From f3e75455b3dcceab50f466b9eb4b4a8a0b3f4e96 Mon Sep 17 00:00:00 2001 From: Gene Liverman Date: Wed, 19 Jun 2024 00:08:01 -0400 Subject: [PATCH] Matrix works, Nginx is carrying the load --- modules/hosts/nixos/hetznix01/default.nix | 1 + .../nixos/hetznix01/post-install/default.nix | 1 + .../hetznix01/post-install/matrix-synapse.nix | 12 +-- .../nixos/hetznix01/post-install/nginx.nix | 81 +++++++++++++------ modules/hosts/nixos/hetznix01/secrets.yaml | 7 +- 5 files changed, 66 insertions(+), 36 deletions(-) diff --git a/modules/hosts/nixos/hetznix01/default.nix b/modules/hosts/nixos/hetznix01/default.nix index fd63a63..0a6161f 100644 --- a/modules/hosts/nixos/hetznix01/default.nix +++ b/modules/hosts/nixos/hetznix01/default.nix @@ -40,6 +40,7 @@ services = { fail2ban.enable = true; + logrotate.enable = true; postgresql = { enable = true; package = pkgs.postgresql_16; diff --git a/modules/hosts/nixos/hetznix01/post-install/default.nix b/modules/hosts/nixos/hetznix01/post-install/default.nix index a0c9b3a..8bbc04e 100644 --- a/modules/hosts/nixos/hetznix01/post-install/default.nix +++ b/modules/hosts/nixos/hetznix01/post-install/default.nix @@ -38,6 +38,7 @@ owner = config.users.users.matrix-synapse.name; restartUnits = ["matrix-synapse.service"]; }; + matrix_homeserver_signing_key.owner = config.users.users.matrix-synapse.name; mqtt_recorder_pass.restartUnits = ["mosquitto.service"]; owntracks_basic_auth = { owner = config.users.users.nginx.name; diff --git a/modules/hosts/nixos/hetznix01/post-install/matrix-synapse.nix b/modules/hosts/nixos/hetznix01/post-install/matrix-synapse.nix index 74ac820..d320b2a 100644 --- a/modules/hosts/nixos/hetznix01/post-install/matrix-synapse.nix +++ b/modules/hosts/nixos/hetznix01/post-install/matrix-synapse.nix @@ -9,7 +9,9 @@ in { config.sops.secrets.matrix_secrets_yaml.path ]; settings = { - public_baseurl = "https://matrix-test.technicalissues.us"; + server_name = "technicalissues.us"; + public_baseurl = "https://matrix.technicalissues.us"; + signing_key_path = config.sops.secrets.matrix_homeserver_signing_key.path; listeners = [ { port = 8008; @@ -31,17 +33,9 @@ in { ]; } ]; - database = { - name = "psycopg2"; - args = { - user = "synapse_user"; - database = "synapse"; - }; - }; url_preview_enabled = true; enable_registration = false; trusted_key_servers = [{ server_name = "matrix.org"; }]; - }; }; diff --git a/modules/hosts/nixos/hetznix01/post-install/nginx.nix b/modules/hosts/nixos/hetznix01/post-install/nginx.nix index ef0b7bb..d7e0a55 100644 --- a/modules/hosts/nixos/hetznix01/post-install/nginx.nix +++ b/modules/hosts/nixos/hetznix01/post-install/nginx.nix @@ -9,6 +9,7 @@ in { ]; services.nginx = { enable = true; + recommendedBrotliSettings = true; recommendedGzipSettings = true; recommendedOptimisation = true; recommendedProxySettings = true; @@ -21,40 +22,79 @@ in { } add_header Strict-Transport-Security $hsts_header; ''; + defaultListen = [ + { port = https_port; addr = "0.0.0.0"; ssl = true; } + { port = https_port; addr = "[::]"; ssl = true; } + ]; virtualHosts = { "hetznix01.${domain}" = { + serverAliases = [ + "technicalissues.us" + ]; default = true; + enableACME = true; + acmeRoot = null; + forceSSL = true; + locations = { + "/" = { + return = "301 https://beanbag.technicalissues.us"; + }; + "/.well-known/matrix/client" = { + return = '' + 200 '{"m.homeserver": {"base_url": "https://matrix.technicalissues.us"}}' + ''; + extraConfig = '' + default_type application/json; + add_header Access-Control-Allow-Origin *; + ''; + }; + "/.well-known/matrix/server" = { + return = '' + 200 '{"m.server": "matrix.technicalissues.us"}' + ''; + extraConfig = '' + default_type application/json; + add_header Access-Control-Allow-Origin *; + ''; + }; + }; + }; + "matrix.${domain}" = { listen = [ - { port = http_port; addr = "0.0.0.0"; } { port = https_port; addr = "0.0.0.0"; ssl = true; } + { port = https_port; addr = "[::]"; ssl = true; } + { port = 8448; addr = "0.0.0.0"; ssl = true; } + { port = 8448; addr = "[::]"; ssl = true; } ]; enableACME = true; acmeRoot = null; - addSSL = true; - forceSSL = false; - locations."/" = { - return = "200 '

Hello world ;)

'"; - extraConfig = '' - add_header Content-Type text/html; - ''; + forceSSL = true; + extraConfig = '' + client_max_body_size 0; + ''; + locations = { + "/" = { + return = "200 '

Hi.

'"; + extraConfig = '' + add_header Content-Type text/html; + ''; + }; + # Forward all Matrix API calls to the synapse Matrix homeserver. A trailing slash + # *must not* be used here. + "/_matrix".proxyPass = "http://[::1]:8008"; + # Forward requests for e.g. SSO and password-resets. + "/_synapse/client".proxyPass = "http://[::1]:8008"; }; }; "ot.${domain}" = { - listen = [{ port = https_port; addr = "0.0.0.0"; ssl = true; }]; enableACME = true; acmeRoot = null; forceSSL = true; basicAuthFile = config.sops.secrets.owntracks_basic_auth.path; - locations = { - # OwnTracks Frontend container - "/" = { - proxyPass = "http://127.0.0.1:8082"; - recommendedProxySettings = true; - }; - }; + # OwnTracks Frontend container + locations."/".proxyPass = "http://127.0.0.1:8082"; }; "recorder.${domain}" = { - listen = [{ port = https_port; addr = "0.0.0.0"; ssl = true; }]; enableACME = true; acmeRoot = null; forceSSL = true; @@ -63,35 +103,28 @@ in { # OwnTracks Recorder "/" = { proxyPass = "http://127.0.0.1:8083"; - recommendedProxySettings = true; }; "/pub" = { # Client apps need to point to this path extraConfig = "proxy_set_header X-Limit-U $remote_user;"; proxyPass = "http://127.0.0.1:8083/pub"; - recommendedProxySettings = true; }; "/static/" = { proxyPass = "http://127.0.0.1:8083/static/"; - recommendedProxySettings = true; }; "/utils/" = { proxyPass = "http://127.0.0.1:8083/utils/"; - recommendedProxySettings = true; }; "/view/" = { extraConfig = "proxy_buffering off;"; proxyPass = "http://127.0.0.1:8083/view/"; - recommendedProxySettings = true; }; "/ws" = { extraConfig = "rewrite ^/(.*) /$1 break;"; proxyPass = "http://127.0.0.1:8083"; - recommendedProxySettings = true; }; }; }; "utk.${domain}" = { - listen = [{ port = https_port; addr = "0.0.0.0"; ssl = true; }]; enableACME = true; acmeRoot = null; forceSSL = true; diff --git a/modules/hosts/nixos/hetznix01/secrets.yaml b/modules/hosts/nixos/hetznix01/secrets.yaml index 4abb301..10532b2 100644 --- a/modules/hosts/nixos/hetznix01/secrets.yaml +++ b/modules/hosts/nixos/hetznix01/secrets.yaml @@ -1,6 +1,7 @@ local_git_config: ENC[AES256_GCM,data:BulcGoJ85+BA3maqbMewUdaNOl3feaJMq/4yZL8Y8SLOHqzmA/DUO7k=,iv:V7wpSiEQpt7AhKd+MUyGqTsO6YZovpkj+AaqpLnfRM0=,tag:7f3fFzQX3bpjokVPnUKDPQ==,type:str] local_private_env: ENC[AES256_GCM,data:OFcCaE9/hpd6JIoUTTxg0pEFL3rkUE3G+JzP/wjFXpa/AJa2Rr0Kv42Pu+iwgPMWgcpp50ChjVxGvbceNQ==,iv:I2LyWwvdMdE4wKLb3udLVMu3jFsvYR1ruZvaVt9GG7c=,tag:tBPmlNr0iNdLRU1GIRV2mg==,type:str] -matrix_secrets_yaml: ENC[AES256_GCM,data:El9razifgbJEaJd9NccOZX1RuZQHRyw6Yg7TY4G8vDtD2w7KxnHUG7bcpIQodh3I1GDjj3gQcHXP6HNs0zS7UjaoGltDt3mHnrhqkvvDW/RgAGrJ9nUsQitB3yhF51PG3IOK1SSbIBk+Pr/wQWbs11ic8i+fGJ6yPcv8k/X5Az8rKmDqDuZh9KUvSB3SQ9J/roOZ+HDb8fv1VmMgZZNGmkOUGZupZkKd+kc2rWrBl5zHTd9XUH6oLk2EwRDufR7T,iv:xCG8xJ7A1bFwK9v1+XJ+vSp/GXCTwdKCL4H/uQ6h4fQ=,tag:Z72quTZvJUMLJ+VJVsTKrw==,type:str] +matrix_secrets_yaml: ENC[AES256_GCM,data:6DLtAZIYBlL7iQVS/FBeUEhHyAOFZ5JRNqFBqi59GVh7cP0Hp8RBWxKpWAH2eUPYqUqUGCKrSSH3sJqzV+vasSR62tcltV7+13+q+rZVCZNCEf21EwQ5aaxgR3yG4n3YUPqLsCQB6UnWn0tF5HO0ofjYkya0pQ/nX9TBiiqIcPcd4NovbTtf+S0G0VptqyXAuRvJoKCx42ft9IBfV9tF1QsXLemKYlI10hN5l/MgJHwVbwH5xXR2kLKvnlpAyIoST/uJhswQV9DyK9cnl09ZM9ztcXhveBzv6uDW+pme8lFL99SMtMJcbSzxYW/pt+GJgYd1NiaoPbayWM72jdpH0hf2zWchxnIJIyL3H6EzIjD8BE9GnMP7ujQwBZGNZITRSg==,iv:cDtuOhv2v6CZcwiMM3oqjmajIl7D8Im+LkfarcjTM/w=,tag:e7zRQBYslJqESOGN3c4/aw==,type:str] +matrix_homeserver_signing_key: ENC[AES256_GCM,data:+RflNxFfS2w9LbavT7YnCQIhJWI49kN7pOa9/dH0BpDWxKQaLE4ZYBYq0ikAgcHaF3+rBL3f6KxUacw=,iv:6+nZzuxBUwjM74XHCD89YWfyuMRcoIwQlHLiNN4NWdc=,tag:91yigynRz6QdEd4rF7d/9g==,type:str] mqtt_recorder_pass: ENC[AES256_GCM,data:N44nv2mk5zguWXNHdKsxhoKUjiduD1hzsAb6,iv:aLudKuUBTPXgtAF33exELH/PESD0CqoDaydeqdhcmbA=,tag:3lhrqO8jxJiRHWZjWSRa0g==,type:str] owntracks_basic_auth: ENC[AES256_GCM,data:GX1U1uf7+erE+g9GzhXK5ED2QicfcbpRCwpJDw6Zr9X2FtdMYleH5mhLxw==,iv:PflRq+P50+oFf4wv5wwlY6V9bApGuJ3tlYTvJZ5mg0E=,tag:VHBY5qv7rX74DGURsYaWpw==,type:str] tailscale_key: ENC[AES256_GCM,data:Bl00WuIrLvxmt7aNsoXC6G7XFls7waZMzdfo/MsEOZl/i3wHwrjrmgwd3V4GkaJ42UjrC1OLobrkuLves4w=,iv:tlCu0EWgvhvs1ANdtQr7KWHJ2RjpHniUm/rFC4L/MHs=,tag:+8eov9w+SPGZPnjMdrN8gA==,type:str] @@ -19,8 +20,8 @@ sops: WkI4ejBaODI0d0tjWHpTT3VWTXNyaXcKMDtvHN4gcZqBNslyC+NwYW05zgs8QuPV W6EktAz+xu6kx5BJbli5GkUFmj52AtEGIqZ1Sr4a0pKQACC87XcTQA== -----END AGE ENCRYPTED FILE----- - lastmodified: "2024-06-18T01:49:28Z" - mac: ENC[AES256_GCM,data:ckwiYte2TP4ufiFkmX2cTuNNae+VizjQ/CM1b1m3Lz3Vo5utd1g82loChQS95s9lr1dmKljuUbklHzg74JbNCeFky4f6od5CEydq/R9dXFTZKBen9cLcdvTVQ0i6E9rZS0t6ohy3wMFyJxw0ss6Zyykd0cqQOPuFBpyHmKFZTVs=,iv:85G4CxlLPD0Ac6KxRYaZ+4H9uj8Co6nmh1bbL6s3MVI=,tag:oyRhgR2Uf7lWFIlH5FKAvw==,type:str] + lastmodified: "2024-06-19T01:44:04Z" + mac: ENC[AES256_GCM,data:PU4r7DhcG6OgqTCeKBtxyAHDErGH6Eh33sOd+KuImQ74ajgahFNfd4zO27OldZbSERkOYLuFqw7w9+zblV3eaaXRQx97Ek3z4oMtJFv2t9lnNfG0lm45c1eECKV742mzTDi6/bcnQMdn/CaGli8DL45IGGctW+beXRJza0S3wEY=,iv:51WymgQc4OWcannaD4g+fjp4vc75WonWsOMS3Jyz7Xo=,tag:dmNFFgkuKQxy2Snb/HjX/A==,type:str] pgp: [] unencrypted_suffix: _unencrypted version: 3.8.1