helm-charts/mautrix-signal/README.adoc

= mautrix-signal

image::https://img.shields.io/badge/Version-0.0.8-informational?style=flat-square[Version: 0.0.8]
image::https://img.shields.io/badge/Version-application-informational?style=flat-square[Type: application]
image::https://img.shields.io/badge/AppVersion-0.7.0-informational?style=flat-square[AppVersion: 0.7.0]
== Maintainers

.Maintainers
|===
| Name | Email | Url

| WrenIX
|
| <https://wrenix.eu>
|===

= Alpha

WARNING
====
We stop working on this Helm-Chart.
There are still many breaking change like:

* https://github.com/stalwartlabs/mail-server/issues/211[storage.fts in toml configuration has two meanings]

We hope that stalward mail-server becomes more stable.

====

== Usage

Helm must be installed and setup to your kubernetes cluster to use the charts.
Refer to Helm's https://helm.sh/docs[documentation] to get started.
Once Helm has been set up correctly, fetch the charts as follows:

[source,bash]
----
helm pull oci://codeberg.org/wrenix/helm-charts/mautrix-signal
----

You can install a chart release using the following command:

[source,bash]
----
helm install mautrix-signal-release oci://codeberg.org/wrenix/helm-charts/mautrix-signal --values values.yaml
----

To uninstall a chart release use `helm`'s delete command:

[source,bash]
----
helm uninstall mautrix-signal-release
----

== Values

.Values
|===
| Key | Type | Default | Description

| affinity
| object
| `{}`
|

| autoscaling.enabled
| bool
| `false`
|

| autoscaling.maxReplicas
| int
| `100`
|

| autoscaling.minReplicas
| int
| `1`
|

| autoscaling.targetCPUUtilizationPercentage
| int
| `80`
|

| config.appservice.address
| string
| `"http://localhost:29328"`
| The address that the homeserver can use to connect to this appservice.

| config.appservice.as_token
| string
| `""`
|

| config.appservice.async_transactions
| bool
| `false`
| Should incoming events be handled asynchronously? This may be necessary for large public instances with lots of messages going through. However, messages will not be guaranteed to be bridged in the same order they were sent in.

| config.appservice.bot.avatar
| string
| `"mxc://maunium.net/wPJgTQbZOtpBFmDNkiNEMDUp"`
|

| config.appservice.bot.displayname
| string
| `"Signal bridge bot"`
| Display name and avatar for bot. Set to "remove" to remove display name/avatar, leave empty to leave display name/avatar as-is.

| config.appservice.bot.username
| string
| `"signalbot"`
| Username of the appservice bot.

| config.appservice.ephemeral_events
| bool
| `true`
| Whether or not to receive ephemeral events via appservice transactions. Requires MSC2409 support (i.e. Synapse 1.22+).

| config.appservice.hostname
| string
| `"0.0.0.0"`
| The hostname and port where this appservice should listen.

| config.appservice.hs_token
| string
| `""`
|

| config.appservice.id
| string
| `"signal"`
| The unique ID of this appservice.

| config.appservice.port
| int
| `29328`
|

| config.appservice.public_address
| string
| `nil`
|

| config.appservice.username_template
| string
| `"signal_{{.}}"`
| Localpart template of MXIDs for Signal users. {{.}} is replaced with the internal ID of the Signal user.

| config.backfill.enabled
| bool
| `false`
|

| config.backfill.max_catchup_messages
| string
| `nil`
|

| config.backfill.max_initial_messages
| string
| `nil`
|

| config.backfill.queue.batch_delay
| string
| `nil`
|

| config.backfill.queue.batch_size
| string
| `nil`
|

| config.backfill.queue.enabled
| string
| `nil`
|

| config.backfill.queue.max_batches
| int
| `10`
|

| config.backfill.queue.max_batches_override.a
| int
| `10`
|

| config.backfill.threads.max_initial_messages
| string
| `nil`
|

| config.backfill.unread_hours_threshold
| string
| `nil`
|

| config.bridge.bridge_matrix_leave
| string
| `nil`
|

| config.bridge.cleanup_on_logout.bad_credentials.private
| string
| `nil`
|

| config.bridge.cleanup_on_logout.bad_credentials.relayed
| string
| `nil`
|

| config.bridge.cleanup_on_logout.bad_credentials.shared_has_users
| string
| `nil`
|

| config.bridge.cleanup_on_logout.bad_credentials.shared_no_users
| string
| `nil`
|

| config.bridge.cleanup_on_logout.enabled
| string
| `nil`
|

| config.bridge.cleanup_on_logout.manual.private
| string
| `nil`
|

| config.bridge.cleanup_on_logout.manual.relayed
| string
| `nil`
|

| config.bridge.cleanup_on_logout.manual.shared_has_users
| string
| `nil`
|

| config.bridge.cleanup_on_logout.manual.shared_no_users
| string
| `nil`
|

| config.bridge.command_prefix
| string
| `"!signal"`
| The prefix for commands. Only required in non-management rooms.

| config.bridge.mute_only_on_create
| string
| `nil`
|

| config.bridge.permissions."@admin:example.com"
| string
| `"admin"`
|

| config.bridge.permissions."example.com"
| string
| `"user"`
|

| config.bridge.permissions.*
| string
| `"relay"`
|

| config.bridge.personal_filtering_spaces
| bool
| `false`
| Should the bridge create a space for each logged-in user and add bridged rooms to it? Users who logged in before turning this on should run `!signal sync-space` to create and fill the space for the first time.

| config.bridge.private_chat_portal_meta
| string
| `"default"`
| Whether to explicitly set the avatar and room name for private chat portal rooms. If set to `default`, this will be enabled in encrypted rooms and disabled in unencrypted rooms. If set to `always`, all DM rooms will have explicit names and avatars set. If set to `never`, DM rooms will never have names and avatars set.

| config.bridge.relay.admin_only
| bool
| `true`
| Should only admins be allowed to set themselves as relay users?

| config.bridge.relay.default_relays
| string
| `nil`
|

| config.bridge.relay.displayname_format
| string
| `""`
|

| config.bridge.relay.enabled
| bool
| `false`
| Whether relay mode should be allowed. If allowed, `!wa set-relay` can be used to turn any authenticated user into a relaybot for that chat.

| config.bridge.relay.message_formats
| object
| `{"m.audio":"<b>{{ .Sender.Displayname }}</b> sent an audio file","m.emote":"* <b>{{ .Sender.Displayname }}</b> {{ .Message }}","m.file":"<b>{{ .Sender.Displayname }}</b> sent a file","m.image":"<b>{{ .Sender.Displayname }}</b> sent an image","m.location":"<b>{{ .Sender.Displayname }}</b> sent a location","m.notice":"<b>{{ .Sender.Displayname }}</b>: {{ .Message }}","m.text":"<b>{{ .Sender.Displayname }}</b>: {{ .Message }}","m.video":"<b>{{ .Sender.Displayname }}</b> sent a video"}`
| The formats to use when sending messages to Signal via the relaybot.

| config.bridge.tag_only_on_create
| string
| `nil`
|

| config.database.max_conn_idle_time
| string
| `nil`
| Maximum connection idle time and lifetime before they're closed. Disabled if null. Parsed with https://pkg.go.dev/time#ParseDuration

| config.database.max_conn_lifetime
| string
| `nil`
|

| config.database.max_idle_conns
| int
| `2`
|

| config.database.max_open_conns
| int
| `20`
| Maximum number of connections. Mostly relevant for Postgres.

| config.database.type
| string
| `"postgres"`
| The database type. "sqlite3-fk-wal" and "postgres" are supported.

| config.database.uri
| string
| `"postgres://user:password@host/database?sslmode=disable"`
| The database URI.   SQLite: A raw file path is supported, but `file:<path>?_txlock=immediate` is recommended.           https://github.com/mattn/go-sqlite3#connection-string   Postgres: Connection string. For example, postgres://user:password@host/database?sslmode=disable             To connect via Unix socket, use something like postgres:///dbname?host=/var/run/postgresql

| config.direct_media.allow_proxy
| bool
| `false`
|

| config.direct_media.enabled
| bool
| `false`
|

| config.direct_media.media_id_prefix
| string
| `""`
|

| config.direct_media.server_key
| string
| `""`
|

| config.direct_media.server_name
| string
| `""`
|

| config.direct_media.well_known_response
| string
| `""`
|

| config.double_puppet.allow_discovery
| bool
| `false`
| Allow using double puppeting from any server with a valid client .well-known file.

| config.double_puppet.secrets
| object
| `{"example.com":"foobar"}`
| Shared secrets for https://github.com/devture/matrix-synapse-shared-secret-auth  If set, double puppeting will be enabled automatically for local users instead of users having to find an access token and run `login-matrix` manually.

| config.double_puppet.servers
| object
| `{"example.com":"https://example.com"}`
| Servers to always allow double puppeting from

| config.encryption.allow
| bool
| `false`
| Allow encryption, work in group chat rooms with e2ee enabled

| config.encryption.allow_key_sharing
| bool
| `false`
| Enable key sharing? If enabled, key requests for rooms where users are in will be fulfilled. You must use a client that supports requesting keys from other users to use this feature.

| config.encryption.appservice
| bool
| `false`
| Whether to use MSC2409/MSC3202 instead of /sync long polling for receiving encryption-related data.

| config.encryption.default
| bool
| `false`
| Default to encryption, force-enable encryption in all portals the bridge creates This will cause the bridge bot to be in private chats for the encryption to work properly.

| config.encryption.delete_keys
| object
| `{"delete_fully_used_on_decrypt":false,"delete_on_device_delete":false,"delete_outbound_on_ack":false,"delete_outdated_inbound":false,"delete_prev_on_new_session":false,"dont_store_outbound":false,"periodically_delete_expired":false,"ratchet_on_decrypt":false}`
| Options for deleting megolm sessions from the bridge.

| config.encryption.delete_keys.delete_fully_used_on_decrypt
| bool
| `false`
| Delete fully used keys (index >= max_messages) after decrypting messages.

| config.encryption.delete_keys.delete_on_device_delete
| bool
| `false`
| Delete megolm sessions received from a device when the device is deleted.

| config.encryption.delete_keys.delete_outbound_on_ack
| bool
| `false`
| Beeper-specific: delete outbound sessions when hungryserv confirms that the user has uploaded the key to key backup.

| config.encryption.delete_keys.delete_outdated_inbound
| bool
| `false`
| Delete inbound megolm sessions that don't have the received_at field used for automatic ratcheting and expired session deletion. This is meant as a migration to delete old keys prior to the bridge update.

| config.encryption.delete_keys.delete_prev_on_new_session
| bool
| `false`
| Delete previous megolm sessions from same device when receiving a new one.

| config.encryption.delete_keys.dont_store_outbound
| bool
| `false`
| Don't store outbound sessions in the inbound table.

| config.encryption.delete_keys.periodically_delete_expired
| bool
| `false`
| Periodically delete megolm sessions when 2x max_age has passed since receiving the session.

| config.encryption.delete_keys.ratchet_on_decrypt
| bool
| `false`
| Ratchet megolm sessions forward after decrypting messages.

| config.encryption.pickle_key
| string
| `nil`
|

| config.encryption.plaintext_mentions
| string
| `nil`
|

| config.encryption.require
| bool
| `false`
| Require encryption, drop any unencrypted messages.

| config.encryption.rotation.disable_device_change_key_rotation
| bool
| `false`
| Disable rotating keys when a user's devices change? You should not enable this option unless you understand all the implications.

| config.encryption.rotation.enable_custom
| bool
| `false`
| Enable custom Megolm room key rotation settings. Note that these settings will only apply to rooms created after this option is set.

| config.encryption.rotation.messages
| int
| `100`
| The maximum number of messages that should be sent with a given a session before changing it. The Matrix spec recommends 100 as the default.

| config.encryption.rotation.milliseconds
| int
| `604800000`
| The maximum number of milliseconds a session should be used before changing it. The Matrix spec recommends 604800000 (a week) as the default.

| config.encryption.verification_levels.receive
| string
| `"unverified"`
| Minimum level for which the bridge should send keys to when bridging messages from Signal to Matrix.

| config.encryption.verification_levels.send
| string
| `"unverified"`
| Minimum level that the bridge should accept for incoming Matrix messages.

| config.encryption.verification_levels.share
| string
| `"cross-signed-tofu"`
| Minimum level that the bridge should require for accepting key requests.

| config.homeserver.address
| string
| `"https://matrix.example.com"`
| The address that this appservice can use to connect to the homeserver.

| config.homeserver.async_media
| bool
| `false`
| Does the homeserver support https://github.com/matrix-org/matrix-spec-proposals/pull/2246?

| config.homeserver.domain
| string
| `"example.com"`
| The domain of the homeserver (also known as server_name, used for MXIDs, etc).

| config.homeserver.message_send_checkpoint_endpoint
| string
| `nil`
| Endpoint for reporting per-message status.

| config.homeserver.ping_interval_seconds
| int
| `0`
| How often should the websocket be pinged? Pinging will be disabled if this is zero.

| config.homeserver.public_address
| string
| `nil`
|

| config.homeserver.software
| string
| `"standard"`
| What software is the homeserver running? Standard Matrix homeservers like Synapse, Dendrite and Conduit should just use "standard" here.

| config.homeserver.status_endpoint
| string
| `nil`
| The URL to push real-time bridge status to. If set, the bridge will make POST requests to this URL whenever a user's Signal connection state changes. The bridge will use the appservice as_token to authorize requests.

| config.homeserver.websocket
| bool
| `false`
| Should the bridge use a websocket for connecting to the homeserver? The server side is currently not documented anywhere and is only implemented by mautrix-wsproxy, mautrix-asmux (deprecated), and hungryserv (proprietary).

| config.homeserver.websocket_proxy
| string
| `""`
|

| config.logging.min_level
| string
| `"warn"`
|

| config.logging.writers[0].format
| string
| `"json"`
|

| config.logging.writers[0].type
| string
| `"stdout"`
|

| config.management_room_text.additional_help
| string
| `""`
| Optional extra text sent when joining a management room.

| config.management_room_text.welcome
| string
| `"Hello, I'm a Signal bridge bot."`
| Sent when joining a room.

| config.management_room_text.welcome_connected
| string
| `"Use `help` for help."`
| Sent when joining a management room and the user is already logged in.

| config.management_room_text.welcome_unconnected
| string
| `"Use `help` for help or `login` to log in."`
| Sent when joining a management room and the user is not logged in.

| config.matrix.delivery_receipts
| bool
| `false`
| Should the bridge send a read receipt from the bridge bot when a message has been sent to Signal?

| config.matrix.federate_rooms
| bool
| `true`
| Whether or not created rooms should have federation enabled. If false, created portal rooms will never be federated.

| config.matrix.message_error_notices
| bool
| `true`
| Whether the bridge should send error notices via m.notice events when a message fails to bridge.

| config.matrix.message_status_events
| bool
| `false`
| Whether the bridge should send the message status as a custom com.beeper.message_send_status event.

| config.matrix.sync_direct_chat_list
| bool
| `false`
| Should the bridge update the m.direct account data event when double puppeting is enabled. Note that updating the m.direct event is not atomic (except with mautrix-asmux) and is therefore prone to race conditions.

| config.metrics.enabled
| bool
| `true`
| Enable prometheus metrics?

| config.metrics.listen
| string
| `"0.0.0.0:8000"`
| IP and port where the metrics listener should be. The path is always /metrics

| config.provisioning.debug_endpoints
| bool
| `false`
| Enable debug API at /debug with provisioning authentication.

| config.provisioning.prefix
| string
| `"/_matrix/provision"`
| Prefix for the provisioning API paths.

| config.provisioning.shared_secret
| string
| `"generate"`
| Shared secret for authentication. If set to "generate", a random secret will be generated, or if set to "disable", the provisioning API will be disabled.

| config.public_media.enabled
| bool
| `false`
|

| config.public_media.expiry
| int
| `0`
|

| config.public_media.hash_length
| int
| `0`
|

| config.public_media.signing_key
| string
| `""`
|

| config.signal.device_name
| string
| `"mautrix-signal"`
| Default device name that shows up in the Signal app.

| config.signal.displayname_template
| string
| `"{{or .ProfileName .PhoneNumber \"Unknown user\"}}"`
| Displayname template for Signal users. This is also used as the room name in DMs if private_chat_portal_meta is enabled. {{.ProfileName}} - The Signal profile name set by the user. {{.ContactName}} - The name for the user from your phone's contact list. This is not safe on multi-user instances. {{.PhoneNumber}} - The phone number of the user. {{.UUID}} - The UUID of the Signal user. {{.AboutEmoji}} - The emoji set by the user in their profile.

| config.signal.location_format
| string
| `"https://www.openstreetmap.org/?mlat=%[1]s&mlon=%[2]s"`
|

| config.signal.note_to_self_avatar
| string
| `"mxc://maunium.net/REBIVrqjZwmaWpssCZpBlmlL"`
|

| config.signal.number_in_topic
| bool
| `true`
| Should the Signal user's phone number be included in the room topic in private chat portal rooms?

| config.signal.sync_contacts_on_startup
| bool
| `true`
| Should the bridge request the user's contact list from the phone on startup?

| config.signal.use_contact_avatars
| bool
| `false`
| Should avatars from the user's contact list be used? This is not safe on multi-user instances.

| config.signal.use_outdated_profiles
| bool
| `false`
| Should the bridge sync ghost user info even if profile fetching fails? This is not safe on multi-user instances.

| fullnameOverride
| string
| `""`
|

| global.image.pullPolicy
| string
| `nil`
| if set it will overwrite all pullPolicy

| global.image.registry
| string
| `nil`
| if set it will overwrite all registry entries

| image.pullPolicy
| string
| `"IfNotPresent"`
|

| image.registry
| string
| `"dock.mau.dev"`
|

| image.repository
| string
| `"mautrix/signal"`
|

| image.tag
| string
| `""`
|

| imagePullSecrets
| list
| `[]`
|

| ingress.annotations
| object
| `{}`
|

| ingress.className
| string
| `""`
|

| ingress.enabled
| bool
| `false`
|

| ingress.hosts[0].host
| string
| `"chart-example.local"`
|

| ingress.hosts[0].paths[0].path
| string
| `"/"`
|

| ingress.hosts[0].paths[0].pathType
| string
| `"ImplementationSpecific"`
|

| ingress.tls
| list
| `[]`
|

| livenessProbe.httpGet.path
| string
| `"/_matrix/mau/live"`
|

| livenessProbe.httpGet.port
| string
| `"http"`
|

| nameOverride
| string
| `""`
|

| nodeSelector
| object
| `{}`
|

| persistence.accessMode
| string
| `"ReadWriteOnce"`
| accessMode

| persistence.annotations
| object
| `{}`
|

| persistence.enabled
| bool
| `true`
| Enable persistence using Persistent Volume Claims ref: http://kubernetes.io/docs/user-guide/persistent-volumes/

| persistence.existingClaim
| string
| `nil`
| A manually managed Persistent Volume and Claim Requires persistence.enabled: true If defined, PVC must be created manually before volume will be bound

| persistence.hostPath
| string
| `nil`
| Do not create an PVC, direct use hostPath in Pod

| persistence.size
| string
| `"10Gi"`
| size

| persistence.storageClass
| string
| `nil`
| Persistent Volume Storage Class If defined, storageClassName: <storageClass> If set to "-", storageClassName: "", which disables dynamic provisioning If undefined (the default) or set to null, no storageClassName spec is   set, choosing the default provisioner.  (gp2 on AWS, standard on   GKE, AWS & OpenStack)

| podAnnotations
| object
| `{}`
|

| podLabels
| object
| `{}`
|

| podSecurityContext
| object
| `{}`
|

| prometheus.servicemonitor.enabled
| bool
| `false`
|

| prometheus.servicemonitor.labels
| object
| `{}`
|

| readinessProbe.httpGet.path
| string
| `"/_matrix/mau/ready"`
|

| readinessProbe.httpGet.port
| string
| `"http"`
|

| registration."de.sorunome.msc2409.push_ephemeral"
| bool
| `true`
|

| registration.namespaces.users[0].exclusive
| bool
| `true`
|

| registration.namespaces.users[0].regex
| string
| `"^@signalbot:example.org$"`
|

| registration.namespaces.users[1].exclusive
| bool
| `true`
|

| registration.namespaces.users[1].regex
| string
| `"^@signal_.*:example.org$"`
|

| registration.push_ephemeral
| bool
| `true`
|

| registration.rate_limited
| bool
| `false`
|

| replicaCount
| int
| `1`
|

| resources
| object
| `{}`
|

| securityContext
| object
| `{}`
|

| service.type
| string
| `"ClusterIP"`
|

| serviceAccount.annotations
| object
| `{}`
|

| serviceAccount.automount
| bool
| `false`
|

| serviceAccount.create
| bool
| `false`
|

| serviceAccount.name
| string
| `""`
|

| tolerations
| list
| `[]`
|

| volumeMounts
| list
| `[]`
|

| volumes
| list
| `[]`
|
|===

Autogenerated from chart metadata using https://github.com/norwoodj/helm-docs[helm-docs]