109 lines
2.7 KiB
Nix
109 lines
2.7 KiB
Nix
args@{ config, lib, pkgs, custom-utils, ... }:
|
||
|
||
let
|
||
cfg = config.services.matrix-synapse.settings;
|
||
fqdn = "matrix.jalr.de";
|
||
domain = "jalr.de";
|
||
turnHost = "turn.jalr.de";
|
||
ports = import ../../ports.nix args;
|
||
in
|
||
{
|
||
sops.secrets = {
|
||
synapse-turn-shared-secret = {
|
||
owner = "matrix-synapse";
|
||
sopsFile = ../../secrets.yaml;
|
||
};
|
||
};
|
||
|
||
services.matrix-synapse = {
|
||
enable = true;
|
||
|
||
settings = {
|
||
server_name = domain;
|
||
public_baseurl = "https://${fqdn}";
|
||
|
||
database.name = "sqlite3";
|
||
|
||
listeners = lib.singleton {
|
||
port = ports.matrix-synapse.tcp;
|
||
bind_addresses = [ "127.0.0.1" "::1" ];
|
||
type = "http";
|
||
tls = false;
|
||
x_forwarded = true;
|
||
resources = lib.singleton {
|
||
names = [ "client" "federation" "metrics" ];
|
||
compress = false;
|
||
};
|
||
};
|
||
|
||
turn_uris = [
|
||
"turns:${turnHost}:5349?transport=udp"
|
||
"turns:${turnHost}:5349?transport=tcp"
|
||
"turn:${turnHost}:3478?transport=udp"
|
||
"turn:${turnHost}:3478?transport=tcp"
|
||
];
|
||
turn_user_lifetime = "1h";
|
||
|
||
enable_metrics = true;
|
||
|
||
# adapted from https://github.com/NixOS/nixpkgs/blob/7e10bf4327491a6ebccbe1aaa8e6c6c0aca4663a/nixos/modules/services/misc/matrix-synapse-log_config.yaml
|
||
# - set root.level to WARNING instead of INFO
|
||
log_config = pkgs.writeText "log_config.yaml" (builtins.toJSON {
|
||
version = 1;
|
||
|
||
formatters.journal_fmt.format = "%(name)s: [%(request)s] %(message)s";
|
||
|
||
filters.context = {
|
||
"()" = "synapse.util.logcontext.LoggingContextFilter";
|
||
request = "";
|
||
};
|
||
|
||
handlers.journal = {
|
||
class = "systemd.journal.JournalHandler";
|
||
formatter = "journal_fmt";
|
||
filters = [ "context" ];
|
||
SYSLOG_IDENTIFIER = "synapse";
|
||
};
|
||
|
||
root = {
|
||
level = "WARNING";
|
||
handlers = [ "journal" ];
|
||
};
|
||
|
||
disable_existing_loggers = false;
|
||
});
|
||
|
||
max_upload_size = "50M";
|
||
|
||
# I’m okay with using matrix.org as trusted key server
|
||
suppress_key_server_warning = true;
|
||
|
||
# For mautrix-whatsapp backfilling
|
||
experimental_features.msc2716_enabled = true;
|
||
};
|
||
|
||
extraConfigFiles = with config.sops.secrets; [
|
||
synapse-turn-shared-secret.path
|
||
];
|
||
};
|
||
|
||
services.nginx.virtualHosts = {
|
||
"${fqdn}" = {
|
||
enableACME = true;
|
||
forceSSL = true;
|
||
|
||
locations."/_matrix" =
|
||
let
|
||
listenerCfg = (lib.elemAt cfg.listeners 0);
|
||
in
|
||
{
|
||
proxyPass = "http://${lib.elemAt listenerCfg.bind_addresses 0}:${toString listenerCfg.port}";
|
||
|
||
extraConfig = ''
|
||
client_max_body_size ${cfg.max_upload_size};
|
||
'';
|
||
};
|
||
};
|
||
|
||
};
|
||
}
|