hosts/vps1: update mautrix bridges

- Regenerate pickle keys
- Enable double puppeting

hosts/vps1/matrix.nix

@@ -41,8 +41,6 @@ let
       allow = true;
       default = true;
       require = true;
-      pickle_key =
-        if (bridge == "mautrix-whatsapp") then "maunium.net/go/mautrix-whatsapp" else "mautrix.bridge.e2ee";
     };
     provisioning = {
       shared_secret = "disable";
@@ -71,6 +69,24 @@ in
     (inputs.nixpkgs-unstable + /nixos/modules/services/matrix/mautrix-whatsapp.nix)
   ];
 
+  age.secrets = {
+    mautrix-doublepuppet-registration = {
+      rekeyFile = ./secrets/mautrix-doublepuppet-registration.age;
+      mode = "0440";
+      group = "matrix-synapse";
+    };
+    mautrix-signal-env = {
+      rekeyFile = ./secrets/mautrix-signal-env.age;
+      mode = "0440";
+      group = "mautrix-signal";
+    };
+    mautrix-whatsapp-env = {
+      rekeyFile = ./secrets/mautrix-whatsapp-env.age;
+      mode = "0440";
+      group = "mautrix-whatsapp";
+    };
+  };
+
   networking.firewall.allowedTCPPorts = [
     8448 # Matrix federation
   ];
@@ -177,6 +193,9 @@ in
     enable = true;
     enableRegistrationScript = true;
     settings = {
+      app_service_config_files = [
+        config.age.secrets.mautrix-doublepuppet-registration.path
+      ];
       database.name = (if usePostgresql then "psycopg2" else "sqlite3");
       enable_metrics = false;
       enable_registration = false;
@@ -213,16 +232,25 @@ in
 
   services.mautrix-signal = lib.mkIf bridges.signal {
     enable = true;
-    settings = commonBridgeSettings "mautrix-signal";
+    environmentFile = config.age.secrets.mautrix-signal-env.path;
+    settings = lib.recursiveUpdate {
+      encryption = {
+        pickle_key = "$MAUTRIX_SIGNAL_ENCRYPTION_PICKLE_KEY";
+      };
+    } (commonBridgeSettings "mautrix-signal");
   };
 
   services.mautrix-whatsapp = lib.mkIf bridges.whatsapp {
     enable = true;
+    environmentFile = config.age.secrets.mautrix-whatsapp-env.path;
     settings = lib.recursiveUpdate {
       backfill = {
         enabled = true;
         max_initial_messags = 50;
       };
+      encryption = {
+        pickle_key = "$MAUTRIX_WHATSAPP_ENCRYPTION_PICKLE_KEY";
+      };
       network = {
         mute_status_broadcast = true;
         history_sync = {

hosts/vps1/secrets/mautrix-whatsapp-env.age

@@ -0,0 +1,10 @@
+age-encryption.org/v1
+-> piv-p256 a1N2XA Aun1dGh6g8jvPV3vYn1oUoP+LjhV973flcjtVIqtdvHU
+ZJgOWsP2WeQEFImxZfWgv2p6JJax3Hc3BW7UQ455l5o
+-> ;2e%O0-grease Ct9^D x[W(+5% vo@!Dg~p ?,{
+LvLHWuzvEitBOTvXnva7wk7iSnlW7QO9
+--- EX0W81CgIg/olFdTbVgSOkPo43W81hzOyyUVwC4iNTI
+yY<EFBFBD><EFBFBD><EFBFBD>;<3B>d<EFBFBD><64>6#<23>q%G{<12>]<5D>Q<EFBFBD>mv(L<><4C>
<01><>G_<47>f<EFBFBD>~<16>
+<EFBFBD><EFBFBD>=
+<0B><><EFBFBD>
s<><73><11>S<EFBFBD><53>iU<1B><><EFBFBD>}<7D>2<EFBFBD><32><EFBFBD>V<1C>_<EFBFBD><5F>rH<72>n<>S<EFBFBD>	
<01>$<24>8<EFBFBD> O<>1<EFBFBD>|<7C>9'<27><><11>#<03><>{
+<EFBFBD><EFBFBD><06>lU<6C>7y[<5B>MS<12>FG!<21><>Ĥ<EFBFBD><C4A4>H<>b<><62>]?<3F>BC(<0B>j<EFBFBD><0E><>sX<73>4