Matrix - Revision history

Hatch01: Update mas config for the new upcomming fix pr #537261

2026-07-03T14:47:42Z

Update mas config for the new upcomming fix pr #537261

← Older revision		Revision as of 14:47, 3 July 2026
Line 263:		Line 263:

	=== Matrix Authentication Service (MAS) ===		=== Matrix Authentication Service (MAS) ===
	<blockquote>~~At the time of writing, the <code>services.matrix-authentication-service</code> module has not yet been merged into Nixpkgs. The examples below are based on the proposed~~ module available ~~in PR [https://github.com/NixOS/nixpkgs/pull/527621/ #527621] and may require adjustments until it is merged~~.</blockquote>The Matrix Authentication Service (MAS) is an OAuth 2.1 and OpenID Connect provider designed for Matrix homeservers. It is intended to become the authentication component used by Matrix homeservers implementing MSC3861.		<blockquote>MAS module is only available since nixos 26.11</blockquote>The Matrix Authentication Service (MAS) is an OAuth 2.1 and OpenID Connect provider designed for Matrix homeservers. It is intended to become the authentication component used by Matrix homeservers implementing MSC3861.

	MAS provides a modern authentication layer for Matrix and enables features such as:		MAS provides a modern authentication layer for Matrix and enables features such as:
Line 280:		Line 280:
	enable = true;		enable = true;
	createDatabase = true;		createDatabase = true;
			credentials."matrix_secret" = config.age.secrets.mas_matrix_secret.path;
	settings = {		settings = {
	http.public_base = "https://auth.example.com/";		http.public_base = "https://auth.example.com/";
Line 286:		Line 287:
	homeserver = "example.com";		homeserver = "example.com";
	endpoint = "http://127.0.0.1:8008/";		endpoint = "http://127.0.0.1:8008/";
	secret_file = ~~config~~.~~age.secrets.mas_matrix_secret.path~~;		secret_file = "/run/credentials/matrix-authentication-service.service/matrix_secret";
	};		};
	};		};
Line 321:		Line 322:
	issuer = "https://auth.example.com";		issuer = "https://auth.example.com";
	client_id = "xxxxxxxx";		client_id = "xxxxxxxx";
	client_secret = "xxxxxxxx";		client_secret_file = "/run/credentials/matrix-authentication-service.service/xxxx";
			# client_secret = "xxxxxxxx";
	token_endpoint_auth_method = "client_secret_basic";		token_endpoint_auth_method = "client_secret_basic";
	discovery_mode = "insecure";		discovery_mode = "insecure";
Line 387:		Line 389:

	See the [https://search.nixos.org/options?channel=unstable&query=matrix-authentication-service MAS configuration reference] for the complete list of available options.		See the [https://search.nixos.org/options?channel=unstable&query=matrix-authentication-service MAS configuration reference] for the complete list of available options.

			==== Example configuration ====
			This configuration is provided for demonstration purposes only (mas+synapse+authelia with agenix for secret management): https://github.com/hatch01/flake/blob/d8e8a74b8b3df01283b79a777c46513dd78c9d10/apps/matrix/mas.nix

	== Application services (a.k.a. bridges) ==		== Application services (a.k.a. bridges) ==

Hatch01: feat: add basic documentation with examples for matrix-authentification-service (coming soon in nixpkgs with PR https://github.com/NixOS/nixpkgs/pull/527621)

2026-06-26T07:09:15Z

feat: add basic documentation with examples for matrix-authentification-service (coming soon in nixpkgs with PR https://github.com/NixOS/nixpkgs/pull/527621)

@@ Line 261: / Line 261: @@
+}
 </syntaxhighlight>
 == Application services (a.k.a. bridges) ==

Walkquackback: /* Desktop clients */Reword to make wording and presentation more neutral

2026-04-18T17:35:43Z

Desktop clients: Reword to make wording and presentation more neutral

← Older revision		Revision as of 17:35, 18 April 2026
Line 13:		Line 13:
	=== Desktop clients ===		=== Desktop clients ===

	~~These~~ clients ~~are known to work:~~ <code>element-desktop</code> [https://element.io/] and <code>fractal</code> [https://gitlab.gnome.org/World/fractal]		The clients <code>element-desktop</code> [https://element.io/] and <code>fractal</code> [https://gitlab.gnome.org/World/fractal] are known to work and are kept up to date.

	~~Most of the other~~ clients packaged in Nixpkgs, such as <code>matrix-commander</code>, <code>neochat</code>, <code>nheko</code>, ~~rely~~ on the ~~'''~~insecure~~''' and '''deprecated'''~~ <code>olm</code> library susceptible to various security vulnerabilities.[https://nvd.nist.gov/vuln/detail/CVE-2024-45191][https://nvd.nist.gov/vuln/detail/CVE-2024-45193][https://nvd.nist.gov/vuln/detail/CVE-2024-45192]		Other clients packaged in Nixpkgs, such as <code>matrix-commander</code>, <code>neochat</code>, <code>nheko</code>, depend on the insecure <code>olm</code> library susceptible to various security vulnerabilities.[https://nvd.nist.gov/vuln/detail/CVE-2024-45191][https://nvd.nist.gov/vuln/detail/CVE-2024-45193][https://nvd.nist.gov/vuln/detail/CVE-2024-45192]

			If this is not a concern, the guide to [https://nixos.org/manual/nixpkgs/stable/#sec-allow-insecure install insecure packages] may be followed.

	If this isn't a problem for you, you can install them as usual, and upon evaluation, Nix will helpfully guide you on how to [https://nixos.org/manual/nixpkgs/stable/#sec-allow-insecure install insecure packages].
	=== Web clients ===		=== Web clients ===
	There is a web version of the client [https://element.io/ Element], <code>element-web</code> on Nixpkgs, which you can use as a regular web application. See [https://nixos.org/nixos/manual/index.html#module-services-matrix-element-web the NixOS manual entry].<syntaxhighlight lang="nixos">		There is a web version of the client [https://element.io/ Element], <code>element-web</code> on Nixpkgs, which you can use as a regular web application. See [https://nixos.org/nixos/manual/index.html#module-services-matrix-element-web the NixOS manual entry].<syntaxhighlight lang="nixos">

Zimward: Move Livekit out of the synapse section as its homeserver independent

2026-03-17T18:04:37Z

Move Livekit out of the synapse section as its homeserver independent

@@ Line 165: / Line 165: @@
 </syntaxhighlight>
-==== Livekit ====
 In order to set up element call or for calls to work in Element X it is necessary to set up and announce livekit. To set up livekit for matrix in nixos use<syntaxhighlight lang="nix" line="1">
 { config, lib, pkgs, ... }: let
@@ Line 235: / Line 260: @@
+}
 </syntaxhighlight>
 == Application services (a.k.a. bridges) ==

Kaya: Add section about synapse admin

2025-11-18T23:30:25Z

Add section about synapse admin

@@ Line 239: / Line 239: @@
 There's an external module to automatically set up synapse and configure nginx with workers:
 https://github.com/dali99/nixos-matrix-modules
 == Application services (a.k.a. bridges) ==

Xanderio: livekit: simplify key creation unit with ConditionPathExists

2025-10-19T10:53:50Z

livekit: simplify key creation unit with ConditionPathExists

← Older revision		Revision as of 10:53, 19 October 2025
Line 188:		Line 188:
	path = with pkgs; [ livekit coreutils gawk ];		path = with pkgs; [ livekit coreutils gawk ];
	script = ''		script = ''
	~~if [ -f ${keyFile} ]; then~~
	~~echo "Key exists"~~
	~~else~~
	echo "Key missing, generating key"		echo "Key missing, generating key"
	echo "lk-jwt-service: $(livekit-server generate-keys \| tail -1 \| awk '{print $3}')" > "${keyFile}"		echo "lk-jwt-service: $(livekit-server generate-keys \| tail -1 \| awk '{print $3}')" > "${keyFile}"
	fi
	'';		'';
	serviceConfig.Type = "oneshot";		serviceConfig.Type = "oneshot";
			unitConfig.ConditionPathExists = "!${keyFile}";
	};		};
	# restrict access to livekit room creation to a homeserver		# restrict access to livekit room creation to a homeserver

Xanderio: disable livekit auto room creation as per lk-jwt-service upstream docs

2025-10-19T10:48:00Z

disable livekit auto room creation as per lk-jwt-service upstream docs

← Older revision		Revision as of 10:48, 19 October 2025
Line 173:		Line 173:
	enable = true;		enable = true;
	openFirewall = true;		openFirewall = true;
			settings.room.auto_create = false;
	inherit keyFile;		inherit keyFile;
	};		};

Benneti: add instructions to setup livekit for use withe element-call or Element X

2025-08-22T19:38:04Z

add instructions to setup livekit for use withe element-call or Element X

@@ Line 162: / Line 162: @@
      turn_user_lifetime = "1h";
    };
+}
 </syntaxhighlight>

Sandro: Remove old link

2025-07-17T12:27:09Z

Remove old link

← Older revision		Revision as of 12:27, 17 July 2025
Line 254:		Line 254:
	=== mautrix-whatsapp ===		=== mautrix-whatsapp ===
	Packaged as [https://search.nixos.org/packages?query=mautrix-whatsapp mautrix-whatsapp].		Packaged as [https://search.nixos.org/packages?query=mautrix-whatsapp mautrix-whatsapp].
	~~Module implemented in this [https://github.com/NixOS/nixpkgs/pull/246842 PR].~~

	=== matrix-appservice-irc ===		=== matrix-appservice-irc ===

O5-J: Minor spelling mistake

2025-06-28T13:44:31Z

Minor spelling mistake

← Older revision		Revision as of 13:44, 28 June 2025
Line 13:		Line 13:
	=== Desktop clients ===		=== Desktop clients ===

	These clients are ~~know~~ to work: <code>element-desktop</code> [https://element.io/] and <code>fractal</code> [https://gitlab.gnome.org/World/fractal]		These clients are known to work: <code>element-desktop</code> [https://element.io/] and <code>fractal</code> [https://gitlab.gnome.org/World/fractal]

	Most of the other clients packaged in Nixpkgs, such as <code>matrix-commander</code>, <code>neochat</code>, <code>nheko</code>, rely on the '''insecure''' and '''deprecated''' <code>olm</code> library susceptible to various security vulnerabilities.[https://nvd.nist.gov/vuln/detail/CVE-2024-45191][https://nvd.nist.gov/vuln/detail/CVE-2024-45193][https://nvd.nist.gov/vuln/detail/CVE-2024-45192]		Most of the other clients packaged in Nixpkgs, such as <code>matrix-commander</code>, <code>neochat</code>, <code>nheko</code>, rely on the '''insecure''' and '''deprecated''' <code>olm</code> library susceptible to various security vulnerabilities.[https://nvd.nist.gov/vuln/detail/CVE-2024-45191][https://nvd.nist.gov/vuln/detail/CVE-2024-45193][https://nvd.nist.gov/vuln/detail/CVE-2024-45192]