Make IRC bridge configuration entirely managed by the playbook

roles/matrix-bridge-appservice-irc/tasks/init.yml

@@ -1,3 +1,11 @@
+# If the matrix-synapse role is not used, `matrix_synapse_role_executed` won't exist.
+# We don't want to fail in such cases.
+- name: Fail if matrix-synapse role already executed
+  fail:
+    msg: >-
+      The matrix-bridge-appservice-irc role needs to execute before the matrix-synapse role.
+  when: "matrix_appservice_irc_enabled|bool and matrix_synapse_role_executed|default(False)"
+
 - set_fact:
     matrix_systemd_services_list: "{{ matrix_systemd_services_list + ['matrix-appservice-irc'] }}"
   when: matrix_appservice_irc_enabled|bool
@@ -7,7 +15,7 @@
     matrix_synapse_container_extra_arguments: >
       {{ matrix_synapse_container_extra_arguments|default([]) }}
       +
-      {{ ["--mount type=bind,src={{ matrix_appservice_irc_base_path }}/registration.yaml,dst=/matrix-appservice-irc-registration.yaml,ro"] }}
+      {{ ["--mount type=bind,src={{ matrix_appservice_irc_config_path }}/registration.yaml,dst=/matrix-appservice-irc-registration.yaml,ro"] }}
 
     matrix_synapse_app_service_config_files: >
       {{ matrix_synapse_app_service_config_files|default([]) }}

roles/matrix-bridge-appservice-irc/tasks/setup_install.yml

@@ -1,13 +1,5 @@
 ---
 
-# If the matrix-synapse role is not used, `matrix_synapse_role_executed` won't exist.
-# We don't want to fail in such cases.
-- name: Fail if matrix-synapse role already executed
-  fail:
-    msg: >-
-      The matrix-bridge-appservice-irc role needs to execute before the matrix-synapse role.
-  when: "matrix_synapse_role_executed|default(False)"
-
 - name: Ensure Appservice IRC image is pulled
   docker_image:
     name: "{{ matrix_appservice_irc_docker_image }}"
@@ -15,31 +7,122 @@
     force_source: "{{ matrix_appservice_irc_docker_image_force_pull if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}"
     force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else matrix_appservice_irc_docker_image_force_pull }}"
 
-- name: Ensure Appservice IRC base directory exists
+- name: Ensure Appservice IRC paths exist
   file:
-    path: "{{ matrix_appservice_irc_base_path }}"
+    path: "{{ item }}"
     state: directory
     mode: 0750
     owner: "{{ matrix_user_username }}"
     group: "{{ matrix_user_username }}"
+  with_items:
+    - "{{ matrix_appservice_irc_base_path }}"
+    - "{{ matrix_appservice_irc_config_path }}"
+    - "{{ matrix_appservice_irc_data_path }}"
+
+- name: Check if an old passkey file already exists
+  stat:
+    path: "{{ matrix_appservice_irc_base_path }}/passkey.pem"
+  register: matrix_appservice_irc_stat_passkey
+
+- name: (Data relocation) Ensure matrix-appservice-irc.service is stopped
+  service:
+    name: matrix-appservice-irc
+    state: stopped
+    daemon_reload: yes
+  failed_when: false
+  when: "matrix_appservice_irc_stat_passkey.stat.exists"
+
+- name: (Data relocation) Move AppService IRC passkey.pem file to ./data directory
+  command: "mv {{ matrix_appservice_irc_base_path }}/passkey.pem {{ matrix_appservice_irc_data_path }}/passkey.pem"
+  when: "matrix_appservice_irc_stat_passkey.stat.exists"
+
+- name: (Data relocation) Move AppService database files to ./data directory
+  command: "mv {{ matrix_appservice_irc_base_path }}/{{ item }} {{ matrix_appservice_irc_data_path }}/{{ item }}"
+  with_items:
+    - rooms.db
+    - users.db
+  failed_when: false
+  when: "matrix_appservice_irc_stat_passkey.stat.exists"
 
 - name: Ensure Matrix Appservice IRC config installed
   copy:
     content: "{{ matrix_appservice_irc_configuration|to_nice_yaml }}"
-    dest: "{{ matrix_appservice_irc_base_path }}/config.yaml"
+    dest: "{{ matrix_appservice_irc_config_path }}/config.yaml"
     mode: 0644
     owner: "{{ matrix_user_username }}"
     group: "{{ matrix_user_username }}"
 
-- name: Check if matrix-appservice-irc passkey exists
+- name: Check if Appservice IRC passkey exists
   stat:
-    path: "{{ matrix_appservice_irc_base_path }}/passkey.pem"
+    path: "{{ matrix_appservice_irc_data_path }}/passkey.pem"
   register: irc_passkey_file
 
-- name: Generate matrix-appservice-irc passkey if it doesn't exist
-  shell: /usr/bin/openssl genpkey -out {{ matrix_appservice_irc_base_path }}/passkey.pem -outform PEM -algorithm RSA -pkeyopt rsa_keygen_bits:2048
+- name: Generate Appservice IRC passkey if it doesn't exist
+  shell: /usr/bin/openssl genpkey -out {{ matrix_appservice_irc_data_path }}/passkey.pem -outform PEM -algorithm RSA -pkeyopt rsa_keygen_bits:2048
   when: "not irc_passkey_file.stat.exists"
 
+# Ideally, we'd like to generate the final registration.yaml file by ourselves.
+#
+# However, the IRC bridge supports multiple servers, which leads to multiple
+# users/aliases/rooms rules in the registration file.
+#
+# Generating a proper file by ourselves is complicated and may lead to deviation
+# from what the bridge is doing.
+#
+# Instead, we do another hacky thing - asking the bridge to generate a template,
+# and then we parse it and fix it up with our own AS/HS token.
+# We need to do this, because:
+# - we'd like to have an up-to-date registration file
+# - we can achieve this by asking the bridge to rebuild it each time
+# - however, the bridge insists on regenerating all tokens each time
+# - .. which is not friendly for integrating with the homeserver
+#
+# So we have a hybrid approach. We ask the bridge to always generate
+# an up-to-date file, and we fix it up with some static values later on,
+# to produce a final registration.yaml file, as we desire.
+- name: Generate Appservice IRC registration-template.yaml
+  shell: >-
+    /usr/bin/docker run --rm --name matrix-appservice-irc-gen
+    --user={{ matrix_user_uid }}:{{ matrix_user_gid }}
+    --cap-drop=ALL
+    -v {{ matrix_appservice_irc_config_path }}:/config:z
+    -v {{ matrix_appservice_irc_data_path }}:/data:z
+    {{ matrix_appservice_irc_docker_image }}
+    node app.js
+    -r
+    -f /config/registration-template.yaml
+    -u "http://matrix-appservice-irc:9999"
+    -c /config/config.yaml
+    -l irc_bot
+  changed_when: false
+
+- name: Read Appservice IRC registration-template.yaml
+  slurp:
+    src: "{{ matrix_appservice_irc_config_path }}/registration-template.yaml"
+  register: matrix_appservice_irc_registration_template_slurp
+
+- name: Remove unnecessary Appservice IRC registration-template.yaml
+  file:
+    path: "{{ matrix_appservice_irc_config_path }}/registration-template.yaml"
+    state: absent
+  changed_when: false
+
+- name: Parse registration-template.yaml
+  set_fact:
+    matrix_appservice_irc_registration_template: "{{ matrix_appservice_irc_registration_template_slurp['content'] | b64decode | from_yaml }}"
+
+- name: Combine registration-template.yaml and own registration override config
+  set_fact:
+    matrix_appservice_irc_registration: "{{ matrix_appservice_irc_registration_template|combine(matrix_appservice_irc_registration_override, recursive=True) }}"
+
+- name: Ensure Appservice IRC registration.yaml installed
+  copy:
+    content: "{{ matrix_appservice_irc_registration|to_nice_yaml }}"
+    dest: "{{ matrix_appservice_irc_config_path }}/registration.yaml"
+    mode: 0644
+    owner: "{{ matrix_user_username }}"
+    group: "{{ matrix_user_username }}"
+
 - name: Ensure matrix-appservice-irc.service installed
   template:
     src: "{{ role_path }}/templates/systemd/matrix-appservice-irc.service.j2"
@@ -51,31 +134,3 @@
   service:
     daemon_reload: yes
   when: "matrix_appservice_irc_systemd_service_result.changed"
-
-- name: Check if a matrix-appservice-irc registration file exists
-  stat:
-    path: "{{ matrix_appservice_irc_base_path }}/registration.yaml"
-  register: appservice_irc_registration_file
-
-- name: Generate matrix-appservice-irc registration.yaml if it doesn't exist
-  shell: >-
-    /usr/bin/docker run --rm --name matrix-appservice-irc-gen
-    --user={{ matrix_user_uid }}:{{ matrix_user_gid }} \
-    --cap-drop=ALL \
-    -v {{ matrix_appservice_irc_base_path }}:/data:z
-    {{ matrix_appservice_irc_docker_image }}
-    node app.js
-    -r
-    -f /data/registration.yaml
-    -u "http://matrix-appservice-irc:9999"
-    -c /data/config.yaml
-    -l irc_bot
-  when: "not appservice_irc_registration_file.stat.exists"
-
-- name: Ensure IRC configuration directory permissions are correct
-  file:
-    path: "{{ matrix_appservice_irc_base_path }}"
-    state: directory
-    owner: "{{ matrix_user_username }}"
-    group: "{{ matrix_user_username }}"
-    recurse: true

roles/matrix-bridge-appservice-irc/tasks/validate_config.yml

@@ -1,5 +1,14 @@
 ---
 
+- name: Fail if required settings not defined
+  fail:
+    msg: >-
+      You need to define a required configuration setting (`{{ item }}`).
+  when: "vars[item] == ''"
+  with_items:
+    - "matrix_appservice_irc_appservice_token"
+    - "matrix_appservice_irc_homeserver_token"
+
 # Our base configuration (`matrix_appservice_irc_configuration_yaml`) is not enough to
 # let the playbook run without errors.
 #
@@ -10,9 +19,11 @@
 - name: Fail if no additional configuration provided
   fail:
     msg: >-
-      Your Appservice IRC configuration is incomplete (lacking an `ircService` key).
-      You need to define additional configuration in `matrix_appservice_irc_configuration_extension_yaml` or to override `matrix_appservice_irc_configuration`.
-  when: "matrix_appservice_irc_configuration.ircService|default(none) is none"
+      Your Appservice IRC configuration is incomplete (lacking an `ircService.servers` configuration).
+      You need to define one or more servers by either using `matrix_appservice_irc_ircService_servers`
+      or by extending the base configuration with additional configuration in `matrix_appservice_irc_configuration_extension_yaml`.
+      Overriding the whole bridge's configuration (`matrix_appservice_irc_configuration`) is yet another possibility.
+  when: "matrix_appservice_irc_configuration.ircService.servers|length == 0"
 
 - name: (Deprecation) Catch and report renamed appservice-irc variables
   fail: