From 69efcb5c21ad55bf597a298a3f6ba499c729920a Mon Sep 17 00:00:00 2001
From: Sabine <sabinbox@laszakovits.net>
Date: Thu, 22 Oct 2020 23:29:34 +0200
Subject: [PATCH 01/22] added mautrix-signal role

---
 .../defaults/main.yml                         | 102 +++++++++
 .../tasks/init.yml                            |  63 ++++++
 .../tasks/main.yml                            |  21 ++
 .../tasks/setup_install.yml                   | 102 +++++++++
 .../tasks/setup_uninstall.yml                 |  64 ++++++
 .../tasks/validate_config.yml                 |  22 ++
 .../templates/config.yaml.j2                  | 207 ++++++++++++++++++
 .../matrix-mautrix-signal-daemon.service.j2   |  29 +++
 .../matrix-mautrix-signal-db.service.j2       |  32 +++
 .../systemd/matrix-mautrix-signal.service.j2  |  44 ++++
 setup.yml                                     |   1 +
 11 files changed, 687 insertions(+)
 create mode 100644 roles/matrix-bridge-mautrix-signal/defaults/main.yml
 create mode 100644 roles/matrix-bridge-mautrix-signal/tasks/init.yml
 create mode 100644 roles/matrix-bridge-mautrix-signal/tasks/main.yml
 create mode 100644 roles/matrix-bridge-mautrix-signal/tasks/setup_install.yml
 create mode 100644 roles/matrix-bridge-mautrix-signal/tasks/setup_uninstall.yml
 create mode 100644 roles/matrix-bridge-mautrix-signal/tasks/validate_config.yml
 create mode 100644 roles/matrix-bridge-mautrix-signal/templates/config.yaml.j2
 create mode 100644 roles/matrix-bridge-mautrix-signal/templates/systemd/matrix-mautrix-signal-daemon.service.j2
 create mode 100644 roles/matrix-bridge-mautrix-signal/templates/systemd/matrix-mautrix-signal-db.service.j2
 create mode 100644 roles/matrix-bridge-mautrix-signal/templates/systemd/matrix-mautrix-signal.service.j2

diff --git a/roles/matrix-bridge-mautrix-signal/defaults/main.yml b/roles/matrix-bridge-mautrix-signal/defaults/main.yml
new file mode 100644
index 000000000..d86bdb59b
--- /dev/null
+++ b/roles/matrix-bridge-mautrix-signal/defaults/main.yml
@@ -0,0 +1,102 @@
+# mautrix-telegram is a Matrix <-> Telegram bridge
+# See: https://github.com/tulir/mautrix-telegram
+
+matrix_mautrix_signal_enabled: false
+
+# See: https://mau.dev/tulir/mautrix-signal/container_registry
+matrix_mautrix_signal_docker_image: "dock.mau.dev/tulir/mautrix-signal:latest"
+matrix_mautrix_signal_docker_image_force_pull: "{{ matrix_mautrix_signal_docker_image.endswith(':latest') }}"
+
+matrix_mautrix_signal_base_path: "{{ matrix_base_data_path }}/mautrix-signal"
+matrix_mautrix_signal_config_path: "{{ matrix_mautrix_signal_base_path }}/bridge"
+
+matrix_mautrix_signal_daemon_docker_image: "dock.mau.dev/maunium/signald:latest"
+matrix_mautrix_signal_daemon_docker_image_force_pull: "{{ matrix_mautrix_signal_daemon_docker_image.endswith(':latest') }}"
+
+matrix_mautrix_signal_daemon_path: "{{ matrix_mautrix_signal_base_path }}/signald"
+
+# # Get your own API keys at https://my.telegram.org/apps
+# matrix_mautrix_telegram_api_id: ''
+# matrix_mautrix_telegram_api_hash: ''
+# matrix_mautrix_telegram_bot_token: disabled
+
+# # Mautrix telegram public endpoint to log in to telegram
+# # Use an uuid so it's not easily discoverable.
+# # Example: /741a0483-ba17-4682-9900-30bd7269f1cc
+# matrix_mautrix_telegram_public_endpoint: ''
+
+matrix_mautrix_signal_homeserver_address: 'http://matrix-synapse:8008'
+matrix_mautrix_signal_homeserver_domain: '{{ matrix_domain }}'
+matrix_mautrix_signal_appservice_address: 'http://matrix-mautrix-signal:29328'
+# matrix_mautrix_telegram_appservice_public_external: 'https://{{ matrix_server_fqn_matrix }}{{ matrix_mautrix_telegram_public_endpoint }}'
+
+# Controls whether the matrix-mautrix-telegram container exposes its HTTP port (tcp/8080 in the container).
+#
+# Takes an "<ip>:<port>" or "<port>" value (e.g. "127.0.0.1:9006"), or empty string to not expose.
+matrix_mautrix_signal_container_http_host_bind_port: ''
+
+# A list of extra arguments to pass to the container
+matrix_mautrix_signal_container_extra_arguments: []
+
+# List of systemd services that matrix-mautrix-signal.service depends on.
+matrix_mautrix_signal_systemd_required_services_list: ['docker.service', 'matrix-mautrix-signal-daemon.service', 'matrix-mautrix-signal-db.service']
+
+# List of systemd services that matrix-mautrix-telegram.service wants
+matrix_mautrix_signal_systemd_wanted_services_list: []
+
+matrix_mautrix_signal_appservice_token: ''
+matrix_mautrix_signal_homeserver_token: ''
+
+matrix_mautrix_signal_db_docker_image: "postgres:13.0-alpine"
+matrix_mautrix_signal_db_docker_image_force_pull: "{{ matrix_mautrix_signal_db_docker_image.endswith(':latest') }}"
+matrix_mautrix_signal_db_storage_path: "{{ matrix_mautrix_signal_base_path }}/database"
+
+matrix_mautrix_signal_db_user: ''
+matrix_mautrix_signal_db_password: ''
+matrix_mautrix_signal_db_host: 'matrix-mautrix-signal-db'
+matrix_mautrix_signal_db_port: '5432'
+matrix_mautrix_signal_db_database: ''
+
+matrix_mautrix_signal_db_url: "postgres://{{ matrix_mautrix_signal_db_user }}:{{ matrix_mautrix_signal_db_password }}@{{ matrix_mautrix_signal_db_host }}:{{ matrix_mautrix_signal_db_port }}/{{ matrix_mautrix_signal_db_database }}"
+
+# Can be set to enable automatic double-puppeting via Shared Secret Auth (https://github.com/devture/matrix-synapse-shared-secret-auth).
+matrix_mautrix_signal_login_shared_secret: ''
+
+# Default configuration template which covers the generic use case.
+# You can customize it by controlling the various variables inside it.
+#
+# For a more advanced customization, you can extend the default (see `matrix_mautrix_telegram_configuration_extension_yaml`)
+# or completely replace this variable with your own template.
+matrix_mautrix_signal_configuration_yaml: "{{ lookup('template', 'templates/config.yaml.j2') }}"
+
+matrix_mautrix_signal_configuration_extension_yaml: |
+  # Your custom YAML configuration goes here.
+  # This configuration extends the default starting configuration (`matrix_mautrix_telegram_configuration_yaml`).
+  #
+  # You can override individual variables from the default configuration, or introduce new ones.
+  #
+  # If you need something more special, you can take full control by
+  # completely redefining `matrix_mautrix_telegram_configuration_yaml`.
+
+matrix_mautrix_signal_configuration_extension: "{{ matrix_mautrix_signal_configuration_extension_yaml|from_yaml if matrix_mautrix_signal_configuration_extension_yaml|from_yaml is mapping else {} }}"
+
+# Holds the final configuration (a combination of the default and its extension).
+# You most likely don't need to touch this variable. Instead, see `matrix_mautrix_telegram_configuration_yaml`.
+matrix_mautrix_signal_configuration: "{{ matrix_mautrix_signal_configuration_yaml|from_yaml|combine(matrix_mautrix_signal_configuration_extension, recursive=True) }}"
+
+matrix_mautrix_signal_registration_yaml: |
+  id: signal
+  as_token: "{{ matrix_mautrix_signal_appservice_token }}"
+  hs_token: "{{ matrix_mautrix_signal_homeserver_token }}"
+  namespaces:
+      users:
+      - exclusive: true
+        regex: '^@signal_.+:{{ matrix_mautrix_signal_homeserver_domain|regex_escape }}$'
+      aliases:
+      - exclusive: true
+        regex: '^#signal_.+:{{ matrix_mautrix_signal_homeserver_domain|regex_escape }}$'
+  url: {{ matrix_mautrix_signal_appservice_address }}
+  sender_localpart: signalbot
+  rate_limited: false
+
+matrix_mautrix_signal_registration: "{{ matrix_mautrix_signal_registration_yaml|from_yaml }}"
diff --git a/roles/matrix-bridge-mautrix-signal/tasks/init.yml b/roles/matrix-bridge-mautrix-signal/tasks/init.yml
new file mode 100644
index 000000000..8fdc98349
--- /dev/null
+++ b/roles/matrix-bridge-mautrix-signal/tasks/init.yml
@@ -0,0 +1,63 @@
+- set_fact:
+    matrix_systemd_services_list: "{{ matrix_systemd_services_list + ['matrix-mautrix-signal', 'matrix-mautrix-signal-daemon'] }}"
+  when: matrix_mautrix_signal_enabled|bool
+
+# If the matrix-synapse role is not used, these variables may not exist.
+- set_fact:
+    matrix_synapse_container_extra_arguments: >
+      {{ matrix_synapse_container_extra_arguments|default([]) }}
+      +
+      ["--mount type=bind,src={{ matrix_mautrix_signal_config_path }}/registration.yaml,dst=/matrix-mautrix-signal-registration.yaml,ro"]
+
+    matrix_synapse_app_service_config_files: >
+      {{ matrix_synapse_app_service_config_files|default([]) }}
+      +
+      {{ ["/matrix-mautrix-signal-registration.yaml"] }}
+  when: matrix_mautrix_signal_enabled|bool
+
+# - block:
+#   - name: Fail if matrix-nginx-proxy role already executed
+#     fail:
+#       msg: >-
+#         Trying to append Mautrix Signal's reverse-proxying configuration to matrix-nginx-proxy,
+#         but it's pointless since the matrix-nginx-proxy role had already executed.
+#         To fix this, please change the order of roles in your plabook,
+#         so that the matrix-nginx-proxy role would run after the matrix-bridge-mautrix-signal role.
+#     when: matrix_nginx_proxy_role_executed|default(False)|bool
+
+  # - name: Generate Mautrix Signal proxying configuration for matrix-nginx-proxy
+  #   set_fact:
+  #     matrix_mautrix_telegram_matrix_nginx_proxy_configuration: |
+  #       location {{ matrix_mautrix_telegram_public_endpoint }} {
+  #       {% if matrix_nginx_proxy_enabled|default(False) %}
+  #       	{# Use the embedded DNS resolver in Docker containers to discover the service #}
+  #       	resolver 127.0.0.11 valid=5s;
+  #       	set $backend "matrix-mautrix-telegram:8080";
+  #       	proxy_pass http://$backend;
+  #       {% else %}
+  #       	{# Generic configuration for use outside of our container setup #}
+  #       	proxy_pass http://127.0.0.1:9006;
+  #       {% endif %}
+  #       }
+
+  # - name: Register Mautrix Telegram proxying configuration with matrix-nginx-proxy
+  #   set_fact:
+  #     matrix_nginx_proxy_proxy_matrix_additional_server_configuration_blocks: |
+  #       {{
+  #         matrix_nginx_proxy_proxy_matrix_additional_server_configuration_blocks|default([])
+  #         +
+  #         [matrix_mautrix_telegram_matrix_nginx_proxy_configuration]
+  #       }}
+  # tags:
+  #  - always
+  # when: matrix_mautrix_telegram_enabled|bool
+
+# - name: Warn about reverse-proxying if matrix-nginx-proxy not used
+#   debug:
+#     msg: >-
+#       NOTE: You've enabled the Mautrix Telegram bridge but are not using the matrix-nginx-proxy
+#       reverse proxy.
+#       Please make sure that you're proxying the `{{ matrix_mautrix_telegram_public_endpoint }}`
+#       URL endpoint to the matrix-mautrix-telegram container.
+#       You can expose the container's port using the `matrix_mautrix_telegram_container_http_host_bind_port` variable.
+#   when: "matrix_mautrix_telegram_enabled|bool and matrix_nginx_proxy_enabled is not defined"
diff --git a/roles/matrix-bridge-mautrix-signal/tasks/main.yml b/roles/matrix-bridge-mautrix-signal/tasks/main.yml
new file mode 100644
index 000000000..edca20e61
--- /dev/null
+++ b/roles/matrix-bridge-mautrix-signal/tasks/main.yml
@@ -0,0 +1,21 @@
+- import_tasks: "{{ role_path }}/tasks/init.yml"
+  tags:
+    - always
+
+- import_tasks: "{{ role_path }}/tasks/validate_config.yml"
+  when: "run_setup|bool and matrix_mautrix_signal_enabled|bool"
+  tags:
+    - setup-all
+    - setup-mautrix-signal
+
+- import_tasks: "{{ role_path }}/tasks/setup_install.yml"
+  when: "run_setup|bool and matrix_mautrix_signal_enabled|bool"
+  tags:
+    - setup-all
+    - setup-mautrix-signal
+
+- import_tasks: "{{ role_path }}/tasks/setup_uninstall.yml"
+  when: "run_setup|bool and not matrix_mautrix_signal_enabled|bool"
+  tags:
+    - setup-all
+    - setup-mautrix-signal
diff --git a/roles/matrix-bridge-mautrix-signal/tasks/setup_install.yml b/roles/matrix-bridge-mautrix-signal/tasks/setup_install.yml
new file mode 100644
index 000000000..cacb4c6c7
--- /dev/null
+++ b/roles/matrix-bridge-mautrix-signal/tasks/setup_install.yml
@@ -0,0 +1,102 @@
+---
+
+# If the matrix-synapse role is not used, `matrix_synapse_role_executed` won't exist.
+# We don't want to fail in such cases.
+- name: Fail if matrix-synapse role already executed
+  fail:
+    msg: >-
+      The matrix-bridge-mautrix-signal role needs to execute before the matrix-synapse role.
+  when: "matrix_synapse_role_executed|default(False)"
+
+- name: Ensure Mautrix Signal image is pulled
+  docker_image:
+    name: "{{ matrix_mautrix_signal_docker_image }}"
+    source: "{{ 'pull' if ansible_version.major > 2 or ansible_version.minor > 7 else omit }}"
+    force_source: "{{ matrix_mautrix_signal_docker_image_force_pull if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}"
+    force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else matrix_mautrix_signal_docker_image_force_pull }}"
+
+- name: Ensure Mautrix Signal Daemon image is pulled
+  docker_image:
+    name: "{{ matrix_mautrix_signal_daemon_docker_image }}"
+    source: "{{ 'pull' if ansible_version.major > 2 or ansible_version.minor > 7 else omit }}"
+    force_source: "{{ matrix_mautrix_signal_daemon_docker_image_force_pull if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}"
+    force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else matrix_mautrix_signal_docker_image_force_pull }}"
+
+- name: Ensure Mautrix Signal database image is pulled
+  docker_image:
+    name: "{{ matrix_mautrix_signal_db_docker_image }}"
+    source: "{{ 'pull' if ansible_version.major > 2 or ansible_version.minor > 7 else omit }}"
+    force_source: "{{ matrix_mautrix_signal_db_docker_image_force_pull if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}"
+    force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else matrix_mautrix_signal_docker_image_force_pull }}"
+
+- name: Ensure Mautrix Signal paths exist
+  file:
+    path: "{{ item }}"
+    state: directory
+    mode: 0750
+    owner: "{{ matrix_user_username }}"
+    group: "{{ matrix_user_groupname }}"
+  with_items:
+    - "{{ matrix_mautrix_signal_base_path }}"
+    - "{{ matrix_mautrix_signal_config_path }}"
+    - "{{ matrix_mautrix_signal_daemon_path }}"
+    - "{{ matrix_mautrix_signal_db_storage_path }}"
+
+# - name: Check if an old database file already exists
+#   stat:
+#     path: "{{ matrix_mautrix_telegram_base_path }}/mautrix-telegram.db"
+#   register: matrix_mautrix_telegram_stat_database
+#
+# - name: (Data relocation) Ensure matrix-mautrix-telegram.service is stopped
+#   service:
+#     name: matrix-mautrix-telegram
+#     state: stopped
+#     daemon_reload: yes
+#   failed_when: false
+#   when: "matrix_mautrix_telegram_stat_database.stat.exists"
+#
+# - name: (Data relocation) Move mautrix-telegram database file to ./data directory
+#   command: "mv {{ matrix_mautrix_telegram_base_path }}/mautrix-telegram.db {{ matrix_mautrix_telegram_data_path }}/mautrix-telegram.db"
+#   when: "matrix_mautrix_telegram_stat_database.stat.exists"
+
+- name: Ensure mautrix-signal config.yaml installed
+  copy:
+    content: "{{ matrix_mautrix_signal_configuration|to_nice_yaml }}"
+    dest: "{{ matrix_mautrix_signal_config_path }}/config.yaml"
+    mode: 0644
+    owner: "{{ matrix_user_username }}"
+    group: "{{ matrix_user_groupname }}"
+
+- name: Ensure mautrix-signal registration.yaml installed
+  copy:
+    content: "{{ matrix_mautrix_signal_registration|to_nice_yaml }}"
+    dest: "{{ matrix_mautrix_signal_config_path }}/registration.yaml"
+    mode: 0644
+    owner: "{{ matrix_user_username }}"
+    group: "{{ matrix_user_groupname }}"
+
+- name: Ensure matrix-mautrix-signal-daemon.service installed
+  template:
+    src: "{{ role_path }}/templates/systemd/matrix-mautrix-signal-daemon.service.j2"
+    dest: "{{ matrix_systemd_path }}/matrix-mautrix-signal-daemon.service"
+    mode: 0644
+  register: matrix_mautrix_signal_daemon_systemd_service_result
+
+- name: Ensure matrix-mautrix-signal-db.service installed
+  template:
+    src: "{{ role_path }}/templates/systemd/matrix-mautrix-signal-db.service.j2"
+    dest: "{{ matrix_systemd_path }}/matrix-mautrix-signal-db.service"
+    mode: 0644
+  register: matrix_mautrix_signal_db_systemd_service_result
+
+- name: Ensure matrix-mautrix-signal.service installed
+  template:
+    src: "{{ role_path }}/templates/systemd/matrix-mautrix-signal.service.j2"
+    dest: "{{ matrix_systemd_path }}/matrix-mautrix-signal.service"
+    mode: 0644
+  register: matrix_mautrix_signal_systemd_service_result
+
+- name: Ensure systemd reloaded after matrix-mautrix-signal.service installation
+  service:
+    daemon_reload: yes
+  when: "matrix_mautrix_signal_systemd_service_result.changed or matrix_mautrix_signal_daemon_systemd_service_result.changed or matrix_mautrix_signal_db_systemd_service_result.changed"
diff --git a/roles/matrix-bridge-mautrix-signal/tasks/setup_uninstall.yml b/roles/matrix-bridge-mautrix-signal/tasks/setup_uninstall.yml
new file mode 100644
index 000000000..51581874c
--- /dev/null
+++ b/roles/matrix-bridge-mautrix-signal/tasks/setup_uninstall.yml
@@ -0,0 +1,64 @@
+---
+
+# Signal database service
+- name: Check existence of matrix-mautrix-signal-db service
+  stat:
+    path: "{{ matrix_systemd_path }}/matrix-mautrix-signal-db.service"
+  register: matrix_mautrix_signal_db_service_stat
+
+- name: Ensure matrix-mautrix-signal-db is stopped
+  service:
+    name: matrix-mautrix-signal-db
+    state: stopped
+    daemon_reload: yes
+  when: "matrix_mautrix_signal_db_service_stat.stat.exists"
+
+- name: Ensure matrix-mautrix-signal-db.service doesn't exist
+  file:
+    path: "{{ matrix_systemd_path }}/matrix-mautrix-signal-db.service"
+    state: absent
+  when: "matrix_mautrix_signal_db_service_stat.stat.exists"
+
+# Signal daemon service
+- name: Check existence of matrix-mautrix-signal-daemon service
+  stat:
+    path: "{{ matrix_systemd_path }}/matrix-mautrix-signal-daemon.service"
+  register: matrix_mautrix_signal_daemon_service_stat
+
+- name: Ensure matrix-mautrix-signal-daemon is stopped
+  service:
+    name: matrix-mautrix-signal-daemon
+    state: stopped
+    daemon_reload: yes
+  when: "matrix_mautrix_signal_daemon_service_stat.stat.exists"
+
+- name: Ensure matrix-mautrix-signal-daemon.service doesn't exist
+  file:
+    path: "{{ matrix_systemd_path }}/matrix-mautrix-signal-daemon.service"
+    state: absent
+  when: "matrix_mautrix_signal_daemon_service_stat.stat.exists"
+
+# Bridge service
+- name: Check existence of matrix-mautrix-signal service
+  stat:
+    path: "{{ matrix_systemd_path }}/matrix-mautrix-signal.service"
+  register: matrix_mautrix_signal_service_stat
+
+- name: Ensure matrix-mautrix-signal is stopped
+  service:
+    name: matrix-mautrix-signal
+    state: stopped
+    daemon_reload: yes
+  when: "matrix_mautrix_signal_service_stat.stat.exists"
+
+- name: Ensure matrix-mautrix-signal.service doesn't exist
+  file:
+    path: "{{ matrix_systemd_path }}/matrix-mautrix-signal.service"
+    state: absent
+  when: "matrix_mautrix_signal_service_stat.stat.exists"
+
+# All services
+- name: Ensure systemd reloaded after matrix-mautrix-signal_X.service removal
+  service:
+    daemon_reload: yes
+  when: "matrix_mautrix_signal_service_stat.stat.exists or matrix_mautrix_signal_daemon_service_stat.stat.exists or matrix_mautrix_signal_db_service_stat.stat.exists"
diff --git a/roles/matrix-bridge-mautrix-signal/tasks/validate_config.yml b/roles/matrix-bridge-mautrix-signal/tasks/validate_config.yml
new file mode 100644
index 000000000..a11e192da
--- /dev/null
+++ b/roles/matrix-bridge-mautrix-signal/tasks/validate_config.yml
@@ -0,0 +1,22 @@
+---
+
+- name: Fail if required settings not defined
+  fail:
+    msg: >-
+      You need to define a required configuration setting (`{{ item }}`).
+  when: "vars[item] == ''"
+  with_items:
+    - "matrix_mautrix_signal_appservice_token"
+    - "matrix_mautrix_signal_homeserver_token"
+    - "matrix_mautrix_signal_db_user"
+    - "matrix_mautrix_signal_db_password"
+    - "matrix_mautrix_signal_db_database"
+
+- name: (Deprecation) Catch and report renamed Signal variables
+  fail:
+    msg: >-
+      Your configuration contains a variable, which now has a different name.
+      Please change your configuration to rename the variable (`{{ item.old }}` -> `{{ item.new }}`).
+  when: "item.old in vars"
+  with_items:
+    - {'old': 'matrix_mautrix_signal_container_exposed_port_number', 'new': '<superseded by matrix_mautrix_signal_container_http_host_bind_port>'}
diff --git a/roles/matrix-bridge-mautrix-signal/templates/config.yaml.j2 b/roles/matrix-bridge-mautrix-signal/templates/config.yaml.j2
new file mode 100644
index 000000000..6865d3c16
--- /dev/null
+++ b/roles/matrix-bridge-mautrix-signal/templates/config.yaml.j2
@@ -0,0 +1,207 @@
+#jinja2: lstrip_blocks: "True"
+# Homeserver details
+homeserver:
+    # The address that this appservice can use to connect to the homeserver.
+    address: {{ matrix_mautrix_signal_homeserver_address }}
+    # The domain of the homeserver (for MXIDs, etc).
+    domain: {{ matrix_mautrix_signal_homeserver_domain }}
+    # Whether or not to verify the SSL certificate of the homeserver.
+    # Only applies if address starts with https://
+    verify_ssl: true
+    asmux: false
+
+# Application service host/registration related details
+# Changing these values requires regeneration of the registration.
+appservice:
+    # The address that the homeserver can use to connect to this appservice.
+    address: {{ matrix_mautrix_signal_appservice_address }}
+    # When using https:// the TLS certificate and key files for the address.
+    tls_cert: false
+    tls_key: false
+
+    # The hostname and port where this appservice should listen.
+    hostname: 0.0.0.0
+    port: 29328
+    # The maximum body size of appservice API requests (from the homeserver) in mebibytes
+    # Usually 1 is enough, but on high-traffic bridges you might need to increase this to avoid 413s
+    max_body_size: 1
+
+    # The full URI to the database. Only Postgres is currently supported.
+    database: {{ matrix_mautrix_signal_db_url }}
+
+    # Provisioning API part of the web server for automated portal creation and fetching information.
+    # Used by things like mautrix-manager (https://github.com/tulir/mautrix-manager).
+    provisioning:
+        # Whether or not the provisioning API should be enabled.
+        enabled: true
+        # The prefix to use in the provisioning API endpoints.
+        prefix: /_matrix/provision/v1
+        # The shared secret to authorize users of the API.
+        # Set to "generate" to generate and save a new token.
+        shared_secret: generate
+
+    # The unique ID of this appservice.
+    id: signal
+    # Username of the appservice bot.
+    bot_username: signalbot
+    # Display name and avatar for bot. Set to "remove" to remove display name/avatar, leave empty
+    # to leave display name/avatar as-is.
+    bot_displayname: Signal bridge bot
+    bot_avatar: mxc://maunium.net/wPJgTQbZOtpBFmDNkiNEMDUp
+
+    # Community ID for bridged users (changes registration file) and rooms.
+    # Must be created manually.
+    #
+    # Example: "+signal:example.com". Set to false to disable.
+    community_id: false
+
+    # Authentication tokens for AS <-> HS communication.
+    as_token: "{{ matrix_mautrix_signal_appservice_token }}"
+    hs_token: "{{ matrix_mautrix_signal_homeserver_token }}"
+
+# Prometheus telemetry config. Requires prometheus-client to be installed.
+metrics:
+    enabled: false
+    listen_port: 8000
+
+signal:
+    # Path to signald unix socket
+    socket_path: /signald/signald.sock
+    # Directory for temp files when sending files to Signal. This should be an
+    # absolute path that signald can read. For attachments in the other direction,
+    # make sure signald is configured to use an absolute path as the data directory.
+    outgoing_attachment_dir: /signald/attachments
+    # Directory where signald stores avatars for groups.
+    avatar_dir: /signald/avatars
+    # Whether or not message attachments should be removed from disk after they're bridged.
+    remove_file_after_handling: true
+
+# Bridge config
+bridge:
+    # Localpart template of MXIDs for Signal users.
+    # {userid} is replaced with an identifier for the Signal user.
+    username_template: "signal_{userid}"
+    # Displayname template for Signal users.
+    # {displayname} is replaced with the displayname of the Signal user, which is the first
+    # available variable in displayname_preference. The variables in displayname_preference
+    # can also be used here directly.
+    displayname_template: "{displayname} (Signal)"
+    # Whether or not contact list displaynames should be used.
+    # Using this isn't recommended on multi-user instances.
+    allow_contact_list_name_updates: false
+    # Available variables: full_name, first_name, last_name, phone, uuid
+    displayname_preference:
+    - full_name
+    - phone
+
+    # Whether or not to create portals for all groups on login/connect.
+    autocreate_group_portal: true
+    # Whether or not to create portals for all contacts on login/connect.
+    autocreate_contact_portal: false
+    # Whether or not to use /sync to get read receipts and typing notifications
+    # when double puppeting is enabled
+    sync_with_custom_puppets: true
+    # Whether or not to update the m.direct account data event when double puppeting is enabled.
+    # Note that updating the m.direct event is not atomic (except with mautrix-asmux)
+    # and is therefore prone to race conditions.
+    sync_direct_chat_list: false
+    # Allow using double puppeting from any server with a valid client .well-known file.
+    double_puppet_allow_discovery: false
+    # Servers to allow double puppeting from, even if double_puppet_allow_discovery is false.
+    double_puppet_server_map: {}
+    # Shared secret for https://github.com/devture/matrix-synapse-shared-secret-auth
+    #
+    # If set, custom puppets will be enabled automatically for local users
+    # instead of users having to find an access token and run `login-matrix`
+    # manually.
+    # If using this for other servers than the bridge's server,
+    # you must also set the URL in the double_puppet_server_map.
+    login_shared_secret_map:
+        {{ matrix_mautrix_signal_homeserver_domain }}: {{ matrix_mautrix_signal_login_shared_secret|to_json }}
+    # Whether or not created rooms should have federation enabled.
+    # If false, created portal rooms will never be federated.
+    federate_rooms: true
+    # End-to-bridge encryption support options. These require matrix-nio to be installed with pip
+    # and login_shared_secret to be configured in order to get a device for the bridge bot.
+    #
+    # Additionally, https://github.com/matrix-org/synapse/pull/5758 is required if using a normal
+    # application service.
+    encryption:
+        # Allow encryption, work in group chat rooms with e2ee enabled
+        allow: false
+        # Default to encryption, force-enable encryption in all portals the bridge creates
+        # This will cause the bridge bot to be in private chats for the encryption to work properly.
+        default: false
+        # Options for automatic key sharing.
+        key_sharing:
+            # Enable key sharing? If enabled, key requests for rooms where users are in will be fulfilled.
+            # You must use a client that supports requesting keys from other users to use this feature.
+            allow: false
+            # Require the requesting device to have a valid cross-signing signature?
+            # This doesn't require that the bridge has verified the device, only that the user has verified it.
+            # Not yet implemented.
+            require_cross_signing: false
+            # Require devices to be verified by the bridge?
+            # Verification by the bridge is not yet implemented.
+            require_verification: true
+    # Whether or not to explicitly set the avatar and room name for private
+    # chat portal rooms. This will be implicitly enabled if encryption.default is true.
+    private_chat_portal_meta: false
+    # Whether or not the bridge should send a read receipt from the bridge bot when a message has
+    # been sent to Signal. This let's you check manually whether the bridge is receiving your
+    # messages.
+    # Note that this is not related to Signal delivery receipts.
+    delivery_receipts: false
+    # Whether or not delivery errors should be reported as messages in the Matrix room. (not yet implemented)
+    delivery_error_reports: false
+    # Set this to true to tell the bridge to re-send m.bridge events to all rooms on the next run.
+    # This field will automatically be changed back to false after it,
+    # except if the config file is not writable.
+    resend_bridge_info: false
+
+    # The prefix for commands. Only required in non-management rooms.
+    command_prefix: "!signal"
+
+    # Permissions for using the bridge.
+    # Permitted values:
+    #       user - Use the bridge with puppeting.
+    #      admin - Use and administrate the bridge.
+    # Permitted keys:
+    #        * - All Matrix users
+    #   domain - All users on that homeserver
+    #     mxid - Specific user
+    permissions:
+        "1m.at": "user"
+        "@admin:1m.at": "admin"
+
+
+# Python logging configuration.
+#
+# See section 16.7.2 of the Python documentation for more info:
+# https://docs.python.org/3.6/library/logging.config.html#configuration-dictionary-schema
+logging:
+    version: 1
+    formatters:
+        colored:
+            (): mautrix_signal.util.ColorFormatter
+            format: "[%(asctime)s] [%(levelname)s@%(name)s] %(message)s"
+        normal:
+            format: "[%(asctime)s] [%(levelname)s@%(name)s] %(message)s"
+    handlers:
+        file:
+            class: logging.handlers.RotatingFileHandler
+            formatter: normal
+            filename: ./mautrix-signal.log
+            maxBytes: 10485760
+            backupCount: 10
+        console:
+            class: logging.StreamHandler
+            formatter: colored
+    loggers:
+        mau:
+            level: DEBUG
+        aiohttp:
+            level: INFO
+    root:
+        level: DEBUG
+        handlers: [file, console]
diff --git a/roles/matrix-bridge-mautrix-signal/templates/systemd/matrix-mautrix-signal-daemon.service.j2 b/roles/matrix-bridge-mautrix-signal/templates/systemd/matrix-mautrix-signal-daemon.service.j2
new file mode 100644
index 000000000..499ee3096
--- /dev/null
+++ b/roles/matrix-bridge-mautrix-signal/templates/systemd/matrix-mautrix-signal-daemon.service.j2
@@ -0,0 +1,29 @@
+#jinja2: lstrip_blocks: "True"
+[Unit]
+Description=Matrix Mautrix Signal daemon
+
+[Service]
+Type=simple
+
+ExecStartPre=-{{ matrix_host_command_docker }} kill matrix-mautrix-signal-daemon
+ExecStartPre=-{{ matrix_host_command_docker }} rm matrix-mautrix-signal-daemon
+
+# Intentional delay, so that the homeserver (we likely depend on) can manage to start.
+ExecStartPre={{ matrix_host_command_sleep }} 5
+
+ExecStart={{ matrix_host_command_docker }} run --rm --name matrix-mautrix-signal-daemon \
+			--log-driver=none \
+			--user={{ matrix_user_uid }}:{{ matrix_user_gid }} \
+			--network={{ matrix_docker_network }} \
+			-v {{ matrix_mautrix_signal_daemon_path }}:/signald:z \
+			{{ matrix_mautrix_signal_daemon_docker_image }}
+
+ExecStop=-{{ matrix_host_command_docker }} kill matrix-mautrix-signal-daemon
+ExecStop=-{{ matrix_host_command_docker }} rm matrix-mautrix-signal-daemon
+
+Restart=always
+RestartSec=30
+SyslogIdentifier=matrix-mautrix-signal-daemon
+
+[Install]
+WantedBy=multi-user.target
diff --git a/roles/matrix-bridge-mautrix-signal/templates/systemd/matrix-mautrix-signal-db.service.j2 b/roles/matrix-bridge-mautrix-signal/templates/systemd/matrix-mautrix-signal-db.service.j2
new file mode 100644
index 000000000..653b67b89
--- /dev/null
+++ b/roles/matrix-bridge-mautrix-signal/templates/systemd/matrix-mautrix-signal-db.service.j2
@@ -0,0 +1,32 @@
+#jinja2: lstrip_blocks: "True"
+[Unit]
+Description=Matrix Mautrix Signal database server
+
+[Service]
+Type=simple
+
+ExecStartPre=-{{ matrix_host_command_docker }} kill {{ matrix_mautrix_signal_db_host }}
+ExecStartPre=-{{ matrix_host_command_docker }} rm {{ matrix_mautrix_signal_db_host }}
+
+# Intentional delay, so that the homeserver (we likely depend on) can manage to start.
+ExecStartPre={{ matrix_host_command_sleep }} 5
+
+ExecStart={{ matrix_host_command_docker }} run --rm --name {{ matrix_mautrix_signal_db_host }} \
+			--log-driver=none \
+			--user={{ matrix_user_uid }}:{{ matrix_user_gid }} \
+			--network={{ matrix_docker_network }} \
+			--env POSTGRES_USER={{ matrix_mautrix_signal_db_user }} \
+			--env POSTGRES_PASSWORD={{ matrix_mautrix_signal_db_password }} \
+			--env POSTGRES_DB={{ matrix_mautrix_signal_db_database }} \
+			-v {{ matrix_mautrix_signal_db_storage_path }}:/var/lib/postgresql/data:z \
+			{{ matrix_mautrix_signal_db_docker_image }}
+
+ExecStop=-{{ matrix_host_command_docker }} kill {{ matrix_mautrix_signal_db_host }}
+ExecStop=-{{ matrix_host_command_docker }} rm {{ matrix_mautrix_signal_db_host }}
+
+Restart=always
+RestartSec=30
+SyslogIdentifier=matrix-mautrix-signal-db
+
+[Install]
+WantedBy=multi-user.target
diff --git a/roles/matrix-bridge-mautrix-signal/templates/systemd/matrix-mautrix-signal.service.j2 b/roles/matrix-bridge-mautrix-signal/templates/systemd/matrix-mautrix-signal.service.j2
new file mode 100644
index 000000000..c1c835a28
--- /dev/null
+++ b/roles/matrix-bridge-mautrix-signal/templates/systemd/matrix-mautrix-signal.service.j2
@@ -0,0 +1,44 @@
+#jinja2: lstrip_blocks: "True"
+[Unit]
+Description=Matrix Mautrix Signal server
+
+{% for service in matrix_mautrix_signal_systemd_required_services_list %}
+Requires={{ service }}
+After={{ service }}
+{% endfor %}
+
+{% for service in matrix_mautrix_signal_systemd_wanted_services_list %}
+Wants={{ service }}
+{% endfor %}
+
+[Service]
+Type=simple
+ExecStartPre=-{{ matrix_host_command_docker }} kill matrix-mautrix-signal
+ExecStartPre=-{{ matrix_host_command_docker }} rm matrix-mautrix-signal
+
+# Intentional delay, so that the homeserver (we likely depend on) can manage to start.
+ExecStartPre={{ matrix_host_command_sleep }} 5
+
+ExecStart={{ matrix_host_command_docker }} run --rm --name matrix-mautrix-signal \
+			--log-driver=none \
+			--network={{ matrix_docker_network }} \
+			{% if matrix_mautrix_signal_container_http_host_bind_port %}
+			-p {{ matrix_mautrix_signal_container_http_host_bind_port }}:29328 \
+			{% endif %}
+			-v {{ matrix_mautrix_signal_daemon_path }}:/signald:z \
+			-v {{ matrix_mautrix_signal_config_path }}:/data:z \
+			{% for arg in matrix_mautrix_signal_container_extra_arguments %}
+			{{ arg }} \
+			{% endfor %}
+			{{ matrix_mautrix_signal_docker_image }} \
+			python3 -m mautrix_signal -c /data/config.yaml
+
+ExecStop=-{{ matrix_host_command_docker }} kill matrix-mautrix-signal
+ExecStop=-{{ matrix_host_command_docker }} rm matrix-mautrix-signal
+
+Restart=always
+RestartSec=30
+SyslogIdentifier=matrix-mautrix-signal
+
+[Install]
+WantedBy=multi-user.target
diff --git a/setup.yml b/setup.yml
index 68c4e4eee..67639f3e5 100755
--- a/setup.yml
+++ b/setup.yml
@@ -14,6 +14,7 @@
     - matrix-bridge-appservice-irc
     - matrix-bridge-mautrix-facebook
     - matrix-bridge-mautrix-hangouts
+    - matrix-bridge-mautrix-signal
     - matrix-bridge-mautrix-telegram
     - matrix-bridge-mautrix-whatsapp
     - matrix-bridge-mx-puppet-discord

From 7a54e1109066ea5960c772de34ae7461be7a304d Mon Sep 17 00:00:00 2001
From: Sabine <sabinbox@laszakovits.net>
Date: Sat, 24 Oct 2020 12:15:03 +0200
Subject: [PATCH 02/22] started moving settings to group_vars

---
 group_vars/matrix_servers                     | 25 +++++++++++++++++++
 .../defaults/main.yml                         |  4 +--
 2 files changed, 27 insertions(+), 2 deletions(-)

diff --git a/group_vars/matrix_servers b/group_vars/matrix_servers
index 00cdbdfbb..009367003 100755
--- a/group_vars/matrix_servers
+++ b/group_vars/matrix_servers
@@ -241,7 +241,32 @@ matrix_mautrix_hangouts_login_shared_secret: "{{ matrix_synapse_ext_password_pro
 ######################################################################
 
 
+######################################################################
+#
+# matrix-bridge-mautrix-signal
+#
+######################################################################
 
+matrix_mautrix_signal_enabled: false
+
+matrix_mautrix_signal_systemd_required_services_list: |
+  {{
+    ['docker.service']
+    +
+    (['matrix-synapse.service'] if matrix_synapse_enabled else [])
+  }}
+
+matrix_mautrix_signal_appservice_token: "{{ matrix_synapse_macaroon_secret_key | password_hash('sha512', 'si.as.token') | to_uuid }}"
+
+matrix_mautrix_signal_homeserver_token: "{{ matrix_synapse_macaroon_secret_key | password_hash('sha512', 'si.hs.token') | to_uuid }}"
+
+matrix_mautrix_signal_login_shared_secret: "{{ matrix_synapse_ext_password_provider_shared_secret_auth_shared_secret if matrix_synapse_ext_password_provider_shared_secret_auth_enabled else '' }}"
+
+######################################################################
+#
+# /matrix-bridge-mautrix-signal
+#
+######################################################################
 
 
 ######################################################################
diff --git a/roles/matrix-bridge-mautrix-signal/defaults/main.yml b/roles/matrix-bridge-mautrix-signal/defaults/main.yml
index d86bdb59b..d034cab10 100644
--- a/roles/matrix-bridge-mautrix-signal/defaults/main.yml
+++ b/roles/matrix-bridge-mautrix-signal/defaults/main.yml
@@ -1,7 +1,7 @@
 # mautrix-telegram is a Matrix <-> Telegram bridge
 # See: https://github.com/tulir/mautrix-telegram
 
-matrix_mautrix_signal_enabled: false
+matrix_mautrix_signal_enabled: true
 
 # See: https://mau.dev/tulir/mautrix-signal/container_registry
 matrix_mautrix_signal_docker_image: "dock.mau.dev/tulir/mautrix-signal:latest"
@@ -41,7 +41,7 @@ matrix_mautrix_signal_container_extra_arguments: []
 # List of systemd services that matrix-mautrix-signal.service depends on.
 matrix_mautrix_signal_systemd_required_services_list: ['docker.service', 'matrix-mautrix-signal-daemon.service', 'matrix-mautrix-signal-db.service']
 
-# List of systemd services that matrix-mautrix-telegram.service wants
+# List of systemd services that matrix-mautrix-signal.service wants
 matrix_mautrix_signal_systemd_wanted_services_list: []
 
 matrix_mautrix_signal_appservice_token: ''

From d6940d9f106429629c6f4b758ebbbd122f6026a4 Mon Sep 17 00:00:00 2001
From: Sabine Laszakovits <sabinbox@laszakovits.net>
Date: Sun, 25 Oct 2020 18:44:19 +0100
Subject: [PATCH 03/22] added docs

---
 ...figuring-playbook-bridge-mautrix-signal.md | 45 +++++++++++++++++++
 docs/configuring-playbook.md                  |  2 +
 2 files changed, 47 insertions(+)
 create mode 100644 docs/configuring-playbook-bridge-mautrix-signal.md

diff --git a/docs/configuring-playbook-bridge-mautrix-signal.md b/docs/configuring-playbook-bridge-mautrix-signal.md
new file mode 100644
index 000000000..7bdd9924f
--- /dev/null
+++ b/docs/configuring-playbook-bridge-mautrix-signal.md
@@ -0,0 +1,45 @@
+# Setting up Mautrix Signal (optional)
+
+The playbook can install and configure [mautrix-signal](https://github.com/tulir/mautrix-signal) for you.
+
+See the project's [documentation](https://github.com/tulir/mautrix-signal/wiki) to learn what it does and why it might be useful to you.
+
+Use the following playbook configuration:
+
+```yaml
+matrix_mautrix_signal_enabled: true
+```
+
+
+## Set up Double Puppeting
+
+If you'd like to use [Double Puppeting](https://github.com/tulir/mautrix-whatsapp/wiki/Authentication#replacing-whatsapp-accounts-matrix-puppet-with-matrix-account) (hint: you most likely do), you have 2 ways of going about it.
+
+### Method 1: automatically, by enabling Shared Secret Auth
+
+The bridge will automatically perform Double Puppeting if you enable [Shared Secret Auth](configuring-playbook-shared-secret-auth.md) for this playbook.
+
+This is the recommended way of setting up Double Puppeting, as it's easier to accomplish, works for all your users automatically, and has less of a chance of breaking in the future.
+
+### Method 2: manually, by asking each user to provide a working access token
+
+**Note**: This method for enabling Double Puppeting can be configured only after you've already set up bridging (see [Usage](#usage)).
+
+When using this method, **each user** that wishes to enable Double Puppeting needs to follow the following steps:
+
+- retrieve a Matrix access token for yourself. You can use the following command:
+
+```
+curl \
+--data '{"identifier": {"type": "m.id.user", "user": "YOUR_MATRIX_USERNAME" }, "password": "YOUR_MATRIX_PASSWORD", "type": "m.login.password", "device_id": "Mautrix-Signal", "initial_device_display_name": "Mautrix-Signal"}' \
+https://matrix.DOMAIN/_matrix/client/r0/login
+```
+
+- send the access token to the bot. Example: `login-matrix MATRIX_ACCESS_TOKEN_HERE`
+
+- make sure you don't log out the `Mautrix-Signal` device some time in the future, as that would break the Double Puppeting feature
+
+
+## Usage
+
+You then need to start a chat with `@signalbot:YOUR_DOMAIN` (where `YOUR_DOMAIN` is your base domain, not the `matrix.` domain).
diff --git a/docs/configuring-playbook.md b/docs/configuring-playbook.md
index b174637ef..ad45eac7f 100644
--- a/docs/configuring-playbook.md
+++ b/docs/configuring-playbook.md
@@ -93,6 +93,8 @@ When you're done with all the configuration you'd like to do, continue with [Ins
 
 - [Setting up Mautrix Hangouts bridging](configuring-playbook-bridge-mautrix-hangouts.md) (optional)
 
+- [Setting up Mautrix Signal bridging](configuring-playbook-bridge-mautrix-signal.md) (optional)
+
 - [Setting up Appservice IRC bridging](configuring-playbook-bridge-appservice-irc.md) (optional)
 
 - [Setting up Appservice Discord bridging](configuring-playbook-bridge-appservice-discord.md) (optional)

From ff1d7921a0f5a64b3f418d13d096112c100990f4 Mon Sep 17 00:00:00 2001
From: Sabine Laszakovits <sabinbox@laszakovits.net>
Date: Sun, 25 Oct 2020 20:16:24 +0100
Subject: [PATCH 04/22] moved registration.yaml contents to template

---
 .../defaults/main.yml                             | 15 +--------------
 .../templates/registration.yaml.j2                | 14 ++++++++++++++
 2 files changed, 15 insertions(+), 14 deletions(-)
 create mode 100644 roles/matrix-bridge-mautrix-signal/templates/registration.yaml.j2

diff --git a/roles/matrix-bridge-mautrix-signal/defaults/main.yml b/roles/matrix-bridge-mautrix-signal/defaults/main.yml
index d034cab10..94428d4f5 100644
--- a/roles/matrix-bridge-mautrix-signal/defaults/main.yml
+++ b/roles/matrix-bridge-mautrix-signal/defaults/main.yml
@@ -84,19 +84,6 @@ matrix_mautrix_signal_configuration_extension: "{{ matrix_mautrix_signal_configu
 # You most likely don't need to touch this variable. Instead, see `matrix_mautrix_telegram_configuration_yaml`.
 matrix_mautrix_signal_configuration: "{{ matrix_mautrix_signal_configuration_yaml|from_yaml|combine(matrix_mautrix_signal_configuration_extension, recursive=True) }}"
 
-matrix_mautrix_signal_registration_yaml: |
-  id: signal
-  as_token: "{{ matrix_mautrix_signal_appservice_token }}"
-  hs_token: "{{ matrix_mautrix_signal_homeserver_token }}"
-  namespaces:
-      users:
-      - exclusive: true
-        regex: '^@signal_.+:{{ matrix_mautrix_signal_homeserver_domain|regex_escape }}$'
-      aliases:
-      - exclusive: true
-        regex: '^#signal_.+:{{ matrix_mautrix_signal_homeserver_domain|regex_escape }}$'
-  url: {{ matrix_mautrix_signal_appservice_address }}
-  sender_localpart: signalbot
-  rate_limited: false
+matrix_mautrix_signal_registration_yaml: "{{ lookup('template', 'templates/registration.yaml.j2') }}"
 
 matrix_mautrix_signal_registration: "{{ matrix_mautrix_signal_registration_yaml|from_yaml }}"
diff --git a/roles/matrix-bridge-mautrix-signal/templates/registration.yaml.j2 b/roles/matrix-bridge-mautrix-signal/templates/registration.yaml.j2
new file mode 100644
index 000000000..45cc5a0fb
--- /dev/null
+++ b/roles/matrix-bridge-mautrix-signal/templates/registration.yaml.j2
@@ -0,0 +1,14 @@
+#jinja2: lstrip_blocks: "True"
+id: signal
+as_token: "{{ matrix_mautrix_signal_appservice_token }}"
+hs_token: "{{ matrix_mautrix_signal_homeserver_token }}"
+namespaces:
+    users:
+    - exclusive: true
+      regex: '^@signal_.+:{{ matrix_mautrix_signal_homeserver_domain|regex_escape }}$'
+    aliases:
+    - exclusive: true
+      regex: '^#signal_.+:{{ matrix_mautrix_signal_homeserver_domain|regex_escape }}$'
+url: {{ matrix_mautrix_signal_appservice_address }}
+sender_localpart: signalbot
+rate_limited: false

From 9b890e9ced5efc95de2b112e12aac5989a22aeb7 Mon Sep 17 00:00:00 2001
From: Sabine Laszakovits <sabinbox@laszakovits.net>
Date: Sun, 25 Oct 2020 20:45:24 +0100
Subject: [PATCH 05/22] moved some settings from role to group_vars

---
 group_vars/matrix_servers                                  | 7 +++++++
 roles/matrix-bridge-mautrix-signal/defaults/main.yml       | 4 ++--
 .../matrix-bridge-mautrix-signal/tasks/validate_config.yml | 2 ++
 3 files changed, 11 insertions(+), 2 deletions(-)

diff --git a/group_vars/matrix_servers b/group_vars/matrix_servers
index 009367003..c42054d78 100755
--- a/group_vars/matrix_servers
+++ b/group_vars/matrix_servers
@@ -257,11 +257,18 @@ matrix_mautrix_signal_systemd_required_services_list: |
   }}
 
 matrix_mautrix_signal_appservice_token: "{{ matrix_synapse_macaroon_secret_key | password_hash('sha512', 'si.as.token') | to_uuid }}"
+matrix_mautrix_signal_homeserver_domain: '{{ matrix_domain }}'
+
+matrix_mautrix_signal_homeserver_address: "{{ 'http://matrix-synapse:8008' if matrix_synapse_enabled else '' }}"
 
 matrix_mautrix_signal_homeserver_token: "{{ matrix_synapse_macaroon_secret_key | password_hash('sha512', 'si.hs.token') | to_uuid }}"
 
 matrix_mautrix_signal_login_shared_secret: "{{ matrix_synapse_ext_password_provider_shared_secret_auth_shared_secret if matrix_synapse_ext_password_provider_shared_secret_auth_enabled else '' }}"
 
+matrix_mautrix_signal_db_user: 'signal-db-user'
+matrix_mautrix_signal_db_password: 'signal-db-password'
+matrix_mautrix_signal_db_database: 'signal-db'
+
 ######################################################################
 #
 # /matrix-bridge-mautrix-signal
diff --git a/roles/matrix-bridge-mautrix-signal/defaults/main.yml b/roles/matrix-bridge-mautrix-signal/defaults/main.yml
index 94428d4f5..0e9705912 100644
--- a/roles/matrix-bridge-mautrix-signal/defaults/main.yml
+++ b/roles/matrix-bridge-mautrix-signal/defaults/main.yml
@@ -25,8 +25,8 @@ matrix_mautrix_signal_daemon_path: "{{ matrix_mautrix_signal_base_path }}/signal
 # # Example: /741a0483-ba17-4682-9900-30bd7269f1cc
 # matrix_mautrix_telegram_public_endpoint: ''
 
-matrix_mautrix_signal_homeserver_address: 'http://matrix-synapse:8008'
-matrix_mautrix_signal_homeserver_domain: '{{ matrix_domain }}'
+matrix_mautrix_signal_homeserver_address: ''
+matrix_mautrix_signal_homeserver_domain: ''
 matrix_mautrix_signal_appservice_address: 'http://matrix-mautrix-signal:29328'
 # matrix_mautrix_telegram_appservice_public_external: 'https://{{ matrix_server_fqn_matrix }}{{ matrix_mautrix_telegram_public_endpoint }}'
 
diff --git a/roles/matrix-bridge-mautrix-signal/tasks/validate_config.yml b/roles/matrix-bridge-mautrix-signal/tasks/validate_config.yml
index a11e192da..0f3a8e35f 100644
--- a/roles/matrix-bridge-mautrix-signal/tasks/validate_config.yml
+++ b/roles/matrix-bridge-mautrix-signal/tasks/validate_config.yml
@@ -7,6 +7,8 @@
   when: "vars[item] == ''"
   with_items:
     - "matrix_mautrix_signal_appservice_token"
+    - "matrix_mautrix_signal_homeserver_domain"
+    - "matrix_mautrix_signal_homeserver_address"
     - "matrix_mautrix_signal_homeserver_token"
     - "matrix_mautrix_signal_db_user"
     - "matrix_mautrix_signal_db_password"

From 8ebc39dea0f1e7ca587c2f781279e3b16527167a Mon Sep 17 00:00:00 2001
From: Sabine Laszakovits <sabinbox@laszakovits.net>
Date: Sun, 25 Oct 2020 20:46:32 +0100
Subject: [PATCH 06/22] fixed dependencies of bridge service (not ideal, but
 correct)

---
 group_vars/matrix_servers                            | 3 +++
 roles/matrix-bridge-mautrix-signal/defaults/main.yml | 7 ++++++-
 2 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/group_vars/matrix_servers b/group_vars/matrix_servers
index c42054d78..735581a29 100755
--- a/group_vars/matrix_servers
+++ b/group_vars/matrix_servers
@@ -249,11 +249,14 @@ matrix_mautrix_hangouts_login_shared_secret: "{{ matrix_synapse_ext_password_pro
 
 matrix_mautrix_signal_enabled: false
 
+# TODO: unclear whether to put this into the role or keep it here
 matrix_mautrix_signal_systemd_required_services_list: |
   {{
     ['docker.service']
     +
     (['matrix-synapse.service'] if matrix_synapse_enabled else [])
+    +
+    ['matrix-mautrix-signal-daemon.service', 'matrix-mautrix-signal-db.service']
   }}
 
 matrix_mautrix_signal_appservice_token: "{{ matrix_synapse_macaroon_secret_key | password_hash('sha512', 'si.as.token') | to_uuid }}"
diff --git a/roles/matrix-bridge-mautrix-signal/defaults/main.yml b/roles/matrix-bridge-mautrix-signal/defaults/main.yml
index 0e9705912..85ae6992d 100644
--- a/roles/matrix-bridge-mautrix-signal/defaults/main.yml
+++ b/roles/matrix-bridge-mautrix-signal/defaults/main.yml
@@ -39,7 +39,12 @@ matrix_mautrix_signal_container_http_host_bind_port: ''
 matrix_mautrix_signal_container_extra_arguments: []
 
 # List of systemd services that matrix-mautrix-signal.service depends on.
-matrix_mautrix_signal_systemd_required_services_list: ['docker.service', 'matrix-mautrix-signal-daemon.service', 'matrix-mautrix-signal-db.service']
+# TODO: unclear whether to put this into group_vars or keep it here
+matrix_mautrix_signal_systemd_required_services_list:
+  - 'docker.service'
+  - "{{ 'matrix-synapse.service' if matrix_synapse_enabled else [] }}"
+  - 'matrix-mautrix-signal-daemon.service'
+  - 'matrix-mautrix-signal-db.service'
 
 # List of systemd services that matrix-mautrix-signal.service wants
 matrix_mautrix_signal_systemd_wanted_services_list: []

From c36e1355cf58d3f73d3891060cb720db9e5b9230 Mon Sep 17 00:00:00 2001
From: Sabine Laszakovits <sabinbox@laszakovits.net>
Date: Sun, 25 Oct 2020 20:46:57 +0100
Subject: [PATCH 07/22] cleanup

---
 group_vars/matrix_servers                                    | 3 ++-
 roles/matrix-bridge-mautrix-signal/defaults/main.yml         | 5 ++---
 roles/matrix-bridge-mautrix-signal/tasks/validate_config.yml | 2 +-
 3 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/group_vars/matrix_servers b/group_vars/matrix_servers
index 735581a29..5252f7ad8 100755
--- a/group_vars/matrix_servers
+++ b/group_vars/matrix_servers
@@ -259,13 +259,14 @@ matrix_mautrix_signal_systemd_required_services_list: |
     ['matrix-mautrix-signal-daemon.service', 'matrix-mautrix-signal-db.service']
   }}
 
-matrix_mautrix_signal_appservice_token: "{{ matrix_synapse_macaroon_secret_key | password_hash('sha512', 'si.as.token') | to_uuid }}"
 matrix_mautrix_signal_homeserver_domain: '{{ matrix_domain }}'
 
 matrix_mautrix_signal_homeserver_address: "{{ 'http://matrix-synapse:8008' if matrix_synapse_enabled else '' }}"
 
 matrix_mautrix_signal_homeserver_token: "{{ matrix_synapse_macaroon_secret_key | password_hash('sha512', 'si.hs.token') | to_uuid }}"
 
+matrix_mautrix_signal_appservice_token: "{{ matrix_synapse_macaroon_secret_key | password_hash('sha512', 'si.as.token') | to_uuid }}"
+
 matrix_mautrix_signal_login_shared_secret: "{{ matrix_synapse_ext_password_provider_shared_secret_auth_shared_secret if matrix_synapse_ext_password_provider_shared_secret_auth_enabled else '' }}"
 
 matrix_mautrix_signal_db_user: 'signal-db-user'
diff --git a/roles/matrix-bridge-mautrix-signal/defaults/main.yml b/roles/matrix-bridge-mautrix-signal/defaults/main.yml
index 85ae6992d..967789406 100644
--- a/roles/matrix-bridge-mautrix-signal/defaults/main.yml
+++ b/roles/matrix-bridge-mautrix-signal/defaults/main.yml
@@ -7,12 +7,11 @@ matrix_mautrix_signal_enabled: true
 matrix_mautrix_signal_docker_image: "dock.mau.dev/tulir/mautrix-signal:latest"
 matrix_mautrix_signal_docker_image_force_pull: "{{ matrix_mautrix_signal_docker_image.endswith(':latest') }}"
 
-matrix_mautrix_signal_base_path: "{{ matrix_base_data_path }}/mautrix-signal"
-matrix_mautrix_signal_config_path: "{{ matrix_mautrix_signal_base_path }}/bridge"
-
 matrix_mautrix_signal_daemon_docker_image: "dock.mau.dev/maunium/signald:latest"
 matrix_mautrix_signal_daemon_docker_image_force_pull: "{{ matrix_mautrix_signal_daemon_docker_image.endswith(':latest') }}"
 
+matrix_mautrix_signal_base_path: "{{ matrix_base_data_path }}/mautrix-signal"
+matrix_mautrix_signal_config_path: "{{ matrix_mautrix_signal_base_path }}/bridge"
 matrix_mautrix_signal_daemon_path: "{{ matrix_mautrix_signal_base_path }}/signald"
 
 # # Get your own API keys at https://my.telegram.org/apps
diff --git a/roles/matrix-bridge-mautrix-signal/tasks/validate_config.yml b/roles/matrix-bridge-mautrix-signal/tasks/validate_config.yml
index 0f3a8e35f..6663c641c 100644
--- a/roles/matrix-bridge-mautrix-signal/tasks/validate_config.yml
+++ b/roles/matrix-bridge-mautrix-signal/tasks/validate_config.yml
@@ -6,10 +6,10 @@
       You need to define a required configuration setting (`{{ item }}`).
   when: "vars[item] == ''"
   with_items:
-    - "matrix_mautrix_signal_appservice_token"
     - "matrix_mautrix_signal_homeserver_domain"
     - "matrix_mautrix_signal_homeserver_address"
     - "matrix_mautrix_signal_homeserver_token"
+    - "matrix_mautrix_signal_appservice_token"
     - "matrix_mautrix_signal_db_user"
     - "matrix_mautrix_signal_db_password"
     - "matrix_mautrix_signal_db_database"

From e59aa07b8660d57e6d34e1cb730524ea7fc27dd9 Mon Sep 17 00:00:00 2001
From: Sabine Laszakovits <sabinbox@laszakovits.net>
Date: Sun, 25 Oct 2020 20:47:10 +0100
Subject: [PATCH 08/22] more cleanup

---
 roles/matrix-bridge-mautrix-signal/defaults/main.yml | 10 ----------
 1 file changed, 10 deletions(-)

diff --git a/roles/matrix-bridge-mautrix-signal/defaults/main.yml b/roles/matrix-bridge-mautrix-signal/defaults/main.yml
index 967789406..2d61d2071 100644
--- a/roles/matrix-bridge-mautrix-signal/defaults/main.yml
+++ b/roles/matrix-bridge-mautrix-signal/defaults/main.yml
@@ -14,16 +14,6 @@ matrix_mautrix_signal_base_path: "{{ matrix_base_data_path }}/mautrix-signal"
 matrix_mautrix_signal_config_path: "{{ matrix_mautrix_signal_base_path }}/bridge"
 matrix_mautrix_signal_daemon_path: "{{ matrix_mautrix_signal_base_path }}/signald"
 
-# # Get your own API keys at https://my.telegram.org/apps
-# matrix_mautrix_telegram_api_id: ''
-# matrix_mautrix_telegram_api_hash: ''
-# matrix_mautrix_telegram_bot_token: disabled
-
-# # Mautrix telegram public endpoint to log in to telegram
-# # Use an uuid so it's not easily discoverable.
-# # Example: /741a0483-ba17-4682-9900-30bd7269f1cc
-# matrix_mautrix_telegram_public_endpoint: ''
-
 matrix_mautrix_signal_homeserver_address: ''
 matrix_mautrix_signal_homeserver_domain: ''
 matrix_mautrix_signal_appservice_address: 'http://matrix-mautrix-signal:29328'

From 2211e678f39af4f6e0931bba834d090c5ce0a0f6 Mon Sep 17 00:00:00 2001
From: Sabine Laszakovits <sabinbox@laszakovits.net>
Date: Sun, 25 Oct 2020 21:01:25 +0100
Subject: [PATCH 09/22] fixed comments that were copied over from
 mautrix-telegram role

---
 .../defaults/main.yml                         | 15 +++---
 .../tasks/init.yml                            | 47 -------------------
 .../tasks/setup_install.yml                   | 17 -------
 3 files changed, 7 insertions(+), 72 deletions(-)

diff --git a/roles/matrix-bridge-mautrix-signal/defaults/main.yml b/roles/matrix-bridge-mautrix-signal/defaults/main.yml
index 2d61d2071..c15f1ed19 100644
--- a/roles/matrix-bridge-mautrix-signal/defaults/main.yml
+++ b/roles/matrix-bridge-mautrix-signal/defaults/main.yml
@@ -1,5 +1,5 @@
-# mautrix-telegram is a Matrix <-> Telegram bridge
-# See: https://github.com/tulir/mautrix-telegram
+# mautrix-signal is a Matrix <-> Signal bridge
+# See: https://github.com/tulir/mautrix-signal
 
 matrix_mautrix_signal_enabled: true
 
@@ -17,9 +17,8 @@ matrix_mautrix_signal_daemon_path: "{{ matrix_mautrix_signal_base_path }}/signal
 matrix_mautrix_signal_homeserver_address: ''
 matrix_mautrix_signal_homeserver_domain: ''
 matrix_mautrix_signal_appservice_address: 'http://matrix-mautrix-signal:29328'
-# matrix_mautrix_telegram_appservice_public_external: 'https://{{ matrix_server_fqn_matrix }}{{ matrix_mautrix_telegram_public_endpoint }}'
 
-# Controls whether the matrix-mautrix-telegram container exposes its HTTP port (tcp/8080 in the container).
+# Controls whether the matrix-mautrix-signal container exposes its port (tcp/29328 in the container).
 #
 # Takes an "<ip>:<port>" or "<port>" value (e.g. "127.0.0.1:9006"), or empty string to not expose.
 matrix_mautrix_signal_container_http_host_bind_port: ''
@@ -59,23 +58,23 @@ matrix_mautrix_signal_login_shared_secret: ''
 # Default configuration template which covers the generic use case.
 # You can customize it by controlling the various variables inside it.
 #
-# For a more advanced customization, you can extend the default (see `matrix_mautrix_telegram_configuration_extension_yaml`)
+# For a more advanced customization, you can extend the default (see `matrix_mautrix_signal_configuration_extension_yaml`)
 # or completely replace this variable with your own template.
 matrix_mautrix_signal_configuration_yaml: "{{ lookup('template', 'templates/config.yaml.j2') }}"
 
 matrix_mautrix_signal_configuration_extension_yaml: |
   # Your custom YAML configuration goes here.
-  # This configuration extends the default starting configuration (`matrix_mautrix_telegram_configuration_yaml`).
+  # This configuration extends the default starting configuration (`matrix_mautrix_signal_configuration_yaml`).
   #
   # You can override individual variables from the default configuration, or introduce new ones.
   #
   # If you need something more special, you can take full control by
-  # completely redefining `matrix_mautrix_telegram_configuration_yaml`.
+  # completely redefining `matrix_mautrix_signal_configuration_yaml`.
 
 matrix_mautrix_signal_configuration_extension: "{{ matrix_mautrix_signal_configuration_extension_yaml|from_yaml if matrix_mautrix_signal_configuration_extension_yaml|from_yaml is mapping else {} }}"
 
 # Holds the final configuration (a combination of the default and its extension).
-# You most likely don't need to touch this variable. Instead, see `matrix_mautrix_telegram_configuration_yaml`.
+# You most likely don't need to touch this variable. Instead, see `matrix_mautrix_signal_configuration_yaml`.
 matrix_mautrix_signal_configuration: "{{ matrix_mautrix_signal_configuration_yaml|from_yaml|combine(matrix_mautrix_signal_configuration_extension, recursive=True) }}"
 
 matrix_mautrix_signal_registration_yaml: "{{ lookup('template', 'templates/registration.yaml.j2') }}"
diff --git a/roles/matrix-bridge-mautrix-signal/tasks/init.yml b/roles/matrix-bridge-mautrix-signal/tasks/init.yml
index 8fdc98349..c2b37841c 100644
--- a/roles/matrix-bridge-mautrix-signal/tasks/init.yml
+++ b/roles/matrix-bridge-mautrix-signal/tasks/init.yml
@@ -14,50 +14,3 @@
       +
       {{ ["/matrix-mautrix-signal-registration.yaml"] }}
   when: matrix_mautrix_signal_enabled|bool
-
-# - block:
-#   - name: Fail if matrix-nginx-proxy role already executed
-#     fail:
-#       msg: >-
-#         Trying to append Mautrix Signal's reverse-proxying configuration to matrix-nginx-proxy,
-#         but it's pointless since the matrix-nginx-proxy role had already executed.
-#         To fix this, please change the order of roles in your plabook,
-#         so that the matrix-nginx-proxy role would run after the matrix-bridge-mautrix-signal role.
-#     when: matrix_nginx_proxy_role_executed|default(False)|bool
-
-  # - name: Generate Mautrix Signal proxying configuration for matrix-nginx-proxy
-  #   set_fact:
-  #     matrix_mautrix_telegram_matrix_nginx_proxy_configuration: |
-  #       location {{ matrix_mautrix_telegram_public_endpoint }} {
-  #       {% if matrix_nginx_proxy_enabled|default(False) %}
-  #       	{# Use the embedded DNS resolver in Docker containers to discover the service #}
-  #       	resolver 127.0.0.11 valid=5s;
-  #       	set $backend "matrix-mautrix-telegram:8080";
-  #       	proxy_pass http://$backend;
-  #       {% else %}
-  #       	{# Generic configuration for use outside of our container setup #}
-  #       	proxy_pass http://127.0.0.1:9006;
-  #       {% endif %}
-  #       }
-
-  # - name: Register Mautrix Telegram proxying configuration with matrix-nginx-proxy
-  #   set_fact:
-  #     matrix_nginx_proxy_proxy_matrix_additional_server_configuration_blocks: |
-  #       {{
-  #         matrix_nginx_proxy_proxy_matrix_additional_server_configuration_blocks|default([])
-  #         +
-  #         [matrix_mautrix_telegram_matrix_nginx_proxy_configuration]
-  #       }}
-  # tags:
-  #  - always
-  # when: matrix_mautrix_telegram_enabled|bool
-
-# - name: Warn about reverse-proxying if matrix-nginx-proxy not used
-#   debug:
-#     msg: >-
-#       NOTE: You've enabled the Mautrix Telegram bridge but are not using the matrix-nginx-proxy
-#       reverse proxy.
-#       Please make sure that you're proxying the `{{ matrix_mautrix_telegram_public_endpoint }}`
-#       URL endpoint to the matrix-mautrix-telegram container.
-#       You can expose the container's port using the `matrix_mautrix_telegram_container_http_host_bind_port` variable.
-#   when: "matrix_mautrix_telegram_enabled|bool and matrix_nginx_proxy_enabled is not defined"
diff --git a/roles/matrix-bridge-mautrix-signal/tasks/setup_install.yml b/roles/matrix-bridge-mautrix-signal/tasks/setup_install.yml
index cacb4c6c7..16b68d250 100644
--- a/roles/matrix-bridge-mautrix-signal/tasks/setup_install.yml
+++ b/roles/matrix-bridge-mautrix-signal/tasks/setup_install.yml
@@ -42,23 +42,6 @@
     - "{{ matrix_mautrix_signal_daemon_path }}"
     - "{{ matrix_mautrix_signal_db_storage_path }}"
 
-# - name: Check if an old database file already exists
-#   stat:
-#     path: "{{ matrix_mautrix_telegram_base_path }}/mautrix-telegram.db"
-#   register: matrix_mautrix_telegram_stat_database
-#
-# - name: (Data relocation) Ensure matrix-mautrix-telegram.service is stopped
-#   service:
-#     name: matrix-mautrix-telegram
-#     state: stopped
-#     daemon_reload: yes
-#   failed_when: false
-#   when: "matrix_mautrix_telegram_stat_database.stat.exists"
-#
-# - name: (Data relocation) Move mautrix-telegram database file to ./data directory
-#   command: "mv {{ matrix_mautrix_telegram_base_path }}/mautrix-telegram.db {{ matrix_mautrix_telegram_data_path }}/mautrix-telegram.db"
-#   when: "matrix_mautrix_telegram_stat_database.stat.exists"
-
 - name: Ensure mautrix-signal config.yaml installed
   copy:
     content: "{{ matrix_mautrix_signal_configuration|to_nice_yaml }}"

From dd50ee19ab80daef38ae59b2b4f68bd679a4cee7 Mon Sep 17 00:00:00 2001
From: Sabine Laszakovits <sabinbox@laszakovits.net>
Date: Sun, 25 Oct 2020 21:42:40 +0100
Subject: [PATCH 10/22] fixed bridge permissions

---
 docs/configuring-playbook-bridge-mautrix-signal.md | 14 ++++++++++++++
 .../matrix-bridge-mautrix-signal/defaults/main.yml |  9 +++++++++
 .../templates/config.yaml.j2                       |  4 +---
 3 files changed, 24 insertions(+), 3 deletions(-)

diff --git a/docs/configuring-playbook-bridge-mautrix-signal.md b/docs/configuring-playbook-bridge-mautrix-signal.md
index 7bdd9924f..066dbaff6 100644
--- a/docs/configuring-playbook-bridge-mautrix-signal.md
+++ b/docs/configuring-playbook-bridge-mautrix-signal.md
@@ -10,6 +10,20 @@ Use the following playbook configuration:
 matrix_mautrix_signal_enabled: true
 ```
 
+To specify which users have access to the bridge, use the variable `matrix_mautrix_signal_configuration_permissions`.
+Refer to the documentation for
+```yaml
+bridge:
+  permissions:
+```
+in [the example config in mautrix-signal](https://github.com/tulir/mautrix-signal/blob/master/mautrix_signal/example-config.yaml).
+For instance, use
+```yaml
+matrix_mautrix_signal_configuration_permissions:
+  "YOUR_DOMAIN": user
+```
+to allow all users registered to `YOUR_DOMAIN` access to the bridge (where `YOUR_DOMAIN` is your base domain, not the `matrix.` domain).
+
 
 ## Set up Double Puppeting
 
diff --git a/roles/matrix-bridge-mautrix-signal/defaults/main.yml b/roles/matrix-bridge-mautrix-signal/defaults/main.yml
index c15f1ed19..e6c5fe054 100644
--- a/roles/matrix-bridge-mautrix-signal/defaults/main.yml
+++ b/roles/matrix-bridge-mautrix-signal/defaults/main.yml
@@ -62,6 +62,15 @@ matrix_mautrix_signal_login_shared_secret: ''
 # or completely replace this variable with your own template.
 matrix_mautrix_signal_configuration_yaml: "{{ lookup('template', 'templates/config.yaml.j2') }}"
 
+# Permitted values:
+#       user - Use the bridge with puppeting.
+#      admin - Use and administrate the bridge.
+# Permitted keys:
+#        * - All Matrix users
+#   domain - All users on that homeserver
+#     mxid - Specific user
+matrix_mautrix_signal_configuration_permissions: []
+
 matrix_mautrix_signal_configuration_extension_yaml: |
   # Your custom YAML configuration goes here.
   # This configuration extends the default starting configuration (`matrix_mautrix_signal_configuration_yaml`).
diff --git a/roles/matrix-bridge-mautrix-signal/templates/config.yaml.j2 b/roles/matrix-bridge-mautrix-signal/templates/config.yaml.j2
index 6865d3c16..ec2a4764e 100644
--- a/roles/matrix-bridge-mautrix-signal/templates/config.yaml.j2
+++ b/roles/matrix-bridge-mautrix-signal/templates/config.yaml.j2
@@ -170,9 +170,7 @@ bridge:
     #        * - All Matrix users
     #   domain - All users on that homeserver
     #     mxid - Specific user
-    permissions:
-        "1m.at": "user"
-        "@admin:1m.at": "admin"
+    permissions: {{ matrix_mautrix_signal_configuration_permissions }} 
 
 
 # Python logging configuration.

From 468cc3946546a7d939be5f25201eb5829c0f3745 Mon Sep 17 00:00:00 2001
From: Sabine <sabinbox@laszakovits.net>
Date: Wed, 28 Oct 2020 21:56:13 +0100
Subject: [PATCH 11/22] added a workaround for postgres's issue with initdb

---
 .../templates/systemd/matrix-mautrix-signal-db.service.j2        | 1 +
 1 file changed, 1 insertion(+)

diff --git a/roles/matrix-bridge-mautrix-signal/templates/systemd/matrix-mautrix-signal-db.service.j2 b/roles/matrix-bridge-mautrix-signal/templates/systemd/matrix-mautrix-signal-db.service.j2
index 653b67b89..b4baed4c0 100644
--- a/roles/matrix-bridge-mautrix-signal/templates/systemd/matrix-mautrix-signal-db.service.j2
+++ b/roles/matrix-bridge-mautrix-signal/templates/systemd/matrix-mautrix-signal-db.service.j2
@@ -19,6 +19,7 @@ ExecStart={{ matrix_host_command_docker }} run --rm --name {{ matrix_mautrix_sig
 			--env POSTGRES_PASSWORD={{ matrix_mautrix_signal_db_password }} \
 			--env POSTGRES_DB={{ matrix_mautrix_signal_db_database }} \
 			-v {{ matrix_mautrix_signal_db_storage_path }}:/var/lib/postgresql/data:z \
+			-v /etc/passwd:/etc/passwd:ro \
 			{{ matrix_mautrix_signal_db_docker_image }}
 
 ExecStop=-{{ matrix_host_command_docker }} kill {{ matrix_mautrix_signal_db_host }}

From aabefe21f46a353258c784d1209e7dea4f2e5f05 Mon Sep 17 00:00:00 2001
From: Sabine <sabinbox@laszakovits.net>
Date: Wed, 28 Oct 2020 21:58:59 +0100
Subject: [PATCH 12/22] fixed yaml

---
 roles/matrix-bridge-mautrix-signal/defaults/main.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/roles/matrix-bridge-mautrix-signal/defaults/main.yml b/roles/matrix-bridge-mautrix-signal/defaults/main.yml
index e6c5fe054..5d6bb7d3f 100644
--- a/roles/matrix-bridge-mautrix-signal/defaults/main.yml
+++ b/roles/matrix-bridge-mautrix-signal/defaults/main.yml
@@ -69,7 +69,7 @@ matrix_mautrix_signal_configuration_yaml: "{{ lookup('template', 'templates/conf
 #        * - All Matrix users
 #   domain - All users on that homeserver
 #     mxid - Specific user
-matrix_mautrix_signal_configuration_permissions: []
+matrix_mautrix_signal_configuration_permissions: {}
 
 matrix_mautrix_signal_configuration_extension_yaml: |
   # Your custom YAML configuration goes here.

From cea2faa1b34362b08d3224276ac6b9e2a81070ad Mon Sep 17 00:00:00 2001
From: Sabine <sabinbox@laszakovits.net>
Date: Wed, 28 Oct 2020 21:59:36 +0100
Subject: [PATCH 13/22] added docs for bridge permissions

---
 docs/configuring-playbook-bridge-mautrix-signal.md | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/docs/configuring-playbook-bridge-mautrix-signal.md b/docs/configuring-playbook-bridge-mautrix-signal.md
index 066dbaff6..a5410665a 100644
--- a/docs/configuring-playbook-bridge-mautrix-signal.md
+++ b/docs/configuring-playbook-bridge-mautrix-signal.md
@@ -19,10 +19,13 @@ bridge:
 in [the example config in mautrix-signal](https://github.com/tulir/mautrix-signal/blob/master/mautrix_signal/example-config.yaml).
 For instance, use
 ```yaml
-matrix_mautrix_signal_configuration_permissions:
-  "YOUR_DOMAIN": user
+matrix_mautrix_signal_configuration_permissions: |
+  {
+    '{{ matrix_domain }}': 'user'
+  }
 ```
-to allow all users registered to `YOUR_DOMAIN` access to the bridge (where `YOUR_DOMAIN` is your base domain, not the `matrix.` domain).
+to allow all users registered to the current host's matrix domain access to the bridge, or hard-code whatever you like.
+(See [this issue](https://github.com/ansible/ansible/issues/17324#issuecomment-449642731) on how to use variable names as dictionary keys.)
 
 
 ## Set up Double Puppeting

From ffb837d4bc069748819079390b319313820d2d99 Mon Sep 17 00:00:00 2001
From: Sabine Laszakovits <sabinbox@laszakovits.net>
Date: Sat, 2 Jan 2021 00:39:11 +0100
Subject: [PATCH 14/22] made the bridge use the default postgres db

---
 group_vars/matrix_servers                     | 17 +++++++---
 .../defaults/main.yml                         | 28 +++++++++-------
 .../tasks/setup_install.yml                   | 17 +---------
 .../tasks/setup_uninstall.yml                 | 21 +-----------
 .../tasks/validate_config.yml                 |  9 +++--
 .../templates/config.yaml.j2                  |  2 +-
 .../matrix-mautrix-signal-db.service.j2       | 33 -------------------
 7 files changed, 39 insertions(+), 88 deletions(-)
 delete mode 100644 roles/matrix-bridge-mautrix-signal/templates/systemd/matrix-mautrix-signal-db.service.j2

diff --git a/group_vars/matrix_servers b/group_vars/matrix_servers
index 09253dae7..c90654204 100755
--- a/group_vars/matrix_servers
+++ b/group_vars/matrix_servers
@@ -262,6 +262,7 @@ matrix_mautrix_hangouts_database_password: "{{ matrix_synapse_macaroon_secret_ke
 #
 ######################################################################
 
+# We don't enable bridges by default.
 matrix_mautrix_signal_enabled: false
 
 # TODO: unclear whether to put this into the role or keep it here
@@ -271,7 +272,9 @@ matrix_mautrix_signal_systemd_required_services_list: |
     +
     (['matrix-synapse.service'] if matrix_synapse_enabled else [])
     +
-    ['matrix-mautrix-signal-daemon.service', 'matrix-mautrix-signal-db.service']
+    (['matrix-postgres.service'] if matrix_postgres_enabled else [])
+    +
+    ['matrix-mautrix-signal-daemon.service']
   }}
 
 matrix_mautrix_signal_homeserver_domain: '{{ matrix_domain }}'
@@ -284,9 +287,9 @@ matrix_mautrix_signal_appservice_token: "{{ matrix_synapse_macaroon_secret_key |
 
 matrix_mautrix_signal_login_shared_secret: "{{ matrix_synapse_ext_password_provider_shared_secret_auth_shared_secret if matrix_synapse_ext_password_provider_shared_secret_auth_enabled else '' }}"
 
-matrix_mautrix_signal_db_user: 'signal-db-user'
-matrix_mautrix_signal_db_password: 'signal-db-password'
-matrix_mautrix_signal_db_database: 'signal-db'
+matrix_mautrix_signal_database_engine: 'postgres'
+matrix_mautrix_signal_database_password: "{{ matrix_synapse_macaroon_secret_key | password_hash('sha512', 'mau.signal.db') | to_uuid }}" 
+
 
 ######################################################################
 #
@@ -1069,6 +1072,12 @@ matrix_postgres_additional_databases: |
       'password': matrix_mautrix_hangouts_database_password,
     }] if (matrix_mautrix_hangouts_enabled and matrix_mautrix_hangouts_database_engine == 'postgres' and matrix_mautrix_hangouts_database_hostname == 'matrix-postgres') else [])
     +
+    ([{
+      'name': matrix_mautrix_signal_database_name, 
+      'username': matrix_mautrix_signal_database_username, 
+      'password': matrix_mautrix_signal_database_password, 
+    }] if (matrix_mautrix_signal_enabled and matrix_mautrix_signal_database_engine == 'postgres' and matrix_mautrix_signal_database_hostname == 'matrix-postgres') else [])
+    +
     ([{
       'name': matrix_mautrix_telegram_database_name,
       'username': matrix_mautrix_telegram_database_username,
diff --git a/roles/matrix-bridge-mautrix-signal/defaults/main.yml b/roles/matrix-bridge-mautrix-signal/defaults/main.yml
index 5d6bb7d3f..d26513df0 100644
--- a/roles/matrix-bridge-mautrix-signal/defaults/main.yml
+++ b/roles/matrix-bridge-mautrix-signal/defaults/main.yml
@@ -30,9 +30,7 @@ matrix_mautrix_signal_container_extra_arguments: []
 # TODO: unclear whether to put this into group_vars or keep it here
 matrix_mautrix_signal_systemd_required_services_list:
   - 'docker.service'
-  - "{{ 'matrix-synapse.service' if matrix_synapse_enabled else [] }}"
   - 'matrix-mautrix-signal-daemon.service'
-  - 'matrix-mautrix-signal-db.service'
 
 # List of systemd services that matrix-mautrix-signal.service wants
 matrix_mautrix_signal_systemd_wanted_services_list: []
@@ -40,17 +38,25 @@ matrix_mautrix_signal_systemd_wanted_services_list: []
 matrix_mautrix_signal_appservice_token: ''
 matrix_mautrix_signal_homeserver_token: ''
 
-matrix_mautrix_signal_db_docker_image: "postgres:13.0-alpine"
-matrix_mautrix_signal_db_docker_image_force_pull: "{{ matrix_mautrix_signal_db_docker_image.endswith(':latest') }}"
-matrix_mautrix_signal_db_storage_path: "{{ matrix_mautrix_signal_base_path }}/database"
+# Database-related configuration fields
+#
+# This bridge only supports postgres. 
+#
+matrix_mautrix_signal_database_engine: 'postgres'
 
-matrix_mautrix_signal_db_user: ''
-matrix_mautrix_signal_db_password: ''
-matrix_mautrix_signal_db_host: 'matrix-mautrix-signal-db'
-matrix_mautrix_signal_db_port: '5432'
-matrix_mautrix_signal_db_database: ''
+matrix_mautrix_signal_database_username: 'matrix_mautrix_signal'
+matrix_mautrix_signal_database_password: 'some-password'
+matrix_mautrix_signal_database_hostname: 'matrix-postgres'
+matrix_mautrix_signal_database_port: 5432
+matrix_mautrix_signal_database_name: 'matrix_mautrix_signal'
 
-matrix_mautrix_signal_db_url: "postgres://{{ matrix_mautrix_signal_db_user }}:{{ matrix_mautrix_signal_db_password }}@{{ matrix_mautrix_signal_db_host }}:{{ matrix_mautrix_signal_db_port }}/{{ matrix_mautrix_signal_db_database }}"
+matrix_mautrix_signal_database_connection_string: 'postgres://{{ matrix_mautrix_signal_database_username }}:{{ matrix_mautrix_signal_database_password }}@{{ matrix_mautrix_signal_database_hostname }}:{{ matrix_mautrix_signal_database_port }}/{{ matrix_mautrix_signal_database_name }}' 
+
+matrix_mautrix_signal_appservice_database: "{{ 
+ 	{ 
+ 		'postgres': matrix_mautrix_facebook_database_connection_string, 
+ 	}[matrix_mautrix_signal_database_engine] 
+ }}" 
 
 # Can be set to enable automatic double-puppeting via Shared Secret Auth (https://github.com/devture/matrix-synapse-shared-secret-auth).
 matrix_mautrix_signal_login_shared_secret: ''
diff --git a/roles/matrix-bridge-mautrix-signal/tasks/setup_install.yml b/roles/matrix-bridge-mautrix-signal/tasks/setup_install.yml
index 16b68d250..9b0499877 100644
--- a/roles/matrix-bridge-mautrix-signal/tasks/setup_install.yml
+++ b/roles/matrix-bridge-mautrix-signal/tasks/setup_install.yml
@@ -22,13 +22,6 @@
     force_source: "{{ matrix_mautrix_signal_daemon_docker_image_force_pull if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}"
     force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else matrix_mautrix_signal_docker_image_force_pull }}"
 
-- name: Ensure Mautrix Signal database image is pulled
-  docker_image:
-    name: "{{ matrix_mautrix_signal_db_docker_image }}"
-    source: "{{ 'pull' if ansible_version.major > 2 or ansible_version.minor > 7 else omit }}"
-    force_source: "{{ matrix_mautrix_signal_db_docker_image_force_pull if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}"
-    force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else matrix_mautrix_signal_docker_image_force_pull }}"
-
 - name: Ensure Mautrix Signal paths exist
   file:
     path: "{{ item }}"
@@ -40,7 +33,6 @@
     - "{{ matrix_mautrix_signal_base_path }}"
     - "{{ matrix_mautrix_signal_config_path }}"
     - "{{ matrix_mautrix_signal_daemon_path }}"
-    - "{{ matrix_mautrix_signal_db_storage_path }}"
 
 - name: Ensure mautrix-signal config.yaml installed
   copy:
@@ -65,13 +57,6 @@
     mode: 0644
   register: matrix_mautrix_signal_daemon_systemd_service_result
 
-- name: Ensure matrix-mautrix-signal-db.service installed
-  template:
-    src: "{{ role_path }}/templates/systemd/matrix-mautrix-signal-db.service.j2"
-    dest: "{{ matrix_systemd_path }}/matrix-mautrix-signal-db.service"
-    mode: 0644
-  register: matrix_mautrix_signal_db_systemd_service_result
-
 - name: Ensure matrix-mautrix-signal.service installed
   template:
     src: "{{ role_path }}/templates/systemd/matrix-mautrix-signal.service.j2"
@@ -82,4 +67,4 @@
 - name: Ensure systemd reloaded after matrix-mautrix-signal.service installation
   service:
     daemon_reload: yes
-  when: "matrix_mautrix_signal_systemd_service_result.changed or matrix_mautrix_signal_daemon_systemd_service_result.changed or matrix_mautrix_signal_db_systemd_service_result.changed"
+  when: "matrix_mautrix_signal_systemd_service_result.changed or matrix_mautrix_signal_daemon_systemd_service_result.changed"
diff --git a/roles/matrix-bridge-mautrix-signal/tasks/setup_uninstall.yml b/roles/matrix-bridge-mautrix-signal/tasks/setup_uninstall.yml
index 51581874c..2ca6a9a9f 100644
--- a/roles/matrix-bridge-mautrix-signal/tasks/setup_uninstall.yml
+++ b/roles/matrix-bridge-mautrix-signal/tasks/setup_uninstall.yml
@@ -1,24 +1,5 @@
 ---
 
-# Signal database service
-- name: Check existence of matrix-mautrix-signal-db service
-  stat:
-    path: "{{ matrix_systemd_path }}/matrix-mautrix-signal-db.service"
-  register: matrix_mautrix_signal_db_service_stat
-
-- name: Ensure matrix-mautrix-signal-db is stopped
-  service:
-    name: matrix-mautrix-signal-db
-    state: stopped
-    daemon_reload: yes
-  when: "matrix_mautrix_signal_db_service_stat.stat.exists"
-
-- name: Ensure matrix-mautrix-signal-db.service doesn't exist
-  file:
-    path: "{{ matrix_systemd_path }}/matrix-mautrix-signal-db.service"
-    state: absent
-  when: "matrix_mautrix_signal_db_service_stat.stat.exists"
-
 # Signal daemon service
 - name: Check existence of matrix-mautrix-signal-daemon service
   stat:
@@ -61,4 +42,4 @@
 - name: Ensure systemd reloaded after matrix-mautrix-signal_X.service removal
   service:
     daemon_reload: yes
-  when: "matrix_mautrix_signal_service_stat.stat.exists or matrix_mautrix_signal_daemon_service_stat.stat.exists or matrix_mautrix_signal_db_service_stat.stat.exists"
+  when: "matrix_mautrix_signal_service_stat.stat.exists or matrix_mautrix_signal_daemon_service_stat.stat.exists"
diff --git a/roles/matrix-bridge-mautrix-signal/tasks/validate_config.yml b/roles/matrix-bridge-mautrix-signal/tasks/validate_config.yml
index 6663c641c..397ef4d87 100644
--- a/roles/matrix-bridge-mautrix-signal/tasks/validate_config.yml
+++ b/roles/matrix-bridge-mautrix-signal/tasks/validate_config.yml
@@ -10,9 +10,6 @@
     - "matrix_mautrix_signal_homeserver_address"
     - "matrix_mautrix_signal_homeserver_token"
     - "matrix_mautrix_signal_appservice_token"
-    - "matrix_mautrix_signal_db_user"
-    - "matrix_mautrix_signal_db_password"
-    - "matrix_mautrix_signal_db_database"
 
 - name: (Deprecation) Catch and report renamed Signal variables
   fail:
@@ -22,3 +19,9 @@
   when: "item.old in vars"
   with_items:
     - {'old': 'matrix_mautrix_signal_container_exposed_port_number', 'new': '<superseded by matrix_mautrix_signal_container_http_host_bind_port>'}
+    - {'old': 'matrix_mautrix_signal_db_user', 'new': 'matrix_mautrix_signal_database_username'}
+    - {'old': 'matrix_mautrix_signal_db_password', 'new': 'matrix_mautrix_signal_database_password'}
+    - {'old': 'matrix_mautrix_signal_db_database', 'new': 'matrix_mautrix_signal_database_name'}
+    - {'old': 'matrix_mautrix_signal_db_host', 'new': 'matrix_mautrix_signal_database_hostname'}
+    - {'old': 'matrix_mautrix_signal_db_port', 'new': 'matrix_mautrix_signal_database_port'}
+    - {'old': 'matrix_mautrix_signal_db_url', 'new': 'matrix_mautrix_signal_database_connection_string'}
diff --git a/roles/matrix-bridge-mautrix-signal/templates/config.yaml.j2 b/roles/matrix-bridge-mautrix-signal/templates/config.yaml.j2
index ec2a4764e..64a820b55 100644
--- a/roles/matrix-bridge-mautrix-signal/templates/config.yaml.j2
+++ b/roles/matrix-bridge-mautrix-signal/templates/config.yaml.j2
@@ -27,7 +27,7 @@ appservice:
     max_body_size: 1
 
     # The full URI to the database. Only Postgres is currently supported.
-    database: {{ matrix_mautrix_signal_db_url }}
+    database: {{ matrix_mautrix_signal_database_connection_string }}
 
     # Provisioning API part of the web server for automated portal creation and fetching information.
     # Used by things like mautrix-manager (https://github.com/tulir/mautrix-manager).
diff --git a/roles/matrix-bridge-mautrix-signal/templates/systemd/matrix-mautrix-signal-db.service.j2 b/roles/matrix-bridge-mautrix-signal/templates/systemd/matrix-mautrix-signal-db.service.j2
deleted file mode 100644
index b4baed4c0..000000000
--- a/roles/matrix-bridge-mautrix-signal/templates/systemd/matrix-mautrix-signal-db.service.j2
+++ /dev/null
@@ -1,33 +0,0 @@
-#jinja2: lstrip_blocks: "True"
-[Unit]
-Description=Matrix Mautrix Signal database server
-
-[Service]
-Type=simple
-
-ExecStartPre=-{{ matrix_host_command_docker }} kill {{ matrix_mautrix_signal_db_host }}
-ExecStartPre=-{{ matrix_host_command_docker }} rm {{ matrix_mautrix_signal_db_host }}
-
-# Intentional delay, so that the homeserver (we likely depend on) can manage to start.
-ExecStartPre={{ matrix_host_command_sleep }} 5
-
-ExecStart={{ matrix_host_command_docker }} run --rm --name {{ matrix_mautrix_signal_db_host }} \
-			--log-driver=none \
-			--user={{ matrix_user_uid }}:{{ matrix_user_gid }} \
-			--network={{ matrix_docker_network }} \
-			--env POSTGRES_USER={{ matrix_mautrix_signal_db_user }} \
-			--env POSTGRES_PASSWORD={{ matrix_mautrix_signal_db_password }} \
-			--env POSTGRES_DB={{ matrix_mautrix_signal_db_database }} \
-			-v {{ matrix_mautrix_signal_db_storage_path }}:/var/lib/postgresql/data:z \
-			-v /etc/passwd:/etc/passwd:ro \
-			{{ matrix_mautrix_signal_db_docker_image }}
-
-ExecStop=-{{ matrix_host_command_docker }} kill {{ matrix_mautrix_signal_db_host }}
-ExecStop=-{{ matrix_host_command_docker }} rm {{ matrix_mautrix_signal_db_host }}
-
-Restart=always
-RestartSec=30
-SyslogIdentifier=matrix-mautrix-signal-db
-
-[Install]
-WantedBy=multi-user.target

From 89f7f3c3b8290ea13e0bf53c837cfe45a7cb6a0f Mon Sep 17 00:00:00 2001
From: Sabine Laszakovits <sabinbox@laszakovits.net>
Date: Sat, 2 Jan 2021 00:55:55 +0100
Subject: [PATCH 15/22] added log level configuration

---
 roles/matrix-bridge-mautrix-signal/defaults/main.yml        | 4 +++-
 roles/matrix-bridge-mautrix-signal/templates/config.yaml.j2 | 4 ++--
 2 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/roles/matrix-bridge-mautrix-signal/defaults/main.yml b/roles/matrix-bridge-mautrix-signal/defaults/main.yml
index d26513df0..d366ed574 100644
--- a/roles/matrix-bridge-mautrix-signal/defaults/main.yml
+++ b/roles/matrix-bridge-mautrix-signal/defaults/main.yml
@@ -28,7 +28,7 @@ matrix_mautrix_signal_container_extra_arguments: []
 
 # List of systemd services that matrix-mautrix-signal.service depends on.
 # TODO: unclear whether to put this into group_vars or keep it here
-matrix_mautrix_signal_systemd_required_services_list:
+matrix_mautrix_signal_systemd_required_services_list: 
   - 'docker.service'
   - 'matrix-mautrix-signal-daemon.service'
 
@@ -95,3 +95,5 @@ matrix_mautrix_signal_configuration: "{{ matrix_mautrix_signal_configuration_yam
 matrix_mautrix_signal_registration_yaml: "{{ lookup('template', 'templates/registration.yaml.j2') }}"
 
 matrix_mautrix_signal_registration: "{{ matrix_mautrix_signal_registration_yaml|from_yaml }}"
+
+matrix_mautrix_signal_log_level: 'DEBUG'
\ No newline at end of file
diff --git a/roles/matrix-bridge-mautrix-signal/templates/config.yaml.j2 b/roles/matrix-bridge-mautrix-signal/templates/config.yaml.j2
index 64a820b55..df57915af 100644
--- a/roles/matrix-bridge-mautrix-signal/templates/config.yaml.j2
+++ b/roles/matrix-bridge-mautrix-signal/templates/config.yaml.j2
@@ -197,9 +197,9 @@ logging:
             formatter: colored
     loggers:
         mau:
-            level: DEBUG
+            level: {{ matrix_mautrix_signal_log_level }}
         aiohttp:
             level: INFO
     root:
-        level: DEBUG
+        level: {{ matrix_mautrix_signal_log_level }}
         handlers: [file, console]

From 56af2b1a8cce6a46d401c4556f3faa209b41b5ed Mon Sep 17 00:00:00 2001
From: Sabine Laszakovits <sabinbox@laszakovits.net>
Date: Sat, 2 Jan 2021 00:56:45 +0100
Subject: [PATCH 16/22] small fixes

---
 roles/matrix-bridge-mautrix-signal/tasks/setup_install.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/roles/matrix-bridge-mautrix-signal/tasks/setup_install.yml b/roles/matrix-bridge-mautrix-signal/tasks/setup_install.yml
index 9b0499877..29555116c 100644
--- a/roles/matrix-bridge-mautrix-signal/tasks/setup_install.yml
+++ b/roles/matrix-bridge-mautrix-signal/tasks/setup_install.yml
@@ -14,6 +14,7 @@
     source: "{{ 'pull' if ansible_version.major > 2 or ansible_version.minor > 7 else omit }}"
     force_source: "{{ matrix_mautrix_signal_docker_image_force_pull if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}"
     force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else matrix_mautrix_signal_docker_image_force_pull }}"
+  when: matrix_mautrix_signal_enabled|bool
 
 - name: Ensure Mautrix Signal Daemon image is pulled
   docker_image:
@@ -21,6 +22,7 @@
     source: "{{ 'pull' if ansible_version.major > 2 or ansible_version.minor > 7 else omit }}"
     force_source: "{{ matrix_mautrix_signal_daemon_docker_image_force_pull if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}"
     force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else matrix_mautrix_signal_docker_image_force_pull }}"
+  when: matrix_mautrix_signal_enabled|bool
 
 - name: Ensure Mautrix Signal paths exist
   file:

From 84cac25c11baad5828d6655817281cb990b8159a Mon Sep 17 00:00:00 2001
From: Sabine Laszakovits <sabinbox@laszakovits.net>
Date: Sat, 2 Jan 2021 19:01:21 +0100
Subject: [PATCH 17/22] added config data_dir (else in ~, which isn't set)

---
 roles/matrix-bridge-mautrix-signal/templates/config.yaml.j2 | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/roles/matrix-bridge-mautrix-signal/templates/config.yaml.j2 b/roles/matrix-bridge-mautrix-signal/templates/config.yaml.j2
index df57915af..4335b023a 100644
--- a/roles/matrix-bridge-mautrix-signal/templates/config.yaml.j2
+++ b/roles/matrix-bridge-mautrix-signal/templates/config.yaml.j2
@@ -73,6 +73,8 @@ signal:
     outgoing_attachment_dir: /signald/attachments
     # Directory where signald stores avatars for groups.
     avatar_dir: /signald/avatars
+    # Directory where signald stores auth data. Used to delete data when logging out.
+    data_dir: /signald/data
     # Whether or not message attachments should be removed from disk after they're bridged.
     remove_file_after_handling: true
 

From df8d9cfd3406433b1a6e9b234c818b70c6460daa Mon Sep 17 00:00:00 2001
From: Slavi Pantaleev <slavi@devture.com>
Date: Sun, 3 Jan 2021 07:46:55 +0200
Subject: [PATCH 18/22] Remove some TODOs

The answer to these is: it's good to have them in both places.
The role defines the obvious things it depends on (not knowing
what setup it will find itself into), and then
`group_vars/matrix_servers` "extends" it based on everything else it
knows (the homeserver being Synapse, whether or not the internal
Postgres server is being used, etc.)
---
 group_vars/matrix_servers                     | 10 ++++------
 .../defaults/main.yml                         | 19 +++++++++----------
 2 files changed, 13 insertions(+), 16 deletions(-)

diff --git a/group_vars/matrix_servers b/group_vars/matrix_servers
index c90654204..45260688f 100755
--- a/group_vars/matrix_servers
+++ b/group_vars/matrix_servers
@@ -265,7 +265,6 @@ matrix_mautrix_hangouts_database_password: "{{ matrix_synapse_macaroon_secret_ke
 # We don't enable bridges by default.
 matrix_mautrix_signal_enabled: false
 
-# TODO: unclear whether to put this into the role or keep it here
 matrix_mautrix_signal_systemd_required_services_list: |
   {{
     ['docker.service']
@@ -288,8 +287,7 @@ matrix_mautrix_signal_appservice_token: "{{ matrix_synapse_macaroon_secret_key |
 matrix_mautrix_signal_login_shared_secret: "{{ matrix_synapse_ext_password_provider_shared_secret_auth_shared_secret if matrix_synapse_ext_password_provider_shared_secret_auth_enabled else '' }}"
 
 matrix_mautrix_signal_database_engine: 'postgres'
-matrix_mautrix_signal_database_password: "{{ matrix_synapse_macaroon_secret_key | password_hash('sha512', 'mau.signal.db') | to_uuid }}" 
-
+matrix_mautrix_signal_database_password: "{{ matrix_synapse_macaroon_secret_key | password_hash('sha512', 'mau.signal.db') | to_uuid }}"
 
 ######################################################################
 #
@@ -1073,9 +1071,9 @@ matrix_postgres_additional_databases: |
     }] if (matrix_mautrix_hangouts_enabled and matrix_mautrix_hangouts_database_engine == 'postgres' and matrix_mautrix_hangouts_database_hostname == 'matrix-postgres') else [])
     +
     ([{
-      'name': matrix_mautrix_signal_database_name, 
-      'username': matrix_mautrix_signal_database_username, 
-      'password': matrix_mautrix_signal_database_password, 
+      'name': matrix_mautrix_signal_database_name,
+      'username': matrix_mautrix_signal_database_username,
+      'password': matrix_mautrix_signal_database_password,
     }] if (matrix_mautrix_signal_enabled and matrix_mautrix_signal_database_engine == 'postgres' and matrix_mautrix_signal_database_hostname == 'matrix-postgres') else [])
     +
     ([{
diff --git a/roles/matrix-bridge-mautrix-signal/defaults/main.yml b/roles/matrix-bridge-mautrix-signal/defaults/main.yml
index d366ed574..d46c2c500 100644
--- a/roles/matrix-bridge-mautrix-signal/defaults/main.yml
+++ b/roles/matrix-bridge-mautrix-signal/defaults/main.yml
@@ -27,8 +27,7 @@ matrix_mautrix_signal_container_http_host_bind_port: ''
 matrix_mautrix_signal_container_extra_arguments: []
 
 # List of systemd services that matrix-mautrix-signal.service depends on.
-# TODO: unclear whether to put this into group_vars or keep it here
-matrix_mautrix_signal_systemd_required_services_list: 
+matrix_mautrix_signal_systemd_required_services_list:
   - 'docker.service'
   - 'matrix-mautrix-signal-daemon.service'
 
@@ -40,7 +39,7 @@ matrix_mautrix_signal_homeserver_token: ''
 
 # Database-related configuration fields
 #
-# This bridge only supports postgres. 
+# This bridge only supports postgres.
 #
 matrix_mautrix_signal_database_engine: 'postgres'
 
@@ -50,13 +49,13 @@ matrix_mautrix_signal_database_hostname: 'matrix-postgres'
 matrix_mautrix_signal_database_port: 5432
 matrix_mautrix_signal_database_name: 'matrix_mautrix_signal'
 
-matrix_mautrix_signal_database_connection_string: 'postgres://{{ matrix_mautrix_signal_database_username }}:{{ matrix_mautrix_signal_database_password }}@{{ matrix_mautrix_signal_database_hostname }}:{{ matrix_mautrix_signal_database_port }}/{{ matrix_mautrix_signal_database_name }}' 
+matrix_mautrix_signal_database_connection_string: 'postgres://{{ matrix_mautrix_signal_database_username }}:{{ matrix_mautrix_signal_database_password }}@{{ matrix_mautrix_signal_database_hostname }}:{{ matrix_mautrix_signal_database_port }}/{{ matrix_mautrix_signal_database_name }}'
 
-matrix_mautrix_signal_appservice_database: "{{ 
- 	{ 
- 		'postgres': matrix_mautrix_facebook_database_connection_string, 
- 	}[matrix_mautrix_signal_database_engine] 
- }}" 
+matrix_mautrix_signal_appservice_database: "{{
+ 	{
+ 		'postgres': matrix_mautrix_facebook_database_connection_string,
+ 	}[matrix_mautrix_signal_database_engine]
+ }}"
 
 # Can be set to enable automatic double-puppeting via Shared Secret Auth (https://github.com/devture/matrix-synapse-shared-secret-auth).
 matrix_mautrix_signal_login_shared_secret: ''
@@ -96,4 +95,4 @@ matrix_mautrix_signal_registration_yaml: "{{ lookup('template', 'templates/regis
 
 matrix_mautrix_signal_registration: "{{ matrix_mautrix_signal_registration_yaml|from_yaml }}"
 
-matrix_mautrix_signal_log_level: 'DEBUG'
\ No newline at end of file
+matrix_mautrix_signal_log_level: 'DEBUG'

From aac400664afeda5f93c13e93a75feacc01964add Mon Sep 17 00:00:00 2001
From: Slavi Pantaleev <slavi@devture.com>
Date: Sun, 3 Jan 2021 07:59:49 +0200
Subject: [PATCH 19/22] Announce mautrix-signal bridge

---
 CHANGELOG.md                                       | 7 +++++++
 README.md                                          | 4 ++++
 docs/configuring-playbook-bridge-mautrix-signal.md | 2 ++
 3 files changed, 13 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index c4a586e8b..b6d1f4148 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,3 +1,10 @@
+# 2021-01-03
+
+## Signal bridging support via mautrix-signal
+
+Thanks to [laszabine](https://github.com/laszabine)'s efforts, the playbook now supports bridging to [Signal](https://www.signal.org/) via the [mautrix-signal](https://github.com/tulir/mautrix-signal) bridge. See our [Setting up Mautrix Signal bridging](docs/configuring-playbook-bridge-mautrix-signal.md) documentation page for getting started.
+
+
 # 2020-12-23
 
 ## The big move to all-on-Postgres (potentially dangerous)
diff --git a/README.md b/README.md
index ac2b7ca96..1ddc50167 100644
--- a/README.md
+++ b/README.md
@@ -46,6 +46,8 @@ Using this playbook, you can get the following services configured on your serve
 
 - (optional) the [mautrix-hangouts](https://github.com/tulir/mautrix-hangouts) bridge for bridging your Matrix server to [Google Hangouts](https://en.wikipedia.org/wiki/Google_Hangouts)
 
+- (optional) the [mautrix-signal](https://github.com/tulir/mautrix-signal) bridge for bridging your Matrix server to [Signal](https://www.signal.org/)
+
 - (optional) the [matrix-appservice-irc](https://github.com/matrix-org/matrix-appservice-irc) bridge for bridging your Matrix server to [IRC](https://wikipedia.org/wiki/Internet_Relay_Chat)
 
 - (optional) the [matrix-appservice-discord](https://github.com/Half-Shot/matrix-appservice-discord) bridge for bridging your Matrix server to [Discord](https://discordapp.com/)
@@ -158,6 +160,8 @@ This playbook sets up your server using the following Docker images:
 
 - [tulir/mautrix-hangouts](https://hub.docker.com/r/tulir/mautrix-hangouts/) - the [mautrix-hangouts](https://github.com/tulir/mautrix-hangouts) bridge to [Google Hangouts](https://en.wikipedia.org/wiki/Google_Hangouts) (optional)
 
+- [tulir/mautrix-signal](https://mau.dev/tulir/mautrix-signal/container_registry) - the [mautrix-signal](https://github.com/tulir/mautrix-signal) bridge to [Signal](https://www.signal.org/) (optional)
+
 - [matrixdotorg/matrix-appservice-irc](https://hub.docker.com/r/matrixdotorg/matrix-appservice-irc) - the [matrix-appservice-irc](https://github.com/matrix-org/matrix-appservice-irc) bridge to [IRC](https://wikipedia.org/wiki/Internet_Relay_Chat) (optional)
 
 - [halfshot/matrix-appservice-discord](https://hub.docker.com/r/halfshot/matrix-appservice-discord) - the [matrix-appservice-discord](https://github.com/Half-Shot/matrix-appservice-discord) bridge to [Discord](https://discordapp.com/) (optional)
diff --git a/docs/configuring-playbook-bridge-mautrix-signal.md b/docs/configuring-playbook-bridge-mautrix-signal.md
index a5410665a..cc6541b57 100644
--- a/docs/configuring-playbook-bridge-mautrix-signal.md
+++ b/docs/configuring-playbook-bridge-mautrix-signal.md
@@ -4,6 +4,8 @@ The playbook can install and configure [mautrix-signal](https://github.com/tulir
 
 See the project's [documentation](https://github.com/tulir/mautrix-signal/wiki) to learn what it does and why it might be useful to you.
 
+**Note/Prerequisite**: If you're running with the Postgres database server integrated by the playbook (which is the default), you don't need to do anything special and can easily proceed with installing. However, if you're [using an external Postgres server](configuring-playbook-external-postgres.md), you'd need to manually prepare a Postgres database for this bridge and adjust the variables related to that (`matrix_mautrix_signal_database_*`).
+
 Use the following playbook configuration:
 
 ```yaml

From da2a6682b39699d0e572a2fd5bcf0350844cd22b Mon Sep 17 00:00:00 2001
From: Slavi Pantaleev <slavi@devture.com>
Date: Sun, 3 Jan 2021 08:06:32 +0200
Subject: [PATCH 20/22] Get rid of
 matrix_mautrix_signal_configuration_permissions

While it's kind of nice having it, it's also somewhat raw
and unnecessary.

Having a good default and not even mentioning it seems better
for most users.

People who need a more exposed bridge (rare) can use
override the default configuration using
`matrix_mautrix_signal_configuration_extension_yaml`.
---
 ...nfiguring-playbook-bridge-mautrix-signal.md | 18 ------------------
 .../defaults/main.yml                          |  9 ---------
 .../tasks/validate_config.yml                  |  1 +
 .../templates/config.yaml.j2                   |  3 ++-
 4 files changed, 3 insertions(+), 28 deletions(-)

diff --git a/docs/configuring-playbook-bridge-mautrix-signal.md b/docs/configuring-playbook-bridge-mautrix-signal.md
index cc6541b57..164b06de8 100644
--- a/docs/configuring-playbook-bridge-mautrix-signal.md
+++ b/docs/configuring-playbook-bridge-mautrix-signal.md
@@ -12,24 +12,6 @@ Use the following playbook configuration:
 matrix_mautrix_signal_enabled: true
 ```
 
-To specify which users have access to the bridge, use the variable `matrix_mautrix_signal_configuration_permissions`.
-Refer to the documentation for
-```yaml
-bridge:
-  permissions:
-```
-in [the example config in mautrix-signal](https://github.com/tulir/mautrix-signal/blob/master/mautrix_signal/example-config.yaml).
-For instance, use
-```yaml
-matrix_mautrix_signal_configuration_permissions: |
-  {
-    '{{ matrix_domain }}': 'user'
-  }
-```
-to allow all users registered to the current host's matrix domain access to the bridge, or hard-code whatever you like.
-(See [this issue](https://github.com/ansible/ansible/issues/17324#issuecomment-449642731) on how to use variable names as dictionary keys.)
-
-
 ## Set up Double Puppeting
 
 If you'd like to use [Double Puppeting](https://github.com/tulir/mautrix-whatsapp/wiki/Authentication#replacing-whatsapp-accounts-matrix-puppet-with-matrix-account) (hint: you most likely do), you have 2 ways of going about it.
diff --git a/roles/matrix-bridge-mautrix-signal/defaults/main.yml b/roles/matrix-bridge-mautrix-signal/defaults/main.yml
index d46c2c500..d15ba6e3d 100644
--- a/roles/matrix-bridge-mautrix-signal/defaults/main.yml
+++ b/roles/matrix-bridge-mautrix-signal/defaults/main.yml
@@ -67,15 +67,6 @@ matrix_mautrix_signal_login_shared_secret: ''
 # or completely replace this variable with your own template.
 matrix_mautrix_signal_configuration_yaml: "{{ lookup('template', 'templates/config.yaml.j2') }}"
 
-# Permitted values:
-#       user - Use the bridge with puppeting.
-#      admin - Use and administrate the bridge.
-# Permitted keys:
-#        * - All Matrix users
-#   domain - All users on that homeserver
-#     mxid - Specific user
-matrix_mautrix_signal_configuration_permissions: {}
-
 matrix_mautrix_signal_configuration_extension_yaml: |
   # Your custom YAML configuration goes here.
   # This configuration extends the default starting configuration (`matrix_mautrix_signal_configuration_yaml`).
diff --git a/roles/matrix-bridge-mautrix-signal/tasks/validate_config.yml b/roles/matrix-bridge-mautrix-signal/tasks/validate_config.yml
index 397ef4d87..100af3f87 100644
--- a/roles/matrix-bridge-mautrix-signal/tasks/validate_config.yml
+++ b/roles/matrix-bridge-mautrix-signal/tasks/validate_config.yml
@@ -25,3 +25,4 @@
     - {'old': 'matrix_mautrix_signal_db_host', 'new': 'matrix_mautrix_signal_database_hostname'}
     - {'old': 'matrix_mautrix_signal_db_port', 'new': 'matrix_mautrix_signal_database_port'}
     - {'old': 'matrix_mautrix_signal_db_url', 'new': 'matrix_mautrix_signal_database_connection_string'}
+    - {'old': 'matrix_mautrix_signal_configuration_permissions', 'new': '<superseded by matrix_mautrix_signal_configuration_extension_yaml>'}
diff --git a/roles/matrix-bridge-mautrix-signal/templates/config.yaml.j2 b/roles/matrix-bridge-mautrix-signal/templates/config.yaml.j2
index 4335b023a..68ed1d6d6 100644
--- a/roles/matrix-bridge-mautrix-signal/templates/config.yaml.j2
+++ b/roles/matrix-bridge-mautrix-signal/templates/config.yaml.j2
@@ -172,7 +172,8 @@ bridge:
     #        * - All Matrix users
     #   domain - All users on that homeserver
     #     mxid - Specific user
-    permissions: {{ matrix_mautrix_signal_configuration_permissions }} 
+    permissions:
+      '{{ matrix_mautrix_signal_homeserver_domain }}': user
 
 
 # Python logging configuration.

From 274f23f66868b72eea753569ee31c6374a4c7686 Mon Sep 17 00:00:00 2001
From: Slavi Pantaleev <slavi@devture.com>
Date: Sun, 3 Jan 2021 08:16:49 +0200
Subject: [PATCH 21/22] Make matrix-mautrix-signal-daemon.service depend on
 docker.service

---
 roles/matrix-bridge-mautrix-signal/defaults/main.yml     | 6 ++++++
 .../systemd/matrix-mautrix-signal-daemon.service.j2      | 9 +++++++++
 2 files changed, 15 insertions(+)

diff --git a/roles/matrix-bridge-mautrix-signal/defaults/main.yml b/roles/matrix-bridge-mautrix-signal/defaults/main.yml
index d15ba6e3d..962140c90 100644
--- a/roles/matrix-bridge-mautrix-signal/defaults/main.yml
+++ b/roles/matrix-bridge-mautrix-signal/defaults/main.yml
@@ -34,6 +34,12 @@ matrix_mautrix_signal_systemd_required_services_list:
 # List of systemd services that matrix-mautrix-signal.service wants
 matrix_mautrix_signal_systemd_wanted_services_list: []
 
+# List of systemd services that matrix-mautrix-signal-daemon.service depends on.
+matrix_mautrix_signal_daemon_systemd_required_services_list: ['docker.service']
+
+# List of systemd services that matrix-mautrix-signal-daemon.service wants
+matrix_mautrix_signal_daemon_systemd_wanted_services_list: []
+
 matrix_mautrix_signal_appservice_token: ''
 matrix_mautrix_signal_homeserver_token: ''
 
diff --git a/roles/matrix-bridge-mautrix-signal/templates/systemd/matrix-mautrix-signal-daemon.service.j2 b/roles/matrix-bridge-mautrix-signal/templates/systemd/matrix-mautrix-signal-daemon.service.j2
index 499ee3096..d89529924 100644
--- a/roles/matrix-bridge-mautrix-signal/templates/systemd/matrix-mautrix-signal-daemon.service.j2
+++ b/roles/matrix-bridge-mautrix-signal/templates/systemd/matrix-mautrix-signal-daemon.service.j2
@@ -2,6 +2,15 @@
 [Unit]
 Description=Matrix Mautrix Signal daemon
 
+{% for service in matrix_mautrix_signal_daemon_systemd_required_services_list %}
+Requires={{ service }}
+After={{ service }}
+{% endfor %}
+
+{% for service in matrix_mautrix_signal_daemon_systemd_wanted_services_list %}
+Wants={{ service }}
+{% endfor %}
+
 [Service]
 Type=simple
 

From 3b524ee815c5123a9d15f5bf8478bc40b705d80a Mon Sep 17 00:00:00 2001
From: Slavi Pantaleev <slavi@devture.com>
Date: Sun, 3 Jan 2021 08:20:43 +0200
Subject: [PATCH 22/22] Make mautrix-signal bridge not log to files

We try to only use console logging (going to journald) for everything,
instead of logging things twice (or more).
---
 .../matrix-bridge-mautrix-signal/templates/config.yaml.j2 | 8 +-------
 1 file changed, 1 insertion(+), 7 deletions(-)

diff --git a/roles/matrix-bridge-mautrix-signal/templates/config.yaml.j2 b/roles/matrix-bridge-mautrix-signal/templates/config.yaml.j2
index 68ed1d6d6..28fff6f02 100644
--- a/roles/matrix-bridge-mautrix-signal/templates/config.yaml.j2
+++ b/roles/matrix-bridge-mautrix-signal/templates/config.yaml.j2
@@ -189,12 +189,6 @@ logging:
         normal:
             format: "[%(asctime)s] [%(levelname)s@%(name)s] %(message)s"
     handlers:
-        file:
-            class: logging.handlers.RotatingFileHandler
-            formatter: normal
-            filename: ./mautrix-signal.log
-            maxBytes: 10485760
-            backupCount: 10
         console:
             class: logging.StreamHandler
             formatter: colored
@@ -205,4 +199,4 @@ logging:
             level: INFO
     root:
         level: {{ matrix_mautrix_signal_log_level }}
-        handlers: [file, console]
+        handlers: [console]