Matrix E2EE-Entschlüsselung via mautrix-go (goolm) integrieren

.env.example

@@ -9,3 +9,6 @@ DB_DSN=farmcal:CHANGE_ME@tcp(127.0.0.1:3306)/farmcal?parseTime=true
 # MATRIX_ACCESS_TOKEN=YOUR_MATRIX_ACCESS_TOKEN
 # MATRIX_ROOM_ID=!abcdefg12345:example.com
 # MATRIX_LIMIT=25
+# MATRIX_ENABLE_CRYPTO=1
+# MATRIX_PICKLE_KEY=CHANGE_ME_LONG_RANDOM
+# MATRIX_CRYPTO_STORE_PATH=/tmp/farmcal-matrix-crypto.db

Dockerfile

@@ -1,5 +1,6 @@
 FROM golang:1.23-alpine AS build
 WORKDIR /app
+RUN apk add --no-cache git
 
 COPY go.mod go.sum ./
 RUN go mod download
@@ -8,7 +9,7 @@ COPY cmd ./cmd
 COPY templates ./templates
 COPY static ./static
 
-RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -o /farmcal ./cmd/server
+RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -tags goolm -o /farmcal ./cmd/server
 
 FROM alpine:3.21
 WORKDIR /app

README.md

@@ -41,10 +41,14 @@ MATRIX_HOMESERVER_URL=https://matrix.example.com
 MATRIX_ACCESS_TOKEN=YOUR_MATRIX_ACCESS_TOKEN
 MATRIX_ROOM_ID=!abcdefg12345:example.com
 MATRIX_LIMIT=25
+MATRIX_ENABLE_CRYPTO=1
+MATRIX_PICKLE_KEY=LONG_RANDOM_SECRET
+MATRIX_CRYPTO_STORE_PATH=/tmp/farmcal-matrix-crypto.db
 ```
 
 - `MATRIX_ACCESS_TOKEN` sollte ein User-Token mit Leserechten fuer den Raum sein.
 - Wenn Matrix-Variablen fehlen, bleibt das Feature deaktiviert.
+- Fuer E2EE-Entschluesselung muss der Matrix-User im Raum sein und Schluessel fuer diesen Client verfuegbar haben.
 
 ## Start mit Docker Compose
 

cmd/server/matrix.go

@@ -10,6 +10,10 @@ import (
 	"strconv"
 	"strings"
 	"time"
+
+	"maunium.net/go/mautrix"
+	"maunium.net/go/mautrix/crypto/cryptohelper"
+	"maunium.net/go/mautrix/event"
 )
 
 type MatrixClient struct {
@@ -18,6 +22,7 @@ type MatrixClient struct {
 	RoomID        string
 	Limit         int
 	httpClient    *http.Client
+	crypto        *cryptohelper.CryptoHelper
 }
 
 func newMatrixClientFromEnv() *MatrixClient {
@@ -36,15 +41,43 @@ func newMatrixClientFromEnv() *MatrixClient {
 		limit = 100
 	}
 
-	return &MatrixClient{
+	m := &MatrixClient{
 		HomeserverURL: hs,
 		AccessToken:   token,
 		RoomID:        roomID,
 		Limit:         limit,
 		httpClient: &http.Client{
-			Timeout: 6 * time.Second,
+			Timeout: 8 * time.Second,
 		},
 	}
+
+	if readEnv("MATRIX_ENABLE_CRYPTO", "1") != "0" {
+		m.crypto = initMatrixCrypto(hs, token)
+	}
+	return m
+}
+
+func initMatrixCrypto(hs, token string) *cryptohelper.CryptoHelper {
+	cli, err := mautrix.NewClient(hs, "", token)
+	if err != nil {
+		return nil
+	}
+
+	if whoami, err := cli.Whoami(context.Background()); err == nil && whoami != nil {
+		cli.SetCredentials(whoami.UserID, token)
+	}
+
+	storePath := readEnv("MATRIX_CRYPTO_STORE_PATH", "/tmp/farmcal-matrix-crypto.db")
+	pickleKey := []byte(readEnv("MATRIX_PICKLE_KEY", token))
+
+	helper, err := cryptohelper.NewCryptoHelper(cli, pickleKey, storePath)
+	if err != nil {
+		return nil
+	}
+	if err = helper.Init(context.Background()); err != nil {
+		return nil
+	}
+	return helper
 }
 
 func (m *MatrixClient) FetchRecentMessages(ctx context.Context) ([]MatrixMessage, error) {
@@ -67,19 +100,11 @@ func (m *MatrixClient) FetchRecentMessages(ctx context.Context) ([]MatrixMessage
 	}
 	defer resp.Body.Close()
 	if resp.StatusCode < 200 || resp.StatusCode >= 300 {
-		return nil, errors.New("matrix sync failed: " + strconv.Itoa(resp.StatusCode))
+		return nil, errors.New("matrix messages failed: " + strconv.Itoa(resp.StatusCode))
 	}
 
 	var messagesResp struct {
-		Chunk []struct {
+		Chunk []json.RawMessage `json:"chunk"`
-			Type           string `json:"type"`
-			Sender         string `json:"sender"`
-			OriginServerTS int64  `json:"origin_server_ts"`
-			Content        struct {
-				MsgType string `json:"msgtype"`
-				Body    string `json:"body"`
-			} `json:"content"`
-		} `json:"chunk"`
 	}
 	if err := json.NewDecoder(resp.Body).Decode(&messagesResp); err != nil {
 		return nil, err
@@ -90,30 +115,69 @@ func (m *MatrixClient) FetchRecentMessages(ctx context.Context) ([]MatrixMessage
 
 	out := make([]MatrixMessage, 0, len(messagesResp.Chunk))
 	for i := len(messagesResp.Chunk) - 1; i >= 0; i-- {
-		ev := messagesResp.Chunk[i]
+		ev := &event.Event{}
-		switch ev.Type {
+		if err := json.Unmarshal(messagesResp.Chunk[i], ev); err != nil {
-		case "m.room.message":
+			continue
-			if ev.Content.MsgType != "m.text" && ev.Content.MsgType != "m.notice" {
+		}
-				continue
+		msg, ok := m.mapEventToMessage(ctx, ev)
-			}
+		if ok {
-			body := strings.TrimSpace(ev.Content.Body)
+			out = append(out, msg)
-			if body == "" {
-				continue
-			}
-			ts := time.UnixMilli(ev.OriginServerTS).Local().Format("02.01.2006 15:04")
-			out = append(out, MatrixMessage{
-				Sender:    ev.Sender,
-				Body:      body,
-				Timestamp: ts,
-			})
-		case "m.room.encrypted":
-			ts := time.UnixMilli(ev.OriginServerTS).Local().Format("02.01.2006 15:04")
-			out = append(out, MatrixMessage{
-				Sender:    ev.Sender,
-				Body:      "[Verschlüsselte Nachricht]",
-				Timestamp: ts,
-			})
 		}
 	}
 	return out, nil
 }
+
+func (m *MatrixClient) mapEventToMessage(ctx context.Context, ev *event.Event) (MatrixMessage, bool) {
+	ts := time.UnixMilli(ev.Timestamp).Local().Format("02.01.2006 15:04")
+	sender := shortMatrixSender(string(ev.Sender))
+
+	switch ev.Type {
+	case event.EventMessage:
+		if body, ok := extractBody(ev); ok {
+			return MatrixMessage{Sender: sender, Body: body, Timestamp: ts}, true
+		}
+		return MatrixMessage{}, false
+	case event.EventEncrypted:
+		if m.crypto != nil {
+			decrypted, err := m.crypto.Decrypt(ctx, ev)
+			if err == nil && decrypted != nil {
+				if body, ok := extractBody(decrypted); ok {
+					return MatrixMessage{Sender: sender, Body: body, Timestamp: ts}, true
+				}
+			}
+		}
+		return MatrixMessage{Sender: sender, Body: "[Verschlüsselte Nachricht]", Timestamp: ts}, true
+	default:
+		return MatrixMessage{}, false
+	}
+}
+
+func extractBody(ev *event.Event) (string, bool) {
+	if ev == nil {
+		return "", false
+	}
+	_ = ev.Content.ParseRaw(ev.Type)
+	msg := ev.Content.AsMessage()
+	if msg.MsgType != event.MsgText && msg.MsgType != event.MsgNotice {
+		return "", false
+	}
+	body := strings.TrimSpace(msg.Body)
+	if body == "" {
+		return "", false
+	}
+	return body, true
+}
+
+func shortMatrixSender(sender string) string {
+	s := strings.TrimSpace(sender)
+	if s == "" {
+		return sender
+	}
+	if strings.HasPrefix(s, "@") {
+		s = strings.TrimPrefix(s, "@")
+	}
+	if idx := strings.Index(s, ":"); idx > 0 {
+		return s[:idx]
+	}
+	return s
+}

docker-compose.yml

@@ -13,3 +13,6 @@ services:
       MATRIX_ACCESS_TOKEN: "${MATRIX_ACCESS_TOKEN:-}"
       MATRIX_ROOM_ID: "${MATRIX_ROOM_ID:-}"
       MATRIX_LIMIT: "${MATRIX_LIMIT:-25}"
+      MATRIX_ENABLE_CRYPTO: "${MATRIX_ENABLE_CRYPTO:-1}"
+      MATRIX_PICKLE_KEY: "${MATRIX_PICKLE_KEY:-}"
+      MATRIX_CRYPTO_STORE_PATH: "${MATRIX_CRYPTO_STORE_PATH:-/tmp/farmcal-matrix-crypto.db}"

go.mod

@@ -1,7 +1,28 @@
 module farmcal
 
-go 1.23
+go 1.23.0
+
+toolchain go1.23.12
 
 require github.com/go-sql-driver/mysql v1.8.1
 
-require filippo.io/edwards25519 v1.1.0 // indirect
+require maunium.net/go/mautrix v0.24.2
+
+require (
+	filippo.io/edwards25519 v1.1.0 // indirect
+	github.com/mattn/go-colorable v0.1.14 // indirect
+	github.com/mattn/go-isatty v0.0.20 // indirect
+	github.com/mattn/go-sqlite3 v1.14.28 // indirect
+	github.com/petermattis/goid v0.0.0-20250508124226-395b08cebbdb // indirect
+	github.com/rs/zerolog v1.34.0 // indirect
+	github.com/tidwall/gjson v1.18.0 // indirect
+	github.com/tidwall/match v1.1.1 // indirect
+	github.com/tidwall/pretty v1.2.1 // indirect
+	github.com/tidwall/sjson v1.2.5 // indirect
+	go.mau.fi/util v0.8.8 // indirect
+	golang.org/x/crypto v0.40.0 // indirect
+	golang.org/x/exp v0.0.0-20250711185948-6ae5c78190dc // indirect
+	golang.org/x/net v0.42.0 // indirect
+	golang.org/x/sys v0.34.0 // indirect
+	golang.org/x/text v0.27.0 // indirect
+)

go.sum

@@ -1,4 +1,58 @@
 filippo.io/edwards25519 v1.1.0 h1:FNf4tywRC1HmFuKW5xopWpigGjJKiJSV0Cqo0cJWDaA=
 filippo.io/edwards25519 v1.1.0/go.mod h1:BxyFTGdWcka3PhytdK4V28tE5sGfRvvvRV7EaN4VDT4=
+github.com/DATA-DOG/go-sqlmock v1.5.2 h1:OcvFkGmslmlZibjAjaHm3L//6LiuBgolP7OputlJIzU=
+github.com/DATA-DOG/go-sqlmock v1.5.2/go.mod h1:88MAG/4G7SMwSE3CeA0ZKzrT5CiOU3OJ+JlNzwDqpNU=
+github.com/coreos/go-systemd/v22 v22.5.0/go.mod h1:Y58oyj3AT4RCenI/lSvhwexgC+NSVTIJ3seZv2GcEnc=
+github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
+github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/go-sql-driver/mysql v1.8.1 h1:LedoTUt/eveggdHS9qUFC1EFSa8bU2+1pZjSRpvNJ1Y=
 github.com/go-sql-driver/mysql v1.8.1/go.mod h1:wEBSXgmK//2ZFJyE+qWnIsVGmvmEKlqwuVSjsCm7DZg=
+github.com/godbus/dbus/v5 v5.0.4/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
+github.com/mattn/go-colorable v0.1.13/go.mod h1:7S9/ev0klgBDR4GtXTXX8a3vIGJpMovkB8vQcUbaXHg=
+github.com/mattn/go-colorable v0.1.14 h1:9A9LHSqF/7dyVVX6g0U9cwm9pG3kP9gSzcuIPHPsaIE=
+github.com/mattn/go-colorable v0.1.14/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
+github.com/mattn/go-isatty v0.0.16/go.mod h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/yFXSvRLM=
+github.com/mattn/go-isatty v0.0.19/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
+github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
+github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
+github.com/mattn/go-sqlite3 v1.14.28 h1:ThEiQrnbtumT+QMknw63Befp/ce/nUPgBPMlRFEum7A=
+github.com/mattn/go-sqlite3 v1.14.28/go.mod h1:Uh1q+B4BYcTPb+yiD3kU8Ct7aC0hY9fxUwlHK0RXw+Y=
+github.com/petermattis/goid v0.0.0-20250508124226-395b08cebbdb h1:3PrKuO92dUTMrQ9dx0YNejC6U/Si6jqKmyQ9vWjwqR4=
+github.com/petermattis/goid v0.0.0-20250508124226-395b08cebbdb/go.mod h1:pxMtw7cyUw6B2bRH0ZBANSPg+AoSud1I1iyJHI69jH4=
+github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
+github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
+github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/rs/xid v1.6.0/go.mod h1:7XoLgs4eV+QndskICGsho+ADou8ySMSjJKDIan90Nz0=
+github.com/rs/zerolog v1.34.0 h1:k43nTLIwcTVQAncfCw4KZ2VY6ukYoZaBPNOE8txlOeY=
+github.com/rs/zerolog v1.34.0/go.mod h1:bJsvje4Z08ROH4Nhs5iH600c3IkWhwp44iRc54W6wYQ=
+github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA=
+github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
+github.com/tidwall/gjson v1.14.2/go.mod h1:/wbyibRr2FHMks5tjHJ5F8dMZh3AcwJEMf5vlfC0lxk=
+github.com/tidwall/gjson v1.18.0 h1:FIDeeyB800efLX89e5a8Y0BNH+LOngJyGrIWxG2FKQY=
+github.com/tidwall/gjson v1.18.0/go.mod h1:/wbyibRr2FHMks5tjHJ5F8dMZh3AcwJEMf5vlfC0lxk=
+github.com/tidwall/match v1.1.1 h1:+Ho715JplO36QYgwN9PGYNhgZvoUSc9X2c80KVTi+GA=
+github.com/tidwall/match v1.1.1/go.mod h1:eRSPERbgtNPcGhD8UCthc6PmLEQXEWd3PRB5JTxsfmM=
+github.com/tidwall/pretty v1.2.0/go.mod h1:ITEVvHYasfjBbM0u2Pg8T2nJnzm8xPwvNhhsoaGGjNU=
+github.com/tidwall/pretty v1.2.1 h1:qjsOFOWWQl+N3RsoF5/ssm1pHmJJwhjlSbZ51I6wMl4=
+github.com/tidwall/pretty v1.2.1/go.mod h1:ITEVvHYasfjBbM0u2Pg8T2nJnzm8xPwvNhhsoaGGjNU=
+github.com/tidwall/sjson v1.2.5 h1:kLy8mja+1c9jlljvWTlSazM7cKDRfJuR/bOJhcY5NcY=
+github.com/tidwall/sjson v1.2.5/go.mod h1:Fvgq9kS/6ociJEDnK0Fk1cpYF4FIW6ZF7LAe+6jwd28=
+go.mau.fi/util v0.8.8 h1:OnuEEc/sIJFhnq4kFggiImUpcmnmL/xpvQMRu5Fiy5c=
+go.mau.fi/util v0.8.8/go.mod h1:Y/kS3loxTEhy8Vill513EtPXr+CRDdae+Xj2BXXMy/c=
+golang.org/x/crypto v0.40.0 h1:r4x+VvoG5Fm+eJcxMaY8CQM7Lb0l1lsmjGBQ6s8BfKM=
+golang.org/x/crypto v0.40.0/go.mod h1:Qr1vMER5WyS2dfPHAlsOj01wgLbsyWtFn/aY+5+ZdxY=
+golang.org/x/exp v0.0.0-20250711185948-6ae5c78190dc h1:TS73t7x3KarrNd5qAipmspBDS1rkMcgVG/fS1aRb4Rc=
+golang.org/x/exp v0.0.0-20250711185948-6ae5c78190dc/go.mod h1:A+z0yzpGtvnG90cToK5n2tu8UJVP2XUATh+r+sfOOOc=
+golang.org/x/net v0.42.0 h1:jzkYrhi3YQWD6MLBJcsklgQsoAcw89EcZbJw8Z614hs=
+golang.org/x/net v0.42.0/go.mod h1:FF1RA5d3u7nAYA4z2TkclSCKh68eSXtiFwcWQpPXdt8=
+golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.34.0 h1:H5Y5sJ2L2JRdyv7ROF1he/lPdvFsd0mJHFw2ThKHxLA=
+golang.org/x/sys v0.34.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
+golang.org/x/text v0.27.0 h1:4fGWRpyh641NLlecmyl4LOe6yDdfaYNrGb2zdfo4JV4=
+golang.org/x/text v0.27.0/go.mod h1:1D28KMCvyooCX9hBiosv5Tz/+YLxj0j7XhWjpSUF7CU=
+gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
+gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+maunium.net/go/mautrix v0.24.2 h1:+AVT5kbcA/QuT5svrJKp4ivwoUmz+RRplMp3DnfpheI=
+maunium.net/go/mautrix v0.24.2/go.mod h1:1ut900w++eE9by9yqCR2dQdMqwsHwZG5L+1bKB1EvSA=

templates/dashboard.html

@@ -86,7 +86,6 @@
     <section class="card">
       <h2>Matrix-Chat</h2>
       {{if .MatrixEnabled}}
-        <p class="hint">Raum: <code>{{.MatrixRoomID}}</code></p>
         {{if .MatrixError}}
           <p class="muted">Chat konnte nicht geladen werden: {{.MatrixError}}</p>
         {{else if .MatrixMessages}}