139 lines
5.5 KiB
YAML
139 lines
5.5 KiB
YAML
# services/comms/pin-othrys-job.yaml
|
|
apiVersion: batch/v1
|
|
kind: CronJob
|
|
metadata:
|
|
name: pin-othrys-invite
|
|
namespace: comms
|
|
spec:
|
|
schedule: "*/30 * * * *"
|
|
suspend: true
|
|
concurrencyPolicy: Forbid
|
|
successfulJobsHistoryLimit: 1
|
|
failedJobsHistoryLimit: 1
|
|
jobTemplate:
|
|
spec:
|
|
backoffLimit: 0
|
|
template:
|
|
spec:
|
|
restartPolicy: Never
|
|
serviceAccountName: comms-vault
|
|
containers:
|
|
- name: pin
|
|
image: python:3.11-slim
|
|
env:
|
|
- name: SYNAPSE_BASE
|
|
value: http://othrys-synapse-matrix-synapse:8008
|
|
- name: AUTH_BASE
|
|
value: http://matrix-authentication-service:8080
|
|
- name: SEEDER_USER
|
|
value: othrys-seeder
|
|
command:
|
|
- /bin/sh
|
|
- -c
|
|
- |
|
|
set -euo pipefail
|
|
. /vault/scripts/comms_vault_env.sh
|
|
pip install --no-cache-dir requests >/dev/null
|
|
python - <<'PY'
|
|
import os, requests, urllib.parse
|
|
|
|
BASE = os.environ["SYNAPSE_BASE"]
|
|
AUTH_BASE = os.environ.get("AUTH_BASE", BASE)
|
|
ROOM_ALIAS = "#othrys:live.bstein.dev"
|
|
MESSAGE = (
|
|
"Invite guests: share https://live.bstein.dev/#/room/#othrys:live.bstein.dev?action=join "
|
|
"and choose 'Continue' -> 'Join as guest'."
|
|
)
|
|
|
|
def auth(token): return {"Authorization": f"Bearer {token}"}
|
|
|
|
def canon_user(user):
|
|
u = (user or "").strip()
|
|
if u.startswith("@") and ":" in u:
|
|
return u
|
|
u = u.lstrip("@")
|
|
if ":" in u:
|
|
return f"@{u}"
|
|
return f"@{u}:live.bstein.dev"
|
|
|
|
def login(user, password):
|
|
r = requests.post(f"{AUTH_BASE}/_matrix/client/v3/login", json={
|
|
"type": "m.login.password",
|
|
"identifier": {"type": "m.id.user", "user": canon_user(user)},
|
|
"password": password,
|
|
})
|
|
r.raise_for_status()
|
|
return r.json()["access_token"]
|
|
|
|
def resolve(alias, token):
|
|
enc = urllib.parse.quote(alias)
|
|
r = requests.get(f"{BASE}/_matrix/client/v3/directory/room/{enc}", headers=auth(token))
|
|
r.raise_for_status()
|
|
return r.json()["room_id"]
|
|
|
|
def get_pinned(room_id, token):
|
|
r = requests.get(
|
|
f"{BASE}/_matrix/client/v3/rooms/{urllib.parse.quote(room_id)}/state/m.room.pinned_events",
|
|
headers=auth(token),
|
|
)
|
|
if r.status_code == 404:
|
|
return []
|
|
r.raise_for_status()
|
|
return r.json().get("pinned", [])
|
|
|
|
def get_event(room_id, event_id, token):
|
|
r = requests.get(
|
|
f"{BASE}/_matrix/client/v3/rooms/{urllib.parse.quote(room_id)}/event/{urllib.parse.quote(event_id)}",
|
|
headers=auth(token),
|
|
)
|
|
if r.status_code == 404:
|
|
return None
|
|
r.raise_for_status()
|
|
return r.json()
|
|
|
|
def send(room_id, token, body):
|
|
r = requests.post(
|
|
f"{BASE}/_matrix/client/v3/rooms/{urllib.parse.quote(room_id)}/send/m.room.message",
|
|
headers=auth(token),
|
|
json={"msgtype": "m.text", "body": body},
|
|
)
|
|
r.raise_for_status()
|
|
return r.json()["event_id"]
|
|
|
|
def pin(room_id, token, event_id):
|
|
r = requests.put(
|
|
f"{BASE}/_matrix/client/v3/rooms/{urllib.parse.quote(room_id)}/state/m.room.pinned_events",
|
|
headers=auth(token),
|
|
json={"pinned": [event_id]},
|
|
)
|
|
r.raise_for_status()
|
|
|
|
token = login(os.environ["SEEDER_USER"], os.environ["SEEDER_PASS"])
|
|
room_id = resolve(ROOM_ALIAS, token)
|
|
for event_id in get_pinned(room_id, token):
|
|
ev = get_event(room_id, event_id, token)
|
|
if ev and ev.get("content", {}).get("body") == MESSAGE:
|
|
raise SystemExit(0)
|
|
|
|
eid = send(room_id, token, MESSAGE)
|
|
pin(room_id, token, eid)
|
|
PY
|
|
volumeMounts:
|
|
- name: vault-secrets
|
|
mountPath: /vault/secrets
|
|
readOnly: true
|
|
- name: vault-scripts
|
|
mountPath: /vault/scripts
|
|
readOnly: true
|
|
volumes:
|
|
- name: vault-secrets
|
|
csi:
|
|
driver: secrets-store.csi.k8s.io
|
|
readOnly: true
|
|
volumeAttributes:
|
|
secretProviderClass: comms-vault
|
|
- name: vault-scripts
|
|
configMap:
|
|
name: comms-vault-env
|
|
defaultMode: 0555
|