This repository has no description
2configs.services.matrix.bridges.mautrix-telegram: add
author
lassulus
date
(May 1, 2026, 11:16 AM CEST)
commit
452b3578
452b3578bf5ec58d2220b7dd285924f7e2e60e25
parent
997510af
997510af686cffcbb721246e7f642a65a400276c
+78
+1
machines/neoprism/config.nix
+1
machines/neoprism/config.nix
···
18
18
../../2configs/services/matrix/bridges/mautrix-whatsapp.nix
19
19
../../2configs/services/matrix/bridges/mautrix-signal.nix
20
20
../../2configs/services/matrix/bridges/heisenbridge.nix
21
+
../../2configs/services/matrix/bridges/mautrix-telegram.nix
21
22
22
23
../../2configs/services/pad
23
24
+77
2configs/services/matrix/bridges/mautrix-telegram.nix
+77
2configs/services/matrix/bridges/mautrix-telegram.nix
···
1
+
{ self, config, ... }:
2
+
{
3
+
# mautrix-telegram is the Python (Telethon) bridge and pulls in python-olm
4
+
# → libolm 3.2.16, which nixpkgs marks insecure. The Go-based v2 bridges
5
+
# (signal/whatsapp) avoid this via withGoolm; Python has no equivalent, so
6
+
# secureify olm via overlay. Avoids nixpkgs.config.permittedInsecurePackages
7
+
# which doesn't list-merge across modules.
8
+
nixpkgs.overlays = [
9
+
(_final: prev: {
10
+
olm = self.lib.secureify prev.olm;
11
+
})
12
+
];
13
+
14
+
services.mautrix-telegram = {
15
+
enable = true;
16
+
registerToSynapse = true;
17
+
# api_id / api_hash supplied via env (MAUTRIX_TELEGRAM_TELEGRAM_API_ID,
18
+
# MAUTRIX_TELEGRAM_TELEGRAM_API_HASH) so they never enter the nix store
19
+
environmentFile = config.clan.core.vars.generators.mautrix-telegram.files.env.path;
20
+
settings = {
21
+
homeserver = {
22
+
address = "http://[::1]:8008";
23
+
domain = "lassul.us";
24
+
};
25
+
appservice = {
26
+
address = "http://127.0.0.1:29317";
27
+
hostname = "127.0.0.1";
28
+
port = 29317;
29
+
database = "postgres:///mautrix-telegram?host=/run/postgresql";
30
+
id = "telegram";
31
+
bot_username = "telegrambot";
32
+
ephemeral_events = true;
33
+
};
34
+
# mautrix-telegram is the legacy Python (Telethon) bridge — config schema
35
+
# is the pre-bridgev2 one, so everything bridge-related lives under
36
+
# `bridge:`, not split into network/matrix/encryption like the v2 bridges.
37
+
bridge = {
38
+
username_template = "telegram_{userid}";
39
+
alias_template = "telegram_{groupname}";
40
+
displayname_template = "{displayname} (TG)";
41
+
delivery_receipts = false;
42
+
message_status_events = false;
43
+
encryption = {
44
+
allow = false;
45
+
default = false;
46
+
require = false;
47
+
};
48
+
permissions = {
49
+
"lassul.us" = "full";
50
+
"@lassulus:lassul.us" = "admin";
51
+
};
52
+
};
53
+
};
54
+
};
55
+
56
+
services.postgresql = {
57
+
ensureDatabases = [ "mautrix-telegram" ];
58
+
ensureUsers = [
59
+
{
60
+
name = "mautrix-telegram";
61
+
ensureDBOwnership = true;
62
+
}
63
+
];
64
+
};
65
+
66
+
clan.core.vars.generators.mautrix-telegram = {
67
+
files.env = { };
68
+
prompts.api_id.description = "Telegram api_id from https://my.telegram.org/apps";
69
+
prompts.api_hash.description = "Telegram api_hash from https://my.telegram.org/apps";
70
+
script = ''
71
+
{
72
+
printf 'MAUTRIX_TELEGRAM_TELEGRAM_API_ID=%s\n' "$(cat "$prompts/api_id")"
73
+
printf 'MAUTRIX_TELEGRAM_TELEGRAM_API_HASH=%s\n' "$(cat "$prompts/api_hash")"
74
+
} > "$out/env"
75
+
'';
76
+
};
77
+
}