blob: e308a7b677c052615ae754203b10ce18f2330de5 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
|
{ config, lib, pkgs, ... }:
let
botConfig = pkgs.writeText "ntfy-matrix-bot.toml" ''
matrix_homeserver = "https://conduit.stuebinm.eu"
matrix_username = "testbot"
matrix_rooms = [ "#test:conduit.stuebinm.eu" ]
ntfy_server = "https://ping.stuebinm.eu"
ntfy_topics = [ "monit" ]
'';
in
{
services.matrix-conduit = {
enable = true;
extraEnvironment.RUST_BACKTRACE = "yes";
settings.global = {
server_name = "conduit.stuebinm.eu";
trusted_servers = [ ]; # TODO what does this mean?
port = 6167;
allow_registration = false;
};
};
sops.secrets."ntfy-matrix-bot/env" = {};
systemd.services.ntfy-matrix-bot = {
enable = true;
wantedBy = [ "multi-user.target" ];
serviceConfig = {
ExecStart = "${lib.getExe pkgs.ntfy-matrix-bot} -c ${botConfig}";
Type = "simple";
RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ];
DynamicUser = true;
BindPaths = botConfig;
EnvironmentFile = "/run/secrets/ntfy-matrix-bot/env";
Restart = "always";
};
environment.RUST_LOG = "ntfy_matrix_bot=info";
};
services.nginx.virtualHosts."conduit.stuebinm.eu" = {
locations."/_matrix/".proxyPass = "http://localhost:6167";
enableACME = true;
forceSSL = true;
listen = [
{
addr = "[::]";
port = 443;
ssl = true;
}
{
addr = "[::]";
port = 8448;
ssl = true;
}
];
};
networking.firewall.allowedTCPPorts = [ 8448 ];
}
|
