Fix Synapse installation

Fix the installation of the PostgreSQL install to set the locale
Add NGinx bouncer in front of Synapse
Fix Synapse install to work properly

hosts/linode/default.nix

@@ -3,7 +3,10 @@
 {
 	imports = [
 		../../profiles/linode.nix
+		./nginx.nix
 		./postgres.nix
+		./synapse.nix
 	];
 	networking.hostName = "linode";
+	networking.domain = "thehellings.com";
 }

hosts/linode/nginx.nix

@@ -0,0 +1,35 @@
+{ ... }:
+let
+	homepage = "127.0.0.1:30080";
+in
+{
+	security.acme = {
+		acceptTerms = true;
+		email = "greg.hellings@gmail.com";
+	};
+
+	services.nginx = {
+		enable = true;
+
+		# If there are recommended settings, let's use them!
+		recommendedGzipSettings = true;
+		recommendedOptimisation = true;
+		recommendedProxySettings = true;
+		recommendedTlsSettings = true;
+	};
+
+	# Actually serve the content from here
+	virtualisation.podman.enable = true;
+	virtualisation.oci-containers = {
+		backend = "podman";
+		containers."homepage" = {
+			image = "ghcr.io/greg-hellings/homepage:latest";
+			ports = [ "${homepage}:80" ];
+		};
+	};
+	services.nginx.virtualHosts = {
+		"thehellings.com" = {
+			locations."/".proxyPass = "http://${homepage}/";
+		};
+	};
+}

hosts/linode/postgres.nix

@@ -1,13 +1,18 @@
-{ config, ... }:
+{ config, pkgs, ... }:
 
 {
 	services.postgresql = {
 		enable = true;
 		checkConfig = true;
-		ensureDatabases = [ "synapse" "nextcloud" ];
+		ensureDatabases = [ "nextcloud" ];
+		initialScript = pkgs.writeText "create-matrix-db.sql" ''
+			CREATE ROLE "matrix-synapse" WITH LOGIN;
+			CREATE DATABASE "synapse" WITH OWNER "matrix-synapse" TEMPLATE template0 LC_COLLATE = "C" LC_CTYPE = "C";
+			GRANT ALL PRIVILEGES ON DATABASE "synapse" TO "matrix-synapse";
+		'';  # These are done manually in order to set the LC_COLLATE values properly
 		ensureUsers = [ {
-			name = "synapse";
+			name = "nextcloud";
-			ensurePermissions."DATABASE synapse" = "ALL PRIVILEGES";
+			ensurePermissions."DATABASE nextcloud" = "ALL PRIVILEGES";
 		} {
 			name = "root";
 			ensurePermissions."ALL TABLES IN SCHEMA public" = "ALL PRIVILEGES";
@@ -18,7 +23,7 @@
 			logging_collector = true;
 		};
 		identMap = ''
-root root root
+root root postgres
 '';
 	};
 

hosts/linode/synapse.nix

@@ -0,0 +1,82 @@
+# Registration of new users is disabled for the public, but I can create
+# them by the following commands:
+# nix run nixpkgs.matrix-synapse
+# register_new_matrix_user -k "B9EoPr2WV9hzwc7uL2Sx1JmvCeKDEOGCpB0uginQcQtEH4wzRtkSIdo7lltrjSQa" http://localhost:8448
+{ config, ... }:
+let
+	domain = "${config.networking.domain}";
+	fqdn = "matrix.${domain}";
+in
+{
+	services.nginx = {
+		virtualHosts = {
+			# Server the '.well-known' files to find the Matrix API server
+			"${domain}" = {
+				enableACME = true;
+				forceSSL = true;
+
+				# This is needed so that servers contacting hellings.com can find
+				# the actual application server at matrix.thehellings.com
+				locations."= /.well-known/matrix/server".extraConfig =
+					let
+						server = { "m.server" = "${fqdn}:443"; };
+					in ''
+add_header Content-Type application/json;
+return 200 '${builtins.toJSON server}';
+'';
+
+				locations."= /.well-known/matrix/client".extraConfig =
+					let
+						client = {
+							"m.homeserver" = { "base_url" = "https://${fqdn}"; };
+							"m.identity_server" = { "base_url" = "https://vector.im"; };
+						};
+					in ''
+add_header Content-Type application/json;
+add_header Access-Control-Allow-Origin *;
+return 200 '${builtins.toJSON client}';
+'';
+			};
+
+			# Reverse proxy in front of the actual Matrix server
+			"${fqdn}" = {
+				enableACME = true;
+				forceSSL = true;
+
+				# Not the appropriate place for the chat client
+				locations."/".extraConfig = "return 404;";
+
+				locations."/_matrix" = {
+					proxyPass = "http://127.0.0.1:8448"; # Lacking the trailing / is correct
+				};
+			};
+		};
+	};
+
+	services.matrix-synapse = {
+		enable = true;
+		database_name = "synapse";
+		database_user = "matrix-synapse";
+		# Identify ourselves as the root of our own domain
+		server_name = "thehellings.com";
+		#registration_shared_secret = "B9EoPr2WV9hzwc7uL2Sx1JmvCeKDEOGCpB0uginQcQtEH4wzRtkSIdo7lltrjSQa";
+		# Bind a single listener to localhost only, disable SSL/TLS, and put
+		# it behind an nginx proxy
+		listeners = [ {
+			port = 8448;
+			bind_address = "127.0.0.1";
+			type = "http";  # Offload SSL/TLS to Nginx
+			tls = false;
+			resources = [ {
+				names = [ "client" "federation" ];
+				compress = false;  # Offload compressiong to Nginx
+			} ];
+		} ];
+	};
+
+	# Open networking ports for the server
+	networking.firewall = {
+		enable = true;
+		allowedTCPPorts = [ 80 443 ];
+	};
+}