From 676ddafd3dbdc8dd95471df84bc5198d2d37d241 Mon Sep 17 00:00:00 2001 From: Michael Lingelbach Date: Thu, 27 May 2021 01:41:05 -0700 Subject: [PATCH] nixos/dendrite: remove (#124524) * The options tlsKey and tlsCert require being accessible by DynamicUser at runtime, which currently requires copying the files into the matrix service state directory. Fixing this might require breaking changes. Thus the module should not be included in a stable release. --- nixos/modules/module-list.nix | 1 - nixos/modules/services/misc/dendrite.nix | 181 ----------------------- nixos/tests/all-tests.nix | 1 - nixos/tests/dendrite.nix | 99 ------------- pkgs/servers/dendrite/default.nix | 4 - 5 files changed, 286 deletions(-) delete mode 100644 nixos/modules/services/misc/dendrite.nix delete mode 100644 nixos/tests/dendrite.nix diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix index aa4e2ccc46b..7a0a90f4bd2 100644 --- a/nixos/modules/module-list.nix +++ b/nixos/modules/module-list.nix @@ -472,7 +472,6 @@ ./services/misc/cgminer.nix ./services/misc/confd.nix ./services/misc/couchpotato.nix - ./services/misc/dendrite.nix ./services/misc/devmon.nix ./services/misc/dictd.nix ./services/misc/duckling.nix diff --git a/nixos/modules/services/misc/dendrite.nix b/nixos/modules/services/misc/dendrite.nix deleted file mode 100644 index c967fc3a362..00000000000 --- a/nixos/modules/services/misc/dendrite.nix +++ /dev/null @@ -1,181 +0,0 @@ -{ config, lib, pkgs, ... }: -let - cfg = config.services.dendrite; - settingsFormat = pkgs.formats.yaml { }; - configurationYaml = settingsFormat.generate "dendrite.yaml" cfg.settings; - workingDir = "/var/lib/dendrite"; -in -{ - options.services.dendrite = { - enable = lib.mkEnableOption "matrix.org dendrite"; - httpPort = lib.mkOption { - type = lib.types.nullOr lib.types.port; - default = 8008; - description = '' - The port to listen for HTTP requests on. - ''; - }; - httpsPort = lib.mkOption { - type = lib.types.nullOr lib.types.port; - default = null; - description = '' - The port to listen for HTTPS requests on. - ''; - }; - tlsCert = lib.mkOption { - type = lib.types.nullOr lib.types.path; - example = "/var/lib/dendrite/server.cert"; - default = null; - description = '' - The path to the TLS certificate. - - - nix-shell -p dendrite --command "generate-keys --tls-cert server.crt --tls-key server.key" - - ''; - }; - tlsKey = lib.mkOption { - type = lib.types.nullOr lib.types.path; - example = "/var/lib/dendrite/server.key"; - default = null; - description = '' - The path to the TLS key. - - - nix-shell -p dendrite --command "generate-keys --tls-cert server.crt --tls-key server.key" - - ''; - }; - environmentFile = lib.mkOption { - type = lib.types.nullOr lib.types.path; - example = "/var/lib/dendrite/registration_secret"; - default = null; - description = '' - Environment file as defined in - systemd.exec5 - . - Secrets may be passed to the service without adding them to the world-readable - Nix store, by specifying placeholder variables as the option value in Nix and - setting these variables accordingly in the environment file. Currently only used - for the registration secret to allow secure registration when - client_api.registration_disabled is true. - - - # snippet of dendrite-related config - services.dendrite.settings.client_api.registration_shared_secret = "$REGISTRATION_SHARED_SECRET"; - - - - # content of the environment file - REGISTRATION_SHARED_SECRET=verysecretpassword - - - Note that this file needs to be available on the host on which - dendrite is running. - ''; - }; - settings = lib.mkOption { - type = lib.types.submodule { - freeformType = settingsFormat.type; - options.global = { - server_name = lib.mkOption { - type = lib.types.str; - example = "example.com"; - description = '' - The domain name of the server, with optional explicit port. - This is used by remote servers to connect to this server. - This is also the last part of your UserID. - ''; - }; - private_key = lib.mkOption { - type = lib.types.path; - example = "${workingDir}/matrix_key.pem"; - description = '' - The path to the signing private key file, used to sign - requests and events. - - - nix-shell -p dendrite --command "generate-keys --private-key matrix_key.pem" - - ''; - }; - trusted_third_party_id_servers = lib.mkOption { - type = lib.types.listOf lib.types.str; - example = [ "matrix.org" ]; - default = [ "matrix.org" "vector.im" ]; - description = '' - Lists of domains that the server will trust as identity - servers to verify third party identifiers such as phone - numbers and email addresses - ''; - }; - }; - options.client_api = { - registration_disabled = lib.mkOption { - type = lib.types.bool; - default = true; - description = '' - Whether to disable user registration to the server - without the shared secret. - ''; - }; - }; - }; - default = { }; - description = '' - Configuration for dendrite, see: - - for available options with which to populate settings. - ''; - }; - }; - - config = lib.mkIf cfg.enable { - assertions = [{ - assertion = cfg.httpsPort != null -> (cfg.tlsCert != null && cfg.tlsKey != null); - message = '' - If Dendrite is configured to use https, tlsCert and tlsKey must be provided. - - nix-shell -p dendrite --command "generate-keys --tls-cert server.crt --tls-key server.key" - ''; - }]; - - systemd.services.dendrite = { - description = "Dendrite Matrix homeserver"; - after = [ - "network.target" - ]; - wantedBy = [ "multi-user.target" ]; - serviceConfig = { - Type = "simple"; - DynamicUser = true; - StateDirectory = "dendrite"; - WorkingDirectory = workingDir; - RuntimeDirectory = "dendrite"; - RuntimeDirectoryMode = "0700"; - EnvironmentFile = lib.mkIf (cfg.environmentFile != null) cfg.environmentFile; - ExecStartPre = - if (cfg.environmentFile != null) then '' - ${pkgs.envsubst}/bin/envsubst \ - -i ${configurationYaml} \ - -o /run/dendrite/dendrite.yaml - '' else '' - ${pkgs.coreutils}/bin/cp ${configurationYaml} /run/dendrite/dendrite.yaml - ''; - ExecStart = lib.strings.concatStringsSep " " ([ - "${pkgs.dendrite}/bin/dendrite-monolith-server" - "--config /run/dendrite/dendrite.yaml" - ] ++ lib.optionals (cfg.httpPort != null) [ - "--http-bind-address :${builtins.toString cfg.httpPort}" - ] ++ lib.optionals (cfg.httpsPort != null) [ - "--https-bind-address :${builtins.toString cfg.httpsPort}" - "--tls-cert ${cfg.tlsCert}" - "--tls-key ${cfg.tlsKey}" - ]); - ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID"; - Restart = "on-failure"; - }; - }; - }; - meta.maintainers = lib.teams.matrix.members; -} diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix index 99393e5b184..032bcf949e7 100644 --- a/nixos/tests/all-tests.nix +++ b/nixos/tests/all-tests.nix @@ -93,7 +93,6 @@ in custom-ca = handleTest ./custom-ca.nix {}; croc = handleTest ./croc.nix {}; deluge = handleTest ./deluge.nix {}; - dendrite = handleTest ./dendrite.nix {}; dhparams = handleTest ./dhparams.nix {}; discourse = handleTest ./discourse.nix {}; dnscrypt-proxy2 = handleTestOn ["x86_64-linux"] ./dnscrypt-proxy2.nix {}; diff --git a/nixos/tests/dendrite.nix b/nixos/tests/dendrite.nix deleted file mode 100644 index a444c9b2001..00000000000 --- a/nixos/tests/dendrite.nix +++ /dev/null @@ -1,99 +0,0 @@ -import ./make-test-python.nix ( - { pkgs, ... }: - let - homeserverUrl = "http://homeserver:8008"; - - private_key = pkgs.runCommand "matrix_key.pem" { - buildInputs = [ pkgs.dendrite ]; - } "generate-keys --private-key $out"; - in - { - name = "dendrite"; - meta = with pkgs.lib; { - maintainers = teams.matrix.members; - }; - - nodes = { - homeserver = { pkgs, ... }: { - services.dendrite = { - enable = true; - settings = { - global.server_name = "test-dendrite-server.com"; - global.private_key = private_key; - client_api.registration_disabled = false; - }; - }; - - networking.firewall.allowedTCPPorts = [ 8008 ]; - }; - - client = { pkgs, ... }: { - environment.systemPackages = [ - ( - pkgs.writers.writePython3Bin "do_test" - { libraries = [ pkgs.python3Packages.matrix-nio ]; } '' - import asyncio - - from nio import AsyncClient - - - async def main() -> None: - # Connect to dendrite - client = AsyncClient("http://homeserver:8008", "alice") - - # Register as user alice - response = await client.register("alice", "my-secret-password") - - # Log in as user alice - response = await client.login("my-secret-password") - - # Create a new room - response = await client.room_create(federate=False) - room_id = response.room_id - - # Join the room - response = await client.join(room_id) - - # Send a message to the room - response = await client.room_send( - room_id=room_id, - message_type="m.room.message", - content={ - "msgtype": "m.text", - "body": "Hello world!" - } - ) - - # Sync responses - response = await client.sync(timeout=30000) - - # Check the message was received by dendrite - last_message = response.rooms.join[room_id].timeline.events[-1].body - assert last_message == "Hello world!" - - # Leave the room - response = await client.room_leave(room_id) - - # Close the client - await client.close() - - asyncio.get_event_loop().run_until_complete(main()) - '' - ) - ]; - }; - }; - - testScript = '' - start_all() - - with subtest("start the homeserver"): - homeserver.wait_for_unit("dendrite.service") - homeserver.wait_for_open_port(8008) - - with subtest("ensure messages can be exchanged"): - client.succeed("do_test") - ''; - - } -) diff --git a/pkgs/servers/dendrite/default.nix b/pkgs/servers/dendrite/default.nix index 5f070aa398c..529cc49c07d 100644 --- a/pkgs/servers/dendrite/default.nix +++ b/pkgs/servers/dendrite/default.nix @@ -13,10 +13,6 @@ buildGoModule rec { vendorSha256 = "1l1wydvi0yalas79cvhrqg563cvs57hg9rv6qnkw879r6smb2x1n"; - passthru.tests = { - inherit (nixosTests) dendrite; - }; - meta = with lib; { homepage = "https://matrix.org"; description = "Dendrite is a second-generation Matrix homeserver written in Go!";