nixos-config/nixos/roles/matrix-synapse/default.nix

{ pkgs, config, lib, ... }:
let
  server_name = "maralorn.de";
  hostName = "matrix.${server_name}";
in
{
  environment.systemPackages = [ pkgs.matrix-synapse-tools.rust-synapse-compress-state ];
  systemd.services = {
    # use jemalloc to improve the memory situation with synapse
    matrix-synapse.environment = {
      LD_PRELOAD = "${pkgs.jemalloc}/lib/libjemalloc.so";
      SYNAPSE_CACHE_FACTOR = "1.0";
      LimitNOFILE = "4096";
    };
    synapse-cleanup = {
      serviceConfig = {
        ExecStart = pkgs.writeHaskell "synapse-cleanup"
          {
            libraries = builtins.attrValues pkgs.myHaskellScriptPackages ++ [
              pkgs.haskellPackages.postgresql-simple
              pkgs.haskellPackages.HTTP
            ];
            ghcEnv.PATH = "${lib.makeBinPath [ pkgs.matrix-synapse-tools.rust-synapse-compress-state config.services.postgresql.package ]}:$PATH";
            ghcArgs = [ "-threaded" ];
          }
          (builtins.readFile ./synapse-cleanup.hs);
        User = "matrix-synapse";
        Type = "oneshot";
      };
    };
    synapse-worker-1 = { };
  };
  services = {
    nginx = {
      enable = true;
      virtualHosts."${server_name}" = {
        enableACME = true;
        forceSSL = true;
        locations = {
          "/.well-known/matrix/server".extraConfig =
            let
              server."m.server" = "${hostName}:443";
            in
            ''
              add_header Content-Type application/json;
              return 200 '${builtins.toJSON server}';
            '';
          "/.well-known/matrix/client".extraConfig =
            let
              client."m.homeserver".base_url = "https://${hostName}";
            in
            ''
              add_header Content-Type application/json;
              add_header Access-Control-Allow-Origin *;
              return 200 '${builtins.toJSON client}';
            '';
        };
      };
      virtualHosts."${hostName}" = {
        forceSSL = true;
        enableACME = true;
        locations."/" = {
          proxyPass = "http://[::1]:8008";
          extraConfig = ''
            proxy_set_header X-Forwarded-For $remote_addr;
            proxy_set_header X-Forwarded-Proto https;'';
        };
      };
    };

    # Postgres
    postgresql = {
      enable = true;
      settings = import ./postgres-tuning.nix;
      ensureDatabases = [ "matrix-synapse" ];
    };

    # Synapse
    matrix-synapse =
      let
        server-secrets = pkgs.privateValue
          {
            registration_shared_secret = "";
            macaroon_secret_key = "";
          } "matrix/server-secrets";
      in
      server-secrets // {
        enable = true;
        package = pkgs.matrix-synapse;
        enable_metrics = true;
        inherit server_name;
        public_baseurl = "https://${hostName}";
        url_preview_enabled = true;
        database_type = "psycopg2";
        max_upload_size = "30M";
        dynamic_thumbnails = true;
        turn_shared_secret = config.services.coturn.static-auth-secret;
        extraConfig = ''
          serve_server_wellknown: true
        '';
        turn_uris =
          let
            turns = "turns:${config.services.coturn.realm}:${
              toString config.services.coturn.tls-listening-port
              }";
            turn = "turn:${config.services.coturn.realm}:${
              toString config.services.coturn.listening-port
              }";
          in
          [
            "${turns}?transport=udp"
            "${turns}?transport=tcp"
            "${turn}?transport=udp"
            "${turn}?transport=tcp"
          ];
        turn_user_lifetime = "24h";
        allow_guest_access = true;
        logConfig = ''
          version: 1

          formatters:
            journal_fmt:
              format: '%(name)s: [%(request)s] %(message)s'

          filters:
            context:
              (): synapse.util.logcontext.LoggingContextFilter
              request: ""

          handlers:
            journal:
              class: systemd.journal.JournalHandler
              formatter: journal_fmt
              filters: [context]
              SYSLOG_IDENTIFIER: synapse

          disable_existing_loggers: True

          loggers:
            synapse:
              level: WARN
            synapse.storage.SQL:
              level: WARN

          root:
            level: WARN
            handlers: [journal]
        '';
        database_args = {
          user = "matrix-synapse";
          database = "matrix-synapse";
          cp_min = 5;
          cp_max = 10;
        };
        report_stats = true;
        listeners = [
          {
            type = "metrics";
            port = 9148;
            bind_address = "127.0.0.1";
            resources = [ ];
            tls = false;
          }
          {
            port = 8008;
            bind_address = "::1";
            resources = [
              {
                compress = false;
                names = [ "client" ];
              }
              {
                compress = false;
                names = [ "federation" ];
              }
            ];
            x_forwarded = true;
            tls = false;
          }
        ];
      };
  };
}