nixos/draupnir: init, nixosTests.draupnir: init

[TheArcaneBrony]

Description of changes

NOTE: This PR is a successor of #398457.
Scope change: The package has been merged in #398489! 🎉

Original description:

Draupnir is a hardfork of Mjolnir. Mjolnir package has been unmaintained due to upstream bugs. This package is mostly a drop-in replacement. This package also uses newer methods of handling dependencies.

Repository can be found at:
https://github.com/the-draupnir-project/Draupnir

Note on testing: package and module were (and still are) tested in our production environment, works fine as far as it's been used.
Note on replacing Mjolnir: Not sure whether this is appropriate, due to general usage of the bot changing. You can however fully automatically migrate from mjolnir to draupnir.

Things done

• Built on platform(s)
  • x86_64-linux
  • aarch64-linux
  • x86_64-darwin
  • aarch64-darwin
• For non-Linux: Is sandboxing enabled in nix.conf? (See Nix manual)
  • sandbox = relaxed
  • sandbox = true
• Tested, as applicable:
  • NixOS test(s) (look inside nixos/tests)
  • and/or package tests
  • or, for functions and "core" functionality, tests in lib/tests or pkgs/test
  • made sure NixOS tests are linked to the relevant packages
• Tested compilation of all packages that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD". Note: all changes have to be committed, also see nixpkgs-review usage
• Tested basic functionality of all binary files (usually in ./result/bin/)
• 24.05 Release Notes (or backporting 23.05 and 23.11 Release notes)
  • (Package updates) Added a release notes entry if the change is major or breaking
  • (Module updates) Added a release notes entry if the change is significant
  • (Module addition) Added a release notes entry if adding a new NixOS module
• Fits CONTRIBUTING.md.

---

Add a 👍 reaction to pull requests you find important.

[teutat3s]

@TheArcaneBrony feel free to cherry-pick my commit to fix the manual build: teutat3s@5b44d46

[sefidel]

We probably need a way to securely provide the synapseHTTPAntispam.authorization value for configuring some of the antispam protections (some option like accessTokenFile)

[teutat3s]

I did a first teutat3s@726c08d stab teutat3s@92dcdc4 at it in my fork of this PR.

[mweinelt]

The changes you applied from me require hooking up the flag within the test. Right now both test cases are the same.

[emilylange]

Marking this as draft because it still needs some work (e.g. the tests don't eval for multiple reasons).

@TheArcaneBrony would you be fine if I implement the remaining To-Dos and review feedback by simply pushing the changes to your branch/PR? :)

[TheArcaneBrony]

@emilylange i suppose you have push access, so go for it :) i can sync whenever
TIL the tests dont eval

[ethancedwards8]

@emilylang @TheArcaneBrony I am a summer of nix 2025 participant and this is one of our intended packages. If it is okay with yall, I would be more than happy to take over and start working on it (and I would provide credit to you both). Let me know what you think.

[emilylange]

@ethancedwards8 hi, thanks for asking.
I think we are good as-is.
I already worked on this over the past few days and made some calls like dropping the pantalaimon options entirely.
There is no much left to do.
But feel free to review the changes once I pushed my local changes today or over the next few days.

[ethancedwards8]

Sounds good. Thank you! We thought we would offer :). I would be more than happy to help review.

[emilylange]

I believe this is ready to review now :)

[emilylange]

I added this warning, because unlike the option reference in the manual, https://search.nixos.org/options hides the fact that this is a read-only option.

E.g. https://nixos.org/manual/nixos/unstable/options#opt-services.kanidm.serverSettings.db_path vs https://search.nixos.org/options?channel=unstable&show=services.kanidm.serverSettings.db_path

[emilylange]

Previously this had serviceConfig.StartLimitBurst= "infinity" which was ignored because it should have been in unitConfig.

I am not sure if I agree on having draupnir.service restart indefinitely, but I suppose there is a case where one does not want one's moderation bot be down indefinitely because something caused it to crash.

Either way, this fixes the implementation of those endless restarts.
Open to discuss.

[TheArcaneBrony]

Keep in mind Draupnir hardcrashes by design on seemingly benign errors, like being unable to sync due to slow server startup etc.

[emilylange]

As mentioned in #400194 (comment), I removed the Pantalaimon "shortcut" options.
Initially they were simply copied over from nixos/mjolnir.
I have fairly strong opinions on this. Pantalaimon is deprecated, marked as insecure in nixpkgs and should no longer be used.

Upstream is also very vocal about not recommending using Pantalaimon with Draupnir:

• https://the-draupnir-project.github.io/draupnir-documentation/bot/encryption
• https://the-draupnir-project.github.io/draupnir-documentation/shared/dogfood#e2ee-support

Those that for some reason want to use Pantalaimon with Draupnir anyway can configure services.pantalaimon-headless.instances on their own.
I do not believe carrying over the options from services.mjolnir.pantalaimon is worth the complexity and a VM test for it would not be run by hydra.nixos.org anyway because olm is marked as insecure and thus skipped.

[emilylange]

RFC 42 for those coming from services.mjolnir.

[emilylange]

I kept it at top-level.
Should be easier to spot this way and I don't think there are even remotely enough secrets to justify making this truly generic.
I am open to move those into services.draupnir.secrets.accessToken and services.draupnir.secrets.pantalaimon.password nonetheless.
Just not free-form.

https://search.nixos.org/options?channel=unstable&show=services.forgejo.secrets for reference by what I mean by "truly generic".

[emilylange]

With the addition of third secret for --http-antispam-authorization-path/web.synapseHTTPAntispam.authorization via #400194 (comment) I decided to move the secrets from top-level to services.draupnir.secrets, matching the structure of services.draupnir.settings:

• cfg.secrets.accessToken for cfg.settings.accessToken
• cfg.secrets.pantalaimon.password for cfg.settings.pantalaimon.password
• cfg.secrets.web.synapseHTTPAntispam.authorization for cfg.settings.web.synapseHTTPAntispam.authorization

[emilylange]

I suggest deferring sandboxing to some future PR, if someone is interested in this.
I removed some options that are already implied by DynamicUser=true.

[emilylange]

git range-diff can be used to compare the changes in a useful way, since GitHub does not provide UI for that:

# git fetch origin master
# git fetch origin 596cb4db3f6531f637d116c7a5f8566a91ae6cd3
# git fetch origin pull/400194/head
# git range-diff --creation-factor=100 origin/master 596cb4db3f6531f637d116c7a5f8566a91ae6cd3 FETCH_HEAD

At least until 596cb4db3f6531f637d116c7a5f8566a91ae6cd3 (the rev before I pushed my changes) gets garbage collected by GitHub, that is.

[mweinelt]

Thanks, that makeover looks awesome!

[teutat3s]

Thank you for pushing this closer to the finish line.
I would love to see an option for the module secret similar to #400194 (comment). Not blocking, can be follow up PR if desired.

[emilylange]

@teutat3s I implemented --http-antispam-authorization-path as per your request. See #400194 (comment).

Note that I did not test this. It should just work though.
If you have the means to test this and report back, please do, that would be awesome :)

[teutat3s]

I tested this PR on a staging server and it works fine. One thing I forgot to mention earlier, we might want to set a default for rawHomeserverUrl or expose it via settings as well - we already expose it via settings.
The settings.web functionality depends on it being correctly set and it defaults to http://localhost:8008, which does not work with e.g. synapse workers.
Maybe just default it to the same value as homeserverUrl and mention it?

[teutat3s]

Thank you so much, this works. Tested with:

• accessToken
• web.synapseHTTPAntispam.authorization
• services.draupnir.settings.web.enabled = true;
• services.draupnir.settings.web.synapseHTTPAntispam.enabled = true;

Example config:

{
  services.matrix-synapse = {
    ...
    plugins = with config.services.matrix-synapse.package.plugins; [
        synapse-http-antispam
    ];
    modules = [
      {
        # https://the-draupnir-project.github.io/draupnir-documentation/bot/synapse-http-antispam
        # https://github.com/maunium/synapse-http-antispam
        module = "synapse_http_antispam.HTTPAntispam";
        config = {
          base_url = "http://${config.services.draupnir.settings.web.address}:${toString config.services.draupnir.settings.web.port}/api/1/spam_check";
          authorization_path = "<http-antispam-authorization-file>";
          enabled_callbacks = [
            "check_event_for_spam"
            "user_may_invite"
            "user_may_join_room"
          ];
          fail_open = {
            check_event_for_spam = true;
            user_may_invite = true;
            user_may_join_room = true;
          };
          async = {
            check_event_for_spam = true;
          };
        };
      }
    ];
  };

  services.draupnir = {
    enable = true;
    secrets = {
      accessToken = "<access-token-file>";
      web.synapseHTTPAntispam.authorization = "<http-antispam-authorization-file>";
    };
    settings = {
      # https://github.com/the-draupnir-project/Draupnir/blob/main/config/default.yaml
      homeserverUrl = "<homeserver-url>";
      managementRoom = "#moderators:example.org";
      protectAllJoinedRooms = true;
      recordIgnoredInvites = true;
      automaticallyRedactForReasons = [
        "*spam"
        "advertising"
      ];
      web = {
        enabled = true;
        port = 8080;
        address = "127.0.200.101";
        abuseReporting.enabled = true;
        synapseHTTPAntispam.enabled = true;
      };
    };
  };
}

[nixpkgs-ci]

Backport failed for release-25.05, because it was unable to cherry-pick the commit(s).

Please cherry-pick the changes locally and resolve any conflicts.

git fetch origin release-25.05
git worktree add -d .worktree/backport-400194-to-release-25.05 origin/release-25.05
cd .worktree/backport-400194-to-release-25.05
git switch --create backport-400194-to-release-25.05
git cherry-pick -x 4b153aad5d363b9d88ca4b47b4628f8032d05863 d6413ba43682273de9595d4193f64209ff8d770e

[teutat3s]

Just wanted to again thank everyone involved in the past two years for getting this from #222939 to merged.