atridad/haschel
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Try this now

Browse Source
This commit is contained in:
Atridad Lahiji
2026-02-10 23:16:32 -07:00
parent 8fa4b314b0
commit 06517138e1
3 changed files with 215 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
configuration.nix
View File

@@ -10,6 +10,7 @@
./modules/hardware.nix
./modules/services.nix
./modules/nginx.nix
./modules/matrix.nix
];
nix.settings.experimental-features = [ "nix-command" "flakes" ];

114
modules/matrix.nix Normal file
View File

@@ -0,0 +1,114 @@
{ config, pkgs, lib, ... }:
let
livekitKeyFile = "/run/livekit.key";
serverName = "atri.dad";
matrixDomain = "chat.atri.dad";
matrixRtcDomain = "matrixrtc.atri.dad";
in
{
services.matrix-synapse = {
enable = true;
settings = {
server_name = serverName;
public_baseurl = "https://${matrixDomain}";
listeners = [
{
port = 8008;
bind_addresses = [ "::1" "127.0.0.1" ];
type = "http";
tls = false;
x_forwarded = true;
resources = [
{
names = [ "client" "federation" ];
compress = true;
}
];
}
];
database = {
name = "psycopg2";
args = {
database = "matrix-synapse";
user = "matrix-synapse";
host = "/run/postgresql";
};
};
max_upload_size = "100M";
url_preview_enabled = true;
url_preview_ip_range_blacklist = [
"127.0.0.0/8"
"10.0.0.0/8"
"172.16.0.0/12"
"192.168.0.0/16"
"100.64.0.0/10"
"192.0.0.0/24"
"169.254.0.0/16"
"198.18.0.0/15"
"::1/128"
"fe80::/10"
"fc00::/7"
];
enable_registration = false;
};
};
services.postgresql = {
enable = true;
ensureDatabases = [ "matrix-synapse" ];
ensureUsers = [
{
name = "matrix-synapse";
ensureDBOwnership = true;
}
];
};
services.livekit = {
enable = true;
openFirewall = true;
settings = {
port = 7880;
rtc = {
port_range_start = 50000;
port_range_end = 60000;
use_external_ip = true;
};
room.auto_create = false;
};
keyFile = livekitKeyFile;
};
services.lk-jwt-service = {
enable = true;
livekitUrl = "wss://${matrixDomain}/livekit/sfu";
keyFile = livekitKeyFile;
};
systemd.services.lk-jwt-service.environment.LIVEKIT_FULL_ACCESS_HOMESERVERS = serverName;
systemd.services.livekit-key = {
before = [ "lk-jwt-service.service" "livekit.service" ];
wantedBy = [ "multi-user.target" ];
path = with pkgs; [ livekit coreutils gawk ];
script = ''
echo "Key missing, generating key"
echo "lk-jwt-service: $(livekit-server generate-keys | tail -1 | awk '{print $3}')" > "${livekitKeyFile}"
'';
serviceConfig.Type = "oneshot";
unitConfig.ConditionPathExists = "!${livekitKeyFile}";
};
networking.firewall = {
allowedTCPPorts = [ 7880 7881 ];
allowedUDPPortRanges = [
{ from = 50000; to = 60000; }
];
};
}

101
modules/nginx.nix
View File

@@ -1,5 +1,30 @@
{ config, pkgs, ... }:
{ config, pkgs, lib, ... }:
let
serverName = "atri.dad";
matrixDomain = "chat.atri.dad";
# .well-known/matrix/client JSON
wellKnownClient = builtins.toJSON {
"m.homeserver" = {
base_url = "https://${matrixDomain}";
};
"org.matrix.msc3575.proxy" = {
url = "https://${matrixDomain}";
};
"org.matrix.msc4143.rtc_foci" = [
{
type = "livekit";
livekit_service_url = "https://${matrixDomain}/livekit/jwt";
}
];
};
# .well-known/matrix/server JSON
wellKnownServer = builtins.toJSON {
"m.server" = "${matrixDomain}:443";
};
in
{
services.nginx = {
enable = true;
@@ -119,6 +144,19 @@
proxyPass = "http://lloyd.tadpole-pain.ts.net:3000";
extraConfig = "if ($fuckai) { return 444; }";
};
locations."= /.well-known/matrix/server" = {
extraConfig = ''
default_type application/json;
return 200 '${wellKnownServer}';
'';
};
locations."= /.well-known/matrix/client" = {
extraConfig = ''
default_type application/json;
add_header Access-Control-Allow-Origin "*";
return 200 '${wellKnownClient}';
'';
};
};
"analytics.atri.dad" = {
enableACME = true;
@@ -337,6 +375,67 @@
};
};
# Matrix
"chat.atri.dad" = {
enableACME = true;
forceSSL = true;
locations."/" = {
proxyPass = "http://[::1]:8008";
proxyWebsockets = true;
extraConfig = ''
client_max_body_size 100M;
'';
};
locations."^~ /livekit/jwt/" = {
priority = 400;
proxyPass = "http://[::1]:${toString config.services.lk-jwt-service.port}/";
};
locations."^~ /livekit/sfu/" = {
priority = 400;
proxyPass = "http://[::1]:${toString config.services.livekit.settings.port}/";
proxyWebsockets = true;
extraConfig = ''
proxy_send_timeout 120;
proxy_read_timeout 120;
proxy_buffering off;
proxy_set_header Accept-Encoding gzip;
'';
};
locations."= /.well-known/matrix/server" = {
extraConfig = ''
default_type application/json;
return 200 '${wellKnownServer}';
'';
};
locations."= /.well-known/matrix/client" = {
extraConfig = ''
default_type application/json;
add_header Access-Control-Allow-Origin "*";
return 200 '${wellKnownClient}';
'';
};
};
# LiveKit WebRTC signaling domain
"matrixrtc.atri.dad" = {
enableACME = true;
forceSSL = true;
locations."/" = {
proxyPass = "http://[::1]:${toString config.services.livekit.settings.port}";
proxyWebsockets = true;
extraConfig = ''
proxy_send_timeout 120;
proxy_read_timeout 120;
proxy_buffering off;
proxy_set_header Accept-Encoding gzip;
'';
};
};
# atash.dev hosts
"atash.dev" = {
enableACME = true;