finallycoffee/matrix-docker-ansible-deploy
5
1
Fork 0
Code Issues Pull Requests Releases Wiki Activity

sync with previous repo

Browse Source
This commit is contained in:
Michael Collins
2021-08-13 16:05:57 +08:00
parent 83a90f1cd1
commit 98e6cd685d
641 changed files with 43857 additions and 55 deletions
Download Patch File Download Diff File Expand all files Collapse all files

106
roles/matrix-corporal/defaults/main.yml Normal file
View File

@ -0,0 +1,106 @@
# matrix-corporal is a reconciliator and gateway for a managed Matrix server.
# See: https://github.com/devture/matrix-corporal
matrix_corporal_enabled: true
matrix_corporal_container_image_self_build: false
matrix_corporal_container_image_self_build_repo: "https://github.com/devture/matrix-corporal.git"
# Controls whether the matrix-corporal container exposes its gateway HTTP port (tcp/41080 in the container).
#
# Takes an "<ip>:<port>" or "<port>" value (e.g. "127.0.0.1:41080"), or empty string to not expose.
matrix_corporal_container_http_gateway_host_bind_port: ''
# Controls whether the matrix-corporal container exposes its API HTTP port (tcp/41081 in the container).
#
# Takes an "<ip>:<port>" or "<port>" value (e.g. "127.0.0.1:41081"), or empty string to not expose.
matrix_corporal_container_http_api_host_bind_port: ''
# A list of extra arguments to pass to the container
matrix_corporal_container_extra_arguments: []
# List of systemd services that matrix-corporal.service depends on
matrix_corporal_systemd_required_services_list: ['docker.service']
matrix_corporal_version: 2.1.1
matrix_corporal_docker_image: "{{ matrix_corporal_docker_image_name_prefix }}devture/matrix-corporal:{{ matrix_corporal_docker_image_tag }}"
matrix_corporal_docker_image_name_prefix: "{{ 'localhost/' if matrix_corporal_container_image_self_build else matrix_container_global_registry_prefix }}"
matrix_corporal_docker_image_tag: "{{ matrix_corporal_version }}" # for backward-compatibility
matrix_corporal_docker_image_force_pull: "{{ matrix_corporal_docker_image.endswith(':latest') }}"
matrix_corporal_base_path: "{{ matrix_base_data_path }}/corporal"
matrix_corporal_container_src_files_path: "{{ matrix_corporal_base_path }}/container-src"
matrix_corporal_config_dir_path: "{{ matrix_corporal_base_path }}/config"
matrix_corporal_cache_dir_path: "{{ matrix_corporal_base_path }}/cache"
matrix_corporal_var_dir_path: "{{ matrix_corporal_base_path }}/var"
matrix_corporal_matrix_homeserver_domain_name: "{{ matrix_domain }}"
# Controls where matrix-corporal can reach your Synapse server (e.g. "http://matrix-synapse:8008").
# If Synapse runs on the same machine, you may need to add its service to `matrix_corporal_systemd_required_services_list`.
matrix_corporal_matrix_homeserver_api_endpoint: ""
# The shared secret between matrix-corporal and Synapse's shared-secret-auth password provider module.
# To use matrix-corporal, the shared-secret-auth password provider needs to be enabled and the secret needs to be identical.
matrix_corporal_matrix_auth_shared_secret: ""
# The shared secret for registering users with Synapse.
# Needs to be identical to Synapse's `registration_shared_secret` setting.
matrix_corporal_matrix_registration_shared_secret: ""
matrix_corporal_matrix_timeout_milliseconds: 45000
matrix_corporal_reconciliation_retry_interval_milliseconds: 30000
matrix_corporal_corporal_user_id_local_part: "matrix-corporal"
matrix_corporal_http_gateway_timeout_milliseconds: 60000
# If enabled, matrix-corporal exposes a `POST /_matrix/corporal/_matrix-internal/identity/v1/check_credentials` API
# on the gateway (Client-Server API) server.
# This API can then be used together with the REST Auth password provider by pointing it to matrix-corporal (e.g. `http://matrix-corporal:41080/_matrix/corporal`).
# Doing so allows Interactive Authentication to work.
matrix_corporal_http_gateway_internal_rest_auth_enabled: false
matrix_corporal_http_api_enabled: false
matrix_corporal_http_api_auth_token: ""
matrix_corporal_http_api_timeout_milliseconds: 15000
# Matrix Corporal policy provider configuration (goes directly into the configuration's `PolicyProvider` value)
matrix_corporal_policy_provider_config: ""
matrix_corporal_debug: false
# Default Corporal configuration template which covers the generic use case.
# You can customize it by controlling the various variables inside it.
#
# For a more advanced customization, you can extend the default (see `matrix_corporal_configuration_extension_json`)
# or completely replace this variable with your own template.
#
# The side-effect of this lookup is that Ansible would even parse the JSON for us, returning a dict.
# This is unlike what it does when looking up YAML template files (no automatic parsing there).
matrix_corporal_configuration_default: "{{ lookup('template', 'templates/config.json.j2') }}"
# Your custom JSON configuration for Corporal should go to `matrix_corporal_configuration_extension_json`.
# This configuration extends the default starting configuration (`matrix_corporal_configuration_default`).
#
# You can override individual variables from the default configuration, or introduce new ones.
#
# If you need something more special, you can take full control by
# completely redefining `matrix_corporal_configuration_default`.
#
# Example configuration extension follows:
#
# matrix_corporal_configuration_extension_json: |
# {
# "Matrix": {
# "TimeoutMilliseconds": 60000
# }
# }
matrix_corporal_configuration_extension_json: '{}'
matrix_corporal_configuration_extension: "{{ matrix_corporal_configuration_extension_json|from_json if matrix_corporal_configuration_extension_json|from_json is mapping else {} }}"
# Holds the final Corporal configuration (a combination of the default and its extension).
# You most likely don't need to touch this variable. Instead, see `matrix_corporal_configuration_default`.
matrix_corporal_configuration: "{{ matrix_corporal_configuration_default|combine(matrix_corporal_configuration_extension, recursive=True) }}"

10
roles/matrix-corporal/tasks/init.yml Normal file
View File

@ -0,0 +1,10 @@
# See https://github.com/spantaleev/matrix-docker-ansible-deploy/issues/1070
# and https://github.com/spantaleev/matrix-docker-ansible-deploy/commit/1ab507349c752042d26def3e95884f6df8886b74#commitcomment-51108407
- name: Fail if trying to self-build on Ansible < 2.8
fail:
msg: "To self-build the Element image, you should use Ansible 2.8 or higher. See docs/ansible.md"
when: "ansible_version.major == 2 and ansible_version.minor < 8 and matrix_corporal_container_image_self_build and matrix_corporal_enabled"
- set_fact:
matrix_systemd_services_list: "{{ matrix_systemd_services_list + ['matrix-corporal.service'] }}"
when: matrix_corporal_enabled|bool

22
roles/matrix-corporal/tasks/main.yml Normal file
View File

@ -0,0 +1,22 @@
- import_tasks: "{{ role_path }}/tasks/init.yml"
tags:
- always
- import_tasks: "{{ role_path }}/tasks/validate_config.yml"
when: "run_setup|bool and matrix_corporal_enabled|bool"
tags:
- setup-all
- setup-corporal
- import_tasks: "{{ role_path }}/tasks/setup_corporal.yml"
when: run_setup|bool
tags:
- setup-all
- setup-corporal
- import_tasks: "{{ role_path }}/tasks/self_check_corporal.yml"
delegate_to: 127.0.0.1
become: false
when: "run_self_check|bool and matrix_corporal_enabled|bool"
tags:
- self-check

22
roles/matrix-corporal/tasks/self_check_corporal.yml Normal file
View File

@ -0,0 +1,22 @@
---
- set_fact:
corporal_client_api_url_endpoint_public: "https://{{ matrix_server_fqn_matrix }}/_matrix/client/corporal"
- name: Check Matrix Corporal HTTP gateway
uri:
url: "{{ corporal_client_api_url_endpoint_public }}"
follow_redirects: none
return_content: true
check_mode: no
register: result_corporal_client_api
ignore_errors: true
- name: Fail if Matrix Corporal HTTP gateway not working
fail:
msg: "Failed checking Matrix Corporal is fronting the Matrix Client API at `{{ matrix_server_fqn_matrix }}` (checked endpoint: `{{ corporal_client_api_url_endpoint_public }}`). Is matrix-corporal running? Is port 443 open in your firewall? Full error: {{ result_corporal_client_api }}"
when: "result_corporal_client_api.failed or 'Matrix Client-Server API protected by Matrix Corporal' not in result_corporal_client_api.content"
- name: Report working Matrix Corporal HTTP gateway
debug:
msg: "Matrix Corporal is fronting the Matrix Client API at `{{ matrix_server_fqn_matrix }}` (checked endpoint: `{{ corporal_client_api_url_endpoint_public }}`)"

114
roles/matrix-corporal/tasks/setup_corporal.yml Normal file
View File

@ -0,0 +1,114 @@
---
#
# Tasks related to setting up matrix-corporal
#
- name: Ensure Matrix Corporal paths exist
file:
path: "{{ item }}"
state: directory
mode: 0750
owner: "{{ matrix_user_username }}"
group: "{{ matrix_user_groupname }}"
with_items:
- "{{ matrix_corporal_config_dir_path }}"
- "{{ matrix_corporal_cache_dir_path }}"
- "{{ matrix_corporal_var_dir_path }}"
when: matrix_corporal_enabled|bool
- name: Ensure Matrix Corporal repository is present on self-build
git:
repo: "{{ matrix_corporal_container_image_self_build_repo }}"
dest: "{{ matrix_corporal_container_src_files_path }}"
version: "{{ matrix_corporal_docker_image.split(':')[1] }}"
force: "yes"
register: matrix_corporal_git_pull_results
when: "matrix_corporal_enabled|bool and matrix_corporal_container_image_self_build|bool"
- name: Ensure Matrix Corporal Docker image is built
docker_image:
name: "{{ matrix_corporal_docker_image }}"
source: build
force_source: "{{ matrix_corporal_git_pull_results.changed if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}"
force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else matrix_corporal_git_pull_results.changed }}"
build:
dockerfile: etc/docker/Dockerfile
path: "{{ matrix_corporal_container_src_files_path }}"
pull: yes
when: "matrix_corporal_enabled|bool and matrix_corporal_container_image_self_build|bool"
- name: Ensure Matrix Corporal Docker image is pulled
docker_image:
name: "{{ matrix_corporal_docker_image }}"
source: "{{ 'pull' if ansible_version.major > 2 or ansible_version.minor > 7 else omit }}"
force_source: "{{ matrix_corporal_docker_image_force_pull if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}"
force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else matrix_corporal_docker_image_force_pull }}"
when: "matrix_corporal_enabled|bool and not matrix_corporal_container_image_self_build|bool"
- name: Ensure Matrix Corporal config installed
copy:
content: "{{ matrix_corporal_configuration|to_nice_json }}"
dest: "{{ matrix_corporal_config_dir_path }}/config.json"
mode: 0644
owner: "{{ matrix_user_username }}"
group: "{{ matrix_user_groupname }}"
when: matrix_corporal_enabled|bool
- name: Ensure matrix-corporal.service installed
template:
src: "{{ role_path }}/templates/systemd/matrix-corporal.service.j2"
dest: "{{ matrix_systemd_path }}/matrix-corporal.service"
mode: 0644
register: matrix_corporal_systemd_service_result
when: matrix_corporal_enabled|bool
- name: Ensure systemd reloaded after matrix-corporal.service installation
service:
daemon_reload: yes
when: "matrix_corporal_enabled|bool and matrix_corporal_systemd_service_result.changed"
#
# Tasks related to getting rid of matrix-corporal (if it was previously enabled)
#
- name: Check existence of matrix-corporal service
stat:
path: "{{ matrix_systemd_path }}/matrix-corporal.service"
register: matrix_corporal_service_stat
when: "not matrix_corporal_enabled|bool"
- name: Ensure matrix-corporal is stopped
service:
name: matrix-corporal
state: stopped
daemon_reload: yes
register: stopping_result
when: "not matrix_corporal_enabled|bool and matrix_corporal_service_stat.stat.exists"
- name: Ensure matrix-corporal.service doesn't exist
file:
path: "{{ matrix_systemd_path }}/matrix-corporal.service"
state: absent
when: "not matrix_corporal_enabled|bool and matrix_corporal_service_stat.stat.exists"
- name: Ensure systemd reloaded after matrix-corporal.service removal
service:
daemon_reload: yes
when: "not matrix_corporal_enabled|bool and matrix_corporal_service_stat.stat.exists"
- name: Ensure matrix-corporal files don't exist
file:
path: "{{ item }}"
state: absent
with_items:
- "{{ matrix_systemd_path }}/matrix-corporal.service"
- "{{ matrix_corporal_config_dir_path }}/config.json"
when: "not matrix_corporal_enabled|bool"
- name: Ensure Matrix Corporal Docker image doesn't exist
docker_image:
name: "{{ matrix_corporal_docker_image }}"
state: absent
when: "not matrix_corporal_enabled|bool"

27
roles/matrix-corporal/tasks/validate_config.yml Normal file
View File

@ -0,0 +1,27 @@
---
- name: Fail if required matrix-corporal settings not defined
fail:
msg: >-
You need to define a required configuration setting (`{{ item }}`) for using matrix-corporal.
when: "vars[item] == ''"
with_items:
- "matrix_corporal_matrix_homeserver_api_endpoint"
- "matrix_corporal_matrix_auth_shared_secret"
- "matrix_corporal_matrix_registration_shared_secret"
- "matrix_corporal_policy_provider_config"
- name: Fail if HTTP API enabled, but no token set
fail:
msg: "The Matrix Corporal HTTP API is enabled (`matrix_corporal_http_api_enabled`), but no auth token has been set in `matrix_corporal_http_api_auth_token`"
when: "matrix_corporal_http_api_enabled|bool and matrix_corporal_http_api_auth_token == ''"
- name: (Deprecation) Catch and report renamed corporal variables
fail:
msg: >-
Your configuration contains a variable, which now has a different name.
Please change your configuration to rename the variable (`{{ item.old }}` -> `{{ item.new }}`).
when: "item.old in vars"
with_items:
- {'old': 'matrix_corporal_container_expose_ports', 'new': '<superseded by matrix_corporal_container_http_gateway_host_bind_port and matrix_corporal_container_http_api_host_bind_port>'}
- {'old': 'matrix_corporal_reconciliation_user_id_local_part', 'new': 'matrix_corporal_corporal_user_id_local_part'}

38
roles/matrix-corporal/templates/config.json.j2 Normal file
View File

@ -0,0 +1,38 @@
{
"Matrix": {
"HomeserverDomainName": "{{ matrix_corporal_matrix_homeserver_domain_name }}",
"HomeserverApiEndpoint": "{{ matrix_corporal_matrix_homeserver_api_endpoint }}",
"AuthSharedSecret": "{{ matrix_corporal_matrix_auth_shared_secret }}",
"RegistrationSharedSecret": "{{ matrix_corporal_matrix_registration_shared_secret }}",
"TimeoutMilliseconds": {{ matrix_corporal_matrix_timeout_milliseconds }}
},
"Corporal": {
"UserID": "@{{ matrix_corporal_corporal_user_id_local_part }}:{{ matrix_domain }}"
},
"Reconciliation": {
"RetryIntervalMilliseconds": {{ matrix_corporal_reconciliation_retry_interval_milliseconds }}
},
"HttpGateway": {
"ListenAddress": "0.0.0.0:41080",
"TimeoutMilliseconds": {{ matrix_corporal_http_gateway_timeout_milliseconds }},
"InternalRESTAuth": {
"Enabled": {{ matrix_corporal_http_gateway_internal_rest_auth_enabled|to_json }}
}
},
"HttpApi": {
"Enabled": {{ matrix_corporal_http_api_enabled|to_json }},
"ListenAddress": "0.0.0.0:41081",
"AuthorizationBearerToken": "{{ matrix_corporal_http_api_auth_token }}",
"TimeoutMilliseconds": {{ matrix_corporal_http_api_timeout_milliseconds }}
},
"PolicyProvider": {{ matrix_corporal_policy_provider_config }},
"Misc": {
"Debug": {{ matrix_corporal_debug|to_json }}
}
}

44
roles/matrix-corporal/templates/systemd/matrix-corporal.service.j2 Normal file
View File

@ -0,0 +1,44 @@
#jinja2: lstrip_blocks: "True"
[Unit]
Description=Matrix Corporal
{% for service in matrix_corporal_systemd_required_services_list %}
Requires={{ service }}
After={{ service }}
{% endfor %}
DefaultDependencies=no
[Service]
Type=simple
Environment="HOME={{ matrix_systemd_unit_home_path }}"
ExecStartPre=-{{ matrix_host_command_sh }} -c '{{ matrix_host_command_docker }} kill matrix-corporal 2>/dev/null'
ExecStartPre=-{{ matrix_host_command_sh }} -c '{{ matrix_host_command_docker }} rm matrix-corporal 2>/dev/null'
ExecStart={{ matrix_host_command_docker }} run --rm --name matrix-corporal \
--log-driver=none \
--user={{ matrix_user_uid }}:{{ matrix_user_gid }} \
--cap-drop=ALL \
--read-only \
--network={{ matrix_docker_network }} \
{% if matrix_corporal_container_http_gateway_host_bind_port %}
-p {{ matrix_corporal_container_http_gateway_host_bind_port }}:41080 \
{% endif %}
{% if matrix_corporal_container_http_api_host_bind_port %}
-p {{ matrix_corporal_container_http_api_host_bind_port }}:41081 \
{% endif %}
--mount type=bind,src={{ matrix_corporal_config_dir_path }},dst=/etc/matrix-corporal,ro \
--mount type=bind,src={{ matrix_corporal_cache_dir_path }},dst=/var/cache/matrix-corporal \
--mount type=bind,src={{ matrix_corporal_var_dir_path }},dst=/var/matrix-corporal \
{% for arg in matrix_corporal_container_extra_arguments %}
{{ arg }} \
{% endfor %}
{{ matrix_corporal_docker_image }} \
/matrix-corporal -config=/etc/matrix-corporal/config.json
ExecStop=-{{ matrix_host_command_sh }} -c '{{ matrix_host_command_docker }} kill matrix-corporal 2>/dev/null'
ExecStop=-{{ matrix_host_command_sh }} -c '{{ matrix_host_command_docker }} rm matrix-corporal 2>/dev/null'
Restart=always
RestartSec=30
SyslogIdentifier=matrix-corporal
[Install]
WantedBy=multi-user.target