add matrix...

4 files changed, 124 insertions, 2 deletions

diff --git a/host/Rory-discordbots/configuration.nix b/host/Rory-discordbots/configuration.nix
index 36e7a1f..958ae5c 100755
--- a/host/Rory-discordbots/configuration.nix
+++ b/host/Rory-discordbots/configuration.nix
@@ -24,5 +24,4 @@
   };
 
   system.stateVersion = "22.11"; # DO NOT EDIT!
-}
-
+}
\ No newline at end of file
diff --git a/host/Rory-nginx/hosts/rory.gay/matrix.nix b/host/Rory-nginx/hosts/rory.gay/matrix.nix
new file mode 100755
index 0000000..6a638c3
--- /dev/null
+++ b/host/Rory-nginx/hosts/rory.gay/matrix.nix
@@ -0,0 +1,6 @@
+{
+  enableACME = true;
+  addSSL = true;
+  locations."/_matrix".proxyPass = "http://192.168.1.5:8008"; 
+  locations."/_synapse/client".proxyPass = "http://192.168.1.5:8008";   
+}
diff --git a/host/Rory-nginx/hosts/rory.gay/root.nix b/host/Rory-nginx/hosts/rory.gay/root.nix
index 4307cf4..c3dfb2f 100755
--- a/host/Rory-nginx/hosts/rory.gay/root.nix
+++ b/host/Rory-nginx/hosts/rory.gay/root.nix
@@ -4,4 +4,21 @@
   addSSL = true;
   extraConfig = ''
     autoindex on;'';
+
+  locations."= /.well-known/matrix/server".extraConfig = ''
+    add_header Content-Type application/json;
+    add_header Access-Control-Allow-Origin *;
+    return 200 '${builtins.toJSON {
+      "m.server" = "matrix.rory.gay:443";
+    }}}';
+  ''; 
+  locations."= /.well-known/matrix/client".extraConfig = ''
+    add_header Content-Type application/json;
+    add_header Access-Control-Allow-Origin *;
+    return 200 '${builtins.toJSON {
+      "m.homeserver".base_url = "https://matrix.rory.gay";
+      "m.identity_server" = {};
+    }
+    }';
+  ''; 
 }
diff --git a/host/Rory-synapse/configuration.nix b/host/Rory-synapse/configuration.nix
new file mode 100755
index 0000000..24a0692
--- /dev/null
+++ b/host/Rory-synapse/configuration.nix
@@ -0,0 +1,100 @@
+{ config, pkgs, lib, ... }:
+
+{
+  imports =
+    [
+      ../../modules/base-server.nix
+    ];
+
+  networking = {
+    hostName = "Rory-synapse";
+    interfaces.ens18.ipv4.addresses = [ { 
+      address = "192.168.1.5";
+      prefixLength = 24;
+    } ];
+    interfaces.ens19.ipv4.addresses = [ {
+      address = "10.10.10.5";
+      prefixLength = 16;
+    } ];
+  };
+
+  # coturn (WebRTC)
+  services.coturn = rec {
+    enable = false; # Alicia - figure out secret first...
+    no-cli = true;
+    no-tcp-relay = true;
+    min-port = 49000;
+    max-port = 50000;
+    use-auth-secret = true;
+    static-auth-secret = "will be world readable for local users :(";
+    realm = "turn.example.com";
+    # Alicia - figure out how to get this to work, since nginx runs on separate machine...
+    #cert = "${config.security.acme.certs.${realm}.directory}/full.pem";
+    #pkey = "${config.security.acme.certs.${realm}.directory}/key.pem";
+    extraConfig = ''
+      # for debugging
+      verbose
+      # ban private IP ranges
+      no-multicast-peers
+      denied-peer-ip=0.0.0.0-0.255.255.255
+      denied-peer-ip=10.0.0.0-10.255.255.255
+      denied-peer-ip=100.64.0.0-100.127.255.255
+      denied-peer-ip=127.0.0.0-127.255.255.255
+      denied-peer-ip=169.254.0.0-169.254.255.255
+      denied-peer-ip=172.16.0.0-172.31.255.255
+      denied-peer-ip=192.0.0.0-192.0.0.255
+      denied-peer-ip=192.0.2.0-192.0.2.255
+      denied-peer-ip=192.88.99.0-192.88.99.255
+      denied-peer-ip=192.168.0.0-192.168.255.255
+      denied-peer-ip=198.18.0.0-198.19.255.255
+      denied-peer-ip=198.51.100.0-198.51.100.255
+      denied-peer-ip=203.0.113.0-203.0.113.255
+      denied-peer-ip=240.0.0.0-255.255.255.255
+      denied-peer-ip=::1
+      denied-peer-ip=64:ff9b::-64:ff9b::ffff:ffff
+      denied-peer-ip=::ffff:0.0.0.0-::ffff:255.255.255.255
+      denied-peer-ip=100::-100::ffff:ffff:ffff:ffff
+      denied-peer-ip=2001::-2001:1ff:ffff:ffff:ffff:ffff:ffff:ffff
+      denied-peer-ip=2002::-2002:ffff:ffff:ffff:ffff:ffff:ffff:ffff
+      denied-peer-ip=fc00::-fdff:ffff:ffff:ffff:ffff:ffff:ffff:ffff
+      denied-peer-ip=fe80::-febf:ffff:ffff:ffff:ffff:ffff:ffff:ffff
+    '';
+  };
+
+  #services.matrix-synapse = with config.services.coturn; {
+  #  turn_uris = ["turn:${realm}:3478?transport=udp" "turn:${realm}:3478?transport=tcp"];
+  #  turn_shared_secret = static-auth-secret;
+  #  turn_user_lifetime = "1h";
+  #};
+
+  # Discord bridge
+   services.matrix-appservice-discord = {
+    enable = false; # Alicia - figure out secret first...
+    environmentFile = /etc/keyring/matrix-appservice-discord/tokens.env;
+    # The appservice is pre-configured to use SQLite by default.
+    # It's also possible to use PostgreSQL.
+    settings = {
+      bridge = {
+        domain = "rory.gay";
+        homeserverUrl = "https://matrix.rory.gay";
+      };
+
+      # The service uses SQLite by default, but it's also possible to use
+      # PostgreSQL instead:
+      database = {
+        #  filename = ""; # empty value to disable sqlite
+        connString = "postgres://postgres@192.168.1.3/matrix-appservice-discord";
+      };
+    };
+
+  services.matrix-synapse = {
+    enable = true;
+    app_service_config_files = [
+      #"/etc/matrix-synapse/appservice-registration.yaml"
+    ];
+    
+  }
+
+  system.stateVersion = "22.11"; # DO NOT EDIT!
+}
+