diff --git a/group_vars/matrix_servers b/group_vars/matrix_servers index f148e042..9fd637e8 100755 --- a/group_vars/matrix_servers +++ b/group_vars/matrix_servers @@ -344,6 +344,8 @@ devture_systemd_service_manager_services_list_auto: | + ([{'name': 'matrix-registration.service', 'priority': 4000, 'groups': ['matrix', 'registration']}] if matrix_registration_enabled else []) + + ([{'name': 'matrix-sliding-sync-proxy.service', 'priority': 4000, 'groups': ['matrix', 'sliding-sync-proxy']}] if matrix_sliding_sync_proxy_enabled else []) + + ([{'name': 'matrix-sygnal.service', 'priority': 800, 'groups': ['matrix', 'sygnal']}] if matrix_sygnal_enabled else []) + ([{'name': 'matrix-goofys.service', 'priority': 800, 'groups': ['matrix', 'goofys']}] if matrix_s3_media_store_enabled else []) @@ -2383,6 +2385,7 @@ matrix_nginx_proxy_proxy_hydrogen_enabled: "{{ matrix_client_hydrogen_enabled an matrix_nginx_proxy_proxy_cinny_enabled: "{{ matrix_client_cinny_enabled and matrix_playbook_reverse_proxy_type in ['playbook-managed-nginx', 'other-nginx-non-container'] }}" matrix_nginx_proxy_proxy_buscarron_enabled: "{{ matrix_bot_buscarron_enabled }}" matrix_nginx_proxy_proxy_dimension_enabled: "{{ matrix_dimension_enabled }}" +matrix_nginx_proxy_proxy_sliding_sync_proxy_enabled: "{{ matrix_sliding_sync_proxy_enabled }}" matrix_nginx_proxy_proxy_etherpad_enabled: "{{ matrix_etherpad_enabled and matrix_etherpad_mode == 'standalone' }}" matrix_nginx_proxy_proxy_bot_go_neb_enabled: "{{ matrix_bot_go_neb_enabled }}" @@ -2400,6 +2403,7 @@ matrix_nginx_proxy_container_labels_traefik_entrypoints: "{{ devture_traefik_ent matrix_nginx_proxy_container_labels_traefik_proxy_matrix_enabled: true matrix_nginx_proxy_container_labels_traefik_proxy_buscarron_enabled: "{{ matrix_bot_buscarron_enabled }}" matrix_nginx_proxy_container_labels_traefik_proxy_dimension_enabled: "{{ matrix_dimension_enabled }}" +matrix_nginx_proxy_container_labels_traefik_proxy_sliding_sync_proxy_enabled: "{{ matrix_sliding_sync_proxy_enabled }}" matrix_nginx_proxy_container_labels_traefik_proxy_etherpad_enabled: "{{ matrix_etherpad_enabled and matrix_etherpad_mode == 'standalone' }}" matrix_nginx_proxy_container_labels_traefik_proxy_bot_go_neb_enabled: "{{ matrix_bot_go_neb_enabled }}" matrix_nginx_proxy_container_labels_traefik_proxy_jitsi_enabled: "{{ matrix_jitsi_enabled }}" @@ -2489,6 +2493,8 @@ matrix_nginx_proxy_systemd_wanted_services_list: | + (['matrix-jitsi.service'] if matrix_jitsi_enabled else []) + + (['matrix-sliding-sync-proxy.service'] if matrix_sliding_sync_proxy_enabled else []) + + (['matrix-bot-go-neb.service'] if matrix_bot_go_neb_enabled else []) + (['matrix-etherpad.service'] if matrix_etherpad_enabled else []) @@ -2512,6 +2518,8 @@ matrix_ssl_domains_to_obtain_certificates_for: | + ([matrix_server_fqn_dimension] if matrix_dimension_enabled else []) + + ([matrix_server_fqn_sliding_sync_proxy] if matrix_sliding_sync_proxy_enabled else []) + + ([matrix_server_fqn_etherpad] if (matrix_etherpad_enabled and matrix_etherpad_mode == 'standalone') else []) + ([matrix_server_fqn_bot_go_neb] if matrix_bot_go_neb_enabled else []) @@ -2620,6 +2628,12 @@ devture_postgres_managed_databases_auto: | 'password': matrix_dendrite_database_password, }] if (matrix_dendrite_enabled and matrix_dendrite_database_hostname == devture_postgres_connection_hostname) else []) + + ([{ + 'name': matrix_sliding_sync_proxy_database_name, + 'username': matrix_sliding_sync_proxy_database_username, + 'password': matrix_sliding_sync_proxy_database_password, + }] if (matrix_sliding_sync_proxy_enabled) else []) + + ([{ 'name': matrix_ma1sd_database_name, 'username': matrix_ma1sd_database_username, @@ -3495,6 +3509,40 @@ matrix_registration_database_password: "{{ '%s' | format(matrix_homeserver_gener ###################################################################### + +###################################################################### +# +# matrix-sliding-sync-proxy +# +###################################################################### + +# We don't enable the sliding sync proxy by default. +matrix_sliding_sync_proxy_enabled: false + +matrix_sliding_sync_proxy_container_image_self_build: "{{ matrix_architecture not in ['amd64'] }}" + +matrix_sliding_sync_proxy_systemd_required_services_list: | + {{ + ['docker.service'] + + + ['matrix-' + matrix_homeserver_implementation + '.service'] + + + ([devture_postgres_identifier ~ '.service'] if devture_postgres_enabled else []) + + + (['matrix-nginx-proxy.service'] if matrix_nginx_proxy_enabled else []) + }} + +matrix_sliding_sync_proxy_secret: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'ss.secret', rounds=655555) | to_uuid }}" +matrix_sliding_sync_proxy_database_hostname: "{{devture_postgres_connection_hostname}}" +matrix_sliding_sync_proxy_database_password: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'ss.db', rounds=655555) | to_uuid }}" + +###################################################################### +# +# /matrix-sliding-sync-proxy +# +###################################################################### + + ###################################################################### # # matrix-dendrite diff --git a/playbooks/matrix.yml b/playbooks/matrix.yml index 6980a6f9..8e8d3563 100755 --- a/playbooks/matrix.yml +++ b/playbooks/matrix.yml @@ -102,6 +102,7 @@ - custom/matrix-ldap-registration-proxy - custom/matrix-ma1sd - custom/matrix-dimension + - custom/matrix-sliding-sync-proxy - custom/matrix-etherpad - custom/matrix-email2matrix - custom/matrix-sygnal diff --git a/roles/custom/matrix-base/defaults/main.yml b/roles/custom/matrix-base/defaults/main.yml index da5459f8..f140e2a3 100644 --- a/roles/custom/matrix-base/defaults/main.yml +++ b/roles/custom/matrix-base/defaults/main.yml @@ -81,6 +81,9 @@ matrix_server_fqn_bot_go_neb: "goneb.{{ matrix_domain }}" # This is where you access Jitsi. matrix_server_fqn_jitsi: "jitsi.{{ matrix_domain }}" +# This is where you access the sliding sync proxy. +matrix_server_fqn_sliding_sync_proxy: "sliding-sync.{{ matrix_domain }}" + # This is where you access Grafana. matrix_server_fqn_grafana: "stats.{{ matrix_domain }}" diff --git a/roles/custom/matrix-base/templates/static-files/well-known/matrix-client.j2 b/roles/custom/matrix-base/templates/static-files/well-known/matrix-client.j2 index 45fc9b66..89e9660c 100644 --- a/roles/custom/matrix-base/templates/static-files/well-known/matrix-client.j2 +++ b/roles/custom/matrix-base/templates/static-files/well-known/matrix-client.j2 @@ -26,6 +26,11 @@ "preferredDomain": {{ matrix_client_element_jitsi_preferredDomain|to_json }} } {% endif %} + {% if matrix_sliding_sync_proxy_enabled %}, + "org.matrix.msc3575.proxy": { + "url": "https://{{ matrix_server_fqn_sliding_sync_proxy }}/_matrix/client/unstable/org.matrix.msc3575/sync" + } + {% endif %} {% if matrix_client_element_location_sharing_enabled %}, "m.tile_server": { "map_style_url": "https://{{ matrix_server_fqn_element }}/map_style.json" diff --git a/roles/custom/matrix-nginx-proxy/defaults/main.yml b/roles/custom/matrix-nginx-proxy/defaults/main.yml index b656f074..f167addd 100644 --- a/roles/custom/matrix-nginx-proxy/defaults/main.yml +++ b/roles/custom/matrix-nginx-proxy/defaults/main.yml @@ -91,6 +91,11 @@ matrix_nginx_proxy_container_labels_traefik_proxy_sygnal_hostname: "{{ matrix_se matrix_nginx_proxy_container_labels_traefik_proxy_sygnal_tls: "{{ matrix_nginx_proxy_container_labels_traefik_entrypoints != 'web' }}" matrix_nginx_proxy_container_labels_traefik_proxy_sygnal_rule: "Host(`{{ matrix_nginx_proxy_container_labels_traefik_proxy_sygnal_hostname }}`)" +matrix_nginx_proxy_container_labels_traefik_proxy_sliding_sync_proxy_enabled: false +matrix_nginx_proxy_container_labels_traefik_proxy_sliding_sync_proxy_hostname: "{{ matrix_server_fqn_sliding_sync_proxy }}" +matrix_nginx_proxy_container_labels_traefik_proxy_sliding_sync_proxy_tls: "{{ matrix_nginx_proxy_container_labels_traefik_entrypoints != 'web' }}" +matrix_nginx_proxy_container_labels_traefik_proxy_sliding_sync_proxy_rule: "Host(`{{ matrix_nginx_proxy_container_labels_traefik_proxy_sliding_sync_proxy_hostname }}`)" + # matrix_nginx_proxy_container_labels_additional_labels contains a multiline string with additional labels to add to the container label file. # See `../templates/labels.j2` for details. # @@ -283,6 +288,10 @@ matrix_nginx_proxy_proxy_sygnal_hostname: "{{ matrix_server_fqn_sygnal }}" matrix_nginx_proxy_proxy_ntfy_enabled: false matrix_nginx_proxy_proxy_ntfy_hostname: "{{ matrix_server_fqn_ntfy }}" +# Controls whether proxying the sliding sync proxy domain should be done. +matrix_nginx_proxy_proxy_sliding_sync_proxy_enabled: false +matrix_nginx_proxy_proxy_sliding_sync_proxy_hostname: "{{ matrix_server_fqn_sliding_sync_proxy }}" + # Controls whether proxying for (Prometheus) metrics (`/metrics/*`) for the various services should be done (on the matrix domain) # If the internal Prometheus server (`matrix-prometheus` role) is used, proxying is not necessary, since Prometheus can access each container directly. # This is only useful when an external Prometheus will be collecting metrics. @@ -462,6 +471,10 @@ matrix_nginx_proxy_proxy_sygnal_additional_server_configuration_blocks: [] # A list of strings containing additional configuration blocks to add to ntfy's server configuration (matrix-ntfy.conf). matrix_nginx_proxy_proxy_ntfy_additional_server_configuration_blocks: [] +# A list of strings containing additional configuration blocks to add to sliding_sync_proxy's server configuration (matrix-sliding-sync-proxy.conf). +matrix_nginx_proxy_proxy_sliding_sync_proxy_additional_server_configuration_blocks: [] + + # A list of strings containing additional configuration blocks to add to the base domain server configuration (matrix-base-domain.conf). matrix_nginx_proxy_proxy_domain_additional_server_configuration_blocks: [] diff --git a/roles/custom/matrix-nginx-proxy/tasks/setup_nginx_proxy.yml b/roles/custom/matrix-nginx-proxy/tasks/setup_nginx_proxy.yml index 5aa63597..7fc8408b 100644 --- a/roles/custom/matrix-nginx-proxy/tasks/setup_nginx_proxy.yml +++ b/roles/custom/matrix-nginx-proxy/tasks/setup_nginx_proxy.yml @@ -122,6 +122,14 @@ mode: 0644 when: matrix_nginx_proxy_proxy_buscarron_enabled | bool +- name: Ensure Matrix nginx-proxy configuration for sliding-sync-proxy domain exists + ansible.builtin.template: + src: "{{ role_path }}/templates/nginx/conf.d/matrix-sliding-sync-proxy.conf.j2" + dest: "{{ matrix_nginx_proxy_confd_path }}/matrix-sliding-sync-proxy.conf" + mode: 0644 + when: matrix_nginx_proxy_proxy_sliding_sync_proxy_enabled | bool + + - name: Ensure Matrix nginx-proxy configuration for dimension domain exists ansible.builtin.template: src: "{{ role_path }}/templates/nginx/conf.d/matrix-dimension.conf.j2" @@ -285,6 +293,12 @@ state: absent when: "not matrix_nginx_proxy_proxy_buscarron_enabled | bool" +- name: Ensure Matrix nginx-proxy configuration for sliding-sync-proxy domain deleted + ansible.builtin.file: + path: "{{ matrix_nginx_proxy_confd_path }}/matrix-sliding-sync-proxy.conf" + state: absent + when: "not matrix_nginx_proxy_proxy_sliding_sync_proxy_enabled | bool" + - name: Ensure Matrix nginx-proxy configuration for dimension domain deleted ansible.builtin.file: path: "{{ matrix_nginx_proxy_confd_path }}/matrix-dimension.conf" diff --git a/roles/custom/matrix-nginx-proxy/templates/labels.j2 b/roles/custom/matrix-nginx-proxy/templates/labels.j2 index 1e60ba6d..b16a0b8e 100644 --- a/roles/custom/matrix-nginx-proxy/templates/labels.j2 +++ b/roles/custom/matrix-nginx-proxy/templates/labels.j2 @@ -50,6 +50,18 @@ traefik.http.routers.matrix-nginx-proxy-buscarron.entrypoints={{ matrix_nginx_pr {% endif %} +{% if matrix_nginx_proxy_container_labels_traefik_proxy_sliding_sync_proxy_enabled %} +# Sliding Sync Proxy +traefik.http.routers.matrix-nginx-proxy-sliding-sync-proxy.rule={{ matrix_nginx_proxy_container_labels_traefik_proxy_sliding_sync_proxy_rule }} +traefik.http.routers.matrix-nginx-proxy-sliding-sync-proxy.service=matrix-nginx-proxy-web +traefik.http.routers.matrix-nginx-proxy-sliding-sync-proxy.tls={{ matrix_nginx_proxy_container_labels_traefik_proxy_sliding_sync_proxy_tls | to_json }} +{% if matrix_nginx_proxy_container_labels_traefik_proxy_sliding_sync_proxy_tls %} +traefik.http.routers.matrix-nginx-proxy-sliding-sync-proxy.tls.certResolver={{ matrix_nginx_proxy_container_labels_traefik_tls_certResolver }} +{% endif %} +traefik.http.routers.matrix-nginx-proxy-sliding-sync-proxy.entrypoints={{ matrix_nginx_proxy_container_labels_traefik_entrypoints }} +{% endif %} + + {% if matrix_nginx_proxy_container_labels_traefik_proxy_dimension_enabled %} # Dimension traefik.http.routers.matrix-nginx-proxy-dimension.rule={{ matrix_nginx_proxy_container_labels_traefik_proxy_dimension_rule }} diff --git a/roles/custom/matrix-nginx-proxy/templates/nginx/conf.d/matrix-sliding-sync-proxy.conf.j2 b/roles/custom/matrix-nginx-proxy/templates/nginx/conf.d/matrix-sliding-sync-proxy.conf.j2 new file mode 100644 index 00000000..50a0422d --- /dev/null +++ b/roles/custom/matrix-nginx-proxy/templates/nginx/conf.d/matrix-sliding-sync-proxy.conf.j2 @@ -0,0 +1,100 @@ +#jinja2: lstrip_blocks: "True" + +{% macro render_vhost_directives() %} + gzip on; + gzip_types text/plain application/json application/javascript text/css image/x-icon font/ttf image/gif; + {% if matrix_nginx_proxy_hsts_preload_enabled %} + add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always; + {% else %} + add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always; + {% endif %} + add_header X-XSS-Protection "{{ matrix_nginx_proxy_xss_protection }}"; + add_header X-Content-Type-Options nosniff; + {% if matrix_nginx_proxy_floc_optout_enabled %} + add_header Permissions-Policy interest-cohort=() always; + {% endif %} + +{% for configuration_block in matrix_nginx_proxy_proxy_sliding_sync_proxy_additional_server_configuration_blocks %} + {{- configuration_block }} +{% endfor %} + + location / { + {% if matrix_nginx_proxy_enabled %} + {# Use the embedded DNS resolver in Docker containers to discover the service #} + resolver {{ matrix_nginx_proxy_http_level_resolver }} valid=5s; + set $backend "matrix-sliding-sync-proxy:8008"; + proxy_pass http://$backend; + {% else %} + {# Generic configuration for use outside of our container setup #} + proxy_pass http://127.0.0.1:8008; + {% endif %} + + proxy_set_header Host $host; + proxy_set_header X-Forwarded-For {{ matrix_nginx_proxy_x_forwarded_for }}; + } +{% endmacro %} + +server { + listen {{ 8080 if matrix_nginx_proxy_enabled else 80 }}; + listen [::]:{{ 8080 if matrix_nginx_proxy_enabled else 80 }}; + + server_name {{ matrix_nginx_proxy_proxy_sliding_sync_proxy_hostname }}; + + server_tokens off; + root /dev/null; + + {% if matrix_nginx_proxy_https_enabled %} + location /.well-known/acme-challenge { + {% if matrix_nginx_proxy_enabled %} + {# Use the embedded DNS resolver in Docker containers to discover the service #} + resolver {{ matrix_nginx_proxy_http_level_resolver }} valid=5s; + set $backend "matrix-certbot:8080"; + proxy_pass http://$backend; + {% else %} + {# Generic configuration for use outside of our container setup #} + proxy_pass http://127.0.0.1:{{ matrix_ssl_lets_encrypt_certbot_standalone_http_port }}; + {% endif %} + } + + location / { + return 301 https://$http_host$request_uri; + } + {% else %} + {{ render_vhost_directives() }} + {% endif %} +} + +{% if matrix_nginx_proxy_https_enabled %} +server { + listen {{ 8443 if matrix_nginx_proxy_enabled else 443 }} ssl http2; + listen [::]:{{ 8443 if matrix_nginx_proxy_enabled else 443 }} ssl http2; + + server_name {{ matrix_nginx_proxy_proxy_sliding_sync_proxy_hostname }}; + + server_tokens off; + root /dev/null; + + ssl_certificate {{ matrix_ssl_config_dir_path }}/live/{{ matrix_nginx_proxy_proxy_sliding_sync_proxy_hostname }}/fullchain.pem; + ssl_certificate_key {{ matrix_ssl_config_dir_path }}/live/{{ matrix_nginx_proxy_proxy_sliding_sync_proxy_hostname }}/privkey.pem; + + ssl_protocols {{ matrix_nginx_proxy_ssl_protocols }}; + {% if matrix_nginx_proxy_ssl_ciphers != '' %} + ssl_ciphers {{ matrix_nginx_proxy_ssl_ciphers }}; + {% endif %} + ssl_prefer_server_ciphers {{ matrix_nginx_proxy_ssl_prefer_server_ciphers }}; + + {% if matrix_nginx_proxy_ocsp_stapling_enabled %} + ssl_stapling on; + ssl_stapling_verify on; + ssl_trusted_certificate {{ matrix_ssl_config_dir_path }}/live/{{ matrix_nginx_proxy_proxy_sliding_sync_proxy_hostname }}/chain.pem; + {% endif %} + + {% if matrix_nginx_proxy_ssl_session_tickets_off %} + ssl_session_tickets off; + {% endif %} + ssl_session_cache {{ matrix_nginx_proxy_ssl_session_cache }}; + ssl_session_timeout {{ matrix_nginx_proxy_ssl_session_timeout }}; + + {{ render_vhost_directives() }} +} +{% endif %} diff --git a/roles/custom/matrix-sliding-sync-proxy/defaults/main.yml b/roles/custom/matrix-sliding-sync-proxy/defaults/main.yml new file mode 100644 index 00000000..edf9c7cb --- /dev/null +++ b/roles/custom/matrix-sliding-sync-proxy/defaults/main.yml @@ -0,0 +1,40 @@ +--- +# Sliding Sync Proxy is an implementation of MSC3575 for the new sliding sync + +matrix_sliding_sync_proxy_enabled: false + +matrix_sliding_sync_proxy_container_image_self_build: false +matrix_sliding_sync_proxy_docker_repo: "https://github.com/matrix-org/sliding_sync_proxy/" +matrix_sliding_sync_proxy_docker_repo_version: "{{ 'main' if matrix_sliding_sync_proxy_version == 'main' else matrix_sliding_sync_proxy_version }}" +matrix_sliding_sync_proxy_docker_src_files_path: "{{ matrix_base_data_path }}/Dockerfile" + +matrix_sliding_sync_proxy_version: "v0.99.1" +matrix_sliding_sync_proxy_docker_image: "{{ matrix_sliding_sync_proxy_docker_image_name_prefix }}matrix-org/sliding-sync:{{ matrix_sliding_sync_proxy_version }}" +matrix_sliding_sync_proxy_docker_image_name_prefix: "{{ 'localhost/' if matrix_sliding_sync_proxy_container_image_self_build else 'ghcr.io/' }}" +matrix_sliding_sync_proxy_docker_image_force_pull: "{{ matrix_sliding_sync_proxy_docker_image.endswith(':main') }}" + +# A list of extra arguments to pass to the container +matrix_sliding_sync_proxy_container_extra_arguments: [] + +# List of systemd services that matrix-sliding-sync-proxy.service depends on +matrix_sliding_sync_proxy_systemd_required_services_list: ["docker.service"] + +# List of systemd services that matrix-sliding-sync-proxy.service wants +matrix_sliding_sync_proxy_systemd_wanted_services_list: [] + +# these must be set for sliding sync to properly start + +# custom secret used in the proxy +matrix_sliding_sync_proxy_secret: '' + +# Database-related configuration fields. +# Only Postgres is supported. +matrix_sliding_sync_proxy_database_engine: "postgres" + +matrix_sliding_sync_proxy_database_username: 'matrix_sliding_sync' +matrix_sliding_sync_proxy_database_password: 'not-a-real-password' +matrix_sliding_sync_proxy_database_hostname: '' +matrix_sliding_sync_proxy_database_port: 5432 +matrix_sliding_sync_proxy_database_name: 'matrix_sliding_sync' + +matrix_sliding_sync_proxy_database_connection_string: 'user={{ matrix_sliding_sync_proxy_database_username }} password={{ matrix_sliding_sync_proxy_database_password }} host={{ matrix_sliding_sync_proxy_database_hostname }} port={{ matrix_sliding_sync_proxy_database_port }} dbname={{ matrix_sliding_sync_proxy_database_name }} sslmode=disable' diff --git a/roles/custom/matrix-sliding-sync-proxy/tasks/main.yml b/roles/custom/matrix-sliding-sync-proxy/tasks/main.yml new file mode 100644 index 00000000..f9011925 --- /dev/null +++ b/roles/custom/matrix-sliding-sync-proxy/tasks/main.yml @@ -0,0 +1,19 @@ +--- +- block: + - when: matrix_sliding_sync_proxy_enabled | bool + ansible.builtin.include_tasks: "{{ role_path }}/tasks/validate_config.yml" + + - when: matrix_sliding_sync_proxy_enabled | bool + ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_install.yml" + tags: + - setup-all + - setup-sliding_sync_proxy + - install-all + - install-sliding_sync_proxy + +- block: + - when: not matrix_sliding_sync_proxy_enabled | bool + ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_uninstall.yml" + tags: + - setup-all + - setup-sliding_sync_proxy diff --git a/roles/custom/matrix-sliding-sync-proxy/tasks/setup_install.yml b/roles/custom/matrix-sliding-sync-proxy/tasks/setup_install.yml new file mode 100644 index 00000000..033c9c9b --- /dev/null +++ b/roles/custom/matrix-sliding-sync-proxy/tasks/setup_install.yml @@ -0,0 +1,56 @@ +--- +- name: Ensure sliding_sync_proxy paths exist + ansible.builtin.file: + path: "{{ item.path }}" + state: directory + mode: 0750 + owner: "{{ matrix_user_username }}" + group: "{{ matrix_user_groupname }}" + with_items: + - { + path: "{{ matrix_sliding_sync_proxy_docker_src_files_path }}", + when: matrix_sliding_sync_proxy_container_image_self_build, + } + when: "item.when | bool" + +- name: Ensure sliding_sync_proxy image is pulled + community.docker.docker_image: + name: "{{ matrix_sliding_sync_proxy_docker_image }}" + source: "{{ 'pull' if ansible_version.major > 2 or ansible_version.minor > 7 else omit }}" + force_source: "{{ matrix_sliding_sync_proxy_docker_image_force_pull if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}" + force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else matrix_sliding_sync_proxy_docker_image_force_pull }}" + when: "not matrix_sliding_sync_proxy_container_image_self_build | bool" + register: result + retries: "{{ devture_playbook_help_container_retries_count }}" + delay: "{{ devture_playbook_help_container_retries_delay }}" + until: result is not failed + +- name: Ensure sliding_sync_proxy repository is present on self-build + ansible.builtin.git: + repo: "{{ matrix_sliding_sync_proxy_docker_repo }}" + version: "{{ matrix_sliding_sync_proxy_docker_repo_version }}" + dest: "{{ matrix_sliding_sync_proxy_docker_src_files_path }}" + force: "yes" + become: true + become_user: "{{ matrix_user_username }}" + register: matrix_sliding_sync_proxy_git_pull_results + when: "matrix_sliding_sync_proxy_container_image_self_build | bool" + +- name: Ensure sliding_sync_proxy image is built + community.docker.docker_image: + name: "{{ matrix_sliding_sync_proxy_docker_image }}" + source: build + force_source: "{{ matrix_sliding_sync_proxy_git_pull_results.changed if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}" + force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else matrix_mailer_git_pull_results.changed }}" + build: + dockerfile: Dockerfile + path: "{{ matrix_sliding_sync_proxy_docker_src_files_path }}" + pull: true + when: "matrix_sliding_sync_proxy_container_image_self_build | bool" + +- name: Ensure matrix-sliding-sync-proxy.service installed + ansible.builtin.template: + src: "{{ role_path }}/templates/systemd/matrix-sliding-sync-proxy.service.j2" + dest: "{{ devture_systemd_docker_base_systemd_path }}/matrix-sliding-sync-proxy.service" + mode: 0644 + register: matrix_sliding_sync_proxy_systemd_service_result diff --git a/roles/custom/matrix-sliding-sync-proxy/tasks/setup_uninstall.yml b/roles/custom/matrix-sliding-sync-proxy/tasks/setup_uninstall.yml new file mode 100644 index 00000000..a52479c1 --- /dev/null +++ b/roles/custom/matrix-sliding-sync-proxy/tasks/setup_uninstall.yml @@ -0,0 +1,24 @@ +--- +- name: Check existence of matrix-sliding-sync-proxy service + ansible.builtin.stat: + path: "{{ devture_systemd_docker_base_systemd_path }}/matrix-sliding-sync-proxy.service" + register: matrix_sliding_sync_proxy_service_stat + +- when: matrix_sliding_sync_proxy_service_stat.stat.exists | bool + block: + - name: Ensure matrix-sliding-sync-proxy is stopped + ansible.builtin.service: + name: matrix-sliding-sync-proxy + state: stopped + enabled: false + daemon_reload: true + + - name: Ensure matrix-sliding-sync-proxy.service doesn't exist + ansible.builtin.file: + path: "{{ devture_systemd_docker_base_systemd_path }}/matrix-sliding-sync-proxy.service" + state: absent + + - name: Ensure matrix-sliding-sync-proxy paths don't exist + ansible.builtin.file: + path: "{{ matrix_sliding_sync_proxy_base_path }}" + state: absent diff --git a/roles/custom/matrix-sliding-sync-proxy/tasks/validate_config.yml b/roles/custom/matrix-sliding-sync-proxy/tasks/validate_config.yml new file mode 100644 index 00000000..4e11fc3b --- /dev/null +++ b/roles/custom/matrix-sliding-sync-proxy/tasks/validate_config.yml @@ -0,0 +1,9 @@ +--- +- name: Fail if required matrix-sliding-sync-proxy settings not defined + ansible.builtin.fail: + msg: > + You need to define a required configuration setting (`{{ item.name }}`). + when: "item.when | bool and vars[item.name] == ''" + with_items: + - {'name': 'matrix_sliding_sync_proxy_secret', when: true} + - {'name': 'matrix_sliding_sync_proxy_database_hostname', when: "{{ matrix_sliding_sync_proxy_database_engine == 'postgres' }}"} diff --git a/roles/custom/matrix-sliding-sync-proxy/templates/systemd/matrix-sliding-sync-proxy.service.j2 b/roles/custom/matrix-sliding-sync-proxy/templates/systemd/matrix-sliding-sync-proxy.service.j2 new file mode 100644 index 00000000..dc80d56a --- /dev/null +++ b/roles/custom/matrix-sliding-sync-proxy/templates/systemd/matrix-sliding-sync-proxy.service.j2 @@ -0,0 +1,43 @@ +#jinja2: lstrip_blocks: "True" +[Unit] +Description=Matrix sliding_sync_proxy Service +{% for service in matrix_sliding_sync_proxy_systemd_required_services_list %} +Requires={{ service }} +After={{ service }} +{% endfor %} +{% for service in matrix_sliding_sync_proxy_systemd_wanted_services_list %} +Wants={{ service }} +{% endfor %} +DefaultDependencies=no + +[Service] +Type=simple +Environment="HOME={{ devture_systemd_docker_base_systemd_unit_home_path }}" +ExecStartPre=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} kill matrix-sliding-sync-proxy 2>/dev/null || true' +ExecStartPre=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} rm matrix-sliding-sync-proxy 2>/dev/null || true' + +ExecStart={{ devture_systemd_docker_base_host_command_docker }} run --rm --name matrix-sliding-sync-proxy \ + --log-driver=none \ + --user={{ matrix_user_uid }}:{{ matrix_user_gid }} \ + --cap-drop=ALL \ + --read-only \ + --tmpfs /tmp \ + -e "SYNCV3_SERVER={{matrix_homeserver_url}}" \ + -e "SYNCV3_SECRET={{matrix_sliding_sync_proxy_secret}}" \ + -e "SYNCV3_BINDADDR=:8008" \ + -e "SYNCV3_DB={{matrix_sliding_sync_proxy_database_connection_string}}" \ + --network={{ matrix_docker_network }} \ + {% for arg in matrix_sliding_sync_proxy_container_extra_arguments %} + {{ arg }} \ + {% endfor %} + {{ matrix_sliding_sync_proxy_docker_image }} \ + --config /config/config.yml + +ExecStop=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} kill matrix-sliding-sync-proxy 2>/dev/null || true' +ExecStop=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} rm matrix-sliding-sync-proxy 2>/dev/null || true' +Restart=always +RestartSec=30 +SyslogIdentifier=matrix-sliding-sync-proxy + +[Install] +WantedBy=multi-user.target