mas: move to module, add secrets for prod

hosts/nachtigall/configuration.nix

@@ -82,8 +82,15 @@
     owner = "matrix-synapse";
   };
 
-  pub-solar-os.matrix-synapse = {
+  age.secrets."matrix-authentication-service-secret-config.yml" = {
+    file = "${flake.self}/secrets/matrix-authentication-service-secret-config.yml.age";
+    mode = "400";
+    owner = "matrix-authentication-service";
+  };
+
+  pub-solar-os.matrix = {
     enable = true;
+    synapse = {
       sliding-sync.enable = true;
       signing_key_path = config.age.secrets."matrix-synapse-signing-key".path;
       extra-config-files = [
@@ -106,6 +113,10 @@
         # "/matrix-mautrix-telegram-registration.yaml"
       ];
     };
+    matrix-authentication-service.extra-config-files = [
+      config.age.secrets."matrix-authentication-service-secret-config.yml".path
+    ];
+  };
 
   systemd.services.postgresql = {
     after = [ "var-lib-postgresql.mount" ];

hosts/nachtigall/default.nix

@@ -9,10 +9,12 @@
     ./networking.nix
     ./wireguard.nix
     ./backups.nix
+    "${flake.inputs.fork}/nixos/modules/services//matrix/matrix-authentication-service.nix"
     "${flake.inputs.unstable}/nixos/modules/services/web-apps/mastodon.nix"
   ];
 
   disabledModules = [
+    "services/matrix/matrix-authentication-service.nix "
     "services/web-apps/mastodon.nix"
   ];
 }

hosts/underground/configuration.nix

@@ -42,8 +42,9 @@
     owner = "matrix-authentication-service";
   };
 
-  pub-solar-os.matrix-synapse = {
+  pub-solar-os.matrix = {
     enable = true;
+    synapse = {
       extra-config-files = [
         config.age.secrets."staging-matrix-synapse-secret-config.yaml".path
 
@@ -60,54 +61,9 @@
         #"/var/lib/matrix-synapse/telegram-registration.yaml"
       ];
     };
-
+    matrix-authentication-service.extra-config-files = [
-  services.matrix-authentication-service = {
-    enable = true;
-    createDatabase = true;
-    extraConfigFiles = [
       config.age.secrets."staging-matrix-authentication-service-secret-config.yml".path
     ];
-    settings = {
-      http.public_base = "https://mas.${config.pub-solar-os.networking.domain}";
-      http.issuer = "https://mas.${config.pub-solar-os.networking.domain}";
-      http.listeners = [
-        {
-          name = "web";
-          resources = [
-            { name = "discovery"; }
-            { name = "human"; }
-            { name = "oauth"; }
-            { name = "compat"; }
-            { name = "graphql"; }
-            {
-              name = "assets";
-              path = "${config.services.matrix-authentication-service.package}/share/matrix-authentication-service/assets";
-            }
-          ];
-          binds = [
-            {
-              host = "0.0.0.0";
-              port = 8090;
-            }
-          ];
-          proxy_protocol = false;
-        }
-        {
-          name = "internal";
-          resources = [
-            { name = "health"; }
-          ];
-          binds = [
-            {
-              host = "0.0.0.0";
-              port = 8081;
-            }
-          ];
-          proxy_protocol = false;
-        }
-      ];
-      passwords.enabled = false;
-    };
   };
 
   services.openssh.openFirewall = true;

modules/matrix/default.nix

@@ -10,9 +10,11 @@ let
   serverDomain = "${config.pub-solar-os.networking.domain}";
 in
 {
-  options.pub-solar-os.matrix-synapse = {
+  options.pub-solar-os = {
-    enable = lib.mkEnableOption "Enable matrix-synapse to run on the node";
+    matrix = {
+      enable = lib.mkEnableOption "Enable matrix-synapse and matrix-authentication-service to run on the node";
 
+      synapse = {
         app-service-config-files = lib.mkOption {
           description = "List of app service config files";
           type = lib.types.listOf lib.types.str;
@@ -30,13 +32,24 @@ in
           type = lib.types.str;
           default = "${config.services.matrix-synapse.dataDir}/homeserver.signing.key";
         };
+
         sliding-sync.enable = lib.mkEnableOption {
           description = "Whether to enable a sliding-sync proxy, no longer needed with synapse version 1.114+";
           default = false;
         };
       };
 
-  config = lib.mkIf config.pub-solar-os.matrix-synapse.enable {
+      matrix-authentication-service = {
+        extra-config-files = lib.mkOption {
+          description = "List of extra mas config files";
+          type = lib.types.listOf lib.types.str;
+          default = [ ];
+        };
+      };
+    };
+  };
+
+  config = lib.mkIf config.pub-solar-os.matrix.enable {
     services.matrix-synapse = {
       enable = true;
       settings = {
@@ -265,6 +278,54 @@ in
       plugins = [ config.services.matrix-synapse.package.plugins.matrix-synapse-shared-secret-auth ];
     };
 
+    services.matrix-authentication-service = {
+      enable = true;
+      createDatabase = true;
+      extraConfigFiles = config.pub-solar-os.matrix.matrix-authentication-service.extra-config-files;
+
+      settings = {
+        http.public_base = "https://mas.${config.pub-solar-os.networking.domain}";
+        http.issuer = "https://mas.${config.pub-solar-os.networking.domain}";
+        http.listeners = [
+          {
+            name = "web";
+            resources = [
+              { name = "discovery"; }
+              { name = "human"; }
+              { name = "oauth"; }
+              { name = "compat"; }
+              { name = "graphql"; }
+              {
+                name = "assets";
+                path = "${config.services.matrix-authentication-service.package}/share/matrix-authentication-service/assets";
+              }
+            ];
+            binds = [
+              {
+                host = "0.0.0.0";
+                port = 8090;
+              }
+            ];
+            proxy_protocol = false;
+          }
+          {
+            name = "internal";
+            resources = [
+              { name = "health"; }
+            ];
+            binds = [
+              {
+                host = "0.0.0.0";
+                port = 8081;
+              }
+            ];
+            proxy_protocol = false;
+          }
+        ];
+        passwords.enabled = false;
+      };
+    };
+
     services.matrix-sliding-sync = {
       enable = config.pub-solar-os.matrix-synapse.sliding-sync.enable;
       settings = {

secrets/secrets.nix

@@ -68,6 +68,7 @@ in
   "matrix-synapse-signing-key.age".publicKeys = nachtigallKeys ++ adminKeys;
   "matrix-synapse-secret-config.yaml.age".publicKeys = nachtigallKeys ++ adminKeys;
   "matrix-synapse-sliding-sync-secret.age".publicKeys = nachtigallKeys ++ adminKeys;
+  "matrix-authentication-service-secret-config.yml.age".publicKeys = nachtigallKeys ++ adminKeys;
 
   "staging-matrix-synapse-secret-config.yaml.age".publicKeys = undergroundKeys ++ adminKeys;
   "staging-matrix-authentication-service-secret-config.yml.age".publicKeys =