From 8a3f942d93de6a23b3b1622a042f60fc30783c64 Mon Sep 17 00:00:00 2001
From: Slavi Pantaleev <slavi@devture.com>
Date: Mon, 28 Jan 2019 15:40:16 +0200
Subject: [PATCH] Make mautrix-telegram run as non-root and w/o capabilities

---
 .../tasks/ext/mautrix-telegram/setup.yml      | 37 +++++++++++++++----
 .../ext/mautrix-telegram/config.yaml.j2       |  4 +-
 .../matrix-mautrix-telegram.service.j2        | 13 ++++++-
 3 files changed, 43 insertions(+), 11 deletions(-)

diff --git a/roles/matrix-synapse/tasks/ext/mautrix-telegram/setup.yml b/roles/matrix-synapse/tasks/ext/mautrix-telegram/setup.yml
index f85abb13b..6bf97e22c 100644
--- a/roles/matrix-synapse/tasks/ext/mautrix-telegram/setup.yml
+++ b/roles/matrix-synapse/tasks/ext/mautrix-telegram/setup.yml
@@ -14,8 +14,10 @@
     group: "{{ matrix_user_username }}"
   when: "matrix_mautrix_telegram_enabled"
 
-- stat: "path={{ matrix_mautrix_telegram_base_path }}/config.yaml"
-  register: mautrix_config_file
+- name: Check if a mautrix-telegram configuration file exists
+  stat:
+    path: "{{ matrix_mautrix_telegram_base_path }}/config.yaml"
+  register: mautrix_config_file_stat
 
 - name: Ensure Matrix Mautrix telegram config installed
   template:
@@ -24,7 +26,18 @@
     mode: 0644
     owner: "{{ matrix_user_username }}"
     group: "{{ matrix_user_username }}"
-  when: "matrix_mautrix_telegram_enabled and mautrix_config_file.stat.exists == False"
+  when: "matrix_mautrix_telegram_enabled and not mautrix_config_file_stat.stat.exists"
+
+- name: (Migration) Fix up old configuration
+  lineinfile:
+    path: "{{ matrix_mautrix_telegram_base_path }}/config.yaml"
+    regexp: "{{ item.regexp }}"
+    line: "{{ item.line }}"
+    backrefs: yes
+  with_items:
+    - {'regexp': '^(\s+)filename: \./mautrix-telegram.log', 'line': '\1filename: /data/mautrix-telegram.log'}
+    - {'regexp': '^(\s+)database:', 'line': '\1database: sqlite:////data/mautrix-telegram.db'}
+  when: "matrix_mautrix_telegram_enabled and mautrix_config_file_stat.stat.exists"
 
 - name: Ensure matrix-mautrix-telegram.service installed
   template:
@@ -33,13 +46,23 @@
     mode: 0644
   when: "matrix_mautrix_telegram_enabled"
 
-- stat:
+- name: Check if a mautrix-telegram registration file exists
+  stat:
     path: "{{ matrix_mautrix_telegram_base_path }}/registration.yaml"
-  register: mautrix_telegram_registration_file
+  register: mautrix_telegram_registration_file_stat
 
 - name: Generate matrix-mautrix-telegram registration.yaml if it doesn't exist
-  shell: /usr/bin/docker run --rm --name matrix-mautrix-telegram-gen -v {{ matrix_mautrix_telegram_base_path }}:/data:z {{ matrix_mautrix_telegram_docker_image }} python3 -m mautrix_telegram -g -c /data/config.yaml -r /data/registration.yaml
-  when: "matrix_mautrix_telegram_enabled and mautrix_telegram_registration_file.stat.exists == False"
+  shell:
+    cmd: >-
+      /usr/bin/docker run
+      --rm
+      --user={{ matrix_user_uid }}:{{ matrix_user_gid }}
+      --cap-drop=ALL
+      --name matrix-mautrix-telegram-gen
+      -v {{ matrix_mautrix_telegram_base_path }}:/data:z
+      {{ matrix_mautrix_telegram_docker_image }}
+      python3 -m mautrix_telegram -g -c /data/config.yaml -r /data/registration.yaml
+  when: "matrix_mautrix_telegram_enabled and not mautrix_telegram_registration_file_stat.stat.exists"
 
 - set_fact:
     matrix_synapse_app_service_config_file_mautrix_telegram: '/app-registration/mautrix-telegram.yml'
diff --git a/roles/matrix-synapse/templates/ext/mautrix-telegram/config.yaml.j2 b/roles/matrix-synapse/templates/ext/mautrix-telegram/config.yaml.j2
index c1858686b..7e6174a11 100644
--- a/roles/matrix-synapse/templates/ext/mautrix-telegram/config.yaml.j2
+++ b/roles/matrix-synapse/templates/ext/mautrix-telegram/config.yaml.j2
@@ -26,7 +26,7 @@ appservice:
     # Format examples:
     #   SQLite:   sqlite:///filename.db
     #   Postgres: postgres://username:password@hostname/dbname
-    database: sqlite:///mautrix-telegram.db
+    database: sqlite:////data/mautrix-telegram.db
 
     # Public part of web server for out-of-Matrix interaction with the bridge.
     # Used for things like login if the user wants to make sure the 2FA password isn't stored in
@@ -253,7 +253,7 @@ logging:
         file:
             class: logging.handlers.RotatingFileHandler
             formatter: precise
-            filename: ./mautrix-telegram.log
+            filename: /data/mautrix-telegram.log
             maxBytes: 10485760
             backupCount: 10
         console:
diff --git a/roles/matrix-synapse/templates/ext/mautrix-telegram/systemd/matrix-mautrix-telegram.service.j2 b/roles/matrix-synapse/templates/ext/mautrix-telegram/systemd/matrix-mautrix-telegram.service.j2
index 61f7e7f84..7e965804c 100644
--- a/roles/matrix-synapse/templates/ext/mautrix-telegram/systemd/matrix-mautrix-telegram.service.j2
+++ b/roles/matrix-synapse/templates/ext/mautrix-telegram/systemd/matrix-mautrix-telegram.service.j2
@@ -9,12 +9,21 @@ After=matrix-synapse.service
 Type=simple
 ExecStartPre=-/usr/bin/docker kill matrix-mautrix-telegram
 ExecStartPre=-/usr/bin/docker rm matrix-mautrix-telegram
+ExecStartPre=/usr/bin/docker run --rm --name matrix-mautrix-telegram-db \
+			--log-driver=none \
+			--user={{ matrix_user_uid }}:{{ matrix_user_gid }} \
+			--cap-drop=ALL \
+			-v {{ matrix_mautrix_telegram_base_path }}:/data:z \
+			{{ matrix_mautrix_telegram_docker_image }} \
+			alembic -x config=/data/config.yaml upgrade head
 ExecStart=/usr/bin/docker run --rm --name matrix-mautrix-telegram \
 			--log-driver=none \
-			-e "UID={{ matrix_user_uid }}" -e "GID={{ matrix_user_gid }}" \
+			--user={{ matrix_user_uid }}:{{ matrix_user_gid }} \
+			--cap-drop=ALL \
 			--network={{ matrix_docker_network }} \
 			-v {{ matrix_mautrix_telegram_base_path }}:/data:z \
-			{{ matrix_mautrix_telegram_docker_image }}
+			{{ matrix_mautrix_telegram_docker_image }} \
+			python3 -m mautrix_telegram -c /data/config.yaml
 ExecStop=-/usr/bin/docker kill matrix-mautrix-telegram
 ExecStop=-/usr/bin/docker rm matrix-mautrix-telegram
 Restart=always