mirror of
https://github.com/spantaleev/matrix-docker-ansible-deploy.git
synced 2026-08-14 21:00:53 +00:00
Slavi Pantaleev
f9222dc70c
Meowlnir (https://github.com/maunium/meowlnir) is a Matrix moderation bot which speaks the same policy-list protocol as Mjolnir and Draupnir, but runs as an appservice and can override individual policies coming from ban lists you do not control. Bots and their management rooms live only in Meowlnir's own database — nothing in its configuration file can declare one — so the role provisions them through the management API from a declarative roster (matrix_bot_meowlnir_bots_custom), applied under the ensure-matrix-users-created tag. Management rooms may be declared or created for you; bots and rooms no longer declared get pruned. Wrapper scripts for driving the management API by hand are installed to /matrix/meowlnir/bin. Meowlnir re-runs its configuration upgrader in memory on every start, so a literal `generate` value yields a new secret per restart. All secrets are therefore rendered explicitly, validation rejects `generate`, and the configuration directory is mounted read-only. Draupnir and Meowlnir both want synapse-http-antispam, which the playbook wires up to a single consumer. The wiring prefers Draupnir, and both roles fail the run when each claims it. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
546 lines
32 KiB
YAML
546 lines
32 KiB
YAML
# SPDX-FileCopyrightText: 2026 Slavi Pantaleev
|
|
#
|
|
# SPDX-License-Identifier: AGPL-3.0-or-later
|
|
|
|
---
|
|
# An opinionated Matrix moderation bot
|
|
# Project source code URL: https://github.com/maunium/meowlnir
|
|
|
|
matrix_bot_meowlnir_enabled: true
|
|
|
|
# renovate: datasource=docker depName=dock.mau.dev/maunium/meowlnir
|
|
matrix_bot_meowlnir_version: v0.2606.0
|
|
|
|
matrix_bot_meowlnir_container_image_self_build: false
|
|
matrix_bot_meowlnir_container_image_self_build_repo: "https://github.com/maunium/meowlnir.git"
|
|
|
|
matrix_bot_meowlnir_container_image: "{{ matrix_bot_meowlnir_container_image_registry_prefix }}{{ matrix_bot_meowlnir_container_image_registry_namespace_identifier }}:{{ matrix_bot_meowlnir_version }}"
|
|
matrix_bot_meowlnir_container_image_registry_namespace_identifier: "maunium/meowlnir"
|
|
matrix_bot_meowlnir_container_image_registry_prefix: "{{ 'localhost/' if matrix_bot_meowlnir_container_image_self_build else matrix_bot_meowlnir_container_image_registry_prefix_upstream }}"
|
|
matrix_bot_meowlnir_container_image_registry_prefix_upstream: "{{ matrix_bot_meowlnir_container_image_registry_prefix_upstream_default }}"
|
|
matrix_bot_meowlnir_container_image_registry_prefix_upstream_default: "dock.mau.dev/"
|
|
|
|
matrix_bot_meowlnir_base_path: "{{ matrix_base_data_path }}/meowlnir"
|
|
matrix_bot_meowlnir_config_path: "{{ matrix_bot_meowlnir_base_path }}/config"
|
|
matrix_bot_meowlnir_data_path: "{{ matrix_bot_meowlnir_base_path }}/data"
|
|
matrix_bot_meowlnir_bin_path: "{{ matrix_bot_meowlnir_base_path }}/bin"
|
|
matrix_bot_meowlnir_container_src_files_path: "{{ matrix_bot_meowlnir_base_path }}/docker-src"
|
|
|
|
matrix_bot_meowlnir_container_network: ""
|
|
|
|
matrix_bot_meowlnir_container_additional_networks: "{{ matrix_bot_meowlnir_container_additional_networks_auto + matrix_bot_meowlnir_container_additional_networks_custom }}"
|
|
matrix_bot_meowlnir_container_additional_networks_auto: []
|
|
matrix_bot_meowlnir_container_additional_networks_custom: []
|
|
|
|
# Controls whether the matrix-bot-meowlnir container exposes its HTTP port.
|
|
#
|
|
# Takes an "<ip>:<port>" or "<port>" value (e.g.
|
|
# "127.0.0.1:29339"), or empty string to not expose.
|
|
matrix_bot_meowlnir_container_http_host_bind_port: ''
|
|
|
|
# A list of extra arguments to pass to the container
|
|
matrix_bot_meowlnir_container_extra_arguments: []
|
|
|
|
# List of systemd services that matrix-bot-meowlnir.service depends on
|
|
matrix_bot_meowlnir_systemd_required_services_list: "{{ matrix_bot_meowlnir_systemd_required_services_list_default + matrix_bot_meowlnir_systemd_required_services_list_auto + matrix_bot_meowlnir_systemd_required_services_list_custom }}"
|
|
matrix_bot_meowlnir_systemd_required_services_list_default: "{{ [devture_systemd_docker_base_docker_service_name] if devture_systemd_docker_base_docker_service_name else [] }}"
|
|
matrix_bot_meowlnir_systemd_required_services_list_auto: []
|
|
matrix_bot_meowlnir_systemd_required_services_list_custom: []
|
|
|
|
# List of systemd services that matrix-bot-meowlnir.service wants
|
|
matrix_bot_meowlnir_systemd_wanted_services_list: []
|
|
|
|
|
|
########################################################################
|
|
# #
|
|
# Appservice registration #
|
|
# #
|
|
########################################################################
|
|
|
|
# Meowlnir runs as an appservice.
|
|
# Unlike Draupnir in bot mode, it does not log in with an access token — the homeserver is told about it via a registration file.
|
|
#
|
|
# Bots themselves are created at runtime through Meowlnir's management API, within the user namespace declared below.
|
|
# See the role's documentation page for details.
|
|
|
|
matrix_bot_meowlnir_appservice_id: meowlnir
|
|
|
|
# The localpart of the appservice's own user.
|
|
# This user does not act as a moderation bot; it is the appservice's sender.
|
|
# Individual bots get their own users.
|
|
matrix_bot_meowlnir_appservice_sender_localpart: meowlnir
|
|
|
|
# The prefix for bot users created via the management API.
|
|
# Must line up with `matrix_bot_meowlnir_config_meowlnir4all_localpart_template`.
|
|
matrix_bot_meowlnir_user_prefix: "meowlnir_"
|
|
|
|
|
|
########################################################################
|
|
# #
|
|
# Managed bots #
|
|
# #
|
|
########################################################################
|
|
|
|
# Meowlnir hosts multiple bots, each with one or more management rooms, and creates them at runtime through its management API, not from its configuration file.
|
|
#
|
|
# The bots listed here are created (and kept up to date) by the playbook when running with the `ensure-matrix-users-created` tag, so that you do not need to call that API yourself.
|
|
#
|
|
# The fields below are required on every entry, so that each bot's setup can be understood without having to know what the playbook defaults to.
|
|
#
|
|
# - `username`: the localpart of the bot user. Must begin with `matrix_bot_meowlnir_user_prefix`, or the homeserver will not let Meowlnir operate it. Pick it carefully — it becomes the bot's Matrix user ID and is awkward to change later.
|
|
# - `displayname`: the name shown in rooms. Safe to change at any time.
|
|
# - `avatar_url`: an `mxc://` URI, or an empty string for no avatar.
|
|
# - `management_room_auto_create`: whether the playbook creates a management room for this bot. Mutually exclusive with `management_rooms` — see below.
|
|
# - `management_rooms`: the rooms you send commands to. A list, because Meowlnir supports several per bot. Each entry needs an `id` (a room ID, not an alias) and an `encrypted` flag saying whether that room is encrypted.
|
|
#
|
|
# `management_room_auto_create` and `management_rooms` are mutually exclusive:
|
|
#
|
|
# - `management_room_auto_create: false` requires at least one entry in `management_rooms`. You create the room yourself, and invite the bot after the first run.
|
|
# - `management_room_auto_create: true` requires `management_rooms` to be empty. The playbook creates the room, invites the bot's initial managers and gives them the power level needed to command the bot. The room's encryption follows `matrix_bot_meowlnir_config_encryption_enable`.
|
|
#
|
|
# One optional field is also recognized:
|
|
#
|
|
# - `initial_managers`: the users invited to a management room the playbook creates for this bot. Omit it to use `matrix_bot_meowlnir_initial_managers`. An explicitly empty list means nobody, which is an error for a bot relying on `management_room_auto_create`.
|
|
#
|
|
# Example:
|
|
# matrix_bot_meowlnir_bots_custom:
|
|
# - username: meowlnir_bot
|
|
# displayname: Meowlnir
|
|
# avatar_url: ""
|
|
# management_room_auto_create: false
|
|
# management_rooms:
|
|
# - id: "!qporfwt:example.com"
|
|
# encrypted: false
|
|
matrix_bot_meowlnir_bots: "{{ matrix_bot_meowlnir_bots_auto + matrix_bot_meowlnir_bots_custom }}"
|
|
matrix_bot_meowlnir_bots_auto: []
|
|
matrix_bot_meowlnir_bots_custom: []
|
|
|
|
# The users invited to management rooms that the playbook creates, and given the power level required to command the bot there.
|
|
# Full Matrix user IDs (`@alice:example.com`).
|
|
#
|
|
# Only consulted by bots with `management_room_auto_create: true`, and only as the default for those which do not carry their own `initial_managers` list.
|
|
# The playbook points this at `matrix_admin` by default.
|
|
matrix_bot_meowlnir_initial_managers: []
|
|
|
|
# Controls whether the bot list above is authoritative for this Meowlnir instance.
|
|
#
|
|
# When enabled, bots and management rooms which are registered with Meowlnir but no longer declared are removed, so that the list describes the whole installation, not merely additions to it.
|
|
#
|
|
# Note that removing a bot only makes Meowlnir forget it.
|
|
# The bot's Matrix user is not deactivated and stays in the rooms it had joined, so clean that up separately if you want it gone for good.
|
|
matrix_bot_meowlnir_bots_pruning_enabled: true
|
|
|
|
# Controls whether pruning also happens when no bots are declared at all.
|
|
#
|
|
# Disabled by default, because an empty list is far more often a mistake (a commented-out block, an unset variable) than a genuine instruction to remove every bot.
|
|
# With this off, the playbook refuses that particular run.
|
|
#
|
|
# Only relevant when `matrix_bot_meowlnir_bots_pruning_enabled` is enabled.
|
|
matrix_bot_meowlnir_bots_pruning_on_empty_roster_enabled: false
|
|
|
|
# How long to wait after starting the Meowlnir service and before creating bots.
|
|
# Only waited on when the service was not already running.
|
|
matrix_bot_meowlnir_bots_start_wait_time_seconds: 15
|
|
|
|
# The name and topic given to management rooms that the playbook creates.
|
|
# Only used by bots with `management_room_auto_create` enabled.
|
|
matrix_bot_meowlnir_management_room_name: Meowlnir management room
|
|
matrix_bot_meowlnir_management_room_topic: >-
|
|
Moderation commands for this Meowlnir bot are sent here.
|
|
|
|
# Regular expressions matching the users this appservice owns.
|
|
#
|
|
# Defined here, because they are used both in the appservice registration file below and when telling other components (Ketesa, for one) which users are appservice-managed.
|
|
# Writing them twice invites the two from drifting apart.
|
|
#
|
|
# The character class covers what the Matrix specification allows in a user ID localpart.
|
|
matrix_bot_meowlnir_user_regex: "^@{{ matrix_bot_meowlnir_user_prefix | regex_escape }}[a-zA-Z0-9._=/+-]+:{{ matrix_bot_meowlnir_config_homeserver_domain | regex_escape }}$"
|
|
matrix_bot_meowlnir_appservice_sender_regex: "^@{{ matrix_bot_meowlnir_appservice_sender_localpart | regex_escape }}:{{ matrix_bot_meowlnir_config_homeserver_domain | regex_escape }}$"
|
|
|
|
# Tokens shared between Meowlnir and the homeserver.
|
|
# Set these to strong, unique values.
|
|
# The playbook derives them from `matrix_homeserver_generic_secret_key` by default.
|
|
matrix_bot_meowlnir_appservice_token: ''
|
|
matrix_bot_meowlnir_homeserver_token: ''
|
|
|
|
matrix_bot_meowlnir_registration_yaml: |
|
|
id: {{ matrix_bot_meowlnir_appservice_id | to_json }}
|
|
as_token: {{ matrix_bot_meowlnir_appservice_token | to_json }}
|
|
hs_token: {{ matrix_bot_meowlnir_homeserver_token | to_json }}
|
|
url: {{ matrix_bot_meowlnir_appservice_url | to_json }}
|
|
sender_localpart: {{ matrix_bot_meowlnir_appservice_sender_localpart | to_json }}
|
|
rate_limited: false
|
|
namespaces:
|
|
users:
|
|
- exclusive: true
|
|
regex: {{ matrix_bot_meowlnir_user_regex | to_json }}
|
|
- exclusive: true
|
|
regex: {{ matrix_bot_meowlnir_appservice_sender_regex | to_json }}
|
|
{% if matrix_bot_meowlnir_config_encryption_enable %}
|
|
de.sorunome.msc2409.push_ephemeral: true
|
|
push_ephemeral: true
|
|
receive_ephemeral: true
|
|
org.matrix.msc3202: true
|
|
io.element.msc4190: true
|
|
{% endif %}
|
|
|
|
matrix_bot_meowlnir_registration: "{{ matrix_bot_meowlnir_registration_yaml | from_yaml }}"
|
|
|
|
|
|
########################################################################
|
|
# #
|
|
# Configuration: homeserver #
|
|
# #
|
|
########################################################################
|
|
|
|
# The address that Meowlnir can use to connect to the homeserver (client-server API).
|
|
matrix_bot_meowlnir_config_homeserver_address: ''
|
|
|
|
# The server name (base domain) of the homeserver.
|
|
matrix_bot_meowlnir_config_homeserver_domain: ''
|
|
|
|
|
|
########################################################################
|
|
# #
|
|
# Configuration: meowlnir #
|
|
# #
|
|
########################################################################
|
|
|
|
# The hostname and port that Meowlnir listens on, inside the container.
|
|
matrix_bot_meowlnir_config_meowlnir_hostname: 0.0.0.0
|
|
matrix_bot_meowlnir_config_meowlnir_port: 29339
|
|
|
|
# The address that the homeserver can use to connect to Meowlnir.
|
|
matrix_bot_meowlnir_appservice_url: "http://matrix-bot-meowlnir:{{ matrix_bot_meowlnir_config_meowlnir_port }}"
|
|
|
|
# Secret for the management API (`/_meowlnir/v1/...`), which is how bots and management rooms get created.
|
|
# Set to `disable` to turn the API off entirely.
|
|
# The playbook derives a value from `matrix_homeserver_generic_secret_key` by default.
|
|
matrix_bot_meowlnir_config_meowlnir_management_secret: ''
|
|
|
|
# Secret for the `/_meowlnir/data` API.
|
|
# The playbook derives a value from `matrix_homeserver_generic_secret_key` by default.
|
|
matrix_bot_meowlnir_config_meowlnir_data_secret: ''
|
|
|
|
# Whether the `/_meowlnir/mxauth` APIs are enabled, which allow querying certain data using any Matrix account.
|
|
# Needed by the (not yet released) management web interface.
|
|
matrix_bot_meowlnir_config_meowlnir_federation_auth: false
|
|
|
|
# When enabled, Meowlnir does everything except take actual moderation actions.
|
|
# Useful for trialling Meowlnir alongside an existing moderation bot.
|
|
matrix_bot_meowlnir_config_meowlnir_dry_run: false
|
|
|
|
# Whether all bots should be considered untrusted, which enables additional checks (e.g. preventing subscription to a policy list without being in the room).
|
|
matrix_bot_meowlnir_config_meowlnir_untrusted: false
|
|
|
|
# The ID of the management room that handles requests to the Matrix report API.
|
|
# Requires `matrix_bot_meowlnir_config_reporting_enabled` to be enabled to be of use.
|
|
matrix_bot_meowlnir_config_meowlnir_report_room: ''
|
|
|
|
# The ID of the management room in charge of deleting rooms from the server.
|
|
# Room bans are not processed in other management rooms.
|
|
matrix_bot_meowlnir_config_meowlnir_room_ban_room: ''
|
|
|
|
# Whether Meowlnir should load all room IDs from the Synapse database on startup.
|
|
# Requires `matrix_bot_meowlnir_synapse_database_uri` to be set.
|
|
matrix_bot_meowlnir_config_meowlnir_load_all_room_hashes: "{{ matrix_bot_meowlnir_synapse_database_uri != '' }}"
|
|
|
|
# Entities (user IDs or server names) whose policies are ignored entirely.
|
|
# A blunt safety net against overly-wide policies from subscribed lists.
|
|
#
|
|
# Meowlnir always ignores policies matching its own homeserver domain, so there is no need to list it here.
|
|
matrix_bot_meowlnir_config_meowlnir_hacky_rule_filter: "{{ matrix_bot_meowlnir_config_meowlnir_hacky_rule_filter_auto + matrix_bot_meowlnir_config_meowlnir_hacky_rule_filter_custom }}"
|
|
matrix_bot_meowlnir_config_meowlnir_hacky_rule_filter_auto: []
|
|
matrix_bot_meowlnir_config_meowlnir_hacky_rule_filter_custom: []
|
|
|
|
# Glob patterns matched against policy reasons.
|
|
# When a policy matches, all messages from the banned target are redacted automatically.
|
|
# The reason `spam` is implicit.
|
|
matrix_bot_meowlnir_config_meowlnir_hacky_redact_patterns: "{{ matrix_bot_meowlnir_config_meowlnir_hacky_redact_patterns_default + matrix_bot_meowlnir_config_meowlnir_hacky_redact_patterns_auto + matrix_bot_meowlnir_config_meowlnir_hacky_redact_patterns_custom }}"
|
|
matrix_bot_meowlnir_config_meowlnir_hacky_redact_patterns_default:
|
|
- spam
|
|
matrix_bot_meowlnir_config_meowlnir_hacky_redact_patterns_auto: []
|
|
matrix_bot_meowlnir_config_meowlnir_hacky_redact_patterns_custom: []
|
|
|
|
# Custom Synapse admin access tokens, per bot user ID.
|
|
#
|
|
# A few features (suspending or deactivating users, deleting rooms during a takedown) call Synapse's admin API, which requires the caller to be a server admin.
|
|
# Bots are not server admins, so those calls fail with `M_FORBIDDEN` until a token is supplied here. Nothing else is affected.
|
|
#
|
|
# When left empty, each bot falls back to the appservice token. That is fine for the client-server API, but carries no admin rights.
|
|
#
|
|
# The key is the bot the token is used for; the token itself belongs to an administrator account.
|
|
# Under Matrix Authentication Service it has to be issued by MAS, since Synapse no longer decides who is an admin. See the role's documentation page.
|
|
#
|
|
# Example:
|
|
# matrix_bot_meowlnir_config_meowlnir_admin_tokens:
|
|
# "@meowlnir_bot:example.com": "ADMIN_TOKEN_HERE"
|
|
matrix_bot_meowlnir_config_meowlnir_admin_tokens: {}
|
|
|
|
|
|
########################################################################
|
|
# #
|
|
# Configuration: meowlnir4all (provisioning bots for other people) #
|
|
# #
|
|
########################################################################
|
|
|
|
# None of this is relevant unless you offer moderation bots to other users.
|
|
|
|
# The management room ID that is allowed to use the `!provision` command.
|
|
matrix_bot_meowlnir_config_meowlnir4all_admin_room: ''
|
|
|
|
# The user ID template for newly provisioned bots.
|
|
matrix_bot_meowlnir_config_meowlnir4all_localpart_template: "{{ matrix_bot_meowlnir_user_prefix }}{{ '{{ uuidgen }}' }}"
|
|
|
|
matrix_bot_meowlnir_config_meowlnir4all_displayname: Administrator
|
|
matrix_bot_meowlnir_config_meowlnir4all_avatar_url: ''
|
|
matrix_bot_meowlnir_config_meowlnir4all_room_name: Meowlnir Management Room
|
|
|
|
# The policy lists that newly provisioned bots subscribe to by default.
|
|
#
|
|
# Note that the order of this list is meaningful: when several lists carry a policy for the same entity, the first match wins.
|
|
# Put your own list first if you want to be able to override policies from community lists with `!add-unban`.
|
|
matrix_bot_meowlnir_config_meowlnir4all_default_watched_lists: "{{ matrix_bot_meowlnir_config_meowlnir4all_default_watched_lists_auto + matrix_bot_meowlnir_config_meowlnir4all_default_watched_lists_custom }}"
|
|
matrix_bot_meowlnir_config_meowlnir4all_default_watched_lists_auto: []
|
|
matrix_bot_meowlnir_config_meowlnir4all_default_watched_lists_custom: []
|
|
|
|
|
|
########################################################################
|
|
# #
|
|
# Configuration: antispam (synapse-http-antispam integration) #
|
|
# #
|
|
########################################################################
|
|
|
|
# Certain Meowlnir features (blocking invites and joins before they happen) require the synapse-http-antispam module: https://github.com/maunium/synapse-http-antispam
|
|
#
|
|
# The module has a single consumer, so this cannot be enabled at the same time as `matrix_bot_draupnir_config_web_synapseHTTPAntispam_enabled`.
|
|
matrix_bot_meowlnir_synapse_http_antispam_enabled: false
|
|
|
|
# Secret shared between Meowlnir and the synapse-http-antispam module.
|
|
# The playbook derives a value from `matrix_homeserver_generic_secret_key` by default.
|
|
matrix_bot_meowlnir_config_antispam_secret: ''
|
|
|
|
# Whether Meowlnir should check local invites for spam too.
|
|
matrix_bot_meowlnir_config_antispam_filter_local_invites: false
|
|
|
|
# When set, Meowlnir uses this token to reject pending invites from users who get banned.
|
|
# This should be an appservice token with access to all local users — the double-puppeting appservice token works well here.
|
|
matrix_bot_meowlnir_config_antispam_auto_reject_invites_token: ''
|
|
|
|
# Whether the management room receives a notice about blocked invites.
|
|
matrix_bot_meowlnir_config_antispam_notify_management_room: false
|
|
|
|
# Inviting any of the users listed here is blocked by default, unless separately allowed with the `!allow-invite` command.
|
|
matrix_bot_meowlnir_config_antispam_block_invites_to: "{{ matrix_bot_meowlnir_config_antispam_block_invites_to_auto + matrix_bot_meowlnir_config_antispam_block_invites_to_custom }}"
|
|
matrix_bot_meowlnir_config_antispam_block_invites_to_auto: []
|
|
matrix_bot_meowlnir_config_antispam_block_invites_to_custom: []
|
|
|
|
# The ID of the management room whose policies the synapse-http-antispam module consults.
|
|
#
|
|
# Meowlnir can host several bots, each with its own management room, so the module needs to be told which one to ask.
|
|
# Required when `matrix_bot_meowlnir_synapse_http_antispam_enabled` is on.
|
|
matrix_bot_meowlnir_synapse_http_antispam_management_room_id: ''
|
|
|
|
# The URL that the synapse-http-antispam module targets in Meowlnir.
|
|
#
|
|
# Meowlnir serves the antispam API at `/_meowlnir/antispam/<management room ID>/<callback>`; the module appends the callback name to this base URL.
|
|
matrix_bot_meowlnir_synapse_http_antispam_config_base_url: "{{ matrix_bot_meowlnir_appservice_url }}/_meowlnir/antispam/{{ matrix_bot_meowlnir_synapse_http_antispam_management_room_id }}"
|
|
|
|
matrix_bot_meowlnir_synapse_http_antispam_config_enabled_callbacks:
|
|
- user_may_invite
|
|
- user_may_join_room
|
|
|
|
matrix_bot_meowlnir_synapse_http_antispam_config_fail_open:
|
|
user_may_invite: true
|
|
user_may_join_room: true
|
|
|
|
matrix_bot_meowlnir_synapse_http_antispam_config_async: {}
|
|
|
|
|
|
########################################################################
|
|
# #
|
|
# Configuration: policy server (MSC4284) #
|
|
# #
|
|
########################################################################
|
|
|
|
# Whether Meowlnir acts as a policy server, letting rooms ask it to vet events before they are accepted.
|
|
# Rooms opt in by pointing at this server.
|
|
#
|
|
# Enabling this exposes `/_matrix/policy/` on the Matrix federation endpoint, so that other servers in the room can reach it.
|
|
matrix_bot_meowlnir_policy_server_enabled: false
|
|
|
|
# Whether to always issue redactions for events blocked by the policy server.
|
|
matrix_bot_meowlnir_config_policy_server_always_redact: true
|
|
|
|
# The Synapse-style private signing key used by the policy server.
|
|
#
|
|
# Must NOT be left as the literal `generate`:
|
|
# Meowlnir re-runs its config upgrader on every start, so `generate` would mint a fresh key on each restart.
|
|
# The playbook derives a stable key from `matrix_homeserver_generic_secret_key` by default.
|
|
matrix_bot_meowlnir_config_policy_server_signing_key: ''
|
|
|
|
|
|
########################################################################
|
|
# #
|
|
# Configuration: reporting #
|
|
# #
|
|
########################################################################
|
|
|
|
# Meowlnir can intercept the report API endpoints of the client-server API, so that abuse reports land in a management room.
|
|
# This requires integration with the reverse proxy in front of the homeserver, which the playbook sets up for you when using Traefik.
|
|
#
|
|
# Also set `matrix_bot_meowlnir_config_meowlnir_report_room` to the management room that should receive the reports.
|
|
matrix_bot_meowlnir_config_reporting_enabled: false
|
|
|
|
|
|
########################################################################
|
|
# #
|
|
# Configuration: encryption #
|
|
# #
|
|
########################################################################
|
|
|
|
# Whether Meowlnir bots support end-to-end encryption.
|
|
#
|
|
# This requires MSC3202, MSC4190 and MSC4203 support on the homeserver, plus `experimental_features.msc2409_to_device_messages_enabled`.
|
|
# On Synapse, the playbook turns these on for you when this is enabled.
|
|
matrix_bot_meowlnir_config_encryption_enable: false
|
|
|
|
# Pickle key used for encrypting encryption keys in the crypto store.
|
|
#
|
|
# A fixed constant, like the mautrix bridge roles use, and for the same reason: the crypto store can't be read with a different key than it was written with, so a value that may change would cost the bots their encryption sessions.
|
|
#
|
|
# When migrating a Meowlnir installation that this playbook did not set up, set this to the `pickle_key` from its old configuration file.
|
|
matrix_bot_meowlnir_config_encryption_pickle_key: go.mau.fi/meowlnir
|
|
|
|
|
|
########################################################################
|
|
# #
|
|
# Configuration: databases #
|
|
# #
|
|
########################################################################
|
|
|
|
matrix_bot_meowlnir_database_engine: postgres
|
|
|
|
matrix_bot_meowlnir_database_username: matrix_bot_meowlnir
|
|
matrix_bot_meowlnir_database_password: ''
|
|
matrix_bot_meowlnir_database_hostname: ''
|
|
matrix_bot_meowlnir_database_port: 5432
|
|
matrix_bot_meowlnir_database_name: matrix_bot_meowlnir
|
|
matrix_bot_meowlnir_database_sslmode: disable
|
|
|
|
matrix_bot_meowlnir_database_connection_string: "postgresql://{{ matrix_bot_meowlnir_database_username }}:{{ matrix_bot_meowlnir_database_password }}@{{ matrix_bot_meowlnir_database_hostname }}:{{ matrix_bot_meowlnir_database_port }}/{{ matrix_bot_meowlnir_database_name }}?sslmode={{ matrix_bot_meowlnir_database_sslmode }}"
|
|
|
|
matrix_bot_meowlnir_config_database_max_open_conns: 20
|
|
matrix_bot_meowlnir_config_database_max_idle_conns: 2
|
|
matrix_bot_meowlnir_config_database_max_conn_idle_time: ''
|
|
matrix_bot_meowlnir_config_database_max_conn_lifetime: ''
|
|
|
|
# Access to the Synapse database.
|
|
# Optional: it powers room-hash lookups used by the room takedown features.
|
|
# Leave disabled to run without it.
|
|
#
|
|
# Upstream expects a user with read-only (SELECT) permissions.
|
|
# The playbook does not create one, so enabling the integration below hands Meowlnir the same credentials Synapse itself uses — which grant write access too.
|
|
# Enable it only if you are comfortable with that; otherwise set `matrix_bot_meowlnir_synapse_database_uri` yourself, pointing at a read-only user you have created.
|
|
matrix_bot_meowlnir_synapse_database_integration_enabled: false
|
|
|
|
# Only Postgres is supported.
|
|
# Example:
|
|
# matrix_bot_meowlnir_synapse_database_uri: postgresql://user:password@matrix-postgres:5432/synapse?sslmode=disable
|
|
matrix_bot_meowlnir_synapse_database_uri: ''
|
|
|
|
matrix_bot_meowlnir_config_synapse_db_max_open_conns: 2
|
|
matrix_bot_meowlnir_config_synapse_db_max_idle_conns: 1
|
|
matrix_bot_meowlnir_config_synapse_db_max_conn_idle_time: ''
|
|
matrix_bot_meowlnir_config_synapse_db_max_conn_lifetime: ''
|
|
|
|
|
|
########################################################################
|
|
# #
|
|
# Configuration: logging #
|
|
# #
|
|
########################################################################
|
|
|
|
matrix_bot_meowlnir_config_logging_min_level: info
|
|
|
|
matrix_bot_meowlnir_config_logging_writers:
|
|
- type: stdout
|
|
format: pretty-colored
|
|
|
|
|
|
########################################################################
|
|
# #
|
|
# Traefik labels #
|
|
# #
|
|
########################################################################
|
|
|
|
# Controls whether labels will be added that route certain paths to Meowlnir.
|
|
# Regardless of whether this is enabled, it may or may not take effect due to the value of other variables.
|
|
# See `matrix_synapse_container_labels_traefik_enabled` or `matrix_synapse_container_labels_matrix_related_labels_enabled`.
|
|
matrix_bot_meowlnir_container_labels_traefik_enabled: "{{ matrix_bot_meowlnir_config_reporting_enabled or matrix_bot_meowlnir_policy_server_enabled }}"
|
|
matrix_bot_meowlnir_container_labels_traefik_docker_network: "{{ matrix_bot_meowlnir_container_network }}"
|
|
|
|
# Reports (/_matrix/client/../rooms/../report and /_matrix/client/../users/../report)
|
|
#
|
|
# Only `v3` is matched on purpose:
|
|
# Meowlnir does not serve the legacy `r0` paths, so routing those here would break reporting for old clients.
|
|
matrix_bot_meowlnir_container_labels_reporting_traefik_hostname: "{{ matrix_synapse_container_labels_traefik_hostname }}"
|
|
matrix_bot_meowlnir_container_labels_reporting_traefik_path_regexp: "^/_matrix/client/v3/(rooms|users)/[^/]+/report(/.*)?$"
|
|
matrix_bot_meowlnir_container_labels_reporting_traefik_rule: "Host(`{{ matrix_bot_meowlnir_container_labels_reporting_traefik_hostname }}`) && PathRegexp(`{{ matrix_bot_meowlnir_container_labels_reporting_traefik_path_regexp }}`)"
|
|
matrix_bot_meowlnir_container_labels_reporting_traefik_priority: 0
|
|
matrix_bot_meowlnir_container_labels_reporting_traefik_entrypoints: "{{ matrix_synapse_container_labels_traefik_entrypoints }}"
|
|
matrix_bot_meowlnir_container_labels_reporting_traefik_tls: "{{ matrix_bot_meowlnir_container_labels_reporting_traefik_entrypoints != 'web' }}"
|
|
matrix_bot_meowlnir_container_labels_reporting_traefik_tls_certResolver: "{{ matrix_synapse_container_labels_traefik_tls_certResolver }}" # noqa var-naming
|
|
|
|
# Policy server (/_matrix/policy), served on the federation endpoint
|
|
matrix_bot_meowlnir_container_labels_policy_server_traefik_hostname: "{{ matrix_synapse_container_labels_public_federation_api_traefik_hostname }}"
|
|
matrix_bot_meowlnir_container_labels_policy_server_traefik_path_prefix: /_matrix/policy
|
|
matrix_bot_meowlnir_container_labels_policy_server_traefik_rule: "Host(`{{ matrix_bot_meowlnir_container_labels_policy_server_traefik_hostname }}`) && PathPrefix(`{{ matrix_bot_meowlnir_container_labels_policy_server_traefik_path_prefix }}`)"
|
|
matrix_bot_meowlnir_container_labels_policy_server_traefik_priority: 0
|
|
matrix_bot_meowlnir_container_labels_policy_server_traefik_entrypoints: "{{ matrix_synapse_container_labels_public_federation_api_traefik_entrypoints }}"
|
|
matrix_bot_meowlnir_container_labels_policy_server_traefik_tls: "{{ matrix_bot_meowlnir_container_labels_policy_server_traefik_entrypoints != 'web' }}"
|
|
matrix_bot_meowlnir_container_labels_policy_server_traefik_tls_certResolver: "{{ matrix_synapse_container_labels_traefik_tls_certResolver }}" # noqa var-naming
|
|
|
|
# matrix_bot_meowlnir_container_labels_traefik_labels_additional_labels contains a multiline string with additional labels to add to the container label file.
|
|
# See `../templates/labels.j2` for details.
|
|
#
|
|
# Example:
|
|
# matrix_bot_meowlnir_container_labels_traefik_labels_additional_labels: |
|
|
# my.label=1
|
|
# another.label="here"
|
|
matrix_bot_meowlnir_container_labels_traefik_labels_additional_labels: ''
|
|
|
|
|
|
########################################################################
|
|
# #
|
|
# Configuration assembly #
|
|
# #
|
|
########################################################################
|
|
|
|
# Default configuration template which covers the generic use case.
|
|
# You can customize it by controlling the various variables inside it.
|
|
#
|
|
# For a more advanced customization, you can extend the default (see `matrix_bot_meowlnir_configuration_extension_yaml`) or completely replace this variable with your own template.
|
|
matrix_bot_meowlnir_configuration_yaml: "{{ lookup('template', 'templates/config.yaml.j2') }}"
|
|
|
|
matrix_bot_meowlnir_configuration_extension_yaml: |
|
|
# Your custom YAML configuration goes here.
|
|
# This configuration extends the default starting configuration (`matrix_bot_meowlnir_configuration_yaml`).
|
|
#
|
|
# You can override individual variables from the default configuration, or introduce new ones.
|
|
#
|
|
# If you need something more special, you can take full control by completely redefining `matrix_bot_meowlnir_configuration_yaml`.
|
|
|
|
matrix_bot_meowlnir_configuration_extension: "{{ matrix_bot_meowlnir_configuration_extension_yaml | from_yaml if matrix_bot_meowlnir_configuration_extension_yaml | from_yaml is mapping else {} }}"
|
|
|
|
# Holds the final configuration (a combination of the default and its extension).
|
|
# You most likely don't need to touch this variable.
|
|
# Instead, see `matrix_bot_meowlnir_configuration_yaml`.
|
|
matrix_bot_meowlnir_configuration: "{{ matrix_bot_meowlnir_configuration_yaml | from_yaml | combine(matrix_bot_meowlnir_configuration_extension, recursive=True) }}"
|
|
|
|
# matrix_bot_meowlnir_restart_necessary controls whether the service will be restarted (when true) or merely started (when false) by the systemd service manager role (when conditional restart is enabled).
|
|
#
|
|
# This value is automatically computed during installation based on whether any configuration files, the systemd service file, or the container image changed.
|
|
# The default of `false` means "no restart needed" — appropriate when the role's installation tasks haven't run (e.g., due to --tags skipping them).
|
|
matrix_bot_meowlnir_restart_necessary: false
|