nginx recomended settings, matrix

system/matrix-server/default.nix

@@ -0,0 +1,66 @@
+{ ... }:
+
+let
+  domain = "jeppers.app";
+  fqdn = "matrix.${domain}";
+  baseUrl = "https://${fqdn}";
+  clientConfig."m.homeserver".base_url = baseUrl;
+  serverConfig."m.server" = "${fqdn}:443";
+  mkWellKnown = data: ''
+    default_type application/json;
+    add_header Access-Control-Allow-Origin *;
+    return 200 '${builtins.toJSON data}';
+  '';
+
+in
+
+{
+  services.matrix-synapse = {
+    enable = true;
+    settings = { 
+      server_name = domain;
+      public_baseurl = baseUrl;
+      listeners = [
+        {
+          port = 8008;
+          bind_addresses = [ "::1" ];
+          type = "http";
+          tls = false;
+          x_forwarded = true;
+          resources = [
+            {
+              names = [
+                "client"
+                "federation"
+              ];
+              compress = true;
+            }
+          ];
+        }
+      ];
+    };
+  };
+
+  services.nginx.virtualHosts = {
+
+    "${domain}" = {
+      enableACME = true;
+      forceSSL = true;
+      locations."= /.well-known/matrix/server".extraConfig = mkWellKnown serverConfig;
+      locations."= /.well-known/matrix/client".extraConfig = mkWellKnown clientConfig;
+    };
+
+    "${fqdn}" = {
+      enableACME = true;
+      forceSSL = true;
+      locations."/".extraConfig = ''
+        return 404;
+      '';
+      locations."/_matrix".proxyPass = "http://[::1]:8008";
+      locations."/_synapse/client".proxyPass = "http://[::1]:8008";
+    };
+  };
+
+ services.postgresql.enable = true;
+
+}

system/web-server/nginx.nix

@@ -4,9 +4,13 @@
   networking.firewall.allowedTCPPorts = [ 80 443 ];
 
   services.nginx = {
+
     enable = true;
+
     recommendedProxySettings = true;
     recommendedTlsSettings = true;
+    recommendedOptimisation = true;
+    recommendedGzipSettings = true;
 
     virtualHosts = {