Commit Graph

58 Commits

Author SHA1 Message Date
3ee7deb2d7 Rename variable (matrix_user_groupname -> matrix_group_name) 2025-04-29 10:39:41 +03:00
9fc5cdab33 Rename variable (matrix_user_username -> matrix_user_name) 2025-04-29 10:39:41 +03:00
7fe25ef0fc Split matrix_coturn_systemd_required_services_list into _default, _auto and _custom 2025-04-06 15:36:51 +03:00
c18fc93a22 Update validate_config.yml files: edit the banner message for variables name
Signed-off-by: Suguru Hirahara <acioustick@noreply.codeberg.org>
2025-03-05 13:30:50 +09:00
66e37a68ae Add license information to files for matrix-coturn
Signed-off-by: Suguru Hirahara <acioustick@noreply.codeberg.org>
2025-03-01 01:41:49 +09:00
c47eca389b Rework all roles to include component_(docker|container)_image_registry_prefix* variables
This:

- brings consistency - no more mixing `_name_prefix` and `_registry_prefix`
- adds extensibility - a future patch will allow reconfiguring all registry prefixes for all roles in the playbook

We still have `_docker_` vs `_container_` inconsistencies.
These may be worked on later.
2025-02-24 11:38:47 +02:00
0d137db283 Re-enable STUN/UDP by default so that old Element mobile clients can work
Partially reverts ac26cc1cb0.

The configurability introduced there is still available, so people can
easily disable this, if necessary.
2025-02-23 12:09:37 +02:00
d6bf789710 Remove matrix_container_global_registry_prefix variable
This is done for a few reasons:

- less globals and more indepdendence for each role is better. We rely
  on various externally-hosted roles and they don't rely on this global
  either.

- `matrix_container_global_registry_prefix` could make people think they
  could just override this variable and have all their images pull from
  elsewhere. This is rarely the case, unless you've taken special care
  to mirror all the various components (from their respective
  registries) to your own. In such a case, you probably know what you're
  mirroring and can adjust individual variables.

- nowadays, various components live on different registries.
  With Docker Inc tightening rate limits for Docker Hub, it's even more
  likely that we'll see increased diversity in where images are hosted
2025-02-23 10:15:41 +02:00
d12643eb91 Do not use docker stop --time (deprecated in Docker v28 in favor of --timeout or just -t)
`-t` works on both old and new Docker versions, so it's best to use that.
2025-02-22 21:42:18 +02:00
671a3dc94f Only advertise 3478/udp (STUN/TURN) if Coturn actually enables it
Related to ac26cc1cb0 which disabled
`3478/udp` by default.

Without this patch, homeservers continued to advertise the `3478/udp` port,
even though it was no longer exposed. While clients should handle that
gracefully (by falling back to TCP, etc.), it seems like Element either
doesn't do that or it doesn't support TCP (which this patch won't fix).

In any case, it's better to only announce what is actually supported/exposed.
2025-02-22 13:44:14 +02:00
64a402eb65 Do not duplicate turn_uris construction for each homeserver implementation (extract to matrix_coturn_turn_uris) 2025-02-22 13:43:25 +02:00
ac26cc1cb0 Allow STUN/TURN exposure over TCP/UDP to be controlled separately & disable STUN over UDP by default 2025-02-19 11:50:49 +02:00
afb97e18ac Make matrix-coturn role respect devture_systemd_docker_base_ipv6_enabled 2025-02-16 12:01:11 +02:00
6531c61c7a Update files for matrix-coturn: make the reloading schedule configurable with variables
This commit adopts the common format which can be seen for BorgBackup. It should be probably helpful, though I am not quite sure how much.

Signed-off-by: Suguru Hirahara <acioustick@noreply.codeberg.org>
2025-02-07 01:13:45 +09:00
107e9d205d Edit YAML files: minor changes (#3955)
* Update roles/custom/matrix-coturn/defaults/main.yml: edit an instruction for creating a strong password

Follow-up to 6b87d1aa7d

Signed-off-by: Suguru Hirahara <acioustick@noreply.codeberg.org>

* Update examples/vars.yml: add a whitespace character for indenting

Signed-off-by: Suguru Hirahara <acioustick@noreply.codeberg.org>

---------

Signed-off-by: Suguru Hirahara <acioustick@noreply.codeberg.org>
Co-authored-by: Suguru Hirahara <acioustick@noreply.codeberg.org>
2025-01-17 13:14:41 +02:00
2773c053d0 Update files for coturn (#3953)
* Update docs/configuring-playbook-turn.md: add a section for description about installing

Signed-off-by: Suguru Hirahara <acioustick@noreply.codeberg.org>

* Update docs/configuring-playbook-turn.md and a related file

- Edit the introducion based on docs/configuring-playbook-client-element-web.md
- Adopt the commont format by creating the section "Adjusting the playbook configuration"
- Add the section "Extending the configuration"
- Move the section "Disabling Coturn" to the bottom

Signed-off-by: Suguru Hirahara <acioustick@noreply.codeberg.org>

* Fix capitalization: Coturn → coturn

See: https://github.com/coturn/coturn. Note that "coturn" is not capitalized even on the start of a sentence, except some rare cases like on the releases page: https://github.com/coturn/coturn/releases

Signed-off-by: Suguru Hirahara <acioustick@noreply.codeberg.org>

---------

Signed-off-by: Suguru Hirahara <acioustick@noreply.codeberg.org>
Co-authored-by: Suguru Hirahara <acioustick@noreply.codeberg.org>
2025-01-17 10:19:17 +02:00
ba9aeb7c9f Consistent capitalization: NOTE → Note
Signed-off-by: Suguru Hirahara <acioustick@noreply.codeberg.org>
2024-10-15 02:58:40 +09:00
c89c356e53 Add a global config option for Docker network MTU (#3502)
* Add a global config option for Docker network MTU

* Upgrade systemd_docker_base (v1.2.0-0 -> v1.3.0-0)

The new version includes `devture_systemd_docker_base_container_networks_driver_options`
due to 3cc7d12396

Related to https://github.com/spantaleev/matrix-docker-ansible-deploy/pull/3502

* Switch from passing matrix_playbook_docker_network_mtu to respecting devture_systemd_docker_base_container_networks_driver_options

Related to:
- 3cc7d12396
- https://github.com/spantaleev/matrix-docker-ansible-deploy/pull/3502

* Update all roles to versions that respect `devture_systemd_docker_base_container_networks_driver_options`

---------

Co-authored-by: Slavi Pantaleev <slavi@devture.com>
2024-09-18 16:20:27 +03:00
035b1c3c04 Upgrade Coturn (4.6.2-r10 -> 4.6.2-r11) 2024-07-26 15:15:51 +03:00
d6aa98e57d Upgrade Coturn (4.6.2-r9 -> 4.6.2-r10) 2024-06-21 09:17:23 +03:00
9f2eff2ac7 Respect devture_systemd_docker_base_docker_service_name
Related to 0241c71a4c

Related to https://github.com/spantaleev/matrix-docker-ansible-deploy/pull/3270#issuecomment-2143782962

With this change, it should be possible for people to adjust the Docker
dependency from `docker.service` to something else (e.g. `pkg-ContainerManager-dockerd.service`),
or to completely eliminate it by setting `devture_systemd_docker_base_docker_service_name` to an empty string.

This makes it easier for people to use the playbook against a Synology DSM server.
2024-06-04 13:14:34 +03:00
3bf488fb16 Upgrade Coturn (4.6.2-r5 -> 4.6.2-r9) 2024-05-24 20:18:56 +03:00
e1363c9b9b Add lt-cred-mech authentication mechanism to Coturn
All homeserver implementations have been updated to support this as
well.

It's just Jitsi that possibly doesn't work with anything other than `auth-secret`.

Fixes https://github.com/spantaleev/matrix-docker-ansible-deploy/issues/3191
2024-02-18 09:52:00 +02:00
ad32953e0b Add additional-networks support to matrix-coturn
Not that it seems necessary right now, but it makes it consistent with
all other roles.
2024-01-15 11:18:09 +02:00
2511b34a7c Stop containers gracefully, instead of outright killing them 2023-12-06 11:52:23 +02:00
ec3b204541 Merge branch 'master' into renovate-config 2023-10-16 18:15:53 +03:00
954634b580 Make ansible-lint happy 2023-10-11 11:12:28 +03:00
dc9ff4e01b Add support for external-IP-address-autodetection to Coturn 2023-10-10 11:10:21 +03:00
c846ed199b Annotate version numbers with renovate metadata 2023-10-06 14:14:03 +02:00
c8e0f35c94 Upgrade Coturn (4.6.2-r4 -> 4.6.2-r5) 2023-10-05 17:00:59 +03:00
ce0eb973b0 Upgrade Coturn (4.6.2-r3 -> 4.6.2-r4) 2023-07-04 16:47:35 +03:00
df07b8fb7d Update coturn 4.6.1-r3 -> 4.6.2-r3 2023-06-16 16:13:15 +03:00
2649d9d8bb Fix lint-reported errors 2023-04-08 08:10:22 +03:00
fa63785109 Upgrade Coturn (4.6.1-r2 -> 4.6.1-r3) 2023-04-03 15:34:19 +03:00
69b2df629b Enable some recommended Coturn options in an effort to lower DDoS amplification factor
Fixes https://github.com/spantaleev/matrix-docker-ansible-deploy/issues/2592
2023-03-22 08:04:47 +02:00
dddfee16bc Fix all 300+ ansible-lint-reported errors 2023-03-07 17:28:15 +02:00
0b9dc56edf Add type support to matrix_coturn_container_additional_volumes
.. and try to auto-switch between `bind` and `volume` depending on
whether there's a slash in the `src` path.

Fixes https://github.com/spantaleev/matrix-docker-ansible-deploy/issues/2482
2023-02-15 06:03:55 +02:00
f6f7bbd2a1 Update coturn 4.6.1-r1 -> 4.6.1-r2 2023-02-13 12:54:55 +00:00
d44d4b637f Allow Coturn to work with SSL certificates extracted from Traefik 2023-02-08 16:06:46 +02:00
c7767e9bc8 Upgrade Coturn (4.6.1-r0 -> 4.6.1-r1) 2023-01-31 20:25:59 +02:00
aafa8f019c Allow matrix_coturn_docker_network to be set to 'host' to use host-networking
This helps large deployments which need to open up thousands of ports
(matrix_coturn_turn_udp_min_port, matrix_coturn_turn_udp_min_port)

On a test VM, opening 1k ports takes 17 seconds for Docker to "publish"
all of these ports (setting up forwarding rules with the firewall, etc),
so service startup and shutdown take a long amount of time.

If host-networking is used, there's no need to open any ports at all
and startup/shutdown can be quick.
2023-01-26 17:35:30 +02:00
bb0faa6bc3 Block various private network ranges via denied_peer_ips for Coturn by default
Inspired by: https://www.rtcsec.com/article/cve-2020-26262-bypass-of-coturns-access-control-protection/
2023-01-26 17:35:30 +02:00
773cb7d37e Make no-tcp-relay Coturn configuration property configurable 2023-01-26 17:35:30 +02:00
bf23d63f82 Add matrix_coturn_additional_configuration 2023-01-26 17:35:30 +02:00
4c9f96722f Add no-multicast-peers to Coturn config by default
Part of a security hardening provoked by:
https://www.rtcsec.com/article/cve-2020-26262-bypass-of-coturns-access-control-protection/
2023-01-26 17:35:30 +02:00
6414599079 Upgrade Coturn (4.6.0 -> 4.6.1) 2022-12-05 09:46:11 +02:00
707e909b9b /usr/local/bin/matrix-ssl-lets-encrypt-certificates-renew -> /matrix/ssl/bin/lets-encrypt-certificates-renew 2022-11-27 09:53:23 +02:00
a04f6f4e3d Optimize uninstall tasks a bit
- forego removing Docker images - it's not effective anyway, because it
  only removes the last version.. which is a drop in the bucket, usually

- do not reload systemd - it's none of our business. `--tags=start`,
  etc., handle this

- combine all uninstall tasks under a single block, which only runs if
  we detect traces (a leftover systemd .service file) of the component.
  If no such .service is detected, we skip them all. This may lead to
  incorect cleanup in rare cases, but is good enough for the most part.
2022-11-25 17:28:57 +02:00
61f67d8f0a Add install-* tags for quicker runs 2022-11-25 16:02:51 +02:00
7c2a7a8eb6 Replace most import_tasks calls with include_tasks for improved performance 2022-11-24 11:33:45 +02:00