add mautrix-signal
This commit is contained in:
parent
d72e7b8d20
commit
56347e60d3
GPG key ID:
AB2BD8DAF2E37122
4 changed files with 196 additions and 0 deletions
|
|
@ -18,6 +18,7 @@
|
|||
./services/synapse.nix
|
||||
./services/mautrix-telegram.nix
|
||||
./services/mautrix-whatsapp.nix
|
||||
./services/mautrix-signal.nix
|
||||
];
|
||||
|
||||
hardware.cpu.amd.updateMicrocode = true;
|
||||
|
|
|
|||
58
config/services/mautrix-signal.nix
Normal file
58
config/services/mautrix-signal.nix
Normal file
|
|
@ -0,0 +1,58 @@
|
|||
{ pkgs, config, ... }: {
|
||||
imports = [
|
||||
../../modules/matrix/mautrix-signal.nix
|
||||
];
|
||||
|
||||
services.mautrix-signal = {
|
||||
enable = true;
|
||||
environmentFile = pkgs.emptyFile;
|
||||
settings = {
|
||||
homeserver = {
|
||||
address = "https://matrix.chir.rs";
|
||||
domain = "chir.rs";
|
||||
http_retry_count = 1000;
|
||||
};
|
||||
appservice = {
|
||||
max_body_size = 10;
|
||||
database = "postgres:///mautrix_signal?sslmode=disable&host=/run/postgresql";
|
||||
};
|
||||
metrics = {
|
||||
enabled = true;
|
||||
listen = "[::]:29329";
|
||||
};
|
||||
signal = {
|
||||
socket_path = config.services.signald.socketPath;
|
||||
avatar_dir = "/var/lib/mautrix-signal/avatars";
|
||||
data_dir = "/var/lib/mautrix-signal/data";
|
||||
|
||||
};
|
||||
bridge = {
|
||||
displayname_template = "{displayname}";
|
||||
autocreate_contact_portal = true;
|
||||
double_puppet_allow_discovery = true;
|
||||
double_puppet_server_map = { };
|
||||
login_shared_secret_map = { };
|
||||
encryption = {
|
||||
allow = true;
|
||||
default = true;
|
||||
};
|
||||
private_chat_portal_meta = true;
|
||||
delivery_receipts = true;
|
||||
delivery_error_reports = true;
|
||||
periodic_sync = 86400;
|
||||
permissions = {
|
||||
"@lotte:chir.rs" = "admin";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
services.postgresql.ensureDatabases = [
|
||||
"mautrix_signal"
|
||||
];
|
||||
services.postgresql.ensureUsers = [{
|
||||
name = "mautrix-signal";
|
||||
ensurePermissions = {
|
||||
"DATABASE mautrix_signal" = "ALL PRIVILEGES";
|
||||
};
|
||||
}];
|
||||
}
|
||||
|
|
@ -22,6 +22,7 @@
|
|||
listen = "[::]:29319";
|
||||
};
|
||||
bridge = {
|
||||
displayname_template = "{displayname}";
|
||||
personal_filtering_spaces = true;
|
||||
delivery_receipts = true;
|
||||
hystory_sync = {
|
||||
|
|
|
|||
136
modules/matrix/mautrix-signal.nix
Normal file
136
modules/matrix/mautrix-signal.nix
Normal file
|
|
@ -0,0 +1,136 @@
|
|||
{ config, pkgs, lib, ... }:
|
||||
with lib;
|
||||
let
|
||||
dataDir = "/var/lib/mautrix-signal";
|
||||
registrationFile = "${dataDir}/signal-registration.yaml";
|
||||
cfg = config.services.mautrix-signal;
|
||||
settingsFormat = pkgs.formats.yaml { };
|
||||
settingsFileUnsubstituted = settingsFormat.generate "mautrix-telegram-signal-unsubstituted.yaml" cfg.settings;
|
||||
settingsFile = "${dataDir}/config.yaml";
|
||||
in
|
||||
{
|
||||
options = {
|
||||
services.mautrix-signal = {
|
||||
enable = mkEnableOption "Mautrix-signal, a Matrix-signal hybrid puppeting/relaybot bridge";
|
||||
settings = mkOption rec {
|
||||
apply = recursiveUpdate default;
|
||||
inherit (settingsFormat) type;
|
||||
default = {
|
||||
appservice = {
|
||||
address = "http://localhost:29328";
|
||||
hostname = "0.0.0.0";
|
||||
port = 29328;
|
||||
database = "sqlite:///${dataDir}/mautrix-signal.db";
|
||||
as_token = "$AS_TOKEN";
|
||||
hs_token = "$HS_TOKEN";
|
||||
};
|
||||
logging = {
|
||||
file_name_format = null;
|
||||
};
|
||||
};
|
||||
};
|
||||
environmentFile = mkOption {
|
||||
type = types.nullOr types.path;
|
||||
default = null;
|
||||
description = ''
|
||||
File containing environment variables to be passed to the mautrix-telegram service,
|
||||
in which secret tokens can be specified securely by defining values for
|
||||
<literal>MAUTRIX_TELEGRAM_APPSERVICE_AS_TOKEN</literal>,
|
||||
<literal>MAUTRIX_TELEGRAM_APPSERVICE_HS_TOKEN</literal>,
|
||||
<literal>MAUTRIX_TELEGRAM_TELEGRAM_API_ID</literal>,
|
||||
<literal>MAUTRIX_TELEGRAM_TELEGRAM_API_HASH</literal> and optionally
|
||||
<literal>MAUTRIX_TELEGRAM_TELEGRAM_BOT_TOKEN</literal>.
|
||||
'';
|
||||
};
|
||||
};
|
||||
};
|
||||
config = mkIf cfg.enable {
|
||||
systemd.services.mautrix-signal-genregistration = {
|
||||
description = "Mautrix-signal Registration";
|
||||
|
||||
wantedBy = [ "matrix-synapse.service" ];
|
||||
before = [ "matrix-synapse.service" ];
|
||||
script = ''
|
||||
# Not all secrets can be passed as environment variable (yet)
|
||||
# https://github.com/tulir/mautrix-telegram/issues/584
|
||||
[ -f ${settingsFile} ] && rm -f ${settingsFile}
|
||||
old_umask=$(umask)
|
||||
umask 0177
|
||||
export AS_TOKEN="This value is generated when generating the registration"
|
||||
export HS_TOKEN="This value is generated when generating the registration"
|
||||
${pkgs.envsubst}/bin/envsubst \
|
||||
-o ${settingsFile} \
|
||||
-i ${settingsFileUnsubstituted}
|
||||
umask $old_umask
|
||||
|
||||
[ -f ${registrationFile} ] && rm -f ${registrationFile}
|
||||
${pkgs.mautrix-signal}/bin/mautrix-signal --generate-registration --config ${settingsFile} --registration ${registrationFile}
|
||||
chmod 660 ${registrationFile}
|
||||
|
||||
# Extract the tokens from the registration
|
||||
export AS_TOKEN=$(${pkgs.yq}/bin/yq -r '.as_token' ${registrationFile})
|
||||
export HS_TOKEN=$(${pkgs.yq}/bin/yq -r '.hs_token' ${registrationFile})
|
||||
umask 0177
|
||||
${pkgs.envsubst}/bin/envsubst \
|
||||
-o ${settingsFile} \
|
||||
-i ${settingsFileUnsubstituted}
|
||||
umask $old_umask
|
||||
'';
|
||||
serviceConfig = {
|
||||
Type = "oneshot";
|
||||
RemainAfterExit = true;
|
||||
ProtectSystem = "strict";
|
||||
ProtectHome = true;
|
||||
ProtectKernelTunables = true;
|
||||
ProtectKernelModules = true;
|
||||
ProtectControlGroups = true;
|
||||
PrivateTmp = true;
|
||||
WorkingDirectory = dataDir;
|
||||
StateDirectory = baseNameOf dataDir;
|
||||
UMask = 0117;
|
||||
User = "mautrix-signal";
|
||||
Group = "matrix-synapse";
|
||||
EnvironmentFile = cfg.environmentFile;
|
||||
};
|
||||
restartTriggers = [ settingsFileUnsubstituted cfg.environmentFile ];
|
||||
};
|
||||
systemd.services.mautrix-signal = {
|
||||
description = "Mautrix-signal";
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
wants = [ "matrix-synapse.service" "mautrix-signal-genregistration.service" ];
|
||||
after = [ "matrix-synapse.service" "mautrix-signal-genregistration.service" ];
|
||||
serviceConfig = {
|
||||
Type = "simple";
|
||||
Restart = "always";
|
||||
|
||||
ProtectSystem = "strict";
|
||||
ProtectHome = true;
|
||||
ProtectKernelTunables = true;
|
||||
ProtectKernelModules = true;
|
||||
ProtectControlGroups = true;
|
||||
WorkingDirectory = dataDir;
|
||||
StateDirectory = baseNameOf dataDir;
|
||||
UMask = 0117;
|
||||
User = "mautrix-signal";
|
||||
Group = "matrix-synapse";
|
||||
EnvironmentFile = cfg.environmentFile;
|
||||
ExecStart = ''
|
||||
${pkgs.mautrix-signal}/bin/mautrix-signal \
|
||||
--config='${settingsFile}'
|
||||
'';
|
||||
};
|
||||
restartTriggers = [ cfg.environmentFile ];
|
||||
};
|
||||
users.users.mautrix-signal = {
|
||||
description = "Mautrix signal bridge";
|
||||
home = "${dataDir}";
|
||||
useDefaultShell = true;
|
||||
group = "matrix-synapse";
|
||||
isSystemUser = true;
|
||||
};
|
||||
services.matrix-synapse.settings.app_service_config_files = [
|
||||
registrationFile
|
||||
];
|
||||
services.signald.enable = true;
|
||||
};
|
||||
}
|
||||
Loading…
Reference in a new issue