treewide: add support for unix sockets

This is mostly a maintainance release to be compatible with nixos-23.11 but comes with some small improvements as well

MIGRATIONS.MD

@@ -2,9 +2,9 @@
 
 This is a best effort document descibing neccecary changes you might have to do when updating
 
-## 0.5.0 UNRELEASED
-
-The module has been renamed from `synapse` to `default`
+## 0.5.0
 
+* The module has been renamed from `synapse` to `default`
+* The synapse module now expects a wrapper-style package. This means the module is now incompatible with nixpkgs < 23.11.
 
 

pkgs/matrix-sliding-sync/default.nix

@@ -1,37 +0,0 @@
-{ lib
-, buildGoModule
-, fetchFromGitHub
-}:
-
-buildGoModule rec {
-  pname = "matrix-sliding-sync";
-  version = "0.99.11";
-
-  src = fetchFromGitHub {
-    owner = "matrix-org";
-    repo = "sliding-sync";
-    rev = "refs/tags/v${version}";
-    hash = "sha256-Wd/nnJhKg+BDyOIz42zEScjzQRrpEq6YG9/9Tk24hgg=";
-  };
-
-  vendorHash = "sha256-0QSyYhOht1j1tWNxHQh+NUZA/W1xy7ANu+29H/gusOE=";
-
-  subPackages = [ "cmd/syncv3" ];
-
-  ldflags = [
-    "-s"
-    "-w"
-    "-X main.GitCommit=${src.rev}"
-  ];
-
-  # requires a running matrix-synapse
-  doCheck = false;
-
-  meta = with lib; {
-    description = "A sliding sync implementation of MSC3575 for matrix";
-    homepage = "https://github.com/matrix-org/sliding-sync";
-    license = with licenses; [ asl20 ];
-    maintainers = with maintainers; [ emilylange ];
-    mainProgram = "syncv3";
-  };
-}

sliding-sync/default.nix

@@ -11,7 +11,7 @@ in
 
     package = lib.mkOption {
       type = lib.types.package;
-      default = pkgs.callPackage ../pkgs/matrix-sliding-sync { };
+      default = pkgs.matrix-sliding-sync;
       description = "What package to use for the sliding-sync proxy.";
     };
 

synapse-module/default.nix

@@ -10,9 +10,25 @@ let
   wcfgText = "config.services.matrix-synapse-next.workers";
 
   format = pkgs.formats.yaml {};
-  matrix-synapse-common-config = format.generate "matrix-synapse-common-config.yaml" cfg.settings;
-  pluginsEnv = cfg.package.python.buildEnv.override {
-    extraLibs = cfg.plugins;
+  matrix-synapse-common-config = format.generate "matrix-synapse-common-config.yaml" (cfg.settings // {
+    listeners = map (lib.filterAttrsRecursive (_: v: v != null)) cfg.settings.listeners;
+  });
+
+  # TODO: Align better with the upstream module
+  wrapped = cfg.package.override { 
+    inherit (cfg) plugins;
+    extras = [
+      "postgres"
+      "saml2"
+      "oidc"
+      "systemd"
+      "url-preview"
+      "sentry"
+      "jwt"
+      "redis"
+      "cache-memory"
+      "user-search"
+    ];
   };
 
   inherit (lib)
@@ -33,7 +49,7 @@ in
   imports = [
     ./nginx.nix
     (import ./workers.nix {
-      inherit matrix-lib throw' format matrix-synapse-common-config pluginsEnv;
+      inherit matrix-lib throw' format matrix-synapse-common-config wrapped;
     })
   ];
 
@@ -65,6 +81,15 @@ in
       '';
     };
 
+    socketDir = mkOption {
+      type = types.path;
+      default = "/run/matrix-synapse";
+      description = ''
+        The directory where matrix-synapse by default stores the sockets of
+        all listeners that bind to UNIX sockets.
+      '';
+    };
+
     enableNginx = mkEnableOption "The synapse module managing nginx";
 
     public_baseurl = mkOption {
@@ -121,14 +146,42 @@ in
             type = types.listOf (types.submodule {
               options = {
                 port = mkOption {
-                  type = types.port;
-                  description = "The TCP port to bind to";
+                  type = with types; nullOr types.port;
+                  default = null;
+                  description = ''
+                    The TCP port to bind to.
+
+                    ::: {.note}
+                      This option will be ignored if {option}`path` is set to a non-null value.
+                    :::
+                  '';
                   example = 8448;
                 };
 
+                path = mkOption {
+                  type = with types; nullOr path;
+                  default = null;
+                  description = ''
+                    The UNIX socket to bind to.
+
+                    ::: {.note}
+                      This option will override {option}`bind_addresses` and {option}`port`
+                      if set to a non-null value.
+                    :::
+                  '';
+                  example = literalExpression ''''${${cfgText}.socketDir}/matrix-synapse.sock'';
+                };
+
                 bind_addresses = mkOption {
                   type = types.listOf types.str;
-                  description = "A list of local addresses to listen on";
+                  default = [ ];
+                  description = ''
+                    A list of local addresses to listen on.
+
+                    ::: {.note}
+                      This option will be ignored if {option}`path` is set to a non-null value.
+                    :::
+                  '';
                 };
 
                 type = mkOption {
@@ -187,16 +240,14 @@ in
             # TODO: add defaultText
             default = [
               {
-                port = 8008;
-                bind_addresses = [ "127.0.0.1" ];
+                path = "${cfg.socketDir}/matrix-synapse.sock";
                 resources = [
                   { names = [ "client" ]; compress = true; }
                   { names = [ "federation" ]; compress = false; }
                 ];
               }
               (mkIf (wcfg.instances != { }) {
-                port = 9093;
-                bind_addresses = [ "127.0.0.1" ];
+                path = "${cfg.socketDir}/matrix-synapse-replication.sock";
                 resources = [
                   {  names = [ "replication" ]; }
                 ];
@@ -338,6 +389,12 @@ in
   };
 
   config = mkIf cfg.enable {
+    assertions = [ ]
+      ++ (map (l: {
+        assertion = l.path == null -> (l.bind_addresses != [ ] && l.port != null);
+        message = "Some listeners are missing either a socket path or a bind_address + port to listen on";
+      }) cfg.settings.listeners);
+
     users.users.matrix-synapse = {
       group = "matrix-synapse";
       home = cfg.dataDir;
@@ -376,21 +433,20 @@ in
           };
         in "${cfg.package}/bin/synapse_homeserver ${flags}";
 
-        environment.PYTHONPATH =
-          lib.makeSearchPathOutput "lib" cfg.package.python.sitePackages [ pluginsEnv ];
-
         serviceConfig = {
           Type = "notify";
           User = "matrix-synapse";
           Group = "matrix-synapse";
           Slice = "system-matrix-synapse.slice";
           WorkingDirectory = cfg.dataDir;
+          StateDirectory = "matrix-synapse";
+          RuntimeDirectory = "matrix-synapse";
           ExecStart = let
             flags = lib.cli.toGNUCommandLineShell {} {
               config-path = [ matrix-synapse-common-config ] ++ cfg.extraConfigFiles;
               keys-directory = cfg.dataDir;
             };
-          in "${cfg.package}/bin/synapse_homeserver ${flags}";
+          in "${wrapped}/bin/synapse_homeserver ${flags}";
           ExecReload = "${pkgs.utillinux}/bin/kill -HUP $MAINPID";
           Restart = "on-failure";
         };

synapse-module/nginx.nix

@@ -2,13 +2,54 @@
 let
   cfg = config.services.matrix-synapse-next;
 
-  getWorkersOfType = type: lib.filterAttrs (_: w: w.type == type) cfg.workers.instances;
-  isListenerType = type: listener: lib.lists.any (r: lib.lists.any (n: n == type) r.names) listener.resources;
-  firstListenerOfType = type: worker: lib.lists.findFirst (isListenerType type) (throw "No federation endpoint on receiver") worker.settings.worker_listeners;
-  wAddressOfType = type: w: lib.lists.findFirst (_: true) (throw "No address in receiver") (firstListenerOfType type w).bind_addresses;
-  wPortOfType = type: w: (firstListenerOfType type w).port;
-  wSocketAddressOfType = type: w: "${wAddressOfType type w}:${builtins.toString (wPortOfType type w)}";
-  generateSocketAddresses = type: workers: lib.mapAttrsToList (_: w: "${wSocketAddressOfType type w}") workers;
+  mapWorkersToUpstreamsByType = workerInstances: lib.pipe workerInstances [
+    lib.attrValues
+
+    # Index by worker type
+    (lib.foldl (acc: worker: acc // {
+      ${worker.type} = (acc.${worker.type} or [ ]) ++ [ worker ];
+    }) { })
+
+    # Subindex by listener type (listener names), and convert to upstreams
+    (lib.mapAttrs (_: workers: lib.pipe workers [
+      (lib.concatMap (worker: worker.settings.worker_listeners))
+      lib.flatten
+      mapListenersToUpstreamsByType
+    ]))
+  ];
+
+  mapListenersToUpstreamsByType = listenerInstances: lib.pipe listenerInstances [
+    # Index by listener type (listener names)
+    (lib.concatMap (listener: lib.pipe listener [
+      (listener: let
+        allResourceNames = lib.pipe listener.resources [
+          (map (resource: resource.names))
+          lib.flatten
+          lib.unique
+        ];
+      in if allResourceNames == [ ]
+        then { "empty" = listener; }
+        else lib.genAttrs allResourceNames (_: listener))
+      lib.attrsToList
+    ]))
+
+    (lib.foldl (acc: listener: acc // {
+      ${listener.name} = (acc.${listener.name} or [ ]) ++ [ listener.value ];
+    }) { })
+
+    # Convert listeners to upstream URIs
+    (lib.mapAttrs (_: listeners: lib.pipe listeners [
+      (lib.concatMap (listener:
+        if listener.path != null
+          then [ "unix:${listener.path}" ]
+          else (map (addr: "${addr}:${toString listener.port}") listener.bind_addresses)
+      ))
+      (uris: lib.genAttrs uris (_: { }))
+    ]))
+  ];
+
+  workerUpstreams = mapWorkersToUpstreamsByType cfg.workers.instances;
+  listenerUpstreams = mapListenersToUpstreamsByType cfg.settings.listeners;
 in
 {
   config = lib.mkIf cfg.enableNginx {
@@ -138,24 +179,17 @@ in
     '';
 
     services.nginx.upstreams.synapse_master.servers = let
-      isMainListener = l: isListenerType "client" l && isListenerType "federation" l;
-      firstMainListener = lib.findFirst isMainListener
-        (throw "No catch-all listener configured") cfg.settings.listeners;
-        address = lib.findFirst (_: true) (throw "No address in main listener") firstMainListener.bind_addresses;
-        port = firstMainListener.port;
-        socketAddress = "${address}:${builtins.toString port}";
-    in {
-      "${socketAddress}" = { };
-    };
+      mainListeners = builtins.intersectAttrs
+        (listenerUpstreams."client" or { })
+        (listenerUpstreams."federation" or { });
+    in
+      assert lib.assertMsg (mainListeners != { })
+        "No catch-all listener configured, or listener is not bound to an address";
+        mainListeners;
 
 
     services.nginx.upstreams.synapse_worker_federation = {
-      servers = let
-        fedReceivers = getWorkersOfType "fed-receiver";
-        socketAddresses = generateSocketAddresses "federation" fedReceivers;
-        in if fedReceivers != { } then
-          lib.genAttrs socketAddresses (_: { })
-      else config.services.nginx.upstreams.synapse_master.servers;
+      servers = workerUpstreams.fed-receiver.federation or config.services.nginx.upstreams.synapse_master.servers;
       extraConfig = ''
         ip_hash;
       '';
@@ -163,12 +197,7 @@ in
 
 
     services.nginx.upstreams.synapse_worker_initial_sync = {
-      servers = let
-        initialSyncers = getWorkersOfType "initial-sync";
-        socketAddresses = generateSocketAddresses "client" initialSyncers;
-      in if initialSyncers != { } then
-        lib.genAttrs socketAddresses (_: { })
-      else config.services.nginx.upstreams.synapse_master.servers;
+      servers = workerUpstreams.initial-sync.client or config.services.nginx.upstreams.synapse_master.servers;
       extraConfig = ''
         hash $mxid_localpart consistent;
       '';
@@ -176,12 +205,7 @@ in
 
 
     services.nginx.upstreams.synapse_worker_normal_sync = {
-      servers = let
-        normalSyncers = getWorkersOfType "normal-sync";
-        socketAddresses = generateSocketAddresses "client" normalSyncers;
-      in if normalSyncers != { } then
-        lib.genAttrs socketAddresses (_: { })
-      else config.services.nginx.upstreams.synapse_master.servers;
+      servers = workerUpstreams.normal-sync.client or config.services.nginx.upstreams.synapse_master.servers;
       extraConfig = ''
         hash $mxid_localpart consistent;
       '';
@@ -189,12 +213,7 @@ in
 
 
     services.nginx.upstreams.synapse_worker_user-dir = {
-      servers = let
-        workers = getWorkersOfType "user-dir";
-        socketAddresses = generateSocketAddresses "client" workers;
-      in if workers != { } then
-        lib.genAttrs socketAddresses (_: { })
-      else config.services.nginx.upstreams.synapse_master.servers;
+      servers = workerUpstreams.user-dir.client or config.services.nginx.upstreams.synapse_master.servers;
     };
 
     services.nginx.virtualHosts."${cfg.public_baseurl}" = {

synapse-module/workers.nix

@@ -1,6 +1,6 @@
 { matrix-synapse-common-config,
   matrix-lib,
-  pluginsEnv,
+  wrapped,
   throw',
   format
 }:
@@ -86,10 +86,17 @@ in {
         };
 
         port = mkOption {
-          type = types.port;
+          type = with types; nullOr port;
+          default = null;
           description = "The TCP port to bind to";
         };
 
+        path = mkOption {
+          type = with types; nullOr path;
+          default = null;
+          description = "The UNIX socket to bind to";
+        };
+
         bind_addresses = mkOption {
           type = with types; listOf str;
           description = "A list of local addresses to listen on";
@@ -161,7 +168,7 @@ in {
     };
   in {
     mainReplicationHost = mkOption {
-      type = types.str;
+      type = with types; nullOr str;
       default = let
         host = (matrix-lib.connectionInfo mainReplicationListener).host;
       in
@@ -174,18 +181,32 @@ in {
     };
 
     mainReplicationPort = mkOption {
-      type = types.port;
+      type = with types; nullOr port;
       default = mainReplicationListener.port;
       # TODO: add defaultText
       description = "Port for the main synapse instance's replication listener";
     };
 
+    mainReplicationPath = mkOption {
+      type = with types; nullOr path;
+      default = mainReplicationListener.path;
+      # TODO: add defaultText
+      description = "Path to the UNIX socket of the main synapse instance's replication listener";
+    };
+
     defaultListenerAddress = mkOption {
       type = types.str;
       default = "127.0.0.1";
       description = "The default listener address for the worker";
     };
 
+    workersUsePath = mkOption {
+      type = types.bool;
+      description = "Whether to enable UNIX sockets for all automatically generated workers";
+      default = true;
+      example = false;
+    };
+
     workerStartingPort = mkOption {
       type = types.port;
       description = "What port should the automatically configured workers start enumerating from";
@@ -233,22 +254,32 @@ in {
   };
 
   config = {
+    assertions = [ ]
+      ++ (lib.concatMap (worker:
+        (map (l: {
+          assertion = l.path == null -> (l.bind_addresses != [ ] && l.port != null);
+          message = "At least one worker listener is missing either a socket path or a bind_address + port to listen on";
+        }) worker.settings.worker_listeners)
+      ) (lib.attrValues wcfg.instances));
+
     services.matrix-synapse-next.settings = {
       federation_sender_instances =
         lib.genList (i: "auto-fed-sender${toString (i + 1)}") wcfg.federationSenders;
 
       instance_map = (lib.mkIf (cfg.workers.instances != { }) ({
-        main = let
-          host = lib.head mainReplicationListener.bind_addresses;
-        in {
-          host = if builtins.elem host [ "0.0.0.0" "::"] then "127.0.0.1" else host;
-          port = mainReplicationListener.port;
+        main = if wcfg.mainReplicationPath != null then {
+          path = wcfg.mainReplicationPath;
+        } else {
+          host = wcfg.mainReplicationHost;
+          port = wcfg.mainReplicationPort;
         };
       } // genAttrs' (lib.lists.range 1 wcfg.eventPersisters)
         (i: "auto-event-persist${toString i}")
         (i: let
           wRL = matrix-lib.firstListenerOfType "replication" wcfg.instances."auto-event-persist${toString i}".settings.worker_listeners;
-        in matrix-lib.connectionInfo wRL)));
+        in if wRL.path != null then {
+          inherit (wRL) path;
+        } else matrix-lib.connectionInfo wRL)));
 
       stream_writers.events =
         mkIf (wcfg.eventPersisters > 0)
@@ -260,10 +291,15 @@ in {
 
     services.matrix-synapse-next.workers.instances = let
       sum = lib.foldl lib.add 0;
-      workerListenersWithMetrics = portOffset:
-        lib.singleton ({
-          port = wcfg.workerStartingPort + portOffset - 1;
-        }) 
+      workerListenersWithMetrics = portOffset: name:
+        [(if wcfg.workersUsePath
+          then {
+            path = "${cfg.socketDir}/matrix-synapse-worker-${name}.sock";
+          }
+          else {
+            port = wcfg.workerStartingPort + portOffset - 1;
+          }
+        )]
         ++ lib.optional wcfg.enableMetrics {
           port = wcfg.metricsStartingPort + portOffset;
           resources = [ { names = [ "metrics" ]; } ];
@@ -274,7 +310,7 @@ in {
         numberOfWorkers,
         portOffset ? 0,
         nameFn ? i: "auto-${type}${toString i}",
-        workerListenerFn ? i: workerListenersWithMetrics (portOffset + i)
+        workerListenerFn ? i: name: workerListenersWithMetrics (portOffset + i) name
       }: genAttrs'
         (lib.lists.range 1 numberOfWorkers)
         nameFn
@@ -282,7 +318,7 @@ in {
           isAuto = true;
           inherit type;
           index = i;
-          settings.worker_listeners = workerListenerFn i;
+          settings.worker_listeners = workerListenerFn i (nameFn i);
         });
 
       workerInstances = {
@@ -323,8 +359,13 @@ in {
 
     systemd.services = let
       workerList = lib.mapAttrsToList lib.nameValuePair wcfg.instances;
-      workerConfig = worker: format.generate "matrix-synapse-worker-${worker.name}-config.yaml"
-        (worker.value.settings // { worker_name = worker.name; });
+      workerConfig = worker:
+        format.generate "matrix-synapse-worker-${worker.name}-config.yaml"
+        (worker.value.settings // {
+          worker_name = worker.name;
+          worker_listeners =
+            map (lib.filterAttrsRecursive (_: v: v != null)) worker.value.settings.worker_listeners;
+        });
     in builtins.listToAttrs (lib.flip map workerList (worker: {
       name = "matrix-synapse-worker-${worker.name}";
       value = {
@@ -333,17 +374,14 @@ in {
         wantedBy = [ "matrix-synapse.target" ];
         after = [ "matrix-synapse.service" ];
         requires = [ "matrix-synapse.service" ];
-        environment = {
-          PYTHONPATH = lib.makeSearchPathOutput "lib" cfg.package.python.sitePackages [
-            pluginsEnv
-          ];
-        };
         serviceConfig = {
           Type = "notify";
           User = "matrix-synapse";
           Group = "matrix-synapse";
           Slice = "system-matrix-synapse.slice";
           WorkingDirectory = cfg.dataDir;
+          RuntimeDirectory = "matrix-synapse";
+          StateDirectory = "matrix-synapse";
           ExecStartPre = pkgs.writers.writeBash "wait-for-synapse" ''
             # From https://md.darmstadt.ccc.de/synapse-at-work
             while ! systemctl is-active -q matrix-synapse.service; do
@@ -355,7 +393,7 @@ in {
               config-path = [ matrix-synapse-common-config (workerConfig worker) ] ++ cfg.extraConfigFiles;
               keys-directory = cfg.dataDir;
             };
-          in "${cfg.package}/bin/synapse_worker ${flags}";
+          in "${wrapped}/bin/synapse_worker ${flags}";
         };
       };
     }));