Add initial role for Dendrite as alternative Matrix server

roles/matrix-dendrite/tasks/dendrite/setup.yml

@@ -0,0 +1,6 @@
+---
+- import_tasks: "{{ role_path }}/tasks/dendrite/setup_install.yml"
+  when: matrix_dendrite_enabled|bool
+
+- import_tasks: "{{ role_path }}/tasks/dendrite/setup_uninstall.yml"
+  when: "not matrix_dendrite_enabled|bool"

roles/matrix-dendrite/tasks/dendrite/setup_install.yml

@@ -0,0 +1,85 @@
+---
+# This will throw a Permission Denied error if already mounted using fuse
+- name: Check Dendrite media store path
+  stat:
+    path: "{{ matrix_dendrite_media_store_path }}"
+  register: local_path_media_store_stat
+  ignore_errors: yes
+
+# This is separate and conditional, to ensure we don't execute it
+# if the path already exists or we failed to check, because it's mounted using fuse.
+- name: Ensure Dendrite media store path exists
+  file:
+    path: "{{ matrix_dendrite_media_store_path }}"
+    state: directory
+    mode: 0750
+    owner: "{{ matrix_user_username }}"
+    group: "{{ matrix_user_groupname }}"
+  when: "not local_path_media_store_stat.failed and not local_path_media_store_stat.stat.exists"
+
+- name: Ensure Dendrite log path exists
+  file:
+    path: "{{ matrix_dendrite_log_path }}"
+    state: directory
+    mode: 0644
+    owner: "{{ matrix_user_username }}"
+    group: "{{ matrix_user_groupname }}"
+
+- name: Ensure Dendrite Docker image is pulled
+  docker_image:
+    name: "{{ matrix_dendrite_docker_image }}"
+    source: "{{ 'pull' if ansible_version.major > 2 or ansible_version.minor > 7 else omit }}"
+    force_source: "{{ matrix_dendrite_docker_image_force_pull if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}"
+    force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else matrix_dendrite_docker_image_force_pull }}"
+
+- name: Check if a Dendrite signing key exists
+  stat:
+    path: "{{ matrix_dendrite_config_dir_path }}/{{ matrix_server_fqn_matrix }}.signing.pem"
+  register: matrix_dendrite_signing_key_stat
+
+# We do this so that the signing key would get generated.
+# We don't use the `docker_container` module, because using it with `cap_drop` requires
+# a very recent version, which is not available for a lot of people yet.
+- name: Generate Dendrite signing key
+  command: |
+    docker run
+    --rm
+    --name=matrix-config
+    --entrypoint=generate-keys
+    --mount type=bind,src={{ matrix_dendrite_config_dir_path }},dst=/data
+    {{ matrix_dendrite_docker_image }} --private-key=/data/{{ matrix_server_fqn_matrix }}.signing.pem
+    generate
+  when: "not matrix_dendrite_signing_key_stat.stat.exists"
+
+- name: Ensure Dendrite server key exists
+  file:
+    path: "{{ matrix_dendrite_config_dir_path }}/{{ matrix_server_fqn_matrix }}.signing.pem"
+    mode: 0644
+    owner: "{{ matrix_user_username }}"
+    group: "{{ matrix_user_groupname }}"
+
+- name: Ensure Dendrite configuration installed
+  copy:
+    content: "{{ matrix_dendrite_configuration|to_nice_yaml }}"
+    dest: "{{ matrix_dendrite_config_dir_path }}/dendrite.yaml"
+    mode: 0644
+    owner: "{{ matrix_user_username }}"
+    group: "{{ matrix_user_groupname }}"
+
+- name: Ensure matrix-dendrite.service installed
+  template:
+    src: "{{ role_path }}/templates/dendrite/systemd/matrix-dendrite.service.j2"
+    dest: "{{ matrix_systemd_path }}/matrix-dendrite.service"
+    mode: 0644
+  register: matrix_dendrite_systemd_service_result
+
+- name: Ensure systemd reloaded after matrix-dendrite.service installation
+  service:
+    daemon_reload: yes
+  when: "matrix_dendrite_systemd_service_result.changed"
+
+- name: Ensure matrix-dendrite-create-account script created
+  template:
+    src: "{{ role_path }}/templates/dendrite/usr-local-bin/matrix-dendrite-create-account.j2"
+    dest: "{{ matrix_local_bin_path }}/matrix-dendrite-create-account"
+    mode: 0750

roles/matrix-dendrite/tasks/dendrite/setup_uninstall.yml

@@ -0,0 +1,28 @@
+- name: Check existence of matrix-dendrite service
+  stat:
+    path: "{{ matrix_systemd_path }}/matrix-dendrite.service"
+  register: matrix_dendrite_service_stat
+
+- name: Ensure matrix-dendrite is stopped
+  service:
+    name: matrix-dendrite
+    state: stopped
+    daemon_reload: yes
+  register: stopping_result
+  when: "matrix_dendrite_service_stat.stat.exists"
+
+- name: Ensure matrix-dendrite.service doesn't exist
+  file:
+    path: "{{ matrix_systemd_path }}/matrix-dendrite.service"
+    state: absent
+  when: "matrix_dendrite_service_stat.stat.exists"
+
+- name: Ensure systemd reloaded after matrix-dendrite.service removal
+  service:
+    daemon_reload: yes
+  when: "matrix_dendrite_service_stat.stat.exists"
+
+- name: Ensure Dendrite Docker image doesn't exist
+  docker_image:
+    name: "{{ matrix_dendrite_docker_image }}"
+    state: absent

roles/matrix-dendrite/tasks/goofys/setup.yml

@@ -0,0 +1,7 @@
+---
+
+- import_tasks: "{{ role_path }}/tasks/goofys/setup_install.yml"
+  when: matrix_s3_media_store_enabled|bool
+
+- import_tasks: "{{ role_path }}/tasks/goofys/setup_uninstall.yml"
+  when: "not matrix_s3_media_store_enabled|bool"

roles/matrix-dendrite/tasks/goofys/setup_install.yml

@@ -0,0 +1,41 @@
+- name: Ensure Goofys Docker image is pulled
+  docker_image:
+    name: "{{ matrix_s3_goofys_docker_image }}"
+    source: "{{ 'pull' if ansible_version.major > 2 or ansible_version.minor > 7 else omit }}"
+    force_source: "{{ matrix_s3_goofys_docker_image_force_pull if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}"
+    force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else matrix_s3_goofys_docker_image_force_pull }}"
+
+# This will throw a Permission Denied error if already mounted
+- name: Check Matrix Goofys external storage mountpoint path
+  stat:
+    path: "{{ matrix_dendrite_media_store_path }}"
+  register: local_path_matrix_dendrite_media_store_path_stat
+  ignore_errors: yes
+
+- name: Ensure Matrix Goofys external storage mountpoint exists
+  file:
+    path: "{{ matrix_dendrite_media_store_path if matrix_dendrite_enabled else matrix_dendrite_media_store_path }}"
+    state: directory
+    mode: 0750
+    owner: "{{ matrix_user_username }}"
+    group: "{{ matrix_user_groupname }}"
+  when: "not local_path_matrix_dendrite_media_store_path_stat.failed and not local_path_matrix_dendrite_media_store_path_stat.stat.exists"
+
+- name: Ensure goofys environment variables file created
+  template:
+    src: "{{ role_path }}/templates/goofys/env-goofys.j2"
+    dest: "{{ matrix_dendrite_config_dir_path }}/env-goofys"
+    owner: root
+    mode: 0600
+
+- name: Ensure matrix-goofys.service installed
+  template:
+    src: "{{ role_path }}/templates/goofys/systemd/matrix-goofys.service.j2"
+    dest: "{{ matrix_systemd_path }}/matrix-goofys.service"
+    mode: 0644
+  register: matrix_goofys_systemd_service_result
+
+- name: Ensure systemd reloaded after matrix-goofys.service installation
+  service:
+    daemon_reload: yes
+  when: "matrix_goofys_systemd_service_result.changed"

roles/matrix-dendrite/tasks/goofys/setup_uninstall.yml

@@ -0,0 +1,33 @@
+- name: Check existence of matrix-goofys service
+  stat:
+    path: "{{ matrix_systemd_path }}/matrix-goofys.service"
+  register: matrix_goofys_service_stat
+
+- name: Ensure matrix-goofys is stopped
+  service:
+    name: matrix-goofys
+    state: stopped
+    daemon_reload: yes
+  register: stopping_result
+  when: "matrix_goofys_service_stat.stat.exists"
+
+- name: Ensure matrix-goofys.service doesn't exist
+  file:
+    path: "{{ matrix_systemd_path }}/matrix-goofys.service"
+    state: absent
+  when: "matrix_goofys_service_stat.stat.exists"
+
+- name: Ensure systemd reloaded after matrix-goofys.service removal
+  service:
+    daemon_reload: yes
+  when: "matrix_goofys_service_stat.stat.exists"
+
+- name: Ensure goofys environment variables file doesn't exist
+  file:
+    path: "{{ matrix_dendrite_config_dir_path }}/env-goofys"
+    state: absent
+
+- name: Ensure Goofys Docker image doesn't exist
+  docker_image:
+    name: "{{ matrix_s3_goofys_docker_image }}"
+    state: absent

roles/matrix-dendrite/tasks/import_media_store.yml

@@ -0,0 +1,81 @@
+---
+# Pre-checks
+
+- name: Fail if playbook called incorrectly
+  fail:
+    msg: "The `server_path_media_store` variable needs to be provided to this playbook, via --extra-vars"
+  when: "server_path_media_store is not defined or server_path_media_store.startswith('<')"
+
+- name: Fail if media store is on Amazon S3
+  fail:
+    msg: "Your media store is on Amazon S3. Due to technical limitations, restoring is not supported."
+  when: matrix_s3_media_store_enabled|bool
+
+- name: Check if the provided media store directory exists
+  stat:
+    path: "{{ server_path_media_store }}"
+  register: server_path_media_store_stat
+
+- name: Fail if provided media store directory doesn't exist on the server
+  fail:
+    msg: "{{ server_path_media_store }} cannot be found on the server"
+  when: "not server_path_media_store_stat.stat.exists or not server_path_media_store_stat.stat.isdir"
+
+- name: Check if media store contains local_content
+  stat:
+    path: "{{ server_path_media_store }}/local_content"
+  register: server_path_media_store_local_content_stat
+
+- name: Check if media store contains remote_content
+  stat:
+    path: "{{ server_path_media_store }}/remote_content"
+  register: server_path_media_store_remote_content_stat
+
+- name: Fail if media store directory doesn't look okay (lacking remote and local content)
+  fail:
+    msg: "{{ server_path_media_store }} contains neither local_content nor remote_content directories. It's most likely a mistake and is not a media store directory."
+  when: "not server_path_media_store_local_content_stat.stat.exists and not server_path_media_store_remote_content_stat.stat.exists"
+
+# Actual import work
+
+- name: Ensure matrix-dendrite is stopped
+  service:
+    name: matrix-dendrite
+    state: stopped
+    daemon_reload: yes
+  register: stopping_result
+
+# This can only work with local files, not if the media store is on Amazon S3,
+# as it won't be accessible in such a case.
+- name: Ensure provided media store directory is synchronized
+  synchronize:
+    src: "{{ server_path_media_store }}/"
+    dest: "{{ matrix_dendrite_media_store_path }}"
+    delete: yes
+    # It's wasteful to preserve owner/group now. We chown below anyway.
+    owner: no
+    group: no
+    times: yes
+  delegate_to: "{{ inventory_hostname }}"
+
+# This is for the generic case and fails in other cases (remote file systems),
+# because in such cases the base path (matrix_dendrite_media_store_path) is a mount point.
+- name: Ensure media store permissions are correct (generic case)
+  file:
+    path: "{{ matrix_dendrite_media_store_path }}"
+    owner: "{{ matrix_user_username }}"
+    group: "{{ matrix_user_groupname }}"
+    recurse: yes
+  when: "not matrix_s3_media_store_enabled|bool"
+
+# We don't chown for Goofys, because due to the way it's mounted,
+# all files become owned by whoever needs to own them.
+
+- name: Ensure Dendrite is started (if it previously was)
+  service:
+    name: "{{ item }}"
+    state: started
+    daemon_reload: yes
+  when: "stopping_result.changed"
+  with_items:
+    - matrix-dendrite

roles/matrix-dendrite/tasks/init.yml

@@ -0,0 +1,12 @@
+- set_fact:
+    matrix_systemd_services_list: "{{ matrix_systemd_services_list + ['matrix-dendrite.service'] }}"
+  when: matrix_dendrite_enabled|bool
+
+- set_fact:
+    matrix_systemd_services_list: "{{ matrix_systemd_services_list + ['matrix-goofys.service'] }}"
+  when: matrix_s3_media_store_enabled|bool
+
+- name: Fail when using also using Synapse
+  fail:
+    msg: "To use Dendrite as your matrix server, you should disable Synapse."
+  when: "matrix_dendrite_enabled and matrix_synapse_enabled"

roles/matrix-dendrite/tasks/main.yml

@@ -0,0 +1,50 @@
+- import_tasks: "{{ role_path }}/tasks/init.yml"
+  tags:
+    - always
+
+- import_tasks: "{{ role_path }}/tasks/validate_config.yml"
+  when: run_setup|bool
+  tags:
+    - setup-all
+    - setup-dendrite
+
+- import_tasks: "{{ role_path }}/tasks/setup_dendrite.yml"
+  when: run_setup|bool
+  tags:
+    - setup-all
+    - setup-dendrite
+
+- import_tasks: "{{ role_path }}/tasks/import_media_store.yml"
+  when: run_dendrite_import_media_store|bool
+  tags:
+    - import-dendrite-media-store
+
+- import_tasks: "{{ role_path }}/tasks/register_user.yml"
+  when: run_dendrite_register_user|bool
+  tags:
+    - register-user
+
+- import_tasks: "{{ role_path }}/tasks/self_check_client_api.yml"
+  delegate_to: 127.0.0.1
+  become: false
+  when: run_self_check|bool
+  tags:
+    - self-check
+
+- import_tasks: "{{ role_path }}/tasks/self_check_federation_api.yml"
+  delegate_to: 127.0.0.1
+  become: false
+  when: run_self_check|bool
+  tags:
+    - self-check
+
+- import_tasks: "{{ role_path }}/tasks/update_user_password.yml"
+  when: run_dendrite_update_user_password|bool
+  tags:
+    - update-user-password
+
+- name: Mark matrix-dendrite role as executed
+  set_fact:
+    matrix_dendrite_role_executed: true
+  tags:
+    - always

roles/matrix-dendrite/tasks/register_user.yml

@@ -0,0 +1,25 @@
+---
+- name: Fail if playbook called incorrectly
+  fail:
+    msg: "The `username` variable needs to be provided to this playbook, via --extra-vars"
+  when: "username is not defined or username == '<your-username>'"
+
+- name: Fail if playbook called incorrectly
+  fail:
+    msg: "The `password` variable needs to be provided to this playbook, via --extra-vars"
+  when: "password is not defined or password == '<your-password>'"
+
+- name: Ensure matrix-dendrite is started
+  service:
+    name: matrix-dendrite
+    state: started
+    daemon_reload: yes
+  register: start_result
+
+- name: Wait a while, so that Dendrite can manage to start
+  pause:
+    seconds: 7
+  when: "start_result.changed"
+
+- name: Register user
+  command: "{{ matrix_local_bin_path }}/matrix-dendrite-create-account {{ username|quote }} {{ password|quote }}"

roles/matrix-dendrite/tasks/self_check_client_api.yml

@@ -0,0 +1,20 @@
+---
+- name: Check Matrix Client API
+  uri:
+    url: "{{ matrix_dendrite_client_api_url_endpoint_public }}"
+    follow_redirects: none
+    validate_certs: "{{ matrix_dendrite_self_check_validate_certificates }}"
+  register: result_matrix_dendrite_client_api
+  ignore_errors: true
+  check_mode: no
+  when: matrix_dendrite_enabled|bool
+
+- name: Fail if Matrix Client API not working
+  fail:
+    msg: "Failed checking Matrix Client API is up at `{{ matrix_server_fqn_matrix }}` (checked endpoint: `{{ matrix_dendrite_client_api_url_endpoint_public }}`). Is Dendrite running? Is port 443 open in your firewall? Full error: {{ result_matrix_dendrite_client_api }}"
+  when: "matrix_dendrite_enabled|bool and (result_matrix_dendrite_client_api.failed or 'json' not in result_matrix_dendrite_client_api)"
+
+- name: Report working Matrix Client API
+  debug:
+    msg: "The Matrix Client API at `{{ matrix_server_fqn_matrix }}` (checked endpoint: `{{ matrix_dendrite_client_api_url_endpoint_public }}`) is working"
+  when: matrix_dendrite_enabled|bool

roles/matrix-dendrite/tasks/self_check_federation_api.yml

@@ -0,0 +1,25 @@
+---
+- name: Check Matrix Federation API
+  uri:
+    url: "{{ matrix_dendrite_federation_api_url_endpoint_public }}"
+    follow_redirects: none
+    validate_certs: "{{ matrix_dendrite_self_check_validate_certificates }}"
+  register: result_matrix_dendrite_federation_api
+  ignore_errors: true
+  check_mode: no
+  when: matrix_dendrite_enabled|bool
+
+- name: Fail if Matrix Federation API not working
+  fail:
+    msg: "Failed checking Matrix Federation API is up at `{{ matrix_server_fqn_matrix }}` (checked endpoint: `{{ matrix_dendrite_federation_api_url_endpoint_public }}`). Is Dendrite running? Is port {{ matrix_federation_public_port }} open in your firewall? Full error: {{ result_matrix_dendrite_federation_api }}"
+  when: "matrix_dendrite_enabled|bool and matrix_dendrite_federation_enabled|bool and (result_matrix_dendrite_federation_api.failed or 'json' not in result_matrix_dendrite_federation_api)"
+
+- name: Fail if Matrix Federation API unexpectedly enabled
+  fail:
+    msg: "Matrix Federation API is up at `{{ matrix_server_fqn_matrix }}` (checked endpoint: `{{ matrix_dendrite_federation_api_url_endpoint_public }}`) despite being disabled."
+  when: "matrix_dendrite_enabled|bool and not matrix_dendrite_federation_enabled|bool and not result_matrix_dendrite_federation_api.failed"
+
+- name: Report working Matrix Federation API
+  debug:
+    msg: "The Matrix Federation API at `{{ matrix_server_fqn_matrix }}` (checked endpoint: `{{ matrix_dendrite_federation_api_url_endpoint_public }}`) is working"
+  when: "matrix_dendrite_enabled|bool and matrix_dendrite_federation_enabled|bool"

roles/matrix-dendrite/tasks/setup_dendrite.yml

@@ -0,0 +1,19 @@
+---
+- name: Ensure Dendrite paths exist
+  file:
+    path: "{{ item.path }}"
+    state: directory
+    mode: 0750
+    owner: "{{ matrix_user_username }}"
+    group: "{{ matrix_user_groupname }}"
+  with_items:
+    - { path: "{{ matrix_dendrite_config_dir_path }}", when: true }
+    - { path: "{{ matrix_dendrite_ext_path }}", when: true }
+    # We handle matrix_dendrite_media_store_path elsewhere (in ./dendrite/setup_install.yml),
+    # because if it's using Goofys and it's already mounted (from before),
+    # trying to chown/chmod it here will cause trouble.
+  when: "(matrix_dendrite_enabled|bool or matrix_s3_media_store_enabled|bool) and item.when"
+
+- import_tasks: "{{ role_path }}/tasks/dendrite/setup.yml"
+
+- import_tasks: "{{ role_path }}/tasks/goofys/setup.yml"

roles/matrix-dendrite/tasks/update_user_password.yml

@@ -0,0 +1,41 @@
+---
+- name: Fail if playbook called incorrectly
+  fail:
+    msg: "The `username` variable needs to be provided to this playbook, via --extra-vars"
+  when: "username is not defined or username == '<your-username>'"
+
+- name: Fail if playbook called incorrectly
+  fail:
+    msg: "The `password` variable needs to be provided to this playbook, via --extra-vars"
+  when: "password is not defined or password == '<your-password>'"
+
+- name: Fail if not using matrix-postgres container
+  fail:
+    msg: "This command is working only when matrix-postgres container is being used"
+  when: "not matrix_postgres_enabled|bool"
+
+- name: Ensure matrix-dendrite is started
+  service:
+    name: matrix-dendrite
+    state: started
+    daemon_reload: yes
+  register: start_result
+
+- name: Ensure matrix-postgres is started
+  service:
+    name: matrix-postgres
+    state: started
+    daemon_reload: yes
+  register: postgres_start_result
+
+- name: Wait a while, so that Matrix Dendrite can manage to start
+  pause:
+    seconds: 7
+  when: "start_result.changed or postgres_start_result.changed"
+
+- name: Generate password hash
+  shell: "{{ matrix_host_command_docker }} exec matrix-dendrite /usr/local/bin/hash_password -c /data/homeserver.yaml -p {{ password|quote }}"
+  register: password_hash
+
+- name: Update user password hash
+  command: "{{ matrix_local_bin_path }}/matrix-postgres-update-user-password-hash {{ username|quote }} {{ password_hash.stdout|quote }}"

roles/matrix-dendrite/tasks/validate_config.yml

@@ -0,0 +1,16 @@
+---
+- name: Fail if required Dendrite settings not defined
+  fail:
+    msg: >-
+      You need to define a required configuration setting (`{{ item }}`) for using Dendrite.
+  when: "vars[item] == ''"
+  with_items:
+    - "matrix_dendrite_macaroon_secret_key"
+
+- name: (Deprecation) Catch and report renamed settings
+  fail:
+    msg: >-
+      Your configuration contains a variable, which now has a different name.
+      Please change your configuration to rename the variable (`{{ item.old }}` -> `{{ item.new }}`).
+  when: "item.old in vars"
+  with_items: []