Merge pull request #2002 from cvwright/conduit

Initial support for Conduit
This commit is contained in:
Slavi Pantaleev 2022-08-09 10:59:05 +03:00 committed by GitHub
commit 8d96e47555
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
16 changed files with 396 additions and 6 deletions

View File

@ -22,16 +22,18 @@ matrix_identity_server_url: "{{ ('https://' + matrix_server_fqn_matrix) if matri
matrix_homeserver_container_url: |-
{{
'http://matrix-nginx-proxy:12080' if matrix_nginx_proxy_enabled else {
'synapse': ('http://matrix-synapse:'+ matrix_synapse_container_client_api_port | string),
'dendrite': ('http://matrix-dendrite:' + matrix_dendrite_http_bind_port | string),
'synapse': ('http://matrix-synapse:'+ matrix_synapse_container_client_api_port|string),
'dendrite': ('http://matrix-dendrite:' + matrix_dendrite_http_bind_port|string),
'conduit': ('http://matrix-conduit:' + matrix_conduit_port_number|string),
}[matrix_homeserver_implementation]
}}
matrix_homeserver_container_federation_url: |-
{{
'http://matrix-nginx-proxy:12088' if matrix_nginx_proxy_enabled else {
'synapse': ('http://matrix-synapse:'+ matrix_synapse_container_federation_api_plain_port | string),
'dendrite': ('http://matrix-dendrite:' + matrix_dendrite_http_bind_port | string),
'synapse': ('http://matrix-synapse:'+ matrix_synapse_container_federation_api_plain_port|string),
'dendrite': ('http://matrix-dendrite:' + matrix_dendrite_http_bind_port|string),
'conduit': ('http://matrix-conduit:' + matrix_conduit_port_number|string),
}[matrix_homeserver_implementation]
}}
@ -1614,6 +1616,7 @@ matrix_nginx_proxy_proxy_matrix_client_api_client_max_body_size_mb: |-
{
'synapse': matrix_synapse_max_upload_size_mb,
'dendrite': (matrix_dendrite_max_file_size_bytes / 1024 / 1024) | round,
'conduit': (matrix_conduit_max_request_size / 1024 / 1024) | round,
}[matrix_homeserver_implementation]|int
}}
@ -1648,6 +1651,7 @@ matrix_nginx_proxy_proxy_matrix_federation_api_enabled: |-
{
'synapse': (matrix_synapse_federation_port_enabled and not matrix_synapse_tls_federation_listener_enabled),
'dendrite': matrix_dendrite_federation_enabled,
'conduit': matrix_conduit_allow_federation,
}[matrix_homeserver_implementation]|bool
}}
@ -1666,6 +1670,12 @@ matrix_nginx_proxy_proxy_dendrite_client_api_addr_sans_container: "127.0.0.1:{{
matrix_nginx_proxy_proxy_dendrite_federation_api_addr_with_container: "matrix-dendrite:{{ matrix_dendrite_http_bind_port | string }}"
matrix_nginx_proxy_proxy_dendrite_federation_api_addr_sans_container: "127.0.0.1:{{ matrix_dendrite_http_bind_port | string }}"
matrix_nginx_proxy_proxy_conduit_enabled: "{{ matrix_conduit_enabled }}"
matrix_nginx_proxy_proxy_conduit_client_api_addr_with_container: "matrix-conduit:{{ matrix_conduit_port_number|string }}"
matrix_nginx_proxy_proxy_conduit_client_api_addr_sans_container: "127.0.0.1:{{ matrix_conduit_port_number|string }}"
matrix_nginx_proxy_proxy_conduit_federation_api_addr_with_container: "matrix-conduit:{{ matrix_conduit_port_number|string }}"
matrix_nginx_proxy_proxy_conduit_federation_api_addr_sans_container: "127.0.0.1:{{ matrix_conduit_port_number|string }}"
# When matrix-nginx-proxy is disabled, the actual port number that the vhost uses may begin to matter.
matrix_nginx_proxy_proxy_matrix_federation_port: "{{ matrix_federation_public_port }}"
@ -2434,6 +2444,7 @@ matrix_registration_shared_secret: |-
{
'synapse': matrix_synapse_registration_shared_secret,
'dendrite': matrix_dendrite_registration_shared_secret,
'conduit': '',
}[matrix_homeserver_implementation]
}}
@ -2554,3 +2565,23 @@ matrix_dendrite_systemd_wanted_services_list: |
# /matrix-dendrite
#
######################################################################
######################################################################
#
# matrix-conduit
#
######################################################################
matrix_conduit_enabled: "{{ matrix_homeserver_implementation == 'conduit' }}"
matrix_conduit_systemd_required_services_list: |
{{
(['docker.service'])
}}
######################################################################
#
# /matrix-conduit
#
######################################################################

View File

@ -28,7 +28,7 @@ matrix_homeserver_admin_contacts: []
matrix_homeserver_support_url: ''
# This will contain the homeserver implementation that is in use.
# Valid values: synapse, dendrite
# Valid values: synapse, dendrite, conduit
#
# By default, we use Synapse, because it's the only full-featured Matrix server at the moment.
#

View File

@ -3,7 +3,7 @@
- name: Fail if invalid homeserver implementation
ansible.builtin.fail:
msg: "You need to set a valid homeserver implementation in `matrix_homeserver_implementation`"
when: "matrix_homeserver_implementation not in ['synapse', 'dendrite']"
when: "matrix_homeserver_implementation not in ['synapse', 'dendrite', 'conduit']"
# We generally support Ansible 2.7.1 and above.
- name: Fail if running on Ansible < 2.7.1

View File

@ -0,0 +1,51 @@
---
# Conduit is a simple, fast and reliable chat server powered by Matrix
# See: https://conduit.rs
matrix_conduit_enabled: true
matrix_conduit_docker_image: "{{ matrix_conduit_docker_image_name_prefix }}matrixconduit/matrix-conduit:{{ matrix_conduit_docker_image_tag }}"
matrix_conduit_docker_image_name_prefix: "docker.io/"
matrix_conduit_docker_image_tag: "v0.4.0"
matrix_conduit_docker_image_force_pull: "{{ matrix_conduit_docker_image.endswith(':latest') }}"
matrix_conduit_base_path: "{{ matrix_base_data_path }}/conduit"
matrix_conduit_config_path: "{{ matrix_conduit_base_path }}/config"
matrix_conduit_data_path: "{{ matrix_conduit_base_path }}/data"
matrix_conduit_port_number: 6167
matrix_conduit_tmp_directory_size_mb: 500
# List of systemd services that matrix-conduit.service depends on
matrix_conduit_systemd_required_services_list: ["docker.service"]
# List of systemd services that matrix-conduit.service wants
matrix_conduit_systemd_wanted_services_list: []
# Extra arguments for the Docker container
matrix_conduit_container_extra_arguments: []
# Specifies which template files to use when configuring Conduit.
# If you'd like to have your own different configuration, feel free to copy and paste
# the original files into your inventory (e.g. in `inventory/host_vars/<host>/`)
# and then change the specific host's `vars.yaml` file like this:
# matrix_conduit_template_conduit_config: "{{ playbook_dir }}/inventory/host_vars/<host>/conduit.yaml.j2"
matrix_conduit_template_conduit_config: "{{ role_path }}/templates/conduit/conduit.toml.j2"
# Max size for uploads, in bytes
matrix_conduit_max_request_size: 20_000_000
# Enables registration. If set to false, no users can register on this server.
matrix_conduit_allow_registration: true
matrix_conduit_allow_federation: true
# Enable the display name lightning bolt on registration.
matrix_conduit_enable_lightning_bolt: true
matrix_conduit_trusted_servers:
- "matrix.org"
# How many requests Conduit sends to other servers at the same time
matrix_conduit_max_concurrent_requests: 100

View File

@ -0,0 +1,7 @@
---
- import_tasks: "{{ role_path }}/tasks/conduit/setup_install.yml"
when: "matrix_conduit_enabled | bool"
- import_tasks: "{{ role_path }}/tasks/conduit/setup_uninstall.yml"
when: "not matrix_conduit_enabled | bool"

View File

@ -0,0 +1,47 @@
---
- name: Ensure Conduit Docker image is pulled
docker_image:
name: "{{ matrix_conduit_docker_image }}"
source: "{{ 'pull' if ansible_version.major > 2 or ansible_version.minor > 7 else omit }}"
force_source: "{{ matrix_conduit_docker_image_force_pull if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}"
force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else matrix_conduit_docker_image_force_pull }}"
register: result
retries: "{{ matrix_container_retries_count }}"
delay: "{{ matrix_container_retries_delay }}"
until: result is not failed
- name: Ensure Conduit config path exists
ansible.builtin.file:
path: "{{ matrix_conduit_config_path }}"
state: directory
mode: 0750
owner: "{{ matrix_user_username }}"
group: "{{ matrix_user_groupname }}"
- name: Ensure Conduit data path exists
ansible.builtin.file:
path: "{{ matrix_conduit_data_path }}"
state: directory
mode: 0770
owner: "{{ matrix_user_username }}"
group: "{{ matrix_user_groupname }}"
- name: Ensure Conduit configuration installed
ansible.builtin.template:
src: "{{ role_path }}/templates/conduit/conduit.toml.j2"
dest: "{{ matrix_conduit_config_path }}/conduit.toml"
mode: 0644
owner: "{{ matrix_user_username }}"
group: "{{ matrix_user_groupname }}"
- name: Ensure matrix-conduit.service installed
ansible.builtin.template:
src: "{{ role_path }}/templates/conduit/systemd/matrix-conduit.service.j2"
dest: "{{ matrix_systemd_path }}/matrix-conduit.service"
mode: 0644
register: matrix_conduit_systemd_service_result
- name: Ensure systemd reloaded after matrix-conduit.service installation
ansible.builtin.systemd:
daemon_reload: true
when: "matrix_conduit_systemd_service_result.changed | bool"

View File

@ -0,0 +1,30 @@
---
- name: Check existence of matrix-conduit service
ansible.builtin.stat:
path: "{{ matrix_systemd_path }}/matrix-conduit.service"
register: matrix_conduit_service_stat
- name: Ensure matrix-conduit is stopped
ansible.builtin.systemd:
name: matrix-conduit
state: stopped
daemon_reload: true
register: stopping_result
when: "matrix_conduit_service_stat.stat.exists"
- name: Ensure matrix-conduit.service doesn't exist
ansible.builtin.file:
path: "{{ matrix_systemd_path }}/matrix-conduit.service"
state: absent
when: "matrix_conduit_service_stat.stat.exists"
- name: Ensure systemd reloaded after matrix-conduit.service removal
ansible.builtin.systemd:
daemon_reload: true
when: "matrix_conduit_service_stat.stat.exists"
- name: Ensure Conduit Docker image doesn't exist
docker_image:
name: "{{ matrix_conduit_docker_image }}"
state: absent

View File

@ -0,0 +1,5 @@
---
- ansible.builtin.set_fact:
matrix_systemd_services_list: "{{ matrix_systemd_services_list + ['matrix-conduit.service'] }}"
when: matrix_conduit_enabled | bool

View File

@ -0,0 +1,17 @@
---
- import_tasks: "{{ role_path }}/tasks/init.yml"
tags:
- always
- import_tasks: "{{ role_path }}/tasks/conduit/setup.yml"
when: run_setup | bool
tags:
- setup-all
- setup-conduit
- name: Mark matrix-conduit role as executed
ansible.builtin.set_fact:
matrix_conduit_role_executed: true
tags:
- always

View File

@ -0,0 +1,52 @@
# =============================================================================
# This is the official example config for Conduit.
# If you use it for your server, you will need to adjust it to your own needs.
# At the very least, change the server_name field!
# =============================================================================
[global]
# The server_name is the pretty name of this server. It is used as a suffix for user
# and room ids. Examples: matrix.org, conduit.rs
# The Conduit server needs all /_matrix/ requests to be reachable at
# https://your.server.name/ on port 443 (client-server) and 8448 (federation).
# If that's not possible for you, you can create /.well-known files to redirect
# requests. See
# https://matrix.org/docs/spec/client_server/latest#get-well-known-matrix-client
# and
# https://matrix.org/docs/spec/server_server/r0.1.4#get-well-known-matrix-server
# for more information
server_name = "{{ matrix_domain }}"
# This is the only directory where Conduit will save its data
database_path = "/var/lib/matrix-conduit/"
database_backend = "rocksdb"
# The port Conduit will be running on. You need to set up a reverse proxy in
# your web server (e.g. apache or nginx), so all requests to /_matrix on port
# 443 and 8448 will be forwarded to the Conduit instance running on this port
# Docker users: Don't change this, you'll need to map an external port to this.
port = {{ matrix_conduit_port_number }}
# Max size for uploads
max_request_size = {{ matrix_conduit_max_request_size }}
# Enables registration. If set to false, no users can register on this server.
allow_registration = {{ matrix_conduit_allow_registration | to_json }}
allow_federation = {{ matrix_conduit_allow_federation | to_json }}
# Enable the display name lightning bolt on registration.
enable_lightning_bolt = {{ matrix_conduit_enable_lightning_bolt | to_json }}
trusted_servers = {{ matrix_conduit_trusted_servers | to_json }}
max_concurrent_requests = {{ matrix_conduit_max_concurrent_requests }}
log = "info,state_res=warn,rocket=off,_=off,sled=off"
address = "0.0.0.0"

View File

@ -0,0 +1,38 @@
#jinja2: lstrip_blocks: "True"
[Unit]
Description=Conduit Matrix homeserver
{% for service in matrix_conduit_systemd_required_services_list %}
Requires={{ service }}
After={{ service }}
{% endfor %}
[Service]
Type=simple
Environment="HOME={{ matrix_systemd_unit_home_path }}"
ExecStartPre=-{{ matrix_host_command_sh }} -c '{{ matrix_host_command_docker }} kill matrix-conduit 2>/dev/null || true'
ExecStartPre=-{{ matrix_host_command_sh }} -c '{{ matrix_host_command_docker }} rm matrix-conduit 2>/dev/null || true'
ExecStart={{ matrix_host_command_docker }} run --rm --name matrix-conduit \
--log-driver=none \
--user={{ matrix_user_uid }}:{{ matrix_user_gid }} \
--cap-drop=ALL \
--read-only \
--tmpfs=/tmp:rw,noexec,nosuid,size={{ matrix_conduit_tmp_directory_size_mb }}m \
--network={{ matrix_docker_network }} \
--env CONDUIT_CONFIG=/etc/matrix-conduit/conduit.toml \
--mount type=bind,src={{ matrix_conduit_data_path }},dst=/var/lib/matrix-conduit \
--mount type=bind,src={{ matrix_conduit_config_path }},dst=/etc/matrix-conduit,ro \
{% for arg in matrix_conduit_container_extra_arguments %}
{{ arg }} \
{% endfor %}
{{ matrix_conduit_docker_image }}
ExecStop=-{{ matrix_host_command_sh }} -c '{{ matrix_host_command_docker }} kill matrix-conduit 2>/dev/null || true'
ExecStop=-{{ matrix_host_command_sh }} -c '{{ matrix_host_command_docker }} rm matrix-conduit 2>/dev/null || true'
ExecReload={{ matrix_host_command_docker }} exec matrix-conduit /bin/sh -c 'kill -HUP 1'
Restart=always
RestartSec=30
SyslogIdentifier=matrix-conduit
[Install]
WantedBy=multi-user.target

View File

@ -0,0 +1,6 @@
---
matrix_conduit_client_api_url_endpoint_public: "https://{{ matrix_server_fqn_matrix }}/_matrix/client/versions"
matrix_conduit_federation_api_url_endpoint_public: "https://{{ matrix_server_fqn_matrix }}:{{ matrix_federation_public_port }}/_matrix/federation/v1/version"
# Tells whether this role had executed or not. Toggled to `true` during runtime.
matrix_conduit_role_executed: false

View File

@ -148,6 +148,21 @@ matrix_nginx_proxy_proxy_dendrite_client_api_addr_sans_container: ""
# A list of strings containing additional configuration blocks to add to the Dendrite's server configuration (matrix-dendrite.conf).
matrix_nginx_proxy_proxy_dendrite_additional_server_configuration_blocks: []
# Controls whether proxying for Conduit should be done.
matrix_nginx_proxy_proxy_conduit_enabled: false
matrix_nginx_proxy_proxy_conduit_hostname: "matrix-nginx-proxy"
matrix_nginx_proxy_proxy_conduit_federation_api_enabled: "{{ matrix_nginx_proxy_proxy_matrix_federation_api_enabled }}"
# Controls whether the Client API server (usually at matrix.DOMAIN:443) should explicitly reject `/_matrix/federation` endpoints.
matrix_nginx_proxy_proxy_conduit_block_federation_api_on_client_port: true
# The addresses where the Matrix Client API is, when using Conduit.
matrix_nginx_proxy_proxy_conduit_client_api_addr_with_container: ""
matrix_nginx_proxy_proxy_conduit_client_api_addr_sans_container: ""
# The addresses where the Federation API is, when using Conduit.
matrix_nginx_proxy_proxy_conduit_federation_api_addr_with_container: ""
matrix_nginx_proxy_proxy_conduit_federation_api_addr_sans_container: ""
# A list of strings containing additional configuration blocks to add to the Conduit's server configuration (matrix-conduit.conf).
matrix_nginx_proxy_proxy_conduit_additional_server_configuration_blocks: []
# Controls whether proxying the Element domain should be done.
matrix_nginx_proxy_proxy_element_enabled: false
matrix_nginx_proxy_proxy_element_hostname: "{{ matrix_server_fqn_element }}"

View File

@ -68,6 +68,19 @@
state: absent
when: "not matrix_nginx_proxy_proxy_dendrite_enabled | bool"
- name: Ensure Matrix nginx-proxy configuration for matrix-conduit exists
ansible.builtin.template:
src: "{{ role_path }}/templates/nginx/conf.d/matrix-conduit.conf.j2"
dest: "{{ matrix_nginx_proxy_confd_path }}/matrix-conduit.conf"
mode: 0644
when: matrix_nginx_proxy_proxy_conduit_enabled | bool
- name: Ensure Matrix nginx-proxy configuration for matrix-conduit deleted
ansible.builtin.file:
path: "{{ matrix_nginx_proxy_confd_path }}/matrix-conduit.conf"
state: absent
when: "not matrix_nginx_proxy_proxy_conduit_enabled | bool"
- name: Ensure Matrix nginx-proxy configuration for Element domain exists
ansible.builtin.template:
src: "{{ role_path }}/templates/nginx/conf.d/matrix-client-element.conf.j2"

View File

@ -0,0 +1,77 @@
#jinja2: lstrip_blocks: "True"
server {
listen 12080;
server_name {{ matrix_nginx_proxy_proxy_conduit_hostname }};
server_tokens off;
root /dev/null;
gzip on;
gzip_types text/plain application/json;
{% for configuration_block in matrix_nginx_proxy_proxy_conduit_additional_server_configuration_blocks %}
{{- configuration_block }}
{% endfor %}
{% if matrix_nginx_proxy_proxy_conduit_block_federation_api_on_client_port %}
location /_matrix/federation {
{% if matrix_nginx_proxy_proxy_conduit_federation_api_enabled %}
return 404 'The Federation API is served at https://{{ matrix_server_fqn_matrix }}:{{ matrix_federation_public_port }}';
{% else %}
return 404 'This Matrix server is running with federation disabled';
{% endif %}
}
{% endif %}
{# Everything else just goes to the API server ##}
location / {
{% if matrix_nginx_proxy_enabled %}
{# Use the embedded DNS resolver in Docker containers to discover the service #}
resolver 127.0.0.11 valid=5s;
set $backend "{{ matrix_nginx_proxy_proxy_conduit_client_api_addr_with_container }}";
proxy_pass http://$backend;
{% else %}
{# Generic configuration for use outside of our container setup #}
proxy_pass http://{{ matrix_nginx_proxy_proxy_conduit_client_api_addr_sans_container }};
{% endif %}
proxy_set_header Host $host;
client_body_buffer_size 25M;
client_max_body_size {{ matrix_nginx_proxy_proxy_matrix_client_api_client_max_body_size_mb }}M;
proxy_max_temp_file_size 0;
}
}
{% if matrix_nginx_proxy_proxy_conduit_federation_api_enabled %}
server {
listen 12088;
server_name {{ matrix_nginx_proxy_proxy_conduit_hostname }};
server_tokens off;
root /dev/null;
gzip on;
gzip_types text/plain application/json;
location / {
{% if matrix_nginx_proxy_enabled %}
{# Use the embedded DNS resolver in Docker containers to discover the service #}
resolver 127.0.0.11 valid=5s;
set $backend "{{ matrix_nginx_proxy_proxy_conduit_federation_api_addr_with_container }}";
proxy_pass http://$backend;
{% else %}
{# Generic configuration for use outside of our container setup #}
proxy_pass http://{{ matrix_nginx_proxy_proxy_conduit_federation_api_addr_sans_container }};
{% endif %}
proxy_set_header Host $host;
client_body_buffer_size 25M;
client_max_body_size {{ matrix_nginx_proxy_proxy_matrix_federation_api_client_max_body_size_mb }}M;
proxy_max_temp_file_size 0;
}
}
{% endif %}

View File

@ -47,6 +47,7 @@
- matrix-bot-mjolnir
- matrix-synapse
- matrix-dendrite
- matrix-conduit
- matrix-synapse-admin
- matrix-prometheus-node-exporter
- matrix-prometheus-postgres-exporter