diff --git a/group_vars/matrix_servers b/group_vars/matrix_servers index 1e3c0e0f4..f396a4750 100755 --- a/group_vars/matrix_servers +++ b/group_vars/matrix_servers @@ -4174,7 +4174,7 @@ matrix_synapse_container_additional_networks: | ) | unique }} -matrix_synapse_container_labels_traefik_enabled: "{{ matrix_playbook_reverse_proxy_type in ['playbook-managed-traefik', 'other-traefik-container'] and not matrix_synapse_workers_enabled }}" +matrix_synapse_container_labels_traefik_enabled: "{{ matrix_playbook_reverse_proxy_type in ['playbook-managed-traefik', 'other-traefik-container'] }}" matrix_synapse_container_labels_traefik_docker_network: "{{ matrix_playbook_reverse_proxyable_services_additional_network }}" matrix_synapse_container_labels_traefik_entrypoints: "{{ devture_traefik_entrypoint_primary }}" matrix_synapse_container_labels_traefik_tls_certResolver: "{{ devture_traefik_certResolver_primary }}" @@ -4183,6 +4183,8 @@ matrix_synapse_container_labels_traefik_hostname: "{{ matrix_server_fqn_matrix } matrix_synapse_container_labels_client_root_redirection_enabled: "{{ matrix_synapse_container_labels_client_root_redirection_url != '' }}" matrix_synapse_container_labels_client_root_redirection_url: "{{ (('https://' if matrix_playbook_ssl_enabled else 'http://') + matrix_server_fqn_element) if matrix_client_element_enabled else '' }}" +matrix_synapse_container_labels_matrix_labels_enabled: "{{ not matrix_synapse_workers_enabled }}" + matrix_synapse_container_labels_client_synapse_admin_api_enabled: "{{ matrix_synapse_admin_enabled }}" matrix_synapse_container_labels_federation_api_traefik_entrypoints: "{{ matrix_federation_traefik_entrypoint }}" @@ -4343,8 +4345,6 @@ matrix_synapse_reverse_proxy_companion_container_labels_traefik_entrypoints: "{{ matrix_synapse_reverse_proxy_companion_container_labels_traefik_tls_certResolver: "{{ devture_traefik_certResolver_primary }}" matrix_synapse_reverse_proxy_companion_container_labels_traefik_hostname: "{{ matrix_server_fqn_matrix }}" -matrix_synapse_reverse_proxy_companion_container_labels_client_root_redirection_enabled: "{{ matrix_synapse_container_labels_client_root_redirection_enabled != '' }}" -matrix_synapse_reverse_proxy_companion_container_labels_client_root_redirection_url: "{{ matrix_synapse_container_labels_client_root_redirection_url }}" matrix_synapse_reverse_proxy_companion_container_labels_client_synapse_client_api_enabled: "{{ matrix_synapse_container_labels_client_synapse_client_api_enabled }}" matrix_synapse_reverse_proxy_companion_container_labels_client_synapse_oidc_api_enabled: "{{ matrix_synapse_container_labels_client_synapse_oidc_api_enabled }}" matrix_synapse_reverse_proxy_companion_container_labels_client_synapse_admin_api_enabled: "{{ matrix_synapse_container_labels_client_synapse_admin_api_enabled }}" diff --git a/roles/custom/matrix-synapse-reverse-proxy-companion/defaults/main.yml b/roles/custom/matrix-synapse-reverse-proxy-companion/defaults/main.yml index 29d07a9da..d39817cef 100644 --- a/roles/custom/matrix-synapse-reverse-proxy-companion/defaults/main.yml +++ b/roles/custom/matrix-synapse-reverse-proxy-companion/defaults/main.yml @@ -61,17 +61,6 @@ matrix_synapse_reverse_proxy_companion_container_labels_traefik_entrypoints: web matrix_synapse_reverse_proxy_companion_container_labels_traefik_tls_certResolver: default # noqa var-naming matrix_synapse_reverse_proxy_companion_container_labels_traefik_hostname: '' -# Controls whether labels will be added for handling the root (/) path -matrix_synapse_reverse_proxy_companion_container_labels_client_root_enabled: true -matrix_synapse_reverse_proxy_companion_container_labels_client_root_traefik_hostname: "{{ matrix_synapse_reverse_proxy_companion_container_labels_traefik_hostname }}" -matrix_synapse_reverse_proxy_companion_container_labels_client_root_traefik_rule: "Host(`{{ matrix_synapse_reverse_proxy_companion_container_labels_client_root_traefik_hostname }}`) && Path(`/`)" -matrix_synapse_reverse_proxy_companion_container_labels_client_root_traefik_priority: 0 -matrix_synapse_reverse_proxy_companion_container_labels_client_root_traefik_entrypoints: "{{ matrix_synapse_reverse_proxy_companion_container_labels_traefik_entrypoints }}" -matrix_synapse_reverse_proxy_companion_container_labels_client_root_traefik_tls: "{{ matrix_synapse_reverse_proxy_companion_container_labels_client_root_traefik_entrypoints != 'web' }}" -matrix_synapse_reverse_proxy_companion_container_labels_client_root_traefik_tls_certResolver: "{{ matrix_synapse_reverse_proxy_companion_container_labels_traefik_tls_certResolver }}" # noqa var-naming -matrix_synapse_reverse_proxy_companion_container_labels_client_root_redirection_enabled: false -matrix_synapse_reverse_proxy_companion_container_labels_client_root_redirection_url: "" - # Controls whether labels will be added that expose the Client-Server API. matrix_synapse_reverse_proxy_companion_container_labels_client_api_enabled: true matrix_synapse_reverse_proxy_companion_container_labels_client_api_traefik_hostname: "{{ matrix_synapse_reverse_proxy_companion_container_labels_traefik_hostname }}" diff --git a/roles/custom/matrix-synapse-reverse-proxy-companion/tasks/validate_config.yml b/roles/custom/matrix-synapse-reverse-proxy-companion/tasks/validate_config.yml index 2612de86b..5b5ac0b72 100644 --- a/roles/custom/matrix-synapse-reverse-proxy-companion/tasks/validate_config.yml +++ b/roles/custom/matrix-synapse-reverse-proxy-companion/tasks/validate_config.yml @@ -8,9 +8,6 @@ with_items: - {'name': 'matrix_synapse_reverse_proxy_companion_container_network', when: true} - - {'name': 'matrix_synapse_reverse_proxy_companion_container_labels_client_root_traefik_hostname', when: "{{ matrix_synapse_reverse_proxy_companion_container_labels_client_root_enabled }}"} - - {'name': 'matrix_synapse_reverse_proxy_companion_container_labels_client_root_redirection_url', when: "{{ matrix_synapse_reverse_proxy_companion_container_labels_client_root_redirection_enabled }}"} - - {'name': 'matrix_synapse_reverse_proxy_companion_container_labels_client_api_traefik_hostname', when: "{{ matrix_synapse_reverse_proxy_companion_container_labels_client_api_enabled }}"} - {'name': 'matrix_synapse_reverse_proxy_companion_container_labels_client_synapse_client_api_traefik_hostname', when: "{{ matrix_synapse_reverse_proxy_companion_container_labels_client_synapse_client_api_enabled }}"} diff --git a/roles/custom/matrix-synapse-reverse-proxy-companion/templates/labels.j2 b/roles/custom/matrix-synapse-reverse-proxy-companion/templates/labels.j2 index 2985fc40c..aeb837539 100644 --- a/roles/custom/matrix-synapse-reverse-proxy-companion/templates/labels.j2 +++ b/roles/custom/matrix-synapse-reverse-proxy-companion/templates/labels.j2 @@ -9,44 +9,6 @@ traefik.http.services.matrix-synapse-reverse-proxy-companion-client-api.loadbala traefik.http.services.matrix-synapse-reverse-proxy-companion-federation-api.loadbalancer.server.port=8048 -{# - Root path (/) -#} -{% if matrix_synapse_reverse_proxy_companion_container_labels_client_root_enabled %} - -{% set client_root_middlewares = [] %} - -{% if matrix_synapse_reverse_proxy_companion_container_labels_client_root_redirection_enabled %} -{% set client_root_middlewares = client_root_middlewares + ['matrix-synapse-reverse-proxy-companion-client-root-redirect'] %} -traefik.http.middlewares.matrix-synapse-reverse-proxy-companion-client-root-redirect.redirectregex.regex=(.*) -traefik.http.middlewares.matrix-synapse-reverse-proxy-companion-client-root-redirect.redirectregex.replacement={{ matrix_synapse_reverse_proxy_companion_container_labels_client_root_redirection_url }} -{% else %} -{% set client_root_middlewares = client_root_middlewares + ['matrix-synapse-reverse-proxy-companion-client-root-replacepath'] %} -traefik.http.middlewares.matrix-synapse-reverse-proxy-companion-client-root-replacepath.replacepath.path=/_matrix/static/ -{% endif %} - -traefik.http.routers.matrix-synapse-reverse-proxy-companion-client-root.rule={{ matrix_synapse_reverse_proxy_companion_container_labels_client_root_traefik_rule }} - -traefik.http.routers.matrix-synapse-reverse-proxy-companion-client-root.middlewares={{ client_root_middlewares | join(',') }} - -{% if matrix_synapse_reverse_proxy_companion_container_labels_client_root_traefik_priority | int > 0 %} -traefik.http.routers.matrix-synapse-reverse-proxy-companion-client-root.priority={{ matrix_synapse_reverse_proxy_companion_container_labels_client_root_traefik_priority }} -{% endif %} - -traefik.http.routers.matrix-synapse-reverse-proxy-companion-client-root.service=matrix-synapse-reverse-proxy-companion-client-api -traefik.http.routers.matrix-synapse-reverse-proxy-companion-client-root.entrypoints={{ matrix_synapse_reverse_proxy_companion_container_labels_client_root_traefik_entrypoints }} -traefik.http.routers.matrix-synapse-reverse-proxy-companion-client-root.tls={{ matrix_synapse_reverse_proxy_companion_container_labels_client_root_traefik_tls | to_json }} - -{% if matrix_synapse_reverse_proxy_companion_container_labels_client_root_traefik_tls %} -traefik.http.routers.matrix-synapse-reverse-proxy-companion-client-root.tls.certResolver={{ matrix_synapse_reverse_proxy_companion_container_labels_client_root_traefik_tls_certResolver }} -{% endif %} - -{% endif %} -{# - /Root path (/) -#} - - {# Client-API (/_matrix) #} diff --git a/roles/custom/matrix-synapse/defaults/main.yml b/roles/custom/matrix-synapse/defaults/main.yml index e396ef928..62fef5bfd 100644 --- a/roles/custom/matrix-synapse/defaults/main.yml +++ b/roles/custom/matrix-synapse/defaults/main.yml @@ -156,7 +156,7 @@ matrix_synapse_container_metrics_api_host_bind_port: '' # Takes an ":" or "" value (e.g. "127.0.0.1:9100"), or empty string to not expose. matrix_synapse_container_manhole_api_host_bind_port: '' -# matrix_synapse_container_labels_traefik_enabled controls whether labels to assist a Traefik reverse-proxy will be attached to the container. +# matrix_synapse_container_labels_traefik_enabled controls whether labels to assist a Traefik reverse-proxy will be attached to the main Synapse worker. # See `../templates/labels.j2` for details. # # To inject your own other container labels, see `matrix_synapse_container_labels_additional_labels`. @@ -166,7 +166,19 @@ matrix_synapse_container_labels_traefik_entrypoints: web-secure matrix_synapse_container_labels_traefik_tls_certResolver: default # noqa var-naming matrix_synapse_container_labels_traefik_hostname: '' -# Controls whether labels will be added for handling the root (/) path +# Controls whether Matrix-related labels will be added. +# +# When set to false, variables like the following take no effect: +# - `matrix_synapse_container_labels_client_api_enabled` +# - `matrix_synapse_container_labels_client_synapse_client_api_enabled` +# - `matrix_synapse_container_labels_client_synapse_oidc_api_enabled` +# - `matrix_synapse_container_labels_client_synapse_admin_api_enabled` +# - `matrix_synapse_container_labels_federation_api_enabled` +# +# When workers are enabled, we do not capture these requests, because we can't route them appropriately. +matrix_synapse_container_labels_matrix_related_labels_enabled: "{{ not matrix_synapse_workers_enabled }}" + +# Controls whether labels will be added for handling the root (/) path. matrix_synapse_container_labels_client_root_enabled: true matrix_synapse_container_labels_client_root_traefik_hostname: "{{ matrix_synapse_container_labels_traefik_hostname }}" matrix_synapse_container_labels_client_root_traefik_rule: "Host(`{{ matrix_synapse_container_labels_client_root_traefik_hostname }}`) && Path(`/`)" @@ -178,6 +190,8 @@ matrix_synapse_container_labels_client_root_redirection_enabled: false matrix_synapse_container_labels_client_root_redirection_url: "" # Controls whether labels will be added that expose the Client-Server API. +# Regardless of whether this is enabled, it may or may not take effect due to the value of other variables. +# See `matrix_synapse_container_labels_traefik_enabled` or `matrix_synapse_container_labels_matrix_related_labels_enabled` matrix_synapse_container_labels_client_api_enabled: true matrix_synapse_container_labels_client_api_traefik_hostname: "{{ matrix_synapse_container_labels_traefik_hostname }}" matrix_synapse_container_labels_client_api_traefik_path_prefix: /_matrix @@ -188,6 +202,9 @@ matrix_synapse_container_labels_client_api_traefik_tls: "{{ matrix_synapse_conta matrix_synapse_container_labels_client_api_traefik_tls_certResolver: "{{ matrix_synapse_container_labels_traefik_tls_certResolver }}" # noqa var-naming # Controls whether labels will be added that expose the /_synapse/client paths +# When workers are enabled, we do not capture these requests, because they may be load-balanaced to some specific worker. +# Regardless of whether this is enabled, it may or may not take effect due to the value of other variables. +# See `matrix_synapse_container_labels_traefik_enabled` or `matrix_synapse_container_labels_matrix_related_labels_enabled` matrix_synapse_container_labels_client_synapse_client_api_enabled: true matrix_synapse_container_labels_client_synapse_client_api_traefik_hostname: "{{ matrix_synapse_container_labels_traefik_hostname }}" matrix_synapse_container_labels_client_synapse_client_api_traefik_path_prefix: /_synapse/client @@ -199,6 +216,8 @@ matrix_synapse_container_labels_client_synapse_client_api_traefik_tls_certResolv # Controls whether labels will be added that expose the /_synapse/oidc paths # Enable this if you need OpenID Connect authentication support. +# Regardless of whether this is enabled, it may or may not take effect due to the value of other variables. +# See `matrix_synapse_container_labels_traefik_enabled` or `matrix_synapse_container_labels_matrix_related_labels_enabled` matrix_synapse_container_labels_client_synapse_oidc_api_enabled: false matrix_synapse_container_labels_client_synapse_oidc_api_traefik_hostname: "{{ matrix_synapse_container_labels_traefik_hostname }}" matrix_synapse_container_labels_client_synapse_oidc_api_traefik_path_prefix: /_synapse/oidc @@ -210,6 +229,8 @@ matrix_synapse_container_labels_client_synapse_oidc_api_traefik_tls_certResolver # Controls whether labels will be added that expose the /_synapse/admin paths # Following these recommendations (https://github.com/matrix-org/synapse/blob/master/docs/reverse_proxy.md), by default, we don't. +# Regardless of whether this is enabled, it may or may not take effect due to the value of other variables. +# See `matrix_synapse_container_labels_traefik_enabled` or `matrix_synapse_container_labels_matrix_related_labels_enabled` matrix_synapse_container_labels_client_synapse_admin_api_enabled: false matrix_synapse_container_labels_client_synapse_admin_api_traefik_hostname: "{{ matrix_synapse_container_labels_traefik_hostname }}" matrix_synapse_container_labels_client_synapse_admin_api_traefik_path_prefix: /_synapse/admin @@ -220,7 +241,9 @@ matrix_synapse_container_labels_client_synapse_admin_api_traefik_tls: "{{ matrix matrix_synapse_container_labels_client_synapse_admin_api_traefik_tls_certResolver: "{{ matrix_synapse_container_labels_traefik_tls_certResolver }}" # noqa var-naming # Controls whether labels will be added that expose the Server-Server API (Federation API). -matrix_synapse_container_labels_federation_api_enabled: "{{ matrix_synapse_federation_enabled }}" +# Regardless of whether this is enabled, it may or may not take effect due to the value of other variables. +# See `matrix_synapse_container_labels_traefik_enabled` or `matrix_synapse_container_labels_matrix_related_labels_enabled` +matrix_synapse_container_labels_federation_api_enabled: "{{ matrix_synapse_federation_enabled and not matrix_synapse_workers_enabled }}" matrix_synapse_container_labels_federation_api_traefik_hostname: "{{ matrix_synapse_container_labels_traefik_hostname }}" matrix_synapse_container_labels_federation_api_traefik_path_prefix: /_matrix matrix_synapse_container_labels_federation_api_traefik_rule: "Host(`{{ matrix_synapse_container_labels_federation_api_traefik_hostname }}`) && PathPrefix(`{{ matrix_synapse_container_labels_federation_api_traefik_path_prefix }}`)" @@ -229,7 +252,7 @@ matrix_synapse_container_labels_federation_api_traefik_entrypoints: '' matrix_synapse_container_labels_federation_api_traefik_tls: "{{ matrix_synapse_container_labels_federation_api_traefik_entrypoints != 'web' }}" matrix_synapse_container_labels_federation_api_traefik_tls_certResolver: "{{ matrix_synapse_container_labels_traefik_tls_certResolver }}" # noqa var-naming -# Controls whether labels will be added that expose metrics (see `matrix_synapse_metrics_proxying_enabled`) +# Controls whether labels will be added that expose metrics (see `matrix_synapse_metrics_proxying_enabled`) for the main Synapse process matrix_synapse_container_labels_metrics_enabled: "{{ matrix_synapse_metrics_enabled and matrix_synapse_metrics_proxying_enabled }}" matrix_synapse_container_labels_metrics_traefik_path: "{{ matrix_synapse_metrics_proxying_path_prefix }}/main-process" matrix_synapse_container_labels_metrics_traefik_rule: "Host(`{{ matrix_synapse_metrics_proxying_hostname }}`) && Path(`{{ matrix_synapse_container_labels_metrics_traefik_path }}`)" @@ -667,6 +690,38 @@ matrix_synapse_workers_presets: # It takes "*" to signify "bind on all interfaces" ("0.0.0.0" is IPv4-only). matrix_synapse_workers_container_host_bind_address: '' +# matrix_synapse_worker_container_labels_traefik_enabled controls whether labels to assist a Traefik reverse-proxy will be attached to Synapse worker containers. +# See `../templates/worker-labels.j2` for details. +# +# To inject your own other container labels, see `matrix_synapse_worker_container_labels_additional_labels`. +matrix_synapse_worker_container_labels_traefik_enabled: true +matrix_synapse_worker_container_labels_traefik_docker_network: "{{ matrix_synapse_container_labels_traefik_docker_network }}" +matrix_synapse_worker_container_labels_traefik_entrypoints: "{{ matrix_synapse_container_labels_traefik_entrypoints }}" +matrix_synapse_worker_container_labels_traefik_tls_certResolver: "{{ matrix_synapse_container_labels_traefik_tls_certResolver }}" # noqa var-naming +matrix_synapse_worker_container_labels_traefik_hostname: "{{ matrix_synapse_container_labels_traefik_hostname }}" + +# Controls whether labels will be added that expose metrics (see `matrix_synapse_metrics_proxying_enabled`) +matrix_synapse_worker_container_labels_metrics_enabled: "{{ matrix_synapse_metrics_enabled and matrix_synapse_metrics_proxying_enabled }}" +# The `__WORKER_ID__` placeholder will be replaced with the actual worker id during label-file generation (see `../templates/worker-labels.j2`). +matrix_synapse_worker_container_labels_metrics_traefik_path: "{{ matrix_synapse_metrics_proxying_path_prefix }}/__WORKER_ID__" +matrix_synapse_worker_container_labels_metrics_traefik_rule: "Host(`{{ matrix_synapse_metrics_proxying_hostname }}`) && Path(`{{ matrix_synapse_worker_container_labels_metrics_traefik_path }}`)" +matrix_synapse_worker_container_labels_metrics_traefik_priority: 0 +matrix_synapse_worker_container_labels_metrics_traefik_entrypoints: "{{ matrix_synapse_container_labels_traefik_entrypoints }}" +matrix_synapse_worker_container_labels_metrics_traefik_tls: "{{ matrix_synapse_container_labels_metrics_traefik_entrypoints != 'web' }}" +matrix_synapse_worker_container_labels_metrics_traefik_tls_certResolver: "{{ matrix_synapse_container_labels_traefik_tls_certResolver }}" # noqa var-naming +matrix_synapse_worker_container_labels_metrics_middleware_basic_auth_enabled: "{{ matrix_synapse_container_labels_metrics_middleware_basic_auth_enabled }}" +# See: https://doc.traefik.io/traefik/middlewares/http/basicauth/#users +matrix_synapse_worker_container_labels_metrics_middleware_basic_auth_users: "{{ matrix_synapse_container_labels_metrics_middleware_basic_auth_users }}" + +# matrix_synapse_worker_container_labels_additional_labels contains a multiline string with additional labels to add to the label files for Synapse worker containers. +# See `../templates/labels.j2` for details. +# +# Example: +# matrix_synapse_worker_container_labels_additional_labels: | +# my.label=1 +# another.label="here" +matrix_synapse_worker_container_labels_additional_labels: '' + matrix_synapse_workers_generic_workers_count: "{{ matrix_synapse_workers_presets[matrix_synapse_workers_preset]['generic_workers_count'] }}" matrix_synapse_workers_generic_workers_port_range_start: 18111 matrix_synapse_workers_generic_workers_metrics_range_start: 19111 diff --git a/roles/custom/matrix-synapse/tasks/synapse/workers/setup_install.yml b/roles/custom/matrix-synapse/tasks/synapse/workers/setup_install.yml index 85ddf3b94..b474be92a 100644 --- a/roles/custom/matrix-synapse/tasks/synapse/workers/setup_install.yml +++ b/roles/custom/matrix-synapse/tasks/synapse/workers/setup_install.yml @@ -40,6 +40,20 @@ with_items: "{{ matrix_synapse_workers_current_systemd_services.files }}" when: "not ansible_check_mode and (item.path | basename | replace('.service', '')) not in matrix_synapse_enabled_worker_names" +- name: Determine current worker label files + ansible.builtin.find: + path: "{{ matrix_synapse_base_path }}" + patterns: "worker.*.labels" + use_regex: true + register: matrix_synapse_workers_current_label_files + +- name: Ensure unnecessary worker labels are cleaned + ansible.builtin.file: + path: "{{ item.path }}" + state: absent + with_items: "{{ matrix_synapse_workers_current_label_files.files }}" + when: "not ansible_check_mode and (item.path | basename | replace ('worker.', '') | replace('.labels', '')) not in matrix_synapse_enabled_worker_names" + - name: Ensure creation of worker systemd service files and configuration files ansible.builtin.include_tasks: "{{ role_path }}/tasks/synapse/workers/util/setup_files_for_worker.yml" with_items: "{{ matrix_synapse_workers_enabled_list }}" diff --git a/roles/custom/matrix-synapse/tasks/synapse/workers/util/setup_files_for_worker.yml b/roles/custom/matrix-synapse/tasks/synapse/workers/util/setup_files_for_worker.yml index d35094129..5b652c475 100644 --- a/roles/custom/matrix-synapse/tasks/synapse/workers/util/setup_files_for_worker.yml +++ b/roles/custom/matrix-synapse/tasks/synapse/workers/util/setup_files_for_worker.yml @@ -4,6 +4,7 @@ matrix_synapse_worker_systemd_service_name: "{{ matrix_synapse_worker_details.name }}" matrix_synapse_worker_container_name: "{{ matrix_synapse_worker_details.name }}" matrix_synapse_worker_config_file_name: "worker.{{ matrix_synapse_worker_details.name }}.yaml" + matrix_synapse_worker_labels_file_name: "worker.{{ matrix_synapse_worker_details.name }}.labels" - name: Ensure configuration exists for {{ matrix_synapse_worker_systemd_service_name }} ansible.builtin.template: @@ -13,6 +14,14 @@ owner: "{{ matrix_synapse_uid }}" group: "{{ matrix_synapse_gid }}" +- name: Ensure labels exists for {{ matrix_synapse_worker_systemd_service_name }} + ansible.builtin.template: + src: "{{ role_path }}/templates/synapse/worker-labels.j2" + dest: "{{ matrix_synapse_base_path }}/{{ matrix_synapse_worker_labels_file_name }}" + mode: 0644 + owner: "{{ matrix_synapse_uid }}" + group: "{{ matrix_synapse_gid }}" + - name: Ensure systemd service exists for {{ matrix_synapse_worker_systemd_service_name }} ansible.builtin.template: src: "{{ role_path }}/templates/synapse/systemd/matrix-synapse-worker.service.j2" diff --git a/roles/custom/matrix-synapse/templates/synapse/labels.j2 b/roles/custom/matrix-synapse/templates/synapse/labels.j2 index 629edfb8b..8f899b200 100644 --- a/roles/custom/matrix-synapse/templates/synapse/labels.j2 +++ b/roles/custom/matrix-synapse/templates/synapse/labels.j2 @@ -48,6 +48,16 @@ traefik.http.routers.matrix-synapse-client-root.tls.certResolver={{ matrix_synap #} +{# +######################################################################### +# # +# Matrix-related labels # +# See: `matrix_synapse_container_labels_matrix_related_labels_enabled` # +# # +######################################################################### +#} +{% if matrix_synapse_container_labels_matrix_related_labels_enabled %} + {# Client-API (/_matrix) #} @@ -172,6 +182,17 @@ traefik.http.routers.matrix-synapse-federation-api.tls.certResolver={{ matrix_sy /Federation-API (/_matrix) #} +{# +######################################################################### +# # +# /Matrix-related labels # +# See: `matrix_synapse_container_labels_matrix_related_labels_enabled` # +# # +######################################################################### +#} +{% endif %} + + {# Metrics (e.g. /metrics/synapse/main-process) #} @@ -205,11 +226,6 @@ traefik.http.routers.matrix-synapse-metrics.tls={{ matrix_synapse_container_labe traefik.http.routers.matrix-synapse-metrics.tls.certResolver={{ matrix_synapse_container_labels_metrics_traefik_tls_certResolver }} {% endif %} -{% if matrix_synapse_container_labels_metrics_middleware_basic_auth_enabled %} -traefik.http.routers.matrix-synapse-metrics.middlewares=matrix-synapse-metrics-basic-auth -traefik.http.middlewares.matrix-synapse-metrics-basic-auth.basicauth.users={{ matrix_synapse_container_labels_metrics_middleware_basic_auth_users }} -{% endif %} - {% endif %} {# /Metrics (e.g. /metrics/synapse/main-process) diff --git a/roles/custom/matrix-synapse/templates/synapse/systemd/matrix-synapse-worker.service.j2 b/roles/custom/matrix-synapse/templates/synapse/systemd/matrix-synapse-worker.service.j2 index 5b5133ffc..90abaa312 100644 --- a/roles/custom/matrix-synapse/templates/synapse/systemd/matrix-synapse-worker.service.j2 +++ b/roles/custom/matrix-synapse/templates/synapse/systemd/matrix-synapse-worker.service.j2 @@ -42,6 +42,7 @@ ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} create \ {% for volume in matrix_synapse_container_additional_volumes %} --mount type={{ volume.type | default('bind' if '/' in volume.src else 'volume') }},src={{ volume.src }},dst={{ volume.dst }}{{ (',' + volume.options) if volume.options else '' }} \ {% endfor %} + --label-file={{ matrix_synapse_base_path }}/{{ matrix_synapse_worker_labels_file_name }} \ {% for arg in matrix_synapse_container_arguments %} {{ arg }} \ {% endfor %} diff --git a/roles/custom/matrix-synapse/templates/synapse/worker-labels.j2 b/roles/custom/matrix-synapse/templates/synapse/worker-labels.j2 new file mode 100644 index 000000000..aa885701f --- /dev/null +++ b/roles/custom/matrix-synapse/templates/synapse/worker-labels.j2 @@ -0,0 +1,51 @@ +{% if matrix_synapse_worker_container_labels_traefik_enabled %} +traefik.enable=true + +{% if matrix_synapse_worker_container_labels_traefik_docker_network %} +traefik.docker.network={{ matrix_synapse_worker_container_labels_traefik_docker_network }} +{% endif %} + +traefik.http.services.{{ matrix_synapse_worker_container_name }}-metrics.loadbalancer.server.port={{ matrix_synapse_worker_details.metrics_port }} + +{# + Metrics (e.g. /metrics/synapse/__WORKER_ID__) +#} +{% if matrix_synapse_worker_container_labels_metrics_enabled %} + +{% set metrics_middlewares = [] %} + +{% if matrix_synapse_worker_container_labels_metrics_middleware_basic_auth_enabled %} +{% set metrics_middlewares = metrics_middlewares + [matrix_synapse_worker_container_name + '-metrics-basic-auth'] %} +traefik.http.middlewares.{{ matrix_synapse_worker_container_name }}-metrics-basic-auth.basicauth.users={{ matrix_synapse_worker_container_labels_metrics_middleware_basic_auth_users }} +{% endif %} + +{% set metrics_middlewares = metrics_middlewares + [matrix_synapse_worker_container_name + '-metrics-replacepath'] %} +traefik.http.middlewares.{{ matrix_synapse_worker_container_name }}-metrics-replacepath.replacepath.path=/_synapse/metrics + +traefik.http.routers.{{ matrix_synapse_worker_container_name }}-metrics.rule={{ matrix_synapse_worker_container_labels_metrics_traefik_rule | replace('__WORKER_ID__', matrix_synapse_worker_details.id) }} + +{% if metrics_middlewares | length > 0 %} +traefik.http.routers.{{ matrix_synapse_worker_container_name }}-metrics.middlewares={{ metrics_middlewares | join(',') }} +{% endif %} + +{% if matrix_synapse_worker_container_labels_metrics_traefik_priority | int > 0 %} +traefik.http.routers.{{ matrix_synapse_worker_container_name }}-metrics.priority={{ matrix_synapse_worker_container_labels_metrics_traefik_priority }} +{% endif %} + +traefik.http.routers.{{ matrix_synapse_worker_container_name }}-metrics.service={{ matrix_synapse_worker_container_name }}-metrics +traefik.http.routers.{{ matrix_synapse_worker_container_name }}-metrics.entrypoints={{ matrix_synapse_worker_container_labels_metrics_traefik_entrypoints }} + +traefik.http.routers.{{ matrix_synapse_worker_container_name }}-metrics.tls={{ matrix_synapse_worker_container_labels_metrics_traefik_tls | to_json }} +{% if matrix_synapse_worker_container_labels_metrics_traefik_tls %} +traefik.http.routers.{{ matrix_synapse_worker_container_name }}-metrics.tls.certResolver={{ matrix_synapse_worker_container_labels_metrics_traefik_tls_certResolver }} +{% endif %} + +{% endif %} +{# + /Metrics (e.g. /metrics/synapse/__WORKER_ID__) +#} + + +{% endif %} + +{{ matrix_synapse_worker_container_labels_additional_labels }} diff --git a/roles/custom/matrix_playbook_migration/tasks/validate_config.yml b/roles/custom/matrix_playbook_migration/tasks/validate_config.yml index ec37a325e..fd481134b 100644 --- a/roles/custom/matrix_playbook_migration/tasks/validate_config.yml +++ b/roles/custom/matrix_playbook_migration/tasks/validate_config.yml @@ -90,7 +90,7 @@ - {'old': 'matrix_nginx_proxy_base_domain_create_directory', 'new': ''} - {'old': 'matrix_nginx_proxy_proxy_riot_compat_redirect_enabled', 'new': ''} - {'old': 'matrix_nginx_proxy_proxy_riot_compat_redirect_hostname', 'new': ''} - - {'old': 'matrix_nginx_proxy_proxy_matrix_client_redirect_root_uri_to_domain', 'new': ''} + - {'old': 'matrix_nginx_proxy_proxy_matrix_client_redirect_root_uri_to_domain', 'new': ''} - {'old': 'matrix_nginx_proxy_proxy_matrix_client_api_forwarded_location_synapse_client_api_enabled', 'new': 'matrix_synapse_container_labels_client_synapse_client_api_enabled'} - {'old': 'matrix_nginx_proxy_proxy_matrix_client_api_forwarded_location_synapse_oidc_api_enabled', 'new': 'matrix_synapse_container_labels_client_synapse_oidc_api_enabled'} - {'old': 'matrix_nginx_proxy_proxy_matrix_client_api_forwarded_location_synapse_admin_api_enabled', 'new': 'matrix_synapse_container_labels_client_synapse_admin_api_enabled'}