60 lines
3.3 KiB
Text
60 lines
3.3 KiB
Text
# /etc/morphit/matrix-bot.env
|
|
#
|
|
# Canonical example for the morphit-matrix-bot service. Copy to
|
|
# /etc/morphit/matrix-bot.env (mode 0600, owned by morphit-matrix-bot)
|
|
# and edit values. Required values are flagged [REQUIRED].
|
|
#
|
|
# The bot tails systemd journals for the morphit-* services and
|
|
# forwards classifier-rated alerts to a Matrix DM. See
|
|
# `apps/matrix-bot/src/config.ts` for the authoritative schema +
|
|
# `docs/OPERATIONS.md §42` for the operator setup walkthrough.
|
|
|
|
# ─── Required ────────────────────────────────────────────────────
|
|
|
|
# The bot's Matrix homeserver URL (full URL with scheme).
|
|
# Default: https://matrix.org (Element's flagship homeserver).
|
|
# If you run a self-hosted homeserver, set to its URL.
|
|
MORPHIT_MATRIX_BOT_HOMESERVER=https://matrix.org
|
|
|
|
# [REQUIRED] Access token for the bot's Matrix account. Generate
|
|
# from your Matrix client (Element: Settings → Help & About →
|
|
# Advanced → Access Token). KEEP SECRET — token grants full
|
|
# access to the bot account. Store in /etc/morphit/matrix-bot.env
|
|
# (mode 0600) or load via systemd-creds.
|
|
MORPHIT_MATRIX_BOT_ACCESS_TOKEN=syt_...
|
|
|
|
# [REQUIRED] Comma-separated MXIDs to DM alerts to. Multiple
|
|
# recipients supported for vacation coverage (your backup operator
|
|
# goes in the list too). MUST be MXIDs (`@user:server`), NEVER
|
|
# room aliases (`#room:server`) — sending alerts to a public room
|
|
# leaks security telemetry to anyone in that room. The bot
|
|
# refuses to start if any value here isn't a well-formed MXID.
|
|
MORPHIT_MATRIX_BOT_ALERT_MXID=@you:matrix.org,@backup:matrix.org
|
|
|
|
# ─── Optional with defaults ──────────────────────────────────────
|
|
|
|
# Comma-separated systemd units to tail. Default covers all
|
|
# morphit-* services and the host-monitor stack. If you set this
|
|
# you REPLACE the full list (no append behavior); copy the default
|
|
# and edit if you only want to add units.
|
|
# MORPHIT_MATRIX_BOT_JOURNALCTL_UNITS=morphit-indexer.service,morphit-relay.service,morphit-host-monitor.service,morphit-smartctl-monitor.service,morphit-fail2ban-monitor.service,morphit-mdadm-monitor.service,morphit-dmesg-monitor.service,morphit-trivy-monitor.service,morphit-postfix-monitor.service,morphit-certbot-monitor.service,morphit-apt-monitor.service,morphit-compose-monitor.service,morphit-systemd-monitor.service,morphit-journald-monitor.service,morphit-release-monitor.service
|
|
|
|
# Path to SQLite state DB. Used to persist rate-limit windows +
|
|
# digest accumulation across restarts. Default works with the
|
|
# packaged systemd unit; only change if you customize the state
|
|
# directory.
|
|
# MORPHIT_MATRIX_BOT_STATE_DB=/var/lib/morphit-matrix-bot/state.db
|
|
|
|
# TCP port the bot binds for systemd healthcheck. Loopback only;
|
|
# nothing user-facing. Default: 9876.
|
|
# MORPHIT_MATRIX_BOT_HEALTHCHECK_PORT=9876
|
|
|
|
# Daily digest send time in UTC ("HH:MM" 24-hour format).
|
|
# Default: 09:00 UTC (5am EST winter / 2am PST winter). Adjust
|
|
# to your timezone.
|
|
# MORPHIT_MATRIX_BOT_DIGEST_SEND_TIME_UTC=09:00
|
|
|
|
# Dry-run mode for staging. When true, the bot reads journalctl
|
|
# and classifies events but doesn't actually post to Matrix; logs
|
|
# what it WOULD have sent. Default: false (live posting).
|
|
# MORPHIT_MATRIX_BOT_DRY_RUN=true
|