diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 1f25d3342016e70..c364fbf626c788d 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -17503,6 +17503,13 @@
     githubId = 76747196;
     name = "Robert Rose";
   };
+  RorySys = {
+    email = "root@rory.gay";
+    github = "TheArcaneBrony";
+    githubId = 13570458;
+    matrix = "@emma:rory.gay"; # preferred
+    name = "Rory&";
+  };
   rosehobgoblin = {
     name = "J. L. Bowden";
     github = "rosehobgoblin";
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index 14ff9fd8b68f69f..433a24b95d20e44 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -682,6 +682,7 @@
   ./services/matrix/conduit.nix
   ./services/matrix/dendrite.nix
   ./services/matrix/hebbot.nix
+  ./services/matrix/draupnir.nix
   ./services/matrix/maubot.nix
   ./services/matrix/mautrix-facebook.nix
   ./services/matrix/mautrix-meta.nix
diff --git a/nixos/modules/services/matrix/draupnir.md b/nixos/modules/services/matrix/draupnir.md
new file mode 100644
index 000000000000000..e7b42dbe91408c7
--- /dev/null
+++ b/nixos/modules/services/matrix/draupnir.md
@@ -0,0 +1,86 @@
+# Draupnir (Matrix Moderation Bot) {#module-services-draupnir}
+
+This chapter will show you how to set up your own, self-hosted
+[Draupnir](https://github.com/the-draupnir-project/Draupnir) instance.
+
+As an all-in-one moderation tool, it can protect your server from
+malicious invites, spam messages, and whatever else you don't want.
+In addition to server-level protection, Draupnir is great for communities
+wanting to protect their rooms without having to use their personal
+accounts for moderation.
+
+The bot by default includes support for bans, redactions, anti-spam,
+server ACLs, room directory changes, room alias transfers, account
+deactivation, room shutdown, and more. (This depends on homeserver configuration and implementation.)
+
+See the [README](https://github.com/the-draupnir-project/draupnir#readme)
+page and the [Moderator's guide](https://the-draupnir-project.github.io/draupnir-documentation/moderator/setting-up-and-configuring)
+for additional instructions on how to setup and use Draupnir.
+
+For [additional settings](#opt-services.draupnir.settings)
+see [the default configuration](https://github.com/the-draupnir-project/Draupnir/blob/main/config/default.yaml).
+
+## Draupnir Setup {#module-services-draupnir-setup}
+
+First create a new Room which will be used as a management room for Draupnir. In
+this room, Draupnir will log possible errors and debugging information. You'll
+need to set this Room-ID in [services.draupnir.settings.managementRoom](#opt-services.draupnir.settings.managementRoom).
+
+Next, create a new user for Draupnir on your homeserver, if not present already.
+
+The Draupnir Matrix user expects to be free of any rate limiting.
+See [Synapse #6286](https://github.com/matrix-org/synapse/issues/6286)
+for an example on how to achieve this.
+
+If you want Draupnir to be able to deactivate users, move room aliases, shut down rooms, etc.
+you'll need to make the Draupnir user a Matrix server admin.
+
+Now invite the Draupnir user to the management room.
+
+It is not recommended to use End to End Encryption when not needed,
+as it is known to break parts of Draupnir.
+
+To enable the Pantalaimon E2EE Proxy for Draupnir, enable
+[services.draupnir.pantalaimon](#opt-services.draupnir.pantalaimon.enable). This will
+autoconfigure a new Pantalaimon instance, which will connect to the homeserver
+set in [services.draupnir.homeserverUrl](#opt-services.draupnir.homeserverUrl) and Draupnir itself
+will be configured to connect to the new Pantalaimon instance.
+
+```
+{
+  services.draupnir = {
+    enable = true;
+
+    # Point this to your reverse proxy, if eg. Synapse's workers are in use!
+    homeserverUrl = "http://localhost:8008";
+
+    settings = {
+      managementRoom = "!yyy:domain.tld";
+    };
+  };
+}
+```
+
+Additional config for Pantalaimon:
+```
+pantalaimon = {
+  enable = true;
+  username = "draupnir";
+  passwordFile = "/run/secrets/draupnir-password";
+  options = {
+    ssl = false;
+  };
+};
+```
+
+### Element Matrix Services (EMS) {#module-services-draupnir-setup-ems}
+
+If you are using a managed ["Element Matrix Services (EMS)"](https://ems.element.io/)
+server, you will need to consent to the terms and conditions. Upon startup, an error
+log entry with a URL to the consent page will be generated.
+
+## Synapse Antispam Module {#module-services-draupnir-matrix-synapse-antispam}
+
+Use the Mjolnir Antispam module, Draupnir made no changes here and as such was not packaged.
+It may be possible that the Mjolir Antispam module does *not* work with Draupnir in the future,
+nor is the one in the Draupnir repository maintained or tested.
diff --git a/nixos/modules/services/matrix/draupnir.nix b/nixos/modules/services/matrix/draupnir.nix
new file mode 100644
index 000000000000000..6b19a362972b36b
--- /dev/null
+++ b/nixos/modules/services/matrix/draupnir.nix
@@ -0,0 +1,238 @@
+{ config, lib, pkgs, utils, ... }:
+
+let
+  cfg = config.services.draupnir;
+
+  format = pkgs.formats.yaml {};
+  configFile = format.generate "draupnir.yaml" (lib.filterAttrsRecursive (_: value: value != null) cfg.settings);
+in
+{
+  #region Options
+  options.services.draupnir = {
+    enable = lib.mkEnableOption "Draupnir, a moderation bot for Matrix";
+
+    package = lib.mkPackageOption pkgs "draupnir" { };
+
+    accessTokenFile = lib.mkOption {
+      type = with lib.types; nullOr path;
+      default = null;
+      description = ''
+        File containing the access token for Draupnir's Matrix account.
+        Make sure this does not contain newlines if writing manually: `:set noeol nofixeol` for vim or -L for nano.
+      '';
+    };
+
+    homeserverUrl = lib.mkOption {
+      type = lib.types.str;
+      description = ''
+        Base URL of the Matrix homeserver, that provides the Client-Server API.
+        Will be used by either Draupnir directly, or by Pantalaimon, if enabled.
+      '';
+    };
+
+    #region Pantalaimon options
+    pantalaimon = lib.mkOption {
+      description = ''
+        `pantalaimon` options (enables E2E Encryption support).
+
+        This will create a `pantalaimon` instance with the name "draupnir".
+      '';
+      default = { };
+      type = lib.types.submodule {
+        options = {
+          enable = lib.mkEnableOption (''
+            pantalaimon, in order to enable E2EE support.
+            If `true`, accessToken is ignored and the username/password below will be
+            used instead. The access token of the bot will be stored in /var/lib/draupnir.
+          '');
+
+          username = lib.mkOption {
+            type = lib.types.str;
+            description = ''
+              Account name on the Matrix homeserver.
+            '';
+          };
+
+          passwordFile = lib.mkOption {
+            type = with lib.types; nullOr path;
+            default = null;
+            description = ''
+              File containing the password for the Matrix account.
+              Make sure this does not contain newlines if writing manually: `:set noeol nofixeol` for vim or -L for nano.
+            '';
+          };
+
+          options = lib.mkOption {
+            type = lib.types.submodule (import ./pantalaimon-options.nix { inherit lib; inherit config; name = "draupnir"; });
+            default = { };
+            description = ''
+              Pass through additional options to the `pantalaimon` service.
+            '';
+          };
+        };
+      };
+    };
+    #endregion
+
+    #region Draupnir settings
+    settings = lib.mkOption {
+      example = lib.literalExpression ''
+        {
+          autojoinOnlyIfManager = true;
+          automaticallyRedactForReasons = [ "spam" "advertising" ];
+        }
+      '';
+      description = ''
+        Draupnir settings (see [Draupnir's default configuration](https://github.com/the-draupnir-project/Draupnir/blob/main/config/default.yaml) for available settings).
+      '';
+      default = { };
+      type = lib.types.submodule {
+        freeformType = format.type;
+        options = {
+          #region Readonly settings - these settings are not configurable
+          dataPath = lib.mkOption {
+            type = lib.types.str;
+            default = "/var/lib/draupnir";
+            readOnly = true;
+            description = ''
+              The path where Draupnir stores its data.
+
+              ::: {.note}
+                If you want to customize where this data is stored, use a bind mount.
+              :::
+            '';
+          };
+          #endregion
+
+          #region Base settings
+          managementRoom = lib.mkOption {
+            type = lib.types.str;
+            example = "#moderators:example.org";
+            description = ''
+              The room ID or alias where moderators can use the bot's functionality.
+
+              The bot has no access controls, so anyone in this room can use the bot - secure this room!
+
+              Warning: When using a room alias, make sure the alias used is on the local homeserver!
+              This prevents an issue where the control room becomes undefined when the alias can't be resolved.
+            '';
+          };
+          #endregion
+        };
+      };
+    };
+    #endregion
+  };
+  #endregion
+
+  #region Service configuration
+  config = lib.mkIf cfg.enable {
+    assertions = [
+      # pantalaimon enabled - use passwordFile instead of accessTokenFile
+      {
+        assertion = cfg.pantalaimon.enable -> cfg.pantalaimon.passwordFile != null;
+        message = "Set services.draupnir.pantailaimon.passwordFile, as it is required in order to use Pantalaimon.";
+      }
+      {
+        assertion = cfg.pantalaimon.enable -> cfg.accessTokenFile == null;
+        message = "Unset services.draupnir.accessTokenFile, as it has no effect when Pantalaimon is enabled.";
+      }
+
+      # pantalaimon disabled - use accessTokenFile instead of passwordFile
+      {
+        assertion = !cfg.pantalaimon.enable -> cfg.accessTokenFile != null;
+        message = "Set services.draupnir.accessTokenFile, as it is required in order to use Draupnir without Pantalaimon.";
+      }
+      {
+        assertion = !cfg.pantalaimon.enable -> cfg.pantalaimon.passwordFile == null;
+        message = "Unset services.draupnir.pantalaimon.passwordFile, as it has no effect when Pantalaimon is disabled.";
+      }
+      # Removed options for those migrating from the Mjolnir module - mkRemovedOption module does *not* work with submodules.
+
+      # Noop in v2, but should ideally not be used in mjolnir or 1.x either.
+      {
+        assertion = (cfg.settings ? protectedRooms) == false;
+        message = "Unset services.draupnir.settings.protectedRooms, as it is unsupported on Draupnir. Add these rooms via `!draupnir rooms add` instead.";
+      }
+    ];
+
+    warnings = [ ]
+      # Unsupported but available options
+      # - Crypto
+      ++ lib.optionals (cfg.pantalaimon.enable) [ ''Using Draupnir with Pantalaimon is known to break some features, and is thus unsupported.
+            Encryption support should only be enabled if you require an encrypted management room or use Draupnir in encrypted rooms.'' ]
+      ++ lib.optionals (cfg.settings ? experimentalRustCrypto && cfg.settings.experimentalRustCrypto) [ ''Using Draupnir with experimental Rust Crypto support is untested and unsupported.
+            Encryption support should only be enabled if you require an encrypted management room or use Draupnir in encrypted rooms.'' ]
+
+      # - Deprecated options
+      ++ lib.optionals (cfg.settings ? verboseLogging && cfg.settings.verboseLogging) [ "Verbose logging in Draupnir is deprecated and may be removed in a future version." ]
+    ;
+
+    services.pantalaimon-headless.instances.draupnir = lib.mkIf cfg.pantalaimon.enable (cfg.pantalaimon.options // { homeserver = cfg.homeserverUrl; });
+    services.draupnir.settings.homeserverUrl = if cfg.pantalaimon.enable
+      then (with config.services.pantalaimon-headless.instances.draupnir; "http://${listenAddress}:${toString listenPort}/")
+      else cfg.homeserverUrl;
+    services.draupnir.settings.pantalaimon = lib.mkIf cfg.pantalaimon.enable ({
+      use = true;
+      username = cfg.pantalaimon.username;
+    });
+
+    systemd.services.draupnir = {
+      description = "Draupnir - a moderation bot for Matrix";
+      requires = lib.optionals (cfg.pantalaimon.enable) [
+        "pantalaimon-draupnir.service"
+      ];
+      wants = [
+        "network-online.target"
+        "matrix-synapse.service"
+        "conduit.service"
+        "dendrite.service"
+      ];
+      after = [
+        "network-online.target"
+        "matrix-synapse.service"
+        "conduit.service"
+        "dendrite.service"
+      ];
+      wantedBy = [ "multi-user.target" ];
+
+      serviceConfig = {
+        ExecStart = utils.escapeSystemdExecArgs ([
+          (lib.getExe cfg.package)
+          "--draupnir-config" configFile
+        ] ++ lib.optionals (cfg.pantalaimon.enable && cfg.pantalaimon.passwordFile != null) [
+          "--pantalaimon-password-path"
+          "/run/credentials/draupnir.service/pantalaimon_password"
+        ] ++ lib.optionals (!cfg.pantalaimon.enable && cfg.accessTokenFile != null) [
+          "--access-token-path"
+          "/run/credentials/draupnir.service/access_token"
+        ]);
+
+        WorkingDirectory = "/var/lib/draupnir";
+        StateDirectory = "draupnir";
+        StateDirectoryMode = "0700";
+        ProtectSystem = "strict";
+        ProtectHome = true;
+        PrivateTmp = true;
+        NoNewPrivileges = true;
+        PrivateDevices = true;
+        Restart = "on-failure";
+
+        DynamicUser = true;
+        LoadCredential =
+          lib.optionals (cfg.accessTokenFile != null) [
+            "access_token:${cfg.accessTokenFile}"
+          ]
+          ++ lib.optionals (cfg.pantalaimon.enable && cfg.pantalaimon.passwordFile != null) [
+            "pantalaimon_password:${cfg.pantalaimon.passwordFile}"
+          ];
+      };
+    };
+  };
+  #endregion
+
+  meta = {
+    doc = ./draupnir.md;
+    maintainers = with lib.maintainers; [ RorySys ];
+  };
+}
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 0852f2350e1dc39..73fdd961047a03b 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -273,6 +273,7 @@ in {
   domination = handleTest ./domination.nix {};
   dovecot = handleTest ./dovecot.nix {};
   drawterm = discoverTests (import ./drawterm.nix);
+  draupnir = handleTest ./matrix/draupnir.nix {};
   drbd = handleTest ./drbd.nix {};
   dublin-traceroute = handleTest ./dublin-traceroute.nix {};
   earlyoom = handleTestOn ["x86_64-linux"] ./earlyoom.nix {};
diff --git a/nixos/tests/matrix/draupnir.nix b/nixos/tests/matrix/draupnir.nix
new file mode 100644
index 000000000000000..c4d9664da5be4ca
--- /dev/null
+++ b/nixos/tests/matrix/draupnir.nix
@@ -0,0 +1,224 @@
+import ../make-test-python.nix (
+  { pkgs, ... }:
+  let
+    # Set up SSL certs for Synapse to be happy.
+    runWithOpenSSL = file: cmd: pkgs.runCommand file
+      {
+        buildInputs = [ pkgs.openssl ];
+      }
+      cmd;
+
+    ca_key = runWithOpenSSL "ca-key.pem" "openssl genrsa -out $out 2048";
+    ca_pem = runWithOpenSSL "ca.pem" ''
+      openssl req \
+        -x509 -new -nodes -key ${ca_key} \
+        -days 10000 -out $out -subj "/CN=snakeoil-ca"
+    '';
+    key = runWithOpenSSL "matrix_key.pem" "openssl genrsa -out $out 2048";
+    csr = runWithOpenSSL "matrix.csr" ''
+      openssl req \
+         -new -key ${key} \
+         -out $out -subj "/CN=localhost" \
+    '';
+    cert = runWithOpenSSL "matrix_cert.pem" ''
+      openssl x509 \
+        -req -in ${csr} \
+        -CA ${ca_pem} -CAkey ${ca_key} \
+        -CAcreateserial -out $out \
+        -days 365
+    '';
+  in
+  {
+    name = "draupnir";
+    meta = with pkgs.lib; {
+      maintainers = [ maintainers.RorySys ];
+    };
+
+    nodes = {
+      homeserver = { pkgs, ... }: {
+        services.matrix-synapse = {
+          enable = true;
+          settings = {
+            database.name = "sqlite3";
+            tls_certificate_path = "${cert}";
+            tls_private_key_path = "${key}";
+            enable_registration = true;
+            enable_registration_without_verification = true;
+            registration_shared_secret = "supersecret-registration";
+
+            listeners = [ {
+              # The default but tls=false
+              bind_addresses = [
+                "0.0.0.0"
+              ];
+              port = 8448;
+              resources = [ {
+                compress = true;
+                names = [ "client" ];
+              } {
+                compress = false;
+                names = [ "federation" ];
+              } ];
+              tls = false;
+              type = "http";
+              x_forwarded = false;
+            } ];
+          };
+        };
+
+        networking.firewall.allowedTCPPorts = [ 8448 ];
+
+        environment.systemPackages = [
+          (pkgs.writeShellScriptBin "register_draupnir_user" ''
+            exec ${pkgs.matrix-synapse}/bin/register_new_matrix_user \
+              -u draupnir \
+              -p draupnir-password \
+              --admin \
+              --shared-secret supersecret-registration \
+              http://localhost:8448
+          ''
+          )
+          (pkgs.writeShellScriptBin "register_moderator_user" ''
+            exec ${pkgs.matrix-synapse}/bin/register_new_matrix_user \
+              -u moderator \
+              -p moderator-password \
+              --no-admin \
+              --shared-secret supersecret-registration \
+              http://localhost:8448
+          ''
+          )
+        ];
+      };
+
+      draupnir = { ... }: {
+        services.draupnir = {
+          enable = true;
+          homeserverUrl = "http://homeserver:8448";
+          accessTokenFile = "/tmp/draupnir-access-token";
+          settings = {
+            managementRoom = "#moderators:homeserver";
+          };
+        };
+        environment.systemPackages = [
+          (pkgs.writeShellScriptBin "get_draupnir_access_token" ''
+            exec ${pkgs.curl}/bin/curl \
+              -X POST -s \
+              -d '{"type":"m.login.password", "user":"draupnir", "password":"draupnir-password"}' \
+              http://homeserver:8448/_matrix/client/v3/login \
+              | ${pkgs.jq}/bin/jq --join-output '.access_token' \
+              > /tmp/draupnir-access-token
+          ''
+          )
+        ];
+      };
+
+      draupnirpantalaimon = { pkgs, ... }: {
+        services.draupnir = {
+          enable = true;
+          homeserverUrl = "http://homeserver:8448";
+          pantalaimon = {
+            enable = true;
+            username = "draupnir";
+            passwordFile = pkgs.writeText "password.txt" "draupnir-password";
+            options = {
+              # otherwise draupnir tries to connect to ::1, which is not listened by pantalaimon
+              listenAddress = "127.0.0.1";
+            };
+          };
+          settings = {
+            managementRoom = "#moderators-encrypted:homeserver";
+          };
+        };
+      };
+
+      client = { pkgs, ... }: {
+        environment.systemPackages = [
+          (pkgs.writers.writePython3Bin "create_management_rooms_and_invite_draupnir"
+            { libraries = with pkgs.python3Packages; [
+                matrix-nio
+              ] ++ matrix-nio.optional-dependencies.e2e;
+            } ''
+            import asyncio
+
+            from nio import (
+                AsyncClient,
+                EnableEncryptionBuilder
+            )
+
+
+            async def main() -> None:
+                client = AsyncClient("http://homeserver:8448", "moderator")
+
+                await client.login("moderator-password")
+
+                room = await client.room_create(
+                    name="Moderators",
+                    alias="moderators",
+                )
+
+                encrypted_room = await client.room_create(
+                    name="Moderators-encrypted",
+                    alias="moderators-encrypted",
+                    initial_state=[EnableEncryptionBuilder().as_dict()],
+                )
+
+                await client.join(room.room_id)
+                await client.room_invite(room.room_id, "@draupnir:homeserver")
+
+                await client.join(encrypted_room.room_id)
+                await client.room_invite(encrypted_room.room_id, "@draupnir:homeserver")
+
+            asyncio.run(main())
+          ''
+          )
+        ];
+      };
+    };
+
+    testScript = ''
+      with subtest("start homeserver"):
+        homeserver.start()
+
+        homeserver.wait_for_unit("matrix-synapse.service")
+        homeserver.wait_until_succeeds("curl --fail -L http://localhost:8448/")
+
+      with subtest("register users"):
+        # register draupnir user
+        homeserver.succeed("register_draupnir_user")
+        # register moderator user
+        homeserver.succeed("register_moderator_user")
+
+      with subtest("start draupnir"):
+        draupnir.start()
+
+        draupnir.wait_until_succeeds("curl --fail -L http://homeserver:8448/")
+
+        draupnir.succeed("get_draupnir_access_token")
+
+        draupnir.wait_for_unit("draupnir.service")
+
+      with subtest("ensure draupnir can be invited to the management rooms"):
+        client.start()
+
+        client.wait_until_succeeds("curl --fail -L http://homeserver:8448/")
+
+        client.succeed("create_management_rooms_and_invite_draupnir")
+
+        draupnir.wait_for_console_text("Startup complete. Now monitoring rooms")
+
+      with subtest("start draupnirpantalaimon"):
+        draupnirpantalaimon.start()
+
+        # wait for pantalaimon to be ready
+        draupnirpantalaimon.wait_for_unit("pantalaimon-draupnir.service")
+        draupnirpantalaimon.wait_for_unit("draupnir.service")
+
+        draupnirpantalaimon.wait_until_succeeds("curl --fail -L http://localhost:8009/")
+
+      with subtest("ensure draupnir can be invited to the encrypted management room"):
+
+        draupnirpantalaimon.wait_for_console_text("Startup complete. Now monitoring rooms")
+    '';
+  }
+)
+
diff --git a/pkgs/by-name/dr/draupnir/hashes.json b/pkgs/by-name/dr/draupnir/hashes.json
new file mode 100644
index 000000000000000..f8ec73c940a94ee
--- /dev/null
+++ b/pkgs/by-name/dr/draupnir/hashes.json
@@ -0,0 +1,3 @@
+{
+  "yarn_offline_cache_hash": "sha256-5h8d8LKE9RIWYckbEITkYBGj5MIfScrFZiVbJXZSf+8="
+}
diff --git a/pkgs/by-name/dr/draupnir/package.json b/pkgs/by-name/dr/draupnir/package.json
new file mode 100644
index 000000000000000..0c73708386e022d
--- /dev/null
+++ b/pkgs/by-name/dr/draupnir/package.json
@@ -0,0 +1,88 @@
+{
+  "name": "draupnir",
+  "version": "2.0.0-beta.6",
+  "description": "A moderation tool for Matrix",
+  "main": "lib/index.js",
+  "repository": "https://github.com/the-draupnir-project/Draupnir.git",
+  "author": "Gnuxie",
+  "license": "AFL-3.0",
+  "private": true,
+  "scripts": {
+    "build": "tsc --project test/tsconfig.json && tsc > /dev/null 2>&1",
+    "postbuild": "corepack yarn describe-version",
+    "describe-version": "(git describe > version.txt.tmp && mv version.txt.tmp version.txt) || true && rm -f version.txt.tmp",
+    "remove-tests-from-lib": "rm -rf lib/test/ && cp -r lib/src/* lib/ && rm -rf lib/src/",
+    "lint": "corepack yarn eslint src test && corepack yarn prettier --check src test",
+    "start:dev": "corepack yarn build && node --async-stack-traces lib/index.js",
+    "test:unit": "mocha --require './test/tsnode.cjs' --forbid-only 'test/unit/**/*.{ts,tsx}'",
+    "test:unit:single": "mocha --require test/tsnode.cjs",
+    "test:integration": "NODE_ENV=harness mocha --require test/tsnode.cjs --async-stack-traces --forbid-only --require test/integration/fixtures.ts --timeout 300000 --project ./tsconfig.json \"test/integration/**/*Test.ts\"",
+    "test:integration:single": "NODE_ENV=harness corepack yarn mocha --require test/tsnode.cjs --require test/integration/fixtures.ts --timeout 300000 --project ./tsconfig.json",
+    "test:appservice:integration": "NODE_ENV=harness mocha --require test/tsnode.cjs --async-stack-traces --forbid-only --timeout 300000 --project ./tsconfig.json \"test/appservice/integration/**/*Test.ts\"",
+    "test:appservice:integration:single": "NODE_ENV=harness corepack yarn mocha --require test/tsnode.cjs --timeout 300000 --project ./tsconfig.json",
+    "test:manual": "NODE_ENV=harness ts-node test/integration/manualLaunchScript.ts",
+    "version": "sed -i '/# version automated/s/[0-9][0-9]*\\.[0-9][0-9]*\\.[0-9][^\"]*/'$npm_package_version'/' synapse_antispam/setup.py && git add synapse_antispam/setup.py && cat synapse_antispam/setup.py"
+  },
+  "devDependencies": {
+    "@eslint/js": "^9.7.0",
+    "@types/better-sqlite3": "^7.6.9",
+    "@types/config": "^3.3.1",
+    "@types/crypto-js": "^4.2.2",
+    "@types/eslint__js": "^8.42.3",
+    "@types/express": "^4.17.21",
+    "@types/html-to-text": "^8.0.1",
+    "@types/humanize-duration": "^3.27.1",
+    "@types/js-yaml": "^4.0.9",
+    "@types/jsdom": "21.1.6",
+    "@types/mocha": "^10.0.7",
+    "@types/nedb": "^1.8.16",
+    "@types/node": "^20.14.11",
+    "@types/pg": "^8.6.5",
+    "@types/request": "^2.48.12",
+    "@types/shell-quote": "1.7.1",
+    "crypto-js": "^4.2.0",
+    "eslint": "^9.7.0",
+    "expect": "^29.7.0",
+    "mocha": "^10.7.0",
+    "prettier": "^3.3.3",
+    "ts-auto-mock": "^3.7.4",
+    "ts-node": "^10.9.2",
+    "typescript": "^5.5.3",
+    "typescript-eslint": "^7.16.1",
+    "typescript-formatter": "^7.2"
+  },
+  "dependencies": {
+    "@gnuxie/typescript-result": "^1.0.0",
+    "@sentry/node": "^7.17.2",
+    "@sentry/tracing": "^7.17.2",
+    "@sinclair/typebox": "0.32.34",
+    "@the-draupnir-project/interface-manager": "^2.3.0",
+    "@the-draupnir-project/matrix-basic-types": "^0.2.0",
+    "await-lock": "^2.2.2",
+    "better-sqlite3": "^9.4.3",
+    "body-parser": "^1.20.2",
+    "config": "^3.3.9",
+    "express": "^4.19",
+    "html-to-text": "^8.0.0",
+    "humanize-duration": "^3.27.1",
+    "humanize-duration-ts": "^2.1.1",
+    "js-yaml": "^4.1.0",
+    "jsdom": "^24.0.0",
+    "matrix-appservice-bridge": "^9.0.1",
+    "matrix-protection-suite": "npm:@gnuxie/matrix-protection-suite@1.3.0",
+    "matrix-protection-suite-for-matrix-bot-sdk": "npm:@gnuxie/matrix-protection-suite-for-matrix-bot-sdk@1.3.0",
+    "parse-duration": "^1.0.2",
+    "pg": "^8.8.0",
+    "shell-quote": "^1.7.3",
+    "ulidx": "^2.2.1",
+    "yaml": "^2.3.2"
+  },
+  "overrides": {
+    "matrix-bot-sdk": "$@vector-im/matrix-bot-sdk",
+    "@vector-im/matrix-bot-sdk": "npm:@vector-im/matrix-bot-sdk@^0.6.6-element.1"
+  },
+  "engines": {
+    "node": ">=18.0.0"
+  },
+  "packageManager": "yarn@1.22.22+sha1.ac34549e6aa8e7ead463a7407e1c7390f61a6610"
+}
diff --git a/pkgs/by-name/dr/draupnir/package.nix b/pkgs/by-name/dr/draupnir/package.nix
new file mode 100644
index 000000000000000..9ac8c17cd185565
--- /dev/null
+++ b/pkgs/by-name/dr/draupnir/package.nix
@@ -0,0 +1,123 @@
+{ lib
+, fetchFromGitHub
+, makeWrapper
+, nodejs
+, matrix-sdk-crypto-nodejs
+, python3
+, sqlite
+, srcOnly
+, removeReferencesTo
+, mkYarnPackage
+, fetchYarnDeps
+, nixosTests
+}:
+
+# docs: https://github.com/NixOS/nixpkgs/blob/master/doc/languages-frameworks/javascript.section.md#yarn2nix-javascript-yarn2nix
+let
+  hashesFile = builtins.fromJSON (builtins.readFile ./hashes.json);
+  nodeSources = srcOnly nodejs;
+in
+  mkYarnPackage rec {
+    pname = "draupnir";
+    version = "2.0.0-beta.6";
+    src = fetchFromGitHub {
+      owner = "the-draupnir-project";
+      repo = "Draupnir";
+      rev = "v${version}";
+      hash = "sha256-s1LWXVwY+7LD7cJtZW7mBLsdpB499zS/nDsJ7qaQDfg=";
+    };
+
+    nativeBuildInputs = [
+      makeWrapper
+      sqlite
+    ];
+
+    offlineCache = fetchYarnDeps {
+      name = "${pname}-yarn-offline-cache";
+      yarnLock = src + "/yarn.lock";
+      hash = hashesFile.yarn_offline_cache_hash;
+    };
+
+    yarnLock = src + "/yarn.lock";
+    packageJSON = ./package.json;
+
+    pkgConfig = {
+      "@matrix-org/matrix-sdk-crypto-nodejs" = {
+        postInstall = ''
+          # replace with the built package
+          cd ..
+          rm -r matrix-sdk-crypto-nodejs
+          ln -s ${matrix-sdk-crypto-nodejs}/lib/node_modules/@matrix-org/* ./
+        '';
+      };
+
+      better-sqlite3 = {
+        nativeBuildInputs = [ python3 ];
+        postInstall = ''
+          # build native sqlite bindings
+          npm run build-release --offline --nodedir="${nodeSources}"
+          find build -type f -exec \
+            ${removeReferencesTo}/bin/remove-references-to \
+            -t "${nodeSources}" {} \;
+       '';
+      };
+    };
+
+    #prebuild phase
+    preBuild = ''
+      echo "Adding version.txt..."
+      mkdir -p deps/draupnir/
+      echo "${version}-nix" > deps/draupnir/version.txt
+
+      sed -i 's/corepack //g' deps/draupnir/package.json
+    '';
+
+    buildPhase = ''
+      runHook preBuild
+      echo "Building..."
+      yarn --offline --verbose build
+      runHook postBuild
+    '';
+
+    installPhase = ''
+      runHook preInstall
+
+      mkdir -p $out/share
+      cp -a . $out/share/draupnir
+
+      makeWrapper ${nodejs}/bin/node $out/bin/draupnir \
+        --add-flags $out/share/draupnir/deps/draupnir/lib/index.js
+
+      runHook postInstall
+    '';
+    distPhase = "true";
+
+    passthru = {
+      tests = {
+        inherit (nixosTests) draupnir;
+      };
+      updateScript = ./update.sh;
+    };
+
+    meta = with lib; {
+      description = "A moderation tool for Matrix";
+      homepage = "https://github.com/the-draupnir-project/Draupnir";
+      longDescription = ''
+        As an all-in-one moderation tool, it can protect your server from
+        malicious invites, spam messages, and whatever else you don't want.
+        In addition to server-level protection, Draupnir is great for communities
+        wanting to protect their rooms without having to use their personal
+        accounts for moderation.
+
+        The bot by default includes support for bans, redactions, anti-spam,
+        server ACLs, room directory changes, room alias transfers, account
+        deactivation, room shutdown, and more.
+
+        A Synapse module is also available to apply the same rulesets the bot
+        uses across an entire homeserver.
+      '';
+      license = licenses.afl3;
+      maintainers = with maintainers; [ RorySys ];
+      mainProgram = "draupnir";
+    };
+  }
diff --git a/pkgs/by-name/dr/draupnir/update.sh b/pkgs/by-name/dr/draupnir/update.sh
new file mode 100755
index 000000000000000..78842bfcbfc4496
--- /dev/null
+++ b/pkgs/by-name/dr/draupnir/update.sh
@@ -0,0 +1,39 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p curl common-updater-scripts coreutils jq prefetch-yarn-deps git
+
+set -euo pipefail
+set -x
+
+cd  "$(git rev-parse --show-toplevel)"
+
+TMPDIR=$(mktemp -d)
+
+echo "Getting versions..."
+latestVersion="$(curl -sL "https://api.github.com/repos/the-draupnir-project/Draupnir/releases?per_page=1" | jq -r '.[0].tag_name | ltrimstr("v")')"
+echo " --> Latest version: ${latestVersion}"
+currentVersion=$(nix-instantiate --eval -E "with import ./. {}; draupnir.version or (lib.getVersion draupnir)" | tr -d '"')
+echo " --> Current version: ${currentVersion}"
+if [[ "$currentVersion" == "$latestVersion" ]]; then
+  echo "Draupnir is up-to-date: $currentVersion"
+  exit 0
+else
+  echo "We are out of date..."
+fi
+
+curl https://raw.githubusercontent.com/the-draupnir-project/Draupnir/v$latestVersion/package.json -o pkgs/by-name/dr/draupnir/package.json
+
+update-source-version draupnir "$latestVersion"
+
+# Update yarn offline cache hash
+cd $TMPDIR
+
+curl https://raw.githubusercontent.com/the-draupnir-project/Draupnir/v$latestVersion/yarn.lock -o yarn.lock
+TMP_PREFETCH_HASH=`prefetch-yarn-deps yarn.lock`
+NEW_YARN_OFFLINE_HASH=`nix hash to-sri --type sha256 $TMP_PREFETCH_HASH`
+
+cd -
+echo "New yarn offline hash: $NEW_YARN_OFFLINE_HASH"
+
+TMPFILE=$(mktemp)
+jq '.yarn_offline_cache_hash = "'$NEW_YARN_OFFLINE_HASH'"' pkgs/by-name/dr/draupnir/hashes.json > $TMPFILE
+mv -- "$TMPFILE" pkgs/by-name/dr/draupnir/hashes.json