changes
This commit is contained in:
484
hosts/fw.cloonar.com/modules/web/matrix.nix
Normal file
484
hosts/fw.cloonar.com/modules/web/matrix.nix
Normal file
@@ -0,0 +1,484 @@
|
||||
{ pkgs, lib, config, ... }:
|
||||
let
|
||||
hostname = "matrix";
|
||||
fqdn = "${hostname}.cloonar.com";
|
||||
baseUrl = "https://matrix.cloonar.com";
|
||||
clientConfig."m.homeserver".base_url = baseUrl;
|
||||
serverConfig."m.server" = "${fqdn}:443";
|
||||
mkWellKnown = data: ''
|
||||
default_type application/json;
|
||||
add_header Access-Control-Allow-Origin *;
|
||||
return 200 '${builtins.toJSON data}';
|
||||
'';
|
||||
in {
|
||||
sops.secrets.matrix-shared-secret = {
|
||||
};
|
||||
sops.secrets.dendrite-private-key = {
|
||||
};
|
||||
|
||||
services.postgresql = {
|
||||
enable = true;
|
||||
ensureDatabases = [ "dendrite" ];
|
||||
ensureUsers = [
|
||||
{
|
||||
name = "dendrite";
|
||||
}
|
||||
];
|
||||
};
|
||||
services.postgresqlBackup.enable = true;
|
||||
services.postgresqlBackup.databases = [ "dendrite" ];
|
||||
|
||||
services.nginx.virtualHosts."${fqdn}" = {
|
||||
forceSSL = true;
|
||||
enableACME = true;
|
||||
acmeRoot = null;
|
||||
locations."/".extraConfig = ''
|
||||
return 404;
|
||||
'';
|
||||
locations."/_dendrite".proxyPass = "http://[::1]:8008";
|
||||
locations."/_matrix".proxyPass = "http://[::1]:8008";
|
||||
locations."/_synapse/client".proxyPass = "http://[::1]:8008";
|
||||
};
|
||||
|
||||
|
||||
services.dendrite = {
|
||||
enable = true;
|
||||
settings = {
|
||||
global = {
|
||||
server_name = "cloonar.com";
|
||||
private_key = "$CREDENTIALS_DIRECTORY/private_key";
|
||||
database.connection_string = "postgresql:///dendrite?host=/run/postgresql";
|
||||
};
|
||||
client_api.registration_shared_secret = "$REGISTRATION_SHARED_SECRET";
|
||||
app_service_api.config_files = [
|
||||
"$CREDENTIALS_DIRECTORY/whatsapp_registration"
|
||||
"$CREDENTIALS_DIRECTORY/signal_registration"
|
||||
"$CREDENTIALS_DIRECTORY/discord_registration"
|
||||
];
|
||||
app_service_api.database.connection_string = "";
|
||||
federation_api.database.connection_string = "";
|
||||
key_server.database.connection_string = "";
|
||||
relay_api.database.connection_string = "";
|
||||
media_api.database.connection_string = "";
|
||||
room_server.database.connection_string = "";
|
||||
sync_api.database.connection_string = "";
|
||||
user_api.account_database.connection_string = "";
|
||||
user_api.device_database.connection_string = "";
|
||||
mscs.database.connection_string = "";
|
||||
};
|
||||
loadCredential = [
|
||||
"private_key:${config.sops.secrets.dendrite-private-key.path}"
|
||||
"whatsapp_registration:/var/lib/mautrix-whatsapp/whatsapp-registration.yaml"
|
||||
"signal_registration:/var/lib/mautrix-signal/signal-registration.yaml"
|
||||
"discord_registration:/var/lib/mautrix-discord/discord-registration.yaml"
|
||||
];
|
||||
environmentFile = config.sops.secrets.matrix-shared-secret.path;
|
||||
};
|
||||
|
||||
users.users.mautrix-whatsapp = {
|
||||
isSystemUser = true;
|
||||
group = "mautrix-whatsapp";
|
||||
home = "/var/lib/mautrix-whatsapp";
|
||||
description = "Mautrix-WhatsApp bridge user";
|
||||
};
|
||||
|
||||
users.groups.mautrix-whatsapp = {};
|
||||
systemd.services.mautrix-whatsapp = let
|
||||
dataDir = "/var/lib/mautrix-whatsapp";
|
||||
registrationFile = "${dataDir}/whatsapp-registration.yaml";
|
||||
settingsFile = "${dataDir}/config.json";
|
||||
settingsFileUnsubstituted = settingsFormat.generate "mautrix-whatsapp-config-unsubstituted.json" defaultConfig;
|
||||
settingsFormat = pkgs.formats.json {};
|
||||
appservicePort = 29318;
|
||||
defaultConfig = {
|
||||
homeserver = {
|
||||
address = "http://[::1]:8008";
|
||||
domain = "cloonar.com";
|
||||
};
|
||||
appservice = {
|
||||
hostname = "[::]";
|
||||
port = appservicePort;
|
||||
database.type = "sqlite3";
|
||||
database.uri = "${dataDir}/mautrix-whatsapp.db";
|
||||
id = "whatsapp";
|
||||
bot.username = "whatsappbot";
|
||||
bot.displayname = "WhatsApp Bridge Bot";
|
||||
as_token = "";
|
||||
hs_token = "";
|
||||
};
|
||||
bridge = {
|
||||
username_template = "whatsapp_{{.}}";
|
||||
displayname_template = "{{if .BusinessName}}{{.BusinessName}}{{else if .PushName}}{{.PushName}}{{else}}{{.JID}}{{end}} (WA)";
|
||||
double_puppet_server_map = {};
|
||||
login_shared_secret_map = {};
|
||||
command_prefix = "!wa";
|
||||
permissions."*" = "relay";
|
||||
permissions."cloonar.com" = "user";
|
||||
relay.enabled = true;
|
||||
history_sync.request_full_sync = false;
|
||||
encryption = {
|
||||
allow = true;
|
||||
default = true;
|
||||
require = true;
|
||||
};
|
||||
};
|
||||
logging = {
|
||||
min_level = "info";
|
||||
writers = lib.singleton {
|
||||
type = "stdout";
|
||||
format = "pretty-colored";
|
||||
time_format = " ";
|
||||
};
|
||||
};
|
||||
};
|
||||
in {
|
||||
description = "Mautrix-WhatsApp Service - A WhatsApp bridge for Matrix";
|
||||
|
||||
wantedBy = ["multi-user.target"];
|
||||
wants = ["network-online.target"];
|
||||
after = ["network-online.target"];
|
||||
|
||||
preStart = ''
|
||||
test -f '${settingsFile}' && rm -f '${settingsFile}'
|
||||
old_umask=$(umask)
|
||||
umask 0177
|
||||
${pkgs.envsubst}/bin/envsubst \
|
||||
-o '${settingsFile}' \
|
||||
-i '${settingsFileUnsubstituted}'
|
||||
umask $old_umask
|
||||
|
||||
# generate the appservice's registration file if absent
|
||||
if [ ! -f '${registrationFile}' ]; then
|
||||
${pkgs.mautrix-whatsapp}/bin/mautrix-whatsapp \
|
||||
--generate-registration \
|
||||
--config='${settingsFile}' \
|
||||
--registration='${registrationFile}'
|
||||
fi
|
||||
chmod 640 ${registrationFile}
|
||||
|
||||
umask 0177
|
||||
${pkgs.yq}/bin/yq -s '.[0].appservice.as_token = .[1].as_token
|
||||
| .[0].appservice.hs_token = .[1].hs_token
|
||||
| .[0]' '${settingsFile}' '${registrationFile}' \
|
||||
> '${settingsFile}.tmp'
|
||||
mv '${settingsFile}.tmp' '${settingsFile}'
|
||||
umask $old_umask
|
||||
'';
|
||||
|
||||
serviceConfig = {
|
||||
User = "mautrix-whatsapp";
|
||||
Group = "mautrix-whatsapp";
|
||||
# EnvironmentFile = cfg.environmentFile;
|
||||
StateDirectory = baseNameOf dataDir;
|
||||
WorkingDirectory = dataDir;
|
||||
ExecStart = ''
|
||||
${pkgs.mautrix-whatsapp}/bin/mautrix-whatsapp \
|
||||
--config='${settingsFile}' \
|
||||
--registration='${registrationFile}' \
|
||||
--ignore-unsupported-server
|
||||
'';
|
||||
LockPersonality = true;
|
||||
MemoryDenyWriteExecute = true;
|
||||
NoNewPrivileges = true;
|
||||
PrivateDevices = true;
|
||||
PrivateTmp = true;
|
||||
PrivateUsers = true;
|
||||
ProtectClock = true;
|
||||
ProtectControlGroups = true;
|
||||
ProtectHome = true;
|
||||
ProtectHostname = true;
|
||||
ProtectKernelLogs = true;
|
||||
ProtectKernelModules = true;
|
||||
ProtectKernelTunables = true;
|
||||
ProtectSystem = "strict";
|
||||
Restart = "on-failure";
|
||||
RestartSec = "30s";
|
||||
RestrictRealtime = true;
|
||||
RestrictSUIDSGID = true;
|
||||
SystemCallArchitectures = "native";
|
||||
SystemCallErrorNumber = "EPERM";
|
||||
SystemCallFilter = ["@system-service"];
|
||||
Type = "simple";
|
||||
UMask = 0027;
|
||||
};
|
||||
restartTriggers = [settingsFileUnsubstituted];
|
||||
};
|
||||
|
||||
users.users.mautrix-signal = {
|
||||
isSystemUser = true;
|
||||
group = "mautrix-signal";
|
||||
home = "/var/lib/mautrix-signal";
|
||||
description = "Mautrix-Signal bridge user";
|
||||
};
|
||||
|
||||
users.groups.mautrix-signal = {};
|
||||
systemd.services.mautrix-signal = let
|
||||
pkgswithsignal = import (fetchTarball "https://github.com/NixOS/nixpkgs/archive/fd698a4ab779fb7fb95425f1b56974ba9c2fa16c.tar.gz") {
|
||||
config = {
|
||||
permittedInsecurePackages = [
|
||||
# needed for matrix
|
||||
"olm-3.2.16"
|
||||
];
|
||||
};
|
||||
};
|
||||
dataDir = "/var/lib/mautrix-signal";
|
||||
registrationFile = "${dataDir}/signal-registration.yaml";
|
||||
settingsFile = "${dataDir}/config.json";
|
||||
settingsFileUnsubstituted = settingsFormat.generate "mautrix-signal-config-unsubstituted.json" defaultConfig;
|
||||
settingsFormat = pkgs.formats.json {};
|
||||
appservicePort = 29328;
|
||||
defaultConfig = {
|
||||
homeserver = {
|
||||
address = "http://[::1]:8008";
|
||||
domain = "cloonar.com";
|
||||
};
|
||||
appservice = {
|
||||
hostname = "[::]";
|
||||
port = appservicePort;
|
||||
database.type = "sqlite3";
|
||||
database.uri = "file:${dataDir}/mautrix-signal.db?_txlock=immediate";
|
||||
id = "signal";
|
||||
bot = {
|
||||
username = "signalbot";
|
||||
displayname = "Signal Bridge Bot";
|
||||
};
|
||||
as_token = "";
|
||||
hs_token = "";
|
||||
};
|
||||
bridge = {
|
||||
username_template = "signal_{{.}}";
|
||||
displayname_template = "{{or .ProfileName .PhoneNumber \"Unknown user\"}}";
|
||||
double_puppet_server_map = { };
|
||||
login_shared_secret_map = { };
|
||||
command_prefix = "!signal";
|
||||
permissions."*" = "relay";
|
||||
permissions."cloonar.com" = "user";
|
||||
relay.enabled = true;
|
||||
encryption = {
|
||||
allow = true;
|
||||
default = true;
|
||||
require = true;
|
||||
};
|
||||
};
|
||||
logging = {
|
||||
min_level = "info";
|
||||
writers = lib.singleton {
|
||||
type = "stdout";
|
||||
format = "pretty-colored";
|
||||
time_format = " ";
|
||||
};
|
||||
};
|
||||
};
|
||||
in {
|
||||
description = "Mautrix-Signal Service - A Signal bridge for Matrix";
|
||||
|
||||
wantedBy = ["multi-user.target"];
|
||||
wants = ["network-online.target"];
|
||||
after = ["network-online.target"];
|
||||
|
||||
preStart = ''
|
||||
test -f '${settingsFile}' && rm -f '${settingsFile}'
|
||||
old_umask=$(umask)
|
||||
umask 0177
|
||||
${pkgs.envsubst}/bin/envsubst \
|
||||
-o '${settingsFile}' \
|
||||
-i '${settingsFileUnsubstituted}'
|
||||
umask $old_umask
|
||||
|
||||
# generate the appservice's registration file if absent
|
||||
if [ ! -f '${registrationFile}' ]; then
|
||||
${pkgswithsignal.mautrix-signal}/bin/mautrix-signal \
|
||||
--generate-registration \
|
||||
--config='${settingsFile}' \
|
||||
--registration='${registrationFile}'
|
||||
fi
|
||||
chmod 640 ${registrationFile}
|
||||
|
||||
umask 0177
|
||||
${pkgs.yq}/bin/yq -s '.[0].appservice.as_token = .[1].as_token
|
||||
| .[0].appservice.hs_token = .[1].hs_token
|
||||
| .[0]
|
||||
| if env.MAUTRIX_SIGNAL_BRIDGE_LOGIN_SHARED_SECRET then .bridge.login_shared_secret_map.[.homeserver.domain] = env.MAUTRIX_SIGNAL_BRIDGE_LOGIN_SHARED_SECRET else . end' \
|
||||
'${settingsFile}' '${registrationFile}' > '${settingsFile}.tmp'
|
||||
mv '${settingsFile}.tmp' '${settingsFile}'
|
||||
umask $old_umask
|
||||
'';
|
||||
|
||||
serviceConfig = {
|
||||
User = "mautrix-signal";
|
||||
Group = "mautrix-signal";
|
||||
# EnvironmentFile = cfg.environmentFile;
|
||||
StateDirectory = baseNameOf dataDir;
|
||||
WorkingDirectory = dataDir;
|
||||
ExecStart = ''
|
||||
${pkgswithsignal.mautrix-signal}/bin/mautrix-signal \
|
||||
--config='${settingsFile}' \
|
||||
--registration='${registrationFile}' \
|
||||
--ignore-unsupported-server
|
||||
'';
|
||||
LockPersonality = true;
|
||||
MemoryDenyWriteExecute = true;
|
||||
NoNewPrivileges = true;
|
||||
PrivateDevices = true;
|
||||
PrivateTmp = true;
|
||||
PrivateUsers = true;
|
||||
ProtectClock = true;
|
||||
ProtectControlGroups = true;
|
||||
ProtectHome = true;
|
||||
ProtectHostname = true;
|
||||
ProtectKernelLogs = true;
|
||||
ProtectKernelModules = true;
|
||||
ProtectKernelTunables = true;
|
||||
ProtectSystem = "strict";
|
||||
Restart = "on-failure";
|
||||
RestartSec = "30s";
|
||||
RestrictRealtime = true;
|
||||
RestrictSUIDSGID = true;
|
||||
SystemCallArchitectures = "native";
|
||||
SystemCallErrorNumber = "EPERM";
|
||||
SystemCallFilter = ["@system-service"];
|
||||
Type = "simple";
|
||||
UMask = 0027;
|
||||
};
|
||||
restartTriggers = [settingsFileUnsubstituted];
|
||||
};
|
||||
|
||||
|
||||
users.users.mautrix-discord = {
|
||||
isSystemUser = true;
|
||||
group = "mautrix-discord";
|
||||
home = "/var/lib/mautrix-discord";
|
||||
description = "Mautrix-Discord bridge user";
|
||||
};
|
||||
|
||||
users.groups.mautrix-discord = {};
|
||||
systemd.services.mautrix-discord = let
|
||||
pkgswithdiscord = import (fetchTarball "https://github.com/NixOS/nixpkgs/archive/5ed627539ac84809c78b2dd6d26a5cebeb5ae269.tar.gz") {
|
||||
config = {
|
||||
permittedInsecurePackages = [
|
||||
# needed for matrix
|
||||
"olm-3.2.16"
|
||||
];
|
||||
};
|
||||
};
|
||||
dataDir = "/var/lib/mautrix-discord";
|
||||
registrationFile = "${dataDir}/discord-registration.yaml";
|
||||
settingsFile = "${dataDir}/config.json";
|
||||
settingsFileUnsubstituted = settingsFormat.generate "mautrix-discord-config-unsubstituted.json" defaultConfig;
|
||||
settingsFormat = pkgs.formats.json {};
|
||||
appservicePort = 29329;
|
||||
defaultConfig = {
|
||||
homeserver = {
|
||||
address = "http://[::1]:8008";
|
||||
domain = "cloonar.com";
|
||||
};
|
||||
appservice = {
|
||||
hostname = "[::]";
|
||||
port = appservicePort;
|
||||
database.type = "sqlite3";
|
||||
database.uri = "file:${dataDir}/mautrix-discord.db?_txlock=immediate";
|
||||
id = "discord";
|
||||
bot = {
|
||||
username = "discordbot";
|
||||
displayname = "Discord Bridge Bot";
|
||||
};
|
||||
as_token = "";
|
||||
hs_token = "";
|
||||
};
|
||||
bridge = {
|
||||
username_template = "discord_{{.}}";
|
||||
displayname_template = "{{or .ProfileName .PhoneNumber \"Unknown user\"}}";
|
||||
double_puppet_server_map = { };
|
||||
login_shared_secret_map = { };
|
||||
command_prefix = "!discord";
|
||||
permissions."*" = "relay";
|
||||
permissions."cloonar.com" = "user";
|
||||
relay.enabled = true;
|
||||
encryption = {
|
||||
allow = true;
|
||||
default = true;
|
||||
require = true;
|
||||
};
|
||||
};
|
||||
logging = {
|
||||
min_level = "info";
|
||||
writers = lib.singleton {
|
||||
type = "stdout";
|
||||
format = "pretty-colored";
|
||||
time_format = " ";
|
||||
};
|
||||
};
|
||||
};
|
||||
in {
|
||||
description = "Mautrix-Discord Service - A Discord bridge for Matrix";
|
||||
|
||||
wantedBy = ["multi-user.target"];
|
||||
wants = ["network-online.target"];
|
||||
after = ["network-online.target"];
|
||||
|
||||
preStart = ''
|
||||
test -f '${settingsFile}' && rm -f '${settingsFile}'
|
||||
old_umask=$(umask)
|
||||
umask 0177
|
||||
${pkgs.envsubst}/bin/envsubst \
|
||||
-o '${settingsFile}' \
|
||||
-i '${settingsFileUnsubstituted}'
|
||||
umask $old_umask
|
||||
|
||||
# generate the appservice's registration file if absent
|
||||
if [ ! -f '${registrationFile}' ]; then
|
||||
${pkgswithdiscord.mautrix-discord}/bin/mautrix-discord \
|
||||
--generate-registration \
|
||||
--config='${settingsFile}' \
|
||||
--registration='${registrationFile}'
|
||||
fi
|
||||
chmod 640 ${registrationFile}
|
||||
|
||||
umask 0177
|
||||
${pkgs.yq}/bin/yq -s '.[0].appservice.as_token = .[1].as_token
|
||||
| .[0].appservice.hs_token = .[1].hs_token
|
||||
| .[0]
|
||||
| if env.MAUTRIX_DISCORD_BRIDGE_LOGIN_SHARED_SECRET then .bridge.login_shared_secret_map.[.homeserver.domain] = env.MAUTRIX_DISCORD_BRIDGE_LOGIN_SHARED_SECRET else . end' \
|
||||
'${settingsFile}' '${registrationFile}' > '${settingsFile}.tmp'
|
||||
mv '${settingsFile}.tmp' '${settingsFile}'
|
||||
umask $old_umask
|
||||
'';
|
||||
|
||||
serviceConfig = {
|
||||
User = "mautrix-discord";
|
||||
Group = "mautrix-discord";
|
||||
# EnvironmentFile = cfg.environmentFile;
|
||||
StateDirectory = baseNameOf dataDir;
|
||||
WorkingDirectory = dataDir;
|
||||
ExecStart = ''
|
||||
${pkgswithdiscord.mautrix-discord}/bin/mautrix-discord \
|
||||
--config='${settingsFile}' \
|
||||
--registration='${registrationFile}'
|
||||
'';
|
||||
LockPersonality = true;
|
||||
MemoryDenyWriteExecute = true;
|
||||
NoNewPrivileges = true;
|
||||
PrivateDevices = true;
|
||||
PrivateTmp = true;
|
||||
PrivateUsers = true;
|
||||
ProtectClock = true;
|
||||
ProtectControlGroups = true;
|
||||
ProtectHome = true;
|
||||
ProtectHostname = true;
|
||||
ProtectKernelLogs = true;
|
||||
ProtectKernelModules = true;
|
||||
ProtectKernelTunables = true;
|
||||
ProtectSystem = "strict";
|
||||
Restart = "on-failure";
|
||||
RestartSec = "30s";
|
||||
RestrictRealtime = true;
|
||||
RestrictSUIDSGID = true;
|
||||
SystemCallArchitectures = "native";
|
||||
SystemCallErrorNumber = "EPERM";
|
||||
SystemCallFilter = ["@system-service"];
|
||||
Type = "simple";
|
||||
UMask = 0027;
|
||||
};
|
||||
restartTriggers = [settingsFileUnsubstituted];
|
||||
};
|
||||
}
|
||||
Reference in New Issue
Block a user