setup matrix-synapse with telegram bridge

profiles/servers/coturn.nix

@@ -0,0 +1,66 @@
+{ config, pkgs, lib, ... }: {
+  secrets-envsubst.turn-shared-secret = {
+    directory = "mautrix-telegram";
+    owner = "turnserver";
+    secrets = [ "turn_shared_secret" ];
+    template = "$turn_shared_secret";
+  };
+  # enable coturn
+  services.coturn = rec {
+    enable = true;
+    no-cli = true;
+    no-tcp-relay = true;
+    min-port = 49000;
+    max-port = 50000;
+    use-auth-secret = true;
+    static-auth-secret-file = config.secrets-envsubst.turn-shared-secret.substituted;
+    realm = "turn.ataraxiadev.com";
+    cert = config.secrets."ataraxiadev.com.pem".decrypted;
+    pkey = config.secrets."ataraxiadev.com.key".decrypted;
+    extraConfig = ''
+      user-quota=20
+      total-quota=600
+      # for debugging
+      verbose
+      # ban private IP ranges
+      no-multicast-peers
+      denied-peer-ip=0.0.0.0-0.255.255.255
+      denied-peer-ip=10.0.0.0-10.255.255.255
+      denied-peer-ip=100.64.0.0-100.127.255.255
+      denied-peer-ip=127.0.0.0-127.255.255.255
+      denied-peer-ip=169.254.0.0-169.254.255.255
+      denied-peer-ip=172.16.0.0-172.31.255.255
+      denied-peer-ip=192.0.0.0-192.0.0.255
+      denied-peer-ip=192.0.2.0-192.0.2.255
+      denied-peer-ip=192.88.99.0-192.88.99.255
+      denied-peer-ip=192.168.0.0-192.168.255.255
+      denied-peer-ip=198.18.0.0-198.19.255.255
+      denied-peer-ip=198.51.100.0-198.51.100.255
+      denied-peer-ip=203.0.113.0-203.0.113.255
+      denied-peer-ip=240.0.0.0-255.255.255.255
+      denied-peer-ip=::1
+      denied-peer-ip=64:ff9b::-64:ff9b::ffff:ffff
+      denied-peer-ip=::ffff:0.0.0.0-::ffff:255.255.255.255
+      denied-peer-ip=100::-100::ffff:ffff:ffff:ffff
+      denied-peer-ip=2001::-2001:1ff:ffff:ffff:ffff:ffff:ffff:ffff
+      denied-peer-ip=2002::-2002:ffff:ffff:ffff:ffff:ffff:ffff:ffff
+      denied-peer-ip=fc00::-fdff:ffff:ffff:ffff:ffff:ffff:ffff:ffff
+      denied-peer-ip=fe80::-febf:ffff:ffff:ffff:ffff:ffff:ffff:ffff
+    '';
+  };
+
+  networking.firewall = {
+    interfaces.enp0s3 = let
+      range = with config.services.coturn; [ {
+      from = min-port;
+      to = max-port;
+    } ];
+    in
+    {
+      allowedUDPPortRanges = range;
+      allowedUDPPorts = [ 3478 ];
+      allowedTCPPortRanges = range;
+      allowedTCPPorts = [ 3478 ];
+    };
+  };
+}

profiles/servers/matrix-synapse.nix

@@ -1,7 +1,21 @@
-{ pkgs, config, lib, ... }: {
+{ pkgs, config, lib, options, ... }: {
-  services.matrix-synapse = {
+  services.postgresql.enable = true;
+  services.postgresqlBackup = {
+    enable = true;
+    location = config.users.users.alukard.home + "/matrix-backup";
+    startAt = "*-*-* 07:00:00";
+  };
+
+  services.matrix-synapse = with config.services.coturn; {
     enable = true;
     allow_guest_access = true;
+    app_service_config_files = [ config.secrets-envsubst.mautrix-telegram-registration.substituted ];
+    extraConfigFiles = [ config.secrets-envsubst.matrix-shared-secret.substituted ];
+    logConfig = options.services.matrix-synapse.logConfig.default + ''
+      loggers:
+          shared_secret_authenticator:
+              level: INFO
+    '';
     listeners = [{
       bind_address = "0.0.0.0";
       port = 13748;
@@ -19,11 +33,148 @@
       tls = false;
       x_forwarded = true;
     }];
+    plugins = with pkgs.matrix-synapse-plugins; [ matrix-synapse-shared-secret-auth ];
     public_baseurl = "https://ataraxiadev.com";
     server_name = "ataraxiadev.com";
+    turn_uris = [ "turn:${realm}:3478?transport=udp" "turn:${realm}:3478?transport=tcp" ];
+    turn_user_lifetime = "12h";
   };
 
-  services.postgresql.enable = true;
+  secrets-envsubst.matrix-shared-secret = {
+    directory = "mautrix-telegram";
+    owner = "matrix-synapse";
+    secrets = [ "shared_secret" "reg_shared_secret" "turn_shared_secret" ];
+    template = ''
+      registration_shared_secret: $reg_shared_secret
+      turn_allow_guests: False
+      turn_shared_secret: $turn_shared_secret
+      password_providers:
+        - module: "shared_secret_authenticator.SharedSecretAuthenticator"
+          config:
+            sharedSecret: "$shared_secret"
+    '';
+  };
+
+  services.mautrix-telegram = {
+    enable = true;
+    environmentFile = toString config.secrets-envsubst.mautrix-telegram;
+    settings = {
+      appservice = {
+        address = "http://localhost:29317";
+        bot_avatar = "mxc://maunium.net/tJCRmUyJDsgRNgqhOgoiHWbX";
+        database = "postgresql://mautrix-telegram:$MATRIX_PASS@localhost/mautrix-telegram";
+        id = "telegram";
+        max_body_size = 1;
+        port = 29317;
+        public = {
+          enabled = true;
+          prefix = "/mautrix-telegram";
+          external = "https://matrix.ataraxiadev.com/mautrix-telegram";
+        };
+        provisioning.enabled = false;
+      };
+      bridge = {
+        alias_template = "tg_{groupname}";
+        allow_matrix_login = false;
+        animated_sticker = {
+          target = "gif";
+          args = {
+            width = 128;
+            height = 128;
+            fps = 30;
+            background = "15191E";
+          };
+        };
+        bot_messages_as_notices = true;
+        catch_up = true;
+        command_prefix = "!tg";
+        encryption = {
+          allow = true;
+          default = true;
+        };
+        filter = {
+          mode = "whitelist";
+          list = [ ];
+        };
+        image_as_file_size = 10;
+        login_shared_secret_map."ataraxiadev.com" = "$SHARED_SECRET_AUTH";
+        max_document_size = 100;
+        max_initial_member_sync = -1;
+        max_telegram_delete = 10;
+        permissions = {
+          "*" = "relaybot";
+          "@ataraxiadev:ataraxiadev.com" = "admin";
+          "@kpoxa:ataraxiadev.com" = "full";
+        };
+        plaintext_highlights = true;
+        startup_sync = false;
+        sync_direct_chat_list = true;
+        sync_direct_chats = false;
+        username_template = "tg_{userid}";
+      };
+      homeserver = {
+        address = "https://matrix.ataraxiadev.com";
+        asmux = true;
+        domain = "ataraxiadev.com";
+        verify_ssl = true;
+      };
+      telegram = { bot_token = "disabled"; };
+    };
+  };
+
+  secrets-envsubst.mautrix-telegram = {
+    secrets = [ "as_token" "hs_token" "api_id" "api_hash" "matrix_pass" "shared_secret" ];
+    template = ''
+      MAUTRIX_TELEGRAM_APPSERVICE_AS_TOKEN=$as_token
+      MAUTRIX_TELEGRAM_APPSERVICE_HS_TOKEN=$hs_token
+      MAUTRIX_TELEGRAM_TELEGRAM_API_ID=$api_id
+      MAUTRIX_TELEGRAM_TELEGRAM_API_HASH=$api_hash
+      MATRIX_PASS=$matrix_pass
+      SHARED_SECRET_AUTH=$shared_secret
+    '';
+  };
+
+  secrets-envsubst.mautrix-telegram-registration = {
+    directory = "mautrix-telegram";
+    secrets = [ "as_token" "hs_token" "sender_localpart" ];
+    owner = "matrix-synapse";
+    template = builtins.toJSON {
+      as_token = "$as_token";
+      hs_token = "$hs_token";
+      id = "telegram";
+      namespaces = {
+        aliases = [{
+          exclusive = true;
+          regex = "#tg_.+:ataraxiadev.com";
+        }];
+        users = [{
+          exclusive = true;
+          regex = "@tg_.+:ataraxiadev.com";
+        } {
+          exclusive = true;
+          regex = "@telegrambot:ataraxiadev.com";
+        }];
+      };
+      rate_limited = false;
+      sender_localpart = "$sender_localpart";
+      url = "http://localhost:29317";
+    };
+  };
+
+  systemd.services.mautrix-telegram = {
+    path = with pkgs; [ lottieconverter ];
+    serviceConfig = {
+      DynamicUser = lib.mkForce false;
+      User = "mautrix-telegram";
+    };
+  };
+
+  users.users.mautrix-telegram = {
+    group = "mautrix-telegram";
+    isSystemUser = true;
+  };
+
+  users.groups.mautrix-telegram = {};
 
   users.users.matrix-synapse.name = lib.mkForce "matrix-synapse";
 }

profiles/servers/nginx.nix

@@ -1,12 +1,15 @@
 { pkgs, config, lib, ... }: {
   secrets."ataraxiadev.com.pem" = {
-    owner = "nginx:nginx";
+    owner = "nginx:turnserver";
+    permissions = "440";
   };
   secrets."ataraxiadev.com.key" = {
-    owner = "nginx:nginx";
+    owner = "nginx:turnserver";
+    permissions = "440";
   };
   secrets."origin-pull-ca.pem" = {
-    owner = "nginx:nginx";
+    owner = "nginx:turnserver";
+    permissions = "440";
   };
   ## DNS-over-TLS
   services.stubby = {
@@ -79,6 +82,9 @@
         locations."/" = {
           proxyPass = "http://localhost:13748";
         };
+        locations."/mautrix-telegram/" = {
+          proxyPass = "http://localhost:29317";
+        };
       } // default;
     };
   };

roles/server.nix

@@ -24,6 +24,7 @@
     direnv
     kitty
 
+    coturn
     matrix-synapse
     nginx
   ];