diff --git a/CHANGELOG.md b/CHANGELOG.md index 153be11fa..0f716c9a1 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,3 +1,20 @@ +# 2024-02-19 + +## Support for bridging to Facebook/Messenger via the new mautrix-meta bridge + +The [mautrix-facebook](./docs/configuring-playbook-bridge-mautrix-facebook.md) and [mautrix-instagram](./docs/configuring-playbook-bridge-mautrix-instagram.md) bridges are being [superseded by a new bridge](https://github.com/mautrix/facebook/issues/332) - the [mautrix-meta](https://github.com/mautrix/meta) bridge. + +The playbook now supports the new mautrix-meta bridge - a single bridge, which can run in different modes and bridge to Messenger (via [Facebook](https://facebook.com/), Facebook over [Tor](https://www.torproject.org/) or via [Messenger](https://messenger.com/)) and [Instagram](https://instagram.com/). The playbook makes this bridge available via 2 separate Ansible roles, allowing you to easily run 2 instances of mautrix-meta, for bridging to both services at the same time. + +If you're using mautrix-facebook or mautrix-instagram right now, **you can still continue using the old bridges, but may wish to change to the new bridge implementations**. See: + +- [Setting up Instagram bridging via Mautrix Meta](docs/configuring-playbook-bridge-mautrix-meta-instagram.md) + +- [Setting up Messenger bridging via Mautrix Meta](docs/configuring-playbook-bridge-mautrix-meta-messenger.md) + +The documentation pages contain more information on how to migrate. + + # 2024-02-14 ## Much larger Synapse caches and cache auto-tuning enabled by default diff --git a/bin/rebuild-mautrix-meta-instagram.sh b/bin/rebuild-mautrix-meta-instagram.sh new file mode 100644 index 000000000..d637168bd --- /dev/null +++ b/bin/rebuild-mautrix-meta-instagram.sh @@ -0,0 +1,39 @@ +#!/bin/bash +set -euxo pipefail + +# This script rebuilds the mautrix-meta-instagram Ansible role, using the mautrix-meta-messenger role as a source. + +if [ $# -eq 0 ]; then + echo "Error: No argument supplied. Please provide the path to the roles/custom directory." + exit 1 +fi + +roles_path=$1 + +messenger_role_path=$roles_path/matrix-bridge-mautrix-meta-messenger +instagram_role_path=$roles_path/matrix-bridge-mautrix-meta-instagram + +if [ ! -d $messenger_role_path ]; then + echo "Cannot find: $messenger_role_path" + exit 1 +fi + +if [ -d $instagram_role_path ]; then + rm -rf $instagram_role_path +fi + +cp -ar $messenger_role_path $instagram_role_path + +find "$instagram_role_path" -type f | while read -r file; do + sed --in-place 's/matrix_mautrix_meta_messenger_/matrix_mautrix_meta_instagram_/g' "$file" + sed --in-place 's/mautrix-meta-messenger/mautrix-meta-instagram/g' "$file" +done + +sed --in-place 's/matrix_mautrix_meta_instagram_meta_mode: \(.*\)/matrix_mautrix_meta_instagram_meta_mode: instagram/g' $instagram_role_path/defaults/main.yml +sed --in-place 's/matrix_mautrix_meta_instagram_identifier: \(.*\)/matrix_mautrix_meta_instagram_identifier: matrix-mautrix-meta-instagram/g' $instagram_role_path/defaults/main.yml + +echo "# matrix-mautrix-meta-instagram" > $instagram_role_path/README.md +echo "" >> $instagram_role_path/README.md +echo "This bridge role is derived from the matrix-mautrix-meta-messenger Ansible role via automatic changes (see \`just rebuild-mautrix-meta-instagram\` or \`bin/rebuild-mautrix-meta-instagram.sh\`)." >> $instagram_role_path/README.md +echo "" >> $instagram_role_path/README.md +echo "If you'd like to make a change to this role, consider making it to the \`matrix-mautrix-meta-messenger\` role instead." >> $instagram_role_path/README.md diff --git a/docs/configuring-playbook-bridge-mautrix-facebook.md b/docs/configuring-playbook-bridge-mautrix-facebook.md index 82d51df32..ffb326beb 100644 --- a/docs/configuring-playbook-bridge-mautrix-facebook.md +++ b/docs/configuring-playbook-bridge-mautrix-facebook.md @@ -1,5 +1,7 @@ # Setting up Mautrix Facebook (optional) +**Note**: bridging to Facebook [Messenger](https://messenger.com) via this bridge is being [superseded by a new bridge - mautrix-meta](https://github.com/mautrix/facebook/issues/332). For now, the mautrix-facebook bridge continues to work, but the new [mautrix-meta-messenger bridge](./configuring-playbook-bridge-mautrix-meta-messenger.md) is better and more supported. Consider using that bridge instead of this one. + The playbook can install and configure [mautrix-facebook](https://github.com/mautrix/facebook) for you. See the project's [documentation](https://github.com/mautrix/facebook/blob/master/ROADMAP.md) to learn what it does and why it might be useful to you. diff --git a/docs/configuring-playbook-bridge-mautrix-instagram.md b/docs/configuring-playbook-bridge-mautrix-instagram.md index c5b3feb7a..90458a028 100644 --- a/docs/configuring-playbook-bridge-mautrix-instagram.md +++ b/docs/configuring-playbook-bridge-mautrix-instagram.md @@ -1,5 +1,7 @@ # Setting up Mautrix Instagram (optional) +**Note**: bridging to Facebook [Instagram](https://instagram.com) via this bridge is being [superseded by a new bridge - mautrix-meta](https://github.com/mautrix/facebook/issues/332). For now, the mautrix-instagram bridge continues to work, but the new [mautrix-meta-instagram bridge](./configuring-playbook-bridge-mautrix-meta-instagram.md) is better and more supported. Consider using that bridge instead of this one. + The playbook can install and configure [mautrix-instagram](https://github.com/mautrix/instagram) for you. See the project's [documentation](https://docs.mau.fi/bridges/python/instagram/index.html) to learn what it does and why it might be useful to you. diff --git a/docs/configuring-playbook-bridge-mautrix-meta-instagram.md b/docs/configuring-playbook-bridge-mautrix-meta-instagram.md new file mode 100644 index 000000000..0e30de56a --- /dev/null +++ b/docs/configuring-playbook-bridge-mautrix-meta-instagram.md @@ -0,0 +1,90 @@ +# Setting up Instagram bridging via Mautrix Meta (optional) + +The playbook can install and configure the [mautrix-meta](https://github.com/mautrix/meta) Messenger/Instagram bridge for you. + +Since this bridge component can bridge to both [Messenger](https://messenger.com/) and [Instagram](https://instagram.com/) and you may wish to do both at the same time, the playbook makes it available via 2 different Ansible roles (`matrix-bridge-mautrix-meta-messenger` and `matrix-bridge-mautrix-meta-instagram`). The latter is a reconfigured copy of the first one (created by `just rebuild-mautrix-meta-instagram` and `bin/rebuild-mautrix-meta-instagram.sh`). + +This documentation page only deals with the bridge's ability to bridge to Instagram. For bridging to Facebook/Messenger, see [Setting up Messenger bridging via Mautrix Meta](configuring-playbook-bridge-mautrix-meta-messenger.md). + + +## Migrating from the old mautrix-instagram bridge + +If you've been using the [mautrix-instagram](./configuring-playbook-bridge-mautrix-instagram.md) bridge, **you'd better get rid of it first** or the 2 bridges will be in conflict: + +- both trying to use `@instagrambot:YOUR_DOMAIN` as their username. This conflict may be resolved by adjusting `matrix_mautrix_instagram_appservice_bot_username` or `matrix_mautrix_meta_instagram_appservice_username` +- both trying to bridge the same DMs + +To do so, send a `clean-rooms` command to the management room with the old bridge bot (`@instagrambot:YOUR_DOMAIN`). + +This would give you a list of portals and groups of portals you may purge. Proceed with sending commands like `clean recommended`, etc. + +Then, consider disabling the old bridge in your configuration, so it won't recreate the portals when you receive new messages. + + +## Configuration + +Most simply, you can enable the bridge with the following playbook configuration: + +```yaml +matrix_mautrix_meta_instagram_enabled: true +``` + +Before proceeding to [re-running the playbook](./installing.md), you may wish to adjust the configuration further. See below. + +### Bridge permissions + +By default, any user on your homeserver will be able to use the bridge. + +Different levels of permission can be granted to users: + +- `relay` - Allowed to be relayed through the bridge, no access to commands +- `user` - Use the bridge with puppeting +- `admin` - Use and administer the bridge + +The permissions are following the sequence: nothing < `relay` < `user` < `admin`. + +The default permissions are set via `matrix_mautrix_meta_instagram_bridge_permissions_default` and are somewhat like this: +```yaml +matrix_mautrix_meta_instagram_bridge_permissions_default: + '*': relay + YOUR_DOMAIN: user + '{{ matrix_admin }}': admin +``` + +If you don't define the `matrix_admin` in your configuration (e.g. `matrix_admin: @user:YOUR_DOMAIN`), then there's no admin by default. + +You may redefine `matrix_mautrix_meta_instagram_bridge_permissions_default` any way you see fit, or add extra permissions using `matrix_mautrix_meta_instagram_bridge_permissions_custom` like this: + +```yaml +matrix_mautrix_meta_instagram_bridge_permissions_custom: | + '@YOUR_USERNAME:YOUR_DOMAIN': admin +``` + +You may wish to look at `roles/custom/matrix-bridge-mautrix-meta-instagram/templates/config.yaml.j2` to find more information on the permissions settings and other options you would like to configure. + +## Set up Double Puppeting + +If you'd like to use [Double Puppeting](https://docs.mau.fi/bridges/general/double-puppeting.html) (hint: you most likely do), you have 2 ways of going about it. + +### Method 1: automatically, by enabling Shared Secret Auth + +The bridge will automatically perform Double Puppeting if you enable [Shared Secret Auth](configuring-playbook-shared-secret-auth.md) for this playbook. + +This is the recommended way of setting up Double Puppeting, as it's easier to accomplish, works for all your users automatically, and has less of a chance of breaking in the future. + +### Method 2: manually, by asking each user to provide a working access token + +**Note**: This method for enabling Double Puppeting can be configured only after you've already set up bridging (see [Usage](#usage)). + +When using this method, **each user** that wishes to enable Double Puppeting needs to follow the following steps: + +- retrieve a Matrix access token for yourself. Refer to the documentation on [how to do that](obtaining-access-tokens.md). + +- send the access token to the bot. Example: `login-matrix MATRIX_ACCESS_TOKEN_HERE` + +- make sure you don't log out the session for which you obtained an access token some time in the future, as that would break the Double Puppeting feature + + +## Usage + +You then need to start a chat with `@instagrambot:YOUR_DOMAIN` (where `YOUR_DOMAIN` is your base domain, not the `matrix.` domain). diff --git a/docs/configuring-playbook-bridge-mautrix-meta-messenger.md b/docs/configuring-playbook-bridge-mautrix-meta-messenger.md new file mode 100644 index 000000000..541f52112 --- /dev/null +++ b/docs/configuring-playbook-bridge-mautrix-meta-messenger.md @@ -0,0 +1,105 @@ +# Setting up Messenger bridging via Mautrix Meta (optional) + +The playbook can install and configure the [mautrix-meta](https://github.com/mautrix/meta) Messenger/Instagram bridge for you. + +Since this bridge component can bridge to both [Messenger](https://messenger.com/) and [Instagram](https://instagram.com/) and you may wish to do both at the same time, the playbook makes it available via 2 different Ansible roles (`matrix-bridge-mautrix-meta-messenger` and `matrix-bridge-mautrix-meta-instagram`). The latter is a reconfigured copy of the first one (created by `just rebuild-mautrix-meta-instagram` and `bin/rebuild-mautrix-meta-instagram.sh`). + +This documentation page only deals with the bridge's ability to bridge to Facebook Messenger. For bridging to Instagram, see [Setting up Instagram bridging via Mautrix Meta](configuring-playbook-bridge-mautrix-meta-instagram.md). + + +## Migrating from the old mautrix-facebook bridge + +If you've been using the [mautrix-facebook](./configuring-playbook-bridge-mautrix-facebook.md) bridge, you may wish to get rid of it first. + +To do so, send a `clean-rooms` command to the management room with the old bridge bot (`@facebookbot:YOUR_DOMAIN`). + +This would give you a list of portals and groups of portals you may purge. Proceed with sending commands like `clean recommended`, etc. + +Then, consider disabling the old bridge in your configuration, so it won't recreate the portals when you receive new messages. + + +## Configuration + +Most simply, you can enable the bridge with the following playbook configuration: + +```yaml +matrix_mautrix_meta_messenger_enabled: true +``` + +Before proceeding to [re-running the playbook](./installing.md), you may wish to adjust the configuration further. See below. + +### Bridge mode + +As mentioned above, the [mautrix-meta](https://github.com/mautrix/meta) bridge supports multiple modes of operation. +The bridge can pull your Messenger messages via 3 different methods: + +- (`facebook`) Facebook via `facebook.com` +- (`facebook-tor`) Facebook via `facebookwkhpilnemxj7asaniu7vnjjbiltxjqhye3mhbshg7kx5tfyd.onion` ([Tor](https://www.torproject.org/)) - does not currently proxy media downloads +- (default) (`messenger`) Messenger via `messenger.com` - usable even without a Facebook account + +You may switch the mode via the `matrix_mautrix_meta_messenger_meta_mode` variable. The playbook defaults to the `messenger` mode, because it's most universal (every Facebook user has a Messenger account, but the opposite is not true). + +Note that switching the mode (especially between `facebook*` and `messenger`) will intentionally make the bridge use another database (`matrix_mautrix_meta_facebook` or `matrix_mautrix_meta_messenger`) to isolate the 2 instances. Switching between Tor and non-Tor may be possible without dataloss, but your mileage may vary. Before switching to a new mode, you may wish to de-configure the old one (send `help` to the bridge bot and unbridge your portals, etc.). + + +### Bridge permissions + +By default, any user on your homeserver will be able to use the bridge. + +Different levels of permission can be granted to users: + +- `relay` - Allowed to be relayed through the bridge, no access to commands +- `user` - Use the bridge with puppeting +- `admin` - Use and administer the bridge + +The permissions are following the sequence: nothing < `relay` < `user` < `admin`. + +The default permissions are set via `matrix_mautrix_meta_messenger_bridge_permissions_default` and are somewhat like this: +```yaml +matrix_mautrix_meta_messenger_bridge_permissions_default: + '*': relay + YOUR_DOMAIN: user + '{{ matrix_admin }}': admin +``` + +If you don't define the `matrix_admin` in your configuration (e.g. `matrix_admin: @user:YOUR_DOMAIN`), then there's no admin by default. + +You may redefine `matrix_mautrix_meta_messenger_bridge_permissions_default` any way you see fit, or add extra permissions using `matrix_mautrix_meta_messenger_bridge_permissions_custom` like this: + +```yaml +matrix_mautrix_meta_messenger_bridge_permissions_custom: | + '@YOUR_USERNAME:YOUR_DOMAIN': admin +``` + +You may wish to look at `roles/custom/matrix-bridge-mautrix-meta-messenger/templates/config.yaml.j2` to find more information on the permissions settings and other options you would like to configure. + +## Set up Double Puppeting + +If you'd like to use [Double Puppeting](https://docs.mau.fi/bridges/general/double-puppeting.html) (hint: you most likely do), you have 2 ways of going about it. + +### Method 1: automatically, by enabling Shared Secret Auth + +The bridge will automatically perform Double Puppeting if you enable [Shared Secret Auth](configuring-playbook-shared-secret-auth.md) for this playbook. + +This is the recommended way of setting up Double Puppeting, as it's easier to accomplish, works for all your users automatically, and has less of a chance of breaking in the future. + +### Method 2: manually, by asking each user to provide a working access token + +**Note**: This method for enabling Double Puppeting can be configured only after you've already set up bridging (see [Usage](#usage)). + +When using this method, **each user** that wishes to enable Double Puppeting needs to follow the following steps: + +- retrieve a Matrix access token for yourself. Refer to the documentation on [how to do that](obtaining-access-tokens.md). + +- send the access token to the bot. Example: `login-matrix MATRIX_ACCESS_TOKEN_HERE` + +- make sure you don't log out the session for which you obtained an access token some time in the future, as that would break the Double Puppeting feature + + +## Usage + +You then need to start a chat with `@messengerbot:YOUR_DOMAIN` (where `YOUR_DOMAIN` is your base domain, not the `matrix.` domain). + +You then need to send a `login` command and follow the bridge bot's instructions. + +Given that the bot is configured in `messenger` [bridge mode](#bridge-mode) by default, you will need to log in to [messenger.com](https://messenger.com/) (not `facebook.com`!) and obtain the cookies from there as per [the bridge's authentication instructions](https://docs.mau.fi/bridges/go/meta/authentication.html). diff --git a/docs/configuring-playbook.md b/docs/configuring-playbook.md index 413db7b8d..fb4597fc8 100644 --- a/docs/configuring-playbook.md +++ b/docs/configuring-playbook.md @@ -120,13 +120,17 @@ When you're done with all the configuration you'd like to do, continue with [Ins - [Setting up Mautrix Whatsapp bridging](configuring-playbook-bridge-mautrix-whatsapp.md) (optional) -- [Setting up Mautrix Facebook bridging](configuring-playbook-bridge-mautrix-facebook.md) (optional) +- [Setting up Instagram bridging via Mautrix Meta](configuring-playbook-bridge-mautrix-meta-instagram.md) (optional) + +- [Setting up Messenger bridging via Mautrix Meta](configuring-playbook-bridge-mautrix-meta-messenger.md) (optional) + +- ~~[Setting up Mautrix Facebook bridging](configuring-playbook-bridge-mautrix-facebook.md)~~ - consider bridging to Facebook/Messenger using the new [mautrix-meta-messenger](./configuring-playbook-bridge-mautrix-meta-messenger.md) bridge (optional) - [Setting up Mautrix Hangouts bridging](configuring-playbook-bridge-mautrix-hangouts.md) (optional) - [Setting up Mautrix Google Chat bridging](configuring-playbook-bridge-mautrix-googlechat.md) (optional) -- [Setting up Mautrix Instagram bridging](configuring-playbook-bridge-mautrix-instagram.md) (optional) +- ~~[Setting up Mautrix Instagram bridging](configuring-playbook-bridge-mautrix-instagram.md)~~ - consider bridging to Instagram using the new [mautrix-meta-instagram](./configuring-playbook-bridge-mautrix-meta-instagram.md) bridge (optional) - [Setting up Mautrix Twitter bridging](configuring-playbook-bridge-mautrix-twitter.md) (optional) diff --git a/group_vars/matrix_servers b/group_vars/matrix_servers index 2d2f7fdc7..a3ec55f06 100755 --- a/group_vars/matrix_servers +++ b/group_vars/matrix_servers @@ -101,6 +101,10 @@ matrix_homeserver_container_extra_arguments_auto: | + (['--mount type=bind,src=' + matrix_mautrix_signal_config_path + '/registration.yaml,dst=/matrix-mautrix-signal-registration.yaml,ro'] if matrix_mautrix_signal_enabled else []) + + (['--mount type=bind,src=' + matrix_mautrix_meta_messenger_config_path + '/registration.yaml,dst=/matrix-mautrix-meta-messenger-registration.yaml,ro'] if matrix_mautrix_meta_messenger_enabled else []) + + + (['--mount type=bind,src=' + matrix_mautrix_meta_instagram_config_path + '/registration.yaml,dst=/matrix-mautrix-meta-instagram-registration.yaml,ro'] if matrix_mautrix_meta_instagram_enabled else []) + + (['--mount type=bind,src=' + matrix_mautrix_telegram_config_path + '/registration.yaml,dst=/matrix-mautrix-telegram-registration.yaml,ro'] if matrix_mautrix_telegram_enabled else []) + (['--mount type=bind,src=' + matrix_mautrix_twitter_config_path + '/registration.yaml,dst=/matrix-mautrix-twitter-registration.yaml,ro'] if matrix_mautrix_twitter_enabled else []) @@ -164,6 +168,10 @@ matrix_homeserver_app_service_config_files_auto: | + (['/matrix-mautrix-signal-registration.yaml'] if matrix_mautrix_signal_enabled else []) + + (['/matrix-mautrix-meta-messenger-registration.yaml'] if matrix_mautrix_meta_messenger_enabled else []) + + + (['/matrix-mautrix-meta-instagram-registration.yaml'] if matrix_mautrix_meta_instagram_enabled else []) + + (['/matrix-mautrix-telegram-registration.yaml'] if matrix_mautrix_telegram_enabled else []) + (['/matrix-mautrix-twitter-registration.yaml'] if matrix_mautrix_twitter_enabled else []) @@ -294,6 +302,10 @@ devture_systemd_service_manager_services_list_auto: | + ([{'name': 'matrix-mautrix-signal.service', 'priority': 2000, 'groups': ['matrix', 'bridges', 'mautrix-signal', 'mautrix-signal']}] if matrix_mautrix_signal_enabled else []) + + ([{'name': (matrix_mautrix_meta_messenger_identifier + '.service'), 'priority': 2000, 'groups': ['matrix', 'bridges', 'mautrix-meta', 'mautrix-meta-messenger']}] if matrix_mautrix_meta_messenger_enabled else []) + + + ([{'name': (matrix_mautrix_meta_instagram_identifier + '.service'), 'priority': 2000, 'groups': ['matrix', 'bridges', 'mautrix-meta', 'mautrix-meta-instagram']}] if matrix_mautrix_meta_instagram_enabled else []) + + ([{'name': 'matrix-mautrix-telegram.service', 'priority': 2000, 'groups': ['matrix', 'bridges', 'mautrix-telegram']}] if matrix_mautrix_telegram_enabled else []) + ([{'name': 'matrix-mautrix-twitter.service', 'priority': 2000, 'groups': ['matrix', 'bridges', 'mautrix-twitter']}] if matrix_mautrix_twitter_enabled else []) @@ -1288,6 +1300,140 @@ matrix_mautrix_signal_database_password: "{{ '%s' | format(matrix_homeserver_gen # ###################################################################### + +###################################################################### +# +# matrix-bridge-mautrix-meta-messenger +# +###################################################################### + +# We don't enable bridges by default. +matrix_mautrix_meta_messenger_enabled: false + +matrix_mautrix_meta_messenger_systemd_required_services_list_auto: | + {{ + matrix_addons_homeserver_systemd_services_list + + + ([devture_postgres_identifier ~ '.service'] if (devture_postgres_enabled and matrix_mautrix_meta_messenger_database_hostname == devture_postgres_connection_hostname) else []) + }} + +matrix_mautrix_meta_messenger_container_image_self_build: "{{ matrix_architecture not in ['amd64', 'arm64'] }}" + +matrix_mautrix_meta_messenger_container_network: "{{ matrix_addons_container_network }}" + +matrix_mautrix_meta_messenger_container_additional_networks_auto: |- + {{ + ( + ([] if matrix_addons_homeserver_container_network == '' else [matrix_addons_homeserver_container_network]) + + + ([devture_postgres_container_network] if (devture_postgres_enabled and matrix_mautrix_meta_messenger_database_hostname == devture_postgres_connection_hostname and matrix_mautrix_meta_messenger_container_network != devture_postgres_container_network) else []) + + + ([matrix_playbook_reverse_proxyable_services_additional_network] if (matrix_playbook_reverse_proxyable_services_additional_network and matrix_mautrix_meta_messenger_container_labels_traefik_enabled) else []) + ) | unique + }} + +matrix_mautrix_meta_messenger_container_labels_traefik_enabled: "{{ matrix_playbook_reverse_proxy_type in ['playbook-managed-traefik', 'other-traefik-container'] }}" +matrix_mautrix_meta_messenger_container_labels_traefik_docker_network: "{{ matrix_playbook_reverse_proxyable_services_additional_network }}" +matrix_mautrix_meta_messenger_container_labels_traefik_entrypoints: "{{ devture_traefik_entrypoint_primary }}" +matrix_mautrix_meta_messenger_container_labels_traefik_tls_certResolver: "{{ devture_traefik_certResolver_primary }}" + +matrix_mautrix_meta_messenger_container_labels_metrics_middleware_basic_auth_enabled: "{{ matrix_metrics_exposure_http_basic_auth_enabled }}" +matrix_mautrix_meta_messenger_container_labels_metrics_middleware_basic_auth_users: "{{ matrix_metrics_exposure_http_basic_auth_users }}" + +matrix_mautrix_meta_messenger_appservice_token: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'mau.meta.fb.as', rounds=655555) | to_uuid }}" + +matrix_mautrix_meta_messenger_homeserver_address: "{{ matrix_addons_homeserver_client_api_url }}" + +matrix_mautrix_meta_messenger_homeserver_token: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'mau.meta.fb.hs', rounds=655555) | to_uuid }}" + +matrix_mautrix_meta_messenger_bridge_login_shared_secret: "{{ matrix_synapse_ext_password_provider_shared_secret_auth_shared_secret if matrix_synapse_ext_password_provider_shared_secret_auth_enabled else '' }}" + +matrix_mautrix_meta_messenger_metrics_enabled: "{{ prometheus_enabled or matrix_metrics_exposure_enabled }}" + +matrix_mautrix_meta_messenger_metrics_proxying_enabled: "{{ matrix_mautrix_meta_messenger_metrics_enabled and matrix_metrics_exposure_enabled }}" +matrix_mautrix_meta_messenger_metrics_proxying_hostname: "{{ matrix_metrics_exposure_hostname }}" +matrix_mautrix_meta_messenger_metrics_proxying_path_prefix: "{{ matrix_metrics_exposure_path_prefix }}/mautrix-meta-messenger" + +# We'd like to force-set people with external Postgres to SQLite, so the bridge role can complain +# and point them to a migration path. +matrix_mautrix_meta_messenger_database_engine: "{{ 'postgres' if devture_postgres_enabled else 'sqlite3-fk-wal' }}" +matrix_mautrix_meta_messenger_database_hostname: "{{ devture_postgres_connection_hostname if (devture_postgres_enabled and matrix_mautrix_meta_messenger_database_engine == 'postgres') else '' }}" +matrix_mautrix_meta_messenger_database_password: "{{ ('%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'mau.fb.db', rounds=655555) | to_uuid) if (devture_postgres_enabled and matrix_mautrix_meta_messenger_database_engine == 'postgres') else '' }}" + +###################################################################### +# +# /matrix-bridge-mautrix-meta-messenger +# +###################################################################### + + + +###################################################################### +# +# matrix-bridge-mautrix-meta-instagram +# +###################################################################### + +# We don't enable bridges by default. +matrix_mautrix_meta_instagram_enabled: false + +matrix_mautrix_meta_instagram_systemd_required_services_list_auto: | + {{ + matrix_addons_homeserver_systemd_services_list + + + ([devture_postgres_identifier ~ '.service'] if (devture_postgres_enabled and matrix_mautrix_meta_instagram_database_hostname == devture_postgres_connection_hostname) else []) + }} + +matrix_mautrix_meta_instagram_container_image_self_build: "{{ matrix_architecture not in ['amd64', 'arm64'] }}" + +matrix_mautrix_meta_instagram_container_network: "{{ matrix_addons_container_network }}" + +matrix_mautrix_meta_instagram_container_additional_networks_auto: |- + {{ + ( + ([] if matrix_addons_homeserver_container_network == '' else [matrix_addons_homeserver_container_network]) + + + ([devture_postgres_container_network] if (devture_postgres_enabled and matrix_mautrix_meta_instagram_database_hostname == devture_postgres_connection_hostname and matrix_mautrix_meta_instagram_container_network != devture_postgres_container_network) else []) + + + ([matrix_playbook_reverse_proxyable_services_additional_network] if (matrix_playbook_reverse_proxyable_services_additional_network and matrix_mautrix_meta_instagram_container_labels_traefik_enabled) else []) + ) | unique + }} + +matrix_mautrix_meta_instagram_container_labels_traefik_enabled: "{{ matrix_playbook_reverse_proxy_type in ['playbook-managed-traefik', 'other-traefik-container'] }}" +matrix_mautrix_meta_instagram_container_labels_traefik_docker_network: "{{ matrix_playbook_reverse_proxyable_services_additional_network }}" +matrix_mautrix_meta_instagram_container_labels_traefik_entrypoints: "{{ devture_traefik_entrypoint_primary }}" +matrix_mautrix_meta_instagram_container_labels_traefik_tls_certResolver: "{{ devture_traefik_certResolver_primary }}" + +matrix_mautrix_meta_instagram_container_labels_metrics_middleware_basic_auth_enabled: "{{ matrix_metrics_exposure_http_basic_auth_enabled }}" +matrix_mautrix_meta_instagram_container_labels_metrics_middleware_basic_auth_users: "{{ matrix_metrics_exposure_http_basic_auth_users }}" + +matrix_mautrix_meta_instagram_appservice_token: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'mau.meta.ig.as', rounds=655555) | to_uuid }}" + +matrix_mautrix_meta_instagram_homeserver_address: "{{ matrix_addons_homeserver_client_api_url }}" + +matrix_mautrix_meta_instagram_homeserver_token: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'mau.meta.ig.hs', rounds=655555) | to_uuid }}" + +matrix_mautrix_meta_instagram_bridge_login_shared_secret: "{{ matrix_synapse_ext_password_provider_shared_secret_auth_shared_secret if matrix_synapse_ext_password_provider_shared_secret_auth_enabled else '' }}" + +matrix_mautrix_meta_instagram_metrics_enabled: "{{ prometheus_enabled or matrix_metrics_exposure_enabled }}" + +matrix_mautrix_meta_instagram_metrics_proxying_enabled: "{{ matrix_mautrix_meta_instagram_metrics_enabled and matrix_metrics_exposure_enabled }}" +matrix_mautrix_meta_instagram_metrics_proxying_hostname: "{{ matrix_metrics_exposure_hostname }}" +matrix_mautrix_meta_instagram_metrics_proxying_path_prefix: "{{ matrix_metrics_exposure_path_prefix }}/mautrix-meta-instagram" + +# We'd like to force-set people with external Postgres to SQLite, so the bridge role can complain +# and point them to a migration path. +matrix_mautrix_meta_instagram_database_engine: "{{ 'postgres' if devture_postgres_enabled else 'sqlite3-fk-wal' }}" +matrix_mautrix_meta_instagram_database_hostname: "{{ devture_postgres_connection_hostname if (devture_postgres_enabled and matrix_mautrix_meta_instagram_database_engine == 'postgres') else '' }}" +matrix_mautrix_meta_instagram_database_password: "{{ ('%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'mau.fb.db', rounds=655555) | to_uuid) if (devture_postgres_enabled and matrix_mautrix_meta_instagram_database_engine == 'postgres') else '' }}" + +###################################################################### +# +# /matrix-bridge-mautrix-meta-instagram +# +###################################################################### + + ###################################################################### # # matrix-bridge-mautrix-telegram @@ -3455,6 +3601,18 @@ devture_postgres_managed_databases_auto: | 'password': matrix_mautrix_signal_database_password, }] if (matrix_mautrix_signal_enabled and matrix_mautrix_signal_database_engine == 'postgres' and matrix_mautrix_signal_database_hostname == devture_postgres_connection_hostname) else []) + + ([{ + 'name': matrix_mautrix_meta_messenger_database_name, + 'username': matrix_mautrix_meta_messenger_database_username, + 'password': matrix_mautrix_meta_messenger_database_password, + }] if (matrix_mautrix_meta_messenger_enabled and matrix_mautrix_meta_messenger_database_engine == 'postgres' and matrix_mautrix_meta_messenger_database_hostname == devture_postgres_connection_hostname) else []) + + + ([{ + 'name': matrix_mautrix_meta_instagram_database_name, + 'username': matrix_mautrix_meta_instagram_database_username, + 'password': matrix_mautrix_meta_instagram_database_password, + }] if (matrix_mautrix_meta_instagram_enabled and matrix_mautrix_meta_instagram_database_engine == 'postgres' and matrix_mautrix_meta_instagram_database_hostname == devture_postgres_connection_hostname) else []) + + ([{ 'name': matrix_mautrix_wsproxy_syncproxy_database_name, 'username': matrix_mautrix_wsproxy_syncproxy_database_username, diff --git a/justfile b/justfile index 46abd7bfb..b7ca7d2c4 100644 --- a/justfile +++ b/justfile @@ -58,3 +58,7 @@ stop-all *extra_args: (run-tags "stop-all" extra_args) # Stops a specific service group stop-group group *extra_args: @just --justfile {{ justfile() }} run-tags stop-group --extra-vars="group={{ group }}" {{ extra_args }} + +# Rebuilds the mautrix-meta-instagram Ansible role using the mautrix-meta-messenger role as a source +rebuild-mautrix-meta-instagram: + /bin/bash {{ justfile_directory() }}/bin/rebuild-mautrix-meta-instagram.sh {{ justfile_directory() }}/roles/custom diff --git a/roles/custom/matrix-bridge-mautrix-meta-instagram/README.md b/roles/custom/matrix-bridge-mautrix-meta-instagram/README.md new file mode 100644 index 000000000..41e9d77d9 --- /dev/null +++ b/roles/custom/matrix-bridge-mautrix-meta-instagram/README.md @@ -0,0 +1,5 @@ +# matrix-mautrix-meta-instagram + +This bridge role is derived from the matrix-mautrix-meta-messenger Ansible role via automatic changes (see `just rebuild-mautrix-meta-instagram` or `bin/rebuild-mautrix-meta-instagram.sh`). + +If you'd like to make a change to this role, consider making it to the `matrix-mautrix-meta-messenger` role instead. diff --git a/roles/custom/matrix-bridge-mautrix-meta-instagram/defaults/main.yml b/roles/custom/matrix-bridge-mautrix-meta-instagram/defaults/main.yml new file mode 100644 index 000000000..da027a43b --- /dev/null +++ b/roles/custom/matrix-bridge-mautrix-meta-instagram/defaults/main.yml @@ -0,0 +1,270 @@ +--- + +# mautrix-meta is a Matrix <-> Facebook/Messenger/Instagram bridge +# Project source code URL: https://github.com/mautrix/meta +# +# WARNING: this bridge role is used for both Messenger and Instagram. +# This Messenger role acts as a source and auto-generates matrix-bridge-mautrix-meta-instagram +# thanks to `just rebuild-mautrix-meta-instagram` (`bin/rebuild-mautrix-meta-instagram.sh`). +# If you'd like to make changes to the Instagram role, consider making your changes to the Messenger role instead. + +matrix_mautrix_meta_instagram_enabled: true + +matrix_mautrix_meta_instagram_identifier: matrix-mautrix-meta-instagram + +# renovate: datasource=docker depName=dock.mau.dev/mautrix/meta +matrix_mautrix_meta_instagram_version: v0.1.0 + +matrix_mautrix_meta_instagram_base_path: "{{ matrix_base_data_path }}/mautrix-meta-instagram" +matrix_mautrix_meta_instagram_config_path: "{{ matrix_mautrix_meta_instagram_base_path }}/config" +matrix_mautrix_meta_instagram_data_path: "{{ matrix_mautrix_meta_instagram_base_path }}/data" +matrix_mautrix_meta_instagram_container_src_files_path: "{{ matrix_mautrix_meta_instagram_base_path }}/container-src" + +matrix_mautrix_meta_instagram_container_image_self_build: false +matrix_mautrix_meta_instagram_container_image_self_build_repo: "https://github.com/mautrix/meta.git" + +matrix_mautrix_meta_instagram_container_image: "{{ matrix_mautrix_meta_instagram_container_image_name_prefix }}mautrix/meta:{{ matrix_mautrix_meta_instagram_version }}" +matrix_mautrix_meta_instagram_container_image_name_prefix: "{{ 'localhost/' if matrix_mautrix_meta_instagram_container_image_self_build else 'dock.mau.dev/' }}" +matrix_mautrix_meta_instagram_container_image_force_pull: "{{ matrix_mautrix_meta_instagram_container_image.endswith(':latest') }}" + +matrix_mautrix_meta_instagram_container_network: "" + +matrix_mautrix_meta_instagram_container_additional_networks: "{{ matrix_mautrix_meta_instagram_container_additional_networks_auto + matrix_mautrix_meta_instagram_container_additional_networks_custom }}" +matrix_mautrix_meta_instagram_container_additional_networks_auto: [] +matrix_mautrix_meta_instagram_container_additional_networks_custom: [] + +# matrix_mautrix_meta_instagram_container_labels_traefik_enabled controls whether labels to assist a Traefik reverse-proxy will be attached to the container. +# See `../templates/labels.j2` for details. +# +# To inject your own other container labels, see `matrix_mautrix_meta_instagram_container_labels_additional_labels`. +matrix_mautrix_meta_instagram_container_labels_traefik_enabled: true +matrix_mautrix_meta_instagram_container_labels_traefik_docker_network: "{{ matrix_mautrix_meta_instagram_container_network }}" +matrix_mautrix_meta_instagram_container_labels_traefik_entrypoints: web-secure +matrix_mautrix_meta_instagram_container_labels_traefik_tls_certResolver: default # noqa var-naming + +# Controls whether labels will be added that expose the bridge's metrics +matrix_mautrix_meta_instagram_container_labels_metrics_enabled: "{{ matrix_mautrix_meta_instagram_metrics_enabled and matrix_mautrix_meta_instagram_metrics_proxying_enabled }}" +matrix_mautrix_meta_instagram_container_labels_metrics_traefik_rule: "Host(`{{ matrix_mautrix_meta_instagram_metrics_proxying_hostname }}`) && PathPrefix(`{{ matrix_mautrix_meta_instagram_metrics_proxying_path_prefix }}`)" +matrix_mautrix_meta_instagram_container_labels_metrics_traefik_priority: 0 +matrix_mautrix_meta_instagram_container_labels_metrics_traefik_entrypoints: "{{ matrix_mautrix_meta_instagram_container_labels_traefik_entrypoints }}" +matrix_mautrix_meta_instagram_container_labels_metrics_traefik_tls: "{{ matrix_mautrix_meta_instagram_container_labels_metrics_traefik_entrypoints != 'web' }}" +matrix_mautrix_meta_instagram_container_labels_metrics_traefik_tls_certResolver: "{{ matrix_mautrix_meta_instagram_container_labels_traefik_tls_certResolver }}" # noqa var-naming +matrix_mautrix_meta_instagram_container_labels_metrics_middleware_basic_auth_enabled: false +# See: https://doc.traefik.io/traefik/middlewares/http/basicauth/#users +matrix_mautrix_meta_instagram_container_labels_metrics_middleware_basic_auth_users: '' + +# matrix_mautrix_meta_instagram_container_labels_additional_labels contains a multiline string with additional labels to add to the container label file. +# See `../templates/labels.j2` for details. +# +# Example: +# matrix_mautrix_meta_instagram_container_labels_additional_labels: | +# my.label=1 +# another.label="here" +matrix_mautrix_meta_instagram_container_labels_additional_labels: '' + +# A list of extra arguments to pass to the container +matrix_mautrix_meta_instagram_container_extra_arguments: [] + +# List of systemd services that the systemd service depends on. +matrix_mautrix_meta_instagram_systemd_required_services_list: "{{ matrix_mautrix_meta_instagram_systemd_required_services_list_default + matrix_mautrix_meta_instagram_systemd_required_services_list_auto + matrix_mautrix_meta_instagram_systemd_required_services_list_custom }}" +matrix_mautrix_meta_instagram_systemd_required_services_list_default: ['docker.service'] +matrix_mautrix_meta_instagram_systemd_required_services_list_auto: [] +matrix_mautrix_meta_instagram_systemd_required_services_list_custom: [] + +# List of systemd services that the systemd service wants +matrix_mautrix_meta_instagram_systemd_wanted_services_list: [] + +# Controls whether the bridge container exposes its HTTP port. +# +# Takes an ":" or "" value (e.g. "127.0.0.1:29319"), or empty string to not expose. +matrix_mautrix_meta_instagram_container_http_host_bind_port: '' + +# Database-related configuration fields +matrix_mautrix_meta_instagram_database_engine: sqlite3-fk-wal + +matrix_mautrix_meta_instagram_sqlite_database_path_local: "{{ matrix_mautrix_meta_instagram_data_path }}/mautrix-meta.db" +matrix_mautrix_meta_instagram_sqlite_database_path_in_container: "/data/mautrix-meta.db" + +matrix_mautrix_meta_instagram_database_suffix: |- + {{ + ({ + 'facebook': '_facebook', + 'facebook-tor': '_facebook', + 'messenger': '_messenger', + 'instagram': '_instagram', + })[matrix_mautrix_meta_instagram_meta_mode] + }} + +matrix_mautrix_meta_instagram_database_username: "matrix_mautrix_meta{{ matrix_mautrix_meta_instagram_database_suffix }}" +matrix_mautrix_meta_instagram_database_password: '' +matrix_mautrix_meta_instagram_database_hostname: '' +matrix_mautrix_meta_instagram_database_port: 5432 +matrix_mautrix_meta_instagram_database_name: "matrix_mautrix_meta{{ matrix_mautrix_meta_instagram_database_suffix }}" +matrix_mautrix_meta_instagram_database_sslmode: disable + +matrix_mautrix_meta_instagram_database_connection_string: 'postgres://{{ matrix_mautrix_meta_instagram_database_username }}:{{ matrix_mautrix_meta_instagram_database_password }}@{{ matrix_mautrix_meta_instagram_database_hostname }}:{{ matrix_mautrix_meta_instagram_database_port }}/{{ matrix_mautrix_meta_instagram_database_name }}?sslmode={{ matrix_mautrix_meta_instagram_database_sslmode }}' + +matrix_mautrix_meta_instagram_homeserver_address: "" +matrix_mautrix_meta_instagram_homeserver_domain: '{{ matrix_domain }}' +matrix_mautrix_meta_instagram_homeserver_token: '' + +matrix_mautrix_meta_instagram_appservice_address: "http://{{ matrix_mautrix_meta_instagram_identifier }}:29319" + +matrix_mautrix_meta_instagram_appservice_id: "{{ matrix_mautrix_meta_instagram_meta_mode }}" + +# For Facebook/Messenger, we use the same `@messengerbot:DOMAIN` username regardless of how bridging happens for multiple reasons: +# - it's consistent - regardless of how bridging happens, the bridged service is actually Messenger +# - it's easy for users - you may change the mode, but the bot is always at `@messengerbot:DOMAIN` +# - it doesn't conflict with mautrix-facebook which uses `@facebookbot:DOMAIN` +# - `matrix_mautrix_meta_instagram_appservice_avatar` only has icons for Messenger and Instagram, not Facebook +matrix_mautrix_meta_instagram_appservice_username_prefix: |- + {{ + ({ + 'facebook': 'messenger', + 'facebook-tor': 'messenger', + 'messenger': 'messenger', + 'instagram': 'instagram', + })[matrix_mautrix_meta_instagram_meta_mode] + }} +matrix_mautrix_meta_instagram_appservice_username: "{{ matrix_mautrix_meta_instagram_appservice_username_prefix }}bot" +matrix_mautrix_meta_instagram_appservice_displayname: "{{ matrix_mautrix_meta_instagram_meta_mode | capitalize }} bridge bot" +matrix_mautrix_meta_instagram_appservice_avatar: "{{ 'mxc://maunium.net/JxjlbZUlCPULEeHZSwleUXQv' if matrix_mautrix_meta_instagram_meta_mode == 'instagram' else 'mxc://maunium.net/ygtkteZsXnGJLJHRchUwYWak' }}" + +matrix_mautrix_meta_instagram_appservice_database_type: "{{ matrix_mautrix_meta_instagram_database_engine }}" + +matrix_mautrix_meta_instagram_appservice_database_uri: |- + {{ + { + 'sqlite3-fk-wal': ('sqlite:///' + matrix_mautrix_meta_instagram_sqlite_database_path_in_container), + 'postgres': matrix_mautrix_meta_instagram_database_connection_string, + }[matrix_mautrix_meta_instagram_database_engine] + }} + +matrix_mautrix_meta_instagram_appservice_token: '' + +# Controls which service this bridge is for. +# Valid options: +# * facebook - connect to FB Messenger via facebook.com +# * facebook-tor - connect to FB Messenger via facebookwkhpilnemxj7asaniu7vnjjbiltxjqhye3mhbshg7kx5tfyd.onion +# (note: does not currently proxy media downloads) +# * messenger - connect to FB Messenger via messenger.com (can be used with the facebook side deactivated) +# * instagram - connect to Instagram DMs via instagram.com +matrix_mautrix_meta_instagram_meta_mode: instagram + +# When in `instagram` mode (see `matrix_mautrix_meta_instagram_meta_mode`), should the bridge connect to WhatsApp servers for encrypted chats? +matrix_mautrix_meta_instagram_meta_ig_e2ee: false + +# Whether or not metrics endpoint should be enabled. +# Enabling them is usually enough for a local (in-container) Prometheus to consume them. +# If metrics need to be consumed by another (external) Prometheus server, consider exposing them via `matrix_mautrix_meta_instagram_metrics_proxying_enabled`. +matrix_mautrix_meta_instagram_metrics_enabled: false + +# Controls whether metrics should be exposed on a public URL. +matrix_mautrix_meta_instagram_metrics_proxying_enabled: false +matrix_mautrix_meta_instagram_metrics_proxying_hostname: '' +matrix_mautrix_meta_instagram_metrics_proxying_path_prefix: '' + +matrix_mautrix_meta_instagram_bridge_username_prefix: |- + {{ + ({ + 'facebook': 'facebook_', + 'facebook-tor': 'facebook_', + 'messenger': 'messenger_', + 'instagram': 'instagram_', + })[matrix_mautrix_meta_instagram_meta_mode] + }} + +# Localpart template of MXIDs for FB/IG users. +# {{.}} is replaced with the internal ID of the FB/IG user. +# Changing this may require that you change the regex in the appservice. +matrix_mautrix_meta_instagram_bridge_username_template: "{{ matrix_mautrix_meta_instagram_bridge_username_prefix + '{{.}}' }}" + +matrix_mautrix_meta_instagram_bridge_displayname_template: '{% raw %}{{or .DisplayName .Username "Unknown user"}}{% endraw %}' + +# The prefix for commands. Only required in non-management rooms. +# If set to "default", will be determined based on meta -> mode (`matrix_mautrix_meta_instagram_meta_mode`): +# - "!ig" for instagram +# - "!fb" for facebook +matrix_mautrix_meta_instagram_bridge_command_prefix: default + +# Whether or not created rooms should have federation enabled. +# If false, created portal rooms will never be federated. +matrix_mautrix_meta_instagram_bridge_federate_rooms: true + +# Enable End-to-bridge encryption +matrix_mautrix_meta_instagram_bridge_encryption_allow: "{{ matrix_bridges_encryption_enabled }}" +matrix_mautrix_meta_instagram_bridge_encryption_default: "{{ matrix_mautrix_meta_instagram_bridge_encryption_allow }}" +matrix_mautrix_meta_instagram_bridge_encryption_allow_key_sharing: "{{ matrix_mautrix_meta_instagram_bridge_encryption_allow }}" +matrix_mautrix_meta_instagram_bridge_encryption_appservice: false +matrix_mautrix_meta_instagram_bridge_encryption_require: false + +# Can be set to enable automatic double-puppeting via Shared Secret Auth (https://github.com/devture/matrix-synapse-shared-secret-auth). +matrix_mautrix_meta_instagram_bridge_login_shared_secret: '' + +matrix_mautrix_meta_instagram_bridge_login_shared_secret_map: "{{ {matrix_mautrix_meta_instagram_homeserver_domain: matrix_mautrix_meta_instagram_bridge_login_shared_secret} if matrix_mautrix_meta_instagram_bridge_login_shared_secret else {} }}" + +matrix_mautrix_meta_instagram_bridge_permissions: "{{ matrix_mautrix_meta_instagram_bridge_permissions_default | combine(matrix_mautrix_meta_instagram_bridge_permissions_custom) }}" + +matrix_mautrix_meta_instagram_bridge_permissions_default: |- + {{ + {'*': 'relay', matrix_mautrix_meta_instagram_homeserver_domain: 'user'} + | combine({matrix_admin: 'admin'} if matrix_admin else {}) + }} + +matrix_mautrix_meta_instagram_bridge_permissions_custom: {} + +# Enable bridge relay bot functionality +matrix_mautrix_meta_instagram_bridge_relay_enabled: "{{ matrix_bridges_relay_enabled }}" +matrix_mautrix_meta_instagram_bridge_relay_admin_only: true + +matrix_mautrix_meta_instagram_bridge_management_room_text_welcome: |- + {{ + ({ + 'facebook': "Hello, I'm a Facebook bridge bot.", + 'facebook-tor': "Hello, I'm a Facebook bridge bot which uses Tor.", + 'messenger': "Hello, I'm a Messenger bridge bot.", + 'instagram': "Hello, I'm an Instagram bridge bot.", + })[matrix_mautrix_meta_instagram_meta_mode] + }} + +# Specifies the default log level. +# This bridge uses zerolog, so valid levels are: panic, fatal, error, warn, info, debug, trace +matrix_mautrix_meta_instagram_logging_min_level: warn + +# Default configuration template which covers the generic use case. +# You can customize it by controlling the various variables inside it. +# +# For a more advanced customization, you can extend the default (see `matrix_mautrix_meta_instagram_configuration_extension_yaml`) +# or completely replace this variable with your own template. +matrix_mautrix_meta_instagram_configuration_yaml: "{{ lookup('template', 'templates/config.yaml.j2') }}" + +matrix_mautrix_meta_instagram_configuration_extension_yaml: | + # Your custom YAML configuration goes here. + # This configuration extends the default starting configuration (`matrix_mautrix_meta_instagram_configuration_yaml`). + # + # You can override individual variables from the default configuration, or introduce new ones. + # + # If you need something more special, you can take full control by + # completely redefining `matrix_mautrix_meta_instagram_configuration_yaml`. + +matrix_mautrix_meta_instagram_configuration_extension: "{{ matrix_mautrix_meta_instagram_configuration_extension_yaml | from_yaml if matrix_mautrix_meta_instagram_configuration_extension_yaml | from_yaml is mapping else {} }}" + +# Holds the final configuration (a combination of the default and its extension). +# You most likely don't need to touch this variable. Instead, see `matrix_mautrix_meta_instagram_configuration_yaml`. +matrix_mautrix_meta_instagram_configuration: "{{ matrix_mautrix_meta_instagram_configuration_yaml | from_yaml | combine(matrix_mautrix_meta_instagram_configuration_extension, recursive=True) }}" + +matrix_mautrix_meta_instagram_registration_yaml: | + id: {{ matrix_mautrix_meta_instagram_appservice_id | to_json }} + as_token: {{ matrix_mautrix_meta_instagram_appservice_token | to_json }} + hs_token: {{ matrix_mautrix_meta_instagram_homeserver_token | to_json }} + namespaces: + users: + - exclusive: true + regex: '^@{{ matrix_mautrix_meta_instagram_bridge_username_prefix }}.+:{{ matrix_mautrix_meta_instagram_homeserver_domain | regex_escape }}$' + - exclusive: true + regex: '^@{{ matrix_mautrix_meta_instagram_appservice_username | regex_escape }}:{{ matrix_mautrix_meta_instagram_homeserver_domain | regex_escape }}$' + url: {{ matrix_mautrix_meta_instagram_appservice_address }} + sender_localpart: _bot_{{ matrix_mautrix_meta_instagram_appservice_username }} + rate_limited: false + +matrix_mautrix_meta_instagram_registration: "{{ matrix_mautrix_meta_instagram_registration_yaml | from_yaml }}" diff --git a/roles/custom/matrix-bridge-mautrix-meta-instagram/tasks/install.yml b/roles/custom/matrix-bridge-mautrix-meta-instagram/tasks/install.yml new file mode 100644 index 000000000..906e5040d --- /dev/null +++ b/roles/custom/matrix-bridge-mautrix-meta-instagram/tasks/install.yml @@ -0,0 +1,121 @@ +--- + +- ansible.builtin.set_fact: + matrix_mautrix_meta_instagram_requires_restart: false + +- when: "matrix_mautrix_meta_instagram_database_engine == 'postgres'" + block: + - name: Check if an SQLite database already exists + ansible.builtin.stat: + path: "{{ matrix_mautrix_meta_instagram_sqlite_database_path_local }}" + register: matrix_mautrix_meta_instagram_sqlite_database_path_local_stat_result + + - when: "matrix_mautrix_meta_instagram_sqlite_database_path_local_stat_result.stat.exists | bool" + block: + - ansible.builtin.include_role: + name: galaxy/com.devture.ansible.role.postgres + tasks_from: migrate_db_to_postgres + vars: + devture_postgres_db_migration_request: + src: "{{ matrix_mautrix_meta_instagram_sqlite_database_path_local }}" + dst: "{{ matrix_mautrix_meta_instagram_database_connection_string }}" + caller: "{{ role_path | basename }}" + engine_variable_name: 'matrix_mautrix_meta_instagram_database_engine' + engine_old: 'sqlite' + systemd_services_to_stop: "{{ [matrix_mautrix_meta_instagram_identifier + '.service'] }}" + + - ansible.builtin.set_fact: + matrix_mautrix_meta_instagram_requires_restart: true + +- name: Ensure mautrix-meta-instagram container image is pulled + community.docker.docker_image: + name: "{{ matrix_mautrix_meta_instagram_container_image }}" + source: "{{ 'pull' if ansible_version.major > 2 or ansible_version.minor > 7 else omit }}" + force_source: "{{ matrix_mautrix_meta_instagram_container_image_force_pull if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}" + force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else matrix_mautrix_meta_instagram_container_image_force_pull }}" + when: not matrix_mautrix_meta_instagram_container_image_self_build + register: result + retries: "{{ devture_playbook_help_container_retries_count }}" + delay: "{{ devture_playbook_help_container_retries_delay }}" + until: result is not failed + +- name: Ensure mautrix-meta-instagram paths exist + ansible.builtin.file: + path: "{{ item.path }}" + state: directory + mode: 0750 + owner: "{{ matrix_user_username }}" + group: "{{ matrix_user_groupname }}" + with_items: + - {path: "{{ matrix_mautrix_meta_instagram_base_path }}", when: true} + - {path: "{{ matrix_mautrix_meta_instagram_config_path }}", when: true} + - {path: "{{ matrix_mautrix_meta_instagram_data_path }}", when: true} + - {path: "{{ matrix_mautrix_meta_instagram_container_src_files_path }}", when: "{{ matrix_mautrix_meta_instagram_container_image_self_build }}"} + when: item.when | bool + +- when: matrix_mautrix_meta_instagram_container_image_self_build | bool + block: + - name: Ensure mautrix-meta-instagram repository is present on self-build + ansible.builtin.git: + repo: "{{ matrix_mautrix_meta_instagram_container_image_self_build_repo }}" + dest: "{{ matrix_mautrix_meta_instagram_container_src_files_path }}" + version: "{{ matrix_mautrix_meta_instagram_container_image.split(':')[1] }}" + force: "yes" + become: true + become_user: "{{ matrix_user_username }}" + register: matrix_mautrix_meta_instagram_git_pull_results + + - name: Ensure mautrix-meta-instagram container image is built + community.docker.docker_image: + name: "{{ matrix_mautrix_meta_instagram_container_image }}" + source: build + force_source: "{{ matrix_mautrix_meta_instagram_git_pull_results.changed if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}" + force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else matrix_mautrix_meta_instagram_git_pull_results.changed }}" + build: + dockerfile: Dockerfile + path: "{{ matrix_mautrix_meta_instagram_container_src_files_path }}" + pull: true + +- name: Ensure mautrix-meta-instagram config.yaml installed + ansible.builtin.copy: + content: "{{ matrix_mautrix_meta_instagram_configuration | to_nice_yaml(indent=2, width=999999) }}" + dest: "{{ matrix_mautrix_meta_instagram_config_path }}/config.yaml" + mode: 0644 + owner: "{{ matrix_user_username }}" + group: "{{ matrix_user_groupname }}" + +- name: Ensure mautrix-meta-instagram registration.yaml installed + ansible.builtin.copy: + content: "{{ matrix_mautrix_meta_instagram_registration | to_nice_yaml(indent=2, width=999999) }}" + dest: "{{ matrix_mautrix_meta_instagram_config_path }}/registration.yaml" + mode: 0644 + owner: "{{ matrix_user_username }}" + group: "{{ matrix_user_groupname }}" + +- name: Ensure mautrix-meta-instagram support files installed + ansible.builtin.template: + src: "{{ role_path }}/templates/{{ item }}.j2" + dest: "{{ matrix_mautrix_meta_instagram_base_path }}/{{ item }}" + mode: 0640 + owner: "{{ matrix_user_username }}" + group: "{{ matrix_user_groupname }}" + with_items: + - labels + +- name: Ensure mautrix-meta-instagram container network is created + community.general.docker_network: + name: "{{ matrix_mautrix_meta_instagram_container_network }}" + driver: bridge + +- name: Ensure mautrix-meta-instagram.service installed + ansible.builtin.template: + src: "{{ role_path }}/templates/systemd/matrix-mautrix-meta.service.j2" + dest: "{{ devture_systemd_docker_base_systemd_path }}/{{ matrix_mautrix_meta_instagram_identifier }}.service" + mode: 0644 + +- name: Ensure mautrix-meta-instagram.service restarted, if necessary + ansible.builtin.service: + name: "{{ matrix_mautrix_meta_instagram_identifier }}.service" + state: restarted + daemon_reload: true + when: "matrix_mautrix_meta_instagram_requires_restart | bool" diff --git a/roles/custom/matrix-bridge-mautrix-meta-instagram/tasks/main.yml b/roles/custom/matrix-bridge-mautrix-meta-instagram/tasks/main.yml new file mode 100644 index 000000000..0acc399f0 --- /dev/null +++ b/roles/custom/matrix-bridge-mautrix-meta-instagram/tasks/main.yml @@ -0,0 +1,20 @@ +--- + +- tags: + - setup-all + - setup-mautrix-meta-instagram + - install-all + - install-mautrix-meta-instagram + block: + - when: matrix_mautrix_meta_instagram_enabled | bool + ansible.builtin.include_tasks: "{{ role_path }}/tasks/validate_config.yml" + + - when: matrix_mautrix_meta_instagram_enabled | bool + ansible.builtin.include_tasks: "{{ role_path }}/tasks/install.yml" + +- tags: + - setup-all + - setup-mautrix-meta-instagram + block: + - when: not matrix_mautrix_meta_instagram_enabled | bool + ansible.builtin.include_tasks: "{{ role_path }}/tasks/uninstall.yml" diff --git a/roles/custom/matrix-bridge-mautrix-meta-instagram/tasks/uninstall.yml b/roles/custom/matrix-bridge-mautrix-meta-instagram/tasks/uninstall.yml new file mode 100644 index 000000000..991f47b40 --- /dev/null +++ b/roles/custom/matrix-bridge-mautrix-meta-instagram/tasks/uninstall.yml @@ -0,0 +1,20 @@ +--- + +- name: Check existence of mautrix-meta-instagram service + ansible.builtin.stat: + path: "{{ devture_systemd_docker_base_systemd_path }}/{{ matrix_mautrix_meta_instagram_identifier }}.service" + register: matrix_mautrix_meta_instagram_service_stat + +- when: matrix_mautrix_meta_instagram_service_stat.stat.exists | bool + block: + - name: Ensure mautrix-meta-instagram is stopped + ansible.builtin.service: + name: "{{ matrix_mautrix_meta_instagram_identifier }}" + state: stopped + enabled: false + daemon_reload: true + + - name: Ensure mautrix-meta-instagram.service doesn't exist + ansible.builtin.file: + path: "{{ devture_systemd_docker_base_systemd_path }}/{{ matrix_mautrix_meta_instagram_identifier }}.service" + state: absent diff --git a/roles/custom/matrix-bridge-mautrix-meta-instagram/tasks/validate_config.yml b/roles/custom/matrix-bridge-mautrix-meta-instagram/tasks/validate_config.yml new file mode 100644 index 000000000..e4d2c1596 --- /dev/null +++ b/roles/custom/matrix-bridge-mautrix-meta-instagram/tasks/validate_config.yml @@ -0,0 +1,16 @@ +--- + +- name: Fail if required mautrix-meta-instagram settings not defined + ansible.builtin.fail: + msg: >- + You need to define a required configuration setting (`{{ item.name }}`). + when: "item.when | bool and vars[item.name] == ''" + with_items: + - {'name': 'matrix_mautrix_meta_instagram_metrics_proxying_hostname', when: "{{ matrix_mautrix_meta_instagram_metrics_proxying_enabled }}"} + - {'name': 'matrix_mautrix_meta_instagram_metrics_proxying_path_prefix', when: "{{ matrix_mautrix_meta_instagram_metrics_proxying_enabled }}"} + - {'name': 'matrix_mautrix_meta_instagram_appservice_token', when: true} + - {'name': 'matrix_mautrix_meta_instagram_homeserver_token', when: true} + - {'name': 'matrix_mautrix_meta_instagram_container_network', when: true} + - {'name': 'matrix_mautrix_meta_instagram_homeserver_address', when: true} + - {'name': 'matrix_mautrix_meta_instagram_database_hostname', when: "{{ matrix_mautrix_meta_instagram_database_engine == 'postgres' }}"} + - {'name': 'matrix_mautrix_meta_instagram_database_password', when: "{{ matrix_mautrix_meta_instagram_database_engine == 'postgres' }}"} diff --git a/roles/custom/matrix-bridge-mautrix-meta-instagram/templates/config.yaml.j2 b/roles/custom/matrix-bridge-mautrix-meta-instagram/templates/config.yaml.j2 new file mode 100644 index 000000000..fe1287cc5 --- /dev/null +++ b/roles/custom/matrix-bridge-mautrix-meta-instagram/templates/config.yaml.j2 @@ -0,0 +1,329 @@ +#jinja2: lstrip_blocks: "True" +# Homeserver details. +homeserver: + # The address that this appservice can use to connect to the homeserver. + address: {{ matrix_mautrix_meta_instagram_homeserver_address | to_json }} + # The domain of the homeserver (also known as server_name, used for MXIDs, etc). + domain: {{ matrix_mautrix_meta_instagram_homeserver_domain | to_json }} + + # What software is the homeserver running? + # Standard Matrix homeservers like Synapse, Dendrite and Conduit should just use "standard" here. + software: standard + # The URL to push real-time bridge status to. + # If set, the bridge will make POST requests to this URL whenever a user's meta connection state changes. + # The bridge will use the appservice as_token to authorize requests. + status_endpoint: null + # Endpoint for reporting per-message status. + message_send_checkpoint_endpoint: null + # Does the homeserver support https://github.com/matrix-org/matrix-spec-proposals/pull/2246? + async_media: false + + # Should the bridge use a websocket for connecting to the homeserver? + # The server side is currently not documented anywhere and is only implemented by mautrix-wsproxy, + # mautrix-asmux (deprecated), and hungryserv (proprietary). + websocket: false + # How often should the websocket be pinged? Pinging will be disabled if this is zero. + ping_interval_seconds: 0 + +# Application service host/registration related details. +# Changing these values requires regeneration of the registration. +appservice: + # The address that the homeserver can use to connect to this appservice. + address: {{ matrix_mautrix_meta_instagram_appservice_address | to_json }} + + # The hostname and port where this appservice should listen. + hostname: 0.0.0.0 + port: 29319 + + # Database config. + database: + # The database type. "sqlite3-fk-wal" and "postgres" are supported. + type: {{ matrix_mautrix_meta_instagram_appservice_database_type | to_json }} + # The database URI. + # SQLite: A raw file path is supported, but `file:?_txlock=immediate` is recommended. + # https://github.com/mattn/go-sqlite3#connection-string + # Postgres: Connection string. For example, postgres://user:password@host/database?sslmode=disable + # To connect via Unix socket, use something like postgres:///dbname?host=/var/run/postgresql + uri: {{ matrix_mautrix_meta_instagram_appservice_database_uri | to_json }} + # Maximum number of connections. Mostly relevant for Postgres. + max_open_conns: 20 + max_idle_conns: 2 + # Maximum connection idle time and lifetime before they're closed. Disabled if null. + # Parsed with https://pkg.go.dev/time#ParseDuration + max_conn_idle_time: null + max_conn_lifetime: null + + # The unique ID of this appservice. + id: {{ matrix_mautrix_meta_instagram_appservice_id | to_json }} + # Appservice bot details. + bot: + # Username of the appservice bot. + username: {{ matrix_mautrix_meta_instagram_appservice_username | to_json }} + # Display name and avatar for bot. Set to "remove" to remove display name/avatar, leave empty + # to leave display name/avatar as-is. + displayname: {{ matrix_mautrix_meta_instagram_appservice_displayname | to_json }} + # You can use mxc://maunium.net/JxjlbZUlCPULEeHZSwleUXQv for an Instagram avatar, + # or mxc://maunium.net/ygtkteZsXnGJLJHRchUwYWak for Facebook Messenger + avatar: {{ matrix_mautrix_meta_instagram_appservice_avatar | to_json }} + + # Whether or not to receive ephemeral events via appservice transactions. + # Requires MSC2409 support (i.e. Synapse 1.22+). + ephemeral_events: true + # Should incoming events be handled asynchronously? + # This may be necessary for large public instances with lots of messages going through. + # However, messages will not be guaranteed to be bridged in the same order they were sent in. + async_transactions: false + + # Authentication tokens for AS <-> HS communication. Autogenerated; do not modify. + as_token: {{ matrix_mautrix_meta_instagram_appservice_token | to_json }} + hs_token: {{ matrix_mautrix_meta_instagram_homeserver_token | to_json }} + +# Prometheus config. +metrics: + # Enable prometheus metrics? + enabled: {{ matrix_mautrix_meta_instagram_metrics_enabled | to_json }} + # IP and port where the metrics listener should be. The path is always /metrics + listen: "0.0.0.0.0:8000" + +meta: + # Which service is this bridge for? Available options: + # * facebook - connect to FB Messenger via facebook.com + # * facebook-tor - connect to FB Messenger via facebookwkhpilnemxj7asaniu7vnjjbiltxjqhye3mhbshg7kx5tfyd.onion + # (note: does not currently proxy media downloads) + # * messenger - connect to FB Messenger via messenger.com (can be used with the facebook side deactivated) + # * instagram - connect to Instagram DMs via instagram.com + # + # Remember to change the appservice id, bot profile info, bridge username_template and management_room_text too. + mode: {{ matrix_mautrix_meta_instagram_meta_mode | to_json }} + # When in Instagram mode, should the bridge connect to WhatsApp servers for encrypted chats? + # In FB/Messenger mode encryption is always enabled, this option only affects Instagram mode. + ig_e2ee: {{ matrix_mautrix_meta_instagram_meta_ig_e2ee | to_json }} + # Static proxy address (HTTP or SOCKS5) for connecting to Meta. + proxy: + # HTTP endpoint to request new proxy address from, for dynamically assigned proxies. + # The endpoint must return a JSON body with a string field called proxy_url. + get_proxy_from: + +# Bridge config +bridge: + # Localpart template of MXIDs for FB/IG users. + # {% raw %}{{.}}{% endraw %} is replaced with the internal ID of the FB/IG user. + username_template: {{ matrix_mautrix_meta_instagram_bridge_username_template | to_json }} + # Displayname template for FB/IG users. This is also used as the room name in DMs if private_chat_portal_meta is enabled. + # {% raw %}{{.DisplayName}}{% endraw %} - The display name set by the user. + # {% raw %}{{.Username}}{% endraw %} - The username set by the user. + # {% raw %}{{.ID}}{% endraw %} - The internal user ID of the user. + displayname_template: {{ matrix_mautrix_meta_instagram_bridge_displayname_template | to_json }} + # Whether to explicitly set the avatar and room name for private chat portal rooms. + # If set to `default`, this will be enabled in encrypted rooms and disabled in unencrypted rooms. + # If set to `always`, all DM rooms will have explicit names and avatars set. + # If set to `never`, DM rooms will never have names and avatars set. + private_chat_portal_meta: default + + portal_message_buffer: 128 + + # Should the bridge create a space for each logged-in user and add bridged rooms to it? + # Users who logged in before turning this on should run `!meta sync-space` to create and fill the space for the first time. + personal_filtering_spaces: false + # Should Matrix m.notice-type messages be bridged? + bridge_notices: true + # Should the bridge send a read receipt from the bridge bot when a message has been sent to FB/IG? + delivery_receipts: false + # Whether the bridge should send the message status as a custom com.beeper.message_send_status event. + message_status_events: false + # Whether the bridge should send error notices via m.notice events when a message fails to bridge. + message_error_notices: true + # Should the bridge never send alerts to the bridge management room? + # These are mostly things like the user being logged out. + disable_bridge_alerts: false + # Should the bridge update the m.direct account data event when double puppeting is enabled. + # Note that updating the m.direct event is not atomic and is therefore prone to race conditions. + sync_direct_chat_list: false + # Set this to true to tell the bridge to re-send m.bridge events to all rooms on the next run. + # This field will automatically be changed back to false after it, except if the config file is not writable. + resend_bridge_info: false + # Send captions in the same message as images. This will send data compatible with both MSC2530. + # This is currently not supported in most clients. + caption_in_message: false + # Whether or not created rooms should have federation enabled. + # If false, created portal rooms will never be federated. + federate_rooms: {{ matrix_mautrix_meta_instagram_bridge_federate_rooms | to_json }} + # Should mute status be bridged? Allowed options: always, on-create, never + mute_bridging: on-create + # Servers to always allow double puppeting from + double_puppet_server_map: {} + # Allow using double puppeting from any server with a valid client .well-known file. + double_puppet_allow_discovery: false + # Shared secrets for https://github.com/devture/matrix-synapse-shared-secret-auth + # + # If set, double puppeting will be enabled automatically for local users + # instead of users having to find an access token and run `login-matrix` + # manually. + login_shared_secret_map: {{ matrix_mautrix_meta_instagram_bridge_login_shared_secret_map | to_json }} + + # The prefix for commands. Only required in non-management rooms. + # If set to "default", will be determined based on meta -> mode, "!ig" for instagram and "!fb" for facebook + command_prefix: {{ matrix_mautrix_meta_instagram_bridge_command_prefix | to_json }} + + backfill: + # If disabled, old messages will never be bridged. + enabled: true + # By default, Meta sends info about approximately 20 recent threads. If this is set to something else than 0, + # the bridge will request more threads on first login, until it reaches the specified number of pages + # or the end of the inbox. + inbox_fetch_pages: 0 + # By default, Meta only sends one old message per thread. If this is set to a something else than 0, + # the bridge will delay handling the one automatically received message and request more messages to backfill. + # One page usually contains 20 messages. This can technically be set to -1 to fetch all messages, + # but that will block bridging messages until the entire backfill is completed. + history_fetch_pages: 0 + # Same as above, but for catchup backfills (i.e. when the bridge is restarted). + catchup_fetch_pages: 5 + # Maximum age of chats to leave as unread when backfilling. 0 means all chats can be left as unread. + # If non-zero, chats that are older than this will be marked as read, even if they're still unread on Meta. + unread_hours_threshold: 0 + # Backfill queue settings. Only relevant for Beeper, because standard Matrix servers + # don't support inserting messages into room history. + queue: + # How many pages of messages to request in one go (without sleeping between requests)? + pages_at_once: 5 + # Maximum number of pages to fetch. -1 to fetch all pages until the start of the chat. + max_pages: -1 + # How long to sleep after fetching a bunch of pages ("bunch" defined by pages_at_once). + sleep_between_tasks: 20s + # Disable fetching XMA media (reels, stories, etc) when backfilling. + dont_fetch_xma: true + + # Messages sent upon joining a management room. + # Markdown is supported. The defaults are listed below. + management_room_text: + # Sent when joining a room. + welcome: {{ matrix_mautrix_meta_instagram_bridge_management_room_text_welcome | to_json }} + # Sent when joining a management room and the user is already logged in. + welcome_connected: "Use `help` for help." + # Sent when joining a management room and the user is not logged in. + welcome_unconnected: "Use `help` for help or `login` to log in." + # Optional extra text sent when joining a management room. + additional_help: "" + + # End-to-bridge encryption support options. + # + # See https://docs.mau.fi/bridges/general/end-to-bridge-encryption.html for more info. + encryption: + # Allow encryption, work in group chat rooms with e2ee enabled + allow: {{ matrix_mautrix_meta_instagram_bridge_encryption_allow | to_json }} + # Default to encryption, force-enable encryption in all portals the bridge creates + # This will cause the bridge bot to be in private chats for the encryption to work properly. + default: {{ matrix_mautrix_meta_instagram_bridge_encryption_default | to_json }} + # Whether to use MSC2409/MSC3202 instead of /sync long polling for receiving encryption-related data. + appservice: {{ matrix_mautrix_meta_instagram_bridge_encryption_appservice | to_json }} + # Require encryption, drop any unencrypted messages. + require: {{ matrix_mautrix_meta_instagram_bridge_encryption_require | to_json }} + # Enable key sharing? If enabled, key requests for rooms where users are in will be fulfilled. + # You must use a client that supports requesting keys from other users to use this feature. + allow_key_sharing: {{ matrix_mautrix_meta_instagram_bridge_encryption_allow_key_sharing | to_json }} + # Options for deleting megolm sessions from the bridge. + delete_keys: + # Beeper-specific: delete outbound sessions when hungryserv confirms + # that the user has uploaded the key to key backup. + delete_outbound_on_ack: false + # Don't store outbound sessions in the inbound table. + dont_store_outbound: false + # Ratchet megolm sessions forward after decrypting messages. + ratchet_on_decrypt: false + # Delete fully used keys (index >= max_messages) after decrypting messages. + delete_fully_used_on_decrypt: false + # Delete previous megolm sessions from same device when receiving a new one. + delete_prev_on_new_session: false + # Delete megolm sessions received from a device when the device is deleted. + delete_on_device_delete: false + # Periodically delete megolm sessions when 2x max_age has passed since receiving the session. + periodically_delete_expired: false + # Delete inbound megolm sessions that don't have the received_at field used for + # automatic ratcheting and expired session deletion. This is meant as a migration + # to delete old keys prior to the bridge update. + delete_outdated_inbound: false + # What level of device verification should be required from users? + # + # Valid levels: + # unverified - Send keys to all device in the room. + # cross-signed-untrusted - Require valid cross-signing, but trust all cross-signing keys. + # cross-signed-tofu - Require valid cross-signing, trust cross-signing keys on first use (and reject changes). + # cross-signed-verified - Require valid cross-signing, plus a valid user signature from the bridge bot. + # Note that creating user signatures from the bridge bot is not currently possible. + # verified - Require manual per-device verification + # (currently only possible by modifying the `trust` column in the `crypto_device` database table). + verification_levels: + # Minimum level for which the bridge should send keys to when bridging messages from FB/IG to Matrix. + receive: unverified + # Minimum level that the bridge should accept for incoming Matrix messages. + send: unverified + # Minimum level that the bridge should require for accepting key requests. + share: cross-signed-tofu + # Options for Megolm room key rotation. These options allow you to + # configure the m.room.encryption event content. See: + # https://spec.matrix.org/v1.3/client-server-api/#mroomencryption for + # more information about that event. + rotation: + # Enable custom Megolm room key rotation settings. Note that these + # settings will only apply to rooms created after this option is + # set. + enable_custom: false + # The maximum number of milliseconds a session should be used + # before changing it. The Matrix spec recommends 604800000 (a week) + # as the default. + milliseconds: 604800000 + # The maximum number of messages that should be sent with a given a + # session before changing it. The Matrix spec recommends 100 as the + # default. + messages: 100 + + # Disable rotating keys when a user's devices change? + # You should not enable this option unless you understand all the implications. + disable_device_change_key_rotation: false + + # Settings for provisioning API + provisioning: + # Prefix for the provisioning API paths. + prefix: /_matrix/provision + # Shared secret for authentication. If set to "generate", a random secret will be generated, + # or if set to "disable", the provisioning API will be disabled. + shared_secret: disable + # Enable debug API at /debug with provisioning authentication. + debug_endpoints: false + + # Permissions for using the bridge. + # Permitted values: + # relay - Talk through the relaybot (if enabled), no access otherwise + # user - Access to use the bridge to chat with a Meta account. + # admin - User level and some additional administration tools + # Permitted keys: + # * - All Matrix users + # domain - All users on that homeserver + # mxid - Specific user + permissions: {{ matrix_mautrix_meta_instagram_bridge_permissions | to_json }} + + # Settings for relay mode + relay: + # Whether relay mode should be allowed. If allowed, `!wa set-relay` can be used to turn any + # authenticated user into a relaybot for that chat. + enabled: {{ matrix_mautrix_meta_instagram_bridge_relay_enabled | to_json }} + # Should only admins be allowed to set themselves as relay users? + admin_only: {{ matrix_mautrix_meta_instagram_bridge_relay_admin_only | to_json }} + # The formats to use when sending messages to Meta via the relaybot. + message_formats: + m.text: "{% raw %}{{ .Sender.Displayname }}: {{ .Message }}{% endraw %}" + m.notice: "{% raw %}{{ .Sender.Displayname }}: {{ .Message }}{% endraw %}" + m.emote: "{% raw %}* {{ .Sender.Displayname }} {{ .Message }}{% endraw %}" + m.file: "{% raw %}{{ .Sender.Displayname }} sent a file{% endraw %}" + m.image: "{% raw %}{{ .Sender.Displayname }} sent an image{% endraw %}" + m.audio: "{% raw %}{{ .Sender.Displayname }} sent an audio file{% endraw %}" + m.video: "{% raw %}{{ .Sender.Displayname }} sent a video{% endraw %}" + m.location: "{% raw %}{{ .Sender.Displayname }} sent a location{% endraw %}" + +# Logging config. See https://github.com/tulir/zeroconfig for details. +logging: + min_level: {{ matrix_mautrix_meta_instagram_logging_min_level | to_json }} + writers: + - type: stdout + format: pretty diff --git a/roles/custom/matrix-bridge-mautrix-meta-instagram/templates/labels.j2 b/roles/custom/matrix-bridge-mautrix-meta-instagram/templates/labels.j2 new file mode 100644 index 000000000..3648706cb --- /dev/null +++ b/roles/custom/matrix-bridge-mautrix-meta-instagram/templates/labels.j2 @@ -0,0 +1,48 @@ +{% if matrix_mautrix_meta_instagram_container_labels_traefik_enabled %} +traefik.enable=true + +{% if matrix_mautrix_meta_instagram_container_labels_traefik_docker_network %} +traefik.docker.network={{ matrix_mautrix_meta_instagram_container_labels_traefik_docker_network }} +{% endif %} + +traefik.http.services.{{ matrix_mautrix_meta_instagram_identifier }}-appservice.loadbalancer.server.port=29319 +traefik.http.services.{{ matrix_mautrix_meta_instagram_identifier }}-metrics.loadbalancer.server.port=8000 + + +{% if matrix_mautrix_meta_instagram_container_labels_metrics_enabled %} +############################################################ +# # +# Metrics # +# # +############################################################ + +{% if matrix_mautrix_meta_instagram_container_labels_metrics_middleware_basic_auth_enabled %} +traefik.http.middlewares.{{ matrix_mautrix_meta_instagram_identifier }}-metrics-basic-auth.basicauth.users={{ matrix_mautrix_meta_instagram_container_labels_metrics_middleware_basic_auth_users }} +traefik.http.routers.{{ matrix_mautrix_meta_instagram_identifier }}-metrics.middlewares={{ matrix_mautrix_meta_instagram_identifier }}-metrics-basic-auth +{% endif %} + +traefik.http.routers.{{ matrix_mautrix_meta_instagram_identifier }}-metrics.rule={{ matrix_mautrix_meta_instagram_container_labels_metrics_traefik_rule }} + +{% if matrix_mautrix_meta_instagram_container_labels_metrics_traefik_priority | int > 0 %} +traefik.http.routers.{{ matrix_mautrix_meta_instagram_identifier }}-metrics.priority={{ matrix_mautrix_meta_instagram_container_labels_metrics_traefik_priority }} +{% endif %} + +traefik.http.routers.{{ matrix_mautrix_meta_instagram_identifier }}-metrics.service={{ matrix_mautrix_meta_instagram_identifier }}-metrics +traefik.http.routers.{{ matrix_mautrix_meta_instagram_identifier }}-metrics.entrypoints={{ matrix_mautrix_meta_instagram_container_labels_metrics_traefik_entrypoints }} + +traefik.http.routers.{{ matrix_mautrix_meta_instagram_identifier }}-metrics.tls={{ matrix_mautrix_meta_instagram_container_labels_metrics_traefik_tls | to_json }} +{% if matrix_mautrix_meta_instagram_container_labels_metrics_traefik_tls %} +traefik.http.routers.{{ matrix_mautrix_meta_instagram_identifier }}-metrics.tls.certResolver={{ matrix_mautrix_meta_instagram_container_labels_metrics_traefik_tls_certResolver }} +{% endif %} + +############################################################ +# # +# /Metrics # +# # +############################################################ +{% endif %} + + +{% endif %} + +{{ matrix_mautrix_meta_instagram_container_labels_additional_labels }} diff --git a/roles/custom/matrix-bridge-mautrix-meta-instagram/templates/systemd/matrix-mautrix-meta.service.j2 b/roles/custom/matrix-bridge-mautrix-meta-instagram/templates/systemd/matrix-mautrix-meta.service.j2 new file mode 100644 index 000000000..a772b3eca --- /dev/null +++ b/roles/custom/matrix-bridge-mautrix-meta-instagram/templates/systemd/matrix-mautrix-meta.service.j2 @@ -0,0 +1,51 @@ +#jinja2: lstrip_blocks: "True" +[Unit] +Description=mautrix-meta bridge ({{ matrix_mautrix_meta_instagram_identifier }}) +{% for service in matrix_mautrix_meta_instagram_systemd_required_services_list %} +Requires={{ service }} +After={{ service }} +{% endfor %} +{% for service in matrix_mautrix_meta_instagram_systemd_wanted_services_list %} +Wants={{ service }} +{% endfor %} +DefaultDependencies=no + +[Service] +Type=simple +Environment="HOME={{ devture_systemd_docker_base_systemd_unit_home_path }}" +ExecStartPre=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} stop --time={{ devture_systemd_docker_base_container_stop_grace_time_seconds }} {{ matrix_mautrix_meta_instagram_identifier }} 2>/dev/null || true' +ExecStartPre=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} rm {{ matrix_mautrix_meta_instagram_identifier }} 2>/dev/null || true' + +ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} create \ + --rm \ + --name={{ matrix_mautrix_meta_instagram_identifier }} \ + --log-driver=none \ + --user={{ matrix_user_uid }}:{{ matrix_user_gid }} \ + --cap-drop=ALL \ + --network={{ matrix_mautrix_meta_instagram_container_network }} \ + {% if matrix_mautrix_meta_instagram_container_http_host_bind_port %} + -p {{ matrix_mautrix_meta_instagram_container_http_host_bind_port }}:29319 \ + {% endif %} + --mount type=bind,src={{ matrix_mautrix_meta_instagram_config_path }},dst=/config,ro \ + --mount type=bind,src={{ matrix_mautrix_meta_instagram_data_path }},dst=/data \ + --label-file={{ matrix_mautrix_meta_instagram_base_path }}/labels \ + {% for arg in matrix_mautrix_meta_instagram_container_extra_arguments %} + {{ arg }} \ + {% endfor %} + {{ matrix_mautrix_meta_instagram_container_image }} \ + /usr/bin/mautrix-meta -c /config/config.yaml -r /config/registration.yaml --no-update + +{% for network in matrix_mautrix_meta_instagram_container_additional_networks %} +ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} network connect {{ network }} {{ matrix_mautrix_meta_instagram_identifier }} +{% endfor %} + +ExecStart={{ devture_systemd_docker_base_host_command_docker }} start --attach {{ matrix_mautrix_meta_instagram_identifier }} + +ExecStop=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} stop --time={{ devture_systemd_docker_base_container_stop_grace_time_seconds }} {{ matrix_mautrix_meta_instagram_identifier }} 2>/dev/null || true' +ExecStop=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} rm {{ matrix_mautrix_meta_instagram_identifier }} 2>/dev/null || true' +Restart=always +RestartSec=30 +SyslogIdentifier={{ matrix_mautrix_meta_instagram_identifier }} + +[Install] +WantedBy=multi-user.target diff --git a/roles/custom/matrix-bridge-mautrix-meta-messenger/defaults/main.yml b/roles/custom/matrix-bridge-mautrix-meta-messenger/defaults/main.yml new file mode 100644 index 000000000..e7d6ed321 --- /dev/null +++ b/roles/custom/matrix-bridge-mautrix-meta-messenger/defaults/main.yml @@ -0,0 +1,270 @@ +--- + +# mautrix-meta is a Matrix <-> Facebook/Messenger/Instagram bridge +# Project source code URL: https://github.com/mautrix/meta +# +# WARNING: this bridge role is used for both Messenger and Instagram. +# This Messenger role acts as a source and auto-generates matrix-bridge-mautrix-meta-instagram +# thanks to `just rebuild-mautrix-meta-instagram` (`bin/rebuild-mautrix-meta-instagram.sh`). +# If you'd like to make changes to the Instagram role, consider making your changes to the Messenger role instead. + +matrix_mautrix_meta_messenger_enabled: true + +matrix_mautrix_meta_messenger_identifier: matrix-mautrix-meta-messenger + +# renovate: datasource=docker depName=dock.mau.dev/mautrix/meta +matrix_mautrix_meta_messenger_version: v0.1.0 + +matrix_mautrix_meta_messenger_base_path: "{{ matrix_base_data_path }}/mautrix-meta-messenger" +matrix_mautrix_meta_messenger_config_path: "{{ matrix_mautrix_meta_messenger_base_path }}/config" +matrix_mautrix_meta_messenger_data_path: "{{ matrix_mautrix_meta_messenger_base_path }}/data" +matrix_mautrix_meta_messenger_container_src_files_path: "{{ matrix_mautrix_meta_messenger_base_path }}/container-src" + +matrix_mautrix_meta_messenger_container_image_self_build: false +matrix_mautrix_meta_messenger_container_image_self_build_repo: "https://github.com/mautrix/meta.git" + +matrix_mautrix_meta_messenger_container_image: "{{ matrix_mautrix_meta_messenger_container_image_name_prefix }}mautrix/meta:{{ matrix_mautrix_meta_messenger_version }}" +matrix_mautrix_meta_messenger_container_image_name_prefix: "{{ 'localhost/' if matrix_mautrix_meta_messenger_container_image_self_build else 'dock.mau.dev/' }}" +matrix_mautrix_meta_messenger_container_image_force_pull: "{{ matrix_mautrix_meta_messenger_container_image.endswith(':latest') }}" + +matrix_mautrix_meta_messenger_container_network: "" + +matrix_mautrix_meta_messenger_container_additional_networks: "{{ matrix_mautrix_meta_messenger_container_additional_networks_auto + matrix_mautrix_meta_messenger_container_additional_networks_custom }}" +matrix_mautrix_meta_messenger_container_additional_networks_auto: [] +matrix_mautrix_meta_messenger_container_additional_networks_custom: [] + +# matrix_mautrix_meta_messenger_container_labels_traefik_enabled controls whether labels to assist a Traefik reverse-proxy will be attached to the container. +# See `../templates/labels.j2` for details. +# +# To inject your own other container labels, see `matrix_mautrix_meta_messenger_container_labels_additional_labels`. +matrix_mautrix_meta_messenger_container_labels_traefik_enabled: true +matrix_mautrix_meta_messenger_container_labels_traefik_docker_network: "{{ matrix_mautrix_meta_messenger_container_network }}" +matrix_mautrix_meta_messenger_container_labels_traefik_entrypoints: web-secure +matrix_mautrix_meta_messenger_container_labels_traefik_tls_certResolver: default # noqa var-naming + +# Controls whether labels will be added that expose the bridge's metrics +matrix_mautrix_meta_messenger_container_labels_metrics_enabled: "{{ matrix_mautrix_meta_messenger_metrics_enabled and matrix_mautrix_meta_messenger_metrics_proxying_enabled }}" +matrix_mautrix_meta_messenger_container_labels_metrics_traefik_rule: "Host(`{{ matrix_mautrix_meta_messenger_metrics_proxying_hostname }}`) && PathPrefix(`{{ matrix_mautrix_meta_messenger_metrics_proxying_path_prefix }}`)" +matrix_mautrix_meta_messenger_container_labels_metrics_traefik_priority: 0 +matrix_mautrix_meta_messenger_container_labels_metrics_traefik_entrypoints: "{{ matrix_mautrix_meta_messenger_container_labels_traefik_entrypoints }}" +matrix_mautrix_meta_messenger_container_labels_metrics_traefik_tls: "{{ matrix_mautrix_meta_messenger_container_labels_metrics_traefik_entrypoints != 'web' }}" +matrix_mautrix_meta_messenger_container_labels_metrics_traefik_tls_certResolver: "{{ matrix_mautrix_meta_messenger_container_labels_traefik_tls_certResolver }}" # noqa var-naming +matrix_mautrix_meta_messenger_container_labels_metrics_middleware_basic_auth_enabled: false +# See: https://doc.traefik.io/traefik/middlewares/http/basicauth/#users +matrix_mautrix_meta_messenger_container_labels_metrics_middleware_basic_auth_users: '' + +# matrix_mautrix_meta_messenger_container_labels_additional_labels contains a multiline string with additional labels to add to the container label file. +# See `../templates/labels.j2` for details. +# +# Example: +# matrix_mautrix_meta_messenger_container_labels_additional_labels: | +# my.label=1 +# another.label="here" +matrix_mautrix_meta_messenger_container_labels_additional_labels: '' + +# A list of extra arguments to pass to the container +matrix_mautrix_meta_messenger_container_extra_arguments: [] + +# List of systemd services that the systemd service depends on. +matrix_mautrix_meta_messenger_systemd_required_services_list: "{{ matrix_mautrix_meta_messenger_systemd_required_services_list_default + matrix_mautrix_meta_messenger_systemd_required_services_list_auto + matrix_mautrix_meta_messenger_systemd_required_services_list_custom }}" +matrix_mautrix_meta_messenger_systemd_required_services_list_default: ['docker.service'] +matrix_mautrix_meta_messenger_systemd_required_services_list_auto: [] +matrix_mautrix_meta_messenger_systemd_required_services_list_custom: [] + +# List of systemd services that the systemd service wants +matrix_mautrix_meta_messenger_systemd_wanted_services_list: [] + +# Controls whether the bridge container exposes its HTTP port. +# +# Takes an ":" or "" value (e.g. "127.0.0.1:29319"), or empty string to not expose. +matrix_mautrix_meta_messenger_container_http_host_bind_port: '' + +# Database-related configuration fields +matrix_mautrix_meta_messenger_database_engine: sqlite3-fk-wal + +matrix_mautrix_meta_messenger_sqlite_database_path_local: "{{ matrix_mautrix_meta_messenger_data_path }}/mautrix-meta.db" +matrix_mautrix_meta_messenger_sqlite_database_path_in_container: "/data/mautrix-meta.db" + +matrix_mautrix_meta_messenger_database_suffix: |- + {{ + ({ + 'facebook': '_facebook', + 'facebook-tor': '_facebook', + 'messenger': '_messenger', + 'instagram': '_instagram', + })[matrix_mautrix_meta_messenger_meta_mode] + }} + +matrix_mautrix_meta_messenger_database_username: "matrix_mautrix_meta{{ matrix_mautrix_meta_messenger_database_suffix }}" +matrix_mautrix_meta_messenger_database_password: '' +matrix_mautrix_meta_messenger_database_hostname: '' +matrix_mautrix_meta_messenger_database_port: 5432 +matrix_mautrix_meta_messenger_database_name: "matrix_mautrix_meta{{ matrix_mautrix_meta_messenger_database_suffix }}" +matrix_mautrix_meta_messenger_database_sslmode: disable + +matrix_mautrix_meta_messenger_database_connection_string: 'postgres://{{ matrix_mautrix_meta_messenger_database_username }}:{{ matrix_mautrix_meta_messenger_database_password }}@{{ matrix_mautrix_meta_messenger_database_hostname }}:{{ matrix_mautrix_meta_messenger_database_port }}/{{ matrix_mautrix_meta_messenger_database_name }}?sslmode={{ matrix_mautrix_meta_messenger_database_sslmode }}' + +matrix_mautrix_meta_messenger_homeserver_address: "" +matrix_mautrix_meta_messenger_homeserver_domain: '{{ matrix_domain }}' +matrix_mautrix_meta_messenger_homeserver_token: '' + +matrix_mautrix_meta_messenger_appservice_address: "http://{{ matrix_mautrix_meta_messenger_identifier }}:29319" + +matrix_mautrix_meta_messenger_appservice_id: "{{ matrix_mautrix_meta_messenger_meta_mode }}" + +# For Facebook/Messenger, we use the same `@messengerbot:DOMAIN` username regardless of how bridging happens for multiple reasons: +# - it's consistent - regardless of how bridging happens, the bridged service is actually Messenger +# - it's easy for users - you may change the mode, but the bot is always at `@messengerbot:DOMAIN` +# - it doesn't conflict with mautrix-facebook which uses `@facebookbot:DOMAIN` +# - `matrix_mautrix_meta_messenger_appservice_avatar` only has icons for Messenger and Instagram, not Facebook +matrix_mautrix_meta_messenger_appservice_username_prefix: |- + {{ + ({ + 'facebook': 'messenger', + 'facebook-tor': 'messenger', + 'messenger': 'messenger', + 'instagram': 'instagram', + })[matrix_mautrix_meta_messenger_meta_mode] + }} +matrix_mautrix_meta_messenger_appservice_username: "{{ matrix_mautrix_meta_messenger_appservice_username_prefix }}bot" +matrix_mautrix_meta_messenger_appservice_displayname: "{{ matrix_mautrix_meta_messenger_meta_mode | capitalize }} bridge bot" +matrix_mautrix_meta_messenger_appservice_avatar: "{{ 'mxc://maunium.net/JxjlbZUlCPULEeHZSwleUXQv' if matrix_mautrix_meta_messenger_meta_mode == 'instagram' else 'mxc://maunium.net/ygtkteZsXnGJLJHRchUwYWak' }}" + +matrix_mautrix_meta_messenger_appservice_database_type: "{{ matrix_mautrix_meta_messenger_database_engine }}" + +matrix_mautrix_meta_messenger_appservice_database_uri: |- + {{ + { + 'sqlite3-fk-wal': ('sqlite:///' + matrix_mautrix_meta_messenger_sqlite_database_path_in_container), + 'postgres': matrix_mautrix_meta_messenger_database_connection_string, + }[matrix_mautrix_meta_messenger_database_engine] + }} + +matrix_mautrix_meta_messenger_appservice_token: '' + +# Controls which service this bridge is for. +# Valid options: +# * facebook - connect to FB Messenger via facebook.com +# * facebook-tor - connect to FB Messenger via facebookwkhpilnemxj7asaniu7vnjjbiltxjqhye3mhbshg7kx5tfyd.onion +# (note: does not currently proxy media downloads) +# * messenger - connect to FB Messenger via messenger.com (can be used with the facebook side deactivated) +# * instagram - connect to Instagram DMs via instagram.com +matrix_mautrix_meta_messenger_meta_mode: messenger + +# When in `instagram` mode (see `matrix_mautrix_meta_messenger_meta_mode`), should the bridge connect to WhatsApp servers for encrypted chats? +matrix_mautrix_meta_messenger_meta_ig_e2ee: false + +# Whether or not metrics endpoint should be enabled. +# Enabling them is usually enough for a local (in-container) Prometheus to consume them. +# If metrics need to be consumed by another (external) Prometheus server, consider exposing them via `matrix_mautrix_meta_messenger_metrics_proxying_enabled`. +matrix_mautrix_meta_messenger_metrics_enabled: false + +# Controls whether metrics should be exposed on a public URL. +matrix_mautrix_meta_messenger_metrics_proxying_enabled: false +matrix_mautrix_meta_messenger_metrics_proxying_hostname: '' +matrix_mautrix_meta_messenger_metrics_proxying_path_prefix: '' + +matrix_mautrix_meta_messenger_bridge_username_prefix: |- + {{ + ({ + 'facebook': 'facebook_', + 'facebook-tor': 'facebook_', + 'messenger': 'messenger_', + 'instagram': 'instagram_', + })[matrix_mautrix_meta_messenger_meta_mode] + }} + +# Localpart template of MXIDs for FB/IG users. +# {{.}} is replaced with the internal ID of the FB/IG user. +# Changing this may require that you change the regex in the appservice. +matrix_mautrix_meta_messenger_bridge_username_template: "{{ matrix_mautrix_meta_messenger_bridge_username_prefix + '{{.}}' }}" + +matrix_mautrix_meta_messenger_bridge_displayname_template: '{% raw %}{{or .DisplayName .Username "Unknown user"}}{% endraw %}' + +# The prefix for commands. Only required in non-management rooms. +# If set to "default", will be determined based on meta -> mode (`matrix_mautrix_meta_messenger_meta_mode`): +# - "!ig" for instagram +# - "!fb" for facebook +matrix_mautrix_meta_messenger_bridge_command_prefix: default + +# Whether or not created rooms should have federation enabled. +# If false, created portal rooms will never be federated. +matrix_mautrix_meta_messenger_bridge_federate_rooms: true + +# Enable End-to-bridge encryption +matrix_mautrix_meta_messenger_bridge_encryption_allow: "{{ matrix_bridges_encryption_enabled }}" +matrix_mautrix_meta_messenger_bridge_encryption_default: "{{ matrix_mautrix_meta_messenger_bridge_encryption_allow }}" +matrix_mautrix_meta_messenger_bridge_encryption_allow_key_sharing: "{{ matrix_mautrix_meta_messenger_bridge_encryption_allow }}" +matrix_mautrix_meta_messenger_bridge_encryption_appservice: false +matrix_mautrix_meta_messenger_bridge_encryption_require: false + +# Can be set to enable automatic double-puppeting via Shared Secret Auth (https://github.com/devture/matrix-synapse-shared-secret-auth). +matrix_mautrix_meta_messenger_bridge_login_shared_secret: '' + +matrix_mautrix_meta_messenger_bridge_login_shared_secret_map: "{{ {matrix_mautrix_meta_messenger_homeserver_domain: matrix_mautrix_meta_messenger_bridge_login_shared_secret} if matrix_mautrix_meta_messenger_bridge_login_shared_secret else {} }}" + +matrix_mautrix_meta_messenger_bridge_permissions: "{{ matrix_mautrix_meta_messenger_bridge_permissions_default | combine(matrix_mautrix_meta_messenger_bridge_permissions_custom) }}" + +matrix_mautrix_meta_messenger_bridge_permissions_default: |- + {{ + {'*': 'relay', matrix_mautrix_meta_messenger_homeserver_domain: 'user'} + | combine({matrix_admin: 'admin'} if matrix_admin else {}) + }} + +matrix_mautrix_meta_messenger_bridge_permissions_custom: {} + +# Enable bridge relay bot functionality +matrix_mautrix_meta_messenger_bridge_relay_enabled: "{{ matrix_bridges_relay_enabled }}" +matrix_mautrix_meta_messenger_bridge_relay_admin_only: true + +matrix_mautrix_meta_messenger_bridge_management_room_text_welcome: |- + {{ + ({ + 'facebook': "Hello, I'm a Facebook bridge bot.", + 'facebook-tor': "Hello, I'm a Facebook bridge bot which uses Tor.", + 'messenger': "Hello, I'm a Messenger bridge bot.", + 'instagram': "Hello, I'm an Instagram bridge bot.", + })[matrix_mautrix_meta_messenger_meta_mode] + }} + +# Specifies the default log level. +# This bridge uses zerolog, so valid levels are: panic, fatal, error, warn, info, debug, trace +matrix_mautrix_meta_messenger_logging_min_level: warn + +# Default configuration template which covers the generic use case. +# You can customize it by controlling the various variables inside it. +# +# For a more advanced customization, you can extend the default (see `matrix_mautrix_meta_messenger_configuration_extension_yaml`) +# or completely replace this variable with your own template. +matrix_mautrix_meta_messenger_configuration_yaml: "{{ lookup('template', 'templates/config.yaml.j2') }}" + +matrix_mautrix_meta_messenger_configuration_extension_yaml: | + # Your custom YAML configuration goes here. + # This configuration extends the default starting configuration (`matrix_mautrix_meta_messenger_configuration_yaml`). + # + # You can override individual variables from the default configuration, or introduce new ones. + # + # If you need something more special, you can take full control by + # completely redefining `matrix_mautrix_meta_messenger_configuration_yaml`. + +matrix_mautrix_meta_messenger_configuration_extension: "{{ matrix_mautrix_meta_messenger_configuration_extension_yaml | from_yaml if matrix_mautrix_meta_messenger_configuration_extension_yaml | from_yaml is mapping else {} }}" + +# Holds the final configuration (a combination of the default and its extension). +# You most likely don't need to touch this variable. Instead, see `matrix_mautrix_meta_messenger_configuration_yaml`. +matrix_mautrix_meta_messenger_configuration: "{{ matrix_mautrix_meta_messenger_configuration_yaml | from_yaml | combine(matrix_mautrix_meta_messenger_configuration_extension, recursive=True) }}" + +matrix_mautrix_meta_messenger_registration_yaml: | + id: {{ matrix_mautrix_meta_messenger_appservice_id | to_json }} + as_token: {{ matrix_mautrix_meta_messenger_appservice_token | to_json }} + hs_token: {{ matrix_mautrix_meta_messenger_homeserver_token | to_json }} + namespaces: + users: + - exclusive: true + regex: '^@{{ matrix_mautrix_meta_messenger_bridge_username_prefix }}.+:{{ matrix_mautrix_meta_messenger_homeserver_domain | regex_escape }}$' + - exclusive: true + regex: '^@{{ matrix_mautrix_meta_messenger_appservice_username | regex_escape }}:{{ matrix_mautrix_meta_messenger_homeserver_domain | regex_escape }}$' + url: {{ matrix_mautrix_meta_messenger_appservice_address }} + sender_localpart: _bot_{{ matrix_mautrix_meta_messenger_appservice_username }} + rate_limited: false + +matrix_mautrix_meta_messenger_registration: "{{ matrix_mautrix_meta_messenger_registration_yaml | from_yaml }}" diff --git a/roles/custom/matrix-bridge-mautrix-meta-messenger/tasks/install.yml b/roles/custom/matrix-bridge-mautrix-meta-messenger/tasks/install.yml new file mode 100644 index 000000000..d9f305be4 --- /dev/null +++ b/roles/custom/matrix-bridge-mautrix-meta-messenger/tasks/install.yml @@ -0,0 +1,121 @@ +--- + +- ansible.builtin.set_fact: + matrix_mautrix_meta_messenger_requires_restart: false + +- when: "matrix_mautrix_meta_messenger_database_engine == 'postgres'" + block: + - name: Check if an SQLite database already exists + ansible.builtin.stat: + path: "{{ matrix_mautrix_meta_messenger_sqlite_database_path_local }}" + register: matrix_mautrix_meta_messenger_sqlite_database_path_local_stat_result + + - when: "matrix_mautrix_meta_messenger_sqlite_database_path_local_stat_result.stat.exists | bool" + block: + - ansible.builtin.include_role: + name: galaxy/com.devture.ansible.role.postgres + tasks_from: migrate_db_to_postgres + vars: + devture_postgres_db_migration_request: + src: "{{ matrix_mautrix_meta_messenger_sqlite_database_path_local }}" + dst: "{{ matrix_mautrix_meta_messenger_database_connection_string }}" + caller: "{{ role_path | basename }}" + engine_variable_name: 'matrix_mautrix_meta_messenger_database_engine' + engine_old: 'sqlite' + systemd_services_to_stop: "{{ [matrix_mautrix_meta_messenger_identifier + '.service'] }}" + + - ansible.builtin.set_fact: + matrix_mautrix_meta_messenger_requires_restart: true + +- name: Ensure mautrix-meta-messenger container image is pulled + community.docker.docker_image: + name: "{{ matrix_mautrix_meta_messenger_container_image }}" + source: "{{ 'pull' if ansible_version.major > 2 or ansible_version.minor > 7 else omit }}" + force_source: "{{ matrix_mautrix_meta_messenger_container_image_force_pull if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}" + force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else matrix_mautrix_meta_messenger_container_image_force_pull }}" + when: not matrix_mautrix_meta_messenger_container_image_self_build + register: result + retries: "{{ devture_playbook_help_container_retries_count }}" + delay: "{{ devture_playbook_help_container_retries_delay }}" + until: result is not failed + +- name: Ensure mautrix-meta-messenger paths exist + ansible.builtin.file: + path: "{{ item.path }}" + state: directory + mode: 0750 + owner: "{{ matrix_user_username }}" + group: "{{ matrix_user_groupname }}" + with_items: + - {path: "{{ matrix_mautrix_meta_messenger_base_path }}", when: true} + - {path: "{{ matrix_mautrix_meta_messenger_config_path }}", when: true} + - {path: "{{ matrix_mautrix_meta_messenger_data_path }}", when: true} + - {path: "{{ matrix_mautrix_meta_messenger_container_src_files_path }}", when: "{{ matrix_mautrix_meta_messenger_container_image_self_build }}"} + when: item.when | bool + +- when: matrix_mautrix_meta_messenger_container_image_self_build | bool + block: + - name: Ensure mautrix-meta-messenger repository is present on self-build + ansible.builtin.git: + repo: "{{ matrix_mautrix_meta_messenger_container_image_self_build_repo }}" + dest: "{{ matrix_mautrix_meta_messenger_container_src_files_path }}" + version: "{{ matrix_mautrix_meta_messenger_container_image.split(':')[1] }}" + force: "yes" + become: true + become_user: "{{ matrix_user_username }}" + register: matrix_mautrix_meta_messenger_git_pull_results + + - name: Ensure mautrix-meta-messenger container image is built + community.docker.docker_image: + name: "{{ matrix_mautrix_meta_messenger_container_image }}" + source: build + force_source: "{{ matrix_mautrix_meta_messenger_git_pull_results.changed if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}" + force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else matrix_mautrix_meta_messenger_git_pull_results.changed }}" + build: + dockerfile: Dockerfile + path: "{{ matrix_mautrix_meta_messenger_container_src_files_path }}" + pull: true + +- name: Ensure mautrix-meta-messenger config.yaml installed + ansible.builtin.copy: + content: "{{ matrix_mautrix_meta_messenger_configuration | to_nice_yaml(indent=2, width=999999) }}" + dest: "{{ matrix_mautrix_meta_messenger_config_path }}/config.yaml" + mode: 0644 + owner: "{{ matrix_user_username }}" + group: "{{ matrix_user_groupname }}" + +- name: Ensure mautrix-meta-messenger registration.yaml installed + ansible.builtin.copy: + content: "{{ matrix_mautrix_meta_messenger_registration | to_nice_yaml(indent=2, width=999999) }}" + dest: "{{ matrix_mautrix_meta_messenger_config_path }}/registration.yaml" + mode: 0644 + owner: "{{ matrix_user_username }}" + group: "{{ matrix_user_groupname }}" + +- name: Ensure mautrix-meta-messenger support files installed + ansible.builtin.template: + src: "{{ role_path }}/templates/{{ item }}.j2" + dest: "{{ matrix_mautrix_meta_messenger_base_path }}/{{ item }}" + mode: 0640 + owner: "{{ matrix_user_username }}" + group: "{{ matrix_user_groupname }}" + with_items: + - labels + +- name: Ensure mautrix-meta-messenger container network is created + community.general.docker_network: + name: "{{ matrix_mautrix_meta_messenger_container_network }}" + driver: bridge + +- name: Ensure mautrix-meta-messenger.service installed + ansible.builtin.template: + src: "{{ role_path }}/templates/systemd/matrix-mautrix-meta.service.j2" + dest: "{{ devture_systemd_docker_base_systemd_path }}/{{ matrix_mautrix_meta_messenger_identifier }}.service" + mode: 0644 + +- name: Ensure mautrix-meta-messenger.service restarted, if necessary + ansible.builtin.service: + name: "{{ matrix_mautrix_meta_messenger_identifier }}.service" + state: restarted + daemon_reload: true + when: "matrix_mautrix_meta_messenger_requires_restart | bool" diff --git a/roles/custom/matrix-bridge-mautrix-meta-messenger/tasks/main.yml b/roles/custom/matrix-bridge-mautrix-meta-messenger/tasks/main.yml new file mode 100644 index 000000000..5e5a7bebd --- /dev/null +++ b/roles/custom/matrix-bridge-mautrix-meta-messenger/tasks/main.yml @@ -0,0 +1,20 @@ +--- + +- tags: + - setup-all + - setup-mautrix-meta-messenger + - install-all + - install-mautrix-meta-messenger + block: + - when: matrix_mautrix_meta_messenger_enabled | bool + ansible.builtin.include_tasks: "{{ role_path }}/tasks/validate_config.yml" + + - when: matrix_mautrix_meta_messenger_enabled | bool + ansible.builtin.include_tasks: "{{ role_path }}/tasks/install.yml" + +- tags: + - setup-all + - setup-mautrix-meta-messenger + block: + - when: not matrix_mautrix_meta_messenger_enabled | bool + ansible.builtin.include_tasks: "{{ role_path }}/tasks/uninstall.yml" diff --git a/roles/custom/matrix-bridge-mautrix-meta-messenger/tasks/uninstall.yml b/roles/custom/matrix-bridge-mautrix-meta-messenger/tasks/uninstall.yml new file mode 100644 index 000000000..22040c2df --- /dev/null +++ b/roles/custom/matrix-bridge-mautrix-meta-messenger/tasks/uninstall.yml @@ -0,0 +1,20 @@ +--- + +- name: Check existence of mautrix-meta-messenger service + ansible.builtin.stat: + path: "{{ devture_systemd_docker_base_systemd_path }}/{{ matrix_mautrix_meta_messenger_identifier }}.service" + register: matrix_mautrix_meta_messenger_service_stat + +- when: matrix_mautrix_meta_messenger_service_stat.stat.exists | bool + block: + - name: Ensure mautrix-meta-messenger is stopped + ansible.builtin.service: + name: "{{ matrix_mautrix_meta_messenger_identifier }}" + state: stopped + enabled: false + daemon_reload: true + + - name: Ensure mautrix-meta-messenger.service doesn't exist + ansible.builtin.file: + path: "{{ devture_systemd_docker_base_systemd_path }}/{{ matrix_mautrix_meta_messenger_identifier }}.service" + state: absent diff --git a/roles/custom/matrix-bridge-mautrix-meta-messenger/tasks/validate_config.yml b/roles/custom/matrix-bridge-mautrix-meta-messenger/tasks/validate_config.yml new file mode 100644 index 000000000..3afa49314 --- /dev/null +++ b/roles/custom/matrix-bridge-mautrix-meta-messenger/tasks/validate_config.yml @@ -0,0 +1,16 @@ +--- + +- name: Fail if required mautrix-meta-messenger settings not defined + ansible.builtin.fail: + msg: >- + You need to define a required configuration setting (`{{ item.name }}`). + when: "item.when | bool and vars[item.name] == ''" + with_items: + - {'name': 'matrix_mautrix_meta_messenger_metrics_proxying_hostname', when: "{{ matrix_mautrix_meta_messenger_metrics_proxying_enabled }}"} + - {'name': 'matrix_mautrix_meta_messenger_metrics_proxying_path_prefix', when: "{{ matrix_mautrix_meta_messenger_metrics_proxying_enabled }}"} + - {'name': 'matrix_mautrix_meta_messenger_appservice_token', when: true} + - {'name': 'matrix_mautrix_meta_messenger_homeserver_token', when: true} + - {'name': 'matrix_mautrix_meta_messenger_container_network', when: true} + - {'name': 'matrix_mautrix_meta_messenger_homeserver_address', when: true} + - {'name': 'matrix_mautrix_meta_messenger_database_hostname', when: "{{ matrix_mautrix_meta_messenger_database_engine == 'postgres' }}"} + - {'name': 'matrix_mautrix_meta_messenger_database_password', when: "{{ matrix_mautrix_meta_messenger_database_engine == 'postgres' }}"} diff --git a/roles/custom/matrix-bridge-mautrix-meta-messenger/templates/config.yaml.j2 b/roles/custom/matrix-bridge-mautrix-meta-messenger/templates/config.yaml.j2 new file mode 100644 index 000000000..09bb0c424 --- /dev/null +++ b/roles/custom/matrix-bridge-mautrix-meta-messenger/templates/config.yaml.j2 @@ -0,0 +1,329 @@ +#jinja2: lstrip_blocks: "True" +# Homeserver details. +homeserver: + # The address that this appservice can use to connect to the homeserver. + address: {{ matrix_mautrix_meta_messenger_homeserver_address | to_json }} + # The domain of the homeserver (also known as server_name, used for MXIDs, etc). + domain: {{ matrix_mautrix_meta_messenger_homeserver_domain | to_json }} + + # What software is the homeserver running? + # Standard Matrix homeservers like Synapse, Dendrite and Conduit should just use "standard" here. + software: standard + # The URL to push real-time bridge status to. + # If set, the bridge will make POST requests to this URL whenever a user's meta connection state changes. + # The bridge will use the appservice as_token to authorize requests. + status_endpoint: null + # Endpoint for reporting per-message status. + message_send_checkpoint_endpoint: null + # Does the homeserver support https://github.com/matrix-org/matrix-spec-proposals/pull/2246? + async_media: false + + # Should the bridge use a websocket for connecting to the homeserver? + # The server side is currently not documented anywhere and is only implemented by mautrix-wsproxy, + # mautrix-asmux (deprecated), and hungryserv (proprietary). + websocket: false + # How often should the websocket be pinged? Pinging will be disabled if this is zero. + ping_interval_seconds: 0 + +# Application service host/registration related details. +# Changing these values requires regeneration of the registration. +appservice: + # The address that the homeserver can use to connect to this appservice. + address: {{ matrix_mautrix_meta_messenger_appservice_address | to_json }} + + # The hostname and port where this appservice should listen. + hostname: 0.0.0.0 + port: 29319 + + # Database config. + database: + # The database type. "sqlite3-fk-wal" and "postgres" are supported. + type: {{ matrix_mautrix_meta_messenger_appservice_database_type | to_json }} + # The database URI. + # SQLite: A raw file path is supported, but `file:?_txlock=immediate` is recommended. + # https://github.com/mattn/go-sqlite3#connection-string + # Postgres: Connection string. For example, postgres://user:password@host/database?sslmode=disable + # To connect via Unix socket, use something like postgres:///dbname?host=/var/run/postgresql + uri: {{ matrix_mautrix_meta_messenger_appservice_database_uri | to_json }} + # Maximum number of connections. Mostly relevant for Postgres. + max_open_conns: 20 + max_idle_conns: 2 + # Maximum connection idle time and lifetime before they're closed. Disabled if null. + # Parsed with https://pkg.go.dev/time#ParseDuration + max_conn_idle_time: null + max_conn_lifetime: null + + # The unique ID of this appservice. + id: {{ matrix_mautrix_meta_messenger_appservice_id | to_json }} + # Appservice bot details. + bot: + # Username of the appservice bot. + username: {{ matrix_mautrix_meta_messenger_appservice_username | to_json }} + # Display name and avatar for bot. Set to "remove" to remove display name/avatar, leave empty + # to leave display name/avatar as-is. + displayname: {{ matrix_mautrix_meta_messenger_appservice_displayname | to_json }} + # You can use mxc://maunium.net/JxjlbZUlCPULEeHZSwleUXQv for an Instagram avatar, + # or mxc://maunium.net/ygtkteZsXnGJLJHRchUwYWak for Facebook Messenger + avatar: {{ matrix_mautrix_meta_messenger_appservice_avatar | to_json }} + + # Whether or not to receive ephemeral events via appservice transactions. + # Requires MSC2409 support (i.e. Synapse 1.22+). + ephemeral_events: true + # Should incoming events be handled asynchronously? + # This may be necessary for large public instances with lots of messages going through. + # However, messages will not be guaranteed to be bridged in the same order they were sent in. + async_transactions: false + + # Authentication tokens for AS <-> HS communication. Autogenerated; do not modify. + as_token: {{ matrix_mautrix_meta_messenger_appservice_token | to_json }} + hs_token: {{ matrix_mautrix_meta_messenger_homeserver_token | to_json }} + +# Prometheus config. +metrics: + # Enable prometheus metrics? + enabled: {{ matrix_mautrix_meta_messenger_metrics_enabled | to_json }} + # IP and port where the metrics listener should be. The path is always /metrics + listen: "0.0.0.0.0:8000" + +meta: + # Which service is this bridge for? Available options: + # * facebook - connect to FB Messenger via facebook.com + # * facebook-tor - connect to FB Messenger via facebookwkhpilnemxj7asaniu7vnjjbiltxjqhye3mhbshg7kx5tfyd.onion + # (note: does not currently proxy media downloads) + # * messenger - connect to FB Messenger via messenger.com (can be used with the facebook side deactivated) + # * instagram - connect to Instagram DMs via instagram.com + # + # Remember to change the appservice id, bot profile info, bridge username_template and management_room_text too. + mode: {{ matrix_mautrix_meta_messenger_meta_mode | to_json }} + # When in Instagram mode, should the bridge connect to WhatsApp servers for encrypted chats? + # In FB/Messenger mode encryption is always enabled, this option only affects Instagram mode. + ig_e2ee: {{ matrix_mautrix_meta_messenger_meta_ig_e2ee | to_json }} + # Static proxy address (HTTP or SOCKS5) for connecting to Meta. + proxy: + # HTTP endpoint to request new proxy address from, for dynamically assigned proxies. + # The endpoint must return a JSON body with a string field called proxy_url. + get_proxy_from: + +# Bridge config +bridge: + # Localpart template of MXIDs for FB/IG users. + # {% raw %}{{.}}{% endraw %} is replaced with the internal ID of the FB/IG user. + username_template: {{ matrix_mautrix_meta_messenger_bridge_username_template | to_json }} + # Displayname template for FB/IG users. This is also used as the room name in DMs if private_chat_portal_meta is enabled. + # {% raw %}{{.DisplayName}}{% endraw %} - The display name set by the user. + # {% raw %}{{.Username}}{% endraw %} - The username set by the user. + # {% raw %}{{.ID}}{% endraw %} - The internal user ID of the user. + displayname_template: {{ matrix_mautrix_meta_messenger_bridge_displayname_template | to_json }} + # Whether to explicitly set the avatar and room name for private chat portal rooms. + # If set to `default`, this will be enabled in encrypted rooms and disabled in unencrypted rooms. + # If set to `always`, all DM rooms will have explicit names and avatars set. + # If set to `never`, DM rooms will never have names and avatars set. + private_chat_portal_meta: default + + portal_message_buffer: 128 + + # Should the bridge create a space for each logged-in user and add bridged rooms to it? + # Users who logged in before turning this on should run `!meta sync-space` to create and fill the space for the first time. + personal_filtering_spaces: false + # Should Matrix m.notice-type messages be bridged? + bridge_notices: true + # Should the bridge send a read receipt from the bridge bot when a message has been sent to FB/IG? + delivery_receipts: false + # Whether the bridge should send the message status as a custom com.beeper.message_send_status event. + message_status_events: false + # Whether the bridge should send error notices via m.notice events when a message fails to bridge. + message_error_notices: true + # Should the bridge never send alerts to the bridge management room? + # These are mostly things like the user being logged out. + disable_bridge_alerts: false + # Should the bridge update the m.direct account data event when double puppeting is enabled. + # Note that updating the m.direct event is not atomic and is therefore prone to race conditions. + sync_direct_chat_list: false + # Set this to true to tell the bridge to re-send m.bridge events to all rooms on the next run. + # This field will automatically be changed back to false after it, except if the config file is not writable. + resend_bridge_info: false + # Send captions in the same message as images. This will send data compatible with both MSC2530. + # This is currently not supported in most clients. + caption_in_message: false + # Whether or not created rooms should have federation enabled. + # If false, created portal rooms will never be federated. + federate_rooms: {{ matrix_mautrix_meta_messenger_bridge_federate_rooms | to_json }} + # Should mute status be bridged? Allowed options: always, on-create, never + mute_bridging: on-create + # Servers to always allow double puppeting from + double_puppet_server_map: {} + # Allow using double puppeting from any server with a valid client .well-known file. + double_puppet_allow_discovery: false + # Shared secrets for https://github.com/devture/matrix-synapse-shared-secret-auth + # + # If set, double puppeting will be enabled automatically for local users + # instead of users having to find an access token and run `login-matrix` + # manually. + login_shared_secret_map: {{ matrix_mautrix_meta_messenger_bridge_login_shared_secret_map | to_json }} + + # The prefix for commands. Only required in non-management rooms. + # If set to "default", will be determined based on meta -> mode, "!ig" for instagram and "!fb" for facebook + command_prefix: {{ matrix_mautrix_meta_messenger_bridge_command_prefix | to_json }} + + backfill: + # If disabled, old messages will never be bridged. + enabled: true + # By default, Meta sends info about approximately 20 recent threads. If this is set to something else than 0, + # the bridge will request more threads on first login, until it reaches the specified number of pages + # or the end of the inbox. + inbox_fetch_pages: 0 + # By default, Meta only sends one old message per thread. If this is set to a something else than 0, + # the bridge will delay handling the one automatically received message and request more messages to backfill. + # One page usually contains 20 messages. This can technically be set to -1 to fetch all messages, + # but that will block bridging messages until the entire backfill is completed. + history_fetch_pages: 0 + # Same as above, but for catchup backfills (i.e. when the bridge is restarted). + catchup_fetch_pages: 5 + # Maximum age of chats to leave as unread when backfilling. 0 means all chats can be left as unread. + # If non-zero, chats that are older than this will be marked as read, even if they're still unread on Meta. + unread_hours_threshold: 0 + # Backfill queue settings. Only relevant for Beeper, because standard Matrix servers + # don't support inserting messages into room history. + queue: + # How many pages of messages to request in one go (without sleeping between requests)? + pages_at_once: 5 + # Maximum number of pages to fetch. -1 to fetch all pages until the start of the chat. + max_pages: -1 + # How long to sleep after fetching a bunch of pages ("bunch" defined by pages_at_once). + sleep_between_tasks: 20s + # Disable fetching XMA media (reels, stories, etc) when backfilling. + dont_fetch_xma: true + + # Messages sent upon joining a management room. + # Markdown is supported. The defaults are listed below. + management_room_text: + # Sent when joining a room. + welcome: {{ matrix_mautrix_meta_messenger_bridge_management_room_text_welcome | to_json }} + # Sent when joining a management room and the user is already logged in. + welcome_connected: "Use `help` for help." + # Sent when joining a management room and the user is not logged in. + welcome_unconnected: "Use `help` for help or `login` to log in." + # Optional extra text sent when joining a management room. + additional_help: "" + + # End-to-bridge encryption support options. + # + # See https://docs.mau.fi/bridges/general/end-to-bridge-encryption.html for more info. + encryption: + # Allow encryption, work in group chat rooms with e2ee enabled + allow: {{ matrix_mautrix_meta_messenger_bridge_encryption_allow | to_json }} + # Default to encryption, force-enable encryption in all portals the bridge creates + # This will cause the bridge bot to be in private chats for the encryption to work properly. + default: {{ matrix_mautrix_meta_messenger_bridge_encryption_default | to_json }} + # Whether to use MSC2409/MSC3202 instead of /sync long polling for receiving encryption-related data. + appservice: {{ matrix_mautrix_meta_messenger_bridge_encryption_appservice | to_json }} + # Require encryption, drop any unencrypted messages. + require: {{ matrix_mautrix_meta_messenger_bridge_encryption_require | to_json }} + # Enable key sharing? If enabled, key requests for rooms where users are in will be fulfilled. + # You must use a client that supports requesting keys from other users to use this feature. + allow_key_sharing: {{ matrix_mautrix_meta_messenger_bridge_encryption_allow_key_sharing | to_json }} + # Options for deleting megolm sessions from the bridge. + delete_keys: + # Beeper-specific: delete outbound sessions when hungryserv confirms + # that the user has uploaded the key to key backup. + delete_outbound_on_ack: false + # Don't store outbound sessions in the inbound table. + dont_store_outbound: false + # Ratchet megolm sessions forward after decrypting messages. + ratchet_on_decrypt: false + # Delete fully used keys (index >= max_messages) after decrypting messages. + delete_fully_used_on_decrypt: false + # Delete previous megolm sessions from same device when receiving a new one. + delete_prev_on_new_session: false + # Delete megolm sessions received from a device when the device is deleted. + delete_on_device_delete: false + # Periodically delete megolm sessions when 2x max_age has passed since receiving the session. + periodically_delete_expired: false + # Delete inbound megolm sessions that don't have the received_at field used for + # automatic ratcheting and expired session deletion. This is meant as a migration + # to delete old keys prior to the bridge update. + delete_outdated_inbound: false + # What level of device verification should be required from users? + # + # Valid levels: + # unverified - Send keys to all device in the room. + # cross-signed-untrusted - Require valid cross-signing, but trust all cross-signing keys. + # cross-signed-tofu - Require valid cross-signing, trust cross-signing keys on first use (and reject changes). + # cross-signed-verified - Require valid cross-signing, plus a valid user signature from the bridge bot. + # Note that creating user signatures from the bridge bot is not currently possible. + # verified - Require manual per-device verification + # (currently only possible by modifying the `trust` column in the `crypto_device` database table). + verification_levels: + # Minimum level for which the bridge should send keys to when bridging messages from FB/IG to Matrix. + receive: unverified + # Minimum level that the bridge should accept for incoming Matrix messages. + send: unverified + # Minimum level that the bridge should require for accepting key requests. + share: cross-signed-tofu + # Options for Megolm room key rotation. These options allow you to + # configure the m.room.encryption event content. See: + # https://spec.matrix.org/v1.3/client-server-api/#mroomencryption for + # more information about that event. + rotation: + # Enable custom Megolm room key rotation settings. Note that these + # settings will only apply to rooms created after this option is + # set. + enable_custom: false + # The maximum number of milliseconds a session should be used + # before changing it. The Matrix spec recommends 604800000 (a week) + # as the default. + milliseconds: 604800000 + # The maximum number of messages that should be sent with a given a + # session before changing it. The Matrix spec recommends 100 as the + # default. + messages: 100 + + # Disable rotating keys when a user's devices change? + # You should not enable this option unless you understand all the implications. + disable_device_change_key_rotation: false + + # Settings for provisioning API + provisioning: + # Prefix for the provisioning API paths. + prefix: /_matrix/provision + # Shared secret for authentication. If set to "generate", a random secret will be generated, + # or if set to "disable", the provisioning API will be disabled. + shared_secret: disable + # Enable debug API at /debug with provisioning authentication. + debug_endpoints: false + + # Permissions for using the bridge. + # Permitted values: + # relay - Talk through the relaybot (if enabled), no access otherwise + # user - Access to use the bridge to chat with a Meta account. + # admin - User level and some additional administration tools + # Permitted keys: + # * - All Matrix users + # domain - All users on that homeserver + # mxid - Specific user + permissions: {{ matrix_mautrix_meta_messenger_bridge_permissions | to_json }} + + # Settings for relay mode + relay: + # Whether relay mode should be allowed. If allowed, `!wa set-relay` can be used to turn any + # authenticated user into a relaybot for that chat. + enabled: {{ matrix_mautrix_meta_messenger_bridge_relay_enabled | to_json }} + # Should only admins be allowed to set themselves as relay users? + admin_only: {{ matrix_mautrix_meta_messenger_bridge_relay_admin_only | to_json }} + # The formats to use when sending messages to Meta via the relaybot. + message_formats: + m.text: "{% raw %}{{ .Sender.Displayname }}: {{ .Message }}{% endraw %}" + m.notice: "{% raw %}{{ .Sender.Displayname }}: {{ .Message }}{% endraw %}" + m.emote: "{% raw %}* {{ .Sender.Displayname }} {{ .Message }}{% endraw %}" + m.file: "{% raw %}{{ .Sender.Displayname }} sent a file{% endraw %}" + m.image: "{% raw %}{{ .Sender.Displayname }} sent an image{% endraw %}" + m.audio: "{% raw %}{{ .Sender.Displayname }} sent an audio file{% endraw %}" + m.video: "{% raw %}{{ .Sender.Displayname }} sent a video{% endraw %}" + m.location: "{% raw %}{{ .Sender.Displayname }} sent a location{% endraw %}" + +# Logging config. See https://github.com/tulir/zeroconfig for details. +logging: + min_level: {{ matrix_mautrix_meta_messenger_logging_min_level | to_json }} + writers: + - type: stdout + format: pretty diff --git a/roles/custom/matrix-bridge-mautrix-meta-messenger/templates/labels.j2 b/roles/custom/matrix-bridge-mautrix-meta-messenger/templates/labels.j2 new file mode 100644 index 000000000..79e1fc743 --- /dev/null +++ b/roles/custom/matrix-bridge-mautrix-meta-messenger/templates/labels.j2 @@ -0,0 +1,48 @@ +{% if matrix_mautrix_meta_messenger_container_labels_traefik_enabled %} +traefik.enable=true + +{% if matrix_mautrix_meta_messenger_container_labels_traefik_docker_network %} +traefik.docker.network={{ matrix_mautrix_meta_messenger_container_labels_traefik_docker_network }} +{% endif %} + +traefik.http.services.{{ matrix_mautrix_meta_messenger_identifier }}-appservice.loadbalancer.server.port=29319 +traefik.http.services.{{ matrix_mautrix_meta_messenger_identifier }}-metrics.loadbalancer.server.port=8000 + + +{% if matrix_mautrix_meta_messenger_container_labels_metrics_enabled %} +############################################################ +# # +# Metrics # +# # +############################################################ + +{% if matrix_mautrix_meta_messenger_container_labels_metrics_middleware_basic_auth_enabled %} +traefik.http.middlewares.{{ matrix_mautrix_meta_messenger_identifier }}-metrics-basic-auth.basicauth.users={{ matrix_mautrix_meta_messenger_container_labels_metrics_middleware_basic_auth_users }} +traefik.http.routers.{{ matrix_mautrix_meta_messenger_identifier }}-metrics.middlewares={{ matrix_mautrix_meta_messenger_identifier }}-metrics-basic-auth +{% endif %} + +traefik.http.routers.{{ matrix_mautrix_meta_messenger_identifier }}-metrics.rule={{ matrix_mautrix_meta_messenger_container_labels_metrics_traefik_rule }} + +{% if matrix_mautrix_meta_messenger_container_labels_metrics_traefik_priority | int > 0 %} +traefik.http.routers.{{ matrix_mautrix_meta_messenger_identifier }}-metrics.priority={{ matrix_mautrix_meta_messenger_container_labels_metrics_traefik_priority }} +{% endif %} + +traefik.http.routers.{{ matrix_mautrix_meta_messenger_identifier }}-metrics.service={{ matrix_mautrix_meta_messenger_identifier }}-metrics +traefik.http.routers.{{ matrix_mautrix_meta_messenger_identifier }}-metrics.entrypoints={{ matrix_mautrix_meta_messenger_container_labels_metrics_traefik_entrypoints }} + +traefik.http.routers.{{ matrix_mautrix_meta_messenger_identifier }}-metrics.tls={{ matrix_mautrix_meta_messenger_container_labels_metrics_traefik_tls | to_json }} +{% if matrix_mautrix_meta_messenger_container_labels_metrics_traefik_tls %} +traefik.http.routers.{{ matrix_mautrix_meta_messenger_identifier }}-metrics.tls.certResolver={{ matrix_mautrix_meta_messenger_container_labels_metrics_traefik_tls_certResolver }} +{% endif %} + +############################################################ +# # +# /Metrics # +# # +############################################################ +{% endif %} + + +{% endif %} + +{{ matrix_mautrix_meta_messenger_container_labels_additional_labels }} diff --git a/roles/custom/matrix-bridge-mautrix-meta-messenger/templates/systemd/matrix-mautrix-meta.service.j2 b/roles/custom/matrix-bridge-mautrix-meta-messenger/templates/systemd/matrix-mautrix-meta.service.j2 new file mode 100644 index 000000000..0ca0263b1 --- /dev/null +++ b/roles/custom/matrix-bridge-mautrix-meta-messenger/templates/systemd/matrix-mautrix-meta.service.j2 @@ -0,0 +1,51 @@ +#jinja2: lstrip_blocks: "True" +[Unit] +Description=mautrix-meta bridge ({{ matrix_mautrix_meta_messenger_identifier }}) +{% for service in matrix_mautrix_meta_messenger_systemd_required_services_list %} +Requires={{ service }} +After={{ service }} +{% endfor %} +{% for service in matrix_mautrix_meta_messenger_systemd_wanted_services_list %} +Wants={{ service }} +{% endfor %} +DefaultDependencies=no + +[Service] +Type=simple +Environment="HOME={{ devture_systemd_docker_base_systemd_unit_home_path }}" +ExecStartPre=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} stop --time={{ devture_systemd_docker_base_container_stop_grace_time_seconds }} {{ matrix_mautrix_meta_messenger_identifier }} 2>/dev/null || true' +ExecStartPre=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} rm {{ matrix_mautrix_meta_messenger_identifier }} 2>/dev/null || true' + +ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} create \ + --rm \ + --name={{ matrix_mautrix_meta_messenger_identifier }} \ + --log-driver=none \ + --user={{ matrix_user_uid }}:{{ matrix_user_gid }} \ + --cap-drop=ALL \ + --network={{ matrix_mautrix_meta_messenger_container_network }} \ + {% if matrix_mautrix_meta_messenger_container_http_host_bind_port %} + -p {{ matrix_mautrix_meta_messenger_container_http_host_bind_port }}:29319 \ + {% endif %} + --mount type=bind,src={{ matrix_mautrix_meta_messenger_config_path }},dst=/config,ro \ + --mount type=bind,src={{ matrix_mautrix_meta_messenger_data_path }},dst=/data \ + --label-file={{ matrix_mautrix_meta_messenger_base_path }}/labels \ + {% for arg in matrix_mautrix_meta_messenger_container_extra_arguments %} + {{ arg }} \ + {% endfor %} + {{ matrix_mautrix_meta_messenger_container_image }} \ + /usr/bin/mautrix-meta -c /config/config.yaml -r /config/registration.yaml --no-update + +{% for network in matrix_mautrix_meta_messenger_container_additional_networks %} +ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} network connect {{ network }} {{ matrix_mautrix_meta_messenger_identifier }} +{% endfor %} + +ExecStart={{ devture_systemd_docker_base_host_command_docker }} start --attach {{ matrix_mautrix_meta_messenger_identifier }} + +ExecStop=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} stop --time={{ devture_systemd_docker_base_container_stop_grace_time_seconds }} {{ matrix_mautrix_meta_messenger_identifier }} 2>/dev/null || true' +ExecStop=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} rm {{ matrix_mautrix_meta_messenger_identifier }} 2>/dev/null || true' +Restart=always +RestartSec=30 +SyslogIdentifier={{ matrix_mautrix_meta_messenger_identifier }} + +[Install] +WantedBy=multi-user.target diff --git a/setup.yml b/setup.yml index beb0b0a58..c1ba0f06b 100644 --- a/setup.yml +++ b/setup.yml @@ -61,6 +61,8 @@ - custom/matrix-bridge-mautrix-hangouts - custom/matrix-bridge-mautrix-googlechat - custom/matrix-bridge-mautrix-instagram + - custom/matrix-bridge-mautrix-meta-messenger + - custom/matrix-bridge-mautrix-meta-instagram - custom/matrix-bridge-mautrix-telegram - custom/matrix-bridge-mautrix-signal - custom/matrix-bridge-mautrix-gmessages