Add native Traefik support to matrix-dendrite

roles/custom/matrix-dendrite/defaults/main.yml

@@ -4,6 +4,8 @@
 
 matrix_dendrite_enabled: true
 
+matrix_dendrite_hostname: ''
+
 matrix_dendrite_container_image_self_build: false
 matrix_dendrite_container_image_self_build_repo: "https://github.com/matrix-org/dendrite.git"
 
@@ -58,6 +60,79 @@ matrix_dendrite_container_http_host_bind_address: ""
 # Takes an "<ip>:<port>" or "<port>" value (e.g. "127.0.0.1:8448"), or empty string to not expose.
 matrix_dendrite_container_https_host_bind_address: ""
 
+# matrix_dendrite_container_labels_traefik_enabled controls whether labels to assist a Traefik reverse-proxy will be attached to the container.
+# See `../templates/labels.j2` for details.
+#
+# To inject your own other container labels, see `matrix_dendrite_container_labels_additional_labels`.
+matrix_dendrite_container_labels_traefik_enabled: true
+matrix_dendrite_container_labels_traefik_docker_network: "{{ matrix_dendrite_container_network }}"
+matrix_dendrite_container_labels_traefik_entrypoints: web-secure
+matrix_dendrite_container_labels_traefik_tls_certResolver: default  # noqa var-naming
+
+# Controls whether labels will be added for handling the root (/) path
+matrix_dendrite_container_labels_client_root_enabled: true
+matrix_dendrite_container_labels_client_root_traefik_hostname: "{{ matrix_dendrite_hostname }}"
+matrix_dendrite_container_labels_client_root_traefik_rule: "Host(`{{ matrix_dendrite_container_labels_client_root_traefik_hostname }}`) && Path(`/`)"
+matrix_dendrite_container_labels_client_root_traefik_priority: 0
+matrix_dendrite_container_labels_client_root_traefik_entrypoints: "{{ matrix_dendrite_container_labels_traefik_entrypoints }}"
+matrix_dendrite_container_labels_client_root_traefik_tls: "{{ matrix_dendrite_container_labels_client_root_traefik_entrypoints != 'web' }}"
+matrix_dendrite_container_labels_client_root_traefik_tls_certResolver: "{{ matrix_dendrite_container_labels_traefik_tls_certResolver }}"  # noqa var-naming
+matrix_dendrite_container_labels_client_root_redirection_enabled: false
+matrix_dendrite_container_labels_client_root_redirection_url: ""
+
+# Controls whether labels will be added that expose the Client-Server API.
+matrix_dendrite_container_labels_client_api_enabled: true
+matrix_dendrite_container_labels_client_api_traefik_hostname: "{{ matrix_dendrite_hostname }}"
+matrix_dendrite_container_labels_client_api_traefik_path_prefix: /_matrix
+matrix_dendrite_container_labels_client_api_traefik_rule: "Host(`{{ matrix_dendrite_container_labels_client_api_traefik_hostname }}`) && PathPrefix(`{{ matrix_dendrite_container_labels_client_api_traefik_path_prefix }}`)"
+matrix_dendrite_container_labels_client_api_traefik_priority: 0
+matrix_dendrite_container_labels_client_api_traefik_entrypoints: "{{ matrix_dendrite_container_labels_traefik_entrypoints }}"
+matrix_dendrite_container_labels_client_api_traefik_tls: "{{ matrix_dendrite_container_labels_client_api_traefik_entrypoints != 'web' }}"
+matrix_dendrite_container_labels_client_api_traefik_tls_certResolver: "{{ matrix_dendrite_container_labels_traefik_tls_certResolver }}"  # noqa var-naming
+
+# Controls whether labels will be added that expose the /_synapse/admin paths.
+# Following these recommendations (https://github.com/matrix-org/synapse/blob/master/docs/reverse_proxy.md), by default, we don't.
+# Dendrite exposes some admin APIs under a Synapse-specific prefix.
+# See: https://matrix-org.github.io/dendrite/administration/adminapi
+matrix_dendrite_container_labels_client_synapse_admin_api_enabled: false
+matrix_dendrite_container_labels_client_synapse_admin_api_traefik_hostname: "{{ matrix_dendrite_hostname }}"
+matrix_dendrite_container_labels_client_synapse_admin_api_traefik_path_prefix: /_synapse/admin
+matrix_dendrite_container_labels_client_synapse_admin_api_traefik_rule: "Host(`{{ matrix_dendrite_container_labels_client_synapse_admin_api_traefik_hostname }}`) && PathPrefix(`{{ matrix_dendrite_container_labels_client_synapse_admin_api_traefik_path_prefix }}`)"
+matrix_dendrite_container_labels_client_synapse_admin_api_traefik_priority: 0
+matrix_dendrite_container_labels_client_synapse_admin_api_traefik_entrypoints: "{{ matrix_dendrite_container_labels_traefik_entrypoints }}"
+matrix_dendrite_container_labels_client_synapse_admin_api_traefik_tls: "{{ matrix_dendrite_container_labels_client_synapse_admin_api_traefik_entrypoints != 'web' }}"
+matrix_dendrite_container_labels_client_synapse_admin_api_traefik_tls_certResolver: "{{ matrix_dendrite_container_labels_traefik_tls_certResolver }}"  # noqa var-naming
+
+# Controls whether labels will be added that expose the /_dendrite/admin paths.
+# See: https://matrix-org.github.io/dendrite/administration/adminapi
+matrix_dendrite_container_labels_client_dendrite_admin_api_enabled: false
+matrix_dendrite_container_labels_client_dendrite_admin_api_traefik_hostname: "{{ matrix_dendrite_hostname }}"
+matrix_dendrite_container_labels_client_dendrite_admin_api_traefik_path_prefix: /_dendrite/admin
+matrix_dendrite_container_labels_client_dendrite_admin_api_traefik_rule: "Host(`{{ matrix_dendrite_container_labels_client_dendrite_admin_api_traefik_hostname }}`) && PathPrefix(`{{ matrix_dendrite_container_labels_client_dendrite_admin_api_traefik_path_prefix }}`)"
+matrix_dendrite_container_labels_client_dendrite_admin_api_traefik_priority: 0
+matrix_dendrite_container_labels_client_dendrite_admin_api_traefik_entrypoints: "{{ matrix_dendrite_container_labels_traefik_entrypoints }}"
+matrix_dendrite_container_labels_client_dendrite_admin_api_traefik_tls: "{{ matrix_dendrite_container_labels_client_dendrite_admin_api_traefik_entrypoints != 'web' }}"
+matrix_dendrite_container_labels_client_dendrite_admin_api_traefik_tls_certResolver: "{{ matrix_dendrite_container_labels_traefik_tls_certResolver }}"  # noqa var-naming
+
+# Controls whether labels will be added that expose the Server-Server API (Federation API).
+matrix_dendrite_container_labels_federation_api_enabled: "{{ matrix_dendrite_federation_enabled }}"
+matrix_dendrite_container_labels_federation_api_traefik_hostname: "{{ matrix_dendrite_hostname }}"
+matrix_dendrite_container_labels_federation_api_traefik_path_prefix: /_matrix
+matrix_dendrite_container_labels_federation_api_traefik_rule: "Host(`{{ matrix_dendrite_container_labels_federation_api_traefik_hostname }}`) && PathPrefix(`{{ matrix_dendrite_container_labels_federation_api_traefik_path_prefix }}`)"
+matrix_dendrite_container_labels_federation_api_traefik_priority: 0
+matrix_dendrite_container_labels_federation_api_traefik_entrypoints: ''
+matrix_dendrite_container_labels_federation_api_traefik_tls: "{{ matrix_dendrite_container_labels_federation_api_traefik_entrypoints != 'web' }}"
+matrix_dendrite_container_labels_federation_api_traefik_tls_certResolver: "{{ matrix_dendrite_container_labels_traefik_tls_certResolver }}"  # noqa var-naming
+
+# matrix_dendrite_container_labels_additional_labels contains a multiline string with additional labels to add to the container label file.
+# See `../templates/labels.j2` for details.
+#
+# Example:
+# matrix_dendrite_container_labels_additional_labels: |
+#   my.label=1
+#   another.label="here"
+matrix_dendrite_container_labels_additional_labels: ''
+
 # A list of extra arguments to pass to the container (`docker run` command)
 # Also see `matrix_dendrite_container_arguments`
 matrix_dendrite_container_extra_arguments: []
@@ -86,14 +161,17 @@ matrix_dendrite_systemd_required_services_list_auto: []
 matrix_dendrite_systemd_required_services_list_custom: []
 
 # List of systemd services that matrix-dendrite.service wants
-matrix_dendrite_systemd_wanted_services_list: []
+matrix_dendrite_systemd_wanted_services_list: "{{ matrix_dendrite_systemd_wanted_services_list_default + matrix_dendrite_systemd_wanted_services_list_auto + matrix_dendrite_systemd_wanted_services_list_custom }}"
+matrix_dendrite_systemd_wanted_services_list_default: ["docker.service"]
+matrix_dendrite_systemd_wanted_services_list_auto: []
+matrix_dendrite_systemd_wanted_services_list_custom: []
 
 # Specifies which template files to use when configuring Dendrite.
 # If you'd like to have your own different configuration, feel free to copy and paste
 # the original files into your inventory (e.g. in `inventory/host_vars/<host>/`)
 # and then change the specific host's `vars.yml` file like this:
 # matrix_dendrite_template_dendrite_config: "{{ playbook_dir }}/inventory/host_vars/<host>/dendrite.yaml.j2"
-matrix_dendrite_template_dendrite_config: "{{ role_path }}/templates/dendrite/dendrite.yaml.j2"
+matrix_dendrite_template_dendrite_config: "{{ role_path }}/templates/dendrite.yaml.j2"
 
 matrix_dendrite_client_api_registration_shared_secret: ""
 matrix_dendrite_allow_guest_access: false
@@ -193,7 +271,7 @@ matrix_dendrite_self_check_validate_certificates: true
 #
 # For a more advanced customization, you can extend the default (see `matrix_dendrite_configuration_extension_yaml`)
 # or completely replace this variable with your own template.
-matrix_dendrite_configuration_yaml: "{{ lookup('template', 'templates/dendrite/dendrite.yaml.j2') }}"
+matrix_dendrite_configuration_yaml: "{{ lookup('template', matrix_dendrite_template_dendrite_config) }}"
 
 matrix_dendrite_configuration_extension_yaml: |
   # Your custom YAML configuration for Dendrite goes here.

roles/custom/matrix-dendrite/tasks/setup_install.yml

@@ -112,16 +112,20 @@
     name: "{{ matrix_dendrite_container_network }}"
     driver: bridge
 
-- name: Ensure matrix-dendrite.service installed
+- name: Ensure Dendrite support files installed
   ansible.builtin.template:
-    src: "{{ role_path }}/templates/dendrite/systemd/matrix-dendrite.service.j2"
-    dest: "{{ devture_systemd_docker_base_systemd_path }}/matrix-dendrite.service"
-    mode: 0644
-
-- name: Ensure Dendrite scripts created
-  ansible.builtin.template:
-    src: "{{ role_path }}/templates/dendrite/bin/{{ item }}.j2"
-    dest: "{{ matrix_dendrite_bin_path }}/{{ item }}"
-    mode: 0750
+    src: "{{ item.src }}"
+    dest: "{{ item.dest }}"
+    mode: "{{ item.mode }}"
+    owner: "{{ matrix_user_username }}"
+    group: "{{ matrix_user_groupname }}"
   with_items:
-    - create-account
+    - src: labels.j2
+      dest: "{{ matrix_dendrite_base_path }}/labels"
+      mode: "0640"
+    - src: bin/create-account.j2
+      dest: "{{ matrix_dendrite_bin_path }}/create-account"
+      mode: "0750"
+    - src: systemd/matrix-dendrite.service.j2
+      dest: "{{ devture_systemd_docker_base_systemd_path }}/matrix-dendrite.service"
+      mode: "0644"

roles/custom/matrix-dendrite/tasks/validate_config.yml

@@ -5,6 +5,7 @@
       You need to define a required configuration setting (`{{ item }}`) for using Dendrite.
   when: "vars[item] == ''"
   with_items:
+    - matrix_dendrite_hostname
     - matrix_dendrite_client_api_registration_shared_secret
     - matrix_dendrite_database_hostname
 

roles/custom/matrix-dendrite/templates/labels.j2

@@ -0,0 +1,147 @@
+{% if matrix_dendrite_container_labels_traefik_enabled %}
+traefik.enable=true
+
+{% if matrix_dendrite_container_labels_traefik_docker_network %}
+traefik.docker.network={{ matrix_dendrite_container_labels_traefik_docker_network }}
+{% endif %}
+
+traefik.http.services.matrix-dendrite.loadbalancer.server.port={{ matrix_dendrite_http_bind_port }}
+
+
+{#
+	Root path (/)
+#}
+{% if matrix_dendrite_container_labels_client_root_enabled %}
+
+{% set client_root_middlewares = [] %}
+
+{% if matrix_dendrite_container_labels_client_root_redirection_enabled %}
+{% set client_root_middlewares = client_root_middlewares + ['matrix-dendrite-client-root-redirect'] %}
+traefik.http.middlewares.matrix-dendrite-client-root-redirect.redirectregex.regex=(.*)
+traefik.http.middlewares.matrix-dendrite-client-root-redirect.redirectregex.replacement={{ matrix_dendrite_container_labels_client_root_redirection_url }}
+{% endif %}
+
+traefik.http.routers.matrix-dendrite-client-root.rule={{ matrix_dendrite_container_labels_client_root_traefik_rule }}
+
+traefik.http.routers.matrix-dendrite-client-root.middlewares={{ client_root_middlewares | join(',') }}
+
+{% if matrix_dendrite_container_labels_client_root_traefik_priority | int > 0 %}
+traefik.http.routers.matrix-dendrite-client-root.priority={{ matrix_dendrite_container_labels_client_root_traefik_priority }}
+{% endif %}
+
+traefik.http.routers.matrix-dendrite-client-root.service=matrix-dendrite
+traefik.http.routers.matrix-dendrite-client-root.entrypoints={{ matrix_dendrite_container_labels_client_root_traefik_entrypoints }}
+traefik.http.routers.matrix-dendrite-client-root.tls={{ matrix_dendrite_container_labels_client_root_traefik_tls | to_json }}
+
+{% if matrix_dendrite_container_labels_client_root_traefik_tls %}
+traefik.http.routers.matrix-dendrite-client-root.tls.certResolver={{ matrix_dendrite_container_labels_client_root_traefik_tls_certResolver }}
+{% endif %}
+
+{% endif %}
+{#
+	/Root path (/)
+#}
+
+
+{#
+	Client-API (/_matrix)
+#}
+{% if matrix_dendrite_container_labels_client_api_enabled %}
+
+traefik.http.routers.matrix-dendrite-client-api.rule={{ matrix_dendrite_container_labels_client_api_traefik_rule }}
+
+{% if matrix_dendrite_container_labels_client_api_traefik_priority | int > 0 %}
+traefik.http.routers.matrix-dendrite-client-api.priority={{ matrix_dendrite_container_labels_client_api_traefik_priority }}
+{% endif %}
+
+traefik.http.routers.matrix-dendrite-client-api.service=matrix-dendrite
+traefik.http.routers.matrix-dendrite-client-api.entrypoints={{ matrix_dendrite_container_labels_client_api_traefik_entrypoints }}
+traefik.http.routers.matrix-dendrite-client-api.tls={{ matrix_dendrite_container_labels_client_api_traefik_tls | to_json }}
+
+{% if matrix_dendrite_container_labels_client_api_traefik_tls %}
+traefik.http.routers.matrix-dendrite-client-api.tls.certResolver={{ matrix_dendrite_container_labels_client_api_traefik_tls_certResolver }}
+{% endif %}
+
+{% endif %}
+{#
+	/Client-API (/_matrix)
+#}
+
+
+{#
+	Synapse Admin API (/_synapse/admin)
+#}
+{% if matrix_dendrite_container_labels_client_synapse_admin_api_enabled %}
+
+traefik.http.routers.matrix-dendrite-client-synapse-admin-api.rule={{ matrix_dendrite_container_labels_client_synapse_admin_api_traefik_rule }}
+
+{% if matrix_dendrite_container_labels_client_synapse_admin_api_traefik_priority | int > 0 %}
+traefik.http.routers.matrix-dendrite-client-synapse-admin-api.priority={{ matrix_dendrite_container_labels_client_synapse_admin_api_traefik_priority }}
+{% endif %}
+
+traefik.http.routers.matrix-dendrite-client-synapse-admin-api.service=matrix-dendrite
+traefik.http.routers.matrix-dendrite-client-synapse-admin-api.entrypoints={{ matrix_dendrite_container_labels_client_synapse_admin_api_traefik_entrypoints }}
+traefik.http.routers.matrix-dendrite-client-synapse-admin-api.tls={{ matrix_dendrite_container_labels_client_synapse_admin_api_traefik_tls | to_json }}
+
+{% if matrix_dendrite_container_labels_client_synapse_admin_api_traefik_tls %}
+traefik.http.routers.matrix-dendrite-client-synapse-admin-api.tls.certResolver={{ matrix_dendrite_container_labels_client_synapse_admin_api_traefik_tls_certResolver }}
+{% endif %}
+
+{% endif %}
+{#
+	/Synapse Admin API (/_synapse/admin)
+#}
+
+
+{#
+	Dendrite Admin API (/_dendrite/admin)
+#}
+{% if matrix_dendrite_container_labels_client_dendrite_admin_api_enabled %}
+
+traefik.http.routers.matrix-dendrite-client-synapse-admin-api.rule={{ matrix_dendrite_container_labels_client_dendrite_admin_api_traefik_rule }}
+
+{% if matrix_dendrite_container_labels_client_dendrite_admin_api_traefik_priority | int > 0 %}
+traefik.http.routers.matrix-dendrite-client-synapse-admin-api.priority={{ matrix_dendrite_container_labels_client_dendrite_admin_api_traefik_priority }}
+{% endif %}
+
+traefik.http.routers.matrix-dendrite-client-synapse-admin-api.service=matrix-dendrite
+traefik.http.routers.matrix-dendrite-client-synapse-admin-api.entrypoints={{ matrix_dendrite_container_labels_client_dendrite_admin_api_traefik_entrypoints }}
+traefik.http.routers.matrix-dendrite-client-synapse-admin-api.tls={{ matrix_dendrite_container_labels_client_dendrite_admin_api_traefik_tls | to_json }}
+
+{% if matrix_dendrite_container_labels_client_dendrite_admin_api_traefik_tls %}
+traefik.http.routers.matrix-dendrite-client-synapse-admin-api.tls.certResolver={{ matrix_dendrite_container_labels_client_dendrite_admin_api_traefik_tls_certResolver }}
+{% endif %}
+
+{% endif %}
+{#
+	/Dendrite Admin API (/_dendrite/admin)
+#}
+
+
+{#
+	Federation-API (/_matrix)
+#}
+{% if matrix_dendrite_container_labels_federation_api_enabled %}
+
+traefik.http.routers.matrix-dendrite-federation-api.rule={{ matrix_dendrite_container_labels_federation_api_traefik_rule }}
+
+{% if matrix_dendrite_container_labels_federation_api_traefik_priority | int > 0 %}
+traefik.http.routers.matrix-dendrite-federation-api.priority={{ matrix_dendrite_container_labels_federation_api_traefik_priority }}
+{% endif %}
+
+traefik.http.routers.matrix-dendrite-federation-api.service=matrix-dendrite-federation-api
+traefik.http.routers.matrix-dendrite-federation-api.entrypoints={{ matrix_dendrite_container_labels_federation_api_traefik_entrypoints }}
+traefik.http.routers.matrix-dendrite-federation-api.tls={{ matrix_dendrite_container_labels_federation_api_traefik_tls | to_json }}
+
+{% if matrix_dendrite_container_labels_federation_api_traefik_tls %}
+traefik.http.routers.matrix-dendrite-federation-api.tls.certResolver={{ matrix_dendrite_container_labels_federation_api_traefik_tls_certResolver }}
+{% endif %}
+
+{% endif %}
+{#
+	/Federation-API (/_matrix)
+#}
+
+{% endif %}
+
+{{ matrix_dendrite_container_labels_additional_labels }}

roles/custom/matrix-dendrite/templates/systemd/matrix-dendrite.service.j2

@@ -40,6 +40,7 @@ ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} create \
 			--mount type=bind,src={{ matrix_dendrite_config_dir_path }},dst=/data,ro \
 			--mount type=bind,src={{ matrix_dendrite_storage_path }},dst=/matrix-media-store-parent,bind-propagation=slave \
 			--mount type=bind,src={{ matrix_dendrite_nats_storage_path }},dst=/matrix-nats-store,bind-propagation=slave \
+			--label-file={{ matrix_dendrite_base_path }}/labels \
 			{% for volume in matrix_dendrite_container_additional_volumes %}
 			-v {{ volume.src }}:{{ volume.dst }}:{{ volume.options }} \
 			{% endfor %}