depot/hosts/VEGAS/services/matrix/default.nix

{ config, lib, pkgs, tools, ... }:
let
  inherit (tools.meta) domain;
  listener = {
    port = 8008;
    bind_addresses = lib.singleton "127.0.0.1";
    type = "http";
    tls = false;
    x_forwarded = true;
    resources = lib.singleton {
      names = [ "client" "federation" ];
      compress = false;
    };
  };
  clientConfig = {
    "m.homeserver".base_url = "https://matrix.${domain}:443";
    "m.integrations".managers = [{
      api_url = "https://dimension.t2bot.io/api/v1/scalar";
      ui_url = "https://dimension.t2bot.io/riot";
    }];
  } // lib.optionalAttrs config.services.jitsi-meet.enable {
    "im.vector.riot.jitsi".preferredDomain = config.services.jitsi-meet.hostName;
  };
  clientConfigJSON = pkgs.writeText "matrix-client-config.json" (builtins.toJSON clientConfig);
  cfg = config.services.matrix-synapse;
in {
  imports = [
    ./coturn.nix
    ./bridges/discord.nix
    ./federation.nix
    ./web-client.nix
  ];

  age.secrets = {
    synapse-ldap = {
      file = ../../../../secrets/synapse-ldap.age;
      owner = "matrix-synapse";
      group = "matrix-synapse";
      mode = "0400";
    };
    synapse-db = {
      file = ../../../../secrets/synapse-db.age;
      owner = "matrix-synapse";
      group = "matrix-synapse";
      mode = "0400";
    };
    synapse-turn = {
      file = ../../../../secrets/synapse-turn.age;
      owner = "matrix-synapse";
      group = "matrix-synapse";
      mode = "0400";
    };
    synapse-keys = {
      file = ../../../../secrets/synapse-keys.age;
      owner = "matrix-synapse";
      group = "matrix-synapse";
      mode = "0400";
    };
  };
  services.matrix-synapse = {
    enable = true;
    plugins = [ pkgs.matrix-synapse-plugins.matrix-synapse-ldap3 ];

    settings = {
      server_name = domain;
      listeners = lib.singleton listener;
      url_preview_enabled = true;
      experimental_features.spaces_enabled = true;
      admin_contact = "mailto:admins@${domain}";
      max_upload_size = "32M";
      max_spider_size = "10M";
      emable_registration = true;
      allow_guest_access = true;
      push.include_content = true;
      group_creation_prefix = "unofficial/";
      app_service_config_files =  [
        "/etc/synapse/discord-registration.yaml"
      ];
      turn_uris = let
        combinations = lib.cartesianProductOfSets {
          proto = [ "udp" "tcp" ];
          scheme = [ "turns" "turn" ];
        };
        makeTurnServer = x: "${x.scheme}:turn.${domain}?transport=${x.proto}";
      in map makeTurnServer combinations;
    };

    extraConfigFiles = map (x: config.age.secrets.${x}.path) [
      "synapse-ldap"
      "synapse-db"
      "synapse-turn"
      "synapse-keys"
    ]; 
  };

  services.nginx.virtualHosts = tools.nginx.mappers.mapSubdomains {
    matrix = tools.nginx.vhosts.basic // {
      locations."/".return = "204";
      locations."/_matrix" = {
        proxyPass = "http://127.0.0.1:8008";
        extraConfig = "client_max_body_size ${cfg.settings.max_upload_size};";
      };
      locations."= /.well-known/matrix/client".alias = clientConfigJSON;
    };
  };
  systemd.services = lib.genAttrs [ "coturn" "matrix-appservice-discord" "matrix-synapse" ] (_: {
    serviceConfig = {
      Slice = "communications.slice";
    };
  });
}