Add deterministic public_media_signing_key, expose portal cleanup

group_vars/matrix_servers

@@ -2789,6 +2789,7 @@ matrix_steam_bridge_appservice_token: "{{ '%s' | format(matrix_homeserver_generi
 
 matrix_steam_bridge_homeserver_address: "{{ matrix_addons_homeserver_client_api_url }}"
 matrix_steam_bridge_homeserver_token: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'steam.hs.token', rounds=655555) | to_uuid }}"
+matrix_steam_bridge_public_media_signing_key: "{{ ('%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'steam.pub.key', rounds=655555) | to_uuid) if matrix_steam_bridge_public_media_enabled else '' }}"
 
 matrix_steam_bridge_provisioning_shared_secret: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'steam.prov', rounds=655555) | to_uuid }}"
 

roles/custom/matrix-bridge-steam/defaults/main.yml

@@ -39,7 +39,8 @@ matrix_steam_bridge_appservice_public_address: "https://{{ matrix_server_fqn_mat
 # Public media configuration for external access to bridge media
 matrix_steam_bridge_public_media_enabled: true
 # A key for signing public media URLs. If set to "generate", a random key will be generated.
-matrix_steam_bridge_public_media_signing_key: generate
+# This will be auto-generated deterministically if matrix_homeserver_generic_secret_key is set.
+matrix_steam_bridge_public_media_signing_key: ''
 # Number of seconds that public media URLs are valid for. If set to 0, URLs will never expire.
 matrix_steam_bridge_public_media_expiry: 0
 matrix_steam_bridge_public_media_hash_length: 32
@@ -112,6 +113,30 @@ matrix_steam_bridge_homeserver_token: ''
 # If false, created portal rooms will never be federated.
 matrix_steam_bridge_matrix_federate_rooms: false
 
+# Bridge configuration options
+# Should every user have their own portals rather than sharing them?
+matrix_steam_bridge_bridge_split_portals: false
+
+# Cleanup on logout configuration
+matrix_steam_bridge_bridge_cleanup_on_logout_enabled: false
+# Valid values for cleanup actions: nothing, kick, unbridge, delete
+#   nothing - Do nothing, let the user stay in the portals
+#   kick - Remove the user from the portal rooms, but don't delete them
+#   unbridge - Remove all ghosts in the room and disassociate it from the remote chat
+#   delete - Remove all ghosts and users from the room (i.e. delete it)
+matrix_steam_bridge_bridge_cleanup_on_logout_manual_private: nothing
+matrix_steam_bridge_bridge_cleanup_on_logout_manual_relayed: nothing
+matrix_steam_bridge_bridge_cleanup_on_logout_manual_shared_no_users: nothing
+matrix_steam_bridge_bridge_cleanup_on_logout_manual_shared_has_users: nothing
+matrix_steam_bridge_bridge_cleanup_on_logout_bad_credentials_private: nothing
+matrix_steam_bridge_bridge_cleanup_on_logout_bad_credentials_relayed: nothing
+matrix_steam_bridge_bridge_cleanup_on_logout_bad_credentials_shared_no_users: nothing
+matrix_steam_bridge_bridge_cleanup_on_logout_bad_credentials_shared_has_users: nothing
+
+# Homeserver configuration options
+# Does the homeserver support MSC2246 (async media uploads)?
+matrix_steam_bridge_homeserver_async_media: false
+
 # Database-related configuration fields.
 #
 # To use Postgres:

roles/custom/matrix-bridge-steam/templates/config.yaml.j2

@@ -38,7 +38,7 @@ bridge:
     # By default, users who are in the same group on the remote network will be
     # in the same Matrix room bridged to that group. If this is set to true,
     # every user will get their own Matrix room instead.
-    split_portals: false
+    split_portals: {{ matrix_steam_bridge_bridge_split_portals | to_json }}
     # Should the bridge resend `m.bridge` events to all portals on startup?
     resend_bridge_info: false
     # Should `m.bridge` events be sent without a state key?
@@ -77,24 +77,24 @@ bridge:
     #   delete - Remove all ghosts and users from the room (i.e. delete it)
     cleanup_on_logout:
         # Should cleanup on logout be enabled at all?
-        enabled: false
+        enabled: {{ matrix_steam_bridge_bridge_cleanup_on_logout_enabled | to_json }}
         # Settings for manual logouts (explicitly initiated by the Matrix user)
         manual:
             # Action for private portals which will never be shared with other Matrix users.
-            private: nothing
+            private: {{ matrix_steam_bridge_bridge_cleanup_on_logout_manual_private | to_json }}
             # Action for portals with a relay user configured.
-            relayed: nothing
+            relayed: {{ matrix_steam_bridge_bridge_cleanup_on_logout_manual_relayed | to_json }}
             # Action for portals which may be shared, but don't currently have any other Matrix users.
-            shared_no_users: nothing
+            shared_no_users: {{ matrix_steam_bridge_bridge_cleanup_on_logout_manual_shared_no_users | to_json }}
             # Action for portals which have other logged-in Matrix users.
-            shared_has_users: nothing
+            shared_has_users: {{ matrix_steam_bridge_bridge_cleanup_on_logout_manual_shared_has_users | to_json }}
         # Settings for credentials being invalidated (initiated by the remote network, possibly through user action).
         # Keys have the same meanings as in the manual section.
         bad_credentials:
-            private: nothing
-            relayed: nothing
-            shared_no_users: nothing
-            shared_has_users: nothing
+            private: {{ matrix_steam_bridge_bridge_cleanup_on_logout_bad_credentials_private | to_json }}
+            relayed: {{ matrix_steam_bridge_bridge_cleanup_on_logout_bad_credentials_relayed | to_json }}
+            shared_no_users: {{ matrix_steam_bridge_bridge_cleanup_on_logout_bad_credentials_shared_no_users | to_json }}
+            shared_has_users: {{ matrix_steam_bridge_bridge_cleanup_on_logout_bad_credentials_shared_has_users | to_json }}
 
     # Settings for relay mode
     relay:
@@ -184,7 +184,7 @@ homeserver:
     # The bridge will use the appservice as_token to authorize requests.
     message_send_checkpoint_endpoint:
     # Does the homeserver support https://github.com/matrix-org/matrix-spec-proposals/pull/2246?
-    async_media: false
+    async_media: {{ matrix_steam_bridge_homeserver_async_media | to_json }}
 
     # Should the bridge use a websocket for connecting to the homeserver?
     # The server side is currently not documented anywhere and is only implemented by mautrix-wsproxy,

roles/custom/matrix-bridge-steam/templates/systemd/matrix-steam-bridge.service.j2

@@ -23,14 +23,14 @@ ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} create \
 			--user={{ matrix_user_uid }}:{{ matrix_user_gid }} \
 			--cap-drop=ALL \
 			--network={{ matrix_steam_bridge_container_network }} \
-			--mount type=bind,src={{ matrix_steam_bridge_config_path }},dst=/app/config \
+			--mount type=bind,src={{ matrix_steam_bridge_config_path }},dst=/app/config,ro \
 			--mount type=bind,src={{ matrix_steam_bridge_data_path }},dst=/app/data \
 			--label-file={{ matrix_steam_bridge_base_path }}/labels \
 			{% for arg in matrix_steam_bridge_container_extra_arguments %}
 			{{ arg }} \
 			{% endfor %}
 			{{ matrix_steam_bridge_docker_image }} \
-			/usr/bin/steam -c /app/config/config.yaml -r /app/config/registration.yaml
+			/usr/bin/steam -c /app/config/config.yaml -r /app/config/registration.yaml --no-update
 
 {% for network in matrix_steam_bridge_container_additional_networks %}
 ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} network connect {{ network }} matrix-steam-bridge