From 3ed11cda2b71d92672d33adc86de2dccb197211e Mon Sep 17 00:00:00 2001 From: Lorenzo Good Date: Tue, 24 Feb 2026 14:16:03 -0800 Subject: [PATCH] Add matrix homeserver (disabled). --- common/services/continuwuity.nix | 119 +++++++++++++++++++++ machines/lebesgue/config/configuration.nix | 14 +++ machines/lebesgue/config/routing.nix | 6 ++ machines/lebesgue/config/secrets.nix | 4 + machines/lebesgue/secrets/main.yaml | 5 +- 5 files changed, 146 insertions(+), 2 deletions(-) create mode 100644 common/services/continuwuity.nix diff --git a/common/services/continuwuity.nix b/common/services/continuwuity.nix new file mode 100644 index 0000000..b739d86 --- /dev/null +++ b/common/services/continuwuity.nix @@ -0,0 +1,119 @@ +{ + config, + lib, + pkgs, + ... +}: +let + inherit (lib) + mkEnableOption + mkIf + mkOption + types + ; + + cfg = config.foehammer.services.continuwuity; +in +{ + options.foehammer.services.continuwuity = { + enable = mkEnableOption "Enable matrix homeserver"; + + port = mkOption { + type = lib.types.port; + default = 6167; + description = '' + What external port to serve over. + ''; + }; + + domain = mkOption { + type = lib.types.str; + }; + + signups = mkOption { + type = lib.types.bool; + default = false; + }; + + allowEncryption = mkOption { + type = lib.types.bool; + default = false; + }; + + ldap = { + addr = mkOption { + type = types.str; + description = "LDAP URL"; + }; + + passwordFile = mkOption { + type = types.nullOr types.path; + default = null; + description = "Path to LDAP service account password file"; + }; + + baseDN = mkOption { + type = types.str; + example = "DC=example,DC=com"; + }; + + user = mkOption { + type = types.str; + example = "UID=authelia,OU=people,DC=example,DC=com"; + }; + + filter = mkOption { + type = types.str; + default = "(&(objectClass=person)(memberOf=matrix))"; + }; + + admin_filter = mkOption { + type = types.str; + default = "(&(objectClass=person)(memberOf=matrix-admin))"; + }; + + uid_attribute = mkOption { + type = types.str; + default = "uid"; + }; + + display_attribute = mkOption { + type = types.str; + default = "cn"; + }; + }; + }; + + config = mkIf cfg.enable { + services.matrix-continuwuity = { + enable = true; + settings = { + global = { + server_name = cfg.domain; + port = [ cfg.port ]; + allow_registration = false; + allow_encryption = cfg.allowEncryption; + allow_federation = false; + new_user_displayname_suffix = "😃"; + database_backup_path = "/opt/continuwuity-db-backups"; + require_auth_for_profile_requests = true; + allow_room_creation = true; + + ldap = { + enable = true; + ldap_only = true; + uri = cfg.ldap.addr; + base_dn = cfg.ldap.baseDN; + bind_dn = cfg.ldap.user; + bind_password_file = cfg.ldap.passwordFile; + filter = cfg.ldap.filter; + uid_attribute = cfg.ldap.uid_attribute; + name_attribute = cfg.ldap.display_attribute; + admin_base_dn = cfg.ldap.baseDN; + admin_filter = cfg.ldap.admin_filter; + }; + }; + }; + }; + }; +} diff --git a/machines/lebesgue/config/configuration.nix b/machines/lebesgue/config/configuration.nix index ad4205e..f540ec0 100644 --- a/machines/lebesgue/config/configuration.nix +++ b/machines/lebesgue/config/configuration.nix @@ -41,6 +41,20 @@ }; }; + services.continuwuity = { + enable = false; + domain = "matrix.foehammer.me"; + signups = false; + allowEncryption = false; + + ldap = { + addr = "ldap://localhost:${toString config.foehammer.services.lldap.ldap_port}"; + baseDN = config.foehammer.services.lldap.base_dn; + user = "UID=authelia,OU=people,${config.foehammer.services.lldap.base_dn}"; + passwordFile = config.sops.secrets.continuwuity-ldap-password.path; + }; + }; + services.lldap = { enable = true; url = "https://lldap.foehammer.me"; diff --git a/machines/lebesgue/config/routing.nix b/machines/lebesgue/config/routing.nix index 90c5887..991db53 100644 --- a/machines/lebesgue/config/routing.nix +++ b/machines/lebesgue/config/routing.nix @@ -24,6 +24,12 @@ reverse_proxy :${toString config.foehammer.services.forgejo.port} ''; }; + "matrix.foehammer.me" = { + extraConfig = '' + reverse_proxy :${toString config.foehammer.services.continuwuity.port} + ''; + }; + }; }; } diff --git a/machines/lebesgue/config/secrets.nix b/machines/lebesgue/config/secrets.nix index efe5b3f..be388df 100644 --- a/machines/lebesgue/config/secrets.nix +++ b/machines/lebesgue/config/secrets.nix @@ -35,6 +35,10 @@ authelia-session-secret = autheliaSecret; authelia-storage-encryption = autheliaSecret; authelia-lldap-password = autheliaSecret; + + # continuwuity-ldap-password = { + # owner = "continuwuity"; + # }; }; }; } diff --git a/machines/lebesgue/secrets/main.yaml b/machines/lebesgue/secrets/main.yaml index 37ce6dd..6945f9a 100644 --- a/machines/lebesgue/secrets/main.yaml +++ b/machines/lebesgue/secrets/main.yaml @@ -5,6 +5,7 @@ restic-password: ENC[AES256_GCM,data:Ympe5/hJxOzJp7IeJy5mZy0fMIrnV+3cWJo1uKwbHHD restic-repository: ENC[AES256_GCM,data:KkFaam8iltY9nz89sVxk4u0xZ46Sq+7UsOY/9wieASD5A2FRruou7BiudX9X4hRA2RMTctO8aqYkrg==,iv:mIZ9z7BJV9s+wSiVMnzYAWM1/zsa6C+RCK1UhSiJVxI=,tag:S7tedxcfd/UaQ5hMEYfBVQ==,type:str] restic-env: ENC[AES256_GCM,data:KW9ma36zmHJF3xBStpoStDRQqg34wlMJMVSYfbLSnWq26R6e6eGf3+kTVkobhn/bqL6ZYi8ctlyvDS8IOz8VveYogsqxZ7/LK62mA0d9I3xEZMG7eNQ8M1PdeZ9RqAUgFJU=,iv:RxwvZ2vNuwmUc3haK2Ub8vHk9UQhjepLCwsfIcSJg9s=,tag:Tvq2RDh8mJ3jGhmpL1uuCA==,type:str] lldap-admin-password: ENC[AES256_GCM,data:OUGtguGSBt7DXZ2eHZ3pq+NCHGFzM4HRSmAAUKulf0v5GGi1we9iMZb54ZFqn57W/t3+nesq/zMudt2Bry7wJQ==,iv:4Mop0qpSBzYnoeMPPoHHoDP1LgCwXW4vs+o6Pd2jRlM=,tag:t+nhS9uhvdibp6PuHMfPrA==,type:str] +continuwuity-ldap-password: ENC[AES256_GCM,data:W2QlKPPl+jk+xp9TI2fVcmBLPC2NczKUadKI4oZzkCiEBWu3GjdQ6dVw9xebRDTY6EwGEvawptdxWyEerhGUtuvRYG0txIK76I4ImBIg0NW6R6Ujwa9LNw==,iv:bhjFHmXWbamzQsoxROAfQMcIkxx7GoYCa6Eymrh7lnw=,tag:nrvtOkVUxob1+L5IsoHL7Q==,type:str] sops: age: - recipient: age1kjy9wym6cmz6wqmewws4ledsne47c0e4sr0ksmm66rff3u2f6u3qxvnyg9 @@ -16,8 +17,8 @@ sops: L2VhMXV4WityYUFDZytxVTJHOXZGVVkKgbKR56dsru6U7I4KpnxfxQsswFwJsTM7 8dzAaFl30mdRwFIH9kzdY3XxyYsJ0Yr0x3xwJ8mI4rjgpI8S9ihJFw== -----END AGE ENCRYPTED FILE----- - lastmodified: "2026-01-01T02:28:46Z" - mac: ENC[AES256_GCM,data:S/pSDlf0DUWvOfBbf1xmtzh46nBKXzIKg/xyLvmah5EnsxlfrQhvhjN628HbexluXDWe3a4QAWv7i4awu+61zem41gpWCy8vJJbKBRnNKBnWEPvZKUJwLlLD7+B8jWttxaUlX/Vz/oyWZR35oD2D4c9Bx5MkzMqxb4w5M1DEzVo=,iv:jqL8NVjw3TK1Oue4Jgc5GXLezNDUm1bKuEBKI7zKhRY=,tag:SMoezaPc+iS2FqSqHHTP1w==,type:str] + lastmodified: "2026-02-24T22:06:05Z" + mac: ENC[AES256_GCM,data:t9GypuF0o5QhFk/+XFft/BeS4Do+igWNayvf879trkk3KpbML0nT5aoNW3Qjr0FL7pTZciaoDA2PcshYyohO+u5zPDpII4vz0xmEkbO6B2xDntusWYnAR2EKzVGTukt2dMfEMc1/IKtosl9tPBdLcUtYENg6hAaOCFR+cejcp2A=,iv:MYrDhWL1rlMqaD0l0rMPMsTfYReSCcasJ14DufsDUwg=,tag:Sl9PR1XQhw+taQBrlLnMQw==,type:str] pgp: - created_at: "2025-02-03T18:58:54Z" enc: |-