From 999f2bf8ddefbaa48b96e4bfd6186b71746e7b6e Mon Sep 17 00:00:00 2001 From: Slavi Pantaleev Date: Sat, 17 Aug 2024 19:01:35 +0300 Subject: [PATCH] Switch mautrix-signal double-puppeting method (shared secret auth -> appservice-double-puppet) Since upgrading mautrix-signal (v0.6.3 -> v0.7.0) in 76fec0b8632804194ae54dce3328fef2b6e6b3c2, we expect double-puppeting to require the new appservice double-puppeting method. This commit switches the mautrix-signal bridge to it. --- docs/configuring-playbook-bridge-mautrix-signal.md | 4 ++-- group_vars/matrix_servers | 9 ++++++++- .../matrix-bridge-mautrix-signal/defaults/main.yml | 11 +++-------- .../tasks/validate_config.yml | 3 +++ .../templates/config.yaml.j2 | 5 ++--- 5 files changed, 18 insertions(+), 14 deletions(-) diff --git a/docs/configuring-playbook-bridge-mautrix-signal.md b/docs/configuring-playbook-bridge-mautrix-signal.md index 86e0d0313..7e2229ad8 100644 --- a/docs/configuring-playbook-bridge-mautrix-signal.md +++ b/docs/configuring-playbook-bridge-mautrix-signal.md @@ -56,9 +56,9 @@ You may wish to look at `roles/custom/matrix-bridge-mautrix-signal/templates/con If you'd like to use [Double Puppeting](https://docs.mau.fi/bridges/general/double-puppeting.html) (hint: you most likely do), you have 2 ways of going about it. -### Method 1: automatically, by enabling Shared Secret Auth +### Method 1: automatically, by enabling Appservice Double Puppet -The bridge will automatically perform Double Puppeting if you enable [Shared Secret Auth](configuring-playbook-shared-secret-auth.md) for this playbook. +The bridge will automatically perform Double Puppeting if you enable the [Appservice Double Puppet](configuring-playbook-appservice-double-puppet.md) service for this playbook. This is the recommended way of setting up Double Puppeting, as it's easier to accomplish, works for all your users automatically, and has less of a chance of breaking in the future. diff --git a/group_vars/matrix_servers b/group_vars/matrix_servers index 199669a0a..4e5b0c696 100755 --- a/group_vars/matrix_servers +++ b/group_vars/matrix_servers @@ -1385,7 +1385,14 @@ matrix_mautrix_signal_homeserver_token: "{{ '%s' | format(matrix_homeserver_gene matrix_mautrix_signal_appservice_token: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'si.as.token', rounds=655555) | to_uuid }}" -matrix_mautrix_signal_login_shared_secret: "{{ matrix_synapse_ext_password_provider_shared_secret_auth_shared_secret if matrix_synapse_ext_password_provider_shared_secret_auth_enabled else '' }}" +matrix_mautrix_signal_double_puppet_secrets_auto: |- + {{ + { + matrix_mautrix_signal_homeserver_domain: ("as_token:" + matrix_appservice_double_puppet_registration_as_token) + } + if matrix_appservice_double_puppet_enabled + else {} + }} matrix_mautrix_signal_metrics_enabled: "{{ prometheus_enabled or matrix_metrics_exposure_enabled }}" diff --git a/roles/custom/matrix-bridge-mautrix-signal/defaults/main.yml b/roles/custom/matrix-bridge-mautrix-signal/defaults/main.yml index 099b51914..2ee54fe8a 100644 --- a/roles/custom/matrix-bridge-mautrix-signal/defaults/main.yml +++ b/roles/custom/matrix-bridge-mautrix-signal/defaults/main.yml @@ -145,14 +145,9 @@ matrix_mautrix_signal_appservice_database_uri: "{{ }[matrix_mautrix_signal_database_engine] }}" -# Can be set to enable automatic double-puppeting via Shared Secret Auth (https://github.com/devture/matrix-synapse-shared-secret-auth). -matrix_mautrix_signal_login_shared_secret: '' -matrix_mautrix_signal_bridge_login_shared_secret_map: - "{{ {matrix_mautrix_signal_homeserver_domain: matrix_mautrix_signal_login_shared_secret} if matrix_mautrix_signal_login_shared_secret else {} }}" - -# Servers to always allow double puppeting from -matrix_mautrix_signal_bridge_double_puppet_server_map: - "{{ matrix_mautrix_signal_homeserver_domain : matrix_mautrix_signal_homeserver_address }}" +matrix_mautrix_signal_double_puppet_secrets: "{{ matrix_mautrix_signal_double_puppet_secrets_auto | combine(matrix_mautrix_signal_double_puppet_secrets_custom) }}" +matrix_mautrix_signal_double_puppet_secrets_auto: {} +matrix_mautrix_signal_double_puppet_secrets_custom: {} # Default mautrix-signal configuration template which covers the generic use case. # You can customize it by controlling the various variables inside it. diff --git a/roles/custom/matrix-bridge-mautrix-signal/tasks/validate_config.yml b/roles/custom/matrix-bridge-mautrix-signal/tasks/validate_config.yml index e2bd71d5f..702842e39 100644 --- a/roles/custom/matrix-bridge-mautrix-signal/tasks/validate_config.yml +++ b/roles/custom/matrix-bridge-mautrix-signal/tasks/validate_config.yml @@ -24,3 +24,6 @@ - {'old': 'matrix_mautrix_signal_log_level', 'new': 'matrix_mautrix_signal_logging_level'} - {'old': 'matrix_mautrix_signal_bridge_restricted_rooms', 'new': ''} - {'old': 'matrix_mautrix_signal_bridge_note_to_self_avatar', 'new': 'matrix_mautrix_signal_network_note_to_self_avatar'} + - {'old': 'matrix_mautrix_signal_login_shared_secret', 'new': ''} + - {'old': 'matrix_mautrix_signal_bridge_login_shared_secret_map', 'new': ''} + - {'old': 'matrix_mautrix_signal_bridge_double_puppet_server_map', 'new': ''} diff --git a/roles/custom/matrix-bridge-mautrix-signal/templates/config.yaml.j2 b/roles/custom/matrix-bridge-mautrix-signal/templates/config.yaml.j2 index 071edce28..9151335af 100644 --- a/roles/custom/matrix-bridge-mautrix-signal/templates/config.yaml.j2 +++ b/roles/custom/matrix-bridge-mautrix-signal/templates/config.yaml.j2 @@ -312,15 +312,14 @@ backfill: double_puppet: # Servers to always allow double puppeting from. # This is only for other servers and should NOT contain the server the bridge is on. - servers: - "{{ matrix_mautrix_signal_homeserver_domain }}": {{ matrix_mautrix_signal_homeserver_address }} + servers: {} # Whether to allow client API URL discovery for other servers. When using this option, # users on other servers can use double puppeting even if their server URLs aren't # explicitly added to the servers map above. allow_discovery: false # Shared secrets for automatic double puppeting. # See https://docs.mau.fi/bridges/general/double-puppeting.html for instructions. - secrets: {{ matrix_mautrix_signal_bridge_login_shared_secret_map | to_json }} + secrets: {{ matrix_mautrix_signal_double_puppet_secrets | to_json }} # End-to-bridge encryption support options. #