diff options
| -rw-r--r-- | Com/Simatime/chat.nix | 100 | ||||
| -rw-r--r-- | Com/Simatime/networking.nix | 1 | ||||
| -rw-r--r-- | default.nix | 1 |
3 files changed, 102 insertions, 0 deletions
diff --git a/Com/Simatime/chat.nix b/Com/Simatime/chat.nix new file mode 100644 index 0000000..e23b73e --- /dev/null +++ b/Com/Simatime/chat.nix @@ -0,0 +1,100 @@ +{ config, pkgs, ... }: +# +# a homeserver for matrix.org. +# +# - nixos manual: https://nixos.org/nixos/manual/index.html#module-services-matrix +# +# to create new users: +# +# nix run nixpkgs.matrix-synapse +# register_new_matrix_user -k <registration_shared_secret> http://localhost:<matrix_port> +# +let + fqdn = "matrix.${config.networking.domain}"; + riot = "chat.${config.networking.domain}"; + matrix_port = 8448; +in { + # matrix-synapse server. for what the settings mean, see: + # https://nixos.org/nixos/manual/index.html#module-services-matrix + # + services.matrix-synapse = { + enable = true; + server_name = config.networking.domain; + registration_shared_secret = "AkGRWSQLga3RoKRFnHhKoeCEIeZzu31y4TRzMRkMyRbBnETkVTSxilf24qySLzQn"; + listeners = [ + { + port = matrix_port; + bind_address = "::1"; + type = "http"; + tls = false; + x_forwarded = true; + resources = [ + { + names = [ "client" "federation" ]; + compress = false; + } + ]; + } + ]; + }; + # matrix needs a database + # + services.postgresql.enable = true; + # web proxy for the matrix server + # + services.nginx = { + enable = true; + recommendedTlsSettings = true; + recommendedOptimisation = true; + recommendedGzipSettings = true; + recommendedProxySettings = true; + virtualHosts = { + # route to matrix-synapse + "${config.networking.domain}" = { + locations."= /.well-known/matrix/server".extraConfig = + let + server = { "m.server" = "${fqdn}:443"; }; + in '' + add_header Content-Type application/json; + return 200 '${builtins.toJSON server}'; + ''; + locations."= /.well-known/matrix/client".extraConfig = + let + client = { + "m.homeserver" = { "base_url" = "https://${fqdn}"; } ; + "m.identity_server" = { "base_url" = "https://vector.im"; }; + }; + in '' + add_header Content-Type application/json; + add_header Access-Control-Allow-Origin *; + return 200 '${builtins.toJSON client}'; + ''; + }; + # reverse proxy for matrix client-server and server-server communication + "${fqdn}" = { + enableACME = true; + forceSSL = true; + locations."/".extraConfig = '' + return 404; + ''; + locations."/_matrix" = { + proxyPass = "http://[::1]:${toString matrix_port}"; + }; + }; + }; + }; + # riot client, available at chat.simatime.com + # + # note that riot and matrix-synapse must be on separate fqdn's to + # protect from XSS attacks: + # https://github.com/vector-im/riot-web#important-security-note + # + services.nginx.virtualHosts."${riot}" = { + enableACME = true; + forceSSL = true; + serverAliases = [ + "chat.${config.networking.domain}" + ]; + root = pkgs.riot-web; + }; +} diff --git a/Com/Simatime/networking.nix b/Com/Simatime/networking.nix index f634187..60d8ebf 100644 --- a/Com/Simatime/networking.nix +++ b/Com/Simatime/networking.nix @@ -3,6 +3,7 @@ { networking = { hostName = "simatime"; + domain = "simatime.com"; firewall = { allowedTCPPorts = [ 22 80 443 ]; allowPing = true; diff --git a/default.nix b/default.nix index 5622c74..0dca989 100644 --- a/default.nix +++ b/default.nix @@ -25,6 +25,7 @@ in rec { ./Com/Simatime/git.nix ./Com/Simatime/mail.nix ./Com/Simatime/web.nix + ./Com/Simatime/chat.nix ./Com/Simatime/znc.nix nixos-mailserver ]; |