From d8720d7bf137d2d96303fa350ef7c6dad51f286e Mon Sep 17 00:00:00 2001
From: jacekpoz <jacekpoz@cock.li>
Date: Thu, 13 Jul 2023 19:44:12 +0200
Subject: [PATCH] thanks neon :3

---
 hosts/chmura/conduit.nix | 145 ++-------------------------------------
 1 file changed, 7 insertions(+), 138 deletions(-)

diff --git a/hosts/chmura/conduit.nix b/hosts/chmura/conduit.nix
index e2db4ba..85f6140 100644
--- a/hosts/chmura/conduit.nix
+++ b/hosts/chmura/conduit.nix
@@ -3,156 +3,25 @@
     pkgs,
     inputs,
     ...
-}:
-
-let
-  # You'll need to edit these values
-
-  # The hostname that will appear in your user and room IDs
-  server_name = "jacekpoz.pl";
-
-  # The hostname that Conduit actually runs on
-  #
-  # This can be the same as `server_name` if you want. This is only necessary
-  # when Conduit is running on a different machine than the one hosting your
-  # root domain. This configuration also assumes this is all running on a single
-  # machine, some tweaks will need to be made if this is not the case.
-  matrix_hostname = "matrix.${server_name}";
-
-  # An admin email for TLS certificate notifications
-  admin_email = "jacekpoz@cock.li";
-
-  # These ones you can leave alone
-
-  # Build a dervation that stores the content of `${server_name}/.well-known/matrix/server`
-  well_known_server = pkgs.writeText "well-known-matrix-server" ''
-    {
-      "m.server": "${matrix_hostname}"
-    }
-  '';
-
-  # Build a dervation that stores the content of `${server_name}/.well-known/matrix/client`
-  well_known_client = pkgs.writeText "well-known-matrix-client" ''
-    {
-      "m.homeserver": {
-        "base_url": "https://${matrix_hostname}"
-      }
-    }
-  '';
-in
-
-{
-  # Configure Conduit itself
+}: {
   services.matrix-conduit = {
     enable = true;
 
-    # This causes NixOS to use the flake defined in this repository instead of
-    # the build of Conduit built into nixpkgs.
     package = inputs.conduit.packages.${pkgs.system}.default;
 
     settings.global = {
-      inherit server_name;
+      server_name = "jacekpoz.pl";
+      database_backend = "rocksdb";
     };
   };
 
-  # Configure automated TLS acquisition/renewal
-  security.acme = {
-    acceptTerms = true;
-    defaults = {
-      email = admin_email;
-    };
-  };
-
-  # ACME data must be readable by the NGINX user
-  users.users.nginx.extraGroups = [
-    "acme"
-  ];
-
-  # Configure NGINX as a reverse proxy
-  services.nginx = {
+  services.caddy = {
     enable = true;
-    recommendedProxySettings = true;
-
-    virtualHosts = {
-      "${matrix_hostname}" = {
-        forceSSL = true;
-        enableACME = true;
-
-        listen = [
-          {
-            addr = "0.0.0.0";
-            port = 443;
-            ssl = true;
-          }
-          {
-            addr = "[::]";
-            port = 443;
-            ssl = true;
-          }          {
-            addr = "0.0.0.0";
-            port = 8448;
-            ssl = true;
-          }
-          {
-            addr = "[::]";
-            port = 8448;
-            ssl = true;
-          }
-        ];
-
-        locations."/_matrix/" = {
-          proxyPass = "http://backend_conduit$request_uri";
-          proxyWebsockets = true;
-          extraConfig = ''
-            proxy_set_header Host $host;
-            proxy_buffering off;
-          '';
-        };
-
-        extraConfig = ''
-          merge_slashes off;
-        '';
-      };
-
-      "${server_name}" = {
-        forceSSL = true;
-        enableACME = true;
-
-        locations."=/.well-known/matrix/server" = {
-          # Use the contents of the derivation built previously
-          alias = "${well_known_server}";
-
-          extraConfig = ''
-            # Set the header since by default NGINX thinks it's just bytes
-            default_type application/json;
-          '';
-        };
-
-        locations."=/.well-known/matrix/client" = {
-          # Use the contents of the derivation built previously
-          alias = "${well_known_client}";
-
-          extraConfig = ''
-            # Set the header since by default NGINX thinks it's just bytes
-            default_type application/json;
-
-            # https://matrix.org/docs/spec/client_server/r0.4.0#web-browser-clients
-            add_header Access-Control-Allow-Origin "*";
-          '';
-        };
-      };
-    };
-
-    upstreams = {
-      "backend_conduit" = {
-        servers = {
-          "localhost:${toString config.services.matrix-conduit.settings.global.port}" = { };
-        };
-      };
-    };
+    virtualHosts."matrix.jacekpoz.pl".extraConfig = ''
+      reverse_proxy /_matrix/* localhost:8448
+    '';
   };
 
-  # Open firewall ports for HTTP, HTTPS, and Matrix federation
   networking.firewall.allowedTCPPorts = [ 80 443 8448 ];
   networking.firewall.allowedUDPPorts = [ 80 443 8448 ];
 }