Initial work on Synapse 0.99/1.0 preparation

roles/matrix-synapse/tasks/setup_synapse_main.yml

@@ -58,6 +58,61 @@
     dest: "{{ matrix_synapse_config_dir_path }}/{{ hostname_matrix }}.log.config"
     mode: 0644
 
+#
+# To make Synapse 0.99 happy, we need to generate a valid (self-signed is OK) certificate file that we provide to it.
+# It won't be used for anything important, but it needs to be there.
+# See https://github.com/matrix-org/synapse/issues/4554
+#
+# Previously, Synapse would generate such certificate files and actually use them.
+# So existing installations already have them.
+#
+
+- name: Check if Synapse certificate exists
+  stat:
+    path: "{{ matrix_synapse_config_dir_path }}/{{ hostname_matrix }}.tls.crt"
+  register: matrix_synapse_certificate_stat
+
+- name: Ensure OpenSSL installed (RedHat)
+  yum:
+    name:
+      - openssl
+    state: present
+    update_cache: no
+  when: "not matrix_synapse_certificate_stat.stat.exists and ansible_os_family == 'RedHat'"
+
+- name: Ensure OpenSSL installed (Debian)
+  apt:
+    name:
+      - openssl
+    state: present
+    update_cache: no
+  when: "not matrix_synapse_certificate_stat.stat.exists and ansible_os_family == 'Debian'"
+
+# The proper way to do this is by using a sequence of
+# `openssl_privatekey`, `openssl_csr` and `openssl_certificate`.
+#
+# Unfortunately, `openssl_csr` and `openssl_certificate` require `PyOpenSSL>=0.15` to work,
+# which is not available on CentOS 7 (at least).
+#
+# We'll do it in a more manual way.
+- name: Generate SSL certificate
+  command: |
+    openssl req -x509 \
+    -sha256 \
+    -newkey rsa:4096 \
+    -nodes \
+    -subj "/CN={{ hostname_matrix }}" \
+    -keyout {{ matrix_synapse_config_dir_path }}/{{ hostname_matrix }}.tls.key \
+    -out {{ matrix_synapse_config_dir_path }}/{{ hostname_matrix }}.tls.crt \
+    -days 3650
+  become: true
+  become_user: "{{ matrix_user_username }}"
+  when: "not matrix_synapse_certificate_stat.stat.exists"
+
+#
+# End of tasks related to making Synapse 0.99 happy.
+#
+
 - name: Ensure matrix-synapse.service installed
   template:
     src: "{{ role_path }}/templates/synapse/systemd/matrix-synapse.service.j2"

roles/matrix-synapse/tasks/validate_config.yml

@@ -6,4 +6,14 @@
       You need to define a required configuration setting (`{{ item }}`) for using Synapse.
   when: "vars[item] == ''"
   with_items:
-    - "matrix_synapse_macaroon_secret_key"
+    - "matrix_synapse_macaroon_secret_key"
+
+- name: (Deprecation) Catch and report renamed settings
+  fail:
+    msg: >
+      Your configuration contains a variable, which now has a different name.
+      Please change your configuration to rename the variable (`{{ item.old }}` -> `{{ item.new }}`).
+  when: "item.old in vars"
+  with_items:
+    - {'old': 'matrix_synapse_container_expose_api_port', 'new': 'matrix_synapse_container_expose_client_api_port'}
+