From 95f434366b26021051fad7a177c1dc5cec3580d9 Mon Sep 17 00:00:00 2001 From: nyanloutre Date: Wed, 6 Feb 2019 10:43:10 +0100 Subject: [PATCH 1/7] pythonPackages.pymacaroons: init at 0.13.0 --- .../python-modules/pymacaroons/default.nix | 25 +++++++++++++++++++ pkgs/top-level/python-packages.nix | 2 ++ 2 files changed, 27 insertions(+) create mode 100644 pkgs/development/python-modules/pymacaroons/default.nix diff --git a/pkgs/development/python-modules/pymacaroons/default.nix b/pkgs/development/python-modules/pymacaroons/default.nix new file mode 100644 index 00000000000..96023c01e1e --- /dev/null +++ b/pkgs/development/python-modules/pymacaroons/default.nix @@ -0,0 +1,25 @@ +{ lib, buildPythonPackage, fetchPypi, six, pynacl }: + +buildPythonPackage rec { + pname = "pymacaroons"; + version = "0.13.0"; + + src = fetchPypi { + inherit pname version; + sha256 = "1e6bba42a5f66c245adf38a5a4006a99dcc06a0703786ea636098667d42903b8"; + }; + + propagatedBuildInputs = [ + six + pynacl + ]; + + # Tests require an old version of hypothesis + doCheck = false; + + meta = with lib; { + description = "Macaroon library for Python"; + homepage = https://github.com/ecordell/pymacaroons; + license = licenses.mit; + }; +} diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix index 63d3e962b23..cd1d4d6a4af 100644 --- a/pkgs/top-level/python-packages.nix +++ b/pkgs/top-level/python-packages.nix @@ -4738,6 +4738,8 @@ in { pymacaroons-pynacl = callPackage ../development/python-modules/pymacaroons-pynacl { }; + pymacaroons = callPackage ../development/python-modules/pymacaroons { }; + pynacl = callPackage ../development/python-modules/pynacl { }; service-identity = callPackage ../development/python-modules/service_identity { }; From d667c33cb2c4563191c3666be8c2e16a376d6df0 Mon Sep 17 00:00:00 2001 From: nyanloutre Date: Wed, 6 Feb 2019 10:44:24 +0100 Subject: [PATCH 2/7] matrix-synapse: 0.34.1.1 -> 0.99.0 Also cleanup of old dependencies and irrelevant patch --- pkgs/servers/matrix-synapse/default.nix | 14 ++++--------- .../matrix-synapse/matrix-synapse.patch | 20 ------------------- 2 files changed, 4 insertions(+), 30 deletions(-) delete mode 100644 pkgs/servers/matrix-synapse/matrix-synapse.patch diff --git a/pkgs/servers/matrix-synapse/default.nix b/pkgs/servers/matrix-synapse/default.nix index ee52b838aea..e2ee3e55afb 100644 --- a/pkgs/servers/matrix-synapse/default.nix +++ b/pkgs/servers/matrix-synapse/default.nix @@ -23,29 +23,24 @@ let in buildPythonApplication rec { pname = "matrix-synapse"; - version = "0.34.1.1"; + version = "0.99.0"; src = fetchPypi { inherit pname version; - sha256 = "13jmbcabll3gk0b6yqwfwpc7aymqhpv6iririzskhm4pgbjcp3yk"; + sha256 = "1xsp60172zvgyjgpjmzz90rj1din8d65ffg73nzid4nd875p45kh"; }; - patches = [ - ./matrix-synapse.patch - ]; - propagatedBuildInputs = [ bcrypt bleach canonicaljson daemonize - dateutil frozendict jinja2 jsonschema lxml matrix-synapse-ldap3 - msgpack-python + msgpack netaddr phonenumbers pillow @@ -59,8 +54,7 @@ in buildPythonApplication rec { psutil psycopg2 pyasn1 - pydenticon - pymacaroons-pynacl + pymacaroons pynacl pyopenssl pysaml2 diff --git a/pkgs/servers/matrix-synapse/matrix-synapse.patch b/pkgs/servers/matrix-synapse/matrix-synapse.patch deleted file mode 100644 index 288e6ff1624..00000000000 --- a/pkgs/servers/matrix-synapse/matrix-synapse.patch +++ /dev/null @@ -1,20 +0,0 @@ -diff --git a/homeserver b/homeserver -new file mode 120000 -index 0000000..2f1d413 ---- /dev/null -+++ b/homeserver -@@ -0,0 +1,1 @@ -+synapse/app/homeserver.py -\ No newline at end of file -diff --git a/setup.py b/setup.py -index b00c2af..c7f6e0a 100755 ---- a/setup.py -+++ b/setup.py -@@ -92,6 +92,6 @@ setup( - include_package_data=True, - zip_safe=False, - long_description=long_description, -- scripts=["synctl"] + glob.glob("scripts/*"), -+ scripts=["synctl", "homeserver"] + glob.glob("scripts/*"), - cmdclass={'test': TestCommand}, - ) From 863e49e3ee86517730c6600797f2dbbc2b746d5a Mon Sep 17 00:00:00 2001 From: nyanloutre Date: Wed, 6 Feb 2019 10:46:34 +0100 Subject: [PATCH 3/7] pythonPackages.pymacaroons-pynacl: remove unmaintained fork --- .../pymacaroons-pynacl/default.nix | 24 ------------------- pkgs/top-level/python-packages.nix | 2 -- 2 files changed, 26 deletions(-) delete mode 100644 pkgs/development/python-modules/pymacaroons-pynacl/default.nix diff --git a/pkgs/development/python-modules/pymacaroons-pynacl/default.nix b/pkgs/development/python-modules/pymacaroons-pynacl/default.nix deleted file mode 100644 index 8bc644252c0..00000000000 --- a/pkgs/development/python-modules/pymacaroons-pynacl/default.nix +++ /dev/null @@ -1,24 +0,0 @@ -{ lib, buildPythonPackage, fetchFromGitHub, pynacl, six }: - -buildPythonPackage rec { - pname = "pymacaroons-pynacl"; - version = "0.9.3"; - - src = fetchFromGitHub { - owner = "matrix-org"; - repo = "pymacaroons"; - rev = "v${version}"; - sha256 = "0bykjk01zdndp6gjr30x46blsn0cvxa7j0zh5g8raxwaawchjhii"; - }; - - propagatedBuildInputs = [ pynacl six ]; - - # Tests require an old version of hypothesis - doCheck = false; - - meta = with lib; { - description = "Macaroon library for Python"; - homepage = https://github.com/matrix-org/pymacaroons; - license = licenses.mit; - }; -} diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix index cd1d4d6a4af..145ac72211b 100644 --- a/pkgs/top-level/python-packages.nix +++ b/pkgs/top-level/python-packages.nix @@ -4736,8 +4736,6 @@ in { pygccxml = callPackage ../development/python-modules/pygccxml {}; - pymacaroons-pynacl = callPackage ../development/python-modules/pymacaroons-pynacl { }; - pymacaroons = callPackage ../development/python-modules/pymacaroons { }; pynacl = callPackage ../development/python-modules/pynacl { }; From eb753318b3716921d3ab3b1887385a5ee92b1884 Mon Sep 17 00:00:00 2001 From: nyanloutre Date: Wed, 6 Feb 2019 15:55:06 +0100 Subject: [PATCH 4/7] nixos/matrix-synapse: use python to launch synapse launch synapse with the python executable because the startup script is no longer available --- nixos/modules/services/misc/matrix-synapse.nix | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/nixos/modules/services/misc/matrix-synapse.nix b/nixos/modules/services/misc/matrix-synapse.nix index 18e13f6ac03..216898d5088 100644 --- a/nixos/modules/services/misc/matrix-synapse.nix +++ b/nixos/modules/services/misc/matrix-synapse.nix @@ -651,12 +651,16 @@ in { services.postgresql.enable = mkIf usePostgresql (mkDefault true); - systemd.services.matrix-synapse = { + systemd.services.matrix-synapse = + let + python = (pkgs.python3.withPackages (ps: with ps; [ (ps.toPythonModule cfg.package) ])); + in + { description = "Synapse Matrix homeserver"; after = [ "network.target" "postgresql.service" ]; wantedBy = [ "multi-user.target" ]; preStart = '' - ${cfg.package}/bin/homeserver \ + ${python.interpreter} -m synapse.app.homeserver \ --config-path ${configFile} \ --keys-directory ${cfg.dataDir} \ --generate-keys @@ -687,7 +691,7 @@ in { WorkingDirectory = cfg.dataDir; PermissionsStartOnly = true; ExecStart = '' - ${cfg.package}/bin/homeserver \ + ${python.interpreter} -m synapse.app.homeserver \ ${ concatMapStringsSep "\n " (x: "--config-path ${x} \\") ([ configFile ] ++ cfg.extraConfigFiles) } --keys-directory ${cfg.dataDir} ''; From 4a5f1bb9bc7ae9a77b144bcc8b0570ea838d6ebb Mon Sep 17 00:00:00 2001 From: nyanloutre Date: Wed, 6 Feb 2019 15:46:00 +0100 Subject: [PATCH 5/7] nixos/tests/matrix-synapse: generate ca and certificates --- nixos/tests/matrix-synapse.nix | 50 +++++++++++++++++++++++++++++----- 1 file changed, 43 insertions(+), 7 deletions(-) diff --git a/nixos/tests/matrix-synapse.nix b/nixos/tests/matrix-synapse.nix index 8504a7c0d05..882e4b75814 100644 --- a/nixos/tests/matrix-synapse.nix +++ b/nixos/tests/matrix-synapse.nix @@ -1,4 +1,32 @@ -import ./make-test.nix ({ pkgs, ... } : { +import ./make-test.nix ({ pkgs, ... } : let + + + runWithOpenSSL = file: cmd: pkgs.runCommand file { + buildInputs = [ pkgs.openssl ]; + } cmd; + + + ca_key = runWithOpenSSL "ca-key.pem" "openssl genrsa -out $out 2048"; + ca_pem = runWithOpenSSL "ca.pem" '' + openssl req \ + -x509 -new -nodes -key ${ca_key} \ + -days 10000 -out $out -subj "/CN=snakeoil-ca" + ''; + key = runWithOpenSSL "matrix_key.pem" "openssl genrsa -out $out 2048"; + csr = runWithOpenSSL "matrix.csr" '' + openssl req \ + -new -key ${key} \ + -out $out -subj "/CN=localhost" \ + ''; + cert = runWithOpenSSL "matrix_cert.pem" '' + openssl x509 \ + -req -in ${csr} \ + -CA ${ca_pem} -CAkey ${ca_key} \ + -CAcreateserial -out $out \ + -days 365 + ''; + +in { name = "matrix-synapse"; meta = with pkgs.stdenv.lib.maintainers; { @@ -8,23 +36,31 @@ import ./make-test.nix ({ pkgs, ... } : { nodes = { # Since 0.33.0, matrix-synapse doesn't allow underscores in server names serverpostgres = args: { - services.matrix-synapse.enable = true; - services.matrix-synapse.database_type = "psycopg2"; + services.matrix-synapse = { + enable = true; + database_type = "psycopg2"; + tls_certificate_path = "${cert}"; + tls_private_key_path = "${key}"; + }; }; serversqlite = args: { - services.matrix-synapse.enable = true; - services.matrix-synapse.database_type = "sqlite3"; + services.matrix-synapse = { + enable = true; + database_type = "sqlite3"; + tls_certificate_path = "${cert}"; + tls_private_key_path = "${key}"; + }; }; }; testScript = '' startAll; $serverpostgres->waitForUnit("matrix-synapse.service"); - $serverpostgres->waitUntilSucceeds("curl -Lk https://localhost:8448/"); + $serverpostgres->waitUntilSucceeds("curl -L --cacert ${ca_pem} https://localhost:8448/"); $serverpostgres->requireActiveUnit("postgresql.service"); $serversqlite->waitForUnit("matrix-synapse.service"); - $serversqlite->waitUntilSucceeds("curl -Lk https://localhost:8448/"); + $serversqlite->waitUntilSucceeds("curl -L --cacert ${ca_pem} https://localhost:8448/"); $serversqlite->mustSucceed("[ -e /var/lib/matrix-synapse/homeserver.db ]"); ''; From 524e26c69a21459aefb17b395f22d6fca6ef2cb1 Mon Sep 17 00:00:00 2001 From: nyanloutre Date: Wed, 6 Feb 2019 16:20:43 +0100 Subject: [PATCH 6/7] nixos/matrix-synapse: reload service with SIGHUP This is used to load new certificates without restarting the service --- nixos/modules/services/misc/matrix-synapse.nix | 1 + 1 file changed, 1 insertion(+) diff --git a/nixos/modules/services/misc/matrix-synapse.nix b/nixos/modules/services/misc/matrix-synapse.nix index 216898d5088..a01e34d7362 100644 --- a/nixos/modules/services/misc/matrix-synapse.nix +++ b/nixos/modules/services/misc/matrix-synapse.nix @@ -695,6 +695,7 @@ in { ${ concatMapStringsSep "\n " (x: "--config-path ${x} \\") ([ configFile ] ++ cfg.extraConfigFiles) } --keys-directory ${cfg.dataDir} ''; + ExecReload = "${pkgs.utillinux}/bin/kill -HUP $MAINPID"; Restart = "on-failure"; }; }; From e088eb34d93b0adcdfd46adf7eb7c35bcde346fc Mon Sep 17 00:00:00 2001 From: nyanloutre Date: Thu, 7 Feb 2019 16:53:30 +0100 Subject: [PATCH 7/7] nixos/release-notes: mention breaking changes with matrix-synapse update --- nixos/doc/manual/release-notes/rl-1903.xml | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/nixos/doc/manual/release-notes/rl-1903.xml b/nixos/doc/manual/release-notes/rl-1903.xml index eca280afdf1..d00ffdbb04d 100644 --- a/nixos/doc/manual/release-notes/rl-1903.xml +++ b/nixos/doc/manual/release-notes/rl-1903.xml @@ -378,6 +378,15 @@ (#54637) + + + matrix-synapse has been updated to version 0.99. It will + no longer generate a self-signed certificate on first launch + and will be the last version to accept self-signed certificates. + As such, it is now recommended to use a proper certificate verified by a + root CA (for example Let's Encrypt). + +