feat(nixos): bfs: +matrix, very unsave

nixos/system/bfs/bfs.nix

@@ -10,6 +10,7 @@
   ...
 }: let
   xrayPort = 10086;
+  matrixDomain = "accord.tube";
 in {
   # TODO:
   # white list
@@ -20,8 +21,20 @@ in {
   imports = [
     self.nixosModules.hectic
     inputs.sops-nix.nixosModules.sops
+    #./voice-tune.nix
+    ./matrix.nix
   ];
 
+  currentServer = {
+    matrix = {
+      postgresql   = {
+        port = 5432;
+        initialEnvFile = config.sops.secrets."init-postgresql".path;
+      };
+      matrixDomain   = "accord.tube";
+    };
+  };
+
   services.xray = {
     enable  = true;
     settingsFile = config.sops.secrets."config".path;
@@ -62,25 +75,25 @@ in {
     };
   };
 
- 
   hectic = {
     archetype.base.enable = true;
     archetype.dev.enable  = true;
   };
 
   sops = {
-    gnupg.sshKeyPaths        = [ ];
-    age.sshKeyPaths          = [ "/etc/ssh/ssh_host_ed25519_key" ];
-    defaultSopsFile          = ../../../sus/bfs.xray.yaml;
+    gnupg.sshKeyPaths         = [ ];
+    age.sshKeyPaths           = [ "/etc/ssh/ssh_host_ed25519_key" ];
+    defaultSopsFile           = ../../../sus/bfs.xray.yaml;
 
-    secrets."config"         = {};
+    secrets."config"          = {};
+    secrets."init-postgresql" = {};
   };
 
-
   networking.firewall = {
     enable = true;
     allowedTCPPorts = [
       xrayPort
+      80 443 # for acme
     ];
   };
 }

nixos/system/bfs/matrix.nix

@@ -0,0 +1,141 @@
+{ pkgs, lib, config, ... }: let
+  cfg = config.currentServer.matrix;
+in {
+  options = {
+      currentServer.matrix = {
+        postgresql = {
+          port = lib.mkOption {
+            type = lib.types.port;
+            default = 5432;
+            description = ''
+              postgres port
+            '';
+          };
+          initialEnvFile = lib.mkOption {
+            type = lib.types.path;
+            description = ''
+              path to env file with postgresql initial secrets
+
+              content:
+              POSTGRESQL_PASSWORD=
+            '';
+          };
+        };
+        matrixDomain = lib.mkOption {
+            type = lib.types.str;
+            description = ''
+              domain to matrix
+            '';
+          };
+
+      };
+  };
+  config  = {
+    services.matrix-synapse = {
+      enable = true;
+      settings = {
+        server_name = cfg.matrixDomain;
+        public_baseurl = "https://${cfg.matrixDomain}";
+        listeners = [
+          {
+            port = 8008;
+            bind_addresses = [ "0.0.0.0" ];
+            type = "http";
+            tls = false;
+            resources = [
+              { 
+                names = [ 
+                  "client" 
+                  # Ability speak between different matrix servers, requires .well-known
+                  #"federation"
+                ];
+                compress = false; 
+              }
+            ];
+          } 
+        ];
+
+        enable_registration = true;
+        enable_registration_without_verification = true;
+
+        registration_shared_secret = "secret1";
+        macaroon_secret_key        = "secret2";
+        form_secret                = "secret3";
+      };
+    };
+
+    environment.systemPackages = [
+      pkgs.matrix-synapse
+    ];
+
+    services.postgresql = {
+      enable = true;
+      package = pkgs.postgresql_17;
+
+      initdbArgs = [
+        "--locale=C"
+        "--encoding=UTF8"
+      ];
+
+      enableTCPIP = true;
+      port = cfg.postgresql.port;
+      authentication = builtins.concatStringsSep "\n" [
+        "local all         all           trust"
+        "host  sameuser    all           127.0.0.1/32 scram-sha-256"
+        "host  sameuser    all           ::1/128 scram-sha-256"
+        "host  all         all           ::1/128 scram-sha-256"
+        "host  all         all           0.0.0.0/0 scram-sha-256"
+
+        "host  replication postgres      127.0.0.1/32   scram-sha-256"
+        "host  replication postgres      ::1/128        scram-sha-256"
+      ];
+
+      settings = {
+        wal_level = "replica";
+        max_wal_senders = 10;
+      };
+
+      ensureUsers = [
+        {
+          name = "matrix-synapse";
+          ensureClauses.login = true;
+          ensureDBOwnership = true;
+        }
+      ];
+
+      ensureDatabases = [
+        "matrix-synapse"
+      ];
+
+      initialScript = pkgs.writeText "init-sql-script" ''
+        -- setup password from env/sops
+        DO $$#!${pkgs.dash}/bin/dash
+          set -e
+          . ${cfg.postgresql.initialEnvFile}
+          psql -Atc "ALTER USER postgres WITH PASSWORD '$POSTGRESQL_PASSWORD'";
+        $$ LANGUAGE plsh;
+
+        CREATE ROLE myuser LOGIN PASSWORD 'matrix-synapse';
+      '';
+    };
+
+    services.nginx = {
+      enable = true;
+      virtualHosts.${cfg.matrixDomain} = {
+        forceSSL = true;
+        enableACME = true;
+        locations."/" = {
+          proxyPass = "http://127.0.0.1:8008";
+        };
+      };
+    };
+
+    security.acme = {
+      acceptTerms = true;
+      defaults = {
+        email = "hectic.yukkop.it@gmail.com";
+        enableDebugLogs = true;
+      };
+    };
+  };
+}

nixos/system/bfs/voice-tune.nix

@@ -0,0 +1,33 @@
+{ lib, config, ... }: let
+  cfg = config.currentServer.matrixDomain;
+in {
+  options = {
+    currentServer.matrixDomain = lib.mkOption {
+      type = lib.types.str;
+      description = ''
+        domain
+      '';
+    };
+  };
+  config = {
+    services.coturn = {
+      enable = true;
+      realm = cfg.matrixDomain;
+
+      listening-port = 3478;
+      tls-listening-port = 5349;
+      no-cli = true;
+    };
+
+    networking.firewall.allowedUDPPorts = [ 3478 5349 ];
+    networking.firewall.allowedTCPPorts = [ 3478 5349 ];
+
+    services.matrix-synapse.settings = {
+      turn_uris = [
+        "turn:your.domain:3478?transport=udp"
+        "turns:your.domain:5349?transport=tcp"
+      ];
+      turn_shared_secret = "secret";
+    };
+  };
+}