105 lines
2.5 KiB
Nix
105 lines
2.5 KiB
Nix
{ config, tools, ... }:
|
|
let
|
|
mask = tools.mask_cidr;
|
|
db_host = tools.build_ip "db";
|
|
db_pass = (import ../config/_passwords.nix).matrix;
|
|
|
|
hostname = tools.build_hostname "matrix";
|
|
auth = tools.build_hostname "auth";
|
|
sec = import ../config/_matrix_secrets.nix;
|
|
in
|
|
{
|
|
http = {
|
|
listeners = [
|
|
{
|
|
name = "web";
|
|
resources = [
|
|
{ name = "discovery"; }
|
|
{ name = "human"; }
|
|
{ name = "oauth"; }
|
|
{ name = "compat"; }
|
|
{ name = "graphql"; }
|
|
{ name = "assets"; }
|
|
];
|
|
binds = [
|
|
{ address = "[::]:8080"; }
|
|
];
|
|
proxy_protocol = false;
|
|
}
|
|
{
|
|
name = "internal";
|
|
resources = [
|
|
{ name = "health"; }
|
|
];
|
|
binds = [
|
|
{
|
|
host = "localhost";
|
|
port = 8081;
|
|
}
|
|
];
|
|
proxy_protocol = false;
|
|
}
|
|
];
|
|
trusted_proxies = [
|
|
mask
|
|
"127.0.0.1/8"
|
|
];
|
|
public_base = "http://[::]:8080/";
|
|
issuer = "http://[::]:8080/";
|
|
database = {
|
|
uri = "postgresql://matrix:${db_pass}@${db_host}:5432/matrix_mas";
|
|
max_connections = 10;
|
|
min_connections = 0;
|
|
connect_timeout = 30;
|
|
idle_timeout = 600;
|
|
max_lifetime = 1800;
|
|
};
|
|
email = {
|
|
from = "\"Authentication Service\" <root@localhost>";
|
|
reply_to = "\"Authentication Service\" <root@localhost>";
|
|
transport = "blackhole";
|
|
};
|
|
secrets = sec.mas;
|
|
passwords = {
|
|
enabled = true;
|
|
schemes = [
|
|
{
|
|
version = 1;
|
|
algorithm = "bcrypt";
|
|
minimum_complexity = 3;
|
|
}
|
|
];
|
|
};
|
|
matrix = {
|
|
kind = "synapse";
|
|
homeserver = hostname;
|
|
secret = sec.mas_secret;
|
|
endpoint = "http://localhost:8008/";
|
|
upstream_oauth2 = {
|
|
providers = [
|
|
{
|
|
id = sec.oidc_provider_id;
|
|
synapse_idp_id = "oidc-authentik";
|
|
issuer = "https://${auth}";
|
|
client_id = sec.oidc_client_id;
|
|
client_secret = sec.oidc_client_secret;
|
|
scope = "openid profile email";
|
|
discovery_mode = "insecure";
|
|
claims_imports = {
|
|
localpart = {
|
|
action = "require";
|
|
template = "{{ user.preferred_username }}";
|
|
on_conflicts = "add";
|
|
};
|
|
displayname = {
|
|
action = "suggest";
|
|
template = "{{ user.name }}";
|
|
};
|
|
};
|
|
}
|
|
];
|
|
};
|
|
};
|
|
};
|
|
}
|