Add native Traefik support to matrix-synapse

group_vars/matrix_servers

@@ -3805,9 +3805,26 @@ matrix_synapse_container_manhole_api_host_bind_port: "{{ (matrix_playbook_servic
 
 matrix_synapse_container_additional_networks: |
   {{
-    ([redis_container_network] if matrix_synapse_redis_enabled and matrix_synapse_redis_host == redis_identifier else [])
+    (
+      ([matrix_playbook_reverse_proxyable_services_additional_network] if matrix_synapse_container_labels_traefik_enabled and matrix_playbook_reverse_proxyable_services_additional_network else [])
+      +
+      ([devture_postgres_container_network] if (devture_postgres_enabled and devture_postgres_container_network != matrix_synapse_container_network and matrix_synapse_database_host == devture_postgres_connection_hostname) else [])
+      +
+      ([redis_container_network] if matrix_synapse_redis_enabled and matrix_synapse_redis_host == redis_identifier else [])
+    )
   }}
 
+matrix_synapse_container_labels_traefik_enabled: "{{ matrix_playbook_reverse_proxy_type in ['playbook-managed-traefik', 'other-traefik-container'] and not matrix_synapse_workers_enabled }}"
+matrix_synapse_container_labels_traefik_docker_network: "{{ matrix_playbook_reverse_proxyable_services_additional_network }}"
+matrix_synapse_container_labels_traefik_entrypoints: "{{ devture_traefik_entrypoint_primary }}"
+matrix_synapse_container_labels_traefik_tls_certResolver: "{{ devture_traefik_certResolver_primary }}"
+matrix_synapse_container_labels_traefik_hostname: "{{ matrix_server_fqn_matrix }}"
+
+matrix_synapse_container_labels_client_root_redirection_enabled: "{{ matrix_synapse_container_labels_client_root_redirection_url != '' }}"
+matrix_synapse_container_labels_client_root_redirection_url: "{{ (('https://' if matrix_playbook_ssl_enabled else 'http://') + matrix_server_fqn_element) if matrix_client_element_enabled else '' }}"
+
+matrix_synapse_container_labels_federation_api_traefik_entrypoints: "{{ matrix_federation_traefik_entrypoint }}"
+
 # For exposing the Synapse worker (and metrics) ports to the local host.
 matrix_synapse_workers_container_host_bind_address: "{{ matrix_playbook_service_host_bind_interface_prefix[0:-1] if (matrix_synapse_workers_enabled and matrix_playbook_service_host_bind_interface_prefix) else '' }}"
 
@@ -3816,8 +3833,7 @@ matrix_synapse_database_password: "{{ '%s' | format(matrix_homeserver_generic_se
 
 matrix_synapse_macaroon_secret_key: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'synapse.mac', rounds=655555) | to_uuid }}"
 
-# We do not enable TLS in Synapse by default.
-# TLS is handled by the matrix-nginx-proxy, which proxies the requests to Synapse.
+# We do not enable TLS in Synapse by default, since it's handled by Traefik.
 matrix_synapse_tls_federation_listener_enabled: false
 matrix_synapse_tls_certificate_path: ~
 matrix_synapse_tls_private_key_path: ~
@@ -3858,18 +3874,16 @@ matrix_synapse_turn_shared_secret: "{{ matrix_coturn_turn_static_auth_secret if
 
 matrix_synapse_self_check_validate_certificates: "{{ false if matrix_playbook_ssl_retrieval_method == 'self-signed' else true }}"
 
-matrix_synapse_systemd_required_services_list: |
+matrix_synapse_systemd_required_services_list_auto: |
   {{
-    (['docker.service'])
-    +
-    ([devture_postgres_identifier ~ '.service'] if devture_postgres_enabled else [])
+    ([devture_postgres_identifier ~ '.service'] if (devture_postgres_enabled and devture_postgres_container_network != matrix_synapse_container_network and matrix_synapse_database_host == devture_postgres_connection_hostname) else [])
     +
     ([redis_identifier ~ '.service'] if matrix_synapse_redis_enabled and matrix_synapse_redis_host == redis_identifier else [])
     +
     (['matrix-goofys.service'] if matrix_s3_media_store_enabled else [])
   }}
 
-matrix_synapse_systemd_wanted_services_list: |
+matrix_synapse_systemd_wanted_services_list_auto: |
   {{
     (['matrix-coturn.service'] if matrix_coturn_enabled else [])
     +
@@ -3943,7 +3957,7 @@ matrix_synapse_reverse_proxy_companion_container_network: "{{ matrix_synapse_con
 matrix_synapse_reverse_proxy_companion_container_additional_networks: |
   {{
     (
-      ([matrix_playbook_reverse_proxyable_services_additional_network] if matrix_playbook_reverse_proxyable_services_additional_network else [])
+      ([matrix_playbook_reverse_proxyable_services_additional_network] if matrix_synapse_reverse_proxy_companion_container_labels_traefik_enabled and matrix_playbook_reverse_proxyable_services_additional_network else [])
       +
       ([] if matrix_homeserver_container_network in ['', matrix_synapse_reverse_proxy_companion_container_network] else [matrix_homeserver_container_network])
     ) | unique
@@ -3960,15 +3974,11 @@ matrix_synapse_reverse_proxy_companion_container_labels_traefik_entrypoints: "{{
 matrix_synapse_reverse_proxy_companion_container_labels_traefik_tls_certResolver: "{{ devture_traefik_certResolver_primary }}"
 matrix_synapse_reverse_proxy_companion_container_labels_traefik_hostname: "{{ matrix_server_fqn_matrix }}"
 
-matrix_synapse_reverse_proxy_companion_container_labels_client_root_redirection_enabled: "{{ matrix_synapse_reverse_proxy_companion_container_labels_client_root_redirection_url != '' }}"
-matrix_synapse_reverse_proxy_companion_container_labels_client_root_redirection_url: "{{ (('https://' if matrix_playbook_ssl_enabled else 'http://') + matrix_server_fqn_element) if matrix_client_element_enabled else '' }}"
-
-# TODO - enable these (and potentially remove them above/below), when they land in matrix-synapse
-# matrix_synapse_reverse_proxy_companion_container_labels_client_root_redirection_enabled: "{{ matrix_synapse_container_labels_client_root_redirection_enabled != '' }}"
-# matrix_synapse_reverse_proxy_companion_container_labels_client_root_redirection_url: "{{ matrix_synapse_container_labels_client_root_redirection_url }}"
-# matrix_synapse_reverse_proxy_companion_container_labels_client_synapse_client_api_enabled: "{{ matrix_synapse_container_labels_client_synapse_client_api_enabled }}"
-# matrix_synapse_reverse_proxy_companion_container_labels_client_synapse_oidc_api_enabled: "{{ matrix_synapse_container_labels_client_synapse_oidc_api_enabled }}"
-# matrix_synapse_reverse_proxy_companion_container_labels_client_synapse_admin_api_enabled: "{{ matrix_synapse_container_labels_client_synapse_admin_api_enabled }}"
+matrix_synapse_reverse_proxy_companion_container_labels_client_root_redirection_enabled: "{{ matrix_synapse_container_labels_client_root_redirection_enabled != '' }}"
+matrix_synapse_reverse_proxy_companion_container_labels_client_root_redirection_url: "{{ matrix_synapse_container_labels_client_root_redirection_url }}"
+matrix_synapse_reverse_proxy_companion_container_labels_client_synapse_client_api_enabled: "{{ matrix_synapse_container_labels_client_synapse_client_api_enabled }}"
+matrix_synapse_reverse_proxy_companion_container_labels_client_synapse_oidc_api_enabled: "{{ matrix_synapse_container_labels_client_synapse_oidc_api_enabled }}"
+matrix_synapse_reverse_proxy_companion_container_labels_client_synapse_admin_api_enabled: "{{ matrix_synapse_container_labels_client_synapse_admin_api_enabled }}"
 
 matrix_synapse_reverse_proxy_companion_container_labels_federation_api_traefik_entrypoints: "{{ matrix_federation_traefik_entrypoint }}"
 

roles/custom/matrix-synapse/defaults/main.yml

@@ -156,6 +156,88 @@ matrix_synapse_container_metrics_api_host_bind_port: ''
 # Takes an "<ip>:<port>" or "<port>" value (e.g. "127.0.0.1:9100"), or empty string to not expose.
 matrix_synapse_container_manhole_api_host_bind_port: ''
 
+# matrix_synapse_container_labels_traefik_enabled controls whether labels to assist a Traefik reverse-proxy will be attached to the container.
+# See `../templates/labels.j2` for details.
+#
+# To inject your own other container labels, see `matrix_synapse_container_labels_additional_labels`.
+matrix_synapse_container_labels_traefik_enabled: true
+matrix_synapse_container_labels_traefik_docker_network: "{{ matrix_synapse_container_network }}"
+matrix_synapse_container_labels_traefik_entrypoints: web-secure
+matrix_synapse_container_labels_traefik_tls_certResolver: default  # noqa var-naming
+matrix_synapse_container_labels_traefik_hostname: ''
+
+# Controls whether labels will be added for handling the root (/) path
+matrix_synapse_container_labels_client_root_enabled: true
+matrix_synapse_container_labels_client_root_traefik_hostname: "{{ matrix_synapse_container_labels_traefik_hostname }}"
+matrix_synapse_container_labels_client_root_traefik_rule: "Host(`{{ matrix_synapse_container_labels_client_root_traefik_hostname }}`) && Path(`/`)"
+matrix_synapse_container_labels_client_root_traefik_priority: 0
+matrix_synapse_container_labels_client_root_traefik_entrypoints: "{{ matrix_synapse_container_labels_traefik_entrypoints }}"
+matrix_synapse_container_labels_client_root_traefik_tls: "{{ matrix_synapse_container_labels_client_root_traefik_entrypoints != 'web' }}"
+matrix_synapse_container_labels_client_root_traefik_tls_certResolver: "{{ matrix_synapse_container_labels_traefik_tls_certResolver }}"  # noqa var-naming
+matrix_synapse_container_labels_client_root_redirection_enabled: false
+matrix_synapse_container_labels_client_root_redirection_url: ""
+
+# Controls whether labels will be added that expose the Client-Server API.
+matrix_synapse_container_labels_client_api_enabled: true
+matrix_synapse_container_labels_client_api_traefik_hostname: "{{ matrix_synapse_container_labels_traefik_hostname }}"
+matrix_synapse_container_labels_client_api_traefik_path_prefix: /_matrix
+matrix_synapse_container_labels_client_api_traefik_rule: "Host(`{{ matrix_synapse_container_labels_client_api_traefik_hostname }}`) && PathPrefix(`{{ matrix_synapse_container_labels_client_api_traefik_path_prefix }}`)"
+matrix_synapse_container_labels_client_api_traefik_priority: 0
+matrix_synapse_container_labels_client_api_traefik_entrypoints: "{{ matrix_synapse_container_labels_traefik_entrypoints }}"
+matrix_synapse_container_labels_client_api_traefik_tls: "{{ matrix_synapse_container_labels_client_api_traefik_entrypoints != 'web' }}"
+matrix_synapse_container_labels_client_api_traefik_tls_certResolver: "{{ matrix_synapse_container_labels_traefik_tls_certResolver }}"  # noqa var-naming
+
+# Controls whether labels will be added that expose the /_synapse/client paths
+matrix_synapse_container_labels_client_synapse_client_api_enabled: true
+matrix_synapse_container_labels_client_synapse_client_api_traefik_hostname: "{{ matrix_synapse_container_labels_traefik_hostname }}"
+matrix_synapse_container_labels_client_synapse_client_api_traefik_path_prefix: /_synapse/client
+matrix_synapse_container_labels_client_synapse_client_api_traefik_rule: "Host(`{{ matrix_synapse_container_labels_client_synapse_client_api_traefik_hostname }}`) && PathPrefix(`{{ matrix_synapse_container_labels_client_synapse_client_api_traefik_path_prefix }}`)"
+matrix_synapse_container_labels_client_synapse_client_api_traefik_priority: 0
+matrix_synapse_container_labels_client_synapse_client_api_traefik_entrypoints: "{{ matrix_synapse_container_labels_traefik_entrypoints }}"
+matrix_synapse_container_labels_client_synapse_client_api_traefik_tls: "{{ matrix_synapse_container_labels_client_synapse_client_api_traefik_entrypoints != 'web' }}"
+matrix_synapse_container_labels_client_synapse_client_api_traefik_tls_certResolver: "{{ matrix_synapse_container_labels_traefik_tls_certResolver }}"  # noqa var-naming
+
+# Controls whether labels will be added that expose the /_synapse/oidc paths
+# Enable this if you need OpenID Connect authentication support.
+matrix_synapse_container_labels_client_synapse_oidc_api_enabled: false
+matrix_synapse_container_labels_client_synapse_oidc_api_traefik_hostname: "{{ matrix_synapse_container_labels_traefik_hostname }}"
+matrix_synapse_container_labels_client_synapse_oidc_api_traefik_path_prefix: /_synapse/oidc
+matrix_synapse_container_labels_client_synapse_oidc_api_traefik_rule: "Host(`{{ matrix_synapse_container_labels_client_synapse_oidc_api_traefik_hostname }}`) && PathPrefix(`{{ matrix_synapse_container_labels_client_synapse_oidc_api_traefik_path_prefix }}`)"
+matrix_synapse_container_labels_client_synapse_oidc_api_traefik_priority: 0
+matrix_synapse_container_labels_client_synapse_oidc_api_traefik_entrypoints: "{{ matrix_synapse_container_labels_traefik_entrypoints }}"
+matrix_synapse_container_labels_client_synapse_oidc_api_traefik_tls: "{{ matrix_synapse_container_labels_client_synapse_oidc_api_traefik_entrypoints != 'web' }}"
+matrix_synapse_container_labels_client_synapse_oidc_api_traefik_tls_certResolver: "{{ matrix_synapse_container_labels_traefik_tls_certResolver }}"  # noqa var-naming
+
+# Controls whether labels will be added that expose the /_synapse/admin paths
+# Following these recommendations (https://github.com/matrix-org/synapse/blob/master/docs/reverse_proxy.md), by default, we don't.
+matrix_synapse_container_labels_client_synapse_admin_api_enabled: false
+matrix_synapse_container_labels_client_synapse_admin_api_traefik_hostname: "{{ matrix_synapse_container_labels_traefik_hostname }}"
+matrix_synapse_container_labels_client_synapse_admin_api_traefik_path_prefix: /_synapse/admin
+matrix_synapse_container_labels_client_synapse_admin_api_traefik_rule: "Host(`{{ matrix_synapse_container_labels_client_synapse_admin_api_traefik_hostname }}`) && PathPrefix(`{{ matrix_synapse_container_labels_client_synapse_admin_api_traefik_path_prefix }}`)"
+matrix_synapse_container_labels_client_synapse_admin_api_traefik_priority: 0
+matrix_synapse_container_labels_client_synapse_admin_api_traefik_entrypoints: "{{ matrix_synapse_container_labels_traefik_entrypoints }}"
+matrix_synapse_container_labels_client_synapse_admin_api_traefik_tls: "{{ matrix_synapse_container_labels_client_synapse_admin_api_traefik_entrypoints != 'web' }}"
+matrix_synapse_container_labels_client_synapse_admin_api_traefik_tls_certResolver: "{{ matrix_synapse_container_labels_traefik_tls_certResolver }}"  # noqa var-naming
+
+# Controls whether labels will be added that expose the Server-Server API (Federation API).
+matrix_synapse_container_labels_federation_api_enabled: "{{ matrix_synapse_reverse_proxy_companion_federation_api_enabled }}"
+matrix_synapse_container_labels_federation_api_traefik_hostname: "{{ matrix_synapse_container_labels_traefik_hostname }}"
+matrix_synapse_container_labels_federation_api_traefik_path_prefix: /_matrix
+matrix_synapse_container_labels_federation_api_traefik_rule: "Host(`{{ matrix_synapse_container_labels_federation_api_traefik_hostname }}`) && PathPrefix(`{{ matrix_synapse_container_labels_federation_api_traefik_path_prefix }}`)"
+matrix_synapse_container_labels_federation_api_traefik_priority: 0
+matrix_synapse_container_labels_federation_api_traefik_entrypoints: ''
+matrix_synapse_container_labels_federation_api_traefik_tls: "{{ matrix_synapse_container_labels_federation_api_traefik_entrypoints != 'web' }}"
+matrix_synapse_container_labels_federation_api_traefik_tls_certResolver: "{{ matrix_synapse_container_labels_traefik_tls_certResolver }}"  # noqa var-naming
+
+# matrix_synapse_container_labels_additional_labels contains a multiline string with additional labels to add to the container label file.
+# See `../templates/labels.j2` for details.
+#
+# Example:
+# matrix_synapse_container_labels_additional_labels: |
+#   my.label=1
+#   another.label="here"
+matrix_synapse_container_labels_additional_labels: ''
+
 # A list of extra arguments to pass to the container
 # Also see `matrix_synapse_container_arguments`
 matrix_synapse_container_extra_arguments: []
@@ -171,10 +253,16 @@ matrix_synapse_container_extra_arguments_auto: []
 matrix_synapse_container_arguments: "{{ matrix_synapse_container_extra_arguments + matrix_synapse_container_extra_arguments_auto }}"
 
 # List of systemd services that matrix-synapse.service depends on
-matrix_synapse_systemd_required_services_list: ['docker.service']
+matrix_synapse_systemd_required_services_list: "{{ matrix_synapse_systemd_required_services_list_default + matrix_synapse_systemd_required_services_list_auto + matrix_synapse_systemd_required_services_list_custom }}"
+matrix_synapse_systemd_required_services_list_default: ['docker.service']
+matrix_synapse_systemd_required_services_list_auto: []
+matrix_synapse_systemd_required_services_list_custom: []
 
 # List of systemd services that matrix-synapse.service wants
-matrix_synapse_systemd_wanted_services_list: []
+matrix_synapse_systemd_wanted_services_list: "{{ matrix_synapse_systemd_wanted_services_list_default + matrix_synapse_systemd_wanted_services_list_auto + matrix_synapse_systemd_wanted_services_list_custom }}"
+matrix_synapse_systemd_wanted_services_list_default: []
+matrix_synapse_systemd_wanted_services_list_auto: []
+matrix_synapse_systemd_wanted_services_list_custom: []
 
 matrix_synapse_in_container_python_packages_path: "/usr/local/lib/python3.11/site-packages"
 

roles/custom/matrix-synapse/tasks/synapse/setup_install.yml

@@ -115,28 +115,29 @@
     owner: "{{ matrix_synapse_uid }}"
     group: "{{ matrix_synapse_gid }}"
 
-- name: Ensure Synapse log config installed
-  ansible.builtin.template:
-    src: "{{ matrix_synapse_template_synapse_log }}"
-    dest: "{{ matrix_synapse_config_dir_path }}/{{ matrix_server_fqn_matrix }}.log.config"
-    mode: 0644
-
 - name: Ensure Synapse container network is created
   community.general.docker_network:
     name: "{{ matrix_synapse_container_network }}"
     driver: bridge
 
-- name: Ensure matrix-synapse.service installed
+- name: Ensure Synapse support files installed
   ansible.builtin.template:
-    src: "{{ role_path }}/templates/synapse/systemd/matrix-synapse.service.j2"
-    dest: "{{ devture_systemd_docker_base_systemd_path }}/matrix-synapse.service"
-    mode: 0644
-
-- name: Ensure register-user script created
-  ansible.builtin.template:
-    src: "{{ role_path }}/templates/synapse/bin/register-user.j2"
-    dest: "{{ matrix_synapse_bin_path }}/register-user"
-    mode: 0755
+    src: "{{ item.src }}"
+    dest: "{{ item.dest }}"
+    mode: "{{ item.mode }}"
+  with_items:
+    - src: "{{ matrix_synapse_template_synapse_log }}"
+      dest: "{{ matrix_synapse_config_dir_path }}/{{ matrix_server_fqn_matrix }}.log.config"
+      mode: '0644'
+    - src: "{{ role_path }}/templates/synapse/bin/register-user.j2"
+      dest: "{{ matrix_synapse_bin_path }}/register-user"
+      mode: '0755'
+    - src: "{{ role_path }}/templates/synapse/labels.j2"
+      dest: "{{ matrix_synapse_base_path }}/labels"
+      mode: '0644'
+    - src: "{{ role_path }}/templates/synapse/systemd/matrix-synapse.service.j2"
+      dest: "{{ devture_systemd_docker_base_systemd_path }}/matrix-synapse.service"
+      mode: '0644'
 
 - name: Generate sample prometheus.yml for external scraping
   ansible.builtin.template:

roles/custom/matrix-synapse/tasks/validate_config.yml

@@ -3,18 +3,30 @@
 - name: Fail if required Synapse settings not defined
   ansible.builtin.fail:
     msg: >-
-      You need to define a required configuration setting (`{{ item }}`) for using Synapse.
-  when: "vars[item] == ''"
+      You need to define a required configuration setting (`{{ item.name }}`).
+  when: "item.when | bool and vars[item.name] == ''"
   with_items:
-    - matrix_synapse_username
-    - matrix_synapse_uid
-    - matrix_synapse_gid
-    - matrix_synapse_container_network
-    - matrix_synapse_macaroon_secret_key
-    - matrix_synapse_database_host
-    - matrix_synapse_database_user
-    - matrix_synapse_database_password
-    - matrix_synapse_database_database
+    - {'name': 'matrix_synapse_username', when: true}
+    - {'name': 'matrix_synapse_uid', when: true}
+    - {'name': 'matrix_synapse_gid', when: true}
+    - {'name': 'matrix_synapse_container_network', when: true}
+    - {'name': 'matrix_synapse_macaroon_secret_key', when: true}
+    - {'name': 'matrix_synapse_database_host', when: true}
+    - {'name': 'matrix_synapse_database_user', when: true}
+    - {'name': 'matrix_synapse_database_password', when: true}
+    - {'name': 'matrix_synapse_database_database', when: true}
+
+    - {'name': 'matrix_synapse_container_labels_client_root_traefik_hostname', when: "{{ matrix_synapse_container_labels_client_root_enabled }}"}
+    - {'name': 'matrix_synapse_container_labels_client_root_redirection_url', when: "{{ matrix_synapse_container_labels_client_root_redirection_enabled }}"}
+
+    - {'name': 'matrix_synapse_container_labels_client_api_traefik_hostname', when: "{{ matrix_synapse_container_labels_client_api_enabled }}"}
+
+    - {'name': 'matrix_synapse_container_labels_client_synapse_client_api_traefik_hostname', when: "{{ matrix_synapse_container_labels_client_synapse_client_api_enabled }}"}
+    - {'name': 'matrix_synapse_container_labels_client_synapse_oidc_api_traefik_hostname', when: "{{ matrix_synapse_container_labels_client_synapse_oidc_api_enabled }}"}
+    - {'name': 'matrix_synapse_container_labels_client_synapse_admin_api_traefik_hostname', when: "{{ matrix_synapse_container_labels_client_synapse_admin_api_enabled }}"}
+
+    - {'name': 'matrix_synapse_container_labels_federation_api_traefik_hostname', when: "{{ matrix_synapse_container_labels_federation_api_enabled }}"}
+    - {'name': 'matrix_synapse_container_labels_federation_api_traefik_entrypoints', when: "{{ matrix_synapse_container_labels_federation_api_enabled }}"}
 
 - name: Fail if asking for more than 1 instance of single-instance workers
   ansible.builtin.fail:

roles/custom/matrix-synapse/templates/synapse/labels.j2

@@ -0,0 +1,176 @@
+{% if matrix_synapse_container_labels_traefik_enabled %}
+traefik.enable=true
+
+{% if matrix_synapse_container_labels_traefik_docker_network %}
+traefik.docker.network={{ matrix_synapse_container_labels_traefik_docker_network }}
+{% endif %}
+
+traefik.http.services.matrix-synapse-client-api.loadbalancer.server.port=8008
+traefik.http.services.matrix-synapse-federation-api.loadbalancer.server.port=8048
+
+
+{#
+	Root path (/)
+#}
+{% if matrix_synapse_container_labels_client_root_enabled %}
+
+{% set client_root_middlewares = [] %}
+
+{% if matrix_synapse_container_labels_client_root_redirection_enabled %}
+{% set client_root_middlewares = client_root_middlewares + ['matrix-synapse-client-root-redirect'] %}
+traefik.http.middlewares.matrix-synapse-client-root-redirect.redirectregex.regex=(.*)
+traefik.http.middlewares.matrix-synapse-client-root-redirect.redirectregex.replacement={{ matrix_synapse_container_labels_client_root_redirection_url }}
+{% else %}
+{% set client_root_middlewares = client_root_middlewares + ['matrix-synapse-client-root-replacepath'] %}
+traefik.http.middlewares.matrix-synapse-client-root-replacepath.replacepath.path=/_matrix/static/
+{% endif %}
+
+traefik.http.routers.matrix-synapse-client-root.rule={{ matrix_synapse_container_labels_client_root_traefik_rule }}
+
+traefik.http.routers.matrix-synapse-client-root.middlewares={{ client_root_middlewares | join(',') }}
+
+{% if matrix_synapse_container_labels_client_root_traefik_priority | int > 0 %}
+traefik.http.routers.matrix-synapse-client-root.priority={{ matrix_synapse_container_labels_client_root_traefik_priority }}
+{% endif %}
+
+traefik.http.routers.matrix-synapse-client-root.service=matrix-synapse-client-api
+traefik.http.routers.matrix-synapse-client-root.entrypoints={{ matrix_synapse_container_labels_client_root_traefik_entrypoints }}
+traefik.http.routers.matrix-synapse-client-root.tls={{ matrix_synapse_container_labels_client_root_traefik_tls | to_json }}
+
+{% if matrix_synapse_container_labels_client_root_traefik_tls %}
+traefik.http.routers.matrix-synapse-client-root.tls.certResolver={{ matrix_synapse_container_labels_client_root_traefik_tls_certResolver }}
+{% endif %}
+
+{% endif %}
+{#
+	/Root path (/)
+#}
+
+
+{#
+	Client-API (/_matrix)
+#}
+{% if matrix_synapse_container_labels_client_api_enabled %}
+
+traefik.http.routers.matrix-synapse-client-api.rule={{ matrix_synapse_container_labels_client_api_traefik_rule }}
+
+{% if matrix_synapse_container_labels_client_api_traefik_priority | int > 0 %}
+traefik.http.routers.matrix-synapse-client-api.priority={{ matrix_synapse_container_labels_client_api_traefik_priority }}
+{% endif %}
+
+traefik.http.routers.matrix-synapse-client-api.service=matrix-synapse-client-api
+traefik.http.routers.matrix-synapse-client-api.entrypoints={{ matrix_synapse_container_labels_client_api_traefik_entrypoints }}
+traefik.http.routers.matrix-synapse-client-api.tls={{ matrix_synapse_container_labels_client_api_traefik_tls | to_json }}
+
+{% if matrix_synapse_container_labels_client_api_traefik_tls %}
+traefik.http.routers.matrix-synapse-client-api.tls.certResolver={{ matrix_synapse_container_labels_client_api_traefik_tls_certResolver }}
+{% endif %}
+
+{% endif %}
+{#
+	/Client-API (/_matrix)
+#}
+
+
+{#
+	Synapse Admin API (/_synapse/client)
+#}
+{% if matrix_synapse_container_labels_client_synapse_client_api_enabled %}
+
+traefik.http.routers.matrix-synapse-client-synapse-client-api.rule={{ matrix_synapse_container_labels_client_synapse_client_api_traefik_rule }}
+
+{% if matrix_synapse_container_labels_client_synapse_client_api_traefik_priority | int > 0 %}
+traefik.http.routers.matrix-synapse-client-synapse-client-api.priority={{ matrix_synapse_container_labels_client_synapse_client_api_traefik_priority }}
+{% endif %}
+
+traefik.http.routers.matrix-synapse-client-synapse-client-api.service=matrix-synapse-client-synapse-client-api
+traefik.http.routers.matrix-synapse-client-synapse-client-api.entrypoints={{ matrix_synapse_container_labels_client_synapse_client_api_traefik_entrypoints }}
+traefik.http.routers.matrix-synapse-client-synapse-client-api.tls={{ matrix_synapse_container_labels_client_synapse_client_api_traefik_tls | to_json }}
+
+{% if matrix_synapse_container_labels_client_synapse_client_api_traefik_tls %}
+traefik.http.routers.matrix-synapse-client-synapse-client-api.tls.certResolver={{ matrix_synapse_container_labels_client_synapse_client_api_traefik_tls_certResolver }}
+{% endif %}
+
+{% endif %}
+{#
+	/Synapse Admin API (/_synapse/client)
+#}
+
+
+{#
+	Synapse OIDC API (/_synapse/oidc)
+#}
+{% if matrix_synapse_container_labels_client_synapse_oidc_api_enabled %}
+
+traefik.http.routers.matrix-synapse-client-synapse-oidc-api.rule={{ matrix_synapse_container_labels_client_synapse_oidc_api_traefik_rule }}
+
+{% if matrix_synapse_container_labels_client_synapse_oidc_api_traefik_priority | int > 0 %}
+traefik.http.routers.matrix-synapse-client-synapse-oidc-api.priority={{ matrix_synapse_container_labels_client_synapse_oidc_api_traefik_priority }}
+{% endif %}
+
+traefik.http.routers.matrix-synapse-client-synapse-oidc-api.service=matrix-synapse-client-synapse-oidc-api
+traefik.http.routers.matrix-synapse-client-synapse-oidc-api.entrypoints={{ matrix_synapse_container_labels_client_synapse_oidc_api_traefik_entrypoints }}
+traefik.http.routers.matrix-synapse-client-synapse-oidc-api.tls={{ matrix_synapse_container_labels_client_synapse_oidc_api_traefik_tls | to_json }}
+
+{% if matrix_synapse_container_labels_client_synapse_oidc_api_traefik_tls %}
+traefik.http.routers.matrix-synapse-client-synapse-oidc-api.tls.certResolver={{ matrix_synapse_container_labels_client_synapse_oidc_api_traefik_tls_certResolver }}
+{% endif %}
+
+{% endif %}
+{#
+	/Synapse OIDC API (/_synapse/oidc)
+#}
+
+
+{#
+	Synapse Admin API (/_synapse/admin)
+#}
+{% if matrix_synapse_container_labels_client_synapse_admin_api_enabled %}
+
+traefik.http.routers.matrix-synapse-client-synapse-admin-api.rule={{ matrix_synapse_container_labels_client_synapse_admin_api_traefik_rule }}
+
+{% if matrix_synapse_container_labels_client_synapse_admin_api_traefik_priority | int > 0 %}
+traefik.http.routers.matrix-synapse-client-synapse-admin-api.priority={{ matrix_synapse_container_labels_client_synapse_admin_api_traefik_priority }}
+{% endif %}
+
+traefik.http.routers.matrix-synapse-client-synapse-admin-api.service=matrix-synapse-client-synapse-admin-api
+traefik.http.routers.matrix-synapse-client-synapse-admin-api.entrypoints={{ matrix_synapse_container_labels_client_synapse_admin_api_traefik_entrypoints }}
+traefik.http.routers.matrix-synapse-client-synapse-admin-api.tls={{ matrix_synapse_container_labels_client_synapse_admin_api_traefik_tls | to_json }}
+
+{% if matrix_synapse_container_labels_client_synapse_admin_api_traefik_tls %}
+traefik.http.routers.matrix-synapse-client-synapse-admin-api.tls.certResolver={{ matrix_synapse_container_labels_client_synapse_admin_api_traefik_tls_certResolver }}
+{% endif %}
+
+{% endif %}
+{#
+	/Synapse Admin API (/_synapse/admin)
+#}
+
+
+{#
+	Federation-API (/_matrix)
+#}
+{% if matrix_synapse_container_labels_federation_api_enabled %}
+
+traefik.http.routers.matrix-synapse-federation-api.rule={{ matrix_synapse_container_labels_federation_api_traefik_rule }}
+
+{% if matrix_synapse_container_labels_federation_api_traefik_priority | int > 0 %}
+traefik.http.routers.matrix-synapse-federation-api.priority={{ matrix_synapse_container_labels_federation_api_traefik_priority }}
+{% endif %}
+
+traefik.http.routers.matrix-synapse-federation-api.service=matrix-synapse-federation-api
+traefik.http.routers.matrix-synapse-federation-api.entrypoints={{ matrix_synapse_container_labels_federation_api_traefik_entrypoints }}
+traefik.http.routers.matrix-synapse-federation-api.tls={{ matrix_synapse_container_labels_federation_api_traefik_tls | to_json }}
+
+{% if matrix_synapse_container_labels_federation_api_traefik_tls %}
+traefik.http.routers.matrix-synapse-federation-api.tls.certResolver={{ matrix_synapse_container_labels_federation_api_traefik_tls_certResolver }}
+{% endif %}
+
+{% endif %}
+{#
+	/Federation-API (/_matrix)
+#}
+
+{% endif %}
+
+{{ matrix_synapse_container_labels_additional_labels }}

roles/custom/matrix-synapse/templates/synapse/systemd/matrix-synapse.service.j2

@@ -56,6 +56,7 @@ ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} create \
 			{% endif %}
 			--mount type=bind,src={{ matrix_synapse_config_dir_path }},dst=/data,ro \
 			--mount type=bind,src={{ matrix_synapse_storage_path }},dst=/matrix-media-store-parent,bind-propagation=slave \
+			--label-file={{ matrix_synapse_base_path }}/labels \
 			{% for volume in matrix_synapse_container_additional_volumes %}
 			-v {{ volume.src }}:{{ volume.dst }}:{{ volume.options }} \
 			{% endfor %}