Add Pantalaimon support

This is actually authored by Julian Foad here
(https://lab.trax.im/matrix/matrix-docker-ansible-deploy), but was in
need of a rebase and various adjustments caused by huge playbook
refactoring that landed in the past months.

This rework is completely untested.

Fixes https://github.com/spantaleev/matrix-docker-ansible-deploy/issues/266

roles/custom/matrix-bot-draupnir/defaults/main.yml

@@ -37,15 +37,34 @@ matrix_bot_draupnir_systemd_required_services_list_custom: []
 # List of systemd services that matrix-bot-draupnir.service wants
 matrix_bot_draupnir_systemd_wanted_services_list: []
 
-# The access token for the bot user
+# Whether Draupnir should talk to the homeserver through Pantalaimon
+# If true, then other variables must be provided including pointing
+# `matrix_bot_draupnir_homeserver_url` to the Pantalaimon URL.
+matrix_bot_draupnir_pantalaimon_use: false
+
+# The access token for the bot user. Required when NOT using Pantalaimon.
+# (Otherwise provide `matrix_bot_draupnir_pantalaimon_username` and `matrix_bot_draupnir_pantalaimon_password` instead.)
 matrix_bot_draupnir_access_token: ""
 
+# User name and password for the bot. Required when using Pantalaimon.
+# (Otherwise provide `matrix_bot_draupnir_access_token` instead.)
+matrix_bot_draupnir_pantalaimon_username: "bot.draupnir"
+matrix_bot_draupnir_pantalaimon_password: ""
+
 # The room ID where people can use the bot. The bot has no access controls, so
 # anyone in this room can use the bot - secure your room!
 # This should be a room alias or room ID - not a matrix.to URL.
 # Note: draupnir is fairly verbose - expect a lot of messages from it.
 matrix_bot_draupnir_management_room: ""
 
+# Endpoint URL that Draupnir uses to interact with the matrix homeserver (client-server API).
+# Set this to the pantalaimon URL if you're using that.
+matrix_bot_draupnir_homeserver_url: ""
+
+# Endpoint URL that Draupnir could use to fetch events related to reports (client-server API and /_synapse/),
+# only set this to the public-internet homeserver client API URL, do NOT set this to the pantalaimon URL.
+matrix_bot_draupnir_raw_homeserver_url: ""
+
 # Disable Server ACL is used if you want to not give the bot the right to apply Server ACLs in rooms without complaints from the bot.
 # This setting is described the following way in the Configuration.
 #

roles/custom/matrix-bot-draupnir/tasks/validate_config.yml

@@ -2,9 +2,20 @@
 
 - name: Fail if required matrix-bot-draupnir variables are undefined
   ansible.builtin.fail:
-    msg: "The `{{ item }}` variable must be defined and have a non-null value."
+    msg: "The `{{ item.name }}` variable must be defined and have a non-null value."
   with_items:
-    - "matrix_bot_draupnir_access_token"
-    - "matrix_bot_draupnir_management_room"
-    - "matrix_bot_draupnir_container_network"
-  when: "vars[item] == '' or vars[item] is none"
+    - {'name': 'matrix_bot_draupnir_access_token', when: "{{ not matrix_bot_draupnir_pantalaimon_use }}"}
+    - {'name': 'matrix_bot_draupnir_management_room', when: true}
+    - {'name': 'matrix_bot_draupnir_container_network', when: true}
+    - {'name': 'matrix_bot_draupnir_homeserver_url', when: true}
+    - {'name': 'matrix_bot_draupnir_raw_homeserver_url', when: true}
+    - {'name': 'matrix_bot_draupnir_pantalaimon_username', when: "{{ matrix_bot_draupnir_pantalaimon_use }}"}
+    - {'name': 'matrix_bot_draupnir_pantalaimon_password', when: "{{ matrix_bot_draupnir_pantalaimon_use }}"}
+  when: "item.when | bool and (vars[item.name] == '' or vars[item.name] is none)"
+
+- name: Fail if inappropriate variables are defined
+  ansible.builtin.fail:
+    msg: "The `{{ item.name }}` variable must be undefined or have a null value."
+  with_items:
+    - {'name': 'matrix_bot_draupnir_access_token', when: "{{ matrix_bot_draupnir_pantalaimon_use }}"}
+  when: "item.when | bool and not (vars[item.name] == '' or vars[item.name] is none)"

roles/custom/matrix-bot-draupnir/templates/production.yaml.j2

@@ -1,32 +1,34 @@
 # Endpoint URL that Draupnir uses to interact with the matrix homeserver (client-server API),
 # set this to the pantalaimon URL if you're using that.
-homeserverUrl: "{{ matrix_homeserver_url }}"
+homeserverUrl: {{ matrix_bot_draupnir_homeserver_url | to_json }}
 
 # Endpoint URL that Draupnir could use to fetch events related to reports (client-server API and /_synapse/),
 # only set this to the public-internet homeserver client API URL, do NOT set this to the pantalaimon URL.
-rawHomeserverUrl: "{{ matrix_homeserver_url }}"
+rawHomeserverUrl: {{ matrix_bot_draupnir_raw_homeserver_url | to_json }}
 
 # Matrix Access Token to use, Draupnir will only use this if pantalaimon.use is false.
-accessToken: "{{ matrix_bot_draupnir_access_token }}"
+accessToken: {{ matrix_bot_draupnir_access_token | to_json }}
 
+{% if matrix_bot_draupnir_pantalaimon_use %}
 # Options related to Pantalaimon (https://github.com/matrix-org/pantalaimon)
-#pantalaimon:
-#  # Whether or not Draupnir will use pantalaimon to access the matrix homeserver,
-#  # set to `true` if you're using pantalaimon.
-#  #
-#  # Be sure to point homeserverUrl to the pantalaimon instance.
-#  #
-#  # Draupnir will log in using the given username and password once,
-#  # then store the resulting access token in a file under dataPath.
-#  use: false
-#
-#  # The username to login with.
-#  username: draupnir
-#
-#  # The password Draupnir will login with.
-#  #
-#  # After successfully logging in once, this will be ignored, so this value can be blanked after first startup.
-#  password: your_password
+pantalaimon:
+  # Whether or not Draupnir will use pantalaimon to access the matrix homeserver,
+  # set to `true` if you're using pantalaimon.
+  #
+  # Be sure to point homeserverUrl to the pantalaimon instance.
+  #
+  # Draupnir will log in using the given username and password once,
+  # then store the resulting access token in a file under dataPath.
+  use: true
+
+  # The username to login with.
+  username: {{ matrix_bot_draupnir_pantalaimon_username | to_json }}
+
+  # The password Draupnir will login with.
+  #
+  # After successfully logging in once, this will be ignored, so this value can be blanked after first startup.
+  password: {{ matrix_bot_draupnir_pantalaimon_password | to_json }}
+{% endif %}
 
 # The path Draupnir will store its state/data in, leave default ("/data/storage") when using containers.
 dataPath: "/data"
@@ -49,7 +51,7 @@ recordIgnoredInvites: false
 #
 # Note: By default, Draupnir is fairly verbose - expect a lot of messages in this room.
 # (see verboseLogging to adjust this a bit.)
-managementRoom: "{{ matrix_bot_draupnir_management_room }}"
+managementRoom: {{ matrix_bot_draupnir_management_room | to_json }}
 
 # Deprecated and will be removed in a future version.
 # Running with verboseLogging is unsupported.
@@ -77,7 +79,7 @@ noop: false
 
 # Whether or not Draupnir should apply `m.room.server_acl` events.
 # DO NOT change this to `true` unless you are very confident that you know what you are doing.
-disableServerACL: "{{ matrix_bot_draupnir_disable_server_acl }}"
+disableServerACL: {{ matrix_bot_draupnir_disable_server_acl | to_json }}
 
 # Whether Draupnir should check member lists quicker (by using a different endpoint),
 # keep in mind that enabling this will miss invited (but not joined) users.
@@ -161,7 +163,7 @@ commands:
 
   # The default reasons to be prompted with if the reason is missing from a ban command.
   ban:
-    defaultReasons: 
+    defaultReasons:
       - "spam"
       - "brigading"
       - "harassment"

roles/custom/matrix-pantalaimon/defaults/main.yml

@@ -0,0 +1,57 @@
+---
+# E2EE aware proxy daemon for matrix clients.
+# Project source code URL: https://github.com/matrix-org/pantalaimon
+
+matrix_pantalaimon_enabled: true
+
+matrix_pantalaimon_version: "0.10.5"
+
+matrix_pantalaimon_container_image_self_build: false
+matrix_pantalaimon_container_image_self_build_repo: "https://github.com/matrix-org/pantalaimon.git"
+matrix_pantalaimon_container_image_self_build_repo_version: "{{ 'main' if matrix_pantalaimon_version == 'latest' else matrix_pantalaimon_version }}"
+
+matrix_pantalaimon_docker_image: "{{ matrix_pantalaimon_docker_image_name_prefix }}matrixdotorg/pantalaimon:v{{ matrix_pantalaimon_version }}"
+matrix_pantalaimon_docker_image_name_prefix: "{{ 'localhost/' if matrix_pantalaimon_container_image_self_build else matrix_container_global_registry_prefix }}"
+matrix_pantalaimon_docker_image_force_pull: "{{ matrix_pantalaimon_docker_image.endswith(':latest') }}"
+
+matrix_pantalaimon_base_path: "{{ matrix_base_data_path }}/pantalaimon"
+matrix_pantalaimon_data_path: "{{ matrix_pantalaimon_base_path }}/data"
+matrix_pantalaimon_container_src_files_path: "{{ matrix_pantalaimon_base_path }}/container-src"
+
+# The base container network
+matrix_pantalaimon_container_network: ''
+
+# A list of additional container networks that the container would be connected to.
+# The role does not create these networks, so make sure they already exist.
+matrix_pantalaimon_container_additional_networks: "{{ matrix_pantalaimon_container_additional_networks_auto + matrix_pantalaimon_container_additional_networks_custom }}"
+matrix_pantalaimon_container_additional_networks_auto: []
+matrix_pantalaimon_container_additional_networks_custom: []
+
+# A list of extra arguments to pass to the container
+matrix_pantalaimon_container_extra_arguments: []
+
+# List of systemd services that matrix-pantalaimon.service depends on
+matrix_pantalaimon_systemd_required_services_list: "{{ matrix_pantalaimon_systemd_required_services_list_default + matrix_pantalaimon_systemd_required_services_list_auto + matrix_pantalaimon_systemd_required_services_list_custom }}"
+matrix_pantalaimon_systemd_required_services_list_default: ['docker.service']
+matrix_pantalaimon_systemd_required_services_list_auto: []
+matrix_pantalaimon_systemd_required_services_list_custom: []
+
+# List of systemd services that matrix-pantalaimon.service wants
+matrix_pantalaimon_systemd_wanted_services_list: "{{ matrix_pantalaimon_systemd_wanted_services_list_default + matrix_pantalaimon_systemd_wanted_services_list_auto + matrix_pantalaimon_systemd_wanted_services_list_custom }}"
+matrix_pantalaimon_systemd_wanted_services_list_default: []
+matrix_pantalaimon_systemd_wanted_services_list_auto: []
+matrix_pantalaimon_systemd_wanted_services_list_custom: []
+
+# Pantalaimon log level, case-insensitive (Error, Warning, Info, Debug)
+matrix_pantalaimon_log_level: Warning
+
+# Base URL where matrix-pantalaimon can reach your homeserver C-S API.
+# If the homeserver runs on the same machine, you may need to add its service to `matrix_pantalaimon_systemd_required_services_list`.
+matrix_pantalaimon_homeserver_url: ""
+
+# Default configuration template which covers the generic use case.
+# You can customize it by controlling the various variables inside it.
+#
+# For a more advanced customization, you can
+# completely replace this variable with your own template.
+matrix_pantalaimon_configuration: "{{ lookup('template', 'templates/pantalaimon.conf.j2') }}"

roles/custom/matrix-pantalaimon/tasks/install.yml

@@ -0,0 +1,67 @@
+---
+
+- name: Ensure matrix-pantalaimon paths exist
+  ansible.builtin.file:
+    path: "{{ item.path }}"
+    state: directory
+    mode: 0750
+    owner: "{{ matrix_user_username }}"
+    group: "{{ matrix_user_groupname }}"
+  with_items:
+    - {path: "{{ matrix_pantalaimon_base_path }}", when: true}
+    - {path: "{{ matrix_pantalaimon_data_path }}", when: true}
+    - {path: "{{ matrix_pantalaimon_container_src_files_path }}", when: "{{ matrix_pantalaimon_container_image_self_build }}"}
+  when: "item.when | bool"
+
+- name: Ensure matrix-pantalaimon config installed
+  ansible.builtin.copy:
+    content: "{{ matrix_pantalaimon_configuration }}"
+    dest: "{{ matrix_pantalaimon_data_path }}/pantalaimon.conf"
+    mode: 0644
+    owner: "{{ matrix_user_username }}"
+    group: "{{ matrix_user_groupname }}"
+
+- name: Ensure pantalaimon container image is pulled
+  community.docker.docker_image:
+    name: "{{ matrix_pantalaimon_docker_image }}"
+    source: "{{ 'pull' if ansible_version.major > 2 or ansible_version.minor > 7 else omit }}"
+    force_source: "{{ matrix_pantalaimon_docker_image_force_pull if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}"
+    force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else matrix_pantalaimon_docker_image_force_pull }}"
+  when: "not matrix_pantalaimon_container_image_self_build | bool"
+  register: result
+  retries: "{{ devture_playbook_help_container_retries_count }}"
+  delay: "{{ devture_playbook_help_container_retries_delay }}"
+  until: result is not failed
+
+- name: Ensure pantalaimon repository is present on self-build
+  ansible.builtin.git:
+    repo: "{{ matrix_pantalaimon_container_image_self_build_repo }}"
+    version: "{{ matrix_pantalaimon_container_image_self_build_repo_version }}"
+    dest: "{{ matrix_pantalaimon_container_src_files_path }}"
+    force: "yes"
+  become: true
+  become_user: "{{ matrix_user_username }}"
+  register: matrix_pantalaimon_git_pull_results
+  when: "matrix_pantalaimon_container_image_self_build | bool"
+
+- name: Ensure pantalaimon container image is built
+  community.docker.docker_image:
+    name: "{{ matrix_pantalaimon_docker_image }}"
+    source: build
+    force_source: "{{ matrix_pantalaimon_git_pull_results.changed }}"
+    build:
+      dockerfile: Dockerfile
+      path: "{{ matrix_pantalaimon_container_src_files_path }}"
+      pull: true
+  when: "matrix_pantalaimon_container_image_self_build | bool"
+
+- name: Ensure pantalaimon container network is created
+  community.general.docker_network:
+    name: "{{ matrix_pantalaimon_container_network }}"
+    driver: bridge
+
+- name: Ensure matrix-pantalaimon.service installed
+  ansible.builtin.template:
+    src: "{{ role_path }}/templates/systemd/matrix-pantalaimon.service.j2"
+    dest: "{{ devture_systemd_docker_base_systemd_path }}/matrix-pantalaimon.service"
+    mode: 0644

roles/custom/matrix-pantalaimon/tasks/main.yml

@@ -0,0 +1,20 @@
+---
+
+- tags:
+    - setup-all
+    - setup-pantalaimon
+    - install-all
+    - install-pantalaimon
+  block:
+    - when: matrix_pantalaimon_enabled | bool
+      ansible.builtin.include_tasks: "{{ role_path }}/tasks/validate_config.yml"
+
+    - when: matrix_pantalaimon_enabled | bool
+      ansible.builtin.include_tasks: "{{ role_path }}/tasks/install.yml"
+
+- tags:
+    - setup-all
+    - setup-pantalaimon
+  block:
+    - when: not matrix_pantalaimon_enabled | bool
+      ansible.builtin.include_tasks: "{{ role_path }}/tasks/uninstall.yml"

roles/custom/matrix-pantalaimon/tasks/uninstall.yml

@@ -0,0 +1,25 @@
+---
+
+- name: Check existence of matrix-pantalaimon service
+  ansible.builtin.stat:
+    path: "{{ devture_systemd_docker_base_systemd_path }}/matrix-pantalaimon.service"
+  register: matrix_pantalaimon_service_stat
+
+- when: matrix_pantalaimon_service_stat.stat.exists | bool
+  block:
+    - name: Ensure matrix-pantalaimon is stopped
+      ansible.builtin.service:
+        name: matrix-pantalaimon
+        state: stopped
+        enabled: false
+        daemon_reload: true
+
+    - name: Ensure matrix-pantalaimon.service doesn't exist
+      ansible.builtin.file:
+        path: "{{ devture_systemd_docker_base_systemd_path }}/matrix-pantalaimon.service"
+        state: absent
+
+    - name: Ensure matrix-pantalaimon paths don't exist
+      ansible.builtin.file:
+        path: "{{ matrix_pantalaimon_base_path }}"
+        state: absent

roles/custom/matrix-pantalaimon/tasks/validate_config.yml

@@ -0,0 +1,8 @@
+---
+
+- name: Fail if required variables are undefined
+  ansible.builtin.fail:
+    msg: "The `{{ item }}` variable must be defined and have a non-null value."
+  with_items:
+    - "matrix_pantalaimon_homeserver_url"
+  when: "vars[item] == '' or vars[item] is none"

roles/custom/matrix-pantalaimon/templates/pantalaimon.conf.j2

@@ -0,0 +1,10 @@
+[Default]
+LogLevel = {{ matrix_pantalaimon_log_level }}
+
+[homeserver]
+Homeserver = {{ matrix_pantalaimon_homeserver_url }}
+ListenAddress = 0.0.0.0
+ListenPort = 8009
+SSL = False
+UseKeyring = False
+IgnoreVerification = True

roles/custom/matrix-pantalaimon/templates/systemd/matrix-pantalaimon.service.j2

@@ -0,0 +1,46 @@
+#jinja2: lstrip_blocks: "True"
+[Unit]
+Description=Matrix Pantalaimon
+{% for service in matrix_pantalaimon_systemd_required_services_list %}
+Requires={{ service }}
+After={{ service }}
+{% endfor %}
+{% for service in matrix_pantalaimon_systemd_wanted_services_list %}
+Wants={{ service }}
+{% endfor %}
+DefaultDependencies=no
+
+[Service]
+Type=simple
+Environment="HOME={{ devture_systemd_docker_base_systemd_unit_home_path }}"
+ExecStartPre=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} kill matrix-pantalaimon 2>/dev/null || true'
+ExecStartPre=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} rm matrix-pantalaimon 2>/dev/null || true'
+
+ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} create \
+			--rm \
+			--name=matrix-pantalaimon \
+			--log-driver=none \
+			--user={{ matrix_user_uid }}:{{ matrix_user_gid }} \
+			--cap-drop=ALL \
+			--read-only \
+			--network={{ matrix_pantalaimon_container_network }} \
+			--mount type=bind,src={{ matrix_pantalaimon_data_path }},dst=/data \
+			{% for arg in matrix_pantalaimon_container_extra_arguments %}
+			{{ arg }} \
+			{% endfor %}
+			{{ matrix_pantalaimon_docker_image }}
+
+{% for network in matrix_pantalaimon_container_additional_networks %}
+ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} network connect {{ network }} matrix-pantalaimon
+{% endfor %}
+
+ExecStart={{ devture_systemd_docker_base_host_command_docker }} start --attach matrix-pantalaimon
+
+ExecStop=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} kill matrix-pantalaimon 2>/dev/null || true'
+ExecStop=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} rm matrix-pantalaimon 2>/dev/null || true'
+Restart=always
+RestartSec=30
+SyslogIdentifier=matrix-pantalaimon
+
+[Install]
+WantedBy=multi-user.target