path: root/host/Rory-synapse/software.nix

{ config, pkgs, lib, ... }:

{
  imports =
    [
      ../../modules/base-server.nix
    ];

  # coturn (WebRTC)
  services.coturn = rec {
    enable = false; # Alicia - figure out secret first...
    no-cli = true;
    no-tcp-relay = true;
    min-port = 49000;
    max-port = 50000;
    use-auth-secret = true;
    static-auth-secret = "will be world readable for local users :(";
    realm = "turn.example.com";
    # Alicia - figure out how to get this to work, since nginx runs on separate machine...
    #cert = "${config.security.acme.certs.${realm}.directory}/full.pem";
    #pkey = "${config.security.acme.certs.${realm}.directory}/key.pem";
    extraConfig = ''
      # for debugging
      verbose
      # ban private IP ranges
      no-multicast-peers
      denied-peer-ip=0.0.0.0-0.255.255.255
      denied-peer-ip=10.0.0.0-10.255.255.255
      denied-peer-ip=100.64.0.0-100.127.255.255
      denied-peer-ip=127.0.0.0-127.255.255.255
      denied-peer-ip=169.254.0.0-169.254.255.255
      denied-peer-ip=172.16.0.0-172.31.255.255
      denied-peer-ip=192.0.0.0-192.0.0.255
      denied-peer-ip=192.0.2.0-192.0.2.255
      denied-peer-ip=192.88.99.0-192.88.99.255
      denied-peer-ip=192.168.0.0-192.168.255.255
      denied-peer-ip=198.18.0.0-198.19.255.255
      denied-peer-ip=198.51.100.0-198.51.100.255
      denied-peer-ip=203.0.113.0-203.0.113.255
      denied-peer-ip=240.0.0.0-255.255.255.255
      denied-peer-ip=::1
      denied-peer-ip=64:ff9b::-64:ff9b::ffff:ffff
      denied-peer-ip=::ffff:0.0.0.0-::ffff:255.255.255.255
      denied-peer-ip=100::-100::ffff:ffff:ffff:ffff
      denied-peer-ip=2001::-2001:1ff:ffff:ffff:ffff:ffff:ffff:ffff
      denied-peer-ip=2002::-2002:ffff:ffff:ffff:ffff:ffff:ffff:ffff
      denied-peer-ip=fc00::-fdff:ffff:ffff:ffff:ffff:ffff:ffff:ffff
      denied-peer-ip=fe80::-febf:ffff:ffff:ffff:ffff:ffff:ffff:ffff
    '';
  };

  #services.matrix-synapse = with config.services.coturn; {
  #  turn_uris = ["turn:${realm}:3478?transport=udp" "turn:${realm}:3478?transport=tcp"];
  #  turn_shared_secret = static-auth-secret;
  #  turn_user_lifetime = "1h";
  #};

  # Discord bridge
   services.matrix-appservice-discord = {
    enable = false; # Alicia - figure out secret first...
    environmentFile = /etc/keyring/matrix-appservice-discord/tokens.env;
    # The appservice is pre-configured to use SQLite by default.
    # It's also possible to use PostgreSQL.
    settings = {
      bridge = {
        domain = "rory.gay";
        homeserverUrl = "https://matrix.rory.gay";
      };

      # The service uses SQLite by default, but it's also possible to use
      # PostgreSQL instead:
      database = {
        #  filename = ""; # empty value to disable sqlite
        connString = "postgres://postgres@127.0.0.1/matrix-appservice-discord";
      };
    };
   };

  services.matrix-synapse = {
    enable = true;
    withJemalloc = true;

    # https://matrix-org.github.io/synapse/latest/usage/configuration/config_documentation.html
    settings = {
      server_name = "rory.gay";

      enable_registration = true;
      registration_requires_token = true;

      require_membership_for_aliases = false;
      redaction_retention_period = null;
      user_ips_max_age = null;
      allow_device_name_lookup_over_federation = true;

      federation = {
        client_timeout = "10s";
        max_short_retries = 3;
        max_short_retry_delay = "30s";
        max_long_retries = 5;
        max_long_retry_delay = "5m";
      };

      event_cache_size = "30K"; #defaults to 10K
      caches = {
        global_factor = 1.0;
        sync_response_cache_duration = "30m";
        cache_autotuning = {
          max_cache_memory_usage = "2048M";
          target_cache_memory_usage = "1024M";
          min_cache_ttl = "30m";
        };
      };


      # Alicia - figure this out later...
      #registration_shared_secret = builtins.exec ["cat" "/dev/urandom" "|" "tr" "-dc" "a-zA-Z0-9" "|" "fold" "-w" "256" "|" "head" "-n" "1"];
      #registration_shared_secret_path = "/var/lib/matrix-synapse/registration_shared_secret.txt";
      
      listeners = [
        { 
          port = 8008;
          bind_addresses = [ "192.168.1.2" "127.0.0.1" ];
          type = "http";
          tls = false;
          x_forwarded = true;
          resources = [ {
            names = [ "client" "federation" ];
            compress = true;
          } ];
        }
      ];
      dynamic_thumbnails = true;
      presence = {
        enable = true;
        update_interval = 60;
      };
      url_preview_enabled = true;
      database = {
        name = "psycopg2";
        args = {
          user = "matrix-synapse-rory-gay";
          #passwordFile = "/run/secrets/matrix-synapse-password";
          password = "somepassword";
          database = "matrix-synapse-rory-gay";
          host = "127.0.0.1";
          application_name = "matrix-synapse (rory.gay)";
          cp_min = 5;
          cp_max = 15;
          cp_reconnect_interval = "True";
        };
      };
      app_service_config_files = [
        #"/etc/matrix-synapse/appservice-registration.yaml"
      ];

      rc_message = {
        per_second = 1000;
        burst_count = 1000;
      };
      rc_login = {
        address = {
          per_second = 1000;
          burst_count = 1000;
        };
        account = {
          per_second = 1000;
          burst_count = 1000;
        };
        failed_attempts = {
          per_second = 0.1;
          burst_count = 3;
        };
      };
      rc_joins = {
        local = {
          per_second = 1000;
          burst_count = 1000;
        };
        remote = {
          per_second = 1000;
          burst_count = 1000;
        };
      };
      rc_joins_per_room = {
        per_second = 1000;
        burst_count = 1000;
      };
      rc_invites = {
        per_room = {
          per_second = 1000;
          burst_count = 1000;
        };
        per_user = {
          per_second = 1000;
          burst_count = 1000;
        };
        per_issuer = {
          per_second = 1000;
          burst_count = 1000;
        };
      };
      rc_federation = {
        window_size = 10;
        sleep_limit = 1000;
        sleep_delay = 100;
        reject_limit = 1000;
        concurrent = 100;
      };
      federation_rr_transactions_per_room_per_second = 1;

      max_image_pixels = "100M";

      ui_auth = {
        session_timeout = "1m";
      };

      login_via_existing_session = {
        enabled = true;
        require_ui_auth = true;
        token_timeout = "1y";
      };

      #sentry = {
      #  dsn = "https://77c8de07855d4e0c90dbcf0945a04f01@sentry.thearcanebrony.net/14";
      #};

      report_stats = false;

      user_directory = {
        enabled = true;
        search_all_users = true;
        prefer_local_users = true;
      };
    };

    plugins = with pkgs.matrix-synapse-plugins; [
      # Alicia - need to port draupnir...
      #matrix-synapse-mjolnir-antispam
#      matrix-synapse-pam
    ];
#    extraConfigFiles = [
#        (pkgs.writeTextFile {
#          name = "matrix-synapse-extra-config.yml";
#          text = ''
#            modules:
#              - module: "pam_auth_provider.PAMAuthProvider"
#                config:
#                  create_users: true
#                  skip_user_check: false
#          '';
#        })
#      ];
  };

  # Alicia - doesnt work yet... until in nixpkgs...
  services.draupnir = {
    enable = true;
    
    pantalaimon = {
      enable = true;
      username = "draupnir";
      passwordFile = "/etc/draupnir-password";
      options = {
        homeserver = "http://localhost:8008";
        ssl = false;
      };
      
    };
    managementRoom = "#draupnir-mgmt:rory.gay";
    homeserverUrl = "http://localhost:8008";
    verboseLogging = false;
    settings = {
      recordIgnoredInvites = false;
      automaticallyRedactForReasons = [ "*" ];
      fasterMembershipChecks = true;
      backgroundDelayMS = 100;
      pollReports = true;
      admin.enableMakeRoomAdminCommand = true;
      commands.ban.defaultReasons = [
        "spam"
        "harassment"
        "transphobia"
        "scam"
      ];
      protections = {
        wordlist = {
          words = [
            "tranny"
            "faggot"
          ];
          minutesBeforeTrusting = 0;
        };
      };
    };
  };

    systemd.services.matrix-synapse-reg-token = {
      description = "Random registration token for Synapse.";
      before = ["matrix-synapse.service"]; # So the registration can be used by Synapse
      wantedBy = ["multi-user.target"];
      after = ["network.target"];

      script = ''

        if [ ! -f "registration_shared_secret.txt" ]
        then
          cat /dev/urandom | tr -dc a-zA-Z0-9 | fold -w 256 | head -n 1 > registration_shared_secret.txt
        else
          echo Not generating key, key exists;
        fi'';
      serviceConfig = {
        User = "matrix-synapse";
        Group = "matrix-synapse";
        WorkingDirectory = "/var/lib/matrix-synapse";
      };
    };
  system.stateVersion = "22.11"; # DO NOT EDIT!
}