feat: add automatic creation of reverse-proxy routing

meta: move inventory structure to be more usable
meta: add own inventory, add vault-unlock with GPG
2022-04-14 13:31:50 +02:00 · 2022-04-14 13:31:49 +02:00 · 2022-04-14 13:31:48 +02:00 · 2022-04-14 08:52:37 +03:00 · 2022-04-13 10:23:18 +03:00 · 2022-04-13 08:58:19 +02:00
58 changed files with 759 additions and 19 deletions
--- a/.gitignore
+++ b/.gitignore
@ -1,7 +1,3 @@
-/inventory/*
-!/inventory/.gitkeep
-!/inventory/host_vars/.gitkeep
-!/inventory/scripts
 /roles/*/files/scratchpad
 .DS_Store
 .python-version
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@ -1,3 +1,16 @@
+# 2022-04-14
+
+## (Compatibility Break) Changes to `docker-src` permissions necessitating manual action
+
+Users who build container images from source will need to manually correct file permissions of some directories on the server.
+
+When self-building, the playbook used to `git clone` repositories (into `/matrix/SERVICE/docker-src`) using the `root` user, but now uses `matrix` instead to work around [the following issue with git 2.35.2](https://github.com/spantaleev/matrix-docker-ansible-deploy/issues/1749).
+
+If you're on a non-`amd64` architecture (that is, you're overriding `matrix_architecture` in your `vars.yml` file) or you have enabled self-building for some service (e.g. `matrix_*_self_build: true`), you're certainly building some container images from source and have `docker-src` directories with mixed permissions lying around in various `/matrix/SERVICE` directories.
+
+The playbook *could* correct these permissions automatically, but that requires additional Ansible tasks in some ~45 different places - something that takes considerable effort. So we ask users observing errors related to `docker-src` directories to correct the problem manually by **running this command on the Matrix server** (which deletes all `/matrix/*/docker-src` directories): `find /matrix -maxdepth 2 -name 'docker-src' | xargs rm -rf`
+
+
 # 2022-03-17

 ## (Compatibility Break) ma1sd identity server no longer installed by default
--- a/ansible.cfg
+++ b/ansible.cfg
@ -1,6 +1,11 @@
 [defaults]
+
+vault_password_file = gpg/open_vault.sh
+
 retry_files_enabled = False
 stdout_callback = yaml

+inventory = inventory/hosts
+
 [connection]
 pipelining = True
--- a/docs/configuring-playbook-backup-borg.md
+++ b/docs/configuring-playbook-backup-borg.md
@ -4,17 +4,23 @@ The playbook can install and configure [borgbackup](https://www.borgbackup.org/)
 BorgBackup is a deduplicating backup program with optional compression and encryption.
 That means your daily incremental backups can be stored in a fraction of the space and is safe whether you store it at home or on a cloud service.

-The backup will run based on `matrix_backup_borg_schedule` var (systemd timer calendar), default: 4am every day
+You will need a remote server where borg will store the backups. There are hosted, borg compatible solutions available, such as [BorgBase](https://www.borgbase.com).
+
+The backup will run based on `matrix_backup_borg_schedule` var (systemd timer calendar), default: 4am every day.

 ## Prerequisites

-1. Create ssh key on any machine:
+1. Create a new SSH key:

 ```bash
 ssh-keygen -t ed25519 -N '' -f matrix-borg-backup -C matrix
 ```

-2. Add public part of that ssh key to your borg provider / server:
+This can be done on any machine and you don't need to place the key in the `.ssh` folder. It will be added to the Ansible config later.
+
+2. Add the **public** part of this SSH key (the `matrix-borg-backup.pub` file) to your borg provider/server:
+
+If you plan to use a hosted solution, follow their instructions. If you have your own server, copy the key over:

 ```bash
 # example to append the new PUBKEY contents, where:
@ -39,13 +45,15 @@ matrix_backup_borg_ssh_key_private: |

 where:

-* USER - ssh user of a provider / server
-* HOST - ssh host of a provider / server
+* USER - SSH user of a provider/server
+* HOST - SSH host of a provider/server
 * REPO - borg repository name, it will be initialized on backup start, eg: `matrix`
-* PASSPHRASE - super-secret borg passphrase, you may generate it with `pwgen -s 64 1` or use any password manager
-* PRIVATE KEY - the content of the public part of the ssh key you created before
+* PASSPHRASE - passphrase used for encrypting backups, you may generate it with `pwgen -s 64 1` or use any password manager
+* PRIVATE KEY - the content of the **private** part of the SSH key you created before

-Check the `roles/matrix-backup-borg/defaults/main.yml` for the full list of available options
+`matrix_backup_borg_location_source_directories` defines the list of directories to back up: it's set to `{{ matrix_base_data_path }}` by default, which is the base directory for every service's data, such as Synapse, Postgres and the bridges. You might want to exclude certain directories or file patterns from the backup using the `matrix_backup_borg_location_exclude_patterns` variable.
+
+Check the `roles/matrix-backup-borg/defaults/main.yml` file for the full list of available options.

 ## Installing

--- a/gpg/open_vault.sh
+++ b/gpg/open_vault.sh
@ -0,0 +1,5 @@
+#!/bin/bash
+
+set -e -u
+
+gpg2 --batch --use-agent --decrypt $(dirname $0)/vault_passphrase.gpg 2>/dev/null
--- a/gpg/vault_passphrase.gpg
+++ b/gpg/vault_passphrase.gpg
@ -0,0 +1,18 @@
+-----BEGIN PGP MESSAGE-----
+
+hQIMAxEs7W/4x4lxARAAssinIzR2rGs+Qkm0Q2tRdSXSXRx3OhH+2T5p0Rz3YkqU
+iyiUtyT/Ll7RMUAlAEDZITvirXe4ZZImDcxQegEzFgO7BowQYJDRdhaRmLKZpiuQ
+foRnJAAR12sf49arjJjaBQb91ViOp5MkxAtXiiqWyXwSSII+cV88flMq143cFmfC
+C5OdIQd3SqrbFhGRTjUzoIMqnJH8xksjwph9GS811dY14rQv5X1Ybt5zehMJ7/m/
+luLNg2zgQgYOUxcovddCVMI54ThXyDubDox/5xLvVjyVOFHgwC/VLn+QXHuPY/r5
+rVzz/30eq0uOLKD3LnDBQskCWRVWGC2ulKaZtlylBq6KRzIM6c6+VPSHCjoFyES
+RRpRHeIXGLs31eLkr8dc+VNbPKpMsjm/E/4ZVE2JBpy7S/kh1XYVQxT6ahDKT1tD
+4YN9O0JyNXzjiyNaTTLwNGh5+ICEd3ZCfa4O/og2LySGPOw6mX8ukgP029LHVp6+
+0tRwSWiIM3US/NIVGA+o9e9I/I5Bp/cnzJgd7faUIlzcVPP+euCbo4GsYWpX3Nca
+eRcr7AVY3wwuZtl7/s8KbQKk0ulLxS4Lo2XmdpQl8CPGwASdbMf/H8B256+xiUQ3
+ml400ZaCC7Loeduwl1ez1H/dFFzmpUziaxxtWW4aFtOUYhGeSCTu6ZIgxVq3eBnS
+jAGv8bt+0Xnrpih3mZWM92cw2VKfzYD9WG+dCB4DtZMKhl1ub2bkeTC/B9F+QuP6
+anlonYHs2wmPXzjcx8ajonbYrYXanoNRHDId6OqVAbjYqbua6TG6H9LUFweIj1RV
+yhUPejzhA8xEB0nUcKJZKLvuqvwPbr06GODnAKY5TQ4yILMAnBx0pNzfQNzo
+=Cecg
+-----END PGP MESSAGE-----
--- a/inventory/host_vars/matrix.finallycoffee.eu/vars.yml
+++ b/inventory/host_vars/matrix.finallycoffee.eu/vars.yml
@ -0,0 +1,339 @@
+#
+# General config
+# Domain of the matrix server and SSL config
+#
+matrix_domain: finallycoffee.eu
+matrix_ssl_retrieval_method: none
+matrix_nginx_proxy_enabled: false
+matrix_base_data_path: "{{ vault_matrix_base_data_path }}"
+matrix_server_fqn_element: "chat.{{ matrix_domain }}"
+
+web_user: "web"
+revproxy_autoload_dir: "/vault/services/web/sites.d"
+
+#matrix_client_element_version: v1.8.4
+#matrix_synapse_docker_image: "{{ matrix_synapse_docker_image_name_prefix }}matrixdotorg/synapse:v1.37.1"
+#matrix_mautrix_telegram_version: v0.10.0
+
+#
+# General Synapse config
+#
+matrix_postgres_connection_password: "{{ vault_matrix_postgres_connection_password }}"
+# A secret used to protect access keys issued by the server.
+matrix_homeserver_generic_secret_key: "{{ vault_homeserver_generic_secret_key }}"
+# Make synapse accept larger media aswell
+matrix_synapse_max_upload_size_mb: 100
+# Enable metrics at (default) :9100/_synapse/metrics
+matrix_synapse_metrics_enabled: true
+matrix_synapse_enable_group_creation: true
+matrix_synapse_turn_shared_secret: "{{ vault_matrix_coturn_turn_static_auth_secret }}"
+matrix_synapse_turn_uris:
+  - "turns:voip.matrix.finallycoffee.eu?transport=udp"
+  - "turns:voip.matrix.finallycoffee.eu?transport=tcp"
+# Auto-join all users into those rooms
+matrix_synapse_auto_join_rooms:
+  - "#welcome:finallycoffee.eu"
+  - "#announcements:finallycoffee.eu"
+
+## Synapse rate limits
+matrix_synapse_rc_federation:
+  window_size: 1000
+  sleep_limit: 25
+  sleep_delay: 500
+  reject_limit: 50
+  concurrent: 5
+matrix_synapse_rc_message:
+  per_second: 0.5
+  burst_count: 25
+
+## Synapse cache tuning
+matrix_synapse_caches_global_factor: 0.7
+matrix_synapse_event_cache_size: "200K"
+
+## Synapse workers
+matrix_synapse_workers_enabled: true
+matrix_synapse_workers_preset: "little-federation-helper"
+matrix_synapse_workers_generic_worker_client_server_count: 0
+matrix_synapse_workers_media_repository_workers_count: 0
+matrix_synapse_workers_federation_sender_workers_count: 1
+matrix_synapse_workers_pusher_workers_count: 0
+matrix_synapse_workers_appservice_workers_count: 1
+
+# Static secret auth for matrix-synapse-shared-secret-auth
+matrix_synapse_ext_password_provider_shared_secret_auth_enabled: true
+matrix_synapse_ext_password_provider_shared_secret_auth_shared_secret: "{{ vault_matrix_synapse_ext_password_provider_shared_secret_auth_shared_secret }}"
+matrix_synapse_ext_password_provider_rest_auth_enabled: true
+matrix_synapse_ext_password_provider_rest_auth_endpoint: "http://matrix-ma1sd:8090"
+matrix_synapse_ext_password_provider_rest_auth_registration_enforce_lowercase: false
+matrix_synapse_ext_password_provider_rest_auth_registration_profile_name_autofill: true
+matrix_synapse_ext_password_provider_rest_auth_login_profile_name_autofill: false
+
+# Enable experimental spaces support
+matrix_synapse_configuration_extension_yaml: |
+  experimental_features:
+    spaces_enabled: true
+
+#
+# synapse-admin tool
+#
+matrix_synapse_admin_enabled: true
+matrix_synapse_admin_container_http_host_bind_port: 8985
+
+
+#
+# VoIP / CoTURN config
+#
+# A shared secret (between Synapse and Coturn) used for authentication.
+matrix_coturn_turn_static_auth_secret: "{{ vault_matrix_coturn_turn_static_auth_secret }}"
+# Disable coturn, as we use own instance
+matrix_coturn_enabled: false
+
+
+#
+# dimension (integration manager) config
+#
+matrix_dimension_enabled: true
+matrix_dimension_admins: "{{ vault_matrix_dimension_admins }}"
+matrix_server_fqn_dimension: "dimension.matrix.{{ matrix_domain }}"
+matrix_dimension_access_token: "{{ vault_matrix_dimension_access_token }}"
+matrix_dimension_configuration_extension_yaml: |
+    telegram:
+        botToken: "{{ vault_matrix_dimension_configuration_telegram_bot_token }}"
+
+
+#
+# mautrix-whatsapp config
+#
+matrix_mautrix_whatsapp_enabled: true
+matrix_mautrix_whatsapp_container_http_monitoring_host_bind_port: 9402
+matrix_mautrix_whatsapp_container_extra_arguments:
+  - "-p 127.0.0.1:{{ matrix_mautrix_whatsapp_container_http_monitoring_host_bind_port }}:{{ matrix_mautrix_whatsapp_container_http_monitoring_host_bind_port }}"
+matrix_mautrix_whatsapp_configuration_extension_yaml: |
+    bridge:
+        displayname_template: "{% raw %}{{.Name}} ({{if .Notify}}{{.Notify}}{{else}}{{.Jid}}{{end}}) (via WhatsApp){% endraw %}"
+        max_connection_attempts: 5
+        connection_timeout: 30
+        contact_wait_delay: 5
+        private_chat_portal_meta: true
+        login_shared_secret: "{{ matrix_synapse_ext_password_provider_shared_secret_auth_shared_secret }}"
+    logging:
+        print_level: info
+    metrics:
+        enabled: true
+        listen: 0.0.0.0:{{ matrix_mautrix_whatsapp_container_http_monitoring_host_bind_port }}
+    whatsapp:
+        os_name: Linux mautrix-whatsapp
+        browser_name: Chrome
+
+
+#
+# mautrix-telegram config
+#
+matrix_mautrix_telegram_enabled: true
+matrix_mautrix_telegram_api_id: "{{ vault_matrix_mautrix_telegram_api_id }}"
+matrix_mautrix_telegram_api_hash: "{{ vault_matrix_mautrix_telegram_api_hash }}"
+matrix_mautrix_telegram_public_endpoint: '/bridge/telegram'
+matrix_mautrix_telegram_container_http_monitoring_host_bind_port: 9401
+matrix_mautrix_telegram_container_http_host_bind_port_public: 8980
+matrix_mautrix_telegram_container_extra_arguments:
+  - "-p 127.0.0.1:{{ matrix_mautrix_telegram_container_http_monitoring_host_bind_port }}:{{ matrix_mautrix_telegram_container_http_monitoring_host_bind_port }}"
+  - "-p 127.0.0.1:{{ matrix_mautrix_telegram_container_http_host_bind_port_public }}:80"
+matrix_mautrix_telegram_configuration_extension_yaml: |
+    bridge:
+        displayname_template: "{displayname} (via Telegram)"
+        parallel_file_transfer: false
+        inline_images: false
+        image_as_file_size: 20
+        delivery_receipts: true
+        login_shared_secret: "{{ matrix_synapse_ext_password_provider_shared_secret_auth_shared_secret }}"
+        animated_sticker:
+            target: webm
+        encryption:
+            allow: true
+            default: true
+        permissions:
+            "@transcaffeine:finallycoffee.eu": "admin"
+            "gruenhage.xyz": "full"
+    logging:
+        root:
+            level: INFO
+    metrics:
+        enabled: true
+        listen_port: {{ matrix_mautrix_telegram_container_http_monitoring_host_bind_port }}
+#        permissions: "{{ vault_matrix_mautrix_telegram_permission_map | from_yaml }}"
+
+
+#
+# mautrix-signal config
+#
+matrix_mautrix_signal_enabled: true
+matrix_mautrix_signal_container_http_monitoring_host_bind_port: 9408
+matrix_mautrix_signal_container_extra_arguments:
+    - "-p 127.0.0.1:{{ matrix_mautrix_signal_container_http_monitoring_host_bind_port }}:{{ matrix_mautrix_signal_container_http_monitoring_host_bind_port }}"
+matrix_mautrix_signal_configuration_extension_yaml: |
+    bridge:
+        displayname_template: "{displayname} (via Signal)"
+        community_id: "+signal:finallycoffee.eu"
+        encryption:
+            allow: true
+            default: true
+            key_sharing:
+                allow: true
+                require_verification: false
+        delivery_receipts: true
+    logging:
+        root:
+            level: INFO
+    metrics:
+        enabled: true
+        listen_port: {{ matrix_mautrix_signal_container_http_monitoring_host_bind_port }}
+
+
+#
+# mx-puppet-instagram configuration
+#
+matrix_mx_puppet_instagram_enabled: true
+matrix_mx_puppet_instagram_container_http_monitoring_host_bind_port: 9403
+matrix_mx_puppet_instagram_container_extra_arguments:
+  - "-p 127.0.0.1:{{ matrix_mx_puppet_instagram_container_http_monitoring_host_bind_port }}:{{ matrix_mx_puppet_instagram_container_http_monitoring_host_bind_port }}"
+matrix_mx_puppet_instagram_configuration_extension_yaml: |
+    bridge:
+        enableGroupSync: true
+        avatarUrl: mxc://finallycoffee.eu/acmiSAinuHDOULofFFeolTvr
+    metrics:
+        enabled: true
+        port: {{ matrix_mx_puppet_instagram_container_http_monitoring_host_bind_port }}
+        path: /metrics
+    presence:
+        enabled: true
+        interval: 3000
+
+
+#
+# mx-puppet-skype configuration
+#
+matrix_mx_puppet_skype_enabled: true
+matrix_mx_puppet_skype_container_http_monitoring_host_bind_port: 9405
+matrix_mx_puppet_skype_container_extra_arguments:
+  - "-p 127.0.0.1:{{ matrix_mx_puppet_skype_container_http_monitoring_host_bind_port }}:{{ matrix_mx_puppet_skype_container_http_monitoring_host_bind_port }}"
+matrix_mx_puppet_skype_configuration_extension_yaml: |
+    bridge:
+        enableGroupSync: true
+        avatarUrl: mxc://finallycoffee.eu/jjXDuFqtpFOBOnywoHgzTuYt
+    metrics:
+        enabled: true
+        port: {{ matrix_mx_puppet_skype_container_http_monitoring_host_bind_port }}
+        path: /metrics
+
+
+#
+# mx-puppet-discord configuration
+#
+matrix_mx_puppet_discord_enabled: true
+matrix_mx_puppet_discord_client_id: "{{ vault_matrix_mx_puppet_discord_client_id }}"
+matrix_mx_puppet_discord_client_secret: "{{ vault_matrix_mx_puppet_discord_client_secret }}"
+matrix_mx_puppet_discord_container_http_monitoring_host_bind_port: 9404
+matrix_mx_puppet_discord_container_extra_arguments:
+  - "-p 127.0.0.1:{{ matrix_mx_puppet_discord_container_http_monitoring_host_bind_port }}:{{ matrix_mx_puppet_discord_container_http_monitoring_host_bind_port }}"
+matrix_mx_puppet_discord_configuration_extension_yaml: |
+    bridge:
+        enableGroupSync: true
+        avatarUrl: mxc://finallycoffee.eu/BxcAAhjXmglMbtthStEHtCzd
+    metrics:
+        enabled: true
+        port: {{ matrix_mx_puppet_discord_container_http_monitoring_host_bind_port }}
+        path: /metrics
+    limits:
+        maxAutojoinUsers: 500
+        roomUserAutojoinDelay: 50
+    presence:
+        enabled: true
+        interval: 3000
+
+
+#
+# mx-puppet-slack configuration
+#
+matrix_mx_puppet_slack_enabled: true
+matrix_mx_puppet_slack_client_id: "{{ vault_matrix_mx_puppet_slack_client_id }}"
+matrix_mx_puppet_slack_client_secret: "{{ vault_matrix_mx_puppet_slack_client_secret }}"
+matrix_mx_puppet_slack_redirect_path: '/bridge/slack/oauth'
+matrix_mx_puppet_slack_container_http_auth_host_bind_port: 8981
+matrix_mx_puppet_slack_container_http_monitoring_host_bind_port: 9406
+matrix_mx_puppet_slack_container_extra_arguments:
+  - "-p 127.0.0.1:{{ matrix_mx_puppet_slack_container_http_monitoring_host_bind_port }}:{{ matrix_mx_puppet_slack_container_http_monitoring_host_bind_port }}"
+  - "-p 127.0.0.1:{{ matrix_mx_puppet_slack_container_http_auth_host_bind_port }}:8008"
+matrix_mx_puppet_slack_configuration_extension_yaml: |
+    bridge:
+        enableGroupSync: true
+    metrics:
+        enabled: true
+        port: {{ matrix_mx_puppet_slack_container_http_monitoring_host_bind_port }}
+        path: /metrics
+    limits:
+        maxAutojoinUsers: 500
+        roomUserAutojoinDelay: 50
+    presence:
+        enabled: true
+        interval: 3000
+
+
+#
+# Element web configuration
+#
+# Branding config
+matrix_client_element_brand: "Chat"
+matrix_client_element_default_theme: "dark"
+matrix_client_element_themes_enabled: true
+matrix_client_element_welcome_headline: "Welcome to chat.finallycoffee.eu"
+matrix_client_element_welcome_text: |
+    Decentralised, encrypted chat &amp; collaboration,<br />
+    hosted on finallycoffee.eu, powered by element.io &amp;
+    <a href="https://matrix.org" target="_blank" rel="noreferrer noopener">
+      <img width="79" height="34" alt="[matrix]" style="padding-left: 1px;vertical-align: middle" src="welcome/images/matrix.svg" />
+    </a>
+matrix_client_element_welcome_logo: "welcome/images/logo.png"
+matrix_client_element_welcome_logo_link: "https://{{ matrix_domain }}"
+matrix_client_element_branding_authHeaderLogoUrl: "welcome/images/logo.png"
+matrix_client_element_branding_welcomeBackgroundUrl: "welcome/images/background.jpg"
+matrix_client_element_container_extra_arguments:
+  - "-v {{ matrix_client_element_data_path }}/background.jpg:/app/{{ matrix_client_element_branding_welcomeBackgroundUrl }}:ro"
+  - "-v {{ matrix_client_element_data_path }}/logo.png:/app/{{ matrix_client_element_branding_authHeaderLogoUrl }}:ro"
+# Integration and capabilites config
+matrix_client_element_integrations_ui_url: "https://{{ matrix_server_fqn_dimension }}/element"
+matrix_client_element_integrations_rest_url: "https://{{ matrix_server_fqn_dimension }}/api/v1/scalar"
+matrix_client_element_integrations_widgets_urls:
+  - "https://{{ matrix_server_fqn_dimension }}/widgets"
+  - "https://scalar.vector.im/api"
+matrix_client_element_integrations_jitsi_widget_url: "https://{{ matrix_server_fqn_dimension }}/widgets/jitsi"
+matrix_client_element_disable_custom_urls: false
+matrix_client_element_roomdir_servers:
+  - "matrix.org"
+  - "finallycoffee.eu"
+  - "entropia.de"
+matrix_client_element_enable_presence_by_hs_url:
+  https://matrix.org: false
+
+
+# Matrix ma1sd extended configuration
+matrix_ma1sd_configuration_extension_yaml: |
+    hashing:
+      enabled: true
+      pepperLength: 20
+      rotationPolicy: per_requests
+      requests: 10
+      hashStorageType: sql
+      algorithms:
+          - none
+          - sha256
+
+
+# Matrix mail notification relay setup
+matrix_mailer_enabled: true
+matrix_mailer_sender_address: "Matrix on finallycoffee.eu <system-matrix@{{ matrix_domain }}>"
+matrix_mailer_relay_use: true
+matrix_mailer_relay_host_name: "{{ vault_matrix_mailer_relay_host_name }}"
+matrix_mailer_relay_host_port: 587
+matrix_mailer_relay_auth: true
+matrix_mailer_relay_auth_username: "{{ vault_matrix_mailer_relay_auth_username }}"
+matrix_mailer_relay_auth_password: "{{ vault_matrix_mailer_relay_auth_password }}"
--- a/inventory/host_vars/matrix.finallycoffee.eu/vault.yml
+++ b/inventory/host_vars/matrix.finallycoffee.eu/vault.yml
@ -0,0 +1,100 @@
+$ANSIBLE_VAULT;1.1;AES256
+39366364363633336238333130353832663162393038633665396333343732353964333363666539
+6562346632343235623835643735386434316666393234360a383634616537393134613631383836
+61333835363666623033306166376232303930306433343366373463653234623736643633383734
+3330333665383539650a383132353032386230393031626361343764323034386230363066306331
+34646236336262623435633566363033613737373064616266336237343233663066396163373034
+62303765353066653737366539626461636531636438323932333134363136363134646164646531
+63656638666233313437663261396665653736373164323433306435323336633938313164646264
+33653661633965363833393031616463633761356234633630643562306366653133366637346166
+38636433343736343461613731623538633361363934343764326466313261353633646230353065
+37366134303164356433333961346663313963626165323966656536313532376162326565383539
+65363333633964323838663461373666353665643236623839646664653661613838353239613137
+39353061323131306365656261343630313665356165623064616436653566373663343733316237
+34393666383465323463313838393465643830373632373938633763666636346539666233303265
+38353337633833373331356663633936326334366337393135653030333531613565643666633038
+64393862303765366632393137313432376563353335353231323464633637343334346634306534
+35613330373336633031376263306466306437656635396133613335386130346163663438386136
+61646437343938663431343736363564376238316666373531616231366132643864346538363866
+35396433366137356162313963666134383134306462313336613735386639363936326131383939
+66623833643433663039623837623133303336666233623935313438366136353332313165333936
+31386632336535383533646639636164313331346630633366383739623261366465656632393062
+63373332623738303364623437666531396331646666336230353333366261653438363861656466
+39333762633037383336393164616563396564383232636533363864636230616664303330323932
+66666234633362346132303932643464366466323535303835363430333737666661373534333934
+61393362616438626636383564613335363634626231663234616438343464383461303632363033
+39336362396339316661323662393665383031643931626333646335643335353661653939363538
+38666561313539613566386132336630643237333432656236356132616230663561343665353938
+33366663353834356434366335373265373439363430636533303933656264366338623232613435
+35356662383232386137313064313363303861326635333435393737643663336534363234623430
+32376432353330613666396337303935376366613564353039396164383361616337656535346166
+34396635356266326461613135303639643935363261396363636338636564643838313262326266
+31663139343336376233303637373864363835313839326433656235616332333134306139623239
+37636639356263646437373362333931613262363363313462666534643765313139386461623731
+33376635653133353033333733613464396632636634313063326363313030376632643863336237
+61636638353237313764313435626463633964643665313536326235343639663137373436303564
+30636232626137376339303238653664346538356430306238633037366332316263623666373062
+63646533646131303466653637346463613237323161313265613834383634626237323563653733
+38656435303264346663663465333966376631666530333833353233376263336436613065366362
+36366263343438393132326661623031316663663231663464383732343064383234616636306530
+66613634626362316533303034393063666632343262613431613635663866636433623535363238
+30643933613731363236346234336662613633323831633437613435326465383530653765616262
+63373538396364316563343365303134373466663639386137663564356532353531343636613135
+63316463353264316164306566326462333732316431643939626161346530636638636662303037
+34346461313961613063336332333934383363373335616636363661396362613661383762663866
+64303834636264376461396266663763336665356561376161333136336638646363313133353161
+31643061623833623239373432633537663664636334623534326639616633616361333834366131
+30376361656238353332656666316637643133623433333861653265636266376639666135383638
+37363337326231656530363536393737383565666266306532626361633633353539363866376534
+61303737326632303762626666306134343837376566343035386663613336626332383035383035
+37633462373066373062313862323766316362393832666466396637363562353865303366323062
+39346332383966313437646138623364656234663066663639663138626163656433363038323166
+65613862386665643438323061323763306635666162303366323131363436633335356332393366
+63373966383132303434633835333438333337303664346335643066623839343835643364306561
+34643336346564363462396330643263653931376664386335313433376332653832323437376135
+35383231386133363236653334393433306638303131323064343931623538323130343666653061
+36353536383632333964343730346265626433303131346531303133663832363036333261386237
+30363361356265356139323761623563396565336137333733656431636531333234323061343862
+33623935346663333735613661363234646234356331323636386637343661373363363261646231
+33643233343235323230393933616664623166666266333862323631653835666135303233653635
+63373061656163353762636531613632366638383366303864343132376162643963366564363563
+61336338613935613532636165383463633866633036393533313433643562313737383431353163
+37623165373933376236393931363939633963666636303136373065376635623761346537643530
+35363464313630376233633863306238616138666464316534363332333937343362343233346431
+34643032323934353939666364323239653932363735373061633434653062326336353239633261
+38306237336266663038656534393664646138343038323335633064616431386666613739326630
+34383963666534313530376331366238343836303036306336343533666332386163643033643138
+33336333333338353733383165306139623964303035653439623131633566356136386431613135
+63616462386639303230343866346631346532353531373132613433363239646330653666633532
+65393766333238383531313132633537633833363335303630376239396565373730646331313633
+30383861303739343265623934643635633361623262356433323035393062353630346430646262
+63303434353038646361353661616339313937323336303566303536366163623362356332383862
+37326333393761633732653264646333653439363039323238383361336233323232613336303464
+34393635633131313135313665363161306466643364393734346264633030373234306466653862
+32336163666435636162343465386633653863363533616339636531306130383331376563393533
+65366136626662343065383164646665613035393636373565346235656439303933343563366339
+36643838393033353033396535613331303031646162316361613564323163633434633861356135
+62343461616335323565636633383962316531316362396165366533346166336163623232366261
+39376230376562626135346333326437373733373266393236383435343562653034313133376236
+61666138346562613330633630373837653465393233613261353937336666646231366666393335
+35393463333936323664323831396639333462626238613164616435363664643438653763623431
+32663237363134353061373563396535653565636431366565386337653863316333343738343432
+62303132636338303462313439376535363063333833363632613832303436353834376561333330
+66633632383135646263626333643230343630326539663762633934316261633062663732373932
+30306438386263626335373838343236643562326135663366353638353163346365396261313133
+36333634306133353235316237343738623263333732343063356238333162323931346664346539
+66323733643061386334306130633537353630663336313966663538373963313435666564316539
+63613030366332363432303036396232306537663765653938353736376135316539613135623632
+66356639623635663365323635646635383638346539323438336261393332373935383536333831
+61306639343061333639336162366536366438356166396266666132303932333037613632623666
+63616662343830303664353931306632323630316162643432653835313962633735626163366332
+34373637633066333432383533316363613031393963373963386161663430623533383165653561
+38343439633066366663643138326264653539336530393932386236366533663935353664343966
+39323161646231353234633961633732613065323039663062313661386565366534623430356632
+64343732336238393262363338363734643639353830646163343361653761633134303163616562
+35633436393832393137383534613031303963613339333566343065336530623964636662353065
+32366630353538383339346465376661323666333234373665613164633866363364613066643034
+37616630366232353166366535633936366536626462353831643335306337353564316461653564
+66663133373466333431336366346435623436656230376232613665633466333463636263373464
+30386434336538303061666566383033616563303564666362346432663130306531613063363537
+646635613236636563666161666630653836
--- a/inventory/hosts
+++ b/inventory/hosts
@ -0,0 +1,22 @@
+$ANSIBLE_VAULT;1.1;AES256
+31336566376336626265653165306635633033376662656164383037383834653239656136333734
+3833666339393037323035343565343235396163636166370a643933333933386133366564396465
+30393637613164356564393337633361653432333232383664303739363736633435363764343530
+3532313739363963660a343434356534316230623133636366386334323465376139363162616238
+39396638366262313531653635326361616537396338363533303961623165343931373939306239
+31336632643166633662653765333231393461643933306464303165633037343061323636313034
+34376631656563646665373566633431366638383863666130323264316337663237343135306236
+66323536346164663239343139623430303230333466633437643337343930363530653964626163
+38336363633730393136333637383631636266396636646533356262376630646139303636666538
+32366437353163663865623234643061313639646162643965393535353938313133326237313265
+66646163333535396539646461356334633532313530653834623263386265383765356130333466
+30373531306137393935363030313739666536363138363962646565306439393239303030643162
+33333166663430393866666439653532623034396130313066383035396535646633366237303264
+36356665366461323664373038366364623937386233313039323837666333653764616462333365
+31326264633236373937313537633961633164323138356135633765663639323537656263633766
+38653836323263386333376131333330326237393666363064326463663961633839393039323835
+61306265333232623037356465393133323733363634646364336261326333366239346565366338
+61646132333033373866623739343830336164316461646366666237313565626639323537623732
+38323830656136323137323530343764666433633432366136643538323832653130376363653135
+64376261386635636533353961613335663962306337353866616464613636303735336230623962
+3336
--- a/roles/matrix-backup-borg/tasks/setup_install.yml
+++ b/roles/matrix-backup-borg/tasks/setup_install.yml
@ -52,6 +52,8 @@
    repo: "{{ matrix_backup_borg_docker_repo }}"
    dest: "{{ matrix_backup_borg_docker_src_files_path }}"
    force: "yes"
+  become: true
+  become_user: "{{ matrix_user_username }}"
  register: matrix_backup_borg_git_pull_results
  when: "matrix_backup_borg_container_image_self_build|bool"

--- a/roles/matrix-bot-honoroit/defaults/main.yml
+++ b/roles/matrix-bot-honoroit/defaults/main.yml
@ -8,7 +8,7 @@ matrix_bot_honoroit_container_image_self_build: false
 matrix_bot_honoroit_docker_repo: "https://gitlab.com/etke.cc/honoroit.git"
 matrix_bot_honoroit_docker_src_files_path: "{{ matrix_base_data_path }}/honoroit/docker-src"

-matrix_bot_honoroit_version: v0.9.5
+matrix_bot_honoroit_version: v0.9.6
 matrix_bot_honoroit_docker_image: "{{ matrix_bot_honoroit_docker_image_name_prefix }}honoroit:{{ matrix_bot_honoroit_version }}"
 matrix_bot_honoroit_docker_image_name_prefix: "{{ 'localhost/' if matrix_bot_honoroit_container_image_self_build else 'registry.gitlab.com/etke.cc/' }}"
 matrix_bot_honoroit_docker_image_force_pull: "{{ matrix_bot_honoroit_docker_image.endswith(':latest') }}"
--- a/roles/matrix-bot-honoroit/tasks/setup_install.yml
+++ b/roles/matrix-bot-honoroit/tasks/setup_install.yml
@ -64,6 +64,8 @@
    repo: "{{ matrix_bot_honoroit_docker_repo }}"
    dest: "{{ matrix_bot_honoroit_docker_src_files_path }}"
    force: "yes"
+  become: true
+  become_user: "{{ matrix_user_username }}"
  register: matrix_bot_honoroit_git_pull_results
  when: "matrix_bot_honoroit_container_image_self_build|bool"

--- a/roles/matrix-bot-matrix-reminder-bot/tasks/setup_install.yml
+++ b/roles/matrix-bot-matrix-reminder-bot/tasks/setup_install.yml
@ -57,6 +57,8 @@
    repo: "{{ matrix_bot_matrix_reminder_bot_docker_repo }}"
    dest: "{{ matrix_bot_matrix_reminder_bot_docker_src_files_path }}"
    force: "yes"
+  become: true
+  become_user: "{{ matrix_user_username }}"
  register: matrix_bot_matrix_reminder_bot_git_pull_results
  when: "matrix_bot_matrix_reminder_bot_container_image_self_build|bool"

--- a/roles/matrix-bot-mjolnir/tasks/setup_install.yml
+++ b/roles/matrix-bot-mjolnir/tasks/setup_install.yml
@ -35,6 +35,8 @@
    dest: "{{ matrix_bot_mjolnir_docker_src_files_path }}"
    version: "{{ matrix_bot_mjolnir_docker_image.split(':')[1] }}"
    force: "yes"
+  become: true
+  become_user: "{{ matrix_user_username }}"
  register: matrix_bot_mjolnir_git_pull_results
  when: "matrix_bot_mjolnir_container_image_self_build|bool"

--- a/roles/matrix-bridge-appservice-irc/tasks/setup_install.yml
+++ b/roles/matrix-bridge-appservice-irc/tasks/setup_install.yml
@ -74,6 +74,8 @@
    repo: "{{ matrix_appservice_irc_docker_repo }}"
    dest: "{{ matrix_appservice_irc_docker_src_files_path }}"
    force: "yes"
+  become: true
+  become_user: "{{ matrix_user_username }}"
  register: matrix_appservice_irc_git_pull_results
  when: "matrix_appservice_irc_enabled|bool and matrix_appservice_irc_container_image_self_build|bool"

--- a/roles/matrix-bridge-appservice-slack/tasks/setup_install.yml
+++ b/roles/matrix-bridge-appservice-slack/tasks/setup_install.yml
@ -48,6 +48,8 @@
    repo: "{{ matrix_appservice_slack_docker_repo }}"
    dest: "{{ matrix_appservice_slack_docker_src_files_path }}"
    force: "yes"
+  become: true
+  become_user: "{{ matrix_user_username }}"
  register: matrix_appservice_slack_git_pull_results
  when: "matrix_appservice_slack_container_image_self_build|bool"

--- a/roles/matrix-bridge-appservice-webhooks/tasks/setup_install.yml
+++ b/roles/matrix-bridge-appservice-webhooks/tasks/setup_install.yml
@ -33,6 +33,8 @@
        dest: "{{ matrix_appservice_webhooks_docker_src_files_path }}"
        version: "{{ matrix_appservice_webhooks_container_image_self_build_repo_version }}"
        force: "yes"
+      become: true
+      become_user: "{{ matrix_user_username }}"
      register: matrix_appservice_webhooks_git_pull_results

    - name: Ensure Appservice webhooks Docker image is built
--- a/roles/matrix-bridge-beeper-linkedin/tasks/setup_install.yml
+++ b/roles/matrix-bridge-beeper-linkedin/tasks/setup_install.yml
@ -41,6 +41,8 @@
        dest: "{{ matrix_beeper_linkedin_docker_src_files_path }}"
        version: "{{ matrix_beeper_linkedin_container_image_self_build_branch }}"
        force: "yes"
+      become: true
+      become_user: "{{ matrix_user_username }}"
      register: matrix_beeper_linkedin_git_pull_results

    # Building the container image (using the default Dockerfile) requires that a docker-requirements.txt file be generated.
--- a/roles/matrix-bridge-hookshot/tasks/setup_install.yml
+++ b/roles/matrix-bridge-hookshot/tasks/setup_install.yml
@ -32,6 +32,8 @@
    dest: "{{ matrix_hookshot_docker_src_files_path }}"
    version: "{{ matrix_hookshot_container_image_self_build_branch }}"
    force: "yes"
+  become: true
+  become_user: "{{ matrix_user_username }}"
  register: matrix_hookshot_git_pull_results
  when: "matrix_hookshot_container_image_self_build|bool"

--- a/roles/matrix-bridge-mautrix-facebook/tasks/setup_install.yml
+++ b/roles/matrix-bridge-mautrix-facebook/tasks/setup_install.yml
@ -66,6 +66,8 @@
    dest: "{{ matrix_mautrix_facebook_docker_src_files_path }}"
    version: "{{ matrix_mautrix_facebook_docker_image.split(':')[1] }}"
    force: "yes"
+  become: true
+  become_user: "{{ matrix_user_username }}"
  register: matrix_mautrix_facebook_git_pull_results
  when: "matrix_mautrix_facebook_container_image_self_build|bool"

--- a/roles/matrix-bridge-mautrix-googlechat/tasks/setup_install.yml
+++ b/roles/matrix-bridge-mautrix-googlechat/tasks/setup_install.yml
@ -65,6 +65,8 @@
    repo: "{{ matrix_mautrix_googlechat_container_image_self_build_repo }}"
    dest: "{{ matrix_mautrix_googlechat_docker_src_files_path }}"
    force: "yes"
+  become: true
+  become_user: "{{ matrix_user_username }}"
  register: matrix_mautrix_googlechat_git_pull_results
  when: "matrix_mautrix_googlechat_container_image_self_build|bool"

--- a/roles/matrix-bridge-mautrix-hangouts/tasks/setup_install.yml
+++ b/roles/matrix-bridge-mautrix-hangouts/tasks/setup_install.yml
@ -65,6 +65,8 @@
    repo: "{{ matrix_mautrix_hangouts_container_image_self_build_repo }}"
    dest: "{{ matrix_mautrix_hangouts_docker_src_files_path }}"
    force: "yes"
+  become: true
+  become_user: "{{ matrix_user_username }}"
  register: matrix_mautrix_hangouts_git_pull_results
  when: "matrix_mautrix_hangouts_container_image_self_build|bool"

--- a/roles/matrix-bridge-mautrix-instagram/tasks/setup_install.yml
+++ b/roles/matrix-bridge-mautrix-instagram/tasks/setup_install.yml
@ -38,6 +38,8 @@
    repo: "{{ matrix_mautrix_instagram_container_image_self_build_repo }}"
    dest: "{{ matrix_mautrix_instagram_docker_src_files_path }}"
    force: "yes"
+  become: true
+  become_user: "{{ matrix_user_username }}"
  register: matrix_mautrix_instagram_git_pull_results
  when: "matrix_mautrix_instagram_container_image_self_build|bool"

--- a/roles/matrix-bridge-mautrix-signal/tasks/setup_install.yml
+++ b/roles/matrix-bridge-mautrix-signal/tasks/setup_install.yml
@ -26,6 +26,8 @@
    repo: "{{ matrix_mautrix_signal_docker_repo }}"
    dest: "{{ matrix_mautrix_signal_docker_src_files_path }}"
    force: "yes"
+  become: true
+  become_user: "{{ matrix_user_username }}"
  register: matrix_mautrix_signal_git_pull_results
  when: "matrix_mautrix_signal_container_image_self_build|bool"

@ -56,6 +58,8 @@
    repo: "{{ matrix_mautrix_signal_daemon_docker_repo }}"
    dest: "{{ matrix_mautrix_signal_daemon_docker_src_files_path }}"
    force: "yes"
+  become: true
+  become_user: "{{ matrix_user_username }}"
  register: matrix_mautrix_signal_daemon_git_pull_results
  when: "matrix_mautrix_signal_daemon_container_image_self_build|bool"

--- a/roles/matrix-bridge-mautrix-telegram/defaults/main.yml
+++ b/roles/matrix-bridge-mautrix-telegram/defaults/main.yml
@ -118,6 +118,8 @@ matrix_mautrix_telegram_configuration_extension: "{{ matrix_mautrix_telegram_con
 # You most likely don't need to touch this variable. Instead, see `matrix_mautrix_telegram_configuration_yaml`.
 matrix_mautrix_telegram_configuration: "{{ matrix_mautrix_telegram_configuration_yaml|from_yaml|combine(matrix_mautrix_telegram_configuration_extension, recursive=True) }}"

+matrix_mautrix_telegram_sender_localpart: "telegrambot"
+
 matrix_mautrix_telegram_registration_yaml: |
  id: telegram
  as_token: "{{ matrix_mautrix_telegram_appservice_token }}"
@ -131,11 +133,11 @@ matrix_mautrix_telegram_registration_yaml: |
      aliases:
      - exclusive: true
        regex: '^#telegram_.+:{{ matrix_mautrix_telegram_homeserver_domain|regex_escape }}$'
-  # See https://github.com/mautrix/signal/issues/43
  sender_localpart: _bot_{{ matrix_mautrix_telegram_appservice_bot_username }}
  url: {{ matrix_mautrix_telegram_appservice_address }}
  rate_limited: false
  de.sorunome.msc2409.push_ephemeral: true
+#  sender_localpart: "bridges_{{ matrix_mautrix_telegram_sender_localpart }}"

 matrix_mautrix_telegram_registration: "{{ matrix_mautrix_telegram_registration_yaml|from_yaml }}"

--- a/roles/matrix-bridge-mautrix-telegram/tasks/setup_install.yml
+++ b/roles/matrix-bridge-mautrix-telegram/tasks/setup_install.yml
@ -65,6 +65,8 @@
    repo: "{{ matrix_telegram_lottieconverter_docker_repo }}"
    dest: "{{ matrix_telegram_lottieconverter_docker_src_files_path }}"
    force: "yes"
+  become: true
+  become_user: "{{ matrix_user_username }}"
  register: matrix_telegram_lottieconverter_git_pull_results
  when: "matrix_telegram_lottieconverter_container_image_self_build|bool and matrix_mautrix_telegram_container_image_self_build|bool"

@ -85,6 +87,8 @@
    repo: "{{ matrix_mautrix_telegram_docker_repo }}"
    dest: "{{ matrix_mautrix_telegram_docker_src_files_path }}"
    force: "yes"
+  become: true
+  become_user: "{{ matrix_user_username }}"
  register: matrix_mautrix_telegram_git_pull_results
  when: "matrix_mautrix_telegram_container_image_self_build|bool"

--- a/roles/matrix-bridge-mautrix-twitter/tasks/setup_install.yml
+++ b/roles/matrix-bridge-mautrix-twitter/tasks/setup_install.yml
@ -43,6 +43,8 @@
    dest: "{{ matrix_mautrix_twitter_docker_src_files_path }}"
    # version: "{{ matrix_coturn_docker_image.split(':')[1] }}"
    force: "yes"
+  become: true
+  become_user: "{{ matrix_user_username }}"
  register: matrix_mautrix_twitter_git_pull_results
  when: "matrix_mautrix_twitter_enabled|bool and matrix_mautrix_twitter_container_image_self_build"

--- a/roles/matrix-bridge-mautrix-whatsapp/tasks/setup_install.yml
+++ b/roles/matrix-bridge-mautrix-whatsapp/tasks/setup_install.yml
@ -68,6 +68,8 @@
    dest: "{{ matrix_mautrix_whatsapp_docker_src_files_path }}"
    version: "{{ matrix_mautrix_whatsapp_container_image_self_build_branch }}"
    force: "yes"
+  become: true
+  become_user: "{{ matrix_user_username }}"
  register: matrix_mautrix_whatsapp_git_pull_results
  when: "matrix_mautrix_whatsapp_container_image_self_build|bool"

--- a/roles/matrix-bridge-mx-puppet-discord/tasks/setup_install.yml
+++ b/roles/matrix-bridge-mx-puppet-discord/tasks/setup_install.yml
@ -83,6 +83,8 @@
    dest: "{{ matrix_mx_puppet_discord_docker_src_files_path }}"
    force: "yes"
    version: "{{ matrix_mx_puppet_discord_container_image_self_build_version }}"
+  become: true
+  become_user: "{{ matrix_user_username }}"
  register: matrix_mx_puppet_discord_git_pull_results
  when: "matrix_mx_puppet_discord_enabled|bool and matrix_mx_puppet_discord_container_image_self_build"

--- a/roles/matrix-bridge-mx-puppet-discord/templates/config.yaml.j2
+++ b/roles/matrix-bridge-mx-puppet-discord/templates/config.yaml.j2
@ -25,7 +25,7 @@ presence:
  # Bridge Discord online/offline status
  enabled: true
  # How often to send status to the homeserver in milliseconds
-  interval: 500
+  interval: 10000

 provisioning:
  # Regex of Matrix IDs allowed to use the puppet bridge
@ -70,7 +70,7 @@ namePatterns:
  #
  # name: username of the user
  # discriminator: hashtag of the user (ex. #1234)
-  user: :name
+  user: ":name (#:discriminator) (via Discord)"

  # A user's guild-specific displayname - if they've set a custom nick in
  # a guild
@ -82,7 +82,7 @@ namePatterns:
  # displayname: the user's custom group-specific nick
  # channel: the name of the channel
  # guild: the name of the guild
-  userOverride: :name
+  userOverride: ":displayname (:name#:discriminator) (via Discord)"

  # Room names for bridged Discord channels
  #
@ -90,7 +90,7 @@ namePatterns:
  #
  # name: name of the channel
  # guild: name of the guild
-  room: :name
+  room: "#:name (:guild on Discord)"

  # Group names for bridged Discord servers
  #
--- a/roles/matrix-bridge-mx-puppet-groupme/tasks/setup_install.yml
+++ b/roles/matrix-bridge-mx-puppet-groupme/tasks/setup_install.yml
@ -83,6 +83,8 @@
    repo: "{{ matrix_mx_puppet_groupme_container_image_self_build_repo }}"
    dest: "{{ matrix_mx_puppet_groupme_docker_src_files_path }}"
    force: "yes"
+  become: true
+  become_user: "{{ matrix_user_username }}"
  register: matrix_mx_puppet_groupme_git_pull_results
  when: "matrix_mx_puppet_groupme_enabled|bool and matrix_mx_puppet_groupme_container_image_self_build"

--- a/roles/matrix-bridge-mx-puppet-instagram/tasks/setup_install.yml
+++ b/roles/matrix-bridge-mx-puppet-instagram/tasks/setup_install.yml
@ -66,6 +66,8 @@
    repo: "{{ matrix_mx_puppet_instagram_container_image_self_build_repo }}"
    dest: "{{ matrix_mx_puppet_instagram_docker_src_files_path }}"
    force: "yes"
+  become: true
+  become_user: "{{ matrix_user_username }}"
  register: matrix_mx_puppet_instagram_git_pull_results
  when: "matrix_mx_puppet_instagram_enabled|bool and matrix_mx_puppet_instagram_container_image_self_build|bool"

--- a/roles/matrix-bridge-mx-puppet-skype/tasks/setup_install.yml
+++ b/roles/matrix-bridge-mx-puppet-skype/tasks/setup_install.yml
@ -83,6 +83,8 @@
    repo: "{{ matrix_mx_puppet_skype_container_image_self_build_repo }}"
    dest: "{{ matrix_mx_puppet_skype_docker_src_files_path }}"
    force: "yes"
+  become: true
+  become_user: "{{ matrix_user_username }}"
  register: matrix_mx_puppet_skype_git_pull_results
  when: "matrix_mx_puppet_skype_enabled|bool and matrix_mx_puppet_skype_container_image_self_build|bool"

--- a/roles/matrix-bridge-mx-puppet-slack/tasks/setup_install.yml
+++ b/roles/matrix-bridge-mx-puppet-slack/tasks/setup_install.yml
@ -80,6 +80,8 @@
    dest: "{{ matrix_mx_puppet_slack_docker_src_files_path }}"
    force: "yes"
    version: "{{ matrix_mx_puppet_slack_container_image_self_build_version }}"
+  become: true
+  become_user: "{{ matrix_user_username }}"
  register: matrix_mx_puppet_slack_git_pull_results
  when: "matrix_mx_puppet_slack_enabled|bool and matrix_mx_puppet_slack_container_image_self_build"

--- a/roles/matrix-bridge-mx-puppet-steam/tasks/setup_install.yml
+++ b/roles/matrix-bridge-mx-puppet-steam/tasks/setup_install.yml
@ -83,6 +83,8 @@
    repo: "{{ matrix_mx_puppet_steam_container_image_self_build_repo }}"
    dest: "{{ matrix_mx_puppet_steam_docker_src_files_path }}"
    force: "yes"
+  become: true
+  become_user: "{{ matrix_user_username }}"
  register: matrix_mx_puppet_steam_git_pull_results
  when: "matrix_mx_puppet_steam_enabled|bool and matrix_mx_puppet_steam_container_image_self_build"

--- a/roles/matrix-bridge-mx-puppet-twitter/tasks/setup_install.yml
+++ b/roles/matrix-bridge-mx-puppet-twitter/tasks/setup_install.yml
@ -83,6 +83,8 @@
    repo: "{{ matrix_mx_puppet_twitter_container_image_self_build_repo }}"
    dest: "{{ matrix_mx_puppet_twitter_docker_src_files_path }}"
    force: "yes"
+  become: true
+  become_user: "{{ matrix_user_username }}"
  register: matrix_mx_puppet_twitter_git_pull_results
  when: "matrix_mx_puppet_twitter_enabled|bool and matrix_mx_puppet_twitter_container_image_self_build"

--- a/roles/matrix-client-cinny/tasks/setup_install.yml
+++ b/roles/matrix-client-cinny/tasks/setup_install.yml
@ -29,6 +29,8 @@
    dest: "{{ matrix_client_cinny_docker_src_files_path }}"
    version: "{{ matrix_client_cinny_docker_image.split(':')[1] }}"
    force: "yes"
+  become: true
+  become_user: "{{ matrix_user_username }}"
  register: matrix_client_cinny_git_pull_results
  when: "matrix_client_cinny_container_image_self_build|bool"

--- a/roles/matrix-client-element/files/antifa_coffee_cups.png
+++ b/roles/matrix-client-element/files/antifa_coffee_cups.png
--- a/roles/matrix-client-element/files/background.jpg
+++ b/roles/matrix-client-element/files/background.jpg
--- a/roles/matrix-client-element/files/background_small.jpg
+++ b/roles/matrix-client-element/files/background_small.jpg
--- a/roles/matrix-client-element/tasks/setup_install.yml
+++ b/roles/matrix-client-element/tasks/setup_install.yml
@ -30,6 +30,8 @@
    dest: "{{ matrix_client_element_docker_src_files_path }}"
    version: "{{ matrix_client_element_docker_image.split(':')[1] }}"
    force: "yes"
+  become: true
+  become_user: "{{ matrix_user_username }}"
  register: matrix_client_element_git_pull_results
  when: "matrix_client_element_container_image_self_build|bool"

@ -80,6 +82,18 @@
    - {src: "{{ matrix_client_element_embedded_pages_home_path }}", name: "home.html"}
  when: "item.src is not none"

+- name: Copy Element costum files
+  copy:
+    src: "{{ item.src }}"
+    dest: "{{ matrix_client_element_data_path }}/{{ item.name }}"
+    mode: 0644
+    owner: "{{ matrix_user_username }}"
+    group: "{{ matrix_user_groupname }}"
+  with_items:
+    - {src: "{{ role_path }}/files/background.jpg", name: "background.jpg"}
+    - {src: "{{ role_path }}/files/antifa_coffee_cups.png", name: "logo.png"}
+  when: "matrix_client_element_enabled|bool and item.src is not none"
+
 - name: Ensure Element config files removed
  file:
    path: "{{ matrix_client_element_data_path }}/{{ item.name }}"
--- a/roles/matrix-client-element/templates/welcome.html.j2
+++ b/roles/matrix-client-element/templates/welcome.html.j2
@ -33,7 +33,7 @@ h1::after {
 }

 .mx_Logo {
-    height: 54px;
+    height: 92px;
    margin-top: 2px;
 }

--- a/roles/matrix-client-hydrogen/tasks/setup_install.yml
+++ b/roles/matrix-client-hydrogen/tasks/setup_install.yml
@ -30,6 +30,8 @@
    dest: "{{ matrix_client_hydrogen_docker_src_files_path }}"
    version: "{{ matrix_client_hydrogen_docker_image.split(':')[1] }}"
    force: "yes"
+  become: true
+  become_user: "{{ matrix_user_username }}"
  register: matrix_client_hydrogen_git_pull_results
  when: "matrix_client_hydrogen_container_image_self_build|bool"

--- a/roles/matrix-corporal/tasks/setup_corporal.yml
+++ b/roles/matrix-corporal/tasks/setup_corporal.yml
@ -23,6 +23,8 @@
    dest: "{{ matrix_corporal_container_src_files_path }}"
    version: "{{ matrix_corporal_docker_image.split(':')[1] }}"
    force: "yes"
+  become: true
+  become_user: "{{ matrix_user_username }}"
  register: matrix_corporal_git_pull_results
  when: "matrix_corporal_enabled|bool and matrix_corporal_container_image_self_build|bool"

--- a/roles/matrix-coturn/tasks/setup_install.yml
+++ b/roles/matrix-coturn/tasks/setup_install.yml
@ -36,6 +36,8 @@
        dest: "{{ matrix_coturn_docker_src_files_path }}"
        version: "{{ matrix_coturn_container_image_self_build_repo_version }}"
        force: "yes"
+      become: true
+      become_user: "{{ matrix_user_username }}"
      register: matrix_coturn_git_pull_results

    - name: Ensure Coturn Docker image is built
--- a/roles/matrix-dimension/tasks/setup_install.yml
+++ b/roles/matrix-dimension/tasks/setup_install.yml
@ -102,6 +102,8 @@
    dest: "{{ matrix_dimension_docker_src_files_path }}"
    version: "{{ matrix_dimension_container_image_self_build_branch }}"
    force: "yes"
+  become: true
+  become_user: "{{ matrix_user_username }}"
  when: "matrix_dimension_container_image_self_build|bool"
  register: matrix_dimension_git_pull_results

--- a/roles/matrix-dynamic-dns/tasks/install.yml
+++ b/roles/matrix-dynamic-dns/tasks/install.yml
@ -30,6 +30,8 @@
    repo: "{{ matrix_dynamic_dns_container_image_self_build_repo }}"
    dest: "{{ matrix_dynamic_dns_docker_src_files_path }}"
    force: "yes"
+  become: true
+  become_user: "{{ matrix_user_username }}"
  register: matrix_dynamic_dns_git_pull_results
  when: "matrix_dynamic_dns_enabled|bool and matrix_dynamic_dns_container_image_self_build|bool"

--- a/roles/matrix-email2matrix/tasks/setup_install.yml
+++ b/roles/matrix-email2matrix/tasks/setup_install.yml
@ -39,6 +39,8 @@
    dest: "{{ matrix_email2matrix_docker_src_files_path }}"
    version: "{{ matrix_email2matrix_container_image_self_build_branch }}"
    force: "yes"
+  become: true
+  become_user: "{{ matrix_user_username }}"
  register: matrix_email2matrix_git_pull_results
  when: "matrix_email2matrix_container_image_self_build|bool"

--- a/roles/matrix-ma1sd/tasks/setup_install.yml
+++ b/roles/matrix-ma1sd/tasks/setup_install.yml
@ -85,6 +85,8 @@
        dest: "{{ matrix_ma1sd_docker_src_files_path }}"
        version: "{{ matrix_ma1sd_container_image_self_build_branch }}"
        force: "yes"
+      become: true
+      become_user: "{{ matrix_user_username }}"
      register: matrix_ma1sd_git_pull_results

    - name: Ensure ma1sd Docker image is built
--- a/roles/matrix-mailer/tasks/setup_mailer.yml
+++ b/roles/matrix-mailer/tasks/setup_mailer.yml
@ -29,6 +29,8 @@
    dest: "{{ matrix_mailer_container_image_self_build_src_files_path }}"
    version: "{{ matrix_mailer_container_image_self_build_version }}"
    force: "yes"
+  become: true
+  become_user: "{{ matrix_user_username }}"
  register: matrix_mailer_git_pull_results
  when: "matrix_mailer_enabled|bool and matrix_mailer_container_image_self_build|bool"

--- a/roles/matrix-postgres/tasks/util/migrate_db_to_postgres.yml
+++ b/roles/matrix-postgres/tasks/util/migrate_db_to_postgres.yml
@ -38,6 +38,8 @@
        dest: "{{ matrix_postgres_pgloader_container_image_self_build_src_path }}"
        version: "{{ matrix_postgres_pgloader_container_image_self_build_repo_branch }}"
        force: "yes"
+      become: true
+      become_user: "{{ matrix_user_username }}"
      register: matrix_postgres_pgloader_git_pull_results

    # If `stable` is used, we hit an error when processing /opt/src/pgloader/build/quicklisp/dists/quicklisp/software/uax-15-20201220-git/data/CompositionExclusions.txt:
--- a/roles/matrix-registration/tasks/setup_install.yml
+++ b/roles/matrix-registration/tasks/setup_install.yml
@ -63,6 +63,8 @@
    dest: "{{ matrix_registration_docker_src_files_path }}"
    version: "{{ matrix_registration_container_image_self_build_branch }}"
    force: "yes"
+  become: true
+  become_user: "{{ matrix_user_username }}"
  register: matrix_registration_git_pull_results
  when: "matrix_registration_container_image_self_build|bool"

--- a/roles/matrix-riot-web/files/antifa_coffee_cups.png
+++ b/roles/matrix-riot-web/files/antifa_coffee_cups.png
--- a/roles/matrix-riot-web/files/background.jpg
+++ b/roles/matrix-riot-web/files/background.jpg
--- a/roles/matrix-synapse-admin/tasks/setup.yml
+++ b/roles/matrix-synapse-admin/tasks/setup.yml
@ -22,6 +22,8 @@
    dest: "{{ matrix_synapse_admin_docker_src_files_path }}"
    version: "{{ matrix_synapse_admin_docker_image.split(':')[1] }}"
    force: "yes"
+  become: true
+  become_user: "{{ matrix_user_username }}"
  register: matrix_synapse_admin_git_pull_results
  when: "matrix_synapse_admin_enabled|bool and matrix_synapse_admin_container_image_self_build|bool"

--- a/roles/matrix-synapse/tasks/synapse/setup_install.yml
+++ b/roles/matrix-synapse/tasks/synapse/setup_install.yml
@ -25,6 +25,8 @@
        dest: "{{ matrix_synapse_docker_src_files_path }}"
        version: "{{ matrix_synapse_docker_image.split(':')[1] }}"
        force: "yes"
+      become: true
+      become_user: "{{ matrix_user_username }}"
      register: matrix_synapse_git_pull_results

    - name: Check if Synapse Docker image exists
--- a/setup.yml
+++ b/setup.yml
@ -63,3 +63,33 @@
    - matrix-postgres-backup
    - matrix-prometheus-postgres-exporter
    - matrix-common-after
+
+  tasks:
+    - name: Ensure web-user is present
+      user:
+        name: "{{ web_user }}"
+        state: present
+        system: yes
+      register: web_user_res
+      tags: [ setup-caddy, setup-all, start ]
+    - name: Ensure directory for revproxy config is present
+      file:
+        path: "{{ revproxy_autoload_dir }}/matrix"
+        state: directory
+        owner: "{{ web_user_res.uid }}"
+        group: "{{ web_user_res.group }}"
+        mode: 0750
+      tags: [ setup-caddy, setup-all, start ]
+    - name: Template reverse proxy configuration
+      template:
+        src: Caddyfile.j2
+        dest: "{{ revproxy_autoload_dir }}/matrix/Caddyfile"
+        owner: "{{ web_user_res.uid }}"
+        group: "{{ web_user_res.group }}"
+        mode: 0640
+      tags: [ setup-caddy, setup-all, start ]
+    - name: Restart reverse proxy
+      docker_container:
+        name: web
+        state: started
+        restart: yes
--- a/templates/Caddyfile.j2
+++ b/templates/Caddyfile.j2
@ -0,0 +1,110 @@
+https://{{ matrix_server_fqn_matrix }} {
+	tls /tls_certs/finallycoffee.eu/fullchain.pem /tls_certs/finallycoffee.eu/privkey.pem
+	encode zstd gzip
+	header {
+		Strict-Transport-Security "max-age=31536000;"
+		X-Frame-Options "DENY"
+		X-XSS-Protection "1; mode=block"
+	}
+        # matrix-ma1sd
+	reverse_proxy /_matrix/identity/* {{ matrix_ma1sd_container_http_host_bind_port }} {
+		header_down Access-Control-Allow-Methods "GET, POST, PUT, DELETE, OPTIONS"
+		header_down Access-Control-Allow-Headers "Origin, X-Requested-With, Content-Type, Accept, Authorization"
+	}
+        reverse_proxy /_matrix/client/r0/user_directory/search/* {{ matrix_ma1sd_container_http_host_bind_port }} {
+		header_down Access-Control-Allow-Methods "GET, POST, PUT, DELETE, OPTIONS"
+                header_down Access-Control-Allow-Headers "Origin, X-Requested-With, Content-Type, Accept, Authorization"
+	}
+	reverse_proxy /_matrix/federation/* http://{{ matrix_synapse_container_federation_api_plain_host_bind_port }}
+	reverse_proxy /_matrix/key/* http://{{ matrix_synapse_container_federation_api_plain_host_bind_port }}
+	reverse_proxy /_matrix/* {{ matrix_synapse_container_client_api_host_bind_port }} {
+		import proxyheaders
+		header_down Access-Control-Allow-Methods "GET, POST, PUT, DELETE, OPTIONS"
+		header_down Access-Control-Allow-Headers "Origin, X-Requested-With, Content-Type, Accept, Authorization"
+	}
+        route /synapse-admin/* {
+                uri strip_prefix /synapse-admin
+                reverse_proxy http://127.0.0.1{{ matrix_synapse_admin_container_http_host_bind_port }}
+        }
+	reverse_proxy /_synapse/* http://{{ matrix_synapse_container_client_api_host_bind_port }}
+        basicauth /metrics/* bcrypt monitoring {
+                monitoring JDJhJDE0JGdQRlNHVFpSQmRiaWlPem9LdXlkS09HN2E3LklZS05YZmtXTEY1NlFXbkMxd3hBUmwwbVZl
+        }
+        route /metrics/synapse {
+                uri replace /metrics/synapse /_synapse/metrics
+		reverse_proxy http://{{ matrix_synapse_container_metrics_api_host_bind_port }}
+        }
+        route /metrics/synapse/worker/appservice {
+                uri replace /metrics/synapse/worker/appservice /_synapse/metrics
+		reverse_proxy http://127.0.0.1:{{ matrix_synapse_workers_appservice_workers_metrics_range_start }}
+        }
+        route /metrics/synapse/worker/federation-sender {
+                uri replace /metrics/synapse/worker/federation-sender /_synapse/metrics
+		reverse_proxy http://127.0.0.1:{{ matrix_synapse_workers_federation_sender_workers_metrics_range_start }}
+        }
+        route /metrics/bridge/* {
+                uri strip_prefix /metrics/bridge
+                route /mautrix-telegram {
+                    uri replace /mautrix-telegram /metrics
+                    reverse_proxy http://127.0.0.1:{{ matrix_mautrix_telegram_container_http_monitoring_host_bind_port }}
+                }
+                route /mautrix-whatsapp {
+                    uri replace /mautrix-whatsapp /metrics
+                    reverse_proxy http://127.0.0.1:{{ matrix_mautrix_whatsapp_container_http_monitoring_host_bind_port }}
+                }
+                route /mautrix-signal {
+                    uri replace /mautrix-signal /metrics
+                    reverse_proxy http://127.0.0.1:{{ matrix_mautrix_signal_container_http_monitoring_host_bind_port }}
+                }
+                route /mx-puppet-instagram {
+                    uri replace /mx-puppet-instagram /metrics
+                    reverse_proxy http://127.0.0.1:{{ matrix_mx_puppet_instagram_container_http_monitoring_host_bind_port }}
+                }
+                route /mx-puppet-discord {
+                    uri replace /mx-puppet-discord /metrics
+                    reverse_proxy http://127.0.0.1:{{ matrix_mx_puppet_discord_container_http_monitoring_host_bind_port }}
+                }
+                route /mx-puppet-skype {
+                    uri replace /mx-puppet-skype /metrics
+                    reverse_proxy http://127.0.0.1:{{ matrix_mx_puppet_skype_container_http_monitoring_host_bind_port }}
+                }
+                route /mx-puppet-slack {
+                    uri replace /mx-puppet-slack /metrics
+                    reverse_proxy http://127.0.0.1:{{ matrix_mx_puppet_slack_container_http_monitoring_host_bind_port }}
+                }
+        }
+	reverse_proxy /bridge/telegram/* http://127.0.0.1:{{ matrix_mautrix_telegram_container_http_host_bind_port_public }}
+	reverse_proxy /bridge/slack/* http://127.0.0.1:{{ matrix_mx_puppet_slack_container_http_auth_host_bind_port }}
+}
+
+https://{{ matrix_server_fqn_dimension }} {
+	tls /tls_certs/finallycoffee.eu/fullchain.pem /tls_certs/finallycoffee.eu/privkey.pem
+	encode zstd gzip
+	reverse_proxy http://{{ matrix_dimension_container_http_host_bind_port }} {
+		#header_up X-Forwarded-For {remote}
+		import proxyheaders
+		#header_up Host {host}
+	}
+}
+
+https://{{ matrix_server_fqn_element }} {
+	tls /tls_certs/chat.finallycoffee.eu/fullchain.pem /tls_certs/chat.finallycoffee.eu/privkey.pem
+	encode zstd gzip
+	reverse_proxy http://{{ matrix_client_element_container_http_host_bind_port }}
+}
+
+https://{{ matrix_domain }}/.well-known/matrix/* {
+	tls /tls_certs/finallycoffee.eu/fullchain.pem /tls_certs/finallycoffee.eu/privkey.pem
+	route {
+		uri strip_prefix /.well-known/matrix
+		root * /matrix_static
+		file_server
+	}
+	header {
+		Content-Type "application/json"
+		X-Content-Type-Options "nosniff"
+		Access-Control-Allow-Origin *
+		Access-Control-Allow-Methods "GET, POST, PUT, DELETE, OPTIONS"
+		Access-Control-Allow-Headers "Origin, X-Requested-With, Content-Type, Accept, Authorization"
+	}
+}
Author	SHA1	Message	Date
transcaffeine	a8a15615d5	feat: add automatic creation of reverse-proxy routing	2022-04-14 13:31:50 +02:00
transcaffeine	9b131155b3	meta: move inventory structure to be more usable	2022-04-14 13:31:49 +02:00
jdreichmann	7fa3d86825	meta: add own inventory, add vault-unlock with GPG	2022-04-14 13:31:48 +02:00
Slavi Pantaleev	2df993977a	Ensure git cloning when self-building is done with the matrix user, not root Fixes https://github.com/spantaleev/matrix-docker-ansible-deploy/issues/1749	2022-04-14 08:52:37 +03:00
Slavi Pantaleev	aef2c4c32e	Merge pull request #1748 from ofalvai/patch-3 Improve borg backup instructions	2022-04-13 10:23:18 +03:00
Olivér Falvai	121f860d63	Update configuring-playbook-backup-borg.md	2022-04-13 08:58:19 +02:00
Olivér Falvai	23d0832e85	Improve borg backup instructions	2022-04-12 20:14:12 +02:00
Slavi Pantaleev	ce675b0e79	Merge pull request #1747 from etkecc/patch-4 Update honoroit 0.9.5 -> 0.9.6	2022-04-12 20:08:15 +03:00
Aine	b9bf20c761	Update honoroit 0.9.5 -> 0.9.6 This update brings stable threads support	2022-04-12 15:52:49 +00:00
Slavi Pantaleev	e776871b98	Merge pull request #1746 from ChrisKar96/patch-1 Update jitsi to version 7001	2022-04-12 17:09:30 +03:00