re-add matrix

configuration.nix

@@ -38,6 +38,8 @@
 
     ./services/bitwarden.nix
 
+    ./services/matrix.nix
+
     ./services/monero.nix
     ./services/xmrig.nix
 

flake.nix

@@ -118,6 +118,8 @@
           syncthing_protocol = 22000;
           syncthing_discovery = 21027;
           minecraft = 25565;
+          matrix = 6167;
+          matrix_federation = 8448;
         };
 
         https = {
@@ -168,6 +170,11 @@
           dataDir = services_dir + "/monero";
         };
 
+        matrix = {
+          dataDir = "/var/lib/private/matrix-conduit";
+          domain = "matrix.${https.domain}";
+        };
+
         syncthing = {
           dataDir = services_dir + "/syncthing";
           signalBackupDir = "/${zpool_ssds}/bak/signal";

services/matrix.nix

@@ -0,0 +1,68 @@
+{
+  pkgs,
+  config,
+  service_configs,
+  lib,
+  ...
+}:
+{
+  imports = [
+    (lib.serviceMountWithZpool "matrix-conduit" service_configs.zpool_ssds [
+      service_configs.matrix.dataDir
+    ])
+  ];
+
+  services.matrix-conduit = {
+    enable = true;
+    package = pkgs.matrix-continuwuity;
+
+    settings.global = {
+      port = service_configs.ports.matrix;
+      server_name = service_configs.https.domain;
+      database_backend = "rocksdb";
+      allow_registration = true;
+      registration_token = builtins.readFile ../secrets/matrix_reg_token;
+
+      new_user_displayname_suffix = "";
+
+      trusted_servers = [
+        "matrix.org"
+        "constellatory.net"
+        "tchncs.de"
+        "envs.net"
+      ];
+
+      # without this, conduit fails to start
+      address = "0.0.0.0";
+    };
+  };
+
+  services.caddy.virtualHosts.${service_configs.https.domain}.extraConfig = lib.mkBefore ''
+    header /.well-known/matrix/* Content-Type application/json
+    header /.well-known/matrix/* Access-Control-Allow-Origin *
+    respond /.well-known/matrix/server `{"m.server": "${service_configs.matrix.domain}:${builtins.toString service_configs.ports.https}"}`
+    respond /.well-known/matrix/client `{"m.server":{"base_url":"https://${service_configs.matrix.domain}"},"m.homeserver":{"base_url":"https://${service_configs.matrix.domain}"},"org.matrix.msc3575.proxy":{"base_url":"https://${config.services.matrix-conduit.settings.global.server_name}"}}`
+  '';
+
+  services.caddy.virtualHosts."${service_configs.matrix.domain}".extraConfig = ''
+    reverse_proxy :${builtins.toString service_configs.ports.matrix}
+  '';
+
+  # Exact duplicate for federation port
+  services.caddy.virtualHosts."${service_configs.matrix.domain}:${builtins.toString service_configs.ports.matrix_federation}".extraConfig =
+    config.services.caddy.virtualHosts."${service_configs.matrix.domain}".extraConfig;
+
+  systemd.tmpfiles.rules = [
+    "Z ${service_configs.matrix.dataDir} 0770 ${config.systemd.services.conduit.serviceConfig.User} ${config.systemd.services.conduit.serviceConfig.User}"
+  ];
+
+  # for federation
+  networking.firewall.allowedTCPPorts = [
+    service_configs.ports.matrix_federation
+  ];
+
+  # for federation
+  networking.firewall.allowedUDPPorts = [
+    service_configs.ports.matrix_federation
+  ];
+}