380 lines
11 KiB
Nix
380 lines
11 KiB
Nix
{ config, lib, pkgs, ... }:
|
|
|
|
{
|
|
|
|
services.matrix-synapse = {
|
|
enable = true;
|
|
settings = {
|
|
server_name = "sealight.xyz";
|
|
listeners = [
|
|
{
|
|
port = 8448;
|
|
tls = false;
|
|
resources = [{
|
|
compress = true;
|
|
names = [ "client" "federation" ];
|
|
}];
|
|
}
|
|
{
|
|
port = 9090;
|
|
type = "metrics";
|
|
bind_addresses = [ "0.0.0.0" ];
|
|
resources = [{
|
|
compress = false;
|
|
names = [ ];
|
|
}];
|
|
tls = false;
|
|
}
|
|
];
|
|
app_service_config_files = [
|
|
# The registration file is automatically generated after starting the appservice for the first time.
|
|
# cp /var/lib/matrix-appservice-discord/discord-registration.yaml /var/lib/matrix-synapse/
|
|
# chown matrix-synapse:matrix-synapse /var/lib/matrix-synapse/discord-registration.yaml
|
|
"/var/lib/matrix-synapse/telegram-registration.yaml"
|
|
# "/var/lib/matrix-synapse/slack-registration.yaml"
|
|
# "/var/lib/matrix-synapse/discord-registration.yaml"
|
|
# "/var/lib/matrix-synapse/whatsapp-registration.yaml"
|
|
];
|
|
turn_uris = [
|
|
"turn:turn.sealight.xyz:3478?transport=udp"
|
|
"turn:turn.sealight.xyz:3478?transport=tcp"
|
|
];
|
|
turn_shared_secret = config.services.coturn.static-auth-secret;
|
|
extraConfig = ''
|
|
max_upload_size: "50M"
|
|
use_presence: false
|
|
registration_shared_secret: "hD9HQGTTDxp0mQsQ5JDsfudWMDiubmZENOgPchIvfBvUlPxlvQSvjoO4wn2L1seU";
|
|
'';
|
|
enable_metrics = true;
|
|
enable_registration = false;
|
|
database = {
|
|
name = "psycopg2";
|
|
args.password = "Da0?H*9i{x?,]|kq@iBwlIzu"; # TODO agenix
|
|
};
|
|
};
|
|
## coturn based TURN server integration (TURN server setup mentioned later),
|
|
## shared secret generated while configuring coturn
|
|
## and reused here (power of Nix being a real programming language)
|
|
};
|
|
|
|
services.coturn = {
|
|
enable = true;
|
|
use-auth-secret = true;
|
|
static-auth-secret = "jXW1ohIq6wM3NB00xeME3uBihY85xjpkhGoyzBIdwhOpj7gjyxXZu1fwp1lUiYwJ"; # TODO agenix
|
|
realm = "turn.sealight.xyz";
|
|
min-port = 49111;
|
|
max-port = 51111;
|
|
no-cli = true;
|
|
no-tcp-relay = true;
|
|
no-tls = true;
|
|
cert = "${config.security.acme.certs."turn.sealight.xyz".directory}/full.pem";
|
|
pkey = "${config.security.acme.certs."turn.sealight.xyz".directory}/key.pem";
|
|
extraConfig = ''
|
|
verbose
|
|
user-quota=12
|
|
total-quota=1200
|
|
denied-peer-ip=10.0.0.0-10.255.255.255
|
|
denied-peer-ip=192.168.0.0-192.168.255.255
|
|
denied-peer-ip=172.16.0.0-172.31.255.255
|
|
denied-peer-ip=0.0.0.0-0.255.255.255
|
|
denied-peer-ip=100.64.0.0-100.127.255.255
|
|
denied-peer-ip=127.0.0.0-127.255.255.255
|
|
denied-peer-ip=169.254.0.0-169.254.255.255
|
|
denied-peer-ip=192.0.0.0-192.0.0.255
|
|
denied-peer-ip=192.0.2.0-192.0.2.255
|
|
denied-peer-ip=192.88.99.0-192.88.99.255
|
|
denied-peer-ip=198.18.0.0-198.19.255.255
|
|
denied-peer-ip=198.51.100.0-198.51.100.255
|
|
denied-peer-ip=203.0.113.0-203.0.113.255
|
|
denied-peer-ip=240.0.0.0-255.255.255.255
|
|
'';
|
|
};
|
|
|
|
security.acme.certs.${config.services.coturn.realm} = {
|
|
/* insert here the right configuration to obtain a certificate */
|
|
webroot = "/var/lib/acme/acme-challenge/";
|
|
email = "anish+acme@lakhwara.com";
|
|
postRun = "systemctl restart coturn.service";
|
|
group = "turnserver";
|
|
};
|
|
|
|
# TODO fix up jitsi bridge stuff
|
|
## services.jitsi-meet = {
|
|
## enable = true;
|
|
## hostName = "jitsi.sealight.xyz";
|
|
## };
|
|
## services.jitsi-videobridge.enable = true;
|
|
|
|
services.postgresql = {
|
|
enable = true;
|
|
package = pkgs.postgresql_14;
|
|
## postgresql user and db name remains in the
|
|
## service.matrix-synapse.database_args setting which
|
|
## by default is matrix-synapse
|
|
# TODO agenix
|
|
initialScript = pkgs.writeText "synapse-init.sql" ''
|
|
CREATE ROLE "matrix-synapse" WITH LOGIN PASSWORD "Da0?H*9i{x?,]|kq@iBwlIzu";
|
|
CREATE DATABASE "matrix-synapse" WITH OWNER "matrix-synapse"
|
|
TEMPLATE template0
|
|
LC_COLLATE = "C"
|
|
LC_CTYPE = "C";
|
|
'';
|
|
authentication = ''
|
|
local matrix-synapse all ident map=matrix-synapse-users
|
|
'';
|
|
identMap = # Map the matrix-synapse user to postgresql
|
|
''
|
|
matrix-synapse-users matrix-synapse matrix-synapse
|
|
'';
|
|
};
|
|
|
|
networking.firewall =
|
|
let
|
|
range = with config.services.coturn; [{
|
|
from = min-port;
|
|
to = max-port;
|
|
}];
|
|
in
|
|
{
|
|
enable = true;
|
|
allowedUDPPortRanges = range; # coturn
|
|
allowedTCPPortRanges = range;
|
|
allowedTCPPorts = [
|
|
22 # SSH
|
|
8448 # Matrix federation
|
|
8008
|
|
80
|
|
443
|
|
3478 # Coturn service
|
|
5349 # Coturn service
|
|
9090 # Synapse Metrics
|
|
];
|
|
allowedUDPPorts = [
|
|
3478
|
|
5349 # Coturn service
|
|
];
|
|
};
|
|
|
|
nixpkgs.overlays = [
|
|
(self: super: {
|
|
element-web = super.element-web.override {
|
|
conf = {
|
|
default_server_config = {
|
|
"m.homeserver" = {
|
|
"base_url" = "https://chat.sealight.xyz";
|
|
"server_name" = "sealight.xyz";
|
|
};
|
|
"m.identity_server" = {
|
|
"base_url" = "https://vector.im";
|
|
};
|
|
};
|
|
|
|
## jitsi will be setup later,
|
|
## but we need to add to Riot configuration
|
|
jitsi.preferredDomain = "jitsi.sealight.xyz";
|
|
};
|
|
};
|
|
})
|
|
];
|
|
|
|
services.nginx = {
|
|
enable = true;
|
|
virtualHosts = {
|
|
"sealight.xyz" = {
|
|
forceSSL = true;
|
|
enableACME = true;
|
|
locations."/" = {
|
|
root = "/var/www/sealight.xyz";
|
|
};
|
|
locations."/_matrix" = {
|
|
proxyPass = "http://localhost:8448";
|
|
};
|
|
# locations."/slackbridge" = {
|
|
# proxyPass = "http://localhost:9899";
|
|
# };
|
|
};
|
|
## virtual host for Synapse
|
|
"chat.sealight.xyz" = {
|
|
forceSSL = true;
|
|
enableACME = true; # TODO
|
|
#useACMEHost = "sealight.xyz";
|
|
locations."/" = {
|
|
proxyPass = "http://localhost:8448";
|
|
};
|
|
};
|
|
## virtual host for Riot/Web
|
|
"element.sealight.xyz" = {
|
|
forceSSL = true;
|
|
enableACME = true; # TODO
|
|
#useACMEHost = "sealight.xyz";
|
|
## root points to the riot-web package content, also configured via Nix
|
|
locations."/" = {
|
|
root = pkgs.element-web;
|
|
};
|
|
};
|
|
# ${config.services.jitsi-meet.hostName} = {
|
|
# enableACME = true; # TODO
|
|
# forceSSL = true; # TODO
|
|
# };
|
|
};
|
|
## other nginx specific best practices
|
|
recommendedGzipSettings = true;
|
|
recommendedOptimisation = true;
|
|
recommendedTlsSettings = true;
|
|
};
|
|
|
|
services.mautrix-telegram = {
|
|
enable = true;
|
|
environmentFile = /etc/secrets/telegram.env; # file containing the appservice and telegram tokens
|
|
# The appservice is pre-configured to use SQLite by default. It's also possible to use PostgreSQL.
|
|
settings = {
|
|
homeserver = {
|
|
address = "https://sealight.xyz";
|
|
domain = "sealight.xyz";
|
|
};
|
|
appservice = {
|
|
provisioning.enabled = false;
|
|
id = "telegram";
|
|
bot_username = "telegrambridge";
|
|
public = {
|
|
enabled = false;
|
|
prefix = "/public";
|
|
external = "https://chat.sealight.xyz/public";
|
|
};
|
|
address = "http://localhost:18787";
|
|
port = 18787;
|
|
# The service uses SQLite by default, but it's also possible to use PostgreSQL instead:
|
|
#database = "postgresql:///mautrix-telegram?host=/run/postgresql";
|
|
};
|
|
bridge = {
|
|
relaybot.authless_portals = false;
|
|
permissions = {
|
|
"@aynish:sealight.xyz" = "admin";
|
|
};
|
|
};
|
|
};
|
|
};
|
|
|
|
services.sealight.heisenbridge = {
|
|
enable = true;
|
|
homeserver = "https://sealight.xyz";
|
|
listenPort = 14456;
|
|
appServiceToken = "wyujLh8kjpmk2bfKeEE3sZ2gWOEUBKK5";
|
|
homeserverToken = "yEHs7lthD2ZHUibJOAv1APaFhEjxN5PT";
|
|
};
|
|
|
|
|
|
# environment.systemPackages = with pkgs; [ matrix-appservice-slack ];
|
|
#services.mx-puppet-slack= {
|
|
#enable = false;
|
|
#settings = {
|
|
# bridge = {
|
|
# bindAddress = "localhost";
|
|
# port = 16786;
|
|
# domain = "sealight.xyz";
|
|
# homeserverUrl = "https://sealight.xyz";
|
|
# };
|
|
# provisioning = {
|
|
# whitelist = [ "@aynish:sealight.xyz" ];
|
|
# };
|
|
# relay = {
|
|
# whitelist = [ "@aynish:sealight.xyz" ];
|
|
# };
|
|
# namePatterns = {
|
|
# group = ":name";
|
|
# room = ":name[:team? - :team,]";
|
|
# user = ":name (Slack)";
|
|
# userOverride = ":displayname";
|
|
# };
|
|
# presence = {
|
|
# enabled = false;
|
|
# };
|
|
# oauth = {
|
|
# enabled = false;
|
|
# };
|
|
#};
|
|
#serviceDependencies = ["matrix-synapse.service"];
|
|
#};
|
|
|
|
# services.mautrix-whatsapp = {
|
|
# enable = false;
|
|
# The appservice is pre-configured to use SQLite by default. It's also possible to use PostgreSQL.
|
|
#configOptions = {
|
|
# homeserver = {
|
|
# address = "https://chat.sealight.xyz";
|
|
# domain = "sealight.xyz";
|
|
# };
|
|
# appservice = {
|
|
# id = "whatsapp";
|
|
# address = http://localhost:9897;
|
|
# hostname = "0.0.0.0";
|
|
# port = 9897;
|
|
# database = {
|
|
# type = "sqlite3";
|
|
# uri = "/var/lib/mautrix-whatsapp/mautrix-whatsapp.db";
|
|
# };
|
|
# state_store_path = "/var/lib/mautrix-whatsapp/mx-state.json";
|
|
# bot = {
|
|
# username = "whatsappbot";
|
|
# displayname = "WhatsApp bridge bot";
|
|
# avatar = "mxc://maunium.net/NeXNQarUbrlYBiPCpprYsRqr";
|
|
# };
|
|
# as_token = "";
|
|
# hs_token = "";
|
|
# };
|
|
# bridge = {
|
|
# username_template = "whatsapp_{{.}}";
|
|
# displayname_template = "{{if .Notify}}{{.Notify}}{{else}}{{.Jid}}{{end}} (WA)";
|
|
# command_prefix = "!wa";
|
|
# permissions = {
|
|
# "@aynish:sealight.xyz" = 100;
|
|
# };
|
|
# };
|
|
# logging = {
|
|
# directory = "/var/lib/mautrix-whatsapp/logs";
|
|
# file_name_format = "{{.Date}}-{{.Index}}.log";
|
|
# file_date_format = "\"2006-01-02\"";
|
|
# file_mode = 384;
|
|
# timestamp_format = "Jan _2, 2006 15:04:05";
|
|
# print_level = "debug";
|
|
# };
|
|
# metrics = {
|
|
# enabled = true;
|
|
# listen = "http://localhost:5070";
|
|
# };
|
|
#};
|
|
# };
|
|
|
|
#services.mx-puppet-discord = {
|
|
# enable = true;
|
|
# settings = {
|
|
# bridge = {
|
|
# bindAddress = "localhost";
|
|
# port = 16785;
|
|
# domain = "sealight.xyz";
|
|
# homeserverUrl = "https://sealight.xyz";
|
|
# avatarUrl = "https://discord.com/assets/2d20a45d79110dc5bf947137e9d99b66.svg";
|
|
# };
|
|
# provisioning = {
|
|
# whitelist = [ "@aynish:sealight.xyz" ];
|
|
# };
|
|
# relay = {
|
|
# whitelist = [ "@aynish:sealight.xyz" ];
|
|
# };
|
|
# namePatterns = {
|
|
# group = ":name";
|
|
# room = ":name";
|
|
# user = ":name (Discord)";
|
|
# userOverride = ":displayname";
|
|
# };
|
|
# presence = {
|
|
# enabled = false;
|
|
# };
|
|
# };
|
|
# serviceDependencies = [ "matrix-synapse.service" ];
|
|
#};
|
|
|
|
|
|
|
|
}
|