bicep/matrix: use sops templates for appservice registrations

hosts/bicep/services/matrix/discord.nix

@@ -6,15 +6,42 @@ in
 {
   users.groups.keys-matrix-registrations = { };
 
-  sops.secrets."matrix/registrations/mx-puppet-discord" = {
+  sops.secrets."matrix/discord/as_token" = {
     sopsFile = ../../../../secrets/bicep/matrix.yaml;
-    key = "registrations/mx-puppet-discord";
+    key = "discord/as_token";
+  };
+  sops.secrets."matrix/discord/hs_token" = {
+    sopsFile = ../../../../secrets/bicep/matrix.yaml;
+    key = "discord/hs_token";
+  };
+
+  sops.templates."discord-registration.yaml" = {
     owner = config.users.users.matrix-synapse.name;
     group = config.users.groups.keys-matrix-registrations.name;
+    content = ''
+      as_token: "${config.sops.placeholder."matrix/discord/as_token"}"
+      hs_token: "${config.sops.placeholder."matrix/discord/hs_token"}"
+      id: discord-puppet
+      namespaces:
+        users:
+          - exclusive: true
+            regex: '@_discordpuppet_.*'
+        rooms: []
+        aliases:
+          - exclusive: true
+            regex: '#_discordpuppet_.*'
+      protocols: []
+      rate_limited: false
+      sender_localpart: _discordpuppet_bot
+      url: 'http://localhost:8434'
+      de.sorunome.msc2409.push_ephemeral: true
+    '';
   };
 
   systemd.services.mx-puppet-discord = {
-    serviceConfig.SupplementaryGroups = [ config.users.groups.keys-matrix-registrations.name ];
+    serviceConfig.SupplementaryGroups = [
+      config.users.groups.keys-matrix-registrations.name
+    ];
   };
 
 
@@ -29,11 +56,16 @@ in
     relay.whitelist = [ ".*" ];
     selfService.whitelist = [ "@danio:pvv\\.ntnu\\.no" "@dandellion:dodsorf\\.as" ];
   };
-  services.mx-puppet-discord.serviceDependencies = [ "matrix-synapse.target" "nginx.service" ];
+  services.mx-puppet-discord.serviceDependencies = [
+    "matrix-synapse.target"
+    "nginx.service"
+  ];
 
 
   services.matrix-synapse-next.settings = {
-    app_service_config_files = [ config.sops.secrets."matrix/registrations/mx-puppet-discord".path ];
+    app_service_config_files = [
+      config.sops.templates."discord-registration.yaml".path
+    ];
     use_appservice_legacy_authorization = true;
   };
 

hosts/bicep/services/matrix/hookshot/default.nix

@@ -10,21 +10,52 @@ in
     ./module.nix
   ];
 
-  sops.secrets."matrix/registrations/matrix-hookshot" = {
+  sops.secrets."matrix/hookshot/as_token" = {
     sopsFile = ../../../../../secrets/bicep/matrix.yaml;
-    key = "registrations/matrix-hookshot";
+    key = "hookshot/as_token";
+  };
+  sops.secrets."matrix/hookshot/hs_token" = {
+    sopsFile = ../../../../../secrets/bicep/matrix.yaml;
+    key = "hookshot/hs_token";
+  };
+
+  sops.templates."hookshot-registration.yaml" = {
     owner = config.users.users.matrix-synapse.name;
     group = config.users.groups.keys-matrix-registrations.name;
+    content = ''
+      id: matrix-hookshot
+      as_token: "${config.sops.placeholder."matrix/hookshot/as_token"}"
+      hs_token: "${config.sops.placeholder."matrix/hookshot/hs_token"}"
+      namespaces:
+        rooms: []
+        users:
+          - regex: "@_webhooks_.*:pvv.ntnu.no"
+            exclusive: true
+          - regex: "@bot_feeds:pvv.ntnu.no"
+            exclusive: true
+        aliases: []
+
+      sender_localpart: hookshot
+      url: "http://${cfg.settings.bridge.bindAddress}:${toString cfg.settings.bridge.port}"
+      rate_limited: false
+
+      # If enabling encryption
+      de.sorunome.msc2409.push_ephemeral: true
+      push_ephemeral: true
+      org.matrix.msc3202: true
+    '';
   };
 
   systemd.services.matrix-hookshot = {
-    serviceConfig.SupplementaryGroups = [ config.users.groups.keys-matrix-registrations.name ];
+    serviceConfig.SupplementaryGroups = [
+      config.users.groups.keys-matrix-registrations.name
+    ];
   };
 
   services.matrix-hookshot = {
     enable = true;
     package = unstablePkgs.matrix-hookshot;
-    registrationFile = config.sops.secrets."matrix/registrations/matrix-hookshot".path;
+    registrationFile = config.sops.templates."hookshot-registration.yaml".path;
     settings = {
       bridge = {
         bindAddress = "127.0.0.1";
@@ -88,10 +119,15 @@ in
     };
   };
 
-  services.matrix-hookshot.serviceDependencies = [ "matrix-synapse.target" "nginx.service" ];
+  services.matrix-hookshot.serviceDependencies = [
+    "matrix-synapse.target"
+    "nginx.service"
+  ];
 
   services.matrix-synapse-next.settings = {
-    app_service_config_files = [ config.sops.secrets."matrix/registrations/matrix-hookshot".path ];
+    app_service_config_files = [
+      config.sops.templates."hookshot-registration.yaml".path
+    ];
   };
 
   services.nginx.virtualHosts."hookshot.pvv.ntnu.no" = {

secrets/bicep/matrix.yaml

@@ -6,9 +6,12 @@ coturn:
     static-auth-secret: ENC[AES256_GCM,data:y5cG/LyrorkDH+8YrgcV7DY=,iv:ca90q2J3+NOy51mUBy4TMKfYMgWL4hxWDdsKIuxRBgU=,tag:hpFCns1lpi07paHyGB7tGQ==,type:str]
 mjolnir:
     access_token: ENC[AES256_GCM,data:ERFqZjK7MRD0xWt91FNCIxP1YC6Qj54QgnckHlCTtcQVLWaM1h2h9lHS+K8=,iv:1d7vmFkXAPcsmumzlmOT31amdrKLWtL5sJiS8G9g+LE=,tag:2l0vWzJ6P12ofuBdf5CCWw==,type:str]
-registrations:
+discord:
-    mx-puppet-discord: ENC[AES256_GCM,data:FleyXxgOmc05nTP6M2DBJlacufN3p/05eZm4kB8+K4ci0k24o3zli988wlM/kyeZmxu4pgQlJ3lNLte4uip2hBXHWG5t5Ldzmr7bNCUD+r7nM+I1lfNkrDROPZ54bHysmn9O5CHpEa16rSo6RJgncIPqsLJxTwjC7qZlkOpzqvMhkq/MHCVOpvg0M/6AUR+AlSZoggujBMoXLznQNQapN13foEsbuo/QxjszM/ObGmhYMVyaS+TDBXzQLA8Yuj50Q/gZCIINWZ4G2qmgsGxxNR4I+usUQml/jxCtIXS4zn/ettXfL9G4Fdm2F9u1v11DehtTGa5xoxDq94M9rIxOqeJpvgEQEyyKAyFUIrlINfGl7tAj4Zu7+9Z8JTRAnppjM1q8iInwn/Z2L9KgB0YFi/Go1whgXly+TH6hpreo7m5klXV/ff/aV3ghOgFCGA8nBrZFqE8Uw268q9tV1s1dxCb6TbpGf19V5c9MD6BsCIVeoq+j9I/I8iZpzg2Reb4IlHhMDwbwsL2w2ks30wiZ9XO/CFrXDY4uBlI=,iv:3vvkGvldS8Raibg6tzlV8VY1O9NCLxSuNX/lwi1QgiA=,tag:D/noIsE3xlOiYM6Pk+cc8Q==,type:str]
+    as_token: ENC[AES256_GCM,data:cnPZjBbODZUA1p0kLNeWpKh1oGkDPxDw/g7163XnoRCIgpqk,iv:Uu4L36uDPMBgzdXE2Lt9U0qrBSl3Xuufh1313BD8B/U=,tag:nTm6s7IGd4vNzZ95mfxDpA==,type:str]
-    matrix-hookshot: ENC[AES256_GCM,data:fBt9h6gRkEc7QLpeIJhOpizZwA9By89PjgEKNCOqrdnfbWfBk3ueol2W4DU1vcsjNpOpTsvwAm5KmoqhBIEpjGaycwtt9c399/dJGP6YQC3puk3c4Psz2C+SZJgk4erJ8GOeiUT7kjUkxAOgU+Hl+TteWSYylgd7PGVElJa0oXIbaxkpHZXuk42VlZl/bny4Fw3ckW19+2iuPbZtflmPrGNvGHuCSc6IwQC665/HmPJzENruLcqirICqgy7l9ZnkbrVqVabQTcLqa8GVM7zcpXzsoAMOuRdM3rvEPyaruPcBbemvlQnM1p/2NEnjDwbRKaZr1FtDpBnuEkQwHf1AQyOKZLJLEdqqDRiYrH27/Ps+voMQjZeB+IcPqbBBcdrF0DpFclWOKbNYWci2qW2Zpni242nJM4vVKQPfqi+UJSqhDjs1czDN2Z2stuyt+N1Nv3ykmfjSJz2/HeqYHTti6kkbxfcB2rDdwYWYNlrvTTsvzOewvhY8t0JImBHXiJtp2Zs/ej6p63cuto9RiU55JifJrQx8Fq0BEHeAzcmT39lHzXd/EQoCJqStz2/lnLMfzff5zlRkl4FgSaBoxoWs6DjLztysC/ibwcn92HI8pHRUc41jLslQLT//dV5QBOyW7F2JyCe/A4J5VEVphn3xLqLC/1xH0pwNaevWxR5hqPzm9XC9zn4UV3OMzVj76xDxywh3QaC3B7ZdHlOoyKNXeL5UDhmDjXbGyrxP1HdOAfITpafS9tbfCYROp31j0Q32PC5fUvEjbVYMq5do17/+MEfVdk4p695N3cqLnyoinh0u7KZZw7Im80mk0+zJrChy6D6dVAEZd/AQFgvcY2q3cbOWA/EuniCZrVFAp9u/mljPdeO3MZiJSc7MyElo2CD0YllZeE+KYoHQrIgWJZ6TiItVk3CyLGsYfqNDcJ+o6iicqAdsCiF9IeXO/BfscN2o5sbcvmAShdxCqCYYVtb3Fp6or7bIUf16fq1jkz4XkGwEj+VT9JTXjRbavx5O74VpnyIuTzI7oXYIU4ZUVI5Fkw==,iv:2ffGONfuT9GUVxEStQoZftYUFQc/HcnSLNpZG1t1oCM=,tag:idETgOr/XgfpueTt3gPLHQ==,type:str]
+    hs_token: ENC[AES256_GCM,data:UzcaNsJtJPKvFT4gQDNfat0nmyJzmQ6OcSI73pANibzOVrWl,iv:ujgRM2jb1rbeloPB4UPLBEvQ7uue4a+bHiqsZAHIqtk=,tag:uIfuaTWSTeVvpQx5o28HPA==,type:str]
+hookshot:
+    as_token: ENC[AES256_GCM,data:L4vEw5r4RhcgritOeDTLHN5E/dM=,iv:pC8BLzxf6NaVAGsotoq6chOceBVdMLvrsQn1LGw9H9w=,tag:SI3CDFHAvgQZEvf/oms3EA==,type:str]
+    hs_token: ENC[AES256_GCM,data:2ufSJfYzzAB5IO+edwKSra5d/+M=,iv:cmTycGzNL+IeRRKZGbkhTtiksYTtbxED0k0B5haFw7k=,tag:FmWe5sGi9rlapUeAE6lKvg==,type:str]
 sops:
     kms: []
     gcp_kms: []
@@ -69,8 +72,8 @@ sops:
             WEh5NFN6SFF1TlltdWFWTGw4MHRHUkUKrKIvC87xjEmwxPQhH8dN+ZuaJTCgPY28
             pR62KxmoKFICLTHPpYP3euiAx5M9BWvgvCnA/US/5klpk8MtlreNFA==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2024-10-13T05:04:30Z"
+    lastmodified: "2024-10-13T23:30:01Z"
-    mac: ENC[AES256_GCM,data:Qtw6ZPxUIp28fw1xFR72Utt+aZZXcXOOJO9lwCsZEsqMKPCtxwNw2NumB4aEBuv16dL14boy/FRtwq0mu/DyA6zgnOeeEzxlcxtFAkqK2A03ZMGEIGYTdB3sBDb2Rm7gnK7J9ypoxb0EP40x18lErk7Cn54B28DPlCkY/tj4B/0=,iv:MRXfroBOUCeWKknjDTfUNNHH91cCkf3vUFAAP+UIN7Y=,tag:awdtYAtmMP2Y72m8PlmgwA==,type:str]
+    mac: ENC[AES256_GCM,data:vdsAZmg7gPqzeucBhLhPemtRVkcxRecIdB6PXZ4paU+Uv5UorBKcTZ3jseN2cLi6ot3ycTIm+UI6uhlCy87vAJVynVJhuJS+ICFRS2+DfoVyuttLjZQGC2sr3+dEBHxIH7sZJSo9PIzbIWw3qHrpOPAZj0//1pFyp/k15k3vidM=,iv:jWtV+WAPt08lgdrVvtXOl35rDB4QflkZWuGBW1+ESyw=,tag:YxSHncZZOAW5uDxXtb/krw==,type:str]
     pgp:
         - created_at: "2024-08-04T00:03:46Z"
           enc: |-