axeman/pub-solar-infra-new
1
0
Fork 0
forked from pub-solar/infra
Code Pull requests Activity

matrix: do not change paths for nachtigall secrets

Browse source
This commit is contained in:
teutat3s 2024-10-27 17:27:17 +01:00
parent d6cc9c8164
commit 7775ad332e
Signed by untrusted user: teutat3s
GPG key ID: 4FA1D3FA524F22C1
3 changed files with 21 additions and 12 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
hosts/nachtigall/configuration.nix
View file

@ -63,18 +63,21 @@
# matrix-synapse
age.secrets."nachtigall-matrix-synapse-signing-key" = {
file = "${flake.self}/secrets/nachtigall-matrix-synapse-signing-key.age";
path = "/run/agenix/matrix-synapse-signing-key";
mode = "400";
owner = "matrix-synapse";
};
age.secrets."nachtigall-matrix-synapse-secret-config.yaml" = {
file = "${flake.self}/secrets/nachtigall-matrix-synapse-secret-config.yaml.age";
path = "/run/agenix/matrix-synapse-secret-config.yaml";
mode = "400";
owner = "matrix-synapse";
};
age.secrets."nachtigall-matrix-synapse-sliding-sync-secret" = {
file = "${flake.self}/secrets/nachtigall-matrix-synapse-sliding-sync-secret.age";
path = "/run/agenix/matrix-synapse-sliding-sync-secret";
mode = "400";
owner = "matrix-synapse";
};
@ -82,6 +85,7 @@
pub-solar-os.matrix-synapse = {
enable = true;
sliding-sync.enable = true;
signing_key_path = config.age.secrets."nachtigall-matrix-synapse-signing-key".path;
extra-config-files = [
config.age.secrets."nachtigall-matrix-synapse-secret-config.yaml".path

3
modules/coturn/default.nix
View file

@ -7,6 +7,7 @@
{
age.secrets."nachtigall-coturn-static-auth-secret" = {
file = "${flake.self}/secrets/nachtigall-coturn-static-auth-secret.age";
path = "/run/agenix/coturn-static-auth-secret";
mode = "400";
owner = "turnserver";
};
@ -18,7 +19,7 @@
min-port = 49000;
max-port = 50000;
use-auth-secret = true;
static-auth-secret-file = "/run/agenix/nachtigall-coturn-static-auth-secret";
static-auth-secret-file = config.age.secrets."nachtigall-coturn-static-auth-secret".path;
realm = "turn.${config.pub-solar-os.networking.domain}";
cert = "${config.security.acme.certs.${realm}.directory}/full.pem";
pkey = "${config.security.acme.certs.${realm}.directory}/key.pem";

26
modules/matrix/default.nix
View file

@ -30,6 +30,10 @@ in
type = lib.types.str;
default = "${config.services.matrix-synapse.dataDir}/homeserver.signing.key";
};
sliding-sync.enable = lib.mkEnableOption {
description = "Whether to enable a sliding-sync proxy, no longer needed with synapse version 1.114+";
default = false;
};
};
config = lib.mkIf config.pub-solar-os.matrix-synapse.enable {
@ -261,17 +265,17 @@ in
plugins = [ config.services.matrix-synapse.package.plugins.matrix-synapse-shared-secret-auth ];
};
#services.matrix-sliding-sync = {
# enable = true;
# settings = {
# SYNCV3_SERVER = "https://${publicDomain}";
# SYNCV3_BINDADDR = "127.0.0.1:8011";
# # The bind addr for Prometheus metrics, which will be accessible at
# # /metrics at this address
# SYNCV3_PROM = "127.0.0.1:9100";
# };
# environmentFile = config.age.secrets."matrix-synapse-sliding-sync-secret".path;
#};
services.matrix-sliding-sync = {
enable = config.pub-solar-os.matrix-synapse.sliding-sync.enable;
settings = {
SYNCV3_SERVER = "https://${publicDomain}";
SYNCV3_BINDADDR = "127.0.0.1:8011";
# The bind addr for Prometheus metrics, which will be accessible at
# /metrics at this address
SYNCV3_PROM = "127.0.0.1:9100";
};
environmentFile = config.age.secrets."nachtigall-matrix-synapse-sliding-sync-secret".path;
};
pub-solar-os.backups.restic.matrix-synapse = {
paths = [