From 20767b514913c1289a3d7a48a890e34511b7e945 Mon Sep 17 00:00:00 2001 From: Charles Wright Date: Thu, 4 Aug 2022 14:35:41 -0500 Subject: [PATCH] Fixes to enable Conduit in setup-all --- group_vars/matrix_servers | 31 ++++++++ roles/matrix-base/defaults/main.yml | 2 +- roles/matrix-base/tasks/sanity_check.yml | 2 +- roles/matrix-conduit/defaults/main.yml | 2 +- roles/matrix-nginx-proxy/defaults/main.yml | 15 ++++ .../tasks/setup_nginx_proxy.yml | 13 ++++ .../nginx/conf.d/matrix-conduit.conf.j2 | 77 +++++++++++++++++++ setup.yml | 1 + 8 files changed, 140 insertions(+), 3 deletions(-) create mode 100644 roles/matrix-nginx-proxy/templates/nginx/conf.d/matrix-conduit.conf.j2 diff --git a/group_vars/matrix_servers b/group_vars/matrix_servers index 91324025e..ed64c0a44 100755 --- a/group_vars/matrix_servers +++ b/group_vars/matrix_servers @@ -24,6 +24,7 @@ matrix_homeserver_container_url: |- 'http://matrix-nginx-proxy:12080' if matrix_nginx_proxy_enabled else { 'synapse': ('http://matrix-synapse:'+ matrix_synapse_container_client_api_port|string), 'dendrite': ('http://matrix-dendrite:' + matrix_dendrite_http_bind_port|string), + 'conduit': ('http://matrix-conduit:' + matrix_conduit_port_number|string), }[matrix_homeserver_implementation] }} @@ -32,6 +33,7 @@ matrix_homeserver_container_federation_url: |- 'http://matrix-nginx-proxy:12088' if matrix_nginx_proxy_enabled else { 'synapse': ('http://matrix-synapse:'+ matrix_synapse_container_federation_api_plain_port|string), 'dendrite': ('http://matrix-dendrite:' + matrix_dendrite_http_bind_port|string), + 'conduit': ('http://matrix-conduit:' + matrix_conduit_port_number|string), }[matrix_homeserver_implementation] }} @@ -1432,6 +1434,7 @@ matrix_nginx_proxy_proxy_matrix_client_api_client_max_body_size_mb: |- { 'synapse': matrix_synapse_max_upload_size_mb, 'dendrite': (matrix_dendrite_max_file_size_bytes / 1024 / 1024) | round, + 'conduit': (matrix_conduit_max_request_size / 1024 / 1024) | round, }[matrix_homeserver_implementation]|int }} @@ -1464,6 +1467,7 @@ matrix_nginx_proxy_proxy_matrix_federation_api_enabled: |- { 'synapse': (matrix_synapse_federation_port_enabled and not matrix_synapse_tls_federation_listener_enabled), 'dendrite': matrix_dendrite_federation_enabled, + 'conduit': matrix_conduit_allow_federation, }[matrix_homeserver_implementation]|bool }} @@ -1482,6 +1486,12 @@ matrix_nginx_proxy_proxy_dendrite_client_api_addr_sans_container: "127.0.0.1:{{ matrix_nginx_proxy_proxy_dendrite_federation_api_addr_with_container: "matrix-dendrite:{{ matrix_dendrite_http_bind_port|string }}" matrix_nginx_proxy_proxy_dendrite_federation_api_addr_sans_container: "127.0.0.1:{{ matrix_dendrite_http_bind_port|string }}" +matrix_nginx_proxy_proxy_conduit_enabled: "{{ matrix_conduit_enabled }}" +matrix_nginx_proxy_proxy_conduit_client_api_addr_with_container: "matrix-conduit:{{ matrix_conduit_port_number|string }}" +matrix_nginx_proxy_proxy_conduit_client_api_addr_sans_container: "127.0.0.1:{{ matrix_conduit_port_number|string }}" +matrix_nginx_proxy_proxy_conduit_federation_api_addr_with_container: "matrix-conduit:{{ matrix_conduit_port_number|string }}" +matrix_nginx_proxy_proxy_conduit_federation_api_addr_sans_container: "127.0.0.1:{{ matrix_conduit_port_number|string }}" + # When matrix-nginx-proxy is disabled, the actual port number that the vhost uses may begin to matter. matrix_nginx_proxy_proxy_matrix_federation_port: "{{ matrix_federation_public_port }}" @@ -2211,6 +2221,7 @@ matrix_registration_shared_secret: |- { 'synapse': matrix_synapse_registration_shared_secret, 'dendrite': matrix_dendrite_registration_shared_secret, + 'conduit': '' }[matrix_homeserver_implementation] }} @@ -2331,3 +2342,23 @@ matrix_dendrite_systemd_wanted_services_list: | # /matrix-dendrite # ###################################################################### + +###################################################################### +# +# matrix-conduit +# +###################################################################### + +matrix_conduit_enabled: "{{ matrix_homeserver_implementation == 'conduit' }}" + +matrix_conduit_systemd_required_services_list: | + {{ + (['docker.service']) + }} + + +###################################################################### +# +# /matrix-conduit +# +###################################################################### diff --git a/roles/matrix-base/defaults/main.yml b/roles/matrix-base/defaults/main.yml index ae39d00a5..9d0ded4a8 100644 --- a/roles/matrix-base/defaults/main.yml +++ b/roles/matrix-base/defaults/main.yml @@ -9,7 +9,7 @@ matrix_domain: ~ # This will contain the homeserver implementation that is in use. -# Valid values: synapse, dendrite +# Valid values: synapse, dendrite, conduit # # By default, we use Synapse, because it's the only full-featured Matrix server at the moment. # diff --git a/roles/matrix-base/tasks/sanity_check.yml b/roles/matrix-base/tasks/sanity_check.yml index f78510d77..ad3d35d63 100644 --- a/roles/matrix-base/tasks/sanity_check.yml +++ b/roles/matrix-base/tasks/sanity_check.yml @@ -3,7 +3,7 @@ - name: Fail if invalid homeserver implementation fail: msg: "You need to set a valid homeserver implementation in `matrix_homeserver_implementation`" - when: "matrix_homeserver_implementation not in ['synapse', 'dendrite']" + when: "matrix_homeserver_implementation not in ['synapse', 'dendrite', 'conduit']" # We generally support Ansible 2.7.1 and above. - name: Fail if running on Ansible < 2.7.1 diff --git a/roles/matrix-conduit/defaults/main.yml b/roles/matrix-conduit/defaults/main.yml index 94d1fcfaf..9ee832825 100644 --- a/roles/matrix-conduit/defaults/main.yml +++ b/roles/matrix-conduit/defaults/main.yml @@ -34,7 +34,7 @@ matrix_conduit_container_extra_arguments: [] matrix_conduit_template_conduit_config: "{{ role_path }}/templates/conduit/conduit.toml.j2" # Max size for uploads, in bytes -matrix_conduit_max_request_size: "20_000_000" +matrix_conduit_max_request_size: 20_000_000 # Enables registration. If set to false, no users can register on this server. matrix_conduit_allow_registration: true diff --git a/roles/matrix-nginx-proxy/defaults/main.yml b/roles/matrix-nginx-proxy/defaults/main.yml index de1a31461..8d606273f 100644 --- a/roles/matrix-nginx-proxy/defaults/main.yml +++ b/roles/matrix-nginx-proxy/defaults/main.yml @@ -147,6 +147,21 @@ matrix_nginx_proxy_proxy_dendrite_client_api_addr_sans_container: "" # A list of strings containing additional configuration blocks to add to the Dendrite's server configuration (matrix-dendrite.conf). matrix_nginx_proxy_proxy_dendrite_additional_server_configuration_blocks: [] +# Controls whether proxying for Conduit should be done. +matrix_nginx_proxy_proxy_conduit_enabled: false +matrix_nginx_proxy_proxy_conduit_hostname: "matrix-nginx-proxy" +matrix_nginx_proxy_proxy_conduit_federation_api_enabled: "{{ matrix_nginx_proxy_proxy_matrix_federation_api_enabled }}" +# Controls whether the Client API server (usually at matrix.DOMAIN:443) should explicitly reject `/_matrix/federation` endpoints. +matrix_nginx_proxy_proxy_conduit_block_federation_api_on_client_port: true +# The addresses where the Matrix Client API is, when using Conduit. +matrix_nginx_proxy_proxy_conduit_client_api_addr_with_container: "" +matrix_nginx_proxy_proxy_conduit_client_api_addr_sans_container: "" +# The addresses where the Federation API is, when using Conduit. +matrix_nginx_proxy_proxy_conduit_federation_api_addr_with_container: "" +matrix_nginx_proxy_proxy_conduit_federation_api_addr_sans_container: "" +# A list of strings containing additional configuration blocks to add to the Conduit's server configuration (matrix-conduit.conf). +matrix_nginx_proxy_proxy_conduit_additional_server_configuration_blocks: [] + # Controls whether proxying the Element domain should be done. matrix_nginx_proxy_proxy_element_enabled: false matrix_nginx_proxy_proxy_element_hostname: "{{ matrix_server_fqn_element }}" diff --git a/roles/matrix-nginx-proxy/tasks/setup_nginx_proxy.yml b/roles/matrix-nginx-proxy/tasks/setup_nginx_proxy.yml index 92454e96f..c546a083e 100644 --- a/roles/matrix-nginx-proxy/tasks/setup_nginx_proxy.yml +++ b/roles/matrix-nginx-proxy/tasks/setup_nginx_proxy.yml @@ -80,6 +80,19 @@ state: absent when: "not matrix_nginx_proxy_proxy_dendrite_enabled|bool" +- name: Ensure Matrix nginx-proxy configuration for matrix-conduit exists + template: + src: "{{ role_path }}/templates/nginx/conf.d/matrix-conduit.conf.j2" + dest: "{{ matrix_nginx_proxy_confd_path }}/matrix-conduit.conf" + mode: 0644 + when: matrix_nginx_proxy_proxy_conduit_enabled|bool + +- name: Ensure Matrix nginx-proxy configuration for matrix-conduit deleted + file: + path: "{{ matrix_nginx_proxy_confd_path }}/matrix-conduit.conf" + state: absent + when: "not matrix_nginx_proxy_proxy_conduit_enabled|bool" + - name: Ensure Matrix nginx-proxy configuration for Element domain exists template: src: "{{ role_path }}/templates/nginx/conf.d/matrix-client-element.conf.j2" diff --git a/roles/matrix-nginx-proxy/templates/nginx/conf.d/matrix-conduit.conf.j2 b/roles/matrix-nginx-proxy/templates/nginx/conf.d/matrix-conduit.conf.j2 new file mode 100644 index 000000000..2106acc48 --- /dev/null +++ b/roles/matrix-nginx-proxy/templates/nginx/conf.d/matrix-conduit.conf.j2 @@ -0,0 +1,77 @@ +#jinja2: lstrip_blocks: "True" + +server { + listen 12080; + server_name {{ matrix_nginx_proxy_proxy_conduit_hostname }}; + + server_tokens off; + root /dev/null; + + gzip on; + gzip_types text/plain application/json; + + {% for configuration_block in matrix_nginx_proxy_proxy_conduit_additional_server_configuration_blocks %} + {{- configuration_block }} + {% endfor %} + + {% if matrix_nginx_proxy_proxy_conduit_block_federation_api_on_client_port %} + location /_matrix/federation { + {% if matrix_nginx_proxy_proxy_conduit_federation_api_enabled %} + return 404 'The Federation API is served at https://{{ matrix_server_fqn_matrix }}:{{ matrix_federation_public_port }}'; + {% else %} + return 404 'This Matrix server is running with federation disabled'; + {% endif %} + } + {% endif %} + + {# Everything else just goes to the API server ##} + location / { + {% if matrix_nginx_proxy_enabled %} + {# Use the embedded DNS resolver in Docker containers to discover the service #} + resolver 127.0.0.11 valid=5s; + set $backend "{{ matrix_nginx_proxy_proxy_conduit_client_api_addr_with_container }}"; + proxy_pass http://$backend; + {% else %} + {# Generic configuration for use outside of our container setup #} + proxy_pass http://{{ matrix_nginx_proxy_proxy_conduit_client_api_addr_sans_container }}; + {% endif %} + + proxy_set_header Host $host; + + client_body_buffer_size 25M; + client_max_body_size {{ matrix_nginx_proxy_proxy_matrix_client_api_client_max_body_size_mb }}M; + proxy_max_temp_file_size 0; + } +} + +{% if matrix_nginx_proxy_proxy_conduit_federation_api_enabled %} +server { + listen 12088; + + server_name {{ matrix_nginx_proxy_proxy_conduit_hostname }}; + server_tokens off; + + root /dev/null; + + gzip on; + gzip_types text/plain application/json; + + location / { + {% if matrix_nginx_proxy_enabled %} + {# Use the embedded DNS resolver in Docker containers to discover the service #} + resolver 127.0.0.11 valid=5s; + set $backend "{{ matrix_nginx_proxy_proxy_conduit_federation_api_addr_with_container }}"; + proxy_pass http://$backend; + {% else %} + {# Generic configuration for use outside of our container setup #} + proxy_pass http://{{ matrix_nginx_proxy_proxy_conduit_federation_api_addr_sans_container }}; + {% endif %} + + proxy_set_header Host $host; + + client_body_buffer_size 25M; + client_max_body_size {{ matrix_nginx_proxy_proxy_matrix_federation_api_client_max_body_size_mb }}M; + proxy_max_temp_file_size 0; + } +} +{% endif %} diff --git a/setup.yml b/setup.yml index de86665b6..82429d437 100755 --- a/setup.yml +++ b/setup.yml @@ -42,6 +42,7 @@ - matrix-bot-mjolnir - matrix-synapse - matrix-dendrite + - matrix-conduit - matrix-synapse-admin - matrix-prometheus-node-exporter - matrix-prometheus