Add support for Matrix Authentication Service

Fixes https://github.com/spantaleev/matrix-docker-ansible-deploy/issues/3108

Related to https://github.com/spantaleev/matrix-docker-ansible-deploy/pull/3562

roles/custom/matrix-authentication-service/tasks/install.yml

@@ -0,0 +1,103 @@
+---
+
+- name: Ensure Matrix Authentication Service paths exist
+  ansible.builtin.file:
+    path: "{{ item.path }}"
+    state: directory
+    mode: 0750
+    owner: "{{ matrix_user_username }}"
+    group: "{{ matrix_user_groupname }}"
+  with_items:
+    - {path: "{{ matrix_authentication_service_base_path }}", when: true}
+    - {path: "{{ matrix_authentication_service_bin_path }}", when: true}
+    - {path: "{{ matrix_authentication_service_config_path }}", when: true}
+    - {path: "{{ matrix_authentication_service_data_path }}", when: true}
+    - {path: "{{ matrix_authentication_service_data_keys_path }}", when: true}
+    - {path: "{{ matrix_authentication_service_container_src_files_path }}", when: "{{ matrix_authentication_service_container_image_self_build }}"}
+  when: "item.when | bool"
+
+- when: matrix_authentication_service_key_management_enabled | bool
+  block:
+    - name: Ensure openssl installed
+      ansible.builtin.package:
+        name: openssl
+        state: present
+
+    - name: Prepare private key
+      ansible.builtin.include_tasks: "{{ role_path }}/tasks/util/prepare_key.yml"
+      with_items: "{{ matrix_authentication_service_key_management_list }}"
+      loop_control:
+        loop_var: private_key_definition
+
+- name: Ensure Matrix Authentication Service configuration installed
+  ansible.builtin.copy:
+    content: "{{ matrix_authentication_service_configuration | to_nice_yaml(indent=2, width=999999) }}"
+    dest: "{{ matrix_authentication_service_config_path }}/config.yaml"
+    mode: 0644
+    owner: "{{ matrix_user_username }}"
+    group: "{{ matrix_user_groupname }}"
+
+- name: Ensure Matrix Authentication Service support files created
+  ansible.builtin.template:
+    src: "{{ item.src }}"
+    dest: "{{ item.dest }}"
+    mode: "{{ item.mode }}"
+    owner: "{{ matrix_user_username }}"
+    group: "{{ matrix_user_groupname }}"
+  with_items:
+    - src: "{{ role_path }}/templates/env.j2"
+      dest: "{{ matrix_authentication_service_config_path }}/env"
+      mode: '0644'
+    - src: "{{ role_path }}/templates/labels.j2"
+      dest: "{{ matrix_authentication_service_config_path }}/labels"
+      mode: '0644'
+    - src: "{{ role_path }}/templates/bin/register-user.j2"
+      dest: "{{ matrix_authentication_service_bin_path }}/register-user"
+      mode: '0755'
+    - src: "{{ role_path }}/templates/bin/mas-cli.j2"
+      dest: "{{ matrix_authentication_service_bin_path }}/mas-cli"
+      mode: '0755'
+
+- name: Ensure Matrix Authentication Service container image is pulled
+  community.docker.docker_image:
+    name: "{{ matrix_authentication_service_container_image }}"
+    source: "{{ 'pull' if ansible_version.major > 2 or ansible_version.minor > 7 else omit }}"
+    force_source: "{{ matrix_authentication_service_container_image_force_pull if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}"
+    force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else matrix_authentication_service_container_image_force_pull }}"
+  when: "not matrix_authentication_service_container_image_self_build | bool"
+  register: result
+  retries: "{{ devture_playbook_help_container_retries_count }}"
+  delay: "{{ devture_playbook_help_container_retries_delay }}"
+  until: result is not failed
+
+- when: "matrix_authentication_service_container_image_self_build | bool"
+  block:
+    - name: Ensure Matrix Authentication Service repository is present on self-build
+      ansible.builtin.git:
+        repo: "{{ matrix_authentication_service_container_repo }}"
+        version: "{{ matrix_authentication_service_container_repo_version }}"
+        dest: "{{ matrix_authentication_service_container_src_files_path }}"
+        force: "yes"
+      become: true
+      become_user: "{{ matrix_user_username }}"
+
+    - name: Ensure Matrix Authentication Service container image is built
+      ansible.builtin.command:
+        cmd: |-
+          {{ devture_systemd_docker_base_host_command_docker }} buildx build
+          --tag={{ matrix_authentication_service_container_image }}
+          --file={{ matrix_authentication_service_container_src_files_path }}/Dockerfile
+          {{ matrix_authentication_service_container_src_files_path }}
+      changed_when: true
+
+- name: Ensure Matrix Authentication Service container network is created
+  community.general.docker_network:
+    enable_ipv6: "{{ devture_systemd_docker_base_ipv6_enabled }}"
+    name: "{{ matrix_authentication_service_container_network }}"
+    driver: bridge
+
+- name: Ensure matrix-authentication-service.service installed
+  ansible.builtin.template:
+    src: "{{ role_path }}/templates/systemd/matrix-authentication-service.service.j2"
+    dest: "{{ devture_systemd_docker_base_systemd_path }}/matrix-authentication-service.service"
+    mode: 0644

roles/custom/matrix-authentication-service/tasks/main.yml

@@ -0,0 +1,38 @@
+---
+
+- tags:
+    - setup-all
+    - setup-matrix-authentication-service
+    - install-all
+    - install-matrix-authentication-service
+  block:
+    - when: matrix_authentication_service_enabled | bool
+      ansible.builtin.include_tasks: "{{ role_path }}/tasks/validate_config.yml"
+
+    - when: matrix_authentication_service_enabled | bool
+      ansible.builtin.include_tasks: "{{ role_path }}/tasks/install.yml"
+
+- tags:
+    - matrix-authentication-service-syn2mas
+  block:
+    - when: matrix_authentication_service_enabled | bool
+      ansible.builtin.include_tasks: "{{ role_path }}/tasks/syn2mas.yml"
+
+- tags:
+    - matrix-authentication-service-mas-cli-doctor
+  block:
+    - when: matrix_authentication_service_enabled | bool
+      ansible.builtin.include_tasks: "{{ role_path }}/tasks/mas_cli_doctor.yml"
+
+- tags:
+    - register-user
+  block:
+    - when: matrix_authentication_service_enabled | bool
+      ansible.builtin.include_tasks: "{{ role_path }}/tasks/register_user.yml"
+
+- tags:
+    - setup-all
+    - setup-matrix-authentication-service
+  block:
+    - when: not matrix_authentication_service_enabled | bool
+      ansible.builtin.include_tasks: "{{ role_path }}/tasks/uninstall.yml"

roles/custom/matrix-authentication-service/tasks/mas_cli_doctor.yml

@@ -0,0 +1,32 @@
+---
+
+- name: Ensure Matrix Authentication Service is started
+  ansible.builtin.service:
+    name: matrix-authentication-service
+    state: started
+    daemon_reload: true
+  register: matrix_authentication_service_mas_ensure_started_result
+
+- when: matrix_authentication_service_mas_ensure_started_result.changed | bool
+  name: Wait a bit, so that Matrix Authentication Service can start
+  ansible.builtin.wait_for:
+    timeout: "{{ matrix_authentication_service_syn2mas_start_wait_time_seconds }}"
+  delegate_to: 127.0.0.1
+  become: false
+
+- name: Generate mas-cli doctor command
+  ansible.builtin.set_fact:
+    matrix_authentication_service_mas_cli_doctor_command: >-
+      {{ matrix_authentication_service_bin_path }}/mas-cli doctor
+  tags:
+    - skip_ansible_lint
+
+- name: Run mas-cli doctor
+  ansible.builtin.command:
+    cmd: "{{ matrix_authentication_service_mas_cli_doctor_command }}"
+  register: matrix_authentication_service_mas_cli_doctor_command_result
+  changed_when: matrix_authentication_service_mas_cli_doctor_command_result.rc == 0
+
+- name: Print mas-cli doctor command result
+  ansible.builtin.debug:
+    var: matrix_authentication_service_mas_cli_doctor_command_result

roles/custom/matrix-authentication-service/tasks/register_user.yml

@@ -0,0 +1,34 @@
+---
+
+- name: Fail if playbook called incorrectly
+  ansible.builtin.fail:
+    msg: "The `username` variable needs to be provided to this playbook, via --extra-vars"
+  when: "username is not defined or username == '<your-username>'"
+
+- name: Fail if playbook called incorrectly
+  ansible.builtin.fail:
+    msg: "The `password` variable needs to be provided to this playbook, via --extra-vars"
+  when: "password is not defined or password == '<your-password>'"
+
+- name: Fail if playbook called incorrectly
+  ansible.builtin.fail:
+    msg: "The `admin` variable needs to be provided to this playbook, via --extra-vars"
+  when: "admin is not defined or admin not in ['yes', 'no']"
+
+- name: Ensure Matrix Authentication Service is started
+  ansible.builtin.service:
+    name: matrix-authentication-service
+    state: started
+    daemon_reload: true
+  register: matrix_authentication_service_start_result
+
+- name: Wait a while, so that Matrix Authentication Service can start
+  ansible.builtin.pause:
+    seconds: 7
+  when: matrix_authentication_service_start_result.changed | bool
+
+- name: Register user
+  ansible.builtin.command:
+    cmd: "{{ matrix_authentication_service_bin_path }}/register-user {{ username | quote }} {{ password | quote }} {{ '1' if admin == 'yes' else '0' }}"
+  register: matrix_authentication_service_register_user_result
+  changed_when: matrix_authentication_service_register_user_result.rc == 0

roles/custom/matrix-authentication-service/tasks/syn2mas.yml

@@ -0,0 +1,137 @@
+---
+
+- set_fact:
+    matrix_authentication_service_syn2mas_dry_run: "{{ matrix_authentication_service_syn2mas_dry_run | bool }}"
+
+- name: Abort, if not using Synapse
+  when: not matrix_synapse_enabled | bool
+  ansible.builtin.fail:
+    msg: |-
+      You can only use syn2mas to migrate from Synapse to Matrix Authentication Service.
+      Other homeserver implementations are not supported.
+
+- name: Fail if required matrix-authentication-service syn2mas settings not defined
+  ansible.builtin.fail:
+    msg: >-
+      You need to define a required configuration setting (`{{ item.name }}`).
+  when: "item.when | bool and vars[item.name] | length == 0"
+  with_items:
+    - {'name': 'matrix_authentication_service_syn2mas_synapse_homeserver_config_path', when: true}
+
+- name: Check if Synapse homeserver config file exists
+  ansible.builtin.stat:
+    path: "{{ matrix_authentication_service_syn2mas_synapse_homeserver_config_path }}"
+  register: matrix_authentication_service_syn2mas_synapse_config_stat
+
+- name: Fail if Synapse homeserver config file does not exist
+  ansible.builtin.fail:
+    msg: "The Synapse homeserver config file does not exist at the specified path: {{ matrix_authentication_service_syn2mas_synapse_homeserver_config_path }}"
+  when: not matrix_authentication_service_syn2mas_synapse_config_stat.stat.exists
+
+- name: Ensure Matrix Authentication Service syn2mas container image is pulled
+  community.docker.docker_image:
+    name: "{{ matrix_authentication_service_syn2mas_container_image }}"
+    source: "{{ 'pull' if ansible_version.major > 2 or ansible_version.minor > 7 else omit }}"
+    force_source: "{{ matrix_authentication_service_syn2mas_container_image_force_pull if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}"
+    force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else matrix_authentication_service_syn2mas_container_image_force_pull }}"
+  when: "not matrix_authentication_service_syn2mas_container_image_self_build | bool"
+  register: result
+  retries: "{{ devture_playbook_help_container_retries_count }}"
+  delay: "{{ devture_playbook_help_container_retries_delay }}"
+  until: result is not failed
+
+- when: "matrix_authentication_service_syn2mas_container_image_self_build | bool"
+  block:
+    - name: Ensure Matrix Authentication Service repository is present on self-build
+      ansible.builtin.git:
+        repo: "{{ matrix_authentication_service_container_repo }}"
+        version: "{{ matrix_authentication_service_container_repo_version }}"
+        dest: "{{ matrix_authentication_service_container_src_files_path }}"
+        force: "yes"
+      become: true
+      become_user: "{{ matrix_user_username }}"
+      register: matrix_authentication_service_git_pull_results
+
+    - name: Ensure Matrix Authentication Service syn2mas container image is built
+      ansible.builtin.command:
+        cmd: |-
+          {{ devture_systemd_docker_base_host_command_docker }} buildx build
+          --tag={{ matrix_authentication_service_syn2mas_container_image }}
+          --file={{ matrix_authentication_service_container_src_files_path }}/tools/syn2mas/Dockerfile
+          {{ matrix_authentication_service_container_src_files_path }}/tools/syn2mas
+      changed_when: true
+
+- name: Ensure Synapse is stopped
+  when: not matrix_authentication_service_syn2mas_dry_run | bool
+  ansible.builtin.service:
+    name: matrix-synapse
+    state: stopped
+    daemon_reload: true
+  register: matrix_authentication_service_synapse_ensure_stopped_result
+
+# We probably don't necessarily need to stop this, because:
+# - the upstream docs don't say we should.
+# - while a migration is in progress (see `matrix_authentication_service_migration_in_progress`),
+#   we don't even add compatibility layer labels, so MAS would not be used anyway.
+#
+# Still, it's probably safer to stop it anyway.
+- name: Ensure Matrix Authentication Service is stopped
+  ansible.builtin.service:
+    name: matrix-authentication-service
+    state: stopped
+  register: matrix_authentication_service_mas_ensure_stopped_result
+
+- name: Generate syn2mas migration command
+  ansible.builtin.set_fact:
+    matrix_authentication_service_syn2mas_migration_command: >-
+      {{ devture_systemd_docker_base_host_command_docker }} run
+      --rm
+      --name=matrix-authentication-service-syn2mas
+      --log-driver=none
+      --user={{ matrix_authentication_service_uid }}:{{ matrix_authentication_service_gid }}
+      --cap-drop=ALL
+      --network={{ matrix_authentication_service_syn2mas_container_network }}
+      --mount type=bind,src={{ matrix_authentication_service_syn2mas_synapse_homeserver_config_path }},dst=/homeserver.yaml,ro
+      --mount type=bind,src={{ matrix_authentication_service_config_path }}/config.yaml,dst=/mas-config.yaml,ro
+      {{ matrix_authentication_service_syn2mas_container_image }}
+      --command=migrate
+      --synapseConfigFile=/homeserver.yaml
+      --masConfigFile=/mas-config.yaml
+      {% if matrix_authentication_service_syn2mas_dry_run | bool %}--dryRun{% endif %}
+  tags:
+    - skip_ansible_lint
+
+# This is a hack.
+# See: https://ansibledaily.com/print-to-standard-output-without-escaping/
+#
+# We want to run `debug: msg=".."`, but that dumps it as JSON and escapes double quotes within it,
+# which ruins the command (`matrix_authentication_service_syn2mas_migration_command`)
+- name: Note about syn2mas migration
+  ansible.builtin.set_fact:
+    dummy: true
+  with_items:
+    - >-
+        Running syn2mas migration using the following command: `{{ matrix_authentication_service_syn2mas_migration_command }}`.
+        If this crashes, you can stop Synapse (`systemctl stop matrix-synapse`) and run the command manually.
+
+- name: Perform syn2mas migration
+  ansible.builtin.command:
+    cmd: "{{ matrix_authentication_service_syn2mas_migration_command }}"
+  register: matrix_authentication_service_syn2mas_migration_command_result
+  changed_when: matrix_authentication_service_syn2mas_migration_command_result.rc == 0
+
+- name: Print syn2mas migration command result
+  ansible.builtin.debug:
+    var: matrix_authentication_service_syn2mas_migration_command_result
+
+- when: "not matrix_authentication_service_syn2mas_dry_run and matrix_authentication_service_synapse_ensure_stopped_result.changed"
+  name: Ensure Synapse is started (if it previously was)
+  ansible.builtin.service:
+    name: matrix-synapse
+    state: started
+
+- when: "not matrix_authentication_service_syn2mas_dry_run and matrix_authentication_service_mas_ensure_stopped_result.changed"
+  name: Ensure Matrix Authentication Service is started (if it previously was)
+  ansible.builtin.service:
+    name: matrix-authentication-service
+    state: started

roles/custom/matrix-authentication-service/tasks/uninstall.yml

@@ -0,0 +1,25 @@
+---
+
+- name: Check existence of matrix-authentication-service service
+  ansible.builtin.stat:
+    path: "{{ devture_systemd_docker_base_systemd_path }}/matrix-authentication-service.service"
+  register: matrix_authentication_service_service_stat
+
+- when: matrix_authentication_service_service_stat.stat.exists | bool
+  block:
+    - name: Ensure matrix-authentication-service is stopped
+      ansible.builtin.service:
+        name: matrix-authentication-service
+        state: stopped
+        enabled: false
+        daemon_reload: true
+
+    - name: Ensure matrix-authentication-service.service doesn't exist
+      ansible.builtin.file:
+        path: "{{ devture_systemd_docker_base_systemd_path }}/matrix-authentication-service.service"
+        state: absent
+
+    - name: Ensure Matrix Authentication Service paths don't exist
+      ansible.builtin.file:
+        path: "{{ matrix_authentication_service_base_path }}"
+        state: absent

roles/custom/matrix-authentication-service/tasks/util/prepare_key.yml

@@ -0,0 +1,10 @@
+- name: Prepare Matrix Authentication Service private key file path ({{ private_key_definition.key_file }})
+  ansible.builtin.set_fact:
+    matrix_authentication_service_private_key_file_path: "{{ matrix_authentication_service_data_keys_path }}/{{ private_key_definition.key_file }}"
+
+- name: Prepare Matrix Authentication Service private key file ({{ private_key_definition.key_file }})
+  ansible.builtin.command:
+    cmd: "{{ private_key_definition.generation_command | replace('__KEY_FILE_PATH__', matrix_authentication_service_private_key_file_path) }}"
+    creates: "{{ matrix_authentication_service_private_key_file_path }}"
+  become: true
+  become_user: "{{ matrix_user_username }}"

roles/custom/matrix-authentication-service/tasks/validate_config.yml

@@ -0,0 +1,31 @@
+---
+
+- name: Fail if required matrix-authentication-service settings not defined
+  ansible.builtin.fail:
+    msg: >-
+      You need to define a required configuration setting (`{{ item.name }}`).
+  when: "item.when | bool and vars[item.name] | length == 0"
+  with_items:
+    - {'name': 'matrix_authentication_service_hostname', when: true}
+    - {'name': 'matrix_authentication_service_config_database_username', when: true}
+    - {'name': 'matrix_authentication_service_config_database_password', when: true}
+    - {'name': 'matrix_authentication_service_config_database_host', when: true}
+    - {'name': 'matrix_authentication_service_config_database_database', when: true}
+    - {'name': 'matrix_authentication_service_config_secrets_encryption', when: true}
+    - {'name': 'matrix_authentication_service_config_matrix_homeserver', when: true}
+    - {'name': 'matrix_authentication_service_config_matrix_secret', when: true}
+    - {'name': 'matrix_authentication_service_config_matrix_endpoint', when: true}
+    - {'name': 'matrix_authentication_service_container_labels_public_main_hostname', when: "{{ matrix_authentication_service_container_labels_traefik_enabled }}"}
+    - {'name': 'matrix_authentication_service_container_labels_public_compatibility_layer_hostname', when: "{{ matrix_authentication_service_container_labels_public_compatibility_layer_enabled }}"}
+    - {'name': 'matrix_authentication_service_container_labels_internal_compatibility_layer_entrypoints', when: "{{ matrix_authentication_service_container_labels_internal_compatibility_layer_enabled }}"}
+    - {'name': 'matrix_authentication_service_config_email_hostname', when: "{{ matrix_authentication_service_config_email_transport == 'smtp' }}"}
+
+- name: Fail if matrix_authentication_service_config_secrets_encryption is not 64 characters long
+  ansible.builtin.fail:
+    msg: "matrix_authentication_service_config_secrets_encryption must be exactly 64 characters long (preferably generated via `openssl rand -hex 32`)"
+  when: "matrix_authentication_service_config_secrets_encryption | length != 64"
+
+- name: Fail if matrix_authentication_service_config_email_transport is invalid
+  ansible.builtin.fail:
+    msg: "matrix_authentication_service_config_email_transport must be one of: blackhole, smtp, or aws_ses"
+  when: "matrix_authentication_service_config_email_transport not in ['blackhole', 'smtp', 'aws_ses']"