1 files changed, 54 insertions, 53 deletions

diff --git a/hosts/surtr/matrix/default.nix b/hosts/surtr/matrix/default.nix
index 09b5c125..07c445b7 100644
--- a/hosts/surtr/matrix/default.nix
+++ b/hosts/surtr/matrix/default.nix
@@ -6,68 +6,69 @@ with lib;
   config = {
     services.matrix-synapse = {
       enable = true;
-      enable_metrics = true;
 
-      enable_registration = true;
-      allow_guest_access = false;
+      settings = {
+        enable_metrics = true;
+
+        enable_registration = true;
+        allow_guest_access = false;
+
+        server_name = "synapse.li";
+
+        listeners = [
+          { bind_addresses = ["::1" "127.0.0.1"];
+            port = 8008;
+            resources = [
+              { names = [ "client" "federation" ];
+                compress = false;
+              }
+            ];
+            tls = false;
+            type = "http";
+            x_forwarded = true;
+          }
+        ];
 
-      server_name = "synapse.li";
+        tls_certificate_path = "/run/credentials/matrix-synapse.service/synapse.li.pem";
+        tls_private_key_path = "/run/credentials/matrix-synapse.service/synapse.li.key.pem";
 
-      listeners = [
-        { bind_address = "localhost";
-          port = 8008;
-          resources = [
-            { names = [ "client" "federation" ];
-              compress = false;
-            }
-          ];
-          tls = false;
-          type = "http";
-          x_forwarded = true;
-        }
-      ];
+        turn_uris = ["turn:turn.synapse.li?transport=udp" "turn:turn.synapse.li?transport=tcp"];
+        turn_user_lifetime = "1h";
+
+        refreshable_access_token_lifetime = "5m";
+        # nonrefreshable_access_token_lifetime = "1w"; # TODO: uncomment once all (relevant) clients have support for refreshable tokens
+        refresh_token_lifetime = "1w";
+        registration_requires_token = true;
 
-      tls_certificate_path = "/run/credentials/matrix-synapse.service/synapse.li.pem";
-      tls_private_key_path = "/run/credentials/matrix-synapse.service/synapse.li.key.pem";
-      tls_dh_params_path = config.security.dhparams.params.matrix-synapse.path;
+        admin_contact = "mailto:matrix-admin@yggdrasil.li";
 
-      turn_uris = ["turn:turn.synapse.li?transport=udp" "turn:turn.synapse.li?transport=tcp"];
-      turn_user_lifetime = "1h";
+        url_preview_enabled = true;
+        url_preview_ip_range_blacklist = [
+          "127.0.0.0/8" "10.0.0.0/8" "172.16.0.0/12" "192.168.0.0/16"
+          "100.64.0.0/10" "192.0.0.0/24" "169.254.0.0/16"
+          "192.88.99.0/24" "198.18.0.0/15" "192.0.2.0/24"
+          "198.51.100.0/24" "203.0.113.0/24" "224.0.0.0/4" "::1/128"
+          "fe80::/10" "fc00::/7" "2001:db8::/32" "ff00::/8"
+          "fec0::/10" "2a03:4000:52:ada::/64"
+        ];
+        url_preview_ip_range_whitelist = [
+          "2a03:4000:52:ada::/128"
+        ];
+
+        max_upload_size = "500M";
+
+        trusted_key_servers = [
+          { server_name = "matrix.org";
+          }
+          { server_name = "vector.im";
+          }
+        ];
+        suppress_key_server_warning = true;
+      };
 
       extraConfigFiles = [
         "/run/credentials/matrix-synapse.service/registration.yaml"
         "/run/credentials/matrix-synapse.service/turn-secret.yaml"
-        (pkgs.writeText "homeserver.yaml" (generators.toYAML {} {
-          "refreshable_access_token_lifetime" = "5m";
-          # "nonrefreshable_access_token_lifetime" = "1w"; # TODO: uncomment once all (relevant) clients have support for refreshable tokens
-          "refresh_token_lifetime" = "1w";
-          "registration_requires_token" = true;
-
-          "admin_contact" = "mailto:matrix-admin@yggdrasil.li";
-
-          "url_preview_enabled" = true;
-          "url_preview_ip_range_blacklist" = [
-            "127.0.0.0/8" "10.0.0.0/8" "172.16.0.0/12" "192.168.0.0/16"
-            "100.64.0.0/10" "192.0.0.0/24" "169.254.0.0/16"
-            "192.88.99.0/24" "198.18.0.0/15" "192.0.2.0/24"
-            "198.51.100.0/24" "203.0.113.0/24" "224.0.0.0/4" "::1/128"
-            "fe80::/10" "fc00::/7" "2001:db8::/32" "ff00::/8"
-            "fec0::/10" "2a03:4000:52:ada::/64"
-          ];
-          "url_preview_ip_range_whitelist" = [
-            "2a03:4000:52:ada::/128"
-          ];
-
-          "max_upload_size" = "500M";
-
-          "trusted_key_servers" = [
-            { "server_name" = "matrix.org";
-            }
-            { "server_name" = "vector.im";
-            }
-          ];
-          "suppress_key_server_warning" = true;
-        }))
       ];
     };
     sops.secrets."matrix-synapse-registration.yaml" = {