Specify default locale and encoding for postgresql

hosts/server.nix

@@ -18,13 +18,13 @@
         webroot = "/var/lib/acme/acme-challenge";
       };
     };
-    auditd.enable = true;
+    # auditd.enable = true;
-    audit = {
+    # audit = {
-      enable = true;
+    #   enable = true;
-      rules = [
+    #   rules = [
-        "-a exit,always -F arch=b64 -S execve"
+    #     "-a exit,always -F arch=b64 -S execve"
-      ];
+    #   ];
-    };
+    # };
   };
 
   systemd = {

hosts/vps1/default.nix

@@ -43,7 +43,8 @@
 
   services.openssh.settings.PermitRootLogin = lib.mkForce "prohibit-password";
 
-  modules = {
+  modules = rec {
+    databases.postgresql.enable = true;
     services = {
       borgmatic = {
         enable = true;
@@ -61,7 +62,10 @@
       };
       gitea.enable = true;
       headscale.enable = true;
-      matrix-synapse.enable = true;
+      matrix-synapse = {
+        enable = true;
+        usePostgresql = databases.postgresql.enable;
+      };
       nginx.enable = true;
       photoprism.enable = true;
     };

modules/databases/postgresql.nix

@@ -0,0 +1,40 @@
+{
+  config,
+  lib,
+  ...
+}:
+
+let
+  cfg = config.modules.databases.postgresql;
+in {
+  options.modules.databases.postgresql = {
+    enable = lib.mkOption {
+      default = false;
+      example = true;
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    services.postgresql = {
+      enable = true;
+      initdbArgs = [
+        "--allow-group-access"
+        "--encoding=UTF8"
+        "--locale=C"
+      ];
+      settings = {
+        log_connections = true;
+        log_disconnections = true;
+        log_destination = lib.mkForce "syslog";
+      };
+    };
+
+    services.borgmatic.settings = {
+      postgresql_databases = [
+        {
+          name = "all";
+        }
+      ];
+    };
+  };
+}

modules/default.nix

@@ -2,6 +2,7 @@
   imports = [
     ./options.nix
     ./podman.nix
+    ./databases/postgresql.nix
     ./desktop/gnome.nix
     ./desktop/forensics.nix
     ./desktop/hyprland.nix

modules/services/coturn/default.nix

@@ -79,7 +79,6 @@ in {
       no-tcp-relay = true;
       extraConfig = ''
         cipher-list="HIGH"
-        no-loopback-peers
         no-multicast-peers
 
         # Ban private CIDR blocks

modules/services/matrix-synapse/default.nix

@@ -2,61 +2,58 @@
   config,
   lib,
   pkgs,
-  inputs,
   ...
 }:
 
 let
   cfg = config.modules.services.matrix-synapse;
-  matrixClientConfig = {
-    "m.homeserver" = {
-      base_url = "https://matrix.vimium.com";
-      server_name = "vimium.com";
-    };
-    "m.identity_server" = {};
-  };
-  matrixServerConfig."m.server" = "matrix.vimium.com:443";
-  mkWellKnown = data: ''
-    more_set_headers 'Content-Type: application/json';
-    return 200 '${builtins.toJSON data}';
-  '';
 in {
   options.modules.services.matrix-synapse = {
     enable = lib.mkOption {
       default = false;
       example = true;
     };
+    enableElementWeb = lib.mkOption {
+      default = true;
+      example = false;
+    };
+    serverName = lib.mkOption {
+      type = lib.types.str;
+      default = "vimium.com";
+      example = "vimium.com";
+    };
+    usePostgresql = lib.mkOption {
+      default = false;
+      example = true;
+    };
   };
 
-  config = lib.mkIf cfg.enable {
+  config = let
+    matrixClientConfig = {
+      "m.homeserver" = {
+        base_url = "https://matrix.${cfg.serverName}";
+        server_name = cfg.serverName;
+      };
+      "m.identity_server" = {};
+    };
+    matrixServerConfig."m.server" = "matrix.${cfg.serverName}:443";
+    mkWellKnown = data: ''
+      more_set_headers 'Content-Type: application/json';
+      return 200 '${builtins.toJSON data}';
+    '';
+  in lib.mkIf cfg.enable {
     networking.firewall.allowedTCPPorts = [
       8448 # Matrix federation
     ];
 
     security.acme.certs = {
-      "matrix.vimium.com" = {
+      "matrix.${cfg.serverName}" = {
         reloadServices = [ "matrix-synapse" ];
       };
     };
 
     services.nginx.virtualHosts = {
-      "chat.vimium.com" = {
+      "matrix.${cfg.serverName}" = {
-        forceSSL = true;
-        enableACME = true;
-        root = pkgs.unstable.element-web.override {
-          conf = {
-            default_server_config = matrixClientConfig;
-            brand = "Vimium Chat";
-            branding = {
-              auth_header_logo_url = "https://vimium.com/images/logo.svg";
-              auth_footer_links = [
-                { "text" = "Vimium.com"; "url" = "https://vimium.com"; }
-              ];
-            };
-          };
-        };
-      };
-      "matrix.vimium.com" = {
         forceSSL = true;
         enableACME = true;
         listen = [
@@ -106,22 +103,51 @@ in {
           "/_synapse/client".proxyPass = "http://localhost:8008";
         };
       };
-      "vimium.com" = {
+      "${cfg.serverName}" = {
         locations."= /.well-known/matrix/server".extraConfig = (mkWellKnown matrixServerConfig);
         locations."= /.well-known/matrix/client".extraConfig = (mkWellKnown matrixClientConfig);
       };
-    };
+    } // (if cfg.enableElementWeb then {
+      "chat.${cfg.serverName}" = {
+        forceSSL = true;
+        enableACME = true;
+        root = pkgs.unstable.element-web.override {
+          conf = {
+            default_server_config = matrixClientConfig;
+            brand = "Vimium Chat";
+            branding = {
+              auth_header_logo_url = "https://vimium.com/images/logo.svg";
+              auth_footer_links = [
+                { "text" = "Vimium.com"; "url" = "https://vimium.com"; }
+              ];
+            };
+          };
+        };
+      };
+    } else {});
 
     services.matrix-synapse = {
       enable = true;
       settings = {
-        database.name = "sqlite3";
+        database.name = (if cfg.usePostgresql then "psycopg2" else "sqlite3");
         enable_metrics = false;
         enable_registration = false;
         max_upload_size = "100M";
         report_stats = false;
-        server_name = "vimium.com";
+        server_name = cfg.serverName;
       };
     };
+
+    services.postgresql = lib.mkIf cfg.usePostgresql {
+      ensureUsers = [
+        {
+          name = "matrix-synapse";
+          ensureDBOwnership = true;
+        }
+      ];
+      ensureDatabases = [
+        "matrix-synapse"
+      ];
+    };
   };
 }