af1c9ae59d
In most cases, there's not really a need to touch the system firewall, as Docker manages iptables by itself (see https://docs.docker.com/network/iptables/). All ports exposed by Docker containers are automatically whitelisted in iptables and wired to the correct container. This made installing firewalld and whitelisting ports pointless, as far as this playbook's services are concerned. People that wish to install firewalld (for other reasons), can do so manually from now on. This is inspired by and fixes #97 (Github Issue).
80 lines
2.8 KiB
YAML
80 lines
2.8 KiB
YAML
---
|
|
|
|
# This will throw a Permission Denied error if already mounted using fuse
|
|
- name: Check Matrix Synapse media store path
|
|
stat:
|
|
path: "{{ matrix_synapse_media_store_path }}"
|
|
register: local_path_media_store_stat
|
|
ignore_errors: yes
|
|
|
|
# This is separate and conditional, to ensure we don't execute it
|
|
# if the path already exists or we failed to check, because it's mounted using fuse.
|
|
- name: Ensure Matrix media store path exists
|
|
file:
|
|
path: "{{ matrix_synapse_media_store_path }}"
|
|
state: directory
|
|
mode: 0750
|
|
owner: "{{ matrix_user_username }}"
|
|
group: "{{ matrix_user_username }}"
|
|
when: "not local_path_media_store_stat.failed and not local_path_media_store_stat.stat.exists"
|
|
|
|
- name: Ensure Matrix Docker image is pulled
|
|
docker_image:
|
|
name: "{{ matrix_synapse_docker_image }}"
|
|
|
|
- name: Check if a Matrix Synapse configuration exists
|
|
stat:
|
|
path: "{{ matrix_synapse_config_dir_path }}/homeserver.yaml"
|
|
register: matrix_synapse_config_stat
|
|
|
|
# We do this mostly so that the keys would get generated.
|
|
# We'll replace the rest of the configuration with our own templates below.
|
|
#
|
|
# We don't use the `docker_container` module, because using it with `cap_drop` requires
|
|
# a very recent version, which is not available for a lot of people yet.
|
|
- name: Generate initial Matrix config
|
|
command: |
|
|
docker run
|
|
--rm
|
|
--name=matrix-config
|
|
--user={{ matrix_user_uid }}:{{ matrix_user_gid }}
|
|
--cap-drop=ALL
|
|
-v {{ matrix_synapse_config_dir_path }}:/data
|
|
-e SYNAPSE_CONFIG_PATH=/data/homeserver.yaml
|
|
-e SYNAPSE_SERVER_NAME={{ matrix_server_fqn_matrix }}
|
|
-e SYNAPSE_REPORT_STATS=no
|
|
{{ matrix_synapse_docker_image }}
|
|
generate
|
|
when: "not matrix_synapse_config_stat.stat.exists"
|
|
|
|
- name: Ensure Matrix homeserver config installed
|
|
template:
|
|
src: "{{ matrix_synapse_template_synapse_homeserver }}"
|
|
dest: "{{ matrix_synapse_config_dir_path }}/homeserver.yaml"
|
|
mode: 0644
|
|
|
|
- name: Ensure Matrix log config installed
|
|
template:
|
|
src: "{{ matrix_synapse_template_synapse_log }}"
|
|
dest: "{{ matrix_synapse_config_dir_path }}/{{ matrix_server_fqn_matrix }}.log.config"
|
|
mode: 0644
|
|
|
|
- name: Ensure matrix-synapse.service installed
|
|
template:
|
|
src: "{{ role_path }}/templates/synapse/systemd/matrix-synapse.service.j2"
|
|
dest: "/etc/systemd/system/matrix-synapse.service"
|
|
mode: 0644
|
|
register: matrix_synapse_systemd_service_result
|
|
|
|
- name: Ensure systemd reloaded after matrix-synapse.service installation
|
|
service:
|
|
daemon_reload: yes
|
|
when: matrix_synapse_systemd_service_result.changed
|
|
|
|
- name: Ensure matrix-synapse-register-user script created
|
|
template:
|
|
src: "{{ role_path }}/templates/synapse/usr-local-bin/matrix-synapse-register-user.j2"
|
|
dest: "/usr/local/bin/matrix-synapse-register-user"
|
|
mode: 0750
|
|
|