finallycoffee/matrix-docker-ansible-deploy
5
1
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Merge pull request #4915 from luixxiul/hydrogen

Browse Source 
Relocate Hydrogen to MASH organization
This commit is contained in:
Suguru Hirahara
2026-02-12 13:00:21 +00:00
committed by GitHub
parent 47bf99af7a
commit 0f5015a33c
21 changed files with 72 additions and 668 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
CHANGELOG.md
View File

@@ -1,3 +1,17 @@
# 2026-02-12
## (BC Break) Hydrogen role has been relocated and variable names need adjustments
The role for Hydrogen has been relocated to the [mother-of-all-self-hosting](https://github.com/mother-of-all-self-hosting) organization.
Along with the relocation, the `matrix_client_hydrogen_` prefix was dropped from its variable names, so you need to adjust your `vars.yml` configuration.
You need to do the following replacement:
- `matrix_client_hydrogen_` -> `hydrogen_`
As always, the playbook would let you know about this and point out any variables you may have missed.
# 2026-02-11
## (BC Break) coturn role has been relocated and variable names need adjustments

12
docs/configuring-playbook-client-hydrogen.md
View File

@@ -24,22 +24,22 @@ When setting, replace `example.com` with your own.
To enable Hydrogen, add the following configuration to your `inventory/host_vars/matrix.example.com/vars.yml` file:
```yaml
matrix_client_hydrogen_enabled: true
hydrogen_enabled: true
```
### Adjusting the Hydrogen URL (optional)
By tweaking the `matrix_client_hydrogen_hostname` and `matrix_client_hydrogen_path_prefix` variables, you can easily make the service available at a **different hostname and/or path** than the default one.
By tweaking the `hydrogen_hostname` and `hydrogen_path_prefix` variables, you can easily make the service available at a **different hostname and/or path** than the default one.
Example additional configuration for your `vars.yml` file:
```yaml
# Switch to the domain used for Matrix services (`matrix.example.com`),
# so we won't need to add additional DNS records for Hydrogen.
matrix_client_hydrogen_hostname: "{{ matrix_server_fqn_matrix }}"
hydrogen_hostname: "{{ matrix_server_fqn_matrix }}"
# Expose under the /hydrogen subpath
matrix_client_hydrogen_path_prefix: /hydrogen
hydrogen_path_prefix: /hydrogen
```
After changing the domain, **you may need to adjust your DNS** records to point the Hydrogen domain to the Matrix server.
@@ -52,8 +52,8 @@ There are some additional things you may wish to configure about the client.
Take a look at:
- `roles/custom/matrix-client-hydrogen/defaults/main.yml` for some variables that you can customize via your `vars.yml` file
- `roles/custom/matrix-client-hydrogen/templates/config.json.j2` for the client's default configuration. You can override settings (even those that don't have dedicated playbook variables) using the `matrix_client_hydrogen_configuration_extension_json` variable
- `roles/galaxy/hydrogen/defaults/main.yml` for some variables that you can customize via your `vars.yml` file
- `roles/galaxy/hydrogen/templates/config.json.j2` for the client's default configuration. You can override settings (even those that don't have dedicated playbook variables) using the `hydrogen_configuration_extension_json` variable
## Installing

2
docs/self-building.md
View File

@@ -28,7 +28,7 @@ Possibly outdated list of roles where self-building the Docker image is currentl
- `matrix-synapse`
- `matrix-synapse-admin`
- `matrix-client-element`
- `matrix-client-hydrogen`
- `hydrogen`
- `cinny`
- `matrix-registration`
- `coturn`

46
group_vars/matrix_servers
View File

@@ -357,7 +357,7 @@ devture_systemd_service_manager_services_list_auto: |
+
([{'name': 'matrix-client-element.service', 'priority': 2000, 'groups': ['matrix', 'clients', 'element', 'client-element']}] if matrix_client_element_enabled else [])
+
([{'name': 'matrix-client-hydrogen.service', 'priority': 2000, 'groups': ['matrix', 'clients', 'hydrogen', 'client-hydrogen']}] if matrix_client_hydrogen_enabled else [])
([{'name': (hydrogen_identifier + '.service'), 'priority': 2000, 'groups': ['matrix', 'clients', 'hydrogen', 'client-hydrogen']}] if hydrogen_enabled else [])
+
([{'name': 'matrix-client-schildichat.service', 'priority': 2000, 'groups': ['matrix', 'clients', 'schildichat', 'client-schildichat']}] if matrix_client_schildichat_enabled else [])
+
@@ -4124,39 +4124,49 @@ matrix_client_element_element_call_url: "{{ matrix_element_call_public_url if ma
######################################################################
#
# matrix-client-hydrogen
# hydrogen
#
######################################################################
matrix_client_hydrogen_enabled: false
hydrogen_enabled: false
matrix_client_hydrogen_docker_image_registry_prefix_upstream: "{{ matrix_container_global_registry_prefix_override if matrix_container_global_registry_prefix_override else matrix_client_hydrogen_docker_image_registry_prefix_upstream_default }}"
hydrogen_identifier: matrix-client-hydrogen
matrix_client_hydrogen_container_image_self_build: "{{ matrix_architecture not in ['arm64', 'amd64'] }}"
hydrogen_uid: "{{ matrix_user_uid }}"
hydrogen_gid: "{{ matrix_user_gid }}"
matrix_client_hydrogen_container_http_host_bind_port: "{{ (matrix_playbook_service_host_bind_interface_prefix ~ '8768') if matrix_playbook_service_host_bind_interface_prefix else '' }}"
hydrogen_container_image_registry_prefix: "{{ 'localhost/' if hydrogen_container_image_self_build else hydrogen_container_image_registry_prefix_upstream }}"
hydrogen_container_image_registry_prefix_upstream: "{{ matrix_container_global_registry_prefix_override if matrix_container_global_registry_prefix_override else hydrogen_container_image_registry_prefix_upstream_default }}"
matrix_client_hydrogen_container_network: "{{ matrix_addons_container_network }}"
hydrogen_container_image_self_build: "{{ matrix_architecture not in ['arm64', 'amd64'] }}"
matrix_client_hydrogen_container_additional_networks: "{{ [matrix_playbook_reverse_proxyable_services_additional_network] if (matrix_client_hydrogen_container_labels_traefik_enabled and matrix_playbook_reverse_proxyable_services_additional_network) else [] }}"
hydrogen_container_http_host_bind_port: "{{ (matrix_playbook_service_host_bind_interface_prefix ~ '8768') if matrix_playbook_service_host_bind_interface_prefix else '' }}"
matrix_client_hydrogen_container_labels_traefik_enabled: "{{ matrix_playbook_reverse_proxy_type in ['playbook-managed-traefik', 'other-traefik-container'] }}"
matrix_client_hydrogen_container_labels_traefik_docker_network: "{{ matrix_playbook_reverse_proxyable_services_additional_network }}"
matrix_client_hydrogen_container_labels_traefik_entrypoints: "{{ traefik_entrypoint_primary }}"
matrix_client_hydrogen_container_labels_traefik_tls_certResolver: "{{ traefik_certResolver_primary }}"
hydrogen_container_network: "{{ matrix_addons_container_network }}"
matrix_client_hydrogen_container_labels_traefik_compression_middleware_enabled: "{{ matrix_playbook_reverse_proxy_traefik_middleware_compression_enabled }}"
matrix_client_hydrogen_container_labels_traefik_compression_middleware_name: "{{ matrix_playbook_reverse_proxy_traefik_middleware_compression_name if matrix_playbook_reverse_proxy_traefik_middleware_compression_enabled else '' }}"
hydrogen_container_additional_networks: "{{ [matrix_playbook_reverse_proxyable_services_additional_network] if (hydrogen_container_labels_traefik_enabled and matrix_playbook_reverse_proxyable_services_additional_network) else [] }}"
matrix_client_hydrogen_scheme: "{{ 'https' if matrix_playbook_ssl_enabled else 'http' }}"
hydrogen_container_labels_traefik_enabled: "{{ matrix_playbook_reverse_proxy_type in ['playbook-managed-traefik', 'other-traefik-container'] }}"
hydrogen_container_labels_traefik_docker_network: "{{ matrix_playbook_reverse_proxyable_services_additional_network }}"
hydrogen_container_labels_traefik_entrypoints: "{{ traefik_entrypoint_primary }}"
hydrogen_container_labels_traefik_tls_certResolver: "{{ traefik_certResolver_primary }}"
matrix_client_hydrogen_default_hs_url: "{{ matrix_homeserver_url }}"
hydrogen_container_labels_traefik_compression_middleware_enabled: "{{ matrix_playbook_reverse_proxy_traefik_middleware_compression_enabled }}"
hydrogen_container_labels_traefik_compression_middleware_name: "{{ matrix_playbook_reverse_proxy_traefik_middleware_compression_name if matrix_playbook_reverse_proxy_traefik_middleware_compression_enabled else '' }}"
matrix_client_hydrogen_self_check_validate_certificates: "{{ matrix_playbook_ssl_enabled }}"
hydrogen_scheme: "{{ 'https' if matrix_playbook_ssl_enabled else 'http' }}"
hydrogen_default_hs_url: "{{ matrix_homeserver_url }}"
hydrogen_self_check_validate_certificates: "{{ matrix_playbook_ssl_enabled }}"
hydrogen_base_path: "{{ matrix_base_data_path }}/client-hydrogen"
hydrogen_hostname: "{{ matrix_server_fqn_hydrogen }}"
######################################################################
#
# /matrix-client-hydrogen
# /hydrogen
#
######################################################################

3
requirements.yml
View File

@@ -35,6 +35,9 @@
- src: git+https://github.com/mother-of-all-self-hosting/ansible-role-grafana.git
version: v11.6.5-6
name: grafana
- src: git+https://github.com/mother-of-all-self-hosting/ansible-role-hydrogen.git
version: v0.5.1-0
name: hydrogen
- src: git+https://github.com/mother-of-all-self-hosting/ansible-role-jitsi.git
version: v10741-0
name: jitsi

2
roles/custom/matrix-base/defaults/main.yml
View File

@@ -106,7 +106,7 @@ matrix_server_fqn_matrix_federation: '{{ matrix_server_fqn_matrix }}'
# This and the Matrix FQN (see above) are expected to be on the same server.
matrix_server_fqn_element: "element.{{ matrix_domain }}"
# This is where you access the Hydrogen web client from (if enabled via matrix_client_hydrogen_enabled; disabled by default).
# This is where you access the Hydrogen web client from (if enabled via hydrogen_enabled; disabled by default).
matrix_server_fqn_hydrogen: "hydrogen.{{ matrix_domain }}"
# This is where you access the Cinny web client from (if enabled via cinny_enabled; disabled by default).

198
roles/custom/matrix-client-hydrogen/defaults/main.yml
View File

@@ -1,198 +0,0 @@
# SPDX-FileCopyrightText: 2021 - 2022 Aaron Raimist
# SPDX-FileCopyrightText: 2021 - 2022 MDAD project contributors
# SPDX-FileCopyrightText: 2021 - 2025 Slavi Pantaleev
# SPDX-FileCopyrightText: 2022 - 2023 Nikita Chernyi
# SPDX-FileCopyrightText: 2022 Marko Weltzer
# SPDX-FileCopyrightText: 2022 Matthew Cengia
# SPDX-FileCopyrightText: 2023 Pierre 'McFly' Marty
# SPDX-FileCopyrightText: 2023 Samuel Meenzen
#
# SPDX-License-Identifier: AGPL-3.0-or-later
---
# Project source code URL: https://github.com/element-hq/hydrogen-web
matrix_client_hydrogen_enabled: true
matrix_client_hydrogen_container_image_self_build: false
matrix_client_hydrogen_container_image_self_build_repo: "https://github.com/element-hq/hydrogen-web.git"
# renovate: datasource=docker depName=ghcr.io/element-hq/hydrogen-web
matrix_client_hydrogen_version: v0.5.1
matrix_client_hydrogen_docker_image: "{{ matrix_client_hydrogen_docker_image_registry_prefix }}element-hq/hydrogen-web:{{ matrix_client_hydrogen_version }}"
matrix_client_hydrogen_docker_image_registry_prefix: "{{ 'localhost/' if matrix_client_hydrogen_container_image_self_build else matrix_client_hydrogen_docker_image_registry_prefix_upstream }}"
matrix_client_hydrogen_docker_image_registry_prefix_upstream: "{{ matrix_client_hydrogen_docker_image_registry_prefix_upstream_default }}"
matrix_client_hydrogen_docker_image_registry_prefix_upstream_default: ghcr.io/
matrix_client_hydrogen_docker_image_force_pull: "{{ matrix_client_hydrogen_docker_image.endswith(':latest') }}"
matrix_client_hydrogen_data_path: "{{ matrix_base_data_path }}/client-hydrogen"
matrix_client_hydrogen_docker_src_files_path: "{{ matrix_client_hydrogen_data_path }}/docker-src"
# The base container network
matrix_client_hydrogen_container_network: ''
# A list of additional container networks that the container would be connected to.
# The role does not create these networks, so make sure they already exist.
# Use this to expose this container to a reverse proxy, which runs in a different container network.
matrix_client_hydrogen_container_additional_networks: []
# Controls whether the container exposes its HTTP port (tcp/8080 in the container).
#
# Takes an "<ip>:<port>" or "<port>" value (e.g. "127.0.0.1:8768"), or empty string to not expose.
matrix_client_hydrogen_container_http_host_bind_port: ''
# matrix_client_hydrogen_container_labels_traefik_enabled controls whether labels to assist a Traefik reverse-proxy will be attached to the container.
# See `../templates/labels.j2` for details.
#
# To inject your own other container labels, see `matrix_client_hydrogen_container_labels_additional_labels`.
matrix_client_hydrogen_container_labels_traefik_enabled: true
matrix_client_hydrogen_container_labels_traefik_docker_network: "{{ matrix_client_hydrogen_container_network }}"
matrix_client_hydrogen_container_labels_traefik_hostname: "{{ matrix_client_hydrogen_hostname }}"
# The path prefix must either be `/` or not end with a slash (e.g. `/hydrogen`).
matrix_client_hydrogen_container_labels_traefik_path_prefix: "{{ matrix_client_hydrogen_path_prefix }}"
matrix_client_hydrogen_container_labels_traefik_rule: "Host(`{{ matrix_client_hydrogen_container_labels_traefik_hostname }}`){% if matrix_client_hydrogen_container_labels_traefik_path_prefix != '/' %} && PathPrefix(`{{ matrix_client_hydrogen_container_labels_traefik_path_prefix }}`){% endif %}"
matrix_client_hydrogen_container_labels_traefik_priority: 0
matrix_client_hydrogen_container_labels_traefik_entrypoints: web-secure
matrix_client_hydrogen_container_labels_traefik_tls: "{{ matrix_client_hydrogen_container_labels_traefik_entrypoints != 'web' }}"
matrix_client_hydrogen_container_labels_traefik_tls_certResolver: default # noqa var-naming
# Controls whether a compression middleware will be injected into the middlewares list.
# This compression middleware is supposed to be defined elsewhere (using labels or a File provider, etc.) and is merely referenced by this router.
matrix_client_hydrogen_container_labels_traefik_compression_middleware_enabled: false
matrix_client_hydrogen_container_labels_traefik_compression_middleware_name: ""
# Controls which additional headers to attach to all HTTP responses.
# To add your own headers, use `matrix_client_hydrogen_container_labels_traefik_additional_response_headers_custom`
matrix_client_hydrogen_container_labels_traefik_additional_response_headers: "{{ matrix_client_hydrogen_container_labels_traefik_additional_response_headers_auto | combine(matrix_client_hydrogen_container_labels_traefik_additional_response_headers_custom) }}"
matrix_client_hydrogen_container_labels_traefik_additional_response_headers_auto: |
{{
{}
| combine ({'X-XSS-Protection': matrix_client_hydrogen_http_header_xss_protection} if matrix_client_hydrogen_http_header_xss_protection else {})
| combine ({'X-Content-Type-Options': matrix_client_hydrogen_http_header_content_type_options} if matrix_client_hydrogen_http_header_content_type_options else {})
| combine ({'Content-Security-Policy': matrix_client_hydrogen_http_header_content_security_policy} if matrix_client_hydrogen_http_header_content_security_policy else {})
| combine ({'Permission-Policy': matrix_client_hydrogen_http_header_content_permission_policy} if matrix_client_hydrogen_http_header_content_permission_policy else {})
| combine ({'Strict-Transport-Security': matrix_client_hydrogen_http_header_strict_transport_security} if matrix_client_hydrogen_http_header_strict_transport_security and matrix_client_hydrogen_container_labels_traefik_tls else {})
}}
matrix_client_hydrogen_container_labels_traefik_additional_response_headers_custom: {}
# matrix_client_hydrogen_container_labels_additional_labels contains a multiline string with additional labels to add to the container label file.
# See `../templates/labels.j2` for details.
#
# Example:
# matrix_client_hydrogen_container_labels_additional_labels: |
# my.label=1
# another.label="here"
matrix_client_hydrogen_container_labels_additional_labels: ''
# A list of extra arguments to pass to the container
matrix_client_hydrogen_container_extra_arguments: []
# List of systemd services that matrix-client-hydrogen.service depends on
matrix_client_hydrogen_systemd_required_services_list: "{{ [devture_systemd_docker_base_docker_service_name] if devture_systemd_docker_base_docker_service_name else [] }}"
# Specifies the value of the `X-XSS-Protection` header
# Stops pages from loading when they detect reflected cross-site scripting (XSS) attacks.
#
# Learn more about it is here:
# - https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-XSS-Protection
# - https://portswigger.net/web-security/cross-site-scripting/reflected
matrix_client_hydrogen_http_header_xss_protection: "1; mode=block"
# Specifies the value of the `X-Content-Type-Options` header.
# See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Content-Type-Options
matrix_client_hydrogen_http_header_content_type_options: nosniff
# Specifies the value of the `Content-Security-Policy` header.
# See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy
matrix_client_hydrogen_http_header_content_security_policy: frame-ancestors 'self'
# Specifies the value of the `Permission-Policy` header.
# See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Permission-Policy
matrix_client_hydrogen_http_header_content_permission_policy: "{{ 'interest-cohort=()' if matrix_client_hydrogen_floc_optout_enabled else '' }}"
# Specifies the value of the `Strict-Transport-Security` header.
# See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security
matrix_client_hydrogen_http_header_strict_transport_security: "max-age=31536000; includeSubDomains{{ '; preload' if matrix_client_hydrogen_hsts_preload_enabled else '' }}"
# Controls whether to send a "Permissions-Policy interest-cohort=();" header along with all responses
#
# Learn more about what it is here:
# - https://www.eff.org/deeplinks/2021/03/googles-floc-terrible-idea
# - https://paramdeo.com/blog/opting-your-website-out-of-googles-floc-network
# - https://amifloced.org/
#
# Of course, a better solution is to just stop using browsers (like Chrome), which participate in such tracking practices.
# See: `matrix_client_hydrogen_content_permission_policy`
matrix_client_hydrogen_floc_optout_enabled: true
# Controls if HSTS preloading is enabled
#
# In its strongest and recommended form, the [HSTS policy](https://www.chromium.org/hsts) includes all subdomains, and
# indicates a willingness to be "preloaded" into browsers:
# `Strict-Transport-Security: max-age=31536000; includeSubDomains; preload`
# For more information visit:
# - https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security
# - https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security
# - https://hstspreload.org/#opt-in
# See: `matrix_client_hydrogen_http_header_strict_transport_security`
matrix_client_hydrogen_hsts_preload_enabled: false
matrix_client_hydrogen_scheme: https
# The hostname at which Hydrogen is served.
matrix_client_hydrogen_hostname: "{{ matrix_server_fqn_hydrogen }}"
# The path at which Hydrogen is exposed.
# This value must either be `/` or not end with a slash (e.g. `/hydrogen`).
matrix_client_hydrogen_path_prefix: /
# Controls whether the self-check feature should validate SSL certificates.
matrix_client_hydrogen_self_check_validate_certificates: true
# Controls whether the access log is enabled.
matrix_client_hydrogen_access_log_enabled: true
# config.json
matrix_client_hydrogen_push:
appId: io.element.hydrogen.web
gatewayUrl: https://matrix.org
applicationServerKey: "BC-gpSdVHEXhvHSHS0AzzWrQoukv2BE7KzpoPO_FfPacqOo3l1pdqz7rSgmB04pZCWaHPz7XRe6fjLaC-WPDopM"
matrix_client_hydrogen_default_hs_url: ""
matrix_client_hydrogen_bugReportEndpointUrl: "https://element.io/bugreports/submit" # noqa var-naming
# Default Hydrogen configuration template which covers the generic use case.
# You can customize it by controlling the various variables inside it.
#
# For a more advanced customization, you can extend the default (see `matrix_client_hydrogen_configuration_extension_json`)
# or completely replace this variable with your own template.
#
# The side-effect of this lookup is that Ansible would even parse the JSON for us, returning a dict.
# This is unlike what it does when looking up YAML template files (no automatic parsing there).
matrix_client_hydrogen_configuration_default: "{{ lookup('template', 'templates/config.json.j2', convert_data=False) | from_json }}"
# Your custom JSON configuration for Hydrogen should go to `matrix_client_hydrogen_configuration_extension_json`.
# This configuration extends the default starting configuration (`matrix_client_hydrogen_configuration_default`).
#
# You can override individual variables from the default configuration, or introduce new ones.
#
# If you need something more special, you can take full control by
# completely redefining `matrix_client_hydrogen_configuration_default`.
#
# Example configuration extension follows:
#
# matrix_client_hydrogen_configuration_extension_json: |
# {
# "push": {
# "appId": "io.element.hydrogen.web",
# "gatewayUrl": "https://matrix.org",
# "applicationServerKey": "BC-gpSdVHEXhvHSHS0AzzWrQoukv2BE7KzpoPO_FfPacqOo3l1pdqz7rSgmB04pZCWaHPz7XRe6fjLaC-WPDopM"
# },
# "defaultHomeServer": "matrix.org"
# }
matrix_client_hydrogen_configuration_extension_json: '{}'
matrix_client_hydrogen_configuration_extension: "{{ matrix_client_hydrogen_configuration_extension_json | from_json if matrix_client_hydrogen_configuration_extension_json | from_json is mapping else {} }}"
# Holds the final Hydrogen configuration (a combination of the default and its extension).
# You most likely don't need to touch this variable. Instead, see `matrix_client_hydrogen_configuration_default`.
matrix_client_hydrogen_configuration: "{{ matrix_client_hydrogen_configuration_default | combine(matrix_client_hydrogen_configuration_extension, recursive=True) }}"

32
roles/custom/matrix-client-hydrogen/tasks/main.yml
View File

@@ -1,32 +0,0 @@
# SPDX-FileCopyrightText: 2021 - 2023 Slavi Pantaleev
# SPDX-FileCopyrightText: 2021 Aaron Raimist
# SPDX-FileCopyrightText: 2022 Marko Weltzer
#
# SPDX-License-Identifier: AGPL-3.0-or-later
---
- tags:
- setup-all
- setup-client-hydrogen
- install-all
- install-client-hydrogen
block:
- when: matrix_client_hydrogen_enabled | bool
ansible.builtin.include_tasks: "{{ role_path }}/tasks/validate_config.yml"
- when: matrix_client_hydrogen_enabled | bool
ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_install.yml"
- tags:
- setup-all
- setup-client-hydrogen
block:
- when: not matrix_client_hydrogen_enabled | bool
ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_uninstall.yml"
- tags:
- self-check
block:
- when: matrix_client_hydrogen_enabled | bool
ansible.builtin.include_tasks: "{{ role_path }}/tasks/self_check.yml"

30
roles/custom/matrix-client-hydrogen/tasks/self_check.yml
View File

@@ -1,30 +0,0 @@
# SPDX-FileCopyrightText: 2021 - 2022 Aaron Raimist
# SPDX-FileCopyrightText: 2022 - 2024 Slavi Pantaleev
# SPDX-FileCopyrightText: 2022 Marko Weltzer
#
# SPDX-License-Identifier: AGPL-3.0-or-later
---
- ansible.builtin.set_fact:
matrix_client_hydrogen_url_endpoint_public: "{{ matrix_client_hydrogen_scheme }}://{{ matrix_client_hydrogen_hostname }}{{ matrix_client_hydrogen_path_prefix }}/config.json"
- name: Check Hydrogen
ansible.builtin.uri:
url: "{{ matrix_client_hydrogen_url_endpoint_public }}"
follow_redirects: none
validate_certs: "{{ matrix_client_hydrogen_self_check_validate_certificates }}"
register: matrix_client_hydrogen_self_check_result
check_mode: false
ignore_errors: true
delegate_to: 127.0.0.1
become: false
- name: Fail if Hydrogen not working
ansible.builtin.fail:
msg: "Failed checking Hydrogen is up at `{{ matrix_client_hydrogen_hostname }}` (checked endpoint: `{{ matrix_client_hydrogen_url_endpoint_public }}`). Is Hydrogen running? Is port 443 open in your firewall? Full error: {{ matrix_client_hydrogen_self_check_result }}"
when: "matrix_client_hydrogen_self_check_result.failed or 'json' not in matrix_client_hydrogen_self_check_result"
- name: Report working Hydrogen
ansible.builtin.debug:
msg: "Hydrogen at `{{ matrix_client_hydrogen_hostname }}` is working (checked endpoint: `{{ matrix_client_hydrogen_url_endpoint_public }}`)"

101
roles/custom/matrix-client-hydrogen/tasks/setup_install.yml
View File

@@ -1,101 +0,0 @@
# SPDX-FileCopyrightText: 2021 - 2022 Aaron Raimist
# SPDX-FileCopyrightText: 2021 - 2024 Slavi Pantaleev
# SPDX-FileCopyrightText: 2022 Marko Weltzer
# SPDX-FileCopyrightText: 2022 Matthew Cengia
# SPDX-FileCopyrightText: 2022 Nikita Chernyi
# SPDX-FileCopyrightText: 2022 Sebastian Gumprich
# SPDX-FileCopyrightText: 2023 Julian Foad
# SPDX-FileCopyrightText: 2024 David Mehren
#
# SPDX-License-Identifier: AGPL-3.0-or-later
---
- name: Ensure Hydrogen paths exists
ansible.builtin.file:
path: "{{ item.path }}"
state: directory
mode: 0750
owner: "{{ matrix_user_name }}"
group: "{{ matrix_group_name }}"
with_items:
- {path: "{{ matrix_client_hydrogen_data_path }}", when: true}
- {path: "{{ matrix_client_hydrogen_docker_src_files_path }}", when: "{{ matrix_client_hydrogen_container_image_self_build }}"}
when: "item.when | bool"
- when: "matrix_client_hydrogen_container_image_self_build | bool"
block:
- name: Ensure Hydrogen repository is present on self-build
ansible.builtin.git:
repo: "{{ matrix_client_hydrogen_container_image_self_build_repo }}"
dest: "{{ matrix_client_hydrogen_docker_src_files_path }}"
version: "{{ matrix_client_hydrogen_docker_image.split(':')[1] }}"
force: "yes"
become: true
become_user: "{{ matrix_user_name }}"
register: matrix_client_hydrogen_git_pull_results
- name: Check if Hydrogen Docker image exists
ansible.builtin.command: "{{ devture_systemd_docker_base_host_command_docker }} images --quiet --filter 'reference={{ matrix_client_hydrogen_docker_image }}'"
register: matrix_client_hydrogen_docker_image_check_result
changed_when: false
# Invoking the `docker build` command here, instead of calling the `docker_image` Ansible module,
# because the latter does not support BuildKit.
# See: https://github.com/ansible-collections/community.general/issues/514
- name: Ensure Hydrogen Docker image is built
ansible.builtin.shell:
chdir: "{{ matrix_client_hydrogen_docker_src_files_path }}"
cmd: |
{{ devture_systemd_docker_base_host_command_docker }} build \
-t "{{ matrix_client_hydrogen_docker_image }}" \
-f Dockerfile \
.
environment:
DOCKER_BUILDKIT: 1
changed_when: true
when: "matrix_client_hydrogen_git_pull_results.changed | bool or matrix_client_hydrogen_docker_image_check_result.stdout == ''"
- name: Ensure Hydrogen Docker image is pulled
community.docker.docker_image:
name: "{{ matrix_client_hydrogen_docker_image }}"
source: "{{ 'pull' if ansible_version.major > 2 or ansible_version.minor > 7 else omit }}"
force_source: "{{ matrix_client_hydrogen_docker_image_force_pull if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}"
force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else matrix_client_hydrogen_docker_image_force_pull }}"
when: "not matrix_client_hydrogen_container_image_self_build | bool"
register: result
retries: "{{ devture_playbook_help_container_retries_count }}"
delay: "{{ devture_playbook_help_container_retries_delay }}"
until: result is not failed
- name: Ensure Hydrogen configuration installed
ansible.builtin.copy:
content: "{{ matrix_client_hydrogen_configuration | to_nice_json }}"
dest: "{{ matrix_client_hydrogen_data_path }}/config.json"
mode: 0644
owner: "{{ matrix_user_name }}"
group: "{{ matrix_group_name }}"
- name: Ensure Hydrogen additional config files installed
ansible.builtin.template:
src: "{{ item.src }}"
dest: "{{ matrix_client_hydrogen_data_path }}/{{ item.name }}"
mode: 0644
owner: "{{ matrix_user_name }}"
group: "{{ matrix_group_name }}"
with_items:
- {src: "{{ role_path }}/templates/nginx.conf.j2", name: "nginx.conf"}
- {src: "{{ role_path }}/templates/labels.j2", name: "labels"}
- name: Ensure Hydrogen container network is created
community.general.docker_network:
enable_ipv6: "{{ devture_systemd_docker_base_ipv6_enabled }}"
name: "{{ matrix_client_hydrogen_container_network }}"
driver: bridge
driver_options: "{{ devture_systemd_docker_base_container_networks_driver_options }}"
- name: Ensure matrix-client-hydrogen.service installed
ansible.builtin.template:
src: "{{ role_path }}/templates/systemd/matrix-client-hydrogen.service.j2"
dest: "{{ devture_systemd_docker_base_systemd_path }}/matrix-client-hydrogen.service"
mode: 0644

31
roles/custom/matrix-client-hydrogen/tasks/setup_uninstall.yml
View File

@@ -1,31 +0,0 @@
# SPDX-FileCopyrightText: 2021 - 2022 Slavi Pantaleev
# SPDX-FileCopyrightText: 2022 Marko Weltzer
# SPDX-FileCopyrightText: 2022 Sebastian Gumprich
#
# SPDX-License-Identifier: AGPL-3.0-or-later
---
- name: Check existence of matrix-client-hydrogen.service
ansible.builtin.stat:
path: "{{ devture_systemd_docker_base_systemd_path }}/matrix-client-hydrogen.service"
register: matrix_client_hydrogen_service_stat
- when: matrix_client_hydrogen_service_stat.stat.exists | bool
block:
- name: Ensure matrix-client-hydrogen is stopped
ansible.builtin.service:
name: matrix-client-hydrogen
state: stopped
enabled: false
daemon_reload: true
- name: Ensure matrix-client-hydrogen.service doesn't exist
ansible.builtin.file:
path: "{{ devture_systemd_docker_base_systemd_path }}/matrix-client-hydrogen.service"
state: absent
- name: Ensure Hydrogen paths doesn't exist
ansible.builtin.file:
path: "{{ matrix_client_hydrogen_data_path }}"
state: absent

45
roles/custom/matrix-client-hydrogen/tasks/validate_config.yml
View File

@@ -1,45 +0,0 @@
# SPDX-FileCopyrightText: 2021 Aaron Raimist
# SPDX-FileCopyrightText: 2022 - 2025 Slavi Pantaleev
# SPDX-FileCopyrightText: 2024 Suguru Hirahara
#
# SPDX-License-Identifier: AGPL-3.0-or-later
---
- name: Fail if required Hydrogen settings not defined
ansible.builtin.fail:
msg: >
You need to define a required configuration setting (`{{ item }}`) to use Hydrogen.
when: "item.when | bool and lookup('vars', item.name, default='') | string | length == 0"
with_items:
- {'name': 'matrix_client_hydrogen_default_hs_url', when: "{{ matrix_client_hydrogen_container_image_self_build }}"}
- {'name': 'matrix_client_hydrogen_container_network', when: true}
- {'name': 'matrix_client_hydrogen_container_labels_traefik_compression_middleware_name', when: "{{ matrix_client_hydrogen_container_labels_traefik_compression_middleware_enabled }}"}
- name: (Deprecation) Catch and report renamed Hydrogen variables
ansible.builtin.fail:
msg: >-
The variable `{{ item.old }}` is deprecated. Please use `{{ item.new }}` instead.
when: "lookup('ansible.builtin.varnames', ('^' + item.old + '$'), wantlist=True) | length > 0"
with_items:
- {'old': 'matrix_client_hydrogen_container_image_name_prefix', 'new': 'matrix_client_hydrogen_container_image_registry_prefix'}
- when: matrix_client_hydrogen_container_labels_traefik_enabled | bool
block:
- name: Fail if required matrix-client-hydrogen Traefik settings not defined
ansible.builtin.fail:
msg: >-
You need to define a required configuration setting (`{{ item }}`).
when: "lookup('vars', item, default='') == ''"
with_items:
- matrix_client_hydrogen_container_labels_traefik_hostname
- matrix_client_hydrogen_container_labels_traefik_path_prefix
# We ensure it doesn't end with a slash, because we handle both (slash and no-slash).
# Knowing that `matrix_client_hydrogen_container_labels_traefik_path_prefix` does not end with a slash
# ensures we know how to set these routes up without having to do "does it end with a slash" checks elsewhere.
- name: Fail if matrix_client_hydrogen_container_labels_traefik_path_prefix ends with a slash
ansible.builtin.fail:
msg: >-
matrix_client_hydrogen_container_labels_traefik_path_prefix (`{{ matrix_client_hydrogen_container_labels_traefik_path_prefix }}`) must either be `/` or not end with a slash (e.g. `/hydrogen`).
when: "matrix_client_hydrogen_container_labels_traefik_path_prefix != '/' and matrix_client_hydrogen_container_labels_traefik_path_prefix[-1] == '/'"

12
roles/custom/matrix-client-hydrogen/templates/config.json.j2
View File

@@ -1,12 +0,0 @@
{
"push": {{ matrix_client_hydrogen_push | to_json }},
"defaultHomeServer": {{ matrix_client_hydrogen_default_hs_url | string | to_json }},
"bugReportEndpointUrl": {{ matrix_client_hydrogen_bugReportEndpointUrl | to_json }},
"themeManifests": [
"{{ '' if matrix_client_hydrogen_path_prefix == '/' else matrix_client_hydrogen_path_prefix }}/assets/theme-element.json"
],
"defaultTheme": {
"light": "element-light",
"dark": "element-dark"
}
}

7
roles/custom/matrix-client-hydrogen/templates/config.json.j2.license
View File

@@ -1,7 +0,0 @@
SPDX-FileCopyrightText: 2021 - 2022 Aaron Raimist
SPDX-FileCopyrightText: 2022 - 2023 Slavi Pantaleev
SPDX-FileCopyrightText: 2022 Matthew Cengia
SPDX-FileCopyrightText: 2022 Nikita Chernyi
SPDX-FileCopyrightText: 2023 Sergio Durigan Junior
SPDX-License-Identifier: AGPL-3.0-or-later

56
roles/custom/matrix-client-hydrogen/templates/labels.j2
View File

@@ -1,56 +0,0 @@
{#
SPDX-FileCopyrightText: 2023 - 2024 Slavi Pantaleev
SPDX-License-Identifier: AGPL-3.0-or-later
#}
{% if matrix_client_hydrogen_container_labels_traefik_enabled %}
traefik.enable=true
{% if matrix_client_hydrogen_container_labels_traefik_docker_network %}
traefik.docker.network={{ matrix_client_hydrogen_container_labels_traefik_docker_network }}
{% endif %}
traefik.http.services.matrix-client-hydrogen.loadbalancer.server.port=8080
{% set middlewares = [] %}
{% if matrix_client_hydrogen_container_labels_traefik_compression_middleware_enabled %}
{% set middlewares = middlewares + [matrix_client_hydrogen_container_labels_traefik_compression_middleware_name] %}
{% endif %}
{% if matrix_client_hydrogen_container_labels_traefik_path_prefix != '/' %}
traefik.http.middlewares.matrix-client-hydrogen-slashless-redirect.redirectregex.regex=({{ matrix_client_hydrogen_container_labels_traefik_path_prefix | quote }})$
traefik.http.middlewares.matrix-client-hydrogen-slashless-redirect.redirectregex.replacement=${1}/
{% set middlewares = middlewares + ['matrix-client-hydrogen-slashless-redirect'] %}
{% endif %}
{% if matrix_client_hydrogen_container_labels_traefik_path_prefix != '/' %}
traefik.http.middlewares.matrix-client-hydrogen-strip-prefix.stripprefix.prefixes={{ matrix_client_hydrogen_container_labels_traefik_path_prefix }}
{% set middlewares = middlewares + ['matrix-client-hydrogen-strip-prefix'] %}
{% endif %}
{% if matrix_client_hydrogen_container_labels_traefik_additional_response_headers.keys() | length > 0 %}
{% for name, value in matrix_client_hydrogen_container_labels_traefik_additional_response_headers.items() %}
traefik.http.middlewares.matrix-client-hydrogen-add-headers.headers.customresponseheaders.{{ name }}={{ value }}
{% endfor %}
{% set middlewares = middlewares + ['matrix-client-hydrogen-add-headers'] %}
{% endif %}
traefik.http.routers.matrix-client-hydrogen.rule={{ matrix_client_hydrogen_container_labels_traefik_rule }}
{% if matrix_client_hydrogen_container_labels_traefik_priority | int > 0 %}
traefik.http.routers.matrix-client-hydrogen.priority={{ matrix_client_hydrogen_container_labels_traefik_priority }}
{% endif %}
traefik.http.routers.matrix-client-hydrogen.service=matrix-client-hydrogen
{% if middlewares | length > 0 %}
traefik.http.routers.matrix-client-hydrogen.middlewares={{ middlewares | join(',') }}
{% endif %}
traefik.http.routers.matrix-client-hydrogen.entrypoints={{ matrix_client_hydrogen_container_labels_traefik_entrypoints }}
traefik.http.routers.matrix-client-hydrogen.tls={{ matrix_client_hydrogen_container_labels_traefik_tls | to_json }}
{% if matrix_client_hydrogen_container_labels_traefik_tls %}
traefik.http.routers.matrix-client-hydrogen.tls.certResolver={{ matrix_client_hydrogen_container_labels_traefik_tls_certResolver }}
{% endif %}
{% endif %}
{{ matrix_client_hydrogen_container_labels_additional_labels }}

70
roles/custom/matrix-client-hydrogen/templates/nginx.conf.j2
View File

@@ -1,70 +0,0 @@
#jinja2: lstrip_blocks: True
# This is a custom nginx configuration file that we use in the container (instead of the default one),
# because it allows us to run nginx with a non-root user.
#
# For this to work, the default vhost file (`/etc/nginx/conf.d/default.conf`) also needs to be removed.
# (mounting `/dev/null` over `/etc/nginx/conf.d/default.conf` works well)
#
# The following changes have been done compared to a default nginx configuration file:
# - default server port is changed (80 -> 8080), so that a non-root user can bind it
# - various temp paths are changed to `/tmp`, so that a non-root user can write to them
# - the `user` directive was removed, as we don't want nginx to switch users
worker_processes 1;
error_log /var/log/nginx/error.log warn;
pid /tmp/nginx.pid;
events {
worker_connections 1024;
}
http {
proxy_temp_path /tmp/proxy_temp;
client_body_temp_path /tmp/client_temp;
fastcgi_temp_path /tmp/fastcgi_temp;
uwsgi_temp_path /tmp/uwsgi_temp;
scgi_temp_path /tmp/scgi_temp;
include /etc/nginx/mime.types;
default_type application/octet-stream;
log_format main '$remote_addr - $remote_user [$time_local] "$request" '
'$status $body_bytes_sent "$http_referer" '
'"$http_user_agent" "$http_x_forwarded_for"';
{% if matrix_client_hydrogen_access_log_enabled %}
access_log /var/log/nginx/access.log main;
{% else %}
access_log off;
{% endif %}
sendfile on;
#tcp_nopush on;
keepalive_timeout 65;
#gzip on;
server {
listen 8080;
server_name localhost;
root /usr/share/nginx/html;
location / {
index index.html index.htm;
}
location ~* ^/(config(.+)?\.json$|(.+)\.html$|i18n) {
expires -1;
}
error_page 500 502 503 504 /50x.html;
location = /50x.html {
root /usr/share/nginx/html;
}
}
}

4
roles/custom/matrix-client-hydrogen/templates/nginx.conf.j2.license
View File

@@ -1,4 +0,0 @@
SPDX-FileCopyrightText: 2021 Aaron Raimist
SPDX-FileCopyrightText: 2022 Slavi Pantaleev
SPDX-License-Identifier: AGPL-3.0-or-later

50
roles/custom/matrix-client-hydrogen/templates/systemd/matrix-client-hydrogen.service.j2
View File

@@ -1,50 +0,0 @@
#jinja2: lstrip_blocks: True
[Unit]
Description=Matrix Hydrogen Client
{% for service in matrix_client_hydrogen_systemd_required_services_list %}
Requires={{ service }}
After={{ service }}
{% endfor %}
DefaultDependencies=no
[Service]
Type=simple
Environment="HOME={{ devture_systemd_docker_base_systemd_unit_home_path }}"
ExecStartPre=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} stop -t {{ devture_systemd_docker_base_container_stop_grace_time_seconds }} matrix-client-hydrogen 2>/dev/null || true'
ExecStartPre=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} rm matrix-client-hydrogen 2>/dev/null || true'
ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} create \
--rm \
--name=matrix-client-hydrogen \
--log-driver=none \
--user={{ matrix_user_uid }}:{{ matrix_user_gid }} \
--cap-drop=ALL \
--read-only \
--network={{ matrix_client_hydrogen_container_network }} \
{% if matrix_client_hydrogen_container_http_host_bind_port %}
-p {{ matrix_client_hydrogen_container_http_host_bind_port }}:8080 \
{% endif %}
--label-file={{ matrix_client_hydrogen_data_path }}/labels \
--tmpfs=/tmp:rw,noexec,nosuid,size=10m \
--mount type=bind,src={{ matrix_client_hydrogen_data_path }}/nginx.conf,dst=/etc/nginx/nginx.conf,ro \
--mount type=bind,src={{ matrix_client_hydrogen_data_path }}/config.json,dst=/config.json.bundled,ro \
{% for arg in matrix_client_hydrogen_container_extra_arguments %}
{{ arg }} \
{% endfor %}
{{ matrix_client_hydrogen_docker_image }}
{% for network in matrix_client_hydrogen_container_additional_networks %}
ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} network connect {{ network }} matrix-client-hydrogen
{% endfor %}
ExecStart={{ devture_systemd_docker_base_host_command_docker }} start --attach matrix-client-hydrogen
ExecStop=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} stop -t {{ devture_systemd_docker_base_container_stop_grace_time_seconds }} matrix-client-hydrogen 2>/dev/null || true'
ExecStop=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} rm matrix-client-hydrogen 2>/dev/null || true'
Restart=always
RestartSec=30
SyslogIdentifier=matrix-client-hydrogen
[Install]
WantedBy=multi-user.target

5
roles/custom/matrix-client-hydrogen/templates/systemd/matrix-client-hydrogen.service.j2.license
View File

@@ -1,5 +0,0 @@
SPDX-FileCopyrightText: 2021 - 2025 Slavi Pantaleev
SPDX-FileCopyrightText: 2021 Aaron Raimist
SPDX-FileCopyrightText: 2022 Matthew Cengia
SPDX-License-Identifier: AGPL-3.0-or-later

18
roles/custom/matrix_playbook_migration/tasks/validate_config.yml
View File

@@ -90,6 +90,11 @@
- {'old': 'ddclient_docker_image_registry_prefix_upstream', 'new': 'ddclient_container_image_registry_prefix_upstream'}
- {'old': 'ddclient_docker_image_registry_prefix_upstream_default', 'new': 'ddclient_container_image_registry_prefix_upstream_default'}
- {'old': 'hydrogen_docker_image', 'new': 'hydrogen_container_image'}
- {'old': 'hydrogen_docker_image_registry_prefix', 'new': 'hydrogen_container_image_registry_prefix'}
- {'old': 'hydrogen_docker_image_registry_prefix_upstream', 'new': 'hydrogen_container_image_registry_prefix_upstream'}
- {'old': 'hydrogen_docker_image_registry_prefix_upstream_default', 'new': 'hydrogen_container_image_registry_prefix_upstream_default'}
- name: (Deprecation) Catch and report matrix_postgres variables
ansible.builtin.fail:
msg: |-
@@ -600,6 +605,19 @@
The following variables in your configuration need to be renamed: {{ lookup('ansible.builtin.varnames', '^matrix_client_cinny_.+', wantlist=True) | join(', ') }}
when: "lookup('ansible.builtin.varnames', '^matrix_client_cinny_.+', wantlist=True) | length > 0"
- name: (Deprecation) Catch and report matrix-client-hydrogen variables
ansible.builtin.fail:
msg: |-
The matrix-client-hydrogen role in the playbook now lives under the MASH organization (https://github.com/mother-of-all-self-hosting/ansible-role-hydrogen).
The new role is pretty much the same, but uses differently named variables.
Please rename all `matrix_client_hydrogen_`-prefixed variables (`matrix_client_hydrogen_*` -> `hydrogen_*`) on your configuration file (vars.yml).
After renaming them, please do not forget to fetch the Ansible role. See docs/maintenance-upgrading-services.md for details about how to do so.
The following variables in your configuration need to be renamed: {{ lookup('ansible.builtin.varnames', '^matrix_client_hydrogen_.+', wantlist=True) | join(', ') }}
when: "lookup('ansible.builtin.varnames', '^matrix_client_hydrogen_.+', wantlist=True) | length > 0"
- name: (Deprecation) Catch and report matrix-coturn variables
ansible.builtin.fail:
msg: |-

2
setup.yml
View File

@@ -108,7 +108,7 @@
- custom/matrix-prometheus-services-connect
- custom/matrix-registration
- custom/matrix-client-element
- custom/matrix-client-hydrogen
- galaxy/hydrogen
- galaxy/cinny
- custom/matrix-client-schildichat
- custom/matrix-client-fluffychat