Move server to persistence, still have stuff to fix

modules/system/services/server/socialserver/default.nix

@@ -0,0 +1,13 @@
+{ lib, ... }:
+{
+  options.system.socialserver.enable = lib.mkOption {
+    type = lib.types.bool;
+    default = false;
+  };
+
+  imports = [
+    ./mastodon
+    ./matrix
+    ./owncast
+  ];
+}

modules/system/services/server/socialserver/mastodon/default.nix

@@ -0,0 +1,23 @@
+{ config, lib, pkgs, ... }:
+{
+  config = lib.mkIf config.system.socialserver.enable {
+    services.mastodon = {
+      enable = true;
+      localDomain = "social.${config.domains.p2}";
+      streamingProcesses = 4;
+      configureNginx = true;
+      smtp = {
+        createLocally = false;
+        host = "mx.${config.domains.p1}";
+        port = 587;
+        authenticate = true;
+        fromAddress = "NixFox Mastodon <noreply@${config.domains.p2}>";
+        user = "noreply@${config.domains.p2}";
+        passwordFile = pkgs.writeText "smtp_pass.txt" config.secrets.noreplyPassword;
+      };
+    };
+    environment.persistence."/persist".directories = [
+      "/var/lib/mastodon"
+    ];
+  };
+}

modules/system/services/server/socialserver/matrix/coturn/default.nix

@@ -0,0 +1,43 @@
+{ config, lib, ... }:
+{
+  imports = [ ./nginx ];
+
+  config = lib.mkIf config.services.matrix-synapse.enable {
+    services = {
+      coturn = {
+        enable = true;
+        no-cli = true;
+        no-tcp-relay = true;
+        min-port = 49000;
+        max-port = 50000;
+        use-auth-secret = true;
+        static-auth-secret = config.secrets.coturnSecret;
+        realm = "turn.${config.domains.p1}";
+        cert = "/var/lib/acme/turn.${config.domains.p1}.com/fullchain.pem";
+        pkey = "/var/lib/acme/turn.${config.domains.p1}.com/key.pem";
+      };
+
+      # Enable coturn on Synapse
+      matrix-synapse.settings = {
+        turn_uris = [
+          "turn:turn.${config.domains.p1}:3478?transport=udp"
+          "turn:turn.${config.domains.p1}:3478?transport=tcp"
+        ];
+        turn_shared_secret = config.secrets.coturnSecret;
+        turn_user_lifetime = "1h";
+      };
+    };
+
+    # Open coturn ports
+    networking.firewall = {
+      allowedUDPPorts = [
+        3478
+        5349
+      ];
+      allowedUDPPortRanges = [{
+        from = config.services.coturn.min-port;
+        to = config.services.coturn.max-port;
+      }];
+    };
+  };
+}

modules/system/services/server/socialserver/matrix/coturn/nginx/default.nix

@@ -0,0 +1,22 @@
+{ config, lib, ... }:
+{
+  config = lib.mkIf config.services.coturn.enable {
+    services.nginx.virtualHosts."turn.${config.domains.p1}" = {
+      enableACME = true;
+      forceSSL = true;
+      listen = [{
+        addr = "0.0.0.0";
+        port = 80;
+        ssl = false; 
+      }];
+      locations."/".proxyPass = "http://127.0.0.1:1380";
+    };
+
+    security.acme.certs = {       
+      "turn.${config.domains.p1}" = {
+        group = "turnserver";
+        postRun = "systemctl restart coturn.service";
+      };
+    };
+  };
+}

modules/system/services/server/socialserver/matrix/default.nix

@@ -0,0 +1,8 @@
+{ ... }:
+{
+  imports = [
+    ./coturn
+    ./element
+    ./synapse
+  ];
+}

modules/system/services/server/socialserver/matrix/element/default.nix

@@ -0,0 +1,23 @@
+{ config, lib, ... }:
+{
+  imports = [ ./nginx ];
+
+  config = lib.mkIf config.services.matrix-synapse.enable {
+    nixpkgs.config.element-web.conf = {
+      default_server_config."m.homeserver" = {
+        base_url = "https://matrix.${config.domains.p1}";
+        server_name = "matrix.${config.domains.p1}";
+      };
+      branding = {
+        #welcome_background_url = "https://staging.${config.domains.p1}/images/backgrounds/template-background.png";
+        #auth_header_logo_url = "https://staging.${config.domains.p1}/images/logos/template-logo.png";
+      };
+      embedded_pages = {
+        home_url = "https://www.${config.domains.p1}/";
+      };
+      disable_custom_urls = true;
+      disable_guests = true;
+      default_theme = "dark";
+    };
+  };
+}

modules/system/services/server/socialserver/matrix/element/nginx/default.nix

@@ -0,0 +1,8 @@
+{ pkgs, config, lib, ... }:
+{
+  services.nginx.virtualHosts."chat.${config.domains.p2}" = lib.mkIf config.services.matrix-synapse.enable {
+    enableACME = true;
+    addSSL = true;
+    root = "${pkgs.element-web}";
+  };
+}

modules/system/services/server/socialserver/matrix/synapse/default.nix

@@ -0,0 +1,78 @@
+{ config, lib, pkgs, ... }:
+{
+  imports = [
+    ./nginx
+  ];
+
+  config = lib.mkIf config.system.socialserver.enable {
+    services.matrix-synapse = {
+      enable = true;
+      settings = {
+        server_name = "${config.domains.p1}";
+        public_baseurl = "https://matrix.${config.domains.p1}";
+        suppress_key_server_warning = true;
+
+        listeners = [
+          {
+            port = 8008;
+            bind_addresses = [ "::" "0.0.0.0" ];
+            resources = [{
+              compress = true;
+              names = [
+                "client"
+                "federation"
+              ];
+            }];
+            type = "http";
+            tls = false;
+            x_forwarded = true;
+          }
+        ];
+
+        email = {
+          notif_from = "NixFox Matrix <noreply@${config.domains.p2}>";
+          smtp_host = "mx.${config.domains.p1}";
+          smtp_user = "noreply@${config.domains.p2}";
+          smtp_pass = config.secrets.noreplyPassword;
+          enable_tls = true;
+          smtp_port = 587;
+          require_transport_security = true;
+        };
+
+        # Disable registration without email
+        registrations_require_3pid = [ "email" ];
+
+        # Allow only this range of emails
+        allowed_local_3pids = [
+          {
+            medium = "email";
+            pattern = ''^[^@]+@nixfox\.ca$'';
+          }
+          {
+            medium = "email";
+            pattern = ''^[^@]+@freecorn1854\.win$'';
+          }
+          {
+            medium = "email";
+            pattern = ''^[^@]+@lunamoonlight\.xyz$'';
+          }
+        ];
+
+        # Set the type of database
+        database.name = "sqlite3";
+
+        # Allow account registration
+        enable_registration = true;
+
+        # General settings
+        url_preview_enabled = true;
+        max_upload_size = "50M";
+        report_stats = false;
+        burst_count = 15;
+      };
+    };
+    environment.persistence."/persist".directories = [
+      "/var/lib/matrix-synapse"
+    ];
+  };
+}

modules/system/services/server/socialserver/matrix/synapse/nginx/default.nix

@@ -0,0 +1,13 @@
+{ config, lib, ... }:
+{
+  services.nginx.virtualHosts."matrix.${config.domains.p1}" = lib.mkIf config.services.matrix-synapse.enable {
+    enableACME = true;
+    forceSSL = true;
+    locations = {
+      "/".extraConfig = ''return 403;'';
+      "/client".proxyPass = "http://127.0.0.1:8008";
+      "/_matrix".proxyPass = "http://127.0.0.1:8008";
+      "/_synapse/client".proxyPass = "http://127.0.0.1:8008";
+    };
+  };
+}

modules/system/services/server/socialserver/owncast/default.nix

@@ -0,0 +1,16 @@
+{ config, lib, ... }:
+{
+  imports = [ ./nginx ];
+
+  config = lib.mkIf config.system.socialserver.enable {
+    services.owncast = {
+      enable = true;
+      port = 8060;
+      rtmp-port = 1945;
+      listen = "0.0.0.0";
+    };
+    environment.persistence."/persist".directories = [
+      "/var/lib/owncast"
+    ];
+  };
+}

modules/system/services/server/socialserver/owncast/nginx/default.nix

@@ -0,0 +1,11 @@
+{ config, lib, ... }:
+{
+  services.nginx.virtualHosts."live.${config.domains.p2}" = lib.mkIf config.services.owncast.enable {
+    enableACME = true;
+    forceSSL = true;
+    locations."/" = {
+      proxyPass = "http://127.0.0.1:8060";
+      proxyWebsockets = true;
+    };
+  };
+}