Merge pull request #107 from NullIsNot0/master

Implement self-hosted Dimension server
This commit is contained in:
Slavi Pantaleev 2019-03-09 20:59:52 +02:00 committed by GitHub
commit ecabe8f814
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
13 changed files with 379 additions and 0 deletions

30
group_vars/matrix-servers Normal file → Executable file
View file

@ -99,6 +99,27 @@ matrix_coturn_enabled: true
######################################################################
#
# matrix-dimension
#
######################################################################
matrix_dimension_enabled: false
# Normally, matrix-nginx-proxy is enabled and nginx can reach Dimension over the container network.
# If matrix-nginx-proxy is not enabled, or you otherwise have a need for it, you can expose
# the Dimension HTTP port to the local host (`127.0.0.1:8184`).
matrix_dimension_container_expose_port: "{{ not matrix_nginx_proxy_enabled }}"
######################################################################
#
# /matrix-dimension
#
######################################################################
###################################################################### ######################################################################
# #
# matrix-mailer # matrix-mailer
@ -184,6 +205,7 @@ matrix_nginx_proxy_proxy_matrix_client_api_client_max_body_size_mb: "{{ matrix_s
matrix_nginx_proxy_proxy_matrix_enabled: true matrix_nginx_proxy_proxy_matrix_enabled: true
matrix_nginx_proxy_proxy_riot_enabled: "{{ matrix_riot_web_enabled }}" matrix_nginx_proxy_proxy_riot_enabled: "{{ matrix_riot_web_enabled }}"
matrix_nginx_proxy_proxy_dimension_enabled: "{{ matrix_dimension_enabled }}"
matrix_nginx_proxy_proxy_matrix_corporal_api_enabled: "{{ matrix_corporal_enabled and matrix_corporal_http_api_enabled }}" matrix_nginx_proxy_proxy_matrix_corporal_api_enabled: "{{ matrix_corporal_enabled and matrix_corporal_http_api_enabled }}"
matrix_nginx_proxy_proxy_matrix_corporal_api_addr_with_container: "matrix-corporal:41081" matrix_nginx_proxy_proxy_matrix_corporal_api_addr_with_container: "matrix-corporal:41081"
@ -222,6 +244,8 @@ matrix_ssl_domains_to_obtain_certificates_for: |
([matrix_server_fqn_matrix]) ([matrix_server_fqn_matrix])
+ +
([matrix_server_fqn_riot] if matrix_riot_web_enabled else []) ([matrix_server_fqn_riot] if matrix_riot_web_enabled else [])
+
([matrix_server_fqn_dimension] if matrix_dimension_enabled else [])
}} }}
###################################################################### ######################################################################
@ -271,6 +295,12 @@ matrix_riot_web_container_expose_port: "{{ not matrix_nginx_proxy_enabled }}"
matrix_riot_web_default_hs_url: "{{ matrix_homeserver_url }}" matrix_riot_web_default_hs_url: "{{ matrix_homeserver_url }}"
matrix_riot_web_default_is_url: "{{ matrix_identity_server_url }}" matrix_riot_web_default_is_url: "{{ matrix_identity_server_url }}"
# Use Dimension if enabled, otherwise fall back to Scalar
matrix_riot_web_integrations_ui_url: "{{ matrix_dimension_integrations_ui_url if matrix_dimension_enabled else 'https://scalar.vector.im/' }}"
matrix_riot_web_integrations_rest_url: "{{ matrix_dimension_integrations_rest_url if matrix_dimension_enabled else 'https://scalar.vector.im/api' }}"
matrix_riot_web_integrations_widgets_urls: "{{ matrix_dimension_integrations_widgets_urls if matrix_dimension_enabled else ['https://scalar.vector.im/api'] }}"
matrix_riot_web_integrations_jitsi_widget_url: "{{ matrix_dimension_integrations_jitsi_widget_url if matrix_dimension_enabled else 'https://scalar.vector.im/api/widgets/jitsi.html' }}"
###################################################################### ######################################################################
# #
# /matrix-riot-web # /matrix-riot-web

3
roles/matrix-base/defaults/main.yml Normal file → Executable file
View file

@ -15,6 +15,9 @@ matrix_server_fqn_matrix: "matrix.{{ matrix_domain }}"
# This and the Matrix FQN (see above) are expected to be on the same server. # This and the Matrix FQN (see above) are expected to be on the same server.
matrix_server_fqn_riot: "riot.{{ matrix_domain }}" matrix_server_fqn_riot: "riot.{{ matrix_domain }}"
# This is where you access the Dimension.
matrix_server_fqn_dimension: "dimension.{{ matrix_domain }}"
matrix_user_username: "matrix" matrix_user_username: "matrix"
matrix_user_uid: 991 matrix_user_uid: 991
matrix_user_gid: 991 matrix_user_gid: 991

View file

@ -0,0 +1,126 @@
matrix_dimension_enabled: false
# You are required to specify an access token for Dimension to work.
# For information on how to acquire an access token, visit https://t2bot.io/docs/access_tokens
matrix_dimension_access_token: ""
# Users in form: ['@user1:domain.com', '@user2:domain.com']
matrix_dimension_admins: []
matrix_dimension_base_path: "{{ matrix_base_data_path }}/dimension"
matrix_dimension_docker_image: "turt2live/matrix-dimension:latest"
# The user and group id correspond to the node user in the `turt2live/matrix-dimension` image.
matrix_dimension_user_uid: 1000
matrix_dimension_user_gid: 1000
matrix_dimension_container_expose_port: false
matrix_dimension_integrations_ui_url: "https://{{ matrix_server_fqn_dimension }}/riot"
matrix_dimension_integrations_rest_url: "https://{{ matrix_server_fqn_dimension }}/api/v1/scalar"
matrix_dimension_integrations_widgets_urls: ["https://{{ matrix_server_fqn_dimension }}/widgets"]
matrix_dimension_integrations_jitsi_widget_url: "https://{{ matrix_server_fqn_dimension }}/widgets/jitsi"
# Default Dimension configuration template which covers the generic use case.
# You can customize it by controlling the various variables inside it.
#
# For a more advanced customization, you can extend the default (see `matrix_dimension_configuration_extension_yaml`)
# or completely replace this variable with your own template.
matrix_dimension_configuration_yaml: |
# The web settings for the service (API and UI).
# It is best to have this run on localhost and use a reverse proxy to access Dimension.
web:
port: 8184
address: '0.0.0.0'
# Homeserver configuration
homeserver:
# The domain name of the homeserver. This is used in many places, such as with go-neb
# setups, to identify the homeserver.
name: "{{ matrix_server_fqn_matrix }}"
# The URL that Dimension, go-neb, and other services provisioned by Dimension should
# use to access the homeserver with.
clientServerUrl: "https://{{ matrix_server_fqn_matrix }}"
# The URL that Dimension should use when trying to communicate with federated APIs on
# the homeserver. If not supplied or left empty Dimension will try to resolve the address
# through the normal federation process.
federationUrl: "http://matrix-synapse:8048"
# The URL that Dimension will redirect media requests to for downloading media such as
# stickers. If not supplied or left empty Dimension will use the clientServerUrl.
#mediaUrl: "https://t2bot.io"
# The access token Dimension should use for miscellaneous access to the homeserver. This
# should be for a user on the configured homeserver: any user will do, however it is
# recommended to use a dedicated user (such as @dimension:t2bot.io). For information on
# how to acquire an access token, visit https://t2bot.io/docs/access_tokens
accessToken: "{{ matrix_dimension_access_token }}"
# These users can modify the integrations this Dimension supports.
# To access the admin interface, open Dimension in Riot and click the settings icon.
admins: {{ matrix_dimension_admins }}
# IPs and CIDR ranges listed here will be blocked from being widgets.
# Note: Widgets may still be embedded with restricted content, although not through Dimension directly.
widgetBlacklist:
- 10.0.0.0/8
- 172.16.0.0/12
- 192.168.0.0/16
- 127.0.0.0/8
# Where the database for Dimension is
database:
file: "dimension.db"
# Display settings that apply to self-hosted go-neb instances
goneb:
# The avatars to set for each bot. Usually these don't need to be changed, however if your homeserver
# is not able to reach t2bot.io then you should specify your own here. To not use an avatar for a bot,
# make the bot's avatar an empty string.
avatars:
giphy: "mxc://t2bot.io/c5eaab3ef0133c1a61d3c849026deb27"
imgur: "mxc://t2bot.io/6749eaf2b302bb2188ae931b2eeb1513"
github: "mxc://t2bot.io/905b64b3cd8e2347f91a60c5eb0832e1"
wikipedia: "mxc://t2bot.io/7edfb54e9ad9e13fec0df22636feedf1"
travisci: "mxc://t2bot.io/7f4703126906fab8bb27df34a17707a8"
rss: "mxc://t2bot.io/aace4fcbd045f30afc1b4e5f0928f2f3"
google: "mxc://t2bot.io/636ad10742b66c4729bf89881a505142"
guggy: "mxc://t2bot.io/e7ef0ed0ba651aaf907655704f9a7526"
echo: "mxc://t2bot.io/3407ff2db96b4e954fcbf2c6c0415a13"
circleci: "mxc://t2bot.io/cf7d875845a82a6b21f5f66de78f6bee"
jira: "mxc://t2bot.io/f4a38ebcc4280ba5b950163ca3e7c329"
# Settings for controlling how logging works
logging:
file: /dev/null
console: true
consoleLevel: verbose
fileLevel: info
rotate:
size: 52428800 # bytes, default is 50mb
count: 5
matrix_dimension_configuration_extension_yaml: |
# Your custom YAML configuration for Dimension goes here.
# This configuration extends the default starting configuration (`matrix_dimension_configuration_yaml`).
#
# You can override individual variables from the default configuration, or introduce new ones.
#
# If you need something more special, you can take full control by
# completely redefining `matrix_dimension_configuration_yaml`.
#
# Example configuration extension follows:
# telegram:
# botToken: "YourTokenHere"
#
# Holds the final Dimension configuration (a combination of the default and its extension).
# You most likely don't need to touch this variable. Instead, see `matrix_dimension_configuration_yaml`.
matrix_dimension_configuration: "{{ matrix_dimension_configuration_yaml|from_yaml|combine(matrix_dimension_configuration_extension, recursive=True) }}"

View file

@ -0,0 +1,3 @@
- set_fact:
matrix_systemd_services_list: "{{ matrix_systemd_services_list + ['matrix-dimension'] }}"
when: "matrix_dimension_enabled"

View file

@ -0,0 +1,15 @@
- import_tasks: "{{ role_path }}/tasks/init.yml"
tags:
- always
- import_tasks: "{{ role_path }}/tasks/validate_config.yml"
when: run_setup
tags:
- setup-all
- setup-dimension
- import_tasks: "{{ role_path }}/tasks/setup_dimension.yml"
when: run_setup
tags:
- setup-all
- setup-dimension

View file

@ -0,0 +1,82 @@
---
#
# Tasks related to setting up the dimension
#
- name: Ensure Dimension base path exists
file:
path: "{{ matrix_dimension_base_path }}"
state: directory
mode: 0770
owner: "{{ matrix_user_username }}"
group: "{{ matrix_dimension_user_gid }}"
when: matrix_dimension_enabled
- name: Ensure Dimension config installed
copy:
content: "{{ matrix_dimension_configuration|to_nice_yaml }}"
dest: "{{ matrix_dimension_base_path }}/config.yaml"
mode: 0640
owner: "{{ matrix_user_username }}"
group: "{{ matrix_dimension_user_gid }}"
when: matrix_dimension_enabled
- name: Ensure Dimension image is pulled
docker_image:
name: "{{ matrix_dimension_docker_image }}"
when: matrix_dimension_enabled
- name: Ensure matrix-dimension.service installed
template:
src: "{{ role_path }}/templates/systemd/matrix-dimension.service.j2"
dest: "/etc/systemd/system/matrix-dimension.service"
mode: 0644
register: matrix_dimension_systemd_service_result
when: matrix_dimension_enabled
- name: Ensure systemd reloaded after matrix-dimension.service installation
service:
daemon_reload: yes
when: "matrix_dimension_enabled and matrix_dimension_systemd_service_result.changed"
#
# Tasks related to getting rid of the dimension (if it was previously enabled)
#
- name: Check existence of matrix-dimension service
stat:
path: "/etc/systemd/system/matrix-dimension.service"
register: matrix_dimension_service_stat
when: not matrix_dimension_enabled
- name: Ensure matrix-dimension is stopped
service:
name: matrix-dimension
state: stopped
daemon_reload: yes
register: stopping_result
when: "not matrix_dimension_enabled and matrix_dimension_service_stat.stat.exists"
- name: Ensure matrix-dimension.service doesn't exist
file:
path: "/etc/systemd/system/matrix-dimension.service"
state: absent
when: "not matrix_dimension_enabled and matrix_dimension_service_stat.stat.exists"
- name: Ensure systemd reloaded after matrix-dimension.service removal
service:
daemon_reload: yes
when: "not matrix_dimension_enabled and matrix_dimension_service_stat.stat.exists"
- name: Ensure Dimension environment variables path doesn't exist
file:
path: "{{ matrix_dimension_base_path }}"
state: absent
when: "not matrix_dimension_enabled"
- name: Ensure Dimension Docker image doesn't exist
docker_image:
name: "{{ matrix_dimension_docker_image }}"
state: absent
when: "not matrix_dimension_enabled"

View file

@ -0,0 +1,15 @@
- name: Fail if required Dimension settings not defined
fail:
msg: >-
You need to define a required configuration setting (`{{ item }}`) for using Dimension.
with_items:
- "matrix_dimension_access_token"
when: "matrix_dimension_enabled and vars[item] == ''"
- name: Fail if Matrix Federation is disabled
fail:
msg: >-
You need to enable Matrix Federation to use Dimension. Set `{{ item }}` to 'true'.
with_items:
- "matrix_synapse_federation_enabled"
when: "matrix_dimension_enabled and matrix_synapse_federation_enabled == false"

View file

@ -0,0 +1,26 @@
[Unit]
Description=Matrix Dimension
After=docker.service
Requires=docker.service
[Service]
Type=simple
ExecStartPre=-/usr/bin/docker kill matrix-dimension
ExecStartPre=-/usr/bin/docker rm matrix-dimension
ExecStart=/usr/bin/docker run --rm --name matrix-dimension \
--log-driver=none \
--user={{ matrix_dimension_user_uid }}:{{ matrix_dimension_user_gid }} \
--cap-drop=ALL \
--network={{ matrix_docker_network }} \
{% if matrix_dimension_container_expose_port %}
-p 127.0.0.1:8184:8184 \
{% endif %}
-v {{ matrix_dimension_base_path }}:/data:rw \
{{ matrix_dimension_docker_image }}
ExecStop=-/usr/bin/docker kill matrix-dimension
ExecStop=-/usr/bin/docker rm matrix-dimension
Restart=always
RestartSec=30
[Install]
WantedBy=multi-user.target

View file

@ -0,0 +1,5 @@
---
# Doing `|from_yaml` when the extension contains nothing yields an empty string ("").
# We need to ensure it's a dictionary or `|combine` (when building `matrix_dimension_configuration`) will fail later.
matrix_dimension_configuration_extension: "{{ matrix_dimension_configuration_extension_yaml|from_yaml if matrix_dimension_configuration_extension_yaml|from_yaml else {} }}"

4
roles/matrix-nginx-proxy/defaults/main.yml Normal file → Executable file
View file

@ -28,6 +28,10 @@ matrix_nginx_proxy_proxy_riot_hostname: "{{ matrix_server_fqn_riot }}"
matrix_nginx_proxy_proxy_matrix_enabled: false matrix_nginx_proxy_proxy_matrix_enabled: false
matrix_nginx_proxy_proxy_matrix_hostname: "{{ matrix_server_fqn_matrix }}" matrix_nginx_proxy_proxy_matrix_hostname: "{{ matrix_server_fqn_matrix }}"
# Controls whether proxying the dimension domain should be done.
matrix_nginx_proxy_proxy_dimension_enabled: false
matrix_nginx_proxy_proxy_dimension_hostname: "{{ matrix_server_fqn_dimension }}"
# Controls whether proxying for the matrix-corporal API (`/_matrix/corporal`) should be done (on the matrix domain) # Controls whether proxying for the matrix-corporal API (`/_matrix/corporal`) should be done (on the matrix domain)
matrix_nginx_proxy_proxy_matrix_corporal_api_enabled: false matrix_nginx_proxy_proxy_matrix_corporal_api_enabled: false
matrix_nginx_proxy_proxy_matrix_corporal_api_addr_with_container: "matrix-corporal:41081" matrix_nginx_proxy_proxy_matrix_corporal_api_addr_with_container: "matrix-corporal:41081"

13
roles/matrix-nginx-proxy/tasks/setup_nginx_proxy.yml Normal file → Executable file
View file

@ -66,6 +66,13 @@
mode: 0644 mode: 0644
when: "matrix_nginx_proxy_proxy_riot_enabled" when: "matrix_nginx_proxy_proxy_riot_enabled"
- name: Ensure Matrix nginx-proxy configuration for dimension domain exists
template:
src: "{{ role_path }}/templates/nginx/conf.d/matrix-dimension.conf.j2"
dest: "{{ matrix_nginx_proxy_confd_path }}/matrix-dimension.conf"
mode: 0644
when: "matrix_nginx_proxy_proxy_dimension_enabled"
# #
# Tasks related to setting up matrix-nginx-proxy # Tasks related to setting up matrix-nginx-proxy
# #
@ -139,6 +146,12 @@
state: absent state: absent
when: "not matrix_nginx_proxy_proxy_riot_enabled" when: "not matrix_nginx_proxy_proxy_riot_enabled"
- name: Ensure Matrix nginx-proxy configuration for dimension domain deleted
file:
path: "{{ matrix_nginx_proxy_confd_path }}/matrix-dimension.conf"
state: absent
when: "not matrix_nginx_proxy_proxy_dimension_enabled"
- name: Ensure Matrix nginx-proxy configuration for main config override deleted - name: Ensure Matrix nginx-proxy configuration for main config override deleted
file: file:
path: "{{ matrix_nginx_proxy_data_path }}/nginx.conf" path: "{{ matrix_nginx_proxy_data_path }}/nginx.conf"

View file

@ -0,0 +1,56 @@
server {
listen {{ 8080 if matrix_nginx_proxy_enabled else 80 }};
server_name {{ matrix_nginx_proxy_proxy_dimension_hostname }};
server_tokens off;
location /.well-known/acme-challenge {
{% if matrix_nginx_proxy_enabled %}
{# Use the embedded DNS resolver in Docker containers to discover the service #}
resolver 127.0.0.11 valid=5s;
set $backend "matrix-certbot:8080";
proxy_pass http://$backend;
{% else %}
{# Generic configuration for use outside of our container setup #}
proxy_pass http://127.0.0.1:{{ matrix_ssl_lets_encrypt_certbot_standalone_http_port }};
{% endif %}
}
location / {
return 301 https://$http_host$request_uri;
}
}
server {
listen {{ 8443 if matrix_nginx_proxy_enabled else 443 }} ssl http2;
listen [::]:{{ 8443 if matrix_nginx_proxy_enabled else 443 }} ssl http2;
server_name {{ matrix_nginx_proxy_proxy_dimension_hostname }};
server_tokens off;
root /dev/null;
gzip on;
gzip_types text/plain application/json application/javascript text/css image/x-icon font/ttf image/gif;
ssl_certificate {{ matrix_ssl_config_dir_path }}/live/{{ matrix_nginx_proxy_proxy_dimension_hostname }}/fullchain.pem;
ssl_certificate_key {{ matrix_ssl_config_dir_path }}/live/{{ matrix_nginx_proxy_proxy_dimension_hostname }}/privkey.pem;
ssl_protocols {{ matrix_nginx_proxy_ssl_protocols }};
ssl_prefer_server_ciphers on;
ssl_ciphers "EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH";
location / {
{% if matrix_nginx_proxy_enabled %}
{# Use the embedded DNS resolver in Docker containers to discover the service #}
resolver 127.0.0.11 valid=5s;
set $backend "matrix-dimension:8184";
proxy_pass http://$backend;
{% else %}
{# Generic configuration for use outside of our container setup #}
proxy_pass http://127.0.0.1:8184;
{% endif %}
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $remote_addr;
}
}

1
setup.yml Normal file → Executable file
View file

@ -12,5 +12,6 @@
- matrix-synapse - matrix-synapse
- matrix-riot-web - matrix-riot-web
- matrix-mxisd - matrix-mxisd
- matrix-dimension
- matrix-nginx-proxy - matrix-nginx-proxy
- matrix-common-after - matrix-common-after