-
-
Notifications
You must be signed in to change notification settings - Fork 14.8k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
Showing
211 changed files
with
5,105 additions
and
1,741 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -10842,6 +10842,15 @@ | |
| githubId = 77865363; | ||
| name = "Leonid Belyaev"; | ||
| }; | ||
| leonm1 = { | ||
| github = "leonm1"; | ||
| githubId = 32306579; | ||
| keys = [{ | ||
| fingerprint = "C12D F14B DC9D 64E1 44C3 4D8A 755C DA4E 5923 416A"; | ||
| }]; | ||
| matrix = "@mattleon:matrix.org"; | ||
| name = "Matt Leon"; | ||
| }; | ||
| leshainc = { | ||
| email = "[email protected]"; | ||
| github = "LeshaInc"; | ||
|
|
@@ -12495,6 +12504,12 @@ | |
| github = "MichaelBrunn3r"; | ||
| githubId = 19626539; | ||
| }; | ||
| MichaelCDormann = { | ||
| email = "[email protected]"; | ||
| name = "Michael Dormann"; | ||
| github = "MichaelCDormann"; | ||
| githubId = 12633081; | ||
| }; | ||
| michaelCTS = { | ||
| email = "[email protected]"; | ||
| name = "Michael Vogel"; | ||
|
|
@@ -14178,7 +14193,8 @@ | |
| githubId = 332423; | ||
| }; | ||
| nu-nu-ko = { | ||
| email = "[email protected]"; | ||
| email = "[email protected]"; | ||
| matrix = "@nuko:shimeji.cafe"; | ||
| github = "nu-nu-ko"; | ||
| githubId = 153512689; | ||
| name = "nuko"; | ||
|
|
@@ -16582,6 +16598,11 @@ | |
| fingerprint = "1401 1B63 393D 16C1 AA9C C521 8526 B757 4A53 6236"; | ||
| }]; | ||
| }; | ||
| rosehobgoblin = { | ||
| name = "J. L. Bowden"; | ||
| github = "rosehobgoblin"; | ||
| githubId = 84164410; | ||
| }; | ||
| rossabaker = { | ||
| name = "Ross A. Baker"; | ||
| email = "[email protected]"; | ||
|
|
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
125 changes: 125 additions & 0 deletions
125
nixos/modules/services/home-automation/matter-server.nix
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,125 @@ | ||
| { lib | ||
| , pkgs | ||
| , config | ||
| , ... | ||
| }: | ||
|
|
||
| with lib; | ||
|
|
||
| let | ||
| cfg = config.services.matter-server; | ||
| storageDir = "matter-server"; | ||
| storagePath = "/var/lib/${storageDir}"; | ||
| vendorId = "4939"; # home-assistant vendor ID | ||
| in | ||
|
|
||
| { | ||
| meta.maintainers = with lib.maintainers; [ leonm1 ]; | ||
|
|
||
| options.services.matter-server = with types; { | ||
| enable = mkEnableOption (lib.mdDoc "Matter-server"); | ||
|
|
||
| package = mkPackageOptionMD pkgs "python-matter-server" { }; | ||
|
|
||
| port = mkOption { | ||
| type = types.port; | ||
| default = 5580; | ||
| description = "Port to expose the matter-server service on."; | ||
| }; | ||
|
|
||
| logLevel = mkOption { | ||
| type = types.enum [ "critical" "error" "warning" "info" "debug" ]; | ||
| default = "info"; | ||
| description = "Verbosity of logs from the matter-server"; | ||
| }; | ||
|
|
||
| extraArgs = mkOption { | ||
| type = listOf str; | ||
| default = []; | ||
| description = '' | ||
| Extra arguments to pass to the matter-server executable. | ||
| See https://github.com/home-assistant-libs/python-matter-server?tab=readme-ov-file#running-the-development-server for options. | ||
| ''; | ||
| }; | ||
| }; | ||
|
|
||
| config = mkIf cfg.enable { | ||
| systemd.services.matter-server = { | ||
| after = [ "network-online.target" ]; | ||
| before = [ "home-assistant.service" ]; | ||
| wants = [ "network-online.target" ]; | ||
| wantedBy = [ "multi-user.target" ]; | ||
| description = "Matter Server"; | ||
| environment.HOME = storagePath; | ||
| serviceConfig = { | ||
| ExecStart = (concatStringsSep " " [ | ||
| "${cfg.package}/bin/matter-server" | ||
| "--port" (toString cfg.port) | ||
| "--vendorid" vendorId | ||
| "--storage-path" storagePath | ||
| "--log-level" "${cfg.logLevel}" | ||
| "${escapeShellArgs cfg.extraArgs}" | ||
| ]); | ||
| # Start with a clean root filesystem, and allowlist what the container | ||
| # is permitted to access. | ||
| TemporaryFileSystem = "/"; | ||
| # Allowlist /nix/store (to allow the binary to find its dependencies) | ||
| # and dbus. | ||
| ReadOnlyPaths = "/nix/store /run/dbus"; | ||
| # Let systemd manage `/var/lib/matter-server` for us inside the | ||
| # ephemeral TemporaryFileSystem. | ||
| StateDirectory = storageDir; | ||
| # `python-matter-server` writes to /data even when a storage-path is | ||
| # specified. This bind-mount points /data at the systemd-managed | ||
| # /var/lib/matter-server, so all files get dropped into the state | ||
| # directory. | ||
| BindPaths = "${storagePath}:/data"; | ||
|
|
||
| # Hardening bits | ||
| AmbientCapabilities = ""; | ||
| CapabilityBoundingSet = ""; | ||
| DevicePolicy = "closed"; | ||
| DynamicUser = true; | ||
| LockPersonality = true; | ||
| MemoryDenyWriteExecute = true; | ||
| NoNewPrivileges = true; | ||
| PrivateDevices = true; | ||
| PrivateTmp = true; | ||
| PrivateUsers = true; | ||
| ProcSubset = "pid"; | ||
| ProtectClock = true; | ||
| ProtectControlGroups = true; | ||
| ProtectHome = true; | ||
| ProtectHostname = true; | ||
| ProtectKernelLogs = true; | ||
| ProtectKernelModules = true; | ||
| ProtectKernelTunables = true; | ||
| ProtectProc = "invisible"; | ||
| RestrictAddressFamilies = [ | ||
| "AF_INET" | ||
| "AF_INET6" | ||
| "AF_NETLINK" | ||
| ]; | ||
| RestrictNamespaces = true; | ||
| RestrictRealtime = true; | ||
| RestrictSUIDSGID = true; | ||
| SystemCallFilter = concatStringsSep " " [ | ||
| "~" # Blocklist | ||
| "@clock" | ||
| "@cpu-emulation" | ||
| "@debug" | ||
| "@module" | ||
| "@mount" | ||
| "@obsolete" | ||
| "@privileged" | ||
| "@raw-io" | ||
| "@reboot" | ||
| "@resources" | ||
| "@swap" | ||
| ]; | ||
| UMask = "0077"; | ||
| }; | ||
| }; | ||
| }; | ||
| } | ||
|
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.