Matt Johnson 44f0257376 docs: migrate Authentik (SSO keystone) to edge2 CT 105

- Authentik -> edge2 CT 105 (Postgres pg_dump/restore; SECRET_KEY carried verbatim; zero-downtime until ~2s cutover)
- Multi-block Caddy cutover: auth.echo6.co + notes.echo6.co outpost/forward_auth -> 100.64.0.36:9000
- runbook: add reboot tailscale-before-docker gotcha; clarify dnsmasq must NOT be repointed (points at Caddy host)
- source left stopped + intact on Contabo as cold rollback

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-06-18 05:49:07 +00:00

3 KiB

Raw Blame History

Hookshot Deployment Discovery

Generated: 2026-04-09 (Phase 6.0, Question 2)

Contabo Resource Availability

Memory

Total: 47 GB
Used: 11 GB
Available: 35 GB
Headroom: PLENTY for hookshot (~100 MB requirement)

Disk

Total: 968 GB
Used: 77 GB (8%)
Available: 892 GB
Headroom: PLENTY

CPU

Current idle is ~65%. TAK Server is the biggest consumer at 22%. Hookshot is single-threaded Node.js, minimal CPU.

Verdict: Hookshot can run on Contabo alongside existing services with no resource concerns.

Hookshot Version

Latest stable: 7.3.2 (released 2026-01-30)
Image: halfshot/matrix-hookshot:7.3.2 (Docker Hub, multi-arch)
Pin to exact tag, not :latest

Port Requirements

Purpose	Default Port	Status on Contabo
Appservice (HS→hookshot)	9993	AVAILABLE
Webhooks (inbound/outbound)	9000	CONFLICT — Authentik (127.0.0.1:9000) and TAK (100.64.0.1:9000)
Metrics (Prometheus)	9001	CONFLICT — TAK (100.64.0.1:9001)
Widgets	9002	AVAILABLE

Conflicts on default ports. Resolution options:

Use non-default ports: e.g., 9800 for webhooks, 9801 for metrics
Since hookshot outbound webhooks talk to a LOCAL receiver, any port works
Appservice port 9993 is fine (container-internal via matrix-net)

Appservice Registration Flow

Same pattern as mautrix-signal. Registration file (registration.yml) goes into Synapse's app_service_config_files list.

Registration file format:

id: matrix-hookshot
as_token: <random>
hs_token: <random>
namespaces:
  rooms: []
  users:
    - regex: "@_webhooks_.*:echo6\\.co"
      exclusive: true
  aliases: []
sender_localpart: hookshot
url: "http://matrix-hookshot:9993"
rate_limited: false

MAS bypass: CONFIRMED from Phase 3. Appservice tokens (as_token/hs_token) are handled natively by Synapse, bypassing MAS entirely. Same mechanism as mautrix-signal.

Docker Compose Snippet (NOT APPLIED)

  matrix-hookshot:
    image: halfshot/matrix-hookshot:7.3.2
    container_name: matrix-hookshot
    restart: unless-stopped
    depends_on:
      postgres:
        condition: service_healthy
    volumes:
      - ./hookshot:/data
    networks:
      - matrix-net
    # No ports: section — internal to matrix-net only
    # Appservice reachable at http://matrix-hookshot:9993 from synapse
    # Webhook listener on 9800 (non-default) for internal receiver

No host port mapping needed. hookshot communicates with:

Synapse via matrix-net (appservice transactions)
A local receiver (if built) via matrix-net or localhost

Dependencies

If encryption is enabled (relevant to Question 3):

Redis is REQUIRED
Could use Mailcow's existing Redis, or add a dedicated instance
Crypto store needs persistent volume

If encryption is NOT enabled:

No Redis needed
Minimal config

Resource Requirements

Per hookshot docs:

RAM: ~100 MB baseline
CPU: Minimal (single-threaded Node.js)
Disk: Negligible (crypto store if E2EE, otherwise just config)

3 KiB Raw Blame History