nixos-config/config/services/matrix-media-repo.nix

201 lines
5.9 KiB
Nix
Raw Normal View History

2022-06-12 15:39:15 +00:00
{
system,
config,
pkgs,
lib,
...
}: let
2023-06-13 05:46:23 +00:00
inherit (pkgs) matrix-media-repo;
2022-06-12 15:39:15 +00:00
config-yml = pkgs.writeText "matrix-media-repo.yaml" (lib.generators.toYAML {} {
2022-04-29 16:34:08 +00:00
repo = {
bindAddress = "127.0.0.1";
port = 8008;
2022-05-27 17:58:46 +00:00
logDirectory = "-";
2022-04-29 16:34:08 +00:00
};
2022-04-29 20:11:01 +00:00
database.postgres = "postgresql:///matrix_media_repo?sslmode=disable&host=/run/postgresql";
2022-06-12 15:39:15 +00:00
homeservers = [
{
2024-10-01 20:11:40 +00:00
name = "chir.rs";
2022-08-26 06:30:59 +00:00
csApi = "https://matrix.chir.rs";
2024-09-25 14:04:39 +00:00
signingKeyPath = config.sops.secrets."services/matrix-media-repo/signing.key".path;
2022-08-26 06:30:59 +00:00
}
2022-06-12 15:39:15 +00:00
];
2023-09-15 12:58:12 +00:00
accessTokens.maxCacheTimeSeconds = 43200;
2022-06-12 15:39:15 +00:00
admins = ["@lotte:chir.rs"];
datastores = [
{
type = "s3";
2023-05-23 04:55:27 +00:00
id = "b003babbb86fecf56bb9ba6571f9adb0bd1e71c8";
2022-06-12 15:39:15 +00:00
enabled = true;
forKinds = ["all"];
opts = {
2023-09-15 12:58:12 +00:00
tempPath = "/var/lib/matrix-media-repo";
2023-10-01 14:47:26 +00:00
endpoint = "ams1.vultrobjects.com";
2022-06-12 15:39:15 +00:00
accessKeyId = "#ACCESS_KEY_ID#";
accessSecret = "#SECRET_ACCESS_KEY#";
ssl = true;
bucketName = "matrix-chir-rs";
2023-10-01 14:47:26 +00:00
region = "ams1";
2022-06-12 15:39:15 +00:00
};
}
];
2022-05-03 09:31:27 +00:00
metrics = {
enabled = true;
bindAddress = "::";
2023-12-10 20:27:33 +00:00
port = 20855;
2022-05-03 09:31:27 +00:00
};
2022-05-27 14:27:16 +00:00
urlPreviews = {
enabled = true;
numWorkers = 10;
2023-12-11 10:33:45 +00:00
oEmbed = false;
2022-08-20 13:18:18 +00:00
allowedNetworks = [
"0.0.0.0/0"
"::/0"
];
2022-05-27 14:27:16 +00:00
disallowedNetworks = [
"127.0.0.1/8"
"10.0.0.0/8"
"172.16.0.0/12"
"192.168.0.0/16"
"::1/128"
"fe80::/64"
"fc00::/7"
];
# user agent header was a mistake
2023-11-18 09:53:21 +00:00
userAgent = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Edg/119.0.0.0, matrix-media-repo (like twitterbot; like telegrambot; like discordbot; like facebook; like whatsapp; like firefox/92; like vkshare) +https://github.com/DarkKirb/nixos-config/pull/264";
2022-05-27 14:27:16 +00:00
};
downloads = {
expireAfterDays = 7;
};
2022-05-28 07:38:51 +00:00
featureSupport = {
2023-09-15 12:58:12 +00:00
};
2024-06-09 11:18:09 +00:00
rateLimit.enabled = false;
2022-08-25 15:44:57 +00:00
thumbnails = {
maxSourceBytes = 0;
maxPixels = 102000000;
types = [
"image/jpeg"
"image/jpg"
"image/png"
"image/apng"
"image/gif"
"image/heif"
"image/webp"
"image/svg+xml"
2022-08-26 09:47:45 +00:00
"image/jxl"
2022-08-25 15:44:57 +00:00
"audio/mpeg"
"audio/ogg"
"audio/wav"
"audio/flac"
"video/mp4"
"video/webm"
"video/x-matroska"
"video/quicktime"
];
};
2022-04-29 16:34:08 +00:00
});
2022-06-12 15:39:15 +00:00
in {
2022-04-29 16:34:08 +00:00
systemd.services.matrix-media-repo = {
description = "Matrix Media Repo";
2022-06-12 15:39:15 +00:00
after = ["network.target"];
wantedBy = ["multi-user.target"];
2022-08-25 15:44:57 +00:00
path = [matrix-media-repo pkgs.ffmpeg pkgs.imagemagick];
2022-04-29 16:34:08 +00:00
preStart = ''
akid=$(cat ${config.sops.secrets."services/matrix-media-repo/access-key-id".path})
2022-04-30 08:15:58 +00:00
sak=$(cat ${config.sops.secrets."services/matrix-media-repo/secret-access-key".path})
2022-04-29 16:42:18 +00:00
cat ${config-yml} > /var/lib/matrix-media-repo/config.yml
2022-04-29 16:46:43 +00:00
sed -i "s|#ACCESS_KEY_ID#|$akid|g" /var/lib/matrix-media-repo/config.yml
sed -i "s|#SECRET_ACCESS_KEY#|$sak|g" /var/lib/matrix-media-repo/config.yml
2022-04-29 16:34:08 +00:00
'';
serviceConfig = {
Type = "simple";
User = "matrix-media-repo";
Group = "matrix-media-repo";
Restart = "always";
ExecStart = "${matrix-media-repo}/bin/media_repo -config /var/lib/matrix-media-repo/config.yml";
};
};
sops.secrets."services/matrix-media-repo/access-key-id".owner = "matrix-media-repo";
sops.secrets."services/matrix-media-repo/secret-access-key".owner = "matrix-media-repo";
2024-09-25 14:04:39 +00:00
sops.secrets."services/matrix-media-repo/signing.key".owner = "matrix-media-repo";
2022-04-29 16:34:08 +00:00
users.users.matrix-media-repo = {
description = "Matrix Media Repository";
home = "/var/lib/matrix-media-repo";
useDefaultShell = true;
group = "matrix-media-repo";
isSystemUser = true;
};
2022-06-12 15:39:15 +00:00
users.groups.matrix-media-repo = {};
2022-04-29 16:34:08 +00:00
systemd.tmpfiles.rules = [
"d '/var/lib/matrix-media-repo' 0750 matrix-media-repo matrix-media-repo - -"
];
2022-04-29 20:00:21 +00:00
services.postgresql.ensureDatabases = [
"matrix_media_repo"
2022-04-29 20:00:21 +00:00
];
2022-08-26 15:28:14 +00:00
services.caddy.virtualHosts."matrix.chir.rs" = {
useACMEHost = "chir.rs";
2022-12-30 13:03:57 +00:00
logFormat = pkgs.lib.mkForce "";
2022-08-26 15:28:14 +00:00
extraConfig = ''
import baseConfig
2023-06-11 19:18:38 +00:00
route {
handle /_matrix/media/* {
uri * replace /unstable/fi.mau.msc2246/ /v1/
reverse_proxy http://localhost:8008 {
header_down Access-Control-Allow-Origin *
header_down Access-Control-Allow-Headers *
2024-10-01 20:11:40 +00:00
header_up Host chir.rs
header_up X-Forwarded-Host chir.rs
2023-06-11 19:18:38 +00:00
}
2022-08-26 15:28:14 +00:00
}
2023-06-11 19:18:38 +00:00
handle /_matrix/client/v3/logout/* {
2024-10-01 20:11:40 +00:00
reverse_proxy {
to http://localhost:8008
header_up Host chir.rs
header_up X-Forwarded-Host chir.rs
}
2023-06-11 19:18:38 +00:00
}
2022-08-26 15:28:14 +00:00
2024-07-24 10:07:33 +00:00
handle /_matrix/client/v1/media/* {
2024-10-01 20:11:40 +00:00
reverse_proxy {
to http://localhost:8008
header_up Host chir.rs
header_up X-Forwarded-Host chir.rs
}
2024-07-24 10:07:33 +00:00
}
2024-07-25 18:12:15 +00:00
2024-07-24 10:07:33 +00:00
handle /_matrix/federation/v1/media/* {
2024-10-01 20:11:40 +00:00
reverse_proxy {
to http://localhost:8008
header_up Host chir.rs
header_up X-Forwarded-Host chir.rs
}
2024-07-24 10:07:33 +00:00
}
2023-06-11 19:18:38 +00:00
handle /_matrix/* {
reverse_proxy {
to https://matrix.int.chir.rs
header_up Host {upstream_hostport}
2022-08-26 15:28:14 +00:00
2023-06-11 19:18:38 +00:00
transport http {
2024-06-05 18:38:34 +00:00
versions 1.1
2023-06-11 19:18:38 +00:00
}
2022-08-26 15:28:14 +00:00
}
}
2023-06-11 19:18:38 +00:00
handle /.well-known/matrix/server {
header Access-Control-Allow-Origin *
header Content-Type application/json
respond "{ \"m.server\": \"matrix.chir.rs:443\" }" 200
}
2022-08-26 15:28:14 +00:00
2023-06-11 19:18:38 +00:00
handle /.well-known/matrix/client {
header Access-Control-Allow-Origin *
header Content-Type application/json
2024-09-26 12:01:05 +00:00
respond "{ \"m.homeserver\": { \"base_url\": \"https://matrix.chir.rs\" } }" 200
2023-06-11 19:18:38 +00:00
}
2022-08-26 15:28:14 +00:00
}
'';
2022-04-29 20:35:33 +00:00
};
2022-04-29 16:34:08 +00:00
}