helix
This commit is contained in:
		
							parent
							
								
									8af4b6faf9
								
							
						
					
					
						commit
						1ced6b7a3b
					
				
							
								
								
									
										52
									
								
								machines/helix.nix
									
									
									
									
									
										Normal file
									
								
							
							
						
						
									
										52
									
								
								machines/helix.nix
									
									
									
									
									
										Normal file
									
								
							|  | @ -0,0 +1,52 @@ | ||||||
|  | { config, pkgs, ... }: | ||||||
|  | { | ||||||
|  |   imports = | ||||||
|  |     [ # Include the results of the hardware scan. | ||||||
|  |       ./hardware-configuration.nix | ||||||
|  |       ./wireguard.nix | ||||||
|  |       ./matrix.nix | ||||||
|  |     ]; | ||||||
|  | 
 | ||||||
|  |   # Use the GRUB 2 boot loader. | ||||||
|  |   boot.loader.grub.enable = true; | ||||||
|  |   boot.loader.grub.version = 2; | ||||||
|  |   boot.loader.grub.device = "/dev/vda"; # or "nodev" for efi only | ||||||
|  | 
 | ||||||
|  |   networking.hostName = "helix"; # Define your hostname. | ||||||
|  | 
 | ||||||
|  |   networking.useDHCP = false; | ||||||
|  |   networking.interfaces.ens3.useDHCP = true; | ||||||
|  | 
 | ||||||
|  |   # Configure network proxy if necessary | ||||||
|  |   # networking.proxy.default = "http://user:password@proxy:port/"; | ||||||
|  |   # networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain"; | ||||||
|  | 
 | ||||||
|  |   # Enable the OpenSSH daemon. | ||||||
|  |   services.openssh.enable = true; | ||||||
|  |   #services.openssh.passwordAuthentication = false; | ||||||
|  |   services.openssh.permitRootLogin = "no"; | ||||||
|  | 
 | ||||||
|  |   # Open ports in the firewall. | ||||||
|  |   # networking.firewall.allowedTCPPorts = [ ... ]; | ||||||
|  |   # networking.firewall.allowedUDPPorts = [ ... ]; | ||||||
|  |   # Or disable the firewall altogether. | ||||||
|  |   # networking.firewall.enable = false; | ||||||
|  | 
 | ||||||
|  |   # Define a user account. Don't forget to set a password with ‘passwd’. | ||||||
|  |   users.users.anish = { | ||||||
|  |     isNormalUser = true; | ||||||
|  |     extraGroups = [ "wheel" ]; # Enable ‘sudo’ for the user | ||||||
|  |     openssh.authorizedKeys.keys = [ | ||||||
|  | 	"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDM8kTdMGGmr6mv/zv+K9qVjhzqwivyyN5IV04R7/kcWKw1c6ZEzzqqmsnJ/hci6IIxZ/VEUzMhYz0iBCL0wJHHMxYoNCgISWePtDlVJdyrzm9OWjJNcRStZBW3XcY9dELJsCVcQ4LAVYE4vA+MdmbwM2FZgJhAH6qUzujpfNrj/YIVG7MTN6tbUd63uZF57F43c8WUjgRJx2o7Wl9bSe6v3PZ4fAgEO+wQPso+W+pEXLZ3hBNrHdybwdoGvG9tHlBDbLid11BxtpzmwR9CydDfpbyOXB2+tJkkNXhsHB22mN/2+vGWYhDKYPTFqbDW7McDfQChySyYDdZWmg5WHIGz anish@curve"   | ||||||
|  | 	"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCeWQsf9rbE+KBrWLkLkg1PMKx0jPfDP8xyv+XtddIQzAskRTN+JSSQp1GpoRgfQij7bx6f6DfjkwSQK5NWDQNQ+klGhcdEwEdptWUzpRAvKHMImjyIwFHmRKKEgcfH8+DSHVM93nRSQKrLezX4PzPkHF9f3TLxFdGeQDeY0J2oP2Oa97hRtuTJZW9BwUojyvDYUbg7F3fxf+pdFCvIAFaayiLkhOYdTXnjLt1Ks6NOhSzM78ZibHv4pFYI9r6dhflkFP/SzyLeSSm1aVAtxqE7vF5HnnORAg0byDsiOv/9RXxiDx7gkAAw3xENDSpp9TRj54M7iz1OSsRMhmD6orHjZFIRejlE4DIn+PBPm3PH+U5ILKTogE6n5MfPT28V0QdtHuqq3b5tSWiDcFpnjxbIUmEIo5hLzMR0tXZoNLQhBCSNfxjE8CYzpk7mHbvhSs2GPfG+NI1vvldbw2EF8beJFQHNYTqJw8y7p8RXpCwZqqpSitJX6v9DiYdLVG1hWvE= nix-on-droid@localhost" | ||||||
|  | 	 "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDKN8/SH55DBiwVoSnTU8k2Pen+wmovL9QaMyehxGEsJJv/8fzwsswGalD4C/4O51LOvdu4UKkZW5hG02uVSK+58p3UV3pOPyoqsu/aDeIsWsqmTeTzUrBIWOlNzcDKnohLz2oGC5YO+wyTJ9Iteq6aGJDjErsW7sG3h5lXCs551EmJNNGhtBQaaoytMNnWqSdlVjDNCijurH7WUpp40U/RjEp532l4rX6eIIj3jBKEFbhZkFSSjqbj4xM4SyFt+Jmigb1RMjsQjmpfY1vDtM84RcYfpTUte/T5w2dkD5H6kccmWnwKSJpm9wXfx4E7lR9APdUGnau2U1+XxiD3ytGl anish@box" ]; | ||||||
|  |   }; | ||||||
|  | 
 | ||||||
|  |   # This value determines the NixOS release with which your system is to be | ||||||
|  |   # compatible, in order to avoid breaking some software such as database | ||||||
|  |   # servers. You should change this only after NixOS release notes say you | ||||||
|  |   # should. | ||||||
|  |   system.stateVersion = "19.09"; # Did you read the comment? | ||||||
|  | 
 | ||||||
|  | } | ||||||
|  | 
 | ||||||
							
								
								
									
										153
									
								
								matrix-slack.nix
									
									
									
									
									
										Normal file
									
								
							
							
						
						
									
										153
									
								
								matrix-slack.nix
									
									
									
									
									
										Normal file
									
								
							|  | @ -0,0 +1,153 @@ | ||||||
|  | { config, pkgs, lib, ... }: | ||||||
|  | 
 | ||||||
|  | with lib; | ||||||
|  | 
 | ||||||
|  | let | ||||||
|  |   dataDir = "/var/lib/matrix-appservice-slack"; | ||||||
|  |   registrationFile = "${dataDir}/slack-registration.yaml"; | ||||||
|  |   #appDir = "${pkgs.matrix-appservice-slack}/${pkgs.matrix-appservice-slack.passthru.nodeAppDir}"; | ||||||
|  |   cfg = config.services.matrix-appservice-slack; | ||||||
|  |   # TODO: switch to configGen.json once RFC42 is implemented | ||||||
|  |   settingsFile = pkgs.writeText "matrix-appservice-slack-settings.json" (builtins.toJSON cfg.settings); | ||||||
|  | 
 | ||||||
|  | in { | ||||||
|  |   options = { | ||||||
|  |     services.matrix-appservice-slack = { | ||||||
|  |       enable = mkEnableOption "a bridge between Matrix and Slack"; | ||||||
|  | 
 | ||||||
|  |       settings = mkOption rec { | ||||||
|  |         # TODO: switch to types.config.json as prescribed by RFC42 once it's implemented | ||||||
|  |         type = types.attrs; | ||||||
|  |         apply = recursiveUpdate default; | ||||||
|  |         default = { | ||||||
|  |           # empty values necessary for registration file generation | ||||||
|  |           # actual values defined in environmentFile | ||||||
|  |           auth = { | ||||||
|  |             clientID = ""; | ||||||
|  |             botToken = ""; | ||||||
|  |           }; | ||||||
|  |         }; | ||||||
|  |         example = literalExample '' | ||||||
|  |           { | ||||||
|  |             bridge = { | ||||||
|  |               domain = "public-domain.tld"; | ||||||
|  |               homeserverUrl = "http://public-domain.tld:8008"; | ||||||
|  |             }; | ||||||
|  |           } | ||||||
|  |         ''; | ||||||
|  |         description = '' | ||||||
|  |           <filename>config.yaml</filename> configuration as a Nix attribute set. | ||||||
|  |           </para> | ||||||
|  | 
 | ||||||
|  |           <para> | ||||||
|  |           Configuration options should match those described in | ||||||
|  |           <link xlink:href="https://github.com/Half-Shot/matrix-appservice-discord/blob/master/config/config.sample.yaml"> | ||||||
|  |           config.sample.yaml</link>. | ||||||
|  |           </para> | ||||||
|  | 
 | ||||||
|  |           <para> | ||||||
|  |           <option>config.bridge.domain</option> and <option>config.bridge.homeserverUrl</option> | ||||||
|  |           should be set to match the public host name of the Matrix homeserver for webhooks and avatars to work. | ||||||
|  |           </para> | ||||||
|  | 
 | ||||||
|  |           <para> | ||||||
|  |           Secret tokens should be specified using <option>environmentFile</option> | ||||||
|  |           instead of this world-readable attribute set. | ||||||
|  |         ''; | ||||||
|  |       }; | ||||||
|  | 
 | ||||||
|  |       environmentFile = mkOption { | ||||||
|  |         type = types.nullOr types.path; | ||||||
|  |         default = null; | ||||||
|  |         description = '' | ||||||
|  |           File containing environment variables to be passed to the matrix-appservice-discord service, | ||||||
|  |           in which secret tokens can be specified securely by defining values for | ||||||
|  |           <literal>APPSERVICE_SLACK_AUTH_CLIENT_I_D</literal> and | ||||||
|  |           <literal>APPSERVICE_SLACK_AUTH_BOT_TOKEN</literal>. | ||||||
|  |         ''; | ||||||
|  |       }; | ||||||
|  | 
 | ||||||
|  |       url = mkOption { | ||||||
|  |         type = types.str; | ||||||
|  |         default = "http://localhost:${toString cfg.port}"; | ||||||
|  |         description = '' | ||||||
|  |           The URL where the application service is listening for HS requests. | ||||||
|  |         ''; | ||||||
|  |       }; | ||||||
|  | 
 | ||||||
|  |       port = mkOption { | ||||||
|  |         type = types.port; | ||||||
|  |         default = 9898; # from https://github.com/matrix-org/matrix-appservice-slack/blob/develop/config/config.sample.yaml#L70 | ||||||
|  |         description = '' | ||||||
|  |           Port number on which the bridge should listen for internal communication with the Matrix homeserver. | ||||||
|  |         ''; | ||||||
|  |       }; | ||||||
|  | 
 | ||||||
|  |       localpart = mkOption { | ||||||
|  |         type = with types; nullOr str; | ||||||
|  |         default = null; | ||||||
|  |         description = '' | ||||||
|  |           The user_id localpart to assign to the AS. | ||||||
|  |         ''; | ||||||
|  |       }; | ||||||
|  | 
 | ||||||
|  |       serviceDependencies = mkOption { | ||||||
|  |         type = with types; listOf str; | ||||||
|  |         default = optional config.services.matrix-synapse.enable "matrix-synapse.service"; | ||||||
|  |         description = '' | ||||||
|  |           List of Systemd services to require and wait for when starting the application service, | ||||||
|  |           such as the Matrix homeserver if it's running on the same host. | ||||||
|  |         ''; | ||||||
|  |       }; | ||||||
|  |     }; | ||||||
|  |   }; | ||||||
|  | 
 | ||||||
|  |   config = mkIf cfg.enable { | ||||||
|  |     systemd.services.matrix-appservice-slack = { | ||||||
|  |       description = "A bridge between Matrix and Slack."; | ||||||
|  | 
 | ||||||
|  |       wantedBy = [ "multi-user.target" ]; | ||||||
|  |       wants = [ "network-online.target" ] ++ cfg.serviceDependencies; | ||||||
|  |       after = [ "network-online.target" ] ++ cfg.serviceDependencies; | ||||||
|  | 
 | ||||||
|  |       preStart = '' | ||||||
|  |         if [ ! -f '${registrationFile}' ]; then | ||||||
|  |           ${pkgs.matrix-appservice-slack}/bin/matrix-appservice-slack \ | ||||||
|  |             --generate-registration \ | ||||||
|  |             --url=${escapeShellArg cfg.url} \ | ||||||
|  |             ${optionalString (cfg.localpart != null) "--localpart=${escapeShellArg cfg.localpart}"} \ | ||||||
|  |             --config='${settingsFile}' \ | ||||||
|  |             --file='${registrationFile}' | ||||||
|  |         fi | ||||||
|  |       ''; | ||||||
|  | 
 | ||||||
|  |       serviceConfig = { | ||||||
|  |         Type = "simple"; | ||||||
|  |         Restart = "always"; | ||||||
|  | 
 | ||||||
|  |         ProtectSystem = "strict"; | ||||||
|  |         ProtectHome = true; | ||||||
|  |         ProtectKernelTunables = true; | ||||||
|  |         ProtectKernelModules = true; | ||||||
|  |         ProtectControlGroups = true; | ||||||
|  | 
 | ||||||
|  |         DynamicUser = true; | ||||||
|  |         PrivateTmp = true; | ||||||
|  |         #WorkingDirectory = appDir; | ||||||
|  |         StateDirectory = baseNameOf dataDir; | ||||||
|  |         UMask = 0027; | ||||||
|  |         EnvironmentFile = cfg.environmentFile; | ||||||
|  | 
 | ||||||
|  |         ExecStart = '' | ||||||
|  |           ${pkgs.matrix-appservice-slack}/bin/matrix-appservice-slack \ | ||||||
|  |             --file='${registrationFile}' \ | ||||||
|  |             --config='${settingsFile}' \ | ||||||
|  |             --port='${toString cfg.port}' | ||||||
|  |         ''; | ||||||
|  |       }; | ||||||
|  |     }; | ||||||
|  |   }; | ||||||
|  | 
 | ||||||
|  |   meta.maintainers = with maintainers; [ chickensoupandrice ]; | ||||||
|  | } | ||||||
|  | 
 | ||||||
							
								
								
									
										258
									
								
								matrix.nix
									
									
									
									
									
										Normal file
									
								
							
							
						
						
									
										258
									
								
								matrix.nix
									
									
									
									
									
										Normal file
									
								
							|  | @ -0,0 +1,258 @@ | ||||||
|  | { config, lib, pkgs, ... }: | ||||||
|  | 
 | ||||||
|  | { | ||||||
|  |   imports = [ ./matrix-slack.nix ./mautrix-whatsapp.nix ]; | ||||||
|  |   security.acme.email = "anish+acme@lakhwara.com"; | ||||||
|  |   security.acme.acceptTerms = true; | ||||||
|  |   services.matrix-synapse = { | ||||||
|  |     enable = true; | ||||||
|  |     app_service_config_files = [ | ||||||
|  |     #  # The registration file is automatically generated after starting the appservice for the first time. | ||||||
|  |     #  # cp /var/lib/matrix-appservice-discord/discord-registration.yaml /var/lib/matrix-synapse/ | ||||||
|  |     #  # chown matrix-synapse:matrix-synapse /var/lib/matrix-synapse/discord-registration.yaml | ||||||
|  |     #   "/var/lib/matrix-synapse/discord-registration.yaml" | ||||||
|  |        "/var/lib/matrix-synapse/telegram-registration.yaml" | ||||||
|  |        "/var/lib/matrix-synapse/slack-registration.yaml" | ||||||
|  |        "/var/lib/matrix-synapse/whatsapp-registration.yaml" | ||||||
|  |     ]; | ||||||
|  |     server_name = "sealight.xyz"; | ||||||
|  |     registration_shared_secret = "hD9HQGTTDxp0mQsQ5JDsfudWMDiubmZENOgPchIvfBvUlPxlvQSvjoO4wn2L1seU"; | ||||||
|  |     enable_metrics = true; | ||||||
|  |     enable_registration = true; | ||||||
|  |     database_type = "psycopg2"; | ||||||
|  |     database_args = { | ||||||
|  |       database = "matrix-synapse"; | ||||||
|  |     }; | ||||||
|  |     listeners = [ | ||||||
|  |       { | ||||||
|  |         port = 8448; | ||||||
|  |         tls = false; | ||||||
|  |         resources = [ | ||||||
|  |           { | ||||||
|  |             compress = true; | ||||||
|  |             names = ["client" "federation"]; | ||||||
|  |           } | ||||||
|  |         ]; | ||||||
|  |       } | ||||||
|  |     ]; | ||||||
|  |     extraConfig = '' | ||||||
|  |       max_upload_size: "50M" | ||||||
|  |     ''; | ||||||
|  |   }; | ||||||
|  | 
 | ||||||
|  |   services.mautrix-telegram = { | ||||||
|  |     enable = true; | ||||||
|  |     environmentFile = /etc/secrets/telegram.env; # file containing the appservice and telegram tokens | ||||||
|  |     # The appservice is pre-configured to use SQLite by default. It's also possible to use PostgreSQL. | ||||||
|  |     settings = { | ||||||
|  |       homeserver = { | ||||||
|  |         address = "https://chat.sealight.xyz"; | ||||||
|  |         domain = "sealight.xyz"; | ||||||
|  |       }; | ||||||
|  |       appservice = { | ||||||
|  |         provisioning.enabled = false; | ||||||
|  |         id = "telegram"; | ||||||
|  |         public = { | ||||||
|  |           enabled = false; | ||||||
|  |           prefix = "/public"; | ||||||
|  |           external = "https://chat.sealight.xyz/public"; | ||||||
|  |         }; | ||||||
|  |         # The service uses SQLite by default, but it's also possible to use PostgreSQL instead: | ||||||
|  |         #database = "postgresql:///mautrix-telegram?host=/run/postgresql"; | ||||||
|  |       }; | ||||||
|  |       bridge = { | ||||||
|  |         relaybot.authless_portals = false; | ||||||
|  |         permissions = { | ||||||
|  |           "@aynish:sealight.xyz" = "admin"; | ||||||
|  |         }; | ||||||
|  |       }; | ||||||
|  |     }; | ||||||
|  |   }; | ||||||
|  | 
 | ||||||
|  |   services.mautrix-whatsapp = { | ||||||
|  |     enable = true; | ||||||
|  |     # The appservice is pre-configured to use SQLite by default. It's also possible to use PostgreSQL. | ||||||
|  |     configOptions = { | ||||||
|  |       homeserver = { | ||||||
|  |         address = "https://chat.sealight.xyz"; | ||||||
|  |         domain = "sealight.xyz"; | ||||||
|  |       }; | ||||||
|  |       appservice = { | ||||||
|  |         id = "whatsapp"; | ||||||
|  | 	address = http://localhost:9897; | ||||||
|  | 	hostname = "0.0.0.0"; | ||||||
|  | 	port = 9897; | ||||||
|  | 	database = { | ||||||
|  |   	  type = "sqlite3"; | ||||||
|  |   	  uri = "/var/lib/mautrix-whatsapp/mautrix-whatsapp.db"; | ||||||
|  | 	}; | ||||||
|  | 	state_store_path = "/var/lib/mautrix-whatsapp/mx-state.json"; | ||||||
|  | 	bot = { | ||||||
|  | 	  username = "whatsappbot"; | ||||||
|  | 	  displayname = "WhatsApp bridge bot"; | ||||||
|  | 	  avatar = "mxc://maunium.net/NeXNQarUbrlYBiPCpprYsRqr"; | ||||||
|  | 	}; | ||||||
|  | 	as_token = ""; | ||||||
|  | 	hs_token = ""; | ||||||
|  |       }; | ||||||
|  |       bridge = { | ||||||
|  | 	username_template = "whatsapp_{{.}}"; | ||||||
|  | 	displayname_template = "{{if .Notify}}{{.Notify}}{{else}}{{.Jid}}{{end}} (WA)"; | ||||||
|  | 	command_prefix = "!wa"; | ||||||
|  | 	permissions = { | ||||||
|  | 		"@aynish:sealight.xyz" = 100; | ||||||
|  | 	}; | ||||||
|  |       }; | ||||||
|  |       logging = { | ||||||
|  |         directory = "/var/lib/mautrix-whatsapp/logs"; | ||||||
|  | 	file_name_format = "{{.Date}}-{{.Index}}.log"; | ||||||
|  | 	file_date_format = "\"2006-01-02\""; | ||||||
|  | 	file_mode = 384; | ||||||
|  | 	timestamp_format = "Jan _2, 2006 15:04:05"; | ||||||
|  | 	print_level = "debug"; | ||||||
|  |       }; | ||||||
|  |       metrics = { | ||||||
|  | 	enabled = true; | ||||||
|  | 	listen  = "http://localhost:5070"; | ||||||
|  |       }; | ||||||
|  |     }; | ||||||
|  |   }; | ||||||
|  | 
 | ||||||
|  |   services.matrix-appservice-slack = { | ||||||
|  |     enable = true; | ||||||
|  |     #environmentFile = /etc/secrets/matrix-appservice-slack.env; | ||||||
|  |     settings = { | ||||||
|  |       homeserver = { | ||||||
|  |         server_name = "sealight.xyz"; | ||||||
|  |         url = "https://chat.sealight.xyz"; | ||||||
|  |       }; | ||||||
|  |       db = { | ||||||
|  |         engine = "postgres"; | ||||||
|  |         connectionString = "postgres://slackbridge_user:somethingverysecret@localhost/slack_bridge?sslmode=require"; | ||||||
|  |       }; | ||||||
|  |       matrix_admin_room = "!ikEWOHCcmoZtVzSmPF:sealight.xyz"; | ||||||
|  |       username_prefix = "slack_"; | ||||||
|  |       rtm = { | ||||||
|  |         enable = true; | ||||||
|  |         logging = "silent"; | ||||||
|  |       }; | ||||||
|  |       slack_hook_port = 9899; | ||||||
|  |       enable_metrics = true; | ||||||
|  |       puppeting = { | ||||||
|  |         enabled = true; | ||||||
|  |         onboard_users = true; | ||||||
|  |       }; | ||||||
|  |       oauth2 = { | ||||||
|  |         client_id = "2832868673.1609454840563"; | ||||||
|  |         client_secret = "079a7ca42b192e66a9ff32740a69cb9d"; | ||||||
|  |         redirect_prefix = "https://sealight.xyz/slackbridge/"; | ||||||
|  |       }; | ||||||
|  |       #team_sync = { | ||||||
|  |       #  T02QGRJKT = { | ||||||
|  |       #    users = { | ||||||
|  |       #      enabled = false; | ||||||
|  |       #    }; | ||||||
|  |       #    channels = { | ||||||
|  |       #       enabled = true; | ||||||
|  |       #       alias_prefix = "qf_"; | ||||||
|  |       #    }; | ||||||
|  |       #  }; | ||||||
|  |       #}; | ||||||
|  |     }; | ||||||
|  |   }; | ||||||
|  | 
 | ||||||
|  |   services.postgresql = { | ||||||
|  |     enable = true; | ||||||
|  |     ## postgresql user and db name remains in the | ||||||
|  |     ## service.matrix-synapse.database_args setting which | ||||||
|  |     ## by default is matrix-synapse | ||||||
|  |     initialScript = pkgs.writeText "synapse-init.sql" '' | ||||||
|  |         CREATE ROLE "matrix-synapse" WITH LOGIN PASSWORD "Da0?H*9i{x?,]|'kq@iBwlIzu"; | ||||||
|  |         CREATE DATABASE "matrix-synapse" WITH OWNER "matrix-synapse" | ||||||
|  |             TEMPLATE template0 | ||||||
|  |             LC_COLLATE = "C" | ||||||
|  |             LC_CTYPE = "C"; | ||||||
|  |         ''; | ||||||
|  |   }; | ||||||
|  | 
 | ||||||
|  |   networking.firewall = { | ||||||
|  |     enable = true; | ||||||
|  |     allowedTCPPorts = [ | ||||||
|  |       22    # SSH | ||||||
|  |       8448  # Matrix federation | ||||||
|  |       8008 | ||||||
|  |       80  | ||||||
|  |       443 | ||||||
|  |       9899 # Matrix <-> Slack Bridge Puppeting | ||||||
|  |     ]; | ||||||
|  |   }; | ||||||
|  | 
 | ||||||
|  |  nixpkgs.overlays = [ | ||||||
|  |     (self: super: { | ||||||
|  |         element-web = super.element-web.override { | ||||||
|  |             conf = { | ||||||
|  |                  default_server_config = { | ||||||
|  |                     "m.homeserver" = { | ||||||
|  |                         "base_url" = "https://chat.sealight.xyz"; | ||||||
|  |                         "server_name" = "sealight.xyz"; | ||||||
|  |                     }; | ||||||
|  |                     "m.identity_server" = { | ||||||
|  |                         "base_url" = "https://vector.im"; | ||||||
|  |                     }; | ||||||
|  |                  }; | ||||||
|  | 
 | ||||||
|  |                  ## jitsi will be setup later, | ||||||
|  |                  ## but we need to add to Riot configuration | ||||||
|  |                  #jitsi.preferredDomain = "jitsi.dangerousdemos.net"; | ||||||
|  |             }; | ||||||
|  |         }; | ||||||
|  |     }) | ||||||
|  |   ]; | ||||||
|  | 
 | ||||||
|  |   services.nginx = { | ||||||
|  |    enable = true; | ||||||
|  |    virtualHosts = { | ||||||
|  | 
 | ||||||
|  |      "sealight.xyz" = { | ||||||
|  |        forceSSL = true; | ||||||
|  |        enableACME = true; | ||||||
|  |        locations."/" = { | ||||||
|  |          root = "/var/www/sealight.xyz"; | ||||||
|  |        }; | ||||||
|  |        locations."/_matrix" = { | ||||||
|  |          proxyPass = "http://localhost:8448"; | ||||||
|  |        }; | ||||||
|  |        locations."/slackbridge" = { | ||||||
|  |          proxyPass = "http://localhost:9899"; | ||||||
|  |        }; | ||||||
|  |      }; | ||||||
|  |      ## virtual host for Synapse | ||||||
|  |      "chat.sealight.xyz" = { | ||||||
|  |        forceSSL = true; | ||||||
|  |        enableACME = true; | ||||||
|  |        #useACMEHost = "sealight.xyz"; | ||||||
|  |        locations."/" = { | ||||||
|  |          proxyPass = "http://localhost:8448"; | ||||||
|  |        }; | ||||||
|  |      }; | ||||||
|  | 
 | ||||||
|  |      ## virtual host for Riot/Web | ||||||
|  |      "element.sealight.xyz" = { | ||||||
|  |        forceSSL = true; | ||||||
|  |        enableACME = true; | ||||||
|  |        #useACMEHost = "sealight.xyz"; | ||||||
|  | 
 | ||||||
|  |        ## root points to the riot-web package content, also configured via Nix | ||||||
|  |        locations."/" = { | ||||||
|  |            root = pkgs.element-web; | ||||||
|  |        }; | ||||||
|  |      }; | ||||||
|  |    }; | ||||||
|  |    ## other nginx specific best practices | ||||||
|  |    recommendedGzipSettings = true; | ||||||
|  |    recommendedOptimisation = true; | ||||||
|  |    recommendedTlsSettings = true; | ||||||
|  |   }; | ||||||
|  | 
 | ||||||
|  |   environment.systemPackages = with pkgs; [ matrix-appservice-slack ]; | ||||||
|  | } | ||||||
							
								
								
									
										96
									
								
								mautrix-whatsapp.nix
									
									
									
									
									
										Normal file
									
								
							
							
						
						
									
										96
									
								
								mautrix-whatsapp.nix
									
									
									
									
									
										Normal file
									
								
							|  | @ -0,0 +1,96 @@ | ||||||
|  | { lib, config, pkgs, ... }: | ||||||
|  | 
 | ||||||
|  | with lib; | ||||||
|  | 
 | ||||||
|  | let | ||||||
|  |   cfg = config.services.mautrix-whatsapp; | ||||||
|  | 
 | ||||||
|  |   configFile = pkgs.runCommand "mautrix-whatsapp" { | ||||||
|  |     buildInputs = [ pkgs.mautrix-whatsapp pkgs.remarshal ]; | ||||||
|  |     preferLocalBuild = true; | ||||||
|  |   } '' | ||||||
|  |     mkdir -p $out | ||||||
|  |     ${pkgs.remarshal}/bin/json2yaml -i ${pkgs.writeText "config.json" (builtins.toJSON cfg.configOptions)} \ | ||||||
|  |       -o $out/config.yaml | ||||||
|  | 
 | ||||||
|  |     ${pkgs.mautrix-whatsapp}/bin/mautrix-whatsapp -c $out/config.yaml -g -r $out/registration.yaml | ||||||
|  |   ''; | ||||||
|  | 
 | ||||||
|  | in | ||||||
|  | { | ||||||
|  |   options.services.mautrix-whatsapp = { | ||||||
|  |     enable = mkEnableOption "Mautrix-whatsapp, a puppeting bridge between Matrix and WhatsApp."; | ||||||
|  | 
 | ||||||
|  |     configOptions = mkOption { | ||||||
|  |       type = types.attrs; | ||||||
|  |       description = '' | ||||||
|  |         This options will be transform in YAML configuration file for the bridge | ||||||
|  | 
 | ||||||
|  |         Look <link xlink:href="https://github.com/tulir/mautrix-whatsapp/wiki/Bridge-setup">here</link> for documentation. | ||||||
|  |       ''; | ||||||
|  |       example = { | ||||||
|  |         configOptions = { | ||||||
|  |           homeserver = { | ||||||
|  |             address = https://matrix.org; | ||||||
|  |             domain = "matrix.org"; | ||||||
|  |           }; | ||||||
|  |           appservice = { | ||||||
|  |             address = http://localhost:8080; | ||||||
|  |             hostname = "0.0.0.0"; | ||||||
|  |             port = 8080; | ||||||
|  |             database = { | ||||||
|  |               type = "sqlite3"; | ||||||
|  |               uri = "/var/lib/mautrix-whatsapp/mautrix-whatsapp.db"; | ||||||
|  |             }; | ||||||
|  |             state_store_path = "/var/lib/mautrix-whatsapp/mx-state.json"; | ||||||
|  |             id = "whatsapp"; | ||||||
|  |             bot = { | ||||||
|  |               username = "whatsappbot"; | ||||||
|  |               displayname = "WhatsApp bridge bot"; | ||||||
|  |               avatar = "mxc://maunium.net/NeXNQarUbrlYBiPCpprYsRqr"; | ||||||
|  |             }; | ||||||
|  |             as_token = ""; | ||||||
|  |             hs_token = ""; | ||||||
|  |           }; | ||||||
|  |           bridge = { | ||||||
|  |             username_template = "whatsapp_{{.}}"; | ||||||
|  |             displayname_template = "{{if .Notify}}{{.Notify}}{{else}}{{.Jid}}{{end}} (WA)"; | ||||||
|  |             command_prefix = "!wa"; | ||||||
|  |             permissions = { | ||||||
|  |               "@example:matrix.org" = 100; | ||||||
|  |             }; | ||||||
|  |           }; | ||||||
|  |           logging = { | ||||||
|  |             directory = "/var/lib/mautrix-whatsapp/logs"; | ||||||
|  |             file_name_format = "{{.Date}}-{{.Index}}.log"; | ||||||
|  |             file_date_format = "\"2006-01-02\""; | ||||||
|  |             file_mode = 384; | ||||||
|  |             timestamp_format = "Jan _2, 2006 15:04:05"; | ||||||
|  |             print_level = "debug"; | ||||||
|  |           }; | ||||||
|  |         }; | ||||||
|  |       }; | ||||||
|  |     }; | ||||||
|  |   }; | ||||||
|  | 
 | ||||||
|  |   config = mkIf cfg.enable { | ||||||
|  |     systemd.services.mautrix-whatsapp = { | ||||||
|  |       description = "Mautrix-WhatsApp Service - A WhatsApp bridge for Matrix"; | ||||||
|  |       after = [ "network.target" "matrix-synapse.service" ]; | ||||||
|  |       wantedBy = [ "multi-user.target" ]; | ||||||
|  | 
 | ||||||
|  |       serviceConfig = { | ||||||
|  |         DynamicUser = true; | ||||||
|  |         StateDirectory = "mautrix-whatsapp"; | ||||||
|  | 	LoggingDir = "mautrix-whatsapp"; | ||||||
|  |         ExecStart = '' | ||||||
|  |           ${pkgs.mautrix-whatsapp}/bin/mautrix-whatsapp -c "${configFile}/config.yaml" | ||||||
|  |         ''; | ||||||
|  |         Restart = "on-failure"; | ||||||
|  |       }; | ||||||
|  |     }; | ||||||
|  | 
 | ||||||
|  |     #services.matrix-synapse.app_service_config_files = [ "${configFile}/registration.yaml" ]; | ||||||
|  | 
 | ||||||
|  |   }; | ||||||
|  | } | ||||||
							
								
								
									
										17
									
								
								monitoring.nix
									
									
									
									
									
										Normal file
									
								
							
							
						
						
									
										17
									
								
								monitoring.nix
									
									
									
									
									
										Normal file
									
								
							|  | @ -0,0 +1,17 @@ | ||||||
|  | { config, pkgs, ... }: { | ||||||
|  |   # grafana configuration | ||||||
|  |   services.grafana = { | ||||||
|  |     enable = true; | ||||||
|  |     domain = "grafana.sealight.xyz"; | ||||||
|  |     port = 2342; | ||||||
|  |     addr = "127.0.0.1"; | ||||||
|  |   }; | ||||||
|  |    | ||||||
|  |   # nginx reverse proxy | ||||||
|  |   services.nginx.virtualHosts.${config.services.grafana.domain} = { | ||||||
|  |     locations."/" = { | ||||||
|  |         proxyPass = "http://127.0.0.1:${toString config.services.grafana.port}"; | ||||||
|  |         proxyWebsockets = true; | ||||||
|  |     }; | ||||||
|  |   }; | ||||||
|  | } | ||||||
							
								
								
									
										14
									
								
								sealight.nix
									
									
									
									
									
										Normal file
									
								
							
							
						
						
									
										14
									
								
								sealight.nix
									
									
									
									
									
										Normal file
									
								
							|  | @ -0,0 +1,14 @@ | ||||||
|  | { | ||||||
|  |    services.nginx = { | ||||||
|  |       enable = true; | ||||||
|  |       vhost = {  | ||||||
|  | 	  "sealight.xyz" = { | ||||||
|  | 		  forceSSL = true; | ||||||
|  | 		  enableACME = true; | ||||||
|  | 		  locations."/" = { | ||||||
|  | 		    root = "/var/www/sealight.xyz" | ||||||
|  | 		  }; | ||||||
|  |       }; | ||||||
|  |     }; | ||||||
|  |    }; | ||||||
|  | } | ||||||
							
								
								
									
										27
									
								
								wireguard.nix
									
									
									
									
									
										Normal file
									
								
							
							
						
						
									
										27
									
								
								wireguard.nix
									
									
									
									
									
										Normal file
									
								
							|  | @ -0,0 +1,27 @@ | ||||||
|  | { config, pkgs, lib, ... }: | ||||||
|  | {  | ||||||
|  |   environment.systemPackages = [ pkgs.wireguard pkgs.mosh ]; | ||||||
|  |   networking.nat = { | ||||||
|  |       enable = true; | ||||||
|  |       externalInterface = "ens3"; | ||||||
|  |       internalInterfaces = [ "wg0" ]; | ||||||
|  |   }; | ||||||
|  |   networking.firewall = { | ||||||
|  |     allowedUDPPorts = [ 60990 ]; | ||||||
|  |   }; | ||||||
|  | 
 | ||||||
|  |   networking.wireguard.interfaces.wg0 = { | ||||||
|  |     ips = [ "10.0.69.1/24" ]; | ||||||
|  |     listenPort = 60990; | ||||||
|  |     privateKeyFile = "/var/lib/wireguard/priv"; | ||||||
|  |     peers = [{ # bowl | ||||||
|  |       publicKey = "EzvDUmHXo95S2jKRv/LkH5ItUNOBgM7aQQsaq1WfCRw="; | ||||||
|  |       allowedIPs = [ "10.0.69.2/32" ]; | ||||||
|  |     } | ||||||
|  |     { # line | ||||||
|  |       publicKey = "ViRabGV2Mv0SZUVWnoAUhIzaHEvqRXAZJLq3Bp1oN1k="; | ||||||
|  |       allowedIPs = [ "10.0.69.3/32" ]; | ||||||
|  |     } | ||||||
|  | ]; | ||||||
|  |   }; | ||||||
|  | } | ||||||
		Loading…
	
		Reference in a new issue