From 9567f487a6db627bda7937e3227c7e034c0743dc Mon Sep 17 00:00:00 2001 From: Lillian-Violet Date: Thu, 29 Feb 2024 23:51:14 +0100 Subject: [PATCH] Copied this config, have to edit it more, but looks promising --- nixos/server/package-configs/conduit/copy.nix | 256 ++++++++++++++++++ 1 file changed, 256 insertions(+) create mode 100644 nixos/server/package-configs/conduit/copy.nix diff --git a/nixos/server/package-configs/conduit/copy.nix b/nixos/server/package-configs/conduit/copy.nix new file mode 100644 index 0000000..78b1518 --- /dev/null +++ b/nixos/server/package-configs/conduit/copy.nix @@ -0,0 +1,256 @@ +{ + pkgs, + config, + lib, + flake-inputs, + ... +}: let + inherit (lib.strings) concatMapStringsSep; + + cfg = config.services.matrix-conduit; + domain = "matrix.gladtherescake.eu"; + turn-realm = "turn.gladtherescake.eu"; +in { + services.matrix-conduit = { + enable = true; + package = flake-inputs.nixpkgs-unstable.legacyPackages.${pkgs.system}.matrix-conduit; + settings.global = { + address = "127.0.0.1"; + server_name = domain; + database_backend = "rocksdb"; + + turn_uris = let + address = "${config.services.coturn.realm}:${toString config.services.coturn.listening-port}"; + tls-address = "${config.services.coturn.realm}:${toString config.services.coturn.tls-listening-port}"; + in [ + "turn:${address}?transport=udp" + "turn:${address}?transport=tcp" + "turns:${tls-address}?transport=udp" + "turns:${tls-address}?transport=tcp" + ]; + }; + }; + + systemd.services.heisenbridge = let + replaceSecretBin = "${pkgs.replace-secret}/bin/replace-secret"; + registrationFile = builtins.toFile "heisenbridge-registration.yaml" (builtins.toJSON { + id = "heisenbridge"; + url = "http://127.0.0.1:9898"; + as_token = "@AS_TOKEN@"; + hs_token = "@HS_TOKEN@"; + rate_limited = false; + sender_localpart = "heisenbridge"; + namespaces = { + users = [ + { + regex = "@irc_.*"; + exclusive = true; + } + { + regex = "@heisenbridge:.*"; + exclusive = true; + } + ]; + aliases = []; + rooms = []; + }; + }); + + # TODO(tlater): Starting with systemd 253 it will become possible + # to do the credential setup as part of ExecStartPre/preStart + # instead. + # + # This will also make it possible to actually set caps on the + # heisenbridge process using systemd, so that we can run the + # identd process. + execScript = pkgs.writeShellScript "heisenbridge" '' + cp ${registrationFile} "$RUNTIME_DIRECTORY/heisenbridge-registration.yaml" + chmod 600 $RUNTIME_DIRECTORY/heisenbridge-registration.yaml + ${replaceSecretBin} '@AS_TOKEN@' "$CREDENTIALS_DIRECTORY/heisenbridge_as-token" "$RUNTIME_DIRECTORY/heisenbridge-registration.yaml" + ${replaceSecretBin} '@HS_TOKEN@' "$CREDENTIALS_DIRECTORY/heisenbridge_hs-token" "$RUNTIME_DIRECTORY/heisenbridge-registration.yaml" + chmod 400 $RUNTIME_DIRECTORY/heisenbridge-registration.yaml + + ${pkgs.heisenbridge}/bin/heisenbridge \ + --config $RUNTIME_DIRECTORY/heisenbridge-registration.yaml \ + --owner @tlater:matrix.tlater.net \ + 'http://localhost:${toString cfg.settings.global.port}' + ''; + in { + description = "Matrix<->IRC bridge"; + wantedBy = ["multi-user.target"]; + after = ["conduit.service"]; + + serviceConfig = { + Type = "simple"; + + LoadCredential = "heisenbridge:/run/secrets/heisenbridge"; + + ExecStart = execScript; + + DynamicUser = true; + RuntimeDirectory = "heisenbridge"; + RuntimeDirectoryMode = "0700"; + + RestrictNamespaces = true; + PrivateUsers = true; + ProtectHostname = true; + ProtectClock = true; + ProtectKernelTunables = true; + ProtectKernelModules = true; + ProtectKernelLogs = true; + ProtectControlGroups = true; + RestrictAddressFamilies = ["AF_INET AF_INET6"]; + LockPersonality = true; + RestrictRealtime = true; + ProtectProc = "invisible"; + ProcSubset = "pid"; + UMask = 0077; + + # For the identd port + # CapabilityBoundingSet = ["CAP_NET_BIND_SERVICE"]; + # AmbientCapabilities = ["CAP_NET_BIND_SERVICE"]; + }; + }; + + # Pass in the TURN secret via EnvironmentFile, not supported by + # upstream module currently. + # + # See also https://gitlab.com/famedly/conduit/-/issues/314 + systemd.services.conduit.serviceConfig.EnvironmentFile = config.sops.secrets."turn/env".path; + + services.coturn = { + enable = true; + no-cli = true; + use-auth-secret = true; + static-auth-secret-file = config.sops.secrets."turn/secret".path; + realm = turn-realm; + relay-ips = [ + "178.79.137.55" + ]; + + # SSL config + # + # TODO(tlater): Switch to letsencrypt once google fix: + # https://github.com/vector-im/element-android/issues/1533 + pkey = config.sops.secrets."turn/ssl-key".path; + cert = config.sops.secrets."turn/ssl-cert".path; + + # Based on suggestions from + # https://github.com/matrix-org/synapse/blob/develop/docs/turn-howto.md + # and + # https://www.foxypossibilities.com/2018/05/19/setting-up-a-turn-sever-for-matrix-on-nixos/ + no-tcp-relay = true; + secure-stun = true; + extraConfig = '' + # Deny various local IP ranges, see + # https://www.rtcsec.com/article/cve-2020-26262-bypass-of-coturns-access-control-protection/ + no-multicast-peers + denied-peer-ip=0.0.0.0-0.255.255.255 + denied-peer-ip=10.0.0.0-10.255.255.255 + denied-peer-ip=100.64.0.0-100.127.255.255 + denied-peer-ip=127.0.0.0-127.255.255.255 + denied-peer-ip=169.254.0.0-169.254.255.255 + denied-peer-ip=172.16.0.0-172.31.255.255 + denied-peer-ip=192.0.0.0-192.0.0.255 + denied-peer-ip=192.0.2.0-192.0.2.255 + denied-peer-ip=192.88.99.0-192.88.99.255 + denied-peer-ip=192.168.0.0-192.168.255.255 + denied-peer-ip=198.18.0.0-198.19.255.255 + denied-peer-ip=198.51.100.0-198.51.100.255 + denied-peer-ip=203.0.113.0-203.0.113.255 + denied-peer-ip=240.0.0.0-255.255.255.255 denied-peer-ip=::1 + denied-peer-ip=64:ff9b::-64:ff9b::ffff:ffff + denied-peer-ip=::ffff:0.0.0.0-::ffff:255.255.255.255 + denied-peer-ip=100::-100::ffff:ffff:ffff:ffff + denied-peer-ip=2001::-2001:1ff:ffff:ffff:ffff:ffff:ffff:ffff + denied-peer-ip=2002::-2002:ffff:ffff:ffff:ffff:ffff:ffff:ffff + denied-peer-ip=fc00::-fdff:ffff:ffff:ffff:ffff:ffff:ffff:ffff + denied-peer-ip=fe80::-febf:ffff:ffff:ffff:ffff:ffff:ffff:ffff + + # *Allow* any IP addresses that we explicitly set as relay IPs + ${concatMapStringsSep "\n" (ip: "allowed-peer-ip=${ip}") config.services.coturn.relay-ips} + + # Various other security settings + no-tlsv1 + no-tlsv1_1 + + # Monitoring + prometheus + ''; + }; + + services.nginx.virtualHosts."${domain}" = { + enableACME = true; + + listen = [ + { + addr = "0.0.0.0"; + port = 80; + } + { + addr = "[::0]"; + port = 80; + } + { + addr = "0.0.0.0"; + port = 443; + ssl = true; + } + { + addr = "[::0]"; + port = 443; + ssl = true; + } + { + addr = "0.0.0.0"; + port = 8448; + ssl = true; + } + { + addr = "[::0]"; + port = 8448; + ssl = true; + } + ]; + + forceSSL = true; + extraConfig = '' + merge_slashes off; + access_log /var/log/nginx/${domain}/access.log upstream_time; + ''; + + locations = { + "/_matrix" = { + proxyPass = "http://${cfg.settings.global.address}:${toString cfg.settings.global.port}"; + # Recommended by conduit + extraConfig = '' + proxy_buffering off; + ''; + }; + + # Add Element X support + # TODO(tlater): Remove when no longer required: https://github.com/vector-im/element-x-android/issues/1085 + "=/.well-known/matrix/client" = { + alias = pkgs.writeText "well-known-matrix-client" (builtins.toJSON { + "m.homeserver".base_url = "https://${domain}"; + "org.matrix.msc3575.proxy".url = "https://${domain}"; + }); + + extraConfig = '' + default_type application/json; + add_header Access-Control-Allow-Origin "*"; + ''; + }; + }; + }; + + # services.backups.conduit = { + # user = "root"; + # paths = [ + # "/var/lib/private/matrix-conduit/" + # ]; + # # Other services store their data in conduit, so no other services + # # need to be shut down currently. + # pauseServices = ["conduit.service"]; + # }; +}