From fc3f7c17e27920d1a56ba4eb1120dfdb1adf18ca Mon Sep 17 00:00:00 2001
From: Morgan Jones <me@numin.it>
Date: Sat, 25 Jan 2025 17:23:39 -0800
Subject: [PATCH] nixos/mattermost: disable telemetry by default

We should disable telemetry but enable security update checks. Make both
controlable in the module without digging into settings.

Disabling telemetry also makes NixOS tests faster because the server
tries to send telemetry on first start.
---
 .../modules/services/web-apps/mattermost.nix  | 29 ++++++++++++++++++-
 nixos/tests/mattermost/default.nix            |  1 +
 2 files changed, 29 insertions(+), 1 deletion(-)

diff --git a/nixos/modules/services/web-apps/mattermost.nix b/nixos/modules/services/web-apps/mattermost.nix
index 9b420f8a51fc..e21164e1e74c 100644
--- a/nixos/modules/services/web-apps/mattermost.nix
+++ b/nixos/modules/services/web-apps/mattermost.nix
@@ -202,6 +202,7 @@ let
       ListenAddress = "${cfg.host}:${toString cfg.port}";
       LocalModeSocketLocation = cfg.socket.path;
       EnableLocalMode = cfg.socket.enable;
+      EnableSecurityFixAlert = cfg.telemetry.enableSecurityAlerts;
     };
     TeamSettings.SiteName = cfg.siteName;
     SqlSettings.DriverName = cfg.database.driver;
@@ -233,7 +234,13 @@ let
     FileSettings.Directory = cfg.dataDir;
     PluginSettings.Directory = "${pluginDir}/server";
     PluginSettings.ClientDirectory = "${pluginDir}/client";
-    LogSettings.FileLocation = cfg.logDir;
+    LogSettings = {
+      FileLocation = cfg.logDir;
+
+      # Reaches out to Mattermost's servers for telemetry; disable it by default.
+      # https://docs.mattermost.com/configure/environment-configuration-settings.html#enable-diagnostics-and-error-reporting
+      EnableDiagnostics = cfg.telemetry.enableDiagnostics;
+    };
   } cfg.settings;
 
   mattermostConf = recursiveUpdate mattermostConfWithoutPlugins (
@@ -474,6 +481,26 @@ in
         '';
       };
 
+      telemetry = {
+        enableSecurityAlerts = mkOption {
+          type = types.bool;
+          default = true;
+          description = ''
+            True if we should enable security update checking. This reaches out to Mattermost's servers:
+            https://docs.mattermost.com/manage/telemetry.html#security-update-check-feature
+          '';
+        };
+
+        enableDiagnostics = mkOption {
+          type = types.bool;
+          default = false;
+          description = ''
+            True if we should enable sending diagnostic data. This reaches out to Mattermost's servers:
+            https://docs.mattermost.com/manage/telemetry.html#error-and-diagnostics-reporting-feature
+          '';
+        };
+      };
+
       environment = mkOption {
         type = with types; attrsOf (either int str);
         default = { };
diff --git a/nixos/tests/mattermost/default.nix b/nixos/tests/mattermost/default.nix
index 99ad4b110118..02f5e8ce247b 100644
--- a/nixos/tests/mattermost/default.nix
+++ b/nixos/tests/mattermost/default.nix
@@ -48,6 +48,7 @@ import ../make-test-python.nix (
               database = {
                 peerAuth = lib.mkDefault true;
               };
+              telemetry.enableSecurityAlerts = false;
               settings = {
                 SupportSettings.AboutLink = "https://nixos.org";
                 PluginSettings.AutomaticPrepackagedPlugins = false;