Restore matrix-corporal functionality when matrix-nginx-proxy is not involved

group_vars/matrix_servers

@@ -2639,34 +2639,31 @@ matrix_cactus_comments_client_container_labels_traefik_tls_certResolver: "{{ dev
 
 matrix_corporal_enabled: false
 
+matrix_corporal_systemd_required_services_list_auto: |
+  {{
+    (['matrix-' + matrix_homeserver_implementation + '.service'])
+  }}
+
 matrix_corporal_container_image_self_build: "{{ matrix_architecture not in ['amd64', 'arm32', 'arm64'] }}"
 
-# Normally, matrix-nginx-proxy is enabled and nginx can reach matrix-corporal over the container network.
-# If matrix-nginx-proxy is not enabled, or you otherwise have a need for it, you can expose
-# matrix-corporal's web-server ports to the local host.
 matrix_corporal_container_http_gateway_host_bind_port: "{{ (matrix_playbook_service_host_bind_interface_prefix ~ '41080') if matrix_playbook_service_host_bind_interface_prefix else '' }}"
 matrix_corporal_container_http_api_host_bind_port: "{{ (matrix_playbook_service_host_bind_interface_prefix ~ '41081') if matrix_playbook_service_host_bind_interface_prefix else '' }}"
 
-matrix_corporal_container_labels_traefik_enabled: "{{ matrix_playbook_reverse_proxy_type in ['playbook-managed-traefik', 'other-traefik-container'] }}"
+matrix_corporal_container_network: matrix-corporal
-matrix_corporal_container_labels_traefik_docker_network: "{{ matrix_playbook_reverse_proxyable_services_additional_network }}"
-matrix_corporal_container_labels_traefik_entrypoints: "{{ devture_traefik_entrypoint_primary }}"
-matrix_corporal_container_labels_traefik_tls_certResolver: "{{ devture_traefik_certResolver_primary }}"
 
 matrix_corporal_container_additional_networks: |
   {{
     (
       ([matrix_playbook_reverse_proxyable_services_additional_network] if matrix_playbook_reverse_proxyable_services_additional_network else [])
       +
-      ([matrix_nginx_proxy_container_network] if matrix_nginx_proxy_enabled and matrix_nginx_proxy_container_network != matrix_corporal_container_network else [])
+      ([matrix_homeserver_container_network] if matrix_corporal_container_network != matrix_homeserver_container_network else [])
     ) | unique
   }}
 
-matrix_corporal_systemd_required_services_list: |
+matrix_corporal_container_labels_traefik_enabled: "{{ matrix_playbook_reverse_proxy_type in ['playbook-managed-traefik', 'other-traefik-container'] }}"
-  {{
+matrix_corporal_container_labels_traefik_docker_network: "{{ matrix_playbook_reverse_proxyable_services_additional_network }}"
-    (['docker.service'])
+matrix_corporal_container_labels_traefik_entrypoints: "{{ devture_traefik_entrypoint_primary }}"
-    +
+matrix_corporal_container_labels_traefik_tls_certResolver: "{{ devture_traefik_certResolver_primary }}"
-    (['matrix-' + matrix_homeserver_implementation + '.service'])
-  }}
 
 matrix_corporal_matrix_homeserver_api_endpoint: "{{ matrix_homeserver_container_url }}"
 

roles/custom/matrix-corporal/defaults/main.yml

@@ -24,7 +24,7 @@ matrix_corporal_container_http_api_host_bind_port: ''
 matrix_corporal_container_extra_arguments: []
 
 # The base container network. It will be auto-created by this role if it doesn't exist already.
-matrix_corporal_container_network: "{{ matrix_docker_network }}"
+matrix_corporal_container_network: ""
 
 # A list of additional container networks that the container would be connected to.
 # The role does not create these networks, so make sure they already exist.
@@ -43,14 +43,29 @@ matrix_corporal_container_labels_traefik_entrypoints: web-secure
 matrix_corporal_container_labels_traefik_tls: "{{ matrix_corporal_container_labels_traefik_entrypoints != 'web' }}"
 matrix_corporal_container_labels_traefik_tls_certResolver: default  # noqa var-naming
 
-# Controls whether labels will be added that expose matrix-corporal's HTTP API
+# Controls whether labels will be added that expose matrix-corporal's HTTP API (/_matrix/corporal).
+# Because we also capture all of `/_matrix` for the Client-Server API below (see `matrix_corporal_container_labels_matrix_client_api_*`)
+# and we explicitly set a higher priority on it (to ensure we capture it instead of the homeserver),
+# we also need to tweak the priority of this router, to avoid its requests going to the other one.
 matrix_corporal_container_labels_api_enabled: "{{ matrix_corporal_http_api_enabled }}"
 matrix_corporal_container_labels_api_traefik_rule: "Host(`{{ matrix_corporal_matrix_homeserver_api_domain_name }}`) && PathPrefix(`/_matrix/corporal`)"
-matrix_corporal_container_labels_api_traefik_priority: 0
+matrix_corporal_container_labels_api_traefik_priority: "{{ matrix_corporal_container_labels_matrix_client_api_traefik_priority + 500 }}"
 matrix_corporal_container_labels_api_traefik_entrypoints: "{{ matrix_corporal_container_labels_traefik_entrypoints }}"
 matrix_corporal_container_labels_api_traefik_tls: "{{ matrix_corporal_container_labels_traefik_tls }}"
 matrix_corporal_container_labels_api_traefik_tls_certResolver: "{{ matrix_corporal_container_labels_traefik_tls_certResolver }}"  # noqa var-naming
 
+# Controls whether labels will be added that expose the Matrix Client-Server API (/_matrix).
+# By default, we try to capture these requests with higher priority than the running homeserver,
+# so that matrix-corporal can do its job of firewalling, etc.
+matrix_corporal_container_labels_matrix_client_api_enabled: true
+matrix_corporal_container_labels_matrix_client_api_traefik_hostname: "{{ matrix_corporal_matrix_homeserver_api_domain_name }}"
+matrix_corporal_container_labels_matrix_client_api_traefik_path_prefix: /_matrix
+matrix_corporal_container_labels_matrix_client_api_traefik_rule: "Host(`{{ matrix_corporal_container_labels_matrix_client_api_traefik_hostname }}`) && PathPrefix(`{{ matrix_corporal_container_labels_matrix_client_api_traefik_path_prefix }}`)"
+matrix_corporal_container_labels_matrix_client_api_traefik_priority: 500
+matrix_corporal_container_labels_matrix_client_api_traefik_entrypoints: "{{ matrix_corporal_container_labels_traefik_entrypoints }}"
+matrix_corporal_container_labels_matrix_client_api_traefik_tls: "{{ matrix_corporal_container_labels_matrix_client_api_traefik_entrypoints != 'web' }}"
+matrix_corporal_container_labels_matrix_client_api_traefik_tls_certResolver: "{{ matrix_corporal_container_labels_traefik_tls_certResolver }}"  # noqa var-naming
+
 # matrix_corporal_container_labels_additional_labels contains a multiline string with additional labels to add to the container label file.
 # See `../templates/labels.j2` for details.
 #
@@ -61,7 +76,11 @@ matrix_corporal_container_labels_api_traefik_tls_certResolver: "{{ matrix_corpor
 matrix_corporal_container_labels_additional_labels: ''
 
 # List of systemd services that matrix-corporal.service depends on
-matrix_corporal_systemd_required_services_list: ['docker.service']
+matrix_corporal_systemd_required_services_list: "{{ matrix_corporal_systemd_required_services_list_default + matrix_corporal_systemd_required_services_list_auto + matrix_corporal_systemd_required_services_list_custom }}"
+matrix_corporal_systemd_required_services_list_default: ['docker.service']
+matrix_corporal_systemd_required_services_list_auto: []
+matrix_corporal_systemd_required_services_list_custom: []
+
 matrix_corporal_docker_image: "{{ matrix_corporal_docker_image_name_prefix }}devture/matrix-corporal:{{ matrix_corporal_docker_image_tag }}"
 matrix_corporal_docker_image_name_prefix: "{{ 'localhost/' if matrix_corporal_container_image_self_build else matrix_container_global_registry_prefix }}"
 matrix_corporal_docker_image_tag: "{{ matrix_corporal_version }}"  # for backward-compatibility
@@ -144,3 +163,5 @@ matrix_corporal_configuration_extension: "{{ matrix_corporal_configuration_exten
 # Holds the final Corporal configuration (a combination of the default and its extension).
 # You most likely don't need to touch this variable. Instead, see `matrix_corporal_configuration_default`.
 matrix_corporal_configuration: "{{ matrix_corporal_configuration_default | combine(matrix_corporal_configuration_extension, recursive=True) }}"
+
+matrix_corporal_self_check_matrix_client_api_url_endpoint_public: "https://{{ matrix_corporal_matrix_homeserver_api_domain_name }}/_matrix/client/corporal"

roles/custom/matrix-corporal/tasks/main.yml

@@ -21,6 +21,7 @@
 
 - tags:
     - self-check
+    - self-check-corporal
   block:
     - when: matrix_corporal_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/self_check.yml"

roles/custom/matrix-corporal/tasks/self_check.yml

@@ -1,24 +1,21 @@
 ---
 
-- ansible.builtin.set_fact:
-    corporal_client_api_url_endpoint_public: "https://{{ matrix_server_fqn_matrix }}/_matrix/client/corporal"
-
 - name: Check Matrix Corporal HTTP gateway
   ansible.builtin.uri:
-    url: "{{ corporal_client_api_url_endpoint_public }}"
+    url: "{{ matrix_corporal_self_check_matrix_client_api_url_endpoint_public }}"
     follow_redirects: none
     return_content: true
   check_mode: false
-  register: result_corporal_client_api
+  register: result_corporal_matrix_client_api
   ignore_errors: true
   delegate_to: 127.0.0.1
   become: false
 
 - name: Fail if Matrix Corporal HTTP gateway not working
   ansible.builtin.fail:
-    msg: "Failed checking Matrix Corporal is fronting the Matrix Client API at `{{ matrix_server_fqn_matrix }}` (checked endpoint: `{{ corporal_client_api_url_endpoint_public }}`). Is matrix-corporal running? Is port 443 open in your firewall? Full error: {{ result_corporal_client_api }}"
+    msg: "Failed checking Matrix Corporal is fronting the Matrix Client API at `{{ matrix_server_fqn_matrix }}` (checked endpoint: `{{ matrix_corporal_self_check_matrix_client_api_url_endpoint_public }}`). Is matrix-corporal running? Is port 443 open in your firewall? Full error: {{ result_corporal_matrix_client_api }}"
-  when: "result_corporal_client_api.failed or 'Matrix Client-Server API protected by Matrix Corporal' not in result_corporal_client_api.content"
+  when: "result_corporal_matrix_client_api.failed or 'Matrix Client-Server API protected by Matrix Corporal' not in result_corporal_matrix_client_api.content"
 
 - name: Report working Matrix Corporal HTTP gateway
   ansible.builtin.debug:
-    msg: "Matrix Corporal is fronting the Matrix Client API at `{{ matrix_server_fqn_matrix }}` (checked endpoint: `{{ corporal_client_api_url_endpoint_public }}`)"
+    msg: "Matrix Corporal is fronting the Matrix Client API at `{{ matrix_server_fqn_matrix }}` (checked endpoint: `{{ matrix_corporal_self_check_matrix_client_api_url_endpoint_public }}`)"

roles/custom/matrix-corporal/tasks/setup_install.yml

@@ -66,6 +66,11 @@
   with_items:
     - labels
 
+- name: Ensure Matrix Corporal container network is created
+  community.general.docker_network:
+    name: "{{ matrix_corporal_container_network }}"
+    driver: bridge
+
 - name: Ensure matrix-corporal.service installed
   ansible.builtin.template:
     src: "{{ role_path }}/templates/systemd/matrix-corporal.service.j2"

roles/custom/matrix-corporal/tasks/validate_config.yml

@@ -6,6 +6,7 @@
       You need to define a required configuration setting (`{{ item }}`) for using matrix-corporal.
   when: "vars[item] == ''"
   with_items:
+    - "matrix_corporal_container_network"
     - "matrix_corporal_matrix_homeserver_api_endpoint"
     - "matrix_corporal_matrix_auth_shared_secret"
     - "matrix_corporal_matrix_registration_shared_secret"

roles/custom/matrix-corporal/templates/labels.j2

@@ -5,21 +5,54 @@ traefik.enable=true
 traefik.docker.network={{ matrix_corporal_container_labels_traefik_docker_network }}
 {% endif %}
 
-{# HTTP API #}
+traefik.http.services.matrix-corporal-gateway.loadbalancer.server.port=41080
+traefik.http.services.matrix-corporal-api.loadbalancer.server.port=41081
+
+{#
+	Corporal API (/_matrix/corporal)
+#}
 {% if matrix_corporal_container_labels_api_enabled %}
 traefik.http.routers.matrix-corporal-api.rule={{ matrix_corporal_container_labels_api_traefik_rule }}
+
 {% if matrix_corporal_container_labels_api_traefik_priority | int > 0 %}
 traefik.http.routers.matrix-corporal-api.priority={{ matrix_corporal_container_labels_api_traefik_priority }}
 {% endif %}
+
 traefik.http.routers.matrix-corporal-api.service=matrix-corporal-api
 traefik.http.routers.matrix-corporal-api.entrypoints={{ matrix_corporal_container_labels_api_traefik_entrypoints }}
+
 traefik.http.routers.matrix-corporal-api.tls={{ matrix_corporal_container_labels_api_traefik_tls | to_json }}
 {% if matrix_corporal_container_labels_api_traefik_tls %}
 traefik.http.routers.matrix-corporal-api.tls.certResolver={{ matrix_corporal_container_labels_api_traefik_tls_certResolver }}
 {% endif %}
-traefik.http.services.matrix-corporal-api.loadbalancer.server.port=41081
+
+{% endif %}
+{#
+	/Corporal API (/_matrix/corporal)
+#}
+
+{#
+	Matrix Client-Server API (/_matrix)
+#}
+{% if matrix_corporal_container_labels_matrix_client_api_enabled %}
+traefik.http.routers.matrix-corporal-matrix-client-api.rule={{ matrix_corporal_container_labels_matrix_client_api_traefik_rule }}
+
+{% if matrix_corporal_container_labels_matrix_client_api_traefik_priority | int > 0 %}
+traefik.http.routers.matrix-corporal-matrix-client-api.priority={{ matrix_corporal_container_labels_matrix_client_api_traefik_priority }}
 {% endif %}
 
+traefik.http.routers.matrix-corporal-matrix-client-api.service=matrix-corporal-gateway
+traefik.http.routers.matrix-corporal-matrix-client-api.entrypoints={{ matrix_corporal_container_labels_matrix_client_api_traefik_entrypoints }}
+
+traefik.http.routers.matrix-corporal-matrix-client-api.tls={{ matrix_corporal_container_labels_matrix_client_api_traefik_tls | to_json }}
+{% if matrix_corporal_container_labels_matrix_client_api_traefik_tls %}
+traefik.http.routers.matrix-corporal-matrix-client-api.tls.certResolver={{ matrix_corporal_container_labels_matrix_client_api_traefik_tls_certResolver }}
+{% endif %}
+
+{% endif %}
+{#
+	/Matrix Client-Server API (/_matrix)
+#}
 
 {% endif %}