diff --git a/hosts/flora-6/apps/prometheus.nix b/hosts/flora-6/apps/prometheus.nix index 686045a8..11bc0bf0 100644 --- a/hosts/flora-6/apps/prometheus.nix +++ b/hosts/flora-6/apps/prometheus.nix @@ -26,7 +26,7 @@ }; scrapeConfigs = [ { - job_name = "http-targets"; + job_name = "node-exporter-http"; static_configs = [{ targets = [ "127.0.0.1:${toString config.services.prometheus.exporters.node.port}" ]; labels = { @@ -35,7 +35,7 @@ }]; } { - job_name = "https-targets"; + job_name = "node-exporter-https"; scheme = "https"; metrics_path = "/metrics"; basic_auth = { @@ -49,6 +49,21 @@ }; }]; } + { + job_name = "matrix-synapse"; + scheme = "https"; + metrics_path = "/_synapse/metrics"; + basic_auth = { + username = "hakkonaut"; + password_file = "${config.age.secrets.nachtigall-metrics-prometheus-basic-auth-password.path}"; + }; + static_configs = [{ + targets = [ "nachtigall.pub.solar" ]; + labels = { + instance = "nachtigall"; + }; + }]; + } ]; }; } diff --git a/hosts/nachtigall/apps/matrix/irc.nix b/hosts/nachtigall/apps/matrix/irc.nix index 50e566c9..fb2c1e07 100644 --- a/hosts/nachtigall/apps/matrix/irc.nix +++ b/hosts/nachtigall/apps/matrix/irc.nix @@ -1,4 +1,17 @@ { config, lib, pkgs, ... }: +let + # Find element in list config.services.matrix-synapse.settings.listeners.*.resources + # that sets names = "client" + nameHasClient = name: name == "client"; + resourceHasClient = resource: builtins.any nameHasClient resource.names; + listenerWithClient = lib.findFirst + (listener: + builtins.any resourceHasClient listener.resources) + (throw "Found no matrix-synapse.settings.listeners.*.resources.*.names containing string client") + config.services.matrix-synapse.settings.listeners + ; + synapseClientPort = "${toString listenerWithClient.port}"; +in { systemd.services.matrix-appservice-irc.serviceConfig.SystemCallFilter = lib.mkForce [ "@system-service @pkey" @@ -13,7 +26,7 @@ settings = { homeserver = { domain = "pub.solar"; - url = "http://127.0.0.1:${toString (builtins.map (listener: listener.port) config.services.matrix-synapse.settings.listeners)}"; + url = "http://127.0.0.1:${synapseClientPort}"; media_url = "https://matrix.pub.solar"; enablePresence = false; }; diff --git a/hosts/nachtigall/apps/matrix/synapse.nix b/hosts/nachtigall/apps/matrix/synapse.nix index e35c914f..93cff67f 100644 --- a/hosts/nachtigall/apps/matrix/synapse.nix +++ b/hosts/nachtigall/apps/matrix/synapse.nix @@ -38,6 +38,45 @@ in allow_unsafe_locale = false; txn_limit = 0; }; + listeners = [ + { + bind_addresses = [ + "127.0.0.1" + ]; + port = 8008; + resources = [ + { + compress = true; + names = [ + "client" + ]; + } + { + compress = false; + names = [ + "federation" + ]; + } + ]; + tls = false; + type = "http"; + x_forwarded = true; + } + { + bind_addresses = [ + "127.0.0.1" + ]; + port = 8012; + resources = [ + { + names = [ + "metrics" + ]; + } + ]; + type = "metrics"; + } + ]; account_threepid_delegates.msisdn = ""; alias_creation_rules = [{ @@ -68,6 +107,7 @@ in encryption_enabled_by_default_for_room_type = "off"; event_cache_size = "100K"; federation_rr_transactions_per_room_per_second = 50; + federation_client_minimum_tls_version = "1.2"; forget_rooms_on_leave = true; include_profile_data_on_invite = true; instance_map = { }; @@ -162,6 +202,7 @@ in stream_writers = { }; trusted_key_servers = [{ server_name = "matrix.org"; }]; + suppress_key_server_warning = true; turn_allow_guests = false; turn_uris = [ @@ -213,6 +254,8 @@ in ]; }; + withJemalloc = true; + extraConfigFiles = [ "/run/agenix/matrix-synapse-secret-config.yaml" diff --git a/hosts/nachtigall/apps/nginx-matrix.nix b/hosts/nachtigall/apps/nginx-matrix.nix index c9431466..a65a3dce 100644 --- a/hosts/nachtigall/apps/nginx-matrix.nix +++ b/hosts/nachtigall/apps/nginx-matrix.nix @@ -88,10 +88,6 @@ in gzip_types text/plain application/json; ''; locations = { - # TODO: Configure metrics - # "/metrics" = { - # }; - # For telegram "/c3c3f34b-29fb-5feb-86e5-98c75ec8214b" = { proxyPass = "http://127.0.0.1:8009"; diff --git a/hosts/nachtigall/apps/nginx-prometheus-exporters.nix b/hosts/nachtigall/apps/nginx-prometheus-exporters.nix index f46e6515..af5678c7 100644 --- a/hosts/nachtigall/apps/nginx-prometheus-exporters.nix +++ b/hosts/nachtigall/apps/nginx-prometheus-exporters.nix @@ -1,5 +1,15 @@ -{ config, flake, ... }: - +{ config, flake, lib, ... }: +let + # Find element in list config.services.matrix-synapse.settings.listeners + # that sets type = "metrics" + listenerWithMetrics = lib.findFirst + (listener: + listener.type == "metrics") + (throw "Found no matrix-synapse.settings.listeners.*.type containing string metrics") + config.services.matrix-synapse.settings.listeners + ; + synapseMetricsPort = "${toString listenerWithMetrics.port}"; +in { age.secrets.nachtigall-metrics-nginx-basic-auth = { file = "${flake.self}/secrets/nachtigall-metrics-nginx-basic-auth.age"; @@ -14,6 +24,9 @@ locations."/metrics" = { proxyPass = "http://127.0.0.1:${toString(config.services.prometheus.exporters.node.port)}"; }; + locations."/_synapse/metrics" = { + proxyPass = "http://127.0.0.1:${synapseMetricsPort}"; + }; }; }; }