diff --git a/hosts/architect/matrix.nix b/hosts/architect/matrix.nix index 38d24b2..2dfd288 100644 --- a/hosts/architect/matrix.nix +++ b/hosts/architect/matrix.nix @@ -1,28 +1,44 @@ -{ pkgs, ... }: +{ pkgs, lib, ... }: let - domain = "matrix.giugl.io"; - webui_domain = "chat.giugl.io"; + domain = "runas.rocks"; + webui_domain = "webchat.runas.rocks"; network = import ./network.nix; - db_name = "matrix-synapse"; -in { + db_name = "matrix-synapse-runas.rocks"; +in +{ services = { matrix-synapse = { enable = true; settings = { server_name = "${domain}"; - database_name = db_name; + database.args.database = db_name; public_baseurl = "https://${domain}"; registration_shared_secret = "runas!"; url_preview_enabled = true; dynamic_thumbnails = true; withJemalloc = true; - # enable_registration = true; app_service_config_files = [ "/var/lib/matrix-synapse/discord-registration.yaml" # "/var/lib/matrix-synapse/hookshot-registration.yml" # "/var/lib/matrix-synapse/telegram-registration.yaml" ]; + + oidc_providers = [{ + idp_id = "keycloak"; + idp_name = "Architect SSO"; + issuer = "https://auth.giugl.io/realms/master"; + client_id = "synapse"; + client_secret = "hj7dkbAI75jIeggr1cW0JTRzAdvJUtq6"; + scopes = [ "openid" "profile" ]; + user_profile_method = "userinfo_endpoint"; + user_mapping_provider.config = { + localpart_template = "{{ user.preferred_username }}"; + display_name_template = "{{ user.name }}"; + }; + backchannel_logout_enabled = true; + }]; + listeners = [{ port = 8008; bind_addresses = [ "127.0.0.1" ]; @@ -35,18 +51,11 @@ in { }]; }]; }; - - #extraConfig = '' - # auto_join_rooms: - # - "#general:matrix.giugl.io" - # max_upload_size: "50M" - #''; }; postgresql = { enable = true; package = pkgs.postgresql; - ensureDatabases = [ db_name ]; ensureUsers = [{ name = db_name; ensurePermissions = { "DATABASE \"${db_name}\"" = "ALL PRIVILEGES"; }; @@ -63,22 +72,25 @@ in { ''; locations."= /.well-known/matrix/server".extraConfig = let server = { "m.server" = "${domain}:443"; }; - in '' + in + '' add_header Content-Type application/json; return 200 '${builtins.toJSON server}'; ''; - locations."= /.well-known/matrix/client".extraConfig = let - client = { - "m.homeserver" = { "base_url" = "https://${domain}:443"; }; - "m.identity_server" = { "base_url" = "https://vector.im"; }; - }; - # ACAO required to allow element-web on any URL to request this json file - in '' - add_header Content-Type application/json; - add_header Access-Control-Allow-Origin *; - return 200 '${builtins.toJSON client}'; - ''; + locations."= /.well-known/matrix/client".extraConfig = + let + client = { + "m.homeserver" = { "base_url" = "https://${domain}:443"; }; + "m.identity_server" = { "base_url" = "https://vector.im"; }; + }; + # ACAO required to allow element-web on any URL to request this json file + in + '' + add_header Content-Type application/json; + add_header Access-Control-Allow-Origin *; + return 200 '${builtins.toJSON client}'; + ''; locations."/".extraConfig = '' return 404; @@ -88,6 +100,10 @@ in { locations."/_matrix" = { proxyPass = "http://127.0.0.1:8008"; # without a trailing / }; + + locations."/_synapse" = { + proxyPass = "http://127.0.0.1:8008"; # without a trailing / + }; }; # web client @@ -114,7 +130,7 @@ in { # It's also possible to use PostgreSQL. settings = { bridge = { - domain = domain; + inherit domain; homeserverUrl = "https://${domain}"; }; }; @@ -122,8 +138,8 @@ in { }; networking.extraHosts = '' - ${network.architect-lan} ${domain} ${webui_domain} - ${network.architect-wg} ${domain} ${webui_domain} + ${network.architect-lan} ${lib.concatStringsSep " " [ domain webui_domain]} + ${network.architect-wg} ${lib.concatStringsSep " " [ domain webui_domain ]} ''; }