22523c0e42
mxisd supports several identity stores. Add support to configure two of them: * synapseSql (storing identities directly in Synapse's database) * LDAP This removed the need to copy `mxisd.yaml.j2` to the inventory in case one wants to use LDAP as identity store. Note that the previous solution (copying `mxisd.yaml.j2` was poor because of two reasons: * The copy remains outdated in case the original is updated in future versions of this repo. * The role's configuration should be in one place (configured only through role variables) instead of in multiple. Configuring more identity stores through role variables can be supported in the future.
397 lines
18 KiB
YAML
397 lines
18 KiB
YAML
# The bare hostname which represents your identity.
|
|
# This is something like "example.com".
|
|
# Note: this playbook does not touch the server referenced here.
|
|
hostname_identity: "{{ host_specific_hostname_identity }}"
|
|
|
|
# This is where your data lives and what we set up here.
|
|
# This and the Riot hostname (see below) are expected to be on the same server.
|
|
hostname_matrix: "matrix.{{ hostname_identity }}"
|
|
|
|
# This is where you access the web UI from and what we set up here.
|
|
# This and the Matrix hostname (see above) are expected to be on the same server.
|
|
hostname_riot: "riot.{{ hostname_identity }}"
|
|
|
|
|
|
matrix_user_username: "matrix"
|
|
matrix_user_uid: 991
|
|
matrix_user_gid: 991
|
|
|
|
matrix_base_data_path: "/matrix"
|
|
matrix_environment_variables_data_path: "{{ matrix_base_data_path }}/environment-variables"
|
|
matrix_scratchpad_dir: "{{ matrix_base_data_path }}/scratchpad"
|
|
matrix_static_files_base_path: "{{ matrix_base_data_path }}/static-files"
|
|
|
|
matrix_homeserver_url: "https://{{ hostname_matrix }}"
|
|
matrix_identity_server_url: "https://{{ matrix_synapse_trusted_third_party_id_servers[0] }}"
|
|
|
|
# The Docker network that all services would be put into
|
|
matrix_docker_network: "matrix"
|
|
|
|
|
|
matrix_synapse_docker_image: "matrixdotorg/synapse:v0.33.9"
|
|
|
|
matrix_synapse_base_path: "{{ matrix_base_data_path }}/synapse"
|
|
matrix_synapse_config_dir_path: "{{ matrix_synapse_base_path }}/config"
|
|
matrix_synapse_run_path: "{{ matrix_synapse_base_path }}/run"
|
|
matrix_synapse_storage_path: "{{ matrix_synapse_base_path }}/storage"
|
|
matrix_synapse_media_store_path: "{{ matrix_synapse_storage_path }}/media-store"
|
|
matrix_synapse_ext_path: "{{ matrix_synapse_base_path }}/ext"
|
|
|
|
# Specifies which template files to use when configuring Synapse.
|
|
# If you'd like to have your own different configuration, feel free to copy and paste
|
|
# the original files into your inventory (e.g. in `inventory/host_vars/<host>/`)
|
|
# and then change the specific host's `vars.yaml` file like this:
|
|
# matrix_synapse_template_synapse_homeserver: "{{ playbook_dir }}/inventory/host_vars/<host>/homeserver.yaml.j2"
|
|
matrix_synapse_template_synapse_homeserver: "{{ role_path }}/templates/synapse/homeserver.yaml.j2"
|
|
matrix_synapse_template_synapse_log: "{{ role_path }}/templates/synapse/synapse.log.config.j2"
|
|
|
|
matrix_synapse_macaroon_secret_key: ""
|
|
matrix_synapse_registration_shared_secret: "{{ matrix_synapse_macaroon_secret_key }}"
|
|
matrix_synapse_form_secret: "{{ matrix_synapse_macaroon_secret_key }}"
|
|
|
|
# These are the identity servers that would be trusted by Synapse if mxisd is NOT enabled
|
|
matrix_synapse_id_servers_public: ['vector.im', 'matrix.org']
|
|
|
|
# These are the identity servers that would be trusted by Synapse if mxisd IS enabled
|
|
matrix_synapse_id_servers_own: "['{{ hostname_matrix }}']"
|
|
|
|
# The final list of identity servers to use for Synapse.
|
|
# The first one would also be used as riot-web's default identity server.
|
|
matrix_synapse_trusted_third_party_id_servers: "{{ matrix_synapse_id_servers_own if matrix_mxisd_enabled else matrix_synapse_id_servers_public }}"
|
|
|
|
matrix_synapse_max_upload_size_mb: 10
|
|
matrix_synapse_max_log_file_size_mb: 100
|
|
matrix_synapse_max_log_files_count: 10
|
|
|
|
# Log levels
|
|
# Possible options are defined here https://docs.python.org/3/library/logging.html#logging-levels
|
|
# warning: setting log level to DEBUG will make synapse log sensitive information such
|
|
# as access tokens
|
|
matrix_synapse_log_level: "INFO"
|
|
matrix_synapse_storage_sql_log_level: "INFO"
|
|
matrix_synapse_root_log_level: "INFO"
|
|
|
|
# Rate limits
|
|
matrix_synapse_rc_messages_per_second: 0.2
|
|
matrix_synapse_rc_message_burst_count: 10.0
|
|
|
|
# Enable this to allow Synapse to report utilization statistics about your server to matrix.org
|
|
# (things like number of users, number of messages sent, uptime, load, etc.)
|
|
matrix_synapse_report_stats: false
|
|
|
|
# Controls whether the Matrix server will track presence status (online, offline, unavailable) for users.
|
|
# If users participate in large rooms with many other servers,
|
|
# disabling this will decrease server load significantly.
|
|
matrix_synapse_use_presence: true
|
|
|
|
# Controls whether people with access to the homeserver can register by themselves.
|
|
matrix_synapse_enable_registration: false
|
|
|
|
# Users who register on this homeserver will automatically be joined to these rooms.
|
|
# Rooms are to be specified using addresses (e.g. `#address:example.com`)
|
|
matrix_synapse_auto_join_rooms: []
|
|
|
|
# Controls whether auto-join rooms (`matrix_synapse_auto_join_rooms`) are to be created
|
|
# automatically if they don't already exist.
|
|
matrix_synapse_autocreate_auto_join_rooms: true
|
|
|
|
# Controls password-peppering for Matrix Synapse. Not to be changed after initial setup.
|
|
matrix_synapse_password_config_pepper: ""
|
|
|
|
# Controls the number of events that Matrix Synapse caches in memory.
|
|
matrix_synapse_event_cache_size: "100K"
|
|
|
|
# Controls cache sizes for Matrix Synapse via the SYNAPSE_CACHE_FACTOR environment variable.
|
|
# Raise this to increase cache sizes or lower it to potentially lower memory use.
|
|
# To learn more, see:
|
|
# - https://github.com/matrix-org/synapse#help-synapse-eats-all-my-ram
|
|
# - https://github.com/matrix-org/synapse/issues/3939
|
|
matrix_synapse_cache_factor: 0.5
|
|
|
|
# Controls whether Matrix Synapse will federate at all.
|
|
# Disable this to completely isolate your server from the rest of the Matrix network.
|
|
matrix_synapse_federation_enabled: true
|
|
|
|
# A list of domain names that are allowed to federate with the given Matrix Synapse server.
|
|
# An empty list value (`[]`) will also effectively stop federation, but if that's the desired
|
|
# result, it's better to accomplish it by changing `matrix_synapse_federation_enabled`.
|
|
matrix_synapse_federation_domain_whitelist: ~
|
|
|
|
# A list of additional "volumes" to mount in the container.
|
|
# This list gets populated dynamically based on Synapse extensions that have been enabled.
|
|
# Contains definition objects like this: `{"src": "/outside", "dst": "/inside", "options": "rw|ro|slave|.."}
|
|
matrix_synapse_container_additional_volumes: []
|
|
|
|
# A list of additional loggers to register in synapse.log.config.
|
|
# This list gets populated dynamically based on Synapse extensions that have been enabled.
|
|
# Contains definition objects like this: `{"name": "..", "level": "DEBUG"}
|
|
matrix_synapse_additional_loggers: []
|
|
|
|
# A list of service config files
|
|
# This list gets populated dynamically based on Synapse extensions that have been enabled.
|
|
# Contains fs paths
|
|
matrix_synapse_app_service_config_files: []
|
|
|
|
# This is set dynamically during execution depending on whether
|
|
# any password providers have been enabled or not.
|
|
matrix_synapse_password_providers_enabled: false
|
|
|
|
|
|
# Enable this to activate the REST auth password provider module.
|
|
# See: https://github.com/kamax-io/matrix-synapse-rest-auth
|
|
matrix_synapse_ext_password_provider_rest_auth_enabled: false
|
|
matrix_synapse_ext_password_provider_rest_auth_download_url: "https://raw.githubusercontent.com/kamax-io/matrix-synapse-rest-auth/v0.1.1/rest_auth_provider.py"
|
|
matrix_synapse_ext_password_provider_rest_auth_endpoint: ""
|
|
matrix_synapse_ext_password_provider_rest_auth_registration_enforce_lowercase: false
|
|
matrix_synapse_ext_password_provider_rest_auth_registration_profile_name_autofill: true
|
|
matrix_synapse_ext_password_provider_rest_auth_login_profile_name_autofill: false
|
|
|
|
# Enable this to activate the Shared Secret Auth password provider module.
|
|
# See: https://github.com/devture/matrix-synapse-shared-secret-auth
|
|
matrix_synapse_ext_password_provider_shared_secret_auth_enabled: false
|
|
matrix_synapse_ext_password_provider_shared_secret_auth_download_url: "https://raw.githubusercontent.com/devture/matrix-synapse-shared-secret-auth/1.0/shared_secret_authenticator.py"
|
|
matrix_synapse_ext_password_provider_shared_secret_auth_shared_secret: ""
|
|
|
|
# Enable this to activate LDAP password provider
|
|
matrix_synapse_ext_password_provider_ldap_enabled: false
|
|
matrix_synapse_ext_password_provider_ldap_uri: "ldap://ldap.mydomain.tld:389"
|
|
matrix_synapse_ext_password_provider_ldap_start_tls: true
|
|
matrix_synapse_ext_password_provider_ldap_base: ""
|
|
matrix_synapse_ext_password_provider_ldap_attributes_uid: "uid"
|
|
matrix_synapse_ext_password_provider_ldap_attributes_mail: "mail"
|
|
matrix_synapse_ext_password_provider_ldap_attributes_name: "cn"
|
|
matrix_synapse_ext_password_provider_ldap_bind_dn: ""
|
|
matrix_synapse_ext_password_provider_ldap_bind_password: ""
|
|
matrix_synapse_ext_password_provider_ldap_filter: ""
|
|
|
|
|
|
# The defaults below cause a postgres server to be configured (running within a container).
|
|
# Using an external server is possible by tweaking all of the parameters below.
|
|
matrix_postgres_use_external: false
|
|
matrix_postgres_connection_hostname: "matrix-postgres"
|
|
matrix_postgres_connection_username: "synapse"
|
|
matrix_postgres_connection_password: "synapse-password"
|
|
matrix_postgres_db_name: "homeserver"
|
|
|
|
matrix_postgres_data_path: "{{ matrix_base_data_path }}/postgres"
|
|
|
|
matrix_postgres_docker_image_v9: "postgres:9.6.10-alpine"
|
|
matrix_postgres_docker_image_v10: "postgres:10.5-alpine"
|
|
matrix_postgres_docker_image_v11: "postgres:11.1-alpine"
|
|
matrix_postgres_docker_image_latest: "{{ matrix_postgres_docker_image_v11 }}"
|
|
|
|
|
|
matrix_coturn_docker_image: "instrumentisto/coturn:4.5.0.8"
|
|
|
|
matrix_coturn_base_path: "{{ matrix_base_data_path }}/coturn"
|
|
matrix_coturn_config_path: "{{ matrix_coturn_base_path }}/turnserver.conf"
|
|
|
|
# A shared secret (between Synapse and Coturn) used for authentication.
|
|
# You can put any string here, but generating a strong one is preferred (e.g. `pwgen -s 64 1`).
|
|
matrix_coturn_turn_static_auth_secret: ""
|
|
|
|
# UDP port-range to use for TURN
|
|
matrix_coturn_turn_udp_min_port: 49152
|
|
matrix_coturn_turn_udp_max_port: 49172
|
|
|
|
matrix_coturn_turn_external_ip_address: "{{ ansible_host }}"
|
|
|
|
|
|
matrix_s3_media_store_enabled: false
|
|
matrix_s3_goofys_docker_image: "cloudproto/goofys:latest"
|
|
matrix_s3_media_store_bucket_name: "your-bucket-name"
|
|
matrix_s3_media_store_aws_access_key: "your-aws-access-key"
|
|
matrix_s3_media_store_aws_secret_key: "your-aws-secret-key"
|
|
matrix_s3_media_store_region: "eu-central-1"
|
|
|
|
|
|
# By default, this playbook sets up a postfix mailer server (running in a container).
|
|
# This is so that Matrix Synapse can send email reminders for unread messages.
|
|
# Other services (like mxisd), however, also use that mailer to send emails through it.
|
|
matrix_mailer_enabled: true
|
|
|
|
matrix_mailer_docker_image: "panubo/postfix:latest"
|
|
|
|
matrix_mailer_sender_address: "matrix@{{ hostname_identity }}"
|
|
matrix_mailer_relay_use: false
|
|
matrix_mailer_relay_host_name: "mail.example.com"
|
|
matrix_mailer_relay_host_port: 587
|
|
matrix_mailer_relay_auth: false
|
|
matrix_mailer_relay_auth_username: ""
|
|
matrix_mailer_relay_auth_password: ""
|
|
|
|
|
|
# By default, this playbook installs the mxisd identity server on the same domain as Synapse (`hostname_matrix`).
|
|
# If you wish to use the public identity servers (matrix.org, vector.im, riot.im) instead of your own,
|
|
# you may wish to disable this.
|
|
matrix_mxisd_enabled: true
|
|
matrix_mxisd_docker_image: "kamax/mxisd:1.2.0"
|
|
matrix_mxisd_base_path: "{{ matrix_base_data_path }}/mxisd"
|
|
matrix_mxisd_config_path: "{{ matrix_mxisd_base_path }}/config"
|
|
matrix_mxisd_data_path: "{{ matrix_mxisd_base_path }}/data"
|
|
|
|
# Your identity server is private by default.
|
|
# To ensure maximum discovery, you can make your identity server
|
|
# also forward lookups to the central matrix.org Identity server
|
|
# (at the cost of potentially leaking all your contacts information).
|
|
# Enabling this is discouraged. Learn more here: https://github.com/kamax-io/mxisd/blob/master/docs/features/identity.md#lookups
|
|
matrix_mxisd_matrixorg_forwarding_enabled: false
|
|
|
|
# mxisd has serveral supported identity stores.
|
|
# One of them is storing identities directly in Synapse's database.
|
|
# Learn more here: https://github.com/kamax-matrix/mxisd/blob/master/docs/stores/synapse.md
|
|
matrix_mxisd_synapsesql_enabled: true
|
|
matrix_mxisd_synapsesql_type: postgresql
|
|
matrix_mxisd_synapsesql_connection: //{{ matrix_postgres_connection_hostname }}/{{ matrix_postgres_db_name }}?user={{ matrix_postgres_connection_username }}&password={{ matrix_postgres_connection_password }}
|
|
|
|
# LDAP is another identity store that's supported by mxisd.
|
|
# Learn more here: https://github.com/kamax-matrix/mxisd/blob/master/docs/stores/ldap.md
|
|
matrix_mxisd_ldap_enabled: false
|
|
matrix_mxisd_ldap_connection_host: ldapHostnameOrIp
|
|
matrix_mxisd_ldap_connection_tls: false
|
|
matrix_mxisd_ldap_connection_port: 389
|
|
matrix_mxisd_ldap_connection_baseDn: OU=Users,DC=example,DC=org
|
|
matrix_mxisd_ldap_connection_bindDn: CN=My Mxisd User,OU=Users,DC=example,DC=org
|
|
matrix_mxisd_ldap_connection_bindPassword: TheUserPassword
|
|
# The following keys are optional:
|
|
# matrix_mxisd_ldap_filter: ""
|
|
# matrix_mxisd_ldap_attribute_uid_type: uid
|
|
# matrix_mxisd_ldap_attribute_uid_value: sAMAccountName
|
|
# matrix_mxisd_ldap_attribute_name: cn
|
|
# matrix_mxisd_ldap_attribute_threepid_email:
|
|
# - mail
|
|
# - otherMailAttribute
|
|
# matrix_mxisd_ldap_attribute_threepid_msisdn:
|
|
# - phone
|
|
# - otherPhoneAttribute
|
|
# matrix_mxisd_ldap_identity_filter: ""
|
|
# matrix_mxisd_ldap_identity_medium: ""
|
|
# matrix_mxisd_ldap_auth_filter: ""
|
|
# matrix_mxisd_ldap_directory_filter: ""
|
|
|
|
|
|
# Specifies which template files to use when configuring mxisd.
|
|
# If you'd like to have your own different configuration, feel free to copy and paste
|
|
# the original files into your inventory (e.g. in `inventory/host_vars/<host>/`)
|
|
# and then change the specific host's `vars.yaml` file like this:
|
|
# matrix_mxisd_template_config: "{{ playbook_dir }}/inventory/host_vars/<host>/mxisd.yaml.j2"
|
|
matrix_mxisd_template_config: "{{ role_path }}/templates/mxisd/mxisd.yaml.j2"
|
|
|
|
|
|
# Enable this to add support for matrix-corporal.
|
|
# See: https://github.com/devture/matrix-corporal
|
|
matrix_corporal_enabled: false
|
|
|
|
matrix_corporal_docker_image: "devture/matrix-corporal:1.2.1"
|
|
matrix_corporal_base_path: "{{ matrix_base_data_path }}/corporal"
|
|
matrix_corporal_config_dir_path: "{{ matrix_corporal_base_path }}/config"
|
|
matrix_corporal_cache_dir_path: "{{ matrix_corporal_base_path }}/cache"
|
|
matrix_corporal_var_dir_path: "{{ matrix_corporal_base_path }}/var"
|
|
|
|
matrix_corporal_matrix_timeout_milliseconds: 30000
|
|
|
|
matrix_corporal_reconciliation_retry_interval_milliseconds: 30000
|
|
matrix_corporal_reconciliation_user_id_local_part: "matrix-corporal"
|
|
|
|
matrix_corporal_http_api_enabled: false
|
|
matrix_corporal_http_api_auth_token: ""
|
|
|
|
# Matrix Corporal policy provider configuration (goes directly into the configuration's `PolicyProvider` value)
|
|
matrix_corporal_policy_provider_config: ""
|
|
|
|
matrix_corporal_debug: false
|
|
|
|
|
|
# By default, this playbook installs the Riot.IM web UI on the `hostname_riot` domain.
|
|
# If you wish to connect to your Matrix server by other means,
|
|
# you may wish to disable this.
|
|
matrix_riot_web_enabled: true
|
|
|
|
matrix_riot_web_docker_image: "avhost/docker-matrix-riot:v0.17.6"
|
|
|
|
matrix_riot_web_data_path: "{{ matrix_base_data_path }}/riot-web"
|
|
|
|
# Riot config.json customizations
|
|
matrix_riot_web_disable_custom_urls: true
|
|
matrix_riot_web_disable_guests: true
|
|
matrix_riot_web_integrations_ui_url: "https://scalar.vector.im/"
|
|
matrix_riot_web_integrations_rest_url: "https://scalar.vector.im/api"
|
|
matrix_riot_web_integrations_widgets_urls: "https://scalar.vector.im/api"
|
|
matrix_riot_web_integrations_jitsi_widget_url: "https://scalar.vector.im/api/widgets/jitsi.html"
|
|
# Riot public room directory server(s)
|
|
matrix_riot_web_roomdir_servers: ['matrix.org']
|
|
matrix_riot_web_welcome_user_id: "@riot-bot:matrix.org"
|
|
|
|
|
|
|
|
# Matrix mautrix is a Matrix <-> Telegram bridge
|
|
# Enable telegram bridge
|
|
matrix_mautrix_telegram_enabled: false
|
|
|
|
matrix_mautrix_telegram_docker_image: "tulir/mautrix-telegram:v0.4.0"
|
|
|
|
matrix_mautrix_telegram_base_path: "{{ matrix_base_data_path }}/mautrix-telegram"
|
|
|
|
# Get your own API keys at https://my.telegram.org/apps
|
|
matrix_mautrix_telegram_api_id: YOUR_TELEGRAM_APP_ID
|
|
matrix_mautrix_telegram_api_hash: YOUR_TELEGRAM_API_HASH
|
|
# Mautrix telegram public endpoint to log in to telegram
|
|
# Use an uuid so it's not easily discoverable
|
|
matrix_mautrix_telegram_public_endpoint: "/{{ matrix_synapse_macaroon_secret_key | password_hash('sha512', 'telegram') | to_uuid }}"
|
|
|
|
|
|
# Matrix mautrix is a Matrix <-> Whatsapp bridge
|
|
# Enable whatsapp bridge
|
|
matrix_mautrix_whatsapp_enabled: false
|
|
|
|
matrix_mautrix_whatsapp_docker_image: "tulir/mautrix-whatsapp:latest"
|
|
|
|
matrix_mautrix_whatsapp_base_path: "{{ matrix_base_data_path }}/mautrix-whatsapp"
|
|
|
|
|
|
# By default, this playbook sets up its own nginx proxy server on port 80/443.
|
|
# This is fine if you're dedicating the whole server to Matrix.
|
|
# But in case that's not the case, you may wish to prevent that
|
|
# and take care of proxying by yourself.
|
|
matrix_nginx_proxy_enabled: true
|
|
|
|
matrix_nginx_proxy_docker_image: "nginx:1.15.6-alpine"
|
|
|
|
matrix_nginx_proxy_data_path: "{{ matrix_base_data_path }}/nginx-proxy"
|
|
matrix_nginx_proxy_confd_path: "{{ matrix_nginx_proxy_data_path }}/conf.d"
|
|
|
|
# The addresses where the Matrix Client API is.
|
|
# Certain extensions (like matrix-corporal) may override this in order to capture all traffic.
|
|
matrix_nginx_proxy_matrix_client_api_addr_with_proxy_container: "matrix-synapse:8008"
|
|
matrix_nginx_proxy_matrix_client_api_addr_sans_proxy_container: "localhost:8008"
|
|
|
|
# Specifies when to reload the matrix-nginx-proxy service so that
|
|
# a new SSL certificate could go into effect.
|
|
matrix_nginx_proxy_reload_cron_time_definition: "20 4 */5 * *"
|
|
|
|
# Specifies which SSL protocols to use when serving Riot and Synapse
|
|
# Note TLSv1.3 is not yet available in dockerized nginx
|
|
# See: https://github.com/nginxinc/docker-nginx/issues/190
|
|
matrix_nginx_proxy_ssl_protocols: "TLSv1.1 TLSv1.2"
|
|
|
|
|
|
matrix_ssl_base_path: "{{ matrix_base_data_path }}/ssl"
|
|
matrix_ssl_config_dir_path: "{{ matrix_ssl_base_path }}/config"
|
|
matrix_ssl_log_dir_path: "{{ matrix_ssl_base_path }}/log"
|
|
matrix_ssl_support_email: "{{ host_specific_matrix_ssl_support_email }}"
|
|
matrix_ssl_certbot_docker_image: "certbot/certbot:v0.28.0"
|
|
matrix_ssl_certbot_standalone_http_port: 2402
|
|
matrix_ssl_use_staging: false
|
|
|
|
# Specifies when to attempt to retrieve new SSL certificates from Let's Encrypt.
|
|
matrix_ssl_renew_cron_time_definition: "15 4 */5 * *"
|
|
|
|
# Variables to Control which parts of the role run.
|
|
run_setup: true
|
|
run_upgrade_postgres: true
|
|
run_start: true
|
|
run_register_user: true
|
|
run_import_sqlite_db: true
|
|
run_import_media_store: true
|
|
run_self_check: true
|