From 35de3d6754924b8d4e33f57d2e61d9ffb7144806 Mon Sep 17 00:00:00 2001 From: Niklas Korz Date: Fri, 11 Apr 2025 11:20:41 +0200 Subject: [PATCH 1/2] conduwuit: mark as EOL On April 11, 2025, the conduwuit project officially ceased development. nixpkgs marks security-sensitive projects that have reached EOL as vulnerable. --- nixos/doc/manual/release-notes/rl-2505.section.md | 2 ++ pkgs/by-name/co/conduwuit/package.nix | 3 +++ 2 files changed, 5 insertions(+) diff --git a/nixos/doc/manual/release-notes/rl-2505.section.md b/nixos/doc/manual/release-notes/rl-2505.section.md index 947b227fb667..b73d8b2db4b8 100644 --- a/nixos/doc/manual/release-notes/rl-2505.section.md +++ b/nixos/doc/manual/release-notes/rl-2505.section.md @@ -303,6 +303,8 @@ - The behavior of `services.hostapd.radios..networks..authentication.enableRecommendedPairwiseCiphers` was changed to not include `CCMP-256` anymore. Since all configured pairwise ciphers have to be supported by the radio, this caused startup failures on many devices which is hard to debug in hostapd. +- The `conduwuit` matrix server implementation has officially been discontinued by upstream and the package has thus been marked as vulnerable, as it is a security-sensitive package that has reached EOL. + - `gkraken` software and `hardware.gkraken.enable` option have been removed, use `coolercontrol` via `programs.coolercontrol.enable` option instead. - To avoid delaying user logins unnecessarily the `multi-user.target` is no longer ordered after `network-online.target`. diff --git a/pkgs/by-name/co/conduwuit/package.nix b/pkgs/by-name/co/conduwuit/package.nix index 89af36894092..a4436d7b0620 100644 --- a/pkgs/by-name/co/conduwuit/package.nix +++ b/pkgs/by-name/co/conduwuit/package.nix @@ -98,6 +98,9 @@ rustPlatform.buildRustPackage rec { homepage = "https://conduwuit.puppyirl.gay/"; changelog = "https://github.com/girlbossceo/conduwuit/releases/tag/v${version}"; license = lib.licenses.asl20; + knownVulnerabilities = [ + "On April 11, 2025, the conduwuit project officially ceased development" + ]; maintainers = with lib.maintainers; [ niklaskorz ]; # Not a typo, conduwuit is a drop-in replacement for conduit. mainProgram = "conduit"; From d2fb99b640cdf37735f03958ad29001bf69963e6 Mon Sep 17 00:00:00 2001 From: Niklas Korz Date: Fri, 11 Apr 2025 22:19:06 +0200 Subject: [PATCH 2/2] nixos/conduwuit: remove As the conduwuit project has been officially discontinued, and the conduwuit NixOS module hasn't been around long enough to appear in any stable NixOS release, we've removed it. --- .../manual/release-notes/rl-2505.section.md | 2 - nixos/modules/module-list.nix | 1 - nixos/modules/rename.nix | 4 + nixos/modules/services/matrix/conduwuit.nix | 265 ------------------ nixos/tests/all-tests.nix | 1 - nixos/tests/matrix/conduwuit.nix | 103 ------- pkgs/by-name/co/conduwuit/package.nix | 15 +- 7 files changed, 9 insertions(+), 382 deletions(-) delete mode 100644 nixos/modules/services/matrix/conduwuit.nix delete mode 100644 nixos/tests/matrix/conduwuit.nix diff --git a/nixos/doc/manual/release-notes/rl-2505.section.md b/nixos/doc/manual/release-notes/rl-2505.section.md index b73d8b2db4b8..c13ba556a69e 100644 --- a/nixos/doc/manual/release-notes/rl-2505.section.md +++ b/nixos/doc/manual/release-notes/rl-2505.section.md @@ -85,8 +85,6 @@ - [ncps](https://github.com/kalbasit/ncps), a Nix binary cache proxy service implemented in Go using [go-nix](https://github.com/nix-community/go-nix). Available as [services.ncps](options.html#opt-services.ncps.enable). -- [Conduwuit](https://conduwuit.puppyirl.gay/), a federated chat server implementing the Matrix protocol, forked from Conduit. Available as [services.conduwuit](#opt-services.conduwuit.enable). - - [Readeck](https://readeck.org/), a read-it later web-application. Available as [services.readeck](#opt-services.readeck.enable). - [Traccar](https://www.traccar.org/), a modern GPS Tracking Platform. Available as [services.traccar](#opt-services.traccar.enable). diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix index fadee10d20ce..b71aa4867252 100644 --- a/nixos/modules/module-list.nix +++ b/nixos/modules/module-list.nix @@ -748,7 +748,6 @@ ./services/matrix/appservice-discord.nix ./services/matrix/appservice-irc.nix ./services/matrix/conduit.nix - ./services/matrix/conduwuit.nix ./services/matrix/dendrite.nix ./services/matrix/hebbot.nix ./services/matrix/hookshot.nix diff --git a/nixos/modules/rename.nix b/nixos/modules/rename.nix index 49872bc7a96b..0e8711fd489a 100644 --- a/nixos/modules/rename.nix +++ b/nixos/modules/rename.nix @@ -311,6 +311,10 @@ in (mkRemovedOptionModule [ "services" "rippleDataApi" ] '' The corresponding package was broken, abandoned upstream and thus removed from nixpkgs. '') + (mkRemovedOptionModule [ "services" "conduwuit" ] '' + The conduwuit project has been discontinued by upstream. + See https://github.com/NixOS/nixpkgs/pull/397902 for more information. + '') # Do NOT add any option renames here, see top of the file ]; diff --git a/nixos/modules/services/matrix/conduwuit.nix b/nixos/modules/services/matrix/conduwuit.nix deleted file mode 100644 index b4d9fdd1c95e..000000000000 --- a/nixos/modules/services/matrix/conduwuit.nix +++ /dev/null @@ -1,265 +0,0 @@ -{ - config, - lib, - pkgs, - ... -}: -let - cfg = config.services.conduwuit; - defaultUser = "conduwuit"; - defaultGroup = "conduwuit"; - - format = pkgs.formats.toml { }; - configFile = format.generate "conduwuit.toml" cfg.settings; -in -{ - meta.maintainers = with lib.maintainers; [ niklaskorz ]; - options.services.conduwuit = { - enable = lib.mkEnableOption "conduwuit"; - - user = lib.mkOption { - type = lib.types.nonEmptyStr; - description = '' - The user {command}`conduwuit` is run as. - ''; - default = defaultUser; - }; - - group = lib.mkOption { - type = lib.types.nonEmptyStr; - description = '' - The group {command}`conduwuit` is run as. - ''; - default = defaultGroup; - }; - - extraEnvironment = lib.mkOption { - type = lib.types.attrsOf lib.types.str; - description = "Extra Environment variables to pass to the conduwuit server."; - default = { }; - example = { - RUST_BACKTRACE = "yes"; - }; - }; - - package = lib.mkPackageOption pkgs "conduwuit" { }; - - settings = lib.mkOption { - type = lib.types.submodule { - freeformType = format.type; - options = { - global.server_name = lib.mkOption { - type = lib.types.nonEmptyStr; - example = "example.com"; - description = "The server_name is the name of this server. It is used as a suffix for user and room ids."; - }; - global.address = lib.mkOption { - type = lib.types.nullOr (lib.types.listOf lib.types.nonEmptyStr); - default = null; - example = [ - "127.0.0.1" - "::1" - ]; - description = '' - Addresses (IPv4 or IPv6) to listen on for connections by the reverse proxy/tls terminator. - If set to `null`, conduwuit will listen on IPv4 and IPv6 localhost. - Must be `null` if `unix_socket_path` is set. - ''; - }; - global.port = lib.mkOption { - type = lib.types.listOf lib.types.port; - default = [ 6167 ]; - description = '' - The port(s) conduwuit will be running on. - You need to set up a reverse proxy in your web server (e.g. apache or nginx), - so all requests to /_matrix on port 443 and 8448 will be forwarded to the conduwuit - instance running on this port. - ''; - }; - global.unix_socket_path = lib.mkOption { - type = lib.types.nullOr lib.types.path; - default = null; - description = '' - Listen on a UNIX socket at the specified path. If listening on a UNIX socket, - listening on an address will be disabled. The `address` option must be set to - `null` (the default value). The option {option}`services.conduwuit.group` must - be set to a group your reverse proxy is part of. - - This will automatically add a system user "conduwuit" to your system if - {option}`services.conduwuit.user` is left at the default, and a "conduwuit" - group if {option}`services.conduwuit.group` is left at the default. - ''; - }; - global.unix_socket_perms = lib.mkOption { - type = lib.types.ints.positive; - default = 660; - description = "The default permissions (in octal) to create the UNIX socket with."; - }; - global.max_request_size = lib.mkOption { - type = lib.types.ints.positive; - default = 20000000; - description = "Max request size in bytes. Don't forget to also change it in the proxy."; - }; - global.allow_registration = lib.mkOption { - type = lib.types.bool; - default = false; - description = '' - Whether new users can register on this server. - - Registration with token requires `registration_token` or `registration_token_file` to be set. - - If set to true without a token configured, and - `yes_i_am_very_very_sure_i_want_an_open_registration_server_prone_to_abuse` - is set to true, users can freely register. - ''; - }; - global.allow_encryption = lib.mkOption { - type = lib.types.bool; - default = true; - description = "Whether new encrypted rooms can be created. Note: existing rooms will continue to work."; - }; - global.allow_federation = lib.mkOption { - type = lib.types.bool; - default = true; - description = '' - Whether this server federates with other servers. - ''; - }; - global.trusted_servers = lib.mkOption { - type = lib.types.listOf lib.types.nonEmptyStr; - default = [ "matrix.org" ]; - description = '' - Servers listed here will be used to gather public keys of other servers - (notary trusted key servers). - - Currently, conduwuit doesn't support inbound batched key requests, so - this list should only contain other Synapse servers. - - Example: `[ "matrix.org" "constellatory.net" "tchncs.de" ]` - ''; - }; - global.database_path = lib.mkOption { - readOnly = true; - type = lib.types.path; - default = "/var/lib/conduwuit/"; - description = '' - Path to the conduwuit database, the directory where conduwuit will save its data. - Note that database_path cannot be edited because of the service's reliance on systemd StateDir. - ''; - }; - global.allow_check_for_updates = lib.mkOption { - type = lib.types.bool; - default = false; - description = '' - If enabled, conduwuit will send a simple GET request periodically to - for any new announcements made. - Despite the name, this is not an update check endpoint, it is simply an announcement check endpoint. - - Disabled by default. - ''; - }; - }; - }; - default = { }; - # TOML does not allow null values, so we use null to omit those fields - apply = lib.filterAttrsRecursive (_: v: v != null); - description = '' - Generates the conduwuit.toml configuration file. Refer to - - for details on supported values. - ''; - }; - }; - - config = lib.mkIf cfg.enable { - assertions = [ - { - assertion = !(cfg.settings ? global.unix_socket_path) || !(cfg.settings ? global.address); - message = '' - In `services.conduwuit.settings.global`, `unix_socket_path` and `address` cannot be set at the - same time. - Leave one of the two options unset or explicitly set them to `null`. - ''; - } - { - assertion = cfg.user != defaultUser -> config ? users.users.${cfg.user}; - message = "If `services.conduwuit.user` is changed, the configured user must already exist."; - } - { - assertion = cfg.group != defaultGroup -> config ? users.groups.${cfg.group}; - message = "If `services.conduwuit.group` is changed, the configured group must already exist."; - } - ]; - - users.users = lib.mkIf (cfg.user == defaultUser) { - ${defaultUser} = { - group = cfg.group; - home = cfg.settings.global.database_path; - isSystemUser = true; - }; - }; - - users.groups = lib.mkIf (cfg.group == defaultGroup) { - ${defaultGroup} = { }; - }; - - systemd.services.conduwuit = { - description = "Conduwuit Matrix Server"; - documentation = [ "https://conduwuit.puppyirl.gay/" ]; - wantedBy = [ "multi-user.target" ]; - wants = [ "network-online.target" ]; - after = [ "network-online.target" ]; - environment = lib.mkMerge ([ - { CONDUWUIT_CONFIG = configFile; } - cfg.extraEnvironment - ]); - startLimitBurst = 5; - startLimitIntervalSec = 60; - serviceConfig = { - DynamicUser = true; - User = cfg.user; - Group = cfg.group; - - DevicePolicy = "closed"; - LockPersonality = true; - MemoryDenyWriteExecute = true; - NoNewPrivileges = true; - ProtectClock = true; - ProtectControlGroups = true; - ProtectHome = true; - ProtectHostname = true; - ProtectKernelLogs = true; - ProtectKernelModules = true; - ProtectKernelTunables = true; - PrivateDevices = true; - PrivateMounts = true; - PrivateTmp = true; - PrivateUsers = true; - PrivateIPC = true; - RemoveIPC = true; - RestrictAddressFamilies = [ - "AF_INET" - "AF_INET6" - "AF_UNIX" - ]; - RestrictNamespaces = true; - RestrictRealtime = true; - SystemCallArchitectures = "native"; - SystemCallFilter = [ - "@system-service @resources" - "~@clock @debug @module @mount @reboot @swap @cpu-emulation @obsolete @timer @chown @setuid @privileged @keyring @ipc" - ]; - SystemCallErrorNumber = "EPERM"; - - StateDirectory = "conduwuit"; - StateDirectoryMode = "0700"; - RuntimeDirectory = "conduwuit"; - RuntimeDirectoryMode = "0750"; - - ExecStart = lib.getExe cfg.package; - Restart = "on-failure"; - RestartSec = 10; - }; - }; - }; -} diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix index 04caa7267e0e..7bbb84dbca4f 100644 --- a/nixos/tests/all-tests.nix +++ b/nixos/tests/all-tests.nix @@ -317,7 +317,6 @@ in coder = handleTest ./coder.nix { }; collectd = handleTest ./collectd.nix { }; commafeed = handleTest ./commafeed.nix { }; - conduwuit = runTest ./matrix/conduwuit.nix; connman = handleTest ./connman.nix { }; consul = handleTest ./consul.nix { }; consul-template = handleTest ./consul-template.nix { }; diff --git a/nixos/tests/matrix/conduwuit.nix b/nixos/tests/matrix/conduwuit.nix deleted file mode 100644 index 3e1123b692a6..000000000000 --- a/nixos/tests/matrix/conduwuit.nix +++ /dev/null @@ -1,103 +0,0 @@ -{ lib, ... }: -let - name = "conduwuit"; -in -{ - inherit name; - - nodes = { - conduwuit = { - services.conduwuit = { - enable = true; - settings.global = { - server_name = name; - address = [ "0.0.0.0" ]; - allow_registration = true; - yes_i_am_very_very_sure_i_want_an_open_registration_server_prone_to_abuse = true; - }; - extraEnvironment.RUST_BACKTRACE = "yes"; - }; - networking.firewall.allowedTCPPorts = [ 6167 ]; - }; - client = - { pkgs, ... }: - { - environment.systemPackages = [ - (pkgs.writers.writePython3Bin "do_test" { libraries = [ pkgs.python3Packages.matrix-nio ]; } '' - import asyncio - import nio - - - async def main() -> None: - # Connect to conduwuit - client = nio.AsyncClient("http://conduwuit:6167", "alice") - - # Register as user alice - response = await client.register("alice", "my-secret-password") - - # Log in as user alice - response = await client.login("my-secret-password") - - # Create a new room - response = await client.room_create(federate=False) - print("Matrix room create response:", response) - assert isinstance(response, nio.RoomCreateResponse) - room_id = response.room_id - - # Join the room - response = await client.join(room_id) - print("Matrix join response:", response) - assert isinstance(response, nio.JoinResponse) - - # Send a message to the room - response = await client.room_send( - room_id=room_id, - message_type="m.room.message", - content={ - "msgtype": "m.text", - "body": "Hello conduwuit!" - } - ) - print("Matrix room send response:", response) - assert isinstance(response, nio.RoomSendResponse) - - # Sync responses - response = await client.sync(timeout=30000) - print("Matrix sync response:", response) - assert isinstance(response, nio.SyncResponse) - - # Check the message was received by conduwuit - last_message = response.rooms.join[room_id].timeline.events[-1].body - assert last_message == "Hello conduwuit!" - - # Leave the room - response = await client.room_leave(room_id) - print("Matrix room leave response:", response) - assert isinstance(response, nio.RoomLeaveResponse) - - # Close the client - await client.close() - - - if __name__ == "__main__": - asyncio.run(main()) - '') - ]; - }; - }; - - testScript = '' - start_all() - - with subtest("start conduwuit"): - conduwuit.wait_for_unit("conduwuit.service") - conduwuit.wait_for_open_port(6167) - - with subtest("ensure messages can be exchanged"): - client.succeed("do_test >&2") - ''; - - meta.maintainers = with lib.maintainers; [ - niklaskorz - ]; -} diff --git a/pkgs/by-name/co/conduwuit/package.nix b/pkgs/by-name/co/conduwuit/package.nix index a4436d7b0620..15ebfc2e3649 100644 --- a/pkgs/by-name/co/conduwuit/package.nix +++ b/pkgs/by-name/co/conduwuit/package.nix @@ -15,7 +15,6 @@ rust-jemalloc-sys, enableLiburing ? stdenv.hostPlatform.isLinux, liburing, - nixosTests, }: let rust-jemalloc-sys' = rust-jemalloc-sys.override { @@ -81,16 +80,12 @@ rustPlatform.buildRustPackage rec { passthru = { updateScript = nix-update-script { }; - tests = - { - version = testers.testVersion { - inherit version; - package = conduwuit; - }; - } - // lib.optionalAttrs stdenv.hostPlatform.isLinux { - inherit (nixosTests) conduwuit; + tests = { + version = testers.testVersion { + inherit version; + package = conduwuit; }; + }; }; meta = {