diff --git a/machines/matrix/configuration.nix b/machines/matrix/configuration.nix index 24ec356..154af9e 100644 --- a/machines/matrix/configuration.nix +++ b/machines/matrix/configuration.nix @@ -114,10 +114,10 @@ auto_join_rooms = [ "#space:community.rs" "#rules:community.rs" "#info:community.rs" ]; turn_uris = [ - "turn:turn.community.rs:3478?transport=udp" - "turn:turn.community.rs:3478?transport=tcp" + # "turn:turn.community.rs:3478?transport=udp" + # "turn:turn.community.rs:3478?transport=tcp" ]; - turn_user_lifetime = "1h"; + # turn_user_lifetime = "1h"; }; extraConfigFiles = [ config.sops.secrets."matrix-secrets.yaml".path ]; }; diff --git a/machines/pendulum/configuration.nix b/machines/pendulum/configuration.nix index 370f88e..d177f52 100644 --- a/machines/pendulum/configuration.nix +++ b/machines/pendulum/configuration.nix @@ -1,6 +1,7 @@ { config, lib, pkgs, inputs, ... }: { + imports = [ ./matrix.nix ]; # Sops setup for this machine sops.secrets = { "borg-ssh-key" = { @@ -11,10 +12,24 @@ sopsFile = ../../secrets/pendulum/borg.yaml; format = "yaml"; }; + "matrix-secrets.yaml" = { + owner = "matrix-synapse"; + format = "binary"; + sopsFile = ../../secrets/pendulum/recaptcha; + }; }; # Setup system configuration nathan = { services = { + nginx = { + enable = true; + acme = true; + }; + matrix = { + enable = true; + baseDomain = "community.rs"; + enableRegistration = true; + }; borg = { enable = true; extraExcludes = [ @@ -28,7 +43,7 @@ passwordFile = config.sops.secrets."borg-password".path; sshKey = config.sops.secrets."borg-ssh-key".path; }; - # postgresql.backup = true; + postgresql.backup = true; }; config = { setupGrub = false; @@ -42,6 +57,8 @@ }; # State version system.stateVersion = "23.05"; + # Postgres version + services.postgresql.package = pkgs.postgresql_15; # Configure bootloader boot.loader.grub.enable = true; boot.loader.grub.device = "/dev/sda"; @@ -65,4 +82,5 @@ # Setup home manager home-manager.users.nathan = import ./home.nix; + } diff --git a/machines/pendulum/matrix.nix b/machines/pendulum/matrix.nix new file mode 100644 index 0000000..c5c49db --- /dev/null +++ b/machines/pendulum/matrix.nix @@ -0,0 +1,126 @@ +{ config, lib, pkgs, ... }: + +{ + ## Matrix configuration + + # Create www-html group + users.groups.www-html.gid = 6848; + # Add shaurya + users.users.shaurya = { + isNormalUser = true; + home = "/home/shaurya"; + description = "Shaurya"; + extraGroups = [ "www-html" ]; + openssh.authorizedKeys.keys = [ + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDA8BwFgWGrX5is2rQV+T0dy4MUWhfpE5EzYxjgLuH1V shauryashubham1234567890@gmail.com" + ]; + shell = pkgs.nushell; + }; + + # Add www-html for my self + users.users.nathan = { extraGroups = [ "www-html" ]; }; + + # Configure matrix registration + services.matrix-synapse = { + settings = { + enable_registration_captcha = true; + allow_guest_access = false; + allow_public_rooms_over_federation = true; + experimental_features = { spaces_enabled = true; }; + auto_join_rooms = + [ "#space:community.rs" "#rules:community.rs" "#info:community.rs" ]; + turn_uris = [ + # "turn:turn.community.rs:3478?transport=udp" + # "turn:turn.community.rs:3478?transport=tcp" + ]; + # turn_user_lifetime = "1h"; + }; + extraConfigFiles = [ config.sops.secrets."matrix-secrets.yaml".path ]; + }; + + # Install our utilties + environment.systemPackages = with pkgs; [ matrix-synapse-tools.synadm ]; + + # Setup a task to cleanup the database + systemd.services.synapse-db-cleanup = { + serviceConfig = { + Type = "oneshot"; + User = "postgres"; + Group = "postgres"; + }; + path = with pkgs; [ matrix-synapse-tools.rust-synapse-compress-state ]; + script = '' + synapse_auto_compressor -p "user=matrix-synapse password=synapse dbname=synapse host=localhost" -c 500 -n 100 + ''; + }; + systemd.timers.synapse-db-cleanup = { + wantedBy = [ "timers.target" ]; + partOf = [ "synapse-db-cleanup.service" ]; + timerConfig = { + # Weekly on sunday mornings + OnCalendar = "Sun, 5:00"; + Unit = "synapse-db-cleanup.service"; + }; + }; + + # Configure the vhost for the domain + services.nginx.virtualHosts = let + fqdn = let + join = hostName: domain: + hostName + lib.optionalString (domain != null) ".${domain}"; + in join config.networking.hostName config.networking.domain; + in { + "${config.networking.domain}" = { + enableACME = true; + forceSSL = true; + + locations."= /.well-known/matrix/server".extraConfig = let + # use 443 instead of the default 8448 port to unite + # the client-server and server-server port for simplicity + server = { "m.server" = "${fqdn}:443"; }; + in '' + add_header Content-Type application/json; + return 200 '${builtins.toJSON server}'; + ''; + locations."= /.well-known/matrix/client".extraConfig = let + client = { + "m.homeserver" = { "base_url" = "https://${fqdn}"; }; + "m.identity_server" = { "base_url" = "https://vector.im"; }; + }; + # ACAO required to allow element-web on any URL to request this json file + in '' + add_header Content-Type application/json; + add_header Access-Control-Allow-Origin *; + return 200 '${builtins.toJSON client}'; + ''; + locations."/".extraConfig = '' + rewrite ^(.*)$ http://www.community.rs$1 redirect; + ''; + }; + # Main domain + "www.community.rs" = { + enableACME = true; + forceSSL = true; + locations."= /.well-known/matrix/server".extraConfig = let + # use 443 instead of the default 8448 port to unite + # the client-server and server-server port for simplicity + server = { "m.server" = "${fqdn}:443"; }; + in '' + add_header Content-Type application/json; + return 200 '${builtins.toJSON server}'; + ''; + locations."= /.well-known/matrix/client".extraConfig = let + client = { + "m.homeserver" = { "base_url" = "https://${fqdn}"; }; + "m.identity_server" = { "base_url" = "https://vector.im"; }; + }; + # ACAO required to allow element-web on any URL to request this json file + in '' + add_header Content-Type application/json; + add_header Access-Control-Allow-Origin *; + return 200 '${builtins.toJSON client}'; + ''; + root = "/var/www"; + }; + }; +} diff --git a/modules/linux/swaywm.nix b/modules/linux/swaywm.nix index 6e62fa2..8c4b5ac 100644 --- a/modules/linux/swaywm.nix +++ b/modules/linux/swaywm.nix @@ -56,6 +56,7 @@ in with lib; { enable = true; # Enable the wrapper for gtk applications wrapperFeatures.gtk = true; + package = null; }; environment.sessionVariables = { MOZ_ENABLE_WAYLAND = "1"; }; diff --git a/secrets/pendulum/recaptcha b/secrets/pendulum/recaptcha new file mode 100644 index 0000000..3015478 --- /dev/null +++ b/secrets/pendulum/recaptcha @@ -0,0 +1,24 @@ +{ + "data": "ENC[AES256_GCM,data:xaTwPCDE4nTOsYobxMCGF42BhWDgAAN2DmMbYqFQlc12RY0Azy/S3a62XI4z+uPBUJlGFVHalWFKyS0ThmMjjfL1rZfusvGNYHjNCwiryBEMTXSH4JQip5qzxTSpnsoTLSnJhEZ/LU/40CxCE0WzYSv5hm20Xyq3Gf8jpQn2lIDgZVn6CdBd0c3eFiKu7Z7mcNY07mJ9UIHYXrp8oAwr+qw2GUOfvy4h,iv:q5BMv0eqcqypdXJtbrAMkq6FsHfhbq2a0jnDKMLdNBM=,tag:abScyBGkyigPrs2ZM8zlLQ==,type:str]", + "sops": { + "kms": null, + "gcp_kms": null, + "azure_kv": null, + "hc_vault": null, + "age": [ + { + "recipient": "age1ud80054jwf6ff7xx65ta6g7qxx2flc24r5gyyfjz43kvppjutqyskr2qm2", + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBRQnV6enVhVUpKWklQenBq\nT2NrUHc3TGtmeGFDc1JtWFgwaGhiRzl4MFNnClhrTmFFZUh6ODNCNVJ1azhXUWwx\nblJDWENCanpSdnVmSCtubTdZQTVMUFEKLS0tIDk4K2czVFFqbGl1aEJyZXByV01B\nNXRSODFCRDlVVlQycE9ENXNGL2d3b3cK6UXVYoGb4GzuObFCJQelQhC/oT4YuUT/\nJX1hKPJFwdlgY7rhSrt0zmYmrjoAIC59o4B3nqSsNy4bFjCYjeVYOA==\n-----END AGE ENCRYPTED FILE-----\n" + }, + { + "recipient": "age1448z8f03hgnem2qeh2020k5tyma4hv365af8fyk4t2vhefedcscsdjs53k", + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBQcFFnTDRCYjJ4Vk5aOEVx\nM3NwNVY1MEFQdEg5K1NJZm5TWGIraUZ1YW5FCk8zN24vK01MZjhQNGdRdUFwYkdp\nUFNEaGJTdWNUNUdxSmVwdW01NHM4c0UKLS0tIEtkeDRCek5sLzBzb2RucFBIaWlV\nb3RNLzd0c0dlbnNDYjZEYTc2ZDNjTTQKUHSIcCVWPRhWLEWlHp+v8eEHOd9+UhpY\nfArxbP+xaJ1b5PATLiiNrgnJ9FiLJ6f8nnNE0d2lwBc4LEgBu+Lv8g==\n-----END AGE ENCRYPTED FILE-----\n" + } + ], + "lastmodified": "2023-06-04T16:29:23Z", + "mac": "ENC[AES256_GCM,data:c+Q7CDXAErHyGBlPoipJa7cknba26DXzjDGIslsX9pvfHmPx3/NUYkqCANQRvBqECBB0sV5S+0gavxYVr1Yvfy+D7FNPzW8OLBom2af6MHQRUHFtDmTT16HPzF+aYP3Y5Deogsxh4JJRmUaM2HsGvgEK2mZ4rtATrFUSi0NTmT8=,iv:sfuq9g+7vGvlSQRhIKNIKAL1Nbl/gNwwxUK3qgoyFSE=,tag:XmmurLyNN4mp1/dPTcZW2Q==,type:str]", + "pgp": null, + "unencrypted_suffix": "_unencrypted", + "version": "3.7.3" + } +} \ No newline at end of file