feat(matrix): generate the appservice tokens in-cluster (REN-587)

as_token and hs_token come from an ESO Password generator (CreatedOnce)
instead of OpenBao, so no one has to seed them by hand. Synapse mounts
only the generated Secret and no longer depends on the OpenBao path;
OpenBao homelab/apps/matrix-bridge now holds only paperclip_api_key.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

kubernetes/apps/matrix/bridge.yaml

@@ -6,32 +6,47 @@
 # No volume: the bridge keeps its state in the bot's account data on Synapse.
 # No ingress: only Synapse talks to it (appservice transactions on :8080).
 #
-# OpenBao homelab/apps/matrix-bridge (seeded by the owner):
-#   as_token           random; bridge -> Synapse, MATRIX_AS_TOKEN
-#   hs_token           random; Synapse -> bridge, MATRIX_HS_TOKEN
-#   paperclip_api_key  Paperclip board key "matrix-bridge (board)" (REN-582)
-#
-# The same Secret carries the appservice registration that Synapse loads
-# from app_service_config_files (synapse.yaml), so both sides always get the
-# same tokens. Synapse cannot start without it: seed OpenBao before merge.
+# Secrets:
+#   matrix-bridge-tokens  as_token (bridge -> Synapse) and hs_token (Synapse
+#                         -> bridge), generated once in-cluster by ESO, plus
+#                         the appservice registration Synapse loads from
+#                         app_service_config_files (synapse.yaml). Both sides
+#                         read the same Secret, so the tokens cannot drift.
+#                         Deleting the Secret regenerates both; Reloader
+#                         restarts Synapse and the bridge.
+#   matrix-bridge         paperclip_api_key from OpenBao
+#                         homelab/apps/matrix-bridge: the Paperclip board key
+#                         "matrix-bridge (board)" (REN-582).
+apiVersion: generators.external-secrets.io/v1alpha1
+kind: Password
+metadata:
+  name: matrix-bridge-tokens
+  namespace: matrix
+spec:
+  length: 64
+  digits: 16
+  symbols: 0
+  allowRepeat: true
+  noUpper: false
+  secretKeys:
+    - as_token
+    - hs_token
+---
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
-  name: matrix-bridge
+  name: matrix-bridge-tokens
   namespace: matrix
 spec:
-  refreshInterval: 1h
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: openbao
+  # Generate once; Periodic would rotate the tokens every refresh.
+  refreshPolicy: CreatedOnce
   target:
-    name: matrix-bridge
+    name: matrix-bridge-tokens
     template:
       engineVersion: v2
       data:
         as_token: "{{ .as_token }}"
         hs_token: "{{ .hs_token }}"
-        paperclip_api_key: "{{ .paperclip_api_key }}"
         # Agent users are @agent_<urlKey>:matrix.renner.uno; the bot is
         # @paperclip:matrix.renner.uno.
         registration.yaml: |
@@ -48,8 +63,29 @@ spec:
             aliases: []
             rooms: []
   dataFrom:
-    - extract:
+    - sourceRef:
+        generatorRef:
+          apiVersion: generators.external-secrets.io/v1alpha1
+          kind: Password
+          name: matrix-bridge-tokens
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: matrix-bridge
+  namespace: matrix
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: openbao
+  target:
+    name: matrix-bridge
+  data:
+    - secretKey: paperclip_api_key
+      remoteRef:
         key: apps/matrix-bridge
+        property: paperclip_api_key
 ---
 apiVersion: apps/v1
 kind: Deployment
@@ -57,7 +93,7 @@ metadata:
   name: matrix-bridge
   namespace: matrix
   annotations:
-    secret.reloader.stakater.com/reload: matrix-bridge
+    secret.reloader.stakater.com/reload: matrix-bridge,matrix-bridge-tokens
   labels:
     app.kubernetes.io/name: matrix-bridge
     app.kubernetes.io/part-of: matrix
@@ -101,12 +137,12 @@ spec:
             - name: MATRIX_AS_TOKEN
               valueFrom:
                 secretKeyRef:
-                  name: matrix-bridge
+                  name: matrix-bridge-tokens
                   key: as_token
             - name: MATRIX_HS_TOKEN
               valueFrom:
                 secretKeyRef:
-                  name: matrix-bridge
+                  name: matrix-bridge-tokens
                   key: hs_token
             - name: PAPERCLIP_API_URL
               value: http://paperclip.paperclip.svc.cluster.local:3100

kubernetes/apps/matrix/synapse.yaml

@@ -120,7 +120,7 @@ metadata:
   namespace: matrix
   annotations:
     configmap.reloader.stakater.com/reload: synapse-config,mas-config
-    secret.reloader.stakater.com/reload: synapse-secrets,matrix-bridge
+    secret.reloader.stakater.com/reload: synapse-secrets,matrix-bridge-tokens
   labels:
     app.kubernetes.io/name: synapse
     app.kubernetes.io/part-of: matrix
@@ -305,7 +305,7 @@ spec:
           emptyDir: {}
         - name: appservice-matrix-bridge
           secret:
-            secretName: matrix-bridge
+            secretName: matrix-bridge-tokens
             items:
               - key: registration.yaml
                 path: registration.yaml