mirror of
https://github.com/NixOS/nixpkgs.git
synced 2024-12-24 06:33:42 +00:00
0a6e6cf7e6
this converts meta.doc into an md pointer, not an xml pointer. since we no longer need xml for manual chapters we can also remove support for manual chapters from md-to-db.sh since pandoc converts smart quotes to docbook quote elements and our nixos-render-docs does not we lose this distinction in the rendered output. that's probably not that bad, our stylesheet didn't make use of this anyway (and pre-23.05 versions of the chapters didn't use quote elements either). also updates the nixpkgs manual to clarify that option docs support all extensions (although it doesn't support headings at all, so heading anchors don't work by extension).
243 lines
8.0 KiB
Nix
243 lines
8.0 KiB
Nix
{ config, lib, pkgs, ... }:
|
|
|
|
with lib;
|
|
let
|
|
cfg = config.services.mjolnir;
|
|
|
|
yamlConfig = {
|
|
inherit (cfg) dataPath managementRoom protectedRooms;
|
|
|
|
accessToken = "@ACCESS_TOKEN@"; # will be replaced in "generateConfig"
|
|
homeserverUrl =
|
|
if cfg.pantalaimon.enable then
|
|
"http://${cfg.pantalaimon.options.listenAddress}:${toString cfg.pantalaimon.options.listenPort}"
|
|
else
|
|
cfg.homeserverUrl;
|
|
|
|
rawHomeserverUrl = cfg.homeserverUrl;
|
|
|
|
pantalaimon = {
|
|
inherit (cfg.pantalaimon) username;
|
|
|
|
use = cfg.pantalaimon.enable;
|
|
password = "@PANTALAIMON_PASSWORD@"; # will be replaced in "generateConfig"
|
|
};
|
|
};
|
|
|
|
moduleConfigFile = pkgs.writeText "module-config.yaml" (
|
|
generators.toYAML { } (filterAttrs (_: v: v != null)
|
|
(fold recursiveUpdate { } [ yamlConfig cfg.settings ])));
|
|
|
|
# these config files will be merged one after the other to build the final config
|
|
configFiles = [
|
|
"${pkgs.mjolnir}/share/mjolnir/config/default.yaml"
|
|
moduleConfigFile
|
|
];
|
|
|
|
# this will generate the default.yaml file with all configFiles as inputs and
|
|
# replace all secret strings using replace-secret
|
|
generateConfig = pkgs.writeShellScript "mjolnir-generate-config" (
|
|
let
|
|
yqEvalStr = concatImapStringsSep " * " (pos: _: "select(fileIndex == ${toString (pos - 1)})") configFiles;
|
|
yqEvalArgs = concatStringsSep " " configFiles;
|
|
in
|
|
''
|
|
set -euo pipefail
|
|
|
|
umask 077
|
|
|
|
# mjolnir will try to load a config from "./config/default.yaml" in the working directory
|
|
# -> let's place the generated config there
|
|
mkdir -p ${cfg.dataPath}/config
|
|
|
|
# merge all config files into one, overriding settings of the previous one with the next config
|
|
# e.g. "eval-all 'select(fileIndex == 0) * select(fileIndex == 1)' filea.yaml fileb.yaml" will merge filea.yaml with fileb.yaml
|
|
${pkgs.yq-go}/bin/yq eval-all -P '${yqEvalStr}' ${yqEvalArgs} > ${cfg.dataPath}/config/default.yaml
|
|
|
|
${optionalString (cfg.accessTokenFile != null) ''
|
|
${pkgs.replace-secret}/bin/replace-secret '@ACCESS_TOKEN@' '${cfg.accessTokenFile}' ${cfg.dataPath}/config/default.yaml
|
|
''}
|
|
${optionalString (cfg.pantalaimon.passwordFile != null) ''
|
|
${pkgs.replace-secret}/bin/replace-secret '@PANTALAIMON_PASSWORD@' '${cfg.pantalaimon.passwordFile}' ${cfg.dataPath}/config/default.yaml
|
|
''}
|
|
''
|
|
);
|
|
in
|
|
{
|
|
options.services.mjolnir = {
|
|
enable = mkEnableOption (lib.mdDoc "Mjolnir, a moderation tool for Matrix");
|
|
|
|
homeserverUrl = mkOption {
|
|
type = types.str;
|
|
default = "https://matrix.org";
|
|
description = lib.mdDoc ''
|
|
Where the homeserver is located (client-server URL).
|
|
|
|
If `pantalaimon.enable` is `true`, this option will become the homeserver to which `pantalaimon` connects.
|
|
The listen address of `pantalaimon` will then become the `homeserverUrl` of `mjolnir`.
|
|
'';
|
|
};
|
|
|
|
accessTokenFile = mkOption {
|
|
type = with types; nullOr path;
|
|
default = null;
|
|
description = lib.mdDoc ''
|
|
File containing the matrix access token for the `mjolnir` user.
|
|
'';
|
|
};
|
|
|
|
pantalaimon = mkOption {
|
|
description = lib.mdDoc ''
|
|
`pantalaimon` options (enables E2E Encryption support).
|
|
|
|
This will create a `pantalaimon` instance with the name "mjolnir".
|
|
'';
|
|
default = { };
|
|
type = types.submodule {
|
|
options = {
|
|
enable = mkEnableOption (lib.mdDoc ''
|
|
If true, accessToken is ignored and the username/password below will be
|
|
used instead. The access token of the bot will be stored in the dataPath.
|
|
'');
|
|
|
|
username = mkOption {
|
|
type = types.str;
|
|
description = lib.mdDoc "The username to login with.";
|
|
};
|
|
|
|
passwordFile = mkOption {
|
|
type = with types; nullOr path;
|
|
default = null;
|
|
description = lib.mdDoc ''
|
|
File containing the matrix password for the `mjolnir` user.
|
|
'';
|
|
};
|
|
|
|
options = mkOption {
|
|
type = types.submodule (import ./pantalaimon-options.nix);
|
|
default = { };
|
|
description = lib.mdDoc ''
|
|
passthrough additional options to the `pantalaimon` service.
|
|
'';
|
|
};
|
|
};
|
|
};
|
|
};
|
|
|
|
dataPath = mkOption {
|
|
type = types.path;
|
|
default = "/var/lib/mjolnir";
|
|
description = lib.mdDoc ''
|
|
The directory the bot should store various bits of information in.
|
|
'';
|
|
};
|
|
|
|
managementRoom = mkOption {
|
|
type = types.str;
|
|
default = "#moderators:example.org";
|
|
description = lib.mdDoc ''
|
|
The room ID where people can use the bot. The bot has no access controls, so
|
|
anyone in this room can use the bot - secure your room!
|
|
This should be a room alias or room ID - not a matrix.to URL.
|
|
Note: `mjolnir` is fairly verbose - expect a lot of messages from it.
|
|
'';
|
|
};
|
|
|
|
protectedRooms = mkOption {
|
|
type = types.listOf types.str;
|
|
default = [ ];
|
|
example = literalExpression ''
|
|
[
|
|
"https://matrix.to/#/#yourroom:example.org"
|
|
"https://matrix.to/#/#anotherroom:example.org"
|
|
]
|
|
'';
|
|
description = lib.mdDoc ''
|
|
A list of rooms to protect (matrix.to URLs).
|
|
'';
|
|
};
|
|
|
|
settings = mkOption {
|
|
default = { };
|
|
type = (pkgs.formats.yaml { }).type;
|
|
example = literalExpression ''
|
|
{
|
|
autojoinOnlyIfManager = true;
|
|
automaticallyRedactForReasons = [ "spam" "advertising" ];
|
|
}
|
|
'';
|
|
description = lib.mdDoc ''
|
|
Additional settings (see [mjolnir default config](https://github.com/matrix-org/mjolnir/blob/main/config/default.yaml) for available settings). These settings will override settings made by the module config.
|
|
'';
|
|
};
|
|
};
|
|
|
|
config = mkIf config.services.mjolnir.enable {
|
|
assertions = [
|
|
{
|
|
assertion = !(cfg.pantalaimon.enable && cfg.pantalaimon.passwordFile == null);
|
|
message = "Specify pantalaimon.passwordFile";
|
|
}
|
|
{
|
|
assertion = !(cfg.pantalaimon.enable && cfg.accessTokenFile != null);
|
|
message = "Do not specify accessTokenFile when using pantalaimon";
|
|
}
|
|
{
|
|
assertion = !(!cfg.pantalaimon.enable && cfg.accessTokenFile == null);
|
|
message = "Specify accessTokenFile when not using pantalaimon";
|
|
}
|
|
];
|
|
|
|
services.pantalaimon-headless.instances."mjolnir" = mkIf cfg.pantalaimon.enable
|
|
{
|
|
homeserver = cfg.homeserverUrl;
|
|
} // cfg.pantalaimon.options;
|
|
|
|
systemd.services.mjolnir = {
|
|
description = "mjolnir - a moderation tool for Matrix";
|
|
wants = [ "network-online.target" ] ++ optionals (cfg.pantalaimon.enable) [ "pantalaimon-mjolnir.service" ];
|
|
after = [ "network-online.target" ] ++ optionals (cfg.pantalaimon.enable) [ "pantalaimon-mjolnir.service" ];
|
|
wantedBy = [ "multi-user.target" ];
|
|
|
|
serviceConfig = {
|
|
ExecStart = ''${pkgs.mjolnir}/bin/mjolnir'';
|
|
ExecStartPre = [ generateConfig ];
|
|
WorkingDirectory = cfg.dataPath;
|
|
StateDirectory = "mjolnir";
|
|
StateDirectoryMode = "0700";
|
|
ProtectSystem = "strict";
|
|
ProtectHome = true;
|
|
PrivateTmp = true;
|
|
NoNewPrivileges = true;
|
|
PrivateDevices = true;
|
|
User = "mjolnir";
|
|
Restart = "on-failure";
|
|
|
|
/* TODO: wait for #102397 to be resolved. Then load secrets from $CREDENTIALS_DIRECTORY+"/NAME"
|
|
DynamicUser = true;
|
|
LoadCredential = [] ++
|
|
optionals (cfg.accessTokenFile != null) [
|
|
"access_token:${cfg.accessTokenFile}"
|
|
] ++
|
|
optionals (cfg.pantalaimon.passwordFile != null) [
|
|
"pantalaimon_password:${cfg.pantalaimon.passwordFile}"
|
|
];
|
|
*/
|
|
};
|
|
};
|
|
|
|
users = {
|
|
users.mjolnir = {
|
|
group = "mjolnir";
|
|
isSystemUser = true;
|
|
};
|
|
groups.mjolnir = { };
|
|
};
|
|
};
|
|
|
|
meta = {
|
|
doc = ./mjolnir.md;
|
|
maintainers = with maintainers; [ jojosch ];
|
|
};
|
|
}
|