janhaa/infra
1
0
Fork 0
forked from pub-solar/infra
Code Pull requests Activity

mas: move to module, add secrets for prod

Browse source
This commit is contained in:
teutat3s 2024-10-30 17:57:33 +01:00
parent 4434a90136
commit 9d9bcf9a15
Signed by untrusted user: teutat3s
GPG key ID: 4FA1D3FA524F22C1
6 changed files with 135 additions and 104 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

13
hosts/nachtigall/configuration.nix
View file

@ -82,8 +82,15 @@
owner = "matrix-synapse";
};
pub-solar-os.matrix-synapse = {
age.secrets."matrix-authentication-service-secret-config.yml" = {
file = "${flake.self}/secrets/matrix-authentication-service-secret-config.yml.age";
mode = "400";
owner = "matrix-authentication-service";
};
pub-solar-os.matrix = {
enable = true;
synapse = {
sliding-sync.enable = true;
signing_key_path = config.age.secrets."matrix-synapse-signing-key".path;
extra-config-files = [
@ -106,6 +113,10 @@
# "/matrix-mautrix-telegram-registration.yaml"
];
};
matrix-authentication-service.extra-config-files = [
config.age.secrets."matrix-authentication-service-secret-config.yml".path
];
};
systemd.services.postgresql = {
after = [ "var-lib-postgresql.mount" ];

2
hosts/nachtigall/default.nix
View file

@ -9,10 +9,12 @@
./networking.nix
./wireguard.nix
./backups.nix
"${flake.inputs.fork}/nixos/modules/services//matrix/matrix-authentication-service.nix"
"${flake.inputs.unstable}/nixos/modules/services/web-apps/mastodon.nix"
];
disabledModules = [
"services/matrix/matrix-authentication-service.nix "
"services/web-apps/mastodon.nix"
];
}

50
hosts/underground/configuration.nix
View file

@ -42,8 +42,9 @@
owner = "matrix-authentication-service";
};
pub-solar-os.matrix-synapse = {
pub-solar-os.matrix = {
enable = true;
synapse = {
extra-config-files = [
config.age.secrets."staging-matrix-synapse-secret-config.yaml".path
@ -60,54 +61,9 @@
#"/var/lib/matrix-synapse/telegram-registration.yaml"
];
};
services.matrix-authentication-service = {
enable = true;
createDatabase = true;
extraConfigFiles = [
matrix-authentication-service.extra-config-files = [
config.age.secrets."staging-matrix-authentication-service-secret-config.yml".path
];
settings = {
http.public_base = "https://mas.${config.pub-solar-os.networking.domain}";
http.issuer = "https://mas.${config.pub-solar-os.networking.domain}";
http.listeners = [
{
name = "web";
resources = [
{ name = "discovery"; }
{ name = "human"; }
{ name = "oauth"; }
{ name = "compat"; }
{ name = "graphql"; }
{
name = "assets";
path = "${config.services.matrix-authentication-service.package}/share/matrix-authentication-service/assets";
}
];
binds = [
{
host = "0.0.0.0";
port = 8090;
}
];
proxy_protocol = false;
}
{
name = "internal";
resources = [
{ name = "health"; }
];
binds = [
{
host = "0.0.0.0";
port = 8081;
}
];
proxy_protocol = false;
}
];
passwords.enabled = false;
};
};
services.openssh.openFirewall = true;

67
modules/matrix/default.nix
View file

@ -10,9 +10,11 @@ let
serverDomain = "${config.pub-solar-os.networking.domain}";
in
{
options.pub-solar-os.matrix-synapse = {
enable = lib.mkEnableOption "Enable matrix-synapse to run on the node";
options.pub-solar-os = {
matrix = {
enable = lib.mkEnableOption "Enable matrix-synapse and matrix-authentication-service to run on the node";
synapse = {
app-service-config-files = lib.mkOption {
description = "List of app service config files";
type = lib.types.listOf lib.types.str;
@ -30,13 +32,24 @@ in
type = lib.types.str;
default = "${config.services.matrix-synapse.dataDir}/homeserver.signing.key";
};
sliding-sync.enable = lib.mkEnableOption {
description = "Whether to enable a sliding-sync proxy, no longer needed with synapse version 1.114+";
default = false;
};
};
config = lib.mkIf config.pub-solar-os.matrix-synapse.enable {
matrix-authentication-service = {
extra-config-files = lib.mkOption {
description = "List of extra mas config files";
type = lib.types.listOf lib.types.str;
default = [ ];
};
};
};
};
config = lib.mkIf config.pub-solar-os.matrix.enable {
services.matrix-synapse = {
enable = true;
settings = {
@ -265,6 +278,54 @@ in
plugins = [ config.services.matrix-synapse.package.plugins.matrix-synapse-shared-secret-auth ];
};
services.matrix-authentication-service = {
enable = true;
createDatabase = true;
extraConfigFiles = config.pub-solar-os.matrix.matrix-authentication-service.extra-config-files;
settings = {
http.public_base = "https://mas.${config.pub-solar-os.networking.domain}";
http.issuer = "https://mas.${config.pub-solar-os.networking.domain}";
http.listeners = [
{
name = "web";
resources = [
{ name = "discovery"; }
{ name = "human"; }
{ name = "oauth"; }
{ name = "compat"; }
{ name = "graphql"; }
{
name = "assets";
path = "${config.services.matrix-authentication-service.package}/share/matrix-authentication-service/assets";
}
];
binds = [
{
host = "0.0.0.0";
port = 8090;
}
];
proxy_protocol = false;
}
{
name = "internal";
resources = [
{ name = "health"; }
];
binds = [
{
host = "0.0.0.0";
port = 8081;
}
];
proxy_protocol = false;
}
];
passwords.enabled = false;
};
};
services.matrix-sliding-sync = {
enable = config.pub-solar-os.matrix-synapse.sliding-sync.enable;
settings = {

BIN
secrets/matrix-authentication-service-secret-config.yml.age Normal file
View file

Binary file not shown.

1
secrets/secrets.nix
View file

@ -68,6 +68,7 @@ in
"matrix-synapse-signing-key.age".publicKeys = nachtigallKeys ++ adminKeys;
"matrix-synapse-secret-config.yaml.age".publicKeys = nachtigallKeys ++ adminKeys;
"matrix-synapse-sliding-sync-secret.age".publicKeys = nachtigallKeys ++ adminKeys;
"matrix-authentication-service-secret-config.yml.age".publicKeys = nachtigallKeys ++ adminKeys;
"staging-matrix-synapse-secret-config.yaml.age".publicKeys = undergroundKeys ++ adminKeys;
"staging-matrix-authentication-service-secret-config.yml.age".publicKeys =