Daholli/nixos-config
1
0
Fork 0
Code Issues 2 Pull requests Releases Packages Activity Actions

loptland: init matrix server

Browse source
This commit is contained in:
Christoph Hollizeck 2026-03-26 13:25:08 +01:00
parent d53de15a3f
commit 9536b08cea
WARNING! Although there is a key with this ID in the database it does not verify this commit! This commit is SUSPICIOUS.
GPG key ID: 249300664F2AF2C7
5 changed files with 148 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

3
modules/hosts/loptland/default.nix
View file

@ -30,6 +30,9 @@ topLevel: {
forgejo
forgejo-runner
# services
matrix-synapse
# game server
minecraft-server
factorio-server

33
modules/hosts/loptland/nginx.nix
View file

@ -50,6 +50,39 @@
};
};
"matrix.alwayssleepy.online" = lib.mkIf config.services.matrix-synapse.enable {
forceSSL = true;
useACMEHost = "alwayssleepy.online";
locations."/" = {
proxyPass = "http://localhost:${toString 8008}";
extraConfig = ''
client_max_body_size 50M;
'';
};
};
# .well-known Matrix delegation so Matrix IDs are @user:alwayssleepy.online
"alwayssleepy.online" = {
forceSSL = true;
useACMEHost = "alwayssleepy.online";
locations."/.well-known/matrix/server" = {
extraConfig = ''
default_type application/json;
return 200 '{"m.server":"matrix.alwayssleepy.online:443"}';
'';
};
locations."/.well-known/matrix/client" = {
extraConfig = ''
default_type application/json;
add_header 'Access-Control-Allow-Origin' '*';
return 200 '{"m.homeserver":{"base_url":"https://matrix.alwayssleepy.online"}}';
'';
};
};
"nixcache.${domainName}" = lib.mkIf config.services.nix-serve.enable {
forceSSL = true;
useACMEHost = domainName;

10
modules/server/acme.nix
View file

@ -54,6 +54,16 @@ topLevel: {
dnsResolver = "1.1.1.1:53";
extraDomainNames = [ "*.${domainname}" ];
};
certs."cholli.de" = {
dnsResolver = "1.1.1.1:53";
extraDomainNames = [ "*.cholli.de" ];
};
certs."alwayssleepy.online" = {
dnsResolver = "1.1.1.1:53";
extraDomainNames = [ "*.alwayssleepy.online" ];
};
};
};

98
modules/server/matrix-synapse.nix Normal file
View file

@ -0,0 +1,98 @@
{
flake.modules.nixos.matrix-synapse =
{ config, ... }:
let
domainName = "alwayssleepy.online";
matrixPort = 8008;
sopsFile = ../../secrets/secrets-loptland.yaml;
in
{
sops.secrets."matrix/registrationSharedSecret" = {
inherit sopsFile;
owner = "matrix-synapse";
};
services.postgresql = {
enable = true;
ensureDatabases = [ "matrix-synapse" ];
ensureUsers = [
{
name = "matrix-synapse";
ensureDBOwnership = true;
}
];
};
# ensureDatabases creates with default collation, but Synapse requires C collation.
# This service runs after postgresql-setup (which runs ensureDatabases) and corrects
# the collation by recreating the DB if needed.
systemd.services."matrix-synapse-db-setup" = {
description = "Set up Matrix Synapse PostgreSQL database with C collation";
wantedBy = [ "matrix-synapse.service" ];
before = [ "matrix-synapse.service" ];
after = [
"postgresql.service"
"postgresql-setup.service"
];
requires = [ "postgresql.service" ];
serviceConfig = {
Type = "oneshot";
User = "postgres";
RemainAfterExit = true;
};
script = ''
COLLATION=$(psql -tAc "SELECT datcollate FROM pg_database WHERE datname = 'matrix-synapse'")
if [ "$COLLATION" != "C" ]; then
psql -c "DROP DATABASE \"matrix-synapse\""
psql -c "CREATE DATABASE \"matrix-synapse\" ENCODING 'UTF8' LC_COLLATE='C' LC_CTYPE='C' TEMPLATE=template0 OWNER \"matrix-synapse\""
fi
'';
};
services.matrix-synapse = {
enable = true;
settings = {
server_name = domainName;
database = {
name = "psycopg2";
args.database = "matrix-synapse";
};
public_baseurl = "https://matrix.${domainName}";
listeners = [
{
port = matrixPort;
bind_addresses = [ "127.0.0.1" ];
type = "http";
tls = false;
x_forwarded = true;
resources = [
{
names = [
"client"
"federation"
];
compress = false;
}
];
}
];
enable_registration = true;
registration_requires_token = true;
};
extraConfigFiles = [ config.sops.templates."matrix-synapse-extra.yaml".path ];
};
sops.templates."matrix-synapse-extra.yaml" = {
owner = "matrix-synapse";
content = ''
registration_shared_secret: "${config.sops.placeholder."matrix/registrationSharedSecret"}"
'';
};
};
}

6
secrets/secrets-loptland.yaml
View file

@ -20,6 +20,8 @@ hydra:
token: ENC[AES256_GCM,data:FqlJMfw7d1VfWhC+vI4SEMWzzADXK/np33fCsihq3wgC6nWNeTurNn1vDRLIRH+s6iT1C8Ni8iAAlndfUS5SPH6Ymswix9KuJCvYc8Jy+c8pPchYePtMQfv3dVe5a1i06b8I5c+MX8V7j2kaCijYDirnhiD0qlc8SW/mIyB5RNpAgKPTzLjLKJNSUkTGOWUnww==,iv:H2yQ5ioBVnezmhGHbJ7sAlXvUb2MUmHpQpS7f+nIph4=,tag:qvqsbgf2Y/PAd3s9ZFuxWA==,type:str]
remotebuild:
private-key: ENC[AES256_GCM,data:FqdXFj4/leKNtNJ1H1sBnb/Gnso9soaLtdUToMsx3O6LAn2smdkFrguY9EESm+o1nIBWwc1S2cE/sfH8FR89NWbyfCDTsQLHRIIEYMS2kKLv7hqqdsmyQojW38TnUYtSo5W1V9pdmeYuotUrM7bPmW/Io/7/G/vW6LxtI7Mx1qT7OXnyEJVYsvY6TtJitWO0/jGUAGOyvu/+YhV4yRmArM2kjT+iYb8/dN0HpqCwo6aLvY7ctAA6ggESciuovEtUMv19y+RpMUaHxloziM3SFz/GjXekrqtPGDkCUusSChXuhzfmZDoz4dzNnkKn8HsmxzByzaTyNH9kCxzNV7vULTKi6/O4ny64FOk6pjymz2Yv6pK+pm3tP2wrPwynn3C1giwFCGn+2Nazixj4g4wd5iSFwNeAsDbLU0b3YN/NgQv0TeKGXR01Xgqvt06vtAnkpu8byPBUX5cz15kJckeztVHYCQyz6Uthk6NN+ScLok1z3I7Vn37KsF0Ka7k22aPMwXLLKkfEneavT41x1VNBq7Nedf9EFjjUG8S7,iv:mTlEphmcoFMv7dxIeSpsi77e3CJULcXxcOF1Nq66mUM=,tag:K2aGpaw2xeEj8537kB/cGA==,type:str]
matrix:
registrationSharedSecret: ENC[AES256_GCM,data:6IBlAfQhWlywWo/l8u5gAfW7bTgXwrAyk8WBBWkJQK+FL9LvUU5hDscozHrPIiRRzZdyeoAZ7phirDk3kN9E6Q==,iv:arZaxnIEUU3psaV8PqKAb46nlq73r2SAVlmCY+y+HB0=,tag:X/zsAtryEfl2PHKQ6GQfbg==,type:str]
sops:
age:
- recipient: age1pc92kl38mfr0j68dxww7tpzvqp3lpw6lwfylj6hn2k3rf4rddgtsjxdx47
@ -40,7 +42,7 @@ sops:
czdSTjNGSEpURlZEUTlIaUtGQUk5cW8KvylMTgtmHNvGnN7DonAsYQZB31mVli75
3OTN+mOetq2YNxh/Se7vqzwbZnshfTDk9nJi9bKZQhBt2nYR8eLRkg==
-----END AGE ENCRYPTED FILE-----
lastmodified: "2025-12-01T21:50:41Z"
mac: ENC[AES256_GCM,data:rtICn+ljt414EWhSmVqM3IttqBx07a+m0MHEADNQ7s3USSfq3oEXqfoA1Nt6nIF/ZjNYeebNW9hiiJcZw/Hh749p3Fdu64w63MUTwsBciT651DwNNHJHVGwELaU72nI8amtVln+Ka0VD58/cM0V4mcw+eNvfUS+ykUVZAqmOiHo=,iv:IlgqHdb1gtajBfWogN6EgZ1V6h7ToTR1cArP8jEYocg=,tag:bagJOpWoMSvsgmKT/LsAJg==,type:str]
lastmodified: "2026-03-26T10:22:50Z"
mac: ENC[AES256_GCM,data:RFNQKhb5AGMNZuZ8efT8s2/DrwOaN+Lge4M2a36NOzuNJ4xTI3Xcp0vEqpARplF9PSBZ64asWYqu4e21+KfS76Is6EaSyvfUc53QoX38zjn6S7EobiVwkCXcEfOAXOd14qqQNOBHcC4ELI5Ah0N7x/iYjX2+BYILQQCcgAGnbDE=,iv:/vJ7JsiP8adC5IUBYod/iHA3qQtDfrV9fmaglZyzQCA=,tag:vy9FfzKXSCCBM3cVMcAcfQ==,type:str]
unencrypted_suffix: _unencrypted
version: 3.11.0