549 lines
17 KiB
Nix
549 lines
17 KiB
Nix
{ pkgs, lib, config, ... }:
|
|
let
|
|
hostname = "matrix";
|
|
fqdn = "${hostname}.cloonar.com";
|
|
baseUrl = "https://${fqdn}";
|
|
clientConfig."m.homeserver".base_url = baseUrl;
|
|
serverConfig."m.server" = "${fqdn}:443";
|
|
mkWellKnown = data: ''
|
|
default_type application/json;
|
|
add_header Access-Control-Allow-Origin *;
|
|
return 200 '${builtins.toJSON data}';
|
|
'';
|
|
|
|
# Shared settings format for bridges
|
|
settingsFormat = pkgs.formats.json {};
|
|
in {
|
|
# Secrets for Synapse
|
|
sops.secrets.synapse-oidc-client-secret = {
|
|
owner = "matrix-synapse";
|
|
};
|
|
|
|
# PostgreSQL database for Synapse
|
|
services.postgresql = {
|
|
enable = true;
|
|
ensureDatabases = [ "matrix-synapse" ];
|
|
ensureUsers = [
|
|
{
|
|
name = "matrix-synapse";
|
|
ensureDBOwnership = true;
|
|
}
|
|
];
|
|
};
|
|
|
|
services.postgresqlBackup.enable = true;
|
|
services.postgresqlBackup.databases = [ "matrix-synapse" ];
|
|
|
|
# Synapse homeserver
|
|
services.matrix-synapse = {
|
|
enable = true;
|
|
settings = {
|
|
server_name = "cloonar.com";
|
|
public_baseurl = baseUrl;
|
|
|
|
listeners = [
|
|
{
|
|
port = 8008;
|
|
bind_addresses = [ "::1" ];
|
|
type = "http";
|
|
tls = false;
|
|
x_forwarded = true;
|
|
resources = [
|
|
{
|
|
compress = true;
|
|
names = [ "client" "federation" ];
|
|
}
|
|
];
|
|
}
|
|
];
|
|
|
|
database = {
|
|
name = "psycopg2";
|
|
args = {
|
|
host = "/run/postgresql";
|
|
database = "matrix-synapse";
|
|
user = "matrix-synapse";
|
|
};
|
|
};
|
|
|
|
# Disable registration - users created via OIDC
|
|
enable_registration = false;
|
|
allow_guest_access = false;
|
|
|
|
# OIDC SSO via Authelia
|
|
oidc_providers = [
|
|
{
|
|
idp_id = "authelia";
|
|
idp_name = "Authelia";
|
|
discover = true;
|
|
issuer = "https://auth.cloonar.com";
|
|
user_profile_method = "userinfo_endpoint";
|
|
client_id = "synapse";
|
|
client_secret_path = config.sops.secrets.synapse-oidc-client-secret.path;
|
|
scopes = [ "openid" "profile" "email" ];
|
|
allow_existing_users = true;
|
|
user_mapping_provider.config = {
|
|
subject_claim = "sub";
|
|
localpart_template = "{{ user.preferred_username }}";
|
|
display_name_template = "{{ user.name }}";
|
|
email_template = "{{ user.email }}";
|
|
};
|
|
}
|
|
];
|
|
|
|
# Appservice registrations for bridges
|
|
app_service_config_files = [
|
|
"/var/lib/mautrix-whatsapp/whatsapp-registration.yaml"
|
|
"/var/lib/mautrix-signal/signal-registration.yaml"
|
|
"/var/lib/mautrix-discord/discord-registration.yaml"
|
|
];
|
|
};
|
|
};
|
|
|
|
# Allow bridge users to read registration files
|
|
systemd.services.matrix-synapse.serviceConfig.SupplementaryGroups = [
|
|
"mautrix-whatsapp"
|
|
"mautrix-signal"
|
|
"mautrix-discord"
|
|
];
|
|
|
|
# Element Web client
|
|
services.nginx.virtualHosts."element.cloonar.com" = {
|
|
forceSSL = true;
|
|
enableACME = true;
|
|
acmeRoot = null;
|
|
root = pkgs.element-web.override {
|
|
conf = {
|
|
default_theme = "dark";
|
|
default_server_config = {
|
|
"m.homeserver" = {
|
|
base_url = "https://matrix.cloonar.com";
|
|
server_name = "cloonar.com";
|
|
};
|
|
};
|
|
disable_custom_urls = true;
|
|
disable_3pid_login = true;
|
|
default_country_code = "AT";
|
|
};
|
|
};
|
|
};
|
|
|
|
# Synapse nginx reverse proxy
|
|
services.nginx.virtualHosts."${fqdn}" = {
|
|
forceSSL = true;
|
|
enableACME = true;
|
|
acmeRoot = null;
|
|
locations."/".extraConfig = ''
|
|
return 404;
|
|
'';
|
|
locations."/_matrix".proxyPass = "http://[::1]:8008";
|
|
locations."/_synapse/client".proxyPass = "http://[::1]:8008";
|
|
};
|
|
|
|
#
|
|
# Mautrix bridges
|
|
#
|
|
|
|
# WhatsApp bridge
|
|
users.users.mautrix-whatsapp = {
|
|
isSystemUser = true;
|
|
group = "mautrix-whatsapp";
|
|
home = "/var/lib/mautrix-whatsapp";
|
|
description = "Mautrix-WhatsApp bridge user";
|
|
};
|
|
users.groups.mautrix-whatsapp = {};
|
|
|
|
systemd.services.mautrix-whatsapp = let
|
|
dataDir = "/var/lib/mautrix-whatsapp";
|
|
registrationFile = "${dataDir}/whatsapp-registration.yaml";
|
|
settingsFile = "${dataDir}/config.json";
|
|
settingsFileUnsubstituted = settingsFormat.generate "mautrix-whatsapp-config-unsubstituted.json" defaultConfig;
|
|
appservicePort = 29318;
|
|
defaultConfig = {
|
|
homeserver = {
|
|
address = "http://[::1]:8008";
|
|
domain = "cloonar.com";
|
|
};
|
|
appservice = {
|
|
hostname = "[::]";
|
|
port = appservicePort;
|
|
database.type = "sqlite3";
|
|
database.uri = "${dataDir}/mautrix-whatsapp.db";
|
|
id = "whatsapp";
|
|
bot.username = "whatsappbot";
|
|
bot.displayname = "WhatsApp Bridge Bot";
|
|
as_token = "";
|
|
hs_token = "";
|
|
};
|
|
bridge = {
|
|
username_template = "whatsapp_{{.}}";
|
|
displayname_template = "{{if .BusinessName}}{{.BusinessName}}{{else if .PushName}}{{.PushName}}{{else}}{{.JID}}{{end}} (WA)";
|
|
double_puppet_server_map = {};
|
|
login_shared_secret_map = {};
|
|
command_prefix = "!wa";
|
|
permissions."*" = "relay";
|
|
permissions."cloonar.com" = "user";
|
|
relay.enabled = true;
|
|
history_sync.request_full_sync = false;
|
|
encryption = {
|
|
allow = true;
|
|
default = true;
|
|
require = true;
|
|
};
|
|
};
|
|
logging = {
|
|
min_level = "info";
|
|
writers = lib.singleton {
|
|
type = "stdout";
|
|
format = "pretty-colored";
|
|
time_format = " ";
|
|
};
|
|
};
|
|
};
|
|
in {
|
|
description = "Mautrix-WhatsApp Service - A WhatsApp bridge for Matrix";
|
|
wantedBy = ["multi-user.target"];
|
|
wants = ["network-online.target" "matrix-synapse.service"];
|
|
after = ["network-online.target" "matrix-synapse.service"];
|
|
|
|
preStart = ''
|
|
test -f '${settingsFile}' && rm -f '${settingsFile}'
|
|
old_umask=$(umask)
|
|
umask 0177
|
|
${pkgs.envsubst}/bin/envsubst \
|
|
-o '${settingsFile}' \
|
|
-i '${settingsFileUnsubstituted}'
|
|
umask $old_umask
|
|
|
|
# generate the appservice's registration file if absent
|
|
if [ ! -f '${registrationFile}' ]; then
|
|
${pkgs.mautrix-whatsapp}/bin/mautrix-whatsapp \
|
|
--generate-registration \
|
|
--config='${settingsFile}' \
|
|
--registration='${registrationFile}'
|
|
fi
|
|
chmod 640 ${registrationFile}
|
|
|
|
umask 0177
|
|
${pkgs.yq}/bin/yq -s '.[0].appservice.as_token = .[1].as_token
|
|
| .[0].appservice.hs_token = .[1].hs_token
|
|
| .[0]' '${settingsFile}' '${registrationFile}' \
|
|
> '${settingsFile}.tmp'
|
|
mv '${settingsFile}.tmp' '${settingsFile}'
|
|
umask $old_umask
|
|
'';
|
|
|
|
serviceConfig = {
|
|
User = "mautrix-whatsapp";
|
|
Group = "mautrix-whatsapp";
|
|
StateDirectory = baseNameOf dataDir;
|
|
WorkingDirectory = dataDir;
|
|
ExecStart = ''
|
|
${pkgs.mautrix-whatsapp}/bin/mautrix-whatsapp \
|
|
--config='${settingsFile}' \
|
|
--registration='${registrationFile}' \
|
|
--ignore-unsupported-server
|
|
'';
|
|
LockPersonality = true;
|
|
MemoryDenyWriteExecute = true;
|
|
NoNewPrivileges = true;
|
|
PrivateDevices = true;
|
|
PrivateTmp = true;
|
|
PrivateUsers = true;
|
|
ProtectClock = true;
|
|
ProtectControlGroups = true;
|
|
ProtectHome = true;
|
|
ProtectHostname = true;
|
|
ProtectKernelLogs = true;
|
|
ProtectKernelModules = true;
|
|
ProtectKernelTunables = true;
|
|
ProtectSystem = "strict";
|
|
Restart = "on-failure";
|
|
RestartSec = "30s";
|
|
RestrictRealtime = true;
|
|
RestrictSUIDSGID = true;
|
|
SystemCallArchitectures = "native";
|
|
SystemCallErrorNumber = "EPERM";
|
|
SystemCallFilter = ["@system-service"];
|
|
Type = "simple";
|
|
UMask = 0027;
|
|
};
|
|
restartTriggers = [settingsFileUnsubstituted];
|
|
};
|
|
|
|
# Signal bridge
|
|
users.users.mautrix-signal = {
|
|
isSystemUser = true;
|
|
group = "mautrix-signal";
|
|
home = "/var/lib/mautrix-signal";
|
|
description = "Mautrix-Signal bridge user";
|
|
};
|
|
users.groups.mautrix-signal = {};
|
|
|
|
systemd.services.mautrix-signal = let
|
|
pkgswithsignal = import (fetchTarball "https://github.com/NixOS/nixpkgs/archive/fd698a4ab779fb7fb95425f1b56974ba9c2fa16c.tar.gz") {
|
|
config = {
|
|
permittedInsecurePackages = [
|
|
"olm-3.2.16"
|
|
];
|
|
};
|
|
};
|
|
dataDir = "/var/lib/mautrix-signal";
|
|
registrationFile = "${dataDir}/signal-registration.yaml";
|
|
settingsFile = "${dataDir}/config.json";
|
|
settingsFileUnsubstituted = settingsFormat.generate "mautrix-signal-config-unsubstituted.json" defaultConfig;
|
|
appservicePort = 29328;
|
|
defaultConfig = {
|
|
homeserver = {
|
|
address = "http://[::1]:8008";
|
|
domain = "cloonar.com";
|
|
};
|
|
appservice = {
|
|
hostname = "[::]";
|
|
port = appservicePort;
|
|
database.type = "sqlite3";
|
|
database.uri = "file:${dataDir}/mautrix-signal.db?_txlock=immediate";
|
|
id = "signal";
|
|
bot = {
|
|
username = "signalbot";
|
|
displayname = "Signal Bridge Bot";
|
|
};
|
|
as_token = "";
|
|
hs_token = "";
|
|
};
|
|
bridge = {
|
|
username_template = "signal_{{.}}";
|
|
displayname_template = "{{or .ProfileName .PhoneNumber \"Unknown user\"}} (Signal)";
|
|
double_puppet_server_map = { };
|
|
login_shared_secret_map = { };
|
|
command_prefix = "!signal";
|
|
permissions."*" = "relay";
|
|
permissions."cloonar.com" = "user";
|
|
relay.enabled = true;
|
|
encryption = {
|
|
allow = true;
|
|
default = true;
|
|
require = true;
|
|
};
|
|
};
|
|
matrix = {
|
|
sync_direct_chat_list = true;
|
|
};
|
|
logging = {
|
|
min_level = "info";
|
|
writers = lib.singleton {
|
|
type = "stdout";
|
|
format = "pretty-colored";
|
|
time_format = " ";
|
|
};
|
|
};
|
|
};
|
|
in {
|
|
description = "Mautrix-Signal Service - A Signal bridge for Matrix";
|
|
wantedBy = ["multi-user.target"];
|
|
wants = ["network-online.target" "matrix-synapse.service"];
|
|
after = ["network-online.target" "matrix-synapse.service"];
|
|
|
|
preStart = ''
|
|
test -f '${settingsFile}' && rm -f '${settingsFile}'
|
|
old_umask=$(umask)
|
|
umask 0177
|
|
${pkgs.envsubst}/bin/envsubst \
|
|
-o '${settingsFile}' \
|
|
-i '${settingsFileUnsubstituted}'
|
|
umask $old_umask
|
|
|
|
# generate the appservice's registration file if absent
|
|
if [ ! -f '${registrationFile}' ]; then
|
|
${pkgswithsignal.mautrix-signal}/bin/mautrix-signal \
|
|
--generate-registration \
|
|
--config='${settingsFile}' \
|
|
--registration='${registrationFile}'
|
|
fi
|
|
chmod 640 ${registrationFile}
|
|
|
|
umask 0177
|
|
${pkgs.yq}/bin/yq -s '.[0].appservice.as_token = .[1].as_token
|
|
| .[0].appservice.hs_token = .[1].hs_token
|
|
| .[0]
|
|
| if env.MAUTRIX_SIGNAL_BRIDGE_LOGIN_SHARED_SECRET then .bridge.login_shared_secret_map.[.homeserver.domain] = env.MAUTRIX_SIGNAL_BRIDGE_LOGIN_SHARED_SECRET else . end' \
|
|
'${settingsFile}' '${registrationFile}' > '${settingsFile}.tmp'
|
|
mv '${settingsFile}.tmp' '${settingsFile}'
|
|
umask $old_umask
|
|
'';
|
|
|
|
serviceConfig = {
|
|
User = "mautrix-signal";
|
|
Group = "mautrix-signal";
|
|
StateDirectory = baseNameOf dataDir;
|
|
WorkingDirectory = dataDir;
|
|
ExecStart = ''
|
|
${pkgswithsignal.mautrix-signal}/bin/mautrix-signal \
|
|
--config='${settingsFile}' \
|
|
--registration='${registrationFile}' \
|
|
--ignore-unsupported-server
|
|
'';
|
|
LockPersonality = true;
|
|
MemoryDenyWriteExecute = true;
|
|
NoNewPrivileges = true;
|
|
PrivateDevices = true;
|
|
PrivateTmp = true;
|
|
PrivateUsers = true;
|
|
ProtectClock = true;
|
|
ProtectControlGroups = true;
|
|
ProtectHome = true;
|
|
ProtectHostname = true;
|
|
ProtectKernelLogs = true;
|
|
ProtectKernelModules = true;
|
|
ProtectKernelTunables = true;
|
|
ProtectSystem = "strict";
|
|
Restart = "on-failure";
|
|
RestartSec = "30s";
|
|
RestrictRealtime = true;
|
|
RestrictSUIDSGID = true;
|
|
SystemCallArchitectures = "native";
|
|
SystemCallErrorNumber = "EPERM";
|
|
SystemCallFilter = ["@system-service"];
|
|
Type = "simple";
|
|
UMask = 0027;
|
|
};
|
|
restartTriggers = [settingsFileUnsubstituted];
|
|
};
|
|
|
|
# Discord bridge
|
|
users.users.mautrix-discord = {
|
|
isSystemUser = true;
|
|
group = "mautrix-discord";
|
|
home = "/var/lib/mautrix-discord";
|
|
description = "Mautrix-Discord bridge user";
|
|
};
|
|
users.groups.mautrix-discord = {};
|
|
|
|
systemd.services.mautrix-discord = let
|
|
pkgswithdiscord = import (fetchTarball "https://github.com/NixOS/nixpkgs/archive/5ed627539ac84809c78b2dd6d26a5cebeb5ae269.tar.gz") {
|
|
config = {
|
|
permittedInsecurePackages = [
|
|
"olm-3.2.16"
|
|
];
|
|
};
|
|
};
|
|
dataDir = "/var/lib/mautrix-discord";
|
|
registrationFile = "${dataDir}/discord-registration.yaml";
|
|
settingsFile = "${dataDir}/config.json";
|
|
settingsFileUnsubstituted = settingsFormat.generate "mautrix-discord-config-unsubstituted.json" defaultConfig;
|
|
appservicePort = 29329;
|
|
defaultConfig = {
|
|
homeserver = {
|
|
address = "http://[::1]:8008";
|
|
domain = "cloonar.com";
|
|
};
|
|
appservice = {
|
|
hostname = "[::]";
|
|
port = appservicePort;
|
|
database.type = "sqlite3";
|
|
database.uri = "file:${dataDir}/mautrix-discord.db?_txlock=immediate";
|
|
id = "discord";
|
|
bot = {
|
|
username = "discordbot";
|
|
displayname = "Discord Bridge Bot";
|
|
};
|
|
as_token = "";
|
|
hs_token = "";
|
|
};
|
|
bridge = {
|
|
username_template = "discord_{{.}}";
|
|
displayname_template = "{{or .GlobalName .Username}} (Discord{{if .Bot}} bot{{end}})";
|
|
double_puppet_server_map = { };
|
|
login_shared_secret_map = { };
|
|
command_prefix = "!discord";
|
|
permissions."*" = "relay";
|
|
permissions."cloonar.com" = "user";
|
|
relay.enabled = true;
|
|
restricted_rooms = false;
|
|
encryption = {
|
|
allow = true;
|
|
default = true;
|
|
require = true;
|
|
};
|
|
};
|
|
logging = {
|
|
min_level = "info";
|
|
writers = lib.singleton {
|
|
type = "stdout";
|
|
format = "pretty-colored";
|
|
time_format = " ";
|
|
};
|
|
};
|
|
};
|
|
in {
|
|
description = "Mautrix-Discord Service - A Discord bridge for Matrix";
|
|
wantedBy = ["multi-user.target"];
|
|
wants = ["network-online.target" "matrix-synapse.service"];
|
|
after = ["network-online.target" "matrix-synapse.service"];
|
|
|
|
preStart = ''
|
|
test -f '${settingsFile}' && rm -f '${settingsFile}'
|
|
old_umask=$(umask)
|
|
umask 0177
|
|
${pkgs.envsubst}/bin/envsubst \
|
|
-o '${settingsFile}' \
|
|
-i '${settingsFileUnsubstituted}'
|
|
umask $old_umask
|
|
|
|
# generate the appservice's registration file if absent
|
|
if [ ! -f '${registrationFile}' ]; then
|
|
${pkgswithdiscord.mautrix-discord}/bin/mautrix-discord \
|
|
--generate-registration \
|
|
--config='${settingsFile}' \
|
|
--registration='${registrationFile}'
|
|
fi
|
|
chmod 640 ${registrationFile}
|
|
|
|
umask 0177
|
|
${pkgs.yq}/bin/yq -s '.[0].appservice.as_token = .[1].as_token
|
|
| .[0].appservice.hs_token = .[1].hs_token
|
|
| .[0]
|
|
| if env.MAUTRIX_DISCORD_BRIDGE_LOGIN_SHARED_SECRET then .bridge.login_shared_secret_map.[.homeserver.domain] = env.MAUTRIX_DISCORD_BRIDGE_LOGIN_SHARED_SECRET else . end' \
|
|
'${settingsFile}' '${registrationFile}' > '${settingsFile}.tmp'
|
|
mv '${settingsFile}.tmp' '${settingsFile}'
|
|
umask $old_umask
|
|
'';
|
|
|
|
serviceConfig = {
|
|
User = "mautrix-discord";
|
|
Group = "mautrix-discord";
|
|
StateDirectory = baseNameOf dataDir;
|
|
WorkingDirectory = dataDir;
|
|
ExecStart = ''
|
|
${pkgswithdiscord.mautrix-discord}/bin/mautrix-discord \
|
|
--config='${settingsFile}' \
|
|
--registration='${registrationFile}'
|
|
'';
|
|
LockPersonality = true;
|
|
MemoryDenyWriteExecute = true;
|
|
NoNewPrivileges = true;
|
|
PrivateDevices = true;
|
|
PrivateTmp = true;
|
|
PrivateUsers = true;
|
|
ProtectClock = true;
|
|
ProtectControlGroups = true;
|
|
ProtectHome = true;
|
|
ProtectHostname = true;
|
|
ProtectKernelLogs = true;
|
|
ProtectKernelModules = true;
|
|
ProtectKernelTunables = true;
|
|
ProtectSystem = "strict";
|
|
Restart = "on-failure";
|
|
RestartSec = "30s";
|
|
RestrictRealtime = true;
|
|
RestrictSUIDSGID = true;
|
|
SystemCallArchitectures = "native";
|
|
SystemCallErrorNumber = "EPERM";
|
|
SystemCallFilter = ["@system-service"];
|
|
Type = "simple";
|
|
UMask = 0027;
|
|
};
|
|
restartTriggers = [settingsFileUnsubstituted];
|
|
};
|
|
|
|
}
|