draupnir: enable Rust crypto so it can read commands in the encrypted management room #26

2026-10-13T01:34:11-04:00

jared commented

2026-10-13 01:34:11 -04:00

Why: the Management room is end-to-end encrypted, but Draupnir runs with experimentalRustCrypto: false and Pantalaimon off. It can post there, because its own messages are unencrypted, but it can't read anything sent to it, so commands are silently ignored.

Its last reply to a command was about 57 days ago. Since then it has only posted startup and flooding notices.
On 2026-10-13, !draupnir rooms add <dco-memes-minecraft> sent from Lotus (encrypted) got no response.
The same command sent unencrypted through the API worked at once: Draupnir reacted ✅ and joined the room.

Change: experimentalRustCrypto: true (keys stored under dataPath).

⚠ Merging deploys and restarts Draupnir (deploy/lxc110-draupnir.sh → systemctl restart draupnir). Do it when you can watch it:

Before: check that the live /opt/draupnir/config/production.yaml really has experimentalRustCrypto: false. The repo copy may lag behind the live one.
After the restart: Draupnir gets a fresh crypto device. Old encrypted history stays unreadable to it; new messages work once clients share keys with its new device. Test with !draupnir status in Management.
If it fails to start: journalctl -u draupnir. Revert this commit to go back.

Not merged by me.

🤖 Generated with Claude Code

https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5

**Why:** the Management room is end-to-end encrypted, but Draupnir runs with `experimentalRustCrypto: false` and Pantalaimon off. It can post there, because its own messages are unencrypted, but it can't read anything sent to it, so commands are silently ignored. - Its last reply to a command was about **57 days ago**. Since then it has only posted startup and flooding notices. - On 2026-10-13, `!draupnir rooms add <dco-memes-minecraft>` sent from Lotus (encrypted) got no response. - The same command sent **unencrypted** through the API worked at once: Draupnir reacted ✅ and joined the room. **Change:** `experimentalRustCrypto: true` (keys stored under `dataPath`). **⚠ Merging deploys and restarts Draupnir** (`deploy/lxc110-draupnir.sh` → `systemctl restart draupnir`). Do it when you can watch it: - **Before:** check that the live `/opt/draupnir/config/production.yaml` really has `experimentalRustCrypto: false`. The repo copy may lag behind the live one. - **After the restart:** Draupnir gets a fresh crypto device. Old encrypted history stays unreadable to it; new messages work once clients share keys with its new device. Test with `!draupnir status` in Management. - **If it fails to start:** `journalctl -u draupnir`. Revert this commit to go back. Not merged by me. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5

jared added 1 commit 2026-10-13 01:34:11 -04:00

draupnir: enable Rust crypto so it can read commands in the encrypted management room

Lint / Shell (shellcheck) (pull_request) Successful in 10s

Details

Lint / JS (eslint) (pull_request) Successful in 9s

Details

Lint / No secrets in webhook configs (pull_request) Successful in 4s

Details

Lint / Landing page is rendered (matrix (pull_request) Successful in 4s

Details

Lint / Python (ruff) (pull_request) Successful in 5s

Details

Lint / Python deps (pip-audit) (pull_request) Successful in 1m17s

Details

Lint / Secret scan (gitleaks) (pull_request) Successful in 10s

Details

Lint / Shell (shellcheck) (push) Successful in 10s

Details

Lint / JS (eslint) (push) Successful in 7s

Details

Lint / No secrets in webhook configs (push) Successful in 5s

Details

Lint / Landing page is rendered (matrix (push) Successful in 4s

Details

Lint / Python (ruff) (push) Successful in 8s

Details

Lint / Python deps (pip-audit) (push) Successful in 1m13s

Details

Lint / Secret scan (gitleaks) (push) Successful in 6s

Details

77e719183a

The management room is end-to-end encrypted, but Draupnir ran with
experimentalRustCrypto: false and Pantalaimon off, so it could post there
(its own messages are unencrypted) but never saw commands: its last reply
to a command was ~57 days ago, and `!draupnir rooms add …` sent from Lotus
on 2026-10-13 was ignored. The same command sent unencrypted worked at
once (✅, joined dco-memes-minecraft).

Merging deploys via lxc110-draupnir.sh, which restarts draupnir.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5

jared merged commit 72a3e3ba17 into main

2026-10-16 18:34:55 -04:00

jared referenced this pull request

2026-10-16 18:36:17 -04:00

Revert Draupnir Rust crypto (#26): it fails to start without a device-bound token #28

jared referenced this issue from a commit

2026-10-16 18:36:17 -04:00

Revert Draupnir Rust crypto (#26): it fails to start without a device-bound token

jared referenced this issue from a commit

2026-10-16 18:40:06 -04:00

Merge pull request 'Revert Draupnir Rust crypto (#26)' (#28) from revert-draupnir-rust-crypto into main

jared referenced this pull request