cortex
70 lines
2.0 KiB
Bash
Executable File
70 lines
2.0 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
source "${SCRIPT_DIR}/functions.sh"
|
|
resolve_paths
|
|
|
|
require_env
|
|
require_command "yq"
|
|
require_command "openssl"
|
|
|
|
SYNAPSE_CFG="${VOLUME_PATH}/synapse/homeserver.yaml"
|
|
MAS_CFG="${VOLUME_PATH}/mas/config.yaml"
|
|
|
|
require_file "$SYNAPSE_CFG" "Synapse config"
|
|
require_file "$MAS_CFG" "MAS config"
|
|
|
|
CLIENT_ID="synapse-client"
|
|
CLIENT_SECRET=$(openssl rand -hex 32)
|
|
|
|
TEMP_FILTER=$(mktemp)
|
|
trap "rm -f $TEMP_FILTER" EXIT
|
|
|
|
cat > "$TEMP_FILTER" <<EOF
|
|
clients:
|
|
- client_id: "${CLIENT_ID}"
|
|
client_secret: "${CLIENT_SECRET}"
|
|
redirect_uris:
|
|
- "https://${HOMESERVER_FQDN}/_synapse/client/oidc/callback"
|
|
grant_types:
|
|
- "authorization_code"
|
|
- "refresh_token"
|
|
response_types:
|
|
- "code"
|
|
scopes:
|
|
- "openid"
|
|
- "profile"
|
|
- "email"
|
|
application_type: "web"
|
|
EOF
|
|
|
|
EXISTING_CLIENT=$(yq '.clients[] | select(.client_id == "'"${CLIENT_ID}"'")' "$MAS_CFG" 2>/dev/null || echo "")
|
|
|
|
if [[ -z "$EXISTING_CLIENT" ]]; then
|
|
# Append new client to MAS config
|
|
yq -y -i "$(cat "$TEMP_FILTER")" "$MAS_CFG" || { log_error "Failed to register Synapse client in MAS"; exit 1; }
|
|
log_info " -> Registered Synapse as OIDC client in MAS"
|
|
else
|
|
log_info " -> Synapse client already registered in MAS, skipping"
|
|
fi
|
|
|
|
ISSUER_URL="https://${MAS_FQDN}"
|
|
|
|
fix_ownership "$SYNAPSE_CFG"
|
|
|
|
cat > "$TEMP_FILTER" <<EOF
|
|
.oidc_providers += [{"idp_id": "mas", "idp_name": "Matrix Authentication Service", "idp_brand": "mas", "issuer": "${ISSUER_URL}", "client_id": "${CLIENT_ID}", "client_secret": "${CLIENT_SECRET}", "scopes": ["openid", "profile"], "skip_verification": false}]
|
|
EOF
|
|
|
|
if ! yq '.oidc_providers' "$SYNAPSE_CFG" 2>/dev/null | grep -q "idp_id"; then
|
|
yq -y -i "$(cat "$TEMP_FILTER")" "$SYNAPSE_CFG" || { log_error "Failed to inject OIDC config"; exit 1; }
|
|
fi
|
|
|
|
if [[ "${INCLUDE_LIVEKIT}" == "TRUE" ]]; then
|
|
JWT_URL="https://${JWT_FQDN:-jwt.${DOMAIN}}"
|
|
yq -y -i ".livekit.url = \"$JWT_URL\"" "$SYNAPSE_CFG"
|
|
fi
|
|
|
|
log_info "OIDC and LiveKit linking complete"
|