vueko: Add element-web

machines/vueko/configuration.nix

@@ -12,6 +12,8 @@ in
     ./hardware-configuration.nix
     ../../modules
 
+    ./services/element-web.nix
+
     "${infinisilSystem}/config/new-modules/murmur.nix"
   ];
 

machines/vueko/services/element-web.nix

@@ -0,0 +1,45 @@
+{ lib, pkgs, ... }:
+
+{
+  services.nginx.virtualHosts."chat.sbruder.de" = {
+    enableACME = true;
+    forceSSL = true;
+
+    root = pkgs.element-web;
+
+    extraConfig = ''
+      # https://github.com/vector-im/element-web#configuration-best-practices
+      add_header Content-Security-Policy "frame-ancestors 'none'";
+      add_header X-Content-Type-Options nosniff;
+      add_header X-Frame-Options SAMEORIGIN;
+      add_header X-XSS-Protection "1; mode=block";
+    '';
+
+    # nixpkgs’s override mechanism doesn’t allow overriding of all options
+    locations."=/config.chat.sbruder.de.json".alias = pkgs.writeText "config.chat.sbruder.de.json" (lib.generators.toJSON { } {
+      default_server_config = {
+        "m.homeserver" = {
+          base_url = "https://matrix.sbruder.de";
+          server_name = "matrix.sbruder.de";
+        };
+      };
+      showLabsSettings = true;
+      branding = {
+        authFooterLinks = [ ];
+      };
+      piwik = false;
+      defaultCountryCode = "DE";
+      settingDefaults = {
+        "UIFeature.feedback" = false;
+        "UIFeature.shareSocial" = false;
+        "UIFeature.identityServer" = false;
+        "UIFeature.thirdPartyId" = false;
+      };
+      disable_custom_urls = true;
+      jitsi.preferredDomain = "meet.jalr.de";
+      disable_guests = true;
+      disable_3pid_login = true;
+      desktopBuilds.available = false;
+    });
+  };
+}