WIP: Unfree problems

nixos/roles/matrix/synapse.nix

@@ -3,13 +3,30 @@
   pkgs,
   ...
 }:
+let
+  wellKnownMatrix = {
+    "= /.well-known/matrix/client" = {
+      extraConfig = ''
+        default_type application/json;
+        add_header Access-Control-Allow-Origin *;
+        return 200 '{"m.homeserver":{"base_url":"https://matrix.cyperpunk.de"}}';
+      '';
+    };
+    "= /.well-known/matrix/server" = {
+      extraConfig = ''
+        default_type application/json;
+        add_header Access-Control-Allow-Origin *;
+        return 200 '{"m.server":"matrix.cyperpunk.de:443"}';
+      '';
+    };
+  };
+
+  synapseAdmin = pkgs.ketesa.withConfig {
+    restrictBaseUrl = [ "https://matrix.cyperpunk.de" ];
+    loginFlows = [ "password" ];
+  };
+in
 {
-
-  networking.firewall.allowedTCPPorts = [
-    8008 # Matrix Synapse
-    8448 # Matrix federation
-  ];
-
   sops.secrets = {
     matrix_macaroon_secret = { };
     matrix_registration_secret = {
@@ -24,24 +41,28 @@
       settings = {
         server_name = "cyperpunk.de";
         public_baseurl = "https://matrix.cyperpunk.de";
-        enable_registration = false; # TODO: disable
-        enable_registration_without_verification = false;
+        enable_registration = false;
         trusted_key_servers = [ { server_name = "matrix.org"; } ];
         suppress_key_server_warning = true;
         registration_shared_secret_path = config.sops.secrets.matrix_registration_secret.path;
         macaroon_secret_key = "$__file{${config.sops.secrets.matrix_macaroon_secret.path}}";
-        experimental_features = {
-          "msc3266_enabled" = true;
-          "msc3779_enabled" = true;
-          "msc3401_enabled" = true;
-          "msc4143_enabled" = true;
-          "msc4195_enabled" = true;
-          "msc4222_enabled" = true;
-        };
+
+        #experimental_features = {
+        #  msc3266_enabled = true;
+        #  msc3779_enabled = true;
+        #  msc3401_enabled = true;
+        #  msc4143_enabled = true;
+        #  msc4195_enabled = true;
+        #  msc4222_enabled = true;
+        #};
+
         listeners = [
           {
             port = 8008;
-            bind_addresses = [ "0.0.0.0" ];
+            bind_addresses = [
+              "127.0.0.1"
+              "::1"
+            ];
             type = "http";
             tls = false;
             x_forwarded = true;
@@ -52,7 +73,7 @@
                   "federation"
                   "openid"
                 ];
-                compress = false;
+                compress = true;
               }
             ];
           }
@@ -64,19 +85,35 @@
             resources = [ ];
           }
         ];
-        matrix_rtc = {
-          enabled = true;
-          transports = [
-            {
-              type = "livekit";
-              livekit_service_url = "https://cyperpunk.de/livekit/jwt/";
-            }
-          ];
-        };
         enable_metrics = true;
       };
     };
 
+    nginx.virtualHosts = {
+      # Matrix homeserver
+      "cyperpunk.de" = {
+        forceSSL = true;
+        enableACME = true;
+        serverAliases = [ "matrix.cyperpunk.de" ];
+        http2 = true;
+        locations = wellKnownMatrix // {
+          "/_matrix".proxyPass = "http://127.0.0.1:8008";
+          "/_synapse/client".proxyPass = "http://127.0.0.1:8008";
+          "/metrics" = {
+            proxyPass = "http://127.0.0.1:9009";
+            extraConfig = ''
+              allow 127.0.0.1;
+              deny all;
+            '';
+          };
+          "/admin/" = {
+            root = "${synapseAdmin}";
+            tryFiles = "$uri $uri/ /index.html";
+          };
+        };
+      };
+    };
+
     postgresql = {
       enable = true;
       initialScript = pkgs.writeText "synapse-init.sql" ''