From d61795eaa207b2cbac673150a16c08cd8530e519 Mon Sep 17 00:00:00 2001 From: eymeric Date: Fri, 3 Jul 2026 11:25:42 +0700 Subject: [PATCH 1/6] nixos/matrix-authentication-service: small cleanup --- nixos/modules/services/matrix/matrix-authentication-service.nix | 2 -- 1 file changed, 2 deletions(-) diff --git a/nixos/modules/services/matrix/matrix-authentication-service.nix b/nixos/modules/services/matrix/matrix-authentication-service.nix index 8ff62f0dbf28..e0ec3438abb7 100644 --- a/nixos/modules/services/matrix/matrix-authentication-service.nix +++ b/nixos/modules/services/matrix/matrix-authentication-service.nix @@ -14,13 +14,11 @@ let isAttrs isList mapAttrs - mkDefault mkEnableOption mkIf mkOption mkPackageOption optional - optionalAttrs types ; From 658c5fefa7ebbab19e637bfea02b26b65863180f Mon Sep 17 00:00:00 2001 From: eymeric Date: Wed, 1 Jul 2026 08:50:20 +0700 Subject: [PATCH 2/6] nixos/matrix-authentication-services: fix extraConfigFiles param permission issue --- .../services/matrix/matrix-authentication-service.nix | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/nixos/modules/services/matrix/matrix-authentication-service.nix b/nixos/modules/services/matrix/matrix-authentication-service.nix index e0ec3438abb7..6f19d9455feb 100644 --- a/nixos/modules/services/matrix/matrix-authentication-service.nix +++ b/nixos/modules/services/matrix/matrix-authentication-service.nix @@ -43,6 +43,9 @@ let else pruned; configFile = format.generate "config.yaml" finalSettings; + + extraConfigArgs = lib.imap0 (i: _: "%d/config-${toString i}") cfg.extraConfigFiles; + configFileArgs = [ configFile ] ++ extraConfigArgs; in { meta.maintainers = with lib.maintainers; [ @@ -388,13 +391,14 @@ in wantedBy = [ "multi-user.target" ]; serviceConfig = { DynamicUser = true; + LoadCredential = lib.imap0 (i: path: "config-${toString i}:${path}") cfg.extraConfigFiles; ExecStartPre = '' ${getExe cfg.package} config check \ - ${concatMapStringsSep " " (x: "--config ${x}") ([ configFile ] ++ cfg.extraConfigFiles)} + ${concatMapStringsSep " " (x: "--config ${x}") configFileArgs} ''; ExecStart = '' ${getExe cfg.package} server \ - ${concatMapStringsSep " " (x: "--config ${x}") ([ configFile ] ++ cfg.extraConfigFiles)} + ${concatMapStringsSep " " (x: "--config ${x}") configFileArgs} ''; Restart = "on-failure"; RestartSec = "1s"; @@ -436,6 +440,7 @@ in # Working and state directories StateDirectory = "matrix-authentication-service"; StateDirectoryMode = "0700"; + RuntimeDirectory = "matrix-authentication-service"; WorkingDirectory = "/var/lib/matrix-authentication-service"; }; }; From 0ab75569e6ff3f1039581758ecc7ae48d8e2c1cd Mon Sep 17 00:00:00 2001 From: eymeric Date: Fri, 3 Jul 2026 11:30:01 +0700 Subject: [PATCH 3/6] nixos/matrix-authentication-service: add option credentials --- .../matrix/matrix-authentication-service.nix | 39 +++++++++++++++---- 1 file changed, 31 insertions(+), 8 deletions(-) diff --git a/nixos/modules/services/matrix/matrix-authentication-service.nix b/nixos/modules/services/matrix/matrix-authentication-service.nix index 6f19d9455feb..ecf38e9bd3c3 100644 --- a/nixos/modules/services/matrix/matrix-authentication-service.nix +++ b/nixos/modules/services/matrix/matrix-authentication-service.nix @@ -11,6 +11,7 @@ let filter filterAttrs getExe + getExe' isAttrs isList mapAttrs @@ -44,8 +45,10 @@ let pruned; configFile = format.generate "config.yaml" finalSettings; - extraConfigArgs = lib.imap0 (i: _: "%d/config-${toString i}") cfg.extraConfigFiles; - configFileArgs = [ configFile ] ++ extraConfigArgs; + extraConfigFiles = lib.imap0 ( + i: _: "$CREDENTIALS_DIRECTORY/config-${toString i}" + ) cfg.extraConfigFiles; + runtimeConfig = "/run/matrix-authentication-service/config.yaml"; in { meta.maintainers = with lib.maintainers; [ @@ -371,6 +374,20 @@ in such as the Matrix homeserver if it's running on the same host. ''; }; + + credentials = lib.mkOption { + type = lib.types.attrsOf lib.types.str; + default = { }; + description = '' + Name -> source file path. Exposed to the unit via LoadCredential and + readable inside the service at ''${CREDENTIALS_DIRECTORY}/. + + For example : + services.matrix-authentication-service.credentials."synapse-secret" = "/run/agenix/synapse-shared"; + services.matrix-authentication-service.settings.matrix.secret_file = + "''${CREDENTIALS_DIRECTORY}/synapse-secret"; + ''; + }; }; config = mkIf cfg.enable { @@ -391,14 +408,20 @@ in wantedBy = [ "multi-user.target" ]; serviceConfig = { DynamicUser = true; - LoadCredential = lib.imap0 (i: path: "config-${toString i}:${path}") cfg.extraConfigFiles; - ExecStartPre = '' - ${getExe cfg.package} config check \ - ${concatMapStringsSep " " (x: "--config ${x}") configFileArgs} + LoadCredential = + (lib.imap0 (i: path: "config-${toString i}:${path}") cfg.extraConfigFiles) + ++ (lib.mapAttrsToList (name: path: "${name}:${path}") cfg.credentials); + ExecStartPre = pkgs.writeShellScript "mas-prepare" '' + ${getExe' pkgs.gettext "envsubst"} \ + '$CREDENTIALS_DIRECTORY' \ + < ${configFile} \ + > /run/matrix-authentication-service/config.yaml + ${getExe cfg.package} config check --config ${runtimeConfig} \ + ${concatMapStringsSep " " (x: "--config ${x}") extraConfigFiles} ''; ExecStart = '' - ${getExe cfg.package} server \ - ${concatMapStringsSep " " (x: "--config ${x}") configFileArgs} + ${getExe cfg.package} server --config ${runtimeConfig} \ + ${concatMapStringsSep " " (x: "--config ${x}") extraConfigFiles} ''; Restart = "on-failure"; RestartSec = "1s"; From 24f95988be9cc36d829360e9ddb01f744f198e8b Mon Sep 17 00:00:00 2001 From: Maximilian Bosch Date: Sat, 4 Jul 2026 11:55:21 +0200 Subject: [PATCH 4/6] nixos/matrix-authentication-service: test credentials behavior in VM-test --- nixos/tests/matrix/matrix-authentication-service.nix | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/nixos/tests/matrix/matrix-authentication-service.nix b/nixos/tests/matrix/matrix-authentication-service.nix index 7fac403e8421..cb4aeddc8246 100644 --- a/nixos/tests/matrix/matrix-authentication-service.nix +++ b/nixos/tests/matrix/matrix-authentication-service.nix @@ -237,13 +237,14 @@ in { id = masULID; client_id = oidcClientID; - client_secret = oidcClientSecret; + client_secret_file = "\${CREDENTIALS_DIRECTORY}/oidc_client_secret"; issuer = "https://${dexDomain}:5556"; scope = "openid email profile"; token_endpoint_auth_method = "client_secret_post"; } ]; }; + credentials.oidc_client_secret = "${pkgs.writeText "oidc-client-secret" oidcClientSecret}"; }; services.postgresql.authentication = pkgs.lib.mkOverride 10 '' local all all trust From 0d214bd808d18bb62f5a611096e3aba79e925d41 Mon Sep 17 00:00:00 2001 From: Maximilian Bosch Date: Sat, 4 Jul 2026 11:58:55 +0200 Subject: [PATCH 5/6] nixos/matrix-authentication-service: escape CREDENTIALS_DIRECTORY correctly The `''` is needed to make Nix not interpret it as variable. However, it would now render in the manual as `${CREDENTIALS_DIRECTORY}`. If somebody would copy that, he'd get an error because that's a variable substitution then. Adding another backslash such that the code rendered in the manual is correct. --- nixos/modules/services/matrix/matrix-authentication-service.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/nixos/modules/services/matrix/matrix-authentication-service.nix b/nixos/modules/services/matrix/matrix-authentication-service.nix index ecf38e9bd3c3..978f2d571fde 100644 --- a/nixos/modules/services/matrix/matrix-authentication-service.nix +++ b/nixos/modules/services/matrix/matrix-authentication-service.nix @@ -385,7 +385,7 @@ in For example : services.matrix-authentication-service.credentials."synapse-secret" = "/run/agenix/synapse-shared"; services.matrix-authentication-service.settings.matrix.secret_file = - "''${CREDENTIALS_DIRECTORY}/synapse-secret"; + "\''${CREDENTIALS_DIRECTORY}/synapse-secret"; ''; }; }; From 084023c72af0071afc8d7a4476f267c328746693 Mon Sep 17 00:00:00 2001 From: Maximilian Bosch Date: Sat, 4 Jul 2026 12:00:54 +0200 Subject: [PATCH 6/6] nixos/matrix-authentication-service: fix formatting of description Be more explicit in the first sentence. And use code-blocks to make sure the code-example is rendered correctly. --- .../services/matrix/matrix-authentication-service.nix | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/nixos/modules/services/matrix/matrix-authentication-service.nix b/nixos/modules/services/matrix/matrix-authentication-service.nix index 978f2d571fde..18648d2e3451 100644 --- a/nixos/modules/services/matrix/matrix-authentication-service.nix +++ b/nixos/modules/services/matrix/matrix-authentication-service.nix @@ -379,13 +379,16 @@ in type = lib.types.attrsOf lib.types.str; default = { }; description = '' - Name -> source file path. Exposed to the unit via LoadCredential and - readable inside the service at ''${CREDENTIALS_DIRECTORY}/. + Mapping of credential name to source file-path. Exposed to the unit via LoadCredential and + readable inside the service at `''${CREDENTIALS_DIRECTORY}/`. - For example : + For example: + + ``` services.matrix-authentication-service.credentials."synapse-secret" = "/run/agenix/synapse-shared"; services.matrix-authentication-service.settings.matrix.secret_file = "\''${CREDENTIALS_DIRECTORY}/synapse-secret"; + ``` ''; }; };