From f28e7ef9c71f02c3935be0c0c8b3f21bcb69a26d Mon Sep 17 00:00:00 2001 From: Slavi Pantaleev Date: Tue, 14 Feb 2023 11:29:53 +0200 Subject: [PATCH] Add (native) Traefik support to matrix-client-cinny Previously, it had to go through matrix-nginx-proxy. It's exposed to Traefik directly via container labels now --- group_vars/matrix_servers | 8 ++ .../matrix-client-cinny/defaults/main.yml | 111 ++++++++++++++++++ .../tasks/setup_install.yml | 7 +- .../tasks/validate_config.yml | 20 ++++ .../matrix-client-cinny/templates/labels.j2 | 45 +++++++ .../systemd/matrix-client-cinny.service.j2 | 14 ++- 6 files changed, 202 insertions(+), 3 deletions(-) create mode 100644 roles/custom/matrix-client-cinny/templates/labels.j2 diff --git a/group_vars/matrix_servers b/group_vars/matrix_servers index 1a131a285..6e311db1a 100755 --- a/group_vars/matrix_servers +++ b/group_vars/matrix_servers @@ -3020,6 +3020,14 @@ matrix_client_cinny_container_image_self_build: "{{ matrix_architecture not in [ # the HTTP port to the local host. matrix_client_cinny_container_http_host_bind_port: "{{ (matrix_playbook_service_host_bind_interface_prefix ~ '8080') if matrix_playbook_service_host_bind_interface_prefix else '' }}" +matrix_client_cinny_container_network: "{{ matrix_nginx_proxy_container_network if matrix_playbook_reverse_proxy_type == 'playbook-managed-nginx' else 'matrix-client-cinny' }}" + +matrix_client_cinny_container_additional_networks: "{{ [matrix_playbook_reverse_proxyable_services_additional_network] if matrix_playbook_reverse_proxyable_services_additional_network else [] }}" + +matrix_client_cinny_container_labels_traefik_enabled: "{{ matrix_playbook_reverse_proxy_type in ['playbook-managed-traefik', 'other-traefik-container'] }}" +matrix_client_cinny_container_labels_traefik_docker_network: "{{ matrix_playbook_reverse_proxyable_services_additional_network }}" +matrix_client_cinny_container_labels_traefik_entrypoints: "{{ devture_traefik_entrypoint_primary if devture_traefik_enabled else '' }}" + matrix_client_cinny_default_hs_url: "{{ matrix_homeserver_url }}" matrix_client_cinny_self_check_validate_certificates: "{{ false if matrix_playbook_ssl_retrieval_method == 'self-signed' else true }}" diff --git a/roles/custom/matrix-client-cinny/defaults/main.yml b/roles/custom/matrix-client-cinny/defaults/main.yml index 5b15b42cd..5e5f216f9 100644 --- a/roles/custom/matrix-client-cinny/defaults/main.yml +++ b/roles/custom/matrix-client-cinny/defaults/main.yml @@ -14,17 +14,128 @@ matrix_client_cinny_docker_image_force_pull: "{{ matrix_client_cinny_docker_imag matrix_client_cinny_data_path: "{{ matrix_base_data_path }}/client-cinny" matrix_client_cinny_docker_src_files_path: "{{ matrix_client_cinny_data_path }}/docker-src" +# The base container network +matrix_client_cinny_container_network: matrix-client-cinny + +# A list of additional container networks that the container would be connected to. +# The role does not create these networks, so make sure they already exist. +# Use this to expose this container to a reverse proxy, which runs in a different container network. +matrix_client_cinny_container_additional_networks: [] + # Controls whether the container exposes its HTTP port (tcp/8080 in the container). # # Takes an ":" or "" value (e.g. "127.0.0.1:8768"), or empty string to not expose. matrix_client_cinny_container_http_host_bind_port: '' + +# matrix_client_cinny_container_labels_traefik_enabled controls whether labels to assist a Traefik reverse-proxy will be attached to the container. +# See `../templates/labels.j2` for details. +# +# To inject your own other container labels, see `matrix_client_cinny_container_labels_additional_labels`. +matrix_client_cinny_container_labels_traefik_enabled: true +matrix_client_cinny_container_labels_traefik_docker_network: "{{ matrix_client_cinny_container_network }}" +matrix_client_cinny_container_labels_traefik_hostname: "{{ matrix_client_cinny_hostname }}" +# The path prefix must either be `/` or not end with a slash (e.g. `/cinny`). +matrix_client_cinny_container_labels_traefik_path_prefix: "{{ matrix_client_cinny_path_prefix }}" +matrix_client_cinny_container_labels_traefik_rule: "Host(`{{ matrix_client_cinny_container_labels_traefik_hostname }}`){% if matrix_client_cinny_container_labels_traefik_path_prefix != '/' %} && PathPrefix(`{{ matrix_client_cinny_container_labels_traefik_path_prefix }}`){% endif %}" +matrix_client_cinny_container_labels_traefik_priority: 0 +matrix_client_cinny_container_labels_traefik_entrypoints: web-secure +matrix_client_cinny_container_labels_traefik_tls: "{{ matrix_client_cinny_container_labels_traefik_entrypoints != 'web' }}" +matrix_client_cinny_container_labels_traefik_tls_certResolver: default # noqa var-naming + +# Controls which additional headers to attach to all HTTP responses. +# To add your own headers, use `matrix_client_cinny_container_labels_traefik_additional_response_headers_custom` +matrix_client_cinny_container_labels_traefik_additional_response_headers: "{{ matrix_client_cinny_container_labels_traefik_additional_response_headers_auto | combine(matrix_client_cinny_container_labels_traefik_additional_response_headers_custom) }}" +matrix_client_cinny_container_labels_traefik_additional_response_headers_auto: | + {{ + {} + | combine ({'X-XSS-Protection': matrix_client_cinny_http_header_xss_protection} if matrix_client_cinny_http_header_xss_protection else {}) + | combine ({'X-Frame-Options': matrix_client_cinny_http_header_frame_options} if matrix_client_cinny_http_header_frame_options else {}) + | combine ({'X-Content-Type-Options': matrix_client_cinny_http_header_content_type_options} if matrix_client_cinny_http_header_content_type_options else {}) + | combine ({'Content-Security-Policy': matrix_client_cinny_http_header_content_security_policy} if matrix_client_cinny_http_header_content_security_policy else {}) + | combine ({'Permission-Policy': matrix_client_cinny_http_header_content_permission_policy} if matrix_client_cinny_http_header_content_permission_policy else {}) + | combine ({'Strict-Transport-Security': matrix_client_cinny_http_header_strict_transport_security} if matrix_client_cinny_http_header_strict_transport_security and matrix_client_cinny_container_labels_traefik_tls else {}) + }} +matrix_client_cinny_container_labels_traefik_additional_response_headers_custom: {} + +# matrix_client_cinny_container_labels_additional_labels contains a multiline string with additional labels to add to the container label file. +# See `../templates/labels.j2` for details. +# +# Example: +# matrix_client_cinny_container_labels_additional_labels: | +# my.label=1 +# another.label="here" +matrix_client_cinny_container_labels_additional_labels: '' + # A list of extra arguments to pass to the container matrix_client_cinny_container_extra_arguments: [] # List of systemd services that matrix-client-cinny.service depends on matrix_client_cinny_systemd_required_services_list: ['docker.service'] +# Specifies the value of the `X-XSS-Protection` header +# Stops pages from loading when they detect reflected cross-site scripting (XSS) attacks. +# +# Learn more about it is here: +# - https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-XSS-Protection +# - https://portswigger.net/web-security/cross-site-scripting/reflected +matrix_client_cinny_http_header_xss_protection: "1; mode=block" + +# Specifies the value of the `X-Frame-Options` header which controls whether framing can happen. +# See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options +matrix_client_cinny_http_header_frame_options: SAMEORIGIN + +# Specifies the value of the `X-Content-Type-Options` header. +# See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Content-Type-Options +matrix_client_cinny_http_header_content_type_options: nosniff + +# Specifies the value of the `Content-Security-Policy` header. +# See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy +matrix_client_cinny_http_header_content_security_policy: frame-ancestors 'self' + +# Specifies the value of the `Permission-Policy` header. +# See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Permission-Policy +matrix_client_cinny_http_header_content_permission_policy: "{{ 'interest-cohort=() always' if matrix_client_cinny_floc_optout_enabled else '' }}" + +# Specifies the value of the `Strict-Transport-Security` header. +# See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security +matrix_client_cinny_http_header_strict_transport_security: "{{ '\"max-age=31536000; includeSubDomains; preload\" always' if matrix_client_cinny_hsts_preload_enabled else '\"max-age=31536000; includeSubDomains\" always' }}" + +# Controls whether to send a "Permissions-Policy interest-cohort=();" header along with all responses +# +# Learn more about what it is here: +# - https://www.eff.org/deeplinks/2021/03/googles-floc-terrible-idea +# - https://paramdeo.com/blog/opting-your-website-out-of-googles-floc-network +# - https://amifloced.org/ +# +# Of course, a better solution is to just stop using browsers (like Chrome), which participate in such tracking practices. +# See: `matrix_client_cinny_content_permission_policy` +matrix_client_cinny_floc_optout_enabled: true + +# Controls if HSTS preloading is enabled +# +# In its strongest and recommended form, the [HSTS policy](https://www.chromium.org/hsts) includes all subdomains, and +# indicates a willingness to be "preloaded" into browsers: +# `Strict-Transport-Security: max-age=31536000; includeSubDomains; preload` +# For more information visit: +# - https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security +# - https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security +# - https://hstspreload.org/#opt-in +# See: `matrix_client_cinny_http_header_strict_transport_security` +matrix_client_cinny_hsts_preload_enabled: false + +# The hostname at which Cinny is served. +# Only works with with Traefik reverse-proxying. +# For matrix-nginx-proxy, `matrix_server_fqn_cinny` is used and this variable has no effect. +matrix_client_cinny_hostname: "{{ matrix_server_fqn_cinny }}" + +# The path at which Cinny is exposed. +# When matrix-nginx-proxy is used, setting this to values other than `/` will cause configuration mismatches and trouble. +# +# If Traefik is used, the hostname is also configurable - see `matrix_client_cinny_container_labels_traefik_hostname`. +# This value must either be `/` or not end with a slash (e.g. `/cinny`). +matrix_client_cinny_path_prefix: / + # Controls whether the self-check feature should validate SSL certificates. matrix_client_cinny_self_check_validate_certificates: true diff --git a/roles/custom/matrix-client-cinny/tasks/setup_install.yml b/roles/custom/matrix-client-cinny/tasks/setup_install.yml index 46458f0b0..e4eb79387 100644 --- a/roles/custom/matrix-client-cinny/tasks/setup_install.yml +++ b/roles/custom/matrix-client-cinny/tasks/setup_install.yml @@ -51,7 +51,7 @@ group: "{{ matrix_user_groupname }}" with_items: - {src: "{{ role_path }}/templates/nginx.conf.j2", name: "nginx.conf"} - when: "item.src is not none" + - {src: "{{ role_path }}/templates/labels.j2", name: "labels"} - name: Ensure Cinny Docker image is built community.docker.docker_image: @@ -64,6 +64,11 @@ pull: true when: "matrix_client_cinny_container_image_self_build | bool" +- name: Ensure Cinny container network is created + community.general.docker_network: + name: "{{ matrix_client_cinny_container_network }}" + driver: bridge + - name: Ensure matrix-client-cinny.service installed ansible.builtin.template: src: "{{ role_path }}/templates/systemd/matrix-client-cinny.service.j2" diff --git a/roles/custom/matrix-client-cinny/tasks/validate_config.yml b/roles/custom/matrix-client-cinny/tasks/validate_config.yml index 10f64fee1..333872097 100644 --- a/roles/custom/matrix-client-cinny/tasks/validate_config.yml +++ b/roles/custom/matrix-client-cinny/tasks/validate_config.yml @@ -6,3 +6,23 @@ when: "vars[item] == '' or vars[item] is none" with_items: - "matrix_client_cinny_default_hs_url" + +- when: matrix_client_cinny_container_labels_traefik_enabled | bool + block: + - name: Fail if required matrix-client-cinny Traefik settings not defined + ansible.builtin.fail: + msg: >- + You need to define a required configuration setting (`{{ item }}`). + when: "vars[item] == ''" + with_items: + - matrix_client_cinny_container_labels_traefik_hostname + - matrix_client_cinny_container_labels_traefik_path_prefix + + # We ensure it doesn't end with a slash, because we handle both (slash and no-slash). + # Knowing that `matrix_client_cinny_container_labels_traefik_path_prefix` does not end with a slash + # ensures we know how to set these routes up without having to do "does it end with a slash" checks elsewhere. + - name: Fail if matrix_client_cinny_container_labels_traefik_path_prefix ends with a slash + ansible.builtin.fail: + msg: >- + matrix_client_cinny_container_labels_traefik_path_prefix (`{{ matrix_client_cinny_container_labels_traefik_path_prefix }}`) must either be `/` or not end with a slash (e.g. `/cinny`). + when: "matrix_client_cinny_container_labels_traefik_path_prefix != '/' and matrix_client_cinny_container_labels_traefik_path_prefix[-1] == '/'" diff --git a/roles/custom/matrix-client-cinny/templates/labels.j2 b/roles/custom/matrix-client-cinny/templates/labels.j2 new file mode 100644 index 000000000..f1c4f49ad --- /dev/null +++ b/roles/custom/matrix-client-cinny/templates/labels.j2 @@ -0,0 +1,45 @@ +{% if matrix_client_cinny_container_labels_traefik_enabled %} +traefik.enable=true + +{% if matrix_client_cinny_container_labels_traefik_docker_network %} +traefik.docker.network={{ matrix_client_cinny_container_labels_traefik_docker_network }} +{% endif %} + +{% set middlewares = [] %} + +{% if matrix_client_cinny_container_labels_traefik_path_prefix != '/' %} +traefik.http.middlewares.matrix-client-cinny-slashless-redirect.redirectregex.regex=({{ matrix_client_cinny_container_labels_traefik_path_prefix | quote }})$ +traefik.http.middlewares.matrix-client-cinny-slashless-redirect.redirectregex.replacement=${1}/ +{% set middlewares = middlewares + ['matrix-client-cinny-slashless-redirect'] %} +{% endif %} + +{% if matrix_client_cinny_container_labels_traefik_path_prefix != '/' %} +traefik.http.middlewares.matrix-client-cinny-strip-prefix.stripprefix.prefixes={{ matrix_client_cinny_container_labels_traefik_path_prefix }} +{% set middlewares = middlewares + ['matrix-client-cinny-strip-prefix'] %} +{% endif %} + +{% if matrix_client_cinny_container_labels_traefik_additional_response_headers.keys() | length > 0 %} +{% for name, value in matrix_client_cinny_container_labels_traefik_additional_response_headers.items() %} +traefik.http.middlewares.matrix-client-cinny-add-headers.headers.customresponseheaders.{{ name }}={{ value }} +{% endfor %} +{% set middlewares = middlewares + ['matrix-client-cinny-add-headers'] %} +{% endif %} + +traefik.http.routers.matrix-client-cinny.rule={{ matrix_client_cinny_container_labels_traefik_rule }} +{% if matrix_client_cinny_container_labels_traefik_priority | int > 0 %} +traefik.http.routers.matrix-client-cinny.priority={{ matrix_client_cinny_container_labels_traefik_priority }} +{% endif %} +traefik.http.routers.matrix-client-cinny.service=matrix-client-cinny +{% if middlewares | length > 0 %} +traefik.http.routers.matrix-client-cinny.middlewares={{ middlewares | join(',') }} +{% endif %} +traefik.http.routers.matrix-client-cinny.entrypoints={{ matrix_client_cinny_container_labels_traefik_entrypoints }} +traefik.http.routers.matrix-client-cinny.tls={{ matrix_client_cinny_container_labels_traefik_tls | to_json }} +{% if matrix_client_cinny_container_labels_traefik_tls %} +traefik.http.routers.matrix-client-cinny.tls.certResolver={{ matrix_client_cinny_container_labels_traefik_tls_certResolver }} +{% endif %} + +traefik.http.services.matrix-client-cinny.loadbalancer.server.port=8080 +{% endif %} + +{{ matrix_client_cinny_container_labels_additional_labels }} diff --git a/roles/custom/matrix-client-cinny/templates/systemd/matrix-client-cinny.service.j2 b/roles/custom/matrix-client-cinny/templates/systemd/matrix-client-cinny.service.j2 index b9a66c74b..2c49a0f3b 100644 --- a/roles/custom/matrix-client-cinny/templates/systemd/matrix-client-cinny.service.j2 +++ b/roles/custom/matrix-client-cinny/templates/systemd/matrix-client-cinny.service.j2 @@ -13,15 +13,18 @@ Environment="HOME={{ devture_systemd_docker_base_systemd_unit_home_path }}" ExecStartPre=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} kill matrix-client-cinny 2>/dev/null || true' ExecStartPre=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} rm matrix-client-cinny 2>/dev/null || true' -ExecStart={{ devture_systemd_docker_base_host_command_docker }} run --rm --name matrix-client-cinny \ +ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} create \ + --rm \ + --name=matrix-client-cinny \ --log-driver=none \ --user={{ matrix_user_uid }}:{{ matrix_user_gid }} \ --cap-drop=ALL \ --read-only \ - --network={{ matrix_docker_network }} \ + --network={{ matrix_client_cinny_container_network }} \ {% if matrix_client_cinny_container_http_host_bind_port %} -p {{ matrix_client_cinny_container_http_host_bind_port }}:8080 \ {% endif %} + --label-file={{ matrix_client_cinny_data_path }}/labels \ --tmpfs=/tmp:rw,noexec,nosuid,size=10m \ --mount type=bind,src={{ matrix_client_cinny_data_path }}/nginx.conf,dst=/etc/nginx/nginx.conf,ro \ --mount type=bind,src={{ matrix_client_cinny_data_path }}/config.json,dst=/app/config.json,ro \ @@ -30,8 +33,15 @@ ExecStart={{ devture_systemd_docker_base_host_command_docker }} run --rm --name {% endfor %} {{ matrix_client_cinny_docker_image }} +{% for network in matrix_client_cinny_container_additional_networks %} +ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} network connect {{ network }} matrix-client-cinny +{% endfor %} + +ExecStart={{ devture_systemd_docker_base_host_command_docker }} start --attach matrix-client-cinny + ExecStop=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} kill matrix-client-cinny 2>/dev/null || true' ExecStop=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} rm matrix-client-cinny 2>/dev/null || true' + Restart=always RestartSec=30 SyslogIdentifier=matrix-client-cinny