server: change matrix provider to tuwunel

nixos/profiles/server.nix

···
 }:
 
 let
-  inherit (self.inputs) srvos agenix tangled;
+  inherit (self.inputs) unixpkgs srvos agenix tangled;
 
   ext-if = "eth0";
   external-ip = "91.99.55.74";
···
 
     tangled.nixosModules.knot
     tangled.nixosModules.spindle
+
+    "${unixpkgs}/nixos/modules/services/matrix/tuwunel.nix"
   ];
 
   config = {
···
       };
     };
 
-    age.secrets.matrix-env.file = ../../secrets/matrix-env.age;
-    services.matrix-conduit = {
+    age.secrets.tuwunel-registration-tokens = { file = ../../secrets/tuwunel-registration-tokens.age; owner = config.services.matrix-tuwunel.user; };
+    services.matrix-tuwunel = {
       enable = true;
-      package = upkgs.matrix-conduit;
+      package = upkgs.matrix-tuwunel;
 
       settings.global = {
-        address = "127.0.0.1";
-        port = matrix-port;
+        address = [ "127.0.0.1" ];
+        port = [ matrix-port ];
 
         server_name = "wiro.world";
         well_known = {
···
           server = "matrix.wiro.world:443";
         };
 
-        database_backend = "sqlite";
-        enable_lightning_bolt = false;
+        grant_admin_to_first_user = true;
+        new_user_displayname_suffix = "";
 
-        # Set in `CONDUIT_REGISTRATION_TOKEN`
-        # registration_token = ...;
         allow_registration = true;
+        registration_token_file = config.age.secrets.tuwunel-registration-tokens.path;
       };
     };
-    systemd.services.conduit.serviceConfig.EnvironmentFile = config.age.secrets.matrix-env.path;
   };
 }

secrets/matrix-env.age

···
-age-encryption.org/v1
--> ssh-ed25519 sMF1bg ynWhH67Y3AynyxoD9WmVKgNTAyb7ktUYUkRniXvfslw
-hlN/NsBEhTwkeaSdCd6uj/U2X9wi/cFwwjIhDUYWtYQ
--> ssh-ed25519 SmMcWg SXQ91ashcl6UJMPAV/7mI950cczhMAJrjcnkdck8DWw
-mndS8XyN+e1A4WRCU9dJ6bF50wrFnK6GPaJy/HJyMMA
--> ssh-ed25519 Q8rMFA g3PNPWKFO8Rf473kBaTuZUnalCI7b8Wl6W9qA7ldv2M
-9UfrXGhwc5Fn42UFr1sHIvtFp0QeqAvu4bhkjEolTZs
---- vzV9NNriSPI4sc2eiJZ0HlxGG9f+BRwsALPWdmEoG84
-�m�eqW{kU����/���mb[\���F*<,02MM���x�0��)��+��Zy�Ws-0e��o6Uv�o��0o W>"S���
8�(#

secrets/secrets.nix

···
   "authelia-storage-key.age".publicKeys = deploy;
   "authelia-ldap-password.age".publicKeys = deploy;
   "authelia-smtp-password.age".publicKeys = deploy;
-  # Defines `CONDUIT_REGISTRATION_TOKEN`
-  "matrix-env.age".publicKeys = deploy;
+  "tuwunel-registration-tokens.age".publicKeys = deploy;
 
   # Not used in config but useful
   "pgp-ca5e.age".publicKeys = users;

secrets/tuwunel-registration-tokens.age

···
+age-encryption.org/v1
+-> ssh-ed25519 sMF1bg TVYRDtTe5khTJo0q8ShrR5o1WBrbK2htHjYCvi5QYAA
+kx6Hke5RAZFfugR4aU28SRh4U8e4ymzeIY/+kYlAWhw
+-> ssh-ed25519 SmMcWg AyJOM5lQHETeGiI/V5vUtu2vD6PqCZNnuTPvfnU90zE
+9vM7/8JUbScHaeDWig16MgqtULryofSrRqhw2OMWfBs
+-> ssh-ed25519 Q8rMFA TeUNtmHquyhhDrXf+zXY56oTGvzkhkaReIoBx5Yb+TE
+DLfVy9cO1JrVln9CHV1ag66z2kIMrVzhcaIugLytojE
+--- nr/3KZTVXNdemLdmp2bO2bjxKDHvcy3gezZKYN5Z1qI
+�"��Z8��ԛ�GvJ�{��(�V9��1�N"��o���o����Х�oJ�~�1�!�}Egd�!�