Merge branch 'master' into synapse-workers

This commit is contained in:
Slavi Pantaleev 2021-02-14 13:00:57 +02:00
commit 5cfeae806b
69 changed files with 1694 additions and 56 deletions

View file

@ -1,3 +1,23 @@
# 2021-02-12
## (Potential Breaking Change) Monitoring/metrics support using Prometheus and Grafana
Thanks to [@Peetz0r](https://github.com/Peetz0r), the playbook can now install a bunch of tools for monitoring your Matrix server: the [Prometheus](https://prometheus.io) time-series database server, the Prometheus [node-exporter](https://prometheus.io/docs/guides/node-exporter/) host metrics exporter, and the [Grafana](https://grafana.com/) web UI.
To get get these installed, follow our [Enabling metrics and graphs (Prometheus, Grafana) for your Matrix server](docs/configuring-playbook-prometheus-grafana.md) docs page.
This update comes with a **potential breaking change** for people who were already exposing Synapse metrics (for consumption via another Prometheus installation). From now on, `matrix_synapse_metrics_enabled: true` no longer exposes metrics publicly via matrix-nginx-proxy (at `https://matrix.DOMAIN/_synapse/metrics`). To do so, you'd need to explicitly set `matrix_nginx_proxy_proxy_synapse_metrics: true`.
# 2021-01-31
## Etherpad support
Thanks to [@pushytoxin](https://github.com/pushytoxin), the playbook can now install the [Etherpad](https://etherpad.org) realtime collaborative text editor. It can be used in a [Jitsi](https://jitsi.org/) audio/video call or integrated as a widget into Matrix chat rooms via the [Dimension](https://dimension.t2bot.io) integration manager.
To get it installed, follow [our Etherpad docs page](docs/configuring-playbook-etherpad.md).
# 2021-01-22
## (Breaking Change) Postgres changes that require manual intervention

View file

@ -63,20 +63,26 @@ Using this playbook, you can get the following services configured on your serve
- (optional) the [matrix-appservice-webhooks](https://github.com/turt2live/matrix-appservice-webhooks) bridge for slack compatible webhooks ([ConcourseCI](https://concourse-ci.org/), [Slack](https://slack.com/) etc. pp.)
- (optional) the [matrix-sms-bridge](https://github.com/benkuly/matrix-sms-bridge) for bridging your Matrix server to SMS - see [docs/configuring-playbook-bridge-matrix-bridge-sms.md](docs/configuring-playbook-bridge-matrix-bridge-sms.md) for setup documentation
- (optional) the [mx-puppet-skype](https://hub.docker.com/r/sorunome/mx-puppet-skype) for bridging your Matrix server to [Skype](https://www.skype.com) - see [docs/configuring-playbook-bridge-mx-puppet-skype.md](docs/configuring-playbook-bridge-mx-puppet-skype.md) for setup documentation
- (optional) the [mx-puppet-slack](https://hub.docker.com/r/sorunome/mx-puppet-slack) for bridging your Matrix server to [Slack](https://slack.com) - see [docs/configuring-playbook-bridge-mx-puppet-slack.md](docs/configuring-playbook-bridge-mx-puppet-slack.md) for setup documentation
- (optional) the [mx-puppet-instagram](https://github.com/Sorunome/mx-puppet-instagram) bridge for Instagram-DMs ([Instagram](https://www.instagram.com/)) - see [docs/configuring-playbook-bridge-mx-puppet-instagram.md](docs/configuring-playbook-bridge-mx-puppet-instagram.md) for setup documentation
- (optional) the [mx-puppet-twitter](https://github.com/Sorunome/mx-puppet-twitter) bridge for Twitter-DMs ([Twitter](https://twitter.com/) - see [docs/configuring-playbook-bridge-mx-puppet-twitter.md](docs/configuring-playbook-bridge-mx-puppet-twitter.md) for setup documentation
- (optional) the [mx-puppet-twitter](https://github.com/Sorunome/mx-puppet-twitter) bridge for Twitter-DMs ([Twitter](https://twitter.com/)) - see [docs/configuring-playbook-bridge-mx-puppet-twitter.md](docs/configuring-playbook-bridge-mx-puppet-twitter.md) for setup documentation
- (optional) the [mx-puppet-discord](https://github.com/matrix-discord/mx-puppet-discord) bridge for [Discord](https://discordapp.com/)) - see [docs/configuring-playbook-bridge-mx-puppet-discord.md](docs/configuring-playbook-bridge-mx-puppet-discord.md) for setup documentation
- (optional) the [mx-puppet-discord](https://github.com/matrix-discord/mx-puppet-discord) bridge for [Discord](https://discordapp.com/) - see [docs/configuring-playbook-bridge-mx-puppet-discord.md](docs/configuring-playbook-bridge-mx-puppet-discord.md) for setup documentation
- (optional) the [mx-puppet-steam](https://github.com/icewind1991/mx-puppet-steam) bridge for [Steam](https://steamapp.com/)) - see [docs/configuring-playbook-bridge-mx-puppet-steam.md](docs/configuring-playbook-bridge-mx-puppet-steam.md) for setup documentation
- (optional) the [matrix-sms-bridge](https://github.com/benkuly/matrix-sms-bridge) for bridging your Matrix server to SMS - see [docs/configuring-playbook-bridge-matrix-bridge-sms.md](docs/configuring-playbook-bridge-matrix-bridge-sms.md) for setup documentation
- (optional) the [mx-puppet-steam](https://github.com/icewind1991/mx-puppet-steam) bridge for [Steam](https://steamapp.com/) - see [docs/configuring-playbook-bridge-mx-puppet-steam.md](docs/configuring-playbook-bridge-mx-puppet-steam.md) for setup documentation
- (optional) [Email2Matrix](https://github.com/devture/email2matrix) for relaying email messages to Matrix rooms - see [docs/configuring-playbook-email2matrix.md](docs/configuring-playbook-email2matrix.md) for setup documentation
- (optional) [Dimension](https://github.com/turt2live/matrix-dimension), an open source integrations manager for matrix clients - see [docs/configuring-playbook-dimension.md](docs/configuring-playbook-dimension.md) for setup documentation
- (optional) [Etherpad](https://etherpad.org), an open source collaborative text editor - see [docs/configuring-playbook-etherpad.md](docs/configuring-playbook-etherpad.md) for setup documentation
- (optional) [Jitsi](https://jitsi.org/), an open source video-conferencing platform - see [docs/configuring-playbook-jitsi.md](docs/configuring-playbook-jitsi.md) for setup documentation
- (optional) [matrix-reminder-bot](https://github.com/anoadragon453/matrix-reminder-bot) for scheduling one-off & recurring reminders and alarms - see [docs/configuring-playbook-bot-matrix-reminder-bot.md](docs/configuring-playbook-bot-matrix-reminder-bot.md) for setup documentation
@ -85,6 +91,8 @@ Using this playbook, you can get the following services configured on your serve
- (optional) [matrix-registration](https://github.com/ZerataX/matrix-registration), a simple python application to have a token based matrix registration - see [docs/configuring-playbook-matrix-registration.md](docs/configuring-playbook-matrix-registration.md) for setup documentation
- (optional) the [Prometheus](https://prometheus.io) time-series database server, the Prometheus [node-exporter](https://prometheus.io/docs/guides/node-exporter/) host metrics exporter, and the [Grafana](https://grafana.com/) web UI - see [Enabling metrics and graphs (Prometheus, Grafana) for your Matrix server](docs/configuring-playbook-prometheus-grafana.md) for setup documentation
Basically, this playbook aims to get you up-and-running with all the basic necessities around Matrix, without you having to do anything else.
**Note**: the list above is exhaustive. It includes optional or even some advanced components that you will most likely not need.

View file

@ -15,20 +15,25 @@ As we discuss in [Server Delegation](howto-server-delegation.md), there are 2 di
This playbook mostly discusses the well-known file method, because it's easier to manage with regard to certificates.
If you decide to go with the alternative method ([Server Delegation via a DNS SRV record (advanced)](howto-server-delegation.md#server-delegation-via-a-dns-srv-record-advanced)), please be aware that the general flow that this playbook guides you through may not match what you need to do.
## General outline of DNS settings you need to do
## Required DNS settings for services enabled by default
| Type | Host | Priority | Weight | Port | Target |
| ----- | ---------------------------- | -------- | ------ | ---- | ---------------------- |
| A | `matrix` | - | - | - | `matrix-server-IP` |
| CNAME | `element` | - | - | - | `matrix.<your-domain>` |
| CNAME | `dimension` (*) | - | - | - | `matrix.<your-domain>` |
| CNAME | `jitsi` (*) | - | - | - | `matrix.<your-domain>` |
| SRV | `_matrix-identity._tcp` | 10 | 0 | 443 | `matrix.<your-domain>` |
Be mindful as to how long it will take for the DNS records to propagate.
DNS records marked with `(*)` above are optional. They refer to services that will not be installed by default (see the section below). If you won't be installing these services, feel free to skip creating these DNS records. Also be mindful as to how long it will take for the DNS records to propagate.
If you are using Cloudflare DNS, make sure to disable the proxy and set all records to `DNS only`. Otherwise, fetching certificates will fail.
## Required DNS settings for optional services
| Type | Host | Priority | Weight | Port | Target |
| ----- | ---------------------------- | -------- | ------ | ---- | ---------------------- |
| CNAME | `dimension` (*) | - | - | - | `matrix.<your-domain>` |
| CNAME | `jitsi` (*) | - | - | - | `matrix.<your-domain>` |
| CNAME | `stats` (*) | - | - | - | `matrix.<your-domain>` |
## Subdomains setup
@ -41,6 +46,8 @@ The `dimension.<your-domain>` subdomain may be necessary, because this playbook
The `jitsi.<your-domain>` subdomain may be necessary, because this playbook could install the [Jitsi video-conferencing platform](https://jitsi.org/) for you. Jitsi installation is disabled by default, because it may be heavy and is not a core required component. To learn how to install it, see our [Jitsi](configuring-playbook-jitsi.md) guide. If you do not wish to set up Jitsi, feel free to skip the `jitsi.<your-domain>` DNS record.
The `stats.<your-domain>` subdomain may be necessary, because this playbook could install [Grafana](https://grafana.com/) and setup performance metrics for you. Grafana installation is disabled by default, it is not a core required component. To learn how to install it, see our [metrics and graphs guide](configuring-playbook-prometheus-grafana.md). If you do not wish to set up Grafana, feel free to skip the `stats.<your-domain>` DNS record. It is possible to install Prometheus without installing Grafana, this would also not require the `stats.<your-domain>` subdomain.
## `_matrix-identity._tcp` SRV record setup

View file

@ -14,7 +14,7 @@ matrix_mautrix_signal_enabled: true
## Set up Double Puppeting
If you'd like to use [Double Puppeting](https://github.com/tulir/mautrix-whatsapp/wiki/Authentication#replacing-whatsapp-accounts-matrix-puppet-with-matrix-account) (hint: you most likely do), you have 2 ways of going about it.
If you'd like to use [Double Puppeting](https://github.com/tulir/mautrix-signal/wiki/Authentication#double-puppeting) (hint: you most likely do), you have 2 ways of going about it.
### Method 1: automatically, by enabling Shared Secret Auth

View file

@ -0,0 +1,31 @@
# Setting up Etherpad (optional)
[Etherpad](https://etherpad.org) is is an open source collaborative text editor that can be embedded in a Matrix chat room using the [Dimension integrations manager](https://dimension.t2bot.io)
When enabled together with the Jitsi audio/video conferencing system (see [our docs on Jitsi](configuring-playbook-jitsi.md)), it will be made available as an option during the conferences.
## Prerequisites
For the self-hosted Etherpad instance to be available to your users, you must first enable and configure the **Dimension integrations manager** as described in [the playbook documentation](configuring-playbook-dimension.md)
## Installing
[Etherpad](https://etherpad.org) installation is disabled by default. You can enable it in your configuration file (`inventory/host_vars/matrix.<your-domain>/vars.yml`):
```yaml
matrix_etherpad_enabled: true
```
## Set Dimension default to the self-hosted Etherpad
The Dimension administrator users can configure the default URL template. The Dimension configuration menu can be accessed with the sprocket icon as you begin to add a widget to a room in Element. There you will find the Etherpad Widget Configuration action beneath the _Widgets_ tab. Replace `scalar.vector.im` with your own Dimension domain.
### Removing the integrated Etherpad chat
If you wish to disable the Etherpad chat button, you can do it by appending `?showChat=false` to the end of the pad URL, or the template.
Example: `https://dimension.<your-domain>/etherpad/p/$roomId_$padName?showChat=false`
## Known issues
If your Etherpad widget fails to load, this might be due to Dimension generating a Pad name so long, the Etherpad app rejects it.
`$roomId_$padName` can end up being longer than 50 characters. You can avoid having this problem by altering the template so it only contains the three word random identifier `$padName`.

View file

@ -34,8 +34,7 @@ Possible values are:
- `"intermediate"` (**default**) - Recommended configuration for a general-purpose server
- `"old"` - Services accessed by very old clients or libraries, such as Internet Explorer 8 (Windows XP), Java 6, or OpenSSL 0.9.8
**Be really carefull when setting it to `"modern"`**. This could break comunication with other Matrix servers, limiting your federation posibilities. The
[Federarion tester](https://federationtester.matrix.org/) also won't work.
**Be really carefull when setting it to `"modern"`**. This could break comunication with other Matrix servers, limiting your federation posibilities.
Besides changing the preset (`matrix_nginx_proxy_ssl_preset`), you can also directly override these 3 variables:
@ -60,3 +59,26 @@ This will disable the access logging for nginx.
```yaml
matrix_nginx_proxy_access_log_enabled: false
```
## Additional configuration
This playbook also allows for additional configuration to be applied to the nginx server.
If you want this playbook to obtain and renew certificates for other domains, then you can set the `matrix_ssl_additional_domains_to_obtain_certificates_for` variable (as mentioned in the [Obtaining SSL certificates for additional domains](configuring-playbook-ssl-certificates.md#obtaining-ssl-certificates-for-additional-domains) documentation as well). Make sure that you have set the DNS configuration for the domains you want to include to point at your server.
```yaml
matrix_ssl_additional_domains_to_obtain_certificates_for:
- domain.one.example
- domain.two.example
```
You can include additional nginx configuration by setting the `matrix_nginx_proxy_proxy_http_additional_server_configuration_blocks` variable.
```yaml
matrix_nginx_proxy_proxy_http_additional_server_configuration_blocks:
- |
# These lines will be included in the nginx configuration.
# This is at the top level of the file, so you will need to define all of the `server { ... }` blocks.
- |
# For advanced use, have a look at the template files in `roles/matrix-nginx-proxy/templates/nginx/conf.d`
```

View file

@ -0,0 +1,66 @@
# Enabling metrics and graphs for your Matrix server (optional)
It can be useful to have some (visual) insight into the performance of your homeserver.
You can enable this with the following settings in your configuration file (`inventory/host_vars/matrix.<your-domain>/vars.yml`):
```yaml
matrix_prometheus_enabled: true
matrix_prometheus_node_exporter_enabled: true
matrix_grafana_enabled: true
matrix_grafana_anonymous_access: false
# This has no relation to your Matrix user id. It can be any username you'd like.
# Changing the username subsequently won't work.
matrix_grafana_default_admin_user: some_username_chosen_by_you
# Passwords containing special characters may be troublesome.
# Changing the password subsequently won't work.
matrix_grafana_default_admin_password: some_strong_password_chosen_by_you
```
By default, a [Grafana](https://grafana.com/) web user-interface will be available at `https://stats.<your-domain>`.
## What does it do?
Name | Description
-----|----------
`matrix_prometheus_enabled`|[Prometheus](https://prometheus.io) is a time series database. It holds all the data we're going to talk about.
`matrix_prometheus_node_exporter_enabled`|[Node Exporter](https://prometheus.io/docs/guides/node-exporter/) is an addon of sorts to Prometheus that collects generic system information such as CPU, memory, filesystem, and even system temperatures
`matrix_grafana_enabled`|[Grafana](https://grafana.com/) is the visual component. It shows (on the `stats.<your-domain>` subdomain) the dashboards with the graphs that we're interested in
`matrix_grafana_anonymous_access`|By default you need to log in to see graphs. If you want to publicly share your graphs (e.g. when asking for help in [`#synapse:matrix.org`](https://matrix.to/#/#synapse:matrix.org?via=matrix.org&via=privacytools.io&via=mozilla.org)) you'll want to enable this option.
`matrix_grafana_default_admin_user`<br>`matrix_grafana_default_admin_password`|By default Grafana creates a user with `admin` as the username and password. If you feel this is insecure and you want to change it beforehand, you can do that here
## Security and privacy
Metrics and resulting graphs can contain a lot of information. This includes system specs but also usage patterns. This applies especially to small personal/family scale homeservers. Someone might be able to figure out when you wake up and go to sleep by looking at the graphs over time. Think about this before enabling anonymous access. And you should really not forget to change your Grafana password.
Most of our docker containers run with limited system access, but the `prometheus-node-exporter` has access to the host network stack and (readonly) root filesystem. This is required to report on them. If you don't like that, you can set `matrix_prometheus_node_exporter_enabled: false` (which is actually the default). You will still get Synapse metrics with this container disabled. Both of the dashboards will always be enabled, so you can still look at historical data after disabling either source.
## Collecting metrics to an external Prometheus server
If you wish, you could expose homeserver metrics without enabling (installing) Prometheus and Grafana via the playbook. This may be useful for hooking Matrix services to an external Prometheus/Grafana installation.
To do this, you may be interested in the following variables:
Name | Description
-----|----------
`matrix_synapse_metrics_enabled`|Set this to `true` to make Synapse expose metrics (locally, on the container network)
`matrix_nginx_proxy_proxy_synapse_metrics`|Set this to `true` to make matrix-nginx-proxy expose the Synapse metrics at `https://matrix.DOMAIN/_synapse/metrics`
`matrix_nginx_proxy_proxy_synapse_metrics_basic_auth_enabled`|Set this to `true` to password-protect (using HTTP Basic Auth) `https://matrix.DOMAIN/_synapse/metrics` (the username is always `prometheus`, the password is defined in `matrix_nginx_proxy_proxy_synapse_metrics_basic_auth_key`)
`matrix_nginx_proxy_proxy_synapse_metrics_basic_auth_key`|Set this to a password to use for HTTP Basic Auth for protecting `https://matrix.DOMAIN/_synapse/metrics` (the username is always `prometheus` - it's not configurable)
## More inforation
- [Understanding Synapse Performance Issues Through Grafana Graphs](https://github.com/matrix-org/synapse/wiki/Understanding-Synapse-Performance-Issues-Through-Grafana-Graphs) at the Synapse Github Wiki
- [The Prometheus scraping rules](https://github.com/matrix-org/synapse/tree/master/contrib/prometheus) (we use v2)
- [The Synapse Grafana dashboard](https://github.com/matrix-org/synapse/tree/master/contrib/grafana)
- [The Node Exporter dashboard](https://github.com/rfrail3/grafana-dashboards) (for generic non-synapse performance graphs)

View file

@ -6,6 +6,11 @@ If that's alright, you can skip this.
If you'd like to store Synapse's content repository (`media_store`) files on Amazon S3 (or other S3-compatible service),
you can let this playbook configure [Goofys](https://github.com/kahing/goofys) for you.
Using a Goofys-backed media store works, but performance may not be ideal. If possible, try to use a region which is close to your Matrix server.
If you'd like to move your locally-stored media store data to Amazon S3 (or another S3-compatible object store), we also provide some migration instructions below.
## Amazon S3
You'll need an Amazon S3 bucket and some IAM user credentials (access key + secret key) with full write access to the bucket. Example security policy:
@ -50,3 +55,133 @@ matrix_s3_media_store_custom_endpoint_enabled: true
# Example: "https://storage.googleapis.com"
matrix_s3_media_store_custom_endpoint: "your-custom-endpoint"
```
### Backblaze B2
To use [Backblaze B2](https://www.backblaze.com/b2/cloud-storage.html):
- create a new **private** bucket through its user interface (you can call it something like `matrix-DOMAIN-media-store`)
- note the **Endpoint** for your bucket (something like `s3.us-west-002.backblazeb2.com`)
- adjust its lifecycle rules to use the following **custom** rules:
- File Path: *empty value*
- Days Till Hide: *empty value*
- Days Till Delete: `1`
- go to [App Keys](https://secure.backblaze.com/app_keys.htm) and use the **Add a New Application Key** to create a new one
- restrict it to the previously created bucket (e.g. `matrix-DOMAIN-media-store`)
- give it *Read & Write* access
Copy the `keyID` and `applicationKey`.
You need the following *additional* playbook configuration (on top of what you see above):
```yaml
matrix_s3_media_store_bucket_name: "YOUR_BUCKET_NAME_GOES_HERE"
matrix_s3_media_store_aws_access_key: "YOUR_keyID_GOES_HERE"
matrix_s3_media_store_aws_secret_key: "YOUR_applicationKey_GOES_HERE"
matrix_s3_media_store_custom_endpoint_enabled: true
matrix_s3_media_store_custom_endpoint: "https://s3.us-west-002.backblazeb2.com" # this may be different for your bucket
```
If you have local media store files and wish to migrate to Backblaze B2 subsequently, follow our [migration guide to Backblaze B2](#migrating-to-backblaze-b2) below instead of applying this configuration as-is.
## Migrating from local filesystem storage to S3
It's a good idea to [make a complete server backup](faq.md#how-do-i-backup-the-data-on-my-server) before migrating your local media store to an S3-backed one.
Follow one of the guides below for a migration path from a locally-stored media store to one stored on S3-compatible storage:
- [Migrating to any S3-compatible storage (universal, but likely slow)](#migrating-to-any-s3-compatible-storage-universal-but-likely-slow)
- [Migrating to Backblaze B2](#migrating-to-backblaze-b2)
### Migrating to any S3-compatible storage (universal, but likely slow)
It's a good idea to [make a complete server backup](faq.md#how-do-i-backup-the-data-on-my-server) before doing this.
1. Proceed with the steps below without stopping Matrix services
2. Start by adding the base S3 configuration in your `vars.yml` file (seen above, may be different depending on the S3 provider of your choice)
3. In addition to the base configuration you see above, add this to your `vars.yml` file:
```yaml
matrix_s3_media_store_path: /matrix/s3-media-store
```
This enables S3 support, but mounts the S3 storage bucket to `/matrix/s3-media-store` without hooking it to your homeserver yet. Your homeserver will still continue using your local filesystem for its media store.
5. Run the playbook to apply the changes: `ansible-playbook -i inventory/hosts setup.yml --tags=setup-all,start`
6. Do an **initial sync of your files** by running this **on the server** (it may take a very long time):
```sh
sudo -u matrix -- rsync --size-only --ignore-existing -avr /matrix/synapse/storage/media-store/. /matrix/s3-media-store/.
```
You may need to install `rsync` manually.
7. Stop all Matrix services (`ansible-playbook -i inventory/hosts setup.yml --tags=stop`)
8. Start the S3 service by running this **on the server**: `systemctl start matrix-goofys`
9. Sync the files again by re-running the `rsync` command you see in step #6
10. Stop the S3 service by running this **on the server**: `systemctl stop matrix-goofys`
11. Get the old media store out of the way by running this command on the server:
```sh
mv /matrix/synapse/storage/media-store /matrix/synapse/storage/media-store-local-backup
```
12. Remove the `matrix_s3_media_store_path` configuration from your `vars.yml` file (undoing step #3 above)
13. Run the playbook: `ansible-playbook -i inventory/hosts setup.yml --tags=setup-all,start`
14. You're done! Verify that loading existing (old) media files works and that you can upload new ones.
15. When confident that it all works, get rid of the local media store directory: `rm -rf /matrix/synapse/storage/media-store-local-backup`
### Migrating to Backblaze B2
It's a good idea to [make a complete server backup](faq.md#how-do-i-backup-the-data-on-my-server) before doing this.
1. While all Matrix services are running, run the following command on the server:
(you need to adjust the 3 `--env` line below with your own data)
```sh
docker run -it --rm -w /work \
--env='B2_KEY_ID=YOUR_KEY_GOES_HERE' \
--env='B2_KEY_SECRET=YOUR_SECRET_GOES_HERE' \
--env='B2_BUCKET_NAME=YOUR_BUCKET_NAME_GOES_HERE' \
-v /matrix/synapse/storage/media-store/:/work \
--entrypoint=/bin/sh \
docker.io/tianon/backblaze-b2:2.1.0 \
-c 'b2 authorize-account $B2_KEY_ID $B2_KEY_SECRET > /dev/null && b2 sync /work/ b2://$B2_BUCKET_NAME'
```
This is some initial file sync, which may take a very long time.
2. Stop all Matrix services (`ansible-playbook -i inventory/hosts setup.yml --tags=stop`)
3. Run the command from step #1 again.
Doing this will sync any new files that may have been created locally in the meantime.
Now that Matrix services aren't running, we're sure to get Backblaze B2 and your local media store fully in sync.
4. Get the old media store out of the way by running this command on the server:
```sh
mv /matrix/synapse/storage/media-store /matrix/synapse/storage/media-store-local-backup
```
5. Put the [Backblaze B2 settings seen above](#backblaze-b2) in your `vars.yml` file
6. Run the playbook: `ansible-playbook -i inventory/hosts setup.yml --tags=setup-all,start`
7. You're done! Verify that loading existing (old) media files works and that you can upload new ones.
8. When confident that it all works, get rid of the local media store directory: `rm -rf /matrix/synapse/storage/media-store-local-backup`

View file

@ -74,15 +74,12 @@ If you are hosting other domains on the Matrix machine, you can make the playboo
To do that, simply define your own custom configuration like this:
```yaml
# Note: we need to explicitly list the aforementioned Matrix domains that you use (Matrix, Element, Dimension).
# In this example, we retrieve an extra certificate - one for the base domain (in the `matrix_domain` variable).
# In this example, we retrieve 2 extra certificates,
# one for the base domain (in the `matrix_domain` variable) and one for a hardcoded domain.
# Adding any other additional domains (hosted on the same machine) is possible.
matrix_ssl_domains_to_obtain_certificates_for:
- '{{ matrix_server_fqn_matrix }}'
- '{{ matrix_server_fqn_element }}'
- '{{ matrix_server_fqn_dimension }}'
- '{{ matrix_server_fqn_jitsi }}'
matrix_ssl_additional_domains_to_obtain_certificates_for:
- '{{ matrix_domain }}'
- 'another.domain.example.com'
```
After redefining `matrix_ssl_domains_to_obtain_certificates_for`, to actually obtain certificates you should:
@ -91,9 +88,9 @@ After redefining `matrix_ssl_domains_to_obtain_certificates_for`, to actually ob
- re-run the SSL part of the playbook and restart all services: `ansible-playbook -i inventory/hosts setup.yml --tags=setup-ssl,start`
The certificate files would be available in `/matrix/ssl/config/live/<your-other-domain>/...`.
The certificate files would be made available in `/matrix/ssl/config/live/<your-other-domain>/...`.
For automated certificate renewal to work, each port `80` vhost for each domain you are obtaining certificates for needs to forward requests for `/.well-known/acme-challenge` to the certbot container we use for renewal.
See how this is configured for the `matrix.` subdomain in `/matrix/nginx-proxy/conf.d/matrix-synapse.conf`
Don't be alarmed if the above configuraiton file says port `8080`, instead of port `80`. It's due to port mapping due to our use of containers.
Don't be alarmed if the above configuration file says port `8080`, instead of port `80`. It's due to port mapping due to our use of containers.

View file

@ -35,6 +35,8 @@ When you're done with all the configuration you'd like to do, continue with [Ins
- [Setting up Dynamic DNS](configuring-playbook-dynamic-dns.md) (optional)
- [Enabling metrics and graphs (Prometheus, Grafana) for your Matrix server](configuring-playbook-prometheus-grafana.md) (optional)
### Core service adjustments
- [Configuring Synapse](configuring-playbook-synapse.md) (optional)

View file

@ -32,6 +32,8 @@ These services are not part of our default installation, but can be enabled by [
- [ewoutp/goofys](https://hub.docker.com/r/ewoutp/goofys/) - the [Goofys](https://github.com/kahing/goofys) Amazon [S3](https://aws.amazon.com/s3/) file-system-mounting program (optional)
- [etherpad/etherpad](https://hub.docker.com/r/etherpad/etherpad/) - the [Etherpad](https://etherpad.org) realtime collaborative text editor that can be used in a Jitsi audio/video call or integrated as a widget into Matrix chat rooms via the Dimension integration manager (optional)
- [devture/email2matrix](https://hub.docker.com/r/devture/email2matrix/) - the [Email2Matrix](https://github.com/devture/email2matrix) email server, which can relay email messages to Matrix rooms (optional)
- [devture/matrix-corporal](https://hub.docker.com/r/devture/matrix-corporal/) - [Matrix Corporal](https://github.com/devture/matrix-corporal): reconciliator and gateway for a managed Matrix server (optional)
@ -83,3 +85,9 @@ These services are not part of our default installation, but can be enabled by [
- [anoa/matrix-reminder-bot](https://hub.docker.com/r/anoa/matrix-reminder-bot) - the [matrix-reminder-bot](https://github.com/anoadragon453/matrix-reminder-bot) bot for one-off & recurring reminders and alarms (optional)
- [awesometechnologies/synapse-admin](https://hub.docker.com/r/awesometechnologies/synapse-admin) - the [synapse-admin](https://github.com/Awesome-Technologies/synapse-admin) web UI tool for administrating users and rooms on your Matrix server (optional)
- [prom/prometheus](https://hub.docker.com/r/prom/prometheus/) - [Prometheus](https://github.com/prometheus/prometheus/) is a systems and service monitoring system
- [prom/node-exporter](https://hub.docker.com/r/prom/node-exporter/) - [Prometheus Node Exporter](https://github.com/prometheus/node_exporter/) is an addon for Prometheus that gathers standard system metrics
- [grafana/grafana](https://hub.docker.com/r/grafana/grafana/) - [Grafana](https://github.com/grafana/grafana/) is a graphing tool that works well with the above two images. Our playbook also adds two dashboards for [Synapse](https://github.com/matrix-org/synapse/tree/master/contrib/grafana) and [Node Exporter](https://github.com/rfrail3/grafana-dashboards)

View file

@ -2,7 +2,7 @@
To install Matrix services using this Ansible playbook, you need:
- (Recommended) An **x86** server running one of these operating systems:
- (Recommended) An **x86** server ([What kind of server specs do I need?](faq.md#what-kind-of-server-specs-do-i-need)) running one of these operating systems:
- **CentOS** (7 only for now; [8 is not yet supported](https://github.com/spantaleev/matrix-docker-ansible-deploy/issues/300))
- **Debian** (9/Stretch or newer)
- **Ubuntu** (16.04 or newer, although [20.04 may be problematic](ansible.md#supported-ansible-versions))

View file

@ -9,10 +9,11 @@
# to the host line below or by adding `ansible_ssh_pipelining: False` to your variables file.
#
# If you're running this Ansible playbook on the same server as the one you're installing to,
# consider adding an additional `ansible_connection=local` argument below.
# consider adding an additional `ansible_connection=local` argument to the host line below.
#
# Ansible may fail to discover which Python interpreter to use on the host for some distros (like Ubuntu 20.04).
# You may sometimes need to explicitly add `ansible_python_interpreter=/usr/bin/python3` to lines below.
# You may sometimes need to explicitly add the argument `ansible_python_interpreter=/usr/bin/python3`
# to the host line below.
[matrix_servers]
matrix.<your-domain> ansible_host=<your-server's external IP address> ansible_ssh_user=root

View file

@ -762,7 +762,30 @@ matrix_dimension_database_password: "{{ matrix_synapse_macaroon_secret_key | pas
#
######################################################################
######################################################################
#
# matrix-etherpad
#
######################################################################
matrix_etherpad_enabled: false
matrix_etherpad_systemd_required_services_list: |
{{
['docker.service']
+
(['matrix-postgres.service'] if matrix_postgres_enabled else [])
}}
# Postgres is the default, except if not using `matrix_postgres` (internal postgres)
matrix_etherpad_database_engine: "{{ 'postgres' if matrix_postgres_enabled else 'sqlite' }}"
matrix_etherpad_database_password: "{{ matrix_synapse_macaroon_secret_key | password_hash('sha512', 'etherpad.db') | to_uuid }}"
######################################################################
#
# /matrix-etherpad
#
######################################################################
######################################################################
#
@ -825,6 +848,13 @@ matrix_jitsi_web_stun_servers: |
else [ 'stun:meet-jit-si-turnrelay.jitsi.net:443']
}}
# If the self-hosted Etherpad instance is available, it will also show up in Jitsi conferences,
# unless explicitly disabled by setting `matrix_jitsi_etherpad_enabled` to false.
# Falls back to the scalar.vector.im etherpad in case someone sets `matrix_jitsi_etherpad_enabled` to true,
# while also setting `matrix_etherpad_enabled` to false.
matrix_jitsi_etherpad_enabled: "{{ matrix_etherpad_enabled }}"
matrix_jitsi_etherpad_base: "{{ matrix_etherpad_base_url if matrix_etherpad_enabled else 'https://scalar.vector.im/etherpad' }}"
######################################################################
#
# /matrix-jitsi
@ -949,6 +979,7 @@ matrix_nginx_proxy_proxy_matrix_enabled: true
matrix_nginx_proxy_proxy_element_enabled: "{{ matrix_client_element_enabled }}"
matrix_nginx_proxy_proxy_dimension_enabled: "{{ matrix_dimension_enabled }}"
matrix_nginx_proxy_proxy_jitsi_enabled: "{{ matrix_jitsi_enabled }}"
matrix_nginx_proxy_proxy_grafana_enabled: "{{ matrix_grafana_enabled }}"
matrix_nginx_proxy_proxy_matrix_corporal_api_enabled: "{{ matrix_corporal_enabled and matrix_corporal_http_api_enabled }}"
matrix_nginx_proxy_proxy_matrix_corporal_api_addr_with_container: "matrix-corporal:41081"
@ -970,7 +1001,10 @@ matrix_nginx_proxy_proxy_synapse_federation_api_enabled: "{{ matrix_nginx_proxy_
matrix_nginx_proxy_container_federation_host_bind_port: "{{ matrix_federation_public_port }}"
matrix_nginx_proxy_proxy_synapse_metrics: "{{ matrix_synapse_metrics_enabled }}"
# This used to be hooked to `matrix_synapse_metrics_enabled`, but we don't do it anymore.
# The fact that someone wishes to enable Synapse metrics does not necessarily mean they want to make them public.
# A local Prometheus can consume them over the container network.
matrix_nginx_proxy_proxy_synapse_metrics: false
matrix_nginx_proxy_proxy_synapse_metrics_addr_with_container: "matrix-synapse:{{ matrix_synapse_metrics_port }}"
matrix_nginx_proxy_proxy_synapse_metrics_addr_sans_container: "127.0.0.1:{{ matrix_synapse_metrics_port }}"
@ -1013,7 +1047,11 @@ matrix_ssl_domains_to_obtain_certificates_for: |
+
([matrix_server_fqn_jitsi] if matrix_jitsi_enabled else [])
+
([matrix_server_fqn_grafana] if matrix_grafana_enabled else [])
+
([matrix_domain] if matrix_nginx_proxy_base_domain_serving_enabled else [])
+
matrix_ssl_additional_domains_to_obtain_certificates_for
}}
matrix_ssl_architecture: "{{
@ -1165,6 +1203,12 @@ matrix_postgres_additional_databases: |
'username': matrix_dimension_database_username,
'password': matrix_dimension_database_password,
}] if (matrix_dimension_enabled and matrix_dimension_database_engine == 'postgres' and matrix_dimension_database_hostname == 'matrix-postgres') else [])
+
([{
'name': matrix_etherpad_database_name,
'username': matrix_etherpad_database_username,
'password': matrix_etherpad_database_password,
}] if (matrix_etherpad_enabled and matrix_etherpad_database_engine == 'postgres' and matrix_etherpad_database_hostname == 'matrix-postgres') else [])
}}
matrix_postgres_import_roles_to_ignore: |
@ -1299,6 +1343,9 @@ matrix_synapse_tls_private_key_path: ~
matrix_synapse_federation_port_openid_resource_required: "{{ not matrix_synapse_federation_enabled and (matrix_dimension_enabled or matrix_ma1sd_enabled) }}"
# If someone instals Prometheus via the playbook, they most likely wish to monitor Synapse.
matrix_synapse_metrics_enabled: "{{ matrix_prometheus_enabled }}"
matrix_synapse_email_enabled: "{{ matrix_mailer_enabled }}"
matrix_synapse_email_smtp_host: "matrix-mailer"
matrix_synapse_email_smtp_port: 8025
@ -1375,6 +1422,75 @@ matrix_synapse_admin_container_self_build: "{{ matrix_architecture != 'amd64' }}
######################################################################
#
# matrix-prometheus-node-exporter
#
######################################################################
matrix_prometheus_node_exporter_enabled: false
# Normally, matrix-nginx-proxy is enabled and nginx can reach Prometheus Node Exporter over the container network.
# If matrix-nginx-proxy is not enabled, or you otherwise have a need for it, you can expose
# Prometheus' HTTP port to the local host.
matrix_prometheus_node_exporter_container_http_host_bind_port: "{{ '' if matrix_nginx_proxy_enabled else '127.0.0.1:9100' }}"
######################################################################
#
# /matrix-prometheus-node-exporter
#
######################################################################
######################################################################
#
# matrix-prometheus
#
######################################################################
matrix_prometheus_enabled: false
# Normally, matrix-nginx-proxy is enabled and nginx can reach Prometheus over the container network.
# If matrix-nginx-proxy is not enabled, or you otherwise have a need for it, you can expose
# Prometheus' HTTP port to the local host.
matrix_prometheus_container_http_host_bind_port: "{{ '' if matrix_nginx_proxy_enabled else '127.0.0.1:9090' }}"
matrix_prometheus_scraper_synapse_enabled: "{{ matrix_synapse_enabled and matrix_synapse_metrics_enabled }}"
matrix_prometheus_scraper_synapse_targets: ['matrix-synapse:{{ matrix_synapse_metrics_port }}']
matrix_prometheus_scraper_synapse_rules_synapse_tag: "{{ matrix_synapse_docker_image_tag }}"
matrix_prometheus_scraper_node_enabled: "{{ matrix_prometheus_node_exporter_enabled }}"
######################################################################
#
# /matrix-prometheus
#
######################################################################
######################################################################
#
# matrix-grafana
#
######################################################################
matrix_grafana_enabled: false
# Normally, matrix-nginx-proxy is enabled and nginx can reach Grafana over the container network.
# If matrix-nginx-proxy is not enabled, or you otherwise have a need for it, you can expose
# Grafana's HTTP port to the local host.
matrix_grafana_container_http_host_bind_port: "{{ '' if matrix_nginx_proxy_enabled else '127.0.0.1:3000' }}"
######################################################################
#
# /matrix-grafana
#
######################################################################
######################################################################
#
# matrix-registration

View file

@ -21,6 +21,9 @@ matrix_server_fqn_dimension: "dimension.{{ matrix_domain }}"
# This is where you access Jitsi.
matrix_server_fqn_jitsi: "jitsi.{{ matrix_domain }}"
# This is where you access Grafana.
matrix_server_fqn_grafana: "stats.{{ matrix_domain }}"
matrix_federation_public_port: 8448
# The architecture that your server runs.

View file

@ -23,7 +23,14 @@
repo: "deb [arch={{ matrix_debian_arch }}] https://download.docker.com/linux/{{ ansible_distribution|lower }} {{ ansible_distribution_release }} stable"
state: present
update_cache: yes
when: matrix_docker_installation_enabled|bool and matrix_docker_package_name == 'docker-ce'
when: matrix_docker_installation_enabled|bool and matrix_docker_package_name == 'docker-ce' and not ansible_distribution_release == 'bullseye'
- name: Ensure Docker repository is enabled (using Debian Buster on Debian Bullseye, for which there is no Docker yet)
apt_repository:
repo: "deb [arch={{ matrix_debian_arch }}] https://download.docker.com/linux/{{ ansible_distribution|lower }} buster stable"
state: present
update_cache: yes
when: matrix_docker_installation_enabled|bool and matrix_docker_package_name == 'docker-ce' and ansible_distribution_release == 'bullseye'
- name: Ensure APT packages are installed
apt:

View file

@ -7,7 +7,7 @@ matrix_appservice_irc_container_self_build: false
matrix_appservice_irc_docker_repo: "https://github.com/matrix-org/matrix-appservice-irc.git"
matrix_appservice_irc_docker_src_files_path: "{{ matrix_base_data_path }}/appservice-irc/docker-src"
matrix_appservice_irc_docker_image: "docker.io/matrixdotorg/matrix-appservice-irc:release-0.17.1"
matrix_appservice_irc_docker_image: "docker.io/matrixdotorg/matrix-appservice-irc:release-0.23.0"
matrix_appservice_irc_docker_image_force_pull: "{{ matrix_appservice_irc_docker_image.endswith(':latest') }}"
matrix_appservice_irc_base_path: "{{ matrix_base_data_path }}/appservice-irc"

View file

@ -2,7 +2,7 @@
- name: Ensure AppService Slack paths exist
file:
path: "{{ item }}"
path: "{{ item.path }}"
state: directory
mode: 0750
owner: "{{ matrix_user_username }}"

View file

@ -44,7 +44,7 @@ ExecStart={{ matrix_host_command_docker }} run --rm --name matrix-mautrix-facebo
{{ arg }} \
{% endfor %}
{{ matrix_mautrix_facebook_docker_image }} \
python3 -m mautrix_facebook -c /config/config.yaml
python3 -m mautrix_facebook -c /config/config.yaml --no-update
ExecStop=-{{ matrix_host_command_sh }} -c '{{ matrix_host_command_docker }} kill matrix-mautrix-facebook 2>/dev/null'
ExecStop=-{{ matrix_host_command_sh }} -c '{{ matrix_host_command_docker }} rm matrix-mautrix-facebook 2>/dev/null'

View file

@ -42,7 +42,7 @@ ExecStart={{ matrix_host_command_docker }} run --rm --name matrix-mautrix-hangou
{{ arg }} \
{% endfor %}
{{ matrix_mautrix_hangouts_docker_image }} \
python3 -m mautrix_hangouts -c /config/config.yaml
python3 -m mautrix_hangouts -c /config/config.yaml --no-update
ExecStop=-{{ matrix_host_command_sh }} -c '{{ matrix_host_command_docker }} kill matrix-mautrix-hangouts 2>/dev/null'
ExecStop=-{{ matrix_host_command_sh }} -c '{{ matrix_host_command_docker }} rm matrix-mautrix-hangouts 2>/dev/null'

View file

@ -21,7 +21,7 @@
name: "{{ matrix_mautrix_signal_daemon_docker_image }}"
source: "{{ 'pull' if ansible_version.major > 2 or ansible_version.minor > 7 else omit }}"
force_source: "{{ matrix_mautrix_signal_daemon_docker_image_force_pull if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}"
force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else matrix_mautrix_signal_docker_image_force_pull }}"
force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else matrix_mautrix_signal_daemon_docker_image_force_pull }}"
when: matrix_mautrix_signal_enabled|bool
- name: Ensure Mautrix Signal paths exist

View file

@ -35,7 +35,7 @@ ExecStart={{ matrix_host_command_docker }} run --rm --name matrix-mautrix-signal
{{ arg }} \
{% endfor %}
{{ matrix_mautrix_signal_docker_image }} \
python3 -m mautrix_signal -c /config/config.yaml
python3 -m mautrix_signal -c /config/config.yaml --no-update
ExecStop=-{{ matrix_host_command_sh }} -c '{{ matrix_host_command_docker }} kill matrix-mautrix-signal 2>/dev/null'
ExecStop=-{{ matrix_host_command_sh }} -c '{{ matrix_host_command_docker }} rm matrix-mautrix-signal 2>/dev/null'

View file

@ -42,7 +42,7 @@ ExecStart={{ matrix_host_command_docker }} run --rm --name matrix-mautrix-telegr
{{ arg }} \
{% endfor %}
{{ matrix_mautrix_telegram_docker_image }} \
python3 -m mautrix_telegram -c /config/config.yaml
python3 -m mautrix_telegram -c /config/config.yaml --no-update
ExecStop=-{{ matrix_host_command_sh }} -c '{{ matrix_host_command_docker }} kill matrix-mautrix-telegram 2>/dev/null'
ExecStop=-{{ matrix_host_command_sh }} -c '{{ matrix_host_command_docker }} rm matrix-mautrix-telegram 2>/dev/null'

View file

@ -3,7 +3,7 @@ matrix_client_element_enabled: true
matrix_client_element_container_image_self_build: false
matrix_client_element_container_image_self_build_repo: "https://github.com/vector-im/riot-web.git"
matrix_client_element_docker_image: "{{ matrix_client_element_docker_image_name_prefix }}vectorim/element-web:v1.7.17"
matrix_client_element_docker_image: "{{ matrix_client_element_docker_image_name_prefix }}vectorim/element-web:v1.7.20"
matrix_client_element_docker_image_name_prefix: "{{ 'localhost/' if matrix_client_element_container_image_self_build else 'docker.io/' }}"
matrix_client_element_docker_image_force_pull: "{{ matrix_client_element_docker_image.endswith(':latest') }}"

View file

@ -0,0 +1,93 @@
matrix_etherpad_enabled: false
matrix_etherpad_base_path: "{{ matrix_base_data_path }}/etherpad"
matrix_etherpad_docker_image: "docker.io/etherpad/etherpad:1.8.7"
matrix_etherpad_docker_image_force_pull: "{{ matrix_etherpad_docker_image.endswith(':latest') }}"
# List of systemd services that matrix-etherpad.service depends on.
matrix_etherpad_systemd_required_services_list: ['docker.service']
# List of systemd services that matrix-etherpad.service wants
matrix_etherpad_systemd_wanted_services_list: []
# Container user has to be able to write to the source file directories until this bug is fixed:
# https://github.com/ether/etherpad-lite/issues/2683
matrix_etherpad_user_uid: '5001'
matrix_etherpad_user_gid: '5001'
# Controls whether the matrix-etherpad container exposes its HTTP port (tcp/9001 in the container).
#
# Takes an "<ip>:<port>" or "<port>" value (e.g. "127.0.0.1:9001"), or empty string to not expose.
matrix_etherpad_container_http_host_bind_port: '9001'
# A list of extra arguments to pass to the container
matrix_etherpad_container_extra_arguments: []
matrix_etherpad_public_endpoint: '/etherpad'
# By default, the Etherpad app can be accessed within the Dimension domain
matrix_etherpad_base_url: "https://{{ matrix_server_fqn_dimension }}{{ matrix_etherpad_public_endpoint }}"
# Database-related configuration fields.
#
# Etherpad recommends using a dedicated database, and supports Sqlite only for development
#
# To use Postgres:
# - change the engine (`matrix_etherpad_database_engine: 'postgres'`)
# - adjust your database credentials via the `matrix_etherpad_postgres_*` variables
matrix_etherpad_database_engine: 'sqlite'
matrix_etherpad_sqlite_database_path_local: "{{ matrix_etherpad_base_path }}/etherpad.db"
matrix_etherpad_sqlite_database_path_in_container: "/data/etherpad.db"
matrix_etherpad_database_username: 'matrix_etherpad'
matrix_etherpad_database_password: 'some-password'
matrix_etherpad_database_hostname: 'matrix-postgres'
matrix_etherpad_database_port: 5432
matrix_etherpad_database_name: 'matrix_etherpad'
matrix_etherpad_database_connection_string: 'postgres://{{ matrix_etherpad_database_username }}:{{ matrix_etherpad_database_password }}@{{ matrix_etherpad_database_hostname }}:{{ matrix_etherpad_database_port }}/{{ matrix_etherpad_database_name }}'
# Variables configuring the etherpad
matrix_etherpad_title: 'Etherpad'
matrix_etherpad_default_pad_text: |
Welcome to Etherpad!
This pad text is synchronized as you type, so that everyone viewing this page sees the same text. This allows you to collaborate seamlessly on documents!
Get involved with Etherpad at https://etherpad.org
# Default Etherpad configuration template which covers the generic use case.
# You can customize it by controlling the various variables inside it.
#
# For a more advanced customization, you can extend the default (see `matrix_etherpad_configuration_extension_json`)
# or completely replace this variable with your own template.
matrix_etherpad_configuration_default: "{{ lookup('template', 'templates/settings.json.j2') }}"
# Your custom JSON configuration for Etherpad goes here.
# This configuration extends the default starting configuration (`matrix_etherpad_configuration_json`).
#
# You can override individual variables from the default configuration, or introduce new ones.
#
# If you need something more special, you can take full control by
# completely redefining `matrix_etherpad_configuration_json`.
#
# Example configuration extension follows:
#
# matrix_etherpad_configuration_extension_json: |
# {
# "loadTest": true,
# "commitRateLimiting": {
# "duration": 1,
# "points": 10
# }
# }
#
matrix_etherpad_configuration_extension_json: '{}'
matrix_etherpad_configuration_extension: "{{ matrix_etherpad_configuration_extension_json|from_json if matrix_etherpad_configuration_extension_json|from_json is mapping else {} }}"
# Holds the final Etherpad configuration (a combination of the default and its extension).
# You most likely don't need to touch this variable. Instead, see `matrix_etherpad_configuration_json`.
matrix_etherpad_configuration: "{{ matrix_etherpad_configuration_default|combine(matrix_etherpad_configuration_extension, recursive=True) }}"

View file

@ -0,0 +1,62 @@
- set_fact:
matrix_systemd_services_list: "{{ matrix_systemd_services_list + ['matrix-etherpad.service'] }}"
when: matrix_etherpad_enabled|bool
- block:
- name: Fail if matrix-nginx-proxy role already executed
fail:
msg: >-
Trying to append Etherpad's reverse-proxying configuration to matrix-nginx-proxy,
but it's pointless since the matrix-nginx-proxy role had already executed.
To fix this, please change the order of roles in your plabook,
so that the matrix-nginx-proxy role would run after the matrix-etherpad role.
when: matrix_nginx_proxy_role_executed|default(False)|bool
- name: Generate Etherpad proxying configuration for matrix-nginx-proxy
set_fact:
matrix_etherpad_matrix_nginx_proxy_configuration: |
rewrite ^{{ matrix_etherpad_public_endpoint }}$ $scheme://$server_name{{ matrix_etherpad_public_endpoint }}/ permanent;
location {{ matrix_etherpad_public_endpoint }}/ {
{% if matrix_nginx_proxy_enabled|default(False) %}
{# Use the embedded DNS resolver in Docker containers to discover the service #}
resolver 127.0.0.11 valid=5s;
proxy_pass http://matrix-etherpad:9001/;
{# These are proxy directives needed specifically by Etherpad #}
proxy_buffering off;
proxy_http_version 1.1; # recommended with keepalive connections
proxy_pass_header Server;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-Proto $scheme; # for EP to set secure cookie flag when https is used
# WebSocket proxying - from http://nginx.org/en/docs/http/websocket.html
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $connection_upgrade;
{% else %}
{# Generic configuration for use outside of our container setup #}
# A good guide for setting up your Etherpad behind nginx:
# https://docs.gandi.net/en/cloud/tutorials/etherpad_lite.html
proxy_pass http://127.0.0.1:9001/;
{% endif %}
}
- name: Register Etherpad proxying configuration with matrix-nginx-proxy
set_fact:
matrix_nginx_proxy_proxy_dimension_additional_server_configuration_blocks: |
{{
matrix_nginx_proxy_proxy_dimension_additional_server_configuration_blocks|default([])
+
[matrix_etherpad_matrix_nginx_proxy_configuration]
}}
tags:
- always
when: matrix_etherpad_enabled|bool
- name: Warn about reverse-proxying if matrix-nginx-proxy not used
debug:
msg: >-
NOTE: You've enabled the Etherpad tool but are not using the matrix-nginx-proxy
reverse proxy.
Please make sure that you're proxying the `{{ matrix_etherpad_public_endpoint }}`
URL endpoint to the matrix-etherpad container.
You can expose the container's port using the `matrix_etherpad_container_http_host_bind_port` variable.
when: "matrix_etherpad_enabled|bool and matrix_nginx_proxy_enabled is not defined"

View file

@ -0,0 +1,21 @@
- import_tasks: "{{ role_path }}/tasks/init.yml"
tags:
- always
- import_tasks: "{{ role_path }}/tasks/setup_install.yml"
when: run_setup|bool and matrix_etherpad_enabled|bool
tags:
- setup-all
- setup-etherpad
- import_tasks: "{{ role_path }}/tasks/setup_uninstall.yml"
when: run_setup|bool and not matrix_etherpad_enabled|bool
tags:
- setup-all
- setup-etherpad
- import_tasks: "{{ role_path }}/tasks/validate_config.yml"
when: run_setup|bool and matrix_etherpad_enabled|bool
tags:
- setup-all
- setup-etherpad

View file

@ -0,0 +1,36 @@
---
- name: Ensure Etherpad base path exists
file:
path: "{{ matrix_etherpad_base_path }}"
state: directory
mode: 0770
owner: "{{ matrix_etherpad_user_uid }}"
group: "{{ matrix_etherpad_user_gid }}"
- name: Ensure Etherpad config installed
copy:
content: "{{ matrix_etherpad_configuration|to_nice_json }}"
dest: "{{ matrix_etherpad_base_path }}/settings.json"
mode: 0640
owner: "{{ matrix_etherpad_user_uid }}"
group: "{{ matrix_etherpad_user_gid }}"
- name: Ensure Etherpad image is pulled
docker_image:
name: "{{ matrix_etherpad_docker_image }}"
source: "{{ 'pull' if ansible_version.major > 2 or ansible_version.minor > 7 else omit }}"
force_source: "{{ matrix_etherpad_docker_image_force_pull if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}"
force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else matrix_etherpad_docker_image_force_pull }}"
- name: Ensure matrix-etherpad.service installed
template:
src: "{{ role_path }}/templates/systemd/matrix-etherpad.service.j2"
dest: "{{ matrix_systemd_path }}/matrix-etherpad.service"
mode: 0644
register: matrix_etherpad_systemd_service_result
- name: Ensure systemd reloaded after matrix-etherpad.service installation
service:
daemon_reload: yes
when: "matrix_etherpad_systemd_service_result.changed|bool"

View file

@ -0,0 +1,35 @@
---
- name: Check existence of matrix-etherpad service
stat:
path: "{{ matrix_systemd_path }}/matrix-etherpad.service"
register: matrix_etherpad_service_stat
- name: Ensure matrix-etherpad is stopped
service:
name: matrix-etherpad
state: stopped
daemon_reload: yes
register: stopping_result
when: "matrix_etherpad_service_stat.stat.exists|bool"
- name: Ensure matrix-etherpad.service doesn't exist
file:
path: "{{ matrix_systemd_path }}/matrix-etherpad.service"
state: absent
when: "matrix_etherpad_service_stat.stat.exists|bool"
- name: Ensure systemd reloaded after matrix-etherpad.service removal
service:
daemon_reload: yes
when: "matrix_etherpad_service_stat.stat.exists|bool"
- name: Ensure Etherpad base directory doesn't exist
file:
path: "{{ matrix_etherpad_base_path }}"
state: absent
- name: Ensure Etherpad Docker image doesn't exist
docker_image:
name: "{{ matrix_etherpad_docker_image }}"
state: absent

View file

@ -0,0 +1,5 @@
- name: Fail if Etherpad is enabled without the Dimension integrations manager
fail:
msg: >-
To integrate Etherpad notes with Matrix rooms you need to set "matrix_dimension_enabled" to true
when: "not matrix_dimension_enabled|bool"

View file

@ -0,0 +1,106 @@
{
"title": {{ matrix_etherpad_title|to_json }},
"favicon": "favicon.ico",
"skinName": "colibris",
"skinVariants": "super-light-toolbar super-light-editor light-background",
"ip": "::",
"port": 9001,
"showSettingsInAdminPage": true,
"dbType": {{ matrix_etherpad_database_engine|to_json }},
"dbSettings": {
{% if matrix_etherpad_database_engine == 'sqlite' %}
"filename": {{ matrix_etherpad_sqlite_database_path_in_container|to_json }}
{% elif matrix_etherpad_database_engine == 'postgres' %}
"database": {{ matrix_etherpad_database_name|to_json }},
"host": {{ matrix_etherpad_database_hostname|to_json }},
"password": {{ matrix_etherpad_database_password|to_json }},
"port": {{ matrix_etherpad_database_port|to_json }},
"user": {{ matrix_etherpad_database_username|to_json }}
{% endif %}
},
"defaultPadText" : {{ matrix_etherpad_default_pad_text|to_json }},
"suppressErrorsInPadText": false,
"requireSession": false,
"editOnly": false,
"minify": true,
"maxAge": 21600,
"abiword": null,
"soffice": null,
"tidyHtml": null,
"allowUnknownFileEnds": true,
"requireAuthentication": false,
"requireAuthorization": false,
"trustProxy": true,
"cookie": {
"sameSite": "Lax"
},
"disableIPlogging": true,
"automaticReconnectionTimeout": 0,
"scrollWhenFocusLineIsOutOfViewport": {
"percentage": {
"editionAboveViewport": 0,
"editionBelowViewport": 0
},
"duration": 0,
"scrollWhenCaretIsInTheLastLineOfViewport": false,
"percentageToScrollWhenUserPressesArrowUp": 0
},
"socketTransportProtocols" : ["xhr-polling", "jsonp-polling", "htmlfile"],
"loadTest": false,
"importExportRateLimiting": {
"windowMs": 90000,
"max": 10
},
"importMaxFileSize": 52428800,
"commitRateLimiting": {
"duration": 1,
"points": 10
},
"exposeVersion": false,
"padOptions": {
"noColors": false,
"showControls": true,
"showChat": false,
"showLineNumbers": true,
"useMonospaceFont": false,
"userName": false,
"userColor": false,
"rtl": false,
"alwaysShowChat": false,
"chatAndUsers": false,
"lang": "en-gb"
},
"padShortcutEnabled" : {
"altF9": true,
"altC": true,
"cmdShift2": true,
"delete": true,
"return": true,
"esc": true,
"cmdS": true,
"tab": true,
"cmdZ": true,
"cmdY": true,
"cmdI": true,
"cmdB": true,
"cmdU": true,
"cmd5": true,
"cmdShiftL": true,
"cmdShiftN": true,
"cmdShift1": true,
"cmdShiftC": true,
"cmdH": true,
"ctrlHome": true,
"pageUp": true,
"pageDown": true
},
"loglevel": "INFO",
"logconfig" :
{ "appenders": [
{ "type": "console",
"layout": {"type": "messagePassThrough"}
}
]
},
"customLocaleStrings": {}
}

View file

@ -0,0 +1,49 @@
#jinja2: lstrip_blocks: "True"
[Unit]
Description=Matrix Etherpad
{% for service in matrix_etherpad_systemd_required_services_list %}
Requires={{ service }}
After={{ service }}
{% endfor %}
{% for service in matrix_etherpad_systemd_wanted_services_list %}
Wants={{ service }}
{% endfor %}
DefaultDependencies=no
[Service]
Type=simple
Environment="HOME={{ matrix_systemd_unit_home_path }}"
ExecStartPre=-{{ matrix_host_command_docker }} kill matrix-etherpad
ExecStartPre=-{{ matrix_host_command_docker }} rm matrix-etherpad
# Fixup database ownership if it got changed somehow (during a server migration, etc.)
{% if matrix_etherpad_database_engine == 'sqlite' %}
ExecStartPre=-{{ matrix_host_command_chown }} {{ matrix_etherpad_user_uid }} {{ matrix_etherpad_sqlite_database_path_local }}
{% endif %}
ExecStart={{ matrix_host_command_docker }} run --rm --name matrix-etherpad \
--log-driver=none \
--user={{ matrix_etherpad_user_uid }}:{{ matrix_etherpad_user_gid }} \
--cap-drop=ALL \
--network={{ matrix_docker_network }} \
{% if matrix_etherpad_container_http_host_bind_port %}
-p {{ matrix_etherpad_container_http_host_bind_port }}:9001 \
{% endif %}
--mount type=bind,src={{ matrix_etherpad_base_path }},dst=/data \
{% for arg in matrix_etherpad_container_extra_arguments %}
{{ arg }} \
{% endfor %}
{{ matrix_etherpad_docker_image }} \
node --experimental-worker /opt/etherpad-lite/node_modules/ep_etherpad-lite/node/server.js \
--settings /data/settings.json --credentials /data/credentials.json \
--sessionkey /data/sessionkey.json --apikey /data/apijey.json
ExecStop=-{{ matrix_host_command_docker }} kill matrix-etherpad
ExecStop=-{{ matrix_host_command_docker }} rm matrix-etherpad
Restart=always
RestartSec=30
SyslogIdentifier=matrix-etherpad
[Install]
WantedBy=multi-user.target

View file

@ -0,0 +1,47 @@
# matrix-grafana is open source visualization and analytics software
# See: https://github.com/matrix-org/synapse/blob/master/docs/metrics-howto.md
matrix_grafana_enabled: false
matrix_grafana_docker_image: "docker.io/grafana/grafana:7.4.0"
matrix_grafana_docker_image_force_pull: "{{ matrix_grafana_docker_image.endswith(':latest') }}"
# Not conditional, because when someone disables metrics
# they might still want to look at the old existing data.
# So it would be silly to delete the dashboard in such case.
matrix_grafana_dashboard_download_urls:
- "https://raw.githubusercontent.com/matrix-org/synapse/master/contrib/grafana/synapse.json"
- "https://raw.githubusercontent.com/rfrail3/grafana-dashboards/master/prometheus/node-exporter-full.json"
matrix_grafana_base_path: "{{ matrix_base_data_path }}/grafana"
matrix_grafana_config_path: "{{ matrix_grafana_base_path }}/config"
matrix_grafana_data_path: "{{ matrix_grafana_base_path }}/data"
# Allow viewing Grafana without logging in
matrix_grafana_anonymous_access: false
# specify organization name that should be used for unauthenticated users
# if you change this in the Grafana admin panel, this needs to be updated
# to match to keep anonymous logins working
matrix_grafana_anonymous_access_org_name: 'Main Org.'
# default admin credentials, you are asked to change these on first login
matrix_grafana_default_admin_user: admin
matrix_grafana_default_admin_password: admin
# A list of extra arguments to pass to the container
matrix_grafana_container_extra_arguments: []
# List of systemd services that matrix-grafana.service depends on
matrix_grafana_systemd_required_services_list: ['docker.service']
# List of systemd services that matrix-grafana.service wants
matrix_grafana_systemd_wanted_services_list: []
# Controls whether the matrix-grafana container exposes its HTTP port (tcp/3000 in the container).
#
# Takes an "<ip>:<port>" or "<port>" value (e.g. "127.0.0.1:3000"), or empty string to not expose.
matrix_grafana_container_http_host_bind_port: ''

View file

@ -0,0 +1,5 @@
- set_fact:
matrix_systemd_services_list: "{{ matrix_systemd_services_list + ['matrix-grafana.service'] }}"
when: matrix_grafana_enabled|bool

View file

@ -0,0 +1,14 @@
- import_tasks: "{{ role_path }}/tasks/init.yml"
tags:
- always
- import_tasks: "{{ role_path }}/tasks/validate_config.yml"
when: "run_setup|bool and matrix_grafana_enabled|bool"
tags:
- setup-all
- setup-grafana
- import_tasks: "{{ role_path }}/tasks/setup.yml"
tags:
- setup-all
- setup-grafana

View file

@ -0,0 +1,115 @@
---
#
# Tasks related to setting up matrix-grafana
#
- name: Ensure matrix-grafana image is pulled
docker_image:
name: "{{ matrix_grafana_docker_image }}"
source: "{{ 'pull' if ansible_version.major > 2 or ansible_version.minor > 7 else omit }}"
force_source: "{{ matrix_grafana_docker_image_force_pull if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}"
force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else matrix_grafana_docker_image_force_pull }}"
when: "matrix_grafana_enabled|bool"
- name: Ensure grafana paths exists
file:
path: "{{ item }}"
state: directory
mode: 0750
owner: "{{ matrix_user_username }}"
group: "{{ matrix_user_groupname }}"
with_items:
- "{{ matrix_grafana_base_path }}"
- "{{ matrix_grafana_config_path }}"
- "{{ matrix_grafana_config_path }}/provisioning"
- "{{ matrix_grafana_config_path }}/provisioning/datasources"
- "{{ matrix_grafana_config_path }}/provisioning/dashboards"
- "{{ matrix_grafana_config_path }}/dashboards"
- "{{ matrix_grafana_data_path }}"
when: matrix_grafana_enabled|bool
- name: Ensure grafana.ini present
template:
src: "{{ role_path }}/templates/grafana.ini.j2"
dest: "{{ matrix_grafana_config_path }}/grafana.ini"
mode: 0440
owner: "{{ matrix_user_username }}"
group: "{{ matrix_user_groupname }}"
when: matrix_grafana_enabled|bool
- name: Ensure provisioning/datasources/default.yaml present
template:
src: "{{ role_path }}/templates/datasources.yaml.j2"
dest: "{{ matrix_grafana_config_path }}/provisioning/datasources/default.yaml"
mode: 0440
owner: "{{ matrix_user_username }}"
group: "{{ matrix_user_groupname }}"
when: matrix_grafana_enabled|bool
- name: Ensure provisioning/dashboards/default.yaml present
template:
src: "{{ role_path }}/templates/dashboards.yaml.j2"
dest: "{{ matrix_grafana_config_path }}/provisioning/dashboards/default.yaml"
mode: 0440
owner: "{{ matrix_user_username }}"
group: "{{ matrix_user_groupname }}"
when: matrix_grafana_enabled|bool
- name: Ensure dashboard(s) downloaded
get_url:
url: "{{ item }}"
dest: "{{ matrix_grafana_config_path }}/dashboards/"
force: true
mode: 0440
owner: "{{ matrix_user_username }}"
group: "{{ matrix_user_groupname }}"
with_items: "{{ matrix_grafana_dashboard_download_urls }}"
when: matrix_grafana_enabled|bool
- name: Ensure matrix-grafana.service installed
template:
src: "{{ role_path }}/templates/systemd/matrix-grafana.service.j2"
dest: "{{ matrix_systemd_path }}/matrix-grafana.service"
mode: 0644
register: matrix_grafana_systemd_service_result
when: matrix_grafana_enabled|bool
- name: Ensure systemd reloaded after matrix-grafana.service installation
service:
daemon_reload: yes
when: "matrix_grafana_enabled|bool and matrix_grafana_systemd_service_result.changed"
#
# Tasks related to getting rid of matrix-grafana (if it was previously enabled)
#
- name: Check existence of matrix-grafana service
stat:
path: "{{ matrix_systemd_path }}/matrix-grafana.service"
register: matrix_grafana_service_stat
- name: Ensure matrix-grafana is stopped
service:
name: matrix-grafana
state: stopped
daemon_reload: yes
register: stopping_result
when: "not matrix_grafana_enabled|bool and matrix_grafana_service_stat.stat.exists"
- name: Ensure matrix-grafana.service doesn't exist
file:
path: "{{ matrix_systemd_path }}/matrix-grafana.service"
state: absent
when: "not matrix_grafana_enabled|bool and matrix_grafana_service_stat.stat.exists"
- name: Ensure systemd reloaded after matrix-grafana.service removal
service:
daemon_reload: yes
when: "not matrix_grafana_enabled|bool and matrix_grafana_service_stat.stat.exists"
- name: Ensure matrix-grafana Docker image doesn't exist
docker_image:
name: "{{ matrix_grafana_docker_image }}"
state: absent
when: "not matrix_grafana_enabled|bool"

View file

@ -0,0 +1,7 @@
---
- name: Fail if Prometheus not enabled
fail:
msg: >
You need to enable `matrix_prometheus_enabled` to use Prometheus as data source for Grafana.
when: "not matrix_prometheus_enabled"

View file

@ -0,0 +1,9 @@
apiVersion: 1
providers:
- name: {{ matrix_server_fqn_matrix }} - Dashboards
folder: '' # The folder where to place the dashboards
type: file
allowUiUpdates: true
options:
path: /etc/grafana/dashboards

View file

@ -0,0 +1,8 @@
apiVersion: 1
datasources:
- name: {{ matrix_server_fqn_matrix }} - Prometheus
type: prometheus
# Access mode - proxy (server in the UI) or direct (browser in the UI).
access: proxy
url: http://matrix-prometheus:9090

View file

@ -0,0 +1,20 @@
[security]
# default admin user, created on startup
admin_user = {{ matrix_grafana_default_admin_user }}
# default admin password, can be changed before first start of grafana, or in profile settings
admin_password = {{ matrix_grafana_default_admin_password }}
[auth.anonymous]
# enable anonymous access
enabled = {{ matrix_grafana_anonymous_access }}
# specify organization name that should be used for unauthenticated users
org_name = {{ matrix_grafana_anonymous_access_org_name }}
[dashboards]
{% if matrix_synapse_metrics_enabled %}
default_home_dashboard_path = /etc/grafana/dashboards/synapse.json
{% else %}
default_home_dashboard_path = /etc/grafana/dashboards/node-exporter-full.json
{% endif %}

View file

@ -0,0 +1,43 @@
#jinja2: lstrip_blocks: "True"
[Unit]
Description=matrix-grafana
{% for service in matrix_grafana_systemd_required_services_list %}
Requires={{ service }}
After={{ service }}
{% endfor %}
{% for service in matrix_grafana_systemd_wanted_services_list %}
Wants={{ service }}
{% endfor %}
DefaultDependencies=no
[Service]
Type=simple
Environment="HOME={{ matrix_systemd_unit_home_path }}"
ExecStartPre=-{{ matrix_host_command_sh }} -c '{{ matrix_host_command_docker }} kill matrix-grafana 2>/dev/null'
ExecStartPre=-{{ matrix_host_command_sh }} -c '{{ matrix_host_command_docker }} rm matrix-grafana 2>/dev/null'
ExecStart={{ matrix_host_command_docker }} run --rm --name matrix-grafana \
--log-driver=none \
--user={{ matrix_user_uid }}:{{ matrix_user_gid }} \
--cap-drop=ALL \
--read-only \
--network={{ matrix_docker_network }} \
{% if matrix_grafana_container_http_host_bind_port %}
-p {{ matrix_grafana_container_http_host_bind_port }}:3000 \
{% endif %}
-v {{ matrix_grafana_config_path }}:/etc/grafana:z \
-v {{ matrix_grafana_data_path }}:/var/lib/grafana:z \
{% for arg in matrix_grafana_container_extra_arguments %}
{{ arg }} \
{% endfor %}
{{ matrix_grafana_docker_image }}
ExecStop=-{{ matrix_host_command_sh }} -c '{{ matrix_host_command_docker }} kill matrix-grafana 2>/dev/null'
ExecStop=-{{ matrix_host_command_sh }} -c '{{ matrix_host_command_docker }} rm matrix-grafana 2>/dev/null'
Restart=always
RestartSec=30
SyslogIdentifier=matrix-grafana
[Install]
WantedBy=multi-user.target

View file

@ -67,6 +67,9 @@ matrix_jitsi_web_public_url: "https://{{ matrix_server_fqn_jitsi }}"
# Addresses need to be prefixed with one of `stun:`, `turn:` or `turns:`.
matrix_jitsi_web_stun_servers: ['stun:meet-jit-si-turnrelay.jitsi.net:443']
# Controls whether Etherpad will be available within Jitsi
matrix_jitsi_etherpad_enabled: false
# Controls whether the matrix-jitsi-web container exposes its HTTP port (tcp/80 in the container).
#
# Takes an "<ip>:<port>" or "<port>" value (e.g. "127.0.0.1:12080"), or empty string to not expose.

View file

@ -11,5 +11,8 @@ config.p2p.stunServers = [
];
{% endif %}
{% if matrix_jitsi_etherpad_enabled %}
config.etherpad_base = {{ (matrix_jitsi_etherpad_base + '/p/') |to_json }}
{% endif %}
{{ matrix_jitsi_web_custom_config_extension }}

View file

@ -37,4 +37,6 @@ RESOLUTION_WIDTH_MIN={{ matrix_jitsi_web_config_resolution_width_min }}
START_AUDIO_MUTED={{ matrix_jitsi_web_config_start_audio_muted_after_nth_participant }}
START_VIDEO_MUTED={{ matrix_jitsi_web_config_start_video_muted_after_nth_participant }}
ETHERPAD_URL_BASE={{ (matrix_jitsi_etherpad_base + '/') if matrix_jitsi_etherpad_enabled else ''}}
{{ matrix_jitsi_web_environment_variables_extension }}

View file

@ -119,6 +119,10 @@ matrix_nginx_proxy_proxy_dimension_hostname: "{{ matrix_server_fqn_dimension }}"
matrix_nginx_proxy_proxy_jitsi_enabled: false
matrix_nginx_proxy_proxy_jitsi_hostname: "{{ matrix_server_fqn_jitsi }}"
# Controls whether proxying the grafana domain should be done.
matrix_nginx_proxy_proxy_grafana_enabled: false
matrix_nginx_proxy_proxy_grafana_hostname: "{{ matrix_server_fqn_grafana }}"
# Controls whether proxying for the matrix-corporal API (`/_matrix/corporal`) should be done (on the matrix domain)
matrix_nginx_proxy_proxy_matrix_corporal_api_enabled: false
matrix_nginx_proxy_proxy_matrix_corporal_api_addr_with_container: "matrix-corporal:41081"
@ -228,6 +232,9 @@ matrix_nginx_proxy_proxy_dimension_additional_server_configuration_blocks: []
# A list of strings containing additional configuration blocks to add to Jitsi's server configuration (matrix-jitsi.conf).
matrix_nginx_proxy_proxy_jitsi_additional_server_configuration_blocks: []
# A list of strings containing additional configuration blocks to add to Grafana's server configuration (matrix-grafana.conf).
matrix_nginx_proxy_proxy_grafana_additional_server_configuration_blocks: []
# A list of strings containing additional configuration blocks to add to the base domain server configuration (matrix-base-domain.conf).
matrix_nginx_proxy_proxy_domain_additional_server_configuration_blocks: []
@ -306,12 +313,17 @@ matrix_ssl_retrieval_method: "lets-encrypt"
matrix_ssl_architecture: "amd64"
# The list of domains that this role will obtain certificates for.
matrix_ssl_domains_to_obtain_certificates_for: []
# The full list of domains that this role will obtain certificates for.
# This variable is likely redefined outside of the role, to include the domains that are necessary (depending on the services that are enabled).
# To add additional domain names, consider using `matrix_ssl_additional_domains_to_obtain_certificates_for` instead.
matrix_ssl_domains_to_obtain_certificates_for: "{{ matrix_ssl_additional_domains_to_obtain_certificates_for }}"
# A list of additional domain names to obtain certificates for.
matrix_ssl_additional_domains_to_obtain_certificates_for: []
# Controls whether to obtain production or staging certificates from Let's Encrypt.
matrix_ssl_lets_encrypt_staging: false
matrix_ssl_lets_encrypt_certbot_docker_image: "docker.io/certbot/certbot:{{ matrix_ssl_architecture }}-v1.10.1"
matrix_ssl_lets_encrypt_certbot_docker_image: "docker.io/certbot/certbot:{{ matrix_ssl_architecture }}-v1.11.0"
matrix_ssl_lets_encrypt_certbot_docker_image_force_pull: "{{ matrix_ssl_lets_encrypt_certbot_docker_image.endswith(':latest') }}"
matrix_ssl_lets_encrypt_certbot_standalone_http_port: 2402
matrix_ssl_lets_encrypt_support_email: ~

View file

@ -86,6 +86,13 @@
mode: 0644
when: matrix_nginx_proxy_proxy_jitsi_enabled|bool
- name: Ensure Matrix nginx-proxy configuration for grafana domain exists
template:
src: "{{ role_path }}/templates/nginx/conf.d/matrix-grafana.conf.j2"
dest: "{{ matrix_nginx_proxy_confd_path }}/matrix-grafana.conf"
mode: 0644
when: matrix_nginx_proxy_proxy_grafana_enabled|bool
- name: Ensure Matrix nginx-proxy configuration for Matrix domain exists
template:
src: "{{ role_path }}/templates/nginx/conf.d/matrix-domain.conf.j2"
@ -195,6 +202,12 @@
state: absent
when: "not matrix_nginx_proxy_proxy_jitsi_enabled|bool"
- name: Ensure Matrix nginx-proxy configuration for grafana domain deleted
file:
path: "{{ matrix_nginx_proxy_confd_path }}/matrix-grafana.conf"
state: absent
when: "not matrix_nginx_proxy_proxy_grafana_enabled|bool"
- name: Ensure Matrix nginx-proxy homepage for base domain deleted
file:
path: "{{ matrix_nginx_proxy_data_path }}/matrix-domain/index.html"

View file

@ -0,0 +1,79 @@
#jinja2: lstrip_blocks: "True"
{% macro render_vhost_directives() %}
gzip on;
gzip_types text/plain application/json application/javascript text/css image/x-icon font/ttf image/gif;
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
add_header X-Content-Type-Options nosniff;
add_header X-Frame-Options SAMEORIGIN;
{% for configuration_block in matrix_nginx_proxy_proxy_grafana_additional_server_configuration_blocks %}
{{- configuration_block }}
{% endfor %}
location / {
{% if matrix_nginx_proxy_enabled %}
{# Use the embedded DNS resolver in Docker containers to discover the service #}
resolver 127.0.0.11 valid=5s;
set $backend "matrix-grafana:3000";
proxy_pass http://$backend;
{% else %}
{# Generic configuration for use outside of our container setup #}
proxy_pass http://127.0.0.1:3000;
{% endif %}
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $remote_addr;
}
{% endmacro %}
server {
listen {{ 8080 if matrix_nginx_proxy_enabled else 80 }};
server_name {{ matrix_nginx_proxy_proxy_grafana_hostname }};
server_tokens off;
root /dev/null;
{% if matrix_nginx_proxy_https_enabled %}
location /.well-known/acme-challenge {
{% if matrix_nginx_proxy_enabled %}
{# Use the embedded DNS resolver in Docker containers to discover the service #}
resolver 127.0.0.11 valid=5s;
set $backend "matrix-certbot:8080";
proxy_pass http://$backend;
{% else %}
{# Generic configuration for use outside of our container setup #}
proxy_pass http://127.0.0.1:{{ matrix_ssl_lets_encrypt_certbot_standalone_http_port }};
{% endif %}
}
location / {
return 301 https://$http_host$request_uri;
}
{% else %}
{{ render_vhost_directives() }}
{% endif %}
}
{% if matrix_nginx_proxy_https_enabled %}
server {
listen {{ 8443 if matrix_nginx_proxy_enabled else 443 }} ssl http2;
listen [::]:{{ 8443 if matrix_nginx_proxy_enabled else 443 }} ssl http2;
server_name {{ matrix_nginx_proxy_proxy_grafana_hostname }};
server_tokens off;
root /dev/null;
ssl_certificate {{ matrix_ssl_config_dir_path }}/live/{{ matrix_nginx_proxy_proxy_grafana_hostname }}/fullchain.pem;
ssl_certificate_key {{ matrix_ssl_config_dir_path }}/live/{{ matrix_nginx_proxy_proxy_grafana_hostname }}/privkey.pem;
ssl_protocols {{ matrix_nginx_proxy_ssl_protocols }};
{% if matrix_nginx_proxy_ssl_ciphers != "" %}
ssl_ciphers {{ matrix_nginx_proxy_ssl_ciphers }};
{% endif %}
ssl_prefer_server_ciphers {{ matrix_nginx_proxy_ssl_prefer_server_ciphers }};
{{ render_vhost_directives() }}
}
{% endif %}

View file

@ -45,6 +45,11 @@ http {
keepalive_timeout 65;
#gzip on;
{# Map directive needed for proxied WebSocket upgrades #}
map $http_upgrade $connection_upgrade {
default upgrade;
'' close;
}
include /etc/nginx/conf.d/*.conf;
}

View file

@ -17,11 +17,11 @@ matrix_postgres_architecture: amd64
# > LOG: startup process (PID 37) was terminated by signal 11: Segmentation fault
matrix_postgres_docker_image_suffix: "{{ '-alpine' if matrix_postgres_architecture in ['amd64', 'arm64'] else '' }}"
matrix_postgres_docker_image_v9: "docker.io/postgres:9.6.20{{ matrix_postgres_docker_image_suffix }}"
matrix_postgres_docker_image_v10: "docker.io/postgres:10.15{{ matrix_postgres_docker_image_suffix }}"
matrix_postgres_docker_image_v11: "docker.io/postgres:11.10{{ matrix_postgres_docker_image_suffix }}"
matrix_postgres_docker_image_v12: "docker.io/postgres:12.5{{ matrix_postgres_docker_image_suffix }}"
matrix_postgres_docker_image_v13: "docker.io/postgres:13.1{{ matrix_postgres_docker_image_suffix }}"
matrix_postgres_docker_image_v9: "docker.io/postgres:9.6.21{{ matrix_postgres_docker_image_suffix }}"
matrix_postgres_docker_image_v10: "docker.io/postgres:10.16{{ matrix_postgres_docker_image_suffix }}"
matrix_postgres_docker_image_v11: "docker.io/postgres:11.11{{ matrix_postgres_docker_image_suffix }}"
matrix_postgres_docker_image_v12: "docker.io/postgres:12.6{{ matrix_postgres_docker_image_suffix }}"
matrix_postgres_docker_image_v13: "docker.io/postgres:13.2{{ matrix_postgres_docker_image_suffix }}"
matrix_postgres_docker_image_latest: "{{ matrix_postgres_docker_image_v13 }}"
# This variable is assigned at runtime. Overriding its value has no effect.

View file

@ -2,18 +2,18 @@
-- Seen here: https://stackoverflow.com/a/49858797
DO $$
BEGIN
CREATE USER {{ additional_db.username }};
CREATE USER "{{ additional_db.username }}";
EXCEPTION WHEN DUPLICATE_OBJECT THEN
RAISE NOTICE 'not creating user {{ additional_db.username }}, since it already exists';
RAISE NOTICE 'not creating user "{{ additional_db.username }}", since it already exists';
END
$$;
-- This is useful for initial user creation (since we don't assign a password above) and for handling subsequent password changes
-- TODO - we should escape quotes in the password.
ALTER ROLE {{ additional_db.username }} PASSWORD '{{ additional_db.password }}';
ALTER ROLE "{{ additional_db.username }}" PASSWORD '{{ additional_db.password }}';
-- This will generate an error on subsequent execution
CREATE DATABASE {{ additional_db.name }} WITH LC_CTYPE 'C' LC_COLLATE 'C' OWNER {{ additional_db.username }};
CREATE DATABASE "{{ additional_db.name }}" WITH LC_CTYPE 'C' LC_COLLATE 'C' OWNER "{{ additional_db.username }}";
-- This is useful for changing the database owner subsequently
ALTER DATABASE {{ additional_db.name }} OWNER TO {{ additional_db.username }};
ALTER DATABASE "{{ additional_db.name }}" OWNER TO "{{ additional_db.username }}";

View file

@ -9,4 +9,5 @@ docker run \
--env-file={{ matrix_postgres_base_path }}/env-postgres-psql \
--network {{ matrix_docker_network }} \
{{ matrix_postgres_docker_image_to_use }} \
psql -h {{ matrix_postgres_connection_hostname }}
psql -h {{ matrix_postgres_connection_hostname }} \
"$@"

View file

@ -0,0 +1,21 @@
# matrix-prometheus-node-exporter is an Prometheus exporter for machine metrics
# See: https://prometheus.io/docs/guides/node-exporter/
matrix_prometheus_node_exporter_enabled: false
matrix_prometheus_node_exporter_docker_image: "docker.io/prom/node-exporter:v1.1.0"
matrix_prometheus_node_exporter_docker_image_force_pull: "{{ matrix_prometheus_node_exporter_docker_image.endswith(':latest') }}"
# A list of extra arguments to pass to the container
matrix_prometheus_node_exporter_container_extra_arguments: []
# List of systemd services that matrix-prometheus.service depends on
matrix_prometheus_node_exporter_systemd_required_services_list: ['docker.service']
# List of systemd services that matrix-prometheus.service wants
matrix_prometheus_node_exporter_systemd_wanted_services_list: []
# Controls whether the matrix-prometheus container exposes its HTTP port (tcp/9100 in the container).
#
# Takes an "<ip>:<port>" or "<port>" value (e.g. "127.0.0.1:9100"), or empty string to not expose.
matrix_prometheus_node_exporter_container_http_host_bind_port: ''

View file

@ -0,0 +1,5 @@
- set_fact:
matrix_systemd_services_list: "{{ matrix_systemd_services_list + ['matrix-prometheus-node-exporter.service'] }}"
when: matrix_prometheus_node_exporter_enabled|bool

View file

@ -0,0 +1,8 @@
- import_tasks: "{{ role_path }}/tasks/init.yml"
tags:
- always
- import_tasks: "{{ role_path }}/tasks/setup.yml"
tags:
- setup-all
- setup-prometheus-node-exporter

View file

@ -0,0 +1,60 @@
---
#
# Tasks related to setting up matrix-prometheus-node-exporter
#
- name: Ensure matrix-prometheus-node-exporter image is pulled
docker_image:
name: "{{ matrix_prometheus_node_exporter_docker_image }}"
source: "{{ 'pull' if ansible_version.major > 2 or ansible_version.minor > 7 else omit }}"
force_source: "{{ matrix_prometheus_node_exporter_docker_image_force_pull if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}"
force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else matrix_prometheus_node_exporter_docker_image_force_pull }}"
when: "matrix_prometheus_node_exporter_enabled|bool"
- name: Ensure matrix-prometheus-node-exporter.service installed
template:
src: "{{ role_path }}/templates/systemd/matrix-prometheus-node-exporter.service.j2"
dest: "{{ matrix_systemd_path }}/matrix-prometheus-node-exporter.service"
mode: 0644
register: matrix_prometheus_node_exporter_systemd_service_result
when: matrix_prometheus_node_exporter_enabled|bool
- name: Ensure systemd reloaded after matrix-prometheus.service installation
service:
daemon_reload: yes
when: "matrix_prometheus_node_exporter_enabled|bool and matrix_prometheus_node_exporter_systemd_service_result.changed"
#
# Tasks related to getting rid of matrix-prometheus-node-exporter (if it was previously enabled)
#
- name: Check existence of matrix-prometheus-node-exporter service
stat:
path: "{{ matrix_systemd_path }}/matrix-prometheus-node-exporter.service"
register: matrix_prometheus_node_exporter_service_stat
- name: Ensure matrix-prometheus-node-exporter is stopped
service:
name: matrix-prometheus-node-exporter
state: stopped
daemon_reload: yes
register: stopping_result
when: "not matrix_prometheus_node_exporter_enabled|bool and matrix_prometheus_node_exporter_service_stat.stat.exists"
- name: Ensure matrix-prometheus-node-exporter.service doesn't exist
file:
path: "{{ matrix_systemd_path }}/matrix-prometheus-node-exporter.service"
state: absent
when: "not matrix_prometheus_node_exporter_enabled|bool and matrix_prometheus_node_exporter_service_stat.stat.exists"
- name: Ensure systemd reloaded after matrix-prometheus-node-exporter.service removal
service:
daemon_reload: yes
when: "not matrix_prometheus_node_exporter_enabled|bool and matrix_prometheus_node_exporter_service_stat.stat.exists"
- name: Ensure matrix-prometheus-node-exporter Docker image doesn't exist
docker_image:
name: "{{ matrix_prometheus_node_exporter_docker_image }}"
state: absent
when: "not matrix_prometheus_node_exporter_enabled|bool"

View file

@ -0,0 +1,44 @@
#jinja2: lstrip_blocks: "True"
[Unit]
Description=matrix-prometheus-node-exporter
{% for service in matrix_prometheus_node_exporter_systemd_required_services_list %}
Requires={{ service }}
After={{ service }}
{% endfor %}
{% for service in matrix_prometheus_node_exporter_systemd_wanted_services_list %}
Wants={{ service }}
{% endfor %}
DefaultDependencies=no
[Service]
Type=simple
Environment="HOME={{ matrix_systemd_unit_home_path }}"
ExecStartPre=-{{ matrix_host_command_sh }} -c '{{ matrix_host_command_docker }} kill matrix-prometheus-node-exporter 2>/dev/null'
ExecStartPre=-{{ matrix_host_command_sh }} -c '{{ matrix_host_command_docker }} rm matrix-prometheus-node-exporter 2>/dev/null'
ExecStart={{ matrix_host_command_docker }} run --rm --name matrix-prometheus-node-exporter \
--log-driver=none \
--user={{ matrix_user_uid }}:{{ matrix_user_gid }} \
--cap-drop=ALL \
--read-only \
{% if matrix_prometheus_node_exporter_container_http_host_bind_port %}
-p {{ matrix_prometheus_node_exporter_container_http_host_bind_port }}:9100 \
{% endif %}
{% for arg in matrix_prometheus_node_exporter_container_extra_arguments %}
{{ arg }} \
{% endfor %}
--net=host \
--pid=host \
--mount type=bind,src=/,dst=/host,ro,bind-propagation=rslave \
{{ matrix_prometheus_node_exporter_docker_image }} \
--path.rootfs=/host
ExecStop=-{{ matrix_host_command_sh }} -c '{{ matrix_host_command_docker }} kill matrix-prometheus-node-exporter 2>/dev/null'
ExecStop=-{{ matrix_host_command_sh }} -c '{{ matrix_host_command_docker }} rm matrix-prometheus-node-exporter 2>/dev/null'
Restart=always
RestartSec=30
SyslogIdentifier=matrix-prometheus-node-exporter
[Install]
WantedBy=multi-user.target

View file

@ -0,0 +1,66 @@
# matrix-prometheus is an open-source systems monitoring and alerting toolkit
# See: https://github.com/matrix-org/synapse/blob/master/docs/metrics-howto.md
matrix_prometheus_enabled: false
matrix_prometheus_docker_image: "docker.io/prom/prometheus:v2.24.1"
matrix_prometheus_docker_image_force_pull: "{{ matrix_prometheus_docker_image.endswith(':latest') }}"
matrix_prometheus_base_path: "{{ matrix_base_data_path }}/prometheus"
matrix_prometheus_config_path: "{{ matrix_prometheus_base_path }}/config"
matrix_prometheus_data_path: "{{ matrix_prometheus_base_path }}/data"
# A list of extra arguments to pass to the container
matrix_prometheus_container_extra_arguments: []
# List of systemd services that matrix-prometheus.service depends on
matrix_prometheus_systemd_required_services_list: ['docker.service']
# List of systemd services that matrix-prometheus.service wants
matrix_prometheus_systemd_wanted_services_list: []
# Controls whether the matrix-prometheus container exposes its HTTP port (tcp/9090 in the container).
#
# Takes an "<ip>:<port>" or "<port>" value (e.g. "127.0.0.1:9090"), or empty string to not expose.
matrix_prometheus_container_http_host_bind_port: ''
# Tells whether the "synapse" scraper configuration is enabled.
matrix_prometheus_scraper_synapse_enabled: false
# Tells whether to download and load a Synapse rules file
matrix_prometheus_scraper_synapse_rules_enabled: "{{ matrix_prometheus_scraper_synapse_enabled }}"
matrix_prometheus_scraper_synapse_rules_synapse_tag: "master"
matrix_prometheus_scraper_synapse_rules_download_url: "https://raw.githubusercontent.com/matrix-org/synapse/{{ matrix_prometheus_scraper_synapse_rules_synapse_tag }}/contrib/prometheus/synapse-v2.rules"
matrix_prometheus_scraper_synapse_targets: []
# Tells whether the "node" scraper configuration is enabled.
# This configuration aims to scrape the current node (this server).
matrix_prometheus_scraper_node_enabled: false
# Target addresses for the "node" scraper configuration.
# Unless you define this as a non-empty list, it gets populated at runtime with the IP address of `matrix-prometheus-node-exporter` and port 9100.
matrix_prometheus_scraper_node_targets: []
# Default prometheus configuration template which covers the generic use case.
# You can customize it by controlling the various variables inside it.
#
# For a more advanced customization, you can extend the default (see `matrix_prometheus_configuration_extension_yaml`)
# or completely replace this variable with your own template.
matrix_prometheus_configuration_yaml: "{{ lookup('template', 'templates/prometheus.yml.j2') }}"
matrix_prometheus_configuration_extension_yaml: |
# Your custom YAML configuration goes here.
# This configuration extends the default starting configuration (`matrix_prometheus_configuration_yaml`).
#
# You can override individual variables from the default configuration, or introduce new ones.
#
# If you need something more special, you can take full control by
# completely redefining `matrix_prometheus_configuration_yaml`.
matrix_prometheus_configuration_extension: "{{ matrix_prometheus_configuration_extension_yaml|from_yaml if matrix_prometheus_configuration_extension_yaml|from_yaml is mapping else {} }}"
# Holds the final configuration (a combination of the default and its extension).
# You most likely don't need to touch this variable. Instead, see `matrix_prometheus_configuration_yaml`.
matrix_prometheus_configuration: "{{ matrix_prometheus_configuration_yaml|from_yaml|combine(matrix_prometheus_configuration_extension, recursive=True) }}"

View file

@ -0,0 +1,5 @@
- set_fact:
matrix_systemd_services_list: "{{ matrix_systemd_services_list + ['matrix-prometheus.service'] }}"
when: matrix_prometheus_enabled|bool

View file

@ -0,0 +1,21 @@
- import_tasks: "{{ role_path }}/tasks/init.yml"
tags:
- always
- import_tasks: "{{ role_path }}/tasks/validate_config.yml"
when: "run_setup|bool and matrix_prometheus_enabled|bool"
tags:
- setup-all
- setup-prometheus
- import_tasks: "{{ role_path }}/tasks/setup_install.yml"
when: "run_setup|bool and matrix_prometheus_enabled|bool"
tags:
- setup-all
- setup-prometheus
- import_tasks: "{{ role_path }}/tasks/setup_uninstall.yml"
when: "run_setup|bool and not matrix_prometheus_enabled|bool"
tags:
- setup-all
- setup-prometheus

View file

@ -0,0 +1,66 @@
---
- name: Ensure matrix-prometheus image is pulled
docker_image:
name: "{{ matrix_prometheus_docker_image }}"
source: "{{ 'pull' if ansible_version.major > 2 or ansible_version.minor > 7 else omit }}"
force_source: "{{ matrix_prometheus_docker_image_force_pull if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}"
force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else matrix_prometheus_docker_image_force_pull }}"
- name: Ensure Prometheus paths exists
file:
path: "{{ item }}"
state: directory
mode: 0750
owner: "{{ matrix_user_username }}"
group: "{{ matrix_user_groupname }}"
with_items:
- "{{ matrix_prometheus_base_path }}"
- "{{ matrix_prometheus_config_path }}"
- "{{ matrix_prometheus_data_path }}"
- block:
# Well, this actually creates the network if it doesn't exist, but..
# The network should have been created by `matrix-base` already.
# We don't rely on that other call and its result, because it runs
# on `--tags=setup-all`, but will get skipped during `--tags=setup-prometheus`.
- name: Fetch Matrix Docker network details
docker_network:
name: "{{ matrix_docker_network }}"
driver: bridge
register: matrix_docker_network_info
- set_fact:
matrix_prometheus_scraper_node_targets: ["{{ matrix_docker_network_info.network.IPAM.Config[0].Gateway }}:9100"]
when: "matrix_prometheus_scraper_node_enabled|bool and matrix_prometheus_scraper_node_targets|length == 0"
- name: Download synapse-v2.rules
get_url:
url: "{{ matrix_prometheus_scraper_synapse_rules_download_url }}"
dest: "{{ matrix_prometheus_config_path }}/synapse-v2.rules"
force: true
mode: 0440
owner: "{{ matrix_user_username }}"
group: "{{ matrix_user_groupname }}"
when: "matrix_prometheus_scraper_synapse_rules_enabled|bool"
- name: Ensure prometheus.yml installed
copy:
content: "{{ matrix_prometheus_configuration|to_nice_yaml }}"
dest: "{{ matrix_prometheus_config_path }}/prometheus.yml"
mode: 0644
owner: "{{ matrix_user_username }}"
group: "{{ matrix_user_groupname }}"
- name: Ensure matrix-prometheus.service installed
template:
src: "{{ role_path }}/templates/systemd/matrix-prometheus.service.j2"
dest: "{{ matrix_systemd_path }}/matrix-prometheus.service"
mode: 0644
register: matrix_prometheus_systemd_service_result
- name: Ensure systemd reloaded after matrix-prometheus.service installation
service:
daemon_reload: yes
when: "matrix_prometheus_systemd_service_result.changed|bool"

View file

@ -0,0 +1,31 @@
---
- name: Check existence of matrix-prometheus service
stat:
path: "{{ matrix_systemd_path }}/matrix-prometheus.service"
register: matrix_prometheus_service_stat
- name: Ensure matrix-prometheus is stopped
service:
name: matrix-prometheus
state: stopped
daemon_reload: yes
register: stopping_result
when: "matrix_prometheus_service_stat.stat.exists|bool"
- name: Ensure matrix-prometheus.service doesn't exist
file:
path: "{{ matrix_systemd_path }}/matrix-prometheus.service"
state: absent
when: "matrix_prometheus_service_stat.stat.exists|bool"
- name: Ensure systemd reloaded after matrix-prometheus.service removal
service:
daemon_reload: yes
when: "matrix_prometheus_service_stat.stat.exists|bool"
- name: Ensure matrix-prometheus Docker image doesn't exist
docker_image:
name: "{{ matrix_prometheus_docker_image }}"
state: absent
when: "not matrix_prometheus_enabled|bool"

View file

@ -0,0 +1,7 @@
---
- name: Fail if Synapse metrics or Prometheus Node Exporter not enabled
fail:
msg: >
You need to enable `matrix_prometheus_scraper_synapse_enabled` and/or `matrix_prometheus_scraper_node_enabled` for Prometheus grab metrics.
when: "not matrix_prometheus_scraper_synapse_enabled and not matrix_prometheus_scraper_node_enabled"

View file

@ -0,0 +1,40 @@
#jinja2: lstrip_blocks: "True"
global:
scrape_interval: 15s # Set the scrape interval to every 15 seconds. Default is every 1 minute.
evaluation_interval: 15s # Evaluate rules every 15 seconds. The default is every 1 minute.
# scrape_timeout is set to the global default (10s).
# Load rules once and periodically evaluate them according to the global 'evaluation_interval'.
rule_files:
{% if matrix_prometheus_scraper_synapse_rules_enabled %}
- 'synapse-v2.rules'
{% endif %}
# A scrape configuration containing exactly one endpoint to scrape:
# Here it's Prometheus itself.
scrape_configs:
# The job name is added as a label `job=<job_name>` to any timeseries scraped from this config.
- job_name: 'prometheus'
# Override the global default and scrape targets from this job every 5 seconds.
scrape_interval: 5s
scrape_timeout: 5s
# metrics_path defaults to '/metrics'
# scheme defaults to 'http'.
static_configs:
- targets: ['localhost:9090']
{% if matrix_prometheus_scraper_synapse_enabled %}
- job_name: 'synapse'
metrics_path: '/_synapse/metrics'
static_configs:
- targets: {{ matrix_prometheus_scraper_synapse_targets|to_json }}
{% endif %}
{% if matrix_prometheus_scraper_node_enabled %}
- job_name: node
static_configs:
- targets: {{ matrix_prometheus_scraper_node_targets|to_json }}
{% endif %}

View file

@ -0,0 +1,43 @@
#jinja2: lstrip_blocks: "True"
[Unit]
Description=matrix-prometheus
{% for service in matrix_prometheus_systemd_required_services_list %}
Requires={{ service }}
After={{ service }}
{% endfor %}
{% for service in matrix_prometheus_systemd_wanted_services_list %}
Wants={{ service }}
{% endfor %}
DefaultDependencies=no
[Service]
Type=simple
Environment="HOME={{ matrix_systemd_unit_home_path }}"
ExecStartPre=-{{ matrix_host_command_sh }} -c '{{ matrix_host_command_docker }} kill matrix-prometheus 2>/dev/null'
ExecStartPre=-{{ matrix_host_command_sh }} -c '{{ matrix_host_command_docker }} rm matrix-prometheus 2>/dev/null'
ExecStart={{ matrix_host_command_docker }} run --rm --name matrix-prometheus \
--log-driver=none \
--user={{ matrix_user_uid }}:{{ matrix_user_gid }} \
--cap-drop=ALL \
--read-only \
--network={{ matrix_docker_network }} \
{% if matrix_prometheus_container_http_host_bind_port %}
-p {{ matrix_prometheus_container_http_host_bind_port }}:9090 \
{% endif %}
-v {{ matrix_prometheus_config_path }}:/etc/prometheus:z \
-v {{ matrix_prometheus_data_path }}:/prometheus:z \
{% for arg in matrix_prometheus_container_extra_arguments %}
{{ arg }} \
{% endfor %}
{{ matrix_prometheus_docker_image }}
ExecStop=-{{ matrix_host_command_sh }} -c '{{ matrix_host_command_docker }} kill matrix-prometheus 2>/dev/null'
ExecStop=-{{ matrix_host_command_sh }} -c '{{ matrix_host_command_docker }} rm matrix-prometheus 2>/dev/null'
Restart=always
RestartSec=30
SyslogIdentifier=matrix-prometheus
[Install]
WantedBy=multi-user.target

View file

@ -412,6 +412,7 @@ matrix_s3_media_store_bucket_name: "your-bucket-name"
matrix_s3_media_store_aws_access_key: "your-aws-access-key"
matrix_s3_media_store_aws_secret_key: "your-aws-secret-key"
matrix_s3_media_store_region: "eu-central-1"
matrix_s3_media_store_path: "{{ matrix_synapse_media_store_path }}"
# Controls whether the self-check feature should validate SSL certificates.
matrix_synapse_self_check_validate_certificates: true

View file

@ -8,18 +8,18 @@
# This will throw a Permission Denied error if already mounted
- name: Check Matrix Goofys external storage mountpoint path
stat:
path: "{{ matrix_synapse_media_store_path }}"
register: local_path_matrix_synapse_media_store_path_stat
path: "{{ matrix_s3_media_store_path }}"
register: local_path_matrix_s3_media_store_path_stat
ignore_errors: yes
- name: Ensure Matrix Goofys external storage mountpoint exists
file:
path: "{{ matrix_synapse_media_store_path }}"
path: "{{ matrix_s3_media_store_path }}"
state: directory
mode: 0750
owner: "{{ matrix_user_username }}"
group: "{{ matrix_user_groupname }}"
when: "not local_path_matrix_synapse_media_store_path_stat.failed and not local_path_matrix_synapse_media_store_path_stat.stat.exists"
when: "not local_path_matrix_s3_media_store_path_stat.failed and not local_path_matrix_s3_media_store_path_stat.stat.exists"
- name: Ensure goofys environment variables file created
template:

View file

@ -34,7 +34,7 @@
--entrypoint=/bin/sh
{{ matrix_postgres_docker_image_latest }}
-c "cat /work/state-compressor.sql |
psql -v ON_ERROR_STOP=1 -h matrix-postgres"
psql -v ON_ERROR_STOP=1 -h matrix-postgres -d {{ matrix_synapse_database_database }}"
- name: Import compression SQL into Postgres
command: "{{ matrix_synapse_rust_synapse_compress_state_psql_import_command }}"

View file

@ -16,7 +16,7 @@ ExecStart={{ matrix_host_command_docker }} run --rm --name %n \
--user={{ matrix_user_uid }}:{{ matrix_user_gid }} \
--mount type=bind,src=/etc/passwd,dst=/etc/passwd,ro \
--mount type=bind,src=/etc/group,dst=/etc/group,ro \
--mount type=bind,src={{ matrix_synapse_media_store_path }},dst=/s3,bind-propagation=shared \
--mount type=bind,src={{ matrix_s3_media_store_path }},dst=/s3,bind-propagation=shared \
--security-opt apparmor:unconfined \
--cap-add mknod \
--cap-add sys_admin \
@ -30,7 +30,7 @@ TimeoutStartSec=5min
ExecStop=-{{ matrix_host_command_docker }} stop %n
ExecStop=-{{ matrix_host_command_docker }} kill %n
ExecStop=-{{ matrix_host_command_docker }} rm %n
ExecStop=-{{ matrix_host_command_fusermount }} -u {{ matrix_synapse_media_store_path }}
ExecStop=-{{ matrix_host_command_fusermount }} -u {{ matrix_s3_media_store_path }}
Restart=always
RestartSec=5
SyslogIdentifier=matrix-goofys

View file

@ -32,11 +32,15 @@
- matrix-bot-matrix-reminder-bot
- matrix-synapse
- matrix-synapse-admin
- matrix-prometheus-node-exporter
- matrix-prometheus
- matrix-grafana
- matrix-registration
- matrix-client-element
- matrix-jitsi
- matrix-ma1sd
- matrix-dimension
- matrix-etherpad
- matrix-email2matrix
- matrix-nginx-proxy
- matrix-coturn