Slack bridge

The Slack bridge turns a screenshot link pasted in Slack, such as https://screen.corp.example/abcdef, into an image card. It works even when the Screenshotter server is on a private network that Slack cannot reach.

It is a small Go program. Its source is public at github.com/mkende/screenshotter_slack_bridge and it is shipped as a container image at ghcr.io/mkende/screenshotter-slack-bridge.

Configuration

Create the Slack app, get its two tokens, write the bridge config.

Deployment

Run it as a container or a systemd service, check it works, troubleshoot.

How it works

The bridge connects to Slack over Socket Mode, an outbound WebSocket, so it needs no public address of its own. When someone posts a link on one of the registered domains, Slack sends the event over that connection. The bridge fetches the image from the server over its own network, registers it with Slack as a remote file together with a preview image, and replaces the link with a card showing that preview.

  Slack ──(Socket Mode, outbound)──► bridge ──(private HTTP)──► screenshotter
    ▲                                  │
    └──(outbound HTTPS: Slack API)─────┘

  a reader clicking the card ──────────────────────────────► screenshotter
                                          (only works from inside your network)

Slack stores the preview and shows it to the people who can see the message. Clicking the card opens the screenshot’s page on your server, with the link to the page it was taken from, so the full-size image never leaves your network and the server needs no inbound path. The bridge never posts messages of its own. If a screenshot cannot be rendered, the link is left as is and the reason is logged.

Security

The bridge fetches screenshots without logging in, so the server must run with require_auth_to_view = false (the default): the image ID is the capability.
The preview image is stored in Slack, workspace-private and visible only to those who can read the message. It is registered per share, so a card carries no record of the other places the screenshot was posted.
By default anyone who can post in a channel the bridge watches can make it render any screenshot whose ID they know, including users with no network access to the server. Two user restrictions narrow this to workspace members or to a user group.