dotfiles/terranix/containers/matrix/default.nix

{
  config',
  config,
  elib,
  vars,
  ...
}: let
  inherit
    (elib)
    nfsVolume
    nomadJob
    ;
in {
  resource."nomad_volume"."matrix-synapse" = nfsVolume {
    volume_name = "matrix-synapse";
    access_mode = "multi-node-multi-writer";
    server = "blowhole.hosts.in.redalder.org";
    share = "/mnt/kyle/infrastructure/matrix/synapse";
    mount_flags = ["hard" "vers=4.2" "rsize=16384" "wsize=16384" "async"];
  };

  resource."nomad_volume"."matrix-postgresql" = nfsVolume {
    volume_name = "matrix-postgresql";
    access_mode = "single-node-writer";
    server = "blowhole.hosts.in.redalder.org";
    share = "/mnt/jimmy/infrastructure/matrix/postgresql";
    mount_flags = ["hard" "vers=4.2" "rsize=16384" "wsize=16384" "async"];
  };

  resource."nomad_volume"."matrix-registrations" = nfsVolume {
    volume_name = "matrix-registrations";
    access_mode = "multi-node-multi-writer";
    server = "blowhole.hosts.in.redalder.org";
    share = "/mnt/kyle/infrastructure/matrix/registrations";
    mount_flags = ["hard" "vers=4.2" "rsize=16384" "wsize=16384" "async"];
  };

  resource."nomad_volume"."matrix-mautrix-discord" = nfsVolume {
    volume_name = "matrix-mautrix-discord";
    access_mode = "single-node-writer";
    server = "blowhole.hosts.in.redalder.org";
    share = "/mnt/kyle/infrastructure/matrix/mautrix-discord";
    mount_flags = ["hard" "vers=4.2" "rsize=16384" "wsize=16384" "async"];
  };

  resource."nomad_volume"."matrix-mautrix-slack" = nfsVolume {
    volume_name = "matrix-mautrix-slack";
    access_mode = "single-node-writer";
    server = "blowhole.hosts.in.redalder.org";
    share = "/mnt/kyle/infrastructure/matrix/mautrix-slack";
    mount_flags = ["hard" "vers=4.2" "rsize=16384" "wsize=16384" "async"];
  };

  resource."nomad_volume"."matrix-mautrix-facebook" = nfsVolume {
    volume_name = "matrix-mautrix-facebook";
    access_mode = "single-node-writer";
    server = "blowhole.hosts.in.redalder.org";
    share = "/mnt/kyle/infrastructure/matrix/mautrix-facebook";
    mount_flags = ["hard" "vers=4.2" "rsize=16384" "wsize=16384" "async"];
  };

  resource."nomad_volume"."matrix-mautrix-signal" = nfsVolume {
    volume_name = "matrix-mautrix-signal";
    access_mode = "single-node-writer";
    server = "blowhole.hosts.in.redalder.org";
    share = "/mnt/kyle/infrastructure/matrix/mautrix-signal";
    mount_flags = ["hard" "vers=4.2" "rsize=16384" "wsize=16384" "async"];
  };

  resource."nomad_volume"."matrix-signald" = nfsVolume {
    volume_name = "matrix-signald";
    access_mode = "single-node-writer";
    server = "blowhole.hosts.in.redalder.org";
    share = "/mnt/kyle/infrastructure/matrix/signald";
    mount_flags = ["hard" "vers=4.2" "rsize=16384" "wsize=16384" "async"];
  };

  resource."nomad_volume"."matrix-redis" = nfsVolume {
    volume_name = "matrix-redis";
    access_mode = "single-node-writer";
    server = "blowhole.hosts.in.redalder.org";
    share = "/mnt/kyle/infrastructure/matrix/redis";
    mount_flags = ["hard" "vers=4.2" "rsize=16384" "wsize=16384" "async"];
  };

  resource."vault_policy"."matrix-mautrix-signal-policy" = {
    name = "matrix-mautrix-signal-policy";
    policy = ''
      path "kv/data/cluster/matrix/mautrix-signal/main" {
        capabilities = ["read"]
      }
      path "kv/data/cluster/matrix/mautrix-signal/postgresql" {
        capabilities = ["read"]
      }
    '';
  };

  resource."vault_policy"."matrix-mautrix-discord-policy" = {
    name = "matrix-mautrix-discord-policy";
    policy = ''
      path "kv/data/cluster/matrix/mautrix-discord/main" {
        capabilities = ["read"]
      }
      path "kv/data/cluster/matrix/mautrix-discord/postgresql" {
        capabilities = ["read"]
      }
    '';
  };

  resource."vault_policy"."matrix-mautrix-slack-policy" = {
    name = "matrix-mautrix-slack-policy";
    policy = ''
      path "kv/data/cluster/matrix/mautrix-slack/main" {
        capabilities = ["read"]
      }
      path "kv/data/cluster/matrix/mautrix-slack/postgresql" {
        capabilities = ["read"]
      }
    '';
  };

  resource."vault_policy"."matrix-mautrix-facebook-policy" = {
    name = "matrix-mautrix-facebook-policy";
    policy = ''
      path "kv/data/cluster/matrix/mautrix-facebook/main" {
        capabilities = ["read"]
      }
      path "kv/data/cluster/matrix/mautrix-facebook/postgresql" {
        capabilities = ["read"]
      }
    '';
  };

  resource."vault_policy"."matrix-synapse-policy" = {
    name = "matrix-synapse-policy";
    policy = ''
      path "kv/data/cluster/matrix/synapse" {
        capabilities = ["read"]
      }
    '';
  };

  resource."vault_policy"."matrix-postgresql-policy" = {
    name = "matrix-postgresql-policy";
    policy = ''
      path "kv/data/cluster/matrix/synapse" {
        capabilities = ["read"]
      }

      path "kv/data/cluster/matrix/mautrix-facebook/postgresql" {
        capabilities = ["read"]
      }

      path "kv/data/cluster/matrix/mautrix-signal/postgresql" {
        capabilities = ["read"]
      }

      path "kv/data/cluster/matrix/mautrix-discord/postgresql" {
        capabilities = ["read"]
      }

      path "kv/data/cluster/matrix/mautrix-slack/postgresql" {
        capabilities = ["read"]
      }
    '';
  };

  resource."nomad_job"."matrix-synapse" = nomadJob {
    jobspec = ./matrix-synapse.hcl;
    vars = {
      flake_ref = "${vars.flake_host}?ref=${vars.flake_ref}&rev=${vars.flake_rev}";
      flake_sha = vars.flake_sha;
      store_path = builtins.toJSON (builtins.mapAttrs (_: builtins.unsafeDiscardStringContext) {
        synapse = config'.flake.nixngConfigurations.synapse.config.system.build.toplevel;
        synapseClient = config'.flake.nixngConfigurations.synapseClient.config.system.build.toplevel;
        synapseSync = config'.flake.nixngConfigurations.synapseSync.config.system.build.toplevel;
        synapseFederationSender = config'.flake.nixngConfigurations.synapseFederationSender.config.system.build.toplevel;
        synapseFederationReceiver = config'.flake.nixngConfigurations.synapseFederationReceiver.config.system.build.toplevel;
        postgresql = config'.flake.nixngConfigurations.synapsePostgreSQL.config.system.build.toplevel;
        redis = config'.flake.nixngConfigurations.synapseRedis.config.system.build.toplevel;
      });
    };
  };

  resource."nomad_job"."matrix-mautrix-discord" = nomadJob {
    jobspec = ./matrix-mautrix-discord.hcl;
    vars = {
      flake_ref = "${vars.flake_host}?ref=${vars.flake_ref}&rev=${vars.flake_rev}";
      flake_sha = vars.flake_sha;
      store_path = builtins.unsafeDiscardStringContext config'.flake.nixngConfigurations.mautrixDiscord.config.system.build.toplevel;
    };
  };

  resource."nomad_job"."matrix-mautrix-slack" = nomadJob {
    jobspec = ./matrix-mautrix-slack.hcl;
    vars = {
      flake_ref = "${vars.flake_host}?ref=${vars.flake_ref}&rev=${vars.flake_rev}";
      flake_sha = vars.flake_sha;
      store_path = builtins.unsafeDiscardStringContext config'.flake.nixngConfigurations.mautrixSlack.config.system.build.toplevel;
    };
  };

  resource."nomad_job"."matrix-mautrix-facebook" = nomadJob {
    jobspec = ./matrix-mautrix-facebook.hcl;
    vars = {
      flake_ref = "${vars.flake_host}?ref=${vars.flake_ref}&rev=${vars.flake_rev}";
      flake_sha = vars.flake_sha;
      store_path = builtins.unsafeDiscardStringContext config'.flake.nixngConfigurations.mautrixFacebook.config.system.build.toplevel;
    };
  };

  resource."nomad_job"."matrix-mautrix-signal" = nomadJob {
    jobspec = ./matrix-mautrix-signal.hcl;
    vars = {
      flake_ref = "${vars.flake_host}?ref=${vars.flake_ref}&rev=${vars.flake_rev}";
      flake_sha = vars.flake_sha;
      store_path = builtins.unsafeDiscardStringContext config'.flake.nixngConfigurations.mautrixSignal.config.system.build.toplevel;
    };
  };

  resource."nomad_job"."matrix-heisenbridge" = nomadJob {
    jobspec = ./matrix-heisenbridge.hcl;

    vars = {
      flake_ref = "${vars.flake_host}?ref=${vars.flake_ref}&rev=${vars.flake_rev}";
      flake_sha = vars.flake_sha;
      store_path = builtins.unsafeDiscardStringContext config'.flake.nixngConfigurations.heisenbridge.config.system.build.toplevel;
    };
  };
}