nixos/matrix-alertmanager: init module

nixos/doc/manual/release-notes/rl-2505.section.md

@@ -121,6 +121,8 @@
 
 - [vivid](https://github.com/sharkdp/vivid), a generator for LS_COLOR. Available as [programs.vivid](#opt-programs.vivid.enable).
 
+- [matrix-alertmanager](https://github.com/jaywink/matrix-alertmanager), a bot to receive Alertmanager webhook events and forward them to chosen Matrix rooms. Available as [services.matrix-alertmanager](options.html#opt-services.matrix-alertmanager.enable).
+
 - [waagent](https://github.com/Azure/WALinuxAgent), the Microsoft Azure Linux Agent (waagent) manages Linux provisioning and VM interaction with the Azure Fabric Controller. Available with [services.waagent](options.html#opt-services.waagent.enable).
 
 - [nfc-nci](https://github.com/StarGate01/ifdnfc-nci), an alternative NFC stack and PC/SC driver for the NXP PN54x chipset, commonly found in Lenovo systems as NXP1001 (NPC300). Available as [hardware.nfc-nci](#opt-hardware.nfc-nci.enable).

nixos/modules/module-list.nix

@@ -742,6 +742,7 @@
   ./services/matrix/dendrite.nix
   ./services/matrix/hebbot.nix
   ./services/matrix/hookshot.nix
+  ./services/matrix/matrix-alertmanager.nix
   ./services/matrix/maubot.nix
   ./services/matrix/mautrix-meta.nix
   ./services/matrix/mautrix-signal.nix

nixos/modules/services/matrix/matrix-alertmanager.nix

@@ -0,0 +1,124 @@
+{
+  lib,
+  config,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.services.matrix-alertmanager;
+  rooms = room: lib.concatStringsSep "/" (room.receivers ++ [ room.roomId ]);
+  concatenatedRooms = lib.concatStringsSep "|" (map rooms cfg.matrixRooms);
+in
+{
+  meta.maintainers = [ lib.maintainers.erethon ];
+
+  options.services.matrix-alertmanager = {
+    enable = lib.mkEnableOption "matrix-alertmanager";
+    package = lib.mkPackageOption pkgs "matrix-alertmanager" { };
+    port = lib.mkOption {
+      type = lib.types.port;
+      default = 3000;
+      description = "Port that matrix-alertmanager listens on.";
+    };
+    homeserverUrl = lib.mkOption {
+      type = lib.types.str;
+      description = "URL of the Matrix homeserver to use.";
+      example = "https://matrix.example.com";
+    };
+    matrixUser = lib.mkOption {
+      type = lib.types.str;
+      description = "Matrix user to use for the bot.";
+      example = "@alertmanageruser:example.com";
+    };
+    matrixRooms = lib.mkOption {
+      type = lib.types.listOf (
+        lib.types.submodule {
+          options = {
+            receivers = lib.mkOption {
+              type = lib.types.listOf lib.types.str;
+              description = "List of receivers for this room";
+            };
+            roomId = lib.mkOption {
+              type = lib.types.str;
+              description = "Matrix room ID";
+              apply =
+                x:
+                assert lib.assertMsg (lib.hasPrefix "!" x) "Matrix room ID must start with a '!'. Got: ${x}";
+                x;
+            };
+          };
+        }
+      );
+      description = ''
+        Combination of Alertmanager receiver(s) and rooms for the bot to join.
+        Each Alertmanager receiver can be mapped to post to a matrix room.
+
+        Note, you must use a room ID and not a room alias/name. Room IDs start
+        with a "!".
+      '';
+      example = [
+        {
+          receivers = [
+            "receiver1"
+            "receiver2"
+          ];
+          roomId = "!roomid@example.com";
+        }
+        {
+          receivers = [ "receiver3" ];
+          roomId = "!differentroomid@example.com";
+        }
+      ];
+    };
+    mention = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      description = "Makes the bot mention @room when posting an alert";
+    };
+    tokenFile = lib.mkOption {
+      type = lib.types.pathWith {
+        inStore = false;
+        absolute = true;
+      };
+      description = "File that contains a valid Matrix token for the Matrix user.";
+    };
+    secretFile = lib.mkOption {
+      type = lib.types.pathWith {
+        inStore = false;
+        absolute = true;
+      };
+      description = "File that contains a secret for the Alertmanager webhook.";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    systemd.services.matrix-alertmanager = {
+      description = "A bot to receive Alertmanager webhook events and forward them to chosen rooms.";
+      after = [ "network.target" ];
+      wantedBy = [ "multi-user.target" ];
+      serviceConfig = {
+        DynamicUser = true;
+        Restart = "always";
+        RestartSec = "10s";
+        LoadCredential = [
+          "token:${cfg.tokenFile}"
+          "secret:${cfg.secretFile}"
+        ];
+      };
+
+      environment = {
+        APP_PORT = toString cfg.port;
+        MATRIX_HOMESERVER_URL = cfg.homeserverUrl;
+        MATRIX_ROOMS = concatenatedRooms;
+        MATRIX_USER = cfg.matrixUser;
+        MENTION_ROOM = if cfg.mention then "1" else "0";
+      };
+
+      script = ''
+        export APP_ALERTMANAGER_SECRET=$(cat "''${CREDENTIALS_DIRECTORY}/secret")
+        export MATRIX_TOKEN=$(cat "''${CREDENTIALS_DIRECTORY}/token")
+        exec ${lib.getExe cfg.package}
+      '';
+    };
+  };
+}