peperunas/nixos
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

matrix: Add OpenID connection and transfer to runas.rocks

Browse Source
This commit is contained in:
Giulio De Pasquale 2022-11-27 11:23:09 +01:00
parent 2ed81fcfe3
commit 6568784680
1 changed files with 45 additions and 29 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

74
hosts/architect/matrix.nix
View File

@ -1,28 +1,44 @@
{ pkgs, ... }:
{ pkgs, lib, ... }:
let
domain = "matrix.giugl.io";
webui_domain = "chat.giugl.io";
domain = "runas.rocks";
webui_domain = "webchat.runas.rocks";
network = import ./network.nix;
db_name = "matrix-synapse";
in {
db_name = "matrix-synapse-runas.rocks";
in
{
services = {
matrix-synapse = {
enable = true;
settings = {
server_name = "${domain}";
database_name = db_name;
database.args.database = db_name;
public_baseurl = "https://${domain}";
registration_shared_secret = "runas!";
url_preview_enabled = true;
dynamic_thumbnails = true;
withJemalloc = true;
# enable_registration = true;
app_service_config_files = [
"/var/lib/matrix-synapse/discord-registration.yaml"
# "/var/lib/matrix-synapse/hookshot-registration.yml"
# "/var/lib/matrix-synapse/telegram-registration.yaml"
];
oidc_providers = [{
idp_id = "keycloak";
idp_name = "Architect SSO";
issuer = "https://auth.giugl.io/realms/master";
client_id = "synapse";
client_secret = "hj7dkbAI75jIeggr1cW0JTRzAdvJUtq6";
scopes = [ "openid" "profile" ];
user_profile_method = "userinfo_endpoint";
user_mapping_provider.config = {
localpart_template = "{{ user.preferred_username }}";
display_name_template = "{{ user.name }}";
};
backchannel_logout_enabled = true;
}];
listeners = [{
port = 8008;
bind_addresses = [ "127.0.0.1" ];
@ -35,18 +51,11 @@ in {
}];
}];
};
#extraConfig = ''
# auto_join_rooms:
# - "#general:matrix.giugl.io"
# max_upload_size: "50M"
#'';
};
postgresql = {
enable = true;
package = pkgs.postgresql;
ensureDatabases = [ db_name ];
ensureUsers = [{
name = db_name;
ensurePermissions = { "DATABASE \"${db_name}\"" = "ALL PRIVILEGES"; };
@ -63,22 +72,25 @@ in {
'';
locations."= /.well-known/matrix/server".extraConfig =
let server = { "m.server" = "${domain}:443"; };
in ''
in
''
add_header Content-Type application/json;
return 200 '${builtins.toJSON server}';
'';
locations."= /.well-known/matrix/client".extraConfig = let
client = {
"m.homeserver" = { "base_url" = "https://${domain}:443"; };
"m.identity_server" = { "base_url" = "https://vector.im"; };
};
# ACAO required to allow element-web on any URL to request this json file
in ''
add_header Content-Type application/json;
add_header Access-Control-Allow-Origin *;
return 200 '${builtins.toJSON client}';
'';
locations."= /.well-known/matrix/client".extraConfig =
let
client = {
"m.homeserver" = { "base_url" = "https://${domain}:443"; };
"m.identity_server" = { "base_url" = "https://vector.im"; };
};
# ACAO required to allow element-web on any URL to request this json file
in
''
add_header Content-Type application/json;
add_header Access-Control-Allow-Origin *;
return 200 '${builtins.toJSON client}';
'';
locations."/".extraConfig = ''
return 404;
@ -88,6 +100,10 @@ in {
locations."/_matrix" = {
proxyPass = "http://127.0.0.1:8008"; # without a trailing /
};
locations."/_synapse" = {
proxyPass = "http://127.0.0.1:8008"; # without a trailing /
};
};
# web client
@ -114,7 +130,7 @@ in {
# It's also possible to use PostgreSQL.
settings = {
bridge = {
domain = domain;
inherit domain;
homeserverUrl = "https://${domain}";
};
};
@ -122,8 +138,8 @@ in {
};
networking.extraHosts = ''
${network.architect-lan} ${domain} ${webui_domain}
${network.architect-wg} ${domain} ${webui_domain}
${network.architect-lan} ${lib.concatStringsSep " " [ domain webui_domain]}
${network.architect-wg} ${lib.concatStringsSep " " [ domain webui_domain ]}
'';
}