oop

Makefile

@@ -1,4 +1,4 @@
-.PHONY: help certs matrix-user switch
+.PHONY: help certs switch
 
 help:
 	@grep -E '^[a-zA-Z_-]+:.*##' $(MAKEFILE_LIST) | awk 'BEGIN {FS = ":.*## "}; {printf "  \033[36m%-20s\033[0m %s\n", $$1, $$2}'
@@ -16,8 +16,3 @@ certs:
 	done; \
 	wait; \
 	echo "Done. Check status with: systemctl list-units 'acme-order-renew-*' --all --state=failed"
-
-matrix-user:
-	@nix shell nixpkgs#matrix-synapse -c register_new_matrix_user \
-		-k "$$(sudo cat /var/lib/matrix-synapse/registration_shared_secret)" \
-		http://localhost:8008

modules/matrix.nix

@@ -3,45 +3,23 @@
 let
   livekitKeyFile = "/run/livekit.key";
   serverName = "atri.dad";
-  matrixDomain = "chat.atri.dad";
+  matrixDomain = "matrix.atri.dad";
   matrixRtcDomain = "matrixrtc.atri.dad";
 in
 {
-  services.matrix-synapse = {
+  services.matrix-tuwunel = {
     enable = true;
     settings = {
+      global = {
         server_name = serverName;
-      public_baseurl = "https://${matrixDomain}";
+        address = [ "127.0.0.1" "::1" ];
-
+        port = [ 6167 ];
-      listeners = [
+        max_request_size = 104857600; # 100MB in bytes
-        {
+        allow_registration = false;
-          port = 8008;
+        allow_encryption = true;
-          bind_addresses = [ "::1" "127.0.0.1" ];
+        allow_federation = true;
-          type = "http";
+        trusted_servers = [ "matrix.org" ];
-          tls = false;
+        ip_range_denylist = [
-          x_forwarded = true;
-          resources = [
-            {
-              names = [ "client" "federation" ];
-              compress = true;
-            }
-          ];
-        }
-      ];
-
-      database = {
-        name = "psycopg2";
-        args = {
-          database = "matrix-synapse";
-          user = "matrix-synapse";
-          host = "/run/postgresql";
-        };
-      };
-
-      max_upload_size = "100M";
-
-      url_preview_enabled = true;
-      url_preview_ip_range_blacklist = [
           "127.0.0.0/8"
           "10.0.0.0/8"
           "172.16.0.0/12"
@@ -55,22 +33,18 @@ in
           "fc00::/7"
         ];
 
-      enable_registration = false;
+        well_known = {
-      registration_shared_secret_path = "/var/lib/matrix-synapse/registration_shared_secret";
+          server = "${matrixDomain}:443";
+          client = "https://${matrixDomain}";
+          rtc_transports = [
+            {
+              type = "livekit";
+              livekit_service_url = "https://${matrixRtcDomain}";
+            }
+          ];
+        };
       };
     };
-
-  services.postgresql = {
-    enable = true;
-    initialScript = pkgs.writeText "synapse-init.sql" ''
-      CREATE ROLE "matrix-synapse" WITH LOGIN;
-      CREATE DATABASE "matrix-synapse"
-        OWNER "matrix-synapse"
-        TEMPLATE template0
-        LC_COLLATE = 'C'
-        LC_CTYPE = 'C'
-        ENCODING = 'UTF8';
-    '';
   };
 
   services.livekit = {
@@ -90,7 +64,7 @@ in
 
   services.lk-jwt-service = {
     enable = true;
-    livekitUrl = "wss://${matrixDomain}/livekit/sfu";
+    livekitUrl = "wss://${matrixRtcDomain}";
     keyFile = livekitKeyFile;
   };
 

modules/nginx.nix

@@ -2,27 +2,18 @@
 
 let
   serverName = "atri.dad";
-  matrixDomain = "chat.atri.dad";
+  matrixDomain = "matrix.atri.dad";
 
-  # .well-known/matrix/client JSON
+  # .well-known/matrix/server JSON (served from atri.dad for delegation)
+  wellKnownServer = builtins.toJSON {
+    "m.server" = "${matrixDomain}:443";
+  };
+
+  # .well-known/matrix/client JSON (served from atri.dad for delegation)
   wellKnownClient = builtins.toJSON {
     "m.homeserver" = {
       base_url = "https://${matrixDomain}";
     };
-    "org.matrix.msc3575.proxy" = {
-      url = "https://${matrixDomain}";
-    };
-    "org.matrix.msc4143.rtc_foci" = [
-      {
-        type = "livekit";
-        livekit_service_url = "https://${matrixDomain}/livekit/jwt";
-      }
-    ];
-  };
-
-  # .well-known/matrix/server JSON
-  wellKnownServer = builtins.toJSON {
-    "m.server" = "${matrixDomain}:443";
   };
 in
 {
@@ -383,54 +374,36 @@ in
       };
 
       # Matrix
-      "chat.atri.dad" = {
+      "matrix.atri.dad" = {
         enableACME = true;
         forceSSL = true;
 
         locations."/" = {
-          proxyPass = "http://[::1]:8008";
+          proxyPass = "http://[::1]:6167";
           proxyWebsockets = true;
           extraConfig = ''
             client_max_body_size 100M;
           '';
         };
-
-        locations."^~ /livekit/jwt/" = {
-          priority = 400;
-          proxyPass = "http://[::1]:${toString config.services.lk-jwt-service.port}/";
       };
 
-        locations."^~ /livekit/sfu/" = {
+      # LiveKit WebRTC signaling domain (MatrixRTC)
-          priority = 400;
-          proxyPass = "http://[::1]:${toString config.services.livekit.settings.port}/";
-          proxyWebsockets = true;
-          extraConfig = ''
-            proxy_send_timeout 120;
-            proxy_read_timeout 120;
-            proxy_buffering off;
-            proxy_set_header Accept-Encoding gzip;
-          '';
-        };
-
-        locations."= /.well-known/matrix/server" = {
-          extraConfig = ''
-            default_type application/json;
-            return 200 '${wellKnownServer}';
-          '';
-        };
-        locations."= /.well-known/matrix/client" = {
-          extraConfig = ''
-            default_type application/json;
-            add_header Access-Control-Allow-Origin "*";
-            return 200 '${wellKnownClient}';
-          '';
-        };
-      };
-
-      # LiveKit WebRTC signaling domain
       "matrixrtc.atri.dad" = {
         enableACME = true;
         forceSSL = true;
+
+        # lk-jwt-service
+        locations."~ ^(/sfu/get|/healthz)" = {
+          priority = 400;
+          proxyPass = "http://[::1]:${toString config.services.lk-jwt-service.port}";
+          extraConfig = ''
+            proxy_set_header Host $host;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+          '';
+        };
+
+        # livekit
         locations."/" = {
           proxyPass = "http://[::1]:${toString config.services.livekit.settings.port}";
           proxyWebsockets = true;