diff options
Diffstat (limited to 'modules/services')
| -rw-r--r-- | modules/services/matrix-bridge/_mautrix-signal-module.nix | 204 | ||||
| -rw-r--r-- | modules/services/matrix-bridge/default.nix | 2 |
2 files changed, 0 insertions, 206 deletions
diff --git a/modules/services/matrix-bridge/_mautrix-signal-module.nix b/modules/services/matrix-bridge/_mautrix-signal-module.nix deleted file mode 100644 index 983d635..0000000 --- a/modules/services/matrix-bridge/_mautrix-signal-module.nix +++ /dev/null @@ -1,204 +0,0 @@ -{ config, pkgs, lib, ... }: - -with lib; - -let - dataDir = "/var/lib/mautrix-signal"; - registrationFile = "${dataDir}/signal-registration.yaml"; - cfg = config.services.mautrix-signal; - settingsFormat = pkgs.formats.json { }; - settingsFile = "${dataDir}/config.json"; - settingsFileUnsubstituted = - settingsFormat.generate "mautrix-signal-config.json" cfg.settings; - -in -{ - # NOTE(2024-01-11): Upstream has been moved to a Go version. - # Environment-based credential setting might not work. - options = { - services.mautrix-signal = { - enable = mkEnableOption (lib.mdDoc "Mautrix-Signal, a Matrix-Signal puppeting bridge."); - - package = mkOption { type = types.package; default = pkgs.mautrix-signal; }; - - settings = mkOption rec { - apply = recursiveUpdate default; - inherit (settingsFormat) type; - default = { - homeserver = { - software = "standard"; - }; - - appservice = rec { - database = "sqlite:///${dataDir}/mautrix-signal.db"; - database_opts = { }; - hostname = "localhost"; - port = 8080; - address = "http://localhost:${toString port}"; - }; - - signal.socket_path = config.services.signald.socketPath; - - bridge = { - permissions."*" = "relay"; - relay.whitelist = [ ]; - double_puppet_server_map = { }; - login_shared_secret_map = { }; - }; - - logging = { - min_level = "debug"; - writers = [ - { - type = "stdout"; - format = "pretty-colored"; - } - ]; - }; - }; - example = literalExpression '' - { - homeserver = { - address = "http://localhost:8008"; - domain = "public-domain.tld"; - }; - - appservice.public = { - prefix = "/public"; - external = "https://public-appservice-address/public"; - }; - - bridge.permissions = { - "example.com" = "full"; - "@admin:example.com" = "admin"; - }; - } - ''; - description = lib.mdDoc '' - {file}`config.yaml` configuration as a Nix attribute set. - Configuration options should match those described in - [example-config.yaml](https://github.com/mautrix/signal/blob/master/signal/example-config.yaml). - - Secret tokens should be specified using {option}`environmentFile` - instead of this world-readable attribute set. - ''; - }; - - environmentFile = mkOption { - type = types.nullOr types.path; - default = null; - description = lib.mdDoc '' - File containing environment variables to be passed to the mautrix-signal service, - in which secret tokens can be specified securely by defining values for e.g. - `MAUTRIX_SIGNAL_APPSERVICE_AS_TOKEN`, - `MAUTRIX_SIGNAL_APPSERVICE_HS_TOKEN`, - - These environment variables can also be used to set other options by - replacing hierarchy levels by `.`, converting the name to uppercase - and prepending `MAUTRIX_SIGNAL_`. - For example, the first value above maps to - {option}`settings.appservice.as_token`. - - The environment variable values can be prefixed with `json::` to have - them be parsed as JSON. For example, `login_shared_secret_map` can be - set as follows: - `MAUTRIX_SIGNAL_BRIDGE_LOGIN_SHARED_SECRET_MAP=json::{"example.com":"secret"}`. - ''; - }; - - serviceDependencies = mkOption { - type = with types; listOf str; - default = optional config.services.matrix-synapse.enable "matrix-synapse.service"; - defaultText = literalExpression '' - optional config.services.matrix-synapse.enable "matrix-synapse.service" - ''; - description = lib.mdDoc '' - List of Systemd services to require and wait for when starting the application service. - ''; - }; - }; - }; - - config = mkIf cfg.enable { - services.signald.enable = true; - - systemd.services.mautrix-signal = { - description = "Mautrix-Signal, a Matrix-Signal puppeting bridge."; - - wantedBy = [ "multi-user.target" ]; - wants = [ "network-online.target" ] ++ cfg.serviceDependencies; - after = [ "network-online.target" ] ++ cfg.serviceDependencies; - path = [ pkgs.lottieconverter pkgs.ffmpeg-full ]; - - # TODO(2023-01-11): Still relevant in Go version? - # mautrix-signal tries to generate a dotfile in the home directory of - # the running user if using a postgresql database: - # - # File "python3.10/site-packages/asyncpg/connect_utils.py", line 257, in _dot_postgre> - # return (pathlib.Path.home() / '.postgresql' / filename).resolve() - # File "python3.10/pathlib.py", line 1000, in home - # return cls("~").expanduser() - # File "python3.10/pathlib.py", line 1440, in expanduser - # raise RuntimeError("Could not determine home directory.") - # RuntimeError: Could not determine home directory. - environment.HOME = dataDir; - - preStart = '' - # substitute the settings file by environment variables - # in this case read from EnvironmentFile - test -f '${settingsFile}' && rm -f '${settingsFile}' - old_umask=$(umask) - umask 0177 - ${pkgs.envsubst}/bin/envsubst \ - -o '${settingsFile}' \ - -i '${settingsFileUnsubstituted}' \ - umask $old_umask - - # generate the appservice's registration file if absent - if [ ! -f '${registrationFile}' ]; then - ${cfg.package}/bin/mautrix-signal \ - --generate-registration \ - --config='${settingsFile}' \ - --registration='${registrationFile}' - fi - chmod 640 ${registrationFile} - - umask 0177 - ${pkgs.yq}/bin/yq -s '.[0].appservice.as_token = .[1].as_token - | .[0].appservice.hs_token = .[1].hs_token - | .[0]' '${settingsFile}' '${registrationFile}' \ - > '${settingsFile}.tmp' - mv '${settingsFile}.tmp' '${settingsFile}' - umask $old_umask - ''; - - serviceConfig = { - Type = "simple"; - Restart = "always"; - - ProtectSystem = "strict"; - ProtectHome = true; - ProtectKernelTunables = true; - ProtectKernelModules = true; - ProtectControlGroups = true; - - DynamicUser = true; - SupplementaryGroups = [ "signald" ]; - PrivateTmp = true; - WorkingDirectory = cfg.package; # necessary for the database migration scripts to be found - StateDirectory = baseNameOf dataDir; - UMask = "0027"; - EnvironmentFile = cfg.environmentFile; - - ExecStart = '' - ${cfg.package}/bin/mautrix-signal \ - --config='${settingsFile}' - ''; - - restartTriggers = [settingsFileUnsubstituted]; - }; - }; - }; - - # meta.maintainers = with maintainers; [ boppyt ]; -} diff --git a/modules/services/matrix-bridge/default.nix b/modules/services/matrix-bridge/default.nix index 3c645e6..6e2188c 100644 --- a/modules/services/matrix-bridge/default.nix +++ b/modules/services/matrix-bridge/default.nix @@ -6,7 +6,6 @@ let in { imports = [ - ./_mautrix-signal-module.nix ./_mautrix-discord-module.nix ]; @@ -89,7 +88,6 @@ in services.mautrix-signal = { enable = true; - package = pkgs.mautrix-signal; environmentFile = cfg.secrets.mautrix-envs; serviceDependencies = [ "matrix-synapse.service" ]; |