diff --git a/.env.sample b/.env.sample index fb909aa..d09e311 100644 --- a/.env.sample +++ b/.env.sample @@ -98,8 +98,16 @@ ALLOWED_LIFETIME_MAX=4w #SECRET_TELEGRAM_AS_TOKEN_VERSION=v1 #SECRET_TELEGRAM_HS_TOKEN_VERSION=v1 -COMPOSE_FILE="$COMPOSE_FILE:compose.discord.yml" +#COMPOSE_FILE="$COMPOSE_FILE:compose.discord.yml" #DISCORD_CLIENT_ID= #DISCORD_BRIDGE_ADMIN= #SECRET_DISCORD_BOT_TOKEN_VERSION=v1 #SECRET_DISCORD_DB_PASSWORD_VERSION=v1 + +#COMPOSE_FILE="$COMPOSE_FILE:compose.signal.yml" +#SIGNAL_ENABLE_ENCRYPTION=true +#SIGNAL_BRIDGE_ADMIN_1="@foo:example.com" +#SIGNAL_BRIDGE_ADMIN_2="@bar:example.com" +#SECRET_SIGNAL_AS_TOKEN_VERSION=v1 +#SECRET_SIGNAL_DB_PASSWORD_VERSION=v1 +#SECRET_SIGNAL_HS_TOKEN_VERSION=v1 diff --git a/README.md b/README.md index b2e2785..40323fc 100644 --- a/README.md +++ b/README.md @@ -139,3 +139,18 @@ Some helpful documentation: - [`matrix-org/matrix-appservice-discord` docs](https://github.com/matrix-org/matrix-appservice-discord#bridging-a-room) - [`t2bot.io/discord`](https://t2bot.io/discord/) + +### Signal bridging + +> WIP + +OK, it's also awful to set this up. Do you see a pattern emerging? :) + +- fake that you have the required tokens: + - `abra app secret insert example.com signal_hs_token v1 foo` + - `abra app secret insert example.com signal_as_token v1 foo` +- generate the database password: + - `abra app secret generate example.com -a` +- deploy the thing and then check the `/data/registration.yaml` +- rm the fake `signal_hs/as_token` values and re-insert the new ones from `registration.yaml` +- re-deploy the whole thing and then it should come up, message `@signalbot:example.com` to test diff --git a/abra.sh b/abra.sh index 4b2938d..3d37419 100644 --- a/abra.sh +++ b/abra.sh @@ -3,3 +3,4 @@ export HOMESERVER_YAML_VERSION=v12 export LOG_CONFIG_VERSION=v2 export TELEGRAM_BRIDGE_YAML_VERSION=v2 export DISCORD_BRIDGE_YAML_VERSION=v1 +export SIGNAL_BRIDGE_YAML_VERSION=v1 diff --git a/compose.signal.yml b/compose.signal.yml new file mode 100644 index 0000000..99397ef --- /dev/null +++ b/compose.signal.yml @@ -0,0 +1,81 @@ +--- +version: "3.8" + +services: + app: + environment: + - APP_SERVICES_ENABLED + - APP_SERVICE_CONFIGS + volumes: + - signal-data:/signal-data + + signald: + image: docker.io/signald/signald:0.22.1-non-root + networks: + - internal + volumes: + - signald-data:/signald + + signalbridge: + image: dock.mau.dev/mautrix/signal:v0.4.0 + depends_on: + - signaldb + configs: + - source: signal_bridge_yaml + target: /data/config.yaml + environment: + - HOMESERVER_DOMAIN + - HOMESERVER_URL + - SIGNAL_BRIDGE_ADMIN_1 + - SIGNAL_BRIDGE_ADMIN_2 + - SIGNAL_ENABLE_ENCRYPTION + - VERIFY_SSL + secrets: + - signal_as_token + - signal_db_password + - signal_hs_token + volumes: + - signal-data:/data + - signald-data:/signald + networks: + - internal + + signaldb: + image: postgres:13-alpine + secrets: + - signal_db_password + environment: + - LC_COLLATE=C + - LC_CTYPE=C + - POSTGRES_DB=signalbridge + - POSTGRES_INITDB_ARGS="-E \"UTF8\"" + - POSTGRES_PASSWORD_FILE=/run/secrets/signal_db_password + - POSTGRES_USER=signalbridge + networks: + - internal + healthcheck: + test: ["CMD", "pg_isready", "-U", "synapse"] + volumes: + - signal-postgres:/var/lib/postgresql/data + +configs: + signal_bridge_yaml: + name: ${STACK_NAME}_signal_bridge_yaml_${SIGNAL_BRIDGE_YAML_VERSION} + file: signal_bridge.yaml.tmpl + template_driver: golang + +volumes: + signald-data: + signal-data: + signal-postgres: + +secrets: + signal_db_password: + external: true + name: ${STACK_NAME}_signal_db_password_${SECRET_SIGNAL_DB_PASSWORD_VERSION} + signal_as_token: + external: true + name: ${STACK_NAME}_signal_as_token_${SECRET_SIGNAL_AS_TOKEN_VERSION} + signal_hs_token: + external: true + name: ${STACK_NAME}_signal_hs_token_${SECRET_SIGNAL_HS_TOKEN_VERSION} diff --git a/signal_bridge.yaml.tmpl b/signal_bridge.yaml.tmpl new file mode 100644 index 0000000..055f108 --- /dev/null +++ b/signal_bridge.yaml.tmpl @@ -0,0 +1,326 @@ +# Homeserver details +homeserver: + # The address that this appservice can use to connect to the homeserver. + address: {{ env "HOMESERVER_URL" }} + # The domain of the homeserver (for MXIDs, etc). + domain: {{ env "HOMESERVER_DOMAIN" }} + # Whether or not to verify the SSL certificate of the homeserver. + # Only applies if address starts with https:// + verify_ssl: {{ env "VERIFY_SSL" }} + # What software is the homeserver running? + # Standard Matrix homeservers like Synapse, Dendrite and Conduit should just use "standard" here. + software: standard + # Number of retries for all HTTP requests if the homeserver isn't reachable. + http_retry_count: 4 + # The URL to push real-time bridge status to. + # If set, the bridge will make POST requests to this URL whenever a user's Signal connection state changes. + # The bridge will use the appservice as_token to authorize requests. + status_endpoint: null + # Endpoint for reporting per-message status. + message_send_checkpoint_endpoint: null + # Maximum number of simultaneous HTTP connections to the homeserver. + connection_limit: 100 + # Whether asynchronous uploads via MSC2246 should be enabled for media. + # Requires a media repo that supports MSC2246. + async_media: false + +# Application service host/registration related details +# Changing these values requires regeneration of the registration. +appservice: + # The address that the homeserver can use to connect to this appservice. + address: http://signalbridge:29328 + # When using https:// the TLS certificate and key files for the address. + tls_cert: false + tls_key: false + # The hostname and port where this appservice should listen. + hostname: 0.0.0.0 + port: 29328 + # The maximum body size of appservice API requests (from the homeserver) in mebibytes + # Usually 1 is enough, but on high-traffic bridges you might need to increase this to avoid 413s + max_body_size: 1 + # The full URI to the database. SQLite and Postgres are supported. + # However, SQLite support is extremely experimental and should not be used. + # Format examples: + # SQLite: sqlite:///filename.db + # Postgres: postgres://username:password@hostname/dbname + database: postgres://signalbridge:{{ secret "signal_db_password" }}@signaldb/signalbridge + # Additional arguments for asyncpg.create_pool() or sqlite3.connect() + # https://magicstack.github.io/asyncpg/current/api/index.html#asyncpg.pool.create_pool + # https://docs.python.org/3/library/sqlite3.html#sqlite3.connect + # For sqlite, min_size is used as the connection thread pool size and max_size is ignored. + # Additionally, SQLite supports init_commands as an array of SQL queries to run on connect (e.g. to set PRAGMAs). + database_opts: + min_size: 1 + max_size: 10 + # The unique ID of this appservice. + id: signal + # Username of the appservice bot. + bot_username: signalbot + # Display name and avatar for bot. Set to "remove" to remove display name/avatar, leave empty + # to leave display name/avatar as-is. + bot_displayname: Signal bridge bot + bot_avatar: mxc://maunium.net/wPJgTQbZOtpBFmDNkiNEMDUp + # Whether or not to receive ephemeral events via appservice transactions. + # Requires MSC2409 support (i.e. Synapse 1.22+). + # You should disable bridge -> sync_with_custom_puppets when this is enabled. + ephemeral_events: true + # Authentication tokens for AS <-> HS communication. Autogenerated; do not modify. + as_token: "{{ secret "signal_as_token" }}" + hs_token: "{{ secret "signal_hs_token" }}" + +# Prometheus telemetry config. Requires prometheus-client to be installed. +metrics: + enabled: false + listen_port: 8000 + +# Manhole config. +manhole: + # Whether or not opening the manhole is allowed. + enabled: false + # The path for the unix socket. + path: /var/tmp/mautrix-signal.manhole + # The list of UIDs who can be added to the whitelist. + # If empty, any UIDs can be specified in the open-manhole command. + whitelist: + - 0 + +signal: + # Path to signald unix socket + socket_path: /signald/signald.sock + # Directory for temp files when sending files to Signal. This should be an + # absolute path that signald can read. For attachments in the other direction, + # make sure signald is configured to use an absolute path as the data directory. + outgoing_attachment_dir: /signald/attachments + # Directory where signald stores avatars for groups. + avatar_dir: /signald/avatars + # Directory where signald stores auth data. Used to delete data when logging out. + data_dir: /signald/data + # Whether or not unknown signald accounts should be deleted when the bridge is started. + # When this is enabled, any UserInUse errors should be resolved by restarting the bridge. + delete_unknown_accounts_on_start: false + # Whether or not message attachments should be removed from disk after they're bridged. + remove_file_after_handling: true + # Whether or not users can register a primary device + registration_enabled: true + # Whether or not to enable disappearing messages in groups. If enabled, then the expiration + # time of the messages will be determined by the first users to read the message, rather + # than individually. If the bridge has a single user, this can be turned on safely. + enable_disappearing_messages_in_groups: false + +# Bridge config +bridge: + # Localpart template of MXIDs for Signal users. + # {userid} is replaced with an identifier for the Signal user. + username_template: "signal_{userid}" + # Displayname template for Signal users. + # {displayname} is replaced with the displayname of the Signal user, which is the first + # available variable in displayname_preference. The variables in displayname_preference + # can also be used here directly. + displayname_template: "{displayname} (Signal)" + # Whether or not contact list displaynames should be used. + # Possible values: disallow, allow, prefer + # + # Multi-user instances are recommended to disallow contact list names, as otherwise there can + # be conflicts between names from different users' contact lists. + contact_list_names: disallow + # Available variables: full_name, first_name, last_name, phone, uuid + displayname_preference: + - full_name + - phone + # Whether or not to create portals for all groups on login/connect. + autocreate_group_portal: true + # Whether or not to create portals for all contacts on login/connect. + autocreate_contact_portal: false + # Whether or not to make portals of Signal groups in which joining via invite link does + # not need to be approved by an administrator publicly joinable on Matrix. + public_portals: false + # Whether or not to use /sync to get read receipts and typing notifications + # when double puppeting is enabled + sync_with_custom_puppets: false + # Whether or not to update the m.direct account data event when double puppeting is enabled. + # Note that updating the m.direct event is not atomic (except with mautrix-asmux) + # and is therefore prone to race conditions. + sync_direct_chat_list: false + # Allow using double puppeting from any server with a valid client .well-known file. + double_puppet_allow_discovery: false + # Servers to allow double puppeting from, even if double_puppet_allow_discovery is false. + double_puppet_server_map: + example.com: https://example.com + # Shared secret for https://github.com/devture/matrix-synapse-shared-secret-auth + # + # If set, custom puppets will be enabled automatically for local users + # instead of users having to find an access token and run `login-matrix` + # manually. + # If using this for other servers than the bridge's server, + # you must also set the URL in the double_puppet_server_map. + login_shared_secret_map: + example.com: foo + # Whether or not created rooms should have federation enabled. + # If false, created portal rooms will never be federated. + federate_rooms: true + # End-to-bridge encryption support options. + # + # See https://docs.mau.fi/bridges/general/end-to-bridge-encryption.html for more info. + encryption: + # Allow encryption, work in group chat rooms with e2ee enabled + allow: {{ env "SIGNAL_ENABLE_ENCRYPTION" }} + # Default to encryption, force-enable encryption in all portals the bridge creates + # This will cause the bridge bot to be in private chats for the encryption to work properly. + default: false + # Whether to use MSC2409/MSC3202 instead of /sync long polling for receiving encryption-related data. + appservice: false + # Require encryption, drop any unencrypted messages. + require: false + # Enable key sharing? If enabled, key requests for rooms where users are in will be fulfilled. + # You must use a client that supports requesting keys from other users to use this feature. + allow_key_sharing: false + # What level of device verification should be required from users? + # + # Valid levels: + # unverified - Send keys to all device in the room. + # cross-signed-untrusted - Require valid cross-signing, but trust all cross-signing keys. + # cross-signed-tofu - Require valid cross-signing, trust cross-signing keys on first use (and reject changes). + # cross-signed-verified - Require valid cross-signing, plus a valid user signature from the bridge bot. + # Note that creating user signatures from the bridge bot is not currently possible. + # verified - Require manual per-device verification + # (currently only possible by modifying the `trust` column in the `crypto_device` database table). + verification_levels: + # Minimum level for which the bridge should send keys to when bridging messages from Telegram to Matrix. + receive: unverified + # Minimum level that the bridge should accept for incoming Matrix messages. + send: unverified + # Minimum level that the bridge should require for accepting key requests. + share: cross-signed-tofu + # Options for Megolm room key rotation. These options allow you to + # configure the m.room.encryption event content. See: + # https://spec.matrix.org/v1.3/client-server-api/#mroomencryption for + # more information about that event. + rotation: + # Enable custom Megolm room key rotation settings. Note that these + # settings will only apply to rooms created after this option is + # set. + enable_custom: false + # The maximum number of milliseconds a session should be used + # before changing it. The Matrix spec recommends 604800000 (a week) + # as the default. + milliseconds: 604800000 + # The maximum number of messages that should be sent with a given a + # session before changing it. The Matrix spec recommends 100 as the + # default. + messages: 100 + # Whether or not to explicitly set the avatar and room name for private + # chat portal rooms. This will be implicitly enabled if encryption.default is true. + private_chat_portal_meta: false + # Whether or not the bridge should send a read receipt from the bridge bot when a message has + # been sent to Signal. This let's you check manually whether the bridge is receiving your + # messages. + # Note that this is not related to Signal delivery receipts. + delivery_receipts: false + # Whether or not delivery errors should be reported as messages in the Matrix room. + delivery_error_reports: true + # Whether the bridge should send the message status as a custom com.beeper.message_send_status event. + message_status_events: false + # Set this to true to tell the bridge to re-send m.bridge events to all rooms on the next run. + # This field will automatically be changed back to false after it, + # except if the config file is not writable. + resend_bridge_info: false + # Interval at which to resync contacts (in seconds). + periodic_sync: 0 + # Should leaving the room on Matrix make the user leave on Signal? + bridge_matrix_leave: true + # Provisioning API part of the web server for automated portal creation and fetching information. + # Used by things like mautrix-manager (https://github.com/tulir/mautrix-manager). + provisioning: + # Whether or not the provisioning API should be enabled. + enabled: true + # The prefix to use in the provisioning API endpoints. + prefix: /_matrix/provision + # The shared secret to authorize users of the API. + # Set to "generate" to generate and save a new token. + shared_secret: generate + # Segment API key to enable analytics tracking for web server + # endpoints. Set to null to disable. + # Currently the only events are login start, QR code scan, and login + # success/failure. + segment_key: null + # The prefix for commands. Only required in non-management rooms. + command_prefix: "!signal" + # Messages sent upon joining a management room. + # Markdown is supported. The defaults are listed below. + management_room_text: + # Sent when joining a room. + welcome: "Hello, I'm a Signal bridge bot." + # Sent when joining a management room and the user is already logged in. + welcome_connected: "Use `help` for help." + # Sent when joining a management room and the user is not logged in. + welcome_unconnected: "Use `help` for help or `link` to log in." + # Optional extra text sent when joining a management room. + additional_help: "" + # Send each message separately (for readability in some clients) + management_room_multiple_messages: false + # Permissions for using the bridge. + # Permitted values: + # relay - Allowed to be relayed through the bridge, no access to commands. + # user - Use the bridge with puppeting. + # admin - Use and administrate the bridge. + # Permitted keys: + # * - All Matrix users + # domain - All users on that homeserver + # mxid - Specific user + permissions: + "*": "relay" + "{{ env "SIGNAL_BRIDGE_ADMIN_1" }}": "admin" + "{{ env "SIGNAL_BRIDGE_ADMIN_2" }}": "admin" + relay: + # Whether relay mode should be allowed. If allowed, `!signal set-relay` can be used to turn any + # authenticated user into a relaybot for that chat. + enabled: false + # The formats to use when sending messages to Signal via a relay user. + # + # Available variables: + # $sender_displayname - The display name of the sender (e.g. Example User) + # $sender_username - The username (Matrix ID localpart) of the sender (e.g. exampleuser) + # $sender_mxid - The Matrix ID of the sender (e.g. @exampleuser:example.com) + # $message - The message content + message_formats: + m.text: '$sender_displayname: $message' + m.notice: '$sender_displayname: $message' + m.emote: '* $sender_displayname $message' + m.file: '$sender_displayname sent a file' + m.image: '$sender_displayname sent an image' + m.audio: '$sender_displayname sent an audio file' + m.video: '$sender_displayname sent a video' + m.location: '$sender_displayname sent a location' + # Specify a dedicated relay account. Must be a regular matrix account logged into this bridge + # and double puppeting working to auto-accept invites. When this user is invited to a room + # it will automatically be set as the relay user. May be overridden with `set-relay` or `unset-relay` + relaybot: '@relaybot:example.com' + # Format for generting URLs from location messages for sending to Signal + # Google Maps: 'https://www.google.com/maps/place/{lat},{long}' + # OpenStreepMap: 'https://www.openstreetmap.org/?mlat={lat}&mlon={long}' + location_format: 'https://www.google.com/maps/place/{lat},{long}' + +# Python logging configuration. +# +# See section 16.7.2 of the Python documentation for more info: +# https://docs.python.org/3.6/library/logging.config.html#configuration-dictionary-schema +logging: + version: 1 + formatters: + colored: + (): mautrix_signal.util.ColorFormatter + format: "[%(asctime)s] [%(levelname)s@%(name)s] %(message)s" + normal: + format: "[%(asctime)s] [%(levelname)s@%(name)s] %(message)s" + handlers: + console: + class: logging.StreamHandler + formatter: colored + loggers: + mau: + level: DEBUG + aiohttp: + level: INFO + root: + level: DEBUG + handlers: [console]