Files
mautrix-whatsapp-cloudron/start.sh
Andreas Dueren ef4d2c1072 Fix domain configuration and database cleanup for production deployment
- Fixed domain extraction logic in start.sh for proper homeserver configuration
- Updated registration file regex patterns to use base domain
- Added comprehensive database cleanup procedures in CLAUDE.md
- Updated CloudronManifest.json for production settings
- Resolved crypto sync issues and user registration conflicts

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>
2025-06-16 20:03:01 -06:00

258 lines
21 KiB
Bash
Executable File

#!/bin/bash
set -eu
echo "=> Setting up mautrix-whatsapp bridge"
# Create necessary directories
mkdir -p /app/data
mkdir -p /app/data/logs
# For Cloudron, we run as the cloudron user
UID=$(id -u cloudron)
GID=$(id -g cloudron)
# Set ownership early to avoid permission issues
chown -R cloudron:cloudron /app/data
# Configuration file paths
CONFIG_PATH="/app/data/config.yaml"
REGISTRATION_PATH="/app/data/registration.yaml"
BACKUP_PATH="/app/data/config.yaml.bak"
# Try to generate config from built-in template
if [ ! -f "$CONFIG_PATH" ]; then
echo "=> Attempting to generate configuration using mautrix-whatsapp"
# Run as cloudron user to avoid permission issues and change to data directory
cd /app/data
gosu cloudron:cloudron /app/pkg/mautrix-whatsapp -e -c "$CONFIG_PATH"
# Configure basic settings first before generating registration
if [ -f "$CONFIG_PATH" ]; then
echo "=> Applying basic Cloudron configuration to generated config"
# Configure for Cloudron environment
if [ -n "${CLOUDRON_POSTGRESQL_URL:-}" ]; then
echo "=> Configuring PostgreSQL database: $CLOUDRON_POSTGRESQL_URL"
# Add SSL mode disable to Cloudron PostgreSQL URL if not already present
if [[ "$CLOUDRON_POSTGRESQL_URL" == *"sslmode="* ]]; then
DB_URL="$CLOUDRON_POSTGRESQL_URL"
else
DB_URL="$CLOUDRON_POSTGRESQL_URL?sslmode=disable"
fi
yq -i -y '.database.uri = "'"$DB_URL"'"' "$CONFIG_PATH" || echo "=> ERROR: Could not configure database"
fi
if [ -n "${CLOUDRON_APP_DOMAIN:-}" ]; then
echo "=> Configuring homeserver and appservice settings for domain: $CLOUDRON_APP_DOMAIN"
# Extract base domain (e.g., whatsapp.matrix.due.ren -> due.ren)
BASE_DOMAIN=$(echo "$CLOUDRON_APP_DOMAIN" | rev | cut -d. -f1-2 | rev)
echo "=> Base domain extracted: $BASE_DOMAIN"
# Update homeserver configuration
yq -i -y '.homeserver.address = "https://matrix.'"$BASE_DOMAIN"'"' "$CONFIG_PATH" || echo "=> ERROR: Could not configure homeserver address"
yq -i -y '.homeserver.domain = "'"$BASE_DOMAIN"'"' "$CONFIG_PATH" || echo "=> ERROR: Could not configure homeserver domain"
# Update appservice configuration
yq -i -y '.appservice.address = "https://'"$CLOUDRON_APP_DOMAIN"'"' "$CONFIG_PATH" || echo "=> ERROR: Could not configure appservice address"
yq -i -y '.appservice.public_address = "https://'"$CLOUDRON_APP_DOMAIN"'"' "$CONFIG_PATH" || echo "=> ERROR: Could not configure appservice public_address"
yq -i -y '.appservice.hostname = "0.0.0.0"' "$CONFIG_PATH" || echo "=> ERROR: Could not configure appservice hostname"
yq -i -y '.appservice.port = 29318' "$CONFIG_PATH" || echo "=> ERROR: Could not configure appservice port"
# Configure permissions for base domain users
yq -i -y '.bridge.permissions."'"$BASE_DOMAIN"'" = "user"' "$CONFIG_PATH" || echo "=> ERROR: Could not configure permissions"
# Configure cleanup on logout to delete everything
yq -i -y '.bridge.cleanup_on_logout.enabled = true' "$CONFIG_PATH" || echo "=> ERROR: Could not configure cleanup enabled"
yq -i -y '.bridge.cleanup_on_logout.manual.private = "delete"' "$CONFIG_PATH" || echo "=> ERROR: Could not configure cleanup manual private"
yq -i -y '.bridge.cleanup_on_logout.manual.relayed = "delete"' "$CONFIG_PATH" || echo "=> ERROR: Could not configure cleanup manual relayed"
yq -i -y '.bridge.cleanup_on_logout.manual.shared_no_users = "delete"' "$CONFIG_PATH" || echo "=> ERROR: Could not configure cleanup manual shared_no_users"
yq -i -y '.bridge.cleanup_on_logout.manual.shared_has_users = "delete"' "$CONFIG_PATH" || echo "=> ERROR: Could not configure cleanup manual shared_has_users"
yq -i -y '.bridge.cleanup_on_logout.bad_credentials.private = "delete"' "$CONFIG_PATH" || echo "=> ERROR: Could not configure cleanup bad_credentials private"
yq -i -y '.bridge.cleanup_on_logout.bad_credentials.relayed = "delete"' "$CONFIG_PATH" || echo "=> ERROR: Could not configure cleanup bad_credentials relayed"
yq -i -y '.bridge.cleanup_on_logout.bad_credentials.shared_no_users = "delete"' "$CONFIG_PATH" || echo "=> ERROR: Could not configure cleanup bad_credentials shared_no_users"
yq -i -y '.bridge.cleanup_on_logout.bad_credentials.shared_has_users = "delete"' "$CONFIG_PATH" || echo "=> ERROR: Could not configure cleanup bad_credentials shared_has_users"
# Configure browser name for better WhatsApp compatibility
yq -i -y '.network.browser_name = "ANDROID_PHONE"' "$CONFIG_PATH" || echo "=> ERROR: Could not configure browser_name"
# Configure end-to-bridge encryption with best practices
yq -i -y '.encryption.allow = true' "$CONFIG_PATH" || echo "=> ERROR: Could not configure encryption allow"
yq -i -y '.encryption.default = false' "$CONFIG_PATH" || echo "=> ERROR: Could not configure encryption default"
yq -i -y '.encryption.require = false' "$CONFIG_PATH" || echo "=> ERROR: Could not configure encryption require"
yq -i -y '.encryption.appservice = false' "$CONFIG_PATH" || echo "=> ERROR: Could not configure encryption appservice"
yq -i -y '.encryption.plaintext_mentions = false' "$CONFIG_PATH" || echo "=> ERROR: Could not configure encryption plaintext_mentions"
yq -i -y '.encryption.delete_keys.delete_outbound_on_ack = true' "$CONFIG_PATH" || echo "=> ERROR: Could not configure encryption delete_outbound_on_ack"
yq -i -y '.encryption.delete_keys.dont_store_outbound = true' "$CONFIG_PATH" || echo "=> ERROR: Could not configure encryption dont_store_outbound"
yq -i -y '.encryption.delete_keys.ratchet_on_decrypt = true' "$CONFIG_PATH" || echo "=> ERROR: Could not configure encryption ratchet_on_decrypt"
yq -i -y '.encryption.delete_keys.delete_fully_used_on_decrypt = true' "$CONFIG_PATH" || echo "=> ERROR: Could not configure encryption delete_fully_used_on_decrypt"
yq -i -y '.encryption.delete_keys.delete_prev_on_new_session = true' "$CONFIG_PATH" || echo "=> ERROR: Could not configure encryption delete_prev_on_new_session"
yq -i -y '.encryption.delete_keys.delete_on_device_delete = true' "$CONFIG_PATH" || echo "=> ERROR: Could not configure encryption delete_on_device_delete"
yq -i -y '.encryption.delete_keys.periodically_delete_expired = true' "$CONFIG_PATH" || echo "=> ERROR: Could not configure encryption periodically_delete_expired"
yq -i -y '.encryption.delete_keys.delete_outdated_inbound = true' "$CONFIG_PATH" || echo "=> ERROR: Could not configure encryption delete_outdated_inbound"
yq -i -y '.encryption.verification_levels.receive = "cross-signed-tofu"' "$CONFIG_PATH" || echo "=> ERROR: Could not configure encryption verification receive"
yq -i -y '.encryption.verification_levels.send = "cross-signed-tofu"' "$CONFIG_PATH" || echo "=> ERROR: Could not configure encryption verification send"
yq -i -y '.encryption.verification_levels.share = "cross-signed-tofu"' "$CONFIG_PATH" || echo "=> ERROR: Could not configure encryption verification share"
fi
# Now generate registration with proper config
echo "=> Generating registration file"
gosu cloudron:cloudron /app/pkg/mautrix-whatsapp -g -c "$CONFIG_PATH" -r "$REGISTRATION_PATH"
# Fix registration file regex patterns to use base domain instead of homeserver domain
if [ -f "$REGISTRATION_PATH" ] && [ -n "${CLOUDRON_APP_DOMAIN:-}" ]; then
echo "=> Fixing registration file regex patterns for domain: $BASE_DOMAIN"
# Fix user regex patterns to use base domain instead of matrix subdomain
yq -i -y '.namespaces.users[0].regex = "^@whatsappbot:'"$BASE_DOMAIN"'$"' "$REGISTRATION_PATH" || echo "=> ERROR: Could not fix whatsappbot regex"
yq -i -y '.namespaces.users[1].regex = "^@whatsapp_.*:'"$BASE_DOMAIN"'$"' "$REGISTRATION_PATH" || echo "=> ERROR: Could not fix whatsapp_.* regex"
fi
chown cloudron:cloudron "$CONFIG_PATH" "$REGISTRATION_PATH" 2>/dev/null || true
echo "=> Configuration applied successfully"
fi
if [ ! -f "$CONFIG_PATH" ]; then
echo "=> ERROR: Config generation failed and no config file was created"
echo "=> Will try to start without config to see error messages"
fi
else
echo "=> Using existing configuration"
# Fix configuration in existing config if needed
if [ -f "$CONFIG_PATH" ]; then
echo "=> Config file exists, applying fixes..."
# Always fix configuration on every start to ensure proper settings
echo "=> Applying configuration fixes"
# Fix database configuration if needed
if [ -n "${CLOUDRON_POSTGRESQL_URL:-}" ]; then
# Add SSL mode disable to Cloudron PostgreSQL URL if not already present
if [[ "$CLOUDRON_POSTGRESQL_URL" == *"sslmode="* ]]; then
DB_URL="$CLOUDRON_POSTGRESQL_URL"
else
DB_URL="$CLOUDRON_POSTGRESQL_URL?sslmode=disable"
fi
CURRENT_DB_URI=$(yq -r '.database.uri' "$CONFIG_PATH" 2>/dev/null || echo "")
if [ "$CURRENT_DB_URI" != "$DB_URL" ]; then
echo "=> Updating database configuration"
yq -i -y '.database.uri = "'"$DB_URL"'"' "$CONFIG_PATH" || echo "=> ERROR: Could not update database"
fi
fi
# Fix homeserver configuration if needed
if [ -n "${CLOUDRON_APP_DOMAIN:-}" ]; then
# Extract base domain (e.g., whatsapp.matrix.due.ren -> due.ren)
BASE_DOMAIN=$(echo "$CLOUDRON_APP_DOMAIN" | rev | cut -d. -f1-2 | rev)
CURRENT_DOMAIN=$(yq -r '.homeserver.domain' "$CONFIG_PATH" 2>/dev/null || echo "")
if [ "$CURRENT_DOMAIN" != "$BASE_DOMAIN" ]; then
echo "=> Updating homeserver configuration"
echo "=> Setting homeserver.address to: https://matrix.$BASE_DOMAIN"
echo "=> Setting homeserver.domain to: $BASE_DOMAIN"
echo "=> Setting appservice.address to: https://$CLOUDRON_APP_DOMAIN"
yq -i -y '.homeserver.address = "https://matrix.'"$BASE_DOMAIN"'"' "$CONFIG_PATH" || echo "=> ERROR: Could not update homeserver address"
yq -i -y '.homeserver.domain = "'"$BASE_DOMAIN"'"' "$CONFIG_PATH" || echo "=> ERROR: Could not update homeserver domain"
yq -i -y '.appservice.address = "https://'"$CLOUDRON_APP_DOMAIN"'"' "$CONFIG_PATH" || echo "=> ERROR: Could not update appservice address"
yq -i -y '.appservice.public_address = "https://'"$CLOUDRON_APP_DOMAIN"'"' "$CONFIG_PATH" || echo "=> ERROR: Could not update appservice public_address"
yq -i -y '.appservice.hostname = "0.0.0.0"' "$CONFIG_PATH" || echo "=> ERROR: Could not update appservice hostname"
yq -i -y '.appservice.port = 29318' "$CONFIG_PATH" || echo "=> ERROR: Could not update appservice port"
# Configure permissions for base domain users
yq -i -y '.bridge.permissions."'"$BASE_DOMAIN"'" = "user"' "$CONFIG_PATH" || echo "=> ERROR: Could not update permissions"
# Configure cleanup on logout to delete everything
yq -i -y '.bridge.cleanup_on_logout.enabled = true' "$CONFIG_PATH" || echo "=> ERROR: Could not update cleanup enabled"
yq -i -y '.bridge.cleanup_on_logout.manual.private = "delete"' "$CONFIG_PATH" || echo "=> ERROR: Could not update cleanup manual private"
yq -i -y '.bridge.cleanup_on_logout.manual.relayed = "delete"' "$CONFIG_PATH" || echo "=> ERROR: Could not update cleanup manual relayed"
yq -i -y '.bridge.cleanup_on_logout.manual.shared_no_users = "delete"' "$CONFIG_PATH" || echo "=> ERROR: Could not update cleanup manual shared_no_users"
yq -i -y '.bridge.cleanup_on_logout.manual.shared_has_users = "delete"' "$CONFIG_PATH" || echo "=> ERROR: Could not update cleanup manual shared_has_users"
yq -i -y '.bridge.cleanup_on_logout.bad_credentials.private = "delete"' "$CONFIG_PATH" || echo "=> ERROR: Could not update cleanup bad_credentials private"
yq -i -y '.bridge.cleanup_on_logout.bad_credentials.relayed = "delete"' "$CONFIG_PATH" || echo "=> ERROR: Could not update cleanup bad_credentials relayed"
yq -i -y '.bridge.cleanup_on_logout.bad_credentials.shared_no_users = "delete"' "$CONFIG_PATH" || echo "=> ERROR: Could not update cleanup bad_credentials shared_no_users"
yq -i -y '.bridge.cleanup_on_logout.bad_credentials.shared_has_users = "delete"' "$CONFIG_PATH" || echo "=> ERROR: Could not update cleanup bad_credentials shared_has_users"
# Configure browser name for better WhatsApp compatibility
yq -i -y '.network.browser_name = "ANDROID_PHONE"' "$CONFIG_PATH" || echo "=> ERROR: Could not update browser_name"
# Configure end-to-bridge encryption with best practices
yq -i -y '.encryption.allow = true' "$CONFIG_PATH" || echo "=> ERROR: Could not update encryption allow"
yq -i -y '.encryption.default = false' "$CONFIG_PATH" || echo "=> ERROR: Could not update encryption default"
yq -i -y '.encryption.require = false' "$CONFIG_PATH" || echo "=> ERROR: Could not update encryption require"
yq -i -y '.encryption.appservice = false' "$CONFIG_PATH" || echo "=> ERROR: Could not update encryption appservice"
yq -i -y '.encryption.plaintext_mentions = false' "$CONFIG_PATH" || echo "=> ERROR: Could not update encryption plaintext_mentions"
yq -i -y '.encryption.delete_keys.delete_outbound_on_ack = true' "$CONFIG_PATH" || echo "=> ERROR: Could not update encryption delete_outbound_on_ack"
yq -i -y '.encryption.delete_keys.dont_store_outbound = true' "$CONFIG_PATH" || echo "=> ERROR: Could not update encryption dont_store_outbound"
yq -i -y '.encryption.delete_keys.ratchet_on_decrypt = true' "$CONFIG_PATH" || echo "=> ERROR: Could not update encryption ratchet_on_decrypt"
yq -i -y '.encryption.delete_keys.delete_fully_used_on_decrypt = true' "$CONFIG_PATH" || echo "=> ERROR: Could not update encryption delete_fully_used_on_decrypt"
yq -i -y '.encryption.delete_keys.delete_prev_on_new_session = true' "$CONFIG_PATH" || echo "=> ERROR: Could not update encryption delete_prev_on_new_session"
yq -i -y '.encryption.delete_keys.delete_on_device_delete = true' "$CONFIG_PATH" || echo "=> ERROR: Could not update encryption delete_on_device_delete"
yq -i -y '.encryption.delete_keys.periodically_delete_expired = true' "$CONFIG_PATH" || echo "=> ERROR: Could not update encryption periodically_delete_expired"
yq -i -y '.encryption.delete_keys.delete_outdated_inbound = true' "$CONFIG_PATH" || echo "=> ERROR: Could not update encryption delete_outdated_inbound"
yq -i -y '.encryption.verification_levels.receive = "cross-signed-tofu"' "$CONFIG_PATH" || echo "=> ERROR: Could not update encryption verification receive"
yq -i -y '.encryption.verification_levels.send = "cross-signed-tofu"' "$CONFIG_PATH" || echo "=> ERROR: Could not update encryption verification send"
yq -i -y '.encryption.verification_levels.share = "cross-signed-tofu"' "$CONFIG_PATH" || echo "=> ERROR: Could not update encryption verification share"
# Verify the changes were applied
echo "=> Verifying configuration changes:"
echo "=> Current homeserver.address: $(yq -r '.homeserver.address' "$CONFIG_PATH")"
echo "=> Current homeserver.domain: $(yq -r '.homeserver.domain' "$CONFIG_PATH")"
fi
fi
# Fix logging configuration
yq -i -y '.logging.writers[1].filename = "/app/data/mautrix-whatsapp.log"' "$CONFIG_PATH" 2>/dev/null || true
# Always apply browser name and encryption settings (regardless of domain changes)
echo "=> Applying browser name and encryption configuration"
yq -i -y '.network.browser_name = "ANDROID_PHONE"' "$CONFIG_PATH" || echo "=> ERROR: Could not update browser_name"
yq -i -y '.encryption.allow = true' "$CONFIG_PATH" || echo "=> ERROR: Could not update encryption allow"
yq -i -y '.encryption.default = false' "$CONFIG_PATH" || echo "=> ERROR: Could not update encryption default"
yq -i -y '.encryption.require = false' "$CONFIG_PATH" || echo "=> ERROR: Could not update encryption require"
yq -i -y '.encryption.appservice = false' "$CONFIG_PATH" || echo "=> ERROR: Could not update encryption appservice"
yq -i -y '.encryption.plaintext_mentions = false' "$CONFIG_PATH" || echo "=> ERROR: Could not update encryption plaintext_mentions"
yq -i -y '.encryption.delete_keys.delete_outbound_on_ack = true' "$CONFIG_PATH" || echo "=> ERROR: Could not update encryption delete_outbound_on_ack"
yq -i -y '.encryption.delete_keys.dont_store_outbound = true' "$CONFIG_PATH" || echo "=> ERROR: Could not update encryption dont_store_outbound"
yq -i -y '.encryption.delete_keys.ratchet_on_decrypt = true' "$CONFIG_PATH" || echo "=> ERROR: Could not update encryption ratchet_on_decrypt"
yq -i -y '.encryption.delete_keys.delete_fully_used_on_decrypt = true' "$CONFIG_PATH" || echo "=> ERROR: Could not update encryption delete_fully_used_on_decrypt"
yq -i -y '.encryption.delete_keys.delete_prev_on_new_session = true' "$CONFIG_PATH" || echo "=> ERROR: Could not update encryption delete_prev_on_new_session"
yq -i -y '.encryption.delete_keys.delete_on_device_delete = true' "$CONFIG_PATH" || echo "=> ERROR: Could not update encryption delete_on_device_delete"
yq -i -y '.encryption.delete_keys.periodically_delete_expired = true' "$CONFIG_PATH" || echo "=> ERROR: Could not update encryption periodically_delete_expired"
yq -i -y '.encryption.delete_keys.delete_outdated_inbound = true' "$CONFIG_PATH" || echo "=> ERROR: Could not update encryption delete_outdated_inbound"
yq -i -y '.encryption.verification_levels.receive = "cross-signed-tofu"' "$CONFIG_PATH" || echo "=> ERROR: Could not update encryption verification receive"
yq -i -y '.encryption.verification_levels.send = "cross-signed-tofu"' "$CONFIG_PATH" || echo "=> ERROR: Could not update encryption verification send"
yq -i -y '.encryption.verification_levels.share = "cross-signed-tofu"' "$CONFIG_PATH" || echo "=> ERROR: Could not update encryption verification share"
# Update registration file with correct URL and fix regex patterns
if [ -f "$REGISTRATION_PATH" ] && [ -n "${CLOUDRON_APP_DOMAIN:-}" ]; then
yq -i -y '.url = "https://'"$CLOUDRON_APP_DOMAIN"'"' "$REGISTRATION_PATH" 2>/dev/null || true
# Fix user regex patterns to use base domain instead of matrix subdomain
yq -i -y '.namespaces.users[0].regex = "^@whatsappbot:'"$BASE_DOMAIN"'$"' "$REGISTRATION_PATH" || echo "=> ERROR: Could not fix whatsappbot regex"
yq -i -y '.namespaces.users[1].regex = "^@whatsapp_.*:'"$BASE_DOMAIN"'$"' "$REGISTRATION_PATH" || echo "=> ERROR: Could not fix whatsapp_.* regex"
fi
# Let the bridge handle token generation automatically - remove any placeholder tokens
if [ -f "$REGISTRATION_PATH" ]; then
echo "=> Registration file generated, letting bridge handle token management"
fi
fi
echo "=> Configuration fixes completed"
fi
# Final permission fix before starting
echo "=> Setting final permissions..."
chown -R cloudron:cloudron /app/data
echo "=> Permissions set"
# Configure TLS if certificates are available
if [ -f "/run/tls/tls.crt" ] && [ -f "/run/tls/tls.key" ]; then
echo "=> Configuring TLS certificates"
yq -i -y '.appservice.tls_cert = "/run/tls/tls.crt"' "$CONFIG_PATH"
yq -i -y '.appservice.tls_key = "/run/tls/tls.key"' "$CONFIG_PATH"
fi
# Start the bridge from the data directory to ensure relative paths work
echo "=> Starting mautrix-whatsapp bridge"
echo "=> Config path: $CONFIG_PATH"
echo "=> Registration path: $REGISTRATION_PATH"
echo "=> Working directory: $(pwd)"
cd /app/data
echo "=> About to exec bridge binary..."
exec gosu cloudron:cloudron /app/pkg/mautrix-whatsapp -c "$CONFIG_PATH"