Draupnir

Moderation bot for Matrix servers

This project is funded by NLnet through these subgrants:

• Draupnir

1. Install Nix

   Arch Linux

   Bash

   $ pacman --sync --refresh --noconfirm curl git jq nix

   Debian

   Bash

   $ apt install --yes curl git jq nix

   Ubuntu

   Bash

   $ apt install --yes curl git jq nix

2. Download a configuration file

   # default.nix
   {
     ngipkgs ? import (fetchTarball "https://github.com/ngi-nix/ngipkgs/tarball/main") { },
   }:
   ngipkgs.demo-vm (
     # https://github.com/NixOS/nixpkgs/blob/c7661dfc33f947d81443ec911549e2d0f6414085/nixos/tests/matrix/draupnir.nix
     { ... }:
   
     let
       port = 8008;
     in
     {
       # We want a server for demos.
       services.matrix-synapse = {
         enable = true;
         log.root.level = "WARNING";
         settings = {
           database.name = "sqlite3";
           # Do *NOT* do this in production!
           registration_shared_secret = "supersecret-registration";
   
           listeners = [
             {
               bind_addresses = [
                 "::"
               ];
               inherit port;
               resources = [
                 {
                   compress = true;
                   names = [ "client" ];
                 }
                 {
                   compress = false;
                   names = [ "federation" ];
                 }
               ];
               tls = false;
               type = "http";
               x_forwarded = false;
             }
           ];
         };
       };
   
       services.draupnir = {
         enable = true;
         settings = {
           homeserverUrl = "http://localhost:${toString port}";
           managementRoom = "#moderators:homeserver";
         };
         secrets = {
           # This needs be set up before the service is started.
           accessToken = "/tmp/draupnir-access-token";
         };
       };
   
       # demo-vm
       networking.firewall.allowedTCPPorts = [ port ];
     }
   
   )
   

   Download
3. Enable binary substituters

   Bash

   $ export NIX_CONFIG='substituters = https://cache.nixos.org/ https://ngi.cachix.org/
   trusted-public-keys = cache.nixos.org-1:6nchdd59x431o0gwypbmraurkbj16zpmqfgspcdshjy= ngi.cachix.org-1:n+cal72roc3qqulxihpv+tw5t42whxmmhpragkrsrow='

4. Build and run a virtual machine

   Arch Linux, Debian Sid and Ubuntu 25.04

   Bash

   $ nix-build ./default.nix && ./result

   Debian 12 and Ubuntu 24.04/24.10

   Bash

   $ rev=$(nix-instantiate --eval --attr sources.nixpkgs.rev https://github.com/ngi-nix/ngipkgs/archive/master.tar.gz | jq --raw-output)

   $ nix-shell -I nixpkgs=https://github.com/NixOS/nixpkgs/archive/$rev.tar.gz --packages nix --run "nix-build ./default.nix && ./result"

5. Access the service
   Open a web browser at http://localhost:8008 .

# https://github.com/NixOS/nixpkgs/blob/c7661dfc33f947d81443ec911549e2d0f6414085/nixos/tests/matrix/draupnir.nix
{ ... }:

let
  port = 8008;
in
{
  # We want a server for demos.
  services.matrix-synapse = {
    enable = true;
    log.root.level = "WARNING";
    settings = {
      database.name = "sqlite3";
      # Do *NOT* do this in production!
      registration_shared_secret = "supersecret-registration";

      listeners = [
        {
          bind_addresses = [
            "::"
          ];
          inherit port;
          resources = [
            {
              compress = true;
              names = [ "client" ];
            }
            {
              compress = false;
              names = [ "federation" ];
            }
          ];
          tls = false;
          type = "http";
          x_forwarded = false;
        }
      ];
    };
  };

  services.draupnir = {
    enable = true;
    settings = {
      homeserverUrl = "http://localhost:${toString port}";
      managementRoom = "#moderators:homeserver";
    };
    secrets = {
      # This needs be set up before the service is started.
      accessToken = "/tmp/draupnir-access-token";
    };
  };

  # demo-vm
  networking.firewall.allowedTCPPorts = [ port ];
}