From fd9edd1b2ff2258fbc3822e83266adad8d3ec009 Mon Sep 17 00:00:00 2001
From: Jurn Wubben <jurnwubben@gmail.com>
Date: Sun, 25 May 2025 11:15:53 +0200
Subject: [PATCH] Beginnings of matrix homeserver

---
 secrets/default.nix            |   4 +--
 secrets/matrix-priv.age        |  12 +++++++
 secrets/secrets.nix            |   4 +--
 secrets/temp.pem               | Bin 0 -> 4096 bytes
 secrets/wg-lapserv-private.age | Bin 587 -> 0 bytes
 secrets/wg-laptop-private.age  | Bin 587 -> 0 bytes
 system/server/default.nix      |   2 +-
 system/server/matrix.nix       |  64 +++++++++++++++++++++++++++++++++
 8 files changed, 79 insertions(+), 7 deletions(-)
 create mode 100644 secrets/matrix-priv.age
 create mode 100644 secrets/temp.pem
 delete mode 100644 secrets/wg-lapserv-private.age
 delete mode 100644 secrets/wg-laptop-private.age
 create mode 100644 system/server/matrix.nix

diff --git a/secrets/default.nix b/secrets/default.nix
index 4d2c03e..396c462 100644
--- a/secrets/default.nix
+++ b/secrets/default.nix
@@ -12,8 +12,6 @@
         else "root";
     };
     password.file = ./password.age;
-
-    wg-lapserv-private.file = ./wg-lapserv-private.age;
-    wg-laptop-private.file = ./wg-laptop-private.age;
+    matrix-priv.file = ./matrix-priv.age;
   };
 }
diff --git a/secrets/matrix-priv.age b/secrets/matrix-priv.age
new file mode 100644
index 0000000..f00af47
--- /dev/null
+++ b/secrets/matrix-priv.age
@@ -0,0 +1,12 @@
+age-encryption.org/v1
+-> ssh-ed25519 WCPLrA c0IvTG3SCwKVkf++spIkThhWEs5UhEmj56DPHY9XDEg
+24vOMtcZiN7y89TwMHkM8ybvqHeVzgoIRuvfujMDoC4
+-> ssh-ed25519 7/ziYw mNTwfuRS/r+bM4bYjFxtNE3yzAD5lLE0DAfgovpGulw
+bTm2Kni2fVWNgPGfTFUl2qbraEJbfoYGffWuw2ythb4
+-> ssh-ed25519 GQzYWA ygE1KP4bnhBw4OJW1zUm2ISo/pCfvrfM6kqezd5WsA8
+0Ta0C7nPks6XTjBFgNSQRFr3IBKlSqDDEAReZeJNW9g
+-> ssh-ed25519 MfR7VA qEA4XrMSGp2Mci90tLAGa1qX8miW7sgFX9D7V4paWkc
+T3fqqBOutnRoL+vmpsXbYhvFi5+8aZdYyrJA+Es39+Q
+--- XtEQSLuJwyqoc6ois17xk29vOh1eWfeJsbApBiI+5ww
+DY<JíbÄ4÷Ql.P9|x �©)Ô
‹PÚ÷¨´�‹Ø¹ä©g!ÚÒU€[Á#„U@í?¶–¨bm•
i°¿ô+eõ<×¼0t5@	É4ï,ªíOšbU`ÏfÅ…‹ClÑštøˆÊb%ŒùQìk	NÞ-2¯~/tKQN‰*q�!öÖŠï
+¼	cIMVïeæøOˆkïþöׂ<¡°¦!
\ No newline at end of file
diff --git a/secrets/secrets.nix b/secrets/secrets.nix
index d6e3f64..0cee580 100644
--- a/secrets/secrets.nix
+++ b/secrets/secrets.nix
@@ -10,7 +10,5 @@ in {
   "transfer-sh.age".publicKeys = systems;
   "password.age".publicKeys = systems;
   "dcbot.age".publicKeys = systems;
-
-  "wg-lapserv-private.age".publicKeys = systems;
-  "wg-laptop-private.age".publicKeys = systems;
+  "matrix-priv.age".publicKeys = systems;
 }
diff --git a/secrets/temp.pem b/secrets/temp.pem
new file mode 100644
index 0000000000000000000000000000000000000000..08e7df176454f3ee5eeda13efa0adaa54828dfd8
GIT binary patch
literal 4096
vcmZP=1*0J_8UmvsFd71*Aut*OqaiRF0;3@?8UmvsFd71*Aut*O!#)H65C8xH

literal 0
HcmV?d00001

diff --git a/secrets/wg-lapserv-private.age b/secrets/wg-lapserv-private.age
deleted file mode 100644
index 87e2b61bcf2410515e264585579c94dabe09c8a7..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 587
zcmYdHPt{G$OD?J`D9Oyv)5|YP*Do{V(zR14F3!+RO))YxHMCR+cMk9=a#To*%<wGt
zEqAU+^fL7IC@Cy=EKE$y3JEJtPxL5HEi=k6b}fo@D=ct!%I5M84=wU3@T^G6$O=yj
za4s(LPK!+S$q7z0(9g;?b*YR<3DK?$s&oprbVaw#T)!$avRuKxBp|TT-$*|sE61qJ
z$FkTxIN#qd$}1zMq{KDcA|<dWB{M52-ykx@*nmqv(>O0o-z(fTD!Z^a)iB#DF~u?|
zz^m9dIM}Gf*U=->Fu>BlqSU$6G#TAC_rR*ia7P8_j7n!eU+>67UlU`K3SWzI*KqAn
zODA_X&tQw<6z^d7;KE9MBW*K3mwc{Vm&*L?Y^S2!;0z0w?8?eYV;9%ZKx5;~G?U6=
zZ|6`GpQzCMG9$BKb6<4ZeA9x=!yFZ|OZ}s&w99kSGjn|+lPdg8-L%U>O7k*Ia*|xL
z{Ikj;jEXb7(hIW#3>>+fEpq%*3@p;h{mjcOESw^plfv91vI<;60`om1ybUu;yu8yg
zETdeF{PVeVb#)c80@F=$OUztT+<mK(ErP;4-26=aU46?8jf)(OLo*%yJ<KbsQp-*B
z6HU1K@9&xx@%Z9$hKJf}FOIvU?%vZPW9R#IadNg+!<mn-;vXKUay^$_<)p>$^?low
la<*^pzsJA4?3AScFsW<fe37V(E~cd8_KRaVB#$<(1^^C$%H03}

diff --git a/secrets/wg-laptop-private.age b/secrets/wg-laptop-private.age
deleted file mode 100644
index a9bd3b02805d210be3b2ba9d4591c812bddbf692..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 587
zcmYdHPt{G$OD?J`D9Oyv)5|YP*Do{V(zR14F3!+RO))YxHMCR+cMk9=a#RSa3UIDS
zaV~RmGV;nW%SbFR&Ma{WG7d;hHSsF<PSX#t^iK~CEY1oI%;s_qNvsO?PYMZlG7m^E
zFUoOB3v>^)^i1(J%*-s$ib`@aHK~g5E^_ut^hCGKT)!$avRonCC$HQv+)3ZVz$+uq
zQQs*oNZ-`LO+P=~$luerNIy(JJK4zJquks$G@r{W$2rnC!`CI$IVIFHt2C!FHPOX0
zqol;8s?@VIttcQo%q^tI+b6Xms~Fuj_rR*ia7P8dbdU5Xw=|F7%na8u=c0@XGxxMq
z?Luu!Lw$n~lccCDiwu|2knD_*YzwYJ&!S4dJTIg0fP!4}^fDtqM~h?&Q<sR+$PmXg
zmvmzzbD!YUkf=iQU<})Q(}K*y92FwUlgu3hjdL>-je{&heab9?%+1X*EDg#6(mg#=
zl6<^UOP#Z_gDstc1G&=5(_M|CBE$2H@^ih)O7;CR(gQsV3k~uuf-8(&jI%<Dy^V6i
z@*RC#O}KP*brs6|Ontl~gNwY9b5pWH61_4!eM|iOv@^mB3$xS0vwd7sLrXjZs~iK;
zJ-LFV^QZDMY}!;<IWI{<X#EVcE3(U1)aLD;n71mRz*y+<i%PpGZC%xo#pxF-m}7nG
jw*PrLJMO;F_ZIIMv$LnyWR~lG`5Vf&Gc@e2pv+SM*73&W

diff --git a/system/server/default.nix b/system/server/default.nix
index fff9e3d..618dcee 100644
--- a/system/server/default.nix
+++ b/system/server/default.nix
@@ -1,4 +1,4 @@
 {lib, ...}: {
-  imports = [./caddy.nix ./transfer-sh.nix ./seafile.nix ./bot.nix ./immich.nix];
+  imports = [./caddy.nix ./transfer-sh.nix ./seafile.nix ./bot.nix ./immich.nix ./matrix.nix];
   options.niksos.server = lib.mkEnableOption "server servcies (such as caddy)."; #TODO: per service option.
 }
diff --git a/system/server/matrix.nix b/system/server/matrix.nix
new file mode 100644
index 0000000..620cf18
--- /dev/null
+++ b/system/server/matrix.nix
@@ -0,0 +1,64 @@
+{
+  config,
+  lib,
+  ...
+}: let
+  database = {
+    connection_string = "postgres:///dendrite?host=/run/postgresql";
+    max_open_conns = 97;
+    max_idle_conns = 5;
+    conn_max_lifetime = -1;
+  };
+in {
+  config = lib.mkIf config.niksos.server {
+    services = {
+      dendrite = {
+        enable = true;
+        httpPort = 9003;
+        settings = {
+          global = {
+            server_name = "matrix.jsw.tf";
+            private_key = "/$CREDENTIALS_DIRECTORY/matrix-server-key"; #nix shell nixpkgs#dendrite; generate-keys --private-key matrix_key.pem
+          };
+
+          global.database = database;
+          app_service_api.database = database;
+          federation_api.database = database;
+          key_server.database = database;
+          media_api.database = database;
+          mscs.database = database;
+          relay_api.database = database;
+          room_server.database = database;
+          sync_api.database = database;
+          user_api.account_database.database = database;
+          user_api.device_database.database = database;
+          sync_api.search.enabled = true;
+        };
+      };
+
+      postgresql = {
+        enable = true;
+        enableTCPIP = false;
+        ensureDatabases = ["dendrite"];
+        ensureUsers = [
+          {
+            name = "dendrite";
+            ensureDBOwnership = true;
+          }
+        ];
+      };
+
+      caddy.virtualHosts."matrix.jsw.tf".extraConfig = ''
+        reverse_proxy /_matrix/* localhost:9003
+      '';
+    };
+
+    systemd.services.dendrite = {
+      serviceConfig.LoadCredential = [
+        # $ nix-shell -p dendrite --run 'generate-keys --private-key /tmp/key'
+        "matrix-server-key:${config.age.secrets.matrix-priv.path}"
+      ];
+      after = ["postgresql.service"];
+    };
+  };
+}