finallycoffee/matrix-docker-ansible-deploy
5
1
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Upgrade Matrix Authentication Service (v0.15.0 -> v0.16.0) and adapt for the new syn2mas subcommand

Browse Source 
Fixes https://github.com/spantaleev/matrix-docker-ansible-deploy/issues/4297

Supersedes https://github.com/spantaleev/matrix-docker-ansible-deploy/pull/4300
This commit is contained in:
Slavi Pantaleev
2025-05-07 17:33:55 +03:00
parent 95ef383ef7
commit 19ccd491fb
9 changed files with 91 additions and 106 deletions
Download Patch File Download Diff File Expand all files Collapse all files

39
roles/custom/matrix-authentication-service/defaults/main.yml
View File

@ -22,7 +22,7 @@ matrix_authentication_service_container_repo_version: "{{ 'main' if matrix_authe
matrix_authentication_service_container_src_files_path: "{{ matrix_base_data_path }}/matrix-authentication-service/container-src"
# renovate: datasource=docker depName=ghcr.io/element-hq/matrix-authentication-service
matrix_authentication_service_version: 0.15.0
matrix_authentication_service_version: 0.16.0
matrix_authentication_service_container_image_registry_prefix: "{{ 'localhost/' if matrix_authentication_service_container_image_self_build else matrix_authentication_service_container_image_registry_prefix_upstream }}"
matrix_authentication_service_container_image_registry_prefix_upstream: "{{ matrix_authentication_service_container_image_registry_prefix_upstream_default }}"
matrix_authentication_service_container_image_registry_prefix_upstream_default: "ghcr.io/"
@ -559,29 +559,34 @@ matrix_authentication_service_container_labels_additional_labels: ''
matrix_authentication_service_syn2mas_start_wait_time_seconds: 5
matrix_authentication_service_syn2mas_dry_run: false
# The syn2mas sub-command to run.
# Valid values: migrate, check
matrix_authentication_service_syn2mas_subcommand: migrate
# renovate: datasource=docker depName=ghcr.io/element-hq/matrix-authentication-service/syn2mas
matrix_authentication_service_syn2mas_version: 0.15.0
matrix_authentication_service_syn2mas_container_image: "{{ matrix_authentication_service_syn2mas_container_image_registry_prefix }}element-hq/matrix-authentication-service/syn2mas:{{ matrix_authentication_service_syn2mas_version }}"
matrix_authentication_service_syn2mas_container_image_registry_prefix: "{{ 'localhost/' if matrix_authentication_service_container_image_self_build else matrix_authentication_service_syn2mas_container_image_registry_prefix_upstream }}"
matrix_authentication_service_syn2mas_container_image_registry_prefix_upstream: "{{ matrix_authentication_service_syn2mas_container_image_registry_prefix_upstream_default }}"
matrix_authentication_service_syn2mas_container_image_registry_prefix_upstream_default: ghcr.io/
matrix_authentication_service_syn2mas_container_image_force_pull: "{{ matrix_authentication_service_syn2mas_container_image.endswith(':latest') }}"
matrix_authentication_service_syn2mas_container_image_self_build: "{{ matrix_authentication_service_container_image_self_build }}"
matrix_authentication_service_syn2mas_container_network: "{{ matrix_authentication_service_container_network }}"
# Whether to pass a `--dry-run` flag to the 'migrate' sub-command.
# See `matrix_authentication_service_syn2mas_subcommand`
matrix_authentication_service_syn2mas_migrate_dry_run: false
# Path to Synapse's homeserver.yaml configuration file.
matrix_authentication_service_syn2mas_synapse_homeserver_config_path: ""
# Additional arguments passed to the syn2mas process.
matrix_authentication_service_syn2mas_container_network: "{{ matrix_authentication_service_container_network }}"
# Additional options passed to the syn2mas sub-command (e.g. `mas-cli syn2mas [OPTIONS] migrate|check`).
# Also see: `matrix_authentication_service_syn2mas_subcommand_extra_options`
#
# Example:
# matrix_authentication_service_syn2mas_process_extra_arguments:
# - "--upstreamProviderMapping oidc-keycloak:01H8PKNWKKRPCBW4YGH1RWV279"
matrix_authentication_service_syn2mas_process_extra_arguments: []
# matrix_authentication_service_syn2mas_command_extra_options:
# - "--something"
matrix_authentication_service_syn2mas_command_extra_options: []
# Additional options passed to the syn2mas sub-command (e.g. `mas-cli syn2mas migrate|check [OPTIONS]`).
# Also see: `matrix_authentication_service_syn2mas_command_extra_options`
#
# Example:
# matrix_authentication_service_syn2mas_subcommand_extra_options:
# - "--dry-run"
matrix_authentication_service_syn2mas_subcommand_extra_options: []
########################################################################################
# #

17
roles/custom/matrix-authentication-service/tasks/main.yml
View File

@ -9,18 +9,33 @@
- setup-matrix-authentication-service
- install-all
- install-matrix-authentication-service
- matrix-authentication-service-mas-cli-syn2mas
block:
- when: matrix_authentication_service_enabled | bool
ansible.builtin.include_tasks: "{{ role_path }}/tasks/validate_config.yml"
- tags:
- setup-all
- setup-matrix-authentication-service
- install-all
- install-matrix-authentication-service
block:
- when: matrix_authentication_service_enabled | bool
ansible.builtin.include_tasks: "{{ role_path }}/tasks/install.yml"
# The tag 'matrix-authentication-service-syn2mas' has been replaced by the tag 'matrix-authentication-service-mas-cli-syn2mas'.
- tags:
- matrix-authentication-service-syn2mas
block:
- name: Warn about deprecated tag
ansible.builtin.fail:
msg: "WARNING: The 'matrix-authentication-service-syn2mas' tag has been replaced by 'matrix-authentication-service-mas-cli-syn2mas'. Please update your command."
- tags:
- matrix-authentication-service-mas-cli-syn2mas
block:
- when: matrix_authentication_service_enabled | bool
ansible.builtin.include_tasks: "{{ role_path }}/tasks/syn2mas.yml"
ansible.builtin.include_tasks: "{{ role_path }}/tasks/mas_cli_syn2mas.yml"
- tags:
- matrix-authentication-service-mas-cli-doctor

78
roles/custom/matrix-authentication-service/tasks/syn2mas.yml → roles/custom/matrix-authentication-service/tasks/mas_cli_syn2mas.yml
View File

@ -6,7 +6,7 @@
---
- ansible.builtin.set_fact:
matrix_authentication_service_syn2mas_dry_run: "{{ matrix_authentication_service_syn2mas_dry_run | bool }}"
matrix_authentication_service_syn2mas_migrate_dry_run: "{{ matrix_authentication_service_syn2mas_migrate_dry_run | bool }}"
- name: Abort, if not using Synapse
when: not matrix_synapse_enabled | bool
@ -33,41 +33,8 @@
msg: "The Synapse homeserver config file does not exist at the specified path: {{ matrix_authentication_service_syn2mas_synapse_homeserver_config_path }}"
when: not matrix_authentication_service_syn2mas_synapse_config_stat.stat.exists
- name: Ensure Matrix Authentication Service syn2mas container image is pulled
community.docker.docker_image:
name: "{{ matrix_authentication_service_syn2mas_container_image }}"
source: "{{ 'pull' if ansible_version.major > 2 or ansible_version.minor > 7 else omit }}"
force_source: "{{ matrix_authentication_service_syn2mas_container_image_force_pull if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}"
force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else matrix_authentication_service_syn2mas_container_image_force_pull }}"
when: "not matrix_authentication_service_syn2mas_container_image_self_build | bool"
register: result
retries: "{{ devture_playbook_help_container_retries_count }}"
delay: "{{ devture_playbook_help_container_retries_delay }}"
until: result is not failed
- when: "matrix_authentication_service_syn2mas_container_image_self_build | bool"
block:
- name: Ensure Matrix Authentication Service repository is present on self-build
ansible.builtin.git:
repo: "{{ matrix_authentication_service_container_repo }}"
version: "{{ matrix_authentication_service_container_repo_version }}"
dest: "{{ matrix_authentication_service_container_src_files_path }}"
force: "yes"
become: true
become_user: "{{ matrix_user_name }}"
register: matrix_authentication_service_git_pull_results
- name: Ensure Matrix Authentication Service syn2mas container image is built
ansible.builtin.command:
cmd: |-
{{ devture_systemd_docker_base_host_command_docker }} buildx build
--tag={{ matrix_authentication_service_syn2mas_container_image }}
--file={{ matrix_authentication_service_container_src_files_path }}/tools/syn2mas/Dockerfile
{{ matrix_authentication_service_container_src_files_path }}/tools/syn2mas
changed_when: true
- name: Ensure Synapse is stopped
when: not matrix_authentication_service_syn2mas_dry_run | bool
when: not matrix_authentication_service_syn2mas_migrate_dry_run | bool
ansible.builtin.service:
name: matrix-synapse
state: stopped
@ -81,14 +48,19 @@
#
# Still, it's probably safer to stop it anyway.
- name: Ensure Matrix Authentication Service is stopped
when: not matrix_authentication_service_syn2mas_migrate_dry_run | bool
ansible.builtin.service:
name: matrix-authentication-service
state: stopped
register: matrix_authentication_service_mas_ensure_stopped_result
# This is similar to the command found in the systemd service file.
#
# We cannot use `docker exec` with the existing Matrix Authentication Service container here,
# because we need an additional mount (the Synapse homeserver config).
- name: Generate syn2mas migration command
ansible.builtin.set_fact:
matrix_authentication_service_syn2mas_migration_command: >-
matrix_authentication_service_mas_cli_syn2mas_command: >-
{{ devture_systemd_docker_base_host_command_docker }} run
--rm
--name=matrix-authentication-service-syn2mas
@ -96,14 +68,16 @@
--user={{ matrix_authentication_service_uid }}:{{ matrix_authentication_service_gid }}
--cap-drop=ALL
--network={{ matrix_authentication_service_syn2mas_container_network }}
--mount type=bind,src={{ matrix_authentication_service_config_path }}/config.yaml,dst=/config.yaml,ro
--mount type=bind,src={{ matrix_authentication_service_data_keys_path }},dst=/keys,ro
--mount type=bind,src={{ matrix_authentication_service_syn2mas_synapse_homeserver_config_path }},dst=/homeserver.yaml,ro
--mount type=bind,src={{ matrix_authentication_service_config_path }}/config.yaml,dst=/mas-config.yaml,ro
{{ matrix_authentication_service_syn2mas_container_image }}
--command=migrate
--synapseConfigFile=/homeserver.yaml
--masConfigFile=/mas-config.yaml
{{ matrix_authentication_service_syn2mas_process_extra_arguments | join(' ') }}
{% if matrix_authentication_service_syn2mas_dry_run | bool %}--dryRun{% endif %}
{{ matrix_authentication_service_container_image }}
syn2mas
--synapse-config=/homeserver.yaml
{{ matrix_authentication_service_syn2mas_command_extra_options | join(' ') }}
{{ matrix_authentication_service_syn2mas_subcommand }}
{{ '--dry-run' if matrix_authentication_service_syn2mas_migrate_dry_run and matrix_authentication_service_syn2mas_subcommand == 'migrate' else '' }}
{{ matrix_authentication_service_syn2mas_subcommand_extra_options | join(' ') }}
tags:
- skip_ansible_lint
@ -111,33 +85,33 @@
# See: https://ansibledaily.com/print-to-standard-output-without-escaping/
#
# We want to run `debug: msg=".."`, but that dumps it as JSON and escapes double quotes within it,
# which ruins the command (`matrix_authentication_service_syn2mas_migration_command`).
# which ruins the command (`matrix_authentication_service_mas_cli_syn2mas_command`).
- name: Note about syn2mas migration
ansible.builtin.set_fact:
dummy: true
with_items:
- >-
Running syn2mas migration using the following command: `{{ matrix_authentication_service_syn2mas_migration_command }}`.
If this crashes, you can stop Synapse (`systemctl stop matrix-synapse`) and run the command manually.
Running syn2mas migration using the following command: `{{ matrix_authentication_service_mas_cli_syn2mas_command }}`.
If this crashes, you can stop Synapse (`systemctl stop matrix-synapse`), start Matrix Authentication Service (`systemctl start matrix-authentication-service`) and run the command manually.
- name: Perform syn2mas migration
ansible.builtin.command:
cmd: "{{ matrix_authentication_service_syn2mas_migration_command }}"
register: matrix_authentication_service_syn2mas_migration_command_result
changed_when: matrix_authentication_service_syn2mas_migration_command_result.rc == 0
cmd: "{{ matrix_authentication_service_mas_cli_syn2mas_command }}"
register: matrix_authentication_service_mas_cli_syn2mas_command_result
changed_when: matrix_authentication_service_mas_cli_syn2mas_command_result.rc == 0
- name: Print syn2mas migration command result
ansible.builtin.debug:
var: matrix_authentication_service_syn2mas_migration_command_result
var: matrix_authentication_service_mas_cli_syn2mas_command_result
- name: Ensure Synapse is started (if it previously was)
when: "not matrix_authentication_service_syn2mas_dry_run and matrix_authentication_service_synapse_ensure_stopped_result.changed"
when: "not matrix_authentication_service_syn2mas_migrate_dry_run and matrix_authentication_service_mas_cli_syn2mas_command_result.changed"
ansible.builtin.service:
name: matrix-synapse
state: started
- name: Ensure Matrix Authentication Service is started (if it previously was)
when: "not matrix_authentication_service_syn2mas_dry_run and matrix_authentication_service_mas_ensure_stopped_result.changed"
when: "not matrix_authentication_service_syn2mas_migrate_dry_run and matrix_authentication_service_mas_ensure_stopped_result.changed"
ansible.builtin.service:
name: matrix-authentication-service
state: started

8
roles/custom/matrix-authentication-service/tasks/validate_config.yml
View File

@ -44,3 +44,11 @@
with_items:
- {'old': 'matrix_authentication_service_container_image_name_prefix', 'new': 'matrix_authentication_service_container_image_registry_prefix'}
- {'old': 'matrix_authentication_service_syn2mas_container_image_name_prefix', 'new': 'matrix_authentication_service_syn2mas_container_image_registry_prefix'}
- {'old': 'matrix_authentication_service_syn2mas_container_image', 'new': '<removed>'}
- {'old': 'matrix_authentication_service_syn2mas_container_image_registry_prefix', 'new': '<removed>'}
- {'old': 'matrix_authentication_service_syn2mas_container_image_registry_prefix_upstream', 'new': '<removed>'}
- {'old': 'matrix_authentication_service_syn2mas_container_image_registry_prefix_upstream_default', 'new': '<removed>'}
- {'old': 'matrix_authentication_service_syn2mas_container_image_force_pull', 'new': '<removed>'}
- {'old': 'matrix_authentication_service_syn2mas_container_image_self_build', 'new': '<removed>'}
- {'old': 'matrix_authentication_service_syn2mas_process_extra_arguments', 'new': 'matrix_authentication_service_syn2mas_command_extra_options or matrix_authentication_service_syn2mas_subcommand_extra_options'}
- {'old': 'matrix_authentication_service_syn2mas_dry_run', 'new': 'matrix_authentication_service_syn2mas_migrate_dry_run'}