From 234ac6965a3731d84597b18f09aa38b4f1e53bd8 Mon Sep 17 00:00:00 2001
From: Qubasa <consulting@qube.email>
Date: Mon, 19 Aug 2024 11:33:17 +0200
Subject: [PATCH] clanModules: Init nginx module. matrix-synapse: don't assume
 domain names

---
 clanModules/matrix-synapse/default.nix | 43 ++++++++++----------
 clanModules/nginx/README.md            |  3 ++
 clanModules/nginx/default.nix          | 55 ++++++++++++++++++++++++++
 3 files changed, 81 insertions(+), 20 deletions(-)
 create mode 100644 clanModules/nginx/README.md
 create mode 100644 clanModules/nginx/default.nix

diff --git a/clanModules/matrix-synapse/default.nix b/clanModules/matrix-synapse/default.nix
index cceb465c1..d623320b9 100644
--- a/clanModules/matrix-synapse/default.nix
+++ b/clanModules/matrix-synapse/default.nix
@@ -6,25 +6,31 @@
 }:
 let
   cfg = config.clan.matrix-synapse;
-  nginx-vhost = "matrix.${config.clan.matrix-synapse.domain}";
   element-web =
     pkgs.runCommand "element-web-with-config" { nativeBuildInputs = [ pkgs.buildPackages.jq ]; }
       ''
         cp -r ${pkgs.element-web} $out
         chmod -R u+w $out
-        jq '."default_server_config"."m.homeserver" = { "base_url": "https://${nginx-vhost}:443", "server_name": "${config.clan.matrix-synapse.domain}" }' \
+        jq '."default_server_config"."m.homeserver" = { "base_url": "https://${cfg.domain.server}:443", "server_name": "${cfg.domain.server}" }' \
           > $out/config.json < ${pkgs.element-web}/config.json
-        ln -s $out/config.json $out/config.${nginx-vhost}.json
+        ln -s $out/config.json $out/config.${cfg.domain.server}.json
       '';
 in
 # FIXME: This was taken from upstream. Drop this when our patch is upstream
 {
   options.services.matrix-synapse.package = lib.mkOption { readOnly = false; };
   options.clan.matrix-synapse = {
-    domain = lib.mkOption {
-      type = lib.types.str;
-      description = "The domain name of the matrix server";
-      example = "example.com";
+    domain = {
+      server = lib.mkOption {
+        type = lib.types.str;
+        description = "The domain name of the matrix server";
+        example = "matrix.example.com";
+      };
+      client = lib.mkOption {
+        type = lib.types.str;
+        description = "The domain name of the matrix client";
+        example = "element.example.com";
+      };
     };
     users = lib.mkOption {
       default = { };
@@ -61,14 +67,14 @@ in
       "matrix-synapse"
       "enable"
     ] "Importing the module will already enable the service.")
-
-    ../postgresql
+    ../nginx
   ];
   config = {
     services.matrix-synapse = {
       enable = true;
       settings = {
-        server_name = cfg.domain;
+        server_name = cfg.domain.server;
+        enable_registration = false;
         database = {
           args.user = "matrix-synapse";
           args.database = "matrix-synapse";
@@ -169,18 +175,13 @@ in
         ];
       };
 
-    networking.firewall.allowedTCPPorts = [
-      80
-      443
-    ];
-
     services.nginx = {
       enable = true;
       virtualHosts = {
-        ${cfg.domain} = {
+        "${cfg.domain.server}" = {
           locations."= /.well-known/matrix/server".extraConfig = ''
             add_header Content-Type application/json;
-            return 200 '${builtins.toJSON { "m.server" = "matrix.${cfg.domain}:443"; }}';
+            return 200 '${builtins.toJSON { "m.server" = "${cfg.domain.server}:443"; }}';
           '';
           locations."= /.well-known/matrix/client".extraConfig = ''
             add_header Content-Type application/json;
@@ -188,7 +189,7 @@ in
             return 200 '${
               builtins.toJSON {
                 "m.homeserver" = {
-                  "base_url" = "https://${nginx-vhost}";
+                  "base_url" = "https://${cfg.domain.server}";
                 };
                 "m.identity_server" = {
                   "base_url" = "https://vector.im";
@@ -196,12 +197,14 @@ in
               }
             }';
           '';
-        };
-        ${nginx-vhost} = {
           forceSSL = true;
           enableACME = true;
           locations."/_matrix".proxyPass = "http://localhost:8008";
           locations."/_synapse".proxyPass = "http://localhost:8008";
+        };
+        "${cfg.domain.client}" = {
+          forceSSL = true;
+          enableACME = true;
           locations."/".root = element-web;
         };
       };
diff --git a/clanModules/nginx/README.md b/clanModules/nginx/README.md
new file mode 100644
index 000000000..4c8ca5a36
--- /dev/null
+++ b/clanModules/nginx/README.md
@@ -0,0 +1,3 @@
+---
+description = "Good defaults for the nginx webserver"
+---
diff --git a/clanModules/nginx/default.nix b/clanModules/nginx/default.nix
new file mode 100644
index 000000000..615ea89cc
--- /dev/null
+++ b/clanModules/nginx/default.nix
@@ -0,0 +1,55 @@
+{ config, lib, ... }:
+{
+
+  imports = [
+    (lib.mkRemovedOptionModule [
+      "clan"
+      "nginx"
+      "enable"
+    ] "Importing the module will already enable the service.")
+
+  ];
+  config = {
+    networking.firewall.allowedTCPPorts = [
+      443
+      80
+    ];
+
+    services.nginx = {
+      enable = true;
+
+      statusPage = lib.mkDefault true;
+      recommendedBrotliSettings = lib.mkDefault true;
+      recommendedGzipSettings = lib.mkDefault true;
+      recommendedOptimisation = lib.mkDefault true;
+      recommendedProxySettings = lib.mkDefault true;
+      recommendedTlsSettings = lib.mkDefault true;
+      recommendedZstdSettings = lib.mkDefault true;
+
+      # Nginx sends all the access logs to /var/log/nginx/access.log by default.
+      # instead of going to the journal!
+      commonHttpConfig = "access_log syslog:server=unix:/dev/log;";
+
+      resolver.addresses =
+        let
+          isIPv6 = addr: builtins.match ".*:.*:.*" addr != null;
+          escapeIPv6 = addr: if isIPv6 addr then "[${addr}]" else addr;
+          cloudflare = [
+            "1.1.1.1"
+            "2606:4700:4700::1111"
+          ];
+          resolvers =
+            if config.networking.nameservers == [ ] then cloudflare else config.networking.nameservers;
+        in
+        map escapeIPv6 resolvers;
+
+      sslDhparam = config.security.dhparams.params.nginx.path;
+    };
+
+    security.dhparams = {
+      enable = true;
+      params.nginx = { };
+    };
+  };
+
+}