Add mautrix bridges

hosts/iron/ports.nix

@@ -5,6 +5,8 @@ custom-utils.validatePortAttrset {
   home-assistant.tcp = 8123;
   jellyfin.tcp = 8096;
   matrix-synapse.tcp = 8008;
+  mautrix-signal.tcp = 29319;
+  mautrix-whatsapp.tcp = 29318;
   navidrome.tcp = 4533;
   nginx-http.tcp = 80;
   nginx-https.tcp = 443;

hosts/iron/services/matrix.nix

@@ -19,5 +19,28 @@ in
       host = "turn.jalr.de";
       sharedSecretFile = config.sops.secrets.synapse-turn-shared-secret.path;
     };
+    mautrix-whatsapp = {
+      enable = true;
+      port = ports.mautrix-whatsapp.tcp;
+      settings.bridge.permissions = {
+        # Only one user since using the name from the address book does not
+        # work with multiple users
+        #"@jalr:jalr.de" = 100;
+        "@jalr:jalr.de" = "admin";
+        "jalr.de" = "user";
+      };
+    };
+    mautrix-signal = {
+      enable = true;
+      port = ports.mautrix-signal.tcp;
+      settings.bridge = {
+        permissions = {
+          "@jalr:jalr.de" = "admin";
+          "jalr.de" = "user";
+        };
+        default_bridge_presence = false;
+        send_presence_on_typing = false;
+      };
+    };
   };
 }

modules/matrix/default.nix

@@ -10,6 +10,16 @@ in
         description = "TCP port for synapse service.";
         type = port;
       };
+      app_service_config = mkOption {
+        type = attrsOf path;
+        description = ''
+          An attribute set of app_service_config_files
+        '';
+        default = { };
+        example = {
+          "my-service-alias" = "/path/to/appservice.yaml";
+        };
+      };
     };
     fqdn = mkOption {
       type = str;
@@ -38,8 +48,40 @@ in
         description = "Location of the shared secret file for the TURN service";
       };
     };
+    mautrix-signal = {
+      enable = mkEnableOption "signal bridge";
+      serviceDependencies = mkOption {
+        type = with types; listOf str;
+        default = optional config.services.matrix-synapse.enable config.services.matrix-synapse.serviceUnit;
+        defaultText = literalExpression ''
+          optional config.services.matrix-synapse.enable config.services.matrix-synapse.serviceUnit
+        '';
+        description = lib.mdDoc ''
+          List of Systemd services to require and wait for when starting the application service.
+        '';
+      };
+      port = mkOption {
+        description = "TCP port for mautrix-signal.";
+        type = port;
+      };
+      settings = mkOption {
+        type = (pkgs.formats.json { }).type;
+      };
+    };
+    mautrix-whatsapp = {
+      enable = mkEnableOption "whatsapp bridge";
+      port = mkOption {
+        description = "TCP port for mautrix-whatsapp.";
+        type = port;
+      };
+      settings = mkOption {
+        type = (pkgs.formats.json { }).type;
+      };
+    };
   };
   imports = [
+    ./mautrix-signal.nix
+    ./mautrix-whatsapp.nix
     ./synapse.nix
   ];
 }

modules/matrix/mautrix-signal.nix

@@ -0,0 +1,136 @@
+{ config, lib, pkgs, ... }:
+
+let
+  cfg = config.jalr.matrix;
+  synapseCfg = config.services.matrix-synapse.settings;
+  dataDir = "/var/lib/mautrix-signal";
+  registrationFile = "${dataDir}/signal-registration.yaml";
+  settings = {
+    homeserver = {
+      address = synapseCfg.public_baseurl;
+      domain = synapseCfg.server_name;
+    };
+    appservice = rec {
+      hostname = "127.0.0.1";
+      port = cfg.mautrix-signal.port;
+      address = "http://${hostname}:${toString port}";
+      provisioning.shared_secret = "disable";
+      database = "sqlite:///${dataDir}/mautrix-signal.db";
+    };
+    bridge = {
+      encryption = {
+        allow = true;
+        default = true;
+      };
+      verification_levels = {
+        receive = "cross-signed-tofu";
+        send = "cross-signed-tofu";
+        share = "cross-signed-tofu";
+      };
+    };
+    logging = {
+      version = 1;
+      min_level = "info";
+      writers = lib.singleton {
+        type = "stdout";
+        format = "pretty-colored";
+        time_format = " ";
+      };
+    };
+  } // cfg.mautrix-signal.settings;
+  settingsFormat = pkgs.formats.json { };
+  settingsFile = "${dataDir}/config.json";
+  settingsFileUnsubstituted =
+    settingsFormat.generate "mautrix-signal-config.json" settings;
+in
+lib.mkIf cfg.mautrix-signal.enable {
+  systemd.services.mautrix-signal = {
+    description = "mautrix-signal, A Matrix-Signal puppeting bridge.";
+    wantedBy = [ "multi-user.target" ];
+    wants = [ "network-online.target" ] ++ cfg.mautrix-signal.serviceDependencies;
+    after = [ "network-online.target" ] ++ cfg.mautrix-signal.serviceDependencies;
+
+    environment.HOME = dataDir;
+    preStart = ''
+      # substitute the settings file by environment variables
+      # in this case read from EnvironmentFile
+      test -f '${settingsFile}' && rm -f '${settingsFile}'
+      old_umask=$(umask)
+      umask 0177
+      ${pkgs.envsubst}/bin/envsubst \
+        -o '${settingsFile}' \
+        -i '${settingsFileUnsubstituted}'
+
+      cp '${settingsFile}' '${settingsFile}.tmp'
+      umask $old_umask
+
+      # generate the appservice's registration file if absent
+      if [ ! -f '${registrationFile}' ]; then
+        ${pkgs.mautrix-signal}/bin/mautrix-signal \
+          --generate-registration \
+          --config='${settingsFile}.tmp' \
+          --registration='${registrationFile}'
+      fi
+
+      umask 0177
+        ${pkgs.yq}/bin/yq -s '.[0].appservice.as_token = .[1].as_token
+          | .[0].appservice.hs_token = .[1].hs_token
+          | .[0]' '${settingsFile}' '${registrationFile}' \
+          > '${settingsFile}.tmp'
+      mv '${settingsFile}.tmp' '${settingsFile}'
+      umask $old_umask
+    '';
+    serviceConfig = {
+      Type = "exec";
+      User = "mautrix-signal";
+      #EnvironmentFile = cfg.environmentFile;
+      WorkingDirectory = dataDir;
+      StateDirectory = lib.mkIf (dataDir == "/var/lib/mautrix-signal") "mautrix-signal";
+      ExecStart = ''
+        ${pkgs.mautrix-signal}/bin/mautrix-signal \
+          --config='${settingsFile}' \
+          --no-update
+      '';
+      Restart = "on-failure";
+      RestartSec = "30s";
+
+      ReadWritePaths = dataDir;
+      NoNewPrivileges = true;
+      MemoryDenyWriteExecute = true;
+      PrivateDevices = true;
+      PrivateTmp = true;
+      #ProtectHome = true;
+      ProtectSystem = "strict";
+      ProtectControlGroups = true;
+      RestrictSUIDSGID = true;
+      RestrictRealtime = true;
+      LockPersonality = true;
+      ProtectKernelLogs = true;
+      ProtectKernelTunables = true;
+      ProtectHostname = true;
+      ProtectKernelModules = true;
+      PrivateUsers = true;
+      ProtectClock = true;
+      SystemCallArchitectures = "native";
+      SystemCallErrorNumber = "EPERM";
+      SystemCallFilter = "@system-service";
+    };
+    restartTriggers = [ settingsFileUnsubstituted ];
+  };
+
+  users.users.mautrix-signal = {
+    isSystemUser = true;
+    group = "mautrix-signal";
+    home = dataDir;
+    description = "mautrix-signal bridge user";
+  };
+
+  users.groups.mautrix-signal = { };
+
+  services.signald = {
+    enable = true;
+    group = "mautrix-signal";
+  };
+
+  jalr.matrix.synapse.app_service_config."mautrix-signal" = "/var/lib/mautrix-signal/signal-registration.yaml";
+}

modules/matrix/mautrix-whatsapp.nix

@@ -0,0 +1,55 @@
+{ config, lib, pkgs, ... }:
+
+let
+  cfg = config.jalr.matrix;
+  synapseCfg = config.services.matrix-synapse.settings;
+in
+lib.mkIf cfg.mautrix-whatsapp.enable {
+  services.mautrix-whatsapp = {
+    enable = true;
+    settings = {
+      homeserver = {
+        address = synapseCfg.public_baseurl;
+        domain = synapseCfg.server_name;
+      };
+      appservice = rec {
+        hostname = "127.0.0.1";
+        port = cfg.mautrix-whatsapp.port;
+        address = "http://${hostname}:${toString port}";
+        provisioning.shared_secret = "disable";
+        database = {
+          type = "sqlite3";
+          uri = "/var/lib/mautrix-whatsapp/mautrix-whatsapp.db";
+        };
+        id = "whatsapp";
+        bot = {
+          username = "whatsappbot";
+          displayname = "WhatsApp bridge bot";
+          avatar = "mxc://maunium.net/NeXNQarUbrlYBiPCpprYsRqr";
+        };
+      };
+      whatsapp = {
+        browser_name = "mx-wa";
+        os_name = "Mautrix-WhatsApp bridge";
+      };
+      bridge = {
+        command_prefix = "!wa";
+        delivery_receipts = true;
+        displayname_template = "{{if .FullName}}{{.FullName}}{{else if .Notify}}{{.Notify}}{{else}}{{.Jid}}{{end}} (WA)";
+        history_sync = {
+          backfill = true;
+        };
+        identity_change_notices = true;
+        private_chat_portal_meta = true;
+        reaction_notices = true;
+        relay.enable = false;
+      };
+      logging = {
+        print_level = "info";
+        file_name_format = null;
+      };
+    } // cfg.mautrix-whatsapp.settings;
+  };
+
+  jalr.matrix.synapse.app_service_config."mautrix-whatsapp" = "/var/lib/mautrix-whatsapp/whatsapp-registration.yaml";
+}

modules/matrix/synapse.nix

@@ -76,6 +76,36 @@ lib.mkIf cfg.enable {
     ];
   };
 
+  services.matrix-synapse.settings.app_service_config_files = lib.attrsets.mapAttrsToList
+    (
+      name: value:
+        "/run/matrix-synapse/app_service_config/${name}.yaml"
+    )
+    cfg.synapse.app_service_config;
+  systemd.services.matrix-synapse = {
+    restartTriggers = lib.attrsets.mapAttrsToList
+      (
+        name: value:
+          "${value}"
+      )
+      cfg.synapse.app_service_config;
+    serviceConfig = {
+      RuntimeDirectory = "matrix-synapse/app_service_config";
+      ExecStartPre = lib.attrsets.mapAttrsToList
+        (name: value:
+          let
+            script = pkgs.writeShellScript "app_service_config-${name}"
+              ''
+                cp "${value}" "$RUNTIME_DIRECTORY/${name}.yaml"
+                chown matrix-synapse: "$RUNTIME_DIRECTORY/${name}.yaml"
+              '';
+          in
+          "+${script}"
+        )
+        cfg.synapse.app_service_config;
+    };
+  };
+
   services.nginx.virtualHosts = {
     "${cfg.fqdn}" = {
       enableACME = true;