From 4a6287c52878b6af9d044e042d3504946fdf1f24 Mon Sep 17 00:00:00 2001 From: Slavi Pantaleev Date: Tue, 2 Jan 2024 15:56:56 +0200 Subject: [PATCH] Initial work on matrix-homeserver-proxy role and eliminating matrix-nginx-proxy This is still very far from usable. Various bridges and bots are still talking to `matrix-nginx-proxy` instead of the new `matrix-homeserver-proxy` role. These services need to be reworked. While reworking them, various cleanups are being done as well as adding Traefik-labels to those that need them. --- group_vars/matrix_servers | 249 ++++++++++++++---- roles/custom/matrix-base/defaults/main.yml | 57 +++- .../matrix-base/tasks/validate_config.yml | 4 +- .../matrix-bot-chatgpt/defaults/main.yml | 13 +- .../matrix-bot-chatgpt/tasks/install.yml | 5 + .../tasks/validate_config.yml | 2 + .../systemd/matrix-bot-chatgpt.service.j2 | 10 +- .../defaults/main.yml | 14 +- .../tasks/validate_config.yml | 2 + .../matrix-bot-matrix-reminder-bot.service.j2 | 12 +- .../matrix-bot-postmoogle/defaults/main.yml | 14 +- .../tasks/setup_install.yml | 5 + .../tasks/validate_config.yml | 2 + .../systemd/matrix-bot-postmoogle.service.j2 | 12 +- .../matrix-bridge-hookshot/defaults/main.yml | 5 +- .../matrix-bridge-hookshot/tasks/main.yml | 3 + .../defaults/main.yml | 69 ++++- .../tasks/inject_into_nginx_proxy.yml | 69 ----- .../tasks/main.yml | 9 - .../tasks/setup_install.yml | 10 + .../tasks/validate_config.yml | 17 +- .../templates/config.yaml.j2 | 2 +- .../templates/labels.j2 | 45 ++++ .../matrix-mautrix-facebook.service.j2 | 17 +- .../matrix-homeserver-proxy/defaults/main.yml | 179 +++++++++++++ .../matrix-homeserver-proxy/tasks/install.yml | 49 ++++ .../matrix-homeserver-proxy/tasks/main.yml | 20 ++ .../tasks/uninstall.yml | 25 ++ .../conf.d/matrix-homeserver-proxy.conf.j2 | 62 +++++ .../templates/nginx/conf.d/nginx-http.conf.j2 | 13 + .../templates/nginx/nginx.conf.j2 | 77 ++++++ .../matrix-homeserver-proxy.service.j2 | 52 ++++ .../matrix-homeserver-proxy/vars/main.yml | 4 + .../tasks/validate_config.yml | 5 + setup.yml | 1 + 35 files changed, 968 insertions(+), 166 deletions(-) delete mode 100644 roles/custom/matrix-bridge-mautrix-facebook/tasks/inject_into_nginx_proxy.yml create mode 100644 roles/custom/matrix-bridge-mautrix-facebook/templates/labels.j2 create mode 100644 roles/custom/matrix-homeserver-proxy/defaults/main.yml create mode 100644 roles/custom/matrix-homeserver-proxy/tasks/install.yml create mode 100644 roles/custom/matrix-homeserver-proxy/tasks/main.yml create mode 100644 roles/custom/matrix-homeserver-proxy/tasks/uninstall.yml create mode 100644 roles/custom/matrix-homeserver-proxy/templates/nginx/conf.d/matrix-homeserver-proxy.conf.j2 create mode 100644 roles/custom/matrix-homeserver-proxy/templates/nginx/conf.d/nginx-http.conf.j2 create mode 100644 roles/custom/matrix-homeserver-proxy/templates/nginx/nginx.conf.j2 create mode 100755 roles/custom/matrix-homeserver-proxy/templates/systemd/matrix-homeserver-proxy.service.j2 create mode 100644 roles/custom/matrix-homeserver-proxy/vars/main.yml diff --git a/group_vars/matrix_servers b/group_vars/matrix_servers index efc2a94d4..678cfa0ee 100755 --- a/group_vars/matrix_servers +++ b/group_vars/matrix_servers @@ -189,6 +189,17 @@ matrix_homeserver_app_service_config_files_auto: | (['/matrix-cactus-comments.yaml'] if matrix_cactus_comments_enabled else []) }} +matrix_bridges_homeserver_container_network: "{{ matrix_homeserver_proxy_container_network if matrix_homeserver_proxy_enabled else matrix_homeserver_container_network }}" +matrix_bridges_homeserver_client_api_url: "{{ matrix_homeserver_proxy_client_api_url if matrix_homeserver_proxy_enabled else matrix_homeserver_container_url }}" +matrix_bridges_homeserver_systemd_services_list: "{{ ([matrix_homeserver_proxy_ident + '.service']) if matrix_homeserver_proxy_enabled else matrix_homeserver_systemd_services_list }}" + +matrix_bots_homeserver_container_network: "{{ matrix_homeserver_proxy_container_network if matrix_homeserver_proxy_enabled else matrix_homeserver_container_network }}" +matrix_bots_homeserver_client_api_url: "{{ matrix_homeserver_proxy_client_api_url if matrix_homeserver_proxy_enabled else matrix_homeserver_container_url }}" +matrix_bots_homeserver_systemd_services_list: "{{ ([matrix_homeserver_proxy_ident + '.service']) if matrix_homeserver_proxy_enabled else matrix_homeserver_systemd_services_list }}" + +# Starting from version `0.6.0` conduit natively supports some sync v3 (sliding-sync) features. +matrix_homeserver_sliding_sync_url: "{{ matrix_sliding_sync_base_url if matrix_sliding_sync_enabled else (matrix_homeserver_url if matrix_homeserver_implementation in ['conduit'] else '') }}" + ######################################################################## # # # /base # @@ -260,7 +271,7 @@ devture_systemd_service_manager_services_list_auto: | + ([{'name': 'matrix-heisenbridge.service', 'priority': 2000, 'groups': ['matrix', 'bridges', 'heisenbridge']}] if matrix_heisenbridge_enabled else []) + - ([{'name': 'matrix-hookshot.service', 'priority': 2000, 'groups': ['matrix', 'bridges', 'hookshot']}] if matrix_hookshot_enabled else []) + ([{'name': 'matrix-hookshot.service', 'priority': 2000, 'groups': ['matrix', 'bridges', 'hookshot', 'bridge-hookshot']}] if matrix_hookshot_enabled else []) + ([{'name': 'matrix-mautrix-discord.service', 'priority': 2000, 'groups': ['matrix', 'bridges', 'mautrix-discord']}] if matrix_mautrix_discord_enabled else []) + @@ -352,6 +363,8 @@ devture_systemd_service_manager_services_list_auto: | + (matrix_ssl_renewal_systemd_units_list | selectattr('applicable') | selectattr('enableable') | list ) + + ([{'name': (matrix_homeserver_proxy_ident + '.service'), 'priority': 3000, 'groups': ['matrix', 'reverse-proxies']}] if matrix_homeserver_proxy_enabled else []) + + ([{'name': (ntfy_identifier + '.service'), 'priority': 800, 'groups': ['matrix', 'ntfy']}] if ntfy_enabled else []) + ([{'name': (devture_postgres_identifier + '.service'), 'priority': 500, 'groups': ['matrix', 'postgres']}] if devture_postgres_enabled else []) @@ -445,28 +458,39 @@ devture_playbook_state_preserver_commit_hash_preservation_dst: "{{ matrix_base_d matrix_identity_server_url: "{{ ('https://' + matrix_server_fqn_matrix) if matrix_ma1sd_enabled else None }}" -matrix_homeserver_container_url: |- +matrix_homeserver_systemd_services_list: |- {{ - 'http://matrix-nginx-proxy:12080' if matrix_nginx_proxy_enabled else { - 'synapse': ('http://matrix-synapse-reverse-proxy-companion:8008' if matrix_synapse_reverse_proxy_companion_enabled else 'http://matrix-synapse:'+ matrix_synapse_container_client_api_port|string), - 'dendrite': ('http://matrix-dendrite:' + matrix_dendrite_http_bind_port|string), - 'conduit': ('http://matrix-conduit:' + matrix_conduit_port_number|string), + ( + ([('matrix-' + matrix_homeserver_implementation + '.service')] if matrix_homeserver_implementation != 'synapse' else []) + + + ([('matrix-' + matrix_homeserver_implementation + '.service')] if matrix_homeserver_implementation == 'synapse' and not matrix_synapse_reverse_proxy_companion_enabled else []) + + + (['matrix-synapse-reverse-proxy-companion.service'] if matrix_synapse_reverse_proxy_companion_enabled else []) + ) | unique + }} + +matrix_homeserver_container_client_api_endpoint: |- + {{ + { + 'synapse': ('matrix-synapse-reverse-proxy-companion:8008' if matrix_synapse_reverse_proxy_companion_enabled else 'http://matrix-synapse:'+ matrix_synapse_container_client_api_port|string), + 'dendrite': ('matrix-dendrite:' + matrix_dendrite_http_bind_port|string), + 'conduit': ('matrix-conduit:' + matrix_conduit_port_number|string), }[matrix_homeserver_implementation] }} -matrix_homeserver_container_federation_url: |- +matrix_homeserver_container_federation_api_endpoint: |- {{ - 'http://matrix-nginx-proxy:12088' if matrix_nginx_proxy_enabled else { - 'synapse': ('http://matrix-synapse-reverse-proxy-companion:8048' if matrix_synapse_reverse_proxy_companion_enabled else 'http://matrix-synapse:'+ matrix_synapse_container_federation_api_plain_port|string), - 'dendrite': ('http://matrix-dendrite:' + matrix_dendrite_http_bind_port|string), - 'conduit': ('http://matrix-conduit:' + matrix_conduit_port_number|string), + { + 'synapse': ('matrix-synapse-reverse-proxy-companion:8048' if matrix_synapse_reverse_proxy_companion_enabled else 'http://matrix-synapse:'+ matrix_synapse_container_federation_api_plain_port|string), + 'dendrite': ('matrix-dendrite:' + matrix_dendrite_http_bind_port|string), + 'conduit': ('matrix-conduit:' + matrix_conduit_port_number|string), }[matrix_homeserver_implementation] }} matrix_homeserver_container_network: |- {{ - matrix_nginx_proxy_container_network if matrix_nginx_proxy_enabled else { - 'synapse': matrix_synapse_container_network, + { + 'synapse': (matrix_synapse_reverse_proxy_companion_container_network if matrix_synapse_reverse_proxy_companion_enabled else matrix_synapse_container_network), 'dendrite': matrix_dendrite_container_network, 'conduit': matrix_conduit_container_network, }[matrix_homeserver_implementation] @@ -862,22 +886,35 @@ matrix_mautrix_facebook_enabled: false matrix_mautrix_facebook_container_image_self_build: "{{ matrix_architecture not in ['amd64', 'arm64'] }}" -matrix_mautrix_facebook_systemd_required_services_list: | +matrix_mautrix_facebook_container_network: "{{ matrix_bridges_container_network }}" + +matrix_mautrix_facebook_container_additional_networks_auto: |- {{ - ['docker.service'] + ( + ([] if matrix_bridges_homeserver_container_network == '' else [matrix_bridges_homeserver_container_network]) + + + ([devture_postgres_container_network] if devture_postgres_enabled and matrix_mautrix_facebook_database_hostname == devture_postgres_connection_hostname else []) + + + ([matrix_playbook_reverse_proxyable_services_additional_network] if matrix_playbook_reverse_proxyable_services_additional_network and matrix_mautrix_facebook_container_labels_traefik_enabled else []) + ) | unique + }} + +matrix_mautrix_facebook_systemd_required_services_list_auto: | + {{ + matrix_bots_homeserver_systemd_services_list + - ['matrix-' + matrix_homeserver_implementation + '.service'] - + - ([devture_postgres_identifier ~ '.service'] if devture_postgres_enabled else []) - + - (['matrix-nginx-proxy.service'] if matrix_nginx_proxy_enabled else []) + ([devture_postgres_identifier ~ '.service'] if devture_postgres_enabled and matrix_mautrix_facebook_database_hostname == devture_postgres_connection_hostname else []) }} matrix_mautrix_facebook_appservice_token: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'fb.as.token', rounds=655555) | to_uuid }}" +matrix_mautrix_facebook_homeserver_address: "{{ matrix_bridges_homeserver_client_api_url }}" + matrix_mautrix_facebook_homeserver_token: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'fb.hs.token', rounds=655555) | to_uuid }}" -matrix_mautrix_facebook_public_endpoint: "/{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'facebook', rounds=655555) | to_uuid }}" +matrix_mautrix_facebook_appservice_public_enabled: true +matrix_mautrix_facebook_appservice_public_hostname: "{{ matrix_server_fqn_matrix }}" +matrix_mautrix_facebook_appservice_public_prefix: "/{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'facebook', rounds=655555) | to_uuid }}" matrix_mautrix_facebook_container_http_host_bind_port: "{{ (matrix_playbook_service_host_bind_interface_prefix ~ '9008') if matrix_playbook_service_host_bind_interface_prefix else '' }}" @@ -885,18 +922,25 @@ matrix_mautrix_facebook_login_shared_secret: "{{ matrix_synapse_ext_password_pro matrix_mautrix_facebook_bridge_presence: "{{ matrix_synapse_presence_enabled if matrix_synapse_enabled else true }}" -# People using an external Prometheus server will need to toggle all of these to be able to consume metrics remotely: -# - `matrix_mautrix_facebook_metrics_enabled` -# - `matrix_mautrix_facebook_proxying_metrics_enabled` -# - `matrix_nginx_proxy_proxy_matrix_metrics_enabled` matrix_mautrix_facebook_metrics_enabled: "{{ prometheus_enabled }}" +matrix_mautrix_facebook_metrics_proxying_enabled: "{{ matrix_mautrix_facebook_metrics_enabled and matrix_metrics_exposure_enabled }}" +matrix_mautrix_facebook_metrics_proxying_hostname: "{{ matrix_metrics_exposure_hostname }}" +matrix_mautrix_facebook_metrics_proxying_path_prefix: "{{ matrix_metrics_exposure_path_prefix }}/mautrix-facebook" +matrix_mautrix_facebook_container_labels_metrics_middleware_basic_auth_enabled: "{{ matrix_metrics_exposure_http_basic_auth_enabled }}" +matrix_mautrix_facebook_container_labels_metrics_middleware_basic_auth_users: "{{ matrix_metrics_exposure_http_basic_auth_users }}" + # We'd like to force-set people with external Postgres to SQLite, so the bridge role can complain # and point them to a migration path. matrix_mautrix_facebook_database_engine: "{{ 'postgres' if devture_postgres_enabled else 'sqlite' }}" matrix_mautrix_facebook_database_hostname: "{{ devture_postgres_connection_hostname if devture_postgres_enabled else '' }}" matrix_mautrix_facebook_database_password: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'mau.fb.db', rounds=655555) | to_uuid }}" +matrix_mautrix_facebook_container_labels_traefik_enabled: "{{ matrix_playbook_reverse_proxy_type in ['playbook-managed-traefik', 'other-traefik-container'] }}" +matrix_mautrix_facebook_container_labels_traefik_docker_network: "{{ matrix_playbook_reverse_proxyable_services_additional_network }}" +matrix_mautrix_facebook_container_labels_traefik_entrypoints: "{{ devture_traefik_entrypoint_primary }}" +matrix_mautrix_facebook_container_labels_traefik_tls_certResolver: "{{ devture_traefik_certResolver_primary }}" + ###################################################################### # # /matrix-bridge-mautrix-facebook @@ -1374,11 +1418,11 @@ matrix_hookshot_appservice_token: "{{ '%s' | format(matrix_homeserver_generic_se matrix_hookshot_homeserver_token: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'hookshot.hs.tok', rounds=655555) | to_uuid }}" +matrix_hookshot_homeserver_address: "{{ matrix_bridges_homeserver_client_api_url }}" + matrix_hookshot_systemd_wanted_services_list: | {{ - (['matrix-' + matrix_homeserver_implementation + '.service']) - + - (['matrix-nginx-proxy.service'] if matrix_nginx_proxy_enabled else []) + matrix_bridges_homeserver_systemd_services_list + ([(redis_identifier + '.service')] if redis_enabled and matrix_hookshot_queue_host == redis_identifier else []) }} @@ -1388,9 +1432,15 @@ matrix_hookshot_systemd_wanted_services_list: | # because connectivity is still potentially troublesome and is to be investigated. matrix_hookshot_queue_host: "{{ redis_identifier if redis_enabled and matrix_hookshot_experimental_encryption_enabled else '' }}" +matrix_hookshot_container_network: "{{ matrix_bridges_container_network }}" + matrix_hookshot_container_additional_networks_auto: | {{ - ([redis_container_network] if redis_enabled and matrix_hookshot_queue_host == redis_identifier else []) + ( + ([] if matrix_bridges_homeserver_container_network == '' else [matrix_bridges_homeserver_container_network]) + + + ([redis_container_network] if redis_enabled and matrix_hookshot_queue_host == redis_identifier else []) + ) }} matrix_hookshot_container_http_host_bind_ports_defaultmapping: @@ -1411,6 +1461,13 @@ matrix_hookshot_provisioning_enabled: "{{ matrix_hookshot_provisioning_secret an # - `matrix_nginx_proxy_proxy_matrix_metrics_enabled` matrix_hookshot_metrics_enabled: "{{ prometheus_enabled }}" +# TODO - implement +# matrix_hookshot_metrics_metrics_proxying_enabled: "{{ matrix_hookshot_metrics_enabled and matrix_metrics_exposure_enabled }}" +# matrix_hookshot_metrics_metrics_proxying_hostname: "{{ matrix_metrics_exposure_hostname }}" +# matrix_hookshot_metrics_metrics_proxying_path_prefix: "{{ matrix_metrics_exposure_path_prefix }}/hookshot" +# matrix_hookshot_metrics_container_labels_metrics_middleware_basic_auth_enabled: "{{ matrix_metrics_exposure_http_basic_auth_enabled }}" +# matrix_hookshot_metrics_container_labels_metrics_middleware_basic_auth_users: "{{ matrix_metrics_exposure_http_basic_auth_users }}" + matrix_hookshot_urlprefix_port_enabled: "{{ matrix_nginx_proxy_container_https_host_bind_port == 443 if matrix_nginx_proxy_https_enabled else matrix_nginx_proxy_container_https_host_bind_port == 80 }}" matrix_hookshot_urlprefix_port: ":{{ matrix_nginx_proxy_container_https_host_bind_port if matrix_nginx_proxy_https_enabled else matrix_nginx_proxy_container_http_host_bind_port }}" matrix_hookshot_urlprefix: "{{ 'https' if matrix_playbook_ssl_enabled else 'http' }}://{{ matrix_server_fqn_matrix }}{{ matrix_hookshot_urlprefix_port if matrix_hookshot_urlprefix_port_enabled else '' }}" @@ -1668,15 +1725,11 @@ matrix_mx_puppet_groupme_database_password: "{{ '%s' | format(matrix_homeserver_ # We don't enable bots by default. matrix_bot_matrix_reminder_bot_enabled: false -matrix_bot_matrix_reminder_bot_systemd_required_services_list: | +matrix_bot_matrix_reminder_bot_systemd_required_services_list_auto: | {{ - ['docker.service'] + matrix_bots_homeserver_systemd_services_list + - ['matrix-' + matrix_homeserver_implementation + '.service'] - + - ([devture_postgres_identifier ~ '.service'] if devture_postgres_enabled else []) - + - (['matrix-nginx-proxy.service'] if matrix_nginx_proxy_enabled else []) + ([devture_postgres_identifier ~ '.service'] if devture_postgres_enabled and matrix_bot_matrix_reminder_bot_database_hostname == devture_postgres_connection_hostname else []) }} # Postgres is the default, except if not using internal Postgres server @@ -1685,6 +1738,18 @@ matrix_bot_matrix_reminder_bot_database_hostname: "{{ devture_postgres_connectio matrix_bot_matrix_reminder_bot_database_password: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'reminder.bot.db', rounds=655555) | to_uuid }}" matrix_bot_matrix_reminder_bot_container_image_self_build: "{{ matrix_architecture != 'amd64' }}" +matrix_bot_matrix_reminder_bot_container_network: "{{ matrix_bots_container_network }}" +matrix_bot_matrix_reminder_bot_container_additional_networks_auto: |- + {{ + ( + ([] if matrix_bots_homeserver_container_network == '' else [matrix_bots_homeserver_container_network]) + + + ([devture_postgres_container_network] if devture_postgres_enabled and matrix_bot_matrix_reminder_bot_database_hostname == devture_postgres_connection_hostname else []) + ) | unique + }} + +matrix_bot_matrix_reminder_bot_matrix_homeserver_url: "{{ matrix_bots_homeserver_client_api_url }}" + ###################################################################### # # /matrix-bot-matrix-reminder-bot @@ -1938,13 +2003,11 @@ matrix_bot_postmoogle_tls_key: |- matrix_playbook_bot_postmoogle_traefik_certs_dumper_waiter_services: "{% for domain in matrix_bot_postmoogle_domains %}{{ devture_traefik_certs_dumper_identifier }}-wait-for-domain@{{ domain }}.service {% endfor %}" -matrix_bot_postmoogle_systemd_required_services_list: | +matrix_bot_postmoogle_systemd_required_services_list_auto: | {{ - ['docker.service'] + matrix_bots_homeserver_systemd_services_list + - ([devture_postgres_identifier ~ '.service'] if devture_postgres_enabled else []) - + - (['matrix-synapse.service'] if matrix_synapse_enabled else []) + ([devture_postgres_identifier ~ '.service'] if devture_postgres_enabled and matrix_bot_postmoogle_database_hostname == matrix_bot_postmoogle_database_hostname else []) + (matrix_playbook_bot_postmoogle_traefik_certs_dumper_waiter_services | trim | split(' ') if matrix_playbook_reverse_proxy_type in ['playbook-managed-traefik', 'other-traefik-container'] and devture_traefik_certs_dumper_enabled else []) }} @@ -1954,6 +2017,19 @@ matrix_bot_postmoogle_database_engine: "{{ 'postgres' if devture_postgres_enable matrix_bot_postmoogle_database_hostname: "{{ devture_postgres_connection_hostname if devture_postgres_enabled else '' }}" matrix_bot_postmoogle_database_password: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'postmoogle.db', rounds=655555) | to_uuid }}" +matrix_bot_postmoogle_homeserver: "{{ matrix_bots_homeserver_client_api_url }}" + +matrix_bot_postmoogle_container_network: "{{ matrix_bots_container_network }}" + +matrix_bot_postmoogle_container_additional_networks_auto: |- + {{ + ( + ([] if matrix_bots_homeserver_container_network == '' else [matrix_bots_homeserver_container_network]) + + + ([devture_postgres_container_network] if devture_postgres_enabled and matrix_bot_matrix_reminder_bot_database_hostname == devture_postgres_connection_hostname else []) + ) | unique + }} + ###################################################################### # # /matrix-bot-postmoogle @@ -1972,6 +2048,13 @@ matrix_bot_chatgpt_enabled: false matrix_bot_chatgpt_container_image_self_build: "{{ matrix_architecture not in ['amd64', 'arm64'] }}" +matrix_bot_chatgpt_container_network: "{{ matrix_bots_container_network }}" +matrix_bot_chatgpt_container_additional_networks_auto: "{{ [] if matrix_bots_homeserver_container_network == '' else [matrix_bots_homeserver_container_network] }}" + +matrix_bot_chatgpt_matrix_homeserver_url: "{{ matrix_bots_homeserver_client_api_url }}" + +matrix_bot_chatgpt_systemd_required_services_list_auto: "{{ matrix_bots_homeserver_systemd_services_list }}" + ###################################################################### # # /matrix-bot-chatgpt @@ -2974,6 +3057,81 @@ matrix_nginx_proxy_access_log_syslog_integration_server_port: "{{ (matrix_promet ###################################################################### +###################################################################### +# # +# matrix-homeserver-proxy # +# # +###################################################################### + +# The playbook always enables the homeserver proxy for now. +# TODO - consider not enabling it if not necessary +matrix_homeserver_proxy_enabled: true + +matrix_homeserver_proxy_access_log_syslog_integration_enabled: "{{ matrix_prometheus_nginxlog_exporter_enabled }}" +matrix_homeserver_proxy_access_log_syslog_integration_server_port: "{{ (matrix_prometheus_nginxlog_exporter_container_hostname | string + ':' + matrix_prometheus_nginxlog_exporter_container_syslog_port | string) | default('') }}" + +matrix_homeserver_proxy_container_additional_networks: | + {{ + ( + ([matrix_playbook_reverse_proxyable_services_additional_network] if matrix_playbook_reverse_proxyable_services_additional_network else []) + + + ([ + { + 'synapse': matrix_synapse_container_network, + 'dendrite': matrix_dendrite_container_network, + 'conduit': matrix_conduit_container_network, + }[matrix_homeserver_implementation] | string + ]) + ) | unique + }} + +matrix_homeserver_proxy_client_api_addr: "{{ 'matrix-corporal:41080' if matrix_corporal_enabled else matrix_homeserver_container_client_api_endpoint }}" +matrix_homeserver_proxy_client_api_client_max_body_size_mb: |- + {{ + { + 'synapse': matrix_synapse_max_upload_size_mb, + 'dendrite': (matrix_dendrite_max_file_size_bytes / 1024 / 1024) | round, + 'conduit': (matrix_conduit_max_request_size / 1024 / 1024) | round, + }[matrix_homeserver_implementation]|int + }} + +matrix_homeserver_proxy_federation_api_addr: "{{ matrix_homeserver_container_federation_api_endpoint }}" + +# matrix_nginx_proxy_proxy_matrix_identity_api_enabled: "{{ matrix_ma1sd_enabled }}" +# matrix_nginx_proxy_proxy_matrix_identity_api_addr_with_container: "matrix-ma1sd:{{ matrix_ma1sd_container_port }}" +# matrix_nginx_proxy_proxy_matrix_identity_api_addr_sans_container: "127.0.0.1:{{ matrix_ma1sd_container_port }}" + +# # NOTE: we cannot disable this, even though matrix-media-repo is already natively exposed at the Traefik level. +# # See: https://github.com/spantaleev/matrix-docker-ansible-deploy/pull/3045#issuecomment-1867327001 +# matrix_nginx_proxy_proxy_media_repo_enabled: "{{ matrix_media_repo_enabled }}" +# matrix_nginx_proxy_proxy_media_repo_addr_with_container: "{{ matrix_media_repo_identifier }}:{{ matrix_media_repo_port }}" +# matrix_nginx_proxy_proxy_media_repo_addr_sans_container: "127.0.0.1:{{ matrix_media_repo_port }}" + +# matrix_nginx_proxy_proxy_matrix_user_directory_search_enabled: "{{ matrix_ma1sd_enabled }}" +# matrix_nginx_proxy_proxy_matrix_user_directory_search_addr_with_container: "{{ matrix_nginx_proxy_proxy_matrix_identity_api_addr_with_container }}" +# matrix_nginx_proxy_proxy_matrix_user_directory_search_addr_sans_container: "{{ matrix_nginx_proxy_proxy_matrix_identity_api_addr_sans_container }}" + +matrix_homeserver_proxy_systemd_wanted_services_list_auto: | + {{ + matrix_homeserver_systemd_services_list + + + (['matrix-corporal.service'] if matrix_corporal_enabled else []) + + + (['matrix-ma1sd.service'] if matrix_ma1sd_enabled else []) + + + ([(matrix_media_repo_identifier + '.service')] if matrix_media_repo_enabled else []) + }} + +# matrix_nginx_proxy_access_log_syslog_integration_enabled: "{{ matrix_prometheus_nginxlog_exporter_enabled }}" +# matrix_nginx_proxy_access_log_syslog_integration_server_port: "{{ (matrix_prometheus_nginxlog_exporter_container_hostname | string +':'+ matrix_prometheus_nginxlog_exporter_container_syslog_port | string) | default('') }}" + +###################################################################### +# # +# /matrix-homeserver-proxy # +# # +###################################################################### + + ######################################################################## # # # com.devture.ansible.role.postgres # @@ -4157,7 +4315,7 @@ matrix_sliding_sync_container_additional_networks: | ( ([matrix_playbook_reverse_proxyable_services_additional_network] if matrix_playbook_reverse_proxyable_services_additional_network else []) + - ([matrix_nginx_proxy_container_network] if matrix_nginx_proxy_enabled and matrix_nginx_proxy_container_network != matrix_sliding_sync_container_network else []) + ([] if matrix_homeserver_container_network in ['', matrix_sliding_sync_container_network] else [matrix_homeserver_container_network]) + ([devture_postgres_container_network] if devture_postgres_enabled and devture_postgres_container_network != matrix_sliding_sync_container_network else []) ) | unique @@ -4172,11 +4330,9 @@ matrix_sliding_sync_systemd_required_services_list: | {{ ['docker.service'] + - ['matrix-' + matrix_homeserver_implementation + '.service'] + matrix_homeserver_systemd_services_list + ([devture_postgres_identifier ~ '.service'] if devture_postgres_enabled else []) - + - (['matrix-nginx-proxy.service'] if matrix_nginx_proxy_enabled else []) }} matrix_sliding_sync_environment_variable_syncv3_secret: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'ss.secret', rounds=655555) | to_uuid }}" @@ -4184,9 +4340,6 @@ matrix_sliding_sync_environment_variable_syncv3_secret: "{{ '%s' | format(matrix matrix_sliding_sync_database_hostname: "{{ devture_postgres_connection_hostname if devture_postgres_enabled else '' }}" matrix_sliding_sync_database_password: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'ss.db', rounds=655555) | to_uuid }}" -# Starting from version `0.6.0` conduit natively supports some sync v3 (sliding-sync) features. -matrix_homeserver_sliding_sync_url: "{{ matrix_sliding_sync_base_url if matrix_sliding_sync_enabled else matrix_homeserver_url if matrix_conduit_enabled else '' }}" - ###################################################################### # # /matrix-sliding-sync diff --git a/roles/custom/matrix-base/defaults/main.yml b/roles/custom/matrix-base/defaults/main.yml index 183f1db33..d1967ba51 100644 --- a/roles/custom/matrix-base/defaults/main.yml +++ b/roles/custom/matrix-base/defaults/main.yml @@ -19,6 +19,30 @@ matrix_bridges_encryption_enabled: false # Global var to enable/disable relay mode across all bridges with relay mode support matrix_bridges_relay_enabled: false +# A container network where all bridges would live. +matrix_bridges_container_network: matrix-bridges + +# The container network that the homeserver lives on and bridges should be connected to +matrix_bridges_homeserver_container_network: "{{ matrix_homeserver_container_network }}" + +# The URL where bridges can reach the homeserver. +matrix_bridges_homeserver_client_api_url: "{{ matrix_homeserver_container_url }}" + +# The systemd services (representing the homeserver) that bridges should depend on +matrix_bridges_homeserver_systemd_services_list: "{{ matrix_homeserver_systemd_services_list }}" + +# A container network where all bots would live. +matrix_bots_container_network: matrix-bots + +# The container network that the homeserver lives on and bots should be connected to +matrix_bots_homeserver_container_network: "{{ matrix_homeserver_container_network }}" + +# The URL where bots can reach the homeserver. +matrix_bots_homeserver_client_api_url: "{{ matrix_homeserver_container_url }}" + +# The systemd services (representing the homeserver) that bots should depend on +matrix_bots_homeserver_systemd_services_list: "{{ matrix_homeserver_systemd_services_list }}" + # matrix_homeserver_enabled controls whether to enable the homeserver systemd service, etc. # # Unless you're wrapping this playbook in another one @@ -146,15 +170,27 @@ matrix_host_command_openssl: "/usr/bin/env openssl" matrix_homeserver_url: "https://{{ matrix_server_fqn_matrix }}" -# Specifies where the homeserver's Client-Server API is on the container network. -# Where this is depends on whether there's a reverse-proxy in front of the homeserver, which homeserver it is, etc. -# This likely gets overriden elsewhere. -matrix_homeserver_container_url: "" +# Specifies on which container network the homeserver is. +matrix_homeserver_container_network: "" -# Specifies where the homeserver's Federation API is on the container network. +# Specifies which systemd services are responsible for the homeserver +matrix_homeserver_systemd_services_list: [] + +# Specifies where the homeserver's Client-Server API is on the container network (matrix_homeserver_container_network). +matrix_homeserver_container_url: "http://{{ matrix_homeserver_container_client_api_endpoint }}" + +# Specifies where the homeserver's Client-Server API is on the container network (matrix_homeserver_container_network). # Where this is depends on whether there's a reverse-proxy in front of the homeserver, which homeserver it is, etc. # This likely gets overriden elsewhere. -matrix_homeserver_container_federation_url: "" +matrix_homeserver_container_client_api_endpoint: "" + +# Specifies where the homeserver's Federation API is on the container network (matrix_homeserver_container_network). +matrix_homeserver_container_federation_url: "http://{{ matrix_homeserver_container_federation_api_endpoint }}" + +# Specifies where the homeserver's Federation API is on the container network (matrix_homeserver_container_network). +# Where this is depends on whether there's a reverse-proxy in front of the homeserver, which homeserver it is, etc. +# This likely gets overriden elsewhere. +matrix_homeserver_container_federation_api_endpoint: "" # Specifies the public url of the Sync v3 (sliding-sync) API. # This will be used to set the `org.matrix.msc3575.proxy` property in `/.well-known/matrix/client`. @@ -294,6 +330,15 @@ matrix_well_known_matrix_support_enabled: false matrix_homeserver_container_extra_arguments_auto: [] matrix_homeserver_app_service_config_files_auto: [] +# Controls whether various services should expose metrics publicly. +# If Prometheus is operating on the same machine, exposing metrics publicly is not necessary. +matrix_metrics_exposure_enabled: false +matrix_metrics_exposure_hostname: "{{ matrix_server_fqn_matrix }}" +matrix_metrics_exposure_path_prefix: /metrics +matrix_metrics_exposure_http_basic_auth_enabled: false +# See https://doc.traefik.io/traefik/middlewares/http/basicauth/#users +matrix_metrics_exposure_http_basic_auth_users: '' + # Specifies the type of reverse-proxy used by the playbook. # # Changing this has an effect on whether a reverse-proxy is installed at all and what its type is, diff --git a/roles/custom/matrix-base/tasks/validate_config.yml b/roles/custom/matrix-base/tasks/validate_config.yml index c663ab2ee..740fc839a 100644 --- a/roles/custom/matrix-base/tasks/validate_config.yml +++ b/roles/custom/matrix-base/tasks/validate_config.yml @@ -44,8 +44,8 @@ - {'var': matrix_domain, 'value': "{{ matrix_domain | default('') }}"} - {'var': matrix_server_fqn_matrix, 'value': "{{ matrix_server_fqn_matrix | default('') }}"} - {'var': matrix_server_fqn_element, 'value': "{{ matrix_server_fqn_element | default('') }}"} - - {'var': matrix_homeserver_container_url, 'value': "{{ matrix_homeserver_container_url | default('') }}"} - - {'var': matrix_homeserver_container_federation_url, 'value': "{{ matrix_homeserver_container_federation_url | default('') }}"} + - {'var': matrix_homeserver_container_client_api_endpoint, 'value': "{{ matrix_homeserver_container_client_api_endpoint | default('') }}"} + - {'var': matrix_homeserver_container_federation_api_endpoint, 'value': "{{ matrix_homeserver_container_federation_api_endpoint | default('') }}"} - {'var': matrix_architecture, 'value': "{{ matrix_architecture | default('') }}"} when: "item.value is none or item.value == ''" diff --git a/roles/custom/matrix-bot-chatgpt/defaults/main.yml b/roles/custom/matrix-bot-chatgpt/defaults/main.yml index 823452fc0..957501b01 100644 --- a/roles/custom/matrix-bot-chatgpt/defaults/main.yml +++ b/roles/custom/matrix-bot-chatgpt/defaults/main.yml @@ -26,11 +26,20 @@ matrix_bot_chatgpt_container_src_path: "{{ matrix_bot_chatgpt_base_path }}/conta # We use a small value here, because this container does not seem to handle the SIGTERM signal. matrix_bot_chatgpt_container_stop_grace_time_seconds: 1 +matrix_bot_chatgpt_container_network: "" + +matrix_bot_chatgpt_container_additional_networks: "{{ matrix_bot_chatgpt_container_additional_networks_auto + matrix_bot_chatgpt_container_additional_networks_custom }}" +matrix_bot_chatgpt_container_additional_networks_auto: [] +matrix_bot_chatgpt_container_additional_networks_custom: [] + # A list of extra arguments to pass to the container matrix_bot_chatgpt_container_extra_arguments: [] # List of systemd services that matrix-bot-chatgpt.service depends on -matrix_bot_chatgpt_systemd_required_services_list: ['docker.service'] +matrix_bot_chatgpt_systemd_required_services_list: "{{ matrix_bot_chatgpt_systemd_required_services_list_default + matrix_bot_chatgpt_systemd_required_services_list_auto + matrix_bot_chatgpt_systemd_required_services_list_custom }}" +matrix_bot_chatgpt_systemd_required_services_list_default: ['docker.service'] +matrix_bot_chatgpt_systemd_required_services_list_auto: [] +matrix_bot_chatgpt_systemd_required_services_list_custom: [] # List of systemd services that matrix-bot-chatgpt.service wants matrix_bot_chatgpt_systemd_wanted_services_list: [] @@ -47,7 +56,7 @@ matrix_bot_chatgpt_keyv_bot_storage: true # Matrix Static Settings (required, see notes) # Defaults to "https://matrix.org" -matrix_bot_chatgpt_matrix_homeserver_url: "{{ matrix_homeserver_container_url }}" # MATRIX_HOMESERVER_URL= +matrix_bot_chatgpt_matrix_homeserver_url: "" # MATRIX_HOMESERVER_URL= # With the @ and :DOMAIN, ie @SOMETHING:DOMAIN, needs to be set, created manually beforehand. matrix_bot_chatgpt_matrix_bot_username_localpart: 'bot.chatgpt' matrix_bot_chatgpt_matrix_bot_username: "@{{ matrix_bot_chatgpt_matrix_bot_username_localpart }}:{{ matrix_domain }}" # MATRIX_BOT_USERNAME= diff --git a/roles/custom/matrix-bot-chatgpt/tasks/install.yml b/roles/custom/matrix-bot-chatgpt/tasks/install.yml index ef31df066..c637e167c 100644 --- a/roles/custom/matrix-bot-chatgpt/tasks/install.yml +++ b/roles/custom/matrix-bot-chatgpt/tasks/install.yml @@ -56,6 +56,11 @@ path: "{{ matrix_bot_chatgpt_container_src_path }}" pull: true +- name: Ensure chatgpt container network is created + community.general.docker_network: + name: "{{ matrix_bot_chatgpt_container_network }}" + driver: bridge + - name: Ensure matrix-bot-chatgpt.service installed ansible.builtin.template: src: "{{ role_path }}/templates/systemd/matrix-bot-chatgpt.service.j2" diff --git a/roles/custom/matrix-bot-chatgpt/tasks/validate_config.yml b/roles/custom/matrix-bot-chatgpt/tasks/validate_config.yml index c6771823e..44f103e01 100644 --- a/roles/custom/matrix-bot-chatgpt/tasks/validate_config.yml +++ b/roles/custom/matrix-bot-chatgpt/tasks/validate_config.yml @@ -8,6 +8,8 @@ with_items: - {'name': 'matrix_bot_chatgpt_openai_api_key', when: true} - {'name': 'matrix_bot_chatgpt_matrix_bot_username', when: true} + - {'name': 'matrix_bot_chatgpt_container_network', when: true} + - {'name': 'matrix_bot_chatgpt_matrix_homeserver_url', when: true} - name: Fail if OpenAI configuration not up-to-date. ansible.builtin.fail: diff --git a/roles/custom/matrix-bot-chatgpt/templates/systemd/matrix-bot-chatgpt.service.j2 b/roles/custom/matrix-bot-chatgpt/templates/systemd/matrix-bot-chatgpt.service.j2 index e27b018f5..01b0763a4 100644 --- a/roles/custom/matrix-bot-chatgpt/templates/systemd/matrix-bot-chatgpt.service.j2 +++ b/roles/custom/matrix-bot-chatgpt/templates/systemd/matrix-bot-chatgpt.service.j2 @@ -16,7 +16,7 @@ Environment="HOME={{ devture_systemd_docker_base_systemd_unit_home_path }}" ExecStartPre=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} stop --time={{ matrix_bot_chatgpt_container_stop_grace_time_seconds }} matrix-bot-chatgpt 2>/dev/null || true' ExecStartPre=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} rm matrix-bot-chatgpt 2>/dev/null || true' -ExecStart={{ devture_systemd_docker_base_host_command_docker }} run \ +ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} create \ --rm \ --name=matrix-bot-chatgpt \ --log-driver=none \ @@ -24,7 +24,7 @@ ExecStart={{ devture_systemd_docker_base_host_command_docker }} run \ --cap-drop=ALL \ --read-only \ --tmpfs /tmp \ - --network={{ matrix_docker_network }} \ + --network={{ matrix_bot_chatgpt_container_network }} \ --env-file={{ matrix_bot_chatgpt_config_path }}/env \ --mount type=bind,src={{ matrix_bot_chatgpt_data_path }},dst=/data \ --env HOME=/data/home \ @@ -33,6 +33,12 @@ ExecStart={{ devture_systemd_docker_base_host_command_docker }} run \ {% endfor %} {{ matrix_bot_chatgpt_container_image }} +{% for network in matrix_bot_chatgpt_container_additional_networks %} +ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} network connect {{ network }} matrix-bot-chatgpt +{% endfor %} + +ExecStart={{ devture_systemd_docker_base_host_command_docker }} start --attach matrix-bot-chatgpt + ExecStop=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} stop --time={{ matrix_bot_chatgpt_container_stop_grace_time_seconds }} matrix-bot-chatgpt 2>/dev/null || true' ExecStop=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} rm matrix-bot-chatgpt 2>/dev/null || true' Restart=always diff --git a/roles/custom/matrix-bot-matrix-reminder-bot/defaults/main.yml b/roles/custom/matrix-bot-matrix-reminder-bot/defaults/main.yml index 2f43024a3..21275a430 100644 --- a/roles/custom/matrix-bot-matrix-reminder-bot/defaults/main.yml +++ b/roles/custom/matrix-bot-matrix-reminder-bot/defaults/main.yml @@ -24,13 +24,21 @@ matrix_bot_matrix_reminder_bot_command_prefix: "!" # A list of extra arguments to pass to the container matrix_bot_matrix_reminder_bot_container_extra_arguments: [] +matrix_bot_matrix_reminder_bot_container_network: "" + +matrix_bot_matrix_reminder_bot_container_additional_networks: "{{ matrix_bot_matrix_reminder_bot_container_additional_networks_auto + matrix_bot_matrix_reminder_bot_container_additional_networks_custom }}" +matrix_bot_matrix_reminder_bot_container_additional_networks_auto: [] +matrix_bot_matrix_reminder_bot_container_additional_networks_custom: [] + # List of systemd services that matrix-bot-matrix-reminder-bot.service depends on -matrix_bot_matrix_reminder_bot_systemd_required_services_list: ['docker.service'] +matrix_bot_matrix_reminder_bot_systemd_required_services_list: "{{ matrix_bot_matrix_reminder_bot_systemd_required_services_list_default + matrix_bot_matrix_reminder_bot_systemd_required_services_list_auto + matrix_bot_matrix_reminder_bot_systemd_required_services_list_custom }}" +matrix_bot_matrix_reminder_bot_systemd_required_services_list_default: ['docker.service'] +matrix_bot_matrix_reminder_bot_systemd_required_services_list_auto: [] +matrix_bot_matrix_reminder_bot_systemd_required_services_list_custom: [] # List of systemd services that matrix-bot-matrix-reminder-bot.service wants matrix_bot_matrix_reminder_bot_systemd_wanted_services_list: [] - # Database-related configuration fields. # # To use SQLite, stick to these defaults. @@ -68,7 +76,7 @@ matrix_bot_matrix_reminder_bot_matrix_user_id: '@{{ matrix_bot_matrix_reminder_b # The password that the bot uses to authenticate. matrix_bot_matrix_reminder_bot_matrix_user_password: '' -matrix_bot_matrix_reminder_bot_matrix_homeserver_url: "{{ matrix_homeserver_container_url }}" +matrix_bot_matrix_reminder_bot_matrix_homeserver_url: "" # The timezone to use when creating reminders. # Examples: 'Europe/London', 'Etc/UTC' diff --git a/roles/custom/matrix-bot-matrix-reminder-bot/tasks/validate_config.yml b/roles/custom/matrix-bot-matrix-reminder-bot/tasks/validate_config.yml index f6e7afdf6..072e392bd 100644 --- a/roles/custom/matrix-bot-matrix-reminder-bot/tasks/validate_config.yml +++ b/roles/custom/matrix-bot-matrix-reminder-bot/tasks/validate_config.yml @@ -8,6 +8,8 @@ with_items: - {'name': 'matrix_bot_matrix_reminder_bot_matrix_user_password', when: true} - {'name': 'matrix_bot_matrix_reminder_bot_reminders_timezone', when: true} + - {'name': 'matrix_bot_matrix_reminder_bot_container_network', when: true} + - {'name': 'matrix_bot_matrix_reminder_bot_matrix_homeserver_url', when: true} - {'name': 'matrix_bot_matrix_reminder_bot_database_hostname', when: "{{ matrix_bot_matrix_reminder_bot_database_engine == 'postgres' }}"} - name: (Deprecation) Catch and report renamed matrix-reminder-bot settings diff --git a/roles/custom/matrix-bot-matrix-reminder-bot/templates/systemd/matrix-bot-matrix-reminder-bot.service.j2 b/roles/custom/matrix-bot-matrix-reminder-bot/templates/systemd/matrix-bot-matrix-reminder-bot.service.j2 index 70c02224a..ecd59bd7b 100644 --- a/roles/custom/matrix-bot-matrix-reminder-bot/templates/systemd/matrix-bot-matrix-reminder-bot.service.j2 +++ b/roles/custom/matrix-bot-matrix-reminder-bot/templates/systemd/matrix-bot-matrix-reminder-bot.service.j2 @@ -16,12 +16,14 @@ Environment="HOME={{ devture_systemd_docker_base_systemd_unit_home_path }}" ExecStartPre=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} stop --time={{ devture_systemd_docker_base_container_stop_grace_time_seconds }} matrix-bot-matrix-reminder-bot 2>/dev/null || true' ExecStartPre=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} rm matrix-bot-matrix-reminder-bot 2>/dev/null || true' -ExecStart={{ devture_systemd_docker_base_host_command_docker }} run --rm --name matrix-bot-matrix-reminder-bot \ +ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} create \ + --rm \ + --name=matrix-bot-matrix-reminder-bot \ --log-driver=none \ --user={{ matrix_user_uid }}:{{ matrix_user_gid }} \ --cap-drop=ALL \ --read-only \ - --network={{ matrix_docker_network }} \ + --network={{ matrix_bot_matrix_reminder_bot_container_network }} \ -e 'TZ={{ matrix_bot_matrix_reminder_bot_reminders_timezone }}' \ --mount type=bind,src={{ matrix_bot_matrix_reminder_bot_config_path }},dst=/config,ro \ --mount type=bind,src={{ matrix_bot_matrix_reminder_bot_data_path }},dst=/data \ @@ -32,6 +34,12 @@ ExecStart={{ devture_systemd_docker_base_host_command_docker }} run --rm --name {{ matrix_bot_matrix_reminder_bot_docker_image }} \ -c "matrix-reminder-bot /config/config.yaml" +{% for network in matrix_bot_matrix_reminder_bot_container_additional_networks %} +ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} network connect {{ network }} matrix-bot-matrix-reminder-bot +{% endfor %} + +ExecStart={{ devture_systemd_docker_base_host_command_docker }} start --attach matrix-bot-matrix-reminder-bot + ExecStop=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} stop --time={{ devture_systemd_docker_base_container_stop_grace_time_seconds }} matrix-bot-matrix-reminder-bot 2>/dev/null || true' ExecStop=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} rm matrix-bot-matrix-reminder-bot 2>/dev/null || true' Restart=always diff --git a/roles/custom/matrix-bot-postmoogle/defaults/main.yml b/roles/custom/matrix-bot-postmoogle/defaults/main.yml index 580dcfed5..fc7d9749a 100644 --- a/roles/custom/matrix-bot-postmoogle/defaults/main.yml +++ b/roles/custom/matrix-bot-postmoogle/defaults/main.yml @@ -19,16 +19,24 @@ matrix_bot_postmoogle_base_path: "{{ matrix_base_data_path }}/postmoogle" matrix_bot_postmoogle_config_path: "{{ matrix_bot_postmoogle_base_path }}/config" matrix_bot_postmoogle_data_path: "{{ matrix_bot_postmoogle_base_path }}/data" +matrix_bot_postmoogle_container_network: "" + +matrix_bot_postmoogle_container_additional_networks: "{{ matrix_bot_postmoogle_container_additional_networks_auto + matrix_bot_postmoogle_container_additional_networks_custom }}" +matrix_bot_postmoogle_container_additional_networks_auto: [] +matrix_bot_postmoogle_container_additional_networks_custom: [] + # A list of extra arguments to pass to the container matrix_bot_postmoogle_container_extra_arguments: [] # List of systemd services that matrix-bot-postmoogle.service depends on -matrix_bot_postmoogle_systemd_required_services_list: ['docker.service'] +matrix_bot_postmoogle_systemd_required_services_list: "{{ matrix_bot_postmoogle_systemd_required_services_list_default + matrix_bot_postmoogle_systemd_required_services_list_auto + matrix_bot_postmoogle_systemd_required_services_list_custom }}" +matrix_bot_postmoogle_systemd_required_services_list_default: ['docker.service'] +matrix_bot_postmoogle_systemd_required_services_list_auto: [] +matrix_bot_postmoogle_systemd_required_services_list_custom: [] # List of systemd services that matrix-bot-postmoogle.service wants matrix_bot_postmoogle_systemd_wanted_services_list: [] - # Database-related configuration fields. # # To use SQLite, stick to these defaults. @@ -75,7 +83,7 @@ matrix_bot_postmoogle_password: '' # Alternative to password - shared secret requires matrix_bot_postmoogle_login to be MXID matrix_bot_postmoogle_sharedsecret: '' -matrix_bot_postmoogle_homeserver: "{{ matrix_homeserver_container_url }}" +matrix_bot_postmoogle_homeserver: "" # Command prefix matrix_bot_postmoogle_prefix: '!pm' diff --git a/roles/custom/matrix-bot-postmoogle/tasks/setup_install.yml b/roles/custom/matrix-bot-postmoogle/tasks/setup_install.yml index ed2bcc9d6..265400d81 100644 --- a/roles/custom/matrix-bot-postmoogle/tasks/setup_install.yml +++ b/roles/custom/matrix-bot-postmoogle/tasks/setup_install.yml @@ -79,6 +79,11 @@ pull: true when: "matrix_bot_postmoogle_container_image_self_build | bool" +- name: Ensure postmoogle container network is created + community.general.docker_network: + name: "{{ matrix_bot_postmoogle_container_network }}" + driver: bridge + - name: Ensure matrix-bot-postmoogle.service installed ansible.builtin.template: src: "{{ role_path }}/templates/systemd/matrix-bot-postmoogle.service.j2" diff --git a/roles/custom/matrix-bot-postmoogle/tasks/validate_config.yml b/roles/custom/matrix-bot-postmoogle/tasks/validate_config.yml index 1e31bd4f6..77f03356a 100644 --- a/roles/custom/matrix-bot-postmoogle/tasks/validate_config.yml +++ b/roles/custom/matrix-bot-postmoogle/tasks/validate_config.yml @@ -7,4 +7,6 @@ when: "item.when | bool and vars[item.name] == ''" with_items: - {'name': 'matrix_bot_postmoogle_password', when: true} + - {'name': 'matrix_bot_postmoogle_container_network', when: true} + - {'name': 'matrix_bot_postmoogle_homeserver', when: true} - {'name': 'matrix_bot_postmoogle_database_hostname', when: "{{ matrix_bot_postmoogle_database_engine == 'postgres' }}"} diff --git a/roles/custom/matrix-bot-postmoogle/templates/systemd/matrix-bot-postmoogle.service.j2 b/roles/custom/matrix-bot-postmoogle/templates/systemd/matrix-bot-postmoogle.service.j2 index 17ebece27..4f6d0ced2 100644 --- a/roles/custom/matrix-bot-postmoogle/templates/systemd/matrix-bot-postmoogle.service.j2 +++ b/roles/custom/matrix-bot-postmoogle/templates/systemd/matrix-bot-postmoogle.service.j2 @@ -16,12 +16,14 @@ Environment="HOME={{ devture_systemd_docker_base_systemd_unit_home_path }}" ExecStartPre=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} stop --time={{ devture_systemd_docker_base_container_stop_grace_time_seconds }} matrix-bot-postmoogle 2>/dev/null || true' ExecStartPre=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} rm matrix-bot-postmoogle 2>/dev/null || true' -ExecStart={{ devture_systemd_docker_base_host_command_docker }} run --rm --name matrix-bot-postmoogle \ +ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} create \ + --rm \ + --name=matrix-bot-postmoogle \ --log-driver=none \ --user={{ matrix_user_uid }}:{{ matrix_user_gid }} \ --cap-drop=ALL \ --read-only \ - --network={{ matrix_docker_network }} \ + --network={{ matrix_bot_postmoogle_container_network }} \ --env-file={{ matrix_bot_postmoogle_config_path }}/env \ -p {{ matrix_bot_postmoogle_smtp_host_bind_port }}:{{ matrix_bot_postmoogle_port }} \ {% if matrix_bot_postmoogle_ssl_path %} @@ -36,6 +38,12 @@ ExecStart={{ devture_systemd_docker_base_host_command_docker }} run --rm --name {% endfor %} {{ matrix_bot_postmoogle_docker_image }} +{% for network in matrix_bot_postmoogle_container_additional_networks %} +ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} network connect {{ network }} matrix-bot-postmoogle +{% endfor %} + +ExecStart={{ devture_systemd_docker_base_host_command_docker }} start --attach matrix-bot-postmoogle + ExecStop=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} stop --time={{ devture_systemd_docker_base_container_stop_grace_time_seconds }} matrix-bot-postmoogle 2>/dev/null || true' ExecStop=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} rm matrix-bot-postmoogle 2>/dev/null || true' Restart=always diff --git a/roles/custom/matrix-bridge-hookshot/defaults/main.yml b/roles/custom/matrix-bridge-hookshot/defaults/main.yml index 7d6c4e7df..378ca0a77 100644 --- a/roles/custom/matrix-bridge-hookshot/defaults/main.yml +++ b/roles/custom/matrix-bridge-hookshot/defaults/main.yml @@ -224,7 +224,10 @@ matrix_hookshot_container_network: "{{ matrix_docker_network }}" matrix_hookshot_container_extra_arguments: [] # List of systemd services that service depends on. -matrix_hookshot_systemd_required_services_list: ['docker.service'] +matrix_hookshot_systemd_required_services_list: "{{ matrix_hookshot_systemd_required_services_list_default + matrix_hookshot_systemd_required_services_list_auto + matrix_hookshot_systemd_required_services_list_custom }}" +matrix_hookshot_systemd_required_services_list_default: ['docker.service'] +matrix_hookshot_systemd_required_services_list_auto: [] +matrix_hookshot_systemd_required_services_list_custom: [] # List of systemd services that service wants matrix_hookshot_systemd_wanted_services_list: [] diff --git a/roles/custom/matrix-bridge-hookshot/tasks/main.yml b/roles/custom/matrix-bridge-hookshot/tasks/main.yml index 44ad5229b..8a98ee999 100644 --- a/roles/custom/matrix-bridge-hookshot/tasks/main.yml +++ b/roles/custom/matrix-bridge-hookshot/tasks/main.yml @@ -18,8 +18,10 @@ - tags: - setup-all - setup-hookshot + - setup-bridge-hookshot - install-all - install-hookshot + - install-bridge-hookshot block: - when: matrix_hookshot_enabled | bool ansible.builtin.include_tasks: "{{ role_path }}/tasks/validate_config.yml" @@ -30,6 +32,7 @@ - tags: - setup-all - setup-hookshot + - setup-bridge-hookshot block: - when: not matrix_hookshot_enabled | bool ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_uninstall.yml" diff --git a/roles/custom/matrix-bridge-mautrix-facebook/defaults/main.yml b/roles/custom/matrix-bridge-mautrix-facebook/defaults/main.yml index 9d9439b38..ae6fe7dc5 100644 --- a/roles/custom/matrix-bridge-mautrix-facebook/defaults/main.yml +++ b/roles/custom/matrix-bridge-mautrix-facebook/defaults/main.yml @@ -20,22 +20,69 @@ matrix_mautrix_facebook_docker_src_files_path: "{{ matrix_mautrix_facebook_base_ matrix_mautrix_facebook_command_prefix: "!fb" -# Whether or not the public-facing endpoints should be enabled (web-based login) -matrix_mautrix_facebook_appservice_public_enabled: true - -# Mautrix Facebook public endpoint to log in to Facebook -matrix_mautrix_facebook_public_endpoint: '' - matrix_mautrix_facebook_homeserver_address: "{{ matrix_homeserver_container_url }}" matrix_mautrix_facebook_homeserver_domain: '{{ matrix_domain }}' + +# Whether or not the public-facing endpoints should be enabled (web-based login) +matrix_mautrix_facebook_appservice_public_enabled: false +# Mautrix Facebook public endpoint to log in to Facebook +matrix_mautrix_facebook_appservice_public_prefix: '' +matrix_mautrix_facebook_appservice_public_hostname: '' +matrix_mautrix_facebook_appservice_public_external: "{{ ('https://' + matrix_mautrix_facebook_appservice_public_hostname + matrix_mautrix_facebook_appservice_public_prefix) if matrix_mautrix_facebook_appservice_public_enabled else '' }}" + matrix_mautrix_facebook_appservice_address: 'http://matrix-mautrix-facebook:29319' -matrix_mautrix_facebook_appservice_public_external: 'https://{{ matrix_server_fqn_matrix }}{{ matrix_mautrix_facebook_public_endpoint }}' + +matrix_mautrix_facebook_container_network: "" + +matrix_mautrix_facebook_container_additional_networks: "{{ matrix_mautrix_facebook_container_additional_networks_auto + matrix_mautrix_facebook_container_additional_networks_custom }}" +matrix_mautrix_facebook_container_additional_networks_auto: [] +matrix_mautrix_facebook_container_additional_networks_custom: [] # A list of extra arguments to pass to the container matrix_mautrix_facebook_container_extra_arguments: [] +# matrix_mautrix_facebook_container_labels_traefik_enabled controls whether labels to assist a Traefik reverse-proxy will be attached to the container. +# See `../templates/labels.j2` for details. +# +# To inject your own other container labels, see `matrix_mautrix_facebook_container_labels_additional_labels`. +matrix_mautrix_facebook_container_labels_traefik_enabled: true +matrix_mautrix_facebook_container_labels_traefik_docker_network: "{{ matrix_mautrix_facebook_container_network }}" +matrix_mautrix_facebook_container_labels_traefik_entrypoints: web-secure +matrix_mautrix_facebook_container_labels_traefik_tls_certResolver: default + +# Controls whether labels will be added that expose mautrix-facebook's public endpoint +matrix_mautrix_facebook_container_labels_public_endpoint_enabled: "{{ matrix_mautrix_facebook_appservice_public_enabled }}" +matrix_mautrix_facebook_container_labels_public_endpoint_traefik_rule: "Host(`{{ matrix_mautrix_facebook_appservice_public_hostname }}`) && PathPrefix(`{{ matrix_mautrix_facebook_appservice_public_prefix }}`)" +matrix_mautrix_facebook_container_labels_public_endpoint_traefik_priority: 0 +matrix_mautrix_facebook_container_labels_public_endpoint_traefik_entrypoints: "{{ matrix_mautrix_facebook_container_labels_traefik_entrypoints }}" +matrix_mautrix_facebook_container_labels_public_endpoint_traefik_tls: "{{ matrix_mautrix_facebook_container_labels_public_endpoint_traefik_entrypoints != 'web' }}" +matrix_mautrix_facebook_container_labels_public_endpoint_traefik_tls_certResolver: "{{ matrix_mautrix_facebook_container_labels_traefik_tls_certResolver }}" # noqa var-naming + +# Controls whether labels will be added that expose mautrix-facebook's metrics +matrix_mautrix_facebook_container_labels_metrics_enabled: "{{ matrix_mautrix_facebook_metrics_enabled and matrix_mautrix_facebook_metrics_proxying_enabled }}" +matrix_mautrix_facebook_container_labels_metrics_traefik_rule: "Host(`{{ matrix_mautrix_facebook_metrics_proxying_hostname }}`) && PathPrefix(`{{ matrix_mautrix_facebook_metrics_proxying_path_prefix }}`)" +matrix_mautrix_facebook_container_labels_metrics_traefik_priority: 0 +matrix_mautrix_facebook_container_labels_metrics_traefik_entrypoints: "{{ matrix_mautrix_facebook_container_labels_traefik_entrypoints }}" +matrix_mautrix_facebook_container_labels_metrics_traefik_tls: "{{ matrix_mautrix_facebook_container_labels_public_endpoint_traefik_entrypoints != 'web' }}" +matrix_mautrix_facebook_container_labels_metrics_traefik_tls_certResolver: "{{ matrix_mautrix_facebook_container_labels_traefik_tls_certResolver }}" # noqa var-naming +matrix_mautrix_facebook_container_labels_metrics_middleware_basic_auth_enabled: false +# See: https://doc.traefik.io/traefik/middlewares/http/basicauth/#users +matrix_mautrix_facebook_container_labels_metrics_middleware_basic_auth_users: '' + +# matrix_mautrix_facebook_container_labels_additional_labels contains a multiline string with additional labels to add to the container label file. +# See `../templates/labels.j2` for details. +# +# Example: +# matrix_mautrix_facebook_container_labels_additional_labels: | +# my.label=1 +# another.label="here" +matrix_mautrix_facebook_container_labels_additional_labels: '' + # List of systemd services that matrix-mautrix-facebook.service depends on. -matrix_mautrix_facebook_systemd_required_services_list: ['docker.service'] +matrix_mautrix_facebook_systemd_required_services_list: "{{ matrix_mautrix_facebook_systemd_required_services_list_default + matrix_mautrix_facebook_systemd_required_services_list_auto + matrix_mautrix_facebook_systemd_required_services_list_custom }}" +matrix_mautrix_facebook_systemd_required_services_list_default: ['docker.service'] +matrix_mautrix_facebook_systemd_required_services_list_auto: [] +matrix_mautrix_facebook_systemd_required_services_list_custom: [] # List of systemd services that matrix-mautrix-facebook.service wants matrix_mautrix_facebook_systemd_wanted_services_list: [] @@ -52,10 +99,10 @@ matrix_mautrix_facebook_federate_rooms: true # If metrics need to be consumed by another (external) Prometheus server, consider exposing them via `matrix_mautrix_facebook_metrics_proxying_enabled`. matrix_mautrix_facebook_metrics_enabled: false -# Controls whether metrics should be proxied (exposed) on `matrix.DOMAIN/metrics/mautrix-facebook`. -# This will only work take effect if `matrix_nginx_proxy_proxy_matrix_metrics_enabled: true`. -# See the `matrix-nginx-proxy` role for details about enabling `matrix_nginx_proxy_proxy_matrix_metrics_enabled`. +# Controls whether metrics should be exposed on `matrix.DOMAIN/metrics/mautrix-facebook`. matrix_mautrix_facebook_metrics_proxying_enabled: false +matrix_mautrix_facebook_metrics_proxying_hostname: '' +matrix_mautrix_facebook_metrics_proxying_path_prefix: '' matrix_mautrix_facebook_bridge_permissions: | {{ diff --git a/roles/custom/matrix-bridge-mautrix-facebook/tasks/inject_into_nginx_proxy.yml b/roles/custom/matrix-bridge-mautrix-facebook/tasks/inject_into_nginx_proxy.yml deleted file mode 100644 index 17e2b138d..000000000 --- a/roles/custom/matrix-bridge-mautrix-facebook/tasks/inject_into_nginx_proxy.yml +++ /dev/null @@ -1,69 +0,0 @@ ---- - -- name: Fail if matrix-nginx-proxy role already executed - ansible.builtin.fail: - msg: >- - Trying to append Mautrix Facebook's reverse-proxying configuration to matrix-nginx-proxy, - but it's pointless since the matrix-nginx-proxy role had already executed. - To fix this, please change the order of roles in your playbook, - so that the matrix-nginx-proxy role would run after the matrix-bridge-mautrix-facebook role. - when: matrix_nginx_proxy_role_executed | default(False) | bool - -- name: Generate Mautrix Facebook proxying configuration for matrix-nginx-proxy - ansible.builtin.set_fact: - matrix_mautrix_facebook_matrix_nginx_proxy_configuration: | - location {{ matrix_mautrix_facebook_public_endpoint }} { - {% if matrix_nginx_proxy_enabled | default(False) %} - {# Use the embedded DNS resolver in Docker containers to discover the service #} - resolver 127.0.0.11 valid=5s; - set $backend "matrix-mautrix-facebook:29319"; - proxy_pass http://$backend; - {% else %} - {# Generic configuration for use outside of our container setup #} - proxy_pass http://127.0.0.1:9008; - {% endif %} - } - -- name: Register Mautrix Facebook proxying configuration with matrix-nginx-proxy - ansible.builtin.set_fact: - matrix_nginx_proxy_proxy_matrix_additional_server_configuration_blocks: | - {{ - matrix_nginx_proxy_proxy_matrix_additional_server_configuration_blocks | default([]) - + - [matrix_mautrix_facebook_matrix_nginx_proxy_configuration] - }} - -- name: Warn about reverse-proxying if matrix-nginx-proxy not used - ansible.builtin.debug: - msg: >- - NOTE: You've enabled the Mautrix Facebook bridge but are not using the matrix-nginx-proxy - reverse proxy. - Please make sure that you're proxying the `{{ matrix_mautrix_facebook_public_endpoint }}` - URL endpoint to the matrix-mautrix-facebook container. - You can expose the container's port using the `matrix_mautrix_facebook_container_http_host_bind_port` variable. - when: "not matrix_nginx_proxy_enabled | default(False) | bool" - -- when: matrix_mautrix_facebook_metrics_proxying_enabled | bool - block: - - name: Generate mautrix-facebook metrics proxying configuration for matrix-nginx-proxy (matrix.DOMAIN/metrics/mautrix-facebook) - ansible.builtin.set_fact: - matrix_mautrix_facebook_nginx_metrics_configuration_block: | - location /metrics/mautrix-facebook { - {% if matrix_nginx_proxy_enabled | default(False) %} - {# Use the embedded DNS resolver in Docker containers to discover the service #} - resolver 127.0.0.11 valid=5s; - set $backend "matrix-mautrix-facebook:8000"; - proxy_pass http://$backend/metrics; - {% else %} - return 404 "matrix-nginx-proxy is disabled and no host port was bound to the container, so metrics are unavailable"; - {% endif %} - } - - - name: Register mautrix-facebook metrics proxying configuration with matrix-nginx-proxy (matrix.DOMAIN/metrics/mautrix-facebook) - ansible.builtin.set_fact: - matrix_nginx_proxy_proxy_matrix_metrics_additional_system_location_configuration_blocks: | - {{ - matrix_nginx_proxy_proxy_matrix_metrics_additional_system_location_configuration_blocks | default([]) - + - [matrix_mautrix_facebook_nginx_metrics_configuration_block] - }} diff --git a/roles/custom/matrix-bridge-mautrix-facebook/tasks/main.yml b/roles/custom/matrix-bridge-mautrix-facebook/tasks/main.yml index 110346682..d26ce1733 100644 --- a/roles/custom/matrix-bridge-mautrix-facebook/tasks/main.yml +++ b/roles/custom/matrix-bridge-mautrix-facebook/tasks/main.yml @@ -1,14 +1,5 @@ --- -- tags: - - setup-all - - setup-nginx-proxy - - install-all - - install-nginx-proxy - block: - - when: matrix_mautrix_facebook_enabled | bool and matrix_mautrix_facebook_appservice_public_enabled | bool - ansible.builtin.include_tasks: "{{ role_path }}/tasks/inject_into_nginx_proxy.yml" - - tags: - setup-all - setup-mautrix-facebook diff --git a/roles/custom/matrix-bridge-mautrix-facebook/tasks/setup_install.yml b/roles/custom/matrix-bridge-mautrix-facebook/tasks/setup_install.yml index fac1d1d2b..36a643661 100644 --- a/roles/custom/matrix-bridge-mautrix-facebook/tasks/setup_install.yml +++ b/roles/custom/matrix-bridge-mautrix-facebook/tasks/setup_install.yml @@ -113,6 +113,16 @@ owner: "{{ matrix_user_username }}" group: "{{ matrix_user_groupname }}" +- name: Ensure mautrix-facebook support files installed + ansible.builtin.template: + src: "{{ role_path }}/templates/{{ item }}.j2" + dest: "{{ matrix_mautrix_facebook_base_path }}/{{ item }}" + mode: 0640 + owner: "{{ matrix_user_username }}" + group: "{{ matrix_user_groupname }}" + with_items: + - labels + - name: Ensure matrix-mautrix-facebook.service installed ansible.builtin.template: src: "{{ role_path }}/templates/systemd/matrix-mautrix-facebook.service.j2" diff --git a/roles/custom/matrix-bridge-mautrix-facebook/tasks/validate_config.yml b/roles/custom/matrix-bridge-mautrix-facebook/tasks/validate_config.yml index d61981a67..707979972 100644 --- a/roles/custom/matrix-bridge-mautrix-facebook/tasks/validate_config.yml +++ b/roles/custom/matrix-bridge-mautrix-facebook/tasks/validate_config.yml @@ -1,14 +1,28 @@ --- +- name: (Deprecation) Catch and report renamed mautrix-facebook settings + ansible.builtin.fail: + msg: >- + Your configuration contains a variable, which now has a different name. + Please change your configuration to rename the variable (`{{ item.old }}` -> `{{ item.new }}`). + when: "item.old in vars" + with_items: + - {'old': 'matrix_mautrix_facebook_public_endpoint', 'new': 'matrix_mautrix_facebook_appservice_public_prefix'} + - name: Fail if required mautrix-facebook settings not defined ansible.builtin.fail: msg: >- You need to define a required configuration setting (`{{ item.name }}`). when: "item.when | bool and vars[item.name] == ''" with_items: - - {'name': 'matrix_mautrix_facebook_public_endpoint', when: true} + - {'name': 'matrix_mautrix_facebook_appservice_public_hostname', when: "{{ matrix_mautrix_facebook_appservice_public_enabled }}"} + - {'name': 'matrix_mautrix_facebook_appservice_public_prefix', when: "{{ matrix_mautrix_facebook_appservice_public_enabled }}"} + - {'name': 'matrix_mautrix_facebook_metrics_proxying_hostname', when: "{{ matrix_mautrix_facebook_metrics_enabled }}"} + - {'name': 'matrix_mautrix_facebook_metrics_proxying_path_prefix', when: "{{ matrix_mautrix_facebook_metrics_enabled }}"} - {'name': 'matrix_mautrix_facebook_appservice_token', when: true} - {'name': 'matrix_mautrix_facebook_homeserver_token', when: true} + - {'name': 'matrix_mautrix_facebook_container_network', when: true} + - {'name': 'matrix_mautrix_facebook_homeserver_address', when: true} - {'name': 'matrix_mautrix_facebook_database_hostname', when: "{{ matrix_mautrix_facebook_database_engine == 'postgres' }}"} - when: "matrix_mautrix_facebook_database_engine == 'sqlite' and matrix_mautrix_facebook_docker_image.endswith(':da1b4ec596e334325a1589e70829dea46e73064b')" @@ -23,3 +37,4 @@ "NOTE: Your mautrix-facebook bridge is still on SQLite and on the last version that supported it, before support was dropped. Support has been subsequently re-added in v0.3.2, so we advise you to upgrade (by removing your `matrix_mautrix_facebook_docker_image` definition from vars.yml)" ] }} + diff --git a/roles/custom/matrix-bridge-mautrix-facebook/templates/config.yaml.j2 b/roles/custom/matrix-bridge-mautrix-facebook/templates/config.yaml.j2 index 7ec9342a2..968cbe162 100644 --- a/roles/custom/matrix-bridge-mautrix-facebook/templates/config.yaml.j2 +++ b/roles/custom/matrix-bridge-mautrix-facebook/templates/config.yaml.j2 @@ -37,7 +37,7 @@ appservice: # Whether or not the public-facing endpoints should be enabled. enabled: {{ matrix_mautrix_facebook_appservice_public_enabled|to_json }} # The prefix to use in the public-facing endpoints. - prefix: {{ matrix_mautrix_facebook_public_endpoint|to_json }} + prefix: {{ matrix_mautrix_facebook_appservice_public_prefix|to_json }} # The base URL where the public-facing endpoints are available. The prefix is not added # implicitly. external: {{ matrix_mautrix_facebook_appservice_public_external|to_json }} diff --git a/roles/custom/matrix-bridge-mautrix-facebook/templates/labels.j2 b/roles/custom/matrix-bridge-mautrix-facebook/templates/labels.j2 new file mode 100644 index 000000000..dbdd3eaef --- /dev/null +++ b/roles/custom/matrix-bridge-mautrix-facebook/templates/labels.j2 @@ -0,0 +1,45 @@ +{% if matrix_mautrix_facebook_container_labels_traefik_enabled %} +traefik.enable=true + +{% if matrix_mautrix_facebook_container_labels_traefik_docker_network %} +traefik.docker.network={{ matrix_mautrix_facebook_container_labels_traefik_docker_network }} +{% endif %} + +{# Public endpoint #} +{% if matrix_mautrix_facebook_container_labels_public_endpoint_enabled %} +traefik.http.routers.matrix-mautrix-facebook-public-endpoint.rule={{ matrix_mautrix_facebook_container_labels_public_endpoint_traefik_rule }} +{% if matrix_mautrix_facebook_container_labels_public_endpoint_traefik_priority | int > 0 %} +traefik.http.routers.matrix-mautrix-facebook-public-endpoint.priority={{ matrix_mautrix_facebook_container_labels_public_endpoint_traefik_priority }} +{% endif %} +traefik.http.routers.matrix-mautrix-facebook-public-endpoint.service=matrix-mautrix-facebook-appservice +traefik.http.routers.matrix-mautrix-facebook-public-endpoint.entrypoints={{ matrix_mautrix_facebook_container_labels_public_endpoint_traefik_entrypoints }} +traefik.http.routers.matrix-mautrix-facebook-public-endpoint.tls={{ matrix_mautrix_facebook_container_labels_public_endpoint_traefik_tls | to_json }} +{% if matrix_mautrix_facebook_container_labels_public_endpoint_traefik_tls %} +traefik.http.routers.matrix-mautrix-facebook-public-endpoint.tls.certResolver={{ matrix_mautrix_facebook_container_labels_public_endpoint_traefik_tls_certResolver }} +{% endif %} +traefik.http.services.matrix-mautrix-facebook-appservice.loadbalancer.server.port=29319 +{% endif %} + +{# Metrics #} +{% if matrix_mautrix_facebook_container_labels_metrics_enabled %} +traefik.http.routers.matrix-mautrix-facebook-metrics.rule={{ matrix_mautrix_facebook_container_labels_metrics_traefik_rule }} +{% if matrix_mautrix_facebook_container_labels_metrics_traefik_priority | int > 0 %} +traefik.http.routers.matrix-mautrix-facebook-metrics.priority={{ matrix_mautrix_facebook_container_labels_metrics_traefik_priority }} +{% endif %} +traefik.http.routers.matrix-mautrix-facebook-metrics.service=matrix-mautrix-facebook-metrics +traefik.http.routers.matrix-mautrix-facebook-metrics.entrypoints={{ matrix_mautrix_facebook_container_labels_metrics_traefik_entrypoints }} +traefik.http.routers.matrix-mautrix-facebook-metrics.tls={{ matrix_mautrix_facebook_container_labels_metrics_traefik_tls | to_json }} +{% if matrix_mautrix_facebook_container_labels_metrics_traefik_tls %} +traefik.http.routers.matrix-mautrix-facebook-metrics.tls.certResolver={{ matrix_mautrix_facebook_container_labels_metrics_traefik_tls_certResolver }} +{% endif %} +{% if matrix_mautrix_facebook_container_labels_metrics_middleware_basic_auth_enabled %} +traefik.http.routers.matrix-mautrix-facebook-metrics.middlewares=matrix-mautrix-facebook-metrics-basic-auth +traefik.http.middlewares.matrix-mautrix-facebook-metrics-basic-auth.basicauth.users={{ matrix_mautrix_facebook_container_labels_metrics_middleware_basic_auth_users }} +{% endif %} + +traefik.http.services.matrix-mautrix-facebook-metrics.loadbalancer.server.port=8000 +{% endif %} + +{% endif %} + +{{ matrix_mautrix_facebook_container_labels_additional_labels }} diff --git a/roles/custom/matrix-bridge-mautrix-facebook/templates/systemd/matrix-mautrix-facebook.service.j2 b/roles/custom/matrix-bridge-mautrix-facebook/templates/systemd/matrix-mautrix-facebook.service.j2 index 2786a3f74..a99173598 100644 --- a/roles/custom/matrix-bridge-mautrix-facebook/templates/systemd/matrix-mautrix-facebook.service.j2 +++ b/roles/custom/matrix-bridge-mautrix-facebook/templates/systemd/matrix-mautrix-facebook.service.j2 @@ -19,22 +19,31 @@ ExecStartPre=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_s # Intentional delay, so that the homeserver (we likely depend on) can manage to start. ExecStartPre={{ matrix_host_command_sleep }} 5 -ExecStart={{ devture_systemd_docker_base_host_command_docker }} run --rm --name matrix-mautrix-facebook \ +ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} create \ + --rm \ + --name=matrix-mautrix-facebook \ --log-driver=none \ --user={{ matrix_user_uid }}:{{ matrix_user_gid }} \ --cap-drop=ALL \ - --network={{ matrix_docker_network }} \ + --network={{ matrix_mautrix_facebook_container_network }} \ {% if matrix_mautrix_facebook_appservice_public_enabled and matrix_mautrix_facebook_container_http_host_bind_port %} -p {{ matrix_mautrix_facebook_container_http_host_bind_port }}:29319 \ {% endif %} - -v {{ matrix_mautrix_facebook_config_path }}:/config:z \ - -v {{ matrix_mautrix_facebook_data_path }}:/data:z \ + --mount type=bind,src={{ matrix_mautrix_facebook_config_path }},dst=/config \ + --mount type=bind,src={{ matrix_mautrix_facebook_data_path }},dst=/data \ + --label-file={{ matrix_mautrix_facebook_base_path }}/labels \ {% for arg in matrix_mautrix_facebook_container_extra_arguments %} {{ arg }} \ {% endfor %} {{ matrix_mautrix_facebook_docker_image }} \ python3 -m mautrix_facebook -c /config/config.yaml --no-update +{% for network in matrix_mautrix_facebook_container_additional_networks %} +ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} network connect {{ network }} matrix-mautrix-facebook +{% endfor %} + +ExecStart={{ devture_systemd_docker_base_host_command_docker }} start --attach matrix-mautrix-facebook + ExecStop=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} stop --time={{ devture_systemd_docker_base_container_stop_grace_time_seconds }} matrix-mautrix-facebook 2>/dev/null || true' ExecStop=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} rm matrix-mautrix-facebook 2>/dev/null || true' Restart=always diff --git a/roles/custom/matrix-homeserver-proxy/defaults/main.yml b/roles/custom/matrix-homeserver-proxy/defaults/main.yml new file mode 100644 index 000000000..7f974c2bb --- /dev/null +++ b/roles/custom/matrix-homeserver-proxy/defaults/main.yml @@ -0,0 +1,179 @@ +--- + +# matrix-homeserver-proxy is a role which brings up a containerized nginx webserver which helps with reverse-proxying to the Matrix homeserver (Synapse, etc.). +# +# Certain services (like matrix-media-repo, matrix-corporal, identity servers, etc.) may need to capture some requests destined for the homeserver +# and handle them instead of it. +# +# This role helps other services (bots, bridges, etc.) reach the homeserver in a way that: +# - is not very direct, so as to allow for some routes (media repo, etc.) to actually go elsewhere +# - is not via the public network and/or via HTTPS, which introduces major performance penalties +# +# Performance-wise, benchmarks show that: +# - each local (container) nginx hop adds about a 200 rps penalty +# - SSL termination (on the Traefik side) adds a 350 rps penalty +# - going over the public network adds another 70 rps penalty +# +# It's something like this for an existing flow (which will be gone soon): +# 1. public network, Traefik + SSL: 70 rps +# 2. `matrix-nginx-proxy:8008`: 600 rps +# 3. `matrix-nginx-proxy:12080` 850 rps +# 4. `matrix-synapse-reverse-proxy-companion:8008`: 1000 rps +# 5. `matrix-synapse:8008`: 1200 rps +# +# Traefik was additionally benchmarked to see where the slowness comes from. Results are like this: +# 1. public network, Traefik + SSL: 70 rps +# 2. local (container) network, Traefik + SSL: 150 rps +# 3. local (container) network, Traefik without SSL: 500 rps +# 4. `matrix-nginx-proxy:8008`: 600 rps +# +# It's obvious that minimizing the number of hops helps a lot and that not using SSL and/or the public network is important. + +matrix_homeserver_proxy_enabled: true + +matrix_homeserver_proxy_ident: matrix-homeserver-proxy + +# renovate: datasource=docker depName=nginx +matrix_homeserver_proxy_version: 1.25.3-alpine + +matrix_homeserver_proxy_base_path: "{{ matrix_base_data_path }}/homeserver-proxy" +matrix_homeserver_proxy_confd_path: "{{ matrix_homeserver_proxy_base_path }}/conf.d" + +# List of systemd services that matrix-homeserver-proxy.service depends on +matrix_homeserver_proxy_systemd_required_services_list: ['docker.service'] + +# List of systemd services that matrix-homeserver-proxy.service wants +matrix_homeserver_proxy_systemd_wanted_services_list: "{{ matrix_homeserver_proxy_systemd_wanted_services_list_auto + matrix_homeserver_proxy_systemd_wanted_services_list_custom }}" +matrix_homeserver_proxy_systemd_wanted_services_list_auto: [] +matrix_homeserver_proxy_systemd_wanted_services_list_custom: [] + +# We use an official nginx image, which we fix-up to run unprivileged. +# An alternative would be an `nginxinc/nginx-unprivileged` image, but that is frequently out of date. +matrix_homeserver_proxy_container_image: "{{ matrix_container_global_registry_prefix }}nginx:{{ matrix_homeserver_proxy_version }}" +matrix_homeserver_proxy_container_image_force_pull: "{{ matrix_homeserver_proxy_container_image.endswith(':latest') }}" + +matrix_homeserver_proxy_container_network: matrix-homeserver-proxy + +# A list of additional container networks that matrix-homeserver-proxy would be connected to. +# The playbook does not create these networks, so make sure they already exist. +matrix_homeserver_proxy_container_additional_networks: [] + +# Controls whether the matrix-homeserver-proxy container exposes its HTTP Client-Server API port (tcp/8008 in the container). +# +# Takes an ":" or "" value (e.g. "127.0.0.1:8008"), or empty string to not expose. +matrix_homeserver_proxy_container_client_api_host_bind_port: '' + +# Controls whether the matrix-homeserver-proxy container exposes its HTTP Federation (Server-Server) API port (tcp/8048 in the container). +# +# Takes an ":" or "" value (e.g. "127.0.0.1:8048"), or empty string to not expose. +matrix_homeserver_proxy_container_federation_api_host_bind_port: '' + +# Option to disable the access log +matrix_homeserver_proxy_access_log_enabled: true + +# The tmpfs at /tmp needs to be large enough to handle multiple concurrent file uploads. +matrix_homeserver_proxy_tmp_directory_size_mb: "{{ (matrix_homeserver_proxy_federation_api_client_max_body_size_mb | int) * 50 }}" +matrix_homeserver_proxy_tmp_cache_directory_size_mb: "{{ (matrix_homeserver_proxy_cache_max_size_mb | int) * 2 }}" + +# A list of strings containing additional configuration blocks to add to the nginx server configuration (nginx.conf). +# for big matrixservers to enlarge the number of open files to prevent timeouts +# matrix_homeserver_proxy_additional_configuration_blocks: +# - 'worker_rlimit_nofile 30000;' +matrix_homeserver_proxy_additional_configuration_blocks: [] + +# A list of strings containing additional configuration blocks to add to the nginx event server configuration (nginx.conf). +matrix_homeserver_proxy_event_additional_configuration_blocks: [] + +# A list of strings containing additional configuration blocks to add to the nginx http's server configuration (nginx-http.conf). +matrix_homeserver_proxy_http_additional_server_configuration_blocks: [] + +# To increase request timeout in NGINX using proxy_read_timeout, proxy_connect_timeout, proxy_send_timeout, send_timeout directives +# Nginx Default: proxy_connect_timeout 60s; #Defines a timeout for establishing a connection with a proxied server +# Nginx Default: proxy_send_timeout 60s; #Sets a timeout for transmitting a request to the proxied server. +# Nginx Default: proxy_read_timeout 60s; #Defines a timeout for reading a response from the proxied server. +# Nginx Default: send_timeout 60s; #Sets a timeout for transmitting a response to the client. +# +# For more information visit: +# http://nginx.org/en/docs/http/ngx_http_proxy_module.html +# http://nginx.org/en/docs/http/ngx_http_core_module.html#send_timeout +# https://www.nginx.com/resources/wiki/start/topics/examples/fullexample2/ +# +# Here we are sticking with nginx default values change this value carefully. +matrix_homeserver_proxy_proxy_connect_timeout: 60 +matrix_homeserver_proxy_proxy_send_timeout: 60 +matrix_homeserver_proxy_proxy_read_timeout: 60 +matrix_homeserver_proxy_send_timeout: 60 + +# For OCSP purposes, we need to define a resolver at the `server{}` level or `http{}` level (we do the latter). +# +# Otherwise, we get warnings like this: +# > [warn] 22#22: no resolver defined to resolve r3.o.lencr.org while requesting certificate status, responder: r3.o.lencr.org, certificate: "/matrix/ssl/config/live/.../fullchain.pem" +# +# We point it to the internal Docker resolver, which likely delegates to nameservers defined in `/etc/resolv.conf`. +matrix_homeserver_proxy_http_level_resolver: 127.0.0.11 + +matrix_homeserver_proxy_hostname: "{{ matrix_homeserver_proxy_ident }}" + +# matrix_homeserver_proxy_client_api_addr specifies the address where the Client-Server API is +matrix_homeserver_proxy_client_api_addr: '' +# This needs to be equal or higher than the maximum upload size accepted by the homeserver. +matrix_homeserver_proxy_client_api_client_max_body_size_mb: 50 + +# Tells whether `/_synapse/client` is forwarded to the Matrix Client API server. +matrix_homeserver_proxy_client_api_forwarded_location_synapse_client_api_enabled: true + +# Tells whether `/_synapse/oidc` is forwarded to the Matrix Client API server. +# Enable this if you need OpenID Connect authentication support. +matrix_homeserver_proxy_client_api_forwarded_location_synapse_oidc_api_enabled: false + +# Tells whether `/_synapse/admin` is forwarded to the Matrix Client API server. +# Following these recommendations (https://github.com/matrix-org/synapse/blob/master/docs/reverse_proxy.md), by default, we don't. +matrix_homeserver_proxy_client_api_forwarded_location_synapse_admin_api_enabled: false + +# `matrix_homeserver_proxy_client_api_forwarded_location_prefix_regexes` holds +# the location prefixes that get forwarded to the Matrix Client API server. +# These locations get combined into a regex like this `^(/_matrix|/_synapse/client)`. +matrix_homeserver_proxy_client_api_forwarded_location_prefix_regexes: | + {{ + (['/_matrix']) + + + (['/_synapse/client'] if matrix_homeserver_proxy_client_api_forwarded_location_synapse_client_api_enabled else []) + + + (['/_synapse/oidc'] if matrix_homeserver_proxy_client_api_forwarded_location_synapse_oidc_api_enabled else []) + + + (['/_synapse/admin'] if matrix_homeserver_proxy_client_api_forwarded_location_synapse_admin_api_enabled else []) + }} + +# Specifies where requests for the root URI (`/`) on the `matrix.` domain should be redirected. +# If this has an empty value, they're just passed to the homeserver, which serves a static page. +# If you'd like to make `https://matrix.DOMAIN` redirect to `https://element.DOMAIN` (or something of that sort), specify the domain name here. +# Example value: `element.DOMAIN` (or `{{ matrix_server_fqn_element }}`). +matrix_homeserver_proxy_client_redirect_root_uri_to_domain: "" + +# A list of strings containing additional configuration blocks to add to the nginx vhost handling the Client-Server API +matrix_homeserver_proxy_client_api_additional_server_configuration_blocks: "{{ matrix_homeserver_proxy_client_api_additional_server_configuration_blocks_auto + matrix_homeserver_proxy_client_api_additional_server_configuration_blocks_custom }}" +matrix_homeserver_proxy_client_api_additional_server_configuration_blocks_auto: [] +matrix_homeserver_proxy_client_api_additional_server_configuration_blocks_custom: [] + +# matrix_homeserver_proxy_federation_api_enabled specifies whether reverse proxying for the Federation (Server-Server) API should be done +matrix_homeserver_proxy_federation_api_enabled: true +# matrix_homeserver_proxy_federation_api_addr specifies the address where the Federation (Server-Server) API is +matrix_homeserver_proxy_federation_api_addr: '' +matrix_homeserver_proxy_federation_api_client_max_body_size_mb: "{{ (matrix_homeserver_proxy_client_api_client_max_body_size_mb | int) * 3 }}" + +# A list of strings containing additional configuration blocks to add to the nginx vhost handling the Federation (Server-Server) API +matrix_homeserver_proxy_federation_api_additional_server_configuration_blocks: "{{ matrix_homeserver_proxy_federation_api_additional_server_configuration_blocks_auto + matrix_homeserver_proxy_federation_api_additional_server_configuration_blocks_custom }}" +matrix_homeserver_proxy_federation_api_additional_server_configuration_blocks_auto: [] +matrix_homeserver_proxy_federation_api_additional_server_configuration_blocks_custom: [] + +# Controls whether matrix-homeserver-proxy trusts an upstream server's X-Forwarded-Proto header. +# The `matrix-homeserver-proxy` does not terminate SSL and always expects to be fronted by another reverse-proxy server. +# As such, it trusts the protocol scheme forwarded by the upstream proxy. +matrix_homeserver_proxy_trust_forwarded_proto: true +matrix_homeserver_proxy_x_forwarded_proto_value: "{{ '$http_x_forwarded_proto' if matrix_homeserver_proxy_trust_forwarded_proto else '$scheme' }}" + +# The amount of worker processes and connections +# Consider increasing these when you are expecting high amounts of traffic +# http://nginx.org/en/docs/ngx_core_module.html#worker_connections +matrix_homeserver_proxy_worker_processes: auto +matrix_homeserver_proxy_worker_connections: 1024 diff --git a/roles/custom/matrix-homeserver-proxy/tasks/install.yml b/roles/custom/matrix-homeserver-proxy/tasks/install.yml new file mode 100644 index 000000000..0171f888f --- /dev/null +++ b/roles/custom/matrix-homeserver-proxy/tasks/install.yml @@ -0,0 +1,49 @@ +--- + +- name: Ensure Matrix Homeserver Proxy paths exist + ansible.builtin.file: + path: "{{ item }}" + state: directory + mode: 0750 + owner: "{{ matrix_user_username }}" + group: "{{ matrix_user_groupname }}" + with_items: + - "{{ matrix_homeserver_proxy_base_path }}" + - "{{ matrix_homeserver_proxy_confd_path }}" + +- name: Ensure Matrix Homeserver Proxy is configured + ansible.builtin.template: + src: "{{ item.src }}" + dest: "{{ item.dest }}" + owner: "{{ matrix_user_username }}" + group: "{{ matrix_user_groupname }}" + mode: 0644 + with_items: + - src: "{{ role_path }}/templates/nginx/nginx.conf.j2" + dest: "{{ matrix_homeserver_proxy_base_path }}/nginx.conf" + - src: "{{ role_path }}/templates/nginx/conf.d/nginx-http.conf.j2" + dest: "{{ matrix_homeserver_proxy_confd_path }}/nginx-http.conf" + - src: "{{ role_path }}/templates/nginx/conf.d/matrix-homeserver-proxy.conf.j2" + dest: "{{ matrix_homeserver_proxy_confd_path }}/matrix-homeserver-proxy.conf" + +- name: Ensure Matrix Homeserver Proxy nginx container image is pulled + community.docker.docker_image: + name: "{{ matrix_homeserver_proxy_container_image }}" + source: "{{ 'pull' if ansible_version.major > 2 or ansible_version.minor > 7 else omit }}" + force_source: "{{ matrix_homeserver_proxy_container_image_force_pull if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}" + force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else matrix_homeserver_proxy_container_image_force_pull }}" + register: result + retries: "{{ devture_playbook_help_container_retries_count }}" + delay: "{{ devture_playbook_help_container_retries_delay }}" + until: result is not failed + +- name: Ensure Matrix Homeserver Proxy container network is created + community.general.docker_network: + name: "{{ matrix_homeserver_proxy_container_network }}" + driver: bridge + +- name: Ensure Matrix Homeserver Proxy systemd service is installed + ansible.builtin.template: + src: "{{ role_path }}/templates/systemd/matrix-homeserver-proxy.service.j2" + dest: "{{ devture_systemd_docker_base_systemd_path }}/{{ matrix_homeserver_proxy_ident }}.service" + mode: 0644 diff --git a/roles/custom/matrix-homeserver-proxy/tasks/main.yml b/roles/custom/matrix-homeserver-proxy/tasks/main.yml new file mode 100644 index 000000000..ac6086f3a --- /dev/null +++ b/roles/custom/matrix-homeserver-proxy/tasks/main.yml @@ -0,0 +1,20 @@ +--- + +- tags: + - setup-all + - setup-homeserver-proxy + - setup-synapse + - install-all + - install-homeserver-proxy + - install-synapse + block: + - when: matrix_homeserver_proxy_enabled | bool + ansible.builtin.include_tasks: "{{ role_path }}/tasks/install.yml" + +- tags: + - setup-all + - setup-homeserver-proxy + - setup-synapse + block: + - when: not matrix_homeserver_proxy_enabled | bool + ansible.builtin.include_tasks: "{{ role_path }}/tasks/uninstall.yml" diff --git a/roles/custom/matrix-homeserver-proxy/tasks/uninstall.yml b/roles/custom/matrix-homeserver-proxy/tasks/uninstall.yml new file mode 100644 index 000000000..01425f2c1 --- /dev/null +++ b/roles/custom/matrix-homeserver-proxy/tasks/uninstall.yml @@ -0,0 +1,25 @@ +--- + +- name: Check existence of Matrix Homeserver Proxy systemd service + ansible.builtin.stat: + path: "{{ devture_systemd_docker_base_systemd_path }}/{{ matrix_homeserver_proxy_ident }}.service" + register: matrix_homeserver_proxy_service_stat + +- when: matrix_homeserver_proxy_service_stat.stat.exists | bool + block: + - name: Ensure Matrix Homeserver Proxy systemd service is stopped + ansible.builtin.service: + name: "{{ matrix_homeserver_proxy_ident }}" + state: stopped + enabled: false + daemon_reload: true + + - name: Ensure Matrix Homeserver Proxy systemd service doesn't exist + ansible.builtin.file: + path: "{{ devture_systemd_docker_base_systemd_path }}/{{ matrix_homeserver_proxy_ident }}.service" + state: absent + + - name: Ensure Matrix Homeserver Proxy directory is deleted + ansible.builtin.file: + path: "{{ matrix_homeserver_proxy_base_path }}" + state: absent diff --git a/roles/custom/matrix-homeserver-proxy/templates/nginx/conf.d/matrix-homeserver-proxy.conf.j2 b/roles/custom/matrix-homeserver-proxy/templates/nginx/conf.d/matrix-homeserver-proxy.conf.j2 new file mode 100644 index 000000000..437be76fd --- /dev/null +++ b/roles/custom/matrix-homeserver-proxy/templates/nginx/conf.d/matrix-homeserver-proxy.conf.j2 @@ -0,0 +1,62 @@ +#jinja2: lstrip_blocks: "True" + +server { + listen 8008; + server_name {{ matrix_homeserver_proxy_hostname }}; + + server_tokens off; + root /dev/null; + + gzip on; + gzip_types text/plain application/json; + + {% for configuration_block in matrix_homeserver_proxy_client_api_additional_server_configuration_blocks %} + {{- configuration_block }} + {% endfor %} + + {# Everything else just goes to the API server ##} + location / { + {# Use the embedded DNS resolver in Docker containers to discover the service #} + resolver {{ matrix_homeserver_proxy_http_level_resolver }} valid=5s; + set $backend "{{ matrix_homeserver_proxy_client_api_addr }}"; + proxy_pass http://$backend; + + proxy_set_header Host $host; + + client_body_buffer_size 25M; + client_max_body_size {{ matrix_homeserver_proxy_client_api_client_max_body_size_mb }}M; + proxy_max_temp_file_size 0; + } +} + +{% if matrix_homeserver_proxy_federation_api_enabled %} +server { + listen 8048; + server_name {{ matrix_homeserver_proxy_hostname }}; + + server_tokens off; + + root /dev/null; + + gzip on; + gzip_types text/plain application/json; + + {% for configuration_block in matrix_homeserver_proxy_federation_api_additional_server_configuration_blocks %} + {{- configuration_block }} + {% endfor %} + + {# Everything else just goes to the API server ##} + location / { + {# Use the embedded DNS resolver in Docker containers to discover the service #} + resolver {{ matrix_homeserver_proxy_http_level_resolver }} valid=5s; + set $backend "{{ matrix_homeserver_proxy_federation_api_addr }}"; + proxy_pass http://$backend; + + proxy_set_header Host $host; + + client_body_buffer_size 25M; + client_max_body_size {{ matrix_homeserver_proxy_federation_api_client_max_body_size_mb }}M; + proxy_max_temp_file_size 0; + } +} +{% endif %} diff --git a/roles/custom/matrix-homeserver-proxy/templates/nginx/conf.d/nginx-http.conf.j2 b/roles/custom/matrix-homeserver-proxy/templates/nginx/conf.d/nginx-http.conf.j2 new file mode 100644 index 000000000..d14c755e2 --- /dev/null +++ b/roles/custom/matrix-homeserver-proxy/templates/nginx/conf.d/nginx-http.conf.j2 @@ -0,0 +1,13 @@ +#jinja2: lstrip_blocks: "True" +# The default is aligned to the CPU's cache size, +# which can sometimes be too low. +# Thus, we ensure a larger bucket size value is used. +server_names_hash_bucket_size 64; + +{% if matrix_homeserver_proxy_http_level_resolver %} +resolver {{ matrix_homeserver_proxy_http_level_resolver }}; +{% endif %} + +{% for configuration_block in matrix_homeserver_proxy_http_additional_server_configuration_blocks %} + {{- configuration_block }} +{% endfor %} diff --git a/roles/custom/matrix-homeserver-proxy/templates/nginx/nginx.conf.j2 b/roles/custom/matrix-homeserver-proxy/templates/nginx/nginx.conf.j2 new file mode 100644 index 000000000..28272b564 --- /dev/null +++ b/roles/custom/matrix-homeserver-proxy/templates/nginx/nginx.conf.j2 @@ -0,0 +1,77 @@ +#jinja2: lstrip_blocks: "True" +# This is a custom nginx configuration file that we use in the container (instead of the default one), +# because it allows us to run nginx with a non-root user. +# +# For this to work, the default vhost file (`/etc/nginx/conf.d/default.conf`) also needs to be removed. +# +# The following changes have been done compared to a default nginx configuration file: +# - various temp paths are changed to `/tmp`, so that a non-root user can write to them +# - the `user` directive was removed, as we don't want nginx to switch users + +worker_processes {{ matrix_homeserver_proxy_worker_processes }}; +error_log /var/log/nginx/error.log warn; +pid /tmp/nginx.pid; +{% for configuration_block in matrix_homeserver_proxy_additional_configuration_blocks %} + {{- configuration_block }} +{% endfor %} + +events { + worker_connections {{ matrix_homeserver_proxy_worker_connections }}; +{% for configuration_block in matrix_homeserver_proxy_event_additional_configuration_blocks %} + {{- configuration_block }} +{% endfor %} +} + + +http { + proxy_temp_path /tmp/proxy_temp; + client_body_temp_path /tmp/client_temp; + fastcgi_temp_path /tmp/fastcgi_temp; + uwsgi_temp_path /tmp/uwsgi_temp; + scgi_temp_path /tmp/scgi_temp; + + include /etc/nginx/mime.types; + default_type application/octet-stream; + + log_format main '$remote_addr - $remote_user [$time_local] "$request" ' + '$status $body_bytes_sent "$http_referer" ' + '"$http_user_agent" "$http_x_forwarded_for"'; + + {% if matrix_homeserver_proxy_access_log_enabled %} + access_log /var/log/nginx/access.log main; + {% endif %} + + {% if matrix_homeserver_proxy_access_log_syslog_integration_enabled %} + log_format prometheus_fmt 'matrix-homeserver-proxy $server_name - $upstream_addr - $remote_addr - $remote_user [$time_local] ' + '$host "$request" ' + '$status "$http_referer" ' + '"$http_user_agent" "$http_x_forwarded_for"'; + + access_log syslog:server={{ matrix_homeserver_proxy_access_log_syslog_integration_server_port }},tag=matrix_nginx_proxy_companion prometheus_fmt; + {% endif %} + + {% if not matrix_homeserver_proxy_access_log_enabled and not matrix_homeserver_proxy_access_log_syslog_integration_enabled %} + access_log off; + {% endif %} + + proxy_connect_timeout {{ matrix_homeserver_proxy_proxy_connect_timeout }}; + proxy_send_timeout {{ matrix_homeserver_proxy_proxy_send_timeout }}; + proxy_read_timeout {{ matrix_homeserver_proxy_proxy_read_timeout }}; + send_timeout {{ matrix_homeserver_proxy_send_timeout }}; + + sendfile on; + #tcp_nopush on; + + keepalive_timeout 65; + + server_tokens off; + + #gzip on; + {# Map directive needed for proxied WebSocket upgrades #} + map $http_upgrade $connection_upgrade { + default upgrade; + '' close; + } + + include /etc/nginx/conf.d/*.conf; +} diff --git a/roles/custom/matrix-homeserver-proxy/templates/systemd/matrix-homeserver-proxy.service.j2 b/roles/custom/matrix-homeserver-proxy/templates/systemd/matrix-homeserver-proxy.service.j2 new file mode 100755 index 000000000..4f7aa02c6 --- /dev/null +++ b/roles/custom/matrix-homeserver-proxy/templates/systemd/matrix-homeserver-proxy.service.j2 @@ -0,0 +1,52 @@ +#jinja2: lstrip_blocks: "True" +[Unit] +Description=Matrix Homeserver Proxy +{% for service in matrix_homeserver_proxy_systemd_required_services_list %} +Requires={{ service }} +After={{ service }} +{% endfor %} +{% for service in matrix_homeserver_proxy_systemd_wanted_services_list %} +Wants={{ service }} +{% endfor %} +DefaultDependencies=no + +[Service] +Type=simple +Environment="HOME={{ devture_systemd_docker_base_systemd_unit_home_path }}" +ExecStartPre=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} stop --time={{ devture_systemd_docker_base_container_stop_grace_time_seconds }} matrix-homeserver-proxy 2>/dev/null || true' +ExecStartPre=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} rm matrix-homeserver-proxy 2>/dev/null || true' + +ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} create \ + --rm \ + --name=matrix-homeserver-proxy \ + --log-driver=none \ + --user={{ matrix_user_uid }}:{{ matrix_user_gid }} \ + --cap-drop=ALL \ + --read-only \ + --tmpfs=/tmp:rw,noexec,nosuid,size={{ matrix_homeserver_proxy_tmp_directory_size_mb }}m \ + --network={{ matrix_homeserver_proxy_container_network }} \ + {% if matrix_homeserver_proxy_container_client_api_host_bind_port %} + -p {{ matrix_homeserver_proxy_container_client_api_host_bind_port }}:8008 \ + {% endif %} + {% if matrix_homeserver_proxy_container_federation_api_host_bind_port %} + -p {{ matrix_homeserver_proxy_container_federation_api_host_bind_port }}:8048 \ + {% endif %} + --mount type=bind,src={{ matrix_homeserver_proxy_base_path }}/nginx.conf,dst=/etc/nginx/nginx.conf,ro \ + --mount type=bind,src={{ matrix_homeserver_proxy_confd_path }},dst=/etc/nginx/conf.d,ro \ + {{ matrix_homeserver_proxy_container_image }} + +{% for network in matrix_homeserver_proxy_container_additional_networks %} +ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} network connect {{ network }} matrix-homeserver-proxy +{% endfor %} + +ExecStart={{ devture_systemd_docker_base_host_command_docker }} start --attach matrix-homeserver-proxy + +ExecStop=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} stop --time={{ devture_systemd_docker_base_container_stop_grace_time_seconds }} matrix-homeserver-proxy 2>/dev/null || true' +ExecStop=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} rm matrix-homeserver-proxy 2>/dev/null || true' +ExecReload={{ devture_systemd_docker_base_host_command_docker }} exec matrix-homeserver-proxy /usr/sbin/nginx -s reload +Restart=always +RestartSec=30 +SyslogIdentifier=matrix-homeserver-proxy + +[Install] +WantedBy=multi-user.target diff --git a/roles/custom/matrix-homeserver-proxy/vars/main.yml b/roles/custom/matrix-homeserver-proxy/vars/main.yml new file mode 100644 index 000000000..71e652c1f --- /dev/null +++ b/roles/custom/matrix-homeserver-proxy/vars/main.yml @@ -0,0 +1,4 @@ +--- +matrix_homeserver_proxy_client_api_url: "http://{{ matrix_homeserver_proxy_ident }}:8008" + +matrix_homeserver_proxy_federation_api_url: "http://{{ matrix_homeserver_proxy_ident }}:8048" diff --git a/roles/custom/matrix_playbook_migration/tasks/validate_config.yml b/roles/custom/matrix_playbook_migration/tasks/validate_config.yml index c61a51957..a506e1cf9 100644 --- a/roles/custom/matrix_playbook_migration/tasks/validate_config.yml +++ b/roles/custom/matrix_playbook_migration/tasks/validate_config.yml @@ -60,6 +60,11 @@ - {'old': 'jitsi_require_well_known', 'new': 'jitsi_web_well_known_element_jitsi_enabled'} - {'old': 'jitsi_wellknown_element_jitsi_json', 'new': 'jitsi_web_well_known_element_jitsi_json'} + - {'old': 'matrix_nginx_proxy_proxy_matrix_metrics_enabled', 'new': 'matrix_metrics_exposure_enabled'} + - {'old': 'matrix_nginx_proxy_proxy_matrix_metrics_basic_auth_enabled', 'new': 'matrix_metrics_exposure_http_basic_auth_enabled'} + - {'old': 'matrix_nginx_proxy_proxy_matrix_metrics_basic_auth_username', 'new': ''} + - {'old': 'matrix_nginx_proxy_proxy_matrix_metrics_basic_auth_password', 'new': ''} + - name: (Deprecation) Catch and report matrix_postgres variables ansible.builtin.fail: msg: |- diff --git a/setup.yml b/setup.yml index 708c53f82..074b44a1e 100644 --- a/setup.yml +++ b/setup.yml @@ -116,6 +116,7 @@ - custom/matrix-sygnal - galaxy/ntfy - custom/matrix-nginx-proxy + - custom/matrix-homeserver-proxy - custom/matrix-coturn - custom/matrix-media-repo