Commit graph

469 commits

Author SHA1 Message Date
Slavi Pantaleev 34c01da9d2 Ensure consistent password_hash results regardless of whether crypt or passlib is used
Ansible recently started showing warnings about `crypt` being
deprecated. If one installs `passlib`, the `password_hash` values that
are generated would be different by default. With this patch, we ensure
consistency regardless of which one is used.

After this patch, password hashes (and UUIDs derived from them) will
change once, but they should be stable after that.

These hashes changing is not a problem, because the playbook
changes all references to the new values. Changes are only a problem if
they're done partially and with different tools.
For example:
- `--tags=setup-COMPONENT` with `passlib`
- `--tags=setup-postgres` with `crypt` (no `passlib`)
If so, the Postgres database password's value will differ for the
configuration generated for `COMPONENT`.

The `rounds=` value is arbitrary. It doesn't matter what it is,
as long as it's different than the default for `crypt` (5000)
and the default for `passlib` for `sha512` (656000).

Source (https://docs.ansible.com/ansible/latest/playbook_guide/playbooks_filters.html):

> To ensure idempotency, specify rounds to be neither crypt’s nor passlib’s default, which is 5000 for crypt and a variable value (535000 for sha256, 656000 for sha512) for passlib
2022-11-25 11:41:16 +02:00
Slavi Pantaleev 4d881477a3 Add matrix_homeserver_enabled variable
We need this to control whether `('matrix-' + matrix_homeserver_implementation + '.service')`
would get injected into `devture_systemd_service_manager_services_list_auto`
2022-11-23 16:56:39 +02:00
Slavi Pantaleev 1bd3a27acd Do not try to enable non-enableable matrix_ssl_renewal_systemd_units_list 2022-11-23 13:00:15 +02:00
Slavi Pantaleev f696928b7d Fix variable typos 2022-11-23 12:18:35 +02:00
Slavi Pantaleev ccfaefa4d2 Add service groups 2022-11-23 11:45:47 +02:00
Slavi Pantaleev 93d4f8d425 Replace matrix-common-after systemd service management with com.devture.ansible.role.systemd_service_manager 2022-11-23 11:45:46 +02:00
Slavi Pantaleev 360e643f84 Add service priorities - try to stop/start them in an optimal order 2022-11-23 11:45:46 +02:00
Slavi Pantaleev 0ea7cb5d18 Remove various init.yml files - initialize systemd services, etc., statically (not at runtime) 2022-11-23 11:45:46 +02:00
Aine b8b5acdb16
fix user creator role 2022-11-22 15:46:00 +02:00
Slavi Pantaleev d8f2141eb0 Install Docker via geerlingguy.docker Galaxy role 2022-11-22 09:01:26 +02:00
Slavi Pantaleev e9e84341a9 Reverse-proxy to Synapse via matrix-synapse-reverse-proxy-companion
Fixes https://github.com/spantaleev/matrix-docker-ansible-deploy/issues/2090
2022-11-20 16:43:33 +02:00
Slavi Pantaleev 424de93f82 Remove useless matrix_nginx_proxy_synapse_presence_disabled variable definition 2022-11-20 11:13:23 +02:00
Aine eec7970689
update postmoogle 0.9.8 -> 0.9.9 2022-11-19 00:55:03 +02:00
Aine 06eb186729
add matrix_etherpad_mode 2022-11-05 09:17:47 +02:00
Aine 9b97957022
Merge branch 'master' into make-etherpad-great-again 2022-11-04 17:36:15 +02:00
Aine a86cb2336a
etherpad - do not request ssl cert for subdomain if dimension is installed 2022-11-04 17:16:29 +02:00
Slavi Pantaleev 04c6c11561 Install ntpd/systemd-timesync via com.devture.ansible.role.timesync 2022-11-04 16:34:23 +02:00
Slavi Pantaleev c3a7237de7 Initial work on using externally defined roles 2022-11-04 14:58:28 +02:00
Aine 83c40fce15
standalone etherpad 2022-11-04 11:36:10 +02:00
Samuel Meenzen 752d2ba8d0
Update matrix_servers 2022-11-02 20:39:14 +01:00
Samuel Meenzen c330b85de3
Merge branch 'spantaleev:master' into mautrix-discord-restricted-rooms-config 2022-11-02 20:36:04 +01:00
Slavi Pantaleev eaa9b7cfc4 Add automatic user account creation support to Buscarron
Continuation of c3dc64b1d5
2022-11-01 17:03:53 +02:00
Slavi Pantaleev c3dc64b1d5 Add matrix-user-creator role - automatic user account creation support
We no longer ask users to create Matrix user accounts for these bots:

- Postmoogle
- Honoroit
- Reminder Bot

Other bots and services (matrix-registration-bot, maubot, mjolnir,
Dimension, etc.) require an Access Token to run (not a password),
so this new role doesn't help for them.

It does help for the above bots though, and for defining your own
"initial user accounts" in the `matrix_user_creator_users_additional`
variable.
2022-11-01 16:22:58 +02:00
Slavi Pantaleev cada3ef48b Use pre-built image for Hookshot on arm64 2022-10-31 12:47:10 +02:00
Slavi Pantaleev 7fb45a507d Make --tags=run-postgres-vacuum and --tags=upgrade-postgres not assume Synapse
Fixes https://github.com/spantaleev/matrix-docker-ansible-deploy/issues/2211
2022-10-28 17:40:12 +03:00
Slavi Pantaleev 3694bf1d18
Merge pull request #2198 from etkecc/buscarron-130
update buscarron 1.2.1 -> 1.3.0
2022-10-25 22:05:22 +03:00
Slavi Pantaleev 06d4ca0f4e
Merge pull request #2197 from etkecc/postmoogle-098
update postmoogle 0.9.7 -> 0.9.8
2022-10-25 22:03:59 +03:00
Aine 12fe1f417c
update buscarron 1.2.1 -> 1.3.0 2022-10-25 18:39:39 +03:00
Aine a22d5b1726
update postmoogle 0.9.7 -> 0.9.8 2022-10-25 18:26:57 +03:00
Aine 145a57a7b8
update honoroit 0.9.15 -> 0.9.16 2022-10-25 18:25:07 +03:00
Slavi Pantaleev 0b44ec19b4 Do not override matrix_postgres_import_roles_to_ignore/matrix_postgres_import_databases_to_ignore in group_vars
These values that we were setting also make sense in the context of the
`matrix-postgres` role even when not used within the playbook.
2022-10-21 10:01:22 +03:00
Jim Myhrberg a47ce70cd2
fix(goofys): fix synapse systemd unit file to correctly require goofys
On Debian 10 (buster) at least, while the Synapse systemd service unit
was referring to Goofys as "matrix-goofys" without a ".service" suffix,
systemd was ignoring the goofys dependency, starting Synapse before
Goofys. All other dependant units which work are using the ".service"
suffix.

This generally leads to the mount path goofys using having been
populated by Synapse before Goofys starts, causing it to fail due to the
mount target not being empty.

The fix seems to be to ensure that the Synapse service unit refers to
Goofys as "matrix-goofys.service".

This change causes the following two lines in
"/etc/systemd/system/matrix-synapse.service":

    Requires=matrix-goofys
    After=matrix-goofys

To be changed to:

    Requires=matrix-goofys.service
    After=matrix-goofys.service
2022-10-11 00:43:22 +01:00
Samuel Meenzen 1d024975d6 Automatically set restricted_rooms to false on conduit 2022-10-10 07:10:15 +00:00
Slavi Pantaleev aff7ca2426 Upgrade appservice-slack (1.11.0 -> 2.0.1)
This also disables self-building on arm64, since it's no longer
necessary: https://github.com/matrix-org/matrix-appservice-slack/pull/656
2022-10-06 16:39:07 +03:00
Slavi Pantaleev b67ba669e8
Merge pull request #2038 from TheOneWithTheBraid/braid/matrix-ldap-registration-proxy
Draft: feat: include matrix_ldap_registration_proxy
2022-10-02 09:23:25 +03:00
Julian-Samuel Gebühr 41e1da2ff4
Make registration proxy independent of other roles, document (#7)
* Make registration proxy independent of other roles, document

Signed-off-by: Julian-Samuel Gebühr <julian-samuel@gebuehr.net>

* Fix yml issues

Signed-off-by: Julian-Samuel Gebühr <julian-samuel@gebuehr.net>

* Remove undefined variable (as service HAS to be exposed

Signed-off-by: Julian-Samuel Gebühr <julian-samuel@gebuehr.net>

* Add registration endpint

Defines the registration endpoint that should be intercepted/forwarded to the proxy

Signed-off-by: Julian-Samuel Gebühr <julian-samuel@gebuehr.net>

* Add image name

Signed-off-by: Julian-Samuel Gebühr <julian-samuel@gebuehr.net>

Signed-off-by: Julian-Samuel Gebühr <julian-samuel@gebuehr.net>
2022-09-29 18:00:14 +02:00
Slavi Pantaleev f623cf3550 Only download Grafana dashboard URLs for enabled services
If someone is using Dendrite and enabling Grafana, we'll no longer
download Synapse dashboards.

If someone is not using node-exporter, we'll no longer download node
exporter dashboards.

Related to https://github.com/spantaleev/matrix-docker-ansible-deploy/pull/2133
2022-09-26 08:46:10 +03:00
Slavi Pantaleev 6c928d87ca Configure Grafana's default_home_dashboard_path properly
Using `matrix_synapse_*` variables within the `matrix-grafana` role
is not a good practice.

We now have a `matrix_grafana_default_home_dashboard_path` variable
with a good universal default value and we override it via
`group_vars/matrix_servers` based on enabled components, etc.

This is a better fix for https://github.com/spantaleev/matrix-docker-ansible-deploy/pull/2133
2022-09-26 08:23:54 +03:00
Slavi Pantaleev 3d2547329e Add missing else clause to inline if
Related to https://github.com/spantaleev/matrix-docker-ansible-deploy/pull/2103

Fixes https://github.com/spantaleev/matrix-docker-ansible-deploy/issues/2104
2022-09-15 13:14:31 +03:00
Slavi Pantaleev 5f3f460cda Restore support for appservice and user_dir workers 2022-09-15 10:06:56 +03:00
Slavi Pantaleev 226c550ffa Add support for stream writer Synapse workers
As stream writer workers are also powered by the `generic_worker`
Synapse app, this necessitated that we provide means for distinguishing
between them and regular `generic_workers`.

I've also taken the time to optimize nginx configuration generation
(more Jinja2 macro usage, less duplication).

Worker names have also changed.
Workers are now named sequentially like this:
- `matrix-synapse-worker-0-generic`
- `matrix-synapse-worker-1-stream-writer-typing`
- `matrix-synapse-worker-2-pusher`

instead of `matrix-synapse-worker_generic_worker-18111` (indexed with a
port number).

People who modify `matrix_synapse_workers_enabled_list` directly will
need to adjust their configuration.
2022-09-15 08:10:04 +03:00
Julian-Samuel Gebühr b6fee92f0e Avoid cross-referencing of variables in role, move to group vars 2022-09-13 16:39:15 +00:00
Julian-Samuel Gebühr 42230b6765 Make role enabled in role but turn it off in group vars 2022-09-13 16:39:15 +00:00
Slavi Pantaleev f12206676f Upgrade Synapse (v1.66.0 -> 1.67.0) and remove frontend_proxy workers
`frontend_proxy` workers have been superseded by `generic_worker` workers.
Related to https://github.com/matrix-org/synapse/pull/13645
2022-09-13 15:45:50 +03:00
Slavi Pantaleev d6bd39c79d Add missing quotes
Related to https://github.com/spantaleev/matrix-docker-ansible-deploy/pull/2089
2022-09-09 15:18:57 +03:00
Julian-Samuel Gebühr 5825a0c919
Cactus comments (#2089)
* Add construct for cactus comments role

* Adjust config files

* Add docker self build to defaults

* Adjust tasks

* Fix smaller syntax errors

* Fix env argument

* Add tmp path to allow container writing there

Background why I did this: https://docs.gunicorn.org/en/stable/settings.html#worker-tmp-dir

* Change port back to 5000 as not configurable in container

* Try to add appservice config file for synapse to use

* Inject appservice file

* Correct copied variable name

* Comment out unused app service file injection

would need mounting the appservice file to the synapse container i guess

* Move role before synapse to be able to inject during runtime

* Remove unused parts

* Change default user id to mirror official docs

* Add docs

* Update roles/matrix-cactus-comments/tasks/setup_install.yml

Co-authored-by: Slavi Pantaleev <slavi@devture.com>

* Update roles/matrix-cactus-comments/templates/cactus_appservice.yaml.j2

Co-authored-by: Slavi Pantaleev <slavi@devture.com>

* Generate secrets if necessary, adjust docs

* Rename cactusbot userid

* Shorten salt strings

Co-authored-by: Slavi Pantaleev <slavi@devture.com>

* Use tmpfs instead of persistent mount

* Remove proxy option as it is nonsense

* Add download and serving of cc-client files

* Add documentation on client

* Clarify docs a bit

* Add nginx proxy to required services

Signed-off-by: Julian-Samuel Gebühr <julian-samuel@gebuehr.net>

* Use container address

Signed-off-by: Julian-Samuel Gebühr <julian-samuel@gebuehr.net>

* Correct comment of user id

Signed-off-by: Julian-Samuel Gebühr <julian-samuel@gebuehr.net>

* Use releases or local distributed client

Signed-off-by: Julian-Samuel Gebühr <julian-samuel@gebuehr.net>

* Move homeserver url to defaults

Signed-off-by: Julian-Samuel Gebühr <julian-samuel@gebuehr.net>

* Correct truth value

Signed-off-by: Julian-Samuel Gebühr <julian-samuel@gebuehr.net>

* Add documentation of variables

Co-authored-by: Slavi Pantaleev <slavi@devture.com>

* Tabs vs. spaces

Co-authored-by: Slavi Pantaleev <slavi@devture.com>

* Make nginx root configurable

Signed-off-by: Julian-Samuel Gebühr <julian-samuel@gebuehr.net>

* Complete ake nginx root configurable

Signed-off-by: Julian-Samuel Gebühr <julian-samuel@gebuehr.net>

* Fix file permission

Signed-off-by: Julian-Samuel Gebühr <julian-samuel@gebuehr.net>

* Fix lint errors

Signed-off-by: Julian-Samuel Gebühr <julian-samuel@gebuehr.net>

Signed-off-by: Julian-Samuel Gebühr <julian-samuel@gebuehr.net>
Co-authored-by: Slavi Pantaleev <slavi@devture.com>
2022-09-09 14:37:52 +03:00
Aine 692a7af36a
postmoogle feedback 2022-09-09 13:19:25 +03:00
Aine b92ff748e4
Update Postmoogle 0.9.0 -> 0.9.1 2022-09-09 10:47:00 +03:00
Shaleen Jain 0300c0e96e Update dendrite 0.9.5 -> 0.9.6
Remove appservice database setup/config as the latest update no longer requires it.
2022-09-02 09:31:17 +05:30
Slavi Pantaleev 8e0e9fa878 Deprecate matrix_synapse_account_threepid_delegates_email before Synapse v1.66.0
This is done in anticipation of this option's removal in the
upcoming Synapse v1.66.0 release (likely tomorrow).

See: https://matrix-org.github.io/synapse/v1.66/upgrade.html#delegation-of-email-validation-no-longer-supported
2022-08-30 18:51:35 +03:00