fossilfranv/matrix-docker-ansible-deploy
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge pull request #3 from hanthor/mautrix-wsproxy

Browse Source 
Mautrix wsproxy
This commit is contained in:
Shreyas Ajjarapu 2022-01-09 18:51:46 -06:00 committed by GitHub
commit 6b41807f46
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
16 changed files with 605 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

27
docs/configuring-playbook-bridge-mautrix-wsproxy.md Normal file
View File

@ -0,0 +1,27 @@
# Setting up Mautrix wsproxy (optional)
The playbook can install and configure [mautrix-wsproxy](https://github.com/mautrix/wsproxy) for you.
See the project's [documentation](https://github.com/mautrix/wsproxy#readme) to learn what it does and why it might be useful to you.
Use the following playbook configuration:
```yaml
matrix_mautrix_wsproxy_enabled: true
matrix_mautrix_imessage_user: 'user@domain.com'
```
## Set up Double Puppeting
If you'd like to use [Double Puppeting](https://github.com/tulir/mautrix-hangouts/wiki/Authentication#double-puppeting) (hint: you most likely do), you have 1 way of going about it.
### Method 1: automatically, by enabling Shared Secret Auth
The bridge will automatically perform Double Puppeting if you enable [Shared Secret Auth](configuring-playbook-shared-secret-auth.md) for this playbook.
This is the recommended way of setting up Double Puppeting, as it's easier to accomplish, works for all your users automatically, and has less of a chance of breaking in the future.
## Usage
Follow the [matrix-imessage documenation](https://docs.mau.fi/bridges/go/imessage/index.html) for running `matrix-imessage` on your iOS device.

45
group_vars/matrix_servers
View File

@ -607,6 +607,48 @@ matrix_mautrix_whatsapp_database_password: "{{ '%s' | format(matrix_homeserver_g
#
######################################################################
######################################################################
#
# matrix-bridge-mautrix-wsproxy
#
######################################################################
# We don't enable bridges by default.
matrix_mautrix_wsproxy_enabled: false
matrix_mautrix_wsproxy_systemd_required_services_list: |
{{
['docker.service']
+
(['matrix-synapse.service'] if matrix_synapse_enabled else [])
+
(['matrix-postgres.service'] if matrix_postgres_enabled else [])
}}
matrix_mautrix_wsproxy_homeserver_domain: '{{ matrix_domain }}'
matrix_mautrix_wsproxy_homeserver_address: "{{ 'http://matrix-synapse:8008' if matrix_synapse_enabled else '' }}"
matrix_mautrix_wsproxy_homeserver_token: "{{ matrix_synapse_macaroon_secret_key | password_hash('sha512', 'wsproxy.hs.token') | to_uuid }}"
matrix_mautrix_wsproxy_appservice_token: "{{ matrix_synapse_macaroon_secret_key | password_hash('sha512', 'wsproxy.as.token') | to_uuid }}"
matrix_mautrix_imessage_homeserver_token: "{{ matrix_synapse_macaroon_secret_key | password_hash('sha512', 'imessage.hs.token') | to_uuid }}"
matrix_mautrix_imessage_appservice_token: "{{ matrix_synapse_macaroon_secret_key | password_hash('sha512', 'imessage.as.token') | to_uuid }}"
matrix_mautrix_wsproxy_login_shared_secret: "{{ matrix_synapse_ext_password_provider_shared_secret_auth_shared_secret if matrix_synapse_ext_password_provider_shared_secret_auth_enabled else '' }}"
# Postgres is the default, except if not using `matrix_postgres` (internal postgres)
######################################################################
#
# /matrix-bridge-mautrix-wsproxy
#
######################################################################
######################################################################
#
# matrix-sms-bridge
@ -1390,6 +1432,7 @@ matrix_nginx_proxy_proxy_bot_go_neb_enabled: "{{ matrix_bot_go_neb_enabled }}"
matrix_nginx_proxy_proxy_jitsi_enabled: "{{ matrix_jitsi_enabled }}"
matrix_nginx_proxy_proxy_grafana_enabled: "{{ matrix_grafana_enabled }}"
matrix_nginx_proxy_proxy_sygnal_enabled: "{{ matrix_sygnal_enabled }}"
matrix_nginx_proxy_proxy_mautrix_wsproxy_enabled: "{{ matrix_mautrix_wsproxy_enabled }}"
matrix_nginx_proxy_proxy_matrix_corporal_api_enabled: "{{ matrix_corporal_enabled and matrix_corporal_http_api_enabled }}"
matrix_nginx_proxy_proxy_matrix_corporal_api_addr_with_container: "matrix-corporal:41081"
@ -1492,6 +1535,8 @@ matrix_ssl_domains_to_obtain_certificates_for: |
+
([matrix_server_fqn_sygnal] if matrix_sygnal_enabled else [])
+
([matrix_server_fqn_mautrix_wsproxy] if matrix_mautrix_wsproxy_enabled else [])
+
([matrix_domain] if matrix_nginx_proxy_base_domain_serving_enabled else [])
+
matrix_ssl_additional_domains_to_obtain_certificates_for

3
roles/matrix-base/defaults/main.yml
View File

@ -51,6 +51,9 @@ matrix_server_fqn_grafana: "stats.{{ matrix_domain }}"
# This is where you access the Sygnal push gateway.
matrix_server_fqn_sygnal: "sygnal.{{ matrix_domain }}"
# This is where you access the mautrix wsproxy push gateway.
matrix_server_fqn_mautrix_wsproxy: "mautrix-wsproxy.{{ matrix_domain }}"
matrix_federation_public_port: 8448
# The architecture that your server runs.

94
roles/matrix-bridge-mautrix-wsproxy/defaults/main.yml Normal file
View File

@ -0,0 +1,94 @@
# mautrix-wsproxy is a Matrix <-> websocket bridge
# See: https://github.com/tulir/mautrix-wsproxy
matrix_mautrix_wsproxy_enabled: true
matrix_mautrix_wsproxy_version: latest
# See: https://mau.dev/tulir/mautrix-wsproxy/container_registry
matrix_mautrix_wsproxy_docker_image: "dock.mau.dev/tulir/mautrix-wsproxy:{{ matrix_mautrix_wsproxy_version }}"
matrix_mautrix_wsproxy_docker_image_force_pull: "{{ matrix_mautrix_wsproxy_docker_image.endswith(':latest') }}"
matrix_mautrix_wsproxy_base_path: "{{ matrix_base_data_path }}/mautrix-wsproxy"
matrix_mautrix_wsproxy_config_path: "{{ matrix_mautrix_wsproxy_base_path }}/config"
matrix_mautrix_wsproxy_data_path: "{{ matrix_mautrix_wsproxy_base_path }}/data"
matrix_mautrix_wsproxy_homeserver_address: "{{ matrix_homeserver_container_url }}"
matrix_mautrix_wsproxy_homeserver_domain: "{{ matrix_domain }}"
matrix_mautrix_wsproxy_appservice_address: "http://matrix-mautrix-wsproxy:29331"
matrix_mautrix_wsproxy_appservice_websocket: "ws://matrix-mautrix-wsproxy:29331"
# A list of extra arguments to pass to the container
matrix_mautrix_wsproxy_container_extra_arguments: []
# List of systemd services that matrix-mautrix-wsproxy.service depends on.
matrix_mautrix_wsproxy_systemd_required_services_list: ['docker.service']
# List of systemd services that matrix-mautrix-wsproxy.service wants
matrix_mautrix_wsproxy_systemd_wanted_services_list: []
matrix_mautrix_wsproxy_appservice_token: ''
matrix_mautrix_wsproxy_homeserver_token: ''
matrix_mautrix_wsproxy_appservice_bot_username: imessagebot
# Default mautrix-wsproxy configuration template which covers the generic use case.
# You can customize it by controlling the various variables inside it.
#
# For a more advanced customization, you can extend the default (see `matrix_mautrix_wsproxy_configuration_extension_yaml`)
# or completely replace this variable with your own template.
matrix_mautrix_wsproxy_configuration_yaml: "{{ lookup('template', 'templates/config.yaml.j2') }}"
matrix_mautrix_wsproxy_configuration_extension_yaml: |
# Your custom YAML configuration goes here.
# This configuration extends the default starting configuration (`matrix_mautrix_wsproxy_configuration_yaml`).
#
# You can override individual variables from the default configuration, or introduce new ones.
#
# If you need something more special, you can take full control by
# completely redefining `matrix_mautrix_wsproxy_configuration_yaml`.
matrix_mautrix_wsproxy_configuration_extension: "{{ matrix_mautrix_wsproxy_configuration_extension_yaml|from_yaml if matrix_mautrix_wsproxy_configuration_extension_yaml|from_yaml is mapping else {} }}"
# Holds the final configuration (a combination of the default and its extension).
# You most likely don't need to touch this variable. Instead, see `matrix_mautrix_wsproxy_configuration_yaml`.
matrix_mautrix_wsproxy_configuration: "{{ matrix_mautrix_wsproxy_configuration_yaml|from_yaml|combine(matrix_mautrix_wsproxy_configuration_extension, recursive=True) }}"
# Default mautrix-wsproxy configuration template which covers the generic use case.
# You can customize it by controlling the various variables inside it.
#
# For a more advanced customization, you can extend the default (see `matrix_mautrix_wsproxy_configuration_extension_yaml`)
# or completely replace this variable with your own template.
matrix_mautrix_imessage_configuration_yaml: "{{ lookup('template', 'templates/config-ios.yaml.j2') }}"
matrix_mautrix_imessage_configuration_extension_yaml: |
# Your custom YAML configuration goes here.
# This configuration extends the default starting configuration (`matrix_mautrix_wsproxy_configuration_yaml`).
#
# You can override individual variables from the default configuration, or introduce new ones.
#
# If you need something more special, you can take full control by
# completely redefining `matrix_mautrix_imessage_configuration_yaml`.
matrix_mautrix_imessage_configuration_extension: "{{ matrix_mautrix_imessage_configuration_extension_yaml|from_yaml if matrix_mautrix_imessage_configuration_extension_yaml|from_yaml is mapping else {} }}"
# Holds the final configuration (a combination of the default and its extension).
# You most likely don't need to touch this variable. Instead, see `matrix_mautrix_imessage_configuration_yaml`.
matrix_mautrix_imessage_configuration: "{{ matrix_mautrix_imessage_configuration_yaml|from_yaml|combine(matrix_mautrix_imessage_configuration_extension, recursive=True) }}"
matrix_mautrix_imessage_user: ''
matrix_mautrix_wsproxy_registration_yaml: |
id: imessage
url: {{ matrix_mautrix_wsproxy_appservice_address }}
as_token: "{{ matrix_mautrix_wsproxy_appservice_token }}"
hs_token: "{{ matrix_mautrix_wsproxy_homeserver_token }}"
sender_localpart: _bot_{{ matrix_mautrix_wsproxy_appservice_bot_username }}
rate_limited: false
namespaces:
users:
- regex: '@imessage_.+:{{ matrix_mautrix_wsproxy_homeserver_domain|regex_escape }}$'
exclusive: true
- exclusive: true
regex: '^@{{ matrix_mautrix_wsproxy_appservice_bot_username|regex_escape }}:{{ matrix_mautrix_wsproxy_homeserver_domain|regex_escape }}$'
matrix_mautrix_wsproxy_registration: "{{ matrix_mautrix_wsproxy_registration_yaml|from_yaml }}"

16
roles/matrix-bridge-mautrix-wsproxy/tasks/init.yml Normal file
View File

@ -0,0 +1,16 @@
- set_fact:
matrix_systemd_services_list: "{{ matrix_systemd_services_list + ['matrix-mautrix-wsproxy.service'] }}"
when: matrix_mautrix_wsproxy_enabled|bool
# If the matrix-synapse role is not used, these variables may not exist.
- set_fact:
matrix_synapse_container_extra_arguments: >
{{ matrix_synapse_container_extra_arguments|default([]) }}
+
["--mount type=bind,src={{ matrix_mautrix_wsproxy_config_path }}/registration.yaml,dst=/matrix-mautrix-wsproxy-registration.yaml,ro"]
matrix_synapse_app_service_config_files: >
{{ matrix_synapse_app_service_config_files|default([]) }}
+
{{ ["/matrix-mautrix-wsproxy-registration.yaml"] }}
when: matrix_mautrix_wsproxy_enabled|bool

21
roles/matrix-bridge-mautrix-wsproxy/tasks/main.yml Normal file
View File

@ -0,0 +1,21 @@
- import_tasks: "{{ role_path }}/tasks/init.yml"
tags:
- always
- import_tasks: "{{ role_path }}/tasks/validate_config.yml"
when: "run_setup|bool and matrix_mautrix_wsproxy_enabled|bool"
tags:
- setup-all
- setup-mautrix-wsproxy
- import_tasks: "{{ role_path }}/tasks/setup_install.yml"
when: "run_setup and matrix_mautrix_wsproxy_enabled"
tags:
- setup-all
- setup-mautrix-wsproxy
- import_tasks: "{{ role_path }}/tasks/setup_uninstall.yml"
when: "run_setup and not matrix_mautrix_wsproxy_enabled"
tags:
- setup-all
- setup-mautrix-wsproxy

78
roles/matrix-bridge-mautrix-wsproxy/tasks/setup_install.yml Normal file
View File

@ -0,0 +1,78 @@
---
# If the matrix-synapse role is not used, `matrix_synapse_role_executed` won't exist.
# We don't want to fail in such cases.
- name: Fail if matrix-synapse role already executed
fail:
msg: >-
The matrix-bridge-mautrix-wsproxy role needs to execute before the matrix-synapse role.
when: "matrix_synapse_role_executed|default(False)"
- set_fact:
matrix_mautrix_wsproxy_requires_restart: false
- name: Ensure Mautrix wsproxy image is pulled
docker_image:
name: "{{ matrix_mautrix_wsproxy_docker_image }}"
source: "{{ 'pull' if ansible_version.major > 2 or ansible_version.minor > 7 else omit }}"
force_source: "{{ matrix_mautrix_wsproxy_docker_image_force_pull if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}"
force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else matrix_mautrix_wsproxy_docker_image_force_pull }}"
- name: Ensure Mautrix wsproxy paths exists
file:
path: "{{ item }}"
state: directory
mode: 0750
owner: "{{ matrix_user_username }}"
group: "{{ matrix_user_groupname }}"
with_items:
- "{{ matrix_mautrix_wsproxy_base_path }}"
- "{{ matrix_mautrix_wsproxy_config_path }}"
- "{{ matrix_mautrix_wsproxy_data_path }}"
- name: Check if an old matrix state file exists
stat:
path: "{{ matrix_mautrix_wsproxy_base_path }}/mx-state.json"
register: matrix_mautrix_wsproxy_stat_mx_state
- name: Ensure mautrix-wsproxy config.yaml installed
copy:
content: "{{ matrix_mautrix_wsproxy_configuration|to_nice_yaml }}"
dest: "{{ matrix_mautrix_wsproxy_config_path }}/config.yaml"
mode: 0644
owner: "{{ matrix_user_username }}"
group: "{{ matrix_user_groupname }}"
- name: Ensure mautrix-imessage config-ios.yaml installed
copy:
content: "{{ matrix_mautrix_imessage_configuration|to_nice_yaml }}"
dest: "{{ matrix_mautrix_wsproxy_config_path }}/config-ios.yaml"
mode: 0644
owner: "{{ matrix_user_username }}"
group: "{{ matrix_user_groupname }}"
- name: Ensure mautrix-wsproxy registration.yaml installed
copy:
content: "{{ matrix_mautrix_wsproxy_registration|to_nice_yaml }}"
dest: "{{ matrix_mautrix_wsproxy_config_path }}/registration.yaml"
mode: 0644
owner: "{{ matrix_user_username }}"
group: "{{ matrix_user_groupname }}"
- name: Ensure matrix-mautrix-wsproxy.service installed
template:
src: "{{ role_path }}/templates/systemd/matrix-mautrix-wsproxy.service.j2"
dest: "{{ matrix_systemd_path }}/matrix-mautrix-wsproxy.service"
mode: 0644
register: matrix_mautrix_wsproxy_systemd_service_result
- name: Ensure systemd reloaded after matrix-mautrix-wsproxy.service installation
service:
daemon_reload: yes
when: "matrix_mautrix_wsproxy_systemd_service_result.changed"
- name: Ensure matrix-mautrix-wsproxy.service restarted, if necessary
service:
name: "matrix-mautrix-wsproxy.service"
state: restarted
when: "matrix_mautrix_wsproxy_requires_restart|bool"

24
roles/matrix-bridge-mautrix-wsproxy/tasks/setup_uninstall.yml Normal file
View File

@ -0,0 +1,24 @@
---
- name: Check existence of matrix-mautrix-wsproxy service
stat:
path: "{{ matrix_systemd_path }}/matrix-mautrix-wsproxy.service"
register: matrix_mautrix_wsproxy_service_stat
- name: Ensure matrix-mautrix-wsproxy is stopped
service:
name: matrix-mautrix-wsproxy
state: stopped
daemon_reload: yes
when: "matrix_mautrix_wsproxy_service_stat.stat.exists"
- name: Ensure matrix-mautrix-wsproxy.service doesn't exist
file:
path: "{{ matrix_systemd_path }}/matrix-mautrix-wsproxy.service"
state: absent
when: "matrix_mautrix_wsproxy_service_stat.stat.exists"
- name: Ensure systemd reloaded after matrix-mautrix-wsproxy.service removal
service:
daemon_reload: yes
when: "matrix_mautrix_wsproxy_service_stat.stat.exists"

11
roles/matrix-bridge-mautrix-wsproxy/tasks/validate_config.yml Normal file
View File

@ -0,0 +1,11 @@
---
- name: Fail if required settings not defined
fail:
msg: >-
You need to define a required configuration setting (`{{ item }}`).
when: "vars[item] == ''"
with_items:
- "matrix_mautrix_wsproxy_appservice_token"
- "matrix_mautrix_wsproxy_homeserver_token"

107
roles/matrix-bridge-mautrix-wsproxy/templates/config-ios.yaml.j2 Normal file
View File

@ -0,0 +1,107 @@
#jinja2: lstrip_blocks: "True"
# Homeserver details.
homeserver:
# The address that this appservice can use to connect to the homeserver.
address: {{ matrix_mautrix_wsproxy_homeserver_address }}
websocket_proxy: {{ matrix_mautrix_wsproxy_appservice_websocket }}
# The domain of the homeserver (for MXIDs, etc).
domain: {{ matrix_mautrix_wsproxy_homeserver_domain }}
# Application service host/registration related details.
# Changing these values requires regeneration of the registration.
appservice:
# SQLite database path
database: mautrix-imessage.db
# The unique ID of this appservice.
id: imessage
# Appservice bot details.
bot:
# Username of the appservice bot.
username: imessagebot
# Display name and avatar for bot. Set to "remove" to remove display name/avatar, leave empty
# to leave display name/avatar as-is.
displayname: iMessage bridge bot
avatar: mxc://maunium.net/tManJEpANASZvDVzvRvhILdX
# Authentication tokens for AS <-> HS communication. Autogenerated; do not modify.
as_token: "{{ matrix_mautrix_wsproxy_appservice_token }}"
hs_token: "{{ matrix_mautrix_wsproxy_homeserver_token }}"
imessage:
platform: ios
# Bridge config
bridge:
# The user of the bridge.
user: "{{ matrix_mautrix_imessage_user }}"
# Localpart template of MXIDs for iMessage users.
# {{ '{{.}}' }} is replaced with the phone number or email of the iMessage user.
username_template: "{{ 'imessage_{{.}}' }}"
# Displayname template for iMessage users.
# {{ '{{.}}' }} is replaced with the contact list name (if available) or username (phone number or email) of the iMessage user.
displayname_template: "{{ '{{.}} (iMessage)' }}"
# Whether or not the bridge should send a read receipt from the bridge bot when a message has been
# sent to iMessage. If fetch_message_on_timeout is enabled, a successful post-timeout fetch will
# trigger a read receipt too.
delivery_receipts: false
# Whether or not to update the m.direct account data event when double puppeting is enabled.
# Note that updating the m.direct event is not atomic (except with mautrix-asmux)
# and is therefore prone to race conditions.
sync_direct_chat_list: false
# Shared secret for https://github.com/devture/matrix-synapse-shared-secret-auth
#
# If set, custom puppets will be enabled automatically for local users
# instead of users having to find an access token and run `login-matrix`
# manually.
login_shared_secret: {{ matrix_mautrix_whatsapp_login_shared_secret|to_json }}
# Maximum age of chats to sync in days.
chat_sync_max_age: 0.5
# Maximum number of messages to backfill for new portal rooms.
initial_backfill_limit: 100
# The prefix for commands. Only required in non-management rooms.
command_prefix: "!im"
# End-to-bridge encryption support options. This requires login_shared_secret to be configured
# in order to get a device for the bridge bot.
#
# Additionally, https://github.com/matrix-org/synapse/pull/5758 is required if using a normal
# application service.
encryption:
# Allow encryption, work in group chat rooms with e2ee enabled
allow: false
# Default to encryption, force-enable encryption in all portals the bridge creates
# This will cause the bridge bot to be in private chats for the encryption to work properly.
# It is recommended to also set private_chat_portal_meta to true when using this.
default: false
# Options for automatic key sharing.
key_sharing:
# Enable key sharing? If enabled, key requests for rooms where users are in will be fulfilled.
# You must use a client that supports requesting keys from other users to use this feature.
allow: false
# Require the requesting device to have a valid cross-signing signature?
# This doesn't require that the bridge has verified the device, only that the user has verified it.
# Not yet implemented.
require_cross_signing: false
# Require devices to be verified by the bridge?
# Verification by the bridge is not yet implemented.
require_verification: true
# Logging config.
logging:
# The directory for log files. Will be created if not found.
directory: ./logs
# Available variables: .Date for the file date and .Index for different log files on the same day.
file_name_format: "{{ '{{.Date}}-{{.Index}}.log' }}"
# Date format for file names in the Go time format: https://golang.org/pkg/time/#pkg-constants
file_date_format: "2006-01-02"
# Log file permissions.
file_mode: 0600
# Timestamp format for log entries in the Go time format.
timestamp_format: "Jan _2, 2006 15:04:05"
# Minimum severity for log messages.
# Options: debug, info, warn, error, fatal
print_level: debug

5
roles/matrix-bridge-mautrix-wsproxy/templates/config.yaml.j2 Normal file
View File

@ -0,0 +1,5 @@
listen_address: 0.0.0.0:29331
appservices:
- id: imessage
as: "{{ matrix_mautrix_wsproxy_appservice_token }}"
hs: "{{ matrix_mautrix_wsproxy_homeserver_token }}"

43
roles/matrix-bridge-mautrix-wsproxy/templates/systemd/matrix-mautrix-wsproxy.service.j2 Normal file
View File

@ -0,0 +1,43 @@
#jinja2: lstrip_blocks: "True"
[Unit]
Description=Matrix Mautrix wsproxy bridge
{% for service in matrix_mautrix_wsproxy_systemd_required_services_list %}
Requires={{ service }}
After={{ service }}
{% endfor %}
{% for service in matrix_mautrix_wsproxy_systemd_wanted_services_list %}
Wants={{ service }}
{% endfor %}
DefaultDependencies=no
[Service]
Type=simple
Environment="HOME={{ matrix_systemd_unit_home_path }}"
ExecStartPre=-{{ matrix_host_command_sh }} -c '{{ matrix_host_command_docker }} kill matrix-mautrix-wsproxy 2>/dev/null'
ExecStartPre=-{{ matrix_host_command_sh }} -c '{{ matrix_host_command_docker }} rm matrix-mautrix-wsproxy 2>/dev/null'
# Intentional delay, so that the homeserver (we likely depend on) can manage to start.
ExecStartPre={{ matrix_host_command_sleep }} 5
ExecStart={{ matrix_host_command_docker }} run --rm --name matrix-mautrix-wsproxy \
--log-driver=none \
--user={{ matrix_user_uid }}:{{ matrix_user_gid }} \
--cap-drop=ALL \
--network={{ matrix_docker_network }} \
-v {{ matrix_mautrix_wsproxy_config_path }}:/config:z \
-v {{ matrix_mautrix_wsproxy_data_path }}:/data:z \
-p 29331:29331 \
{% for arg in matrix_mautrix_wsproxy_container_extra_arguments %}
{{ arg }} \
{% endfor %}
{{ matrix_mautrix_wsproxy_docker_image }} \
/usr/bin/mautrix-wsproxy -config /config/config.yaml
ExecStop=-{{ matrix_host_command_sh }} -c '{{ matrix_host_command_docker }} kill matrix-mautrix-wsproxy 2>/dev/null'
ExecStop=-{{ matrix_host_command_sh }} -c '{{ matrix_host_command_docker }} rm matrix-mautrix-wsproxy 2>/dev/null'
Restart=always
RestartSec=30
SyslogIdentifier=matrix-mautrix-wsproxy
[Install]
WantedBy=multi-user.target

7
roles/matrix-nginx-proxy/defaults/main.yml
View File

@ -178,6 +178,10 @@ matrix_nginx_proxy_proxy_grafana_hostname: "{{ matrix_server_fqn_grafana }}"
matrix_nginx_proxy_proxy_sygnal_enabled: false
matrix_nginx_proxy_proxy_sygnal_hostname: "{{ matrix_server_fqn_sygnal }}"
# Controls whether proxying the mautrix wsproxy should be done.
matrix_nginx_proxy_proxy_mautrix_wsproxy_enabled: false
matrix_nginx_proxy_proxy_mautrix_wsproxy_hostname: "{{ matrix_server_fqn_mautrix_wsproxy }}"
# Controls whether proxying for the matrix-corporal API (`/_matrix/corporal`) should be done (on the matrix domain)
matrix_nginx_proxy_proxy_matrix_corporal_api_enabled: false
matrix_nginx_proxy_proxy_matrix_corporal_api_addr_with_container: "matrix-corporal:41081"
@ -308,6 +312,9 @@ matrix_nginx_proxy_proxy_grafana_additional_server_configuration_blocks: []
# A list of strings containing additional configuration blocks to add to Sygnal's server configuration (matrix-sygnal.conf).
matrix_nginx_proxy_proxy_sygnal_additional_server_configuration_blocks: []
# A list of strings containing additional configuration blocks to add to mautrix wsproxy server configuration (matrix-mautrix-wsproxy.conf).
matrix_nginx_proxy_proxy_mautrix_wsproxy_additional_server_configuration_blocks: []
# A list of strings containing additional configuration blocks to add to the base domain server configuration (matrix-base-domain.conf).
matrix_nginx_proxy_proxy_domain_additional_server_configuration_blocks: []

13
roles/matrix-nginx-proxy/tasks/setup_nginx_proxy.yml
View File

@ -143,6 +143,13 @@
mode: 0644
when: matrix_nginx_proxy_proxy_sygnal_enabled|bool
- name: Ensure Matrix nginx-proxy configuration for mautrix wsproxy exists
template:
src: "{{ role_path }}/templates/nginx/conf.d/matrix-mautrix-wsproxy.conf.j2"
dest: "{{ matrix_nginx_proxy_confd_path }}/matrix-mautrix-wsproxy.conf"
mode: 0644
when: matrix_nginx_proxy_proxy_mautrix_wsproxy_enabled|bool
- name: Ensure Matrix nginx-proxy configuration for Matrix domain exists
template:
src: "{{ role_path }}/templates/nginx/conf.d/matrix-domain.conf.j2"
@ -283,6 +290,12 @@
state: absent
when: "not matrix_nginx_proxy_proxy_sygnal_enabled|bool"
- name: Ensure Matrix nginx-proxy configuration for mautrix wsproxy deleted
file:
path: "{{ matrix_nginx_proxy_confd_path }}/matrix-mautrix-wsproxy.conf"
state: absent
when: "not matrix_nginx_proxy_proxy_mautrix_wsproxy_enabled|bool"
- name: Ensure Matrix nginx-proxy homepage for base domain deleted
file:
path: "{{ matrix_nginx_proxy_data_path }}/matrix-domain/index.html"

110
roles/matrix-nginx-proxy/templates/nginx/conf.d/matrix-mautrix-wsproxy.conf.j2 Normal file
View File

@ -0,0 +1,110 @@
#jinja2: lstrip_blocks: "True"
{% macro render_vhost_directives() %}
gzip on;
gzip_types text/plain application/json application/javascript text/css image/x-icon font/ttf image/gif;
{% if matrix_nginx_proxy_hsts_preload_enabled %}
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
{% else %}
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
{% endif %}
add_header X-Content-Type-Options nosniff;
add_header X-XSS-Protection "{{ matrix_nginx_proxy_xss_protection }}";
add_header X-Frame-Options SAMEORIGIN;
{% if matrix_nginx_proxy_floc_optout_enabled %}
add_header Permissions-Policy interest-cohort=() always;
{% endif %}
{% for configuration_block in matrix_nginx_proxy_proxy_mautrix_wsproxy_additional_server_configuration_blocks %}
{{- configuration_block }}
{% endfor %}
location / {
{% if matrix_nginx_proxy_enabled %}
{# Use the embedded DNS resolver in Docker containers to discover the service #}
resolver 127.0.0.11 valid=5s;
set $backend "matrix-mautrix-wsproxy:29331";
proxy_pass http://$backend;
{% else %}
{# Generic configuration for use outside of our container setup #}
proxy_pass http://127.0.0.1:29331;
{% endif %}
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $remote_addr;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_http_version 1.1;
proxy_send_timeout 1d;
proxy_read_timeout 1d;
tcp_nodelay on;
}
{% endmacro %}
server {
listen {{ 8080 if matrix_nginx_proxy_enabled else 80 }};
server_name {{ matrix_nginx_proxy_proxy_mautrix_wsproxy_hostname }};
server_tokens off;
root /dev/null;
{% if matrix_nginx_proxy_https_enabled %}
location /.well-known/acme-challenge {
{% if matrix_nginx_proxy_enabled %}
{# Use the embedded DNS resolver in Docker containers to discover the service #}
resolver 127.0.0.11 valid=5s;
set $backend "matrix-certbot:8080";
proxy_pass http://$backend;
{% else %}
{# Generic configuration for use outside of our container setup #}
proxy_pass http://127.0.0.1:{{ matrix_ssl_lets_encrypt_certbot_standalone_http_port }};
{% endif %}
}
location / {
return 301 https://$http_host$request_uri;
}
{% else %}
{{ render_vhost_directives() }}
{% endif %}
}
{% if matrix_nginx_proxy_https_enabled %}
server {
listen {{ 8443 if matrix_nginx_proxy_enabled else 443 }} ssl http2;
listen [::]:{{ 8443 if matrix_nginx_proxy_enabled else 443 }} ssl http2;
server_name {{ matrix_nginx_proxy_proxy_mautrix_wsproxy_hostname }};
server_tokens off;
root /dev/null;
ssl_certificate {{ matrix_ssl_config_dir_path }}/live/{{ matrix_nginx_proxy_proxy_mautrix_wsproxy_hostname }}/fullchain.pem;
ssl_certificate_key {{ matrix_ssl_config_dir_path }}/live/{{ matrix_nginx_proxy_proxy_mautrix_wsproxy_hostname }}/privkey.pem;
ssl_protocols {{ matrix_nginx_proxy_ssl_protocols }};
{% if matrix_nginx_proxy_ssl_ciphers != "" %}
ssl_ciphers {{ matrix_nginx_proxy_ssl_ciphers }};
{% endif %}
ssl_prefer_server_ciphers {{ matrix_nginx_proxy_ssl_prefer_server_ciphers }};
{% if matrix_nginx_proxy_ocsp_stapling_enabled %}
ssl_stapling on;
ssl_stapling_verify on;
ssl_trusted_certificate {{ matrix_ssl_config_dir_path }}/live/{{ matrix_nginx_proxy_proxy_mautrix_wsproxy_hostname }}/chain.pem;
{% endif %}
{% if matrix_nginx_proxy_ssl_session_tickets_off %}
ssl_session_tickets off;
{% endif %}
ssl_session_cache {{ matrix_nginx_proxy_ssl_session_cache }};
ssl_session_timeout {{ matrix_nginx_proxy_ssl_session_timeout }};
{{ render_vhost_directives() }}
}
{% endif %}

1
setup.yml
View File

@ -27,6 +27,7 @@
- matrix-bridge-mautrix-signal
- matrix-bridge-mautrix-telegram
- matrix-bridge-mautrix-whatsapp
- matrix-bridge-mautrix-wsproxy
- matrix-bridge-mx-puppet-discord
- matrix-bridge-mx-puppet-groupme
- matrix-bridge-mx-puppet-steam