mirror of
https://github.com/prdlk/vortex.git
synced 2026-08-02 17:31:41 +00:00
56 lines
2.2 KiB
Bash
56 lines
2.2 KiB
Bash
|
#!/bin/bash
|
||
|
|
# One-shot post-synapse provisioning: create admin user (idempotent) and
|
||
|
|
# write /data/shared/credentials.json for the TUI and MCP server.
|
||
|
|
set -euo pipefail
|
||
|
|
|
||
|
|
DATA=/data
|
||
|
|
DOMAIN=${MATRIX_SERVER_NAME:-localhost}
|
||
|
|
USER=${MATRIX_USER:-admin}
|
||
|
|
PASS=${MATRIX_PASSWORD:?}
|
||
|
|
MXID="@${USER}:${DOMAIN}"
|
||
|
|
HS=http://synapse:8008
|
||
|
|
REG_SECRET=$(cat $DATA/secrets/registration_shared_secret 2>/dev/null || true)
|
||
|
|
|
||
|
|
log() { echo "[provision] $*"; }
|
||
|
|
|
||
|
|
# already provisioned and token still valid? then no-op
|
||
|
|
if [ -f "$DATA/shared/credentials.json" ]; then
|
||
|
|
TOK=$(yq -p json '.access_token' "$DATA/shared/credentials.json")
|
||
|
|
if curl -sf -H "Authorization: Bearer $TOK" "$HS/_matrix/client/v3/account/whoami" >/dev/null; then
|
||
|
|
log "credentials already valid, nothing to do"
|
||
|
|
exit 0
|
||
|
|
fi
|
||
|
|
fi
|
||
|
|
|
||
|
|
login() {
|
||
|
|
curl -sf -X POST "$HS/_matrix/client/v3/login" \
|
||
|
|
-d "{\"type\":\"m.login.password\",\"identifier\":{\"type\":\"m.id.user\",\"user\":\"$USER\"},\"password\":$(python3 -c "import json,sys;print(json.dumps(sys.argv[1]))" "$PASS"),\"initial_device_display_name\":\"provision\"}"
|
||
|
|
}
|
||
|
|
|
||
|
|
RESP=$(login || true)
|
||
|
|
if [ -z "$RESP" ]; then
|
||
|
|
log "admin user missing, registering $MXID"
|
||
|
|
NONCE=$(curl -sf "$HS/_synapse/admin/v1/register" | yq -p json '.nonce')
|
||
|
|
MAC=$(printf '%s\0%s\0%s\0admin' "$NONCE" "$USER" "$PASS" | openssl dgst -sha1 -hmac "$REG_SECRET" | awk '{print $NF}')
|
||
|
|
RESP=$(python3 - "$NONCE" "$USER" "$PASS" "$MAC" <<'EOF' | curl -sf -X POST "$HS/_synapse/admin/v1/register" -d @-
|
||
|
|
import json, sys
|
||
|
|
n, u, p, m = sys.argv[1:5]
|
||
|
|
print(json.dumps({"nonce": n, "username": u, "password": p, "admin": True, "mac": m}))
|
||
|
|
EOF
|
||
|
|
)
|
||
|
|
[ -n "$RESP" ] || { log "registration failed"; exit 1; }
|
||
|
|
fi
|
||
|
|
|
||
|
|
TOKEN=$(echo "$RESP" | yq -p json '.access_token')
|
||
|
|
DEVICE=$(echo "$RESP" | yq -p json '.device_id')
|
||
|
|
|
||
|
|
python3 - "$HS" "$MXID" "$PASS" "$TOKEN" "$DEVICE" <<'EOF' > $DATA/shared/credentials.json.new
|
||
|
|
import json, sys
|
||
|
|
hs, mxid, pw, tok, dev = sys.argv[1:6]
|
||
|
|
print(json.dumps({"homeserver": hs, "user_id": mxid, "password": pw,
|
||
|
|
"access_token": tok, "device_id": dev}, indent=2))
|
||
|
|
EOF
|
||
|
|
mv $DATA/shared/credentials.json.new $DATA/shared/credentials.json
|
||
|
|
chmod a+rw $DATA/shared/credentials.json
|
||
|
|
log "credentials written for $MXID"
|