Disable matrix bridge
This commit is contained in:
parent
bf9886c401
commit
cdf4d5f3f9
|
|
@ -20,7 +20,6 @@ in {
|
|||
../../roles/blog.nix
|
||||
../../roles/email2matrix.nix
|
||||
../../roles/matrix-synapse
|
||||
../../roles/matrix-signal
|
||||
../../roles/coturn.nix
|
||||
../../roles/go-neb.nix
|
||||
../../roles/laminar
|
||||
|
|
|
|||
|
|
@ -1,36 +0,0 @@
|
|||
_: {
|
||||
imports = [
|
||||
./mautrix-signal-module.nix
|
||||
];
|
||||
|
||||
services.signald = {
|
||||
enable = true;
|
||||
user = "mautrix-signal";
|
||||
group = "mautrix-signal";
|
||||
};
|
||||
systemd.services.signald.serviceConfig.Environment = "SIGNALD_TRUST_NEW_KEYS=true SIGNALD_TRUST_ALL_KEYS=true";
|
||||
|
||||
services.mautrix-signal = {
|
||||
enable = true;
|
||||
settings = {
|
||||
homeserver = {
|
||||
address = "https://matrix.maralorn.de";
|
||||
domain = "maralorn.de";
|
||||
};
|
||||
signal.delete_unknown_accounts_on_start = true;
|
||||
bridge = {
|
||||
public_portals = false;
|
||||
federate_rooms = false;
|
||||
permissions."@maralorn:maralorn.de" = "admin";
|
||||
contact_list_names = "allow";
|
||||
autocreate_contact_portal = false;
|
||||
autocreate_group_portal = true;
|
||||
sync_direct_chat_list = true;
|
||||
encryption = {
|
||||
allow = true;
|
||||
default = true;
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
@ -1,202 +0,0 @@
|
|||
{
|
||||
config,
|
||||
pkgs,
|
||||
lib,
|
||||
...
|
||||
}:
|
||||
with lib; let
|
||||
dataDir = "/var/lib/mautrix-signal";
|
||||
registrationFile = "${dataDir}/signal-registration.yaml";
|
||||
cfg = config.services.mautrix-signal;
|
||||
settingsFormat = pkgs.formats.json {};
|
||||
settingsFileUnsubstituted = settingsFormat.generate "mautrix-signal-config-unsubstituted.json" cfg.settings;
|
||||
settingsFile = "${dataDir}/config.json";
|
||||
in {
|
||||
options = {
|
||||
services.mautrix-signal = {
|
||||
enable = mkEnableOption "Mautrix-Signal, a Matrix-Signal hybrid puppeting bridge";
|
||||
|
||||
settings = mkOption rec {
|
||||
apply = recursiveUpdate default;
|
||||
inherit (settingsFormat) type;
|
||||
default = {
|
||||
appservice = rec {
|
||||
database = "postgresql:///mautrix-signal?host=/run/postgresql";
|
||||
database_opts = {};
|
||||
hostname = "0.0.0.0";
|
||||
port = 29328;
|
||||
address = "http://localhost:${toString port}";
|
||||
};
|
||||
|
||||
bridge = {
|
||||
permissions = {};
|
||||
double_puppet_server_map = {};
|
||||
login_shared_secret_map = {};
|
||||
};
|
||||
signal = {
|
||||
socket_path = "/run/signald/signald.sock";
|
||||
outgoing_attachment_dir = "/var/lib/signald/tmp";
|
||||
};
|
||||
|
||||
logging = {
|
||||
version = 1;
|
||||
|
||||
formatters.precise.format = "[%(levelname)s@%(name)s] %(message)s";
|
||||
|
||||
handlers.console = {
|
||||
class = "logging.StreamHandler";
|
||||
formatter = "precise";
|
||||
};
|
||||
|
||||
loggers = {
|
||||
mau.level = "INFO";
|
||||
telethon.level = "INFO";
|
||||
|
||||
# prevent tokens from leaking in the logs:
|
||||
# https://github.com/tulir/mautrix-signal/issues/351
|
||||
aiohttp.level = "WARNING";
|
||||
};
|
||||
|
||||
# log to console/systemd instead of file
|
||||
root = {
|
||||
level = "INFO";
|
||||
handlers = ["console"];
|
||||
};
|
||||
};
|
||||
};
|
||||
example = literalExample ''
|
||||
{
|
||||
homeserver = {
|
||||
address = "http://localhost:8008";
|
||||
domain = "public-domain.tld";
|
||||
};
|
||||
|
||||
appservice.public = {
|
||||
prefix = "/public";
|
||||
external = "https://public-appservice-address/public";
|
||||
};
|
||||
|
||||
bridge.permissions = {
|
||||
"example.com" = "full";
|
||||
"@admin:example.com" = "admin";
|
||||
};
|
||||
}
|
||||
'';
|
||||
description = ''
|
||||
<filename>config.yaml</filename> configuration as a Nix attribute set.
|
||||
Configuration options should match those described in
|
||||
<link xlink:href="https://github.com/tulir/mautrix-signal/blob/master/mautrix_signal/example-config.yaml">
|
||||
example-config.yaml</link>.
|
||||
'';
|
||||
};
|
||||
|
||||
serviceDependencies = mkOption {
|
||||
type = with types; listOf str;
|
||||
default = optional config.services.matrix-synapse.enable "matrix-synapse.service";
|
||||
description = ''
|
||||
List of Systemd services to require and wait for when starting the application service.
|
||||
'';
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
config = mkIf cfg.enable {
|
||||
services.postgresql = {
|
||||
ensureDatabases = ["mautrix-signal"];
|
||||
ensureUsers = [
|
||||
{
|
||||
name = "mautrix-signal";
|
||||
ensurePermissions = {
|
||||
"DATABASE \"mautrix-signal\"" = "ALL PRIVILEGES";
|
||||
};
|
||||
}
|
||||
];
|
||||
};
|
||||
services.matrix-synapse.settings.app_service_config_files = [registrationFile];
|
||||
systemd.services.mautrix-signal = {
|
||||
description = "Mautrix-Signal, a Matrix-Signal hybrid puppeting/relaybot bridge.";
|
||||
|
||||
wantedBy = ["multi-user.target"];
|
||||
wants = ["network-online.target" "signald.service"];
|
||||
after = ["network-online.target" "signald.service"];
|
||||
|
||||
preStart = ''
|
||||
old_umask=$(umask)
|
||||
makeSettingsFile () {
|
||||
tempjson=$(${pkgs.coreutils}/bin/mktemp)
|
||||
${pkgs.yq}/bin/yq . '${registrationFile}' > "$tempjson"
|
||||
[ -f ${settingsFile} ] && rm -f ${settingsFile}
|
||||
umask 0277
|
||||
${pkgs.jq}/bin/jq '.[0] * { appservice : { as_token: .[1].as_token, hs_token: .[1].hs_token }}' \
|
||||
-s '${settingsFileUnsubstituted}' $tempjson > '${settingsFile}'
|
||||
rm $tempjson
|
||||
umask $old_umask
|
||||
}
|
||||
|
||||
if [ -f '${registrationFile}' ]; then
|
||||
makeSettingsFile
|
||||
else
|
||||
umask 0277
|
||||
cp '${settingsFileUnsubstituted}' '${settingsFile}'
|
||||
umask 0077
|
||||
# generate the appservice's registration file if absent
|
||||
${pkgs.mautrix-signal}/bin/mautrix-signal \
|
||||
--generate-registration \
|
||||
--config='${settingsFile}' \
|
||||
--registration='${registrationFile}' \
|
||||
-n
|
||||
umask $old_umask
|
||||
makeSettingsFile
|
||||
fi
|
||||
# Allow synapse access to the registration
|
||||
if ${getBin pkgs.glibc}/bin/getent group matrix-synapse > /dev/null; then
|
||||
chgrp matrix-synapse ${registrationFile}
|
||||
chmod g+r ${registrationFile}
|
||||
fi
|
||||
'';
|
||||
|
||||
serviceConfig = rec {
|
||||
Type = "simple";
|
||||
WatchdogSignal = "SIGTERM";
|
||||
WatchdogSec = "60m";
|
||||
Restart = "always";
|
||||
|
||||
ProtectSystem = "full";
|
||||
ProtectHome = true;
|
||||
ProtectKernelTunables = true;
|
||||
ProtectKernelModules = true;
|
||||
ProtectControlGroups = true;
|
||||
User = "mautrix-signal";
|
||||
|
||||
CapabilityBoundingSet = ["CAP_CHOWN"];
|
||||
AmbientCapabilities = CapabilityBoundingSet;
|
||||
NoNewPrivileges = true;
|
||||
|
||||
LockPersonality = true;
|
||||
RestrictRealtime = true;
|
||||
|
||||
ReadWritePaths = ["/var/lib/signald"];
|
||||
|
||||
BindPaths = "/var/lib/signald";
|
||||
StateDirectory = baseNameOf dataDir;
|
||||
StateDirectoryMode = "771";
|
||||
UMask = 0007;
|
||||
|
||||
ExecStart = ''
|
||||
${pkgs.mautrix-signal}/bin/mautrix-signal \
|
||||
--config='${settingsFile}'
|
||||
'';
|
||||
};
|
||||
|
||||
restartTriggers = [settingsFileUnsubstituted];
|
||||
};
|
||||
users.users.mautrix-signal = {
|
||||
description = "Service user for the Matrix-Signal bridge";
|
||||
isSystemUser = true;
|
||||
group = "mautrix-signal";
|
||||
};
|
||||
users.groups.mautrix-signal = {};
|
||||
};
|
||||
|
||||
meta.maintainers = with maintainers; [expipiplus1];
|
||||
}
|
||||
2
private
2
private
|
|
@ -1 +1 @@
|
|||
Subproject commit bbd8da4af9eab3a30618553618b9f80f7744e956
|
||||
Subproject commit 06036a665edfdb35c15610e0313e38ed5622bcb1
|
||||
Loading…
Reference in a new issue