Merge pull request #4915 from luixxiul/hydrogen
Relocate Hydrogen to MASH organization
This commit is contained in:
14
CHANGELOG.md
14
CHANGELOG.md
@@ -1,3 +1,17 @@
|
|||||||
|
# 2026-02-12
|
||||||
|
|
||||||
|
## (BC Break) Hydrogen role has been relocated and variable names need adjustments
|
||||||
|
|
||||||
|
The role for Hydrogen has been relocated to the [mother-of-all-self-hosting](https://github.com/mother-of-all-self-hosting) organization.
|
||||||
|
|
||||||
|
Along with the relocation, the `matrix_client_hydrogen_` prefix was dropped from its variable names, so you need to adjust your `vars.yml` configuration.
|
||||||
|
|
||||||
|
You need to do the following replacement:
|
||||||
|
|
||||||
|
- `matrix_client_hydrogen_` -> `hydrogen_`
|
||||||
|
|
||||||
|
As always, the playbook would let you know about this and point out any variables you may have missed.
|
||||||
|
|
||||||
# 2026-02-11
|
# 2026-02-11
|
||||||
|
|
||||||
## (BC Break) coturn role has been relocated and variable names need adjustments
|
## (BC Break) coturn role has been relocated and variable names need adjustments
|
||||||
|
|||||||
@@ -24,22 +24,22 @@ When setting, replace `example.com` with your own.
|
|||||||
To enable Hydrogen, add the following configuration to your `inventory/host_vars/matrix.example.com/vars.yml` file:
|
To enable Hydrogen, add the following configuration to your `inventory/host_vars/matrix.example.com/vars.yml` file:
|
||||||
|
|
||||||
```yaml
|
```yaml
|
||||||
matrix_client_hydrogen_enabled: true
|
hydrogen_enabled: true
|
||||||
```
|
```
|
||||||
|
|
||||||
### Adjusting the Hydrogen URL (optional)
|
### Adjusting the Hydrogen URL (optional)
|
||||||
|
|
||||||
By tweaking the `matrix_client_hydrogen_hostname` and `matrix_client_hydrogen_path_prefix` variables, you can easily make the service available at a **different hostname and/or path** than the default one.
|
By tweaking the `hydrogen_hostname` and `hydrogen_path_prefix` variables, you can easily make the service available at a **different hostname and/or path** than the default one.
|
||||||
|
|
||||||
Example additional configuration for your `vars.yml` file:
|
Example additional configuration for your `vars.yml` file:
|
||||||
|
|
||||||
```yaml
|
```yaml
|
||||||
# Switch to the domain used for Matrix services (`matrix.example.com`),
|
# Switch to the domain used for Matrix services (`matrix.example.com`),
|
||||||
# so we won't need to add additional DNS records for Hydrogen.
|
# so we won't need to add additional DNS records for Hydrogen.
|
||||||
matrix_client_hydrogen_hostname: "{{ matrix_server_fqn_matrix }}"
|
hydrogen_hostname: "{{ matrix_server_fqn_matrix }}"
|
||||||
|
|
||||||
# Expose under the /hydrogen subpath
|
# Expose under the /hydrogen subpath
|
||||||
matrix_client_hydrogen_path_prefix: /hydrogen
|
hydrogen_path_prefix: /hydrogen
|
||||||
```
|
```
|
||||||
|
|
||||||
After changing the domain, **you may need to adjust your DNS** records to point the Hydrogen domain to the Matrix server.
|
After changing the domain, **you may need to adjust your DNS** records to point the Hydrogen domain to the Matrix server.
|
||||||
@@ -52,8 +52,8 @@ There are some additional things you may wish to configure about the client.
|
|||||||
|
|
||||||
Take a look at:
|
Take a look at:
|
||||||
|
|
||||||
- `roles/custom/matrix-client-hydrogen/defaults/main.yml` for some variables that you can customize via your `vars.yml` file
|
- `roles/galaxy/hydrogen/defaults/main.yml` for some variables that you can customize via your `vars.yml` file
|
||||||
- `roles/custom/matrix-client-hydrogen/templates/config.json.j2` for the client's default configuration. You can override settings (even those that don't have dedicated playbook variables) using the `matrix_client_hydrogen_configuration_extension_json` variable
|
- `roles/galaxy/hydrogen/templates/config.json.j2` for the client's default configuration. You can override settings (even those that don't have dedicated playbook variables) using the `hydrogen_configuration_extension_json` variable
|
||||||
|
|
||||||
## Installing
|
## Installing
|
||||||
|
|
||||||
|
|||||||
@@ -28,7 +28,7 @@ Possibly outdated list of roles where self-building the Docker image is currentl
|
|||||||
- `matrix-synapse`
|
- `matrix-synapse`
|
||||||
- `matrix-synapse-admin`
|
- `matrix-synapse-admin`
|
||||||
- `matrix-client-element`
|
- `matrix-client-element`
|
||||||
- `matrix-client-hydrogen`
|
- `hydrogen`
|
||||||
- `cinny`
|
- `cinny`
|
||||||
- `matrix-registration`
|
- `matrix-registration`
|
||||||
- `coturn`
|
- `coturn`
|
||||||
|
|||||||
@@ -357,7 +357,7 @@ devture_systemd_service_manager_services_list_auto: |
|
|||||||
+
|
+
|
||||||
([{'name': 'matrix-client-element.service', 'priority': 2000, 'groups': ['matrix', 'clients', 'element', 'client-element']}] if matrix_client_element_enabled else [])
|
([{'name': 'matrix-client-element.service', 'priority': 2000, 'groups': ['matrix', 'clients', 'element', 'client-element']}] if matrix_client_element_enabled else [])
|
||||||
+
|
+
|
||||||
([{'name': 'matrix-client-hydrogen.service', 'priority': 2000, 'groups': ['matrix', 'clients', 'hydrogen', 'client-hydrogen']}] if matrix_client_hydrogen_enabled else [])
|
([{'name': (hydrogen_identifier + '.service'), 'priority': 2000, 'groups': ['matrix', 'clients', 'hydrogen', 'client-hydrogen']}] if hydrogen_enabled else [])
|
||||||
+
|
+
|
||||||
([{'name': 'matrix-client-schildichat.service', 'priority': 2000, 'groups': ['matrix', 'clients', 'schildichat', 'client-schildichat']}] if matrix_client_schildichat_enabled else [])
|
([{'name': 'matrix-client-schildichat.service', 'priority': 2000, 'groups': ['matrix', 'clients', 'schildichat', 'client-schildichat']}] if matrix_client_schildichat_enabled else [])
|
||||||
+
|
+
|
||||||
@@ -4124,39 +4124,49 @@ matrix_client_element_element_call_url: "{{ matrix_element_call_public_url if ma
|
|||||||
|
|
||||||
######################################################################
|
######################################################################
|
||||||
#
|
#
|
||||||
# matrix-client-hydrogen
|
# hydrogen
|
||||||
#
|
#
|
||||||
######################################################################
|
######################################################################
|
||||||
|
|
||||||
matrix_client_hydrogen_enabled: false
|
hydrogen_enabled: false
|
||||||
|
|
||||||
matrix_client_hydrogen_docker_image_registry_prefix_upstream: "{{ matrix_container_global_registry_prefix_override if matrix_container_global_registry_prefix_override else matrix_client_hydrogen_docker_image_registry_prefix_upstream_default }}"
|
hydrogen_identifier: matrix-client-hydrogen
|
||||||
|
|
||||||
matrix_client_hydrogen_container_image_self_build: "{{ matrix_architecture not in ['arm64', 'amd64'] }}"
|
hydrogen_uid: "{{ matrix_user_uid }}"
|
||||||
|
hydrogen_gid: "{{ matrix_user_gid }}"
|
||||||
|
|
||||||
matrix_client_hydrogen_container_http_host_bind_port: "{{ (matrix_playbook_service_host_bind_interface_prefix ~ '8768') if matrix_playbook_service_host_bind_interface_prefix else '' }}"
|
hydrogen_container_image_registry_prefix: "{{ 'localhost/' if hydrogen_container_image_self_build else hydrogen_container_image_registry_prefix_upstream }}"
|
||||||
|
hydrogen_container_image_registry_prefix_upstream: "{{ matrix_container_global_registry_prefix_override if matrix_container_global_registry_prefix_override else hydrogen_container_image_registry_prefix_upstream_default }}"
|
||||||
|
|
||||||
matrix_client_hydrogen_container_network: "{{ matrix_addons_container_network }}"
|
hydrogen_container_image_self_build: "{{ matrix_architecture not in ['arm64', 'amd64'] }}"
|
||||||
|
|
||||||
matrix_client_hydrogen_container_additional_networks: "{{ [matrix_playbook_reverse_proxyable_services_additional_network] if (matrix_client_hydrogen_container_labels_traefik_enabled and matrix_playbook_reverse_proxyable_services_additional_network) else [] }}"
|
hydrogen_container_http_host_bind_port: "{{ (matrix_playbook_service_host_bind_interface_prefix ~ '8768') if matrix_playbook_service_host_bind_interface_prefix else '' }}"
|
||||||
|
|
||||||
matrix_client_hydrogen_container_labels_traefik_enabled: "{{ matrix_playbook_reverse_proxy_type in ['playbook-managed-traefik', 'other-traefik-container'] }}"
|
hydrogen_container_network: "{{ matrix_addons_container_network }}"
|
||||||
matrix_client_hydrogen_container_labels_traefik_docker_network: "{{ matrix_playbook_reverse_proxyable_services_additional_network }}"
|
|
||||||
matrix_client_hydrogen_container_labels_traefik_entrypoints: "{{ traefik_entrypoint_primary }}"
|
|
||||||
matrix_client_hydrogen_container_labels_traefik_tls_certResolver: "{{ traefik_certResolver_primary }}"
|
|
||||||
|
|
||||||
matrix_client_hydrogen_container_labels_traefik_compression_middleware_enabled: "{{ matrix_playbook_reverse_proxy_traefik_middleware_compression_enabled }}"
|
hydrogen_container_additional_networks: "{{ [matrix_playbook_reverse_proxyable_services_additional_network] if (hydrogen_container_labels_traefik_enabled and matrix_playbook_reverse_proxyable_services_additional_network) else [] }}"
|
||||||
matrix_client_hydrogen_container_labels_traefik_compression_middleware_name: "{{ matrix_playbook_reverse_proxy_traefik_middleware_compression_name if matrix_playbook_reverse_proxy_traefik_middleware_compression_enabled else '' }}"
|
|
||||||
|
|
||||||
matrix_client_hydrogen_scheme: "{{ 'https' if matrix_playbook_ssl_enabled else 'http' }}"
|
hydrogen_container_labels_traefik_enabled: "{{ matrix_playbook_reverse_proxy_type in ['playbook-managed-traefik', 'other-traefik-container'] }}"
|
||||||
|
hydrogen_container_labels_traefik_docker_network: "{{ matrix_playbook_reverse_proxyable_services_additional_network }}"
|
||||||
|
hydrogen_container_labels_traefik_entrypoints: "{{ traefik_entrypoint_primary }}"
|
||||||
|
hydrogen_container_labels_traefik_tls_certResolver: "{{ traefik_certResolver_primary }}"
|
||||||
|
|
||||||
matrix_client_hydrogen_default_hs_url: "{{ matrix_homeserver_url }}"
|
hydrogen_container_labels_traefik_compression_middleware_enabled: "{{ matrix_playbook_reverse_proxy_traefik_middleware_compression_enabled }}"
|
||||||
|
hydrogen_container_labels_traefik_compression_middleware_name: "{{ matrix_playbook_reverse_proxy_traefik_middleware_compression_name if matrix_playbook_reverse_proxy_traefik_middleware_compression_enabled else '' }}"
|
||||||
|
|
||||||
matrix_client_hydrogen_self_check_validate_certificates: "{{ matrix_playbook_ssl_enabled }}"
|
hydrogen_scheme: "{{ 'https' if matrix_playbook_ssl_enabled else 'http' }}"
|
||||||
|
|
||||||
|
hydrogen_default_hs_url: "{{ matrix_homeserver_url }}"
|
||||||
|
|
||||||
|
hydrogen_self_check_validate_certificates: "{{ matrix_playbook_ssl_enabled }}"
|
||||||
|
|
||||||
|
hydrogen_base_path: "{{ matrix_base_data_path }}/client-hydrogen"
|
||||||
|
|
||||||
|
hydrogen_hostname: "{{ matrix_server_fqn_hydrogen }}"
|
||||||
|
|
||||||
######################################################################
|
######################################################################
|
||||||
#
|
#
|
||||||
# /matrix-client-hydrogen
|
# /hydrogen
|
||||||
#
|
#
|
||||||
######################################################################
|
######################################################################
|
||||||
|
|
||||||
|
|||||||
@@ -35,6 +35,9 @@
|
|||||||
- src: git+https://github.com/mother-of-all-self-hosting/ansible-role-grafana.git
|
- src: git+https://github.com/mother-of-all-self-hosting/ansible-role-grafana.git
|
||||||
version: v11.6.5-6
|
version: v11.6.5-6
|
||||||
name: grafana
|
name: grafana
|
||||||
|
- src: git+https://github.com/mother-of-all-self-hosting/ansible-role-hydrogen.git
|
||||||
|
version: v0.5.1-0
|
||||||
|
name: hydrogen
|
||||||
- src: git+https://github.com/mother-of-all-self-hosting/ansible-role-jitsi.git
|
- src: git+https://github.com/mother-of-all-self-hosting/ansible-role-jitsi.git
|
||||||
version: v10741-0
|
version: v10741-0
|
||||||
name: jitsi
|
name: jitsi
|
||||||
|
|||||||
@@ -106,7 +106,7 @@ matrix_server_fqn_matrix_federation: '{{ matrix_server_fqn_matrix }}'
|
|||||||
# This and the Matrix FQN (see above) are expected to be on the same server.
|
# This and the Matrix FQN (see above) are expected to be on the same server.
|
||||||
matrix_server_fqn_element: "element.{{ matrix_domain }}"
|
matrix_server_fqn_element: "element.{{ matrix_domain }}"
|
||||||
|
|
||||||
# This is where you access the Hydrogen web client from (if enabled via matrix_client_hydrogen_enabled; disabled by default).
|
# This is where you access the Hydrogen web client from (if enabled via hydrogen_enabled; disabled by default).
|
||||||
matrix_server_fqn_hydrogen: "hydrogen.{{ matrix_domain }}"
|
matrix_server_fqn_hydrogen: "hydrogen.{{ matrix_domain }}"
|
||||||
|
|
||||||
# This is where you access the Cinny web client from (if enabled via cinny_enabled; disabled by default).
|
# This is where you access the Cinny web client from (if enabled via cinny_enabled; disabled by default).
|
||||||
|
|||||||
@@ -1,198 +0,0 @@
|
|||||||
# SPDX-FileCopyrightText: 2021 - 2022 Aaron Raimist
|
|
||||||
# SPDX-FileCopyrightText: 2021 - 2022 MDAD project contributors
|
|
||||||
# SPDX-FileCopyrightText: 2021 - 2025 Slavi Pantaleev
|
|
||||||
# SPDX-FileCopyrightText: 2022 - 2023 Nikita Chernyi
|
|
||||||
# SPDX-FileCopyrightText: 2022 Marko Weltzer
|
|
||||||
# SPDX-FileCopyrightText: 2022 Matthew Cengia
|
|
||||||
# SPDX-FileCopyrightText: 2023 Pierre 'McFly' Marty
|
|
||||||
# SPDX-FileCopyrightText: 2023 Samuel Meenzen
|
|
||||||
#
|
|
||||||
# SPDX-License-Identifier: AGPL-3.0-or-later
|
|
||||||
|
|
||||||
---
|
|
||||||
# Project source code URL: https://github.com/element-hq/hydrogen-web
|
|
||||||
|
|
||||||
matrix_client_hydrogen_enabled: true
|
|
||||||
|
|
||||||
matrix_client_hydrogen_container_image_self_build: false
|
|
||||||
matrix_client_hydrogen_container_image_self_build_repo: "https://github.com/element-hq/hydrogen-web.git"
|
|
||||||
|
|
||||||
# renovate: datasource=docker depName=ghcr.io/element-hq/hydrogen-web
|
|
||||||
matrix_client_hydrogen_version: v0.5.1
|
|
||||||
matrix_client_hydrogen_docker_image: "{{ matrix_client_hydrogen_docker_image_registry_prefix }}element-hq/hydrogen-web:{{ matrix_client_hydrogen_version }}"
|
|
||||||
matrix_client_hydrogen_docker_image_registry_prefix: "{{ 'localhost/' if matrix_client_hydrogen_container_image_self_build else matrix_client_hydrogen_docker_image_registry_prefix_upstream }}"
|
|
||||||
matrix_client_hydrogen_docker_image_registry_prefix_upstream: "{{ matrix_client_hydrogen_docker_image_registry_prefix_upstream_default }}"
|
|
||||||
matrix_client_hydrogen_docker_image_registry_prefix_upstream_default: ghcr.io/
|
|
||||||
matrix_client_hydrogen_docker_image_force_pull: "{{ matrix_client_hydrogen_docker_image.endswith(':latest') }}"
|
|
||||||
|
|
||||||
matrix_client_hydrogen_data_path: "{{ matrix_base_data_path }}/client-hydrogen"
|
|
||||||
matrix_client_hydrogen_docker_src_files_path: "{{ matrix_client_hydrogen_data_path }}/docker-src"
|
|
||||||
|
|
||||||
# The base container network
|
|
||||||
matrix_client_hydrogen_container_network: ''
|
|
||||||
|
|
||||||
# A list of additional container networks that the container would be connected to.
|
|
||||||
# The role does not create these networks, so make sure they already exist.
|
|
||||||
# Use this to expose this container to a reverse proxy, which runs in a different container network.
|
|
||||||
matrix_client_hydrogen_container_additional_networks: []
|
|
||||||
|
|
||||||
# Controls whether the container exposes its HTTP port (tcp/8080 in the container).
|
|
||||||
#
|
|
||||||
# Takes an "<ip>:<port>" or "<port>" value (e.g. "127.0.0.1:8768"), or empty string to not expose.
|
|
||||||
matrix_client_hydrogen_container_http_host_bind_port: ''
|
|
||||||
|
|
||||||
# matrix_client_hydrogen_container_labels_traefik_enabled controls whether labels to assist a Traefik reverse-proxy will be attached to the container.
|
|
||||||
# See `../templates/labels.j2` for details.
|
|
||||||
#
|
|
||||||
# To inject your own other container labels, see `matrix_client_hydrogen_container_labels_additional_labels`.
|
|
||||||
matrix_client_hydrogen_container_labels_traefik_enabled: true
|
|
||||||
matrix_client_hydrogen_container_labels_traefik_docker_network: "{{ matrix_client_hydrogen_container_network }}"
|
|
||||||
matrix_client_hydrogen_container_labels_traefik_hostname: "{{ matrix_client_hydrogen_hostname }}"
|
|
||||||
# The path prefix must either be `/` or not end with a slash (e.g. `/hydrogen`).
|
|
||||||
matrix_client_hydrogen_container_labels_traefik_path_prefix: "{{ matrix_client_hydrogen_path_prefix }}"
|
|
||||||
matrix_client_hydrogen_container_labels_traefik_rule: "Host(`{{ matrix_client_hydrogen_container_labels_traefik_hostname }}`){% if matrix_client_hydrogen_container_labels_traefik_path_prefix != '/' %} && PathPrefix(`{{ matrix_client_hydrogen_container_labels_traefik_path_prefix }}`){% endif %}"
|
|
||||||
matrix_client_hydrogen_container_labels_traefik_priority: 0
|
|
||||||
matrix_client_hydrogen_container_labels_traefik_entrypoints: web-secure
|
|
||||||
matrix_client_hydrogen_container_labels_traefik_tls: "{{ matrix_client_hydrogen_container_labels_traefik_entrypoints != 'web' }}"
|
|
||||||
matrix_client_hydrogen_container_labels_traefik_tls_certResolver: default # noqa var-naming
|
|
||||||
|
|
||||||
# Controls whether a compression middleware will be injected into the middlewares list.
|
|
||||||
# This compression middleware is supposed to be defined elsewhere (using labels or a File provider, etc.) and is merely referenced by this router.
|
|
||||||
matrix_client_hydrogen_container_labels_traefik_compression_middleware_enabled: false
|
|
||||||
matrix_client_hydrogen_container_labels_traefik_compression_middleware_name: ""
|
|
||||||
|
|
||||||
# Controls which additional headers to attach to all HTTP responses.
|
|
||||||
# To add your own headers, use `matrix_client_hydrogen_container_labels_traefik_additional_response_headers_custom`
|
|
||||||
matrix_client_hydrogen_container_labels_traefik_additional_response_headers: "{{ matrix_client_hydrogen_container_labels_traefik_additional_response_headers_auto | combine(matrix_client_hydrogen_container_labels_traefik_additional_response_headers_custom) }}"
|
|
||||||
matrix_client_hydrogen_container_labels_traefik_additional_response_headers_auto: |
|
|
||||||
{{
|
|
||||||
{}
|
|
||||||
| combine ({'X-XSS-Protection': matrix_client_hydrogen_http_header_xss_protection} if matrix_client_hydrogen_http_header_xss_protection else {})
|
|
||||||
| combine ({'X-Content-Type-Options': matrix_client_hydrogen_http_header_content_type_options} if matrix_client_hydrogen_http_header_content_type_options else {})
|
|
||||||
| combine ({'Content-Security-Policy': matrix_client_hydrogen_http_header_content_security_policy} if matrix_client_hydrogen_http_header_content_security_policy else {})
|
|
||||||
| combine ({'Permission-Policy': matrix_client_hydrogen_http_header_content_permission_policy} if matrix_client_hydrogen_http_header_content_permission_policy else {})
|
|
||||||
| combine ({'Strict-Transport-Security': matrix_client_hydrogen_http_header_strict_transport_security} if matrix_client_hydrogen_http_header_strict_transport_security and matrix_client_hydrogen_container_labels_traefik_tls else {})
|
|
||||||
}}
|
|
||||||
matrix_client_hydrogen_container_labels_traefik_additional_response_headers_custom: {}
|
|
||||||
|
|
||||||
# matrix_client_hydrogen_container_labels_additional_labels contains a multiline string with additional labels to add to the container label file.
|
|
||||||
# See `../templates/labels.j2` for details.
|
|
||||||
#
|
|
||||||
# Example:
|
|
||||||
# matrix_client_hydrogen_container_labels_additional_labels: |
|
|
||||||
# my.label=1
|
|
||||||
# another.label="here"
|
|
||||||
matrix_client_hydrogen_container_labels_additional_labels: ''
|
|
||||||
|
|
||||||
# A list of extra arguments to pass to the container
|
|
||||||
matrix_client_hydrogen_container_extra_arguments: []
|
|
||||||
|
|
||||||
# List of systemd services that matrix-client-hydrogen.service depends on
|
|
||||||
matrix_client_hydrogen_systemd_required_services_list: "{{ [devture_systemd_docker_base_docker_service_name] if devture_systemd_docker_base_docker_service_name else [] }}"
|
|
||||||
|
|
||||||
# Specifies the value of the `X-XSS-Protection` header
|
|
||||||
# Stops pages from loading when they detect reflected cross-site scripting (XSS) attacks.
|
|
||||||
#
|
|
||||||
# Learn more about it is here:
|
|
||||||
# - https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-XSS-Protection
|
|
||||||
# - https://portswigger.net/web-security/cross-site-scripting/reflected
|
|
||||||
matrix_client_hydrogen_http_header_xss_protection: "1; mode=block"
|
|
||||||
|
|
||||||
# Specifies the value of the `X-Content-Type-Options` header.
|
|
||||||
# See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Content-Type-Options
|
|
||||||
matrix_client_hydrogen_http_header_content_type_options: nosniff
|
|
||||||
|
|
||||||
# Specifies the value of the `Content-Security-Policy` header.
|
|
||||||
# See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy
|
|
||||||
matrix_client_hydrogen_http_header_content_security_policy: frame-ancestors 'self'
|
|
||||||
|
|
||||||
# Specifies the value of the `Permission-Policy` header.
|
|
||||||
# See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Permission-Policy
|
|
||||||
matrix_client_hydrogen_http_header_content_permission_policy: "{{ 'interest-cohort=()' if matrix_client_hydrogen_floc_optout_enabled else '' }}"
|
|
||||||
|
|
||||||
# Specifies the value of the `Strict-Transport-Security` header.
|
|
||||||
# See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security
|
|
||||||
matrix_client_hydrogen_http_header_strict_transport_security: "max-age=31536000; includeSubDomains{{ '; preload' if matrix_client_hydrogen_hsts_preload_enabled else '' }}"
|
|
||||||
|
|
||||||
# Controls whether to send a "Permissions-Policy interest-cohort=();" header along with all responses
|
|
||||||
#
|
|
||||||
# Learn more about what it is here:
|
|
||||||
# - https://www.eff.org/deeplinks/2021/03/googles-floc-terrible-idea
|
|
||||||
# - https://paramdeo.com/blog/opting-your-website-out-of-googles-floc-network
|
|
||||||
# - https://amifloced.org/
|
|
||||||
#
|
|
||||||
# Of course, a better solution is to just stop using browsers (like Chrome), which participate in such tracking practices.
|
|
||||||
# See: `matrix_client_hydrogen_content_permission_policy`
|
|
||||||
matrix_client_hydrogen_floc_optout_enabled: true
|
|
||||||
|
|
||||||
# Controls if HSTS preloading is enabled
|
|
||||||
#
|
|
||||||
# In its strongest and recommended form, the [HSTS policy](https://www.chromium.org/hsts) includes all subdomains, and
|
|
||||||
# indicates a willingness to be "preloaded" into browsers:
|
|
||||||
# `Strict-Transport-Security: max-age=31536000; includeSubDomains; preload`
|
|
||||||
# For more information visit:
|
|
||||||
# - https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security
|
|
||||||
# - https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security
|
|
||||||
# - https://hstspreload.org/#opt-in
|
|
||||||
# See: `matrix_client_hydrogen_http_header_strict_transport_security`
|
|
||||||
matrix_client_hydrogen_hsts_preload_enabled: false
|
|
||||||
|
|
||||||
matrix_client_hydrogen_scheme: https
|
|
||||||
|
|
||||||
# The hostname at which Hydrogen is served.
|
|
||||||
matrix_client_hydrogen_hostname: "{{ matrix_server_fqn_hydrogen }}"
|
|
||||||
|
|
||||||
# The path at which Hydrogen is exposed.
|
|
||||||
# This value must either be `/` or not end with a slash (e.g. `/hydrogen`).
|
|
||||||
matrix_client_hydrogen_path_prefix: /
|
|
||||||
|
|
||||||
# Controls whether the self-check feature should validate SSL certificates.
|
|
||||||
matrix_client_hydrogen_self_check_validate_certificates: true
|
|
||||||
|
|
||||||
# Controls whether the access log is enabled.
|
|
||||||
matrix_client_hydrogen_access_log_enabled: true
|
|
||||||
|
|
||||||
# config.json
|
|
||||||
matrix_client_hydrogen_push:
|
|
||||||
appId: io.element.hydrogen.web
|
|
||||||
gatewayUrl: https://matrix.org
|
|
||||||
applicationServerKey: "BC-gpSdVHEXhvHSHS0AzzWrQoukv2BE7KzpoPO_FfPacqOo3l1pdqz7rSgmB04pZCWaHPz7XRe6fjLaC-WPDopM"
|
|
||||||
matrix_client_hydrogen_default_hs_url: ""
|
|
||||||
matrix_client_hydrogen_bugReportEndpointUrl: "https://element.io/bugreports/submit" # noqa var-naming
|
|
||||||
|
|
||||||
# Default Hydrogen configuration template which covers the generic use case.
|
|
||||||
# You can customize it by controlling the various variables inside it.
|
|
||||||
#
|
|
||||||
# For a more advanced customization, you can extend the default (see `matrix_client_hydrogen_configuration_extension_json`)
|
|
||||||
# or completely replace this variable with your own template.
|
|
||||||
#
|
|
||||||
# The side-effect of this lookup is that Ansible would even parse the JSON for us, returning a dict.
|
|
||||||
# This is unlike what it does when looking up YAML template files (no automatic parsing there).
|
|
||||||
matrix_client_hydrogen_configuration_default: "{{ lookup('template', 'templates/config.json.j2', convert_data=False) | from_json }}"
|
|
||||||
|
|
||||||
# Your custom JSON configuration for Hydrogen should go to `matrix_client_hydrogen_configuration_extension_json`.
|
|
||||||
# This configuration extends the default starting configuration (`matrix_client_hydrogen_configuration_default`).
|
|
||||||
#
|
|
||||||
# You can override individual variables from the default configuration, or introduce new ones.
|
|
||||||
#
|
|
||||||
# If you need something more special, you can take full control by
|
|
||||||
# completely redefining `matrix_client_hydrogen_configuration_default`.
|
|
||||||
#
|
|
||||||
# Example configuration extension follows:
|
|
||||||
#
|
|
||||||
# matrix_client_hydrogen_configuration_extension_json: |
|
|
||||||
# {
|
|
||||||
# "push": {
|
|
||||||
# "appId": "io.element.hydrogen.web",
|
|
||||||
# "gatewayUrl": "https://matrix.org",
|
|
||||||
# "applicationServerKey": "BC-gpSdVHEXhvHSHS0AzzWrQoukv2BE7KzpoPO_FfPacqOo3l1pdqz7rSgmB04pZCWaHPz7XRe6fjLaC-WPDopM"
|
|
||||||
# },
|
|
||||||
# "defaultHomeServer": "matrix.org"
|
|
||||||
# }
|
|
||||||
matrix_client_hydrogen_configuration_extension_json: '{}'
|
|
||||||
|
|
||||||
matrix_client_hydrogen_configuration_extension: "{{ matrix_client_hydrogen_configuration_extension_json | from_json if matrix_client_hydrogen_configuration_extension_json | from_json is mapping else {} }}"
|
|
||||||
|
|
||||||
# Holds the final Hydrogen configuration (a combination of the default and its extension).
|
|
||||||
# You most likely don't need to touch this variable. Instead, see `matrix_client_hydrogen_configuration_default`.
|
|
||||||
matrix_client_hydrogen_configuration: "{{ matrix_client_hydrogen_configuration_default | combine(matrix_client_hydrogen_configuration_extension, recursive=True) }}"
|
|
||||||
@@ -1,32 +0,0 @@
|
|||||||
# SPDX-FileCopyrightText: 2021 - 2023 Slavi Pantaleev
|
|
||||||
# SPDX-FileCopyrightText: 2021 Aaron Raimist
|
|
||||||
# SPDX-FileCopyrightText: 2022 Marko Weltzer
|
|
||||||
#
|
|
||||||
# SPDX-License-Identifier: AGPL-3.0-or-later
|
|
||||||
|
|
||||||
---
|
|
||||||
|
|
||||||
- tags:
|
|
||||||
- setup-all
|
|
||||||
- setup-client-hydrogen
|
|
||||||
- install-all
|
|
||||||
- install-client-hydrogen
|
|
||||||
block:
|
|
||||||
- when: matrix_client_hydrogen_enabled | bool
|
|
||||||
ansible.builtin.include_tasks: "{{ role_path }}/tasks/validate_config.yml"
|
|
||||||
|
|
||||||
- when: matrix_client_hydrogen_enabled | bool
|
|
||||||
ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_install.yml"
|
|
||||||
|
|
||||||
- tags:
|
|
||||||
- setup-all
|
|
||||||
- setup-client-hydrogen
|
|
||||||
block:
|
|
||||||
- when: not matrix_client_hydrogen_enabled | bool
|
|
||||||
ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_uninstall.yml"
|
|
||||||
|
|
||||||
- tags:
|
|
||||||
- self-check
|
|
||||||
block:
|
|
||||||
- when: matrix_client_hydrogen_enabled | bool
|
|
||||||
ansible.builtin.include_tasks: "{{ role_path }}/tasks/self_check.yml"
|
|
||||||
@@ -1,30 +0,0 @@
|
|||||||
# SPDX-FileCopyrightText: 2021 - 2022 Aaron Raimist
|
|
||||||
# SPDX-FileCopyrightText: 2022 - 2024 Slavi Pantaleev
|
|
||||||
# SPDX-FileCopyrightText: 2022 Marko Weltzer
|
|
||||||
#
|
|
||||||
# SPDX-License-Identifier: AGPL-3.0-or-later
|
|
||||||
|
|
||||||
---
|
|
||||||
|
|
||||||
- ansible.builtin.set_fact:
|
|
||||||
matrix_client_hydrogen_url_endpoint_public: "{{ matrix_client_hydrogen_scheme }}://{{ matrix_client_hydrogen_hostname }}{{ matrix_client_hydrogen_path_prefix }}/config.json"
|
|
||||||
|
|
||||||
- name: Check Hydrogen
|
|
||||||
ansible.builtin.uri:
|
|
||||||
url: "{{ matrix_client_hydrogen_url_endpoint_public }}"
|
|
||||||
follow_redirects: none
|
|
||||||
validate_certs: "{{ matrix_client_hydrogen_self_check_validate_certificates }}"
|
|
||||||
register: matrix_client_hydrogen_self_check_result
|
|
||||||
check_mode: false
|
|
||||||
ignore_errors: true
|
|
||||||
delegate_to: 127.0.0.1
|
|
||||||
become: false
|
|
||||||
|
|
||||||
- name: Fail if Hydrogen not working
|
|
||||||
ansible.builtin.fail:
|
|
||||||
msg: "Failed checking Hydrogen is up at `{{ matrix_client_hydrogen_hostname }}` (checked endpoint: `{{ matrix_client_hydrogen_url_endpoint_public }}`). Is Hydrogen running? Is port 443 open in your firewall? Full error: {{ matrix_client_hydrogen_self_check_result }}"
|
|
||||||
when: "matrix_client_hydrogen_self_check_result.failed or 'json' not in matrix_client_hydrogen_self_check_result"
|
|
||||||
|
|
||||||
- name: Report working Hydrogen
|
|
||||||
ansible.builtin.debug:
|
|
||||||
msg: "Hydrogen at `{{ matrix_client_hydrogen_hostname }}` is working (checked endpoint: `{{ matrix_client_hydrogen_url_endpoint_public }}`)"
|
|
||||||
@@ -1,101 +0,0 @@
|
|||||||
# SPDX-FileCopyrightText: 2021 - 2022 Aaron Raimist
|
|
||||||
# SPDX-FileCopyrightText: 2021 - 2024 Slavi Pantaleev
|
|
||||||
# SPDX-FileCopyrightText: 2022 Marko Weltzer
|
|
||||||
# SPDX-FileCopyrightText: 2022 Matthew Cengia
|
|
||||||
# SPDX-FileCopyrightText: 2022 Nikita Chernyi
|
|
||||||
# SPDX-FileCopyrightText: 2022 Sebastian Gumprich
|
|
||||||
# SPDX-FileCopyrightText: 2023 Julian Foad
|
|
||||||
# SPDX-FileCopyrightText: 2024 David Mehren
|
|
||||||
#
|
|
||||||
# SPDX-License-Identifier: AGPL-3.0-or-later
|
|
||||||
|
|
||||||
---
|
|
||||||
|
|
||||||
- name: Ensure Hydrogen paths exists
|
|
||||||
ansible.builtin.file:
|
|
||||||
path: "{{ item.path }}"
|
|
||||||
state: directory
|
|
||||||
mode: 0750
|
|
||||||
owner: "{{ matrix_user_name }}"
|
|
||||||
group: "{{ matrix_group_name }}"
|
|
||||||
with_items:
|
|
||||||
- {path: "{{ matrix_client_hydrogen_data_path }}", when: true}
|
|
||||||
- {path: "{{ matrix_client_hydrogen_docker_src_files_path }}", when: "{{ matrix_client_hydrogen_container_image_self_build }}"}
|
|
||||||
when: "item.when | bool"
|
|
||||||
|
|
||||||
- when: "matrix_client_hydrogen_container_image_self_build | bool"
|
|
||||||
block:
|
|
||||||
- name: Ensure Hydrogen repository is present on self-build
|
|
||||||
ansible.builtin.git:
|
|
||||||
repo: "{{ matrix_client_hydrogen_container_image_self_build_repo }}"
|
|
||||||
dest: "{{ matrix_client_hydrogen_docker_src_files_path }}"
|
|
||||||
version: "{{ matrix_client_hydrogen_docker_image.split(':')[1] }}"
|
|
||||||
force: "yes"
|
|
||||||
become: true
|
|
||||||
become_user: "{{ matrix_user_name }}"
|
|
||||||
register: matrix_client_hydrogen_git_pull_results
|
|
||||||
|
|
||||||
- name: Check if Hydrogen Docker image exists
|
|
||||||
ansible.builtin.command: "{{ devture_systemd_docker_base_host_command_docker }} images --quiet --filter 'reference={{ matrix_client_hydrogen_docker_image }}'"
|
|
||||||
register: matrix_client_hydrogen_docker_image_check_result
|
|
||||||
changed_when: false
|
|
||||||
|
|
||||||
# Invoking the `docker build` command here, instead of calling the `docker_image` Ansible module,
|
|
||||||
# because the latter does not support BuildKit.
|
|
||||||
# See: https://github.com/ansible-collections/community.general/issues/514
|
|
||||||
- name: Ensure Hydrogen Docker image is built
|
|
||||||
ansible.builtin.shell:
|
|
||||||
chdir: "{{ matrix_client_hydrogen_docker_src_files_path }}"
|
|
||||||
cmd: |
|
|
||||||
{{ devture_systemd_docker_base_host_command_docker }} build \
|
|
||||||
-t "{{ matrix_client_hydrogen_docker_image }}" \
|
|
||||||
-f Dockerfile \
|
|
||||||
.
|
|
||||||
environment:
|
|
||||||
DOCKER_BUILDKIT: 1
|
|
||||||
changed_when: true
|
|
||||||
when: "matrix_client_hydrogen_git_pull_results.changed | bool or matrix_client_hydrogen_docker_image_check_result.stdout == ''"
|
|
||||||
|
|
||||||
- name: Ensure Hydrogen Docker image is pulled
|
|
||||||
community.docker.docker_image:
|
|
||||||
name: "{{ matrix_client_hydrogen_docker_image }}"
|
|
||||||
source: "{{ 'pull' if ansible_version.major > 2 or ansible_version.minor > 7 else omit }}"
|
|
||||||
force_source: "{{ matrix_client_hydrogen_docker_image_force_pull if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}"
|
|
||||||
force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else matrix_client_hydrogen_docker_image_force_pull }}"
|
|
||||||
when: "not matrix_client_hydrogen_container_image_self_build | bool"
|
|
||||||
register: result
|
|
||||||
retries: "{{ devture_playbook_help_container_retries_count }}"
|
|
||||||
delay: "{{ devture_playbook_help_container_retries_delay }}"
|
|
||||||
until: result is not failed
|
|
||||||
|
|
||||||
- name: Ensure Hydrogen configuration installed
|
|
||||||
ansible.builtin.copy:
|
|
||||||
content: "{{ matrix_client_hydrogen_configuration | to_nice_json }}"
|
|
||||||
dest: "{{ matrix_client_hydrogen_data_path }}/config.json"
|
|
||||||
mode: 0644
|
|
||||||
owner: "{{ matrix_user_name }}"
|
|
||||||
group: "{{ matrix_group_name }}"
|
|
||||||
|
|
||||||
- name: Ensure Hydrogen additional config files installed
|
|
||||||
ansible.builtin.template:
|
|
||||||
src: "{{ item.src }}"
|
|
||||||
dest: "{{ matrix_client_hydrogen_data_path }}/{{ item.name }}"
|
|
||||||
mode: 0644
|
|
||||||
owner: "{{ matrix_user_name }}"
|
|
||||||
group: "{{ matrix_group_name }}"
|
|
||||||
with_items:
|
|
||||||
- {src: "{{ role_path }}/templates/nginx.conf.j2", name: "nginx.conf"}
|
|
||||||
- {src: "{{ role_path }}/templates/labels.j2", name: "labels"}
|
|
||||||
|
|
||||||
- name: Ensure Hydrogen container network is created
|
|
||||||
community.general.docker_network:
|
|
||||||
enable_ipv6: "{{ devture_systemd_docker_base_ipv6_enabled }}"
|
|
||||||
name: "{{ matrix_client_hydrogen_container_network }}"
|
|
||||||
driver: bridge
|
|
||||||
driver_options: "{{ devture_systemd_docker_base_container_networks_driver_options }}"
|
|
||||||
|
|
||||||
- name: Ensure matrix-client-hydrogen.service installed
|
|
||||||
ansible.builtin.template:
|
|
||||||
src: "{{ role_path }}/templates/systemd/matrix-client-hydrogen.service.j2"
|
|
||||||
dest: "{{ devture_systemd_docker_base_systemd_path }}/matrix-client-hydrogen.service"
|
|
||||||
mode: 0644
|
|
||||||
@@ -1,31 +0,0 @@
|
|||||||
# SPDX-FileCopyrightText: 2021 - 2022 Slavi Pantaleev
|
|
||||||
# SPDX-FileCopyrightText: 2022 Marko Weltzer
|
|
||||||
# SPDX-FileCopyrightText: 2022 Sebastian Gumprich
|
|
||||||
#
|
|
||||||
# SPDX-License-Identifier: AGPL-3.0-or-later
|
|
||||||
|
|
||||||
---
|
|
||||||
|
|
||||||
- name: Check existence of matrix-client-hydrogen.service
|
|
||||||
ansible.builtin.stat:
|
|
||||||
path: "{{ devture_systemd_docker_base_systemd_path }}/matrix-client-hydrogen.service"
|
|
||||||
register: matrix_client_hydrogen_service_stat
|
|
||||||
|
|
||||||
- when: matrix_client_hydrogen_service_stat.stat.exists | bool
|
|
||||||
block:
|
|
||||||
- name: Ensure matrix-client-hydrogen is stopped
|
|
||||||
ansible.builtin.service:
|
|
||||||
name: matrix-client-hydrogen
|
|
||||||
state: stopped
|
|
||||||
enabled: false
|
|
||||||
daemon_reload: true
|
|
||||||
|
|
||||||
- name: Ensure matrix-client-hydrogen.service doesn't exist
|
|
||||||
ansible.builtin.file:
|
|
||||||
path: "{{ devture_systemd_docker_base_systemd_path }}/matrix-client-hydrogen.service"
|
|
||||||
state: absent
|
|
||||||
|
|
||||||
- name: Ensure Hydrogen paths doesn't exist
|
|
||||||
ansible.builtin.file:
|
|
||||||
path: "{{ matrix_client_hydrogen_data_path }}"
|
|
||||||
state: absent
|
|
||||||
@@ -1,45 +0,0 @@
|
|||||||
# SPDX-FileCopyrightText: 2021 Aaron Raimist
|
|
||||||
# SPDX-FileCopyrightText: 2022 - 2025 Slavi Pantaleev
|
|
||||||
# SPDX-FileCopyrightText: 2024 Suguru Hirahara
|
|
||||||
#
|
|
||||||
# SPDX-License-Identifier: AGPL-3.0-or-later
|
|
||||||
|
|
||||||
---
|
|
||||||
|
|
||||||
- name: Fail if required Hydrogen settings not defined
|
|
||||||
ansible.builtin.fail:
|
|
||||||
msg: >
|
|
||||||
You need to define a required configuration setting (`{{ item }}`) to use Hydrogen.
|
|
||||||
when: "item.when | bool and lookup('vars', item.name, default='') | string | length == 0"
|
|
||||||
with_items:
|
|
||||||
- {'name': 'matrix_client_hydrogen_default_hs_url', when: "{{ matrix_client_hydrogen_container_image_self_build }}"}
|
|
||||||
- {'name': 'matrix_client_hydrogen_container_network', when: true}
|
|
||||||
- {'name': 'matrix_client_hydrogen_container_labels_traefik_compression_middleware_name', when: "{{ matrix_client_hydrogen_container_labels_traefik_compression_middleware_enabled }}"}
|
|
||||||
|
|
||||||
- name: (Deprecation) Catch and report renamed Hydrogen variables
|
|
||||||
ansible.builtin.fail:
|
|
||||||
msg: >-
|
|
||||||
The variable `{{ item.old }}` is deprecated. Please use `{{ item.new }}` instead.
|
|
||||||
when: "lookup('ansible.builtin.varnames', ('^' + item.old + '$'), wantlist=True) | length > 0"
|
|
||||||
with_items:
|
|
||||||
- {'old': 'matrix_client_hydrogen_container_image_name_prefix', 'new': 'matrix_client_hydrogen_container_image_registry_prefix'}
|
|
||||||
|
|
||||||
- when: matrix_client_hydrogen_container_labels_traefik_enabled | bool
|
|
||||||
block:
|
|
||||||
- name: Fail if required matrix-client-hydrogen Traefik settings not defined
|
|
||||||
ansible.builtin.fail:
|
|
||||||
msg: >-
|
|
||||||
You need to define a required configuration setting (`{{ item }}`).
|
|
||||||
when: "lookup('vars', item, default='') == ''"
|
|
||||||
with_items:
|
|
||||||
- matrix_client_hydrogen_container_labels_traefik_hostname
|
|
||||||
- matrix_client_hydrogen_container_labels_traefik_path_prefix
|
|
||||||
|
|
||||||
# We ensure it doesn't end with a slash, because we handle both (slash and no-slash).
|
|
||||||
# Knowing that `matrix_client_hydrogen_container_labels_traefik_path_prefix` does not end with a slash
|
|
||||||
# ensures we know how to set these routes up without having to do "does it end with a slash" checks elsewhere.
|
|
||||||
- name: Fail if matrix_client_hydrogen_container_labels_traefik_path_prefix ends with a slash
|
|
||||||
ansible.builtin.fail:
|
|
||||||
msg: >-
|
|
||||||
matrix_client_hydrogen_container_labels_traefik_path_prefix (`{{ matrix_client_hydrogen_container_labels_traefik_path_prefix }}`) must either be `/` or not end with a slash (e.g. `/hydrogen`).
|
|
||||||
when: "matrix_client_hydrogen_container_labels_traefik_path_prefix != '/' and matrix_client_hydrogen_container_labels_traefik_path_prefix[-1] == '/'"
|
|
||||||
@@ -1,12 +0,0 @@
|
|||||||
{
|
|
||||||
"push": {{ matrix_client_hydrogen_push | to_json }},
|
|
||||||
"defaultHomeServer": {{ matrix_client_hydrogen_default_hs_url | string | to_json }},
|
|
||||||
"bugReportEndpointUrl": {{ matrix_client_hydrogen_bugReportEndpointUrl | to_json }},
|
|
||||||
"themeManifests": [
|
|
||||||
"{{ '' if matrix_client_hydrogen_path_prefix == '/' else matrix_client_hydrogen_path_prefix }}/assets/theme-element.json"
|
|
||||||
],
|
|
||||||
"defaultTheme": {
|
|
||||||
"light": "element-light",
|
|
||||||
"dark": "element-dark"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -1,7 +0,0 @@
|
|||||||
SPDX-FileCopyrightText: 2021 - 2022 Aaron Raimist
|
|
||||||
SPDX-FileCopyrightText: 2022 - 2023 Slavi Pantaleev
|
|
||||||
SPDX-FileCopyrightText: 2022 Matthew Cengia
|
|
||||||
SPDX-FileCopyrightText: 2022 Nikita Chernyi
|
|
||||||
SPDX-FileCopyrightText: 2023 Sergio Durigan Junior
|
|
||||||
|
|
||||||
SPDX-License-Identifier: AGPL-3.0-or-later
|
|
||||||
@@ -1,56 +0,0 @@
|
|||||||
{#
|
|
||||||
SPDX-FileCopyrightText: 2023 - 2024 Slavi Pantaleev
|
|
||||||
|
|
||||||
SPDX-License-Identifier: AGPL-3.0-or-later
|
|
||||||
#}
|
|
||||||
|
|
||||||
{% if matrix_client_hydrogen_container_labels_traefik_enabled %}
|
|
||||||
traefik.enable=true
|
|
||||||
|
|
||||||
{% if matrix_client_hydrogen_container_labels_traefik_docker_network %}
|
|
||||||
traefik.docker.network={{ matrix_client_hydrogen_container_labels_traefik_docker_network }}
|
|
||||||
{% endif %}
|
|
||||||
|
|
||||||
traefik.http.services.matrix-client-hydrogen.loadbalancer.server.port=8080
|
|
||||||
|
|
||||||
{% set middlewares = [] %}
|
|
||||||
|
|
||||||
{% if matrix_client_hydrogen_container_labels_traefik_compression_middleware_enabled %}
|
|
||||||
{% set middlewares = middlewares + [matrix_client_hydrogen_container_labels_traefik_compression_middleware_name] %}
|
|
||||||
{% endif %}
|
|
||||||
|
|
||||||
{% if matrix_client_hydrogen_container_labels_traefik_path_prefix != '/' %}
|
|
||||||
traefik.http.middlewares.matrix-client-hydrogen-slashless-redirect.redirectregex.regex=({{ matrix_client_hydrogen_container_labels_traefik_path_prefix | quote }})$
|
|
||||||
traefik.http.middlewares.matrix-client-hydrogen-slashless-redirect.redirectregex.replacement=${1}/
|
|
||||||
{% set middlewares = middlewares + ['matrix-client-hydrogen-slashless-redirect'] %}
|
|
||||||
{% endif %}
|
|
||||||
|
|
||||||
{% if matrix_client_hydrogen_container_labels_traefik_path_prefix != '/' %}
|
|
||||||
traefik.http.middlewares.matrix-client-hydrogen-strip-prefix.stripprefix.prefixes={{ matrix_client_hydrogen_container_labels_traefik_path_prefix }}
|
|
||||||
{% set middlewares = middlewares + ['matrix-client-hydrogen-strip-prefix'] %}
|
|
||||||
{% endif %}
|
|
||||||
|
|
||||||
{% if matrix_client_hydrogen_container_labels_traefik_additional_response_headers.keys() | length > 0 %}
|
|
||||||
{% for name, value in matrix_client_hydrogen_container_labels_traefik_additional_response_headers.items() %}
|
|
||||||
traefik.http.middlewares.matrix-client-hydrogen-add-headers.headers.customresponseheaders.{{ name }}={{ value }}
|
|
||||||
{% endfor %}
|
|
||||||
{% set middlewares = middlewares + ['matrix-client-hydrogen-add-headers'] %}
|
|
||||||
{% endif %}
|
|
||||||
|
|
||||||
traefik.http.routers.matrix-client-hydrogen.rule={{ matrix_client_hydrogen_container_labels_traefik_rule }}
|
|
||||||
{% if matrix_client_hydrogen_container_labels_traefik_priority | int > 0 %}
|
|
||||||
traefik.http.routers.matrix-client-hydrogen.priority={{ matrix_client_hydrogen_container_labels_traefik_priority }}
|
|
||||||
{% endif %}
|
|
||||||
traefik.http.routers.matrix-client-hydrogen.service=matrix-client-hydrogen
|
|
||||||
{% if middlewares | length > 0 %}
|
|
||||||
traefik.http.routers.matrix-client-hydrogen.middlewares={{ middlewares | join(',') }}
|
|
||||||
{% endif %}
|
|
||||||
traefik.http.routers.matrix-client-hydrogen.entrypoints={{ matrix_client_hydrogen_container_labels_traefik_entrypoints }}
|
|
||||||
traefik.http.routers.matrix-client-hydrogen.tls={{ matrix_client_hydrogen_container_labels_traefik_tls | to_json }}
|
|
||||||
{% if matrix_client_hydrogen_container_labels_traefik_tls %}
|
|
||||||
traefik.http.routers.matrix-client-hydrogen.tls.certResolver={{ matrix_client_hydrogen_container_labels_traefik_tls_certResolver }}
|
|
||||||
{% endif %}
|
|
||||||
|
|
||||||
{% endif %}
|
|
||||||
|
|
||||||
{{ matrix_client_hydrogen_container_labels_additional_labels }}
|
|
||||||
@@ -1,70 +0,0 @@
|
|||||||
#jinja2: lstrip_blocks: True
|
|
||||||
# This is a custom nginx configuration file that we use in the container (instead of the default one),
|
|
||||||
# because it allows us to run nginx with a non-root user.
|
|
||||||
#
|
|
||||||
# For this to work, the default vhost file (`/etc/nginx/conf.d/default.conf`) also needs to be removed.
|
|
||||||
# (mounting `/dev/null` over `/etc/nginx/conf.d/default.conf` works well)
|
|
||||||
#
|
|
||||||
# The following changes have been done compared to a default nginx configuration file:
|
|
||||||
# - default server port is changed (80 -> 8080), so that a non-root user can bind it
|
|
||||||
# - various temp paths are changed to `/tmp`, so that a non-root user can write to them
|
|
||||||
# - the `user` directive was removed, as we don't want nginx to switch users
|
|
||||||
|
|
||||||
worker_processes 1;
|
|
||||||
|
|
||||||
error_log /var/log/nginx/error.log warn;
|
|
||||||
pid /tmp/nginx.pid;
|
|
||||||
|
|
||||||
|
|
||||||
events {
|
|
||||||
worker_connections 1024;
|
|
||||||
}
|
|
||||||
|
|
||||||
|
|
||||||
http {
|
|
||||||
proxy_temp_path /tmp/proxy_temp;
|
|
||||||
client_body_temp_path /tmp/client_temp;
|
|
||||||
fastcgi_temp_path /tmp/fastcgi_temp;
|
|
||||||
uwsgi_temp_path /tmp/uwsgi_temp;
|
|
||||||
scgi_temp_path /tmp/scgi_temp;
|
|
||||||
|
|
||||||
include /etc/nginx/mime.types;
|
|
||||||
default_type application/octet-stream;
|
|
||||||
|
|
||||||
log_format main '$remote_addr - $remote_user [$time_local] "$request" '
|
|
||||||
'$status $body_bytes_sent "$http_referer" '
|
|
||||||
'"$http_user_agent" "$http_x_forwarded_for"';
|
|
||||||
|
|
||||||
{% if matrix_client_hydrogen_access_log_enabled %}
|
|
||||||
access_log /var/log/nginx/access.log main;
|
|
||||||
{% else %}
|
|
||||||
access_log off;
|
|
||||||
{% endif %}
|
|
||||||
|
|
||||||
sendfile on;
|
|
||||||
#tcp_nopush on;
|
|
||||||
|
|
||||||
keepalive_timeout 65;
|
|
||||||
|
|
||||||
#gzip on;
|
|
||||||
|
|
||||||
server {
|
|
||||||
listen 8080;
|
|
||||||
server_name localhost;
|
|
||||||
|
|
||||||
root /usr/share/nginx/html;
|
|
||||||
|
|
||||||
location / {
|
|
||||||
index index.html index.htm;
|
|
||||||
}
|
|
||||||
|
|
||||||
location ~* ^/(config(.+)?\.json$|(.+)\.html$|i18n) {
|
|
||||||
expires -1;
|
|
||||||
}
|
|
||||||
|
|
||||||
error_page 500 502 503 504 /50x.html;
|
|
||||||
location = /50x.html {
|
|
||||||
root /usr/share/nginx/html;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -1,4 +0,0 @@
|
|||||||
SPDX-FileCopyrightText: 2021 Aaron Raimist
|
|
||||||
SPDX-FileCopyrightText: 2022 Slavi Pantaleev
|
|
||||||
|
|
||||||
SPDX-License-Identifier: AGPL-3.0-or-later
|
|
||||||
@@ -1,50 +0,0 @@
|
|||||||
#jinja2: lstrip_blocks: True
|
|
||||||
[Unit]
|
|
||||||
Description=Matrix Hydrogen Client
|
|
||||||
{% for service in matrix_client_hydrogen_systemd_required_services_list %}
|
|
||||||
Requires={{ service }}
|
|
||||||
After={{ service }}
|
|
||||||
{% endfor %}
|
|
||||||
DefaultDependencies=no
|
|
||||||
|
|
||||||
[Service]
|
|
||||||
Type=simple
|
|
||||||
Environment="HOME={{ devture_systemd_docker_base_systemd_unit_home_path }}"
|
|
||||||
ExecStartPre=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} stop -t {{ devture_systemd_docker_base_container_stop_grace_time_seconds }} matrix-client-hydrogen 2>/dev/null || true'
|
|
||||||
ExecStartPre=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} rm matrix-client-hydrogen 2>/dev/null || true'
|
|
||||||
|
|
||||||
ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} create \
|
|
||||||
--rm \
|
|
||||||
--name=matrix-client-hydrogen \
|
|
||||||
--log-driver=none \
|
|
||||||
--user={{ matrix_user_uid }}:{{ matrix_user_gid }} \
|
|
||||||
--cap-drop=ALL \
|
|
||||||
--read-only \
|
|
||||||
--network={{ matrix_client_hydrogen_container_network }} \
|
|
||||||
{% if matrix_client_hydrogen_container_http_host_bind_port %}
|
|
||||||
-p {{ matrix_client_hydrogen_container_http_host_bind_port }}:8080 \
|
|
||||||
{% endif %}
|
|
||||||
--label-file={{ matrix_client_hydrogen_data_path }}/labels \
|
|
||||||
--tmpfs=/tmp:rw,noexec,nosuid,size=10m \
|
|
||||||
--mount type=bind,src={{ matrix_client_hydrogen_data_path }}/nginx.conf,dst=/etc/nginx/nginx.conf,ro \
|
|
||||||
--mount type=bind,src={{ matrix_client_hydrogen_data_path }}/config.json,dst=/config.json.bundled,ro \
|
|
||||||
{% for arg in matrix_client_hydrogen_container_extra_arguments %}
|
|
||||||
{{ arg }} \
|
|
||||||
{% endfor %}
|
|
||||||
{{ matrix_client_hydrogen_docker_image }}
|
|
||||||
|
|
||||||
{% for network in matrix_client_hydrogen_container_additional_networks %}
|
|
||||||
ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} network connect {{ network }} matrix-client-hydrogen
|
|
||||||
{% endfor %}
|
|
||||||
|
|
||||||
ExecStart={{ devture_systemd_docker_base_host_command_docker }} start --attach matrix-client-hydrogen
|
|
||||||
|
|
||||||
ExecStop=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} stop -t {{ devture_systemd_docker_base_container_stop_grace_time_seconds }} matrix-client-hydrogen 2>/dev/null || true'
|
|
||||||
ExecStop=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} rm matrix-client-hydrogen 2>/dev/null || true'
|
|
||||||
|
|
||||||
Restart=always
|
|
||||||
RestartSec=30
|
|
||||||
SyslogIdentifier=matrix-client-hydrogen
|
|
||||||
|
|
||||||
[Install]
|
|
||||||
WantedBy=multi-user.target
|
|
||||||
@@ -1,5 +0,0 @@
|
|||||||
SPDX-FileCopyrightText: 2021 - 2025 Slavi Pantaleev
|
|
||||||
SPDX-FileCopyrightText: 2021 Aaron Raimist
|
|
||||||
SPDX-FileCopyrightText: 2022 Matthew Cengia
|
|
||||||
|
|
||||||
SPDX-License-Identifier: AGPL-3.0-or-later
|
|
||||||
@@ -90,6 +90,11 @@
|
|||||||
- {'old': 'ddclient_docker_image_registry_prefix_upstream', 'new': 'ddclient_container_image_registry_prefix_upstream'}
|
- {'old': 'ddclient_docker_image_registry_prefix_upstream', 'new': 'ddclient_container_image_registry_prefix_upstream'}
|
||||||
- {'old': 'ddclient_docker_image_registry_prefix_upstream_default', 'new': 'ddclient_container_image_registry_prefix_upstream_default'}
|
- {'old': 'ddclient_docker_image_registry_prefix_upstream_default', 'new': 'ddclient_container_image_registry_prefix_upstream_default'}
|
||||||
|
|
||||||
|
- {'old': 'hydrogen_docker_image', 'new': 'hydrogen_container_image'}
|
||||||
|
- {'old': 'hydrogen_docker_image_registry_prefix', 'new': 'hydrogen_container_image_registry_prefix'}
|
||||||
|
- {'old': 'hydrogen_docker_image_registry_prefix_upstream', 'new': 'hydrogen_container_image_registry_prefix_upstream'}
|
||||||
|
- {'old': 'hydrogen_docker_image_registry_prefix_upstream_default', 'new': 'hydrogen_container_image_registry_prefix_upstream_default'}
|
||||||
|
|
||||||
- name: (Deprecation) Catch and report matrix_postgres variables
|
- name: (Deprecation) Catch and report matrix_postgres variables
|
||||||
ansible.builtin.fail:
|
ansible.builtin.fail:
|
||||||
msg: |-
|
msg: |-
|
||||||
@@ -600,6 +605,19 @@
|
|||||||
The following variables in your configuration need to be renamed: {{ lookup('ansible.builtin.varnames', '^matrix_client_cinny_.+', wantlist=True) | join(', ') }}
|
The following variables in your configuration need to be renamed: {{ lookup('ansible.builtin.varnames', '^matrix_client_cinny_.+', wantlist=True) | join(', ') }}
|
||||||
when: "lookup('ansible.builtin.varnames', '^matrix_client_cinny_.+', wantlist=True) | length > 0"
|
when: "lookup('ansible.builtin.varnames', '^matrix_client_cinny_.+', wantlist=True) | length > 0"
|
||||||
|
|
||||||
|
- name: (Deprecation) Catch and report matrix-client-hydrogen variables
|
||||||
|
ansible.builtin.fail:
|
||||||
|
msg: |-
|
||||||
|
The matrix-client-hydrogen role in the playbook now lives under the MASH organization (https://github.com/mother-of-all-self-hosting/ansible-role-hydrogen).
|
||||||
|
The new role is pretty much the same, but uses differently named variables.
|
||||||
|
|
||||||
|
Please rename all `matrix_client_hydrogen_`-prefixed variables (`matrix_client_hydrogen_*` -> `hydrogen_*`) on your configuration file (vars.yml).
|
||||||
|
|
||||||
|
After renaming them, please do not forget to fetch the Ansible role. See docs/maintenance-upgrading-services.md for details about how to do so.
|
||||||
|
|
||||||
|
The following variables in your configuration need to be renamed: {{ lookup('ansible.builtin.varnames', '^matrix_client_hydrogen_.+', wantlist=True) | join(', ') }}
|
||||||
|
when: "lookup('ansible.builtin.varnames', '^matrix_client_hydrogen_.+', wantlist=True) | length > 0"
|
||||||
|
|
||||||
- name: (Deprecation) Catch and report matrix-coturn variables
|
- name: (Deprecation) Catch and report matrix-coturn variables
|
||||||
ansible.builtin.fail:
|
ansible.builtin.fail:
|
||||||
msg: |-
|
msg: |-
|
||||||
|
|||||||
@@ -108,7 +108,7 @@
|
|||||||
- custom/matrix-prometheus-services-connect
|
- custom/matrix-prometheus-services-connect
|
||||||
- custom/matrix-registration
|
- custom/matrix-registration
|
||||||
- custom/matrix-client-element
|
- custom/matrix-client-element
|
||||||
- custom/matrix-client-hydrogen
|
- galaxy/hydrogen
|
||||||
- galaxy/cinny
|
- galaxy/cinny
|
||||||
- custom/matrix-client-schildichat
|
- custom/matrix-client-schildichat
|
||||||
- custom/matrix-client-fluffychat
|
- custom/matrix-client-fluffychat
|
||||||
|
|||||||
Reference in New Issue
Block a user