bstein/titan-iac
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

comms: make room reset a suspended cronjob

Browse Source
This commit is contained in:
Brad Stein 2026-01-08 06:09:34 -03:00
parent d870e97b38
commit ffddd71116
2 changed files with 235 additions and 209 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
services/comms/NOTES.md
View File

@ -17,13 +17,12 @@ Operational jobs
- synapse-user-seed-job: seeds atlasbot + othrys-seeder users/passwords. - synapse-user-seed-job: seeds atlasbot + othrys-seeder users/passwords.
- mas-local-users-ensure-job: ensures MAS local users exist (seeder/bot). - mas-local-users-ensure-job: ensures MAS local users exist (seeder/bot).
- seed-othrys-room: (suspended) creates Othrys + joins locals. - seed-othrys-room: (suspended) creates Othrys + joins locals.
- reset-othrys-room: one-off room reset + pin invite. - reset-othrys-room: suspended CronJob for a manual room reset + pin invite.
- pin-othrys-invite: (suspended) pin invite message if missing. - pin-othrys-invite: (suspended) pin invite message if missing.
- guest-name-randomizer: renames numeric/guest users to adj-noun names. - guest-name-randomizer: renames numeric/guest users to adj-noun names.
- bstein-force-leave: one-off room leave cleanup. - bstein-force-leave: one-off room leave cleanup.
Manual re-runs Manual re-runs
- Bump the job name suffix (e.g., reset-othrys-room-9) to re-run a one-off job.
- Unsuspend a CronJob only when needed; re-suspend after completion. - Unsuspend a CronJob only when needed; re-suspend after completion.
Ports Ports

441
services/comms/reset-othrys-room-job.yaml
View File

@ -1,82 +1,93 @@
# services/comms/reset-othrys-room-job.yaml # services/comms/reset-othrys-room-job.yaml
apiVersion: batch/v1 apiVersion: batch/v1
kind: Job kind: CronJob
metadata: metadata:
name: othrys-room-reset-8 name: othrys-room-reset
namespace: comms namespace: comms
spec: spec:
backoffLimit: 0 schedule: "0 0 1 1 *"
template: suspend: true
concurrencyPolicy: Forbid
successfulJobsHistoryLimit: 1
failedJobsHistoryLimit: 1
jobTemplate:
spec: spec:
restartPolicy: Never backoffLimit: 0
containers: template:
- name: reset spec:
image: python:3.11-slim restartPolicy: Never
env: containers:
- name: SYNAPSE_BASE - name: reset
value: http://matrix-authentication-service:8080 image: python:3.11-slim
- name: AUTH_BASE env:
value: http://matrix-authentication-service:8080 - name: SYNAPSE_BASE
- name: SERVER_NAME value: http://othrys-synapse-matrix-synapse:8008
value: live.bstein.dev - name: AUTH_BASE
- name: ROOM_ALIAS value: http://matrix-authentication-service:8080
value: "#othrys:live.bstein.dev" - name: SERVER_NAME
- name: ROOM_NAME value: live.bstein.dev
value: Othrys - name: ROOM_ALIAS
- name: PIN_MESSAGE value: "#othrys:live.bstein.dev"
value: "Invite guests: share https://live.bstein.dev/#/room/#othrys:live.bstein.dev?action=join and choose 'Continue' -> 'Join as guest'." - name: ROOM_NAME
- name: SEEDER_USER value: Othrys
value: othrys-seeder - name: PIN_MESSAGE
- name: SEEDER_PASS value: "Invite guests: share https://live.bstein.dev/#/room/#othrys:live.bstein.dev?action=join and choose 'Continue' -> 'Join as guest'."
valueFrom: - name: SEEDER_USER
secretKeyRef: value: othrys-seeder
name: atlasbot-credentials-runtime - name: SEEDER_PASS
key: seeder-password valueFrom:
- name: BOT_USER secretKeyRef:
value: atlasbot name: atlasbot-credentials-runtime
command: key: seeder-password
- /bin/sh - name: BOT_USER
- -c value: atlasbot
- | command:
set -euo pipefail - /bin/sh
pip install --no-cache-dir requests >/dev/null - -c
python - <<'PY' - |
import os, sys, time, urllib.parse, requests set -euo pipefail
pip install --no-cache-dir requests >/dev/null
python - <<'PY'
import os
import time
import urllib.parse
import requests
BASE = os.environ["SYNAPSE_BASE"] BASE = os.environ["SYNAPSE_BASE"]
AUTH_BASE = os.environ.get("AUTH_BASE", BASE) AUTH_BASE = os.environ.get("AUTH_BASE", BASE)
SERVER_NAME = os.environ.get("SERVER_NAME", "live.bstein.dev") SERVER_NAME = os.environ.get("SERVER_NAME", "live.bstein.dev")
ROOM_ALIAS = os.environ.get("ROOM_ALIAS", "#othrys:live.bstein.dev") ROOM_ALIAS = os.environ.get("ROOM_ALIAS", "#othrys:live.bstein.dev")
ROOM_NAME = os.environ.get("ROOM_NAME", "Othrys") ROOM_NAME = os.environ.get("ROOM_NAME", "Othrys")
PIN_MESSAGE = os.environ["PIN_MESSAGE"] PIN_MESSAGE = os.environ["PIN_MESSAGE"]
SEEDER_USER = os.environ["SEEDER_USER"] SEEDER_USER = os.environ["SEEDER_USER"]
SEEDER_PASS = os.environ["SEEDER_PASS"] SEEDER_PASS = os.environ["SEEDER_PASS"]
BOT_USER = os.environ["BOT_USER"] BOT_USER = os.environ["BOT_USER"]
POWER_LEVELS = { POWER_LEVELS = {
"ban": 50, "ban": 50,
"events": { "events": {
"m.room.avatar": 50, "m.room.avatar": 50,
"m.room.canonical_alias": 50, "m.room.canonical_alias": 50,
"m.room.encryption": 100, "m.room.encryption": 100,
"m.room.history_visibility": 100, "m.room.history_visibility": 100,
"m.room.name": 50, "m.room.name": 50,
"m.room.power_levels": 100, "m.room.power_levels": 100,
"m.room.server_acl": 100, "m.room.server_acl": 100,
"m.room.tombstone": 100, "m.room.tombstone": 100,
}, },
"events_default": 0, "events_default": 0,
"historical": 100, "historical": 100,
"invite": 50, "invite": 50,
"kick": 50, "kick": 50,
"m.call.invite": 50, "m.call.invite": 50,
"redact": 50, "redact": 50,
"state_default": 50, "state_default": 50,
"users": {f"@{SEEDER_USER}:{SERVER_NAME}": 100}, "users": {f"@{SEEDER_USER}:{SERVER_NAME}": 100},
"users_default": 0, "users_default": 0,
} }
def auth(token): return {"Authorization": f"Bearer {token}"} def auth(token):
return {"Authorization": f"Bearer {token}"}
def canon_user(user): def canon_user(user):
u = (user or "").strip() u = (user or "").strip()
@ -85,155 +96,171 @@ spec:
u = u.lstrip("@") u = u.lstrip("@")
if ":" in u: if ":" in u:
return f"@{u}" return f"@{u}"
return f"@{u}:live.bstein.dev" return f"@{u}:{SERVER_NAME}"
def login(user, password): def login(user, password):
r = requests.post(f"{AUTH_BASE}/_matrix/client/v3/login", json={ r = requests.post(
"type": "m.login.password", f"{AUTH_BASE}/_matrix/client/v3/login",
"identifier": {"type": "m.id.user", "user": canon_user(user)}, json={
"password": password, "type": "m.login.password",
}) "identifier": {"type": "m.id.user", "user": canon_user(user)},
if r.status_code != 200: "password": password,
raise SystemExit(f"login failed: {r.status_code} {r.text}") },
return r.json()["access_token"] )
if r.status_code != 200:
raise SystemExit(f"login failed: {r.status_code} {r.text}")
return r.json()["access_token"]
def resolve_alias(token, alias): def resolve_alias(token, alias):
enc = urllib.parse.quote(alias) enc = urllib.parse.quote(alias)
r = requests.get(f"{BASE}/_matrix/client/v3/directory/room/{enc}", headers=auth(token)) r = requests.get(f"{BASE}/_matrix/client/v3/directory/room/{enc}", headers=auth(token))
if r.status_code == 404: if r.status_code == 404:
return None return None
r.raise_for_status() r.raise_for_status()
return r.json()["room_id"] return r.json()["room_id"]
def create_room(token): def create_room(token):
r = requests.post(f"{BASE}/_matrix/client/v3/createRoom", headers=auth(token), json={ r = requests.post(
"preset": "public_chat", f"{BASE}/_matrix/client/v3/createRoom",
"name": ROOM_NAME, headers=auth(token),
"room_version": "11", json={
}) "preset": "public_chat",
r.raise_for_status() "name": ROOM_NAME,
return r.json()["room_id"] "room_version": "11",
},
)
r.raise_for_status()
return r.json()["room_id"]
def put_state(token, room_id, ev_type, content): def put_state(token, room_id, ev_type, content):
r = requests.put( r = requests.put(
f"{BASE}/_matrix/client/v3/rooms/{urllib.parse.quote(room_id)}/state/{ev_type}", f"{BASE}/_matrix/client/v3/rooms/{urllib.parse.quote(room_id)}/state/{ev_type}",
headers=auth(token), headers=auth(token),
json=content, json=content,
) )
r.raise_for_status() r.raise_for_status()
def set_directory_visibility(token, room_id, visibility): def set_directory_visibility(token, room_id, visibility):
r = requests.put( r = requests.put(
f"{BASE}/_matrix/client/v3/directory/list/room/{urllib.parse.quote(room_id)}", f"{BASE}/_matrix/client/v3/directory/list/room/{urllib.parse.quote(room_id)}",
headers=auth(token), headers=auth(token),
json={"visibility": visibility}, json={"visibility": visibility},
) )
r.raise_for_status() r.raise_for_status()
def delete_alias(token, alias): def delete_alias(token, alias):
enc = urllib.parse.quote(alias) enc = urllib.parse.quote(alias)
r = requests.delete(f"{BASE}/_matrix/client/v3/directory/room/{enc}", headers=auth(token)) r = requests.delete(f"{BASE}/_matrix/client/v3/directory/room/{enc}", headers=auth(token))
if r.status_code in (200, 202, 404): if r.status_code in (200, 202, 404):
return return
r.raise_for_status() r.raise_for_status()
def put_alias(token, alias, room_id): def put_alias(token, alias, room_id):
enc = urllib.parse.quote(alias) enc = urllib.parse.quote(alias)
r = requests.put( r = requests.put(
f"{BASE}/_matrix/client/v3/directory/room/{enc}", f"{BASE}/_matrix/client/v3/directory/room/{enc}",
headers=auth(token), headers=auth(token),
json={"room_id": room_id}, json={"room_id": room_id},
) )
r.raise_for_status() r.raise_for_status()
def list_joined_members(token, room_id): def list_joined_members(token, room_id):
r = requests.get( r = requests.get(
f"{BASE}/_matrix/client/v3/rooms/{urllib.parse.quote(room_id)}/members?membership=join", f"{BASE}/_matrix/client/v3/rooms/{urllib.parse.quote(room_id)}/members?membership=join",
headers=auth(token), headers=auth(token),
) )
r.raise_for_status() r.raise_for_status()
members = [] members = []
for ev in r.json().get("chunk", []): for ev in r.json().get("chunk", []):
if ev.get("type") != "m.room.member": if ev.get("type") != "m.room.member":
continue
uid = ev.get("state_key")
if not isinstance(uid, str) or not uid.startswith("@"):
continue
members.append(uid)
return members
def invite_user(token, room_id, user_id):
r = requests.post(
f"{BASE}/_matrix/client/v3/rooms/{urllib.parse.quote(room_id)}/invite",
headers=auth(token),
json={"user_id": user_id},
)
if r.status_code in (200, 202):
return
r.raise_for_status()
def send_message(token, room_id, body):
r = requests.post(
f"{BASE}/_matrix/client/v3/rooms/{urllib.parse.quote(room_id)}/send/m.room.message",
headers=auth(token),
json={"msgtype": "m.text", "body": body},
)
r.raise_for_status()
return r.json()["event_id"]
def login_with_retry():
last = None
for attempt in range(1, 6):
try:
return login(SEEDER_USER, SEEDER_PASS)
except Exception as exc: # noqa: BLE001
last = exc
time.sleep(attempt * 2)
raise last
token = login_with_retry()
old_room_id = resolve_alias(token, ROOM_ALIAS)
if not old_room_id:
raise SystemExit(f"alias {ROOM_ALIAS} not found; refusing to proceed")
new_room_id = create_room(token)
# Configure the new room.
put_state(token, new_room_id, "m.room.join_rules", {"join_rule": "public"})
put_state(token, new_room_id, "m.room.guest_access", {"guest_access": "can_join"})
put_state(token, new_room_id, "m.room.history_visibility", {"history_visibility": "shared"})
put_state(token, new_room_id, "m.room.power_levels", POWER_LEVELS)
# Move the alias.
delete_alias(token, ROOM_ALIAS)
put_alias(token, ROOM_ALIAS, new_room_id)
put_state(token, new_room_id, "m.room.canonical_alias", {"alias": ROOM_ALIAS})
set_directory_visibility(token, new_room_id, "public")
# Invite the bot and all joined members of the old room.
bot_user_id = f"@{BOT_USER}:{SERVER_NAME}"
invite_user(token, new_room_id, bot_user_id)
for uid in list_joined_members(token, old_room_id):
if uid == f"@{SEEDER_USER}:{SERVER_NAME}":
continue continue
uid = ev.get("state_key") localpart = uid.split(":", 1)[0].lstrip("@")
if not isinstance(uid, str) or not uid.startswith("@"): if localpart.isdigit():
continue continue
members.append(uid) invite_user(token, new_room_id, uid)
return members
def invite_user(token, room_id, user_id): # Pin the guest invite message in the new room.
r = requests.post( event_id = send_message(token, new_room_id, PIN_MESSAGE)
f"{BASE}/_matrix/client/v3/rooms/{urllib.parse.quote(room_id)}/invite", put_state(token, new_room_id, "m.room.pinned_events", {"pinned": [event_id]})
headers=auth(token),
json={"user_id": user_id}, # De-list and tombstone the old room.
set_directory_visibility(token, old_room_id, "private")
put_state(token, old_room_id, "m.room.join_rules", {"join_rule": "invite"})
put_state(token, old_room_id, "m.room.guest_access", {"guest_access": "forbidden"})
put_state(
token,
old_room_id,
"m.room.tombstone",
{"body": "Othrys has been reset. Please join the new room.", "replacement_room": new_room_id},
) )
if r.status_code in (200, 202): send_message(
return token,
r.raise_for_status() old_room_id,
"Othrys was reset. Join the new room at https://live.bstein.dev/#/room/#othrys:live.bstein.dev?action=join",
def send_message(token, room_id, body):
r = requests.post(
f"{BASE}/_matrix/client/v3/rooms/{urllib.parse.quote(room_id)}/send/m.room.message",
headers=auth(token),
json={"msgtype": "m.text", "body": body},
) )
r.raise_for_status()
return r.json()["event_id"]
def login_with_retry(): print(f"old_room_id={old_room_id}")
last = None print(f"new_room_id={new_room_id}")
for attempt in range(1, 6): PY
try:
return login(SEEDER_USER, SEEDER_PASS)
except Exception as exc: # noqa: BLE001
last = exc
time.sleep(attempt * 2)
raise last
token = login_with_retry()
old_room_id = resolve_alias(token, ROOM_ALIAS)
if not old_room_id:
raise SystemExit(f"alias {ROOM_ALIAS} not found; refusing to proceed")
new_room_id = create_room(token)
# Configure the new room.
put_state(token, new_room_id, "m.room.join_rules", {"join_rule": "public"})
put_state(token, new_room_id, "m.room.guest_access", {"guest_access": "can_join"})
put_state(token, new_room_id, "m.room.history_visibility", {"history_visibility": "shared"})
put_state(token, new_room_id, "m.room.power_levels", POWER_LEVELS)
# Move the alias.
delete_alias(token, ROOM_ALIAS)
put_alias(token, ROOM_ALIAS, new_room_id)
put_state(token, new_room_id, "m.room.canonical_alias", {"alias": ROOM_ALIAS})
set_directory_visibility(token, new_room_id, "public")
# Invite the bot and all joined members of the old room.
bot_user_id = f"@{BOT_USER}:{SERVER_NAME}"
invite_user(token, new_room_id, bot_user_id)
for uid in list_joined_members(token, old_room_id):
if uid == f"@{SEEDER_USER}:{SERVER_NAME}":
continue
localpart = uid.split(":", 1)[0].lstrip("@")
if localpart.isdigit():
continue
invite_user(token, new_room_id, uid)
# Pin the guest invite message in the new room.
event_id = send_message(token, new_room_id, PIN_MESSAGE)
put_state(token, new_room_id, "m.room.pinned_events", {"pinned": [event_id]})
# De-list and tombstone the old room.
set_directory_visibility(token, old_room_id, "private")
put_state(token, old_room_id, "m.room.join_rules", {"join_rule": "invite"})
put_state(token, old_room_id, "m.room.guest_access", {"guest_access": "forbidden"})
put_state(token, old_room_id, "m.room.tombstone", {"body": "Othrys has been reset. Please join the new room.", "replacement_room": new_room_id})
send_message(token, old_room_id, "Othrys was reset. Join the new room at https://live.bstein.dev/#/room/#othrys:live.bstein.dev?action=join")
print(f"old_room_id={old_room_id}")
print(f"new_room_id={new_room_id}")
PY