Add Pantalaimon support

This is actually authored by Julian Foad here
(https://lab.trax.im/matrix/matrix-docker-ansible-deploy), but was in
need of a rebase and various adjustments caused by huge playbook
refactoring that landed in the past months.

This rework is completely untested.

Fixes https://github.com/spantaleev/matrix-docker-ansible-deploy/issues/266

roles/custom/matrix-pantalaimon/defaults/main.yml

@@ -0,0 +1,57 @@
+---
+# E2EE aware proxy daemon for matrix clients.
+# Project source code URL: https://github.com/matrix-org/pantalaimon
+
+matrix_pantalaimon_enabled: true
+
+matrix_pantalaimon_version: "0.10.5"
+
+matrix_pantalaimon_container_image_self_build: false
+matrix_pantalaimon_container_image_self_build_repo: "https://github.com/matrix-org/pantalaimon.git"
+matrix_pantalaimon_container_image_self_build_repo_version: "{{ 'main' if matrix_pantalaimon_version == 'latest' else matrix_pantalaimon_version }}"
+
+matrix_pantalaimon_docker_image: "{{ matrix_pantalaimon_docker_image_name_prefix }}matrixdotorg/pantalaimon:v{{ matrix_pantalaimon_version }}"
+matrix_pantalaimon_docker_image_name_prefix: "{{ 'localhost/' if matrix_pantalaimon_container_image_self_build else matrix_container_global_registry_prefix }}"
+matrix_pantalaimon_docker_image_force_pull: "{{ matrix_pantalaimon_docker_image.endswith(':latest') }}"
+
+matrix_pantalaimon_base_path: "{{ matrix_base_data_path }}/pantalaimon"
+matrix_pantalaimon_data_path: "{{ matrix_pantalaimon_base_path }}/data"
+matrix_pantalaimon_container_src_files_path: "{{ matrix_pantalaimon_base_path }}/container-src"
+
+# The base container network
+matrix_pantalaimon_container_network: ''
+
+# A list of additional container networks that the container would be connected to.
+# The role does not create these networks, so make sure they already exist.
+matrix_pantalaimon_container_additional_networks: "{{ matrix_pantalaimon_container_additional_networks_auto + matrix_pantalaimon_container_additional_networks_custom }}"
+matrix_pantalaimon_container_additional_networks_auto: []
+matrix_pantalaimon_container_additional_networks_custom: []
+
+# A list of extra arguments to pass to the container
+matrix_pantalaimon_container_extra_arguments: []
+
+# List of systemd services that matrix-pantalaimon.service depends on
+matrix_pantalaimon_systemd_required_services_list: "{{ matrix_pantalaimon_systemd_required_services_list_default + matrix_pantalaimon_systemd_required_services_list_auto + matrix_pantalaimon_systemd_required_services_list_custom }}"
+matrix_pantalaimon_systemd_required_services_list_default: ['docker.service']
+matrix_pantalaimon_systemd_required_services_list_auto: []
+matrix_pantalaimon_systemd_required_services_list_custom: []
+
+# List of systemd services that matrix-pantalaimon.service wants
+matrix_pantalaimon_systemd_wanted_services_list: "{{ matrix_pantalaimon_systemd_wanted_services_list_default + matrix_pantalaimon_systemd_wanted_services_list_auto + matrix_pantalaimon_systemd_wanted_services_list_custom }}"
+matrix_pantalaimon_systemd_wanted_services_list_default: []
+matrix_pantalaimon_systemd_wanted_services_list_auto: []
+matrix_pantalaimon_systemd_wanted_services_list_custom: []
+
+# Pantalaimon log level, case-insensitive (Error, Warning, Info, Debug)
+matrix_pantalaimon_log_level: Warning
+
+# Base URL where matrix-pantalaimon can reach your homeserver C-S API.
+# If the homeserver runs on the same machine, you may need to add its service to `matrix_pantalaimon_systemd_required_services_list`.
+matrix_pantalaimon_homeserver_url: ""
+
+# Default configuration template which covers the generic use case.
+# You can customize it by controlling the various variables inside it.
+#
+# For a more advanced customization, you can
+# completely replace this variable with your own template.
+matrix_pantalaimon_configuration: "{{ lookup('template', 'templates/pantalaimon.conf.j2') }}"

roles/custom/matrix-pantalaimon/tasks/install.yml

@@ -0,0 +1,67 @@
+---
+
+- name: Ensure matrix-pantalaimon paths exist
+  ansible.builtin.file:
+    path: "{{ item.path }}"
+    state: directory
+    mode: 0750
+    owner: "{{ matrix_user_username }}"
+    group: "{{ matrix_user_groupname }}"
+  with_items:
+    - {path: "{{ matrix_pantalaimon_base_path }}", when: true}
+    - {path: "{{ matrix_pantalaimon_data_path }}", when: true}
+    - {path: "{{ matrix_pantalaimon_container_src_files_path }}", when: "{{ matrix_pantalaimon_container_image_self_build }}"}
+  when: "item.when | bool"
+
+- name: Ensure matrix-pantalaimon config installed
+  ansible.builtin.copy:
+    content: "{{ matrix_pantalaimon_configuration }}"
+    dest: "{{ matrix_pantalaimon_data_path }}/pantalaimon.conf"
+    mode: 0644
+    owner: "{{ matrix_user_username }}"
+    group: "{{ matrix_user_groupname }}"
+
+- name: Ensure pantalaimon container image is pulled
+  community.docker.docker_image:
+    name: "{{ matrix_pantalaimon_docker_image }}"
+    source: "{{ 'pull' if ansible_version.major > 2 or ansible_version.minor > 7 else omit }}"
+    force_source: "{{ matrix_pantalaimon_docker_image_force_pull if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}"
+    force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else matrix_pantalaimon_docker_image_force_pull }}"
+  when: "not matrix_pantalaimon_container_image_self_build | bool"
+  register: result
+  retries: "{{ devture_playbook_help_container_retries_count }}"
+  delay: "{{ devture_playbook_help_container_retries_delay }}"
+  until: result is not failed
+
+- name: Ensure pantalaimon repository is present on self-build
+  ansible.builtin.git:
+    repo: "{{ matrix_pantalaimon_container_image_self_build_repo }}"
+    version: "{{ matrix_pantalaimon_container_image_self_build_repo_version }}"
+    dest: "{{ matrix_pantalaimon_container_src_files_path }}"
+    force: "yes"
+  become: true
+  become_user: "{{ matrix_user_username }}"
+  register: matrix_pantalaimon_git_pull_results
+  when: "matrix_pantalaimon_container_image_self_build | bool"
+
+- name: Ensure pantalaimon container image is built
+  community.docker.docker_image:
+    name: "{{ matrix_pantalaimon_docker_image }}"
+    source: build
+    force_source: "{{ matrix_pantalaimon_git_pull_results.changed }}"
+    build:
+      dockerfile: Dockerfile
+      path: "{{ matrix_pantalaimon_container_src_files_path }}"
+      pull: true
+  when: "matrix_pantalaimon_container_image_self_build | bool"
+
+- name: Ensure pantalaimon container network is created
+  community.general.docker_network:
+    name: "{{ matrix_pantalaimon_container_network }}"
+    driver: bridge
+
+- name: Ensure matrix-pantalaimon.service installed
+  ansible.builtin.template:
+    src: "{{ role_path }}/templates/systemd/matrix-pantalaimon.service.j2"
+    dest: "{{ devture_systemd_docker_base_systemd_path }}/matrix-pantalaimon.service"
+    mode: 0644

roles/custom/matrix-pantalaimon/tasks/main.yml

@@ -0,0 +1,20 @@
+---
+
+- tags:
+    - setup-all
+    - setup-pantalaimon
+    - install-all
+    - install-pantalaimon
+  block:
+    - when: matrix_pantalaimon_enabled | bool
+      ansible.builtin.include_tasks: "{{ role_path }}/tasks/validate_config.yml"
+
+    - when: matrix_pantalaimon_enabled | bool
+      ansible.builtin.include_tasks: "{{ role_path }}/tasks/install.yml"
+
+- tags:
+    - setup-all
+    - setup-pantalaimon
+  block:
+    - when: not matrix_pantalaimon_enabled | bool
+      ansible.builtin.include_tasks: "{{ role_path }}/tasks/uninstall.yml"

roles/custom/matrix-pantalaimon/tasks/uninstall.yml

@@ -0,0 +1,25 @@
+---
+
+- name: Check existence of matrix-pantalaimon service
+  ansible.builtin.stat:
+    path: "{{ devture_systemd_docker_base_systemd_path }}/matrix-pantalaimon.service"
+  register: matrix_pantalaimon_service_stat
+
+- when: matrix_pantalaimon_service_stat.stat.exists | bool
+  block:
+    - name: Ensure matrix-pantalaimon is stopped
+      ansible.builtin.service:
+        name: matrix-pantalaimon
+        state: stopped
+        enabled: false
+        daemon_reload: true
+
+    - name: Ensure matrix-pantalaimon.service doesn't exist
+      ansible.builtin.file:
+        path: "{{ devture_systemd_docker_base_systemd_path }}/matrix-pantalaimon.service"
+        state: absent
+
+    - name: Ensure matrix-pantalaimon paths don't exist
+      ansible.builtin.file:
+        path: "{{ matrix_pantalaimon_base_path }}"
+        state: absent

roles/custom/matrix-pantalaimon/tasks/validate_config.yml

@@ -0,0 +1,8 @@
+---
+
+- name: Fail if required variables are undefined
+  ansible.builtin.fail:
+    msg: "The `{{ item }}` variable must be defined and have a non-null value."
+  with_items:
+    - "matrix_pantalaimon_homeserver_url"
+  when: "vars[item] == '' or vars[item] is none"

roles/custom/matrix-pantalaimon/templates/pantalaimon.conf.j2

@@ -0,0 +1,10 @@
+[Default]
+LogLevel = {{ matrix_pantalaimon_log_level }}
+
+[homeserver]
+Homeserver = {{ matrix_pantalaimon_homeserver_url }}
+ListenAddress = 0.0.0.0
+ListenPort = 8009
+SSL = False
+UseKeyring = False
+IgnoreVerification = True

roles/custom/matrix-pantalaimon/templates/systemd/matrix-pantalaimon.service.j2

@@ -0,0 +1,46 @@
+#jinja2: lstrip_blocks: "True"
+[Unit]
+Description=Matrix Pantalaimon
+{% for service in matrix_pantalaimon_systemd_required_services_list %}
+Requires={{ service }}
+After={{ service }}
+{% endfor %}
+{% for service in matrix_pantalaimon_systemd_wanted_services_list %}
+Wants={{ service }}
+{% endfor %}
+DefaultDependencies=no
+
+[Service]
+Type=simple
+Environment="HOME={{ devture_systemd_docker_base_systemd_unit_home_path }}"
+ExecStartPre=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} kill matrix-pantalaimon 2>/dev/null || true'
+ExecStartPre=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} rm matrix-pantalaimon 2>/dev/null || true'
+
+ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} create \
+			--rm \
+			--name=matrix-pantalaimon \
+			--log-driver=none \
+			--user={{ matrix_user_uid }}:{{ matrix_user_gid }} \
+			--cap-drop=ALL \
+			--read-only \
+			--network={{ matrix_pantalaimon_container_network }} \
+			--mount type=bind,src={{ matrix_pantalaimon_data_path }},dst=/data \
+			{% for arg in matrix_pantalaimon_container_extra_arguments %}
+			{{ arg }} \
+			{% endfor %}
+			{{ matrix_pantalaimon_docker_image }}
+
+{% for network in matrix_pantalaimon_container_additional_networks %}
+ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} network connect {{ network }} matrix-pantalaimon
+{% endfor %}
+
+ExecStart={{ devture_systemd_docker_base_host_command_docker }} start --attach matrix-pantalaimon
+
+ExecStop=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} kill matrix-pantalaimon 2>/dev/null || true'
+ExecStop=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} rm matrix-pantalaimon 2>/dev/null || true'
+Restart=always
+RestartSec=30
+SyslogIdentifier=matrix-pantalaimon
+
+[Install]
+WantedBy=multi-user.target