nix-config/modules/nixos/services/matrix.nix

{ config, lib, pkgs, self, ... }:

let
  cfg = config.modules.services.matrix;
in {
  options.modules.services.matrix = {
    enable = lib.mkEnableOption "matrix";
    element = {
      enable = lib.mkOption {
        type = lib.types.bool;
        default = true;
      };
    };
    bridges = {
      signal = lib.mkOption {
        type = lib.types.bool;
        default = false;
        description = "Enable Signal bridge.";
      };
      whatsapp = lib.mkOption {
        type = lib.types.bool;
        default = false;
        description = "Enable WhatsApp bridge.";
      };
    };
    serverName = lib.mkOption {
      type = lib.types.str;
      default = "vimium.com";
      example = "vimium.com";
    };
    usePostgresql = lib.mkEnableOption "postgresql";
  };

  config = let
    matrixSubdomain = "matrix.${cfg.serverName}";
    elementSubdomain = "chat.${cfg.serverName}";
    matrixClientConfig = {
      "m.homeserver" = {
        base_url = "https://${matrixSubdomain}";
        server_name = cfg.serverName;
      };
      "m.identity_server" = {
        "base_url" = "https://vector.im";
      };
    };
    matrixServerConfig."m.server" = "${matrixSubdomain}:443";
    commonBridgeSettings = bridge: {
      appservice = {
        database = lib.mkIf cfg.usePostgresql {
          type = "postgres";
          uri = "postgresql:///${bridge}?host=/run/postgresql";
        };
      };
      bridge = {
        encryption = {
          allow = true;
          default = true;
          require = true;
        };
        permissions = {
          "${cfg.serverName}" = "user";
          "@jordan:${cfg.serverName}" = "admin";
        };
        provisioning = {
          shared_secret = "disable";
        };
      };
      homeserver = {
        address = "https://${matrixSubdomain}";
        domain = cfg.serverName;
      };
    };
  in lib.mkIf cfg.enable {
    networking.firewall.allowedTCPPorts = [
      8448 # Matrix federation
    ];

    security.acme.certs = {
      "${matrixSubdomain}" = {
        reloadServices = [ "matrix-synapse" ];
      };
    };

    services.nginx.virtualHosts = {
      "${matrixSubdomain}" = {
        forceSSL = true;
        enableACME = true;
        listen = [
          {
            addr = "0.0.0.0";
            port = 443;
            ssl = true;
          }
          {
            addr = "0.0.0.0";
            port = 80;
          }
          {
            addr = "0.0.0.0";
            port = 8448;
            ssl = true;
          }
          {
            addr = "[::1]";
            port = 443;
            ssl = true;
          }
          {
            addr = "[::1]";
            port = 80;
          }
          {
            addr = "[::1]";
            port = 8448;
            ssl = true;
          }
        ];
        locations = {
          "/" = {
            proxyPass = "http://localhost:8008";
            extraConfig = ''
              proxy_set_header X-Forwarded-For $remote_addr;
            '';
          };
          "/_matrix" = {
            proxyPass = "http://localhost:8008";
            extraConfig = ''
              proxy_set_header X-Forwarded-For $remote_addr;
              client_max_body_size 50M;
            '';
          };
          "/_synapse/client".proxyPass = "http://localhost:8008";
        };
      };
      "${cfg.serverName}" = let
        mkWellKnown = data: ''
          more_set_headers 'Content-Type: application/json';
          return 200 '${builtins.toJSON data}';
        '';
      in {
        locations."= /.well-known/matrix/server".extraConfig = (mkWellKnown matrixServerConfig);
        locations."= /.well-known/matrix/client".extraConfig = (mkWellKnown matrixClientConfig);
      };
    } // (if cfg.element.enable then {
      "${elementSubdomain}" = {
        forceSSL = true;
        enableACME = true;
        root = pkgs.unstable.element-web.override {
          conf = {
            default_server_config = matrixClientConfig;
            brand = "Vimium Chat";
            branding = {
              auth_header_logo_url = "https://vimium.com/images/logo.svg";
              auth_footer_links = [
                { "text" = "Vimium.com"; "url" = "https://vimium.com"; }
              ];
            };
          };
        };
      };
    } else {});

    nixpkgs.config.permittedInsecurePackages = [
      "jitsi-meet-1.0.8043"
      "olm-3.2.16"
    ];

    services.matrix-synapse = {
      enable = true;
      enableRegistrationScript = true;
      settings = {
        database.name = (if cfg.usePostgresql then "psycopg2" else "sqlite3");
        enable_metrics = false;
        enable_registration = false;
        max_upload_size = "100M";
        report_stats = false;
        server_name = cfg.serverName;
      };
    };
    systemd.services.matrix-synapse.serviceConfig.SupplementaryGroups =
      (lib.optional cfg.bridges.whatsapp
        config.systemd.services.mautrix-whatsapp.serviceConfig.Group);

    services.postgresql = lib.mkIf cfg.usePostgresql {
      ensureUsers = [
        {
          name = "matrix-synapse";
          ensureDBOwnership = true;
        }
      ] ++ (lib.optional cfg.bridges.signal
        {
          name = "mautrix-signal";
          ensureDBOwnership = true;
        })
        ++ (lib.optional cfg.bridges.whatsapp
        {
          name = "mautrix-whatsapp";
          ensureDBOwnership = true;
        });
      ensureDatabases = [
        "matrix-synapse"
      ] ++ (lib.optional cfg.bridges.signal
        "mautrix-signal")
        ++ (lib.optional cfg.bridges.whatsapp
        "mautrix-whatsapp");
    };

    services.mautrix-signal = lib.mkIf cfg.bridges.signal {
      enable = true;
      settings = commonBridgeSettings "mautrix-signal";
    };

    services.mautrix-whatsapp = lib.mkIf cfg.bridges.whatsapp {
      enable = true;
      settings = {
        bridge = {
          history_sync = {
            backfill = true;
            max_initial_conversations = -1;
            message_count = 50;
            request_full_sync = true;
          };
          mute_bridging = true;
        };
      } // commonBridgeSettings "mautrix-whatsapp";
    };
  };
}