# services/comms/pin-othrys-job.yaml apiVersion: batch/v1 kind: CronJob metadata: name: pin-othrys-invite namespace: comms spec: schedule: "*/30 * * * *" suspend: true concurrencyPolicy: Forbid successfulJobsHistoryLimit: 1 failedJobsHistoryLimit: 1 jobTemplate: spec: backoffLimit: 0 template: metadata: annotations: vault.hashicorp.com/agent-inject: "true" vault.hashicorp.com/role: "comms" vault.hashicorp.com/agent-inject-secret-turn-secret: "kv/data/atlas/comms/turn-shared-secret" vault.hashicorp.com/agent-inject-template-turn-secret: | {{- with secret "kv/data/atlas/comms/turn-shared-secret" -}}{{ .Data.data.TURN_STATIC_AUTH_SECRET }}{{- end -}} vault.hashicorp.com/agent-inject-secret-livekit-primary: "kv/data/atlas/comms/livekit-api" vault.hashicorp.com/agent-inject-template-livekit-primary: | {{- with secret "kv/data/atlas/comms/livekit-api" -}}{{ .Data.data.primary }}{{- end -}} vault.hashicorp.com/agent-inject-secret-bot-pass: "kv/data/atlas/comms/atlasbot-credentials-runtime" vault.hashicorp.com/agent-inject-template-bot-pass: | {{- with secret "kv/data/atlas/comms/atlasbot-credentials-runtime" -}}{{ index .Data.data "bot-password" }}{{- end -}} vault.hashicorp.com/agent-inject-secret-seeder-pass: "kv/data/atlas/comms/atlasbot-credentials-runtime" vault.hashicorp.com/agent-inject-template-seeder-pass: | {{- with secret "kv/data/atlas/comms/atlasbot-credentials-runtime" -}}{{ index .Data.data "seeder-password" }}{{- end -}} vault.hashicorp.com/agent-inject-secret-chat-matrix: "kv/data/atlas/shared/chat-ai-keys-runtime" vault.hashicorp.com/agent-inject-template-chat-matrix: | {{- with secret "kv/data/atlas/shared/chat-ai-keys-runtime" -}}{{ .Data.data.matrix }}{{- end -}} vault.hashicorp.com/agent-inject-secret-chat-homepage: "kv/data/atlas/shared/chat-ai-keys-runtime" vault.hashicorp.com/agent-inject-template-chat-homepage: | {{- with secret "kv/data/atlas/shared/chat-ai-keys-runtime" -}}{{ .Data.data.homepage }}{{- end -}} vault.hashicorp.com/agent-inject-secret-mas-admin-secret: "kv/data/atlas/comms/mas-admin-client-runtime" vault.hashicorp.com/agent-inject-template-mas-admin-secret: | {{- with secret "kv/data/atlas/comms/mas-admin-client-runtime" -}}{{ .Data.data.client_secret }}{{- end -}} vault.hashicorp.com/agent-inject-secret-synapse-db-pass: "kv/data/atlas/comms/synapse-db" vault.hashicorp.com/agent-inject-template-synapse-db-pass: | {{- with secret "kv/data/atlas/comms/synapse-db" -}}{{ .Data.data.POSTGRES_PASSWORD }}{{- end -}} vault.hashicorp.com/agent-inject-secret-mas-db-pass: "kv/data/atlas/comms/mas-db" vault.hashicorp.com/agent-inject-template-mas-db-pass: | {{- with secret "kv/data/atlas/comms/mas-db" -}}{{ .Data.data.password }}{{- end -}} vault.hashicorp.com/agent-inject-secret-mas-matrix-shared: "kv/data/atlas/comms/mas-secrets-runtime" vault.hashicorp.com/agent-inject-template-mas-matrix-shared: | {{- with secret "kv/data/atlas/comms/mas-secrets-runtime" -}}{{ .Data.data.matrix_shared_secret }}{{- end -}} vault.hashicorp.com/agent-inject-secret-mas-kc-secret: "kv/data/atlas/comms/mas-secrets-runtime" vault.hashicorp.com/agent-inject-template-mas-kc-secret: | {{- with secret "kv/data/atlas/comms/mas-secrets-runtime" -}}{{ .Data.data.keycloak_client_secret }}{{- end -}} spec: restartPolicy: Never serviceAccountName: comms-vault containers: - name: pin image: python:3.11-slim env: - name: SYNAPSE_BASE value: http://othrys-synapse-matrix-synapse:8008 - name: AUTH_BASE value: http://matrix-authentication-service:8080 - name: SEEDER_USER value: othrys-seeder command: - /bin/sh - -c - | set -euo pipefail . /vault/scripts/comms_vault_env.sh pip install --no-cache-dir requests >/dev/null python - <<'PY' import os, requests, urllib.parse BASE = os.environ["SYNAPSE_BASE"] AUTH_BASE = os.environ.get("AUTH_BASE", BASE) ROOM_ALIAS = "#othrys:live.bstein.dev" MESSAGE = ( "Invite guests: share https://live.bstein.dev/#/room/#othrys:live.bstein.dev?action=join " "and choose 'Continue' -> 'Join as guest'." ) def auth(token): return {"Authorization": f"Bearer {token}"} def canon_user(user): u = (user or "").strip() if u.startswith("@") and ":" in u: return u u = u.lstrip("@") if ":" in u: return f"@{u}" return f"@{u}:live.bstein.dev" def login(user, password): r = requests.post(f"{AUTH_BASE}/_matrix/client/v3/login", json={ "type": "m.login.password", "identifier": {"type": "m.id.user", "user": canon_user(user)}, "password": password, }) r.raise_for_status() return r.json()["access_token"] def resolve(alias, token): enc = urllib.parse.quote(alias) r = requests.get(f"{BASE}/_matrix/client/v3/directory/room/{enc}", headers=auth(token)) r.raise_for_status() return r.json()["room_id"] def get_pinned(room_id, token): r = requests.get( f"{BASE}/_matrix/client/v3/rooms/{urllib.parse.quote(room_id)}/state/m.room.pinned_events", headers=auth(token), ) if r.status_code == 404: return [] r.raise_for_status() return r.json().get("pinned", []) def get_event(room_id, event_id, token): r = requests.get( f"{BASE}/_matrix/client/v3/rooms/{urllib.parse.quote(room_id)}/event/{urllib.parse.quote(event_id)}", headers=auth(token), ) if r.status_code == 404: return None r.raise_for_status() return r.json() def send(room_id, token, body): r = requests.post( f"{BASE}/_matrix/client/v3/rooms/{urllib.parse.quote(room_id)}/send/m.room.message", headers=auth(token), json={"msgtype": "m.text", "body": body}, ) r.raise_for_status() return r.json()["event_id"] def pin(room_id, token, event_id): r = requests.put( f"{BASE}/_matrix/client/v3/rooms/{urllib.parse.quote(room_id)}/state/m.room.pinned_events", headers=auth(token), json={"pinned": [event_id]}, ) r.raise_for_status() token = login(os.environ["SEEDER_USER"], os.environ["SEEDER_PASS"]) room_id = resolve(ROOM_ALIAS, token) for event_id in get_pinned(room_id, token): ev = get_event(room_id, event_id, token) if ev and ev.get("content", {}).get("body") == MESSAGE: raise SystemExit(0) eid = send(room_id, token, MESSAGE) pin(room_id, token, eid) PY volumeMounts: - name: vault-scripts mountPath: /vault/scripts readOnly: true volumes: - name: vault-scripts configMap: name: comms-vault-env defaultMode: 0555