Organize Synapse setup files better

roles/matrix-server/tasks/setup/synapse/ext/main.yml

@@ -0,0 +1,11 @@
+---
+
+- include: tasks/setup/synapse/ext/setup_synapse_ext_rest_auth.yml
+
+- include: tasks/setup/synapse/ext/setup_synapse_ext_shared_secret_auth.yml
+
+- include: tasks/setup/synapse/ext/setup_synapse_ext_ldap_auth.yml
+
+- include: tasks/setup/synapse/ext/setup_synapse_ext_mautrix_telegram.yml
+
+- include: tasks/setup/synapse/ext/setup_synapse_ext_mautrix_whatsapp.yml

roles/matrix-server/tasks/setup/synapse/ext/setup_synapse_ext_ldap_auth.yml

@@ -0,0 +1,11 @@
+- set_fact:
+    matrix_synapse_password_providers_enabled: true
+  when: "matrix_synapse_ext_password_provider_ldap_enabled"
+
+- set_fact:
+    matrix_synapse_additional_loggers: >
+      {{ matrix_synapse_additional_loggers }}
+      +
+      {{ [{'name': 'ldap_auth_provider', 'level': 'INFO'}] }}
+  when: "matrix_synapse_ext_password_provider_ldap_enabled"
+

roles/matrix-server/tasks/setup/synapse/ext/setup_synapse_ext_mautrix_telegram.yml

@@ -0,0 +1,68 @@
+---
+
+- name: Ensure Mautrix Telegram image is pulled
+  docker_image:
+    name: "{{ matrix_mautrix_telegram_docker_image }}"
+  when: "matrix_mautrix_telegram_enabled"
+
+- name: Ensure Mautrix Telegram configuration path exists
+  file:
+    path: "{{ matrix_mautrix_telegram_base_path }}"
+    state: directory
+    mode: 0750
+    owner: "{{ matrix_user_username }}"
+    group: "{{ matrix_user_username }}"
+  when: "matrix_mautrix_telegram_enabled"
+
+- stat: "path={{ matrix_mautrix_telegram_base_path }}/config.yaml"
+  register: mautrix_config_file
+
+- name: Ensure Matrix Mautrix telegram config installed
+  template:
+    src: "{{ role_path }}/templates/mautrix-telegram/config.yaml.j2"
+    dest: "{{ matrix_mautrix_telegram_base_path }}/config.yaml"
+    mode: 0644
+    owner: "{{ matrix_user_username }}"
+    group: "{{ matrix_user_username }}"
+  when: "matrix_mautrix_telegram_enabled and mautrix_config_file.stat.exists == False"
+
+- name: Ensure matrix-mautrix-telegram.service installed
+  template:
+    src: "{{ role_path }}/templates/systemd/matrix-mautrix-telegram.service.j2"
+    dest: "/etc/systemd/system/matrix-mautrix-telegram.service"
+    mode: 0644
+  when: "matrix_mautrix_telegram_enabled"
+
+- stat: "path={{ matrix_mautrix_telegram_base_path }}/registration.yaml"
+  register: mautrix_telegram_registration_file
+
+- name: Generate matrix-mautrix-telegram registration.yaml if it doesn't exist
+  shell: /usr/bin/docker run --rm --name matrix-mautrix-telegram-gen -v {{ matrix_mautrix_telegram_base_path }}:/data:z {{ matrix_mautrix_telegram_docker_image }} python3 -m mautrix_telegram -g -c /data/config.yaml -r /data/registration.yaml
+  when: "matrix_mautrix_telegram_enabled and mautrix_telegram_registration_file.stat.exists == False"
+
+- set_fact:
+    matrix_synapse_app_service_config_file_mautrix_telegram: '/app-registration/mautrix-telegram.yml'
+
+- set_fact:
+    matrix_synapse_container_additional_volumes: >
+      {{ matrix_synapse_container_additional_volumes }}
+      +
+      {{ [{'src': '{{ matrix_mautrix_telegram_base_path }}/registration.yaml', 'dst': '{{ matrix_synapse_app_service_config_file_mautrix_telegram }}', 'options': 'ro'}] }}
+  when: "matrix_mautrix_telegram_enabled"
+
+- set_fact:
+    matrix_synapse_app_service_config_files: >
+      {{ matrix_synapse_app_service_config_files }}
+      +
+      {{ ["{{ matrix_synapse_app_service_config_file_mautrix_telegram }}"] | to_nice_json  }}
+  when: "matrix_mautrix_telegram_enabled"
+
+#
+# Tasks related to getting rid of matrix-mautrix-telegram (if it was previously enabled)
+#
+
+- name: Ensure matrix-mautrix-telegram.service doesn't exist
+  file:
+    path: "/etc/systemd/system/matrix-mautrix-telegram.service"
+    state: absent
+  when: "not matrix_mautrix_telegram_enabled"

roles/matrix-server/tasks/setup/synapse/ext/setup_synapse_ext_mautrix_whatsapp.yml

@@ -0,0 +1,68 @@
+---
+
+- name: Ensure Mautrix Whatsapp image is pulled
+  docker_image:
+    name: "{{ matrix_mautrix_whatsapp_docker_image }}"
+  when: "matrix_mautrix_whatsapp_enabled"
+
+- name: Ensure Mautrix Whatsapp configuration path exists
+  file:
+    path: "{{ matrix_mautrix_whatsapp_base_path }}"
+    state: directory
+    mode: 0750
+    owner: "{{ matrix_user_username }}"
+    group: "{{ matrix_user_username }}"
+  when: "matrix_mautrix_whatsapp_enabled"
+
+- stat: "path={{ matrix_mautrix_whatsapp_base_path }}/config.yaml"
+  register: mautrix_config_file
+
+- name: Ensure Matrix Mautrix whatsapp config installed
+  template:
+    src: "{{ role_path }}/templates/mautrix-whatsapp/config.yaml.j2"
+    dest: "{{ matrix_mautrix_whatsapp_base_path }}/config.yaml"
+    mode: 0644
+    owner: "{{ matrix_user_username }}"
+    group: "{{ matrix_user_username }}"
+  when: "matrix_mautrix_whatsapp_enabled and mautrix_config_file.stat.exists == False"
+
+- name: Ensure matrix-mautrix-whatsapp.service installed
+  template:
+    src: "{{ role_path }}/templates/systemd/matrix-mautrix-whatsapp.service.j2"
+    dest: "/etc/systemd/system/matrix-mautrix-whatsapp.service"
+    mode: 0644
+  when: "matrix_mautrix_whatsapp_enabled"
+
+- stat: "path={{ matrix_mautrix_whatsapp_base_path }}/registration.yaml"
+  register: mautrix_whatsapp_registration_file
+
+- name: Generate matrix-mautrix-whatsapp registration.yaml if it doesn't exist
+  shell: /usr/bin/docker run --rm --name matrix-mautrix-whatsapp-gen -v {{ matrix_mautrix_whatsapp_base_path }}:/data:z {{ matrix_mautrix_whatsapp_docker_image }} /usr/bin/mautrix-whatsapp -g -c /data/config.yaml -r /data/registration.yaml
+  when: "matrix_mautrix_whatsapp_enabled and mautrix_whatsapp_registration_file.stat.exists == False"
+
+- set_fact:
+    matrix_synapse_app_service_config_file_mautrix_whatsapp: '/app-registration/mautrix-whatsapp.yml'
+
+- set_fact:
+    matrix_synapse_container_additional_volumes: >
+      {{ matrix_synapse_container_additional_volumes }}
+      +
+      {{ [{'src': '{{ matrix_mautrix_whatsapp_base_path }}/registration.yaml', 'dst': '{{ matrix_synapse_app_service_config_file_mautrix_whatsapp }}', 'options': 'ro'}] }}
+  when: "matrix_mautrix_whatsapp_enabled"
+
+- set_fact:
+    matrix_synapse_app_service_config_files: >
+      {{ matrix_synapse_app_service_config_files }}
+      +
+      {{ ["{{ matrix_synapse_app_service_config_file_mautrix_whatsapp }}"] | to_nice_json  }}
+  when: "matrix_mautrix_whatsapp_enabled"
+
+#
+# Tasks related to getting rid of matrix-mautrix-whatsapp (if it was previously enabled)
+#
+
+- name: Ensure matrix-mautrix-whatsapp.service doesn't exist
+  file:
+    path: "/etc/systemd/system/matrix-mautrix-whatsapp.service"
+    state: absent
+  when: "not matrix_mautrix_whatsapp_enabled"

roles/matrix-server/tasks/setup/synapse/ext/setup_synapse_ext_rest_auth.yml

@@ -0,0 +1,43 @@
+---
+
+#
+# Tasks related to setting up matrix-synapse-rest-auth
+#
+
+- name: Download matrix-synapse-rest-auth
+  get_url:
+    url: "{{ matrix_synapse_ext_password_provider_rest_auth_download_url }}"
+    dest: "{{ matrix_synapse_ext_path }}/rest_auth_provider.py"
+    force: true
+    mode: 0440
+    owner: "{{ matrix_user_username }}"
+    group: "{{ matrix_user_username }}"
+  when: "matrix_synapse_ext_password_provider_rest_auth_enabled"
+
+- set_fact:
+    matrix_synapse_password_providers_enabled: true
+  when: "matrix_synapse_ext_password_provider_rest_auth_enabled"
+
+- set_fact:
+    matrix_synapse_container_additional_volumes: >
+      {{ matrix_synapse_container_additional_volumes }}
+      +
+      {{ [{'src': '{{ matrix_synapse_ext_path }}/rest_auth_provider.py', 'dst': '{{ matrix_synapse_in_container_python_packages_path }}/rest_auth_provider.py', 'options': 'ro'}] }}
+  when: "matrix_synapse_ext_password_provider_rest_auth_enabled"
+
+- set_fact:
+    matrix_synapse_additional_loggers: >
+      {{ matrix_synapse_additional_loggers }}
+      +
+      {{ [{'name': 'rest_auth_provider', 'level': 'INFO'}] }}
+  when: "matrix_synapse_ext_password_provider_rest_auth_enabled"
+
+#
+# Tasks related to getting rid of matrix-synapse-rest-auth (if it was previously enabled)
+#
+
+- name: Ensure matrix-synapse-rest-auth doesn't exist
+  file:
+    path: "{{ matrix_synapse_ext_path }}/rest_auth_provider.py"
+    state: absent
+  when: "not matrix_synapse_ext_password_provider_rest_auth_enabled"

roles/matrix-server/tasks/setup/synapse/ext/setup_synapse_ext_shared_secret_auth.yml

@@ -0,0 +1,48 @@
+---
+
+#
+# Tasks related to setting up matrix-synapse-shared-secret-auth
+#
+
+- name: Fail if Shared Secret Auth enabled, but no secret set
+  fail:
+    msg: "Shared Secret Auth is enabled, but no secret has been set in matrix_synapse_ext_password_provider_shared_secret_auth_shared_secret"
+  when: "matrix_synapse_ext_password_provider_shared_secret_auth_enabled and matrix_synapse_ext_password_provider_shared_secret_auth_shared_secret == ''"
+
+- name: Download matrix-synapse-shared-secret-auth
+  get_url:
+    url: "{{ matrix_synapse_ext_password_provider_shared_secret_auth_download_url }}"
+    dest: "{{ matrix_synapse_ext_path }}/shared_secret_authenticator.py"
+    force: true
+    mode: 0440
+    owner: "{{ matrix_user_username }}"
+    group: "{{ matrix_user_username }}"
+  when: "matrix_synapse_ext_password_provider_shared_secret_auth_enabled"
+
+- set_fact:
+    matrix_synapse_password_providers_enabled: true
+  when: "matrix_synapse_ext_password_provider_shared_secret_auth_enabled"
+
+- set_fact:
+    matrix_synapse_container_additional_volumes: >
+      {{ matrix_synapse_container_additional_volumes }}
+      +
+      {{ [{'src': '{{ matrix_synapse_ext_path }}/shared_secret_authenticator.py', 'dst': '{{ matrix_synapse_in_container_python_packages_path }}/shared_secret_authenticator.py', 'options': 'ro'}] }}
+  when: "matrix_synapse_ext_password_provider_shared_secret_auth_enabled"
+
+- set_fact:
+    matrix_synapse_additional_loggers: >
+      {{ matrix_synapse_additional_loggers }}
+      +
+      {{ [{'name': 'shared_secret_authenticator', 'level': 'INFO'}] }}
+  when: "matrix_synapse_ext_password_provider_shared_secret_auth_enabled"
+
+#
+# Tasks related to getting rid of matrix-synapse-shared-secret-auth (if it was previously enabled)
+#
+
+- name: Ensure matrix-synapse-shared-secret-auth doesn't exist
+  file:
+    path: "{{ matrix_synapse_ext_path }}/shared_secret_authenticator.py"
+    state: absent
+  when: "not matrix_synapse_ext_password_provider_shared_secret_auth_enabled"

roles/matrix-server/tasks/setup/synapse/main.yml

@@ -0,0 +1,7 @@
+---
+
+- include: tasks/setup/synapse/setup_synapse_pre.yml
+
+- include: tasks/setup/synapse/ext/main.yml
+
+- include: tasks/setup/synapse/setup_synapse_main.yml

roles/matrix-server/tasks/setup/synapse/setup_synapse_main.yml

@@ -0,0 +1,86 @@
+---
+
+# This will throw a Permission Denied error if already mounted using fuse
+- name: Check Matrix Synapse media store path
+  stat: path="{{ matrix_synapse_media_store_path }}"
+  register: local_path_media_store_stat
+  ignore_errors: yes
+
+# This is separate and conditional, to ensure we don't execute it
+# if the path already exists or we failed to check, because it's mounted using fuse.
+- name: Ensure Matrix media store path exists
+  file:
+    path: "{{ matrix_synapse_media_store_path }}"
+    state: directory
+    mode: 0750
+    owner: "{{ matrix_user_username }}"
+    group: "{{ matrix_user_username }}"
+  when: "not local_path_media_store_stat.failed and not local_path_media_store_stat.stat.exists"
+
+- name: Ensure Matrix Docker image is pulled
+  docker_image:
+    name: "{{ matrix_synapse_docker_image }}"
+
+- name: Check if a Matrix Synapse configuration exists
+  stat:
+    path: "{{ matrix_synapse_config_dir_path }}/homeserver.yaml"
+  register: matrix_synapse_config_stat
+
+# We do this mostly so that the keys would get generated.
+# We'll replace the rest of the configuration with our own templates below.
+- name: Generate initial Matrix config
+  docker_container:
+    name: matrix-config
+    image: "{{ matrix_synapse_docker_image }}"
+    detach: no
+    cleanup: yes
+    command: generate
+    env:
+      SYNAPSE_CONFIG_PATH: "/data/homeserver.yaml"
+      SYNAPSE_SERVER_NAME: "{{ hostname_matrix }}"
+      SYNAPSE_REPORT_STATS: "no"
+    user: "{{ matrix_user_uid }}:{{ matrix_user_gid }}"
+    volumes:
+      - "{{ matrix_synapse_config_dir_path }}:/data"
+  when: "not matrix_synapse_config_stat.stat.exists"
+
+- name: Ensure Matrix homeserver config installed
+  template:
+    src: "{{ matrix_synapse_template_synapse_homeserver }}"
+    dest: "{{ matrix_synapse_config_dir_path }}/homeserver.yaml"
+    mode: 0644
+
+- name: Ensure Matrix log config installed
+  template:
+    src: "{{ matrix_synapse_template_synapse_log }}"
+    dest: "{{ matrix_synapse_config_dir_path }}/{{ hostname_matrix }}.log.config"
+    mode: 0644
+
+- name: Ensure Synapse environment variables file created
+  template:
+    src: "{{ role_path }}/templates/env/env-synapse.j2"
+    dest: "{{ matrix_environment_variables_data_path }}/synapse"
+    owner: root
+    mode: 0600
+
+- name: Ensure matrix-synapse.service installed
+  template:
+    src: "{{ role_path }}/templates/systemd/matrix-synapse.service.j2"
+    dest: "/etc/systemd/system/matrix-synapse.service"
+    mode: 0644
+
+- name: Ensure matrix-synapse-register-user script created
+  template:
+    src: "{{ role_path }}/templates/usr-local-bin/matrix-synapse-register-user.j2"
+    dest: "/usr/local/bin/matrix-synapse-register-user"
+    mode: 0750
+
+- name: Allow access to Matrix ports in firewalld
+  firewalld:
+    port: "{{ item }}"
+    state: enabled
+    immediate: yes
+    permanent: yes
+  with_items:
+    - '8448/tcp' # Matrix federation
+  when: ansible_os_family == 'RedHat'

roles/matrix-server/tasks/setup/synapse/setup_synapse_pre.yml

@@ -0,0 +1,25 @@
+---
+
+- name: Fail if Macaroon key is missing
+  fail:
+    msg: "You need to set a secret in the matrix_synapse_macaroon_secret_key variable"
+  when: "matrix_synapse_macaroon_secret_key == ''"
+
+- set_fact:
+    matrix_synapse_media_store_parent_path: "{{ matrix_synapse_media_store_path|dirname }}"
+    matrix_synapse_media_store_directory_name: "{{ matrix_synapse_media_store_path|basename }}"
+
+- name: Ensure Matrix Synapse paths exist
+  file:
+    path: "{{ item }}"
+    state: directory
+    mode: 0750
+    owner: "{{ matrix_user_username }}"
+    group: "{{ matrix_user_username }}"
+  with_items:
+    - "{{ matrix_synapse_config_dir_path }}"
+    - "{{ matrix_synapse_run_path }}"
+    - "{{ matrix_synapse_ext_path }}"
+    # We handle matrix_synapse_media_store_path elsewhere (in setup_synapse_main.yml),
+    # because if it's using Goofys and it's already mounted (from before),
+    # trying to chown/chmod it here will cause trouble.