services/conduwuit.nix


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70

{ config, pkgs, auxiliaryPkgs, ... }:

let
  inherit (pkgs) conduwuit dockerTools;
  inherit (auxiliaryPkgs) common;

  conduwuitLocalPort = 2123;
  conduwuitDir = "/srv/conduwuit";

  conduwuitImage = dockerTools.streamLayeredImage {
    name = "conduwuit";
    tag = conduwuit.version;
    fromImage = common.alpine.base;

    contents = [ conduwuit ];
  };

in
{
  age.secrets.conduwuit-registration-token = {
    file = ../secrets/conduwuit-registration-token.age;
  };

  foundation.service.conduwuit = {
    conduwuit = {
      image = conduwuitImage;
      ports = [ conduwuitLocalPort ];

      volumes = [
        [ "${conduwuitDir}/db" "/var/lib/conduwuit" ]
        [ "${conduwuitDir}/conduwuit.toml" "/etc/conduwuit/conduwuit.toml" ]
        [
          "${config.age.secrets.conduwuit-registration-token.path}"
          "/etc/conduwuit/registration-itoken"
        ]
      ];

      environment = {
        CONDUWUIT_CONFIG = "/etc/conduwuit/conduwuit.toml";
      };

      entrypoint = "${conduwuit}/bin/conduit";
    };
  };

  services.nginx.virtualHosts = {
    "matrix.rnrd.eu" = let
      proxySettings = { proxyPass = "http://127.0.0.1:${toString conduwuitLocalPort}"; };
    in
    {
      useACMEHost = "rnrd.eu";
      forceSSL = true;

      locations."/" = proxySettings;
      locations."/_matrix" = proxySettings;
      locations."/_conduwuit" = proxySettings;

      extraConfig = ''
        client_max_body_size 20M;

        proxy_connect_timeout 600;
        proxy_send_timeout 600;
        proxy_read_timeout 600;
        send_timeout 600;

        access_log /var/log/nginx/conduwuit.access.log json_combined;
      '';
    };
  };
}