Move roles/matrix* to roles/custom/matrix*

This paves the way for installing other roles into `roles/galaxy` using `ansible-galaxy`,
similar to how it's done in:

- https://github.com/spantaleev/gitea-docker-ansible-deploy
- https://github.com/spantaleev/nextcloud-docker-ansible-deploy

In the near future, we'll be removing a lot of the shared role code from here
and using upstream roles for it. Some of the core `matrix-*` roles have
already been extracted out into other reusable roles:

- https://github.com/devture/com.devture.ansible.role.postgres
- https://github.com/devture/com.devture.ansible.role.systemd_docker_base
- https://github.com/devture/com.devture.ansible.role.timesync
- https://github.com/devture/com.devture.ansible.role.vars_preserver
- https://github.com/devture/com.devture.ansible.role.playbook_runtime_messages
- https://github.com/devture/com.devture.ansible.role.playbook_help

We just need to migrate to those.

roles/custom/matrix-conduit/defaults/main.yml

@@ -0,0 +1,56 @@
+---
+# Conduit is a simple, fast and reliable chat server powered by Matrix
+# See: https://conduit.rs
+
+matrix_conduit_enabled: true
+
+matrix_conduit_docker_image: "{{ matrix_conduit_docker_image_name_prefix }}matrixconduit/matrix-conduit:{{ matrix_conduit_docker_image_tag }}"
+matrix_conduit_docker_image_name_prefix: "docker.io/"
+matrix_conduit_docker_image_tag: "v0.4.0"
+matrix_conduit_docker_image_force_pull: "{{ matrix_conduit_docker_image.endswith(':latest') }}"
+
+matrix_conduit_base_path: "{{ matrix_base_data_path }}/conduit"
+matrix_conduit_config_path: "{{ matrix_conduit_base_path }}/config"
+matrix_conduit_data_path: "{{ matrix_conduit_base_path }}/data"
+
+matrix_conduit_port_number: 6167
+
+matrix_conduit_tmp_directory_size_mb: 500
+
+# List of systemd services that matrix-conduit.service depends on
+matrix_conduit_systemd_required_services_list: ["docker.service"]
+
+# List of systemd services that matrix-conduit.service wants
+matrix_conduit_systemd_wanted_services_list: []
+
+# Extra arguments for the Docker container
+matrix_conduit_container_extra_arguments: []
+
+# Specifies which template files to use when configuring Conduit.
+# If you'd like to have your own different configuration, feel free to copy and paste
+# the original files into your inventory (e.g. in `inventory/host_vars/<host>/`)
+# and then change the specific host's `vars.yaml` file like this:
+# matrix_conduit_template_conduit_config: "{{ playbook_dir }}/inventory/host_vars/<host>/conduit.yaml.j2"
+matrix_conduit_template_conduit_config: "{{ role_path }}/templates/conduit/conduit.toml.j2"
+
+# Max size for uploads, in bytes
+matrix_conduit_max_request_size: 20_000_000
+
+# Maximum number of open files for Conduit's embedded RocksDB database
+# See https://github.com/facebook/rocksdb/wiki/RocksDB-Tuning-Guide#tuning-other-options
+# By default, Conduit uses a relatively low value of 20.
+matrix_conduit_rocksdb_max_open_files: 64
+
+# Enables registration. If set to false, no users can register on this server.
+matrix_conduit_allow_registration: false
+
+matrix_conduit_allow_federation: true
+
+# Enable the display name lightning bolt on registration.
+matrix_conduit_enable_lightning_bolt: true
+
+matrix_conduit_trusted_servers:
+ - "matrix.org"
+
+# How many requests Conduit sends to other servers at the same time
+matrix_conduit_max_concurrent_requests: 100

roles/custom/matrix-conduit/tasks/conduit/setup.yml

@@ -0,0 +1,7 @@
+---
+
+- ansible.builtin.import_tasks: "{{ role_path }}/tasks/conduit/setup_install.yml"
+  when: "matrix_conduit_enabled | bool"
+
+- ansible.builtin.import_tasks: "{{ role_path }}/tasks/conduit/setup_uninstall.yml"
+  when: "not matrix_conduit_enabled | bool"

roles/custom/matrix-conduit/tasks/conduit/setup_install.yml

@@ -0,0 +1,47 @@
+---
+- name: Ensure Conduit Docker image is pulled
+  community.docker.docker_image:
+    name: "{{ matrix_conduit_docker_image }}"
+    source: "{{ 'pull' if ansible_version.major > 2 or ansible_version.minor > 7 else omit }}"
+    force_source: "{{ matrix_conduit_docker_image_force_pull if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}"
+    force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else matrix_conduit_docker_image_force_pull }}"
+  register: result
+  retries: "{{ matrix_container_retries_count }}"
+  delay: "{{ matrix_container_retries_delay }}"
+  until: result is not failed
+
+- name: Ensure Conduit config path exists
+  ansible.builtin.file:
+    path: "{{ matrix_conduit_config_path }}"
+    state: directory
+    mode: 0750
+    owner: "{{ matrix_user_username }}"
+    group: "{{ matrix_user_groupname }}"
+
+- name: Ensure Conduit data path exists
+  ansible.builtin.file:
+    path: "{{ matrix_conduit_data_path }}"
+    state: directory
+    mode: 0770
+    owner: "{{ matrix_user_username }}"
+    group: "{{ matrix_user_groupname }}"
+
+- name: Ensure Conduit configuration installed
+  ansible.builtin.template:
+    src: "{{ role_path }}/templates/conduit/conduit.toml.j2"
+    dest: "{{ matrix_conduit_config_path }}/conduit.toml"
+    mode: 0644
+    owner: "{{ matrix_user_username }}"
+    group: "{{ matrix_user_groupname }}"
+
+- name: Ensure matrix-conduit.service installed
+  ansible.builtin.template:
+    src: "{{ role_path }}/templates/conduit/systemd/matrix-conduit.service.j2"
+    dest: "{{ matrix_systemd_path }}/matrix-conduit.service"
+    mode: 0644
+  register: matrix_conduit_systemd_service_result
+
+- name: Ensure systemd reloaded after matrix-conduit.service installation
+  ansible.builtin.systemd:
+    daemon_reload: true
+  when: "matrix_conduit_systemd_service_result.changed | bool"

roles/custom/matrix-conduit/tasks/conduit/setup_uninstall.yml

@@ -0,0 +1,30 @@
+---
+
+- name: Check existence of matrix-conduit service
+  ansible.builtin.stat:
+    path: "{{ matrix_systemd_path }}/matrix-conduit.service"
+  register: matrix_conduit_service_stat
+
+- name: Ensure matrix-conduit is stopped
+  ansible.builtin.systemd:
+    name: matrix-conduit
+    state: stopped
+    daemon_reload: true
+  register: stopping_result
+  when: "matrix_conduit_service_stat.stat.exists"
+
+- name: Ensure matrix-conduit.service doesn't exist
+  ansible.builtin.file:
+    path: "{{ matrix_systemd_path }}/matrix-conduit.service"
+    state: absent
+  when: "matrix_conduit_service_stat.stat.exists"
+
+- name: Ensure systemd reloaded after matrix-conduit.service removal
+  ansible.builtin.systemd:
+    daemon_reload: true
+  when: "matrix_conduit_service_stat.stat.exists"
+
+- name: Ensure Conduit Docker image doesn't exist
+  community.docker.docker_image:
+    name: "{{ matrix_conduit_docker_image }}"
+    state: absent

roles/custom/matrix-conduit/tasks/init.yml

@@ -0,0 +1,5 @@
+---
+
+- ansible.builtin.set_fact:
+    matrix_systemd_services_list: "{{ matrix_systemd_services_list + ['matrix-conduit.service'] }}"
+  when: matrix_conduit_enabled | bool

roles/custom/matrix-conduit/tasks/main.yml

@@ -0,0 +1,17 @@
+---
+
+- ansible.builtin.import_tasks: "{{ role_path }}/tasks/init.yml"
+  tags:
+    - always
+
+- ansible.builtin.import_tasks: "{{ role_path }}/tasks/conduit/setup.yml"
+  when: run_setup | bool
+  tags:
+    - setup-all
+    - setup-conduit
+
+- name: Mark matrix-conduit role as executed
+  ansible.builtin.set_fact:
+    matrix_conduit_role_executed: true
+  tags:
+    - always

roles/custom/matrix-conduit/templates/conduit/conduit.toml.j2

@@ -0,0 +1,55 @@
+# =============================================================================
+#  This is the official example config for Conduit.
+#  If you use it for your server, you will need to adjust it to your own needs.
+#  At the very least, change the server_name field!
+# =============================================================================
+
+
+[global]
+# The server_name is the pretty name of this server. It is used as a suffix for user
+# and room ids. Examples: matrix.org, conduit.rs
+
+# The Conduit server needs all /_matrix/ requests to be reachable at
+# https://your.server.name/ on port 443 (client-server) and 8448 (federation).
+
+# If that's not possible for you, you can create /.well-known files to redirect
+# requests. See
+# https://matrix.org/docs/spec/client_server/latest#get-well-known-matrix-client
+# and
+# https://matrix.org/docs/spec/server_server/r0.1.4#get-well-known-matrix-server
+# for more information
+
+server_name = "{{ matrix_domain }}"
+
+# This is the only directory where Conduit will save its data
+database_path = "/var/lib/matrix-conduit/"
+database_backend = "rocksdb"
+
+# The port Conduit will be running on. You need to set up a reverse proxy in
+# your web server (e.g. apache or nginx), so all requests to /_matrix on port
+# 443 and 8448 will be forwarded to the Conduit instance running on this port
+# Docker users: Don't change this, you'll need to map an external port to this.
+port = {{ matrix_conduit_port_number }}
+
+# Max size for uploads
+max_request_size = {{ matrix_conduit_max_request_size }}
+
+# Max number of open files for the RocksDB database
+rocksdb_max_open_files = {{ matrix_conduit_rocksdb_max_open_files }}
+
+# Enables registration. If set to false, no users can register on this server.
+allow_registration = {{ matrix_conduit_allow_registration | to_json }}
+
+allow_federation = {{ matrix_conduit_allow_federation | to_json }}
+
+# Enable the display name lightning bolt on registration.
+enable_lightning_bolt = {{ matrix_conduit_enable_lightning_bolt | to_json }}
+
+trusted_servers = {{ matrix_conduit_trusted_servers | to_json }}
+
+max_concurrent_requests = {{ matrix_conduit_max_concurrent_requests }}
+
+log = "info,state_res=warn,rocket=off,_=off,sled=off"
+
+address = "0.0.0.0"
+

roles/custom/matrix-conduit/templates/conduit/systemd/matrix-conduit.service.j2

@@ -0,0 +1,38 @@
+#jinja2: lstrip_blocks: "True"
+[Unit]
+Description=Conduit Matrix homeserver
+{% for service in matrix_conduit_systemd_required_services_list %}
+Requires={{ service }}
+After={{ service }}
+{% endfor %}
+
+[Service]
+Type=simple
+Environment="HOME={{ matrix_systemd_unit_home_path }}"
+ExecStartPre=-{{ matrix_host_command_sh }} -c '{{ matrix_host_command_docker }} kill matrix-conduit 2>/dev/null || true'
+ExecStartPre=-{{ matrix_host_command_sh }} -c '{{ matrix_host_command_docker }} rm matrix-conduit 2>/dev/null || true'
+
+ExecStart={{ matrix_host_command_docker }} run --rm --name matrix-conduit \
+			--log-driver=none \
+			--user={{ matrix_user_uid }}:{{ matrix_user_gid }} \
+			--cap-drop=ALL \
+			--read-only \
+			--tmpfs=/tmp:rw,noexec,nosuid,size={{ matrix_conduit_tmp_directory_size_mb }}m \
+			--network={{ matrix_docker_network }} \
+			--env CONDUIT_CONFIG=/etc/matrix-conduit/conduit.toml \
+			--mount type=bind,src={{ matrix_conduit_data_path }},dst=/var/lib/matrix-conduit \
+			--mount type=bind,src={{ matrix_conduit_config_path }},dst=/etc/matrix-conduit,ro \
+			{% for arg in matrix_conduit_container_extra_arguments %}
+			{{ arg }} \
+			{% endfor %}
+			{{ matrix_conduit_docker_image }}
+
+ExecStop=-{{ matrix_host_command_sh }} -c '{{ matrix_host_command_docker }} kill matrix-conduit 2>/dev/null || true'
+ExecStop=-{{ matrix_host_command_sh }} -c '{{ matrix_host_command_docker }} rm matrix-conduit 2>/dev/null || true'
+ExecReload={{ matrix_host_command_docker }} exec matrix-conduit /bin/sh -c 'kill -HUP 1'
+Restart=always
+RestartSec=30
+SyslogIdentifier=matrix-conduit
+
+[Install]
+WantedBy=multi-user.target

roles/custom/matrix-conduit/vars/main.yml

@@ -0,0 +1,6 @@
+---
+matrix_conduit_client_api_url_endpoint_public: "https://{{ matrix_server_fqn_matrix }}/_matrix/client/versions"
+matrix_conduit_federation_api_url_endpoint_public: "https://{{ matrix_server_fqn_matrix }}:{{ matrix_federation_public_port }}/_matrix/federation/v1/version"
+
+# Tells whether this role had executed or not. Toggled to `true` during runtime.
+matrix_conduit_role_executed: false