Greg Hellings
26ecc9d36c
Take all references to Nix stable out Take out hm stable and other inputs th also depended on it Clean up some lints and deadnix code
103 lines
2.5 KiB
Nix
103 lines
2.5 KiB
Nix
{ pkgs, config, ... }:
|
|
let
|
|
conn = "postgresql:///dendrite?sslmode=disable&host=/run/postgresql";
|
|
in
|
|
{
|
|
imports = [ ./hardware-configuration.nix ];
|
|
|
|
environment.systemPackages = with pkgs; [ upgrade-pg-cluster ];
|
|
|
|
boot.loader.grub.devices = [ "/dev/disk/by-label/ESP" ];
|
|
|
|
greg = {
|
|
tailscale.enable = true;
|
|
};
|
|
networking = {
|
|
hostName = "vm-matrix";
|
|
domain = "thehellings.lan";
|
|
firewall.allowedTCPPorts = [ config.services.dendrite.httpPort ];
|
|
};
|
|
|
|
# Environment secrets
|
|
age = {
|
|
secrets.dendrite = {
|
|
file = ../../secrets/dendrite.age;
|
|
owner = "dendrite";
|
|
};
|
|
secrets.dendrite_key = {
|
|
file = ../../secrets/dendrite_key.age;
|
|
owner = "dendrite";
|
|
};
|
|
};
|
|
users.users = {
|
|
dendrite = {
|
|
isSystemUser = true;
|
|
group = "dendrite";
|
|
};
|
|
};
|
|
users.groups.dendrite = { };
|
|
|
|
systemd.services.dendrite.serviceConfig = {
|
|
User = "dendrite";
|
|
};
|
|
|
|
greg.databases.dendrite = { };
|
|
|
|
services.dendrite = {
|
|
enable = true;
|
|
environmentFile = config.age.secrets.dendrite.path;
|
|
httpPort = 8448;
|
|
# Identify ourselves as the root of our own domain
|
|
settings = (
|
|
(builtins.listToAttrs (
|
|
map
|
|
(x: {
|
|
name = x;
|
|
value = {
|
|
database.connection_string = conn;
|
|
};
|
|
})
|
|
[
|
|
"app_service_api"
|
|
"federation_api"
|
|
"key_server"
|
|
"media_api"
|
|
"mscs"
|
|
"relay_api"
|
|
"room_server"
|
|
"sync_api"
|
|
]
|
|
))
|
|
// {
|
|
user_api.account_database.connection_string = conn;
|
|
user_api.device_database.connection_string = conn;
|
|
global = {
|
|
database = {
|
|
connection_string = conn;
|
|
max_open_conns = 25;
|
|
max_idle_conns = 5;
|
|
conn_max_lifetime = -1;
|
|
};
|
|
server_name = "thehellings.com";
|
|
trusted_third_party_id_servers = [
|
|
"matrix.org"
|
|
"vector.im"
|
|
"jupiterbroadcasting.com"
|
|
];
|
|
# Generate this with {path-to-dendrite}/bin/generate-keys --private-key /etc/dendrite.pem
|
|
private_key = config.age.secrets.dendrite_key.path;
|
|
};
|
|
client_api = {
|
|
registration_disabled = true;
|
|
registration_shared_secret = "\${REGISTRATION_SHARED_SECRET}";
|
|
};
|
|
}
|
|
);
|
|
};
|
|
|
|
systemd.services.dendrite = {
|
|
after = [ "postgresql.service" ];
|
|
requires = [ "postgresql.service" ];
|
|
};
|
|
}
|