Add native Traefik support to matrix-synapse
This commit is contained in:
Slavi Pantaleev
parent
fe7c06d6f5
commit
015acb6d08
@ -3805,9 +3805,26 @@ matrix_synapse_container_manhole_api_host_bind_port: "{{ (matrix_playbook_servic
|
||||
|
||||
matrix_synapse_container_additional_networks: |
|
||||
{{
|
||||
([redis_container_network] if matrix_synapse_redis_enabled and matrix_synapse_redis_host == redis_identifier else [])
|
||||
(
|
||||
([matrix_playbook_reverse_proxyable_services_additional_network] if matrix_synapse_container_labels_traefik_enabled and matrix_playbook_reverse_proxyable_services_additional_network else [])
|
||||
+
|
||||
([devture_postgres_container_network] if (devture_postgres_enabled and devture_postgres_container_network != matrix_synapse_container_network and matrix_synapse_database_host == devture_postgres_connection_hostname) else [])
|
||||
+
|
||||
([redis_container_network] if matrix_synapse_redis_enabled and matrix_synapse_redis_host == redis_identifier else [])
|
||||
)
|
||||
}}
|
||||
|
||||
matrix_synapse_container_labels_traefik_enabled: "{{ matrix_playbook_reverse_proxy_type in ['playbook-managed-traefik', 'other-traefik-container'] and not matrix_synapse_workers_enabled }}"
|
||||
matrix_synapse_container_labels_traefik_docker_network: "{{ matrix_playbook_reverse_proxyable_services_additional_network }}"
|
||||
matrix_synapse_container_labels_traefik_entrypoints: "{{ devture_traefik_entrypoint_primary }}"
|
||||
matrix_synapse_container_labels_traefik_tls_certResolver: "{{ devture_traefik_certResolver_primary }}"
|
||||
matrix_synapse_container_labels_traefik_hostname: "{{ matrix_server_fqn_matrix }}"
|
||||
|
||||
matrix_synapse_container_labels_client_root_redirection_enabled: "{{ matrix_synapse_container_labels_client_root_redirection_url != '' }}"
|
||||
matrix_synapse_container_labels_client_root_redirection_url: "{{ (('https://' if matrix_playbook_ssl_enabled else 'http://') + matrix_server_fqn_element) if matrix_client_element_enabled else '' }}"
|
||||
|
||||
matrix_synapse_container_labels_federation_api_traefik_entrypoints: "{{ matrix_federation_traefik_entrypoint }}"
|
||||
|
||||
# For exposing the Synapse worker (and metrics) ports to the local host.
|
||||
matrix_synapse_workers_container_host_bind_address: "{{ matrix_playbook_service_host_bind_interface_prefix[0:-1] if (matrix_synapse_workers_enabled and matrix_playbook_service_host_bind_interface_prefix) else '' }}"
|
||||
|
||||
@ -3816,8 +3833,7 @@ matrix_synapse_database_password: "{{ '%s' | format(matrix_homeserver_generic_se
|
||||
|
||||
matrix_synapse_macaroon_secret_key: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'synapse.mac', rounds=655555) | to_uuid }}"
|
||||
|
||||
# We do not enable TLS in Synapse by default.
|
||||
# TLS is handled by the matrix-nginx-proxy, which proxies the requests to Synapse.
|
||||
# We do not enable TLS in Synapse by default, since it's handled by Traefik.
|
||||
matrix_synapse_tls_federation_listener_enabled: false
|
||||
matrix_synapse_tls_certificate_path: ~
|
||||
matrix_synapse_tls_private_key_path: ~
|
||||
@ -3858,18 +3874,16 @@ matrix_synapse_turn_shared_secret: "{{ matrix_coturn_turn_static_auth_secret if
|
||||
|
||||
matrix_synapse_self_check_validate_certificates: "{{ false if matrix_playbook_ssl_retrieval_method == 'self-signed' else true }}"
|
||||
|
||||
matrix_synapse_systemd_required_services_list: |
|
||||
matrix_synapse_systemd_required_services_list_auto: |
|
||||
{{
|
||||
(['docker.service'])
|
||||
+
|
||||
([devture_postgres_identifier ~ '.service'] if devture_postgres_enabled else [])
|
||||
([devture_postgres_identifier ~ '.service'] if (devture_postgres_enabled and devture_postgres_container_network != matrix_synapse_container_network and matrix_synapse_database_host == devture_postgres_connection_hostname) else [])
|
||||
+
|
||||
([redis_identifier ~ '.service'] if matrix_synapse_redis_enabled and matrix_synapse_redis_host == redis_identifier else [])
|
||||
+
|
||||
(['matrix-goofys.service'] if matrix_s3_media_store_enabled else [])
|
||||
}}
|
||||
|
||||
matrix_synapse_systemd_wanted_services_list: |
|
||||
matrix_synapse_systemd_wanted_services_list_auto: |
|
||||
{{
|
||||
(['matrix-coturn.service'] if matrix_coturn_enabled else [])
|
||||
+
|
||||
@ -3943,7 +3957,7 @@ matrix_synapse_reverse_proxy_companion_container_network: "{{ matrix_synapse_con
|
||||
matrix_synapse_reverse_proxy_companion_container_additional_networks: |
|
||||
{{
|
||||
(
|
||||
([matrix_playbook_reverse_proxyable_services_additional_network] if matrix_playbook_reverse_proxyable_services_additional_network else [])
|
||||
([matrix_playbook_reverse_proxyable_services_additional_network] if matrix_synapse_reverse_proxy_companion_container_labels_traefik_enabled and matrix_playbook_reverse_proxyable_services_additional_network else [])
|
||||
+
|
||||
([] if matrix_homeserver_container_network in ['', matrix_synapse_reverse_proxy_companion_container_network] else [matrix_homeserver_container_network])
|
||||
) | unique
|
||||
@ -3960,15 +3974,11 @@ matrix_synapse_reverse_proxy_companion_container_labels_traefik_entrypoints: "{{
|
||||
matrix_synapse_reverse_proxy_companion_container_labels_traefik_tls_certResolver: "{{ devture_traefik_certResolver_primary }}"
|
||||
matrix_synapse_reverse_proxy_companion_container_labels_traefik_hostname: "{{ matrix_server_fqn_matrix }}"
|
||||
|
||||
matrix_synapse_reverse_proxy_companion_container_labels_client_root_redirection_enabled: "{{ matrix_synapse_reverse_proxy_companion_container_labels_client_root_redirection_url != '' }}"
|
||||
matrix_synapse_reverse_proxy_companion_container_labels_client_root_redirection_url: "{{ (('https://' if matrix_playbook_ssl_enabled else 'http://') + matrix_server_fqn_element) if matrix_client_element_enabled else '' }}"
|
||||
|
||||
# TODO - enable these (and potentially remove them above/below), when they land in matrix-synapse
|
||||
# matrix_synapse_reverse_proxy_companion_container_labels_client_root_redirection_enabled: "{{ matrix_synapse_container_labels_client_root_redirection_enabled != '' }}"
|
||||
# matrix_synapse_reverse_proxy_companion_container_labels_client_root_redirection_url: "{{ matrix_synapse_container_labels_client_root_redirection_url }}"
|
||||
# matrix_synapse_reverse_proxy_companion_container_labels_client_synapse_client_api_enabled: "{{ matrix_synapse_container_labels_client_synapse_client_api_enabled }}"
|
||||
# matrix_synapse_reverse_proxy_companion_container_labels_client_synapse_oidc_api_enabled: "{{ matrix_synapse_container_labels_client_synapse_oidc_api_enabled }}"
|
||||
# matrix_synapse_reverse_proxy_companion_container_labels_client_synapse_admin_api_enabled: "{{ matrix_synapse_container_labels_client_synapse_admin_api_enabled }}"
|
||||
matrix_synapse_reverse_proxy_companion_container_labels_client_root_redirection_enabled: "{{ matrix_synapse_container_labels_client_root_redirection_enabled != '' }}"
|
||||
matrix_synapse_reverse_proxy_companion_container_labels_client_root_redirection_url: "{{ matrix_synapse_container_labels_client_root_redirection_url }}"
|
||||
matrix_synapse_reverse_proxy_companion_container_labels_client_synapse_client_api_enabled: "{{ matrix_synapse_container_labels_client_synapse_client_api_enabled }}"
|
||||
matrix_synapse_reverse_proxy_companion_container_labels_client_synapse_oidc_api_enabled: "{{ matrix_synapse_container_labels_client_synapse_oidc_api_enabled }}"
|
||||
matrix_synapse_reverse_proxy_companion_container_labels_client_synapse_admin_api_enabled: "{{ matrix_synapse_container_labels_client_synapse_admin_api_enabled }}"
|
||||
|
||||
matrix_synapse_reverse_proxy_companion_container_labels_federation_api_traefik_entrypoints: "{{ matrix_federation_traefik_entrypoint }}"
|
||||
|
||||
|
||||
@ -156,6 +156,88 @@ matrix_synapse_container_metrics_api_host_bind_port: ''
|
||||
# Takes an "<ip>:<port>" or "<port>" value (e.g. "127.0.0.1:9100"), or empty string to not expose.
|
||||
matrix_synapse_container_manhole_api_host_bind_port: ''
|
||||
|
||||
# matrix_synapse_container_labels_traefik_enabled controls whether labels to assist a Traefik reverse-proxy will be attached to the container.
|
||||
# See `../templates/labels.j2` for details.
|
||||
#
|
||||
# To inject your own other container labels, see `matrix_synapse_container_labels_additional_labels`.
|
||||
matrix_synapse_container_labels_traefik_enabled: true
|
||||
matrix_synapse_container_labels_traefik_docker_network: "{{ matrix_synapse_container_network }}"
|
||||
matrix_synapse_container_labels_traefik_entrypoints: web-secure
|
||||
matrix_synapse_container_labels_traefik_tls_certResolver: default # noqa var-naming
|
||||
matrix_synapse_container_labels_traefik_hostname: ''
|
||||
|
||||
# Controls whether labels will be added for handling the root (/) path
|
||||
matrix_synapse_container_labels_client_root_enabled: true
|
||||
matrix_synapse_container_labels_client_root_traefik_hostname: "{{ matrix_synapse_container_labels_traefik_hostname }}"
|
||||
matrix_synapse_container_labels_client_root_traefik_rule: "Host(`{{ matrix_synapse_container_labels_client_root_traefik_hostname }}`) && Path(`/`)"
|
||||
matrix_synapse_container_labels_client_root_traefik_priority: 0
|
||||
matrix_synapse_container_labels_client_root_traefik_entrypoints: "{{ matrix_synapse_container_labels_traefik_entrypoints }}"
|
||||
matrix_synapse_container_labels_client_root_traefik_tls: "{{ matrix_synapse_container_labels_client_root_traefik_entrypoints != 'web' }}"
|
||||
matrix_synapse_container_labels_client_root_traefik_tls_certResolver: "{{ matrix_synapse_container_labels_traefik_tls_certResolver }}" # noqa var-naming
|
||||
matrix_synapse_container_labels_client_root_redirection_enabled: false
|
||||
matrix_synapse_container_labels_client_root_redirection_url: ""
|
||||
|
||||
# Controls whether labels will be added that expose the Client-Server API.
|
||||
matrix_synapse_container_labels_client_api_enabled: true
|
||||
matrix_synapse_container_labels_client_api_traefik_hostname: "{{ matrix_synapse_container_labels_traefik_hostname }}"
|
||||
matrix_synapse_container_labels_client_api_traefik_path_prefix: /_matrix
|
||||
matrix_synapse_container_labels_client_api_traefik_rule: "Host(`{{ matrix_synapse_container_labels_client_api_traefik_hostname }}`) && PathPrefix(`{{ matrix_synapse_container_labels_client_api_traefik_path_prefix }}`)"
|
||||
matrix_synapse_container_labels_client_api_traefik_priority: 0
|
||||
matrix_synapse_container_labels_client_api_traefik_entrypoints: "{{ matrix_synapse_container_labels_traefik_entrypoints }}"
|
||||
matrix_synapse_container_labels_client_api_traefik_tls: "{{ matrix_synapse_container_labels_client_api_traefik_entrypoints != 'web' }}"
|
||||
matrix_synapse_container_labels_client_api_traefik_tls_certResolver: "{{ matrix_synapse_container_labels_traefik_tls_certResolver }}" # noqa var-naming
|
||||
|
||||
# Controls whether labels will be added that expose the /_synapse/client paths
|
||||
matrix_synapse_container_labels_client_synapse_client_api_enabled: true
|
||||
matrix_synapse_container_labels_client_synapse_client_api_traefik_hostname: "{{ matrix_synapse_container_labels_traefik_hostname }}"
|
||||
matrix_synapse_container_labels_client_synapse_client_api_traefik_path_prefix: /_synapse/client
|
||||
matrix_synapse_container_labels_client_synapse_client_api_traefik_rule: "Host(`{{ matrix_synapse_container_labels_client_synapse_client_api_traefik_hostname }}`) && PathPrefix(`{{ matrix_synapse_container_labels_client_synapse_client_api_traefik_path_prefix }}`)"
|
||||
matrix_synapse_container_labels_client_synapse_client_api_traefik_priority: 0
|
||||
matrix_synapse_container_labels_client_synapse_client_api_traefik_entrypoints: "{{ matrix_synapse_container_labels_traefik_entrypoints }}"
|
||||
matrix_synapse_container_labels_client_synapse_client_api_traefik_tls: "{{ matrix_synapse_container_labels_client_synapse_client_api_traefik_entrypoints != 'web' }}"
|
||||
matrix_synapse_container_labels_client_synapse_client_api_traefik_tls_certResolver: "{{ matrix_synapse_container_labels_traefik_tls_certResolver }}" # noqa var-naming
|
||||
|
||||
# Controls whether labels will be added that expose the /_synapse/oidc paths
|
||||
# Enable this if you need OpenID Connect authentication support.
|
||||
matrix_synapse_container_labels_client_synapse_oidc_api_enabled: false
|
||||
matrix_synapse_container_labels_client_synapse_oidc_api_traefik_hostname: "{{ matrix_synapse_container_labels_traefik_hostname }}"
|
||||
matrix_synapse_container_labels_client_synapse_oidc_api_traefik_path_prefix: /_synapse/oidc
|
||||
matrix_synapse_container_labels_client_synapse_oidc_api_traefik_rule: "Host(`{{ matrix_synapse_container_labels_client_synapse_oidc_api_traefik_hostname }}`) && PathPrefix(`{{ matrix_synapse_container_labels_client_synapse_oidc_api_traefik_path_prefix }}`)"
|
||||
matrix_synapse_container_labels_client_synapse_oidc_api_traefik_priority: 0
|
||||
matrix_synapse_container_labels_client_synapse_oidc_api_traefik_entrypoints: "{{ matrix_synapse_container_labels_traefik_entrypoints }}"
|
||||
matrix_synapse_container_labels_client_synapse_oidc_api_traefik_tls: "{{ matrix_synapse_container_labels_client_synapse_oidc_api_traefik_entrypoints != 'web' }}"
|
||||
matrix_synapse_container_labels_client_synapse_oidc_api_traefik_tls_certResolver: "{{ matrix_synapse_container_labels_traefik_tls_certResolver }}" # noqa var-naming
|
||||
|
||||
# Controls whether labels will be added that expose the /_synapse/admin paths
|
||||
# Following these recommendations (https://github.com/matrix-org/synapse/blob/master/docs/reverse_proxy.md), by default, we don't.
|
||||
matrix_synapse_container_labels_client_synapse_admin_api_enabled: false
|
||||
matrix_synapse_container_labels_client_synapse_admin_api_traefik_hostname: "{{ matrix_synapse_container_labels_traefik_hostname }}"
|
||||
matrix_synapse_container_labels_client_synapse_admin_api_traefik_path_prefix: /_synapse/admin
|
||||
matrix_synapse_container_labels_client_synapse_admin_api_traefik_rule: "Host(`{{ matrix_synapse_container_labels_client_synapse_admin_api_traefik_hostname }}`) && PathPrefix(`{{ matrix_synapse_container_labels_client_synapse_admin_api_traefik_path_prefix }}`)"
|
||||
matrix_synapse_container_labels_client_synapse_admin_api_traefik_priority: 0
|
||||
matrix_synapse_container_labels_client_synapse_admin_api_traefik_entrypoints: "{{ matrix_synapse_container_labels_traefik_entrypoints }}"
|
||||
matrix_synapse_container_labels_client_synapse_admin_api_traefik_tls: "{{ matrix_synapse_container_labels_client_synapse_admin_api_traefik_entrypoints != 'web' }}"
|
||||
matrix_synapse_container_labels_client_synapse_admin_api_traefik_tls_certResolver: "{{ matrix_synapse_container_labels_traefik_tls_certResolver }}" # noqa var-naming
|
||||
|
||||
# Controls whether labels will be added that expose the Server-Server API (Federation API).
|
||||
matrix_synapse_container_labels_federation_api_enabled: "{{ matrix_synapse_reverse_proxy_companion_federation_api_enabled }}"
|
||||
matrix_synapse_container_labels_federation_api_traefik_hostname: "{{ matrix_synapse_container_labels_traefik_hostname }}"
|
||||
matrix_synapse_container_labels_federation_api_traefik_path_prefix: /_matrix
|
||||
matrix_synapse_container_labels_federation_api_traefik_rule: "Host(`{{ matrix_synapse_container_labels_federation_api_traefik_hostname }}`) && PathPrefix(`{{ matrix_synapse_container_labels_federation_api_traefik_path_prefix }}`)"
|
||||
matrix_synapse_container_labels_federation_api_traefik_priority: 0
|
||||
matrix_synapse_container_labels_federation_api_traefik_entrypoints: ''
|
||||
matrix_synapse_container_labels_federation_api_traefik_tls: "{{ matrix_synapse_container_labels_federation_api_traefik_entrypoints != 'web' }}"
|
||||
matrix_synapse_container_labels_federation_api_traefik_tls_certResolver: "{{ matrix_synapse_container_labels_traefik_tls_certResolver }}" # noqa var-naming
|
||||
|
||||
# matrix_synapse_container_labels_additional_labels contains a multiline string with additional labels to add to the container label file.
|
||||
# See `../templates/labels.j2` for details.
|
||||
#
|
||||
# Example:
|
||||
# matrix_synapse_container_labels_additional_labels: |
|
||||
# my.label=1
|
||||
# another.label="here"
|
||||
matrix_synapse_container_labels_additional_labels: ''
|
||||
|
||||
# A list of extra arguments to pass to the container
|
||||
# Also see `matrix_synapse_container_arguments`
|
||||
matrix_synapse_container_extra_arguments: []
|
||||
@ -171,10 +253,16 @@ matrix_synapse_container_extra_arguments_auto: []
|
||||
matrix_synapse_container_arguments: "{{ matrix_synapse_container_extra_arguments + matrix_synapse_container_extra_arguments_auto }}"
|
||||
|
||||
# List of systemd services that matrix-synapse.service depends on
|
||||
matrix_synapse_systemd_required_services_list: ['docker.service']
|
||||
matrix_synapse_systemd_required_services_list: "{{ matrix_synapse_systemd_required_services_list_default + matrix_synapse_systemd_required_services_list_auto + matrix_synapse_systemd_required_services_list_custom }}"
|
||||
matrix_synapse_systemd_required_services_list_default: ['docker.service']
|
||||
matrix_synapse_systemd_required_services_list_auto: []
|
||||
matrix_synapse_systemd_required_services_list_custom: []
|
||||
|
||||
# List of systemd services that matrix-synapse.service wants
|
||||
matrix_synapse_systemd_wanted_services_list: []
|
||||
matrix_synapse_systemd_wanted_services_list: "{{ matrix_synapse_systemd_wanted_services_list_default + matrix_synapse_systemd_wanted_services_list_auto + matrix_synapse_systemd_wanted_services_list_custom }}"
|
||||
matrix_synapse_systemd_wanted_services_list_default: []
|
||||
matrix_synapse_systemd_wanted_services_list_auto: []
|
||||
matrix_synapse_systemd_wanted_services_list_custom: []
|
||||
|
||||
matrix_synapse_in_container_python_packages_path: "/usr/local/lib/python3.11/site-packages"
|
||||
|
||||
|
||||
@ -115,28 +115,29 @@
|
||||
owner: "{{ matrix_synapse_uid }}"
|
||||
group: "{{ matrix_synapse_gid }}"
|
||||
|
||||
- name: Ensure Synapse log config installed
|
||||
ansible.builtin.template:
|
||||
src: "{{ matrix_synapse_template_synapse_log }}"
|
||||
dest: "{{ matrix_synapse_config_dir_path }}/{{ matrix_server_fqn_matrix }}.log.config"
|
||||
mode: 0644
|
||||
|
||||
- name: Ensure Synapse container network is created
|
||||
community.general.docker_network:
|
||||
name: "{{ matrix_synapse_container_network }}"
|
||||
driver: bridge
|
||||
|
||||
- name: Ensure matrix-synapse.service installed
|
||||
- name: Ensure Synapse support files installed
|
||||
ansible.builtin.template:
|
||||
src: "{{ role_path }}/templates/synapse/systemd/matrix-synapse.service.j2"
|
||||
dest: "{{ devture_systemd_docker_base_systemd_path }}/matrix-synapse.service"
|
||||
mode: 0644
|
||||
|
||||
- name: Ensure register-user script created
|
||||
ansible.builtin.template:
|
||||
src: "{{ role_path }}/templates/synapse/bin/register-user.j2"
|
||||
dest: "{{ matrix_synapse_bin_path }}/register-user"
|
||||
mode: 0755
|
||||
src: "{{ item.src }}"
|
||||
dest: "{{ item.dest }}"
|
||||
mode: "{{ item.mode }}"
|
||||
with_items:
|
||||
- src: "{{ matrix_synapse_template_synapse_log }}"
|
||||
dest: "{{ matrix_synapse_config_dir_path }}/{{ matrix_server_fqn_matrix }}.log.config"
|
||||
mode: '0644'
|
||||
- src: "{{ role_path }}/templates/synapse/bin/register-user.j2"
|
||||
dest: "{{ matrix_synapse_bin_path }}/register-user"
|
||||
mode: '0755'
|
||||
- src: "{{ role_path }}/templates/synapse/labels.j2"
|
||||
dest: "{{ matrix_synapse_base_path }}/labels"
|
||||
mode: '0644'
|
||||
- src: "{{ role_path }}/templates/synapse/systemd/matrix-synapse.service.j2"
|
||||
dest: "{{ devture_systemd_docker_base_systemd_path }}/matrix-synapse.service"
|
||||
mode: '0644'
|
||||
|
||||
- name: Generate sample prometheus.yml for external scraping
|
||||
ansible.builtin.template:
|
||||
|
||||
@ -3,18 +3,30 @@
|
||||
- name: Fail if required Synapse settings not defined
|
||||
ansible.builtin.fail:
|
||||
msg: >-
|
||||
You need to define a required configuration setting (`{{ item }}`) for using Synapse.
|
||||
when: "vars[item] == ''"
|
||||
You need to define a required configuration setting (`{{ item.name }}`).
|
||||
when: "item.when | bool and vars[item.name] == ''"
|
||||
with_items:
|
||||
- matrix_synapse_username
|
||||
- matrix_synapse_uid
|
||||
- matrix_synapse_gid
|
||||
- matrix_synapse_container_network
|
||||
- matrix_synapse_macaroon_secret_key
|
||||
- matrix_synapse_database_host
|
||||
- matrix_synapse_database_user
|
||||
- matrix_synapse_database_password
|
||||
- matrix_synapse_database_database
|
||||
- {'name': 'matrix_synapse_username', when: true}
|
||||
- {'name': 'matrix_synapse_uid', when: true}
|
||||
- {'name': 'matrix_synapse_gid', when: true}
|
||||
- {'name': 'matrix_synapse_container_network', when: true}
|
||||
- {'name': 'matrix_synapse_macaroon_secret_key', when: true}
|
||||
- {'name': 'matrix_synapse_database_host', when: true}
|
||||
- {'name': 'matrix_synapse_database_user', when: true}
|
||||
- {'name': 'matrix_synapse_database_password', when: true}
|
||||
- {'name': 'matrix_synapse_database_database', when: true}
|
||||
|
||||
- {'name': 'matrix_synapse_container_labels_client_root_traefik_hostname', when: "{{ matrix_synapse_container_labels_client_root_enabled }}"}
|
||||
- {'name': 'matrix_synapse_container_labels_client_root_redirection_url', when: "{{ matrix_synapse_container_labels_client_root_redirection_enabled }}"}
|
||||
|
||||
- {'name': 'matrix_synapse_container_labels_client_api_traefik_hostname', when: "{{ matrix_synapse_container_labels_client_api_enabled }}"}
|
||||
|
||||
- {'name': 'matrix_synapse_container_labels_client_synapse_client_api_traefik_hostname', when: "{{ matrix_synapse_container_labels_client_synapse_client_api_enabled }}"}
|
||||
- {'name': 'matrix_synapse_container_labels_client_synapse_oidc_api_traefik_hostname', when: "{{ matrix_synapse_container_labels_client_synapse_oidc_api_enabled }}"}
|
||||
- {'name': 'matrix_synapse_container_labels_client_synapse_admin_api_traefik_hostname', when: "{{ matrix_synapse_container_labels_client_synapse_admin_api_enabled }}"}
|
||||
|
||||
- {'name': 'matrix_synapse_container_labels_federation_api_traefik_hostname', when: "{{ matrix_synapse_container_labels_federation_api_enabled }}"}
|
||||
- {'name': 'matrix_synapse_container_labels_federation_api_traefik_entrypoints', when: "{{ matrix_synapse_container_labels_federation_api_enabled }}"}
|
||||
|
||||
- name: Fail if asking for more than 1 instance of single-instance workers
|
||||
ansible.builtin.fail:
|
||||
|
||||
176
roles/custom/matrix-synapse/templates/synapse/labels.j2
Normal file
176
roles/custom/matrix-synapse/templates/synapse/labels.j2
Normal file
@ -0,0 +1,176 @@
|
||||
{% if matrix_synapse_container_labels_traefik_enabled %}
|
||||
traefik.enable=true
|
||||
|
||||
{% if matrix_synapse_container_labels_traefik_docker_network %}
|
||||
traefik.docker.network={{ matrix_synapse_container_labels_traefik_docker_network }}
|
||||
{% endif %}
|
||||
|
||||
traefik.http.services.matrix-synapse-client-api.loadbalancer.server.port=8008
|
||||
traefik.http.services.matrix-synapse-federation-api.loadbalancer.server.port=8048
|
||||
|
||||
|
||||
{#
|
||||
Root path (/)
|
||||
#}
|
||||
{% if matrix_synapse_container_labels_client_root_enabled %}
|
||||
|
||||
{% set client_root_middlewares = [] %}
|
||||
|
||||
{% if matrix_synapse_container_labels_client_root_redirection_enabled %}
|
||||
{% set client_root_middlewares = client_root_middlewares + ['matrix-synapse-client-root-redirect'] %}
|
||||
traefik.http.middlewares.matrix-synapse-client-root-redirect.redirectregex.regex=(.*)
|
||||
traefik.http.middlewares.matrix-synapse-client-root-redirect.redirectregex.replacement={{ matrix_synapse_container_labels_client_root_redirection_url }}
|
||||
{% else %}
|
||||
{% set client_root_middlewares = client_root_middlewares + ['matrix-synapse-client-root-replacepath'] %}
|
||||
traefik.http.middlewares.matrix-synapse-client-root-replacepath.replacepath.path=/_matrix/static/
|
||||
{% endif %}
|
||||
|
||||
traefik.http.routers.matrix-synapse-client-root.rule={{ matrix_synapse_container_labels_client_root_traefik_rule }}
|
||||
|
||||
traefik.http.routers.matrix-synapse-client-root.middlewares={{ client_root_middlewares | join(',') }}
|
||||
|
||||
{% if matrix_synapse_container_labels_client_root_traefik_priority | int > 0 %}
|
||||
traefik.http.routers.matrix-synapse-client-root.priority={{ matrix_synapse_container_labels_client_root_traefik_priority }}
|
||||
{% endif %}
|
||||
|
||||
traefik.http.routers.matrix-synapse-client-root.service=matrix-synapse-client-api
|
||||
traefik.http.routers.matrix-synapse-client-root.entrypoints={{ matrix_synapse_container_labels_client_root_traefik_entrypoints }}
|
||||
traefik.http.routers.matrix-synapse-client-root.tls={{ matrix_synapse_container_labels_client_root_traefik_tls | to_json }}
|
||||
|
||||
{% if matrix_synapse_container_labels_client_root_traefik_tls %}
|
||||
traefik.http.routers.matrix-synapse-client-root.tls.certResolver={{ matrix_synapse_container_labels_client_root_traefik_tls_certResolver }}
|
||||
{% endif %}
|
||||
|
||||
{% endif %}
|
||||
{#
|
||||
/Root path (/)
|
||||
#}
|
||||
|
||||
|
||||
{#
|
||||
Client-API (/_matrix)
|
||||
#}
|
||||
{% if matrix_synapse_container_labels_client_api_enabled %}
|
||||
|
||||
traefik.http.routers.matrix-synapse-client-api.rule={{ matrix_synapse_container_labels_client_api_traefik_rule }}
|
||||
|
||||
{% if matrix_synapse_container_labels_client_api_traefik_priority | int > 0 %}
|
||||
traefik.http.routers.matrix-synapse-client-api.priority={{ matrix_synapse_container_labels_client_api_traefik_priority }}
|
||||
{% endif %}
|
||||
|
||||
traefik.http.routers.matrix-synapse-client-api.service=matrix-synapse-client-api
|
||||
traefik.http.routers.matrix-synapse-client-api.entrypoints={{ matrix_synapse_container_labels_client_api_traefik_entrypoints }}
|
||||
traefik.http.routers.matrix-synapse-client-api.tls={{ matrix_synapse_container_labels_client_api_traefik_tls | to_json }}
|
||||
|
||||
{% if matrix_synapse_container_labels_client_api_traefik_tls %}
|
||||
traefik.http.routers.matrix-synapse-client-api.tls.certResolver={{ matrix_synapse_container_labels_client_api_traefik_tls_certResolver }}
|
||||
{% endif %}
|
||||
|
||||
{% endif %}
|
||||
{#
|
||||
/Client-API (/_matrix)
|
||||
#}
|
||||
|
||||
|
||||
{#
|
||||
Synapse Admin API (/_synapse/client)
|
||||
#}
|
||||
{% if matrix_synapse_container_labels_client_synapse_client_api_enabled %}
|
||||
|
||||
traefik.http.routers.matrix-synapse-client-synapse-client-api.rule={{ matrix_synapse_container_labels_client_synapse_client_api_traefik_rule }}
|
||||
|
||||
{% if matrix_synapse_container_labels_client_synapse_client_api_traefik_priority | int > 0 %}
|
||||
traefik.http.routers.matrix-synapse-client-synapse-client-api.priority={{ matrix_synapse_container_labels_client_synapse_client_api_traefik_priority }}
|
||||
{% endif %}
|
||||
|
||||
traefik.http.routers.matrix-synapse-client-synapse-client-api.service=matrix-synapse-client-synapse-client-api
|
||||
traefik.http.routers.matrix-synapse-client-synapse-client-api.entrypoints={{ matrix_synapse_container_labels_client_synapse_client_api_traefik_entrypoints }}
|
||||
traefik.http.routers.matrix-synapse-client-synapse-client-api.tls={{ matrix_synapse_container_labels_client_synapse_client_api_traefik_tls | to_json }}
|
||||
|
||||
{% if matrix_synapse_container_labels_client_synapse_client_api_traefik_tls %}
|
||||
traefik.http.routers.matrix-synapse-client-synapse-client-api.tls.certResolver={{ matrix_synapse_container_labels_client_synapse_client_api_traefik_tls_certResolver }}
|
||||
{% endif %}
|
||||
|
||||
{% endif %}
|
||||
{#
|
||||
/Synapse Admin API (/_synapse/client)
|
||||
#}
|
||||
|
||||
|
||||
{#
|
||||
Synapse OIDC API (/_synapse/oidc)
|
||||
#}
|
||||
{% if matrix_synapse_container_labels_client_synapse_oidc_api_enabled %}
|
||||
|
||||
traefik.http.routers.matrix-synapse-client-synapse-oidc-api.rule={{ matrix_synapse_container_labels_client_synapse_oidc_api_traefik_rule }}
|
||||
|
||||
{% if matrix_synapse_container_labels_client_synapse_oidc_api_traefik_priority | int > 0 %}
|
||||
traefik.http.routers.matrix-synapse-client-synapse-oidc-api.priority={{ matrix_synapse_container_labels_client_synapse_oidc_api_traefik_priority }}
|
||||
{% endif %}
|
||||
|
||||
traefik.http.routers.matrix-synapse-client-synapse-oidc-api.service=matrix-synapse-client-synapse-oidc-api
|
||||
traefik.http.routers.matrix-synapse-client-synapse-oidc-api.entrypoints={{ matrix_synapse_container_labels_client_synapse_oidc_api_traefik_entrypoints }}
|
||||
traefik.http.routers.matrix-synapse-client-synapse-oidc-api.tls={{ matrix_synapse_container_labels_client_synapse_oidc_api_traefik_tls | to_json }}
|
||||
|
||||
{% if matrix_synapse_container_labels_client_synapse_oidc_api_traefik_tls %}
|
||||
traefik.http.routers.matrix-synapse-client-synapse-oidc-api.tls.certResolver={{ matrix_synapse_container_labels_client_synapse_oidc_api_traefik_tls_certResolver }}
|
||||
{% endif %}
|
||||
|
||||
{% endif %}
|
||||
{#
|
||||
/Synapse OIDC API (/_synapse/oidc)
|
||||
#}
|
||||
|
||||
|
||||
{#
|
||||
Synapse Admin API (/_synapse/admin)
|
||||
#}
|
||||
{% if matrix_synapse_container_labels_client_synapse_admin_api_enabled %}
|
||||
|
||||
traefik.http.routers.matrix-synapse-client-synapse-admin-api.rule={{ matrix_synapse_container_labels_client_synapse_admin_api_traefik_rule }}
|
||||
|
||||
{% if matrix_synapse_container_labels_client_synapse_admin_api_traefik_priority | int > 0 %}
|
||||
traefik.http.routers.matrix-synapse-client-synapse-admin-api.priority={{ matrix_synapse_container_labels_client_synapse_admin_api_traefik_priority }}
|
||||
{% endif %}
|
||||
|
||||
traefik.http.routers.matrix-synapse-client-synapse-admin-api.service=matrix-synapse-client-synapse-admin-api
|
||||
traefik.http.routers.matrix-synapse-client-synapse-admin-api.entrypoints={{ matrix_synapse_container_labels_client_synapse_admin_api_traefik_entrypoints }}
|
||||
traefik.http.routers.matrix-synapse-client-synapse-admin-api.tls={{ matrix_synapse_container_labels_client_synapse_admin_api_traefik_tls | to_json }}
|
||||
|
||||
{% if matrix_synapse_container_labels_client_synapse_admin_api_traefik_tls %}
|
||||
traefik.http.routers.matrix-synapse-client-synapse-admin-api.tls.certResolver={{ matrix_synapse_container_labels_client_synapse_admin_api_traefik_tls_certResolver }}
|
||||
{% endif %}
|
||||
|
||||
{% endif %}
|
||||
{#
|
||||
/Synapse Admin API (/_synapse/admin)
|
||||
#}
|
||||
|
||||
|
||||
{#
|
||||
Federation-API (/_matrix)
|
||||
#}
|
||||
{% if matrix_synapse_container_labels_federation_api_enabled %}
|
||||
|
||||
traefik.http.routers.matrix-synapse-federation-api.rule={{ matrix_synapse_container_labels_federation_api_traefik_rule }}
|
||||
|
||||
{% if matrix_synapse_container_labels_federation_api_traefik_priority | int > 0 %}
|
||||
traefik.http.routers.matrix-synapse-federation-api.priority={{ matrix_synapse_container_labels_federation_api_traefik_priority }}
|
||||
{% endif %}
|
||||
|
||||
traefik.http.routers.matrix-synapse-federation-api.service=matrix-synapse-federation-api
|
||||
traefik.http.routers.matrix-synapse-federation-api.entrypoints={{ matrix_synapse_container_labels_federation_api_traefik_entrypoints }}
|
||||
traefik.http.routers.matrix-synapse-federation-api.tls={{ matrix_synapse_container_labels_federation_api_traefik_tls | to_json }}
|
||||
|
||||
{% if matrix_synapse_container_labels_federation_api_traefik_tls %}
|
||||
traefik.http.routers.matrix-synapse-federation-api.tls.certResolver={{ matrix_synapse_container_labels_federation_api_traefik_tls_certResolver }}
|
||||
{% endif %}
|
||||
|
||||
{% endif %}
|
||||
{#
|
||||
/Federation-API (/_matrix)
|
||||
#}
|
||||
|
||||
{% endif %}
|
||||
|
||||
{{ matrix_synapse_container_labels_additional_labels }}
|
||||
@ -56,6 +56,7 @@ ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} create \
|
||||
{% endif %}
|
||||
--mount type=bind,src={{ matrix_synapse_config_dir_path }},dst=/data,ro \
|
||||
--mount type=bind,src={{ matrix_synapse_storage_path }},dst=/matrix-media-store-parent,bind-propagation=slave \
|
||||
--label-file={{ matrix_synapse_base_path }}/labels \
|
||||
{% for volume in matrix_synapse_container_additional_volumes %}
|
||||
-v {{ volume.src }}:{{ volume.dst }}:{{ volume.options }} \
|
||||
{% endfor %}
|
||||
|
||||
Loading…
Reference in New Issue
Block a user