Use separate pre-start service

This commit is contained in:
Rory& 2024-12-16 12:51:50 +01:00
commit 859dd28c0c

View file

@ -27,18 +27,11 @@ in
namespace = mkStringOption "The prefix to use for the MXIDs/aliases of bridged users/rooms. Should end with a _!" "_ooye_"; namespace = mkStringOption "The prefix to use for the MXIDs/aliases of bridged users/rooms. Should end with a _!" "_ooye_";
discordTokenPath = mkStringOption "The path to the discord token file." "/etc/ooye-discord-token"; discordTokenPath = mkStringOption "The path to the discord token file." "/etc/ooye-discord-token";
socket = mkStringOption "The socket to listen on, can either be a port number or a unix socket path." "6693"; socket = mkStringOption "The socket to listen on, can either be a port number or a unix socket path." "6693";
};
};
config = lib.mkIf cfg.enable {
warnings =
lib.optionals ((builtins.substring (lib.stringLength cfg.namespace - 1) 1 cfg.namespace) != "_") [
"OOYE namespace does not end with an underscore! This is recommended to have better ID formatting. Provided: '${cfg.namespace}'"
]
++ lib.optionals ((builtins.substring 0 1 cfg.namespace) != "_") [
"OOYE namespace does not start with an underscore! This is recommended to avoid conflicts with registered users. Provided: '${cfg.namespace}'"
];
systemd.services."matrix-ooye" = enableSynapseIntegration = lib.mkEnableOption "Enable Synapse integration";
};
};
config = lib.mkIf cfg.enable (
let let
baseConfig = pkgs.writeText "matrix-ooye-config.json" ( baseConfig = pkgs.writeText "matrix-ooye-config.json" (
builtins.toJSON { builtins.toJSON {
@ -73,18 +66,25 @@ in
} }
); );
script = pkgs.writeScript "matrix-ooye-pre-start.sh" '' script = pkgs.writeScript "matrix-ooye-pre-start.sh" ''
#!${lib.getExe pkgs.bash} #!${lib.getExe pkgs.bash}
REGISTRATION_FILE=registration.yaml REGISTRATION_FILE=registration.yaml
id
echo "Before if statement"
stat ''${REGISTRATION_FILE}
if [[ ! -f ''${REGISTRATION_FILE} ]]; then if [[ ! -f ''${REGISTRATION_FILE} ]]; then
echo "No registration file found at '$REGISTRATION_FILE'" echo "No registration file found at '$REGISTRATION_FILE'"
cp --no-preserve=mode,ownership ${baseConfig} ''${REGISTRATION_FILE} cp --no-preserve=mode,ownership ${baseConfig} ''${REGISTRATION_FILE}
fi fi
echo "After if statement"
stat ''${REGISTRATION_FILE}
AS_TOKEN=$(${lib.getExe pkgs.jq} -r .as_token ''${REGISTRATION_FILE}) AS_TOKEN=$(${lib.getExe pkgs.jq} -r .as_token ''${REGISTRATION_FILE})
HS_TOKEN=$(${lib.getExe pkgs.jq} -r .hs_token ''${REGISTRATION_FILE}) HS_TOKEN=$(${lib.getExe pkgs.jq} -r .hs_token ''${REGISTRATION_FILE})
DISCORD_TOKEN=$(cat /run/credentials/matrix-ooye.service/discord_token) DISCORD_TOKEN=$(cat /run/credentials/matrix-ooye-pre-start.service/discord_token)
if [[ -z "$AS_TOKEN" || "$AS_TOKEN" == "null" ]]; then if [[ -z "$AS_TOKEN" || "$AS_TOKEN" == "null" ]]; then
AS_TOKEN=$(${lib.getExe pkgs.openssl} rand -hex 64) AS_TOKEN=$(${lib.getExe pkgs.openssl} rand -hex 64)
@ -106,12 +106,35 @@ in
shred -u ''${REGISTRATION_FILE} shred -u ''${REGISTRATION_FILE}
mv ''${REGISTRATION_FILE}.tmp ''${REGISTRATION_FILE} mv ''${REGISTRATION_FILE}.tmp ''${REGISTRATION_FILE}
''; '';
in in
{ {
enable = true; warnings =
lib.optionals ((builtins.substring (lib.stringLength cfg.namespace - 1) 1 cfg.namespace) != "_") [
"OOYE namespace does not end with an underscore! This is recommended to have better ID formatting. Provided: '${cfg.namespace}'"
]
++ lib.optionals ((builtins.substring 0 1 cfg.namespace) != "_") [
"OOYE namespace does not start with an underscore! This is recommended to avoid conflicts with registered users. Provided: '${cfg.namespace}'"
];
systemd.services."matrix-ooye-pre-start" = {
enable = true;
wantedBy = [ "multi-user.target" ];
serviceConfig = {
ExecStart = script;
WorkingDirectory = "/var/lib/matrix-ooye";
StateDirectory = "matrix-ooye";
DynamicUser = true;
LoadCredential = [
"discord_token:${cfg.discordTokenPath}"
];
};
};
systemd.services."matrix-ooye" = {
enable = true;
description = "Out of Your Element - a Discord bridge for Matrix."; description = "Out of Your Element - a Discord bridge for Matrix.";
wants = [ wants = [
@ -120,35 +143,37 @@ in
"conduit.service" "conduit.service"
"dendrite.service" "dendrite.service"
]; ];
after = [ after = [
"matrix-ooye-pre-start.service" "matrix-ooye-pre-start.service"
"network-online.target" "network-online.target"
"matrix-synapse.service"
"conduit.service"
"dendrite.service"
]; ];
wantedBy = [ "multi-user.target" ]; wantedBy = [ "multi-user.target" ];
requires = [ "matrix-ooye-pre-start.service" ];
serviceConfig = { serviceConfig = {
ExecStartPre = script;
ExecStart = lib.getExe config.services.matrix-ooye.package; ExecStart = lib.getExe config.services.matrix-ooye.package;
WorkingDirectory = "/var/lib/matrix-ooye"; WorkingDirectory = "/var/lib/matrix-ooye";
StateDirectory = "matrix-ooye"; StateDirectory = "matrix-ooye";
StateDirectoryMode = "0700";
ProtectSystem = "strict"; ProtectSystem = "strict";
ProtectHome = true; ProtectHome = true;
PrivateTmp = true; PrivateTmp = true;
NoNewPrivileges = true; NoNewPrivileges = true;
PrivateDevices = true; PrivateDevices = true;
Restart = "on-failure"; Restart = "on-failure";
DynamicUser = true; DynamicUser = true;
};
};
systemd.services."matrix-synapse".serviceConfig = lib.mkIf cfg.enableSynapseIntegration {
LoadCredential = [ LoadCredential = [
"discord_token:${cfg.discordTokenPath}" "matrix-ooye-registration:/var/lib/matrix-ooye/registration.yaml"
]; ];
ExecStartPre = "cp /run/credentials/matrix-synapse.service/registration.yaml ${config.services.matrix-synapse.dataDir}/ooye-registration.yaml";
}; };
};
}; services.matrix-synapse.settings.app_service_config_files = lib.mkIf cfg.enableSynapseIntegration [
"${config.services.matrix-synapse.dataDir}/ooye-registration.yaml"
];
}
);
} }