finallycoffee/matrix-docker-ansible-deploy
finallycoffee/matrix-docker-ansible-deploy
2
1
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Switch mautrix-signal double-puppeting method (shared secret auth -> appservice-double-puppet)

Browse Source 
Since upgrading mautrix-signal (v0.6.3 -> v0.7.0) in 76fec0b863,
we expect double-puppeting to require the new appservice double-puppeting method.

This commit switches the mautrix-signal bridge to it.
This commit is contained in:
Slavi Pantaleev 2024-08-17 19:01:35 +03:00
parent 111fa65e44
commit 999f2bf8dd
5 changed files with 18 additions and 14 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
docs/configuring-playbook-bridge-mautrix-signal.md
View File

@ -56,9 +56,9 @@ You may wish to look at `roles/custom/matrix-bridge-mautrix-signal/templates/con
If you'd like to use [Double Puppeting](https://docs.mau.fi/bridges/general/double-puppeting.html) (hint: you most likely do), you have 2 ways of going about it.
### Method 1: automatically, by enabling Shared Secret Auth
### Method 1: automatically, by enabling Appservice Double Puppet
The bridge will automatically perform Double Puppeting if you enable [Shared Secret Auth](configuring-playbook-shared-secret-auth.md) for this playbook.
The bridge will automatically perform Double Puppeting if you enable the [Appservice Double Puppet](configuring-playbook-appservice-double-puppet.md) service for this playbook.
This is the recommended way of setting up Double Puppeting, as it's easier to accomplish, works for all your users automatically, and has less of a chance of breaking in the future.

9
group_vars/matrix_servers
View File

@ -1385,7 +1385,14 @@ matrix_mautrix_signal_homeserver_token: "{{ '%s' | format(matrix_homeserver_gene
matrix_mautrix_signal_appservice_token: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'si.as.token', rounds=655555) | to_uuid }}"
matrix_mautrix_signal_login_shared_secret: "{{ matrix_synapse_ext_password_provider_shared_secret_auth_shared_secret if matrix_synapse_ext_password_provider_shared_secret_auth_enabled else '' }}"
matrix_mautrix_signal_double_puppet_secrets_auto: |-
{{
{
matrix_mautrix_signal_homeserver_domain: ("as_token:" + matrix_appservice_double_puppet_registration_as_token)
}
if matrix_appservice_double_puppet_enabled
else {}
}}
matrix_mautrix_signal_metrics_enabled: "{{ prometheus_enabled or matrix_metrics_exposure_enabled }}"

11
roles/custom/matrix-bridge-mautrix-signal/defaults/main.yml
View File

@ -145,14 +145,9 @@ matrix_mautrix_signal_appservice_database_uri: "{{
}[matrix_mautrix_signal_database_engine]
}}"
# Can be set to enable automatic double-puppeting via Shared Secret Auth (https://github.com/devture/matrix-synapse-shared-secret-auth).
matrix_mautrix_signal_login_shared_secret: ''
matrix_mautrix_signal_bridge_login_shared_secret_map:
"{{ {matrix_mautrix_signal_homeserver_domain: matrix_mautrix_signal_login_shared_secret} if matrix_mautrix_signal_login_shared_secret else {} }}"
# Servers to always allow double puppeting from
matrix_mautrix_signal_bridge_double_puppet_server_map:
"{{ matrix_mautrix_signal_homeserver_domain : matrix_mautrix_signal_homeserver_address }}"
matrix_mautrix_signal_double_puppet_secrets: "{{ matrix_mautrix_signal_double_puppet_secrets_auto | combine(matrix_mautrix_signal_double_puppet_secrets_custom) }}"
matrix_mautrix_signal_double_puppet_secrets_auto: {}
matrix_mautrix_signal_double_puppet_secrets_custom: {}
# Default mautrix-signal configuration template which covers the generic use case.
# You can customize it by controlling the various variables inside it.

3
roles/custom/matrix-bridge-mautrix-signal/tasks/validate_config.yml
View File

@ -24,3 +24,6 @@
- {'old': 'matrix_mautrix_signal_log_level', 'new': 'matrix_mautrix_signal_logging_level'}
- {'old': 'matrix_mautrix_signal_bridge_restricted_rooms', 'new': '<removed>'}
- {'old': 'matrix_mautrix_signal_bridge_note_to_self_avatar', 'new': 'matrix_mautrix_signal_network_note_to_self_avatar'}
- {'old': 'matrix_mautrix_signal_login_shared_secret', 'new': '<removed>'}
- {'old': 'matrix_mautrix_signal_bridge_login_shared_secret_map', 'new': '<superseded by matrix_mautrix_signal_double_puppet_secrets>'}
- {'old': 'matrix_mautrix_signal_bridge_double_puppet_server_map', 'new': '<removed>'}

5
roles/custom/matrix-bridge-mautrix-signal/templates/config.yaml.j2
View File

@ -312,15 +312,14 @@ backfill:
double_puppet:
# Servers to always allow double puppeting from.
# This is only for other servers and should NOT contain the server the bridge is on.
servers:
"{{ matrix_mautrix_signal_homeserver_domain }}": {{ matrix_mautrix_signal_homeserver_address }}
servers: {}
# Whether to allow client API URL discovery for other servers. When using this option,
# users on other servers can use double puppeting even if their server URLs aren't
# explicitly added to the servers map above.
allow_discovery: false
# Shared secrets for automatic double puppeting.
# See https://docs.mau.fi/bridges/general/double-puppeting.html for instructions.
secrets: {{ matrix_mautrix_signal_bridge_login_shared_secret_map | to_json }}
secrets: {{ matrix_mautrix_signal_double_puppet_secrets | to_json }}
# End-to-bridge encryption support options.
#