2022-06-12 15:39:15 +00:00
|
|
|
{
|
|
|
|
system,
|
|
|
|
config,
|
|
|
|
pkgs,
|
|
|
|
lib,
|
|
|
|
...
|
|
|
|
}: let
|
2023-06-13 05:46:23 +00:00
|
|
|
inherit (pkgs) matrix-media-repo;
|
2022-06-12 15:39:15 +00:00
|
|
|
config-yml = pkgs.writeText "matrix-media-repo.yaml" (lib.generators.toYAML {} {
|
2022-04-29 16:34:08 +00:00
|
|
|
repo = {
|
|
|
|
bindAddress = "127.0.0.1";
|
|
|
|
port = 8008;
|
2022-05-27 17:58:46 +00:00
|
|
|
logDirectory = "-";
|
2022-04-29 16:34:08 +00:00
|
|
|
};
|
2022-04-29 20:11:01 +00:00
|
|
|
database.postgres = "postgresql:///matrix_media_repo?sslmode=disable&host=/run/postgresql";
|
2022-06-12 15:39:15 +00:00
|
|
|
homeservers = [
|
|
|
|
{
|
2024-10-01 20:11:40 +00:00
|
|
|
name = "chir.rs";
|
2022-08-26 06:30:59 +00:00
|
|
|
csApi = "https://matrix.chir.rs";
|
2024-09-25 14:04:39 +00:00
|
|
|
signingKeyPath = config.sops.secrets."services/matrix-media-repo/signing.key".path;
|
2022-08-26 06:30:59 +00:00
|
|
|
}
|
2022-06-12 15:39:15 +00:00
|
|
|
];
|
2023-09-15 12:58:12 +00:00
|
|
|
accessTokens.maxCacheTimeSeconds = 43200;
|
2022-06-12 15:39:15 +00:00
|
|
|
admins = ["@lotte:chir.rs"];
|
|
|
|
datastores = [
|
|
|
|
{
|
|
|
|
type = "s3";
|
2023-05-23 04:55:27 +00:00
|
|
|
id = "b003babbb86fecf56bb9ba6571f9adb0bd1e71c8";
|
2022-06-12 15:39:15 +00:00
|
|
|
enabled = true;
|
|
|
|
forKinds = ["all"];
|
|
|
|
opts = {
|
2023-09-15 12:58:12 +00:00
|
|
|
tempPath = "/var/lib/matrix-media-repo";
|
2023-10-01 14:47:26 +00:00
|
|
|
endpoint = "ams1.vultrobjects.com";
|
2022-06-12 15:39:15 +00:00
|
|
|
accessKeyId = "#ACCESS_KEY_ID#";
|
|
|
|
accessSecret = "#SECRET_ACCESS_KEY#";
|
|
|
|
ssl = true;
|
|
|
|
bucketName = "matrix-chir-rs";
|
2023-10-01 14:47:26 +00:00
|
|
|
region = "ams1";
|
2022-06-12 15:39:15 +00:00
|
|
|
};
|
|
|
|
}
|
|
|
|
];
|
2022-05-03 09:31:27 +00:00
|
|
|
metrics = {
|
|
|
|
enabled = true;
|
2022-05-03 15:11:04 +00:00
|
|
|
bindAddress = "::";
|
2023-12-10 20:27:33 +00:00
|
|
|
port = 20855;
|
2022-05-03 09:31:27 +00:00
|
|
|
};
|
2022-05-27 14:27:16 +00:00
|
|
|
urlPreviews = {
|
|
|
|
enabled = true;
|
|
|
|
numWorkers = 10;
|
2023-12-11 10:33:45 +00:00
|
|
|
oEmbed = false;
|
2022-08-20 13:18:18 +00:00
|
|
|
allowedNetworks = [
|
|
|
|
"0.0.0.0/0"
|
|
|
|
"::/0"
|
|
|
|
];
|
2022-05-27 14:27:16 +00:00
|
|
|
disallowedNetworks = [
|
|
|
|
"127.0.0.1/8"
|
|
|
|
"10.0.0.0/8"
|
|
|
|
"172.16.0.0/12"
|
|
|
|
"192.168.0.0/16"
|
|
|
|
"::1/128"
|
|
|
|
"fe80::/64"
|
|
|
|
"fc00::/7"
|
|
|
|
];
|
2023-11-17 15:35:23 +00:00
|
|
|
# user agent header was a mistake
|
2023-11-18 09:53:21 +00:00
|
|
|
userAgent = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Edg/119.0.0.0, matrix-media-repo (like twitterbot; like telegrambot; like discordbot; like facebook; like whatsapp; like firefox/92; like vkshare) +https://github.com/DarkKirb/nixos-config/pull/264";
|
2022-05-27 14:27:16 +00:00
|
|
|
};
|
2022-05-27 17:56:39 +00:00
|
|
|
downloads = {
|
|
|
|
expireAfterDays = 7;
|
|
|
|
};
|
2022-05-28 07:38:51 +00:00
|
|
|
featureSupport = {
|
2023-09-15 12:58:12 +00:00
|
|
|
};
|
2024-06-09 11:18:09 +00:00
|
|
|
rateLimit.enabled = false;
|
2022-08-25 15:44:57 +00:00
|
|
|
thumbnails = {
|
|
|
|
maxSourceBytes = 0;
|
|
|
|
maxPixels = 102000000;
|
|
|
|
types = [
|
|
|
|
"image/jpeg"
|
|
|
|
"image/jpg"
|
|
|
|
"image/png"
|
|
|
|
"image/apng"
|
|
|
|
"image/gif"
|
|
|
|
"image/heif"
|
|
|
|
"image/webp"
|
|
|
|
"image/svg+xml"
|
2022-08-26 09:47:45 +00:00
|
|
|
"image/jxl"
|
2022-08-25 15:44:57 +00:00
|
|
|
"audio/mpeg"
|
|
|
|
"audio/ogg"
|
|
|
|
"audio/wav"
|
|
|
|
"audio/flac"
|
|
|
|
"video/mp4"
|
|
|
|
"video/webm"
|
|
|
|
"video/x-matroska"
|
|
|
|
"video/quicktime"
|
|
|
|
];
|
|
|
|
};
|
2022-04-29 16:34:08 +00:00
|
|
|
});
|
2022-06-12 15:39:15 +00:00
|
|
|
in {
|
2022-04-29 16:34:08 +00:00
|
|
|
systemd.services.matrix-media-repo = {
|
|
|
|
description = "Matrix Media Repo";
|
2022-06-12 15:39:15 +00:00
|
|
|
after = ["network.target"];
|
|
|
|
wantedBy = ["multi-user.target"];
|
2022-08-25 15:44:57 +00:00
|
|
|
path = [matrix-media-repo pkgs.ffmpeg pkgs.imagemagick];
|
2022-04-29 16:34:08 +00:00
|
|
|
preStart = ''
|
|
|
|
akid=$(cat ${config.sops.secrets."services/matrix-media-repo/access-key-id".path})
|
2022-04-30 08:15:58 +00:00
|
|
|
sak=$(cat ${config.sops.secrets."services/matrix-media-repo/secret-access-key".path})
|
2022-04-29 16:42:18 +00:00
|
|
|
cat ${config-yml} > /var/lib/matrix-media-repo/config.yml
|
2022-04-29 16:46:43 +00:00
|
|
|
sed -i "s|#ACCESS_KEY_ID#|$akid|g" /var/lib/matrix-media-repo/config.yml
|
|
|
|
sed -i "s|#SECRET_ACCESS_KEY#|$sak|g" /var/lib/matrix-media-repo/config.yml
|
2022-04-29 16:34:08 +00:00
|
|
|
'';
|
|
|
|
serviceConfig = {
|
|
|
|
Type = "simple";
|
|
|
|
User = "matrix-media-repo";
|
|
|
|
Group = "matrix-media-repo";
|
|
|
|
Restart = "always";
|
|
|
|
ExecStart = "${matrix-media-repo}/bin/media_repo -config /var/lib/matrix-media-repo/config.yml";
|
|
|
|
};
|
|
|
|
};
|
|
|
|
sops.secrets."services/matrix-media-repo/access-key-id".owner = "matrix-media-repo";
|
|
|
|
sops.secrets."services/matrix-media-repo/secret-access-key".owner = "matrix-media-repo";
|
2024-09-25 14:04:39 +00:00
|
|
|
sops.secrets."services/matrix-media-repo/signing.key".owner = "matrix-media-repo";
|
2022-04-29 16:34:08 +00:00
|
|
|
users.users.matrix-media-repo = {
|
|
|
|
description = "Matrix Media Repository";
|
|
|
|
home = "/var/lib/matrix-media-repo";
|
|
|
|
useDefaultShell = true;
|
|
|
|
group = "matrix-media-repo";
|
|
|
|
isSystemUser = true;
|
|
|
|
};
|
2022-06-12 15:39:15 +00:00
|
|
|
users.groups.matrix-media-repo = {};
|
2022-04-29 16:34:08 +00:00
|
|
|
systemd.tmpfiles.rules = [
|
|
|
|
"d '/var/lib/matrix-media-repo' 0750 matrix-media-repo matrix-media-repo - -"
|
|
|
|
];
|
2022-04-29 20:00:21 +00:00
|
|
|
services.postgresql.ensureDatabases = [
|
2022-04-29 20:02:32 +00:00
|
|
|
"matrix_media_repo"
|
2022-04-29 20:00:21 +00:00
|
|
|
];
|
2022-08-26 15:28:14 +00:00
|
|
|
services.caddy.virtualHosts."matrix.chir.rs" = {
|
|
|
|
useACMEHost = "chir.rs";
|
2022-12-30 13:03:57 +00:00
|
|
|
logFormat = pkgs.lib.mkForce "";
|
2022-08-26 15:28:14 +00:00
|
|
|
extraConfig = ''
|
|
|
|
import baseConfig
|
2023-06-11 19:18:38 +00:00
|
|
|
route {
|
|
|
|
handle /_matrix/media/* {
|
|
|
|
uri * replace /unstable/fi.mau.msc2246/ /v1/
|
|
|
|
reverse_proxy http://localhost:8008 {
|
|
|
|
header_down Access-Control-Allow-Origin *
|
|
|
|
header_down Access-Control-Allow-Headers *
|
2024-10-01 20:11:40 +00:00
|
|
|
header_up Host chir.rs
|
|
|
|
header_up X-Forwarded-Host chir.rs
|
2023-06-11 19:18:38 +00:00
|
|
|
}
|
2022-08-26 15:28:14 +00:00
|
|
|
}
|
|
|
|
|
2023-06-11 19:18:38 +00:00
|
|
|
handle /_matrix/client/v3/logout/* {
|
2024-10-01 20:11:40 +00:00
|
|
|
reverse_proxy {
|
|
|
|
to http://localhost:8008
|
|
|
|
header_up Host chir.rs
|
|
|
|
header_up X-Forwarded-Host chir.rs
|
|
|
|
}
|
2023-06-11 19:18:38 +00:00
|
|
|
}
|
2022-08-26 15:28:14 +00:00
|
|
|
|
2024-07-24 10:07:33 +00:00
|
|
|
handle /_matrix/client/v1/media/* {
|
2024-10-01 20:11:40 +00:00
|
|
|
reverse_proxy {
|
|
|
|
to http://localhost:8008
|
|
|
|
header_up Host chir.rs
|
|
|
|
header_up X-Forwarded-Host chir.rs
|
|
|
|
}
|
2024-07-24 10:07:33 +00:00
|
|
|
}
|
2024-07-25 18:12:15 +00:00
|
|
|
|
2024-07-24 10:07:33 +00:00
|
|
|
handle /_matrix/federation/v1/media/* {
|
2024-10-01 20:11:40 +00:00
|
|
|
reverse_proxy {
|
|
|
|
to http://localhost:8008
|
|
|
|
header_up Host chir.rs
|
|
|
|
header_up X-Forwarded-Host chir.rs
|
|
|
|
}
|
2024-07-24 10:07:33 +00:00
|
|
|
}
|
|
|
|
|
2023-06-11 19:18:38 +00:00
|
|
|
handle /_matrix/* {
|
|
|
|
reverse_proxy {
|
|
|
|
to https://matrix.int.chir.rs
|
|
|
|
header_up Host {upstream_hostport}
|
2022-08-26 15:28:14 +00:00
|
|
|
|
2023-06-11 19:18:38 +00:00
|
|
|
transport http {
|
2024-06-05 18:38:34 +00:00
|
|
|
versions 1.1
|
2023-06-11 19:18:38 +00:00
|
|
|
}
|
2022-08-26 15:28:14 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2023-06-11 19:18:38 +00:00
|
|
|
handle /.well-known/matrix/server {
|
|
|
|
header Access-Control-Allow-Origin *
|
|
|
|
header Content-Type application/json
|
|
|
|
respond "{ \"m.server\": \"matrix.chir.rs:443\" }" 200
|
|
|
|
}
|
2022-08-26 15:28:14 +00:00
|
|
|
|
2023-06-11 19:18:38 +00:00
|
|
|
handle /.well-known/matrix/client {
|
|
|
|
header Access-Control-Allow-Origin *
|
|
|
|
header Content-Type application/json
|
2024-09-26 12:01:05 +00:00
|
|
|
respond "{ \"m.homeserver\": { \"base_url\": \"https://matrix.chir.rs\" } }" 200
|
2023-06-11 19:18:38 +00:00
|
|
|
}
|
2022-08-26 15:28:14 +00:00
|
|
|
}
|
|
|
|
'';
|
2022-04-29 20:35:33 +00:00
|
|
|
};
|
2022-04-29 16:34:08 +00:00
|
|
|
}
|