Matrix setup

Signed-off-by: main <magic_rb@redalder.org>

containers/conduit.nix

@@ -1,7 +1,7 @@
 { nglib, nixpkgs }:
 nglib.makeSystem {
   system = "x86_64-linux";
-  name = "nixng-gitea";
+  name = "synapse";
   inherit nixpkgs;
   config = ({ pkgs, ... }:
     {

containers/heisenbridge.nix

@@ -0,0 +1,42 @@
+{ nglib, nixpkgs }:
+nglib.makeSystem {
+  system = "x86_64-linux";
+  name = "heisenbridge";
+  inherit nixpkgs;
+  config = ({ pkgs, ... }:
+    {
+      dumb-init = {
+        enable = true;
+        type.services = { };
+      };
+
+      init.services.heisenbridge = {
+        enabled = true;
+        # heisenbridge needs to retry the connection and task restarting does not work currently
+        shutdownOnExit = false;
+        script =
+          let
+            config =
+              ''
+                -l 127.0.0.1 \
+                -p 9898 \
+                -o @magic_rb:matrix.redalder.org \
+              '';
+            homeserverURI = "https://matrix.redalder.org/";
+          in
+          pkgs.writeShellScript "heisenbridge"
+            ''
+              REGISTRATION_FILE="/var/lib/registrations/heisenbridge.yaml"
+
+              [ -e "$REGISTRATION_FILE" ] || \
+                ${pkgs.heisenbridge}/bin/heisenbridge '${homeserverURI}' \
+                  -c "$REGISTRATION_FILE" \
+                  ${config} \
+                  --generate
+              ${pkgs.heisenbridge}/bin/heisenbridge '${homeserverURI}' \
+                  -c "$REGISTRATION_FILE" \
+                  ${config}
+            '';
+      };
+    });
+}

containers/mautrix-facebook.nix

@@ -1,7 +1,7 @@
 { nglib, nixpkgs }:
 nglib.makeSystem {
   system = "x86_64-linux";
-  name = "nixng-gitea";
+  name = "mautrix-facebook";
   inherit nixpkgs;
   config = ({ pkgs, ... }:
     {

flake.nix

@@ -48,6 +48,7 @@
               baikal = import ./containers/baikal.nix base;
               conduit = import ./containers/conduit.nix base;
               mautrix-facebook = import ./containers/mautrix-facebook.nix base;
+              heisenbridge = import ./containers/heisenbridge.nix base;
             };
 
         hydraJobs =

nomad/regions/do-1/ingress-upstreams.conf

@@ -18,8 +18,16 @@ upstream reicio {
   server {{ env "NOMAD_UPSTREAM_ADDR_reicio" }};
 }
 
+upstream matrix-synapse {
+  server {{ env "NOMAD_UPSTREAM_ADDR_matrix_synapse" }};
+}
+
+upstream matrix-mautrix-facebook {
+  server {{ env "NOMAD_UPSTREAM_ADDR_matrix-mautrix-facebook" }};
+}
+
 server {
-  listen 443 ssl;
+  listen 443 ssl http2;
 
   server_name _;
 
@@ -29,7 +37,7 @@ server {
 }
 
 server {
-  listen 443 ssl;
+  listen 443 ssl http2;
 
   server_name gitea.redalder.org;
 
@@ -45,7 +53,7 @@ server {
 }
 
 server {
-  listen 443 ssl;
+  listen 443 ssl http2;
 
   server_name hydra.redalder.org;
 
@@ -59,7 +67,7 @@ server {
 }
 
 server {
-  listen 443 ssl;
+  listen 443 ssl http2;
 
   server_name redalder.org nixng.org;
 
@@ -81,3 +89,30 @@ server {
     proxy_pass http://website;
   }
 }
+
+server {
+  listen 443 ssl http2;
+  listen 8448 ssl http2;
+
+  server_name matrix.redalder.org;
+  merge_slashes off;
+
+  location /_matrix/ {
+      proxy_pass http://matrix-synapse$request_uri;
+      proxy_set_header Host $http_host;
+      proxy_buffering off;
+  }
+
+  location /mufb/ {
+      proxy_pass http://matrix-mautrix-facebook$request_uri;
+      proxy_set_header Host $http_host;
+      proxy_buffering off;
+  }
+
+  location / {
+    return 404;
+  }
+
+  include /local/security.conf;
+  include /local/ssl.conf;
+}

nomad/regions/do-1/ingress.hcl

@@ -40,6 +40,12 @@ job "ingress" {
         host_network = "public"
       }
 
+      port "http-matrix" {
+        static = 8448
+        to = 8448
+        host_network = "public"
+      }
+
       port "https" {
         static = 443
         to = 443
@@ -119,13 +125,33 @@ job "ingress" {
                 mode = "local"
               }
             }
+
+            upstreams {
+              destination_name = "matrix-synapse"
+              local_bind_port  = 6167
+              datacenter = "homelab-1"
+
+              mesh_gateway {
+                mode = "local"
+              }
+            }
+
+            upstreams {
+              destination_name = "matrix-mautrix-facebook"
+              local_bind_port  = 29319
+              datacenter = "homelab-1"
+
+              mesh_gateway {
+                mode = "local"
+              }
+            }
           }
         }
       }
     }
 
     task "nginx" {
-      driver = "docker"
+      driver = "containerd-driver"
 
       volume_mount {
         volume = "ingress-letsencrypt"
@@ -133,21 +159,15 @@ job "ingress" {
         read_only = false
       }
 
-      # artifact {
-      # source = "http://hydra/build/99/download/1/image.tar.gz"
-      # }
-
       config {
-        # load = "nixng-ingress.tar.gz"
-        image = "nixng-ingress:local"
-
-        ports = ["http", "https", "minecraft"]
-        memory_hard_limit = 128
+        flake_ref = "${var.flake_ref}#nixngSystems.ingressToothpick.config.system.build.toplevel"
+        flake_sha = var.flake_sha
+        entrypoint = [ "init" ]
       }
 
       resources {
         cpu = 200
-        memory = 32
+        memory = 128
       }
 
       template {

nomad/regions/homelab-1/conduit.tf

@@ -1,9 +1,9 @@
-resource "nomad_volume" "conduit-data" {
+resource "nomad_volume" "matrix-synapse" {
   type        = "csi"
-  plugin_id   = "nfs"
-  volume_id   = "conduit-data"
-  name        = "conduit-data"
-  external_id = "conduit-data"
+  plugin_id   = "org.democratic-csi.nfs"
+  volume_id   = "matrix-synapse"
+  name        = "matrix-synapse"
+  external_id = "matrix-synapse"
 
   capability {
     access_mode = "single-node-writer"
@@ -12,22 +12,92 @@ resource "nomad_volume" "conduit-data" {
 
   context = {
     server = "blowhole.hosts.in.redalder.org"
-    share = "/var/nfs/conduit-data"
+    share = "/var/nfs/matrix/synapse"
+    node_attach_driver = "nfs"
+    provisioner_driver = "node-manual"
   }
 
   mount_options {
     fs_type = "nfs"
-    mount_flags = [ "nolock", "hard" ]
+    mount_flags = [ "nfsvers=3", "hard", "async" ]
   }
 }
 
+resource "nomad_volume" "matrix-registrations" {
+  type        = "csi"
+  plugin_id   = "org.democratic-csi.nfs"
+  volume_id   = "matrix-registrations"
+  name        = "matrix-registrations"
+  external_id = "matrix-registrations"
+
+  capability {
+    access_mode = "multi-node-multi-writer"
+    attachment_mode = "file-system"
+  }
+
+  context = {
+    server = "blowhole.hosts.in.redalder.org"
+    share = "/var/nfs/matrix/registrations"
+    node_attach_driver = "nfs"
+    provisioner_driver = "node-manual"
+  }
+
+  mount_options {
+    fs_type = "nfs"
+    mount_flags = [ "nfsvers=3", "hard", "async" ]
+  }
+}
+
+resource "nomad_volume" "matrix-mautrix-facebook" {
+  type        = "csi"
+  plugin_id   = "org.democratic-csi.nfs"
+  volume_id   = "matrix-mautrix-facebook"
+  name        = "matrix-mautrix-facebook"
+  external_id = "matrix-mautrix-facebook"
+
+  capability {
+    access_mode = "single-node-writer"
+    attachment_mode = "file-system"
+  }
+
+  context = {
+    server = "blowhole.hosts.in.redalder.org"
+    share = "/var/nfs/matrix/mautrix-facebook"
+    node_attach_driver = "nfs"
+    provisioner_driver = "node-manual"
+  }
+
+  mount_options {
+    fs_type = "nfs"
+    mount_flags = [ "nfsvers=3", "hard", "async" ]
+  }
+}
+
+resource "vault_policy" "matrix-mautrix-facebook-policy" {
+  name = "matrix-mautrix-facebook-policy"
+  policy = <<EOF
+path "kv/data/matrix/mautrix-facebook" {
+  capabilities = ["read"]
+}
+EOF
+}
+
+resource "vault_policy" "matrix-synapse-policy" {
+  name = "matrix-synapse-policy"
+  policy = <<EOF
+path "kv/data/matrix/synapse" {
+  capabilities = ["read"]
+}
+EOF
+}
+
 resource "nomad_job" "conduit" {
   jobspec = file("${path.module}/job/conduit.hcl")
 
   hcl2 {
     enabled = true
     vars = {
-      flake_ref = "${var.flake_host_alt}?rev=${var.flake_rev}"
+      flake_ref = "${var.flake_host}?ref=${var.flake_ref}&rev=${var.flake_rev}"
       flake_sha = var.flake_sha
     }
   }

nomad/regions/homelab-1/job/conduit.hcl

@@ -6,22 +6,31 @@ variable "flake_sha" {
   type = string
 }
 
-job "conduit" {
+job "matrix" {
   datacenters = [ "homelab-1" ]
   type = "service"
 
-  group "svc" {
+  group "mautrix-facebook" {
     count = 1
 
-    volume "conduit-data" {
+    volume "matrix-mautrix-facebook" {
       type = "csi"
-      source = "conduit-data"
+      source = "matrix-mautrix-facebook"
       read_only = false
 
       attachment_mode = "file-system"
       access_mode     = "single-node-writer"
     }
 
+    volume "matrix-registrations" {
+      type = "csi"
+      source = "matrix-registrations"
+      read_only = false
+
+      attachment_mode = "file-system"
+      access_mode     = "multi-node-multi-writer"
+    }
+
     restart {
       attempts = 5
       delay = "5s"
@@ -32,29 +41,190 @@ job "conduit" {
     }
 
     service {
-      name = "conduit"
-      port = "6167"
+      name = "matrix-mautrix-facebook"
+      port = "29319"
 
-      check {
-        type = "http"
-        address_mode = "alloc"
-        path = "/"
-        port = "6167"
-        interval = "2s"
-        timeout = "2s"
-      }
+      # check {
+      #   type = "http"
+      #   address_mode = "alloc"
+      #   path = "/public"
+      #   port = "29319"
+      #   interval = "2s"
+      #   timeout = "2s"
+      # }
 
       connect {
         sidecar_service {}
       }
     }
 
-    task "app" {
+    task "mautrix-facebook" {
       driver = "containerd-driver"
 
       volume_mount {
-        volume = "conduit-data"
-        destination = "/var/lib/matrix-conduit"
+        volume = "matrix-mautrix-facebook"
+        destination = "/var/lib/mautrix-facebook"
+        read_only = false
+      }
+
+      volume_mount {
+        volume = "matrix-registrations"
+        destination = "/var/lib/registrations"
+        read_only = false
+      }
+
+      config {
+        flake_ref = "${var.flake_ref}#nixngSystems.mautrix-facebook.config.system.build.toplevel"
+        flake_sha = var.flake_sha
+        entrypoint = [ "init" ]
+      }
+
+      vault {
+        policies = ["matrix-mautrix-facebook-policy"]
+      }
+
+      template {
+        data = <<EOF
+{{ with secret "kv/data/matrix/mautrix-facebook" }}
+MAUTRIX_FACEBOOK_APPSERVICE_AS_TOKEN={{ .Data.data.as_token }}
+MAUTRIX_FACEBOOK_APPSERVICE_HS_TOKEN={{ .Data.data.hs_token }}
+{{ end }}
+EOF
+        destination = "secrets/environment"
+        env = true
+      }
+
+      resources {
+        cpu = 256
+        memory = 256
+      }
+    }
+  }
+
+  group "heisenbridge" {
+    count = 1
+
+    volume "matrix-registrations" {
+      type = "csi"
+      source = "matrix-registrations"
+      read_only = false
+
+      attachment_mode = "file-system"
+      access_mode     = "multi-node-multi-writer"
+    }
+
+    restart {
+      attempts = 5
+      delay = "5s"
+    }
+
+    network {
+      mode = "bridge"
+    }
+
+    service {
+      name = "matrix-heisenbridge"
+      port = "9898"
+
+      connect {
+        sidecar_service {}
+      }
+    }
+
+    task "heisenbridge" {
+      driver = "containerd-driver"
+
+      volume_mount {
+        volume = "matrix-registrations"
+        destination = "/var/lib/registrations"
+        read_only = false
+      }
+
+      config {
+        flake_ref = "${var.flake_ref}#nixngSystems.heisenbridge.config.system.build.toplevel"
+        flake_sha = var.flake_sha
+        entrypoint = [ "init" ]
+      }
+
+      resources {
+        cpu = 128
+        memory = 128
+      }
+    }
+  }
+
+  group "synapse" {
+    count = 1
+
+    volume "matrix-synapse" {
+      type = "csi"
+      source = "matrix-synapse"
+      read_only = false
+
+      attachment_mode = "file-system"
+      access_mode     = "single-node-writer"
+    }
+
+    volume "matrix-registrations" {
+      type = "csi"
+      source = "matrix-registrations"
+      read_only = false
+
+      attachment_mode = "file-system"
+      access_mode     = "multi-node-multi-writer"
+    }
+
+    restart {
+      attempts = 5
+      delay = "5s"
+    }
+
+    network {
+      mode = "bridge"
+    }
+
+    service {
+      name = "matrix-synapse"
+      port = "6167"
+
+      check {
+        type = "http"
+        address_mode = "alloc"
+        path = "/_matrix/client/versions"
+        port = "6167"
+        interval = "2s"
+        timeout = "2s"
+      }
+
+      connect {
+        sidecar_service {
+          proxy {
+            upstreams {
+              destination_name = "matrix-mautrix-facebook"
+              local_bind_port  = 29319
+            }
+
+            upstreams {
+              destination_name = "matrix-heisenbridge"
+              local_bind_port  = 9898
+            }
+          }
+        }
+      }
+    }
+
+    task "synapse" {
+      driver = "containerd-driver"
+
+      volume_mount {
+        volume = "matrix-synapse"
+        destination = "/var/lib/synapse"
+        read_only = false
+      }
+
+      volume_mount {
+        volume = "matrix-registrations"
+        destination = "/var/lib/registrations"
         read_only = false
       }
 
@@ -65,8 +235,23 @@ job "conduit" {
       }
 
       resources {
-        cpu = 500
-        memory = 1024
+        cpu = 2048
+        memory = 2048
+      }
+
+      vault {
+        policies = ["matrix-synapse-policy"]
+      }
+
+      template {
+        data = <<EOF
+{{ with secret "kv/data/matrix/synapse" }}
+registration_shared_secret: "{{ .Data.data.registration_shared_secret }}"
+macaroon_secret_key: "{{ .Data.data.macaroon_secret_key }}"
+form_secret: "{{ .Data.data.form_secret }}"
+{{ end }}
+EOF
+        destination = "/secrets/extra.yaml"
       }
     }
   }

terraform.tfvars

@@ -1,6 +1,5 @@
-flake_rev = "1de7117dca94932945dab6cb92315a74edcf01d5"
-flake_ref = "home-assistant"
-# flake_host = "git+https://gitea.redalder.org/RedAlder/systems"
-flake_host = "git+https://git.irunx.org/MagicRB/ra-systems"
-flake_host_alt = "git+https://git.irunx.org/MagicRB/ra-systems"
-flake_sha = "sha256-QhVT7sAEzMNyYeInRNdI30JK6E7x1ksTZc1DSPNHNZ0="
+flake_rev = "a27a4c4e78928564383e165b3868aa4f63c451df"
+flake_ref = "conduit-wip"
+flake_host = "git+https://git.sr.ht/~magic_rb/cluster"
+flake_host_alt = "git+https://git.sr.ht/~magic_rb/cluster"
+flake_sha = "sha256-7b/9W8mDnqQv0DfH6if0IVbMWR8iEvor7Ktth/WkX9M="