Add (native) Traefik support to synapse-admin

Previously, it had to go through matrix-nginx-proxy.
It's exposed to Traefik directly via container labels now.
This commit is contained in:
Slavi Pantaleev 2023-02-13 15:08:42 +02:00
parent 80935a5194
commit 3d9aa8387e
8 changed files with 133 additions and 9 deletions

View file

@ -3159,13 +3159,18 @@ matrix_synapse_reverse_proxy_companion_access_log_syslog_integration_server_port
matrix_synapse_admin_enabled: false matrix_synapse_admin_enabled: false
# Normally, matrix-nginx-proxy is enabled and nginx can reach Synapse Admin over the container network. matrix_synapse_admin_nginx_proxy_integration_enabled: "{{ matrix_playbook_reverse_proxy_type in ['playbook-managed-nginx', 'other-nginx-non-container'] }}"
# If matrix-nginx-proxy is not enabled, or you otherwise have a need for it, you can expose
# Synapse Admin's HTTP port to the local host.
matrix_synapse_admin_container_http_host_bind_port: "{{ (matrix_playbook_service_host_bind_interface_prefix ~ ':8766') if matrix_playbook_service_host_bind_interface_prefix else '' }}" matrix_synapse_admin_container_http_host_bind_port: "{{ (matrix_playbook_service_host_bind_interface_prefix ~ ':8766') if matrix_playbook_service_host_bind_interface_prefix else '' }}"
matrix_synapse_admin_container_image_self_build: "{{ matrix_architecture not in ['arm64', 'amd64'] }}" matrix_synapse_admin_container_image_self_build: "{{ matrix_architecture not in ['arm64', 'amd64'] }}"
matrix_synapse_admin_container_additional_networks: "{{ [matrix_playbook_reverse_proxyable_services_additional_network] if matrix_playbook_reverse_proxyable_services_additional_network else [] }}"
matrix_synapse_admin_container_labels_traefik_enabled: "{{ matrix_playbook_reverse_proxy_type in ['playbook-managed-traefik', 'other-traefik-container'] }}"
matrix_synapse_admin_container_labels_traefik_docker_network: "{{ matrix_playbook_reverse_proxyable_services_additional_network }}"
matrix_synapse_admin_container_labels_traefik_entrypoints: "{{ devture_traefik_entrypoint_primary if devture_traefik_enabled else '' }}"
###################################################################### ######################################################################
# #
# /matrix-synapse-admin # /matrix-synapse-admin

View file

@ -4,19 +4,57 @@
matrix_synapse_admin_enabled: true matrix_synapse_admin_enabled: true
# A path on host where all related files will be saved
matrix_synapse_admin_base_path: "{{ matrix_base_data_path }}/synapse-admin"
matrix_synapse_admin_docker_src_files_path: "{{ matrix_synapse_admin_base_path }}/docker-src"
# Specifies whether this role will integrate with the matrix-nginx-proxy role
matrix_synapse_admin_nginx_proxy_integration_enabled: false
matrix_synapse_admin_container_image_self_build: false matrix_synapse_admin_container_image_self_build: false
matrix_synapse_admin_container_image_self_build_repo: "https://github.com/Awesome-Technologies/synapse-admin.git" matrix_synapse_admin_container_image_self_build_repo: "https://github.com/Awesome-Technologies/synapse-admin.git"
matrix_synapse_admin_docker_src_files_path: "{{ matrix_base_data_path }}/synapse-admin/docker-src"
matrix_synapse_admin_version: 0.8.7 matrix_synapse_admin_version: 0.8.7
matrix_synapse_admin_docker_image: "{{ matrix_synapse_admin_docker_image_name_prefix }}awesometechnologies/synapse-admin:{{ matrix_synapse_admin_version }}" matrix_synapse_admin_docker_image: "{{ matrix_synapse_admin_docker_image_name_prefix }}awesometechnologies/synapse-admin:{{ matrix_synapse_admin_version }}"
matrix_synapse_admin_docker_image_name_prefix: "{{ 'localhost/' if matrix_synapse_admin_container_image_self_build else matrix_container_global_registry_prefix }}" matrix_synapse_admin_docker_image_name_prefix: "{{ 'localhost/' if matrix_synapse_admin_container_image_self_build else matrix_container_global_registry_prefix }}"
matrix_synapse_admin_docker_image_force_pull: "{{ matrix_synapse_admin_docker_image.endswith(':latest') }}" matrix_synapse_admin_docker_image_force_pull: "{{ matrix_synapse_admin_docker_image.endswith(':latest') }}"
# The base container network
matrix_synapse_admin_container_network: matrix-synapse-admin
# A list of additional container networks that the container would be connected to.
# The role does not create these networks, so make sure they already exist.
#
# Use this to expose this container to another reverse proxy, which runs in a different container network,
# without exposing all other container services to that other reverse-proxy.
matrix_synapse_admin_container_additional_networks: []
# A list of extra arguments to pass to the container # A list of extra arguments to pass to the container
matrix_synapse_admin_container_extra_arguments: [] matrix_synapse_admin_container_extra_arguments: []
# matrix_synapse_admin_container_labels_traefik_enabled controls whether labels to assist a Traefik reverse-proxy will be attached to the container.
# See `../templates/labels.j2` for details.
#
# To inject your own other container labels, see `matrix_synapse_admin_container_labels_additional_labels`.
matrix_synapse_admin_container_labels_traefik_enabled: true
matrix_synapse_admin_container_labels_traefik_docker_network: "{{ matrix_synapse_admin_container_network }}"
matrix_synapse_admin_container_labels_traefik_hostname: "{{ matrix_server_fqn_matrix }}"
# The path prefix must not end with a slash
matrix_synapse_admin_container_labels_traefik_path_prefix: /synapse-admin
matrix_synapse_admin_container_labels_traefik_rule: "Host(`{{ matrix_synapse_admin_container_labels_traefik_hostname }}`) && PathPrefix(`{{ matrix_synapse_admin_container_labels_traefik_path_prefix | quote }}`)"
matrix_synapse_admin_container_labels_traefik_entrypoints: web-secure
matrix_synapse_admin_container_labels_traefik_tls: "{{ matrix_synapse_admin_container_labels_traefik_entrypoints != 'web' }}"
matrix_synapse_admin_container_labels_traefik_tls_certResolver: default # noqa var-naming
# matrix_synapse_admin_container_labels_additional_labels contains a multiline string with additional labels to add to the container label file.
# See `../templates/labels.j2` for details.
#
# Example:
# matrix_synapse_admin_container_labels_additional_labels: |
# my.label=1
# another.label="here"
matrix_synapse_admin_container_labels_additional_labels: ''
# List of systemd services that matrix-synapse-admin.service depends on # List of systemd services that matrix-synapse-admin.service depends on
matrix_synapse_admin_systemd_required_services_list: ['docker.service'] matrix_synapse_admin_systemd_required_services_list: ['docker.service']

View file

@ -1,7 +1,7 @@
--- ---
- block: - block:
- when: matrix_synapse_admin_enabled | bool - when: matrix_synapse_admin_enabled | bool and matrix_synapse_admin_nginx_proxy_integration_enabled | bool
ansible.builtin.include_tasks: "{{ role_path }}/tasks/inject_into_nginx_proxy.yml" ansible.builtin.include_tasks: "{{ role_path }}/tasks/inject_into_nginx_proxy.yml"
tags: tags:
- setup-all - setup-all

View file

@ -1,5 +1,21 @@
--- ---
- name: Ensure matrix-synapse-admin path exist
ansible.builtin.file:
path: "{{ matrix_synapse_admin_base_path }}"
state: directory
mode: 0700
owner: "{{ matrix_user_username }}"
group: "{{ matrix_user_groupname }}"
- name: Ensure matrix-synapse-admin labels file is created
ansible.builtin.template:
src: "{{ role_path }}/templates/labels.j2"
dest: "{{ matrix_synapse_admin_base_path }}/labels"
owner: "{{ matrix_user_username }}"
group: "{{ matrix_user_groupname }}"
mode: 0640
- name: Ensure matrix-synapse-admin image is pulled - name: Ensure matrix-synapse-admin image is pulled
community.docker.docker_image: community.docker.docker_image:
name: "{{ matrix_synapse_admin_docker_image }}" name: "{{ matrix_synapse_admin_docker_image }}"
@ -35,9 +51,13 @@
pull: true pull: true
when: matrix_synapse_admin_container_image_self_build | bool when: matrix_synapse_admin_container_image_self_build | bool
- name: Ensure matrix-synapse-admin container network is created
community.general.docker_network:
name: "{{ matrix_synapse_admin_container_network }}"
driver: bridge
- name: Ensure matrix-synapse-admin.service installed - name: Ensure matrix-synapse-admin.service installed
ansible.builtin.template: ansible.builtin.template:
src: "{{ role_path }}/templates/systemd/matrix-synapse-admin.service.j2" src: "{{ role_path }}/templates/systemd/matrix-synapse-admin.service.j2"
dest: "{{ devture_systemd_docker_base_systemd_path }}/matrix-synapse-admin.service" dest: "{{ devture_systemd_docker_base_systemd_path }}/matrix-synapse-admin.service"
mode: 0644 mode: 0644
register: matrix_synapse_admin_systemd_service_result

View file

@ -18,3 +18,8 @@
ansible.builtin.file: ansible.builtin.file:
path: "{{ devture_systemd_docker_base_systemd_path }}/matrix-synapse-admin.service" path: "{{ devture_systemd_docker_base_systemd_path }}/matrix-synapse-admin.service"
state: absent state: absent
- name: Ensure matrix-synapse-admin directory doesn't exist
ansible.builtin.file:
path: "{{ matrix_synapse_admin_base_path }}"
state: absent

View file

@ -10,3 +10,24 @@
- {'old': 'matrix_synapse_admin_docker_repo', 'new': 'matrix_synapse_admin_container_self_build_repo'} - {'old': 'matrix_synapse_admin_docker_repo', 'new': 'matrix_synapse_admin_container_self_build_repo'}
- {'old': 'matrix_synapse_admin_container_self_build', 'new': 'matrix_synapse_admin_container_image_self_build'} - {'old': 'matrix_synapse_admin_container_self_build', 'new': 'matrix_synapse_admin_container_image_self_build'}
- {'old': 'matrix_synapse_admin_container_self_build_repo', 'new': 'matrix_synapse_admin_container_image_self_build_repo'} - {'old': 'matrix_synapse_admin_container_self_build_repo', 'new': 'matrix_synapse_admin_container_image_self_build_repo'}
- when: matrix_synapse_admin_container_labels_traefik_enabled | bool
block:
- name: Fail if required matrix-synapse-admin Traefik settings not defined
ansible.builtin.fail:
msg: >-
You need to define a required configuration setting (`{{ item }}`).
when: "vars[item] == ''"
with_items:
- matrix_synapse_admin_container_labels_traefik_hostname
- matrix_synapse_admin_container_labels_traefik_path_prefix
# We ensure it doesn't end with a slash, because we handle both (slash and no-slash).
# Knowing that `matrix_synapse_admin_container_labels_traefik_path_prefix` does not end with a slash
# ensures we know how to set these routes up without having to do "does it end with a slash" checks elsewhere.
- name: Fail if matrix_synapse_admin_container_labels_traefik_path_prefix ends with a slash
ansible.builtin.fail:
msg: >-
matrix_synapse_admin_container_labels_traefik_path_prefix (`{{ matrix_synapse_admin_container_labels_traefik_path_prefix }}`) must not end with a slash.
Example: `/synapse-admin`.
when: "matrix_synapse_admin_container_labels_traefik_path_prefix[-1] == '/'"

View file

@ -0,0 +1,25 @@
{% if matrix_synapse_admin_container_labels_traefik_enabled %}
traefik.enable=true
{% if matrix_synapse_admin_container_labels_traefik_docker_network %}
traefik.docker.network={{ matrix_synapse_admin_container_labels_traefik_docker_network }}
{% endif %}
traefik.http.middlewares.matrix-synapse-admin-slashless-redirect.redirectregex.regex=({{ matrix_synapse_admin_container_labels_traefik_path_prefix | quote }})$
traefik.http.middlewares.matrix-synapse-admin-slashless-redirect.redirectregex.replacement=${1}/
traefik.http.middlewares.matrix-synapse-admin-replacepath.replacepath.path=/
traefik.http.routers.matrix-synapse-admin.rule={{ matrix_synapse_admin_container_labels_traefik_rule }}
traefik.http.routers.matrix-synapse-admin.middlewares=matrix-synapse-admin-slashless-redirect,matrix-synapse-admin-replacepath
traefik.http.routers.matrix-synapse-admin.service=matrix-synapse-admin
traefik.http.routers.matrix-synapse-admin.entrypoints={{ matrix_synapse_admin_container_labels_traefik_entrypoints }}
traefik.http.routers.matrix-synapse-admin.tls={{ matrix_synapse_admin_container_labels_traefik_tls | to_json }}
{% if matrix_synapse_admin_container_labels_traefik_tls %}
traefik.http.routers.matrix-synapse-admin.tls.certResolver={{ matrix_synapse_admin_container_labels_traefik_tls_certResolver }}
{% endif %}
traefik.http.services.matrix-synapse-admin.loadbalancer.server.port=80
{% endif %}
{{ matrix_synapse_admin_container_labels_additional_labels }}

View file

@ -16,24 +16,34 @@ Environment="HOME={{ devture_systemd_docker_base_systemd_unit_home_path }}"
ExecStartPre=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} kill matrix-synapse-admin 2>/dev/null || true' ExecStartPre=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} kill matrix-synapse-admin 2>/dev/null || true'
ExecStartPre=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} rm matrix-synapse-admin 2>/dev/null || true' ExecStartPre=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} rm matrix-synapse-admin 2>/dev/null || true'
ExecStart={{ devture_systemd_docker_base_host_command_docker }} run --rm --name matrix-synapse-admin \ ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} create \
--rm \
--name=matrix-synapse-admin \
--log-driver=none \ --log-driver=none \
--cap-drop=ALL \ --cap-drop=ALL \
--cap-add=CHOWN \ --cap-add=CHOWN \
--cap-add=NET_BIND_SERVICE \ --cap-add=NET_BIND_SERVICE \
--cap-add=SETUID \ --cap-add=SETUID \
--cap-add=SETGID \ --cap-add=SETGID \
--network={{ matrix_docker_network }} \ --network={{ matrix_synapse_admin_container_network }} \
{% if matrix_synapse_admin_container_http_host_bind_port %} {% if matrix_synapse_admin_container_http_host_bind_port %}
-p {{ matrix_synapse_admin_container_http_host_bind_port }}:80 \ -p {{ matrix_synapse_admin_container_http_host_bind_port }}:80 \
{% endif %} {% endif %}
--label-file={{ matrix_synapse_admin_base_path }}/labels \
{% for arg in matrix_synapse_admin_container_extra_arguments %} {% for arg in matrix_synapse_admin_container_extra_arguments %}
{{ arg }} \ {{ arg }} \
{% endfor %} {% endfor %}
{{ matrix_synapse_admin_docker_image }} {{ matrix_synapse_admin_docker_image }}
{% for network in matrix_synapse_admin_container_additional_networks %}
ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} network connect {{ network }} matrix-synapse-admin
{% endfor %}
ExecStart={{ devture_systemd_docker_base_host_command_docker }} start --attach matrix-synapse-admin
ExecStop=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} kill matrix-synapse-admin 2>/dev/null || true' ExecStop=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} kill matrix-synapse-admin 2>/dev/null || true'
ExecStop=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} rm matrix-synapse-admin 2>/dev/null || true' ExecStop=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} rm matrix-synapse-admin 2>/dev/null || true'
Restart=always Restart=always
RestartSec=30 RestartSec=30
SyslogIdentifier=matrix-synapse-admin SyslogIdentifier=matrix-synapse-admin