Switch Docker image to official one

Switching from from avhost/docker-matrix (silviof/docker-matrix)
to matrixdotorg/synapse.

The avhost/docker-matrix (silviof/docker-matrix) image used to bundle
in the coturn STUN/TURN server, so as part of the move,
we're separating this to a separately-ran service
(matrix-coturn.service, powered by instrumentisto/coturn-docker-image)

roles/matrix-server/tasks/main.yml

@@ -28,10 +28,16 @@
     - setup-main
     - setup-goofys
 
+- include: tasks/setup_coturn.yml
+  tags:
+    - setup-main
+    - setup-coturn
+
 - include: tasks/setup_synapse.yml
   tags:
     - setup-main
     - setup-synapse
+    - setup-coturn
 
 - include: tasks/setup_riot_web.yml
   tags:

roles/matrix-server/tasks/setup_coturn.yml

@@ -0,0 +1,42 @@
+---
+
+- name: Fail if Coturn secret is missing
+  fail:
+    msg: "You need to set a secret in the matrix_coturn_turn_static_auth_secret variable"
+  when: "matrix_coturn_turn_static_auth_secret == ''"
+
+- name: Ensure Coturn image is pulled
+  docker_image:
+    name: "{{ docker_coturn_image }}"
+
+- name: Ensure Coturn configuration path exists
+  file:
+    path: "{{ matrix_coturn_base_path }}"
+    state: directory
+    mode: 0750
+    owner: "{{ matrix_user_username }}"
+    group: "{{ matrix_user_username }}"
+
+- name: Ensure turnserver.conf installed
+  template:
+    src: "{{ role_path }}/templates/coturn/turnserver.conf.j2"
+    dest: "{{ matrix_coturn_config_path }}"
+    mode: 0644
+
+- name: Ensure matrix-coturn.service installed
+  template:
+    src: "{{ role_path }}/templates/systemd/matrix-coturn.service.j2"
+    dest: "/etc/systemd/system/matrix-coturn.service"
+    mode: 0644
+
+- name: Allow access to Coturn ports in firewalld
+  firewalld:
+    port: "{{ item }}"
+    state: enabled
+    immediate: yes
+    permanent: yes
+  with_items:
+    - '3478/tcp' # STUN
+    - '3478/udp' # STUN
+    - "{{ matrix_coturn_turn_udp_min_port }}-{{ matrix_coturn_turn_udp_max_port }}/udp" # TURN
+  when: ansible_os_family == 'RedHat'

roles/matrix-server/tasks/setup_synapse.yml

@@ -49,8 +49,9 @@
     cleanup: yes
     command: generate
     env:
-      SERVER_NAME: "{{ hostname_matrix }}"
-      REPORT_STATS: "no"
+      SYNAPSE_CONFIG_PATH: "/data/homeserver.yaml"
+      SYNAPSE_SERVER_NAME: "{{ hostname_matrix }}"
+      SYNAPSE_REPORT_STATS: "no"
     user: "{{ matrix_user_uid }}:{{ matrix_user_gid }}"
     volumes:
       - "{{ matrix_synapse_config_dir_path }}:/data"
@@ -74,6 +75,7 @@
     line: '{{ item.line }}'
   with_items:
     - {"regexp": "^log_file:", "line": 'log_file: "/matrix-run/homeserver.log"'}
+    - {"regexp": "^uploads_path:", "line": 'uploads_path: "/matrix-run/uploads"'}
     - {"regexp": "^server_name:", "line": 'server_name: "{{ hostname_identity }}"'}
     - {"regexp": "^turn_allow_guests:", "line": 'turn_allow_guests: False'}
     - {"regexp": "^url_preview_enabled:", "line": 'url_preview_enabled: True'}
@@ -117,15 +119,14 @@
     regexp: '(.*)name: "psycopg2"((?:.|\n)*?)\n\n'
     replace: '\1name: "psycopg2"\n\1args:\n\1\1user: "{{ matrix_postgres_connection_username }}"\n\1\1password: "{{ matrix_postgres_connection_password }}"\n\1\1database: "{{ matrix_postgres_db_name }}"\n\1\1host: "{{ matrix_postgres_connection_hostname }}"\n\1\1cp_min: 5\n\1\1cp_max: 10\n\n'
 
-- name: Augment Matrix config (configure Coturn)
-  lineinfile: "dest={{ matrix_synapse_config_dir_path }}/turnserver.conf"
+- name: Augment Matrix config (configure TURN)
+  lineinfile: "dest={{ matrix_synapse_config_dir_path }}/homeserver.yaml"
   args:
-    regexp: "^{{ item.variable }}="
-    line: '{{ item.variable }}={{ item.value }}'
+    regexp: "{{ item.regexp }}"
+    line: '{{ item.line }}'
   with_items:
-    - {'variable': 'min-port', 'value': "{{ matrix_coturn_turn_udp_min_port }}"}
-    - {'variable': 'max-port', 'value': "{{ matrix_coturn_turn_udp_max_port }}"}
-    - {'variable': 'external-ip', 'value': "{{ matrix_coturn_turn_external_ip_address }}"}
+    - {"regexp": "^turn_uris:", "line": 'turn_uris: ["turn:{{ hostname_matrix }}:3478?transport=udp", "turn:{{ hostname_matrix }}:3478?transport=tcp"]'}
+    - {"regexp": "^turn_shared_secret:", "line": 'turn_shared_secret: "{{ matrix_coturn_turn_static_auth_secret }}"'}
 
 - name: Allow access to Matrix ports in firewalld
   firewalld:
@@ -135,9 +136,6 @@
     permanent: yes
   with_items:
     - '8448/tcp' # Matrix federation
-    - '3478/tcp' # STUN
-    - '3478/udp' # STUN
-    - "{{ matrix_coturn_turn_udp_min_port }}-{{ matrix_coturn_turn_udp_max_port }}/udp" # TURN
   when: ansible_os_family == 'RedHat'
 
 - name: Ensure matrix-synapse.service installed

roles/matrix-server/tasks/start.yml

@@ -8,6 +8,9 @@
   service: name=matrix-goofys enabled=yes state=restarted daemon_reload=yes
   when: matrix_s3_media_store_enabled
 
+- name: Ensure matrix-coturn autoruns and is restarted
+  service: name=matrix-coturn enabled=yes state=restarted daemon_reload=yes
+
 - name: Ensure matrix-synapse autoruns and is restarted
   service: name=matrix-synapse enabled=yes state=restarted daemon_reload=yes