helm/profiles/matrix/default.nix

{ config, lib, pkgs, ... }:

{

  services.matrix-synapse = {
    enable = true;
    settings = {
      server_name = "sealight.xyz";
      listeners = [
        {
          port = 8448;
          tls = false;
          resources = [{
            compress = true;
            names = [ "client" "federation" ];
          }];
        }
        {
          port = 9090;
          type = "metrics";
          bind_addresses = [ "0.0.0.0" ];
          resources = [{
            compress = false;
            names = [ ];
          }];
          tls = false;
        }
      ];
      app_service_config_files = [
        #   The registration file is automatically generated after starting the appservice for the first time.
        #   cp /var/lib/matrix-appservice-discord/discord-registration.yaml /var/lib/matrix-synapse/
        #   chown matrix-synapse:matrix-synapse /var/lib/matrix-synapse/discord-registration.yaml
        "/var/lib/matrix-synapse/telegram-registration.yaml"
        # "/var/lib/matrix-synapse/slack-registration.yaml"
        # "/var/lib/matrix-synapse/discord-registration.yaml"
        # "/var/lib/matrix-synapse/whatsapp-registration.yaml"
      ];
      turn_uris = [
        "turn:turn.sealight.xyz:3478?transport=udp"
        "turn:turn.sealight.xyz:3478?transport=tcp"
      ];
      turn_shared_secret = config.services.coturn.static-auth-secret;
      extraConfig = ''
        max_upload_size: "50M"
        use_presence: false
        registration_shared_secret: "hD9HQGTTDxp0mQsQ5JDsfudWMDiubmZENOgPchIvfBvUlPxlvQSvjoO4wn2L1seU";
      '';
      enable_metrics = true;
      enable_registration = false;
      database = {
        name = "psycopg2";
        args.password = "Da0?H*9i{x?,]|kq@iBwlIzu"; # TODO agenix
      };
    };
    ## coturn based TURN server integration (TURN server setup mentioned later),
    ## shared secret generated while configuring coturn
    ## and reused here (power of Nix being a real programming language)
  };

  services.coturn = {
    enable = true;
    use-auth-secret = true;
    static-auth-secret = "jXW1ohIq6wM3NB00xeME3uBihY85xjpkhGoyzBIdwhOpj7gjyxXZu1fwp1lUiYwJ"; # TODO agenix
    realm = "turn.sealight.xyz";
    min-port = 49111;
    max-port = 51111;
    no-cli = true;
    no-tcp-relay = true;
    no-tls = true;
    cert = "${config.security.acme.certs."turn.sealight.xyz".directory}/full.pem";
    pkey = "${config.security.acme.certs."turn.sealight.xyz".directory}/key.pem";
    extraConfig = ''
      verbose
      user-quota=12
      total-quota=1200
      denied-peer-ip=10.0.0.0-10.255.255.255
      denied-peer-ip=192.168.0.0-192.168.255.255
      denied-peer-ip=172.16.0.0-172.31.255.255
      denied-peer-ip=0.0.0.0-0.255.255.255
      denied-peer-ip=100.64.0.0-100.127.255.255
      denied-peer-ip=127.0.0.0-127.255.255.255
      denied-peer-ip=169.254.0.0-169.254.255.255
      denied-peer-ip=192.0.0.0-192.0.0.255
      denied-peer-ip=192.0.2.0-192.0.2.255
      denied-peer-ip=192.88.99.0-192.88.99.255
      denied-peer-ip=198.18.0.0-198.19.255.255
      denied-peer-ip=198.51.100.0-198.51.100.255
      denied-peer-ip=203.0.113.0-203.0.113.255
      denied-peer-ip=240.0.0.0-255.255.255.255
    '';
  };

  security.acme.certs.${config.services.coturn.realm} = {
    /* insert here the right configuration to obtain a certificate */
    webroot = "/var/lib/acme/acme-challenge/";
    email = "anish+acme@lakhwara.com";
    postRun = "systemctl restart coturn.service";
    group = "turnserver";
  };

  # TODO fix up jitsi bridge stuff
  ## services.jitsi-meet = {
  ##   enable = true;
  ##   hostName = "jitsi.sealight.xyz";
  ## };
  ## services.jitsi-videobridge.enable = true;

  services.postgresql = {
    enable = true;
    package = pkgs.postgresql_14;
    ## postgresql user and db name remains in the
    ## service.matrix-synapse.database_args setting which
    ## by default is matrix-synapse
    # TODO agenix
    initialScript = pkgs.writeText "synapse-init.sql" ''
      CREATE ROLE "matrix-synapse" WITH LOGIN PASSWORD "Da0?H*9i{x?,]|kq@iBwlIzu"; 
      CREATE DATABASE "matrix-synapse" WITH OWNER "matrix-synapse"
          TEMPLATE template0
          LC_COLLATE = "C"
          LC_CTYPE = "C";
    '';
    authentication = ''
      local matrix-synapse all ident map=matrix-synapse-users
    '';
    identMap = # Map the matrix-synapse user to postgresql
      ''
        matrix-synapse-users matrix-synapse matrix-synapse
      '';
  };

  networking.firewall =
    let
      range = with config.services.coturn; [{
        from = min-port;
        to = max-port;
      }];
    in
    {
      enable = true;
      allowedUDPPortRanges = range; # coturn
      allowedTCPPortRanges = range;
      allowedTCPPorts = [
        22 # SSH
        8448 # Matrix federation
        8008
        80
        443
        3478 # Coturn service
        5349 # Coturn service
        9090 # Synapse Metrics
      ];
      allowedUDPPorts = [
        3478
        5349 # Coturn service
      ];
    };

  nixpkgs.overlays = [
    (self: super: {
      element-web = super.element-web.override {
        conf = {
          default_server_config = {
            "m.homeserver" = {
              "base_url" = "https://chat.sealight.xyz";
              "server_name" = "sealight.xyz";
            };
            "m.identity_server" = {
              "base_url" = "https://vector.im";
            };
          };

          ## jitsi will be setup later,
          ## but we need to add to Riot configuration
          jitsi.preferredDomain = "jitsi.sealight.xyz";
        };
      };
    })
  ];

  services.nginx = {
    enable = true;
    virtualHosts = {
      "sealight.xyz" = {
        forceSSL = true;
        enableACME = true;
        locations."/" = {
          root = "/var/www/sealight.xyz";
        };
        locations."/_matrix" = {
          proxyPass = "http://localhost:8448";
        };
        # locations."/slackbridge" = {
        #   proxyPass = "http://localhost:9899";
        # };
      };
      ## virtual host for Synapse
      "chat.sealight.xyz" = {
        forceSSL = true;
        enableACME = true; # TODO
        #useACMEHost = "sealight.xyz";
        locations."/" = {
          proxyPass = "http://localhost:8448";
        };
      };
      ## virtual host for Riot/Web
      "element.sealight.xyz" = {
        forceSSL = true;
        enableACME = true; # TODO
        #useACMEHost = "sealight.xyz"; 
        ## root points to the riot-web package content, also configured via Nix
        locations."/" = {
          root = pkgs.element-web;
        };
      };
      # ${config.services.jitsi-meet.hostName} = {
      #  enableACME = true; # TODO
      #  forceSSL = true; # TODO
      # };
    };
    ## other nginx specific best practices
    recommendedGzipSettings = true;
    recommendedOptimisation = true;
    recommendedTlsSettings = true;
  };

  services.mautrix-telegram = {
    enable = true;
    environmentFile = /etc/secrets/telegram.env; # file containing the appservice and telegram tokens
    # The appservice is pre-configured to use SQLite by default. It's also possible to use PostgreSQL.
    settings = {
      homeserver = {
        address = "https://sealight.xyz";
        domain = "sealight.xyz";
      };
      appservice = {
        provisioning.enabled = false;
        id = "telegram";
        bot_username = "telegrambridge";
        public = {
          enabled = false;
          prefix = "/public";
          external = "https://chat.sealight.xyz/public";
        };
        address = "http://localhost:18787";
        port = 18787;
        # The service uses SQLite by default, but it's also possible to use PostgreSQL instead:
        #database = "postgresql:///mautrix-telegram?host=/run/postgresql";
      };
      bridge = {
        relaybot.authless_portals = false;
        permissions = {
          "@aynish:sealight.xyz" = "admin";
        };
      };
    };
  };

  services.sealight.heisenbridge = {
    enable = true;
    homeserver = "https://sealight.xyz";
    listenPort = 14456;
    appServiceToken = "wyujLh8kjpmk2bfKeEE3sZ2gWOEUBKK5";
    homeserverToken = "yEHs7lthD2ZHUibJOAv1APaFhEjxN5PT";
  };


  # environment.systemPackages = with pkgs; [ matrix-appservice-slack ];
  #services.mx-puppet-slack= {
  #enable = false;
  #settings = {
  #  bridge = { 
  #    bindAddress = "localhost";
  #    port = 16786;
  #    domain = "sealight.xyz";
  #    homeserverUrl = "https://sealight.xyz";
  #  };
  #  provisioning = {
  #    whitelist = [ "@aynish:sealight.xyz" ];
  #  };
  #  relay = {
  #    whitelist = [ "@aynish:sealight.xyz" ];
  #  };
  #  namePatterns = {
  #    group = ":name";
  #    room = ":name[:team? - :team,]";
  #    user = ":name (Slack)";
  #    userOverride = ":displayname";
  #  };
  #  presence = {
  #    enabled = false;
  #  };
  #  oauth = {
  #    enabled = false;
  #  };
  #};
  #serviceDependencies = ["matrix-synapse.service"];
  #};

  # services.mautrix-whatsapp = {
  #   enable = false;
  # The appservice is pre-configured to use SQLite by default. It's also possible to use PostgreSQL.
  #configOptions = {
  #  homeserver = {
  #    address = "https://chat.sealight.xyz";
  #    domain = "sealight.xyz";
  #  };
  #  appservice = {
  #    id = "whatsapp";
  #    address = http://localhost:9897;
  #    hostname = "0.0.0.0";
  #    port = 9897;
  #    database = {
  #      type = "sqlite3";
  #      uri = "/var/lib/mautrix-whatsapp/mautrix-whatsapp.db";
  #    };
  #    state_store_path = "/var/lib/mautrix-whatsapp/mx-state.json";
  #    bot = {
  #      username = "whatsappbot";
  #      displayname = "WhatsApp bridge bot";
  #      avatar = "mxc://maunium.net/NeXNQarUbrlYBiPCpprYsRqr";
  #    };
  #    as_token = "";
  #    hs_token = "";
  #  };
  #  bridge = {
  #    username_template = "whatsapp_{{.}}";
  #    displayname_template = "{{if .Notify}}{{.Notify}}{{else}}{{.Jid}}{{end}} (WA)";
  #    command_prefix = "!wa";
  #    permissions = {
  #      "@aynish:sealight.xyz" = 100;
  #    };
  #  };
  #  logging = {
  #    directory = "/var/lib/mautrix-whatsapp/logs";
  #    file_name_format = "{{.Date}}-{{.Index}}.log";
  #    file_date_format = "\"2006-01-02\"";
  #    file_mode = 384;
  #    timestamp_format = "Jan _2, 2006 15:04:05";
  #    print_level = "debug";
  #  };
  #  metrics = {
  #    enabled = true;
  #    listen  = "http://localhost:5070";
  #  };
  #};
  # };

  #services.mx-puppet-discord = {
  #  enable = true;
  #  settings = {
  #    bridge = {
  #      bindAddress = "localhost";
  #      port = 16785;
  #      domain = "sealight.xyz";
  #      homeserverUrl = "https://sealight.xyz";
  #      avatarUrl = "https://discord.com/assets/2d20a45d79110dc5bf947137e9d99b66.svg";
  #    };
  #    provisioning = {
  #      whitelist = [ "@aynish:sealight.xyz" ];
  #    };
  #    relay = {
  #      whitelist = [ "@aynish:sealight.xyz" ];
  #    };
  #    namePatterns = {
  #      group = ":name";
  #      room = ":name";
  #      user = ":name (Discord)";
  #      userOverride = ":displayname";
  #    };
  #    presence = {
  #      enabled = false;
  #    };
  #  };
  #  serviceDependencies = [ "matrix-synapse.service" ];
  #};



}