From 015acb6d085852e326f1b808df66d793229ef75a Mon Sep 17 00:00:00 2001 From: Slavi Pantaleev Date: Thu, 4 Jan 2024 19:00:23 +0200 Subject: [PATCH] Add native Traefik support to matrix-synapse --- group_vars/matrix_servers | 46 +++-- roles/custom/matrix-synapse/defaults/main.yml | 92 ++++++++- .../tasks/synapse/setup_install.yml | 33 ++-- .../matrix-synapse/tasks/validate_config.yml | 34 ++-- .../templates/synapse/labels.j2 | 176 ++++++++++++++++++ .../synapse/systemd/matrix-synapse.service.j2 | 1 + 6 files changed, 335 insertions(+), 47 deletions(-) create mode 100644 roles/custom/matrix-synapse/templates/synapse/labels.j2 diff --git a/group_vars/matrix_servers b/group_vars/matrix_servers index 7f406813c..37fd784e3 100755 --- a/group_vars/matrix_servers +++ b/group_vars/matrix_servers @@ -3805,9 +3805,26 @@ matrix_synapse_container_manhole_api_host_bind_port: "{{ (matrix_playbook_servic matrix_synapse_container_additional_networks: | {{ - ([redis_container_network] if matrix_synapse_redis_enabled and matrix_synapse_redis_host == redis_identifier else []) + ( + ([matrix_playbook_reverse_proxyable_services_additional_network] if matrix_synapse_container_labels_traefik_enabled and matrix_playbook_reverse_proxyable_services_additional_network else []) + + + ([devture_postgres_container_network] if (devture_postgres_enabled and devture_postgres_container_network != matrix_synapse_container_network and matrix_synapse_database_host == devture_postgres_connection_hostname) else []) + + + ([redis_container_network] if matrix_synapse_redis_enabled and matrix_synapse_redis_host == redis_identifier else []) + ) }} +matrix_synapse_container_labels_traefik_enabled: "{{ matrix_playbook_reverse_proxy_type in ['playbook-managed-traefik', 'other-traefik-container'] and not matrix_synapse_workers_enabled }}" +matrix_synapse_container_labels_traefik_docker_network: "{{ matrix_playbook_reverse_proxyable_services_additional_network }}" +matrix_synapse_container_labels_traefik_entrypoints: "{{ devture_traefik_entrypoint_primary }}" +matrix_synapse_container_labels_traefik_tls_certResolver: "{{ devture_traefik_certResolver_primary }}" +matrix_synapse_container_labels_traefik_hostname: "{{ matrix_server_fqn_matrix }}" + +matrix_synapse_container_labels_client_root_redirection_enabled: "{{ matrix_synapse_container_labels_client_root_redirection_url != '' }}" +matrix_synapse_container_labels_client_root_redirection_url: "{{ (('https://' if matrix_playbook_ssl_enabled else 'http://') + matrix_server_fqn_element) if matrix_client_element_enabled else '' }}" + +matrix_synapse_container_labels_federation_api_traefik_entrypoints: "{{ matrix_federation_traefik_entrypoint }}" + # For exposing the Synapse worker (and metrics) ports to the local host. matrix_synapse_workers_container_host_bind_address: "{{ matrix_playbook_service_host_bind_interface_prefix[0:-1] if (matrix_synapse_workers_enabled and matrix_playbook_service_host_bind_interface_prefix) else '' }}" @@ -3816,8 +3833,7 @@ matrix_synapse_database_password: "{{ '%s' | format(matrix_homeserver_generic_se matrix_synapse_macaroon_secret_key: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'synapse.mac', rounds=655555) | to_uuid }}" -# We do not enable TLS in Synapse by default. -# TLS is handled by the matrix-nginx-proxy, which proxies the requests to Synapse. +# We do not enable TLS in Synapse by default, since it's handled by Traefik. matrix_synapse_tls_federation_listener_enabled: false matrix_synapse_tls_certificate_path: ~ matrix_synapse_tls_private_key_path: ~ @@ -3858,18 +3874,16 @@ matrix_synapse_turn_shared_secret: "{{ matrix_coturn_turn_static_auth_secret if matrix_synapse_self_check_validate_certificates: "{{ false if matrix_playbook_ssl_retrieval_method == 'self-signed' else true }}" -matrix_synapse_systemd_required_services_list: | +matrix_synapse_systemd_required_services_list_auto: | {{ - (['docker.service']) - + - ([devture_postgres_identifier ~ '.service'] if devture_postgres_enabled else []) + ([devture_postgres_identifier ~ '.service'] if (devture_postgres_enabled and devture_postgres_container_network != matrix_synapse_container_network and matrix_synapse_database_host == devture_postgres_connection_hostname) else []) + ([redis_identifier ~ '.service'] if matrix_synapse_redis_enabled and matrix_synapse_redis_host == redis_identifier else []) + (['matrix-goofys.service'] if matrix_s3_media_store_enabled else []) }} -matrix_synapse_systemd_wanted_services_list: | +matrix_synapse_systemd_wanted_services_list_auto: | {{ (['matrix-coturn.service'] if matrix_coturn_enabled else []) + @@ -3943,7 +3957,7 @@ matrix_synapse_reverse_proxy_companion_container_network: "{{ matrix_synapse_con matrix_synapse_reverse_proxy_companion_container_additional_networks: | {{ ( - ([matrix_playbook_reverse_proxyable_services_additional_network] if matrix_playbook_reverse_proxyable_services_additional_network else []) + ([matrix_playbook_reverse_proxyable_services_additional_network] if matrix_synapse_reverse_proxy_companion_container_labels_traefik_enabled and matrix_playbook_reverse_proxyable_services_additional_network else []) + ([] if matrix_homeserver_container_network in ['', matrix_synapse_reverse_proxy_companion_container_network] else [matrix_homeserver_container_network]) ) | unique @@ -3960,15 +3974,11 @@ matrix_synapse_reverse_proxy_companion_container_labels_traefik_entrypoints: "{{ matrix_synapse_reverse_proxy_companion_container_labels_traefik_tls_certResolver: "{{ devture_traefik_certResolver_primary }}" matrix_synapse_reverse_proxy_companion_container_labels_traefik_hostname: "{{ matrix_server_fqn_matrix }}" -matrix_synapse_reverse_proxy_companion_container_labels_client_root_redirection_enabled: "{{ matrix_synapse_reverse_proxy_companion_container_labels_client_root_redirection_url != '' }}" -matrix_synapse_reverse_proxy_companion_container_labels_client_root_redirection_url: "{{ (('https://' if matrix_playbook_ssl_enabled else 'http://') + matrix_server_fqn_element) if matrix_client_element_enabled else '' }}" - -# TODO - enable these (and potentially remove them above/below), when they land in matrix-synapse -# matrix_synapse_reverse_proxy_companion_container_labels_client_root_redirection_enabled: "{{ matrix_synapse_container_labels_client_root_redirection_enabled != '' }}" -# matrix_synapse_reverse_proxy_companion_container_labels_client_root_redirection_url: "{{ matrix_synapse_container_labels_client_root_redirection_url }}" -# matrix_synapse_reverse_proxy_companion_container_labels_client_synapse_client_api_enabled: "{{ matrix_synapse_container_labels_client_synapse_client_api_enabled }}" -# matrix_synapse_reverse_proxy_companion_container_labels_client_synapse_oidc_api_enabled: "{{ matrix_synapse_container_labels_client_synapse_oidc_api_enabled }}" -# matrix_synapse_reverse_proxy_companion_container_labels_client_synapse_admin_api_enabled: "{{ matrix_synapse_container_labels_client_synapse_admin_api_enabled }}" +matrix_synapse_reverse_proxy_companion_container_labels_client_root_redirection_enabled: "{{ matrix_synapse_container_labels_client_root_redirection_enabled != '' }}" +matrix_synapse_reverse_proxy_companion_container_labels_client_root_redirection_url: "{{ matrix_synapse_container_labels_client_root_redirection_url }}" +matrix_synapse_reverse_proxy_companion_container_labels_client_synapse_client_api_enabled: "{{ matrix_synapse_container_labels_client_synapse_client_api_enabled }}" +matrix_synapse_reverse_proxy_companion_container_labels_client_synapse_oidc_api_enabled: "{{ matrix_synapse_container_labels_client_synapse_oidc_api_enabled }}" +matrix_synapse_reverse_proxy_companion_container_labels_client_synapse_admin_api_enabled: "{{ matrix_synapse_container_labels_client_synapse_admin_api_enabled }}" matrix_synapse_reverse_proxy_companion_container_labels_federation_api_traefik_entrypoints: "{{ matrix_federation_traefik_entrypoint }}" diff --git a/roles/custom/matrix-synapse/defaults/main.yml b/roles/custom/matrix-synapse/defaults/main.yml index b08980033..5634864f2 100644 --- a/roles/custom/matrix-synapse/defaults/main.yml +++ b/roles/custom/matrix-synapse/defaults/main.yml @@ -156,6 +156,88 @@ matrix_synapse_container_metrics_api_host_bind_port: '' # Takes an ":" or "" value (e.g. "127.0.0.1:9100"), or empty string to not expose. matrix_synapse_container_manhole_api_host_bind_port: '' +# matrix_synapse_container_labels_traefik_enabled controls whether labels to assist a Traefik reverse-proxy will be attached to the container. +# See `../templates/labels.j2` for details. +# +# To inject your own other container labels, see `matrix_synapse_container_labels_additional_labels`. +matrix_synapse_container_labels_traefik_enabled: true +matrix_synapse_container_labels_traefik_docker_network: "{{ matrix_synapse_container_network }}" +matrix_synapse_container_labels_traefik_entrypoints: web-secure +matrix_synapse_container_labels_traefik_tls_certResolver: default # noqa var-naming +matrix_synapse_container_labels_traefik_hostname: '' + +# Controls whether labels will be added for handling the root (/) path +matrix_synapse_container_labels_client_root_enabled: true +matrix_synapse_container_labels_client_root_traefik_hostname: "{{ matrix_synapse_container_labels_traefik_hostname }}" +matrix_synapse_container_labels_client_root_traefik_rule: "Host(`{{ matrix_synapse_container_labels_client_root_traefik_hostname }}`) && Path(`/`)" +matrix_synapse_container_labels_client_root_traefik_priority: 0 +matrix_synapse_container_labels_client_root_traefik_entrypoints: "{{ matrix_synapse_container_labels_traefik_entrypoints }}" +matrix_synapse_container_labels_client_root_traefik_tls: "{{ matrix_synapse_container_labels_client_root_traefik_entrypoints != 'web' }}" +matrix_synapse_container_labels_client_root_traefik_tls_certResolver: "{{ matrix_synapse_container_labels_traefik_tls_certResolver }}" # noqa var-naming +matrix_synapse_container_labels_client_root_redirection_enabled: false +matrix_synapse_container_labels_client_root_redirection_url: "" + +# Controls whether labels will be added that expose the Client-Server API. +matrix_synapse_container_labels_client_api_enabled: true +matrix_synapse_container_labels_client_api_traefik_hostname: "{{ matrix_synapse_container_labels_traefik_hostname }}" +matrix_synapse_container_labels_client_api_traefik_path_prefix: /_matrix +matrix_synapse_container_labels_client_api_traefik_rule: "Host(`{{ matrix_synapse_container_labels_client_api_traefik_hostname }}`) && PathPrefix(`{{ matrix_synapse_container_labels_client_api_traefik_path_prefix }}`)" +matrix_synapse_container_labels_client_api_traefik_priority: 0 +matrix_synapse_container_labels_client_api_traefik_entrypoints: "{{ matrix_synapse_container_labels_traefik_entrypoints }}" +matrix_synapse_container_labels_client_api_traefik_tls: "{{ matrix_synapse_container_labels_client_api_traefik_entrypoints != 'web' }}" +matrix_synapse_container_labels_client_api_traefik_tls_certResolver: "{{ matrix_synapse_container_labels_traefik_tls_certResolver }}" # noqa var-naming + +# Controls whether labels will be added that expose the /_synapse/client paths +matrix_synapse_container_labels_client_synapse_client_api_enabled: true +matrix_synapse_container_labels_client_synapse_client_api_traefik_hostname: "{{ matrix_synapse_container_labels_traefik_hostname }}" +matrix_synapse_container_labels_client_synapse_client_api_traefik_path_prefix: /_synapse/client +matrix_synapse_container_labels_client_synapse_client_api_traefik_rule: "Host(`{{ matrix_synapse_container_labels_client_synapse_client_api_traefik_hostname }}`) && PathPrefix(`{{ matrix_synapse_container_labels_client_synapse_client_api_traefik_path_prefix }}`)" +matrix_synapse_container_labels_client_synapse_client_api_traefik_priority: 0 +matrix_synapse_container_labels_client_synapse_client_api_traefik_entrypoints: "{{ matrix_synapse_container_labels_traefik_entrypoints }}" +matrix_synapse_container_labels_client_synapse_client_api_traefik_tls: "{{ matrix_synapse_container_labels_client_synapse_client_api_traefik_entrypoints != 'web' }}" +matrix_synapse_container_labels_client_synapse_client_api_traefik_tls_certResolver: "{{ matrix_synapse_container_labels_traefik_tls_certResolver }}" # noqa var-naming + +# Controls whether labels will be added that expose the /_synapse/oidc paths +# Enable this if you need OpenID Connect authentication support. +matrix_synapse_container_labels_client_synapse_oidc_api_enabled: false +matrix_synapse_container_labels_client_synapse_oidc_api_traefik_hostname: "{{ matrix_synapse_container_labels_traefik_hostname }}" +matrix_synapse_container_labels_client_synapse_oidc_api_traefik_path_prefix: /_synapse/oidc +matrix_synapse_container_labels_client_synapse_oidc_api_traefik_rule: "Host(`{{ matrix_synapse_container_labels_client_synapse_oidc_api_traefik_hostname }}`) && PathPrefix(`{{ matrix_synapse_container_labels_client_synapse_oidc_api_traefik_path_prefix }}`)" +matrix_synapse_container_labels_client_synapse_oidc_api_traefik_priority: 0 +matrix_synapse_container_labels_client_synapse_oidc_api_traefik_entrypoints: "{{ matrix_synapse_container_labels_traefik_entrypoints }}" +matrix_synapse_container_labels_client_synapse_oidc_api_traefik_tls: "{{ matrix_synapse_container_labels_client_synapse_oidc_api_traefik_entrypoints != 'web' }}" +matrix_synapse_container_labels_client_synapse_oidc_api_traefik_tls_certResolver: "{{ matrix_synapse_container_labels_traefik_tls_certResolver }}" # noqa var-naming + +# Controls whether labels will be added that expose the /_synapse/admin paths +# Following these recommendations (https://github.com/matrix-org/synapse/blob/master/docs/reverse_proxy.md), by default, we don't. +matrix_synapse_container_labels_client_synapse_admin_api_enabled: false +matrix_synapse_container_labels_client_synapse_admin_api_traefik_hostname: "{{ matrix_synapse_container_labels_traefik_hostname }}" +matrix_synapse_container_labels_client_synapse_admin_api_traefik_path_prefix: /_synapse/admin +matrix_synapse_container_labels_client_synapse_admin_api_traefik_rule: "Host(`{{ matrix_synapse_container_labels_client_synapse_admin_api_traefik_hostname }}`) && PathPrefix(`{{ matrix_synapse_container_labels_client_synapse_admin_api_traefik_path_prefix }}`)" +matrix_synapse_container_labels_client_synapse_admin_api_traefik_priority: 0 +matrix_synapse_container_labels_client_synapse_admin_api_traefik_entrypoints: "{{ matrix_synapse_container_labels_traefik_entrypoints }}" +matrix_synapse_container_labels_client_synapse_admin_api_traefik_tls: "{{ matrix_synapse_container_labels_client_synapse_admin_api_traefik_entrypoints != 'web' }}" +matrix_synapse_container_labels_client_synapse_admin_api_traefik_tls_certResolver: "{{ matrix_synapse_container_labels_traefik_tls_certResolver }}" # noqa var-naming + +# Controls whether labels will be added that expose the Server-Server API (Federation API). +matrix_synapse_container_labels_federation_api_enabled: "{{ matrix_synapse_reverse_proxy_companion_federation_api_enabled }}" +matrix_synapse_container_labels_federation_api_traefik_hostname: "{{ matrix_synapse_container_labels_traefik_hostname }}" +matrix_synapse_container_labels_federation_api_traefik_path_prefix: /_matrix +matrix_synapse_container_labels_federation_api_traefik_rule: "Host(`{{ matrix_synapse_container_labels_federation_api_traefik_hostname }}`) && PathPrefix(`{{ matrix_synapse_container_labels_federation_api_traefik_path_prefix }}`)" +matrix_synapse_container_labels_federation_api_traefik_priority: 0 +matrix_synapse_container_labels_federation_api_traefik_entrypoints: '' +matrix_synapse_container_labels_federation_api_traefik_tls: "{{ matrix_synapse_container_labels_federation_api_traefik_entrypoints != 'web' }}" +matrix_synapse_container_labels_federation_api_traefik_tls_certResolver: "{{ matrix_synapse_container_labels_traefik_tls_certResolver }}" # noqa var-naming + +# matrix_synapse_container_labels_additional_labels contains a multiline string with additional labels to add to the container label file. +# See `../templates/labels.j2` for details. +# +# Example: +# matrix_synapse_container_labels_additional_labels: | +# my.label=1 +# another.label="here" +matrix_synapse_container_labels_additional_labels: '' + # A list of extra arguments to pass to the container # Also see `matrix_synapse_container_arguments` matrix_synapse_container_extra_arguments: [] @@ -171,10 +253,16 @@ matrix_synapse_container_extra_arguments_auto: [] matrix_synapse_container_arguments: "{{ matrix_synapse_container_extra_arguments + matrix_synapse_container_extra_arguments_auto }}" # List of systemd services that matrix-synapse.service depends on -matrix_synapse_systemd_required_services_list: ['docker.service'] +matrix_synapse_systemd_required_services_list: "{{ matrix_synapse_systemd_required_services_list_default + matrix_synapse_systemd_required_services_list_auto + matrix_synapse_systemd_required_services_list_custom }}" +matrix_synapse_systemd_required_services_list_default: ['docker.service'] +matrix_synapse_systemd_required_services_list_auto: [] +matrix_synapse_systemd_required_services_list_custom: [] # List of systemd services that matrix-synapse.service wants -matrix_synapse_systemd_wanted_services_list: [] +matrix_synapse_systemd_wanted_services_list: "{{ matrix_synapse_systemd_wanted_services_list_default + matrix_synapse_systemd_wanted_services_list_auto + matrix_synapse_systemd_wanted_services_list_custom }}" +matrix_synapse_systemd_wanted_services_list_default: [] +matrix_synapse_systemd_wanted_services_list_auto: [] +matrix_synapse_systemd_wanted_services_list_custom: [] matrix_synapse_in_container_python_packages_path: "/usr/local/lib/python3.11/site-packages" diff --git a/roles/custom/matrix-synapse/tasks/synapse/setup_install.yml b/roles/custom/matrix-synapse/tasks/synapse/setup_install.yml index 7bdf5ddc8..fab610464 100644 --- a/roles/custom/matrix-synapse/tasks/synapse/setup_install.yml +++ b/roles/custom/matrix-synapse/tasks/synapse/setup_install.yml @@ -115,28 +115,29 @@ owner: "{{ matrix_synapse_uid }}" group: "{{ matrix_synapse_gid }}" -- name: Ensure Synapse log config installed - ansible.builtin.template: - src: "{{ matrix_synapse_template_synapse_log }}" - dest: "{{ matrix_synapse_config_dir_path }}/{{ matrix_server_fqn_matrix }}.log.config" - mode: 0644 - - name: Ensure Synapse container network is created community.general.docker_network: name: "{{ matrix_synapse_container_network }}" driver: bridge -- name: Ensure matrix-synapse.service installed +- name: Ensure Synapse support files installed ansible.builtin.template: - src: "{{ role_path }}/templates/synapse/systemd/matrix-synapse.service.j2" - dest: "{{ devture_systemd_docker_base_systemd_path }}/matrix-synapse.service" - mode: 0644 - -- name: Ensure register-user script created - ansible.builtin.template: - src: "{{ role_path }}/templates/synapse/bin/register-user.j2" - dest: "{{ matrix_synapse_bin_path }}/register-user" - mode: 0755 + src: "{{ item.src }}" + dest: "{{ item.dest }}" + mode: "{{ item.mode }}" + with_items: + - src: "{{ matrix_synapse_template_synapse_log }}" + dest: "{{ matrix_synapse_config_dir_path }}/{{ matrix_server_fqn_matrix }}.log.config" + mode: '0644' + - src: "{{ role_path }}/templates/synapse/bin/register-user.j2" + dest: "{{ matrix_synapse_bin_path }}/register-user" + mode: '0755' + - src: "{{ role_path }}/templates/synapse/labels.j2" + dest: "{{ matrix_synapse_base_path }}/labels" + mode: '0644' + - src: "{{ role_path }}/templates/synapse/systemd/matrix-synapse.service.j2" + dest: "{{ devture_systemd_docker_base_systemd_path }}/matrix-synapse.service" + mode: '0644' - name: Generate sample prometheus.yml for external scraping ansible.builtin.template: diff --git a/roles/custom/matrix-synapse/tasks/validate_config.yml b/roles/custom/matrix-synapse/tasks/validate_config.yml index 64397a493..0f6dec888 100644 --- a/roles/custom/matrix-synapse/tasks/validate_config.yml +++ b/roles/custom/matrix-synapse/tasks/validate_config.yml @@ -3,18 +3,30 @@ - name: Fail if required Synapse settings not defined ansible.builtin.fail: msg: >- - You need to define a required configuration setting (`{{ item }}`) for using Synapse. - when: "vars[item] == ''" + You need to define a required configuration setting (`{{ item.name }}`). + when: "item.when | bool and vars[item.name] == ''" with_items: - - matrix_synapse_username - - matrix_synapse_uid - - matrix_synapse_gid - - matrix_synapse_container_network - - matrix_synapse_macaroon_secret_key - - matrix_synapse_database_host - - matrix_synapse_database_user - - matrix_synapse_database_password - - matrix_synapse_database_database + - {'name': 'matrix_synapse_username', when: true} + - {'name': 'matrix_synapse_uid', when: true} + - {'name': 'matrix_synapse_gid', when: true} + - {'name': 'matrix_synapse_container_network', when: true} + - {'name': 'matrix_synapse_macaroon_secret_key', when: true} + - {'name': 'matrix_synapse_database_host', when: true} + - {'name': 'matrix_synapse_database_user', when: true} + - {'name': 'matrix_synapse_database_password', when: true} + - {'name': 'matrix_synapse_database_database', when: true} + + - {'name': 'matrix_synapse_container_labels_client_root_traefik_hostname', when: "{{ matrix_synapse_container_labels_client_root_enabled }}"} + - {'name': 'matrix_synapse_container_labels_client_root_redirection_url', when: "{{ matrix_synapse_container_labels_client_root_redirection_enabled }}"} + + - {'name': 'matrix_synapse_container_labels_client_api_traefik_hostname', when: "{{ matrix_synapse_container_labels_client_api_enabled }}"} + + - {'name': 'matrix_synapse_container_labels_client_synapse_client_api_traefik_hostname', when: "{{ matrix_synapse_container_labels_client_synapse_client_api_enabled }}"} + - {'name': 'matrix_synapse_container_labels_client_synapse_oidc_api_traefik_hostname', when: "{{ matrix_synapse_container_labels_client_synapse_oidc_api_enabled }}"} + - {'name': 'matrix_synapse_container_labels_client_synapse_admin_api_traefik_hostname', when: "{{ matrix_synapse_container_labels_client_synapse_admin_api_enabled }}"} + + - {'name': 'matrix_synapse_container_labels_federation_api_traefik_hostname', when: "{{ matrix_synapse_container_labels_federation_api_enabled }}"} + - {'name': 'matrix_synapse_container_labels_federation_api_traefik_entrypoints', when: "{{ matrix_synapse_container_labels_federation_api_enabled }}"} - name: Fail if asking for more than 1 instance of single-instance workers ansible.builtin.fail: diff --git a/roles/custom/matrix-synapse/templates/synapse/labels.j2 b/roles/custom/matrix-synapse/templates/synapse/labels.j2 new file mode 100644 index 000000000..8dc0be9e6 --- /dev/null +++ b/roles/custom/matrix-synapse/templates/synapse/labels.j2 @@ -0,0 +1,176 @@ +{% if matrix_synapse_container_labels_traefik_enabled %} +traefik.enable=true + +{% if matrix_synapse_container_labels_traefik_docker_network %} +traefik.docker.network={{ matrix_synapse_container_labels_traefik_docker_network }} +{% endif %} + +traefik.http.services.matrix-synapse-client-api.loadbalancer.server.port=8008 +traefik.http.services.matrix-synapse-federation-api.loadbalancer.server.port=8048 + + +{# + Root path (/) +#} +{% if matrix_synapse_container_labels_client_root_enabled %} + +{% set client_root_middlewares = [] %} + +{% if matrix_synapse_container_labels_client_root_redirection_enabled %} +{% set client_root_middlewares = client_root_middlewares + ['matrix-synapse-client-root-redirect'] %} +traefik.http.middlewares.matrix-synapse-client-root-redirect.redirectregex.regex=(.*) +traefik.http.middlewares.matrix-synapse-client-root-redirect.redirectregex.replacement={{ matrix_synapse_container_labels_client_root_redirection_url }} +{% else %} +{% set client_root_middlewares = client_root_middlewares + ['matrix-synapse-client-root-replacepath'] %} +traefik.http.middlewares.matrix-synapse-client-root-replacepath.replacepath.path=/_matrix/static/ +{% endif %} + +traefik.http.routers.matrix-synapse-client-root.rule={{ matrix_synapse_container_labels_client_root_traefik_rule }} + +traefik.http.routers.matrix-synapse-client-root.middlewares={{ client_root_middlewares | join(',') }} + +{% if matrix_synapse_container_labels_client_root_traefik_priority | int > 0 %} +traefik.http.routers.matrix-synapse-client-root.priority={{ matrix_synapse_container_labels_client_root_traefik_priority }} +{% endif %} + +traefik.http.routers.matrix-synapse-client-root.service=matrix-synapse-client-api +traefik.http.routers.matrix-synapse-client-root.entrypoints={{ matrix_synapse_container_labels_client_root_traefik_entrypoints }} +traefik.http.routers.matrix-synapse-client-root.tls={{ matrix_synapse_container_labels_client_root_traefik_tls | to_json }} + +{% if matrix_synapse_container_labels_client_root_traefik_tls %} +traefik.http.routers.matrix-synapse-client-root.tls.certResolver={{ matrix_synapse_container_labels_client_root_traefik_tls_certResolver }} +{% endif %} + +{% endif %} +{# + /Root path (/) +#} + + +{# + Client-API (/_matrix) +#} +{% if matrix_synapse_container_labels_client_api_enabled %} + +traefik.http.routers.matrix-synapse-client-api.rule={{ matrix_synapse_container_labels_client_api_traefik_rule }} + +{% if matrix_synapse_container_labels_client_api_traefik_priority | int > 0 %} +traefik.http.routers.matrix-synapse-client-api.priority={{ matrix_synapse_container_labels_client_api_traefik_priority }} +{% endif %} + +traefik.http.routers.matrix-synapse-client-api.service=matrix-synapse-client-api +traefik.http.routers.matrix-synapse-client-api.entrypoints={{ matrix_synapse_container_labels_client_api_traefik_entrypoints }} +traefik.http.routers.matrix-synapse-client-api.tls={{ matrix_synapse_container_labels_client_api_traefik_tls | to_json }} + +{% if matrix_synapse_container_labels_client_api_traefik_tls %} +traefik.http.routers.matrix-synapse-client-api.tls.certResolver={{ matrix_synapse_container_labels_client_api_traefik_tls_certResolver }} +{% endif %} + +{% endif %} +{# + /Client-API (/_matrix) +#} + + +{# + Synapse Admin API (/_synapse/client) +#} +{% if matrix_synapse_container_labels_client_synapse_client_api_enabled %} + +traefik.http.routers.matrix-synapse-client-synapse-client-api.rule={{ matrix_synapse_container_labels_client_synapse_client_api_traefik_rule }} + +{% if matrix_synapse_container_labels_client_synapse_client_api_traefik_priority | int > 0 %} +traefik.http.routers.matrix-synapse-client-synapse-client-api.priority={{ matrix_synapse_container_labels_client_synapse_client_api_traefik_priority }} +{% endif %} + +traefik.http.routers.matrix-synapse-client-synapse-client-api.service=matrix-synapse-client-synapse-client-api +traefik.http.routers.matrix-synapse-client-synapse-client-api.entrypoints={{ matrix_synapse_container_labels_client_synapse_client_api_traefik_entrypoints }} +traefik.http.routers.matrix-synapse-client-synapse-client-api.tls={{ matrix_synapse_container_labels_client_synapse_client_api_traefik_tls | to_json }} + +{% if matrix_synapse_container_labels_client_synapse_client_api_traefik_tls %} +traefik.http.routers.matrix-synapse-client-synapse-client-api.tls.certResolver={{ matrix_synapse_container_labels_client_synapse_client_api_traefik_tls_certResolver }} +{% endif %} + +{% endif %} +{# + /Synapse Admin API (/_synapse/client) +#} + + +{# + Synapse OIDC API (/_synapse/oidc) +#} +{% if matrix_synapse_container_labels_client_synapse_oidc_api_enabled %} + +traefik.http.routers.matrix-synapse-client-synapse-oidc-api.rule={{ matrix_synapse_container_labels_client_synapse_oidc_api_traefik_rule }} + +{% if matrix_synapse_container_labels_client_synapse_oidc_api_traefik_priority | int > 0 %} +traefik.http.routers.matrix-synapse-client-synapse-oidc-api.priority={{ matrix_synapse_container_labels_client_synapse_oidc_api_traefik_priority }} +{% endif %} + +traefik.http.routers.matrix-synapse-client-synapse-oidc-api.service=matrix-synapse-client-synapse-oidc-api +traefik.http.routers.matrix-synapse-client-synapse-oidc-api.entrypoints={{ matrix_synapse_container_labels_client_synapse_oidc_api_traefik_entrypoints }} +traefik.http.routers.matrix-synapse-client-synapse-oidc-api.tls={{ matrix_synapse_container_labels_client_synapse_oidc_api_traefik_tls | to_json }} + +{% if matrix_synapse_container_labels_client_synapse_oidc_api_traefik_tls %} +traefik.http.routers.matrix-synapse-client-synapse-oidc-api.tls.certResolver={{ matrix_synapse_container_labels_client_synapse_oidc_api_traefik_tls_certResolver }} +{% endif %} + +{% endif %} +{# + /Synapse OIDC API (/_synapse/oidc) +#} + + +{# + Synapse Admin API (/_synapse/admin) +#} +{% if matrix_synapse_container_labels_client_synapse_admin_api_enabled %} + +traefik.http.routers.matrix-synapse-client-synapse-admin-api.rule={{ matrix_synapse_container_labels_client_synapse_admin_api_traefik_rule }} + +{% if matrix_synapse_container_labels_client_synapse_admin_api_traefik_priority | int > 0 %} +traefik.http.routers.matrix-synapse-client-synapse-admin-api.priority={{ matrix_synapse_container_labels_client_synapse_admin_api_traefik_priority }} +{% endif %} + +traefik.http.routers.matrix-synapse-client-synapse-admin-api.service=matrix-synapse-client-synapse-admin-api +traefik.http.routers.matrix-synapse-client-synapse-admin-api.entrypoints={{ matrix_synapse_container_labels_client_synapse_admin_api_traefik_entrypoints }} +traefik.http.routers.matrix-synapse-client-synapse-admin-api.tls={{ matrix_synapse_container_labels_client_synapse_admin_api_traefik_tls | to_json }} + +{% if matrix_synapse_container_labels_client_synapse_admin_api_traefik_tls %} +traefik.http.routers.matrix-synapse-client-synapse-admin-api.tls.certResolver={{ matrix_synapse_container_labels_client_synapse_admin_api_traefik_tls_certResolver }} +{% endif %} + +{% endif %} +{# + /Synapse Admin API (/_synapse/admin) +#} + + +{# + Federation-API (/_matrix) +#} +{% if matrix_synapse_container_labels_federation_api_enabled %} + +traefik.http.routers.matrix-synapse-federation-api.rule={{ matrix_synapse_container_labels_federation_api_traefik_rule }} + +{% if matrix_synapse_container_labels_federation_api_traefik_priority | int > 0 %} +traefik.http.routers.matrix-synapse-federation-api.priority={{ matrix_synapse_container_labels_federation_api_traefik_priority }} +{% endif %} + +traefik.http.routers.matrix-synapse-federation-api.service=matrix-synapse-federation-api +traefik.http.routers.matrix-synapse-federation-api.entrypoints={{ matrix_synapse_container_labels_federation_api_traefik_entrypoints }} +traefik.http.routers.matrix-synapse-federation-api.tls={{ matrix_synapse_container_labels_federation_api_traefik_tls | to_json }} + +{% if matrix_synapse_container_labels_federation_api_traefik_tls %} +traefik.http.routers.matrix-synapse-federation-api.tls.certResolver={{ matrix_synapse_container_labels_federation_api_traefik_tls_certResolver }} +{% endif %} + +{% endif %} +{# + /Federation-API (/_matrix) +#} + +{% endif %} + +{{ matrix_synapse_container_labels_additional_labels }} diff --git a/roles/custom/matrix-synapse/templates/synapse/systemd/matrix-synapse.service.j2 b/roles/custom/matrix-synapse/templates/synapse/systemd/matrix-synapse.service.j2 index 27bc54e93..f44ebeb2d 100644 --- a/roles/custom/matrix-synapse/templates/synapse/systemd/matrix-synapse.service.j2 +++ b/roles/custom/matrix-synapse/templates/synapse/systemd/matrix-synapse.service.j2 @@ -56,6 +56,7 @@ ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} create \ {% endif %} --mount type=bind,src={{ matrix_synapse_config_dir_path }},dst=/data,ro \ --mount type=bind,src={{ matrix_synapse_storage_path }},dst=/matrix-media-store-parent,bind-propagation=slave \ + --label-file={{ matrix_synapse_base_path }}/labels \ {% for volume in matrix_synapse_container_additional_volumes %} -v {{ volume.src }}:{{ volume.dst }}:{{ volume.options }} \ {% endfor %}