Add native Traefik support to Sygnal

This commit is contained in:
Slavi Pantaleev 2023-02-26 11:03:42 +02:00
parent eb213c1195
commit d20ff688db
11 changed files with 206 additions and 43 deletions

View file

@ -11,6 +11,31 @@ See the project's [documentation](https://github.com/matrix-org/sygnal) to learn
This optional playbook component is only useful to people who develop/build their own Matrix client applications themselves.
## Decide on a domain and path
By default, Sygnal is configured to use its own dedicated domain (`sygnal.DOMAIN`) and requires you to [adjust your DNS records](#adjusting-dns-records).
You can override the domain and path like this:
```yaml
# Switch to the domain used for Matrix services (`matrix.DOMAIN`),
# so we won't need to add additional DNS records for Sygnal.
matrix_sygnal_hostname: "{{ matrix_server_fqn_matrix }}"
# Expose under the /sygnal subpath
matrix_sygnal_path_prefix: /sygnal
```
**NOTE**: When using `matrix-nginx-proxy` instead of Traefik, you won't be able to override the path prefix. You can only override the domain, but that needs to happen using another variable: `matrix_server_fqn_sygnal` (e.g. `matrix_server_fqn_sygnal: "push.{{ matrix_domain }}"`).
## Adjusting DNS records
Once you've decided on the domain and path, **you may need to adjust your DNS** records to point the Sygnal domain to the Matrix server.
If you've decided to reuse the `matrix.` domain, you won't need to do any extra DNS configuration.
## Adjusting the playbook configuration
Add the following configuration to your `inventory/host_vars/matrix.DOMAIN/vars.yml` file (adapt to your needs):
@ -55,9 +80,7 @@ To do that, the above example configuration:
## Installing
Don't forget to add `sygnal.<your-domain>` to DNS as described in [Configuring DNS](configuring-dns.md) before running the playbook.
After configuring the playbook, run the [installation](installing.md) command again:
After configuring the playbook and potentially [adjusting your DNS records](#adjusting-dns-records), run the [installation](installing.md) command:
```
ansible-playbook -i inventory/hosts setup.yml --tags=setup-all,start
@ -66,6 +89,6 @@ ansible-playbook -i inventory/hosts setup.yml --tags=setup-all,start
## Usage
To make use of your Sygnal installation, you'd need to build your own Matrix client application, which uses the same API keys (for [GCM/FCM](https://firebase.google.com/docs/cloud-messaging/)) and certificates (for [APNS](https://developer.apple.com/notifications/)) and is also pointed to `https://sygnal.DOMAIN` as the configured push server.
To make use of your Sygnal installation, you'd need to build your own Matrix client application, which uses the same API keys (for [GCM/FCM](https://firebase.google.com/docs/cloud-messaging/)) and certificates (for [APNS](https://developer.apple.com/notifications/)) and is to your Sygnal URL endpoint (e.g. `https://sygnal.DOMAIN`).
Refer to Sygnal's [Notes for application developers](https://github.com/matrix-org/sygnal/blob/master/docs/applications.md) document.

View file

@ -2443,7 +2443,7 @@ matrix_nginx_proxy_proxy_jitsi_enabled: "{{ matrix_jitsi_enabled }}"
matrix_nginx_proxy_proxy_jitsi_manage_wellknown: "{{ matrix_jitsi_require_well_known }}"
matrix_nginx_proxy_proxy_grafana_enabled: "{{ grafana_enabled and matrix_playbook_reverse_proxy_type in ['playbook-managed-nginx', 'other-nginx-non-container'] }}"
matrix_nginx_proxy_proxy_sygnal_enabled: "{{ matrix_sygnal_enabled }}"
matrix_nginx_proxy_proxy_sygnal_enabled: "{{ matrix_sygnal_enabled and matrix_playbook_reverse_proxy_type in ['playbook-managed-nginx', 'other-nginx-non-container'] }}"
matrix_nginx_proxy_proxy_ntfy_enabled: "{{ ntfy_enabled and matrix_playbook_reverse_proxy_type in ['playbook-managed-nginx', 'other-nginx-non-container'] }}"
matrix_nginx_proxy_container_labels_traefik_enabled: "{{ matrix_playbook_traefik_labels_enabled }}"
@ -2455,7 +2455,6 @@ matrix_nginx_proxy_container_labels_traefik_proxy_dimension_enabled: "{{ matrix_
matrix_nginx_proxy_container_labels_traefik_proxy_etherpad_enabled: "{{ matrix_etherpad_enabled and matrix_etherpad_mode == 'standalone' }}"
matrix_nginx_proxy_container_labels_traefik_proxy_bot_go_neb_enabled: "{{ matrix_bot_go_neb_enabled }}"
matrix_nginx_proxy_container_labels_traefik_proxy_jitsi_enabled: "{{ matrix_jitsi_enabled }}"
matrix_nginx_proxy_container_labels_traefik_proxy_sygnal_enabled: "{{ matrix_sygnal_enabled }}"
matrix_nginx_proxy_proxy_matrix_corporal_api_enabled: "{{ matrix_corporal_enabled and matrix_corporal_http_api_enabled }}"
matrix_nginx_proxy_proxy_matrix_corporal_api_addr_with_container: "matrix-corporal:41081"
@ -2931,8 +2930,18 @@ matrix_sygnal_enabled: false
# If someone instals Prometheus via the playbook, they most likely wish to monitor Sygnal.
matrix_sygnal_metrics_prometheus_enabled: "{{ matrix_prometheus_enabled }}"
matrix_sygnal_hostname: "{{ matrix_server_fqn_sygnal }}"
matrix_sygnal_container_network: "{{ matrix_nginx_proxy_container_network if matrix_playbook_reverse_proxy_type == 'playbook-managed-nginx' else 'matrix-sygnal' }}"
matrix_sygnal_container_additional_networks: "{{ [matrix_playbook_reverse_proxyable_services_additional_network] if matrix_playbook_reverse_proxyable_services_additional_network else [] }}"
matrix_sygnal_container_http_host_bind_port: "{{ (matrix_playbook_service_host_bind_interface_prefix ~ '6000') if matrix_playbook_service_host_bind_interface_prefix else '' }}"
matrix_sygnal_container_labels_traefik_enabled: "{{ matrix_playbook_traefik_labels_enabled }}"
matrix_sygnal_container_labels_traefik_docker_network: "{{ matrix_playbook_reverse_proxyable_services_additional_network }}"
matrix_sygnal_container_labels_traefik_entrypoints: "{{ devture_traefik_entrypoint_primary }}"
######################################################################
#
# /matrix-sygnal

View file

@ -81,11 +81,6 @@ matrix_nginx_proxy_container_labels_traefik_proxy_jitsi_hostname: "{{ matrix_ser
matrix_nginx_proxy_container_labels_traefik_proxy_jitsi_tls: "{{ matrix_nginx_proxy_container_labels_traefik_entrypoints != 'web' }}"
matrix_nginx_proxy_container_labels_traefik_proxy_jitsi_rule: "Host(`{{ matrix_nginx_proxy_container_labels_traefik_proxy_jitsi_hostname }}`)"
matrix_nginx_proxy_container_labels_traefik_proxy_sygnal_enabled: false
matrix_nginx_proxy_container_labels_traefik_proxy_sygnal_hostname: "{{ matrix_server_fqn_sygnal }}"
matrix_nginx_proxy_container_labels_traefik_proxy_sygnal_tls: "{{ matrix_nginx_proxy_container_labels_traefik_entrypoints != 'web' }}"
matrix_nginx_proxy_container_labels_traefik_proxy_sygnal_rule: "Host(`{{ matrix_nginx_proxy_container_labels_traefik_proxy_sygnal_hostname }}`)"
# matrix_nginx_proxy_container_labels_additional_labels contains a multiline string with additional labels to add to the container label file.
# See `../templates/labels.j2` for details.
#

View file

@ -86,17 +86,6 @@ traefik.http.routers.matrix-nginx-proxy-jitsi.tls.certResolver={{ matrix_nginx_p
traefik.http.routers.matrix-nginx-proxy-jitsi.entrypoints={{ matrix_nginx_proxy_container_labels_traefik_entrypoints }}
{% endif %}
{% if matrix_nginx_proxy_container_labels_traefik_proxy_sygnal_enabled %}
# Sygnal
traefik.http.routers.matrix-nginx-proxy-sygnal.rule={{ matrix_nginx_proxy_container_labels_traefik_proxy_sygnal_rule }}
traefik.http.routers.matrix-nginx-proxy-sygnal.service=matrix-nginx-proxy-web
traefik.http.routers.matrix-nginx-proxy-sygnal.tls={{ matrix_nginx_proxy_container_labels_traefik_proxy_sygnal_tls | to_json }}
{% if matrix_nginx_proxy_container_labels_traefik_proxy_sygnal_tls %}
traefik.http.routers.matrix-nginx-proxy-sygnal.tls.certResolver={{ matrix_nginx_proxy_container_labels_traefik_tls_certResolver }}
{% endif %}
traefik.http.routers.matrix-nginx-proxy-sygnal.entrypoints={{ matrix_nginx_proxy_container_labels_traefik_entrypoints }}
{% endif %}
traefik.http.services.matrix-nginx-proxy-web.loadbalancer.server.port=8080

View file

@ -1,28 +1,77 @@
---
# Sygnal is a reference Push Gateway for Matrix.
# To make use of it for delivering push notificatins, you'll need to develop/build your own Matrix app.
# Project source code URL: https://github.com/matrix-org/sygnal
matrix_sygnal_enabled: false
matrix_sygnal_enabled: true
# The hostname at which Sygnal is served.
matrix_sygnal_hostname: ''
# The path at which Sygnal is exposed.
# This value must either be `/` or not end with a slash (e.g. `/sygnal`).
matrix_sygnal_path_prefix: /
matrix_sygnal_version: v0.12.0
matrix_sygnal_base_path: "{{ matrix_base_data_path }}/sygnal"
matrix_sygnal_config_path: "{{ matrix_sygnal_base_path }}/config"
matrix_sygnal_data_path: "{{ matrix_sygnal_base_path }}/data"
matrix_sygnal_version: v0.12.0
matrix_sygnal_docker_image: "{{ matrix_container_global_registry_prefix }}matrixdotorg/sygnal:{{ matrix_sygnal_version }}"
matrix_sygnal_docker_image_force_pull: "{{ matrix_sygnal_docker_image.endswith(':latest') }}"
# List of systemd services that matrix-sygnal.service depends on.
matrix_sygnal_systemd_required_services_list: ['docker.service']
# List of systemd services that matrix-sygnal.service wants
matrix_sygnal_systemd_wanted_services_list: []
matrix_sygnal_docker_image: "{{ matrix_sygnal_docker_image_registry_prefix }}matrixdotorg/sygnal:{{ matrix_sygnal_docker_image_tag }}"
matrix_sygnal_docker_image_tag: "{{ matrix_sygnal_version }}"
matrix_sygnal_docker_image_registry_prefix: "{{ matrix_container_global_registry_prefix }}"
matrix_sygnal_docker_image_force_pull: "{{ matrix_sygnal_docker_image.endswith(':latest') }}"
# The base container network. It will be auto-created by this role if it doesn't exist already.
matrix_sygnal_container_network: "{{ matrix_sygnal_identifier }}"
# A list of additional container networks that the container would be connected to.
# The role does not create these networks, so make sure they already exist.
# Use this to expose this container to another reverse proxy, which runs in a different container network.
matrix_sygnal_container_additional_networks: []
# Controls whether the matrix-sygnal container exposes its HTTP port (tcp/6000 in the container).
#
# Takes an "<ip>:<port>" or "<port>" value (e.g. "127.0.0.1:6000"), or empty string to not expose.
matrix_sygnal_container_http_host_bind_port: ''
# matrix_sygnal_container_labels_traefik_enabled controls whether labels to assist a Traefik reverse-proxy will be attached to the container.
# See `../templates/labels.j2` for details.
#
# To inject your own other container labels, see `matrix_sygnal_container_labels_additional_labels`.
matrix_sygnal_container_labels_traefik_enabled: true
matrix_sygnal_container_labels_traefik_docker_network: "{{ matrix_sygnal_container_network }}"
matrix_sygnal_container_labels_traefik_hostname: "{{ matrix_sygnal_hostname }}"
# The path prefix must either be `/` or not end with a slash (e.g. `/sygnal`).
matrix_sygnal_container_labels_traefik_path_prefix: "{{ matrix_sygnal_path_prefix }}"
matrix_sygnal_container_labels_traefik_rule: "Host(`{{ matrix_sygnal_container_labels_traefik_hostname }}`){% if matrix_sygnal_container_labels_traefik_path_prefix != '/' %} && PathPrefix(`{{ matrix_sygnal_container_labels_traefik_path_prefix }}`){% endif %}"
matrix_sygnal_container_labels_traefik_priority: 0
matrix_sygnal_container_labels_traefik_entrypoints: web-secure
matrix_sygnal_container_labels_traefik_tls: "{{ matrix_sygnal_container_labels_traefik_entrypoints != 'web' }}"
matrix_sygnal_container_labels_traefik_tls_certResolver: default # noqa var-naming
# Controls which additional headers to attach to all HTTP responses.
# To add your own headers, use `matrix_sygnal_container_labels_traefik_additional_response_headers_custom`
matrix_sygnal_container_labels_traefik_additional_response_headers: "{{ matrix_sygnal_container_labels_traefik_additional_response_headers_auto | combine(matrix_sygnal_container_labels_traefik_additional_response_headers_custom) }}"
matrix_sygnal_container_labels_traefik_additional_response_headers_auto: {}
matrix_sygnal_container_labels_traefik_additional_response_headers_custom: {}
# matrix_sygnal_container_labels_additional_labels contains a multiline string with additional labels to add to the container label file.
# See `../templates/labels.j2` for details.
#
# Example:
# matrix_sygnal_container_labels_additional_labels: |
# my.label=1
# another.label="here"
matrix_sygnal_container_labels_additional_labels: ''
# A list of extra arguments to pass to the container
matrix_sygnal_container_extra_arguments: []

View file

@ -1,16 +1,5 @@
---
- name: Ensure Sygnal image is pulled
community.docker.docker_image:
name: "{{ matrix_sygnal_docker_image }}"
source: "{{ 'pull' if ansible_version.major > 2 or ansible_version.minor > 7 else omit }}"
force_source: "{{ matrix_sygnal_docker_image_force_pull if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}"
force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else matrix_sygnal_docker_image_force_pull }}"
register: result
retries: "{{ devture_playbook_help_container_retries_count }}"
delay: "{{ devture_playbook_help_container_retries_delay }}"
until: result is not failed
- name: Ensure Sygnal paths exists
ansible.builtin.file:
path: "{{ item }}"
@ -31,6 +20,30 @@
owner: "{{ matrix_user_username }}"
group: "{{ matrix_user_groupname }}"
- name: Ensure Sygnal labels installed
ansible.builtin.template:
src: "{{ role_path }}/templates/labels.j2"
dest: "{{ matrix_sygnal_base_path }}/labels"
mode: 0640
owner: "{{ matrix_user_username }}"
group: "{{ matrix_user_groupname }}"
- name: Ensure Sygnal image is pulled
community.docker.docker_image:
name: "{{ matrix_sygnal_docker_image }}"
source: "{{ 'pull' if ansible_version.major > 2 or ansible_version.minor > 7 else omit }}"
force_source: "{{ matrix_sygnal_docker_image_force_pull if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}"
force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else matrix_sygnal_docker_image_force_pull }}"
register: result
retries: "{{ devture_playbook_help_container_retries_count }}"
delay: "{{ devture_playbook_help_container_retries_delay }}"
until: result is not failed
- name: Ensure Sygnal container network is created
community.general.docker_network:
name: "{{ matrix_sygnal_container_network }}"
driver: bridge
- name: Ensure matrix-sygnal.service installed
ansible.builtin.template:
src: "{{ role_path }}/templates/systemd/matrix-sygnal.service.j2"

View file

@ -5,7 +5,7 @@
ansible.builtin.include_tasks: "{{ role_path }}/tasks/validate_config.yml"
- when: matrix_sygnal_enabled | bool
ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_install.yml"
ansible.builtin.include_tasks: "{{ role_path }}/tasks/install.yml"
tags:
- setup-all
- setup-sygnal
@ -14,7 +14,7 @@
- block:
- when: not matrix_sygnal_enabled | bool
ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_uninstall.yml"
ansible.builtin.include_tasks: "{{ role_path }}/tasks/uninstall.yml"
tags:
- setup-all
- setup-sygnal

View file

@ -1,7 +1,37 @@
---
- name: Fail if required Sygnal settings not defined
ansible.builtin.fail:
msg: >
You need to define a required configuration setting (`{{ item }}`).
when: "vars[item] == ''"
with_items:
- matrix_sygnal_hostname
- matrix_sygnal_path_prefix
- matrix_sygnal_container_network
- when: matrix_sygnal_container_labels_traefik_enabled | bool
block:
- name: Fail if required Sygnal Traefik settings not defined
ansible.builtin.fail:
msg: >-
You need to define a required configuration setting (`{{ item }}`).
when: "vars[item] == ''"
with_items:
- matrix_sygnal_container_labels_traefik_hostname
- matrix_sygnal_container_labels_traefik_path_prefix
# We ensure it doesn't end with a slash, because we handle both (slash and no-slash).
# Knowing that `matrix_sygnal_container_labels_traefik_path_prefix` does not end with a slash
# ensures we know how to set these routes up without having to do "does it end with a slash" checks elsewhere.
- name: Fail if matrix_sygnal_container_labels_traefik_path_prefix ends with a slash
ansible.builtin.fail:
msg: >-
matrix_sygnal_container_labels_traefik_path_prefix (`{{ matrix_sygnal_container_labels_traefik_path_prefix }}`) must either be `/` or not end with a slash (e.g. `/sygnal`).
when: "matrix_sygnal_container_labels_traefik_path_prefix != '/' and matrix_sygnal_container_labels_traefik_path_prefix[-1] == '/'"
- name: Fail if no Sygnal apps defined
ansible.builtin.fail:
msg: >-
Enabling Sygnal requires that you specify at least one app in `matrix_sygnal_apps`
when: "matrix_sygnal_enabled and matrix_sygnal_apps | length == 0"
when: "matrix_sygnal_apps | length == 0"

View file

@ -0,0 +1,45 @@
{% if matrix_sygnal_container_labels_traefik_enabled %}
traefik.enable=true
{% if matrix_sygnal_container_labels_traefik_docker_network %}
traefik.docker.network={{ matrix_sygnal_container_labels_traefik_docker_network }}
{% endif %}
{% set middlewares = [] %}
{% if matrix_sygnal_container_labels_traefik_path_prefix != '/' %}
traefik.http.middlewares.matrix-sygnal-slashless-redirect.redirectregex.regex=({{ matrix_sygnal_container_labels_traefik_path_prefix | quote }})$
traefik.http.middlewares.matrix-sygnal-slashless-redirect.redirectregex.replacement=${1}/
{% set middlewares = middlewares + ['matrix-sygnal-slashless-redirect'] %}
{% endif %}
{% if matrix_sygnal_container_labels_traefik_path_prefix != '/' %}
traefik.http.middlewares.matrix-sygnal-strip-prefix.stripprefix.prefixes={{ matrix_sygnal_container_labels_traefik_path_prefix }}
{% set middlewares = middlewares + ['matrix-sygnal-strip-prefix'] %}
{% endif %}
{% if matrix_sygnal_container_labels_traefik_additional_response_headers.keys() | length > 0 %}
{% for name, value in matrix_sygnal_container_labels_traefik_additional_response_headers.items() %}
traefik.http.middlewares.matrix-sygnal-add-headers.headers.customresponseheaders.{{ name }}={{ value }}
{% endfor %}
{% set middlewares = middlewares + ['matrix-sygnal-add-headers'] %}
{% endif %}
traefik.http.routers.matrix-sygnal.rule={{ matrix_sygnal_container_labels_traefik_rule }}
{% if matrix_sygnal_container_labels_traefik_priority | int > 0 %}
traefik.http.routers.matrix-sygnal.priority={{ matrix_sygnal_container_labels_traefik_priority }}
{% endif %}
traefik.http.routers.matrix-sygnal.service=matrix-sygnal
{% if middlewares | length > 0 %}
traefik.http.routers.matrix-sygnal.middlewares={{ middlewares | join(',') }}
{% endif %}
traefik.http.routers.matrix-sygnal.entrypoints={{ matrix_sygnal_container_labels_traefik_entrypoints }}
traefik.http.routers.matrix-sygnal.tls={{ matrix_sygnal_container_labels_traefik_tls | to_json }}
{% if matrix_sygnal_container_labels_traefik_tls %}
traefik.http.routers.matrix-sygnal.tls.certResolver={{ matrix_sygnal_container_labels_traefik_tls_certResolver }}
{% endif %}
traefik.http.services.matrix-sygnal.loadbalancer.server.port=6000
{% endif %}
{{ matrix_sygnal_container_labels_additional_labels }}

View file

@ -16,15 +16,18 @@ Environment="HOME={{ devture_systemd_docker_base_systemd_unit_home_path }}"
ExecStartPre=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} kill matrix-sygnal 2>/dev/null || true'
ExecStartPre=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} rm matrix-sygnal 2>/dev/null || true'
ExecStart={{ devture_systemd_docker_base_host_command_docker }} run --rm --name matrix-sygnal \
ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} create \
--rm \
--name=matrix-sygnal \
--log-driver=none \
--user={{ matrix_user_uid }}:{{ matrix_user_gid }} \
--cap-drop=ALL \
--env=SYGNAL_CONF=/config/sygnal.yaml \
--network={{ matrix_docker_network }} \
--network={{ matrix_sygnal_container_network }} \
{% if matrix_sygnal_container_http_host_bind_port %}
-p {{ matrix_sygnal_container_http_host_bind_port }}:6000 \
{% endif %}
--label-file={{ matrix_sygnal_base_path }}/labels \
--mount type=bind,src={{ matrix_sygnal_config_path }},dst=/config \
--mount type=bind,src={{ matrix_sygnal_data_path }},dst=/data \
{% for arg in matrix_sygnal_container_extra_arguments %}
@ -32,8 +35,15 @@ ExecStart={{ devture_systemd_docker_base_host_command_docker }} run --rm --name
{% endfor %}
{{ matrix_sygnal_docker_image }}
{% for network in matrix_sygnal_container_additional_networks %}
ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} network connect {{ network }} matrix-sygnal
{% endfor %}
ExecStart={{ devture_systemd_docker_base_host_command_docker }} start --attach matrix-sygnal
ExecStop=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} kill matrix-sygnal 2>/dev/null || true'
ExecStop=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} rm matrix-sygnal 2>/dev/null || true'
Restart=always
RestartSec=30
SyslogIdentifier=matrix-sygnal