finallycoffee/matrix-docker-ansible-deploy
5
1
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Merge remote-tracking branch 'origin/master' into synapse-workers

Browse Source 
Also, replace vague FIXME by a proper NOTE on the complete
story of the user_dir endpoints..
This commit is contained in:
Marcel Partap
2020-11-11 21:23:37 +01:00
parent 5598a89ad5 4dbec2470f
commit 4678c5d7bd
28 changed files with 453 additions and 45 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
roles/matrix-client-element/defaults/main.yml
View File

@ -2,7 +2,7 @@ matrix_client_element_enabled: true
matrix_client_element_container_image_self_build: false
matrix_client_element_docker_image: "vectorim/riot-web:v1.7.10"
matrix_client_element_docker_image: "vectorim/element-web:v1.7.13"
matrix_client_element_docker_image_force_pull: "{{ matrix_client_element_docker_image.endswith(':latest') }}"
matrix_client_element_data_path: "{{ matrix_base_data_path }}/client-element"

43
roles/matrix-dynamic-dns/defaults/main.yml Normal file
View File

@ -0,0 +1,43 @@
# Whether dynamic dns is enabled
matrix_dynamic_dns_enabled: true
# The dynamic dns daemon interval
matrix_dynamic_dns_daemon_interval: '300'
# The docker container to use when in mode
matrix_dynamic_dns_docker_image: 'linuxserver/ddclient:v3.9.1-ls45'
# The image to force pull
matrix_dynamic_dns_docker_image_force_pull: "{{ matrix_dynamic_dns_docker_image.endswith(':latest') }}"
# List of extra arguments to pass to the ontainer mode
matrix_dynamic_dns_container_extra_arguments: []
# List of wanted services when running in mode
matrix_dynamic_dns_systemd_wanted_services_list: []
# List of required services when running in mode
matrix_dynamic_dns_systemd_required_services_list: ['docker.service']
# Build the container from source when running in mode
matrix_dynamic_dns_container_image_self_build: false
# Config paths
matrix_dynamic_dns_base_path: "{{ matrix_base_data_path }}/dynamic-dns"
matrix_dynamic_dns_config_path: "{{ matrix_dynamic_dns_base_path }}/config"
matrix_dynamic_dns_docker_src_files_path: "{{ matrix_dynamic_dns_base_path }}/docker-src"
# Holds the configurations (the domains to update DNS for, the providers they use, etc.)
#
# Example:
# matrix_dynamic_dns_domain_configurations:
# - provider: domains.google.com
# protocol: dyndn2
# username: XXXXXXXXXXXXXXXX
# password: XXXXXXXXXXXXXXXX
# domain: "{{ matrix_domain }}"
matrix_dynamic_dns_domain_configurations: []
# Config options
matrix_dynamic_dns_additional_configuration_blocks: []
matrix_dynamic_dns_use: "web"

3
roles/matrix-dynamic-dns/tasks/init.yml Normal file
View File

@ -0,0 +1,3 @@
- set_fact:
matrix_systemd_services_list: "{{ matrix_systemd_services_list + ['matrix-dynamic-dns'] }}"
when: "matrix_dynamic_dns_enabled|bool"

59
roles/matrix-dynamic-dns/tasks/install.yml Normal file
View File

@ -0,0 +1,59 @@
---
- name: Ensure Dynamic DNS image is pulled
docker_image:
name: "{{ matrix_dynamic_dns_docker_image }}"
source: "{{ 'pull' if ansible_version.major > 2 or ansible_version.minor > 7 else omit }}"
force_source: "{{ matrix_dynamic_dns_docker_image_force_pull if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}"
force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else matrix_dynamic_dns_docker_image_force_pull }}"
when: matrix_dynamic_dns_enabled|bool and not matrix_dynamic_dns_container_image_self_build
- name: Ensure Dynamic DNS paths exist
file:
path: "{{ item.path }}"
state: directory
mode: 0751
owner: "{{ matrix_user_username }}"
group: "{{ matrix_user_groupname }}"
with_items:
- { path: "{{ matrix_dynamic_dns_base_path }}", when: true }
- { path: "{{ matrix_dynamic_dns_config_path }}", when: true }
- { path: "{{ matrix_dynamic_dns_docker_src_files_path }}", when: "{{ matrix_dynamic_dns_container_image_self_build }}" }
when: matrix_dynamic_dns_enabled|bool and item.when|bool
- name: Ensure Dynamic DNS repository is present on self build
git:
repo: https://github.com/linuxserver/docker-ddclient.git
dest: "{{ matrix_dynamic_dns_docker_src_files_path }}"
force: "yes"
when: "matrix_dynamic_dns_enabled|bool and matrix_dynamic_dns_container_image_self_build"
- name: Ensure Dynamic DNS Docker image is built
docker_image:
name: "{{ matrix_dynamic_dns_docker_image }}"
source: build
build:
dockerfile: Dockerfile
path: "{{ matrix_dynamic_dns_docker_src_files_path }}"
pull: yes
when: "matrix_dynamic_dns_enabled|bool and matrix_dynamic_dns_container_image_self_build"
- name: Ensure Dynamic DNS ddclient.conf installed
template:
src: "{{ role_path }}/templates/ddclient.conf.j2"
dest: "{{ matrix_dynamic_dns_config_path }}/ddclient.conf"
mode: 0644
owner: "{{ matrix_user_username }}"
group: "{{ matrix_user_groupname }}"
- name: Ensure matrix-dynamic-dns.service installed
template:
src: "{{ role_path }}/templates/systemd/matrix-dynamic-dns.service.j2"
dest: "/etc/systemd/system/matrix-dynamic-dns.service"
mode: 0644
register: matrix_dynamic_dns_systemd_service_result
- name: Ensure systemd reloaded after matrix-dynamic-dns.service installation
service:
daemon_reload: yes
when: "matrix_dynamic_dns_systemd_service_result.changed"

21
roles/matrix-dynamic-dns/tasks/main.yml Normal file
View File

@ -0,0 +1,21 @@
- import_tasks: "{{ role_path }}/tasks/init.yml"
tags:
- always
- import_tasks: "{{ role_path }}/tasks/validate_config.yml"
when: "run_setup|bool and matrix_dynamic_dns_enabled|bool"
tags:
- setup-all
- setup-dynamic-dns
- import_tasks: "{{ role_path }}/tasks/install.yml"
when: "run_setup|bool and matrix_dynamic_dns_enabled|bool"
tags:
- setup-all
- setup-dynamic-dns
- import_tasks: "{{ role_path }}/tasks/uninstall.yml"
when: "run_setup|bool and not matrix_dynamic_dns_enabled|bool"
tags:
- setup-all
- setup-dynamic-dns

24
roles/matrix-dynamic-dns/tasks/uninstall.yml Normal file
View File

@ -0,0 +1,24 @@
---
- name: Check existence of matrix-dynamic-dns service
stat:
path: "{{ matrix_systemd_path }}/matrix-dynamic-dns.service"
register: matrix_dynamic_dns_service_stat
- name: Ensure matrix-dynamic-dns is stopped
service:
name: matrix-dynamic-dns
state: stopped
daemon_reload: yes
when: "matrix_dynamic_dns_service_stat.stat.exists"
- name: Ensure matrix-dynamic-dns.service doesn't exist
file:
path: "{{ matrix_systemd_path }}/matrix-dynamic-dns.service"
state: absent
when: "matrix_dynamic_dns_service_stat.stat.exists"
- name: Ensure systemd reloaded after matrix-dynamic-dns.service removal
service:
daemon_reload: yes
when: "matrix_dynamic_dns_service_stat.stat.exists"

16
roles/matrix-dynamic-dns/tasks/validate_config.yml Normal file
View File

@ -0,0 +1,16 @@
---
- name: Fail if no configurations specified
fail:
msg: >-
You need to define at least one configuration in `matrix_dynamic_dns_domain_configurations` for using matrix-dynamic-dns.
when: "matrix_dynamic_dns_domain_configurations|length == 0"
- name: Fail if required settings not defined in configuration blocks
fail:
msg: >-
One of the configurations in matrix_dynamic_dns_domain_configurations is missing a required key (domain, provider, protocol).
when: "'domain' not in configuration or 'provider' not in configuration or 'protocol' not in configuration"
with_items: "{{ matrix_dynamic_dns_domain_configurations }}"
loop_control:
loop_var: configuration

26
roles/matrix-dynamic-dns/templates/ddclient.conf.j2 Normal file
View File

@ -0,0 +1,26 @@
daemon={{ matrix_dynamic_dns_daemon_interval }}
syslog=no
pid=/var/run/ddclient/ddclient.pid
ssl=yes
use={{ matrix_dynamic_dns_use }}
{% for dynamic_dns_domain_configuration in matrix_dynamic_dns_domain_configurations %}
protocol={{ dynamic_dns_domain_configuration.protocol }}
server={{ dynamic_dns_domain_configuration.provider }} {% if 'username' in dynamic_dns_domain_configuration %}
login='{{ dynamic_dns_domain_configuration.username }}' {% endif %} {% if 'password' in dynamic_dns_domain_configuration %}
password='{{ dynamic_dns_domain_configuration.password }}' {% endif %} {% if 'static' in dynamic_dns_domain_configuration %}
static=yes {% endif %} {% if 'custom' in dynamic_dns_domain_configuration %}
custom=yes {% endif %} {% if 'zone' in dynamic_dns_domain_configuration %}
zone={{ dynamic_dns_domain_configuration.zone }} {% endif %} {% if 'ttl' in dynamic_dns_domain_configuration %}
ttl={{ dynamic_dns_domain_configuration.ttl }} {% endif %} {% if 'mx' in dynamic_dns_domain_configuration %}
mx={{ dynamic_dns_domain_configuration.mx }} {% endif %} {% if 'wildcard' in dynamic_dns_domain_configuration %}
wildcard=yes {% endif %}
{{ dynamic_dns_domain_configuration.domain }}
{% endfor %}
{% for matrix_dynamic_dns_additional_configuration in matrix_dynamic_dns_additional_configuration_blocks %}
{{ matrix_dynamic_dns_additional_configuration }}
{% endfor %}

34
roles/matrix-dynamic-dns/templates/systemd/matrix-dynamic-dns.service.j2 Normal file
View File

@ -0,0 +1,34 @@
#jinja2: lstrip_blocks: "True"
[Unit]
Description=Matrix Dynamic DNS
{% for service in matrix_dynamic_dns_systemd_required_services_list %}
Requires={{ service }}
After={{ service }}
{% endfor %}
{% for service in matrix_dynamic_dns_systemd_wanted_services_list %}
Wants={{ service }}
{% endfor %}
[Service]
Type=simple
ExecStartPre=-{{ matrix_host_command_docker }} kill matrix-dynamic-dns
ExecStartPre=-{{ matrix_host_command_docker }} rm matrix-dynamic-dns
ExecStart={{ matrix_host_command_docker }} run --rm --name matrix-dynamic-dns \
--log-driver=none \
--network={{ matrix_docker_network }} \
-e PUID={{ matrix_user_uid }} \
-e PGID={{ matrix_user_gid }} \
-v {{ matrix_dynamic_dns_config_path }}:/config:z \
{% for arg in matrix_dynamic_dns_container_extra_arguments %}
{{ arg }} \
{% endfor %}
{{ matrix_dynamic_dns_docker_image }}
ExecStop=-{{ matrix_host_command_docker }} kill matrix-dynamic-dns
ExecStop=-{{ matrix_host_command_docker }} rm matrix-dynamic-dns
Restart=always
RestartSec=30
SyslogIdentifier=matrix-dynamic-dns
[Install]
WantedBy=multi-user.target

40
roles/matrix-nginx-proxy/defaults/main.yml
View File

@ -3,7 +3,7 @@ matrix_nginx_proxy_enabled: true
# We use an official nginx image, which we fix-up to run unprivileged.
# An alternative would be an `nginxinc/nginx-unprivileged` image, but
# that is frequently out of date.
matrix_nginx_proxy_docker_image: "nginx:1.19.3-alpine"
matrix_nginx_proxy_docker_image: "nginx:1.19.4-alpine"
matrix_nginx_proxy_docker_image_force_pull: "{{ matrix_nginx_proxy_docker_image.endswith(':latest') }}"
matrix_nginx_proxy_base_path: "{{ matrix_base_data_path }}/nginx-proxy"
@ -147,7 +147,39 @@ matrix_nginx_proxy_proxy_synapse_metrics_basic_auth_key: ""
matrix_nginx_proxy_proxy_matrix_client_api_addr_with_container: "matrix-synapse:8008"
matrix_nginx_proxy_proxy_matrix_client_api_addr_sans_container: "127.0.0.1:8008"
# This needs to be equal or higher than the maximum upload size accepted by Synapse.
matrix_nginx_proxy_proxy_matrix_client_api_client_max_body_size_mb: 25
matrix_nginx_proxy_proxy_matrix_client_api_client_max_body_size_mb: 50
# Tells whether `/_synapse/client` is forwarded to the Matrix Client API server.
matrix_nginx_proxy_proxy_matrix_client_api_forwarded_location_synapse_client_api_enabled: true
# Tells whether `/_synapse/oidc` is forwarded to the Matrix Client API server.
# Enable this if you need OpenID Connect authentication support.
matrix_nginx_proxy_proxy_matrix_client_api_forwarded_location_synapse_oidc_api_enabled: false
# Tells whether `/_synapse/admin` is forwarded to the Matrix Client API server.
# Following these recommendations (https://github.com/matrix-org/synapse/blob/master/docs/reverse_proxy.md), by default, we don't.
matrix_nginx_proxy_proxy_matrix_client_api_forwarded_location_synapse_admin_api_enabled: false
# `matrix_nginx_proxy_proxy_matrix_client_api_forwarded_location_prefixes` holds
# the location prefixes that get forwarded to the Matrix Client API server.
# These locations get combined into a regex like this `^(/_matrix|/_synapse/client)`.
matrix_nginx_proxy_proxy_matrix_client_api_forwarded_location_prefix_regexes: |
{{
(['/_matrix'])
+
(['/_synapse/client'] if matrix_nginx_proxy_proxy_matrix_client_api_forwarded_location_synapse_client_api_enabled else [])
+
(['/_synapse/oidc'] if matrix_nginx_proxy_proxy_matrix_client_api_forwarded_location_synapse_oidc_api_enabled else [])
+
(['/_synapse/admin'] if matrix_nginx_proxy_proxy_matrix_client_api_forwarded_location_synapse_admin_api_enabled else [])
}}
# Specifies where requests for the root URI (`/`) on the `matrix.` domain should be redirected.
# If this has an empty value, they're just passed to the homeserver, which serves a static page.
# If you'd like to make `https://matrix.DOMAIN` redirect to `https://element.DOMAIN` (or something of that sort), specify the domain name here.
# Example value: `element.DOMAIN` (or `{{ matrix_server_fqn_element }}`).
matrix_nginx_proxy_proxy_matrix_client_redirect_root_uri_to_domain: ""
# Controls whether proxying for the Matrix Federation API should be done.
matrix_nginx_proxy_proxy_matrix_federation_api_enabled: false
@ -243,6 +275,10 @@ matrix_ssl_base_path: "{{ matrix_base_data_path }}/ssl"
matrix_ssl_config_dir_path: "{{ matrix_ssl_base_path }}/config"
matrix_ssl_log_dir_path: "{{ matrix_ssl_base_path }}/log"
# If you'd like to start some service before a certificate is obtained, specify it here.
# This could be something like `matrix-dynamic-dns`, etc.
matrix_ssl_pre_obtaining_required_service_name: ~
matrix_ssl_pre_obtaining_required_service_start_wait_time_seconds: 60
# nginx status page configurations.
matrix_nginx_proxy_proxy_matrix_nginx_status_enabled: false

13
roles/matrix-nginx-proxy/tasks/ssl/setup_ssl_lets_encrypt_obtain_for_domain.yml
View File

@ -12,6 +12,19 @@
- set_fact:
domain_name_needs_cert: "{{ not domain_name_certificate_path_stat.stat.exists }}"
- block:
- name: Ensure required service for obtaining is started
service:
name: "{{ matrix_ssl_pre_obtaining_required_service_name }}"
state: started
register: matrix_ssl_pre_obtaining_required_service_start_result
- name: Wait some time, so that the required service for obtaining can start
wait_for:
timeout: "{{ matrix_ssl_service_to_start_before_obtaining_start_wait_time_seconds }}"
when: "matrix_ssl_pre_obtaining_required_service_start_result.changed|bool"
when: "domain_name_needs_cert|bool and matrix_ssl_pre_obtaining_required_service_name != ''"
# This will fail if there is something running on port 80 (like matrix-nginx-proxy).
# We suppress the error, as we'll try another method below.
- name: Attempt initial SSL certificate retrieval with standalone authenticator (directly)

49
roles/matrix-nginx-proxy/templates/nginx/conf.d/matrix-synapse.conf.j2
View File

@ -34,7 +34,7 @@
{% endif %}
{% if matrix_nginx_proxy_proxy_matrix_corporal_api_enabled %}
location /_matrix/corporal {
location ^~ /_matrix/corporal {
{% if matrix_nginx_proxy_enabled %}
{# Use the embedded DNS resolver in Docker containers to discover the service #}
resolver 127.0.0.11 valid=5s;
@ -51,7 +51,7 @@
{% endif %}
{% if matrix_nginx_proxy_proxy_matrix_identity_api_enabled %}
location /_matrix/identity {
location ^~ /_matrix/identity {
{% if matrix_nginx_proxy_enabled %}
{# Use the embedded DNS resolver in Docker containers to discover the service #}
resolver 127.0.0.11 valid=5s;
@ -68,8 +68,10 @@
{% endif %}
{% if matrix_nginx_proxy_proxy_matrix_user_directory_search_enabled %}
# FIXME: if this is enabled, user_dir_workers should be disabled
location /_matrix/client/r0/user_directory/search {
# NOTE: This redirects user lookup requests to the identity server instead of
# synapse, so user_dir_workers endpoints listed further down in this file will
# not be reached and workers of this kind should be disabled for consistency.
location ^~ /_matrix/client/r0/user_directory/search {
{% if matrix_nginx_proxy_enabled %}
{# Use the embedded DNS resolver in Docker containers to discover the service #}
resolver 127.0.0.11 valid=5s;
@ -103,7 +105,7 @@
{% endif %}
{% if matrix_nginx_proxy_synapse_workers_enabled %}
# Workers redirects BEGIN
{# Workers redirects BEGIN}
{% if generic_workers %}
# https://github.com/matrix-org/synapse/blob/master/docs/workers.md#synapseappgeneric_worker
@ -162,7 +164,7 @@
}
{% endif %}
{% endif %}
# Workers redirects END
{# Workers redirects END}
{% endif %}
@ -170,29 +172,6 @@
{{- configuration_block }}
{% endfor %}
{#
This handles the Matrix Client API only.
The Matrix Federation API is handled by a separate vhost.
#}
location /_matrix {
{% if matrix_nginx_proxy_enabled %}
{# Use the embedded DNS resolver in Docker containers to discover the service #}
resolver 127.0.0.11 valid=5s;
set $backend "{{ matrix_nginx_proxy_proxy_matrix_client_api_addr_with_container }}";
proxy_pass http://$backend;
{% else %}
{# Generic configuration for use outside of our container setup #}
proxy_pass http://{{ matrix_nginx_proxy_proxy_matrix_client_api_addr_sans_container }};
{% endif %}
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $remote_addr;
client_body_buffer_size 25M;
client_max_body_size {{ matrix_nginx_proxy_proxy_matrix_client_api_client_max_body_size_mb }}M;
proxy_max_temp_file_size 0;
}
{% if matrix_nginx_proxy_proxy_synapse_metrics %}
location /_synapse/metrics {
{% if matrix_nginx_proxy_enabled %}
@ -215,7 +194,11 @@
}
{% endif %}
location /_synapse {
{#
This handles the Matrix Client API only.
The Matrix Federation API is handled by a separate vhost.
#}
location ~* ^({{ matrix_nginx_proxy_proxy_matrix_client_api_forwarded_location_prefix_regexes|join('|') }}) {
{% if matrix_nginx_proxy_enabled %}
{# Use the embedded DNS resolver in Docker containers to discover the service #}
resolver 127.0.0.11 valid=5s;
@ -235,7 +218,11 @@
}
location / {
rewrite ^/$ /_matrix/static/ last;
{% if matrix_nginx_proxy_proxy_matrix_client_redirect_root_uri_to_domain %}
return 302 $scheme://{{ matrix_nginx_proxy_proxy_matrix_client_redirect_root_uri_to_domain }}$request_uri;
{% else %}
rewrite ^/$ /_matrix/static/ last;
{% endif %}
}
{% endmacro %}

6
roles/matrix-synapse/defaults/main.yml
View File

@ -5,7 +5,7 @@ matrix_synapse_enabled: true
matrix_synapse_container_image_self_build: false
matrix_synapse_docker_image: "matrixdotorg/synapse:v1.21.2"
matrix_synapse_docker_image: "matrixdotorg/synapse:v1.22.1"
matrix_synapse_docker_image_force_pull: "{{ matrix_synapse_docker_image.endswith(':latest') }}"
matrix_synapse_base_path: "{{ matrix_base_data_path }}/synapse"
@ -73,7 +73,7 @@ matrix_synapse_registration_shared_secret: "{{ matrix_synapse_macaroon_secret_ke
matrix_synapse_allow_guest_access: false
matrix_synapse_form_secret: "{{ matrix_synapse_macaroon_secret_key }}"
matrix_synapse_max_upload_size_mb: 10
matrix_synapse_max_upload_size_mb: 50
# The tmpfs at /tmp needs to be large enough to handle multiple concurrent file uploads.
matrix_synapse_tmp_directory_size_mb: "{{ matrix_synapse_max_upload_size_mb * 50 }}"
@ -389,7 +389,7 @@ matrix_synapse_room_list_publication_rules:
room_id: "*"
action: allow
matrix_synapse_default_room_version: "5"
matrix_synapse_default_room_version: "6"
# Controls the Synapse `spam_checker` setting.
#