add mautrix-whatsapp

config/nas.nix

@@ -17,6 +17,7 @@
     ./services/rspamd.nix
     ./services/synapse.nix
     ./services/mautrix-telegram.nix
+    ./services/mautrix-whatsapp.nix
   ];
 
   hardware.cpu.amd.updateMicrocode = true;

config/services/mautrix-whatsapp.nix

@@ -0,0 +1,60 @@
+{ pkgs, ... }: {
+  imports = [
+    ../../modules/matrix/mautrix-whatsapp.nix
+  ];
+
+  services.mautrix-whatsapp = {
+    enable = true;
+    environmentFile = pkgs.emptyFile;
+    settings = {
+      homeserver = {
+        address = "https://matrix.chir.rs";
+        domain = "chir.rs";
+      };
+      appservice = {
+        database = {
+          type = "postgres";
+          uri = "postgres:///mautrix_whatsapp?sslmode=disable&host=/run/postgresql";
+        };
+      };
+      metrics = {
+        enabled = true;
+        listen = "[::]:29319";
+      };
+      bridge = {
+        personal_filtering_spaces = true;
+        delivery_receipts = true;
+        hystory_sync = {
+          backfill = true;
+          request_full_sync = true;
+        };
+        send_presence_on_typing = true;
+        double_puppet_server_map = { };
+        login_shared_secret_map = { };
+        private_chat_portal_meta = true;
+        mute_bridging = true;
+        pinned_tag = "m.favourite";
+        archive_tag = "m.lowpriority";
+        allow_user_invite = true;
+        disappearing_messages_in_groups = true;
+        url_previews = true;
+        encryption = {
+          allow = true;
+          default = true;
+        };
+        permissions = {
+          "@lotte:chir.rs" = "admin";
+        };
+      };
+    };
+  };
+  services.postgresql.ensureDatabases = [
+    "mautrix_whatsapp"
+  ];
+  services.postgresql.ensureUsers = [{
+    name = "mautrix-whatsapp";
+    ensurePermissions = {
+      "DATABASE mautrix_whatsapp" = "ALL PRIVILEGES";
+    };
+  }];
+}

config/services/synapse.nix

@@ -55,6 +55,10 @@
       signing_key_path = config.sops.secrets."services/synapse/private_key".path;
       encryption_enabled_by_default_for_room_type = "all";
       enable_metrics = true;
+      experimental_features = {
+        msc2716_enabled = true;
+        spaces_enabled = true;
+      };
     };
     withJemalloc = true;
   };

flake.nix

@@ -90,7 +90,7 @@ rec {
           nativeBuildInputs = with pkgs; [
             sops
             ssh-to-age
-            nix-prefetch-git
+            nix-prefetch
             jq
             bundix
           ];

modules/matrix/mautrix-whatsapp.nix

@@ -0,0 +1,130 @@
+{ config, pkgs, lib, ... }:
+with lib;
+let
+  dataDir = "/var/lib/mautrix-whatsapp";
+  registrationFile = "${dataDir}/whatsapp-registration.yaml";
+  cfg = config.services.mautrix-whatsapp;
+  settingsFormat = pkgs.formats.yaml { };
+  settingsFileUnsubstituted = settingsFormat.generate "mautrix-telegram-whatsapp-unsubstituted.yaml" cfg.settings;
+  settingsFile = "${dataDir}/config.yaml";
+  mautrix-whatsapp = pkgs.callPackage ../../packages/matrix/mautrix-whatsapp.nix { };
+in
+{
+  options = {
+    services.mautrix-whatsapp = {
+      enable = mkEnableOption "Mautrix-Whatsapp, a Matrix-Whatsapp hybrid puppeting/relaybot bridge";
+      settings = mkOption rec {
+        apply = recursiveUpdate default;
+        inherit (settingsFormat) type;
+        default = {
+          appservice = {
+            address = "http://localhost:29318";
+            hostname = "0.0.0.0";
+            port = 29318;
+            database = {
+              type = "sqlite";
+              uri = "sqlite:///${dataDir}/mautrix-telegram.db";
+            };
+            as_token = "$AS_TOKEN";
+            hs_token = "$HS_TOKEN";
+          };
+          logging = {
+            file_name_format = null;
+          };
+        };
+      };
+      environmentFile = mkOption {
+        type = types.nullOr types.path;
+        default = null;
+        description = ''
+          File containing environment variables to be passed to the mautrix-telegram service,
+          in which secret tokens can be specified securely by defining values for
+          <literal>MAUTRIX_TELEGRAM_APPSERVICE_AS_TOKEN</literal>,
+          <literal>MAUTRIX_TELEGRAM_APPSERVICE_HS_TOKEN</literal>,
+          <literal>MAUTRIX_TELEGRAM_TELEGRAM_API_ID</literal>,
+          <literal>MAUTRIX_TELEGRAM_TELEGRAM_API_HASH</literal> and optionally
+          <literal>MAUTRIX_TELEGRAM_TELEGRAM_BOT_TOKEN</literal>.
+        '';
+      };
+    };
+  };
+  config = mkIf cfg.enable {
+    systemd.services.mautrix-whatsapp-genregistration = {
+      description = "Mautrix-Whatsapp Registration";
+
+      requiredBy = [ "matrix-synapse.service" ];
+      script = ''
+        # Not all secrets can be passed as environment variable (yet)
+        # https://github.com/tulir/mautrix-telegram/issues/584
+        [ -f ${settingsFile} ] && rm -f ${settingsFile}
+        old_umask=$(umask)
+        umask 0177
+        export AS_TOKEN="This value is generated when generating the registration"
+        export HS_TOKEN="This value is generated when generating the registration"
+        ${pkgs.envsubst}/bin/envsubst \
+          -o ${settingsFile} \
+          -i ${settingsFileUnsubstituted}
+        umask $old_umask
+
+        [ -f ${registrationFile} ] && rm -f ${registrationFile}
+        ${mautrix-whatsapp}/bin/mautrix-whatsapp --generate-registration --base-config ${mautrix-whatsapp.src}/example-config.yaml --config ${settingsFile} --registration ${registrationFile}
+
+        # Extract the tokens from the registration
+        export AS_TOKEN=$(${pkgs.yq}/bin/yq -r '.as_token' ${registrationFile})
+        export HS_TOKEN=$(${pkgs.yq}/bin/yq -r '.hs_token' ${registrationFile})
+        umask 0177
+        ${pkgs.envsubst}/bin/envsubst \
+          -o ${settingsFile} \
+          -i ${settingsFileUnsubstituted}
+        umask $old_umask
+      '';
+      serviceConfig = {
+        Type = "oneshot";
+        ProtectSystem = "strict";
+        ProtectHome = true;
+        ProtectKernelTunables = true;
+        ProtectKernelModules = true;
+        ProtectControlGroups = true;
+        PrivateTmp = true;
+        WorkingDirectory = dataDir;
+        StateDirectory = baseNameOf dataDir;
+        UMask = 0117;
+        User = "mautrix-whatsapp";
+        Group = "matrix-synapse";
+        EnvironmentFile = cfg.environmentFile;
+      };
+      restartTriggers = [ settingsFileUnsubstituted cfg.environmentFile ];
+    };
+    systemd.services.mautrix-whatsapp = {
+      description = "Mautrix-Whatsapp";
+      wantedBy = [ "multi-user.target" ];
+      wants = [ "matrix-synapse.service" ];
+      after = [ "matrix-synapse.service" ];
+      requires = [ "mautrix-whatsapp-genregistration.service" ];
+      serviceConfig = {
+        Type = "simple";
+        Restart = "always";
+
+        ProtectSystem = "strict";
+        ProtectHome = true;
+        ProtectKernelTunables = true;
+        ProtectKernelModules = true;
+        ProtectControlGroups = true;
+        WorkingDirectory = dataDir;
+        StateDirectory = baseNameOf dataDir;
+        UMask = 0117;
+        User = "mautrix-whatsapp";
+        Group = "matrix-synapse";
+        EnvironmentFile = cfg.environmentFile;
+      };
+      restartTriggers = [ cfg.environmentFile ];
+    };
+    users.users.mautrix-whatsapp = {
+      description = "Mautrix Whatsapp bridge";
+      home = "${dataDir}";
+      useDefaultShell = true;
+      group = "matrix-synapse";
+      isSystemUser = true;
+    };
+  };
+}

packages/matrix/mautrix-whatsapp.nix

@@ -0,0 +1,16 @@
+{ buildGo117Module
+, fetchFromGitHub
+, olm
+}: buildGo117Module rec {
+  pname = "mautrix-whatsapp";
+  version = "0.3.1";
+  src = fetchFromGitHub {
+    owner = "mautrix";
+    repo = "whatsapp";
+    rev = "v${version}";
+    sha256 = "sha256-adsGPVG/EwpzOqhFJvn3anjTXwGY27a7Bc4NNkBeqJk=";
+  };
+  proxyVendor = true;
+  vendorSha256 = "sha256-LmNzhyBSm3eHODbXjZc9sFsRczYZtc4ORk3X6/dcHfY=";
+  buildInputs = [ olm ];
+}