main/mimic
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

various bugfixes during testing

Browse Source
This commit is contained in:
cortex
2026-05-21 09:17:29 +00:00
parent ed832c54dc
commit 75089cd2e9
4 changed files with 54 additions and 44 deletions
Download Patch File Download Diff File Expand all files Collapse all files
init/scripts/config_gen.sh
+48 -32
View File
@@ -64,8 +64,8 @@ docker run -it --rm --network matrix_network \
-e SYNAPSE_SERVER_NAME="$HOMESERVER_FQDN" \
-e SYNAPSE_REPORT_STATS=no \
ghcr.io/element-hq/synapse:latest generate || { log_error "Synapse config generation failed"; exit 1; }
SYNAPSE_CFG="${VOLUME_PATH}/synapse/homeserver.yaml"
fix_ownership "${VOLUME_PATH}/synapse"
yq -y -i '.database.name = "psycopg2"' "$SYNAPSE_CFG"
yq -y -i ".database.args.user = \"${PG_USER_MATRIX}\"" "$SYNAPSE_CFG"
yq -y -i ".database.args.password = \"${PG_PASSWORD_MATRIX}\"" "$SYNAPSE_CFG"
@@ -76,21 +76,19 @@ yq -y -i ".database.args.sslmode = \"prefer\"" "$SYNAPSE_CFG"
yq -y -i ".public_baseurl = \"https://${HOMESERVER_FQDN}\"" "$SYNAPSE_CFG"
yq -y -i ".server_name = \"${HOMESERVER_FQDN}\"" "$SYNAPSE_CFG"
fix_ownership "${VOLUME_PATH}/synapse"
log_info "Generating MAS configuration..."
docker run -it --rm --network matrix_network \
-v "${VOLUME_PATH}/mas:/data" \
ghcr.io/element-hq/matrix-authentication-service:latest config generate \
| grep -v '^[0-9]\{4\}-[0-9]\{2\}-[0-9]\{2\}' > "${VOLUME_PATH}/mas/config.yaml" || { log_error "Mas config generation failed"; exit 1; }
MAS_CFG="${VOLUME_PATH}/mas/config.yaml"
MAS_CFG="${VOLUME_PATH}/mas/config.json"
if ! yq '.clients' "$MAS_CFG" > /dev/null 2>&1; then
yq -y -i '.clients = []' "$MAS_CFG"
yq -i '.clients = []' "$MAS_CFG"
fi
yq -y -i ".public_base_url = \"https://${MAS_FQDN}\"" "$MAS_CFG"
yq -y -i ".http.listen = \"0.0.0.0:8000\"" "$MAS_CFG"
yq -y -i ".database.uri = \"postgres://${PG_USER_MAS}:${PG_PASSWORD_MAS}@matrix-db:5432/auth?sslmode=prefer\"" "$MAS_CFG"
yq -i ".public_base_url = \"https://${MAS_FQDN}\"" "$MAS_CFG"
yq -i ".http.listen = \"0.0.0.0:8000\"" "$MAS_CFG"
yq -i ".database.uri = \"postgres://${PG_USER_MAS}:${PG_PASSWORD_MAS}@matrix-db:5432/auth?sslmode=prefer\"" "$MAS_CFG"
fix_ownership "${VOLUME_PATH}/mas"
@@ -103,31 +101,39 @@ log_info "Linking Synapse and MAS via OIDC..."
CLIENT_ID="synapse-client"
CLIENT_SECRET=$(openssl rand -hex 32)
TEMP_FILTER=$(mktemp)
trap "rm -f $TEMP_FILTER" EXIT
#TEMP_FILTER=$(mktemp)
#trap "rm -f $TEMP_FILTER" EXIT
cat > "$TEMP_FILTER" <<EOF
clients:
- client_id: "${CLIENT_ID}"
client_secret: "${CLIENT_SECRET}"
redirect_uris:
- "https://${HOMESERVER_FQDN}/_synapse/client/oidc/callback"
grant_types:
- "authorization_code"
- "refresh_token"
response_types:
- "code"
scopes:
- "openid"
- "profile"
- "email"
application_type: "web"
EOF
#cat > "$TEMP_FILTER" <<EOF
#clients:
# - client_id: "${CLIENT_ID}"
# client_secret: "${CLIENT_SECRET}"
# redirect_uris:
# - "https://${HOMESERVER_FQDN}/_synapse/client/oidc/callback"
# grant_types:
# - "authorization_code"
# - "refresh_token"
# response_types:
# - "code"
# scopes:
# - "openid"
# - "profile"
# - "email"
# application_type: "web"
#EOF
EXISTING_CLIENT=$(yq '.clients[] | select(.client_id == "'"${CLIENT_ID}"'")' "$MAS_CFG" 2>/dev/null || echo "")
if [[ -z "$EXISTING_CLIENT" ]]; then
yq -y -i "$(cat "$TEMP_FILTER")" "$MAS_CFG" || { log_error "Failed to register Synapse client in MAS"; exit 1; }
yq -y -i ".clients += [{
\"client_id\": \"${CLIENT_ID}\",
\"client_secret\": \"${CLIENT_SECRET}\",
\"redirect_uris\": [\"https://${HOMESERVER_FQDN}/_synapse/client/oidc/callback\"],
\"grant_types\": [\"authorization_code\", \"refresh_token\"],
\"response_types\": [\"code\"],
\"scopes\": [\"openid\", \"profile\", \"email\"],
\"application_type\": \"web\"
}]" "$MAS_CFG" || { log_error "Failed to register Synapse client in MAS"; exit 1; }
log_info " -> Registered Synapse as OIDC client in MAS"
else
log_info " -> Synapse client already registered in MAS, skipping"
@@ -137,12 +143,22 @@ ISSUER_URL="https://${MAS_FQDN}"
fix_ownership "$SYNAPSE_CFG"
cat > "$TEMP_FILTER" <<EOF
.oidc_providers += [{"idp_id": "mas", "idp_name": "Matrix Authentication Service", "idp_brand": "mas", "issuer": "${ISSUER_URL}", "client_id": "${CLIENT_ID}", "client_secret": "${CLIENT_SECRET}", "scopes": ["openid", "profile"], "skip_verification": false}]
EOF
#cat > "$TEMP_FILTER" <<EOF
#.oidc_providers += [{"idp_id": "mas", "idp_name": "Matrix Authentication Service", "idp_brand": "mas", "issuer": "${ISSUER_URL}", "client_id": "${CLIENT_ID}", "client_secret": "${CLIENT_SECRET}", "scopes": ["openid", "profile"], "skip_verification": false}]
#EOF
if ! yq '.oidc_providers' "$SYNAPSE_CFG" 2>/dev/null | grep -q "idp_id"; then
yq -y -i "$(cat "$TEMP_FILTER")" "$SYNAPSE_CFG" || { log_error "Failed to inject OIDC config"; exit 1; }
# # yq -y -i "$(cat "$TEMP_FILTER")" "$SYNAPSE_CFG" || { log_error "Failed to inject OIDC config"; exit 1; }
yq -y -i ".oidc_providers += [{
\"idp_id\": \"mas\",
\"idp_name\": \"Matrix Authentication Service\",
\"idp_brand\": \"mas\",
\"issuer\": \"${ISSUER_URL}\",
\"client_id\": \"${CLIENT_ID}\",
\"client_secret\": \"${CLIENT_SECRET}\",
\"scopes\": [\"openid\", \"profile\"],
\"skip_verification\": false
}]" "$SYNAPSE_CFG" || { log_error "Failed to inject OIDC config"; exit 1; }
fi
if [[ "${INCLUDE_LIVEKIT:-FALSE}" == "TRUE" ]]; then