Add matrix homeserver (disabled).

common/services/continuwuity.nix

@@ -0,0 +1,119 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  inherit (lib)
+    mkEnableOption
+    mkIf
+    mkOption
+    types
+    ;
+
+  cfg = config.foehammer.services.continuwuity;
+in
+{
+  options.foehammer.services.continuwuity = {
+    enable = mkEnableOption "Enable matrix homeserver";
+
+    port = mkOption {
+      type = lib.types.port;
+      default = 6167;
+      description = ''
+        What external port to serve over.
+      '';
+    };
+
+    domain = mkOption {
+      type = lib.types.str;
+    };
+
+    signups = mkOption {
+      type = lib.types.bool;
+      default = false;
+    };
+
+    allowEncryption = mkOption {
+      type = lib.types.bool;
+      default = false;
+    };
+
+    ldap = {
+      addr = mkOption {
+        type = types.str;
+        description = "LDAP URL";
+      };
+
+      passwordFile = mkOption {
+        type = types.nullOr types.path;
+        default = null;
+        description = "Path to LDAP service account password file";
+      };
+
+      baseDN = mkOption {
+        type = types.str;
+        example = "DC=example,DC=com";
+      };
+
+      user = mkOption {
+        type = types.str;
+        example = "UID=authelia,OU=people,DC=example,DC=com";
+      };
+
+      filter = mkOption {
+        type = types.str;
+        default = "(&(objectClass=person)(memberOf=matrix))";
+      };
+
+      admin_filter = mkOption {
+        type = types.str;
+        default = "(&(objectClass=person)(memberOf=matrix-admin))";
+      };
+
+      uid_attribute = mkOption {
+        type = types.str;
+        default = "uid";
+      };
+
+      display_attribute = mkOption {
+        type = types.str;
+        default = "cn";
+      };
+    };
+  };
+
+  config = mkIf cfg.enable {
+    services.matrix-continuwuity = {
+      enable = true;
+      settings = {
+        global = {
+          server_name = cfg.domain;
+          port = [ cfg.port ];
+          allow_registration = false;
+          allow_encryption = cfg.allowEncryption;
+          allow_federation = false;
+          new_user_displayname_suffix = "😃";
+          database_backup_path = "/opt/continuwuity-db-backups";
+          require_auth_for_profile_requests = true;
+          allow_room_creation = true;
+
+          ldap = {
+            enable = true;
+            ldap_only = true;
+            uri = cfg.ldap.addr;
+            base_dn = cfg.ldap.baseDN;
+            bind_dn = cfg.ldap.user;
+            bind_password_file = cfg.ldap.passwordFile;
+            filter = cfg.ldap.filter;
+            uid_attribute = cfg.ldap.uid_attribute;
+            name_attribute = cfg.ldap.display_attribute;
+            admin_base_dn = cfg.ldap.baseDN;
+            admin_filter = cfg.ldap.admin_filter;
+          };
+        };
+      };
+    };
+  };
+}

machines/lebesgue/config/configuration.nix

@@ -41,6 +41,20 @@
       };
     };
 
+    services.continuwuity = {
+      enable = false;
+      domain = "matrix.foehammer.me";
+      signups = false;
+      allowEncryption = false;
+
+      ldap = {
+        addr = "ldap://localhost:${toString config.foehammer.services.lldap.ldap_port}";
+        baseDN = config.foehammer.services.lldap.base_dn;
+        user = "UID=authelia,OU=people,${config.foehammer.services.lldap.base_dn}";
+        passwordFile = config.sops.secrets.continuwuity-ldap-password.path;
+      };
+    };
+
     services.lldap = {
       enable = true;
       url = "https://lldap.foehammer.me";

machines/lebesgue/config/routing.nix

@@ -24,6 +24,12 @@
           reverse_proxy :${toString config.foehammer.services.forgejo.port}
         '';
       };
+      "matrix.foehammer.me" = {
+        extraConfig = ''
+          reverse_proxy :${toString config.foehammer.services.continuwuity.port}
+        '';
+      };
+
     };
   };
 }

machines/lebesgue/config/secrets.nix

@@ -35,6 +35,10 @@
         authelia-session-secret = autheliaSecret;
         authelia-storage-encryption = autheliaSecret;
         authelia-lldap-password = autheliaSecret;
+
+        # continuwuity-ldap-password = {
+        #   owner = "continuwuity";
+        # };
       };
   };
 }

machines/lebesgue/secrets/main.yaml

@@ -5,6 +5,7 @@ restic-password: ENC[AES256_GCM,data:Ympe5/hJxOzJp7IeJy5mZy0fMIrnV+3cWJo1uKwbHHD
 restic-repository: ENC[AES256_GCM,data:KkFaam8iltY9nz89sVxk4u0xZ46Sq+7UsOY/9wieASD5A2FRruou7BiudX9X4hRA2RMTctO8aqYkrg==,iv:mIZ9z7BJV9s+wSiVMnzYAWM1/zsa6C+RCK1UhSiJVxI=,tag:S7tedxcfd/UaQ5hMEYfBVQ==,type:str]
 restic-env: ENC[AES256_GCM,data:KW9ma36zmHJF3xBStpoStDRQqg34wlMJMVSYfbLSnWq26R6e6eGf3+kTVkobhn/bqL6ZYi8ctlyvDS8IOz8VveYogsqxZ7/LK62mA0d9I3xEZMG7eNQ8M1PdeZ9RqAUgFJU=,iv:RxwvZ2vNuwmUc3haK2Ub8vHk9UQhjepLCwsfIcSJg9s=,tag:Tvq2RDh8mJ3jGhmpL1uuCA==,type:str]
 lldap-admin-password: ENC[AES256_GCM,data:OUGtguGSBt7DXZ2eHZ3pq+NCHGFzM4HRSmAAUKulf0v5GGi1we9iMZb54ZFqn57W/t3+nesq/zMudt2Bry7wJQ==,iv:4Mop0qpSBzYnoeMPPoHHoDP1LgCwXW4vs+o6Pd2jRlM=,tag:t+nhS9uhvdibp6PuHMfPrA==,type:str]
+continuwuity-ldap-password: ENC[AES256_GCM,data:W2QlKPPl+jk+xp9TI2fVcmBLPC2NczKUadKI4oZzkCiEBWu3GjdQ6dVw9xebRDTY6EwGEvawptdxWyEerhGUtuvRYG0txIK76I4ImBIg0NW6R6Ujwa9LNw==,iv:bhjFHmXWbamzQsoxROAfQMcIkxx7GoYCa6Eymrh7lnw=,tag:nrvtOkVUxob1+L5IsoHL7Q==,type:str]
 sops:
     age:
         - recipient: age1kjy9wym6cmz6wqmewws4ledsne47c0e4sr0ksmm66rff3u2f6u3qxvnyg9
@@ -16,8 +17,8 @@ sops:
             L2VhMXV4WityYUFDZytxVTJHOXZGVVkKgbKR56dsru6U7I4KpnxfxQsswFwJsTM7
             8dzAaFl30mdRwFIH9kzdY3XxyYsJ0Yr0x3xwJ8mI4rjgpI8S9ihJFw==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-01-01T02:28:46Z"
-    mac: ENC[AES256_GCM,data:S/pSDlf0DUWvOfBbf1xmtzh46nBKXzIKg/xyLvmah5EnsxlfrQhvhjN628HbexluXDWe3a4QAWv7i4awu+61zem41gpWCy8vJJbKBRnNKBnWEPvZKUJwLlLD7+B8jWttxaUlX/Vz/oyWZR35oD2D4c9Bx5MkzMqxb4w5M1DEzVo=,iv:jqL8NVjw3TK1Oue4Jgc5GXLezNDUm1bKuEBKI7zKhRY=,tag:SMoezaPc+iS2FqSqHHTP1w==,type:str]
+    lastmodified: "2026-02-24T22:06:05Z"
+    mac: ENC[AES256_GCM,data:t9GypuF0o5QhFk/+XFft/BeS4Do+igWNayvf879trkk3KpbML0nT5aoNW3Qjr0FL7pTZciaoDA2PcshYyohO+u5zPDpII4vz0xmEkbO6B2xDntusWYnAR2EKzVGTukt2dMfEMc1/IKtosl9tPBdLcUtYENg6hAaOCFR+cejcp2A=,iv:MYrDhWL1rlMqaD0l0rMPMsTfYReSCcasJ14DufsDUwg=,tag:Sl9PR1XQhw+taQBrlLnMQw==,type:str]
     pgp:
         - created_at: "2025-02-03T18:58:54Z"
           enc: |-