feat(matrix): replace conduit with dendrite!

secrets/etna/dendriteKey.age

@@ -0,0 +1,14 @@
+-----BEGIN AGE ENCRYPTED FILE-----
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBXUXIwUHJvMGlqMThoNDJQ
+bW9jb1paekhHN25MSDIrdWxDa29EbGExaWtvCkJGQmt2d0VTYXd5eTZDS25KVlhQ
+dm1CeW1acDVkMHZORGJpaDNEUER3N0EKLT4gWDI1NTE5IHpRaFB5cWZjSTlocGda
+SitEbC9TQ1JxUi8vQ3dCbkxWbmkvOVdkQlM4UlUKYnlOMVM3YmRrT1Vld3VDMzlt
+Z1VLeEZvZzFEME85OVJjcVBRZU1taTc5TQotPiBYMjU1MTkgSi9velVpRUJrcXA3
+L05EVDNGdEZqR0JOUVpjV1hQZ3VIa2hRT1RVZWtTdwpQMWVNYzJKZyttOFlyRDNQ
+RnhxQ3dsVno2UldGQjJCZGp0ZThVVExmanEwCi0tLSBTK1hqUTNMV1MvVFNpbmsy
+Zm9PWjM4N2VCbkRkN0JxVFBiZHB4TnR1a1c0Cn+cp0DpgCFW2dIiZ6DQllFG4eTh
+GrFXVyxw65wz/rjZlNE2xp4R5h7et7m1uUQf50UzFXw47NwiNqhw3/baegxdDUDk
+fHx93pRl7UvZuBm/FLNxUN25+oEpx29adZud+ij/TfUhx864k3LXrWec0o2DQzfv
+TmpzvpGX4Fq+oBSw2RHnUByDPYW9idnYdvoEetjOegoAcUhfqAUriZyddtRgn8Ka
+n3u/Ss03
+-----END AGE ENCRYPTED FILE-----

secrets/secrets.nix

@@ -20,4 +20,5 @@ in {
   "etna/ngrokEnv.age".publicKeys = main ++ [etna];
   "etna/minecraftEnv.age".publicKeys = main ++ [etna];
   "etna/atticEnv.age".publicKeys = main ++ [etna];
+  "etna/dendriteKey.age".publicKeys = main ++ [etna];
 }

systems/etna/default.nix

@@ -10,6 +10,7 @@ in {
 
     ./minecraft.nix
     ./attic.nix
+    ./matrix.nix
   ];
 
   age.secrets = let
@@ -21,6 +22,11 @@ in {
       group = "cloudflared";
     };
 
+    dendriteKey = {
+      file = "${path}/dendriteKey.age";
+      mode = "444";
+    };
+
     apiRsEnv.file = "${path}/apiRsEnv.age";
     ukubotRsEnv.file = "${path}/ukubotRsEnv.age";
     ngrokEnv.file = "${path}/ngrokEnv.age";

systems/etna/matrix.nix

@@ -1,39 +1,77 @@
-{pkgs, ...}: {
+{config, ...}: {
   cfTunnels."m.uku.moe" = "http://localhost:80";
 
   services = {
-    matrix-conduit = {
-      enable = true;
-      settings.global = {
-        server_name = "m.uku.moe";
-        allow_registration = true;
-        port = 6167;
+    dendrite = let
+      database = {
+        connection_string = "postgres:///dendrite?host=/run/postgresql";
+        max_open_conns = 50;
+        max_idle_conns = 5;
+        conn_max_lifetime = -1;
       };
+    in {
+      enable = true;
+      httpPort = 8008;
+      settings = {
+        global = {
+          server_name = "m.uku.moe";
+          private_key = config.age.secrets.dendriteKey.path;
+          inherit database;
+        };
+
+        client_api = {
+          registration_disabled = true;
+        };
+
+        app_service_api = {inherit database;};
+        federation_api = {inherit database;};
+        key_server = {inherit database;};
+        media_api = {inherit database;};
+        mscs = {inherit database;};
+        relay_api = {inherit database;};
+        room_server = {inherit database;};
+        sync_api = {inherit database;};
+        user_api = {
+          account_database = database;
+          device_database = database;
+        };
+      };
+    };
+
+    postgresql = {
+      enable = true;
+      ensureDatabases = ["dendrite"];
+      ensureUsers = [
+        {
+          name = "dendrite";
+          ensureDBOwnership = true;
+        }
+      ];
     };
 
     nginx = {
       enable = true;
-      recommendedProxySettings = true;
 
       virtualHosts."m.uku.moe" = {
         locations."=/.well-known/matrix/server" = let
-          filename = "server-well-known";
-          content = builtins.toJSON {"m.server" = "m.uku.moe:443";};
+          server = {"m.server" = "m.uku.moe:443";};
         in {
-          alias = builtins.toString (pkgs.writeTextDir filename content) + "/";
-          tryFiles = "${filename} =200";
-          extraConfig = ''
-            default_type application/json;
-          '';
+          return = "200 '${builtins.toJSON server}'";
+        };
+
+        locations."=/.well-known/matrix/client" = let
+          client = {"m.homeserver"."base_url" = "https://my.hostname.com";};
+        in {
+          return = "200 '${builtins.toJSON client}'";
         };
 
         locations."/" = {
-          proxyPass = "http://localhost:6167/";
+          proxyPass = "http://localhost:8008";
           proxyWebsockets = true;
           extraConfig = ''
             proxy_set_header Host      $host;
-            proxy_buffering off;
-            client_max_body_size 100M;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_read_timeout         600;
           '';
         };
       };