5706498565
Five apps (mastodon, owncloud, mattermost, matrix, stoat) took their generated secrets from the compose-side generator tags PASSWORD_TAG_<n>/RANDOM_TAG_<n>/ HEX_TAG_<n>/VAPID_TAG_<n>. Those mint a fresh secret on every templating run, so a reinstall handed the app a new database password while its data volume kept the one initdb was given, and the app came back up unable to open its own database. Move them to <app>.config as RANDOMIZED* placeholders, reaching the compose via the #LIBREPORTAL|<APP>_<KEY>_TAG| mechanism tags_processor_app_config_values already provides. No new handler: the tag name is derived from the config key, so this is a config line plus a tag per secret. Generation is unchanged — still random on first install; the value is now remembered instead of re-rolled. Also fixes two things this exposed: - The RANDOMIZED* replacers matched unanchored. `sort -u` orders slots lexically (1, 10, 11, 2), so slot 1's pattern rewrote the prefix inside slot 10's placeholder and slots 10+ ended up holding slot 1's secret with a digit glued on — derivable, and invisible because the values weren't byte-identical. Anchoring with \b makes match order irrelevant. Verified at 20 slots across all four placeholder types: 64 keys, 64 distinct values, no prefix collisions. - generateRandomPassword drew from base64 without constraining the mix; measured over 2000 draws, 1 in 40 contained no digit at all. Retry until the result has both a digit and a letter, bounded so a pathological length can't spin. owncloud gains a fix in passing: its compose seeded the admin account from PASSWORD_TAG_2 while the WebUI displayed CFG_OWNCLOUD_ADMIN_PASSWORD, which was generated separately and never used. Both now read the same value. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
102 lines
6.0 KiB
Plaintext
102 lines
6.0 KiB
Plaintext
#
|
|
# =============================================================================
|
|
# GENERAL CONFIGURATION
|
|
# =============================================================================
|
|
# APP_NAME = name of application for use in scripts
|
|
# REQUIRES = comma-separated install prerequisites (see scripts/checks/requirements/check_app_install.sh)
|
|
# COMPOSE_FILE = default for no app_name in docker-compose file name, app if there is
|
|
# BACKUP = if true, include this application in backup operations
|
|
# UPDATE_TYPE = auto: new image builds are applied automatically (a recovery snapshot is taken first), manual: only when you press Update
|
|
# HEALTHCHECK = if true, default docker health checks for that container will be enabled
|
|
# AUTHELIA = if true, use Authelia authentication, if false turned off.
|
|
# HEADSCALE = options : false, local, remote (see general config). e.g false or local,remote
|
|
# ENABLE_REGISTRATION = if true, anyone who can reach the homeserver can create an account on it
|
|
# ADMIN_USERNAME = localpart of the first admin account created at install (the full ID becomes @<name>:<server_name>)
|
|
# ADMIN_PASSWORD = password for that first admin account
|
|
# MONITORING = if true, export this app's metrics to Prometheus + Grafana (needs both apps installed)
|
|
#
|
|
CFG_MATRIX_APP_NAME=matrix
|
|
# A domain and Traefik are hard requirements, not conveniences. Synapse bakes
|
|
# server_name into every event and user ID it has ever signed, and it CANNOT be
|
|
# changed afterwards without throwing the database away — so the homeserver must
|
|
# know its real public name at install time, over real TLS.
|
|
CFG_MATRIX_REQUIRES="domain,traefik"
|
|
CFG_MATRIX_BACKUP=true
|
|
CFG_MATRIX_BACKUP_STRATEGY=auto
|
|
CFG_MATRIX_UPDATE_TYPE=auto
|
|
CFG_MATRIX_COMPOSE_FILE=default
|
|
CFG_MATRIX_HEALTHCHECK=true
|
|
# Must stay false. Authelia's forward-auth would sit in front of /_matrix, which
|
|
# is the API every Matrix client and every federating server speaks — they
|
|
# authenticate with Matrix access tokens and cannot follow an Authelia redirect,
|
|
# so turning this on breaks all clients and federation at once. Synapse can do
|
|
# real SSO against Authelia instead, via the OIDC block in
|
|
# resources/homeserver.yaml.
|
|
CFG_MATRIX_AUTHELIA=false
|
|
CFG_MATRIX_HEADSCALE=false
|
|
CFG_MATRIX_ENABLE_REGISTRATION=false
|
|
CFG_MATRIX_ADMIN_USERNAME=admin
|
|
CFG_MATRIX_ADMIN_PASSWORD=RANDOMIZEDPASSWORD1
|
|
CFG_MATRIX_MONITORING=false
|
|
# Postgres password for the `synapse` role, fed to the compose via
|
|
# #LIBREPORTAL|MATRIX_DB_PASSWORD_TAG| and written into homeserver.yaml by the
|
|
# install hook. Generated on first install and preserved across reinstalls —
|
|
# initdb sets it once when the volume is created, so a regenerated value would
|
|
# leave Synapse unable to open its own database.
|
|
CFG_MATRIX_DB_PASSWORD=RANDOMIZEDPASSWORD2
|
|
#
|
|
# =============================================================================
|
|
# METADATA
|
|
# =============================================================================
|
|
# CATEGORY = application category for grouping
|
|
# TITLE = display name for the application
|
|
# DESCRIPTION = short description of the application
|
|
# LONG_DESCRIPTION = detailed description of the application
|
|
# URL = source repository or documentation URL
|
|
# ACTIONS = available actions for this application
|
|
# REQUIRES_SERVICE = name of another LibrePortal app that must be installed before this one can be configured
|
|
#
|
|
CFG_MATRIX_CATEGORY="communication"
|
|
CFG_MATRIX_TITLE="Matrix"
|
|
CFG_MATRIX_DESCRIPTION="Federated Chat"
|
|
CFG_MATRIX_LONG_DESCRIPTION="Matrix is the open federated chat protocol — Spaces and rooms cover what Discord servers and channels do, with end-to-end encryption and bridges to Discord, IRC and Slack. This installs the Synapse homeserver on Postgres plus the Element web client, on their own subdomains. Because it federates, accounts on this server can talk to every other Matrix server without either side giving up control"
|
|
CFG_MATRIX_URL="https://github.com/element-hq/synapse"
|
|
CFG_MATRIX_ACTIONS="configure|install|restart|shutdown|uninstall"
|
|
CFG_MATRIX_REQUIRES_SERVICE=traefik
|
|
#
|
|
# =============================================================================
|
|
# NETWORK CONFIGURATION
|
|
# =============================================================================
|
|
# DOMAIN = number of domain from the general config, useful when using multiple domains
|
|
# WHITELIST = if true only allow whitelisted ips (see general config), if false allow all
|
|
#
|
|
CFG_MATRIX_DOMAIN=1
|
|
CFG_MATRIX_WHITELIST=false
|
|
CFG_MATRIX_NETWORK=default
|
|
#
|
|
# =============================================================================
|
|
# PORT CONFIGURATION
|
|
# =============================================================================
|
|
# PORT_ = port configuration: app|name|external:internal|access|protocol|login|traefik|webui|description
|
|
# - app: application name
|
|
# - name: service identifier (webui, dns, ssh, etc.)
|
|
# - external:internal: port mapping (external can be 'random' for auto-allocation)
|
|
# - access: 'public' (internet accessible), 'private' (local network only), 'disabled' (not running)
|
|
# - protocol: 'tcp' or 'udp'
|
|
# - login: if true, this port requires basic-auth via Traefik (only meaningful when traefik=true)
|
|
# - traefik: if true, Traefik handles this port (reverse proxy)
|
|
# - webui: if true, this port serves the main web interface
|
|
# - description: human-readable description of the service
|
|
#
|
|
# Two hosts, on purpose. Port 1 is the homeserver API on matrix.<domain>, which
|
|
# becomes server_name — so user IDs read @alice:matrix.<domain>. Port 2 is the
|
|
# Element web client on element.<domain>. Keeping them apart means Synapse can
|
|
# answer /.well-known/matrix/server for itself and federation needs no
|
|
# delegation from the apex domain, which this app has no way to configure.
|
|
#
|
|
# Port 1 must NOT be marked login=true: /_matrix is the client and federation
|
|
# API and basic-auth in front of it locks out every client and every peer.
|
|
#
|
|
CFG_MATRIX_PORT_1="matrix-synapse|homeserver|random:8008|public|tcp|false|true|false|Matrix Homeserver (client + federation API)||matrix"
|
|
CFG_MATRIX_PORT_2="matrix-element|webui|random:80|public|tcp|false|true|true|Element Web Interface||element"
|