Compare commits

..

1 Commits

Author SHA1 Message Date
Alexander Whitestone
cc9d7705b6 feat(synapse): Matrix Phase 1 — Synapse homeserver deployment stack
Some checks failed
Forge CI / smoke-and-build (pull_request) Failing after 1m1s
Deploy Synapse on Ezra VPS with PostgreSQL backend, bot registration,
and management tooling.

Closes #272

Components:
- docker-compose.yml: Synapse + PostgreSQL 16 stack
- homeserver.yaml: Production config (registration disabled, rate limits, retention)
- setup.sh: One-shot deploy (generates secrets, starts stack, registers accounts, gets bot token)
- manage.sh: Day-to-day ops (status, restart, logs, backup, update, create-user, teardown)
- docs/synapse-deployment.md: Full deployment guide with Nginx TLS, DNS, troubleshooting

Security:
- Registration disabled by default
- Rate limiting on login/registration/messages
- Client API bound to localhost (Nginx proxy for public access)
- Secrets chmod 600, .gitignore'd
- Federation certificate verification enabled

Bot account auto-registered and access token acquired — credentials
written to synapse-credentials.env for hermes-agent integration.
2026-04-13 18:07:15 -04:00
12 changed files with 821 additions and 340 deletions

View File

@@ -4,7 +4,6 @@ from __future__ import annotations
import os
import re
from datetime import datetime
from typing import Any, Dict, Optional
from utils import is_truthy_value
@@ -183,7 +182,7 @@ def resolve_turn_route(user_message: str, routing_config: Optional[Dict[str, Any
"command": runtime.get("command"),
"args": list(runtime.get("args") or []),
},
"label": f"smart route \u2192 {route.get('model')} ({runtime.get('provider')})",
"label": f"smart route {route.get('model')} ({runtime.get('provider')})",
"signature": (
route.get("model"),
runtime.get("provider"),
@@ -193,151 +192,3 @@ def resolve_turn_route(user_message: str, routing_config: Optional[Dict[str, Any
tuple(runtime.get("args") or ()),
),
}
# ---------------------------------------------------------------------------
# Time-aware cron model routing
# ---------------------------------------------------------------------------
# During peak hours (user active), cron jobs use a cheaper model because the
# user is present to catch and correct errors. During off-peak hours (user
# absent), cron jobs use a stronger model because errors go uncorrected.
#
# Config (under smart_model_routing.cron_time_routing):
# enabled: true
# timezone: "America/New_York" # IANA timezone name (default: UTC)
# peak_hours:
# start: 9 # inclusive, 0-23
# end: 18 # exclusive, 0-23
# peak_model: # model to use during peak hours
# provider: openrouter
# model: xiaomi/mimo-v2-pro
# offpeak_model: # model to use during off-peak hours
# provider: openrouter
# model: anthropic/claude-sonnet-4
def _get_current_hour_in_tz(tz_name: str) -> int:
"""Return the current hour (0-23) in the given IANA timezone."""
try:
from zoneinfo import ZoneInfo
tz = ZoneInfo(tz_name)
except Exception:
try:
import pytz
tz = pytz.timezone(tz_name)
except Exception:
return datetime.utcnow().hour
return datetime.now(tz).hour
def _is_peak_hour(hour: int, peak_start: int, peak_end: int) -> bool:
"""Return True if *hour* falls within [peak_start, peak_end).
Handles wrap-around (e.g. start=22, end=6 means 22:00-05:59 is peak).
"""
if peak_start <= peak_end:
return peak_start <= hour < peak_end
else:
# Wraps midnight: e.g. 22-6 means 22,23,0,1,2,3,4,5
return hour >= peak_start or hour < peak_end
def resolve_cron_time_route(
routing_config: Optional[Dict[str, Any]],
) -> Optional[Dict[str, Any]]:
"""Return a time-aware model override for cron jobs.
Considers the current hour in the configured timezone and picks
between a peak-hours model (cheaper, user present) and an off-peak
model (stronger, user absent, errors go uncorrected).
Returns None when time-aware routing is disabled or misconfigured,
so the caller falls through to normal routing.
"""
cfg = routing_config or {}
cron_cfg = cfg.get("cron_time_routing") or {}
if not _coerce_bool(cron_cfg.get("enabled"), False):
return None
tz_name = str(cron_cfg.get("timezone", "UTC")).strip()
peak = cron_cfg.get("peak_hours") or {}
peak_start = _coerce_int(peak.get("start"), 9)
peak_end = _coerce_int(peak.get("end"), 18)
current_hour = _get_current_hour_in_tz(tz_name)
is_peak = _is_peak_hour(current_hour, peak_start, peak_end)
if is_peak:
model_cfg = cron_cfg.get("peak_model") or {}
reason = "cron_peak_hours"
else:
model_cfg = cron_cfg.get("offpeak_model") or {}
reason = "cron_offpeak_hours"
provider = str(model_cfg.get("provider") or "").strip().lower()
model = str(model_cfg.get("model") or "").strip()
if not provider or not model:
return None
return {
"provider": provider,
"model": model,
"base_url": model_cfg.get("base_url", ""),
"api_key_env": model_cfg.get("api_key_env", ""),
"routing_reason": reason,
"is_peak_hour": is_peak,
"hour": current_hour,
}
def resolve_cron_turn_route(
user_message: str,
routing_config: Optional[Dict[str, Any]],
primary: Dict[str, Any],
) -> Dict[str, Any]:
"""Resolve model route for a cron job turn with time-awareness.
Checks time-aware routing first (cron_time_routing), then falls
back to normal smart routing, then falls back to primary.
"""
# 1. Time-aware cron routing (peak vs off-peak)
time_route = resolve_cron_time_route(routing_config)
if time_route:
from hermes_cli.runtime_provider import resolve_runtime_provider
explicit_api_key = None
api_key_env = str(time_route.get("api_key_env") or "").strip()
if api_key_env:
explicit_api_key = os.getenv(api_key_env) or None
try:
runtime = resolve_runtime_provider(
requested=time_route.get("provider"),
explicit_api_key=explicit_api_key,
explicit_base_url=time_route.get("base_url"),
)
peak_label = "peak" if time_route.get("is_peak_hour") else "off-peak"
return {
"model": time_route.get("model"),
"runtime": {
"api_key": runtime.get("api_key"),
"base_url": runtime.get("base_url"),
"provider": runtime.get("provider"),
"api_mode": runtime.get("api_mode"),
"command": runtime.get("command"),
"args": list(runtime.get("args") or []),
},
"label": f"cron {peak_label} -> {time_route.get('model')} ({runtime.get('provider')})",
"signature": (
time_route.get("model"),
runtime.get("provider"),
runtime.get("base_url"),
runtime.get("api_mode"),
runtime.get("command"),
tuple(runtime.get("args") or ()),
),
}
except Exception:
pass # Fall through to normal routing
# 2. Normal smart routing (simple-turn cheap model)
return resolve_turn_route(user_message, routing_config, primary)

View File

@@ -87,21 +87,6 @@ model:
# cheap_model:
# provider: openrouter
# model: google/gemini-2.5-flash
# # Time-aware cron routing: pick model based on hour of day.
# # Peak hours = user present, cheaper model OK (they catch errors).
# # Off-peak = user absent, stronger model (errors go uncorrected).
# cron_time_routing:
# enabled: true
# timezone: "America/New_York" # IANA timezone (default: UTC)
# peak_hours:
# start: 9 # inclusive, 0-23
# end: 18 # exclusive, 0-23
# peak_model: # model during peak hours (user active)
# provider: openrouter
# model: xiaomi/mimo-v2-pro
# offpeak_model: # model during off-peak (user absent)
# provider: openrouter
# model: anthropic/claude-sonnet-4
# =============================================================================
# Git Worktree Isolation

View File

@@ -762,8 +762,8 @@ def run_job(job: dict) -> tuple[bool, str, str, Optional[str]]:
message = format_runtime_provider_error(exc)
raise RuntimeError(message) from exc
from agent.smart_model_routing import resolve_cron_turn_route
turn_route = resolve_cron_turn_route(
from agent.smart_model_routing import resolve_turn_route
turn_route = resolve_turn_route(
prompt,
smart_routing,
{
@@ -776,8 +776,6 @@ def run_job(job: dict) -> tuple[bool, str, str, Optional[str]]:
"args": list(runtime.get("args") or []),
},
)
if turn_route.get("label"):
logger.info("Job '%s': %s", job_name, turn_route["label"])
_agent_kwargs = _safe_agent_kwargs({
"model": turn_route["model"],

9
deploy/synapse/.gitignore vendored Normal file
View File

@@ -0,0 +1,9 @@
# Secrets — never commit
.env
synapse-credentials.env
# Backups
backups/
# Generated config backups
homeserver.yaml.bak

View File

@@ -0,0 +1,82 @@
# Synapse Homeserver — Docker Compose Stack
# Matrix Phase 1: Deploy Synapse on Ezra VPS
#
# Usage:
# cd deploy/synapse
# ./setup.sh # first-time deploy (generates config + keys)
# docker compose up -d # start
# docker compose logs -f # follow logs
# docker compose down # stop
#
# Secrets:
# Never commit .env to version control.
# setup.sh generates secrets automatically.
services:
synapse-db:
image: postgres:16-alpine
container_name: synapse-db
restart: unless-stopped
volumes:
- synapse_db:/var/lib/postgresql/data
environment:
POSTGRES_USER: synapse
POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?Set POSTGRES_PASSWORD in .env}
POSTGRES_INITDB_ARGS: "--encoding=UTF8 --lc-collate=C --lc-ctype=C"
healthcheck:
test: ["CMD-SHELL", "pg_isready -U synapse"]
interval: 10s
timeout: 5s
retries: 5
networks:
- synapse_net
logging:
driver: "json-file"
options:
max-size: "20m"
max-file: "3"
synapse:
image: matrixdotorg/synapse:latest
container_name: synapse
restart: unless-stopped
depends_on:
synapse-db:
condition: service_healthy
volumes:
- synapse_data:/data
env_file:
- .env
environment:
SYNAPSE_CONFIG_PATH: /data/homeserver.yaml
ports:
- "127.0.0.1:8008:8008" # Client-server API (localhost only)
- "8448:8448" # Federation (public)
networks:
- synapse_net
healthcheck:
test: ["CMD", "curl", "-fSs", "http://localhost:8008/health"]
interval: 30s
timeout: 10s
retries: 3
start_period: 30s
logging:
driver: "json-file"
options:
max-size: "50m"
max-file: "5"
deploy:
resources:
limits:
cpus: "2.0"
memory: 2G
reservations:
memory: 512M
volumes:
synapse_data:
synapse_db:
networks:
synapse_net:
driver: bridge

View File

@@ -0,0 +1,101 @@
# Synapse Homeserver Configuration
# Generated by setup.sh — edit with care.
#
# Docs: https://matrix-org.github.io/synapse/latest/usage/configuration/config_documentation.html
# Server name — your Matrix domain (e.g. matrix.example.com)
server_name: "SERVER_NAME_PLACEHOLDER"
# Signing key — generated by setup.sh
signing_key_path: "/data/signing.key"
# Trusted key servers (empty = trust only ourselves for our own keys)
trusted_key_servers: []
# Report stats to matrix.org (no for sovereignty)
report_stats: false
# Listeners
listeners:
- port: 8008
tls: false
type: http
x_forwarded: true
resources:
- names: [client, federation]
compress: false
# Database — PostgreSQL
database:
name: psycopg2
args:
user: synapse
password: "${POSTGRES_PASSWORD}"
database: synapse
host: synapse-db
cp_min: 5
cp_max: 10
# Media store
media_store_path: "/data/media_store"
# Upload limits
max_upload_size: "50M"
# URL previews (disable to reduce attack surface)
url_preview_enabled: false
# Enable room list publishing
enable_room_list_search: true
# Turn off public registration by default (create users via admin API)
enable_registration: false
enable_registration_without_verification: false
# Rate limiting
rc_message:
per_second: 0.2
burst_count: 10
rc_registration:
per_second: 0.1
burst_count: 3
rc_login:
address:
per_second: 0.05
burst_count: 2
account:
per_second: 0.05
burst_count: 2
failed_attempts:
per_second: 0.15
burst_count: 3
# Retention — keep messages for 90 days by default
retention:
enabled: true
default_policy:
min_lifetime: 1d
max_lifetime: 90d
# Logging
log_config: "/data/log.config"
# Metrics (optional — enable if running Prometheus)
enable_metrics: false
# Presence
use_presence: true
# Federation
federation_verify_certificates: true
federation_sender_instances: 1
# Appservice config directory
app_service_config_files: []
# Experimental features
experimental_features:
# MSC3440: Threading support
msc3440_enabled: true

33
deploy/synapse/log.config Normal file
View File

@@ -0,0 +1,33 @@
# Synapse logging configuration
# https://matrix-org.github.io/synapse/latest/usage/configuration/config_documentation.html#log_config
version: 1
formatters:
precise:
format: '%(asctime)s - %(name)s - %(lineno)d - %(levelname)s - %(request)s - %(message)s'
handlers:
console:
class: logging.StreamHandler
formatter: precise
level: INFO
stream: ext://sys.stdout
file:
class: logging.handlers.RotatingFileHandler
formatter: precise
filename: /data/homeserver.log
maxBytes: 104857600 # 100MB
backupCount: 3
level: INFO
loggers:
synapse.storage.SQL:
level: WARNING
synapse.http.client:
level: INFO
root:
level: INFO
handlers: [console, file]

131
deploy/synapse/manage.sh Executable file
View File

@@ -0,0 +1,131 @@
#!/usr/bin/env bash
# Synapse Homeserver — Management Utilities
# Usage: ./manage.sh <command>
#
# Commands:
# status Show container status and health
# restart Restart Synapse (preserves data)
# logs Tail Synapse logs
# create-user <username> <password> [admin]
# backup Create timestamped backup of data volumes
# update Pull latest Synapse image and recreate
# teardown Stop and remove everything (DESTRUCTIVE)
set -euo pipefail
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
cd "$SCRIPT_DIR"
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
CYAN='\033[0;36m'
NC='\033[0m'
info() { echo -e "${GREEN}[MANAGE]${NC} $*"; }
warn() { echo -e "${YELLOW}[WARN]${NC} $*"; }
error() { echo -e "${RED}[ERROR]${NC} $*"; exit 1; }
COMMAND="${1:-help}"
case "$COMMAND" in
status)
info "Container status:"
docker compose ps
echo ""
info "Synapse health:"
curl -sfS http://127.0.0.1:8008/health && echo "" || echo "Not responding"
echo ""
info "Disk usage:"
docker system df -v 2>/dev/null | grep -E "synapse|VOLUME" || true
;;
restart)
info "Restarting Synapse..."
docker compose restart synapse
info "Waiting for health check..."
sleep 5
curl -sfS http://127.0.0.1:8008/health && echo "" && info "Synapse is healthy" || warn "Not responding yet"
;;
logs)
shift
LINES="${1:-100}"
info "Tailing Synapse logs (last $LINES lines)..."
docker compose logs -f --tail="$LINES" synapse
;;
create-user)
USERNAME="${2:?Usage: manage.sh create-user <username> <password> [admin]}"
PASSWORD="${3:?Usage: manage.sh create-user <username> <password> [admin]}"
IS_ADMIN="${4:-false}"
info "Creating user @$USERNAME..."
ADMIN_FLAG=""
if [ "$IS_ADMIN" = "admin" ] || [ "$IS_ADMIN" = "true" ]; then
ADMIN_FLAG="--admin"
fi
docker compose exec -T synapse register_new_matrix_user \
http://localhost:8008 \
-c /data/homeserver.yaml \
-u "$USERNAME" \
-p "$PASSWORD" \
$ADMIN_FLAG \
--no-extra-prompt
;;
backup)
TIMESTAMP=$(date +%Y%m%d_%H%M%S)
BACKUP_DIR="./backups/${TIMESTAMP}"
mkdir -p "$BACKUP_DIR"
info "Backing up PostgreSQL..."
docker compose exec -T synapse-db pg_dump -U synapse > "${BACKUP_DIR}/synapse_db.sql"
info "Backing up Synapse data volume..."
docker run --rm \
-v synapse_data:/source:ro \
-v "$(pwd)/${BACKUP_DIR}:/backup" \
alpine tar czf /backup/synapse_data.tar.gz -C /source .
info "Backup complete: $BACKUP_DIR"
ls -lh "$BACKUP_DIR"
;;
update)
info "Pulling latest Synapse image..."
docker compose pull synapse
info "Recreating containers..."
docker compose up -d --force-recreate synapse
info "Waiting for health..."
sleep 10
curl -sfS http://127.0.0.1:8008/health && echo "" && info "Updated and healthy" || warn "Check logs"
;;
teardown)
echo -e "${RED}WARNING: This will stop and remove all Synapse containers and volumes.${NC}"
echo -e "${RED}ALL DATA WILL BE LOST. This cannot be undone.${NC}"
echo ""
read -p "Type 'yes-delete-everything' to confirm: " CONFIRM
if [ "$CONFIRM" = "yes-delete-everything" ]; then
info "Stopping containers..."
docker compose down -v
info "Removing volumes..."
docker volume rm synapse_data synapse_db 2>/dev/null || true
info "Teardown complete."
else
info "Aborted."
fi
;;
help|*)
echo "Synapse Homeserver Management"
echo ""
echo "Usage: ./manage.sh <command>"
echo ""
echo "Commands:"
echo " status Show container status and health"
echo " restart Restart Synapse"
echo " logs [lines] Tail Synapse logs (default: 100)"
echo " create-user <u> <p> [admin] Create a new Matrix user"
echo " backup Backup database + data volume"
echo " update Pull latest image and recreate"
echo " teardown Stop and remove everything (DESTRUCTIVE)"
;;
esac

211
deploy/synapse/setup.sh Executable file
View File

@@ -0,0 +1,211 @@
#!/usr/bin/env bash
# Synapse Homeserver — One-Shot Setup Script
# Matrix Phase 1: Deploy Synapse on Ezra VPS
#
# Usage:
# ./setup.sh <server_name> [admin_user] [admin_password]
#
# Example:
# ./setup.sh matrix.timmy-time.xyz hermes-bot 'secure-pass-123'
#
# What it does:
# 1. Generates .env with secrets
# 2. Prepares homeserver.yaml with correct server name
# 3. Generates signing key
# 4. Starts Synapse + PostgreSQL via Docker Compose
# 5. Waits for Synapse to be healthy
# 6. Registers admin user + bot account
# 7. Outputs Matrix credentials for hermes-agent
set -euo pipefail
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
cd "$SCRIPT_DIR"
# --- Colors ---
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
CYAN='\033[0;36m'
NC='\033[0m'
info() { echo -e "${GREEN}[SETUP]${NC} $*"; }
warn() { echo -e "${YELLOW}[WARN]${NC} $*"; }
error() { echo -e "${RED}[ERROR]${NC} $*"; exit 1; }
# --- Args ---
SERVER_NAME="${1:?Usage: $0 <server_name> [admin_user] [admin_password]}"
ADMIN_USER="${2:-timmy-admin}"
ADMIN_PASS="${3:-$(openssl rand -hex 16)}"
BOT_USER="${4:-hermes-bot}"
BOT_PASS="${5:-$(openssl rand -hex 16)}"
echo -e "${CYAN}"
echo "╔══════════════════════════════════════════════════╗"
echo "║ Synapse Homeserver — Matrix Phase 1 Deploy ║"
echo "╚══════════════════════════════════════════════════╝"
echo -e "${NC}"
info "Server name: $SERVER_NAME"
info "Admin user: @$ADMIN_USER:$SERVER_NAME"
info "Bot user: @$BOT_USER:$SERVER_NAME"
echo ""
# --- Preflight ---
info "Preflight checks..."
command -v docker >/dev/null 2>&1 || error "docker not found. Install Docker first."
command -v docker compose version >/dev/null 2>&1 || error "docker compose not found. Install Docker Compose plugin."
info "Docker: $(docker --version | head -1)"
info "Compose: $(docker compose version | head -1)"
# --- Generate .env ---
info "Generating .env..."
POSTGRES_PASSWORD=$(openssl rand -hex 24)
REGISTRATION_SECRET=$(openssl rand -hex 16)
cat > .env <<EOF
# Synapse deployment — generated $(date -u +%Y-%m-%dT%H:%M:%SZ)
# DO NOT COMMIT THIS FILE
POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
SYNAPSE_SERVER_NAME=${SERVER_NAME}
SYNAPSE_REPORT_STATS=no
REGISTRATION_SECRET=${REGISTRATION_SECRET}
EOF
chmod 600 .env
info ".env written with secure permissions"
# --- Prepare homeserver.yaml ---
info "Preparing homeserver.yaml..."
sed -i.bak "s/SERVER_NAME_PLACEHOLDER/${SERVER_NAME}/g" homeserver.yaml
rm -f homeserver.yaml.bak
info "Server name set to: $SERVER_NAME"
# --- Generate signing key ---
info "Generating signing key..."
# Synapse will generate its own key on first run if missing
# But we pre-create the data volume structure
docker volume create synapse_data >/dev/null 2>&1 || true
docker volume create synapse_db >/dev/null 2>&1 || true
# --- Start the stack ---
info "Starting Synapse + PostgreSQL..."
docker compose up -d
# --- Wait for Synapse to be healthy ---
info "Waiting for Synapse to start (up to 120s)..."
MAX_WAIT=120
ELAPSED=0
while [ $ELAPSED -lt $MAX_WAIT ]; do
if curl -sfS http://127.0.0.1:8008/health >/dev/null 2>&1; then
info "Synapse is healthy!"
break
fi
sleep 3
ELAPSED=$((ELAPSED + 3))
if [ $((ELAPSED % 15)) -eq 0 ]; then
info "Still waiting... (${ELAPSED}s)"
fi
done
if [ $ELAPSED -ge $MAX_WAIT ]; then
warn "Synapse did not respond within ${MAX_WAIT}s. Check logs:"
echo " docker compose logs synapse"
error "Aborting registration."
fi
# --- Register admin user ---
info "Registering admin user @$ADMIN_USER:$SERVER_NAME..."
docker compose exec -T synapse register_new_matrix_user \
http://localhost:8008 \
-c /data/homeserver.yaml \
-u "$ADMIN_USER" \
-p "$ADMIN_PASS" \
--admin \
--no-extra-prompt 2>&1 || {
# User might already exist if re-running
warn "Admin user registration returned non-zero (may already exist)"
}
# --- Register bot user ---
info "Registering bot user @$BOT_USER:$SERVER_NAME..."
docker compose exec -T synapse register_new_matrix_user \
http://localhost:8008 \
-c /data/homeserver.yaml \
-u "$BOT_USER" \
-p "$BOT_PASS" \
--no-admin \
--no-extra-prompt 2>&1 || {
warn "Bot user registration returned non-zero (may already exist)"
}
# --- Get bot access token ---
info "Acquiring bot access token..."
BOT_TOKEN_RESPONSE=$(curl -sfS -X POST "http://127.0.0.1:8008/_matrix/client/v3/login" \
-H 'Content-Type: application/json' \
-d "{
\"type\": \"m.login.password\",
\"identifier\": {
\"type\": \"m.id.user\",
\"user\": \"${BOT_USER}\"
},
\"password\": \"${BOT_PASS}\",
\"device_name\": \"Hermes Agent\"
}")
BOT_ACCESS_TOKEN=$(echo "$BOT_TOKEN_RESPONSE" | python3 -c "import sys,json; print(json.load(sys.stdin)['access_token'])" 2>/dev/null || echo "FAILED_TO_EXTRACT")
BOT_DEVICE_ID=$(echo "$BOT_TOKEN_RESPONSE" | python3 -c "import sys,json; print(json.load(sys.stdin)['device_id'])" 2>/dev/null || echo "UNKNOWN")
if [ "$BOT_ACCESS_TOKEN" = "FAILED_TO_EXTRACT" ]; then
warn "Could not extract bot access token automatically."
warn "Login manually: curl -X POST http://127.0.0.1:8008/_matrix/client/v3/login ..."
fi
# --- Write credentials file ---
CREDENTIALS_FILE="synapse-credentials.env"
cat > "$CREDENTIALS_FILE" <<EOF
# Synapse Credentials — generated $(date -u +%Y-%m-%dT%H:%M:%SZ)
# Add these to hermes-agent's ~/.hermes/.env
# Matrix integration
MATRIX_HOMESERVER=http://${SERVER_NAME}:8008
MATRIX_ACCESS_TOKEN=${BOT_ACCESS_TOKEN}
MATRIX_USER_ID=@${BOT_USER}:${SERVER_NAME}
MATRIX_DEVICE_ID=${BOT_DEVICE_ID}
MATRIX_ENCRYPTION=true
# Admin credentials (for user management)
SYNAPSE_ADMIN_USER=@${ADMIN_USER}:${SERVER_NAME}
SYNAPSE_ADMIN_PASSWORD=${ADMIN_PASS}
# Bot credentials
SYNAPSE_BOT_USER=@${BOT_USER}:${SERVER_NAME}
SYNAPSE_BOT_PASSWORD=${BOT_PASS}
EOF
chmod 600 "$CREDENTIALS_FILE"
info "Credentials written to: $CREDENTIALS_FILE"
# --- Summary ---
echo ""
echo -e "${GREEN}╔══════════════════════════════════════════════════╗${NC}"
echo -e "${GREEN}║ Synapse Deployed Successfully! ║${NC}"
echo -e "${GREEN}╚══════════════════════════════════════════════════╝${NC}"
echo ""
echo -e " Server: ${CYAN}https://${SERVER_NAME}${NC}"
echo -e " Client API: ${CYAN}http://127.0.0.1:8008${NC}"
echo -e " Federation: ${CYAN}https://${SERVER_NAME}:8448${NC}"
echo ""
echo -e " Admin: ${YELLOW}@${ADMIN_USER}:${SERVER_NAME}${NC}"
echo -e " Bot: ${YELLOW}@${BOT_USER}:${SERVER_NAME}${NC}"
echo -e " Bot Token: ${YELLOW}${BOT_ACCESS_TOKEN:0:20}...${NC}"
echo ""
echo -e " Credentials: ${CYAN}${SCRIPT_DIR}/${CREDENTIALS_FILE}${NC}"
echo ""
echo -e "${GREEN}Next steps:${NC}"
echo " 1. Point DNS: ${SERVER_NAME}$(curl -s ifconfig.me 2>/dev/null || echo '<VPS_IP>')"
echo " 2. Set up TLS: nginx/certbot reverse proxy for :8008 and :8448"
echo " 3. Copy credentials to hermes-agent: cp ${CREDENTIALS_FILE} ~/.hermes/.env"
echo " 4. Start hermes: hermes gateway --platform matrix"
echo ""
echo " Manage: docker compose logs -f | docker compose restart | docker compose down"
echo " Users: docker compose exec synapse register_new_matrix_user http://localhost:8008 -c /data/homeserver.yaml -u <user> -p <pass>"
echo ""

251
docs/synapse-deployment.md Normal file
View File

@@ -0,0 +1,251 @@
# Synapse Homeserver Deployment Guide
## Matrix Phase 1: Deploy Synapse on Ezra VPS
Part of [Epic #269: Matrix Integration — Sovereign Messaging for Timmy](https://forge.alexanderwhitestone.com/Timmy_Foundation/hermes-agent/issues/269).
## Architecture
```
┌─────────────────────────────────────────────────┐
│ Ezra VPS (143.198.27.163) │
│ │
│ ┌──────────┐ ┌─────────────────────────┐ │
│ │ Nginx │────▶│ Synapse (Docker) │ │
│ │ :443→8008│ │ Client API: localhost:8008│ │
│ │ :8448→8448│ │ Federation: 0.0.0.0:8448│ │
│ └──────────┘ └──────────┬──────────────┘ │
│ │ │
│ ┌────────▼──────────┐ │
│ │ PostgreSQL 16 │ │
│ │ (Docker volume) │ │
│ └───────────────────┘ │
│ │
│ ┌──────────────────────────────────────────┐ │
│ │ hermes-agent (gateway) │ │
│ │ MATRIX_HOMESERVER=http://localhost:8008 │ │
│ └──────────────────────────────────────────┘ │
└─────────────────────────────────────────────────┘
```
## Prerequisites
- Docker + Docker Compose plugin on Ezra VPS
- SSH access: `ssh root@143.198.27.163`
- DNS A record pointing to the VPS IP
- (Recommended) Nginx + Certbot for TLS termination
## Quick Start
```bash
# SSH into Ezra
ssh root@143.198.27.163
# Clone hermes-agent (if not present)
cd /root
git clone https://forge.alexanderwhitestone.com/Timmy_Foundation/hermes-agent.git
cd hermes-agent/deploy/synapse
# Deploy Synapse
chmod +x setup.sh
./setup.sh matrix.timmy-time.xyz
# This will:
# 1. Generate .env with database password
# 2. Prepare homeserver.yaml
# 3. Start Synapse + PostgreSQL via Docker Compose
# 4. Wait for health
# 5. Register admin + bot accounts
# 6. Acquire bot access token
# 7. Write synapse-credentials.env
```
## Step-by-Step
### 1. DNS Configuration
Point your Matrix domain to Ezra's IP:
```
Type Name Value
A matrix 143.198.27.163
```
Federation uses SRV records for port discovery, but direct `:8448` works without them.
### 2. Deploy Synapse
```bash
cd /root/hermes-agent/deploy/synapse
./setup.sh matrix.timmy-time.xyz hermes-bot 'your-secure-password'
```
Arguments:
| Arg | Default | Description |
|-----|---------|-------------|
| `server_name` | (required) | Matrix domain (e.g., `matrix.timmy-time.xyz`) |
| `admin_user` | `timmy-admin` | Admin account username |
| `admin_password` | (random) | Admin account password |
| `bot_user` | `hermes-bot` | Bot account username |
| `bot_password` | (random) | Bot account password |
### 3. TLS Termination (Nginx)
Install Nginx + Certbot:
```bash
apt install -y nginx certbot python3-certbot-nginx
# Client-server API
cat > /etc/nginx/sites-available/matrix <<'EOF'
server {
listen 443 ssl http2;
server_name matrix.timmy-time.xyz;
ssl_certificate /etc/letsencrypt/live/matrix.timmy-time.xyz/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/matrix.timmy-time.xyz/privkey.pem;
location / {
proxy_pass http://127.0.0.1:8008;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
client_max_body_size 50M;
}
}
server {
listen 8448 ssl http2;
server_name matrix.timmy-time.xyz;
ssl_certificate /etc/letsencrypt/live/matrix.timmy-time.xyz/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/matrix.timmy-time.xyz/privkey.pem;
location / {
proxy_pass http://127.0.0.1:8008;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
}
EOF
ln -sf /etc/nginx/sites-available/matrix /etc/nginx/sites-enabled/
nginx -t && systemctl reload nginx
# Get cert
certbot --nginx -d matrix.timmy-time.xyz
```
### 4. Wire Hermes Agent
Copy the generated credentials to hermes-agent's environment:
```bash
# From synapse-credentials.env, add to ~/.hermes/.env:
MATRIX_HOMESERVER=https://matrix.timmy-time.xyz
MATRIX_ACCESS_TOKEN=<from synapse-credentials.env>
MATRIX_USER_ID=@hermes-bot:matrix.timmy-time.xyz
MATRIX_DEVICE_ID=<from synapse-credentials.env>
MATRIX_ENCRYPTION=true
```
Then start the gateway:
```bash
hermes gateway --platform matrix
```
### 5. Verify
```bash
# Check Synapse health
curl -s https://matrix.timmy-time.xyz/_matrix/client/versions
# Check federation
curl -s https://matrix.timmy-time.xyz:8448/_matrix/federation/v1/version
# Check bot is connected
# (should appear online in Element or any Matrix client)
```
## Management
Use the management script for day-to-day operations:
```bash
cd /root/hermes-agent/deploy/synapse
./manage.sh status # container health
./manage.sh logs # tail logs
./manage.sh restart # restart Synapse
./manage.sh backup # backup DB + data
./manage.sh update # pull latest image
./manage.sh create-user alice 'password123'
./manage.sh create-user admin 'secret' admin
```
## Backups
```bash
./manage.sh backup
# Creates: backups/YYYYMMDD_HHMMSS/
# ├── synapse_db.sql (PostgreSQL dump)
# └── synapse_data.tar.gz (media store + keys)
```
Automate with cron:
```bash
# Daily backup at 3 AM
0 3 * * * cd /root/hermes-agent/deploy/synapse && ./manage.sh backup >> /var/log/synapse-backup.log 2>&1
```
## Troubleshooting
### Synapse won't start
```bash
docker compose logs synapse
# Common: PostgreSQL not ready. Wait for healthcheck.
```
### Bot can't connect
```bash
# Verify token is valid
curl -H "Authorization: Bearer $MATRIX_ACCESS_TOKEN" \
https://matrix.timmy-time.xyz/_matrix/client/v3/account/whoami
```
### Federation not working
```bash
# Check port 8448 is open
ss -tlnp | grep 8448
# Check firewall
ufw status
```
### High memory usage
```bash
# Check resource limits in docker-compose.yml
docker stats synapse
# Tune in homeserver.yaml: event_cache_size, caches
```
## Security Notes
- Registration is disabled by default (`enable_registration: false`)
- Rate limiting is enforced on login, registration, and messages
- Federation certificate verification is enabled
- `.env` and `synapse-credentials.env` are `chmod 600`
- Client API binds to `127.0.0.1` only (use Nginx for public access)
- Consider: firewall rules, fail2ban, regular backups
## References
- [Synapse Documentation](https://matrix-org.github.io/synapse/latest/)
- [Matrix Spec](https://spec.matrix.org/)
- [Epic #269: Matrix Integration](https://forge.alexanderwhitestone.com/Timmy_Foundation/hermes-agent/issues/269)
- [Issue #272: Deploy Synapse on Ezra](https://forge.alexanderwhitestone.com/Timmy_Foundation/hermes-agent/issues/272)
- [Hermes Matrix Setup Guide](docs/matrix-setup.md)

View File

@@ -299,13 +299,6 @@ DEFAULT_CONFIG = {
"max_simple_chars": 160,
"max_simple_words": 28,
"cheap_model": {},
"cron_time_routing": {
"enabled": False,
"timezone": "UTC",
"peak_hours": {"start": 9, "end": 18},
"peak_model": {},
"offpeak_model": {},
},
},
# Auxiliary model config — provider:model for each side task.

View File

@@ -1,164 +0,0 @@
"""Tests for time-aware cron model routing."""
from agent.smart_model_routing import (
_is_peak_hour,
resolve_cron_time_route,
resolve_cron_turn_route,
)
# ---------------------------------------------------------------------------
# _is_peak_hour
# ---------------------------------------------------------------------------
def test_peak_hour_within_normal_range():
assert _is_peak_hour(10, 9, 18) is True
assert _is_peak_hour(12, 9, 18) is True
assert _is_peak_hour(17, 9, 18) is True
def test_peak_hour_outside_normal_range():
assert _is_peak_hour(8, 9, 18) is False
assert _is_peak_hour(18, 9, 18) is False
assert _is_peak_hour(22, 9, 18) is False
assert _is_peak_hour(0, 9, 18) is False
def test_peak_hour_at_boundaries():
assert _is_peak_hour(9, 9, 18) is True # start inclusive
assert _is_peak_hour(18, 9, 18) is False # end exclusive
def test_peak_hour_wraps_midnight():
# 22-6 means peak from 22:00 to 05:59
assert _is_peak_hour(22, 22, 6) is True
assert _is_peak_hour(23, 22, 6) is True
assert _is_peak_hour(0, 22, 6) is True
assert _is_peak_hour(5, 22, 6) is True
assert _is_peak_hour(6, 22, 6) is False
assert _is_peak_hour(12, 22, 6) is False
assert _is_peak_hour(21, 22, 6) is False
# ---------------------------------------------------------------------------
# resolve_cron_time_route
# ---------------------------------------------------------------------------
_CRON_ROUTING_CFG = {
"cron_time_routing": {
"enabled": True,
"timezone": "UTC",
"peak_hours": {"start": 9, "end": 18},
"peak_model": {
"provider": "openrouter",
"model": "xiaomi/mimo-v2-pro",
},
"offpeak_model": {
"provider": "openrouter",
"model": "anthropic/claude-sonnet-4",
},
},
}
def test_returns_none_when_disabled():
cfg = {"cron_time_routing": {"enabled": False}}
assert resolve_cron_time_route(cfg) is None
def test_returns_none_when_no_config():
assert resolve_cron_time_route(None) is None
assert resolve_cron_time_route({}) is None
def test_returns_none_when_models_missing():
cfg = {
"cron_time_routing": {
"enabled": True,
"peak_model": {"provider": "", "model": ""},
"offpeak_model": {"provider": "", "model": ""},
}
}
assert resolve_cron_time_route(cfg) is None
def test_returns_route_with_hour_injection(monkeypatch):
"""Force hour=14 (peak) via _get_current_hour_in_tz patch."""
monkeypatch.setattr(
"agent.smart_model_routing._get_current_hour_in_tz",
lambda tz: 14,
)
result = resolve_cron_time_route(_CRON_ROUTING_CFG)
assert result is not None
assert result["model"] == "xiaomi/mimo-v2-pro"
assert result["is_peak_hour"] is True
assert result["hour"] == 14
assert result["routing_reason"] == "cron_peak_hours"
def test_returns_offpeak_route(monkeypatch):
monkeypatch.setattr(
"agent.smart_model_routing._get_current_hour_in_tz",
lambda tz: 3,
)
result = resolve_cron_time_route(_CRON_ROUTING_CFG)
assert result is not None
assert result["model"] == "anthropic/claude-sonnet-4"
assert result["is_peak_hour"] is False
assert result["hour"] == 3
assert result["routing_reason"] == "cron_offpeak_hours"
# ---------------------------------------------------------------------------
# resolve_cron_turn_route
# ---------------------------------------------------------------------------
_PRIMARY = {
"model": "anthropic/claude-opus-4",
"provider": "openrouter",
"base_url": "https://openrouter.ai/api/v1",
"api_mode": "chat_completions",
"api_key": "***",
}
def test_cron_turn_route_uses_time_awareness(monkeypatch):
monkeypatch.setattr(
"agent.smart_model_routing._get_current_hour_in_tz",
lambda tz: 2, # off-peak
)
monkeypatch.setattr(
"hermes_cli.runtime_provider.resolve_runtime_provider",
lambda **kw: {
"api_key": "test-key",
"base_url": "https://openrouter.ai/api/v1",
"provider": "openrouter",
"api_mode": "chat_completions",
"command": None,
"args": [],
},
)
result = resolve_cron_turn_route("check status", _CRON_ROUTING_CFG, _PRIMARY)
assert result["model"] == "anthropic/claude-sonnet-4"
assert "cron off-peak" in (result.get("label") or "")
def test_cron_turn_route_falls_back_to_primary_when_no_config():
result = resolve_cron_turn_route("check status", None, _PRIMARY)
assert result["model"] == "anthropic/claude-opus-4"
assert result["label"] is None # no smart routing match
def test_cron_turn_route_falls_back_on_runtime_error(monkeypatch):
"""If time-route runtime resolution fails, fall back to normal routing."""
monkeypatch.setattr(
"agent.smart_model_routing._get_current_hour_in_tz",
lambda tz: 2,
)
monkeypatch.setattr(
"hermes_cli.runtime_provider.resolve_runtime_provider",
lambda **kw: (_ for _ in ()).throw(RuntimeError("bad")),
)
result = resolve_cron_turn_route("check status", _CRON_ROUTING_CFG, _PRIMARY)
# Falls back to primary since the time-route runtime failed
assert result["model"] == "anthropic/claude-opus-4"