From f4eb17a6fc21503147832491d2e1ec5744fc752c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Nicolas=20Mass=C3=A9?= <nicolas.masse@itix.fr>
Date: Mon, 29 Jun 2026 18:11:47 +0000
Subject: [PATCH] add config file

---
 cookbooks/matrix/config/examples/tuwunel.env  | 40 -------------------
 .../config/examples/tuwunel/tuwunel.toml      | 29 ++++++++++++++
 cookbooks/matrix/config/init.sh               |  2 +-
 cookbooks/matrix/matrix-homeserver.container  |  5 +++
 4 files changed, 35 insertions(+), 41 deletions(-)
 create mode 100644 cookbooks/matrix/config/examples/tuwunel/tuwunel.toml

diff --git a/cookbooks/matrix/config/examples/tuwunel.env b/cookbooks/matrix/config/examples/tuwunel.env
index 76b6639..40097cb 100644
--- a/cookbooks/matrix/config/examples/tuwunel.env
+++ b/cookbooks/matrix/config/examples/tuwunel.env
@@ -1,47 +1,11 @@
 ##
 ## Matrix Configuration Environment Variables (Tuwunel)
 ##
-## IMPORTANT: server_name cannot be changed after the first start.
-## Prefer a root domain (e.g. example.com) so users get @user:example.com handles.
-## The server itself can be accessed at a subdomain (e.g. matrix.example.com) via
-## a .well-known delegation.
-##
 
-# Server identity
 TUWUNEL_SERVER_NAME=example.com
-
-# Bind to localhost only - Traefik handles the public-facing TLS
-TUWUNEL_ADDRESS=127.0.0.1
 TUWUNEL_PORT=6167
-
-# Database storage path (inside the container)
-TUWUNEL_DATABASE_PATH=/var/lib/tuwunel/db
-
-# Registration
-# Set a token to restrict who can register.
-TUWUNEL_ALLOW_REGISTRATION=true
 TUWUNEL_REGISTRATION_TOKEN=changeme
 
-# First user to register is automatically granted admin.
-TUWUNEL_GRANT_ADMIN_TO_FIRST_USER=true
-
-# Federation (disabled for a private home server)
-TUWUNEL_ALLOW_FEDERATION=false
-
-# Trusted servers for public key queries (used even without full federation)
-TUWUNEL_TRUSTED_SERVERS=["matrix.org"]
-
-# Tell Tuwunel to trust the X-Forwarded-For header set by Traefik
-TUWUNEL_IP_SOURCE=rightmost_x_forwarded_for
-
-# Log level
-TUWUNEL_LOG=info
-
-# Media Storage path and options
-TUWUNEL_STORAGE_PROVIDER__MEDIA__LOCAL__BASE_PATH=/var/lib/tuwunel/media
-TUWUNEL_STORAGE_PROVIDER__MEDIA__LOCAL__DELETE_EMPTY_DIRECTORIES=true
-TUWUNEL_STORAGE_PROVIDER__MEDIA__LOCAL__STARTUP_CHECK=true
-
 ##
 ## First-run initialization (matrix-init)
 ## These variables are used once by matrix-init to create the admin user and
@@ -57,10 +21,6 @@ MATRIX_INIT_ADMIN_PASSWORD=changeme
 ## Backup configuration
 ##
 
-# Path where Tuwunel stores RocksDB online backups (inside the container).
-# Each call to '!admin server backup-database' creates an incremental backup here.
-TUWUNEL_DATABASE_BACKUP_PATH=/var/lib/tuwunel/backup
-
 # Number of dated backup archives to keep on virtiofs (0 = keep all).
 MATRIX_BACKUP_RETENTION=7
 
diff --git a/cookbooks/matrix/config/examples/tuwunel/tuwunel.toml b/cookbooks/matrix/config/examples/tuwunel/tuwunel.toml
new file mode 100644
index 0000000..9eb9cd8
--- /dev/null
+++ b/cookbooks/matrix/config/examples/tuwunel/tuwunel.toml
@@ -0,0 +1,29 @@
+[global]
+# Network settings
+address = ["127.0.0.1", "::1"]
+ip_source = "rightmost_x_forwarded_for"
+
+# Paths
+database_path = "/var/lib/tuwunel/db"
+database_backup_path = "/var/lib/tuwunel/backup"
+
+# Registration
+allow_registration = true
+grant_admin_to_first_user = true
+
+# Login
+login_via_existing_session = true
+login_via_token = true
+
+# Federation
+allow_federation = false
+
+# Logging
+log = "info"
+log_colors = false
+
+# Media Storage
+[global.storage_provider.media.local]
+base_path = "/var/lib/tuwunel/media"
+delete_empty_directories = true
+startup_check = true
diff --git a/cookbooks/matrix/config/init.sh b/cookbooks/matrix/config/init.sh
index 079d814..5c7ae7e 100755
--- a/cookbooks/matrix/config/init.sh
+++ b/cookbooks/matrix/config/init.sh
@@ -31,7 +31,7 @@ LOGIN_RESPONSE=$(curl -s -X POST \
 ACCESS_TOKEN=$(echo "$LOGIN_RESPONSE" | jq -r '.access_token // empty')
 
 if [ -z "$ACCESS_TOKEN" ]; then
-    echo "Login failed; registering ${ADMIN_USER} (TUWUNEL_GRANT_ADMIN_TO_FIRST_USER=true)..."
+    echo "Login failed; registering ${ADMIN_USER}..."
 
     # Step 1: get the UIAA session ID (server returns 401 with session in body)
     UIAA_RESPONSE=$(curl -s -X POST \
diff --git a/cookbooks/matrix/matrix-homeserver.container b/cookbooks/matrix/matrix-homeserver.container
index b0a4821..21c8e6c 100644
--- a/cookbooks/matrix/matrix-homeserver.container
+++ b/cookbooks/matrix/matrix-homeserver.container
@@ -7,6 +7,7 @@ Before=matrix.target
 
 # Only run if the homeserver has been configured
 ConditionPathExists=/etc/quadlets/matrix/tuwunel.env
+ConditionPathExists=/etc/quadlets/matrix/tuwunel/tuwunel.toml
 
 PartOf=matrix.target
 
@@ -30,6 +31,10 @@ Volume=/var/lib/quadlets/matrix/tuwunel/db:/var/lib/tuwunel/db:z
 Volume=/var/lib/virtiofs/data/matrix/tuwunel/media:/var/lib/tuwunel/media:z
 Volume=/var/lib/quadlets/matrix/tuwunel/backup-staging:/var/lib/tuwunel/backup:z
 
+# Configuration file (must exist before starting)
+Volume=/etc/quadlets/matrix/tuwunel:/etc/tuwunel:z,ro
+Exec=--config /etc/tuwunel/tuwunel.toml
+
 [Service]
 Restart=always
 RestartSec=10