| 1 | { |
| 2 | config, |
| 3 | ... |
| 4 | }: |
| 5 | { |
| 6 | sops.secrets.mjolnir-access-token = { |
| 7 | sopsFile = ../secrets/mjolnir-access-token.caliban; |
| 8 | format = "binary"; |
| 9 | restartUnits = [ "draupnir.service" ]; |
| 10 | }; |
| 11 | |
| 12 | services.draupnir = { |
| 13 | enable = true; |
| 14 | secrets = { |
| 15 | accessToken = config.sops.secrets.mjolnir-access-token.path; |
| 16 | }; |
| 17 | settings = { |
| 18 | # https://github.com/the-draupnir-project/Draupnir/blob/main/config/default.yaml |
| 19 | homeserverUrl = "https://matrix.nixos.org"; |
| 20 | managementRoom = "#draupnir:nixos.org"; |
| 21 | backgroundDelayMS = "10"; # snappy reactions, we don't mind the performance hit |
| 22 | protectAllJoinedRooms = true; |
| 23 | automaticallyRedactForReasons = [ |
| 24 | "spam" |
| 25 | ]; |
| 26 | web = { |
| 27 | enabled = true; |
| 28 | address = "127.0.0.1"; |
| 29 | port = 8082; |
| 30 | abuseReporting.enabled = true; |
| 31 | }; |
| 32 | displayReports = true; |
| 33 | }; |
| 34 | }; |
| 35 | |
| 36 | services.nginx.virtualHosts."matrix.nixos.org" = { |
| 37 | # https://github.com/the-draupnir-project/Draupnir/blob/main/test/nginx.conf |
| 38 | locations = { |
| 39 | "~ ^/_matrix/client/(r0|v3)/rooms/([^/\\s]+)/report/(.*)$" = { |
| 40 | extraConfig = '' |
| 41 | mirror /report_mirror; |
| 42 | |
| 43 | # Abuse reports should be sent to Draupnir. |
| 44 | # The r0 endpoint is deprecated but still used by many clients. |
| 45 | # As of this writing, the v3 endpoint is the up-to-date version. |
| 46 | |
| 47 | # Alias the regexps, to ensure that they're not rewritten. |
| 48 | set $room_id $2; |
| 49 | set $event_id $3; |
| 50 | ''; |
| 51 | proxyPass = |
| 52 | with config.services.draupnir.settings.web; |
| 53 | "http://${address}:${toString port}/api/1/report/$room_id/$event_id"; |
| 54 | }; |
| 55 | "/report_mirror" = { |
| 56 | proxyPass = "http://matrix-synapse$request_uri"; |
| 57 | extraConfig = '' |
| 58 | internal; |
| 59 | ''; |
| 60 | }; |
| 61 | }; |
| 62 | }; |
| 63 | } |