{ config, lib, inputs, pkgs, ... }: with lib; let cfg = config.nixfiles.modules.matrix.dendrite; in { options.nixfiles.modules.matrix.dendrite = { enable = mkEnableOption "Dendrite Matrix server"; port = mkOption { description = "Port."; type = with types; port; default = 8008; }; domain = mkOption { type = types.str; default = config.networking.domain; description = "Domain name sans protocol scheme."; }; }; config = let db = "dendrite"; in mkIf cfg.enable { ark.directories = [ "/var/lib/dendrite" "/var/lib/private/dendrite" ]; # FIXME Use systemd secrets/environment for this. secrets.dendrite-private-key = { file = "${inputs.self}/secrets/dendrite-private-key"; mode = "0444"; }; secrets.dendrite-environment-file = { file = "${inputs.self}/secrets/dendrite-environment-file"; mode = "0444"; }; nixfiles.modules = { nginx = { enable = true; upstreams.dendrite.servers."127.0.0.1:${toString config.services.dendrite.httpPort}" = {}; virtualHosts.${cfg.domain}.locations = { "/_matrix".proxyPass = "http://dendrite"; "= /.well-known/matrix/server" = { extraConfig = '' add_header Content-Type application/json; ''; return = "200 '${generators.toJSON {} { "m.server" = "${cfg.domain}:443"; }}'"; }; "= /.well-known/matrix/client" = { extraConfig = '' add_header Content-Type application/json; add_header Access-Control-Allow-Origin *; ''; return = "200 '${generators.toJSON {} { "m.homeserver".base_url = "https://${cfg.domain}"; }}'"; }; }; }; postgresql = { enable = true; extraPostStart = [ '' $PSQL "${db}" -tAc 'GRANT ALL ON SCHEMA "public" TO "${db}"' '' ]; }; promtail.filters = [ { match = { selector = ''{syslog_identifier="dendrite"} |~ ".*Failed to fetch key for server.*"''; action = "drop"; }; } { match = { selector = ''{syslog_identifier="dendrite"} |~ ".*could not download key for.*"''; action = "drop"; }; } ]; }; services.postgresql = { ensureDatabases = [db]; ensureUsers = [ { name = db; ensureDBOwnership = true; } ]; }; systemd.services.dendrite = { description = "Dendrite Matrix homeserver"; requires = ["network.target"]; wantedBy = ["multi-user.target"]; serviceConfig = let needsPrivileges = cfg.port < 1024; capabilities = [""] ++ optionals needsPrivileges ["CAP_NET_BIND_SERVICE"]; in { Restart = "on-failure"; ExecStartPre = let settings = { version = 2; global = { server_name = cfg.domain; private_key = config.secrets.dendrite-private-key.path; database = { connection_string = "postgresql://${db}@/${db}?host=/run/postgresql"; max_open_conns = 64; max_idle_connections = 8; }; cache = { max_size_estimated = "1gb"; max_age = "1h"; }; trusted_third_party_id_servers = [ "matrix.org" "nixos.org" "vector.im" ]; presence = { enable_inbound = false; enable_outbound = false; }; }; client_api = { registration_disabled = true; guests_disabled = true; registration_shared_secret = "$REGISTRATION_SHARED_SECRET"; }; media_api = { base_path = "/var/lib/dendrite/media_store"; max_file_size_bytes = 0; dynamic_thumbnails = true; max_thumbnail_generators = 8; thumbnail_sizes = [ { width = 32; height = 32; method = "crop"; } { width = 96; height = 96; method = "crop"; } { width = 640; height = 480; method = "scale"; } ]; }; logging = [ { type = "std"; level = "warn"; } ]; }; in concatStringsSep " " [ (getExe pkgs.envsubst) "-i ${(pkgs.formats.yaml {}).generate "dendrite.yaml" settings}" "-o /run/dendrite/dendrite.yaml" ]; ExecStart = concatStringsSep " " [ (getExe' pkgs.dendrite "dendrite") "--config /run/dendrite/dendrite.yaml" "--http-bind-address 127.0.0.1:${toString cfg.port}" ]; ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID"; EnvironmentFile = config.secrets.dendrite-environment-file.path; DynamicUser = true; StateDirectory = "dendrite"; RuntimeDirectory = "dendrite"; RuntimeDirectoryMode = "0700"; AmbientCapabilities = capabilities; CapabilityBoundingSet = capabilities; UMask = "0077"; LockPersonality = true; MemoryDenyWriteExecute = true; NoNewPrivileges = true; PrivateDevices = true; PrivateTmp = true; PrivateUsers = !needsPrivileges; ProtectClock = true; ProtectControlGroups = true; ProtectHome = true; ProtectHostname = true; ProtectKernelLogs = true; ProtectKernelModules = true; ProtectKernelTunables = true; ProtectSystem = "strict"; ProtectProc = "noaccess"; ProcSubset = "pid"; RemoveIPC = true; RestrictAddressFamilies = ["AF_UNIX" "AF_INET" "AF_INET6"]; RestrictNamespaces = true; RestrictRealtime = true; RestrictSUIDSGID = true; SystemCallArchitectures = "native"; SystemCallFilter = ["@system-service" "~@privileged"]; }; }; }; }