matrix-synapse: add automatic user creation

clanModules/matrix-synapse/default.nix

@@ -16,16 +16,58 @@ let
           > $out/config.json < ${pkgs.element-web}/config.json
         ln -s $out/config.json $out/config.${nginx-vhost}.json
       '';
+
+  # FIXME: This was taken from upstream. Drop this when our patch is upstream
+  synapseCfg = config.services.matrix-synapse;
+  wantedExtras =
+    synapseCfg.extras
+    ++ lib.optional (synapseCfg.settings ? oidc_providers) "oidc"
+    ++ lib.optional (synapseCfg.settings ? jwt_config) "jwt"
+    ++ lib.optional (synapseCfg.settings ? saml2_config) "saml2"
+    ++ lib.optional (synapseCfg.settings ? redis) "redis"
+    ++ lib.optional (synapseCfg.settings ? sentry) "sentry"
+    ++ lib.optional (synapseCfg.settings ? user_directory) "user-search"
+    ++ lib.optional (synapseCfg.settings.url_preview_enabled) "url-preview"
+    ++ lib.optional (synapseCfg.settings.database.name == "psycopg2") "postgres";
+
 in
 {
+  options.services.matrix-synapse.package = lib.mkOption { readOnly = false; };
   options.clan.matrix-synapse = {
     domain = lib.mkOption {
       type = lib.types.str;
       description = "The domain name of the matrix server";
       example = "example.com";
     };
+    users = lib.mkOption {
+      type = lib.types.attrsOf (
+        lib.types.submodule (
+          { name, ... }:
+          {
+            options = {
+              name = lib.mkOption {
+                type = lib.types.str;
+                default = name;
+                description = "The name of the user";
+              };
+
+              admin = lib.mkOption {
+                type = lib.types.bool;
+                default = false;
+                description = "Whether the user should be an admin";
+              };
+            };
+          }
+        )
+      );
+      description = "A list of users. Not that only new users will be created and existing ones are not modified.";
+      example.alice = {
+        admin = true;
+      };
+    };
   };
   imports = [
+    ../postgresql
     (lib.mkRemovedOptionModule [
       "clan"
       "matrix-synapse"
@@ -36,6 +78,18 @@ in
   ];
   config = {
     services.matrix-synapse = {
+      package = lib.mkForce (
+        pkgs.matrix-synapse.override {
+          matrix-synapse-unwrapped = pkgs.matrix-synapse.unwrapped.overrideAttrs (_old: {
+            doInstallCheck = false; # too slow, nixpkgs maintainer already run this.
+            # see: https://github.com/element-hq/synapse/pull/17294
+            patches = [ ./0001-register_new_matrix_user-add-password-file-flag.patch ];
+          });
+          extras = wantedExtras;
+          plugins = synapseCfg.plugins;
+        }
+      );
+
       enable = true;
       settings = {
         server_name = cfg.domain;
@@ -70,7 +124,10 @@ in
       };
       extraConfigFiles = [ "/run/synapse-registration-shared-secret.yaml" ];
     };
-    systemd.tmpfiles.settings."synapse" = {
+
+    security.wrappers = lib.mkForce { }; # unsupported in unprivileged containers
+
+    systemd.tmpfiles.settings."01-matrix" = {
       "/run/synapse-registration-shared-secret.yaml" = {
         C.argument =
           config.clanCore.facts.services.matrix-synapse.secret.synapse-registration_shared_secret.path;
@@ -90,16 +147,64 @@ in
       OWNER = "matrix-synapse";
     };
 
-    clanCore.facts.services."matrix-synapse" = {
-      secret."synapse-registration_shared_secret" = { };
-      generator.path = with pkgs; [
-        coreutils
-        pwgen
-      ];
-      generator.script = ''
-        echo "registration_shared_secret: $(pwgen -s 32 1)" > "$secrets"/synapse-registration_shared_secret
-      '';
-    };
+    clanCore.facts.services =
+      {
+        "matrix-synapse" = {
+          secret."synapse-registration_shared_secret" = { };
+          generator.path = with pkgs; [
+            coreutils
+            pwgen
+          ];
+          generator.script = ''
+            echo "registration_shared_secret: $(pwgen -s 32 1)" > "$secrets"/synapse-registration_shared_secret
+          '';
+        };
+      }
+      // lib.mapAttrs' (
+        name: user:
+        lib.nameValuePair "matrix-password-${user.name}" {
+          secret."matrix-password-${user.name}" = { };
+          generator.path = with pkgs; [
+            coreutils
+            pwgen
+          ];
+          generator.script = ''
+            xkcdpass -n 4 -d - > "$secrets"/${lib.escapeShellArg "matrix-password-${user.name}"}
+          '';
+        }
+      ) cfg.users;
+
+    systemd.services.matrix-synapse =
+      let
+        usersScript =
+          ''
+            while ! ${pkgs.netcat}/bin/nc -z -v ::1 8008; do
+              if ! kill -0 "$MAINPID"; then exit 1; fi
+              sleep 1;
+            done
+
+            headers=$(mktemp)
+            trap 'rm -f "$headers"' EXIT
+
+            cat > "$headers" <<EOF
+            Authorization: Bearer $(cat /run/synapse-registration-shared-secret.yaml| sed -n 's/registration_shared_secret: //p')
+            EOF
+          ''
+          + lib.concatMapStringsSep "\n" (user: ''
+            # only create user if it doesn't exist
+            if ! curl --header "$headers" "http://localhost:8008/_synapse/admin/v1/whois/${user.name}@${cfg.domain}" >&2; then
+              /run/current-system/sw/bin/matrix-synapse-register_new_matrix_user --password-file ${
+                config.clanCore.facts.services."matrix-password-${user.name}".secret."matrix-password-${user.name}".path
+              } --user "${user.name}" ${if user.admin then "--admin" else "--no-admin"}
+            fi
+          '') (lib.attrValues cfg.users);
+      in
+      {
+        path = [ pkgs.curl ];
+        serviceConfig.ExecStartPost = [
+          (''+${pkgs.writeShellScript "matrix-synapse-create-users" usersScript}'')
+        ];
+      };
 
     services.nginx = {
       enable = true;