public/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

nixos/doc/matrix-synapse: refactor

Browse Source 
* Linkify all service options used in the code-examples.
* Demonstrated the use of `riot-web.override {}`.
* Moved the example how to configure a postgresql-database for
  `matrix-synapse` to this document from the 20.03 release-notes.
This commit is contained in:
Maximilian Bosch 2020-03-15 16:58:50 +01:00
parent 8be61f7a36
commit 849e16888f
No known key found for this signature in database
GPG Key ID: 091DBF4D1FC46B8E
4 changed files with 66 additions and 55 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
nixos/doc/manual/configuration/configuration.xml
View File

@ -21,7 +21,6 @@
<xi:include href="xfce.xml" /> <xi:include href="xfce.xml" />
<xi:include href="networking.xml" /> <xi:include href="networking.xml" />
<xi:include href="linux-kernel.xml" /> <xi:include href="linux-kernel.xml" />
<xi:include href="matrix.xml" />
<xi:include href="../generated/modules.xml" xpointer="xpointer(//section[@id='modules']/*)" /> <xi:include href="../generated/modules.xml" xpointer="xpointer(//section[@id='modules']/*)" />
<xi:include href="profiles.xml" /> <xi:include href="profiles.xml" />
<xi:include href="kubernetes.xml" /> <xi:include href="kubernetes.xml" />

19
nixos/doc/manual/release-notes/rl-2003.xml
View File

@ -746,21 +746,10 @@ auth required pam_succeed_if.so uid >= 1000 quiet
}</programlisting> }</programlisting>
</para></listitem> </para></listitem>
<listitem><para>If you deploy a fresh <package>matrix-synapse</package>, you need to configure <listitem><para>If you deploy a fresh <package>matrix-synapse</package>, you need to configure
the database yourself. An example for this can be found in <literal>&lt;nixpkgs/nixos/tests/matrix-synapse.nix&gt;</literal>: the database yourself (e.g. by using the
<programlisting>{ ... }: { <link linkend="opt-services.postgresql.initialScript">services.postgresql.initialScript</link>
services.matrix-synapse = { option). An example for this can be found in the
<link linkend="opt-services.matrix-synapse.enable">enable</link> = true; <link linkend="module-services-matrix">documentation of the Matrix module</link>.
/* and all the other config you've defined here */
};
<link linkend="opt-services.postgresql.enable">services.postgresql.enable</link> = true;
<link linkend="opt-services.postgresql.initialScript">services.postgresql.initialScript</link> = ''
CREATE ROLE "matrix-synapse" WITH LOGIN PASSWORD 'synapse';
CREATE DATABASE "matrix-synapse" WITH OWNER "matrix-synapse"
TEMPLATE template0
LC_COLLATE = "C"
LC_CTYPE = "C";
'';
}</programlisting>
</para></listitem> </para></listitem>
<listitem><para>If you initially deployed your <package>matrix-synapse</package> on <listitem><para>If you initially deployed your <package>matrix-synapse</package> on
<literal>nixos-unstable</literal> <emphasis>after</emphasis> the <literal>19.09</literal>-release, <literal>nixos-unstable</literal> <emphasis>after</emphasis> the <literal>19.09</literal>-release,

4
nixos/modules/services/misc/matrix-synapse.nix
View File

@ -113,7 +113,7 @@ ${cfg.extraConfig}
''; '';
hasLocalPostgresDB = let args = cfg.database_args; in hasLocalPostgresDB = let args = cfg.database_args; in
usePostgresql && (!(args ? host) || (elem args.host [ "localhost" "127.0.0.1" ])); usePostgresql && (!(args ? host) || (elem args.host [ "localhost" "127.0.0.1" "::1" ]));
in { in {
options = { options = {
services.matrix-synapse = { services.matrix-synapse = {
@ -721,4 +721,6 @@ in {
'') '')
]; ];
meta.doc = ./matrix-synapse.xml;
} }

97
nixos/doc/manual/configuration/matrix.xml → nixos/modules/services/misc/matrix-synapse.xml
View File

@ -40,26 +40,35 @@ let
in join config.networking.hostName config.networking.domain; in join config.networking.hostName config.networking.domain;
in { in {
networking = { networking = {
hostName = "myhostname"; <link linkend="opt-networking.hostName">hostName</link> = "myhostname";
domain = "example.org"; <link linkend="opt-networking.domain">domain</link> = "example.org";
}; };
networking.firewall.allowedTCPPorts = [ 80 443 ]; <link linkend="opt-networking.firewall.allowedTCPPorts">networking.firewall.allowedTCPPorts</link> = [ 80 443 ];
<link linkend="opt-services.postgresql.enable">services.postgresql.enable</link> = true;
<link linkend="opt-services.postgresql.initialScript">services.postgresql.initialScript</link> = ''
CREATE ROLE "matrix-synapse" WITH LOGIN PASSWORD 'synapse';
CREATE DATABASE "matrix-synapse" WITH OWNER "matrix-synapse"
TEMPLATE template0
LC_COLLATE = "C"
LC_CTYPE = "C";
'';
services.nginx = { services.nginx = {
enable = true; <link linkend="opt-services.nginx.enable">enable</link> = true;
# only recommendedProxySettings and recommendedGzipSettings are strictly required, # only recommendedProxySettings and recommendedGzipSettings are strictly required,
# but the rest make sense as well # but the rest make sense as well
recommendedTlsSettings = true; <link linkend="opt-services.nginx.recommendedTlsSettings">recommendedTlsSettings</link> = true;
recommendedOptimisation = true; <link linkend="opt-services.nginx.recommendedOptimisation">recommendedOptimisation</link> = true;
recommendedGzipSettings = true; <link linkend="opt-services.nginx.recommendedGzipSettings">recommendedGzipSettings</link> = true;
recommendedProxySettings = true; <link linkend="opt-services.nginx.recommendedProxySettings">recommendedProxySettings</link> = true;
virtualHosts = { <link linkend="opt-services.nginx.virtualHosts">virtualHosts</link> = {
# This host section can be placed on a different host than the rest, # This host section can be placed on a different host than the rest,
# i.e. to delegate from the host being accessible as ${config.networking.domain} # i.e. to delegate from the host being accessible as ${config.networking.domain}
# to another host actually running the Matrix homeserver. # to another host actually running the Matrix homeserver.
"${config.networking.domain}" = { "${config.networking.domain}" = {
locations."= /.well-known/matrix/server".extraConfig = <link linkend="opt-services.nginx.virtualHosts._name_.locations._name_.extraConfig">locations."= /.well-known/matrix/server".extraConfig</link> =
let let
# use 443 instead of the default 8448 port to unite # use 443 instead of the default 8448 port to unite
# the client-server and server-server port for simplicity # the client-server and server-server port for simplicity
@ -68,7 +77,7 @@ in {
add_header Content-Type application/json; add_header Content-Type application/json;
return 200 '${builtins.toJSON server}'; return 200 '${builtins.toJSON server}';
''; '';
locations."= /.well-known/matrix/client".extraConfig = <link linkend="opt-services.nginx.virtualHosts._name_.locations._name_.extraConfig">locations."= /.well-known/matrix/client".extraConfig</link> =
let let
client = { client = {
"m.homeserver" = { "base_url" = "https://${fqdn}"; }; "m.homeserver" = { "base_url" = "https://${fqdn}"; };
@ -84,34 +93,37 @@ in {
# Reverse proxy for Matrix client-server and server-server communication # Reverse proxy for Matrix client-server and server-server communication
${fqdn} = { ${fqdn} = {
enableACME = true; <link linkend="opt-services.nginx.virtualHosts._name_.enableACME">enableACME</link> = true;
forceSSL = true; <link linkend="opt-services.nginx.virtualHosts._name_.forceSSL">forceSSL</link> = true;
# Or do a redirect instead of the 404, or whatever is appropriate for you. # Or do a redirect instead of the 404, or whatever is appropriate for you.
# But do not put a Matrix Web client here! See the Riot Web section below. # But do not put a Matrix Web client here! See the Riot Web section below.
locations."/".extraConfig = '' <link linkend="opt-services.nginx.virtualHosts._name_.locations._name_.extraConfig">locations."/".extraConfig</link> = ''
return 404; return 404;
''; '';
# forward all Matrix API calls to the synapse Matrix homeserver # forward all Matrix API calls to the synapse Matrix homeserver
locations."/_matrix" = { locations."/_matrix" = {
proxyPass = "http://[::1]:8008"; # without a trailing / <link linkend="opt-services.nginx.virtualHosts._name_.locations._name_.proxyPass">proxyPass</link> = "http://[::1]:8008"; # without a trailing /
}; };
}; };
}; };
}; };
services.matrix-synapse = { services.matrix-synapse = {
enable = true; <link linkend="opt-services.matrix-synapse.enable">enable</link> = true;
server_name = config.networking.domain; <link linkend="opt-services.matrix-synapse.server_name">server_name</link> = config.networking.domain;
listeners = [ <link linkend="opt-services.matrix-synapse.listeners">listeners</link> = [
{ {
port = 8008; <link linkend="opt-services.matrix-synapse.listeners._.port">port</link> = 8008;
bind_address = "::1"; <link linkend="opt-services.matrix-synapse.listeners._.bind_address">bind_address</link> = "::1";
type = "http"; <link linkend="opt-services.matrix-synapse.listeners._.type">type</link> = "http";
tls = false; <link linkend="opt-services.matrix-synapse.listeners._.tls">tls</link> = false;
x_forwarded = true; <link linkend="opt-services.matrix-synapse.listeners._.x_forwarded">x_forwarded</link> = true;
resources = [ <link linkend="opt-services.matrix-synapse.listeners._.resources">resources</link> = [
{ names = [ "client" "federation" ]; compress = false; } {
<link linkend="opt-services.matrix-synapse.listeners._.resources._.names">names</link> = [ "client" "federation" ];
<link linkend="opt-services.matrix-synapse.listeners._.resources._.compress">compress</link> = false;
}
]; ];
} }
]; ];
@ -135,10 +147,10 @@ in {
<para> <para>
If you want to run a server with public registration by anybody, you can If you want to run a server with public registration by anybody, you can
then enable <option>services.matrix-synapse.enable_registration = then enable <literal><link linkend="opt-services.matrix-synapse.enable_registration">services.matrix-synapse.enable_registration</link> =
true;</option>. Otherwise, or you can generate a registration secret with true;</literal>. Otherwise, or you can generate a registration secret with
<command>pwgen -s 64 1</command> and set it with <command>pwgen -s 64 1</command> and set it with
<option>services.matrix-synapse.registration_shared_secret</option>. To <option><link linkend="opt-services.matrix-synapse.registration_shared_secret">services.matrix-synapse.registration_shared_secret</link></option>. To
create a new user or admin, run the following after you have set the secret create a new user or admin, run the following after you have set the secret
and have rebuilt NixOS: and have rebuilt NixOS:
<screen> <screen>
@ -154,8 +166,8 @@ Success!
<literal>@your-username:example.org</literal>. Note that the registration <literal>@your-username:example.org</literal>. Note that the registration
secret ends up in the nix store and therefore is world-readable by any user secret ends up in the nix store and therefore is world-readable by any user
on your machine, so it makes sense to only temporarily activate the on your machine, so it makes sense to only temporarily activate the
<option>registration_shared_secret</option> option until a better solution <link linkend="opt-services.matrix-synapse.registration_shared_secret">registration_shared_secret</link>
for NixOS is in place. option until a better solution for NixOS is in place.
</para> </para>
</section> </section>
<section xml:id="module-services-matrix-riot-web"> <section xml:id="module-services-matrix-riot-web">
@ -177,15 +189,24 @@ Success!
Matrix Now!</link> for a list of existing clients and their supported Matrix Now!</link> for a list of existing clients and their supported
featureset. featureset.
<programlisting> <programlisting>
services.nginx.virtualHosts."riot.${fqdn}" = { {
enableACME = true; services.nginx.virtualHosts."riot.${fqdn}" = {
forceSSL = true; <link linkend="opt-services.nginx.virtualHosts._name_.enableACME">enableACME</link> = true;
serverAliases = [ <link linkend="opt-services.nginx.virtualHosts._name_.forceSSL">forceSSL</link> = true;
"riot.${config.networking.domain}" <link linkend="opt-services.nginx.virtualHosts._name_.serverAliases">serverAliases</link> = [
]; "riot.${config.networking.domain}"
];
root = pkgs.riot-web; <link linkend="opt-services.nginx.virtualHosts._name_.root">root</link> = pkgs.riot-web.override {
}; conf = {
default_server_config."m.homeserver" = {
"base_url" = "${config.networking.domain}";
"server_name" = "${fqdn}";
};
};
};
};
}
</programlisting> </programlisting>
</para> </para>