feat(mautrix-discord): add double pupetting

kubernetes/apps/matrix/mautrix-discord/app/externalsecret.yaml

@@ -25,6 +25,12 @@ spec:
             items:
               - key: registration.yaml
                 templateAs: Values
+        - target: Data
+          configMap:
+            name: mautrix-discord-base-config
+            items:
+              - key: double-puppet-registration.yaml
+                templateAs: Values
   dataFrom:
     - extract:
         key: matrix/mautrix-bridge

kubernetes/apps/matrix/mautrix-discord/app/kustomization.yaml

@@ -10,5 +10,6 @@ configMapGenerator:
     files:
       - config.yaml=./resources/config.yaml
       - registration.yaml=./resources/registration.yaml
+      - double-puppet-registration.yaml=./resources/double-puppet-registration.yaml
 generatorOptions:
   disableNameSuffixHash: true

kubernetes/apps/matrix/mautrix-discord/app/resources/config.yaml

@@ -190,7 +190,7 @@ bridge:
       fps: 25 # only for webm, webp and gif (2, 5, 10, 20 or 25 recommended)
   # Servers to always allow double puppeting from
   double_puppet_server_map:
-    example.com: https://example.com
+    ${SECRET_DOMAIN}: https://matrix.${SECRET_DOMAIN}
   # Allow using double puppeting from any server with a valid client .well-known file.
   double_puppet_allow_discovery: false
   # Shared secrets for https://github.com/devture/matrix-synapse-shared-secret-auth
@@ -199,7 +199,7 @@ bridge:
   # instead of users having to find an access token and run `login-matrix`
   # manually.
   login_shared_secret_map:
-    example.com: foobar
+    ${SECRET_DOMAIN}: "as_token:{{ .DOUBLE_PUPPET_AS_TOKEN }}"
 
   # The prefix for commands. Only required in non-management rooms.
   command_prefix: '!discord'

kubernetes/apps/matrix/mautrix-discord/app/resources/double-puppet-registration.yaml

@@ -0,0 +1,22 @@
+---
+# The ID doesn't really matter, put whatever you want.
+id: doublepuppet
+# The URL is intentionally left empty (null), as the homeserver shouldn't
+# push events anywhere for this extra appservice. If you use a
+# non-spec-compliant server, you may need to put some fake URL here.
+url:
+# Generate random strings for these three fields. Only the as_token really
+# matters, hs_token is never used because there's no url, and the default
+# user (sender_localpart) is never used either.
+as_token: {{ .DOUBLE_PUPPET_AS_TOKEN }}
+hs_token: {{ .DOUBLE_PUPPET_HS_TOKEN }}
+sender_localpart: {{ .DOUBLE_PUPPET_LOCAL_PART }}
+# Bridges don't like ratelimiting. This should only apply when using the
+# as_token, normal user tokens will still be ratelimited.
+rate_limited: false
+namespaces:
+  users:
+    # Replace your\.domain with your server name (escape dots for regex)
+    - regex: '@.*:${SECRET_DOMAIN/./\\.}'
+      # This must be false so the appservice doesn't take over all users completely.
+      exclusive: false