diff --git a/profiles/matrix/default.nix b/profiles/matrix/default.nix index 73019e89..54431a2a 100644 --- a/profiles/matrix/default.nix +++ b/profiles/matrix/default.nix @@ -2,11 +2,15 @@ { imports = [ - ./mautrix-telegram + ./mautrix-telegram.nix # ./mjolnir.nix # need to create the mod user ./heisenbridge.nix ]; environment.systemPackages = [ pkgs.matrix-synapse-tools.rust-synapse-compress-state ]; + age.secrets.synapse-database-password.file = "${self}/secrets/synapse-database-password.age"; + age.secrets.synapse-database-password.owner = "matrix-synapse"; + age.secrets.synapse-database-password.file = "${self}/secrets/synapse-config.age"; + age.secrets.synapse-database-password.owner = "matrix-synapse"; services.matrix-synapse = { enable = true; @@ -45,17 +49,20 @@ "turn:turn.sealight.xyz:3478?transport=udp" "turn:turn.sealight.xyz:3478?transport=tcp" ]; - turn_shared_secret = config.services.coturn.static-auth-secret; - extraConfig = '' - max_upload_size: "50M" - use_presence: false - registration_shared_secret: "hD9HQGTTDxp0mQsQ5JDsfudWMDiubmZENOgPchIvfBvUlPxlvQSvjoO4wn2L1seU"; # TODO agenix - ''; + # turn_shared_secret = config.services.coturn.static-auth-secret; + extraConfig = "/run/agenix/synapse-config"; + # Example config (saved as secret??) + # '' + # max_upload_size: "50M" + # use_presence: false + # registration_shared_secret: "hD9HQGTTDxp0mQsQ5JDsfudWMDiubmZENOgPchIvfBvUlPxlvQSvjoO4wn2L1seU"; + # enable_registration_without_verification: true + # ''; enable_metrics = true; - enable_registration = false; + enable_registration = true; database = { name = "psycopg2"; - args.password = "Da0?H*9i{x?,]|kq@iBwlIzu"; # TODO agenix + args.passfile = "/run/agenix/synapse-database-password"; }; }; ## coturn based TURN server integration (TURN server setup mentioned later), @@ -96,13 +103,13 @@ # ''; # }; - security.acme.certs.${config.services.coturn.realm} = { - /* insert here the right configuration to obtain a certificate */ - webroot = "/var/lib/acme/acme-challenge/"; - email = "anish+acme@lakhwara.com"; - postRun = "systemctl restart coturn.service"; - group = "turnserver"; - }; + # security.acme.certs.${config.services.coturn.realm} = { + # /* insert here the right configuration to obtain a certificate */ + # webroot = "/var/lib/acme/acme-challenge/"; + # email = "anish+acme@lakhwara.com"; + # postRun = "systemctl restart coturn.service"; + # group = "turnserver"; + # }; # TODO fix up jitsi bridge stuff ## services.jitsi-meet = { @@ -119,7 +126,7 @@ ## by default is matrix-synapse # TODO agenix initialScript = pkgs.writeText "synapse-init.sql" '' - CREATE ROLE "matrix-synapse" WITH LOGIN PASSWORD "Da0?H*9i{x?,]|kq@iBwlIzu"; + CREATE ROLE "matrix-synapse" WITH LOGIN PASSWORD "s0m3s3cur3p455w0rdth4tisch4ng3d"; CREATE DATABASE "matrix-synapse" WITH OWNER "matrix-synapse" TEMPLATE template0 LC_COLLATE = "C" @@ -202,8 +209,7 @@ ## virtual host for Synapse "chat.sealight.xyz" = { forceSSL = true; - enableACME = true; # TODO - #useACMEHost = "sealight.xyz"; + enableACME = true; locations."/" = { proxyPass = "http://localhost:8448"; }; @@ -211,9 +217,8 @@ ## virtual host for Riot/Web "element.sealight.xyz" = { forceSSL = true; - enableACME = true; # TODO - #useACMEHost = "sealight.xyz"; - ## root points to the riot-web package content, also configured via Nix + enableACME = true; + ## root points to the element-web package content, also configured via Nix locations."/" = { root = pkgs.element-web; }; diff --git a/profiles/matrix/mautrix-telegram.nix b/profiles/matrix/mautrix-telegram.nix index 619995d1..de5b8703 100644 --- a/profiles/matrix/mautrix-telegram.nix +++ b/profiles/matrix/mautrix-telegram.nix @@ -1,8 +1,10 @@ { config, lib, pkgs, ... }: { + age.secrets.telegram-matrix-env.file = "${self}/secrets/telegram-matrix-env.age"; + age.secrets.telegram-matrix-env.owner = "mautrix-telegram"; services.mautrix-telegram = { enable = true; - environmentFile = /etc/secrets/telegram.env; # TODO agenix + environmentFile = "/run/agenix/telegram-matrix-env"; # TODO use pgsql # The appservice is pre-configured to use SQLite by default. It's also possible to use PostgreSQL. settings = { diff --git a/profiles/matrix/mjolnir.nix b/profiles/matrix/mjolnir.nix index 912dd422..4760d388 100644 --- a/profiles/matrix/mjolnir.nix +++ b/profiles/matrix/mjolnir.nix @@ -1,5 +1,7 @@ { pkgs, lib, config, ... }: { + age.secrets.sealight-mod-password.file = "${self}/secrets/sealight-mod-password.age"; + age.secrets.sealight-mod-password.owner = "mjolnir"; services.mjolnir = { enable = true; protectedRooms = [ @@ -13,7 +15,7 @@ pantalaimon = { enable = true; username = "mod"; - passwordFile = "/run/agenix/sealight-mod-password"; # TODO + passwordFile = "/run/agenix/sealight-mod-password"; options.homeserver = config.services.mjolnir.homeserverUrl; }; };