Merge branch 'braid/matrix-ldap-registration-proxy' of https://github.com/TheOneWithTheBraid/matrix-docker-ansible-deploy into matrix-ldap-registration-proxy

This commit is contained in:
Julian-Samuel Gebühr 2022-09-16 19:40:00 +02:00
commit cd21525b4b
43 changed files with 606 additions and 120 deletions

View file

@ -1,3 +1,12 @@
# 2022-09-09
## Cactus Comments support
Thanks to [Julian-Samuel Gebühr (@moan0s)](https://github.com/moan0s), the playbook can now set up [Cactus Comments](https://cactus.chat) - federated comment system for the web based on Matrix.
See our [Setting up a Cactus Comments server](docs/configuring-playbook-cactus-comments.md) documentation to get started.
# 2022-08-23
## Postmoogle email bridge support

View file

@ -139,6 +139,8 @@ Using this playbook, you can get the following services configured on your serve
- (optional) the [Buscarron](https://gitlab.com/etke.cc/buscarron) bot - see [docs/configuring-playbook-bot-buscarron.md](docs/configuring-playbook-bot-buscarron.md) for setup documentation
- (optional) [Cactus Comments](https://cactus.chat), a federated comment system built on matrix - see [docs/configuring-playbook-cactus-comments.md](docs/configuring-playbook-cactus-comments.md) for setup documentation
Basically, this playbook aims to get you up-and-running with all the necessities around Matrix, without you having to do anything else.
**Note**: the list above is exhaustive. It includes optional or even some advanced components that you will most likely not need.

View file

@ -28,18 +28,22 @@ If you are using Cloudflare DNS, make sure to disable the proxy and set all reco
## DNS settings for optional services/features
| Type | Host | Priority | Weight | Port | Target |
| ----- | ---------------------------- | -------- | ------ | ---- | ---------------------- |
| SRV | `_matrix-identity._tcp` | 10 | 0 | 443 | `matrix.<your-domain>` |
| CNAME | `dimension` | - | - | - | `matrix.<your-domain>` |
| CNAME | `jitsi` | - | - | - | `matrix.<your-domain>` |
| CNAME | `stats` | - | - | - | `matrix.<your-domain>` |
| CNAME | `goneb` | - | - | - | `matrix.<your-domain>` |
| CNAME | `sygnal` | - | - | - | `matrix.<your-domain>` |
| CNAME | `ntfy` | - | - | - | `matrix.<your-domain>` |
| CNAME | `hydrogen` | - | - | - | `matrix.<your-domain>` |
| CNAME | `cinny` | - | - | - | `matrix.<your-domain>` |
| CNAME | `buscarron` | - | - | - | `matrix.<your-domain>` |
| Used by component | Type | Host | Priority | Weight | Port | Target |
| ----------------------------------------------------------------------------------------------------------------------- | ----- | ------------------------------ | -------- | ------ | ---- | --------------------------- |
| [ma1sd](configuring-playbook-ma1sd.md) identity server | SRV | `_matrix-identity._tcp` | 10 | 0 | 443 | `matrix.<your-domain>` |
| [Dimension](configuring-playbook-dimension.md) integration server | CNAME | `dimension` | - | - | - | `matrix.<your-domain>` |
| [Jitsi](configuring-playbook-jitsi.md) video-conferencing platform | CNAME | `jitsi` | - | - | - | `matrix.<your-domain>` |
| [Prometheus/Grafana](configuring-playbook-prometheus-grafana.md) monitoring system | CNAME | `stats` | - | - | - | `matrix.<your-domain>` |
| [Go-NEB](configuring-playbook-bot-go-neb.md) bot | CNAME | `goneb` | - | - | - | `matrix.<your-domain>` |
| [Sygnal](configuring-playbook-sygnal.md) push notification gateway | CNAME | `sygnal` | - | - | - | `matrix.<your-domain>` |
| [ntfy](configuring-playbook-ntfy.md) push notifications server | CNAME | `ntfy` | - | - | - | `matrix.<your-domain>` |
| [Hydrogen](configuring-playbook-client-hydrogen.md) web client | CNAME | `hydrogen` | - | - | - | `matrix.<your-domain>` |
| [Cinny](configuring-playbook-client-cinny.md) web client | CNAME | `cinny` | - | - | - | `matrix.<your-domain>` |
| [Buscarron](configuring-playbook-bot-buscarron.md) helpdesk bot | CNAME | `buscarron` | - | - | - | `matrix.<your-domain>` |
| [Postmoogle](configuring-playbook-bot-postmoogle.md)/[Email2Matrix](configuring-playbook-email2matrix.md) email bridges | MX | `matrix` | 10 | 0 | - | `matrix.<your-domain>` |
| [Postmoogle](configuring-playbook-bot-postmoogle.md) email bridge | TXT | `matrix` | - | - | - | `v=spf1 ip4:<your-ip> -all` |
| [Postmoogle](configuring-playbook-bot-postmoogle.md) email bridge | TXT | `_dmarc.matrix` | - | - | - | `v=DMARC1; p=quarantine;` |
| [Postmoogle](configuring-playbook-bot-postmoogle.md) email bridge | TXT | `postmoogle._domainkey.matrix` | - | - | - | get it from `!pm dkim` |
## Subdomains setup
@ -77,3 +81,8 @@ This is an optional feature for the optionally-installed [ma1sd service](configu
Note: This `_matrix-identity._tcp` SRV record for the identity server is different from the `_matrix._tcp` that can be used for Synapse delegation. See [howto-server-delegation.md](howto-server-delegation.md) for more information about delegation.
When you're done with the DNS configuration and ready to proceed, continue with [Getting the playbook](getting-the-playbook.md).
## `_dmarc`, `postmoogle._domainkey` TXT and `matrix` MX records setup
To make the [postmoogle](configuring-playbook-bot-postmoogle.md) email bridge enable its email sending features, you need to configure
SPF (TXT), DMARC (TXT), DKIM (TXT) and MX records

View file

@ -56,7 +56,7 @@ ansible-playbook -i inventory/hosts setup.yml --tags=setup-all,start
## Usage
To use the bot, create a **non-encrypted** room and invite `@bot.matrix-registration-bot:DOMAIN` (where `YOUR_DOMAIN` is your base domain, not the `matrix.` domain).
To use the bot, create a **non-encrypted** room and invite `@bot.matrix-registration-bot:DOMAIN` (where `DOMAIN` is your base domain, not the `matrix.` domain).
In this room send `help` and the bot will reply with all options.

View file

@ -35,6 +35,9 @@ matrix_bot_postmoogle_enabled: true
matrix_bot_postmoogle_password: PASSWORD_FOR_THE_BOT
```
You will also need to add several DNS records so that postmoogle can send emails.
See [Configuring DNS](configuring-dns.md).
## Installing

View file

@ -0,0 +1,65 @@
# Setting up Cactus Comments (optional)
The playbook can install and configure [Cactus Comments](https://cactus.chat) for you.
Cactus Comments is a **federated comment system** built on Matrix. The role allows you to self-host the system.
It respects your privacy, and puts you in control.
See the project's [documentation](https://cactus.chat/docs/getting-started/introduction/) to learn what it
does and why it might be useful to you.
## Configuration
Add the following block to your `vars.yaml` and make sure to exchange the tokens to randomly generated values.
```yaml
#################
## Cactus Chat ##
#################
matrix_cactus_comments_enabled: true
# To allow guest comments without users needing to log in, you need to have guest registration enabled.
# To do this you need to uncomment one of the following lines (depending if you are using synapse or dentrite as a homeserver)
# If you don't know which one you use: The default is synapse ;)
# matrix_synapse_allow_guest_access: true
# matrix_dentrite_allow_guest_access
```
## Installing
After configuring the playbook, run the [installation](installing.md) command again:
```
ansible-playbook -i inventory/hosts setup.yml --tags=setup-all,start
```
## Usage
Upon starting Cactus Comments, a `bot.cactusbot` user account is created automatically.
To get started, send a `help` message to the `@bot.cactusbot:your-homeserver.com` bot to confirm it's working.
Then, register a site by typing: `register <sitename>`. You will then be invited into a moderation room.
Now you are good to go and can include the comment section on your website!
**Careful:** To really make use of self-hosting you need change a few things in comparison to the official docs!
Insert the following snippet into you page and make sure to replace `example.com` with your base domain!
```html
<script type="text/javascript" src="https://matrix.example.com/cactus-comments/cactus.js"></script>
<link rel="stylesheet" href="https://matrix.example.com/cactus-comments/style.css" type="text/css">
<div id="comment-section"></div>
<script>
initComments({
node: document.getElementById("comment-section"),
defaultHomeserverUrl: "https://matrix.example.com:8448",
serverName: "example.com",
siteName: "YourSiteName",
commentSectionId: "1"
})
</script>
```

View file

@ -1,6 +1,7 @@
# Setting up Email2Matrix (optional)
**Note**: email bridging can also happen via the [Postmoogle](configuring-playbook-bot-postmoogle.md) bot supported by the playbook.
Postmoogle is much more powerful and easier to use, so we recommend that you use it, instead of Email2Matrix.
The playbook can install and configure [email2matrix](https://github.com/devture/email2matrix) for you.
@ -9,6 +10,10 @@ See the project's [documentation](https://github.com/devture/email2matrix/blob/m
## Preparation
### DNS configuration
It's not strictly necessary, but you may increase the chances that incoming emails reach your server by adding an `MX` record for `matrix.DOMAIN`, as described in the [Configuring DNS](configuring-dns.md) documentation page.
### Port availability
Ensure that port 25 is available on your Matrix server and open in your firewall.

View file

@ -182,4 +182,4 @@ When you're done with all the configuration you'd like to do, continue with [Ins
- [Setting up the ntfy push notifications server](configuring-playbook-ntfy.md) (optional)
- [Setting up a Cactus Comments server](configuring-playbook-cactus-comments.md) - a federated comment system built on Matrix (optional)

View file

@ -117,3 +117,5 @@ These services are not part of our default installation, but can be enabled by [
- [matrixdotorg/sygnal](https://hub.docker.com/r/matrixdotorg/sygnal/) - [Sygnal](https://github.com/matrix-org/sygnal) is a reference Push Gateway for Matrix
- [binwiederhier/ntfy](https://hub.docker.com/r/binwiederhier/ntfy/) - [ntfy](https://ntfy.sh/) is a self-hosted, UnifiedPush-compatible push notifications server
- [cactuscomments/cactus-appservice](https://hub.docker.com/r/cactuscomments/cactus-appservice/) - [Cactus Comments](https://cactus.chat) a federated comment system built on Matrix

View file

@ -1210,6 +1210,9 @@ matrix_bot_buscarron_container_image_self_build: "{{ matrix_architecture not in
# We don't enable bots by default.
matrix_bot_postmoogle_enabled: false
matrix_bot_postmoogle_ssl_path: "{{ matrix_ssl_config_dir_path }}"
matrix_bot_postmoogle_tls_cert: "/ssl/live/{{ matrix_bot_postmoogle_domain }}/fullchain.pem"
matrix_bot_postmoogle_tls_key: "/ssl/live/{{ matrix_bot_postmoogle_domain }}/privkey.pem"
matrix_bot_postmoogle_systemd_required_services_list: |
{{
@ -1329,6 +1332,35 @@ matrix_backup_borg_systemd_required_services_list: |
# /matrix-backup-borg
#
######################################################################
######################################################################
#
# matrix-cactus-comments
#
######################################################################
matrix_cactus_comments_enabled: false
# Derive secret values from homeserver secret
matrix_cactus_comments_as_token: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'cactus.as.token') | to_uuid }}"
matrix_cactus_comments_hs_token: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'cactus.hs.token') | to_uuid }}"
matrix_cactus_comments_container_image_self_build: "{{ matrix_architecture not in ['amd64', 'arm32', 'arm64'] }}"
matrix_cactus_comments_systemd_required_services_list: |
{{
(['docker.service'])
+
(['matrix-nginx-proxy.service'] if matrix_nginx_proxy_enabled else [])
+
(['matrix-' + matrix_homeserver_implementation + '.service'])
}}
matrix_cactus_comments_client_nginx_path: "{{ '/cactus-comments/' if matrix_nginx_proxy_enabled else matrix_cactus_comments_client_path + '/' }}"
######################################################################
#
# /matrix-cactus-comments
#
######################################################################
######################################################################
#
@ -1750,7 +1782,6 @@ matrix_nginx_proxy_synapse_generic_worker_client_server_locations: "{{ matrix_sy
matrix_nginx_proxy_synapse_generic_worker_federation_locations: "{{ matrix_synapse_workers_generic_worker_federation_endpoints }}"
matrix_nginx_proxy_synapse_media_repository_locations: "{{matrix_synapse_workers_media_repository_endpoints|default([]) }}"
matrix_nginx_proxy_synapse_user_dir_locations: "{{ matrix_synapse_workers_user_dir_endpoints|default([]) }}"
matrix_nginx_proxy_synapse_frontend_proxy_locations: "{{ matrix_synapse_workers_frontend_proxy_endpoints|default([]) }}"
matrix_nginx_proxy_systemd_wanted_services_list: |
{{
@ -1811,6 +1842,8 @@ matrix_ssl_domains_to_obtain_certificates_for: |
+
([matrix_server_fqn_ntfy] if matrix_ntfy_enabled else [])
+
([matrix_bot_postmoogle_domain] if matrix_bot_postmoogle_enabled else [])
+
([matrix_domain] if matrix_nginx_proxy_base_domain_serving_enabled else [])
+
matrix_ssl_additional_domains_to_obtain_certificates_for

View file

@ -9,7 +9,7 @@ matrix_bot_postmoogle_docker_repo: "https://gitlab.com/etke.cc/postmoogle.git"
matrix_bot_postmoogle_docker_repo_version: "{{ 'main' if matrix_bot_postmoogle_version == 'latest' else matrix_bot_postmoogle_version }}"
matrix_bot_postmoogle_docker_src_files_path: "{{ matrix_base_data_path }}/postmoogle/docker-src"
matrix_bot_postmoogle_version: v0.9.0
matrix_bot_postmoogle_version: v0.9.1
matrix_bot_postmoogle_docker_image: "{{ matrix_bot_postmoogle_docker_image_name_prefix }}postmoogle:{{ matrix_bot_postmoogle_version }}"
matrix_bot_postmoogle_docker_image_name_prefix: "{{ 'localhost/' if matrix_bot_postmoogle_container_image_self_build else 'registry.gitlab.com/etke.cc/' }}"
matrix_bot_postmoogle_docker_image_force_pull: "{{ matrix_bot_postmoogle_docker_image.endswith(':latest') }}"
@ -110,11 +110,35 @@ matrix_bot_postmoogle_noencryption: false
matrix_bot_postmoogle_domain: "{{ matrix_server_fqn_matrix }}"
# in-container port
# in-container ports
matrix_bot_postmoogle_port: '2525'
matrix_bot_postmoogle_tls_port: '25587'
# on-host port
# on-host ports
matrix_bot_postmoogle_smtp_host_bind_port: '25'
matrix_bot_postmoogle_submission_host_bind_port: '587'
### SSL
## on-host SSL dir
matrix_bot_postmoogle_ssl_path: ""
## in-container SSL paths
# matrix_bot_postmoogle_tls_cert is the SSL certificate's certificate.
# This is likely set via group_vars/matrix_servers, so you don't need to set it.
# If you do need to set it manually, note that this is an in-container path.
# To mount a certificates volumes into the container, use matrix_bot_postmoogle_ssl_path
# Example value: /ssl/live/{{ matrix_bot_postmoogle_domain }}/fullchain.pem
matrix_bot_postmoogle_tls_cert: ""
# matrix_bot_postmoogle_tls_key is the SSL certificate's key.
# This is likely set via group_vars/matrix_servers, so you don't need to set it.
# If you do need to set it manually, note that this is an in-container path.
# To mount a certificates volumes into the container, use matrix_bot_postmoogle_ssl_path
# Example value: /ssl/live/{{ matrix_bot_postmoogle_domain }}/privkey.pem
matrix_bot_postmoogle_tls_key: ""
# Mandatory TLS, even on plain SMTP port
matrix_bot_postmoogle_tls_required: false
# Additional environment variables to pass to the postmoogle container
#

View file

@ -10,7 +10,10 @@ POSTMOOGLE_MAXSIZE={{ matrix_bot_postmoogle_maxsize }}
POSTMOOGLE_SENTRY={{ matrix_bot_postmoogle_sentry }}
POSTMOOGLE_LOGLEVEL={{ matrix_bot_postmoogle_loglevel }}
POSTMOOGLE_NOENCRYPTION={{ matrix_bot_postmoogle_noencryption }}
POSTMOOGLE_USERS={{ matrix_bot_postmoogle_users | join(' ') }}
POSTMOOGLE_ADMINS={{ matrix_bot_postmoogle_admins | join(' ') }}
POSTMOOGLE_TLS_PORT={{ matrix_bot_postmoogle_tls_port }}
POSTMOOGLE_TLS_CERT={{ matrix_bot_postmoogle_tls_cert }}
POSTMOOGLE_TLS_KEY={{ matrix_bot_postmoogle_tls_key }}
POSTMOOGLE_TLS_REQUIRED={{ matrix_bot_postmoogle_tls_required }}
{{ matrix_bot_postmoogle_environment_variables_extension }}

View file

@ -24,7 +24,13 @@ ExecStart={{ matrix_host_command_docker }} run --rm --name matrix-bot-postmoogle
--network={{ matrix_docker_network }} \
--env-file={{ matrix_bot_postmoogle_config_path }}/env \
-p {{ matrix_bot_postmoogle_smtp_host_bind_port }}:{{ matrix_bot_postmoogle_port }} \
{% if matrix_bot_postmoogle_ssl_path %}
-p {{ matrix_bot_postmoogle_submission_host_bind_port }}:{{ matrix_bot_postmoogle_tls_port }} \
{% endif %}
--mount type=bind,src={{ matrix_bot_postmoogle_data_path }},dst=/data \
{% if matrix_bot_postmoogle_ssl_path %}
--mount type=bind,src={{ matrix_bot_postmoogle_ssl_path }},dst=/ssl \
{% endif %}
{% for arg in matrix_bot_postmoogle_container_extra_arguments %}
{{ arg }} \
{% endfor %}

View file

@ -11,7 +11,7 @@ matrix_appservice_irc_docker_src_files_path: "{{ matrix_base_data_path }}/appser
# matrix_appservice_irc_version used to contain the full Docker image tag (e.g. `release-X.X.X`).
# It's a bare version number now. We try to somewhat retain compatibility below.
matrix_appservice_irc_version: 0.34.0
matrix_appservice_irc_version: 0.35.0
matrix_appservice_irc_docker_image: "{{ matrix_container_global_registry_prefix }}matrixdotorg/matrix-appservice-irc:{{ matrix_appservice_irc_docker_image_tag }}"
matrix_appservice_irc_docker_image_tag: "{{ 'latest' if matrix_appservice_irc_version == 'latest' else ('release-' + matrix_appservice_irc_version) }}"
matrix_appservice_irc_docker_image_force_pull: "{{ matrix_appservice_irc_docker_image.endswith(':latest') }}"

View file

@ -0,0 +1,60 @@
---
# Cactus Comments is a federated comment system built on Matrix
# Project source code URL: https://gitlab.com/cactus-comments/cactus-appservice
# Project source code URL: https://gitlab.com/cactus-comments/cactus-client
matrix_cactus_comments_enabled: true
matrix_cactus_comments_serve_client_enabled: true
matrix_cactus_comments_container_image_self_build: false
matrix_cactus_comments_docker_repo: "https://gitlab.com/cactus-comments/cactus-appservice.git"
matrix_cactus_comments_docker_repo_version: "{{ matrix_cactus_comments_version if matrix_cactus_comments_version != 'latest' else 'main' }}"
matrix_cactus_comments_docker_src_files_path: "{{ matrix_cactus_comments_base_path }}/docker-src"
matrix_cactus_comments_base_path: "{{ matrix_base_data_path }}/cactus-comments"
matrix_cactus_comments_container_tmp_path: "{{ matrix_cactus_comments_base_path }}/tmp"
matrix_cactus_comments_client_path: "{{ matrix_cactus_comments_base_path }}/client"
matrix_cactus_comments_client_file_permissions: "0644"
matrix_cactus_comments_app_service_config_file: "{{ matrix_cactus_comments_base_path }}/cactus_appservice.yaml"
matrix_cactus_comments_app_service_env_file: "{{ matrix_cactus_comments_base_path }}/cactus.env"
matrix_cactus_comments_as_token: ''
matrix_cactus_comments_hs_token: ''
matrix_cactus_comments_homeserver_url: "{{ matrix_homeserver_container_url }}"
matrix_cactus_comments_user_id: "bot.cactusbot"
matrix_cactus_comments_tmp_directory_size_mb: 1
matrix_cactus_comments_container_port: 5000
matrix_cactus_comments_version: 0.9.0
matrix_cactus_comments_docker_image: "{{ matrix_container_global_registry_prefix }}cactuscomments/cactus-appservice:{{ matrix_cactus_comments_version }}"
matrix_cactus_comments_docker_image_force_pull: "{{ matrix_cactus_comments_docker_image.endswith(':latest') }}"
# matrix_cactus_comments_client_version specifies the version of the cactus-client release to use.
# For available versions, see: https://gitlab.com/cactus-comments/cactus-client/-/releases
# Also see: `matrix_cactus_comments_client_local_dir`
matrix_cactus_comments_client_version: "0.13.0"
# matrix_cactus_comments_client_local_dir specifies a local directory (on the Ansible controller, not on the remote server) with cactus-client files to use.
# This is an alternative to `matrix_cactus_comments_client_version`, to be used when you'd like to
# provide the files locally / manually.
matrix_cactus_comments_client_local_dir: ''
# matrix_cactus_comments_client_nginx_path specifies the path where nginx can access the client files.
# The default value assumes a container setup. If you're running nginx without a container, consider adjusting this path
matrix_cactus_comments_client_nginx_path: "/cactus-comments/"
# matrix_cactus_comments_client_endpoint specifies where nginx will serve the files in nginx is enabled
matrix_cactus_comments_client_endpoint: "/cactus-comments/"
# List of systemd services that matrix-cactus-comments.service depends on
matrix_bot_cactus_comments_systemd_required_services_list: ['docker.service']
# List of systemd services that matrix-cactus-comments.service wants
matrix_bot_cactus_comments_systemd_wanted_services_list: []
# A list of extra arguments to pass to the container
matrix_cactus_comments_container_extra_arguments: []
matrix_cactus_comments_environment_variables_extension: ''

View file

@ -0,0 +1,67 @@
---
- ansible.builtin.set_fact:
matrix_systemd_services_list: "{{ matrix_systemd_services_list + ['matrix-cactus-comments.service'] }}"
when: matrix_cactus_comments_enabled | bool
# If the matrix-synapse role is not used, these variables may not exist.
- ansible.builtin.set_fact:
matrix_homeserver_container_runtime_injected_arguments: >
{{
matrix_homeserver_container_runtime_injected_arguments | default([])
+
["--mount type=bind,src={{ matrix_cactus_comments_app_service_config_file }},dst=/matrix-cactus-comments.yaml,ro"]
}}
matrix_homeserver_app_service_runtime_injected_config_files: >
{{
matrix_homeserver_app_service_runtime_injected_config_files | default([])
+
["/matrix-cactus-comments.yaml"]
}}
when: matrix_cactus_comments_enabled | bool
- block:
- name: Fail if matrix-nginx-proxy role already executed
ansible.builtin.fail:
msg: >-
Trying to append Cactus Comment's reverse-proxying configuration to matrix-nginx-proxy,
but it's pointless since the matrix-nginx-proxy role had already executed.
To fix this, please change the order of roles in your playbook,
so that the matrix-nginx-proxy role would run after the matrix-cactus-comments role.
when: matrix_nginx_proxy_role_executed | default(False) | bool
- name: Mount volume
ansible.builtin.set_fact:
matrix_nginx_proxy_container_additional_volumes: >
{{
matrix_nginx_proxy_container_additional_volumes | default([])
+
[{"src": "{{ matrix_cactus_comments_client_path }}", "dst": "/cactus-comments/cactus-comments", "options": "ro"}]
}}
- name: Generate Cactus Comment proxying configuration for matrix-nginx-proxy
ansible.builtin.set_fact:
matrix_cactus_comments_nginx_proxy_configuration: |
location {{ matrix_cactus_comments_client_endpoint }} {
root {{ matrix_cactus_comments_client_nginx_path }};
}
when: "matrix_nginx_proxy_enabled | default(False) | bool"
- name: Register Cactus Comment proxying configuration with matrix-nginx-proxy
ansible.builtin.set_fact:
matrix_nginx_proxy_proxy_matrix_additional_server_configuration_blocks: |
{{
matrix_nginx_proxy_proxy_matrix_additional_server_configuration_blocks | default([])
+
[matrix_cactus_comments_nginx_proxy_configuration]
}}
- name: Warn about reverse-proxying if matrix-nginx-proxy not used
ansible.builtin.debug:
msg: >-
NOTE: You've enabled Cactus Comments but are not using the matrix-nginx-proxy
reverse proxy.
Please make sure that you're proxying client files in {{ matrix_cactus_comments_client_path }} correctly
when: "not matrix_nginx_proxy_enabled | default(False) | bool"
tags:
- always
when: matrix_cactus_comments_enabled | bool and matrix_cactus_comments_serve_client_enabled | bool

View file

@ -0,0 +1,23 @@
---
- ansible.builtin.import_tasks: "{{ role_path }}/tasks/init.yml"
tags:
- always
- ansible.builtin.import_tasks: "{{ role_path }}/tasks/validate_config.yml"
when: "run_setup | bool and matrix_cactus_comments_enabled | bool"
tags:
- setup-all
- setup-cactus-comments
- ansible.builtin.import_tasks: "{{ role_path }}/tasks/setup_install.yml"
when: "run_setup | bool and matrix_cactus_comments_enabled | bool"
tags:
- setup-all
- setup-cactus-comments
- ansible.builtin.import_tasks: "{{ role_path }}/tasks/setup_uninstall.yml"
when: "run_setup | bool and not matrix_cactus_comments_enabled | bool"
tags:
- setup-all
- setup-cactus-comments

View file

@ -0,0 +1,138 @@
---
- name: Ensure cactus comments paths exist
ansible.builtin.file:
path: "{{ item.path }}"
state: directory
mode: 0750
owner: "{{ matrix_user_username }}"
group: "{{ matrix_user_groupname }}"
with_items:
- {path: "{{ matrix_cactus_comments_base_path }}", when: true}
- {path: "{{ matrix_cactus_comments_client_path }}", when: true}
- {path: "{{ matrix_cactus_comments_container_tmp_path }}", when: true}
- {path: "{{ matrix_cactus_comments_docker_src_files_path }}", when: matrix_cactus_comments_container_image_self_build}
when: "item.when | bool"
- name: Ensure cactus comments environment file created
ansible.builtin.template:
src: "{{ role_path }}/templates/env.j2"
dest: "{{ matrix_cactus_comments_app_service_env_file }}"
owner: "{{ matrix_user_username }}"
group: "{{ matrix_user_groupname }}"
mode: 0640
- name: Ensure cactus comments appservice file created
ansible.builtin.template:
src: "{{ role_path }}/templates/cactus_appservice.yaml.j2"
dest: "{{ matrix_cactus_comments_app_service_config_file }}"
owner: "{{ matrix_user_username }}"
group: "{{ matrix_user_groupname }}"
mode: 0640
- name: Ensure cactus comments image is pulled
docker_image:
name: "{{ matrix_cactus_comments_docker_image }}"
source: "{{ 'pull' if ansible_version.major > 2 or ansible_version.minor > 7 else omit }}"
force_source: "{{ matrix_cactus_comments_docker_image_force_pull if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}"
force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else matrix_cactus_comments_docker_image_force_pull }}"
when: "not matrix_cactus_comments_container_image_self_build | bool"
register: result
retries: "{{ matrix_container_retries_count }}"
delay: "{{ matrix_container_retries_delay }}"
until: result is not failed
- name: Ensure cactus comments repository is present on self-build
ansible.builtin.git:
repo: "{{ matrix_cactus_comments_docker_repo }}"
version: "{{ matrix_cactus_comments_docker_repo_version }}"
dest: "{{ matrix_cactus_comments_docker_src_files_path }}"
force: "yes"
become: true
become_user: "{{ matrix_user_username }}"
register: matrix_cactus_comments_git_pull_results
when: "matrix_cactus_comments_container_image_self_build | bool"
- name: Ensure cactus comments image is built
docker_image:
name: "{{ matrix_cactus_comments_docker_image }}"
source: build
force_source: "{{ matrix_cactus_comments_git_pull_results.changed if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}"
force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else matrix_mailer_git_pull_results.changed }}"
build:
dockerfile: Dockerfile
path: "{{ matrix_cactus_comments_docker_src_files_path }}"
pull: true
when: "matrix_cactus_comments_container_image_self_build | bool"
- block:
- name: Download client binary to local folder
ansible.builtin.get_url:
url: "https://gitlab.com/cactus-comments/cactus-client/-/archive/v{{ matrix_cactus_comments_client_version }}/cactus-client-v{{ matrix_cactus_comments_client_version }}.tar.gz"
dest: "/tmp/cactus-comments-{{ matrix_cactus_comments_client_version }}.tar.gz"
mode: '0644'
register: _download_client
until: _download_client is succeeded
retries: 5
delay: 2
check_mode: false
- name: Unpack client
ansible.builtin.unarchive:
src: "/tmp/cactus-comments-{{ matrix_cactus_comments_client_version }}.tar.gz"
dest: "/tmp/"
remote_src: true
mode: 0600
check_mode: false
- name: Propagate client javascript file
ansible.builtin.copy:
src: "/tmp/cactus-client-v{{ matrix_cactus_comments_client_version }}/src/cactus.js"
remote_src: true
dest: "{{ matrix_cactus_comments_client_path }}/cactus.js"
mode: "{{ matrix_cactus_comments_client_file_permissions }}"
owner: "{{ matrix_user_username }}"
group: "{{ matrix_user_groupname }}"
- name: Propagate client style file
ansible.builtin.copy:
src: "/tmp/cactus-client-v{{ matrix_cactus_comments_client_version }}/src/style.css"
remote_src: true
dest: "{{ matrix_cactus_comments_client_path }}/style.css"
mode: "{{ matrix_cactus_comments_client_file_permissions }}"
owner: "{{ matrix_user_username }}"
group: "{{ matrix_user_groupname }}"
when: matrix_cactus_comments_client_local_dir | length == 0
- block:
- name: Propagate locally distributed client javascreipt
ansible.builtin.copy:
src: "{{ matrix_cactus_comments_client_local_dir }}/src/cactus.js"
dest: "{{ matrix_cactus_comments_client_path }}/cactus.js"
mode: "{{ matrix_cactus_comments_client_file_permissions }}"
owner: "{{ matrix_user_username }}"
group: "{{ matrix_user_groupname }}"
- name: Propagate locally distributed client style.css
ansible.builtin.copy:
src: "{{ matrix_cactus_comments_client_local_dir }}/src/style.css"
dest: "{{ matrix_cactus_comments_client_path }}/style.css"
mode: "{{ matrix_cactus_comments_client_file_permissions }}"
owner: "{{ matrix_user_username }}"
group: "{{ matrix_user_groupname }}"
when: matrix_cactus_comments_client_local_dir | length > 0
- name: Ensure matrix-cactus-comments.service installed
ansible.builtin.template:
src: "{{ role_path }}/templates/systemd/matrix-cactus-comments.service.j2"
dest: "{{ matrix_systemd_path }}/matrix-cactus-comments.service"
mode: 0644
register: matrix_cactus_comments_systemd_service_result
- name: Ensure systemd reloaded after matrix-cactus-comments.service installation
ansible.builtin.service:
daemon_reload: true
when: "matrix_cactus_comments_systemd_service_result.changed | bool"
- name: Ensure matrix-cactus-comments.service restarted, if necessary
ansible.builtin.service:
name: "matrix-cactus-comments.service"
state: restarted

View file

@ -0,0 +1,36 @@
---
- name: Check existence of matrix-cactus-comments service
ansible.builtin.stat:
path: "{{ matrix_systemd_path }}/matrix-cactus-comments.service"
register: matrix_cactus_comments_service_stat
- name: Ensure cactus comments is stopped
ansible.builtin.service:
name: matrix-cactus-comments
state: stopped
enabled: false
daemon_reload: true
register: stopping_result
when: "matrix_cactus_comments_service_stat.stat.exists | bool"
- name: Ensure matrix-cactus-comments.service doesn't exist
ansible.builtin.file:
path: "{{ matrix_systemd_path }}/matrix-cactus-comments.service"
state: absent
when: "matrix_cactus_comments_service_stat.stat.exists | bool"
- name: Ensure systemd reloaded after matrix-cactus-comments.service removal
ansible.builtin.service:
daemon_reload: true
when: "matrix_cactus_comments_service_stat.stat.exists | bool"
- name: Ensure Matrix cactus comments paths don't exist
ansible.builtin.file:
path: "{{ matrix_cactus_comments_base_path }}"
state: absent
- name: Ensure cactus comments Docker image doesn't exist
docker_image:
name: "{{ matrix_cactus_comments_docker_image }}"
state: absent

View file

@ -0,0 +1,10 @@
---
- name: Fail if required settings not defined
ansible.builtin.fail:
msg: >-
You need to define a required configuration setting (`{{ item }}`).
when: "vars[item] == ''"
with_items:
- "matrix_cactus_comments_as_token"
- "matrix_cactus_comments_hs_token"

View file

@ -0,0 +1,19 @@
# A unique, user-defined ID of the application service which will never change.
id: "Cactus Comments"
# Where the cactus-appservice is hosted:
url: "http://matrix-cactus-comments:{{ matrix_cactus_comments_container_port }}"
# Unique tokens used to authenticate requests between our service and the
# homeserver (and the other way). Use the sha256 hashes of something random.
# CHANGE THESE VALUES.
as_token: {{ matrix_cactus_comments_as_token | to_json }}
hs_token: {{ matrix_cactus_comments_hs_token | to_json }}
# The user id of the cactusbot which can be used to register and moderate sites
sender_localpart: "{{ matrix_cactus_comments_user_id }}"
namespaces:
aliases:
- exclusive: true
regex: "#comments_.*"

View file

@ -0,0 +1,6 @@
CACTUS_HS_TOKEN={{ matrix_cactus_comments_hs_token }}
CACTUS_AS_TOKEN={{ matrix_cactus_comments_as_token }}
CACTUS_HOMESERVER_URL={{ matrix_cactus_comments_homeserver_url }}
CACTUS_USER_ID=@{{ matrix_cactus_comments_user_id }}:{{ matrix_domain }}
{{ matrix_cactus_comments_environment_variables_extension }}

View file

@ -0,0 +1,36 @@
#jinja2: lstrip_blocks: "True"
[Unit]
Description=Cactus Comments
{% for service in matrix_bot_cactus_comments_systemd_required_services_list %}
Requires={{ service }}
After={{ service }}
{% endfor %}
{% for service in matrix_bot_cactus_comments_systemd_wanted_services_list %}
Wants={{ service }}
{% endfor %}
DefaultDependencies=no
[Service]
Type=simple
Environment="HOME={{ matrix_systemd_unit_home_path }}"
ExecStartPre=-{{ matrix_host_command_sh }} -c '{{ matrix_host_command_docker }} kill matrix-cactus-comments 2>/dev/null || true'
ExecStartPre=-{{ matrix_host_command_sh }} -c '{{ matrix_host_command_docker }} rm matrix-cactus-comments 2>/dev/null || true'
ExecStart={{ matrix_host_command_docker }} run --rm --name matrix-cactus-comments \
--log-driver=none \
--cap-drop=ALL \
--user={{ matrix_user_uid }}:{{ matrix_user_gid }} \
--read-only \
--env-file {{ matrix_cactus_comments_app_service_env_file }} \
--tmpfs=/tmp:rw,noexec,nosuid,size={{ matrix_cactus_comments_tmp_directory_size_mb }}m \
--network={{ matrix_docker_network }} \
{{ matrix_cactus_comments_docker_image }}
ExecStop=-{{ matrix_host_command_sh }} -c '{{ matrix_host_command_docker }} kill matrix-cactus-comments 2>/dev/null || true'
ExecStop=-{{ matrix_host_command_sh }} -c '{{ matrix_host_command_docker }} rm matrix-cactus-comments 2>/dev/null || true'
Restart=always
RestartSec=30
SyslogIdentifier=matrix-cactus-comments
[Install]
WantedBy=multi-user.target

View file

@ -10,7 +10,7 @@ matrix_client_element_container_image_self_build_repo: "https://github.com/vecto
# - https://github.com/vector-im/element-web/issues/19544
matrix_client_element_container_image_self_build_low_memory_system_patch_enabled: "{{ ansible_memtotal_mb < 4096 }}"
matrix_client_element_version: v1.11.4
matrix_client_element_version: v1.11.5
matrix_client_element_docker_image: "{{ matrix_client_element_docker_image_name_prefix }}vectorim/element-web:{{ matrix_client_element_version }}"
matrix_client_element_docker_image_name_prefix: "{{ 'localhost/' if matrix_client_element_container_image_self_build else matrix_container_global_registry_prefix }}"
matrix_client_element_docker_image_force_pull: "{{ matrix_client_element_docker_image.endswith(':latest') }}"

View file

@ -38,7 +38,7 @@ matrix_conduit_max_request_size: 20_000_000
# Maximum number of open files for Conduit's embedded RocksDB database
# See https://github.com/facebook/rocksdb/wiki/RocksDB-Tuning-Guide#tuning-other-options
# If not specified, Conduit defaults to a relatively low value of 20
# By default, Conduit uses a relatively low value of 20.
matrix_conduit_rocksdb_max_open_files: 64
# Enables registration. If set to false, no users can register on this server.

View file

@ -8,7 +8,7 @@ matrix_coturn_container_image_self_build_repo: "https://github.com/coturn/coturn
matrix_coturn_container_image_self_build_repo_version: "docker/{{ matrix_coturn_version }}"
matrix_coturn_container_image_self_build_repo_dockerfile_path: "docker/coturn/alpine/Dockerfile"
matrix_coturn_version: 4.5.2-r14
matrix_coturn_version: 4.6.0-r0
matrix_coturn_docker_image: "{{ matrix_coturn_docker_image_name_prefix }}coturn/coturn:{{ matrix_coturn_version }}-alpine"
matrix_coturn_docker_image_name_prefix: "{{ 'localhost/' if matrix_coturn_container_image_self_build else matrix_container_global_registry_prefix }}"
matrix_coturn_docker_image_force_pull: "{{ matrix_coturn_docker_image.endswith(':latest') }}"

View file

@ -6,7 +6,7 @@ matrix_dendrite_enabled: true
matrix_dendrite_docker_image: "{{ matrix_dendrite_docker_image_name_prefix }}matrixdotorg/dendrite-monolith:{{ matrix_dendrite_docker_image_tag }}"
matrix_dendrite_docker_image_name_prefix: "docker.io/"
matrix_dendrite_docker_image_tag: "v0.9.6"
matrix_dendrite_docker_image_tag: "v0.9.8"
matrix_dendrite_docker_image_force_pull: "{{ matrix_dendrite_docker_image.endswith(':latest') }}"
matrix_dendrite_base_path: "{{ matrix_base_data_path }}/dendrite"

View file

@ -7,7 +7,7 @@ matrix_dynamic_dns_enabled: true
# The dynamic dns daemon interval
matrix_dynamic_dns_daemon_interval: '300'
matrix_dynamic_dns_version: v3.9.1-ls97
matrix_dynamic_dns_version: v3.9.1-ls98
# The docker container to use when in mode
matrix_dynamic_dns_docker_image: "{{ matrix_dynamic_dns_docker_image_name_prefix }}linuxserver/ddclient:{{ matrix_dynamic_dns_version }}"

View file

@ -5,7 +5,7 @@
matrix_grafana_enabled: false
matrix_grafana_version: 9.1.2
matrix_grafana_version: 9.1.5
matrix_grafana_docker_image: "{{ matrix_container_global_registry_prefix }}grafana/grafana:{{ matrix_grafana_version }}"
matrix_grafana_docker_image_force_pull: "{{ matrix_grafana_docker_image.endswith(':latest') }}"

View file

@ -7,7 +7,7 @@
when: "ansible_version.major == 2 and ansible_version.minor < 8 and matrix_ldap_registration_proxy_container_image_self_build and matrix_ldap_registration_proxy_enabled | bool"
- ansible.builtin.set_fact:
matrix_systemd_services_list: "{{ matrix_systemd_services_list + ['matrix-matrix-ldap-registration-proxy.service'] }}"
matrix_systemd_services_list: "{{ matrix_systemd_services_list + ['matrix-ldap-registration-proxy.service'] }}"
when: matrix_ldap_registration_proxy_enabled | bool
- block:
@ -49,7 +49,7 @@
NOTE: You've enabled the Matrix LDAP registration proxy bridge but are not using the matrix-nginx-proxy
reverse proxy.
Please make sure that you're proxying the `{{ matrix_ldap_registration_proxy_public_endpoint }}`
URL endpoint to the matrix-matrix-ldap-proxy container.
URL endpoint to the matrix-ldap-proxy container.
You can expose the container's port using the `matrix_ldap_registration_proxy_container_http_host_bind_port` variable.
when: "not matrix_nginx_proxy_enabled | default(False) | bool"

View file

@ -5,19 +5,19 @@
- always
- ansible.builtin.import_tasks: "{{ role_path }}/tasks/validate_config.yml"
when: "run_setup | bool and matrix_matrix_ldap_registration_proxy_enabled | bool"
when: "run_setup | bool and matrix_ldap_registration_proxy_enabled | bool"
tags:
- setup-all
- setup-matrix-ldap-registration-proxy
- ansible.builtin.import_tasks: "{{ role_path }}/tasks/setup_install.yml"
when: "run_setup | bool and matrix_matrix_ldap_registration_proxy_enabled | bool"
when: "run_setup | bool and matrix_ldap_registration_proxy_enabled | bool"
tags:
- setup-all
- setup-matrix-ldap-registration-proxy
- ansible.builtin.import_tasks: "{{ role_path }}/tasks/setup_uninstall.yml"
when: "run_setup | bool and not matrix_matrix_ldap_registration_proxy_enabled | bool"
when: "run_setup | bool and not matrix_ldap_registration_proxy_enabled | bool"
tags:
- setup-all
- setup-matrix-ldap-registration-proxy

View file

@ -3,7 +3,7 @@
- name: Check existence of matrix-matrix_ldap_registration_proxy service
ansible.builtin.stat:
path: "{{ matrix_systemd_path }}/matrix-ldap-registration-proxy.service"
register: matrix_matrix_ldap_registration_proxy_service_stat
register: matrix_ldap_registration_proxy_service_stat
- name: Ensure matrix-matrix_ldap_registration_proxy is stopped
ansible.builtin.service:
@ -12,25 +12,25 @@
enabled: false
daemon_reload: true
register: stopping_result
when: "matrix_matrix_ldap_registration_proxy_service_stat.stat.exists | bool"
when: "matrix_ldap_registration_proxy_service_stat.stat.exists | bool"
- name: Ensure matrix-ldap-registration-proxy.service doesn't exist
ansible.builtin.file:
path: "{{ matrix_systemd_path }}/matrix-ldap-registration-proxy.service"
state: absent
when: "matrix_matrix_ldap_registration_proxy_service_stat.stat.exists | bool"
when: "matrix_ldap_registration_proxy_service_stat.stat.exists | bool"
- name: Ensure systemd reloaded after matrix-ldap-registration-proxy.service removal
ansible.builtin.service:
daemon_reload: true
when: "matrix_matrix_ldap_registration_proxy_service_stat.stat.exists | bool"
when: "matrix_ldap_registration_proxy_service_stat.stat.exists | bool"
- name: Ensure Matrix matrix_ldap_registration_proxy paths don't exist
ansible.builtin.file:
path: "{{ matrix_matrix_ldap_registration_proxy_base_path }}"
path: "{{ matrix_ldap_registration_proxy_base_path }}"
state: absent
- name: Ensure matrix_ldap_registration_proxy Docker image doesn't exist
docker_image:
name: "{{ matrix_matrix_ldap_registration_proxy_docker_image }}"
name: "{{ matrix_ldap_registration_proxy_docker_image }}"
state: absent

View file

@ -547,7 +547,7 @@ matrix_ssl_lets_encrypt_staging: false
# Learn more here: https://eff-certbot.readthedocs.io/en/stable/using.html#changing-the-acme-server
matrix_ssl_lets_encrypt_server: ''
matrix_ssl_lets_encrypt_certbot_docker_image: "{{ matrix_container_global_registry_prefix }}certbot/certbot:{{ matrix_ssl_architecture }}-v1.28.0"
matrix_ssl_lets_encrypt_certbot_docker_image: "{{ matrix_container_global_registry_prefix }}certbot/certbot:{{ matrix_ssl_architecture }}-v1.30.0"
matrix_ssl_lets_encrypt_certbot_docker_image_force_pull: "{{ matrix_ssl_lets_encrypt_certbot_docker_image.endswith(':latest') }}"
matrix_ssl_lets_encrypt_certbot_standalone_http_port: 2402
matrix_ssl_lets_encrypt_support_email: ~
@ -625,7 +625,6 @@ matrix_nginx_proxy_synapse_generic_worker_client_server_locations: []
matrix_nginx_proxy_synapse_generic_worker_federation_locations: []
matrix_nginx_proxy_synapse_media_repository_locations: []
matrix_nginx_proxy_synapse_user_dir_locations: []
matrix_nginx_proxy_synapse_frontend_proxy_locations: []
# synapse content caching
matrix_nginx_proxy_synapse_cache_enabled: false

View file

@ -26,7 +26,7 @@
- name: Obtain Let's Encrypt certificates
ansible.builtin.include_tasks: "{{ role_path }}/tasks/ssl/setup_ssl_lets_encrypt_obtain_for_domain.yml"
with_items: "{{ matrix_ssl_domains_to_obtain_certificates_for }}"
with_items: "{{ matrix_ssl_domains_to_obtain_certificates_for | unique }}"
loop_control:
loop_var: domain_name

View file

@ -2,7 +2,7 @@
- name: Verify certificates
ansible.builtin.include_tasks: "{{ role_path }}/tasks/ssl/setup_ssl_manually_managed_verify_for_domain.yml"
with_items: "{{ matrix_ssl_domains_to_obtain_certificates_for }}"
with_items: "{{ matrix_ssl_domains_to_obtain_certificates_for | unique }}"
loop_control:
loop_var: domain_name
when: "matrix_ssl_retrieval_method == 'manually-managed'"

View file

@ -5,7 +5,7 @@
- name: Generate self-signed certificates
ansible.builtin.include_tasks: "{{ role_path }}/tasks/ssl/setup_ssl_self_signed_obtain_for_domain.yml"
with_items: "{{ matrix_ssl_domains_to_obtain_certificates_for }}"
with_items: "{{ matrix_ssl_domains_to_obtain_certificates_for | unique }}"
loop_control:
loop_var: domain_name
when: "matrix_ssl_retrieval_method == 'self-signed'"

View file

@ -3,7 +3,6 @@
{% set generic_workers = matrix_nginx_proxy_synapse_workers_list | selectattr('type', 'equalto', 'generic_worker') | list %}
{% set media_repository_workers = matrix_nginx_proxy_synapse_workers_list | selectattr('type', 'equalto', 'media_repository') | list %}
{% set user_dir_workers = matrix_nginx_proxy_synapse_workers_list | selectattr('type', 'equalto', 'user_dir') | list %}
{% set frontend_proxy_workers = matrix_nginx_proxy_synapse_workers_list | selectattr('type', 'equalto', 'frontend_proxy') | list %}
{% if matrix_nginx_proxy_synapse_workers_enabled %}
{% if matrix_nginx_proxy_synapse_cache_enabled %}
proxy_cache_path {{ matrix_nginx_proxy_synapse_cache_path }} levels=1:2 keys_zone={{ matrix_nginx_proxy_synapse_cache_keys_zone_name }}:{{ matrix_nginx_proxy_synapse_cache_keys_zone_size }} inactive={{ matrix_nginx_proxy_synapse_cache_inactive_time }} max_size={{ matrix_nginx_proxy_synapse_cache_max_size_mb }}m;
@ -26,18 +25,6 @@
}
{% endif %}
{% if frontend_proxy_workers %}
upstream frontend_proxy_upstream {
{% for worker in frontend_proxy_workers %}
{% if matrix_nginx_proxy_enabled %}
server "matrix-synapse-worker-{{ worker.type }}-{{ worker.instanceId }}:{{ worker.port }}";
{% else %}
server "127.0.0.1:{{ worker.port }}";
{% endif %}
{% endfor %}
}
{% endif %}
{% if media_repository_workers %}
upstream media_repository_upstream {
{% for worker in media_repository_workers %}
@ -120,23 +107,6 @@ server {
}
{% endfor %}
{% endif %}
{% if frontend_proxy_workers %}
# https://github.com/matrix-org/synapse/blob/master/docs/workers.md#synapseappfrontend_proxy
{% for location in matrix_nginx_proxy_synapse_frontend_proxy_locations %}
location ~ {{ location }} {
proxy_pass http://frontend_proxy_upstream$request_uri;
proxy_set_header Host $host;
}
{% endfor %}
{% if matrix_nginx_proxy_synapse_presence_disabled %}
# FIXME: keep in sync with synapse workers documentation manually
location ~ ^/_matrix/client/(api/v1|r0|v3|unstable)/presence/[^/]+/status {
proxy_pass http://frontend_proxy_upstream$request_uri;
proxy_set_header Host $host;
}
{% endif %}
{% endif %}
{# Workers redirects END #}
{% endif %}

View file

@ -9,7 +9,7 @@ matrix_synapse_container_image_self_build_repo: "https://github.com/matrix-org/s
matrix_synapse_docker_image: "{{ matrix_synapse_docker_image_name_prefix }}matrixdotorg/synapse:{{ matrix_synapse_docker_image_tag }}"
matrix_synapse_docker_image_name_prefix: "{{ 'localhost/' if matrix_synapse_container_image_self_build else matrix_container_global_registry_prefix }}"
matrix_synapse_version: v1.66.0
matrix_synapse_version: v1.67.0
matrix_synapse_docker_image_tag: "{{ matrix_synapse_version }}"
matrix_synapse_docker_image_force_pull: "{{ matrix_synapse_docker_image.endswith(':latest') }}"
@ -398,7 +398,6 @@ matrix_synapse_workers_presets:
federation_sender_workers_count: 1
media_repository_workers_count: 0
user_dir_workers_count: 0
frontend_proxy_workers_count: 0
one-of-each:
generic_workers_count: 1
pusher_workers_count: 1
@ -410,7 +409,6 @@ matrix_synapse_workers_presets:
# user_dir workers are deprecated since Synapse v1.59. This will be removed.
# See: https://github.com/matrix-org/synapse/blob/v1.59.0/docs/upgrade.md#deprecation-of-the-synapseappappservice-and-synapseappuser_dir-worker-application-types
user_dir_workers_count: 0
frontend_proxy_workers_count: 1
# Controls whether the matrix-synapse container exposes the various worker ports
# (see `port` and `metrics_port` in `matrix_synapse_workers_enabled_list`) outside of the container.
@ -452,10 +450,6 @@ matrix_synapse_workers_user_dir_workers_count: 0
matrix_synapse_workers_user_dir_workers_port_range_start: 18661
matrix_synapse_workers_user_dir_workers_metrics_range_start: 19661
matrix_synapse_workers_frontend_proxy_workers_count: "{{ matrix_synapse_workers_presets[matrix_synapse_workers_preset]['frontend_proxy_workers_count'] }}"
matrix_synapse_workers_frontend_proxy_workers_port_range_start: 18771
matrix_synapse_workers_frontend_proxy_workers_metrics_range_start: 19771
# Default list of workers to spawn.
#
# Unless you populate this manually, this list is dynamically generated

View file

@ -56,16 +56,6 @@
register: "matrix_synapse_workers_list_results_media_repository_workers"
loop: "{{ range(0, matrix_synapse_workers_media_repository_workers_count | int) | list }}"
- name: Build frontend_proxy workers
ansible.builtin.set_fact:
worker:
type: 'frontend_proxy'
instanceId: "{{ matrix_synapse_workers_frontend_proxy_workers_port_range_start + item }}"
port: "{{ matrix_synapse_workers_frontend_proxy_workers_port_range_start + item }}"
metrics_port: "{{ matrix_synapse_workers_frontend_proxy_workers_metrics_range_start + item }}"
register: "matrix_synapse_workers_list_results_frontend_proxy_workers"
loop: "{{ range(0, matrix_synapse_workers_frontend_proxy_workers_count | int) | list }}"
- ansible.builtin.set_fact:
matrix_synapse_dynamic_workers_list: "{{ matrix_synapse_dynamic_workers_list | default([]) + [item.ansible_facts.worker] }}"
with_items: |
@ -79,8 +69,6 @@
matrix_synapse_workers_list_results_appservice_workers.results
+
matrix_synapse_workers_list_results_media_repository_workers.results
+
matrix_synapse_workers_list_results_frontend_proxy_workers.results
}}
- ansible.builtin.set_fact:

View file

@ -62,6 +62,9 @@
- {'old': 'matrix_synapse_version_arm64', 'new': '<superseded by matrix_synapse_version - see https://github.com/matrix-org/synapse/pull/11810>'}
- {'old': 'matrix_synapse_enable_group_creation', 'new': '<removed in Synapse v1.61.0 - use the new Spaces feature instead>'}
- {'old': 'matrix_synapse_account_threepid_delegates_email', 'new': '<removed in Synapse v1.66.0 - make sure to configure email settings for Synapse - see https://matrix-org.github.io/synapse/v1.66/upgrade.html#delegation-of-email-validation-no-longer-supported>'}
- {'old': 'matrix_synapse_workers_frontend_proxy_workers_count', 'new': '<removed in favor of generic workers - see https://github.com/matrix-org/synapse/pull/13645>'}
- {'old': 'matrix_synapse_workers_frontend_proxy_workers_port_range_start', 'new': '<removed in favor of generic workers - see https://github.com/matrix-org/synapse/pull/13645>'}
- {'old': 'matrix_synapse_workers_frontend_proxy_workers_metrics_range_start', 'new': '<removed in favor of generic workers - see https://github.com/matrix-org/synapse/pull/13645>'}
- name: (Deprecation) Catch and report renamed settings in matrix_synapse_configuration_extension_yaml
ansible.builtin.fail:

View file

@ -11,7 +11,7 @@ worker_replication_http_port: {{ matrix_synapse_replication_http_port }}
{% set http_resources = [] %}
{% if matrix_synapse_worker_details.type in ['generic_worker', 'frontend_proxy', 'user_dir'] %}
{% if matrix_synapse_worker_details.type in ['generic_worker', 'user_dir'] %}
{% set http_resources = http_resources + ['client'] %}
{% endif %}
{% if matrix_synapse_worker_details.type in ['generic_worker'] %}
@ -38,7 +38,7 @@ worker_listeners:
{% endif %}
{% endif %}
{% if matrix_synapse_worker_details.type == 'frontend_proxy' %}
{% if matrix_synapse_worker_details.type == 'generic_worker' %}
worker_main_http_uri: http://matrix-synapse:{{ matrix_synapse_container_client_api_port }}
{% endif %}

View file

@ -55,10 +55,12 @@ matrix_synapse_workers_generic_worker_endpoints:
- ^/_matrix/client/(api/v1|r0|v3|unstable)/search$
# Encryption requests
# Note that ^/_matrix/client/(r0|v3|unstable)/keys/upload/ requires `worker_main_http_uri`
- ^/_matrix/client/(r0|v3|unstable)/keys/query$
- ^/_matrix/client/(r0|v3|unstable)/keys/changes$
- ^/_matrix/client/(r0|v3|unstable)/keys/claim$
- ^/_matrix/client/(r0|v3|unstable)/room_keys/
- ^/_matrix/client/(r0|v3|unstable)/keys/upload/
# Registration/login requests
- ^/_matrix/client/(api/v1|r0|v3|unstable)/login$
@ -172,7 +174,6 @@ matrix_synapse_workers_generic_worker_endpoints:
# Additionally, the writing of specific streams (such as events) can be moved off
# of the main process to a particular worker.
# (This is only supported with Redis-based replication.)
# To enable this, the worker must have a HTTP replication listener configured,
# have a `worker_name` and be listed in the `instance_map` config. The same worker
@ -432,35 +433,9 @@ matrix_synapse_workers_user_dir_endpoints:
# If `update_user_directory` is set to `false`, and this worker is not running,
# the above endpoint may give outdated results.
matrix_synapse_workers_frontend_proxy_endpoints:
# Proxies some frequently-requested client endpoints to add caching and remove
# load from the main synapse. It can handle REST endpoints matching the following
# regular expressions:
- ^/_matrix/client/(r0|v3|unstable)/keys/upload
# If `use_presence` is False in the homeserver config, it can also handle REST
# endpoints matching the following regular expressions:
# FIXME: ADDITIONAL CONDITIONS REQUIRED: to be enabled manually
# ^/_matrix/client/(api/v1|r0|v3|unstable)/presence/[^/]+/status
# This "stub" presence handler will pass through `GET` request but make the
# `PUT` effectively a no-op.
# It will proxy any requests it cannot handle to the main synapse instance. It
# must therefore be configured with the location of the main instance, via
# the `worker_main_http_uri` setting in the `frontend_proxy` worker configuration
# file. For example:
# ```yaml
# worker_main_http_uri: http://127.0.0.1:8008
# ```
matrix_synapse_workers_avail_list:
- appservice
- federation_sender
- frontend_proxy
- generic_worker
- media_repository
- pusher

View file

@ -46,6 +46,7 @@
- matrix-bot-postmoogle
- matrix-bot-go-neb
- matrix-bot-mjolnir
- matrix-cactus-comments
- matrix-synapse
- matrix-dendrite
- matrix-conduit