helix
This commit is contained in:
		
							parent
							
								
									8af4b6faf9
								
							
						
					
					
						commit
						1ced6b7a3b
					
				
							
								
								
									
										52
									
								
								machines/helix.nix
									
									
									
									
									
										Normal file
									
								
							
							
						
						
									
										52
									
								
								machines/helix.nix
									
									
									
									
									
										Normal file
									
								
							|  | @ -0,0 +1,52 @@ | |||
| { config, pkgs, ... }: | ||||
| { | ||||
|   imports = | ||||
|     [ # Include the results of the hardware scan. | ||||
|       ./hardware-configuration.nix | ||||
|       ./wireguard.nix | ||||
|       ./matrix.nix | ||||
|     ]; | ||||
| 
 | ||||
|   # Use the GRUB 2 boot loader. | ||||
|   boot.loader.grub.enable = true; | ||||
|   boot.loader.grub.version = 2; | ||||
|   boot.loader.grub.device = "/dev/vda"; # or "nodev" for efi only | ||||
| 
 | ||||
|   networking.hostName = "helix"; # Define your hostname. | ||||
| 
 | ||||
|   networking.useDHCP = false; | ||||
|   networking.interfaces.ens3.useDHCP = true; | ||||
| 
 | ||||
|   # Configure network proxy if necessary | ||||
|   # networking.proxy.default = "http://user:password@proxy:port/"; | ||||
|   # networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain"; | ||||
| 
 | ||||
|   # Enable the OpenSSH daemon. | ||||
|   services.openssh.enable = true; | ||||
|   #services.openssh.passwordAuthentication = false; | ||||
|   services.openssh.permitRootLogin = "no"; | ||||
| 
 | ||||
|   # Open ports in the firewall. | ||||
|   # networking.firewall.allowedTCPPorts = [ ... ]; | ||||
|   # networking.firewall.allowedUDPPorts = [ ... ]; | ||||
|   # Or disable the firewall altogether. | ||||
|   # networking.firewall.enable = false; | ||||
| 
 | ||||
|   # Define a user account. Don't forget to set a password with ‘passwd’. | ||||
|   users.users.anish = { | ||||
|     isNormalUser = true; | ||||
|     extraGroups = [ "wheel" ]; # Enable ‘sudo’ for the user | ||||
|     openssh.authorizedKeys.keys = [ | ||||
| 	"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDM8kTdMGGmr6mv/zv+K9qVjhzqwivyyN5IV04R7/kcWKw1c6ZEzzqqmsnJ/hci6IIxZ/VEUzMhYz0iBCL0wJHHMxYoNCgISWePtDlVJdyrzm9OWjJNcRStZBW3XcY9dELJsCVcQ4LAVYE4vA+MdmbwM2FZgJhAH6qUzujpfNrj/YIVG7MTN6tbUd63uZF57F43c8WUjgRJx2o7Wl9bSe6v3PZ4fAgEO+wQPso+W+pEXLZ3hBNrHdybwdoGvG9tHlBDbLid11BxtpzmwR9CydDfpbyOXB2+tJkkNXhsHB22mN/2+vGWYhDKYPTFqbDW7McDfQChySyYDdZWmg5WHIGz anish@curve"   | ||||
| 	"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCeWQsf9rbE+KBrWLkLkg1PMKx0jPfDP8xyv+XtddIQzAskRTN+JSSQp1GpoRgfQij7bx6f6DfjkwSQK5NWDQNQ+klGhcdEwEdptWUzpRAvKHMImjyIwFHmRKKEgcfH8+DSHVM93nRSQKrLezX4PzPkHF9f3TLxFdGeQDeY0J2oP2Oa97hRtuTJZW9BwUojyvDYUbg7F3fxf+pdFCvIAFaayiLkhOYdTXnjLt1Ks6NOhSzM78ZibHv4pFYI9r6dhflkFP/SzyLeSSm1aVAtxqE7vF5HnnORAg0byDsiOv/9RXxiDx7gkAAw3xENDSpp9TRj54M7iz1OSsRMhmD6orHjZFIRejlE4DIn+PBPm3PH+U5ILKTogE6n5MfPT28V0QdtHuqq3b5tSWiDcFpnjxbIUmEIo5hLzMR0tXZoNLQhBCSNfxjE8CYzpk7mHbvhSs2GPfG+NI1vvldbw2EF8beJFQHNYTqJw8y7p8RXpCwZqqpSitJX6v9DiYdLVG1hWvE= nix-on-droid@localhost" | ||||
| 	 "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDKN8/SH55DBiwVoSnTU8k2Pen+wmovL9QaMyehxGEsJJv/8fzwsswGalD4C/4O51LOvdu4UKkZW5hG02uVSK+58p3UV3pOPyoqsu/aDeIsWsqmTeTzUrBIWOlNzcDKnohLz2oGC5YO+wyTJ9Iteq6aGJDjErsW7sG3h5lXCs551EmJNNGhtBQaaoytMNnWqSdlVjDNCijurH7WUpp40U/RjEp532l4rX6eIIj3jBKEFbhZkFSSjqbj4xM4SyFt+Jmigb1RMjsQjmpfY1vDtM84RcYfpTUte/T5w2dkD5H6kccmWnwKSJpm9wXfx4E7lR9APdUGnau2U1+XxiD3ytGl anish@box" ]; | ||||
|   }; | ||||
| 
 | ||||
|   # This value determines the NixOS release with which your system is to be | ||||
|   # compatible, in order to avoid breaking some software such as database | ||||
|   # servers. You should change this only after NixOS release notes say you | ||||
|   # should. | ||||
|   system.stateVersion = "19.09"; # Did you read the comment? | ||||
| 
 | ||||
| } | ||||
| 
 | ||||
							
								
								
									
										153
									
								
								matrix-slack.nix
									
									
									
									
									
										Normal file
									
								
							
							
						
						
									
										153
									
								
								matrix-slack.nix
									
									
									
									
									
										Normal file
									
								
							|  | @ -0,0 +1,153 @@ | |||
| { config, pkgs, lib, ... }: | ||||
| 
 | ||||
| with lib; | ||||
| 
 | ||||
| let | ||||
|   dataDir = "/var/lib/matrix-appservice-slack"; | ||||
|   registrationFile = "${dataDir}/slack-registration.yaml"; | ||||
|   #appDir = "${pkgs.matrix-appservice-slack}/${pkgs.matrix-appservice-slack.passthru.nodeAppDir}"; | ||||
|   cfg = config.services.matrix-appservice-slack; | ||||
|   # TODO: switch to configGen.json once RFC42 is implemented | ||||
|   settingsFile = pkgs.writeText "matrix-appservice-slack-settings.json" (builtins.toJSON cfg.settings); | ||||
| 
 | ||||
| in { | ||||
|   options = { | ||||
|     services.matrix-appservice-slack = { | ||||
|       enable = mkEnableOption "a bridge between Matrix and Slack"; | ||||
| 
 | ||||
|       settings = mkOption rec { | ||||
|         # TODO: switch to types.config.json as prescribed by RFC42 once it's implemented | ||||
|         type = types.attrs; | ||||
|         apply = recursiveUpdate default; | ||||
|         default = { | ||||
|           # empty values necessary for registration file generation | ||||
|           # actual values defined in environmentFile | ||||
|           auth = { | ||||
|             clientID = ""; | ||||
|             botToken = ""; | ||||
|           }; | ||||
|         }; | ||||
|         example = literalExample '' | ||||
|           { | ||||
|             bridge = { | ||||
|               domain = "public-domain.tld"; | ||||
|               homeserverUrl = "http://public-domain.tld:8008"; | ||||
|             }; | ||||
|           } | ||||
|         ''; | ||||
|         description = '' | ||||
|           <filename>config.yaml</filename> configuration as a Nix attribute set. | ||||
|           </para> | ||||
| 
 | ||||
|           <para> | ||||
|           Configuration options should match those described in | ||||
|           <link xlink:href="https://github.com/Half-Shot/matrix-appservice-discord/blob/master/config/config.sample.yaml"> | ||||
|           config.sample.yaml</link>. | ||||
|           </para> | ||||
| 
 | ||||
|           <para> | ||||
|           <option>config.bridge.domain</option> and <option>config.bridge.homeserverUrl</option> | ||||
|           should be set to match the public host name of the Matrix homeserver for webhooks and avatars to work. | ||||
|           </para> | ||||
| 
 | ||||
|           <para> | ||||
|           Secret tokens should be specified using <option>environmentFile</option> | ||||
|           instead of this world-readable attribute set. | ||||
|         ''; | ||||
|       }; | ||||
| 
 | ||||
|       environmentFile = mkOption { | ||||
|         type = types.nullOr types.path; | ||||
|         default = null; | ||||
|         description = '' | ||||
|           File containing environment variables to be passed to the matrix-appservice-discord service, | ||||
|           in which secret tokens can be specified securely by defining values for | ||||
|           <literal>APPSERVICE_SLACK_AUTH_CLIENT_I_D</literal> and | ||||
|           <literal>APPSERVICE_SLACK_AUTH_BOT_TOKEN</literal>. | ||||
|         ''; | ||||
|       }; | ||||
| 
 | ||||
|       url = mkOption { | ||||
|         type = types.str; | ||||
|         default = "http://localhost:${toString cfg.port}"; | ||||
|         description = '' | ||||
|           The URL where the application service is listening for HS requests. | ||||
|         ''; | ||||
|       }; | ||||
| 
 | ||||
|       port = mkOption { | ||||
|         type = types.port; | ||||
|         default = 9898; # from https://github.com/matrix-org/matrix-appservice-slack/blob/develop/config/config.sample.yaml#L70 | ||||
|         description = '' | ||||
|           Port number on which the bridge should listen for internal communication with the Matrix homeserver. | ||||
|         ''; | ||||
|       }; | ||||
| 
 | ||||
|       localpart = mkOption { | ||||
|         type = with types; nullOr str; | ||||
|         default = null; | ||||
|         description = '' | ||||
|           The user_id localpart to assign to the AS. | ||||
|         ''; | ||||
|       }; | ||||
| 
 | ||||
|       serviceDependencies = mkOption { | ||||
|         type = with types; listOf str; | ||||
|         default = optional config.services.matrix-synapse.enable "matrix-synapse.service"; | ||||
|         description = '' | ||||
|           List of Systemd services to require and wait for when starting the application service, | ||||
|           such as the Matrix homeserver if it's running on the same host. | ||||
|         ''; | ||||
|       }; | ||||
|     }; | ||||
|   }; | ||||
| 
 | ||||
|   config = mkIf cfg.enable { | ||||
|     systemd.services.matrix-appservice-slack = { | ||||
|       description = "A bridge between Matrix and Slack."; | ||||
| 
 | ||||
|       wantedBy = [ "multi-user.target" ]; | ||||
|       wants = [ "network-online.target" ] ++ cfg.serviceDependencies; | ||||
|       after = [ "network-online.target" ] ++ cfg.serviceDependencies; | ||||
| 
 | ||||
|       preStart = '' | ||||
|         if [ ! -f '${registrationFile}' ]; then | ||||
|           ${pkgs.matrix-appservice-slack}/bin/matrix-appservice-slack \ | ||||
|             --generate-registration \ | ||||
|             --url=${escapeShellArg cfg.url} \ | ||||
|             ${optionalString (cfg.localpart != null) "--localpart=${escapeShellArg cfg.localpart}"} \ | ||||
|             --config='${settingsFile}' \ | ||||
|             --file='${registrationFile}' | ||||
|         fi | ||||
|       ''; | ||||
| 
 | ||||
|       serviceConfig = { | ||||
|         Type = "simple"; | ||||
|         Restart = "always"; | ||||
| 
 | ||||
|         ProtectSystem = "strict"; | ||||
|         ProtectHome = true; | ||||
|         ProtectKernelTunables = true; | ||||
|         ProtectKernelModules = true; | ||||
|         ProtectControlGroups = true; | ||||
| 
 | ||||
|         DynamicUser = true; | ||||
|         PrivateTmp = true; | ||||
|         #WorkingDirectory = appDir; | ||||
|         StateDirectory = baseNameOf dataDir; | ||||
|         UMask = 0027; | ||||
|         EnvironmentFile = cfg.environmentFile; | ||||
| 
 | ||||
|         ExecStart = '' | ||||
|           ${pkgs.matrix-appservice-slack}/bin/matrix-appservice-slack \ | ||||
|             --file='${registrationFile}' \ | ||||
|             --config='${settingsFile}' \ | ||||
|             --port='${toString cfg.port}' | ||||
|         ''; | ||||
|       }; | ||||
|     }; | ||||
|   }; | ||||
| 
 | ||||
|   meta.maintainers = with maintainers; [ chickensoupandrice ]; | ||||
| } | ||||
| 
 | ||||
							
								
								
									
										258
									
								
								matrix.nix
									
									
									
									
									
										Normal file
									
								
							
							
						
						
									
										258
									
								
								matrix.nix
									
									
									
									
									
										Normal file
									
								
							|  | @ -0,0 +1,258 @@ | |||
| { config, lib, pkgs, ... }: | ||||
| 
 | ||||
| { | ||||
|   imports = [ ./matrix-slack.nix ./mautrix-whatsapp.nix ]; | ||||
|   security.acme.email = "anish+acme@lakhwara.com"; | ||||
|   security.acme.acceptTerms = true; | ||||
|   services.matrix-synapse = { | ||||
|     enable = true; | ||||
|     app_service_config_files = [ | ||||
|     #  # The registration file is automatically generated after starting the appservice for the first time. | ||||
|     #  # cp /var/lib/matrix-appservice-discord/discord-registration.yaml /var/lib/matrix-synapse/ | ||||
|     #  # chown matrix-synapse:matrix-synapse /var/lib/matrix-synapse/discord-registration.yaml | ||||
|     #   "/var/lib/matrix-synapse/discord-registration.yaml" | ||||
|        "/var/lib/matrix-synapse/telegram-registration.yaml" | ||||
|        "/var/lib/matrix-synapse/slack-registration.yaml" | ||||
|        "/var/lib/matrix-synapse/whatsapp-registration.yaml" | ||||
|     ]; | ||||
|     server_name = "sealight.xyz"; | ||||
|     registration_shared_secret = "hD9HQGTTDxp0mQsQ5JDsfudWMDiubmZENOgPchIvfBvUlPxlvQSvjoO4wn2L1seU"; | ||||
|     enable_metrics = true; | ||||
|     enable_registration = true; | ||||
|     database_type = "psycopg2"; | ||||
|     database_args = { | ||||
|       database = "matrix-synapse"; | ||||
|     }; | ||||
|     listeners = [ | ||||
|       { | ||||
|         port = 8448; | ||||
|         tls = false; | ||||
|         resources = [ | ||||
|           { | ||||
|             compress = true; | ||||
|             names = ["client" "federation"]; | ||||
|           } | ||||
|         ]; | ||||
|       } | ||||
|     ]; | ||||
|     extraConfig = '' | ||||
|       max_upload_size: "50M" | ||||
|     ''; | ||||
|   }; | ||||
| 
 | ||||
|   services.mautrix-telegram = { | ||||
|     enable = true; | ||||
|     environmentFile = /etc/secrets/telegram.env; # file containing the appservice and telegram tokens | ||||
|     # The appservice is pre-configured to use SQLite by default. It's also possible to use PostgreSQL. | ||||
|     settings = { | ||||
|       homeserver = { | ||||
|         address = "https://chat.sealight.xyz"; | ||||
|         domain = "sealight.xyz"; | ||||
|       }; | ||||
|       appservice = { | ||||
|         provisioning.enabled = false; | ||||
|         id = "telegram"; | ||||
|         public = { | ||||
|           enabled = false; | ||||
|           prefix = "/public"; | ||||
|           external = "https://chat.sealight.xyz/public"; | ||||
|         }; | ||||
|         # The service uses SQLite by default, but it's also possible to use PostgreSQL instead: | ||||
|         #database = "postgresql:///mautrix-telegram?host=/run/postgresql"; | ||||
|       }; | ||||
|       bridge = { | ||||
|         relaybot.authless_portals = false; | ||||
|         permissions = { | ||||
|           "@aynish:sealight.xyz" = "admin"; | ||||
|         }; | ||||
|       }; | ||||
|     }; | ||||
|   }; | ||||
| 
 | ||||
|   services.mautrix-whatsapp = { | ||||
|     enable = true; | ||||
|     # The appservice is pre-configured to use SQLite by default. It's also possible to use PostgreSQL. | ||||
|     configOptions = { | ||||
|       homeserver = { | ||||
|         address = "https://chat.sealight.xyz"; | ||||
|         domain = "sealight.xyz"; | ||||
|       }; | ||||
|       appservice = { | ||||
|         id = "whatsapp"; | ||||
| 	address = http://localhost:9897; | ||||
| 	hostname = "0.0.0.0"; | ||||
| 	port = 9897; | ||||
| 	database = { | ||||
|   	  type = "sqlite3"; | ||||
|   	  uri = "/var/lib/mautrix-whatsapp/mautrix-whatsapp.db"; | ||||
| 	}; | ||||
| 	state_store_path = "/var/lib/mautrix-whatsapp/mx-state.json"; | ||||
| 	bot = { | ||||
| 	  username = "whatsappbot"; | ||||
| 	  displayname = "WhatsApp bridge bot"; | ||||
| 	  avatar = "mxc://maunium.net/NeXNQarUbrlYBiPCpprYsRqr"; | ||||
| 	}; | ||||
| 	as_token = ""; | ||||
| 	hs_token = ""; | ||||
|       }; | ||||
|       bridge = { | ||||
| 	username_template = "whatsapp_{{.}}"; | ||||
| 	displayname_template = "{{if .Notify}}{{.Notify}}{{else}}{{.Jid}}{{end}} (WA)"; | ||||
| 	command_prefix = "!wa"; | ||||
| 	permissions = { | ||||
| 		"@aynish:sealight.xyz" = 100; | ||||
| 	}; | ||||
|       }; | ||||
|       logging = { | ||||
|         directory = "/var/lib/mautrix-whatsapp/logs"; | ||||
| 	file_name_format = "{{.Date}}-{{.Index}}.log"; | ||||
| 	file_date_format = "\"2006-01-02\""; | ||||
| 	file_mode = 384; | ||||
| 	timestamp_format = "Jan _2, 2006 15:04:05"; | ||||
| 	print_level = "debug"; | ||||
|       }; | ||||
|       metrics = { | ||||
| 	enabled = true; | ||||
| 	listen  = "http://localhost:5070"; | ||||
|       }; | ||||
|     }; | ||||
|   }; | ||||
| 
 | ||||
|   services.matrix-appservice-slack = { | ||||
|     enable = true; | ||||
|     #environmentFile = /etc/secrets/matrix-appservice-slack.env; | ||||
|     settings = { | ||||
|       homeserver = { | ||||
|         server_name = "sealight.xyz"; | ||||
|         url = "https://chat.sealight.xyz"; | ||||
|       }; | ||||
|       db = { | ||||
|         engine = "postgres"; | ||||
|         connectionString = "postgres://slackbridge_user:somethingverysecret@localhost/slack_bridge?sslmode=require"; | ||||
|       }; | ||||
|       matrix_admin_room = "!ikEWOHCcmoZtVzSmPF:sealight.xyz"; | ||||
|       username_prefix = "slack_"; | ||||
|       rtm = { | ||||
|         enable = true; | ||||
|         logging = "silent"; | ||||
|       }; | ||||
|       slack_hook_port = 9899; | ||||
|       enable_metrics = true; | ||||
|       puppeting = { | ||||
|         enabled = true; | ||||
|         onboard_users = true; | ||||
|       }; | ||||
|       oauth2 = { | ||||
|         client_id = "2832868673.1609454840563"; | ||||
|         client_secret = "079a7ca42b192e66a9ff32740a69cb9d"; | ||||
|         redirect_prefix = "https://sealight.xyz/slackbridge/"; | ||||
|       }; | ||||
|       #team_sync = { | ||||
|       #  T02QGRJKT = { | ||||
|       #    users = { | ||||
|       #      enabled = false; | ||||
|       #    }; | ||||
|       #    channels = { | ||||
|       #       enabled = true; | ||||
|       #       alias_prefix = "qf_"; | ||||
|       #    }; | ||||
|       #  }; | ||||
|       #}; | ||||
|     }; | ||||
|   }; | ||||
| 
 | ||||
|   services.postgresql = { | ||||
|     enable = true; | ||||
|     ## postgresql user and db name remains in the | ||||
|     ## service.matrix-synapse.database_args setting which | ||||
|     ## by default is matrix-synapse | ||||
|     initialScript = pkgs.writeText "synapse-init.sql" '' | ||||
|         CREATE ROLE "matrix-synapse" WITH LOGIN PASSWORD "Da0?H*9i{x?,]|'kq@iBwlIzu"; | ||||
|         CREATE DATABASE "matrix-synapse" WITH OWNER "matrix-synapse" | ||||
|             TEMPLATE template0 | ||||
|             LC_COLLATE = "C" | ||||
|             LC_CTYPE = "C"; | ||||
|         ''; | ||||
|   }; | ||||
| 
 | ||||
|   networking.firewall = { | ||||
|     enable = true; | ||||
|     allowedTCPPorts = [ | ||||
|       22    # SSH | ||||
|       8448  # Matrix federation | ||||
|       8008 | ||||
|       80  | ||||
|       443 | ||||
|       9899 # Matrix <-> Slack Bridge Puppeting | ||||
|     ]; | ||||
|   }; | ||||
| 
 | ||||
|  nixpkgs.overlays = [ | ||||
|     (self: super: { | ||||
|         element-web = super.element-web.override { | ||||
|             conf = { | ||||
|                  default_server_config = { | ||||
|                     "m.homeserver" = { | ||||
|                         "base_url" = "https://chat.sealight.xyz"; | ||||
|                         "server_name" = "sealight.xyz"; | ||||
|                     }; | ||||
|                     "m.identity_server" = { | ||||
|                         "base_url" = "https://vector.im"; | ||||
|                     }; | ||||
|                  }; | ||||
| 
 | ||||
|                  ## jitsi will be setup later, | ||||
|                  ## but we need to add to Riot configuration | ||||
|                  #jitsi.preferredDomain = "jitsi.dangerousdemos.net"; | ||||
|             }; | ||||
|         }; | ||||
|     }) | ||||
|   ]; | ||||
| 
 | ||||
|   services.nginx = { | ||||
|    enable = true; | ||||
|    virtualHosts = { | ||||
| 
 | ||||
|      "sealight.xyz" = { | ||||
|        forceSSL = true; | ||||
|        enableACME = true; | ||||
|        locations."/" = { | ||||
|          root = "/var/www/sealight.xyz"; | ||||
|        }; | ||||
|        locations."/_matrix" = { | ||||
|          proxyPass = "http://localhost:8448"; | ||||
|        }; | ||||
|        locations."/slackbridge" = { | ||||
|          proxyPass = "http://localhost:9899"; | ||||
|        }; | ||||
|      }; | ||||
|      ## virtual host for Synapse | ||||
|      "chat.sealight.xyz" = { | ||||
|        forceSSL = true; | ||||
|        enableACME = true; | ||||
|        #useACMEHost = "sealight.xyz"; | ||||
|        locations."/" = { | ||||
|          proxyPass = "http://localhost:8448"; | ||||
|        }; | ||||
|      }; | ||||
| 
 | ||||
|      ## virtual host for Riot/Web | ||||
|      "element.sealight.xyz" = { | ||||
|        forceSSL = true; | ||||
|        enableACME = true; | ||||
|        #useACMEHost = "sealight.xyz"; | ||||
| 
 | ||||
|        ## root points to the riot-web package content, also configured via Nix | ||||
|        locations."/" = { | ||||
|            root = pkgs.element-web; | ||||
|        }; | ||||
|      }; | ||||
|    }; | ||||
|    ## other nginx specific best practices | ||||
|    recommendedGzipSettings = true; | ||||
|    recommendedOptimisation = true; | ||||
|    recommendedTlsSettings = true; | ||||
|   }; | ||||
| 
 | ||||
|   environment.systemPackages = with pkgs; [ matrix-appservice-slack ]; | ||||
| } | ||||
							
								
								
									
										96
									
								
								mautrix-whatsapp.nix
									
									
									
									
									
										Normal file
									
								
							
							
						
						
									
										96
									
								
								mautrix-whatsapp.nix
									
									
									
									
									
										Normal file
									
								
							|  | @ -0,0 +1,96 @@ | |||
| { lib, config, pkgs, ... }: | ||||
| 
 | ||||
| with lib; | ||||
| 
 | ||||
| let | ||||
|   cfg = config.services.mautrix-whatsapp; | ||||
| 
 | ||||
|   configFile = pkgs.runCommand "mautrix-whatsapp" { | ||||
|     buildInputs = [ pkgs.mautrix-whatsapp pkgs.remarshal ]; | ||||
|     preferLocalBuild = true; | ||||
|   } '' | ||||
|     mkdir -p $out | ||||
|     ${pkgs.remarshal}/bin/json2yaml -i ${pkgs.writeText "config.json" (builtins.toJSON cfg.configOptions)} \ | ||||
|       -o $out/config.yaml | ||||
| 
 | ||||
|     ${pkgs.mautrix-whatsapp}/bin/mautrix-whatsapp -c $out/config.yaml -g -r $out/registration.yaml | ||||
|   ''; | ||||
| 
 | ||||
| in | ||||
| { | ||||
|   options.services.mautrix-whatsapp = { | ||||
|     enable = mkEnableOption "Mautrix-whatsapp, a puppeting bridge between Matrix and WhatsApp."; | ||||
| 
 | ||||
|     configOptions = mkOption { | ||||
|       type = types.attrs; | ||||
|       description = '' | ||||
|         This options will be transform in YAML configuration file for the bridge | ||||
| 
 | ||||
|         Look <link xlink:href="https://github.com/tulir/mautrix-whatsapp/wiki/Bridge-setup">here</link> for documentation. | ||||
|       ''; | ||||
|       example = { | ||||
|         configOptions = { | ||||
|           homeserver = { | ||||
|             address = https://matrix.org; | ||||
|             domain = "matrix.org"; | ||||
|           }; | ||||
|           appservice = { | ||||
|             address = http://localhost:8080; | ||||
|             hostname = "0.0.0.0"; | ||||
|             port = 8080; | ||||
|             database = { | ||||
|               type = "sqlite3"; | ||||
|               uri = "/var/lib/mautrix-whatsapp/mautrix-whatsapp.db"; | ||||
|             }; | ||||
|             state_store_path = "/var/lib/mautrix-whatsapp/mx-state.json"; | ||||
|             id = "whatsapp"; | ||||
|             bot = { | ||||
|               username = "whatsappbot"; | ||||
|               displayname = "WhatsApp bridge bot"; | ||||
|               avatar = "mxc://maunium.net/NeXNQarUbrlYBiPCpprYsRqr"; | ||||
|             }; | ||||
|             as_token = ""; | ||||
|             hs_token = ""; | ||||
|           }; | ||||
|           bridge = { | ||||
|             username_template = "whatsapp_{{.}}"; | ||||
|             displayname_template = "{{if .Notify}}{{.Notify}}{{else}}{{.Jid}}{{end}} (WA)"; | ||||
|             command_prefix = "!wa"; | ||||
|             permissions = { | ||||
|               "@example:matrix.org" = 100; | ||||
|             }; | ||||
|           }; | ||||
|           logging = { | ||||
|             directory = "/var/lib/mautrix-whatsapp/logs"; | ||||
|             file_name_format = "{{.Date}}-{{.Index}}.log"; | ||||
|             file_date_format = "\"2006-01-02\""; | ||||
|             file_mode = 384; | ||||
|             timestamp_format = "Jan _2, 2006 15:04:05"; | ||||
|             print_level = "debug"; | ||||
|           }; | ||||
|         }; | ||||
|       }; | ||||
|     }; | ||||
|   }; | ||||
| 
 | ||||
|   config = mkIf cfg.enable { | ||||
|     systemd.services.mautrix-whatsapp = { | ||||
|       description = "Mautrix-WhatsApp Service - A WhatsApp bridge for Matrix"; | ||||
|       after = [ "network.target" "matrix-synapse.service" ]; | ||||
|       wantedBy = [ "multi-user.target" ]; | ||||
| 
 | ||||
|       serviceConfig = { | ||||
|         DynamicUser = true; | ||||
|         StateDirectory = "mautrix-whatsapp"; | ||||
| 	LoggingDir = "mautrix-whatsapp"; | ||||
|         ExecStart = '' | ||||
|           ${pkgs.mautrix-whatsapp}/bin/mautrix-whatsapp -c "${configFile}/config.yaml" | ||||
|         ''; | ||||
|         Restart = "on-failure"; | ||||
|       }; | ||||
|     }; | ||||
| 
 | ||||
|     #services.matrix-synapse.app_service_config_files = [ "${configFile}/registration.yaml" ]; | ||||
| 
 | ||||
|   }; | ||||
| } | ||||
							
								
								
									
										17
									
								
								monitoring.nix
									
									
									
									
									
										Normal file
									
								
							
							
						
						
									
										17
									
								
								monitoring.nix
									
									
									
									
									
										Normal file
									
								
							|  | @ -0,0 +1,17 @@ | |||
| { config, pkgs, ... }: { | ||||
|   # grafana configuration | ||||
|   services.grafana = { | ||||
|     enable = true; | ||||
|     domain = "grafana.sealight.xyz"; | ||||
|     port = 2342; | ||||
|     addr = "127.0.0.1"; | ||||
|   }; | ||||
|    | ||||
|   # nginx reverse proxy | ||||
|   services.nginx.virtualHosts.${config.services.grafana.domain} = { | ||||
|     locations."/" = { | ||||
|         proxyPass = "http://127.0.0.1:${toString config.services.grafana.port}"; | ||||
|         proxyWebsockets = true; | ||||
|     }; | ||||
|   }; | ||||
| } | ||||
							
								
								
									
										14
									
								
								sealight.nix
									
									
									
									
									
										Normal file
									
								
							
							
						
						
									
										14
									
								
								sealight.nix
									
									
									
									
									
										Normal file
									
								
							|  | @ -0,0 +1,14 @@ | |||
| { | ||||
|    services.nginx = { | ||||
|       enable = true; | ||||
|       vhost = {  | ||||
| 	  "sealight.xyz" = { | ||||
| 		  forceSSL = true; | ||||
| 		  enableACME = true; | ||||
| 		  locations."/" = { | ||||
| 		    root = "/var/www/sealight.xyz" | ||||
| 		  }; | ||||
|       }; | ||||
|     }; | ||||
|    }; | ||||
| } | ||||
							
								
								
									
										27
									
								
								wireguard.nix
									
									
									
									
									
										Normal file
									
								
							
							
						
						
									
										27
									
								
								wireguard.nix
									
									
									
									
									
										Normal file
									
								
							|  | @ -0,0 +1,27 @@ | |||
| { config, pkgs, lib, ... }: | ||||
| {  | ||||
|   environment.systemPackages = [ pkgs.wireguard pkgs.mosh ]; | ||||
|   networking.nat = { | ||||
|       enable = true; | ||||
|       externalInterface = "ens3"; | ||||
|       internalInterfaces = [ "wg0" ]; | ||||
|   }; | ||||
|   networking.firewall = { | ||||
|     allowedUDPPorts = [ 60990 ]; | ||||
|   }; | ||||
| 
 | ||||
|   networking.wireguard.interfaces.wg0 = { | ||||
|     ips = [ "10.0.69.1/24" ]; | ||||
|     listenPort = 60990; | ||||
|     privateKeyFile = "/var/lib/wireguard/priv"; | ||||
|     peers = [{ # bowl | ||||
|       publicKey = "EzvDUmHXo95S2jKRv/LkH5ItUNOBgM7aQQsaq1WfCRw="; | ||||
|       allowedIPs = [ "10.0.69.2/32" ]; | ||||
|     } | ||||
|     { # line | ||||
|       publicKey = "ViRabGV2Mv0SZUVWnoAUhIzaHEvqRXAZJLq3Bp1oN1k="; | ||||
|       allowedIPs = [ "10.0.69.3/32" ]; | ||||
|     } | ||||
| ]; | ||||
|   }; | ||||
| } | ||||
		Loading…
	
		Reference in a new issue