nixos/conduwuit: init

nixos/doc/manual/release-notes/rl-2505.section.md

@@ -12,7 +12,7 @@
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
 
-- Create the first release note entry in this section!
+- [Conduwuit](https://conduwuit.puppyirl.gay/), a federated chat server implementing the Matrix protocol, forked from Conduit. Available as [services.conduwuit](options.html#opt-services.conduwuit.enable).
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
 

nixos/modules/module-list.nix

@@ -704,6 +704,7 @@
   ./services/matrix/appservice-discord.nix
   ./services/matrix/appservice-irc.nix
   ./services/matrix/conduit.nix
+  ./services/matrix/conduwuit.nix
   ./services/matrix/dendrite.nix
   ./services/matrix/hebbot.nix
   ./services/matrix/hookshot.nix

nixos/modules/services/matrix/conduwuit.nix

@@ -0,0 +1,285 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.services.conduwuit;
+
+  format = pkgs.formats.toml { };
+  # TOML does not allow null values, so we just omit those fields
+  filteredSettings = lib.converge (lib.filterAttrsRecursive (_: v: v != null)) cfg.settings;
+  configFile = format.generate "conduwuit.toml" filteredSettings;
+in
+{
+  meta.maintainers = with lib.maintainers; [ niklaskorz ];
+  options.services.conduwuit = {
+    enable = lib.mkEnableOption "conduwuit";
+
+    user = lib.mkOption {
+      type = lib.types.nonEmptyStr;
+      description = ''
+        The user {command}`conduwuit` is run as.
+      '';
+      default = "conduwuit";
+    };
+
+    group = lib.mkOption {
+      type = lib.types.nonEmptyStr;
+      description = ''
+        The group {command}`conduwuit` is run as.
+      '';
+      default = "conduwuit";
+    };
+
+    extraEnvironment = lib.mkOption {
+      type = lib.types.attrsOf lib.types.str;
+      description = "Extra Environment variables to pass to the conduwuit server.";
+      default = { };
+      example = {
+        RUST_BACKTRACE = "yes";
+      };
+    };
+
+    package = lib.mkPackageOption pkgs "conduwuit" { };
+
+    settings = lib.mkOption {
+      type = lib.types.submodule {
+        freeformType = format.type;
+        options = {
+          global.server_name = lib.mkOption {
+            type = lib.types.nonEmptyStr;
+            default = "";
+            example = "example.com";
+            description = "The server_name is the name of this server. It is used as a suffix for user # and room ids.";
+          };
+          global.address = lib.mkOption {
+            type = lib.types.nullOr (
+              lib.types.oneOf [
+                lib.types.nonEmptyStr
+                (lib.types.listOf lib.types.nonEmptyStr)
+              ]
+            );
+            default = null;
+            description = ''
+              Address (IPv4 or IPv6) to listen on for connections by the reverse proxy/tls terminator.
+              If set to `null`, conduwuit will listen on IPv4 and IPv6 localhost.
+              Must be `null` if `unix_socket_path` is set.
+
+              To listen on multiple addresses, specify a list. For example:
+              `[ "127.0.0.1" "::1" ]`
+            '';
+          };
+          global.port = lib.mkOption {
+            type = lib.types.oneOf [
+              lib.types.port
+              (lib.types.listOf lib.types.port)
+            ];
+            default = 6167;
+            description = "The port(s) conduwuit will be running on. You need to set up a reverse proxy in your web server (e.g. apache or nginx), so all requests to /_matrix on port 443 and 8448 will be forwarded to the conduwuit instance running on this port";
+          };
+          global.unix_socket_path = lib.mkOption {
+            type = lib.types.nullOr lib.types.path;
+            default = null;
+            description = ''
+              Listen on a UNIX socket at the specified path. If listening on a UNIX socket,
+              listening on an address will be disabled. The `address` option must be set to
+              `null` (the default value). You must add your reverse proxy to the `conduwuit`
+              group or set {option}`services.conduwuit.group` to a group your reverse proxy
+              is part of.
+
+              This will automatically add a static user to your system if {option}`services.conduwuit.user`
+              is left at the default value `conduwuit, and a static group if {option}`services.conduwuit.group`
+              is left at the default value `conduwuit`, since this is the intended way how
+              unix sockets should be used with conduwuit.
+            '';
+          };
+          global.unix_socket_perms = lib.mkOption {
+            type = lib.types.ints.positive;
+            default = 660;
+            description = "The default permissions (in octal) to create the UNIX socket with.";
+          };
+          global.max_request_size = lib.mkOption {
+            type = lib.types.ints.positive;
+            default = 20000000;
+            description = "Max request size in bytes. Don't forget to also change it in the proxy.";
+          };
+          global.allow_registration = lib.mkOption {
+            type = lib.types.bool;
+            default = false;
+            description = ''
+              Whether new users can register on this server.
+
+              If set to true without a token configured, users can register with no
+              form of 2nd-step only if you set
+              `yes_i_am_very_very_sure_i_want_an_open_registration_server_prone_to_abuse` to
+              true in your config.
+              If you would like registration only via token reg, please configure
+              `registration_token` or `registration_token_file`.
+            '';
+          };
+          global.allow_encryption = lib.mkOption {
+            type = lib.types.bool;
+            default = true;
+            description = "Whether new encrypted rooms can be created. Note: existing rooms will continue to work.";
+          };
+          global.allow_federation = lib.mkOption {
+            type = lib.types.bool;
+            default = true;
+            description = ''
+              Whether this server federates with other servers.
+            '';
+          };
+          global.trusted_servers = lib.mkOption {
+            type = lib.types.listOf lib.types.str;
+            default = [ "matrix.org" ];
+            description = ''
+              Servers listed here will be used to gather public keys of other servers
+              (notary trusted key servers).
+
+              Currently, conduwuit doesn't support inbound batched key requests, so
+              this list should only contain other Synapse servers.
+
+              Example: `[ "matrix.org" "constellatory.net" "tchncs.de" ]`
+            '';
+          };
+          global.database_path = lib.mkOption {
+            type = lib.types.path;
+            default = "/var/lib/conduwuit/";
+            description = ''
+              Path to the conduwuit database, the directory where conduwuit will save its data.
+              To change this value the DynamicUser feature has to be disabled for the conduwuit
+              systemd service.
+            '';
+          };
+          global.allow_check_for_updates = lib.mkOption {
+            type = lib.types.bool;
+            default = false;
+            description = ''
+              If enabled, conduwuit will send a simple GET request periodically to
+              <https://pupbrain.dev/check-for-updates/stable> for any new announcements made.
+              Despite the name, this is not an update check endpoint, it is simply an announcement check endpoint.
+
+              Disabled by default.
+            '';
+          };
+        };
+      };
+      default = { };
+      description = ''
+        Generates the conduwuit.toml configuration file. Refer to
+        <https://conduwuit.puppyirl.gay/configuration.html>
+        for details on supported values.
+        Note that database_path can not be edited because the service's reliance on systemd StateDir.
+      '';
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = cfg.settings.global.unix_socket_path == null || cfg.settings.global.address == null;
+        message = ''
+          In `services.conduwuit.settings.global`, `unix_socket_path` and `address` cannot be set at the
+          same time.
+          You can either listen on an IP address or a UNIX socket, but not both.
+          Leave one of the two options unset or explicitly set them to `null`.
+        '';
+      }
+      {
+        assertion =
+          config.systemd.services.conduwuit.serviceConfig.DynamicUser
+          -> cfg.settings.global.database_path == "/var/lib/conduwuit/";
+        message = ''
+          To change `services.conduwuit.settings.global.database_path`
+          `systemd.services.conduwuit.serviceConfig.DynamicUser` has to be disabled
+        '';
+      }
+    ];
+
+    users = lib.mkIf (cfg.settings.global.unix_socket_path != null) {
+      groups.${cfg.group} = lib.mkIf (cfg.group == "conduwuit") { };
+      users.${cfg.user} = lib.mkIf (cfg.user == "conduwuit") {
+        group = cfg.group;
+        home = cfg.settings.global.database_path;
+        isSystemUser = true;
+      };
+    };
+
+    systemd.services.conduwuit = {
+      description = "Conduwuit Matrix Server";
+      documentation = [ "https://conduwuit.puppyirl.gay/" ];
+      wantedBy = [ "multi-user.target" ];
+      wants = [ "network-online.target" ];
+      after = [ "network-online.target" ];
+      environment = lib.mkMerge ([
+        { CONDUWUIT_CONFIG = configFile; }
+        cfg.extraEnvironment
+      ]);
+      startLimitBurst = 5;
+      startLimitIntervalSec = 60;
+      serviceConfig = {
+        DynamicUser = true;
+        User = cfg.user;
+        Group = cfg.group;
+
+        DevicePolicy = "closed";
+        LockPersonality = true;
+        MemoryDenyWriteExecute = true;
+        NoNewPrivileges = true;
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        PrivateDevices = true;
+        PrivateMounts = true;
+        PrivateTmp = true;
+        PrivateUsers = true;
+        PrivateIPC = true;
+        RemoveIPC = true;
+        RestrictAddressFamilies = [
+          "AF_INET"
+          "AF_INET6"
+          "AF_UNIX"
+        ];
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        SystemCallArchitectures = "native";
+        SystemCallFilter = [
+          "@system-service"
+          "@resources"
+          "~@clock"
+          "@debug"
+          "@module"
+          "@mount"
+          "@reboot"
+          "@swap"
+          "@cpu-emulation"
+          "@obsolete"
+          "@timer"
+          "@chown"
+          "@setuid"
+          "@privileged"
+          "@keyring"
+          "@ipc"
+        ];
+        SystemCallErrorNumber = "EPERM";
+
+        StateDirectory = "conduwuit";
+        StateDirectoryMode = "0700";
+        RuntimeDirectory = "conduwuit";
+        RuntimeDirectoryMode = "0750";
+
+        ExecStart = lib.getExe cfg.package;
+        Restart = "on-failure";
+        RestartSec = 10;
+        TimeoutStopSec = "4m";
+        TimeoutStartSec = "4m";
+      };
+    };
+  };
+}

nixos/tests/all-tests.nix

@@ -214,6 +214,7 @@ in {
   coder = handleTest ./coder.nix {};
   collectd = handleTest ./collectd.nix {};
   commafeed = handleTest ./commafeed.nix {};
+  conduwuit = handleTest ./matrix/conduwuit.nix {};
   connman = handleTest ./connman.nix {};
   consul = handleTest ./consul.nix {};
   consul-template = handleTest ./consul-template.nix {};