102 lines
2.4 KiB
Nix
102 lines
2.4 KiB
Nix
{ config, pkgs, inputs, lib, ... }:
|
|
let
|
|
domain = "thehellings.com";
|
|
fqdn = "matrix.${domain}";
|
|
conn = "postgresql:///dendrite?sslmode=disable&host=/run/postgresql";
|
|
in
|
|
{
|
|
containers.matrix = {
|
|
autoStart = true;
|
|
bindMounts."/etc/ssh".hostPath = "/etc/ssh";
|
|
config = { pkgs, config, ... }: {
|
|
imports = [
|
|
inputs.agenix.nixosModules.default
|
|
inputs.self.modules.nixosModule
|
|
];
|
|
|
|
nixpkgs.overlays = inputs.self.overlays.all;
|
|
|
|
networking = {
|
|
firewall = {
|
|
enable = true;
|
|
allowedTCPPorts = [ config.services.dendrite.httpPort ];
|
|
};
|
|
useHostResolvConf = lib.mkForce false;
|
|
};
|
|
|
|
# Environment secrets
|
|
age = {
|
|
identityPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
|
|
secrets.dendrite = {
|
|
file = ../../secrets/dendrite.age;
|
|
owner = "dendrite";
|
|
};
|
|
};
|
|
|
|
users.users.dendrite = {
|
|
isSystemUser = true;
|
|
group = "dendrite";
|
|
};
|
|
users.groups.dendrite = {};
|
|
|
|
systemd.services.dendrite.serviceConfig = {
|
|
User = "dendrite";
|
|
};
|
|
|
|
greg = {
|
|
databases.dendrite = {};
|
|
tailscale.enable = true;
|
|
};
|
|
|
|
services.dendrite = {
|
|
enable = true;
|
|
environmentFile = config.age.secrets.dendrite.path;
|
|
httpPort = 8448;
|
|
# Identify ourselves as the root of our own domain
|
|
settings = (
|
|
(builtins.listToAttrs (
|
|
(map (x: { name = x; value = { database.connection_string = conn; }; }) [
|
|
"app_service_api"
|
|
"federation_api"
|
|
"key_server"
|
|
"media_api"
|
|
"mscs"
|
|
"relay_api"
|
|
"room_server"
|
|
"sync_api"
|
|
])
|
|
) ) //
|
|
{
|
|
user_api.account_database.connection_string = conn;
|
|
user_api.device_database.connection_string = conn;
|
|
global = {
|
|
database = {
|
|
connection_string = conn;
|
|
max_open_conns = 25;
|
|
max_idle_conns = 5;
|
|
conn_max_lifetime = -1;
|
|
};
|
|
server_name = "thehellings.com";
|
|
trusted_third_party_id_servers = [
|
|
"matrix.org"
|
|
"vector.im"
|
|
"jupiterbroadcasting.com"
|
|
];
|
|
# Generate this with {path-to-dendrite}/bin/generate-keys --private-key /etc/dendrite.pem
|
|
private_key = "/etc/dendrite.pem";
|
|
};
|
|
client_api = {
|
|
registration_enabled = false;
|
|
registration_shared_secret = "\${REGISTRATION_SHARED_SECRET}";
|
|
};
|
|
});
|
|
};
|
|
|
|
systemd.services.dendrite = {
|
|
after = [ "postgresql.service" ];
|
|
requires = [ "postgresql.service" ];
|
|
};
|
|
};
|
|
};
|
|
}
|