From f559671cae7b02526dedf7923b135c09e0d095d5 Mon Sep 17 00:00:00 2001
From: Miran Bastaja <miran.bastaja04@gmail.com>
Date: Fri, 3 Nov 2023 15:59:16 +0100
Subject: Inital commit ;P

---
 hosts/sagittarius/web/matrix.nix | 115 +++++++++++++++++++++++++++++++++++++++
 1 file changed, 115 insertions(+)
 create mode 100644 hosts/sagittarius/web/matrix.nix

(limited to 'hosts/sagittarius/web/matrix.nix')

diff --git a/hosts/sagittarius/web/matrix.nix b/hosts/sagittarius/web/matrix.nix
new file mode 100644
index 0000000..fc32044
--- /dev/null
+++ b/hosts/sagittarius/web/matrix.nix
@@ -0,0 +1,115 @@
+{ pkgs, config, ... }:
+let
+  server_name = "sorre.xyz";
+  matrix_hostname = "matrix.${server_name}";
+  #admin_email = "gloss_unranked088@simplelogin.com";
+
+  # Build a dervation that stores the content of `${server_name}/.well-known/matrix/server`
+  well_known_server = pkgs.writeText "well-known-matrix-server" ''
+    {
+      "m.server": "${matrix_hostname}"
+    }
+  '';
+
+  # Build a dervation that stores the content of `${server_name}/.well-known/matrix/client`
+  well_known_client = pkgs.writeText "well-known-matrix-client" ''
+    {
+      "m.homeserver": {
+        "base_url": "https://${matrix_hostname}"
+      }
+    }
+  '';
+in
+{
+  imports = [ ./acme.nix ];
+
+  networking.firewall.allowedTCPPorts = [ 80 443 8448 ];
+  networking.firewall.allowedUDPPorts = [ 80 443 8448 ];
+
+  services.matrix-conduit = {
+    enable = true;
+    # Currently conduit seems to have no substituter for the flake, which means
+    # that the compilation would be done on the server, therefore we're using
+    # the (prebuilt) nixpkgs version of it for now.
+    #package = inputs.conduit.packages.${pkgs.system}.default;
+    package = pkgs.matrix-conduit;
+    settings.global.server_name = server_name;
+    settings.global.allow_registration = false;
+  };
+
+  services.nginx = {
+    enable = true;
+    recommendedProxySettings = true;
+
+    virtualHosts."${matrix_hostname}" = {
+      enableACME = true;
+      forceSSL = true;
+
+      listen = [
+        {
+          addr = "0.0.0.0";
+          port = 443;
+          ssl = true;
+        }
+        {
+          addr = "[::]";
+          port = 443;
+          ssl = true;
+        }
+        {
+          addr = "0.0.0.0";
+          port = 8448;
+          ssl = true;
+        }
+        {
+          addr = "[::]";
+          port = 8448;
+          ssl = true;
+        }
+      ];
+      locations."/_matrix/" = {
+        proxyPass = "http://backend_conduit$request_uri";
+        proxyWebsockets = true;
+        extraConfig = ''
+          proxy_set_header Host $host;
+          proxy_buffering off;
+        '';
+      };
+      extraConfig = ''
+        merge_slashes off;
+      '';
+    };
+
+    virtualHosts."${server_name}" = {
+      enableACME = true;
+      forceSSL = true;
+
+      locations = {
+        "=/.well-known/matrix/server" = {
+          alias = "${well_known_server}";
+          extraConfig = ''
+            # Set the header since by default NGINX thinks it's just bytes
+            default_type application/json;
+          '';
+        };
+        "=/.well-known/matrix/client" = {
+          # Use the contents of the derivation built previously
+          alias = "${well_known_client}";
+
+          extraConfig = ''
+            # Set the header since by default NGINX thinks it's just bytes
+            default_type application/json;
+
+            # https://matrix.org/docs/spec/client_server/r0.4.0#web-browser-clients
+            add_header Access-Control-Allow-Origin "*";
+          '';
+        };
+      };
+    };
+
+    upstreams."backend_conduit".servers = {
+      "[::1]:${toString config.services.matrix-conduit.settings.global.port}" =
+        { };
+    };
+  };
+}
-- 
cgit v1.3.1