mautrix-signal: 0.6.3 -> 0.7.0 (#337534)

nixos/doc/manual/release-notes/rl-2411.section.md

@@ -171,6 +171,9 @@
   Processes also now run as a dynamically allocated user by default instead of
   root.
 
+- The `mautrix-signal` module was adapted to incorporate the configuration rearrangement that resulted from the update to the mautrix bridgev2 architecture. Pre-0.7.0 configurations should continue to work.
+  In case you want to update your configuration make sure to check the NixOS manual.
+
 - The nvidia driver no longer defaults to the proprietary driver starting with version 560. You will need to manually set `hardware.nvidia.open` to select the proprietary or open driver.
 
 - `singularity-tools` have the `storeDir` argument removed from its override interface and use `builtins.storeDir` instead.

nixos/modules/services/matrix/mautrix-signal.md

@@ -0,0 +1,32 @@
+# Mautrix-Signal {#module-services-mautrix-signal}
+
+[Mautrix-Signal](https://github.com/mautrix/signal) is a Matrix-Signal puppeting bridge.
+
+## Configuration {#module-services-mautrix-signal-configuration}
+
+1. Set [](#opt-services.mautrix-signal.enable) to `true`. The service will use
+   SQLite by default.
+2. To create your configuration check the default configuration for
+   [](#opt-services.mautrix-signal.settings). To obtain the complete default
+   configuration, run
+   `nix-shell -p mautrix-signal --run "mautrix-signal -c default.yaml -e"`.
+
+::: {.warning}
+Mautrix-Signal allows for some options like `encryption.pickle_key`,
+`provisioning.shared_secret`, allow the value `generate` to be set.
+Since the configuration file is regenerated on every start of the
+service, the generated values would be discarded and might break your
+installation. Instead, set those values via
+[](#opt-services.mautrix-signal.environmentFile).
+:::
+
+## Migrating from an older configuration {#module-services-mautrix-signal-migrate-configuration}
+
+With Mautrix-Signal v0.7.0 the configuration has been rearranged. Mautrix-Signal
+performs an automatic configuration migration so your pre-0.7.0 configuration
+should just continue to work.
+
+In case you want to update your NixOS configuration, compare the migrated configuration
+at `/var/lib/mautrix-signal/config.yaml` with the default configuration
+(`nix-shell -p mautrix-signal --run "mautrix-signal -c example.yaml -e"`) and
+update your module configuration accordingly.

nixos/modules/services/matrix/mautrix-signal.nix

@@ -1,7 +1,8 @@
-{ lib
+{
-, config
+  lib,
-, pkgs
+  config,
-, ...
+  pkgs,
+  ...
 }:
 let
   cfg = config.services.mautrix-signal;
@@ -16,12 +17,22 @@ let
   optOneOf = lib.lists.findFirst (value: value.condition) (lib.mkIf false null);
   mkDefaults = lib.mapAttrsRecursive (n: v: lib.mkDefault v);
   defaultConfig = {
+    network = {
+      displayname_template = "{{or .ProfileName .PhoneNumber \"Unknown user\"}}";
+    };
+    bridge = {
+      command_prefix = "!signal";
+      relay.enabled = true;
+      permissions."*" = "relay";
+    };
+    database = {
+      type = "sqlite3";
+      uri = "file:${dataDir}/mautrix-signal.db?_txlock=immediate";
+    };
     homeserver.address = "http://localhost:8448";
     appservice = {
       hostname = "[::]";
       port = appservicePort;
-      database.type = "sqlite3";
-      database.uri = "file:${dataDir}/mautrix-signal.db?_txlock=immediate";
       id = "signal";
       bot = {
         username = "signalbot";
@@ -29,16 +40,19 @@ let
       };
       as_token = "";
       hs_token = "";
-    };
-    bridge = {
       username_template = "signal_{{.}}";
-      displayname_template = "{{or .ProfileName .PhoneNumber \"Unknown user\"}}";
-      double_puppet_server_map = { };
-      login_shared_secret_map = { };
-      command_prefix = "!signal";
-      permissions."*" = "relay";
-      relay.enabled = true;
     };
+    double_puppet = {
+      servers = { };
+      secrets = { };
+    };
+    # By default, the following keys/secrets are set to `generate`. This would break when the service
+    # is restarted, since the previously generated configuration will be overwritten everytime.
+    # If encryption is enabled, it's recommended to set those keys via `environmentFile`.
+    encryption.pickle_key = "";
+    provisioning.shared_secret = "";
+    public_media.signing_key = "";
+    direct_media.server_key = "";
     logging = {
       min_level = "info";
       writers = lib.singleton {
@@ -60,38 +74,42 @@ in
       default = defaultConfig;
       description = ''
         {file}`config.yaml` configuration as a Nix attribute set.
-        Configuration options should match those described in
+        Configuration options should match those described in the example configuration.
-        [example-config.yaml](https://github.com/mautrix/signal/blob/master/example-config.yaml).
+        Get an example configuration by executing `mautrix-signal -c example.yaml --generate-example-config`
         Secret tokens should be specified using {option}`environmentFile`
         instead of this world-readable attribute set.
       '';
       example = {
-        appservice = {
-          database = {
-            type = "postgres";
-            uri = "postgresql:///mautrix_signal?host=/run/postgresql";
-          };
-          id = "signal";
-          ephemeral_events = false;
-        };
         bridge = {
-          history_sync = {
-            request_full_sync = true;
-          };
           private_chat_portal_meta = true;
-          mute_bridging = true;
+          mute_only_on_create = false;
-          encryption = {
-            allow = true;
-            default = true;
-            require = true;
-          };
-          provisioning = {
-            shared_secret = "disable";
-          };
           permissions = {
             "example.com" = "user";
           };
         };
+        database = {
+          type = "postgres";
+          uri = "postgresql:///mautrix_signal?host=/run/postgresql";
+        };
+        homeserver = {
+          address = "http://[::1]:8008";
+          domain = "my-domain.tld";
+        };
+        appservice = {
+          id = "signal";
+          ephemeral_events = false;
+        };
+        matrix.message_status_events = true;
+        provisioning = {
+          shared_secret = "disable";
+        };
+        backfill.enabled = true;
+        encryption = {
+          allow = true;
+          default = true;
+          require = true;
+          pickle_key = "$ENCRYPTION_PICKLE_KEY";
+        };
       };
     };
 
@@ -102,16 +120,15 @@ in
         File containing environment variables to be passed to the mautrix-signal service.
         If an environment variable `MAUTRIX_SIGNAL_BRIDGE_LOGIN_SHARED_SECRET` is set,
         then its value will be used in the configuration file for the option
-        `login_shared_secret_map` without leaking it to the store, using the configured
+        `double_puppet.secrets` without leaking it to the store, using the configured
         `homeserver.domain` as key.
-        See [here](https://github.com/mautrix/signal/blob/main/example-config.yaml)
-        for the documentation of `login_shared_secret_map`.
       '';
     };
 
     serviceDependencies = lib.mkOption {
       type = with lib.types; listOf str;
-      default = (lib.optional config.services.matrix-synapse.enable config.services.matrix-synapse.serviceUnit)
+      default =
+        (lib.optional config.services.matrix-synapse.enable config.services.matrix-synapse.serviceUnit)
         ++ (lib.optional config.services.matrix-conduit.enable "conduit.service");
       defaultText = lib.literalExpression ''
         (optional config.services.matrix-synapse.enable config.services.matrix-synapse.serviceUnit)
@@ -154,15 +171,18 @@ in
     };
 
     # Note: this is defined here to avoid the docs depending on `config`
-    services.mautrix-signal.settings.homeserver = optOneOf (with config.services; [
+    services.mautrix-signal.settings.homeserver = optOneOf (
-      (lib.mkIf matrix-synapse.enable (mkDefaults {
+      with config.services;
-        domain = matrix-synapse.settings.server_name;
+      [
-      }))
+        (lib.mkIf matrix-synapse.enable (mkDefaults {
-      (lib.mkIf matrix-conduit.enable (mkDefaults {
+          domain = matrix-synapse.settings.server_name;
-        domain = matrix-conduit.settings.global.server_name;
+        }))
-        address = "http://localhost:${toString matrix-conduit.settings.global.port}";
+        (lib.mkIf matrix-conduit.enable (mkDefaults {
-      }))
+          domain = matrix-conduit.settings.global.server_name;
-    ]);
+          address = "http://localhost:${toString matrix-conduit.settings.global.port}";
+        }))
+      ]
+    );
 
     systemd.services.mautrix-signal = {
       description = "mautrix-signal, a Matrix-Signal puppeting bridge.";
@@ -201,7 +221,7 @@ in
         ${pkgs.yq}/bin/yq -s '.[0].appservice.as_token = .[1].as_token
           | .[0].appservice.hs_token = .[1].hs_token
           | .[0]
-          | if env.MAUTRIX_SIGNAL_BRIDGE_LOGIN_SHARED_SECRET then .bridge.login_shared_secret_map.[.homeserver.domain] = env.MAUTRIX_SIGNAL_BRIDGE_LOGIN_SHARED_SECRET else . end' \
+          | if env.MAUTRIX_SIGNAL_BRIDGE_LOGIN_SHARED_SECRET then .double_puppet.secrets.[.homeserver.domain] = env.MAUTRIX_SIGNAL_BRIDGE_LOGIN_SHARED_SECRET else . end' \
           '${settingsFile}' '${registrationFile}' > '${settingsFile}.tmp'
         mv '${settingsFile}.tmp' '${settingsFile}'
         umask $old_umask
@@ -240,10 +260,17 @@ in
         SystemCallErrorNumber = "EPERM";
         SystemCallFilter = [ "@system-service" ];
         Type = "simple";
-        UMask = 0027;
+        UMask = 27;
       };
       restartTriggers = [ settingsFileUnsubstituted ];
     };
   };
-  meta.maintainers = with lib.maintainers; [ niklaskorz ];
+  meta = {
+    buildDocsInSandbox = false;
+    doc = ./mautrix-signal.md;
+    maintainers = with lib.maintainers; [
+      niklaskorz
+      frederictobiasc
+    ];
+  };
 }

pkgs/by-name/li/libsignal-ffi/package.nix

@@ -1,4 +1,14 @@
-{ lib, stdenv, fetchFromGitHub, rustPlatform, runCommand, xcodebuild, protobuf, boringssl, darwin }:
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  rustPlatform,
+  runCommand,
+  xcodebuild,
+  protobuf,
+  boringssl,
+  darwin,
+}:
 let
   # boring-sys expects the static libraries in build/ instead of lib/
   boringssl-wrapper = runCommand "boringssl-wrapper" { } ''
@@ -12,13 +22,14 @@ rustPlatform.buildRustPackage rec {
   pname = "libsignal-ffi";
   # must match the version used in mautrix-signal
   # see https://github.com/mautrix/signal/issues/401
-  version = "0.52.0";
+  version = "0.55.1";
 
   src = fetchFromGitHub {
+    fetchSubmodules = true;
     owner = "signalapp";
     repo = "libsignal";
     rev = "v${version}";
-    hash = "sha256-MFTTrIJ9+1NgaL9KD4t0KYR2feHow+HtyYXQWJgKilM=";
+    hash = "sha256-hQ3iWGLef1y3yyzjWH2MWcs32A7HxUSxGG8fCyMn/KE=";
   };
 
   buildInputs = lib.optional stdenv.isDarwin [ darwin.apple_sdk.frameworks.Security ];
@@ -34,12 +45,15 @@ rustPlatform.buildRustPackage rec {
   cargoLock = {
     lockFile = ./Cargo.lock;
     outputHashes = {
-      "boring-4.6.0" = "sha256-IjkpCKZ4Y1UTrFPg4g/bak+/mJFiyfUyxtTtT5uzcUY=";
+      "boring-4.9.0" = "sha256-RSpaMzMUXp+WuqqDwLErP5yLT0YhYGoOUWCuSt4jR3I=";
       "curve25519-dalek-4.1.3" = "sha256-bPh7eEgcZnq9C3wmSnnYv0C4aAP+7pnwk9Io29GrI4A=";
     };
   };
 
-  cargoBuildFlags = [ "-p" "libsignal-ffi" ];
+  cargoBuildFlags = [
+    "-p"
+    "libsignal-ffi"
+  ];
 
   meta = with lib; {
     description = "C ABI library which exposes Signal protocol logic";

pkgs/servers/mautrix-signal/default.nix

@@ -14,13 +14,13 @@
 
 buildGoModule rec {
   pname = "mautrix-signal";
-  version = "0.6.3";
+  version = "0.7.0";
 
   src = fetchFromGitHub {
     owner = "mautrix";
     repo = "signal";
     rev = "v${version}";
-    hash = "sha256-KBb/rLYM2ne4VD/bPy/lcXD0avCx3J74e3zDcmg+Dzs=";
+    hash = "sha256-/JO2SFAG42cyY1JICT/BJQ8VrkNLsEfAoeWwu9Ofl68=";
   };
 
   buildInputs = (lib.optional (!withGoolm) olm) ++ [
@@ -30,7 +30,7 @@ buildGoModule rec {
   ];
   tags = lib.optional withGoolm "goolm";
 
-  vendorHash = "sha256-DDcz4O3RhV6OVI+qC/LkDW/UsE5jOAn5t/gmILxHx1s=";
+  vendorHash = "sha256-MmbpY4VP6vrwGCI74GZ/QslThHDLQmIwI7G63Gru3UI=";
 
   doCheck = false;
 
@@ -38,7 +38,11 @@ buildGoModule rec {
     homepage = "https://github.com/mautrix/signal";
     description = "Matrix-Signal puppeting bridge";
     license = licenses.agpl3Plus;
-    maintainers = with maintainers; [ expipiplus1 niklaskorz ma27 ];
+    maintainers = with maintainers; [
+      expipiplus1
+      niklaskorz
+      ma27
+    ];
     mainProgram = "mautrix-signal";
   };
 }