nixos-config/hosts/hera/matrix.nix

{ config, ... }:
let
  hostName = "matrix.maralorn.de";
  inherit (config.m-0) hosts;
  inherit (../../lib) unstable;
in {
  networking.firewall.allowedTCPPorts = [ 3478 8448 ];

  m-0.monitoring = [
    {
      name = "matrix";
      host = "matrix:9100";
    }
    {
      name = "matrix-nginx";
      host = "matrix:9113";
    }
  ];

  services.coturn = {
    enable = true;
    pkey = "/var/lib/acme/hera.m-0.eu/key.pem";
    cert = "/var/lib/acme/hera.m-0.eu/fullchain.pem";
    no-tcp = true;
    static-auth-secret = config.m-0.private.turn_secret;
    realm = "maralorn.de";
    use-auth-secret = true;
  };

  containers.matrix = {
    autoStart = true;
    privateNetwork = true;
    hostBridge = "bridge";
    config = { pkgs, lib, ... }: {
      imports = [ ../../system ];
      networking = {
        interfaces.eth0 = {
          ipv6.addresses = [{
            address = hosts.matrix;
            prefixLength = 112;
          }];
          ipv4.addresses = [{
            address = hosts.matrix-intern-v4;
            prefixLength = 24;
          }];
        };
        inherit (config.networking) nameservers;
        defaultGateway6 = {
          address = hosts.hera-intern;
          interface = "eth0";
        };
        defaultGateway = {
          address = hosts.hera-intern-v4;
          interface = "eth0";
        };
        firewall.allowedTCPPorts = [ 80 443 8448 ];
      };
      m-0.riot = {
        enable = true;
        hostname = "riot.maralorn.de";
        config = {
          default_hs_url = "https://matrix.maralorn.de";
          default_is_url = "https://vector.im";
          integrations_ui_url = "";
          integrations_rest_url = "";
          integrations_widgets_urls = [ ];
          bug_report_endpoint_url = "https://riot.im/bugreports/submit";
          welcomeUserId = "@riot-bot:matrix.org";
          piwik = false;
          features = {
            feature_lazyloading = "enable";
            feature_room_breadcrumbs = "enable";
          };
          roomDirectory = { servers = [ "matrix.org" "maralorn.de" ]; };
          branding = {
            welcomeBackgroundUrl =
              "https://cloud.maralorn.de/apps/theming/image/background";
          };
        };
      };
      services = {
        nginx = {
          enable = true;
          virtualHosts."${hostName}" = {
            forceSSL = true;
            enableACME = true;
            locations = {
              "/" = {
                proxyPass = "http://[::1]:8008";
                extraConfig = ''
                  proxy_http_version 1.1;
                  proxy_set_header X-Forwarded-For $remote_addr;
                '';
              };
            };
          };
        };

        # Postgres
        postgresql = { enable = true; };

        # Synapse
        matrix-synapse = {
          enable = true;
          enable_metrics = true;
          server_name = "maralorn.de";
          public_baseurl = "https://${hostName}";
          url_preview_enabled = true;
          database_type = "psycopg2";
          max_upload_size = "30M";
          create_local_database = false;
          dynamic_thumbnails = true;
          macaroon_secret_key = config.m-0.private.macaroon_secret;
          turn_uris = [ "turn:hera.m-0.eu:3478?transport=udp" ];
          turn_shared_secret = config.m-0.private.turn_secret;
          turn_user_lifetime = "5h";
          allow_guest_access = true;
          logConfig = ''
            version: 1

            formatters:
              journal_fmt:
                format: '%(name)s: [%(request)s] %(message)s'

            filters:
              context:
                (): synapse.util.logcontext.LoggingContextFilter
                request: ""

            handlers:
              journal:
                class: systemd.journal.JournalHandler
                formatter: journal_fmt
                filters: [context]
                SYSLOG_IDENTIFIER: synapse

            disable_existing_loggers: True

            loggers:
              synapse:
                level: WARN
              synapse.storage.SQL:
                level: WARN

            root:
              level: WARN
              handlers: [journal]
          '';
          database_args = {
            user = "matrix-synapse";
            database = "matrix-synapse";
            cp_min = 5;
            cp_max = 10;
          };
          report_stats = true;
          tls_certificate_path = "/var/lib/acme/${hostName}/fullchain.pem";
          tls_private_key_path = "/var/lib/acme/${hostName}/key.pem";
          listeners = [
            {
              port = 8448;
              bind_address = "::";
              resources = [
                {
                  compress = true;
                  names = [ "client" ];
                }
                {
                  compress = false;
                  names = [ "federation" ];
                }
              ];
              x_forwarded = false;
            }
            {
              port = 8008;
              bind_address = "::1";
              resources = [
                {
                  compress = false;
                  names = [ "client" ];
                }
                {
                  compress = false;
                  names = [ "federation" ];
                }
              ];
              x_forwarded = true;
              tls = false;
            }
          ];
        };
      };
      security.acme.certs = {
        "${hostName}" = {
          group = "matrix-synapse";
          allowKeysForGroup = true;
          postRun =
            "systemctl reload nginx.service; systemctl restart matrix-synapse.service";
        };
      };
    };
  };

}