2019-01-12 16:53:00 +01:00
matrix_nginx_proxy_enabled : true
2019-01-27 19:25:13 +01:00
# We use an official nginx image, which we fix-up to run unprivileged.
# An alternative would be an `nginxinc/nginx-unprivileged` image, but
2019-06-10 13:23:51 +02:00
# that is frequently out of date.
2019-09-25 13:00:44 +02:00
matrix_nginx_proxy_docker_image : "nginx:1.17.4-alpine"
2019-06-10 13:23:51 +02:00
matrix_nginx_proxy_docker_image_force_pull : "{{ matrix_nginx_proxy_docker_image.endswith(':latest') }}"
2019-01-12 16:53:00 +01:00
2019-03-12 21:15:22 +01:00
matrix_nginx_proxy_base_path : "{{ matrix_base_data_path }}/nginx-proxy"
matrix_nginx_proxy_data_path : "{{ matrix_nginx_proxy_base_path }}/data"
matrix_nginx_proxy_confd_path : "{{ matrix_nginx_proxy_base_path }}/conf.d"
2019-01-12 16:53:00 +01:00
2019-01-16 17:05:48 +01:00
# List of systemd services that matrix-nginx-proxy.service depends on
matrix_nginx_proxy_systemd_required_services_list : [ 'docker.service' ]
# List of systemd services that matrix-nginx-proxy.service wants
matrix_nginx_proxy_systemd_wanted_services_list : [ ]
2019-02-05 10:46:16 +01:00
# A list of additional "volumes" to mount in the container.
# This list gets populated dynamically at runtime. You can provide a different default value,
# if you wish to mount your own files into the container.
# Contains definition objects like this: `{"src": "/outside", "dst": "/inside", "options": "rw|ro|slave|.."}
matrix_nginx_proxy_container_additional_volumes : [ ]
2019-04-30 16:35:18 +02:00
# A list of extra arguments to pass to the container
matrix_nginx_proxy_container_extra_arguments : [ ]
2019-10-03 10:23:45 +02:00
2019-03-12 21:27:18 +01:00
# Controls whether matrix-nginx-proxy should serve the base domain.
#
# This is useful for when you only have your Matrix server, but you need to serve
# to serve `/.well-known/matrix/*` files from the base domain for the needs of
# Server-Discovery (Federation) and for Client-Discovery.
#
# Besides serving these Matrix files, a homepage would be served with content
# as specified in the `matrix_nginx_proxy_base_domain_homepage_template` variable.
# You can also put additional files to use for this webpage
# in the `{{ matrix_nginx_proxy_data_path }}/matrix-domain` (`/matrix/nginx-proxy/data/matrix-domain`) directory.
matrix_nginx_proxy_base_domain_serving_enabled : false
2019-10-03 10:23:45 +02:00
2019-03-12 21:27:18 +01:00
matrix_nginx_proxy_base_domain_hostname : "{{ matrix_domain }}"
2019-10-03 10:23:45 +02:00
# Controls whether `matrix_nginx_proxy_base_domain_homepage_template` would be dumped to an `index.html` file
# in the `/matrix/nginx-proxy/data/matrix-domain` directory.
#
# If you would instead like to serve a static website by yourself, you can disable this.
# When disabled, you're expected to put website files in `/matrix/nginx-proxy/data/matrix-domain` manually
# and can expect that the playbook won't intefere with the `index.html` file.
matrix_nginx_proxy_base_domain_homepage_enabled : true
2019-03-12 21:27:18 +01:00
matrix_nginx_proxy_base_domain_homepage_template : |-
<!doctype html>
<meta charset="utf-8" />
<html>
<body>
Hello from {{ matrix_domain }}!
</body>
</html>
2019-10-03 10:23:45 +02:00
2019-01-16 17:05:48 +01:00
# Controls whether proxying the riot domain should be done.
matrix_nginx_proxy_proxy_riot_enabled : false
2019-02-28 10:51:09 +01:00
matrix_nginx_proxy_proxy_riot_hostname : "{{ matrix_server_fqn_riot }}"
2019-01-16 17:05:48 +01:00
# Controls whether proxying the matrix domain should be done.
matrix_nginx_proxy_proxy_matrix_enabled : false
2019-02-28 10:51:09 +01:00
matrix_nginx_proxy_proxy_matrix_hostname : "{{ matrix_server_fqn_matrix }}"
2019-01-16 17:05:48 +01:00
2019-03-07 06:22:08 +01:00
# Controls whether proxying the dimension domain should be done.
matrix_nginx_proxy_proxy_dimension_enabled : false
matrix_nginx_proxy_proxy_dimension_hostname : "{{ matrix_server_fqn_dimension }}"
2019-01-17 12:32:46 +01:00
# Controls whether proxying for the matrix-corporal API (`/_matrix/corporal`) should be done (on the matrix domain)
matrix_nginx_proxy_proxy_matrix_corporal_api_enabled : false
matrix_nginx_proxy_proxy_matrix_corporal_api_addr_with_container : "matrix-corporal:41081"
2019-02-04 16:49:45 +01:00
matrix_nginx_proxy_proxy_matrix_corporal_api_addr_sans_container : "127.0.0.1:41081"
2019-01-17 12:32:46 +01:00
2019-01-17 14:55:23 +01:00
# Controls whether proxying for the User Directory Search API (`/_matrix/client/r0/user_directory/search`) should be done (on the matrix domain).
# This can be used to forward the API endpoint to another service, augmenting the functionality of Synapse's own User Directory Search.
# To learn more, see: https://github.com/kamax-matrix/mxisd/blob/master/docs/features/directory.md
matrix_nginx_proxy_proxy_matrix_user_directory_search_enabled : false
matrix_nginx_proxy_proxy_matrix_user_directory_search_addr_with_container : "matrix-mxisd:8090"
2019-02-04 16:49:45 +01:00
matrix_nginx_proxy_proxy_matrix_user_directory_search_addr_sans_container : "127.0.0.1:8090"
2019-01-17 14:55:23 +01:00
2019-05-08 20:49:51 +02:00
# Controls whether proxying for 3PID-based registration (`/_matrix/client/r0/register/(email|msisdn)/requestToken`) should be done (on the matrix domain).
# This allows another service to control registrations involving 3PIDs.
# To learn more, see: https://github.com/kamax-matrix/mxisd/blob/master/docs/features/registration.md
matrix_nginx_proxy_proxy_matrix_3pid_registration_enabled : false
matrix_nginx_proxy_proxy_matrix_3pid_registration_addr_with_container : "matrix-mxisd:8090"
matrix_nginx_proxy_proxy_matrix_3pid_registration_addr_sans_container : "127.0.0.1:8090"
2019-01-17 12:32:46 +01:00
# Controls whether proxying for the Identity API (`/_matrix/identity`) should be done (on the matrix domain)
matrix_nginx_proxy_proxy_matrix_identity_api_enabled : false
matrix_nginx_proxy_proxy_matrix_identity_api_addr_with_container : "matrix-mxisd:8090"
2019-02-04 16:49:45 +01:00
matrix_nginx_proxy_proxy_matrix_identity_api_addr_sans_container : "127.0.0.1:8090"
2019-01-17 12:32:46 +01:00
2019-01-30 19:31:50 +01:00
# Controls whether proxying for metrics (`/_synapse/metrics`) should be done (on the matrix domain)
matrix_nginx_proxy_proxy_synapse_metrics : false
matrix_nginx_proxy_proxy_synapse_metrics_basic_auth_enabled : false
matrix_nginx_proxy_proxy_synapse_metrics_basic_auth_key : ""
2019-01-12 16:53:00 +01:00
# The addresses where the Matrix Client API is.
# Certain extensions (like matrix-corporal) may override this in order to capture all traffic.
2019-01-17 12:32:46 +01:00
matrix_nginx_proxy_proxy_matrix_client_api_addr_with_container : "matrix-synapse:8008"
2019-02-04 16:49:45 +01:00
matrix_nginx_proxy_proxy_matrix_client_api_addr_sans_container : "127.0.0.1:8008"
2019-01-17 12:32:46 +01:00
# This needs to be equal or higher than the maximum upload size accepted by Synapse.
2019-01-29 17:52:02 +01:00
matrix_nginx_proxy_proxy_matrix_client_api_client_max_body_size_mb : 25
2019-02-05 10:07:08 +01:00
# Controls whether proxying for the Matrix Federation API should be done.
matrix_nginx_proxy_proxy_matrix_federation_api_enabled : false
matrix_nginx_proxy_proxy_matrix_federation_api_addr_with_container : "matrix-synapse:8048"
matrix_nginx_proxy_proxy_matrix_federation_api_addr_sans_container : "localhost:8048"
2019-04-30 17:25:57 +02:00
matrix_nginx_proxy_proxy_matrix_federation_api_client_max_body_size_mb : "{{ (matrix_nginx_proxy_proxy_matrix_client_api_client_max_body_size_mb | int) * 3 }}"
2019-02-05 10:49:59 +01:00
matrix_nginx_proxy_proxy_matrix_federation_api_ssl_certificate : "{{ matrix_ssl_config_dir_path }}/live/{{ matrix_nginx_proxy_proxy_matrix_hostname }}/fullchain.pem"
matrix_nginx_proxy_proxy_matrix_federation_api_ssl_certificate_key : "{{ matrix_ssl_config_dir_path }}/live/{{ matrix_nginx_proxy_proxy_matrix_hostname }}/privkey.pem"
2019-02-05 10:07:08 +01:00
2019-01-29 17:52:02 +01:00
# The tmpfs at /tmp needs to be large enough to handle multiple concurrent file uploads.
2019-04-27 21:54:21 +02:00
matrix_nginx_proxy_tmp_directory_size_mb : "{{ (matrix_nginx_proxy_proxy_matrix_federation_api_client_max_body_size_mb | int) * 50 }}"
2019-01-17 12:32:46 +01:00
# A list of strings containing additional configuration blocks to add to the matrix domain's server configuration.
matrix_nginx_proxy_proxy_matrix_additional_server_configuration_blocks : [ ]
2019-01-12 16:53:00 +01:00
# Specifies when to reload the matrix-nginx-proxy service so that
# a new SSL certificate could go into effect.
matrix_nginx_proxy_reload_cron_time_definition : "20 4 */5 * *"
# Specifies which SSL protocols to use when serving Riot and Synapse
2019-02-01 10:47:43 +01:00
matrix_nginx_proxy_ssl_protocols : "TLSv1.1 TLSv1.2 TLSv1.3"
2019-01-12 16:53:00 +01:00
2019-03-22 08:39:17 +01:00
# Controls whether the self-check feature should validate SSL certificates.
matrix_nginx_proxy_self_check_validate_certificates : true
2019-01-12 16:53:00 +01:00
# By default, this playbook automatically retrieves and auto-renews
# free SSL certificates from Let's Encrypt.
#
# The following retrieval methods are supported:
# - "lets-encrypt" - the playbook obtains free SSL certificates from Let's Encrypt
# - "self-signed" - the playbook generates and self-signs certificates
# - "manually-managed" - lets you manage certificates by yourself (manually; see below)
2019-02-01 15:50:02 +01:00
# - "none" - like "manually-managed", but doesn't care if you don't drop certificates in the location it expects
2019-01-12 16:53:00 +01:00
#
# If you decide to manage certificates by yourself (`matrix_ssl_retrieval_method: manually-managed`),
# you'd need to drop them into the directory specified by `matrix_ssl_config_dir_path`
# obeying the following hierarchy:
# - <matrix_ssl_config_dir_path>/live/<domain>/fullchain.pem
# - <matrix_ssl_config_dir_path>/live/<domain>/privkey.pem
2019-02-28 10:51:09 +01:00
# where <domain> refers to the domains that you need (usually `matrix_server_fqn_matrix` and `matrix_server_fqn_riot`).
2019-02-01 15:50:02 +01:00
#
# The "none" type (`matrix_ssl_retrieval_method: none`), simply means that no certificate retrieval will happen.
# It's useful for when you've disabled the nginx proxy (`matrix_nginx_proxy_enabled: false`)
# and you'll be using another reverse-proxy server (like Apache) with your own certificates, managed by yourself.
2019-01-12 16:53:00 +01:00
matrix_ssl_retrieval_method : "lets-encrypt"
2019-01-16 17:05:48 +01:00
# The list of domains that this role will obtain certificates for.
matrix_ssl_domains_to_obtain_certificates_for : [ ]
2019-01-12 16:53:00 +01:00
# Controls whether to obtain production or staging certificates from Let's Encrypt.
matrix_ssl_lets_encrypt_staging : false
2019-09-25 13:17:12 +02:00
matrix_ssl_lets_encrypt_certbot_docker_image : "certbot/certbot:v0.38.0"
2019-06-10 13:23:51 +02:00
matrix_ssl_lets_encrypt_certbot_docker_image_force_pull : "{{ matrix_ssl_lets_encrypt_certbot_docker_image.endswith(':latest') }}"
2019-01-12 16:53:00 +01:00
matrix_ssl_lets_encrypt_certbot_standalone_http_port : 2402
2019-02-28 10:51:09 +01:00
matrix_ssl_lets_encrypt_support_email : ~
2019-01-12 16:53:00 +01:00
matrix_ssl_base_path : "{{ matrix_base_data_path }}/ssl"
matrix_ssl_config_dir_path : "{{ matrix_ssl_base_path }}/config"
2019-01-29 17:52:02 +01:00
matrix_ssl_log_dir_path : "{{ matrix_ssl_base_path }}/log"
2019-04-23 09:44:02 +02:00
# ngnix status page configurations.
2019-08-07 10:56:29 +02:00
matrix_nginx_proxy_proxy_matrix_nginx_status_enabled : false
matrix_nginx_proxy_proxy_matrix_nginx_status_allowed_addresses : [ '{{ ansible_default_ipv4.address }}' ]
