From 3d9aa8387e4adc37bbbb997155dfe3a9042241fc Mon Sep 17 00:00:00 2001 From: Slavi Pantaleev Date: Mon, 13 Feb 2023 15:08:42 +0200 Subject: [PATCH] Add (native) Traefik support to synapse-admin Previously, it had to go through matrix-nginx-proxy. It's exposed to Traefik directly via container labels now. --- group_vars/matrix_servers | 11 +++-- .../matrix-synapse-admin/defaults/main.yml | 42 ++++++++++++++++++- .../matrix-synapse-admin/tasks/main.yml | 2 +- .../tasks/setup_install.yml | 22 +++++++++- .../tasks/setup_uninstall.yml | 5 +++ .../tasks/validate_config.yml | 21 ++++++++++ .../matrix-synapse-admin/templates/labels.j2 | 25 +++++++++++ .../systemd/matrix-synapse-admin.service.j2 | 14 ++++++- 8 files changed, 133 insertions(+), 9 deletions(-) create mode 100644 roles/custom/matrix-synapse-admin/templates/labels.j2 diff --git a/group_vars/matrix_servers b/group_vars/matrix_servers index f5fab4e65..3abc1d438 100755 --- a/group_vars/matrix_servers +++ b/group_vars/matrix_servers @@ -3159,13 +3159,18 @@ matrix_synapse_reverse_proxy_companion_access_log_syslog_integration_server_port matrix_synapse_admin_enabled: false -# Normally, matrix-nginx-proxy is enabled and nginx can reach Synapse Admin over the container network. -# If matrix-nginx-proxy is not enabled, or you otherwise have a need for it, you can expose -# Synapse Admin's HTTP port to the local host. +matrix_synapse_admin_nginx_proxy_integration_enabled: "{{ matrix_playbook_reverse_proxy_type in ['playbook-managed-nginx', 'other-nginx-non-container'] }}" + matrix_synapse_admin_container_http_host_bind_port: "{{ (matrix_playbook_service_host_bind_interface_prefix ~ ':8766') if matrix_playbook_service_host_bind_interface_prefix else '' }}" matrix_synapse_admin_container_image_self_build: "{{ matrix_architecture not in ['arm64', 'amd64'] }}" +matrix_synapse_admin_container_additional_networks: "{{ [matrix_playbook_reverse_proxyable_services_additional_network] if matrix_playbook_reverse_proxyable_services_additional_network else [] }}" + +matrix_synapse_admin_container_labels_traefik_enabled: "{{ matrix_playbook_reverse_proxy_type in ['playbook-managed-traefik', 'other-traefik-container'] }}" +matrix_synapse_admin_container_labels_traefik_docker_network: "{{ matrix_playbook_reverse_proxyable_services_additional_network }}" +matrix_synapse_admin_container_labels_traefik_entrypoints: "{{ devture_traefik_entrypoint_primary if devture_traefik_enabled else '' }}" + ###################################################################### # # /matrix-synapse-admin diff --git a/roles/custom/matrix-synapse-admin/defaults/main.yml b/roles/custom/matrix-synapse-admin/defaults/main.yml index 0f5c7af6e..b95632a72 100644 --- a/roles/custom/matrix-synapse-admin/defaults/main.yml +++ b/roles/custom/matrix-synapse-admin/defaults/main.yml @@ -4,19 +4,57 @@ matrix_synapse_admin_enabled: true +# A path on host where all related files will be saved +matrix_synapse_admin_base_path: "{{ matrix_base_data_path }}/synapse-admin" +matrix_synapse_admin_docker_src_files_path: "{{ matrix_synapse_admin_base_path }}/docker-src" + +# Specifies whether this role will integrate with the matrix-nginx-proxy role +matrix_synapse_admin_nginx_proxy_integration_enabled: false + matrix_synapse_admin_container_image_self_build: false matrix_synapse_admin_container_image_self_build_repo: "https://github.com/Awesome-Technologies/synapse-admin.git" -matrix_synapse_admin_docker_src_files_path: "{{ matrix_base_data_path }}/synapse-admin/docker-src" - matrix_synapse_admin_version: 0.8.7 matrix_synapse_admin_docker_image: "{{ matrix_synapse_admin_docker_image_name_prefix }}awesometechnologies/synapse-admin:{{ matrix_synapse_admin_version }}" matrix_synapse_admin_docker_image_name_prefix: "{{ 'localhost/' if matrix_synapse_admin_container_image_self_build else matrix_container_global_registry_prefix }}" matrix_synapse_admin_docker_image_force_pull: "{{ matrix_synapse_admin_docker_image.endswith(':latest') }}" +# The base container network +matrix_synapse_admin_container_network: matrix-synapse-admin + +# A list of additional container networks that the container would be connected to. +# The role does not create these networks, so make sure they already exist. +# +# Use this to expose this container to another reverse proxy, which runs in a different container network, +# without exposing all other container services to that other reverse-proxy. +matrix_synapse_admin_container_additional_networks: [] + # A list of extra arguments to pass to the container matrix_synapse_admin_container_extra_arguments: [] +# matrix_synapse_admin_container_labels_traefik_enabled controls whether labels to assist a Traefik reverse-proxy will be attached to the container. +# See `../templates/labels.j2` for details. +# +# To inject your own other container labels, see `matrix_synapse_admin_container_labels_additional_labels`. +matrix_synapse_admin_container_labels_traefik_enabled: true +matrix_synapse_admin_container_labels_traefik_docker_network: "{{ matrix_synapse_admin_container_network }}" +matrix_synapse_admin_container_labels_traefik_hostname: "{{ matrix_server_fqn_matrix }}" +# The path prefix must not end with a slash +matrix_synapse_admin_container_labels_traefik_path_prefix: /synapse-admin +matrix_synapse_admin_container_labels_traefik_rule: "Host(`{{ matrix_synapse_admin_container_labels_traefik_hostname }}`) && PathPrefix(`{{ matrix_synapse_admin_container_labels_traefik_path_prefix | quote }}`)" +matrix_synapse_admin_container_labels_traefik_entrypoints: web-secure +matrix_synapse_admin_container_labels_traefik_tls: "{{ matrix_synapse_admin_container_labels_traefik_entrypoints != 'web' }}" +matrix_synapse_admin_container_labels_traefik_tls_certResolver: default # noqa var-naming + +# matrix_synapse_admin_container_labels_additional_labels contains a multiline string with additional labels to add to the container label file. +# See `../templates/labels.j2` for details. +# +# Example: +# matrix_synapse_admin_container_labels_additional_labels: | +# my.label=1 +# another.label="here" +matrix_synapse_admin_container_labels_additional_labels: '' + # List of systemd services that matrix-synapse-admin.service depends on matrix_synapse_admin_systemd_required_services_list: ['docker.service'] diff --git a/roles/custom/matrix-synapse-admin/tasks/main.yml b/roles/custom/matrix-synapse-admin/tasks/main.yml index 0b1664cf1..f38f1d5e4 100644 --- a/roles/custom/matrix-synapse-admin/tasks/main.yml +++ b/roles/custom/matrix-synapse-admin/tasks/main.yml @@ -1,7 +1,7 @@ --- - block: - - when: matrix_synapse_admin_enabled | bool + - when: matrix_synapse_admin_enabled | bool and matrix_synapse_admin_nginx_proxy_integration_enabled | bool ansible.builtin.include_tasks: "{{ role_path }}/tasks/inject_into_nginx_proxy.yml" tags: - setup-all diff --git a/roles/custom/matrix-synapse-admin/tasks/setup_install.yml b/roles/custom/matrix-synapse-admin/tasks/setup_install.yml index 57e591486..2eefe06f6 100644 --- a/roles/custom/matrix-synapse-admin/tasks/setup_install.yml +++ b/roles/custom/matrix-synapse-admin/tasks/setup_install.yml @@ -1,5 +1,21 @@ --- +- name: Ensure matrix-synapse-admin path exist + ansible.builtin.file: + path: "{{ matrix_synapse_admin_base_path }}" + state: directory + mode: 0700 + owner: "{{ matrix_user_username }}" + group: "{{ matrix_user_groupname }}" + +- name: Ensure matrix-synapse-admin labels file is created + ansible.builtin.template: + src: "{{ role_path }}/templates/labels.j2" + dest: "{{ matrix_synapse_admin_base_path }}/labels" + owner: "{{ matrix_user_username }}" + group: "{{ matrix_user_groupname }}" + mode: 0640 + - name: Ensure matrix-synapse-admin image is pulled community.docker.docker_image: name: "{{ matrix_synapse_admin_docker_image }}" @@ -35,9 +51,13 @@ pull: true when: matrix_synapse_admin_container_image_self_build | bool +- name: Ensure matrix-synapse-admin container network is created + community.general.docker_network: + name: "{{ matrix_synapse_admin_container_network }}" + driver: bridge + - name: Ensure matrix-synapse-admin.service installed ansible.builtin.template: src: "{{ role_path }}/templates/systemd/matrix-synapse-admin.service.j2" dest: "{{ devture_systemd_docker_base_systemd_path }}/matrix-synapse-admin.service" mode: 0644 - register: matrix_synapse_admin_systemd_service_result diff --git a/roles/custom/matrix-synapse-admin/tasks/setup_uninstall.yml b/roles/custom/matrix-synapse-admin/tasks/setup_uninstall.yml index 3828b7359..69820a005 100644 --- a/roles/custom/matrix-synapse-admin/tasks/setup_uninstall.yml +++ b/roles/custom/matrix-synapse-admin/tasks/setup_uninstall.yml @@ -18,3 +18,8 @@ ansible.builtin.file: path: "{{ devture_systemd_docker_base_systemd_path }}/matrix-synapse-admin.service" state: absent + + - name: Ensure matrix-synapse-admin directory doesn't exist + ansible.builtin.file: + path: "{{ matrix_synapse_admin_base_path }}" + state: absent diff --git a/roles/custom/matrix-synapse-admin/tasks/validate_config.yml b/roles/custom/matrix-synapse-admin/tasks/validate_config.yml index bf5fe69e1..41f19b751 100644 --- a/roles/custom/matrix-synapse-admin/tasks/validate_config.yml +++ b/roles/custom/matrix-synapse-admin/tasks/validate_config.yml @@ -10,3 +10,24 @@ - {'old': 'matrix_synapse_admin_docker_repo', 'new': 'matrix_synapse_admin_container_self_build_repo'} - {'old': 'matrix_synapse_admin_container_self_build', 'new': 'matrix_synapse_admin_container_image_self_build'} - {'old': 'matrix_synapse_admin_container_self_build_repo', 'new': 'matrix_synapse_admin_container_image_self_build_repo'} + +- when: matrix_synapse_admin_container_labels_traefik_enabled | bool + block: + - name: Fail if required matrix-synapse-admin Traefik settings not defined + ansible.builtin.fail: + msg: >- + You need to define a required configuration setting (`{{ item }}`). + when: "vars[item] == ''" + with_items: + - matrix_synapse_admin_container_labels_traefik_hostname + - matrix_synapse_admin_container_labels_traefik_path_prefix + + # We ensure it doesn't end with a slash, because we handle both (slash and no-slash). + # Knowing that `matrix_synapse_admin_container_labels_traefik_path_prefix` does not end with a slash + # ensures we know how to set these routes up without having to do "does it end with a slash" checks elsewhere. + - name: Fail if matrix_synapse_admin_container_labels_traefik_path_prefix ends with a slash + ansible.builtin.fail: + msg: >- + matrix_synapse_admin_container_labels_traefik_path_prefix (`{{ matrix_synapse_admin_container_labels_traefik_path_prefix }}`) must not end with a slash. + Example: `/synapse-admin`. + when: "matrix_synapse_admin_container_labels_traefik_path_prefix[-1] == '/'" diff --git a/roles/custom/matrix-synapse-admin/templates/labels.j2 b/roles/custom/matrix-synapse-admin/templates/labels.j2 new file mode 100644 index 000000000..772fdad80 --- /dev/null +++ b/roles/custom/matrix-synapse-admin/templates/labels.j2 @@ -0,0 +1,25 @@ +{% if matrix_synapse_admin_container_labels_traefik_enabled %} +traefik.enable=true + +{% if matrix_synapse_admin_container_labels_traefik_docker_network %} +traefik.docker.network={{ matrix_synapse_admin_container_labels_traefik_docker_network }} +{% endif %} + +traefik.http.middlewares.matrix-synapse-admin-slashless-redirect.redirectregex.regex=({{ matrix_synapse_admin_container_labels_traefik_path_prefix | quote }})$ +traefik.http.middlewares.matrix-synapse-admin-slashless-redirect.redirectregex.replacement=${1}/ + +traefik.http.middlewares.matrix-synapse-admin-replacepath.replacepath.path=/ + +traefik.http.routers.matrix-synapse-admin.rule={{ matrix_synapse_admin_container_labels_traefik_rule }} +traefik.http.routers.matrix-synapse-admin.middlewares=matrix-synapse-admin-slashless-redirect,matrix-synapse-admin-replacepath +traefik.http.routers.matrix-synapse-admin.service=matrix-synapse-admin +traefik.http.routers.matrix-synapse-admin.entrypoints={{ matrix_synapse_admin_container_labels_traefik_entrypoints }} +traefik.http.routers.matrix-synapse-admin.tls={{ matrix_synapse_admin_container_labels_traefik_tls | to_json }} +{% if matrix_synapse_admin_container_labels_traefik_tls %} +traefik.http.routers.matrix-synapse-admin.tls.certResolver={{ matrix_synapse_admin_container_labels_traefik_tls_certResolver }} +{% endif %} + +traefik.http.services.matrix-synapse-admin.loadbalancer.server.port=80 +{% endif %} + +{{ matrix_synapse_admin_container_labels_additional_labels }} diff --git a/roles/custom/matrix-synapse-admin/templates/systemd/matrix-synapse-admin.service.j2 b/roles/custom/matrix-synapse-admin/templates/systemd/matrix-synapse-admin.service.j2 index 9bae6e03f..ba56374c4 100644 --- a/roles/custom/matrix-synapse-admin/templates/systemd/matrix-synapse-admin.service.j2 +++ b/roles/custom/matrix-synapse-admin/templates/systemd/matrix-synapse-admin.service.j2 @@ -16,24 +16,34 @@ Environment="HOME={{ devture_systemd_docker_base_systemd_unit_home_path }}" ExecStartPre=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} kill matrix-synapse-admin 2>/dev/null || true' ExecStartPre=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} rm matrix-synapse-admin 2>/dev/null || true' -ExecStart={{ devture_systemd_docker_base_host_command_docker }} run --rm --name matrix-synapse-admin \ +ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} create \ + --rm \ + --name=matrix-synapse-admin \ --log-driver=none \ --cap-drop=ALL \ --cap-add=CHOWN \ --cap-add=NET_BIND_SERVICE \ --cap-add=SETUID \ --cap-add=SETGID \ - --network={{ matrix_docker_network }} \ + --network={{ matrix_synapse_admin_container_network }} \ {% if matrix_synapse_admin_container_http_host_bind_port %} -p {{ matrix_synapse_admin_container_http_host_bind_port }}:80 \ {% endif %} + --label-file={{ matrix_synapse_admin_base_path }}/labels \ {% for arg in matrix_synapse_admin_container_extra_arguments %} {{ arg }} \ {% endfor %} {{ matrix_synapse_admin_docker_image }} +{% for network in matrix_synapse_admin_container_additional_networks %} +ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} network connect {{ network }} matrix-synapse-admin +{% endfor %} + +ExecStart={{ devture_systemd_docker_base_host_command_docker }} start --attach matrix-synapse-admin + ExecStop=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} kill matrix-synapse-admin 2>/dev/null || true' ExecStop=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} rm matrix-synapse-admin 2>/dev/null || true' + Restart=always RestartSec=30 SyslogIdentifier=matrix-synapse-admin