Add native Traefik support to matrix-conduit

docs/configuring-playbook-conduit.md

@@ -55,4 +55,3 @@ Find the `registration.yaml` in the `/matrix` directory, for example `/matrix/ma
     sender_localpart: _bot_signalbot
     url: http://matrix-mautrix-signal:29328
     ```
-

group_vars/matrix_servers

@@ -4889,6 +4889,24 @@ matrix_conduit_enabled: "{{ matrix_homeserver_implementation == 'conduit' }}"
 
 matrix_conduit_container_network: "{{ matrix_homeserver_container_network }}"
 
+matrix_conduit_container_additional_networks_auto: |
+  {{
+    (
+      ([matrix_playbook_reverse_proxyable_services_additional_network] if matrix_conduit_container_labels_traefik_enabled and matrix_playbook_reverse_proxyable_services_additional_network else [])
+    ) | unique
+  }}
+
+matrix_conduit_container_labels_traefik_enabled: "{{ matrix_playbook_reverse_proxy_type in ['playbook-managed-traefik', 'other-traefik-container'] and not matrix_synapse_workers_enabled }}"
+matrix_conduit_container_labels_traefik_docker_network: "{{ matrix_playbook_reverse_proxyable_services_additional_network }}"
+matrix_conduit_container_labels_traefik_entrypoints: "{{ devture_traefik_entrypoint_primary }}"
+matrix_conduit_container_labels_traefik_tls_certResolver: "{{ devture_traefik_certResolver_primary }}"
+matrix_conduit_container_labels_traefik_hostname: "{{ matrix_server_fqn_matrix }}"
+
+matrix_conduit_container_labels_client_root_redirection_enabled: "{{ matrix_conduit_container_labels_client_root_redirection_url != '' }}"
+matrix_conduit_container_labels_client_root_redirection_url: "{{ (('https://' if matrix_playbook_ssl_enabled else 'http://') + matrix_server_fqn_element) if matrix_client_element_enabled else '' }}"
+
+matrix_conduit_container_labels_federation_api_traefik_entrypoints: "{{ matrix_federation_traefik_entrypoint }}"
+
 # Even if TURN doesn't support TLS (it does by default),
 # it doesn't hurt to try a secure connection anyway.
 #

roles/custom/matrix-conduit/defaults/main.yml

@@ -34,7 +34,59 @@ matrix_conduit_container_network: ""
 # A list of additional container networks that the container would be connected to.
 # The role does not create these networks, so make sure they already exist.
 # Use this to expose this container to another reverse proxy, which runs in a different container network.
-matrix_conduit_container_additional_networks: []
+matrix_conduit_container_additional_networks: "{{ matrix_conduit_container_additional_networks_auto + matrix_conduit_container_additional_networks_custom }}"
+matrix_conduit_container_additional_networks_auto: []
+matrix_conduit_container_additional_networks_custom: []
+
+# matrix_conduit_container_labels_traefik_enabled controls whether labels to assist a Traefik reverse-proxy will be attached to the container.
+# See `../templates/labels.j2` for details.
+#
+# To inject your own other container labels, see `matrix_conduit_container_labels_additional_labels`.
+matrix_conduit_container_labels_traefik_enabled: true
+matrix_conduit_container_labels_traefik_docker_network: "{{ matrix_conduit_container_network }}"
+matrix_conduit_container_labels_traefik_entrypoints: web-secure
+matrix_conduit_container_labels_traefik_tls_certResolver: default  # noqa var-naming
+matrix_conduit_container_labels_traefik_hostname: ''
+
+# Controls whether labels will be added for handling the root (/) path
+matrix_conduit_container_labels_client_root_enabled: true
+matrix_conduit_container_labels_client_root_traefik_hostname: "{{ matrix_conduit_container_labels_traefik_hostname }}"
+matrix_conduit_container_labels_client_root_traefik_rule: "Host(`{{ matrix_conduit_container_labels_client_root_traefik_hostname }}`) && Path(`/`)"
+matrix_conduit_container_labels_client_root_traefik_priority: 0
+matrix_conduit_container_labels_client_root_traefik_entrypoints: "{{ matrix_conduit_container_labels_traefik_entrypoints }}"
+matrix_conduit_container_labels_client_root_traefik_tls: "{{ matrix_conduit_container_labels_client_root_traefik_entrypoints != 'web' }}"
+matrix_conduit_container_labels_client_root_traefik_tls_certResolver: "{{ matrix_conduit_container_labels_traefik_tls_certResolver }}"  # noqa var-naming
+matrix_conduit_container_labels_client_root_redirection_enabled: false
+matrix_conduit_container_labels_client_root_redirection_url: ""
+
+# Controls whether labels will be added that expose the Client-Server API.
+matrix_conduit_container_labels_client_api_enabled: true
+matrix_conduit_container_labels_client_api_traefik_hostname: "{{ matrix_conduit_container_labels_traefik_hostname }}"
+matrix_conduit_container_labels_client_api_traefik_path_prefix: /_matrix
+matrix_conduit_container_labels_client_api_traefik_rule: "Host(`{{ matrix_conduit_container_labels_client_api_traefik_hostname }}`) && PathPrefix(`{{ matrix_conduit_container_labels_client_api_traefik_path_prefix }}`)"
+matrix_conduit_container_labels_client_api_traefik_priority: 0
+matrix_conduit_container_labels_client_api_traefik_entrypoints: "{{ matrix_conduit_container_labels_traefik_entrypoints }}"
+matrix_conduit_container_labels_client_api_traefik_tls: "{{ matrix_conduit_container_labels_client_api_traefik_entrypoints != 'web' }}"
+matrix_conduit_container_labels_client_api_traefik_tls_certResolver: "{{ matrix_conduit_container_labels_traefik_tls_certResolver }}"  # noqa var-naming
+
+# Controls whether labels will be added that expose the Server-Server API (Federation API).
+matrix_conduit_container_labels_federation_api_enabled: "{{ matrix_conduit_allow_federation }}"
+matrix_conduit_container_labels_federation_api_traefik_hostname: "{{ matrix_conduit_container_labels_traefik_hostname }}"
+matrix_conduit_container_labels_federation_api_traefik_path_prefix: /_matrix
+matrix_conduit_container_labels_federation_api_traefik_rule: "Host(`{{ matrix_conduit_container_labels_federation_api_traefik_hostname }}`) && PathPrefix(`{{ matrix_conduit_container_labels_federation_api_traefik_path_prefix }}`)"
+matrix_conduit_container_labels_federation_api_traefik_priority: 0
+matrix_conduit_container_labels_federation_api_traefik_entrypoints: ''
+matrix_conduit_container_labels_federation_api_traefik_tls: "{{ matrix_conduit_container_labels_federation_api_traefik_entrypoints != 'web' }}"
+matrix_conduit_container_labels_federation_api_traefik_tls_certResolver: "{{ matrix_conduit_container_labels_traefik_tls_certResolver }}"  # noqa var-naming
+
+# matrix_conduit_container_labels_additional_labels contains a multiline string with additional labels to add to the container label file.
+# See `../templates/labels.j2` for details.
+#
+# Example:
+# matrix_conduit_container_labels_additional_labels: |
+#   my.label=1
+#   another.label="here"
+matrix_conduit_container_labels_additional_labels: ''
 
 # Extra arguments for the Docker container
 matrix_conduit_container_extra_arguments: []

roles/custom/matrix-conduit/tasks/setup_install.yml

@@ -18,12 +18,22 @@
 
 - name: Ensure Conduit configuration installed
   ansible.builtin.template:
-    src: "{{ role_path }}/templates/conduit/conduit.toml.j2"
+    src: "{{ role_path }}/templates/conduit.toml.j2"
     dest: "{{ matrix_conduit_config_path }}/conduit.toml"
     mode: 0644
     owner: "{{ matrix_user_username }}"
     group: "{{ matrix_user_groupname }}"
 
+- name: Ensure Conduit support files installed
+  ansible.builtin.template:
+    src: "{{ role_path }}/templates/{{ item }}.j2"
+    dest: "{{ matrix_conduit_base_path }}/{{ item }}"
+    mode: 0640
+    owner: "{{ matrix_user_username }}"
+    group: "{{ matrix_user_groupname }}"
+  with_items:
+    - labels
+
 - name: Ensure Conduit container network is created
   community.general.docker_network:
     name: "{{ matrix_conduit_container_network }}"
@@ -42,6 +52,6 @@
 
 - name: Ensure matrix-conduit.service installed
   ansible.builtin.template:
-    src: "{{ role_path }}/templates/conduit/systemd/matrix-conduit.service.j2"
+    src: "{{ role_path }}/templates/systemd/matrix-conduit.service.j2"
     dest: "{{ devture_systemd_docker_base_systemd_path }}/matrix-conduit.service"
     mode: 0644

roles/custom/matrix-conduit/templates/labels.j2

@@ -0,0 +1,97 @@
+{% if matrix_conduit_container_labels_traefik_enabled %}
+traefik.enable=true
+
+{% if matrix_conduit_container_labels_traefik_docker_network %}
+traefik.docker.network={{ matrix_conduit_container_labels_traefik_docker_network }}
+{% endif %}
+
+traefik.http.services.matrix-conduit.loadbalancer.server.port={{ matrix_conduit_port_number }}
+
+
+{#
+	Root path (/)
+#}
+{% if matrix_conduit_container_labels_client_root_enabled %}
+
+{% set client_root_middlewares = [] %}
+
+{% if matrix_conduit_container_labels_client_root_redirection_enabled %}
+{% set client_root_middlewares = client_root_middlewares + ['matrix-conduit-client-root-redirect'] %}
+traefik.http.middlewares.matrix-conduit-client-root-redirect.redirectregex.regex=(.*)
+traefik.http.middlewares.matrix-conduit-client-root-redirect.redirectregex.replacement={{ matrix_conduit_container_labels_client_root_redirection_url }}
+{% endif %}
+
+traefik.http.routers.matrix-conduit-client-root.rule={{ matrix_conduit_container_labels_client_root_traefik_rule }}
+
+traefik.http.routers.matrix-conduit-client-root.middlewares={{ client_root_middlewares | join(',') }}
+
+{% if matrix_conduit_container_labels_client_root_traefik_priority | int > 0 %}
+traefik.http.routers.matrix-conduit-client-root.priority={{ matrix_conduit_container_labels_client_root_traefik_priority }}
+{% endif %}
+
+traefik.http.routers.matrix-conduit-client-root.service=matrix-conduit
+traefik.http.routers.matrix-conduit-client-root.entrypoints={{ matrix_conduit_container_labels_client_root_traefik_entrypoints }}
+traefik.http.routers.matrix-conduit-client-root.tls={{ matrix_conduit_container_labels_client_root_traefik_tls | to_json }}
+
+{% if matrix_conduit_container_labels_client_root_traefik_tls %}
+traefik.http.routers.matrix-conduit-client-root.tls.certResolver={{ matrix_conduit_container_labels_client_root_traefik_tls_certResolver }}
+{% endif %}
+
+{% endif %}
+{#
+	/Root path (/)
+#}
+
+
+{#
+	Client-API (/_matrix)
+#}
+{% if matrix_conduit_container_labels_client_api_enabled %}
+
+traefik.http.routers.matrix-conduit-client-api.rule={{ matrix_conduit_container_labels_client_api_traefik_rule }}
+
+{% if matrix_conduit_container_labels_client_api_traefik_priority | int > 0 %}
+traefik.http.routers.matrix-conduit-client-api.priority={{ matrix_conduit_container_labels_client_api_traefik_priority }}
+{% endif %}
+
+traefik.http.routers.matrix-conduit-client-api.service=matrix-conduit
+traefik.http.routers.matrix-conduit-client-api.entrypoints={{ matrix_conduit_container_labels_client_api_traefik_entrypoints }}
+traefik.http.routers.matrix-conduit-client-api.tls={{ matrix_conduit_container_labels_client_api_traefik_tls | to_json }}
+
+{% if matrix_conduit_container_labels_client_api_traefik_tls %}
+traefik.http.routers.matrix-conduit-client-api.tls.certResolver={{ matrix_conduit_container_labels_client_api_traefik_tls_certResolver }}
+{% endif %}
+
+{% endif %}
+{#
+	/Client-API (/_matrix)
+#}
+
+
+{#
+	Federation-API (/_matrix)
+#}
+{% if matrix_conduit_container_labels_federation_api_enabled %}
+
+traefik.http.routers.matrix-conduit-federation-api.rule={{ matrix_conduit_container_labels_federation_api_traefik_rule }}
+
+{% if matrix_conduit_container_labels_federation_api_traefik_priority | int > 0 %}
+traefik.http.routers.matrix-conduit-federation-api.priority={{ matrix_conduit_container_labels_federation_api_traefik_priority }}
+{% endif %}
+
+traefik.http.routers.matrix-conduit-federation-api.service=matrix-conduit-federation-api
+traefik.http.routers.matrix-conduit-federation-api.entrypoints={{ matrix_conduit_container_labels_federation_api_traefik_entrypoints }}
+traefik.http.routers.matrix-conduit-federation-api.tls={{ matrix_conduit_container_labels_federation_api_traefik_tls | to_json }}
+
+{% if matrix_conduit_container_labels_federation_api_traefik_tls %}
+traefik.http.routers.matrix-conduit-federation-api.tls.certResolver={{ matrix_conduit_container_labels_federation_api_traefik_tls_certResolver }}
+{% endif %}
+
+{% endif %}
+{#
+	/Federation-API (/_matrix)
+#}
+
+{% endif %}
+
+{{ matrix_conduit_container_labels_additional_labels }}

roles/custom/matrix-conduit/templates/systemd/matrix-conduit.service.j2

@@ -22,6 +22,7 @@ ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} create \
 			--tmpfs=/tmp:rw,noexec,nosuid,size={{ matrix_conduit_tmp_directory_size_mb }}m \
 			--network={{ matrix_conduit_container_network }} \
 			--env CONDUIT_CONFIG=/etc/matrix-conduit/conduit.toml \
+			--label-file={{ matrix_conduit_base_path }}/labels \
 			--mount type=bind,src={{ matrix_conduit_data_path }},dst=/var/lib/matrix-conduit \
 			--mount type=bind,src={{ matrix_conduit_config_path }},dst=/etc/matrix-conduit,ro \
 			{% for arg in matrix_conduit_container_extra_arguments %}