Make Telegram bridge configuration playbook-managed

CHANGELOG.md

@@ -1,3 +1,26 @@
+# 2019-06-15
+
+## (BC Break) Telegram bridge configuration is now entirely managed by the playbook
+
+Until now, configuration files for the [Telegram bridge](docs/configuring-playbook-bridge-mautrix-telegram.md) were created by the playbook initially, but never modified later on.
+
+From now on, the playbook will keep those configuration in sync for you.
+
+This means that if you were making manual changes to the `/matrix/mautrix-telegram/config.yaml` or `/matrix/mautrix-telegram/registration.yaml` configuration files, those would be lost the next time you run the playbook.
+
+The bridge now stores configuration in a subdirectory (`/matrix/mautrix-telegram/config`), so your old configuration remains in the base directory (`/matrix/mautrix-telegram`).
+You need to migrate any manual changes over to the new `matrix_mautrix_telegram_configuration_extension_yaml` variable, so that the playbook would apply them for you.
+
+Likewise, data is now also stored in a subdirectory (`/matrix/mautrix-telegram/data`). When you run the playbook with an existing database file (`/matrix/mautrix-telegram/mautrix-telegram.db`), the playbook will stop the bridge and relocate the database file to the `./data` directory. There's no data-loss involved. You'll need to restart the bridge manually though (`--tags=start`).
+
+Also, we're now following the default configuration for the Telegram bridge, so some default configuration values are different:
+
+- `edits_as_replies` (used to be `false`, now `true`) - previously replies were not sent over to Matrix at all; ow they are sent over as a reply to the original message
+- `inline_images` (used to be `true`, now `false`) - this has to do with captioned images. Inline-image (included caption) are said to exhibit troubles on Riot iOS. When `false`, the caption arrives on the Matrix side as a separate message.
+- `authless_portals` (used to be `false`, now `true`) - creating portals from the Telegram side is now possible
+- `whitelist_group_admins` (used to be `false`, now `true`) - allows Telegram group admins to use the bot commands
+
+
 # 2019-06-12
 
 ## Synapse v1.0

group_vars/matrix_servers

@@ -117,6 +117,7 @@ matrix_mautrix_facebook_homeserver_token: "{{ matrix_synapse_macaroon_secret_key
 # We don't enable bridges by default.
 matrix_mautrix_telegram_enabled: false
 
+
 matrix_mautrix_telegram_systemd_required_services_list: |
   {{
     ['docker.service']
@@ -124,6 +125,10 @@ matrix_mautrix_telegram_systemd_required_services_list: |
     (['matrix-synapse.service'] if matrix_synapse_enabled else [])
   }}
 
+matrix_mautrix_telegram_appservice_token: "{{ matrix_synapse_macaroon_secret_key | password_hash('sha512', 'telegram-appservice-token') | to_uuid }}"
+
+matrix_mautrix_telegram_homeserver_token: "{{ matrix_synapse_macaroon_secret_key | password_hash('sha512', 'telegram-homeserver-token') | to_uuid }}"
+
 matrix_mautrix_telegram_public_endpoint: "/{{ matrix_synapse_macaroon_secret_key | password_hash('sha512', 'telegram') | to_uuid }}"
 
 matrix_mautrix_telegram_container_http_host_bind_port: "{{ '' if matrix_nginx_proxy_enabled else '127.0.0.1:9006' }}"

roles/matrix-bridge-mautrix-telegram/defaults/main.yml

@@ -7,6 +7,8 @@ matrix_mautrix_telegram_docker_image: "tulir/mautrix-telegram:v0.5.2"
 matrix_mautrix_telegram_docker_image_force_pull: "{{ matrix_mautrix_telegram_docker_image.endswith(':latest') }}"
 
 matrix_mautrix_telegram_base_path: "{{ matrix_base_data_path }}/mautrix-telegram"
+matrix_mautrix_telegram_config_path: "{{ matrix_mautrix_telegram_base_path }}/config"
+matrix_mautrix_telegram_data_path: "{{ matrix_mautrix_telegram_base_path }}/data"
 
 # Get your own API keys at https://my.telegram.org/apps
 matrix_mautrix_telegram_api_id: ''
@@ -35,3 +37,342 @@ matrix_mautrix_telegram_systemd_required_services_list: ['docker.service']
 
 # List of systemd services that matrix-mautrix-telegram.service wants
 matrix_mautrix_telegram_systemd_wanted_services_list: []
+
+matrix_mautrix_telegram_appservice_token: ''
+matrix_mautrix_telegram_homeserver_token: ''
+
+# Default mxisd configuration template which covers the generic use case.
+# You can customize it by controlling the various variables inside it.
+#
+# For a more advanced customization, you can extend the default (see `matrix_mautrix_telegram_configuration_extension_yaml`)
+# or completely replace this variable with your own template.
+matrix_mautrix_telegram_configuration_yaml: |
+  #jinja2: lstrip_blocks: "True"
+  # Homeserver details
+  homeserver:
+      # The address that this appservice can use to connect to the homeserver.
+      address: {{ matrix_mautrix_telegram_homeserver_address }}
+      # The domain of the homeserver (for MXIDs, etc).
+      domain: {{ matrix_mautrix_telegram_homeserver_domain }}
+      # Whether or not to verify the SSL certificate of the homeserver.
+      # Only applies if address starts with https://
+      verify_ssl: true
+
+  # Application service host/registration related details
+  # Changing these values requires regeneration of the registration.
+  appservice:
+      # The address that the homeserver can use to connect to this appservice.
+      address: {{ matrix_mautrix_telegram_appservice_address }}
+
+      # The hostname and port where this appservice should listen.
+      hostname: 0.0.0.0
+      port: 8080
+      # The maximum body size of appservice API requests (from the homeserver) in mebibytes
+      # Usually 1 is enough, but on high-traffic bridges you might need to increase this to avoid 413s
+      max_body_size: 1
+
+      # The full URI to the database. SQLite and Postgres are fully supported.
+      # Other DBMSes supported by SQLAlchemy may or may not work.
+      # Format examples:
+      #   SQLite:   sqlite:///filename.db
+      #   Postgres: postgres://username:password@hostname/dbname
+      database: sqlite:////data/mautrix-telegram.db
+
+      # Public part of web server for out-of-Matrix interaction with the bridge.
+      # Used for things like login if the user wants to make sure the 2FA password isn't stored in
+      # the HS database.
+      public:
+          # Whether or not the public-facing endpoints should be enabled.
+          enabled: true
+          # The prefix to use in the public-facing endpoints.
+          prefix: {{ matrix_mautrix_telegram_public_endpoint }}
+          # The base URL where the public-facing endpoints are available. The prefix is not added
+          # implicitly.
+          external: {{ matrix_mautrix_telegram_appservice_public_external }}
+
+      # Provisioning API part of the web server for automated portal creation and fetching information.
+      # Used by things like Dimension (https://dimension.t2bot.io/).
+      provisioning:
+          # Whether or not the provisioning API should be enabled.
+          enabled: false
+          # The prefix to use in the provisioning API endpoints.
+          prefix: /_matrix/provision/v1
+          # The shared secret to authorize users of the API.
+          # Set to "generate" to generate and save a new token.
+          shared_secret: generate
+
+      # The unique ID of this appservice.
+      id: telegram
+      # Username of the appservice bot.
+      bot_username: telegrambot
+      # Display name and avatar for bot. Set to "remove" to remove display name/avatar, leave empty
+      # to leave display name/avatar as-is.
+      bot_displayname: Telegram bridge bot
+      bot_avatar: mxc://maunium.net/tJCRmUyJDsgRNgqhOgoiHWbX
+
+      # Authentication tokens for AS <-> HS communication.
+      as_token: "{{ matrix_mautrix_telegram_appservice_token }}"
+      hs_token: "{{ matrix_mautrix_telegram_homeserver_token }}"
+
+  # Bridge config
+  bridge:
+      # Localpart template of MXIDs for Telegram users.
+      # {userid} is replaced with the user ID of the Telegram user.
+      username_template: "telegram_{userid}"
+      # Localpart template of room aliases for Telegram portal rooms.
+      # {groupname} is replaced with the name part of the public channel/group invite link ( https://t.me/{} )
+      alias_template: "telegram_{groupname}"
+      # Displayname template for Telegram users.
+      # {displayname} is replaced with the display name of the Telegram user.
+      displayname_template: "{displayname} (Telegram)"
+
+      # Set the preferred order of user identifiers which to use in the Matrix puppet display name.
+      # In the (hopefully unlikely) scenario that none of the given keys are found, the numeric user
+      # ID is used.
+      #
+      # If the bridge is working properly, a phone number or an username should always be known, but
+      # the other one can very well be empty.
+      #
+      # Valid keys:
+      #   "full name"          (First and/or last name)
+      #   "full name reversed" (Last and/or first name)
+      #   "first name"
+      #   "last name"
+      #   "username"
+      #   "phone number"
+      displayname_preference:
+      - full name
+      - username
+      - phone number
+
+      # Maximum number of members to sync per portal when starting up. Other members will be
+      # synced when they send messages. The maximum is 10000, after which the Telegram server
+      # will not send any more members.
+      # Defaults to no local limit (-> limited to 10000 by server)
+      max_initial_member_sync: -1
+      # Whether or not to sync the member list in channels.
+      # If no channel admins have logged into the bridge, the bridge won't be able to sync the member
+      # list regardless of this setting.
+      sync_channel_members: true
+      # Whether or not to skip deleted members when syncing members.
+      skip_deleted_members: true
+      # Whether or not to automatically synchronize contacts and chats of Matrix users logged into
+      # their Telegram account at startup.
+      startup_sync: true
+      # Number of most recently active dialogs to check when syncing chats.
+      # Dialogs include groups and private chats, but only groups are synced.
+      # Set to 0 to remove limit.
+      sync_dialog_limit: 30
+      # The maximum number of simultaneous Telegram deletions to handle.
+      # A large number of simultaneous redactions could put strain on your homeserver.
+      max_telegram_delete: 10
+      # Whether or not to automatically sync the Matrix room state (mostly unpuppeted displaynames)
+      # at startup and when creating a bridge.
+      sync_matrix_state: true
+      # Allow logging in within Matrix. If false, the only way to log in is using the out-of-Matrix
+      # login website (see appservice.public config section)
+      allow_matrix_login: true
+      # Whether or not to bridge plaintext highlights.
+      # Only enable this if your displayname_template has some static part that the bridge can use to
+      # reliably identify what is a plaintext highlight.
+      plaintext_highlights: false
+      # Show message editing as a reply to the original message.
+      # If this is false, message edits are not shown at all, as Matrix does not support editing yet.
+      edits_as_replies: true
+      # Highlight changed/added parts in edits. Requires lxml.
+      highlight_edits: false
+      # Whether or not to make portals of publicly joinable channels/supergroups publicly joinable on Matrix.
+      public_portals: true
+      # Whether or not to fetch and handle Telegram updates at startup from the time the bridge was down.
+      # Currently only works for private chats and normal groups.
+      catch_up: false
+      # Whether or not to use /sync to get presence, read receipts and typing notifications when using
+      # your own Matrix account as the Matrix puppet for your Telegram account.
+      sync_with_custom_puppets: true
+      # Set to false to disable link previews in messages sent to Telegram.
+      telegram_link_preview: true
+      # Use inline images instead of a separate message for the caption.
+      # N.B. Inline images are not supported on all clients (e.g. Riot iOS).
+      inline_images: false
+      # Maximum size of image in megabytes before sending to Telegram as a document.
+      image_as_file_size: 10
+
+      # Whether to bridge Telegram bot messages as m.notices or m.texts.
+      bot_messages_as_notices: true
+      bridge_notices:
+          # Whether or not Matrix bot messages (type m.notice) should be bridged.
+          default: false
+          # List of user IDs for whom the previous flag is flipped.
+          # e.g. if bridge_notices.default is false, notices from other users will not be bridged, but
+          #      notices from users listed here will be bridged.
+          exceptions: []
+
+      # Some config options related to Telegram message deduplication.
+      # The default values are usually fine, but some debug messages/warnings might recommend you
+      # change these.
+      deduplication:
+          # Whether or not to check the database if the message about to be sent is a duplicate.
+          pre_db_check: false
+          # The number of latest events to keep when checking for duplicates.
+          # You might need to increase this on high-traffic bridge instances.
+          cache_queue_length: 20
+
+
+      # The formats to use when sending messages to Telegram via the relay bot.
+      #
+      # Telegram doesn't have built-in emotes, so the m.emote format is also used for non-relaybot users.
+      #
+      # Available variables:
+      #   $sender_displayname    - The display name of the sender (e.g. Example User)
+      #   $sender_username       - The username (Matrix ID localpart) of the sender (e.g. exampleuser)
+      #   $sender_mxid           - The Matrix ID of the sender (e.g. @exampleuser:example.com)
+      #   $message               - The message content as HTML
+      message_formats:
+          m.text: "<b>$sender_displayname</b>: $message"
+          m.emote: "* <b>$sender_displayname</b> $message"
+          m.file: "<b>$sender_displayname</b> sent a file: $message"
+          m.image: "<b>$sender_displayname</b> sent an image: $message"
+          m.audio: "<b>$sender_displayname</b> sent an audio file: $message"
+          m.video: "<b>$sender_displayname</b> sent a video: $message"
+          m.location: "<b>$sender_displayname</b> sent a location: $message"
+
+      # The formats to use when sending state events to Telegram via the relay bot.
+      #
+      # Variables from `message_formats` that have the `sender_` prefix are available without the prefix.
+      # In name_change events, `$prev_displayname` is the previous displayname.
+      #
+      # Set format to an empty string to disable the messages for that event.
+      state_event_formats:
+          join: "<b>$displayname</b> joined the room."
+          leave: "<b>$displayname</b> left the room."
+          name_change: "<b>$prev_displayname</b> changed their name to <b>$displayname</b>"
+
+      # Filter rooms that can/can't be bridged. Can also be managed using the `filter` and
+      # `filter-mode` management commands.
+      #
+      # Filters do not affect direct chats.
+      # An empty blacklist will essentially disable the filter.
+      filter:
+          # Filter mode to use. Either "blacklist" or "whitelist".
+          # If the mode is "blacklist", the listed chats will never be bridged.
+          # If the mode is "whitelist", only the listed chats can be bridged.
+          mode: blacklist
+          # The list of group/channel IDs to filter.
+          list: []
+
+      # The prefix for commands. Only required in non-management rooms.
+      command_prefix: "!tg"
+
+      # Permissions for using the bridge.
+      # Permitted values:
+      #   relaybot - Only use the bridge via the relaybot, no access to commands.
+      #       user - Relaybot level + access to commands to create bridges.
+      #  puppeting - User level + logging in with a Telegram account.
+      #       full - Full access to use the bridge, i.e. previous levels + Matrix login.
+      #      admin - Full access to use the bridge and some extra administration commands.
+      # Permitted keys:
+      #        * - All Matrix users
+      #   domain - All users on that homeserver
+      #     mxid - Specific user
+      permissions:
+        '{{ matrix_mautrix_telegram_homeserver_domain }}': full
+
+      # Options related to the message relay Telegram bot.
+      relaybot:
+          # Whether or not to allow creating portals from Telegram.
+          authless_portals: true
+          # Whether or not to allow Telegram group admins to use the bot commands.
+          whitelist_group_admins: true
+          # Whether or not to ignore incoming events sent by the relay bot.
+          ignore_own_incoming_events: true
+          # List of usernames/user IDs who are also allowed to use the bot commands.
+          whitelist: []
+
+  # Telegram config
+  telegram:
+      # Get your own API keys at https://my.telegram.org/apps
+      api_id: {{ matrix_mautrix_telegram_api_id }}
+      api_hash: {{ matrix_mautrix_telegram_api_hash }}
+      # (Optional) Create your own bot at https://t.me/BotFather
+      bot_token: disabled
+      # Custom server to connect to.
+      server:
+          # Set to true to use these server settings. If false, will automatically
+          # use production server assigned by Telegram. Set to false in production.
+          enabled: false
+          # The DC ID to connect to.
+          dc: 2
+          # The IP to connect to.
+          ip: 149.154.167.40
+          # The port to connect to. 443 may not work, 80 is better and both are equally secure.
+          port: 80
+      # Telethon proxy configuration.
+      # You must install PySocks from pip for proxies to work.
+      proxy:
+          # Allowed types: disabled, socks4, socks5, http
+          type: disabled
+          # Proxy IP address and port.
+          address: 127.0.0.1
+          port: 1080
+          # Whether or not to perform DNS resolving remotely.
+          rdns: true
+          # Proxy authentication (optional).
+          username: ""
+          password: ""
+
+  # Python logging configuration.
+  #
+  # See section 16.7.2 of the Python documentation for more info:
+  # https://docs.python.org/3.6/library/logging.config.html#configuration-dictionary-schema
+  logging:
+      version: 1
+      formatters:
+          precise:
+              format: "[%(asctime)s] [%(levelname)s@%(name)s] %(message)s"
+      handlers:
+          console:
+              class: logging.StreamHandler
+              formatter: precise
+      loggers:
+          mau:
+              level: DEBUG
+          telethon:
+              level: DEBUG
+          aiohttp:
+              level: INFO
+      root:
+          level: DEBUG
+          handlers: [console]
+
+
+matrix_mautrix_telegram_configuration_extension_yaml: |
+  # Your custom YAML configuration goes here.
+  # This configuration extends the default starting configuration (`matrix_mautrix_telegram_configuration_yaml`).
+  #
+  # You can override individual variables from the default configuration, or introduce new ones.
+  #
+  # If you need something more special, you can take full control by
+  # completely redefining `matrix_mautrix_telegram_configuration_yaml`.
+
+matrix_mautrix_telegram_configuration_extension: "{{ matrix_mautrix_telegram_configuration_extension_yaml|from_yaml if matrix_mautrix_telegram_configuration_extension_yaml|from_yaml is mapping else {} }}"
+
+# Holds the final configuration (a combination of the default and its extension).
+# You most likely don't need to touch this variable. Instead, see `matrix_mautrix_telegram_configuration_yaml`.
+matrix_mautrix_telegram_configuration: "{{ matrix_mautrix_telegram_configuration_yaml|from_yaml|combine(matrix_mautrix_telegram_configuration_extension, recursive=True) }}"
+
+matrix_mautrix_telegram_registration_yaml: |
+  id: telegram
+  as_token: "{{ matrix_mautrix_telegram_appservice_token }}"
+  hs_token: "{{ matrix_mautrix_telegram_homeserver_token }}"
+  namespaces:
+      users:
+      - exclusive: true
+        regex: '@telegram_.+:{{ matrix_mautrix_telegram_homeserver_domain }}'
+      aliases:
+      - exclusive: true
+        regex: '#telegram_.+:{{ matrix_mautrix_telegram_homeserver_domain }}'
+  url: {{ matrix_mautrix_telegram_appservice_address }}
+  sender_localpart: telegrambot
+  rate_limited: false
+
+matrix_mautrix_telegram_registration: "{{ matrix_mautrix_telegram_registration_yaml|from_yaml }}"

roles/matrix-bridge-mautrix-telegram/tasks/setup_install.yml

@@ -15,38 +15,50 @@
     force_source: "{{ matrix_mautrix_telegram_docker_image_force_pull if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}"
     force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else matrix_mautrix_telegram_docker_image_force_pull }}"
 
-- name: Ensure Mautrix Telegram base directory exists
+- name: Ensure Mautrix Telegram paths exist
   file:
-    path: "{{ matrix_mautrix_telegram_base_path }}"
+    path: "{{ item }}"
     state: directory
     mode: 0750
     owner: "{{ matrix_user_username }}"
     group: "{{ matrix_user_username }}"
+  with_items:
+    - "{{ matrix_mautrix_telegram_base_path }}"
+    - "{{ matrix_mautrix_telegram_config_path }}"
+    - "{{ matrix_mautrix_telegram_data_path }}"
 
-- name: Check if a mautrix-telegram configuration file exists
+- name: Check if an old database file already exists
   stat:
-    path: "{{ matrix_mautrix_telegram_base_path }}/config.yaml"
+    path: "{{ matrix_mautrix_telegram_base_path }}/mautrix-telegram.db"
-  register: mautrix_telegram_config_file_stat
+  register: matrix_mautrix_telegram_stat_database
 
-- name: Ensure Matrix Mautrix telegram config installed
+- name: (Data relocation) Ensure matrix-mautrix-telegram.service is stopped
-  template:
+  service:
-    src: "{{ role_path }}/templates/config.yaml.j2"
+    name: matrix-mautrix-telegram
-    dest: "{{ matrix_mautrix_telegram_base_path }}/config.yaml"
+    state: stopped
+    daemon_reload: yes
+  failed_when: false
+  when: "matrix_mautrix_telegram_stat_database.stat.exists"
+
+- name: (Data relocation) Move mautrix-telegram database file to ./data directory
+  command: "mv {{ matrix_mautrix_telegram_base_path }}/mautrix-telegram.db {{ matrix_mautrix_telegram_data_path }}/mautrix-telegram.db"
+  when: "matrix_mautrix_telegram_stat_database.stat.exists"
+
+- name: Ensure mautrix-telegram config.yaml installed
+  copy:
+    content: "{{ matrix_mautrix_telegram_configuration|to_nice_yaml }}"
+    dest: "{{ matrix_mautrix_telegram_config_path }}/config.yaml"
     mode: 0644
     owner: "{{ matrix_user_username }}"
     group: "{{ matrix_user_username }}"
-  when: "not mautrix_telegram_config_file_stat.stat.exists"
 
-- name: (Migration) Fix up old configuration
+- name: Ensure mautrix-telegram registration.yaml installed
-  lineinfile:
+  copy:
-    path: "{{ matrix_mautrix_telegram_base_path }}/config.yaml"
+    content: "{{ matrix_mautrix_telegram_registration|to_nice_yaml }}"
-    regexp: "{{ item.regexp }}"
+    dest: "{{ matrix_mautrix_telegram_config_path }}/registration.yaml"
-    line: "{{ item.line }}"
+    mode: 0644
-    backrefs: yes
+    owner: "{{ matrix_user_username }}"
-  with_items:
+    group: "{{ matrix_user_username }}"
-    - {'regexp': '^(\s+)filename: \./mautrix-telegram.log', 'line': '\1filename: /data/mautrix-telegram.log'}
-    - {'regexp': '^(\s+)database:', 'line': '\1database: sqlite:////data/mautrix-telegram.db'}
-  when: "mautrix_telegram_config_file_stat.stat.exists"
 
 - name: Ensure matrix-mautrix-telegram.service installed
   template:
@@ -59,22 +71,3 @@
   service:
     daemon_reload: yes
   when: "matrix_mautrix_telegram_systemd_service_result.changed"
-
-- name: Check if a mautrix-telegram registration file exists
-  stat:
-    path: "{{ matrix_mautrix_telegram_base_path }}/registration.yaml"
-  register: mautrix_telegram_registration_file_stat
-
-- name: Generate matrix-mautrix-telegram registration.yaml if it doesn't exist
-  shell:
-    cmd: >-
-      /usr/bin/docker run
-      --rm
-      --user={{ matrix_user_uid }}:{{ matrix_user_gid }}
-      --cap-drop=ALL
-      --name matrix-mautrix-telegram-gen
-      -v {{ matrix_mautrix_telegram_base_path }}:/data:z
-      {{ matrix_mautrix_telegram_docker_image }}
-      python3 -m mautrix_telegram -g -c /data/config.yaml -r /data/registration.yaml
-  when: "not mautrix_telegram_registration_file_stat.stat.exists"
-

roles/matrix-bridge-mautrix-telegram/tasks/validate_config.yml

@@ -9,6 +9,8 @@
     - "matrix_mautrix_telegram_api_id"
     - "matrix_mautrix_telegram_api_hash"
     - "matrix_mautrix_telegram_public_endpoint"
+    - "matrix_mautrix_telegram_appservice_token"
+    - "matrix_mautrix_telegram_homeserver_token"
 
 - name: (Deprecation) Catch and report renamed Telegram variables
   fail:

roles/matrix-bridge-mautrix-telegram/templates/config.yaml.j2

@@ -1,266 +0,0 @@
-#jinja2: lstrip_blocks: "True"
-# Homeserver details
-homeserver:
-    # The address that this appservice can use to connect to the homeserver.
-    address: {{ matrix_mautrix_telegram_homeserver_address }}
-    # The domain of the homeserver (for MXIDs, etc).
-    domain: {{ matrix_mautrix_telegram_homeserver_domain }}
-    # Whether or not to verify the SSL certificate of the homeserver.
-    # Only applies if address starts with https://
-    verify_ssl: true
-
-# Application service host/registration related details
-# Changing these values requires regeneration of the registration.
-appservice:
-    # The address that the homeserver can use to connect to this appservice.
-    address: {{ matrix_mautrix_telegram_appservice_address }}
-
-    # The hostname and port where this appservice should listen.
-    hostname: 0.0.0.0
-    port: 8080
-    # The maximum body size of appservice API requests (from the homeserver) in mebibytes
-    # Usually 1 is enough, but on high-traffic bridges you might need to increase this to avoid 413s
-    max_body_size: 1
-
-    # The full URI to the database. SQLite and Postgres are fully supported.
-    # Other DBMSes supported by SQLAlchemy may or may not work.
-    # Format examples:
-    #   SQLite:   sqlite:///filename.db
-    #   Postgres: postgres://username:password@hostname/dbname
-    database: sqlite:////data/mautrix-telegram.db
-
-    # Public part of web server for out-of-Matrix interaction with the bridge.
-    # Used for things like login if the user wants to make sure the 2FA password isn't stored in
-    # the HS database.
-    public:
-        # Whether or not the public-facing endpoints should be enabled.
-        enabled: true
-        # The prefix to use in the public-facing endpoints.
-        prefix: {{ matrix_mautrix_telegram_public_endpoint }}
-        # The base URL where the public-facing endpoints are available. The prefix is not added
-        # implicitly.
-        external: {{ matrix_mautrix_telegram_appservice_public_external }}
-
-    # Provisioning API part of the web server for automated portal creation and fetching information.
-    # Used by things like Dimension (https://dimension.t2bot.io/).
-    provisioning:
-        # Whether or not the provisioning API should be enabled.
-        enabled: false
-        # The prefix to use in the provisioning API endpoints.
-        prefix: /_matrix/provision/v1
-        # The shared secret to authorize users of the API.
-        # Set to "generate" to generate and save a new token.
-        shared_secret: generate
-
-    # The unique ID of this appservice.
-    id: telegram
-    # Username of the appservice bot.
-    bot_username: telegrambot
-    # Display name and avatar for bot. Set to "remove" to remove display name/avatar, leave empty
-    # to leave display name/avatar as-is.
-    bot_displayname: Telegram bridge bot
-    bot_avatar: mxc://maunium.net/tJCRmUyJDsgRNgqhOgoiHWbX
-
-    # Authentication tokens for AS <-> HS communication. Autogenerated; do not modify.
-    as_token: "This value is generated when generating the registration"
-    hs_token: "This value is generated when generating the registration"
-
-# Bridge config
-bridge:
-    # Localpart template of MXIDs for Telegram users.
-    # {userid} is replaced with the user ID of the Telegram user.
-    username_template: "telegram_{userid}"
-    # Localpart template of room aliases for Telegram portal rooms.
-    # {groupname} is replaced with the name part of the public channel/group invite link ( https://t.me/{} )
-    alias_template: "telegram_{groupname}"
-    # Displayname template for Telegram users.
-    # {displayname} is replaced with the display name of the Telegram user.
-    displayname_template: "{displayname} (Telegram)"
-
-    # Set the preferred order of user identifiers which to use in the Matrix puppet display name.
-    # In the (hopefully unlikely) scenario that none of the given keys are found, the numeric user
-    # ID is used.
-    #
-    # If the bridge is working properly, a phone number or an username should always be known, but
-    # the other one can very well be empty.
-    #
-    # Valid keys:
-    #   "full name"          (First and/or last name)
-    #   "full name reversed" (Last and/or first name)
-    #   "first name"
-    #   "last name"
-    #   "username"
-    #   "phone number"
-    displayname_preference:
-    - full name
-    - username
-    - phone number
-
-    # Show message editing as a reply to the original message.
-    # If this is false, message edits are not shown at all, as Matrix does not support editing yet.
-    edits_as_replies: false
-    # Highlight changed/added parts in edits. Requires lxml.
-    highlight_edits: false
-    # Whether or not Matrix bot messages (type m.notice) should be bridged.
-    bridge_notices: true
-    # Whether to bridge Telegram bot messages as m.notices or m.texts.
-    bot_messages_as_notices: true
-    # Maximum number of members to sync per portal when starting up. Other members will be
-    # synced when they send messages. The maximum is 10000, after which the Telegram server
-    # will not send any more members.
-    # Defaults to no local limit (-> limited to 10000 by server)
-    max_initial_member_sync: -1
-    # Whether or not to sync the member list in channels.
-    # If no channel admins have logged into the bridge, the bridge won't be able to sync the member
-    # list regardless of this setting.
-    sync_channel_members: true
-    # The maximum number of simultaneous Telegram deletions to handle.
-    # A large number of simultaneous redactions could put strain on your homeserver.
-    max_telegram_delete: 10
-    # Allow logging in within Matrix. If false, the only way to log in is using the out-of-Matrix
-    # login website (see appservice.public config section)
-    allow_matrix_login: true
-    # Use inline images instead of m.image to make rich captions possible.
-    # N.B. Inline images are not supported on all clients (e.g. Riot iOS).
-    inline_images: true
-    # Whether or not to bridge plaintext highlights.
-    # Only enable this if your displayname_template has some static part that the bridge can use to
-    # reliably identify what is a plaintext highlight.
-    plaintext_highlights: false
-    # Whether or not to make portals of publicly joinable channels/supergroups publicly joinable on Matrix.
-    public_portals: true
-    # Whether to send stickers as the new native m.sticker type or normal m.images.
-    # Old versions of Riot don't support the new type at all.
-    # Remember that proper sticker support always requires Pillow to convert webp into png.
-    native_stickers: true
-    # Whether or not to fetch and handle Telegram updates at startup from the time the bridge was down.
-    # WARNING: Probably buggy, might get stuck in infinite loop.
-    catch_up: false
-    # Whether or not to use /sync to get presence, read receipts and typing notifications when using
-    # your own Matrix account as the Matrix puppet for your Telegram account.
-    sync_with_custom_puppets: true
-
-    # Some config options related to Telegram message deduplication.
-    # The default values are usually fine, but some debug messages/warnings might recommend you
-    # change these.
-    deduplication:
-        # Whether or not to check the database if the message about to be sent is a duplicate.
-        pre_db_check: false
-        # The number of latest events to keep when checking for duplicates.
-        # You might need to increase this on high-traffic bridge instances.
-        cache_queue_length: 20
-
-    # The formats to use when sending messages to Telegram via the relay bot.
-    #
-    # Telegram doesn't have built-in emotes, so the m.emote format is also used for non-relaybot users.
-    #
-    # Available variables:
-    #   $sender_displayname    - The display name of the sender (e.g. Example User)
-    #   $sender_username       - The username (Matrix ID localpart) of the sender (e.g. exampleuser)
-    #   $sender_mxid           - The Matrix ID of the sender (e.g. @exampleuser:example.com)
-    #   $message               - The message content as HTML
-    message_formats:
-        m.text: "<b>$sender_displayname</b>: $message"
-        m.emote: "* <b>$sender_displayname</b> $message"
-        m.file: "<b>$sender_displayname</b> sent a file: $message"
-        m.image: "<b>$sender_displayname</b> sent an image: $message"
-        m.audio: "<b>$sender_displayname</b> sent an audio file: $message"
-        m.video: "<b>$sender_displayname</b> sent a video: $message"
-        m.location: "<b>$sender_displayname</b> sent a location: $message"
-
-    # The formats to use when sending state events to Telegram via the relay bot.
-    #
-    # Variables from `message_formats` that have the `sender_` prefix are available without the prefix.
-    # In name_change events, `$prev_displayname` is the previous displayname.
-    #
-    # Set format to an empty string to disable the messages for that event.
-    state_event_formats:
-        join: "<b>$displayname</b> joined the room."
-        leave: "<b>$displayname</b> left the room."
-        name_change: "<b>$prev_displayname</b> changed their name to <b>$displayname</b>"
-
-    # Filter rooms that can/can't be bridged. Can also be managed using the `filter` and
-    # `filter-mode` management commands.
-    #
-    # Filters do not affect direct chats.
-    # An empty blacklist will essentially disable the filter.
-    filter:
-        # Filter mode to use. Either "blacklist" or "whitelist".
-        # If the mode is "blacklist", the listed chats will never be bridged.
-        # If the mode is "whitelist", only the listed chats can be bridged.
-        mode: blacklist
-        # The list of group/channel IDs to filter.
-        list: []
-
-    # The prefix for commands. Only required in non-management rooms.
-    command_prefix: "!tg"
-
-    # Permissions for using the bridge.
-    # Permitted values:
-    #   relaybot - Only use the bridge via the relaybot, no access to commands.
-    #       user - Relaybot level + access to commands to create bridges.
-    #  puppeting - User level + logging in with a Telegram account.
-    #       full - Full access to use the bridge, i.e. previous levels + Matrix login.
-    #      admin - Full access to use the bridge and some extra administration commands.
-    # Permitted keys:
-    #        * - All Matrix users
-    #   domain - All users on that homeserver
-    #     mxid - Specific user
-    permissions:
-        '{{ matrix_mautrix_telegram_homeserver_domain }}': full
-
-    # Options related to the message relay Telegram bot.
-    relaybot:
-        # Whether or not to allow creating portals from Telegram.
-        authless_portals: false
-        # Whether or not to allow Telegram group admins to use the bot commands.
-        whitelist_group_admins: false
-        # Whether or not to ignore incoming events sent by the relay bot.
-        ignore_own_incoming_events: true
-        # List of usernames/user IDs who are also allowed to use the bot commands.
-        whitelist:
-
-# Telegram config
-telegram:
-    # Get your own API keys at https://my.telegram.org/apps
-    api_id: {{ matrix_mautrix_telegram_api_id }}
-    api_hash: {{ matrix_mautrix_telegram_api_hash }}
-    # (Optional) Create your own bot at https://t.me/BotFather
-    bot_token: disabled
-    # Telethon proxy configuration.
-    # You must install PySocks from pip for proxies to work.
-    proxy:
-        # Allowed types: disabled, socks4, socks5, http
-        type: disabled
-        # Proxy IP address and port.
-        address: 127.0.0.1
-        port: 1080
-        # Whether or not to perform DNS resolving remotely.
-        rdns: true
-        # Proxy authentication (optional).
-        username: ""
-        password: ""
-
-# Python logging configuration.
-#
-# See section 16.7.2 of the Python documentation for more info:
-# https://docs.python.org/3.6/library/logging.config.html#configuration-dictionary-schema
-logging:
-    version: 1
-    formatters:
-        precise:
-            format: "[%(asctime)s] [%(levelname)s@%(name)s] %(message)s"
-    handlers:
-        console:
-            class: logging.StreamHandler
-            formatter: precise
-    loggers:
-        mau:
-            level: DEBUG
-        telethon:
-            level: DEBUG
-        aiohttp:
-            level: INFO
-    root:
-        level: DEBUG
-        handlers: [console]

roles/matrix-bridge-mautrix-telegram/templates/systemd/matrix-mautrix-telegram.service.j2

@@ -17,9 +17,10 @@ ExecStartPre=/usr/bin/docker run --rm --name matrix-mautrix-telegram-db \
 			--log-driver=none \
 			--user={{ matrix_user_uid }}:{{ matrix_user_gid }} \
 			--cap-drop=ALL \
-			-v {{ matrix_mautrix_telegram_base_path }}:/data:z \
+			-v {{ matrix_mautrix_telegram_config_path }}:/config:z \
+			-v {{ matrix_mautrix_telegram_data_path }}:/data:z \
 			{{ matrix_mautrix_telegram_docker_image }} \
-			alembic -x config=/data/config.yaml upgrade head
+			alembic -x config=/config/config.yaml upgrade head
 
 # Intentional delay, so that the homeserver (we likely depend on) can manage to start.
 ExecStartPre=/bin/sleep 5
@@ -32,12 +33,13 @@ ExecStart=/usr/bin/docker run --rm --name matrix-mautrix-telegram \
 			{% if matrix_mautrix_telegram_container_http_host_bind_port %}
 			-p {{ matrix_mautrix_telegram_container_http_host_bind_port }}:8080 \
 			{% endif %}
-			-v {{ matrix_mautrix_telegram_base_path }}:/data:z \
+			-v {{ matrix_mautrix_telegram_config_path }}:/config:z \
+			-v {{ matrix_mautrix_telegram_data_path }}:/data:z \
 			{% for arg in matrix_mautrix_telegram_container_extra_arguments %}
 			{{ arg }} \
 			{% endfor %}
 			{{ matrix_mautrix_telegram_docker_image }} \
-			python3 -m mautrix_telegram -c /data/config.yaml
+			python3 -m mautrix_telegram -c /config/config.yaml
 
 ExecStop=-/usr/bin/docker kill matrix-mautrix-telegram
 ExecStop=-/usr/bin/docker rm matrix-mautrix-telegram