5003a40a97
As the nixos module now already sets a RuntimeDirectory, I had to move stuff around and use some `lib.mkForce`.
132 lines
3.6 KiB
Nix
132 lines
3.6 KiB
Nix
{ config, lib, pkgs, ... }:
|
||
|
||
let
|
||
cfg = config.jalr.matrix;
|
||
in
|
||
lib.mkIf cfg.enable {
|
||
services.matrix-synapse = {
|
||
enable = true;
|
||
|
||
settings = {
|
||
server_name = cfg.domain;
|
||
public_baseurl = "https://${cfg.fqdn}";
|
||
|
||
database.name = "sqlite3";
|
||
|
||
listeners = lib.singleton {
|
||
port = cfg.synapse.port;
|
||
bind_addresses = [ "127.0.0.1" "::1" ];
|
||
type = "http";
|
||
tls = false;
|
||
x_forwarded = true;
|
||
resources = lib.singleton {
|
||
names = [ "client" "federation" "metrics" ];
|
||
compress = false;
|
||
};
|
||
};
|
||
|
||
turn_uris = [
|
||
"turns:${cfg.turn.host}:5349?transport=udp"
|
||
"turns:${cfg.turn.host}:5349?transport=tcp"
|
||
"turn:${cfg.turn.host}:3478?transport=udp"
|
||
"turn:${cfg.turn.host}:3478?transport=tcp"
|
||
];
|
||
turn_user_lifetime = "1h";
|
||
|
||
enable_metrics = true;
|
||
|
||
# adapted from https://github.com/NixOS/nixpkgs/blob/7e10bf4327491a6ebccbe1aaa8e6c6c0aca4663a/nixos/modules/services/misc/matrix-synapse-log_config.yaml
|
||
# - set root.level to WARNING instead of INFO
|
||
log_config = pkgs.writeText "log_config.yaml" (builtins.toJSON {
|
||
version = 1;
|
||
|
||
formatters.journal_fmt.format = "%(name)s: [%(request)s] %(message)s";
|
||
|
||
filters.context = {
|
||
"()" = "synapse.util.logcontext.LoggingContextFilter";
|
||
request = "";
|
||
};
|
||
|
||
handlers.journal = {
|
||
class = "systemd.journal.JournalHandler";
|
||
formatter = "journal_fmt";
|
||
filters = [ "context" ];
|
||
SYSLOG_IDENTIFIER = "synapse";
|
||
};
|
||
|
||
root = {
|
||
level = "WARNING";
|
||
handlers = [ "journal" ];
|
||
};
|
||
|
||
disable_existing_loggers = false;
|
||
});
|
||
|
||
max_upload_size = "50M";
|
||
|
||
# I’m okay with using matrix.org as trusted key server
|
||
suppress_key_server_warning = true;
|
||
|
||
# For mautrix-whatsapp backfilling
|
||
experimental_features.msc2716_enabled = true;
|
||
};
|
||
|
||
extraConfigFiles = [
|
||
cfg.turn.sharedSecretFile
|
||
];
|
||
};
|
||
|
||
services.matrix-synapse.settings.app_service_config_files = lib.attrsets.mapAttrsToList
|
||
(
|
||
name: value:
|
||
"/run/matrix-synapse/app_service_config/${name}.yaml"
|
||
)
|
||
cfg.synapse.app_service_config;
|
||
systemd.services.matrix-synapse = {
|
||
restartTriggers = lib.attrsets.mapAttrsToList
|
||
(
|
||
name: value:
|
||
"${value}"
|
||
)
|
||
cfg.synapse.app_service_config;
|
||
serviceConfig = {
|
||
RuntimeDirectory = lib.mkForce [
|
||
"matrix-synapse"
|
||
"matrix-synapse/app_service_config"
|
||
];
|
||
RuntimeDirectoryPreserve = lib.mkForce false;
|
||
ExecStartPre = lib.attrsets.mapAttrsToList
|
||
(name: value:
|
||
let
|
||
script = pkgs.writeShellScript "app_service_config-${name}"
|
||
''
|
||
cp "${value}" "/run/matrix-synapse/app_service_config/${name}.yaml"
|
||
chown matrix-synapse: "/run/matrix-synapse/app_service_config/${name}.yaml"
|
||
'';
|
||
in
|
||
"+${script}"
|
||
)
|
||
cfg.synapse.app_service_config;
|
||
};
|
||
};
|
||
|
||
services.nginx.virtualHosts = {
|
||
"${cfg.fqdn}" = {
|
||
enableACME = true;
|
||
forceSSL = true;
|
||
|
||
locations."/_matrix" =
|
||
let
|
||
listenerCfg = (lib.elemAt config.services.matrix-synapse.settings.listeners 0);
|
||
in
|
||
{
|
||
proxyPass = "http://${lib.elemAt listenerCfg.bind_addresses 0}:${toString listenerCfg.port}";
|
||
|
||
extraConfig = ''
|
||
client_max_body_size ${config.services.matrix-synapse.settings.max_upload_size};
|
||
'';
|
||
};
|
||
};
|
||
|
||
};
|
||
}
|