nixos/modules/services/matrix/mautrix-whatsapp.nix

   1 {
   2   lib,
   3   config,
   4   pkgs,
   5   ...
   6 }: let
   7   cfg = config.services.mautrix-whatsapp;
   8   dataDir = "/var/lib/mautrix-whatsapp";
   9   registrationFile = "${dataDir}/whatsapp-registration.yaml";
  10   settingsFile = "${dataDir}/config.json";
  11   settingsFileUnsubstituted = settingsFormat.generate "mautrix-whatsapp-config-unsubstituted.json" cfg.settings;
  12   settingsFormat = pkgs.formats.json {};
  13   appservicePort = 29318;
  14
  15   mkDefaults = lib.mapAttrsRecursive (n: v: lib.mkDefault v);
  16   defaultConfig = {
  17     homeserver.address = "http://localhost:8448";
  18     appservice = {
  19       hostname = "[::]";
  20       port = appservicePort;
  21       database.type = "sqlite3";
  22       database.uri = "${dataDir}/mautrix-whatsapp.db";
  23       id = "whatsapp";
  24       bot.username = "whatsappbot";
  25       bot.displayname = "WhatsApp Bridge Bot";
  26       as_token = "";
  27       hs_token = "";
  28     };
  29     bridge = {
  30       username_template = "whatsapp_{{.}}";
  31       displayname_template = "{{if .BusinessName}}{{.BusinessName}}{{else if .PushName}}{{.PushName}}{{else}}{{.JID}}{{end}} (WA)";
  32       double_puppet_server_map = {};
  33       login_shared_secret_map = {};
  34       command_prefix = "!wa";
  35       permissions."*" = "relay";
  36       relay.enabled = true;
  37     };
  38     logging = {
  39       min_level = "info";
  40       writers = lib.singleton {
  41         type = "stdout";
  42         format = "pretty-colored";
  43         time_format = " ";
  44       };
  45     };
  46   };
  47
  48 in {
  49   options.services.mautrix-whatsapp = {
  50     enable = lib.mkEnableOption "mautrix-whatsapp, a puppeting/relaybot bridge between Matrix and WhatsApp";
  51
  52     settings = lib.mkOption {
  53       type = settingsFormat.type;
  54       default = defaultConfig;
  55       description = ''
  56         {file}`config.yaml` configuration as a Nix attribute set.
  57         Configuration options should match those described in
  58         [example-config.yaml](https://github.com/mautrix/whatsapp/blob/master/example-config.yaml).
  59         Secret tokens should be specified using {option}`environmentFile`
  60         instead of this world-readable attribute set.
  61       '';
  62       example = {
  63         appservice = {
  64           database = {
  65             type = "postgres";
  66             uri = "postgresql:///mautrix_whatsapp?host=/run/postgresql";
  67           };
  68           id = "whatsapp";
  69           ephemeral_events = false;
  70         };
  71         bridge = {
  72           history_sync = {
  73             request_full_sync = true;
  74           };
  75           private_chat_portal_meta = true;
  76           mute_bridging = true;
  77           encryption = {
  78             allow = true;
  79             default = true;
  80             require = true;
  81           };
  82           provisioning = {
  83             shared_secret = "disable";
  84           };
  85           permissions = {
  86             "example.com" = "user";
  87           };
  88         };
  89       };
  90     };
  91     environmentFile = lib.mkOption {
  92       type = lib.types.nullOr lib.types.path;
  93       default = null;
  94       description = ''
  95         File containing environment variables to be passed to the mautrix-whatsapp service,
  96         in which secret tokens can be specified securely by optionally defining a value for
  97         `MAUTRIX_WHATSAPP_BRIDGE_LOGIN_SHARED_SECRET`.
  98       '';
  99     };
 100
 101     serviceDependencies = lib.mkOption {
 102       type = with lib.types; listOf str;
 103       default = lib.optional config.services.matrix-synapse.enable config.services.matrix-synapse.serviceUnit;
 104       defaultText = lib.literalExpression ''
 105         optional config.services.matrix-synapse.enable config.services.matrix-synapse.serviceUnits
 106       '';
 107       description = ''
 108         List of Systemd services to require and wait for when starting the application service.
 109       '';
 110     };
 111
 112     registerToSynapse = lib.mkOption {
 113       type = lib.types.bool;
 114       default = config.services.matrix-synapse.enable;
 115       defaultText = lib.literalExpression "config.services.matrix-synapse.enable";
 116       description = ''
 117         Whether to add the bridge's app service registration file to
 118         `services.matrix-synapse.settings.app_service_config_files`.
 119       '';
 120     };
 121   };
 122
 123   config = lib.mkIf cfg.enable {
 124
 125     users.users.mautrix-whatsapp = {
 126       isSystemUser = true;
 127       group = "mautrix-whatsapp";
 128       home = dataDir;
 129       description = "Mautrix-WhatsApp bridge user";
 130     };
 131
 132     users.groups.mautrix-whatsapp = {};
 133
 134     services.matrix-synapse = lib.mkIf cfg.registerToSynapse {
 135       settings.app_service_config_files = [ registrationFile ];
 136     };
 137     systemd.services.matrix-synapse = lib.mkIf cfg.registerToSynapse {
 138       serviceConfig.SupplementaryGroups = [ "mautrix-whatsapp" ];
 139     };
 140
 141     services.mautrix-whatsapp.settings = lib.mkMerge (map mkDefaults [
 142       defaultConfig
 143       # Note: this is defined here to avoid the docs depending on `config`
 144       { homeserver.domain = config.services.matrix-synapse.settings.server_name; }
 145     ]);
 146
 147     systemd.services.mautrix-whatsapp = {
 148       description = "Mautrix-WhatsApp Service - A WhatsApp bridge for Matrix";
 149
 150       wantedBy = ["multi-user.target"];
 151       wants = ["network-online.target"] ++ cfg.serviceDependencies;
 152       after = ["network-online.target"] ++ cfg.serviceDependencies;
 153
 154       preStart = ''
 155         # substitute the settings file by environment variables
 156         # in this case read from EnvironmentFile
 157         test -f '${settingsFile}' && rm -f '${settingsFile}'
 158         old_umask=$(umask)
 159         umask 0177
 160         ${pkgs.envsubst}/bin/envsubst \
 161           -o '${settingsFile}' \
 162           -i '${settingsFileUnsubstituted}'
 163         umask $old_umask
 164
 165         # generate the appservice's registration file if absent
 166         if [ ! -f '${registrationFile}' ]; then
 167           ${pkgs.mautrix-whatsapp}/bin/mautrix-whatsapp \
 168             --generate-registration \
 169             --config='${settingsFile}' \
 170             --registration='${registrationFile}'
 171         fi
 172         chmod 640 ${registrationFile}
 173
 174         umask 0177
 175         # 1. Overwrite registration tokens in config
 176         # 2. If environment variable MAUTRIX_WHATSAPP_BRIDGE_LOGIN_SHARED_SECRET
 177         #    is set, set it as the login shared secret value for the configured
 178         #    homeserver domain.
 179         ${pkgs.yq}/bin/yq -s '.[0].appservice.as_token = .[1].as_token
 180           | .[0].appservice.hs_token = .[1].hs_token
 181           | .[0]
 182           | if env.MAUTRIX_WHATSAPP_BRIDGE_LOGIN_SHARED_SECRET then .bridge.login_shared_secret_map.[.homeserver.domain] = env.MAUTRIX_WHATSAPP_BRIDGE_LOGIN_SHARED_SECRET else . end' \
 183           '${settingsFile}' '${registrationFile}' > '${settingsFile}.tmp'
 184         mv '${settingsFile}.tmp' '${settingsFile}'
 185         umask $old_umask
 186       '';
 187
 188       serviceConfig = {
 189         User = "mautrix-whatsapp";
 190         Group = "mautrix-whatsapp";
 191         EnvironmentFile = cfg.environmentFile;
 192         StateDirectory = baseNameOf dataDir;
 193         WorkingDirectory = dataDir;
 194         ExecStart = ''
 195           ${pkgs.mautrix-whatsapp}/bin/mautrix-whatsapp \
 196           --config='${settingsFile}' \
 197           --registration='${registrationFile}'
 198         '';
 199         LockPersonality = true;
 200         MemoryDenyWriteExecute = true;
 201         NoNewPrivileges = true;
 202         PrivateDevices = true;
 203         PrivateTmp = true;
 204         PrivateUsers = true;
 205         ProtectClock = true;
 206         ProtectControlGroups = true;
 207         ProtectHome = true;
 208         ProtectHostname = true;
 209         ProtectKernelLogs = true;
 210         ProtectKernelModules = true;
 211         ProtectKernelTunables = true;
 212         ProtectSystem = "strict";
 213         Restart = "on-failure";
 214         RestartSec = "30s";
 215         RestrictRealtime = true;
 216         RestrictSUIDSGID = true;
 217         SystemCallArchitectures = "native";
 218         SystemCallErrorNumber = "EPERM";
 219         SystemCallFilter = ["@system-service"];
 220         Type = "simple";
 221         UMask = 0027;
 222       };
 223       restartTriggers = [settingsFileUnsubstituted];
 224     };
 225   };
 226   meta.maintainers = with lib.maintainers; [frederictobiasc];
 227 }