Hosting Matrix Moderation-Bot #58
Labels
No labels
bug
cleanup
duplicate
enhancement
forgefriends
help wanted
invalid
label workflow
need more info
question
refactor
static-site
sync
wontfix
No milestone
No project
No assignees
3 participants
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference: infrastructure/k8s-cluster#58
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Why?
The moderation on Matrix depends currently highly on the capabilities of the used clients (e.g. bulk deletion of spam comments).
A moderation tool like https://github.com/matrix-org/mjolnir would improve the management.
ToDo:
This is a YAML file, right? Is it possible to specify more than one config file? That would be convenient to split the password part out of the rest. So that the config can be stored in the git repository while the password is stored in a secret in the cluster. If that's not possible, it is not a blocker, it is just not as easy.
it seems we need #242 to securely store secrets here. will try to add next days
@earl-warren wrote in https://code.forgejo.org/infrastructure/k8s-cluster/issues/415#issuecomment-37368:
Yes, needed to change the extension to upload the file.
@earl-warren wrote in https://code.forgejo.org/infrastructure/k8s-cluster/issues/415#issuecomment-37368:
As far as I can see this is not possible, it's also not possible to specify it as env variable.
I created
@forgejo-mod-bot:matrix.org(@forgejo-moderation-bot:matrix.orgis already register by someone else) but it's fine and fluent :DIt is currently associated with an email from myself. I could change it to another one if we have a fitting one.
moderation-bot@forgejo.org was created just now and is forwarded to moderation@forgejo.org.
Does that help?
Changed the mail of the account
I can speak a bit about the various requirements laid out here that Draupnir meets.
Draupnir uses legacy long lived access tokens while we are waiting for MAS to implement proper service authentication like exists on platforms like Discord or Github. This is supported in MAS via legacy support. Whereas Mjolnir tries to login like a regular Matrix user and this is why Mjolnir needs to make special arrangements to support MAS.
Secrets can be loaded from separate secret files. This was implemented for environments that use secret management systems that allow file based secrets. NixOS with Systemd secret management was the environment that pushed the initial implementation but K8s is also a clear example of a environment that benefits. Documentation for secret management can be accessed here https://the-draupnir-project.github.io/draupnir-documentation/bot/starting_draupnir#secret-management
As for if E2EE is a good idea for your moderation bot that is a separate topic that the Draupnir documentation covers in https://the-draupnir-project.github.io/draupnir-documentation/concepts/encryption
Ok, I'll have to look that up. In general, I would be in favour of Draupnir.
Ok, so we can use Draupnir, which also solves the secret managment.
I attached a sample configuration which should be fine. (Will only update the wordlist probably in the future 🤔).
You probably want to activate the
healthsetting to do automatic health checks in k8s.https://the-draupnir-project.github.io/draupnir-documentation/bot/systemd
Regarding secrets: https://the-draupnir-project.github.io/draupnir-documentation/bot/starting_draupnir#secret-management
@viceice comments in the chatroom for the record.
https://github.com/the-draupnir-project/helm-charts is WIP
57a29f5e61/charts/draupnir/values.yaml (L119)the token can only be provided in cleartext
https://github.com/the-draupnir-project/helm-charts/issues/1
@earl-warren wrote in https://invisible.forgejo.org/infrastructure/k8s-cluster/issues/415#issuecomment-3934:
Sounds like the chart is in it's early days and the ticket is just as reminder for somewhere in the future 🤔
@earl-warren whats the best/preferred way to provide you the access token and in the best case I also provide the username and password for gopass.
ToDo: I need to update the docs page, it still links to the meta repo and the secret keepers team...
A message via matrix would be fine.
@earl-warren wrote in https://invisible.forgejo.org/infrastructure/k8s-cluster/issues/415#issuecomment-3937:
Done
https://github.com/the-draupnir-project/helm-charts is soft forked at https://code.forgejo.org/forgejo-contrib/draupnir-helm-charts in order to produce releases and maintain hacks/fixes until an official release is ready.