Make roles more independent of one another
With this change, the following roles are now only dependent on the minimal `matrix-base` role: - `matrix-corporal` - `matrix-coturn` - `matrix-mailer` - `matrix-mxisd` - `matrix-postgres` - `matrix-riot-web` - `matrix-synapse` The `matrix-nginx-proxy` role still does too much and remains dependent on the others. Wiring up the various (now-independent) roles happens via a glue variables file (`group_vars/matrix-servers`). It's triggered for all hosts in the `matrix-servers` group. According to Ansible's rules of priority, we have the following chain of inclusion/overriding now: - role defaults (mostly empty or good for independent usage) - playbook glue variables (`group_vars/matrix-servers`) - inventory host variables (`inventory/host_vars/matrix.<your-domain>`) All roles default to enabling their main component (e.g. `matrix_mxisd_enabled: true`, `matrix_riot_web_enabled: true`). Reasoning: if a role is included in a playbook (especially separately, in another playbook), it should "work" by default. Our playbook disables some of those if they are not generally useful (e.g. `matrix_corporal_enabled: false`).
This commit is contained in:
Slavi Pantaleev
@ -1,17 +1,18 @@
|
||||
# By default, this playbook installs the mxisd identity server on the same domain as Synapse (`hostname_matrix`).
|
||||
# If you wish to use the public identity servers (matrix.org, vector.im, riot.im) instead of your own,
|
||||
# you may wish to disable this.
|
||||
matrix_mxisd_enabled: true
|
||||
|
||||
matrix_mxisd_docker_image: "kamax/mxisd:1.2.2"
|
||||
matrix_mxisd_base_path: "{{ matrix_base_data_path }}/mxisd"
|
||||
matrix_mxisd_config_path: "{{ matrix_mxisd_base_path }}/config"
|
||||
matrix_mxisd_data_path: "{{ matrix_mxisd_base_path }}/data"
|
||||
|
||||
# Controls whether the mxisd web server's port is exposed outside of the container.
|
||||
# Normally, matrix-nginx-proxy is enabled and nginx can reach mxisd over the container network.
|
||||
# If matrix-nginx-proxy is not enabled, or you otherwise have a need for it, you can expose
|
||||
# mxisd's web-server port to the local host (`127.0.0.1:8090`).
|
||||
matrix_mxisd_container_expose_port: "{{ not matrix_nginx_proxy_enabled }}"
|
||||
# Controls whether the mxisd web server's port (`8090`) is exposed outside of the container.
|
||||
matrix_mxisd_container_expose_port: false
|
||||
|
||||
# List of systemd services that matrix-mxisd.service depends on
|
||||
matrix_mxisd_systemd_required_services_list: ['docker.service']
|
||||
|
||||
# List of systemd services that matrix-mxisd.service wants
|
||||
matrix_mxisd_systemd_wanted_services_list: []
|
||||
|
||||
# Your identity server is private by default.
|
||||
# To ensure maximum discovery, you can make your identity server
|
||||
@ -21,14 +22,19 @@ matrix_mxisd_container_expose_port: "{{ not matrix_nginx_proxy_enabled }}"
|
||||
matrix_mxisd_matrixorg_forwarding_enabled: false
|
||||
|
||||
# mxisd has serveral supported identity stores.
|
||||
# One of them (which we enable by default) is storing identities directly in Synapse's database.
|
||||
# One of them is storing identities directly in Synapse's database.
|
||||
# Learn more here: https://github.com/kamax-matrix/mxisd/blob/master/docs/stores/synapse.md
|
||||
#
|
||||
# If you need to disable this in favor of some other store, you can toggle it to disabled here
|
||||
# and add your own mxisd configuration for the other store in `matrix_mxisd_configuration_extension_yaml`.
|
||||
matrix_mxisd_synapsesql_enabled: true
|
||||
matrix_mxisd_synapsesql_type: postgresql
|
||||
matrix_mxisd_synapsesql_connection: //{{ matrix_postgres_connection_hostname }}/{{ matrix_postgres_db_name }}?user={{ matrix_postgres_connection_username }}&password={{ matrix_postgres_connection_password }}
|
||||
matrix_mxisd_synapsesql_enabled: false
|
||||
matrix_mxisd_synapsesql_type: ""
|
||||
matrix_mxisd_synapsesql_connection: ""
|
||||
|
||||
# Setting up email-sending settings is required for using mxisd.
|
||||
matrix_mxid_threepid_medium_email_identity_from: "matrix@{{ hostname_identity }}"
|
||||
matrix_mxid_threepid_medium_email_connectors_smtp_host: ""
|
||||
matrix_mxid_threepid_medium_email_connectors_smtp_port: 587
|
||||
matrix_mxid_threepid_medium_email_connectors_smtp_tls: 1
|
||||
matrix_mxid_threepid_medium_email_connectors_smtp_login: ""
|
||||
matrix_mxid_threepid_medium_email_connectors_smtp_password: ""
|
||||
|
||||
# Default mxisd configuration template which covers the generic use case.
|
||||
# You can customize it by controlling the various variables inside it.
|
||||
@ -59,12 +65,14 @@ matrix_mxisd_configuration_yaml: |
|
||||
medium:
|
||||
email:
|
||||
identity:
|
||||
from: {{ matrix_mailer_sender_address }}
|
||||
from: {{ matrix_mxid_threepid_medium_email_identity_from }}
|
||||
connectors:
|
||||
smtp:
|
||||
host: matrix-mailer
|
||||
port: 587
|
||||
tls: 0
|
||||
host: {{ matrix_mxid_threepid_medium_email_connectors_smtp_host }}
|
||||
port: {{ matrix_mxid_threepid_medium_email_connectors_smtp_port }}
|
||||
tls: {{ matrix_mxid_threepid_medium_email_connectors_smtp_tls }}
|
||||
login: {{ matrix_mxid_threepid_medium_email_connectors_smtp_login }}
|
||||
password: {{ matrix_mxid_threepid_medium_email_connectors_smtp_password }}
|
||||
|
||||
synapseSql:
|
||||
enabled: {{ matrix_mxisd_synapsesql_enabled }}
|
||||
@ -92,10 +100,6 @@ matrix_mxisd_configuration_extension_yaml: |
|
||||
# bindDn: CN=My Mxisd User,OU=Users,DC=example,DC=org
|
||||
# bindPassword: TheUserPassword
|
||||
|
||||
# Doing `|from_yaml` when the extension contains nothing yields an empty string ("").
|
||||
# We need to ensure it's a dictionary or `|combine` (when building `matrix_mxisd_configuration`) will fail later.
|
||||
matrix_mxisd_configuration_extension: "{{ matrix_mxisd_configuration_extension_yaml|from_yaml if matrix_mxisd_configuration_extension_yaml|from_yaml else {} }}"
|
||||
|
||||
# Holds the final mxisd configuration (a combination of the default and its extension).
|
||||
# You most likely don't need to touch this variable. Instead, see `matrix_mxisd_configuration_yaml`.
|
||||
matrix_mxisd_configuration: "{{ matrix_mxisd_configuration_yaml|from_yaml|combine(matrix_mxisd_configuration_extension, recursive=True) }}"
|
||||
@ -2,6 +2,12 @@
|
||||
tags:
|
||||
- always
|
||||
|
||||
- import_tasks: "{{ role_path }}/tasks/validate_config.yml"
|
||||
when: "run_setup and matrix_mxisd_enabled"
|
||||
tags:
|
||||
- setup-all
|
||||
- setup-mxisd
|
||||
|
||||
- import_tasks: "{{ role_path }}/tasks/setup_mxisd.yml"
|
||||
tags:
|
||||
- setup-all
|
||||
|
||||
@ -4,49 +4,6 @@
|
||||
# Tasks related to setting up mxisd
|
||||
#
|
||||
|
||||
- name: (Deprecation) Warn about mxisd variables that are not used anymore
|
||||
fail:
|
||||
msg: >
|
||||
The `{{ item }}` variable defined in your configuration is not used by this playbook anymore!
|
||||
You'll need to adapt to the new way of extending mxisd configuration.
|
||||
See the CHANGELOG and the `matrix_mxisd_configuration_extension_yaml` variable for more information and examples.
|
||||
when: "matrix_mxisd_enabled and item in vars"
|
||||
with_items:
|
||||
- 'matrix_mxisd_ldap_enabled'
|
||||
- 'matrix_mxisd_ldap_connection_host'
|
||||
- 'matrix_mxisd_ldap_connection_tls'
|
||||
- 'matrix_mxisd_ldap_connection_port'
|
||||
- 'matrix_mxisd_ldap_connection_baseDn'
|
||||
- 'matrix_mxisd_ldap_connection_baseDns'
|
||||
- 'matrix_mxisd_ldap_connection_bindDn'
|
||||
- 'matrix_mxisd_ldap_connection_bindPassword'
|
||||
- 'matrix_mxisd_ldap_filter'
|
||||
- 'matrix_mxisd_ldap_attribute_uid_type'
|
||||
- 'matrix_mxisd_ldap_attribute_uid_value'
|
||||
- 'matrix_mxisd_ldap_connection_bindPassword'
|
||||
- 'matrix_mxisd_ldap_attribute_name'
|
||||
- 'matrix_mxisd_ldap_attribute_threepid_email'
|
||||
- 'matrix_mxisd_ldap_attribute_threepid_msisdn'
|
||||
- 'matrix_mxisd_ldap_identity_filter'
|
||||
- 'matrix_mxisd_ldap_identity_medium'
|
||||
- 'matrix_mxisd_ldap_auth_filter'
|
||||
- 'matrix_mxisd_ldap_directory_filter'
|
||||
- 'matrix_mxisd_template_config'
|
||||
|
||||
- name: Ensure mxisd configuration does not contain any dot-notation keys
|
||||
fail:
|
||||
msg: >
|
||||
Since version 1.3.0, mxisd will not accept property-style configuration keys.
|
||||
You have defined a key (`{{ item.key }}`) which contains a dot.
|
||||
Instead, use nesting. See: https://github.com/kamax-matrix/mxisd/wiki/Upgrade#v130
|
||||
when: "matrix_mxisd_enabled and '.' in item.key"
|
||||
with_dict: "{{ matrix_mxisd_configuration }}"
|
||||
|
||||
- name: Fail if mailer is not enabled
|
||||
fail:
|
||||
msg: "You need to enable the mailer service (`matrix_mailer_enabled`) to install mxisd"
|
||||
when: "matrix_mxisd_enabled and not matrix_mailer_enabled"
|
||||
|
||||
- name: Ensure mxisd paths exist
|
||||
file:
|
||||
path: "{{ item }}"
|
||||
|
||||
47
roles/matrix-mxisd/tasks/validate_config.yml
Normal file
47
roles/matrix-mxisd/tasks/validate_config.yml
Normal file
@ -0,0 +1,47 @@
|
||||
---
|
||||
|
||||
- name: (Deprecation) Warn about mxisd variables that are not used anymore
|
||||
fail:
|
||||
msg: >
|
||||
The `{{ item }}` variable defined in your configuration is not used by this playbook anymore!
|
||||
You'll need to adapt to the new way of extending mxisd configuration.
|
||||
See the CHANGELOG and the `matrix_mxisd_configuration_extension_yaml` variable for more information and examples.
|
||||
when: "item in vars"
|
||||
with_items:
|
||||
- 'matrix_mxisd_ldap_enabled'
|
||||
- 'matrix_mxisd_ldap_connection_host'
|
||||
- 'matrix_mxisd_ldap_connection_tls'
|
||||
- 'matrix_mxisd_ldap_connection_port'
|
||||
- 'matrix_mxisd_ldap_connection_baseDn'
|
||||
- 'matrix_mxisd_ldap_connection_baseDns'
|
||||
- 'matrix_mxisd_ldap_connection_bindDn'
|
||||
- 'matrix_mxisd_ldap_connection_bindPassword'
|
||||
- 'matrix_mxisd_ldap_filter'
|
||||
- 'matrix_mxisd_ldap_attribute_uid_type'
|
||||
- 'matrix_mxisd_ldap_attribute_uid_value'
|
||||
- 'matrix_mxisd_ldap_connection_bindPassword'
|
||||
- 'matrix_mxisd_ldap_attribute_name'
|
||||
- 'matrix_mxisd_ldap_attribute_threepid_email'
|
||||
- 'matrix_mxisd_ldap_attribute_threepid_msisdn'
|
||||
- 'matrix_mxisd_ldap_identity_filter'
|
||||
- 'matrix_mxisd_ldap_identity_medium'
|
||||
- 'matrix_mxisd_ldap_auth_filter'
|
||||
- 'matrix_mxisd_ldap_directory_filter'
|
||||
- 'matrix_mxisd_template_config'
|
||||
|
||||
- name: Ensure mxisd configuration does not contain any dot-notation keys
|
||||
fail:
|
||||
msg: >
|
||||
Since version 1.3.0, mxisd will not accept property-style configuration keys.
|
||||
You have defined a key (`{{ item.key }}`) which contains a dot.
|
||||
Instead, use nesting. See: https://github.com/kamax-matrix/mxisd/wiki/Upgrade#v130
|
||||
when: "'.' in item.key"
|
||||
with_dict: "{{ matrix_mxisd_configuration }}"
|
||||
|
||||
- name: Fail if required mxisd settings not defined
|
||||
fail:
|
||||
msg: >
|
||||
You need to define a required configuration setting (`{{ item }}`) for using mxisd.
|
||||
when: "vars[item] == ''"
|
||||
with_items:
|
||||
- "matrix_mxid_threepid_medium_email_connectors_smtp_host"
|
||||
@ -1,11 +1,12 @@
|
||||
[Unit]
|
||||
Description=Matrix mxisd identity server
|
||||
After=docker.service
|
||||
Requires=docker.service
|
||||
{% if not matrix_postgres_use_external %}
|
||||
Requires=matrix-postgres.service
|
||||
After=matrix-postgres.service
|
||||
{% endif %}
|
||||
Description=Matrix mxisd Identity server
|
||||
{% for service in matrix_mxisd_systemd_required_services_list %}
|
||||
Requires={{ service }}
|
||||
After={{ service }}
|
||||
{% endfor %}
|
||||
{% for service in matrix_mxisd_systemd_wanted_services_list %}
|
||||
Wants={{ service }}
|
||||
{% endfor %}
|
||||
|
||||
[Service]
|
||||
Type=simple
|
||||
|
||||
5
roles/matrix-mxisd/vars/main.yml
Normal file
5
roles/matrix-mxisd/vars/main.yml
Normal file
@ -0,0 +1,5 @@
|
||||
---
|
||||
|
||||
# Doing `|from_yaml` when the extension contains nothing yields an empty string ("").
|
||||
# We need to ensure it's a dictionary or `|combine` (when building `matrix_mxisd_configuration`) will fail later.
|
||||
matrix_mxisd_configuration_extension: "{{ matrix_mxisd_configuration_extension_yaml|from_yaml if matrix_mxisd_configuration_extension_yaml|from_yaml else {} }}"
|
||||
Reference in New Issue
Block a user