From 7165d6fe24cab73de34d0e4d1267ec3fc517c1a6 Mon Sep 17 00:00:00 2001 From: Jordan Holt Date: Sun, 5 Oct 2025 21:23:28 +0100 Subject: [PATCH] hosts/vps1: update mautrix bridges - Regenerate pickle keys - Enable double puppeting --- hosts/vps1/matrix.nix | 34 ++++++++++++++++-- .../mautrix-doublepuppet-registration.age | Bin 0 -> 575 bytes hosts/vps1/secrets/mautrix-signal-env.age | Bin 0 -> 556 bytes hosts/vps1/secrets/mautrix-whatsapp-env.age | 10 ++++++ ...828b9c64dc5d6762e-mautrix-whatsapp-env.age | 8 +++++ ...58d4-mautrix-doublepuppet-registration.age | 10 ++++++ ...566b3ad02189b6d105b-mautrix-signal-env.age | Bin 0 -> 545 bytes 7 files changed, 59 insertions(+), 3 deletions(-) create mode 100644 hosts/vps1/secrets/mautrix-doublepuppet-registration.age create mode 100644 hosts/vps1/secrets/mautrix-signal-env.age create mode 100644 hosts/vps1/secrets/mautrix-whatsapp-env.age create mode 100644 secrets/rekeyed/vps1/28a626290761387828b9c64dc5d6762e-mautrix-whatsapp-env.age create mode 100644 secrets/rekeyed/vps1/297ecb1d48e44e0f309958a6b43f58d4-mautrix-doublepuppet-registration.age create mode 100644 secrets/rekeyed/vps1/33aa80cdd327d566b3ad02189b6d105b-mautrix-signal-env.age diff --git a/hosts/vps1/matrix.nix b/hosts/vps1/matrix.nix index 610fc08..c0b970c 100644 --- a/hosts/vps1/matrix.nix +++ b/hosts/vps1/matrix.nix @@ -41,8 +41,6 @@ let allow = true; default = true; require = true; - pickle_key = - if (bridge == "mautrix-whatsapp") then "maunium.net/go/mautrix-whatsapp" else "mautrix.bridge.e2ee"; }; provisioning = { shared_secret = "disable"; @@ -71,6 +69,24 @@ in (inputs.nixpkgs-unstable + /nixos/modules/services/matrix/mautrix-whatsapp.nix) ]; + age.secrets = { + mautrix-doublepuppet-registration = { + rekeyFile = ./secrets/mautrix-doublepuppet-registration.age; + mode = "0440"; + group = "matrix-synapse"; + }; + mautrix-signal-env = { + rekeyFile = ./secrets/mautrix-signal-env.age; + mode = "0440"; + group = "mautrix-signal"; + }; + mautrix-whatsapp-env = { + rekeyFile = ./secrets/mautrix-whatsapp-env.age; + mode = "0440"; + group = "mautrix-whatsapp"; + }; + }; + networking.firewall.allowedTCPPorts = [ 8448 # Matrix federation ]; @@ -177,6 +193,9 @@ in enable = true; enableRegistrationScript = true; settings = { + app_service_config_files = [ + config.age.secrets.mautrix-doublepuppet-registration.path + ]; database.name = (if usePostgresql then "psycopg2" else "sqlite3"); enable_metrics = false; enable_registration = false; @@ -213,16 +232,25 @@ in services.mautrix-signal = lib.mkIf bridges.signal { enable = true; - settings = commonBridgeSettings "mautrix-signal"; + environmentFile = config.age.secrets.mautrix-signal-env.path; + settings = lib.recursiveUpdate { + encryption = { + pickle_key = "$MAUTRIX_SIGNAL_ENCRYPTION_PICKLE_KEY"; + }; + } (commonBridgeSettings "mautrix-signal"); }; services.mautrix-whatsapp = lib.mkIf bridges.whatsapp { enable = true; + environmentFile = config.age.secrets.mautrix-whatsapp-env.path; settings = lib.recursiveUpdate { backfill = { enabled = true; max_initial_messags = 50; }; + encryption = { + pickle_key = "$MAUTRIX_WHATSAPP_ENCRYPTION_PICKLE_KEY"; + }; network = { mute_status_broadcast = true; history_sync = { diff --git a/hosts/vps1/secrets/mautrix-doublepuppet-registration.age b/hosts/vps1/secrets/mautrix-doublepuppet-registration.age new file mode 100644 index 0000000000000000000000000000000000000000..34fd8eb30b50afde34c0ecb8d57ba784909e1812 GIT binary patch literal 575 zcmYdHPt{G$OD?J`D9Oyv)5|YP*Do{V(zR14$Sl(>Ffuh$NHp{_if~kL%+61#Eb^(+ z4=PUAE=jcTD33}qHct%9DhhJRG%O3VED9~ucPw=G_Xr8&N-5ShDhe`4E^{g^Ffen? zat%)Nvq*QT@+vMdE-}wDcMkI`FiuNPH;=La*=3LzmZ_Uwl$uza%BAfQ;Nz%WRO;fS zouwb*mSR{KY@F(3T3F@opPZRqkmhaR$fc{Rs}SHHuI-zZT zQ*HkyPFifEzasFJ`7O5(&lihce}8@GNQFOWC&qu~?D zY#$+$Ym44aR?bfTu<=gMnh&d|O>dlEBQj;Wi^lWXQIqj@ug?PCV6=y%KwzYfO zS3m1b?M?~Cf2=i!4=lH0d}bLmamCa#o3>WRZptWSnf$%KGFfuh$NHp{_if~kLtTMGI$@i%Y z^*0O%4o^wV2@ZC0(yyut^C~kcEKf0s2usPTh{#M2O)e_r^3KmPay8Ga^bIsmj3}RDCoMM!kV;B}< z7!u`SnUtGinWt?Sm0_M(Zs;1BZ0Hism6Q?{nXPT$?-!Y89$w(*mzGoJk>nW}9_goT zT$JILYT}xlRGu4F>K9;P?px&>X;RLmtE;QvV^MCBQV^9=l^N`oofsD7R$-7D7?~gH z=i(o1;#HLt>Eh;>Vrg0wk?P8If}!>ugLv@EO+E7a6-8fO_4~Cr(58C(t0&i!t8+|Z zXKl{bJ5aktLG_L{*FUKVj$v2Q)Fw60(YRa}5&g&9s`QA=<{GEzo`wg{M<4hwC-%{j zw+8nQ^G_Ev{XBWfna)@Iev&)S>~Koo@5g-UleyG3exB=7QgkmI7gxNtN#B! z^luBVns2_@t&=QAy;V<&RaVOt$lumeTfp!1cB0Y)3EtnDM>2$4#9LN=>D#Yg4ghfM B(}w^6 literal 0 HcmV?d00001 diff --git a/hosts/vps1/secrets/mautrix-whatsapp-env.age b/hosts/vps1/secrets/mautrix-whatsapp-env.age new file mode 100644 index 0000000..8fd65dc --- /dev/null +++ b/hosts/vps1/secrets/mautrix-whatsapp-env.age @@ -0,0 +1,10 @@ +age-encryption.org/v1 +-> piv-p256 a1N2XA Aun1dGh6g8jvPV3vYn1oUoP+LjhV973flcjtVIqtdvHU +ZJgOWsP2WeQEFImxZfWgv2p6JJax3Hc3BW7UQ455l5o +-> ;2e%O0-grease Ct9^D x[W(+5% vo@!Dg~p ?,{ +LvLHWuzvEitBOTvXnva7wk7iSnlW7QO9 +--- EX0W81CgIg/olFdTbVgSOkPo43W81hzOyyUVwC4iNTI +yY;d6#q%G{]Qmv(LG_f~ = + sSiU}2V_rHnS $8 O1|9'#{ +lU7y[MSFG!Ĥ Hb]?BC( jsX4 +?IakP9J>hyob6D.T}hz>A[ F%>E \ No newline at end of file diff --git a/secrets/rekeyed/vps1/28a626290761387828b9c64dc5d6762e-mautrix-whatsapp-env.age b/secrets/rekeyed/vps1/28a626290761387828b9c64dc5d6762e-mautrix-whatsapp-env.age new file mode 100644 index 0000000..c698b5f --- /dev/null +++ b/secrets/rekeyed/vps1/28a626290761387828b9c64dc5d6762e-mautrix-whatsapp-env.age @@ -0,0 +1,8 @@ +age-encryption.org/v1 +-> ssh-ed25519 lOyIlA /lISmmDOngpCBwSzDxvzEwuYzfF7+HvVx79t63wW30o +doVKg72Ayle+ZaLY70mxOzQQQ9h1PbrIuqjTRhOQobs +-> 31A;]V-grease tT@4m2=P +UElYAFZWQ2JzWKFWanbljMj5JA3n7D0s +--- 4p3W3tOSNKA0vMKKAIxGWYHjKXssvdalTwawCr0efpo +Un[y8'@µ#5(xig>ܱ u{ݻ3C\vA@}dKCrY{Y#9q~E +:֓jH+u{7_ʁh_+4'4}8=Gd ״{/lt?J"\xO:QsrGÈ;Po h )$R ssh-ed25519 lOyIlA LfDvF0kXFmP4yGPz9A5uov9DbRfMeLniWQhgnYE3ZA0 +9GkGo/twG1cfOHZgRGAmAcfQlrgQ86QvgehbkleKyz0 +-> GEv|{-grease c)B+5+, \v$ piek +hwIw75OzOhfdScMKrNZ5i+WWh5zcfMryQXdbz81yUkEjWm9P4UVOYee+zz4/PU+t +6nEKEqvPf6RwBOzAlzx72Yi0l+onxh1CHOWRlfU +--- dkZlSoaBUqLnMu25ocR0VwgPr190ZOmcMdxQ3KApFS0 +<ٲ}M9Gdh0[̮ȼajg:J$:^Oe@o1 +r]I>t?XQىAr)ab $8efōz7lf)|jl% +v-!(.qR*yXٵ ii ꐑ c=eЄ>/Ls4-.Yq鉾b|KFc (17ʲKI~>t 4w pȨIquiE\בAZ1`Z \ꤨ˲MUmߝ2z xv(AW6oɶf7)e5R2/`\ \ No newline at end of file diff --git a/secrets/rekeyed/vps1/33aa80cdd327d566b3ad02189b6d105b-mautrix-signal-env.age b/secrets/rekeyed/vps1/33aa80cdd327d566b3ad02189b6d105b-mautrix-signal-env.age new file mode 100644 index 0000000000000000000000000000000000000000..8930742fbaf678e8d6bedfbbe4faecc21d11b02e GIT binary patch literal 545 zcmYdHPt{G$OD?J`D9Oyv)5|YP*Do{V(zR14F3!+RO))YxHMCU7@vrpEaa2gmH}m%> z%q(;CiZV+!D+nuhO>?gFcGWlcO$s!04hYSQbT08J@bu28DCbJ{HjFHHjB+*$|XRA!Xx9q#K@>}^)=U8?V2 zZ|Wj=;fd6hYF- zZMAh;Y>Vv7l^=CA=ex?CPr75F#yaIc|Al29n)9g7aJ~5tqkSvQ z)AG;!YyD-AV9)i=(CNoA4Hvd8?^h&U$PCvs+UF7(9x`if-5%Ayhh8pG)3n>UQ*}xD zo#>Kp{dcySG0GljG+vi;cuv#a*2iaf&#rSc?cR81;}Y=zF(w6Zud2q}mG#C~y#6kf qG@51~_~Hc5eXcv=t|vAh^1Wc1(mVelL*do(a>3hQo;n=8=L-PiOw#uN literal 0 HcmV?d00001