matrix-docker-ansible-deploy
matrix-docker-ansible-deploy copied to clipboard
spantaleev
Feature request: Pantalaimon E2EE proxy
Is this a project that could be integrated in to the playbook? There is a preliminary dockerfile https://github.com/matrix-org/pantalaimon/issues/13, but I don't have much experience with it.
That would be a thing you run locally on your own computer, not on the server.
Ah OK, I had envisioned being able to connect to a server instance of the proxy to enable encryption for older or basic (read Pattle) mobile clients. I have looked more closely at Pantalaimon and realise this is not the imagined use case (there may be security holes to exposing it over the web.
I guess you could run it on the server but it would have to be very clear that it probably isn’t ready for that yet, may not be secure, and that you are allowing your homeserver operator to decrypt your messages.
Yes, probably best to keep it out of solutions like this project as it isn't really meant for deployment.
Putting it on the server certainly makes it much easier to use from any client, on any OS. It suddenly makes E2EE easily accessible to everyone.
Of course, it also means that you need to trust the server where Pantalaimon is running.. which is pretty much the same as not using E2EE at all. (unless I'm missing something about how it works..)
We could probably install Pantalaimon and put it somewhere on the matrix.DOMAIN virtual host (likely at https://matrix.DOMAIN/pantalaimon).
The question is:
- how well would it work for multiple users
- how ready is it for such public usage
- who's going to build a Docker image we could use ;)
Since I'm staying away from all things E2EE for the time being, I'm not sure I can be the one to implement and test all this.. But if someone else would like to have a go, I'd gladly help.
I think running pan as an entirely internal (docker network only) service to provide support for e2ee for bots like mjolnir and maubot etc would be really useful. I am dubious that there should be use for it which is outside the host it's running on (unless you have a well trusted network etc)
trust the server where Pantalaimon is running.. which is pretty much the same as not using E2EE at all.
I think there was a misunderstanding here. Not using E2EE requires trusting your server and all the other servers in your rooms. Using Pantalaimon (for a particular bot or client) requires trusting only the particular server(s) where Pantalaimon is running. (And your connection to it, if connecting a bot or client from outside the server.)
I need Pantalaimon to use Draupnir for moderation of encrypted rooms. Just a heads-up that I might consider making a playbook role. (No promises though.)
I made a Pantalaimon role. A merge-request for it is prepared in my fork in my own forge: https://lab.trax.im/matrix/matrix-docker-ansible-deploy/-/merge_requests/1
This has gone through one round of review by Slavi.