peperunas/nixos
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

matrix: Add OpenID connection and transfer to runas.rocks

Browse Source
This commit is contained in:
Giulio De Pasquale 2022-11-27 11:23:09 +01:00
parent 2ed81fcfe3
commit 6568784680
1 changed files with 45 additions and 29 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

74
hosts/architect/matrix.nix
View File

@ -1,28 +1,44 @@
{ pkgs, ... }: { pkgs, lib, ... }:
let let
domain = "matrix.giugl.io"; domain = "runas.rocks";
webui_domain = "chat.giugl.io"; webui_domain = "webchat.runas.rocks";
network = import ./network.nix; network = import ./network.nix;
db_name = "matrix-synapse"; db_name = "matrix-synapse-runas.rocks";
in { in
{
services = { services = {
matrix-synapse = { matrix-synapse = {
enable = true; enable = true;
settings = { settings = {
server_name = "${domain}"; server_name = "${domain}";
database_name = db_name; database.args.database = db_name;
public_baseurl = "https://${domain}"; public_baseurl = "https://${domain}";
registration_shared_secret = "runas!"; registration_shared_secret = "runas!";
url_preview_enabled = true; url_preview_enabled = true;
dynamic_thumbnails = true; dynamic_thumbnails = true;
withJemalloc = true; withJemalloc = true;
# enable_registration = true;
app_service_config_files = [ app_service_config_files = [
"/var/lib/matrix-synapse/discord-registration.yaml" "/var/lib/matrix-synapse/discord-registration.yaml"
# "/var/lib/matrix-synapse/hookshot-registration.yml" # "/var/lib/matrix-synapse/hookshot-registration.yml"
# "/var/lib/matrix-synapse/telegram-registration.yaml" # "/var/lib/matrix-synapse/telegram-registration.yaml"
]; ];
oidc_providers = [{
idp_id = "keycloak";
idp_name = "Architect SSO";
issuer = "https://auth.giugl.io/realms/master";
client_id = "synapse";
client_secret = "hj7dkbAI75jIeggr1cW0JTRzAdvJUtq6";
scopes = [ "openid" "profile" ];
user_profile_method = "userinfo_endpoint";
user_mapping_provider.config = {
localpart_template = "{{ user.preferred_username }}";
display_name_template = "{{ user.name }}";
};
backchannel_logout_enabled = true;
}];
listeners = [{ listeners = [{
port = 8008; port = 8008;
bind_addresses = [ "127.0.0.1" ]; bind_addresses = [ "127.0.0.1" ];
@ -35,18 +51,11 @@ in {
}]; }];
}]; }];
}; };
#extraConfig = ''
# auto_join_rooms:
# - "#general:matrix.giugl.io"
# max_upload_size: "50M"
#'';
}; };
postgresql = { postgresql = {
enable = true; enable = true;
package = pkgs.postgresql; package = pkgs.postgresql;
ensureDatabases = [ db_name ];
ensureUsers = [{ ensureUsers = [{
name = db_name; name = db_name;
ensurePermissions = { "DATABASE \"${db_name}\"" = "ALL PRIVILEGES"; }; ensurePermissions = { "DATABASE \"${db_name}\"" = "ALL PRIVILEGES"; };
@ -63,22 +72,25 @@ in {
''; '';
locations."= /.well-known/matrix/server".extraConfig = locations."= /.well-known/matrix/server".extraConfig =
let server = { "m.server" = "${domain}:443"; }; let server = { "m.server" = "${domain}:443"; };
in '' in
''
add_header Content-Type application/json; add_header Content-Type application/json;
return 200 '${builtins.toJSON server}'; return 200 '${builtins.toJSON server}';
''; '';
locations."= /.well-known/matrix/client".extraConfig = let locations."= /.well-known/matrix/client".extraConfig =
client = { let
"m.homeserver" = { "base_url" = "https://${domain}:443"; }; client = {
"m.identity_server" = { "base_url" = "https://vector.im"; }; "m.homeserver" = { "base_url" = "https://${domain}:443"; };
}; "m.identity_server" = { "base_url" = "https://vector.im"; };
# ACAO required to allow element-web on any URL to request this json file };
in '' # ACAO required to allow element-web on any URL to request this json file
add_header Content-Type application/json; in
add_header Access-Control-Allow-Origin *; ''
return 200 '${builtins.toJSON client}'; add_header Content-Type application/json;
''; add_header Access-Control-Allow-Origin *;
return 200 '${builtins.toJSON client}';
'';
locations."/".extraConfig = '' locations."/".extraConfig = ''
return 404; return 404;
@ -88,6 +100,10 @@ in {
locations."/_matrix" = { locations."/_matrix" = {
proxyPass = "http://127.0.0.1:8008"; # without a trailing / proxyPass = "http://127.0.0.1:8008"; # without a trailing /
}; };
locations."/_synapse" = {
proxyPass = "http://127.0.0.1:8008"; # without a trailing /
};
}; };
# web client # web client
@ -114,7 +130,7 @@ in {
# It's also possible to use PostgreSQL. # It's also possible to use PostgreSQL.
settings = { settings = {
bridge = { bridge = {
domain = domain; inherit domain;
homeserverUrl = "https://${domain}"; homeserverUrl = "https://${domain}";
}; };
}; };
@ -122,8 +138,8 @@ in {
}; };
networking.extraHosts = '' networking.extraHosts = ''
${network.architect-lan} ${domain} ${webui_domain} ${network.architect-lan} ${lib.concatStringsSep " " [ domain webui_domain]}
${network.architect-wg} ${domain} ${webui_domain} ${network.architect-wg} ${lib.concatStringsSep " " [ domain webui_domain ]}
''; '';
} }