Merge pull request #158 from lpopov/master

Add the ability to update user passwords with ansible
This commit is contained in:
Slavi Pantaleev 2019-05-05 10:21:45 +03:00 committed by GitHub
commit 1653e40239
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
8 changed files with 98 additions and 1 deletions

View file

@ -12,6 +12,8 @@
- [Registering users](registering-users.md)
- [Updating users passwords](updating-users-passwords.md)
- [Configuring service discovery via .well-known](configuring-well-known.md)
- [Maintenance / checking if services work](maintenance-checking-services.md)

View file

@ -0,0 +1,19 @@
# Updating users passwords
If you are using the matrix-postgres container(default), you can do it via this Ansible playbook (make sure to edit the `<your-username>` and `<your-password>` part below):
ansible-playbook -i inventory/hosts setup.yml --extra-vars='username=<your-username> password=<your-password>' --tags=update-user-password
**Note**: `<your-username>` is just a plain username (like `john`), not your full `@<username>:<your-domain>` identifier.
**You can then log in with that user** via the riot-web service that this playbook has created for you at a URL like this: `https://riot.<domain>/`.
If you are NOT using the matrix-postgres container, you can generate the password hash by using the command-line after **SSH**-ing to your server (requires that [all services have been started](#starting-the-services)):
docker exec -it matrix-synapse /usr/local/bin/hash_password -c /data/homeserver.yaml
and then connecting to the postgres server and executing:
UPDATE users SET password_hash = '<password-hash>' WHERE name = '@someone:server.com'
where `<password-hash>` is the hash returned by the docker command above.

View file

@ -48,6 +48,7 @@ run_import_postgres: true
run_upgrade_postgres: true
run_start: true
run_register_user: true
run_update_user_password: true
run_import_sqlite_db: true
run_import_media_store: true
run_self_check: true

View file

@ -68,7 +68,7 @@
- name: Ensure Docker is started and autoruns
service:
name: docker
name: docker
state: started
enabled: yes

View file

@ -123,3 +123,10 @@
debug:
msg: "Note: You are not using a local PostgreSQL database, but some old data remains from before in `{{ matrix_postgres_data_path }}`. Feel free to delete it."
when: "not matrix_postgres_enabled and matrix_postgres_data_path_stat.stat.exists"
- name: Ensure matrix-postgres-update-user-password-hash script created
template:
src: "{{ role_path }}/templates/usr-local-bin/matrix-postgres-update-user-password-hash.j2"
dest: "/usr/local/bin/matrix-postgres-update-user-password-hash"
mode: 0750
when: matrix_postgres_enabled

View file

@ -0,0 +1,15 @@
#!/bin/bash
if [ $# -ne 2 ]; then
echo "Usage: "$0" <username> <password_hash>"
exit 1
fi
docker run \
--rm \
--user={{ matrix_user_uid }}:{{ matrix_user_gid }} \
--cap-drop=ALL \
--env-file={{ matrix_postgres_base_path }}/env-postgres-psql \
--network {{ matrix_docker_network }} \
{{ matrix_postgres_docker_image_to_use }} \
psql -h {{ matrix_postgres_connection_hostname }} -c "UPDATE users set password_hash='$2' WHERE name = '@$1:{{ matrix_domain }}'"

View file

@ -37,3 +37,8 @@
when: run_self_check
tags:
- self-check
- import_tasks: "{{ role_path }}/tasks/update_user_password.yml"
when: run_update_user_password
tags:
- update-user-password

View file

@ -0,0 +1,48 @@
---
- name: Fail if playbook called incorrectly
fail:
msg: "The `username` variable needs to be provided to this playbook, via --extra-vars"
when: "username is not defined or username == '<your-username>'"
- name: Fail if playbook called incorrectly
fail:
msg: "The `password` variable needs to be provided to this playbook, via --extra-vars"
when: "password is not defined or password == '<your-password>'"
- name: Fail if not using matrix-postgres container
fail:
msg: "This command is working only when matrix-postgres container is being used"
when: "not matrix_postgres_enabled"
- name: Ensure matrix-synapse is started
service:
name: matrix-synapse
state: started
daemon_reload: yes
register: start_result
- name: Ensure matrix-postgres is started
service:
name: matrix-postgres
state: started
daemon_reload: yes
register: postgres_start_result
- name: Wait a while, so that Matrix Synapse can manage to start
pause:
seconds: 7
when: start_result.changed
- name: Wait a while, so that Matrix Postgres can manage to start
pause:
seconds: 7
when: postgres_start_result.changed
- name: Generate password hash
shell: "/usr/bin/docker exec matrix-synapse /usr/local/bin/hash_password -c /data/homeserver.yaml -p {{ password }}"
register: password_hash
- name: Update user password hash
shell: "/usr/local/bin/matrix-postgres-update-user-password-hash {{ username }} '{{ password_hash.stdout }}'"