6 files changed, 196 insertions, 12 deletions

diff --git a/deploy/flake.lock b/deploy/flake.lock
index 153f0c6..40b7302 100644
--- a/deploy/flake.lock
+++ b/deploy/flake.lock
@@ -2783,7 +2783,7 @@
       },
       "locked": {
         "lastModified": 1,
-        "narHash": "sha256-Nw6nhvfCOJvSiqgkq/iJDA+ex5mllZxRSqAuO2bZCVc=",
+        "narHash": "sha256-FnlsOOyTYqmGYWT4+ZTG92NOdVuWTpYLkyfyNFwKNYQ=",
         "path": "../flakes",
         "type": "path"
       },
@@ -3903,7 +3903,7 @@
       },
       "locked": {
         "lastModified": 1,
-        "narHash": "sha256-/2ewPhp/ETtRESC/RG6PXCsh16cCWK+GtGNPEnk6sEs=",
+        "narHash": "sha256-716InHQU0Gd7XR6AN3//P5kjwV0mQAT4bg83lVIqghk=",
         "path": "../systems/eldiron",
         "type": "path"
       },
@@ -3974,7 +3974,7 @@
       },
       "locked": {
         "lastModified": 1,
-        "narHash": "sha256-JlmfWvZWdpG8URsDmCRaWmLo1pUxKf0yxwcLF2OwzTo=",
+        "narHash": "sha256-9qnPvun+A27xK5GmR9NU6Jd8UC5lAWcqpGJ9IMF6IhQ=",
         "path": "../systems/zoldene",
         "type": "path"
       },
@@ -8888,11 +8888,11 @@
         "nixpkgs": "nixpkgs_106"
       },
       "locked": {
-        "lastModified": 1718015850,
-        "narHash": "sha256-svUAfD+aIaS9T9UtepEGlIdxcZyu3YJcrGOmjuwgplE=",
+        "lastModified": 1718531880,
+        "narHash": "sha256-BqLfVL7N6dO2oWB8Xo89uvO5cG8oDCRBgsk/TUnpcYs=",
         "ref": "master",
-        "rev": "71fbb32c4b3195982c0f03c90714c959b5ce2251",
-        "revCount": 735,
+        "rev": "b0236017d9da46b98017f348d7031a69526c0aeb",
+        "revCount": 738,
         "type": "git",
         "url": "git+ssh://gitolite@git.immae.eu/perso/Immae/Config/Nix/Nixops/Secrets"
       },
diff --git a/flake.lock b/flake.lock
index b7403fa..adc46ab 100644
--- a/flake.lock
+++ b/flake.lock
@@ -2664,7 +2664,7 @@
       },
       "locked": {
         "lastModified": 1,
-        "narHash": "sha256-Nw6nhvfCOJvSiqgkq/iJDA+ex5mllZxRSqAuO2bZCVc=",
+        "narHash": "sha256-FnlsOOyTYqmGYWT4+ZTG92NOdVuWTpYLkyfyNFwKNYQ=",
         "path": "./flakes",
         "type": "path"
       },
@@ -3919,7 +3919,7 @@
       },
       "locked": {
         "lastModified": 1,
-        "narHash": "sha256-/2ewPhp/ETtRESC/RG6PXCsh16cCWK+GtGNPEnk6sEs=",
+        "narHash": "sha256-716InHQU0Gd7XR6AN3//P5kjwV0mQAT4bg83lVIqghk=",
         "path": "../systems/eldiron",
         "type": "path"
       },
@@ -3990,7 +3990,7 @@
       },
       "locked": {
         "lastModified": 1,
-        "narHash": "sha256-JlmfWvZWdpG8URsDmCRaWmLo1pUxKf0yxwcLF2OwzTo=",
+        "narHash": "sha256-9qnPvun+A27xK5GmR9NU6Jd8UC5lAWcqpGJ9IMF6IhQ=",
         "path": "../systems/zoldene",
         "type": "path"
       },
diff --git a/flakes/flake.lock b/flakes/flake.lock
index 1aa828e..2e49cab 100644
--- a/flakes/flake.lock
+++ b/flakes/flake.lock
@@ -3824,7 +3824,7 @@
       },
       "locked": {
         "lastModified": 1,
-        "narHash": "sha256-/2ewPhp/ETtRESC/RG6PXCsh16cCWK+GtGNPEnk6sEs=",
+        "narHash": "sha256-716InHQU0Gd7XR6AN3//P5kjwV0mQAT4bg83lVIqghk=",
         "path": "../systems/eldiron",
         "type": "path"
       },
@@ -3895,7 +3895,7 @@
       },
       "locked": {
         "lastModified": 1,
-        "narHash": "sha256-JlmfWvZWdpG8URsDmCRaWmLo1pUxKf0yxwcLF2OwzTo=",
+        "narHash": "sha256-9qnPvun+A27xK5GmR9NU6Jd8UC5lAWcqpGJ9IMF6IhQ=",
         "path": "../systems/zoldene",
         "type": "path"
       },
diff --git a/systems/eldiron/websites/tools/default.nix b/systems/eldiron/websites/tools/default.nix
index 46e6a9f..7d8bf5e 100644
--- a/systems/eldiron/websites/tools/default.nix
+++ b/systems/eldiron/websites/tools/default.nix
@@ -108,6 +108,7 @@ in {
           mailSend
           (ips servers.eldiron.ips.main)
         ];
+        synapse = ips servers.zoldene.ips.main;
       };
 
     services.borgBackup.profiles.global.ignoredPaths = [
diff --git a/systems/zoldene/base.nix b/systems/zoldene/base.nix
index 617cd82..1b42a52 100644
--- a/systems/zoldene/base.nix
+++ b/systems/zoldene/base.nix
@@ -13,6 +13,7 @@ in
     secrets.nixosModules.users-config-zoldene
     ./virtualisation.nix
     ./certificates.nix
+    ./synapse.nix
   ];
 
   services.openssh = {
diff --git a/systems/zoldene/synapse.nix b/systems/zoldene/synapse.nix
new file mode 100644
index 0000000..1d892a7
--- /dev/null
+++ b/systems/zoldene/synapse.nix
@@ -0,0 +1,182 @@
+{ lib, config, pkgs, name, ... }:
+{
+  config = {
+    security.acme.certs."${name}".extraDomainNames = ["synapse.immae.eu"];
+    services.nginx = {
+      virtualHosts = {
+        "synapse.immae.eu" = {
+          acmeRoot = config.security.acme.defaults.webroot;
+          useACMEHost = name;
+          forceSSL = true;
+
+          locations."~ ^/admin(?:/(.*))?$" = {
+            alias = let
+              synapse-admin = pkgs.fetchzip {
+                url = "https://github.com/Awesome-Technologies/synapse-admin/releases/download/0.10.1/synapse-admin-0.10.1.tar.gz";
+                sha256 = "sha256-M2AYNrnpNoDm20ZTH1OZBHVcjOrHAlqyq5iTQ/At/Xk=";
+                postFetch = ''
+                  sed -i -e 's@"/assets@"./assets@g' $out/index.html
+                '';
+              };
+            in
+              "${synapse-admin}/$1";
+          };
+          locations."/sliding-sync-client/" = {
+            # some svg urls are hardcoded to /client :shrug:
+            alias = "${pkgs.matrix-sliding-sync.src}/client/";
+            tryFiles = "$uri $uri/ /sliding-sync-client/index.html";
+          };
+          locations."~ ^/_matrix/client/unstable/org.matrix.msc3575/sync" = {
+            proxyPass = "http://unix:/run/matrix-synapse/sliding_sync.sock:";
+          };
+          locations."~ ^(/_matrix|/_synapse/client|/_synapse/admin)" = {
+            proxyPass = "http://unix:/run/matrix-synapse/main_client_federation.sock:";
+            extraConfig = ''
+              client_max_body_size 50M;
+            '';
+          };
+        };
+      };
+    };
+
+    systemd.services.postgresql.postStart = lib.mkAfter ''
+      $PSQL -tAc "SELECT 1 FROM pg_database WHERE datname = 'matrix-synapse'" | grep -q 1 || $PSQL -tAc "CREATE DATABASE \"matrix-synapse\" LC_COLLATE='C' LC_CTYPE='C' TEMPLATE template0"
+      $PSQL -tAc "SELECT 1 FROM pg_database WHERE datname = 'matrix-sliding-sync'" | grep -q 1 || $PSQL -tAc "CREATE DATABASE \"matrix-sliding-sync\" LC_COLLATE='C' LC_CTYPE='C' TEMPLATE template0"
+      $PSQL -tAc "SELECT 1 FROM pg_roles WHERE rolname='matrix-synapse'" | grep -q 1 || $PSQL -tAc 'CREATE USER "matrix-synapse"'
+      $PSQL -tAc 'ALTER DATABASE "matrix-synapse" OWNER TO "matrix-synapse";'
+      $PSQL -tAc 'ALTER DATABASE "matrix-sliding-sync" OWNER TO "matrix-synapse";'
+    '';
+
+    disko.devices.zpool.zfast.datasets."root/persist/var/lib/matrix-sliding-sync" =
+      { type = "zfs_fs"; mountpoint = "/persist/zfast/var/lib/matrix-sliding-sync"; options.mountpoint = "legacy"; };
+    disko.devices.zpool.zfast.datasets."root/persist/var/lib/matrix-synapse" =
+      { type = "zfs_fs"; mountpoint = "/persist/zfast/var/lib/matrix-synapse"; options.mountpoint = "legacy"; };
+
+    environment.persistence."/persist/zfast".directories = [
+      {
+        directory = "/var/lib/matrix-synapse";
+        user = "matrix-synapse";
+        group = "matrix-synapse";
+        mode = "0700";
+      }
+      {
+        directory = "/var/lib/matrix-sliding-sync";
+        user = "matrix-synapse";
+        group = "matrix-synapse";
+        mode = "0700";
+      }
+    ];
+
+    users.users.matrix-synapse.extraGroups = [ "keys" ];
+    users.users.nginx.extraGroups = [ "matrix-synapse" ];
+
+    services.matrix-synapse = {
+      enable = true;
+      extraConfigFiles = [
+        config.secrets.fullPaths."matrix/homeserver_secrets.yaml"
+      ];
+      settings.server_name = "immae.eu";
+      settings.signing_key_path = config.secrets.fullPaths."matrix/signing.key";
+      settings.listeners = [
+        {
+          port = 8008;
+          bind_addresses = [ "127.0.0.1" ];
+          type = "http";
+          tls = false;
+          x_forwarded = true;
+          resources = [
+            {
+              names = [ "client" ];
+              compress = true;
+            }
+          ];
+        }
+        {
+          path = "/run/matrix-synapse/main_client_federation.sock";
+          resources = [
+            {
+              compress = true;
+              names = [ "client" ];
+            }
+            {
+              compress = false;
+              names = [ "federation" ];
+            }
+          ];
+          type = "http";
+          x_forwarded = true;
+        }
+      ];
+    };
+    services.matrix-sliding-sync = {
+      enable = true;
+      createDatabase = false;
+      settings.SYNCV3_SERVER = "/run/matrix-synapse/main_client_federation.sock";
+      settings.SYNCV3_BINDADDR = "/run/matrix-synapse/sliding_sync.sock";
+      environmentFile = config.secrets.fullPaths."matrix/sliding-sync";
+    };
+
+    systemd.services.matrix-synapse = {
+      after = [
+        "postgresql.service"
+        "persist-zfast-var-lib-matrix\\x2dsynapse.mount"
+        "var-lib-matrix\\x2dsynapse.mount"
+      ];
+      unitConfig = {
+        BindsTo = [
+          "var-lib-matrix\\x2dsynapse.mount"
+          "persist-zfast-var-lib-matrix\\x2dsynapse.mount"
+        ];
+      };
+      serviceConfig.SupplementaryGroups = [ "keys" ];
+    };
+
+    systemd.services.matrix-sliding-sync = {
+      serviceConfig = {
+        DynamicUser = lib.mkForce false;
+        User = "matrix-synapse";
+        Group = "matrix-synapse";
+        RuntimeDirectory = "matrix-synapse";
+        SupplementaryGroups = [ "keys" ];
+      };
+      unitConfig = {
+        BindsTo = [
+          "persist-zfast-var-lib-matrix\\x2dsliding\\x2dsync.mount"
+          "var-lib-matrix\\x2dsliding\\x2dsync.mount"
+        ];
+        After = lib.mkForce [
+          "matrix-synapse.service"
+          "postgresql.service"
+          "var-lib-matrix\\x2dsliding\\x2dsync.mount"
+          "persist-zfast-var-lib-matrix\\x2dsliding\\x2dsync.mount"
+        ];
+      };
+    };
+    secrets.keys."matrix/signing.key" = {
+      permissions = "0400";
+      user = "matrix-synapse";
+      group = "matrix-synapse";
+      text = "{{ .matrix.signing_key }}";
+    };
+    secrets.keys."matrix/homeserver_secrets.yaml" = {
+      permissions = "0400";
+      user = "matrix-synapse";
+      group = "matrix-synapse";
+      # Beware, yaml keys are merged at top level, not deep
+      text = ''
+        password_config:
+            enabled: true
+            pepper: "{{ .matrix.password_pepper }}"
+        macaroon_secret_key: "{{ .matrix.macaroon_secret_key }}"
+      '';
+    };
+    secrets.keys."matrix/sliding-sync" = {
+      permissions = "0400";
+      user = "matrix-synapse";
+      group = "matrix-synapse";
+      text = ''
+        SYNCV3_SECRET={{ .matrix.sliding_sync_secret }}
+      '';
+    };
+  };
+}