Commit Graph

69 Commits

Author SHA1 Message Date
Michael Hollister
305e3afb1b Updated matrix media repo to v1.3.3 2023-12-04 12:37:39 -06:00
T. Küchel
81ee0749c8
Update matrix-domain.conf.j2 - trying to fix issue #2954 (#2985)
* Update matrix-domain.conf.j2

exchanged "^~" with "~" as a pattern matching in the location part.
I am very sure, that it only works using "~". I am not quite sure though, if this is the right way to do it, because "~" is probably more expensive than "^~"

the rewrite has to be behind the definition of the $backend. Otherwise nginx will fail to work. This is probably because "break" goes directly to the proxy_pass which uses $backend.

* Update matrix-domain.conf.j2

also change the order of "set $backend" and "rewrite" here in the 3pid registration section

* Update matrix-domain.conf.j2 - repeat v3_to_r0 rewrite in else-statement

as you said: repeat it for the else-case, where the ma1sd might be running on sans_container.

* Update matrix-domain.conf.j2 - corrected wrong variable

atrix_nginx_proxy_proxy_matrix_3pid_registration_v3_to_r0_redirect_enabled
is the right variable to check (twice) in the corresponding branch.

* matrix-domain.conf.j2 - fix-2954: change all whitespaces to tabs as you do it

---------

Co-authored-by: Tobias Küchel <t.kuechel@humboldt-ka.de>
2023-11-09 09:00:25 +02:00
Slavi Pantaleev
a88a4c2b82 Use regex-enabled location blocks when matching with regex
Fixes https://github.com/spantaleev/matrix-docker-ansible-deploy/issues/2986
2023-11-08 16:30:02 +02:00
Slavi Pantaleev
ad230555e9 Try to fix /_matrix/client/v3 for ma1sd via URL rewriting to (/_matrix/client/r0)
Hopefully fixes: https://github.com/spantaleev/matrix-docker-ansible-deploy/issues/2954

Untested.

Patch inspired by: https://github.com/spantaleev/matrix-docker-ansible-deploy/issues/2954#issuecomment-1795029963
2023-11-08 11:31:18 +02:00
Slavi Pantaleev
ebe7e3b6e0 Forward /_matrix/client/v3 to identity server (not just /_matrix/client/r0)
Fixes https://github.com/spantaleev/matrix-docker-ansible-deploy/issues/2954
2023-11-06 09:33:11 +02:00
renovate[bot]
7c12c508d7
Update nginx Docker tag to v1.25.3 2023-10-25 03:59:15 +00:00
Samuel Meenzen
c846ed199b
Annotate version numbers with renovate metadata 2023-10-06 14:14:03 +02:00
Slavi Pantaleev
a0f9b1b051 Fix Schildichat config cleanup for matrix-nginx-proxy 2023-09-16 10:27:50 +03:00
Aine
86655db995
add SchildiChat client 2023-08-30 19:23:52 +03:00
Slavi Pantaleev
af636a1bb0 Upgrade ntfy (v2.7.0-0 -> v2.7.0-2) and switch it to a non-privileged port
Fixes https://github.com/spantaleev/matrix-docker-ansible-deploy/issues/2846
2023-08-26 08:21:15 +03:00
Slavi Pantaleev
4873b18000 Do not assume the jitsi_jvb_servers group is defined in everyone's inventory
Related to https://github.com/spantaleev/matrix-docker-ansible-deploy/pull/2842
2023-08-25 15:50:10 +03:00
Slavi Pantaleev
a4e642e3f4 Mark matrix_nginx_proxy_proxy_jitsi_additional_jvbs as deprecated
Related to https://github.com/spantaleev/matrix-docker-ansible-deploy/pull/2842
2023-08-25 10:22:25 +03:00
Antonis Christofides
0d8b66abd7 Simplify additional JVB configuration
The variable matrix_nginx_proxy_proxy_jitsi_additional_jvbs isn't
needed, as this information is already in the inventory.

This contribution is provided by GRNET S.A. (grnet.gr).
2023-08-24 18:07:50 +03:00
Johan Swetzén
4299d4ebd5
wsproxy for Android SMS (#2261)
* Inital work, copeid from mautrix-amp PR

* Some fixes leftover code copeid over from whatsapp

* Got it to run and register

* Fixed service issue with docker image

* I now realize I need 2 roles wsproxy and imessage

* Got someting working, still rough

* Closer to working but still not working

* reverting ports

* Update main.yml

* Add matrix-nginx-proxy config for mautrix-wsproxy

* Changed

* Add back file

* fix for error hopefully

* Changed the the way nginx was recieved

* basically did not add anything ugh

* Added some arguments

* just trying stuff now

* Ugh i messed up port number

* Changed docs

* Change dns config

* changed generic secret key

* Testing new nginx proxy

* test

* Fix linting errors

* Add mautrix syncproxy to wsproxy for Android SMS

* WIP

* Move wsproxy to custom

* Squashed commit of the following:

commit 943189a9aa
Merge: 4a229d68 f5a09f30
Author: Slavi Pantaleev <slavi@devture.com>
Date:   Sun Nov 13 08:54:32 2022 +0200

    Merge pull request #2259 from throny/patch-3

    warn users about upgrading to pg15 when using borg

commit 4a229d6870
Merge: 9b326e08 c68def08
Author: Slavi Pantaleev <slavi@devture.com>
Date:   Sun Nov 13 08:53:13 2022 +0200

    Merge pull request #2260 from etkecc/patch-117

    Update ntfy 1.28.0 -> 1.29.0

commit f5a09f30b7
Author: throny <m.throne12@gmail.com>
Date:   Sat Nov 12 23:48:57 2022 +0100

    Update maintenance-postgres.md

commit b12cdbd99d
Author: throny <m.throne12@gmail.com>
Date:   Sat Nov 12 23:40:46 2022 +0100

    Update maintenance-postgres.md

commit c68def0809
Author: Aine <97398200+etkecc@users.noreply.github.com>
Date:   Sat Nov 12 22:01:31 2022 +0000

    Update ntfy 1.28.0 -> 1.29.0

commit adbc09f152
Author: throny <m.throne12@gmail.com>
Date:   Sat Nov 12 11:20:43 2022 +0100

    warn users about upgrading to pg15 when using borg

* Fix linting errors

* Cleanup after merge

* Correct outdated variable names

* Enable both Android and iMessage with wsproxy

* Restructure wsproxy service defs and nginx config

* Fix linter errors

* Apply suggestions from code review

Co-authored-by: Slavi Pantaleev <slavi@devture.com>

* Fix comments for documentation, volumes and ports

* Correct mount syntax

* Complete network and traefik support for wsproxy

* Remove wsproxy data_path

* Fix wsproxy service definitions

* Actually include syncproxy service

* Remove wsproxy PathPrefix, it needs a subdomain

There's no setting in the iMessage bridge that allows a path.
Also don't bind port by default, wsproxy has no TLS.
Syncproxy should never expose a port, it's only internal.

---------

Co-authored-by: hanthor <jreilly112@gmail.com>
Co-authored-by: Miguel Alatzar <miguel@natrx.io>
Co-authored-by: Shreyas Ajjarapu <github.tzarina@aleeas.com>
Co-authored-by: Slavi Pantaleev <slavi@devture.com>
2023-08-23 15:05:32 +03:00
Aine
e7e81f7828
update nginx 1.25.1 -> 1.25.2 2023-08-16 10:09:30 +03:00
Michael Hollister
78bd1dbd1b Added matrix-media-repo role 2023-07-12 01:09:27 -05:00
Aine
9315ba571d
Update nginx 1.25.1 2023-06-16 16:15:02 +03:00
Aine
ed5cf04306
nginx: fix base domain configuration to allow serving custom content 2023-05-03 19:27:57 +00:00
Slavi Pantaleev
1d00d15482 Switch to exported Jitsi role 2023-04-03 08:53:46 +03:00
Slavi Pantaleev
dddfee16bc Fix all 300+ ansible-lint-reported errors 2023-03-07 17:28:15 +02:00
Slavi Pantaleev
10b5350370 Add Traefik support to Go-NEB bot
Completely untested.
2023-03-03 10:40:45 +02:00
Slavi Pantaleev
124fbeda04 Switch to using an external Etherpad role
This new role also adds native Traefik support and support for other
(non-`amd64`) architectures via self-building.
2023-03-02 22:50:13 +02:00
Slavi Pantaleev
6fe739a2cb Remove unnecessary variable 2023-02-27 18:32:22 +02:00
Slavi Pantaleev
7716c306f1 Split Traefik rules for Matrix Client and Matrix Federation APIs
This helps people who run federation on another domain (etc.).
They should now easily be able to add a custom rule for federation traffic.
2023-02-27 17:28:33 +02:00
Slavi Pantaleev
058a54fd05 Add native Traefik support to Dimension 2023-02-26 23:06:36 +02:00
Slavi Pantaleev
d20ff688db Add native Traefik support to Sygnal 2023-02-26 11:03:42 +02:00
Slavi Pantaleev
725b2beed7 Add native Traefik support to Buscarron 2023-02-25 15:50:48 +02:00
Slavi Pantaleev
233e253264 Add native Traefik support to rageshake 2023-02-25 13:46:42 +02:00
Benjamin Kampmann
40f037b36d Add rageshake server 2023-02-24 16:55:49 +01:00
Slavi Pantaleev
964aa0e84d Switch to using an external Ntfy role
The newly extracted role also has native Traefik support,
so we no longer need to rely on `matrix-nginx-proxy` for
reverse-proxying to Ntfy.

The new role uses port `80` inside the container (not `8080`, like
before), because that's the default assumption of the officially
published container image. Using a custom port (like `8080`), means the
default healthcheck command (which hardcodes port `80`) doesn't work.
Instead of fiddling to override the healthcheck command, we've decided
to stick to the default port instead. This only affects the
inside-the-container port, not any external ports.

The new role also supports adding the network ranges of the container's
multiple additional networks as "exempt hosts". Previously, only one
network's address range was added to "exempt hosts".
2023-02-17 09:54:33 +02:00
Slavi Pantaleev
1006b8d899 Replace matrix-grafana with an external role 2023-02-15 10:32:24 +02:00
Slavi Pantaleev
c85d48c45c Remove Traefik labels for Hydrogen & Cinny from matrix-nginx-proxy
Related to 6a52be7987 and 28e7ef9c71f02
2023-02-14 22:46:34 +02:00
Slavi Pantaleev
e51e4eec09 Add (native) Traefik support to matrix-client-element
Previously, it had to go through matrix-nginx-proxy.
It's exposed to Traefik directly via container labels now
2023-02-13 19:03:20 +02:00
Slavi Pantaleev
f2ed5e4b04 Delete /matrix/nginx-proxy/conf.d/matrix-client-element.conf if matrix_nginx_proxy_proxy_element_enabled not enabled 2023-02-13 19:03:20 +02:00
Slavi Pantaleev
06ccd71edc Merge branch 'master' into traefik 2023-02-10 14:37:59 +02:00
Slavi Pantaleev
01ccec2dbe Merge branch 'master' into pr-jitsi-matrix-authentication 2023-02-10 14:12:47 +02:00
Slavi Pantaleev
2b9061a5d3 Add support for reverse-proxying the base domain via Traefik 2023-02-07 11:02:02 +02:00
Slavi Pantaleev
8155f780e5 Add support for reverse-proxying Matric (Client & Federation) via Traefik 2023-02-06 13:08:11 +02:00
Slavi Pantaleev
f983604695 Initial work on Traefik support
This gets us started on adding a Traefik role and hooking Traefik:

- directly to services which support Traefik - we only have a few of
  these right now, but the list will grow

- to matrix-nginx-proxy for most services that integrate with
  matrix-nginx-proxy right now

Traefik usage should be disabled by default for now and nothing should
change for people just yet.

Enabling these experiments requires additional configuration like this:

```yaml
devture_traefik_ssl_email_address: '.....'

matrix_playbook_traefik_role_enabled: true
matrix_playbook_traefik_labels_enabled: true

matrix_ssl_retrieval_method: none

matrix_nginx_proxy_https_enabled: false

matrix_nginx_proxy_container_http_host_bind_port: ''
matrix_nginx_proxy_container_federation_host_bind_port: ''

matrix_nginx_proxy_trust_forwarded_proto: true

matrix_nginx_proxy_x_forwarded_for: '$proxy_add_x_forwarded_for'

matrix_coturn_enabled: false
```

What currently works is:
reverse-proxying for all nginx-proxy based services **except** for the Matrix homeserver
(both Client-Server an Federation traffic for the homeserver don't work yet)
2023-02-06 10:34:51 +02:00
Slavi Pantaleev
4d6a8d049d Add matrix_nginx_proxy_container_network variable 2023-02-06 08:48:11 +02:00
Slavi Pantaleev
e018663ba4 Attach ma1sd/nginx-proxy/synapse-reverse-proxy-companion to additional networks in a better way
Switching from doing "post-start" loop hacks to running the container
in 3 steps: `create` + potentially connect to additional networks + `start`.
This way, the container would be connected to all its networks even at
the very beginning of its life.
2023-02-06 08:38:43 +02:00
jakicoll
42e4e50f5b Matrix Authentication Support for Jitsi
This extends the collection with support for seamless authentication at the Jitsi server using Matrix OpenID.

1. New role for installing the [Matrix User Verification Service](https://github.com/matrix-org/matrix-user-verification-service)
2. Changes to Jitsi role: Installing Jitsi Prosody Mods and configuring Jitsi Auth
3. Changes to Jitsi and nginx-proxy roles: Serving .well-known/element/jitsi from jitsi.DOMAIN
4. We updated the Jitsi documentation on authentication and added documentation for the user verification service.
2023-01-04 14:27:16 +01:00
Slavi Pantaleev
f2e68469cb Upgrade nginx (1.23.2 -> 1.23.3) 2022-12-19 12:32:43 +02:00
ikkemaniac
8ebf18a885
add prometheus-nginxlog-exporter role (#2315)
* add prometheus-nginxlog-exporter role

* Rename matrix_prometheus_nginxlog_exporter_container_url to matrix_prometheus_nginxlog_exporter_container_hostname

* avoid referencing variables from other roles, handover info using group_vars/matrix_servers

* fix: stop service when uninstalling

fix: typo

move available arch's into a var

fix: text

* fix: prometheus enabled condition

Co-authored-by: ikkemaniac <ikkemaniac@localhost>
2022-12-07 16:58:36 +02:00
Slavi Pantaleev
5b26647127 Upgrade Certbot (v1.31.0 -> v2.0.0) and switch to new default key type (ecdsa)
More details about the new key type can be found here:
https://eff-certbot.readthedocs.io/en/stable/using.html#rsa-and-ecdsa-keys

Existing RSA-based keys will continue to renew as RSA until manual
action is taken. Example from the documentation above:
> certbot renew --key-type ecdsa --cert-name example.com --force-renewal

In the future, we may add a command which does this automatically for
all domains.
2022-11-28 09:24:25 +02:00
Slavi Pantaleev
910cd9adf0 Replace import_role calls with include_role calls 2022-11-27 11:27:01 +02:00
Slavi Pantaleev
2688e8bfc3 Optimize initial installation by not reloading systemd after each .service install
We expect `--tags=start` to handle systemd reloading, so we don't need
to do it manually each time we install/uninstall a .service file.
2022-11-27 10:02:45 +02:00
Slavi Pantaleev
707e909b9b /usr/local/bin/matrix-ssl-lets-encrypt-certificates-renew -> /matrix/ssl/bin/lets-encrypt-certificates-renew 2022-11-27 09:53:23 +02:00
Slavi Pantaleev
a04f6f4e3d Optimize uninstall tasks a bit
- forego removing Docker images - it's not effective anyway, because it
  only removes the last version.. which is a drop in the bucket, usually

- do not reload systemd - it's none of our business. `--tags=start`,
  etc., handle this

- combine all uninstall tasks under a single block, which only runs if
  we detect traces (a leftover systemd .service file) of the component.
  If no such .service is detected, we skip them all. This may lead to
  incorect cleanup in rare cases, but is good enough for the most part.
2022-11-25 17:28:57 +02:00
Slavi Pantaleev
61f67d8f0a Add install-* tags for quicker runs 2022-11-25 16:02:51 +02:00