From e278715249e4da50d24c546d6d4045178b48c73f Mon Sep 17 00:00:00 2001 From: Gregor Kleen Date: Wed, 9 Mar 2022 19:23:00 +0100 Subject: bump --- hosts/surtr/matrix/default.nix | 107 +++++++++++++++++++++-------------------- 1 file changed, 54 insertions(+), 53 deletions(-) (limited to 'hosts/surtr/matrix') diff --git a/hosts/surtr/matrix/default.nix b/hosts/surtr/matrix/default.nix index 09b5c125..07c445b7 100644 --- a/hosts/surtr/matrix/default.nix +++ b/hosts/surtr/matrix/default.nix @@ -6,68 +6,69 @@ with lib; config = { services.matrix-synapse = { enable = true; - enable_metrics = true; - enable_registration = true; - allow_guest_access = false; + settings = { + enable_metrics = true; + + enable_registration = true; + allow_guest_access = false; + + server_name = "synapse.li"; + + listeners = [ + { bind_addresses = ["::1" "127.0.0.1"]; + port = 8008; + resources = [ + { names = [ "client" "federation" ]; + compress = false; + } + ]; + tls = false; + type = "http"; + x_forwarded = true; + } + ]; - server_name = "synapse.li"; + tls_certificate_path = "/run/credentials/matrix-synapse.service/synapse.li.pem"; + tls_private_key_path = "/run/credentials/matrix-synapse.service/synapse.li.key.pem"; - listeners = [ - { bind_address = "localhost"; - port = 8008; - resources = [ - { names = [ "client" "federation" ]; - compress = false; - } - ]; - tls = false; - type = "http"; - x_forwarded = true; - } - ]; + turn_uris = ["turn:turn.synapse.li?transport=udp" "turn:turn.synapse.li?transport=tcp"]; + turn_user_lifetime = "1h"; + + refreshable_access_token_lifetime = "5m"; + # nonrefreshable_access_token_lifetime = "1w"; # TODO: uncomment once all (relevant) clients have support for refreshable tokens + refresh_token_lifetime = "1w"; + registration_requires_token = true; - tls_certificate_path = "/run/credentials/matrix-synapse.service/synapse.li.pem"; - tls_private_key_path = "/run/credentials/matrix-synapse.service/synapse.li.key.pem"; - tls_dh_params_path = config.security.dhparams.params.matrix-synapse.path; + admin_contact = "mailto:matrix-admin@yggdrasil.li"; - turn_uris = ["turn:turn.synapse.li?transport=udp" "turn:turn.synapse.li?transport=tcp"]; - turn_user_lifetime = "1h"; + url_preview_enabled = true; + url_preview_ip_range_blacklist = [ + "127.0.0.0/8" "10.0.0.0/8" "172.16.0.0/12" "192.168.0.0/16" + "100.64.0.0/10" "192.0.0.0/24" "169.254.0.0/16" + "192.88.99.0/24" "198.18.0.0/15" "192.0.2.0/24" + "198.51.100.0/24" "203.0.113.0/24" "224.0.0.0/4" "::1/128" + "fe80::/10" "fc00::/7" "2001:db8::/32" "ff00::/8" + "fec0::/10" "2a03:4000:52:ada::/64" + ]; + url_preview_ip_range_whitelist = [ + "2a03:4000:52:ada::/128" + ]; + + max_upload_size = "500M"; + + trusted_key_servers = [ + { server_name = "matrix.org"; + } + { server_name = "vector.im"; + } + ]; + suppress_key_server_warning = true; + }; extraConfigFiles = [ "/run/credentials/matrix-synapse.service/registration.yaml" "/run/credentials/matrix-synapse.service/turn-secret.yaml" - (pkgs.writeText "homeserver.yaml" (generators.toYAML {} { - "refreshable_access_token_lifetime" = "5m"; - # "nonrefreshable_access_token_lifetime" = "1w"; # TODO: uncomment once all (relevant) clients have support for refreshable tokens - "refresh_token_lifetime" = "1w"; - "registration_requires_token" = true; - - "admin_contact" = "mailto:matrix-admin@yggdrasil.li"; - - "url_preview_enabled" = true; - "url_preview_ip_range_blacklist" = [ - "127.0.0.0/8" "10.0.0.0/8" "172.16.0.0/12" "192.168.0.0/16" - "100.64.0.0/10" "192.0.0.0/24" "169.254.0.0/16" - "192.88.99.0/24" "198.18.0.0/15" "192.0.2.0/24" - "198.51.100.0/24" "203.0.113.0/24" "224.0.0.0/4" "::1/128" - "fe80::/10" "fc00::/7" "2001:db8::/32" "ff00::/8" - "fec0::/10" "2a03:4000:52:ada::/64" - ]; - "url_preview_ip_range_whitelist" = [ - "2a03:4000:52:ada::/128" - ]; - - "max_upload_size" = "500M"; - - "trusted_key_servers" = [ - { "server_name" = "matrix.org"; - } - { "server_name" = "vector.im"; - } - ]; - "suppress_key_server_warning" = true; - })) ]; }; sops.secrets."matrix-synapse-registration.yaml" = { -- cgit v1.2.3