RuJect/nixos-infra
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(services/synapse): simplify reverse proxy
Some checks failed
Nix CI / build (push) Failing after 5m55s
Details

Browse source
This commit is contained in:
Rustam Efimov 2026-04-14 21:47:04 +03:00
parent 9ff92a89e3
commit 7df9d7ef4f
No known key found for this signature in database
1 changed files with 9 additions and 57 deletions
Download patch file Download diff file Expand all files Collapse all files

66
services/synapse/nginx.nix
View file

@ -8,11 +8,7 @@ in
services.nginx = { services.nginx = {
appendHttpConfig = '' appendHttpConfig = ''
limit_req_zone $binary_remote_addr zone=matrix_login:10m rate=1r/s; limit_req_zone $binary_remote_addr zone=matrix:10m rate=50r/s;
limit_req_zone $binary_remote_addr zone=matrix_register:10m rate=1r/m;
limit_req_zone $binary_remote_addr zone=matrix_api:10m rate=20r/s;
limit_req_zone $binary_remote_addr zone=matrix_media:10m rate=10r/s;
limit_req_zone $binary_remote_addr zone=matrix_federation:10m rate=50r/s;
limit_conn_zone $binary_remote_addr zone=conn_limit:10m; limit_conn_zone $binary_remote_addr zone=conn_limit:10m;
''; '';
upstreams."matrix-synapse".servers = { upstreams."matrix-synapse".servers = {
@ -23,65 +19,21 @@ in
enableACME = true; enableACME = true;
locations = { locations = {
# Synapse client API "^~ /_matrix" = {
"/_matrix/client" = {
proxyPass = "http://127.0.0.1:${toString port}"; proxyPass = "http://127.0.0.1:${toString port}";
extraConfig = '' extraConfig = ''
limit_req zone=matrix_api burst=50 nodelay; limit_req zone=matrix burst=100 nodelay;
client_max_body_size ${maxUploadSize}; proxy_set_header Host $host;
''; proxy_set_header X-Forwarded-Proto https;
}; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Real-IP $remote_addr;
# Login endpoint with stricter rate limiting
"~ ^/_matrix/client/(r0|v3)/login$" = {
proxyPass = "http://127.0.0.1:${toString port}";
extraConfig = ''
limit_req zone=matrix_login burst=3 nodelay;
'';
};
# Registration with very strict rate limiting
"~ ^/_matrix/client/(r0|v3)/register" = {
proxyPass = "http://127.0.0.1:${toString port}";
extraConfig = ''
limit_req zone=matrix_register burst=2 nodelay;
'';
};
# Sync endpoint with longer timeout
"~ ^/_matrix/client/(r0|v3|unstable)/sync" = {
proxyPass = "http://127.0.0.1:${toString port}";
extraConfig = ''
limit_req zone=matrix_api burst=50 nodelay;
proxy_read_timeout 600s; proxy_read_timeout 600s;
''; proxy_connect_timeout 60s;
}; proxy_send_timeout 600s;
# Media
"/_matrix/media" = {
proxyPass = "http://127.0.0.1:${toString port}";
extraConfig = ''
limit_req zone=matrix_media burst=100 nodelay;
client_max_body_size ${maxUploadSize};
'';
};
# Federation
"/_matrix/federation" = {
proxyPass = "http://127.0.0.1:${toString port}";
extraConfig = ''
limit_req zone=matrix_federation burst=100 nodelay;
client_max_body_size 50M; client_max_body_size 50M;
''; '';
}; };
"/_matrix/key" = {
proxyPass = "http://127.0.0.1:${toString port}";
extraConfig = ''
limit_req zone=matrix_federation burst=50 nodelay;
'';
};
# Health check # Health check
"= /health" = { "= /health" = {
proxyPass = "http://127.0.0.1:${toString port}"; proxyPass = "http://127.0.0.1:${toString port}";