jason.woltje
2698ddb7b5
Co-authored-by: jason.woltje <jason@diversecanvas.com> Co-committed-by: jason.woltje <jason@diversecanvas.com>
109 lines
4.8 KiB
Bash
Executable File
109 lines
4.8 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# ============================================================================
|
|
# dev-up.sh — bring up the DEV Synapse for RFC-001 P1 (presence)
|
|
# ============================================================================
|
|
#
|
|
# *** DEV-ONLY. LOCAL SANDBOX. This script must never be pointed at live
|
|
# infra. It writes only into infra/matrix/.data (gitignored) and drives
|
|
# a dedicated compose project (matrix-p1-dev). ***
|
|
#
|
|
# It renders the Synapse config + appservice registration from the committed
|
|
# templates (envsubst), generates a DEV signing key + self-signed TLS cert,
|
|
# and starts Synapse. All topology facts come from the environment with dev
|
|
# defaults (RFC-002 G2: nothing hardcoded).
|
|
# ----------------------------------------------------------------------------
|
|
set -euo pipefail
|
|
|
|
HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
DATA="${HERE}/.data"
|
|
COMPOSE=(docker compose -f "${HERE}/docker-compose.dev.yml")
|
|
|
|
# ---- Topology inputs (dev defaults; override via env) ----------------------
|
|
export MATRIX_SERVER_NAME="${MATRIX_SERVER_NAME:-matrix.localhost}"
|
|
export MOSAIC_AS_ID="${MOSAIC_AS_ID:-mosaic-as}"
|
|
export MATRIX_HTTP_PORT="${MATRIX_HTTP_PORT:-18008}"
|
|
export MATRIX_TLS_PORT="${MATRIX_TLS_PORT:-18448}"
|
|
|
|
# ---- DEV secrets (throwaway; regenerated if absent) ------------------------
|
|
SECRETS_ENV="${DATA}/dev-secrets.env"
|
|
mkdir -p "${DATA}"
|
|
if [[ ! -f "${SECRETS_ENV}" ]]; then
|
|
{
|
|
echo "MOSAIC_AS_TOKEN=devas_$(openssl rand -hex 16)"
|
|
echo "MOSAIC_HS_TOKEN=devhs_$(openssl rand -hex 16)"
|
|
echo "SYNAPSE_REG_SHARED_SECRET=devreg_$(openssl rand -hex 16)"
|
|
echo "SYNAPSE_MACAROON_SECRET=devmac_$(openssl rand -hex 16)"
|
|
echo "SYNAPSE_FORM_SECRET=devform_$(openssl rand -hex 16)"
|
|
} > "${SECRETS_ENV}"
|
|
echo "[dev-up] generated throwaway DEV secrets -> ${SECRETS_ENV}"
|
|
fi
|
|
# shellcheck disable=SC1090
|
|
set -a; source "${SECRETS_ENV}"; set +a
|
|
|
|
# DEV: let the synapse container user (uid 991) write the sqlite db / media.
|
|
chmod 0777 "${DATA}" || true
|
|
|
|
# ---- Render config from templates ------------------------------------------
|
|
envsubst < "${HERE}/synapse/homeserver.dev.yaml.tpl" > "${DATA}/homeserver.yaml"
|
|
envsubst < "${HERE}/appservice/mosaic-as.dev.yaml.tpl" > "${DATA}/${MOSAIC_AS_ID}.yaml"
|
|
cp "${HERE}/synapse/log.config" "${DATA}/log.config"
|
|
echo "[dev-up] rendered homeserver.yaml + ${MOSAIC_AS_ID}.yaml (server_name=${MATRIX_SERVER_NAME})"
|
|
|
|
# ---- DEV signing key -------------------------------------------------------
|
|
# Generate as the synapse container user (uid 991) so the running container
|
|
# can read it; owned-by-991 mode-600 is fine (the container IS 991).
|
|
SIGNING_KEY="${DATA}/${MATRIX_SERVER_NAME}.signing.key"
|
|
if [[ ! -f "${SIGNING_KEY}" ]]; then
|
|
docker run --rm --user 991:991 -v "${DATA}:/data" --entrypoint generate_signing_key \
|
|
matrixdotorg/synapse:latest -o "/data/${MATRIX_SERVER_NAME}.signing.key"
|
|
echo "[dev-up] generated DEV signing key"
|
|
fi
|
|
|
|
# ---- DEV self-signed TLS cert (A1) -----------------------------------------
|
|
if [[ ! -f "${DATA}/dev-cert.pem" ]]; then
|
|
openssl req -x509 -newkey rsa:2048 -nodes \
|
|
-keyout "${DATA}/dev-key.pem" -out "${DATA}/dev-cert.pem" \
|
|
-days 90 -subj "/CN=${MATRIX_SERVER_NAME}" \
|
|
-addext "subjectAltName=DNS:${MATRIX_SERVER_NAME},DNS:localhost,IP:127.0.0.1" >/dev/null 2>&1
|
|
echo "[dev-up] generated DEV self-signed TLS cert for ${MATRIX_SERVER_NAME}"
|
|
fi
|
|
# Files hermes owns must be world-readable so the synapse (uid 991) container
|
|
# can read them (DEV-only; the signing key stays owned by 991 from above).
|
|
chmod 0644 "${DATA}/dev-cert.pem" "${DATA}/dev-key.pem" \
|
|
"${DATA}/homeserver.yaml" "${DATA}/${MOSAIC_AS_ID}.yaml" "${DATA}/log.config" || true
|
|
|
|
# ---- Element config (optional human view, A4) ------------------------------
|
|
cat > "${DATA}/element-config.json" <<JSON
|
|
{
|
|
"default_server_config": {
|
|
"m.homeserver": {
|
|
"base_url": "https://localhost:${MATRIX_TLS_PORT}",
|
|
"server_name": "${MATRIX_SERVER_NAME}"
|
|
}
|
|
},
|
|
"disable_guests": true,
|
|
"brand": "Mosaic P1 (DEV)"
|
|
}
|
|
JSON
|
|
|
|
# ---- Boot ------------------------------------------------------------------
|
|
"${COMPOSE[@]}" up -d synapse
|
|
|
|
echo -n "[dev-up] waiting for Synapse health"
|
|
for _ in $(seq 1 60); do
|
|
status="$("${COMPOSE[@]}" ps --format '{{.Health}}' synapse 2>/dev/null || true)"
|
|
if [[ "${status}" == "healthy" ]]; then echo " ... healthy"; break; fi
|
|
echo -n "."; sleep 2
|
|
done
|
|
|
|
if ! curl -fsS "http://127.0.0.1:${MATRIX_HTTP_PORT}/health" >/dev/null 2>&1; then
|
|
echo "[dev-up] ERROR: Synapse did not become healthy" >&2
|
|
"${COMPOSE[@]}" logs --tail 60 synapse >&2 || true
|
|
exit 1
|
|
fi
|
|
|
|
echo "[dev-up] Synapse UP:"
|
|
echo " plain HTTP : http://127.0.0.1:${MATRIX_HTTP_PORT}"
|
|
echo " TLS : https://127.0.0.1:${MATRIX_TLS_PORT} (self-signed, DEV)"
|
|
echo " server_name: ${MATRIX_SERVER_NAME} registration: OFF"
|