From 5606d8083eeeb02c34102c43709cfd2cd2c17089 Mon Sep 17 00:00:00 2001
From: cortex <admin@fossgate.co.uk>
Date: Thu, 21 May 2026 07:13:08 +0100
Subject: [PATCH] config rewrite to fix oidc issues

---
 init/scripts/config_gen.sh  | 26 ++++++++++++++++++++++++--
 init/scripts/config_link.sh | 27 +++++++++++++++++++++++----
 2 files changed, 47 insertions(+), 6 deletions(-)

diff --git a/init/scripts/config_gen.sh b/init/scripts/config_gen.sh
index 9949a2e..a5a3c3b 100755
--- a/init/scripts/config_gen.sh
+++ b/init/scripts/config_gen.sh
@@ -17,7 +17,7 @@ log_info "Initializing PostgreSQL..."
 docker compose -f "$COMPOSE_FILE" --env-file "$ENV_FILE" up -d --wait matrix-db
 
 # Wait for database readiness (silent except on failure)
-for ATTEMPT in $(seq 1 30); do
+for ATTEMPT in $(seq 1 60); do
     if docker compose -f "$COMPOSE_FILE" exec -T matrix-db psql -U "$PG_USER" -c "SELECT 1;" > /dev/null 2>&1; then
         break
     fi
@@ -44,7 +44,7 @@ SELECT CASE WHEN NOT EXISTS (SELECT 1 FROM pg_database WHERE datname = 'synapse'
 EOF
 )
 
-echo "$INIT_SQL" | docker compose -f "$COMPOSE_FILE" --env-file "$ENV_FILE" exec -T matrix-db psql -U "$PG_USER" -f -
+echo "$INIT_SQL" | docker compose -f "$COMPOSE_FILE" --env-file "$ENV_FILE" exec -T matrix-db psql -U "$PG_USER" -f - > /dev/null
 
 log_info "Generating Synapse configuration..."
 docker run -it --rm --network matrix_network \
@@ -53,13 +53,35 @@ docker run -it --rm --network matrix_network \
     -e SYNAPSE_REPORT_STATS=no \
     ghcr.io/element-hq/synapse:latest generate || { log_error "Synapse config generation failed"; exit 1; }
 
+SYNAPSE_CFG="${VOLUME_PATH}/synapse/homeserver.yaml"
+yq -y -i '.database.name = "psycopg2"' "$SYNAPSE_CFG"
+yq -y -i ".database.args.user = \"${PG_USER_MATRIX}\"" "$SYNAPSE_CFG"
+yq -y -i ".database.args.password = \"${PG_PASSWORD_MATRIX}\"" "$SYNAPSE_CFG"
+yq -y -i ".database.args.database = \"${PG_DB_MATRIX}\"" "$SYNAPSE_CFG"
+yq -y -i ".database.args.host = \"matrix-db\"" "$SYNAPSE_CFG"
+yq -y -i ".database.args.port = 5432" "$SYNAPSE_CFG"
+yq -y -i ".database.args.sslmode = \"prefer\"" "$SYNAPSE_CFG"
+yq -y -i ".public_baseurl = \"https://${HOMESERVER_FQDN}\"" "$SYNAPSE_CFG"
+yq -y -i ".server_name = \"${HOMESERVER_FQDN}\"" "$SYNAPSE_CFG"
+
 fix_ownership "${VOLUME_PATH}/synapse"
 
 log_info "Generating MAS configuration..."
+
 docker run -it --rm --network matrix_network \
     -v "${VOLUME_PATH}/mas:/data" \
     ghcr.io/element-hq/matrix-authentication-service:latest config generate \
     | grep -v '^[0-9]\{4\}-[0-9]\{2\}-[0-9]\{2\}' > "${VOLUME_PATH}/mas/config.yaml" || { log_error "Mas config generation failed"; exit 1; }
 
+MAS_CFG="${VOLUME_PATH}/mas/config.yaml"
+# Ensure 'clients' array exists (prevents errors if we try to append later)
+if ! yq '.clients' "$MAS_CFG" > /dev/null 2>&1; then
+    yq -y -i '.clients = []' "$MAS_CFG"
+fi
+yq -y -i ".public_base_url = \"https://${MAS_FQDN}\"" "$MAS_CFG"
+yq -y -i ".http.listen = \"0.0.0.0:8000\"" "$MAS_CFG"
+yq -y -i ".database.uri = \"postgres://${PG_USER_MAS}:${PG_PASSWORD_MAS}@matrix-db:5432/auth?sslmode=prefer\"" "$MAS_CFG"
+
 fix_ownership "${VOLUME_PATH}/mas"
+
 log_info "Configuration complete"
diff --git a/init/scripts/config_link.sh b/init/scripts/config_link.sh
index 3464574..f19f5db 100755
--- a/init/scripts/config_link.sh
+++ b/init/scripts/config_link.sh
@@ -22,13 +22,32 @@ TEMP_FILTER=$(mktemp)
 trap "rm -f $TEMP_FILTER" EXIT
 
 cat > "$TEMP_FILTER" <<EOF
-.oidc.providers += [{"id": "synapse", "client_id": "${CLIENT_ID}", "client_secret": "${CLIENT_SECRET}", "scopes": ["openid", "profile", "email"], "issuer": "http://mas:8000"}]
+clients:
+  - client_id: "${CLIENT_ID}"
+    client_secret: "${CLIENT_SECRET}"
+    redirect_uris:
+      - "https://${HOMESERVER_FQDN}/_synapse/client/oidc/callback"
+    grant_types:
+      - "authorization_code"
+      - "refresh_token"
+    response_types:
+      - "code"
+    scopes:
+      - "openid"
+      - "profile"
+      - "email"
+    application_type: "web"
 EOF
 
-yq -y -i "$(cat "$TEMP_FILTER")" "$MAS_CFG" || { log_error "Failed to update MAS config"; exit 1; }
+EXISTING_CLIENT=$(yq '.clients[] | select(.client_id == "'"${CLIENT_ID}"'")' "$MAS_CFG" 2>/dev/null || echo "")
 
-CLIENT_ID=$(yq '.oidc.providers[0].client_id' "$MAS_CFG" | tr -d '"')
-CLIENT_SECRET=$(yq '.oidc.providers[0].client_secret' "$MAS_CFG" | tr -d '"')
+if [[ -z "$EXISTING_CLIENT" ]]; then
+    # Append new client to MAS config
+    yq -y -i "$(cat "$TEMP_FILTER")" "$MAS_CFG" || { log_error "Failed to register Synapse client in MAS"; exit 1; }
+    log_info "  -> Registered Synapse as OIDC client in MAS"
+else
+    log_info "  -> Synapse client already registered in MAS, skipping"
+fi
 
 ISSUER_URL="https://${MAS_FQDN}"