Initial Commit

init/scripts/config_link.sh

@@ -0,0 +1,54 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+source "${SCRIPT_DIR}/functions.sh"
+resolve_paths
+
+require_env
+require_command "yq"
+require_command "openssl"
+
+SYNAPSE_CFG="${VOLUME_PATH}/synapse/homeserver.yaml"
+MAS_CFG="${VOLUME_PATH}/mas/config.yaml"
+
+require_file "$SYNAPSE_CFG" "Synapse config"
+require_file "$MAS_CFG" "MAS config"
+
+CLIENT_ID="synapse-client"
+CLIENT_SECRET=$(openssl rand -hex 32)
+
+TEMP_FILTER=$(mktemp)
+trap "rm -f $TEMP_FILTER" EXIT
+
+cat > "$TEMP_FILTER" <<EOF
+.oidc.providers += [{"id": "synapse", "client_id": "${CLIENT_ID}", "client_secret": "${CLIENT_SECRET}", "scopes": ["openid", "profile", "email"], "issuer": "http://mas:8000"}]
+EOF
+
+yq -y -i "$(cat "$TEMP_FILTER")" "$MAS_CFG" || { log_error "Failed to update MAS config"; exit 1; }
+
+CLIENT_ID=$(yq '.oidc.providers[0].client_id' "$MAS_CFG" | tr -d '"')
+CLIENT_SECRET=$(yq '.oidc.providers[0].client_secret' "$MAS_CFG" | tr -d '"')
+
+ISSUER_URL="https://${MAS_FQDN}"
+
+fix_ownership "$SYNAPSE_CFG"
+
+cat > "$TEMP_FILTER" <<EOF
+.oidc_providers += [{"idp_id": "mas", "idp_name": "Matrix Authentication Service", "idp_brand": "mas", "issuer": "${ISSUER_URL}", "client_id": "${CLIENT_ID}", "client_secret": "${CLIENT_SECRET}", "scopes": ["openid", "profile"], "skip_verification": false}]
+EOF
+
+if ! yq '.oidc_providers' "$SYNAPSE_CFG" 2>/dev/null | grep -q "idp_id"; then
+    yq -y -i "$(cat "$TEMP_FILTER")" "$SYNAPSE_CFG" || { log_error "Failed to inject OIDC config"; exit 1; }
+fi
+
+if [[ -n "${LIVEKIT_API_KEY:-}" ]]; then
+    JWT_URL="https://${JWT_FQDN:-jwt.${DOMAIN}}"
+    if yq '.livekit.url' "$SYNAPSE_CFG" 2>/dev/null | grep -q "."; then
+        yq -y -i ".livekit.url = \"$JWT_URL\"" "$SYNAPSE_CFG"
+    else
+        yq -y -i ".livekit.url = \"$JWT_URL\"" "$SYNAPSE_CFG"
+    fi
+fi
+
+log_info "OIDC and LiveKit linking complete"