mirror of
https://github.com/spantaleev/matrix-docker-ansible-deploy.git
synced 2026-09-19 22:30:09 +00:00
Add support for Meowlnir
Meowlnir (https://github.com/maunium/meowlnir) is a Matrix moderation bot which speaks the same policy-list protocol as Mjolnir and Draupnir, but runs as an appservice and can override individual policies coming from ban lists you do not control. Bots and their management rooms live only in Meowlnir's own database — nothing in its configuration file can declare one — so the role provisions them through the management API from a declarative roster (matrix_bot_meowlnir_bots_custom), applied under the ensure-matrix-users-created tag. Management rooms may be declared or created for you; bots and rooms no longer declared get pruned. Wrapper scripts for driving the management API by hand are installed to /matrix/meowlnir/bin. Meowlnir re-runs its configuration upgrader in memory on every start, so a literal `generate` value yields a new secret per restart. All secrets are therefore rendered explicitly, validation rejects `generate`, and the configuration directory is mounted read-only. Draupnir and Meowlnir both want synapse-http-antispam, which the playbook wires up to a single consumer. The wiring prefers Draupnir, and both roles fail the run when each claims it. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
Slavi Pantaleev
co-authored by
Claude Opus 5
Claude Opus 5
parent
bed7bddf4a
commit
f9222dc70c
@@ -0,0 +1,81 @@
|
||||
# SPDX-FileCopyrightText: 2026 Slavi Pantaleev
|
||||
#
|
||||
# SPDX-License-Identifier: AGPL-3.0-or-later
|
||||
|
||||
---
|
||||
|
||||
# The management API endpoints are idempotent PUTs, so re-running is safe.
|
||||
|
||||
# Meowlnir's own record of this bot, as fetched before the loop started.
|
||||
# Empty when the bot does not exist yet.
|
||||
- name: Look up what Meowlnir already knows about the bot - {{ bot.username | quote }}
|
||||
ansible.builtin.set_fact:
|
||||
matrix_bot_meowlnir_bot_live: >-
|
||||
{{
|
||||
(matrix_bot_meowlnir_live_bots | selectattr('username', 'equalto', bot.username) | list | first)
|
||||
| default({}, true)
|
||||
}}
|
||||
|
||||
# `PUT /_meowlnir/v1/bot/…` answers 200 whether it created the bot, updated it, or did nothing at all, so the response cannot tell us whether anything changed.
|
||||
# Comparing against what Meowlnir already holds lets the request be skipped when it would be a no-op, which both avoids pointless calls and lets the task report an honest changed state.
|
||||
#
|
||||
# Note that this trusts Meowlnir's own record.
|
||||
# Changing a bot's profile directly through a Matrix client goes behind its back and will not be corrected here.
|
||||
- name: Determine whether the Meowlnir bot needs creating or updating - {{ bot.username | quote }}
|
||||
ansible.builtin.set_fact:
|
||||
matrix_bot_meowlnir_bot_needs_update: >-
|
||||
{{
|
||||
not matrix_bot_meowlnir_bot_live
|
||||
or (matrix_bot_meowlnir_bot_live.displayname | default('', true)) != bot.displayname
|
||||
or (matrix_bot_meowlnir_bot_live.avatar_url | default('', true)) != bot.avatar_url
|
||||
}}
|
||||
matrix_bot_meowlnir_bot_body: >-
|
||||
{{
|
||||
{
|
||||
'displayname': bot.displayname,
|
||||
'avatar_url': bot.avatar_url,
|
||||
}
|
||||
}}
|
||||
|
||||
- name: Ensure Meowlnir bot exists and is up to date - {{ bot.username | quote }}
|
||||
when: matrix_bot_meowlnir_bot_needs_update | bool
|
||||
ansible.builtin.command:
|
||||
cmd: >-
|
||||
{{ matrix_bot_meowlnir_bin_path }}/meowlnir-api
|
||||
PUT /_meowlnir/v1/bot/{{ bot.username }}
|
||||
{{ matrix_bot_meowlnir_bot_body | to_json | quote }}
|
||||
register: matrix_bot_meowlnir_bot_create_result
|
||||
# The task only runs when something needs changing, so a successful call is reported as a change.
|
||||
# Deriving this from the status keeps a failed call from also claiming to have changed anything.
|
||||
# Meowlnir answers 200 even when it could not apply the displayname or avatar (it only logs that), so this is what was asked for, not proof of what landed. A later run retries, since its stored record is unchanged.
|
||||
changed_when: "matrix_bot_meowlnir_bot_create_result.stdout_lines | default([]) | last | default('') == '200'"
|
||||
failed_when: false
|
||||
|
||||
- name: Fail if the Meowlnir bot could not be created - {{ bot.username | quote }}
|
||||
ansible.builtin.fail:
|
||||
msg: >-
|
||||
Creating the Meowlnir bot `{{ bot.username }}` failed.
|
||||
Meowlnir said: {{ matrix_bot_meowlnir_bot_create_result.stdout | default('') | trim }}
|
||||
{{ matrix_bot_meowlnir_bot_create_result.stderr | default('') | trim }}
|
||||
when: >-
|
||||
matrix_bot_meowlnir_bot_needs_update | bool
|
||||
and (
|
||||
matrix_bot_meowlnir_bot_create_result.rc | default(1) != 0
|
||||
or (matrix_bot_meowlnir_bot_create_result.stdout_lines | default([]) | length == 0)
|
||||
or (matrix_bot_meowlnir_bot_create_result.stdout_lines | last != '200')
|
||||
)
|
||||
|
||||
- name: Determine which management rooms Meowlnir already has for this bot - {{ bot.username | quote }}
|
||||
ansible.builtin.set_fact:
|
||||
matrix_bot_meowlnir_bot_live_rooms: >-
|
||||
{{ matrix_bot_meowlnir_bot_live.management_rooms | default([], true) | map(attribute='room_id') | list }}
|
||||
|
||||
- name: Ensure Meowlnir management room created - {{ bot.username | quote }}
|
||||
when: "bot.management_room_auto_create | bool and matrix_bot_meowlnir_bot_live_rooms | length == 0"
|
||||
ansible.builtin.include_tasks: "{{ role_path }}/tasks/util/ensure_management_room_created.yml"
|
||||
|
||||
- name: Ensure declared Meowlnir management rooms registered - {{ bot.username | quote }}
|
||||
ansible.builtin.include_tasks: "{{ role_path }}/tasks/util/ensure_management_room_registered.yml"
|
||||
with_items: "{{ bot.management_rooms }}"
|
||||
loop_control:
|
||||
loop_var: management_room
|
||||
@@ -0,0 +1,57 @@
|
||||
# SPDX-FileCopyrightText: 2026 Slavi Pantaleev
|
||||
#
|
||||
# SPDX-License-Identifier: AGPL-3.0-or-later
|
||||
|
||||
---
|
||||
|
||||
# Only reached for bots with `management_room_auto_create` which do not have a management room yet.
|
||||
# Meowlnir's own record of the bot's rooms is what makes this idempotent, so no state is kept on the Ansible side.
|
||||
|
||||
# Recomputed here, because validation runs its own loop over all bots and would leave this holding the last one's value.
|
||||
- name: Determine the effective initial managers for a Meowlnir bot - {{ bot.username | quote }}
|
||||
ansible.builtin.set_fact:
|
||||
matrix_bot_meowlnir_bot_initial_managers: "{{ bot.initial_managers | default(matrix_bot_meowlnir_initial_managers) }}"
|
||||
|
||||
- name: Create a Meowlnir management room - {{ bot.username | quote }}
|
||||
ansible.builtin.command:
|
||||
cmd: >-
|
||||
{{ matrix_bot_meowlnir_bin_path }}/meowlnir-create-management-room
|
||||
{{ bot.username | quote }}
|
||||
{{ matrix_bot_meowlnir_bot_initial_managers | map('quote') | join(' ') }}
|
||||
register: matrix_bot_meowlnir_room_creation_result
|
||||
# The script prints the new room's ID on success, so that is what tells us a room was actually created, not merely attempted.
|
||||
changed_when: >-
|
||||
matrix_bot_meowlnir_room_creation_result.rc == 0
|
||||
and (matrix_bot_meowlnir_room_creation_result.stdout | default('') | trim).startswith('!')
|
||||
failed_when: false
|
||||
|
||||
- name: Fail if the Meowlnir management room could not be created - {{ bot.username | quote }}
|
||||
ansible.builtin.fail:
|
||||
msg: >-
|
||||
Creating a management room for the Meowlnir bot `{{ bot.username }}` failed.
|
||||
{{ matrix_bot_meowlnir_room_creation_result.stdout | default('') | trim }}
|
||||
{{ matrix_bot_meowlnir_room_creation_result.stderr | default('') | trim }}
|
||||
when: >-
|
||||
matrix_bot_meowlnir_room_creation_result.rc != 0
|
||||
or not (matrix_bot_meowlnir_room_creation_result.stdout | default('') | trim).startswith('!')
|
||||
|
||||
- name: Register the created Meowlnir management room - {{ bot.username | quote }}
|
||||
ansible.builtin.include_tasks: "{{ role_path }}/tasks/util/ensure_management_room_registered.yml"
|
||||
vars:
|
||||
management_room:
|
||||
id: "{{ matrix_bot_meowlnir_room_creation_result.stdout | trim }}"
|
||||
encrypted: "{{ matrix_bot_meowlnir_config_encryption_enable }}"
|
||||
|
||||
- name: Report the created Meowlnir management room - {{ bot.username | quote }}
|
||||
ansible.builtin.set_fact:
|
||||
devture_playbook_runtime_messages_list: >-
|
||||
{{
|
||||
devture_playbook_runtime_messages_list | default([])
|
||||
+
|
||||
[
|
||||
"Note: created a management room (" ~ (matrix_bot_meowlnir_room_creation_result.stdout | trim) ~
|
||||
") for the Meowlnir bot " ~ bot.username ~ " and invited " ~
|
||||
(matrix_bot_meowlnir_bot_initial_managers | join(", ")) ~
|
||||
" to it. Accept the invitation to start commanding the bot."
|
||||
]
|
||||
}}
|
||||
@@ -0,0 +1,38 @@
|
||||
# SPDX-FileCopyrightText: 2026 Slavi Pantaleev
|
||||
#
|
||||
# SPDX-License-Identifier: AGPL-3.0-or-later
|
||||
|
||||
---
|
||||
|
||||
- name: Build request body for Meowlnir management room - {{ management_room.id | quote }}
|
||||
ansible.builtin.set_fact:
|
||||
matrix_bot_meowlnir_management_room_body: >-
|
||||
{{
|
||||
{
|
||||
'bot_username': bot.username,
|
||||
'encrypted': management_room.encrypted | bool,
|
||||
}
|
||||
}}
|
||||
|
||||
- name: Ensure Meowlnir management room registered - {{ management_room.id | quote }}
|
||||
ansible.builtin.command:
|
||||
cmd: >-
|
||||
{{ matrix_bot_meowlnir_bin_path }}/meowlnir-api
|
||||
PUT /_meowlnir/v1/management_room/{{ management_room.id }}
|
||||
{{ matrix_bot_meowlnir_management_room_body | to_json | quote }}
|
||||
register: matrix_bot_meowlnir_management_room_result
|
||||
# 201 means the room was newly registered, 200 that it already was.
|
||||
changed_when: "matrix_bot_meowlnir_management_room_result.stdout_lines | default([]) | last | default('') == '201'"
|
||||
failed_when: false
|
||||
|
||||
- name: Fail if the Meowlnir management room could not be registered - {{ management_room.id | quote }}
|
||||
ansible.builtin.fail:
|
||||
msg: >-
|
||||
Registering `{{ management_room.id }}` as a management room for the Meowlnir bot
|
||||
`{{ bot.username }}` failed.
|
||||
Meowlnir said: {{ matrix_bot_meowlnir_management_room_result.stdout | default('') | trim }}
|
||||
{{ matrix_bot_meowlnir_management_room_result.stderr | default('') | trim }}
|
||||
when: >-
|
||||
matrix_bot_meowlnir_management_room_result.rc != 0
|
||||
or (matrix_bot_meowlnir_management_room_result.stdout_lines | default([]) | length == 0)
|
||||
or (matrix_bot_meowlnir_management_room_result.stdout_lines | last not in ['200', '201'])
|
||||
@@ -0,0 +1,41 @@
|
||||
# SPDX-FileCopyrightText: 2026 Slavi Pantaleev
|
||||
#
|
||||
# SPDX-License-Identifier: AGPL-3.0-or-later
|
||||
|
||||
---
|
||||
|
||||
# Only reached for bots which are no longer declared, and only after their management rooms have been de-registered — Meowlnir refuses to delete a bot which is still in use.
|
||||
|
||||
- name: Remove Meowlnir bot - {{ live_bot.username | quote }}
|
||||
ansible.builtin.command:
|
||||
cmd: >-
|
||||
{{ matrix_bot_meowlnir_bin_path }}/meowlnir-api
|
||||
DELETE /_meowlnir/v1/bot/{{ live_bot.username }}
|
||||
register: matrix_bot_meowlnir_bot_removal_result
|
||||
changed_when: "matrix_bot_meowlnir_bot_removal_result.stdout_lines | default([]) | last | default('') == '200'"
|
||||
failed_when: false
|
||||
|
||||
- name: Fail if the Meowlnir bot could not be removed - {{ live_bot.username | quote }}
|
||||
ansible.builtin.fail:
|
||||
msg: >-
|
||||
Removing the Meowlnir bot `{{ live_bot.username }}` failed.
|
||||
Meowlnir said: {{ matrix_bot_meowlnir_bot_removal_result.stdout | default('') | trim }}
|
||||
{{ matrix_bot_meowlnir_bot_removal_result.stderr | default('') | trim }}
|
||||
when: >-
|
||||
matrix_bot_meowlnir_bot_removal_result.rc != 0
|
||||
or (matrix_bot_meowlnir_bot_removal_result.stdout_lines | default([]) | length == 0)
|
||||
or (matrix_bot_meowlnir_bot_removal_result.stdout_lines | last not in ['200', '404'])
|
||||
|
||||
- name: Report the removed Meowlnir bot - {{ live_bot.username | quote }}
|
||||
ansible.builtin.set_fact:
|
||||
devture_playbook_runtime_messages_list: >-
|
||||
{{
|
||||
devture_playbook_runtime_messages_list | default([])
|
||||
+
|
||||
[
|
||||
"Note: the Meowlnir bot " ~ live_bot.username ~ " is no longer declared in matrix_bot_meowlnir_bots," ~
|
||||
" so Meowlnir has been told to forget it. Its Matrix user is not deactivated and remains in the rooms" ~
|
||||
" it had joined - clean that up separately if you want it gone for good."
|
||||
]
|
||||
}}
|
||||
when: "matrix_bot_meowlnir_bot_removal_result.stdout_lines | default([]) | last | default('') == '200'"
|
||||
@@ -0,0 +1,33 @@
|
||||
# SPDX-FileCopyrightText: 2026 Slavi Pantaleev
|
||||
#
|
||||
# SPDX-License-Identifier: AGPL-3.0-or-later
|
||||
|
||||
---
|
||||
|
||||
- name: Find the declaration for the Meowlnir bot - {{ live_bot.username | quote }}
|
||||
ansible.builtin.set_fact:
|
||||
matrix_bot_meowlnir_declared_bot: >-
|
||||
{{
|
||||
(matrix_bot_meowlnir_bots | selectattr('username', 'equalto', live_bot.username) | list | first)
|
||||
| default({}, true)
|
||||
}}
|
||||
|
||||
# Rooms created by the playbook are not declared anywhere, so bots which auto-create their management room are left alone.
|
||||
# Bots which are no longer declared at all fall through to the empty declaration, meaning all of their rooms get removed — which is also what has to happen before the bot itself can be deleted.
|
||||
- name: Determine which management rooms to remove - {{ live_bot.username | quote }}
|
||||
ansible.builtin.set_fact:
|
||||
matrix_bot_meowlnir_rooms_to_remove: >-
|
||||
{{
|
||||
[]
|
||||
if (matrix_bot_meowlnir_declared_bot.management_room_auto_create | default(false) | bool)
|
||||
else (
|
||||
(live_bot.management_rooms | map(attribute='room_id') | list)
|
||||
| difference(matrix_bot_meowlnir_declared_bot.management_rooms | default([], true) | map(attribute='id') | list)
|
||||
)
|
||||
}}
|
||||
|
||||
- name: Remove Meowlnir management rooms which are no longer declared - {{ live_bot.username | quote }}
|
||||
ansible.builtin.include_tasks: "{{ role_path }}/tasks/util/prune_management_room.yml"
|
||||
with_items: "{{ matrix_bot_meowlnir_rooms_to_remove }}"
|
||||
loop_control:
|
||||
loop_var: room_id_to_remove
|
||||
@@ -0,0 +1,50 @@
|
||||
# SPDX-FileCopyrightText: 2026 Slavi Pantaleev
|
||||
#
|
||||
# SPDX-License-Identifier: AGPL-3.0-or-later
|
||||
|
||||
---
|
||||
|
||||
# Makes the declared bot list authoritative: anything Meowlnir still knows about but which is no longer declared gets removed.
|
||||
# Meowlnir's own records are re-read first, because the provisioning that just ran will have changed them.
|
||||
|
||||
- name: Re-read Meowlnir's bots before pruning
|
||||
ansible.builtin.include_tasks: "{{ role_path }}/tasks/util/read_meowlnir_state.yml"
|
||||
|
||||
- name: Determine which Meowlnir bots are no longer declared
|
||||
ansible.builtin.set_fact:
|
||||
matrix_bot_meowlnir_undeclared_bots: >-
|
||||
{{
|
||||
matrix_bot_meowlnir_live_bots
|
||||
| rejectattr('username', 'in', matrix_bot_meowlnir_bots | map(attribute='username') | list)
|
||||
| list
|
||||
}}
|
||||
|
||||
- name: Fail if pruning would remove every Meowlnir bot
|
||||
ansible.builtin.fail:
|
||||
msg: >-
|
||||
No bots are declared in `matrix_bot_meowlnir_bots`, but Meowlnir still has
|
||||
{{ matrix_bot_meowlnir_undeclared_bots | length }} of them
|
||||
({{ matrix_bot_meowlnir_undeclared_bots | map(attribute='username') | join(', ') }}).
|
||||
Removing them would make Meowlnir forget them along with their management rooms, so the
|
||||
playbook will not act on what is far more often a mistake (a commented-out block, an
|
||||
unset variable) than an instruction.
|
||||
If you really do want them all gone, set
|
||||
`matrix_bot_meowlnir_bots_pruning_on_empty_roster_enabled: true`.
|
||||
To stop the playbook managing bots at all, set
|
||||
`matrix_bot_meowlnir_bots_pruning_enabled: false`.
|
||||
when: >-
|
||||
matrix_bot_meowlnir_bots | length == 0
|
||||
and matrix_bot_meowlnir_undeclared_bots | length > 0
|
||||
and not matrix_bot_meowlnir_bots_pruning_on_empty_roster_enabled | bool
|
||||
|
||||
- name: Remove management rooms which are no longer declared
|
||||
ansible.builtin.include_tasks: "{{ role_path }}/tasks/util/prune_bot_management_rooms.yml"
|
||||
with_items: "{{ matrix_bot_meowlnir_live_bots }}"
|
||||
loop_control:
|
||||
loop_var: live_bot
|
||||
|
||||
- name: Remove Meowlnir bots which are no longer declared
|
||||
ansible.builtin.include_tasks: "{{ role_path }}/tasks/util/prune_bot.yml"
|
||||
with_items: "{{ matrix_bot_meowlnir_undeclared_bots }}"
|
||||
loop_control:
|
||||
loop_var: live_bot
|
||||
@@ -0,0 +1,38 @@
|
||||
# SPDX-FileCopyrightText: 2026 Slavi Pantaleev
|
||||
#
|
||||
# SPDX-License-Identifier: AGPL-3.0-or-later
|
||||
|
||||
---
|
||||
|
||||
- name: Remove Meowlnir management room - {{ room_id_to_remove | quote }}
|
||||
ansible.builtin.command:
|
||||
cmd: >-
|
||||
{{ matrix_bot_meowlnir_bin_path }}/meowlnir-api
|
||||
DELETE /_meowlnir/v1/management_room/{{ room_id_to_remove }}
|
||||
register: matrix_bot_meowlnir_room_removal_result
|
||||
changed_when: "matrix_bot_meowlnir_room_removal_result.stdout_lines | default([]) | last | default('') == '200'"
|
||||
failed_when: false
|
||||
|
||||
- name: Fail if the Meowlnir management room could not be removed - {{ room_id_to_remove | quote }}
|
||||
ansible.builtin.fail:
|
||||
msg: >-
|
||||
De-registering the Meowlnir management room `{{ room_id_to_remove }}` failed.
|
||||
Meowlnir said: {{ matrix_bot_meowlnir_room_removal_result.stdout | default('') | trim }}
|
||||
{{ matrix_bot_meowlnir_room_removal_result.stderr | default('') | trim }}
|
||||
when: >-
|
||||
matrix_bot_meowlnir_room_removal_result.rc != 0
|
||||
or (matrix_bot_meowlnir_room_removal_result.stdout_lines | default([]) | length == 0)
|
||||
or (matrix_bot_meowlnir_room_removal_result.stdout_lines | last not in ['200', '404'])
|
||||
|
||||
- name: Report the removed Meowlnir management room - {{ room_id_to_remove | quote }}
|
||||
ansible.builtin.set_fact:
|
||||
devture_playbook_runtime_messages_list: >-
|
||||
{{
|
||||
devture_playbook_runtime_messages_list | default([])
|
||||
+
|
||||
[
|
||||
"Note: the Meowlnir management room " ~ room_id_to_remove ~ " is no longer declared, so it has been de-registered." ~
|
||||
" The room itself still exists and the bot is still in it - Meowlnir simply no longer takes commands there."
|
||||
]
|
||||
}}
|
||||
when: "matrix_bot_meowlnir_room_removal_result.stdout_lines | default([]) | last | default('') == '200'"
|
||||
@@ -0,0 +1,29 @@
|
||||
# SPDX-FileCopyrightText: 2026 Slavi Pantaleev
|
||||
#
|
||||
# SPDX-License-Identifier: AGPL-3.0-or-later
|
||||
|
||||
---
|
||||
|
||||
# Meowlnir's own database is the source of truth for which bots and management rooms exist, and it can be queried, so the playbook keeps no state of its own about them.
|
||||
|
||||
- name: Ask Meowlnir which bots currently exist
|
||||
ansible.builtin.command:
|
||||
cmd: "{{ matrix_bot_meowlnir_bin_path }}/meowlnir-api GET /_meowlnir/v1/bots"
|
||||
register: matrix_bot_meowlnir_state_result
|
||||
changed_when: false
|
||||
failed_when: false
|
||||
|
||||
- name: Fail if Meowlnir could not be asked which bots exist
|
||||
ansible.builtin.fail:
|
||||
msg: >-
|
||||
Could not read the list of bots from Meowlnir.
|
||||
Meowlnir said: {{ matrix_bot_meowlnir_state_result.stdout | default('') | trim }}
|
||||
{{ matrix_bot_meowlnir_state_result.stderr | default('') | trim }}
|
||||
when: >-
|
||||
matrix_bot_meowlnir_state_result.rc != 0
|
||||
or (matrix_bot_meowlnir_state_result.stdout_lines | default([]) | length == 0)
|
||||
or (matrix_bot_meowlnir_state_result.stdout_lines | last != '200')
|
||||
|
||||
- name: Determine which bots and management rooms Meowlnir knows about
|
||||
ansible.builtin.set_fact:
|
||||
matrix_bot_meowlnir_live_bots: "{{ (matrix_bot_meowlnir_state_result.stdout_lines[:-1] | join('\n') | from_json).bots | default([], true) }}"
|
||||
@@ -0,0 +1,90 @@
|
||||
# SPDX-FileCopyrightText: 2026 Slavi Pantaleev
|
||||
#
|
||||
# SPDX-License-Identifier: AGPL-3.0-or-later
|
||||
|
||||
---
|
||||
|
||||
# These fields are required on every entry, so that a bot's setup can be read off the definition without knowing what the playbook would otherwise default to.
|
||||
#
|
||||
# The optional `initial_managers` is deliberately not among them: it only overrides an instance-wide default, and demanding it on every bot would defeat that default's purpose.
|
||||
- name: Fail if a Meowlnir bot definition lacks required fields
|
||||
ansible.builtin.fail:
|
||||
msg: >-
|
||||
A bot definition in `matrix_bot_meowlnir_bots` is missing the `{{ item }}` field.
|
||||
Required on every entry: {{ matrix_bot_meowlnir_bot_required_fields | join(', ') }}.
|
||||
Offending definition: {{ bot | to_json }}
|
||||
when: "item not in bot"
|
||||
with_items: "{{ matrix_bot_meowlnir_bot_required_fields }}"
|
||||
|
||||
- name: Fail if a Meowlnir bot username is empty
|
||||
ansible.builtin.fail:
|
||||
msg: "A bot definition in `matrix_bot_meowlnir_bots` has an empty `username`: {{ bot | to_json }}"
|
||||
when: "not bot.username"
|
||||
|
||||
- name: Fail if Meowlnir bot username lacks the required prefix
|
||||
ansible.builtin.fail:
|
||||
msg: >-
|
||||
The Meowlnir bot username `{{ bot.username }}` does not start with
|
||||
`{{ matrix_bot_meowlnir_user_prefix }}`. Bot users need to fall within the user
|
||||
namespace declared in Meowlnir's appservice registration file, or the homeserver
|
||||
will refuse to let Meowlnir operate them.
|
||||
Either rename the bot, or adjust `matrix_bot_meowlnir_user_prefix`.
|
||||
when: "not bot.username.startswith(matrix_bot_meowlnir_user_prefix)"
|
||||
|
||||
- name: Fail if a Meowlnir bot mixes management room auto-creation with declared rooms
|
||||
ansible.builtin.fail:
|
||||
msg: >-
|
||||
The Meowlnir bot `{{ bot.username }}` has `management_room_auto_create` enabled, but
|
||||
also declares `management_rooms`. These are mutually exclusive: either let the
|
||||
playbook create a management room, or declare the rooms yourself.
|
||||
when: "bot.management_room_auto_create | bool and bot.management_rooms | length > 0"
|
||||
|
||||
- name: Fail if a Meowlnir bot has neither auto-created nor declared management rooms
|
||||
ansible.builtin.fail:
|
||||
msg: >-
|
||||
The Meowlnir bot `{{ bot.username }}` declares no `management_rooms` and does not have
|
||||
`management_room_auto_create` enabled, so there would be no room to command it from.
|
||||
Either create a room yourself and declare it, or enable `management_room_auto_create`.
|
||||
when: "not bot.management_room_auto_create | bool and bot.management_rooms | length == 0"
|
||||
|
||||
- name: Fail if a Meowlnir bot declares `initial_managers` which is not a list
|
||||
ansible.builtin.fail:
|
||||
msg: >-
|
||||
The Meowlnir bot `{{ bot.username }}` declares an `initial_managers` value which is not
|
||||
a list. It needs to be a list of full Matrix user IDs (`@alice:example.com`), even when
|
||||
there is only one.
|
||||
Offending definition: {{ bot | to_json }}
|
||||
when: "'initial_managers' in bot and (bot.initial_managers is string or bot.initial_managers is mapping or bot.initial_managers is not iterable)"
|
||||
|
||||
# Omitting the key inherits the instance-wide default; declaring it empty means nobody, which is why `default()` is used here without its `boolean` argument.
|
||||
- name: Determine the effective initial managers for a Meowlnir bot
|
||||
ansible.builtin.set_fact:
|
||||
matrix_bot_meowlnir_bot_initial_managers: "{{ bot.initial_managers | default(matrix_bot_meowlnir_initial_managers) }}"
|
||||
|
||||
- name: Fail if Meowlnir management room auto-creation lacks an initial manager
|
||||
ansible.builtin.fail:
|
||||
msg: >-
|
||||
The Meowlnir bot `{{ bot.username }}` has `management_room_auto_create` enabled, but no
|
||||
initial managers are set, so nobody would be able to command the bot in the room that
|
||||
gets created.
|
||||
Either give the bot its own `initial_managers` list, or set
|
||||
`matrix_bot_meowlnir_initial_managers` (or the `matrix_admin` variable it follows by
|
||||
default), or disable `management_room_auto_create` and declare `management_rooms`
|
||||
yourself.
|
||||
when: "bot.management_room_auto_create | bool and matrix_bot_meowlnir_bot_initial_managers | length == 0"
|
||||
|
||||
# Nothing downstream catches a bad value: the homeserver accepts invitations for users which do not exist, and on room versions supporting MSC4289 an invitee's standing in the room cannot be revoked afterwards.
|
||||
# So a typo here is both silent and permanent.
|
||||
- name: Fail if a Meowlnir initial manager is not a full Matrix user ID
|
||||
ansible.builtin.fail:
|
||||
msg: >-
|
||||
`{{ item }}` is listed as an initial manager for the Meowlnir bot `{{ bot.username }}`,
|
||||
but it is not a full Matrix user ID (`@alice:example.com`).
|
||||
when: "not (item.startswith('@') and ':' in item)"
|
||||
with_items: "{{ matrix_bot_meowlnir_bot_initial_managers }}"
|
||||
|
||||
- name: Validate Meowlnir bot management rooms
|
||||
ansible.builtin.include_tasks: "{{ role_path }}/tasks/util/validate_bot_management_room.yml"
|
||||
with_items: "{{ bot.management_rooms }}"
|
||||
loop_control:
|
||||
loop_var: management_room
|
||||
@@ -0,0 +1,25 @@
|
||||
# SPDX-FileCopyrightText: 2026 Slavi Pantaleev
|
||||
#
|
||||
# SPDX-License-Identifier: AGPL-3.0-or-later
|
||||
|
||||
---
|
||||
|
||||
- name: Fail if a Meowlnir management room definition lacks required fields
|
||||
ansible.builtin.fail:
|
||||
msg: >-
|
||||
A `management_rooms` entry for the Meowlnir bot `{{ bot.username }}` is missing the
|
||||
`{{ item }}` field. All fields are required on every entry.
|
||||
Offending definition: {{ management_room | to_json }}
|
||||
when: "item not in management_room"
|
||||
with_items:
|
||||
- id
|
||||
- encrypted
|
||||
|
||||
- name: Fail if a Meowlnir management room ID does not look like a room ID
|
||||
ansible.builtin.fail:
|
||||
msg: >-
|
||||
A `management_rooms` entry for the Meowlnir bot `{{ bot.username }}` has an `id` of
|
||||
`{{ management_room.id }}`, which does not look like a room ID.
|
||||
It needs to be a room ID (`!qporfwt:example.com`), not a room alias or a matrix.to URL.
|
||||
You can find it in Element Web under the room's Settings -> Advanced.
|
||||
when: "not management_room.id.startswith('!')"
|
||||
Reference in New Issue
Block a user