From 22513474bb44ec5183fb01650ada4a826f11bff6 Mon Sep 17 00:00:00 2001 From: stuebinm Date: Thu, 18 Mar 2021 23:01:41 +0100 Subject: [PATCH] synapse/element: nicer code layout for the config --- hosts/hainich/services/matrix-synapse.nix | 121 ++++++++++------------ 1 file changed, 55 insertions(+), 66 deletions(-) diff --git a/hosts/hainich/services/matrix-synapse.nix b/hosts/hainich/services/matrix-synapse.nix index fcb61b2..49151da 100644 --- a/hosts/hainich/services/matrix-synapse.nix +++ b/hosts/hainich/services/matrix-synapse.nix @@ -15,54 +15,70 @@ services.nginx = { enable = true; # only recommendedProxySettings and recommendedGzipSettings are strictly required, - # but the rest make sense as well + # but the rest make sense as well (according to the broken example from the manual) recommendedTlsSettings = true; recommendedOptimisation = true; recommendedGzipSettings = true; recommendedProxySettings = true; virtualHosts = { + # This host section can be placed on a different host than the rest, - # i.e. to delegate from the host being accessible as ${config.networking.domain} - # to another host actually running the Matrix homeserver. + # i.e. to delegate from the host on which matrix / synapse actually run. + # This may make migration easier; in our case it's mostly added complexity. "hacc.space" = { - locations."= /.well-known/matrix/server".extraConfig = - let - # use 443 instead of the default 8448 port to unite - # the client-server and server-server port for simplicity - server = { "m.server" = "matrix.hacc.space:443"; }; - in '' - add_header Content-Type application/json; - return 200 '${builtins.toJSON server}'; - ''; + # see https://matrix.org/docs/spec/client_server/latest#get-well-known-matrix-client + # for documentation on what should be returned at these endpoints. + locations."= /.well-known/matrix/server".extraConfig = '' + add_header Content-Type application/json; + return 200 '${builtins.toJSON { "m.server" = "matrix.hacc.space:443"; }}'; + ''; + # this is to configure the nice default homeserver setting for our element web. locations."= /.well-known/matrix/client".extraConfig = - let - client = { - "m.homeserver" = { "base_url" = "https://matrix.hacc.space"; }; - "m.identity_server" = { "base_url" = "https://vector.im"; }; - }; - # ACAO required to allow element-web on any URL to request this json file - in '' - add_header Content-Type application/json; - add_header Access-Control-Allow-Origin *; - return 200 '${builtins.toJSON client}'; - ''; + let client = { + "m.homeserver" = { "base_url" = "https://matrix.hacc.space"; }; + "m.identity_server" = { "base_url" = "https://vector.im"; }; + }; + in '' + add_header Content-Type application/json; + add_header Access-Control-Allow-Origin *; + return 200 '${builtins.toJSON client}'; + ''; }; - # Reverse proxy for Matrix client-server and server-server communication + + # this serves the actual matrix endpoint "matrix.hacc.space" = { enableACME = true; forceSSL = true; - # Or do a redirect instead of the 404, or whatever is appropriate for you. - # But do not put a Matrix Web client here! See the Element web section below. + # it is not recommended to have the actual element web interface on the same domain, + # cf. https://github.com/vector-im/element-web#separate-domains on this. locations."/".extraConfig = '' return 404; ''; - # forward all Matrix API calls to the synapse Matrix homeserver locations."/_matrix" = { - proxyPass = "http://[::1]:8008"; # without a trailing / + proxyPass = "http://[::1]:8008"; + }; + }; + + + # the element web client for our matrix server. + "element.matrix.hacc.space" = { + enableACME = true; + forceSSL = true; + serverAliases = [ + "element.hacc.space" + ]; + root = pkgs.element-web.override { + conf = { + # the base_url here must be identical to the one on hacc.space/.well-known above. + default_server_config."m.homeserver" = { + "base_url" = "https://matrix.hacc.space"; + "server_name" = "matrix.hacc.space"; + }; + }; }; }; }; @@ -71,43 +87,16 @@ services.matrix-synapse = { enable = true; server_name = "hacc.space"; - # TODO: this is horrible, and should probably be removed once everything's running - # so we won't have secrets in the nix store. - # - # I used this to test that the server works at all, and I've removed it again for now. - registration_shared_secret = ""; - listeners = [ - { - port = 8008; - bind_address = "::1"; - type = "http"; - tls = false; - x_forwarded = true; - resources = [ - { - names = [ "client" "federation" ]; - compress = false; - } - ]; - } - ]; - }; - - services.nginx.virtualHosts."element.matrix.hacc.space" = { - enableACME = true; - forceSSL = true; - serverAliases = [ - "element.hacc.space" - ]; - root = pkgs.element-web.override { - conf = { - default_server_config."m.homeserver" = { - "base_url" = "https://matrix.hacc.space"; - "server_name" = "matrix.hacc.space"; - }; - }; - }; - - #locations."= /config.element.matrix.hacc.space.json".alias = element.outPath + "/config.json"; + listeners = [ { + port = 8008; + bind_address = "::1"; + type = "http"; + tls = false; + x_forwarded = true; + resources = [ { + names = [ "client" "federation" ]; + compress = false; + } ]; + } ]; }; }