From 8edbb5589fb6d5d3469bb8a073c39bd9c36ff1b1 Mon Sep 17 00:00:00 2001 From: Adithya Nair Date: Sun, 24 Nov 2024 18:35:22 +0530 Subject: [PATCH] add module for conduwuit --- flake.nix | 1 + modules/conduwuit.nix | 174 ++++++++++++++++++++++++++++++++++++++++++ modules/default.nix | 5 ++ 3 files changed, 180 insertions(+) create mode 100644 modules/conduwuit.nix create mode 100644 modules/default.nix diff --git a/flake.nix b/flake.nix index aeb1c37..a334213 100644 --- a/flake.nix +++ b/flake.nix @@ -13,6 +13,7 @@ }; in { + nixosModules.default = import ./modules; overlays.default = import ./overlay.nix; packages.x86_64-linux.autobrr = pkgs_x86_64-linux.callPackage ./packages/autobrr { }; packages.aarch64-linux.autobrr = pkgs_aarch64-linux.callPackage ./packages/autobrr { }; diff --git a/modules/conduwuit.nix b/modules/conduwuit.nix new file mode 100644 index 0000000..4232f91 --- /dev/null +++ b/modules/conduwuit.nix @@ -0,0 +1,174 @@ +{ config, lib, pkgs, ... }: +let + cfg = config.recipes.conduwuit; + + format = pkgs.formats.toml { }; + configFile = format.generate "conduwuit.toml" cfg.settings; +in +{ + meta.maintainers = with lib.maintainers; [ adtya ]; + options.recipes.conduwuit = { + enable = lib.mkEnableOption "conduwuit"; + + extraEnvironment = lib.mkOption { + type = lib.types.attrsOf lib.types.str; + description = "Extra Environment variables to pass to the conduwuit server."; + default = { }; + example = { RUST_BACKTRACE = true; }; + }; + + package = lib.mkPackageOption pkgs "conduwuit" { }; + + settings = lib.mkOption { + type = lib.types.submodule { + freeformType = format.type; + options = { + global.server_name = lib.mkOption { + type = lib.types.str; + example = "example.com"; + description = "The server_name is the name of this server. It is used as a suffix for user # and room ids."; + }; + global.port = lib.mkOption { + type = lib.types.port; + default = 6167; + description = "The port Conduit will be running on. You need to set up a reverse proxy in your web server (e.g. apache or nginx), so all requests to /_matrix on port 443 and 8448 will be forwarded to the Conduit instance running on this port"; + }; + global.max_request_size = lib.mkOption { + type = lib.types.ints.positive; + default = 20000000; + description = "Max request size in bytes. Don't forget to also change it in the proxy."; + }; + global.allow_registration = lib.mkOption { + type = lib.types.bool; + default = false; + description = "Whether new users can register on this server."; + }; + global.allow_encryption = lib.mkOption { + type = lib.types.bool; + default = true; + description = "Whether new encrypted rooms can be created. Note: existing rooms will continue to work."; + }; + global.allow_federation = lib.mkOption { + type = lib.types.bool; + default = true; + description = '' + Whether this server federates with other servers. + ''; + }; + global.trusted_servers = lib.mkOption { + type = lib.types.listOf lib.types.str; + default = [ "matrix.org" ]; + description = "Servers trusted with signing server keys."; + }; + global.address = lib.mkOption { + type = lib.types.str; + default = "::1"; + description = "Address to listen on for connections by the reverse proxy/tls terminator."; + }; + global.database_path = lib.mkOption { + type = lib.types.str; + default = "/var/lib/conduwuit/"; + readOnly = true; + description = '' + Path to the conduwuit database, the directory where conduwuit will save its data. + Note that due to using the DynamicUser feature of systemd, this value should not be changed + and is set to be read only. + ''; + }; + global.database_backend = lib.mkOption { + type = lib.types.enum [ "sqlite" "rocksdb" ]; + default = "sqlite"; + example = "rocksdb"; + description = '' + The database backend for the service. Switching it on an existing + instance will require manual migration of data. + ''; + }; + global.allow_check_for_updates = lib.mkOption { + type = lib.types.bool; + default = false; + description = '' + Whether to allow Conduit to automatically contact + hourly to check for important Conduit news. + + Disabled by default because nixpkgs handles updates. + ''; + }; + }; + }; + default = { }; + description = '' + Generates the conduwuit.toml configuration file. Refer to + + for details on supported values. + Note that database_path can not be edited because the service's reliance on systemd StateDir. + ''; + }; + }; + + config = lib.mkIf cfg.enable { + systemd.services.conduwuit = { + description = "Conduwuit Matrix Server"; + documentation = [ "https://conduwuit.puppyirl.gay" ]; + wantedBy = [ "multi-user.target" ]; + wants = [ "network-online.target" ]; + after = [ "network-online.target" ]; + environment = cfg.extraEnvironment; + serviceConfig = { + Type = "notify"; + DynamicUser = true; + AmbientCapabilities = [ ]; + CapabilityBoundingSet = [ ]; + DevicePolicy = "closed"; + LockPersonality = true; + MemoryDenyWriteExecute = true; + NoNewPrivileges = true; + ProcSubset = "pid"; + ProtectClock = true; + ProtectControlGroups = true; + ProtectHome = true; + ProtectHostname = true; + ProtectKernelLogs = true; + ProtectKernelModules = true; + ProtectKernelTunables = true; + ProtectProc = "invisible"; + ProtectSystem = "strict"; + PrivateDevices = true; + PrivateMounts = true; + PrivateTmp = true; + PrivateUsers = true; + PrivateIPC = true; + RemoveIPC = true; + RestrictAddressFamilies = [ "AF_INET" "AF_INET6" "AF_UNIX" ]; + RestrictNamespaces = true; + RestrictRealtime = true; + RestrictSUIDSGID = true; + SystemCallArchitectures = "native"; + SystemCallFilter = [ "@system-service" "@resources" ] ++ [ + "~@clock" + "~@debug" + "~@module" + "~@mount" + "~@reboot" + "~@swap" + "~@cpu-emulation" + "~@obsolete" + "~@timer" + "~@chown" + "~@setuid" + "~@privileged" + "~@keyring" + "~@ipc" + ]; + SystemCallErrorNumber = "EPERM"; + StateDirectory = "conduwuit"; + RuntimeDirectory = "conduwuit"; + RuntimeDirectoryMode = "0750"; + ExecStart = "${cfg.package}/bin/conduit --config ${configFile}"; + Restart = "on-failure"; + RestartSec = 10; + StartLimitBurst = 5; + }; + }; + }; +} diff --git a/modules/default.nix b/modules/default.nix new file mode 100644 index 0000000..7dcd970 --- /dev/null +++ b/modules/default.nix @@ -0,0 +1,5 @@ +_: { + imports = [ + ./conduwuit.nix + ]; +}