blob: f273e57e68f31854024333d63222c445ce7fd3ca (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
|
{ config, pkgs, lib, ... }:
{
imports = [ ./postgresql.nix ];
# note current postgresql module does not run initialScript
# (conflict between confinement and post script requiring sudo)
services.postgresql.initialScript = pkgs.writeText "synapse-init.sql" ''
CREATE ROLE "matrix-synapse" WITH LOGIN PASSWORD 'synapse';
CREATE DATABASE "matrix-synapse" WITH OWNER "matrix-synapse"
TEMPLATE template0
LC_COLLATE = "C"
LC_CTYPE = "C";
'';
services.matrix-synapse = {
enable = true;
settings = {
server_name = "codewreck.org";
listeners = [{
port = 8008;
bind_addresses = ["::1"];
type = "http";
tls = false;
x_forwarded = true;
resources = [{
names = [ "client" "federation" ];
compress = false;
}];
}];
app_service_config_files = [
# matrix side of slack proxy
"/var/lib/matrix-synapse/slack-registration.yaml"
];
};
};
systemd.services.matrix-synapse = {
serviceConfig.BindPaths = [
"/var/lib/matrix-synapse"
];
serviceConfig.BindReadOnlyPaths = [
# logs & notify
"/run/systemd/journal/socket"
"/run/systemd/notify"
# psql socket
"/run/postgresql"
# some dev files..?
"/dev/null"
# validate tls certificates & dns to contact remotes
"/etc/ssl/certs/ca-certificates.crt"
"/etc/resolv.conf"
# wg host for slack
"/etc/hosts"
];
# Fix rootdir for confinement
serviceConfig.RuntimeDirectory = lib.mkForce [
"confinement/matrix-synapse" "matrix-synapse"
];
serviceConfig.UMask = lib.mkForce "0022";
confinement = {
enable = true;
binSh = null;
mode = "chroot-only";
};
};
}
|
