MollySocket Air-Gap Configuration with Docker Compose

In the previous post I talked about the reasons behind why I decided to set up my own private and air-gaped MollySocket Unified Push Gateway for Molly, a fork of the Signal messaging app. The official documentation is a bit difficult to read and also offers no details on how to host MollySocket with Docker Compose. So I worked on this with an LLM a bit and here’s a straight forward version of how to install MollySocket with Docker Compose:

Preconditions

The following setup requires the SunUp Unified Push app on Android that talks to Mozilla’s push service. Conversations and a Prosody XMPP server is another Unified Push setup for Android, but it doesn’t work with MollySocket’s air-gap configuration. This is because the Unified Push configuration by default changes once a day. Conversations can tell Molly about this, but Molly has no way to forward the changes to MollySocket in air gap mode. That’s not a bug, that’s part of being air gaped. See my previous post on what air gaped means in this context. Long story short: Air gaped = only works with a static unified Unified Push configuration used by the Sunup app on Android and Mozilla but not with Conversations as Unified Push frontend.

So let’s go:

Step 1 – The directory for the Docker Compose Project

Create the directory for the docker compose project and subsequently a directory in it for MollySocket’s data directory for things that must persist over restarts:

mkdir -p ~/mollysocket/mollysocket-data
cd ~/mollysocket
chmod 700 mollysocket-data

Step 2 – Generate the VAPID Key

One parameter that is required for the docker compose file below is a unique ID for this MollySocket instance. Create it with:

docker run --rm -v "$PWD/mollysocket-data:/data" -w /data \
  ghcr.io/mollyim/mollysocket:1 vapid gen

Step 3 – Create the Docker Compose File

Here’s how the docker-compose.yml file looks like. Put the key generated in step 2 into the MOLLY_VAPID_PRIVKEY parameter:

services:
  mollysocket:
    image: ghcr.io/mollyim/mollysocket:1
    container_name: mollysocket
    restart: unless-stopped
    working_dir: /data
    command: server
    volumes:
      - ./mollysocket-data:/data
    environment:
      - MOLLY_WEBSERVER=false
      - MOLLY_VAPID_PRIVKEY=THE-KEY-GENERATED-ABOVE
      - MOLLY_DB=/data/mollysocket.db
      # no spaces inside the JSON arrays
      - MOLLY_ALLOWED_UUIDS=["*"]
      - MOLLY_ALLOWED_ENDPOINTS=["https://updates.push.services.mozilla.com"]
      - RUST_LOG=debug

And that’s all! After a docker compose up, MollySocket is running. Don’t put ‘-d‘ at the end of the command yet, because seeing the log output is required for the next step. If things are working, MollySocket shows a 2D bardode on the shell in the log output that would normally be shown on MollySocket’s web interface.

Step 4 – Sunup on Android

• Install the SunUp app on Android and, if you haven’t already done so already, Molly.
• In Molly, go to the settings, select ‘notifications’ and set it to Unified Push. This will trigger the camera to scan the barcode.
• Scan the barcode that is presented in the Molly log on the shell. Note: Most shells have a black background, which prevents Molly from decoding the barcode. Change to a ‘white’ shell for a moment so the barcode shows up correctly with black blocks in front of a white background.

Step 5 – Getting Molly’s parameters to MollySocket

Molly would now send its configuration to MollySocket. However, since we are running in air-gaped mode, it can’t do this. So grab the connection parameters via the ‘get connection details’ menu entry, get it to your PC and then configure MollySocket on the shell with the following command:

docker compose exec mollysocket mollysocket connection add \
  xxxxxx......  \
  2 \
  'xxxx.............' \
  'https://updates.push.services.mozilla.com/wpush/v2/xxxxxxxxxxxxxxxxxxxxxxxxd.....'

There are 4 parameters in total, the last one being the the Mozilla URL. The last two can contain special characters, so they need to be between quotes.

Step 6 – Verify

If the command above has succeeded, MollySocket will send a test push message via the Mozilla Push Service to SumUp on the Android device which in turn will forward it to Molly. Molly will then show a notification that a test message has been received. Once that is shown, things are up and running.

Finally, stop MollySocket and restart it. I’m not sure why that is necessary, but I only got ‘real’ push messages when I sent messages to my Signal account from another device once I did that.

Final Words

OK, the configuration is not a no-brainer, but it is also not rocket science.