From 4639eebf12f89eed70732e2e993697a53e32bb0d Mon Sep 17 00:00:00 2001 From: Slavi Pantaleev Date: Thu, 11 Jan 2024 08:56:51 +0200 Subject: [PATCH] Add native Traefik support to matrix-conduit --- docs/configuring-playbook-conduit.md | 1 - group_vars/matrix_servers | 18 ++++ roles/custom/matrix-conduit/defaults/main.yml | 54 ++++++++++- .../matrix-conduit/tasks/setup_install.yml | 14 ++- .../templates/{conduit => }/conduit.toml.j2 | 0 .../custom/matrix-conduit/templates/labels.j2 | 97 +++++++++++++++++++ .../systemd/matrix-conduit.service.j2 | 1 + 7 files changed, 181 insertions(+), 4 deletions(-) rename roles/custom/matrix-conduit/templates/{conduit => }/conduit.toml.j2 (100%) create mode 100644 roles/custom/matrix-conduit/templates/labels.j2 rename roles/custom/matrix-conduit/templates/{conduit => }/systemd/matrix-conduit.service.j2 (97%) diff --git a/docs/configuring-playbook-conduit.md b/docs/configuring-playbook-conduit.md index 8739a5674..eac7e12b4 100644 --- a/docs/configuring-playbook-conduit.md +++ b/docs/configuring-playbook-conduit.md @@ -55,4 +55,3 @@ Find the `registration.yaml` in the `/matrix` directory, for example `/matrix/ma sender_localpart: _bot_signalbot url: http://matrix-mautrix-signal:29328 ``` - diff --git a/group_vars/matrix_servers b/group_vars/matrix_servers index 57408137f..932bf6a77 100755 --- a/group_vars/matrix_servers +++ b/group_vars/matrix_servers @@ -4889,6 +4889,24 @@ matrix_conduit_enabled: "{{ matrix_homeserver_implementation == 'conduit' }}" matrix_conduit_container_network: "{{ matrix_homeserver_container_network }}" +matrix_conduit_container_additional_networks_auto: | + {{ + ( + ([matrix_playbook_reverse_proxyable_services_additional_network] if matrix_conduit_container_labels_traefik_enabled and matrix_playbook_reverse_proxyable_services_additional_network else []) + ) | unique + }} + +matrix_conduit_container_labels_traefik_enabled: "{{ matrix_playbook_reverse_proxy_type in ['playbook-managed-traefik', 'other-traefik-container'] and not matrix_synapse_workers_enabled }}" +matrix_conduit_container_labels_traefik_docker_network: "{{ matrix_playbook_reverse_proxyable_services_additional_network }}" +matrix_conduit_container_labels_traefik_entrypoints: "{{ devture_traefik_entrypoint_primary }}" +matrix_conduit_container_labels_traefik_tls_certResolver: "{{ devture_traefik_certResolver_primary }}" +matrix_conduit_container_labels_traefik_hostname: "{{ matrix_server_fqn_matrix }}" + +matrix_conduit_container_labels_client_root_redirection_enabled: "{{ matrix_conduit_container_labels_client_root_redirection_url != '' }}" +matrix_conduit_container_labels_client_root_redirection_url: "{{ (('https://' if matrix_playbook_ssl_enabled else 'http://') + matrix_server_fqn_element) if matrix_client_element_enabled else '' }}" + +matrix_conduit_container_labels_federation_api_traefik_entrypoints: "{{ matrix_federation_traefik_entrypoint }}" + # Even if TURN doesn't support TLS (it does by default), # it doesn't hurt to try a secure connection anyway. # diff --git a/roles/custom/matrix-conduit/defaults/main.yml b/roles/custom/matrix-conduit/defaults/main.yml index a19aeecd8..104965bfa 100644 --- a/roles/custom/matrix-conduit/defaults/main.yml +++ b/roles/custom/matrix-conduit/defaults/main.yml @@ -34,7 +34,59 @@ matrix_conduit_container_network: "" # A list of additional container networks that the container would be connected to. # The role does not create these networks, so make sure they already exist. # Use this to expose this container to another reverse proxy, which runs in a different container network. -matrix_conduit_container_additional_networks: [] +matrix_conduit_container_additional_networks: "{{ matrix_conduit_container_additional_networks_auto + matrix_conduit_container_additional_networks_custom }}" +matrix_conduit_container_additional_networks_auto: [] +matrix_conduit_container_additional_networks_custom: [] + +# matrix_conduit_container_labels_traefik_enabled controls whether labels to assist a Traefik reverse-proxy will be attached to the container. +# See `../templates/labels.j2` for details. +# +# To inject your own other container labels, see `matrix_conduit_container_labels_additional_labels`. +matrix_conduit_container_labels_traefik_enabled: true +matrix_conduit_container_labels_traefik_docker_network: "{{ matrix_conduit_container_network }}" +matrix_conduit_container_labels_traefik_entrypoints: web-secure +matrix_conduit_container_labels_traefik_tls_certResolver: default # noqa var-naming +matrix_conduit_container_labels_traefik_hostname: '' + +# Controls whether labels will be added for handling the root (/) path +matrix_conduit_container_labels_client_root_enabled: true +matrix_conduit_container_labels_client_root_traefik_hostname: "{{ matrix_conduit_container_labels_traefik_hostname }}" +matrix_conduit_container_labels_client_root_traefik_rule: "Host(`{{ matrix_conduit_container_labels_client_root_traefik_hostname }}`) && Path(`/`)" +matrix_conduit_container_labels_client_root_traefik_priority: 0 +matrix_conduit_container_labels_client_root_traefik_entrypoints: "{{ matrix_conduit_container_labels_traefik_entrypoints }}" +matrix_conduit_container_labels_client_root_traefik_tls: "{{ matrix_conduit_container_labels_client_root_traefik_entrypoints != 'web' }}" +matrix_conduit_container_labels_client_root_traefik_tls_certResolver: "{{ matrix_conduit_container_labels_traefik_tls_certResolver }}" # noqa var-naming +matrix_conduit_container_labels_client_root_redirection_enabled: false +matrix_conduit_container_labels_client_root_redirection_url: "" + +# Controls whether labels will be added that expose the Client-Server API. +matrix_conduit_container_labels_client_api_enabled: true +matrix_conduit_container_labels_client_api_traefik_hostname: "{{ matrix_conduit_container_labels_traefik_hostname }}" +matrix_conduit_container_labels_client_api_traefik_path_prefix: /_matrix +matrix_conduit_container_labels_client_api_traefik_rule: "Host(`{{ matrix_conduit_container_labels_client_api_traefik_hostname }}`) && PathPrefix(`{{ matrix_conduit_container_labels_client_api_traefik_path_prefix }}`)" +matrix_conduit_container_labels_client_api_traefik_priority: 0 +matrix_conduit_container_labels_client_api_traefik_entrypoints: "{{ matrix_conduit_container_labels_traefik_entrypoints }}" +matrix_conduit_container_labels_client_api_traefik_tls: "{{ matrix_conduit_container_labels_client_api_traefik_entrypoints != 'web' }}" +matrix_conduit_container_labels_client_api_traefik_tls_certResolver: "{{ matrix_conduit_container_labels_traefik_tls_certResolver }}" # noqa var-naming + +# Controls whether labels will be added that expose the Server-Server API (Federation API). +matrix_conduit_container_labels_federation_api_enabled: "{{ matrix_conduit_allow_federation }}" +matrix_conduit_container_labels_federation_api_traefik_hostname: "{{ matrix_conduit_container_labels_traefik_hostname }}" +matrix_conduit_container_labels_federation_api_traefik_path_prefix: /_matrix +matrix_conduit_container_labels_federation_api_traefik_rule: "Host(`{{ matrix_conduit_container_labels_federation_api_traefik_hostname }}`) && PathPrefix(`{{ matrix_conduit_container_labels_federation_api_traefik_path_prefix }}`)" +matrix_conduit_container_labels_federation_api_traefik_priority: 0 +matrix_conduit_container_labels_federation_api_traefik_entrypoints: '' +matrix_conduit_container_labels_federation_api_traefik_tls: "{{ matrix_conduit_container_labels_federation_api_traefik_entrypoints != 'web' }}" +matrix_conduit_container_labels_federation_api_traefik_tls_certResolver: "{{ matrix_conduit_container_labels_traefik_tls_certResolver }}" # noqa var-naming + +# matrix_conduit_container_labels_additional_labels contains a multiline string with additional labels to add to the container label file. +# See `../templates/labels.j2` for details. +# +# Example: +# matrix_conduit_container_labels_additional_labels: | +# my.label=1 +# another.label="here" +matrix_conduit_container_labels_additional_labels: '' # Extra arguments for the Docker container matrix_conduit_container_extra_arguments: [] diff --git a/roles/custom/matrix-conduit/tasks/setup_install.yml b/roles/custom/matrix-conduit/tasks/setup_install.yml index ecccbb326..409f2e80c 100644 --- a/roles/custom/matrix-conduit/tasks/setup_install.yml +++ b/roles/custom/matrix-conduit/tasks/setup_install.yml @@ -18,12 +18,22 @@ - name: Ensure Conduit configuration installed ansible.builtin.template: - src: "{{ role_path }}/templates/conduit/conduit.toml.j2" + src: "{{ role_path }}/templates/conduit.toml.j2" dest: "{{ matrix_conduit_config_path }}/conduit.toml" mode: 0644 owner: "{{ matrix_user_username }}" group: "{{ matrix_user_groupname }}" +- name: Ensure Conduit support files installed + ansible.builtin.template: + src: "{{ role_path }}/templates/{{ item }}.j2" + dest: "{{ matrix_conduit_base_path }}/{{ item }}" + mode: 0640 + owner: "{{ matrix_user_username }}" + group: "{{ matrix_user_groupname }}" + with_items: + - labels + - name: Ensure Conduit container network is created community.general.docker_network: name: "{{ matrix_conduit_container_network }}" @@ -42,6 +52,6 @@ - name: Ensure matrix-conduit.service installed ansible.builtin.template: - src: "{{ role_path }}/templates/conduit/systemd/matrix-conduit.service.j2" + src: "{{ role_path }}/templates/systemd/matrix-conduit.service.j2" dest: "{{ devture_systemd_docker_base_systemd_path }}/matrix-conduit.service" mode: 0644 diff --git a/roles/custom/matrix-conduit/templates/conduit/conduit.toml.j2 b/roles/custom/matrix-conduit/templates/conduit.toml.j2 similarity index 100% rename from roles/custom/matrix-conduit/templates/conduit/conduit.toml.j2 rename to roles/custom/matrix-conduit/templates/conduit.toml.j2 diff --git a/roles/custom/matrix-conduit/templates/labels.j2 b/roles/custom/matrix-conduit/templates/labels.j2 new file mode 100644 index 000000000..be17ee76f --- /dev/null +++ b/roles/custom/matrix-conduit/templates/labels.j2 @@ -0,0 +1,97 @@ +{% if matrix_conduit_container_labels_traefik_enabled %} +traefik.enable=true + +{% if matrix_conduit_container_labels_traefik_docker_network %} +traefik.docker.network={{ matrix_conduit_container_labels_traefik_docker_network }} +{% endif %} + +traefik.http.services.matrix-conduit.loadbalancer.server.port={{ matrix_conduit_port_number }} + + +{# + Root path (/) +#} +{% if matrix_conduit_container_labels_client_root_enabled %} + +{% set client_root_middlewares = [] %} + +{% if matrix_conduit_container_labels_client_root_redirection_enabled %} +{% set client_root_middlewares = client_root_middlewares + ['matrix-conduit-client-root-redirect'] %} +traefik.http.middlewares.matrix-conduit-client-root-redirect.redirectregex.regex=(.*) +traefik.http.middlewares.matrix-conduit-client-root-redirect.redirectregex.replacement={{ matrix_conduit_container_labels_client_root_redirection_url }} +{% endif %} + +traefik.http.routers.matrix-conduit-client-root.rule={{ matrix_conduit_container_labels_client_root_traefik_rule }} + +traefik.http.routers.matrix-conduit-client-root.middlewares={{ client_root_middlewares | join(',') }} + +{% if matrix_conduit_container_labels_client_root_traefik_priority | int > 0 %} +traefik.http.routers.matrix-conduit-client-root.priority={{ matrix_conduit_container_labels_client_root_traefik_priority }} +{% endif %} + +traefik.http.routers.matrix-conduit-client-root.service=matrix-conduit +traefik.http.routers.matrix-conduit-client-root.entrypoints={{ matrix_conduit_container_labels_client_root_traefik_entrypoints }} +traefik.http.routers.matrix-conduit-client-root.tls={{ matrix_conduit_container_labels_client_root_traefik_tls | to_json }} + +{% if matrix_conduit_container_labels_client_root_traefik_tls %} +traefik.http.routers.matrix-conduit-client-root.tls.certResolver={{ matrix_conduit_container_labels_client_root_traefik_tls_certResolver }} +{% endif %} + +{% endif %} +{# + /Root path (/) +#} + + +{# + Client-API (/_matrix) +#} +{% if matrix_conduit_container_labels_client_api_enabled %} + +traefik.http.routers.matrix-conduit-client-api.rule={{ matrix_conduit_container_labels_client_api_traefik_rule }} + +{% if matrix_conduit_container_labels_client_api_traefik_priority | int > 0 %} +traefik.http.routers.matrix-conduit-client-api.priority={{ matrix_conduit_container_labels_client_api_traefik_priority }} +{% endif %} + +traefik.http.routers.matrix-conduit-client-api.service=matrix-conduit +traefik.http.routers.matrix-conduit-client-api.entrypoints={{ matrix_conduit_container_labels_client_api_traefik_entrypoints }} +traefik.http.routers.matrix-conduit-client-api.tls={{ matrix_conduit_container_labels_client_api_traefik_tls | to_json }} + +{% if matrix_conduit_container_labels_client_api_traefik_tls %} +traefik.http.routers.matrix-conduit-client-api.tls.certResolver={{ matrix_conduit_container_labels_client_api_traefik_tls_certResolver }} +{% endif %} + +{% endif %} +{# + /Client-API (/_matrix) +#} + + +{# + Federation-API (/_matrix) +#} +{% if matrix_conduit_container_labels_federation_api_enabled %} + +traefik.http.routers.matrix-conduit-federation-api.rule={{ matrix_conduit_container_labels_federation_api_traefik_rule }} + +{% if matrix_conduit_container_labels_federation_api_traefik_priority | int > 0 %} +traefik.http.routers.matrix-conduit-federation-api.priority={{ matrix_conduit_container_labels_federation_api_traefik_priority }} +{% endif %} + +traefik.http.routers.matrix-conduit-federation-api.service=matrix-conduit-federation-api +traefik.http.routers.matrix-conduit-federation-api.entrypoints={{ matrix_conduit_container_labels_federation_api_traefik_entrypoints }} +traefik.http.routers.matrix-conduit-federation-api.tls={{ matrix_conduit_container_labels_federation_api_traefik_tls | to_json }} + +{% if matrix_conduit_container_labels_federation_api_traefik_tls %} +traefik.http.routers.matrix-conduit-federation-api.tls.certResolver={{ matrix_conduit_container_labels_federation_api_traefik_tls_certResolver }} +{% endif %} + +{% endif %} +{# + /Federation-API (/_matrix) +#} + +{% endif %} + +{{ matrix_conduit_container_labels_additional_labels }} diff --git a/roles/custom/matrix-conduit/templates/conduit/systemd/matrix-conduit.service.j2 b/roles/custom/matrix-conduit/templates/systemd/matrix-conduit.service.j2 similarity index 97% rename from roles/custom/matrix-conduit/templates/conduit/systemd/matrix-conduit.service.j2 rename to roles/custom/matrix-conduit/templates/systemd/matrix-conduit.service.j2 index ce857818d..bb80fa061 100644 --- a/roles/custom/matrix-conduit/templates/conduit/systemd/matrix-conduit.service.j2 +++ b/roles/custom/matrix-conduit/templates/systemd/matrix-conduit.service.j2 @@ -22,6 +22,7 @@ ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} create \ --tmpfs=/tmp:rw,noexec,nosuid,size={{ matrix_conduit_tmp_directory_size_mb }}m \ --network={{ matrix_conduit_container_network }} \ --env CONDUIT_CONFIG=/etc/matrix-conduit/conduit.toml \ + --label-file={{ matrix_conduit_base_path }}/labels \ --mount type=bind,src={{ matrix_conduit_data_path }},dst=/var/lib/matrix-conduit \ --mount type=bind,src={{ matrix_conduit_config_path }},dst=/etc/matrix-conduit,ro \ {% for arg in matrix_conduit_container_extra_arguments %}