Pantalaimon/E2BE configuration for Application Service bots

[MatteoCarlone]

Pantalaimon/E2BE configuration for Application Service bots

Context

I am building a Matrix Application Service bridge using matrix-appservice-bridge and running Matrix Synapse (Docker matrixdotorg/synapse:latest) with SYNAPSE_SERVER_NAME=localhost.

My goal is to enable End-to-Bridge Encryption (E2BE) for the application service bot, typically @bridge_bot:localhost.

Problem Encountered

When attempting to enable bridgeEncryption in the matrix-appservice-bridge configuration:

1. Direct connection to Synapse (port 8008):
   If bridgeEncryption.homeserverUrl is set to http://localhost:8008, I encounter NotImplementedError errors from Synapse's SyncRestServlet in the Synapse logs. This suggests Synapse's "latest" Docker image might not fully implement the necessary sync APIs for application services with E2EE.

2. Attempted connection via Pantalaimon (port 8004):
   Following a reference example that used homeserverUrl: "http://localhost:8004" for bridgeEncryption, I added a pantalaimon service to my docker-compose.yml (using matrixdotorg/pantalaimon:latest).
   My pantalaimon.conf was set up as follows:

[local-matrix]
Homeserver = http://localhost:8008
ListenAddress = 0.0.0.0
ListenPort = 8004
SSL = False
UseKeyring = False
IgnoreVerification = True

However, when bridgeEncryption.homeserverUrl in the bridge points to http://localhost:8004, Pantalaimon attempts to log in as @bridge_bot:localhost to Synapse and fails with MatrixHttpClient (REQ-X) { errcode: 'M_UNKNOWN_TOKEN', error: 'Unrecognised access token.' }.

Specific Question / Clarification Needed

Given that an application service bot like @bridge_bot:localhost authenticates with Synapse via hs_token and as_token (as defined in registration.yaml), and not a traditional password, the use of pantalaimon with a password parameter for such a bot seems conceptually incorrect and leads to authentication failures as stated also here

The reference example in this repo implies Pantalaimon can be used for E2BE with an appservice bot. Could you please clarify:

1. How is Pantalaimon intended to be configured and used with a matrix-appservice-bridge application service bot for E2BE?
2. How does Pantalaimon handle authentication/access to the homeserver for an application service bot, given that these bots do not have standard passwords for client login? Is there a specific configuration for Pantalaimon or a different authentication mechanism it uses for appservice users?

Any guidance on correctly setting up E2BE for appservice bots, especially considering the NotImplementedError when connecting directly and the authentication issue with Pantalaimon, would be greatly appreciated.

Thank you for your time and assistance.