Merge pull request #1782 from etkecc/matrix-bot-buscarron

add matrix-bot-buscarron
This commit is contained in:
Slavi Pantaleev 2022-04-25 09:44:35 +03:00 committed by GitHub
commit 49da9c76ac
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
17 changed files with 577 additions and 0 deletions

View file

@ -123,6 +123,8 @@ Using this playbook, you can get the following services configured on your serve
- (optional) the [Borg](https://borgbackup.org) backup - see [docs/configuring-playbook-backup-borg.md](docs/configuring-playbook-backup-borg.md) for setup documentation
- (optional) the [Buscarron](https://gitlab.com/etke.cc/buscarron) bot - see [docs/configuring-playbook-bot-buscarron.md](docs/configuring-playbook-bot-buscarron.md) for setup documentation
Basically, this playbook aims to get you up-and-running with all the necessities around Matrix, without you having to do anything else.
**Note**: the list above is exhaustive. It includes optional or even some advanced components that you will most likely not need.

View file

@ -38,6 +38,7 @@ If you are using Cloudflare DNS, make sure to disable the proxy and set all reco
| CNAME | `sygnal` | - | - | - | `matrix.<your-domain>` |
| CNAME | `hydrogen` | - | - | - | `matrix.<your-domain>` |
| CNAME | `cinny` | - | - | - | `matrix.<your-domain>` |
| CNAME | `buscarron` | - | - | - | `matrix.<your-domain>` |
## Subdomains setup
@ -60,6 +61,8 @@ The `hydrogen.<your-domain>` subdomain may be necessary, because this playbook c
The `cinny.<your-domain>` subdomain may be necessary, because this playbook could install the [Cinny](https://github.com/ajbura/cinny) web client. The installation of cinny is disabled by default, it is not a core required component. To learn how to install it, see our [configuring cinny guide](configuring-playbook-client-cinny.md). If you do not wish to set up cinny, feel free to skip the `cinny.<your-domain>` DNS record.
The `buscarron.<your-domain>` subdomain may be necessary, because this playbook could install the [buscarron](https://github.com/etke.cc/buscarron) bot. The installation of buscarron is disabled by default, it is not a core required component. To learn how to install it, see our [configuring buscarron guide](configuring-playbook-bot-buscarron.md). If you do not wish to set up buscarron, feel free to skip the `buscarron.<your-domain>` DNS record.
## `_matrix-identity._tcp` SRV record setup
To make the [ma1sd](https://github.com/ma1uta/ma1sd) Identity Server (which this playbook may optionally install for you) enable its federation features, set up an SRV record that looks like this:

View file

@ -0,0 +1,75 @@
# Setting up Buscarron (optional)
The playbook can install and configure [buscarron](https://gitlab.com/etke.cc/buscarron) for you.
It's a bot you can use to setup **your own helpdesk on matrix**
It's a bot you can use to send any form (HTTP POST, HTML) to a (encrypted) matrix room
## Registering the bot user
By default, the playbook will set up the bot with a username like this: `@bot.buscarron:DOMAIN`.
(to use a different username, adjust the `matrix_bot_buscarron_login` variable).
You **need to register the bot user manually** before setting up the bot. You can use the playbook to [register a new user](registering-users.md):
```
ansible-playbook -i inventory/hosts setup.yml --extra-vars='username=buscarron password=PASSWORD_FOR_THE_BOT admin=no' --tags=register-user
```
Choose a strong password for the bot. You can generate a good password with a command like this: `pwgen -s 64 1`.
## Adjusting the playbook configuration
Add the following configuration to your `inventory/host_vars/matrix.DOMAIN/vars.yml` file:
```yaml
matrix_bot_buscarron_enabled: true
# Adjust this to whatever password you chose when registering the bot user
matrix_bot_buscarron_password: PASSWORD_FOR_THE_BOT
# Adjust accepted forms
matrix_bot_buscarron_forms:
- name: contact # (mandatory) Your form name, will be used as endpoint, eg: buscarron.DOMAIN/contact
room: "!yourRoomID:DOMAIN" # (mandatory) Room ID where form submission will be posted
redirect: https://DOMAIN # (mandatory) To what page user will be redirected after the form submission
ratelimit: 1r/m # (optional) rate limit of the form, format: <max requests>r/<interval:s,m>, eg: 1r/s or 54r/m
extensions: [] # (optional) list of form extensions (not used yet)
matrix_bot_buscarron_spam_hosts: [] # (optional) list of email domains/hosts that should be rejected automatically
matrix_bot_buscarron_spam_emails: [] # (optional) list of email addresses that should be rejected automatically
```
You will also need to add a DNS record so that buscarron can be accessed.
By default buscarron will use https://buscarron.DOMAIN so you will need to create an CNAME record for `buscarron`.
See [Configuring DNS](configuring-dns.md).
If you would like to use a different domain, add the following to your configuration file (changing it to use your preferred domain):
```yaml
matrix_server_fqn_buscarron: "form.{{ matrix_domain }}"
```
## Installing
After configuring the playbook, run the [installation](installing.md) command again:
```
ansible-playbook -i inventory/hosts setup.yml --tags=setup-all,start
```
## Usage
To use the bot, invite the `@bot.buscarron:DOMAIN` to the room you specified in a config, after that any point your form to the form url, example for the `contact` form:
```html
<form method="POST" action="https://buscarron.DOMAIN/contact">
<!--your fields-->
</form>
```
You can also refer to the upstream [documentation](https://gitlab.com/etke.cc/buscarron).

View file

@ -1047,6 +1047,37 @@ matrix_bot_honoroit_container_image_self_build: "{{ matrix_architecture not in [
#
######################################################################
######################################################################
#
# matrix-bot-buscarron
#
######################################################################
# We don't enable bots by default.
matrix_bot_buscarron_enabled: false
matrix_bot_buscarron_systemd_required_services_list: |
{{
['docker.service']
+
(['matrix-postgres.service'] if matrix_postgres_enabled else [])
+
(['matrix-synapse.service'] if matrix_synapse_enabled else [])
+
(['matrix-nginx-proxy.service'] if matrix_nginx_proxy_enabled else [])
}}
# Postgres is the default, except if not using `matrix_postgres` (internal postgres)
matrix_bot_buscarron_database_engine: "{{ 'postgres' if matrix_postgres_enabled else 'sqlite' }}"
matrix_bot_buscarron_database_password: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'buscarron.bot.db') | to_uuid }}"
matrix_bot_buscarron_container_image_self_build: "{{ matrix_architecture not in ['amd64', 'arm32', 'arm64'] }}"
######################################################################
#
# /matrix-bot-buscarron
#
######################################################################
######################################################################
#
@ -1472,6 +1503,7 @@ matrix_nginx_proxy_proxy_matrix_enabled: true
matrix_nginx_proxy_proxy_element_enabled: "{{ matrix_client_element_enabled }}"
matrix_nginx_proxy_proxy_hydrogen_enabled: "{{ matrix_client_hydrogen_enabled }}"
matrix_nginx_proxy_proxy_cinny_enabled: "{{ matrix_client_cinny_enabled }}"
matrix_nginx_proxy_proxy_buscarron_enabled: "{{ matrix_bot_buscarron_enabled }}"
matrix_nginx_proxy_proxy_dimension_enabled: "{{ matrix_dimension_enabled }}"
matrix_nginx_proxy_proxy_bot_go_neb_enabled: "{{ matrix_bot_go_neb_enabled }}"
matrix_nginx_proxy_proxy_jitsi_enabled: "{{ matrix_jitsi_enabled }}"
@ -1556,6 +1588,8 @@ matrix_nginx_proxy_systemd_wanted_services_list: |
+
(['matrix-client-cinny.service'] if matrix_client_cinny_enabled else [])
+
(['matrix-bot-buscarron.service'] if matrix_bot_buscarron_enabled else [])
+
(['matrix-client-element.service'] if matrix_client_element_enabled else [])
+
(['matrix-client-hydrogen.service'] if matrix_client_hydrogen_enabled else [])
@ -1587,6 +1621,8 @@ matrix_ssl_domains_to_obtain_certificates_for: |
+
([matrix_server_fqn_cinny] if matrix_client_cinny_enabled else [])
+
([matrix_server_fqn_buscarron] if matrix_bot_buscarron_enabled else [])
+
([matrix_server_fqn_dimension] if matrix_dimension_enabled else [])
+
([matrix_server_fqn_bot_go_neb] if matrix_bot_go_neb_enabled else [])
@ -1698,6 +1734,12 @@ matrix_postgres_additional_databases: |
'password': matrix_bot_honoroit_database_password,
}] if (matrix_bot_honoroit_enabled and matrix_bot_honoroit_database_engine == 'postgres' and matrix_bot_honoroit_database_hostname == 'matrix-postgres') else [])
+
([{
'name': matrix_bot_buscarron_database_name,
'username': matrix_bot_buscarron_database_username,
'password': matrix_bot_buscarron_database_password,
}] if (matrix_bot_buscarron_enabled and matrix_bot_buscarron_database_engine == 'postgres' and matrix_bot_buscarron_database_hostname == 'matrix-postgres') else [])
+
([{
'name': matrix_registration_database_name,
'username': matrix_registration_database_username,

View file

@ -37,6 +37,9 @@ matrix_server_fqn_hydrogen: "hydrogen.{{ matrix_domain }}"
# This is where you access the Cinny web client from (if enabled via matrix_client_cinny_enabled; disabled by default).
matrix_server_fqn_cinny: "cinny.{{ matrix_domain }}"
# This is where you access the buscarron bot from (if enabled via matrix_bot_buscarron_enabled; disabled by default).
matrix_server_fqn_buscarron: "buscarron.{{ matrix_domain }}"
# This is where you access the Dimension.
matrix_server_fqn_dimension: "dimension.{{ matrix_domain }}"

View file

@ -0,0 +1,96 @@
---
# buscarron is a helpdesk bot
# See: https://gitlab.com/etke.cc/buscarron
matrix_bot_buscarron_enabled: true
matrix_bot_buscarron_container_image_self_build: false
matrix_bot_buscarron_docker_repo: "https://gitlab.com/etke.cc/buscarron.git"
matrix_bot_buscarron_docker_src_files_path: "{{ matrix_base_data_path }}/buscarron/docker-src"
matrix_bot_buscarron_version: v1.0.0
matrix_bot_buscarron_docker_image: "{{ matrix_bot_buscarron_docker_image_name_prefix }}buscarron:{{ matrix_bot_buscarron_version }}"
matrix_bot_buscarron_docker_image_name_prefix: "{{ 'localhost/' if matrix_bot_buscarron_container_image_self_build else 'registry.gitlab.com/etke.cc/' }}"
matrix_bot_buscarron_docker_image_force_pull: "{{ matrix_bot_buscarron_docker_image.endswith(':latest') }}"
matrix_bot_buscarron_base_path: "{{ matrix_base_data_path }}/buscarron"
matrix_bot_buscarron_config_path: "{{ matrix_bot_buscarron_base_path }}/config"
matrix_bot_buscarron_data_path: "{{ matrix_bot_buscarron_base_path }}/data"
matrix_bot_buscarron_data_store_path: "{{ matrix_bot_buscarron_data_path }}/store"
# A list of extra arguments to pass to the container
matrix_bot_buscarron_container_extra_arguments: []
# List of systemd services that matrix-bot-buscarron.service depends on
matrix_bot_buscarron_systemd_required_services_list: ['docker.service']
# List of systemd services that matrix-bot-buscarron.service wants
matrix_bot_buscarron_systemd_wanted_services_list: []
# Database-related configuration fields.
#
# To use SQLite, stick to these defaults.
#
# To use Postgres:
# - change the engine (`matrix_bot_buscarron_database_engine: 'postgres'`)
# - adjust your database credentials via the `matrix_bot_buscarron_database_*` variables
matrix_bot_buscarron_database_engine: 'sqlite'
matrix_bot_buscarron_sqlite_database_path_local: "{{ matrix_bot_buscarron_data_path }}/bot.db"
matrix_bot_buscarron_sqlite_database_path_in_container: "/data/bot.db"
matrix_bot_buscarron_database_username: 'buscarron'
matrix_bot_buscarron_database_password: 'some-password'
matrix_bot_buscarron_database_hostname: 'matrix-postgres'
matrix_bot_buscarron_database_port: 5432
matrix_bot_buscarron_database_name: 'buscarron'
matrix_bot_buscarron_database_connection_string: 'postgres://{{ matrix_bot_buscarron_database_username }}:{{ matrix_bot_buscarron_database_password }}@{{ matrix_bot_buscarron_database_hostname }}:{{ matrix_bot_buscarron_database_port }}/{{ matrix_bot_buscarron_database_name }}?sslmode=disable'
matrix_bot_buscarron_storage_database: "{{
{
'sqlite': matrix_bot_buscarron_sqlite_database_path_in_container,
'postgres': matrix_bot_buscarron_database_connection_string,
}[matrix_bot_buscarron_database_engine]
}}"
matrix_bot_buscarron_database_dialect: "{{
{
'sqlite': 'sqlite3',
'postgres': 'postgres',
}[matrix_bot_buscarron_database_engine]
}}"
# The bot's username. This user needs to be created manually beforehand.
# Also see `matrix_bot_buscarron_password`.
matrix_bot_buscarron_login: "bot.buscarron"
# The password that the bot uses to authenticate.
matrix_bot_buscarron_password: ''
# the homeserver URL, uses internal synapse container address by default
matrix_bot_buscarron_homeserver: "{{ matrix_homeserver_container_url }}"
# forms configuration
matrix_bot_buscarron_forms: []
# Sentry DSN
matrix_bot_buscarron_sentry:
# Log level
matrix_bot_buscarron_loglevel: INFO
# spam hosts/domains
matrix_bot_buscarron_spam_hosts: []
# spam email addresses
matrix_bot_buscarron_spam_emails: []
# Additional environment variables to pass to the buscarron container
#
# Example:
# matrix_bot_buscarron_environment_variables_extension: |
# BUSCARRON_LOGLEVEL=DEBUG
matrix_bot_buscarron_environment_variables_extension: ''

View file

@ -0,0 +1,5 @@
---
- set_fact:
matrix_systemd_services_list: "{{ matrix_systemd_services_list + ['matrix-bot-buscarron.service'] }}"
when: matrix_bot_buscarron_enabled|bool

View file

@ -0,0 +1,23 @@
---
- import_tasks: "{{ role_path }}/tasks/init.yml"
tags:
- always
- import_tasks: "{{ role_path }}/tasks/validate_config.yml"
when: "run_setup|bool and matrix_bot_buscarron_enabled|bool"
tags:
- setup-all
- setup-bot-buscarron
- import_tasks: "{{ role_path }}/tasks/setup_install.yml"
when: "run_setup|bool and matrix_bot_buscarron_enabled|bool"
tags:
- setup-all
- setup-bot-buscarron
- import_tasks: "{{ role_path }}/tasks/setup_uninstall.yml"
when: "run_setup|bool and not matrix_bot_buscarron_enabled|bool"
tags:
- setup-all
- setup-bot-buscarron

View file

@ -0,0 +1,100 @@
---
- set_fact:
matrix_bot_buscarron_requires_restart: false
- block:
- name: Check if an SQLite database already exists
stat:
path: "{{ matrix_bot_buscarron_sqlite_database_path_local }}"
register: matrix_bot_buscarron_sqlite_database_path_local_stat_result
- block:
- set_fact:
matrix_postgres_db_migration_request:
src: "{{ matrix_bot_buscarron_sqlite_database_path_local }}"
dst: "{{ matrix_bot_buscarron_database_connection_string }}"
caller: "{{ role_path|basename }}"
engine_variable_name: 'matrix_bot_buscarron_database_engine'
engine_old: 'sqlite'
systemd_services_to_stop: ['matrix-bot-buscarron.service']
- import_tasks: "{{ role_path }}/../matrix-postgres/tasks/util/migrate_db_to_postgres.yml"
- set_fact:
matrix_bot_buscarron_requires_restart: true
when: "matrix_bot_buscarron_sqlite_database_path_local_stat_result.stat.exists|bool"
when: "matrix_bot_buscarron_database_engine == 'postgres'"
- name: Ensure buscarron paths exist
file:
path: "{{ item.path }}"
state: directory
mode: 0750
owner: "{{ matrix_user_username }}"
group: "{{ matrix_user_groupname }}"
with_items:
- {path: "{{ matrix_bot_buscarron_config_path }}", when: true}
- {path: "{{ matrix_bot_buscarron_data_path }}", when: true}
- {path: "{{ matrix_bot_buscarron_data_store_path }}", when: true}
- {path: "{{ matrix_bot_buscarron_docker_src_files_path }}", when: true}
when: "item.when|bool"
- name: Ensure buscarron environment variables file created
template:
src: "{{ role_path }}/templates/env.j2"
dest: "{{ matrix_bot_buscarron_config_path }}/env"
owner: "{{ matrix_user_username }}"
group: "{{ matrix_user_groupname }}"
mode: 0640
- name: Ensure buscarron image is pulled
docker_image:
name: "{{ matrix_bot_buscarron_docker_image }}"
source: "{{ 'pull' if ansible_version.major > 2 or ansible_version.minor > 7 else omit }}"
force_source: "{{ matrix_bot_buscarron_docker_image_force_pull if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}"
force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else matrix_bot_buscarron_docker_image_force_pull }}"
when: "not matrix_bot_buscarron_container_image_self_build|bool"
register: result
retries: "{{ matrix_container_retries_count }}"
delay: "{{ matrix_container_retries_delay }}"
until: result is not failed
- name: Ensure buscarron repository is present on self-build
git:
repo: "{{ matrix_bot_buscarron_docker_repo }}"
dest: "{{ matrix_bot_buscarron_docker_src_files_path }}"
force: "yes"
become: true
become_user: "{{ matrix_user_username }}"
register: matrix_bot_buscarron_git_pull_results
when: "matrix_bot_buscarron_container_image_self_build|bool"
- name: Ensure buscarron image is built
docker_image:
name: "{{ matrix_bot_buscarron_docker_image }}"
source: build
force_source: "{{ matrix_bot_buscarron_git_pull_results.changed if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}"
force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else matrix_mailer_git_pull_results.changed }}"
build:
dockerfile: Dockerfile
path: "{{ matrix_bot_buscarron_docker_src_files_path }}"
pull: true
when: "matrix_bot_buscarron_container_image_self_build|bool"
- name: Ensure matrix-bot-buscarron.service installed
template:
src: "{{ role_path }}/templates/systemd/matrix-bot-buscarron.service.j2"
dest: "{{ matrix_systemd_path }}/matrix-bot-buscarron.service"
mode: 0644
register: matrix_bot_buscarron_systemd_service_result
- name: Ensure systemd reloaded after matrix-bot-buscarron.service installation
service:
daemon_reload: true
when: "matrix_bot_buscarron_systemd_service_result.changed|bool"
- name: Ensure matrix-bot-buscarron.service restarted, if necessary
service:
name: "matrix-bot-buscarron.service"
state: restarted
when: "matrix_bot_buscarron_requires_restart|bool"

View file

@ -0,0 +1,36 @@
---
- name: Check existence of matrix-buscarron service
stat:
path: "{{ matrix_systemd_path }}/matrix-bot-buscarron.service"
register: matrix_bot_buscarron_service_stat
- name: Ensure matrix-buscarron is stopped
service:
name: matrix-bot-buscarron
state: stopped
enabled: false
daemon_reload: true
register: stopping_result
when: "matrix_bot_buscarron_service_stat.stat.exists|bool"
- name: Ensure matrix-bot-buscarron.service doesn't exist
file:
path: "{{ matrix_systemd_path }}/matrix-bot-buscarron.service"
state: absent
when: "matrix_bot_buscarron_service_stat.stat.exists|bool"
- name: Ensure systemd reloaded after matrix-bot-buscarron.service removal
service:
daemon_reload: true
when: "matrix_bot_buscarron_service_stat.stat.exists|bool"
- name: Ensure Matrix buscarron paths don't exist
file:
path: "{{ matrix_bot_buscarron_base_path }}"
state: absent
- name: Ensure buscarron Docker image doesn't exist
docker_image:
name: "{{ matrix_bot_buscarron_docker_image }}"
state: absent

View file

@ -0,0 +1,9 @@
---
- name: Fail if required settings not defined
fail:
msg: >-
You need to define a required configuration setting (`{{ item }}`).
when: "vars[item] == ''"
with_items:
- "matrix_bot_buscarron_password"

View file

@ -0,0 +1,19 @@
BUSCARRON_LOGIN={{ matrix_bot_buscarron_login }}
BUSCARRON_PASSWORD={{ matrix_bot_buscarron_password }}
BUSCARRON_HOMESERVER={{ matrix_bot_buscarron_homeserver }}
BUSCARRON_DB_DSN={{ matrix_bot_buscarron_database_connection_string }}
BUSCARRON_DB_DIALECT={{ matrix_bot_buscarron_database_dialect }}
BUSCARRON_SPAM_HOSTS={{ matrix_bot_buscarron_spam_hosts|join(" ") }}
BUSCARRON_SPAM_EMAILS={{ matrix_bot_buscarron_spam_emails|join(" ") }}
BUSCARRON_SENTRY={{ matrix_bot_buscarron_sentry }}
BUSCARRON_LOGLEVEL={{ matrix_bot_buscarron_loglevel }}
{% set forms = [] %}
{% for form in matrix_bot_buscarron_forms -%}{{- forms.append(form.name) -}}
BUSCARRON_{{ form.name|upper }}_ROOM={{ form.room|default('') }}
BUSCARRON_{{ form.name|upper }}_REDIRECT={{ form.redirect|default('') }}
BUSCARRON_{{ form.name|upper }}_RATELIMIT={{ form.ratelimit|default('') }}
BUSCARRON_{{ form.name|upper }}_EXTENSIONS={{ form.extensions|default('')|join(' ') }}
{% endfor %}
BUSCARRON_LIST={{ forms|join(" ") }}
{{ matrix_bot_buscarron_environment_variables_extension }}

View file

@ -0,0 +1,39 @@
#jinja2: lstrip_blocks: "True"
[Unit]
Description=Matrix web forms bot
{% for service in matrix_bot_buscarron_systemd_required_services_list %}
Requires={{ service }}
After={{ service }}
{% endfor %}
{% for service in matrix_bot_buscarron_systemd_wanted_services_list %}
Wants={{ service }}
{% endfor %}
DefaultDependencies=no
[Service]
Type=simple
Environment="HOME={{ matrix_systemd_unit_home_path }}"
ExecStartPre=-{{ matrix_host_command_sh }} -c '{{ matrix_host_command_docker }} kill matrix-bot-buscarron 2>/dev/null || true'
ExecStartPre=-{{ matrix_host_command_sh }} -c '{{ matrix_host_command_docker }} rm matrix-bot-buscarron 2>/dev/null || true'
ExecStart={{ matrix_host_command_docker }} run --rm --name matrix-bot-buscarron \
--log-driver=none \
--user={{ matrix_user_uid }}:{{ matrix_user_gid }} \
--cap-drop=ALL \
--read-only \
--network={{ matrix_docker_network }} \
--env-file={{ matrix_bot_buscarron_config_path }}/env \
--mount type=bind,src={{ matrix_bot_buscarron_data_path }},dst=/data \
{% for arg in matrix_bot_buscarron_container_extra_arguments %}
{{ arg }} \
{% endfor %}
{{ matrix_bot_buscarron_docker_image }}
ExecStop=-{{ matrix_host_command_sh }} -c '{{ matrix_host_command_docker }} kill matrix-bot-buscarron 2>/dev/null || true'
ExecStop=-{{ matrix_host_command_sh }} -c '{{ matrix_host_command_docker }} rm matrix-bot-buscarron 2>/dev/null || true'
Restart=always
RestartSec=30
SyslogIdentifier=matrix-bot-buscarron
[Install]
WantedBy=multi-user.target

View file

@ -159,6 +159,10 @@ matrix_nginx_proxy_proxy_hydrogen_hostname: "{{ matrix_server_fqn_hydrogen }}"
matrix_nginx_proxy_proxy_cinny_enabled: false
matrix_nginx_proxy_proxy_cinny_hostname: "{{ matrix_server_fqn_cinny }}"
# Controls whether proxying the buscarron domain should be done.
matrix_nginx_proxy_proxy_buscarron_enabled: false
matrix_nginx_proxy_proxy_buscarron_hostname: "{{ matrix_server_fqn_buscarron }}"
# Controls whether proxying the matrix domain should be done.
matrix_nginx_proxy_proxy_matrix_enabled: false
matrix_nginx_proxy_proxy_matrix_hostname: "{{ matrix_server_fqn_matrix }}"
@ -304,6 +308,9 @@ matrix_nginx_proxy_proxy_hydrogen_additional_server_configuration_blocks: []
# A list of strings containing additional configuration blocks to add to Cinny's server configuration (matrix-client-cinny.conf).
matrix_nginx_proxy_proxy_cinny_additional_server_configuration_blocks: []
# A list of strings containing additional configuration blocks to add to buscarron's server configuration (matrix-bot-buscarron.conf).
matrix_nginx_proxy_proxy_buscarron_additional_server_configuration_blocks: []
# A list of strings containing additional configuration blocks to add to Dimension's server configuration (matrix-dimension.conf).
matrix_nginx_proxy_proxy_dimension_additional_server_configuration_blocks: []

View file

@ -110,6 +110,13 @@
mode: 0644
when: matrix_nginx_proxy_proxy_cinny_enabled|bool
- name: Ensure Matrix nginx-proxy configuration for buscarron domain exists
template:
src: "{{ role_path }}/templates/nginx/conf.d/matrix-bot-buscarron.conf.j2"
dest: "{{ matrix_nginx_proxy_confd_path }}/matrix-bot-buscarron.conf"
mode: 0644
when: matrix_nginx_proxy_proxy_buscarron_enabled|bool
- name: Ensure Matrix nginx-proxy configuration for dimension domain exists
template:
src: "{{ role_path }}/templates/nginx/conf.d/matrix-dimension.conf.j2"
@ -259,6 +266,12 @@
state: absent
when: "not matrix_nginx_proxy_proxy_cinny_enabled|bool"
- name: Ensure Matrix nginx-proxy configuration for buscarron domain deleted
file:
path: "{{ matrix_nginx_proxy_confd_path }}/matrix-bot-buscarron.conf"
state: absent
when: "not matrix_nginx_proxy_proxy_buscarron_enabled|bool"
- name: Ensure Matrix nginx-proxy configuration for dimension domain deleted
file:
path: "{{ matrix_nginx_proxy_confd_path }}/matrix-dimension.conf"

View file

@ -0,0 +1,104 @@
#jinja2: lstrip_blocks: "True"
{% macro render_vhost_directives() %}
gzip on;
gzip_types text/plain application/json application/javascript text/css image/x-icon font/ttf image/gif;
{% if matrix_nginx_proxy_hsts_preload_enabled %}
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
{% else %}
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
{% endif %}
add_header X-XSS-Protection "{{ matrix_nginx_proxy_xss_protection }}";
add_header X-Content-Type-Options nosniff;
add_header X-Frame-Options SAMEORIGIN;
add_header Content-Security-Policy "frame-ancestors 'none'";
{% if matrix_nginx_proxy_floc_optout_enabled %}
add_header Permissions-Policy interest-cohort=() always;
{% endif %}
{% for configuration_block in matrix_nginx_proxy_proxy_buscarron_additional_server_configuration_blocks %}
{{- configuration_block }}
{% endfor %}
location / {
{% if matrix_nginx_proxy_enabled %}
{# Use the embedded DNS resolver in Docker containers to discover the service #}
resolver 127.0.0.11 valid=5s;
set $backend "matrix-bot-buscarron:8080";
proxy_pass http://$backend;
{% else %}
{# Generic configuration for use outside of our container setup #}
proxy_pass http://127.0.0.1:8080;
{% endif %}
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For {{ matrix_nginx_proxy_x_forwarded_for }};
}
{% endmacro %}
server {
listen {{ 8080 if matrix_nginx_proxy_enabled else 80 }};
listen [::]:{{ 8080 if matrix_nginx_proxy_enabled else 80 }};
server_name {{ matrix_nginx_proxy_proxy_buscarron_hostname }};
server_tokens off;
root /dev/null;
{% if matrix_nginx_proxy_https_enabled %}
location /.well-known/acme-challenge {
{% if matrix_nginx_proxy_enabled %}
{# Use the embedded DNS resolver in Docker containers to discover the service #}
resolver 127.0.0.11 valid=5s;
set $backend "matrix-certbot:8080";
proxy_pass http://$backend;
{% else %}
{# Generic configuration for use outside of our container setup #}
proxy_pass http://127.0.0.1:{{ matrix_ssl_lets_encrypt_certbot_standalone_http_port }};
{% endif %}
}
location / {
return 301 https://$http_host$request_uri;
}
{% else %}
{{ render_vhost_directives() }}
{% endif %}
}
{% if matrix_nginx_proxy_https_enabled %}
server {
listen {{ 8443 if matrix_nginx_proxy_enabled else 443 }} ssl http2;
listen [::]:{{ 8443 if matrix_nginx_proxy_enabled else 443 }} ssl http2;
server_name {{ matrix_nginx_proxy_proxy_buscarron_hostname }};
server_tokens off;
root /dev/null;
ssl_certificate {{ matrix_ssl_config_dir_path }}/live/{{ matrix_nginx_proxy_proxy_buscarron_hostname }}/fullchain.pem;
ssl_certificate_key {{ matrix_ssl_config_dir_path }}/live/{{ matrix_nginx_proxy_proxy_buscarron_hostname }}/privkey.pem;
ssl_protocols {{ matrix_nginx_proxy_ssl_protocols }};
{% if matrix_nginx_proxy_ssl_ciphers != "" %}
ssl_ciphers {{ matrix_nginx_proxy_ssl_ciphers }};
{% endif %}
ssl_prefer_server_ciphers {{ matrix_nginx_proxy_ssl_prefer_server_ciphers }};
{% if matrix_nginx_proxy_ocsp_stapling_enabled %}
ssl_stapling on;
ssl_stapling_verify on;
ssl_trusted_certificate {{ matrix_ssl_config_dir_path }}/live/{{ matrix_nginx_proxy_proxy_buscarron_hostname }}/chain.pem;
{% endif %}
{% if matrix_nginx_proxy_ssl_session_tickets_off %}
ssl_session_tickets off;
{% endif %}
ssl_session_cache {{ matrix_nginx_proxy_ssl_session_cache }};
ssl_session_timeout {{ matrix_nginx_proxy_ssl_session_timeout }};
{{ render_vhost_directives() }}
}
{% endif %}

View file

@ -38,6 +38,7 @@
- matrix-bridge-hookshot
- matrix-bot-matrix-reminder-bot
- matrix-bot-matrix-registration-bot
- matrix-bot-buscarron
- matrix-bot-honoroit
- matrix-bot-go-neb
- matrix-bot-mjolnir