fix

mastodon-kanidm-sync.py

@@ -14,31 +14,32 @@ def getenv(name):
         print(f"[ERROR] Missing environment variable {name}. You should NOT run this script by hand, please use systemd mastodon-kanidm-sync.service.")
         exit(1)
 
-
 # Import configuration
 KANIDM_URL = getenv("KANIDM_URL")
 KANIDM_TOKEN = read_file(getenv("KANIDM_TOKEN_PATH")).strip()
 OWNER_USERNAME = getenv("OWNER_USERNAME")
+SLEEP_TIME = int(getenv("SLEEP_TIME"))
 
-# Fetch kanidm users list from userdata file
+def sync_mastodon():
-# Userdata file is json list with information about what users are configured by kanidm
+    # Fetch kanidm users list from userdata file
-try:
+    # Userdata file is json list with information about what users are configured by kanidm
+    try:
         USERDATA = read_file(getenv("USERDATA_FILE_PATH")).strip()
         userdata = json.loads(USERDATA)
         print("[INFO] ")
-except FileNotFoundError:
+    except FileNotFoundError:
         userdata = []
 
-# Load database
+    # Load database
-conn = ps.connect(
+    conn = ps.connect(
         dbname=getenv("POSTGRES_DBNAME"),
         user=getenv("POSTGRES_USER"),
         host=getenv("POSTGRES_HOST")
-)
+    )
 
-# Fetch current userdata from database
+    # Fetch current userdata from database
-cur = conn.cursor()
+    cur = conn.cursor()
-cur.execute('''
+    cur.execute('''
         SELECT identities.uid, users.id, user_roles.name
         FROM users
         JOIN identities
@@ -46,29 +47,29 @@ cur.execute('''
         LEFT JOIN user_roles
           ON users.role_id = user_roles.id;
         '''
-)
+    )
 
-state = cur.fetchall()
+    state = cur.fetchall()
 
-users = {}
+    users = {}
-for i in state:
+    for i in state:
         users[i[0]] = {
             "id": i[1],
             "role": i[2],
             "isKanidmUser": False
         }
 
-# Fetch Kanidm userdata
+    # Fetch Kanidm userdata
-kanidm_users_raw = requests.get(
+    kanidm_users_raw = requests.get(
         f"{KANIDM_URL}/v1/person",
         headers={
             "Authorization": f"Bearer {KANIDM_TOKEN}",
             "Content-Type": "application/json",
         },
         timeout=5,
-).json()
+    ).json()
 
-def give_role(uid, role, putUserdata = True):
+    def give_role(uid, role, putUserdata = True):
         if (uid not in userdata) and (putUserdata):
             userdata.append(uid)
         users[uid]["isKanidmUser"] = True
@@ -76,7 +77,7 @@ def give_role(uid, role, putUserdata = True):
         print(f"[INFO] {uid} is marked as {role}")
         
 
-for i in kanidm_users_raw:
+    for i in kanidm_users_raw:
         i = i["attrs"]
         for uid in i["name"]: # [user].attrs.name is a list
           if uid in users: # Don't apply anything for users who have no mastodon access (sp.mastodon.users) or didn't register
@@ -98,19 +99,19 @@ for i in kanidm_users_raw:
                 give_role(uid, None, False)
                 userdata.remove(uid)
 
-print("[DEBUG]", users)
+    print("[DEBUG]", users)
 
-# Fetch RoleIDs
+    # Fetch RoleIDs
-cur = conn.cursor()
+    cur = conn.cursor()
-cur.execute("SELECT id, name FROM user_roles;")
+    cur.execute("SELECT id, name FROM user_roles;")
 
-roles_raw = cur.fetchall()
+    roles_raw = cur.fetchall()
-roles = {}
+    roles = {}
-for i in roles_raw:
+    for i in roles_raw:
         roles[i[1]] = i[0]
 
-# Give roles
+    # Give roles
-for uid in users:
+    for uid in users:
         if not users[uid]["isKanidmUser"]:
             continue
         
@@ -124,19 +125,23 @@ for uid in users:
         print("[DEBUG] SQL:", sqlcommand)
         cur.execute(sqlcommand)
 
-conn.commit()
+    conn.commit()
-cur.close()
+    cur.close()
-conn.close()
+    conn.close()
 
-print("[INFO] Final userdata.json file content: ", userdata)
+    print("[INFO] Final userdata.json file content: ", userdata)
 
-def write_userdata(mode):
+    def write_userdata(mode):
         with open(getenv("USERDATA_FILE_PATH"), mode) as f:
             f.write(json.dumps(userdata))
             f.close()
 
-try:
+    try:
         write_userdata("w")
-except FileNotFoundError:
+    except FileNotFoundError:
         print("[INFO] userdata.json file doesn't exist. Creating it")
         write_userdata("x")
+
+while True:
+    sync_mastodon()
+    time.sleep(SLEEP_TIME)

module.nix

@@ -91,7 +91,7 @@ in
       enableUnixSocket = false;
       configureNginx = true;
       database.createLocally = true;
-      streamingProcesses = 3;
+      streamingProcesses = 2;
 
       smtp = {
         createLocally = false;
@@ -105,8 +105,7 @@ in
         port = 465;
       };
       extraConfig = {
-        # "SMTP_ENABLE_STARTTLS" = "never";
+        "SMTP_ENABLE_STARTTLS_AUTO" = "true"; # Simple NixOS MailServer doesn't allow connections without SSL
-        "SMTP_ENABLE_STARTTLS_AUTO" = "true";
         "SMTP_ENABLE_STARTTLS" = "always";
         "SMTP_TLS" = "true";
         "SMTP_SSL" = "true";
@@ -114,14 +113,7 @@ in
         "DISALLOW_UNAUTHENTICATED_API_ACCESS" = lib.boolToString cfg.dissallowUnauthenticatedAPI;
       };
     };
-    users.users.mastodon.isSystemUser = lib.mkForce false;
-    users.users.mastodon.isNormalUser = lib.mkForce true;
 
-    users.groups."email-users" = {};
-    users.users."noreply.mastodon" = {
-      isSystemUser = true;
-      group = "email-users";
-    };
     selfprivacy.emails."noreply.mastodon" = {
       hashedPasswordFile = secrets.hashedPasswordFile;
       systemdTargets = [ "mastodon-email-password-setup.service" ];
@@ -155,7 +147,6 @@ in
 
       services.mastodon-kanidm-sync = {
         after = [
-          # "mastodon.service" # TODO: ??
           "postgresql.service"
           "kanidm.service"
         ];
@@ -173,6 +164,7 @@ in
           POSTGRES_HOST = db.host;
           USERDATA_FILE_PATH = "/var/lib/mastodon/.userdata.json";
           OWNER_USERNAME = sp.username;
+          SLEEP_TIME = "30";
         };
         serviceConfig = {
           Slice = "mastodon.slice";