{ config, ... }: let fqdn = "matrix.kempkens.io"; in { services.matrix-synapse = { enable = true; withJemalloc = true; settings = { server_name = "kempkens.io"; public_baseurl = "https://${fqdn}/"; listeners = [ { bind_addresses = [ "127.0.0.1" "10.88.0.1" ]; port = 8008; tls = false; type = "http"; x_forwarded = true; resources = [ { names = [ "client" "federation" ]; compress = false; } ]; } ]; database = { name = "psycopg2"; args = { host = "127.0.0.1"; }; }; thumbnail_sizes = [ { width = 32; height = 32; method = "crop"; } { width = 96; height = 96; method = "crop"; } { width = 320; height = 240; method = "scale"; } { width = 640; height = 480; method = "scale"; } { width = 800; height = 600; method = "scale"; } ]; url_preview_enabled = true; url_preview_ip_range_blacklist = [ "10.0.0.0/8" "94.130.142.168/32" "100.64.0.0/10" "127.0.0.0/8" "157.90.18.162/32" "169.254.0.0/16" "172.16.0.0/12" "192.0.0.0/24" "192.0.2.0/24" "192.168.0.0/16" "192.88.99.0/24" "198.18.0.0/15" "198.51.100.0/24" "2001:db8::/32" "203.0.113.0/24" "224.0.0.0/4" "::1/128" "fc00::/7" "fe80::/10" "fec0::/10" "ff00::/8" "2001:db8::/32" "2a01:4f8:c2c:989c::/64" "2a01:4f8:13b:2d81::/64" ]; enable_registration = false; enable_metrics = false; report_stats = false; app_service_config_files = [ "/var/lib/matrix-bridges/signal/registration.yaml" "/var/lib/matrix-bridges/whatsapp/registration.yaml" ]; experimental_features = { msc3202_device_masquerading = true; msc3202_transaction_extensions = true; msc2409_to_device_messages_enabled = true; }; }; extraConfigFiles = [ config.age.secrets.synapse-extra-config.path ]; sliding-sync = { enable = true; settings = { SYNCV3_SERVER = "https://${fqdn}"; SYNCV3_BINDADDR = "127.0.0.1:8009"; }; environmentFile = config.age.secrets.synapse-sliding-sync-config.path; }; }; systemd.services.matrix-synapse.after = [ "podman-wait-for-host-interface.service" ]; networking.firewall.interfaces."podman+".allowedTCPPorts = [ 8008 ]; services.nginx.virtualHosts."${fqdn}" = { quic = true; http3 = true; forceSSL = true; useACMEHost = "kempkens.io"; extraConfig = '' add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always; location ~* ^/(client/|_matrix/client/unstable/org.matrix.msc3575/sync) { proxy_pass http://127.0.0.1:8009; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; proxy_set_header X-Forwarded-Host $host; proxy_set_header X-Forwarded-Server $host; } location ~* ^(\/_matrix|\/_synapse\/client) { proxy_pass http://127.0.0.1:8008; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; proxy_set_header X-Forwarded-Host $host; proxy_set_header X-Forwarded-Server $host; client_max_body_size 50m; proxy_force_ranges on; } ''; }; }