blob: 04b78ed41b97b5b96e4bcc345de6f49ae1a854b2 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
|
{
pkgs,
config,
lib,
inputs,
...
}:
let
cfg = config.wilkuu.services.continuwuity;
hostname = config.netowrking.hostName;
inherit (lib) mkOption types mkEnableOption;
in
{
options.wilkuu.services.continuwuity = {
host-domain = mkOption {
type = types.str;
default = "matrix.${hostname}.local";
example = "matrix.wilkuu.xyz";
description = "The hosting address of the server";
};
fdqn = mkOption {
type = types.str;
default = "${hostname}.local";
example = "wilkuu.xyz";
description = "The domain displayed in the addresses for users/rooms";
};
doACME = mkEnableOption "Enable ACME for stalwart here";
enable = mkEnableOption "Enable the matrix server";
dataDir = mkOption {
type = types.path;
description = "Storage localtion for Stalwart user data";
default = "/srv/data/continuwuity";
example = "/srv/data/continuwuity";
};
allowRegistration = mkEnableOption "allow random people to register";
allowFederation = mkEnableOption "allow other servers to federate";
trustedServers = mkOption {
type = types.listOf types.str;
default = [ ];
example = [ "matrix.org" ];
description = "The trusted matrix servers.";
};
};
config = lib.mkIf cfg.enable {
services.matrix-continuwuity = {
enable = cfg.enable;
package = inputs.continuwuity.packages.${pkgs.stdenv.hostPlatform.system}.default;
settings.global = {
# Hosted at cfg.domain, server fdqn is fdqn.
server_name = cfg.fdqn;
# Remove the trans flag, it is a nice feature but not my style.
new_user_displayname_suffix = "";
# Configure matrix stuffs
allow_registration = cfg.allowRegistration;
allow_encryption = true;
allow_federation = cfg.allowFederation;
trusted_servers = cfg.trustedServers;
ip_lookup_strategy = 4;
# Host the server on a unix-socket and use nginx to connect to that socket.
address = null;
unix_socket_path = "/run/continuwuity/continuwuity.sock";
unix_socket_perms = 660;
# You can run this once to create a user called harbinger which is admin.
# This might not be needed to bootstrap c10y in the later versions.
# It will crash c10y if the user already exists (Idk what the workaround is)
# admin_execute = [
# "users create-user harbinger"
# "users make-user-admin harbinger"
# ];
url_preview_domain_explicit_allowlist = [
"i.imgur.com"
"cdn.discordapp.com"
"ooye.elisaado.com"
"media.tenor.com"
"media1.tenor.com"
"tenor.com"
"giphy.com"
"cdn.nest.rip"
"ssd-cdn.nest.rip"
"i.github.com"
"github.com"
"wilkuu.xyz"
];
# well-known setup
well_known = {
client = "https://${cfg.host-domain}";
server = "${cfg.host-domain}:443";
support_email = "jakub@wilkuu.xyz";
};
};
};
services.nginx.virtualHosts =
let
socket = "http://unix://${config.services.matrix-continuwuity.settings.global.unix_socket_path}";
in
{
# well-known discovery
# TODO: Might need to enforce https here, if it already is not.
${cfg.fdqn}.locations."/.well-known/matrix/".proxyPass = socket;
# The matrix server
${cfg.host-domain} = {
enableACME = cfg.doACME;
forceSSL = cfg.doACME;
locations."/_matrix".proxyPass = socket;
};
};
# Let nginx access the socket.
systemd.services.nginx.serviceConfig.SupplementaryGroups = [
config.services.matrix-continuwuity.group
];
};
}
|
