nginx: add missing worker endpoints

Additional fixes for 25.11

.gitignore

@@ -0,0 +1 @@
+result

COPYING

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2020, 2022-2023 Daniel Løvbrøtte Olsen and contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

MIGRATIONS.MD

@@ -0,0 +1,21 @@
+# Migrations
+
+This is a best effort document descibing neccecary changes you might have to do when updating
+
+## 0.8.0
+
+`saml2` is no longer enabled, as it depends on vulnerable dependencies and isnt really built in nixpks anymore.
+
+If you need to authenticate with saml, you should deploy some sort of saml to openid bridge, instead.
+
+## 0.6.1
+
+enableSlidingSync, and setting matrix-synapse.sliding-sync.environmentFile (or any other sliding-sync setting)
+is no longer needed for a sliding-sync setup. Upgrading will force relogins for all users.
+
+## 0.5.0
+
+* The module has been renamed from `synapse` to `default`
+* The synapse module now expects a wrapper-style package. This means the module is now incompatible with nixpkgs < 23.11.
+
+

README.MD

@@ -1,3 +1,5 @@
+For support and requests feel free to join [#nixos-matrix-modules:dodsorf.as](https://matrix.to/#/#nixos-matrix-modules:dodsorf.as), [uri](matrix:r/nixos-matrix-modules:dodsorf.as)
+
 With matrix.YOURDOMAIN pointing at the server:
 
 ```
@@ -9,6 +11,10 @@ With matrix.YOURDOMAIN pointing at the server:
 
     workers.federationSenders = 1;
     workers.federationReceivers = 1;
+    workers.initialSyncers = 1;
+    workers.normalSyncers = 1;
+    workers.eventPersisters = 2;
+    workers.useUserDirectoryWorker = true;
 
     enableNginx = true;
 
@@ -31,4 +37,4 @@ With matrix.YOURDOMAIN pointing at the server:
 }
 ```
 
-is ~enough to get a functional matrix-server running one federation sender and one federation receiver
+is ~enough to get a functional matrix-server running with some workers

flake.lock

@@ -0,0 +1,26 @@
+{
+  "nodes": {
+    "nixpkgs": {
+      "locked": {
+        "lastModified": 1764983851,
+        "narHash": "sha256-y7RPKl/jJ/KAP/VKLMghMgXTlvNIJMHKskl8/Uuar7o=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "d9bc5c7dceb30d8d6fafa10aeb6aa8a48c218454",
+        "type": "github"
+      },
+      "original": {
+        "id": "nixpkgs",
+        "ref": "nixos-25.11",
+        "type": "indirect"
+      }
+    },
+    "root": {
+      "inputs": {
+        "nixpkgs": "nixpkgs"
+      }
+    }
+  },
+  "root": "root",
+  "version": 7
+}

flake.nix

@@ -1,9 +1,32 @@
 {
   description = "NixOS modules for matrix related services";
 
-  outputs = { self }: {
+  inputs = {
+    nixpkgs.url = "nixpkgs/nixos-25.11";
+  };
+
+  outputs = { self, nixpkgs }: {
     nixosModules = {
-      synapse = import ./synapse-module;
+      default = import ./module.nix;
     };
+
+    lib = import ./lib.nix { lib = nixpkgs.lib; };
+
+    checks = let
+      forAllSystems = f:
+        nixpkgs.lib.genAttrs [
+          "x86_64-linux"
+          "aarch64-linux"
+          "x86_64-darwin"
+          "aarch64-darwin"
+        ] (system: f nixpkgs.legacyPackages.${system});
+    in forAllSystems (pkgs: let
+      tests = import ./tests {
+        inherit nixpkgs pkgs;
+        matrix-lib = self.lib;
+      };
+    in {
+      inherit (tests) nginx-pipeline-eval;
+    });
   };
 }

lib.nix

@@ -0,0 +1,80 @@
+{ lib }:
+rec {
+  # checks if given listener configuration has type as a resource
+  isListenerType = type: l: lib.any (r: lib.any (n: n == type) r.names) l.resources;
+  # Get the first listener that includes the given resource from worker
+  firstListenerOfType = type: ls: lib.lists.findFirst (isListenerType type)
+    (throw "No listener with resource: ${type} configured")
+    ls;
+  # Get an attrset of the host and port from a listener 
+  connectionInfo = l: {
+    host = lib.head l.bind_addresses;
+    port = l.port;
+  };
+
+  # Get an attrset of the host and port from a worker given a type
+  workerConnectionResource = r: w: let
+    l = firstListenerOfType r w.settings.worker_listeners;
+  in connectionInfo l;
+
+  mapWorkersToUpstreamsByType = workerInstances:
+    lib.pipe workerInstances [
+      lib.attrValues
+
+      # Index by worker type
+      (lib.foldl (acc: worker: acc // {
+        ${worker.type} = (acc.${worker.type} or [ ]) ++ [ worker ];
+      }) { })
+
+      # Subindex by resource names, listener types, and convert to upstreams
+      (lib.mapAttrs (_: workers: lib.pipe workers [
+        (lib.concatMap (worker: [ (lib.lists.head  worker.settings.worker_listeners) ]))
+        lib.flatten
+        mapListenersToUpstreamsByType
+      ]))
+    ];
+
+    mapListenersToUpstreamsByType = listenerInstances:
+      lib.pipe listenerInstances [
+        # Index by resource names
+        (lib.concatMap (listener: lib.pipe listener [
+          (listener: let
+            allResourceNames = lib.pipe listener.resources [
+              (map (resource: resource.names))
+              lib.flatten
+              lib.unique
+            ];
+          in if allResourceNames == [ ]
+            then { "empty" = listener; }
+            else lib.genAttrs allResourceNames (_: listener))
+          lib.attrsToList
+        ]))
+
+        (lib.foldl (acc: listener: acc // {
+          ${listener.name} = (acc.${listener.name} or [ ]) ++ [ listener.value ];
+        }) { })
+
+        # Index by listener type
+        (lib.mapAttrs (_:
+          (lib.foldl (acc: listener: acc // {
+            ${listener.type} = (acc.${listener.type} or [ ]) ++ [ listener ];
+          }) { })
+        ))
+
+        # Convert listeners to upstream URIs
+        (lib.mapAttrs (_:
+          (lib.mapAttrs (_: listeners:
+            lib.pipe listeners [
+              (lib.concatMap (listener:
+                if listener.path != null
+                  then [ "unix:${listener.path}" ]
+                  else (map (addr: "${addr}:${toString listener.port}") listener.bind_addresses)
+              ))
+              # NOTE: Adding ` = { }` to every upstream might seem unnecessary in isolation,
+              #       but it makes it easier to set upstreams in the nginx module.
+              (uris: lib.genAttrs uris (_: { }))
+            ]
+          ))
+        ))
+      ];
+}

module.nix

@@ -0,0 +1,14 @@
+{ lib, ... }:
+
+{
+  imports = [
+    ./synapse-module
+
+    # TODO: Remove after 25.05
+    (lib.mkRemovedOptionModule [ "services" "matrix-synapse" "sliding-sync" ] ''
+      `services.matrix-synapse.sliding-sync` is no longer necessary to use sliding-sync with synapse.
+      As synapse now includes this in itself, if you have a manually managed `.well-known/matrix/client` file
+      remove the proxy url from it.
+    '')
+  ];
+}

synapse-module/default.nix

@@ -1,5 +1,7 @@
 { pkgs, lib, config, ... }:
-let
+let 
+  matrix-lib = (import ../lib.nix { inherit lib; });
+
   cfg = config.services.matrix-synapse-next;
   wcfg = cfg.workers;
 
@@ -8,9 +10,23 @@ let
   wcfgText = "config.services.matrix-synapse-next.workers";
 
   format = pkgs.formats.yaml {};
-  matrix-synapse-common-config = format.generate "matrix-synapse-common-config.yaml" cfg.settings;
-  pluginsEnv = cfg.package.python.buildEnv.override {
-    extraLibs = cfg.plugins;
+  matrix-synapse-common-config = format.generate "matrix-synapse-common-config.yaml" (cfg.settings // {
+    listeners = map (lib.filterAttrsRecursive (_: v: v != null)) cfg.settings.listeners;
+  });
+
+  # TODO: Align better with the upstream module
+  wrapped = cfg.package.override { 
+    inherit (cfg) plugins;
+    extras = [
+      "postgres"
+      "oidc"
+      "systemd"
+      "url-preview"
+      "sentry"
+      "jwt"
+      "redis"
+      "cache-memory"
+    ];
   };
 
   inherit (lib)
@@ -31,7 +47,7 @@ in
   imports = [
     ./nginx.nix
     (import ./workers.nix {
-      inherit throw' format matrix-synapse-common-config pluginsEnv;
+      inherit matrix-lib throw' format matrix-synapse-common-config wrapped;
     })
   ];
 
@@ -54,6 +70,14 @@ in
       '';
     };
 
+    withJemalloc = mkOption {
+      type = types.bool;
+      default = true;
+      description = ''
+        Whether to preload jemalloc to reduce memory fragmentation and overall usage.
+      '';
+    };
+
     dataDir = mkOption {
       type = types.path;
       default = "/var/lib/matrix-synapse";
@@ -63,6 +87,15 @@ in
       '';
     };
 
+    socketDir = mkOption {
+      type = types.path;
+      default = "/run/matrix-synapse";
+      description = ''
+        The directory where matrix-synapse by default stores the sockets of
+        all listeners that bind to UNIX sockets.
+      '';
+    };
+
     enableNginx = mkEnableOption "The synapse module managing nginx";
 
     public_baseurl = mkOption {
@@ -82,6 +115,8 @@ in
       description = "A yaml python logging config file";
     };
 
+    enableSlidingSync = mkEnableOption (lib.mdDoc "automatic Sliding Sync setup at `slidingsync.<domain>`");
+
     settings = mkOption {
       type = types.submodule {
         freeformType = format.type;
@@ -117,14 +152,42 @@ in
             type = types.listOf (types.submodule {
               options = {
                 port = mkOption {
-                  type = types.port;
-                  description = "The TCP port to bind to";
+                  type = with types; nullOr types.port;
+                  default = null;
+                  description = ''
+                    The TCP port to bind to.
+
+                    ::: {.note}
+                      This option will be ignored if {option}`path` is set to a non-null value.
+                    :::
+                  '';
                   example = 8448;
                 };
 
+                path = mkOption {
+                  type = with types; nullOr path;
+                  default = null;
+                  description = ''
+                    The UNIX socket to bind to.
+
+                    ::: {.note}
+                      This option will override {option}`bind_addresses` and {option}`port`
+                      if set to a non-null value.
+                    :::
+                  '';
+                  example = literalExpression ''''${${cfgText}.socketDir}/matrix-synapse.sock'';
+                };
+
                 bind_addresses = mkOption {
                   type = types.listOf types.str;
-                  description = "A list of local addresses to listen on";
+                  default = [ ];
+                  description = ''
+                    A list of local addresses to listen on.
+
+                    ::: {.note}
+                      This option will be ignored if {option}`path` is set to a non-null value.
+                    :::
+                  '';
                 };
 
                 type = mkOption {
@@ -183,16 +246,14 @@ in
             # TODO: add defaultText
             default = [
               {
-                port = 8008;
-                bind_addresses = [ "127.0.0.1" ];
+                path = "${cfg.socketDir}/matrix-synapse.sock";
                 resources = [
                   { names = [ "client" ]; compress = true; }
                   { names = [ "federation" ]; compress = false; }
                 ];
               }
               (mkIf (wcfg.instances != { }) {
-                port = 9093;
-                bind_addresses = [ "127.0.0.1" ];
+                path = "${cfg.socketDir}/matrix-synapse-replication.sock";
                 resources = [
                   {  names = [ "replication" ]; }
                 ];
@@ -334,11 +395,19 @@ in
   };
 
   config = mkIf cfg.enable {
+    assertions = [ ]
+      ++ (map (l: {
+        assertion = l.path == null -> (l.bind_addresses != [ ] && l.port != null);
+        message = "Some listeners are missing either a socket path or a bind_address + port to listen on";
+      }) cfg.settings.listeners);
+
+    warnings = [ ] ++ lib.optional cfg.enableSlidingSync
+      "the option services.matrix-synapse-next.enableSlidingSync no longer has any effect (and is enabled by default)";
+
     users.users.matrix-synapse = {
       group = "matrix-synapse";
       home = cfg.dataDir;
       createHome = true;
-      shell = "${pkgs.bash}/bin/bash";
       uid = config.ids.uids.matrix-synapse;
     };
 
@@ -364,31 +433,77 @@ in
         partOf = [ "matrix-synapse.target" ];
         wantedBy = [ "matrix-synapse.target" ];
 
-        preStart = let
-          flags = lib.cli.toGNUCommandLineShell {} {
-            config-path = [ matrix-synapse-common-config ] ++ cfg.extraConfigFiles;
-            keys-directory = cfg.dataDir;
-            generate-keys = true;
-          };
-        in "${cfg.package}/bin/synapse_homeserver ${flags}";
-
-        environment.PYTHONPATH =
-          lib.makeSearchPathOutput "lib" cfg.package.python.sitePackages [ pluginsEnv ];
+        environment = lib.optionalAttrs cfg.withJemalloc {
+          LD_PRELOAD = "${pkgs.jemalloc}/lib/libjemalloc.so";
+          PYTHONMALLOC = "malloc";
+        };
 
         serviceConfig = {
           Type = "notify";
           User = "matrix-synapse";
           Group = "matrix-synapse";
           Slice = "system-matrix-synapse.slice";
+
+          Restart = "always";
+          RestartSec = 3;
+
           WorkingDirectory = cfg.dataDir;
+          StateDirectory = "matrix-synapse";
+          RuntimeDirectory = "matrix-synapse";
+
+          ExecStartPre = let
+            flags = lib.cli.toCommandLineShellGNU {} {
+              config-path = [ matrix-synapse-common-config ] ++ cfg.extraConfigFiles;
+              keys-directory = cfg.dataDir;
+              generate-keys = true;
+            };
+          in "${cfg.package}/bin/synapse_homeserver ${flags}";
           ExecStart = let
-            flags = lib.cli.toGNUCommandLineShell {} {
+            flags = lib.cli.toCommandLineShellGNU {} {
               config-path = [ matrix-synapse-common-config ] ++ cfg.extraConfigFiles;
               keys-directory = cfg.dataDir;
             };
-          in "${cfg.package}/bin/synapse_homeserver ${flags}";
-          ExecReload = "${pkgs.utillinux}/bin/kill -HUP $MAINPID";
-          Restart = "on-failure";
+          in "${wrapped}/bin/synapse_homeserver ${flags}";
+          ExecReload = "${lib.getExe' pkgs.coreutils "kill"} -HUP $MAINPID";
+
+          CapabilityBoundingSet = [ "" ];
+          LockPersonality = true;
+          NoNewPrivileges = true;
+          PrivateDevices = true;
+          PrivateTmp = true;
+          PrivateUsers = true;
+          ProcSubset = "pid";
+          ProtectClock = true;
+          ProtectControlGroups = true;
+          ProtectHome = true;
+          ProtectHostname = true;
+          ProtectKernelLogs = true;
+          ProtectKernelModules = true;
+          ProtectKernelTunables = true;
+          ProtectProc = "invisible";
+          ProtectSystem = "strict";
+          ReadWritePaths = [
+            cfg.dataDir
+            cfg.settings.media_store_path
+          ]
+          ++ (map (listener: dirOf listener.path) (
+            lib.filter (listener: listener.path != null) cfg.settings.listeners
+          ));
+          RemoveIPC = true;
+          RestrictAddressFamilies = [
+            "AF_INET"
+            "AF_INET6"
+            "AF_UNIX"
+          ];
+          RestrictNamespaces = true;
+          RestrictRealtime = true;
+          RestrictSUIDSGID = true;
+          SystemCallArchitectures = "native";
+          SystemCallFilter = [
+            "@system-service"
+            "~@resources"
+            "~@privileged"
+          ];
         };
       };
     };

synapse-module/nginx.nix

@@ -2,13 +2,10 @@
 let
   cfg = config.services.matrix-synapse-next;
 
-  getWorkersOfType = type: lib.filterAttrs (_: w: w.type == type) cfg.workers.instances;
-  isListenerType = type: listener: lib.lists.any (r: lib.lists.any (n: n == type) r.names) listener.resources;
-  firstListenerOfType = type: worker: lib.lists.findFirst (isListenerType type) (throw "No federation endpoint on receiver") worker.settings.worker_listeners;
-  wAddressOfType = type: w: lib.lists.findFirst (_: true) (throw "No address in receiver") (firstListenerOfType type w).bind_addresses;
-  wPortOfType = type: w: (firstListenerOfType type w).port;
-  wSocketAddressOfType = type: w: "${wAddressOfType type w}:${builtins.toString (wPortOfType type w)}";
-  generateSocketAddresses = type: workers: lib.mapAttrsToList (_: w: "${wSocketAddressOfType type w}") workers;
+  matrix-lib = (import ../lib.nix { inherit lib; });
+
+  workerUpstreams = matrix-lib.mapWorkersToUpstreamsByType cfg.workers.instances;
+  listenerUpstreams = matrix-lib.mapListenersToUpstreamsByType cfg.settings.listeners;
 in
 {
   config = lib.mkIf cfg.enableNginx {
@@ -27,6 +24,7 @@ in
         ~^/_matrix/client/(api/v1|r0|v3)/rooms/[^/]+/initialSync$ synapse_initial_sync;
 
         # Federation requests
+        ~^/_matrix/federation/v1/version$ synapse_federation;
         ~^/_matrix/federation/v1/event/ synapse_federation;
         ~^/_matrix/federation/v1/state/ synapse_federation;
         ~^/_matrix/federation/v1/state_ids/ synapse_federation;
@@ -38,6 +36,8 @@ in
         ~^/_matrix/federation/v1/make_leave/ synapse_federation;
         ~^/_matrix/federation/(v1|v2)/send_join/ synapse_federation;
         ~^/_matrix/federation/(v1|v2)/send_leave/ synapse_federation;
+        ~^/_matrix/federation/v1/make_knock/ synapse_federation;
+        ~^/_matrix/federation/v1/send_knock/ synapse_federation;
         ~^/_matrix/federation/(v1|v2)/invite/ synapse_federation;
         ~^/_matrix/federation/v1/event_auth/ synapse_federation;
         ~^/_matrix/federation/v1/timestamp_to_event/ synapse_federation;
@@ -59,17 +59,23 @@ in
         ~^/_matrix/client/v1/rooms/.*/hierarchy$ synapse_client_interaction;
         ~^/_matrix/client/(v1|unstable)/rooms/.*/relations/ synapse_client_interaction;
         ~^/_matrix/client/v1/rooms/.*/threads$ synapse_client_interaction;
-        ~^/_matrix/client/unstable/org.matrix.msc2716/rooms/.*/batch_send$ synapse_client_interaction;
         ~^/_matrix/client/unstable/im.nheko.summary/rooms/.*/summary$ synapse_client_interaction;
         ~^/_matrix/client/(r0|v3|unstable)/account/3pid$ synapse_client_interaction;
         ~^/_matrix/client/(r0|v3|unstable)/account/whoami$ synapse_client_interaction;
-        ~^/_matrix/client/(r0|v3|unstable)/devices$ synapse_client_interaction;
+        ~^/_matrix/client/(r0|v3|unstable)/account/deactivate$ synapse_client_interaction;
+        ~^/_matrix/client/(r0|v3)/delete_devices$ synapse_client_interaction;
+        ~^/_matrix/client/(api/v1|r0|v3|unstable)/devices(/|$) synapse_client_interaction;
         ~^/_matrix/client/versions$ synapse_client_interaction;
         ~^/_matrix/client/(api/v1|r0|v3|unstable)/voip/turnServer$ synapse_client_interaction;
         ~^/_matrix/client/(api/v1|r0|v3|unstable)/rooms/.*/event/ synapse_client_interaction;
         ~^/_matrix/client/(api/v1|r0|v3|unstable)/joined_rooms$ synapse_client_interaction;
         ~^/_matrix/client/v1/rooms/.*/timestamp_to_event$ synapse_client_interaction;
+        ~^/_matrix/client/(api/v1|r0|v3|unstable/.*)/rooms/.*/aliases synapse_client_interaction;
         ~^/_matrix/client/(api/v1|r0|v3|unstable)/search$ synapse_client_interaction;
+        ~^/_matrix/client/(r0|v3|unstable)/user/.*/filter(/|$) synapse_client_interaction;
+        ~^/_matrix/client/(api/v1|r0|v3|unstable)/directory/room/.*$ synapse_client_interaction;
+        ~^/_matrix/client/(r0|v3|unstable)/capabilities$ synapse_client_interaction;
+        ~^/_matrix/client/(r0|v3|unstable)/notifications$ synapse_client_interaction;
 
         # Encryption requests
         ~^/_matrix/client/(r0|v3|unstable)/keys/query$ synapse_client_encryption;
@@ -77,11 +83,15 @@ in
         ~^/_matrix/client/(r0|v3|unstable)/keys/claim$ synapse_client_encryption;
         ~^/_matrix/client/(r0|v3|unstable)/room_keys/ synapse_client_encryption;
         ~^/_matrix/client/(r0|v3|unstable)/keys/upload/ synapse_client_encryption;
+        ~^/_matrix/client/(api/v1|r0|v3|unstable)/keys/device_signing/upload$ synapse_client_encryption;
+        ~^/_matrix/client/(api/v1|r0|v3|unstable)/keys/signatures/upload$ synapse_client_encryption;
 
         # Registration/login requests
         ~^/_matrix/client/(api/v1|r0|v3|unstable)/login$ synapse_client_login;
         ~^/_matrix/client/(r0|v3|unstable)/register$ synapse_client_login;
+        ~^/_matrix/client/(r0|v3|unstable)/register/available$ synapse_client_login;
         ~^/_matrix/client/v1/register/m.login.registration_token/validity$ synapse_client_login;
+        ~^/_matrix/client/(r0|v3|unstable)/password_policy$ synapse_client_login;
 
         # Event sending requests
         ~^/_matrix/client/(api/v1|r0|v3|unstable)/rooms/.*/redact synapse_client_transaction;
@@ -89,6 +99,7 @@ in
         ~^/_matrix/client/(api/v1|r0|v3|unstable)/rooms/.*/state/ synapse_client_transaction;
         ~^/_matrix/client/(api/v1|r0|v3|unstable)/rooms/.*/(join|invite|leave|ban|unban|kick)$ synapse_client_transaction;
         ~^/_matrix/client/(api/v1|r0|v3|unstable)/join/ synapse_client_transaction;
+        ~^/_matrix/client/(api/v1|r0|v3|unstable)/knock/ synapse_client_transaction;
         ~^/_matrix/client/(api/v1|r0|v3|unstable)/profile/ synapse_client_transaction;
 
         # Account data requests
@@ -138,24 +149,17 @@ in
     '';
 
     services.nginx.upstreams.synapse_master.servers = let
-      isMainListener = l: isListenerType "client" l && isListenerType "federation" l;
-      firstMainListener = lib.findFirst isMainListener
-        (throw "No catch-all listener configured") cfg.settings.listeners;
-        address = lib.findFirst (_: true) (throw "No address in main listener") firstMainListener.bind_addresses;
-        port = firstMainListener.port;
-        socketAddress = "${address}:${builtins.toString port}";
-    in {
-      "${socketAddress}" = { };
-    };
+      mainListeners = builtins.intersectAttrs
+        (listenerUpstreams.client.http or { })
+        (listenerUpstreams.federation.http or { });
+    in
+      assert lib.assertMsg (mainListeners != { })
+        "No catch-all listener configured, or listener is not bound to an address";
+        mainListeners;
 
 
     services.nginx.upstreams.synapse_worker_federation = {
-      servers = let
-        fedReceivers = getWorkersOfType "fed-receiver";
-        socketAddresses = generateSocketAddresses "federation" fedReceivers;
-        in if fedReceivers != { } then
-          lib.genAttrs socketAddresses (_: { })
-      else config.services.nginx.upstreams.synapse_master.servers;
+      servers = workerUpstreams.fed-receiver.federation.http or config.services.nginx.upstreams.synapse_master.servers;
       extraConfig = ''
         ip_hash;
       '';
@@ -163,12 +167,7 @@ in
 
 
     services.nginx.upstreams.synapse_worker_initial_sync = {
-      servers = let
-        initialSyncers = getWorkersOfType "initial-sync";
-        socketAddresses = generateSocketAddresses "client" initialSyncers;
-      in if initialSyncers != { } then
-        lib.genAttrs socketAddresses (_: { })
-      else config.services.nginx.upstreams.synapse_master.servers;
+      servers = workerUpstreams.initial-sync.client.http or config.services.nginx.upstreams.synapse_master.servers;
       extraConfig = ''
         hash $mxid_localpart consistent;
       '';
@@ -176,12 +175,7 @@ in
 
 
     services.nginx.upstreams.synapse_worker_normal_sync = {
-      servers = let
-        normalSyncers = getWorkersOfType "normal-sync";
-        socketAddresses = generateSocketAddresses "client" normalSyncers;
-      in if normalSyncers != { } then
-        lib.genAttrs socketAddresses (_: { })
-      else config.services.nginx.upstreams.synapse_master.servers;
+      servers = workerUpstreams.normal-sync.client.http or config.services.nginx.upstreams.synapse_master.servers;
       extraConfig = ''
         hash $mxid_localpart consistent;
       '';
@@ -189,16 +183,11 @@ in
 
 
     services.nginx.upstreams.synapse_worker_user-dir = {
-      servers = let
-        workers = getWorkersOfType "user-dir";
-        socketAddresses = generateSocketAddresses "client" workers;
-      in if workers != { } then
-        lib.genAttrs socketAddresses (_: { })
-      else config.services.nginx.upstreams.synapse_master.servers;
+      servers = workerUpstreams.user-dir.client.http or config.services.nginx.upstreams.synapse_master.servers;
     };
 
     services.nginx.virtualHosts."${cfg.public_baseurl}" = {
-      enableACME = true;
+      enableACME = lib.mkDefault true;
       forceSSL = true;
       locations."/_matrix" = {
         proxyPass = "http://$synapse_backend";
@@ -230,6 +219,9 @@ in
       locations."/_synapse/client" = {
         proxyPass = "http://$synapse_backend";
       };
+      locations."/.well-known/matrix" = {
+        proxyPass = "http://$synapse_backend";
+      };
     };
   };
 }

synapse-module/workers.nix

@@ -1,5 +1,6 @@
 { matrix-synapse-common-config,
-  pluginsEnv,
+  matrix-lib,
+  wrapped,
   throw',
   format
 }:
@@ -22,17 +23,7 @@
 
   genAttrs' = items: f: g: builtins.listToAttrs (map (i: lib.nameValuePair (f i) (g i)) items);
 
-  isReplicationListener =
-    l: lib.any (r: lib.any (n: n == "replication") r.names) l.resources;
-
-  mainReplicationListener = lib.lists.findFirst isReplicationListener
-    (throw' "No replication listener configured!")
-    cfg.settings.listeners;
-  mainReplicationListenerHost =
-    if mainReplicationListener.bind_addresses == []
-      then throw' "Replication listener had no addresses"
-      else builtins.head mainReplicationListener.bind_addresses;
-  mainReplicationListenerPort = mainReplicationListener.port;
+  mainReplicationListener = matrix-lib.firstListenerOfType "replication" cfg.settings.listeners;
 in {
   # See https://github.com/matrix-org/synapse/blob/develop/docs/workers.md for more info
   options.services.matrix-synapse-next.workers = let
@@ -78,25 +69,21 @@ in {
           default = "synapse.app.generic_worker";
         };
 
-        worker_replication_host = mkOption {
-          type = types.str;
-          default = wcfg.mainReplicationHost;
-          defaultText = literalExpression "${wcfgText}.mainReplicationHost";
-          description = "The replication listeners IP on the main synapse process";
-        };
-
-        worker_replication_http_port = mkOption {
-          type = types.port;
-          default = wcfg.mainReplicationPort;
-          defaultText = literalExpression "${wcfgText}.mainReplicationPort";
-          description = "The replication listeners port on the main synapse process";
-        };
-
         worker_listeners = mkOption {
           type = types.listOf (workerListenerType instanceCfg);
           description = "Listener configuration for the worker, similar to the main synapse listener";
           default = [ ];
         };
+
+        worker_log_config = mkOption {
+          type = types.path;
+          description = ''
+            A yaml python logging config file as described by
+            https://docs.python.org/3.7/library/logging.config.html#configuration-dictionary-schema
+          '';
+          default = pkgs.writeText "log_config.yaml" cfg.mainLogConfig;
+          defaultText = "A config file generated from ${cfgText}.mainLogConfig";
+        };
       };
     };
 
@@ -109,10 +96,17 @@ in {
         };
 
         port = mkOption {
-          type = types.port;
+          type = with types; nullOr port;
+          default = null;
           description = "The TCP port to bind to";
         };
 
+        path = mkOption {
+          type = with types; nullOr path;
+          default = null;
+          description = "The UNIX socket to bind to";
+        };
+
         bind_addresses = mkOption {
           type = with types; listOf str;
           description = "A list of local addresses to listen on";
@@ -184,28 +178,45 @@ in {
     };
   in {
     mainReplicationHost = mkOption {
-      type = types.str;
-      default =
-        if builtins.elem mainReplicationListenerHost [ "0.0.0.0" "::" ]
+      type = with types; nullOr str;
+      default = let
+        host = (matrix-lib.connectionInfo mainReplicationListener).host;
+      in
+        # To avoid connecting to 0.0.0.0 and so on
+        if builtins.elem host [ "0.0.0.0" "::" ]
           then "127.0.0.1"
-          else mainReplicationListenerHost;
+          else host;
       # TODO: add defaultText
       description = "Host of the main synapse instance's replication listener";
     };
 
     mainReplicationPort = mkOption {
-      type = types.port;
-      default = mainReplicationListenerPort;
+      type = with types; nullOr port;
+      default = mainReplicationListener.port;
       # TODO: add defaultText
       description = "Port for the main synapse instance's replication listener";
     };
 
+    mainReplicationPath = mkOption {
+      type = with types; nullOr path;
+      default = mainReplicationListener.path;
+      # TODO: add defaultText
+      description = "Path to the UNIX socket of the main synapse instance's replication listener";
+    };
+
     defaultListenerAddress = mkOption {
       type = types.str;
       default = "127.0.0.1";
       description = "The default listener address for the worker";
     };
 
+    workersUsePath = mkOption {
+      type = types.bool;
+      description = "Whether to enable UNIX sockets for all automatically generated workers";
+      default = true;
+      example = false;
+    };
+
     workerStartingPort = mkOption {
       type = types.port;
       description = "What port should the automatically configured workers start enumerating from";
@@ -253,23 +264,32 @@ in {
   };
 
   config = {
+    assertions = [ ]
+      ++ (lib.concatMap (worker:
+        (map (l: {
+          assertion = l.path == null -> (l.bind_addresses != [ ] && l.port != null);
+          message = "At least one worker listener is missing either a socket path or a bind_address + port to listen on";
+        }) worker.settings.worker_listeners)
+      ) (lib.attrValues wcfg.instances));
+
     services.matrix-synapse-next.settings = {
       federation_sender_instances =
         lib.genList (i: "auto-fed-sender${toString (i + 1)}") wcfg.federationSenders;
 
-      instance_map = genAttrs' (lib.lists.range 1 wcfg.eventPersisters)
+      instance_map = (lib.mkIf (cfg.workers.instances != { }) ({
+        main = if wcfg.mainReplicationPath != null then {
+          path = wcfg.mainReplicationPath;
+        } else {
+          host = wcfg.mainReplicationHost;
+          port = wcfg.mainReplicationPort;
+        };
+      } // genAttrs' (lib.lists.range 1 wcfg.eventPersisters)
         (i: "auto-event-persist${toString i}")
         (i: let
-          wRL = lib.lists.findFirst isReplicationListener
-            (throw' "No replication listener configured!")
-            wcfg.instances."auto-event-persist${toString i}".settings.worker_listeners;
-          wRH = lib.findFirst (x: true) (throw' "Replication listener had no addresses")
-            wRL.bind_addresses;
-          wRP = wRL.port;
-        in {
-          host = wRH;
-          port = wRP;
-        });
+          wRL = matrix-lib.firstListenerOfType "replication" wcfg.instances."auto-event-persist${toString i}".settings.worker_listeners;
+        in if wRL.path != null then {
+          inherit (wRL) path;
+        } else matrix-lib.connectionInfo wRL)));
 
       stream_writers.events =
         mkIf (wcfg.eventPersisters > 0)
@@ -281,10 +301,15 @@ in {
 
     services.matrix-synapse-next.workers.instances = let
       sum = lib.foldl lib.add 0;
-      workerListenersWithMetrics = portOffset:
-        lib.singleton ({
-          port = wcfg.workerStartingPort + portOffset - 1;
-        }) 
+      workerListenersWithMetrics = portOffset: name:
+        [(if wcfg.workersUsePath
+          then {
+            path = "${cfg.socketDir}/matrix-synapse-worker-${name}.sock";
+          }
+          else {
+            port = wcfg.workerStartingPort + portOffset - 1;
+          }
+        )]
         ++ lib.optional wcfg.enableMetrics {
           port = wcfg.metricsStartingPort + portOffset;
           resources = [ { names = [ "metrics" ]; } ];
@@ -295,7 +320,7 @@ in {
         numberOfWorkers,
         portOffset ? 0,
         nameFn ? i: "auto-${type}${toString i}",
-        workerListenerFn ? i: workerListenersWithMetrics (portOffset + i)
+        workerListenerFn ? i: name: workerListenersWithMetrics (portOffset + i) name
       }: genAttrs'
         (lib.lists.range 1 numberOfWorkers)
         nameFn
@@ -303,7 +328,7 @@ in {
           isAuto = true;
           inherit type;
           index = i;
-          settings.worker_listeners = workerListenerFn i;
+          settings.worker_listeners = workerListenerFn i (nameFn i);
         });
 
       workerInstances = {
@@ -344,8 +369,13 @@ in {
 
     systemd.services = let
       workerList = lib.mapAttrsToList lib.nameValuePair wcfg.instances;
-      workerConfig = worker: format.generate "matrix-synapse-worker-${worker.name}-config.yaml"
-        (worker.value.settings // { worker_name = worker.name; });
+      workerConfig = worker:
+        format.generate "matrix-synapse-worker-${worker.name}-config.yaml"
+        (worker.value.settings // {
+          worker_name = worker.name;
+          worker_listeners =
+            map (lib.filterAttrsRecursive (_: v: v != null)) worker.value.settings.worker_listeners;
+        });
     in builtins.listToAttrs (lib.flip map workerList (worker: {
       name = "matrix-synapse-worker-${worker.name}";
       value = {
@@ -354,15 +384,25 @@ in {
         wantedBy = [ "matrix-synapse.target" ];
         after = [ "matrix-synapse.service" ];
         requires = [ "matrix-synapse.service" ];
-        environment.PYTHONPATH = lib.makeSearchPathOutput "lib" cfg.package.python.sitePackages [
-          pluginsEnv
-        ];
+
+        environment = lib.optionalAttrs cfg.withJemalloc {
+          LD_PRELOAD = "${pkgs.jemalloc}/lib/libjemalloc.so";
+          PYTHONMALLOC = "malloc";
+        };
+
         serviceConfig = {
           Type = "notify";
           User = "matrix-synapse";
           Group = "matrix-synapse";
           Slice = "system-matrix-synapse.slice";
+
+          Restart = "always";
+          RestartSec = 3;
+
           WorkingDirectory = cfg.dataDir;
+          RuntimeDirectory = "matrix-synapse";
+          StateDirectory = "matrix-synapse";
+
           ExecStartPre = pkgs.writers.writeBash "wait-for-synapse" ''
             # From https://md.darmstadt.ccc.de/synapse-at-work
             while ! systemctl is-active -q matrix-synapse.service; do
@@ -370,11 +410,50 @@ in {
             done
           '';
           ExecStart = let
-            flags = lib.cli.toGNUCommandLineShell {} {
+            flags = lib.cli.toCommandLineShellGNU {} {
               config-path = [ matrix-synapse-common-config (workerConfig worker) ] ++ cfg.extraConfigFiles;
               keys-directory = cfg.dataDir;
             };
-          in "${cfg.package}/bin/synapse_worker ${flags}";
+          in "${wrapped}/bin/synapse_worker ${flags}";
+
+          CapabilityBoundingSet = [ "" ];
+          LockPersonality = true;
+          NoNewPrivileges = true;
+          PrivateDevices = true;
+          PrivateTmp = true;
+          PrivateUsers = true;
+          ProcSubset = "pid";
+          ProtectClock = true;
+          ProtectControlGroups = true;
+          ProtectHome = true;
+          ProtectHostname = true;
+          ProtectKernelLogs = true;
+          ProtectKernelModules = true;
+          ProtectKernelTunables = true;
+          ProtectProc = "invisible";
+          ProtectSystem = "strict";
+          ReadWritePaths = [
+            cfg.dataDir
+            cfg.settings.media_store_path
+          ]
+          ++ (map (listener: dirOf listener.path) (
+            lib.filter (listener: listener.path != null) cfg.settings.listeners
+          ));
+          RemoveIPC = true;
+          RestrictAddressFamilies = [
+            "AF_INET"
+            "AF_INET6"
+            "AF_UNIX"
+          ];
+          RestrictNamespaces = true;
+          RestrictRealtime = true;
+          RestrictSUIDSGID = true;
+          SystemCallArchitectures = "native";
+          SystemCallFilter = [
+            "@system-service"
+            "~@resources"
+            "~@privileged"
+          ];
         };
       };
     }));

tests/default.nix

@@ -0,0 +1,4 @@
+{ nixpkgs, pkgs, matrix-lib, ... }:
+{
+  nginx-pipeline-eval = pkgs.callPackage ./nginx-pipeline { inherit nixpkgs matrix-lib; };
+}

tests/nginx-pipeline/default.nix

@@ -0,0 +1,53 @@
+{ nixpkgs, lib, matrix-lib, writeText, ... }:
+let
+  nixosConfig = nixpkgs.lib.nixosSystem {
+    system = "x86_64-linux";
+    modules = [
+      ../../module.nix
+      {
+        system.stateVersion = "25.11";
+        boot.isContainer = true;
+        services.matrix-synapse-next = {
+          enable = true;
+          enableNginx = true;
+
+          workers = {
+            enableMetrics = true;
+
+            federationSenders = 3;
+            federationReceivers = 3;
+            initialSyncers = 1;
+            normalSyncers = 1;
+            eventPersisters = 1;
+            useUserDirectoryWorker = true;
+
+            instances.auto-fed-receiver1.settings.worker_listeners = [
+              {
+                bind_addresses = [
+                  "127.0.0.2"
+                ];
+                port = 1337;
+                resources = [
+                  { compress = false;
+                    names = [ "federation" ];
+                  }
+                ];
+              }
+            ];
+          };
+
+          settings.server_name = "example.com";
+        };
+      }
+    ];
+  };
+
+  inherit (nixosConfig.config.services.matrix-synapse-next.workers) instances;
+in
+  writeText "matrix-synapse-next-nginx-pipeline-test.txt" ''
+    ${(lib.generators.toPretty {}) instances}
+
+    ====================================================
+
+    ${(lib.generators.toPretty {}) (matrix-lib.mapWorkersToUpstreamsByType instances)}
+  ''