flake.lock: Update

Flake lock file updates: • Updated input 'determinate': 'https://api.flakehub.com/f/pinned/DeterminateSystems/determinate/3.21.0/019e5103-0940-7a50-bac6-f1c621bf31ff/source.tar.gz' (2026-05-22) → 'https://api.flakehub.com/f/pinned/DeterminateSystems/determinate/3.21.1/019ea867-5568-7d03-9579-e943ed6d4cef/source.tar.gz' (2026-06-08) • Updated input 'determinate/determinate-nixd-aarch64-darwin': 'https://install.determinate.systems/determinate-nixd/tag/v3.21.0/macOS' → 'https://install.determinate.systems/determinate-nixd/tag/v3.21.1/macOS' • Updated input 'determinate/determinate-nixd-aarch64-linux': 'https://install.determinate.systems/determinate-nixd/tag/v3.21.0/aarch64-linux' → 'https://install.determinate.systems/determinate-nixd/tag/v3.21.1/aarch64-linux' • Updated input 'determinate/determinate-nixd-x86_64-linux': 'https://install.determinate.systems/determinate-nixd/tag/v3.21.0/x86_64-linux' → 'https://install.determinate.systems/determinate-nixd/tag/v3.21.1/x86_64-linux' • Updated input 'determinate/nix': 'https://api.flakehub.com/f/pinned/DeterminateSystems/nix-src/3.21.0/019e50fb-8633-73d0-b673-b2e265950490/source.tar.gz' (2026-05-22) → 'https://api.flakehub.com/f/pinned/DeterminateSystems/nix-src/3.21.1/019ea860-2acd-7680-ae61-10f9574b2694/source.tar.gz' (2026-06-08) • Updated input 'determinate/nixpkgs': 'https://api.flakehub.com/f/pinned/DeterminateSystems/nixpkgs-weekly/0.1.998534%2Brev-d233902339c02a9c334e7e593de68855ad26c4cb/019e3efc-e09a-7ff1-b05f-0c8f85ba7441/source.tar.gz' (2026-05-15) → 'https://api.flakehub.com/f/pinned/DeterminateSystems/nixpkgs-weekly/0.1.1008784%2Brev-4df1b885d76a54e1aa1a318f8d16fd6005b6401f/019e8725-c925-7ec1-8f35-3f9effcf169a/source.tar.gz' (2026-06-01) • Updated input 'nixos-hardware': 'github:NixOS/nixos-hardware/4ed851c' (2026-06-01) → 'github:NixOS/nixos-hardware/32c2cd9' (2026-06-09) • Updated input 'nixpkgs': 'github:NixOS/nixpkgs/9b69646' (2026-06-06) → 'github:NixOS/nixpkgs/bd0ff2d' (2026-06-08)
flake.lock: Update
2026-06-11 00:44:26 +02:00 · 2026-06-08 15:48:55 +02:00 · 2026-06-02 15:23:29 +02:00 · 2026-06-02 15:23:29 +02:00 · 2026-06-02 15:23:29 +02:00
11 changed files with 136 additions and 116 deletions
@@ -173,18 +173,10 @@ with pkgs;
      group = "users";
    };
    # HACK The owner and group is set by systemd due to the use of DynamicUser
-    secrets.dendrite = {
-      file = secrets/dendrite.age;
-      owner = "63026";
-      group = "63026";
-    };
-    secrets.dendrite-postgres = {
-      file = secrets/dendrite-postgres.age;
-      owner = "63026";
-      group = "63026";
-    };
    secrets.telegram = {
      file = secrets/telegram.age;
+      owner = "mautrix-telegram";
+      group = "mautrix-telegram";
    };
    secrets.mqtt-sender = {
      file = secrets/mqtt-sender.age;
@@ -198,9 +190,14 @@ with pkgs;
    };
    secrets.facebook = {
      file = secrets/facebook.age;
+      owner = "mautrix-meta-facebook";
+      group = "mautrix-meta-facebook";
+
    };
    secrets.signal = {
      file = secrets/signal.age;
+      owner = "mautrix-signal";
+      group = "mautrix-signal";
    };
    secrets.inadyn-duckdns = {
      file = secrets/inadyn-duckdns.age;
@@ -54,12 +54,12 @@
        "nixpkgs": "nixpkgs_2"
      },
      "locked": {
-        "lastModified": 1779475417,
-        "narHash": "sha256-7/U/+X66C7XmLnt5JVJVtpx8wVDRU//Awaeqkq9+NNc=",
-        "rev": "8a9c57ea6b458a40589df60f26200b7d305354d1",
-        "revCount": 417,
+        "lastModified": 1780941588,
+        "narHash": "sha256-cXxaBtTSYEYVtSxw4IH0hPa+p+VFxS0i+66GwxVFk7o=",
+        "rev": "70c28bcdd4dde10d04f39e7accb5738a1f5d5298",
+        "revCount": 421,
        "type": "tarball",
-        "url": "https://api.flakehub.com/f/pinned/DeterminateSystems/determinate/3.21.0/019e5103-0940-7a50-bac6-f1c621bf31ff/source.tar.gz"
+        "url": "https://api.flakehub.com/f/pinned/DeterminateSystems/determinate/3.21.1/019ea867-5568-7d03-9579-e943ed6d4cef/source.tar.gz"
      },
      "original": {
        "type": "tarball",
@@ -69,37 +69,37 @@
    "determinate-nixd-aarch64-darwin": {
      "flake": false,
      "locked": {
-        "narHash": "sha256-LNvx0qZsH8tbdgNfaig/x5Cf4r4UrXfU1m+0bO3D0E4=",
+        "narHash": "sha256-ctwRrPKWBSFkTqlCHRGz6MHBSWRkbSAEVGoelsxdr2g=",
        "type": "file",
-        "url": "https://install.determinate.systems/determinate-nixd/tag/v3.21.0/macOS"
+        "url": "https://install.determinate.systems/determinate-nixd/tag/v3.21.1/macOS"
      },
      "original": {
        "type": "file",
-        "url": "https://install.determinate.systems/determinate-nixd/tag/v3.21.0/macOS"
+        "url": "https://install.determinate.systems/determinate-nixd/tag/v3.21.1/macOS"
      }
    },
    "determinate-nixd-aarch64-linux": {
      "flake": false,
      "locked": {
-        "narHash": "sha256-rKg7uVAEK8X3TTFGaWp8CVZuCAr3wHkMnuJOndhXJF0=",
+        "narHash": "sha256-qYFrMN6lSMRYV87D/uK5L2CUBvOpoLZAAfSYXvcp9cc=",
        "type": "file",
-        "url": "https://install.determinate.systems/determinate-nixd/tag/v3.21.0/aarch64-linux"
+        "url": "https://install.determinate.systems/determinate-nixd/tag/v3.21.1/aarch64-linux"
      },
      "original": {
        "type": "file",
-        "url": "https://install.determinate.systems/determinate-nixd/tag/v3.21.0/aarch64-linux"
+        "url": "https://install.determinate.systems/determinate-nixd/tag/v3.21.1/aarch64-linux"
      }
    },
    "determinate-nixd-x86_64-linux": {
      "flake": false,
      "locked": {
-        "narHash": "sha256-vBCUEVPfY4+nxGDM62evpxJYEVqLTqdBGbCkmZ2sQhk=",
+        "narHash": "sha256-BxzPf6fT1ekyvD5JA0vvDJOTPtIyjrzVg3Puuo0ftbg=",
        "type": "file",
-        "url": "https://install.determinate.systems/determinate-nixd/tag/v3.21.0/x86_64-linux"
+        "url": "https://install.determinate.systems/determinate-nixd/tag/v3.21.1/x86_64-linux"
      },
      "original": {
        "type": "file",
-        "url": "https://install.determinate.systems/determinate-nixd/tag/v3.21.0/x86_64-linux"
+        "url": "https://install.determinate.systems/determinate-nixd/tag/v3.21.1/x86_64-linux"
      }
    },
    "flake-compat": {
@@ -195,12 +195,12 @@
        "nixpkgs-regression": "nixpkgs-regression"
      },
      "locked": {
-        "lastModified": 1779472733,
-        "narHash": "sha256-nV5OHwivEf392cB5MDwoVdDHSvy6Q+rRYZBHd9sePj4=",
-        "rev": "11f3aff904f84ae612e36e8bc578ac421fca74fa",
-        "revCount": 25967,
+        "lastModified": 1780939209,
+        "narHash": "sha256-/JuW5C6sWuC836Y9b7hga3ZvhRiY4k4Zs73RRg5KVWM=",
+        "rev": "952beffe9c45ed245d30209d4f17cf1d26654a2a",
+        "revCount": 26044,
        "type": "tarball",
-        "url": "https://api.flakehub.com/f/pinned/DeterminateSystems/nix-src/3.21.0/019e50fb-8633-73d0-b673-b2e265950490/source.tar.gz"
+        "url": "https://api.flakehub.com/f/pinned/DeterminateSystems/nix-src/3.21.1/019ea860-2acd-7680-ae61-10f9574b2694/source.tar.gz"
      },
      "original": {
        "type": "tarball",
@@ -212,11 +212,11 @@
        "nixpkgs": "nixpkgs_3"
      },
      "locked": {
-        "lastModified": 1780065812,
-        "narHash": "sha256-SCSLUKBmwlSLGQ8Xbr8PjRFtiHNk0l9ktqkcmqdBkfE=",
+        "lastModified": 1781020964,
+        "narHash": "sha256-fS7xTi2j2iso5Hj7RNZLv/acDlCT+fgMVkVk40A7Uco=",
        "owner": "NixOS",
        "repo": "nixos-hardware",
-        "rev": "b76b5639c0593e0aeb0b5879ad62d4b30596c144",
+        "rev": "32c2cd9e46286c4eced3dc6b613c659126bf3cca",
        "type": "github"
      },
      "original": {
@@ -274,12 +274,12 @@
    },
    "nixpkgs_2": {
      "locked": {
-        "lastModified": 1778869304,
-        "narHash": "sha256-30sZNZoA1cqF5JNO9fVX+wgiQYjB7HJqqJ4ztCDeBZE=",
-        "rev": "d233902339c02a9c334e7e593de68855ad26c4cb",
-        "revCount": 998534,
+        "lastModified": 1780336545,
+        "narHash": "sha256-vhVhuXzFrIOfcssC/9hDHx7MHzDKjF3keHuREOQqQiQ=",
+        "rev": "4df1b885d76a54e1aa1a318f8d16fd6005b6401f",
+        "revCount": 1008784,
        "type": "tarball",
-        "url": "https://api.flakehub.com/f/pinned/DeterminateSystems/nixpkgs-weekly/0.1.998534%2Brev-d233902339c02a9c334e7e593de68855ad26c4cb/019e3efc-e09a-7ff1-b05f-0c8f85ba7441/source.tar.gz"
+        "url": "https://api.flakehub.com/f/pinned/DeterminateSystems/nixpkgs-weekly/0.1.1008784%2Brev-4df1b885d76a54e1aa1a318f8d16fd6005b6401f/019e8725-c925-7ec1-8f35-3f9effcf169a/source.tar.gz"
      },
      "original": {
        "type": "tarball",
@@ -301,11 +301,11 @@
    },
    "nixpkgs_4": {
      "locked": {
-        "lastModified": 1780051219,
-        "narHash": "sha256-WnxzG4x47uCgjz+uD+vOzbF+Qid+hKyYdJWbduA9w7g=",
+        "lastModified": 1780902259,
+        "narHash": "sha256-q8yYEC5f1mFlQO9RGna4LTc9QrcvWunX6FYp83munkQ=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "e8e446a361172fe838243958325845d0b845c5e5",
+        "rev": "bd0ff2d3eac24699c3664d5966b9ef36f388e2ca",
        "type": "github"
      },
      "original": {
@@ -16,10 +16,6 @@
      inputs.nixpkgs.follows = "nixpkgs";
    };
    nixos-hardware.url = "github:NixOS/nixos-hardware/master";
-    nix-matrix-appservices = {
-      url = "gitlab:coffeetables/nix-matrix-appservices";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
  };

  outputs =
@@ -7,71 +7,92 @@

 with pkgs;

-# NOTE Reference the environment variable set in the corresponding agenix secret
-let
-  database = {
-    connection_string = "$DB_STRING";
-    max_open_conns = 100;
-    max_idle_conns = 5;
-    conn_max_lifetime = -1;
-  };
-
-in
 {
  # Matrix server configuration
-  services.dendrite = {
+  services.matrix-continuwuity = {
    enable = true;
-    httpPort = 8008;
-    environmentFile = config.age.secrets.dendrite-postgres.path;
-    loadCredential = [ "private_key:${config.age.secrets.dendrite.path}" ];
    settings = {
      global = {
-        server_name = "coolneng.duckdns.org";
-        private_key = config.age.secrets.dendrite.path;
-        inherit database;
-        dns_cache.enabled = true;
-      };
-      # HACK Inherit postgres connection string for the rest of the DBs
-      app_service_api = {
-        inherit database;
-      };
-      media_api = {
-        inherit database;
-      };
-      room_server = {
-        inherit database;
-      };
-      push_server = {
-        inherit database;
-      };
-      mscs = {
-        inherit database;
-        mscs = [
-          "msc2836"
-          "msc2946"
-        ];
-      };
-      sync_api = {
-        inherit database;
-      };
-      key_server = {
-        inherit database;
-      };
-      federation_api = {
-        inherit database;
-      };
-      user_api = {
-        account_database = database;
-        device_database = database;
+        server_name = "psydnd.org";
+        port = [ 8008 ];
+        allow_encryption = true;
+        allow_federation = true;
+        well_known.client = "https://matrix.psydnd.org";
      };
    };
  };

+  ## Matrix bridges
+  # Facebook
+  services.mautrix-meta.instances.facebook = {
+    enable = true;
+    environmentFile = config.age.secrets.facebook.path;
+    settings = {
+      homeserver = {
+        address = "https://matrix.psysdnd.org";
+        domain = "psydnd.org";
+      };
+      appservice = {
+        address = "http://localhost:8228";
+        port = 8228;
+        database = "$DB_STRING";
+      };
+      bridge.permissions."@coolneng:psydnd.org" = "admin";
+    };
+    serviceDependencies = [ "continuwuity.service" ];
+  };
+
+  # Enable voice messages for Facebook
+  systemd.services.matrix-as-facebook.path = [ ffmpeg ];
+
+  # Telegram
+  services.mautrix-telegram = {
+    enable = true;
+    environmentFile = config.age.secrets.telegram.path;
+    settings = {
+      homeserver = {
+        address = "https://matrix.psysdnd.org";
+        domain = "psydnd.org";
+      };
+      appservice = {
+        address = "http://localhost:8118";
+        port = 8118;
+        database = "$DB_STRING";
+      };
+      bridge.permissions."@coolneng:psydnd.org" = "admin";
+    };
+    serviceDependencies = [ "continuwuity.service" ];
+  };
+
+  # Signal
+  services.mautrix-signal = {
+    enable = true;
+    environmentFile = config.age.secrets.signal.path;
+    settings = {
+      homeserver = {
+        address = "https://matrix.psysdnd.org";
+        domain = "psydnd.org";
+      };
+      appservice = {
+        address = "http://localhost:8338";
+        port = 8338;
+        database = "$DB_STRING";
+      };
+      bridge.permissions."@coolneng:psydnd.org" = "admin";
+    };
+    serviceDependencies = [ "continuwuity.service" ];
+  };
+
+  # HACK Use libolm as there's no good alternative
+  nixpkgs.config.permittedInsecurePackages = [
+    "olm-3.2.16"
+  ];
+
  # Start dendrite after config files are mounted
-  systemd.services.dendrite.unitConfig.RequiresMountsFor = [
-    /var/lib/matrix-as-facebook
-    /var/lib/matrix-as-signal
-    /var/lib/matrix-as-telegram
+  systemd.services.continuwuity.unitConfig.RequiresMountsFor = [
+    /var/lib/mautrix-meta-facebook
+    /var/lib/mautrix-signal
+    /var/lib/mautrix-telegram
  ];

  # MQTT configuration
@@ -82,10 +82,13 @@ with pkgs;
  # Grafana configuration
  services.grafana = {
    enable = true;
-    settings.server = {
-      domain = "grafana.psydnd.org";
-      http_port = 9009;
-      http_addr = "127.0.0.1";
+    settings = {
+      server = {
+        domain = "grafana.psydnd.org";
+        http_port = 9009;
+        http_addr = "127.0.0.1";
+      };
+      security.secret_key = config.age.secrets.grafana.path;
    };
  };

@@ -34,21 +34,12 @@
      proxy_cookie_path / "/; secure; HttpOnly; SameSite=strict";
    '';
    virtualHosts = {
-      # Old domain being redirected
+      # Redirection of the old domain
      "coolneng.duckdns.org" = {
        useACMEHost = "coolneng.duckdns.org";
        forceSSL = true;
        locations = {
          "/".return = "301 https://psydnd.org$request_uri";
-          # Delegation for Matrix
-          "/.well-known/" = {
-            alias = "${../well-known}" + "/";
-            extraConfig = ''
-              ${config.services.nginx.commonHttpConfig}
-              default_type application/json;
-              add_header Access-Control-Allow-Origin * always;
-            '';
-          };
        };
      };
      # Redirect subdomains
@@ -61,6 +52,15 @@
      "psydnd.org" = {
        useACMEHost = "psydnd.org";
        forceSSL = true;
+        # Delegation for Matrix
+        locations."/.well-known/" = {
+          alias = "${../well-known}" + "/";
+          extraConfig = ''
+            ${config.services.nginx.commonHttpConfig}
+            default_type application/json;
+            add_header Access-Control-Allow-Origin * always;
+          '';
+        };
      };
      "radicale.psydnd.org" = {
        useACMEHost = "psydnd.org";
@@ -24,7 +24,7 @@ services=(
    "radicale.service"
    "miniflux.service"
    "gitea.service"
-    "dendrite.service"
+    "continuwuity.service"
    "nginx.service"
    "dnsmasq.service"
    "dnscrypt-proxy.service"
@@ -0,0 +1,5 @@
+age-encryption.org/v1
+-> ssh-ed25519 iUaRGg Ag32nut/aBlxEy7RPw7sV5itZSHkp8eMLVtxFxwQ8EM
+ZhK8EZWTLkxrwo+x97w4HpexDXkC1yQuKyYFujqlOgs
+--- kszqKtyubreK5mGkrJg4hrEKrfITJCCM/hW6IHKlMIE
+TÚ+À~/ œDbM?Çø×å ½œa-ð'ƒÒp^5ç›?�ï&#!àÏ³‰þ~59O
@@ -8,8 +8,6 @@ in
  "gitea.age".publicKeys = [ zion ];
  "miniflux.age".publicKeys = [ zion ];
  "git.age".publicKeys = [ zion ];
-  "dendrite.age".publicKeys = [ zion ];
-  "dendrite-postgres.age".publicKeys = [ zion ];
  "telegram.age".publicKeys = [ zion ];
  "mqtt-sender.age".publicKeys = [ zion ];
  "mqtt-receiver.age".publicKeys = [ zion ];
Author	SHA1	Message	Date
coolneng	2112a32348	flake.lock: Update Flake lock file updates: • Updated input 'determinate': 'https://api.flakehub.com/f/pinned/DeterminateSystems/determinate/3.21.0/019e5103-0940-7a50-bac6-f1c621bf31ff/source.tar.gz' (2026-05-22) → 'https://api.flakehub.com/f/pinned/DeterminateSystems/determinate/3.21.1/019ea867-5568-7d03-9579-e943ed6d4cef/source.tar.gz' (2026-06-08) • Updated input 'determinate/determinate-nixd-aarch64-darwin': 'https://install.determinate.systems/determinate-nixd/tag/v3.21.0/macOS' → 'https://install.determinate.systems/determinate-nixd/tag/v3.21.1/macOS' • Updated input 'determinate/determinate-nixd-aarch64-linux': 'https://install.determinate.systems/determinate-nixd/tag/v3.21.0/aarch64-linux' → 'https://install.determinate.systems/determinate-nixd/tag/v3.21.1/aarch64-linux' • Updated input 'determinate/determinate-nixd-x86_64-linux': 'https://install.determinate.systems/determinate-nixd/tag/v3.21.0/x86_64-linux' → 'https://install.determinate.systems/determinate-nixd/tag/v3.21.1/x86_64-linux' • Updated input 'determinate/nix': 'https://api.flakehub.com/f/pinned/DeterminateSystems/nix-src/3.21.0/019e50fb-8633-73d0-b673-b2e265950490/source.tar.gz' (2026-05-22) → 'https://api.flakehub.com/f/pinned/DeterminateSystems/nix-src/3.21.1/019ea860-2acd-7680-ae61-10f9574b2694/source.tar.gz' (2026-06-08) • Updated input 'determinate/nixpkgs': 'https://api.flakehub.com/f/pinned/DeterminateSystems/nixpkgs-weekly/0.1.998534%2Brev-d233902339c02a9c334e7e593de68855ad26c4cb/019e3efc-e09a-7ff1-b05f-0c8f85ba7441/source.tar.gz' (2026-05-15) → 'https://api.flakehub.com/f/pinned/DeterminateSystems/nixpkgs-weekly/0.1.1008784%2Brev-4df1b885d76a54e1aa1a318f8d16fd6005b6401f/019e8725-c925-7ec1-8f35-3f9effcf169a/source.tar.gz' (2026-06-01) • Updated input 'nixos-hardware': 'github:NixOS/nixos-hardware/4ed851c' (2026-06-01) → 'github:NixOS/nixos-hardware/32c2cd9' (2026-06-09) • Updated input 'nixpkgs': 'github:NixOS/nixpkgs/9b69646' (2026-06-06) → 'github:NixOS/nixpkgs/bd0ff2d' (2026-06-08)	2026-06-11 00:44:26 +02:00
coolneng	299e332a83	flake.lock: Update Flake lock file updates: • Updated input 'nixos-hardware': 'github:NixOS/nixos-hardware/b76b563' (2026-05-29) → 'github:NixOS/nixos-hardware/4ed851c' (2026-06-01) • Updated input 'nixpkgs': 'github:NixOS/nixpkgs/e8e446a' (2026-05-29) → 'github:NixOS/nixpkgs/9b69646' (2026-06-06)	2026-06-08 15:48:55 +02:00
coolneng	488969abd7	Move well-known delegation to main domain	2026-06-02 15:23:29 +02:00
coolneng	4cd14c0838	Replace dendrite with continuwuity	2026-06-02 15:23:29 +02:00
coolneng	7544f6d121	Upgrade to NixOS 26.05	2026-06-02 15:23:29 +02:00