feat: add automatic creation of reverse-proxy routing

Fixes https://github.com/spantaleev/matrix-docker-ansible-deploy/issues/1749

inventory/host_vars/matrix.finallycoffee.eu/vars.yml

@@ -3,20 +3,10 @@
 # Domain of the matrix server and SSL config
 #
 matrix_domain: finallycoffee.eu
-
 matrix_ssl_retrieval_method: none
-matrix_nginx_proxy_enabled: true
-matrix_nginx_proxy_https_enabled: false
-matrix_nginx_proxy_container_http_host_bind_port: "127.0.10.1:8080"
-matrix_nginx_proxy_container_federation_host_bind_port: "127.0.10.1:8448"
-matrix_nginx_proxy_trust_forwarded_proto: true
-matrix_nginx_proxy_x_forwarded_for: '$proxy_add_x_forwarded_for'
-
-matrix_nginx_proxy_proxy_synapse_metrics: true
-
+matrix_nginx_proxy_enabled: false
 matrix_base_data_path: "{{ vault_matrix_base_data_path }}"
 matrix_server_fqn_element: "chat.{{ matrix_domain }}"
-matrix_docker_installation_enabled: false
 
 web_user: "web"
 revproxy_autoload_dir: "/vault/services/web/sites.d"
@@ -32,14 +22,14 @@ matrix_postgres_connection_password: "{{ vault_matrix_postgres_connection_passwo
 # A secret used to protect access keys issued by the server.
 matrix_homeserver_generic_secret_key: "{{ vault_homeserver_generic_secret_key }}"
 # Make synapse accept larger media aswell
-matrix_synapse_max_upload_size_mb: 200
+matrix_synapse_max_upload_size_mb: 100
 # Enable metrics at (default) :9100/_synapse/metrics
 matrix_synapse_metrics_enabled: true
 matrix_synapse_enable_group_creation: true
 matrix_synapse_turn_shared_secret: "{{ vault_matrix_coturn_turn_static_auth_secret }}"
 matrix_synapse_turn_uris:
-  - "turn:voip.matrix.finallycoffee.eu?transport=udp"
-  - "turn:voip.matrix.finallycoffee.eu?transport=tcp"
+  - "turns:voip.matrix.finallycoffee.eu?transport=udp"
+  - "turns:voip.matrix.finallycoffee.eu?transport=tcp"
 # Auto-join all users into those rooms
 matrix_synapse_auto_join_rooms:
   - "#welcome:finallycoffee.eu"
@@ -63,8 +53,8 @@ matrix_synapse_event_cache_size: "200K"
 ## Synapse workers
 matrix_synapse_workers_enabled: true
 matrix_synapse_workers_preset: "little-federation-helper"
-matrix_synapse_workers_generic_workers_count: 2
-matrix_synapse_workers_media_repository_workers_count: 2
+matrix_synapse_workers_generic_worker_client_server_count: 0
+matrix_synapse_workers_media_repository_workers_count: 0
 matrix_synapse_workers_federation_sender_workers_count: 1
 matrix_synapse_workers_pusher_workers_count: 0
 matrix_synapse_workers_appservice_workers_count: 1
@@ -191,8 +181,6 @@ matrix_mautrix_signal_configuration_extension_yaml: |
                 allow: true
                 require_verification: false
         delivery_receipts: true
-        permissions:
-          "@ilosai:fairydust.space": "user"
     logging:
         root:
             level: INFO

roles/matrix-base/tasks/server_base/setup_fedora.yml

@@ -18,7 +18,6 @@
   when: matrix_docker_installation_enabled|bool and matrix_docker_package_name == 'docker-ce'
 
 - name: Ensure yum packages are installed
-  when: false
   yum:
     name:
       - "{{ matrix_ntpd_package }}"

roles/matrix-base/tasks/server_base/setup_redhat.yml

@@ -28,4 +28,4 @@
       - "{{ matrix_docker_package_name }}"
       - docker-python
     state: latest
-  when: matrix_docker_installation_enabled|bool and false
+  when: matrix_docker_installation_enabled|bool

setup.yml

@@ -7,10 +7,9 @@
     - roles/matrix-synapse/vars/workers.yml
 
   roles:
-#    - matrix-awx
     - matrix-base
-#    - matrix-dynamic-dns
-#    - matrix-mailer
+    - matrix-dynamic-dns
+    - matrix-mailer
     - matrix-postgres
     - matrix-redis
     - matrix-corporal

templates/Caddyfile.j2

@@ -6,36 +6,41 @@ https://{{ matrix_server_fqn_matrix }} {
 		X-Frame-Options "DENY"
 		X-XSS-Protection "1; mode=block"
 	}
+        # matrix-ma1sd
+	reverse_proxy /_matrix/identity/* {{ matrix_ma1sd_container_http_host_bind_port }} {
+		header_down Access-Control-Allow-Methods "GET, POST, PUT, DELETE, OPTIONS"
+		header_down Access-Control-Allow-Headers "Origin, X-Requested-With, Content-Type, Accept, Authorization"
+	}
+        reverse_proxy /_matrix/client/r0/user_directory/search/* {{ matrix_ma1sd_container_http_host_bind_port }} {
+		header_down Access-Control-Allow-Methods "GET, POST, PUT, DELETE, OPTIONS"
+                header_down Access-Control-Allow-Headers "Origin, X-Requested-With, Content-Type, Accept, Authorization"
+	}
+	reverse_proxy /_matrix/federation/* http://{{ matrix_synapse_container_federation_api_plain_host_bind_port }}
+	reverse_proxy /_matrix/key/* http://{{ matrix_synapse_container_federation_api_plain_host_bind_port }}
+	reverse_proxy /_matrix/* {{ matrix_synapse_container_client_api_host_bind_port }} {
+		import proxyheaders
+		header_down Access-Control-Allow-Methods "GET, POST, PUT, DELETE, OPTIONS"
+		header_down Access-Control-Allow-Headers "Origin, X-Requested-With, Content-Type, Accept, Authorization"
+	}
+        route /synapse-admin/* {
+                uri strip_prefix /synapse-admin
+                reverse_proxy http://127.0.0.1{{ matrix_synapse_admin_container_http_host_bind_port }}
+        }
+	reverse_proxy /_synapse/* http://{{ matrix_synapse_container_client_api_host_bind_port }}
         basicauth /metrics/* bcrypt monitoring {
                 monitoring JDJhJDE0JGdQRlNHVFpSQmRiaWlPem9LdXlkS09HN2E3LklZS05YZmtXTEY1NlFXbkMxd3hBUmwwbVZl
         }
         route /metrics/synapse {
                 uri replace /metrics/synapse /_synapse/metrics
-                reverse_proxy * http://{{ matrix_nginx_proxy_container_http_host_bind_port }}
+		reverse_proxy http://{{ matrix_synapse_container_metrics_api_host_bind_port }}
         }
         route /metrics/synapse/worker/appservice {
-                uri replace /metrics/synapse/worker/appservice /_synapse-worker-appservice-0/metrics
-                reverse_proxy * http://{{ matrix_nginx_proxy_container_http_host_bind_port }}
+                uri replace /metrics/synapse/worker/appservice /_synapse/metrics
+		reverse_proxy http://127.0.0.1:{{ matrix_synapse_workers_appservice_workers_metrics_range_start }}
         }
         route /metrics/synapse/worker/federation-sender {
-                uri replace /metrics/synapse/worker/federation-sender /_synapse-worker-federation_sender-0/metrics
-                reverse_proxy * http://{{ matrix_nginx_proxy_container_http_host_bind_port }}
-        }
-        route /metrics/synapse/worker/generic-0 {
-                uri replace /metrics/synapse/worker/generic-0 /_synapse-worker-generic_worker-{{ (matrix_synapse_workers_generic_workers_port_range_start)|int}}/metrics
-                reverse_proxy * http://{{ matrix_nginx_proxy_container_http_host_bind_port }}
-        }
-        route /metrics/synapse/worker/generic-1 {
-                uri replace /metrics/synapse/worker/generic-1 /_synapse-worker-generic_worker-{{ (matrix_synapse_workers_generic_workers_port_range_start + 1)|int}}/metrics
-                reverse_proxy * http://{{ matrix_nginx_proxy_container_http_host_bind_port }}
-        }
-        route /metrics/synapse/worker/media-0 {
-                uri replace /metrics/synapse/worker/media-0 /_synapse-worker-media_repository-{{ (matrix_synapse_workers_media_repository_workers_port_range_start)|int }}/metrics
-                reverse_proxy * http://{{ matrix_nginx_proxy_container_http_host_bind_port }}
-        }
-        route /metrics/synapse/worker/media-1 {
-                uri replace /metrics/synapse/worker/media-1 /_synapse-worker-media_repository-{{ (matrix_synapse_workers_media_repository_workers_port_range_start + 1)|int }}/metrics
-                reverse_proxy * http://{{ matrix_nginx_proxy_container_http_host_bind_port }}
+                uri replace /metrics/synapse/worker/federation-sender /_synapse/metrics
+		reverse_proxy http://127.0.0.1:{{ matrix_synapse_workers_federation_sender_workers_metrics_range_start }}
         }
         route /metrics/bridge/* {
                 uri strip_prefix /metrics/bridge
@@ -68,21 +73,24 @@ https://{{ matrix_server_fqn_matrix }} {
                     reverse_proxy http://127.0.0.1:{{ matrix_mx_puppet_slack_container_http_monitoring_host_bind_port }}
                 }
         }
-	reverse_proxy /_matrix/federation/* http://{{ matrix_nginx_proxy_container_federation_host_bind_port }}
-	reverse_proxy /_matrix/key/* http://{{ matrix_nginx_proxy_container_federation_host_bind_port }}
-        reverse_proxy * http://{{ matrix_nginx_proxy_container_http_host_bind_port }}
+	reverse_proxy /bridge/telegram/* http://127.0.0.1:{{ matrix_mautrix_telegram_container_http_host_bind_port_public }}
+	reverse_proxy /bridge/slack/* http://127.0.0.1:{{ matrix_mx_puppet_slack_container_http_auth_host_bind_port }}
 }
 
 https://{{ matrix_server_fqn_dimension }} {
 	tls /tls_certs/finallycoffee.eu/fullchain.pem /tls_certs/finallycoffee.eu/privkey.pem
 	encode zstd gzip
-        reverse_proxy * http://{{ matrix_nginx_proxy_container_http_host_bind_port }}
+	reverse_proxy http://{{ matrix_dimension_container_http_host_bind_port }} {
+		#header_up X-Forwarded-For {remote}
+		import proxyheaders
+		#header_up Host {host}
+	}
 }
 
 https://{{ matrix_server_fqn_element }} {
 	tls /tls_certs/chat.finallycoffee.eu/fullchain.pem /tls_certs/chat.finallycoffee.eu/privkey.pem
 	encode zstd gzip
-        reverse_proxy * http://{{ matrix_nginx_proxy_container_http_host_bind_port }}
+	reverse_proxy http://{{ matrix_client_element_container_http_host_bind_port }}
 }
 
 https://{{ matrix_domain }}/.well-known/matrix/* {