finallycoffee/matrix-docker-ansible-deploy
5
1
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Introduced flags to (1) enable/disable Auth (2) enable/disable openid_server_name pinning. Updated validate_config.yml and added new checks to verify.

Browse Source
This commit is contained in:
Paul N
2023-02-06 15:59:32 +01:00
parent 96dd86d33b
commit 70bea81df7
4 changed files with 44 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
roles/custom/matrix-user-verification-service/defaults/main.yml
View File

@ -43,13 +43,17 @@ matrix_user_verification_service_uvs_disable_ip_blacklist: false
## OPTIONAL
# Require an Auth-Token with API calls. If set to false, UVS will reply to any API call.
# The Auth-Token is defined via: matrix_user_verification_service_uvs_auth_token
matrix_user_verification_service_uvs_require_auth: true
# Auth token to protect the API
# If this is set any calls to the provided API endpoints
# need have the header "Authorization: Bearer changeme".
# matrix_user_verification_service_uvs_auth_token: changeme
# If enabled any calls to the provided API endpoints need have the header "Authorization: Bearer TOKEN".
# A Token will be derived from matrix_homeserver_generic_secret_key in group_vars/matrix_servers
matrix_user_verification_service_uvs_auth_token: ''
# Matrix server name to verify OpenID tokens against.
# Pin UVS to only check openId Tokens for the matrix_server_name configured by this playbook.
matrix_user_verification_service_uvs_pin_openid_verify_server_name: true
# Matrix server name to verify OpenID tokens against.
# This is not the homeserverURL, but rather the domain in the matrix "user ID"
# UVS can also be instructed to verify against the Matrix server name passed in the token, to enable set to ""
matrix_user_verification_service_uvs_openid_verify_server_name: "{{ matrix_domain }}"

23
roles/custom/matrix-user-verification-service/tasks/validate_config.yml
View File

@ -1,8 +1,25 @@
---
- name: verify all necessary variables are present
- name: Verify homeserver_url is not empty
assert:
that:
- matrix_user_verification_service_uvs_access_token is defined and matrix_user_verification_service_uvs_access_token|length
- matrix_user_verification_service_uvs_homeserver_url is defined and matrix_user_verification_service_uvs_homeserver_url|length
- matrix_user_verification_service_uvs_homeserver_url|length > 0
fail_msg: "Missing variable in {{ matrix_user_verification_service_ansible_name }} role"
- name: Verify Auth is configured properly or disabled
assert:
that:
- matrix_user_verification_service_uvs_access_token|length > 0 or not matrix_user_verification_service_uvs_require_auth|bool
fail_msg: "If Auth is enabled, a valid (non empty) TOKEN must be given in 'matrix_user_verification_service_uvs_access_token'."
- name: Verify server_name for openid verification is given, if pinning a single server_name is enabled.
assert:
that:
- matrix_user_verification_service_uvs_openid_verify_server_name|length > 0 or not matrix_user_verification_service_uvs_pin_openid_verify_server_name|bool
fail_msg: "If pinning a single server_name is enabled, a valid (non empty) server_name must be given in 'matrix_user_verification_service_uvs_openid_verify_server_name'."
- name: Verify the homeserver implementation is synapse
assert:
that:
- matrix_homeserver_implementation == 'synapse'
fail_msg: "The User-Verification-Service requires Synapse as homeserver implementation"

6
roles/custom/matrix-user-verification-service/templates/.env.j2
View File

@ -2,8 +2,10 @@ UVS_ACCESS_TOKEN={{ matrix_user_verification_service_uvs_access_token }}
UVS_HOMESERVER_URL={{ matrix_user_verification_service_uvs_homeserver_url }}
UVS_DISABLE_IP_BLACKLIST={{ matrix_user_verification_service_uvs_disable_ip_blacklist }}
UVS_LOG_LEVEL={{ matrix_user_verification_service_uvs_log_level }}
UVS_AUTH_TOKEN={{ matrix_user_verification_service_uvs_auth_token }}
{% if matrix_user_verification_service_uvs_openid_verify_server_name | length > 0 %}
{% if matrix_user_verification_service_uvs_require_auth | bool %}
UVS_AUTH_TOKEN={{ matrix_user_verification_service_uvs_auth_token }}
{% endif %}
{% if matrix_user_verification_service_uvs_pin_openid_verify_server_name | bool %}
UVS_OPENID_VERIFY_SERVER_NAME={{ matrix_user_verification_service_uvs_openid_verify_server_name }}
{% endif %}