titan-iac/services/comms/reset-othrys-room-job.yaml

# services/comms/reset-othrys-room-job.yaml
apiVersion: batch/v1
kind: CronJob
metadata:
  name: othrys-room-reset
  namespace: comms
spec:
  schedule: "0 0 1 1 *"
  suspend: true
  concurrencyPolicy: Forbid
  successfulJobsHistoryLimit: 1
  failedJobsHistoryLimit: 1
  jobTemplate:
    spec:
      backoffLimit: 0
      template:
        metadata:
          annotations:
            vault.hashicorp.com/agent-inject: "true"
            vault.hashicorp.com/agent-pre-populate-only: "true"
            vault.hashicorp.com/role: "comms"
            vault.hashicorp.com/agent-inject-secret-turn-secret: "kv/data/atlas/comms/turn-shared-secret"
            vault.hashicorp.com/agent-inject-template-turn-secret: |
              {{- with secret "kv/data/atlas/comms/turn-shared-secret" -}}{{ .Data.data.TURN_STATIC_AUTH_SECRET }}{{- end -}}
            vault.hashicorp.com/agent-inject-secret-livekit-primary: "kv/data/atlas/comms/livekit-api"
            vault.hashicorp.com/agent-inject-template-livekit-primary: |
              {{- with secret "kv/data/atlas/comms/livekit-api" -}}{{ .Data.data.primary }}{{- end -}}
            vault.hashicorp.com/agent-inject-secret-bot-pass: "kv/data/atlas/comms/atlasbot-credentials-runtime"
            vault.hashicorp.com/agent-inject-template-bot-pass: |
              {{- with secret "kv/data/atlas/comms/atlasbot-credentials-runtime" -}}{{ index .Data.data "bot-password" }}{{- end -}}
            vault.hashicorp.com/agent-inject-secret-seeder-pass: "kv/data/atlas/comms/atlasbot-credentials-runtime"
            vault.hashicorp.com/agent-inject-template-seeder-pass: |
              {{- with secret "kv/data/atlas/comms/atlasbot-credentials-runtime" -}}{{ index .Data.data "seeder-password" }}{{- end -}}
            vault.hashicorp.com/agent-inject-secret-chat-matrix: "kv/data/atlas/shared/chat-ai-keys-runtime"
            vault.hashicorp.com/agent-inject-template-chat-matrix: |
              {{- with secret "kv/data/atlas/shared/chat-ai-keys-runtime" -}}{{ .Data.data.matrix }}{{- end -}}
            vault.hashicorp.com/agent-inject-secret-chat-homepage: "kv/data/atlas/shared/chat-ai-keys-runtime"
            vault.hashicorp.com/agent-inject-template-chat-homepage: |
              {{- with secret "kv/data/atlas/shared/chat-ai-keys-runtime" -}}{{ .Data.data.homepage }}{{- end -}}
            vault.hashicorp.com/agent-inject-secret-mas-admin-secret: "kv/data/atlas/comms/mas-admin-client-runtime"
            vault.hashicorp.com/agent-inject-template-mas-admin-secret: |
              {{- with secret "kv/data/atlas/comms/mas-admin-client-runtime" -}}{{ .Data.data.client_secret }}{{- end -}}
            vault.hashicorp.com/agent-inject-secret-synapse-db-pass: "kv/data/atlas/comms/synapse-db"
            vault.hashicorp.com/agent-inject-template-synapse-db-pass: |
              {{- with secret "kv/data/atlas/comms/synapse-db" -}}{{ .Data.data.POSTGRES_PASSWORD }}{{- end -}}
            vault.hashicorp.com/agent-inject-secret-mas-db-pass: "kv/data/atlas/comms/mas-db"
            vault.hashicorp.com/agent-inject-template-mas-db-pass: |
              {{- with secret "kv/data/atlas/comms/mas-db" -}}{{ .Data.data.password }}{{- end -}}
            vault.hashicorp.com/agent-inject-secret-mas-matrix-shared: "kv/data/atlas/comms/mas-secrets-runtime"
            vault.hashicorp.com/agent-inject-template-mas-matrix-shared: |
              {{- with secret "kv/data/atlas/comms/mas-secrets-runtime" -}}{{ .Data.data.matrix_shared_secret }}{{- end -}}
            vault.hashicorp.com/agent-inject-secret-mas-kc-secret: "kv/data/atlas/comms/mas-secrets-runtime"
            vault.hashicorp.com/agent-inject-template-mas-kc-secret: |
              {{- with secret "kv/data/atlas/comms/mas-secrets-runtime" -}}{{ .Data.data.keycloak_client_secret }}{{- end -}}
        spec:
          restartPolicy: Never
          serviceAccountName: comms-vault
          containers:
            - name: reset
              image: python:3.11-slim
              env:
                - name: SYNAPSE_BASE
                  value: http://othrys-synapse-matrix-synapse:8008
                - name: AUTH_BASE
                  value: http://matrix-authentication-service:8080
                - name: SERVER_NAME
                  value: live.bstein.dev
                - name: ROOM_ALIAS
                  value: "#othrys:live.bstein.dev"
                - name: ROOM_NAME
                  value: Othrys
                - name: PIN_MESSAGE
                  value: "Invite guests: share https://live.bstein.dev/#/room/#othrys:live.bstein.dev?action=join and choose 'Continue' -> 'Join as guest'."
                - name: SEEDER_USER
                  value: othrys-seeder
                - name: BOT_USER
                  value: atlasbot
              command:
                - /bin/sh
                - -c
                - |
                  set -euo pipefail
                  . /vault/scripts/comms_vault_env.sh
                  pip install --no-cache-dir requests >/dev/null
                  python - <<'PY'
                  import os
                  import time
                  import urllib.parse
                  import requests

                  BASE = os.environ["SYNAPSE_BASE"]
                  AUTH_BASE = os.environ.get("AUTH_BASE", BASE)
                  SERVER_NAME = os.environ.get("SERVER_NAME", "live.bstein.dev")
                  ROOM_ALIAS = os.environ.get("ROOM_ALIAS", "#othrys:live.bstein.dev")
                  ROOM_NAME = os.environ.get("ROOM_NAME", "Othrys")
                  PIN_MESSAGE = os.environ["PIN_MESSAGE"]
                  SEEDER_USER = os.environ["SEEDER_USER"]
                  SEEDER_PASS = os.environ["SEEDER_PASS"]
                  BOT_USER = os.environ["BOT_USER"]

                  POWER_LEVELS = {
                      "ban": 50,
                      "events": {
                          "m.room.avatar": 50,
                          "m.room.canonical_alias": 50,
                          "m.room.encryption": 100,
                          "m.room.history_visibility": 100,
                          "m.room.name": 50,
                          "m.room.power_levels": 100,
                          "m.room.server_acl": 100,
                          "m.room.tombstone": 100,
                      },
                      "events_default": 0,
                      "historical": 100,
                      "invite": 50,
                      "kick": 50,
                      "m.call.invite": 50,
                      "redact": 50,
                      "state_default": 50,
                      "users": {f"@{SEEDER_USER}:{SERVER_NAME}": 100},
                      "users_default": 0,
                  }

                  def auth(token):
                      return {"Authorization": f"Bearer {token}"}

                  def canon_user(user):
                      u = (user or "").strip()
                      if u.startswith("@") and ":" in u:
                          return u
                      u = u.lstrip("@")
                      if ":" in u:
                          return f"@{u}"
                      return f"@{u}:{SERVER_NAME}"

                  def login(user, password):
                      r = requests.post(
                          f"{AUTH_BASE}/_matrix/client/v3/login",
                          json={
                              "type": "m.login.password",
                              "identifier": {"type": "m.id.user", "user": canon_user(user)},
                              "password": password,
                          },
                      )
                      if r.status_code != 200:
                          raise SystemExit(f"login failed: {r.status_code} {r.text}")
                      return r.json()["access_token"]

                  def resolve_alias(token, alias):
                      enc = urllib.parse.quote(alias)
                      r = requests.get(f"{BASE}/_matrix/client/v3/directory/room/{enc}", headers=auth(token))
                      if r.status_code == 404:
                          return None
                      r.raise_for_status()
                      return r.json()["room_id"]

                  def create_room(token):
                      r = requests.post(
                          f"{BASE}/_matrix/client/v3/createRoom",
                          headers=auth(token),
                          json={
                              "preset": "public_chat",
                              "name": ROOM_NAME,
                              "room_version": "11",
                          },
                      )
                      r.raise_for_status()
                      return r.json()["room_id"]

                  def put_state(token, room_id, ev_type, content):
                      r = requests.put(
                          f"{BASE}/_matrix/client/v3/rooms/{urllib.parse.quote(room_id)}/state/{ev_type}",
                          headers=auth(token),
                          json=content,
                      )
                      r.raise_for_status()

                  def set_directory_visibility(token, room_id, visibility):
                      r = requests.put(
                          f"{BASE}/_matrix/client/v3/directory/list/room/{urllib.parse.quote(room_id)}",
                          headers=auth(token),
                          json={"visibility": visibility},
                      )
                      r.raise_for_status()

                  def delete_alias(token, alias):
                      enc = urllib.parse.quote(alias)
                      r = requests.delete(f"{BASE}/_matrix/client/v3/directory/room/{enc}", headers=auth(token))
                      if r.status_code in (200, 202, 404):
                          return
                      r.raise_for_status()

                  def put_alias(token, alias, room_id):
                      enc = urllib.parse.quote(alias)
                      r = requests.put(
                          f"{BASE}/_matrix/client/v3/directory/room/{enc}",
                          headers=auth(token),
                          json={"room_id": room_id},
                      )
                      r.raise_for_status()

                  def list_joined_members(token, room_id):
                      r = requests.get(
                          f"{BASE}/_matrix/client/v3/rooms/{urllib.parse.quote(room_id)}/members?membership=join",
                          headers=auth(token),
                      )
                      r.raise_for_status()
                      members = []
                      for ev in r.json().get("chunk", []):
                          if ev.get("type") != "m.room.member":
                              continue
                          uid = ev.get("state_key")
                          if not isinstance(uid, str) or not uid.startswith("@"):
                              continue
                          members.append(uid)
                      return members

                  def invite_user(token, room_id, user_id):
                      r = requests.post(
                          f"{BASE}/_matrix/client/v3/rooms/{urllib.parse.quote(room_id)}/invite",
                          headers=auth(token),
                          json={"user_id": user_id},
                      )
                      if r.status_code in (200, 202):
                          return
                      r.raise_for_status()

                  def send_message(token, room_id, body):
                      r = requests.post(
                          f"{BASE}/_matrix/client/v3/rooms/{urllib.parse.quote(room_id)}/send/m.room.message",
                          headers=auth(token),
                          json={"msgtype": "m.text", "body": body},
                      )
                      r.raise_for_status()
                      return r.json()["event_id"]

                  def login_with_retry():
                      last = None
                      for attempt in range(1, 6):
                          try:
                              return login(SEEDER_USER, SEEDER_PASS)
                          except Exception as exc:  # noqa: BLE001
                              last = exc
                              time.sleep(attempt * 2)
                      raise last

                  token = login_with_retry()

                  old_room_id = resolve_alias(token, ROOM_ALIAS)
                  if not old_room_id:
                      raise SystemExit(f"alias {ROOM_ALIAS} not found; refusing to proceed")

                  new_room_id = create_room(token)

                  # Configure the new room.
                  put_state(token, new_room_id, "m.room.join_rules", {"join_rule": "public"})
                  put_state(token, new_room_id, "m.room.guest_access", {"guest_access": "can_join"})
                  put_state(token, new_room_id, "m.room.history_visibility", {"history_visibility": "shared"})
                  put_state(token, new_room_id, "m.room.power_levels", POWER_LEVELS)

                  # Move the alias.
                  delete_alias(token, ROOM_ALIAS)
                  put_alias(token, ROOM_ALIAS, new_room_id)
                  put_state(token, new_room_id, "m.room.canonical_alias", {"alias": ROOM_ALIAS})

                  set_directory_visibility(token, new_room_id, "public")

                  # Invite the bot and all joined members of the old room.
                  bot_user_id = f"@{BOT_USER}:{SERVER_NAME}"
                  invite_user(token, new_room_id, bot_user_id)
                  for uid in list_joined_members(token, old_room_id):
                      if uid == f"@{SEEDER_USER}:{SERVER_NAME}":
                          continue
                      localpart = uid.split(":", 1)[0].lstrip("@")
                      if localpart.isdigit():
                          continue
                      invite_user(token, new_room_id, uid)

                  # Pin the guest invite message in the new room.
                  event_id = send_message(token, new_room_id, PIN_MESSAGE)
                  put_state(token, new_room_id, "m.room.pinned_events", {"pinned": [event_id]})

                  # De-list and tombstone the old room.
                  set_directory_visibility(token, old_room_id, "private")
                  put_state(token, old_room_id, "m.room.join_rules", {"join_rule": "invite"})
                  put_state(token, old_room_id, "m.room.guest_access", {"guest_access": "forbidden"})
                  put_state(
                      token,
                      old_room_id,
                      "m.room.tombstone",
                      {"body": "Othrys has been reset. Please join the new room.", "replacement_room": new_room_id},
                  )
                  send_message(
                      token,
                      old_room_id,
                      "Othrys was reset. Join the new room at https://live.bstein.dev/#/room/#othrys:live.bstein.dev?action=join",
                  )

                  print(f"old_room_id={old_room_id}")
                  print(f"new_room_id={new_room_id}")
                  PY
              volumeMounts:
                - name: vault-scripts
                  mountPath: /vault/scripts
                  readOnly: true
          volumes:
            - name: vault-scripts
              configMap:
                name: comms-vault-env
                defaultMode: 0555