From 6a52be79877daf9d320bb5ef28389977d1ec8d31 Mon Sep 17 00:00:00 2001 From: Slavi Pantaleev Date: Tue, 14 Feb 2023 09:58:35 +0200 Subject: [PATCH] Add (native) Traefik support to matrix-client-hydrogen Previously, it had to go through matrix-nginx-proxy. It's exposed to Traefik directly via container labels now Serving at a path other than `/` doesn't work well yet. --- group_vars/matrix_servers | 8 ++ .../matrix-client-hydrogen/defaults/main.yml | 99 +++++++++++++++++++ .../tasks/setup_install.yml | 7 +- .../tasks/validate_config.yml | 31 ++++++ .../templates/labels.j2 | 45 +++++++++ .../systemd/matrix-client-hydrogen.service.j2 | 14 ++- 6 files changed, 201 insertions(+), 3 deletions(-) create mode 100644 roles/custom/matrix-client-hydrogen/templates/labels.j2 diff --git a/group_vars/matrix_servers b/group_vars/matrix_servers index ca0460401..1a131a285 100755 --- a/group_vars/matrix_servers +++ b/group_vars/matrix_servers @@ -2987,6 +2987,14 @@ matrix_client_hydrogen_container_image_self_build: "{{ matrix_architecture not i # the HTTP port to the local host. matrix_client_hydrogen_container_http_host_bind_port: "{{ (matrix_playbook_service_host_bind_interface_prefix ~ '8768') if matrix_playbook_service_host_bind_interface_prefix else '' }}" +matrix_client_hydrogen_container_network: "{{ matrix_nginx_proxy_container_network if matrix_playbook_reverse_proxy_type == 'playbook-managed-nginx' else 'matrix-client-hydrogen' }}" + +matrix_client_hydrogen_container_additional_networks: "{{ [matrix_playbook_reverse_proxyable_services_additional_network] if matrix_playbook_reverse_proxyable_services_additional_network else [] }}" + +matrix_client_hydrogen_container_labels_traefik_enabled: "{{ matrix_playbook_reverse_proxy_type in ['playbook-managed-traefik', 'other-traefik-container'] }}" +matrix_client_hydrogen_container_labels_traefik_docker_network: "{{ matrix_playbook_reverse_proxyable_services_additional_network }}" +matrix_client_hydrogen_container_labels_traefik_entrypoints: "{{ devture_traefik_entrypoint_primary if devture_traefik_enabled else '' }}" + matrix_client_hydrogen_default_hs_url: "{{ matrix_homeserver_url }}" matrix_client_hydrogen_self_check_validate_certificates: "{{ false if matrix_playbook_ssl_retrieval_method == 'self-signed' else true }}" diff --git a/roles/custom/matrix-client-hydrogen/defaults/main.yml b/roles/custom/matrix-client-hydrogen/defaults/main.yml index 6ee304cfa..d429707c6 100644 --- a/roles/custom/matrix-client-hydrogen/defaults/main.yml +++ b/roles/custom/matrix-client-hydrogen/defaults/main.yml @@ -14,17 +14,116 @@ matrix_client_hydrogen_docker_image_force_pull: "{{ matrix_client_hydrogen_docke matrix_client_hydrogen_data_path: "{{ matrix_base_data_path }}/client-hydrogen" matrix_client_hydrogen_docker_src_files_path: "{{ matrix_client_hydrogen_data_path }}/docker-src" +# The base container network +matrix_client_hydrogen_container_network: matrix-client-hydrogen + +# A list of additional container networks that the container would be connected to. +# The role does not create these networks, so make sure they already exist. +# Use this to expose this container to a reverse proxy, which runs in a different container network. +matrix_client_hydrogen_container_additional_networks: [] + # Controls whether the container exposes its HTTP port (tcp/8080 in the container). # # Takes an ":" or "" value (e.g. "127.0.0.1:8768"), or empty string to not expose. matrix_client_hydrogen_container_http_host_bind_port: '' +# matrix_client_hydrogen_container_labels_traefik_enabled controls whether labels to assist a Traefik reverse-proxy will be attached to the container. +# See `../templates/labels.j2` for details. +# +# To inject your own other container labels, see `matrix_client_hydrogen_container_labels_additional_labels`. +matrix_client_hydrogen_container_labels_traefik_enabled: true +matrix_client_hydrogen_container_labels_traefik_docker_network: "{{ matrix_client_hydrogen_container_network }}" +matrix_client_hydrogen_container_labels_traefik_hostname: "{{ matrix_server_fqn_element }}" +# The path prefix must either be `/` or not end with a slash (e.g. `/hydrogen`). +# For now, only `/` is supported due to problems with serving Hydrogen at a subpath. +matrix_client_hydrogen_container_labels_traefik_path_prefix: / +matrix_client_hydrogen_container_labels_traefik_rule: "Host(`{{ matrix_client_hydrogen_container_labels_traefik_hostname }}`){% if matrix_client_hydrogen_container_labels_traefik_path_prefix != '/' %} && PathPrefix(`{{ matrix_client_hydrogen_container_labels_traefik_path_prefix }}`){% endif %}" +matrix_client_hydrogen_container_labels_traefik_priority: 0 +matrix_client_hydrogen_container_labels_traefik_entrypoints: web-secure +matrix_client_hydrogen_container_labels_traefik_tls: "{{ matrix_client_hydrogen_container_labels_traefik_entrypoints != 'web' }}" +matrix_client_hydrogen_container_labels_traefik_tls_certResolver: default # noqa var-naming + +# Controls which additional headers to attach to all HTTP responses. +# To add your own headers, use `matrix_client_hydrogen_container_labels_traefik_additional_response_headers_custom` +matrix_client_hydrogen_container_labels_traefik_additional_response_headers: "{{ matrix_client_hydrogen_container_labels_traefik_additional_response_headers_auto | combine(matrix_client_hydrogen_container_labels_traefik_additional_response_headers_custom) }}" +matrix_client_hydrogen_container_labels_traefik_additional_response_headers_auto: | + {{ + {} + | combine ({'X-XSS-Protection': matrix_client_hydrogen_http_header_xss_protection} if matrix_client_hydrogen_http_header_xss_protection else {}) + | combine ({'X-Frame-Options': matrix_client_hydrogen_http_header_frame_options} if matrix_client_hydrogen_http_header_frame_options else {}) + | combine ({'X-Content-Type-Options': matrix_client_hydrogen_http_header_content_type_options} if matrix_client_hydrogen_http_header_content_type_options else {}) + | combine ({'Content-Security-Policy': matrix_client_hydrogen_http_header_content_security_policy} if matrix_client_hydrogen_http_header_content_security_policy else {}) + | combine ({'Permission-Policy': matrix_client_hydrogen_http_header_content_permission_policy} if matrix_client_hydrogen_http_header_content_permission_policy else {}) + | combine ({'Strict-Transport-Security': matrix_client_hydrogen_http_header_strict_transport_security} if matrix_client_hydrogen_http_header_strict_transport_security and matrix_client_hydrogen_container_labels_traefik_tls else {}) + }} +matrix_client_hydrogen_container_labels_traefik_additional_response_headers_custom: {} + +# matrix_client_hydrogen_container_labels_additional_labels contains a multiline string with additional labels to add to the container label file. +# See `../templates/labels.j2` for details. +# +# Example: +# matrix_client_hydrogen_container_labels_additional_labels: | +# my.label=1 +# another.label="here" +matrix_client_hydrogen_container_labels_additional_labels: '' + # A list of extra arguments to pass to the container matrix_client_hydrogen_container_extra_arguments: [] # List of systemd services that matrix-client-hydrogen.service depends on matrix_client_hydrogen_systemd_required_services_list: ['docker.service'] +# Specifies the value of the `X-XSS-Protection` header +# Stops pages from loading when they detect reflected cross-site scripting (XSS) attacks. +# +# Learn more about it is here: +# - https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-XSS-Protection +# - https://portswigger.net/web-security/cross-site-scripting/reflected +matrix_client_hydrogen_http_header_xss_protection: "1; mode=block" + +# Specifies the value of the `X-Frame-Options` header which controls whether framing can happen. +# See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options +matrix_client_hydrogen_http_header_frame_options: SAMEORIGIN + +# Specifies the value of the `X-Content-Type-Options` header. +# See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Content-Type-Options +matrix_client_hydrogen_http_header_content_type_options: nosniff + +# Specifies the value of the `Content-Security-Policy` header. +# See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy +matrix_client_hydrogen_http_header_content_security_policy: frame-ancestors 'self' + +# Specifies the value of the `Permission-Policy` header. +# See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Permission-Policy +matrix_client_hydrogen_http_header_content_permission_policy: "{{ 'interest-cohort=() always' if matrix_client_hydrogen_floc_optout_enabled else '' }}" + +# Specifies the value of the `Strict-Transport-Security` header. +# See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security +matrix_client_hydrogen_http_header_strict_transport_security: "{{ '\"max-age=31536000; includeSubDomains; preload\" always' if matrix_client_hydrogen_hsts_preload_enabled else '\"max-age=31536000; includeSubDomains\" always' }}" + +# Controls whether to send a "Permissions-Policy interest-cohort=();" header along with all responses +# +# Learn more about what it is here: +# - https://www.eff.org/deeplinks/2021/03/googles-floc-terrible-idea +# - https://paramdeo.com/blog/opting-your-website-out-of-googles-floc-network +# - https://amifloced.org/ +# +# Of course, a better solution is to just stop using browsers (like Chrome), which participate in such tracking practices. +# See: `matrix_client_hydrogen_content_permission_policy` +matrix_client_hydrogen_floc_optout_enabled: true + +# Controls if HSTS preloading is enabled +# +# In its strongest and recommended form, the [HSTS policy](https://www.chromium.org/hsts) includes all subdomains, and +# indicates a willingness to be "preloaded" into browsers: +# `Strict-Transport-Security: max-age=31536000; includeSubDomains; preload` +# For more information visit: +# - https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security +# - https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security +# - https://hstspreload.org/#opt-in +# See: `matrix_client_hydrogen_http_header_strict_transport_security` +matrix_client_hydrogen_hsts_preload_enabled: false + # Controls whether the self-check feature should validate SSL certificates. matrix_client_hydrogen_self_check_validate_certificates: true diff --git a/roles/custom/matrix-client-hydrogen/tasks/setup_install.yml b/roles/custom/matrix-client-hydrogen/tasks/setup_install.yml index 5fe4ceadd..0e1148042 100644 --- a/roles/custom/matrix-client-hydrogen/tasks/setup_install.yml +++ b/roles/custom/matrix-client-hydrogen/tasks/setup_install.yml @@ -52,7 +52,7 @@ group: "{{ matrix_user_groupname }}" with_items: - {src: "{{ role_path }}/templates/nginx.conf.j2", name: "nginx.conf"} - when: "item.src is not none" + - {src: "{{ role_path }}/templates/labels.j2", name: "labels"} - name: Ensure Hydrogen Docker image is built community.docker.docker_image: @@ -65,6 +65,11 @@ pull: true when: "matrix_client_hydrogen_container_image_self_build | bool" +- name: Ensure Hydrogen container network is created + community.general.docker_network: + name: "{{ matrix_client_hydrogen_container_network }}" + driver: bridge + - name: Ensure matrix-client-hydrogen.service installed ansible.builtin.template: src: "{{ role_path }}/templates/systemd/matrix-client-hydrogen.service.j2" diff --git a/roles/custom/matrix-client-hydrogen/tasks/validate_config.yml b/roles/custom/matrix-client-hydrogen/tasks/validate_config.yml index 65b0e14f6..bc7725945 100644 --- a/roles/custom/matrix-client-hydrogen/tasks/validate_config.yml +++ b/roles/custom/matrix-client-hydrogen/tasks/validate_config.yml @@ -7,3 +7,34 @@ when: "(vars[item] == '' or vars[item] is none) and matrix_client_hydrogen_container_image_self_build | bool" with_items: - "matrix_client_hydrogen_default_hs_url" + +- when: matrix_client_hydrogen_container_labels_traefik_enabled | bool + block: + - name: Fail if required matrix-client-hydrogen Traefik settings not defined + ansible.builtin.fail: + msg: >- + You need to define a required configuration setting (`{{ item }}`). + when: "vars[item] == ''" + with_items: + - matrix_client_hydrogen_container_labels_traefik_hostname + - matrix_client_hydrogen_container_labels_traefik_path_prefix + + # We ensure it doesn't end with a slash, because we handle both (slash and no-slash). + # Knowing that `matrix_client_hydrogen_container_labels_traefik_path_prefix` does not end with a slash + # ensures we know how to set these routes up without having to do "does it end with a slash" checks elsewhere. + - name: Fail if matrix_client_hydrogen_container_labels_traefik_path_prefix ends with a slash + ansible.builtin.fail: + msg: >- + matrix_client_hydrogen_container_labels_traefik_path_prefix (`{{ matrix_client_hydrogen_container_labels_traefik_path_prefix }}`) must either be `/` or not end with a slash (e.g. `/hydrogen`). + when: "matrix_client_hydrogen_container_labels_traefik_path_prefix != '/' and matrix_client_hydrogen_container_labels_traefik_path_prefix[-1] == '/'" + + # For example, we're getting errors like this: + # > main.js:51 Failed to load stylesheet from https://DOMAIN/assets/theme-element-light.5316e268.css: + # despite having set a prefix of `/hydrogen`. + # This is yet to be investigated and workaround around. + - name: Fail if matrix_client_hydrogen_container_labels_traefik_path_prefix is not / + ansible.builtin.fail: + msg: >- + matrix_client_hydrogen_container_labels_traefik_path_prefix can only be set to `/` right now. + Serving Hydrogen from another path doesn't work just yet. + when: "matrix_client_hydrogen_container_labels_traefik_path_prefix != '/'" diff --git a/roles/custom/matrix-client-hydrogen/templates/labels.j2 b/roles/custom/matrix-client-hydrogen/templates/labels.j2 new file mode 100644 index 000000000..71c3ca59e --- /dev/null +++ b/roles/custom/matrix-client-hydrogen/templates/labels.j2 @@ -0,0 +1,45 @@ +{% if matrix_client_hydrogen_container_labels_traefik_enabled %} +traefik.enable=true + +{% if matrix_client_hydrogen_container_labels_traefik_docker_network %} +traefik.docker.network={{ matrix_client_hydrogen_container_labels_traefik_docker_network }} +{% endif %} + +{% set middlewares = [] %} + +{% if matrix_client_hydrogen_container_labels_traefik_path_prefix != '/' %} +traefik.http.middlewares.matrix-client-hydrogen-slashless-redirect.redirectregex.regex=({{ matrix_client_hydrogen_container_labels_traefik_path_prefix | quote }})$ +traefik.http.middlewares.matrix-client-hydrogen-slashless-redirect.redirectregex.replacement=${1}/ +{% set middlewares = middlewares + ['matrix-client-hydrogen-slashless-redirect'] %} +{% endif %} + +{% if matrix_client_hydrogen_container_labels_traefik_path_prefix != '/' %} +traefik.http.middlewares.matrix-client-hydrogen-strip-prefix.stripprefix.prefixes={{ matrix_client_hydrogen_container_labels_traefik_path_prefix }} +{% set middlewares = middlewares + ['matrix-client-hydrogen-strip-prefix'] %} +{% endif %} + +{% if matrix_client_hydrogen_container_labels_traefik_additional_response_headers.keys() | length > 0 %} +{% for name, value in matrix_client_hydrogen_container_labels_traefik_additional_response_headers.items() %} +traefik.http.middlewares.matrix-client-hydrogen-add-headers.headers.customresponseheaders.{{ name }}={{ value }} +{% endfor %} +{% set middlewares = middlewares + ['matrix-client-hydrogen-add-headers'] %} +{% endif %} + +traefik.http.routers.matrix-client-hydrogen.rule={{ matrix_client_hydrogen_container_labels_traefik_rule }} +{% if matrix_client_hydrogen_container_labels_traefik_priority | int > 0 %} +traefik.http.routers.matrix-client-hydrogen.priority={{ matrix_client_hydrogen_container_labels_traefik_priority }} +{% endif %} +traefik.http.routers.matrix-client-hydrogen.service=matrix-client-hydrogen +{% if middlewares | length > 0 %} +traefik.http.routers.matrix-client-hydrogen.middlewares={{ middlewares | join(',') }} +{% endif %} +traefik.http.routers.matrix-client-hydrogen.entrypoints={{ matrix_client_hydrogen_container_labels_traefik_entrypoints }} +traefik.http.routers.matrix-client-hydrogen.tls={{ matrix_client_hydrogen_container_labels_traefik_tls | to_json }} +{% if matrix_client_hydrogen_container_labels_traefik_tls %} +traefik.http.routers.matrix-client-hydrogen.tls.certResolver={{ matrix_client_hydrogen_container_labels_traefik_tls_certResolver }} +{% endif %} + +traefik.http.services.matrix-client-hydrogen.loadbalancer.server.port=8080 +{% endif %} + +{{ matrix_client_hydrogen_container_labels_additional_labels }} diff --git a/roles/custom/matrix-client-hydrogen/templates/systemd/matrix-client-hydrogen.service.j2 b/roles/custom/matrix-client-hydrogen/templates/systemd/matrix-client-hydrogen.service.j2 index e09978eae..1f1f0dc9b 100644 --- a/roles/custom/matrix-client-hydrogen/templates/systemd/matrix-client-hydrogen.service.j2 +++ b/roles/custom/matrix-client-hydrogen/templates/systemd/matrix-client-hydrogen.service.j2 @@ -13,15 +13,18 @@ Environment="HOME={{ devture_systemd_docker_base_systemd_unit_home_path }}" ExecStartPre=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} kill matrix-client-hydrogen 2>/dev/null || true' ExecStartPre=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} rm matrix-client-hydrogen 2>/dev/null || true' -ExecStart={{ devture_systemd_docker_base_host_command_docker }} run --rm --name matrix-client-hydrogen \ +ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} create \ + --rm \ + --name=matrix-client-hydrogen \ --log-driver=none \ --user={{ matrix_user_uid }}:{{ matrix_user_gid }} \ --cap-drop=ALL \ --read-only \ - --network={{ matrix_docker_network }} \ + --network={{ matrix_client_hydrogen_container_network }} \ {% if matrix_client_hydrogen_container_http_host_bind_port %} -p {{ matrix_client_hydrogen_container_http_host_bind_port }}:8080 \ {% endif %} + --label-file={{ matrix_client_hydrogen_data_path }}/labels \ --tmpfs=/tmp:rw,noexec,nosuid,size=10m \ --mount type=bind,src={{ matrix_client_hydrogen_data_path }}/nginx.conf,dst=/etc/nginx/nginx.conf,ro \ --mount type=bind,src={{ matrix_client_hydrogen_data_path }}/config.json,dst=/config.json.bundled,ro \ @@ -30,8 +33,15 @@ ExecStart={{ devture_systemd_docker_base_host_command_docker }} run --rm --name {% endfor %} {{ matrix_client_hydrogen_docker_image }} +{% for network in matrix_client_hydrogen_container_additional_networks %} +ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} network connect {{ network }} matrix-client-hydrogen +{% endfor %} + +ExecStart={{ devture_systemd_docker_base_host_command_docker }} start --attach matrix-client-hydrogen + ExecStop=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} kill matrix-client-hydrogen 2>/dev/null || true' ExecStop=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} rm matrix-client-hydrogen 2>/dev/null || true' + Restart=always RestartSec=30 SyslogIdentifier=matrix-client-hydrogen