Self-host your own digital island
ryan.freumh.org
1{ config, pkgs, lib, ... }:
2
3with lib;
4let
5 cfg = config.eilean;
6 turnSharedSecretFile = "/run/matrix-synapse/turn-shared-secret";
7 domain = config.networking.domain;
8 subdomain = "matrix.${domain}";
9in {
10 options.eilean.matrix = {
11 enable = mkEnableOption "matrix";
12 turn = mkOption {
13 type = types.bool;
14 default = true;
15 };
16 registrationSecretFile = mkOption {
17 type = types.nullOr types.str;
18 default = null;
19 };
20 bridges = {
21 whatsapp = mkOption {
22 type = types.bool;
23 default = false;
24 description = "Enable WhatsApp bridge.";
25 };
26 signal = mkOption {
27 type = types.bool;
28 default = false;
29 description = "Enable Signal bridge.";
30 };
31 instagram = mkOption {
32 type = types.bool;
33 default = false;
34 description = "Enable Instagram bridge.";
35 };
36 messenger = mkOption {
37 type = types.bool;
38 default = false;
39 description = "Enable Facebook Messenger bridge.";
40 };
41 };
42 };
43
44 config = mkIf cfg.matrix.enable {
45 services.postgresql.enable = true;
46 services.postgresql.package = pkgs.postgresql_13;
47 services.postgresql.initialScript = pkgs.writeText "synapse-init.sql" ''
48 CREATE ROLE "matrix-synapse" WITH LOGIN PASSWORD 'synapse';
49 CREATE DATABASE "matrix-synapse" WITH OWNER "matrix-synapse"
50 TEMPLATE template0
51 LC_COLLATE = "C"
52 LC_CTYPE = "C";
53 '';
54
55 security.acme-eon.nginxCerts = lib.mkIf cfg.acme-eon [ domain subdomain ];
56
57 services.nginx = {
58 enable = true;
59 # only recommendedProxySettings and recommendedGzipSettings are strictly required,
60 # but the rest make sense as well
61 recommendedTlsSettings = true;
62 recommendedOptimisation = true;
63 recommendedGzipSettings = true;
64 recommendedProxySettings = true;
65
66 virtualHosts = {
67 # This host section can be placed on a different host than the rest,
68 # i.e. to delegate from the host being accessible as ${domain}
69 # to another host actually running the Matrix homeserver.
70 "${domain}" = {
71 enableACME = lib.mkIf (!cfg.acme-eon) true;
72 forceSSL = true;
73
74 locations."= /.well-known/matrix/server".extraConfig = let
75 # use 443 instead of the default 8448 port to unite
76 # the client-server and server-server port for simplicity
77 server = { "m.server" = "${subdomain}:443"; };
78 in ''
79 default_type application/json;
80 return 200 '${builtins.toJSON server}';
81 '';
82 locations."= /.well-known/matrix/client".extraConfig = let
83 client = {
84 "m.homeserver" = { "base_url" = "https://${subdomain}"; };
85 "m.identity_server" = { "base_url" = "https://vector.im"; };
86 };
87 # ACAO required to allow element-web on any URL to request this json file
88 # set other headers due to https://github.com/yandex/gixy/blob/master/docs/en/plugins/addheaderredefinition.md
89 in ''
90 default_type application/json;
91 add_header Access-Control-Allow-Origin *;
92 add_header Strict-Transport-Security max-age=31536000 always;
93 add_header X-Frame-Options SAMEORIGIN always;
94 add_header X-Content-Type-Options nosniff always;
95 add_header Content-Security-Policy "default-src 'self'; base-uri 'self'; frame-src 'self'; frame-ancestors 'self'; form-action 'self';" always;
96 add_header Referrer-Policy 'same-origin';
97 return 200 '${builtins.toJSON client}';
98 '';
99 };
100
101 # Reverse proxy for Matrix client-server and server-server communication
102 "${subdomain}" = {
103 enableACME = lib.mkIf (!cfg.acme-eon) true;
104 forceSSL = true;
105
106 # Or do a redirect instead of the 404, or whatever is appropriate for you.
107 # But do not put a Matrix Web client here! See the Element web section below.
108 locations."/".extraConfig = ''
109 return 404;
110 '';
111
112 # forward all Matrix API calls to the synapse Matrix homeserver
113 locations."~ ^(\\/_matrix|\\/_synapse\\/client)" = {
114 proxyPass = "http://127.0.0.1:8008";
115 };
116 };
117 };
118 };
119
120 services.matrix-synapse = {
121 enable = true;
122 settings = mkMerge [
123 {
124 server_name = domain;
125 enable_registration = true;
126 registration_requires_token = true;
127 registration_shared_secret_path = cfg.matrix.registrationSecretFile;
128 listeners = [{
129 port = 8008;
130 bind_addresses = [ "::1" "127.0.0.1" ];
131 type = "http";
132 tls = false;
133 x_forwarded = true;
134 resources = [{
135 names = [ "client" "federation" ];
136 compress = false;
137 }];
138 }];
139 max_upload_size = "100M";
140 app_service_config_files =
141 (optional cfg.matrix.bridges.instagram
142 "/var/lib/mautrix-instagram/instagram-registration.yaml")
143 ++ (optional cfg.matrix.bridges.messenger
144 "/var/lib/mautrix-messenger/messenger-registration.yaml");
145 }
146 (mkIf cfg.matrix.turn {
147 turn_uris = with config.services.coturn; [
148 "turn:${realm}:3478?transport=udp"
149 "turn:${realm}:3478?transport=tcp"
150 "turns:${realm}:5349?transport=udp"
151 "turns:${realm}:5349?transport=tcp"
152 ];
153 turn_user_lifetime = "1h";
154 })
155 ];
156 extraConfigFiles = mkIf cfg.matrix.turn ([ turnSharedSecretFile ]);
157 };
158
159 systemd.services.matrix-synapse-turn-shared-secret-generator =
160 mkIf cfg.matrix.turn {
161 description = "Generate matrix synapse turn shared secret config file";
162 script = ''
163 mkdir -p "$(dirname '${turnSharedSecretFile}')"
164 echo "turn_shared_secret: $(cat '${config.services.coturn.static-auth-secret-file}')" > '${turnSharedSecretFile}'
165 chmod 770 '${turnSharedSecretFile}'
166 chown ${config.systemd.services.matrix-synapse.serviceConfig.User}:${config.systemd.services.matrix-synapse.serviceConfig.Group} '${turnSharedSecretFile}'
167 '';
168 serviceConfig.Type = "oneshot";
169 serviceConfig.RemainAfterExit = true;
170 after = [ "coturn-static-auth-secret-generator.service" ];
171 requires = [ "coturn-static-auth-secret-generator.service" ];
172 };
173 systemd.services."matrix-synapse".after = mkIf cfg.matrix.turn
174 [ "matrix-synapse-turn-shared-secret-generator.service" ];
175 systemd.services."matrix-synapse".requires = mkIf cfg.matrix.turn
176 [ "matrix-synapse-turn-shared-secret-generator.service" ];
177
178 systemd.services.matrix-synapse.serviceConfig.SupplementaryGroups =
179 # remove after https://github.com/NixOS/nixpkgs/pull/311681/files
180 (optional cfg.matrix.bridges.whatsapp
181 config.systemd.services.mautrix-whatsapp.serviceConfig.Group)
182 ++ (optional cfg.matrix.bridges.instagram
183 config.systemd.services.mautrix-instagram.serviceConfig.Group)
184 ++ (optional cfg.matrix.bridges.messenger
185 config.systemd.services.mautrix-messenger.serviceConfig.Group);
186
187 services.mautrix-whatsapp = mkIf cfg.matrix.bridges.whatsapp {
188 enable = true;
189 settings.homeserver.address = "https://${subdomain}";
190 settings.homeserver.domain = domain;
191 settings.appservice.hostname = "localhost";
192 settings.appservice.address = "http://localhost:29318";
193 settings.bridge.personal_filtering_spaces = true;
194 settings.bridge.history_sync.backfill = false;
195 settings.bridge.permissions."@${config.eilean.username}:${domain}" =
196 "admin";
197 settings.bridge.encryption.allow = true;
198 settings.bridge.encryption.default = true;
199 };
200 # using https://github.com/NixOS/nixpkgs/pull/277368
201 services.mautrix-signal = mkIf cfg.matrix.bridges.signal {
202 enable = true;
203 settings.homeserver.address = "https://${subdomain}";
204 settings.homeserver.domain = domain;
205 settings.appservice.hostname = "localhost";
206 settings.appservice.address = "http://localhost:29328";
207 settings.bridge.personal_filtering_spaces = true;
208 settings.bridge.permissions."@${config.eilean.username}:${domain}" =
209 "admin";
210 settings.bridge.encryption.allow = true;
211 settings.bridge.encryption.default = true;
212 };
213 # TODO replace with upstreamed mautrix-meta
214 services.mautrix-instagram = mkIf cfg.matrix.bridges.instagram {
215 enable = true;
216 settings.homeserver.address = "https://${subdomain}";
217 settings.homeserver.domain = domain;
218 settings.appservice.hostname = "localhost";
219 settings.appservice.address = "http://localhost:29319";
220 settings.bridge.personal_filtering_spaces = true;
221 settings.bridge.backfill.enabled = false;
222 settings.bridge.permissions."@${config.eilean.username}:${domain}" =
223 "admin";
224 settings.bridge.encryption.allow = true;
225 settings.bridge.encryption.default = true;
226 };
227 services.mautrix-messenger = mkIf cfg.matrix.bridges.messenger {
228 enable = true;
229 settings.homeserver.address = "https://${subdomain}";
230 settings.homeserver.domain = domain;
231 settings.appservice.hostname = "localhost";
232 settings.appservice.address = "http://localhost:29320";
233 settings.bridge.personal_filtering_spaces = true;
234 settings.bridge.backfill.enabled = false;
235 settings.bridge.permissions."@${config.eilean.username}:${domain}" =
236 "admin";
237 settings.bridge.encryption.allow = true;
238 settings.bridge.encryption.default = true;
239 };
240
241 eilean.turn.enable = mkIf cfg.matrix.turn true;
242
243 eilean.dns.enable = true;
244 eilean.services.dns.zones.${domain}.records = [{
245 name = "matrix";
246 type = "CNAME";
247 value = cfg.domainName;
248 }];
249 };
250}