vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(#551): enable matrix e2ee -- add e2e-encryption feature, wire EncryptionSettings, flip tuwunel allow_encryption

Browse source
This commit is contained in:
damocles 2026-06-03 23:17:05 +02:00 • committed by mara
commit f51402a867
3 changed files with 11 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

1
Cargo.toml
View file

@ -63,5 +63,6 @@ matrix-sdk = { version = "0.14", default-features = false, features = [
"rustls-tls", "rustls-tls",
"sqlite", "sqlite",
"markdown", "markdown",
"e2e-encryption",
] } ] }
futures-util = "0.3" futures-util = "0.3"

9
hive-matrix-mcp/src/client.rs
View file

@ -9,6 +9,13 @@
//! UIAA flow already minted the token + user/device, hive-c0re just //! UIAA flow already minted the token + user/device, hive-c0re just
//! handed us the bearer in a file. matrix-sdk's `restore_session` with //! handed us the bearer in a file. matrix-sdk's `restore_session` with
//! a constructed `MatrixSession` skips the login flow entirely. //! a constructed `MatrixSession` skips the login flow entirely.
//!
//! E2EE is enabled via `with_encryption_settings(EncryptionSettings::default())`.
//! Crypto keys are persisted in the sqlite store under `state_dir`
//! (survives container restarts, lost on `--purge`). Cross-signing and
//! automatic key backup are deliberately left at their defaults (disabled)
//! for the first pass: bot accounts authenticated with a static bearer token
//! can't bootstrap cross-signing without MSC3967 on the server side.
use std::path::Path; use std::path::Path;
@ -16,6 +23,7 @@ use anyhow::{Context, Result, anyhow};
use matrix_sdk::{ use matrix_sdk::{
Client, SessionMeta, SessionTokens, Client, SessionMeta, SessionTokens,
authentication::matrix::MatrixSession, authentication::matrix::MatrixSession,
encryption::EncryptionSettings,
ruma::{OwnedDeviceId, OwnedUserId}, ruma::{OwnedDeviceId, OwnedUserId},
}; };
use serde::Deserialize; use serde::Deserialize;
@ -108,6 +116,7 @@ pub async fn build_and_restore(
let client = Client::builder() let client = Client::builder()
.homeserver_url(homeserver) .homeserver_url(homeserver)
.sqlite_store(state_dir, None) .sqlite_store(state_dir, None)
.with_encryption_settings(EncryptionSettings::default())
.build() .build()
.await .await
.with_context(|| format!("build matrix client for {homeserver}"))?; .with_context(|| format!("build matrix client for {homeserver}"))?;

3
nix/modules/hive-matrix.nix
View file

@ -403,8 +403,7 @@ in
# LoadCredential below copies the host file into a # LoadCredential below copies the host file into a
# 0400 dynamic-user-owned path; tuwunel reads from there. # 0400 dynamic-user-owned path; tuwunel reads from there.
registration_token_file = "/run/credentials/tuwunel.service/registration_token"; registration_token_file = "/run/credentials/tuwunel.service/registration_token";
# E2EE disabled in initial rollout; tracked in the issue tracker. allow_encryption = true;
allow_encryption = false;
# Tuwunel's default suffix is " 💕" — suppress it so agent # Tuwunel's default suffix is " 💕" — suppress it so agent
# display names are clean (just the agent name, no emoji). # display names are clean (just the agent name, no emoji).
new_user_displayname_suffix = ""; new_user_displayname_suffix = "";