This repository has no description
3.0 kB
90 lines
1{
2 self,
3 config,
4 pkgs,
5 ...
6}:
7{
8 # mautrix-telegram is the Python (Telethon) bridge and pulls in python-olm
9 # → libolm 3.2.16, which nixpkgs marks insecure. The Go-based v2 bridges
10 # (signal/whatsapp) avoid this via withGoolm; Python has no equivalent, so
11 # secureify olm via overlay. Avoids nixpkgs.config.permittedInsecurePackages
12 # which doesn't list-merge across modules.
13 nixpkgs.overlays = [
14 (_final: prev: {
15 olm = self.lib.secureify prev.olm;
16 })
17 ];
18
19 services.mautrix-telegram = {
20 enable = true;
21 registerToSynapse = true;
22 # api_id / api_hash supplied via env (MAUTRIX_TELEGRAM_TELEGRAM_API_ID,
23 # MAUTRIX_TELEGRAM_TELEGRAM_API_HASH) so they never enter the nix store
24 environmentFile = config.clan.core.vars.generators.mautrix-telegram.files.env.path;
25 settings = {
26 homeserver = {
27 address = "http://[::1]:8008";
28 domain = "lassul.us";
29 };
30 appservice = {
31 address = "http://127.0.0.1:29317";
32 hostname = "127.0.0.1";
33 port = 29317;
34 database = "postgres:///mautrix-telegram?host=/run/postgresql";
35 id = "telegram";
36 bot_username = "telegrambot";
37 ephemeral_events = true;
38 };
39 # mautrix-telegram is the legacy Python (Telethon) bridge — config schema
40 # is the pre-bridgev2 one, so everything bridge-related lives under
41 # `bridge:`, not split into network/matrix/encryption like the v2 bridges.
42 bridge = {
43 username_template = "telegram_{userid}";
44 alias_template = "telegram_{groupname}";
45 displayname_template = "{displayname} (TG)";
46 delivery_receipts = false;
47 message_status_events = false;
48 encryption = {
49 allow = false;
50 default = false;
51 require = false;
52 };
53 permissions = {
54 "lassul.us" = "full";
55 "@lassulus:lassul.us" = "admin";
56 };
57 };
58 };
59 };
60
61 services.postgresql = {
62 ensureDatabases = [ "mautrix-telegram" ];
63 ensureUsers = [
64 {
65 name = "mautrix-telegram";
66 ensureDBOwnership = true;
67 }
68 ];
69 };
70
71 # portal mappings, sessions, tokens: losing them means relogin and every
72 # existing Matrix room orphaned
73 lass.backup.state.mautrix-telegram.preBackup = ''
74 mkdir -p /var/backup/postgresql
75 ${pkgs.sudo}/bin/sudo -u postgres ${config.services.postgresql.package}/bin/pg_dump \
76 mautrix-telegram | ${pkgs.gzip}/bin/gzip > /var/backup/postgresql/mautrix-telegram.sql.gz
77 '';
78
79 clan.core.vars.generators.mautrix-telegram = {
80 files.env = { };
81 prompts.api_id.description = "Telegram api_id from https://my.telegram.org/apps";
82 prompts.api_hash.description = "Telegram api_hash from https://my.telegram.org/apps";
83 script = ''
84 {
85 printf 'MAUTRIX_TELEGRAM_TELEGRAM_API_ID=%s\n' "$(cat "$prompts/api_id")"
86 printf 'MAUTRIX_TELEGRAM_TELEGRAM_API_HASH=%s\n' "$(cat "$prompts/api_hash")"
87 } > "$out/env"
88 '';
89 };
90}