draupnir: migrate from mjolnir
Martin Weinelt committed
Jun 7, 2025 at 00:37 UTC
e58caf3697f9a871507f9f497d1fca13b9834b3f
4 files changed
+87
-49
non-critical-infra/hosts/caliban/default.nix
+1
-1
@@ -12,11 +12,11 @@
12
inputs.srvos.nixosModules.hardware-hetzner-online-amd
13
../../../modules/rasdaemon.nix
14
../../modules/common.nix
15
+ ../../modules/draupnir.nix
16
../../modules/first-time-contribution-tagger.nix
17
../../modules/backup.nix
18
../../modules/element-web.nix
19
../../modules/matrix-synapse.nix
19
- ../../modules/mjolnir.nix
20
../../modules/owncast.nix
21
../../modules/prometheus/node-exporter.nix
22
../../modules/vaultwarden.nix
non-critical-infra/modules/draupnir.nix
new
+63
@@ -0,0 +1,63 @@
1
+{
2
+ config,
3
+ ...
4
+}:
5
+{
6
+ sops.secrets.mjolnir-access-token = {
7
+ sopsFile = ../secrets/mjolnir-access-token.caliban;
8
+ format = "binary";
9
+ restartUnits = [ "draupnir.service" ];
10
+ };
11
+
12
+ services.draupnir = {
13
+ enable = true;
14
+ secrets = {
15
+ accessToken = config.sops.secrets.mjolnir-access-token.path;
16
+ };
17
+ settings = {
18
+ # https://github.com/the-draupnir-project/Draupnir/blob/main/config/default.yaml
19
+ homeserverUrl = "https://matrix.nixos.org";
20
+ managementRoom = "#draupnir:nixos.org";
21
+ backgroundDelayMS = "10"; # snappy reactions, we don't mind the performance hit
22
+ protectAllJoinedRooms = true;
23
+ automaticallyRedactForReasons = [
24
+ "spam"
25
+ ];
26
+ web = {
27
+ enabled = true;
28
+ address = "127.0.0.1";
29
+ port = 8082;
30
+ abuseReporting.enabled = true;
31
+ };
32
+ displayReports = true;
33
+ };
34
+ };
35
+
36
+ services.nginx.virtualHosts."matrix.nixos.org" = {
37
+ # https://github.com/the-draupnir-project/Draupnir/blob/main/test/nginx.conf
38
+ locations = {
39
+ "~ ^/_matrix/client/(r0|v3)/rooms/([^/\\s]+)/report/(.*)$" = {
40
+ extraConfig = ''
41
+ mirror /report_mirror;
42
+
43
+ # Abuse reports should be sent to Draupnir.
44
+ # The r0 endpoint is deprecated but still used by many clients.
45
+ # As of this writing, the v3 endpoint is the up-to-date version.
46
+
47
+ # Alias the regexps, to ensure that they're not rewritten.
48
+ set $room_id $2;
49
+ set $event_id $3;
50
+ '';
51
+ proxyPass =
52
+ with config.services.draupnir.settings.web;
53
+ "http://${address}:${toString port}/api/1/report/$room_id/$event_id";
54
+ };
55
+ "/report_mirror" = {
56
+ proxyPass = "http://matrix-synapse$request_uri";
57
+ extraConfig = ''
58
+ internal;
59
+ '';
60
+ };
61
+ };
62
+ };
63
+}
non-critical-infra/modules/mjolnir.nix
deleted
-48
@@ -1,48 +0,0 @@
1
-{ lib, ... }:
2
-{
3
- sops.secrets.mjolnir-password = {
4
- sopsFile = ../secrets/mjolnir-password.caliban;
5
- format = "binary";
6
- path = "/var/keys/mjolnir.password";
7
- mode = "0640";
8
- owner = "root";
9
- group = "mjolnir";
10
- };
11
-
12
- nixpkgs.config.permittedInsecurePackages = [ "olm-3.2.16" ];
13
-
14
- # pantalaimon takes ages to start up, so mjolnir could hit the systemd burst
15
- # limit and then just be down forever. We don't want mjolnir to ever go down,
16
- # so disable rate-limiting and allow it to flap until pantalaimon is alive.
17
- systemd.services.mjolnir.serviceConfig.Restart = lib.mkForce "always";
18
- systemd.services.mjolnir.serviceConfig.RestartSec = 3;
19
- systemd.services.mjolnir.unitConfig.StartLimitIntervalSec = 0;
20
-
21
- services.pantalaimon-headless.instances.mjolnir.listenAddress = "::1";
22
-
23
- services.mjolnir = {
24
- enable = true;
25
- homeserverUrl = "https://matrix.nixos.org:443";
26
-
27
- pantalaimon = {
28
- enable = true;
29
- username = "mjolnir";
30
- passwordFile = "/var/keys/mjolnir.password";
31
- options = {
32
- listenAddress = "[::1]";
33
- };
34
- };
35
-
36
- managementRoom = "#mjolnir:nixos.org";
37
-
38
- # https://github.com/matrix-org/mjolnir/blob/master/config/default.yaml
39
- settings = {
40
- noop = false;
41
- protectAllJoinedRooms = true;
42
- fasterMembershipChecks = true;
43
-
44
- # too noisy
45
- verboseLogging = false;
46
- };
47
- };
48
-}
non-critical-infra/secrets/mjolnir-access-token.caliban
new
+23
@@ -0,0 +1,23 @@
1
+{
2
+ "data": "ENC[AES256_GCM,data:WuqhzFzf9bNkLGljc87P4SJcTLFFjzgfF1AwKTb7ecIW6GgiVp1X8y5ARw==,iv:htfPbSknGVotYObu7FOQhNHPzPttlTAYHeFZragGmsg=,tag:qP4l+RZPywXrupsLr8Vd/g==,type:str]",
3
+ "sops": {
4
+ "age": [
5
+ {
6
+ "recipient": "age1sv307kkrxwgjah8pjpap5kzl4j2r6fqr3vg234n7m32chlchs9lsey7nlq",
7
+ "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBkODRUSmNnTVcrUjl1bklF\nSHZaS3NMTmxoK3daQ0FqTXNQaUFPaGpHeVZjCk1ieXdUV0NpbU4rbUhIQlk5N1dS\nZFBtQ05yMHpqOFhKM2dXaU5qL3VXdWMKLS0tIGJFUlc2ell3cTEvQkhFVEg4bVND\nL2ljY3c0ZHVGWVo2MFRGeXZBOWlEWEkKQF46cGAKEXuI1ODorYHHrSeg+slLPPtu\nQ0vOqeK0yJwarsZWaWKCc4+O2cHQP3RNFp4OUcpk/szRo/htM3ZAhw==\n-----END AGE ENCRYPTED FILE-----\n"
8
+ },
9
+ {
10
+ "recipient": "age1j3mkgedmeru63vwww6m44zfw09tg8yw6xdzstaq7ejfkvgcau40qwakm8x",
11
+ "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBqdVJiekRvejhRUnNuTHhy\nZmZ1b1YyenY4d2FNY2lBT0hYWGx0KzVHYVdZCnBueEphS2dTMC9YY0FBQUlwYWNj\ncUFYNERScDlQZDkrQ0ZNb08vNTNGUGMKLS0tIERTelJDZFF5b25FWStRWk5uWkda\nVm1tVGoyNm0rZm5teEt4VEdhL2RmZk0KwamvCxl8D1q8Koet4KIa4laMieqfk4xc\nx+M3xQg/A+OdBRbYhbMvNn3p6PooQljbi1MtTOystOLQEbG+MK6yNg==\n-----END AGE ENCRYPTED FILE-----\n"
12
+ },
13
+ {
14
+ "recipient": "age1jrh8yyq3swjru09s75s4mspu0mphh7h6z54z946raa9wx3pcdegq0x8t4h",
15
+ "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBONzZIeGI0dDF1ajBWVEtu\nWUVRWG5kUHg0YlpDYm9nNVdraXJ6ZnpiaEY0Ck9UOEgwNWtCMVRDWjJmOEQzbUxH\nVDdvby9YUW5USzk5OExZMzRESEVuWlUKLS0tIG9leGZwMG1qb3lCVkJPUm13cGJz\nY1Z5aFVrWWt3aFpXUXkyRmhjV1JJNjQKa3OZQQIQLba4Lto6yaSZtVIxr+rpsO85\nwz1EOKTYvwjDPzLpDbdqUfwDlLkIQ1KAimN2XEqfq1iI87RY7botjw==\n-----END AGE ENCRYPTED FILE-----\n"
16
+ }
17
+ ],
18
+ "lastmodified": "2025-06-06T21:23:25Z",
19
+ "mac": "ENC[AES256_GCM,data:WrlVzDeD17VtFJLO2sdGDeG8JL536WTl2SDid6jnHSsUZsTqoYCRirzE5ZEKc4aN6DcBPNkuFGVSMVYcmvKq7v5khmW5Oyi0NjT+7hqcewrUAh5loDWzAZd7VOkCsD8GxjtBWtUbADIE2hJ9L8hWoATL9Yh07zwSjWvFg6pW5Bs=,iv:wTOdsNFfdqRluHAFOR1ZcOczYArurlsneqzr8se7SU4=,tag:iiYLrzEuyuuYerNPd9afBA==,type:str]",
20
+ "unencrypted_suffix": "_unencrypted",
21
+ "version": "3.10.2"
22
+ }
23
+}