Self-host your own digital island
ryan.freumh.org
1{ config, pkgs, lib, ... }:
2
3with lib;
4let
5 cfg = config.eilean;
6 turnSharedSecretFile = "/run/matrix-synapse/turn-shared-secret";
7 domain = config.networking.domain;
8 subdomain = "matrix.${domain}";
9in {
10 options.eilean.matrix = {
11 enable = mkEnableOption "matrix";
12 turn = mkOption {
13 type = types.bool;
14 default = true;
15 };
16 registrationSecretFile = mkOption {
17 type = types.nullOr types.str;
18 default = null;
19 };
20 bridges = {
21 whatsapp = mkOption {
22 type = types.bool;
23 default = false;
24 description = "Enable WhatsApp bridge.";
25 };
26 signal = mkOption {
27 type = types.bool;
28 default = false;
29 description = "Enable Signal bridge.";
30 };
31 instagram = mkOption {
32 type = types.bool;
33 default = false;
34 description = "Enable Instagram bridge.";
35 };
36 messenger = mkOption {
37 type = types.bool;
38 default = false;
39 description = "Enable Facebook Messenger bridge.";
40 };
41 };
42 };
43
44 config = mkIf cfg.matrix.enable {
45 services.postgresql.enable = true;
46 services.postgresql.package = pkgs.postgresql_13;
47 services.postgresql.initialScript = pkgs.writeText "synapse-init.sql" ''
48 CREATE ROLE "matrix-synapse" WITH LOGIN PASSWORD 'synapse';
49 CREATE DATABASE "matrix-synapse" WITH OWNER "matrix-synapse"
50 TEMPLATE template0
51 LC_COLLATE = "C"
52 LC_CTYPE = "C";
53 '';
54
55 security.acme-eon.nginxCerts = lib.mkIf cfg.acme-eon [ domain subdomain ];
56
57 services.nginx = {
58 enable = true;
59 # only recommendedProxySettings and recommendedGzipSettings are strictly required,
60 # but the rest make sense as well
61 recommendedTlsSettings = true;
62 recommendedOptimisation = true;
63 recommendedGzipSettings = true;
64 recommendedProxySettings = true;
65
66 virtualHosts = {
67 # This host section can be placed on a different host than the rest,
68 # i.e. to delegate from the host being accessible as ${domain}
69 # to another host actually running the Matrix homeserver.
70 "${domain}" = {
71 enableACME = lib.mkIf (!cfg.acme-eon) true;
72 forceSSL = true;
73
74 locations."= /.well-known/matrix/server".extraConfig = let
75 # use 443 instead of the default 8448 port to unite
76 # the client-server and server-server port for simplicity
77 server = { "m.server" = "${subdomain}:443"; };
78 in ''
79 default_type application/json;
80 return 200 '${builtins.toJSON server}';
81 '';
82 locations."= /.well-known/matrix/client".extraConfig = let
83 client = {
84 "m.homeserver" = { "base_url" = "https://${subdomain}"; };
85 "m.identity_server" = { "base_url" = "https://vector.im"; };
86 };
87 # ACAO required to allow element-web on any URL to request this json file
88 # set other headers due to https://github.com/yandex/gixy/blob/master/docs/en/plugins/addheaderredefinition.md
89 in ''
90 default_type application/json;
91 add_header Access-Control-Allow-Origin *;
92 add_header Strict-Transport-Security max-age=31536000 always;
93 add_header X-Frame-Options SAMEORIGIN always;
94 add_header X-Content-Type-Options nosniff always;
95 add_header Content-Security-Policy "default-src 'self'; base-uri 'self'; frame-src 'self'; frame-ancestors 'self'; form-action 'self';" always;
96 add_header Referrer-Policy 'same-origin';
97 return 200 '${builtins.toJSON client}';
98 '';
99 };
100
101 # Reverse proxy for Matrix client-server and server-server communication
102 "${subdomain}" = {
103 enableACME = lib.mkIf (!cfg.acme-eon) true;
104 forceSSL = true;
105
106 # Or do a redirect instead of the 404, or whatever is appropriate for you.
107 # But do not put a Matrix Web client here! See the Element web section below.
108 locations."/".extraConfig = ''
109 return 404;
110 '';
111
112 # forward all Matrix API calls to the synapse Matrix homeserver
113 locations."/_matrix" = {
114 proxyPass = "http://127.0.0.1:8008"; # without a trailing /
115 #proxyPassReverse = "http://127.0.0.1:8008"; # without a trailing /
116 };
117 };
118 };
119 };
120
121 services.matrix-synapse = {
122 enable = true;
123 settings = mkMerge [
124 {
125 server_name = domain;
126 enable_registration = true;
127 registration_requires_token = true;
128 registration_shared_secret_path = cfg.matrix.registrationSecretFile;
129 listeners = [{
130 port = 8008;
131 bind_addresses = [ "::1" "127.0.0.1" ];
132 type = "http";
133 tls = false;
134 x_forwarded = true;
135 resources = [{
136 names = [ "client" "federation" ];
137 compress = false;
138 }];
139 }];
140 max_upload_size = "100M";
141 app_service_config_files = (optional cfg.matrix.bridges.whatsapp
142 "/var/lib/mautrix-whatsapp/whatsapp-registration.yaml")
143 ++ (optional cfg.matrix.bridges.instagram
144 "/var/lib/mautrix-instagram/instagram-registration.yaml")
145 ++ (optional cfg.matrix.bridges.messenger
146 "/var/lib/mautrix-messenger/messenger-registration.yaml");
147 }
148 (mkIf cfg.matrix.turn {
149 turn_uris = with config.services.coturn; [
150 "turn:${realm}:3478?transport=udp"
151 "turn:${realm}:3478?transport=tcp"
152 "turns:${realm}:5349?transport=udp"
153 "turns:${realm}:5349?transport=tcp"
154 ];
155 turn_user_lifetime = "1h";
156 })
157 ];
158 extraConfigFiles = mkIf cfg.matrix.turn ([ turnSharedSecretFile ]);
159 };
160
161 systemd.services.matrix-synapse-turn-shared-secret-generator =
162 mkIf cfg.matrix.turn {
163 description = "Generate matrix synapse turn shared secret config file";
164 script = ''
165 mkdir -p "$(dirname '${turnSharedSecretFile}')"
166 echo "turn_shared_secret: $(cat '${config.services.coturn.static-auth-secret-file}')" > '${turnSharedSecretFile}'
167 chmod 770 '${turnSharedSecretFile}'
168 chown ${config.systemd.services.matrix-synapse.serviceConfig.User}:${config.systemd.services.matrix-synapse.serviceConfig.Group} '${turnSharedSecretFile}'
169 '';
170 serviceConfig.Type = "oneshot";
171 serviceConfig.RemainAfterExit = true;
172 after = [ "coturn-static-auth-secret-generator.service" ];
173 requires = [ "coturn-static-auth-secret-generator.service" ];
174 };
175 systemd.services."matrix-synapse".after = mkIf cfg.matrix.turn
176 [ "matrix-synapse-turn-shared-secret-generator.service" ];
177 systemd.services."matrix-synapse".requires = mkIf cfg.matrix.turn
178 [ "matrix-synapse-turn-shared-secret-generator.service" ];
179
180 systemd.services.matrix-synapse.serviceConfig.SupplementaryGroups =
181 # remove after https://github.com/NixOS/nixpkgs/pull/311681/files
182 (optional cfg.matrix.bridges.whatsapp
183 config.systemd.services.mautrix-whatsapp.serviceConfig.Group)
184 ++ (optional cfg.matrix.bridges.instagram
185 config.systemd.services.mautrix-instagram.serviceConfig.Group)
186 ++ (optional cfg.matrix.bridges.messenger
187 config.systemd.services.mautrix-messenger.serviceConfig.Group);
188
189 services.mautrix-whatsapp = mkIf cfg.matrix.bridges.whatsapp {
190 enable = true;
191 settings.homeserver.address = "https://${subdomain}";
192 settings.homeserver.domain = domain;
193 settings.appservice.hostname = "localhost";
194 settings.appservice.address = "http://localhost:29318";
195 settings.bridge.personal_filtering_spaces = true;
196 settings.bridge.history_sync.backfill = false;
197 settings.bridge.permissions."@${config.eilean.username}:${domain}" =
198 "admin";
199 };
200 # using https://github.com/NixOS/nixpkgs/pull/277368
201 services.mautrix-signal = mkIf cfg.matrix.bridges.signal {
202 enable = true;
203 settings.homeserver.address = "https://${subdomain}";
204 settings.homeserver.domain = domain;
205 settings.appservice.hostname = "localhost";
206 settings.appservice.address = "http://localhost:29328";
207 settings.bridge.personal_filtering_spaces = true;
208 settings.bridge.permissions."@${config.eilean.username}:${domain}" =
209 "admin";
210 };
211 # TODO replace with upstreamed mautrix-meta
212 services.mautrix-instagram = mkIf cfg.matrix.bridges.instagram {
213 enable = true;
214 settings.homeserver.address = "https://${subdomain}";
215 settings.homeserver.domain = domain;
216 settings.appservice.hostname = "localhost";
217 settings.appservice.address = "http://localhost:29319";
218 settings.bridge.personal_filtering_spaces = true;
219 settings.bridge.backfill.enabled = false;
220 settings.bridge.permissions."@${config.eilean.username}:${domain}" =
221 "admin";
222 };
223 services.mautrix-messenger = mkIf cfg.matrix.bridges.messenger {
224 enable = true;
225 settings.homeserver.address = "https://${subdomain}";
226 settings.homeserver.domain = domain;
227 settings.appservice.hostname = "localhost";
228 settings.appservice.address = "http://localhost:29320";
229 settings.bridge.personal_filtering_spaces = true;
230 settings.bridge.backfill.enabled = false;
231 settings.bridge.permissions."@${config.eilean.username}:${domain}" =
232 "admin";
233 };
234
235 eilean.turn.enable = mkIf cfg.matrix.turn true;
236
237 eilean.dns.enable = true;
238 eilean.services.dns.zones.${domain}.records = [{
239 name = "matrix";
240 type = "CNAME";
241 data = cfg.domainName;
242 }];
243 };
244}