Enable appservice mode for end-to-bridge encryption (MSC3202)

- Fix encryption with Synapse 1.141+ which blocks appservice users from /sync
- Set encryption.appservice=true in start.sh (all 3 occurrences)
- Bump version to 1.0.2

CHANGELOG.md

@@ -1,5 +1,15 @@
 # Changelog
 
+## 1.0.2 - 2026-01-16
+
+- Enable appservice mode for end-to-bridge encryption (MSC3202)
+- Fixes encryption with Synapse 1.141+ which blocks appservice users from /sync
+
+## 1.0.1 - 2026-01-15
+
+- Fixed start.sh permissions issue
+- Uses prebuilt binary from mau.dev CI for faster builds
+
 ## 1.0.0 - 2026-01-15
 
 - Initial Cloudron package release

CloudronManifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.0.0",
+  "version": "1.0.2",
   "upstreamVersion": "0.2512.0",
   "id": "dev.maunium.signal.cloudronapp",
   "title": "Matrix Signal Bridge",

Dockerfile.cloudron

@@ -25,8 +25,9 @@ RUN curl -L "https://mau.dev/mautrix/signal/-/jobs/artifacts/main/download?job=b
     && chmod +x /app/pkg/mautrix-signal \
     && rm /tmp/mautrix-signal.zip
 
-# Copy startup script
+# Copy startup script and make executable
 COPY start.sh /app/pkg/
+RUN chmod +x /app/pkg/start.sh
 
 # Set volumes and environment
 VOLUME /app/data

start.sh

@@ -78,7 +78,7 @@ if [ ! -f "$CONFIG_PATH" ]; then
             yq -i -y '.encryption.allow = true' "$CONFIG_PATH" || echo "=> ERROR: Could not configure encryption allow"
             yq -i -y '.encryption.default = false' "$CONFIG_PATH" || echo "=> ERROR: Could not configure encryption default"
             yq -i -y '.encryption.require = false' "$CONFIG_PATH" || echo "=> ERROR: Could not configure encryption require"
-            yq -i -y '.encryption.appservice = false' "$CONFIG_PATH" || echo "=> ERROR: Could not configure encryption appservice"
+            yq -i -y '.encryption.appservice = true' "$CONFIG_PATH" || echo "=> ERROR: Could not configure encryption appservice"
             yq -i -y '.encryption.plaintext_mentions = false' "$CONFIG_PATH" || echo "=> ERROR: Could not configure encryption plaintext_mentions"
             yq -i -y '.encryption.delete_keys.delete_outbound_on_ack = true' "$CONFIG_PATH" || echo "=> ERROR: Could not configure encryption delete_outbound_on_ack"
             yq -i -y '.encryption.delete_keys.dont_store_outbound = true' "$CONFIG_PATH" || echo "=> ERROR: Could not configure encryption dont_store_outbound"
@@ -173,7 +173,7 @@ else
                 yq -i -y '.encryption.allow = true' "$CONFIG_PATH" || echo "=> ERROR: Could not update encryption allow"
                 yq -i -y '.encryption.default = false' "$CONFIG_PATH" || echo "=> ERROR: Could not update encryption default"
                 yq -i -y '.encryption.require = false' "$CONFIG_PATH" || echo "=> ERROR: Could not update encryption require"
-                yq -i -y '.encryption.appservice = false' "$CONFIG_PATH" || echo "=> ERROR: Could not update encryption appservice"
+                yq -i -y '.encryption.appservice = true' "$CONFIG_PATH" || echo "=> ERROR: Could not update encryption appservice"
                 yq -i -y '.encryption.plaintext_mentions = false' "$CONFIG_PATH" || echo "=> ERROR: Could not update encryption plaintext_mentions"
                 yq -i -y '.encryption.delete_keys.delete_outbound_on_ack = true' "$CONFIG_PATH" || echo "=> ERROR: Could not update encryption delete_outbound_on_ack"
                 yq -i -y '.encryption.delete_keys.dont_store_outbound = true' "$CONFIG_PATH" || echo "=> ERROR: Could not update encryption dont_store_outbound"
@@ -202,7 +202,7 @@ else
         yq -i -y '.encryption.allow = true' "$CONFIG_PATH" || echo "=> ERROR: Could not update encryption allow"
         yq -i -y '.encryption.default = false' "$CONFIG_PATH" || echo "=> ERROR: Could not update encryption default"
         yq -i -y '.encryption.require = false' "$CONFIG_PATH" || echo "=> ERROR: Could not update encryption require"
-        yq -i -y '.encryption.appservice = false' "$CONFIG_PATH" || echo "=> ERROR: Could not update encryption appservice"
+        yq -i -y '.encryption.appservice = true' "$CONFIG_PATH" || echo "=> ERROR: Could not update encryption appservice"
         yq -i -y '.encryption.plaintext_mentions = false' "$CONFIG_PATH" || echo "=> ERROR: Could not update encryption plaintext_mentions"
         yq -i -y '.encryption.delete_keys.delete_outbound_on_ack = true' "$CONFIG_PATH" || echo "=> ERROR: Could not update encryption delete_outbound_on_ack"
         yq -i -y '.encryption.delete_keys.dont_store_outbound = true' "$CONFIG_PATH" || echo "=> ERROR: Could not update encryption dont_store_outbound"