genebean/dots
1
0
Fork 0
mirror of https://github.com/genebean/dots.git synced 2026-03-27 09:27:44 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

Matrix works, Nginx is carrying the load

Browse source
This commit is contained in:
Gene Liverman 2024-06-19 00:08:01 -04:00
parent fac12b855e
commit f3e75455b3
5 changed files with 66 additions and 36 deletions
Download patch file Download diff file Expand all files Collapse all files

1
modules/hosts/nixos/hetznix01/post-install/default.nix
View file

@ -38,6 +38,7 @@
owner = config.users.users.matrix-synapse.name;
restartUnits = ["matrix-synapse.service"];
};
matrix_homeserver_signing_key.owner = config.users.users.matrix-synapse.name;
mqtt_recorder_pass.restartUnits = ["mosquitto.service"];
owntracks_basic_auth = {
owner = config.users.users.nginx.name;

12
modules/hosts/nixos/hetznix01/post-install/matrix-synapse.nix
View file

@ -9,7 +9,9 @@ in {
config.sops.secrets.matrix_secrets_yaml.path
];
settings = {
public_baseurl = "https://matrix-test.technicalissues.us";
server_name = "technicalissues.us";
public_baseurl = "https://matrix.technicalissues.us";
signing_key_path = config.sops.secrets.matrix_homeserver_signing_key.path;
listeners = [
{
port = 8008;
@ -31,17 +33,9 @@ in {
];
}
];
database = {
name = "psycopg2";
args = {
user = "synapse_user";
database = "synapse";
};
};
url_preview_enabled = true;
enable_registration = false;
trusted_key_servers = [{ server_name = "matrix.org"; }];
};
};

81
modules/hosts/nixos/hetznix01/post-install/nginx.nix
View file

@ -9,6 +9,7 @@ in {
];
services.nginx = {
enable = true;
recommendedBrotliSettings = true;
recommendedGzipSettings = true;
recommendedOptimisation = true;
recommendedProxySettings = true;
@ -21,40 +22,79 @@ in {
}
add_header Strict-Transport-Security $hsts_header;
'';
defaultListen = [
{ port = https_port; addr = "0.0.0.0"; ssl = true; }
{ port = https_port; addr = "[::]"; ssl = true; }
];
virtualHosts = {
"hetznix01.${domain}" = {
serverAliases = [
"technicalissues.us"
];
default = true;
enableACME = true;
acmeRoot = null;
forceSSL = true;
locations = {
"/" = {
return = "301 https://beanbag.technicalissues.us";
};
"/.well-known/matrix/client" = {
return = ''
200 '{"m.homeserver": {"base_url": "https://matrix.technicalissues.us"}}'
'';
extraConfig = ''
default_type application/json;
add_header Access-Control-Allow-Origin *;
'';
};
"/.well-known/matrix/server" = {
return = ''
200 '{"m.server": "matrix.technicalissues.us"}'
'';
extraConfig = ''
default_type application/json;
add_header Access-Control-Allow-Origin *;
'';
};
};
};
"matrix.${domain}" = {
listen = [
{ port = http_port; addr = "0.0.0.0"; }
{ port = https_port; addr = "0.0.0.0"; ssl = true; }
{ port = https_port; addr = "[::]"; ssl = true; }
{ port = 8448; addr = "0.0.0.0"; ssl = true; }
{ port = 8448; addr = "[::]"; ssl = true; }
];
enableACME = true;
acmeRoot = null;
addSSL = true;
forceSSL = false;
locations."/" = {
return = "200 '<h1>Hello world ;)</h1>'";
extraConfig = ''
add_header Content-Type text/html;
'';
forceSSL = true;
extraConfig = ''
client_max_body_size 0;
'';
locations = {
"/" = {
return = "200 '<h1>Hi.</h1>'";
extraConfig = ''
add_header Content-Type text/html;
'';
};
# Forward all Matrix API calls to the synapse Matrix homeserver. A trailing slash
# *must not* be used here.
"/_matrix".proxyPass = "http://[::1]:8008";
# Forward requests for e.g. SSO and password-resets.
"/_synapse/client".proxyPass = "http://[::1]:8008";
};
};
"ot.${domain}" = {
listen = [{ port = https_port; addr = "0.0.0.0"; ssl = true; }];
enableACME = true;
acmeRoot = null;
forceSSL = true;
basicAuthFile = config.sops.secrets.owntracks_basic_auth.path;
locations = {
# OwnTracks Frontend container
"/" = {
proxyPass = "http://127.0.0.1:8082";
recommendedProxySettings = true;
};
};
# OwnTracks Frontend container
locations."/".proxyPass = "http://127.0.0.1:8082";
};
"recorder.${domain}" = {
listen = [{ port = https_port; addr = "0.0.0.0"; ssl = true; }];
enableACME = true;
acmeRoot = null;
forceSSL = true;
@ -63,35 +103,28 @@ in {
# OwnTracks Recorder
"/" = {
proxyPass = "http://127.0.0.1:8083";
recommendedProxySettings = true;
};
"/pub" = { # Client apps need to point to this path
extraConfig = "proxy_set_header X-Limit-U $remote_user;";
proxyPass = "http://127.0.0.1:8083/pub";
recommendedProxySettings = true;
};
"/static/" = {
proxyPass = "http://127.0.0.1:8083/static/";
recommendedProxySettings = true;
};
"/utils/" = {
proxyPass = "http://127.0.0.1:8083/utils/";
recommendedProxySettings = true;
};
"/view/" = {
extraConfig = "proxy_buffering off;";
proxyPass = "http://127.0.0.1:8083/view/";
recommendedProxySettings = true;
};
"/ws" = {
extraConfig = "rewrite ^/(.*) /$1 break;";
proxyPass = "http://127.0.0.1:8083";
recommendedProxySettings = true;
};
};
};
"utk.${domain}" = {
listen = [{ port = https_port; addr = "0.0.0.0"; ssl = true; }];
enableACME = true;
acmeRoot = null;
forceSSL = true;