nix-config/modules/services/matrix-synapse/default.nix

{
  config,
  lib,
  pkgs,
  inputs,
  ...
}:

let
  cfg = config.modules.services.matrix-synapse;
  matrixClientConfig = {
    "m.homeserver" = {
      base_url = "https://matrix.vimium.com";
      server_name = "vimium.com";
    };
    "m.identity_server" = {};
  };
  matrixServerConfig."m.server" = "matrix.vimium.com:443";
  mkWellKnown = data: ''
    more_set_headers 'Content-Type: application/json';
    return 200 '${builtins.toJSON data}';
  '';
in {
  options.modules.services.matrix-synapse = {
    enable = lib.mkOption {
      default = false;
      example = true;
    };
  };

  config = lib.mkIf cfg.enable {
    networking.firewall.allowedTCPPorts = [
      8448 # Matrix federation
    ];

    security.acme.certs = {
      "matrix.vimium.com" = {
        reloadServices = [ "matrix-synapse" ];
      };
    };

    services.nginx.virtualHosts = {
      "chat.vimium.com" = {
        forceSSL = true;
        enableACME = true;
        root = pkgs.unstable.element-web.override {
          conf = {
            default_server_config = matrixClientConfig;
            brand = "Vimium Chat";
            branding = {
              auth_header_logo_url = "https://vimium.com/images/logo.svg";
              auth_footer_links = [
                { "text" = "Vimium.com"; "url" = "https://vimium.com"; }
              ];
            };
          };
        };
      };
      "matrix.vimium.com" = {
        forceSSL = true;
        enableACME = true;
        listen = [
          {
            addr = "0.0.0.0";
            port = 443;
            ssl = true;
          }
          {
            addr = "0.0.0.0";
            port = 80;
          }
          {
            addr = "0.0.0.0";
            port = 8448;
            ssl = true;
          }
          {
            addr = "[::1]";
            port = 443;
            ssl = true;
          }
          {
            addr = "[::1]";
            port = 80;
          }
          {
            addr = "[::1]";
            port = 8448;
            ssl = true;
          }
        ];
        locations = {
          "/" = {
            proxyPass = "http://localhost:8008";
            extraConfig = ''
              proxy_set_header X-Forwarded-For $remote_addr;
            '';
          };
          "/_matrix" = {
            proxyPass = "http://localhost:8008";
            extraConfig = ''
              proxy_set_header X-Forwarded-For $remote_addr;
              client_max_body_size 50M;
            '';
          };
          "/_synapse/client".proxyPass = "http://localhost:8008";
        };
      };
      "vimium.com" = {
        locations."= /.well-known/matrix/server".extraConfig = (mkWellKnown matrixServerConfig);
        locations."= /.well-known/matrix/client".extraConfig = (mkWellKnown matrixClientConfig);
      };
    };

    services.matrix-synapse = {
      enable = true;
      settings = {
        database.name = "sqlite3";
        enable_metrics = false;
        enable_registration = false;
        max_upload_size = "100M";
        report_stats = false;
        server_name = "vimium.com";
      };
    };
  };
}