commit 917ed4b6be9bde8d72a6a4d2babf7ac3859a1999 · ryan.freumh.org/eilean-nix

+4 -4

flake.lock

···

       176
        
           },

     

       177
        
           "nixpkgs_2": {

     

       178
        
             "locked": {

     

       179
       -
               "lastModified": 1712867921,

     

       180
       -
               "narHash": "sha256-edTFV4KldkCMdViC/rmpJa7oLIU8SE/S35lh/ukC7bg=",

     

       181
        
               "owner": "nixos",

     

       182
        
               "repo": "nixpkgs",

     

       183
       -
               "rev": "51651a540816273b67bc4dedea2d37d116c5f7fe",

     

       184
        
               "type": "github"

     

       185
        
             },

     

       186
        
             "original": {

     

       187
        
               "owner": "nixos",

     

       188
       -
               "ref": "nixos-23.11",

     

       189
        
               "repo": "nixpkgs",

     

       190
        
               "type": "github"

     

       191
        
             }

···

       176
        
           },

     

       177
        
           "nixpkgs_2": {

     

       178
        
             "locked": {

     

       179
       +
               "lastModified": 1717952948,

     

       180
       +
               "narHash": "sha256-mJi4/gjiwQlSaxjA6AusXBN/6rQRaPCycR7bd8fydnQ=",

     

       181
        
               "owner": "nixos",

     

       182
        
               "repo": "nixpkgs",

     

       183
       +
               "rev": "2819fffa7fa42156680f0d282c60d81e8fb185b7",

     

       184
        
               "type": "github"

     

       185
        
             },

     

       186
        
             "original": {

     

       187
        
               "owner": "nixos",

     

       188
       +
               "ref": "nixos-24.05",

     

       189
        
               "repo": "nixpkgs",

     

       190
        
               "type": "github"

     

       191
        
             }

+1 -1

flake.nix

···

       1
        
       {

     

       2
        
         inputs = {

     

       3
       -
           nixpkgs.url = "github:nixos/nixpkgs/nixos-23.11";

     

       4
        
           nixos-mailserver.url = "github:RyanGibb/nixos-mailserver/fork-23.11";

     

       5
        
           eon.url = "github:RyanGibb/eon";

     

       6
        
           eon.inputs.nixpkgs.follows = "nixpkgs";

···

       1
        
       {

     

       2
        
         inputs = {

     

       3
       +
           nixpkgs.url = "github:nixos/nixpkgs/nixos-24.05";

     

       4
        
           nixos-mailserver.url = "github:RyanGibb/nixos-mailserver/fork-23.11";

     

       5
        
           eon.url = "github:RyanGibb/eon";

     

       6
        
           eon.inputs.nixpkgs.follows = "nixpkgs";

-1

modules/default.nix

···

       10
        
           ./gitea.nix

     

       11
        
           ./dns.nix

     

       12
        
           ./matrix/synapse.nix

     

       13
       -
           ./matrix/mautrix-signal.nix

     

       14
        
           ./matrix/mautrix-instagram.nix

     

       15
        
           ./matrix/mautrix-messenger.nix

     

       16
        
           ./turn.nix

···

       10
        
           ./gitea.nix

     

       11
        
           ./dns.nix

     

       12
        
           ./matrix/synapse.nix

     

       0
        
       
     

       13
        
           ./matrix/mautrix-instagram.nix

     

       14
        
           ./matrix/mautrix-messenger.nix

     

       15
        
           ./turn.nix

-197

modules/matrix/mautrix-signal.nix

···

       1
       -
       { lib, config, pkgs, ... }:

     

       2
       -
       let

     

       3
       -
         cfg = config.services.mautrix-signal;

     

       4
       -
         dataDir = "/var/lib/mautrix-signal";

     

       5
       -
         registrationFile = "${dataDir}/signal-registration.yaml";

     

       6
       -
         settingsFile = "${dataDir}/config.json";

     

       7
       -
         settingsFileUnsubstituted =

     

       8
       -
           settingsFormat.generate "mautrix-signal-config-unsubstituted.json"

     

       9
       -
           cfg.settings;

     

       10
       -
         settingsFormat = pkgs.formats.json { };

     

       11
       -
         appservicePort = 29328;

     

       12
       -
       

     

       13
       -
         mkDefaults = lib.mapAttrsRecursive (n: v: lib.mkDefault v);

     

       14
       -
         defaultConfig = {

     

       15
       -
           homeserver.address = "http://localhost:8448";

     

       16
       -
           signal = {

     

       17
       -
             socket_path = config.services.signald.socketPath;

     

       18
       -
             outgoing_attachment_dir = "/var/lib/signald/tmp";

     

       19
       -
           };

     

       20
       -
           appservice = {

     

       21
       -
             hostname = "[::]";

     

       22
       -
             port = appservicePort;

     

       23
       -
             database.type = "sqlite3";

     

       24
       -
             database.uri = "${dataDir}/mautrix-signal.db";

     

       25
       -
             id = "signal";

     

       26
       -
             bot.username = "signalbot";

     

       27
       -
             bot.displayname = "Signal Bridge Bot";

     

       28
       -
             as_token = "";

     

       29
       -
             hs_token = "";

     

       30
       -
           };

     

       31
       -
           bridge = {

     

       32
       -
             username_template = "signal_{{.}}";

     

       33
       -
             double_puppet_server_map = { };

     

       34
       -
             login_shared_secret_map = { };

     

       35
       -
             permissions."*" = "relay";

     

       36
       -
           };

     

       37
       -
           logging = {

     

       38
       -
             min_level = "info";

     

       39
       -
             writers = lib.singleton {

     

       40
       -
               type = "stdout";

     

       41
       -
               format = "pretty-colored";

     

       42
       -
               time_format = " ";

     

       43
       -
             };

     

       44
       -
           };

     

       45
       -
         };

     

       46
       -
       

     

       47
       -
       in {

     

       48
       -
         options.services.mautrix-signal = {

     

       49
       -
           enable = lib.mkEnableOption (lib.mdDoc

     

       50
       -
             "mautrix-signal, a puppeting/relaybot bridge between Matrix and Signal.");

     

       51
       -
       

     

       52
       -
           settings = lib.mkOption {

     

       53
       -
             type = settingsFormat.type;

     

       54
       -
             default = defaultConfig;

     

       55
       -
             description = lib.mdDoc ''

     

       56
       -
               {file}`config.yaml` configuration as a Nix attribute set.

     

       57
       -
               Configuration options should match those described in

     

       58
       -
               [example-config.yaml](https://github.com/mautrix/signal/blob/master/example-config.yaml).

     

       59
       -
             '';

     

       60
       -
             example = {

     

       61
       -
               appservice = {

     

       62
       -
                 database = {

     

       63
       -
                   type = "postgres";

     

       64
       -
                   uri = "postgresql:///mautrix_signal?host=/run/postgresql";

     

       65
       -
                 };

     

       66
       -
                 id = "signal";

     

       67
       -
                 ephemeral_events = false;

     

       68
       -
               };

     

       69
       -
               bridge = {

     

       70
       -
                 history_sync = { request_full_sync = true; };

     

       71
       -
                 private_chat_portal_meta = true;

     

       72
       -
                 mute_bridging = true;

     

       73
       -
                 encryption = {

     

       74
       -
                   allow = true;

     

       75
       -
                   default = true;

     

       76
       -
                   require = true;

     

       77
       -
                 };

     

       78
       -
                 provisioning = { shared_secret = "disable"; };

     

       79
       -
                 permissions = { "example.com" = "user"; };

     

       80
       -
               };

     

       81
       -
             };

     

       82
       -
           };

     

       83
       -
       

     

       84
       -
           serviceDependencies = lib.mkOption {

     

       85
       -
             type = with lib.types; listOf str;

     

       86
       -
             default = lib.optional config.services.matrix-synapse.enable

     

       87
       -
               config.services.matrix-synapse.serviceUnit;

     

       88
       -
             defaultText = lib.literalExpression ''

     

       89
       -
               optional config.services.matrix-synapse.enable config.services.matrix-synapse.serviceUnits

     

       90
       -
             '';

     

       91
       -
             description = lib.mdDoc ''

     

       92
       -
               List of Systemd services to require and wait for when starting the application service.

     

       93
       -
             '';

     

       94
       -
           };

     

       95
       -
         };

     

       96
       -
       

     

       97
       -
         config = lib.mkIf cfg.enable {

     

       98
       -
       

     

       99
       -
           services.signald.enable = true;

     

       100
       -
       

     

       101
       -
           users.users.mautrix-signal = {

     

       102
       -
             isSystemUser = true;

     

       103
       -
             group = "mautrix-signal";

     

       104
       -
             home = dataDir;

     

       105
       -
             description = "Mautrix-Signal bridge user";

     

       106
       -
           };

     

       107
       -
       

     

       108
       -
           users.groups.mautrix-signal = { };

     

       109
       -
       

     

       110
       -
           services.mautrix-signal.settings = lib.mkMerge (map mkDefaults [

     

       111
       -
             defaultConfig

     

       112
       -
             # Note: this is defined here to avoid the docs depending on `config`

     

       113
       -
             {

     

       114
       -
               homeserver.domain = config.services.matrix-synapse.settings.server_name;

     

       115
       -
             }

     

       116
       -
           ]);

     

       117
       -
       

     

       118
       -
           systemd.services.mautrix-signal = {

     

       119
       -
             description = "Mautrix-Signal Service - A Signal bridge for Matrix";

     

       120
       -
       

     

       121
       -
             requires = [ "signald.service" ];

     

       122
       -
             # voice messages need `ffmpeg`

     

       123
       -
             path = [ pkgs.ffmpeg ];

     

       124
       -
       

     

       125
       -
             wantedBy = [ "multi-user.target" ];

     

       126
       -
             wants = [ "network-online.target" ] ++ cfg.serviceDependencies;

     

       127
       -
             after = [ "network-online.target" "signald.service" ]

     

       128
       -
               ++ cfg.serviceDependencies;

     

       129
       -
       

     

       130
       -
             preStart = ''

     

       131
       -
               # substitute the settings file by environment variables

     

       132
       -
               # in this case read from EnvironmentFile

     

       133
       -
               test -f '${settingsFile}' && rm -f '${settingsFile}'

     

       134
       -
               old_umask=$(umask)

     

       135
       -
               umask 0177

     

       136
       -
               ${pkgs.envsubst}/bin/envsubst \

     

       137
       -
                 -o '${settingsFile}' \

     

       138
       -
                 -i '${settingsFileUnsubstituted}'

     

       139
       -
               umask $old_umask

     

       140
       -
       

     

       141
       -
               # generate the appservice's registration file if absent

     

       142
       -
               if [ ! -f '${registrationFile}' ]; then

     

       143
       -
                 ${pkgs.mautrix-signal}/bin/mautrix-signal \

     

       144
       -
                   --generate-registration \

     

       145
       -
                   --config='${settingsFile}' \

     

       146
       -
                   --registration='${registrationFile}'

     

       147
       -
               fi

     

       148
       -
               chmod 640 ${registrationFile}

     

       149
       -
       

     

       150
       -
               umask 0177

     

       151
       -
               ${pkgs.yq}/bin/yq -s '.[0].appservice.as_token = .[1].as_token

     

       152
       -
                 | .[0].appservice.hs_token = .[1].hs_token

     

       153
       -
                 | .[0]' '${settingsFile}' '${registrationFile}' \

     

       154
       -
                 > '${settingsFile}.tmp'

     

       155
       -
               mv '${settingsFile}.tmp' '${settingsFile}'

     

       156
       -
               umask $old_umask

     

       157
       -
             '';

     

       158
       -
       

     

       159
       -
             serviceConfig = {

     

       160
       -
               SupplementaryGroups = [ "signald" ];

     

       161
       -
               User = "mautrix-signal";

     

       162
       -
               Group = "mautrix-signal";

     

       163
       -
               StateDirectory = baseNameOf dataDir;

     

       164
       -
               WorkingDirectory = dataDir;

     

       165
       -
               ExecStart = ''

     

       166
       -
                 ${pkgs.mautrix-signal}/bin/mautrix-signal \

     

       167
       -
                 --config='${settingsFile}' \

     

       168
       -
                 --registration='${registrationFile}'

     

       169
       -
               '';

     

       170
       -
               LockPersonality = true;

     

       171
       -
               MemoryDenyWriteExecute = true;

     

       172
       -
               NoNewPrivileges = true;

     

       173
       -
               PrivateDevices = true;

     

       174
       -
               PrivateTmp = true;

     

       175
       -
               PrivateUsers = true;

     

       176
       -
               ProtectClock = true;

     

       177
       -
               ProtectControlGroups = true;

     

       178
       -
               ProtectHome = true;

     

       179
       -
               ProtectHostname = true;

     

       180
       -
               ProtectKernelLogs = true;

     

       181
       -
               ProtectKernelModules = true;

     

       182
       -
               ProtectKernelTunables = true;

     

       183
       -
               ProtectSystem = "strict";

     

       184
       -
               Restart = "on-failure";

     

       185
       -
               RestartSec = "30s";

     

       186
       -
               RestrictRealtime = true;

     

       187
       -
               RestrictSUIDSGID = true;

     

       188
       -
               SystemCallArchitectures = "native";

     

       189
       -
               SystemCallErrorNumber = "EPERM";

     

       190
       -
               SystemCallFilter = [ "@system-service" ];

     

       191
       -
               Type = "simple";

     

       192
       -
               UMask = 27;

     

       193
       -
             };

     

       194
       -
             restartTriggers = [ settingsFileUnsubstituted ];

     

       195
       -
           };

     

       196
       -
         };

     

       197
       -
       }

+3 -4

modules/matrix/synapse.nix

···

       138
        
                 max_upload_size = "100M";

     

       139
        
                 app_service_config_files = (optional cfg.matrix.bridges.whatsapp

     

       140
        
                   "/var/lib/mautrix-whatsapp/whatsapp-registration.yaml")

     

       141
       -
                   ++ (optional cfg.matrix.bridges.signal

     

       142
       -
                     "/var/lib/mautrix-signal/signal-registration.yaml")

     

       143
        
                   ++ (optional cfg.matrix.bridges.instagram

     

       144
        
                     "/var/lib/mautrix-instagram/instagram-registration.yaml")

     

       145
        
                   ++ (optional cfg.matrix.bridges.messenger

     
···

       178
        
             [ "matrix-synapse-turn-shared-secret-generator.service" ];

     

       179
        
       

     

       180
        
           systemd.services.matrix-synapse.serviceConfig.SupplementaryGroups =

     

       0
        
       
     

       181
        
             (optional cfg.matrix.bridges.whatsapp

     

       182
        
               config.systemd.services.mautrix-whatsapp.serviceConfig.Group)

     

       183
       -
             ++ (optional cfg.matrix.bridges.signal

     

       184
       -
               config.systemd.services.mautrix-signal.serviceConfig.Group)

     

       185
        
             ++ (optional cfg.matrix.bridges.instagram

     

       186
        
               config.systemd.services.mautrix-instagram.serviceConfig.Group)

     

       187
        
             ++ (optional cfg.matrix.bridges.messenger

     
···

       199
        
             settings.bridge.permissions."@${config.eilean.username}:${config.networking.domain}" =

     

       200
        
               "admin";

     

       201
        
           };

     

       0
        
       
     

       202
        
           services.mautrix-signal = mkIf cfg.matrix.bridges.signal {

     

       203
        
             enable = true;

     

       204
        
             settings.homeserver.address =

     
···

       210
        
             settings.bridge.permissions."@${config.eilean.username}:${config.networking.domain}" =

     

       211
        
               "admin";

     

       212
        
           };

     

       0
        
       
     

       213
        
           services.mautrix-instagram = mkIf cfg.matrix.bridges.instagram {

     

       214
        
             enable = true;

     

       215
        
             settings.homeserver.address =

···

       138
        
                 max_upload_size = "100M";

     

       139
        
                 app_service_config_files = (optional cfg.matrix.bridges.whatsapp

     

       140
        
                   "/var/lib/mautrix-whatsapp/whatsapp-registration.yaml")

     

       0
        
       
     

       0
        
       
     

       141
        
                   ++ (optional cfg.matrix.bridges.instagram

     

       142
        
                     "/var/lib/mautrix-instagram/instagram-registration.yaml")

     

       143
        
                   ++ (optional cfg.matrix.bridges.messenger

     
···

       176
        
             [ "matrix-synapse-turn-shared-secret-generator.service" ];

     

       177
        
       

     

       178
        
           systemd.services.matrix-synapse.serviceConfig.SupplementaryGroups =

     

       179
       +
             # remove after https://github.com/NixOS/nixpkgs/pull/311681/files

     

       180
        
             (optional cfg.matrix.bridges.whatsapp

     

       181
        
               config.systemd.services.mautrix-whatsapp.serviceConfig.Group)

     

       0
        
       
     

       0
        
       
     

       182
        
             ++ (optional cfg.matrix.bridges.instagram

     

       183
        
               config.systemd.services.mautrix-instagram.serviceConfig.Group)

     

       184
        
             ++ (optional cfg.matrix.bridges.messenger

     
···

       196
        
             settings.bridge.permissions."@${config.eilean.username}:${config.networking.domain}" =

     

       197
        
               "admin";

     

       198
        
           };

     

       199
       +
           # using https://github.com/NixOS/nixpkgs/pull/277368

     

       200
        
           services.mautrix-signal = mkIf cfg.matrix.bridges.signal {

     

       201
        
             enable = true;

     

       202
        
             settings.homeserver.address =

     
···

       208
        
             settings.bridge.permissions."@${config.eilean.username}:${config.networking.domain}" =

     

       209
        
               "admin";

     

       210
        
           };

     

       211
       +
           # TODO replace with upstreamed mautrix-meta

     

       212
        
           services.mautrix-instagram = mkIf cfg.matrix.bridges.instagram {

     

       213
        
             enable = true;

     

       214
        
             settings.homeserver.address =