From 54a281a4250e6e608f1df9b555973fa5d49485c7 Mon Sep 17 00:00:00 2001 From: Jason Locklin Date: Thu, 23 May 2019 15:02:44 -0400 Subject: [PATCH 01/14] Config validation not required Validate_config was copied from the telegram bridge code, but doesn't apply to the facebook bridge. --- roles/matrix-bridge-mautrix-facebook/tasks/main.yml | 6 ------ .../tasks/validate_config.yml | 10 ---------- 2 files changed, 16 deletions(-) delete mode 100644 roles/matrix-bridge-mautrix-facebook/tasks/validate_config.yml diff --git a/roles/matrix-bridge-mautrix-facebook/tasks/main.yml b/roles/matrix-bridge-mautrix-facebook/tasks/main.yml index 54fb6f9df..d3e3ce329 100644 --- a/roles/matrix-bridge-mautrix-facebook/tasks/main.yml +++ b/roles/matrix-bridge-mautrix-facebook/tasks/main.yml @@ -2,12 +2,6 @@ tags: - always -- import_tasks: "{{ role_path }}/tasks/validate_config.yml" - when: "run_setup|bool and matrix_mautrix_facebook_enabled|bool" - tags: - - setup-all - - setup-mautrix-facebook - - import_tasks: "{{ role_path }}/tasks/setup_install.yml" when: "run_setup|bool and matrix_mautrix_facebook_enabled|bool" tags: diff --git a/roles/matrix-bridge-mautrix-facebook/tasks/validate_config.yml b/roles/matrix-bridge-mautrix-facebook/tasks/validate_config.yml deleted file mode 100644 index 6b2240c88..000000000 --- a/roles/matrix-bridge-mautrix-facebook/tasks/validate_config.yml +++ /dev/null @@ -1,10 +0,0 @@ ---- - -- name: Fail if required settings not defined - fail: - msg: >- - You need to define a required configuration setting (`{{ item }}`). - when: "vars[item] == ''" - with_items: - - "matrix_mautrix_facebook_api_id" - - "matrix_mautrix_facebook_api_hash" From be2812bc8f77d80e0dc9b3d8a021d9cf517a8d0d Mon Sep 17 00:00:00 2001 From: Slavi Pantaleev Date: Fri, 24 May 2019 08:01:08 +0900 Subject: [PATCH 02/14] Remove unnecessary variables Continuation of 54a281a4250e6e. Related to #188 (Github Pull Request). --- roles/matrix-bridge-mautrix-facebook/defaults/main.yml | 4 ---- 1 file changed, 4 deletions(-) diff --git a/roles/matrix-bridge-mautrix-facebook/defaults/main.yml b/roles/matrix-bridge-mautrix-facebook/defaults/main.yml index 48740e1e3..4ff467dde 100644 --- a/roles/matrix-bridge-mautrix-facebook/defaults/main.yml +++ b/roles/matrix-bridge-mautrix-facebook/defaults/main.yml @@ -7,10 +7,6 @@ matrix_mautrix_facebook_docker_image: "tulir/mautrix-facebook:latest" matrix_mautrix_facebook_base_path: "{{ matrix_base_data_path }}/mautrix-facebook" -# Get your own API keys at https://developers.facebook.com/docs/apis-and-sdks/ -matrix_mautrix_facebook_api_id: '' -matrix_mautrix_facebook_api_hash: '' - matrix_mautrix_facebook_homeserver_address: 'https://{{ matrix_server_fqn_matrix }}' matrix_mautrix_facebook_homeserver_domain: '{{ matrix_domain }}' matrix_mautrix_facebook_appservice_address: 'http://matrix-mautrix-facebook:8080' From 5bfd22d13b75072bdb5b4d66d944f82ef026b861 Mon Sep 17 00:00:00 2001 From: Slavi Pantaleev Date: Fri, 24 May 2019 08:06:42 +0900 Subject: [PATCH 03/14] Fix incorrect inventory host_vars paths --- docs/configuring-playbook-dimension.md | 6 +++--- docs/configuring-playbook-external-postgres.md | 2 +- docs/configuring-playbook-federation.md | 6 +++--- docs/configuring-playbook-own-webserver.md | 4 ++-- docs/configuring-playbook-s3.md | 2 +- examples/apache/README.md | 2 +- 6 files changed, 11 insertions(+), 11 deletions(-) diff --git a/docs/configuring-playbook-dimension.md b/docs/configuring-playbook-dimension.md index f6a7779f6..eb6d06125 100644 --- a/docs/configuring-playbook-dimension.md +++ b/docs/configuring-playbook-dimension.md @@ -9,7 +9,7 @@ For an Integration Manager like [Dimension](https://dimension.t2bot.io) to work, Other important prerequisite is the `dimension.` DNS record being set up correctly. See [Configuring your DNS server](configuring-dns.md) on how to set up DNS record correctly. ## Enable -[Dimension integrations manager](https://dimension.t2bot.io) installation is disabled by default. You can enable it in your configuration file (`inventory/matrix./vars.yml`): +[Dimension integrations manager](https://dimension.t2bot.io) installation is disabled by default. You can enable it in your configuration file (`inventory/host_vars/matrix./vars.yml`): ```yaml matrix_dimension_enabled: true @@ -18,7 +18,7 @@ matrix_dimension_enabled: true ## Define admin users These users can modify the integrations this Dimension supports. Admin interface is accessible by opening Dimension in Riot and clicking the settings icon. -Add this to your configuration file (`inventory/matrix./vars.yml`): +Add this to your configuration file (`inventory/host_vars/matrix./vars.yml`): ```yaml matrix_dimension_admins: ['@user1:domain.com', '@user2:domain.com'] @@ -37,7 +37,7 @@ To get an access token, follow these steps: **Access tokens are sensitive information. Do not include them in any bug reports, messages, or logs. Do not share the access token with anyone.** -Add access token to your configuration file (`inventory/matrix./vars.yml`): +Add access token to your configuration file (`inventory/host_vars/matrix./vars.yml`): ```yaml matrix_dimension_access_token: "YOUR ACCESS TOKEN HERE" diff --git a/docs/configuring-playbook-external-postgres.md b/docs/configuring-playbook-external-postgres.md index c988cfeca..f3671a641 100644 --- a/docs/configuring-playbook-external-postgres.md +++ b/docs/configuring-playbook-external-postgres.md @@ -3,7 +3,7 @@ By default, this playbook would set up a PostgreSQL database server on your machine, running in a Docker container. If that's alright, you can skip this. -If you'd like to use an external PostgreSQL server that you manage, you can edit your configuration file (`inventory/matrix./vars.yml`). +If you'd like to use an external PostgreSQL server that you manage, you can edit your configuration file (`inventory/host_vars/matrix./vars.yml`). It should be something like this: ```yaml diff --git a/docs/configuring-playbook-federation.md b/docs/configuring-playbook-federation.md index 1906f37d0..ad818ab24 100644 --- a/docs/configuring-playbook-federation.md +++ b/docs/configuring-playbook-federation.md @@ -6,7 +6,7 @@ That is, people on your server can communicate with people on any other Matrix s ## Federating only with select servers -To make your server only federate with servers of your choosing, add this to your configuration file (`inventory/matrix./vars.yml`): +To make your server only federate with servers of your choosing, add this to your configuration file (`inventory/host_vars/matrix./vars.yml`): ```yaml matrix_synapse_federation_domain_whitelist: @@ -19,10 +19,10 @@ If you wish to disable federation, you can do that with an empty list (`[]`), or ## Disabling federation -To completely disable federation, isolating your server from the rest of the Matrix network, add this to your configuration file (`inventory/matrix./vars.yml`): +To completely disable federation, isolating your server from the rest of the Matrix network, add this to your configuration file (`inventory/host_vars/matrix./vars.yml`): ```yaml matrix_synapse_federation_enabled: false ``` -With that, your server's users will only be able to talk among themselves, but not to anyone who is on another server. \ No newline at end of file +With that, your server's users will only be able to talk among themselves, but not to anyone who is on another server. diff --git a/docs/configuring-playbook-own-webserver.md b/docs/configuring-playbook-own-webserver.md index 1f4ff863f..267734366 100644 --- a/docs/configuring-playbook-own-webserver.md +++ b/docs/configuring-playbook-own-webserver.md @@ -13,13 +13,13 @@ No matter which external webserver you decide to go with, you'll need to: 1) Make sure your web server user (something like `http`, `apache`, `www-data`, `nginx`) is part of the `matrix` group. You should run something like this: `usermod -a -G matrix nginx` -2) Edit your configuration file (`inventory/matrix./vars.yml`) to disable the integrated nginx server: +2) Edit your configuration file (`inventory/host_vars/matrix./vars.yml`) to disable the integrated nginx server: ```yaml matrix_nginx_proxy_enabled: false ``` -3) **If you'll manage SSL certificates by yourself**, edit your configuration file (`inventory/matrix./vars.yml`) to disable SSL certificate retrieval: +3) **If you'll manage SSL certificates by yourself**, edit your configuration file (`inventory/host_vars/matrix./vars.yml`) to disable SSL certificate retrieval: ```yaml matrix_ssl_retrieval_method: none diff --git a/docs/configuring-playbook-s3.md b/docs/configuring-playbook-s3.md index ca6701a8a..ed7c4d926 100644 --- a/docs/configuring-playbook-s3.md +++ b/docs/configuring-playbook-s3.md @@ -29,7 +29,7 @@ You'll need an Amazon S3 bucket and some IAM user credentials (access key + secr } ``` -You then need to enable S3 support in your configuration file (`inventory/matrix./vars.yml`). +You then need to enable S3 support in your configuration file (`inventory/host_vars/matrix./vars.yml`). It would be something like this: ```yaml diff --git a/examples/apache/README.md b/examples/apache/README.md index 33183b9c6..92d7d932d 100644 --- a/examples/apache/README.md +++ b/examples/apache/README.md @@ -6,7 +6,7 @@ This is for when you wish to have your own Apache webserver sitting in front of See the [Using your own webserver, instead of this playbook's nginx proxy](../../docs/configuring-playbook-own-webserver.md) documentation page. To use your own Apache reverse-proxy, you first need to disable the integrated nginx server. -You do that with the following custom configuration (`inventory/matrix./vars.yml`): +You do that with the following custom configuration (`inventory/host_vars/matrix./vars.yml`): ```yaml matrix_nginx_proxy_enabled: false From ab59cc50bd70bc7b14ff577748f2e0672022963b Mon Sep 17 00:00:00 2001 From: Slavi Pantaleev Date: Sat, 25 May 2019 07:41:04 +0900 Subject: [PATCH 04/14] Add support for more flexible container port exposing Fixes #171 (Github Issue). --- CHANGELOG.md | 35 ++++++++++++++ group_vars/matrix_servers | 46 +++++++++++-------- .../defaults/main.yml | 6 ++- .../tasks/validate_config.yml | 9 ++++ .../matrix-appservice-discord.service.j2 | 4 +- .../defaults/main.yml | 6 ++- .../tasks/validate_config.yml | 8 ++++ .../systemd/matrix-appservice-irc.service.j2 | 4 +- roles/matrix-corporal/defaults/main.yml | 11 ++++- .../matrix-corporal/tasks/validate_config.yml | 12 ++++- .../systemd/matrix-corporal.service.j2 | 8 ++-- roles/matrix-coturn/tasks/validate_config.yml | 2 +- roles/matrix-dimension/defaults/main.yml | 5 +- .../tasks/validate_config.yml | 9 ++++ .../systemd/matrix-dimension.service.j2 | 4 +- roles/matrix-mxisd/defaults/main.yml | 9 +++- roles/matrix-mxisd/tasks/validate_config.yml | 10 ++++ .../templates/systemd/matrix-mxisd.service.j2 | 4 +- .../tasks/validate_config.yml | 2 +- roles/matrix-riot-web/defaults/main.yml | 5 +- .../matrix-riot-web/tasks/validate_config.yml | 5 +- .../systemd/matrix-riot-web.service.j2 | 4 +- roles/matrix-riot-web/vars/main.yml | 2 +- roles/matrix-synapse/defaults/main.yml | 32 +++++++++---- .../matrix-synapse/tasks/validate_config.yml | 5 +- .../synapse/systemd/matrix-synapse.service.j2 | 16 +++---- 26 files changed, 197 insertions(+), 66 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 27e83dc4f..999280b52 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,3 +1,38 @@ +# 2019-05-25 + +## Support for exposing container ports publicly (not just to the host) + +Until now, various roles supported a `matrix_*_expose_port` variable, which would expose their container's port to the host. This was mostly useful for reverse-proxying manually (in case `matrix-nginx-proxy` was disabled). It could also be used for installing some playbook services (e.g. bridges, etc.) and wiring them to a separate (manual) Matrix setup. + +`matrix_*_expose_port` variables were not granular enough - sometimes they would expose one port, other times multiple. They also didn't provide control over **where** to expose (to which port number and to which network interface), because they would usually hardcode something like `127.0.0.1:8080`. + +All such variables have been superseded by a better (more flexible) way to do it. + +**Most** people (including those not using `matrix-nginx-proxy`), **don't need** to bother with this. + +Porting examples follow for people having more customized setups: + +- **from** `matrix_synapse_container_expose_client_api_port: true` **to** `matrix_synapse_container_client_api_host_bind_port: '127.0.0.1:8008'` + +- **from** `matrix_synapse_container_expose_federation_api_port: true` **to** `matrix_synapse_container_federation_api_plain_host_bind_port: '127.0.0.1:8048'` and possibly `matrix_synapse_container_federation_api_tls_host_bind_port: '8448'` + +- **from** `matrix_synapse_container_expose_metrics_port: true` **to** `matrix_synapse_container_metrics_api_host_bind_port: '127.0.0.1:9100'` + +- **from** `matrix_riot_web_container_expose_port: true` **to** `matrix_riot_web_container_http_host_bind_port: '127.0.0.1:8765'` + +- **from** `matrix_mxisd_container_expose_port: true` **to** `matrix_mxisd_container_http_host_bind_port: '127.0.0.1:8090'` + +- **from** `matrix_dimension_container_expose_port: true` **to** `matrix_dimension_container_http_host_bind_port: '127.0.0.1:8184'` + +- **from** `matrix_corporal_container_expose_ports: true` **to** `matrix_corporal_container_http_gateway_host_bind_port: '127.0.0.1:41080'` and possibly `matrix_corporal_container_http_api_host_bind_port: '127.0.0.1:41081'` + +- **from** `matrix_appservice_irc_container_expose_client_server_api_port: true` **to** `matrix_appservice_irc_container_http_host_bind_port: '127.0.0.1:9999'` + +- **from** `matrix_appservice_discord_container_expose_client_server_api_port: true` **to** `matrix_appservice_discord_container_http_host_bind_port: '127.0.0.1:9005'` + +As always, if you forget to remove usage of some outdated variable, the playbook will warn you. + + # 2019-05-23 ## Ansible 2.8 compatibility diff --git a/group_vars/matrix_servers b/group_vars/matrix_servers index 9defecaef..dc96c2099 100755 --- a/group_vars/matrix_servers +++ b/group_vars/matrix_servers @@ -36,8 +36,8 @@ matrix_appservice_discord_enabled: false # Normally, matrix-nginx-proxy is enabled and nginx can reach matrix-appservice-discord over the container network. # If matrix-nginx-proxy is not enabled, or you otherwise have a need for it, you can expose -# matrix-appservice-discord's client-server port to the local host (`127.0.0.1:9005`). -matrix_appservice_discord_container_expose_client_server_api_port: "{{ not matrix_nginx_proxy_enabled }}" +# matrix-appservice-discord's client-server port to the local host. +matrix_appservice_discord_container_http_host_bind_port: "{{ '' if matrix_nginx_proxy_enabled else '127.0.0.1:9005' }}" matrix_appservice_discord_systemd_required_services_list: | {{ @@ -64,8 +64,8 @@ matrix_appservice_irc_enabled: false # Normally, matrix-nginx-proxy is enabled and nginx can reach matrix-appservice-irc over the container network. # If matrix-nginx-proxy is not enabled, or you otherwise have a need for it, you can expose -# matrix-appservice-irc's client-server port to the local host (`127.0.0.1:9999`). -matrix_appservice_irc_container_expose_client_server_api_port: "{{ not matrix_nginx_proxy_enabled }}" +# matrix-appservice-irc's client-server port to the local host. +matrix_appservice_irc_container_http_host_bind_port: "{{ '' if matrix_nginx_proxy_enabled else '127.0.0.1:9999' }}" matrix_appservice_irc_systemd_required_services_list: | {{ @@ -162,8 +162,9 @@ matrix_corporal_enabled: false # Normally, matrix-nginx-proxy is enabled and nginx can reach matrix-corporal over the container network. # If matrix-nginx-proxy is not enabled, or you otherwise have a need for it, you can expose -# matrix-corporal's web-server ports to the local host (`127.0.0.1:41080` and `127.0.0.1:41081`). -matrix_corporal_container_expose_ports: "{{ not matrix_nginx_proxy_enabled }}" +# matrix-corporal's web-server ports to the local host. +matrix_corporal_container_http_gateway_host_bind_port: "{{ '' if matrix_nginx_proxy_enabled else '127.0.0.1:41080' }}" +matrix_corporal_container_http_api_host_bind_port: "{{ '' if matrix_nginx_proxy_enabled else '127.0.0.1:41081' }}" matrix_corporal_systemd_required_services_list: | {{ @@ -222,8 +223,8 @@ matrix_dimension_enabled: false # Normally, matrix-nginx-proxy is enabled and nginx can reach Dimension over the container network. # If matrix-nginx-proxy is not enabled, or you otherwise have a need for it, you can expose -# the Dimension HTTP port to the local host (`127.0.0.1:8184`). -matrix_dimension_container_expose_port: "{{ not matrix_nginx_proxy_enabled }}" +# the Dimension HTTP port to the local host. +matrix_dimension_container_http_host_bind_port: "{{ '' if matrix_nginx_proxy_enabled else '127.0.0.1:8184' }}" ###################################################################### # @@ -264,8 +265,8 @@ matrix_mxisd_enabled: true # Normally, matrix-nginx-proxy is enabled and nginx can reach mxisd over the container network. # If matrix-nginx-proxy is not enabled, or you otherwise have a need for it, you can expose -# mxisd's web-server port to the local host (`127.0.0.1:8090`). -matrix_mxisd_container_expose_port: "{{ not matrix_nginx_proxy_enabled }}" +# mxisd's web-server port. +matrix_mxisd_container_http_host_bind_port: "{{ '' if matrix_nginx_proxy_enabled else '127.0.0.1:8090' }}" # We enable Synapse integration via its Postgres database by default. # When using another Identity store, you might wish to disable this and define @@ -408,8 +409,8 @@ matrix_riot_web_enabled: true # Normally, matrix-nginx-proxy is enabled and nginx can reach riot-web over the container network. # If matrix-nginx-proxy is not enabled, or you otherwise have a need for it, you can expose -# the riot-web HTTP port to the local host (`127.0.0.1:80`). -matrix_riot_web_container_expose_port: "{{ not matrix_nginx_proxy_enabled }}" +# the riot-web HTTP port to the local host. +matrix_riot_web_container_http_host_bind_port: "{{ '' if matrix_nginx_proxy_enabled else '127.0.0.1:8765' }}" matrix_riot_web_default_hs_url: "{{ matrix_homeserver_url }}" matrix_riot_web_default_is_url: "{{ matrix_identity_server_url }}" @@ -449,15 +450,20 @@ matrix_riot_web_enable_presence_by_hs_url: | matrix_synapse_trusted_third_party_id_servers: "{{ [matrix_server_fqn_matrix] if matrix_mxisd_enabled else matrix_synapse_id_servers_public }}" # Normally, matrix-nginx-proxy is enabled and nginx can reach Synapse over the container network. -# If matrix-nginx-proxy is not enabled, or you otherwise have a need for it, you can expose its ports -# to the local host. +# If matrix-nginx-proxy is not enabled, or you otherwise have a need for it, +# you can expose Synapse's ports to the host. # -# For exposing the Matrix Client API's port (plain HTTP) to the local host (`127.0.0.1:8008`). -matrix_synapse_container_expose_client_api_port: "{{ not matrix_nginx_proxy_enabled }}" -# For exposing the Matrix Federation API's port (plain HTTP) to the local host (`127.0.0.1:8048`). -matrix_synapse_container_expose_federation_api_port: "{{ not matrix_nginx_proxy_enabled }}" - -matrix_synapse_container_expose_metrics_port: "{{ not matrix_nginx_proxy_enabled }}" +# For exposing the Matrix Client API's port (plain HTTP) to the local host. +matrix_synapse_container_client_api_host_bind_port: "{{ '' if matrix_nginx_proxy_enabled else '127.0.0.1:8008' }}" +# +# For exposing the Matrix Federation API's plain port (plain HTTP) to the local host. +matrix_synapse_container_federation_api_plain_host_bind_port: "{{ '' if matrix_nginx_proxy_enabled else '127.0.0.1:8048' }}" +# +# For exposing the Matrix Federation API's TLS port (HTTPS) to the internet on all network interfaces. +matrix_synapse_container_federation_api_tls_host_bind_port: "{{ '8448' if (matrix_synapse_federation_enabled and matrix_synapse_tls_federation_listener_enabled) else '' }}" +# +# For exposing the Synapse Metrics API's port (plain HTTP) to the local host. +matrix_synapse_container_metrics_api_host_bind_port: "{{ '127.0.0.1:9100' if (matrix_synapse_metrics_enabled and not matrix_nginx_proxy_enabled) else '' }}" matrix_synapse_database_host: "{{ matrix_postgres_connection_hostname }}" matrix_synapse_database_user: "{{ matrix_postgres_connection_username }}" diff --git a/roles/matrix-bridge-appservice-discord/defaults/main.yml b/roles/matrix-bridge-appservice-discord/defaults/main.yml index d94067745..23c5df252 100644 --- a/roles/matrix-bridge-appservice-discord/defaults/main.yml +++ b/roles/matrix-bridge-appservice-discord/defaults/main.yml @@ -11,8 +11,10 @@ matrix_appservice_discord_base_path: "{{ matrix_base_data_path }}/appservice-dis matrix_appservice_discord_client_id: '' matrix_appservice_discord_bot_token: '' -# Controls whether the Appservice Discord container exposes the Client/Server API port (tcp/9005). -matrix_appservice_discord_container_expose_client_server_api_port: false +# Controls whether the matrix-appservice-discord container exposes its HTTP port (tcp/9005 in the container). +# +# Takes an ":" or "" value (e.g. "127.0.0.1:9005"), or empty string to not expose. +matrix_appservice_discord_container_http_host_bind_port: '' # A list of extra arguments to pass to the container matrix_appservice_discord_container_extra_arguments: [] diff --git a/roles/matrix-bridge-appservice-discord/tasks/validate_config.yml b/roles/matrix-bridge-appservice-discord/tasks/validate_config.yml index 0afe9a0d6..fc321237a 100644 --- a/roles/matrix-bridge-appservice-discord/tasks/validate_config.yml +++ b/roles/matrix-bridge-appservice-discord/tasks/validate_config.yml @@ -8,3 +8,12 @@ with_items: - "matrix_appservice_discord_client_id" - "matrix_appservice_discord_bot_token" + +- name: (Deprecation) Catch and report renamed appservice-discord variables + fail: + msg: >- + Your configuration contains a variable, which now has a different name. + Please change your configuration to rename the variable (`{{ item.old }}` -> `{{ item.new }}`). + when: "item.old in vars" + with_items: + - {'old': 'matrix_appservice_discord_container_expose_client_server_api_port', 'new': ''} diff --git a/roles/matrix-bridge-appservice-discord/templates/systemd/matrix-appservice-discord.service.j2 b/roles/matrix-bridge-appservice-discord/templates/systemd/matrix-appservice-discord.service.j2 index 627c7ed6e..4ae408c53 100644 --- a/roles/matrix-bridge-appservice-discord/templates/systemd/matrix-appservice-discord.service.j2 +++ b/roles/matrix-bridge-appservice-discord/templates/systemd/matrix-appservice-discord.service.j2 @@ -19,8 +19,8 @@ ExecStart=/usr/bin/docker run --rm --name matrix-appservice-discord \ --user={{ matrix_user_uid }}:{{ matrix_user_gid }} \ --cap-drop=ALL \ --network={{ matrix_docker_network }} \ - {% if matrix_appservice_discord_container_expose_client_server_api_port %} - -p 127.0.0.1:9005:9005 \ + {% if matrix_appservice_discord_container_http_host_bind_port %} + -p {{ matrix_appservice_discord_container_http_host_bind_port }}:9005 \ {% endif %} -v {{ matrix_appservice_discord_base_path }}:/data \ {% for arg in matrix_appservice_discord_container_extra_arguments %} diff --git a/roles/matrix-bridge-appservice-irc/defaults/main.yml b/roles/matrix-bridge-appservice-irc/defaults/main.yml index 138fd3691..a4b1ef220 100644 --- a/roles/matrix-bridge-appservice-irc/defaults/main.yml +++ b/roles/matrix-bridge-appservice-irc/defaults/main.yml @@ -7,8 +7,10 @@ matrix_appservice_irc_docker_image: "tedomum/matrix-appservice-irc:latest" matrix_appservice_irc_base_path: "{{ matrix_base_data_path }}/appservice-irc" -# Controls whether the Appservice IRC container exposes the Client/Server API port (tcp/9999). -matrix_appservice_irc_container_expose_client_server_api_port: false +# Controls whether the matrix-appservice-discord container exposes its HTTP port (tcp/9999 in the container). +# +# Takes an ":" or "" value (e.g. "127.0.0.1:9999"), or empty string to not expose. +matrix_appservice_irc_container_http_host_bind_port: '' # A list of extra arguments to pass to the container matrix_appservice_irc_container_extra_arguments: [] diff --git a/roles/matrix-bridge-appservice-irc/tasks/validate_config.yml b/roles/matrix-bridge-appservice-irc/tasks/validate_config.yml index 952487e9c..cd4c1a311 100644 --- a/roles/matrix-bridge-appservice-irc/tasks/validate_config.yml +++ b/roles/matrix-bridge-appservice-irc/tasks/validate_config.yml @@ -14,3 +14,11 @@ You need to define additional configuration in `matrix_appservice_irc_configuration_extension_yaml` or to override `matrix_appservice_irc_configuration`. when: "matrix_appservice_irc_configuration.ircService|default(none) is none" +- name: (Deprecation) Catch and report renamed appservice-irc variables + fail: + msg: >- + Your configuration contains a variable, which now has a different name. + Please change your configuration to rename the variable (`{{ item.old }}` -> `{{ item.new }}`). + when: "item.old in vars" + with_items: + - {'old': 'matrix_appservice_irc_container_expose_client_server_api_port', 'new': ''} diff --git a/roles/matrix-bridge-appservice-irc/templates/systemd/matrix-appservice-irc.service.j2 b/roles/matrix-bridge-appservice-irc/templates/systemd/matrix-appservice-irc.service.j2 index 1a2b21532..b50f058ed 100644 --- a/roles/matrix-bridge-appservice-irc/templates/systemd/matrix-appservice-irc.service.j2 +++ b/roles/matrix-bridge-appservice-irc/templates/systemd/matrix-appservice-irc.service.j2 @@ -19,8 +19,8 @@ ExecStart=/usr/bin/docker run --rm --name matrix-appservice-irc \ --user={{ matrix_user_uid }}:{{ matrix_user_gid }} \ --cap-drop=ALL \ --network={{ matrix_docker_network }} \ - {% if matrix_appservice_irc_container_expose_client_server_api_port %} - -p 127.0.0.1:9999:9999 \ + {% if matrix_appservice_irc_container_http_host_bind_port %} + -p {{ matrix_appservice_irc_container_http_host_bind_port }}:9999 \ {% endif %} -v {{ matrix_appservice_irc_base_path }}:/data:z \ {% for arg in matrix_appservice_irc_container_extra_arguments %} diff --git a/roles/matrix-corporal/defaults/main.yml b/roles/matrix-corporal/defaults/main.yml index 09bdbb564..47e834a48 100644 --- a/roles/matrix-corporal/defaults/main.yml +++ b/roles/matrix-corporal/defaults/main.yml @@ -3,8 +3,15 @@ matrix_corporal_enabled: true -# Controls whether the matrix-corporal web server's ports (`41080` and `41081`) are exposed outside of the container. -matrix_corporal_container_expose_ports: false +# Controls whether the matrix-corporal container exposes its gateway HTTP port (tcp/41080 in the container). +# +# Takes an ":" or "" value (e.g. "127.0.0.1:41080"), or empty string to not expose. +matrix_corporal_container_http_gateway_host_bind_port: '' + +# Controls whether the matrix-corporal container exposes its API HTTP port (tcp/41081 in the container). +# +# Takes an ":" or "" value (e.g. "127.0.0.1:41081"), or empty string to not expose. +matrix_corporal_container_http_api_host_bind_port: '' # A list of extra arguments to pass to the container matrix_corporal_container_extra_arguments: [] diff --git a/roles/matrix-corporal/tasks/validate_config.yml b/roles/matrix-corporal/tasks/validate_config.yml index ace2eb1fd..9c6b295ea 100644 --- a/roles/matrix-corporal/tasks/validate_config.yml +++ b/roles/matrix-corporal/tasks/validate_config.yml @@ -2,7 +2,7 @@ - name: Fail if required matrix-corporal settings not defined fail: - msg: > + msg: >- You need to define a required configuration setting (`{{ item }}`) for using matrix-corporal. when: "vars[item] == ''" with_items: @@ -15,3 +15,13 @@ fail: msg: "The Matrix Corporal HTTP API is enabled (`matrix_corporal_http_api_enabled`), but no auth token has been set in `matrix_corporal_http_api_auth_token`" when: "matrix_corporal_http_api_enabled|bool and matrix_corporal_http_api_auth_token == ''" + + +- name: (Deprecation) Catch and report renamed corporal variables + fail: + msg: >- + Your configuration contains a variable, which now has a different name. + Please change your configuration to rename the variable (`{{ item.old }}` -> `{{ item.new }}`). + when: "item.old in vars" + with_items: + - {'old': 'matrix_corporal_container_expose_ports', 'new': ''} diff --git a/roles/matrix-corporal/templates/systemd/matrix-corporal.service.j2 b/roles/matrix-corporal/templates/systemd/matrix-corporal.service.j2 index 4979166e0..ae4830ffd 100644 --- a/roles/matrix-corporal/templates/systemd/matrix-corporal.service.j2 +++ b/roles/matrix-corporal/templates/systemd/matrix-corporal.service.j2 @@ -17,9 +17,11 @@ ExecStart=/usr/bin/docker run --rm --name matrix-corporal \ --cap-drop=ALL \ --read-only \ --network={{ matrix_docker_network }} \ - {% if matrix_corporal_container_expose_ports %} - -p 127.0.0.1:41080:41080 \ - -p 127.0.0.1:41081:41081 \ + {% if matrix_corporal_container_http_gateway_host_bind_port %} + -p {{ matrix_corporal_container_http_gateway_host_bind_port }}:41080 \ + {% endif %} + {% if matrix_corporal_container_http_api_host_bind_port %} + -p {{ matrix_corporal_container_http_api_host_bind_port }}:41081 \ {% endif %} -v {{ matrix_corporal_config_dir_path }}:/etc/matrix-corporal:ro \ -v {{ matrix_corporal_cache_dir_path }}:/var/cache/matrix-corporal:rw \ diff --git a/roles/matrix-coturn/tasks/validate_config.yml b/roles/matrix-coturn/tasks/validate_config.yml index 39019982f..d8276d3a0 100644 --- a/roles/matrix-coturn/tasks/validate_config.yml +++ b/roles/matrix-coturn/tasks/validate_config.yml @@ -2,7 +2,7 @@ - name: Fail if required Coturn settings not defined fail: - msg: > + msg: >- You need to define a required configuration setting (`{{ item }}`) for using Coturn. when: "vars[item] == ''" with_items: diff --git a/roles/matrix-dimension/defaults/main.yml b/roles/matrix-dimension/defaults/main.yml index bae6aa102..d2c5a011c 100644 --- a/roles/matrix-dimension/defaults/main.yml +++ b/roles/matrix-dimension/defaults/main.yml @@ -18,7 +18,10 @@ matrix_dimension_docker_image: "turt2live/matrix-dimension:latest" matrix_dimension_user_uid: 1000 matrix_dimension_user_gid: 1000 -matrix_dimension_container_expose_port: false +# Controls whether the matrix-dimension container exposes its HTTP port (tcp/8184 in the container). +# +# Takes an ":" or "" value (e.g. "127.0.0.1:8184"), or empty string to not expose. +matrix_dimension_container_http_host_bind_port: '' # A list of extra arguments to pass to the container matrix_dimension_container_extra_arguments: [] diff --git a/roles/matrix-dimension/tasks/validate_config.yml b/roles/matrix-dimension/tasks/validate_config.yml index 59a4c0506..62f23e33e 100644 --- a/roles/matrix-dimension/tasks/validate_config.yml +++ b/roles/matrix-dimension/tasks/validate_config.yml @@ -13,3 +13,12 @@ with_items: - "matrix_synapse_federation_enabled" when: "matrix_dimension_enabled|bool and not matrix_synapse_federation_enabled|bool" + +- name: (Deprecation) Catch and report renamed Dimension variables + fail: + msg: >- + Your configuration contains a variable, which now has a different name. + Please change your configuration to rename the variable (`{{ item.old }}` -> `{{ item.new }}`). + when: "item.old in vars" + with_items: + - {'old': 'matrix_dimension_container_expose_port', 'new': ''} diff --git a/roles/matrix-dimension/templates/systemd/matrix-dimension.service.j2 b/roles/matrix-dimension/templates/systemd/matrix-dimension.service.j2 index a95e1ca04..c32027b12 100644 --- a/roles/matrix-dimension/templates/systemd/matrix-dimension.service.j2 +++ b/roles/matrix-dimension/templates/systemd/matrix-dimension.service.j2 @@ -17,8 +17,8 @@ ExecStart=/usr/bin/docker run --rm --name matrix-dimension \ {% if matrix_dimension_widgets_allow_self_signed_ssl_certificates %} -e NODE_TLS_REJECT_UNAUTHORIZED=0 \ {% endif %} - {% if matrix_dimension_container_expose_port %} - -p 127.0.0.1:8184:8184 \ + {% if matrix_dimension_container_http_host_bind_port %} + -p {{ matrix_dimension_container_http_host_bind_port }}:8184 \ {% endif %} -v {{ matrix_dimension_base_path }}:/data:rw \ {% for arg in matrix_dimension_container_extra_arguments %} diff --git a/roles/matrix-mxisd/defaults/main.yml b/roles/matrix-mxisd/defaults/main.yml index df2cc78b0..ec9c0bdad 100644 --- a/roles/matrix-mxisd/defaults/main.yml +++ b/roles/matrix-mxisd/defaults/main.yml @@ -1,3 +1,6 @@ +# mxisd is a Federated Matrix Identity Server +# See: https://github.com/kamax-matrix/mxisd + matrix_mxisd_enabled: true matrix_mxisd_docker_image: "kamax/mxisd:1.4.3" @@ -5,8 +8,10 @@ matrix_mxisd_base_path: "{{ matrix_base_data_path }}/mxisd" matrix_mxisd_config_path: "{{ matrix_mxisd_base_path }}/config" matrix_mxisd_data_path: "{{ matrix_mxisd_base_path }}/data" -# Controls whether the mxisd web server's port (`8090`) is exposed outside of the container. -matrix_mxisd_container_expose_port: false +# Controls whether the matrix-mxisd container exposes its HTTP port (tcp/8090 in the container). +# +# Takes an ":" or "" value (e.g. "127.0.0.1:8090"), or empty string to not expose. +matrix_mxisd_container_http_host_bind_port: '' # A list of extra arguments to pass to the container matrix_mxisd_container_extra_arguments: [] diff --git a/roles/matrix-mxisd/tasks/validate_config.yml b/roles/matrix-mxisd/tasks/validate_config.yml index 3b125b3fe..200a43a3c 100644 --- a/roles/matrix-mxisd/tasks/validate_config.yml +++ b/roles/matrix-mxisd/tasks/validate_config.yml @@ -45,3 +45,13 @@ when: "vars[item] == ''" with_items: - "matrix_mxisd_threepid_medium_email_connectors_smtp_host" + + +- name: (Deprecation) Catch and report renamed mxisd variables + fail: + msg: >- + Your configuration contains a variable, which now has a different name. + Please change your configuration to rename the variable (`{{ item.old }}` -> `{{ item.new }}`). + when: "item.old in vars" + with_items: + - {'old': 'matrix_mxisd_container_expose_port', 'new': ''} diff --git a/roles/matrix-mxisd/templates/systemd/matrix-mxisd.service.j2 b/roles/matrix-mxisd/templates/systemd/matrix-mxisd.service.j2 index 892e565c5..09ebb05d1 100644 --- a/roles/matrix-mxisd/templates/systemd/matrix-mxisd.service.j2 +++ b/roles/matrix-mxisd/templates/systemd/matrix-mxisd.service.j2 @@ -23,8 +23,8 @@ ExecStart=/usr/bin/docker run --rm --name matrix-mxisd \ --read-only \ --tmpfs=/tmp:rw,exec,nosuid,size=10m \ --network={{ matrix_docker_network }} \ - {% if matrix_mxisd_container_expose_port %} - -p 127.0.0.1:8090:8090 \ + {% if matrix_mxisd_container_http_host_bind_port %} + -p {{ matrix_mxisd_container_http_host_bind_port }}:8090 \ {% endif %} -v {{ matrix_mxisd_config_path }}:/etc/mxisd:ro \ -v {{ matrix_mxisd_data_path }}:/var/mxisd:rw \ diff --git a/roles/matrix-nginx-proxy/tasks/validate_config.yml b/roles/matrix-nginx-proxy/tasks/validate_config.yml index 9316fc4e7..e5b672ed6 100644 --- a/roles/matrix-nginx-proxy/tasks/validate_config.yml +++ b/roles/matrix-nginx-proxy/tasks/validate_config.yml @@ -2,7 +2,7 @@ - name: (Deprecation) Catch and report renamed settings fail: - msg: > + msg: >- Your configuration contains a variable, which now has a different name. Please change your configuration to rename the variable (`{{ item.old }}` -> `{{ item.new }}`). when: "item.old in vars" diff --git a/roles/matrix-riot-web/defaults/main.yml b/roles/matrix-riot-web/defaults/main.yml index 7208d1b3a..0b4b9931a 100644 --- a/roles/matrix-riot-web/defaults/main.yml +++ b/roles/matrix-riot-web/defaults/main.yml @@ -4,7 +4,10 @@ matrix_riot_web_docker_image: "bubuntux/riot-web:v1.1.2" matrix_riot_web_data_path: "{{ matrix_base_data_path }}/riot-web" -matrix_riot_web_container_expose_port: false +# Controls whether the matrix-riot-web container exposes its HTTP port (tcp/8080 in the container). +# +# Takes an ":" or "" value (e.g. "127.0.0.1:8765"), or empty string to not expose. +matrix_riot_web_container_http_host_bind_port: '' # A list of extra arguments to pass to the container matrix_riot_web_container_extra_arguments: [] diff --git a/roles/matrix-riot-web/tasks/validate_config.yml b/roles/matrix-riot-web/tasks/validate_config.yml index 0a96afc0d..611eb947f 100644 --- a/roles/matrix-riot-web/tasks/validate_config.yml +++ b/roles/matrix-riot-web/tasks/validate_config.yml @@ -8,9 +8,9 @@ with_items: - "matrix_riot_web_default_hs_url" -- name: (Deprecation) Catch and report renamed settings +- name: (Deprecation) Catch and report renamed riot-web variables fail: - msg: > + msg: >- Your configuration contains a variable, which now has a different name. Please change your configuration to rename the variable (`{{ item.old }}` -> `{{ item.new }}`). when: "item.old in vars" @@ -20,3 +20,4 @@ - {'old': 'matrix_riot_web_homepage_template_technical', 'new': ''} - {'old': 'matrix_riot_web_homepage_template_building', 'new': ''} - {'old': 'matrix_riot_web_homepage_template_contributing', 'new': ''} + - {'old': 'matrix_riot_web_container_expose_port', 'new': ''} diff --git a/roles/matrix-riot-web/templates/systemd/matrix-riot-web.service.j2 b/roles/matrix-riot-web/templates/systemd/matrix-riot-web.service.j2 index 59bcf340e..20e173541 100644 --- a/roles/matrix-riot-web/templates/systemd/matrix-riot-web.service.j2 +++ b/roles/matrix-riot-web/templates/systemd/matrix-riot-web.service.j2 @@ -17,8 +17,8 @@ ExecStart=/usr/bin/docker run --rm --name matrix-riot-web \ --cap-drop=ALL \ --read-only \ --network={{ matrix_docker_network }} \ - {% if matrix_riot_web_container_expose_port %} - -p 127.0.0.1:8765:8080 \ + {% if matrix_riot_web_container_http_host_bind_port %} + -p {{ matrix_riot_web_container_http_host_bind_port }}:8080 \ {% endif %} --tmpfs=/tmp:rw,noexec,nosuid,size=10m \ -v {{ matrix_riot_web_data_path }}/nginx.conf:/etc/nginx/nginx.conf:ro \ diff --git a/roles/matrix-riot-web/vars/main.yml b/roles/matrix-riot-web/vars/main.yml index 201b5bdd9..4c5563100 100644 --- a/roles/matrix-riot-web/vars/main.yml +++ b/roles/matrix-riot-web/vars/main.yml @@ -1,3 +1,3 @@ --- -matrix_riot_web_embedded_pages_home_url: "{{ (none if matrix_riot_web_embedded_pages_home_path is none else 'home.html') }}" +matrix_riot_web_embedded_pages_home_url: "{{ ('' if matrix_riot_web_embedded_pages_home_path is none else 'home.html') }}" diff --git a/roles/matrix-synapse/defaults/main.yml b/roles/matrix-synapse/defaults/main.yml index 1a854f2f4..a5a33ba65 100644 --- a/roles/matrix-synapse/defaults/main.yml +++ b/roles/matrix-synapse/defaults/main.yml @@ -12,16 +12,32 @@ matrix_synapse_storage_path: "{{ matrix_synapse_base_path }}/storage" matrix_synapse_media_store_path: "{{ matrix_synapse_storage_path }}/media-store" matrix_synapse_ext_path: "{{ matrix_synapse_base_path }}/ext" -# Controls whether the Synapse container exposes the Client/Server API port (tcp/8008). -matrix_synapse_container_expose_client_api_port: false +# Controls whether the matrix-synapse container exposes the Client/Server API port (tcp/8008 in the container). +# +# Takes an ":" or "" value (e.g. "127.0.0.1:8008"), or empty string to not expose. +matrix_synapse_container_client_api_host_bind_port: '' -# Controls whether the Synapse container exposes the Server/Server (Federation) API port (tcp/8048). -# This is for the plain HTTP API. If you need Synapse to handle TLS encryption, -# that would be on another port (tcp/8448) controlled by `matrix_synapse_tls_federation_listener_enabled`. -matrix_synapse_container_expose_federation_api_port: false +# Controls whether the matrix-synapse container exposes the plain (unencrypted) Server/Server (Federation) API port (tcp/8048 in the container). +# +# Takes effect only if federation is enabled (matrix_synapse_federation_enabled). +# +# Takes an ":" or "" value (e.g. "127.0.0.1:8048"), or empty string to not expose. +matrix_synapse_container_federation_api_plain_host_bind_port: '' -# Controls whether the matrix-synapse container exposes the metrics port (tcp/9100). -matrix_synapse_container_expose_metrics_port: false +# Controls whether the matrix-synapse container exposes the tls (encrypted) Server/Server (Federation) API port (tcp/8448 in the container). +# +# Takes effect only if federation is enabled (matrix_synapse_federation_enabled) +# and TLS support is enabled (matrix_synapse_tls_federation_listener_enabled). +# +# Takes an ":" or "" value (e.g. "8448"), or empty string to not expose. +matrix_synapse_container_federation_api_tls_host_bind_port: '' + +# Controls whether the matrix-synapse container exposes the metrics port (tcp/9100 in the container). +# +# Takes effect only if metrics are enabled (matrix_synapse_metrics_enabled). +# +# Takes an ":" or "" value (e.g. "127.0.0.1:9100"), or empty string to not expose. +matrix_synapse_container_metrics_api_host_bind_port: '' # A list of extra arguments to pass to the container matrix_synapse_container_extra_arguments: [] diff --git a/roles/matrix-synapse/tasks/validate_config.yml b/roles/matrix-synapse/tasks/validate_config.yml index d4efad9da..fa496642d 100644 --- a/roles/matrix-synapse/tasks/validate_config.yml +++ b/roles/matrix-synapse/tasks/validate_config.yml @@ -15,7 +15,7 @@ Please change your configuration to rename the variable (`{{ item.old }}` -> `{{ item.new }}`). when: "item.old in vars" with_items: - - {'old': 'matrix_synapse_container_expose_api_port', 'new': 'matrix_synapse_container_expose_client_api_port'} + - {'old': 'matrix_synapse_container_expose_api_port', 'new': ''} - {'old': 'matrix_synapse_no_tls', 'new': ''} - {'old': 'matrix_enable_room_list_search', 'new': 'matrix_synapse_enable_room_list_search'} - {'old': 'matrix_alias_creation_rules', 'new': 'matrix_synapse_alias_creation_rules'} @@ -27,3 +27,6 @@ - {'old': 'matrix_synapse_federation_rc_sleep_delay', 'new': ''} - {'old': 'matrix_synapse_federation_rc_reject_limit', 'new': ''} - {'old': 'matrix_synapse_federation_rc_concurrent', 'new': ''} + - {'old': 'matrix_synapse_container_expose_client_api_port', 'new': ''} + - {'old': 'matrix_synapse_container_expose_federation_api_port', 'new': ''} + - {'old': 'matrix_synapse_container_expose_metrics_port', 'new': ''} diff --git a/roles/matrix-synapse/templates/synapse/systemd/matrix-synapse.service.j2 b/roles/matrix-synapse/templates/synapse/systemd/matrix-synapse.service.j2 index f0ea3d061..071a0eda2 100644 --- a/roles/matrix-synapse/templates/synapse/systemd/matrix-synapse.service.j2 +++ b/roles/matrix-synapse/templates/synapse/systemd/matrix-synapse.service.j2 @@ -29,17 +29,17 @@ ExecStart=/usr/bin/docker run --rm --name matrix-synapse \ --tmpfs=/tmp:rw,noexec,nosuid,size={{ matrix_synapse_tmp_directory_size_mb }}m \ --network={{ matrix_docker_network }} \ -e SYNAPSE_CACHE_FACTOR={{ matrix_synapse_cache_factor }} \ - {% if matrix_synapse_container_expose_client_api_port %} - -p 127.0.0.1:8008:8008 \ + {% if matrix_synapse_container_client_api_host_bind_port %} + -p {{ matrix_synapse_container_client_api_host_bind_port }}:8008 \ {% endif %} - {% if matrix_synapse_federation_enabled and matrix_synapse_tls_federation_listener_enabled %} - -p 8448:8448 \ + {% if matrix_synapse_federation_enabled and matrix_synapse_tls_federation_listener_enabled and matrix_synapse_container_federation_api_tls_host_bind_port %} + -p {{ matrix_synapse_container_federation_api_tls_host_bind_port }}:8448 \ {% endif %} - {% if matrix_synapse_federation_enabled and matrix_synapse_container_expose_federation_api_port %} - -p 127.0.0.1:8048:8048 \ + {% if matrix_synapse_federation_enabled and matrix_synapse_container_federation_api_plain_host_bind_port %} + -p {{ matrix_synapse_container_federation_api_plain_host_bind_port }}:8048 \ {% endif %} - {% if matrix_synapse_container_expose_metrics_port %} - -p 127.0.0.1:{{ matrix_synapse_metrics_port }}:{{ matrix_synapse_metrics_port }} \ + {% if matrix_synapse_metrics_enabled and matrix_synapse_container_metrics_api_host_bind_port %} + -p {{ matrix_synapse_container_metrics_api_host_bind_port }}:{{ matrix_synapse_metrics_port }} \ {% endif %} -v {{ matrix_synapse_config_dir_path }}:/data:ro \ -v {{ matrix_synapse_run_path }}:/matrix-run:rw \ From 120abaf39136a19bbd0fb2b8c2cffa455d615c5a Mon Sep 17 00:00:00 2001 From: Slavi Pantaleev Date: Sun, 26 May 2019 20:41:21 +0300 Subject: [PATCH 05/14] Upgrade Telegram bridge (0.5.1 -> 0.5.2) --- roles/matrix-bridge-mautrix-telegram/defaults/main.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/roles/matrix-bridge-mautrix-telegram/defaults/main.yml b/roles/matrix-bridge-mautrix-telegram/defaults/main.yml index ad6d49a50..9e5ede91f 100644 --- a/roles/matrix-bridge-mautrix-telegram/defaults/main.yml +++ b/roles/matrix-bridge-mautrix-telegram/defaults/main.yml @@ -3,7 +3,7 @@ matrix_mautrix_telegram_enabled: true -matrix_mautrix_telegram_docker_image: "tulir/mautrix-telegram:v0.5.1" +matrix_mautrix_telegram_docker_image: "tulir/mautrix-telegram:v0.5.2" matrix_mautrix_telegram_base_path: "{{ matrix_base_data_path }}/mautrix-telegram" From 7379968a3c7cb7acedb60d4c00be72dc60d03178 Mon Sep 17 00:00:00 2001 From: Slavi Pantaleev Date: Sun, 26 May 2019 20:50:52 +0300 Subject: [PATCH 06/14] Fix Telegram bridge HTTP proxying when not using matrix-nginx-proxy From what I see, this was never implemented to begin with. Fixes #189 (Github Issue). --- group_vars/matrix_servers | 2 ++ roles/matrix-bridge-mautrix-telegram/defaults/main.yml | 6 ++++-- .../tasks/setup_install.yml | 2 +- .../tasks/validate_config.yml | 9 +++++++++ .../templates/systemd/matrix-mautrix-telegram.service.j2 | 4 ++-- 5 files changed, 18 insertions(+), 5 deletions(-) diff --git a/group_vars/matrix_servers b/group_vars/matrix_servers index dc96c2099..dcc06d8d7 100755 --- a/group_vars/matrix_servers +++ b/group_vars/matrix_servers @@ -122,6 +122,8 @@ matrix_mautrix_telegram_systemd_required_services_list: | matrix_mautrix_telegram_public_endpoint: "/{{ matrix_synapse_macaroon_secret_key | password_hash('sha512', 'telegram') | to_uuid }}" +matrix_mautrix_telegram_container_http_host_bind_port: "{{ '' if matrix_nginx_proxy_enabled else '127.0.0.1:9006' }}" + ###################################################################### # # /matrix-bridge-mautrix-telegram diff --git a/roles/matrix-bridge-mautrix-telegram/defaults/main.yml b/roles/matrix-bridge-mautrix-telegram/defaults/main.yml index 9e5ede91f..c0f3b0a0f 100644 --- a/roles/matrix-bridge-mautrix-telegram/defaults/main.yml +++ b/roles/matrix-bridge-mautrix-telegram/defaults/main.yml @@ -21,8 +21,10 @@ matrix_mautrix_telegram_homeserver_domain: '{{ matrix_domain }}' matrix_mautrix_telegram_appservice_address: 'http://matrix-mautrix-telegram:8080' matrix_mautrix_telegram_appservice_public_external: 'https://{{ matrix_server_fqn_matrix }}{{ matrix_mautrix_telegram_public_endpoint }}' -# Set this to a port number to expose on the host when not using matrix-nginx-proxy -matrix_mautrix_telegram_container_exposed_port_number: ~ +# Controls whether the matrix-telegram container exposes its HTTP port (tcp/8080 in the container). +# +# Takes an ":" or "" value (e.g. "127.0.0.1:9006"), or empty string to not expose. +matrix_mautrix_telegram_container_http_host_bind_port: '' # A list of extra arguments to pass to the container matrix_mautrix_telegram_container_extra_arguments: [] diff --git a/roles/matrix-bridge-mautrix-telegram/tasks/setup_install.yml b/roles/matrix-bridge-mautrix-telegram/tasks/setup_install.yml index 59b95550e..3b65a33dc 100644 --- a/roles/matrix-bridge-mautrix-telegram/tasks/setup_install.yml +++ b/roles/matrix-bridge-mautrix-telegram/tasks/setup_install.yml @@ -112,7 +112,7 @@ proxy_pass http://$backend; {% else %} {# Generic configuration for use outside of our container setup #} - proxy_pass http://127.0.0.1:8080; + proxy_pass http://127.0.0.1:9006; {% endif %} } diff --git a/roles/matrix-bridge-mautrix-telegram/tasks/validate_config.yml b/roles/matrix-bridge-mautrix-telegram/tasks/validate_config.yml index fac59c9ff..d30be92e2 100644 --- a/roles/matrix-bridge-mautrix-telegram/tasks/validate_config.yml +++ b/roles/matrix-bridge-mautrix-telegram/tasks/validate_config.yml @@ -9,3 +9,12 @@ - "matrix_mautrix_telegram_api_id" - "matrix_mautrix_telegram_api_hash" - "matrix_mautrix_telegram_public_endpoint" + +- name: (Deprecation) Catch and report renamed Telegram variables + fail: + msg: >- + Your configuration contains a variable, which now has a different name. + Please change your configuration to rename the variable (`{{ item.old }}` -> `{{ item.new }}`). + when: "item.old in vars" + with_items: + - {'old': 'matrix_mautrix_telegram_container_exposed_port_number', 'new': ''} diff --git a/roles/matrix-bridge-mautrix-telegram/templates/systemd/matrix-mautrix-telegram.service.j2 b/roles/matrix-bridge-mautrix-telegram/templates/systemd/matrix-mautrix-telegram.service.j2 index 18d8a7ede..c47ad8666 100644 --- a/roles/matrix-bridge-mautrix-telegram/templates/systemd/matrix-mautrix-telegram.service.j2 +++ b/roles/matrix-bridge-mautrix-telegram/templates/systemd/matrix-mautrix-telegram.service.j2 @@ -26,8 +26,8 @@ ExecStart=/usr/bin/docker run --rm --name matrix-mautrix-telegram \ --user={{ matrix_user_uid }}:{{ matrix_user_gid }} \ --cap-drop=ALL \ --network={{ matrix_docker_network }} \ - {% if matrix_mautrix_telegram_container_exposed_port_number is not none %} - -p 127.0.0.1:{{ matrix_mautrix_telegram_container_exposed_port_number }}:8080 \ + {% if matrix_mautrix_telegram_container_http_host_bind_port %} + -p {{ matrix_mautrix_telegram_container_http_host_bind_port }}:8080 \ {% endif %} -v {{ matrix_mautrix_telegram_base_path }}:/data:z \ {% for arg in matrix_mautrix_telegram_container_extra_arguments %} From 5361d3a412560ef9be4b0ae2825c583aff38c7c6 Mon Sep 17 00:00:00 2001 From: Slavi Pantaleev Date: Mon, 27 May 2019 10:04:52 +0300 Subject: [PATCH 07/14] Fix Telegram bridge proxying config when matrix-nginx-proxy disabled Related to #189 (Github Issue). People had proxying problems if: - they used the whole playbook (including the `matrix-nginx-proxy` role) - and they were disabling the proxy (`matrix_nginx_proxy_enabled: false`) - and they were proxying with their own nginx server For them, `matrix_nginx_proxy_proxy_matrix_additional_server_configuration_blocks` would not be modified to inject the necessary proxying configuration. --- .../tasks/setup_install.yml | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-) diff --git a/roles/matrix-bridge-mautrix-telegram/tasks/setup_install.yml b/roles/matrix-bridge-mautrix-telegram/tasks/setup_install.yml index 3b65a33dc..4bd20f9e2 100644 --- a/roles/matrix-bridge-mautrix-telegram/tasks/setup_install.yml +++ b/roles/matrix-bridge-mautrix-telegram/tasks/setup_install.yml @@ -94,18 +94,18 @@ - block: - name: Fail if matrix-nginx-proxy role already executed fail: - msg: > + msg: >- Trying to append Mautrix Telegram's reverse-proxying configuration to matrix-nginx-proxy, but it's pointless since the matrix-nginx-proxy role had already executed. To fix this, please change the order of roles in your plabook, so that the matrix-nginx-proxy role would run after the matrix-bridge-mautrix-telegram role. - when: matrix_nginx_proxy_role_executed|bool + when: matrix_nginx_proxy_role_executed|default(False)|bool - name: Generate Mautrix Telegram proxying configuration for matrix-nginx-proxy set_fact: matrix_mautrix_telegram_matrix_nginx_proxy_configuration: | location {{ matrix_mautrix_telegram_public_endpoint }} { - {% if matrix_nginx_proxy_enabled %} + {% if matrix_nginx_proxy_enabled|default(False) %} {# Use the embedded DNS resolver in Docker containers to discover the service #} resolver 127.0.0.11 valid=5s; set $backend "matrix-mautrix-telegram:8080"; @@ -120,20 +120,19 @@ set_fact: matrix_nginx_proxy_proxy_matrix_additional_server_configuration_blocks: | {{ - matrix_nginx_proxy_proxy_matrix_additional_server_configuration_blocks + matrix_nginx_proxy_proxy_matrix_additional_server_configuration_blocks|default([]) + [matrix_mautrix_telegram_matrix_nginx_proxy_configuration] }} - - when: "matrix_nginx_proxy_enabled|default(False)" tags: - always - name: Warn about reverse-proxying if matrix-nginx-proxy not used debug: - msg: > + msg: >- NOTE: You've enabled the Mautrix Telegram bridge but are not using the matrix-nginx-proxy reverse proxy. Please make sure that you're proxying the `{{ matrix_mautrix_telegram_public_endpoint }}` URL endpoint to the matrix-mautrix-telegram container. + You can expose the container's port using the `matrix_mautrix_telegram_container_http_host_bind_port` variable. when: "matrix_nginx_proxy_enabled is not defined" From 7d8dde8a5372b5d1e9a628e09275bcb91e92097d Mon Sep 17 00:00:00 2001 From: Slavi Pantaleev Date: Wed, 29 May 2019 08:32:06 +0300 Subject: [PATCH 08/14] Add support for proxying /_synapse/admin APIs Fixes #191 (Github Issue). --- .../nginx/conf.d/matrix-synapse.conf.j2 | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/roles/matrix-nginx-proxy/templates/nginx/conf.d/matrix-synapse.conf.j2 b/roles/matrix-nginx-proxy/templates/nginx/conf.d/matrix-synapse.conf.j2 index d927f373b..eda0929b8 100644 --- a/roles/matrix-nginx-proxy/templates/nginx/conf.d/matrix-synapse.conf.j2 +++ b/roles/matrix-nginx-proxy/templates/nginx/conf.d/matrix-synapse.conf.j2 @@ -169,6 +169,25 @@ server { } {% endif %} + location /_synapse/admin { + {% if matrix_nginx_proxy_enabled %} + {# Use the embedded DNS resolver in Docker containers to discover the service #} + resolver 127.0.0.11 valid=5s; + set $backend "{{ matrix_nginx_proxy_proxy_matrix_client_api_addr_with_container }}"; + proxy_pass http://$backend; + {% else %} + {# Generic configuration for use outside of our container setup #} + proxy_pass http://{{ matrix_nginx_proxy_proxy_matrix_client_api_addr_sans_container }}; + {% endif %} + + proxy_set_header Host $host; + proxy_set_header X-Forwarded-For $remote_addr; + + client_body_buffer_size 25M; + client_max_body_size {{ matrix_nginx_proxy_proxy_matrix_client_api_client_max_body_size_mb }}M; + proxy_max_temp_file_size 0; + } + location / { rewrite ^/$ /_matrix/static/ last; } From 70487061f4aa1113b01c7e0bb1d83df424015743 Mon Sep 17 00:00:00 2001 From: Slavi Pantaleev Date: Wed, 29 May 2019 09:59:50 +0300 Subject: [PATCH 09/14] Prefer --mount instead of -v for mounting volumes This doesn't replace all usage of `-v`, but it's a start. People sometimes troubleshoot by deleting files (especially bridge config files). Restarting Synapse with a missing registration.yaml file for a given bridge, causes the `-v /something/registration.yaml:/something/registration.yaml:ro` option to force-create `/something/registration.yaml` as a directory. When a path that's provided to the `-v` option is missing, Docker auto-creates that path as a directory. This causes more breakage and confusion later on. We'd rather fail, instead of magically creating directories. Using `--mount`, instead of `-v` is the solution to this. From Docker's documentation: > When you use --mount with type=bind, the host-path must refer to an existing path on the host. > The path will not be created for you and the service will fail with an error if the path does not exist. --- docs/howto-server-delegation.md | 12 ++++-------- .../tasks/setup_install.yml | 11 ++++------- .../tasks/setup_install.yml | 11 ++++------- .../tasks/setup_install.yml | 11 ++++------- .../tasks/setup_install.yml | 11 ++++------- .../tasks/setup_install.yml | 11 ++++------- roles/matrix-synapse/defaults/main.yml | 7 ++++++- roles/matrix-synapse/tasks/ext/ldap-auth/setup.yml | 2 -- .../tasks/ext/rest-auth/setup_install.yml | 8 +++----- .../tasks/ext/shared-secret-auth/setup_install.yml | 8 +++----- 10 files changed, 36 insertions(+), 56 deletions(-) diff --git a/docs/howto-server-delegation.md b/docs/howto-server-delegation.md index a7863d881..45ef12dc4 100644 --- a/docs/howto-server-delegation.md +++ b/docs/howto-server-delegation.md @@ -89,10 +89,8 @@ matrix_nginx_proxy_proxy_matrix_federation_api_ssl_certificate_key: /matrix/ssl/ If your files are not in `/matrix/ssl` but in some other location, you would need to mount them into the container: ```yaml -matrix_nginx_proxy_container_additional_volumes: - - src: /some/path/on/the/host - dst: /some/path/inside/the/container - options: ro +matrix_synapse_container_extra_arguments: + - "--mount type-bind,src=/some/path/on/the/host,dst=/some/path/inside/the/container,ro" ``` You then refer to them (for `matrix_nginx_proxy_proxy_matrix_federation_api_ssl_certificate` and `matrix_nginx_proxy_proxy_matrix_federation_api_ssl_certificate_key`) by using `/some/path/inside/the/container`. @@ -118,10 +116,8 @@ Make sure to reload/restart your webserver once in a while, so that newer certif To do that, make sure the certificate files are mounted into the Synapse container: ```yaml -matrix_synapse_container_additional_volumes: - - src: /some/path/on/the/host - dst: /some/path/inside/the/container - options: ro +matrix_synapse_container_extra_arguments: + - "--mount type-bind,src=/some/path/on/the/host,dst=/some/path/inside/the/container,ro" ``` You can then tell Synapse to serve Federation traffic over TLS on `tcp/8448`: diff --git a/roles/matrix-bridge-appservice-discord/tasks/setup_install.yml b/roles/matrix-bridge-appservice-discord/tasks/setup_install.yml index 59dd8d018..90d52ef51 100644 --- a/roles/matrix-bridge-appservice-discord/tasks/setup_install.yml +++ b/roles/matrix-bridge-appservice-discord/tasks/setup_install.yml @@ -61,9 +61,6 @@ -l discord_bot when: "not appservice_discord_registration_file.stat.exists" -- set_fact: - matrix_synapse_app_service_config_file_appservice_discord: '{{ matrix_appservice_discord_base_path }}/discord-registration.yml' - - name: Check if a matrix-appservice-discord invite_link file exists stat: path: "{{ matrix_appservice_discord_base_path }}/invite_link" @@ -82,12 +79,12 @@ # If the matrix-synapse role is not used, these variables may not exist. - set_fact: - matrix_synapse_container_additional_volumes: > - {{ matrix_synapse_container_additional_volumes|default([]) }} + matrix_synapse_container_extra_arguments: > + {{ matrix_synapse_container_extra_arguments|default([]) }} + - {{ [{'src': '{{ matrix_appservice_discord_base_path }}/discord-registration.yaml', 'dst': '{{ matrix_synapse_app_service_config_file_appservice_discord }}', 'options': 'ro'}] }} + {{ ["--mount type=bind,src={{ matrix_appservice_discord_base_path }}/discord-registration.yaml,dst=/matrix-appservice-discord-registration.yaml,ro"] }} matrix_synapse_app_service_config_files: > {{ matrix_synapse_app_service_config_files|default([]) }} + - {{ ["{{ matrix_synapse_app_service_config_file_appservice_discord }}"] | to_nice_json }} + {{ ["/matrix-appservice-discord-registration.yaml"] }} diff --git a/roles/matrix-bridge-appservice-irc/tasks/setup_install.yml b/roles/matrix-bridge-appservice-irc/tasks/setup_install.yml index 2825ac6b7..96849c65f 100644 --- a/roles/matrix-bridge-appservice-irc/tasks/setup_install.yml +++ b/roles/matrix-bridge-appservice-irc/tasks/setup_install.yml @@ -70,20 +70,17 @@ -l irc_bot when: "not appservice_irc_registration_file.stat.exists" -- set_fact: - matrix_synapse_app_service_config_file_appservice_irc: '/app-registration/appservice-irc.yml' - # If the matrix-synapse role is not used, these variables may not exist. - set_fact: - matrix_synapse_container_additional_volumes: > - {{ matrix_synapse_container_additional_volumes|default([]) }} + matrix_synapse_container_extra_arguments: > + {{ matrix_synapse_container_extra_arguments|default([]) }} + - {{ [{'src': '{{ matrix_appservice_irc_base_path }}/registration.yaml', 'dst': '{{ matrix_synapse_app_service_config_file_appservice_irc }}', 'options': 'ro'}] }} + {{ ["--mount type=bind,src={{ matrix_appservice_irc_base_path }}/registration.yaml,dst=/matrix-appservice-irc-registration.yaml,ro"] }} matrix_synapse_app_service_config_files: > {{ matrix_synapse_app_service_config_files|default([]) }} + - {{ ["{{ matrix_synapse_app_service_config_file_appservice_irc }}"] | to_nice_json }} + {{ ["/matrix-appservice-irc-registration.yaml"] }} - name: Ensure IRC configuration directory permissions are correct file: diff --git a/roles/matrix-bridge-mautrix-facebook/tasks/setup_install.yml b/roles/matrix-bridge-mautrix-facebook/tasks/setup_install.yml index a13321872..ae313e366 100644 --- a/roles/matrix-bridge-mautrix-facebook/tasks/setup_install.yml +++ b/roles/matrix-bridge-mautrix-facebook/tasks/setup_install.yml @@ -65,17 +65,14 @@ python3 -m mautrix_facebook -g -c /data/config.yaml -r /data/registration.yaml when: "not mautrix_facebook_registration_file_stat.stat.exists" -- set_fact: - matrix_synapse_app_service_config_file_mautrix_facebook: '/app-registration/mautrix-facebook.yml' - # If the matrix-synapse role is not used, these variables may not exist. - set_fact: - matrix_synapse_container_additional_volumes: > - {{ matrix_synapse_container_additional_volumes|default([]) }} + matrix_synapse_container_extra_arguments: > + {{ matrix_synapse_container_extra_arguments|default([]) }} + - {{ [{'src': '{{ matrix_mautrix_facebook_base_path }}/registration.yaml', 'dst': '{{ matrix_synapse_app_service_config_file_mautrix_facebook }}', 'options': 'ro'}] }} + {{ ["--mount type=bind,src={{ matrix_mautrix_facebook_base_path }}/registration.yaml,dst=/matrix-mautrix-facebook-registration.yaml,ro"] }} matrix_synapse_app_service_config_files: > {{ matrix_synapse_app_service_config_files|default([]) }} + - {{ ["{{ matrix_synapse_app_service_config_file_mautrix_facebook }}"] | to_nice_json }} + {{ ["/matrix-mautrix-facebook-registration.yaml"] }} diff --git a/roles/matrix-bridge-mautrix-telegram/tasks/setup_install.yml b/roles/matrix-bridge-mautrix-telegram/tasks/setup_install.yml index 4bd20f9e2..0655369b0 100644 --- a/roles/matrix-bridge-mautrix-telegram/tasks/setup_install.yml +++ b/roles/matrix-bridge-mautrix-telegram/tasks/setup_install.yml @@ -76,20 +76,17 @@ python3 -m mautrix_telegram -g -c /data/config.yaml -r /data/registration.yaml when: "not mautrix_telegram_registration_file_stat.stat.exists" -- set_fact: - matrix_synapse_app_service_config_file_mautrix_telegram: '/app-registration/mautrix-telegram.yml' - # If the matrix-synapse role is not used, these variables may not exist. - set_fact: - matrix_synapse_container_additional_volumes: > - {{ matrix_synapse_container_additional_volumes|default([]) }} + matrix_synapse_container_extra_arguments: > + {{ matrix_synapse_container_extra_arguments|default([]) }} + - {{ [{'src': '{{ matrix_mautrix_telegram_base_path }}/registration.yaml', 'dst': '{{ matrix_synapse_app_service_config_file_mautrix_telegram }}', 'options': 'ro'}] }} + {{ ["--mount type=bind,src={{ matrix_mautrix_telegram_base_path }}/registration.yaml,dst=/matrix-mautrix-telegram-registration.yaml,ro"] }} matrix_synapse_app_service_config_files: > {{ matrix_synapse_app_service_config_files|default([]) }} + - {{ ["{{ matrix_synapse_app_service_config_file_mautrix_telegram }}"] | to_nice_json }} + {{ ["/matrix-mautrix-telegram-registration.yaml"] }} - block: - name: Fail if matrix-nginx-proxy role already executed diff --git a/roles/matrix-bridge-mautrix-whatsapp/tasks/setup_install.yml b/roles/matrix-bridge-mautrix-whatsapp/tasks/setup_install.yml index 7c090e9b4..ac7361ac5 100644 --- a/roles/matrix-bridge-mautrix-whatsapp/tasks/setup_install.yml +++ b/roles/matrix-bridge-mautrix-whatsapp/tasks/setup_install.yml @@ -65,17 +65,14 @@ /usr/bin/mautrix-whatsapp -g -c /data/config.yaml -r /data/registration.yaml when: "not mautrix_whatsapp_registration_file_stat.stat.exists" -- set_fact: - matrix_synapse_app_service_config_file_mautrix_whatsapp: '/app-registration/mautrix-whatsapp.yml' - # If the matrix-synapse role is not used, these variables may not exist. - set_fact: - matrix_synapse_container_additional_volumes: > - {{ matrix_synapse_container_additional_volumes|default([]) }} + matrix_synapse_container_extra_arguments: > + {{ matrix_synapse_container_extra_arguments|default([]) }} + - {{ [{'src': '{{ matrix_mautrix_whatsapp_base_path }}/registration.yaml', 'dst': '{{ matrix_synapse_app_service_config_file_mautrix_whatsapp }}', 'options': 'ro'}] }} + {{ ["--mount type=bind,src={{ matrix_mautrix_whatsapp_base_path }}/registration.yaml,dst=/matrix-mautrix-whatsapp-registration.yaml,ro"] }} matrix_synapse_app_service_config_files: > {{ matrix_synapse_app_service_config_files|default([]) }} + - {{ ["{{ matrix_synapse_app_service_config_file_mautrix_whatsapp }}"] | to_nice_json }} + {{ ["/matrix-mautrix-whatsapp-registration.yaml"] }} diff --git a/roles/matrix-synapse/defaults/main.yml b/roles/matrix-synapse/defaults/main.yml index a5a33ba65..7903cca28 100644 --- a/roles/matrix-synapse/defaults/main.yml +++ b/roles/matrix-synapse/defaults/main.yml @@ -170,6 +170,11 @@ matrix_synapse_federation_domain_whitelist: ~ # A list of additional "volumes" to mount in the container. # This list gets populated dynamically based on Synapse extensions that have been enabled. # Contains definition objects like this: `{"src": "/outside", "dst": "/inside", "options": "rw|ro|slave|.."} +# +# Note: internally, this uses the `-v` flag for mounting the specified volumes. +# It's better (safer) to use the `--mount` flag for mounting volumes. +# To use `--mount`, specifiy it in `matrix_synapse_container_extra_arguments`. +# Example: `matrix_synapse_container_extra_arguments: ['--mount type=bind,src=/outside,dst=/inside,ro'] matrix_synapse_container_additional_volumes: [] # A list of additional loggers to register in synapse.log.config. @@ -179,7 +184,7 @@ matrix_synapse_additional_loggers: [] # A list of appservice config files (in-container filesystem paths). # This list gets populated dynamically based on Synapse extensions that have been enabled. -# You may wish to use this together with `matrix_synapse_container_additional_volumes`. +# You may wish to use this together with `matrix_synapse_container_additional_volumes` or `matrix_synapse_container_extra_arguments`. matrix_synapse_app_service_config_files: [] # This is set dynamically during execution depending on whether diff --git a/roles/matrix-synapse/tasks/ext/ldap-auth/setup.yml b/roles/matrix-synapse/tasks/ext/ldap-auth/setup.yml index f4290ac26..e760626dc 100644 --- a/roles/matrix-synapse/tasks/ext/ldap-auth/setup.yml +++ b/roles/matrix-synapse/tasks/ext/ldap-auth/setup.yml @@ -1,8 +1,6 @@ - set_fact: matrix_synapse_password_providers_enabled: true - when: matrix_synapse_ext_password_provider_ldap_enabled|bool -- set_fact: matrix_synapse_additional_loggers: > {{ matrix_synapse_additional_loggers }} + diff --git a/roles/matrix-synapse/tasks/ext/rest-auth/setup_install.yml b/roles/matrix-synapse/tasks/ext/rest-auth/setup_install.yml index 05429ca31..f1a182c50 100644 --- a/roles/matrix-synapse/tasks/ext/rest-auth/setup_install.yml +++ b/roles/matrix-synapse/tasks/ext/rest-auth/setup_install.yml @@ -17,13 +17,11 @@ - set_fact: matrix_synapse_password_providers_enabled: true -- set_fact: - matrix_synapse_container_additional_volumes: > - {{ matrix_synapse_container_additional_volumes }} + matrix_synapse_container_extra_arguments: > + {{ matrix_synapse_container_extra_arguments|default([]) }} + - {{ [{'src': '{{ matrix_synapse_ext_path }}/rest_auth_provider.py', 'dst': '{{ matrix_synapse_in_container_python_packages_path }}/rest_auth_provider.py', 'options': 'ro'}] }} + {{ ["--mount type=bind,src={{ matrix_synapse_ext_path }}/rest_auth_provider.py,dst={{ matrix_synapse_in_container_python_packages_path }}/rest_auth_provider.py,ro"] }} -- set_fact: matrix_synapse_additional_loggers: > {{ matrix_synapse_additional_loggers }} + diff --git a/roles/matrix-synapse/tasks/ext/shared-secret-auth/setup_install.yml b/roles/matrix-synapse/tasks/ext/shared-secret-auth/setup_install.yml index 128cba3c7..d26235849 100644 --- a/roles/matrix-synapse/tasks/ext/shared-secret-auth/setup_install.yml +++ b/roles/matrix-synapse/tasks/ext/shared-secret-auth/setup_install.yml @@ -17,13 +17,11 @@ - set_fact: matrix_synapse_password_providers_enabled: true -- set_fact: - matrix_synapse_container_additional_volumes: > - {{ matrix_synapse_container_additional_volumes }} + matrix_synapse_container_extra_arguments: > + {{ matrix_synapse_container_extra_arguments|default([]) }} + - {{ [{'src': '{{ matrix_synapse_ext_path }}/shared_secret_authenticator.py', 'dst': '{{ matrix_synapse_in_container_python_packages_path }}/shared_secret_authenticator.py', 'options': 'ro'}] }} + {{ ["--mount type=bind,src={{ matrix_synapse_ext_path }}/shared_secret_authenticator.py,dst={{ matrix_synapse_in_container_python_packages_path }}/shared_secret_authenticator.py,ro"] }} -- set_fact: matrix_synapse_additional_loggers: > {{ matrix_synapse_additional_loggers }} + From f1c124331feffd29b137680557245816998453bf Mon Sep 17 00:00:00 2001 From: Slavi Pantaleev Date: Thu, 30 May 2019 08:44:21 +0300 Subject: [PATCH 10/14] Upgrade riot-web (1.1.2 -> 1.2.0) --- roles/matrix-riot-web/defaults/main.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/roles/matrix-riot-web/defaults/main.yml b/roles/matrix-riot-web/defaults/main.yml index 0b4b9931a..981ec7192 100644 --- a/roles/matrix-riot-web/defaults/main.yml +++ b/roles/matrix-riot-web/defaults/main.yml @@ -1,6 +1,6 @@ matrix_riot_web_enabled: true -matrix_riot_web_docker_image: "bubuntux/riot-web:v1.1.2" +matrix_riot_web_docker_image: "bubuntux/riot-web:v1.2.0" matrix_riot_web_data_path: "{{ matrix_base_data_path }}/riot-web" From 2982b038091bc195556d275eca21dc2345d28c7b Mon Sep 17 00:00:00 2001 From: Slavi Pantaleev Date: Thu, 30 May 2019 09:42:08 +0300 Subject: [PATCH 11/14] Explicitly serialize matrix_synapse_app_service_config_files Attempt to fix #192 (Github Issue), potential regression since 70487061f4aa111. Serializing as JSON/YAML explicitly is much better than relying on magic (well, Python serialization being valid YAML..). It seems like Python may prefix strings with `u` sometimes (Python 3?), which causes Python serialization to not be compatible with YAML. --- roles/matrix-synapse/templates/synapse/homeserver.yaml.j2 | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/roles/matrix-synapse/templates/synapse/homeserver.yaml.j2 b/roles/matrix-synapse/templates/synapse/homeserver.yaml.j2 index c51a60a01..9e7777fda 100644 --- a/roles/matrix-synapse/templates/synapse/homeserver.yaml.j2 +++ b/roles/matrix-synapse/templates/synapse/homeserver.yaml.j2 @@ -893,7 +893,7 @@ report_stats: {{ matrix_synapse_report_stats|to_json }} # A list of application service config files to use # -app_service_config_files: {{ matrix_synapse_app_service_config_files }} +app_service_config_files: {{ matrix_synapse_app_service_config_files|to_json }} # Uncomment to enable tracking of application service IP addresses. Implicitly # enables MAU tracking for application service users. From 35892286a11eb21391908f014904819e50f12b60 Mon Sep 17 00:00:00 2001 From: Slavi Pantaleev Date: Thu, 30 May 2019 17:22:39 +0300 Subject: [PATCH 12/14] Upgrade mxisd (1.4.3 -> 1.4.4) --- roles/matrix-mxisd/defaults/main.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/roles/matrix-mxisd/defaults/main.yml b/roles/matrix-mxisd/defaults/main.yml index ec9c0bdad..b7fc51379 100644 --- a/roles/matrix-mxisd/defaults/main.yml +++ b/roles/matrix-mxisd/defaults/main.yml @@ -3,7 +3,7 @@ matrix_mxisd_enabled: true -matrix_mxisd_docker_image: "kamax/mxisd:1.4.3" +matrix_mxisd_docker_image: "kamax/mxisd:1.4.4" matrix_mxisd_base_path: "{{ matrix_base_data_path }}/mxisd" matrix_mxisd_config_path: "{{ matrix_mxisd_base_path }}/config" matrix_mxisd_data_path: "{{ matrix_mxisd_base_path }}/data" From 3bc8aa0a82179b2a609018daa2a7183c3e1b0118 Mon Sep 17 00:00:00 2001 From: Slavi Pantaleev Date: Thu, 30 May 2019 20:50:09 +0300 Subject: [PATCH 13/14] Upgrade Synapse (0.99.5.1 -> 0.99.5.2) --- roles/matrix-synapse/defaults/main.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/roles/matrix-synapse/defaults/main.yml b/roles/matrix-synapse/defaults/main.yml index 7903cca28..f343d5ffb 100644 --- a/roles/matrix-synapse/defaults/main.yml +++ b/roles/matrix-synapse/defaults/main.yml @@ -3,7 +3,7 @@ matrix_synapse_enabled: true -matrix_synapse_docker_image: "matrixdotorg/synapse:v0.99.5.1" +matrix_synapse_docker_image: "matrixdotorg/synapse:v0.99.5.2" matrix_synapse_base_path: "{{ matrix_base_data_path }}/synapse" matrix_synapse_config_dir_path: "{{ matrix_synapse_base_path }}/config" From c06b47af77e2a8f435f916ed40aeab5da9bcd221 Mon Sep 17 00:00:00 2001 From: kingoftheconnors Date: Sun, 2 Jun 2019 18:24:18 -0400 Subject: [PATCH 14/14] Fixed error message to direct users to the right debug command --- roles/matrix-common-after/tasks/start.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/roles/matrix-common-after/tasks/start.yml b/roles/matrix-common-after/tasks/start.yml index f0015428b..6a5318149 100644 --- a/roles/matrix-common-after/tasks/start.yml +++ b/roles/matrix-common-after/tasks/start.yml @@ -36,6 +36,6 @@ msg: >- {{ item }} was not detected to be running. It's possible that there's a configuration problem or another service on your server interferes with it (uses the same ports, etc.). - Try running `systemctl status {{ item }}` and `systemctl -fu {{ item }}` on the server to investigate. + Try running `systemctl status {{ item }}` and `journalctl -fu {{ item }}` on the server to investigate. with_items: "{{ matrix_systemd_services_list }}" when: "ansible_facts.services[item + '.service']|default(none) is none or ansible_facts.services[item + '.service'].state != 'running'"