From 7fb1498f20bfad820d52b1aedf722a53ba5c3509 Mon Sep 17 00:00:00 2001 From: nicknase27 Date: Tue, 28 Jul 2026 12:29:22 +0200 Subject: [PATCH] Add matrix server --- modules/services/caddy.nix | 32 +++++++++++++++- modules/services/default.nix | 1 + modules/services/matrix.nix | 72 +++++++++++++++++++++++++++++++++++ secrets/livekit-keys.age | Bin 0 -> 421 bytes secrets/matrix-register.age | Bin 0 -> 363 bytes secrets/secrets.nix | 2 + 6 files changed, 106 insertions(+), 1 deletion(-) create mode 100644 modules/services/matrix.nix create mode 100644 secrets/livekit-keys.age create mode 100644 secrets/matrix-register.age diff --git a/modules/services/caddy.nix b/modules/services/caddy.nix index 86a5d9d..baef0ee 100644 --- a/modules/services/caddy.nix +++ b/modules/services/caddy.nix @@ -22,7 +22,37 @@ virtualHosts = { "nicknase27.com" = { extraConfig = '' - respond "Blank" 200 + # CORS headers for Matrix .well-known lookup + @matrix path /.well-known/matrix/* + header @matrix { + Access-Control-Allow-Origin "*" + Access-Control-Allow-Methods "GET, POST, PUT, DELETE, OPTIONS" + Access-Control-Allow-Headers "X-Requested-With, Content-Type, Authorization" + Content-Type "application/json" + } + + # Matrix Client & Server Delegation + respond /.well-known/matrix/client `{"m.homeserver":{"base_url":"https://nicknase27.com"},"org.matrix.msc4143.rtc_foci":[{"type":"livekit","livekit_service_url":"https://rtc-jwt.nicknase27.com"}]}` + respond /.well-known/matrix/server `{"m.server":"nicknase27.com:443"}` + + # Route Matrix API requests to Tuwunel + reverse_proxy /_matrix/* localhost:6167 + + # Root domain catch-all (disable tuwunel landing page text) + respond / " " 200 + ''; + }; + # Reverse proxy for LiveKit JWT Service + "rtc-jwt.nicknase27.com" = { + extraConfig = '' + reverse_proxy localhost:8081 + ''; + }; + + # Reverse proxy for LiveKit WebSocket / Signal API + "matrix-rtc.nicknase27.com" = { + extraConfig = '' + reverse_proxy localhost:7880 ''; }; "nv.nicknase27.com" = { diff --git a/modules/services/default.nix b/modules/services/default.nix index 6e7c02e..fb142e8 100644 --- a/modules/services/default.nix +++ b/modules/services/default.nix @@ -8,6 +8,7 @@ ./vaultwarden.nix ./navidrome.nix ./homepage.nix + ./matrix.nix ./caddy.nix ./unifi.nix ./gitea.nix diff --git a/modules/services/matrix.nix b/modules/services/matrix.nix new file mode 100644 index 0000000..6111c24 --- /dev/null +++ b/modules/services/matrix.nix @@ -0,0 +1,72 @@ +{config, ...}: { + services.matrix-tuwunel = { + enable = true; + settings.global = { + server_name = "nicknase27.com"; + address = ["0.0.0.0"]; + port = [6167]; + allow_federation = true; + allow_registration = true; + new_user_displayname_suffix = " "; + registration_token_file = "${config.age.secrets.matrix-register.path}"; + unix_socket_path = "/run/tuwunel/tuwunel.sock"; + unix_socket_perms = 660; + well_known_client = "https://nicknase27.com"; + well_known_server = "nicknase27.com:443"; + msc4140_enabled = true; + }; + }; + + services.livekit = { + enable = true; + keyFile = config.age.secrets.livekit-keys.path; + openFirewall = true; + settings = { + port = 7880; + bind_addresses = ["0.0.0.0"]; + rtc = { + tcp_port = 7881; + port_range_start = 50100; + port_range_end = 50200; + + use_external_ip = false; + node_ip = "130.61.151.118"; + }; + }; + }; + + services.lk-jwt-service = { + enable = true; + port = 8081; + keyFile = config.age.secrets.livekit-keys.path; + livekitUrl = "wss://matrix-rtc.nicknase27.com"; + }; + + # Pass homeserver restriction environment variable to native JWT service + systemd.services.lk-jwt-service.environment = { + LIVEKIT_FULL_ACCESS_HOMESERVERS = "nicknase27.com"; + }; + + age.secrets = { + matrix-register = { + file = ../../secrets/matrix-register.age; + path = "/run/secrets/matrix-register"; + owner = "tuwunel"; + group = "tuwunel"; + }; + livekit-keys = { + file = ../../secrets/livekit-keys.age; + path = "/run/secrets/livekit-keys"; + }; + }; + + networking.firewall = { + allowedTCPPorts = [7881]; + allowedUDPPortRanges = [ + { + from = 50100; + to = 50200; + } + ]; + }; +} diff --git a/secrets/livekit-keys.age b/secrets/livekit-keys.age new file mode 100644 index 0000000000000000000000000000000000000000..87ce05bbd868cf17166a90cb9fd674da0be8cb86 GIT binary patch literal 421 zcmYdHPt{G$OD?J`D9Oyv)5|YP*Do{V(zR14F3!+RO))YxHMCSnDKtq9PFL_PaV!Zb zEip^7a58hZF!FNpbPF>|@hfr5PxNyt2@fgr3@dPR^{_N?vfxU~D-TUC@XZKy4l*xK zHmXdr3=gm@NDj{Q2=X-6HVhBV;{8N^@@`K`QtN;5B{#Nz=@*yUu{i8l( z+T1CJZm!Lkesbp2>9-$fNhWKaS#Qz#LgxkFX>os@7rBnLPaW3P-Qd|M^X_EHsvd?d G=UM<_yrW0} literal 0 HcmV?d00001 diff --git a/secrets/matrix-register.age b/secrets/matrix-register.age new file mode 100644 index 0000000000000000000000000000000000000000..10d8cf32bfd3a3a11cd21333944b557ceaba4646 GIT binary patch literal 363 zcmYdHPt{G$OD?J`D9Oyv)5|YP*Do{V(zR14F3!+RO))YxHMCSnDKtq9PFDy{F^i}& zat{oR42!BTE~$)k3wKR1C@9NJuX2iV&9C%HFEUAW^{^~(H{fy$@W^+o$PZ66&2;fJ zOAYjPbgC-Ic6QayGBF7)&kXa;4Dkr8a?7`HDMq)g!Y4F0Dp0}AB0SKu$i$^Qyu`cA zx7^t{v&h`JJUG|fCC9_p%rdd0$R|J7JKfLU$bc)~tRTo-yTrI6Kg=ySB`VO>E5k9_ z*uU7)(=^q)DAl*j%q67EGb+>6znn`~S69K?GsrnH*gPe;FsanIBFi$@(zU?H(z__g zF}uP{J2E0Q%GEd5#l);QAdu@#+K=5wdSg#J1V=7$=oZ)}@?=Skw~NHbrtjAbo6oIr wtBegzeim}_MAf?+^(`x`j)eyBsE0kTc(g^-S)a+5;RLVZr-Thb@)O