nixos/synapse-auto-compressor: init

This commit is contained in:
transcaffeine 2025-02-18 20:27:55 +01:00
parent f176582204
commit 0b483037f7
No known key found for this signature in database
GPG key ID: 03624C433676E465
3 changed files with 167 additions and 0 deletions

View file

@ -149,6 +149,8 @@
- [PDS](https://github.com/bluesky-social/pds), Personal Data Server for [bsky](https://bsky.social/). Available as [services.pds](option.html#opt-services.pds).
- [synapse-auto-compressor](https://github.com/matrix-org/rust-synapse-compress-state?tab=readme-ov-file#automated-tool-synapse_auto_compressor), a rust-based matrix-synapse state compressor for postgresql. Available as [services.synapse-auto-compressor](#opt-services.synapse-auto-compressor.enable).
- [mqtt-exporter](https://github.com/kpetremann/mqtt-exporter/), a Prometheus exporter for exposing messages from MQTT. Available as [services.prometheus.exporters.mqtt](#opt-services.prometheus.exporters.mqtt.enable).
- [nvidia-gpu](https://github.com/utkuozdemir/nvidia_gpu_exporter), a Prometheus exporter that scrapes `nvidia-smi` for GPU metrics. Available as [services.prometheus.exporters.nvidia-gpu](#opt-services.prometheus.exporters.nvidia-gpu.enable).

View file

@ -751,6 +751,7 @@
./services/matrix/mx-puppet-discord.nix
./services/matrix/pantalaimon.nix
./services/matrix/synapse.nix
./services/matrix/synapse-auto-compressor.nix
./services/misc/airsonic.nix
./services/misc/amazon-ssm-agent.nix
./services/misc/ananicy.nix

View file

@ -0,0 +1,164 @@
{
config,
lib,
pkgs,
utils,
...
}:
let
cfg = config.services.synapse-auto-compressor;
synapseConfig = config.services.matrix-synapse;
postgresEnabled = config.services.postgresql.enable;
synapseUsesPostgresql = synapseConfig.settings.database.name == "psycopg2";
synapseUsesLocalPostgresql =
let
args = synapseConfig.settings.database.args;
in
synapseUsesPostgresql
&& postgresEnabled
&& (
!(args ? host)
|| (builtins.elem args.host [
"localhost"
"127.0.0.1"
"::1"
])
);
in
{
options = {
services.synapse-auto-compressor = {
enable = lib.mkEnableOption "synapse-auto-compressor";
package = lib.mkPackageOption pkgs "rust-synapse-state-compress" { };
postgresUrl = lib.mkOption {
default =
let
args = synapseConfig.settings.database.args;
in
if synapseConfig.enable then
''postgresql://${args.user}${lib.optionalString (args ? password) (":" + args.password)}@${
lib.escapeURL (if (args ? host) then args.host else "/run/postgresql")
}${lib.optionalString (args ? port) (":" + args.port)}/${args.database}''
else
null;
defaultText = lib.literalExpression ''
let
synapseConfig = config.services.matrix-synapse;
args = synapseConfig.settings.database.args;
in
if synapseConfig.enable then
'''postgresql://''${args.user}''${lib.optionalString (args ? password) (":" + args.password)}@''${
lib.escapeURL (if (args ? host) then args.host else "/run/postgresql")
}''${lib.optionalString (args ? port) (":" + args.port)}''${args.database}'''
else
null;
'';
type = lib.types.str;
example = "postgresql://username:password@mydomain.com:port/database";
description = ''
Connection string to postgresql in the
[rust `postgres` crate config format](https://docs.rs/postgres/latest/postgres/config/struct.Config.html).
The module will attempt to build a URL-style connection string out of the `services.matrix-synapse.settings.database.args`
if a local synapse is enabled.
'';
};
startAt = lib.mkOption {
default = "weekly";
type = with lib.types; either str (listOf str);
description = "How often to run this service in systemd calendar syntax (see {manpage}`systemd.time(7)`)";
example = "daily";
};
settings = {
chunk_size = lib.mkOption {
type = lib.types.int;
default = 500;
description = ''
The number of state groups to work on at once. All of the entries from `state_groups_state` are requested
from the database for state groups that are worked on. Therefore small chunk sizes may be needed on
machines with low memory.
Note: if the compressor fails to find space savings on the chunk as a whole
(which may well happen in rooms with lots of backfill in) then the entire chunk is skipped.
'';
};
chunks_to_compress = lib.mkOption {
type = lib.types.int;
default = 100;
description = ''
`chunks_to_compress` chunks of size `chunk_size` will be compressed. The higher this number is set to,
the longer the compressor will run for.
'';
};
levels = lib.mkOption {
type = with lib.types; listOf int;
default = [
100
50
25
];
description = ''
Sizes of each new level in the compression algorithm, as a comma-separated list. The first entry in
the list is for the lowest, most granular level, with each subsequent entry being for the next highest
level. The number of entries in the list determines the number of levels that will be used. The sum of
the sizes of the levels affects the performance of fetching the state from the database, as the sum of
the sizes is the upper bound on the number of iterations needed to fetch a given set of state.
'';
};
};
};
};
config = lib.mkIf cfg.enable {
assertions = [
{
assertion = synapseConfig.enable && synapseUsesPostgresql;
message = "`services.synapse-auto-compressor` requires local synapse to use postgresql as a database backend";
}
];
systemd.services.synapse-auto-compressor = {
description = "synapse-auto-compressor";
requires = lib.optionals synapseUsesLocalPostgresql [
"postgresql.service"
];
inherit (cfg) startAt;
serviceConfig = {
Type = "oneshot";
DynamicUser = true;
User = "matrix-synapse";
PrivateTmp = true;
ExecStart = utils.escapeSystemdExecArgs [
"${cfg.package}/bin/synapse_auto_compressor"
"-p"
cfg.postgresUrl
"-c"
cfg.settings.chunk_size
"-n"
cfg.settings.chunks_to_compress
"-l"
(lib.concatStringsSep "," (builtins.map builtins.toString cfg.settings.levels))
];
LockPersonality = true;
MemoryDenyWriteExecute = true;
NoNewPrivileges = true;
PrivateDevices = true;
PrivateMounts = true;
PrivateUsers = true;
RemoveIPC = true;
RestrictNamespaces = true;
RestrictRealtime = true;
RestrictSUIDSGID = true;
ProcSubset = "pid";
ProtectProc = "invisible";
ProtectSystem = "strict";
ProtectHome = true;
ProtectHostname = true;
ProtectClock = true;
ProtectKernelTunables = true;
ProtectKernelModules = true;
ProtectKernelLogs = true;
ProtectControlGroups = true;
};
};
};
}