1 files changed, 33 insertions, 27 deletions
diff --git a/overlays/mautrix-signal-module.nix b/overlays/mautrix-signal-module.nix
index 58878b9..983d635 100644
--- a/overlays/mautrix-signal-module.nix
+++ b/overlays/mautrix-signal-module.nix
@@ -7,11 +7,14 @@ let
   registrationFile = "${dataDir}/signal-registration.yaml";
   cfg = config.services.mautrix-signal;
   settingsFormat = pkgs.formats.json { };
-  settingsFile =
+  settingsFile = "${dataDir}/config.json";
+  settingsFileUnsubstituted =
     settingsFormat.generate "mautrix-signal-config.json" cfg.settings;
 
 in
 {
+  # NOTE(2024-01-11): Upstream has been moved to a Go version.
+  # Environment-based credential setting might not work.
   options = {
     services.mautrix-signal = {
       enable = mkEnableOption (lib.mdDoc "Mautrix-Signal, a Matrix-Signal puppeting bridge.");
@@ -44,28 +47,13 @@ in
           };
 
           logging = {
-            version = 1;
-
-            formatters.precise.format = "[%(levelname)s@%(name)s] %(message)s";
-
-            handlers.console = {
-              class = "logging.StreamHandler";
-              formatter = "precise";
-            };
-
-            loggers = {
-              mau.level = "INFO";
-
-              # prevent tokens from leaking in the logs:
-              # https://github.com/tulir/mautrix-telegram/issues/351
-              aiohttp.level = "WARNING";
-            };
-
-            # log to console/systemd instead of file
-            root = {
-              level = "INFO";
-              handlers = [ "console" ];
-            };
+            min_level = "debug";
+            writers = [
+              {
+                type = "stdout";
+                format = "pretty-colored";
+              }
+            ];
           };
         };
         example = literalExpression ''
@@ -142,6 +130,7 @@ in
       after = [ "network-online.target" ] ++ cfg.serviceDependencies;
       path = [ pkgs.lottieconverter pkgs.ffmpeg-full ];
 
+      # TODO(2023-01-11): Still relevant in Go version?
       # mautrix-signal tries to generate a dotfile in the home directory of
       # the running user if using a postgresql database:
       #
@@ -155,17 +144,32 @@ in
       environment.HOME = dataDir;
 
       preStart = ''
+        # substitute the settings file by environment variables
+        # in this case read from EnvironmentFile
+        test -f '${settingsFile}' && rm -f '${settingsFile}'
+        old_umask=$(umask)
+        umask 0177
+        ${pkgs.envsubst}/bin/envsubst \
+          -o '${settingsFile}' \
+          -i '${settingsFileUnsubstituted}' \
+        umask $old_umask
+
         # generate the appservice's registration file if absent
         if [ ! -f '${registrationFile}' ]; then
           ${cfg.package}/bin/mautrix-signal \
             --generate-registration \
-            --base-config='${cfg.package}/${cfg.package.pythonModule.sitePackages}/mautrix_signal/example-config.yaml' \
             --config='${settingsFile}' \
             --registration='${registrationFile}'
         fi
-      '' + lib.optionalString (cfg.package ? alembic) ''
-        # run automatic database init and migration scripts
-        ${cfg.package.alembic}/bin/alembic -x config='${settingsFile}' upgrade head
+        chmod 640 ${registrationFile}
+
+        umask 0177
+        ${pkgs.yq}/bin/yq -s '.[0].appservice.as_token = .[1].as_token
+          | .[0].appservice.hs_token = .[1].hs_token
+          | .[0]' '${settingsFile}' '${registrationFile}' \
+          > '${settingsFile}.tmp'
+        mv '${settingsFile}.tmp' '${settingsFile}'
+        umask $old_umask
       '';
 
       serviceConfig = {
@@ -190,6 +194,8 @@ in
           ${cfg.package}/bin/mautrix-signal \
             --config='${settingsFile}'
         '';
+
+      restartTriggers = [settingsFileUnsubstituted];
       };
     };
   };