mautrix-signal: 0.6.3 -> 0.7.0 (#337534)

  Processes also now run as a dynamically allocated user by default instead of

  root.

- The `mautrix-signal` module was adapted to incorporate the configuration rearrangement that resulted from the update to the mautrix bridgev2 architecture. Pre-0.7.0 configurations should continue to work.

  In case you want to update your configuration make sure to check the NixOS manual.

- The nvidia driver no longer defaults to the proprietary driver starting with version 560. You will need to manually set `hardware.nvidia.open` to select the proprietary or open driver.

- `singularity-tools` have the `storeDir` argument removed from its override interface and use `builtins.storeDir` instead.

# Mautrix-Signal {#module-services-mautrix-signal}

[Mautrix-Signal](https://github.com/mautrix/signal) is a Matrix-Signal puppeting bridge.

## Configuration {#module-services-mautrix-signal-configuration}

1. Set [](#opt-services.mautrix-signal.enable) to `true`. The service will use

   SQLite by default.

2. To create your configuration check the default configuration for

   [](#opt-services.mautrix-signal.settings). To obtain the complete default

   configuration, run

   `nix-shell -p mautrix-signal --run "mautrix-signal -c default.yaml -e"`.

::: {.warning}

Mautrix-Signal allows for some options like `encryption.pickle_key`,

`provisioning.shared_secret`, allow the value `generate` to be set.

Since the configuration file is regenerated on every start of the

service, the generated values would be discarded and might break your

installation. Instead, set those values via

[](#opt-services.mautrix-signal.environmentFile).

:::

## Migrating from an older configuration {#module-services-mautrix-signal-migrate-configuration}

With Mautrix-Signal v0.7.0 the configuration has been rearranged. Mautrix-Signal

performs an automatic configuration migration so your pre-0.7.0 configuration

should just continue to work.

In case you want to update your NixOS configuration, compare the migrated configuration

at `/var/lib/mautrix-signal/config.yaml` with the default configuration

(`nix-shell -p mautrix-signal --run "mautrix-signal -c example.yaml -e"`) and

update your module configuration accordingly.

{ lib

, config

, pkgs

, ...

{

  lib,

  config,

  pkgs,

  ...

}:

let

  cfg = config.services.mautrix-signal;

  optOneOf = lib.lists.findFirst (value: value.condition) (lib.mkIf false null);

  mkDefaults = lib.mapAttrsRecursive (n: v: lib.mkDefault v);

  defaultConfig = {

    network = {

      displayname_template = "{{or .ProfileName .PhoneNumber \"Unknown user\"}}";

    };

    bridge = {

      command_prefix = "!signal";

      relay.enabled = true;

      permissions."*" = "relay";

    };

    database = {

      type = "sqlite3";

      uri = "file:${dataDir}/mautrix-signal.db?_txlock=immediate";

    };

    homeserver.address = "http://localhost:8448";

    appservice = {

      hostname = "[::]";

      port = appservicePort;

      database.type = "sqlite3";

      database.uri = "file:${dataDir}/mautrix-signal.db?_txlock=immediate";

      id = "signal";

      bot = {

        username = "signalbot";

      };

      as_token = "";

      hs_token = "";

    };

    bridge = {

      username_template = "signal_{{.}}";

      displayname_template = "{{or .ProfileName .PhoneNumber \"Unknown user\"}}";

      double_puppet_server_map = { };

      login_shared_secret_map = { };

      command_prefix = "!signal";

      permissions."*" = "relay";

      relay.enabled = true;

    };

    double_puppet = {

      servers = { };

      secrets = { };

    };

    # By default, the following keys/secrets are set to `generate`. This would break when the service

    # is restarted, since the previously generated configuration will be overwritten everytime.

    # If encryption is enabled, it's recommended to set those keys via `environmentFile`.

    encryption.pickle_key = "";

    provisioning.shared_secret = "";

    public_media.signing_key = "";

    direct_media.server_key = "";

    logging = {

      min_level = "info";

      writers = lib.singleton {

      default = defaultConfig;

      description = ''

        {file}`config.yaml` configuration as a Nix attribute set.

        Configuration options should match those described in

        [example-config.yaml](https://github.com/mautrix/signal/blob/master/example-config.yaml).

        Configuration options should match those described in the example configuration.

        Get an example configuration by executing `mautrix-signal -c example.yaml --generate-example-config`

        Secret tokens should be specified using {option}`environmentFile`

        instead of this world-readable attribute set.

      '';

      example = {

        appservice = {

        bridge = {

          private_chat_portal_meta = true;

          mute_only_on_create = false;

          permissions = {

            "example.com" = "user";

          };

        };

        database = {

          type = "postgres";

          uri = "postgresql:///mautrix_signal?host=/run/postgresql";

        };

        homeserver = {

          address = "http://[::1]:8008";

          domain = "my-domain.tld";

        };

        appservice = {

          id = "signal";

          ephemeral_events = false;

        };

        bridge = {

          history_sync = {

            request_full_sync = true;

        matrix.message_status_events = true;

        provisioning = {

          shared_secret = "disable";

        };

          private_chat_portal_meta = true;

          mute_bridging = true;

        backfill.enabled = true;

        encryption = {

          allow = true;

          default = true;

          require = true;

          };

          provisioning = {

            shared_secret = "disable";

          };

          permissions = {

            "example.com" = "user";

          };

          pickle_key = "$ENCRYPTION_PICKLE_KEY";

        };

      };

    };

        File containing environment variables to be passed to the mautrix-signal service.

        If an environment variable `MAUTRIX_SIGNAL_BRIDGE_LOGIN_SHARED_SECRET` is set,

        then its value will be used in the configuration file for the option

        `login_shared_secret_map` without leaking it to the store, using the configured

        `double_puppet.secrets` without leaking it to the store, using the configured

        `homeserver.domain` as key.

        See [here](https://github.com/mautrix/signal/blob/main/example-config.yaml)

        for the documentation of `login_shared_secret_map`.

      '';

    };

    serviceDependencies = lib.mkOption {

      type = with lib.types; listOf str;

      default = (lib.optional config.services.matrix-synapse.enable config.services.matrix-synapse.serviceUnit)

      default =

        (lib.optional config.services.matrix-synapse.enable config.services.matrix-synapse.serviceUnit)

        ++ (lib.optional config.services.matrix-conduit.enable "conduit.service");

      defaultText = lib.literalExpression ''

        (optional config.services.matrix-synapse.enable config.services.matrix-synapse.serviceUnit)

    };

    # Note: this is defined here to avoid the docs depending on `config`

    services.mautrix-signal.settings.homeserver = optOneOf (with config.services; [

    services.mautrix-signal.settings.homeserver = optOneOf (

      with config.services;

      [

        (lib.mkIf matrix-synapse.enable (mkDefaults {

          domain = matrix-synapse.settings.server_name;

        }))

          domain = matrix-conduit.settings.global.server_name;

          address = "http://localhost:${toString matrix-conduit.settings.global.port}";

        }))

    ]);

      ]

    );

    systemd.services.mautrix-signal = {

      description = "mautrix-signal, a Matrix-Signal puppeting bridge.";

        ${pkgs.yq}/bin/yq -s '.[0].appservice.as_token = .[1].as_token

          | .[0].appservice.hs_token = .[1].hs_token

          | .[0]

          | if env.MAUTRIX_SIGNAL_BRIDGE_LOGIN_SHARED_SECRET then .bridge.login_shared_secret_map.[.homeserver.domain] = env.MAUTRIX_SIGNAL_BRIDGE_LOGIN_SHARED_SECRET else . end' \

          | if env.MAUTRIX_SIGNAL_BRIDGE_LOGIN_SHARED_SECRET then .double_puppet.secrets.[.homeserver.domain] = env.MAUTRIX_SIGNAL_BRIDGE_LOGIN_SHARED_SECRET else . end' \

          '${settingsFile}' '${registrationFile}' > '${settingsFile}.tmp'

        mv '${settingsFile}.tmp' '${settingsFile}'

        umask $old_umask

        SystemCallErrorNumber = "EPERM";

        SystemCallFilter = [ "@system-service" ];

        Type = "simple";

        UMask = 0027;

        UMask = 27;

      };

      restartTriggers = [ settingsFileUnsubstituted ];

    };

  };

  meta.maintainers = with lib.maintainers; [ niklaskorz ];

  meta = {

    buildDocsInSandbox = false;

    doc = ./mautrix-signal.md;

    maintainers = with lib.maintainers; [

      niklaskorz

      frederictobiasc

    ];

  };

}

{ lib, stdenv, fetchFromGitHub, rustPlatform, runCommand, xcodebuild, protobuf, boringssl, darwin }:

{

  lib,

  stdenv,

  fetchFromGitHub,

  rustPlatform,

  runCommand,

  xcodebuild,

  protobuf,

  boringssl,

  darwin,

}:

let

  # boring-sys expects the static libraries in build/ instead of lib/

  boringssl-wrapper = runCommand "boringssl-wrapper" { } ''

  pname = "libsignal-ffi";

  # must match the version used in mautrix-signal

  # see https://github.com/mautrix/signal/issues/401

  version = "0.52.0";

  version = "0.55.1";

  src = fetchFromGitHub {

    fetchSubmodules = true;

    owner = "signalapp";

    repo = "libsignal";

    rev = "v${version}";

    hash = "sha256-MFTTrIJ9+1NgaL9KD4t0KYR2feHow+HtyYXQWJgKilM=";

    hash = "sha256-hQ3iWGLef1y3yyzjWH2MWcs32A7HxUSxGG8fCyMn/KE=";

  };

  buildInputs = lib.optional stdenv.isDarwin [ darwin.apple_sdk.frameworks.Security ];

  cargoLock = {

    lockFile = ./Cargo.lock;

    outputHashes = {

      "boring-4.6.0" = "sha256-IjkpCKZ4Y1UTrFPg4g/bak+/mJFiyfUyxtTtT5uzcUY=";

      "boring-4.9.0" = "sha256-RSpaMzMUXp+WuqqDwLErP5yLT0YhYGoOUWCuSt4jR3I=";

      "curve25519-dalek-4.1.3" = "sha256-bPh7eEgcZnq9C3wmSnnYv0C4aAP+7pnwk9Io29GrI4A=";

    };

  };

  cargoBuildFlags = [ "-p" "libsignal-ffi" ];

  cargoBuildFlags = [

    "-p"

    "libsignal-ffi"

  ];

  meta = with lib; {

    description = "C ABI library which exposes Signal protocol logic";