infra/hosts/matrix/synapse.nix

{ config, ... }:

let
  fqdn = "matrix.${config.networking.domain}";
in
{
  imports = [
    ../../services/nginx.nix
    ../../services/prometheus-nginx.nix
  ];

  services = {
    matrix-synapse = {
      enable = true;
      settings = {
        server_name = config.networking.domain;
        public_baseurl = "https://${fqdn}:443/";
        # "/var/lib/matrix-synapse/homeserver.signing.key"
        signing_key_path = config.age.secrets.matrix_signing_key.path;
        registration_shared_secret_path = config.age.secrets.matrix_registration_shared_secret.path;
        listeners = [
          {
            type = "http";
            tls = false;
            x_forwarded = true;
            port = 8008;
            bind_addresses = [ "::1" ];
            #request_id_header = "X-Request-ID";
            resources = [
              {
                compress = false;
                names = [
                  "client"
                  "federation"
                ];
              }
            ];
          }
          {
            type = "metrics";
            tls = false;
            port = 9009;
            bind_addresses = [ "::1" ];
            resources = [
              {
                compress = false;
                names = [ "metrics" ];
              }
            ];
          }
        ];
        enable_metrics = true;
        dynamic_thumbnails = true;
        max_upload_size = "128M";
        max_image_pixels = "64M";

        retention = {
          enabled = true;
          default_policy = {
            min_lifetime = "1d";
            max_lifetime = "1y";
          };
          allowed_lifetime_min = "1d";
          allowed_lifetime_max = "1y";
        };
      };
      extraConfigFiles = [
        config.age.secrets.matrix_db_password.path
      ];
      enableRegistrationScript = true;
    };

    nginx.virtualHosts.${fqdn} = {
      default = true;
      quic = true;
      kTLS = true;
      forceSSL = true;
      enableACME = true;
      extraConfig = ''
        proxy_set_header Forwarded "$proxy_forwarded_for_element;$proxy_forwarded_by_element;host=$host;proto=$scheme";
        error_log syslog:server=unix:/dev/log,tag=${builtins.replaceStrings [ "." ] [ "_" ] fqdn} warn;
        access_log syslog:server=unix:/dev/log vhost_combined;
      '';
      locations = {
        "/".return = "418 \"🫖\"";
        "~ ^(/_matrix|/_synapse/client)" = {
          recommendedProxySettings = true;
          proxyPass = "http://[::1]:8008";
          extraConfig = ''
            client_max_body_size 64M;
            proxy_set_header X-Request-ID $request_id;
            proxy_http_version 1.1;
          '';
        };
        "/_synapse/metrics" = {
          proxyPass = "http://[::1]:9009";
          recommendedProxySettings = true;
          extraConfig = ''
            allow 2001:678:760:cccb::14;
            allow 195.160.173.14;
            deny all;
          '';
        };
      };
    };
  };
}