From d8eb768e0369026a0b2a03cbb8fef922e65a93e1 Mon Sep 17 00:00:00 2001 From: Slavi Pantaleev Date: Thu, 11 Jan 2024 11:30:42 +0200 Subject: [PATCH] Add native Traefik support to matrix-dendrite --- docs/configuring-playbook-synapse-admin.md | 7 +- group_vars/matrix_servers | 28 ++-- .../custom/matrix-dendrite/defaults/main.yml | 84 +++++++++- .../matrix-dendrite/tasks/setup_install.yml | 26 ++-- .../matrix-dendrite/tasks/validate_config.yml | 1 + .../{dendrite => }/bin/create-account.j2 | 0 .../templates/{dendrite => }/dendrite.yaml.j2 | 0 .../matrix-dendrite/templates/labels.j2 | 147 ++++++++++++++++++ .../systemd/matrix-dendrite.service.j2 | 1 + 9 files changed, 269 insertions(+), 25 deletions(-) rename roles/custom/matrix-dendrite/templates/{dendrite => }/bin/create-account.j2 (100%) rename roles/custom/matrix-dendrite/templates/{dendrite => }/dendrite.yaml.j2 (100%) create mode 100644 roles/custom/matrix-dendrite/templates/labels.j2 rename roles/custom/matrix-dendrite/templates/{dendrite => }/systemd/matrix-dendrite.service.j2 (98%) diff --git a/docs/configuring-playbook-synapse-admin.md b/docs/configuring-playbook-synapse-admin.md index 1f8f8adda..e557d4abb 100644 --- a/docs/configuring-playbook-synapse-admin.md +++ b/docs/configuring-playbook-synapse-admin.md @@ -2,7 +2,7 @@ The playbook can install and configure [synapse-admin](https://github.com/Awesome-Technologies/synapse-admin) for you. -It's a web UI tool you can use to **administrate users and rooms on your Matrix server**. +It's a web UI tool you can use to **administrate users and rooms on your Matrix server**. It's designed to work with the Synapse homeserver implementation, but to some extent may work with [Dendrite](./configuring-playbook-dendrite.md) as well. See the project's [documentation](https://github.com/Awesome-Technologies/synapse-admin) to learn what it does and why it might be useful to you. @@ -15,7 +15,10 @@ Add the following configuration to your `inventory/host_vars/matrix.DOMAIN/vars. matrix_synapse_admin_enabled: true ``` -**Note**: Synapse Admin requires Synapse's [Admin APIs](https://matrix-org.github.io/synapse/latest/usage/administration/admin_api/index.html) to function. Access to them is restricted with a valid access token, so exposing them publicly should not be a real security concern. Still, for additional security, we normally leave them unexposed, following [official Synapse reverse-proxying recommendations](https://github.com/matrix-org/synapse/blob/master/docs/reverse_proxy.md#synapse-administration-endpoints). Because Synapse Admin needs these APIs to function, when installing Synapse Admin, the playbook **automatically** exposes the Synapse Admin API publicly for you (equivalent to `matrix_synapse_container_labels_client_synapse_admin_api_enabled: true`). +**Note**: Synapse Admin requires Synapse's [Admin APIs](https://matrix-org.github.io/synapse/latest/usage/administration/admin_api/index.html) to function. Access to them is restricted with a valid access token, so exposing them publicly should not be a real security concern. Still, for additional security, we normally leave them unexposed, following [official Synapse reverse-proxying recommendations](https://github.com/matrix-org/synapse/blob/master/docs/reverse_proxy.md#synapse-administration-endpoints). Because Synapse Admin needs these APIs to function, when installing Synapse Admin, the playbook **automatically** exposes the Synapse Admin API publicly for you. Depending on the homeserver implementation you're using (Synapse, Dendrite), this is equivalent to: + +- for Synapse (our default homeserver implementation): `matrix_synapse_container_labels_client_synapse_admin_api_enabled: true` +- for [Dendrite](./configuring-playbook-dendrite.md): `matrix_dendrite_container_labels_client_synapse_admin_api_enabled: true` ## Installing diff --git a/group_vars/matrix_servers b/group_vars/matrix_servers index 545baaeb7..83e03f7b2 100755 --- a/group_vars/matrix_servers +++ b/group_vars/matrix_servers @@ -3364,12 +3364,6 @@ matrix_nginx_proxy_proxy_matrix_federation_api_enabled: |- matrix_nginx_proxy_proxy_matrix_federation_api_addr_with_container: "matrix-nginx-proxy:12088" matrix_nginx_proxy_proxy_matrix_federation_api_addr_sans_container: "127.0.0.1:12088" -matrix_nginx_proxy_proxy_dendrite_enabled: "{{ matrix_dendrite_enabled }}" -matrix_nginx_proxy_proxy_dendrite_client_api_addr_with_container: "matrix-dendrite:{{ matrix_dendrite_http_bind_port | string }}" -matrix_nginx_proxy_proxy_dendrite_client_api_addr_sans_container: "127.0.0.1:{{ matrix_dendrite_http_bind_port | string }}" -matrix_nginx_proxy_proxy_dendrite_federation_api_addr_with_container: "matrix-dendrite:{{ matrix_dendrite_http_bind_port | string }}" -matrix_nginx_proxy_proxy_dendrite_federation_api_addr_sans_container: "127.0.0.1:{{ matrix_dendrite_http_bind_port | string }}" - # When matrix-nginx-proxy is disabled, the actual port number that the vhost uses may begin to matter. matrix_nginx_proxy_proxy_matrix_federation_port: "{{ matrix_federation_public_port }}" @@ -4195,6 +4189,8 @@ matrix_synapse_container_labels_traefik_hostname: "{{ matrix_server_fqn_matrix } matrix_synapse_container_labels_client_root_redirection_enabled: "{{ matrix_synapse_container_labels_client_root_redirection_url != '' }}" matrix_synapse_container_labels_client_root_redirection_url: "{{ (('https://' if matrix_playbook_ssl_enabled else 'http://') + matrix_server_fqn_element) if matrix_client_element_enabled else '' }}" +matrix_synapse_container_labels_client_synapse_admin_api_enabled: "{{ matrix_synapse_admin_enabled }}" + matrix_synapse_container_labels_federation_api_traefik_entrypoints: "{{ matrix_federation_traefik_entrypoint }}" # For exposing the Synapse worker (and metrics) ports to the local host. @@ -4804,18 +4800,32 @@ matrix_sliding_sync_database_password: "{{ '%s' | format(matrix_homeserver_gener matrix_dendrite_enabled: "{{ matrix_homeserver_implementation == 'dendrite' }}" +matrix_dendrite_hostname: "{{ matrix_server_fqn_matrix }}" + matrix_dendrite_container_network: "{{ matrix_homeserver_container_network }}" matrix_dendrite_container_additional_networks: | {{ ( - ([devture_postgres_container_network] if (devture_postgres_enabled and devture_postgres_container_network != matrix_dendrite_container_network and matrix_dendrite_database_hostname == devture_postgres_connection_hostname) else []) - ) + ([matrix_playbook_reverse_proxyable_services_additional_network] if matrix_dendrite_container_labels_traefik_enabled and matrix_playbook_reverse_proxyable_services_additional_network else []) + + + ([devture_postgres_container_network] if (devture_postgres_enabled and matrix_dendrite_database_hostname == devture_postgres_connection_hostname and devture_postgres_container_network != matrix_dendrite_container_network) else []) + ) | unique }} matrix_dendrite_container_http_host_bind_address: "{{ (matrix_playbook_service_host_bind_interface_prefix ~ matrix_dendrite_http_bind_port | string) if matrix_playbook_service_host_bind_interface_prefix else '' }}" matrix_dendrite_container_https_host_bind_address: "{{ '' if not matrix_dendrite_https_bind_port or not matrix_playbook_service_host_bind_interface_prefix else (matrix_playbook_service_host_bind_interface_prefix + matrix_dendrite_https_bind_port | string) }}" +matrix_dendrite_container_labels_traefik_enabled: "{{ matrix_playbook_reverse_proxy_type in ['playbook-managed-traefik', 'other-traefik-container'] and not matrix_synapse_workers_enabled }}" +matrix_dendrite_container_labels_traefik_docker_network: "{{ matrix_playbook_reverse_proxyable_services_additional_network }}" +matrix_dendrite_container_labels_traefik_entrypoints: "{{ devture_traefik_entrypoint_primary }}" +matrix_dendrite_container_labels_traefik_tls_certResolver: "{{ devture_traefik_certResolver_primary }}" + +matrix_dendrite_container_labels_client_root_redirection_enabled: "{{ matrix_dendrite_container_labels_client_root_redirection_url != '' }}" +matrix_dendrite_container_labels_client_root_redirection_url: "{{ (('https://' if matrix_playbook_ssl_enabled else 'http://') + matrix_server_fqn_element) if matrix_client_element_enabled else '' }}" + +matrix_dendrite_container_labels_federation_api_traefik_entrypoints: "{{ matrix_federation_traefik_entrypoint }}" + matrix_dendrite_container_extra_arguments_auto: "{{ matrix_homeserver_container_extra_arguments_auto }}" matrix_dendrite_client_api_registration_shared_secret: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'dendrite.rss', rounds=655555) | to_uuid }}" @@ -4853,7 +4863,7 @@ matrix_dendrite_systemd_required_services_list_auto: | (['matrix-goofys.service'] if matrix_s3_media_store_enabled else []) }} -matrix_dendrite_systemd_wanted_services_list: | +matrix_dendrite_systemd_wanted_services_list_auto: | {{ (['matrix-coturn.service'] if matrix_coturn_enabled else []) }} diff --git a/roles/custom/matrix-dendrite/defaults/main.yml b/roles/custom/matrix-dendrite/defaults/main.yml index f5eaba34f..5b6b8ae98 100644 --- a/roles/custom/matrix-dendrite/defaults/main.yml +++ b/roles/custom/matrix-dendrite/defaults/main.yml @@ -4,6 +4,8 @@ matrix_dendrite_enabled: true +matrix_dendrite_hostname: '' + matrix_dendrite_container_image_self_build: false matrix_dendrite_container_image_self_build_repo: "https://github.com/matrix-org/dendrite.git" @@ -58,6 +60,79 @@ matrix_dendrite_container_http_host_bind_address: "" # Takes an ":" or "" value (e.g. "127.0.0.1:8448"), or empty string to not expose. matrix_dendrite_container_https_host_bind_address: "" +# matrix_dendrite_container_labels_traefik_enabled controls whether labels to assist a Traefik reverse-proxy will be attached to the container. +# See `../templates/labels.j2` for details. +# +# To inject your own other container labels, see `matrix_dendrite_container_labels_additional_labels`. +matrix_dendrite_container_labels_traefik_enabled: true +matrix_dendrite_container_labels_traefik_docker_network: "{{ matrix_dendrite_container_network }}" +matrix_dendrite_container_labels_traefik_entrypoints: web-secure +matrix_dendrite_container_labels_traefik_tls_certResolver: default # noqa var-naming + +# Controls whether labels will be added for handling the root (/) path +matrix_dendrite_container_labels_client_root_enabled: true +matrix_dendrite_container_labels_client_root_traefik_hostname: "{{ matrix_dendrite_hostname }}" +matrix_dendrite_container_labels_client_root_traefik_rule: "Host(`{{ matrix_dendrite_container_labels_client_root_traefik_hostname }}`) && Path(`/`)" +matrix_dendrite_container_labels_client_root_traefik_priority: 0 +matrix_dendrite_container_labels_client_root_traefik_entrypoints: "{{ matrix_dendrite_container_labels_traefik_entrypoints }}" +matrix_dendrite_container_labels_client_root_traefik_tls: "{{ matrix_dendrite_container_labels_client_root_traefik_entrypoints != 'web' }}" +matrix_dendrite_container_labels_client_root_traefik_tls_certResolver: "{{ matrix_dendrite_container_labels_traefik_tls_certResolver }}" # noqa var-naming +matrix_dendrite_container_labels_client_root_redirection_enabled: false +matrix_dendrite_container_labels_client_root_redirection_url: "" + +# Controls whether labels will be added that expose the Client-Server API. +matrix_dendrite_container_labels_client_api_enabled: true +matrix_dendrite_container_labels_client_api_traefik_hostname: "{{ matrix_dendrite_hostname }}" +matrix_dendrite_container_labels_client_api_traefik_path_prefix: /_matrix +matrix_dendrite_container_labels_client_api_traefik_rule: "Host(`{{ matrix_dendrite_container_labels_client_api_traefik_hostname }}`) && PathPrefix(`{{ matrix_dendrite_container_labels_client_api_traefik_path_prefix }}`)" +matrix_dendrite_container_labels_client_api_traefik_priority: 0 +matrix_dendrite_container_labels_client_api_traefik_entrypoints: "{{ matrix_dendrite_container_labels_traefik_entrypoints }}" +matrix_dendrite_container_labels_client_api_traefik_tls: "{{ matrix_dendrite_container_labels_client_api_traefik_entrypoints != 'web' }}" +matrix_dendrite_container_labels_client_api_traefik_tls_certResolver: "{{ matrix_dendrite_container_labels_traefik_tls_certResolver }}" # noqa var-naming + +# Controls whether labels will be added that expose the /_synapse/admin paths. +# Following these recommendations (https://github.com/matrix-org/synapse/blob/master/docs/reverse_proxy.md), by default, we don't. +# Dendrite exposes some admin APIs under a Synapse-specific prefix. +# See: https://matrix-org.github.io/dendrite/administration/adminapi +matrix_dendrite_container_labels_client_synapse_admin_api_enabled: false +matrix_dendrite_container_labels_client_synapse_admin_api_traefik_hostname: "{{ matrix_dendrite_hostname }}" +matrix_dendrite_container_labels_client_synapse_admin_api_traefik_path_prefix: /_synapse/admin +matrix_dendrite_container_labels_client_synapse_admin_api_traefik_rule: "Host(`{{ matrix_dendrite_container_labels_client_synapse_admin_api_traefik_hostname }}`) && PathPrefix(`{{ matrix_dendrite_container_labels_client_synapse_admin_api_traefik_path_prefix }}`)" +matrix_dendrite_container_labels_client_synapse_admin_api_traefik_priority: 0 +matrix_dendrite_container_labels_client_synapse_admin_api_traefik_entrypoints: "{{ matrix_dendrite_container_labels_traefik_entrypoints }}" +matrix_dendrite_container_labels_client_synapse_admin_api_traefik_tls: "{{ matrix_dendrite_container_labels_client_synapse_admin_api_traefik_entrypoints != 'web' }}" +matrix_dendrite_container_labels_client_synapse_admin_api_traefik_tls_certResolver: "{{ matrix_dendrite_container_labels_traefik_tls_certResolver }}" # noqa var-naming + +# Controls whether labels will be added that expose the /_dendrite/admin paths. +# See: https://matrix-org.github.io/dendrite/administration/adminapi +matrix_dendrite_container_labels_client_dendrite_admin_api_enabled: false +matrix_dendrite_container_labels_client_dendrite_admin_api_traefik_hostname: "{{ matrix_dendrite_hostname }}" +matrix_dendrite_container_labels_client_dendrite_admin_api_traefik_path_prefix: /_dendrite/admin +matrix_dendrite_container_labels_client_dendrite_admin_api_traefik_rule: "Host(`{{ matrix_dendrite_container_labels_client_dendrite_admin_api_traefik_hostname }}`) && PathPrefix(`{{ matrix_dendrite_container_labels_client_dendrite_admin_api_traefik_path_prefix }}`)" +matrix_dendrite_container_labels_client_dendrite_admin_api_traefik_priority: 0 +matrix_dendrite_container_labels_client_dendrite_admin_api_traefik_entrypoints: "{{ matrix_dendrite_container_labels_traefik_entrypoints }}" +matrix_dendrite_container_labels_client_dendrite_admin_api_traefik_tls: "{{ matrix_dendrite_container_labels_client_dendrite_admin_api_traefik_entrypoints != 'web' }}" +matrix_dendrite_container_labels_client_dendrite_admin_api_traefik_tls_certResolver: "{{ matrix_dendrite_container_labels_traefik_tls_certResolver }}" # noqa var-naming + +# Controls whether labels will be added that expose the Server-Server API (Federation API). +matrix_dendrite_container_labels_federation_api_enabled: "{{ matrix_dendrite_federation_enabled }}" +matrix_dendrite_container_labels_federation_api_traefik_hostname: "{{ matrix_dendrite_hostname }}" +matrix_dendrite_container_labels_federation_api_traefik_path_prefix: /_matrix +matrix_dendrite_container_labels_federation_api_traefik_rule: "Host(`{{ matrix_dendrite_container_labels_federation_api_traefik_hostname }}`) && PathPrefix(`{{ matrix_dendrite_container_labels_federation_api_traefik_path_prefix }}`)" +matrix_dendrite_container_labels_federation_api_traefik_priority: 0 +matrix_dendrite_container_labels_federation_api_traefik_entrypoints: '' +matrix_dendrite_container_labels_federation_api_traefik_tls: "{{ matrix_dendrite_container_labels_federation_api_traefik_entrypoints != 'web' }}" +matrix_dendrite_container_labels_federation_api_traefik_tls_certResolver: "{{ matrix_dendrite_container_labels_traefik_tls_certResolver }}" # noqa var-naming + +# matrix_dendrite_container_labels_additional_labels contains a multiline string with additional labels to add to the container label file. +# See `../templates/labels.j2` for details. +# +# Example: +# matrix_dendrite_container_labels_additional_labels: | +# my.label=1 +# another.label="here" +matrix_dendrite_container_labels_additional_labels: '' + # A list of extra arguments to pass to the container (`docker run` command) # Also see `matrix_dendrite_container_arguments` matrix_dendrite_container_extra_arguments: [] @@ -86,14 +161,17 @@ matrix_dendrite_systemd_required_services_list_auto: [] matrix_dendrite_systemd_required_services_list_custom: [] # List of systemd services that matrix-dendrite.service wants -matrix_dendrite_systemd_wanted_services_list: [] +matrix_dendrite_systemd_wanted_services_list: "{{ matrix_dendrite_systemd_wanted_services_list_default + matrix_dendrite_systemd_wanted_services_list_auto + matrix_dendrite_systemd_wanted_services_list_custom }}" +matrix_dendrite_systemd_wanted_services_list_default: ["docker.service"] +matrix_dendrite_systemd_wanted_services_list_auto: [] +matrix_dendrite_systemd_wanted_services_list_custom: [] # Specifies which template files to use when configuring Dendrite. # If you'd like to have your own different configuration, feel free to copy and paste # the original files into your inventory (e.g. in `inventory/host_vars//`) # and then change the specific host's `vars.yml` file like this: # matrix_dendrite_template_dendrite_config: "{{ playbook_dir }}/inventory/host_vars//dendrite.yaml.j2" -matrix_dendrite_template_dendrite_config: "{{ role_path }}/templates/dendrite/dendrite.yaml.j2" +matrix_dendrite_template_dendrite_config: "{{ role_path }}/templates/dendrite.yaml.j2" matrix_dendrite_client_api_registration_shared_secret: "" matrix_dendrite_allow_guest_access: false @@ -193,7 +271,7 @@ matrix_dendrite_self_check_validate_certificates: true # # For a more advanced customization, you can extend the default (see `matrix_dendrite_configuration_extension_yaml`) # or completely replace this variable with your own template. -matrix_dendrite_configuration_yaml: "{{ lookup('template', 'templates/dendrite/dendrite.yaml.j2') }}" +matrix_dendrite_configuration_yaml: "{{ lookup('template', matrix_dendrite_template_dendrite_config) }}" matrix_dendrite_configuration_extension_yaml: | # Your custom YAML configuration for Dendrite goes here. diff --git a/roles/custom/matrix-dendrite/tasks/setup_install.yml b/roles/custom/matrix-dendrite/tasks/setup_install.yml index 64c047d1c..05c96aced 100644 --- a/roles/custom/matrix-dendrite/tasks/setup_install.yml +++ b/roles/custom/matrix-dendrite/tasks/setup_install.yml @@ -112,16 +112,20 @@ name: "{{ matrix_dendrite_container_network }}" driver: bridge -- name: Ensure matrix-dendrite.service installed +- name: Ensure Dendrite support files installed ansible.builtin.template: - src: "{{ role_path }}/templates/dendrite/systemd/matrix-dendrite.service.j2" - dest: "{{ devture_systemd_docker_base_systemd_path }}/matrix-dendrite.service" - mode: 0644 - -- name: Ensure Dendrite scripts created - ansible.builtin.template: - src: "{{ role_path }}/templates/dendrite/bin/{{ item }}.j2" - dest: "{{ matrix_dendrite_bin_path }}/{{ item }}" - mode: 0750 + src: "{{ item.src }}" + dest: "{{ item.dest }}" + mode: "{{ item.mode }}" + owner: "{{ matrix_user_username }}" + group: "{{ matrix_user_groupname }}" with_items: - - create-account + - src: labels.j2 + dest: "{{ matrix_dendrite_base_path }}/labels" + mode: "0640" + - src: bin/create-account.j2 + dest: "{{ matrix_dendrite_bin_path }}/create-account" + mode: "0750" + - src: systemd/matrix-dendrite.service.j2 + dest: "{{ devture_systemd_docker_base_systemd_path }}/matrix-dendrite.service" + mode: "0644" diff --git a/roles/custom/matrix-dendrite/tasks/validate_config.yml b/roles/custom/matrix-dendrite/tasks/validate_config.yml index 0b1540bb1..fbd582505 100644 --- a/roles/custom/matrix-dendrite/tasks/validate_config.yml +++ b/roles/custom/matrix-dendrite/tasks/validate_config.yml @@ -5,6 +5,7 @@ You need to define a required configuration setting (`{{ item }}`) for using Dendrite. when: "vars[item] == ''" with_items: + - matrix_dendrite_hostname - matrix_dendrite_client_api_registration_shared_secret - matrix_dendrite_database_hostname diff --git a/roles/custom/matrix-dendrite/templates/dendrite/bin/create-account.j2 b/roles/custom/matrix-dendrite/templates/bin/create-account.j2 similarity index 100% rename from roles/custom/matrix-dendrite/templates/dendrite/bin/create-account.j2 rename to roles/custom/matrix-dendrite/templates/bin/create-account.j2 diff --git a/roles/custom/matrix-dendrite/templates/dendrite/dendrite.yaml.j2 b/roles/custom/matrix-dendrite/templates/dendrite.yaml.j2 similarity index 100% rename from roles/custom/matrix-dendrite/templates/dendrite/dendrite.yaml.j2 rename to roles/custom/matrix-dendrite/templates/dendrite.yaml.j2 diff --git a/roles/custom/matrix-dendrite/templates/labels.j2 b/roles/custom/matrix-dendrite/templates/labels.j2 new file mode 100644 index 000000000..997451af5 --- /dev/null +++ b/roles/custom/matrix-dendrite/templates/labels.j2 @@ -0,0 +1,147 @@ +{% if matrix_dendrite_container_labels_traefik_enabled %} +traefik.enable=true + +{% if matrix_dendrite_container_labels_traefik_docker_network %} +traefik.docker.network={{ matrix_dendrite_container_labels_traefik_docker_network }} +{% endif %} + +traefik.http.services.matrix-dendrite.loadbalancer.server.port={{ matrix_dendrite_http_bind_port }} + + +{# + Root path (/) +#} +{% if matrix_dendrite_container_labels_client_root_enabled %} + +{% set client_root_middlewares = [] %} + +{% if matrix_dendrite_container_labels_client_root_redirection_enabled %} +{% set client_root_middlewares = client_root_middlewares + ['matrix-dendrite-client-root-redirect'] %} +traefik.http.middlewares.matrix-dendrite-client-root-redirect.redirectregex.regex=(.*) +traefik.http.middlewares.matrix-dendrite-client-root-redirect.redirectregex.replacement={{ matrix_dendrite_container_labels_client_root_redirection_url }} +{% endif %} + +traefik.http.routers.matrix-dendrite-client-root.rule={{ matrix_dendrite_container_labels_client_root_traefik_rule }} + +traefik.http.routers.matrix-dendrite-client-root.middlewares={{ client_root_middlewares | join(',') }} + +{% if matrix_dendrite_container_labels_client_root_traefik_priority | int > 0 %} +traefik.http.routers.matrix-dendrite-client-root.priority={{ matrix_dendrite_container_labels_client_root_traefik_priority }} +{% endif %} + +traefik.http.routers.matrix-dendrite-client-root.service=matrix-dendrite +traefik.http.routers.matrix-dendrite-client-root.entrypoints={{ matrix_dendrite_container_labels_client_root_traefik_entrypoints }} +traefik.http.routers.matrix-dendrite-client-root.tls={{ matrix_dendrite_container_labels_client_root_traefik_tls | to_json }} + +{% if matrix_dendrite_container_labels_client_root_traefik_tls %} +traefik.http.routers.matrix-dendrite-client-root.tls.certResolver={{ matrix_dendrite_container_labels_client_root_traefik_tls_certResolver }} +{% endif %} + +{% endif %} +{# + /Root path (/) +#} + + +{# + Client-API (/_matrix) +#} +{% if matrix_dendrite_container_labels_client_api_enabled %} + +traefik.http.routers.matrix-dendrite-client-api.rule={{ matrix_dendrite_container_labels_client_api_traefik_rule }} + +{% if matrix_dendrite_container_labels_client_api_traefik_priority | int > 0 %} +traefik.http.routers.matrix-dendrite-client-api.priority={{ matrix_dendrite_container_labels_client_api_traefik_priority }} +{% endif %} + +traefik.http.routers.matrix-dendrite-client-api.service=matrix-dendrite +traefik.http.routers.matrix-dendrite-client-api.entrypoints={{ matrix_dendrite_container_labels_client_api_traefik_entrypoints }} +traefik.http.routers.matrix-dendrite-client-api.tls={{ matrix_dendrite_container_labels_client_api_traefik_tls | to_json }} + +{% if matrix_dendrite_container_labels_client_api_traefik_tls %} +traefik.http.routers.matrix-dendrite-client-api.tls.certResolver={{ matrix_dendrite_container_labels_client_api_traefik_tls_certResolver }} +{% endif %} + +{% endif %} +{# + /Client-API (/_matrix) +#} + + +{# + Synapse Admin API (/_synapse/admin) +#} +{% if matrix_dendrite_container_labels_client_synapse_admin_api_enabled %} + +traefik.http.routers.matrix-dendrite-client-synapse-admin-api.rule={{ matrix_dendrite_container_labels_client_synapse_admin_api_traefik_rule }} + +{% if matrix_dendrite_container_labels_client_synapse_admin_api_traefik_priority | int > 0 %} +traefik.http.routers.matrix-dendrite-client-synapse-admin-api.priority={{ matrix_dendrite_container_labels_client_synapse_admin_api_traefik_priority }} +{% endif %} + +traefik.http.routers.matrix-dendrite-client-synapse-admin-api.service=matrix-dendrite +traefik.http.routers.matrix-dendrite-client-synapse-admin-api.entrypoints={{ matrix_dendrite_container_labels_client_synapse_admin_api_traefik_entrypoints }} +traefik.http.routers.matrix-dendrite-client-synapse-admin-api.tls={{ matrix_dendrite_container_labels_client_synapse_admin_api_traefik_tls | to_json }} + +{% if matrix_dendrite_container_labels_client_synapse_admin_api_traefik_tls %} +traefik.http.routers.matrix-dendrite-client-synapse-admin-api.tls.certResolver={{ matrix_dendrite_container_labels_client_synapse_admin_api_traefik_tls_certResolver }} +{% endif %} + +{% endif %} +{# + /Synapse Admin API (/_synapse/admin) +#} + + +{# + Dendrite Admin API (/_dendrite/admin) +#} +{% if matrix_dendrite_container_labels_client_dendrite_admin_api_enabled %} + +traefik.http.routers.matrix-dendrite-client-synapse-admin-api.rule={{ matrix_dendrite_container_labels_client_dendrite_admin_api_traefik_rule }} + +{% if matrix_dendrite_container_labels_client_dendrite_admin_api_traefik_priority | int > 0 %} +traefik.http.routers.matrix-dendrite-client-synapse-admin-api.priority={{ matrix_dendrite_container_labels_client_dendrite_admin_api_traefik_priority }} +{% endif %} + +traefik.http.routers.matrix-dendrite-client-synapse-admin-api.service=matrix-dendrite +traefik.http.routers.matrix-dendrite-client-synapse-admin-api.entrypoints={{ matrix_dendrite_container_labels_client_dendrite_admin_api_traefik_entrypoints }} +traefik.http.routers.matrix-dendrite-client-synapse-admin-api.tls={{ matrix_dendrite_container_labels_client_dendrite_admin_api_traefik_tls | to_json }} + +{% if matrix_dendrite_container_labels_client_dendrite_admin_api_traefik_tls %} +traefik.http.routers.matrix-dendrite-client-synapse-admin-api.tls.certResolver={{ matrix_dendrite_container_labels_client_dendrite_admin_api_traefik_tls_certResolver }} +{% endif %} + +{% endif %} +{# + /Dendrite Admin API (/_dendrite/admin) +#} + + +{# + Federation-API (/_matrix) +#} +{% if matrix_dendrite_container_labels_federation_api_enabled %} + +traefik.http.routers.matrix-dendrite-federation-api.rule={{ matrix_dendrite_container_labels_federation_api_traefik_rule }} + +{% if matrix_dendrite_container_labels_federation_api_traefik_priority | int > 0 %} +traefik.http.routers.matrix-dendrite-federation-api.priority={{ matrix_dendrite_container_labels_federation_api_traefik_priority }} +{% endif %} + +traefik.http.routers.matrix-dendrite-federation-api.service=matrix-dendrite-federation-api +traefik.http.routers.matrix-dendrite-federation-api.entrypoints={{ matrix_dendrite_container_labels_federation_api_traefik_entrypoints }} +traefik.http.routers.matrix-dendrite-federation-api.tls={{ matrix_dendrite_container_labels_federation_api_traefik_tls | to_json }} + +{% if matrix_dendrite_container_labels_federation_api_traefik_tls %} +traefik.http.routers.matrix-dendrite-federation-api.tls.certResolver={{ matrix_dendrite_container_labels_federation_api_traefik_tls_certResolver }} +{% endif %} + +{% endif %} +{# + /Federation-API (/_matrix) +#} + +{% endif %} + +{{ matrix_dendrite_container_labels_additional_labels }} diff --git a/roles/custom/matrix-dendrite/templates/dendrite/systemd/matrix-dendrite.service.j2 b/roles/custom/matrix-dendrite/templates/systemd/matrix-dendrite.service.j2 similarity index 98% rename from roles/custom/matrix-dendrite/templates/dendrite/systemd/matrix-dendrite.service.j2 rename to roles/custom/matrix-dendrite/templates/systemd/matrix-dendrite.service.j2 index cf2309fab..1079cec3d 100644 --- a/roles/custom/matrix-dendrite/templates/dendrite/systemd/matrix-dendrite.service.j2 +++ b/roles/custom/matrix-dendrite/templates/systemd/matrix-dendrite.service.j2 @@ -40,6 +40,7 @@ ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} create \ --mount type=bind,src={{ matrix_dendrite_config_dir_path }},dst=/data,ro \ --mount type=bind,src={{ matrix_dendrite_storage_path }},dst=/matrix-media-store-parent,bind-propagation=slave \ --mount type=bind,src={{ matrix_dendrite_nats_storage_path }},dst=/matrix-nats-store,bind-propagation=slave \ + --label-file={{ matrix_dendrite_base_path }}/labels \ {% for volume in matrix_dendrite_container_additional_volumes %} -v {{ volume.src }}:{{ volume.dst }}:{{ volume.options }} \ {% endfor %}