Commit graph

573 commits

Author SHA1 Message Date
Julian-Samuel Gebühr 14f7eed932
Update matrix-registration-bot, improve authentication config (#2723)
* Adjust to new mrb docker versioning

* Stabilze authentication

* fix lint

* Move & document mrb password usage

* Add clean cache role

* Document clean cache

* Fix lint

* Update CHANGELOG.md

* Automate access tokens

* Improve changelog

* Make use of mrb's function to fetch API tokens

* Adjust changelog

* Use ansible.builtin.file to clear directory

* Fix typo

---------

Co-authored-by: Slavi Pantaleev <slavi@devture.com>
2023-07-24 13:57:06 +03:00
ThellraAK 2153c310f7
Update matrix_servers 2023-07-21 05:49:52 -08:00
ThellraAK eea143e6eb
Shortened gmessages salt
The salts need to be shorter than 16 chars
2023-07-21 05:47:51 -08:00
Shreyas Ajjarapu 5ea6aa3e50
Added Google Messager Bridge (#2794)
* intial commit

* changed

* Reorderd

* merge old changes

* added changes to matrix_servers

* Remove duplicate discord

* Update main.yml

* added google message to configuring-playbook.md

* Changed docs to add new changes

* Changed bug?

* Removed problem j2 values

* Rename a service files

* change how password hash string

* Changed port number

* Change how the local part works

* Revert "Merge pull request #8 from shreyasajj/wsproxy"

This reverts commit bb1b8fc67ca39f63ca77e70077be99cb2b32c4de, reversing
changes made to cce6ba5f9d74f89172488afc8b1ef124031de8c1.

---------

Co-authored-by: Shreyas Ajjarapu <github.tzarina@aleeas.com>
2023-07-21 14:33:52 +03:00
Slavi Pantaleev 60c34d701a Use prebuilt container images for matrix-sliding-sync on ARM64
As mentioned in https://github.com/matrix-org/sliding-sync/issues/31#issuecomment-1640321110
images are available for arm64 already.
2023-07-18 18:16:11 +03:00
Slavi Pantaleev 95bfa4e87e
Put matrix-media-repo.service in the matrix-media-repo group
Making the group match the Ansible task tags allows people to do `just install-service matrix-media-repo` and have that trigger both `--tags=matrix-media-repo` and also restart just that single group (`matrix-media-repo`).
2023-07-17 08:11:23 +03:00
Slavi Pantaleev bc0b73dd70
Improve if condition for including Postgres in matrix_media_repo_systemd_required_services_list 2023-07-17 08:07:49 +03:00
Michael Hollister 73edde3992 Replaced additional hardcoded service names with identifer variable 2023-07-13 23:12:24 -05:00
Michael Hollister 28fa644c30 Removed redeclration of matrix_media_repo_identifier 2023-07-13 21:19:07 -05:00
Michael Hollister d565c1607b
Replaced hard coded string with identifier variable
Co-authored-by: Slavi Pantaleev <slavi@devture.com>
2023-07-13 11:06:59 -05:00
Michael Hollister 78bd1dbd1b Added matrix-media-repo role 2023-07-12 01:09:27 -05:00
Slavi Pantaleev 704a9abd9b Fix file path in comment
Related to https://github.com/spantaleev/matrix-docker-ansible-deploy/pull/2746
2023-06-18 08:54:55 +03:00
Slavi Pantaleev b5d5e49235 Move Honoroit metrics from /honoroit/metrics to /metrics/honoroit
This restores consistency with other services.

Related to 8f903fa621
2023-05-19 19:33:22 +03:00
Slavi Pantaleev 018e620ee8 Default matrix_bot_honoroit_path_prefix to /honoroit to avoid conflicts with Matrix Client-Server API 2023-05-18 10:10:47 +03:00
Slavi Pantaleev 9d77950cd8 Adjust bot group names, so that they match the install/setup tags
Previously `just install-service buscarron` would not fully work,
because:

- the systemd services were indeed tagged with `buscarron`

- however, the actual installation tasks are not
  `install-buscarron`/`setup-buscarron`, but rather
  `install-bot-buscarron`/`setup-bot-buscarron`

Services are now tagged with the `bot-` prefix to match the tags.
2023-05-18 09:43:19 +03:00
Slavi Pantaleev 4546410f6a Restore matrix-nginx-proxy connectivity to the Jitsi container network
Regression since 1d00d15482
2023-04-10 15:15:32 +03:00
Kabir Kwatra fdab05fa0a
fix(traefik): only include federation endpoint if port is new 2023-04-04 02:31:49 +00:00
Slavi Pantaleev 812b395aa9 Remove various systemd services from matrix-nginx-proxy Wanted list when not proxied via nginx
If Traefik is used, these are not Wanted services.
2023-04-03 08:59:43 +03:00
Slavi Pantaleev 1d00d15482 Switch to exported Jitsi role 2023-04-03 08:53:46 +03:00
Slavi Pantaleev 76197df3bc Add some additional groups to client systemd services
This allows for doing `just install-service client-element` to get only
Element rebuilt and restarted.
2023-03-28 16:57:50 +03:00
Aine 15ce377235
honoroit - add matrix_bot_honoroit_hostname into group vars 2023-03-23 19:09:34 +02:00
Aine 0b18f03195
honoroit - add proper networking configuration and traefik labels 2023-03-23 19:06:16 +02:00
Slavi Pantaleev 14b8efcad2 Replace matrix-prometheus with an external Prometheus role 2023-03-21 07:38:12 +02:00
Slavi Pantaleev 1b6a85e485 Do not consider prometheus-exporters as part of the prometheus group
This makes us rebuild/restart exporters when running `just install-service prometheus`,
which we don't like.
2023-03-20 15:09:04 +02:00
Slavi Pantaleev 220d80ac3a Move matrix-aux outside of this playbook 2023-03-20 11:06:27 +02:00
Aine 88dc5e0de0
migrate prometheus-node-exporter's var 2023-03-18 10:26:29 +02:00
Array in a Matrix dd1712d457
fix typo
i was sleepy lol
2023-03-18 03:43:12 -04:00
array-in-a-matrix f1c0321a8c add relay api database for dendrite 2023-03-18 03:22:30 -04:00
Slavi Pantaleev 4c1db32ef9 Rename some Dendrite variables to improve consistency 2023-03-14 08:52:15 +02:00
Slavi Pantaleev 7422337c26 Add missing matrix-synapse-auto-compressor.timer in systemd service list 2023-03-12 10:18:33 +02:00
Slavi Pantaleev 26d5719df4 Make matrix-synapse-auto-compressor live in its own container network
It will, additionally, be connected to the devture-postgres network, if
devture-postgres is enabled.
2023-03-12 10:18:33 +02:00
Slavi Pantaleev ca69fce648 Add missing group vars for matrix-synapse-auto-compressor 2023-03-12 10:18:33 +02:00
Slavi Pantaleev b28d779c6c Add matrix-synapse-auto-compressor section in group_vars/matrix_servers 2023-03-12 09:48:46 +02:00
Slavi Pantaleev 023fe3ea08 Add sliding-sync support
This allows people to try out the new Element X clients, which need to
run against the sliding-sync proxy (https://github.com/matrix-org/sliding-sync).

Supersedes https://github.com/spantaleev/matrix-docker-ansible-deploy/pull/2515

The code is based on the existing PR (#2515), but heavily reworked. Major changes:

- lots of internal refactoring and variable renaming

- fixed self-building to support non-amd64 architectures

- changed to talk to the homeserver locally, over the container network (not
  publicly)

- no more matrix-nginx-proxy support due to complexity (see below)

- no more `matrix_server_fqn_sliding_sync_proxy` in favor of
  `matrix_sliding_sync_hostname` and `matrix_sliding_sync_path_prefix`

- runs on `matrix.DOMAIN/sliding-sync` by default, so it can tried
  easily without having to create new DNS records
2023-03-07 11:57:56 +02:00
Slavi Pantaleev 30f1034767 Remove matrix_playbook_traefik_role_enabled variable and devture-traefik references
The variable was necessary when multiple playbooks could have
potentially tried to manage a shared `devture-traefik.serivce` systemd service
and shared `/devture-traefik` directory.

Since adcc6d9723, we use our own `/matrix/traefik`
(`matrix-traefik.service`) installation and no conflicts can arise.
It's safe to always enable the role, just like we do with all the other roles.
2023-03-06 09:51:14 +02:00
Slavi Pantaleev adcc6d9723 Relocate Traefik (to matrix-traefik.service && /matrix/traefik base path)
The migration is automatic. Existing users should experience a bit of
downtime until the playbook runs to completion, but don't need to do
anything manually.

This change is provoked by https://github.com/spantaleev/matrix-docker-ansible-deploy/pull/2535

While my statements there ("Traefik is a shared component among
sibling/related playbooks and should retain its global
non-matrix-prefixed name and path") do make sense, there's another point
of view as well.

With the addition of docker-socket-proxy support in bf2b540807,
we potentially introduced another non-`matrix-`-prefixed systemd service
and global path (`/devture-container-socket-proxy`). It would have
started to become messy.

Traefik always being called `devture-traefik.service` and using the `/devture-traefik` path
has the following downsides:

- different playbooks may write to the same place, unintentionally,
  before you disable the Traefik role in some of them.
  If each playbook manages its own installation, no such conflicts
  arise and you'll learn about the conflict when one of them starts its
  Traefik service and fails because the ports are already in use

- the data is scattered - backing up `/matrix` is no longer enough when
  some stuff lives in `/devture-traefik` or `/devture-container-socket-proxy` as well;
  similarly, deleting `/matrix` is no longer enough to clean up

For this reason, the Traefik instance managed by this playbook
will now be called `matrix-traefik` and live under `/matrix/traefik`.

This also makes it obvious to users running multiple playbooks, which
Traefik instance (powered by which playbook) is the active one.
Previously, you'd look at `devture-traefik.service` and wonder which
role was managing it.
2023-03-06 09:34:31 +02:00
Slavi Pantaleev bf2b540807 Harden Traefik security by accessing the Docker API through docker-socket-proxy
With these changes, we:

- install https://github.com/Tecnativa/docker-socket-proxy via the
  https://github.com/devture/com.devture.ansible.role.container_socket_proxy Ansible role

- make Traefik access the Docker API via TCP by connecting to this
  socket proxy

- .. which allows us to run the Traefik container with less privileges
  (non-`root`, dropped capabilities)
2023-03-06 09:11:02 +02:00
Slavi Pantaleev 10b5350370 Add Traefik support to Go-NEB bot
Completely untested.
2023-03-03 10:40:45 +02:00
Slavi Pantaleev f8966cd8da Default etherpad_hostname to matrix_server_fqn_etherpad for backward compatibility 2023-03-03 09:47:13 +02:00
Slavi Pantaleev 124fbeda04 Switch to using an external Etherpad role
This new role also adds native Traefik support and support for other
(non-`amd64`) architectures via self-building.
2023-03-02 22:50:13 +02:00
Slavi Pantaleev b0845984b3 Only enable Traefik certs dumper if the ACME certificate resolver for Traefik is enabled
If someone disables ACME, then they're using their own certificates
somehow. There's nothing to dump from an `acme.json` file.
2023-03-01 09:45:16 +02:00
Slavi Pantaleev f7149103e4 Remove matrix_playbook_traefik_certs_dumper_role_enabled in favor of just devture_traefik_certs_dumper_enabled
We don't need these 2 roughly-the-same settings related to the
traefik-certs-dumper role.

For Traefik, it makes sense, because it's a component used by the
various related playbooks and they could step onto each other's toes
if the role is enabled, but Traefik is disabled (in that case, uninstall
tasks will run).

As for Traefik certs dumper, the other related playbooks don't have it,
so there's no conflict. Even if they used it, each one would use its own
instance (different `devture_traefik_certs_dumper_identifier`), so there
wouldn't be a conflict and uninstall tasks can run without any danger.
2023-03-01 09:31:48 +02:00
Slavi Pantaleev b388a01ab7 Wire all certResolver variables to devture_traefik_certResolver_primary
This allows people wishing to change or unset the resolver,
to have a single variable which they can toggle.

Unsetting the resolver is useful for using your own certificates
(not coming from a certificate resolver).
2023-02-27 17:09:19 +02:00
Slavi Pantaleev 9e7415afa2 Ensure Buscarron is part of the Postgres network 2023-02-27 17:07:44 +02:00
Slavi Pantaleev 058a54fd05 Add native Traefik support to Dimension 2023-02-26 23:06:36 +02:00
Slavi Pantaleev b84f25309b Add matrix_homeserver_container_network 2023-02-26 22:09:37 +02:00
Slavi Pantaleev d20ff688db Add native Traefik support to Sygnal 2023-02-26 11:03:42 +02:00
Slavi Pantaleev 348dd8e76b Remove double space 2023-02-25 19:37:35 +02:00
Slavi Pantaleev 725b2beed7 Add native Traefik support to Buscarron 2023-02-25 15:50:48 +02:00
Slavi Pantaleev bc5dda2b3a Reorder some Buscarron default variables and fix some typos
Fixes a regression introduced in 0220c851e8
2023-02-25 15:11:23 +02:00