1317 lines
52 KiB
Nix
1317 lines
52 KiB
Nix
{ config, lib, options, pkgs, ... }:
|
|
|
|
with lib;
|
|
|
|
let
|
|
cfg = config.services.matrix-synapse;
|
|
format = pkgs.formats.yaml { };
|
|
|
|
filterRecursiveNull = o:
|
|
if isAttrs o then
|
|
mapAttrs (_: v: filterRecursiveNull v) (filterAttrs (_: v: v != null) o)
|
|
else if isList o then
|
|
map filterRecursiveNull (filter (v: v != null) o)
|
|
else
|
|
o;
|
|
|
|
# remove null values from the final configuration
|
|
finalSettings = filterRecursiveNull cfg.settings;
|
|
configFile = format.generate "homeserver.yaml" finalSettings;
|
|
|
|
usePostgresql = cfg.settings.database.name == "psycopg2";
|
|
hasLocalPostgresDB = let args = cfg.settings.database.args; in
|
|
usePostgresql
|
|
&& (!(args ? host) || (elem args.host [ "localhost" "127.0.0.1" "::1" ]))
|
|
&& config.services.postgresql.enable;
|
|
hasWorkers = cfg.workers != { };
|
|
|
|
listenerSupportsResource = resource: listener:
|
|
lib.any ({ names, ... }: builtins.elem resource names) listener.resources;
|
|
|
|
clientListener = findFirst
|
|
(listenerSupportsResource "client")
|
|
null
|
|
(cfg.settings.listeners
|
|
++ concatMap ({ worker_listeners, ... }: worker_listeners) (attrValues cfg.workers));
|
|
|
|
registerNewMatrixUser =
|
|
let
|
|
isIpv6 = hasInfix ":";
|
|
|
|
# add a tail, so that without any bind_addresses we still have a useable address
|
|
bindAddress = head (clientListener.bind_addresses ++ [ "127.0.0.1" ]);
|
|
listenerProtocol = if clientListener.tls
|
|
then "https"
|
|
else "http";
|
|
in
|
|
assert assertMsg (clientListener != null) "No client listener found in synapse or one of its workers";
|
|
pkgs.writeShellScriptBin "matrix-synapse-register_new_matrix_user" ''
|
|
exec ${cfg.package}/bin/register_new_matrix_user \
|
|
$@ \
|
|
${lib.concatMapStringsSep " " (x: "-c ${x}") ([ configFile ] ++ cfg.extraConfigFiles)} \
|
|
"${listenerProtocol}://${
|
|
if (isIpv6 bindAddress) then
|
|
"[${bindAddress}]"
|
|
else
|
|
"${bindAddress}"
|
|
}:${builtins.toString clientListener.port}/"
|
|
'';
|
|
|
|
defaultExtras = [
|
|
"systemd"
|
|
"postgres"
|
|
"url-preview"
|
|
"user-search"
|
|
];
|
|
|
|
wantedExtras = cfg.extras
|
|
++ lib.optional (cfg.settings ? oidc_providers) "oidc"
|
|
++ lib.optional (cfg.settings ? jwt_config) "jwt"
|
|
++ lib.optional (cfg.settings ? saml2_config) "saml2"
|
|
++ lib.optional (cfg.settings ? redis) "redis"
|
|
++ lib.optional (cfg.settings ? sentry) "sentry"
|
|
++ lib.optional (cfg.settings ? user_directory) "user-search"
|
|
++ lib.optional (cfg.settings.url_preview_enabled) "url-preview"
|
|
++ lib.optional (cfg.settings.database.name == "psycopg2") "postgres";
|
|
|
|
wrapped = pkgs.matrix-synapse.override {
|
|
extras = wantedExtras;
|
|
inherit (cfg) plugins;
|
|
};
|
|
|
|
defaultCommonLogConfig = {
|
|
version = 1;
|
|
formatters.journal_fmt.format = "%(name)s: [%(request)s] %(message)s";
|
|
handlers.journal = {
|
|
class = "systemd.journal.JournalHandler";
|
|
formatter = "journal_fmt";
|
|
};
|
|
root = {
|
|
level = "INFO";
|
|
handlers = [ "journal" ];
|
|
};
|
|
disable_existing_loggers = false;
|
|
};
|
|
|
|
defaultCommonLogConfigText = generators.toPretty { } defaultCommonLogConfig;
|
|
|
|
logConfigText = logName:
|
|
lib.literalMD ''
|
|
Path to a yaml file generated from this Nix expression:
|
|
|
|
```
|
|
${generators.toPretty { } (
|
|
recursiveUpdate defaultCommonLogConfig { handlers.journal.SYSLOG_IDENTIFIER = logName; }
|
|
)}
|
|
```
|
|
'';
|
|
|
|
genLogConfigFile = logName: format.generate
|
|
"synapse-log-${logName}.yaml"
|
|
(cfg.log // optionalAttrs (cfg.log?handlers.journal) {
|
|
handlers.journal = cfg.log.handlers.journal // {
|
|
SYSLOG_IDENTIFIER = logName;
|
|
};
|
|
});
|
|
|
|
toIntBase8 = str:
|
|
lib.pipe str [
|
|
lib.stringToCharacters
|
|
(map lib.toInt)
|
|
(lib.foldl (acc: digit: acc * 8 + digit) 0)
|
|
];
|
|
|
|
toDecimalFilePermission = value:
|
|
if value == null then
|
|
null
|
|
else
|
|
toIntBase8 value;
|
|
in {
|
|
|
|
imports = [
|
|
|
|
(mkRemovedOptionModule [ "services" "matrix-synapse" "trusted_third_party_id_servers" ] ''
|
|
The `trusted_third_party_id_servers` option as been removed in `matrix-synapse` v1.4.0
|
|
as the behavior is now obsolete.
|
|
'')
|
|
(mkRemovedOptionModule [ "services" "matrix-synapse" "create_local_database" ] ''
|
|
Database configuration must be done manually. An exemplary setup is demonstrated in
|
|
<nixpkgs/nixos/tests/matrix/synapse.nix>
|
|
'')
|
|
(mkRemovedOptionModule [ "services" "matrix-synapse" "web_client" ] "")
|
|
(mkRemovedOptionModule [ "services" "matrix-synapse" "room_invite_state_types" ] ''
|
|
You may add additional event types via
|
|
`services.matrix-synapse.room_prejoin_state.additional_event_types` and
|
|
disable the default events via
|
|
`services.matrix-synapse.room_prejoin_state.disable_default_event_types`.
|
|
'')
|
|
|
|
# options that don't exist in synapse anymore
|
|
(mkRemovedOptionModule [ "services" "matrix-synapse" "bind_host" ] "Use listener settings instead." )
|
|
(mkRemovedOptionModule [ "services" "matrix-synapse" "bind_port" ] "Use listener settings instead." )
|
|
(mkRemovedOptionModule [ "services" "matrix-synapse" "expire_access_tokens" ] "" )
|
|
(mkRemovedOptionModule [ "services" "matrix-synapse" "no_tls" ] "It is no longer supported by synapse." )
|
|
(mkRemovedOptionModule [ "services" "matrix-synapse" "tls_dh_param_path" ] "It was removed from synapse." )
|
|
(mkRemovedOptionModule [ "services" "matrix-synapse" "unsecure_port" ] "Use settings.listeners instead." )
|
|
(mkRemovedOptionModule [ "services" "matrix-synapse" "user_creation_max_duration" ] "It is no longer supported by synapse." )
|
|
(mkRemovedOptionModule [ "services" "matrix-synapse" "verbose" ] "Use a log config instead." )
|
|
|
|
# options that were moved into rfc42 style settings
|
|
(mkRemovedOptionModule [ "services" "matrix-synapse" "app_service_config_files" ] "Use settings.app_service_config_files instead" )
|
|
(mkRemovedOptionModule [ "services" "matrix-synapse" "database_args" ] "Use settings.database.args instead" )
|
|
(mkRemovedOptionModule [ "services" "matrix-synapse" "database_name" ] "Use settings.database.args.database instead" )
|
|
(mkRemovedOptionModule [ "services" "matrix-synapse" "database_type" ] "Use settings.database.name instead" )
|
|
(mkRemovedOptionModule [ "services" "matrix-synapse" "database_user" ] "Use settings.database.args.user instead" )
|
|
(mkRemovedOptionModule [ "services" "matrix-synapse" "dynamic_thumbnails" ] "Use settings.dynamic_thumbnails instead" )
|
|
(mkRemovedOptionModule [ "services" "matrix-synapse" "enable_metrics" ] "Use settings.enable_metrics instead" )
|
|
(mkRemovedOptionModule [ "services" "matrix-synapse" "enable_registration" ] "Use settings.enable_registration instead" )
|
|
(mkRemovedOptionModule [ "services" "matrix-synapse" "extraConfig" ] "Use settings instead." )
|
|
(mkRemovedOptionModule [ "services" "matrix-synapse" "listeners" ] "Use settings.listeners instead" )
|
|
(mkRemovedOptionModule [ "services" "matrix-synapse" "logConfig" ] "Use settings.log_config instead" )
|
|
(mkRemovedOptionModule [ "services" "matrix-synapse" "max_image_pixels" ] "Use settings.max_image_pixels instead" )
|
|
(mkRemovedOptionModule [ "services" "matrix-synapse" "max_upload_size" ] "Use settings.max_upload_size instead" )
|
|
(mkRemovedOptionModule [ "services" "matrix-synapse" "presence" "enabled" ] "Use settings.presence.enabled instead" )
|
|
(mkRemovedOptionModule [ "services" "matrix-synapse" "public_baseurl" ] "Use settings.public_baseurl instead" )
|
|
(mkRemovedOptionModule [ "services" "matrix-synapse" "report_stats" ] "Use settings.report_stats instead" )
|
|
(mkRemovedOptionModule [ "services" "matrix-synapse" "server_name" ] "Use settings.server_name instead" )
|
|
(mkRemovedOptionModule [ "services" "matrix-synapse" "servers" ] "Use settings.trusted_key_servers instead." )
|
|
(mkRemovedOptionModule [ "services" "matrix-synapse" "tls_certificate_path" ] "Use settings.tls_certificate_path instead" )
|
|
(mkRemovedOptionModule [ "services" "matrix-synapse" "tls_private_key_path" ] "Use settings.tls_private_key_path instead" )
|
|
(mkRemovedOptionModule [ "services" "matrix-synapse" "turn_shared_secret" ] "Use settings.turn_shared_secret instead" )
|
|
(mkRemovedOptionModule [ "services" "matrix-synapse" "turn_uris" ] "Use settings.turn_uris instead" )
|
|
(mkRemovedOptionModule [ "services" "matrix-synapse" "turn_user_lifetime" ] "Use settings.turn_user_lifetime instead" )
|
|
(mkRemovedOptionModule [ "services" "matrix-synapse" "url_preview_enabled" ] "Use settings.url_preview_enabled instead" )
|
|
(mkRemovedOptionModule [ "services" "matrix-synapse" "url_preview_ip_range_blacklist" ] "Use settings.url_preview_ip_range_blacklist instead" )
|
|
(mkRemovedOptionModule [ "services" "matrix-synapse" "url_preview_ip_range_whitelist" ] "Use settings.url_preview_ip_range_whitelist instead" )
|
|
(mkRemovedOptionModule [ "services" "matrix-synapse" "url_preview_url_blacklist" ] "Use settings.url_preview_url_blacklist instead" )
|
|
|
|
# options that are too specific to mention them explicitly in settings
|
|
(mkRemovedOptionModule [ "services" "matrix-synapse" "account_threepid_delegates" "email" ] "Use settings.account_threepid_delegates.email instead" )
|
|
(mkRemovedOptionModule [ "services" "matrix-synapse" "account_threepid_delegates" "msisdn" ] "Use settings.account_threepid_delegates.msisdn instead" )
|
|
(mkRemovedOptionModule [ "services" "matrix-synapse" "allow_guest_access" ] "Use settings.allow_guest_access instead" )
|
|
(mkRemovedOptionModule [ "services" "matrix-synapse" "bcrypt_rounds" ] "Use settings.bcrypt_rounds instead" )
|
|
(mkRemovedOptionModule [ "services" "matrix-synapse" "enable_registration_captcha" ] "Use settings.enable_registration_captcha instead" )
|
|
(mkRemovedOptionModule [ "services" "matrix-synapse" "event_cache_size" ] "Use settings.event_cache_size instead" )
|
|
(mkRemovedOptionModule [ "services" "matrix-synapse" "federation_rc_concurrent" ] "Use settings.rc_federation.concurrent instead" )
|
|
(mkRemovedOptionModule [ "services" "matrix-synapse" "federation_rc_reject_limit" ] "Use settings.rc_federation.reject_limit instead" )
|
|
(mkRemovedOptionModule [ "services" "matrix-synapse" "federation_rc_sleep_delay" ] "Use settings.rc_federation.sleep_delay instead" )
|
|
(mkRemovedOptionModule [ "services" "matrix-synapse" "federation_rc_sleep_limit" ] "Use settings.rc_federation.sleep_limit instead" )
|
|
(mkRemovedOptionModule [ "services" "matrix-synapse" "federation_rc_window_size" ] "Use settings.rc_federation.window_size instead" )
|
|
(mkRemovedOptionModule [ "services" "matrix-synapse" "key_refresh_interval" ] "Use settings.key_refresh_interval instead" )
|
|
(mkRemovedOptionModule [ "services" "matrix-synapse" "rc_messages_burst_count" ] "Use settings.rc_messages.burst_count instead" )
|
|
(mkRemovedOptionModule [ "services" "matrix-synapse" "rc_messages_per_second" ] "Use settings.rc_messages.per_second instead" )
|
|
(mkRemovedOptionModule [ "services" "matrix-synapse" "recaptcha_private_key" ] "Use settings.recaptcha_private_key instead" )
|
|
(mkRemovedOptionModule [ "services" "matrix-synapse" "recaptcha_public_key" ] "Use settings.recaptcha_public_key instead" )
|
|
(mkRemovedOptionModule [ "services" "matrix-synapse" "redaction_retention_period" ] "Use settings.redaction_retention_period instead" )
|
|
(mkRemovedOptionModule [ "services" "matrix-synapse" "room_prejoin_state" "additional_event_types" ] "Use settings.room_prejoin_state.additional_event_types instead" )
|
|
(mkRemovedOptionModule [ "services" "matrix-synapse" "room_prejoin_state" "disable_default_event_types" ] "Use settings.room_prejoin-state.disable_default_event_types instead" )
|
|
|
|
# Options that should be passed via extraConfigFiles, so they are not persisted into the nix store
|
|
(mkRemovedOptionModule [ "services" "matrix-synapse" "macaroon_secret_key" ] "Pass this value via extraConfigFiles instead" )
|
|
(mkRemovedOptionModule [ "services" "matrix-synapse" "registration_shared_secret" ] "Pass this value via extraConfigFiles instead" )
|
|
|
|
];
|
|
|
|
options = let
|
|
listenerType = workerContext: types.submodule ({ config, ... }: {
|
|
options = {
|
|
port = mkOption {
|
|
type = types.nullOr types.port;
|
|
default = null;
|
|
example = 8448;
|
|
description = ''
|
|
The port to listen for HTTP(S) requests on.
|
|
'';
|
|
};
|
|
|
|
bind_addresses = mkOption {
|
|
type = types.nullOr (types.listOf types.str);
|
|
default = if config.path != null then null else [
|
|
"::1"
|
|
"127.0.0.1"
|
|
];
|
|
defaultText = literalExpression ''
|
|
if path != null then
|
|
null
|
|
else
|
|
[
|
|
"::1"
|
|
"127.0.0.1"
|
|
]
|
|
'';
|
|
example = literalExpression ''
|
|
[
|
|
"::"
|
|
"0.0.0.0"
|
|
]
|
|
'';
|
|
description = ''
|
|
IP addresses to bind the listener to.
|
|
'';
|
|
};
|
|
|
|
path = mkOption {
|
|
type = types.nullOr types.path;
|
|
default = null;
|
|
description = ''
|
|
Unix domain socket path to bind this listener to.
|
|
|
|
::: {.note}
|
|
This option is incompatible with {option}`bind_addresses`, {option}`port`, {option}`tls`
|
|
and also does not support the `metrics` and `manhole` listener {option}`type`.
|
|
:::
|
|
'';
|
|
};
|
|
|
|
mode = mkOption {
|
|
type = types.nullOr (types.strMatching "^[0,2-7]{3,4}$");
|
|
default = if config.path != null then "660" else null;
|
|
defaultText = literalExpression ''
|
|
if path != null then
|
|
"660"
|
|
else
|
|
null
|
|
'';
|
|
example = "660";
|
|
description = ''
|
|
File permissions on the UNIX domain socket.
|
|
'';
|
|
apply = toDecimalFilePermission;
|
|
};
|
|
|
|
type = mkOption {
|
|
type = types.enum [
|
|
"http"
|
|
"manhole"
|
|
"metrics"
|
|
"replication"
|
|
];
|
|
default = "http";
|
|
example = "metrics";
|
|
description = ''
|
|
The type of the listener, usually http.
|
|
'';
|
|
};
|
|
|
|
tls = mkOption {
|
|
type = types.nullOr types.bool;
|
|
default = if config.path != null then
|
|
null
|
|
else
|
|
!workerContext;
|
|
defaultText = ''
|
|
Enabled for the main instance listener, unless it is configured with a UNIX domain socket path.
|
|
'';
|
|
example = false;
|
|
description = ''
|
|
Whether to enable TLS on the listener socket.
|
|
|
|
::: {.note}
|
|
This option will be ignored for UNIX domain sockets.
|
|
:::
|
|
'';
|
|
};
|
|
|
|
x_forwarded = mkOption {
|
|
type = types.bool;
|
|
default = config.path != null;
|
|
defaultText = ''
|
|
Enabled if the listener is configured with a UNIX domain socket path
|
|
'';
|
|
example = true;
|
|
description = ''
|
|
Use the X-Forwarded-For (XFF) header as the client IP and not the
|
|
actual client IP.
|
|
'';
|
|
};
|
|
|
|
resources = mkOption {
|
|
type = types.listOf (types.submodule {
|
|
options = {
|
|
names = mkOption {
|
|
type = types.listOf (types.enum [
|
|
"client"
|
|
"consent"
|
|
"federation"
|
|
"health"
|
|
"keys"
|
|
"media"
|
|
"metrics"
|
|
"openid"
|
|
"replication"
|
|
"static"
|
|
]);
|
|
description = ''
|
|
List of resources to host on this listener.
|
|
'';
|
|
example = [
|
|
"client"
|
|
];
|
|
};
|
|
compress = mkOption {
|
|
default = false;
|
|
type = types.bool;
|
|
description = ''
|
|
Whether synapse should compress HTTP responses to clients that support it.
|
|
This should be disabled if running synapse behind a load balancer
|
|
that can do automatic compression.
|
|
'';
|
|
};
|
|
};
|
|
});
|
|
description = ''
|
|
List of HTTP resources to serve on this listener.
|
|
'';
|
|
};
|
|
};
|
|
});
|
|
in {
|
|
services.matrix-synapse = {
|
|
enable = mkEnableOption "matrix.org synapse, the reference homeserver";
|
|
|
|
enableRegistrationScript = mkOption {
|
|
type = types.bool;
|
|
default = clientListener.bind_addresses != [];
|
|
example = false;
|
|
defaultText = ''
|
|
Enabled if the client listener uses TCP sockets
|
|
'';
|
|
description = ''
|
|
Whether to install the `register_new_matrix_user` script, that
|
|
allows account creation on the terminal.
|
|
|
|
::: {.note}
|
|
This script does not work when the client listener uses UNIX domain sockets
|
|
:::
|
|
'';
|
|
};
|
|
|
|
serviceUnit = lib.mkOption {
|
|
type = lib.types.str;
|
|
readOnly = true;
|
|
description = ''
|
|
The systemd unit (a service or a target) for other services to depend on if they
|
|
need to be started after matrix-synapse.
|
|
|
|
This option is useful as the actual parent unit for all matrix-synapse processes
|
|
changes when configuring workers.
|
|
'';
|
|
};
|
|
|
|
configFile = mkOption {
|
|
type = types.path;
|
|
readOnly = true;
|
|
description = ''
|
|
Path to the configuration file on the target system. Useful to configure e.g. workers
|
|
that also need this.
|
|
'';
|
|
};
|
|
|
|
package = mkOption {
|
|
type = types.package;
|
|
readOnly = true;
|
|
description = ''
|
|
Reference to the `matrix-synapse` wrapper with all extras
|
|
(e.g. for `oidc` or `saml2`) added to the `PYTHONPATH` of all executables.
|
|
|
|
This option is useful to reference the "final" `matrix-synapse` package that's
|
|
actually used by `matrix-synapse.service`. For instance, when using
|
|
workers, it's possible to run
|
|
`''${config.services.matrix-synapse.package}/bin/synapse_worker` and
|
|
no additional PYTHONPATH needs to be specified for extras or plugins configured
|
|
via `services.matrix-synapse`.
|
|
|
|
However, this means that this option is supposed to be only declared
|
|
by the `services.matrix-synapse` module itself and is thus read-only.
|
|
In order to modify `matrix-synapse` itself, use an overlay to override
|
|
`pkgs.matrix-synapse-unwrapped`.
|
|
'';
|
|
};
|
|
|
|
extras = mkOption {
|
|
type = types.listOf (types.enum (lib.attrNames pkgs.matrix-synapse-unwrapped.optional-dependencies));
|
|
default = defaultExtras;
|
|
example = literalExpression ''
|
|
[
|
|
"cache-memory" # Provide statistics about caching memory consumption
|
|
"jwt" # JSON Web Token authentication
|
|
"oidc" # OpenID Connect authentication
|
|
"postgres" # PostgreSQL database backend
|
|
"redis" # Redis support for the replication stream between worker processes
|
|
"saml2" # SAML2 authentication
|
|
"sentry" # Error tracking and performance metrics
|
|
"systemd" # Provide the JournalHandler used in the default log_config
|
|
"url-preview" # Support for oEmbed URL previews
|
|
"user-search" # Support internationalized domain names in user-search
|
|
]
|
|
'';
|
|
description = ''
|
|
Explicitly install extras provided by matrix-synapse. Most
|
|
will require some additional configuration.
|
|
|
|
Extras will automatically be enabled, when the relevant
|
|
configuration sections are present.
|
|
|
|
Please note that this option is additive: i.e. when adding a new item
|
|
to this list, the defaults are still kept. To override the defaults as well,
|
|
use `lib.mkForce`.
|
|
'';
|
|
};
|
|
|
|
plugins = mkOption {
|
|
type = types.listOf types.package;
|
|
default = [ ];
|
|
example = literalExpression ''
|
|
with config.services.matrix-synapse.package.plugins; [
|
|
matrix-synapse-ldap3
|
|
matrix-synapse-pam
|
|
];
|
|
'';
|
|
description = ''
|
|
List of additional Matrix plugins to make available.
|
|
'';
|
|
};
|
|
|
|
withJemalloc = mkOption {
|
|
type = types.bool;
|
|
default = false;
|
|
description = ''
|
|
Whether to preload jemalloc to reduce memory fragmentation and overall usage.
|
|
'';
|
|
};
|
|
|
|
dataDir = mkOption {
|
|
type = types.str;
|
|
default = "/var/lib/matrix-synapse";
|
|
description = ''
|
|
The directory where matrix-synapse stores its stateful data such as
|
|
certificates, media and uploads.
|
|
'';
|
|
};
|
|
|
|
log = mkOption {
|
|
type = types.attrsOf format.type;
|
|
defaultText = literalExpression defaultCommonLogConfigText;
|
|
description = ''
|
|
Default configuration for the loggers used by `matrix-synapse` and its workers.
|
|
The defaults are added with the default priority which means that
|
|
these will be merged with additional declarations. These additional
|
|
declarations also take precedence over the defaults when declared
|
|
with at least normal priority. For instance
|
|
the log-level for synapse and its workers can be changed like this:
|
|
|
|
```nix
|
|
{ lib, ... }: {
|
|
services.matrix-synapse.log.root.level = "WARNING";
|
|
}
|
|
```
|
|
|
|
And another field can be added like this:
|
|
|
|
```nix
|
|
{
|
|
services.matrix-synapse.log = {
|
|
loggers."synapse.http.matrixfederationclient".level = "DEBUG";
|
|
};
|
|
}
|
|
```
|
|
|
|
Additionally, the field `handlers.journal.SYSLOG_IDENTIFIER` will be added to
|
|
each log config, i.e.
|
|
* `synapse` for `matrix-synapse.service`
|
|
* `synapse-<worker name>` for `matrix-synapse-worker-<worker name>.service`
|
|
|
|
This is only done if this option has a `handlers.journal` field declared.
|
|
|
|
To discard all settings declared by this option for each worker and synapse,
|
|
`lib.mkForce` can be used.
|
|
|
|
To discard all settings declared by this option for a single worker or synapse only,
|
|
[](#opt-services.matrix-synapse.workers._name_.worker_log_config) or
|
|
[](#opt-services.matrix-synapse.settings.log_config) can be used.
|
|
'';
|
|
};
|
|
|
|
settings = mkOption {
|
|
default = { };
|
|
description = ''
|
|
The primary synapse configuration. See the
|
|
[sample configuration](https://github.com/element-hq/synapse/blob/v${pkgs.matrix-synapse-unwrapped.version}/docs/sample_config.yaml)
|
|
for possible values.
|
|
|
|
Secrets should be passed in by using the `extraConfigFiles` option.
|
|
'';
|
|
type = with types; submodule {
|
|
freeformType = format.type;
|
|
options = {
|
|
# This is a reduced set of popular options and defaults
|
|
# Do not add every available option here, they can be specified
|
|
# by the user at their own discretion. This is a freeform type!
|
|
|
|
server_name = mkOption {
|
|
type = types.str;
|
|
example = "example.com";
|
|
default = config.networking.hostName;
|
|
defaultText = literalExpression "config.networking.hostName";
|
|
description = ''
|
|
The domain name of the server, with optional explicit port.
|
|
This is used by remote servers to look up the server address.
|
|
This is also the last part of your UserID.
|
|
|
|
The server_name cannot be changed later so it is important to configure this correctly before you start Synapse.
|
|
'';
|
|
};
|
|
|
|
enable_registration = mkOption {
|
|
type = types.bool;
|
|
default = false;
|
|
description = ''
|
|
Enable registration for new users.
|
|
'';
|
|
};
|
|
|
|
registration_shared_secret = mkOption {
|
|
type = types.nullOr types.str;
|
|
default = null;
|
|
description = ''
|
|
If set, allows registration by anyone who also has the shared
|
|
secret, even if registration is otherwise disabled.
|
|
|
|
Secrets should be passed in via `extraConfigFiles`!
|
|
'';
|
|
};
|
|
|
|
macaroon_secret_key = mkOption {
|
|
type = types.nullOr types.str;
|
|
default = null;
|
|
description = ''
|
|
Secret key for authentication tokens. If none is specified,
|
|
the registration_shared_secret is used, if one is given; otherwise,
|
|
a secret key is derived from the signing key.
|
|
|
|
Secrets should be passed in via `extraConfigFiles`!
|
|
'';
|
|
};
|
|
|
|
enable_metrics = mkOption {
|
|
type = types.bool;
|
|
default = false;
|
|
description = ''
|
|
Enable collection and rendering of performance metrics
|
|
'';
|
|
};
|
|
|
|
report_stats = mkOption {
|
|
type = types.bool;
|
|
default = false;
|
|
description = ''
|
|
Whether or not to report anonymized homeserver usage statistics.
|
|
'';
|
|
};
|
|
|
|
signing_key_path = mkOption {
|
|
type = types.path;
|
|
default = "${cfg.dataDir}/homeserver.signing.key";
|
|
description = ''
|
|
Path to the signing key to sign messages with.
|
|
'';
|
|
};
|
|
|
|
pid_file = mkOption {
|
|
type = types.path;
|
|
default = "/run/matrix-synapse.pid";
|
|
readOnly = true;
|
|
description = ''
|
|
The file to store the PID in.
|
|
'';
|
|
};
|
|
|
|
log_config = mkOption {
|
|
type = types.path;
|
|
default = genLogConfigFile "synapse";
|
|
defaultText = logConfigText "synapse";
|
|
description = ''
|
|
The file that holds the logging configuration.
|
|
'';
|
|
};
|
|
|
|
media_store_path = mkOption {
|
|
type = types.path;
|
|
default = if lib.versionAtLeast config.system.stateVersion "22.05"
|
|
then "${cfg.dataDir}/media_store"
|
|
else "${cfg.dataDir}/media";
|
|
defaultText = "${cfg.dataDir}/media_store for when system.stateVersion is at least 22.05, ${cfg.dataDir}/media when lower than 22.05";
|
|
description = ''
|
|
Directory where uploaded images and attachments are stored.
|
|
'';
|
|
};
|
|
|
|
public_baseurl = mkOption {
|
|
type = types.nullOr types.str;
|
|
default = null;
|
|
example = "https://example.com:8448/";
|
|
description = ''
|
|
The public-facing base URL for the client API (not including _matrix/...)
|
|
'';
|
|
};
|
|
|
|
tls_certificate_path = mkOption {
|
|
type = types.nullOr types.str;
|
|
default = null;
|
|
example = "/var/lib/acme/example.com/fullchain.pem";
|
|
description = ''
|
|
PEM encoded X509 certificate for TLS.
|
|
You can replace the self-signed certificate that synapse
|
|
autogenerates on launch with your own SSL certificate + key pair
|
|
if you like. Any required intermediary certificates can be
|
|
appended after the primary certificate in hierarchical order.
|
|
'';
|
|
};
|
|
|
|
tls_private_key_path = mkOption {
|
|
type = types.nullOr types.str;
|
|
default = null;
|
|
example = "/var/lib/acme/example.com/key.pem";
|
|
description = ''
|
|
PEM encoded private key for TLS. Specify null if synapse is not
|
|
speaking TLS directly.
|
|
'';
|
|
};
|
|
|
|
presence.enabled = mkOption {
|
|
type = types.bool;
|
|
default = true;
|
|
example = false;
|
|
description = ''
|
|
Whether to enable presence tracking.
|
|
|
|
Presence tracking allows users to see the state (e.g online/offline)
|
|
of other local and remote users.
|
|
'';
|
|
};
|
|
|
|
listeners = mkOption {
|
|
type = types.listOf (listenerType false);
|
|
default = [{
|
|
port = 8008;
|
|
bind_addresses = [ "127.0.0.1" ];
|
|
type = "http";
|
|
tls = false;
|
|
x_forwarded = true;
|
|
resources = [{
|
|
names = [ "client" ];
|
|
compress = true;
|
|
} {
|
|
names = [ "federation" ];
|
|
compress = false;
|
|
}];
|
|
}] ++ lib.optional hasWorkers {
|
|
path = "/run/matrix-synapse/main_replication.sock";
|
|
type = "http";
|
|
resources = [{
|
|
names = [ "replication" ];
|
|
compress = false;
|
|
}];
|
|
};
|
|
description = ''
|
|
List of ports that Synapse should listen on, their purpose and their configuration.
|
|
|
|
By default, synapse will be configured for client and federation traffic on port 8008, and
|
|
use a UNIX domain socket for worker replication. See [`services.matrix-synapse.workers`](#opt-services.matrix-synapse.workers)
|
|
for more details.
|
|
'';
|
|
};
|
|
|
|
database.name = mkOption {
|
|
type = types.enum [
|
|
"sqlite3"
|
|
"psycopg2"
|
|
];
|
|
default = if versionAtLeast config.system.stateVersion "18.03"
|
|
then "psycopg2"
|
|
else "sqlite3";
|
|
defaultText = literalExpression ''
|
|
if versionAtLeast config.system.stateVersion "18.03"
|
|
then "psycopg2"
|
|
else "sqlite3"
|
|
'';
|
|
description = ''
|
|
The database engine name. Can be sqlite3 or psycopg2.
|
|
'';
|
|
};
|
|
|
|
database.args.database = mkOption {
|
|
type = types.str;
|
|
default = {
|
|
sqlite3 = "${cfg.dataDir}/homeserver.db";
|
|
psycopg2 = "matrix-synapse";
|
|
}.${cfg.settings.database.name};
|
|
defaultText = literalExpression ''
|
|
{
|
|
sqlite3 = "''${${options.services.matrix-synapse.dataDir}}/homeserver.db";
|
|
psycopg2 = "matrix-synapse";
|
|
}.''${${options.services.matrix-synapse.settings}.database.name};
|
|
'';
|
|
description = ''
|
|
Name of the database when using the psycopg2 backend,
|
|
path to the database location when using sqlite3.
|
|
'';
|
|
};
|
|
|
|
database.args.user = mkOption {
|
|
type = types.nullOr types.str;
|
|
default = {
|
|
sqlite3 = null;
|
|
psycopg2 = "matrix-synapse";
|
|
}.${cfg.settings.database.name};
|
|
defaultText = lib.literalExpression ''
|
|
{
|
|
sqlite3 = null;
|
|
psycopg2 = "matrix-synapse";
|
|
}.''${cfg.settings.database.name};
|
|
'';
|
|
description = ''
|
|
Username to connect with psycopg2, set to null
|
|
when using sqlite3.
|
|
'';
|
|
};
|
|
|
|
url_preview_enabled = mkOption {
|
|
type = types.bool;
|
|
default = true;
|
|
example = false;
|
|
description = ''
|
|
Is the preview URL API enabled? If enabled, you *must* specify an
|
|
explicit url_preview_ip_range_blacklist of IPs that the spider is
|
|
denied from accessing.
|
|
'';
|
|
};
|
|
|
|
url_preview_ip_range_blacklist = mkOption {
|
|
type = types.listOf types.str;
|
|
default = [
|
|
"10.0.0.0/8"
|
|
"100.64.0.0/10"
|
|
"127.0.0.0/8"
|
|
"169.254.0.0/16"
|
|
"172.16.0.0/12"
|
|
"192.0.0.0/24"
|
|
"192.0.2.0/24"
|
|
"192.168.0.0/16"
|
|
"192.88.99.0/24"
|
|
"198.18.0.0/15"
|
|
"198.51.100.0/24"
|
|
"2001:db8::/32"
|
|
"203.0.113.0/24"
|
|
"224.0.0.0/4"
|
|
"::1/128"
|
|
"fc00::/7"
|
|
"fe80::/10"
|
|
"fec0::/10"
|
|
"ff00::/8"
|
|
];
|
|
description = ''
|
|
List of IP address CIDR ranges that the URL preview spider is denied
|
|
from accessing.
|
|
'';
|
|
};
|
|
|
|
url_preview_ip_range_whitelist = mkOption {
|
|
type = types.listOf types.str;
|
|
default = [ ];
|
|
description = ''
|
|
List of IP address CIDR ranges that the URL preview spider is allowed
|
|
to access even if they are specified in url_preview_ip_range_blacklist.
|
|
'';
|
|
};
|
|
|
|
url_preview_url_blacklist = mkOption {
|
|
# FIXME revert to just `listOf (attrsOf str)` after some time(tm).
|
|
type = types.listOf (
|
|
types.coercedTo
|
|
types.str
|
|
(const (throw ''
|
|
Setting `config.services.matrix-synapse.settings.url_preview_url_blacklist`
|
|
to a list of strings has never worked. Due to a bug, this was the type accepted
|
|
by the module, but in practice it broke on runtime and as a result, no URL
|
|
preview worked anywhere if this was set.
|
|
|
|
See https://element-hq.github.io/synapse/latest/usage/configuration/config_documentation.html#url_preview_url_blacklist
|
|
on how to configure it properly.
|
|
''))
|
|
(types.attrsOf types.str));
|
|
default = [ ];
|
|
example = literalExpression ''
|
|
[
|
|
{ scheme = "http"; } # no http previews
|
|
{ netloc = "www.acme.com"; path = "/foo"; } # block http(s)://www.acme.com/foo
|
|
]
|
|
'';
|
|
description = ''
|
|
Optional list of URL matches that the URL preview spider is
|
|
denied from accessing.
|
|
'';
|
|
};
|
|
|
|
max_upload_size = mkOption {
|
|
type = types.str;
|
|
default = "50M";
|
|
example = "100M";
|
|
description = ''
|
|
The largest allowed upload size in bytes
|
|
'';
|
|
};
|
|
|
|
max_image_pixels = mkOption {
|
|
type = types.str;
|
|
default = "32M";
|
|
example = "64M";
|
|
description = ''
|
|
Maximum number of pixels that will be thumbnailed
|
|
'';
|
|
};
|
|
|
|
dynamic_thumbnails = mkOption {
|
|
type = types.bool;
|
|
default = false;
|
|
example = true;
|
|
description = ''
|
|
Whether to generate new thumbnails on the fly to precisely match
|
|
the resolution requested by the client. If true then whenever
|
|
a new resolution is requested by the client the server will
|
|
generate a new thumbnail. If false the server will pick a thumbnail
|
|
from a precalculated list.
|
|
'';
|
|
};
|
|
|
|
turn_uris = mkOption {
|
|
type = types.listOf types.str;
|
|
default = [ ];
|
|
example = [
|
|
"turn:turn.example.com:3487?transport=udp"
|
|
"turn:turn.example.com:3487?transport=tcp"
|
|
"turns:turn.example.com:5349?transport=udp"
|
|
"turns:turn.example.com:5349?transport=tcp"
|
|
];
|
|
description = ''
|
|
The public URIs of the TURN server to give to clients
|
|
'';
|
|
};
|
|
turn_shared_secret = mkOption {
|
|
type = types.str;
|
|
default = "";
|
|
example = literalExpression ''
|
|
config.services.coturn.static-auth-secret
|
|
'';
|
|
description = ''
|
|
The shared secret used to compute passwords for the TURN server.
|
|
|
|
Secrets should be passed in via `extraConfigFiles`!
|
|
'';
|
|
};
|
|
|
|
trusted_key_servers = mkOption {
|
|
type = types.listOf (types.submodule {
|
|
freeformType = format.type;
|
|
options = {
|
|
server_name = mkOption {
|
|
type = types.str;
|
|
example = "matrix.org";
|
|
description = ''
|
|
Hostname of the trusted server.
|
|
'';
|
|
};
|
|
};
|
|
});
|
|
default = [{
|
|
server_name = "matrix.org";
|
|
verify_keys = {
|
|
"ed25519:auto" = "Noi6WqcDj0QmPxCNQqgezwTlBKrfqehY1u2FyWP9uYw";
|
|
};
|
|
}];
|
|
description = ''
|
|
The trusted servers to download signing keys from.
|
|
'';
|
|
};
|
|
|
|
app_service_config_files = mkOption {
|
|
type = types.listOf types.path;
|
|
default = [ ];
|
|
description = ''
|
|
A list of application service config file to use
|
|
'';
|
|
};
|
|
|
|
redis = lib.mkOption {
|
|
type = types.submodule {
|
|
freeformType = format.type;
|
|
options = {
|
|
enabled = lib.mkOption {
|
|
type = types.bool;
|
|
default = false;
|
|
description = ''
|
|
Whether to use redis support
|
|
'';
|
|
};
|
|
};
|
|
};
|
|
default = { };
|
|
description = ''
|
|
Redis configuration for synapse.
|
|
|
|
See the
|
|
[upstream documentation](https://github.com/element-hq/synapse/blob/v${pkgs.matrix-synapse-unwrapped.version}/docs/usage/configuration/config_documentation.md#redis)
|
|
for available options.
|
|
'';
|
|
};
|
|
};
|
|
};
|
|
};
|
|
|
|
workers = lib.mkOption {
|
|
default = { };
|
|
description = ''
|
|
Options for configuring workers. Worker support will be enabled if at least one worker is configured here.
|
|
|
|
See the [worker documention](https://element-hq.github.io/synapse/latest/workers.html#worker-configuration)
|
|
for possible options for each worker. Worker-specific options overriding the shared homeserver configuration can be
|
|
specified here for each worker.
|
|
|
|
::: {.note}
|
|
Worker support will add a replication listener on port 9093 to the main synapse process using the default
|
|
value of [`services.matrix-synapse.settings.listeners`](#opt-services.matrix-synapse.settings.listeners) and configure that
|
|
listener as `services.matrix-synapse.settings.instance_map.main`.
|
|
If you set either of those options, make sure to configure a replication listener yourself.
|
|
|
|
A redis server is required for running workers. A local one can be enabled
|
|
using [`services.matrix-synapse.configureRedisLocally`](#opt-services.matrix-synapse.configureRedisLocally).
|
|
|
|
Workers also require a proper reverse proxy setup to direct incoming requests to the appropriate process. See
|
|
the [reverse proxy documentation](https://element-hq.github.io/synapse/latest/reverse_proxy.html) for a
|
|
general reverse proxying setup and
|
|
the [worker documentation](https://element-hq.github.io/synapse/latest/workers.html#available-worker-applications)
|
|
for the available endpoints per worker application.
|
|
:::
|
|
'';
|
|
type = types.attrsOf (types.submodule ({name, ...}: {
|
|
freeformType = format.type;
|
|
options = {
|
|
worker_app = lib.mkOption {
|
|
type = types.enum [
|
|
"synapse.app.generic_worker"
|
|
"synapse.app.media_repository"
|
|
];
|
|
description = "Type of this worker";
|
|
default = "synapse.app.generic_worker";
|
|
};
|
|
worker_listeners = lib.mkOption {
|
|
default = [ ];
|
|
type = types.listOf (listenerType true);
|
|
description = ''
|
|
List of ports that this worker should listen on, their purpose and their configuration.
|
|
'';
|
|
};
|
|
worker_log_config = lib.mkOption {
|
|
type = types.path;
|
|
default = genLogConfigFile "synapse-${name}";
|
|
defaultText = logConfigText "synapse-${name}";
|
|
description = ''
|
|
The file for log configuration.
|
|
|
|
See the [python documentation](https://docs.python.org/3/library/logging.config.html#configuration-dictionary-schema)
|
|
for the schema and the [upstream repository](https://github.com/element-hq/synapse/blob/v${pkgs.matrix-synapse-unwrapped.version}/docs/sample_log_config.yaml)
|
|
for an example.
|
|
'';
|
|
};
|
|
};
|
|
}));
|
|
default = { };
|
|
example = lib.literalExpression ''
|
|
{
|
|
"federation_sender" = { };
|
|
"federation_receiver" = {
|
|
worker_listeners = [
|
|
{
|
|
type = "http";
|
|
port = 8009;
|
|
bind_addresses = [ "127.0.0.1" ];
|
|
tls = false;
|
|
x_forwarded = true;
|
|
resources = [{
|
|
names = [ "federation" ];
|
|
}];
|
|
}
|
|
];
|
|
};
|
|
}
|
|
'';
|
|
};
|
|
|
|
extraConfigFiles = mkOption {
|
|
type = types.listOf types.path;
|
|
default = [ ];
|
|
description = ''
|
|
Extra config files to include.
|
|
|
|
The configuration files will be included based on the command line
|
|
argument --config-path. This allows to configure secrets without
|
|
having to go through the Nix store, e.g. based on deployment keys if
|
|
NixOps is in use.
|
|
'';
|
|
};
|
|
|
|
configureRedisLocally = lib.mkOption {
|
|
type = types.bool;
|
|
default = false;
|
|
description = ''
|
|
Whether to automatically configure a local redis server for matrix-synapse.
|
|
'';
|
|
};
|
|
};
|
|
};
|
|
|
|
config = mkIf cfg.enable {
|
|
assertions = [
|
|
{
|
|
assertion = clientListener != null;
|
|
message = ''
|
|
At least one listener which serves the `client` resource via HTTP is required
|
|
by synapse in `services.matrix-synapse.settings.listeners` or in one of the workers!
|
|
'';
|
|
}
|
|
{
|
|
assertion = hasWorkers -> cfg.settings.redis.enabled;
|
|
message = ''
|
|
Workers for matrix-synapse require configuring a redis instance. This can be done
|
|
automatically by setting `services.matrix-synapse.configureRedisLocally = true`.
|
|
'';
|
|
}
|
|
{
|
|
assertion =
|
|
let
|
|
main = cfg.settings.instance_map.main;
|
|
listener = lib.findFirst
|
|
(
|
|
listener:
|
|
(
|
|
lib.hasAttr "port" main && listener.port or null == main.port
|
|
|| lib.hasAttr "path" main && listener.path or null == main.path
|
|
)
|
|
&& listenerSupportsResource "replication" listener
|
|
&& (
|
|
lib.hasAttr "host" main && lib.any (bind: bind == main.host || bind == "0.0.0.0" || bind == "::") listener.bind_addresses
|
|
|| lib.hasAttr "path" main
|
|
)
|
|
)
|
|
null
|
|
cfg.settings.listeners;
|
|
in
|
|
hasWorkers -> (cfg.settings.instance_map ? main && listener != null);
|
|
message = ''
|
|
Workers for matrix-synapse require setting `services.matrix-synapse.settings.instance_map.main`
|
|
to any listener configured in `services.matrix-synapse.settings.listeners` with a `"replication"`
|
|
resource.
|
|
|
|
This is done by default unless you manually configure either of those settings.
|
|
'';
|
|
}
|
|
{
|
|
assertion = cfg.enableRegistrationScript -> clientListener.path == null;
|
|
message = ''
|
|
The client listener on matrix-synapse is configured to use UNIX domain sockets.
|
|
This configuration is incompatible with the `register_new_matrix_user` script.
|
|
|
|
Disable `services.matrix-synapse.enableRegistrationScript` to continue.
|
|
'';
|
|
}
|
|
]
|
|
++ (map (listener: {
|
|
assertion = (listener.path == null) != (listener.bind_addresses == null);
|
|
message = ''
|
|
Listeners require either a UNIX domain socket `path` or `bind_addresses` for a TCP socket.
|
|
'';
|
|
}) cfg.settings.listeners)
|
|
++ (map (listener: {
|
|
assertion = listener.path != null -> (listener.bind_addresses == null && listener.port == null && listener.tls == null);
|
|
message = let
|
|
formatKeyValue = key: value: lib.optionalString (value != null) " - ${key}=${toString value}\n";
|
|
in ''
|
|
Listener configured with UNIX domain socket (${toString listener.path}) ignores the following options:
|
|
${formatKeyValue "bind_addresses" listener.bind_addresses}${formatKeyValue "port" listener.port}${formatKeyValue "tls" listener.tls}
|
|
'';
|
|
}) cfg.settings.listeners)
|
|
++ (map (listener: {
|
|
assertion = listener.path == null || listener.type == "http";
|
|
message = ''
|
|
Listener configured with UNIX domain socket (${toString listener.path}) only supports the "http" listener type.
|
|
'';
|
|
}) cfg.settings.listeners);
|
|
|
|
services.matrix-synapse.settings.redis = lib.mkIf cfg.configureRedisLocally {
|
|
enabled = true;
|
|
path = config.services.redis.servers.matrix-synapse.unixSocket;
|
|
};
|
|
services.matrix-synapse.settings.instance_map.main = lib.mkIf hasWorkers (lib.mkDefault {
|
|
path = "/run/matrix-synapse/main_replication.sock";
|
|
});
|
|
|
|
services.matrix-synapse.serviceUnit = if hasWorkers then "matrix-synapse.target" else "matrix-synapse.service";
|
|
services.matrix-synapse.configFile = configFile;
|
|
services.matrix-synapse.package = wrapped;
|
|
|
|
# default them, so they are additive
|
|
services.matrix-synapse.extras = defaultExtras;
|
|
|
|
services.matrix-synapse.log = mapAttrsRecursive (const mkDefault) defaultCommonLogConfig;
|
|
|
|
users.users.matrix-synapse = {
|
|
group = "matrix-synapse";
|
|
home = cfg.dataDir;
|
|
createHome = true;
|
|
shell = "${pkgs.bash}/bin/bash";
|
|
uid = config.ids.uids.matrix-synapse;
|
|
};
|
|
|
|
users.groups.matrix-synapse = {
|
|
gid = config.ids.gids.matrix-synapse;
|
|
};
|
|
|
|
systemd.targets.matrix-synapse = lib.mkIf hasWorkers {
|
|
description = "Synapse Matrix parent target";
|
|
wants = [ "network-online.target" ];
|
|
after = [ "network-online.target" ] ++ optional hasLocalPostgresDB "postgresql.service";
|
|
wantedBy = [ "multi-user.target" ];
|
|
};
|
|
|
|
systemd.services =
|
|
let
|
|
targetConfig =
|
|
if hasWorkers
|
|
then {
|
|
partOf = [ "matrix-synapse.target" ];
|
|
wantedBy = [ "matrix-synapse.target" ];
|
|
unitConfig.ReloadPropagatedFrom = "matrix-synapse.target";
|
|
requires = optional hasLocalPostgresDB "postgresql.service";
|
|
}
|
|
else {
|
|
wants = [ "network-online.target" ];
|
|
after = [ "network-online.target" ] ++ optional hasLocalPostgresDB "postgresql.service";
|
|
requires = optional hasLocalPostgresDB "postgresql.service";
|
|
wantedBy = [ "multi-user.target" ];
|
|
};
|
|
baseServiceConfig = {
|
|
environment = optionalAttrs (cfg.withJemalloc) {
|
|
LD_PRELOAD = "${pkgs.jemalloc}/lib/libjemalloc.so";
|
|
};
|
|
serviceConfig = {
|
|
Type = "notify";
|
|
User = "matrix-synapse";
|
|
Group = "matrix-synapse";
|
|
WorkingDirectory = cfg.dataDir;
|
|
RuntimeDirectory = "matrix-synapse";
|
|
RuntimeDirectoryPreserve = true;
|
|
ExecReload = "${pkgs.util-linux}/bin/kill -HUP $MAINPID";
|
|
Restart = "on-failure";
|
|
UMask = "0077";
|
|
|
|
# Security Hardening
|
|
# Refer to systemd.exec(5) for option descriptions.
|
|
CapabilityBoundingSet = [ "" ];
|
|
LockPersonality = true;
|
|
NoNewPrivileges = true;
|
|
PrivateDevices = true;
|
|
PrivateTmp = true;
|
|
PrivateUsers = true;
|
|
ProcSubset = "pid";
|
|
ProtectClock = true;
|
|
ProtectControlGroups = true;
|
|
ProtectHome = true;
|
|
ProtectHostname = true;
|
|
ProtectKernelLogs = true;
|
|
ProtectKernelModules = true;
|
|
ProtectKernelTunables = true;
|
|
ProtectProc = "invisible";
|
|
ProtectSystem = "strict";
|
|
ReadWritePaths = [ cfg.dataDir cfg.settings.media_store_path ] ++
|
|
(map (listener: dirOf listener.path) (filter (listener: listener.path != null) cfg.settings.listeners));
|
|
RemoveIPC = true;
|
|
RestrictAddressFamilies = [ "AF_INET" "AF_INET6" "AF_UNIX" ];
|
|
RestrictNamespaces = true;
|
|
RestrictRealtime = true;
|
|
RestrictSUIDSGID = true;
|
|
SystemCallArchitectures = "native";
|
|
SystemCallFilter = [ "@system-service" "~@resources" "~@privileged" ];
|
|
};
|
|
}
|
|
// targetConfig;
|
|
genWorkerService = name: workerCfg:
|
|
let
|
|
finalWorkerCfg = workerCfg // { worker_name = name; };
|
|
workerConfigFile = format.generate "worker-${name}.yaml" finalWorkerCfg;
|
|
in
|
|
{
|
|
name = "matrix-synapse-worker-${name}";
|
|
value = lib.mkMerge [
|
|
baseServiceConfig
|
|
{
|
|
description = "Synapse Matrix worker ${name}";
|
|
# make sure the main process starts first for potential database migrations
|
|
after = [ "matrix-synapse.service" ];
|
|
requires = [ "matrix-synapse.service" ];
|
|
serviceConfig = {
|
|
ExecStart = ''
|
|
${cfg.package}/bin/synapse_worker \
|
|
${ concatMapStringsSep "\n " (x: "--config-path ${x} \\") ([ configFile workerConfigFile ] ++ cfg.extraConfigFiles) }
|
|
--keys-directory ${cfg.dataDir}
|
|
'';
|
|
};
|
|
}
|
|
];
|
|
};
|
|
in
|
|
{
|
|
matrix-synapse = lib.mkMerge [
|
|
baseServiceConfig
|
|
{
|
|
description = "Synapse Matrix homeserver";
|
|
preStart = ''
|
|
${cfg.package}/bin/synapse_homeserver \
|
|
--config-path ${configFile} \
|
|
--keys-directory ${cfg.dataDir} \
|
|
--generate-keys
|
|
'';
|
|
serviceConfig = {
|
|
ExecStartPre = [
|
|
("+" + (pkgs.writeShellScript "matrix-synapse-fix-permissions" ''
|
|
chown matrix-synapse:matrix-synapse ${cfg.settings.signing_key_path}
|
|
chmod 0600 ${cfg.settings.signing_key_path}
|
|
''))
|
|
];
|
|
ExecStart = ''
|
|
${cfg.package}/bin/synapse_homeserver \
|
|
${ concatMapStringsSep "\n " (x: "--config-path ${x} \\") ([ configFile ] ++ cfg.extraConfigFiles) }
|
|
--keys-directory ${cfg.dataDir}
|
|
'';
|
|
};
|
|
}
|
|
];
|
|
}
|
|
// (lib.mapAttrs' genWorkerService cfg.workers);
|
|
|
|
services.redis.servers.matrix-synapse = lib.mkIf cfg.configureRedisLocally {
|
|
enable = true;
|
|
user = "matrix-synapse";
|
|
};
|
|
|
|
environment.systemPackages = lib.optionals cfg.enableRegistrationScript [
|
|
registerNewMatrixUser
|
|
];
|
|
};
|
|
|
|
meta = {
|
|
buildDocsInSandbox = false;
|
|
doc = ./synapse.md;
|
|
maintainers = teams.matrix.members;
|
|
};
|
|
|
|
}
|