Move Synapse to webserver

container/matrix/config.nix

@@ -1,16 +0,0 @@
-{ secret, ... }:
-
-{
-  # Synapse
-
-  systemd.tmpfiles.rules = [
-    "d /etc/container-matrix/synapse 0755 991 991"
-  ];
-
-  environment.etc."container-matrix/synapse/homeserver.yaml" = {
-    source = ../../secret/container/matrix/config/homeserver.yaml;
-    mode = "0640";
-    uid = 991;
-    gid = 991;
-  };
-}

container/matrix/default.nix

@@ -1,32 +0,0 @@
-let
-  secret = import ../../secret/container/matrix;
-  custom-config = import ./config.nix { inherit secret; };
-in
-{
-  virtualisation.arion.projects.matrix.settings = {
-    services = {
-      synapse = {
-        service = {
-          image = "matrixdotorg/synapse:latest";
-          container_name = "synapse";
-          restart = "unless-stopped";
-          volumes = [
-            "/etc/container-matrix/synapse:/data"
-          ];
-          labels = {
-            "traefik.enable" = "true";
-            "traefik.http.routers.matrix.rule" = "Host(`matrix.kempkens.io`)";
-            "traefik.http.routers.matrix.entrypoints" = "websecure";
-            "traefik.http.routers.matrix.service" = "matrix-web";
-            "traefik.http.routers.matrix.tls.certresolver" = "cfresolver";
-            "traefik.http.routers.matrix.tls.domains[0].main" = "kempkens.io";
-            "traefik.http.routers.matrix.tls.domains[0].sans" = "*.kempkens.io";
-            "traefik.http.routers.matrix.middlewares" = "content-compression@file";
-            "traefik.http.services.matrix-web.loadbalancer.server.port" = "8008";
-            "com.centurylinklabs.watchtower.enable" = "true";
-          };
-        };
-      };
-    };
-  };
-} // custom-config

container/webserver/config.nix

@@ -1,6 +1,12 @@
 { secret, ... }:
 
 {
+  systemd.tmpfiles.rules = [
+    "d /etc/container-webserver/weewx 0755 421 421"
+    "d /etc/container-webserver/weewx/html 0755 421 421"
+    "d /etc/container-matrix/synapse 0755 991 991"
+  ];
+
   # mosquitto
 
   environment.etc."container-webserver/mosquitto/mosquitto.conf" = {
@@ -82,15 +88,19 @@
 
   # weewx
 
-  systemd.tmpfiles.rules = [
-    "d /etc/container-webserver/weewx 0755 421 421"
-    "d /etc/container-webserver/weewx/html 0755 421 421"
-  ];
-
   environment.etc."container-webserver/weewx/weewx.conf" = {
     source = ../../secret/container/webserver/config/weewx.conf;
     mode = "0644";
     uid = 421;
     gid = 421;
   };
+
+  # Matrix: Synapse
+
+  environment.etc."container-matrix/synapse/homeserver.yaml" = {
+    source = ../../secret/container/webserver/config/matrix/homeserver.yaml;
+    mode = "0640";
+    uid = 991;
+    gid = 991;
+  };
 }

container/webserver/default.nix

@@ -57,7 +57,7 @@ in
           command = [ "--configFile=/traefik.toml" ];
           environment = secret.container.webserver.traefik.environment;
           volumes = [
-            "/var/run/docker.sock:/var/run/docker.sock"
+            "/var/run/docker.sock:/var/run/docker.sock:ro"
             "/etc/container-webserver/traefik/traefik.toml:/traefik.toml:ro"
             "/etc/container-webserver/traefik/acme.json:/acme.json"
             "/etc/container-webserver/traefik/custom:/custom_config:ro"
@@ -132,6 +132,36 @@ in
           labels = secret.container.webserver.weewx.labels;
         };
       };
+
+      # Matrix
+
+      synapse = {
+        service = {
+          image = "matrixdotorg/synapse:latest";
+          container_name = "synapse";
+          restart = "unless-stopped";
+          depends_on = [
+            "ipv6nat"
+            "traefik"
+          ];
+          networks = [ "webserver" ];
+          volumes = [
+            "/etc/container-matrix/synapse:/data"
+          ];
+          labels = {
+            "traefik.enable" = "true";
+            "traefik.http.routers.matrix.rule" = "Host(`matrix.kempkens.io`)";
+            "traefik.http.routers.matrix.entrypoints" = "websecure";
+            "traefik.http.routers.matrix.service" = "matrix-web";
+            "traefik.http.routers.matrix.tls.certresolver" = "cfresolver";
+            "traefik.http.routers.matrix.tls.domains[0].main" = "kempkens.io";
+            "traefik.http.routers.matrix.tls.domains[0].sans" = "*.kempkens.io";
+            "traefik.http.routers.matrix.middlewares" = "content-compression@file";
+            "traefik.http.services.matrix-web.loadbalancer.server.port" = "8008";
+            "com.centurylinklabs.watchtower.enable" = "true";
+          };
+        };
+      };
     };
 
     networks.webserver = {

system/hosts/sail.nix

@@ -16,7 +16,6 @@ in
 
     ../nixos/arion.nix
     ../../container/webserver
-    ../../container/matrix
   ];
 
   nix = {