Kabbone/nixos-config
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

services: matrix bridge fix signal

Browse Source
This commit is contained in:
Kabbone 2022-12-30 13:53:08 +01:00
parent f5b6f5fb8f
commit 91c5be61fd
Signed by: Kabbone
SSH Key Fingerprint: SHA256:A5zPB5I6u5V78V51c362BBdCwhDhfDUVbt7NfKdjWBY
1 changed files with 47 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

51
modules/services/server/matrix.nix
View File

@ -101,20 +101,61 @@ in {
User = "mautrix-whatsapp";
Group = "mautrix-whatsapp";
Environment = "HOME=/var/lib/mautrix-whatsapp";
PrivateTmp = true;
ReadWritePaths="/var/log/mautrix-whatsapp";
NoNewPrivileges=true;
MemoryDenyWriteExecute=true;
PrivateDevices=true;
PrivateTmp=true;
ProtectHome=true;
ProtectSystem="strict";
ProtectControlGroups=true;
RestrictSUIDSGID=true;
RestrictRealtime=true;
LockPersonality=true;
ProtectKernelLogs=true;
ProtectKernelTunables=true;
ProtectHostname=true;
ProtectKernelModules=true;
PrivateUsers=true;
ProtectClock=true;
SystemCallArchitectures="native";
SystemCallErrorNumber="EPERM";
SystemCallFilter="@system-service";
};
};
mautrix-signal = {
description = "Matrix <-> Signal bridge";
wantedBy = [ "multi-user.target" ];
after = [ "network.target" "postgresql.service" "matrix-synapse.service" ];
after = [ "network.target" "postgresql.service" "matrix-synapse.service" "signald.service" ];
requires = [ "postgresql.service" "matrix-synapse.service" "signald.service"];
script = "${pkgs.mautrix-signal}/bin/mautrix-signal -n --config ${config.age.secrets."services/matrix/mautrix-signal.yml".path}";
serviceConfig = {
User = "mautrix-signal";
Group = "mautrix-signal";
Environment = "HOME=/var/lib/mautrix-whatsapp";
PrivateTmp = true;
Environment = "HOME=/var/lib/mautrix-signal";
ReadWritePaths= [
"/var/run/signald/signald.sock"
"/var/log/mautrix-signal"
];
NoNewPrivileges=true;
MemoryDenyWriteExecute=true;
PrivateDevices=true;
PrivateTmp=true;
ProtectHome=true;
ProtectSystem="strict";
ProtectControlGroups=true;
RestrictSUIDSGID=true;
RestrictRealtime=true;
LockPersonality=true;
ProtectKernelLogs=true;
ProtectKernelTunables=true;
ProtectHostname=true;
ProtectKernelModules=true;
PrivateUsers=true;
ProtectClock=true;
SystemCallArchitectures="native";
SystemCallErrorNumber="EPERM";
SystemCallFilter="@system-service";
};
};
};
@ -199,6 +240,8 @@ in {
};
signald = {
enable = true;
user = "mautrix-signal";
group = "mautrix-signal";
};
};