treewide: add support for unix sockets

.gitignore

@@ -1 +0,0 @@
-result

MIGRATIONS.MD

@@ -2,17 +2,6 @@
 
 This is a best effort document descibing neccecary changes you might have to do when updating
 
-## 0.8.0
-
-`saml2` is no longer enabled, as it depends on vulnerable dependencies and isnt really built in nixpks anymore.
-
-If you need to authenticate with saml, you should deploy some sort of saml to openid bridge, instead.
-
-## 0.6.1
-
-enableSlidingSync, and setting matrix-synapse.sliding-sync.environmentFile (or any other sliding-sync setting)
-is no longer needed for a sliding-sync setup. Upgrading will force relogins for all users.
-
 ## 0.5.0
 
 * The module has been renamed from `synapse` to `default`

README.MD

@@ -1,5 +1,3 @@
-For support and requests feel free to join [#nixos-matrix-modules:dodsorf.as](https://matrix.to/#/#nixos-matrix-modules:dodsorf.as), [uri](matrix:r/nixos-matrix-modules:dodsorf.as)
-
 With matrix.YOURDOMAIN pointing at the server:
 
 ```
@@ -38,3 +36,19 @@ With matrix.YOURDOMAIN pointing at the server:
 ```
 
 is ~enough to get a functional matrix-server running with some workers
+
+## Sliding Sync (Element X)
+
+Just add the following to your config and point `slidingsync.YOURDOMAIN` at the server
+
+```
+services.matrix-synapse-next = {
+  enableSlidingSync = true;
+};
+
+services.matrix-synapse.sliding-sync.environmentFile = "/some/file/containing/SYNCV3_SECRET=<some secret>";
+
+```
+
+If using [well-known delagation](https://matrix-org.github.io/synapse/v1.37/delegate.html) make sure `YOURDOMAIN/.well-known/matrix/client` matches
+what's in `matrix.YOURDOMAIN/.well-known/matrix/client`

flake.lock

@@ -1,23 +1,23 @@
 {
   "nodes": {
-    "nixpkgs": {
+    "nixpkgs-lib": {
       "locked": {
-        "lastModified": 1764983851,
-        "narHash": "sha256-y7RPKl/jJ/KAP/VKLMghMgXTlvNIJMHKskl8/Uuar7o=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "d9bc5c7dceb30d8d6fafa10aeb6aa8a48c218454",
+        "lastModified": 1673743903,
+        "narHash": "sha256-sloY6KYyVOozJ1CkbgJPpZ99TKIjIvM+04V48C04sMQ=",
+        "owner": "nix-community",
+        "repo": "nixpkgs.lib",
+        "rev": "7555e2dfcbac1533f047021f1744ac8871150f9f",
         "type": "github"
       },
       "original": {
-        "id": "nixpkgs",
-        "ref": "nixos-25.11",
-        "type": "indirect"
+        "owner": "nix-community",
+        "repo": "nixpkgs.lib",
+        "type": "github"
       }
     },
     "root": {
       "inputs": {
-        "nixpkgs": "nixpkgs"
+        "nixpkgs-lib": "nixpkgs-lib"
       }
     }
   },

flake.nix

@@ -2,31 +2,13 @@
   description = "NixOS modules for matrix related services";
 
   inputs = {
-    nixpkgs.url = "nixpkgs/nixos-25.11";
+    nixpkgs-lib.url = github:nix-community/nixpkgs.lib;
   };
 
-  outputs = { self, nixpkgs }: {
+  outputs = { self, nixpkgs-lib }: {
     nixosModules = {
       default = import ./module.nix;
     };
-
-    lib = import ./lib.nix { lib = nixpkgs.lib; };
-
-    checks = let
-      forAllSystems = f:
-        nixpkgs.lib.genAttrs [
-          "x86_64-linux"
-          "aarch64-linux"
-          "x86_64-darwin"
-          "aarch64-darwin"
-        ] (system: f nixpkgs.legacyPackages.${system});
-    in forAllSystems (pkgs: let
-      tests = import ./tests {
-        inherit nixpkgs pkgs;
-        matrix-lib = self.lib;
-      };
-    in {
-      inherit (tests) nginx-pipeline-eval;
-    });
+    lib = import ./lib.nix { lib = nixpkgs-lib.lib; };
   };
 }

lib.nix

@@ -4,7 +4,7 @@ rec {
   isListenerType = type: l: lib.any (r: lib.any (n: n == type) r.names) l.resources;
   # Get the first listener that includes the given resource from worker
   firstListenerOfType = type: ls: lib.lists.findFirst (isListenerType type)
-    (throw "No listener with resource: ${type} configured")
+    (lib.throw "No listener with resource: ${type} configured")
     ls;
   # Get an attrset of the host and port from a listener 
   connectionInfo = l: {
@@ -17,64 +17,4 @@ rec {
     l = firstListenerOfType r w.settings.worker_listeners;
   in connectionInfo l;
 
-  mapWorkersToUpstreamsByType = workerInstances:
-    lib.pipe workerInstances [
-      lib.attrValues
-
-      # Index by worker type
-      (lib.foldl (acc: worker: acc // {
-        ${worker.type} = (acc.${worker.type} or [ ]) ++ [ worker ];
-      }) { })
-
-      # Subindex by resource names, listener types, and convert to upstreams
-      (lib.mapAttrs (_: workers: lib.pipe workers [
-        (lib.concatMap (worker: [ (lib.lists.head  worker.settings.worker_listeners) ]))
-        lib.flatten
-        mapListenersToUpstreamsByType
-      ]))
-    ];
-
-    mapListenersToUpstreamsByType = listenerInstances:
-      lib.pipe listenerInstances [
-        # Index by resource names
-        (lib.concatMap (listener: lib.pipe listener [
-          (listener: let
-            allResourceNames = lib.pipe listener.resources [
-              (map (resource: resource.names))
-              lib.flatten
-              lib.unique
-            ];
-          in if allResourceNames == [ ]
-            then { "empty" = listener; }
-            else lib.genAttrs allResourceNames (_: listener))
-          lib.attrsToList
-        ]))
-
-        (lib.foldl (acc: listener: acc // {
-          ${listener.name} = (acc.${listener.name} or [ ]) ++ [ listener.value ];
-        }) { })
-
-        # Index by listener type
-        (lib.mapAttrs (_:
-          (lib.foldl (acc: listener: acc // {
-            ${listener.type} = (acc.${listener.type} or [ ]) ++ [ listener ];
-          }) { })
-        ))
-
-        # Convert listeners to upstream URIs
-        (lib.mapAttrs (_:
-          (lib.mapAttrs (_: listeners:
-            lib.pipe listeners [
-              (lib.concatMap (listener:
-                if listener.path != null
-                  then [ "unix:${listener.path}" ]
-                  else (map (addr: "${addr}:${toString listener.port}") listener.bind_addresses)
-              ))
-              # NOTE: Adding ` = { }` to every upstream might seem unnecessary in isolation,
-              #       but it makes it easier to set upstreams in the nginx module.
-              (uris: lib.genAttrs uris (_: { }))
-            ]
-          ))
-        ))
-      ];
 }

module.nix

@@ -1,14 +1,8 @@
-{ lib, ... }:
+{ ... }:
 
 {
   imports = [
     ./synapse-module
-
-    # TODO: Remove after 25.05
-    (lib.mkRemovedOptionModule [ "services" "matrix-synapse" "sliding-sync" ] ''
-      `services.matrix-synapse.sliding-sync` is no longer necessary to use sliding-sync with synapse.
-      As synapse now includes this in itself, if you have a manually managed `.well-known/matrix/client` file
-      remove the proxy url from it.
-    '')
+    ./sliding-sync
   ];
 }

sliding-sync/default.nix

@@ -0,0 +1,117 @@
+{ config, lib, pkgs, ... }:
+
+let
+  cfg = config.services.matrix-synapse.sliding-sync;
+in
+{
+  disabledModules = [ "services/matrix/matrix-sliding-sync.nix" ];
+
+  options.services.matrix-synapse.sliding-sync = {
+    enable = lib.mkEnableOption (lib.mdDoc "sliding sync");
+
+    package = lib.mkOption {
+      type = lib.types.package;
+      default = pkgs.matrix-sliding-sync;
+      description = "What package to use for the sliding-sync proxy.";
+    };
+
+    enableNginx = lib.mkEnableOption (lib.mdDoc "autogenerated nginx config");
+    publicBaseUrl = lib.mkOption {
+      type = lib.types.str;
+      description = "The domain where clients connect, only has an effect with enableNginx";
+      example = "slidingsync.matrix.org";
+    };
+
+    settings = lib.mkOption {
+      type = lib.types.submodule {
+        freeformType = with lib.types; attrsOf str;
+        options = {
+          SYNCV3_SERVER = lib.mkOption {
+            type = lib.types.str;
+            description = lib.mdDoc ''
+              The destination homeserver to talk to not including `/_matrix/` e.g `https://matrix.example.org`.
+            '';
+          };
+
+          SYNCV3_DB = lib.mkOption {
+            type = lib.types.str;
+            default = "postgresql:///matrix-sliding-sync?host=/run/postgresql";
+            description = lib.mdDoc ''
+              The postgres connection string.
+              Refer to <https://www.postgresql.org/docs/current/libpq-connect.html#LIBPQ-CONNSTRING>.
+            '';
+          };
+
+          SYNCV3_BINDADDR = lib.mkOption {
+            type = lib.types.str;
+            default = "127.0.0.1:8009";
+            example = "[::]:8008";
+            description = lib.mdDoc "The interface and port to listen on.";
+          };
+
+          SYNCV3_LOG_LEVEL = lib.mkOption {
+            type = lib.types.enum [ "trace" "debug" "info" "warn" "error" "fatal" ];
+            default = "info";
+            description = lib.mdDoc "The level of verbosity for messages logged.";
+          };
+        };
+      };
+      default = { };
+      description = ''
+        Freeform environment variables passed to the sliding sync proxy.
+        Refer to <https://github.com/matrix-org/sliding-sync#setup> for all supported values.
+      '';
+    };
+
+    createDatabase = lib.mkOption {
+      type = lib.types.bool;
+      default = true;
+      description = lib.mdDoc ''
+        Whether to enable and configure `services.postgres` to ensure that the database user `matrix-sliding-sync`
+        and the database `matrix-sliding-sync` exist.
+      '';
+    };
+
+    environmentFile = lib.mkOption {
+      type = lib.types.str;
+      description = lib.mdDoc ''
+        Environment file as defined in {manpage}`systemd.exec(5)`.
+
+        This must contain the {env}`SYNCV3_SECRET` variable which should
+        be generated with {command}`openssl rand -hex 32`.
+      '';
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    services.postgresql = lib.optionalAttrs cfg.createDatabase {
+      enable = true;
+      ensureDatabases = [ "matrix-sliding-sync" ];
+      ensureUsers = [ rec {
+        name = "matrix-sliding-sync";
+        ensurePermissions."DATABASE \"${name}\"" = "ALL PRIVILEGES";
+      } ];
+    };
+
+    systemd.services.matrix-sliding-sync = {
+      after = lib.optional cfg.createDatabase "postgresql.service";
+      wantedBy = [ "multi-user.target" ];
+      environment = cfg.settings;
+      serviceConfig = {
+        DynamicUser = true;
+        EnvironmentFile = cfg.environmentFile;
+        ExecStart = lib.getExe cfg.package;
+        StateDirectory = "matrix-sliding-sync";
+        WorkingDirectory = "%S/matrix-sliding-sync";
+      };
+    };
+
+    services.nginx.virtualHosts.${cfg.publicBaseUrl} = lib.mkIf cfg.enableNginx {
+      enableACME = true;
+      forceSSL = true;
+      locations."/" = {
+        proxyPass = lib.replaceStrings [ "0.0.0.0" "::" ] [ "127.0.0.1" "::1" ] "http://${cfg.settings.SYNCV3_BINDADDR}";
+      };
+    };
+  };
+}

synapse-module/default.nix

@@ -19,6 +19,7 @@ let
     inherit (cfg) plugins;
     extras = [
       "postgres"
+      "saml2"
       "oidc"
       "systemd"
       "url-preview"
@@ -26,6 +27,7 @@ let
       "jwt"
       "redis"
       "cache-memory"
+      "user-search"
     ];
   };
 
@@ -70,14 +72,6 @@ in
       '';
     };
 
-    withJemalloc = mkOption {
-      type = types.bool;
-      default = true;
-      description = ''
-        Whether to preload jemalloc to reduce memory fragmentation and overall usage.
-      '';
-    };
-
     dataDir = mkOption {
       type = types.path;
       default = "/var/lib/matrix-synapse";
@@ -401,13 +395,11 @@ in
         message = "Some listeners are missing either a socket path or a bind_address + port to listen on";
       }) cfg.settings.listeners);
 
-    warnings = [ ] ++ lib.optional cfg.enableSlidingSync
-      "the option services.matrix-synapse-next.enableSlidingSync no longer has any effect (and is enabled by default)";
-
     users.users.matrix-synapse = {
       group = "matrix-synapse";
       home = cfg.dataDir;
       createHome = true;
+      shell = "${pkgs.bash}/bin/bash";
       uid = config.ids.uids.matrix-synapse;
     };
 
@@ -433,79 +425,46 @@ in
         partOf = [ "matrix-synapse.target" ];
         wantedBy = [ "matrix-synapse.target" ];
 
-        environment = lib.optionalAttrs cfg.withJemalloc {
-          LD_PRELOAD = "${pkgs.jemalloc}/lib/libjemalloc.so";
-          PYTHONMALLOC = "malloc";
-        };
+        preStart = let
+          flags = lib.cli.toGNUCommandLineShell {} {
+            config-path = [ matrix-synapse-common-config ] ++ cfg.extraConfigFiles;
+            keys-directory = cfg.dataDir;
+            generate-keys = true;
+          };
+        in "${cfg.package}/bin/synapse_homeserver ${flags}";
 
         serviceConfig = {
           Type = "notify";
           User = "matrix-synapse";
           Group = "matrix-synapse";
           Slice = "system-matrix-synapse.slice";
-
-          Restart = "always";
-          RestartSec = 3;
-
           WorkingDirectory = cfg.dataDir;
           StateDirectory = "matrix-synapse";
           RuntimeDirectory = "matrix-synapse";
-
-          ExecStartPre = let
-            flags = lib.cli.toCommandLineShellGNU {} {
-              config-path = [ matrix-synapse-common-config ] ++ cfg.extraConfigFiles;
-              keys-directory = cfg.dataDir;
-              generate-keys = true;
-            };
-          in "${cfg.package}/bin/synapse_homeserver ${flags}";
           ExecStart = let
-            flags = lib.cli.toCommandLineShellGNU {} {
+            flags = lib.cli.toGNUCommandLineShell {} {
               config-path = [ matrix-synapse-common-config ] ++ cfg.extraConfigFiles;
               keys-directory = cfg.dataDir;
             };
           in "${wrapped}/bin/synapse_homeserver ${flags}";
-          ExecReload = "${lib.getExe' pkgs.coreutils "kill"} -HUP $MAINPID";
-
-          CapabilityBoundingSet = [ "" ];
-          LockPersonality = true;
-          NoNewPrivileges = true;
-          PrivateDevices = true;
-          PrivateTmp = true;
-          PrivateUsers = true;
-          ProcSubset = "pid";
-          ProtectClock = true;
-          ProtectControlGroups = true;
-          ProtectHome = true;
-          ProtectHostname = true;
-          ProtectKernelLogs = true;
-          ProtectKernelModules = true;
-          ProtectKernelTunables = true;
-          ProtectProc = "invisible";
-          ProtectSystem = "strict";
-          ReadWritePaths = [
-            cfg.dataDir
-            cfg.settings.media_store_path
-          ]
-          ++ (map (listener: dirOf listener.path) (
-            lib.filter (listener: listener.path != null) cfg.settings.listeners
-          ));
-          RemoveIPC = true;
-          RestrictAddressFamilies = [
-            "AF_INET"
-            "AF_INET6"
-            "AF_UNIX"
-          ];
-          RestrictNamespaces = true;
-          RestrictRealtime = true;
-          RestrictSUIDSGID = true;
-          SystemCallArchitectures = "native";
-          SystemCallFilter = [
-            "@system-service"
-            "~@resources"
-            "~@privileged"
-          ];
+          ExecReload = "${pkgs.utillinux}/bin/kill -HUP $MAINPID";
+          Restart = "on-failure";
         };
       };
     };
+
+    services.matrix-synapse-next.settings.extra_well_known_client_content."org.matrix.msc3575.proxy" = mkIf cfg.enableSlidingSync {
+      url = "https://${config.services.matrix-synapse.sliding-sync.publicBaseUrl}";
+    };
+    services.matrix-synapse.sliding-sync = mkIf cfg.enableSlidingSync {
+      enable = true;
+      enableNginx = lib.mkDefault cfg.enableNginx;
+      publicBaseUrl = lib.mkDefault "slidingsync.${cfg.settings.server_name}";
+
+      settings = {
+        SYNCV3_SERVER = lib.mkDefault "https://${cfg.public_baseurl}";
+        SYNCV3_PROM = lib.mkIf cfg.settings.enable_metrics (lib.mkDefault "127.0.0.1:9001");
+      };
+    };
   };
 }

synapse-module/nginx.nix

@@ -2,10 +2,54 @@
 let
   cfg = config.services.matrix-synapse-next;
 
-  matrix-lib = (import ../lib.nix { inherit lib; });
+  mapWorkersToUpstreamsByType = workerInstances: lib.pipe workerInstances [
+    lib.attrValues
 
-  workerUpstreams = matrix-lib.mapWorkersToUpstreamsByType cfg.workers.instances;
-  listenerUpstreams = matrix-lib.mapListenersToUpstreamsByType cfg.settings.listeners;
+    # Index by worker type
+    (lib.foldl (acc: worker: acc // {
+      ${worker.type} = (acc.${worker.type} or [ ]) ++ [ worker ];
+    }) { })
+
+    # Subindex by listener type (listener names), and convert to upstreams
+    (lib.mapAttrs (_: workers: lib.pipe workers [
+      (lib.concatMap (worker: worker.settings.worker_listeners))
+      lib.flatten
+      mapListenersToUpstreamsByType
+    ]))
+  ];
+
+  mapListenersToUpstreamsByType = listenerInstances: lib.pipe listenerInstances [
+    # Index by listener type (listener names)
+    (lib.concatMap (listener: lib.pipe listener [
+      (listener: let
+        allResourceNames = lib.pipe listener.resources [
+          (map (resource: resource.names))
+          lib.flatten
+          lib.unique
+        ];
+      in if allResourceNames == [ ]
+        then { "empty" = listener; }
+        else lib.genAttrs allResourceNames (_: listener))
+      lib.attrsToList
+    ]))
+
+    (lib.foldl (acc: listener: acc // {
+      ${listener.name} = (acc.${listener.name} or [ ]) ++ [ listener.value ];
+    }) { })
+
+    # Convert listeners to upstream URIs
+    (lib.mapAttrs (_: listeners: lib.pipe listeners [
+      (lib.concatMap (listener:
+        if listener.path != null
+          then [ "unix:${listener.path}" ]
+          else (map (addr: "${addr}:${toString listener.port}") listener.bind_addresses)
+      ))
+      (uris: lib.genAttrs uris (_: { }))
+    ]))
+  ];
+
+  workerUpstreams = mapWorkersToUpstreamsByType cfg.workers.instances;
+  listenerUpstreams = mapListenersToUpstreamsByType cfg.settings.listeners;
 in
 {
   config = lib.mkIf cfg.enableNginx {
@@ -24,7 +68,6 @@ in
         ~^/_matrix/client/(api/v1|r0|v3)/rooms/[^/]+/initialSync$ synapse_initial_sync;
 
         # Federation requests
-        ~^/_matrix/federation/v1/version$ synapse_federation;
         ~^/_matrix/federation/v1/event/ synapse_federation;
         ~^/_matrix/federation/v1/state/ synapse_federation;
         ~^/_matrix/federation/v1/state_ids/ synapse_federation;
@@ -36,8 +79,6 @@ in
         ~^/_matrix/federation/v1/make_leave/ synapse_federation;
         ~^/_matrix/federation/(v1|v2)/send_join/ synapse_federation;
         ~^/_matrix/federation/(v1|v2)/send_leave/ synapse_federation;
-        ~^/_matrix/federation/v1/make_knock/ synapse_federation;
-        ~^/_matrix/federation/v1/send_knock/ synapse_federation;
         ~^/_matrix/federation/(v1|v2)/invite/ synapse_federation;
         ~^/_matrix/federation/v1/event_auth/ synapse_federation;
         ~^/_matrix/federation/v1/timestamp_to_event/ synapse_federation;
@@ -59,23 +100,17 @@ in
         ~^/_matrix/client/v1/rooms/.*/hierarchy$ synapse_client_interaction;
         ~^/_matrix/client/(v1|unstable)/rooms/.*/relations/ synapse_client_interaction;
         ~^/_matrix/client/v1/rooms/.*/threads$ synapse_client_interaction;
+        ~^/_matrix/client/unstable/org.matrix.msc2716/rooms/.*/batch_send$ synapse_client_interaction;
         ~^/_matrix/client/unstable/im.nheko.summary/rooms/.*/summary$ synapse_client_interaction;
         ~^/_matrix/client/(r0|v3|unstable)/account/3pid$ synapse_client_interaction;
         ~^/_matrix/client/(r0|v3|unstable)/account/whoami$ synapse_client_interaction;
-        ~^/_matrix/client/(r0|v3|unstable)/account/deactivate$ synapse_client_interaction;
-        ~^/_matrix/client/(r0|v3)/delete_devices$ synapse_client_interaction;
-        ~^/_matrix/client/(api/v1|r0|v3|unstable)/devices(/|$) synapse_client_interaction;
+        ~^/_matrix/client/(r0|v3|unstable)/devices$ synapse_client_interaction;
         ~^/_matrix/client/versions$ synapse_client_interaction;
         ~^/_matrix/client/(api/v1|r0|v3|unstable)/voip/turnServer$ synapse_client_interaction;
         ~^/_matrix/client/(api/v1|r0|v3|unstable)/rooms/.*/event/ synapse_client_interaction;
         ~^/_matrix/client/(api/v1|r0|v3|unstable)/joined_rooms$ synapse_client_interaction;
         ~^/_matrix/client/v1/rooms/.*/timestamp_to_event$ synapse_client_interaction;
-        ~^/_matrix/client/(api/v1|r0|v3|unstable/.*)/rooms/.*/aliases synapse_client_interaction;
         ~^/_matrix/client/(api/v1|r0|v3|unstable)/search$ synapse_client_interaction;
-        ~^/_matrix/client/(r0|v3|unstable)/user/.*/filter(/|$) synapse_client_interaction;
-        ~^/_matrix/client/(api/v1|r0|v3|unstable)/directory/room/.*$ synapse_client_interaction;
-        ~^/_matrix/client/(r0|v3|unstable)/capabilities$ synapse_client_interaction;
-        ~^/_matrix/client/(r0|v3|unstable)/notifications$ synapse_client_interaction;
 
         # Encryption requests
         ~^/_matrix/client/(r0|v3|unstable)/keys/query$ synapse_client_encryption;
@@ -83,15 +118,11 @@ in
         ~^/_matrix/client/(r0|v3|unstable)/keys/claim$ synapse_client_encryption;
         ~^/_matrix/client/(r0|v3|unstable)/room_keys/ synapse_client_encryption;
         ~^/_matrix/client/(r0|v3|unstable)/keys/upload/ synapse_client_encryption;
-        ~^/_matrix/client/(api/v1|r0|v3|unstable)/keys/device_signing/upload$ synapse_client_encryption;
-        ~^/_matrix/client/(api/v1|r0|v3|unstable)/keys/signatures/upload$ synapse_client_encryption;
 
         # Registration/login requests
         ~^/_matrix/client/(api/v1|r0|v3|unstable)/login$ synapse_client_login;
         ~^/_matrix/client/(r0|v3|unstable)/register$ synapse_client_login;
-        ~^/_matrix/client/(r0|v3|unstable)/register/available$ synapse_client_login;
         ~^/_matrix/client/v1/register/m.login.registration_token/validity$ synapse_client_login;
-        ~^/_matrix/client/(r0|v3|unstable)/password_policy$ synapse_client_login;
 
         # Event sending requests
         ~^/_matrix/client/(api/v1|r0|v3|unstable)/rooms/.*/redact synapse_client_transaction;
@@ -99,7 +130,6 @@ in
         ~^/_matrix/client/(api/v1|r0|v3|unstable)/rooms/.*/state/ synapse_client_transaction;
         ~^/_matrix/client/(api/v1|r0|v3|unstable)/rooms/.*/(join|invite|leave|ban|unban|kick)$ synapse_client_transaction;
         ~^/_matrix/client/(api/v1|r0|v3|unstable)/join/ synapse_client_transaction;
-        ~^/_matrix/client/(api/v1|r0|v3|unstable)/knock/ synapse_client_transaction;
         ~^/_matrix/client/(api/v1|r0|v3|unstable)/profile/ synapse_client_transaction;
 
         # Account data requests
@@ -150,8 +180,8 @@ in
 
     services.nginx.upstreams.synapse_master.servers = let
       mainListeners = builtins.intersectAttrs
-        (listenerUpstreams.client.http or { })
-        (listenerUpstreams.federation.http or { });
+        (listenerUpstreams."client" or { })
+        (listenerUpstreams."federation" or { });
     in
       assert lib.assertMsg (mainListeners != { })
         "No catch-all listener configured, or listener is not bound to an address";
@@ -159,7 +189,7 @@ in
 
 
     services.nginx.upstreams.synapse_worker_federation = {
-      servers = workerUpstreams.fed-receiver.federation.http or config.services.nginx.upstreams.synapse_master.servers;
+      servers = workerUpstreams.fed-receiver.federation or config.services.nginx.upstreams.synapse_master.servers;
       extraConfig = ''
         ip_hash;
       '';
@@ -167,7 +197,7 @@ in
 
 
     services.nginx.upstreams.synapse_worker_initial_sync = {
-      servers = workerUpstreams.initial-sync.client.http or config.services.nginx.upstreams.synapse_master.servers;
+      servers = workerUpstreams.initial-sync.client or config.services.nginx.upstreams.synapse_master.servers;
       extraConfig = ''
         hash $mxid_localpart consistent;
       '';
@@ -175,7 +205,7 @@ in
 
 
     services.nginx.upstreams.synapse_worker_normal_sync = {
-      servers = workerUpstreams.normal-sync.client.http or config.services.nginx.upstreams.synapse_master.servers;
+      servers = workerUpstreams.normal-sync.client or config.services.nginx.upstreams.synapse_master.servers;
       extraConfig = ''
         hash $mxid_localpart consistent;
       '';
@@ -183,7 +213,7 @@ in
 
 
     services.nginx.upstreams.synapse_worker_user-dir = {
-      servers = workerUpstreams.user-dir.client.http or config.services.nginx.upstreams.synapse_master.servers;
+      servers = workerUpstreams.user-dir.client or config.services.nginx.upstreams.synapse_master.servers;
     };
 
     services.nginx.virtualHosts."${cfg.public_baseurl}" = {

synapse-module/workers.nix

@@ -74,16 +74,6 @@ in {
           description = "Listener configuration for the worker, similar to the main synapse listener";
           default = [ ];
         };
-
-        worker_log_config = mkOption {
-          type = types.path;
-          description = ''
-            A yaml python logging config file as described by
-            https://docs.python.org/3.7/library/logging.config.html#configuration-dictionary-schema
-          '';
-          default = pkgs.writeText "log_config.yaml" cfg.mainLogConfig;
-          defaultText = "A config file generated from ${cfgText}.mainLogConfig";
-        };
       };
     };
 
@@ -384,25 +374,14 @@ in {
         wantedBy = [ "matrix-synapse.target" ];
         after = [ "matrix-synapse.service" ];
         requires = [ "matrix-synapse.service" ];
-
-        environment = lib.optionalAttrs cfg.withJemalloc {
-          LD_PRELOAD = "${pkgs.jemalloc}/lib/libjemalloc.so";
-          PYTHONMALLOC = "malloc";
-        };
-
         serviceConfig = {
           Type = "notify";
           User = "matrix-synapse";
           Group = "matrix-synapse";
           Slice = "system-matrix-synapse.slice";
-
-          Restart = "always";
-          RestartSec = 3;
-
           WorkingDirectory = cfg.dataDir;
           RuntimeDirectory = "matrix-synapse";
           StateDirectory = "matrix-synapse";
-
           ExecStartPre = pkgs.writers.writeBash "wait-for-synapse" ''
             # From https://md.darmstadt.ccc.de/synapse-at-work
             while ! systemctl is-active -q matrix-synapse.service; do
@@ -410,50 +389,11 @@ in {
             done
           '';
           ExecStart = let
-            flags = lib.cli.toCommandLineShellGNU {} {
+            flags = lib.cli.toGNUCommandLineShell {} {
               config-path = [ matrix-synapse-common-config (workerConfig worker) ] ++ cfg.extraConfigFiles;
               keys-directory = cfg.dataDir;
             };
           in "${wrapped}/bin/synapse_worker ${flags}";
-
-          CapabilityBoundingSet = [ "" ];
-          LockPersonality = true;
-          NoNewPrivileges = true;
-          PrivateDevices = true;
-          PrivateTmp = true;
-          PrivateUsers = true;
-          ProcSubset = "pid";
-          ProtectClock = true;
-          ProtectControlGroups = true;
-          ProtectHome = true;
-          ProtectHostname = true;
-          ProtectKernelLogs = true;
-          ProtectKernelModules = true;
-          ProtectKernelTunables = true;
-          ProtectProc = "invisible";
-          ProtectSystem = "strict";
-          ReadWritePaths = [
-            cfg.dataDir
-            cfg.settings.media_store_path
-          ]
-          ++ (map (listener: dirOf listener.path) (
-            lib.filter (listener: listener.path != null) cfg.settings.listeners
-          ));
-          RemoveIPC = true;
-          RestrictAddressFamilies = [
-            "AF_INET"
-            "AF_INET6"
-            "AF_UNIX"
-          ];
-          RestrictNamespaces = true;
-          RestrictRealtime = true;
-          RestrictSUIDSGID = true;
-          SystemCallArchitectures = "native";
-          SystemCallFilter = [
-            "@system-service"
-            "~@resources"
-            "~@privileged"
-          ];
         };
       };
     }));

tests/default.nix

@@ -1,4 +0,0 @@
-{ nixpkgs, pkgs, matrix-lib, ... }:
-{
-  nginx-pipeline-eval = pkgs.callPackage ./nginx-pipeline { inherit nixpkgs matrix-lib; };
-}

tests/nginx-pipeline/default.nix

@@ -1,53 +0,0 @@
-{ nixpkgs, lib, matrix-lib, writeText, ... }:
-let
-  nixosConfig = nixpkgs.lib.nixosSystem {
-    system = "x86_64-linux";
-    modules = [
-      ../../module.nix
-      {
-        system.stateVersion = "25.11";
-        boot.isContainer = true;
-        services.matrix-synapse-next = {
-          enable = true;
-          enableNginx = true;
-
-          workers = {
-            enableMetrics = true;
-
-            federationSenders = 3;
-            federationReceivers = 3;
-            initialSyncers = 1;
-            normalSyncers = 1;
-            eventPersisters = 1;
-            useUserDirectoryWorker = true;
-
-            instances.auto-fed-receiver1.settings.worker_listeners = [
-              {
-                bind_addresses = [
-                  "127.0.0.2"
-                ];
-                port = 1337;
-                resources = [
-                  { compress = false;
-                    names = [ "federation" ];
-                  }
-                ];
-              }
-            ];
-          };
-
-          settings.server_name = "example.com";
-        };
-      }
-    ];
-  };
-
-  inherit (nixosConfig.config.services.matrix-synapse-next.workers) instances;
-in
-  writeText "matrix-synapse-next-nginx-pipeline-test.txt" ''
-    ${(lib.generators.toPretty {}) instances}
-
-    ====================================================
-
-    ${(lib.generators.toPretty {}) (matrix-lib.mapWorkersToUpstreamsByType instances)}
-  ''