mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 02:54:26 +00:00
kevinveenbirkenbachandClaude Opus 5
304144ce67
Every mautrix bridge generated its own registration with -g on start, with fresh random tokens. Synapse had to read that file from a shared directory, be restarted afterwards, and on swarm the services had to be removed first so the registrations could be wiped (93735fd533). The tokens changed on every redeploy and the deploy depended on a wait for files a container writes. Each bridge now has as_token and hs_token declared in meta/secrets.yml and a fixed appservice_port in its addon. The bridge config reads the tokens through lookup('config'), and registration.yaml.j2 renders the registration from that config in the upstream -g format, so both sides are known before anything starts and stay identical across redeploys. The files reach the containers as secrets: matrix_bridge_mounts offers a stack view (top-level definitions, content-hash named by compose_volumes), a synapse view (one registration per bridge under /registrations, mode 0444) and a bridge view (the config at /config/config.yaml). The bridges run as the synapse uid with an explicit --config and --no-update, keep their scratch /data on a 16m tmpfs so hlth-volumes finds no anonymous volume, and depend on a healthy synapse. Their healthcheck is /_matrix/mau/ready, which the bridge only reports after whoami with the as_token and an appservice ping carrying the hs_token, so a healthy bridge proves the token pair. The compose tasks lose the compose down, the swarm service rm block, the registration wait, the permission fixes and both synapse restarts; this reverts the workaround of93735fd533. Verified on the local compose stack: four bridges ready, synapse pings answered, registration and config sha256 unchanged across a redeploy, test-bridge-roster and 12 matrix Playwright specs green. A token rotation (new pair in both files, compose up --force-recreate as the handler runs it) came back healthy; a mismatched pair left the bridge unhealthy. The swarm-shaped stack file passes docker stack config with the 0444 secret modes, the 16 MiB tmpfs and content-hash secret names. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
117 lines
4.6 KiB
YAML
117 lines
4.6 KiB
YAML
---
|
|
credentials:
|
|
litellm_api_key:
|
|
description: Per-consumer virtual key for the shared svc-ai-litellm gateway
|
|
algorithm: sk_prefixed
|
|
validation:
|
|
min_length: 50
|
|
administrator_password:
|
|
description: Initial administrator password for the Matrix homeserver
|
|
algorithm: sha256
|
|
validation: ^[a-f0-9]{64}$
|
|
generic_secret_key:
|
|
description: Generic secret used by Synapse for key signing and session management
|
|
algorithm: sha256
|
|
validation: ^[a-f0-9]{64}$
|
|
database_password:
|
|
description: Password for the Matrix PostgreSQL database
|
|
algorithm: bcrypt
|
|
validation: ^\$2[aby]\$.{56}$
|
|
registration_shared_secret:
|
|
description: Secret token used to allow shared registration from external sources
|
|
algorithm: sha256
|
|
validation: ^[a-f0-9]{64}$
|
|
macaroon_secret_key:
|
|
description: Secret key used to sign macaroon tokens for authentication
|
|
algorithm: sha256
|
|
validation: ^[a-f0-9]{64}$
|
|
form_secret:
|
|
description: Secret for form token protection (used in web registration flows)
|
|
algorithm: sha256
|
|
validation: ^[a-f0-9]{64}$
|
|
chatgpt_bridge_openai_api_key:
|
|
description: Key the Matrix ChatGPT bridge presents to its inference endpoint, the shared gateway when svc-ai-litellm is deployed
|
|
algorithm: sk_prefixed
|
|
validation:
|
|
min_length: 50
|
|
chatgpt_bridge_access_token:
|
|
description: Access token used by the ChatGPT bridge for authentication
|
|
algorithm: plain
|
|
validation: ^[a-zA-Z0-9-_]{20,}$
|
|
chatgpt_bridge_user_password:
|
|
description: Matrix user password used by the ChatGPT bridge
|
|
algorithm: sha256
|
|
validation: ^[a-f0-9]{64}$
|
|
mautrix_meta_bridge_database_password:
|
|
description: Database password for the mautrix-meta bridge (Facebook Messenger + Instagram)
|
|
algorithm: bcrypt
|
|
validation: ^\$2[aby]\$.{56}$
|
|
mautrix_meta_bridge_as_token:
|
|
description: Appservice token the mautrix-meta bridge presents to Synapse
|
|
algorithm: alphanumeric
|
|
validation: ^[A-Za-z0-9]{64}$
|
|
mautrix_meta_bridge_hs_token:
|
|
description: Token Synapse presents to the mautrix-meta bridge
|
|
algorithm: alphanumeric
|
|
validation: ^[A-Za-z0-9]{64}$
|
|
mautrix_signal_bridge_as_token:
|
|
description: Appservice token the mautrix-signal bridge presents to Synapse
|
|
algorithm: alphanumeric
|
|
validation: ^[A-Za-z0-9]{64}$
|
|
mautrix_signal_bridge_hs_token:
|
|
description: Token Synapse presents to the mautrix-signal bridge
|
|
algorithm: alphanumeric
|
|
validation: ^[A-Za-z0-9]{64}$
|
|
mautrix_slack_bridge_as_token:
|
|
description: Appservice token the mautrix-slack bridge presents to Synapse
|
|
algorithm: alphanumeric
|
|
validation: ^[A-Za-z0-9]{64}$
|
|
mautrix_slack_bridge_hs_token:
|
|
description: Token Synapse presents to the mautrix-slack bridge
|
|
algorithm: alphanumeric
|
|
validation: ^[A-Za-z0-9]{64}$
|
|
mautrix_telegram_bridge_as_token:
|
|
description: Appservice token the mautrix-telegram bridge presents to Synapse
|
|
algorithm: alphanumeric
|
|
validation: ^[A-Za-z0-9]{64}$
|
|
mautrix_telegram_bridge_hs_token:
|
|
description: Token Synapse presents to the mautrix-telegram bridge
|
|
algorithm: alphanumeric
|
|
validation: ^[A-Za-z0-9]{64}$
|
|
mautrix_whatsapp_bridge_as_token:
|
|
description: Appservice token the mautrix-whatsapp bridge presents to Synapse
|
|
algorithm: alphanumeric
|
|
validation: ^[A-Za-z0-9]{64}$
|
|
mautrix_whatsapp_bridge_hs_token:
|
|
description: Token Synapse presents to the mautrix-whatsapp bridge
|
|
algorithm: alphanumeric
|
|
validation: ^[A-Za-z0-9]{64}$
|
|
mautrix_signal_bridge_database_password:
|
|
description: Database password for the mautrix-signal bridge
|
|
algorithm: bcrypt
|
|
validation: ^\$2[aby]\$.{56}$
|
|
mautrix_slack_bridge_database_password:
|
|
description: Database password for the mautrix-slack bridge
|
|
algorithm: bcrypt
|
|
validation: ^\$2[aby]\$.{56}$
|
|
mautrix_telegram_bridge_database_password:
|
|
description: Database password for the mautrix-telegram bridge
|
|
algorithm: bcrypt
|
|
validation: ^\$2[aby]\$.{56}$
|
|
mautrix_telgegram_bridge_api_id:
|
|
description: Telegram API ID for the mautrix-telegram bridge
|
|
algorithm: plain
|
|
validation: ^\d{5,}$
|
|
mautrix_telgegram_bridge_api_pin:
|
|
description: Telegram API hash or PIN for the mautrix-telegram bridge
|
|
algorithm: plain
|
|
validation: ^[a-zA-Z0-9]{10,}$
|
|
mautrix_whatsapp_bridge_database_password:
|
|
description: Database password for the mautrix-whatsapp bridge
|
|
algorithm: bcrypt
|
|
validation: ^\$2[aby]\$.{56}$
|
|
mautrix_whatsapp_bridge_provisioning_shared_secret:
|
|
description: Shared secret for the mautrix-whatsapp bridge provisioning endpoint
|
|
algorithm: sha256
|
|
validation: ^[a-f0-9]{64}$
|