blob: 864ef9e20083784a07d714c0e62b1759bd0072d6 (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
|
{ lib
, pkgs
, config
, ...
}:
with lib;
let
cfg = config.services.matter-server;
storageDir = "matter-server";
storagePath = "/var/lib/${storageDir}";
vendorId = "4939"; # home-assistant vendor ID
in
{
meta.maintainers = with lib.maintainers; [ leonm1 ];
options.services.matter-server = with types; {
enable = mkEnableOption (lib.mdDoc "Matter-server");
package = mkPackageOptionMD pkgs "python-matter-server" { };
port = mkOption {
type = types.port;
default = 5580;
description = "Port to expose the matter-server service on.";
};
logLevel = mkOption {
type = types.enum [ "critical" "error" "warning" "info" "debug" ];
default = "info";
description = "Verbosity of logs from the matter-server";
};
extraArgs = mkOption {
type = listOf str;
default = [];
description = ''
Extra arguments to pass to the matter-server executable.
See https://github.com/home-assistant-libs/python-matter-server?tab=readme-ov-file#running-the-development-server for options.
'';
};
};
config = mkIf cfg.enable {
systemd.services.matter-server = {
after = [ "network-online.target" ];
before = [ "home-assistant.service" ];
wants = [ "network-online.target" ];
wantedBy = [ "multi-user.target" ];
description = "Matter Server";
environment.HOME = storagePath;
serviceConfig = {
ExecStart = (concatStringsSep " " [
"${cfg.package}/bin/matter-server"
"--port" (toString cfg.port)
"--vendorid" vendorId
"--storage-path" storagePath
"--log-level" "${cfg.logLevel}"
"${escapeShellArgs cfg.extraArgs}"
]);
# Start with a clean root filesystem, and allowlist what the container
# is permitted to access.
TemporaryFileSystem = "/";
# Allowlist /nix/store (to allow the binary to find its dependencies)
# and dbus.
ReadOnlyPaths = "/nix/store /run/dbus";
# Let systemd manage `/var/lib/matter-server` for us inside the
# ephemeral TemporaryFileSystem.
StateDirectory = storageDir;
# `python-matter-server` writes to /data even when a storage-path is
# specified. This bind-mount points /data at the systemd-managed
# /var/lib/matter-server, so all files get dropped into the state
# directory.
BindPaths = "${storagePath}:/data";
# Hardening bits
AmbientCapabilities = "";
CapabilityBoundingSet = "";
DevicePolicy = "closed";
DynamicUser = true;
LockPersonality = true;
MemoryDenyWriteExecute = true;
NoNewPrivileges = true;
PrivateDevices = true;
PrivateTmp = true;
PrivateUsers = true;
ProcSubset = "pid";
ProtectClock = true;
ProtectControlGroups = true;
ProtectHome = true;
ProtectHostname = true;
ProtectKernelLogs = true;
ProtectKernelModules = true;
ProtectKernelTunables = true;
ProtectProc = "invisible";
RestrictAddressFamilies = [
"AF_INET"
"AF_INET6"
"AF_NETLINK"
];
RestrictNamespaces = true;
RestrictRealtime = true;
RestrictSUIDSGID = true;
SystemCallFilter = concatStringsSep " " [
"~" # Blocklist
"@clock"
"@cpu-emulation"
"@debug"
"@module"
"@mount"
"@obsolete"
"@privileged"
"@raw-io"
"@reboot"
"@resources"
"@swap"
];
UMask = "0077";
};
};
};
}
|