88 lines
2.3 KiB
Nix
88 lines
2.3 KiB
Nix
{config, ...}: let
|
|
cfg = config.services.matrix-conduit;
|
|
domain = "matrix.${config.services.nginx.domain}";
|
|
turn-realm = "turn.${config.services.nginx.domain}";
|
|
in {
|
|
services.matrix-conduit = {
|
|
enable = true;
|
|
settings.global = {
|
|
address = "127.0.0.1";
|
|
server_name = domain;
|
|
database_backend = "rocksdb";
|
|
|
|
turn_uris = ["turn:turn.tlater.net?transport=udp" "turn:turn.tlater.net?transport=tcp"];
|
|
};
|
|
};
|
|
|
|
# Pass in the TURN secret via EnvironmentFile, not supported by
|
|
# upstream module currently.
|
|
#
|
|
# See also https://gitlab.com/famedly/conduit/-/issues/314
|
|
systemd.services.conduit.serviceConfig.EnvironmentFile = config.sops.secrets."turn/env".path;
|
|
|
|
services.coturn = {
|
|
enable = true;
|
|
use-auth-secret = true;
|
|
static-auth-secret-file = config.sops.secrets."turn/secret".path;
|
|
realm = turn-realm;
|
|
|
|
# Based on suggestions from https://github.com/matrix-org/synapse/blob/develop/docs/turn-howto.md
|
|
no-tcp-relay = true;
|
|
extraConfig = ''
|
|
denied-peer-ip=0.0.0.0-0.255.255.255
|
|
denied-peer-ip=100.64.0.0-100.127.255.255
|
|
denied-peer-ip=127.0.0.0-127.255.255.255
|
|
denied-peer-ip=169.254.0.0-169.254.255.255
|
|
denied-peer-ip=192.0.0.0-192.0.0.255
|
|
denied-peer-ip=192.0.2.0-192.0.2.255
|
|
denied-peer-ip=192.88.99.0-192.88.99.255
|
|
denied-peer-ip=198.18.0.0-198.19.255.255
|
|
denied-peer-ip=198.51.100.0-198.51.100.255
|
|
denied-peer-ip=203.0.113.0-203.0.113.255
|
|
denied-peer-ip=240.0.0.0-255.255.255.255
|
|
allowed-peer-ip=127.0.0.1
|
|
user-quota=12
|
|
total-quota=36
|
|
'';
|
|
};
|
|
|
|
services.nginx.virtualHosts."${domain}" = {
|
|
enableACME = true;
|
|
|
|
listen = [
|
|
{
|
|
addr = "0.0.0.0";
|
|
port = 443;
|
|
ssl = true;
|
|
}
|
|
{
|
|
addr = "[::0]";
|
|
port = 443;
|
|
ssl = true;
|
|
}
|
|
{
|
|
addr = "0.0.0.0";
|
|
port = 8448;
|
|
ssl = true;
|
|
}
|
|
{
|
|
addr = "[::0]";
|
|
port = 8488;
|
|
ssl = true;
|
|
}
|
|
];
|
|
|
|
addSSL = true;
|
|
extraConfig = ''
|
|
merge_slashes off;
|
|
'';
|
|
|
|
locations."/_matrix" = {
|
|
proxyPass = "http://${cfg.settings.global.address}:${toString cfg.settings.global.port}";
|
|
# Recommended by conduit
|
|
extraConfig = ''
|
|
proxy_buffering off;
|
|
'';
|
|
};
|
|
};
|
|
}
|