115 lines
2.7 KiB
Nix
115 lines
2.7 KiB
Nix
{
|
|
config,
|
|
tools,
|
|
pkgs,
|
|
...
|
|
}:
|
|
let
|
|
container = "matrix";
|
|
hostname = tools.build_hostname container;
|
|
admin_handle = "@${config.globals.master.login}:${hostname}";
|
|
db_host = tools.build_hostname "db";
|
|
auth_host = tools.build_hostname "auth";
|
|
db_pass = config.my-lxc.matrix.db.password;
|
|
sec = import ../config/_matrix_secrets.nix;
|
|
in
|
|
{
|
|
environment = {
|
|
etc."alloy/logs-synapse.alloy".text =
|
|
(import ./alloy/default-journal-logger.alloy.nix {
|
|
inherit tools container;
|
|
service = "matrix-synapse";
|
|
additional_stages = ''
|
|
stage.regex {
|
|
expression = "^(?P<facility>\\S+): \\[(?P<worker>[^\\]]+)\\] (?P<message>.*)$"
|
|
}
|
|
stage.labels {
|
|
values = {
|
|
facility = "",
|
|
worker = "",
|
|
}
|
|
}
|
|
stage.output {
|
|
source = "message"
|
|
}
|
|
'';
|
|
}).out;
|
|
};
|
|
services.matrix-synapse = {
|
|
enable = true;
|
|
extras = [
|
|
"oidc"
|
|
"postgres"
|
|
"systemd"
|
|
"url-preview"
|
|
];
|
|
settings = {
|
|
admin_users = [
|
|
admin_handle
|
|
];
|
|
enable_metrics = true;
|
|
server_name = hostname;
|
|
database = {
|
|
name = "psycopg2";
|
|
args = {
|
|
user = container;
|
|
password = db_pass;
|
|
database = container;
|
|
host = db_host;
|
|
port = 5432;
|
|
cp_min = 5;
|
|
cp_max = 10;
|
|
};
|
|
allow_unsafe_locale = true;
|
|
};
|
|
listeners = [
|
|
{
|
|
bind_addresses = [ "0.0.0.0" ];
|
|
port = 8008;
|
|
resources = [
|
|
{
|
|
compress = true;
|
|
names = [
|
|
"client"
|
|
"federation"
|
|
];
|
|
}
|
|
];
|
|
tls = false;
|
|
type = "http";
|
|
x_forwarded = true;
|
|
}
|
|
];
|
|
matrix-authentication-service = {
|
|
enable = true;
|
|
endpoint = "http://localhost:8080/";
|
|
secret = sec.mas_secret;
|
|
};
|
|
jwt_config = {
|
|
enabled = true;
|
|
secret = sec.jwt_secret;
|
|
algorithm = sec.jwt_algo;
|
|
};
|
|
oidc_providers = [
|
|
{
|
|
idp_id = "authentik";
|
|
idp_name = "authentik";
|
|
discover = true;
|
|
issuer = "https://${auth_host}/application/o/chat/";
|
|
client_id = sec.oidc_client_id;
|
|
client_secret = sec.oidc_client_secret;
|
|
scopes = [
|
|
"openid"
|
|
"profile"
|
|
"email"
|
|
];
|
|
user_mapping_provider.config = {
|
|
localpart_template = "{{ user.preferred_username }}";
|
|
display_name_template = "{{ user.name }}";
|
|
};
|
|
}
|
|
];
|
|
};
|
|
};
|
|
}
|