dolysis/conduwuit
3
0
Fork 0
mirror of https://github.com/girlbossceo/conduwuit.git synced 2024-12-04 02:09:30 +00:00
Code Issues Packages Projects Releases Wiki Activity

docs: add workaround to use unix sockets with the nixos module

Browse source
This commit is contained in:
emily 2024-11-20 16:29:42 +01:00 committed by June 🍓🦴
parent 876c6e933c
commit ee3c58f78f
1 changed files with 21 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

26
docs/deploying/nixos.md
View file

@ -55,15 +55,31 @@ appropriately to use conduwuit instead of Conduit.
### UNIX sockets ### UNIX sockets
Due to the lack of a conduwuit NixOS module, when using the `services.matrix-conduit` module Due to the lack of a conduwuit NixOS module, when using the `services.matrix-conduit` module
it is not possible to use UNIX sockets. This is because the UNIX socket option does not exist a workaround like the one below is necessary to use UNIX sockets. This is because the UNIX
in Conduit, and their module forces listening on `[::1]:6167` by default if unspecified. socket option does not exist in Conduit, and the module forcibly sets the `address` and
`port` config options.
```nix
options.services.matrix-conduit.settings = lib.mkOption {
apply = old: old // (
if (old.global ? "unix_socket_path")
then { global = builtins.removeAttrs old.global [ "address" "port" ]; }
else { }
);
};
```
Additionally, the [`matrix-conduit` systemd unit][systemd-unit] in the module does not allow Additionally, the [`matrix-conduit` systemd unit][systemd-unit] in the module does not allow
the `AF_UNIX` socket address family in their systemd unit's `RestrictAddressFamilies=` which the `AF_UNIX` socket address family in their systemd unit's `RestrictAddressFamilies=` which
disallows the namespace from accessing or creating UNIX sockets. disallows the namespace from accessing or creating UNIX sockets and has to be enabled like so:
There is no known workaround these. A conduwuit NixOS configuration module must be developed and ```nix
published by the community. systemd.services.conduit.serviceConfig.RestrictAddressFamilies = [ "AF_UNIX" ];
```
Even though those workarounds are feasible a conduwuit NixOS configuration module, developed and
published by the community, would be appreciated.
### jemalloc and hardened profile ### jemalloc and hardened profile