Merge remote-tracking branch 'origin/main' into mailman

flake.nix

@@ -51,6 +51,7 @@
             ./modules/stream.nix
             ./modules/nextcloud.nix
             ./modules/matrix.nix
+            ./modules/mautrix-telegram.nix
             ./modules/sogo.nix
             {
               fsr.enable_office_bloat = false;

keys/pgp/fugi.asc

@@ -23,42 +23,29 @@ AtzqMgx0uhQvnoB4WP6LKscU+dQybRcmWvXGpJ1H67Q9sshbAJ8/M6PIkv+ixTge
 9qDppPNgRQWfk4IkU070Ed2n6utwlH9T1UFtj2HfXbbs/EENlMMMGHKV5bfjLYO1
 wBMOmxneME65387gCC0VyC1mODHybrncbC/0wHeW4zKsEMP7xLC2YHnQMeo+nwW/
 ZbIyOAT1vSGcVGONy6Dm+o8dgmCkzxDtG+2h3VJ+oxSZXO4rhZD718HLEFLFJy31
-dra9QAZS6Id4TWBX/ssGHqfLROW9w915O5vUlMPMgWdadl+Gu/b6BLQeTHVjYXMg
+dra9QAZS6Id4TWBX/ssGHqfLROW9w915O5vUlMPMgWdadl+Gu/b6BLkCDQRg7b+b
-RnVnbWFubiA8bHVjYXNAZnVnaS5kZXY+iQJOBBMBCAA4AhsDBQsJCAcCBhUKCQgL
+ARAA06QiieAnnNHPw0kub3iugxafKLpBUBLBHox4EJey52foJmdCJJlfld850RAj
-AgQWAgMBAh4BAheAFiEEvzeQOub9KUxMZ07iRHKiAJG/p5IFAmO7DR8ACgkQRHKi
+KdhIxEa5FBtLDb2pd/PLZTY9W/ons64pylgrrpUfIsF+4oi3bRb6UYkf1W5uPm7Z
-AJG/p5KGYRAAoAGdF9xjBXt3XNRTQapCelA/GeNtUTTqd7AsEeTe2vpl2Wro+mqw
+2AQL1OT+OM+0eA7C6xY3eqZe3ULSIEHaIteOVN9afyj6JSF9yylza3z/PoMzybBD
-d77997LzugxrqEOxmMTp8aqeu5eg7QZbYxIWRDESzIfLu3/mFK7RWtwUMnq9E+Nw
+tHKodyD58RkYKhGl9MTPQHqZb7fO+eEz4rbU8dqbhC0Q7NT5MxCKKpQsdNPBe3DS
-1+6TM3r/wIg6vY6fLFZpUmnL3M7BXEBynCWXy0N39BtzcTD8SxYCco8Ud0ZD2Ike
+DY8GjlvYG93IK+FIproc4Z+kv2cA08/m3uUhURkjLvFeoXsqFnOleOWC5ZaCQW90
-Pt/5xN5WHs+FyII4mUo8TDwW8hQbyMOQGu06prkG8NHn5PVQk3Fc4aqAwfYl9PaS
+5iwIuhMREiF2vyxmKCoaP5WG+cNS3bwHncyJdL0yU3lgbin1givE2VE0FG4AYGlI
-GTfvz3POEL2+7e9cbc7wUaG6W0wVtS97j4BRLmDn2HmfcD611TX0Axfoji3wevYi
+tx+i3b6LM1fm4+N8H5NCl+54lPdPcGgCvcsI7G2cU/M9dFIO39r1JafwAs3SBqBI
-2wvxidnVbvVUYpEq7cJ2XYBcE4gGTSADr6SnQtw5E6JyNkSZHCoNFv96VrROisIg
+G7pKzr5jsn3xOl/GjUMo48RftptYaHeoYHcjWeQdhTWq5dZhTurD4lDz/ktR/7QH
-Phhjtu21i8Ad6uBnNJa1bM0rrSL4YVSPT1UrhDsLdWVfB3TH5uAa+Ioss55dt22P
+iae/axfpSz57LhU8v4GZeTbIpfdnJEIYT9nAauueCG9W8N4BEwCTHka+HsIvWTrj
-2rG9MGKYMiOc0UpZEf8E7MndDP3hutQEVPHt94ccPPn6I33ZnvnNaORZAfPufrhl
+v+CkYFy1c/pIw7futLf3nHU/AMN1issRDE2ARZZ7fHatKnOy8KPEbYuFITEpuiNk
-Y/Hf7gTgvlDoctev7sZ62VWeWvgn5BMIKVrmV4MJW/UWUguQim8F/hrst8KE62JP
+jNnWy4027LhNXvKB52QANsdtZPBs56bwA3IzavgLoxIhNj8AEQEAAYkCNgQYAQgA
-XEyvFoklx/f7osf0rbPcqQhKXUe8O+6n90Pt63Z3LptSx/PCxXsDwweuwoz1cTea
+IBYhBL83kDrm/SlMTGdO4kRyogCRv6eSBQJg7b+bAhsMAAoJEERyogCRv6eSBJcP
-ZuKmXywY1khbNMbKKTXn2vQ3jl/ZDZXGWBK0LF2O8Hn91J1VxybLczy5Ag0EYO2/
+/3VgyKe8J5H+CRFtQT77xI6xk1wW0R2/3yFMaBNdXyuS58JtizUX90DAPCXH8EvU
-mwEQANOkIongJ5zRz8NJLm94roMWnyi6QVASwR6MeBCXsudn6CZnQiSZX5XfOdEQ
+Y1ZAZ6Tk+/Pdqhmv4XORWDW4O/ZnRITDqRR3SHEsQPuLYz3rlpu6ic+bEpC4HjaK
-IynYSMRGuRQbSw29qXfzy2U2PVv6J7OuKcpYK66VHyLBfuKIt20W+lGJH9Vubj5u
+KqdeS2M66g0+l/0byWhtoV0JZvhPDlqRMaI64wizJnHIgDyEiaaRr0WSkxAfGoNK
-2dgEC9Tk/jjPtHgOwusWN3qmXt1C0iBB2iLXjlTfWn8o+iUhfcspc2t8/z6DM8mw
+8EYaXYM7XCr3QqLtKswQ7ySRk2wm5Kn2KT1884F4dNXtXWKTbvcxMXEBLiIa5EeZ
-Q7RyqHcg+fEZGCoRpfTEz0B6mW+3zvnhM+K21PHam4QtEOzU+TMQiiqULHTTwXtw
+isuFazQ3vIoK7W8opfIKVV/iYW0Ibr4c8UBwHFBVjzOekp1EsyjCIQ5fdL2HVL5o
-0g2PBo5b2BvdyCvhSKa6HOGfpL9nANPP5t7lIVEZIy7xXqF7KhZzpXjlguWWgkFv
+/JvJeZNeUHDv/UrShz6Vr6UiQI2Vk+witGkR/hM5KbZvMVw6+YGImm5nViyE3ikZ
-dOYsCLoTERIhdr8sZigqGj+VhvnDUt28B53MiXS9MlN5YG4p9YIrxNlRNBRuAGBp
+W3hZr6M7RO3zjtrbn177QCrqv123iRng7d/nomxQajpSKtw20eQcz1pZKpphF0NM
-SLcfot2+izNX5uPjfB+TQpfueJT3T3BoAr3LCOxtnFPzPXRSDt/a9SWn8ALN0gag
+QenckYbWP5snESlrSIqxoJbPYM02/jSUiuUW3MZqtUFIXh+AAmh6+Ev5nJjRF9Eb
-SBu6Ss6+Y7J98Tpfxo1DKOPEX7abWGh3qGB3I1nkHYU1quXWYU7qw+JQ8/5LUf+0
+jYJNrYQMyk9me9KTI5QhAg9V26q/kPQ1CDZf3tPfIEuW7STcU5GJeK60kXbLYWsu
-B4mnv2sX6Us+ey4VPL+BmXk2yKX3ZyRCGE/ZwGrrnghvVvDeARMAkx5Gvh7CL1k6
+ktWMG81950zHmkidnVRx+6Afem0IyoE/oXyqQxmbpZc+I/j/7w5s3UnMfBSLT4CU
-47/gpGBctXP6SMO37rS395x1PwDDdYrLEQxNgEWWe3x2rSpzsvCjxG2LhSExKboj
+RKDxUzrpsELRTjEJfEhSFM1G0AIm3d7uOSM0sAo8bstC
-ZIzZ1suNNuy4TV7ygedkADbHbWTwbOem8ANyM2r4C6MSITY/ABEBAAGJAjYEGAEI
+=dj40
-ACAWIQS/N5A65v0pTExnTuJEcqIAkb+nkgUCYO2/mwIbDAAKCRBEcqIAkb+nkgSX
-D/91YMinvCeR/gkRbUE++8SOsZNcFtEdv98hTGgTXV8rkufCbYs1F/dAwDwlx/BL
-1GNWQGek5Pvz3aoZr+FzkVg1uDv2Z0SEw6kUd0hxLED7i2M965abuonPmxKQuB42
-iiqnXktjOuoNPpf9G8lobaFdCWb4Tw5akTGiOuMIsyZxyIA8hImmka9FkpMQHxqD
-SvBGGl2DO1wq90Ki7SrMEO8kkZNsJuSp9ik9fPOBeHTV7V1ik273MTFxAS4iGuRH
-mYrLhWs0N7yKCu1vKKXyClVf4mFtCG6+HPFAcBxQVY8znpKdRLMowiEOX3S9h1S+
-aPybyXmTXlBw7/1K0oc+la+lIkCNlZPsIrRpEf4TOSm2bzFcOvmBiJpuZ1YshN4p
-GVt4Wa+jO0Tt847a259e+0Aq6r9dt4kZ4O3f56JsUGo6UircNtHkHM9aWSqaYRdD
-TEHp3JGG1j+bJxEpa0iKsaCWz2DNNv40lIrlFtzGarVBSF4fgAJoevhL+ZyY0RfR
-G42CTa2EDMpPZnvSkyOUIQIPVduqv5D0NQg2X97T3yBLlu0k3FORiXiutJF2y2Fr
-LpLVjBvNfedMx5pInZ1UcfugH3ptCMqBP6F8qkMZm6WXPiP4/+8ObN1JzHwUi0+A
-lESg8VM66bBC0U4xCXxIUhTNRtACJt3e7jkjNLAKPG7LQg==
-=XbNH
 -----END PGP PUBLIC KEY BLOCK-----

modules/mautrix-telegram.nix

@@ -0,0 +1,71 @@
+{ config, options, lib, pkgs, ... }:
+let
+  homeserverDomain = config.services.matrix-synapse.settings.server_name;
+  registrationFileSynapse = "/var/lib/matrix-synapse/telegram-registration.yaml";
+  registrationFileMautrix = "/var/lib/mautrix-telegram/telegram-registration.yaml";
+  settingsFile = builtins.head (builtins.match ".*--config='(.*)' \\\\.*" config.systemd.services.mautrix-telegram.preStart);
+in
+{
+  services.postgresql = {
+    enable = true;
+    ensureUsers = [{
+      name = "mautrix-telegram";
+      ensurePermissions = {
+        "DATABASE \"mautrix-telegram\"" = "ALL PRIVILEGES";
+      };
+    }];
+    ensureDatabases = [ "mautrix-telegram" ];
+  };
+
+  sops.secrets.mautrix-telegram_env = { };
+
+  services.matrix-synapse.settings.app_service_config_files = [
+    # The registration file is automatically generated after starting the
+    # appservice for the first time.
+    registrationFileSynapse
+  ];
+
+  systemd.tmpfiles.rules = [
+    # copy registration file over to synapse
+    "C ${registrationFileSynapse} - - - - ${registrationFileMautrix}"
+    "Z /var/lib/matrix-synapse/ - matrix-synapse matrix-synapse - -"
+  ];
+
+  services.mautrix-telegram = {
+    enable = true;
+
+    environmentFile = config.sops.secrets.mautrix-telegram_env.path;
+
+    settings = {
+      homeserver = {
+        address = "http://[::1]:8008";
+        domain = homeserverDomain;
+      };
+
+      appservice = rec {
+        # Use postgresql instead of sqlite
+        database = "postgresql:///mautrix-telegram?host=/run/postgresql";
+        port = 8082;
+        address = "localhost:${toString port}";
+      };
+
+      bridge = {
+        relaybot.authless_portals = false;
+        permissions = {
+          "@admin:${homeserverDomain}" = "admin";
+        };
+        relay_user_distinguishers = [ ];
+      };
+    };
+  };
+
+  # If we don't explicitly set {a,h}s_token, mautrix-telegram will try to read them from the registrationFile
+  # and write them to the settingsFile in /nix/store, which obviously fails.
+  systemd.services.mautrix-telegram.serviceConfig.ExecStart =
+    lib.mkForce (pkgs.writeShellScript "start" ''
+      export MAUTRIX_TELEGRAM_APPSERVICE_AS_TOKEN=$(grep as_token ${registrationFileMautrix} | cut -d' ' -f2-)
+      export MAUTRIX_TELEGRAM_APPSERVICE_HS_TOKEN=$(grep hs_token ${registrationFileMautrix} | cut -d' ' -f2-)
+
+      ${pkgs.mautrix-telegram}/bin/mautrix-telegram --config='${settingsFile}'
+    '');
+}

secrets/quitte.yaml

@@ -16,6 +16,7 @@ mediawiki:
     initial_admin: ENC[AES256_GCM,data:iET5rz9rygx49NDBjKwqAlRgpeS+jq5iM5zmjnoKcyk=,iv:11iDbCrpzjCdyAB22R8NknJ6vzcpVZXCXB3iWsGWXw0=,tag:1RCyg1ysOWaXKdqqdHqRrw==,type:str]
     ldapprovider: ENC[AES256_GCM,data:CPsrWmUviUpFIVVN/2a1lRjJCoZCWR9zrHm3T5Tv/YuXSYXStZGfBgXN96zhJUUpZcwiJq95o1sajyit+6itZCcGAPu0BTHSnNXRu1fgifonXE0ghw6rvzwkYpfBS+rfmBcG2wxX+7uZG3ulANYpvvGMxpKgM5IzQjE1sAytRDir6QeMGcFHP2gV4xQAdTNUZK2V+EKOlrcV5vTSzDSy3eXg18TVUgZqdxaQFfwnr2UN0eEEZ4Dn83G3QWsROZ0A7R3tuEmdAzmR8AdWBxfqCcOA8vZaOIOWb1AyobLCUaqQOj/SbGdgehMOQn1UcbRHpYQ2E9mvxD572uc/U5kzy/TbOLM34pkvckNrGfxwvqwbvXZrVP3gONY5CnJpk5XfVdT5Au/uwE5ZRs83ZEx31+85mpK3HecyBWRfWID0z2XS8PAU6G7ASQsXCh6sd5LFhL7zhxBQ4ENjT8pDi0OLYvw9VzPhPrdzooULeMytGitVWRtLsSzCn/D+U4x6EJLivLW6jv9SAIKg54fAjNEBYHh7GuHbr/VGtmiWKj6av2e3/BLgPOIyINzNv+X5QSsopZ2/yamPs+ARTOqAZvSyRgqereYoLZ5ZV15jIWiGc7HVfj/+Bk7cN4+VwFhzSuttp1DmvNNIWueeX69rdSqe41Y2lqKZ4ajOSIJ+YLP/dR0wvrVbd7QSP2OVRAnMugmeekbIuyIKPNsNJ183Z4y1m/ihIdRAzLnjSYuYCdWw3LXl5gM0ZTtGb7K+cIYcyJrS3fcaErDmqyI/LJoXNTo5CJI=,iv:ycKt8/awCo3HoO6Oa8H77GH9+m+xgR4kiXb7Cbf0wSY=,tag:b6pBoZs+E4CP+V9oZXrcoQ==,type:str]
 postfix_ldap_aliases: ENC[AES256_GCM,data:SFCncYQAY2ZOA4d8YO58HQvUIRpevU6dX3BDv/pnB1JlvNmQH7oy4NZ4zf24/1i11EV7Z0NvPsa4sAqj8xRR++yyzeG9RQk3Pcst3AkFtA+MkNP0ueZJYsvLKyUE6G7UpzVVuLI+L5R121JrRp6+r5xqckOBNCBo73ulb7tC67hSfLA+ZNmDw+bKbshHej4l3hvM/c2sHLbcPp/+vxLXqthPR+y8lf6J/QgZ8Yzw1JxFVDO8ypaWpWZZvA3HbAzRJXxk2zxg+lpmgFsyzTXLZGhvf7NdRHUmTP9OgDFt/efhxpUvDYpDinzVOuFrYJGL/4U0LLvxtGQQaQ==,iv:dUx+BsJWaiZ6MeNB+OhrSxQf+co2USjJM5rKt7OP5GI=,tag:nOVLxEyIRSNnxGa8eHMmFQ==,type:str]
+mautrix-telegram_env: ENC[AES256_GCM,data:2p5vYV+/vEDrrZItTcT1vxddv2tM7dLGBUmG+OXHccTzJ2UhyYpDGgUMr5KgObxvyssYBZTsvbV7QFN3sjcU/jVPx1qEUn6zyKO0HBQjrviVU3urx5zNOnCEHwDKyDrZ1Hu/CE6lpGNrtGlpewgOs/+84JZIZhC9qSuzDhN38sr4OGfMr29fMzafYC+TGHoZyA64GI9xz0KvXhwg6ci1hLtVWYEOFW2Nf8uLY8qkNLuDzA6bYx8rn3CEXoxiv0n4,iv:jmcWTyVkqu9nDc1ws2NxkMKrHPZ13i3jqDkk4Y0kejw=,tag:BjhmPc4lSbsZBmZ/q2CqGg==,type:str]
 sops:
     kms: []
     gcp_kms: []
@@ -31,8 +32,8 @@ sops:
             NEJBTHE2end1RDlHRTNFYlZjTjhib2cKmQRHpBKZ2DbQ5CfOwcSPfZAm9fnnpxUk
             +LcR8haK//O3N2uNf9etDW3VsT5ipPucCdFU1m/v9L5tcN6ZP8WP+w==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2023-07-03T16:18:44Z"
+    lastmodified: "2023-07-04T07:41:45Z"
-    mac: ENC[AES256_GCM,data:USYbcrCkagxH2fMkkYab6kviwvaM9dC6BHd+uomsjQQwp2aSElxrz7yJZgHiiWuODwLqC6Cg+i/1NLY1JDyGy1IBehmaW/PFEjpq5RjcY4oIiHWDLBKlVBryZGMlDCc1o5Q5ispK8TksCDP567ogEV1AeFb/f/l4Lp/0lsstQlk=,iv:oyIndbLisTKyJezd0ndpuHesAur57g5d0vZb/nliGfs=,tag:K/hWbcikN1ATgJrzABWD9Q==,type:str]
+    mac: ENC[AES256_GCM,data:YLC02dhSSLl9C1B7wo/AJcY4a4zc1LIaA0PKH0H8uZ8I9Kh105yk4sc2cz15FVMLtkMeIdfnhmWxbnPyLbM0mA9bAYT9MQn65quEgDumr+XH0UW6m1e2S23/2fxTFH1xRWsu7/Kon/gdzLb5hf2m30eJAP7MrdpxDz28Q7ut1P4=,iv:9UC71WxpDt1bxWSu16Sc+OKpy6KmX0Ru+Q54LYuQCBU=,tag:CpNKSJem+XHimm+yzRpwaw==,type:str]
     pgp:
         - created_at: "2023-04-23T17:48:54Z"
           enc: |

secrets/test.yaml

@@ -15,6 +15,7 @@ mediawiki:
     postgres: ENC[AES256_GCM,data:bna6ksGVOHWor7OqVL/jgeDIxA==,iv:bgkQh+NgPE/hr4N4YOCzSCfs7vaOx4pSWlc8WxI8qMc=,tag:WIjyu1i0M7flGFFovH5jWQ==,type:str]
     initial_admin: ENC[AES256_GCM,data:YRd3O5774NTmshxbQPbFjg==,iv:/Ra3WbZKcnUMf99ujN9qd/+DkOkFKv4cIEfUdmxpqMw=,tag:gj7ZbwIB1HLuPpGTgiz7Vg==,type:str]
     ldapprovider: ENC[AES256_GCM,data:dVrCFVgm4BDtUhcj9rSKXwnaIKsC5GGsDUoPJH1q5F4inskuSbFigcLM/UJFNOcr5R1dL+mYUOvnmIcoWA5AsuFKs3NzSYJVtVAm0x7vYSkHnfXu93V2F8Lc1xX/kZrFfnmNUXwhv2I+hknPUApY7wpmZOdk9NLKv4tbsgVTbfmR/WM6soOurh3b6b4cknfxqSeLZLeOIKL5WL8842t5SethyCfPsCm74JCpwHmflkCyT/lzIP1Kghab+xGWWyN9OAENlDZrJE6VAdctR+MKYZnhA7dXKeQPjKii9MZsDYFYTL5YDRysam4r7Jog/fozgWkXNrCUan29efnnBwpLz5hgV1MguIpvU8ccDQLNvgJCOdp6FgH45ZRlCxx29EWzh9iTDGPqmNsctUknFdfUVfIg9ziz/97i/kGcwy5N1oOsoUf7iRj5zLyLP6OlXGNThowF4jlNdI2b+caQGz7H6ZkJfUPWULotBUrjxrZo3pSYRkpJ77xbGUZf35ysxTHpfsmhyyO9HRhhgNkilEHlcsi8u+AC0su+Htg/Io332tSX+W6Gj6R6Q23hQ0gf8on5Y2xx34ysobEh8cMS4+Kj0nwasMHjW70g3qWpKkG1LSOIgXiA7hcusGCo8xPZ1y3gIyRiTxVTPJHh63Ecd0O37P4NWVSKEpsIM5pkngMN5L5K/ymtZ0kjREX2q4qpXf2xJiTTdAkeTMcmDs9HHjOzIIynYouY7P6qdXUpXjyGwqfovmnIv5icQ6sqFA==,iv:sPRnnIEif6W1SPy5SKiUuY681HeLPcR19U4p1mdUGdc=,tag:zeMdtTRk8ULP4GYDQLIU7A==,type:str]
+mautrix-telegram_env: ENC[AES256_GCM,data:vqHmM3mRrIYMT4760sglAlBZoOb7siqx3alvQE5rpq8z6FgOqJxHqGaN1quhpAVVe9ugtlvezVh8eSFX+45Y5rtqJ7iylxmC+y8JGsyLIflf674Si7h07bedCcT0wBg1ioI/JILDwICiAf0=,iv:BAPKiVt2l3E7z1Wk9ky6WFYr6hn62d+X5r0NMdUYwJQ=,tag:CRddpVMHQLwhwUF1hn0JKA==,type:str]
 sops:
     kms: []
     gcp_kms: []
@@ -30,8 +31,8 @@ sops:
             MERVUkh2ck9YWnJ5TXJDVmxpem1kTXMKCeOyjV/se1nRXsi15m/3i48hP7As6SEk
             ygtLt+UueHStX/b/OzrXk8IC5dj/mARGIJI5S61IKln6SZFbJGT6cQ==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2023-04-03T21:29:36Z"
+    lastmodified: "2023-05-04T14:41:09Z"
-    mac: ENC[AES256_GCM,data:tsnXkf9D/EzNozBWEK8fca0S+vSc4fH0y9KXpjlYtcFkgjSjvuwnlo2tH3stdEAo5odHO/rsW29uCvCDomTHwMUeKWmD7NdUAVbBuUNfl6pl6gll9p+9yfTB5lZH9QpFGnC/6ANbwhLN7vBO5ZCRbfpl5hlIN4iQ25GyiPZ/GCM=,iv:2YWxDXfsonj+Td/ZeEBKZYuDpGktEVYw1LBPxqIyofA=,tag:aaX98g7PtGh5Ob81EWmHcA==,type:str]
+    mac: ENC[AES256_GCM,data:qY1fcRl53tcvgYAqhvWLfAxe6MRvcXcbkeLMtQShQtyKRv4BW0AMOh0OOKFcxxcMbucG4j9yufvK18Q8COIslsOtm5wZhEjK8+sK0RT3l6uX0EPn/aNwGWwScXjMOeKJEBEozA4xPHt7+flTsRDAzjRz+ixC/cevm1Iu/ok17lE=,iv:OTtpuinzQXZ6nykpH8/XwIUYDNf+DNWrbDxCmJpdqAc=,tag:ng3dWwOdj60iy4yT4Ux8Cw==,type:str]
     pgp:
         - created_at: "2022-11-18T16:37:58Z"
           enc: |