Upgrade to NixOS 26.05

configuration.nix

@@ -173,10 +173,18 @@ with pkgs;
       group = "users";
     };
     # HACK The owner and group is set by systemd due to the use of DynamicUser
+    secrets.dendrite = {
+      file = secrets/dendrite.age;
+      owner = "63026";
+      group = "63026";
+    };
+    secrets.dendrite-postgres = {
+      file = secrets/dendrite-postgres.age;
+      owner = "63026";
+      group = "63026";
+    };
     secrets.telegram = {
       file = secrets/telegram.age;
-      owner = "mautrix-telegram";
-      group = "mautrix-telegram";
     };
     secrets.mqtt-sender = {
       file = secrets/mqtt-sender.age;
@@ -190,14 +198,9 @@ with pkgs;
     };
     secrets.facebook = {
       file = secrets/facebook.age;
-      owner = "mautrix-meta-facebook";
-      group = "mautrix-meta-facebook";
-
     };
     secrets.signal = {
       file = secrets/signal.age;
-      owner = "mautrix-signal";
-      group = "mautrix-signal";
     };
     secrets.inadyn-duckdns = {
       file = secrets/inadyn-duckdns.age;

flake.lock

@@ -54,12 +54,12 @@
         "nixpkgs": "nixpkgs_2"
       },
       "locked": {
-        "lastModified": 1786121778,
+        "lastModified": 1779475417,
-        "narHash": "sha256-KV12+FdIAecrnrS97IYhDUUotvnwYMrB+bXirUMPOdA=",
+        "narHash": "sha256-7/U/+X66C7XmLnt5JVJVtpx8wVDRU//Awaeqkq9+NNc=",
-        "rev": "c5a93225f633faee482cbd0670e5d6dca0edf9de",
+        "rev": "8a9c57ea6b458a40589df60f26200b7d305354d1",
-        "revCount": 431,
+        "revCount": 417,
         "type": "tarball",
-        "url": "https://api.flakehub.com/f/pinned/DeterminateSystems/determinate/3.22.0/019fdd2b-320e-7cf1-8321-a350e90231d9/source.tar.gz"
+        "url": "https://api.flakehub.com/f/pinned/DeterminateSystems/determinate/3.21.0/019e5103-0940-7a50-bac6-f1c621bf31ff/source.tar.gz"
       },
       "original": {
         "type": "tarball",
@@ -69,51 +69,51 @@
     "determinate-nixd-aarch64-darwin": {
       "flake": false,
       "locked": {
-        "narHash": "sha256-MJ6w+0xdY7SGBfk90WzNo9qJAINb7EqywoTUyJf+rbE=",
+        "narHash": "sha256-LNvx0qZsH8tbdgNfaig/x5Cf4r4UrXfU1m+0bO3D0E4=",
         "type": "file",
-        "url": "https://install.determinate.systems/determinate-nixd/tag/v3.22.0/macOS"
+        "url": "https://install.determinate.systems/determinate-nixd/tag/v3.21.0/macOS"
       },
       "original": {
         "type": "file",
-        "url": "https://install.determinate.systems/determinate-nixd/tag/v3.22.0/macOS"
+        "url": "https://install.determinate.systems/determinate-nixd/tag/v3.21.0/macOS"
       }
     },
     "determinate-nixd-aarch64-linux": {
       "flake": false,
       "locked": {
-        "narHash": "sha256-CL1jY3+NauKiMgH52YE1ZxJ2X78XiOcSaAkAQJa03ek=",
+        "narHash": "sha256-rKg7uVAEK8X3TTFGaWp8CVZuCAr3wHkMnuJOndhXJF0=",
         "type": "file",
-        "url": "https://install.determinate.systems/determinate-nixd/tag/v3.22.0/aarch64-linux"
+        "url": "https://install.determinate.systems/determinate-nixd/tag/v3.21.0/aarch64-linux"
       },
       "original": {
         "type": "file",
-        "url": "https://install.determinate.systems/determinate-nixd/tag/v3.22.0/aarch64-linux"
+        "url": "https://install.determinate.systems/determinate-nixd/tag/v3.21.0/aarch64-linux"
       }
     },
     "determinate-nixd-x86_64-linux": {
       "flake": false,
       "locked": {
-        "narHash": "sha256-n2/CLr4NrldpdfNnBzH3jQL3CdAfxDvya1KzM9Hh5Ec=",
+        "narHash": "sha256-vBCUEVPfY4+nxGDM62evpxJYEVqLTqdBGbCkmZ2sQhk=",
         "type": "file",
-        "url": "https://install.determinate.systems/determinate-nixd/tag/v3.22.0/x86_64-linux"
+        "url": "https://install.determinate.systems/determinate-nixd/tag/v3.21.0/x86_64-linux"
       },
       "original": {
         "type": "file",
-        "url": "https://install.determinate.systems/determinate-nixd/tag/v3.22.0/x86_64-linux"
+        "url": "https://install.determinate.systems/determinate-nixd/tag/v3.21.0/x86_64-linux"
       }
     },
     "flake-compat": {
       "flake": false,
       "locked": {
-        "lastModified": 1767039857,
+        "lastModified": 1696426674,
-        "narHash": "sha256-vNpUSpF5Nuw8xvDLj2KCwwksIbjua2LZCqhV1LNRDns=",
+        "narHash": "sha256-kvjfFW7WAETZlt09AgDn1MrtKzP7t90Vf7vypd3OL1U=",
-        "owner": "NixOS",
+        "owner": "edolstra",
         "repo": "flake-compat",
-        "rev": "5edf11c44bc78a0d334f6334cdaf7d60d732daab",
+        "rev": "0f9255e01c2351cc7d116c072cb317785dd33b33",
         "type": "github"
       },
       "original": {
-        "owner": "NixOS",
+        "owner": "edolstra",
         "repo": "flake-compat",
         "type": "github"
       }
@@ -127,12 +127,12 @@
         ]
       },
       "locked": {
-        "lastModified": 1782949081,
+        "lastModified": 1748821116,
-        "narHash": "sha256-vp6Y/Grm98ESt6ceOkWiHWyZRDV3J1RID4w+6NWK9yA=",
+        "narHash": "sha256-F82+gS044J1APL0n4hH50GYdPRv/5JWm34oCJYmVKdE=",
-        "rev": "17c9d6cdfc60c64f4ee8d306f9bc0b4ccb51481e",
+        "rev": "49f0870db23e8c1ca0b5259734a02cd9e1e371a1",
-        "revCount": 480,
+        "revCount": 377,
         "type": "tarball",
-        "url": "https://api.flakehub.com/f/pinned/hercules-ci/flake-parts/0.1.480%2Brev-17c9d6cdfc60c64f4ee8d306f9bc0b4ccb51481e/019f2195-dee5-7233-9747-eca0c27f7406/source.tar.gz"
+        "url": "https://api.flakehub.com/f/pinned/hercules-ci/flake-parts/0.1.377%2Brev-49f0870db23e8c1ca0b5259734a02cd9e1e371a1/01972f28-554a-73f8-91f4-d488cc502f08/source.tar.gz"
       },
       "original": {
         "type": "tarball",
@@ -142,6 +142,10 @@
     "git-hooks-nix": {
       "inputs": {
         "flake-compat": "flake-compat",
+        "gitignore": [
+          "determinate",
+          "nix"
+        ],
         "nixpkgs": [
           "determinate",
           "nix",
@@ -149,12 +153,12 @@
         ]
       },
       "locked": {
-        "lastModified": 1784288435,
+        "lastModified": 1747372754,
-        "narHash": "sha256-ReRHaLgr/uVqdD8afFSn+myXIfpHeOhP0yYe0TJqAA8=",
+        "narHash": "sha256-2Y53NGIX2vxfie1rOW0Qb86vjRZ7ngizoo+bnXU9D9k=",
-        "rev": "43b3c1ab9d40fb1dbb008f451988a91e375825e9",
+        "rev": "80479b6ec16fefd9c1db3ea13aeb038c60530f46",
-        "revCount": 1231,
+        "revCount": 1026,
         "type": "tarball",
-        "url": "https://api.flakehub.com/f/pinned/cachix/git-hooks.nix/0.1.1231%2Brev-43b3c1ab9d40fb1dbb008f451988a91e375825e9/019f7135-8fdf-76f0-b1a1-d2c67e91af8d/source.tar.gz"
+        "url": "https://api.flakehub.com/f/pinned/cachix/git-hooks.nix/0.1.1026%2Brev-80479b6ec16fefd9c1db3ea13aeb038c60530f46/0196d79a-1b35-7b8e-a021-c894fb62163d/source.tar.gz"
       },
       "original": {
         "type": "tarball",
@@ -191,12 +195,12 @@
         "nixpkgs-regression": "nixpkgs-regression"
       },
       "locked": {
-        "lastModified": 1786114274,
+        "lastModified": 1779472733,
-        "narHash": "sha256-Quqthts9sCdYDCelos6cVrlxgJgkGcJNtQmWwFwvPQw=",
+        "narHash": "sha256-nV5OHwivEf392cB5MDwoVdDHSvy6Q+rRYZBHd9sePj4=",
-        "rev": "c9c272f5ab1a99fb149ab2b152bd8cd8d6fa1186",
+        "rev": "11f3aff904f84ae612e36e8bc578ac421fca74fa",
-        "revCount": 27199,
+        "revCount": 25967,
         "type": "tarball",
-        "url": "https://api.flakehub.com/f/pinned/DeterminateSystems/nix-src/3.22.0/019fdd0b-8551-7d43-a627-08af9d70b415/source.tar.gz"
+        "url": "https://api.flakehub.com/f/pinned/DeterminateSystems/nix-src/3.21.0/019e50fb-8633-73d0-b673-b2e265950490/source.tar.gz"
       },
       "original": {
         "type": "tarball",
@@ -208,11 +212,11 @@
         "nixpkgs": "nixpkgs_3"
       },
       "locked": {
-        "lastModified": 1785232496,
+        "lastModified": 1780065812,
-        "narHash": "sha256-65EQYIRRpTdpH8lUiB6Mvo5uBkG60aBIzAJuALfx+O0=",
+        "narHash": "sha256-SCSLUKBmwlSLGQ8Xbr8PjRFtiHNk0l9ktqkcmqdBkfE=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "2e790b0a6be8ec2b76174ac0931b8ff11919ec98",
+        "rev": "b76b5639c0593e0aeb0b5879ad62d4b30596c144",
         "type": "github"
       },
       "original": {
@@ -224,16 +228,16 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1784160687,
+        "lastModified": 1773222311,
-        "narHash": "sha256-iYL/bixrb6FlHFu/gIuBYzq6c6lM5AAXsXNSWXtIgQc=",
+        "narHash": "sha256-BHoB/XpbqoZkVYZCfXJXfkR+GXFqwb/4zbWnOr2cRcU=",
-        "rev": "4382ed2b7a6839d4280a9b386db49cbc5907414d",
+        "rev": "0590cd39f728e129122770c029970378a79d076a",
-        "revCount": 1009383,
+        "revCount": 909248,
         "type": "tarball",
-        "url": "https://api.flakehub.com/f/pinned/NixOS/nixpkgs/0.2605.1009383%2Brev-4382ed2b7a6839d4280a9b386db49cbc5907414d/019f6c11-ad78-7500-a194-d18a5bad0fbe/source.tar.gz"
+        "url": "https://api.flakehub.com/f/pinned/NixOS/nixpkgs/0.2511.909248%2Brev-0590cd39f728e129122770c029970378a79d076a/019ce32b-8ace-7339-b129-cceaa8dd10c6/source.tar.gz"
       },
       "original": {
         "type": "tarball",
-        "url": "https://flakehub.com/f/NixOS/nixpkgs/0.2605"
+        "url": "https://flakehub.com/f/NixOS/nixpkgs/0.2511"
       }
     },
     "nixpkgs-23-11": {
@@ -270,12 +274,12 @@
     },
     "nixpkgs_2": {
       "locked": {
-        "lastModified": 1785090369,
+        "lastModified": 1778869304,
-        "narHash": "sha256-m0pDuRJG7EDo9ri+4Ksu83VsI+PlxNC9lNBfydejce4=",
+        "narHash": "sha256-30sZNZoA1cqF5JNO9fVX+wgiQYjB7HJqqJ4ztCDeBZE=",
-        "rev": "624af665418d3c65d544145b4d34ad696439570e",
+        "rev": "d233902339c02a9c334e7e593de68855ad26c4cb",
-        "revCount": 1042126,
+        "revCount": 998534,
         "type": "tarball",
-        "url": "https://api.flakehub.com/f/pinned/DeterminateSystems/nixpkgs-weekly/0.1.1042126%2Brev-624af665418d3c65d544145b4d34ad696439570e/019fcb6c-e772-7cb3-baa0-211e12b79e38/source.tar.gz"
+        "url": "https://api.flakehub.com/f/pinned/DeterminateSystems/nixpkgs-weekly/0.1.998534%2Brev-d233902339c02a9c334e7e593de68855ad26c4cb/019e3efc-e09a-7ff1-b05f-0c8f85ba7441/source.tar.gz"
       },
       "original": {
         "type": "tarball",
@@ -297,11 +301,11 @@
     },
     "nixpkgs_4": {
       "locked": {
-        "lastModified": 1785989512,
+        "lastModified": 1780051219,
-        "narHash": "sha256-HFQhkQcl5D1hUNoen3SGHCSFCt2Bg6uP+HgbrnA3InQ=",
+        "narHash": "sha256-WnxzG4x47uCgjz+uD+vOzbF+Qid+hKyYdJWbduA9w7g=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "445d861c6d31b4af0c79d8d4be2331f762a361d7",
+        "rev": "e8e446a361172fe838243958325845d0b845c5e5",
         "type": "github"
       },
       "original": {

flake.nix

@@ -16,6 +16,10 @@
       inputs.nixpkgs.follows = "nixpkgs";
     };
     nixos-hardware.url = "github:NixOS/nixos-hardware/master";
+    nix-matrix-appservices = {
+      url = "gitlab:coffeetables/nix-matrix-appservices";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
   };
 
   outputs =

modules/communication.nix

@@ -7,92 +7,71 @@
 
 with pkgs;
 
+# NOTE Reference the environment variable set in the corresponding agenix secret
+let
+  database = {
+    connection_string = "$DB_STRING";
+    max_open_conns = 100;
+    max_idle_conns = 5;
+    conn_max_lifetime = -1;
+  };
+
+in
 {
   # Matrix server configuration
-  services.matrix-continuwuity = {
+  services.dendrite = {
     enable = true;
+    httpPort = 8008;
+    environmentFile = config.age.secrets.dendrite-postgres.path;
+    loadCredential = [ "private_key:${config.age.secrets.dendrite.path}" ];
     settings = {
       global = {
-        server_name = "psydnd.org";
+        server_name = "coolneng.duckdns.org";
-        port = [ 8008 ];
+        private_key = config.age.secrets.dendrite.path;
-        allow_encryption = true;
+        inherit database;
-        allow_federation = true;
+        dns_cache.enabled = true;
-        well_known.client = "https://matrix.psydnd.org";
       };
+      # HACK Inherit postgres connection string for the rest of the DBs
+      app_service_api = {
+        inherit database;
       };
+      media_api = {
+        inherit database;
       };
-
+      room_server = {
-  ## Matrix bridges
+        inherit database;
-  # Facebook
-  services.mautrix-meta.instances.facebook = {
-    enable = true;
-    environmentFile = config.age.secrets.facebook.path;
-    settings = {
-      homeserver = {
-        address = "https://matrix.psysdnd.org";
-        domain = "psydnd.org";
       };
-      appservice = {
+      push_server = {
-        address = "http://localhost:8228";
+        inherit database;
-        port = 8228;
-        database = "$DB_STRING";
       };
-      bridge.permissions."@coolneng:psydnd.org" = "admin";
+      mscs = {
-    };
+        inherit database;
-    serviceDependencies = [ "continuwuity.service" ];
+        mscs = [
-  };
+          "msc2836"
-
+          "msc2946"
-  # Enable voice messages for Facebook
-  systemd.services.matrix-as-facebook.path = [ ffmpeg ];
-
-  # Telegram
-  services.mautrix-telegram = {
-    enable = true;
-    environmentFile = config.age.secrets.telegram.path;
-    settings = {
-      homeserver = {
-        address = "https://matrix.psysdnd.org";
-        domain = "psydnd.org";
-      };
-      appservice = {
-        address = "http://localhost:8118";
-        port = 8118;
-        database = "$DB_STRING";
-      };
-      bridge.permissions."@coolneng:psydnd.org" = "admin";
-    };
-    serviceDependencies = [ "continuwuity.service" ];
-  };
-
-  # Signal
-  services.mautrix-signal = {
-    enable = true;
-    environmentFile = config.age.secrets.signal.path;
-    settings = {
-      homeserver = {
-        address = "https://matrix.psysdnd.org";
-        domain = "psydnd.org";
-      };
-      appservice = {
-        address = "http://localhost:8338";
-        port = 8338;
-        database = "$DB_STRING";
-      };
-      bridge.permissions."@coolneng:psydnd.org" = "admin";
-    };
-    serviceDependencies = [ "continuwuity.service" ];
-  };
-
-  # HACK Use libolm as there's no good alternative
-  nixpkgs.config.permittedInsecurePackages = [
-    "olm-3.2.16"
         ];
+      };
+      sync_api = {
+        inherit database;
+      };
+      key_server = {
+        inherit database;
+      };
+      federation_api = {
+        inherit database;
+      };
+      user_api = {
+        account_database = database;
+        device_database = database;
+      };
+    };
+  };
 
   # Start dendrite after config files are mounted
-  systemd.services.continuwuity.unitConfig.RequiresMountsFor = [
+  systemd.services.dendrite.unitConfig.RequiresMountsFor = [
-    /var/lib/mautrix-meta-facebook
+    /var/lib/matrix-as-facebook
-    /var/lib/mautrix-signal
+    /var/lib/matrix-as-signal
-    /var/lib/mautrix-telegram
+    /var/lib/matrix-as-telegram
   ];
 
   # MQTT configuration

modules/monitoring.nix

@@ -82,14 +82,11 @@ with pkgs;
   # Grafana configuration
   services.grafana = {
     enable = true;
-    settings = {
+    settings.server = {
-      server = {
       domain = "grafana.psydnd.org";
       http_port = 9009;
       http_addr = "127.0.0.1";
     };
-      security.secret_key = config.age.secrets.grafana.path;
-    };
   };
 
 }

modules/webstack.nix

@@ -34,12 +34,21 @@
       proxy_cookie_path / "/; secure; HttpOnly; SameSite=strict";
     '';
     virtualHosts = {
-      # Redirection of the old domain
+      # Old domain being redirected
       "coolneng.duckdns.org" = {
         useACMEHost = "coolneng.duckdns.org";
         forceSSL = true;
         locations = {
           "/".return = "301 https://psydnd.org$request_uri";
+          # Delegation for Matrix
+          "/.well-known/" = {
+            alias = "${../well-known}" + "/";
+            extraConfig = ''
+              ${config.services.nginx.commonHttpConfig}
+              default_type application/json;
+              add_header Access-Control-Allow-Origin * always;
+            '';
+          };
         };
       };
       # Redirect subdomains
@@ -52,15 +61,6 @@
       "psydnd.org" = {
         useACMEHost = "psydnd.org";
         forceSSL = true;
-        # Delegation for Matrix
-        locations."/.well-known/" = {
-          alias = "${../well-known}" + "/";
-          extraConfig = ''
-            ${config.services.nginx.commonHttpConfig}
-            default_type application/json;
-            add_header Access-Control-Allow-Origin * always;
-          '';
-        };
       };
       "radicale.psydnd.org" = {
         useACMEHost = "psydnd.org";

scripts/motd.sh

@@ -24,7 +24,7 @@ services=(
     "radicale.service"
     "miniflux.service"
     "gitea.service"
-    "continuwuity.service"
+    "dendrite.service"
     "nginx.service"
     "dnsmasq.service"
     "dnscrypt-proxy.service"

secrets/grafana.age

@@ -1,5 +0,0 @@
-age-encryption.org/v1
--> ssh-ed25519 iUaRGg Ag32nut/aBlxEy7RPw7sV5itZSHkp8eMLVtxFxwQ8EM
-ZhK8EZWTLkxrwo+x97w4HpexDXkC1yQuKyYFujqlOgs
---- kszqKtyubreK5mGkrJg4hrEKrfITJCCM/hW6IHKlMIE
-TÚ+À~/ œDbM?Çø×å ½œa-ð'ƒÒp^5ç›?�ï&#!àϳ‰þ~59O

secrets/secrets.nix

@@ -8,6 +8,8 @@ in
   "gitea.age".publicKeys = [ zion ];
   "miniflux.age".publicKeys = [ zion ];
   "git.age".publicKeys = [ zion ];
+  "dendrite.age".publicKeys = [ zion ];
+  "dendrite-postgres.age".publicKeys = [ zion ];
   "telegram.age".publicKeys = [ zion ];
   "mqtt-sender.age".publicKeys = [ zion ];
   "mqtt-receiver.age".publicKeys = [ zion ];