finallycoffee/matrix-docker-ansible-deploy
5
1
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Add support for not taking over a server (no matrix-nginx-proxy) and disabling Riot

Browse Source
This commit is contained in:
Slavi Pantaleev
2017-09-12 12:41:44 +03:00
parent b3a8698734
commit 6962bfcc42
12 changed files with 178 additions and 24 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
roles/matrix-server/templates/cron.d/matrix-ssl-certificate-renewal.j2
View File

@ -11,11 +11,14 @@ MAILTO="{{ matrix_ssl_support_email }}"
#
# How renewal works?
#
# acmetool will fail to bind to port :80 (because matrix-nginx-proxy is running there),
# acmetool will fail to bind to port :80 (because matrix-nginx-proxy or some other server is running there),
# and will fall back to its "webroot" validation method.
#
# Thus, it would put validation files in `/var/run/acme/acme-challenge`.
# These files can be retrieved via any vhost on port 80 of matrix-nginx-proxy,
# because it aliases `/.well-known/acme-challenge` to that same directory.
#
# When a custom proxy server (not matrix-nginx-proxy provided by this playbook),
# you'd need to make sure you alias these files corretly or SSL renewal would not work.
15 4 */5 * * root /usr/bin/docker run --rm --name acmetool-host-grab --net=host -v {{ matrix_ssl_certs_path }}:/certs -v {{ matrix_ssl_certs_path }}/run:/var/run/acme -e ACME_EMAIL={{ matrix_ssl_support_email }} willwill/acme-docker acmetool --batch reconcile # --xlog.severity=debug

8
roles/matrix-server/templates/nginx-conf.d/matrix-riot-web.conf.j2
View File

@ -6,7 +6,7 @@ server {
location /.well-known/acme-challenge {
default_type "text/plain";
alias /acmetool-certs/run/acme-challenge;
alias {{ matrix_ssl_certs_path }}/run/acme-challenge;
}
location / {
@ -24,14 +24,14 @@ server {
root /dev/null;
ssl on;
ssl_certificate /acmetool-certs/live/{{ hostname_riot }}/fullchain;
ssl_certificate_key /acmetool-certs/live/{{ hostname_riot }}/privkey;
ssl_certificate {{ matrix_ssl_certs_path }}/live/{{ hostname_riot }}/fullchain;
ssl_certificate_key {{ matrix_ssl_certs_path }}/live/{{ hostname_riot }}/privkey;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_prefer_server_ciphers on;
ssl_ciphers "EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH";
location / {
proxy_pass http://riot:8765;
proxy_pass http://{{ 'riot' if matrix_nginx_proxy_enabled else 'localhost' }}:8765;
proxy_set_header X-Forwarded-For $remote_addr;
}
}

8
roles/matrix-server/templates/nginx-conf.d/matrix-synapse.conf.j2
View File

@ -6,7 +6,7 @@ server {
location /.well-known/acme-challenge {
default_type "text/plain";
alias /acmetool-certs/run/acme-challenge;
alias {{ matrix_ssl_certs_path }}/run/acme-challenge;
}
location / {
@ -24,14 +24,14 @@ server {
root /dev/null;
ssl on;
ssl_certificate /acmetool-certs/live/{{ hostname_matrix }}/fullchain;
ssl_certificate_key /acmetool-certs/live/{{ hostname_matrix }}/privkey;
ssl_certificate {{ matrix_ssl_certs_path }}/live/{{ hostname_matrix }}/fullchain;
ssl_certificate_key {{ matrix_ssl_certs_path }}/live/{{ hostname_matrix }}/privkey;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_prefer_server_ciphers on;
ssl_ciphers "EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH";
location /_matrix {
proxy_pass http://synapse:8008;
proxy_pass http://{{ 'synapse' if matrix_nginx_proxy_enabled else 'localhost' }}:8008;
proxy_set_header X-Forwarded-For $remote_addr;
client_body_buffer_size 25M;

2
roles/matrix-server/templates/systemd/matrix-nginx-proxy.service.j2
View File

@ -17,7 +17,7 @@ ExecStart=/usr/bin/docker run --rm --name matrix-nginx-proxy \
--link matrix-synapse:synapse \
--link matrix-riot-web:riot \
-v {{ matrix_nginx_proxy_confd_path }}:/etc/nginx/conf.d \
-v {{ matrix_ssl_certs_path }}:/acmetool-certs \
-v {{ matrix_ssl_certs_path }}:{{ matrix_ssl_certs_path }} \
{{ docker_nginx_image }}
ExecStop=-/usr/bin/docker kill matrix-nginx-proxy
ExecStop=-/usr/bin/docker rm matrix-nginx-proxy

3
roles/matrix-server/templates/systemd/matrix-riot-web.service.j2
View File

@ -9,6 +9,9 @@ ExecStartPre=-/usr/bin/docker kill matrix-riot-web
ExecStartPre=-/usr/bin/docker rm matrix-riot-web
ExecStart=/usr/bin/docker run --rm --name matrix-riot-web \
-v {{ matrix_nginx_riot_web_data_path }}:/data \
{% if not matrix_nginx_proxy_enabled %}
-p 127.0.0.1:8765:8765 \
{% endif %}
{{ docker_riot_image }}
ExecStop=-/usr/bin/docker kill matrix-riot-web
ExecStop=-/usr/bin/docker rm matrix-riot-web

3
roles/matrix-server/templates/systemd/matrix-synapse.service.j2
View File

@ -21,6 +21,9 @@ ExecStart=/usr/bin/docker run --rm --name matrix-synapse \
--link matrix-postgres:{{ matrix_postgres_connection_hostname }} \
{% endif %}
-p 8448:8448 \
{% if not matrix_nginx_proxy_enabled %}
-p 127.0.0.1:8008:8008 \
{% endif %}
-p 3478:3478 \
-p 3478:3478/udp \
-p {{ matrix_coturn_turn_udp_min_port }}-{{ matrix_coturn_turn_udp_max_port }}:{{ matrix_coturn_turn_udp_min_port }}-{{ matrix_coturn_turn_udp_max_port }}/udp \