Add matrix server

2026-07-28 12:29:22 +02:00
parent 31e5f1f10c
commit 7fb1498f20
6 changed files with 106 additions and 1 deletions
@@ -0,0 +1,72 @@
+{config, ...}: {
+  services.matrix-tuwunel = {
+    enable = true;
+    settings.global = {
+      server_name = "nicknase27.com";
+      address = ["0.0.0.0"];
+      port = [6167];
+      allow_federation = true;
+      allow_registration = true;
+      new_user_displayname_suffix = " ";
+      registration_token_file = "${config.age.secrets.matrix-register.path}";
+      unix_socket_path = "/run/tuwunel/tuwunel.sock";
+      unix_socket_perms = 660;
+      well_known_client = "https://nicknase27.com";
+      well_known_server = "nicknase27.com:443";
+      msc4140_enabled = true;
+    };
+  };
+
+  services.livekit = {
+    enable = true;
+    keyFile = config.age.secrets.livekit-keys.path;
+    openFirewall = true;
+    settings = {
+      port = 7880;
+      bind_addresses = ["0.0.0.0"];
+      rtc = {
+        tcp_port = 7881;
+        port_range_start = 50100;
+        port_range_end = 50200;
+
+        use_external_ip = false;
+        node_ip = "130.61.151.118";
+      };
+    };
+  };
+
+  services.lk-jwt-service = {
+    enable = true;
+    port = 8081;
+    keyFile = config.age.secrets.livekit-keys.path;
+    livekitUrl = "wss://matrix-rtc.nicknase27.com";
+  };
+
+  # Pass homeserver restriction environment variable to native JWT service
+  systemd.services.lk-jwt-service.environment = {
+    LIVEKIT_FULL_ACCESS_HOMESERVERS = "nicknase27.com";
+  };
+
+  age.secrets = {
+    matrix-register = {
+      file = ../../secrets/matrix-register.age;
+      path = "/run/secrets/matrix-register";
+      owner = "tuwunel";
+      group = "tuwunel";
+    };
+    livekit-keys = {
+      file = ../../secrets/livekit-keys.age;
+      path = "/run/secrets/livekit-keys";
+    };
+  };
+
+  networking.firewall = {
+    allowedTCPPorts = [7881];
+    allowedUDPPortRanges = [
+      {
+        from = 50100;
+        to = 50200;
+      }
+    ];
+  };
+}