finallycoffee/matrix-docker-ansible-deploy
5
1
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Move roles/matrix* to roles/custom/matrix*

Browse Source 
This paves the way for installing other roles into `roles/galaxy` using `ansible-galaxy`,
similar to how it's done in:

- https://github.com/spantaleev/gitea-docker-ansible-deploy
- https://github.com/spantaleev/nextcloud-docker-ansible-deploy

In the near future, we'll be removing a lot of the shared role code from here
and using upstream roles for it. Some of the core `matrix-*` roles have
already been extracted out into other reusable roles:

- https://github.com/devture/com.devture.ansible.role.postgres
- https://github.com/devture/com.devture.ansible.role.systemd_docker_base
- https://github.com/devture/com.devture.ansible.role.timesync
- https://github.com/devture/com.devture.ansible.role.vars_preserver
- https://github.com/devture/com.devture.ansible.role.playbook_runtime_messages
- https://github.com/devture/com.devture.ansible.role.playbook_help

We just need to migrate to those.
This commit is contained in:
Slavi Pantaleev
2022-11-03 09:11:29 +02:00
parent 6c131138ad
commit 410a915a8a
722 changed files with 148 additions and 145 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
roles/custom/matrix-synapse/tasks/ext/encryption-disabler/setup.yml Normal file
View File

@ -0,0 +1,7 @@
---
- ansible.builtin.import_tasks: "{{ role_path }}/tasks/ext/encryption-disabler/setup_install.yml"
when: matrix_synapse_ext_encryption_disabler_enabled | bool
- ansible.builtin.import_tasks: "{{ role_path }}/tasks/ext/encryption-disabler/setup_uninstall.yml"
when: "not matrix_synapse_ext_encryption_disabler_enabled | bool"

41
roles/custom/matrix-synapse/tasks/ext/encryption-disabler/setup_install.yml Normal file
View File

@ -0,0 +1,41 @@
---
- name: Download matrix_encryption_disabler
ansible.builtin.get_url:
url: "{{ matrix_synapse_ext_encryption_disabler_download_url }}"
dest: "{{ matrix_synapse_ext_path }}/matrix_e2ee_filter.py"
force: true
mode: 0440
owner: "{{ matrix_user_username }}"
group: "{{ matrix_user_groupname }}"
register: result
retries: "{{ matrix_geturl_retries_count }}"
delay: "{{ matrix_geturl_retries_delay }}"
until: result is not failed
- ansible.builtin.set_fact:
matrix_synapse_modules: |
{{
matrix_synapse_modules | default([])
+
[
{
"module": "matrix_e2ee_filter.EncryptedRoomFilter",
"config": matrix_synapse_ext_encryption_config
}
]
}}
matrix_synapse_container_extra_arguments: >
{{
matrix_synapse_container_extra_arguments | default([])
+
["--mount type=bind,src={{ matrix_synapse_ext_path }}/matrix_e2ee_filter.py,dst={{ matrix_synapse_in_container_python_packages_path }}/matrix_e2ee_filter.py,ro"]
}}
matrix_synapse_additional_loggers: >
{{
matrix_synapse_additional_loggers
+
[{'name': 'matrix_e2ee_filter', 'level': 'INFO'}]
}}

6
roles/custom/matrix-synapse/tasks/ext/encryption-disabler/setup_uninstall.yml Normal file
View File

@ -0,0 +1,6 @@
---
- name: Ensure matrix_encryption_disabler doesn't exist
ansible.builtin.file:
path: "{{ matrix_synapse_ext_path }}/matrix_e2ee_filter.py"
state: absent

12
roles/custom/matrix-synapse/tasks/ext/ldap-auth/setup.yml Normal file
View File

@ -0,0 +1,12 @@
---
- ansible.builtin.set_fact:
matrix_synapse_password_providers_enabled: true
matrix_synapse_additional_loggers: >
{{
matrix_synapse_additional_loggers
+
[{'name': 'ldap_auth_provider', 'level': 'INFO'}]
}}
when: matrix_synapse_ext_password_provider_ldap_enabled | bool

7
roles/custom/matrix-synapse/tasks/ext/mjolnir-antispam/setup.yml Normal file
View File

@ -0,0 +1,7 @@
---
- ansible.builtin.import_tasks: "{{ role_path }}/tasks/ext/mjolnir-antispam/setup_install.yml"
when: matrix_synapse_ext_spam_checker_mjolnir_antispam_enabled | bool
- ansible.builtin.import_tasks: "{{ role_path }}/tasks/ext/mjolnir-antispam/setup_uninstall.yml"
when: "not matrix_synapse_ext_spam_checker_mjolnir_antispam_enabled | bool"

56
roles/custom/matrix-synapse/tasks/ext/mjolnir-antispam/setup_install.yml Normal file
View File

@ -0,0 +1,56 @@
---
- name: Ensure git installed (RedHat)
ansible.builtin.yum:
name:
- git
state: present
update_cache: false
when: "ansible_os_family == 'RedHat'"
- name: Ensure git installed (Debian)
ansible.builtin.apt:
name:
- git
state: present
update_cache: false
when: "ansible_os_family == 'Debian'"
- name: Ensure git installed (Archlinux)
community.general.pacman:
name:
- git
state: present
update_cache: false
when: "ansible_distribution == 'Archlinux'"
- name: Clone mjolnir-antispam git repository
ansible.builtin.git:
repo: "{{ matrix_synapse_ext_spam_checker_mjolnir_antispam_git_repository_url }}"
version: "{{ matrix_synapse_ext_spam_checker_mjolnir_antispam_git_version }}"
dest: "{{ matrix_synapse_ext_path }}/mjolnir"
become: true
become_user: "{{ matrix_user_username }}"
- ansible.builtin.set_fact:
matrix_synapse_spam_checker: >
{{
matrix_synapse_spam_checker
+
[{
"module": "mjolnir.AntiSpam",
"config": {
"block_invites": matrix_synapse_ext_spam_checker_mjolnir_antispam_config_block_invites,
"block_messages": matrix_synapse_ext_spam_checker_mjolnir_antispam_config_block_messages,
"block_usernames": matrix_synapse_ext_spam_checker_mjolnir_antispam_config_block_usernames,
"ban_lists": matrix_synapse_ext_spam_checker_mjolnir_antispam_config_ban_lists,
}
}]
}}
matrix_synapse_container_extra_arguments: >
{{
matrix_synapse_container_extra_arguments | default([])
+
["--mount type=bind,src={{ matrix_synapse_ext_path }}/mjolnir/synapse_antispam/mjolnir,dst={{ matrix_synapse_in_container_python_packages_path }}/mjolnir,ro"]
}}

6
roles/custom/matrix-synapse/tasks/ext/mjolnir-antispam/setup_uninstall.yml Normal file
View File

@ -0,0 +1,6 @@
---
- name: Ensure mjolnir-antispam doesn't exist
ansible.builtin.file:
path: "{{ matrix_synapse_ext_path }}/mjolnir"
state: absent

7
roles/custom/matrix-synapse/tasks/ext/rest-auth/setup.yml Normal file
View File

@ -0,0 +1,7 @@
---
- ansible.builtin.import_tasks: "{{ role_path }}/tasks/ext/rest-auth/setup_install.yml"
when: matrix_synapse_ext_password_provider_rest_auth_enabled | bool
- ansible.builtin.import_tasks: "{{ role_path }}/tasks/ext/rest-auth/setup_uninstall.yml"
when: "not matrix_synapse_ext_password_provider_rest_auth_enabled | bool"

36
roles/custom/matrix-synapse/tasks/ext/rest-auth/setup_install.yml Normal file
View File

@ -0,0 +1,36 @@
---
- name: Fail if REST Auth endpoint not configured
ansible.builtin.fail:
msg: "You have enabled the REST Auth password provider, but have not configured its endpoint in the `matrix_synapse_ext_password_provider_rest_auth_endpoint` variable. Consult the documentation."
when: "matrix_synapse_ext_password_provider_rest_auth_endpoint == ''"
- name: Download matrix-synapse-rest-auth
ansible.builtin.get_url:
url: "{{ matrix_synapse_ext_password_provider_rest_auth_download_url }}"
dest: "{{ matrix_synapse_ext_path }}/rest_auth_provider.py"
force: true
mode: 0440
owner: "{{ matrix_user_username }}"
group: "{{ matrix_user_groupname }}"
register: result
retries: "{{ matrix_geturl_retries_count }}"
delay: "{{ matrix_geturl_retries_delay }}"
until: result is not failed
- ansible.builtin.set_fact:
matrix_synapse_password_providers_enabled: true
matrix_synapse_container_extra_arguments: >
{{
matrix_synapse_container_extra_arguments | default([])
+
["--mount type=bind,src={{ matrix_synapse_ext_path }}/rest_auth_provider.py,dst={{ matrix_synapse_in_container_python_packages_path }}/rest_auth_provider.py,ro"]
}}
matrix_synapse_additional_loggers: >
{{
matrix_synapse_additional_loggers
+
[{'name': 'rest_auth_provider', 'level': 'INFO'}]
}}

6
roles/custom/matrix-synapse/tasks/ext/rest-auth/setup_uninstall.yml Normal file
View File

@ -0,0 +1,6 @@
---
- name: Ensure matrix-synapse-rest-auth doesn't exist
ansible.builtin.file:
path: "{{ matrix_synapse_ext_path }}/rest_auth_provider.py"
state: absent

5
roles/custom/matrix-synapse/tasks/ext/s3-storage-provider/init.yml Normal file
View File

@ -0,0 +1,5 @@
---
- ansible.builtin.set_fact:
matrix_systemd_services_list: "{{ matrix_systemd_services_list + ['matrix-synapse-s3-storage-provider-migrate.timer'] }}"
when: matrix_synapse_ext_synapse_s3_storage_provider_enabled | bool

10
roles/custom/matrix-synapse/tasks/ext/s3-storage-provider/setup.yml Normal file
View File

@ -0,0 +1,10 @@
---
- ansible.builtin.import_tasks: "{{ role_path }}/tasks/ext/s3-storage-provider/validate_config.yml"
when: matrix_synapse_ext_synapse_s3_storage_provider_enabled | bool
- ansible.builtin.import_tasks: "{{ role_path }}/tasks/ext/s3-storage-provider/setup_install.yml"
when: matrix_synapse_ext_synapse_s3_storage_provider_enabled | bool
- ansible.builtin.import_tasks: "{{ role_path }}/tasks/ext/s3-storage-provider/setup_uninstall.yml"
when: not matrix_synapse_ext_synapse_s3_storage_provider_enabled | bool

52
roles/custom/matrix-synapse/tasks/ext/s3-storage-provider/setup_install.yml Normal file
View File

@ -0,0 +1,52 @@
---
# We install this into Synapse by making `matrix_synapse_ext_synapse_s3_storage_provider_enabled` influence other variables:
# - `matrix_synapse_media_storage_providers` (via `matrix_synapse_media_storage_providers_auto`)
# - `matrix_synapse_container_image_customizations_enabled`
# - `matrix_synapse_container_image_customizations_s3_storage_provider_installation_enabled`
#
# Below are additional tasks for setting up various helper scripts, etc.
- name: Ensure s3-storage-provider env file installed
ansible.builtin.template:
src: "{{ role_path }}/templates/synapse/ext/s3-storage-provider/env.j2"
dest: "{{ matrix_synapse_ext_s3_storage_provider_path }}/env"
mode: 0640
- name: Ensure s3-storage-provider data path exists
ansible.builtin.file:
path: "{{ matrix_synapse_ext_s3_storage_provider_path }}/data"
state: directory
mode: 0750
owner: "{{ matrix_user_username }}"
group: "{{ matrix_user_groupname }}"
- name: Ensure s3-storage-provider database.yaml file installed
ansible.builtin.template:
src: "{{ role_path }}/templates/synapse/ext/s3-storage-provider/database.yaml.j2"
dest: "{{ matrix_synapse_ext_s3_storage_provider_path }}/data/database.yaml"
mode: 0640
- name: Ensure s3-storage-provider scripts installed
ansible.builtin.template:
src: "{{ role_path }}/templates/synapse/ext/s3-storage-provider/usr-local-bin/{{ item }}.j2"
dest: "{{ matrix_local_bin_path }}/{{ item }}"
mode: 0750
with_items:
- matrix-synapse-s3-storage-provider-shell
- matrix-synapse-s3-storage-provider-migrate
- name: Ensure matrix-synapse-s3-storage-provider-migrate.service and timer are installed
ansible.builtin.template:
src: "{{ role_path }}/templates/synapse/ext/s3-storage-provider/systemd/{{ item }}.j2"
dest: "{{ matrix_systemd_path }}/{{ item }}"
mode: 0640
with_items:
- matrix-synapse-s3-storage-provider-migrate.service
- matrix-synapse-s3-storage-provider-migrate.timer
register: matrix_synapse_s3_storage_provider_systemd_service_result
- name: Ensure systemd reloaded after matrix-synapse-s3-storage-provider-migrate.service installation
ansible.builtin.service:
daemon_reload: true
when: matrix_synapse_s3_storage_provider_systemd_service_result.changed | bool

24
roles/custom/matrix-synapse/tasks/ext/s3-storage-provider/setup_uninstall.yml Normal file
View File

@ -0,0 +1,24 @@
---
- name: Ensure matrix-synapse-s3-storage-provider-migrate.service and timer don't exist
ansible.builtin.file:
path: "{{ matrix_systemd_path }}/{{ item }}"
state: absent
with_items:
- matrix-synapse-s3-storage-provider-migrate.timer
- matrix-synapse-s3-storage-provider-migrate.service
register: matrix_synapse_s3_storage_provider_migrate_sevice_removal
- name: Ensure systemd reloaded after matrix-synapse-s3-storage-provider-migrate.service removal
ansible.builtin.service:
daemon_reload: true
when: matrix_synapse_s3_storage_provider_migrate_sevice_removal.changed | bool
- name: Ensure s3-storage-provider files don't exist
ansible.builtin.file:
path: "{{ item }}"
state: absent
with_items:
- "{{ matrix_local_bin_path }}/matrix-synapse-s3-storage-provider-shell"
- "{{ matrix_local_bin_path }}/matrix-synapse-s3-storage-provider-migrate"
- "{{ matrix_synapse_ext_s3_storage_provider_path }}"

18
roles/custom/matrix-synapse/tasks/ext/s3-storage-provider/validate_config.yml Normal file
View File

@ -0,0 +1,18 @@
---
- name: Fail if required s3-storage-provider settings not defined
ansible.builtin.fail:
msg: >-
You need to define a required configuration setting (`{{ item }}`) for using s3-storage-provider.
when: "vars[item] == ''"
with_items:
- "matrix_synapse_ext_synapse_s3_storage_provider_config_bucket"
- "matrix_synapse_ext_synapse_s3_storage_provider_config_region_name"
- "matrix_synapse_ext_synapse_s3_storage_provider_config_access_key_id"
- "matrix_synapse_ext_synapse_s3_storage_provider_config_secret_access_key"
- name: Fail if required matrix_synapse_ext_synapse_s3_storage_provider_config_endpoint_url looks invalid
ansible.builtin.fail:
msg: >-
`matrix_synapse_ext_synapse_s3_storage_provider_config_endpoint_url` needs to look like a URL (`http://` or `https://` prefix).
when: "matrix_synapse_ext_synapse_s3_storage_provider_config_endpoint_url != '' and not matrix_synapse_ext_synapse_s3_storage_provider_config_endpoint_url.startswith('http')"

15
roles/custom/matrix-synapse/tasks/ext/setup.yml Normal file
View File

@ -0,0 +1,15 @@
---
- ansible.builtin.import_tasks: "{{ role_path }}/tasks/ext/encryption-disabler/setup.yml"
- ansible.builtin.import_tasks: "{{ role_path }}/tasks/ext/rest-auth/setup.yml"
- ansible.builtin.import_tasks: "{{ role_path }}/tasks/ext/shared-secret-auth/setup.yml"
- ansible.builtin.import_tasks: "{{ role_path }}/tasks/ext/ldap-auth/setup.yml"
- ansible.builtin.import_tasks: "{{ role_path }}/tasks/ext/synapse-simple-antispam/setup.yml"
- ansible.builtin.import_tasks: "{{ role_path }}/tasks/ext/mjolnir-antispam/setup.yml"
- ansible.builtin.import_tasks: "{{ role_path }}/tasks/ext/s3-storage-provider/setup.yml"

7
roles/custom/matrix-synapse/tasks/ext/shared-secret-auth/setup.yml Normal file
View File

@ -0,0 +1,7 @@
---
- ansible.builtin.import_tasks: "{{ role_path }}/tasks/ext/shared-secret-auth/setup_install.yml"
when: matrix_synapse_ext_password_provider_shared_secret_auth_enabled | bool
- ansible.builtin.import_tasks: "{{ role_path }}/tasks/ext/shared-secret-auth/setup_uninstall.yml"
when: "not matrix_synapse_ext_password_provider_shared_secret_auth_enabled | bool"

51
roles/custom/matrix-synapse/tasks/ext/shared-secret-auth/setup_install.yml Normal file
View File

@ -0,0 +1,51 @@
---
- name: Fail if Shared Secret Auth secret not set
ansible.builtin.fail:
msg: "Shared Secret Auth is enabled, but no secret has been set in matrix_synapse_ext_password_provider_shared_secret_auth_shared_secret"
when: "matrix_synapse_ext_password_provider_shared_secret_auth_shared_secret == ''"
- name: Fail if no Shared Secret Auth login types enabled
ansible.builtin.fail:
msg: "Shared Secret Auth is enabled, but none of the login types are"
when: "not (matrix_synapse_ext_password_provider_shared_secret_auth_m_login_password_support_enabled or matrix_synapse_ext_password_provider_shared_secret_auth_com_devture_shared_secret_auth_support_enabled)"
- name: Download matrix-synapse-shared-secret-auth
ansible.builtin.get_url:
url: "{{ matrix_synapse_ext_password_provider_shared_secret_auth_download_url }}"
dest: "{{ matrix_synapse_ext_path }}/shared_secret_authenticator.py"
force: true
mode: 0440
owner: "{{ matrix_user_username }}"
group: "{{ matrix_user_groupname }}"
register: result
retries: "{{ matrix_geturl_retries_count }}"
delay: "{{ matrix_geturl_retries_delay }}"
until: result is not failed
- ansible.builtin.set_fact:
matrix_synapse_modules: |
{{
matrix_synapse_modules | default([])
+
[
{
"module": "shared_secret_authenticator.SharedSecretAuthProvider",
"config": matrix_synapse_ext_password_provider_shared_secret_config
}
]
}}
matrix_synapse_container_extra_arguments: >
{{
matrix_synapse_container_extra_arguments | default([])
+
["--mount type=bind,src={{ matrix_synapse_ext_path }}/shared_secret_authenticator.py,dst={{ matrix_synapse_in_container_python_packages_path }}/shared_secret_authenticator.py,ro"]
}}
matrix_synapse_additional_loggers: >
{{
matrix_synapse_additional_loggers
+
[{'name': 'shared_secret_authenticator', 'level': 'INFO'}]
}}

6
roles/custom/matrix-synapse/tasks/ext/shared-secret-auth/setup_uninstall.yml Normal file
View File

@ -0,0 +1,6 @@
---
- name: Ensure matrix-synapse-shared-secret-auth doesn't exist
ansible.builtin.file:
path: "{{ matrix_synapse_ext_path }}/shared_secret_authenticator.py"
state: absent

7
roles/custom/matrix-synapse/tasks/ext/synapse-simple-antispam/setup.yml Normal file
View File

@ -0,0 +1,7 @@
---
- ansible.builtin.import_tasks: "{{ role_path }}/tasks/ext/synapse-simple-antispam/setup_install.yml"
when: matrix_synapse_ext_spam_checker_synapse_simple_antispam_enabled | bool
- ansible.builtin.import_tasks: "{{ role_path }}/tasks/ext/synapse-simple-antispam/setup_uninstall.yml"
when: "not matrix_synapse_ext_spam_checker_synapse_simple_antispam_enabled | bool"

58
roles/custom/matrix-synapse/tasks/ext/synapse-simple-antispam/setup_install.yml Normal file
View File

@ -0,0 +1,58 @@
---
- name: Fail if Synapse Simple Antispam blocked homeservers is not set
ansible.builtin.fail:
msg: "Synapse Simple Antispam is enabled, but no blocked homeservers have been set in matrix_synapse_ext_spam_checker_synapse_simple_antispam_config_blocked_homeservers"
when: "matrix_synapse_ext_spam_checker_synapse_simple_antispam_config_blocked_homeservers | length == 0"
- name: Ensure git installed (RedHat)
ansible.builtin.yum:
name:
- git
state: present
update_cache: false
when: "ansible_os_family == 'RedHat'"
- name: Ensure git installed (Debian)
ansible.builtin.apt:
name:
- git
state: present
update_cache: false
when: "ansible_os_family == 'Debian'"
- name: Ensure git installed (Archlinux)
community.general.pacman:
name:
- git
state: present
update_cache: false
when: "ansible_distribution == 'Archlinux'"
- name: Clone synapse-simple-antispam git repository
ansible.builtin.git:
repo: "{{ matrix_synapse_ext_spam_checker_synapse_simple_antispam_git_repository_url }}"
version: "{{ matrix_synapse_ext_spam_checker_synapse_simple_antispam_git_version }}"
dest: "{{ matrix_synapse_ext_path }}/synapse-simple-antispam"
become: true
become_user: "{{ matrix_user_username }}"
- ansible.builtin.set_fact:
matrix_synapse_modules: >
{{
matrix_synapse_modules
+
[{
"module": "synapse_simple_antispam.AntiSpamInvites",
"config": {
"blocked_homeservers": matrix_synapse_ext_spam_checker_synapse_simple_antispam_config_blocked_homeservers
}
}]
}}
matrix_synapse_container_extra_arguments: >
{{
matrix_synapse_container_extra_arguments | default([])
+
["--mount type=bind,src={{ matrix_synapse_ext_path }}/synapse-simple-antispam/synapse_simple_antispam,dst={{ matrix_synapse_in_container_python_packages_path }}/synapse_simple_antispam,ro"]
}}

6
roles/custom/matrix-synapse/tasks/ext/synapse-simple-antispam/setup_uninstall.yml Normal file
View File

@ -0,0 +1,6 @@
---
- name: Ensure synapse-simple-antispam doesn't exist
ansible.builtin.file:
path: "{{ matrix_synapse_ext_path }}/synapse-simple-antispam"
state: absent

7
roles/custom/matrix-synapse/tasks/goofys/setup.yml Normal file
View File

@ -0,0 +1,7 @@
---
- ansible.builtin.import_tasks: "{{ role_path }}/tasks/goofys/setup_install.yml"
when: matrix_s3_media_store_enabled | bool
- ansible.builtin.import_tasks: "{{ role_path }}/tasks/goofys/setup_uninstall.yml"
when: "not matrix_s3_media_store_enabled | bool"

49
roles/custom/matrix-synapse/tasks/goofys/setup_install.yml Normal file
View File

@ -0,0 +1,49 @@
---
- ansible.builtin.import_tasks: "{{ role_path }}/../matrix-base/tasks/util/ensure_fuse_installed.yml"
- name: Ensure Goofys Docker image is pulled
community.docker.docker_image:
name: "{{ matrix_s3_goofys_docker_image }}"
source: "{{ 'pull' if ansible_version.major > 2 or ansible_version.minor > 7 else omit }}"
force_source: "{{ matrix_s3_goofys_docker_image_force_pull if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}"
force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else matrix_s3_goofys_docker_image_force_pull }}"
register: result
retries: "{{ matrix_container_retries_count }}"
delay: "{{ matrix_container_retries_delay }}"
until: result is not failed
# This will throw a Permission Denied error if already mounted
- name: Check Matrix Goofys external storage mountpoint path
ansible.builtin.stat:
path: "{{ matrix_s3_media_store_path }}"
register: local_path_matrix_s3_media_store_path_stat
ignore_errors: true
- name: Ensure Matrix Goofys external storage mountpoint exists
ansible.builtin.file:
path: "{{ matrix_s3_media_store_path }}"
state: directory
mode: 0750
owner: "{{ matrix_user_username }}"
group: "{{ matrix_user_groupname }}"
when: "not local_path_matrix_s3_media_store_path_stat.failed and not local_path_matrix_s3_media_store_path_stat.stat.exists"
- name: Ensure goofys environment variables file created
ansible.builtin.template:
src: "{{ role_path }}/templates/goofys/env-goofys.j2"
dest: "{{ matrix_synapse_config_dir_path }}/env-goofys"
owner: root
mode: 0600
- name: Ensure matrix-goofys.service installed
ansible.builtin.template:
src: "{{ role_path }}/templates/goofys/systemd/matrix-goofys.service.j2"
dest: "{{ matrix_systemd_path }}/matrix-goofys.service"
mode: 0644
register: matrix_goofys_systemd_service_result
- name: Ensure systemd reloaded after matrix-goofys.service installation
ansible.builtin.service:
daemon_reload: true
when: "matrix_goofys_systemd_service_result.changed"

36
roles/custom/matrix-synapse/tasks/goofys/setup_uninstall.yml Normal file
View File

@ -0,0 +1,36 @@
---
- name: Check existence of matrix-goofys service
ansible.builtin.stat:
path: "{{ matrix_systemd_path }}/matrix-goofys.service"
register: matrix_goofys_service_stat
- name: Ensure matrix-goofys is stopped
ansible.builtin.service:
name: matrix-goofys
state: stopped
enabled: false
daemon_reload: true
register: stopping_result
when: "matrix_goofys_service_stat.stat.exists"
- name: Ensure matrix-goofys.service doesn't exist
ansible.builtin.file:
path: "{{ matrix_systemd_path }}/matrix-goofys.service"
state: absent
when: "matrix_goofys_service_stat.stat.exists"
- name: Ensure systemd reloaded after matrix-goofys.service removal
ansible.builtin.service:
daemon_reload: true
when: "matrix_goofys_service_stat.stat.exists"
- name: Ensure goofys environment variables file doesn't exist
ansible.builtin.file:
path: "{{ matrix_synapse_config_dir_path }}/env-goofys"
state: absent
- name: Ensure Goofys Docker image doesn't exist
community.docker.docker_image:
name: "{{ matrix_s3_goofys_docker_image }}"
state: absent

84
roles/custom/matrix-synapse/tasks/import_media_store.yml Normal file
View File

@ -0,0 +1,84 @@
---
# Pre-checks
- name: Fail if playbook called incorrectly
ansible.builtin.fail:
msg: "The `server_path_media_store` variable needs to be provided to this playbook, via --extra-vars"
when: "server_path_media_store is not defined or server_path_media_store.startswith('<')"
- name: Fail if media store is on Amazon S3
ansible.builtin.fail:
msg: "Your media store is on Amazon S3. Due to technical limitations, restoring is not supported."
when: matrix_s3_media_store_enabled | bool
- name: Check if the provided media store directory exists
ansible.builtin.stat:
path: "{{ server_path_media_store }}"
register: server_path_media_store_stat
- name: Fail if provided media store directory doesn't exist on the server
ansible.builtin.fail:
msg: "{{ server_path_media_store }} cannot be found on the server"
when: "not server_path_media_store_stat.stat.exists or not server_path_media_store_stat.stat.isdir"
- name: Check if media store contains local_content
ansible.builtin.stat:
path: "{{ server_path_media_store }}/local_content"
register: server_path_media_store_local_content_stat
- name: Check if media store contains remote_content
ansible.builtin.stat:
path: "{{ server_path_media_store }}/remote_content"
register: server_path_media_store_remote_content_stat
- name: Fail if media store directory doesn't look okay (lacking remote and local content)
ansible.builtin.fail:
msg: "{{ server_path_media_store }} contains neither local_content nor remote_content directories. It's most likely a mistake and is not a media store directory."
when: "not server_path_media_store_local_content_stat.stat.exists and not server_path_media_store_remote_content_stat.stat.exists"
# Actual import work
- name: Ensure matrix-synapse is stopped
ansible.builtin.service:
name: matrix-synapse
state: stopped
enabled: false
daemon_reload: true
register: stopping_result
# This can only work with local files, not if the media store is on Amazon S3,
# as it won't be accessible in such a case.
- name: Ensure provided media store directory is synchronized
ansible.posix.synchronize:
src: "{{ server_path_media_store }}/"
dest: "{{ matrix_synapse_media_store_path }}"
delete: true
# It's wasteful to preserve owner/group now. We chown below anyway.
owner: false
group: false
times: true
delegate_to: "{{ inventory_hostname }}"
# This is for the generic case and fails in other cases (remote file systems),
# because in such cases the base path (matrix_synapse_media_store_path) is a mount point.
- name: Ensure media store permissions are correct (generic case)
ansible.builtin.file:
path: "{{ matrix_synapse_media_store_path }}"
owner: "{{ matrix_user_username }}"
group: "{{ matrix_user_groupname }}"
recurse: true
when: "not matrix_s3_media_store_enabled | bool"
# We don't chown for Goofys, because due to the way it's mounted,
# all files become owned by whoever needs to own them.
- name: Ensure Synapse is started (if it previously was)
ansible.builtin.service:
name: "{{ item }}"
state: started
daemon_reload: true
when: "stopping_result.changed"
with_items:
- matrix-synapse

90
roles/custom/matrix-synapse/tasks/init.yml Normal file
View File

@ -0,0 +1,90 @@
---
# See https://github.com/spantaleev/matrix-docker-ansible-deploy/issues/1070
# and https://github.com/spantaleev/matrix-docker-ansible-deploy/commit/1ab507349c752042d26def3e95884f6df8886b74#commitcomment-51108407
- name: Fail if trying to self-build on Ansible < 2.8
ansible.builtin.fail:
msg: "To self-build the Synapse image, you should use Ansible 2.8 or higher. See docs/ansible.md"
when: "ansible_version.major == 2 and ansible_version.minor < 8 and matrix_synapse_container_image_self_build and matrix_synapse_enabled"
# Unless `matrix_synapse_workers_enabled_list` is explicitly defined,
# we'll generate it dynamically.
- ansible.builtin.include_tasks: "{{ role_path }}/tasks/synapse/workers/init.yml"
when: "matrix_synapse_enabled and matrix_synapse_workers_enabled and matrix_synapse_workers_enabled_list | length == 0"
- ansible.builtin.set_fact:
matrix_systemd_services_list: "{{ matrix_systemd_services_list + ['matrix-synapse.service'] }}"
when: matrix_synapse_enabled | bool
- name: Ensure workers are injected into various places
ansible.builtin.include_tasks: "{{ role_path }}/tasks/synapse/workers/util/inject_worker.yml"
with_items: "{{ matrix_synapse_workers_enabled_list }}"
loop_control:
loop_var: matrix_synapse_worker_details
when: matrix_synapse_enabled | bool and matrix_synapse_workers_enabled | bool
- ansible.builtin.set_fact:
matrix_systemd_services_list: "{{ matrix_systemd_services_list + ['matrix-goofys.service'] }}"
when: matrix_s3_media_store_enabled | bool
- ansible.builtin.include_tasks: "{{ role_path }}/tasks/ext/s3-storage-provider/init.yml"
when: matrix_synapse_ext_synapse_s3_storage_provider_enabled | bool
- when: matrix_synapse_enabled | bool and matrix_synapse_metrics_proxying_enabled | bool
block:
- name: Fail if matrix-nginx-proxy role already executed
ansible.builtin.fail:
msg: >-
Trying to append Synapse's reverse-proxying configuration to matrix-nginx-proxy,
but it's pointless since the matrix-nginx-proxy role had already executed.
To fix this, please change the order of roles in your playbook,
so that the matrix-nginx-proxy role would run after the matrix-synapse role.
when: matrix_nginx_proxy_role_executed | default(False) | bool
- name: Generate synapse metrics proxying configuration for matrix-nginx-proxy (matrix.DOMAIN/metrics/synapse/main-process)
ansible.builtin.set_fact:
matrix_synapse_nginx_metrics_configuration_block: |
location /metrics/synapse/main-process {
{% if matrix_nginx_proxy_enabled | default(False) %}
{# Use the embedded DNS resolver in Docker containers to discover the service #}
resolver 127.0.0.11 valid=5s;
set $backend "matrix-synapse:{{ matrix_synapse_metrics_port }}";
proxy_pass http://$backend/_synapse/metrics;
{% else %}
{# Generic configuration for use outside of our container setup #}
proxy_pass http://127.0.0.1:{{ matrix_synapse_metrics_port }}/_synapse/metrics;
{% endif %}
}
- name: Register synapse metrics proxying configuration with matrix-nginx-proxy (matrix.DOMAIN/metrics/synapse/main-process)
ansible.builtin.set_fact:
matrix_nginx_proxy_proxy_matrix_metrics_additional_system_location_configuration_blocks: |
{{
matrix_nginx_proxy_proxy_matrix_metrics_additional_system_location_configuration_blocks | default([])
+
[matrix_synapse_nginx_metrics_configuration_block]
}}
- name: Generate synapse worker metrics proxying configuration for matrix-nginx-proxy (matrix.DOMAIN/metrics/synapse/worker)
ansible.builtin.set_fact:
matrix_synapse_worker_nginx_metrics_configuration_block: |
{% for worker in matrix_synapse_workers_enabled_list %}
{% if worker.metrics_port != 0 %}
location /metrics/synapse/worker/{{ worker.id }} {
resolver 127.0.0.11 valid=5s;
set $backend "{{ worker.name }}:{{ worker.metrics_port }}";
proxy_pass http://$backend/_synapse/metrics;
proxy_set_header Host $host;
}
{% endif %}
{% endfor %}
when: matrix_synapse_workers_enabled_list | length > 0
- name: Register synapse worker metrics proxying configuration with matrix-nginx-proxy (matrix.DOMAIN/metrics/synapse/worker)
ansible.builtin.set_fact:
matrix_nginx_proxy_proxy_matrix_metrics_additional_system_location_configuration_blocks: |
{{
matrix_nginx_proxy_proxy_matrix_metrics_additional_system_location_configuration_blocks | default([])
+
[matrix_synapse_worker_nginx_metrics_configuration_block]
}}
when: matrix_synapse_workers_enabled_list | length > 0

57
roles/custom/matrix-synapse/tasks/main.yml Normal file
View File

@ -0,0 +1,57 @@
---
- ansible.builtin.import_tasks: "{{ role_path }}/tasks/init.yml"
tags:
- always
- ansible.builtin.import_tasks: "{{ role_path }}/tasks/validate_config.yml"
when: run_setup | bool and matrix_synapse_enabled | bool
tags:
- setup-all
- setup-synapse
- ansible.builtin.import_tasks: "{{ role_path }}/tasks/setup_synapse.yml"
when: run_setup | bool
tags:
- setup-all
- setup-synapse
- ansible.builtin.import_tasks: "{{ role_path }}/tasks/import_media_store.yml"
when: run_synapse_import_media_store | bool
tags:
- import-synapse-media-store
- ansible.builtin.import_tasks: "{{ role_path }}/tasks/register_user.yml"
when: run_synapse_register_user | bool and matrix_synapse_enabled | bool
tags:
- register-user
- ansible.builtin.import_tasks: "{{ role_path }}/tasks/self_check_client_api.yml"
delegate_to: 127.0.0.1
become: false
when: run_self_check | bool
tags:
- self-check
- ansible.builtin.import_tasks: "{{ role_path }}/tasks/self_check_federation_api.yml"
delegate_to: 127.0.0.1
become: false
when: run_self_check | bool
tags:
- self-check
- ansible.builtin.import_tasks: "{{ role_path }}/tasks/update_user_password.yml"
when: run_synapse_update_user_password | bool and matrix_synapse_enabled | bool
tags:
- update-user-password
- ansible.builtin.import_tasks: "{{ role_path }}/tasks/rust-synapse-compress-state/main.yml"
when: run_synapse_rust_synapse_compress_state | bool
tags:
- rust-synapse-compress-state
- name: Mark matrix-synapse role as executed
ansible.builtin.set_fact:
matrix_synapse_role_executed: true
tags:
- always

33
roles/custom/matrix-synapse/tasks/register_user.yml Normal file
View File

@ -0,0 +1,33 @@
---
- name: Fail if playbook called incorrectly
ansible.builtin.fail:
msg: "The `username` variable needs to be provided to this playbook, via --extra-vars"
when: "username is not defined or username == '<your-username>'"
- name: Fail if playbook called incorrectly
ansible.builtin.fail:
msg: "The `password` variable needs to be provided to this playbook, via --extra-vars"
when: "password is not defined or password == '<your-password>'"
- name: Fail if playbook called incorrectly
ansible.builtin.fail:
msg: "The `admin` variable needs to be provided to this playbook, via --extra-vars"
when: "admin is not defined or admin not in ['yes', 'no']"
- name: Ensure matrix-synapse is started
ansible.builtin.service:
name: matrix-synapse
state: started
daemon_reload: true
register: start_result
- name: Wait a while, so that Synapse can manage to start
ansible.builtin.pause:
seconds: 7
when: "start_result.changed"
- name: Register user
ansible.builtin.command: "{{ matrix_local_bin_path }}/matrix-synapse-register-user {{ username | quote }} {{ password | quote }} {{ '1' if admin == 'yes' else '0' }}"
register: matrix_synapse_register_user_result
changed_when: matrix_synapse_register_user_result.rc == 0

55
roles/custom/matrix-synapse/tasks/rust-synapse-compress-state/compress_room.yml Normal file
View File

@ -0,0 +1,55 @@
---
- ansible.builtin.debug:
msg: "Compressing room `{{ room_details.room_id }}` having {{ room_details.count }} state group rows"
- name: Generate rust-synapse-compress-state room compression command
ansible.builtin.set_fact:
matrix_synapse_rust_synapse_compress_state_compress_room_command: >-
{{ matrix_host_command_docker }} run --rm --name matrix-rust-synapse-compress-state-compress-room
--user={{ matrix_user_uid }}:{{ matrix_user_gid }}
--cap-drop=ALL
--network={{ matrix_docker_network }}
--mount type=bind,src={{ matrix_synapse_rust_synapse_compress_state_base_path }},dst=/work
{{ matrix_synapse_rust_synapse_compress_state_docker_image }}
{{ matrix_synapse_rust_synapse_compress_state_synapse_compress_state_in_container_path }} -t -o /work/state-compressor.sql
-p "host={{ matrix_synapse_database_host }} user={{ matrix_synapse_database_user }} password={{ matrix_synapse_database_password }} dbname={{ matrix_synapse_database_database }}"
-r '{{ room_details.room_id }}'
- name: Run rust-synapse-compress-state room compression command (SQL generation)
ansible.builtin.command: "{{ matrix_synapse_rust_synapse_compress_state_compress_room_command }}"
async: "{{ matrix_synapse_rust_synapse_compress_state_compress_room_time }}"
poll: 10
register: matrix_synapse_rust_synapse_compress_state_compress_room_command_result
failed_when: not matrix_synapse_rust_synapse_compress_state_compress_room_command_result.finished or matrix_synapse_rust_synapse_compress_state_compress_room_command_result.rc != 0
changed_when: matrix_synapse_rust_synapse_compress_state_compress_room_command_result.finished and matrix_synapse_rust_synapse_compress_state_compress_room_command_result.rc == 0
- ansible.builtin.debug:
var: "matrix_synapse_rust_synapse_compress_state_compress_room_command_result"
- name: Generate Postgres compression SQL import command
ansible.builtin.set_fact:
matrix_synapse_rust_synapse_compress_state_psql_import_command: >-
{{ matrix_host_command_docker }} run --rm --name matrix-rust-synapse-compress-state-psql-import
--user={{ matrix_user_uid }}:{{ matrix_user_gid }}
--cap-drop=ALL
--network={{ matrix_docker_network }}
--env-file={{ matrix_postgres_base_path }}/env-postgres-psql
--mount type=bind,src={{ matrix_synapse_rust_synapse_compress_state_base_path }},dst=/work,ro
--entrypoint=/bin/sh
{{ matrix_postgres_docker_image_latest }}
-c "cat /work/state-compressor.sql |
psql -v ON_ERROR_STOP=1 -h matrix-postgres -d {{ matrix_synapse_database_database }}"
- name: Import compression SQL into Postgres
ansible.builtin.command: "{{ matrix_synapse_rust_synapse_compress_state_psql_import_command }}"
async: "{{ matrix_synapse_rust_synapse_compress_state_psql_import_time }}"
poll: 10
register: matrix_synapse_rust_synapse_compress_state_psql_import_command_result
failed_when: not matrix_synapse_rust_synapse_compress_state_psql_import_command_result.finished
changed_when: matrix_synapse_rust_synapse_compress_state_psql_import_command_result.finished and matrix_synapse_rust_synapse_compress_state_psql_import_command_result.rc == 0
- name: Clean up
ansible.builtin.file:
path: "{{ matrix_synapse_rust_synapse_compress_state_base_path }}/state-compressor.sql"
state: absent

126
roles/custom/matrix-synapse/tasks/rust-synapse-compress-state/main.yml Normal file
View File

@ -0,0 +1,126 @@
---
# Pre-checks
- name: Fail if Postgres not enabled
ansible.builtin.fail:
msg: "Postgres via the matrix-postgres role is not enabled (`matrix_postgres_enabled`). Cannot use rust-synapse-compress-state."
when: "not matrix_postgres_enabled | bool"
# Defaults
- name: Set matrix_synapse_rust_synapse_compress_state_find_rooms_command_wait_time, if not provided
ansible.builtin.set_fact:
matrix_synapse_rust_synapse_compress_state_find_rooms_command_wait_time: 1800
when: "matrix_synapse_rust_synapse_compress_state_find_rooms_command_wait_time | default('') == ''"
- name: Set matrix_synapse_rust_synapse_compress_state_compress_room_time, if not provided
ansible.builtin.set_fact:
matrix_synapse_rust_synapse_compress_state_compress_room_time: 3600
when: "matrix_synapse_rust_synapse_compress_state_compress_room_time | default('') == ''"
- name: Set matrix_synapse_rust_synapse_compress_state_psql_import_time, if not provided
ansible.builtin.set_fact:
matrix_synapse_rust_synapse_compress_state_psql_import_time: 3600
when: "matrix_synapse_rust_synapse_compress_state_psql_import_time | default('') == ''"
- name: Set matrix_synapse_rust_synapse_compress_state_min_state_groups_required, if not provided
ansible.builtin.set_fact:
# The minimum number of state groups we're looking for before we consider a room eligible for compression.
# Rooms with a smaller state groups count will not be compressed.
matrix_synapse_rust_synapse_compress_state_min_state_groups_required: 100000
when: "matrix_synapse_rust_synapse_compress_state_min_state_groups_required | default('') == ''"
# Actual compression work
- name: Ensure rust-synapse-compress-state paths exist
ansible.builtin.file:
path: "{{ matrix_synapse_rust_synapse_compress_state_base_path }}"
state: directory
mode: 0750
owner: "{{ matrix_user_username }}"
group: "{{ matrix_user_groupname }}"
- name: Ensure rust-synapse-compress-state image is pulled
community.docker.docker_image:
name: "{{ matrix_synapse_rust_synapse_compress_state_docker_image }}"
source: "{{ 'pull' if ansible_version.major > 2 or ansible_version.minor > 7 else omit }}"
force_source: "{{ matrix_synapse_rust_synapse_compress_state_docker_image_force_pull if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}"
force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else matrix_synapse_rust_synapse_compress_state_docker_image_force_pull }}"
register: result
retries: "{{ matrix_container_retries_count }}"
delay: "{{ matrix_container_retries_delay }}"
until: result is not failed
- name: Generate rust-synapse-compress-state room find command
ansible.builtin.set_fact:
matrix_synapse_rust_synapse_compress_state_find_rooms_command: >-
{{ matrix_host_command_docker }} run --rm --name matrix-rust-synapse-compress-state-find-rooms
--user={{ matrix_user_uid }}:{{ matrix_user_gid }}
--cap-drop=ALL
--network={{ matrix_docker_network }}
--env-file={{ matrix_postgres_base_path }}/env-postgres-psql
{{ matrix_postgres_docker_image_latest }}
psql -v ON_ERROR_STOP=1 -h matrix-postgres {{ matrix_synapse_database_database }} -c
'SELECT array_to_json(array_agg(row_to_json (r))) FROM (SELECT room_id, count(*) AS count FROM state_groups_state GROUP BY room_id HAVING count(*) > {{ matrix_synapse_rust_synapse_compress_state_min_state_groups_required }} ORDER BY count DESC) r;'
- name: Find rooms eligible for compression with rust-synapse-compress-state
ansible.builtin.command: "{{ matrix_synapse_rust_synapse_compress_state_find_rooms_command }}"
async: "{{ matrix_synapse_rust_synapse_compress_state_find_rooms_command_wait_time }}"
poll: 10
register: matrix_synapse_rust_synapse_compress_state_find_rooms_command_result
failed_when: not matrix_synapse_rust_synapse_compress_state_find_rooms_command_result.finished
changed_when: false
# We expect the output to be like this:
#
# "stdout_lines": [
# " array_to_json ",
# "----------------------------------------------------------------------------------------------------------------------------",
# " [{\"room_id\":\"!some-id\",\"count\":2461329},{\"room_id\":\"!another-id\",\"count\":512017}]",
# "(1 row)"
# ]
#
# Row 3 (out of 4) contains the actual result.
#
# Row 3 contains a space when there's no result.
- when: "matrix_synapse_rust_synapse_compress_state_find_rooms_command_result.failed or matrix_synapse_rust_synapse_compress_state_find_rooms_command_result.stdout_lines | length != 4"
block:
- ansible.builtin.debug:
var: "matrix_synapse_rust_synapse_compress_state_find_rooms_command_result"
- name: Fail if room find result is not what we expect
ansible.builtin.fail:
msg: >-
Expecting 4 lines in the "find rooms" result.
- when: "matrix_synapse_rust_synapse_compress_state_find_rooms_command_result.stdout_lines[2] != ' '"
block:
# matrix_synapse_rust_synapse_compress_state_eligible_rooms is a list
# of dictionaries like this: {'room_id': '!some-id', 'count': 2461329}
- ansible.builtin.set_fact:
matrix_synapse_rust_synapse_compress_state_eligible_rooms: "{{ matrix_synapse_rust_synapse_compress_state_find_rooms_command_result.stdout_lines[2] | from_json }}"
- name: Display rooms that will be compressed
ansible.builtin.debug:
msg: >-
The following rooms contain more than {{ matrix_synapse_rust_synapse_compress_state_min_state_groups_required }} state group rows
(configurable via `matrix_synapse_rust_synapse_compress_state_min_state_groups_required`)
and will be compressed:
{{ matrix_synapse_rust_synapse_compress_state_eligible_rooms }}
- name: Compress room state
ansible.builtin.include_tasks: "{{ role_path }}/tasks/rust-synapse-compress-state/compress_room.yml"
with_items: "{{ matrix_synapse_rust_synapse_compress_state_eligible_rooms }}"
loop_control:
loop_var: room_details
- name: Show notice about lack of rooms to compress
ansible.builtin.debug:
msg: >-
No rooms were found to contain more than {{ matrix_synapse_rust_synapse_compress_state_min_state_groups_required }} state group rows
(configurable via `matrix_synapse_rust_synapse_compress_state_min_state_groups_required`),
so there's nothing to compress.
when: "matrix_synapse_rust_synapse_compress_state_find_rooms_command_result.stdout_lines[2] == ' '"

21
roles/custom/matrix-synapse/tasks/self_check_client_api.yml Normal file
View File

@ -0,0 +1,21 @@
---
- name: Check Matrix Client API
ansible.builtin.uri:
url: "{{ matrix_synapse_client_api_url_endpoint_public }}"
follow_redirects: none
validate_certs: "{{ matrix_synapse_self_check_validate_certificates }}"
register: result_matrix_synapse_client_api
ignore_errors: true
check_mode: false
when: matrix_synapse_enabled | bool
- name: Fail if Matrix Client API not working
ansible.builtin.fail:
msg: "Failed checking Matrix Client API is up at `{{ matrix_server_fqn_matrix }}` (checked endpoint: `{{ matrix_synapse_client_api_url_endpoint_public }}`). Is Synapse running? Is port 443 open in your firewall? Full error: {{ result_matrix_synapse_client_api }}"
when: "matrix_synapse_enabled | bool and (result_matrix_synapse_client_api.failed or 'json' not in result_matrix_synapse_client_api)"
- name: Report working Matrix Client API
ansible.builtin.debug:
msg: "The Matrix Client API at `{{ matrix_server_fqn_matrix }}` (checked endpoint: `{{ matrix_synapse_client_api_url_endpoint_public }}`) is working"
when: matrix_synapse_enabled | bool

26
roles/custom/matrix-synapse/tasks/self_check_federation_api.yml Normal file
View File

@ -0,0 +1,26 @@
---
- name: Check Matrix Federation API
ansible.builtin.uri:
url: "{{ matrix_synapse_federation_api_url_endpoint_public }}"
follow_redirects: none
validate_certs: "{{ matrix_synapse_self_check_validate_certificates }}"
register: result_matrix_synapse_federation_api
ignore_errors: true
check_mode: false
when: matrix_synapse_enabled | bool
- name: Fail if Matrix Federation API not working
ansible.builtin.fail:
msg: "Failed checking Matrix Federation API is up at `{{ matrix_server_fqn_matrix }}` (checked endpoint: `{{ matrix_synapse_federation_api_url_endpoint_public }}`). Is Synapse running? Is port {{ matrix_federation_public_port }} open in your firewall? Full error: {{ result_matrix_synapse_federation_api }}"
when: "matrix_synapse_enabled | bool and matrix_synapse_federation_enabled | bool and (result_matrix_synapse_federation_api.failed or 'json' not in result_matrix_synapse_federation_api)"
- name: Fail if Matrix Federation API unexpectedly enabled
ansible.builtin.fail:
msg: "Matrix Federation API is up at `{{ matrix_server_fqn_matrix }}` (checked endpoint: `{{ matrix_synapse_federation_api_url_endpoint_public }}`) despite being disabled."
when: "matrix_synapse_enabled | bool and not matrix_synapse_federation_enabled | bool and not result_matrix_synapse_federation_api.failed"
- name: Report working Matrix Federation API
ansible.builtin.debug:
msg: "The Matrix Federation API at `{{ matrix_server_fqn_matrix }}` (checked endpoint: `{{ matrix_synapse_federation_api_url_endpoint_public }}`) is working"
when: "matrix_synapse_enabled | bool and matrix_synapse_federation_enabled | bool"

27
roles/custom/matrix-synapse/tasks/setup_synapse.yml Normal file
View File

@ -0,0 +1,27 @@
---
- name: Ensure Synapse paths exist
ansible.builtin.file:
path: "{{ item.path }}"
state: directory
mode: 0750
owner: "{{ matrix_user_username }}"
group: "{{ matrix_user_groupname }}"
with_items:
- {path: "{{ matrix_synapse_config_dir_path }}", when: true}
- {path: "{{ matrix_synapse_ext_path }}", when: true}
- {path: "{{ matrix_synapse_docker_src_files_path }}", when: "{{ matrix_synapse_container_image_self_build }}"}
- {path: "{{ matrix_synapse_customized_docker_src_files_path }}", when: "{{ matrix_synapse_container_image_customizations_enabled }}"}
- {path: "{{ matrix_synapse_ext_s3_storage_provider_path }}", when: "{{ matrix_synapse_ext_synapse_s3_storage_provider_enabled }}"}
# We handle matrix_synapse_media_store_path elsewhere (in ./synapse/setup_install.yml),
# because if it's using Goofys and it's already mounted (from before),
# trying to chown/chmod it here will cause trouble.
when: "(matrix_synapse_enabled | bool or matrix_s3_media_store_enabled | bool) and item.when"
- ansible.builtin.import_tasks: "{{ role_path }}/tasks/ext/setup.yml"
- ansible.builtin.import_tasks: "{{ role_path }}/tasks/synapse/workers/setup.yml"
- ansible.builtin.import_tasks: "{{ role_path }}/tasks/synapse/setup.yml"
- ansible.builtin.import_tasks: "{{ role_path }}/tasks/goofys/setup.yml"

7
roles/custom/matrix-synapse/tasks/synapse/setup.yml Normal file
View File

@ -0,0 +1,7 @@
---
- ansible.builtin.import_tasks: "{{ role_path }}/tasks/synapse/setup_install.yml"
when: matrix_synapse_enabled | bool
- ansible.builtin.import_tasks: "{{ role_path }}/tasks/synapse/setup_uninstall.yml"
when: "not matrix_synapse_enabled | bool"

150
roles/custom/matrix-synapse/tasks/synapse/setup_install.yml Normal file
View File

@ -0,0 +1,150 @@
---
# This will throw a Permission Denied error if already mounted using fuse
- name: Check Synapse media store path
ansible.builtin.stat:
path: "{{ matrix_synapse_media_store_path }}"
register: local_path_media_store_stat
ignore_errors: true
# This is separate and conditional, to ensure we don't execute it
# if the path already exists or we failed to check, because it's mounted using fuse.
- name: Ensure Synapse media store path exists
ansible.builtin.file:
path: "{{ matrix_synapse_media_store_path }}"
state: directory
mode: 0750
owner: "{{ matrix_user_username }}"
group: "{{ matrix_user_groupname }}"
when: "not local_path_media_store_stat.failed and not local_path_media_store_stat.stat.exists"
- when: "matrix_synapse_container_image_self_build | bool"
block:
- name: Ensure Synapse repository is present on self-build
ansible.builtin.git:
repo: "{{ matrix_synapse_container_image_self_build_repo }}"
dest: "{{ matrix_synapse_docker_src_files_path }}"
version: "{{ matrix_synapse_docker_image.split(':')[1] }}"
force: "yes"
become: true
become_user: "{{ matrix_user_username }}"
register: matrix_synapse_git_pull_results
- name: Check if Synapse Docker image exists
ansible.builtin.command: "{{ matrix_host_command_docker }} images --quiet --filter 'reference={{ matrix_synapse_docker_image }}'"
register: matrix_synapse_docker_image_check_result
changed_when: false
# Invoking the `docker build` command here, instead of calling the `docker_image` Ansible module,
# because the latter does not support BuildKit.
# See: https://github.com/ansible-collections/community.general/issues/514
- name: Ensure Synapse Docker image is built
ansible.builtin.shell:
chdir: "{{ matrix_synapse_docker_src_files_path }}"
cmd: |
{{ matrix_host_command_docker }} build \
-t "{{ matrix_synapse_docker_image }}" \
-f docker/Dockerfile \
.
environment:
DOCKER_BUILDKIT: 1
when: "matrix_synapse_git_pull_results.changed | bool or matrix_synapse_docker_image_check_result.stdout == ''"
- name: Ensure Synapse Docker image is pulled
community.docker.docker_image:
name: "{{ matrix_synapse_docker_image }}"
source: "{{ 'pull' if ansible_version.major > 2 or ansible_version.minor > 7 else omit }}"
force_source: "{{ matrix_synapse_docker_image_force_pull if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}"
force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else matrix_synapse_docker_image_force_pull }}"
when: "not matrix_synapse_container_image_self_build"
register: result
retries: "{{ matrix_container_retries_count }}"
delay: "{{ matrix_container_retries_delay }}"
until: result is not failed
- when: "matrix_synapse_container_image_customizations_enabled | bool"
block:
- name: Ensure customizations Dockerfile is created
ansible.builtin.template:
src: "{{ role_path }}/templates/synapse/customizations/Dockerfile.j2"
dest: "{{ matrix_synapse_customized_docker_src_files_path }}/Dockerfile"
owner: "{{ matrix_user_username }}"
group: "{{ matrix_user_groupname }}"
mode: 0640
- name: Ensure customized Docker image for Synapse is built
community.docker.docker_image:
name: "{{ matrix_synapse_docker_image_customized }}"
source: build
build:
dockerfile: Dockerfile
path: "{{ matrix_synapse_customized_docker_src_files_path }}"
pull: true
- name: Check if a Synapse signing key exists
ansible.builtin.stat:
path: "{{ matrix_synapse_config_dir_path }}/{{ matrix_server_fqn_matrix }}.signing.key"
register: matrix_synapse_signing_key_stat
# We do this so that the signing key would get generated.
#
# This will also generate a default homeserver.yaml configuration file and a log configuration file.
# We don't care about those configuration files, as we replace them with our own anyway (see below).
#
# We don't use the `docker_container` module, because using it with `cap_drop` requires
# a very recent docker-py version, which is not available for a lot of people yet.
- name: Generate initial Synapse config and signing key
ansible.builtin.command: |
docker run
--rm
--name=matrix-config
--user={{ matrix_user_uid }}:{{ matrix_user_gid }}
--cap-drop=ALL
--mount type=bind,src={{ matrix_synapse_config_dir_path }},dst=/data
-e SYNAPSE_CONFIG_PATH=/data/homeserver.yaml
-e SYNAPSE_SERVER_NAME={{ matrix_server_fqn_matrix }}
-e SYNAPSE_REPORT_STATS=no
{{ matrix_synapse_docker_image }}
generate
when: "not matrix_synapse_signing_key_stat.stat.exists"
- name: Ensure Synapse homeserver config installed
ansible.builtin.copy:
content: "{{ matrix_synapse_configuration | to_nice_yaml(indent=2, width=999999) }}"
dest: "{{ matrix_synapse_config_dir_path }}/homeserver.yaml"
mode: 0644
owner: "{{ matrix_user_username }}"
group: "{{ matrix_user_groupname }}"
- name: Ensure Synapse log config installed
ansible.builtin.template:
src: "{{ matrix_synapse_template_synapse_log }}"
dest: "{{ matrix_synapse_config_dir_path }}/{{ matrix_server_fqn_matrix }}.log.config"
mode: 0644
- name: Ensure matrix-synapse.service installed
ansible.builtin.template:
src: "{{ role_path }}/templates/synapse/systemd/matrix-synapse.service.j2"
dest: "{{ matrix_systemd_path }}/matrix-synapse.service"
mode: 0644
register: matrix_synapse_systemd_service_result
- name: Ensure systemd reloaded after matrix-synapse.service installation
ansible.builtin.service:
daemon_reload: true
when: "matrix_synapse_systemd_service_result.changed"
- name: Ensure matrix-synapse-register-user script created
ansible.builtin.template:
src: "{{ role_path }}/templates/synapse/usr-local-bin/matrix-synapse-register-user.j2"
dest: "{{ matrix_local_bin_path }}/matrix-synapse-register-user"
mode: 0755
- name: Generate sample prometheus.yml for external scraping
ansible.builtin.template:
src: "{{ role_path }}/templates/synapse/prometheus/external_prometheus.yml.example.j2"
dest: "{{ matrix_synapse_base_path }}/external_prometheus.yml.example"
owner: "{{ matrix_user_username }}"
group: "{{ matrix_user_groupname }}"
mode: 0644
when: matrix_synapse_metrics_proxying_enabled | bool

40
roles/custom/matrix-synapse/tasks/synapse/setup_uninstall.yml Normal file
View File

@ -0,0 +1,40 @@
---
- name: Check existence of matrix-synapse service
ansible.builtin.stat:
path: "{{ matrix_systemd_path }}/matrix-synapse.service"
register: matrix_synapse_service_stat
- name: Ensure matrix-synapse is stopped
ansible.builtin.service:
name: matrix-synapse
state: stopped
enabled: false
daemon_reload: true
register: stopping_result
when: "matrix_synapse_service_stat.stat.exists"
- name: Ensure matrix-synapse.service doesn't exist
ansible.builtin.file:
path: "{{ matrix_systemd_path }}/matrix-synapse.service"
state: absent
when: "matrix_synapse_service_stat.stat.exists"
- name: Ensure systemd reloaded after matrix-synapse.service removal
ansible.builtin.service:
daemon_reload: true
when: "matrix_synapse_service_stat.stat.exists"
- name: Ensure Synapse Docker image doesn't exist
community.docker.docker_image:
name: "{{ item }}"
state: absent
with_items:
- "{{ matrix_synapse_docker_image_final }}"
- "{{ matrix_synapse_docker_image }}"
- name: Ensure sample prometheus.yml for external scraping is deleted
ansible.builtin.file:
path: "{{ matrix_synapse_base_path }}/external_prometheus.yml.example"
state: absent
when: "not matrix_synapse_metrics_proxying_enabled | bool"

152
roles/custom/matrix-synapse/tasks/synapse/workers/init.yml Normal file
View File

@ -0,0 +1,152 @@
---
# Below is a huge hack for dynamically building a list of workers and finally assigning it to `matrix_synapse_workers_enabled_list`.
#
# set_fact within a loop does not work reliably in Ansible (it only executes on the first iteration for some reason),
# so we're forced to do something much uglier.
- name: Build generic workers
ansible.builtin.set_fact:
worker:
id: "generic-worker-{{ item }}"
name: "matrix-synapse-worker-generic-{{ item }}"
type: 'generic_worker'
app: 'generic_worker'
webserving: true
port: "{{ matrix_synapse_workers_generic_workers_port_range_start + item }}"
metrics_port: "{{ matrix_synapse_workers_generic_workers_metrics_range_start + item }}"
register: "matrix_synapse_workers_list_results_generic_workers"
loop: "{{ range(0, matrix_synapse_workers_generic_workers_count | int) | list }}"
- name: Build stream writer workers
ansible.builtin.set_fact:
worker:
id: "stream-writer-{{ idx }}-{{ item.stream }}"
# Names must not include understores. Certain stream writer streams (to_device, account_data, ..) do, so we fix them up.
name: "matrix-synapse-worker-stream-writer-{{ idx }}-{{ item.stream | replace('_', '-') }}"
type: 'stream_writer'
app: "generic_worker"
webserving: "{{ item.stream in matrix_synapse_workers_webserving_stream_writer_types }}"
stream_writer_stream: "{{ item.stream }}"
port: "{{ matrix_synapse_workers_stream_writer_workers_http_port_range_start + idx }}"
replication_port: "{{ matrix_synapse_workers_stream_writer_workers_replication_port_range_start + idx }}"
metrics_port: "{{ matrix_synapse_workers_stream_writer_workers_metrics_range_start + idx }}"
register: "matrix_synapse_workers_list_results_stream_writer_workers"
loop: "{{ matrix_synapse_workers_stream_writers }}"
loop_control:
index_var: idx
- name: Populate matrix_synapse_stream_writers from enabled stream writer workers list
ansible.builtin.set_fact:
matrix_synapse_stream_writers: "{{ matrix_synapse_stream_writers | combine({item.ansible_facts.worker.stream_writer_stream: [item.ansible_facts.worker.name]}, list_merge='append') }}"
with_items: "{{ matrix_synapse_workers_list_results_stream_writer_workers.results }}"
- name: Build federation sender workers
ansible.builtin.set_fact:
worker:
id: "federation-sender-{{ item }}"
name: "matrix-synapse-worker-federation-sender-{{ item }}"
type: 'federation_sender'
app: 'federation_sender'
webserving: false
port: 0
metrics_port: "{{ matrix_synapse_workers_federation_sender_workers_metrics_range_start + item }}"
register: "matrix_synapse_workers_list_results_federation_sender_workers"
loop: "{{ range(0, matrix_synapse_workers_federation_sender_workers_count | int) | list }}"
- name: Populate matrix_synapse_federation_sender_instances from enabled federation sender workers list
ansible.builtin.set_fact:
matrix_synapse_federation_sender_instances: "{{ matrix_synapse_federation_sender_instances + [item.ansible_facts.worker.name] }}"
with_items: "{{ matrix_synapse_workers_list_results_federation_sender_workers.results }}"
# This type of worker can only have a count of 1, at most
- name: Build pusher workers
ansible.builtin.set_fact:
worker:
id: "pusher-{{ item }}"
name: "matrix-synapse-worker-pusher-{{ item }}"
type: 'pusher'
app: 'pusher'
webserving: false
port: 0
metrics_port: "{{ matrix_synapse_workers_pusher_workers_metrics_range_start + item }}"
register: "matrix_synapse_workers_list_results_pusher_workers"
loop: "{{ range(0, matrix_synapse_workers_pusher_workers_count | int) | list }}"
# This type of worker can only have a count of 1, at most
- name: Build appservice workers
ansible.builtin.set_fact:
worker:
id: "appservice-{{ item }}"
name: "matrix-synapse-worker-appservice-{{ item }}"
type: 'appservice'
app: 'generic_worker'
webserving: false
port: 0
metrics_port: "{{ matrix_synapse_workers_appservice_workers_metrics_range_start + item }}"
register: "matrix_synapse_workers_list_results_appservice_workers"
loop: "{{ range(0, matrix_synapse_workers_appservice_workers_count | int) | list }}"
# This type of worker can only have a count of 1, at most
- name: Build user_dir workers
ansible.builtin.set_fact:
worker:
id: "user-dir-{{ item }}"
name: "matrix-synapse-worker-user-dir-{{ item }}"
type: 'user_dir'
app: 'generic_worker'
webserving: true
port: "{{ matrix_synapse_workers_user_dir_workers_port_range_start + item }}"
metrics_port: "{{ matrix_synapse_workers_user_dir_workers_metrics_range_start + item }}"
register: "matrix_synapse_workers_list_results_user_dir_workers"
loop: "{{ range(0, matrix_synapse_workers_user_dir_workers_count | int) | list }}"
# This type of worker can only have a count of 1, at most
- name: Build background workers
ansible.builtin.set_fact:
worker:
id: "background-{{ item }}"
name: "matrix-synapse-worker-background-{{ item }}"
type: 'background'
app: 'generic_worker'
webserving: false
port: 0
metrics_port: "{{ matrix_synapse_workers_background_workers_metrics_range_start + item }}"
register: "matrix_synapse_workers_list_results_background_workers"
loop: "{{ range(0, matrix_synapse_workers_background_workers_count | int) | list }}"
- name: Build media_repository workers
ansible.builtin.set_fact:
worker:
id: "media-repository-{{ item }}"
name: "matrix-synapse-worker-media-repository-{{ item }}"
type: 'media_repository'
app: 'media_repository'
webserving: true
port: "{{ matrix_synapse_workers_media_repository_workers_port_range_start + item }}"
metrics_port: "{{ matrix_synapse_workers_media_repository_workers_metrics_range_start + item }}"
register: "matrix_synapse_workers_list_results_media_repository_workers"
loop: "{{ range(0, matrix_synapse_workers_media_repository_workers_count | int) | list }}"
- ansible.builtin.set_fact:
matrix_synapse_dynamic_workers_list: "{{ matrix_synapse_dynamic_workers_list | default([]) + [item.ansible_facts.worker] }}"
with_items: |
{{
matrix_synapse_workers_list_results_generic_workers.results
+
matrix_synapse_workers_list_results_stream_writer_workers.results
+
matrix_synapse_workers_list_results_federation_sender_workers.results
+
matrix_synapse_workers_list_results_pusher_workers.results
+
matrix_synapse_workers_list_results_appservice_workers.results
+
matrix_synapse_workers_list_results_user_dir_workers.results
+
matrix_synapse_workers_list_results_media_repository_workers.results
+
matrix_synapse_workers_list_results_background_workers.results
}}
- ansible.builtin.set_fact:
matrix_synapse_workers_enabled_list: "{{ matrix_synapse_dynamic_workers_list }}"

21
roles/custom/matrix-synapse/tasks/synapse/workers/setup.yml Normal file
View File

@ -0,0 +1,21 @@
---
# A previous version of the worker setup used this.
# This is a temporary cleanup for people who ran that version.
- name: Ensure old matrix-synapse.service.wants directory is gone
ansible.builtin.file:
path: "{{ matrix_systemd_path }}/matrix-synapse.service.wants"
state: absent
# Same. This was part of a previous version of the worker setup.
# No longer necessary.
- name: Ensure matrix-synapse-worker-write-pid script is removed
ansible.builtin.file:
path: "{{ matrix_local_bin_path }}/matrix-synapse-worker-write-pid"
state: absent
- ansible.builtin.include_tasks: "{{ role_path }}/tasks/synapse/workers/setup_install.yml"
when: "matrix_synapse_enabled | bool and matrix_synapse_workers_enabled | bool"
- ansible.builtin.include_tasks: "{{ role_path }}/tasks/synapse/workers/setup_uninstall.yml"
when: "not matrix_synapse_workers_enabled | bool"

42
roles/custom/matrix-synapse/tasks/synapse/workers/setup_install.yml Normal file
View File

@ -0,0 +1,42 @@
---
- name: Determine current worker configs
ansible.builtin.find:
path: "{{ matrix_synapse_config_dir_path }}"
patterns: "worker.*.yaml"
use_regex: true
register: matrix_synapse_workers_current_config_files
# This also deletes some things which we need. They will be recreated below.
- name: Ensure previous worker configs are cleaned
ansible.builtin.file:
path: "{{ item.path }}"
state: absent
with_items: "{{ matrix_synapse_workers_current_config_files.files }}"
- name: Determine current worker systemd services
ansible.builtin.find:
path: "{{ matrix_systemd_path }}"
patterns: "matrix-synapse-worker.*.service"
use_regex: true
register: matrix_synapse_workers_current_systemd_services
- name: Ensure unnecessary worker systemd services are stopped and disabled
ansible.builtin.service:
name: "{{ item.path | basename }}"
state: stopped
enabled: false
with_items: "{{ matrix_synapse_workers_current_systemd_services.files }}"
when: "not ansible_check_mode and item.path | basename not in matrix_systemd_services_list"
- name: Ensure unnecessary worker systemd services are cleaned
ansible.builtin.file:
path: "{{ item.path }}"
state: absent
with_items: "{{ matrix_synapse_workers_current_systemd_services.files }}"
- name: Ensure creation of worker systemd service files and configuration files
ansible.builtin.include_tasks: "{{ role_path }}/tasks/synapse/workers/util/setup_files_for_worker.yml"
with_items: "{{ matrix_synapse_workers_enabled_list }}"
loop_control:
loop_var: matrix_synapse_worker_details

37
roles/custom/matrix-synapse/tasks/synapse/workers/setup_uninstall.yml Normal file
View File

@ -0,0 +1,37 @@
---
- name: Populate service facts
ansible.builtin.service_facts:
- name: Ensure any worker services are stopped
ansible.builtin.service:
name: "{{ item.key }}"
state: stopped
with_dict: "{{ ansible_facts.services | default({}) | dict2items | selectattr('key', 'match', 'matrix-synapse-worker-.+\\.service') | list | items2dict }}"
when: "item.value['status'] != 'not-found'" # see https://github.com/spantaleev/matrix-docker-ansible-deploy/issues/1461
- name: Find worker configs to be cleaned
ansible.builtin.find:
path: "{{ matrix_synapse_config_dir_path }}"
patterns: "worker.*.yaml"
use_regex: true
register: matrix_synapse_workers_current_config_files
- name: Ensure previous worker configs are cleaned
ansible.builtin.file:
path: "{{ item.path }}"
state: absent
with_items: "{{ matrix_synapse_workers_current_config_files.files }}"
- name: Find worker systemd services to be cleaned
ansible.builtin.find:
path: "{{ matrix_systemd_path }}"
patterns: "matrix-synapse-worker.*.service"
use_regex: true
register: matrix_synapse_workers_current_systemd_services
- name: Ensure previous worker systemd services are cleaned
ansible.builtin.file:
path: "{{ item.path }}"
state: absent
with_items: "{{ matrix_synapse_workers_current_systemd_services.files }}"

65
roles/custom/matrix-synapse/tasks/synapse/workers/util/inject_worker.yml Normal file
View File

@ -0,0 +1,65 @@
---
# The tasks below run before `validate_config.yml`.
# To avoid failing with a cryptic error message, we'll do validation here.
#
# This check is mostly relevant to people who explicitly define `matrix_synapse_workers_enabled_list`
# (Synapse Workers users from the earlier days of this PR - https://github.com/spantaleev/matrix-docker-ansible-deploy/pull/456).
#
# In the future, it should be possible to remove this check.
# Our own code which dynamically builds `matrix_synapse_workers_enabled_list` does things right.
- name: Fail if required property not defined for worker
ansible.builtin.fail:
msg: "Synapse workers (like {{ matrix_synapse_worker_details | to_json }}) need to define a `{{ item }}` property"
with_items:
- id
- name
- type
- app
- port
- webserving
when: "item not in matrix_synapse_worker_details"
# Names are used for container names and systemd services.
# Routing happens based on container names, so Synapse processes that try to route to workers with underscores in the name will complain. Example:
# > InvalidCodepoint Codepoint U+005F at position 46 of 'matrix-synapse-worker-stream-writer-3-account_data' not allowed
- name: Fail if worker name includes underscore
ansible.builtin.fail:
msg: "Unrecognized Synapse worker `name`: `{{ matrix_synapse_worker_details.name }}`. It must not include underscores"
when: "'_' in matrix_synapse_worker_details.name"
- name: Fail if worker type unknown
ansible.builtin.fail:
msg: "Unrecognized Synapse worker `type`: `{{ matrix_synapse_worker_details.type }}`. Supported types are: {{ matrix_synapse_known_worker_types | join(', ') }}"
when: "matrix_synapse_worker_details.type not in matrix_synapse_known_worker_types"
- name: Fail if worker app unknown
ansible.builtin.fail:
msg: "Unrecognized Synapse worker `app`: `{{ matrix_synapse_worker_details.app }}`. Supported types are: {{ matrix_synapse_workers_avail_list | join(', ') }}"
when: "matrix_synapse_worker_details.app not in matrix_synapse_workers_avail_list"
- when: "matrix_synapse_worker_details.type == 'stream_writer'"
block:
- name: Fail if stream_writer_stream not defined for stream_writer worker
ansible.builtin.fail:
msg: >-
Synapse stream_writer workers (such as {{ item }}) need to define a valid `stream_writer_stream` property
(not `{{ matrix_synapse_worker_details.stream_writer_stream | default('undefined') }}`).
Supported types are: {{ matrix_synapse_workers_known_stream_writer_stream_types | join(', ') }}
when: "'stream_writer_stream' not in matrix_synapse_worker_details or matrix_synapse_worker_details.stream_writer_stream not in matrix_synapse_workers_known_stream_writer_stream_types"
- name: Fail if replication_port not defined for stream_writer worker
ansible.builtin.fail:
msg: "Synapse background workers of type stream_writer (such as {{ item }}) need to define a valid `replication_port` property"
when: "'replication_port' not in matrix_synapse_worker_details"
- ansible.builtin.set_fact:
matrix_systemd_services_list: "{{ matrix_systemd_services_list + [matrix_synapse_worker_details.name + '.service'] }}"
- ansible.builtin.set_fact:
matrix_synapse_webserving_workers_systemd_services_list: "{{ matrix_synapse_webserving_workers_systemd_services_list + [matrix_synapse_worker_details.name + '.service'] }}"
when: matrix_synapse_worker_details.webserving | bool
# Inject stream writers into the instance map.
- ansible.builtin.set_fact:
matrix_synapse_instance_map: "{{ matrix_synapse_instance_map | combine({matrix_synapse_worker_details.name: {'host': matrix_synapse_worker_details.name, 'port': matrix_synapse_worker_details.replication_port}}) }}"
when: matrix_synapse_worker_details.type in matrix_synapse_known_instance_map_eligible_worker_types

20
roles/custom/matrix-synapse/tasks/synapse/workers/util/setup_files_for_worker.yml Normal file
View File

@ -0,0 +1,20 @@
---
- ansible.builtin.set_fact:
matrix_synapse_worker_systemd_service_name: "{{ matrix_synapse_worker_details.name }}"
matrix_synapse_worker_container_name: "{{ matrix_synapse_worker_details.name }}"
matrix_synapse_worker_config_file_name: "worker.{{ matrix_synapse_worker_details.name }}.yaml"
- name: Ensure configuration exists for {{ matrix_synapse_worker_systemd_service_name }}
ansible.builtin.template:
src: "{{ role_path }}/templates/synapse/worker.yaml.j2"
dest: "{{ matrix_synapse_config_dir_path }}/{{ matrix_synapse_worker_config_file_name }}"
mode: 0644
owner: "{{ matrix_user_username }}"
group: "{{ matrix_user_groupname }}"
- name: Ensure systemd service exists for {{ matrix_synapse_worker_systemd_service_name }}
ansible.builtin.template:
src: "{{ role_path }}/templates/synapse/systemd/matrix-synapse-worker.service.j2"
dest: "{{ matrix_systemd_path }}/{{ matrix_synapse_worker_systemd_service_name }}.service"
mode: 0644

46
roles/custom/matrix-synapse/tasks/update_user_password.yml Normal file
View File

@ -0,0 +1,46 @@
---
- name: Fail if playbook called incorrectly
ansible.builtin.fail:
msg: "The `username` variable needs to be provided to this playbook, via --extra-vars"
when: "username is not defined or username == '<your-username>'"
- name: Fail if playbook called incorrectly
ansible.builtin.fail:
msg: "The `password` variable needs to be provided to this playbook, via --extra-vars"
when: "password is not defined or password == '<your-password>'"
- name: Fail if not using matrix-postgres container
ansible.builtin.fail:
msg: "This command is working only when matrix-postgres container is being used"
when: "not matrix_postgres_enabled | bool"
- name: Ensure matrix-synapse is started
ansible.builtin.service:
name: matrix-synapse
state: started
daemon_reload: true
register: start_result
- name: Ensure matrix-postgres is started
ansible.builtin.service:
name: matrix-postgres
state: started
daemon_reload: true
register: postgres_start_result
- name: Wait a while, so that Matrix Synapse can manage to start
ansible.builtin.pause:
seconds: 7
when: "start_result.changed or postgres_start_result.changed"
- name: Generate password hash
ansible.builtin.shell: "{{ matrix_host_command_docker }} exec matrix-synapse /usr/local/bin/hash_password -c /data/homeserver.yaml -p {{ password | quote }}"
register: password_hash
changed_when: false
- name: Update user password hash
ansible.builtin.command: "{{ matrix_local_bin_path }}/matrix-postgres-update-user-password-hash {{ username | quote }} {{ password_hash.stdout | quote }}"
register: matrix_synapse_update_user_password_result
changed_when: matrix_synapse_update_user_password_result.rc == 0

70
roles/custom/matrix-synapse/tasks/validate_config.yml Normal file
View File

@ -0,0 +1,70 @@
---
- name: Fail if required Synapse settings not defined
ansible.builtin.fail:
msg: >-
You need to define a required configuration setting (`{{ item }}`) for using Synapse.
when: "vars[item] == ''"
with_items:
- "matrix_synapse_macaroon_secret_key"
- "matrix_synapse_database_host"
- "matrix_synapse_database_user"
- "matrix_synapse_database_password"
- "matrix_synapse_database_database"
- name: Fail if asking for more than 1 instance of single-instance workers
ansible.builtin.fail:
msg: >-
`{{ item }}` cannot be more than 1. This is a single-instance worker.
when: "vars[item] | int > 1"
with_items:
- "matrix_synapse_workers_appservice_workers_count"
- "matrix_synapse_workers_user_dir_workers_count"
- "matrix_synapse_workers_background_workers_count"
- "matrix_synapse_workers_stream_writer_typing_stream_workers_count"
- "matrix_synapse_workers_stream_writer_to_device_stream_workers_count"
- "matrix_synapse_workers_stream_writer_account_data_stream_workers_count"
- "matrix_synapse_workers_stream_writer_receipts_stream_workers_count"
- "matrix_synapse_workers_stream_writer_presence_stream_workers_count"
- name: (Deprecation) Catch and report renamed settings
ansible.builtin.fail:
msg: >-
Your configuration contains a variable, which now has a different name.
Please change your configuration to rename the variable (`{{ item.old }}` -> `{{ item.new }}`).
when: "item.old in vars"
with_items:
- {'old': 'matrix_synapse_email_riot_base_url', 'new': '<superseded by client_base_url>'}
- {'old': 'matrix_synapse_container_expose_api_port', 'new': '<superseded by matrix_synapse_container_federation_api_plain_host_bind_port>'}
- {'old': 'matrix_synapse_no_tls', 'new': '<removed>'}
- {'old': 'matrix_enable_room_list_search', 'new': 'matrix_synapse_enable_room_list_search'}
- {'old': 'matrix_alias_creation_rules', 'new': 'matrix_synapse_alias_creation_rules'}
- {'old': 'matrix_room_list_publication_rules', 'new': 'matrix_synapse_room_list_publication_rules'}
- {'old': 'matrix_synapse_rc_messages_per_second', 'new': '<per_second subkey of matrix_synapse_rc_message>'}
- {'old': 'matrix_synapse_rc_message_burst_count', 'new': '<burst_count subkey of matrix_synapse_rc_message>'}
- {'old': 'matrix_synapse_federation_rc_window_size', 'new': '<window_size subkey of matrix_synapse_rc_federation>'}
- {'old': 'matrix_synapse_federation_rc_sleep_limit', 'new': '<sleep_limit subkey of matrix_synapse_rc_federation>'}
- {'old': 'matrix_synapse_federation_rc_sleep_delay', 'new': '<sleep_delay subkey of matrix_synapse_rc_federation>'}
- {'old': 'matrix_synapse_federation_rc_reject_limit', 'new': '<reject_limit subkey of matrix_synapse_rc_federation>'}
- {'old': 'matrix_synapse_federation_rc_concurrent', 'new': '<concurrent subkey of matrix_synapse_rc_federation>'}
- {'old': 'matrix_synapse_container_expose_client_api_port', 'new': '<superseded by matrix_synapse_container_client_api_host_bind_port>'}
- {'old': 'matrix_synapse_container_expose_federation_api_port', 'new': '<superseded by matrix_synapse_container_federation_api_plain_host_bind_port>'}
- {'old': 'matrix_synapse_container_expose_metrics_port', 'new': '<superseded by matrix_synapse_container_metrics_api_host_bind_port>'}
- {'old': 'matrix_synapse_cache_factor', 'new': 'matrix_synapse_caches_global_factor'}
- {'old': 'matrix_synapse_trusted_third_party_id_servers', 'new': '<deprecated in Synapse v0.99.4 and removed in Synapse v1.19.0>'}
- {'old': 'matrix_synapse_use_presence', 'new': 'matrix_synapse_presence_enabled'}
- {'old': 'matrix_synapse_version_arm64', 'new': '<superseded by matrix_synapse_version - see https://github.com/matrix-org/synapse/pull/11810>'}
- {'old': 'matrix_synapse_enable_group_creation', 'new': '<removed in Synapse v1.61.0 - use the new Spaces feature instead>'}
- {'old': 'matrix_synapse_account_threepid_delegates_email', 'new': '<removed in Synapse v1.66.0 - make sure to configure email settings for Synapse - see https://matrix-org.github.io/synapse/v1.66/upgrade.html#delegation-of-email-validation-no-longer-supported>'}
- {'old': 'matrix_synapse_workers_frontend_proxy_workers_count', 'new': '<removed in favor of generic workers - see https://github.com/matrix-org/synapse/pull/13645>'}
- {'old': 'matrix_synapse_workers_frontend_proxy_workers_port_range_start', 'new': '<removed in favor of generic workers - see https://github.com/matrix-org/synapse/pull/13645>'}
- {'old': 'matrix_synapse_workers_frontend_proxy_workers_metrics_range_start', 'new': '<removed in favor of generic workers - see https://github.com/matrix-org/synapse/pull/13645>'}
- name: (Deprecation) Catch and report renamed settings in matrix_synapse_configuration_extension_yaml
ansible.builtin.fail:
msg: >-
Your matrix_synapse_configuration_extension_yaml configuration contains a variable, which now has a different name.
Please change your configuration to rename the variable (`{{ item.old }}` -> `{{ item.new }}`).
when: "item.old in matrix_synapse_configuration_extension"
with_items:
- {'old': 'federation_ip_range_blacklist', 'new': 'ip_range_blacklist'}