Greg Hellings
00c1adfa2d
Fix the installation of the PostgreSQL install to set the locale Add NGinx bouncer in front of Synapse Fix Synapse install to work properly
83 lines
2.3 KiB
Nix
83 lines
2.3 KiB
Nix
# Registration of new users is disabled for the public, but I can create
|
|
# them by the following commands:
|
|
# nix run nixpkgs.matrix-synapse
|
|
# register_new_matrix_user -k "B9EoPr2WV9hzwc7uL2Sx1JmvCeKDEOGCpB0uginQcQtEH4wzRtkSIdo7lltrjSQa" http://localhost:8448
|
|
{ config, ... }:
|
|
let
|
|
domain = "${config.networking.domain}";
|
|
fqdn = "matrix.${domain}";
|
|
in
|
|
{
|
|
services.nginx = {
|
|
virtualHosts = {
|
|
# Server the '.well-known' files to find the Matrix API server
|
|
"${domain}" = {
|
|
enableACME = true;
|
|
forceSSL = true;
|
|
|
|
# This is needed so that servers contacting hellings.com can find
|
|
# the actual application server at matrix.thehellings.com
|
|
locations."= /.well-known/matrix/server".extraConfig =
|
|
let
|
|
server = { "m.server" = "${fqdn}:443"; };
|
|
in ''
|
|
add_header Content-Type application/json;
|
|
return 200 '${builtins.toJSON server}';
|
|
'';
|
|
|
|
locations."= /.well-known/matrix/client".extraConfig =
|
|
let
|
|
client = {
|
|
"m.homeserver" = { "base_url" = "https://${fqdn}"; };
|
|
"m.identity_server" = { "base_url" = "https://vector.im"; };
|
|
};
|
|
in ''
|
|
add_header Content-Type application/json;
|
|
add_header Access-Control-Allow-Origin *;
|
|
return 200 '${builtins.toJSON client}';
|
|
'';
|
|
};
|
|
|
|
# Reverse proxy in front of the actual Matrix server
|
|
"${fqdn}" = {
|
|
enableACME = true;
|
|
forceSSL = true;
|
|
|
|
# Not the appropriate place for the chat client
|
|
locations."/".extraConfig = "return 404;";
|
|
|
|
locations."/_matrix" = {
|
|
proxyPass = "http://127.0.0.1:8448"; # Lacking the trailing / is correct
|
|
};
|
|
};
|
|
};
|
|
};
|
|
|
|
services.matrix-synapse = {
|
|
enable = true;
|
|
database_name = "synapse";
|
|
database_user = "matrix-synapse";
|
|
# Identify ourselves as the root of our own domain
|
|
server_name = "thehellings.com";
|
|
#registration_shared_secret = "B9EoPr2WV9hzwc7uL2Sx1JmvCeKDEOGCpB0uginQcQtEH4wzRtkSIdo7lltrjSQa";
|
|
# Bind a single listener to localhost only, disable SSL/TLS, and put
|
|
# it behind an nginx proxy
|
|
listeners = [ {
|
|
port = 8448;
|
|
bind_address = "127.0.0.1";
|
|
type = "http"; # Offload SSL/TLS to Nginx
|
|
tls = false;
|
|
resources = [ {
|
|
names = [ "client" "federation" ];
|
|
compress = false; # Offload compressiong to Nginx
|
|
} ];
|
|
} ];
|
|
};
|
|
|
|
# Open networking ports for the server
|
|
networking.firewall = {
|
|
enable = true;
|
|
allowedTCPPorts = [ 80 443 ];
|
|
};
|
|
}
|