mirror of
https://github.com/spantaleev/matrix-docker-ansible-deploy.git
synced 2026-06-24 17:11:21 +03:00
Add matrix-rustpush-bridge (iMessage)
Add the matrix-rustpush-bridge role, a Matrix <-> iMessage bridge built on the mautrix-go bridgev2 framework using RustPush (OpenBubbles backend). Unlike the existing mautrix-imessage/wsproxy bridge, it talks directly to Apple's push notification service, so it needs neither a running Mac nor a wsproxy on the homeserver. Each user supplies a hardware key extracted from a Mac through the bridge bot's login flow. The bridge uses its own bot username and puppet namespace (rustpushbot, rustpush_*) so it does not collide with the wsproxy iMessage bridge. This bridge is in early development and may have stability issues.
This commit is contained in:
Jason LaGuidice
GitHub
@@ -0,0 +1,248 @@
|
||||
# SPDX-FileCopyrightText: 2026 MDAD project contributors
|
||||
# SPDX-FileCopyrightText: 2026 Jason LaGuidice
|
||||
#
|
||||
# SPDX-License-Identifier: AGPL-3.0-or-later
|
||||
|
||||
---
|
||||
# matrix-bridge-rustpush is a Matrix <-> iMessage bridge using RustPush
|
||||
# Project source code URL: https://github.com/jasonlaguidice/imessage
|
||||
|
||||
matrix_rustpush_bridge_enabled: false
|
||||
|
||||
matrix_rustpush_bridge_container_image_self_build: false
|
||||
matrix_rustpush_bridge_container_image_self_build_repo: "https://github.com/jasonlaguidice/imessage.git"
|
||||
matrix_rustpush_bridge_container_image_self_build_repo_version: "{{ 'master' if matrix_rustpush_bridge_version == 'latest' else matrix_rustpush_bridge_version }}"
|
||||
|
||||
# Adjust to pin to releases
|
||||
matrix_rustpush_bridge_version: v0.0.1
|
||||
matrix_rustpush_bridge_container_image: "{{ matrix_rustpush_bridge_container_image_registry_prefix }}jasonlaguidice/imessage:{{ matrix_rustpush_bridge_version }}"
|
||||
matrix_rustpush_bridge_container_image_registry_prefix: "{{ 'localhost/' if matrix_rustpush_bridge_container_image_self_build else matrix_rustpush_bridge_container_image_registry_prefix_upstream }}"
|
||||
matrix_rustpush_bridge_container_image_registry_prefix_upstream: "{{ matrix_rustpush_bridge_container_image_registry_prefix_upstream_default }}"
|
||||
matrix_rustpush_bridge_container_image_registry_prefix_upstream_default: "ghcr.io/"
|
||||
|
||||
matrix_rustpush_bridge_base_path: "{{ matrix_base_data_path }}/matrix-rustpush-bridge"
|
||||
matrix_rustpush_bridge_config_path: "{{ matrix_rustpush_bridge_base_path }}/config"
|
||||
matrix_rustpush_bridge_data_path: "{{ matrix_rustpush_bridge_base_path }}/data"
|
||||
matrix_rustpush_bridge_container_src_files_path: "{{ matrix_rustpush_bridge_base_path }}/docker-src"
|
||||
|
||||
matrix_rustpush_bridge_homeserver_address: ""
|
||||
# Whether asynchronous uploads via MSC2246 should be enabled for media.
|
||||
matrix_rustpush_bridge_homeserver_async_media: false
|
||||
matrix_rustpush_bridge_homeserver_domain: '{{ matrix_domain }}'
|
||||
matrix_rustpush_bridge_appservice_address: 'http://matrix-rustpush-bridge:8081'
|
||||
|
||||
matrix_rustpush_bridge_msc4190_enabled: "{{ matrix_bridges_msc4190_enabled }}"
|
||||
matrix_rustpush_bridge_self_sign_enabled: "{{ matrix_bridges_self_sign_enabled }}"
|
||||
|
||||
# A public address that external services can use to reach this appservice.
|
||||
matrix_rustpush_bridge_appservice_public_address: ''
|
||||
|
||||
# Displayname template for iMessage contacts.
|
||||
# Available variables: {{.FirstName}}, {{.LastName}}, {{.Nickname}},
|
||||
# {{.Phone}}, {{.Email}}, {{.ID}}
|
||||
matrix_rustpush_bridge_network_displayname_template: "{% raw %}{{if .FirstName}}{{.FirstName}}{{if .LastName}} {{.LastName}}{{end}}{{else if .Nickname}}{{.Nickname}}{{else if .Phone}}{{.Phone}}{{else if .Email}}{{.Email}}{{else}}{{.ID}}{{end}} (iMessage){% endraw %}"
|
||||
|
||||
matrix_rustpush_bridge_cloudkit_backfill: true
|
||||
matrix_rustpush_bridge_video_transcoding: true
|
||||
matrix_rustpush_bridge_heic_conversion: true
|
||||
matrix_rustpush_bridge_disable_facetime: false
|
||||
matrix_rustpush_bridge_statuskit_notifications: true
|
||||
matrix_rustpush_bridge_statuskit_share_on_startup: true
|
||||
|
||||
matrix_rustpush_bridge_bridge_command_prefix: "!im"
|
||||
|
||||
matrix_rustpush_bridge_bridge_permissions: |
|
||||
{{
|
||||
{matrix_rustpush_bridge_homeserver_domain: 'user'}
|
||||
| combine({matrix_admin: 'admin'} if matrix_admin else {})
|
||||
}}
|
||||
|
||||
matrix_rustpush_bridge_container_network: ""
|
||||
|
||||
matrix_rustpush_bridge_container_additional_networks: "{{ matrix_rustpush_bridge_container_additional_networks_auto + matrix_rustpush_bridge_container_additional_networks_custom }}"
|
||||
matrix_rustpush_bridge_container_additional_networks_auto: []
|
||||
matrix_rustpush_bridge_container_additional_networks_custom: []
|
||||
|
||||
# matrix_rustpush_bridge_container_labels_traefik_enabled controls whether labels to assist a Traefik reverse-proxy will be attached to the container.
|
||||
# See `../templates/labels.j2` for details.
|
||||
#
|
||||
# To inject your own other container labels, see `matrix_rustpush_bridge_container_labels_additional_labels`.
|
||||
matrix_rustpush_bridge_container_labels_traefik_enabled: true
|
||||
matrix_rustpush_bridge_container_labels_traefik_docker_network: "{{ matrix_rustpush_bridge_container_network }}"
|
||||
matrix_rustpush_bridge_container_labels_traefik_entrypoints: web-secure
|
||||
matrix_rustpush_bridge_container_labels_traefik_tls_certResolver: default # noqa var-naming
|
||||
|
||||
# Controls whether labels will be added that expose metrics
|
||||
matrix_rustpush_bridge_container_labels_metrics_enabled: "{{ matrix_rustpush_bridge_metrics_enabled and matrix_rustpush_bridge_metrics_proxying_enabled }}"
|
||||
matrix_rustpush_bridge_container_labels_metrics_traefik_rule: "Host(`{{ matrix_rustpush_bridge_metrics_proxying_hostname }}`) && PathPrefix(`{{ matrix_rustpush_bridge_metrics_proxying_path_prefix }}`)"
|
||||
matrix_rustpush_bridge_container_labels_metrics_traefik_priority: 0
|
||||
matrix_rustpush_bridge_container_labels_metrics_traefik_entrypoints: "{{ matrix_rustpush_bridge_container_labels_traefik_entrypoints }}"
|
||||
matrix_rustpush_bridge_container_labels_metrics_traefik_tls: "{{ matrix_rustpush_bridge_container_labels_metrics_traefik_entrypoints != 'web' }}"
|
||||
matrix_rustpush_bridge_container_labels_metrics_traefik_tls_certResolver: "{{ matrix_rustpush_bridge_container_labels_traefik_tls_certResolver }}" # noqa var-naming
|
||||
matrix_rustpush_bridge_container_labels_metrics_middleware_basic_auth_enabled: false
|
||||
# See: https://doc.traefik.io/traefik/middlewares/http/basicauth/#users
|
||||
matrix_rustpush_bridge_container_labels_metrics_middleware_basic_auth_users: ''
|
||||
|
||||
# matrix_rustpush_bridge_container_labels_additional_labels contains a multiline string with additional labels to add to the container label file.
|
||||
# See `../templates/labels.j2` for details.
|
||||
#
|
||||
# Example:
|
||||
# matrix_rustpush_bridge_container_labels_additional_labels: |
|
||||
# my.label=1
|
||||
# another.label="here"
|
||||
matrix_rustpush_bridge_container_labels_additional_labels: ''
|
||||
|
||||
# A list of extra arguments to pass to the container
|
||||
matrix_rustpush_bridge_container_extra_arguments: []
|
||||
|
||||
# Override the Rust log filter passed to the bridge container via RUST_LOG.
|
||||
# Leave empty to use the bridge's built-in default
|
||||
# ("warn,rustpush=warn,rustpushgo=info,open_absinthe=info").
|
||||
#
|
||||
# Useful values:
|
||||
# "warn,rustpushgo=info,open_absinthe=debug" # NAC emulator diagnostics (_enc field sizes, etc.)
|
||||
# "warn,rustpushgo=info,open_absinthe=debug,rustpush=info" # + upstream rustpush internals
|
||||
# "debug" # everything (very chatty)
|
||||
#
|
||||
# The open_absinthe crate logs NAC hardware-key diagnostics at INFO and emulator
|
||||
# state at DEBUG. These are suppressed by default to reduce log noise.
|
||||
matrix_rustpush_bridge_rust_log: ""
|
||||
|
||||
# List of systemd services that matrix-rustpush-bridge.service depends on.
|
||||
matrix_rustpush_bridge_systemd_required_services_list: "{{ matrix_rustpush_bridge_systemd_required_services_list_default + matrix_rustpush_bridge_systemd_required_services_list_auto + matrix_rustpush_bridge_systemd_required_services_list_custom }}"
|
||||
matrix_rustpush_bridge_systemd_required_services_list_default: "{{ [devture_systemd_docker_base_docker_service_name] if devture_systemd_docker_base_docker_service_name else [] }}"
|
||||
matrix_rustpush_bridge_systemd_required_services_list_auto: []
|
||||
matrix_rustpush_bridge_systemd_required_services_list_custom: []
|
||||
|
||||
# List of systemd services that matrix-rustpush-bridge.service wants
|
||||
matrix_rustpush_bridge_systemd_wanted_services_list: []
|
||||
|
||||
matrix_rustpush_bridge_appservice_token: ''
|
||||
matrix_rustpush_bridge_homeserver_token: ''
|
||||
|
||||
# Whether or not created rooms should have federation enabled.
|
||||
# If false, created portal rooms will never be federated.
|
||||
matrix_rustpush_bridge_matrix_federate_rooms: false
|
||||
|
||||
# Database-related configuration fields.
|
||||
#
|
||||
# To use Postgres:
|
||||
# - adjust your database credentials via the `matrix_rustpush_bridge_postgres_*` variables
|
||||
matrix_rustpush_bridge_database_engine: 'postgres'
|
||||
|
||||
matrix_rustpush_bridge_database_username: 'matrix_rustpush_bridge'
|
||||
matrix_rustpush_bridge_database_password: 'some-password'
|
||||
matrix_rustpush_bridge_database_hostname: ''
|
||||
matrix_rustpush_bridge_database_port: 5432
|
||||
matrix_rustpush_bridge_database_name: 'matrix_rustpush_bridge'
|
||||
matrix_rustpush_bridge_database_sslmode: disable
|
||||
|
||||
matrix_rustpush_bridge_database_connection_string: 'postgres://{{ matrix_rustpush_bridge_database_username }}:{{ matrix_rustpush_bridge_database_password }}@{{ matrix_rustpush_bridge_database_hostname }}:{{ matrix_rustpush_bridge_database_port }}/{{ matrix_rustpush_bridge_database_name }}?sslmode={{ matrix_rustpush_bridge_database_sslmode }}'
|
||||
|
||||
matrix_rustpush_bridge_database_uri: "{{
|
||||
{
|
||||
'postgres': matrix_rustpush_bridge_database_connection_string,
|
||||
}[matrix_rustpush_bridge_database_engine]
|
||||
}}"
|
||||
|
||||
matrix_rustpush_bridge_double_puppet_secrets: "{{ matrix_rustpush_bridge_double_puppet_secrets_auto | combine(matrix_rustpush_bridge_double_puppet_secrets_custom) }}"
|
||||
matrix_rustpush_bridge_double_puppet_secrets_auto: {}
|
||||
matrix_rustpush_bridge_double_puppet_secrets_custom: {}
|
||||
|
||||
matrix_rustpush_bridge_appservice_bot_username: rustpushbot
|
||||
matrix_rustpush_bridge_appservice_bot_displayname: RustPush bridge bot
|
||||
matrix_rustpush_bridge_appservice_bot_avatar: ''
|
||||
|
||||
# Localpart template for MXIDs of remote (iMessage) users.
|
||||
# The `{{.}}` placeholder expands to the iMessage handle (phone/email).
|
||||
matrix_rustpush_bridge_appservice_username_template: "{% raw %}rustpush_{{.}}{% endraw %}"
|
||||
|
||||
# Backfill is disabled by default because Linux Docker cannot access chat.db.
|
||||
# On macOS with Full Disk Access, this can be set to true.
|
||||
matrix_rustpush_bridge_backfill_enabled: false
|
||||
# Maximum number of messages to backfill in empty rooms
|
||||
matrix_rustpush_bridge_backfill_max_initial_messages: 50
|
||||
|
||||
# Maximum number of missed messages to backfill after bridge restarts
|
||||
matrix_rustpush_bridge_backfill_max_catchup_messages: 500
|
||||
|
||||
# How many days back to look for chats during initial sync.
|
||||
# Default in upstream is 365 (1 year). Set to 0 to disable.
|
||||
matrix_rustpush_bridge_initial_sync_days: 365
|
||||
|
||||
# Shared secret for authentication of provisioning API requests.
|
||||
# If set to "disable", the provisioning API will be disabled.
|
||||
matrix_rustpush_bridge_provisioning_shared_secret: disable
|
||||
|
||||
# Minimum severity of journal log messages.
|
||||
# Valid values: fatal, error, warn, info, debug, trace
|
||||
matrix_rustpush_bridge_logging_level: 'warn'
|
||||
|
||||
# Whether or not metrics endpoint should be enabled.
|
||||
# Enabling them is usually enough for a local (in-container) Prometheus to consume them.
|
||||
# If metrics need to be consumed by another (external) Prometheus server, consider exposing them via `matrix_rustpush_bridge_metrics_proxying_enabled`.
|
||||
matrix_rustpush_bridge_metrics_enabled: false
|
||||
|
||||
# Controls whether metrics should be exposed on a public URL.
|
||||
matrix_rustpush_bridge_metrics_proxying_enabled: false
|
||||
matrix_rustpush_bridge_metrics_proxying_hostname: ''
|
||||
matrix_rustpush_bridge_metrics_proxying_path_prefix: ''
|
||||
|
||||
# Default configuration template which covers the generic use case.
|
||||
# You can customize it by controlling the various variables inside it.
|
||||
#
|
||||
# For a more advanced customization, you can extend the default (see `matrix_rustpush_bridge_configuration_extension_yaml`)
|
||||
# or completely replace this variable with your own template.
|
||||
matrix_rustpush_bridge_configuration_yaml: "{{ lookup('template', 'templates/config.yaml.j2') }}"
|
||||
|
||||
matrix_rustpush_bridge_configuration_extension_yaml: |
|
||||
# Your custom YAML configuration goes here.
|
||||
# This configuration extends the default starting configuration (`matrix_rustpush_bridge_configuration_yaml`).
|
||||
#
|
||||
# You can override individual variables from the default configuration, or introduce new ones.
|
||||
#
|
||||
# If you need something more special, you can take full control by
|
||||
# completely redefining `matrix_rustpush_bridge_configuration_yaml`.
|
||||
|
||||
matrix_rustpush_bridge_configuration_extension: "{{ matrix_rustpush_bridge_configuration_extension_yaml | from_yaml if matrix_rustpush_bridge_configuration_extension_yaml | from_yaml is mapping else {} }}"
|
||||
|
||||
# Holds the final configuration (a combination of the default and its extension).
|
||||
# You most likely don't need to touch this variable. Instead, see `matrix_rustpush_bridge_configuration_yaml`.
|
||||
matrix_rustpush_bridge_configuration: "{{ matrix_rustpush_bridge_configuration_yaml | from_yaml | combine(matrix_rustpush_bridge_configuration_extension, recursive=True) }}"
|
||||
|
||||
matrix_rustpush_bridge_registration_yaml: |
|
||||
id: rustpush-bridge
|
||||
as_token: "{{ matrix_rustpush_bridge_appservice_token }}"
|
||||
hs_token: "{{ matrix_rustpush_bridge_homeserver_token }}"
|
||||
namespaces:
|
||||
users:
|
||||
- exclusive: true
|
||||
regex: '^@rustpush_.+:{{ matrix_rustpush_bridge_homeserver_domain | regex_escape }}$'
|
||||
- exclusive: true
|
||||
regex: '^@{{ matrix_rustpush_bridge_appservice_bot_username | regex_escape }}:{{ matrix_rustpush_bridge_homeserver_domain | regex_escape }}$'
|
||||
url: {{ matrix_rustpush_bridge_appservice_address }}
|
||||
sender_localpart: _bot_{{ matrix_rustpush_bridge_appservice_bot_username }}
|
||||
rate_limited: false
|
||||
de.sorunome.msc2409.push_ephemeral: true
|
||||
receive_ephemeral: true
|
||||
io.element.msc4190: {{ matrix_rustpush_bridge_msc4190_enabled | to_json }}
|
||||
|
||||
matrix_rustpush_bridge_registration: "{{ matrix_rustpush_bridge_registration_yaml | from_yaml }}"
|
||||
|
||||
# Enable End-to-bridge encryption
|
||||
matrix_rustpush_bridge_bridge_encryption_allow: "{{ matrix_bridges_encryption_enabled }}"
|
||||
matrix_rustpush_bridge_bridge_encryption_default: "{{ matrix_bridges_encryption_default }}"
|
||||
matrix_rustpush_bridge_bridge_encryption_require: false
|
||||
matrix_rustpush_bridge_bridge_encryption_appservice: false
|
||||
matrix_rustpush_bridge_bridge_encryption_key_sharing_allow: "{{ matrix_rustpush_bridge_bridge_encryption_allow }}"
|
||||
matrix_rustpush_bridge_bridge_encryption_pickle_key: mautrix.bridge.e2ee
|
||||
|
||||
# matrix_rustpush_bridge_restart_necessary controls whether the service
|
||||
# will be restarted (when true) or merely started (when false) by the
|
||||
# systemd service manager role (when conditional restart is enabled).
|
||||
#
|
||||
# This value is automatically computed during installation based on whether
|
||||
# any configuration files, the systemd service file, or the container image changed.
|
||||
# The default of `false` means "no restart needed" — appropriate when the role's
|
||||
# installation tasks haven't run (e.g., due to --tags skipping them).
|
||||
matrix_rustpush_bridge_restart_necessary: false
|
||||
Reference in New Issue
Block a user