diff --git a/profiles/matrix/default.nix b/profiles/matrix/default.nix index 72c21f4f..73019e89 100644 --- a/profiles/matrix/default.nix +++ b/profiles/matrix/default.nix @@ -1,6 +1,12 @@ { config, lib, pkgs, ... }: { + imports = [ + ./mautrix-telegram + # ./mjolnir.nix # need to create the mod user + ./heisenbridge.nix + ]; + environment.systemPackages = [ pkgs.matrix-synapse-tools.rust-synapse-compress-state ]; services.matrix-synapse = { enable = true; @@ -43,7 +49,7 @@ extraConfig = '' max_upload_size: "50M" use_presence: false - registration_shared_secret: "hD9HQGTTDxp0mQsQ5JDsfudWMDiubmZENOgPchIvfBvUlPxlvQSvjoO4wn2L1seU"; + registration_shared_secret: "hD9HQGTTDxp0mQsQ5JDsfudWMDiubmZENOgPchIvfBvUlPxlvQSvjoO4wn2L1seU"; # TODO agenix ''; enable_metrics = true; enable_registration = false; @@ -57,38 +63,38 @@ ## and reused here (power of Nix being a real programming language) }; - services.coturn = { - enable = true; - use-auth-secret = true; - static-auth-secret = "jXW1ohIq6wM3NB00xeME3uBihY85xjpkhGoyzBIdwhOpj7gjyxXZu1fwp1lUiYwJ"; # TODO agenix - realm = "turn.sealight.xyz"; - min-port = 49111; - max-port = 51111; - no-cli = true; - no-tcp-relay = true; - no-tls = true; - cert = "${config.security.acme.certs."turn.sealight.xyz".directory}/full.pem"; - pkey = "${config.security.acme.certs."turn.sealight.xyz".directory}/key.pem"; - extraConfig = '' - verbose - user-quota=12 - total-quota=1200 - denied-peer-ip=10.0.0.0-10.255.255.255 - denied-peer-ip=192.168.0.0-192.168.255.255 - denied-peer-ip=172.16.0.0-172.31.255.255 - denied-peer-ip=0.0.0.0-0.255.255.255 - denied-peer-ip=100.64.0.0-100.127.255.255 - denied-peer-ip=127.0.0.0-127.255.255.255 - denied-peer-ip=169.254.0.0-169.254.255.255 - denied-peer-ip=192.0.0.0-192.0.0.255 - denied-peer-ip=192.0.2.0-192.0.2.255 - denied-peer-ip=192.88.99.0-192.88.99.255 - denied-peer-ip=198.18.0.0-198.19.255.255 - denied-peer-ip=198.51.100.0-198.51.100.255 - denied-peer-ip=203.0.113.0-203.0.113.255 - denied-peer-ip=240.0.0.0-255.255.255.255 - ''; - }; + # services.coturn = { + # enable = true; + # use-auth-secret = true; + # static-auth-secret = "jXW1ohIq6wM3NB00xeME3uBihY85xjpkhGoyzBIdwhOpj7gjyxXZu1fwp1lUiYwJ"; # TODO agenix + # realm = "turn.sealight.xyz"; + # min-port = 49111; + # max-port = 51111; + # no-cli = true; + # no-tcp-relay = true; + # no-tls = true; + # cert = "${config.security.acme.certs."turn.sealight.xyz".directory}/full.pem"; + # pkey = "${config.security.acme.certs."turn.sealight.xyz".directory}/key.pem"; + # extraConfig = '' + # verbose + # user-quota=12 + # total-quota=1200 + # denied-peer-ip=10.0.0.0-10.255.255.255 + # denied-peer-ip=192.168.0.0-192.168.255.255 + # denied-peer-ip=172.16.0.0-172.31.255.255 + # denied-peer-ip=0.0.0.0-0.255.255.255 + # denied-peer-ip=100.64.0.0-100.127.255.255 + # denied-peer-ip=127.0.0.0-127.255.255.255 + # denied-peer-ip=169.254.0.0-169.254.255.255 + # denied-peer-ip=192.0.0.0-192.0.0.255 + # denied-peer-ip=192.0.2.0-192.0.2.255 + # denied-peer-ip=192.88.99.0-192.88.99.255 + # denied-peer-ip=198.18.0.0-198.19.255.255 + # denied-peer-ip=198.51.100.0-198.51.100.255 + # denied-peer-ip=203.0.113.0-203.0.113.255 + # denied-peer-ip=240.0.0.0-255.255.255.255 + # ''; + # }; security.acme.certs.${config.services.coturn.realm} = { /* insert here the right configuration to obtain a certificate */ @@ -223,157 +229,4 @@ recommendedTlsSettings = true; }; - services.mautrix-telegram = { - enable = true; - environmentFile = /etc/secrets/telegram.env; # file containing the appservice and telegram tokens - # The appservice is pre-configured to use SQLite by default. It's also possible to use PostgreSQL. - settings = { - homeserver = { - address = "https://sealight.xyz"; - domain = "sealight.xyz"; - }; - appservice = { - provisioning.enabled = false; - id = "telegram"; - bot_username = "telegrambridge"; - public = { - enabled = false; - prefix = "/public"; - external = "https://chat.sealight.xyz/public"; - }; - address = "http://localhost:18787"; - port = 18787; - # The service uses SQLite by default, but it's also possible to use PostgreSQL instead: - #database = "postgresql:///mautrix-telegram?host=/run/postgresql"; - }; - bridge = { - relaybot.authless_portals = false; - permissions = { - "@aynish:sealight.xyz" = "admin"; - }; - }; - }; - }; - - services.sealight.heisenbridge = { - enable = true; - homeserver = "https://sealight.xyz"; - listenPort = 14456; - appServiceToken = "wyujLh8kjpmk2bfKeEE3sZ2gWOEUBKK5"; - homeserverToken = "yEHs7lthD2ZHUibJOAv1APaFhEjxN5PT"; - }; - - - # environment.systemPackages = with pkgs; [ matrix-appservice-slack ]; - #services.mx-puppet-slack= { - #enable = false; - #settings = { - # bridge = { - # bindAddress = "localhost"; - # port = 16786; - # domain = "sealight.xyz"; - # homeserverUrl = "https://sealight.xyz"; - # }; - # provisioning = { - # whitelist = [ "@aynish:sealight.xyz" ]; - # }; - # relay = { - # whitelist = [ "@aynish:sealight.xyz" ]; - # }; - # namePatterns = { - # group = ":name"; - # room = ":name[:team? - :team,]"; - # user = ":name (Slack)"; - # userOverride = ":displayname"; - # }; - # presence = { - # enabled = false; - # }; - # oauth = { - # enabled = false; - # }; - #}; - #serviceDependencies = ["matrix-synapse.service"]; - #}; - - # services.mautrix-whatsapp = { - # enable = false; - # The appservice is pre-configured to use SQLite by default. It's also possible to use PostgreSQL. - #configOptions = { - # homeserver = { - # address = "https://chat.sealight.xyz"; - # domain = "sealight.xyz"; - # }; - # appservice = { - # id = "whatsapp"; - # address = http://localhost:9897; - # hostname = "0.0.0.0"; - # port = 9897; - # database = { - # type = "sqlite3"; - # uri = "/var/lib/mautrix-whatsapp/mautrix-whatsapp.db"; - # }; - # state_store_path = "/var/lib/mautrix-whatsapp/mx-state.json"; - # bot = { - # username = "whatsappbot"; - # displayname = "WhatsApp bridge bot"; - # avatar = "mxc://maunium.net/NeXNQarUbrlYBiPCpprYsRqr"; - # }; - # as_token = ""; - # hs_token = ""; - # }; - # bridge = { - # username_template = "whatsapp_{{.}}"; - # displayname_template = "{{if .Notify}}{{.Notify}}{{else}}{{.Jid}}{{end}} (WA)"; - # command_prefix = "!wa"; - # permissions = { - # "@aynish:sealight.xyz" = 100; - # }; - # }; - # logging = { - # directory = "/var/lib/mautrix-whatsapp/logs"; - # file_name_format = "{{.Date}}-{{.Index}}.log"; - # file_date_format = "\"2006-01-02\""; - # file_mode = 384; - # timestamp_format = "Jan _2, 2006 15:04:05"; - # print_level = "debug"; - # }; - # metrics = { - # enabled = true; - # listen = "http://localhost:5070"; - # }; - #}; - # }; - - #services.mx-puppet-discord = { - # enable = true; - # settings = { - # bridge = { - # bindAddress = "localhost"; - # port = 16785; - # domain = "sealight.xyz"; - # homeserverUrl = "https://sealight.xyz"; - # avatarUrl = "https://discord.com/assets/2d20a45d79110dc5bf947137e9d99b66.svg"; - # }; - # provisioning = { - # whitelist = [ "@aynish:sealight.xyz" ]; - # }; - # relay = { - # whitelist = [ "@aynish:sealight.xyz" ]; - # }; - # namePatterns = { - # group = ":name"; - # room = ":name"; - # user = ":name (Discord)"; - # userOverride = ":displayname"; - # }; - # presence = { - # enabled = false; - # }; - # }; - # serviceDependencies = [ "matrix-synapse.service" ]; - #}; - - - } diff --git a/profiles/matrix/heisenbridge.nix b/profiles/matrix/heisenbridge.nix new file mode 100644 index 00000000..cf83543f --- /dev/null +++ b/profiles/matrix/heisenbridge.nix @@ -0,0 +1,10 @@ +{ pkgs, lib, config, ... }: +{ + services.sealight.heisenbridge = { + enable = true; + homeserver = "https://sealight.xyz"; + listenPort = 14456; + appServiceToken = "wyujLh8kjpmk2bfKeEE3sZ2gWOEUBKK5"; + homeserverToken = "yEHs7lthD2ZHUibJOAv1APaFhEjxN5PT"; + }; +} diff --git a/profiles/matrix/mautrix-telegram.nix b/profiles/matrix/mautrix-telegram.nix new file mode 100644 index 00000000..619995d1 --- /dev/null +++ b/profiles/matrix/mautrix-telegram.nix @@ -0,0 +1,35 @@ +{ config, lib, pkgs, ... }: +{ + services.mautrix-telegram = { + enable = true; + environmentFile = /etc/secrets/telegram.env; # TODO agenix + # TODO use pgsql + # The appservice is pre-configured to use SQLite by default. It's also possible to use PostgreSQL. + settings = { + homeserver = { + address = "https://sealight.xyz"; + domain = "sealight.xyz"; + }; + appservice = { + provisioning.enabled = false; + id = "telegram"; + bot_username = "telegrambridge"; + public = { + enabled = false; + prefix = "/public"; + external = "https://chat.sealight.xyz/public"; + }; + address = "http://localhost:18787"; + port = 18787; + # The service uses SQLite by default, but it's also possible to use PostgreSQL instead: + #database = "postgresql:///mautrix-telegram?host=/run/postgresql"; + }; + bridge = { + relaybot.authless_portals = false; + permissions = { + "@aynish:sealight.xyz" = "admin"; + }; + }; + }; + }; +} diff --git a/profiles/matrix/mjolnir.nix b/profiles/matrix/mjolnir.nix new file mode 100644 index 00000000..912dd422 --- /dev/null +++ b/profiles/matrix/mjolnir.nix @@ -0,0 +1,20 @@ +{ pkgs, lib, config, ... }: +{ + services.mjolnir = { + enable = true; + protectedRooms = [ + "https://matrix.to/#/#public:sealight.xyz" + "https://matrix.to/#/#theFeed:sealight.xyz" + "https://matrix.to/#/#control:sealight.xyz" + ]; + managementRoom = "#control:sealight.xyz"; + homeserverUrl = "https://sealight.xyz"; + + pantalaimon = { + enable = true; + username = "mod"; + passwordFile = "/run/agenix/sealight-mod-password"; # TODO + options.homeserver = config.services.mjolnir.homeserverUrl; + }; + }; +}