Serve Synapse Admin from quasar

flake.nix

@@ -15,6 +15,7 @@
         common = import ./modules/common.nix;
         prompt = import ./modules/prompt.nix;
         server = import ./modules/server.nix;
+        zerotier = import ./modules/zerotier.nix;
       };
 
       nixosConfigurations = {
@@ -28,6 +29,11 @@
           modules = [ ./hosts/monolith ];
           specialArgs = { inherit self inputs secrets; };
         };
+        quasar = nixpkgs.lib.nixosSystem {
+          system = "x86_64-linux";
+          modules = [ ./hosts/quasar ];
+          specialArgs = { inherit self inputs secrets; };
+        };
       };
     };
 }

hosts/marauder/default.nix

@@ -3,8 +3,10 @@
   imports = [
     self.nixosModules.common
     self.nixosModules.prompt
+    self.nixosModules.zerotier
     ./backup.nix
     ./dev.nix
+    ./printing.nix
   ];
 
   networking.hostName = "marauder";

hosts/marauder/printing.nix

@@ -0,0 +1,16 @@
+{ pkgs, ... }:
+{
+  environment.systemPackages = with pkgs; [
+    system-config-printer
+  ];
+
+  services.printing = {
+    enable = true;
+  };
+
+  services.avahi = {
+    enable = true;
+    nssmdns4 = true;
+    openFirewall = true;
+  };
+}

hosts/monolith/default.nix

@@ -4,6 +4,7 @@
     self.nixosModules.common
     self.nixosModules.prompt
     self.nixosModules.server
+    self.nixosModules.zerotier
     ./dns.nix
   ];
 

hosts/quasar/default.nix

@@ -0,0 +1,54 @@
+{ self, modulesPath, pkgs, config, secrets, ... }:
+{
+  imports = [
+    "${modulesPath}/virtualisation/amazon-image.nix"
+    self.nixosModules.common
+    self.nixosModules.prompt
+    self.nixosModules.server
+  ];
+
+  networking = {
+    hostName = "quasar";
+    domain = "consortium.chat";
+    firewall.allowedTCPPorts = [ 80 443 ];
+  };
+
+  services.postgresql = {
+    enable = true;
+  };
+
+  services.caddy = {
+    enable = true;
+    virtualHosts = {
+      "${config.networking.domain}".extraConfig = ''
+        reverse_proxy localhost:8008
+        header Strict-Transport-Security "max-age=63072000; includeSubDomains;"
+      '';
+      "matrix.${config.networking.domain}".extraConfig = ''
+        reverse_proxy /_matrix/* localhost:8008
+        reverse_proxy /_synapse/client/* localhost:8008
+      '';
+      "admin.${config.networking.domain}".extraConfig = ''
+        root * ${pkgs.synapse-admin}
+        file_server
+      '';
+    };
+  };
+
+  services.matrix-synapse = {
+    enable = true;
+    settings = {
+      server_name = config.networking.domain;
+      serve_server_wellknown = true;
+      registration_shared_secret = secrets.synapse."consortium.chat".registration-shared-secret;
+      macaroon_secret_key = secrets.synapse."consortium.chat".macaroon-secret-key;
+      form_secret = secrets.synapse."consortium.chat".form-secret;
+    };
+  };
+
+  promptEmoji = "🌟";
+
+  time.timeZone = "America/Los_Angeles";
+
+  system.stateVersion = "24.05";
+}

modules/common.nix

@@ -1,4 +1,4 @@
-{ pkgs, secrets, ... }:
+{ pkgs, ... }:
 {
   nixpkgs.config.allowUnfree = true;
 
@@ -41,11 +41,6 @@
     '';
   };
 
-  services.zerotierone = {
-    enable = true;
-    joinNetworks = secrets.zerotier.networks;
-  };
-
   environment.systemPackages = with pkgs; [
     git-crypt
     jq

modules/zerotier.nix

@@ -0,0 +1,7 @@
+{ secrets, ... }:
+{
+  services.zerotierone = {
+    enable = true;
+    joinNetworks = secrets.zerotier.networks;
+  };
+}