matrix: add Telegram bridge appservice.
Configuring this one is a bit different from appservice-irc. Notably,
there's no way to give it a registration.yaml to overlay on top of a
config, se we end up using an init container with yq to do that for us.
Also, I had to manually copy the regsitration.yaml in synapse, from
/appservices/telegram-prod/registration.yaml to
/data/appservices/telegram-prod.jsonnet, in order to make it work with
the synapse docker start magic. :/
Otherwise, this is deployed and seems to be working.
Change-Id: Id747a0e310221855556c1d280439376f0c4e5ed6
diff --git a/app/matrix/appservice-telegram.libsonnet b/app/matrix/appservice-telegram.libsonnet
new file mode 100644
index 0000000..b174225
--- /dev/null
+++ b/app/matrix/appservice-telegram.libsonnet
@@ -0,0 +1,157 @@
+local kube = import "../../kube/kube.libsonnet";
+
+{
+ AppServiceTelegram(name):: {
+ local bridge = self,
+ local cfg = bridge.cfg,
+ cfg:: {
+ metadata: {},
+ image: error "image must be set",
+ storageClassName: error "storageClassName must be set",
+
+ // Data that will be serialized into the appservice's config.yaml.
+ // This is taken straight from a YAML that was generated by
+ // dock.mau.dev/tulir/mautrix-telegram:v0.8.2. We override here
+ // fields that we know are strictly necessary to be configured when
+ // instantiating this template.
+ config: (std.native("parseYaml")(importstr "appservice-telegram.yaml")[0]) + {
+ homeserver+: {
+ address: error "homeserver.address must be set",
+ domain: error "homeserver.domain must be set",
+ },
+ appservice+: {
+ address: bridge.svc.http_url,
+ // We disable this. I have no idea what it does, but it
+ // wants a secret. ~q3k
+ provisioning+: {
+ enabled: false,
+ shared_secret: if self.enabled then error "appservice.provisioning.shared_secret must be set" else "hackme",
+ },
+ id: error "appservice.id must be set",
+ as_token: "This value is generated when generating the registration",
+ hs_token: "This value is generated when generating the registration",
+ },
+ telegram+: {
+ api_id: error "telegram.api_id must be set",
+ api_hash: error "telegram.api_hash must be set",
+ bot_token: error "telegram.bot_token must be set",
+ },
+ bridge+: {
+ permissions: {
+ '*': "relaybot",
+ },
+ },
+ },
+ },
+
+ config: kube.Secret("appservice-telegram-%s" % [name]) {
+ metadata+: cfg.metadata,
+ data: {
+ "config.yaml": std.base64(std.manifestYamlDoc(cfg.config)),
+ },
+ },
+
+ dataVolume: kube.PersistentVolumeClaim("appservice-telegram-%s" % [name]) {
+ metadata+: cfg.metadata,
+ spec+: {
+ storageClassName: cfg.storageClassName,
+ accessModes: [ "ReadWriteOnce" ],
+ resources: {
+ requests: {
+ storage: "10Gi",
+ },
+ },
+ },
+ },
+
+ bootstrapJob: kube.Job("appservice-telegram-%s-bootstrap" % [name]) {
+ metadata+: cfg.metadata {
+ labels: {
+ "job-name": "appservice-telegram-%s-bootstrap" % [name],
+ },
+ },
+ spec+: {
+ template+: {
+ spec+: {
+ volumes_: {
+ config: kube.SecretVolume(bridge.config),
+ },
+ containers_: {
+ bootstrap: kube.Container("appservice-telegram-%s-bootstrap" % [name]) {
+ image: cfg.image,
+ command: [
+ "sh", "-c",
+ "python3 -m mautrix_telegram -g -c /config/config.yaml -r /tmp/registration.yaml && echo SNIPSNIP && cat /tmp/registration.yaml",
+ ],
+ volumeMounts_: {
+ config: { mountPath: "/config" },
+ },
+ },
+ },
+ },
+ },
+ },
+ },
+
+ deployment: kube.Deployment("appservice-telegram-%s" % [name]) {
+ metadata+: cfg.metadata,
+ spec+: {
+ replicas: 1,
+ template+: {
+ spec+: {
+ volumes_: {
+ config: kube.SecretVolume(bridge.config),
+ data: kube.PersistentVolumeClaimVolume(bridge.dataVolume),
+ registration: { secret: { secretName: "appservice-telegram-%s-registration" % [name] } },
+ },
+ initContainers: [
+ // This container takes the stateless config from the Secret, and
+ // updates it with the registration secrets from the registration token.
+ kube.Container("generate-config") {
+ volumeMounts_: {
+ config: { mountPath: "/config", },
+ registration: { mountPath: "/registration", },
+ data: { mountPath: "/data" },
+ },
+ // Ow, the edge! We need yq.
+ // See: https://github.com/mikefarah/yq/issues/190#issuecomment-667519015
+ image: "alpine@sha256:156f59dc1cbe233827642e09ed06e259ef6fa1ca9b2e29d52ae14d5e7b79d7f0",
+ command: [
+ "sh", "-c", |||
+ set -e -x
+ apk add --no-cache yq
+ cp /config/config.yaml /data/config.yaml
+ yq w -i /data/config.yaml appservice.as_token $(yq r /registration/registration.yaml as_token)
+ yq w -i /data/config.yaml appservice.hs_token $(yq r /registration/registration.yaml hs_token)
+ |||
+ ],
+ },
+ ],
+ containers_: {
+ appserviceIrc: kube.Container("appservice-telegram-%s" % [name]) {
+ image: cfg.image,
+ command: [
+ "sh", "-c", |||
+ alembic -x config=/data/config.yaml upgrade head
+ python3 -m mautrix_telegram -n -c /data/config.yaml
+ |||
+ ],
+ ports_: {
+ http: { containerPort: 29317 },
+ },
+ volumeMounts_: {
+ data: { mountPath: "/data" },
+ },
+ },
+ },
+ },
+ },
+ },
+ },
+
+ svc: kube.Service("appservice-telegram-%s" % [name]) {
+ metadata+: cfg.metadata,
+ target_pod:: bridge.deployment.spec.template,
+ },
+ },
+}
diff --git a/app/matrix/appservice-telegram.yaml b/app/matrix/appservice-telegram.yaml
new file mode 100644
index 0000000..28880af
--- /dev/null
+++ b/app/matrix/appservice-telegram.yaml
@@ -0,0 +1,443 @@
+# Homeserver details
+homeserver:
+ # The address that this appservice can use to connect to the homeserver.
+ address: https://example.com
+ # The domain of the homeserver (for MXIDs, etc).
+ domain: example.com
+ # Whether or not to verify the SSL certificate of the homeserver.
+ # Only applies if address starts with https://
+ verify_ssl: true
+
+# Application service host/registration related details
+# Changing these values requires regeneration of the registration.
+appservice:
+ # The address that the homeserver can use to connect to this appservice.
+ address: http://localhost:29317
+ # When using https:// the TLS certificate and key files for the address.
+ tls_cert: false
+ tls_key: false
+
+ # The hostname and port where this appservice should listen.
+ hostname: 0.0.0.0
+ port: 29317
+ # The maximum body size of appservice API requests (from the homeserver) in mebibytes
+ # Usually 1 is enough, but on high-traffic bridges you might need to increase this to avoid 413s
+ max_body_size: 1
+
+ # The full URI to the database. SQLite and Postgres are fully supported.
+ # Other DBMSes supported by SQLAlchemy may or may not work.
+ # Format examples:
+ # SQLite: sqlite:///filename.db
+ # Postgres: postgres://username:password@hostname/dbname
+ database: sqlite:////data/mautrix-telegram.db
+
+ # Public part of web server for out-of-Matrix interaction with the bridge.
+ # Used for things like login if the user wants to make sure the 2FA password isn't stored in
+ # the HS database.
+ public:
+ # Whether or not the public-facing endpoints should be enabled.
+ enabled: false
+ # The prefix to use in the public-facing endpoints.
+ prefix: /public
+ # The base URL where the public-facing endpoints are available. The prefix is not added
+ # implicitly.
+ external: https://example.com/public
+
+ # Provisioning API part of the web server for automated portal creation and fetching information.
+ # Used by things like Dimension (https://dimension.t2bot.io/).
+ provisioning:
+ # Whether or not the provisioning API should be enabled.
+ enabled: true
+ # The prefix to use in the provisioning API endpoints.
+ prefix: /_matrix/provision/v1
+ # The shared secret to authorize users of the API.
+ # Set to "generate" to generate and save a new token.
+ shared_secret: hackmehackmehackme
+
+ # The unique ID of this appservice.
+ id: telegram
+ # Username of the appservice bot.
+ bot_username: telegrambot
+ # Display name and avatar for bot. Set to "remove" to remove display name/avatar, leave empty
+ # to leave display name/avatar as-is.
+ bot_displayname: Telegram bridge bot
+ bot_avatar: mxc://maunium.net/tJCRmUyJDsgRNgqhOgoiHWbX
+
+ # Community ID for bridged users (changes registration file) and rooms.
+ # Must be created manually.
+ #
+ # Example: "+telegram:example.com". Set to false to disable.
+ community_id: false
+
+ # Authentication tokens for AS <-> HS communication. Autogenerated; do not modify.
+ as_token: This value is generated when generating the registration
+ hs_token: This value is generated when generating the registration
+
+# Prometheus telemetry config. Requires prometheus-client to be installed.
+metrics:
+ enabled: false
+ listen_port: 8000
+
+# Manhole config.
+manhole:
+ # Whether or not opening the manhole is allowed.
+ enabled: false
+ # The path for the unix socket.
+ path: /var/tmp/mautrix-telegram.manhole
+ # The list of UIDs who can be added to the whitelist.
+ # If empty, any UIDs can be specified in the open-manhole command.
+ whitelist:
+ - 0
+
+# Bridge config
+bridge:
+ # Localpart template of MXIDs for Telegram users.
+ # {userid} is replaced with the user ID of the Telegram user.
+ username_template: telegram_{userid}
+ # Localpart template of room aliases for Telegram portal rooms.
+ # {groupname} is replaced with the name part of the public channel/group invite link ( https://t.me/{} )
+ alias_template: telegram_{groupname}
+ # Displayname template for Telegram users.
+ # {displayname} is replaced with the display name of the Telegram user.
+ displayname_template: '{displayname} (Telegram)'
+
+ # Set the preferred order of user identifiers which to use in the Matrix puppet display name.
+ # In the (hopefully unlikely) scenario that none of the given keys are found, the numeric user
+ # ID is used.
+ #
+ # If the bridge is working properly, a phone number or an username should always be known, but
+ # the other one can very well be empty.
+ #
+ # Valid keys:
+ # "full name" (First and/or last name)
+ # "full name reversed" (Last and/or first name)
+ # "first name"
+ # "last name"
+ # "username"
+ # "phone number"
+ displayname_preference:
+ - full name
+ - username
+ - phone number
+ # Maximum length of displayname
+ displayname_max_length: 100
+ # Remove avatars from Telegram ghost users when removed on Telegram. This is disabled by default
+ # as there's no way to determine whether an avatar is removed or just hidden from some users. If
+ # you're on a single-user instance, this should be safe to enable.
+ allow_avatar_remove: false
+
+ # Maximum number of members to sync per portal when starting up. Other members will be
+ # synced when they send messages. The maximum is 10000, after which the Telegram server
+ # will not send any more members.
+ # Defaults to no local limit (-> limited to 10000 by server)
+ max_initial_member_sync: 100
+ # Whether or not to sync the member list in channels.
+ # If no channel admins have logged into the bridge, the bridge won't be able to sync the member
+ # list regardless of this setting.
+ sync_channel_members: true
+ # Whether or not to skip deleted members when syncing members.
+ skip_deleted_members: true
+ # Whether or not to automatically synchronize contacts and chats of Matrix users logged into
+ # their Telegram account at startup.
+ startup_sync: true
+ # Number of most recently active dialogs to check when syncing chats.
+ # Set to 0 to remove limit.
+ sync_dialog_limit: 30
+ # Whether or not to sync and create portals for direct chats at startup.
+ sync_direct_chats: false
+ # The maximum number of simultaneous Telegram deletions to handle.
+ # A large number of simultaneous redactions could put strain on your homeserver.
+ max_telegram_delete: 10
+ # Whether or not to automatically sync the Matrix room state (mostly unpuppeted displaynames)
+ # at startup and when creating a bridge.
+ sync_matrix_state: true
+ # Allow logging in within Matrix. If false, the only way to log in is using the out-of-Matrix
+ # login website (see appservice.public config section)
+ allow_matrix_login: true
+ # Whether or not to bridge plaintext highlights.
+ # Only enable this if your displayname_template has some static part that the bridge can use to
+ # reliably identify what is a plaintext highlight.
+ plaintext_highlights: false
+ # Whether or not to make portals of publicly joinable channels/supergroups publicly joinable on Matrix.
+ public_portals: true
+ # Whether or not to use /sync to get presence, read receipts and typing notifications when using
+ # your own Matrix account as the Matrix puppet for your Telegram account.
+ sync_with_custom_puppets: true
+ # Shared secret for https://github.com/devture/matrix-synapse-shared-secret-auth
+ #
+ # If set, custom puppets will be enabled automatically for local users
+ # instead of users having to find an access token and run `login-matrix`
+ # manually.
+ login_shared_secret:
+ # Set to false to disable link previews in messages sent to Telegram.
+ telegram_link_preview: true
+ # Use inline images instead of a separate message for the caption.
+ # N.B. Inline images are not supported on all clients (e.g. Riot iOS).
+ inline_images: false
+ # Maximum size of image in megabytes before sending to Telegram as a document.
+ image_as_file_size: 10
+ # Maximum size of Telegram documents in megabytes to bridge.
+ max_document_size: 100
+ # Enable experimental parallel file transfer, which makes uploads/downloads much faster by
+ # streaming from/to Matrix and using many connections for Telegram.
+ # Note that generating HQ thumbnails for videos is not possible with streamed transfers.
+ parallel_file_transfer: false
+ # Whether or not created rooms should have federation enabled.
+ # If false, created portal rooms will never be federated.
+ federate_rooms: true
+ # Settings for converting animated stickers.
+ animated_sticker:
+ # Format to which animated stickers should be converted.
+ # disable - No conversion, send as-is (gzipped lottie)
+ # png - converts to non-animated png (fastest),
+ # gif - converts to animated gif, but loses transparency
+ # webm - converts to webm video, requires ffmpeg executable with vp9 codec and webm container support
+ target: gif
+ # Arguments for converter. All converters take width and height.
+ # GIF converter takes background as a hex color.
+ args:
+ width: 256
+ height: 256
+ background: '020202' # only for gif
+ fps: 30 # only for webm
+ # End-to-bridge encryption support options. These require matrix-nio to be installed with pip
+ # and login_shared_secret to be configured in order to get a device for the bridge bot.
+ #
+ # Additionally, https://github.com/matrix-org/synapse/pull/5758 is required if using a normal
+ # application service.
+ encryption:
+ # Allow encryption, work in group chat rooms with e2ee enabled
+ allow: false
+ # Default to encryption, force-enable encryption in all portals the bridge creates
+ # This will cause the bridge bot to be in private chats for the encryption to work properly.
+ default: false
+ # Whether or not to explicitly set the avatar and room name for private
+ # chat portal rooms. This will be implicitly enabled if encryption.default is true.
+ private_chat_portal_meta: false
+ # Whether or not the bridge should send a read receipt from the bridge bot when a message has
+ # been sent to Telegram.
+ delivery_receipts: false
+ # Whether or not delivery errors should be reported as messages in the Matrix room.
+ delivery_error_reports: false
+
+ # Overrides for base power levels.
+ initial_power_level_overrides:
+ user: {}
+ group: {}
+
+ # Whether to bridge Telegram bot messages as m.notices or m.texts.
+ bot_messages_as_notices: true
+ bridge_notices:
+ # Whether or not Matrix bot messages (type m.notice) should be bridged.
+ default: false
+ # List of user IDs for whom the previous flag is flipped.
+ # e.g. if bridge_notices.default is false, notices from other users will not be bridged, but
+ # notices from users listed here will be bridged.
+ exceptions:
+ - '@importantbot:example.com'
+
+ # Some config options related to Telegram message deduplication.
+ # The default values are usually fine, but some debug messages/warnings might recommend you
+ # change these.
+ deduplication:
+ # Whether or not to check the database if the message about to be sent is a duplicate.
+ pre_db_check: false
+ # The number of latest events to keep when checking for duplicates.
+ # You might need to increase this on high-traffic bridge instances.
+ cache_queue_length: 20
+
+ # The formats to use when sending messages to Telegram via the relay bot.
+ # Text msgtypes (m.text, m.notice and m.emote) support HTML, media msgtypes don't.
+ #
+ # Available variables:
+ # $sender_displayname - The display name of the sender (e.g. Example User)
+ # $sender_username - The username (Matrix ID localpart) of the sender (e.g. exampleuser)
+ # $sender_mxid - The Matrix ID of the sender (e.g. @exampleuser:example.com)
+ # $message - The message content
+ message_formats:
+ m.text: '<b>$sender_displayname</b>: $message'
+ m.notice: '<b>$sender_displayname</b>: $message'
+ m.emote: '* <b>$sender_displayname</b> $message'
+ m.file: '<b>$sender_displayname</b> sent a file: $message'
+ m.image: '<b>$sender_displayname</b> sent an image: $message'
+ m.audio: '<b>$sender_displayname</b> sent an audio file: $message'
+ m.video: '<b>$sender_displayname</b> sent a video: $message'
+ m.location: '<b>$sender_displayname</b> sent a location: $message'
+ # Telegram doesn't have built-in emotes, this field specifies how m.emote's from authenticated
+ # users are sent to telegram. All fields in message_formats are supported. Additionally, the
+ # Telegram user info is available in the following variables:
+ # $displayname - Telegram displayname
+ # $username - Telegram username (may not exist)
+ # $mention - Telegram @username or displayname mention (depending on which exists)
+ emote_format: '* $mention $formatted_body'
+
+ # The formats to use when sending state events to Telegram via the relay bot.
+ #
+ # Variables from `message_formats` that have the `sender_` prefix are available without the prefix.
+ # In name_change events, `$prev_displayname` is the previous displayname.
+ #
+ # Set format to an empty string to disable the messages for that event.
+ state_event_formats:
+ join: <b>$displayname</b> joined the room.
+ leave: <b>$displayname</b> left the room.
+ name_change: <b>$prev_displayname</b> changed their name to <b>$displayname</b>
+
+ # Filter rooms that can/can't be bridged. Can also be managed using the `filter` and
+ # `filter-mode` management commands.
+ #
+ # Filters do not affect direct chats.
+ # An empty blacklist will essentially disable the filter.
+ filter:
+ # Filter mode to use. Either "blacklist" or "whitelist".
+ # If the mode is "blacklist", the listed chats will never be bridged.
+ # If the mode is "whitelist", only the listed chats can be bridged.
+ mode: blacklist
+ # The list of group/channel IDs to filter.
+ list: []
+
+ # The prefix for commands. Only required in non-management rooms.
+ command_prefix: '!tg'
+
+ # Permissions for using the bridge.
+ # Permitted values:
+ # relaybot - Only use the bridge via the relaybot, no access to commands.
+ # user - Relaybot level + access to commands to create bridges.
+ # puppeting - User level + logging in with a Telegram account.
+ # full - Full access to use the bridge, i.e. previous levels + Matrix login.
+ # admin - Full access to use the bridge and some extra administration commands.
+ # Permitted keys:
+ # * - All Matrix users
+ # domain - All users on that homeserver
+ # mxid - Specific user
+ permissions:
+ '*': relaybot
+ public.example.com: user
+ example.com: full
+ '@admin:example.com': admin
+ relaybot:
+ private_chat:
+ # List of users to invite to the portal when someone starts a private chat with the bot.
+ # If empty, private chats with the bot won't create a portal.
+ invite: []
+ # Whether or not to bridge state change messages in relaybot private chats.
+ state_changes: true
+ # When private_chat_invite is empty, this message is sent to users /starting the
+ # relaybot. Telegram's "markdown" is supported.
+ message: This is a Matrix bridge relaybot and does not support direct chats
+ # List of users to invite to all group chat portals created by the bridge.
+ group_chat_invite: []
+ # Whether or not the relaybot should not bridge events in unbridged group chats.
+ # If false, portals will be created when the relaybot receives messages, just like normal
+ # users. This behavior is usually not desirable, as it interferes with manually bridging
+ # the chat to another room.
+ ignore_unbridged_group_chat: true
+ # Whether or not to allow creating portals from Telegram.
+ authless_portals: true
+ # Whether or not to allow Telegram group admins to use the bot commands.
+ whitelist_group_admins: true
+ # Whether or not to ignore incoming events sent by the relay bot.
+ ignore_own_incoming_events: true
+ # List of usernames/user IDs who are also allowed to use the bot commands.
+ whitelist:
+ - myusername
+ - 12345678
+
+# Telegram config
+telegram:
+ # Get your own API keys at https://my.telegram.org/apps
+ api_id: 12345
+ api_hash: tjyd5yge35lbodk1xwzw2jstp90k55qz
+ # (Optional) Create your own bot at https://t.me/BotFather
+ bot_token: disabled
+
+ # Telethon connection options.
+ connection:
+ # The timeout in seconds to be used when connecting.
+ timeout: 120
+ # How many times the reconnection should retry, either on the initial connection or when
+ # Telegram disconnects us. May be set to a negative or null value for infinite retries, but
+ # this is not recommended, since the program can get stuck in an infinite loop.
+ retries: 5
+ # The delay in seconds to sleep between automatic reconnections.
+ retry_delay: 1
+ # The threshold below which the library should automatically sleep on flood wait errors
+ # (inclusive). For instance, if a FloodWaitError for 17s occurs and flood_sleep_threshold
+ # is 20s, the library will sleep automatically. If the error was for 21s, it would raise
+ # the error instead. Values larger than a day (86400) will be changed to a day.
+ flood_sleep_threshold: 60
+ # How many times a request should be retried. Request are retried when Telegram is having
+ # internal issues, when there is a FloodWaitError less than flood_sleep_threshold, or when
+ # there's a migrate error. May take a negative or null value for infinite retries, but this
+ # is not recommended, since some requests can always trigger a call fail (such as searching
+ # for messages).
+ request_retries: 5
+
+ # Device info sent to Telegram.
+ device_info:
+ # "auto" = OS name+version.
+ device_model: auto
+ # "auto" = Telethon version.
+ system_version: auto
+ # "auto" = mautrix-telegram version.
+ app_version: auto
+ lang_code: en
+ system_lang_code: en
+
+ # Custom server to connect to.
+ server:
+ # Set to true to use these server settings. If false, will automatically
+ # use production server assigned by Telegram. Set to false in production.
+ enabled: false
+ # The DC ID to connect to.
+ dc: 2
+ # The IP to connect to.
+ ip: 149.154.167.40
+ # The port to connect to. 443 may not work, 80 is better and both are equally secure.
+ port: 80
+
+ # Telethon proxy configuration.
+ # You must install PySocks from pip for proxies to work.
+ proxy:
+ # Allowed types: disabled, socks4, socks5, http, mtproxy
+ type: disabled
+ # Proxy IP address and port.
+ address: 127.0.0.1
+ port: 1080
+ # Whether or not to perform DNS resolving remotely. Only for socks/http proxies.
+ rdns: true
+ # Proxy authentication (optional). Put MTProxy secret in password field.
+ username: ''
+ password: ''
+
+# Python logging configuration.
+#
+# See section 16.7.2 of the Python documentation for more info:
+# https://docs.python.org/3.6/library/logging.config.html#configuration-dictionary-schema
+logging:
+ version: 1
+ formatters:
+ colored:
+ (): mautrix_telegram.util.ColorFormatter
+ format: '[%(asctime)s] [%(levelname)s@%(name)s] %(message)s'
+ normal:
+ format: '[%(asctime)s] [%(levelname)s@%(name)s] %(message)s'
+ handlers:
+ file:
+ class: logging.handlers.RotatingFileHandler
+ formatter: normal
+ filename: ./mautrix-telegram.log
+ maxBytes: 10485760
+ backupCount: 10
+ console:
+ class: logging.StreamHandler
+ formatter: colored
+ loggers:
+ mau:
+ level: DEBUG
+ telethon:
+ level: INFO
+ aiohttp:
+ level: INFO
+ root:
+ level: DEBUG
+ handlers: [file, console]
diff --git a/app/matrix/prod.jsonnet b/app/matrix/prod.jsonnet
index cf68738..66be5ea 100644
--- a/app/matrix/prod.jsonnet
+++ b/app/matrix/prod.jsonnet
@@ -2,12 +2,25 @@
# This needs a secret provisioned, create with:
# kubectl -n matrix create secret generic synapse --from-literal=postgres_password=$(pwgen 24 1) --from-literal=macaroon_secret_key=$(pwgen 32 1) --from-literal=registration_shared_secret=$(pwgen 32 1)
# kubectl -n matrix create secret generic oauth2-cas-proxy --from-literal=oauth2_secret=...
+#
+# Sequencing appservices is fun. The appservice needs to run first (for
+# instance, via a bootstrap job), and on startup it will spit out a
+# registration file. This registration file then needs to be fed to synapse -
+# this is done via specialy named secrets (appservice-X-registration, for X key
+# in the appservices object).
+#
+# For appservice-irc instances, you can use this oneliner magic to get the
+# registration YAML from logs.
# kubectl -n matrix create secret generic appservice-irc-freenode-registration --from-file=registration.yaml=<(kubectl logs -n matrix $(kubectl get pods -n matrix --selector=job-name=appservice-irc-freenode-bootstrap --output=jsonpath='{.items[*].metadata.name}') | tail -n +4 | sed -r 's/(.*aliases:.*)/ group_id: "+freenode:hackerspace.pl"\n\1/')
+#
+# For appservice-telegram instances, you can use this oneliner magic:
+# kubectl -n matrix create secret generic appservice-telegram-prod-registration --from-file=registration.yaml=<(kubectl -n matrix logs job/appservice-telegram-prod-bootstrap | grep -A 100 SNIPSNIP | grep -v SNIPSNIP)
local kube = import "../../kube/kube.libsonnet";
local postgres = import "../../kube/postgres.libsonnet";
local irc = import "appservice-irc.libsonnet";
+local telegram = import "appservice-telegram.libsonnet";
{
local app = self,
@@ -16,13 +29,14 @@
namespace: "matrix",
domain: "matrix.hackerspace.pl",
serverName: "hackerspace.pl",
- storageClassName: "waw-hdd-paranoid-2",
- storageClassName3: "waw-hdd-redundant-3",
+ storageClassName: "waw-hdd-redundant-3",
synapseImage: "matrixdotorg/synapse:v1.17.0",
riotImage: "vectorim/riot-web:v1.7.1",
casProxyImage: "registry.k0.hswaw.net/q3k/oauth2-cas-proxy:0.1.4",
appserviceIRCImage: "matrixdotorg/matrix-appservice-irc:release-0.17.1",
+ # That's v0.8.2 - we just don't trust that host to not re-tag images.
+ appserviceTelegramImage: "dock.mau.dev/tulir/mautrix-telegram@sha256:9e68eaa80c9e4a75d9a09ec92dc4898b12d48390e01efa4de40ce882a6f7e330"
},
metadata(component):: {
@@ -44,7 +58,7 @@
username: "synapse",
prefix: "waw3-",
password: { secretKeyRef: { name: "synapse", key: "postgres_password" } },
- storageClassName: cfg.storageClassName3,
+ storageClassName: cfg.storageClassName,
storageSize: "100Gi",
},
},
@@ -52,7 +66,7 @@
dataVolume: kube.PersistentVolumeClaim("synapse-data-waw3") {
metadata+: app.metadata("synapse-data"),
spec+: {
- storageClassName: cfg.storageClassName3,
+ storageClassName: cfg.storageClassName,
accessModes: [ "ReadWriteOnce" ],
resources: {
requests: {
@@ -223,11 +237,18 @@
target_pod:: app.riotDeployment.spec.template,
},
+ // Any appservice you add here will require an appservice-X-registration
+ // secret containing a registration.yaml file. Adding something to this
+ // dictionary will cause Synapse to not start until that secret is
+ // available - so change things carefully!
+ // If bootstrapping a new appservice, just keep it out of this dictionary
+ // until it spits you a registration YAML and you feed that to a secret.
appservices: {
"irc-freenode": irc.AppServiceIrc("freenode") {
cfg+: {
image: cfg.appserviceIRCImage,
- storageClassName: cfg.storageClassName,
+ // TODO(q3k): move this appservice to waw-hdd-redundant-3
+ storageClassName: "waw-hdd-paranoid-2",
metadata: app.metadata("appservice-irc-freenode"),
// TODO(q3k): add labels to blessed nodes
nodeSelector: {
@@ -250,6 +271,34 @@
},
},
},
+ "telegram-prod": telegram.AppServiceTelegram("prod") {
+ cfg+: {
+ image: cfg.appserviceTelegramImage,
+ storageClassName: cfg.storageClassName,
+ metadata: app.metadata("appservice-telegram-prod"),
+
+ config+: {
+ homeserver+: {
+ address: "https://%s" % [cfg.domain],
+ domain: cfg.serverName,
+ },
+ appservice+: {
+ id: "telegram",
+ },
+ telegram+: {
+ api_id: (std.split(importstr "secrets/plain/appservice-telegram-prod-api-id", "\n"))[0],
+ api_hash: (std.split(importstr "secrets/plain/appservice-telegram-prod-api-hash", "\n"))[0],
+ bot_token: (std.split(importstr "secrets/plain/appservice-telegram-prod-token", "\n"))[0],
+ },
+ bridge+: {
+ permissions+: {
+ "hackerspace.pl": "puppeting",
+ "@q3k:hackerspace.pl": "admin",
+ },
+ },
+ },
+ },
+ },
},
ingress: kube.Ingress("matrix") {
diff --git a/app/matrix/secrets/cipher/appservice-telegram-prod-api-hash b/app/matrix/secrets/cipher/appservice-telegram-prod-api-hash
new file mode 100644
index 0000000..6328ef9
--- /dev/null
+++ b/app/matrix/secrets/cipher/appservice-telegram-prod-api-hash
@@ -0,0 +1,40 @@
+-----BEGIN PGP MESSAGE-----
+
+hQEMAzhuiT4RC8VbAQf+Mi//T3zuThdW2iv4kCVLTun+jvfVlxj+kAyoRT9GIpYv
+BMLxfYJqHw+helGHJw7bipYQKuHwYKEh25ZTzSXkb8vf1Dinb38Bcxl1u1Mco/rL
++7TjhqL4AB+E7jRbdKq5z/dCWcEUSy1eqTqUPJqPiUMp83gs0je07s0FYAN8Z6aa
+AELVGVpDhazvP3k3XfEGWr7WPZGtqSOP1JqcI3E6eZmwXySG7vWnBYVnd0e94MlF
+gpTRsh4vRQd9mTvsni9KvhrglwBHv0WeXdQyMZlKArCqscHYDyfTgjNrCSkukoN4
+2ldV1mAXzt9uh9FeyX1HAPFX7O73RhgmRi+EGsnZMIUBDANcG2tp6fXqvgEIAJs0
+5TeRQAq5EwFA3zQmzxEQtalaEAMpX5wJTQGCmpNjAwtJWHsQvhAsbolV3UGHAyaF
+QIxQo2kSsMraWQDrFlvVfsZg5qLsP9ktTUfiyqOdnto/5AWp33DFjvL4SWOEGFJR
+grHah+ooDsg+FByZGgaECn9aab/USbUbWBM4pXGPBti3lVRmzKJmc4Xi7ncVi/GK
+Ew3+d3Kj8qmIitSp6TtmKwBLvEO3FpQZanGZ73nLf9dhnuhP0+2Op8gnCQYf0/Aj
+8hu1raaZ0b4Z7CK63PBWgDiDX2pv8iu4wdWmo+qDVJcwroQCfJ7MMDJO2rblDK6c
+8ap2yvvNrPTFFHuNZG2FAgwDodoT8VqRl4UBD/4pz3vCkCH3MiymsRsYj6uVcqWc
+yNTs/Ac3MLWPwNqSRgtKlO9cKdOHMse5/ZFXCmFUKD5HzD7q2uSIQVN4MgQ12adO
+o6P7jBZc50Fs0gEuW0fu0iSpbodpN+7sZl0UVsDUjk0uuiOJ8X5D7GoxTyzgan0b
+TpkELlxfJS+qrxOTuru4ruT62w6pt0LhMrEjiE9YBBsYUHj5LXlvBAJWuTjg4DCo
+RnjaXkzNgMXg9k7gwr/7T0kvgcmoFde2Z5WtpmbZZtddxIl/A1pFBjlC3ShdaK9M
+aLJewD/PpE3prfAvPR1uqsZ4+70ZGaOfONFg6W39W1AezfWcoHOBBzNzFopZeJgi
+3rL5bqKtU2fB/pwTvmua/8b+MJmsDDlxwKhaWyAZyecnW3+UlOFdv/SVgeiyyECY
+TWeILyw7lpLc853Dp3jHiBtmoG5I7NJ3Ra61SJWSuIuKF/un1+205or8cDE6O53Y
+eqmerHuM/9s29b0eGwgSWuR8e/abSEhNIW5jB8koCaWZTZcTYRZWwQIxoMmB0Sge
+lcRaK8Y+D5eNOBlwvkYvOytwji6SPGkGWEcUXPQq7IehDRFadBKyMZV+X/cR25XX
+mReikAg4Ujm7+QLwkFx1UW7oAMTj5MSHLxC5GsZ53tyw1Dfs7bkjiwhggzEq+U6j
+PCourQac30W8NSRL1YUCDAPiA8lOXOuz7wEP/29VkdpnBq0oqCFjY2CGtvUSwNLO
+8DzyLg6nieLviDpji0raFcNysIGidbjeA5DfLjjxKMzuNBKTwhfmbsVe7x27tkr4
+wM+uYzJw0kAMWju8i2CmIEZ0vJrs/TStyGizBGV273jrWJ98vMYcCcyyQ4TvKt7B
+IYEeemsZqci2tk0Gx1ySFI42nw2PGAZKocmGOE0QrQRypuwWQnAFNuIlz4mz+lDx
+HekocBy80N+o6RLzkdrX37ihwkSzHhEn2ouCVr9rPStlIWLjrWYApVmuIwfDzTN0
+RZ4jcBBNJNu4e+Skq7WhlZLKzOVdpL9T/ZZJdollkuDvuRcMZMKSBpN+BYO5qZId
+8eYWf08RULnTwOpph15S136HiY6HfR1yix1MXfMp0tgpjEETb0ZHqYWn5LmLssTz
+piebYuZy8RX7/LeMs6DgXwZvlGLRfumxB3R590AALSJcmR9LoFzETPX7k+zx6wia
+Whh1axlxB6T5ixovsAP9FVgdxAMxNjeZpX3fLV5kwFmNWWPLB461I5JvFcrIyAp4
+j/PPF/8W3eKbjIC99xLxfrKwCPbZ5a6nNfGZF1v5mnltlShTH6B9anVz7Gat6aqD
+jVQuj4ZXetXK+sOXB++X/Wv4Cxtr5O5iMCNcb/XZRwKtM48EAnj7Hi79qoOzuLxp
+wqsyMCRlIwRRPgZO0nsB1IEYcjXuak363TmE+21Zfzroid04n0ACt11gBzHCXnw1
+MBlQTVl4AvZe0jQOWW7+DZFDEENXWQxRIV9nBOe4LR6BvOCHx5f/5skxMlEmawF8
+hruFENYt2FyHl7Y8eSoyERnJWbGLaZUBAZ7pWQm+hrFlwvolo0odipo=
+=A4un
+-----END PGP MESSAGE-----
diff --git a/app/matrix/secrets/cipher/appservice-telegram-prod-api-id b/app/matrix/secrets/cipher/appservice-telegram-prod-api-id
new file mode 100644
index 0000000..45273fd
--- /dev/null
+++ b/app/matrix/secrets/cipher/appservice-telegram-prod-api-id
@@ -0,0 +1,40 @@
+-----BEGIN PGP MESSAGE-----
+
+hQEMAzhuiT4RC8VbAQgAiqMa7pqfKcyQw7p3KPcgI1iGhOsgZyNWymK18ejm5BxV
+zA9lURjn0OMhiOnKg+A9X10S3XcJs2ow3v4nvOwVPDI2dSYMUwnkhKGiI5V+I/qe
+bYXd9xk1LPn3d23LH3U616TLQ0bllv37Fs9rU2o/DMy5UGESaU6mzkTKjV9l0loW
+VuClwK3fgOOXLMFzsP99gO0JG0Z1gfKcWE2IEPEB7OSoGx/XA69JxT8YjbzPYA8Z
+QpKk2FBxkiVx4xW7kRUnuly7HzQLprmqSye6OQSPXSduyra8aMs1PVkwPvEg38Ec
+BDuBrE3dXepU52HXkLkt9zcBo9LSJAkMR69+CJ6SdYUBDANcG2tp6fXqvgEH/Aly
++zfvbUs+H6Nzj82GwQUqJtRmypOYFLMzYSNzeWdCGJSPbCop+v+dpx+/8vwfl/yf
+unnLtlSvDnNwLsUqe7WSq6wSeQ2073XNi1f+pjmwZQ2Jjcr8p4l+8B2IlhSM6m1A
+wcly8dl9fVbKzJ06GrC9q+cd4Brl7g0fF+isvF5klNomjDy1DjSpjgWcpgi/9osJ
+FUdR6trTKIR1yMtr5+PiVYEEvZOsIqJySQfGI6U3R66muI/s4PaTAJPyf46Vzmd5
+pnVNi8CnCAoERtLZ+hFbnB7vbD47bSyTpsTkxUOQOik2sghYLDdEGouWbONakL0g
+OOGV160WddGotrXTY6iFAgwDodoT8VqRl4UBD/41aYgD53H7Vu8hC/YNTeD4HrVw
+khuOqEsZ1tBXxJwkujjRl4hx7xEmzhC59daI3IwsJSTFE+gBYTHlyIksqSgq72P6
+VfpNdwzV3GP5RpgAi6Kin7q2HcDVxBUJYQvmZ4igoe+luXXEtkHAYv/BO507+Rr9
+UMlFw/XldRrqMUQhxfYOWgVrAxIg4bbOKo0xt2KjXXeUpM8qclK9QUKtyFUPMDOB
+xbCKa2SiwtsFQUXhS4cyt4lTBeemCXC1ajhghgW7f9G3ym/UR/beNICiF56t4Mvr
+HEdiPGDzVnntC9Wbt6rLiE2WQAskjana53kpwVUCfrv4f4BDvVrkqoQSeEEnj2Qz
+Kc3zFcedrE3FILgHPApJFrZknD+V3RdPXv5d1tgTVYxZJu840YgBXVihKgFcIkN7
+QU5ZwttNwnWGKhCFtS/za6rWGaWe+LUoMJ5b6FqZ5vXV9s3+VjXAaHT55Qv9EKDz
+eDHlfpK0VizPlRBgJJEFjxWPIf7d6qHyHWfivmXwbwzdducZFSvof6qqrSsSJY41
+qvIsf+/YjGFLKz8UT+/bTBFL32Wf/F0cDefJ4zystG9ZhWQSUdpF6XeHrG0+1BuG
+pVBk+HakEFrjzG5YlQGERbrktJi/lCEDRf0LsQfiXsDVlwXvUUgsIShrE11mnX/T
+oh8+YOe4cI3Gy5r0a4UCDAPiA8lOXOuz7wEP/RRJo/3Op15irMGWp+6Ty/8yciZQ
+DisSpfckpZtWo+jn1K2KJ/xJz9SHa2TcwkoXi4N/1je0oYjUB/KwiVhS0nxHKjdT
+BLbG9XZeI+PzgiBaV2pfoDytHYjsecLLPNRkMC/4A+2EOOZ4r0MsXRik0By2AuMP
+lfz4OUZGppdRG61+fUAuxkCz7YEmwe/sYdiZUHZhcA9HyxcjTnWWnmQ9Wivt0wOW
+mPKWDbYsSISKzqWJKwU7X2dG0W8A8WDQgozHyL/SCuVT8hnnyEeyQsRXk+gBvb4K
+/5zO9OgBtOoiYyH+NZNY+gYGUs/1R6wWp3KJCaD6v7/DE8sryQlHSVlDJ41g611d
+YiT5JXoQZreEgCZmUZE1Q4rZjtS5sEPq+O9eYoHFLzSElXE0uyXvlv71ANLExWia
+u/ITgxmRk9mbrLQS4eoI60tM/vg+mT8JPkr/CJv7jrI1jHIFf7cGAqm/CFKhy69R
+bPTGf85130iR+w49NkZ8XBDwW7P7xyoflCBi2qL9jcgb2jyHjSSL+X7ucVXjm50i
+rDMvtYuvFtP08ut9q/I7HVxOzmr+atY4MiNcTVltBFn+3NLRqJIyacx/ZgY1EDAc
+wokg2Tylglv/uSXTzHFbgWT6TH/WdgMobJdf705xoIIXhaa2HRCWvOGdJ5r0mKI0
+bjwvZKJEZB8MKU0s0mIBGGFffvNvb8WrixQCczg37YNVhvnBxprUT9R4tMfE/ybt
+BPFQIXTCjdaxMc6GL1EGLhaj3XADUT/JLSDqX9BUuZyN8CBrt4EgkD4tmtwB80Cp
+b9sc0R49c51gYZ2y00PvXQ==
+=ezNx
+-----END PGP MESSAGE-----
diff --git a/app/matrix/secrets/cipher/appservice-telegram-prod-token b/app/matrix/secrets/cipher/appservice-telegram-prod-token
new file mode 100644
index 0000000..52708e3
--- /dev/null
+++ b/app/matrix/secrets/cipher/appservice-telegram-prod-token
@@ -0,0 +1,41 @@
+-----BEGIN PGP MESSAGE-----
+
+hQEMAzhuiT4RC8VbAQf+KV+pXyxCBLTkTCGWRc7I1loxw8793j1CXOgINS1817Sl
+6cq4o07NxQRY+owyXGOyUGpQC1mlqyUJYbPjjgj6SzPIm6Knr7ue0PWeFsdKq+3d
+XHf5R7+xijJG0GMBMRXrP46Jg4amPNkydUmGFhbcSJ6uGnvfcqdOO7G9m5A6ACo/
+LCJgsoncBpxb5xVgfkPJRna1yFzZCDXmtT3c0UGcnVfhN4ZSsKThEX5n0W/cbQXv
+tzPGgP/4A0JGxvKcB5OHsGMH4bbEtlEHobm6Wo9OKNc7I9iIbCczkUR2viz988y1
+7v8si3aCrZVbIkIqlBRI6fJCoW9yfzo6r9KtlwL0wYUBDANcG2tp6fXqvgEH/ROm
+5xNkYKPpyEPULzEdk5VWQxmrwsnweEl33mejTmSrFD5l+1w2aS5eUwSfy9bwjr+Z
+zQ+Rsu2OISTisQsfKHrCuGxaV+E+hH4Ta5RoKopcVdOI9bga1Ja4wtGk6M5tul9L
+4/ePGWK5A6vwnBp4pPSC14nZXpWXUvZRGpglV9DSEHJ/DfsiSqfkdW6bKfx33MGP
+KhxmocxwR3K2KzgRyj2lVQpCiMnGsQbXKwyFSnVFid5NR/g4lOWnHhKLybNI6DHV
+eAC12Ai+YjIfoTcsYL2fwUYhsXkgvzicWF9lgQkJjFiJGSuo1ZdSg7Bmjro6Bfok
+4tRBE2CDDiNUL1LCE0GFAgwDodoT8VqRl4UBD/4pIsJ4On49B3D8P+vwPBHUCOkw
+MOT3TvnLxAuB0NoYYnNRjYz5J1SrZTyHi0wiRed5T2Rxhy+MAXiKMKmBYBjdBkye
+eMHObobXq0OWu0cTSHy6HwR7gDI3osd1hNVIN8zxt9OgKE1omv8TJ0hnkFgLtyLD
+l8mh9LLHgRoZ9aFmU26LUA8DV7QY2XMetCmbGM5kMswq1hf4Kok/WHDleTEbv3Af
+23jSqn2+eAHipKqZFhbBvx14o+9bCa2gmQbep/QGuMS29GYgBEQbAw9cFW6dTKqY
+GL2eHYwmcjDx8jDSZqPFAYyXJWR+cBsd8oQnVoiKCEX1YGPWOp6AW+V2B41y4fo6
+4yrbQSkNVJhb5uNxFkyTcJ+kAnQ/GkaIq5ju+0hbCEnGL3J8jrY21rXWHNZgQcc3
+XmDYuE+ewDMMi4y4m7sIaFlpEnsi7ikNiDw27X33OIfBJ5VA2eN2yhYlmlVPzx9N
+9O3Xiz2EzwtfVCpQplgIdYlKBop/FtU4dKEuLgVM/UwsZ1nR5xqTMctIXUxF2DAP
+ZyCjg/EpOvII4Qw3CUoyF31ICA1BqxYvP+b7cE/70zTeF4YtBoTICsxRQYK85y04
+qJlSB1GG+wr8nHWYH3xDizxt4KmVEcIFVID9fw/IMSYd8uZxfLxxTPlT/UCYLqTA
+IayaZbzvP+2bGFYXJoUCDAPiA8lOXOuz7wEP/jTu6keVVeCyqmeWXoJQKXgQl43y
+TiDVsJkeeCaR4Ek3crZ/VfN/Tu8j14zsVS2hdE+4l96cWNasEjNP/To7IYCjm5xl
+btSkXwtNEG65zHuKfOqgXLoFN1zfyi2uMdhiCXURFjHdMPSaP60dAkF0oC5HQ4X2
+IJBeRjV0XTzJusvs7DpmYTs8q+BKjg2ERNvXtQZHUftDAL04OjJVqYiXeuL13das
+jhxSliz7VWrrFmaWzg0wB3QyZeN7p2Qx2VDiJlXVp7GLRUOgfkdeCNYJFBfk8DHV
+qiLzCZYRSSypPoLnDQZoCye3m04B5IAQi4NTAAlTAAzVZC6tbV/0nSkrSDhdm0Wn
+JLh0Xonhg/JlEArerQKag9eZ0FOxnrQSSz73A2lH9qrH5MO5DRLR5f0UigVHdhMh
+gQ02jBtQ5u1fSW64pPscrmllXaZn8H838j+C5T+/iTxSD0KQrArTJg3dB525fIQ6
+U1j50kpACF5Q9MHebCpVE6xXrThkQYcSIJIPUYUlQUzbQQQJHTs32U4JrGsxK26G
+FVMl+df12S6CdezB9SD8gu4Qjw01A5LPSYSInVhgJRmLHokHvVgXBr7BF7k0WO8G
+ci56x5N2zLvYAki+gJbVnUd4jVXr3uSmhlKgBSlE+vED4M3ZVK6XSxbfrKeRLfek
+mQZW+n9NgYG/ai8h0ogBJ7POGcjfmI//VsnhZNmFpSuQi63Lr8hC2DHVzp4GdegZ
+oyXPqIZb3HCiuJ/fKbHRcQau2Pyp//P4l6Zv2moikOEP4SWhUZ2ZyFxgEqt8vjkB
+wlJAfgJuJbjis9Cj1QA2cOW03I9or9cinTW782SzEeNMZgmYZnM2+mKrTANlwnLi
+6uaFMmg9
+=xl1i
+-----END PGP MESSAGE-----
diff --git a/app/matrix/secrets/plain/.gitignore b/app/matrix/secrets/plain/.gitignore
new file mode 100644
index 0000000..72e8ffc
--- /dev/null
+++ b/app/matrix/secrets/plain/.gitignore
@@ -0,0 +1 @@
+*