diff --git a/roles/custom/matrix-bridge-mautrix-signalgo/defaults/main.yml b/roles/custom/matrix-bridge-mautrix-signalgo/defaults/main.yml new file mode 100644 index 000000000..45ef0789a --- /dev/null +++ b/roles/custom/matrix-bridge-mautrix-signalgo/defaults/main.yml @@ -0,0 +1,149 @@ +--- +# mautrix-signalgo is a Matrix <-> signalgo bridge +# Project source code URL: https://github.com/mautrix/signalgo + +matrix_mautrix_signalgo_enabled: true + +matrix_mautrix_signalgo_container_image_self_build: false +matrix_mautrix_signalgo_container_image_self_build_repo: "https://mau.dev/mautrix/signalgo.git" +matrix_mautrix_signalgo_container_image_self_build_branch: "{{ 'main' if matrix_mautrix_signalgo_version == 'latest' else matrix_mautrix_signalgo_version }}" + +# renovate: datasource=docker depName=dock.mau.dev/mautrix/signalgo +matrix_mautrix_signalgo_version: 3953789ef00f5f521a26b4463aaee95aa8a929b9-amd64 + +# See: https://mau.dev/mautrix/signalgo/container_registry +matrix_mautrix_signalgo_docker_image: "{{ matrix_mautrix_signalgo_docker_image_name_prefix }}mautrix/signalgo:{{ matrix_mautrix_signalgo_version }}" +matrix_mautrix_signalgo_docker_image_name_prefix: "{{ 'localhost/' if matrix_mautrix_signalgo_container_image_self_build else 'dock.mau.dev/' }}" +matrix_mautrix_signalgo_docker_image_force_pull: "{{ matrix_mautrix_signalgo_docker_image.endswith(':latest') }}" + +matrix_mautrix_signalgo_base_path: "{{ matrix_base_data_path }}/mautrix-signalgo" +matrix_mautrix_signalgo_config_path: "{{ matrix_mautrix_signalgo_base_path }}/config" +matrix_mautrix_signalgo_data_path: "{{ matrix_mautrix_signalgo_base_path }}/data" +matrix_mautrix_signalgo_docker_src_files_path: "{{ matrix_mautrix_signalgo_base_path }}/docker-src" + +matrix_mautrix_signalgo_homeserver_address: "{{ matrix_homeserver_container_url }}" +matrix_mautrix_signalgo_homeserver_domain: "{{ matrix_domain }}" +matrix_mautrix_signalgo_appservice_address: "http://matrix-mautrix-signalgo:8080" + +matrix_mautrix_signalgo_command_prefix: "!signalgo" + +matrix_mautrix_signalgo_bridge_permissions: | + {{ + {'*': 'relay', matrix_mautrix_signalgo_homeserver_domain: 'user'} + | combine({matrix_admin: 'admin'} if matrix_admin else {}) + }} + +# A list of extra arguments to pass to the container +matrix_mautrix_signalgo_container_extra_arguments: [] + +# List of systemd services that matrix-mautrix-signalgo.service depends on. +matrix_mautrix_signalgo_systemd_required_services_list: ['docker.service'] + +# List of systemd services that matrix-mautrix-signalgo.service wants +matrix_mautrix_signalgo_systemd_wanted_services_list: [] + +matrix_mautrix_signalgo_appservice_token: '' +matrix_mautrix_signalgo_homeserver_token: '' + +matrix_mautrix_signalgo_appservice_bot_username: signalgobot + +# Minimum severity of journal log messages. +# Options: debug, info, warn, error, fatal +matrix_mautrix_signalgo_logging_level: 'warn' + +# Whether or not created rooms should have federation enabled. +# If false, created portal rooms will never be federated. +matrix_mautrix_signalgo_federate_rooms: true + +# Database-related configuration fields. +# +# To use SQLite, stick to these defaults. +# +# To use Postgres: +# - change the engine (`matrix_mautrix_signalgo_database_engine: 'postgres'`) +# - adjust your database credentials via the `matrix_mautrix_signalgo_database_*` variables +matrix_mautrix_signalgo_database_engine: 'sqlite' + +matrix_mautrix_signalgo_sqlite_database_path_local: "{{ matrix_mautrix_signalgo_data_path }}/mautrix-signalgo.db" +matrix_mautrix_signalgo_sqlite_database_path_in_container: "/data/mautrix-signalgo.db" + +matrix_mautrix_signalgo_database_username: 'matrix_mautrix_signalgo' +matrix_mautrix_signalgo_database_password: 'some-password' +matrix_mautrix_signalgo_database_hostname: '' +matrix_mautrix_signalgo_database_port: 5432 +matrix_mautrix_signalgo_database_name: 'matrix_mautrix_signalgo' +matrix_mautrix_signalgo_database_sslmode: disable + +matrix_mautrix_signalgo_database_connection_string: 'postgresql://{{ matrix_mautrix_signalgo_database_username }}:{{ matrix_mautrix_signalgo_database_password }}@{{ matrix_mautrix_signalgo_database_hostname }}:{{ matrix_mautrix_signalgo_database_port }}/{{ matrix_mautrix_signalgo_database_name }}?sslmode={{ matrix_mautrix_signalgo_database_sslmode }}' + +matrix_mautrix_signalgo_appservice_database_type: "{{ + { + 'sqlite': 'sqlite3', + 'postgres':'postgres', + }[matrix_mautrix_signalgo_database_engine] +}}" + +matrix_mautrix_signalgo_appservice_database_uri: "{{ + { + 'sqlite': matrix_mautrix_signalgo_sqlite_database_path_in_container, + 'postgres': matrix_mautrix_signalgo_database_connection_string, + }[matrix_mautrix_signalgo_database_engine] +}}" + +# Can be set to enable automatic double-puppeting via Shared Secret Auth (https://github.com/devture/matrix-synapse-shared-secret-auth). +matrix_mautrix_signalgo_login_shared_secret: '' +matrix_mautrix_signalgo_bridge_login_shared_secret_map: + "{{ {matrix_mautrix_signalgo_homeserver_domain: matrix_mautrix_signalgo_login_shared_secret} if matrix_mautrix_signalgo_login_shared_secret else {} }}" + +# Servers to always allow double puppeting from +matrix_mautrix_signalgo_bridge_double_puppet_server_map: + "{{ matrix_mautrix_signalgo_homeserver_domain : matrix_mautrix_signalgo_homeserver_address }}" + +# Default mautrix-signalgo configuration template which covers the generic use case. +# You can customize it by controlling the various variables inside it. +# +# For a more advanced customization, you can extend the default (see `matrix_mautrix_signalgo_configuration_extension_yaml`) +# or completely replace this variable with your own template. +matrix_mautrix_signalgo_configuration_yaml: "{{ lookup('template', 'templates/config.yaml.j2') }}" + +matrix_mautrix_signalgo_configuration_extension_yaml: | + # Your custom YAML configuration goes here. + # This configuration extends the default starting configuration (`matrix_mautrix_signalgo_configuration_yaml`). + # + # You can override individual variables from the default configuration, or introduce new ones. + # + # If you need something more special, you can take full control by + # completely redefining `matrix_mautrix_signalgo_configuration_yaml`. + +matrix_mautrix_signalgo_configuration_extension: "{{ matrix_mautrix_signalgo_configuration_extension_yaml | from_yaml if matrix_mautrix_signalgo_configuration_extension_yaml | from_yaml is mapping else {} }}" + +# Holds the final configuration (a combination of the default and its extension). +# You most likely don't need to touch this variable. Instead, see `matrix_mautrix_signalgo_configuration_yaml`. +matrix_mautrix_signalgo_configuration: "{{ matrix_mautrix_signalgo_configuration_yaml | from_yaml | combine(matrix_mautrix_signalgo_configuration_extension, recursive=True) }}" + +matrix_mautrix_signalgo_registration_yaml: | + id: signalgo + url: {{ matrix_mautrix_signalgo_appservice_address }} + as_token: "{{ matrix_mautrix_signalgo_appservice_token }}" + hs_token: "{{ matrix_mautrix_signalgo_homeserver_token }}" + # See https://github.com/mautrix/signal/issues/43 + sender_localpart: _bot_{{ matrix_mautrix_signalgo_appservice_bot_username }} + rate_limited: false + namespaces: + users: + - regex: '^@signalgo_[0-9]+:{{ matrix_mautrix_signalgo_homeserver_domain | regex_escape }}$' + exclusive: true + - exclusive: true + regex: '^@{{ matrix_mautrix_signalgo_appservice_bot_username | regex_escape }}:{{ matrix_mautrix_signalgo_homeserver_domain | regex_escape }}$' + de.sorunome.msc2409.push_ephemeral: true + +matrix_mautrix_signalgo_registration: "{{ matrix_mautrix_signalgo_registration_yaml | from_yaml }}" + +# Enable End-to-bridge encryption +matrix_mautrix_signalgo_bridge_encryption_allow: "{{ matrix_bridges_encryption_enabled }}" +matrix_mautrix_signalgo_bridge_encryption_default: "{{ matrix_mautrix_signalgo_bridge_encryption_allow }}" +matrix_mautrix_signalgo_bridge_encryption_key_sharing_allow: "{{ matrix_mautrix_signalgo_bridge_encryption_allow }}" + +# On conduit versions before 0.5.0 this option prevented users from joining spaces created by the bridge. +# Setting this to false fixed the issue. +matrix_mautrix_signalgo_bridge_restricted_rooms: true diff --git a/roles/custom/matrix-bridge-mautrix-signalgo/tasks/main.yml b/roles/custom/matrix-bridge-mautrix-signalgo/tasks/main.yml new file mode 100644 index 000000000..dc4450047 --- /dev/null +++ b/roles/custom/matrix-bridge-mautrix-signalgo/tasks/main.yml @@ -0,0 +1,20 @@ +--- + +- tags: + - setup-all + - setup-mautrix-signalgo + - install-all + - install-mautrix-signalgo + block: + - when: matrix_mautrix_signalgo_enabled | bool + ansible.builtin.include_tasks: "{{ role_path }}/tasks/validate_config.yml" + + - when: matrix_mautrix_signalgo_enabled | bool + ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_install.yml" + +- tags: + - setup-all + - setup-mautrix-signalgo + block: + - when: not matrix_mautrix_signalgo_enabled | bool + ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_uninstall.yml" diff --git a/roles/custom/matrix-bridge-mautrix-signalgo/tasks/setup_install.yml b/roles/custom/matrix-bridge-mautrix-signalgo/tasks/setup_install.yml new file mode 100644 index 000000000..61db5a575 --- /dev/null +++ b/roles/custom/matrix-bridge-mautrix-signalgo/tasks/setup_install.yml @@ -0,0 +1,108 @@ +--- + +- ansible.builtin.set_fact: + matrix_mautrix_signalgo_requires_restart: false + +- when: "matrix_mautrix_signalgo_database_engine == 'postgres'" + block: + - name: Check if an SQLite database already exists + ansible.builtin.stat: + path: "{{ matrix_mautrix_signalgo_sqlite_database_path_local }}" + register: matrix_mautrix_signalgo_sqlite_database_path_local_stat_result + + - when: "matrix_mautrix_signalgo_sqlite_database_path_local_stat_result.stat.exists | bool" + block: + - ansible.builtin.include_role: + name: galaxy/com.devture.ansible.role.postgres + tasks_from: migrate_db_to_postgres + vars: + devture_postgres_db_migration_request: + src: "{{ matrix_mautrix_signalgo_sqlite_database_path_local }}" + dst: "{{ matrix_mautrix_signalgo_database_connection_string }}" + caller: "{{ role_path | basename }}" + engine_variable_name: 'matrix_mautrix_signalgo_database_engine' + engine_old: 'sqlite' + systemd_services_to_stop: ['matrix-mautrix-signalgo.service'] + pgloader_options: ['--with "quote identifiers"'] + + - ansible.builtin.set_fact: + matrix_mautrix_signalgo_requires_restart: true + +- name: Ensure Mautrix Signalgo paths exists + ansible.builtin.file: + path: "{{ item.path }}" + state: directory + mode: 0750 + owner: "{{ matrix_user_username }}" + group: "{{ matrix_user_groupname }}" + with_items: + - {path: "{{ matrix_mautrix_signalgo_base_path }}", when: true} + - {path: "{{ matrix_mautrix_signalgo_config_path }}", when: true} + - {path: "{{ matrix_mautrix_signalgo_data_path }}", when: true} + - {path: "{{ matrix_mautrix_signalgo_docker_src_files_path }}", when: "{{ matrix_mautrix_signalgo_container_image_self_build }}"} + when: item.when | bool + +- name: Ensure Mautrix Signalgo image is pulled + community.docker.docker_image: + name: "{{ matrix_mautrix_signalgo_docker_image }}" + source: "{{ 'pull' if ansible_version.major > 2 or ansible_version.minor > 7 else omit }}" + force_source: "{{ matrix_mautrix_signalgo_docker_image_force_pull if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}" + force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else matrix_mautrix_signalgo_docker_image_force_pull }}" + when: not matrix_mautrix_signalgo_container_image_self_build + register: result + retries: "{{ devture_playbook_help_container_retries_count }}" + delay: "{{ devture_playbook_help_container_retries_delay }}" + until: result is not failed + +- name: Ensure Mautrix Signalgo repository is present on self-build + ansible.builtin.git: + repo: "{{ matrix_mautrix_signalgo_container_image_self_build_repo }}" + dest: "{{ matrix_mautrix_signalgo_docker_src_files_path }}" + version: "{{ matrix_mautrix_signalgo_container_image_self_build_branch }}" + force: "yes" + become: true + become_user: "{{ matrix_user_username }}" + register: matrix_mautrix_signalgo_git_pull_results + when: "matrix_mautrix_signalgo_container_image_self_build | bool" + +- name: Ensure Mautrix Signalgo Docker image is built + community.docker.docker_image: + name: "{{ matrix_mautrix_signalgo_docker_image }}" + source: build + force_source: "{{ matrix_mautrix_signalgo_git_pull_results.changed if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}" + force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else matrix_mautrix_signalgo_git_pull_results.changed }}" + build: + dockerfile: Dockerfile + path: "{{ matrix_mautrix_signalgo_docker_src_files_path }}" + pull: true + when: "matrix_mautrix_signalgo_container_image_self_build | bool" + +- name: Ensure mautrix-signalgo config.yaml installed + ansible.builtin.copy: + content: "{{ matrix_mautrix_signalgo_configuration | to_nice_yaml(indent=2, width=999999) }}" + dest: "{{ matrix_mautrix_signalgo_config_path }}/config.yaml" + mode: 0644 + owner: "{{ matrix_user_username }}" + group: "{{ matrix_user_groupname }}" + +- name: Ensure mautrix-signalgo registration.yaml installed + ansible.builtin.copy: + content: "{{ matrix_mautrix_signalgo_registration | to_nice_yaml(indent=2, width=999999) }}" + dest: "{{ matrix_mautrix_signalgo_config_path }}/registration.yaml" + mode: 0644 + owner: "{{ matrix_user_username }}" + group: "{{ matrix_user_groupname }}" + +- name: Ensure matrix-mautrix-signalgo.service installed + ansible.builtin.template: + src: "{{ role_path }}/templates/systemd/matrix-mautrix-signalgo.service.j2" + dest: "{{ devture_systemd_docker_base_systemd_path }}/matrix-mautrix-signalgo.service" + mode: 0644 + register: matrix_mautrix_signalgo_systemd_service_result + +- name: Ensure matrix-mautrix-signalgo.service restarted, if necessary + ansible.builtin.service: + name: "matrix-mautrix-signalgo.service" + state: restarted + daemon_reload: true + when: "matrix_mautrix_signalgo_requires_restart | bool" diff --git a/roles/custom/matrix-bridge-mautrix-signalgo/tasks/setup_uninstall.yml b/roles/custom/matrix-bridge-mautrix-signalgo/tasks/setup_uninstall.yml new file mode 100644 index 000000000..05cd66a65 --- /dev/null +++ b/roles/custom/matrix-bridge-mautrix-signalgo/tasks/setup_uninstall.yml @@ -0,0 +1,20 @@ +--- + +- name: Check existence of matrix-mautrix-signalgo service + ansible.builtin.stat: + path: "{{ devture_systemd_docker_base_systemd_path }}/matrix-mautrix-signalgo.service" + register: matrix_mautrix_signalgo_service_stat + +- when: matrix_mautrix_signalgo_service_stat.stat.exists | bool + block: + - name: Ensure matrix-mautrix-signalgo is stopped + ansible.builtin.service: + name: matrix-mautrix-signalgo + state: stopped + enabled: false + daemon_reload: true + + - name: Ensure matrix-mautrix-signalgo.service doesn't exist + ansible.builtin.file: + path: "{{ devture_systemd_docker_base_systemd_path }}/matrix-mautrix-signalgo.service" + state: absent diff --git a/roles/custom/matrix-bridge-mautrix-signalgo/tasks/validate_config.yml b/roles/custom/matrix-bridge-mautrix-signalgo/tasks/validate_config.yml new file mode 100644 index 000000000..1fc0d0cec --- /dev/null +++ b/roles/custom/matrix-bridge-mautrix-signalgo/tasks/validate_config.yml @@ -0,0 +1,11 @@ +--- + +- name: Fail if required mautrix-signalgo settings not defined + ansible.builtin.fail: + msg: >- + You need to define a required configuration setting (`{{ item.name }}`). + when: "item.when | bool and vars[item.name] == ''" + with_items: + - {'name': 'matrix_mautrix_signalgo_appservice_token', when: true} + - {'name': 'matrix_mautrix_signalgo_homeserver_token', when: true} + - {'name': 'matrix_mautrix_signalgo_database_hostname', when: "{{ matrix_mautrix_signalgo_database_engine == 'postgres' }}"} diff --git a/roles/custom/matrix-bridge-mautrix-signalgo/templates/config.yaml.j2 b/roles/custom/matrix-bridge-mautrix-signalgo/templates/config.yaml.j2 new file mode 100644 index 000000000..0d708d743 --- /dev/null +++ b/roles/custom/matrix-bridge-mautrix-signalgo/templates/config.yaml.j2 @@ -0,0 +1,264 @@ +#jinja2: lstrip_blocks: "True" +# Homeserver details. +homeserver: + # The address that this appservice can use to connect to the homeserver. + address: {{ matrix_mautrix_signalgo_homeserver_address | to_json }} + # The domain of the homeserver (for MXIDs, etc). + domain: {{ matrix_mautrix_signalgo_homeserver_domain | to_json }} + + # What software is the homeserver running? + # Standard Matrix homeservers like Synapse, Dendrite and Conduit should just use "standard" here. + software: standard + # The URL to push real-time bridge status to. + # If set, the bridge will make POST requests to this URL whenever a user's discord connection state changes. + # The bridge will use the appservice as_token to authorize requests. + status_endpoint: null + # Endpoint for reporting per-message status. + message_send_checkpoint_endpoint: null + # Does the homeserver support https://github.com/matrix-org/matrix-spec-proposals/pull/2246? + async_media: false + + # Should the bridge use a websocket for connecting to the homeserver? + # The server side is currently not documented anywhere and is only implemented by mautrix-wsproxy, + # mautrix-asmux (deprecated), and hungryserv (proprietary). + websocket: false + # How often should the websocket be pinged? Pinging will be disabled if this is zero. + ping_interval_seconds: 0 + +# Application service host/registration related details. +# Changing these values requires regeneration of the registration. +appservice: + # The address that the homeserver can use to connect to this appservice. + address: {{ matrix_mautrix_signalgo_appservice_address | to_json }} + + # The hostname and port where this appservice should listen. + hostname: 0.0.0.0 + port: 8080 + + # Database config. + database: + # The database type. "sqlite3-fk-wal" and "postgres" are supported. + type: {{ matrix_mautrix_signalgo_appservice_database_type|to_json }} + # The database URI. + # SQLite: A raw file path is supported, but `file:?_txlock=immediate` is recommended. + # https://github.com/mattn/go-sqlite3#connection-string + # Postgres: Connection string. For example, postgres://user:password@host/database?sslmode=disable + # To connect via Unix socket, use something like postgres:///dbname?host=/var/run/postgresql + uri: {{ matrix_mautrix_signalgo_appservice_database_uri|to_json }} + # Maximum number of connections. Mostly relevant for Postgres. + max_open_conns: 20 + max_idle_conns: 2 + # Maximum connection idle time and lifetime before they're closed. Disabled if null. + # Parsed with https://pkg.go.dev/time#ParseDuration + max_conn_idle_time: null + max_conn_lifetime: null + + # The unique ID of this appservice. + id: signalgo + # Appservice bot details. + bot: + # Username of the appservice bot. + username: signalgobot + # Display name and avatar for bot. Set to "remove" to remove display name/avatar, leave empty + # to leave display name/avatar as-is. + displayname: Signalgo bridge bot + avatar: mxc://maunium.net/wPJgTQbZOtpBFmDNkiNEMDUp + + # Whether or not to receive ephemeral events via appservice transactions. + # Requires MSC2409 support (i.e. Synapse 1.22+). + ephemeral_events: true + + # Should incoming events be handled asynchronously? + # This may be necessary for large public instances with lots of messages going through. + # However, messages will not be guaranteed to be bridged in the same order they were sent in. + async_transactions: false + + # Authentication tokens for AS <-> HS communication. Autogenerated; do not modify. + as_token: {{ matrix_mautrix_signalgo_appservice_token | to_json }} + hs_token: {{ matrix_mautrix_signalgo_homeserver_token | to_json }} + +# Prometheus config. +metrics: + # Enable prometheus metrics? + enabled: false + # IP and port where the metrics listener should be. The path is always /metrics + listen: 127.0.0.1:8000 + +# Bridge config +bridge: + # Localpart template of MXIDs for Signal users. + # {{.}} is replaced with the internal ID of the Signal user. + username_template: signal_{{.}} + # Displayname template for Signal users. This is also used as the room name in DMs if private_chat_portal_meta is enabled. + # Available variables: TODO + displayname_template: '{{.ProfileName}} (Signal)' + # Whether to explicitly set the avatar and room name for private chat portal rooms. + # If set to `default`, this will be enabled in encrypted rooms and disabled in unencrypted rooms. + # If set to `always`, all DM rooms will have explicit names and avatars set. + # If set to `never`, DM rooms will never have names and avatars set. + private_chat_portal_meta: default + + portal_message_buffer: 128 + + # Should the bridge send a read receipt from the bridge bot when a message has been sent to Signal? + delivery_receipts: false + # Whether the bridge should send the message status as a custom com.beeper.message_send_status event. + message_status_events: false + # Whether the bridge should send error notices via m.notice events when a message fails to bridge. + message_error_notices: true + # Should the bridge update the m.direct account data event when double puppeting is enabled. + # Note that updating the m.direct event is not atomic (except with mautrix-asmux) + # and is therefore prone to race conditions. + sync_direct_chat_list: false + # Set this to true to tell the bridge to re-send m.bridge events to all rooms on the next run. + # This field will automatically be changed back to false after it, except if the config file is not writable. + resend_bridge_info: false + # Whether or not created rooms should have federation enabled. + # If false, created portal rooms will never be federated. + federate_rooms: {{ matrix_mautrix_signalgo_federate_rooms|to_json }} + # Servers to always allow double puppeting from + double_puppet_server_map: + "{{ matrix_mautrix_signalgo_homeserver_domain }}": {{ matrix_mautrix_signalgo_homeserver_address }} + # Allow using double puppeting from any server with a valid client .well-known file. + double_puppet_allow_discovery: false + # Shared secrets for https://github.com/devture/matrix-synapse-shared-secret-auth + # + # If set, double puppeting will be enabled automatically for local users + # instead of users having to find an access token and run `login-matrix` + # manually. + login_shared_secret_map: {{ matrix_mautrix_signalgo_bridge_login_shared_secret_map|to_json }} + + # Maximum time for handling Matrix events. Duration strings formatted for https://pkg.go.dev/time#ParseDuration + # Null means there's no enforced timeout. + message_handling_timeout: + # Send an error message after this timeout, but keep waiting for the response until the deadline. + # This is counted from the origin_server_ts, so the warning time is consistent regardless of the source of delay. + # If the message is older than this when it reaches the bridge, the message won't be handled at all. + error_after: null + # Drop messages after this timeout. They may still go through if the message got sent to the servers. + # This is counted from the time the bridge starts handling the message. + deadline: 120s + + # The prefix for commands. Only required in non-management rooms. + command_prefix: "{{ matrix_mautrix_signalgo_command_prefix }}" + # Messages sent upon joining a management room. + # Markdown is supported. The defaults are listed below. + management_room_text: + # Sent when joining a room. + welcome: "Hello, I'm a Signalgo bridge bot." + # Sent when joining a management room and the user is already logged in. + welcome_connected: "Use `help` for help." + # Sent when joining a management room and the user is not logged in. + welcome_unconnected: "Use `help` for help or `login` to log in." + # Optional extra text sent when joining a management room. + additional_help: "" + + # End-to-bridge encryption support options. + # + # See https://docs.mau.fi/bridges/general/end-to-bridge-encryption.html for more info. + encryption: + # Allow encryption, work in group chat rooms with e2ee enabled + allow: {{ matrix_mautrix_signalgo_bridge_encryption_allow|to_json }} + # Default to encryption, force-enable encryption in all portals the bridge creates + # This will cause the bridge bot to be in private chats for the encryption to work properly. + default: {{ matrix_mautrix_signalgo_bridge_encryption_default|to_json }} + # Whether to use MSC2409/MSC3202 instead of /sync long polling for receiving encryption-related data. + appservice: false + # Require encryption, drop any unencrypted messages. + require: false + # Enable key sharing? If enabled, key requests for rooms where users are in will be fulfilled. + # You must use a client that supports requesting keys from other users to use this feature. + allow_key_sharing: {{ matrix_mautrix_signalgo_bridge_encryption_key_sharing_allow|to_json }} + # Options for deleting megolm sessions from the bridge. + delete_keys: + # Beeper-specific: delete outbound sessions when hungryserv confirms + # that the user has uploaded the key to key backup. + delete_outbound_on_ack: false + # Don't store outbound sessions in the inbound table. + dont_store_outbound: false + # Ratchet megolm sessions forward after decrypting messages. + ratchet_on_decrypt: false + # Delete fully used keys (index >= max_messages) after decrypting messages. + delete_fully_used_on_decrypt: false + # Delete previous megolm sessions from same device when receiving a new one. + delete_prev_on_new_session: false + # Delete megolm sessions received from a device when the device is deleted. + delete_on_device_delete: false + # Periodically delete megolm sessions when 2x max_age has passed since receiving the session. + periodically_delete_expired: false + # Delete inbound megolm sessions that don't have the received_at field used for + # automatic ratcheting and expired session deletion. This is meant as a migration + # to delete old keys prior to the bridge update. + delete_outdated_inbound: false + # What level of device verification should be required from users? + # + # Valid levels: + # unverified - Send keys to all device in the room. + # cross-signed-untrusted - Require valid cross-signing, but trust all cross-signing keys. + # cross-signed-tofu - Require valid cross-signing, trust cross-signing keys on first use (and reject changes). + # cross-signed-verified - Require valid cross-signing, plus a valid user signature from the bridge bot. + # Note that creating user signatures from the bridge bot is not currently possible. + # verified - Require manual per-device verification + # (currently only possible by modifying the `trust` column in the `crypto_device` database table). + verification_levels: + # Minimum level for which the bridge should send keys to when bridging messages from Signal to Matrix. + receive: unverified + # Minimum level that the bridge should accept for incoming Matrix messages. + send: unverified + # Minimum level that the bridge should require for accepting key requests. + share: cross-signed-tofu + # Options for Megolm room key rotation. These options allow you to + # configure the m.room.encryption event content. See: + # https://spec.matrix.org/v1.3/client-server-api/#mroomencryption for + # more information about that event. + rotation: + # Enable custom Megolm room key rotation settings. Note that these + # settings will only apply to rooms created after this option is + # set. + enable_custom: false + # The maximum number of milliseconds a session should be used + # before changing it. The Matrix spec recommends 604800000 (a week) + # as the default. + milliseconds: 604800000 + # The maximum number of messages that should be sent with a given a + # session before changing it. The Matrix spec recommends 100 as the + # default. + messages: 100 + + # Disable rotating keys when a user's devices change? + # You should not enable this option unless you understand all the implications. + disable_device_change_key_rotation: false + + # Settings for provisioning API + provisioning: + # Prefix for the provisioning API paths. + prefix: /_matrix/provision + # Shared secret for authentication. If set to "generate", a random secret will be generated, + # or if set to "disable", the provisioning API will be disabled. + shared_secret: generate + # Enable debug API at /debug with provisioning authentication. + debug_endpoints: false + + # Permissions for using the bridge. + # Permitted values: + # relay - Talk through the relaybot (if enabled), no access otherwise + # user - Access to use the bridge to chat with a Signal account. + # admin - User level and some additional administration tools + # Permitted keys: + # * - All Matrix users + # domain - All users on that homeserver + # mxid - Specific user + permissions: {{ matrix_mautrix_signalgo_bridge_permissions|to_json }} + +# Logging config. See https://github.com/tulir/zeroconfig for details. +logging: + min_level: {{ matrix_mautrix_signalgo_logging_level | to_json }} + writers: + - type: stdout + format: pretty-colored + - type: file + format: json + filename: ./logs/mautrix-signalgo.log + max_size: 100 + max_backups: 10 + compress: true diff --git a/roles/custom/matrix-bridge-mautrix-signalgo/templates/systemd/matrix-mautrix-signalgo.service.j2 b/roles/custom/matrix-bridge-mautrix-signalgo/templates/systemd/matrix-mautrix-signalgo.service.j2 new file mode 100644 index 000000000..722deff28 --- /dev/null +++ b/roles/custom/matrix-bridge-mautrix-signalgo/templates/systemd/matrix-mautrix-signalgo.service.j2 @@ -0,0 +1,43 @@ +#jinja2: lstrip_blocks: "True" +[Unit] +Description=Matrix Mautrix Signalgo bridge +{% for service in matrix_mautrix_signalgo_systemd_required_services_list %} +Requires={{ service }} +After={{ service }} +{% endfor %} +{% for service in matrix_mautrix_signalgo_systemd_wanted_services_list %} +Wants={{ service }} +{% endfor %} +DefaultDependencies=no + +[Service] +Type=simple +Environment="HOME={{ devture_systemd_docker_base_systemd_unit_home_path }}" +ExecStartPre=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} stop --time={{ devture_systemd_docker_base_container_stop_grace_time_seconds }} matrix-mautrix-signalgo 2>/dev/null || true' +ExecStartPre=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} rm matrix-mautrix-signalgo 2>/dev/null || true' + +# Intentional delay, so that the homeserver (we likely depend on) can manage to start. +ExecStartPre={{ matrix_host_command_sleep }} 5 + +ExecStart={{ devture_systemd_docker_base_host_command_docker }} run --rm --name matrix-mautrix-signalgo \ + --log-driver=none \ + --user={{ matrix_user_uid }}:{{ matrix_user_gid }} \ + --cap-drop=ALL \ + --network={{ matrix_docker_network }} \ + --mount type=bind,src={{ matrix_mautrix_signalgo_config_path }},dst=/config,ro \ + --mount type=bind,src={{ matrix_mautrix_signalgo_data_path }},dst=/data \ + --workdir=/data \ + {% for arg in matrix_mautrix_signalgo_container_extra_arguments %} + {{ arg }} \ + {% endfor %} + {{ matrix_mautrix_signalgo_docker_image }} \ + /usr/bin/mautrix-signalgo -c /config/config.yaml -r /config/registration.yaml --no-update + +ExecStop=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} stop --time={{ devture_systemd_docker_base_container_stop_grace_time_seconds }} matrix-mautrix-signalgo 2>/dev/null || true' +ExecStop=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} rm matrix-mautrix-signalgo 2>/dev/null || true' +Restart=always +RestartSec=30 +SyslogIdentifier=matrix-mautrix-signalgo + +[Install] +WantedBy=multi-user.target diff --git a/setup.yml b/setup.yml index 5a4ecd383..1aab29a5e 100644 --- a/setup.yml +++ b/setup.yml @@ -58,8 +58,9 @@ - custom/matrix-bridge-mautrix-hangouts - custom/matrix-bridge-mautrix-googlechat - custom/matrix-bridge-mautrix-instagram - - custom/matrix-bridge-mautrix-signal - custom/matrix-bridge-mautrix-telegram + - custom/matrix-bridge-mautrix-signal + - custom/matrix-bridge-mautrix-signalgo - custom/matrix-bridge-mautrix-gmessages - custom/matrix-bridge-mautrix-whatsapp - custom/matrix-bridge-mautrix-wsproxy