Cloonar/nixos
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

fix: switch back to better secret handling

Browse source
This commit is contained in:
Dominik Polakovics Polakovics 2026-03-02 11:17:28 +01:00
parent 0ae91ee62f
commit 4825645bc1
1 changed files with 13 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

24
hosts/fw/modules/web/matrix.nix
View file

@ -21,12 +21,24 @@ let
masUpstreamId = "01KJPRKN397E5N8D0CA2Z3TJ7Y";
elementWebClientId = "01KJPVT5D54NRAY7AJY6PZEN0D";
masPackage = pkgs.matrix-authentication-service;
synapseMasConfig = pkgs.writeText "synapse-mas-config.yaml" ''
matrix_authentication_service:
enabled: true
endpoint: "http://127.0.0.1:8081"
secret_file: ${config.sops.secrets.mas-matrix-secret-synapse.path}
'';
in {
# Secrets for MAS
sops.secrets.mas-encryption-key = { owner = "mas"; };
sops.secrets.mas-matrix-secret = { owner = "mas"; };
sops.secrets.mas-authelia-client-secret = { owner = "mas"; };
sops.secrets.mas-rsa-key = { owner = "mas"; };
# Synapse also needs the shared secret
sops.secrets.mas-matrix-secret-synapse = {
owner = "matrix-synapse";
key = "mas-matrix-secret";
};
sops.secrets.mautrix-whatsapp-env = { };
sops.secrets.mautrix-signal-env = { };
@ -87,16 +99,6 @@ in {
MATRIX_SECRET=$(cat ${config.sops.secrets.mas-matrix-secret.path})
CLIENT_SECRET=$(cat ${config.sops.secrets.mas-authelia-client-secret.path})
# Write Synapse MAS config fragment with inline secret
# (secret_path is not supported in all Synapse versions)
cat > /run/mas/synapse-mas-config.yaml <<SYNEOF
matrix_authentication_service:
enabled: true
endpoint: "http://127.0.0.1:8081"
secret: "$MATRIX_SECRET"
SYNEOF
chmod 644 /run/mas/synapse-mas-config.yaml
# Write MAS config with secrets interpolated
cat > /run/mas/config.yaml <<MASEOF
http:
@ -174,7 +176,7 @@ in {
# Synapse homeserver
services.matrix-synapse = {
enable = true;
extraConfigFiles = [ "/run/mas/synapse-mas-config.yaml" ];
extraConfigFiles = [ "${synapseMasConfig}" ];
settings = {
server_name = "cloonar.com";
public_baseurl = baseUrl;