Initial work on getting nginx reverse proxying working with Dendrite

This commit is contained in:
Slavi Pantaleev 2021-12-18 10:50:44 +02:00
parent 2f57c51733
commit ecc237bbad
11 changed files with 143 additions and 28 deletions

View file

@ -1365,7 +1365,13 @@ matrix_nginx_proxy_enabled: true
matrix_nginx_proxy_proxy_matrix_client_api_addr_with_container: "{{ 'matrix-corporal:41080' if matrix_corporal_enabled else 'matrix-nginx-proxy:12080' }}"
matrix_nginx_proxy_proxy_matrix_client_api_addr_sans_container: "{{ '127.0.0.1:41080' if matrix_corporal_enabled else '127.0.0.1:12080' }}"
matrix_nginx_proxy_proxy_matrix_client_api_client_max_body_size_mb: "{{ matrix_synapse_max_upload_size_mb }}"
matrix_nginx_proxy_proxy_matrix_client_api_client_max_body_size_mb: |-
{{
{
'synapse': matrix_synapse_max_upload_size_mb,
'dendrite': (matrix_dendrite_max_file_size_bytes / 1024 / 1024) | round,
}[matrix_homeserver_implementation]|int
}}
matrix_nginx_proxy_proxy_matrix_client_api_forwarded_location_synapse_admin_api_enabled: "{{ matrix_synapse_admin_enabled }}"
@ -1391,19 +1397,29 @@ matrix_nginx_proxy_proxy_matrix_identity_api_addr_sans_container: "127.0.0.1:{{
# By default, we do TLS termination for the Matrix Federation API (port 8448) at matrix-nginx-proxy.
# Unless this is handled there OR Synapse's federation listener port is disabled, we'll reverse-proxy.
matrix_nginx_proxy_proxy_matrix_federation_api_enabled: "{{ matrix_synapse_federation_port_enabled and not matrix_synapse_tls_federation_listener_enabled }}"
matrix_nginx_proxy_proxy_matrix_federation_api_enabled: |-
{{
{
'synapse': (matrix_synapse_federation_port_enabled and not matrix_synapse_tls_federation_listener_enabled),
'dendrite': matrix_dendrite_federation_enabled,
}[matrix_homeserver_implementation]|bool
}}
matrix_nginx_proxy_proxy_matrix_federation_api_addr_with_container: "matrix-nginx-proxy:12088"
matrix_nginx_proxy_proxy_matrix_federation_api_addr_sans_container: "127.0.0.1:12088"
# Settings controlling matrix-synapse-proxy.conf
matrix_nginx_proxy_proxy_synapse_enabled: "{{ matrix_synapse_enabled }}"
matrix_nginx_proxy_proxy_synapse_client_api_addr_with_container: "matrix-synapse:{{ matrix_synapse_container_client_api_port }}"
matrix_nginx_proxy_proxy_synapse_client_api_addr_sans_container: "127.0.0.1:{{ matrix_synapse_container_client_api_port }}"
matrix_nginx_proxy_proxy_synapse_client_api_addr_sans_container: "127.0.0.1:{{ matrix_dendrite_container_client_api_port }}"
matrix_nginx_proxy_proxy_synapse_federation_api_addr_with_container: "matrix-synapse:{{matrix_synapse_container_federation_api_plain_port|string}}"
matrix_nginx_proxy_proxy_synapse_federation_api_addr_sans_container: "localhost:{{matrix_synapse_container_federation_api_plain_port|string}}"
matrix_nginx_proxy_proxy_dendrite_enabled: "{{ matrix_dendrite_enabled }}"
matrix_nginx_proxy_proxy_dendrite_client_api_addr_with_container: "matrix-dendrite:{{ matrix_dendrite_container_client_api_port }}"
matrix_nginx_proxy_proxy_dendrite_client_api_addr_sans_container: "127.0.0.1:{{ matrix_synapse_container_client_api_port }}"
matrix_nginx_proxy_proxy_dendrite_federation_api_addr_with_container: "matrix-dendrite:{{ matrix_dendrite_container_federation_api_plain_port|string }}"
matrix_nginx_proxy_proxy_dendrite_federation_api_addr_sans_container: "127.0.0.1:{{ matrix_dendrite_container_federation_api_plain_port|string }}"
# When matrix-nginx-proxy is disabled, the actual port number that the vhost uses may begin to matter.
matrix_nginx_proxy_proxy_matrix_federation_port: "{{ matrix_federation_public_port }}"
@ -2221,6 +2237,8 @@ matrix_dendrite_turn_shared_secret: "{{ matrix_coturn_turn_static_auth_secret if
matrix_dendrite_disable_tls_validation: "{{ true if matrix_ssl_retrieval_method == 'self-signed' else false }}"
matrix_dendrite_self_check_validate_certificates: "{{ false if matrix_ssl_retrieval_method == 'self-signed' else true }}"
matrix_dendrite_systemd_required_services_list: |
{{
(['docker.service'])

View file

@ -14,6 +14,15 @@ matrix_dendrite_storage_path: "{{ matrix_dendrite_base_path }}/storage"
matrix_dendrite_media_store_path: "{{ matrix_dendrite_storage_path }}/media-store"
matrix_dendrite_ext_path: "{{ matrix_dendrite_base_path }}/ext"
matrix_dendrite_container_http_bind_port: 8008
# This is passed as a flag `-http-bind-address` flag to the Dendrite server in the container
matrix_dendrite_container_http_bind_address: ":{{ matrix_dendrite_container_http_bind_port }}"
# Dendrite monolith exposes both the Client API and the Federation API on the same port
matrix_dendrite_container_client_api_port: "{{ matrix_dendrite_container_http_bind_port }}"
matrix_dendrite_container_federation_api_plain_port: "{{ matrix_dendrite_container_http_bind_port }}"
# Controls whether the matrix-dendrite container exposes the Client/Server API port (tcp/8008 in the container).
#
# Takes an "<ip>:<port>" or "<port>" value (e.g. "127.0.0.1:8008"), or empty string to not expose.
@ -116,7 +125,10 @@ matrix_dendrite_trusted_id_servers:
# Controls whether Dendrite will federate at all.
# Disable this to completely isolate your server from the rest of the Matrix network.
matrix_dendrite_disable_federation: false
matrix_dendrite_federation_enabled: true
# Controls whether the self-check feature should validate SSL certificates.
matrix_dendrite_self_check_validate_certificates: true
# Default Dendrite configuration template which covers the generic use case.
# You can customize it by controlling the various variables inside it.

View file

@ -68,7 +68,7 @@
- name: Ensure systemd reloaded after matrix-dendrite.service installation
service:
daemon_reload: yes
when: "matrix_dendrite_systemd_service_result.changed"
when: "matrix_dendrite_systemd_service_result.changed|bool"
- name: Ensure matrix-dendrite-create-account script created
template:

View file

@ -22,14 +22,14 @@
- import_tasks: "{{ role_path }}/tasks/self_check_client_api.yml"
delegate_to: 127.0.0.1
become: false
when: run_self_check|bool
when: run_self_check|bool and matrix_dendrite_enabled|bool
tags:
- self-check
- import_tasks: "{{ role_path }}/tasks/self_check_federation_api.yml"
delegate_to: 127.0.0.1
become: false
when: run_self_check|bool
when: run_self_check|bool and matrix_dendrite_enabled|bool
tags:
- self-check

View file

@ -7,14 +7,12 @@
register: result_matrix_dendrite_client_api
ignore_errors: true
check_mode: no
when: matrix_dendrite_enabled|bool
- name: Fail if Matrix Client API not working
fail:
msg: "Failed checking Matrix Client API is up at `{{ matrix_server_fqn_matrix }}` (checked endpoint: `{{ matrix_dendrite_client_api_url_endpoint_public }}`). Is Dendrite running? Is port 443 open in your firewall? Full error: {{ result_matrix_dendrite_client_api }}"
when: "matrix_dendrite_enabled|bool and (result_matrix_dendrite_client_api.failed or 'json' not in result_matrix_dendrite_client_api)"
when: "(result_matrix_dendrite_client_api.failed or 'json' not in result_matrix_dendrite_client_api)"
- name: Report working Matrix Client API
debug:
msg: "The Matrix Client API at `{{ matrix_server_fqn_matrix }}` (checked endpoint: `{{ matrix_dendrite_client_api_url_endpoint_public }}`) is working"
when: matrix_dendrite_enabled|bool

View file

@ -7,19 +7,18 @@
register: result_matrix_dendrite_federation_api
ignore_errors: true
check_mode: no
when: matrix_dendrite_enabled|bool
- name: Fail if Matrix Federation API not working
fail:
msg: "Failed checking Matrix Federation API is up at `{{ matrix_server_fqn_matrix }}` (checked endpoint: `{{ matrix_dendrite_federation_api_url_endpoint_public }}`). Is Dendrite running? Is port {{ matrix_federation_public_port }} open in your firewall? Full error: {{ result_matrix_dendrite_federation_api }}"
when: "matrix_dendrite_enabled|bool and matrix_dendrite_federation_enabled|bool and (result_matrix_dendrite_federation_api.failed or 'json' not in result_matrix_dendrite_federation_api)"
when: "matrix_dendrite_federation_enabled|bool and (result_matrix_dendrite_federation_api.failed or 'json' not in result_matrix_dendrite_federation_api)"
- name: Fail if Matrix Federation API unexpectedly enabled
fail:
msg: "Matrix Federation API is up at `{{ matrix_server_fqn_matrix }}` (checked endpoint: `{{ matrix_dendrite_federation_api_url_endpoint_public }}`) despite being disabled."
when: "matrix_dendrite_enabled|bool and not matrix_dendrite_federation_enabled|bool and not result_matrix_dendrite_federation_api.failed"
when: "not matrix_dendrite_federation_enabled|bool and not result_matrix_dendrite_federation_api.failed"
- name: Report working Matrix Federation API
debug:
msg: "The Matrix Federation API at `{{ matrix_server_fqn_matrix }}` (checked endpoint: `{{ matrix_dendrite_federation_api_url_endpoint_public }}`) is working"
when: "matrix_dendrite_enabled|bool and matrix_dendrite_federation_enabled|bool"
when: "matrix_dendrite_federation_enabled|bool"

View file

@ -64,7 +64,7 @@ global:
# Disables federation. Dendrite will not be able to make any outbound HTTP requests
# to other servers and the federation API will not be exposed.
disable_federation: {{ matrix_dendrite_disable_federation|to_json }}
disable_federation: {{ (not matrix_dendrite_federation_enabled)|to_json }}
# Configuration for Kafka/Naffka.
kafka:

View file

@ -44,7 +44,8 @@ ExecStart={{ matrix_host_command_docker }} run --rm --name matrix-dendrite \
{{ arg }} \
{% endfor %}
{{ matrix_dendrite_docker_image }} \
--config /data/dendrite.yaml
-config /data/dendrite.yaml \
-http-bind-address {{ matrix_dendrite_container_http_bind_address }}
ExecStop=-{{ matrix_host_command_docker }} kill matrix-dendrite
ExecStop=-{{ matrix_host_command_docker }} rm matrix-dendrite

View file

@ -111,14 +111,28 @@ matrix_nginx_proxy_access_log_enabled: true
matrix_nginx_proxy_proxy_riot_compat_redirect_enabled: false
matrix_nginx_proxy_proxy_riot_compat_redirect_hostname: "riot.{{ matrix_domain }}"
# Controls whether proxying the Synapse domain should be done.
# Controls whether proxying for Synapse should be done.
matrix_nginx_proxy_proxy_synapse_enabled: false
matrix_nginx_proxy_proxy_synapse_hostname: "matrix-nginx-proxy"
matrix_nginx_proxy_proxy_synapse_federation_api_enabled: "{{ matrix_nginx_proxy_proxy_matrix_federation_api_enabled }}"
# The addresses where the Matrix Client API is, when using Synapse.
matrix_nginx_proxy_proxy_synapse_client_api_addr_with_container: ""
matrix_nginx_proxy_proxy_synapse_client_api_addr_sans_container: ""
# The addresses where the Federation API is, when using Synapse.
matrix_nginx_proxy_proxy_synapse_federation_api_addr_with_container: ""
matrix_nginx_proxy_proxy_synapse_federation_api_addr_sans_container: ""
# A list of strings containing additional configuration blocks to add to the Synapse's server configuration (matrix-synapse.conf).
matrix_nginx_proxy_proxy_synapse_additional_server_configuration_blocks: []
# Controls whether proxying for Dendrite should be done.
matrix_nginx_proxy_proxy_dendrite_enabled: false
matrix_nginx_proxy_proxy_dendrite_hostname: "matrix-nginx-proxy"
matrix_nginx_proxy_proxy_dendrite_federation_api_enabled: "{{ matrix_nginx_proxy_proxy_matrix_federation_api_enabled }}"
# The addresses where the Matrix Client API is, when using Dendrite.
matrix_nginx_proxy_proxy_dendrite_client_api_addr_with_container: ""
matrix_nginx_proxy_proxy_dendrite_client_api_addr_sans_container: ""
# A list of strings containing additional configuration blocks to add to the Dendrite's server configuration (matrix-dendrite.conf).
matrix_nginx_proxy_proxy_dendrite_additional_server_configuration_blocks: []
# Controls whether proxying the Element domain should be done.
matrix_nginx_proxy_proxy_element_enabled: false
@ -200,10 +214,6 @@ matrix_nginx_proxy_proxy_synapse_metrics_basic_auth_key: ""
matrix_nginx_proxy_proxy_matrix_client_api_addr_with_container: "matrix-nginx-proxy:12080"
matrix_nginx_proxy_proxy_matrix_client_api_addr_sans_container: "127.0.0.1:12080"
# The addresses where the Matrix Client API is, when using Synapse.
matrix_nginx_proxy_proxy_synapse_client_api_addr_with_container: ""
matrix_nginx_proxy_proxy_synapse_client_api_addr_sans_container: ""
# This needs to be equal or higher than the maximum upload size accepted by Synapse.
matrix_nginx_proxy_proxy_matrix_client_api_client_max_body_size_mb: 50
@ -268,9 +278,6 @@ matrix_nginx_proxy_proxy_http_additional_server_configuration_blocks: []
# A list of strings containing additional configuration blocks to add to the base matrix server configuration (matrix-domain.conf).
matrix_nginx_proxy_proxy_matrix_additional_server_configuration_blocks: []
# A list of strings containing additional configuration blocks to add to the synapse's server configuration (matrix-synapse.conf).
matrix_nginx_proxy_proxy_synapse_additional_server_configuration_blocks: []
# A list of strings containing additional configuration blocks to add to Riot's server configuration (matrix-riot-web.conf).
matrix_nginx_proxy_proxy_riot_additional_server_configuration_blocks: []

View file

@ -67,6 +67,19 @@
state: absent
when: "not matrix_nginx_proxy_proxy_synapse_enabled|bool"
- name: Ensure Matrix nginx-proxy configuration for matrix-dendrite exists
template:
src: "{{ role_path }}/templates/nginx/conf.d/matrix-dendrite.conf.j2"
dest: "{{ matrix_nginx_proxy_confd_path }}/matrix-dendrite.conf"
mode: 0644
when: matrix_nginx_proxy_proxy_dendrite_enabled|bool
- name: Ensure Matrix nginx-proxy configuration for matrix-dendrite deleted
file:
path: "{{ matrix_nginx_proxy_confd_path }}/matrix-dendrite.conf"
state: absent
when: "not matrix_nginx_proxy_proxy_dendrite_enabled|bool"
- name: Ensure Matrix nginx-proxy configuration for Element domain exists
template:
src: "{{ role_path }}/templates/nginx/conf.d/matrix-client-element.conf.j2"

View file

@ -0,0 +1,67 @@
#jinja2: lstrip_blocks: "True"
server {
listen 12080;
server_name {{ matrix_nginx_proxy_proxy_dendrite_hostname }};
server_tokens off;
root /dev/null;
gzip on;
gzip_types text/plain application/json;
{% for configuration_block in matrix_nginx_proxy_proxy_dendrite_additional_server_configuration_blocks %}
{{- configuration_block }}
{% endfor %}
{# Everything else just goes to the API server ##}
location / {
{% if matrix_nginx_proxy_enabled %}
{# Use the embedded DNS resolver in Docker containers to discover the service #}
resolver 127.0.0.11 valid=5s;
set $backend "{{ matrix_nginx_proxy_proxy_dendrite_client_api_addr_with_container }}";
proxy_pass http://$backend;
{% else %}
{# Generic configuration for use outside of our container setup #}
proxy_pass http://{{ matrix_nginx_proxy_proxy_dendrite_client_api_addr_sans_container }};
{% endif %}
proxy_set_header Host $host;
client_body_buffer_size 25M;
client_max_body_size {{ matrix_nginx_proxy_proxy_matrix_client_api_client_max_body_size_mb }}M;
proxy_max_temp_file_size 0;
}
}
{% if matrix_nginx_proxy_proxy_dendrite_federation_api_enabled %}
server {
listen 12088;
server_name {{ matrix_nginx_proxy_proxy_dendrite_hostname }};
server_tokens off;
root /dev/null;
gzip on;
gzip_types text/plain application/json;
location / {
{% if matrix_nginx_proxy_enabled %}
{# Use the embedded DNS resolver in Docker containers to discover the service #}
resolver 127.0.0.11 valid=5s;
set $backend "{{ matrix_nginx_proxy_proxy_dendrite_federation_api_addr_with_container }}";
proxy_pass http://$backend;
{% else %}
{# Generic configuration for use outside of our container setup #}
proxy_pass http://{{ matrix_nginx_proxy_proxy_dendrite_federation_api_addr_sans_container }};
{% endif %}
proxy_set_header Host $host;
client_body_buffer_size 25M;
client_max_body_size {{ matrix_nginx_proxy_proxy_matrix_federation_api_client_max_body_size_mb }}M;
proxy_max_temp_file_size 0;
}
}
{% endif %}