From 8cc45221536a6e7237837fe7f79633ba4d575bf9 Mon Sep 17 00:00:00 2001
From: Daniel Kempkens <daniel+git@kempkens.io>
Date: Sun, 5 Feb 2023 23:25:57 +0100
Subject: [PATCH] synapse: move secrets to agenix

---
 agenix/hosts/sail/config.nix              |   6 +++++
 agenix/hosts/sail/synapse/extraConfig.age | Bin 0 -> 1115 bytes
 home/programs/nvim/plugins.nix            |  10 ++++----
 secret/hosts/sail.nix                     | Bin 2112 -> 1630 bytes
 secrets.nix                               |   2 ++
 system/hosts/sail.nix                     |   2 +-
 system/nixos/synapse.nix                  |  30 +++-------------------
 7 files changed, 17 insertions(+), 33 deletions(-)
 create mode 100644 agenix/hosts/sail/synapse/extraConfig.age

diff --git a/agenix/hosts/sail/config.nix b/agenix/hosts/sail/config.nix
index 9cdca1a..be7e673 100644
--- a/agenix/hosts/sail/config.nix
+++ b/agenix/hosts/sail/config.nix
@@ -42,6 +42,12 @@
       group = "mastodon";
     };
 
+    synapse-extra-config = {
+      file = ./synapse/extraConfig.nix;
+      owner = "matrix-synapse";
+      group = "matrix-synapse";
+    };
+
     freshrss-user-password = {
       file = ./freshrss/userPassword.age;
       owner = "freshrss";
diff --git a/agenix/hosts/sail/synapse/extraConfig.age b/agenix/hosts/sail/synapse/extraConfig.age
new file mode 100644
index 0000000000000000000000000000000000000000..779e728003b4f478da82ce6a6bdcd3da70649641
GIT binary patch
literal 1115
zcmV-h1f=_6XJsvAZewzJaCB*JZZ2<fXD@a!3N1b$b8~1dWn?lnH8D9LO>{?aHfJDd
zF-<{BM|ev%Z){dZGg4<!VRTkAWKU3PN@g*2Z+C5RaZ^J@dM`LIYf%bSbzx&=c{y}4
zV^?i=Yb#GjHhM@`ct&_jO+rIXVpUl}ZZv9dLU%}6V>AjaJ|J^*Xf0)AGBq_ZIUr7A
zRy1gLAZ2zrGFECuT32m%H*I24YfCp)ICo`lWocALV^w%YS$cFbc4Tm7Qb&1X3NcSu
zOKMVLX<<z_Z(34SZ(~PKHeqUZY%6+0LrG0XHDg3jLO5b`F;8?b3N1b$WH?z*M=fV^
zWnpt=AShQLA$w#?X&`Ykbz4&)bUzA8Pf$~OD`7NhN-$z<Rc1|XFGEB_N<=SAG;(@T
zXH|E1Pfu%7Gc!gqcuYkwRdaS$M_6=vV^~yALT4*4HZV;JRAxkLaz{*fMQ3_zbW2T8
zMM-T(XKYqYIZ9+vRWEKwVNhCHOG9*dPB1}qFLrN6FGNvNQ)gF3MNxEjR5wgR3JNVP
zEg&>kL3Cv`bt_>jYjI>jO;Tf5M@%*_cY0Y$W^ZdNNI5}DOKUV}b~t2acM2LIH5UQ0
z3Oh=oW7D5KwN9a`@R1L4!8AgrmQvj9LvV#aE9ee!O)92W)nexETJ8#h9nC3xWL<OR
z%AF1N__+r9#!V1H=u<dh$c27p@aOx#8}TT;&=`=}X^g(hO8olsyoj-(MfB^{yvYJv
z8fKCj=Ms<~y7nAINMl}e8R<y#vv<M#91d0r!R^VP{&;&oSKJ}Ra+YUD?^MR+A_B=R
zs_IT@3l4|5aj%}dEGTH+<idleoO_IhEM+s?;DMSxNSg5?XZq)EYTK!NU-=oCBw4Dl
z^!0ThI~H`(UwkW(4cz$L1GF)Ayz4H+MGXm19PST|r%XdmU(1@{8UctG0^Fh9CQNFc
zX8TtkC$0{>A+A5HX<ycNN=s45=~zu!M%@ml64?R^ap2sP2u1~6G5N|}&vpod&x7Cq
z-Stk-bo_cFTT^&-1E`>weneOMH)Qz@T|vaO4v(lD6sv|g#to7r7g`aJ!8Uo?Cf8OX
zV^Aq6eQ&cn#8c0gM>@J)JViL%DBA0=j|kM~u9Kh;nZ31gxDG1h@SLij_Z(^XkFL=1
z#*c|xuWXA+b!-?8I2wZm5l7WJsNDD_liV*6S=5wc$unpN5``Ii04^xMRji`{!&<zC
z82z9FEMwtASWL<(1eYHIT0EU7d7<r2d~V(2WL4`<Jw@~J4<*B$p!gSu4v^4X+72&C
zj`#i`$LR3}37RK!(QLRjW|I+Zhg4NWAnV61Q!*6SkCi14*W4p|wqtBHy(oypz!E<G
zdJckrZ?7clwPFx;H%{pbm11V}7FD#U%h?wBN>TL&jY{f}$H?&S!USZvFm>2GPprfJ
h8SxV_;?XLDPl4S)z!djoagf)J^GQ0gfAhyJ)Bp6U)F}V}

literal 0
HcmV?d00001

diff --git a/home/programs/nvim/plugins.nix b/home/programs/nvim/plugins.nix
index 5ba45ec..5153281 100644
--- a/home/programs/nvim/plugins.nix
+++ b/home/programs/nvim/plugins.nix
@@ -102,12 +102,12 @@ rec {
   };
   dracula-nvim = pkgs.vimUtils.buildVimPluginFrom2Nix {
     pname = "dracula.nvim";
-    version = "2023-01-19";
+    version = "2023-02-05";
     src = pkgs.fetchFromGitHub {
       owner = "Mofiqul";
       repo = "dracula.nvim";
-      rev = "a0b129d7dea51b317fa8064f13b29f68004839c4";
-      sha256 = "0q7ly95hp123z9z8qh4sih5a53dnbxv0jxa80b1s7d6h1wpr2w5j";
+      rev = "798274ba3c454a9aa3cd71f95a86ea55cbbbb142";
+      sha256 = "156g08ab9jghi580b1k88si3bc6h72d77avlpn34dnnn5481anvh";
       fetchSubmodules = false;
     };
   };
@@ -116,8 +116,8 @@ rec {
     src = pkgs.fetchFromGitHub {
       owner = "nvim-treesitter";
       repo = "nvim-treesitter";
-      rev = "720f75f9881cae820cecde23fc2f07affacf2826";
-      sha256 = "16rh90skmhs2qr9v39l7f0kmml8n7f8c36vsp96pwkd9rw1j99ki";
+      rev = "24d5be6e7192a855a0eba21829717614fa1cf54e";
+      sha256 = "0mk81rjjg4z86kc5wh400j3hvhfq5fflmv0w7daxbxz83133xnxx";
       fetchSubmodules = false;
     };
   });
diff --git a/secret/hosts/sail.nix b/secret/hosts/sail.nix
index 5e77745743b63ee0fa8f1dedf0a659056fe18b9e..e29dca36e21edca04887e410dbe9a216c3e986e0 100644
GIT binary patch
literal 1630
zcmV-k2BG-?M@dveQdv+`0MQ@_i{QMUJQs;6%he@p3WacPzY9dDZ@XdGe7745Tj1lD
zBV~jLxQczhdu(q_<DZ4;-?<wCF8NsAg4BY%*}{^tk*HhsQ?y(2*q@*<aytJI67EOk
zTxj|&IeeyybzV~83wd8W!|zn<rO3%K_J}-L{r}DmQlVJ4__WTflL6SBfk!`N|CH}9
zabCdjB7vUJLMzutKLxa)h>_5G@<{Bb4?Ur#kkERAW{=SJsU}^o3;bJrpWzW|@8!UP
zWzrlo7rES*^`!6c?Y(5iZv3;cfEb{D3IfeR^zX`j44#vubN^si<jc1}QiC~#;*EPS
zglktBH=)k(GUoJS68W>G30Xk4mS9}%==IbJwpnagsHTjQ^x|SBEDW}(9~@Iv{$k$P
z2jrUAPml%Isz5a96(UTV1t<-XO=Me36{FmR*a{o&l_L_U{s@qDH&8GYov%GUUjs!Q
zegBL!%6uWlEc*$g-ApIXXxe*k^*Xqeg406~FDQYEswSg$KZ)VWCU3AiH@re>#{Bwt
zh|p<c*Gt6iftr1TS`Obs=s6mIl^wqGx&#HfF_@dMib<l+9c_;Ywyiq>PD&BT+ZY)C
z*7Yzk_aJWuR}EJNU46w-p@riAnKr1Gv7YO1D6*6Xkr<>{r&omMW8C+9%=;F!EbqJ>
z8?g6K3yJ1DdT;n9Pks~a{c^I<E=w}Y^IkAN1}^15Y3O%`K_bRuO8xQhY2wMurfFEs
z@xN5U=k*;}PEx%Bm3>IfjXUhZOxF$5&a`<DRb3%ZrjhiIREl!V6;bPDL0Zr129B5O
z=zGnkoQ~;DeG&4OcR_K>Sqy=h1SD;=Ijc#R`O_paZ>(B&sZ!l^V)u}zL(nk6o`aQ?
zN-?6J+R11E({g3F^tdLok%kSBvD|5@ZB_6XA_>{eqr!!Q$unQYF92C84`b(7hh9_b
zmg@mp^HdYcCcpOpp7tWaZpd-bX{DKM(sg#z>;TgSUC5y1{Wl`|(TF5?0Dx(m?NOE;
zxR@bc8A6g|=!aZn-=BffX{VQ7jx{};ic7kQiJ=4B3OOh;yUr1U<1X309TRBnWt}n<
z68x2s<}seK?(vm+SmOgKjqrWl1sA4Kp#&VYTyV#^d`g>9^F>Nm-uN{;Q+@L7l!*C$
z#JLZDlE}zEktZ$r(gl5OEc~BG9deGFPs}v#ZemucSDnv>*Jy_Sqh3Y-pe=M|pEkxx
z`M~ML0CQas^u=)Qn#2J)9TXd$oDDu21nJhY_~QzMTwwq#cyMptX?HqvTRq<~S?g!P
z)uRhG&rP6ii_h;tVxRAonlEqWmG#bo6#@iq9C^WsL*0(90hyQjHC8?=@y1JMs#>3s
z9|ugOiqe$)aH1=DSlR1iS#EhY<4Nh>EXQLB*G7_Riy*Ba79iDdV=>tAS?iW*kySuu
z)RzU;p-uYBI{4g0$hbm@1x$y+a9;oSyM}E25AdT%$~>F9Eul)kIfBye1{_UTM_ttC
z%q)G^`*}SJk>ud==jn{70O##6xva?v#M;o`FhFZ@`s_m6@~0B;mmQsS<RwSlgs*jx
zdd1Y<c;oQ=mqkg{A{RVR2%uEW^y{^kj~=@&Yp0L0|BS~$##16wrgr|J;@+p-zAZaS
zW-l%iK6W4!C8~y2!+2FX6|JEks6EE*4=B4;8(MJUeP^+CKMD7}gdTLcOGY%?C&nQH
zeenvS$4}?5`P5<f_RXWn({V5=R4l|r+OqncHq)V`kb6I%L2HgVG9OwnCavaSty;cN
z$B;pItW7Wvljb8*f?egaoVPhE@eb2*VvrHFQML@jW=(6`;NBBCrzm#NwPHp=yl|}S
z2N*SnPeUC(4cw(6SO@L0Tl8a))l63v^qdMIyunFq+#DJV{4~ov!A0|rr?i10;kZ9%
z(ed~QN}~>IYnfa6Og3_srtP%n_GVb+ZRTd5-+Nw2nlZvS3||23uh%K+sf%+Wp)mGW
z{BE;BR@-Z0chfJ3NJCk+@;WU=Xr@p%-IrWRZ#3$3T|bqvequJ9qSPhVTnPV~T&kVr
z99(z+c52nLZM{jBzJrD$yS|6N{ew4l&n@>TIQy)HT7NN9aNpm+4lzfc6||^<R_`W+
cUI5HgODEms)fAOgvndhx6y&>OKJ4pD3=(KNS^xk5

literal 2112
zcmV-G2*39LM@dveQdv+`0EJ9=j#B$~PRC-Ti$Qjry~veZ@O4o6`icmO=xmbgj)A*@
zvh!m7RSXe(Zwl-7^A#|vIE%l+{^`YyNU!;qgxEe*LFfevM6|?s2<Eh1isJ);sXuPA
z&h0n3PyHQN7Op+jnL-DjSnWwC7r((B*=P8`K25xqWcwCc@a;9S{zwt<RnfL}38<4o
znwKxOr8Nh7%@@WDG^OK{PM4wUx2Z(~4D#;lt-c$xq?buvfZgv7hYzjW26Fo@e7f#O
z6<C^cN_OPq0M!uQa*P<Fd{XIGV2#tpgFSDDpcXN>P7OS#zm=xZ9)Gq_LDsP|cssxS
zuvxA*AUd}j(so?<>Q;1-D+~^U%?~I)XDN*ivz@@!6SOsxAX>`t+%uzaIaN2we<$pM
zsju+FxJJ2LI&auro1=fqnNV2}Nv+A>!Ir`=;OxwK(>BCX?}d(YXYMl0cNW`iK?Z}S
zefG0Q*kW7sNy?>~B_&ppEsy_aRmh(^gPSxzIB*eAjCS=(n9W}jJ-D#rmsk+SSF>l_
z1;`gMjp#;FXTvh{DL2-%c0$>ov!wv6PGh`XbmNwcU&Ma$h;e0bomlCFtWS*CdE@Bs
z3yr%dwFFc1O7f{81{ePGf+gM}bx&!3hXMKh#>4W+fAdc^+Q|ZIt)Z7Hh*rb!CPGV^
zkq<@!RXc(lpwGMZD^g}vr)u6xIin8!Zq)}tFMlS%j6kGhdu<D!2<uZ=ayrkY9*rC5
zi%c^{bOFkj#RtCFQcDj1Cy^lU;a6KeE=F$&2f~*vc%)~?<BdejYIH>1zE&_)kS`_k
zrtE^K58O(hWi{Fx4e8M;f1IY~>wvdH$qu}V?!cXjN##*y?@d&Ldr#a$jTE`cLG#Nt
zzHwp9q8rg;KDnp3VIR;2zVdzxyO}uQC!Q9T0p?Sxf<bXCoTDWDPf4Xfnozy%`~0F3
z*ruL!vSO@5#SeDWlSR?>3_zbn_ki1|#7p(Fk8b+S)<^N#Yu=uvLmydiBr8iIhKbb#
z>kDWtiSm`B-;%mHlCGUI&>i|Kepcljfk{}iC^$Drr5ArKr75cc%(D`<nw^k8W+J0t
zP>F~oEKT}cf0Wh5o2v(QDoG;XfH6mP^Qb|wr7!~5DwH^$41Urd>0WyH7w@1THNBa+
zGd@6~#e}DuTjwdjoTNJcesk6PSPjqEXcDCZd9KAYzyUxAL1V05jHeD!hLv!=OF`VE
zb9r@v*(glkhnW<eBeC2F@dM1vTmJCl1KohOA+yNX1I9+f#<Og|8r^?{M<&gKi6C_s
zsx`rfu(h1AU60TePJx^FWqQ`Z6A<&DOQ>%`v!)#~?_4KmXot4=pML2@Y1X>FdZ#=!
zKWz#$sJKl8B?Av2sSFAslp*&C7z+_8w_=v7rTMV6+{kDNM3=WWI;^Yc9_rGE&mF#!
zwh!+s_*skV^O5!^X{z5<6)aVhvL_PanIJDyL}D9o3&KH0yRcU>0RP#@2Uvu(0g5A6
z-%UXwnI06v+WAv^Gh-J_!Ra5cZpW@$h}Ujpt#loe%v<rXMXmY1i8pq4&-FCp{$!>t
z=CD?Q^66Vv1hk3#6%tBm9Gvg&a|n#Cz^5;LeU{1-*NW&RT*Dd^UVBBJ9<ZvhnIxJ>
zK}H%&$IJ2zVI%NZWFlPc^Ja!k#>)@w94Z(Le~nUhAuJTt`lg<ZEOmW=3=s|G0=ho{
zXB*hhxB8Y!z0UusK)S?kqW}t$3OO+mOwhnhB~J}S>{K;UB-pkyBk;}5cR84$6L!7=
z&+q{7t2zLMm&d-d2li**_O7<n&29DxxWWQYz40#d2lvh_bS9=tsnJINI=#`ohD~MT
zy#tp|zvYz?(Z;j6Il`9i((kczWgg;AG>P8Gwn+zxaWW>LUioCO#109M0{bRde2>2T
zq!i!gAg9tcE4p;EQmIGB2k1{m9>)p=AF_yW=Sk>#$IRt0HQ-Pdq0E#NP(^YshzlhX
zf@CHb)b5fQT(xG;Gg$tWoRigjKCjJsBO(I!c~8Q6Gy)ed9+DS2%0FTF#JgjkBswfU
z7C`4}Ryh(~z-;lRd!c7x^Q-;zc*74hD6ouaEaSw_^swgy*5?|MZ-Xpc(3rb3uCtrH
zt&`28$cC%Utd#<Ky$*-AHPO=%<5~tuOp6WnH&y^F_Y)*Bz}h#zM?d9ZuPyuJLy(Ml
zRyq3aGkG|Kh|^J{V@ApH_xmM!t|%lm24@j*+Z7?vtCac&2fGGOjQJdY%VAldtGj%C
z5xUy)gCc7a=gJT=Uoops2zV`{H%~|q2e%1?79zzjY1?;;=akxO_}**i@1nKFJLWUj
z7>lBVPsR?mQ2Hv^QC!PdL?a-TlIDwpLwEq9;)3;D{_CK{`-g%&pr3JC05z7R3;dd*
z5r|}Uy-NjGWVkM(nI;j;LRpG6a%j?t)ozku*DiA!=miGa#SnSVVwaRCj{w})B{pTt
z2MGJ^oue*K<slGzSGh4rm}G6c&T*u8<)Y~FbM+w;RMy>3SbT%)m7kK1G|C)Kmrq@Q
z0F15L0<|8dyxctf`=ato#R4$rVp()qoqEqx+;-(zWb|9U$xOpZ@p~YZR8a=0Z(lv4
z!q~po{>!dHSnYJSaMWc{_dg_l7ADBT0}Ospz%~<G!dXetDFx6l%lydA;PKTaxW{j&
za|Ot|Y;hrg<zA{ru%hT5fepLLLy_xtbQCv8m;23r%NR0PsU$OV6|jz&-(&|ask9}|
q71)^dy~gQj5X367YD(5Uxy|60&#<ppGQ1i(T`bBN)XPtX3IXC0mKqoU

diff --git a/secrets.nix b/secrets.nix
index 339484b..88504a8 100644
--- a/secrets.nix
+++ b/secrets.nix
@@ -15,6 +15,8 @@ in
   "agenix/hosts/sail/mastodon/vapidPublicKey.age".publicKeys = sail;
   "agenix/hosts/sail/mastodon/extraConfig.age".publicKeys = sail;
 
+  "agenix/hosts/sail/synapse/extraConfig.age".publicKeys = sail;
+
   "agenix/hosts/sail/freshrss/userPassword.age".publicKeys = sail;
   "agenix/hosts/sail/freshrss/databasePassword.age".publicKeys = sail;
 }
diff --git a/system/hosts/sail.nix b/system/hosts/sail.nix
index debf7c8..35f8d70 100644
--- a/system/hosts/sail.nix
+++ b/system/hosts/sail.nix
@@ -20,7 +20,7 @@ in
 
     (import ../nixos/mastodon.nix (args // { inherit secret; }))
 
-    (import ../nixos/synapse.nix (args // { inherit secret; }))
+    ../nixos/synapse.nix
 
     ../nixos/websites.nix
 
diff --git a/system/nixos/synapse.nix b/system/nixos/synapse.nix
index b8cc76a..b7248af 100644
--- a/system/nixos/synapse.nix
+++ b/system/nixos/synapse.nix
@@ -1,4 +1,4 @@
-{ secret, ... }:
+{ config, ... }:
 
 {
   services.matrix-synapse = {
@@ -26,28 +26,6 @@
         }
       ];
 
-      database = {
-        name = "psycopg2";
-        args = {
-          host = "10.99.99.3";
-          database = "synapse";
-          inherit (secret.synapse.database) user;
-          inherit (secret.synapse.database) password;
-          cp_min = 5;
-          cp_max = 10;
-        };
-      };
-
-      email = {
-        smtp_host = "smtp.mailgun.org";
-        smtp_port = 465;
-        smtp_user = secret.synapse.email.user;
-        smtp_pass = secret.synapse.email.password;
-        force_tls = true;
-        notif_from = "%(app)s <matrix@mg.kempkens.io>";
-        app_name = "kempkens_matrix";
-      };
-
       thumbnail_sizes = [
         { width = 32; height = 32; method = "crop"; }
         { width = 96; height = 96; method = "crop"; }
@@ -84,10 +62,6 @@
 
       enable_registration = false;
 
-      inherit (secret.synapse) registration_shared_secret;
-      inherit (secret.synapse) macaroon_secret_key;
-      inherit (secret.synapse) form_secret;
-
       enable_metrics = false;
       report_stats = false;
 
@@ -102,6 +76,8 @@
         msc2409_to_device_messages_enabled = true;
       };
     };
+
+    extraConfigFiles = [ config.age.secrets.synapse-extra-config.path ];
   };
 
   networking.firewall.allowedTCPPorts = [ 8008 ];