mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 10:59:59 +00:00
kevinveenbirkenbachandClaude Opus 5
304144ce67
Every mautrix bridge generated its own registration with -g on start, with fresh random tokens. Synapse had to read that file from a shared directory, be restarted afterwards, and on swarm the services had to be removed first so the registrations could be wiped (93735fd533). The tokens changed on every redeploy and the deploy depended on a wait for files a container writes. Each bridge now has as_token and hs_token declared in meta/secrets.yml and a fixed appservice_port in its addon. The bridge config reads the tokens through lookup('config'), and registration.yaml.j2 renders the registration from that config in the upstream -g format, so both sides are known before anything starts and stay identical across redeploys. The files reach the containers as secrets: matrix_bridge_mounts offers a stack view (top-level definitions, content-hash named by compose_volumes), a synapse view (one registration per bridge under /registrations, mode 0444) and a bridge view (the config at /config/config.yaml). The bridges run as the synapse uid with an explicit --config and --no-update, keep their scratch /data on a 16m tmpfs so hlth-volumes finds no anonymous volume, and depend on a healthy synapse. Their healthcheck is /_matrix/mau/ready, which the bridge only reports after whoami with the as_token and an appservice ping carrying the hs_token, so a healthy bridge proves the token pair. The compose tasks lose the compose down, the swarm service rm block, the registration wait, the permission fixes and both synapse restarts; this reverts the workaround of93735fd533. Verified on the local compose stack: four bridges ready, synapse pings answered, registration and config sha256 unchanged across a redeploy, test-bridge-roster and 12 matrix Playwright specs green. A token rotation (new pair in both files, compose up --force-recreate as the handler runs it) came back healthy; a mismatched pair left the bridge unhealthy. The swarm-shaped stack file passes docker stack config with the 0444 secret modes, the 16 MiB tmpfs and content-hash secret names. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
11 lines
395 B
Django/Jinja
11 lines
395 B
Django/Jinja
{% include 'roles/sys-svc-compose/templates/base.yml.j2' %}
|
|
{% if matrix_flavor == 'ansible' %}
|
|
{% include 'flavor/ansible/services.yml.j2' %}
|
|
{% else %}
|
|
{% include 'flavor/compose/services.yml.j2' %}
|
|
{% endif %}
|
|
|
|
{{ lookup('compose_volumes', extra_secrets=(lookup('matrix_bridge_mounts', 'stack') if matrix_flavor == 'compose' else {})) }}
|
|
|
|
{{ lookup('compose_networks') }}
|