Compare commits
6 Commits
3dcd9f52d6
...
da5c959509
Author | SHA1 | Date |
---|---|---|
Daniel Lovbrotte Olsen | da5c959509 | |
Joakim Pettersvold | c1833eb07c | |
Finn Landweber | 5ee23ef2e2 | |
Oystein Kristoffer Tveit | f5c16f46f1 | |
Oystein Kristoffer Tveit | aa71d497f1 | |
fredrikr79 | 4fbd823be6 |
|
@ -57,7 +57,7 @@
|
||||||
rec {
|
rec {
|
||||||
system = "x86_64-linux";
|
system = "x86_64-linux";
|
||||||
specialArgs = {
|
specialArgs = {
|
||||||
inherit nixpkgs-unstable inputs;
|
inherit unstablePkgs inputs;
|
||||||
values = import ./values.nix;
|
values = import ./values.nix;
|
||||||
};
|
};
|
||||||
|
|
||||||
|
|
|
@ -6,6 +6,11 @@ let
|
||||||
domain = "webmail.pvv.ntnu.no";
|
domain = "webmail.pvv.ntnu.no";
|
||||||
in
|
in
|
||||||
{
|
{
|
||||||
|
sops.secrets."roundcube/postgres_password" = {
|
||||||
|
owner = "nginx";
|
||||||
|
group = "nginx";
|
||||||
|
};
|
||||||
|
|
||||||
services.roundcube = {
|
services.roundcube = {
|
||||||
enable = true;
|
enable = true;
|
||||||
|
|
||||||
|
@ -20,6 +25,11 @@ in
|
||||||
maxAttachmentSize = 20;
|
maxAttachmentSize = 20;
|
||||||
hostName = "roundcubeplaceholder.example.com";
|
hostName = "roundcubeplaceholder.example.com";
|
||||||
|
|
||||||
|
database = {
|
||||||
|
host = "postgres.pvv.ntnu.no";
|
||||||
|
passwordFile = config.sops.secrets."roundcube/postgres_password".path;
|
||||||
|
};
|
||||||
|
|
||||||
extraConfig = ''
|
extraConfig = ''
|
||||||
$config['enable_installer'] = false;
|
$config['enable_installer'] = false;
|
||||||
$config['default_host'] = "ssl://imap.pvv.ntnu.no";
|
$config['default_host'] = "ssl://imap.pvv.ntnu.no";
|
||||||
|
|
|
@ -10,6 +10,7 @@
|
||||||
./mjolnir.nix
|
./mjolnir.nix
|
||||||
|
|
||||||
./discord.nix
|
./discord.nix
|
||||||
|
./hookshot
|
||||||
];
|
];
|
||||||
|
|
||||||
|
|
||||||
|
|
|
@ -0,0 +1,70 @@
|
||||||
|
{ config, lib, unstablePkgs, inputs, ... }:
|
||||||
|
|
||||||
|
let
|
||||||
|
cfg = config.services.matrix-hookshot;
|
||||||
|
webhookListenAddress = "127.0.0.1";
|
||||||
|
webhookListenPort = 9000;
|
||||||
|
in
|
||||||
|
{
|
||||||
|
imports = [
|
||||||
|
./module.nix
|
||||||
|
];
|
||||||
|
|
||||||
|
sops.secrets."matrix/registrations/matrix-hookshot" = {
|
||||||
|
sopsFile = ../../../../../secrets/bicep/matrix.yaml;
|
||||||
|
key = "registrations/matrix-hookshot";
|
||||||
|
owner = config.users.users.matrix-synapse.name;
|
||||||
|
group = config.users.groups.keys-matrix-registrations.name;
|
||||||
|
};
|
||||||
|
|
||||||
|
systemd.services.matrix-hookshot = {
|
||||||
|
serviceConfig.SupplementaryGroups = [ config.users.groups.keys-matrix-registrations.name ];
|
||||||
|
};
|
||||||
|
|
||||||
|
services.matrix-hookshot = {
|
||||||
|
enable = true;
|
||||||
|
package = unstablePkgs.matrix-hookshot;
|
||||||
|
registrationFile = config.sops.secrets."matrix/registrations/matrix-hookshot".path;
|
||||||
|
settings = {
|
||||||
|
bridge = {
|
||||||
|
bindAddress = "127.0.0.1";
|
||||||
|
domain = "pvv.ntnu,no";
|
||||||
|
url = "https://matrix.pvv.ntnu.no";
|
||||||
|
mediaUrl = "https://matrix.pvv.ntnu.no";
|
||||||
|
port = 9993;
|
||||||
|
};
|
||||||
|
listeners = [
|
||||||
|
{
|
||||||
|
bindAddress = webhookListenAddress;
|
||||||
|
port = webhookListenPort;
|
||||||
|
resources = [
|
||||||
|
"webhooks"
|
||||||
|
# "metrics"
|
||||||
|
# "provisioning"
|
||||||
|
"widgets"
|
||||||
|
];
|
||||||
|
}
|
||||||
|
];
|
||||||
|
generic = {
|
||||||
|
enabled = true;
|
||||||
|
outbound = true;
|
||||||
|
};
|
||||||
|
feeds = {
|
||||||
|
enabled = true;
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
services.matrix-hookshot.serviceDependencies = [ "matrix-synapse.target" "nginx.service" ];
|
||||||
|
|
||||||
|
services.matrix-synapse-next.settings = {
|
||||||
|
app_service_config_files = [ config.sops.secrets."matrix/registrations/matrix-hookshot".path ];
|
||||||
|
};
|
||||||
|
|
||||||
|
services.nginx.virtualHosts."hookshot.pvv.ntnu.no" = {
|
||||||
|
enableACME = true;
|
||||||
|
locations."/" = {
|
||||||
|
proxyPass = "http://${webhookListenAddress}:${toString webhookListenPort}";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
}
|
|
@ -0,0 +1,127 @@
|
||||||
|
{
|
||||||
|
config,
|
||||||
|
pkgs,
|
||||||
|
lib,
|
||||||
|
...
|
||||||
|
}:
|
||||||
|
let
|
||||||
|
cfg = config.services.matrix-hookshot;
|
||||||
|
settingsFormat = pkgs.formats.yaml { };
|
||||||
|
configFile = settingsFormat.generate "matrix-hookshot-config.yml" cfg.settings;
|
||||||
|
in
|
||||||
|
{
|
||||||
|
options = {
|
||||||
|
services.matrix-hookshot = {
|
||||||
|
enable = lib.mkEnableOption "matrix-hookshot, a bridge between Matrix and project management services";
|
||||||
|
|
||||||
|
package = lib.mkPackageOption pkgs "matrix-hookshot" { };
|
||||||
|
|
||||||
|
registrationFile = lib.mkOption {
|
||||||
|
type = lib.types.path;
|
||||||
|
description = ''
|
||||||
|
Appservice registration file.
|
||||||
|
As it contains secret tokens, you may not want to add this to the publicly readable Nix store.
|
||||||
|
'';
|
||||||
|
example = lib.literalExpression ''
|
||||||
|
pkgs.writeText "matrix-hookshot-registration" \'\'
|
||||||
|
id: matrix-hookshot
|
||||||
|
as_token: aaaaaaaaaa
|
||||||
|
hs_token: aaaaaaaaaa
|
||||||
|
namespaces:
|
||||||
|
rooms: []
|
||||||
|
users:
|
||||||
|
- regex: "@_webhooks_.*:foobar"
|
||||||
|
exclusive: true
|
||||||
|
|
||||||
|
sender_localpart: hookshot
|
||||||
|
url: "http://localhost:9993"
|
||||||
|
rate_limited: false
|
||||||
|
\'\'
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
|
||||||
|
settings = lib.mkOption {
|
||||||
|
description = ''
|
||||||
|
{file}`config.yml` configuration as a Nix attribute set.
|
||||||
|
|
||||||
|
For details please see the [documentation](https://matrix-org.github.io/matrix-hookshot/latest/setup/sample-configuration.html).
|
||||||
|
'';
|
||||||
|
example = {
|
||||||
|
bridge = {
|
||||||
|
domain = "example.com";
|
||||||
|
url = "http://localhost:8008";
|
||||||
|
mediaUrl = "https://example.com";
|
||||||
|
port = 9993;
|
||||||
|
bindAddress = "127.0.0.1";
|
||||||
|
};
|
||||||
|
listeners = [
|
||||||
|
{
|
||||||
|
port = 9000;
|
||||||
|
bindAddress = "0.0.0.0";
|
||||||
|
resources = [ "webhooks" ];
|
||||||
|
}
|
||||||
|
{
|
||||||
|
port = 9001;
|
||||||
|
bindAddress = "localhost";
|
||||||
|
resources = [
|
||||||
|
"metrics"
|
||||||
|
"provisioning"
|
||||||
|
];
|
||||||
|
}
|
||||||
|
];
|
||||||
|
};
|
||||||
|
default = { };
|
||||||
|
type = lib.types.submodule {
|
||||||
|
freeformType = settingsFormat.type;
|
||||||
|
options = {
|
||||||
|
passFile = lib.mkOption {
|
||||||
|
type = lib.types.path;
|
||||||
|
default = "/var/lib/matrix-hookshot/passkey.pem";
|
||||||
|
description = ''
|
||||||
|
A passkey used to encrypt tokens stored inside the bridge.
|
||||||
|
File will be generated if not found.
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
serviceDependencies = lib.mkOption {
|
||||||
|
type = with lib.types; listOf str;
|
||||||
|
default = lib.optional config.services.matrix-synapse.enable config.services.matrix-synapse.serviceUnit;
|
||||||
|
defaultText = lib.literalExpression ''
|
||||||
|
lib.optional config.services.matrix-synapse.enable config.services.matrix-synapse.serviceUnit
|
||||||
|
'';
|
||||||
|
description = ''
|
||||||
|
List of Systemd services to require and wait for when starting the application service,
|
||||||
|
such as the Matrix homeserver if it's running on the same host.
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
config = lib.mkIf cfg.enable {
|
||||||
|
systemd.services.matrix-hookshot = {
|
||||||
|
description = "a bridge between Matrix and multiple project management services";
|
||||||
|
|
||||||
|
wantedBy = [ "multi-user.target" ];
|
||||||
|
wants = [ "network-online.target" ] ++ cfg.serviceDependencies;
|
||||||
|
after = [ "network-online.target" ] ++ cfg.serviceDependencies;
|
||||||
|
|
||||||
|
preStart = ''
|
||||||
|
if [ ! -f '${cfg.settings.passFile}' ]; then
|
||||||
|
mkdir -p $(dirname '${cfg.settings.passFile}')
|
||||||
|
${pkgs.openssl}/bin/openssl genpkey -out '${cfg.settings.passFile}' -outform PEM -algorithm RSA -pkeyopt rsa_keygen_bits:4096
|
||||||
|
fi
|
||||||
|
'';
|
||||||
|
|
||||||
|
serviceConfig = {
|
||||||
|
Type = "simple";
|
||||||
|
Restart = "always";
|
||||||
|
ExecStart = "${cfg.package}/bin/matrix-hookshot ${configFile} ${cfg.registrationFile}";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
meta.maintainers = with lib.maintainers; [ flandweber ];
|
||||||
|
}
|
|
@ -18,6 +18,8 @@ mediawiki:
|
||||||
postgres_password: ENC[AES256_GCM,data:FzykBVtJbA+Bey1GE5VqnSuv2GeobH1j,iv:wayQH3+y0FYFkr3JjmulI53SADk0Ikur/2mUS5kFrTk=,tag:d+nQ/se2bDA5aaQfBicnPQ==,type:str]
|
postgres_password: ENC[AES256_GCM,data:FzykBVtJbA+Bey1GE5VqnSuv2GeobH1j,iv:wayQH3+y0FYFkr3JjmulI53SADk0Ikur/2mUS5kFrTk=,tag:d+nQ/se2bDA5aaQfBicnPQ==,type:str]
|
||||||
cookie_salt: ENC[AES256_GCM,data:BioRPAvL4F9ORBJDFdqHot81RhVpAOf32v1ah3pvOLq8E88bxGyKFQZxAwpIL3UkWQIsWMnEerm5MEMYL1C2OQ==,iv:yMVqiPTQ8hO1IVAax6PIkD0V9YTOEunwDTtnGcmy6Kc=,tag:Z4+bZF4olLlkx7YpXeQiUw==,type:str]
|
cookie_salt: ENC[AES256_GCM,data:BioRPAvL4F9ORBJDFdqHot81RhVpAOf32v1ah3pvOLq8E88bxGyKFQZxAwpIL3UkWQIsWMnEerm5MEMYL1C2OQ==,iv:yMVqiPTQ8hO1IVAax6PIkD0V9YTOEunwDTtnGcmy6Kc=,tag:Z4+bZF4olLlkx7YpXeQiUw==,type:str]
|
||||||
admin_password: ENC[AES256_GCM,data:4eUXvcO7NLOWke9XShfKzj+x3FvqPONa,iv:3iZ+BTBTZ7yMJ0HT14cEMebKZattWUcYEevRsl/6WOk=,tag:CU0iDhPP2ndztdX5U5A4cw==,type:str]
|
admin_password: ENC[AES256_GCM,data:4eUXvcO7NLOWke9XShfKzj+x3FvqPONa,iv:3iZ+BTBTZ7yMJ0HT14cEMebKZattWUcYEevRsl/6WOk=,tag:CU0iDhPP2ndztdX5U5A4cw==,type:str]
|
||||||
|
roundcube:
|
||||||
|
postgres_password: ENC[AES256_GCM,data:fGHmq6r/ZCeIseHL8/gmm5DfWQYorI3OJq1TW0EHvh7rHL62M4TE+Lrlrmq8AIlmGLSWtO8AQzOP3toxidL6xWX3pcwLxtTefa1gom2oQf6ZL4TbAZLidHksdiro6pWtpMOO66bb8O9eXvZmns4=,iv:Irnb2/bgx8WilDyRLleWfo6HHafZ+vlDEwxIcgm1f18=,tag:eTNBUELmLwO7DsQN9CLX7Q==,type:str]
|
||||||
idp:
|
idp:
|
||||||
cookie_salt: ENC[AES256_GCM,data:cyV6HDCPHKQIa8T1+rFBFh6EuHtG5B508lg6uFYENK7qVpYuiTUIokdVQhY8SRLs2mECx/ampgnUHxCRB/Cc/A==,iv:QRrRUhzRQrLkmg38rrYtCEfF8U4/7ZHZUDSEq++BlbI=,tag:fLqFSLd+CKqJvmCh1fx8vg==,type:str]
|
cookie_salt: ENC[AES256_GCM,data:cyV6HDCPHKQIa8T1+rFBFh6EuHtG5B508lg6uFYENK7qVpYuiTUIokdVQhY8SRLs2mECx/ampgnUHxCRB/Cc/A==,iv:QRrRUhzRQrLkmg38rrYtCEfF8U4/7ZHZUDSEq++BlbI=,tag:fLqFSLd+CKqJvmCh1fx8vg==,type:str]
|
||||||
admin_password: ENC[AES256_GCM,data:Vf33Oenk6x6BIij1uW8RQDjTPcKhUVYA,iv:RNeyCNpTAYdBPrZwE3Y6CCjoAML/3XUvjfJCrr06IEU=,tag:zVOrx1oXnEyr/VwFCFaCDQ==,type:str]
|
admin_password: ENC[AES256_GCM,data:Vf33Oenk6x6BIij1uW8RQDjTPcKhUVYA,iv:RNeyCNpTAYdBPrZwE3Y6CCjoAML/3XUvjfJCrr06IEU=,tag:zVOrx1oXnEyr/VwFCFaCDQ==,type:str]
|
||||||
|
@ -95,8 +97,8 @@ sops:
|
||||||
UHpLRkdQTnhkeGlWVG9VS1hkWktyckEKAdwnA9URLYZ50lMtXrU9Q09d0L3Zfsyr
|
UHpLRkdQTnhkeGlWVG9VS1hkWktyckEKAdwnA9URLYZ50lMtXrU9Q09d0L3Zfsyr
|
||||||
4UsvjjdnFtsXwEZ9ZzOQrpiN0Oz24s3csw5KckDni6kslaloJZsLGg==
|
4UsvjjdnFtsXwEZ9ZzOQrpiN0Oz24s3csw5KckDni6kslaloJZsLGg==
|
||||||
-----END AGE ENCRYPTED FILE-----
|
-----END AGE ENCRYPTED FILE-----
|
||||||
lastmodified: "2024-09-01T01:33:50Z"
|
lastmodified: "2024-10-12T21:56:27Z"
|
||||||
mac: ENC[AES256_GCM,data:PkcOD9hJWD5tILO9PuZkOgIoujt4q2qtHBB9KF8ikrNKo0yw24Jf1ceI5/+BHCxhdi8sF4qQM/zty61zqwNaBsvrsLUkdWDwUDsuJQa1KKZiCEZPqYBc+qGIQ5wNPsU2zJ0c8+wU8H0LtGqKOH9GmaQtTdm0Rt2IcexV823uTjQ=,iv:GYTI85OgqnN8iUc6OOXO7Sz2XIthWJtz8zwMuWutEYs=,tag:2rhfhjXXzZLzoVlkINo0ZQ==,type:str]
|
mac: ENC[AES256_GCM,data:bZ1BbVC6D+B6SFze2ReeCUcQamK/O14zH3YxCjWBwMC++w3niIiEx4Bq7Ulci5yuMld0luVsfUzHoqFN/+zvZbV2rGVk8lVRiTrpFoSZ78aUUgeHG9ROLXsR7T7rVhLWbl86y1G5LcKws7G55V0wAh6f58WjYYzwR8fnBmfW1Ko=,iv:7xtMdtXQB9uZirE/CkUSmeu0qnG++R7DUR7zn/Bo0lM=,tag:DH/BJPpAp//quDqKNXyHcg==,type:str]
|
||||||
pgp:
|
pgp:
|
||||||
- created_at: "2024-08-04T00:03:28Z"
|
- created_at: "2024-08-04T00:03:28Z"
|
||||||
enc: |-
|
enc: |-
|
||||||
|
@ -119,4 +121,4 @@ sops:
|
||||||
-----END PGP MESSAGE-----
|
-----END PGP MESSAGE-----
|
||||||
fp: F7D37890228A907440E1FD4846B9228E814A2AAC
|
fp: F7D37890228A907440E1FD4846B9228E814A2AAC
|
||||||
unencrypted_suffix: _unencrypted
|
unencrypted_suffix: _unencrypted
|
||||||
version: 3.9.0
|
version: 3.9.1
|
||||||
|
|
Loading…
Reference in New Issue