bicep/matrix/hookshot: More configuration

Co-authored-by: Daniel Olsen <daniel.olsen99@gmail.com>

flake.nix

@@ -57,7 +57,7 @@
         rec {
           system = "x86_64-linux";
           specialArgs = {
-            inherit nixpkgs-unstable inputs;
+            inherit unstablePkgs inputs;
             values = import ./values.nix;
           };
 

hosts/bicep/services/matrix/default.nix

@@ -10,6 +10,7 @@
     ./mjolnir.nix
 
     ./discord.nix
+    ./hookshot
   ];
 
 

hosts/bicep/services/matrix/hookshot/default.nix

@@ -0,0 +1,103 @@
+{ config, lib, unstablePkgs, inputs, ... }:
+
+let
+  cfg = config.services.matrix-hookshot;
+  webhookListenAddress = "127.0.0.1";
+  webhookListenPort = 8435;
+in
+{
+  imports = [
+    ./module.nix
+  ];
+
+  sops.secrets."matrix/registrations/matrix-hookshot" = {
+    sopsFile = ../../../../../secrets/bicep/matrix.yaml;
+    key = "registrations/matrix-hookshot";
+    owner = config.users.users.matrix-synapse.name;
+    group = config.users.groups.keys-matrix-registrations.name;
+  };
+
+  systemd.services.matrix-hookshot = {
+    serviceConfig.SupplementaryGroups = [ config.users.groups.keys-matrix-registrations.name ];
+  };
+
+  services.matrix-hookshot = {
+    enable = true;
+    package = unstablePkgs.matrix-hookshot;
+    registrationFile = config.sops.secrets."matrix/registrations/matrix-hookshot".path;
+    settings = {
+      bridge = {
+        bindAddress = "127.0.0.1";
+        domain = "pvv.ntnu.no";
+        url = "https://matrix.pvv.ntnu.no";
+        mediaUrl = "https://matrix.pvv.ntnu.no";
+        port = 9993;
+      };
+      listeners = [
+        {
+          bindAddress = webhookListenAddress;
+          port = webhookListenPort;
+          resources = [
+            "webhooks"
+            # "metrics"
+            # "provisioning"
+            "widgets"
+          ];
+        }
+      ];
+      generic = {
+        enabled = true;
+        outbound = true;
+        urlPrefix = "https://hookshot.pvv.ntnu.no/webhook/";
+        userIdPrefix = "_webhooks_";
+        allowJsTransformationFunctions = false;
+        waitForComplete = false;
+      };
+      feeds = {
+        enabled = true;
+        pollIntervalSeconds = 600;
+      };
+      
+      serviceBots = [
+        { localpart = "bot_feeds";
+          displayname = "Aya";
+          avatar = ./feeds.png;
+          prefix = "!aya";
+          service = "feeds";
+        }
+      ];
+
+      permissions = [
+        # Users of the PVV Server
+        { actor = "pvv.ntnu.no";
+          services = [ { service = "*"; level = "commands"; } ];
+        }
+        # Members of Medlem space (for people with their own hs)
+        { actor = "!pZOTJQinWyyTWaeOgK:pvv.ntnu.no";
+          services = [ { service = "*"; level = "commands"; } ];
+        }
+        # Members of Drift
+        { actor = "!eYgeufLrninXxQpYml:pvv.ntnu.no";
+          services = [ { service = "*"; level = "admin"; } ];
+        }
+        # Dan bootstrap
+        { actor = "@dandellion:dodsorf.as";
+          services = [ { service = "*"; level = "admin"; } ];
+        }
+      ];
+    };
+  };
+
+  services.matrix-hookshot.serviceDependencies = [ "matrix-synapse.target" "nginx.service" ];
+
+  services.matrix-synapse-next.settings = {
+    app_service_config_files = [ config.sops.secrets."matrix/registrations/matrix-hookshot".path ];
+  };
+
+  services.nginx.virtualHosts."hookshot.pvv.ntnu.no" = {
+    enableACME = true;
+    locations."/" = {
+      proxyPass = "http://${webhookListenAddress}:${toString webhookListenPort}";
+    };
+  };
+}

hosts/bicep/services/matrix/hookshot/module.nix

@@ -0,0 +1,127 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+let
+  cfg = config.services.matrix-hookshot;
+  settingsFormat = pkgs.formats.yaml { };
+  configFile = settingsFormat.generate "matrix-hookshot-config.yml" cfg.settings;
+in
+{
+  options = {
+    services.matrix-hookshot = {
+      enable = lib.mkEnableOption "matrix-hookshot, a bridge between Matrix and project management services";
+
+      package = lib.mkPackageOption pkgs "matrix-hookshot" { };
+
+      registrationFile = lib.mkOption {
+        type = lib.types.path;
+        description = ''
+          Appservice registration file.
+          As it contains secret tokens, you may not want to add this to the publicly readable Nix store.
+        '';
+        example = lib.literalExpression ''
+          pkgs.writeText "matrix-hookshot-registration" \'\'
+            id: matrix-hookshot
+            as_token: aaaaaaaaaa
+            hs_token: aaaaaaaaaa
+            namespaces:
+              rooms: []
+              users:
+                - regex: "@_webhooks_.*:foobar"
+                  exclusive: true
+
+            sender_localpart: hookshot
+            url: "http://localhost:9993"
+            rate_limited: false
+            \'\'
+        '';
+      };
+
+      settings = lib.mkOption {
+        description = ''
+          {file}`config.yml` configuration as a Nix attribute set.
+
+          For details please see the [documentation](https://matrix-org.github.io/matrix-hookshot/latest/setup/sample-configuration.html).
+        '';
+        example = {
+          bridge = {
+            domain = "example.com";
+            url = "http://localhost:8008";
+            mediaUrl = "https://example.com";
+            port = 9993;
+            bindAddress = "127.0.0.1";
+          };
+          listeners = [
+            {
+              port = 9000;
+              bindAddress = "0.0.0.0";
+              resources = [ "webhooks" ];
+            }
+            {
+              port = 9001;
+              bindAddress = "localhost";
+              resources = [
+                "metrics"
+                "provisioning"
+              ];
+            }
+          ];
+        };
+        default = { };
+        type = lib.types.submodule {
+          freeformType = settingsFormat.type;
+          options = {
+            passFile = lib.mkOption {
+              type = lib.types.path;
+              default = "/var/lib/matrix-hookshot/passkey.pem";
+              description = ''
+                A passkey used to encrypt tokens stored inside the bridge.
+                File will be generated if not found.
+              '';
+            };
+          };
+        };
+      };
+
+      serviceDependencies = lib.mkOption {
+        type = with lib.types; listOf str;
+        default = lib.optional config.services.matrix-synapse.enable config.services.matrix-synapse.serviceUnit;
+        defaultText = lib.literalExpression ''
+          lib.optional config.services.matrix-synapse.enable config.services.matrix-synapse.serviceUnit
+        '';
+        description = ''
+          List of Systemd services to require and wait for when starting the application service,
+          such as the Matrix homeserver if it's running on the same host.
+        '';
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    systemd.services.matrix-hookshot = {
+      description = "a bridge between Matrix and multiple project management services";
+
+      wantedBy = [ "multi-user.target" ];
+      wants = [ "network-online.target" ] ++ cfg.serviceDependencies;
+      after = [ "network-online.target" ] ++ cfg.serviceDependencies;
+
+      preStart = ''
+        if [ ! -f '${cfg.settings.passFile}' ]; then
+          mkdir -p $(dirname '${cfg.settings.passFile}')
+          ${pkgs.openssl}/bin/openssl genpkey -out '${cfg.settings.passFile}' -outform PEM -algorithm RSA -pkeyopt rsa_keygen_bits:4096
+        fi
+      '';
+
+      serviceConfig = {
+        Type = "simple";
+        Restart = "always";
+        ExecStart = "${cfg.package}/bin/matrix-hookshot ${configFile} ${cfg.registrationFile}";
+      };
+    };
+  };
+
+  meta.maintainers = with lib.maintainers; [ flandweber ];
+}

secrets/bicep/matrix.yaml

@@ -8,7 +8,7 @@ mjolnir:
     access_token: ENC[AES256_GCM,data:ERFqZjK7MRD0xWt91FNCIxP1YC6Qj54QgnckHlCTtcQVLWaM1h2h9lHS+K8=,iv:1d7vmFkXAPcsmumzlmOT31amdrKLWtL5sJiS8G9g+LE=,tag:2l0vWzJ6P12ofuBdf5CCWw==,type:str]
 registrations:
     mx-puppet-discord: ENC[AES256_GCM,data:FleyXxgOmc05nTP6M2DBJlacufN3p/05eZm4kB8+K4ci0k24o3zli988wlM/kyeZmxu4pgQlJ3lNLte4uip2hBXHWG5t5Ldzmr7bNCUD+r7nM+I1lfNkrDROPZ54bHysmn9O5CHpEa16rSo6RJgncIPqsLJxTwjC7qZlkOpzqvMhkq/MHCVOpvg0M/6AUR+AlSZoggujBMoXLznQNQapN13foEsbuo/QxjszM/ObGmhYMVyaS+TDBXzQLA8Yuj50Q/gZCIINWZ4G2qmgsGxxNR4I+usUQml/jxCtIXS4zn/ettXfL9G4Fdm2F9u1v11DehtTGa5xoxDq94M9rIxOqeJpvgEQEyyKAyFUIrlINfGl7tAj4Zu7+9Z8JTRAnppjM1q8iInwn/Z2L9KgB0YFi/Go1whgXly+TH6hpreo7m5klXV/ff/aV3ghOgFCGA8nBrZFqE8Uw268q9tV1s1dxCb6TbpGf19V5c9MD6BsCIVeoq+j9I/I8iZpzg2Reb4IlHhMDwbwsL2w2ks30wiZ9XO/CFrXDY4uBlI=,iv:3vvkGvldS8Raibg6tzlV8VY1O9NCLxSuNX/lwi1QgiA=,tag:D/noIsE3xlOiYM6Pk+cc8Q==,type:str]
-    matrix-hookshot: ENC[AES256_GCM,data:xdgW720VcaREJEaVs0BTT9/5fBp+VpXL54oRrLt53ymjMMS5QCLA9VLW0kOwadpZcr9xv2txVICkU63wmmH5W6HzDHpVbVWG5ByUMyvZkBWWB5HEvfNi6+66CGRNwPqrtrmM4aS8cg3eoXje+qJbjfxk0UzQsDkPV/VXxpzcQt47GTMUX59Xu9C6SYncze5G3QkTn30o+jiJMiha4xTULfqnP0iHXDVN1iFlNudOgr8keQIdYnFu7QqWZdvuERUPA9OANy8c0CQxoMxuUfHnLvxPyEYkDXTyBIgBAWC2AlOqHJWXUccqXYZWSRFp51uB3Tmlhkv+nTsmVWndnmOgnVpvUp9BS1wTqF8z3Vg63EHCrOGb4iPprjH13hUompmXDsFt4+FC1vd1KIl5DeAL9N3WCDa0hX4reH0SVmI2alNG28cpKdFimMowgdHJ9nLA7rgIqGRjciZMr+uJTGnWHeOFpqUo3hkF9vA2+Ca0Ti307SfgCsymfVgt9nFIoHGwWG2CJ0FdAs7JUiKIuG4K87HpYaowcAcCj9wU2sVKvDx+zQWb7pmRM2TGDJZ2W/yzYdFWLCqbSUBt0S/1rEPiqj5h7+y2ZTWB42aN0lcjWOwZBP39+wvJI+4EUE/F+aezPd6viWyJn8pIK9ZBDEcWfBBEb/xADa8UTBk6LjL/Sqsu9BDvCbIaOeTDi/LaUNJLOdre9GiUtjWlAxXKjYhYaFpI0SlXP42JZxLhz5jvGE8kGgPK+ruq2bai3KiwaWJRSadnO5L1+bFTjaiVrp2PSskULdHmCxgKDfPDmMWglPvF7wCswMmE4rqvBx0fxVtPTVzQeo6pwUBbZ4Ihg6UlcFEBncyNCahuvClCNO2st7c7ygbnMoZuDDYjgqbCf2jVOPg06FDgn5wXi2jJerw4L7NAD8FtsepScuqdjmsB14oepMDMgOnzKc72h4JiIouUe3wkU1ReTdIIxfpuvLpF9WNzwZOc214YfDWdhus+RvsHZtoaupezjHFDiFmwP5tygyz3iw==,iv:HIVrDHhwEQ+NOU4MYUXgz1aSjQD445b/LSj4rqvJRY8=,tag:VJAy4v9OZJrOV2y4JFuh9w==,type:str]
+    matrix-hookshot: ENC[AES256_GCM,data:fBt9h6gRkEc7QLpeIJhOpizZwA9By89PjgEKNCOqrdnfbWfBk3ueol2W4DU1vcsjNpOpTsvwAm5KmoqhBIEpjGaycwtt9c399/dJGP6YQC3puk3c4Psz2C+SZJgk4erJ8GOeiUT7kjUkxAOgU+Hl+TteWSYylgd7PGVElJa0oXIbaxkpHZXuk42VlZl/bny4Fw3ckW19+2iuPbZtflmPrGNvGHuCSc6IwQC665/HmPJzENruLcqirICqgy7l9ZnkbrVqVabQTcLqa8GVM7zcpXzsoAMOuRdM3rvEPyaruPcBbemvlQnM1p/2NEnjDwbRKaZr1FtDpBnuEkQwHf1AQyOKZLJLEdqqDRiYrH27/Ps+voMQjZeB+IcPqbBBcdrF0DpFclWOKbNYWci2qW2Zpni242nJM4vVKQPfqi+UJSqhDjs1czDN2Z2stuyt+N1Nv3ykmfjSJz2/HeqYHTti6kkbxfcB2rDdwYWYNlrvTTsvzOewvhY8t0JImBHXiJtp2Zs/ej6p63cuto9RiU55JifJrQx8Fq0BEHeAzcmT39lHzXd/EQoCJqStz2/lnLMfzff5zlRkl4FgSaBoxoWs6DjLztysC/ibwcn92HI8pHRUc41jLslQLT//dV5QBOyW7F2JyCe/A4J5VEVphn3xLqLC/1xH0pwNaevWxR5hqPzm9XC9zn4UV3OMzVj76xDxywh3QaC3B7ZdHlOoyKNXeL5UDhmDjXbGyrxP1HdOAfITpafS9tbfCYROp31j0Q32PC5fUvEjbVYMq5do17/+MEfVdk4p695N3cqLnyoinh0u7KZZw7Im80mk0+zJrChy6D6dVAEZd/AQFgvcY2q3cbOWA/EuniCZrVFAp9u/mljPdeO3MZiJSc7MyElo2CD0YllZeE+KYoHQrIgWJZ6TiItVk3CyLGsYfqNDcJ+o6iicqAdsCiF9IeXO/BfscN2o5sbcvmAShdxCqCYYVtb3Fp6or7bIUf16fq1jkz4XkGwEj+VT9JTXjRbavx5O74VpnyIuTzI7oXYIU4ZUVI5Fkw==,iv:2ffGONfuT9GUVxEStQoZftYUFQc/HcnSLNpZG1t1oCM=,tag:idETgOr/XgfpueTt3gPLHQ==,type:str]
 sops:
     kms: []
     gcp_kms: []
@@ -69,8 +69,8 @@ sops:
             WEh5NFN6SFF1TlltdWFWTGw4MHRHUkUKrKIvC87xjEmwxPQhH8dN+ZuaJTCgPY28
             pR62KxmoKFICLTHPpYP3euiAx5M9BWvgvCnA/US/5klpk8MtlreNFA==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2024-10-12T21:48:59Z"
-    mac: ENC[AES256_GCM,data:fLpGjWpoLwwwofwBzkNakD9JoNjbbGOvTEKrrT1jTWXo26Y01NkuqTEEwbmNkODOjmlyeTovRnY3K0dujtEcKJO8Nlu3uNCiL/ie3KitYTQH1lrsI7IdtXvCRELU5trQCqFmBjYUFhFyldKyKL30QxEuYxxTa+t1eBmtOL4jBTY=,iv:kcAPBuA3R5uF6bTfffMgdnsySKxSmCheQx1tOpRwyf4=,tag:aUGRR5w8Ljcdh458ir99DA==,type:str]
+    lastmodified: "2024-10-13T05:04:30Z"
+    mac: ENC[AES256_GCM,data:Qtw6ZPxUIp28fw1xFR72Utt+aZZXcXOOJO9lwCsZEsqMKPCtxwNw2NumB4aEBuv16dL14boy/FRtwq0mu/DyA6zgnOeeEzxlcxtFAkqK2A03ZMGEIGYTdB3sBDb2Rm7gnK7J9ypoxb0EP40x18lErk7Cn54B28DPlCkY/tj4B/0=,iv:MRXfroBOUCeWKknjDTfUNNHH91cCkf3vUFAAP+UIN7Y=,tag:awdtYAtmMP2Y72m8PlmgwA==,type:str]
     pgp:
         - created_at: "2024-08-04T00:03:46Z"
           enc: |-