synapse 支持多实例

This commit is contained in:
陈浩南 2023-12-17 19:44:40 +08:00
parent 9801e53230
commit 1769069057
4 changed files with 202 additions and 96 deletions

View File

@ -324,7 +324,7 @@
misskey.hostname = "xn--s8w913fdga.chn.moe";
misskey-old = { port = 9727; redis.port = 3546; meilisearch.enable = false; };
};
synapse.enable = true;
synapse.instances.synapse.matrixHostname = "synapse.chn.moe";
xrdp = { enable = true; hostname = [ "vps7.chn.moe" ]; };
vaultwarden.enable = true;
beesd = { enable = true; instances.root = { device = "/"; hashTableSizeMB = 1024; }; };

View File

@ -1,111 +1,215 @@
# port from nixpkgs#70dc536a
inputs:
{
options.nixos.services.synapse = let inherit (inputs.lib) mkOption types; in
options.nixos.services.synapse.instances = let inherit (inputs.lib) mkOption types; in mkOption
{
enable = mkOption { type = types.bool; default = false; };
autoStart = mkOption { type = types.bool; default = true; };
port = mkOption { type = types.ints.unsigned; default = 8008; };
hostname = mkOption { type = types.nonEmptyStr; default = "synapse.chn.moe"; };
type = types.attrsOf (types.submodule { options =
{
autoStart = mkOption { type = types.bool; default = true; };
port = mkOption { type = types.ints.unsigned; default = 8008; };
hostname = mkOption { type = types.nonEmptyStr; default = "synapse.chn.moe"; };
matrixHostname = mkOption { type = types.nonEmptyStr; default = "chn.moe"; };
};});
default = {};
};
config =
let
inherit (inputs.config.nixos.services) synapse;
inherit (inputs.lib) mkIf;
inherit (builtins) map listToAttrs;
in mkIf synapse.enable
inherit (inputs.lib) mkIf mkMerge;
inherit (builtins) map listToAttrs replaceStrings;
inherit (inputs.localLib) attrsToList;
in
{
services.matrix-synapse =
{
enable = true;
settings =
users = mkMerge (map
(instance:
{
server_name = synapse.hostname;
listeners =
[{
bind_addresses = [ "0.0.0.0" ];
port = 8008;
resources = [{ names = [ "client" "federation" ]; compress = false; }];
tls = false;
type = "http";
x_forwarded = true;
}];
database.name = "psycopg2";
admin_contact = "mailto:chn@chn.moe";
enable_registration = true;
registrations_require_3pid = [ "email" ];
turn_uris = [ "turns:coturn.chn.moe" "turn:coturn.chn.moe" ];
max_upload_size = "1024M";
web_client_location = "https://element.chn.moe/";
serve_server_wellknown = true;
report_stats = true;
trusted_key_servers = [{ server_name = "matrix.org"; }];
suppress_key_server_warning = true;
log_config = (inputs.pkgs.formats.yaml {}).generate "log.yaml"
users."synapse-${instance.name}" =
{
version = 1;
formatters.precise.format =
"%(asctime)s - %(name)s - %(lineno)d - %(levelname)s - %(request)s - %(message)s";
handlers.console = { class = "logging.StreamHandler"; formatter = "precise"; };
root = { level = "INFO"; handlers = [ "console" ]; };
disable_existing_loggers = true;
uid = inputs.config.nixos.system.user.user."synapse-${instance.name}";
group = "synapse-${instance.name}";
home = "/var/lib/synapse/${instance.name}";
createHome = true;
isSystemUser = true;
shell = "${inputs.pkgs.bash}/bin/bash";
};
};
extraConfigFiles = [ inputs.config.sops.templates."synapse/password.yaml".path ];
};
sops =
{
templates."synapse/password.yaml" =
groups."synapse-${instance.name}".gid = inputs.config.nixos.system.user.group."synapse-${instance.name}";
})
(attrsToList synapse.instances));
systemd = mkMerge (map
(instance: let workdir = "/var/lib/synapse/${instance.name}"; in
{
owner = inputs.config.systemd.services.matrix-synapse.serviceConfig.User;
group = inputs.config.systemd.services.matrix-synapse.serviceConfig.Group;
content = builtins.readFile ((inputs.pkgs.formats.yaml {}).generate "password.yaml"
{
database =
services."synapse-${instance.name}" =
let
package = inputs.pkgs.matrix-synapse.override { extras = [ "url-preview" "postgres" ]; plugins = []; };
config = inputs.config.sops.templates."synapse/${instance.name}.yaml".path;
homeserver = "${package}/bin/synapse_homeserver";
in
{
name = "psycopg2";
args =
description = "synapse-${instance.name}";
enable = instance.value.autoStart;
after = [ "network-online.target" "postgresql.service" ];
requires = [ "postgresql.service" ];
wantedBy = [ "multi-user.target" ];
serviceConfig =
{
user = "synapse";
password = inputs.config.sops.placeholder."postgresql/synapse";
database = "synapse";
host = "127.0.0.1";
port = "5432";
ExecStart = "${homeserver} --config-path ${config} --keys-directory ${workdir}";
Type = "notify";
User = "synapse-${instance.name}";
Group = "synapse-${instance.name}";
WorkingDirectory = workdir;
ExecReload = "${inputs.pkgs.util-linux}/bin/kill -HUP $MAINPID";
Restart = "on-failure";
UMask = "0077";
CapabilityBoundingSet = [ "" ];
# hardening
LockPersonality = true;
NoNewPrivileges = true;
PrivateDevices = true;
PrivateTmp = true;
PrivateUsers = true;
ProcSubset = "pid";
ProtectClock = true;
ProtectControlGroups = true;
ProtectHome = true;
ProtectHostname = true;
ProtectKernelLogs = true;
ProtectKernelModules = true;
ProtectKernelTunables = true;
ProtectProc = "invisible";
ProtectSystem = "strict";
ReadWritePaths = [ workdir ];
RemoveIPC = true;
RestrictAddressFamilies = [ "AF_INET" "AF_INET6" "AF_UNIX" ];
RestrictNamespaces = true;
RestrictRealtime = true;
RestrictSUIDSGID = true;
SystemCallArchitectures = "native";
SystemCallFilter = [ "@system-service" "~@resources" "~@privileged" ];
};
allow_unsafe_locale = true;
};
turn_shared_secret = inputs.config.sops.placeholder."synapse/coturn";
registration_shared_secret = inputs.config.sops.placeholder."synapse/registration";
macaroon_secret_key = inputs.config.sops.placeholder."synapse/macaroon";
form_secret = inputs.config.sops.placeholder."synapse/form";
signing_key_path = inputs.config.sops.secrets."synapse/signing-key".path;
email =
{
smtp_host = "mail.chn.moe";
smtp_port = 25;
smtp_user = "bot@chn.moe";
smtp_pass = inputs.config.sops.placeholder."mail/bot";
require_transport_security = true;
notif_from = "Your Friendly %(app)s homeserver <bot@chn.moe>";
app_name = "Haonan Chen's synapse";
};
});
};
secrets = (listToAttrs (map
(secret: { name = "synapse/${secret}"; value = {}; })
[ "coturn" "registration" "macaroon" "form" ]))
// { "synapse/signing-key".owner = inputs.config.systemd.services.matrix-synapse.serviceConfig.User; }
// { "mail/bot" = {}; };
};
tmpfiles.rules =
[
"d /var/lib/synapse 0755 root root"
"d ${workdir} 0700 synapse-${instance.name} synapse-${instance.name}"
"Z ${workdir} - synapse-${instance.name} synapse-${instance.name}"
];
})
(attrsToList synapse.instances));
sops = mkMerge (map
(instance:
{
templates."synapse/${instance.name}.yaml" =
{
owner = "synapse-${instance.name}";
group = "synapse-${instance.name}";
content =
let
inherit (inputs.config.sops) placeholder;
in builtins.readFile ((inputs.pkgs.formats.yaml {}).generate "${instance.name}.yaml"
{
server_name = instance.value.matrixHostname;
listeners =
[{
bind_addresses = [ "127.0.0.1" ];
inherit (instance.value) port;
resources = [{ names = [ "client" "federation" ]; compress = false; }];
tls = false;
type = "http";
x_forwarded = true;
}];
database =
{
name = "psycopg2";
args =
{
user = "synapse_${replaceStrings [ "-" ] [ "_" ] instance.name}";
password = placeholder."postgresql/synapse_${replaceStrings [ "-" ] [ "_" ] instance.name}";
database = "synapse_${replaceStrings [ "-" ] [ "_" ] instance.name}";
host = "127.0.0.1";
port = "5432";
};
allow_unsafe_locale = true;
};
turn_shared_secret = placeholder."synapse/${instance.name}/coturn";
registration_shared_secret = placeholder."synapse/${instance.name}/registration";
macaroon_secret_key = placeholder."synapse/${instance.name}/macaroon";
form_secret = placeholder."synapse/${instance.name}/form";
signing_key_path = inputs.config.sops.secrets."synapse/${instance.name}/signing-key".path;
email =
{
smtp_host = "mail.chn.moe";
smtp_port = 25;
smtp_user = "bot@chn.moe";
smtp_pass = placeholder."mail/bot";
require_transport_security = true;
notif_from = "Your Friendly %(app)s homeserver <bot@chn.moe>";
app_name = "Haonan Chen's synapse";
};
admin_contact = "mailto:chn@chn.moe";
enable_registration = true;
registrations_require_3pid = [ "email" ];
turn_uris = [ "turns:coturn.chn.moe" "turn:coturn.chn.moe" ];
max_upload_size = "1024M";
web_client_location = "https://element.chn.moe/";
serve_server_wellknown = true;
report_stats = true;
trusted_key_servers =
[{
server_name = "matrix.org";
verify_keys."ed25519:auto" = "Noi6WqcDj0QmPxCNQqgezwTlBKrfqehY1u2FyWP9uYw";
}];
suppress_key_server_warning = true;
log_config = (inputs.pkgs.formats.yaml {}).generate "log.yaml"
{
version = 1;
formatters.precise.format =
"%(asctime)s - %(name)s - %(lineno)d - %(levelname)s - %(request)s - %(message)s";
handlers.console = { class = "logging.StreamHandler"; formatter = "precise"; };
root = { level = "INFO"; handlers = [ "console" ]; };
disable_existing_loggers = true;
};
pid_file = "/run/synapse-${instance.name}.pid";
media_store_path = "/var/lib/synapse/${instance.name}/media_store";
presence.enabled = true;
url_preview_enabled = true;
url_preview_ip_range_blacklist =
[
"10.0.0.0/8" "100.64.0.0/10" "127.0.0.0/8" "169.254.0.0/16" "172.16.0.0/12" "192.0.0.0/24"
"192.0.2.0/24" "192.168.0.0/16" "192.88.99.0/24" "198.18.0.0/15" "198.51.100.0/24" "2001:db8::/32"
"203.0.113.0/24" "224.0.0.0/4" "::1/128" "fc00::/7" "fe80::/10" "fec0::/10" "ff00::/8"
];
max_image_pixels = "32M";
dynamic_thumbnails = false;
});
};
secrets = (listToAttrs (map
(secret: { name = "synapse/${instance.name}/${secret}"; value = {}; })
[ "coturn" "registration" "macaroon" "form" ]))
// { "synapse/${instance.name}/signing-key".owner = "synapse-${instance.name}"; }
// { "mail/bot" = {}; };
})
(attrsToList synapse.instances));
nixos.services =
{
postgresql = { enable = true; instances.synapse = {}; };
postgresql =
{
enable = mkIf (synapse.instances != {}) true;
instances = listToAttrs (map
(instance: { name = "synapse_${replaceStrings [ "-" ] [ "_" ] instance.name}"; value = {}; })
(attrsToList synapse.instances));
};
nginx =
{
enable = true;
https.${synapse.hostname}.location."/".proxy =
{ upstream = "http://127.0.0.1:${toString synapse.port}"; websocket = true; };
enable = mkIf (synapse.instances != {}) true;
https = listToAttrs (map
(instance: with instance.value;
{
name = hostname;
value.location."/".proxy = { upstream = "http://127.0.0.1:${toString port}"; websocket = true; };
})
(attrsToList synapse.instances));
};
};
systemd.services.matrix-synapse.enable = synapse.autoStart;
};
}

View File

@ -22,6 +22,7 @@ inputs:
rsshub = 2006;
v2ray = 2007;
fz-new-order = 2008;
synapse-synapse = 2009;
};
};
group = mkOption

View File

@ -17,7 +17,7 @@ postgresql:
wallabag: ENC[AES256_GCM,data:ANwvEE3K/W/hU34Y7RvlbUuJNo2bOaRfeusYM9pRxXQOdG4XpwYfd/DprsrVjlkrMFuTurUR5j6UNHWh+ILDbQ==,iv:K8doqhVosz+OosMrLJXrSxairr84EeGs3EWgVQjpkS8=,tag:WjDzy7ubm/GVlBkW0O3znQ==,type:str]
misskey_misskey: ENC[AES256_GCM,data:lRbSz7bbiWEdK/cRD41fLvFJF4WYsclKHVykFcU3LIz9vnKlR3VdczzznVqpT7JvG6OUi+TmipJii+0KzXHtdA==,iv:8sBKgVwuDJdThup0KQ6cnAV5O2liwVra1yIpDHVfpMI=,tag:DyUpaHai8ZUyllvZBUm8sg==,type:str]
misskey_misskey_old: ENC[AES256_GCM,data:Wwtd+hKI0s7m3PbEPHbnSyTsCkW0x8SYHUiCYuNSNCG8i4RAmiAbONNFfWN2hXnmTmRK79Tx/3GR+L0KMzmNGQ==,iv:BekTELToPQXUdZHyNtkuqKyZeez+moI6k907P7NhA3Q=,tag:A5YB0WIa1RkDCtzeBhiuyA==,type:str]
synapse: ENC[AES256_GCM,data:Orfse2arRGMujA8MloqOp+iVr0+uCVtlMZJNAA36J3UCog5ExE8HE6G5wIvvoP0o/PNToYc9Jgn8T7iWdU6FIA==,iv:XQ6/bDfIRmvZ3VdTqH5Gaiu2emd5kV+q6RjNXDQEtkc=,tag:Yq+w9oxv2yhpsQfMRp4HaQ==,type:str]
synapse_synapse: ENC[AES256_GCM,data:lzaggyuXM1XwsRxFHslsP89r8wEcgi6LNfbcm+pFWj6WLO8y8WaQIdOkiF3D2ToKDwcw5XgSGSt/VAk6lv+GeA==,iv:8WOL3jze797Wz9kSRq7YpY8OS1TBMqHYhfgZlluJlic=,tag:utNhs1AMbGthp6M2c0x67g==,type:str]
vaultwarden: ENC[AES256_GCM,data:Uz8GJMaLUTQ9pQbZyZLWS4bL5wmt9RvbAwNctAIDt9JrV3FaXxgKjE0MJSGklS55yj/Z/wbO6RCuCK2AWR2VKw==,iv:7hA8YcB88M1qCV8EhFYpHbfPmAZ/7xNqvTMJYZ/UcAY=,tag:mkDHJYmRoYZ/Ct0UmOp9FA==,type:str]
nextcloud: ENC[AES256_GCM,data:5UpYSMsZgUgEJHg0ou9Z1RTE+YFFUKuXwPtc6L5XxD4GNo8Gd3CvcQSNGAol+5DtyPKF3q1+ZgtScWGrqU1RyA==,iv:Zfm+Oa4eON8WiJzYUkMFawafDwo9pOnOpWkwHYLIKkk=,tag:4ECMla1dFfCrn7lILwWFNA==,type:str]
mastodon: ENC[AES256_GCM,data:IQxoNjZILazu5cxkEzFAqqmGSsOffMQHoRB7AC2NqI/+CJSVsfdwiSVfxN+Jc9dmrqCjscUSxaWCMHnrZj/JyQ==,iv:d6tyj/w0uH2E3qHjEcopVhnmE/Pq0qN9PHthSArryyw=,tag:kfJsxqkErFcG11B0CmiIKw==,type:str]
@ -35,11 +35,12 @@ mail:
bot-encoded: ENC[AES256_GCM,data:HstqDfhKoLqDip9O+mwYGbNlNQ==,iv:CZSTfxJHhI6nG7501cQdJiZ9l3uKS7d5YsA8iVTUuoE=,tag:Rj3rvXJzDp8XzODV/gABog==,type:str]
bot: ENC[AES256_GCM,data:j4Y5oYeVt0sd2z2Qwuqisw==,iv:wasQCTqEMAyttbn1zm9oKck6QiByom+F7ZIMDUse9Gc=,tag:92O4ka6f0I9qnlnVy2dltA==,type:str]
synapse:
coturn: ENC[AES256_GCM,data:d0slDodWSVCMMgYXeLYcESuS3q2OkRI0fGTPAn1Ho+WLc/g8IHwSDtLt6W8j9UiBn1TpLVHnI71M6SZLwZK2XQ==,iv:nF89F/ezZFgCrS1WLLTgdV6pksSSgntJUdJ8Q2hVME4=,tag:Z0bJFFRdZCinrFDH9gyGwg==,type:str]
registration: ENC[AES256_GCM,data:bvDx/RaGLd7wkQIGz6+GKNHzuwjaoC2IOIY5Nu+/UAAjlwtTv5fhjlxq1ylTctvaeto=,iv:2mcSGeocXboBcY3SHkio8tnj+7rM1o5gOHZGYBP5x+Q=,tag:3vcVHR03NyIq6DvbPApFkg==,type:str]
macaroon: ENC[AES256_GCM,data:SUJe+4q7QlWBceL/cyJxrjl9OV9o2//YEu3k4rzRRg3eSgiDphyL8MWzoO/WH8MzaH8=,iv:2tTQVj9kHa3Lb3ZqnxwSfpyWEDq77gtxS+iBqKuTLpY=,tag:XnKKMg8sxw3WQtJvfcyXcA==,type:str]
form: ENC[AES256_GCM,data:N/5El9TMbVL0zKTiTgtjdhk3PeRmWV7grckZ6NrroaXqt0I1HCCUGJQA+Qd7fp5SKV0=,iv:AfP6PrsyU6cCQa3LEUivN3k5pv/JARVzEigHJLopasU=,tag:CT0/7czF+VNnlb5yN8EZXg==,type:str]
signing-key: ENC[AES256_GCM,data:ZCayvU2lElUnuyVDL05XjO3v2P78ha9i9PEcLvpBLgNeYkh7nH9Z4kIAP6Pmbw39ufaSJuo5tZZPmA==,iv:CfxqL7dJbmG/jEcdDe+Su8uxsA4dkOq/CCOGlb3EDIk=,tag:9728QS3GLnTcerzDgtQEWw==,type:str]
synapse:
coturn: ENC[AES256_GCM,data:9MDq0eXLHjJ8Cd2d1iogS1lnjI0A2+0ZK8OtLKRLqT16BVzQQJyhbkAYwkn1+9ppfrazsHFGrk7DVsA7PWjdmA==,iv:SOjwZIyzkMK9Q1fGkmBSr6nSIarNe/WeD91GPJRuZjg=,tag:1GljmXdK80NKTPSg6xJz0A==,type:str]
registration: ENC[AES256_GCM,data:MmRJ3el59XaTwFImuCsiAm2zXeGhgvyUyw9AIv7FvxR4N3YWnHKALcQJtG52N4bmLXU=,iv:vm2R7XGzGET0eTcD2trl3xD2I09NzYmx5NPIY4KK4xM=,tag:exm8/ehPufeqtp6j61ap0Q==,type:str]
macaroon: ENC[AES256_GCM,data:2/8GuF/a+ocVtLN0PU17JDvXw/RoXX/CXFHPlI9THl5bY8lBm6tEawijnOKVoFLovfU=,iv:GPAr3ZjqLf9ixevsZoQgs4cPkv0VL4WJoFfQZOdThlw=,tag:HRt/igDEfUJ3K39mG7b9Fg==,type:str]
form: ENC[AES256_GCM,data:Z9cYL9ibRWmOhAYtB269n0cWZSvL4zGgc03ZRag0m8cz2j0god/Fn/w6kx3cyGK1C70=,iv:Yst6WSV63IvbMF5nnicIoBj77eSwVMnAHtHrKo2UcDk=,tag:4qf6F2rdctcCf4J9vECvYg==,type:str]
signing-key: ENC[AES256_GCM,data:BbPJiNcVTqMAL2XG3K3CIbsb8EM4r8ct/WxPK10FHRwAnqChKy3CAviYU9gewO/tNZXHvUYUAUbPww==,iv:IZB/40EE3DIxAqagdH/a4kcSmiec5l24XLCQKCQNaRo=,tag:/1t0WAPBYmYrPTx4V4wgkw==,type:str]
nebula:
key: ENC[AES256_GCM,data:9o6EkfTWOU0KwnJsgHML4E7VOfzo3LHnlOkV8ubhi6aayXImC3lAaoPrqUI=,iv:KHprijN7z+4FIIW+D5klDM9a9VzMJ5xawPc7jJtbHmk=,tag:0DAmxoz8D5f38ndPbkNW+g==,type:str]
vaultwarden:
@ -116,8 +117,8 @@ sops:
SnFHS1Z0SXUzTFdEd29KTy9DU3Y3R0UKfhh+rUmWDrf+UGjclP57dHipPLFoXSqy
HdelmfV6q4/c7ppx2E+oZw3VNgoZCsrxxzYZfwxHJiZb+5vkE0D8iA==
-----END AGE ENCRYPTED FILE-----
lastmodified: "2023-12-17T05:32:02Z"
mac: ENC[AES256_GCM,data:fgtAvBL6Dg/ATU2+jIY9RAukDm64VxKPkf19ouRptuHq6DPm5e/puVLpNMhs5X+uGH9GTfBy79aBV9lYzrniA0IFWv3vbUeHI1A4VvgfZwqGazJ+6oJg6jNibsoeWFhrZGWxfYGWs0U4HDkL52QcLDjU0VyMq33t8HrTEKh2KCM=,iv:ML+H3E/Mb+3d13U2E4zLb+F4vxPINtps0gsxqfqG9XA=,tag:jOcaxjXDJMxIweI5VwEgKw==,type:str]
lastmodified: "2023-12-17T11:19:52Z"
mac: ENC[AES256_GCM,data:oLp1jVWscy64axwpILDh2PKKD8MKxLfl9rLmt2/ojSo2U4vFGu83o0eVUhBEWQZiajRO/SOWckEKZeNAwxFNVRS0dOSIMgwTHFqxREwtY0nVtH0rChlGHSf/LjOuHhMbknlchvNVqVNhqEqnGdAKxWvhmaH9ZtqoafvN4+gd118=,iv:zMpWL31SAaJ4HoXPK3qlq0WXEAmPkvc+aMmCf+exuVc=,tag:cBI0xHul6beJUG9o4cmbtw==,type:str]
pgp: []
unencrypted_suffix: _unencrypted
version: 3.8.1