···

       
6
       
 
       


     

       
7
       
 
       
  outputs = { self, nixpkgs, nixos-mailserver, ... }: rec {

     

       
8
       
 
       
    packages = nixpkgs.lib.genAttrs nixpkgs.lib.systems.flakeExposed (system:

     

       
9
       
-
       
      let

     

       
10
       
-
       
        pkgs = nixpkgs.legacyPackages.${system};

     

       
11
       
-
       
      in {

     

       
12
       
-
       
        manpage = import ./man { inherit pkgs system nixos-mailserver; };

     

       
13
       
-
       
      });

     

       
14
       
 
       


     

       
15
       
 
       
    nixosModules.default = {

     

       
16
       
 
       
      imports = [

     

       
17
       
 
       
        ./modules/default.nix

     

       
18
       
 
       
        nixos-mailserver.nixosModule

     

       
19
       
 
       
        ({ pkgs, config, ... }: {

     

       
20
       
-
       
          nixpkgs.overlays = [ (final: prev: {

     

       
21
       
-
       
            mautrix-meta = (prev.callPackage ./pkgs/mautrix-meta.nix { });

     

       
22
       
-
       
          }) ];

     

       
0
       
 
       

     

       
0
       
 
       

     

       
23
       
 
       
        })

     

       
24
       
 
       
      ];

     

       
25
       
 
       
    };

     

       
26
       
 
       
    defaultTemplate.path = ./template;

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
27
       
 
       
  };

     

       
28
       
 
       
}

     

···

       
6
       
 
       


     

       
7
       
 
       
  outputs = { self, nixpkgs, nixos-mailserver, ... }: rec {

     

       
8
       
 
       
    packages = nixpkgs.lib.genAttrs nixpkgs.lib.systems.flakeExposed (system:

     

       
9
       
+
       
      let pkgs = nixpkgs.legacyPackages.${system};

     

       
10
       
+
       
      in { manpage = import ./man { inherit pkgs system nixos-mailserver; }; });

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
11
       
 
       


     

       
12
       
 
       
    nixosModules.default = {

     

       
13
       
 
       
      imports = [

     

       
14
       
 
       
        ./modules/default.nix

     

       
15
       
 
       
        nixos-mailserver.nixosModule

     

       
16
       
 
       
        ({ pkgs, config, ... }: {

     

       
17
       
+
       
          nixpkgs.overlays = [

     

       
18
       
+
       
            (final: prev: {

     

       
19
       
+
       
              mautrix-meta = (prev.callPackage ./pkgs/mautrix-meta.nix { });

     

       
20
       
+
       
            })

     

       
21
       
+
       
          ];

     

       
22
       
 
       
        })

     

       
23
       
 
       
      ];

     

       
24
       
 
       
    };

     

       
25
       
 
       
    defaultTemplate.path = ./template;

     

       
26
       
+
       


     

       
27
       
+
       
    formatter = nixpkgs.lib.genAttrs nixpkgs.lib.systems.flakeExposed

     

       
28
       
+
       
      (system: nixpkgs.legacyPackages.${system}.nixfmt);

     

       
29
       
 
       
  };

     

       
30
       
 
       
}

     

···

       
2
       
 
       


     

       
3
       
 
       
with pkgs;

     

       
4
       
 
       
let

     

       
5
       
-
       
    optionsDoc =

     

       
6
       
-
       
      let

     

       
7
       
-
       
        eval = import (pkgs.path + "/nixos/lib/eval-config.nix") {

     

       
8
       
-
       
          inherit system;

     

       
9
       
-
       
          modules = [

     

       
10
       
-
       
            ../modules/default.nix

     

       
11
       
-
       
            nixos-mailserver

     

       
12
       
-
       
          ];

     

       
13
       
-
       
        };

     

       
14
       
-
       
      in pkgs.nixosOptionsDoc {

     

       
15
       
-
       
        options = eval.options;

     

       
16
       
-
       
        # TODO make sure all options have descriptions

     

       
17
       
-
       
        warningsAreErrors = false;

     

       
18
       
-
       
      };

     

       
19
       
 
       


     

       
20
       
 
       
  # Generate the `man eliean.nix` package

     

       
21
       
-
       
  eilean-configuration-manual =

     

       
22
       
-
       
    runCommand "eilean-reference-manpage"

     

       
23
       
-
       
    { nativeBuildInputs = [

     

       
24
       
-
       
        buildPackages.installShellFiles

     

       
25
       
-
       
        buildPackages.nixos-render-docs

     

       
26
       
-
       
      ];

     

       
27
       
-
       
      allowedReferences = [ "out" ];

     

       
28
       
-
       
    }

     

       
29
       
-
       
    ''

     

       
30
       
-
       
      # Generate manpages.

     

       
31
       
-
       
      mkdir -p $out/share/man/man5

     

       
32
       
-
       
      # filter to only eilean options

     

       
33
       
-
       
      cat ${optionsDoc.optionsJSON}/share/doc/nixos/options.json \

     

       
34
       
-
       
        | ${pkgs.jq}/bin/jq 'with_entries(select(.key | test("^eilean")))' \

     

       
35
       
-
       
        > eilean-options.json

     

       
36
       
-
       
      nixos-render-docs -j $NIX_BUILD_CORES options manpage \

     

       
37
       
-
       
        --revision dev \

     

       
38
       
-
       
        --header ${./eilean-configuration-nix-header.5} \

     

       
39
       
-
       
        --footer ${./eilean-configuration-nix-footer.5} \

     

       
40
       
-
       
        eilean-options.json \

     

       
41
       
-
       
        $out/share/man/man5/eilean-configuration.nix.5

     

       
42
       
-
       
    '';

     

       
43
       
 
       
in eilean-configuration-manual

     

···

       
2
       
 
       


     

       
3
       
 
       
with pkgs;

     

       
4
       
 
       
let

     

       
5
       
+
       
  optionsDoc = let

     

       
6
       
+
       
    eval = import (pkgs.path + "/nixos/lib/eval-config.nix") {

     

       
7
       
+
       
      inherit system;

     

       
8
       
+
       
      modules = [ ../modules/default.nix nixos-mailserver ];

     

       
9
       
+
       
    };

     

       
10
       
+
       
  in pkgs.nixosOptionsDoc {

     

       
11
       
+
       
    options = eval.options;

     

       
12
       
+
       
    # TODO make sure all options have descriptions

     

       
13
       
+
       
    warningsAreErrors = false;

     

       
14
       
+
       
  };

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
15
       
 
       


     

       
16
       
 
       
  # Generate the `man eliean.nix` package

     

       
17
       
+
       
  eilean-configuration-manual = runCommand "eilean-reference-manpage" {

     

       
18
       
+
       
    nativeBuildInputs =

     

       
19
       
+
       
      [ buildPackages.installShellFiles buildPackages.nixos-render-docs ];

     

       
20
       
+
       
    allowedReferences = [ "out" ];

     

       
21
       
+
       
  } ''

     

       
22
       
+
       
    # Generate manpages.

     

       
23
       
+
       
    mkdir -p $out/share/man/man5

     

       
24
       
+
       
    # filter to only eilean options

     

       
25
       
+
       
    cat ${optionsDoc.optionsJSON}/share/doc/nixos/options.json \

     

       
26
       
+
       
      | ${pkgs.jq}/bin/jq 'with_entries(select(.key | test("^eilean")))' \

     

       
27
       
+
       
      > eilean-options.json

     

       
28
       
+
       
    nixos-render-docs -j $NIX_BUILD_CORES options manpage \

     

       
29
       
+
       
      --revision dev \

     

       
30
       
+
       
      --header ${./eilean-configuration-nix-header.5} \

     

       
31
       
+
       
      --footer ${./eilean-configuration-nix-footer.5} \

     

       
32
       
+
       
      eilean-options.json \

     

       
33
       
+
       
      $out/share/man/man5/eilean-configuration.nix.5

     

       
34
       
+
       
  '';

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
35
       
 
       
in eilean-configuration-manual

     

···

       
19
       
 
       
  ];

     

       
20
       
 
       


     

       
21
       
 
       
  options.eilean = with types; {

     

       
22
       
-
       
    username = mkOption {

     

       
23
       
-
       
      type = str;

     

       
24
       
-
       
    };

     

       
25
       
-
       
    serverIpv4 = mkOption {

     

       
26
       
-
       
      type = str;

     

       
27
       
-
       
    };

     

       
28
       
-
       
    serverIpv6 = mkOption {

     

       
29
       
-
       
      type = str;

     

       
30
       
-
       
    };

     

       
31
       
-
       
    publicInterface = mkOption {

     

       
32
       
-
       
      type = str;

     

       
33
       
-
       
    };

     

       
34
       
 
       
  };

     

       
35
       
 
       


     

       
36
       
 
       
  config = {

     

       
37
       
 
       
    # TODO install manpage

     

       
38
       
-
       
    environment.systemPackages = [

     

       
39
       
-
       
    ];

     

       
40
       
-
       
    security.acme.defaults.email = "${config.eilean.username}@${config.networking.domain}";

     

       
41
       
 
       
    networking.firewall.allowedTCPPorts = mkIf config.services.nginx.enable [

     

       
42
       
 
       
      80 # HTTP

     

       
43
       
 
       
      443 # HTTPS

     

···

       
19
       
 
       
  ];

     

       
20
       
 
       


     

       
21
       
 
       
  options.eilean = with types; {

     

       
22
       
+
       
    username = mkOption { type = str; };

     

       
23
       
+
       
    serverIpv4 = mkOption { type = str; };

     

       
24
       
+
       
    serverIpv6 = mkOption { type = str; };

     

       
25
       
+
       
    publicInterface = mkOption { type = str; };

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
26
       
 
       
  };

     

       
27
       
 
       


     

       
28
       
 
       
  config = {

     

       
29
       
 
       
    # TODO install manpage

     

       
30
       
+
       
    environment.systemPackages = [ ];

     

       
31
       
+
       
    security.acme.defaults.email =

     

       
32
       
+
       
      "${config.eilean.username}@${config.networking.domain}";

     

       
33
       
 
       
    networking.firewall.allowedTCPPorts = mkIf config.services.nginx.enable [

     

       
34
       
 
       
      80 # HTTP

     

       
35
       
 
       
      443 # HTTPS

     

···

       
1
       
 
       
{ config, lib, ... }:

     

       
2
       
 
       


     

       
3
       
 
       
with lib;

     

       
4
       
-
       
let cfg = config.eilean; in

     

       
5
       
-
       
{

     

       
6
       
-
       
  

     

       
7
       
 
       
  options.eilean.dns = {

     

       
8
       
 
       
    enable = mkEnableOption "dns";

     

       
9
       
 
       
    nameservers = mkOption {

     
···

       
11
       
 
       
      default = [ "ns1" "ns2" ];

     

       
12
       
 
       
    };

     

       
13
       
 
       
  };

     

       
14
       
-
       
  

     

       
15
       
 
       
  config.eilean.services.dns = mkIf cfg.dns.enable {

     

       
16
       
 
       
    enable = true;

     

       
17
       
 
       
    zones.${config.networking.domain} = {

     
···

       
37
       
 
       
          type = "AAAA";

     

       
38
       
 
       
          data = cfg.serverIpv6;

     

       
39
       
 
       
        }

     

       
40
       
-
       
      ]) cfg.dns.nameservers ++

     

       
41
       
-
       
      [

     

       
42
       
 
       
        {

     

       
43
       
 
       
          name = "@";

     

       
44
       
 
       
          type = "A";

     
···

       
60
       
 
       
          type = "AAAA";

     

       
61
       
 
       
          data = cfg.serverIpv6;

     

       
62
       
 
       
        }

     

       
63
       
-
       
        

     

       
64
       
 
       
        {

     

       
65
       
 
       
          name = "@";

     

       
66
       
 
       
          type = "LOC";

     

···

       
1
       
 
       
{ config, lib, ... }:

     

       
2
       
 
       


     

       
3
       
 
       
with lib;

     

       
4
       
+
       
let cfg = config.eilean;

     

       
5
       
+
       
in {

     

       
6
       
+
       


     

       
7
       
 
       
  options.eilean.dns = {

     

       
8
       
 
       
    enable = mkEnableOption "dns";

     

       
9
       
 
       
    nameservers = mkOption {

     
···

       
11
       
 
       
      default = [ "ns1" "ns2" ];

     

       
12
       
 
       
    };

     

       
13
       
 
       
  };

     

       
14
       
+
       


     

       
15
       
 
       
  config.eilean.services.dns = mkIf cfg.dns.enable {

     

       
16
       
 
       
    enable = true;

     

       
17
       
 
       
    zones.${config.networking.domain} = {

     
···

       
37
       
 
       
          type = "AAAA";

     

       
38
       
 
       
          data = cfg.serverIpv6;

     

       
39
       
 
       
        }

     

       
40
       
+
       
      ]) cfg.dns.nameservers ++ [

     

       
0
       
 
       

     

       
41
       
 
       
        {

     

       
42
       
 
       
          name = "@";

     

       
43
       
 
       
          type = "A";

     
···

       
59
       
 
       
          type = "AAAA";

     

       
60
       
 
       
          data = cfg.serverIpv6;

     

       
61
       
 
       
        }

     

       
62
       
+
       


     

       
63
       
 
       
        {

     

       
64
       
 
       
          name = "@";

     

       
65
       
 
       
          type = "LOC";

     

···

       
25
       
 
       
        enableACME = true;

     

       
26
       
 
       
        forceSSL = true;

     

       
27
       
 
       
        locations."/" = {

     

       
28
       
-
       
          proxyPass = "http://localhost:${builtins.toString config.services.gitea.settings.server.HTTP_PORT}/";

     

       
0
       
 
       

     

       
0
       
 
       

     

       
29
       
 
       
        };

     

       
30
       
 
       
      };

     

       
31
       
 
       
    };

     
···

       
88
       
 
       
      RestrictRealtime = mkForce false;

     

       
89
       
 
       
      RestrictSUIDSGID = mkForce false;

     

       
90
       
 
       
      SystemCallArchitectures = mkForce "";

     

       
91
       
-
       
      SystemCallFilter = mkForce [];

     

       
92
       
 
       
    };

     

       
93
       
 
       


     

       
94
       
 
       
    eilean.dns.enable = true;

     

       
95
       
-
       
    eilean.services.dns.zones.${config.networking.domain}.records = [

     

       
96
       
-
       
      {

     

       
97
       
-
       
        name = "git";

     

       
98
       
-
       
        type = "CNAME";

     

       
99
       
-
       
        data = "vps";

     

       
100
       
-
       
      }

     

       
101
       
-
       
    ];

     

       
102
       
 
       


     

       
103
       
 
       
    # proxy port 22 on ethernet interface to internal gitea ssh server

     

       
104
       
 
       
    # openssh server remains accessible on port 22 via vpn(s)

     
···

       
110
       
 
       
    };

     

       
111
       
 
       


     

       
112
       
 
       
    networking.firewall = {

     

       
113
       
-
       
      allowedTCPPorts = [

     

       
114
       
-
       
        22

     

       
115
       
-
       
        cfg.gitea.sshPort

     

       
116
       
-
       
      ];

     

       
117
       
 
       
      extraCommands = ''

     

       
118
       
 
       
        # proxy all traffic on public interface to the gitea SSH server

     

       
119
       
-
       
        iptables -A PREROUTING -t nat -i ${config.eilean.publicInterface} -p tcp --dport 22 -j REDIRECT --to-port ${builtins.toString cfg.gitea.sshPort}

     

       
120
       
-
       
        ip6tables -A PREROUTING -t nat -i ${config.eilean.publicInterface} -p tcp --dport 22 -j REDIRECT --to-port ${builtins.toString cfg.gitea.sshPort}

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
121
       
 
       


     

       
122
       
 
       
        # proxy locally originating outgoing packets

     

       
123
       
-
       
        iptables -A OUTPUT -d ${config.eilean.serverIpv4} -t nat -p tcp --dport 22 -j REDIRECT --to-port ${builtins.toString cfg.gitea.sshPort}

     

       
124
       
-
       
        ip6tables -A OUTPUT -d ${config.eilean.serverIpv6} -t nat -p tcp --dport 22 -j REDIRECT --to-port ${builtins.toString cfg.gitea.sshPort}

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
125
       
 
       
      '';

     

       
126
       
 
       
    };

     

       
127
       
 
       


     

···

       
25
       
 
       
        enableACME = true;

     

       
26
       
 
       
        forceSSL = true;

     

       
27
       
 
       
        locations."/" = {

     

       
28
       
+
       
          proxyPass = "http://localhost:${

     

       
29
       
+
       
              builtins.toString config.services.gitea.settings.server.HTTP_PORT

     

       
30
       
+
       
            }/";

     

       
31
       
 
       
        };

     

       
32
       
 
       
      };

     

       
33
       
 
       
    };

     
···

       
90
       
 
       
      RestrictRealtime = mkForce false;

     

       
91
       
 
       
      RestrictSUIDSGID = mkForce false;

     

       
92
       
 
       
      SystemCallArchitectures = mkForce "";

     

       
93
       
+
       
      SystemCallFilter = mkForce [ ];

     

       
94
       
 
       
    };

     

       
95
       
 
       


     

       
96
       
 
       
    eilean.dns.enable = true;

     

       
97
       
+
       
    eilean.services.dns.zones.${config.networking.domain}.records = [{

     

       
98
       
+
       
      name = "git";

     

       
99
       
+
       
      type = "CNAME";

     

       
100
       
+
       
      data = "vps";

     

       
101
       
+
       
    }];

     

       
0
       
 
       

     

       
0
       
 
       

     

       
102
       
 
       


     

       
103
       
 
       
    # proxy port 22 on ethernet interface to internal gitea ssh server

     

       
104
       
 
       
    # openssh server remains accessible on port 22 via vpn(s)

     
···

       
110
       
 
       
    };

     

       
111
       
 
       


     

       
112
       
 
       
    networking.firewall = {

     

       
113
       
+
       
      allowedTCPPorts = [ 22 cfg.gitea.sshPort ];

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
114
       
 
       
      extraCommands = ''

     

       
115
       
 
       
        # proxy all traffic on public interface to the gitea SSH server

     

       
116
       
+
       
        iptables -A PREROUTING -t nat -i ${config.eilean.publicInterface} -p tcp --dport 22 -j REDIRECT --to-port ${

     

       
117
       
+
       
          builtins.toString cfg.gitea.sshPort

     

       
118
       
+
       
        }

     

       
119
       
+
       
        ip6tables -A PREROUTING -t nat -i ${config.eilean.publicInterface} -p tcp --dport 22 -j REDIRECT --to-port ${

     

       
120
       
+
       
          builtins.toString cfg.gitea.sshPort

     

       
121
       
+
       
        }

     

       
122
       
 
       


     

       
123
       
 
       
        # proxy locally originating outgoing packets

     

       
124
       
+
       
        iptables -A OUTPUT -d ${config.eilean.serverIpv4} -t nat -p tcp --dport 22 -j REDIRECT --to-port ${

     

       
125
       
+
       
          builtins.toString cfg.gitea.sshPort

     

       
126
       
+
       
        }

     

       
127
       
+
       
        ip6tables -A OUTPUT -d ${config.eilean.serverIpv6} -t nat -p tcp --dport 22 -j REDIRECT --to-port ${

     

       
128
       
+
       
          builtins.toString cfg.gitea.sshPort

     

       
129
       
+
       
        }

     

       
130
       
 
       
      '';

     

       
131
       
 
       
    };

     

       
132
       
 
       


     

···

       
1
       
 
       
{ pkgs, config, lib, ... }:

     

       
2
       
 
       


     

       
3
       
 
       
with lib;

     

       
4
       
-
       
let

     

       
5
       
-
       
  cfg = config.eilean;

     

       
6
       
 
       
in {

     

       
7
       
 
       
  options.eilean.headscale = with lib; {

     

       
8
       
 
       
    enable = mkEnableOption "headscale";

     
···

       
14
       
 
       
    domain = mkOption {

     

       
15
       
 
       
      type = types.str;

     

       
16
       
 
       
      default = "headscale.${config.networking.domain}";

     

       
17
       
-
       
      defaultText = "headscale.$${config.networking.domain}";

     

       
18
       
 
       
    };

     

       
19
       
 
       
  };

     

       
20
       
 
       


     
···

       
30
       
 
       
      settings = {

     

       
31
       
 
       
        server_url = "https://${cfg.headscale.domain}";

     

       
32
       
 
       
        logtail.enabled = false;

     

       
33
       
-
       
        ip_prefixes = [

     

       
34
       
-
       
          "100.64.0.0/10"

     

       
35
       
-
       
          "fd7a:115c:a1e0::/48"

     

       
36
       
-
       
        ];

     

       
37
       
 
       
        dns_config = {

     

       
38
       
 
       
          # magicDns = true;

     

       
39
       
 
       
          nameservers = config.networking.nameservers;

     
···

       
58
       
 
       
    environment.systemPackages = [ config.services.headscale.package ];

     

       
59
       
 
       


     

       
60
       
 
       
    eilean.dns.enable = true;

     

       
61
       
-
       
    eilean.services.dns.zones.${cfg.headscale.zone}.records = [

     

       
62
       
-
       
      {

     

       
63
       
-
       
        name = "${cfg.headscale.domain}.";

     

       
64
       
-
       
        type = "CNAME";

     

       
65
       
-
       
        data = "vps";

     

       
66
       
-
       
      }

     

       
67
       
-
       
    ];

     

       
68
       
 
       
  };

     

       
69
       
 
       
}

     

···

       
1
       
 
       
{ pkgs, config, lib, ... }:

     

       
2
       
 
       


     

       
3
       
 
       
with lib;

     

       
4
       
+
       
let cfg = config.eilean;

     

       
0
       
 
       

     

       
5
       
 
       
in {

     

       
6
       
 
       
  options.eilean.headscale = with lib; {

     

       
7
       
 
       
    enable = mkEnableOption "headscale";

     
···

       
13
       
 
       
    domain = mkOption {

     

       
14
       
 
       
      type = types.str;

     

       
15
       
 
       
      default = "headscale.${config.networking.domain}";

     

       
16
       
+
       
      defaultText = "headscale.$\${config.networking.domain}";

     

       
17
       
 
       
    };

     

       
18
       
 
       
  };

     

       
19
       
 
       


     
···

       
29
       
 
       
      settings = {

     

       
30
       
 
       
        server_url = "https://${cfg.headscale.domain}";

     

       
31
       
 
       
        logtail.enabled = false;

     

       
32
       
+
       
        ip_prefixes = [ "100.64.0.0/10" "fd7a:115c:a1e0::/48" ];

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
33
       
 
       
        dns_config = {

     

       
34
       
 
       
          # magicDns = true;

     

       
35
       
 
       
          nameservers = config.networking.nameservers;

     
···

       
54
       
 
       
    environment.systemPackages = [ config.services.headscale.package ];

     

       
55
       
 
       


     

       
56
       
 
       
    eilean.dns.enable = true;

     

       
57
       
+
       
    eilean.services.dns.zones.${cfg.headscale.zone}.records = [{

     

       
58
       
+
       
      name = "${cfg.headscale.domain}.";

     

       
59
       
+
       
      type = "CNAME";

     

       
60
       
+
       
      data = "vps";

     

       
61
       
+
       
    }];

     

       
0
       
 
       

     

       
0
       
 
       

     

       
62
       
 
       
  };

     

       
63
       
 
       
}

     

···

       
42
       
 
       
    '';

     

       
43
       
 
       


     

       
44
       
 
       
    services.postfix.config = {

     

       
45
       
-
       
      smtpd_tls_protocols = mkForce "TLSv1.3, TLSv1.2, !TLSv1.1, !TLSv1, !SSLv2, !SSLv3";

     

       
46
       
-
       
      smtp_tls_protocols = mkForce "TLSv1.3, TLSv1.2, !TLSv1.1, !TLSv1, !SSLv2, !SSLv3";

     

       
47
       
-
       
      smtpd_tls_mandatory_protocols = mkForce "TLSv1.3, !TLSv1.2, TLSv1.1, !TLSv1, !SSLv2, !SSLv3";

     

       
48
       
-
       
      smtp_tls_mandatory_protocols = mkForce "TLSv1.3, !TLSv1.2, TLSv1.1, !TLSv1, !SSLv2, !SSLv3";

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
49
       
 
       
    };

     

       
50
       
 
       


     

       
51
       
 
       
    eilean.dns.enable = true;

     
···

       
68
       
 
       
      {

     

       
69
       
 
       
        name = "@";

     

       
70
       
 
       
        type = "TXT";

     

       
71
       
-
       
        data = "\"v=spf1 a:mail.${config.networking.domain} -all\"";

     

       
72
       
 
       
      }

     

       
73
       
 
       
      {

     

       
74
       
 
       
        name = "mail._domainkey";

     

       
75
       
 
       
        ttl = 10800;

     

       
76
       
 
       
        type = "TXT";

     

       
77
       
-
       
        data = "\"v=DKIM1; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC6YmYYvoFF7VqtGcozpVQa78aaGgZdvc5ZIHqzmkKdCBEyDF2FRbCEK4s2AlC8hhc8O4mSSe3S4AzEhlRgHXbU22GBaUZ3s2WHS8JJwZvWeTjsbXQwjN/U7xpkqXPHLH9IVfOJbHlp4HQmCAXw4NaypgkkxIGK0jaZHm2j6/1izQIDAQAB\"";

     

       
0
       
 
       

     

       
78
       
 
       
      }

     

       
79
       
 
       
      {

     

       
80
       
 
       
        name = "_dmarc";

     

       
81
       
 
       
        ttl = 10800;

     

       
82
       
 
       
        type = "TXT";

     

       
83
       
-
       
        data = "\"v=DMARC1; p=reject\"";

     

       
84
       
 
       
      }

     

       
85
       
 
       
    ];

     

       
86
       
 
       
  };

     

···

       
42
       
 
       
    '';

     

       
43
       
 
       


     

       
44
       
 
       
    services.postfix.config = {

     

       
45
       
+
       
      smtpd_tls_protocols =

     

       
46
       
+
       
        mkForce "TLSv1.3, TLSv1.2, !TLSv1.1, !TLSv1, !SSLv2, !SSLv3";

     

       
47
       
+
       
      smtp_tls_protocols =

     

       
48
       
+
       
        mkForce "TLSv1.3, TLSv1.2, !TLSv1.1, !TLSv1, !SSLv2, !SSLv3";

     

       
49
       
+
       
      smtpd_tls_mandatory_protocols =

     

       
50
       
+
       
        mkForce "TLSv1.3, !TLSv1.2, TLSv1.1, !TLSv1, !SSLv2, !SSLv3";

     

       
51
       
+
       
      smtp_tls_mandatory_protocols =

     

       
52
       
+
       
        mkForce "TLSv1.3, !TLSv1.2, TLSv1.1, !TLSv1, !SSLv2, !SSLv3";

     

       
53
       
 
       
    };

     

       
54
       
 
       


     

       
55
       
 
       
    eilean.dns.enable = true;

     
···

       
72
       
 
       
      {

     

       
73
       
 
       
        name = "@";

     

       
74
       
 
       
        type = "TXT";

     

       
75
       
+
       
        data = ''"v=spf1 a:mail.${config.networking.domain} -all"'';

     

       
76
       
 
       
      }

     

       
77
       
 
       
      {

     

       
78
       
 
       
        name = "mail._domainkey";

     

       
79
       
 
       
        ttl = 10800;

     

       
80
       
 
       
        type = "TXT";

     

       
81
       
+
       
        data = ''

     

       
82
       
+
       
          "v=DKIM1; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC6YmYYvoFF7VqtGcozpVQa78aaGgZdvc5ZIHqzmkKdCBEyDF2FRbCEK4s2AlC8hhc8O4mSSe3S4AzEhlRgHXbU22GBaUZ3s2WHS8JJwZvWeTjsbXQwjN/U7xpkqXPHLH9IVfOJbHlp4HQmCAXw4NaypgkkxIGK0jaZHm2j6/1izQIDAQAB"'';

     

       
83
       
 
       
      }

     

       
84
       
 
       
      {

     

       
85
       
 
       
        name = "_dmarc";

     

       
86
       
 
       
        ttl = 10800;

     

       
87
       
 
       
        type = "TXT";

     

       
88
       
+
       
        data = ''"v=DMARC1; p=reject"'';

     

       
89
       
 
       
      }

     

       
90
       
 
       
    ];

     

       
91
       
 
       
  };

     

···

       
5
       
 
       
  cfg = config.eilean;

     

       
6
       
 
       
  domain = config.networking.domain;

     

       
7
       
 
       
in {

     

       
8
       
-
       
  options.eilean.mastodon = {

     

       
9
       
-
       
    enable = mkEnableOption "mastodon";

     

       
10
       
-
       
  };

     

       
11
       
 
       


     

       
12
       
 
       
  config = mkIf cfg.mastodon.enable {

     

       
13
       
 
       
    services.mastodon = {

     
···

       
32
       
 
       
        WEB_DOMAIN = "mastodon.${domain}";

     

       
33
       
 
       


     

       
34
       
 
       
        # https://peterbabic.dev/blog/setting-up-smtp-in-mastodon/

     

       
35
       
-
       
        SMTP_SSL="true";

     

       
36
       
-
       
        SMTP_ENABLE_STARTTLS="false";

     

       
37
       
-
       
        SMTP_OPENSSL_VERIFY_MODE="none";

     

       
38
       
 
       
      };

     

       
39
       
 
       
    };

     

       
40
       
 
       


     

       
41
       
-
       
    users.groups.${config.services.mastodon.group}.members = [ config.services.nginx.user ];

     

       
0
       
 
       

     

       
42
       
 
       


     

       
43
       
 
       
    services.nginx = {

     

       
44
       
 
       
      enable = true;

     
···

       
60
       
 
       


     

       
61
       
 
       
          locations."/system/".alias = "/var/lib/mastodon/public-system/";

     

       
62
       
 
       


     

       
63
       
-
       
          locations."/" = {

     

       
64
       
-
       
            tryFiles = "$uri @proxy";

     

       
65
       
-
       
          };

     

       
66
       
 
       


     

       
67
       
 
       
          locations."@proxy" = {

     

       
68
       
-
       
            proxyPass = "http://127.0.0.1:${builtins.toString config.services.mastodon.webPort}";

     

       
0
       
 
       

     

       
0
       
 
       

     

       
69
       
 
       
            proxyWebsockets = true;

     

       
70
       
 
       
          };

     

       
71
       
 
       
        };

     
···

       
73
       
 
       
    };

     

       
74
       
 
       


     

       
75
       
 
       
    eilean.dns.enable = true;

     

       
76
       
-
       
    eilean.services.dns.zones.${config.networking.domain}.records = [

     

       
77
       
-
       
      {

     

       
78
       
-
       
        name = "mastodon";

     

       
79
       
-
       
        type = "CNAME";

     

       
80
       
-
       
        data = "vps";

     

       
81
       
-
       
      }

     

       
82
       
-
       
    ];

     

       
83
       
 
       
  };

     

       
84
       
 
       
}

     

···

       
5
       
 
       
  cfg = config.eilean;

     

       
6
       
 
       
  domain = config.networking.domain;

     

       
7
       
 
       
in {

     

       
8
       
+
       
  options.eilean.mastodon = { enable = mkEnableOption "mastodon"; };

     

       
0
       
 
       

     

       
0
       
 
       

     

       
9
       
 
       


     

       
10
       
 
       
  config = mkIf cfg.mastodon.enable {

     

       
11
       
 
       
    services.mastodon = {

     
···

       
30
       
 
       
        WEB_DOMAIN = "mastodon.${domain}";

     

       
31
       
 
       


     

       
32
       
 
       
        # https://peterbabic.dev/blog/setting-up-smtp-in-mastodon/

     

       
33
       
+
       
        SMTP_SSL = "true";

     

       
34
       
+
       
        SMTP_ENABLE_STARTTLS = "false";

     

       
35
       
+
       
        SMTP_OPENSSL_VERIFY_MODE = "none";

     

       
36
       
 
       
      };

     

       
37
       
 
       
    };

     

       
38
       
 
       


     

       
39
       
+
       
    users.groups.${config.services.mastodon.group}.members =

     

       
40
       
+
       
      [ config.services.nginx.user ];

     

       
41
       
 
       


     

       
42
       
 
       
    services.nginx = {

     

       
43
       
 
       
      enable = true;

     
···

       
59
       
 
       


     

       
60
       
 
       
          locations."/system/".alias = "/var/lib/mastodon/public-system/";

     

       
61
       
 
       


     

       
62
       
+
       
          locations."/" = { tryFiles = "$uri @proxy"; };

     

       
0
       
 
       

     

       
0
       
 
       

     

       
63
       
 
       


     

       
64
       
 
       
          locations."@proxy" = {

     

       
65
       
+
       
            proxyPass = "http://127.0.0.1:${

     

       
66
       
+
       
                builtins.toString config.services.mastodon.webPort

     

       
67
       
+
       
              }";

     

       
68
       
 
       
            proxyWebsockets = true;

     

       
69
       
 
       
          };

     

       
70
       
 
       
        };

     
···

       
72
       
 
       
    };

     

       
73
       
 
       


     

       
74
       
 
       
    eilean.dns.enable = true;

     

       
75
       
+
       
    eilean.services.dns.zones.${config.networking.domain}.records = [{

     

       
76
       
+
       
      name = "mastodon";

     

       
77
       
+
       
      type = "CNAME";

     

       
78
       
+
       
      data = "vps";

     

       
79
       
+
       
    }];

     

       
0
       
 
       

     

       
0
       
 
       

     

       
80
       
 
       
  };

     

       
81
       
 
       
}

     

···

       
1
       
-
       
{

     

       
2
       
-
       
  lib,

     

       
3
       
-
       
  config,

     

       
4
       
-
       
  pkgs,

     

       
5
       
-
       
  ...

     

       
6
       
-
       
}: let

     

       
7
       
 
       
  cfg = config.services.mautrix-instagram;

     

       
8
       
 
       
  dataDir = "/var/lib/mautrix-instagram";

     

       
9
       
 
       
  registrationFile = "${dataDir}/instagram-registration.yaml";

     

       
10
       
 
       
  settingsFile = "${dataDir}/config.json";

     

       
11
       
-
       
  settingsFileUnsubstituted = settingsFormat.generate "mautrix-instagram-config-unsubstituted.json" cfg.settings;

     

       
12
       
-
       
  settingsFormat = pkgs.formats.json {};

     

       
0
       
 
       

     

       
0
       
 
       

     

       
13
       
 
       
  appservicePort = 29319;

     

       
14
       
 
       


     

       
15
       
 
       
  mkDefaults = lib.mapAttrsRecursive (n: v: lib.mkDefault v);

     
···

       
30
       
 
       
    };

     

       
31
       
 
       
    bridge = {

     

       
32
       
 
       
      username_template = "instagram_{{.}}";

     

       
33
       
-
       
      double_puppet_server_map = {};

     

       
34
       
-
       
      login_shared_secret_map = {};

     

       
35
       
 
       
      permissions."*" = "relay";

     

       
36
       
 
       
      relay.enabled = true;

     

       
37
       
 
       
    };

     
···

       
47
       
 
       


     

       
48
       
 
       
in {

     

       
49
       
 
       
  options.services.mautrix-instagram = {

     

       
50
       
-
       
    enable = lib.mkEnableOption (lib.mdDoc "mautrix-instagram, a puppeting/relaybot bridge between Matrix and Instagram.");

     

       
0
       
 
       

     

       
51
       
 
       


     

       
52
       
 
       
    settings = lib.mkOption {

     

       
53
       
 
       
      type = settingsFormat.type;

     
···

       
67
       
 
       
          ephemeral_events = false;

     

       
68
       
 
       
        };

     

       
69
       
 
       
        bridge = {

     

       
70
       
-
       
          history_sync = {

     

       
71
       
-
       
            request_full_sync = true;

     

       
72
       
-
       
          };

     

       
73
       
 
       
          private_chat_portal_meta = true;

     

       
74
       
 
       
          mute_bridging = true;

     

       
75
       
 
       
          encryption = {

     
···

       
77
       
 
       
            default = true;

     

       
78
       
 
       
            require = true;

     

       
79
       
 
       
          };

     

       
80
       
-
       
          provisioning = {

     

       
81
       
-
       
            shared_secret = "disable";

     

       
82
       
-
       
          };

     

       
83
       
-
       
          permissions = {

     

       
84
       
-
       
            "example.com" = "user";

     

       
85
       
-
       
          };

     

       
86
       
 
       
        };

     

       
87
       
 
       
      };

     

       
88
       
 
       
    };

     

       
89
       
 
       


     

       
90
       
 
       
    serviceDependencies = lib.mkOption {

     

       
91
       
 
       
      type = with lib.types; listOf str;

     

       
92
       
-
       
      default = lib.optional config.services.matrix-synapse.enable config.services.matrix-synapse.serviceUnit;

     

       
0
       
 
       

     

       
93
       
 
       
      defaultText = lib.literalExpression ''

     

       
94
       
 
       
        optional config.services.matrix-synapse.enable config.services.matrix-synapse.serviceUnits

     

       
95
       
 
       
      '';

     
···

       
108
       
 
       
      description = "Mautrix-Instagram bridge user";

     

       
109
       
 
       
    };

     

       
110
       
 
       


     

       
111
       
-
       
    users.groups.mautrix-instagram = {};

     

       
112
       
 
       


     

       
113
       
 
       
    services.mautrix-instagram.settings = lib.mkMerge (map mkDefaults [

     

       
114
       
 
       
      defaultConfig

     

       
115
       
 
       
      # Note: this is defined here to avoid the docs depending on `config`

     

       
116
       
-
       
      { homeserver.domain = config.services.matrix-synapse.settings.server_name; }

     

       
0
       
 
       

     

       
0
       
 
       

     

       
117
       
 
       
    ]);

     

       
118
       
 
       


     

       
119
       
 
       
    systemd.services.mautrix-instagram = {

     

       
120
       
 
       
      description = "Mautrix-Instagram Service - A Instagram bridge for Matrix";

     

       
121
       
 
       


     

       
122
       
-
       
      wantedBy = ["multi-user.target"];

     

       
123
       
-
       
      wants = ["network-online.target"] ++ cfg.serviceDependencies;

     

       
124
       
-
       
      after = ["network-online.target"] ++ cfg.serviceDependencies;

     

       
125
       
 
       


     

       
126
       
 
       
      preStart = ''

     

       
127
       
 
       
        # substitute the settings file by environment variables

     
···

       
182
       
 
       
        RestrictSUIDSGID = true;

     

       
183
       
 
       
        SystemCallArchitectures = "native";

     

       
184
       
 
       
        SystemCallErrorNumber = "EPERM";

     

       
185
       
-
       
        SystemCallFilter = ["@system-service"];

     

       
186
       
 
       
        Type = "simple";

     

       
187
       
-
       
        UMask = 0027;

     

       
188
       
 
       
      };

     

       
189
       
-
       
      restartTriggers = [settingsFileUnsubstituted];

     

       
190
       
 
       
    };

     

       
191
       
 
       
  };

     

       
192
       
 
       
}

     

···

       
1
       
+
       
{ lib, config, pkgs, ... }:

     

       
2
       
+
       
let

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
3
       
 
       
  cfg = config.services.mautrix-instagram;

     

       
4
       
 
       
  dataDir = "/var/lib/mautrix-instagram";

     

       
5
       
 
       
  registrationFile = "${dataDir}/instagram-registration.yaml";

     

       
6
       
 
       
  settingsFile = "${dataDir}/config.json";

     

       
7
       
+
       
  settingsFileUnsubstituted =

     

       
8
       
+
       
    settingsFormat.generate "mautrix-instagram-config-unsubstituted.json"

     

       
9
       
+
       
    cfg.settings;

     

       
10
       
+
       
  settingsFormat = pkgs.formats.json { };

     

       
11
       
 
       
  appservicePort = 29319;

     

       
12
       
 
       


     

       
13
       
 
       
  mkDefaults = lib.mapAttrsRecursive (n: v: lib.mkDefault v);

     
···

       
28
       
 
       
    };

     

       
29
       
 
       
    bridge = {

     

       
30
       
 
       
      username_template = "instagram_{{.}}";

     

       
31
       
+
       
      double_puppet_server_map = { };

     

       
32
       
+
       
      login_shared_secret_map = { };

     

       
33
       
 
       
      permissions."*" = "relay";

     

       
34
       
 
       
      relay.enabled = true;

     

       
35
       
 
       
    };

     
···

       
45
       
 
       


     

       
46
       
 
       
in {

     

       
47
       
 
       
  options.services.mautrix-instagram = {

     

       
48
       
+
       
    enable = lib.mkEnableOption (lib.mdDoc

     

       
49
       
+
       
      "mautrix-instagram, a puppeting/relaybot bridge between Matrix and Instagram.");

     

       
50
       
 
       


     

       
51
       
 
       
    settings = lib.mkOption {

     

       
52
       
 
       
      type = settingsFormat.type;

     
···

       
66
       
 
       
          ephemeral_events = false;

     

       
67
       
 
       
        };

     

       
68
       
 
       
        bridge = {

     

       
69
       
+
       
          history_sync = { request_full_sync = true; };

     

       
0
       
 
       

     

       
0
       
 
       

     

       
70
       
 
       
          private_chat_portal_meta = true;

     

       
71
       
 
       
          mute_bridging = true;

     

       
72
       
 
       
          encryption = {

     
···

       
74
       
 
       
            default = true;

     

       
75
       
 
       
            require = true;

     

       
76
       
 
       
          };

     

       
77
       
+
       
          provisioning = { shared_secret = "disable"; };

     

       
78
       
+
       
          permissions = { "example.com" = "user"; };

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
79
       
 
       
        };

     

       
80
       
 
       
      };

     

       
81
       
 
       
    };

     

       
82
       
 
       


     

       
83
       
 
       
    serviceDependencies = lib.mkOption {

     

       
84
       
 
       
      type = with lib.types; listOf str;

     

       
85
       
+
       
      default = lib.optional config.services.matrix-synapse.enable

     

       
86
       
+
       
        config.services.matrix-synapse.serviceUnit;

     

       
87
       
 
       
      defaultText = lib.literalExpression ''

     

       
88
       
 
       
        optional config.services.matrix-synapse.enable config.services.matrix-synapse.serviceUnits

     

       
89
       
 
       
      '';

     
···

       
102
       
 
       
      description = "Mautrix-Instagram bridge user";

     

       
103
       
 
       
    };

     

       
104
       
 
       


     

       
105
       
+
       
    users.groups.mautrix-instagram = { };

     

       
106
       
 
       


     

       
107
       
 
       
    services.mautrix-instagram.settings = lib.mkMerge (map mkDefaults [

     

       
108
       
 
       
      defaultConfig

     

       
109
       
 
       
      # Note: this is defined here to avoid the docs depending on `config`

     

       
110
       
+
       
      {

     

       
111
       
+
       
        homeserver.domain = config.services.matrix-synapse.settings.server_name;

     

       
112
       
+
       
      }

     

       
113
       
 
       
    ]);

     

       
114
       
 
       


     

       
115
       
 
       
    systemd.services.mautrix-instagram = {

     

       
116
       
 
       
      description = "Mautrix-Instagram Service - A Instagram bridge for Matrix";

     

       
117
       
 
       


     

       
118
       
+
       
      wantedBy = [ "multi-user.target" ];

     

       
119
       
+
       
      wants = [ "network-online.target" ] ++ cfg.serviceDependencies;

     

       
120
       
+
       
      after = [ "network-online.target" ] ++ cfg.serviceDependencies;

     

       
121
       
 
       


     

       
122
       
 
       
      preStart = ''

     

       
123
       
 
       
        # substitute the settings file by environment variables

     
···

       
178
       
 
       
        RestrictSUIDSGID = true;

     

       
179
       
 
       
        SystemCallArchitectures = "native";

     

       
180
       
 
       
        SystemCallErrorNumber = "EPERM";

     

       
181
       
+
       
        SystemCallFilter = [ "@system-service" ];

     

       
182
       
 
       
        Type = "simple";

     

       
183
       
+
       
        UMask = 27;

     

       
184
       
 
       
      };

     

       
185
       
+
       
      restartTriggers = [ settingsFileUnsubstituted ];

     

       
186
       
 
       
    };

     

       
187
       
 
       
  };

     

       
188
       
 
       
}

     

···

       
1
       
-
       
{

     

       
2
       
-
       
  lib,

     

       
3
       
-
       
  config,

     

       
4
       
-
       
  pkgs,

     

       
5
       
-
       
  ...

     

       
6
       
-
       
}: let

     

       
7
       
 
       
  cfg = config.services.mautrix-messenger;

     

       
8
       
 
       
  dataDir = "/var/lib/mautrix-messenger";

     

       
9
       
 
       
  registrationFile = "${dataDir}/messenger-registration.yaml";

     

       
10
       
 
       
  settingsFile = "${dataDir}/config.json";

     

       
11
       
-
       
  settingsFileUnsubstituted = settingsFormat.generate "mautrix-messenger-config-unsubstituted.json" cfg.settings;

     

       
12
       
-
       
  settingsFormat = pkgs.formats.json {};

     

       
0
       
 
       

     

       
0
       
 
       

     

       
13
       
 
       
  appservicePort = 29320;

     

       
14
       
 
       


     

       
15
       
 
       
  mkDefaults = lib.mapAttrsRecursive (n: v: lib.mkDefault v);

     
···

       
30
       
 
       
    };

     

       
31
       
 
       
    bridge = {

     

       
32
       
 
       
      username_template = "messenger_{{.}}";

     

       
33
       
-
       
      double_puppet_server_map = {};

     

       
34
       
-
       
      login_shared_secret_map = {};

     

       
35
       
 
       
      permissions."*" = "relay";

     

       
36
       
 
       
      relay.enabled = true;

     

       
37
       
 
       
    };

     
···

       
47
       
 
       


     

       
48
       
 
       
in {

     

       
49
       
 
       
  options.services.mautrix-messenger = {

     

       
50
       
-
       
    enable = lib.mkEnableOption (lib.mdDoc "mautrix-messenger, a puppeting/relaybot bridge between Matrix and Messenger.");

     

       
0
       
 
       

     

       
51
       
 
       


     

       
52
       
 
       
    settings = lib.mkOption {

     

       
53
       
 
       
      type = settingsFormat.type;

     
···

       
67
       
 
       
          ephemeral_events = false;

     

       
68
       
 
       
        };

     

       
69
       
 
       
        bridge = {

     

       
70
       
-
       
          history_sync = {

     

       
71
       
-
       
            request_full_sync = true;

     

       
72
       
-
       
          };

     

       
73
       
 
       
          private_chat_portal_meta = true;

     

       
74
       
 
       
          mute_bridging = true;

     

       
75
       
 
       
          encryption = {

     
···

       
77
       
 
       
            default = true;

     

       
78
       
 
       
            require = true;

     

       
79
       
 
       
          };

     

       
80
       
-
       
          provisioning = {

     

       
81
       
-
       
            shared_secret = "disable";

     

       
82
       
-
       
          };

     

       
83
       
-
       
          permissions = {

     

       
84
       
-
       
            "example.com" = "user";

     

       
85
       
-
       
          };

     

       
86
       
 
       
        };

     

       
87
       
 
       
      };

     

       
88
       
 
       
    };

     

       
89
       
 
       


     

       
90
       
 
       
    serviceDependencies = lib.mkOption {

     

       
91
       
 
       
      type = with lib.types; listOf str;

     

       
92
       
-
       
      default = lib.optional config.services.matrix-synapse.enable config.services.matrix-synapse.serviceUnit;

     

       
0
       
 
       

     

       
93
       
 
       
      defaultText = lib.literalExpression ''

     

       
94
       
 
       
        optional config.services.matrix-synapse.enable config.services.matrix-synapse.serviceUnits

     

       
95
       
 
       
      '';

     
···

       
108
       
 
       
      description = "Mautrix-Messenger bridge user";

     

       
109
       
 
       
    };

     

       
110
       
 
       


     

       
111
       
-
       
    users.groups.mautrix-messenger = {};

     

       
112
       
 
       


     

       
113
       
 
       
    services.mautrix-messenger.settings = lib.mkMerge (map mkDefaults [

     

       
114
       
 
       
      defaultConfig

     

       
115
       
 
       
      # Note: this is defined here to avoid the docs depending on `config`

     

       
116
       
-
       
      { homeserver.domain = config.services.matrix-synapse.settings.server_name; }

     

       
0
       
 
       

     

       
0
       
 
       

     

       
117
       
 
       
    ]);

     

       
118
       
 
       


     

       
119
       
 
       
    systemd.services.mautrix-messenger = {

     

       
120
       
 
       
      description = "Mautrix-Messenger Service - A Messenger bridge for Matrix";

     

       
121
       
 
       


     

       
122
       
-
       
      wantedBy = ["multi-user.target"];

     

       
123
       
-
       
      wants = ["network-online.target"] ++ cfg.serviceDependencies;

     

       
124
       
-
       
      after = ["network-online.target"] ++ cfg.serviceDependencies;

     

       
125
       
 
       


     

       
126
       
 
       
      preStart = ''

     

       
127
       
 
       
        # substitute the settings file by environment variables

     
···

       
182
       
 
       
        RestrictSUIDSGID = true;

     

       
183
       
 
       
        SystemCallArchitectures = "native";

     

       
184
       
 
       
        SystemCallErrorNumber = "EPERM";

     

       
185
       
-
       
        SystemCallFilter = ["@system-service"];

     

       
186
       
 
       
        Type = "simple";

     

       
187
       
-
       
        UMask = 0027;

     

       
188
       
 
       
      };

     

       
189
       
-
       
      restartTriggers = [settingsFileUnsubstituted];

     

       
190
       
 
       
    };

     

       
191
       
 
       
  };

     

       
192
       
 
       
}

     

···

       
1
       
+
       
{ lib, config, pkgs, ... }:

     

       
2
       
+
       
let

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
3
       
 
       
  cfg = config.services.mautrix-messenger;

     

       
4
       
 
       
  dataDir = "/var/lib/mautrix-messenger";

     

       
5
       
 
       
  registrationFile = "${dataDir}/messenger-registration.yaml";

     

       
6
       
 
       
  settingsFile = "${dataDir}/config.json";

     

       
7
       
+
       
  settingsFileUnsubstituted =

     

       
8
       
+
       
    settingsFormat.generate "mautrix-messenger-config-unsubstituted.json"

     

       
9
       
+
       
    cfg.settings;

     

       
10
       
+
       
  settingsFormat = pkgs.formats.json { };

     

       
11
       
 
       
  appservicePort = 29320;

     

       
12
       
 
       


     

       
13
       
 
       
  mkDefaults = lib.mapAttrsRecursive (n: v: lib.mkDefault v);

     
···

       
28
       
 
       
    };

     

       
29
       
 
       
    bridge = {

     

       
30
       
 
       
      username_template = "messenger_{{.}}";

     

       
31
       
+
       
      double_puppet_server_map = { };

     

       
32
       
+
       
      login_shared_secret_map = { };

     

       
33
       
 
       
      permissions."*" = "relay";

     

       
34
       
 
       
      relay.enabled = true;

     

       
35
       
 
       
    };

     
···

       
45
       
 
       


     

       
46
       
 
       
in {

     

       
47
       
 
       
  options.services.mautrix-messenger = {

     

       
48
       
+
       
    enable = lib.mkEnableOption (lib.mdDoc

     

       
49
       
+
       
      "mautrix-messenger, a puppeting/relaybot bridge between Matrix and Messenger.");

     

       
50
       
 
       


     

       
51
       
 
       
    settings = lib.mkOption {

     

       
52
       
 
       
      type = settingsFormat.type;

     
···

       
66
       
 
       
          ephemeral_events = false;

     

       
67
       
 
       
        };

     

       
68
       
 
       
        bridge = {

     

       
69
       
+
       
          history_sync = { request_full_sync = true; };

     

       
0
       
 
       

     

       
0
       
 
       

     

       
70
       
 
       
          private_chat_portal_meta = true;

     

       
71
       
 
       
          mute_bridging = true;

     

       
72
       
 
       
          encryption = {

     
···

       
74
       
 
       
            default = true;

     

       
75
       
 
       
            require = true;

     

       
76
       
 
       
          };

     

       
77
       
+
       
          provisioning = { shared_secret = "disable"; };

     

       
78
       
+
       
          permissions = { "example.com" = "user"; };

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
79
       
 
       
        };

     

       
80
       
 
       
      };

     

       
81
       
 
       
    };

     

       
82
       
 
       


     

       
83
       
 
       
    serviceDependencies = lib.mkOption {

     

       
84
       
 
       
      type = with lib.types; listOf str;

     

       
85
       
+
       
      default = lib.optional config.services.matrix-synapse.enable

     

       
86
       
+
       
        config.services.matrix-synapse.serviceUnit;

     

       
87
       
 
       
      defaultText = lib.literalExpression ''

     

       
88
       
 
       
        optional config.services.matrix-synapse.enable config.services.matrix-synapse.serviceUnits

     

       
89
       
 
       
      '';

     
···

       
102
       
 
       
      description = "Mautrix-Messenger bridge user";

     

       
103
       
 
       
    };

     

       
104
       
 
       


     

       
105
       
+
       
    users.groups.mautrix-messenger = { };

     

       
106
       
 
       


     

       
107
       
 
       
    services.mautrix-messenger.settings = lib.mkMerge (map mkDefaults [

     

       
108
       
 
       
      defaultConfig

     

       
109
       
 
       
      # Note: this is defined here to avoid the docs depending on `config`

     

       
110
       
+
       
      {

     

       
111
       
+
       
        homeserver.domain = config.services.matrix-synapse.settings.server_name;

     

       
112
       
+
       
      }

     

       
113
       
 
       
    ]);

     

       
114
       
 
       


     

       
115
       
 
       
    systemd.services.mautrix-messenger = {

     

       
116
       
 
       
      description = "Mautrix-Messenger Service - A Messenger bridge for Matrix";

     

       
117
       
 
       


     

       
118
       
+
       
      wantedBy = [ "multi-user.target" ];

     

       
119
       
+
       
      wants = [ "network-online.target" ] ++ cfg.serviceDependencies;

     

       
120
       
+
       
      after = [ "network-online.target" ] ++ cfg.serviceDependencies;

     

       
121
       
 
       


     

       
122
       
 
       
      preStart = ''

     

       
123
       
 
       
        # substitute the settings file by environment variables

     
···

       
178
       
 
       
        RestrictSUIDSGID = true;

     

       
179
       
 
       
        SystemCallArchitectures = "native";

     

       
180
       
 
       
        SystemCallErrorNumber = "EPERM";

     

       
181
       
+
       
        SystemCallFilter = [ "@system-service" ];

     

       
182
       
 
       
        Type = "simple";

     

       
183
       
+
       
        UMask = 27;

     

       
184
       
 
       
      };

     

       
185
       
+
       
      restartTriggers = [ settingsFileUnsubstituted ];

     

       
186
       
 
       
    };

     

       
187
       
 
       
  };

     

       
188
       
 
       
}

     

···

       
1
       
-
       
{

     

       
2
       
-
       
  lib,

     

       
3
       
-
       
  config,

     

       
4
       
-
       
  pkgs,

     

       
5
       
-
       
  ...

     

       
6
       
-
       
}: let

     

       
7
       
 
       
  cfg = config.services.mautrix-signal;

     

       
8
       
 
       
  dataDir = "/var/lib/mautrix-signal";

     

       
9
       
 
       
  registrationFile = "${dataDir}/signal-registration.yaml";

     

       
10
       
 
       
  settingsFile = "${dataDir}/config.json";

     

       
11
       
-
       
  settingsFileUnsubstituted = settingsFormat.generate "mautrix-signal-config-unsubstituted.json" cfg.settings;

     

       
12
       
-
       
  settingsFormat = pkgs.formats.json {};

     

       
0
       
 
       

     

       
0
       
 
       

     

       
13
       
 
       
  appservicePort = 29328;

     

       
14
       
 
       


     

       
15
       
 
       
  mkDefaults = lib.mapAttrsRecursive (n: v: lib.mkDefault v);

     
···

       
32
       
 
       
    };

     

       
33
       
 
       
    bridge = {

     

       
34
       
 
       
      username_template = "signal_{{.}}";

     

       
35
       
-
       
      double_puppet_server_map = {};

     

       
36
       
-
       
      login_shared_secret_map = {};

     

       
37
       
 
       
      permissions."*" = "relay";

     

       
38
       
 
       
    };

     

       
39
       
 
       
    logging = {

     
···

       
48
       
 
       


     

       
49
       
 
       
in {

     

       
50
       
 
       
  options.services.mautrix-signal = {

     

       
51
       
-
       
    enable = lib.mkEnableOption (lib.mdDoc "mautrix-signal, a puppeting/relaybot bridge between Matrix and Signal.");

     

       
0
       
 
       

     

       
52
       
 
       


     

       
53
       
 
       
    settings = lib.mkOption {

     

       
54
       
 
       
      type = settingsFormat.type;

     
···

       
68
       
 
       
          ephemeral_events = false;

     

       
69
       
 
       
        };

     

       
70
       
 
       
        bridge = {

     

       
71
       
-
       
          history_sync = {

     

       
72
       
-
       
            request_full_sync = true;

     

       
73
       
-
       
          };

     

       
74
       
 
       
          private_chat_portal_meta = true;

     

       
75
       
 
       
          mute_bridging = true;

     

       
76
       
 
       
          encryption = {

     
···

       
78
       
 
       
            default = true;

     

       
79
       
 
       
            require = true;

     

       
80
       
 
       
          };

     

       
81
       
-
       
          provisioning = {

     

       
82
       
-
       
            shared_secret = "disable";

     

       
83
       
-
       
          };

     

       
84
       
-
       
          permissions = {

     

       
85
       
-
       
            "example.com" = "user";

     

       
86
       
-
       
          };

     

       
87
       
 
       
        };

     

       
88
       
 
       
      };

     

       
89
       
 
       
    };

     

       
90
       
 
       


     

       
91
       
 
       
    serviceDependencies = lib.mkOption {

     

       
92
       
 
       
      type = with lib.types; listOf str;

     

       
93
       
-
       
      default = lib.optional config.services.matrix-synapse.enable config.services.matrix-synapse.serviceUnit;

     

       
0
       
 
       

     

       
94
       
 
       
      defaultText = lib.literalExpression ''

     

       
95
       
 
       
        optional config.services.matrix-synapse.enable config.services.matrix-synapse.serviceUnits

     

       
96
       
 
       
      '';

     
···

       
111
       
 
       
      description = "Mautrix-Signal bridge user";

     

       
112
       
 
       
    };

     

       
113
       
 
       


     

       
114
       
-
       
    users.groups.mautrix-signal = {};

     

       
115
       
 
       


     

       
116
       
 
       
    services.mautrix-signal.settings = lib.mkMerge (map mkDefaults [

     

       
117
       
 
       
      defaultConfig

     

       
118
       
 
       
      # Note: this is defined here to avoid the docs depending on `config`

     

       
119
       
-
       
      { homeserver.domain = config.services.matrix-synapse.settings.server_name; }

     

       
0
       
 
       

     

       
0
       
 
       

     

       
120
       
 
       
    ]);

     

       
121
       
 
       


     

       
122
       
 
       
    systemd.services.mautrix-signal = {

     
···

       
126
       
 
       
      # voice messages need `ffmpeg`

     

       
127
       
 
       
      path = [ pkgs.ffmpeg ];

     

       
128
       
 
       


     

       
129
       
-
       
      wantedBy = ["multi-user.target"];

     

       
130
       
-
       
      wants = ["network-online.target"] ++ cfg.serviceDependencies;

     

       
131
       
-
       
      after = ["network-online.target" "signald.service"] ++ cfg.serviceDependencies;

     

       
0
       
 
       

     

       
132
       
 
       


     

       
133
       
 
       
      preStart = ''

     

       
134
       
 
       
        # substitute the settings file by environment variables

     
···

       
190
       
 
       
        RestrictSUIDSGID = true;

     

       
191
       
 
       
        SystemCallArchitectures = "native";

     

       
192
       
 
       
        SystemCallErrorNumber = "EPERM";

     

       
193
       
-
       
        SystemCallFilter = ["@system-service"];

     

       
194
       
 
       
        Type = "simple";

     

       
195
       
-
       
        UMask = 0027;

     

       
196
       
 
       
      };

     

       
197
       
-
       
      restartTriggers = [settingsFileUnsubstituted];

     

       
198
       
 
       
    };

     

       
199
       
 
       
  };

     

       
200
       
 
       
}

     

···

       
1
       
+
       
{ lib, config, pkgs, ... }:

     

       
2
       
+
       
let

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
3
       
 
       
  cfg = config.services.mautrix-signal;

     

       
4
       
 
       
  dataDir = "/var/lib/mautrix-signal";

     

       
5
       
 
       
  registrationFile = "${dataDir}/signal-registration.yaml";

     

       
6
       
 
       
  settingsFile = "${dataDir}/config.json";

     

       
7
       
+
       
  settingsFileUnsubstituted =

     

       
8
       
+
       
    settingsFormat.generate "mautrix-signal-config-unsubstituted.json"

     

       
9
       
+
       
    cfg.settings;

     

       
10
       
+
       
  settingsFormat = pkgs.formats.json { };

     

       
11
       
 
       
  appservicePort = 29328;

     

       
12
       
 
       


     

       
13
       
 
       
  mkDefaults = lib.mapAttrsRecursive (n: v: lib.mkDefault v);

     
···

       
30
       
 
       
    };

     

       
31
       
 
       
    bridge = {

     

       
32
       
 
       
      username_template = "signal_{{.}}";

     

       
33
       
+
       
      double_puppet_server_map = { };

     

       
34
       
+
       
      login_shared_secret_map = { };

     

       
35
       
 
       
      permissions."*" = "relay";

     

       
36
       
 
       
    };

     

       
37
       
 
       
    logging = {

     
···

       
46
       
 
       


     

       
47
       
 
       
in {

     

       
48
       
 
       
  options.services.mautrix-signal = {

     

       
49
       
+
       
    enable = lib.mkEnableOption (lib.mdDoc

     

       
50
       
+
       
      "mautrix-signal, a puppeting/relaybot bridge between Matrix and Signal.");

     

       
51
       
 
       


     

       
52
       
 
       
    settings = lib.mkOption {

     

       
53
       
 
       
      type = settingsFormat.type;

     
···

       
67
       
 
       
          ephemeral_events = false;

     

       
68
       
 
       
        };

     

       
69
       
 
       
        bridge = {

     

       
70
       
+
       
          history_sync = { request_full_sync = true; };

     

       
0
       
 
       

     

       
0
       
 
       

     

       
71
       
 
       
          private_chat_portal_meta = true;

     

       
72
       
 
       
          mute_bridging = true;

     

       
73
       
 
       
          encryption = {

     
···

       
75
       
 
       
            default = true;

     

       
76
       
 
       
            require = true;

     

       
77
       
 
       
          };

     

       
78
       
+
       
          provisioning = { shared_secret = "disable"; };

     

       
79
       
+
       
          permissions = { "example.com" = "user"; };

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
80
       
 
       
        };

     

       
81
       
 
       
      };

     

       
82
       
 
       
    };

     

       
83
       
 
       


     

       
84
       
 
       
    serviceDependencies = lib.mkOption {

     

       
85
       
 
       
      type = with lib.types; listOf str;

     

       
86
       
+
       
      default = lib.optional config.services.matrix-synapse.enable

     

       
87
       
+
       
        config.services.matrix-synapse.serviceUnit;

     

       
88
       
 
       
      defaultText = lib.literalExpression ''

     

       
89
       
 
       
        optional config.services.matrix-synapse.enable config.services.matrix-synapse.serviceUnits

     

       
90
       
 
       
      '';

     
···

       
105
       
 
       
      description = "Mautrix-Signal bridge user";

     

       
106
       
 
       
    };

     

       
107
       
 
       


     

       
108
       
+
       
    users.groups.mautrix-signal = { };

     

       
109
       
 
       


     

       
110
       
 
       
    services.mautrix-signal.settings = lib.mkMerge (map mkDefaults [

     

       
111
       
 
       
      defaultConfig

     

       
112
       
 
       
      # Note: this is defined here to avoid the docs depending on `config`

     

       
113
       
+
       
      {

     

       
114
       
+
       
        homeserver.domain = config.services.matrix-synapse.settings.server_name;

     

       
115
       
+
       
      }

     

       
116
       
 
       
    ]);

     

       
117
       
 
       


     

       
118
       
 
       
    systemd.services.mautrix-signal = {

     
···

       
122
       
 
       
      # voice messages need `ffmpeg`

     

       
123
       
 
       
      path = [ pkgs.ffmpeg ];

     

       
124
       
 
       


     

       
125
       
+
       
      wantedBy = [ "multi-user.target" ];

     

       
126
       
+
       
      wants = [ "network-online.target" ] ++ cfg.serviceDependencies;

     

       
127
       
+
       
      after = [ "network-online.target" "signald.service" ]

     

       
128
       
+
       
        ++ cfg.serviceDependencies;

     

       
129
       
 
       


     

       
130
       
 
       
      preStart = ''

     

       
131
       
 
       
        # substitute the settings file by environment variables

     
···

       
187
       
 
       
        RestrictSUIDSGID = true;

     

       
188
       
 
       
        SystemCallArchitectures = "native";

     

       
189
       
 
       
        SystemCallErrorNumber = "EPERM";

     

       
190
       
+
       
        SystemCallFilter = [ "@system-service" ];

     

       
191
       
 
       
        Type = "simple";

     

       
192
       
+
       
        UMask = 27;

     

       
193
       
 
       
      };

     

       
194
       
+
       
      restartTriggers = [ settingsFileUnsubstituted ];

     

       
195
       
 
       
    };

     

       
196
       
 
       
  };

     

       
197
       
 
       
}

     

···

       
4
       
 
       
let

     

       
5
       
 
       
  cfg = config.eilean;

     

       
6
       
 
       
  turnSharedSecretFile = "/run/matrix-synapse/turn-shared-secret";

     

       
7
       
-
       
in

     

       
8
       
-
       
{

     

       
9
       
 
       
  options.eilean.matrix = {

     

       
10
       
 
       
    enable = mkEnableOption "matrix";

     

       
11
       
 
       
    turn = mkOption {

     
···

       
68
       
 
       
          enableACME = true;

     

       
69
       
 
       
          forceSSL = true;

     

       
70
       
 
       


     

       
71
       
-
       
          locations."= /.well-known/matrix/server".extraConfig =

     

       
72
       
-
       
            let

     

       
73
       
-
       
              # use 443 instead of the default 8448 port to unite

     

       
74
       
-
       
              # the client-server and server-server port for simplicity

     

       
75
       
-
       
              server = { "m.server" = "matrix.${config.networking.domain}:443"; };

     

       
76
       
-
       
            in ''

     

       
77
       
-
       
              default_type application/json;

     

       
78
       
-
       
              return 200 '${builtins.toJSON server}';

     

       
79
       
-
       
            '';

     

       
80
       
-
       
          locations."= /.well-known/matrix/client".extraConfig =

     

       
81
       
-
       
            let

     

       
82
       
-
       
              client = {

     

       
83
       
-
       
                "m.homeserver" =  { "base_url" = "https://matrix.${config.networking.domain}"; };

     

       
84
       
-
       
                "m.identity_server" =  { "base_url" = "https://vector.im"; };

     

       
85
       
 
       
              };

     

       
0
       
 
       

     

       
0
       
 
       

     

       
86
       
 
       
            # ACAO required to allow element-web on any URL to request this json file

     

       
87
       
 
       
            # set other headers due to https://github.com/yandex/gixy/blob/master/docs/en/plugins/addheaderredefinition.md

     

       
88
       
-
       
            in ''

     

       
89
       
-
       
              default_type application/json;

     

       
90
       
-
       
              add_header Access-Control-Allow-Origin *;

     

       
91
       
-
       
              add_header Strict-Transport-Security max-age=31536000 always;

     

       
92
       
-
       
              add_header X-Frame-Options SAMEORIGIN always;

     

       
93
       
-
       
              add_header X-Content-Type-Options nosniff always;

     

       
94
       
-
       
              add_header Content-Security-Policy "default-src 'self'; base-uri 'self'; frame-src 'self'; frame-ancestors 'self'; form-action 'self';" always;

     

       
95
       
-
       
              add_header Referrer-Policy 'same-origin';

     

       
96
       
-
       
              return 200 '${builtins.toJSON client}';

     

       
97
       
-
       
            '';

     

       
98
       
 
       
        };

     

       
99
       
 
       


     

       
100
       
 
       
        # Reverse proxy for Matrix client-server and server-server communication

     
···

       
125
       
 
       
          enable_registration = true;

     

       
126
       
 
       
          registration_requires_token = true;

     

       
127
       
 
       
          registration_shared_secret_path = cfg.matrix.registrationSecretFile;

     

       
128
       
-
       
          listeners = [

     

       
129
       
-
       
            {

     

       
130
       
-
       
              port = 8008;

     

       
131
       
-
       
              bind_addresses = [ "::1" "127.0.0.1" ];

     

       
132
       
-
       
              type = "http";

     

       
133
       
-
       
              tls = false;

     

       
134
       
-
       
              x_forwarded = true;

     

       
135
       
-
       
              resources = [

     

       
136
       
-
       
                {

     

       
137
       
-
       
                  names = [ "client" "federation" ];

     

       
138
       
-
       
                  compress = false;

     

       
139
       
-
       
                }

     

       
140
       
-
       
              ];

     

       
141
       
-
       
            }

     

       
142
       
-
       
          ];

     

       
143
       
 
       
          max_upload_size = "100M";

     

       
144
       
-
       
          app_service_config_files =

     

       
145
       
-
       
            (optional cfg.matrix.bridges.whatsapp "/var/lib/mautrix-whatsapp/whatsapp-registration.yaml") ++

     

       
146
       
-
       
            (optional cfg.matrix.bridges.signal "/var/lib/mautrix-signal/signal-registration.yaml") ++

     

       
147
       
-
       
            (optional cfg.matrix.bridges.instagram "/var/lib/mautrix-instagram/instagram-registration.yaml") ++

     

       
148
       
-
       
            (optional cfg.matrix.bridges.messenger "/var/lib/mautrix-messenger/messenger-registration.yaml");

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
149
       
 
       
        }

     

       
150
       
 
       
        (mkIf cfg.matrix.turn {

     

       
151
       
 
       
          turn_uris = with config.services.coturn; [

     
···

       
157
       
 
       
          turn_user_lifetime = "1h";

     

       
158
       
 
       
        })

     

       
159
       
 
       
      ];

     

       
160
       
-
       
      extraConfigFiles = mkIf cfg.matrix.turn (

     

       
161
       
-
       
        [ turnSharedSecretFile ]

     

       
162
       
-
       
      );

     

       
163
       
 
       
    };

     

       
164
       
 
       


     

       
165
       
-
       
    systemd.services.matrix-synapse-turn-shared-secret-generator = mkIf cfg.matrix.turn {

     

       
166
       
-
       
      description = "Generate matrix synapse turn shared secret config file";

     

       
167
       
-
       
      script = ''

     

       
168
       
-
       
        mkdir -p "$(dirname '${turnSharedSecretFile}')"

     

       
169
       
-
       
        echo "turn_shared_secret: $(cat '${config.services.coturn.static-auth-secret-file}')" > '${turnSharedSecretFile}'

     

       
170
       
-
       
        chmod 770 '${turnSharedSecretFile}'

     

       
171
       
-
       
        chown ${config.systemd.services.matrix-synapse.serviceConfig.User}:${config.systemd.services.matrix-synapse.serviceConfig.Group} '${turnSharedSecretFile}'

     

       
0
       
 
       

     

       
172
       
 
       
        '';

     

       
173
       
-
       
      serviceConfig.Type = "oneshot";

     

       
174
       
-
       
      serviceConfig.RemainAfterExit = true;

     

       
175
       
-
       
      after = [ "coturn-static-auth-secret-generator.service" ];

     

       
176
       
-
       
      requires = [ "coturn-static-auth-secret-generator.service" ];

     

       
177
       
-
       
    };

     

       
178
       
-
       
    systemd.services."matrix-synapse".after = mkIf cfg.matrix.turn [ "matrix-synapse-turn-shared-secret-generator.service" ];

     

       
179
       
-
       
    systemd.services."matrix-synapse".requires = mkIf cfg.matrix.turn [ "matrix-synapse-turn-shared-secret-generator.service" ];

     

       
0
       
 
       

     

       
0
       
 
       

     

       
180
       
 
       


     

       
181
       
 
       
    systemd.services.matrix-synapse.serviceConfig.SupplementaryGroups =

     

       
182
       
-
       
      (optional cfg.matrix.bridges.whatsapp config.systemd.services.mautrix-whatsapp.serviceConfig.Group) ++

     

       
183
       
-
       
      (optional cfg.matrix.bridges.signal config.systemd.services.mautrix-signal.serviceConfig.Group) ++

     

       
184
       
-
       
      (optional cfg.matrix.bridges.instagram config.systemd.services.mautrix-instagram.serviceConfig.Group) ++

     

       
185
       
-
       
      (optional cfg.matrix.bridges.messenger config.systemd.services.mautrix-messenger.serviceConfig.Group);

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
186
       
 
       


     

       
187
       
 
       
    services.mautrix-whatsapp = mkIf cfg.matrix.bridges.whatsapp {

     

       
188
       
 
       
      enable = true;

     

       
189
       
-
       
      settings.homeserver.address = "https://matrix.${config.networking.domain}";

     

       
0
       
 
       

     

       
190
       
 
       
      settings.homeserver.domain = config.networking.domain;

     

       
191
       
 
       
      settings.appservice.hostname = "localhost";

     

       
192
       
 
       
      settings.appservice.address = "http://localhost:29318";

     

       
193
       
 
       
      settings.bridge.personal_filtering_spaces = true;

     

       
194
       
 
       
      settings.bridge.history_sync.backfill = false;

     

       
195
       
-
       
      settings.bridge.permissions."@${config.eilean.username}:${config.networking.domain}" = "admin";

     

       
0
       
 
       

     

       
196
       
 
       
    };

     

       
197
       
 
       
    services.mautrix-signal = mkIf cfg.matrix.bridges.signal {

     

       
198
       
 
       
      enable = true;

     

       
199
       
-
       
      settings.homeserver.address = "https://matrix.${config.networking.domain}";

     

       
0
       
 
       

     

       
200
       
 
       
      settings.homeserver.domain = config.networking.domain;

     

       
201
       
 
       
      settings.appservice.hostname = "localhost";

     

       
202
       
 
       
      settings.appservice.address = "http://localhost:29328";

     

       
203
       
 
       
      settings.bridge.personal_filtering_spaces = true;

     

       
204
       
-
       
      settings.bridge.permissions."@${config.eilean.username}:${config.networking.domain}" = "admin";

     

       
0
       
 
       

     

       
205
       
 
       
    };

     

       
206
       
 
       
    services.mautrix-instagram = mkIf cfg.matrix.bridges.instagram {

     

       
207
       
 
       
      enable = true;

     

       
208
       
-
       
      settings.homeserver.address = "https://matrix.${config.networking.domain}";

     

       
0
       
 
       

     

       
209
       
 
       
      settings.homeserver.domain = config.networking.domain;

     

       
210
       
 
       
      settings.appservice.hostname = "localhost";

     

       
211
       
 
       
      settings.appservice.address = "http://localhost:29319";

     

       
212
       
 
       
      settings.bridge.personal_filtering_spaces = true;

     

       
213
       
 
       
      settings.bridge.backfill.enabled = false;

     

       
214
       
-
       
      settings.bridge.permissions."@${config.eilean.username}:${config.networking.domain}" = "admin";

     

       
0
       
 
       

     

       
215
       
 
       
    };

     

       
216
       
 
       
    services.mautrix-messenger = mkIf cfg.matrix.bridges.messenger {

     

       
217
       
 
       
      enable = true;

     

       
218
       
-
       
      settings.homeserver.address = "https://matrix.${config.networking.domain}";

     

       
0
       
 
       

     

       
219
       
 
       
      settings.homeserver.domain = config.networking.domain;

     

       
220
       
 
       
      settings.appservice.hostname = "localhost";

     

       
221
       
 
       
      settings.appservice.address = "http://localhost:29320";

     

       
222
       
 
       
      settings.bridge.personal_filtering_spaces = true;

     

       
223
       
 
       
      settings.bridge.backfill.enabled = false;

     

       
224
       
-
       
      settings.bridge.permissions."@${config.eilean.username}:${config.networking.domain}" = "admin";

     

       
0
       
 
       

     

       
225
       
 
       
    };

     

       
226
       
 
       


     

       
227
       
 
       
    eilean.turn.enable = mkIf cfg.matrix.turn true;

     

       
228
       
 
       


     

       
229
       
 
       
    eilean.dns.enable = true;

     

       
230
       
-
       
    eilean.services.dns.zones.${config.networking.domain}.records = [

     

       
231
       
-
       
      {

     

       
232
       
-
       
        name = "matrix";

     

       
233
       
-
       
        type = "CNAME";

     

       
234
       
-
       
        data = "vps";

     

       
235
       
-
       
      }

     

       
236
       
-
       
    ];

     

       
237
       
 
       
  };

     

       
238
       
 
       
}

     

···

       
4
       
 
       
let

     

       
5
       
 
       
  cfg = config.eilean;

     

       
6
       
 
       
  turnSharedSecretFile = "/run/matrix-synapse/turn-shared-secret";

     

       
7
       
+
       
in {

     

       
0
       
 
       

     

       
8
       
 
       
  options.eilean.matrix = {

     

       
9
       
 
       
    enable = mkEnableOption "matrix";

     

       
10
       
 
       
    turn = mkOption {

     
···

       
67
       
 
       
          enableACME = true;

     

       
68
       
 
       
          forceSSL = true;

     

       
69
       
 
       


     

       
70
       
+
       
          locations."= /.well-known/matrix/server".extraConfig = let

     

       
71
       
+
       
            # use 443 instead of the default 8448 port to unite

     

       
72
       
+
       
            # the client-server and server-server port for simplicity

     

       
73
       
+
       
            server = { "m.server" = "matrix.${config.networking.domain}:443"; };

     

       
74
       
+
       
          in ''

     

       
75
       
+
       
            default_type application/json;

     

       
76
       
+
       
            return 200 '${builtins.toJSON server}';

     

       
77
       
+
       
          '';

     

       
78
       
+
       
          locations."= /.well-known/matrix/client".extraConfig = let

     

       
79
       
+
       
            client = {

     

       
80
       
+
       
              "m.homeserver" = {

     

       
81
       
+
       
                "base_url" = "https://matrix.${config.networking.domain}";

     

       
0
       
 
       

     

       
0
       
 
       

     

       
82
       
 
       
              };

     

       
83
       
+
       
              "m.identity_server" = { "base_url" = "https://vector.im"; };

     

       
84
       
+
       
            };

     

       
85
       
 
       
            # ACAO required to allow element-web on any URL to request this json file

     

       
86
       
 
       
            # set other headers due to https://github.com/yandex/gixy/blob/master/docs/en/plugins/addheaderredefinition.md

     

       
87
       
+
       
          in ''

     

       
88
       
+
       
            default_type application/json;

     

       
89
       
+
       
            add_header Access-Control-Allow-Origin *;

     

       
90
       
+
       
            add_header Strict-Transport-Security max-age=31536000 always;

     

       
91
       
+
       
            add_header X-Frame-Options SAMEORIGIN always;

     

       
92
       
+
       
            add_header X-Content-Type-Options nosniff always;

     

       
93
       
+
       
            add_header Content-Security-Policy "default-src 'self'; base-uri 'self'; frame-src 'self'; frame-ancestors 'self'; form-action 'self';" always;

     

       
94
       
+
       
            add_header Referrer-Policy 'same-origin';

     

       
95
       
+
       
            return 200 '${builtins.toJSON client}';

     

       
96
       
+
       
          '';

     

       
97
       
 
       
        };

     

       
98
       
 
       


     

       
99
       
 
       
        # Reverse proxy for Matrix client-server and server-server communication

     
···

       
124
       
 
       
          enable_registration = true;

     

       
125
       
 
       
          registration_requires_token = true;

     

       
126
       
 
       
          registration_shared_secret_path = cfg.matrix.registrationSecretFile;

     

       
127
       
+
       
          listeners = [{

     

       
128
       
+
       
            port = 8008;

     

       
129
       
+
       
            bind_addresses = [ "::1" "127.0.0.1" ];

     

       
130
       
+
       
            type = "http";

     

       
131
       
+
       
            tls = false;

     

       
132
       
+
       
            x_forwarded = true;

     

       
133
       
+
       
            resources = [{

     

       
134
       
+
       
              names = [ "client" "federation" ];

     

       
135
       
+
       
              compress = false;

     

       
136
       
+
       
            }];

     

       
137
       
+
       
          }];

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
138
       
 
       
          max_upload_size = "100M";

     

       
139
       
+
       
          app_service_config_files = (optional cfg.matrix.bridges.whatsapp

     

       
140
       
+
       
            "/var/lib/mautrix-whatsapp/whatsapp-registration.yaml")

     

       
141
       
+
       
            ++ (optional cfg.matrix.bridges.signal

     

       
142
       
+
       
              "/var/lib/mautrix-signal/signal-registration.yaml")

     

       
143
       
+
       
            ++ (optional cfg.matrix.bridges.instagram

     

       
144
       
+
       
              "/var/lib/mautrix-instagram/instagram-registration.yaml")

     

       
145
       
+
       
            ++ (optional cfg.matrix.bridges.messenger

     

       
146
       
+
       
              "/var/lib/mautrix-messenger/messenger-registration.yaml");

     

       
147
       
 
       
        }

     

       
148
       
 
       
        (mkIf cfg.matrix.turn {

     

       
149
       
 
       
          turn_uris = with config.services.coturn; [

     
···

       
155
       
 
       
          turn_user_lifetime = "1h";

     

       
156
       
 
       
        })

     

       
157
       
 
       
      ];

     

       
158
       
+
       
      extraConfigFiles = mkIf cfg.matrix.turn ([ turnSharedSecretFile ]);

     

       
0
       
 
       

     

       
0
       
 
       

     

       
159
       
 
       
    };

     

       
160
       
 
       


     

       
161
       
+
       
    systemd.services.matrix-synapse-turn-shared-secret-generator =

     

       
162
       
+
       
      mkIf cfg.matrix.turn {

     

       
163
       
+
       
        description = "Generate matrix synapse turn shared secret config file";

     

       
164
       
+
       
        script = ''

     

       
165
       
+
       
          mkdir -p "$(dirname '${turnSharedSecretFile}')"

     

       
166
       
+
       
          echo "turn_shared_secret: $(cat '${config.services.coturn.static-auth-secret-file}')" > '${turnSharedSecretFile}'

     

       
167
       
+
       
          chmod 770 '${turnSharedSecretFile}'

     

       
168
       
+
       
          chown ${config.systemd.services.matrix-synapse.serviceConfig.User}:${config.systemd.services.matrix-synapse.serviceConfig.Group} '${turnSharedSecretFile}'

     

       
169
       
 
       
        '';

     

       
170
       
+
       
        serviceConfig.Type = "oneshot";

     

       
171
       
+
       
        serviceConfig.RemainAfterExit = true;

     

       
172
       
+
       
        after = [ "coturn-static-auth-secret-generator.service" ];

     

       
173
       
+
       
        requires = [ "coturn-static-auth-secret-generator.service" ];

     

       
174
       
+
       
      };

     

       
175
       
+
       
    systemd.services."matrix-synapse".after = mkIf cfg.matrix.turn

     

       
176
       
+
       
      [ "matrix-synapse-turn-shared-secret-generator.service" ];

     

       
177
       
+
       
    systemd.services."matrix-synapse".requires = mkIf cfg.matrix.turn

     

       
178
       
+
       
      [ "matrix-synapse-turn-shared-secret-generator.service" ];

     

       
179
       
 
       


     

       
180
       
 
       
    systemd.services.matrix-synapse.serviceConfig.SupplementaryGroups =

     

       
181
       
+
       
      (optional cfg.matrix.bridges.whatsapp

     

       
182
       
+
       
        config.systemd.services.mautrix-whatsapp.serviceConfig.Group)

     

       
183
       
+
       
      ++ (optional cfg.matrix.bridges.signal

     

       
184
       
+
       
        config.systemd.services.mautrix-signal.serviceConfig.Group)

     

       
185
       
+
       
      ++ (optional cfg.matrix.bridges.instagram

     

       
186
       
+
       
        config.systemd.services.mautrix-instagram.serviceConfig.Group)

     

       
187
       
+
       
      ++ (optional cfg.matrix.bridges.messenger

     

       
188
       
+
       
        config.systemd.services.mautrix-messenger.serviceConfig.Group);

     

       
189
       
 
       


     

       
190
       
 
       
    services.mautrix-whatsapp = mkIf cfg.matrix.bridges.whatsapp {

     

       
191
       
 
       
      enable = true;

     

       
192
       
+
       
      settings.homeserver.address =

     

       
193
       
+
       
        "https://matrix.${config.networking.domain}";

     

       
194
       
 
       
      settings.homeserver.domain = config.networking.domain;

     

       
195
       
 
       
      settings.appservice.hostname = "localhost";

     

       
196
       
 
       
      settings.appservice.address = "http://localhost:29318";

     

       
197
       
 
       
      settings.bridge.personal_filtering_spaces = true;

     

       
198
       
 
       
      settings.bridge.history_sync.backfill = false;

     

       
199
       
+
       
      settings.bridge.permissions."@${config.eilean.username}:${config.networking.domain}" =

     

       
200
       
+
       
        "admin";

     

       
201
       
 
       
    };

     

       
202
       
 
       
    services.mautrix-signal = mkIf cfg.matrix.bridges.signal {

     

       
203
       
 
       
      enable = true;

     

       
204
       
+
       
      settings.homeserver.address =

     

       
205
       
+
       
        "https://matrix.${config.networking.domain}";

     

       
206
       
 
       
      settings.homeserver.domain = config.networking.domain;

     

       
207
       
 
       
      settings.appservice.hostname = "localhost";

     

       
208
       
 
       
      settings.appservice.address = "http://localhost:29328";

     

       
209
       
 
       
      settings.bridge.personal_filtering_spaces = true;

     

       
210
       
+
       
      settings.bridge.permissions."@${config.eilean.username}:${config.networking.domain}" =

     

       
211
       
+
       
        "admin";

     

       
212
       
 
       
    };

     

       
213
       
 
       
    services.mautrix-instagram = mkIf cfg.matrix.bridges.instagram {

     

       
214
       
 
       
      enable = true;

     

       
215
       
+
       
      settings.homeserver.address =

     

       
216
       
+
       
        "https://matrix.${config.networking.domain}";

     

       
217
       
 
       
      settings.homeserver.domain = config.networking.domain;

     

       
218
       
 
       
      settings.appservice.hostname = "localhost";

     

       
219
       
 
       
      settings.appservice.address = "http://localhost:29319";

     

       
220
       
 
       
      settings.bridge.personal_filtering_spaces = true;

     

       
221
       
 
       
      settings.bridge.backfill.enabled = false;

     

       
222
       
+
       
      settings.bridge.permissions."@${config.eilean.username}:${config.networking.domain}" =

     

       
223
       
+
       
        "admin";

     

       
224
       
 
       
    };

     

       
225
       
 
       
    services.mautrix-messenger = mkIf cfg.matrix.bridges.messenger {

     

       
226
       
 
       
      enable = true;

     

       
227
       
+
       
      settings.homeserver.address =

     

       
228
       
+
       
        "https://matrix.${config.networking.domain}";

     

       
229
       
 
       
      settings.homeserver.domain = config.networking.domain;

     

       
230
       
 
       
      settings.appservice.hostname = "localhost";

     

       
231
       
 
       
      settings.appservice.address = "http://localhost:29320";

     

       
232
       
 
       
      settings.bridge.personal_filtering_spaces = true;

     

       
233
       
 
       
      settings.bridge.backfill.enabled = false;

     

       
234
       
+
       
      settings.bridge.permissions."@${config.eilean.username}:${config.networking.domain}" =

     

       
235
       
+
       
        "admin";

     

       
236
       
 
       
    };

     

       
237
       
 
       


     

       
238
       
 
       
    eilean.turn.enable = mkIf cfg.matrix.turn true;

     

       
239
       
 
       


     

       
240
       
 
       
    eilean.dns.enable = true;

     

       
241
       
+
       
    eilean.services.dns.zones.${config.networking.domain}.records = [{

     

       
242
       
+
       
      name = "matrix";

     

       
243
       
+
       
      type = "CNAME";

     

       
244
       
+
       
      data = "vps";

     

       
245
       
+
       
    }];

     

       
0
       
 
       

     

       
0
       
 
       

     

       
246
       
 
       
  };

     

       
247
       
 
       
}