mirror/matrix-docker-ansible-deploy
1
0
Fork 0
mirror of https://github.com/spantaleev/matrix-docker-ansible-deploy.git synced 2025-06-26 03:07:51 +02:00
Code Issues Packages Projects Releases Wiki Activity

Move roles/matrix* to roles/custom/matrix*

Browse Source 
This paves the way for installing other roles into `roles/galaxy` using `ansible-galaxy`,
similar to how it's done in:

- https://github.com/spantaleev/gitea-docker-ansible-deploy
- https://github.com/spantaleev/nextcloud-docker-ansible-deploy

In the near future, we'll be removing a lot of the shared role code from here
and using upstream roles for it. Some of the core `matrix-*` roles have
already been extracted out into other reusable roles:

- https://github.com/devture/com.devture.ansible.role.postgres
- https://github.com/devture/com.devture.ansible.role.systemd_docker_base
- https://github.com/devture/com.devture.ansible.role.timesync
- https://github.com/devture/com.devture.ansible.role.vars_preserver
- https://github.com/devture/com.devture.ansible.role.playbook_runtime_messages
- https://github.com/devture/com.devture.ansible.role.playbook_help

We just need to migrate to those.
This commit is contained in:
Slavi Pantaleev
2022-11-03 09:11:29 +02:00
parent 6c131138ad
commit 410a915a8a
722 changed files with 148 additions and 145 deletions
Download Patch File Download Diff File Expand all files Collapse all files

81
roles/custom/matrix-aux/defaults/main.yml Normal file
View File

@ -0,0 +1,81 @@
---
# matrix-aux is a role that manages auxiliary files and directories on your Matrix server.
#
# Certain components (like matrix-synapse, etc.) may sometimes require additional templates (email templates, privacy policies, etc.).
# This role allows such files to be managed by the playbook.
#
# Note that files and directories created via this role are not automatically made available for containers to use.
# If you use this role to put files in a directory that's already mounted into a container,
# you can access the files without additional work.
# Otherwise, you'd need to mount the file/directory to the container that needs it.
# Roles usually provide a `matrix_*_additional_volumes` or `matrix_*_container_extra_arguments` variable
# that you can use to mount an additional volume.
# The default permission mode when creating directories using `matrix_aux_directory_definitions`
matrix_aux_directory_default_mode: '0750'
# Holds a list of directories to create on the server.
#
# By default, directories are:
# - created with permissions as specified in `matrix_aux_directory_default_mode`
# - owned by the `matrix_user_username` user and `matrix_user_groupname` group (usually `matrix:matrix`)
#
# Example:
#
# matrix_aux_directory_definitions:
# - dest: /matrix/aux
#
# - dest: /matrix/another
# mode: '0700'
# owner: 'some-user'
# group: 'some-group'
matrix_aux_directory_definitions: []
# The default permission mode when creating directories using `matrix_aux_directory_definitions`
matrix_aux_file_default_mode: '0640'
# Holds a list of files to create on the server.
#
# By default, files are:
# - created with permissions as specified in `matrix_aux_file_default_mode`
# - owned by the `matrix_user_username` user and `matrix_user_groupname` group (usually `matrix:matrix`)
#
# You can define the file content inline (in your `vars.yml` file) or as an external file (see the example below).
# Defining the content inline in `vars.yml` has the benefit of not splitting your configuration into multiple files,
# but rather keeping everything inside `vars.yml` (which also gets backed up on the server in `/matrix/vars.yml`).
#
# Note: parent paths for files must exist.
# If you've defined a file with a destination of `/matrix/some/path/file.txt`,
# then you likely need to add `/matrix/some/path` to `matrix_aux_directory_definitions` as well.
# You don't need to do this for directories that the playbook already creates for you.
#
# Use a `content` key for text content and `src` with a location to a file for binary content.
# The `content` key does not support binary content (see https://github.com/ansible/ansible/issues/11594).
#
# Example:
#
# matrix_aux_file_definitions:
# - dest: "{{ matrix_synapse_config_dir_path }}/something.html"
# content: |
# <!doctype html>
# <html><body>Something</body></html>
#
# - dest: /matrix/aux/some-other-file.txt
# content: "Something"
# mode: '0600'
# owner: 'some-user'
# group: 'some-group'
#
# - dest: /matrix/aux/yet-another-file.txt
# content: "{{ lookup('template', '/path/to/file.txt.j2') }}"
# mode: '0600'
# owner: 'some-user'
# group: 'some-group'
#
# - dest: /matrix/aux/binary-file.dat
# src: "/path/to/binary.dat"
# mode: '0600'
# owner: 'some-user'
# group: 'some-group'
matrix_aux_file_definitions: []

7
roles/custom/matrix-aux/tasks/main.yml Normal file
View File

@ -0,0 +1,7 @@
---
- ansible.builtin.import_tasks: "{{ role_path }}/tasks/setup.yml"
when: run_stop | bool
tags:
- setup-all
- setup-aux-files

20
roles/custom/matrix-aux/tasks/setup.yml Normal file
View File

@ -0,0 +1,20 @@
---
- name: Ensure AUX directories are created
ansible.builtin.file:
dest: "{{ item.dest }}"
state: directory
owner: "{{ item.owner | default(matrix_user_username) }}"
group: "{{ item.group | default(matrix_user_groupname) }}"
mode: "{{ item.mode | default(matrix_aux_directory_default_mode) }}"
with_items: "{{ matrix_aux_directory_definitions }}"
- name: Ensure AUX files are created
ansible.builtin.copy:
src: "{{ item.src if 'src' in item else omit }}"
content: "{{ item.content if 'content' in item else omit }}"
dest: "{{ item.dest }}"
owner: "{{ item.owner | default(matrix_user_username) }}"
group: "{{ item.group | default(matrix_user_groupname) }}"
mode: "{{ item.mode | default(matrix_aux_file_default_mode) }}"
with_items: "{{ matrix_aux_file_definitions }}"

104
roles/custom/matrix-backup-borg/defaults/main.yml Normal file
View File

@ -0,0 +1,104 @@
---
# Project source code URL: https://gitlab.com/etke.cc/borgmatic
matrix_backup_borg_enabled: true
matrix_backup_borg_base_path: "{{ matrix_base_data_path }}/backup-borg"
matrix_backup_borg_config_path: "{{ matrix_backup_borg_base_path }}/config"
matrix_backup_borg_container_image_self_build: false
matrix_backup_borg_docker_repo: "https://gitlab.com/etke.cc/borgmatic"
matrix_backup_borg_docker_repo_version: main
matrix_backup_borg_docker_src_files_path: "{{ matrix_backup_borg_base_path }}/docker-src"
# version determined automatically, based on postgres server version (if enabled), otherwise latest is used
matrix_backup_borg_version: ""
matrix_backup_borg_docker_image: "{{ matrix_backup_borg_docker_image_name_prefix }}etke.cc/borgmatic:{{ matrix_backup_borg_version }}"
matrix_backup_borg_docker_image_name_prefix: "{{ 'localhost/' if matrix_backup_borg_container_image_self_build else 'registry.gitlab.com/' }}"
matrix_backup_borg_docker_image_force_pull: "{{ matrix_backup_borg_docker_image.endswith(':latest') or matrix_backup_borg_version | default('') == '' }}"
# A list of extra arguments to pass to the container
matrix_backup_borg_container_extra_arguments: []
# List of systemd services that matrix-backup-borg.service depends on
matrix_backup_borg_systemd_required_services_list: ['docker.service']
# List of systemd services that matrix-backup-borg.service wants
matrix_backup_borg_systemd_wanted_services_list: []
# systemd calendar configuration for the backup job
# the actual job may run with a delay (see matrix_backup_borg_schedule_randomized_delay_sec)
matrix_backup_borg_schedule: "*-*-* 04:00:00"
# the delay with which the systemd timer may run in relation to the `matrix_backup_borg_schedule` schedule
matrix_backup_borg_schedule_randomized_delay_sec: 2h
# what directories should be added to backup
matrix_backup_borg_location_source_directories: []
# postgres db backup
matrix_backup_borg_postgresql_enabled: true
matrix_backup_borg_supported_postgres_versions: ['12', '13', '14']
matrix_backup_borg_postgresql_databases: []
matrix_backup_borg_postgresql_databases_hostname: "matrix-postgres"
matrix_backup_borg_postgresql_databases_username: "matrix"
matrix_backup_borg_postgresql_databases_password: ""
matrix_backup_borg_postgresql_databases_port: 5432
# target repositories
matrix_backup_borg_location_repositories: []
# exclude following paths:
matrix_backup_borg_location_exclude_patterns: []
# borg encryption mode, only "repokey-*" and "none" are supported
matrix_backup_borg_encryption: repokey-blake2
# private ssh key used to connect to the borg repo
matrix_backup_borg_ssh_key_private: ""
# allow unencrypted repo access
matrix_backup_borg_unknown_unencrypted_repo_access_is_ok: "{{ matrix_backup_borg_encryption == 'none' }}"
# borg ssh command with ssh key
matrix_backup_borg_storage_ssh_command: ssh -o "StrictHostKeyChecking accept-new" -i /etc/borgmatic.d/sshkey
# compression algorithm
matrix_backup_borg_storage_compression: lz4
# archive name format
matrix_backup_borg_storage_archive_name_format: matrix-{now:%Y-%m-%d-%H%M%S}
# repository passphrase
matrix_backup_borg_storage_encryption_passphrase: ""
# retention configuration
matrix_backup_borg_retention_keep_hourly: 0
matrix_backup_borg_retention_keep_daily: 7
matrix_backup_borg_retention_keep_weekly: 4
matrix_backup_borg_retention_keep_monthly: 12
matrix_backup_borg_retention_keep_yearly: 2
# retention prefix
matrix_backup_borg_retention_prefix: matrix-
# Default borgmatic configuration template which covers the generic use case.
# You can customize it by controlling the various variables inside it.
#
# For a more advanced customization, you can extend the default (see `matrix_backup_borg_configuration_extension_yaml`)
# or completely replace this variable with your own template.
matrix_backup_borg_configuration_yaml: "{{ lookup('template', 'templates/config.yaml.j2') }}"
matrix_backup_borg_configuration_extension_yaml: |
# Your custom YAML configuration for borgmatic goes here.
# This configuration extends the default starting configuration (`matrix_borg_configuration_yaml`).
#
# You can override individual variables from the default configuration, or introduce new ones.
#
# If you need something more special, you can take full control by
# completely redefining `matrix_backup_borg_configuration_yaml`.
matrix_backup_borg_configuration_extension: "{{ matrix_backup_borg_configuration_extension_yaml | from_yaml if matrix_backup_borg_configuration_extension_yaml | from_yaml is mapping else {} }}"
# Holds the final borgmatic configuration (a combination of the default and its extension).
# You most likely don't need to touch this variable. Instead, see `matrix_backup_borg_configuration_yaml`.
matrix_backup_borg_configuration: "{{ matrix_backup_borg_configuration_yaml | from_yaml | combine(matrix_backup_borg_configuration_extension, recursive=True) }}"

4
roles/custom/matrix-backup-borg/tasks/init.yml Normal file
View File

@ -0,0 +1,4 @@
---
- ansible.builtin.set_fact:
matrix_systemd_services_list: "{{ matrix_systemd_services_list + ['matrix-backup-borg.timer'] }}"
when: matrix_backup_borg_enabled | bool

23
roles/custom/matrix-backup-borg/tasks/main.yml Normal file
View File

@ -0,0 +1,23 @@
---
- ansible.builtin.import_tasks: "{{ role_path }}/tasks/init.yml"
tags:
- always
- ansible.builtin.import_tasks: "{{ role_path }}/tasks/validate_config.yml"
when: "run_setup | bool and matrix_backup_borg_enabled | bool"
tags:
- setup-all
- setup-backup-borg
- ansible.builtin.import_tasks: "{{ role_path }}/tasks/setup_install.yml"
when: "run_setup | bool and matrix_backup_borg_enabled | bool"
tags:
- setup-all
- setup-backup-borg
- ansible.builtin.import_tasks: "{{ role_path }}/tasks/setup_uninstall.yml"
when: "run_setup | bool and not matrix_backup_borg_enabled | bool"
tags:
- setup-all
- setup-backup-borg

123
roles/custom/matrix-backup-borg/tasks/setup_install.yml Normal file
View File

@ -0,0 +1,123 @@
---
- when: matrix_backup_borg_postgresql_enabled | bool and matrix_backup_borg_version == ''
block:
- name: Fail with matrix_backup_borg_version advice if Postgres not enabled
ansible.builtin.fail:
msg: >-
You are not running a built-in Postgres server (`matrix_postgres_enabled: false`), so auto-detecting its version and setting `matrix_backup_borg_version` automatically based on that cannot happen.
Consider setting `matrix_backup_borg_version` to your Postgres version manually.
when: not matrix_postgres_enabled
- ansible.builtin.import_role:
name: custom/matrix-postgres
tasks_from: detect_existing_postgres_version
- name: Fail if detected Postgres version is unsupported
ansible.builtin.fail:
msg: "You cannot use borg backup with such an old version ({{ matrix_postgres_detected_version }}) of Postgres. Consider upgrading - link to docs for upgrading Postgres: docs/maintenance-postgres.md#upgrading-postgresql"
when: "matrix_postgres_detected_version not in matrix_backup_borg_supported_postgres_versions"
- name: Set the correct borg backup version to use
ansible.builtin.set_fact:
matrix_backup_borg_version: "{{ matrix_postgres_detected_version }}"
- name: Ensure borg paths exist
ansible.builtin.file:
path: "{{ item.path }}"
state: directory
mode: 0750
owner: "{{ matrix_user_username }}"
group: "{{ matrix_user_groupname }}"
with_items:
- {path: "{{ matrix_backup_borg_config_path }}", when: true}
- {path: "{{ matrix_backup_borg_docker_src_files_path }}", when: true}
when: "item.when | bool"
- name: Ensure borgmatic config is created
ansible.builtin.copy:
content: "{{ matrix_backup_borg_configuration | to_nice_yaml(indent=2, width=999999) }}"
dest: "{{ matrix_backup_borg_config_path }}/config.yaml"
owner: "{{ matrix_user_username }}"
group: "{{ matrix_user_groupname }}"
mode: 0640
- name: Ensure borg passwd is created
ansible.builtin.template:
src: "{{ role_path }}/templates/passwd.j2"
dest: "{{ matrix_backup_borg_config_path }}/passwd"
owner: "{{ matrix_user_username }}"
group: "{{ matrix_user_groupname }}"
mode: 0640
- name: Ensure borg ssh key is created
ansible.builtin.template:
src: "{{ role_path }}/templates/sshkey.j2"
dest: "{{ matrix_backup_borg_config_path }}/sshkey"
owner: "{{ matrix_user_username }}"
group: "{{ matrix_user_groupname }}"
mode: 0600
- name: Ensure borg image is pulled
community.docker.docker_image:
name: "{{ matrix_backup_borg_docker_image }}"
source: "{{ 'pull' if ansible_version.major > 2 or ansible_version.minor > 7 else omit }}"
force_source: "{{ matrix_backup_borg_docker_image_force_pull if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}"
force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else matrix_backup_borg_docker_image_force_pull }}"
when: "not matrix_backup_borg_container_image_self_build | bool"
register: result
retries: "{{ matrix_container_retries_count }}"
delay: "{{ matrix_container_retries_delay }}"
until: result is not failed
- name: Ensure borg repository is present on self-build
ansible.builtin.git:
repo: "{{ matrix_backup_borg_docker_repo }}"
version: "{{ matrix_backup_borg_docker_repo_version }}"
dest: "{{ matrix_backup_borg_docker_src_files_path }}"
force: "yes"
become: true
become_user: "{{ matrix_user_username }}"
register: matrix_backup_borg_git_pull_results
when: "matrix_backup_borg_container_image_self_build | bool"
- name: Ensure borg image is built
community.docker.docker_image:
name: "{{ matrix_backup_borg_docker_image }}"
source: build
force_source: "{{ matrix_backup_borg_git_pull_results.changed if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}"
force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else matrix_mailer_git_pull_results.changed }}"
build:
dockerfile: Dockerfile
path: "{{ matrix_backup_borg_docker_src_files_path }}"
pull: true
when: "matrix_backup_borg_container_image_self_build | bool"
- name: Ensure matrix-backup-borg.service installed
ansible.builtin.template:
src: "{{ role_path }}/templates/systemd/matrix-backup-borg.service.j2"
dest: "{{ matrix_systemd_path }}/matrix-backup-borg.service"
mode: 0644
register: matrix_backup_borg_systemd_service_result
- name: Ensure matrix-backup-borg.timer installed
ansible.builtin.template:
src: "{{ role_path }}/templates/systemd/matrix-backup-borg.timer.j2"
dest: "{{ matrix_systemd_path }}/matrix-backup-borg.timer"
mode: 0644
register: matrix_backup_borg_systemd_timer_result
- name: Ensure systemd reloaded after matrix-backup-borg.service installation
ansible.builtin.service:
daemon_reload: true
when: "matrix_backup_borg_systemd_service_result.changed | bool"
- name: Ensure matrix-backup-borg.service enabled
ansible.builtin.service:
enabled: true
name: matrix-backup-borg.service
- name: Ensure matrix-backup-borg.timer enabled
ansible.builtin.service:
enabled: true
name: matrix-backup-borg.timer

41
roles/custom/matrix-backup-borg/tasks/setup_uninstall.yml Normal file
View File

@ -0,0 +1,41 @@
---
- name: Check existence of matrix-backup-borg service
ansible.builtin.stat:
path: "{{ matrix_systemd_path }}/matrix-backup-borg.service"
register: matrix_backup_borg_service_stat
- name: Ensure matrix-backup-borg is stopped
ansible.builtin.service:
name: matrix-backup-borg
state: stopped
enabled: false
daemon_reload: true
register: stopping_result
when: "matrix_backup_borg_service_stat.stat.exists | bool"
- name: Ensure matrix-backup-borg.service doesn't exist
ansible.builtin.file:
path: "{{ matrix_systemd_path }}/matrix-backup-borg.service"
state: absent
when: "matrix_backup_borg_service_stat.stat.exists | bool"
- name: Ensure matrix-backup-borg.timer doesn't exist
ansible.builtin.file:
path: "{{ matrix_systemd_path }}/matrix-backup-borg.timer"
state: absent
when: "matrix_backup_borg_service_stat.stat.exists | bool"
- name: Ensure systemd reloaded after matrix-backup-borg.service removal
ansible.builtin.service:
daemon_reload: true
when: "matrix_backup_borg_service_stat.stat.exists | bool"
- name: Ensure Matrix borg paths don't exist
ansible.builtin.file:
path: "{{ matrix_backup_borg_base_path }}"
state: absent
- name: Ensure borg Docker image doesn't exist
community.docker.docker_image:
name: "{{ matrix_backup_borg_docker_image }}"
state: absent

15
roles/custom/matrix-backup-borg/tasks/validate_config.yml Normal file
View File

@ -0,0 +1,15 @@
---
- name: Fail if required settings not defined
ansible.builtin.fail:
msg: >-
You need to define a required configuration setting (`{{ item }}`).
when: "vars[item] == ''"
with_items:
- "matrix_backup_borg_ssh_key_private"
- "matrix_backup_borg_location_repositories"
- name: Fail if encryption passphrase is undefined unless repository is unencrypted
ansible.builtin.fail:
msg: >-
You need to define a required passphrase using the `matrix_backup_borg_storage_encryption_passphrase` variable.
when: "matrix_backup_borg_storage_encryption_passphrase == '' and matrix_backup_borg_encryption != 'none'"

43
roles/custom/matrix-backup-borg/templates/config.yaml.j2 Normal file
View File

@ -0,0 +1,43 @@
#jinja2: lstrip_blocks: "True", trim_blocks: "True"
location:
source_directories: {{ matrix_backup_borg_location_source_directories|to_json }}
repositories: {{ matrix_backup_borg_location_repositories|to_json }}
one_file_system: true
exclude_patterns: {{ matrix_backup_borg_location_exclude_patterns|to_json }}
storage:
compression: {{ matrix_backup_borg_storage_compression|to_json }}
ssh_command: {{ matrix_backup_borg_storage_ssh_command|to_json }}
archive_name_format: {{ matrix_backup_borg_storage_archive_name_format|to_json }}
encryption_passphrase: {{ matrix_backup_borg_storage_encryption_passphrase|to_json }}
unknown_unencrypted_repo_access_is_ok: {{ matrix_backup_borg_unknown_unencrypted_repo_access_is_ok|to_json }}
retention:
keep_hourly: {{ matrix_backup_borg_retention_keep_hourly|to_json }}
keep_daily: {{ matrix_backup_borg_retention_keep_daily|to_json }}
keep_weekly: {{ matrix_backup_borg_retention_keep_weekly|to_json }}
keep_monthly: {{ matrix_backup_borg_retention_keep_monthly|to_json }}
keep_yearly: {{ matrix_backup_borg_retention_keep_yearly|to_json }}
prefix: {{ matrix_backup_borg_retention_prefix|to_json }}
consistency:
checks:
- repository
- archives
hooks:
{% if matrix_backup_borg_postgresql_enabled and matrix_backup_borg_postgresql_databases|length > 0 %}
postgresql_databases:
{% for database in matrix_backup_borg_postgresql_databases %}
- name: {{ database|to_json }}
hostname: {{ matrix_backup_borg_postgresql_databases_hostname|to_json }}
username: {{ matrix_backup_borg_postgresql_databases_username|to_json }}
password: {{ matrix_backup_borg_postgresql_databases_password|to_json }}
port: {{ matrix_backup_borg_postgresql_databases_port|to_json }}
{% endfor %}
{% endif %}
after_backup:
- echo "Backup created."
on_error:
- echo "Error while creating a backup."

29
roles/custom/matrix-backup-borg/templates/passwd.j2 Normal file
View File

@ -0,0 +1,29 @@
{# the passwd file with correct username, UID and GID is mandatory to work with borg over ssh, otherwise ssh connections will fail #}
root:x:0:0:root:/root:/bin/ash
bin:x:1:1:bin:/bin:/sbin/nologin
daemon:x:2:2:daemon:/sbin:/sbin/nologin
adm:x:3:4:adm:/var/adm:/sbin/nologin
lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
sync:x:5:0:sync:/sbin:/bin/sync
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
halt:x:7:0:halt:/sbin:/sbin/halt
mail:x:8:12:mail:/var/mail:/sbin/nologin
news:x:9:13:news:/usr/lib/news:/sbin/nologin
uucp:x:10:14:uucp:/var/spool/uucppublic:/sbin/nologin
operator:x:11:0:operator:/root:/sbin/nologin
man:x:13:15:man:/usr/man:/sbin/nologin
postmaster:x:14:12:postmaster:/var/mail:/sbin/nologin
cron:x:16:16:cron:/var/spool/cron:/sbin/nologin
ftp:x:21:21::/var/lib/ftp:/sbin/nologin
sshd:x:22:22:sshd:/dev/null:/sbin/nologin
at:x:25:25:at:/var/spool/cron/atjobs:/sbin/nologin
squid:x:31:31:Squid:/var/cache/squid:/sbin/nologin
xfs:x:33:33:X Font Server:/etc/X11/fs:/sbin/nologin
games:x:35:35:games:/usr/games:/sbin/nologin
cyrus:x:85:12::/usr/cyrus:/sbin/nologin
vpopmail:x:89:89::/var/vpopmail:/sbin/nologin
ntp:x:123:123:NTP:/var/empty:/sbin/nologin
smmsp:x:209:209:smmsp:/var/spool/mqueue:/sbin/nologin
guest:x:405:100:guest:/dev/null:/sbin/nologin
{{ matrix_user_username }}:x:{{ matrix_user_uid }}:{{ matrix_user_gid }}:Matrix:/tmp:/bin/ash
nobody:x:65534:65534:nobody:/:/sbin/nologin

1
roles/custom/matrix-backup-borg/templates/sshkey.j2 Normal file
View File

@ -0,0 +1 @@
{{ matrix_backup_borg_ssh_key_private }}

58
roles/custom/matrix-backup-borg/templates/systemd/matrix-backup-borg.service.j2 Normal file
View File

@ -0,0 +1,58 @@
#jinja2: lstrip_blocks: "True"
[Unit]
Description=Matrix Borg Backup
{% for service in matrix_backup_borg_systemd_required_services_list %}
Requires={{ service }}
After={{ service }}
{% endfor %}
{% for service in matrix_backup_borg_systemd_wanted_services_list %}
Wants={{ service }}
{% endfor %}
DefaultDependencies=no
[Service]
Type=oneshot
Environment="HOME={{ matrix_systemd_unit_home_path }}"
ExecStartPre=-{{ matrix_host_command_sh }} -c '{{ matrix_host_command_docker }} kill matrix-backup-borg 2>/dev/null || true'
ExecStartPre=-{{ matrix_host_command_sh }} -c '{{ matrix_host_command_docker }} rm matrix-backup-borg 2>/dev/null || true'
ExecStartPre=-{{ matrix_host_command_docker }} run --rm --name matrix-backup-borg \
--log-driver=none \
--cap-drop=ALL \
--read-only \
--user={{ matrix_user_uid }}:{{ matrix_user_gid }} \
--network={{ matrix_docker_network }} \
--tmpfs=/tmp:rw,noexec,nosuid,size=100m \
--mount type=bind,src={{ matrix_backup_borg_config_path }}/passwd,dst=/etc/passwd,ro \
--mount type=bind,src={{ matrix_backup_borg_config_path }},dst=/etc/borgmatic.d,ro \
{% for source in matrix_backup_borg_location_source_directories %}
--mount type=bind,src={{ source }},dst={{ source }},ro \
{% endfor %}
{% for arg in matrix_backup_borg_container_extra_arguments %}
{{ arg }} \
{% endfor %}
{{ matrix_backup_borg_docker_image }} \
sh -c "borgmatic --init --encryption {{ matrix_backup_borg_encryption }}"
ExecStart={{ matrix_host_command_docker }} run --rm --name matrix-backup-borg \
--log-driver=none \
--cap-drop=ALL \
--read-only \
--user={{ matrix_user_uid }}:{{ matrix_user_gid }} \
--network={{ matrix_docker_network }} \
--tmpfs=/tmp:rw,noexec,nosuid,size=100m \
--mount type=bind,src={{ matrix_backup_borg_config_path }}/passwd,dst=/etc/passwd,ro \
--mount type=bind,src={{ matrix_backup_borg_config_path }},dst=/etc/borgmatic.d,ro \
{% for source in matrix_backup_borg_location_source_directories %}
--mount type=bind,src={{ source }},dst={{ source }},ro \
{% endfor %}
{% for arg in matrix_backup_borg_container_extra_arguments %}
{{ arg }} \
{% endfor %}
{{ matrix_backup_borg_docker_image }}
ExecStop=-{{ matrix_host_command_sh }} -c '{{ matrix_host_command_docker }} kill matrix-backup-borg 2>/dev/null || true'
ExecStop=-{{ matrix_host_command_sh }} -c '{{ matrix_host_command_docker }} rm matrix-backup-borg 2>/dev/null || true'
SyslogIdentifier=matrix-backup-borg
[Install]
WantedBy=multi-user.target

10
roles/custom/matrix-backup-borg/templates/systemd/matrix-backup-borg.timer.j2 Normal file
View File

@ -0,0 +1,10 @@
[Unit]
Description=Matrix Borg Backup timer
[Timer]
Unit=matrix-backup-borg.service
OnCalendar={{ matrix_backup_borg_schedule }}
RandomizedDelaySec={{ matrix_backup_borg_schedule_randomized_delay_sec }}
[Install]
WantedBy=timers.target

305
roles/custom/matrix-base/defaults/main.yml Normal file
View File

@ -0,0 +1,305 @@
---
# The bare domain name which represents your Matrix identity.
# Matrix user ids for your server will be of the form (`@user:<matrix-domain>`).
#
# Note: this playbook does not touch the server referenced here.
# Installation happens on another server ("matrix.<matrix-domain>", see `matrix_server_fqn_matrix`).
#
# Example value: example.com
matrix_domain: ~
# The optional matrix admin MXID, used in bridges' configs to set bridge admin user
# Example value: "@someone:{{ matrix_domain }}"
matrix_admin: ''
# Homeserver admin contacts and support page as per MSC 1929
# See: https://github.com/matrix-org/matrix-spec-proposals/pull/1929
# Users in form:
# matrix_homeserver_admin_contacts:
# - matrix_id: @admin:domain.tld
# email_address: admin@domain.tld
# role: admin
# - email_address: security@domain.tld
# role: security
# Also see: `matrix_well_known_matrix_support_enabled`
matrix_homeserver_admin_contacts: []
# Url string like https://domain.tld/support.html
# Also see: `matrix_well_known_matrix_support_enabled`
matrix_homeserver_support_url: ''
# This will contain the homeserver implementation that is in use.
# Valid values: synapse, dendrite, conduit
#
# By default, we use Synapse, because it's the only full-featured Matrix server at the moment.
#
# This value automatically influences other variables (`matrix_synapse_enabled`, `matrix_dendrite_enabled`, etc.).
# The homeserver implementation of an existing server cannot be changed without data loss.
matrix_homeserver_implementation: synapse
# This contains a secret, which is used for generating various other secrets later on.
matrix_homeserver_generic_secret_key: ''
# This is where your data lives and what we set up.
# This and the Element FQN (see below) are expected to be on the same server.
matrix_server_fqn_matrix: "matrix.{{ matrix_domain }}"
# This is where you access federation API.
matrix_server_fqn_matrix_federation: '{{ matrix_server_fqn_matrix }}'
# This is where you access the Element web UI from (if enabled via matrix_client_element_enabled; enabled by default).
# This and the Matrix FQN (see above) are expected to be on the same server.
matrix_server_fqn_element: "element.{{ matrix_domain }}"
# This is where you access the Hydrogen web client from (if enabled via matrix_client_hydrogen_enabled; disabled by default).
matrix_server_fqn_hydrogen: "hydrogen.{{ matrix_domain }}"
# This is where you access the Cinny web client from (if enabled via matrix_client_cinny_enabled; disabled by default).
matrix_server_fqn_cinny: "cinny.{{ matrix_domain }}"
# This is where you access the buscarron bot from (if enabled via matrix_bot_buscarron_enabled; disabled by default).
matrix_server_fqn_buscarron: "buscarron.{{ matrix_domain }}"
# This is where you access the Dimension.
matrix_server_fqn_dimension: "dimension.{{ matrix_domain }}"
# For use with Go-NEB! (github callback url for example)
matrix_server_fqn_bot_go_neb: "goneb.{{ matrix_domain }}"
# This is where you access Jitsi.
matrix_server_fqn_jitsi: "jitsi.{{ matrix_domain }}"
# This is where you access Grafana.
matrix_server_fqn_grafana: "stats.{{ matrix_domain }}"
# This is where you access the Sygnal push gateway.
matrix_server_fqn_sygnal: "sygnal.{{ matrix_domain }}"
# This is where you access the ntfy push notification service.
matrix_server_fqn_ntfy: "ntfy.{{ matrix_domain }}"
matrix_federation_public_port: 8448
# The architecture that your server runs.
# Recognized values by us are 'amd64', 'arm32' and 'arm64'.
# Not all architectures support all services, so your experience (on non-amd64) may vary.
# See docs/alternative-architectures.md
matrix_architecture: amd64
# The architecture for Debian packages.
# See: https://wiki.debian.org/SupportedArchitectures
# We just remap from our `matrix_architecture` values to what Debian and possibly other distros call things.
matrix_debian_arch: "{{ 'armhf' if matrix_architecture == 'arm32' else matrix_architecture }}"
matrix_container_global_registry_prefix: "docker.io/"
# Each docker pull will retry on failed attempt 10 times with delay of 10 seconds between each attempt.
matrix_container_retries_count: 10
matrix_container_retries_delay: 10
# Each get_url will retry on failed attempt 10 times with delay of 10 seconds between each attempt.
matrix_geturl_retries_count: 10
matrix_geturl_retries_delay: 10
matrix_user_username: "matrix"
matrix_user_groupname: "matrix"
# By default, the playbook creates the user (`matrix_user_username`)
# and group (`matrix_user_groupname`) with a random id.
# To use a specific user/group id, override these variables.
matrix_user_uid: ~
matrix_user_gid: ~
matrix_base_data_path: "/matrix"
matrix_base_data_path_mode: "750"
matrix_static_files_base_path: "{{ matrix_base_data_path }}/static-files"
matrix_systemd_path: "/etc/systemd/system"
# Specifies the path to use for the `HOME` environment variable for systemd unit files.
# Docker 20.10 complains with `WARNING: Error loading config file: .dockercfg: $HOME is not defined`
# if `$HOME` is not defined, so we define something to make it happy.
matrix_systemd_unit_home_path: /root
# This is now unused. We keep it so that cleanup tasks can use it.
# To be removed in the future.
matrix_cron_path: "/etc/cron.d"
matrix_local_bin_path: "/usr/local/bin"
matrix_host_command_docker: "/usr/bin/env docker"
matrix_host_command_sleep: "/usr/bin/env sleep"
matrix_host_command_chown: "/usr/bin/env chown"
matrix_host_command_fusermount: "/usr/bin/env fusermount"
matrix_host_command_openssl: "/usr/bin/env openssl"
matrix_host_command_systemctl: "/usr/bin/env systemctl"
matrix_host_command_sh: "/usr/bin/env sh"
matrix_ntpd_package: "{{ 'systemd-timesyncd' if (ansible_os_family == 'RedHat' and ansible_distribution_major_version | int > 7) or (ansible_distribution == 'Ubuntu' and ansible_distribution_major_version | int > 18) else ('systemd' if ansible_os_family == 'Suse' else 'ntp') }}"
matrix_ntpd_service: "{{ 'systemd-timesyncd' if (ansible_os_family == 'RedHat' and ansible_distribution_major_version | int > 7) or (ansible_distribution == 'Ubuntu' and ansible_distribution_major_version | int > 18) or ansible_distribution == 'Archlinux' or ansible_os_family == 'Suse' else ('ntpd' if ansible_os_family == 'RedHat' else 'ntp') }}"
matrix_homeserver_url: "https://{{ matrix_server_fqn_matrix }}"
# Specifies where the homeserver's Client-Server API is on the container network.
# Where this is depends on whether there's a reverse-proxy in front of the homeserver, which homeserver it is, etc.
# This likely gets overriden elsewhere.
matrix_homeserver_container_url: ""
# Specifies where the homeserver's Federation API is on the container network.
# Where this is depends on whether there's a reverse-proxy in front of the homeserver, which homeserver it is, etc.
# This likely gets overriden elsewhere.
matrix_homeserver_container_federation_url: ""
matrix_identity_server_url: ~
matrix_integration_manager_rest_url: ~
matrix_integration_manager_ui_url: ~
# The domain name where a Jitsi server is self-hosted.
# If set, `/.well-known/matrix/client` will suggest Element clients to use that Jitsi server.
# See: https://github.com/vector-im/element-web/blob/develop/docs/jitsi.md#configuring-element-to-use-your-self-hosted-jitsi-server
matrix_client_element_jitsi_preferredDomain: '' # noqa var-naming
# Controls whether Element should use End-to-End Encryption by default.
# Setting this to false will update `/.well-known/matrix/client` and tell Element clients to avoid E2EE.
# See: https://github.com/vector-im/element-web/blob/develop/docs/e2ee.md
matrix_client_element_e2ee_default: true
# Controls whether Element should require a secure backup set up before Element can be used.
# Setting this to true will update `/.well-known/matrix/client` and tell Element require a secure backup.
# See: https://github.com/vector-im/element-web/blob/develop/docs/e2ee.md
matrix_client_element_e2ee_secure_backup_required: false
# Controls which backup methods from ["key", "passphrase"] should be used, both is the default.
# Setting this to other then empty will update `/.well-known/matrix/client` and tell Element which method to use
# See: https://github.com/vector-im/element-web/blob/develop/docs/e2ee.md
matrix_client_element_e2ee_secure_backup_setup_methods: []
# Default `/.well-known/matrix/client` configuration - it covers the generic use case.
# You can customize it by controlling the various variables inside the template file that it references.
#
# For a more advanced customization, you can extend the default (see `matrix_well_known_matrix_client_configuration_extension_json`)
# or completely replace this variable with your own template.
#
# The side-effect of this lookup is that Ansible would even parse the JSON for us, returning a dict.
# This is unlike what it does when looking up YAML template files (no automatic parsing there).
matrix_well_known_matrix_client_configuration_default: "{{ lookup('template', 'templates/static-files/well-known/matrix-client.j2') }}"
# Your custom JSON configuration for `/.well-known/matrix/client` should go to `matrix_well_known_matrix_client_configuration_extension_json`.
# This configuration extends the default starting configuration (`matrix_well_known_matrix_client_configuration_default`).
#
# You can override individual variables from the default configuration, or introduce new ones.
#
# If you need something more special, you can take full control by
# completely redefining `matrix_well_known_matrix_client_configuration`.
#
# Example configuration extension follows:
#
# matrix_well_known_matrix_client_configuration_extension_json: |
# {
# "io.element.call_behaviour": {
# "widget_build_url": "https://dimension.example.com/api/v1/dimension/bigbluebutton/widget_state"
# }
# }
matrix_well_known_matrix_client_configuration_extension_json: '{}'
matrix_well_known_matrix_client_configuration_extension: "{{ matrix_well_known_matrix_client_configuration_extension_json | from_json if matrix_well_known_matrix_client_configuration_extension_json | from_json is mapping else {} }}"
# Holds the final `/.well-known/matrix/client` configuration (a combination of the default and its extension).
# You most likely don't need to touch this variable. Instead, see `matrix_well_known_matrix_client_configuration_default` and `matrix_well_known_matrix_client_configuration_extension_json`.
matrix_well_known_matrix_client_configuration: "{{ matrix_well_known_matrix_client_configuration_default | combine(matrix_well_known_matrix_client_configuration_extension, recursive=True) }}"
# Default `/.well-known/matrix/server` configuration - it covers the generic use case.
# You can customize it by controlling the various variables inside the template file that it references.
#
# For a more advanced customization, you can extend the default (see `matrix_well_known_matrix_server_configuration_extension_json`)
# or completely replace this variable with your own template.
#
# The side-effect of this lookup is that Ansible would even parse the JSON for us, returning a dict.
# This is unlike what it does when looking up YAML template files (no automatic parsing there).
matrix_well_known_matrix_server_configuration_default: "{{ lookup('template', 'templates/static-files/well-known/matrix-server.j2') }}"
# Your custom JSON configuration for `/.well-known/matrix/server` should go to `matrix_well_known_matrix_server_configuration_extension_json`.
# This configuration extends the default starting configuration (`matrix_well_known_matrix_server_configuration_default`).
#
# You can override individual variables from the default configuration, or introduce new ones.
#
# If you need something more special, you can take full control by
# completely redefining `matrix_well_known_matrix_server_configuration`.
#
# Example configuration extension follows:
#
# matrix_well_known_matrix_server_configuration_extension_json: |
# {
# "something": "another"
# }
matrix_well_known_matrix_server_configuration_extension_json: '{}'
matrix_well_known_matrix_server_configuration_extension: "{{ matrix_well_known_matrix_server_configuration_extension_json | from_json if matrix_well_known_matrix_server_configuration_extension_json | from_json is mapping else {} }}"
# Holds the final `/.well-known/matrix/server` configuration (a combination of the default and its extension).
# You most likely don't need to touch this variable. Instead, see `matrix_well_known_matrix_server_configuration_default` and `matrix_well_known_matrix_server_configuration_extension_json`.
matrix_well_known_matrix_server_configuration: "{{ matrix_well_known_matrix_server_configuration_default | combine(matrix_well_known_matrix_server_configuration_extension, recursive=True) }}"
# The side-effect of this lookup is that Ansible would even parse the JSON for us, returning a dict.
# This is unlike what it does when looking up YAML template files (no automatic parsing there).
matrix_well_known_matrix_support_configuration_default: "{{ lookup('template', 'templates/static-files/well-known/matrix-support.j2') }}"
matrix_well_known_matrix_support_configuration_extension_json: '{}'
matrix_well_known_matrix_support_configuration_extension: "{{ matrix_well_known_matrix_support_configuration_extension_json | from_json if matrix_well_known_matrix_support_configuration_extension_json | from_json is mapping else {} }}"
# Holds the final `/.well-known/matrix/support` configuration (a combination of the default and its extension).
# You most likely don't need to touch this variable. Instead, see `matrix_well_known_matrix_support_configuration_default` and `matrix_well_known_matrix_support_configuration_extension_json`.
matrix_well_known_matrix_support_configuration: "{{ matrix_well_known_matrix_support_configuration_default | combine(matrix_well_known_matrix_support_configuration_extension, recursive=True) }}"
# The Docker network that all services would be put into
matrix_docker_network: "matrix"
# Controls whether we'll preserve the vars.yml file on the Matrix server.
# If you have a differently organized inventory, you may wish to disable this feature,
# or to repoint `matrix_vars_yml_snapshotting_src` to the file you'd like to preserve.
matrix_vars_yml_snapshotting_enabled: true
matrix_vars_yml_snapshotting_src: "{{ inventory_dir }}/host_vars/{{ inventory_hostname }}/vars.yml"
# Controls whether a `/.well-known/matrix/server` file is generated and used at all.
#
# If you wish to rely on DNS SRV records only, you can disable this.
# Using DNS SRV records implies that you'll be handling Matrix Federation API traffic (tcp/8448)
# using certificates for the base domain (`matrix_domain`) and not for the
# matrix domain (`matrix_server_fqn_matrix`).
matrix_well_known_matrix_server_enabled: true
# Controls whether a `/.well-known/matrix/support` file is generated and used at all.
#
# This is not enabled by default, until the MSC gets accepted: https://github.com/matrix-org/matrix-spec-proposals/pull/1929
#
# See `matrix_homeserver_admin_contacts`, `matrix_homeserver_support_url`, etc.
matrix_well_known_matrix_support_enabled: false
# Controls whether Docker is automatically installed.
# If you change this to false you must install and update Docker manually. You also need to install the docker (https://pypi.org/project/docker/) Python package.
matrix_docker_installation_enabled: true
# Controls the Docker package that is installed.
# Possible values are "docker-ce" (default) and "docker.io" (Debian).
matrix_docker_package_name: docker-ce
# Controls whether the current playbook's commit hash is saved in `git_hash.yml` on the target
# Set this to false if GIT is not installed on the local system (the system where the ansible command is run on)
# to suppress the warning message.
matrix_playbook_commit_hash_preservation_enabled: true
# Variables to Control which parts of our roles run.
run_postgres_import: true
run_postgres_upgrade: true
run_postgres_import_sqlite_db: true
run_postgres_vacuum: true
run_synapse_register_user: true
run_synapse_update_user_password: true
run_synapse_import_media_store: true
run_synapse_rust_synapse_compress_state: true
run_dendrite_register_user: true
run_setup: true
run_self_check: true
run_start: true
run_stop: true

62
roles/custom/matrix-base/files/yum.repos.d/docker-ce-centos.repo Normal file
View File

@ -0,0 +1,62 @@
[docker-ce-stable]
name=Docker CE Stable - $basearch
baseurl=https://download.docker.com/linux/centos/$releasever/$basearch/stable
enabled=1
gpgcheck=1
gpgkey=https://download.docker.com/linux/centos/gpg
[docker-ce-stable-debuginfo]
name=Docker CE Stable - Debuginfo $basearch
baseurl=https://download.docker.com/linux/centos/$releasever/debug-$basearch/stable
enabled=0
gpgcheck=1
gpgkey=https://download.docker.com/linux/centos/gpg
[docker-ce-stable-source]
name=Docker CE Stable - Sources
baseurl=https://download.docker.com/linux/centos/$releasever/source/stable
enabled=0
gpgcheck=1
gpgkey=https://download.docker.com/linux/centos/gpg
[docker-ce-test]
name=Docker CE Test - $basearch
baseurl=https://download.docker.com/linux/centos/$releasever/$basearch/test
enabled=0
gpgcheck=1
gpgkey=https://download.docker.com/linux/centos/gpg
[docker-ce-test-debuginfo]
name=Docker CE Test - Debuginfo $basearch
baseurl=https://download.docker.com/linux/centos/$releasever/debug-$basearch/test
enabled=0
gpgcheck=1
gpgkey=https://download.docker.com/linux/centos/gpg
[docker-ce-test-source]
name=Docker CE Test - Sources
baseurl=https://download.docker.com/linux/centos/$releasever/source/test
enabled=0
gpgcheck=1
gpgkey=https://download.docker.com/linux/centos/gpg
[docker-ce-nightly]
name=Docker CE Nightly - $basearch
baseurl=https://download.docker.com/linux/centos/$releasever/$basearch/nightly
enabled=0
gpgcheck=1
gpgkey=https://download.docker.com/linux/centos/gpg
[docker-ce-nightly-debuginfo]
name=Docker CE Nightly - Debuginfo $basearch
baseurl=https://download.docker.com/linux/centos/$releasever/debug-$basearch/nightly
enabled=0
gpgcheck=1
gpgkey=https://download.docker.com/linux/centos/gpg
[docker-ce-nightly-source]
name=Docker CE Nightly - Sources
baseurl=https://download.docker.com/linux/centos/$releasever/source/nightly
enabled=0
gpgcheck=1
gpgkey=https://download.docker.com/linux/centos/gpg

62
roles/custom/matrix-base/files/yum.repos.d/docker-ce-fedora.repo Normal file
View File

@ -0,0 +1,62 @@
[docker-ce-stable]
name=Docker CE Stable - $basearch
baseurl=https://download.docker.com/linux/fedora/$releasever/$basearch/stable
enabled=1
gpgcheck=1
gpgkey=https://download.docker.com/linux/fedora/gpg
[docker-ce-stable-debuginfo]
name=Docker CE Stable - Debuginfo $basearch
baseurl=https://download.docker.com/linux/fedora/$releasever/debug-$basearch/stable
enabled=0
gpgcheck=1
gpgkey=https://download.docker.com/linux/fedora/gpg
[docker-ce-stable-source]
name=Docker CE Stable - Sources
baseurl=https://download.docker.com/linux/fedora/$releasever/source/stable
enabled=0
gpgcheck=1
gpgkey=https://download.docker.com/linux/fedora/gpg
[docker-ce-test]
name=Docker CE Test - $basearch
baseurl=https://download.docker.com/linux/fedora/$releasever/$basearch/test
enabled=0
gpgcheck=1
gpgkey=https://download.docker.com/linux/fedora/gpg
[docker-ce-test-debuginfo]
name=Docker CE Test - Debuginfo $basearch
baseurl=https://download.docker.com/linux/fedora/$releasever/debug-$basearch/test
enabled=0
gpgcheck=1
gpgkey=https://download.docker.com/linux/fedora/gpg
[docker-ce-test-source]
name=Docker CE Test - Sources
baseurl=https://download.docker.com/linux/fedora/$releasever/source/test
enabled=0
gpgcheck=1
gpgkey=https://download.docker.com/linux/fedora/gpg
[docker-ce-nightly]
name=Docker CE Nightly - $basearch
baseurl=https://download.docker.com/linux/fedora/$releasever/$basearch/nightly
enabled=0
gpgcheck=1
gpgkey=https://download.docker.com/linux/fedora/gpg
[docker-ce-nightly-debuginfo]
name=Docker CE Nightly - Debuginfo $basearch
baseurl=https://download.docker.com/linux/fedora/$releasever/debug-$basearch/nightly
enabled=0
gpgcheck=1
gpgkey=https://download.docker.com/linux/fedora/gpg
[docker-ce-nightly-source]
name=Docker CE Nightly - Sources
baseurl=https://download.docker.com/linux/fedora/$releasever/source/nightly
enabled=0
gpgcheck=1
gpgkey=https://download.docker.com/linux/fedora/gpg

9
roles/custom/matrix-base/tasks/clean_up_old_files.yml Normal file
View File

@ -0,0 +1,9 @@
---
- name: Get rid of old files and directories
ansible.builtin.file:
path: "{{ item }}"
state: absent
with_items:
- "{{ matrix_base_data_path }}/environment-variables"
- "{{ matrix_base_data_path }}/scratchpad"

37
roles/custom/matrix-base/tasks/main.yml Normal file
View File

@ -0,0 +1,37 @@
---
- ansible.builtin.import_tasks: "{{ role_path }}/tasks/sanity_check.yml"
tags:
- always
- ansible.builtin.import_tasks: "{{ role_path }}/tasks/clean_up_old_files.yml"
when: run_setup | bool
tags:
- setup-all
- ansible.builtin.import_tasks: "{{ role_path }}/tasks/server_base/setup.yml"
when: run_setup | bool
tags:
- setup-all
# This needs to always run, because it populates `matrix_user_uid` and `matrix_user_gid`,
# which are required by many other roles.
- ansible.builtin.import_tasks: "{{ role_path }}/tasks/setup_matrix_user.yml"
when: run_setup | bool
tags:
- always
- setup-system-user
- ansible.builtin.import_tasks: "{{ role_path }}/tasks/setup_matrix_base.yml"
when: run_setup | bool
tags:
- setup-all
- ansible.builtin.import_tasks: "{{ role_path }}/tasks/setup_well_known.yml"
when: run_setup | bool
tags:
- setup-all
- setup-ma1sd
- setup-synapse
- setup-dendrite
- setup-nginx-proxy

91
roles/custom/matrix-base/tasks/sanity_check.yml Normal file
View File

@ -0,0 +1,91 @@
---
- name: Fail if invalid homeserver implementation
ansible.builtin.fail:
msg: "You need to set a valid homeserver implementation in `matrix_homeserver_implementation`"
when: "matrix_homeserver_implementation not in ['synapse', 'dendrite', 'conduit']"
# We generally support Ansible 2.7.1 and above.
- name: Fail if running on Ansible < 2.7.1
ansible.builtin.fail:
msg: "You are running on Ansible {{ ansible_version.string }}, which is not supported. See our guide about Ansible: https://github.com/spantaleev/matrix-docker-ansible-deploy/blob/master/docs/ansible.md"
when:
- "(ansible_version.major < 2) or (ansible_version.major == 2 and ansible_version.minor < 7) or (ansible_version.major == 2 and ansible_version.minor == 7 and ansible_version.revision < 1)"
# Though we do not support Ansible 2.9.6 which is buggy
- name: Fail if running on Ansible 2.9.6 on Ubuntu
ansible.builtin.fail:
msg: "You are running on Ansible {{ ansible_version.string }}, which is not supported. See our guide about Ansible: https://github.com/spantaleev/matrix-docker-ansible-deploy/blob/master/docs/ansible.md"
when:
- ansible_distribution == 'Ubuntu'
- "ansible_version.major == 2 and ansible_version.minor == 9 and ansible_version.revision == 6"
- name: (Deprecation) Catch and report renamed settings
ansible.builtin.fail:
msg: >-
Your configuration contains a variable, which now has a different name.
Please change your configuration to rename the variable (`{{ item.old }}` -> `{{ item.new }}`).
when: "item.old in vars"
with_items:
- {'old': 'host_specific_hostname_identity', 'new': 'matrix_domain'}
- {'old': 'hostname_identity', 'new': 'matrix_domain'}
- {'old': 'hostname_matrix', 'new': 'matrix_server_fqn_matrix'}
- {'old': 'hostname_riot', 'new': 'matrix_server_fqn_element'}
- {'old': 'matrix_server_fqn_riot', 'new': 'matrix_server_fqn_element'}
# We have a dedicated check for this variable, because we'd like to have a custom (friendlier) message.
- name: Fail if matrix_homeserver_generic_secret_key is undefined
ansible.builtin.fail:
msg: |
The `matrix_homeserver_generic_secret_key` variable must be defined and have a non-null and non-empty value.
If you're observing this error on a new installation, you should ensure that the `matrix_homeserver_generic_secret_key` is defined.
If you're observing this error on an existing homeserver installation, you can fix it easily and in a backward-compatible way by adding
`{% raw %}matrix_homeserver_generic_secret_key: "{{ matrix_synapse_macaroon_secret_key }}"{% endraw %}`
to your `vars.yml` file. Using another secret value for the new variable is also possible and shouldn't cause any trouble.
when: "matrix_homeserver_generic_secret_key is none or matrix_homeserver_generic_secret_key == ''"
- name: Fail if required variables are undefined
ansible.builtin.fail:
msg: "The `{{ item.var }}` variable must be defined and have a non-null and non-empty value"
with_items:
- {'var': matrix_domain, 'value': "{{ matrix_domain | default('') }}"}
- {'var': matrix_server_fqn_matrix, 'value': "{{ matrix_server_fqn_matrix | default('') }}"}
- {'var': matrix_server_fqn_element, 'value': "{{ matrix_server_fqn_element | default('') }}"}
- {'var': matrix_homeserver_container_url, 'value': "{{ matrix_homeserver_container_url | default('') }}"}
- {'var': matrix_homeserver_container_federation_url, 'value': "{{ matrix_homeserver_container_federation_url | default('') }}"}
when: "item.value is none or item.value == ''"
- name: Fail if uppercase domain used
ansible.builtin.fail:
msg: "Detected that you're using an uppercase domain name - `{{ item }}`. This will cause trouble. Please use all-lowercase!"
with_items:
- "{{ matrix_domain }}"
- "{{ matrix_server_fqn_matrix }}"
- "{{ matrix_server_fqn_element }}"
when: "item != item | lower"
- name: Fail if using python2 on Archlinux
ansible.builtin.fail:
msg: "Detected that you're using python2 when installing onto Archlinux. Archlinux by default only supports python3."
when:
- ansible_distribution == 'Archlinux'
- ansible_python.version.major != 3
- name: Fail if architecture is set incorrectly
ansible.builtin.fail:
msg: "Detected that variable matrix_architecture {{ matrix_architecture }} appears to be set incorrectly. See docs/alternative-architectures.md. Server appears to be {{ ansible_architecture }}."
when: (ansible_architecture == "x86_64" and matrix_architecture != "amd64") or
(ansible_architecture == "aarch64" and matrix_architecture != "arm64") or
(ansible_architecture.startswith("armv") and matrix_architecture != "arm32")
- name: Fail if encountering usage of removed role (mx-puppet-skype)
ansible.builtin.fail:
msg: >-
Your configuration seems to include a reference to `matrix_mx_puppet_skype_enabled`. Are you trying to install the mx-puppet-skype bridge?
The playbook no longer includes a role for installing mx-puppet-skype, because the mx-puppet-bridge is unmaintained and has been reported as broken for a long time.
To get rid of this error, remove all `matrix_mx_puppet_*` references from your configuration.
To clean up your server from mx-puppet-skype's presence, see this changelog entry: https://github.com/spantaleev/matrix-docker-ansible-deploy/blob/master/CHANGELOG.md#mx-puppet-skype-removal.
If you still need bridging to Skype, consider switching to the go-skype bridge instead. See `docs/configuring-playbook-bridge-go-skype-bridge.md`.
when: "'matrix_mx_puppet_skype_enabled' in vars"

47
roles/custom/matrix-base/tasks/server_base/setup.yml Normal file
View File

@ -0,0 +1,47 @@
---
- ansible.builtin.include_tasks: "{{ role_path }}/tasks/server_base/setup_redhat.yml"
when: ansible_os_family == 'RedHat' and ansible_distribution_major_version | int < 8
- ansible.builtin.include_tasks: "{{ role_path }}/tasks/server_base/setup_redhat8.yml"
when: ansible_os_family == 'RedHat' and ansible_distribution_major_version | int > 7 and ansible_distribution_major_version | int < 30
- ansible.builtin.include_tasks: "{{ role_path }}/tasks/server_base/setup_fedora.yml"
when: ansible_os_family == 'RedHat' and ansible_distribution_major_version | int > 30
- when: ansible_os_family == 'Debian'
block:
# ansible_lsb is only available if lsb-release is installed.
- name: Ensure lsb-release installed
ansible.builtin.apt:
name:
- lsb-release
state: present
update_cache: true
register: lsb_release_installation_result
- name: Reread ansible_lsb facts if lsb-release got installed
ansible.builtin.setup:
filter: ansible_lsb*
when: lsb_release_installation_result.changed
- ansible.builtin.include_tasks: "{{ role_path }}/tasks/server_base/setup_debian.yml"
when: (ansible_os_family == 'Debian') and (ansible_lsb.id != 'Raspbian')
- ansible.builtin.include_tasks: "{{ role_path }}/tasks/server_base/setup_raspbian.yml"
when: (ansible_os_family == 'Debian') and (ansible_lsb.id == 'Raspbian')
- ansible.builtin.include_tasks: "{{ role_path }}/tasks/server_base/setup_archlinux.yml"
when: ansible_distribution == 'Archlinux'
- name: Ensure Docker is started and autoruns
ansible.builtin.service:
name: docker
state: started
enabled: true
- name: "Ensure ntpd is started and autoruns"
ansible.builtin.service:
name: "{{ matrix_ntpd_service }}"
state: started
enabled: true

16
roles/custom/matrix-base/tasks/server_base/setup_archlinux.yml Normal file
View File

@ -0,0 +1,16 @@
---
- name: Install host dependencies
community.general.pacman:
name:
- python-docker
- python-dnspython
state: present
update_cache: true
- name: Ensure Docker is installed
community.general.pacman:
name:
- docker
state: present
when: matrix_docker_installation_enabled | bool

41
roles/custom/matrix-base/tasks/server_base/setup_debian.yml Normal file
View File

@ -0,0 +1,41 @@
---
- name: Ensure APT usage dependencies are installed
ansible.builtin.apt:
name:
- apt-transport-https
- ca-certificates
- gnupg
state: present
update_cache: true
- name: Ensure Docker's APT key is trusted
ansible.builtin.apt_key:
url: "https://download.docker.com/linux/{{ ansible_distribution | lower }}/gpg"
id: 9DC858229FC7DD38854AE2D88D81803C0EBFCD88
state: present
register: add_repository_key
ignore_errors: true
when: matrix_docker_installation_enabled | bool and matrix_docker_package_name == 'docker-ce'
- name: Ensure Docker repository is enabled
ansible.builtin.apt_repository:
repo: "deb [arch={{ matrix_debian_arch }}] https://download.docker.com/linux/{{ ansible_distribution | lower }} {{ ansible_distribution_release }} stable"
state: present
update_cache: true
when: matrix_docker_installation_enabled | bool and matrix_docker_package_name == 'docker-ce'
- name: Ensure APT packages are installed
ansible.builtin.apt:
name:
- "{{ matrix_ntpd_package }}"
state: present
update_cache: true
- name: Ensure Docker is installed
ansible.builtin.apt:
name:
- "{{ matrix_docker_package_name }}"
- "python{{ '3' if ansible_python.version.major == 3 else '' }}-docker"
state: present
when: matrix_docker_installation_enabled | bool

39
roles/custom/matrix-base/tasks/server_base/setup_fedora.yml Normal file
View File

@ -0,0 +1,39 @@
---
- name: Ensure Docker repository is enabled
ansible.builtin.template:
src: "{{ role_path }}/files/yum.repos.d/{{ item }}"
dest: "/etc/yum.repos.d/docker-ce.repo"
owner: "root"
group: "root"
mode: 0644
with_items:
- docker-ce-fedora.repo
when: matrix_docker_installation_enabled | bool and matrix_docker_package_name == 'docker-ce'
- name: Ensure Docker's RPM key is trusted
ansible.builtin.rpm_key:
state: present
key: https://download.docker.com/linux/fedora/gpg
when: matrix_docker_installation_enabled | bool and matrix_docker_package_name == 'docker-ce'
- name: Ensure yum packages are installed
ansible.builtin.yum:
name:
- "{{ matrix_ntpd_package }}"
state: present
update_cache: true
- name: Ensure Docker is installed
ansible.builtin.yum:
name:
- "{{ matrix_docker_package_name }}"
- python3-pip
state: present
when: matrix_docker_installation_enabled | bool
- name: Ensure Docker-Py is installed
ansible.builtin.pip:
name: docker-py
state: present
when: matrix_docker_installation_enabled | bool

41
roles/custom/matrix-base/tasks/server_base/setup_raspbian.yml Normal file
View File

@ -0,0 +1,41 @@
---
- name: Ensure APT usage dependencies are installed
ansible.builtin.apt:
name:
- apt-transport-https
- ca-certificates
- gnupg
state: present
update_cache: true
- name: Ensure Docker's APT key is trusted
ansible.builtin.apt_key:
url: https://download.docker.com/linux/raspbian/gpg
id: 9DC858229FC7DD38854AE2D88D81803C0EBFCD88
state: present
register: add_repository_key
ignore_errors: true
when: matrix_docker_installation_enabled | bool and matrix_docker_package_name == 'docker-ce'
- name: Ensure Docker repository is enabled
ansible.builtin.apt_repository:
repo: "deb [arch={{ matrix_debian_arch }}] https://download.docker.com/linux/raspbian {{ ansible_distribution_release }} stable"
state: present
update_cache: true
when: matrix_docker_installation_enabled | bool and matrix_docker_package_name == 'docker-ce'
- name: Ensure APT packages are installed
ansible.builtin.apt:
name:
- "{{ matrix_ntpd_package }}"
state: present
update_cache: true
- name: Ensure Docker is installed
ansible.builtin.apt:
name:
- "{{ matrix_docker_package_name }}"
- "python{{ '3' if ansible_python.version.major == 3 else '' }}-docker"
state: present
when: matrix_docker_installation_enabled | bool

31
roles/custom/matrix-base/tasks/server_base/setup_redhat.yml Normal file
View File

@ -0,0 +1,31 @@
---
- name: Ensure Docker repository is enabled
ansible.builtin.template:
src: "{{ role_path }}/files/yum.repos.d/docker-ce-centos.repo"
dest: "/etc/yum.repos.d/docker-ce.repo"
owner: "root"
group: "root"
mode: 0644
when: matrix_docker_installation_enabled | bool and matrix_docker_package_name == 'docker-ce'
- name: Ensure Docker's RPM key is trusted
ansible.builtin.rpm_key:
state: present
key: https://download.docker.com/linux/centos/gpg
when: matrix_docker_installation_enabled | bool and matrix_docker_package_name == 'docker-ce'
- name: Ensure yum packages are installed
ansible.builtin.yum:
name:
- "{{ matrix_ntpd_package }}"
state: present
update_cache: true
- name: Ensure Docker is installed
ansible.builtin.yum:
name:
- "{{ matrix_docker_package_name }}"
- docker-python
state: present
when: matrix_docker_installation_enabled | bool

44
roles/custom/matrix-base/tasks/server_base/setup_redhat8.yml Normal file
View File

@ -0,0 +1,44 @@
---
- name: Ensure Docker repository is enabled
ansible.builtin.template:
src: "{{ role_path }}/files/yum.repos.d/docker-ce-centos.repo"
dest: "/etc/yum.repos.d/docker-ce.repo"
owner: "root"
group: "root"
mode: 0644
when: matrix_docker_installation_enabled | bool and matrix_docker_package_name == 'docker-ce'
- name: Ensure Docker's RPM key is trusted
ansible.builtin.rpm_key:
state: present
key: https://download.docker.com/linux/centos/gpg
when: matrix_docker_installation_enabled | bool and matrix_docker_package_name == 'docker-ce'
- name: Ensure EPEL is installed
ansible.builtin.yum:
name:
- epel-release
state: present
update_cache: true
- name: Ensure yum packages are installed
ansible.builtin.yum:
name:
- "{{ matrix_ntpd_package }}"
state: present
update_cache: true
- name: Ensure Docker is installed
ansible.builtin.yum:
name:
- "{{ matrix_docker_package_name }}"
- python3-pip
state: present
when: matrix_docker_installation_enabled | bool
- name: Ensure Docker-Py is installed
ansible.builtin.pip:
name: docker-py
state: present
when: matrix_docker_installation_enabled | bool

77
roles/custom/matrix-base/tasks/setup_matrix_base.yml Normal file
View File

@ -0,0 +1,77 @@
---
- name: Ensure Matrix base path exists
ansible.builtin.file:
path: "{{ item }}"
state: directory
mode: "{{ matrix_base_data_path_mode }}"
owner: "{{ matrix_user_username }}"
group: "{{ matrix_user_groupname }}"
with_items:
- "{{ matrix_base_data_path }}"
- name: Preserve vars.yml on the server for easily restoring if it gets lost later on
ansible.builtin.copy:
src: "{{ matrix_vars_yml_snapshotting_src }}"
dest: "{{ matrix_base_data_path }}/vars.yml"
owner: "{{ matrix_user_username }}"
group: "{{ matrix_user_groupname }}"
mode: '0660'
when: "matrix_vars_yml_snapshotting_enabled | bool"
- name: Save current git-repo status on the target to aid with restoring in case of problems
when: "matrix_playbook_commit_hash_preservation_enabled|bool"
block:
- name: Get local git hash # noqa command-instead-of-module
delegate_to: 127.0.0.1
become: false
register: git_describe
changed_when: false
ansible.builtin.shell:
git describe
--always
--tags
--dirty
--long
--all
- ansible.builtin.set_fact:
git_hash: "{{ git_describe.stdout }}"
- name: Git hash
ansible.builtin.debug:
msg: "Git hash: {{ git_hash }}"
- name: Save git_hash.yml on target
ansible.builtin.copy:
content: "{{ git_hash }}"
dest: "{{ matrix_base_data_path }}/git_hash.yml"
owner: "{{ matrix_user_username }}"
group: "{{ matrix_user_groupname }}"
mode: '0660'
rescue:
- name: GIT not found error
ansible.builtin.debug:
msg: >-
Couldn't find GIT on the local machine. Continuing without saving the GIT hash.
You can disable saving the GIT hash by setting 'matrix_playbook_commit_hash_preservation_enabled: false' in vars.yml
when: "git_describe.stderr.find('git: not found') != -1"
- name: Get GIT hash error
ansible.builtin.fail:
msg: >-
Error when trying to get the GIT hash. Please consult the error message above.
You can disable saving the GIT hash by setting 'matrix_playbook_commit_hash_preservation_enabled: false' in vars.yml
when: "git_describe.stderr.find('git: not found') == -1"
- name: Ensure Matrix network is created in Docker
community.docker.docker_network:
name: "{{ matrix_docker_network }}"
driver: bridge
- name: Ensure matrix-remove-all script created
ansible.builtin.template:
src: "{{ role_path }}/templates/usr-local-bin/matrix-remove-all.j2"
dest: "{{ matrix_local_bin_path }}/matrix-remove-all"
mode: 0750

27
roles/custom/matrix-base/tasks/setup_matrix_user.yml Normal file
View File

@ -0,0 +1,27 @@
---
- name: Ensure Matrix group is created
ansible.builtin.group:
name: "{{ matrix_user_groupname }}"
gid: "{{ omit if matrix_user_gid is none else matrix_user_gid }}"
state: present
register: matrix_group
- name: Set Matrix Group GID Variable
ansible.builtin.set_fact:
matrix_user_gid: "{{ matrix_group.gid }}"
- name: Ensure Matrix user is created
ansible.builtin.user:
name: "{{ matrix_user_username }}"
uid: "{{ omit if matrix_user_uid is none else matrix_user_uid }}"
state: present
group: "{{ matrix_user_groupname }}"
home: "{{ matrix_base_data_path }}"
create_home: false
system: true
register: matrix_user
- name: Set Matrix Group UID Variable
ansible.builtin.set_fact:
matrix_user_uid: "{{ matrix_user.uid }}"

52
roles/custom/matrix-base/tasks/setup_well_known.yml Normal file
View File

@ -0,0 +1,52 @@
---
# We need others to be able to read these directories too,
# so that matrix-nginx-proxy's nginx user can access the files.
#
# For running with another webserver, we recommend being part of the `matrix` group.
- name: Ensure Matrix static-files path exists
ansible.builtin.file:
path: "{{ item }}"
state: directory
mode: 0755
owner: "{{ matrix_user_username }}"
group: "{{ matrix_user_groupname }}"
with_items:
- "{{ matrix_static_files_base_path }}/.well-known/matrix"
- name: Ensure Matrix /.well-known/matrix/client file configured
ansible.builtin.copy:
content: "{{ matrix_well_known_matrix_client_configuration | to_nice_json }}"
dest: "{{ matrix_static_files_base_path }}/.well-known/matrix/client"
mode: 0644
owner: "{{ matrix_user_username }}"
group: "{{ matrix_user_groupname }}"
- name: Ensure Matrix /.well-known/matrix/server file configured
ansible.builtin.copy:
content: "{{ matrix_well_known_matrix_server_configuration | to_nice_json }}"
dest: "{{ matrix_static_files_base_path }}/.well-known/matrix/server"
mode: 0644
owner: "{{ matrix_user_username }}"
group: "{{ matrix_user_groupname }}"
when: matrix_well_known_matrix_server_enabled | bool
- name: Ensure Matrix /.well-known/matrix/server file deleted
ansible.builtin.file:
path: "{{ matrix_static_files_base_path }}/.well-known/matrix/server"
state: absent
when: "not matrix_well_known_matrix_server_enabled | bool"
- name: Ensure Matrix /.well-known/matrix/support file configured
ansible.builtin.copy:
content: "{{ matrix_well_known_matrix_support_configuration | to_nice_json }}"
dest: "{{ matrix_static_files_base_path }}/.well-known/matrix/support"
mode: 0644
owner: "{{ matrix_user_username }}"
group: "{{ matrix_user_groupname }}"
when: matrix_well_known_matrix_support_enabled | bool
- name: Ensure Matrix /.well-known/matrix/support file deleted
ansible.builtin.file:
path: "{{ matrix_static_files_base_path }}/.well-known/matrix/support"
state: absent
when: "not matrix_well_known_matrix_support_enabled | bool"

23
roles/custom/matrix-base/tasks/util/ensure_fuse_installed.yml Normal file
View File

@ -0,0 +1,23 @@
---
# This is for both RedHat 7 and 8
- name: Ensure fuse installed (RedHat)
ansible.builtin.yum:
name:
- fuse
state: present
when: ansible_os_family == 'RedHat'
# This is for both Debian and Raspbian
- name: Ensure fuse installed (Debian/Raspbian)
ansible.builtin.apt:
name:
- fuse
state: present
when: ansible_os_family == 'Debian'
- name: Ensure fuse installed (Archlinux)
community.general.pacman:
name:
- fuse3
state: present
when: ansible_distribution == 'Archlinux'

23
roles/custom/matrix-base/tasks/util/ensure_openssl_installed.yml Normal file
View File

@ -0,0 +1,23 @@
---
# This is for both RedHat 7 and 8
- name: Ensure openssl installed (RedHat)
ansible.builtin.yum:
name:
- openssl
state: present
when: ansible_os_family == 'RedHat'
# This is for both Debian and Raspbian
- name: Ensure openssl installed (Debian/Raspbian)
ansible.builtin.apt:
name:
- openssl
state: present
when: ansible_os_family == 'Debian'
- name: Ensure openssl installed (Archlinux)
community.general.pacman:
name:
- openssl
state: present
when: ansible_distribution == 'Archlinux'

38
roles/custom/matrix-base/templates/static-files/well-known/matrix-client.j2 Normal file
View File

@ -0,0 +1,38 @@
#jinja2: lstrip_blocks: "True"
{
"m.homeserver": {
"base_url": "{{ matrix_homeserver_url }}"
}
{% if matrix_identity_server_url %},
"m.identity_server": {
"base_url": "{{ matrix_identity_server_url }}"
}
{% endif %}
{% if matrix_integration_manager_rest_url and matrix_integration_manager_ui_url %},
"m.integrations": {
"managers": [
{
"api_url": "{{ matrix_integration_manager_rest_url }}",
"ui_url": "{{ matrix_integration_manager_ui_url }}"
}
]
}
{% endif %}
{% if matrix_client_element_jitsi_preferredDomain %},
"io.element.jitsi": {
"preferredDomain": {{ matrix_client_element_jitsi_preferredDomain|to_json }}
},
"im.vector.riot.jitsi": {
"preferredDomain": {{ matrix_client_element_jitsi_preferredDomain|to_json }}
}
{% endif %}
,
"io.element.e2ee": {
"default": {{ matrix_client_element_e2ee_default|to_json }},
"secure_backup_required": {{ matrix_client_element_e2ee_secure_backup_required|to_json }},
"secure_backup_setup_methods": {{ matrix_client_element_e2ee_secure_backup_setup_methods|to_json }}
},
"im.vector.riot.e2ee": {
"default": {{ matrix_client_element_e2ee_default|to_json }}
}
}

4
roles/custom/matrix-base/templates/static-files/well-known/matrix-server.j2 Normal file
View File

@ -0,0 +1,4 @@
#jinja2: lstrip_blocks: "True"
{
"m.server": "{{ matrix_server_fqn_matrix_federation }}:{{ matrix_federation_public_port }}"
}

7
roles/custom/matrix-base/templates/static-files/well-known/matrix-support.j2 Normal file
View File

@ -0,0 +1,7 @@
#jinja2: lstrip_blocks: "True"
{
"admins": {{ matrix_homeserver_admin_contacts|to_json }}
{% if matrix_homeserver_support_url %},
"support_page": {{ matrix_homeserver_support_url|to_json }}
{% endif %}
}

36
roles/custom/matrix-base/templates/usr-local-bin/matrix-remove-all.j2 Normal file
View File

@ -0,0 +1,36 @@
#jinja2: lstrip_blocks: "True"
#!/bin/bash
if [ "$(id -u)" != "0" ]; then
echo "This script must be executed as root! Aborting."
exit 1
fi
echo "WARNING! You are about to remove everything the playbook installs for {{ matrix_server_fqn_matrix }}: matrix, docker images,..."
echo -n "If you're sure you want to do this, type: 'Yes, I really want to remove everything!'"
read sure
if [ "$sure" != "Yes, I really want to remove everything!" ]; then
echo "Good thing I asked, exiting"
exit 0
else
echo "Stop and remove matrix services"
for s in $(find {{ matrix_systemd_path }}/ -type f -name "matrix-*" -printf "%f\n"); do
systemctl disable --now $s
rm -f {{ matrix_systemd_path }}/$s
done
systemctl daemon-reload
echo "Remove matrix scripts"
find {{ matrix_local_bin_path }}/ -name "matrix-*" -delete
echo "Remove unused Docker images and resources"
docker system prune -af
echo "Remove Docker matrix network (should be gone already, but ..)"
docker network rm {{ matrix_docker_network }}
echo "Remove {{ matrix_base_data_path }} directory"
rm -fr "{{ matrix_base_data_path }}"
exit 0
fi

7
roles/custom/matrix-base/vars/main.yml Normal file
View File

@ -0,0 +1,7 @@
---
# This will contain a list of enabled services that the playbook is managing.
# Each component is expected to append its service name to this list.
matrix_systemd_services_list: []
matrix_homeserver_container_runtime_injected_arguments: []
matrix_homeserver_app_service_runtime_injected_config_files: []

130
roles/custom/matrix-bot-buscarron/defaults/main.yml Normal file
View File

@ -0,0 +1,130 @@
---
# buscarron is a helpdesk bot
# Project source code URL: https://gitlab.com/etke.cc/buscarron
matrix_bot_buscarron_enabled: true
matrix_bot_buscarron_container_image_self_build: false
matrix_bot_buscarron_docker_repo: "https://gitlab.com/etke.cc/buscarron.git"
matrix_bot_buscarron_docker_repo_version: "{{ matrix_bot_buscarron_version }}"
matrix_bot_buscarron_docker_src_files_path: "{{ matrix_base_data_path }}/buscarron/docker-src"
matrix_bot_buscarron_version: v1.3.0
matrix_bot_buscarron_docker_image: "{{ matrix_bot_buscarron_docker_image_name_prefix }}buscarron:{{ matrix_bot_buscarron_version }}"
matrix_bot_buscarron_docker_image_name_prefix: "{{ 'localhost/' if matrix_bot_buscarron_container_image_self_build else 'registry.gitlab.com/etke.cc/' }}"
matrix_bot_buscarron_docker_image_force_pull: "{{ matrix_bot_buscarron_docker_image.endswith(':latest') }}"
matrix_bot_buscarron_base_path: "{{ matrix_base_data_path }}/buscarron"
matrix_bot_buscarron_config_path: "{{ matrix_bot_buscarron_base_path }}/config"
matrix_bot_buscarron_data_path: "{{ matrix_bot_buscarron_base_path }}/data"
matrix_bot_buscarron_data_store_path: "{{ matrix_bot_buscarron_data_path }}/store"
# A list of extra arguments to pass to the container
matrix_bot_buscarron_container_extra_arguments: []
# List of systemd services that matrix-bot-buscarron.service depends on
matrix_bot_buscarron_systemd_required_services_list: ['docker.service']
# List of systemd services that matrix-bot-buscarron.service wants
matrix_bot_buscarron_systemd_wanted_services_list: []
# Database-related configuration fields.
#
# To use SQLite, stick to these defaults.
#
# To use Postgres:
# - change the engine (`matrix_bot_buscarron_database_engine: 'postgres'`)
# - adjust your database credentials via the `matrix_bot_buscarron_database_*` variables
matrix_bot_buscarron_database_engine: 'sqlite'
matrix_bot_buscarron_sqlite_database_path_local: "{{ matrix_bot_buscarron_data_path }}/bot.db"
matrix_bot_buscarron_sqlite_database_path_in_container: "/data/bot.db"
matrix_bot_buscarron_database_username: 'buscarron'
matrix_bot_buscarron_database_password: 'some-password'
matrix_bot_buscarron_database_hostname: 'matrix-postgres'
matrix_bot_buscarron_database_port: 5432
matrix_bot_buscarron_database_name: 'buscarron'
matrix_bot_buscarron_database_connection_string: 'postgres://{{ matrix_bot_buscarron_database_username }}:{{ matrix_bot_buscarron_database_password }}@{{ matrix_bot_buscarron_database_hostname }}:{{ matrix_bot_buscarron_database_port }}/{{ matrix_bot_buscarron_database_name }}?sslmode=disable'
matrix_bot_buscarron_storage_database: "{{
{
'sqlite': matrix_bot_buscarron_sqlite_database_path_in_container,
'postgres': matrix_bot_buscarron_database_connection_string,
}[matrix_bot_buscarron_database_engine]
}}"
matrix_bot_buscarron_database_dialect: "{{
{
'sqlite': 'sqlite3',
'postgres': 'postgres',
}[matrix_bot_buscarron_database_engine]
}}"
# The bot's username. This user needs to be created manually beforehand.
# Also see `matrix_bot_buscarron_password`.
matrix_bot_buscarron_login: "bot.buscarron"
# The password that the bot uses to authenticate.
matrix_bot_buscarron_password: ''
# the homeserver URL, uses internal synapse container address by default
matrix_bot_buscarron_homeserver: "{{ matrix_homeserver_container_url }}"
# forms configuration
matrix_bot_buscarron_forms: []
# Disable encryption
matrix_bot_buscarron_noencryption: false
# Sentry DSN
matrix_bot_buscarron_sentry: ''
# Log level
matrix_bot_buscarron_loglevel: INFO
# list of spammers with wildcards support, eg: *@spam.com spam@*, spam@spam.com
matrix_bot_buscarron_spamlist: []
# spam hosts/domains.
# deprecated, use matrix_bot_buscarron_spamlist
matrix_bot_buscarron_spam_hosts: []
# spam email addresses
# deprecated, use matrix_bot_buscarron_spamlist
matrix_bot_buscarron_spam_emails: []
# spam email localparts
# deprecated, use matrix_bot_buscarron_spamlist
matrix_bot_buscarron_spam_localparts: []
# Banlist size
matrix_bot_buscarron_ban_size: 10000
# Permanent banlist
matrix_bot_buscarron_ban_list: []
# Postmark token (confirmation emails)
matrix_bot_buscarron_pm_token: ''
# Postmark sender signature
matrix_bot_buscarron_pm_from: ''
# Postmark confirmation email's reply-to
matrix_bot_buscarron_pm_replyto: ''
# email address (from) for SMTP validation. Must be valid email on valid SMTP server, otherwise it will be rejected by other servers
matrix_bot_buscarron_smtp_from: ''
# enforce SMTP validation
matrix_bot_buscarron_smtp_validation: false
# Additional environment variables to pass to the buscarron container
#
# Example:
# matrix_bot_buscarron_environment_variables_extension: |
# BUSCARRON_LOGLEVEL=DEBUG
matrix_bot_buscarron_environment_variables_extension: ''

5
roles/custom/matrix-bot-buscarron/tasks/init.yml Normal file
View File

@ -0,0 +1,5 @@
---
- ansible.builtin.set_fact:
matrix_systemd_services_list: "{{ matrix_systemd_services_list + ['matrix-bot-buscarron.service'] }}"
when: matrix_bot_buscarron_enabled | bool

23
roles/custom/matrix-bot-buscarron/tasks/main.yml Normal file
View File

@ -0,0 +1,23 @@
---
- ansible.builtin.import_tasks: "{{ role_path }}/tasks/init.yml"
tags:
- always
- ansible.builtin.import_tasks: "{{ role_path }}/tasks/validate_config.yml"
when: "run_setup | bool and matrix_bot_buscarron_enabled | bool"
tags:
- setup-all
- setup-bot-buscarron
- ansible.builtin.import_tasks: "{{ role_path }}/tasks/setup_install.yml"
when: "run_setup | bool and matrix_bot_buscarron_enabled | bool"
tags:
- setup-all
- setup-bot-buscarron
- ansible.builtin.import_tasks: "{{ role_path }}/tasks/setup_uninstall.yml"
when: "run_setup | bool and not matrix_bot_buscarron_enabled | bool"
tags:
- setup-all
- setup-bot-buscarron

103
roles/custom/matrix-bot-buscarron/tasks/setup_install.yml Normal file
View File

@ -0,0 +1,103 @@
---
- ansible.builtin.set_fact:
matrix_bot_buscarron_requires_restart: false
- when: "matrix_bot_buscarron_database_engine == 'postgres'"
block:
- name: Check if an SQLite database already exists
ansible.builtin.stat:
path: "{{ matrix_bot_buscarron_sqlite_database_path_local }}"
register: matrix_bot_buscarron_sqlite_database_path_local_stat_result
- when: "matrix_bot_buscarron_sqlite_database_path_local_stat_result.stat.exists | bool"
block:
- ansible.builtin.set_fact:
matrix_postgres_db_migration_request:
src: "{{ matrix_bot_buscarron_sqlite_database_path_local }}"
dst: "{{ matrix_bot_buscarron_database_connection_string }}"
caller: "{{ role_path | basename }}"
engine_variable_name: 'matrix_bot_buscarron_database_engine'
engine_old: 'sqlite'
systemd_services_to_stop: ['matrix-bot-buscarron.service']
- ansible.builtin.import_role:
name: custom/matrix-postgres
tasks_from: migrate_db_to_postgres
- ansible.builtin.set_fact:
matrix_bot_buscarron_requires_restart: true
- name: Ensure buscarron paths exist
ansible.builtin.file:
path: "{{ item.path }}"
state: directory
mode: 0750
owner: "{{ matrix_user_username }}"
group: "{{ matrix_user_groupname }}"
with_items:
- {path: "{{ matrix_bot_buscarron_config_path }}", when: true}
- {path: "{{ matrix_bot_buscarron_data_path }}", when: true}
- {path: "{{ matrix_bot_buscarron_data_store_path }}", when: true}
- {path: "{{ matrix_bot_buscarron_docker_src_files_path }}", when: true}
when: "item.when | bool"
- name: Ensure buscarron environment variables file created
ansible.builtin.template:
src: "{{ role_path }}/templates/env.j2"
dest: "{{ matrix_bot_buscarron_config_path }}/env"
owner: "{{ matrix_user_username }}"
group: "{{ matrix_user_groupname }}"
mode: 0640
- name: Ensure buscarron image is pulled
community.docker.docker_image:
name: "{{ matrix_bot_buscarron_docker_image }}"
source: "{{ 'pull' if ansible_version.major > 2 or ansible_version.minor > 7 else omit }}"
force_source: "{{ matrix_bot_buscarron_docker_image_force_pull if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}"
force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else matrix_bot_buscarron_docker_image_force_pull }}"
when: "not matrix_bot_buscarron_container_image_self_build | bool"
register: result
retries: "{{ matrix_container_retries_count }}"
delay: "{{ matrix_container_retries_delay }}"
until: result is not failed
- name: Ensure buscarron repository is present on self-build
ansible.builtin.git:
repo: "{{ matrix_bot_buscarron_docker_repo }}"
version: "{{ matrix_bot_buscarron_docker_repo_version }}"
dest: "{{ matrix_bot_buscarron_docker_src_files_path }}"
force: "yes"
become: true
become_user: "{{ matrix_user_username }}"
register: matrix_bot_buscarron_git_pull_results
when: "matrix_bot_buscarron_container_image_self_build | bool"
- name: Ensure buscarron image is built
community.docker.docker_image:
name: "{{ matrix_bot_buscarron_docker_image }}"
source: build
force_source: "{{ matrix_bot_buscarron_git_pull_results.changed if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}"
force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else matrix_mailer_git_pull_results.changed }}"
build:
dockerfile: Dockerfile
path: "{{ matrix_bot_buscarron_docker_src_files_path }}"
pull: true
when: "matrix_bot_buscarron_container_image_self_build | bool"
- name: Ensure matrix-bot-buscarron.service installed
ansible.builtin.template:
src: "{{ role_path }}/templates/systemd/matrix-bot-buscarron.service.j2"
dest: "{{ matrix_systemd_path }}/matrix-bot-buscarron.service"
mode: 0644
register: matrix_bot_buscarron_systemd_service_result
- name: Ensure systemd reloaded after matrix-bot-buscarron.service installation
ansible.builtin.service:
daemon_reload: true
when: "matrix_bot_buscarron_systemd_service_result.changed | bool"
- name: Ensure matrix-bot-buscarron.service restarted, if necessary
ansible.builtin.service:
name: "matrix-bot-buscarron.service"
state: restarted
when: "matrix_bot_buscarron_requires_restart | bool"

36
roles/custom/matrix-bot-buscarron/tasks/setup_uninstall.yml Normal file
View File

@ -0,0 +1,36 @@
---
- name: Check existence of matrix-buscarron service
ansible.builtin.stat:
path: "{{ matrix_systemd_path }}/matrix-bot-buscarron.service"
register: matrix_bot_buscarron_service_stat
- name: Ensure matrix-buscarron is stopped
ansible.builtin.service:
name: matrix-bot-buscarron
state: stopped
enabled: false
daemon_reload: true
register: stopping_result
when: "matrix_bot_buscarron_service_stat.stat.exists | bool"
- name: Ensure matrix-bot-buscarron.service doesn't exist
ansible.builtin.file:
path: "{{ matrix_systemd_path }}/matrix-bot-buscarron.service"
state: absent
when: "matrix_bot_buscarron_service_stat.stat.exists | bool"
- name: Ensure systemd reloaded after matrix-bot-buscarron.service removal
ansible.builtin.service:
daemon_reload: true
when: "matrix_bot_buscarron_service_stat.stat.exists | bool"
- name: Ensure Matrix buscarron paths don't exist
ansible.builtin.file:
path: "{{ matrix_bot_buscarron_base_path }}"
state: absent
- name: Ensure buscarron Docker image doesn't exist
community.docker.docker_image:
name: "{{ matrix_bot_buscarron_docker_image }}"
state: absent

9
roles/custom/matrix-bot-buscarron/tasks/validate_config.yml Normal file
View File

@ -0,0 +1,9 @@
---
- name: Fail if required settings not defined
ansible.builtin.fail:
msg: >-
You need to define a required configuration setting (`{{ item }}`).
when: "vars[item] == ''"
with_items:
- "matrix_bot_buscarron_password"

33
roles/custom/matrix-bot-buscarron/templates/env.j2 Normal file
View File

@ -0,0 +1,33 @@
BUSCARRON_LOGIN={{ matrix_bot_buscarron_login }}
BUSCARRON_PASSWORD={{ matrix_bot_buscarron_password }}
BUSCARRON_HOMESERVER={{ matrix_bot_buscarron_homeserver }}
BUSCARRON_DB_DSN={{ matrix_bot_buscarron_database_connection_string }}
BUSCARRON_DB_DIALECT={{ matrix_bot_buscarron_database_dialect }}
BUSCARRON_SPAMLIST={{ matrix_bot_buscarron_spamlist|join(" ") }}
BUSCARRON_SPAM_HOSTS={{ matrix_bot_buscarron_spam_hosts|join(" ") }}
BUSCARRON_SPAM_EMAILS={{ matrix_bot_buscarron_spam_emails|join(" ") }}
BUSCARRON_SPAM_LOCALPARTS={{ matrix_bot_buscarron_spam_localparts|join(" ") }}
BUSCARRON_SENTRY={{ matrix_bot_buscarron_sentry }}
BUSCARRON_LOGLEVEL={{ matrix_bot_buscarron_loglevel }}
BUSCARRON_BAN_SIZE={{ matrix_bot_buscarron_ban_size }}
BUSCARRON_BAN_LIST={{ matrix_bot_buscarron_ban_list|default('')|join(' ') }}
BUSCARRON_PM_TOKEN={{ matrix_bot_buscarron_pm_token }}
BUSCARRON_PM_FROM={{ matrix_bot_buscarron_pm_from }}
BUSCARRON_PM_REPLYTO={{ matrix_bot_buscarron_pm_replyto }}
BUSCARRON_SMTP_FROM={{ matrix_bot_buscarron_smtp_from }}
BUSCARRON_SMTP_VALIDATION={{ matrix_bot_buscarron_smtp_validation }}
BUSCARRON_NOENCRYPTION={{ matrix_bot_buscarron_noencryption }}
{% set forms = [] %}
{% for form in matrix_bot_buscarron_forms -%}{{- forms.append(form.name) -}}
BUSCARRON_{{ form.name|upper }}_ROOM={{ form.room|default('') }}
BUSCARRON_{{ form.name|upper }}_REDIRECT={{ form.redirect|default('') }}
BUSCARRON_{{ form.name|upper }}_HASDOMAIN={{ form.hasdomain|default('') }}
BUSCARRON_{{ form.name|upper }}_HASEMAIL={{ form.hasemail|default('') }}
BUSCARRON_{{ form.name|upper }}_RATELIMIT={{ form.ratelimit|default('') }}
BUSCARRON_{{ form.name|upper }}_EXTENSIONS={{ form.extensions|default('')|join(' ') }}
BUSCARRON_{{ form.name|upper }}_CONFIRMATION_SUBJECT={{ form.confirmation_subject|default('') }}
BUSCARRON_{{ form.name|upper }}_CONFIRMATION_BODY={{ form.confirmation_body|default('') }}
{% endfor %}
BUSCARRON_LIST={{ forms|join(" ") }}
{{ matrix_bot_buscarron_environment_variables_extension }}

39
roles/custom/matrix-bot-buscarron/templates/systemd/matrix-bot-buscarron.service.j2 Normal file
View File

@ -0,0 +1,39 @@
#jinja2: lstrip_blocks: "True"
[Unit]
Description=Matrix web forms bot
{% for service in matrix_bot_buscarron_systemd_required_services_list %}
Requires={{ service }}
After={{ service }}
{% endfor %}
{% for service in matrix_bot_buscarron_systemd_wanted_services_list %}
Wants={{ service }}
{% endfor %}
DefaultDependencies=no
[Service]
Type=simple
Environment="HOME={{ matrix_systemd_unit_home_path }}"
ExecStartPre=-{{ matrix_host_command_sh }} -c '{{ matrix_host_command_docker }} kill matrix-bot-buscarron 2>/dev/null || true'
ExecStartPre=-{{ matrix_host_command_sh }} -c '{{ matrix_host_command_docker }} rm matrix-bot-buscarron 2>/dev/null || true'
ExecStart={{ matrix_host_command_docker }} run --rm --name matrix-bot-buscarron \
--log-driver=none \
--user={{ matrix_user_uid }}:{{ matrix_user_gid }} \
--cap-drop=ALL \
--read-only \
--network={{ matrix_docker_network }} \
--env-file={{ matrix_bot_buscarron_config_path }}/env \
--mount type=bind,src={{ matrix_bot_buscarron_data_path }},dst=/data \
{% for arg in matrix_bot_buscarron_container_extra_arguments %}
{{ arg }} \
{% endfor %}
{{ matrix_bot_buscarron_docker_image }}
ExecStop=-{{ matrix_host_command_sh }} -c '{{ matrix_host_command_docker }} kill matrix-bot-buscarron 2>/dev/null || true'
ExecStop=-{{ matrix_host_command_sh }} -c '{{ matrix_host_command_docker }} rm matrix-bot-buscarron 2>/dev/null || true'
Restart=always
RestartSec=30
SyslogIdentifier=matrix-bot-buscarron
[Install]
WantedBy=multi-user.target

231
roles/custom/matrix-bot-go-neb/defaults/main.yml Normal file
View File

@ -0,0 +1,231 @@
---
# Go-NEB is a Matrix bot written in Go. It is the successor to Matrix-NEB, the original Matrix bot written in Python.
# Project source code URL: https://github.com/matrix-org/go-neb
matrix_bot_go_neb_enabled: true
matrix_bot_go_neb_version: latest
matrix_bot_go_neb_docker_image: "matrixdotorg/go-neb:{{ matrix_bot_go_neb_version }}"
matrix_bot_go_neb_docker_image_force_pull: "{{ matrix_bot_go_neb_docker_image.endswith(':latest') }}"
matrix_bot_go_neb_base_path: "{{ matrix_base_data_path }}/go-neb"
matrix_bot_go_neb_config_path: "{{ matrix_bot_go_neb_base_path }}/config"
matrix_bot_go_neb_config_path_in_container: "/config/config.yaml"
matrix_bot_go_neb_data_path: "{{ matrix_bot_go_neb_base_path }}/data"
matrix_bot_go_neb_data_store_path: "{{ matrix_bot_go_neb_data_path }}/store"
# Controls whether the matrix-bot-go-neb container exposes its HTTP port (tcp/4050 in the container).
#
# Takes an "<ip>:<port>" or "<port>" value (e.g. "127.0.0.1:4050"), or empty string to not expose.
matrix_bot_go_neb_container_http_host_bind_port: ''
# A list of extra arguments to pass to the container
matrix_bot_go_neb_container_extra_arguments: []
# List of systemd services that matrix-bot-go-neb.service depends on
matrix_bot_go_neb_systemd_required_services_list: ['docker.service']
# List of systemd services that matrix-bot-go-neb.service wants
matrix_bot_go_neb_systemd_wanted_services_list: []
# Database-related configuration fields.
#
# MUST be "sqlite3". No other type is supported.
matrix_bot_go_neb_database_engine: 'sqlite3'
matrix_bot_go_neb_sqlite_database_path_local: "{{ matrix_bot_go_neb_data_path }}/bot.db"
matrix_bot_go_neb_sqlite_database_path_in_container: "/data/bot.db"
matrix_bot_go_neb_storage_database: "{{
{
'sqlite3': (matrix_bot_go_neb_sqlite_database_path_in_container + '?_busy_timeout=5000'),
}[matrix_bot_go_neb_database_engine]
}}"
# The bot's username(s). These users need to be created manually beforehand.
# The access tokens that the bot uses to authenticate.
# Generate one as described in
# https://github.com/spantaleev/matrix-docker-ansible-deploy/blob/master/docs/configuring-playbook-dimension.md#access-token
# via curl. With the element method, you might run into decryption problems (see https://github.com/matrix-org/go-neb#quick-start)
matrix_bot_go_neb_clients: []
# - UserID: "@goneb:{{ matrix_domain }}"
# AccessToken: "MDASDASJDIASDJASDAFGFRGER"
# DeviceID: "DEVICE1"
# HomeserverURL: "{{ matrix_homeserver_container_url }}"
# Sync: true
# AutoJoinRooms: true
# DisplayName: "Go-NEB!"
# AcceptVerificationFromUsers: [":{{ matrix_domain }}"]
#
# - UserID: "@another_goneb:{{ matrix_domain }}"
# AccessToken: "MDASDASJDIASDJASDAFGFRGER"
# DeviceID: "DEVICE2"
# HomeserverURL: "{{ matrix_homeserver_container_url }}"
# Sync: false
# AutoJoinRooms: false
# DisplayName: "Go-NEB!"
# AcceptVerificationFromUsers: ["^@admin:{{ matrix_domain }}"]
# The list of realms which Go-NEB is aware of.
# Delete or modify this list as appropriate.
# See the docs for /configureAuthRealm for the full list of options:
# https://matrix-org.github.io/go-neb/pkg/github.com/matrix-org/go-neb/api/index.html#ConfigureAuthRealmRequest
matrix_bot_go_neb_realms: []
# - ID: "github_realm"
# Type: "github"
# Config: {} # No need for client ID or Secret as Go-NEB isn't generating OAuth URLs
# The list of *authenticated* sessions which Go-NEB is aware of.
# Delete or modify this list as appropriate.
# The full list of options are shown below: there is no single HTTP endpoint
# which maps to this section.
# https://matrix-org.github.io/go-neb/pkg/github.com/matrix-org/go-neb/api/index.html#Session
matrix_bot_go_neb_sessions: []
# - SessionID: "your_github_session"
# RealmID: "github_realm"
# UserID: "@YOUR_USER_ID:{{ matrix_domain }}" # This needs to be the username of the person that's allowed to use the !github commands
# Config:
# # Populate these fields by generating a "Personal Access Token" on github.com
# AccessToken: "YOUR_GITHUB_ACCESS_TOKEN"
# Scopes: "admin:org_hook,admin:repo_hook,repo,user"
# The list of services which Go-NEB is aware of.
# Delete or modify this list as appropriate.
# See the docs for /configureService for the full list of options:
# https://matrix-org.github.io/go-neb/pkg/github.com/matrix-org/go-neb/api/index.html#ConfigureServiceRequest
matrix_bot_go_neb_services: []
# - ID: "echo_service"
# Type: "echo"
# UserID: "@goneb:{{ matrix_domain }}"
# Config: {}
## Can be obtained from https://developers.giphy.com/dashboard/
# - ID: "giphy_service"
# Type: "giphy"
# UserID: "@goneb:{{ matrix_domain }}" # requires a Syncing client
# Config:
# api_key: "qwg4672vsuyfsfe"
# use_downsized: false
#
## This service has been dead for over a year :/
# - ID: "guggy_service"
# Type: "guggy"
# UserID: "@goneb:{{ matrix_domain }}" # requires a Syncing client
# Config:
# api_key: "2356saaqfhgfe"
#
## API Key via https://developers.google.com/custom-search/v1/introduction
## CX via http://www.google.com/cse/manage/all
## https://stackoverflow.com/questions/6562125/getting-a-cx-id-for-custom-search-google-api-python
## 'Search the entire web' and 'Image search' enabled for best results
# - ID: "google_service"
# Type: "google"
# UserID: "@goneb:{{ matrix_domain }}" # requires a Syncing client
# Config:
# api_key: "AIzaSyA4FD39m9"
# cx: "AIASDFWSRRtrtr"
#
## Get a key via https://api.imgur.com/oauth2/addclient
## Select "oauth2 without callback url"
# - ID: "imgur_service"
# Type: "imgur"
# UserID: "@imgur:{{ matrix_domain }}" # requires a Syncing client
# Config:
# client_id: "AIzaSyA4FD39m9"
# client_secret: "somesecret"
#
# - ID: "wikipedia_service"
# Type: "wikipedia"
# UserID: "@goneb:{{ matrix_domain }}" # requires a Syncing client
# Config:
#
# - ID: "rss_service"
# Type: "rssbot"
# UserID: "@another_goneb:{{ matrix_domain }}"
# Config:
# feeds:
# "http://lorem-rss.herokuapp.com/feed?unit=second&interval=60":
# rooms: ["!qmElAGdFYCHoCJuaNt:localhost"]
# must_include:
# author:
# - author1
# description:
# - lorem
# - ipsum
# must_not_include:
# title:
# - Lorem
# - Ipsum
#
# - ID: "github_cmd_service"
# Type: "github"
# UserID: "@goneb:{{ matrix_domain }}" # requires a Syncing client
# Config:
# RealmID: "github_realm"
#
# # Make sure your BASE_URL can be accessed by Github!
# - ID: "github_webhook_service"
# Type: "github-webhook"
# UserID: "@another_goneb:{{ matrix_domain }}"
# Config:
# RealmID: "github_realm"
# ClientUserID: "@YOUR_USER_ID:{{ matrix_domain }}" # needs to be an authenticated user so Go-NEB can create webhooks. Check the UserID field in the github_realm in matrix_bot_go_neb_sessions.
# Rooms:
# "!someroom:id":
# Repos:
# "matrix-org/synapse":
# Events: ["push", "issues"]
# "matrix-org/dendron":
# Events: ["pull_request"]
# "!anotherroom:id":
# Repos:
# "matrix-org/synapse":
# Events: ["push", "issues"]
# "matrix-org/dendron":
# Events: ["pull_request"]
#
# - ID: "slackapi_service"
# Type: "slackapi"
# UserID: "@slackapi:{{ matrix_domain }}"
# Config:
# Hooks:
# "hook1":
# RoomID: "!someroom:id"
# MessageType: "m.text" # default is m.text
#
# - ID: "alertmanager_service"
# Type: "alertmanager"
# UserID: "@alertmanager:{{ matrix_domain }}"
# Config:
# # This is for information purposes only. It should point to Go-NEB path as follows:
# # `/services/hooks/<base64 encoded service ID>`
# # Where in this case "service ID" is "alertmanager_service"
# # Make sure your BASE_URL can be accessed by the Alertmanager instance!
# webhook_url: "http://localhost/services/hooks/YWxlcnRtYW5hZ2VyX3NlcnZpY2U"
# # Each room will get the notification with the alert rendered with the given template
# rooms:
# "!someroomid:domain.tld":
# text_template: "{% raw %}{{range .Alerts -}} [{{ .Status }}] {{index .Labels \"alertname\"}}: {{index .Annotations \"description\"}} {{ end -}}{% endraw %}"
# html_template: "{% raw %}{{range .Alerts -}} {{ $severity := index .Labels \"severity\"}} {{ if eq .Status \"firing\"}} {{ if eq $severity \"critical\"}} <font color='red'><b>[FIRING - CRITICAL]</b></font> {{ else if eq $severity \"warning\"}} <font color='orange'><b>[FIRING - WARNING]</b></font> {{ else }} <b>[FIRING - {{ $severity }}]</b> {{ end }} {{ else }} <font color='green'><b>[RESOLVED]</b></font> {{ end }} {{ index .Labels \"alertname\"}} : {{ index .Annotations \"description\"}} <a href=\"{{ .GeneratorURL }}\">source</a><br/>{{end -}}{% endraw %}"
# msg_type: "m.text" # Must be either `m.text` or `m.notice`
# Default configuration template which covers the generic use case.
# You can customize it by controlling the various variables inside it.
#
# For a more advanced customization, you can extend the default (see `matrix_bot_go_neb_configuration_extension_yaml`)
# or completely replace this variable with your own template.
matrix_bot_go_neb_configuration_yaml: "{{ lookup('template', 'templates/config.yaml.j2') }}"
matrix_bot_go_neb_configuration_extension_yaml: |
# Your custom YAML configuration goes here.
# This configuration extends the default starting configuration (`matrix_bot_go_neb_configuration_yaml`).
#
# You can override individual variables from the default configuration, or introduce new ones.
#
# If you need something more special, you can take full control by
# completely redefining `matrix_bot_go_neb_configuration_yaml`.
matrix_bot_go_neb_configuration_extension: "{{ matrix_bot_go_neb_configuration_extension_yaml | from_yaml if matrix_bot_go_neb_configuration_extension_yaml | from_yaml is mapping else {} }}"
# Holds the final configuration (a combination of the default and its extension).
# You most likely don't need to touch this variable. Instead, see `matrix_bot_go_neb_configuration_yaml`.
matrix_bot_go_neb_configuration: "{{ matrix_bot_go_neb_configuration_yaml | from_yaml | combine(matrix_bot_go_neb_configuration_extension, recursive=True) }}"

5
roles/custom/matrix-bot-go-neb/tasks/init.yml Normal file
View File

@ -0,0 +1,5 @@
---
- ansible.builtin.set_fact:
matrix_systemd_services_list: "{{ matrix_systemd_services_list + ['matrix-bot-go-neb.service'] }}"
when: matrix_bot_go_neb_enabled | bool

23
roles/custom/matrix-bot-go-neb/tasks/main.yml Normal file
View File

@ -0,0 +1,23 @@
---
- ansible.builtin.import_tasks: "{{ role_path }}/tasks/init.yml"
tags:
- always
- ansible.builtin.import_tasks: "{{ role_path }}/tasks/validate_config.yml"
when: "run_setup | bool and matrix_bot_go_neb_enabled | bool"
tags:
- setup-all
- setup-bot-go-neb
- ansible.builtin.import_tasks: "{{ role_path }}/tasks/setup_install.yml"
when: "run_setup | bool and matrix_bot_go_neb_enabled | bool"
tags:
- setup-all
- setup-bot-go-neb
- ansible.builtin.import_tasks: "{{ role_path }}/tasks/setup_uninstall.yml"
when: "run_setup | bool and not matrix_bot_go_neb_enabled | bool"
tags:
- setup-all
- setup-bot-go-neb

54
roles/custom/matrix-bot-go-neb/tasks/setup_install.yml Normal file
View File

@ -0,0 +1,54 @@
---
- ansible.builtin.set_fact:
matrix_bot_go_neb_requires_restart: false
- name: Ensure go-neb paths exist
ansible.builtin.file:
path: "{{ item.path }}"
state: directory
mode: 0750
owner: "{{ matrix_user_username }}"
group: "{{ matrix_user_groupname }}"
with_items:
- {path: "{{ matrix_bot_go_neb_config_path }}", when: true}
- {path: "{{ matrix_bot_go_neb_data_path }}", when: true}
- {path: "{{ matrix_bot_go_neb_data_store_path }}", when: true}
when: "item.when | bool"
- name: Ensure go-neb image is pulled
community.docker.docker_image:
name: "{{ matrix_bot_go_neb_docker_image }}"
source: "{{ 'pull' if ansible_version.major > 2 or ansible_version.minor > 7 else omit }}"
force_source: "{{ matrix_bot_go_neb_docker_image_force_pull if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}"
force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else matrix_bot_go_neb_docker_image_force_pull }}"
register: result
retries: "{{ matrix_container_retries_count }}"
delay: "{{ matrix_container_retries_delay }}"
until: result is not failed
- name: Ensure go-neb config installed
ansible.builtin.copy:
content: "{{ matrix_bot_go_neb_configuration | to_nice_yaml(indent=2, width=999999) }}"
dest: "{{ matrix_bot_go_neb_config_path }}/config.yaml"
mode: 0644
owner: "{{ matrix_user_username }}"
group: "{{ matrix_user_groupname }}"
- name: Ensure matrix-bot-go-neb.service installed
ansible.builtin.template:
src: "{{ role_path }}/templates/systemd/matrix-bot-go-neb.service.j2"
dest: "{{ matrix_systemd_path }}/matrix-bot-go-neb.service"
mode: 0644
register: matrix_bot_go_neb_systemd_service_result
- name: Ensure systemd reloaded after matrix-bot-go-neb.service installation
ansible.builtin.service:
daemon_reload: true
when: "matrix_bot_go_neb_systemd_service_result.changed | bool"
- name: Ensure matrix-bot-go-neb.service restarted, if necessary
ansible.builtin.service:
name: "matrix-bot-go-neb.service"
state: restarted
when: "matrix_bot_go_neb_requires_restart | bool"

36
roles/custom/matrix-bot-go-neb/tasks/setup_uninstall.yml Normal file
View File

@ -0,0 +1,36 @@
---
- name: Check existence of matrix-go-neb service
ansible.builtin.stat:
path: "{{ matrix_systemd_path }}/matrix-bot-go-neb.service"
register: matrix_bot_go_neb_service_stat
- name: Ensure matrix-go-neb is stopped
ansible.builtin.service:
name: matrix-bot-go-neb
state: stopped
enabled: false
daemon_reload: true
register: stopping_result
when: "matrix_bot_go_neb_service_stat.stat.exists | bool"
- name: Ensure matrix-bot-go-neb.service doesn't exist
ansible.builtin.file:
path: "{{ matrix_systemd_path }}/matrix-bot-go-neb.service"
state: absent
when: "matrix_bot_go_neb_service_stat.stat.exists | bool"
- name: Ensure systemd reloaded after matrix-bot-go-neb.service removal
ansible.builtin.service:
daemon_reload: true
when: "matrix_bot_go_neb_service_stat.stat.exists | bool"
- name: Ensure Matrix go-neb paths don't exist
ansible.builtin.file:
path: "{{ matrix_bot_go_neb_base_path }}"
state: absent
- name: Ensure go-neb Docker image doesn't exist
community.docker.docker_image:
name: "{{ matrix_bot_go_neb_docker_image }}"
state: absent

13
roles/custom/matrix-bot-go-neb/tasks/validate_config.yml Normal file
View File

@ -0,0 +1,13 @@
---
- name: Fail if there's not at least 1 client
ansible.builtin.fail:
msg: >-
You need at least 1 client in the matrix_bot_go_neb_clients block.
when: matrix_bot_go_neb_clients is not defined or matrix_bot_go_neb_clients[0] is not defined
- name: Fail if there's not at least 1 service
ansible.builtin.fail:
msg: >-
You need at least 1 service in the matrix_bot_go_neb_services block.
when: matrix_bot_go_neb_services is not defined or matrix_bot_go_neb_services[0] is not defined

44
roles/custom/matrix-bot-go-neb/templates/config.yaml.j2 Normal file
View File

@ -0,0 +1,44 @@
# Go-NEB Configuration File
#
# This file provides an alternative way to configure Go-NEB which does not involve HTTP APIs.
#
# This file can be supplied to go-neb by the environment variable `CONFIG_FILE=config.yaml`.
# It will force Go-NEB to operate in "config" mode. This means:
# - Go-NEB will ONLY use the data contained inside this file.
# - All of Go-NEB's /admin HTTP listeners will be disabled. You will be unable to add new services at runtime.
# - The environment variable `DATABASE_URL` will be ignored and an in-memory database will be used instead.
#
# This file is broken down into 4 sections which matches the following HTTP APIs:
# - /configureClient
# - /configureAuthRealm
# - /configureService
# - /requestAuthSession (redirects not supported)
# The list of clients which Go-NEB is aware of.
# Delete or modify this list as appropriate.
# See the docs for /configureClient for the full list of options:
# https://matrix-org.github.io/go-neb/pkg/github.com/matrix-org/go-neb/api/index.html#ClientConfig
clients:
{{ matrix_bot_go_neb_clients|to_json }}
# The list of realms which Go-NEB is aware of.
# Delete or modify this list as appropriate.
# See the docs for /configureAuthRealm for the full list of options:
# https://matrix-org.github.io/go-neb/pkg/github.com/matrix-org/go-neb/api/index.html#ConfigureAuthRealmRequest
realms:
{{ matrix_bot_go_neb_realms|to_json }}
# The list of *authenticated* sessions which Go-NEB is aware of.
# Delete or modify this list as appropriate.
# The full list of options are shown below: there is no single HTTP endpoint
# which maps to this section.
# https://matrix-org.github.io/go-neb/pkg/github.com/matrix-org/go-neb/api/index.html#Session
sessions:
{{ matrix_bot_go_neb_sessions|to_json }}
# The list of services which Go-NEB is aware of.
# Delete or modify this list as appropriate.
# See the docs for /configureService for the full list of options:
# https://matrix-org.github.io/go-neb/pkg/github.com/matrix-org/go-neb/api/index.html#ConfigureServiceRequest
services:
{{ matrix_bot_go_neb_services|to_json }}

49
roles/custom/matrix-bot-go-neb/templates/systemd/matrix-bot-go-neb.service.j2 Normal file
View File

@ -0,0 +1,49 @@
#jinja2: lstrip_blocks: "True"
[Unit]
Description=Matrix Go-NEB bot
{% for service in matrix_bot_go_neb_systemd_required_services_list %}
Requires={{ service }}
After={{ service }}
{% endfor %}
{% for service in matrix_bot_go_neb_systemd_wanted_services_list %}
Wants={{ service }}
{% endfor %}
DefaultDependencies=no
[Service]
Type=simple
Environment="HOME={{ matrix_systemd_unit_home_path }}"
ExecStartPre=-{{ matrix_host_command_sh }} -c '{{ matrix_host_command_docker }} kill matrix-bot-go-neb 2>/dev/null || true'
ExecStartPre=-{{ matrix_host_command_sh }} -c '{{ matrix_host_command_docker }} rm matrix-bot-go-neb 2>/dev/null || true'
ExecStart={{ matrix_host_command_docker }} run --rm --name matrix-bot-go-neb \
--log-driver=none \
--user={{ matrix_user_uid }}:{{ matrix_user_gid }} \
--cap-drop=ALL \
--read-only \
--network={{ matrix_docker_network }} \
{% if matrix_bot_go_neb_container_http_host_bind_port %}
-p {{ matrix_bot_go_neb_container_http_host_bind_port }}:4050 \
{% endif %}
-e 'BIND_ADDRESS=:4050' \
-e 'DATABASE_TYPE={{ matrix_bot_go_neb_database_engine }}' \
-e 'BASE_URL=https://{{ matrix_server_fqn_bot_go_neb }}' \
-e 'CONFIG_FILE={{ matrix_bot_go_neb_config_path_in_container }}' \
-e 'DATABASE_URL={{ matrix_bot_go_neb_storage_database }}' \
--mount type=bind,src={{ matrix_bot_go_neb_config_path }},dst=/config,ro \
--mount type=bind,src={{ matrix_bot_go_neb_data_path }},dst=/data \
--entrypoint=/bin/sh \
{% for arg in matrix_bot_go_neb_container_extra_arguments %}
{{ arg }} \
{% endfor %}
{{ matrix_bot_go_neb_docker_image }} \
-c "go-neb /config/config.yaml"
ExecStop=-{{ matrix_host_command_sh }} -c '{{ matrix_host_command_docker }} kill matrix-bot-go-neb 2>/dev/null || true'
ExecStop=-{{ matrix_host_command_sh }} -c '{{ matrix_host_command_docker }} rm matrix-bot-go-neb 2>/dev/null || true'
Restart=always
RestartSec=30
SyslogIdentifier=matrix-bot-go-neb
[Install]
WantedBy=multi-user.target

146
roles/custom/matrix-bot-honoroit/defaults/main.yml Normal file
View File

@ -0,0 +1,146 @@
---
# honoroit is a helpdesk bot
# Project source code URL: https://gitlab.com/etke.cc/honoroit
matrix_bot_honoroit_enabled: true
matrix_bot_honoroit_container_image_self_build: false
matrix_bot_honoroit_docker_repo: "https://gitlab.com/etke.cc/honoroit.git"
matrix_bot_honoroit_docker_repo_version: "{{ matrix_bot_honoroit_version }}"
matrix_bot_honoroit_docker_src_files_path: "{{ matrix_base_data_path }}/honoroit/docker-src"
matrix_bot_honoroit_version: v0.9.16
matrix_bot_honoroit_docker_image: "{{ matrix_bot_honoroit_docker_image_name_prefix }}honoroit:{{ matrix_bot_honoroit_version }}"
matrix_bot_honoroit_docker_image_name_prefix: "{{ 'localhost/' if matrix_bot_honoroit_container_image_self_build else 'registry.gitlab.com/etke.cc/' }}"
matrix_bot_honoroit_docker_image_force_pull: "{{ matrix_bot_honoroit_docker_image.endswith(':latest') }}"
matrix_bot_honoroit_base_path: "{{ matrix_base_data_path }}/honoroit"
matrix_bot_honoroit_config_path: "{{ matrix_bot_honoroit_base_path }}/config"
matrix_bot_honoroit_data_path: "{{ matrix_bot_honoroit_base_path }}/data"
matrix_bot_honoroit_data_store_path: "{{ matrix_bot_honoroit_data_path }}/store"
# A list of extra arguments to pass to the container
matrix_bot_honoroit_container_extra_arguments: []
# List of systemd services that matrix-bot-honoroit.service depends on
matrix_bot_honoroit_systemd_required_services_list: ['docker.service']
# List of systemd services that matrix-bot-honoroit.service wants
matrix_bot_honoroit_systemd_wanted_services_list: []
# Database-related configuration fields.
#
# To use SQLite, stick to these defaults.
#
# To use Postgres:
# - change the engine (`matrix_bot_honoroit_database_engine: 'postgres'`)
# - adjust your database credentials via the `matrix_bot_honoroit_database_*` variables
matrix_bot_honoroit_database_engine: 'sqlite'
matrix_bot_honoroit_sqlite_database_path_local: "{{ matrix_bot_honoroit_data_path }}/bot.db"
matrix_bot_honoroit_sqlite_database_path_in_container: "/data/bot.db"
matrix_bot_honoroit_database_username: 'honoroit'
matrix_bot_honoroit_database_password: 'some-password'
matrix_bot_honoroit_database_hostname: 'matrix-postgres'
matrix_bot_honoroit_database_port: 5432
matrix_bot_honoroit_database_name: 'honoroit'
matrix_bot_honoroit_database_connection_string: 'postgres://{{ matrix_bot_honoroit_database_username }}:{{ matrix_bot_honoroit_database_password }}@{{ matrix_bot_honoroit_database_hostname }}:{{ matrix_bot_honoroit_database_port }}/{{ matrix_bot_honoroit_database_name }}?sslmode=disable'
matrix_bot_honoroit_storage_database: "{{
{
'sqlite': matrix_bot_honoroit_sqlite_database_path_in_container,
'postgres': matrix_bot_honoroit_database_connection_string,
}[matrix_bot_honoroit_database_engine]
}}"
matrix_bot_honoroit_database_dialect: "{{
{
'sqlite': 'sqlite3',
'postgres': 'postgres',
}[matrix_bot_honoroit_database_engine]
}}"
# The bot's username. This user needs to be created manually beforehand.
# Also see `matrix_bot_honoroit_password`.
matrix_bot_honoroit_login: "honoroit"
# The password that the bot uses to authenticate.
matrix_bot_honoroit_password: ''
matrix_bot_honoroit_homeserver: "{{ matrix_homeserver_container_url }}"
# The room ID where bot will create threads
matrix_bot_honoroit_roomid: ''
# Command prefix
matrix_bot_honoroit_prefix: ''
# Sentry DSN
matrix_bot_honoroit_sentry: ''
# Log level
matrix_bot_honoroit_loglevel: ''
# Disable encryption
matrix_bot_honoroit_noencryption: false
# A list of whitelisted users allowed to use/invite honoroit
# If not defined, everyone is allowed.
# Example set of rules:
# matrix_bot_honoroit_allowedusers:
# - @someone:example.com
# - @another:example.com
# - @bot.*:example.com
# - @*:another.com
matrix_bot_honoroit_allowedusers:
- "@*:*"
# Max items in cache
matrix_bot_honoroit_cachesize: ''
# List of ignored room IDs
matrix_bot_honoroit_ignoredrooms: []
# Ignore messages outside of threads
matrix_bot_honoroit_ignorenothread: false
# Text prefix: open
matrix_bot_honoroit_text_prefix_open: ''
# Text prefix: done
matrix_bot_honoroit_text_prefix_done: ''
# Text: no encryption
matrix_bot_honoroit_text_noencryption: ''
# Text: greetings
matrix_bot_honoroit_text_greetings: ''
# Text: invite
matrix_bot_honoroit_text_invite: ''
# Text: join
matrix_bot_honoroit_text_join: ''
# Text: leave
matrix_bot_honoroit_text_leave: ''
# Text: error
matrix_bot_honoroit_text_error: ''
# Text: empty room
matrix_bot_honoroit_text_emptyroom: ''
# Text: done
matrix_bot_honoroit_text_done: ''
# Additional environment variables to pass to the Honoroit container
#
# Example:
# matrix_bot_honoroit_environment_variables_extension: |
# HONOROIT_TEXT_DONE=Done
matrix_bot_honoroit_environment_variables_extension: ''

5
roles/custom/matrix-bot-honoroit/tasks/init.yml Normal file
View File

@ -0,0 +1,5 @@
---
- ansible.builtin.set_fact:
matrix_systemd_services_list: "{{ matrix_systemd_services_list + ['matrix-bot-honoroit.service'] }}"
when: matrix_bot_honoroit_enabled | bool

23
roles/custom/matrix-bot-honoroit/tasks/main.yml Normal file
View File

@ -0,0 +1,23 @@
---
- ansible.builtin.import_tasks: "{{ role_path }}/tasks/init.yml"
tags:
- always
- ansible.builtin.import_tasks: "{{ role_path }}/tasks/validate_config.yml"
when: "run_setup | bool and matrix_bot_honoroit_enabled | bool"
tags:
- setup-all
- setup-bot-honoroit
- ansible.builtin.import_tasks: "{{ role_path }}/tasks/setup_install.yml"
when: "run_setup | bool and matrix_bot_honoroit_enabled | bool"
tags:
- setup-all
- setup-bot-honoroit
- ansible.builtin.import_tasks: "{{ role_path }}/tasks/setup_uninstall.yml"
when: "run_setup | bool and not matrix_bot_honoroit_enabled | bool"
tags:
- setup-all
- setup-bot-honoroit

103
roles/custom/matrix-bot-honoroit/tasks/setup_install.yml Normal file
View File

@ -0,0 +1,103 @@
---
- ansible.builtin.set_fact:
matrix_bot_honoroit_requires_restart: false
- when: "matrix_bot_honoroit_database_engine == 'postgres'"
block:
- name: Check if an SQLite database already exists
ansible.builtin.stat:
path: "{{ matrix_bot_honoroit_sqlite_database_path_local }}"
register: matrix_bot_honoroit_sqlite_database_path_local_stat_result
- when: "matrix_bot_honoroit_sqlite_database_path_local_stat_result.stat.exists | bool"
block:
- ansible.builtin.set_fact:
matrix_postgres_db_migration_request:
src: "{{ matrix_bot_honoroit_sqlite_database_path_local }}"
dst: "{{ matrix_bot_honoroit_database_connection_string }}"
caller: "{{ role_path | basename }}"
engine_variable_name: 'matrix_bot_honoroit_database_engine'
engine_old: 'sqlite'
systemd_services_to_stop: ['matrix-bot-honoroit.service']
- ansible.builtin.import_role:
name: custom/matrix-postgres
tasks_from: migrate_db_to_postgres
- ansible.builtin.set_fact:
matrix_bot_honoroit_requires_restart: true
- name: Ensure honoroit paths exist
ansible.builtin.file:
path: "{{ item.path }}"
state: directory
mode: 0750
owner: "{{ matrix_user_username }}"
group: "{{ matrix_user_groupname }}"
with_items:
- {path: "{{ matrix_bot_honoroit_config_path }}", when: true}
- {path: "{{ matrix_bot_honoroit_data_path }}", when: true}
- {path: "{{ matrix_bot_honoroit_data_store_path }}", when: true}
- {path: "{{ matrix_bot_honoroit_docker_src_files_path }}", when: true}
when: "item.when | bool"
- name: Ensure honoroit environment variables file created
ansible.builtin.template:
src: "{{ role_path }}/templates/env.j2"
dest: "{{ matrix_bot_honoroit_config_path }}/env"
owner: "{{ matrix_user_username }}"
group: "{{ matrix_user_groupname }}"
mode: 0640
- name: Ensure honoroit image is pulled
community.docker.docker_image:
name: "{{ matrix_bot_honoroit_docker_image }}"
source: "{{ 'pull' if ansible_version.major > 2 or ansible_version.minor > 7 else omit }}"
force_source: "{{ matrix_bot_honoroit_docker_image_force_pull if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}"
force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else matrix_bot_honoroit_docker_image_force_pull }}"
when: "not matrix_bot_honoroit_container_image_self_build | bool"
register: result
retries: "{{ matrix_container_retries_count }}"
delay: "{{ matrix_container_retries_delay }}"
until: result is not failed
- name: Ensure honoroit repository is present on self-build
ansible.builtin.git:
repo: "{{ matrix_bot_honoroit_docker_repo }}"
version: "{{ matrix_bot_honoroit_docker_repo_version }}"
dest: "{{ matrix_bot_honoroit_docker_src_files_path }}"
force: "yes"
become: true
become_user: "{{ matrix_user_username }}"
register: matrix_bot_honoroit_git_pull_results
when: "matrix_bot_honoroit_container_image_self_build | bool"
- name: Ensure honoroit image is built
community.docker.docker_image:
name: "{{ matrix_bot_honoroit_docker_image }}"
source: build
force_source: "{{ matrix_bot_honoroit_git_pull_results.changed if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}"
force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else matrix_mailer_git_pull_results.changed }}"
build:
dockerfile: Dockerfile
path: "{{ matrix_bot_honoroit_docker_src_files_path }}"
pull: true
when: "matrix_bot_honoroit_container_image_self_build | bool"
- name: Ensure matrix-bot-honoroit.service installed
ansible.builtin.template:
src: "{{ role_path }}/templates/systemd/matrix-bot-honoroit.service.j2"
dest: "{{ matrix_systemd_path }}/matrix-bot-honoroit.service"
mode: 0644
register: matrix_bot_honoroit_systemd_service_result
- name: Ensure systemd reloaded after matrix-bot-honoroit.service installation
ansible.builtin.service:
daemon_reload: true
when: "matrix_bot_honoroit_systemd_service_result.changed | bool"
- name: Ensure matrix-bot-honoroit.service restarted, if necessary
ansible.builtin.service:
name: "matrix-bot-honoroit.service"
state: restarted
when: "matrix_bot_honoroit_requires_restart | bool"

36
roles/custom/matrix-bot-honoroit/tasks/setup_uninstall.yml Normal file
View File

@ -0,0 +1,36 @@
---
- name: Check existence of matrix-honoroit service
ansible.builtin.stat:
path: "{{ matrix_systemd_path }}/matrix-bot-honoroit.service"
register: matrix_bot_honoroit_service_stat
- name: Ensure matrix-honoroit is stopped
ansible.builtin.service:
name: matrix-bot-honoroit
state: stopped
enabled: false
daemon_reload: true
register: stopping_result
when: "matrix_bot_honoroit_service_stat.stat.exists | bool"
- name: Ensure matrix-bot-honoroit.service doesn't exist
ansible.builtin.file:
path: "{{ matrix_systemd_path }}/matrix-bot-honoroit.service"
state: absent
when: "matrix_bot_honoroit_service_stat.stat.exists | bool"
- name: Ensure systemd reloaded after matrix-bot-honoroit.service removal
ansible.builtin.service:
daemon_reload: true
when: "matrix_bot_honoroit_service_stat.stat.exists | bool"
- name: Ensure Matrix honoroit paths don't exist
ansible.builtin.file:
path: "{{ matrix_bot_honoroit_base_path }}"
state: absent
- name: Ensure honoroit Docker image doesn't exist
community.docker.docker_image:
name: "{{ matrix_bot_honoroit_docker_image }}"
state: absent

10
roles/custom/matrix-bot-honoroit/tasks/validate_config.yml Normal file
View File

@ -0,0 +1,10 @@
---
- name: Fail if required settings not defined
ansible.builtin.fail:
msg: >-
You need to define a required configuration setting (`{{ item }}`).
when: "vars[item] == ''"
with_items:
- "matrix_bot_honoroit_password"
- "matrix_bot_honoroit_roomid"

26
roles/custom/matrix-bot-honoroit/templates/env.j2 Normal file
View File

@ -0,0 +1,26 @@
HONOROIT_LOGIN={{ matrix_bot_honoroit_login }}
HONOROIT_PASSWORD={{ matrix_bot_honoroit_password }}
HONOROIT_HOMESERVER={{ matrix_bot_honoroit_homeserver }}
HONOROIT_ROOMID={{ matrix_bot_honoroit_roomid }}
HONOROIT_DB_DSN={{ matrix_bot_honoroit_database_connection_string }}
HONOROIT_DB_DIALECT={{ matrix_bot_honoroit_database_dialect }}
HONOROIT_PREFIX={{ matrix_bot_honoroit_prefix }}
HONOROIT_SENTRY={{ matrix_bot_honoroit_sentry }}
HONOROIT_LOGLEVEL={{ matrix_bot_honoroit_loglevel }}
HONOROIT_CACHESIZE={{ matrix_bot_honoroit_cachesize }}
HONOROIT_NOENCRYPTION={{ matrix_bot_honoroit_noencryption }}
HONOROIT_IGNORENOTHREAD={{ matrix_bot_honoroit_ignorenothread }}
HONOROIT_IGNOREDROOMS={{ matrix_bot_honoroit_ignoredrooms | join(' ') }}
HONOROIT_ALLOWEDUSERS={{ matrix_bot_honoroit_allowedusers | join(' ') }}
HONOROIT_TEXT_PREFIX_OPEN={{ matrix_bot_honoroit_text_prefix_open }}
HONOROIT_TEXT_PREFIX_DONE={{ matrix_bot_honoroit_text_prefix_done }}
HONOROIT_TEXT_NOENCRYPTION={{ matrix_bot_honoroit_text_noencryption }}
HONOROIT_TEXT_GREETINGS={{ matrix_bot_honoroit_text_greetings }}
HONOROIT_TEXT_INVITE={{ matrix_bot_honoroit_text_invite }}
HONOROIT_TEXT_JOIN={{ matrix_bot_honoroit_text_join }}
HONOROIT_TEXT_LEAVE={{ matrix_bot_honoroit_text_leave }}
HONOROIT_TEXT_ERROR={{ matrix_bot_honoroit_text_error }}
HONOROIT_TEXT_EMPTYROOM={{ matrix_bot_honoroit_text_emptyroom }}
HONOROIT_TEXT_DONE={{ matrix_bot_honoroit_text_done }}
{{ matrix_bot_honoroit_environment_variables_extension }}

39
roles/custom/matrix-bot-honoroit/templates/systemd/matrix-bot-honoroit.service.j2 Normal file
View File

@ -0,0 +1,39 @@
#jinja2: lstrip_blocks: "True"
[Unit]
Description=Matrix helpdesk bot
{% for service in matrix_bot_honoroit_systemd_required_services_list %}
Requires={{ service }}
After={{ service }}
{% endfor %}
{% for service in matrix_bot_honoroit_systemd_wanted_services_list %}
Wants={{ service }}
{% endfor %}
DefaultDependencies=no
[Service]
Type=simple
Environment="HOME={{ matrix_systemd_unit_home_path }}"
ExecStartPre=-{{ matrix_host_command_sh }} -c '{{ matrix_host_command_docker }} kill matrix-bot-honoroit 2>/dev/null || true'
ExecStartPre=-{{ matrix_host_command_sh }} -c '{{ matrix_host_command_docker }} rm matrix-bot-honoroit 2>/dev/null || true'
ExecStart={{ matrix_host_command_docker }} run --rm --name matrix-bot-honoroit \
--log-driver=none \
--user={{ matrix_user_uid }}:{{ matrix_user_gid }} \
--cap-drop=ALL \
--read-only \
--network={{ matrix_docker_network }} \
--env-file={{ matrix_bot_honoroit_config_path }}/env \
--mount type=bind,src={{ matrix_bot_honoroit_data_path }},dst=/data \
{% for arg in matrix_bot_honoroit_container_extra_arguments %}
{{ arg }} \
{% endfor %}
{{ matrix_bot_honoroit_docker_image }}
ExecStop=-{{ matrix_host_command_sh }} -c '{{ matrix_host_command_docker }} kill matrix-bot-honoroit 2>/dev/null || true'
ExecStop=-{{ matrix_host_command_sh }} -c '{{ matrix_host_command_docker }} rm matrix-bot-honoroit 2>/dev/null || true'
Restart=always
RestartSec=30
SyslogIdentifier=matrix-bot-honoroit
[Install]
WantedBy=multi-user.target

50
roles/custom/matrix-bot-matrix-registration-bot/defaults/main.yml Normal file
View File

@ -0,0 +1,50 @@
---
# matrix-registration-bot creates and manages registration tokens for a matrix server
# Project source code URL: https://github.com/moan0s/matrix-registration-bot
matrix_bot_matrix_registration_bot_enabled: true
matrix_bot_matrix_registration_bot_container_image_self_build: false
matrix_bot_matrix_registration_bot_docker_repo: "https://github.com/moan0s/matrix-registration-bot.git"
matrix_bot_matrix_registration_bot_docker_repo_version: "{{ matrix_bot_matrix_registration_bot_version if matrix_bot_matrix_registration_bot_version != 'latest' else 'main' }}"
matrix_bot_matrix_registration_bot_docker_src_files_path: "{{ matrix_bot_matrix_registration_bot_base_path }}/docker-src"
matrix_bot_matrix_registration_bot_version: latest
matrix_bot_matrix_registration_bot_docker_image: "{{ matrix_container_global_registry_prefix }}moanos/matrix-registration-bot:{{ matrix_bot_matrix_registration_bot_version }}"
matrix_bot_matrix_registration_bot_docker_image_force_pull: "{{ matrix_bot_matrix_registration_bot_docker_image.endswith(':latest') }}"
matrix_bot_matrix_registration_bot_base_path: "{{ matrix_base_data_path }}/matrix-registration-bot"
matrix_bot_matrix_registration_bot_config_path: "{{ matrix_bot_matrix_registration_bot_base_path }}/config"
matrix_bot_matrix_registration_bot_data_path: "{{ matrix_bot_matrix_registration_bot_base_path }}/data"
matrix_bot_matrix_registration_bot_bot_server: "https://{{ matrix_server_fqn_matrix }}"
matrix_bot_matrix_registration_bot_api_base_url: "https://{{ matrix_server_fqn_matrix }}"
# The access token that the bot uses to communicate in Matrix chats
# This does not necessarily need to be a privileged (admin) access token.
matrix_bot_matrix_registration_bot_bot_access_token: ''
# The access token that the bot uses to call the Matrix API for creating registration tokens.
# This needs to be a privileged (admin) access token.
# By default, we assume `matrix_bot_matrix_registration_bot_bot_access_token` is such a privileged token and we use it as is.
# If necessary, you can define your own other access token here, which might even be for a different Matrix user.
matrix_bot_matrix_registration_bot_api_token: "{{ matrix_bot_matrix_registration_bot_bot_access_token }}"
matrix_bot_matrix_registration_bot_logging_level: info
matrix_bot_matrix_registration_environment_variables_extension: ''
# A list of extra arguments to pass to the container
matrix_bot_matrix_registration_bot_container_extra_arguments: []
# List of systemd services that matrix-bot-matrix-registration-bot.service depends on
matrix_bot_matrix_registration_bot_systemd_required_services_list: ['docker.service']
# List of systemd services that matrix-bot-matrix-registration-bot.service wants
matrix_bot_matrix_registration_bot_systemd_wanted_services_list: []
# The bot's username. This user needs to be created manually beforehand.
# Also see `matrix_bot_matrix_registration_bot_user_password`.
matrix_bot_matrix_registration_bot_matrix_user_id_localpart: "bot.matrix-registration-bot"
matrix_bot_matrix_registration_bot_matrix_user_id: '@{{ matrix_bot_matrix_registration_bot_matrix_user_id_localpart }}:{{ matrix_domain }}'
matrix_bot_matrix_registration_bot_matrix_homeserver_url: "{{ matrix_homeserver_container_url }}"

5
roles/custom/matrix-bot-matrix-registration-bot/tasks/init.yml Normal file
View File

@ -0,0 +1,5 @@
---
- ansible.builtin.set_fact:
matrix_systemd_services_list: "{{ matrix_systemd_services_list + ['matrix-bot-matrix-registration-bot.service'] }}"
when: matrix_bot_matrix_registration_bot_enabled | bool

23
roles/custom/matrix-bot-matrix-registration-bot/tasks/main.yml Normal file
View File

@ -0,0 +1,23 @@
---
- ansible.builtin.import_tasks: "{{ role_path }}/tasks/init.yml"
tags:
- always
- ansible.builtin.import_tasks: "{{ role_path }}/tasks/validate_config.yml"
when: "run_setup | bool and matrix_bot_matrix_registration_bot_enabled | bool"
tags:
- setup-all
- setup-bot-matrix-registration-bot
- ansible.builtin.import_tasks: "{{ role_path }}/tasks/setup_install.yml"
when: "run_setup | bool and matrix_bot_matrix_registration_bot_enabled | bool"
tags:
- setup-all
- setup-bot-matrix-registration-bot
- ansible.builtin.import_tasks: "{{ role_path }}/tasks/setup_uninstall.yml"
when: "run_setup | bool and not matrix_bot_matrix_registration_bot_enabled | bool"
tags:
- setup-all
- setup-bot-matrix-registration-bot

74
roles/custom/matrix-bot-matrix-registration-bot/tasks/setup_install.yml Normal file
View File

@ -0,0 +1,74 @@
---
- name: Ensure matrix-registration-bot paths exist
ansible.builtin.file:
path: "{{ item.path }}"
state: directory
mode: 0750
owner: "{{ matrix_user_username }}"
group: "{{ matrix_user_groupname }}"
with_items:
- {path: "{{ matrix_bot_matrix_registration_bot_config_path }}", when: true}
- - {path: "{{ matrix_bot_matrix_registration_bot_data_path }}", when: true}
- {path: "{{ matrix_bot_matrix_registration_bot_docker_src_files_path }}", when: true}
when: "item.when | bool"
- name: Ensure matrix-registration-bot configuration file created
ansible.builtin.template:
src: "{{ role_path }}/templates/config/config.yml.j2"
dest: "{{ matrix_bot_matrix_registration_bot_config_path }}/config.yml"
owner: "{{ matrix_user_username }}"
group: "{{ matrix_user_groupname }}"
mode: 0640
- name: Ensure matrix-registration-bot image is pulled
community.docker.docker_image:
name: "{{ matrix_bot_matrix_registration_bot_docker_image }}"
source: "{{ 'pull' if ansible_version.major > 2 or ansible_version.minor > 7 else omit }}"
force_source: "{{ matrix_bot_matrix_registration_bot_docker_image_force_pull if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}"
force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else matrix_bot_matrix_registration_bot_docker_image_force_pull }}"
when: "not matrix_bot_matrix_registration_bot_container_image_self_build | bool"
register: result
retries: "{{ matrix_container_retries_count }}"
delay: "{{ matrix_container_retries_delay }}"
until: result is not failed
- name: Ensure matrix-registration-bot repository is present on self-build
ansible.builtin.git:
repo: "{{ matrix_bot_matrix_registration_bot_docker_repo }}"
version: "{{ matrix_bot_matrix_registration_bot_docker_repo_version }}"
dest: "{{ matrix_bot_matrix_registration_bot_docker_src_files_path }}"
force: "yes"
become: true
become_user: "{{ matrix_user_username }}"
register: matrix_bot_matrix_registration_bot_git_pull_results
when: "matrix_bot_matrix_registration_bot_container_image_self_build | bool"
- name: Ensure matrix-registration-bot image is built
community.docker.docker_image:
name: "{{ matrix_bot_matrix_registration_bot_docker_image }}"
source: build
force_source: "{{ matrix_bot_matrix_registration_bot_git_pull_results.changed if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}"
force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else matrix_mailer_git_pull_results.changed }}"
build:
dockerfile: Dockerfile
path: "{{ matrix_bot_matrix_registration_bot_docker_src_files_path }}"
pull: true
when: "matrix_bot_matrix_registration_bot_container_image_self_build | bool"
- name: Ensure matrix-bot-matrix-registration-bot.service installed
ansible.builtin.template:
src: "{{ role_path }}/templates/systemd/matrix-bot-matrix-registration-bot.service.j2"
dest: "{{ matrix_systemd_path }}/matrix-bot-matrix-registration-bot.service"
mode: 0644
register: matrix_bot_matrix_registration_bot_systemd_service_result
- name: Ensure systemd reloaded after matrix-bot-matrix-registration-bot.service installation
ansible.builtin.service:
daemon_reload: true
when: "matrix_bot_matrix_registration_bot_systemd_service_result.changed | bool"
- name: Ensure matrix-bot-matrix-registration-bot.service restarted, if necessary
ansible.builtin.service:
name: "matrix-bot-matrix-registration-bot.service"
state: restarted

36
roles/custom/matrix-bot-matrix-registration-bot/tasks/setup_uninstall.yml Normal file
View File

@ -0,0 +1,36 @@
---
- name: Check existence of matrix-matrix-registration-bot service
ansible.builtin.stat:
path: "{{ matrix_systemd_path }}/matrix-bot-matrix-registration-bot.service"
register: matrix_bot_matrix_registration_bot_service_stat
- name: Ensure matrix-matrix-registration-bot is stopped
ansible.builtin.service:
name: matrix-bot-matrix-registration-bot
state: stopped
enabled: false
daemon_reload: true
register: stopping_result
when: "matrix_bot_matrix_registration_bot_service_stat.stat.exists | bool"
- name: Ensure matrix-bot-matrix-registration-bot.service doesn't exist
ansible.builtin.file:
path: "{{ matrix_systemd_path }}/matrix-bot-matrix-registration-bot.service"
state: absent
when: "matrix_bot_matrix_registration_bot_service_stat.stat.exists | bool"
- name: Ensure systemd reloaded after matrix-bot-matrix-registration-bot.service removal
ansible.builtin.service:
daemon_reload: true
when: "matrix_bot_matrix_registration_bot_service_stat.stat.exists | bool"
- name: Ensure Matrix matrix-registration-bot paths don't exist
ansible.builtin.file:
path: "{{ matrix_bot_matrix_registration_bot_base_path }}"
state: absent
- name: Ensure matrix-registration-bot Docker image doesn't exist
community.docker.docker_image:
name: "{{ matrix_bot_matrix_registration_bot_docker_image }}"
state: absent

10
roles/custom/matrix-bot-matrix-registration-bot/tasks/validate_config.yml Normal file
View File

@ -0,0 +1,10 @@
---
- name: Fail if required settings not defined
ansible.builtin.fail:
msg: >-
You need to define a required configuration setting (`{{ item }}`).
when: "vars[item] == ''"
with_items:
- "matrix_bot_matrix_registration_bot_bot_access_token"
- "matrix_bot_matrix_registration_bot_api_token"

12
roles/custom/matrix-bot-matrix-registration-bot/templates/config/config.yml.j2 Normal file
View File

@ -0,0 +1,12 @@
bot:
server: {{ matrix_bot_matrix_registration_bot_bot_server|to_json }}
username: {{ matrix_bot_matrix_registration_bot_matrix_user_id_localpart|to_json }}
access_token: {{ matrix_bot_matrix_registration_bot_bot_access_token|to_json }}
api:
# API endpoint of the registration tokens
base_url: {{ matrix_bot_matrix_registration_bot_api_base_url|to_json }}
# Access token of an administrator on the server
token: {{ matrix_bot_matrix_registration_bot_api_token|to_json }}
logging:
level: {{ matrix_bot_matrix_registration_bot_logging_level|to_json }}

37
roles/custom/matrix-bot-matrix-registration-bot/templates/systemd/matrix-bot-matrix-registration-bot.service.j2 Normal file
View File

@ -0,0 +1,37 @@
#jinja2: lstrip_blocks: "True"
[Unit]
Description=Matrix registration bot
{% for service in matrix_bot_matrix_registration_bot_systemd_required_services_list %}
Requires={{ service }}
After={{ service }}
{% endfor %}
{% for service in matrix_bot_matrix_registration_bot_systemd_wanted_services_list %}
Wants={{ service }}
{% endfor %}
DefaultDependencies=no
[Service]
Type=simple
Environment="HOME={{ matrix_systemd_unit_home_path }}"
ExecStartPre=-{{ matrix_host_command_sh }} -c '{{ matrix_host_command_docker }} kill matrix-bot-matrix-registration-bot 2>/dev/null || true'
ExecStartPre=-{{ matrix_host_command_sh }} -c '{{ matrix_host_command_docker }} rm matrix-bot-matrix-registration-bot 2>/dev/null || true'
ExecStart={{ matrix_host_command_docker }} run --rm --name matrix-bot-matrix-registration-bot \
--log-driver=none \
--cap-drop=ALL \
-e "CONFIG_PATH=/config/config.yml" \
--user={{ matrix_user_uid }}:{{ matrix_user_gid }} \
--read-only \
--mount type=bind,src={{ matrix_bot_matrix_registration_bot_config_path }},dst=/config,ro \
--mount type=bind,src={{ matrix_bot_matrix_registration_bot_data_path }},dst=/data \
--network={{ matrix_docker_network }} \
{{ matrix_bot_matrix_registration_bot_docker_image }}
ExecStop=-{{ matrix_host_command_sh }} -c '{{ matrix_host_command_docker }} kill matrix-bot-matrix-registration-bot 2>/dev/null || true'
ExecStop=-{{ matrix_host_command_sh }} -c '{{ matrix_host_command_docker }} rm matrix-bot-matrix-registration-bot 2>/dev/null || true'
Restart=always
RestartSec=30
SyslogIdentifier=matrix-bot-matrix-registration-bot
[Install]
WantedBy=multi-user.target

101
roles/custom/matrix-bot-matrix-reminder-bot/defaults/main.yml Normal file
View File

@ -0,0 +1,101 @@
---
# matrix-reminder-bot is a bot for one-off and recurring reminders
# Project source code URL: https://github.com/anoadragon453/matrix-reminder-bot
matrix_bot_matrix_reminder_bot_enabled: true
matrix_bot_matrix_reminder_bot_container_image_self_build: false
matrix_bot_matrix_reminder_bot_docker_repo: "https://github.com/anoadragon453/matrix-reminder-bot.git"
matrix_bot_matrix_reminder_bot_docker_repo_version: "{{ matrix_bot_matrix_reminder_bot_version }}"
matrix_bot_matrix_reminder_bot_docker_src_files_path: "{{ matrix_base_data_path }}/matrix-reminder-bot/docker-src"
matrix_bot_matrix_reminder_bot_version: release-v0.2.1
matrix_bot_matrix_reminder_bot_docker_image: "{{ matrix_container_global_registry_prefix }}anoa/matrix-reminder-bot:{{ matrix_bot_matrix_reminder_bot_version }}"
matrix_bot_matrix_reminder_bot_docker_image_force_pull: "{{ matrix_bot_matrix_reminder_bot_docker_image.endswith(':latest') }}"
matrix_bot_matrix_reminder_bot_base_path: "{{ matrix_base_data_path }}/matrix-reminder-bot"
matrix_bot_matrix_reminder_bot_config_path: "{{ matrix_bot_matrix_reminder_bot_base_path }}/config"
matrix_bot_matrix_reminder_bot_data_path: "{{ matrix_bot_matrix_reminder_bot_base_path }}/data"
matrix_bot_matrix_reminder_bot_data_store_path: "{{ matrix_bot_matrix_reminder_bot_data_path }}/store"
matrix_bot_matrix_reminder_bot_command_prefix: "!"
# A list of extra arguments to pass to the container
matrix_bot_matrix_reminder_bot_container_extra_arguments: []
# List of systemd services that matrix-bot-matrix-reminder-bot.service depends on
matrix_bot_matrix_reminder_bot_systemd_required_services_list: ['docker.service']
# List of systemd services that matrix-bot-matrix-reminder-bot.service wants
matrix_bot_matrix_reminder_bot_systemd_wanted_services_list: []
# Database-related configuration fields.
#
# To use SQLite, stick to these defaults.
#
# To use Postgres:
# - change the engine (`matrix_bot_matrix_reminder_bot_database_engine: 'postgres'`)
# - adjust your database credentials via the `matrix_bot_matrix_reminder_bot_database_*` variables
matrix_bot_matrix_reminder_bot_database_engine: 'sqlite'
matrix_bot_matrix_reminder_bot_sqlite_database_path_local: "{{ matrix_bot_matrix_reminder_bot_data_path }}/bot.db"
matrix_bot_matrix_reminder_bot_sqlite_database_path_in_container: "/data/bot.db"
matrix_bot_matrix_reminder_bot_database_username: 'matrix_reminder_bot'
matrix_bot_matrix_reminder_bot_database_password: 'some-password'
matrix_bot_matrix_reminder_bot_database_hostname: 'matrix-postgres'
matrix_bot_matrix_reminder_bot_database_port: 5432
matrix_bot_matrix_reminder_bot_database_name: 'matrix_reminder_bot'
matrix_bot_matrix_reminder_bot_database_connection_string: 'postgres://{{ matrix_bot_matrix_reminder_bot_database_username }}:{{ matrix_bot_matrix_reminder_bot_database_password }}@{{ matrix_bot_matrix_reminder_bot_database_hostname }}:{{ matrix_bot_matrix_reminder_bot_database_port }}/{{ matrix_bot_matrix_reminder_bot_database_name }}'
matrix_bot_matrix_reminder_bot_storage_database: "{{
{
'sqlite': ('sqlite://' + matrix_bot_matrix_reminder_bot_sqlite_database_path_in_container),
'postgres': matrix_bot_matrix_reminder_bot_database_connection_string,
}[matrix_bot_matrix_reminder_bot_database_engine]
}}"
# The bot's username. This user needs to be created manually beforehand.
# Also see `matrix_bot_matrix_reminder_bot_user_password`.
matrix_bot_matrix_reminder_bot_matrix_user_id_localpart: "bot.matrix-reminder-bot"
matrix_bot_matrix_reminder_bot_matrix_user_id: '@{{ matrix_bot_matrix_reminder_bot_matrix_user_id_localpart }}:{{ matrix_domain }}'
# The password that the bot uses to authenticate.
matrix_bot_matrix_reminder_bot_matrix_user_password: ''
matrix_bot_matrix_reminder_bot_matrix_homeserver_url: "{{ matrix_homeserver_container_url }}"
# The timezone to use when creating reminders.
# Examples: 'Europe/London', 'Etc/UTC'
matrix_bot_matrix_reminder_bot_reminders_timezone: ''
# Default configuration template which covers the generic use case.
# You can customize it by controlling the various variables inside it.
#
# For a more advanced customization, you can extend the default (see `matrix_bot_matrix_reminder_bot_configuration_extension_yaml`)
# or completely replace this variable with your own template.
matrix_bot_matrix_reminder_bot_configuration_yaml: "{{ lookup('template', 'templates/config.yaml.j2') }}"
matrix_bot_matrix_reminder_bot_configuration_extension_yaml: |
# Your custom YAML configuration goes here.
# This configuration extends the default starting configuration (`matrix_bot_matrix_reminder_bot_configuration_yaml`).
#
# You can override individual variables from the default configuration, or introduce new ones.
#
# If you need something more special, you can take full control by
# completely redefining `matrix_bot_matrix_reminder_bot_configuration_yaml`.
#
# Example configuration extension follows:
#
# matrix:
# device_name: My-Reminder-Bot
matrix_bot_matrix_reminder_bot_configuration_extension: "{{ matrix_bot_matrix_reminder_bot_configuration_extension_yaml | from_yaml if matrix_bot_matrix_reminder_bot_configuration_extension_yaml | from_yaml is mapping else {} }}"
# Holds the final configuration (a combination of the default and its extension).
# You most likely don't need to touch this variable. Instead, see `matrix_bot_matrix_reminder_bot_configuration_yaml`.
matrix_bot_matrix_reminder_bot_configuration: "{{ matrix_bot_matrix_reminder_bot_configuration_yaml | from_yaml | combine(matrix_bot_matrix_reminder_bot_configuration_extension, recursive=True) }}"

5
roles/custom/matrix-bot-matrix-reminder-bot/tasks/init.yml Normal file
View File

@ -0,0 +1,5 @@
---
- ansible.builtin.set_fact:
matrix_systemd_services_list: "{{ matrix_systemd_services_list + ['matrix-bot-matrix-reminder-bot.service'] }}"
when: matrix_bot_matrix_reminder_bot_enabled | bool

23
roles/custom/matrix-bot-matrix-reminder-bot/tasks/main.yml Normal file
View File

@ -0,0 +1,23 @@
---
- ansible.builtin.import_tasks: "{{ role_path }}/tasks/init.yml"
tags:
- always
- ansible.builtin.import_tasks: "{{ role_path }}/tasks/validate_config.yml"
when: "run_setup | bool and matrix_bot_matrix_reminder_bot_enabled | bool"
tags:
- setup-all
- setup-bot-matrix-reminder-bot
- ansible.builtin.import_tasks: "{{ role_path }}/tasks/setup_install.yml"
when: "run_setup | bool and matrix_bot_matrix_reminder_bot_enabled | bool"
tags:
- setup-all
- setup-bot-matrix-reminder-bot
- ansible.builtin.import_tasks: "{{ role_path }}/tasks/setup_uninstall.yml"
when: "run_setup | bool and not matrix_bot_matrix_reminder_bot_enabled | bool"
tags:
- setup-all
- setup-bot-matrix-reminder-bot

104
roles/custom/matrix-bot-matrix-reminder-bot/tasks/setup_install.yml Normal file
View File

@ -0,0 +1,104 @@
---
- ansible.builtin.set_fact:
matrix_bot_matrix_reminder_bot_requires_restart: false
- when: "matrix_bot_matrix_reminder_bot_database_engine == 'postgres'"
block:
- name: Check if an SQLite database already exists
ansible.builtin.stat:
path: "{{ matrix_bot_matrix_reminder_bot_sqlite_database_path_local }}"
register: matrix_bot_matrix_reminder_bot_sqlite_database_path_local_stat_result
- when: "matrix_bot_matrix_reminder_bot_sqlite_database_path_local_stat_result.stat.exists | bool"
block:
- ansible.builtin.set_fact:
matrix_postgres_db_migration_request:
src: "{{ matrix_bot_matrix_reminder_bot_sqlite_database_path_local }}"
dst: "{{ matrix_bot_matrix_reminder_bot_database_connection_string }}"
caller: "{{ role_path | basename }}"
engine_variable_name: 'matrix_bot_matrix_reminder_bot_database_engine'
engine_old: 'sqlite'
systemd_services_to_stop: ['matrix-bot-matrix-reminder-bot.service']
- ansible.builtin.import_role:
name: custom/matrix-postgres
tasks_from: migrate_db_to_postgres
- ansible.builtin.set_fact:
matrix_bot_matrix_reminder_bot_requires_restart: true
- name: Ensure matrix-reminder-bot paths exist
ansible.builtin.file:
path: "{{ item.path }}"
state: directory
mode: 0750
owner: "{{ matrix_user_username }}"
group: "{{ matrix_user_groupname }}"
with_items:
- {path: "{{ matrix_bot_matrix_reminder_bot_config_path }}", when: true}
- {path: "{{ matrix_bot_matrix_reminder_bot_data_path }}", when: true}
- {path: "{{ matrix_bot_matrix_reminder_bot_data_store_path }}", when: true}
- {path: "{{ matrix_bot_matrix_reminder_bot_docker_src_files_path }}", when: true}
when: "item.when | bool"
- name: Ensure matrix-reminder-bot image is pulled
community.docker.docker_image:
name: "{{ matrix_bot_matrix_reminder_bot_docker_image }}"
source: "{{ 'pull' if ansible_version.major > 2 or ansible_version.minor > 7 else omit }}"
force_source: "{{ matrix_bot_matrix_reminder_bot_docker_image_force_pull if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}"
force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else matrix_bot_matrix_reminder_bot_docker_image_force_pull }}"
when: "not matrix_bot_matrix_reminder_bot_container_image_self_build | bool"
register: result
retries: "{{ matrix_container_retries_count }}"
delay: "{{ matrix_container_retries_delay }}"
until: result is not failed
- name: Ensure matrix-reminder-bot repository is present on self-build
ansible.builtin.git:
repo: "{{ matrix_bot_matrix_reminder_bot_docker_repo }}"
version: "{{ matrix_bot_matrix_reminder_bot_docker_repo_version }}"
dest: "{{ matrix_bot_matrix_reminder_bot_docker_src_files_path }}"
force: "yes"
become: true
become_user: "{{ matrix_user_username }}"
register: matrix_bot_matrix_reminder_bot_git_pull_results
when: "matrix_bot_matrix_reminder_bot_container_image_self_build | bool"
- name: Ensure matrix-reminder-bot image is built
community.docker.docker_image:
name: "{{ matrix_bot_matrix_reminder_bot_docker_image }}"
source: build
force_source: "{{ matrix_bot_matrix_reminder_bot_git_pull_results.changed if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}"
force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else matrix_mailer_git_pull_results.changed }}"
build:
dockerfile: docker/Dockerfile
path: "{{ matrix_bot_matrix_reminder_bot_docker_src_files_path }}"
pull: true
when: "matrix_bot_matrix_reminder_bot_container_image_self_build | bool"
- name: Ensure matrix-reminder-bot config installed
ansible.builtin.copy:
content: "{{ matrix_bot_matrix_reminder_bot_configuration | to_nice_yaml(indent=2, width=999999) }}"
dest: "{{ matrix_bot_matrix_reminder_bot_config_path }}/config.yaml"
mode: 0644
owner: "{{ matrix_user_username }}"
group: "{{ matrix_user_groupname }}"
- name: Ensure matrix-bot-matrix-reminder-bot.service installed
ansible.builtin.template:
src: "{{ role_path }}/templates/systemd/matrix-bot-matrix-reminder-bot.service.j2"
dest: "{{ matrix_systemd_path }}/matrix-bot-matrix-reminder-bot.service"
mode: 0644
register: matrix_bot_matrix_reminder_bot_systemd_service_result
- name: Ensure systemd reloaded after matrix-bot-matrix-reminder-bot.service installation
ansible.builtin.service:
daemon_reload: true
when: "matrix_bot_matrix_reminder_bot_systemd_service_result.changed | bool"
- name: Ensure matrix-bot-matrix-reminder-bot.service restarted, if necessary
ansible.builtin.service:
name: "matrix-bot-matrix-reminder-bot.service"
state: restarted
when: "matrix_bot_matrix_reminder_bot_requires_restart | bool"

36
roles/custom/matrix-bot-matrix-reminder-bot/tasks/setup_uninstall.yml Normal file
View File

@ -0,0 +1,36 @@
---
- name: Check existence of matrix-matrix-reminder-bot service
ansible.builtin.stat:
path: "{{ matrix_systemd_path }}/matrix-bot-matrix-reminder-bot.service"
register: matrix_bot_matrix_reminder_bot_service_stat
- name: Ensure matrix-matrix-reminder-bot is stopped
ansible.builtin.service:
name: matrix-bot-matrix-reminder-bot
state: stopped
enabled: false
daemon_reload: true
register: stopping_result
when: "matrix_bot_matrix_reminder_bot_service_stat.stat.exists | bool"
- name: Ensure matrix-bot-matrix-reminder-bot.service doesn't exist
ansible.builtin.file:
path: "{{ matrix_systemd_path }}/matrix-bot-matrix-reminder-bot.service"
state: absent
when: "matrix_bot_matrix_reminder_bot_service_stat.stat.exists | bool"
- name: Ensure systemd reloaded after matrix-bot-matrix-reminder-bot.service removal
ansible.builtin.service:
daemon_reload: true
when: "matrix_bot_matrix_reminder_bot_service_stat.stat.exists | bool"
- name: Ensure Matrix matrix-reminder-bot paths don't exist
ansible.builtin.file:
path: "{{ matrix_bot_matrix_reminder_bot_base_path }}"
state: absent
- name: Ensure matrix-reminder-bot Docker image doesn't exist
community.docker.docker_image:
name: "{{ matrix_bot_matrix_reminder_bot_docker_image }}"
state: absent

19
roles/custom/matrix-bot-matrix-reminder-bot/tasks/validate_config.yml Normal file
View File

@ -0,0 +1,19 @@
---
- name: Fail if required settings not defined
ansible.builtin.fail:
msg: >-
You need to define a required configuration setting (`{{ item }}`).
when: "vars[item] == ''"
with_items:
- "matrix_bot_matrix_reminder_bot_matrix_user_password"
- "matrix_bot_matrix_reminder_bot_reminders_timezone"
- name: (Deprecation) Catch and report renamed settings
ansible.builtin.fail:
msg: >-
Your configuration contains a variable, which now has a different name.
Please change your configuration to rename the variable (`{{ item.old }}` -> `{{ item.new }}`).
when: "item.old in vars"
with_items:
- {'old': 'matrix_bot_matrix_reminder_bot_container_self_build', 'new': 'matrix_bot_matrix_reminder_bot_container_image_self_build'}

50
roles/custom/matrix-bot-matrix-reminder-bot/templates/config.yaml.j2 Normal file
View File

@ -0,0 +1,50 @@
# The string to prefix bot commands with
command_prefix: "{{ matrix_bot_matrix_reminder_bot_command_prefix }}"
# Options for connecting to the bot's Matrix account
matrix:
# The Matrix User ID of the bot account
user_id: {{ matrix_bot_matrix_reminder_bot_matrix_user_id|to_json }}
# Matrix account password
user_password: {{ matrix_bot_matrix_reminder_bot_matrix_user_password|to_json }}
# The public URL at which the homeserver's Client-Server API can be accessed
homeserver_url: {{ matrix_bot_matrix_reminder_bot_matrix_homeserver_url }}
# The device ID that is a **non pre-existing** device
# If this device ID already exists, messages will be dropped silently in
# encrypted rooms
device_id: REMINDER
# What to name the logged in device
device_name: Reminder Bot
storage:
# The database connection string
# For SQLite3, this would look like:
# database: "sqlite://bot.db"
# For Postgres, this would look like:
# database: "postgres://username:password@localhost/dbname?sslmode=disable"
#database: "postgres://matrix-reminder-bot:remindme@localhost/matrix-reminder-bot?sslmode=disable"
database: {{ matrix_bot_matrix_reminder_bot_storage_database|to_json }}
# The path to a directory for internal bot storage
# containing encryption keys, sync tokens, etc.
store_path: "/data/store"
reminders:
# Uncomment to set a default timezone that will be used when creating reminders.
# If not set, UTC will be used
timezone: {{ matrix_bot_matrix_reminder_bot_reminders_timezone }}
# Logging setup
logging:
# Logging level
# Allowed levels are 'INFO', 'WARNING', 'ERROR', 'DEBUG' where DEBUG is most verbose
level: INFO
# Configure logging to a file
file_logging:
# Whether logging to a file is enabled
enabled: false
# The path to the file to log to. May be relative or absolute
filepath: /data/bot.log
# Configure logging to the console (stdout/stderr)
console_logging:
# Whether console logging is enabled
enabled: true

42
roles/custom/matrix-bot-matrix-reminder-bot/templates/systemd/matrix-bot-matrix-reminder-bot.service.j2 Normal file
View File

@ -0,0 +1,42 @@
#jinja2: lstrip_blocks: "True"
[Unit]
Description=Matrix reminder bot
{% for service in matrix_bot_matrix_reminder_bot_systemd_required_services_list %}
Requires={{ service }}
After={{ service }}
{% endfor %}
{% for service in matrix_bot_matrix_reminder_bot_systemd_wanted_services_list %}
Wants={{ service }}
{% endfor %}
DefaultDependencies=no
[Service]
Type=simple
Environment="HOME={{ matrix_systemd_unit_home_path }}"
ExecStartPre=-{{ matrix_host_command_sh }} -c '{{ matrix_host_command_docker }} kill matrix-bot-matrix-reminder-bot 2>/dev/null || true'
ExecStartPre=-{{ matrix_host_command_sh }} -c '{{ matrix_host_command_docker }} rm matrix-bot-matrix-reminder-bot 2>/dev/null || true'
ExecStart={{ matrix_host_command_docker }} run --rm --name matrix-bot-matrix-reminder-bot \
--log-driver=none \
--user={{ matrix_user_uid }}:{{ matrix_user_gid }} \
--cap-drop=ALL \
--read-only \
--network={{ matrix_docker_network }} \
-e 'TZ={{ matrix_bot_matrix_reminder_bot_reminders_timezone }}' \
--mount type=bind,src={{ matrix_bot_matrix_reminder_bot_config_path }},dst=/config,ro \
--mount type=bind,src={{ matrix_bot_matrix_reminder_bot_data_path }},dst=/data \
--entrypoint=/bin/sh \
{% for arg in matrix_bot_matrix_reminder_bot_container_extra_arguments %}
{{ arg }} \
{% endfor %}
{{ matrix_bot_matrix_reminder_bot_docker_image }} \
-c "matrix-reminder-bot /config/config.yaml"
ExecStop=-{{ matrix_host_command_sh }} -c '{{ matrix_host_command_docker }} kill matrix-bot-matrix-reminder-bot 2>/dev/null || true'
ExecStop=-{{ matrix_host_command_sh }} -c '{{ matrix_host_command_docker }} rm matrix-bot-matrix-reminder-bot 2>/dev/null || true'
Restart=always
RestartSec=30
SyslogIdentifier=matrix-bot-matrix-reminder-bot
[Install]
WantedBy=multi-user.target

69
roles/custom/matrix-bot-maubot/defaults/main.yml Normal file
View File

@ -0,0 +1,69 @@
---
# maubot is a plugin-based Matrix bot system.
# Project source code URL: https://mau.dev/maubot/maubot
matrix_bot_maubot_enabled: true
matrix_bot_maubot_container_image_self_build: false
matrix_bot_maubot_docker_repo: "https://mau.dev/maubot/maubot.git"
matrix_bot_maubot_docker_src_files_path: "{{ matrix_bot_maubot_base_path }}/docker-src"
matrix_bot_maubot_docker_repo_version: "{{ 'master' if matrix_bot_maubot_version == 'latest' else matrix_bot_maubot_version }}"
matrix_bot_maubot_version: v0.3.1
matrix_bot_maubot_docker_image: "dock.mau.dev/maubot/maubot:{{ matrix_bot_maubot_version }}"
matrix_bot_maubot_docker_image_force_pull: "{{ matrix_bot_maubot_docker_image.endswith(':latest') }}"
matrix_bot_maubot_base_path: "{{ matrix_base_data_path }}/maubot"
matrix_bot_maubot_data_path: "{{ matrix_bot_maubot_base_path }}/data"
matrix_bot_maubot_config_path: "{{ matrix_bot_maubot_base_path }}/config"
matrix_bot_maubot_bot_server_public_url: "https://{{ matrix_server_fqn_matrix }}"
matrix_bot_maubot_proxy_management_interface: true
matrix_bot_maubot_database_engine: sqlite
matrix_bot_maubot_sqlite_database_path_local: "{{ matrix_bot_maubot_data_path }}/maubot.db"
matrix_bot_maubot_sqlite_database_path_in_container: "/data/maubot.db"
matrix_bot_maubot_database_username: matrix_bot_maubot
matrix_bot_maubot_database_password: ~
matrix_bot_maubot_database_hostname: 'matrix-postgres'
matrix_bot_maubot_database_port: 5432
matrix_bot_maubot_database_name: matrix_bot_maubot
matrix_bot_maubot_database_connection_string: postgres://{{ matrix_bot_maubot_database_username }}:{{ matrix_bot_maubot_database_password }}@{{ matrix_bot_maubot_database_hostname }}:{{ matrix_bot_maubot_database_port }}/{{ matrix_bot_maubot_database_name }}?sslmode=disable
matrix_bot_maubot_database_uri: "{{
{
'sqlite': ('sqlite:///' + matrix_bot_maubot_sqlite_database_path_in_container),
'postgres': matrix_bot_maubot_database_connection_string,
}[matrix_bot_maubot_database_engine]
}}"
# Defines the port number where the management interface is
# To actually expose the management interface outside of the container, use `matrix_bot_maubot_management_interface_http_bind_port`
matrix_bot_maubot_management_interface_port: 29316
# Controls whether the maubot container exposes its HTTP management interface port (tcp/29316 in the container).
#
# Takes an "<ip>:<port>" or "<port>" value (e.g. "127.0.0.1:29316"), or empty string to not expose.
# If you'll be setting this at all, it should be defined in terms of `matrix_bot_maubot_management_interface_port`.
# Example:
# matrix_bot_maubot_management_interface_http_bind_port: "127.0.0.1:{{ matrix_bot_maubot_management_interface_port }}"
matrix_bot_maubot_management_interface_http_bind_port: ''
matrix_bot_maubot_unshared_secret: 'generate'
# Specifies the default log level for all bot loggers.
matrix_bot_maubot_logging_level: WARNING
# A list of extra arguments to pass to the container
matrix_bot_maubot_container_extra_arguments: []
# List of systemd services that matrix-bot-maubot.service depends on
matrix_bot_maubot_systemd_required_services_list: ['docker.service']
# List of systemd services that matrix-bot-maubot.service wants
matrix_bot_maubot_systemd_wanted_services_list: []

47
roles/custom/matrix-bot-maubot/tasks/init.yml Normal file
View File

@ -0,0 +1,47 @@
---
- name: Add maubot to the systemd service list
ansible.builtin.set_fact:
matrix_systemd_services_list: "{{ matrix_systemd_services_list + ['matrix-bot-maubot.service'] }}"
when: matrix_bot_maubot_enabled | bool
- name: Configure nginx for maubot
block:
- name: Generate Maubot proxying configuration for matrix-nginx-proxy
ansible.builtin.set_fact:
matrix_bot_maubot_matrix_nginx_proxy_configuration: |
location ~ ^/(_matrix/maubot/.*) {
{% if matrix_nginx_proxy_enabled | default(False) %}
{# Use the embedded DNS resolver in Docker containers to discover the service #}
resolver 127.0.0.11 valid=5s;
set $backend "matrix-bot-maubot:{{ matrix_bot_maubot_management_interface_port }}";
proxy_pass http://$backend$request_uri;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
{% else %}
{# Generic configuration for use outside of our container setup #}
proxy_pass http://127.0.0.1:{{ matrix_bot_maubot_management_interface_port }}$request_uri;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
{% endif %}
}
when: matrix_bot_maubot_proxy_management_interface | bool
- name: Register Maubot's proxying configuration with matrix-nginx-proxy
ansible.builtin.set_fact:
matrix_nginx_proxy_proxy_matrix_additional_server_configuration_blocks: |
{{
matrix_nginx_proxy_proxy_matrix_additional_server_configuration_blocks | default([])
+
[matrix_bot_maubot_matrix_nginx_proxy_configuration]
}}
when: matrix_bot_maubot_proxy_management_interface | bool
- name: Warn about reverse-proxying if matrix-nginx-proxy not used
ansible.builtin.debug:
msg: >-
NOTE: You've enabled Maubot but are not using the matrix-nginx-proxy
reverse proxy.
Please make sure that you're proxying the `/_matrix/maubot`
URL endpoint to the matrix-maubot container.
when: "matrix_bot_maubot_enabled | bool and matrix_bot_maubot_proxy_management_interface | bool and matrix_nginx_proxy_enabled is not defined"

23
roles/custom/matrix-bot-maubot/tasks/main.yml Normal file
View File

@ -0,0 +1,23 @@
---
- ansible.builtin.import_tasks: "{{ role_path }}/tasks/init.yml"
tags:
- always
- ansible.builtin.import_tasks: "{{ role_path }}/tasks/validate_config.yml"
when: "run_setup|bool and matrix_bot_maubot_enabled|bool"
tags:
- setup-all
- setup-bot-maubot
- ansible.builtin.import_tasks: "{{ role_path }}/tasks/setup_install.yml"
when: "run_setup|bool and matrix_bot_maubot_enabled|bool"
tags:
- setup-all
- setup-bot-maubot
- ansible.builtin.import_tasks: "{{ role_path }}/tasks/setup_uninstall.yml"
when: "run_setup|bool and not matrix_bot_maubot_enabled|bool"
tags:
- setup-all
- setup-bot-maubot

73
roles/custom/matrix-bot-maubot/tasks/setup_install.yml Normal file
View File

@ -0,0 +1,73 @@
---
- name: Ensure maubot paths exist
ansible.builtin.file:
path: "{{ item.path }}"
state: directory
mode: 0755
owner: "{{ matrix_user_username }}"
group: "{{ matrix_user_groupname }}"
with_items:
- {path: "{{ matrix_bot_maubot_base_path }}", when: true}
- {path: "{{ matrix_bot_maubot_config_path }}", when: true}
- {path: "{{ matrix_bot_maubot_data_path }}", when: true}
- {path: "{{ matrix_bot_maubot_data_path }}/plugins", when: true}
- {path: "{{ matrix_bot_maubot_data_path }}/dbs", when: true}
- {path: "{{ matrix_bot_maubot_data_path }}/trash", when: true}
- {path: "{{ matrix_bot_maubot_docker_src_files_path }}", when: "{{ matrix_bot_maubot_container_image_self_build }}"}
when: "item.when|bool"
- name: Ensure maubot configuration file created
ansible.builtin.template:
src: "{{ role_path }}/templates/config/config.yaml.j2"
dest: "{{ matrix_bot_maubot_config_path }}/config.yaml"
owner: "{{ matrix_user_username }}"
group: "{{ matrix_user_groupname }}"
mode: "u=rwx"
- name: Ensure maubot image is pulled
community.docker.docker_image:
name: "{{ matrix_bot_maubot_docker_image }}"
source: "{{ 'pull' if ansible_version.major > 2 or ansible_version.minor > 7 else omit }}"
force_source: "{{ matrix_bot_maubot_docker_image_force_pull if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}"
force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else matrix_bot_maubot_docker_image_force_pull }}"
when: "not matrix_bot_maubot_container_image_self_build|bool"
register: result
retries: "{{ matrix_container_retries_count }}"
delay: "{{ matrix_container_retries_delay }}"
until: result is not failed
- name: Ensure maubot repository is present on self-build
ansible.builtin.git:
repo: "{{ matrix_bot_maubot_docker_repo }}"
version: "{{ matrix_bot_maubot_docker_repo_version }}"
dest: "{{ matrix_bot_maubot_docker_src_files_path }}"
force: "yes"
become: true
become_user: "{{ matrix_user_username }}"
register: matrix_bot_maubot_git_pull_results
when: "matrix_bot_maubot_container_image_self_build|bool"
- name: Ensure maubot image is built
community.docker.docker_image:
name: "{{ matrix_bot_maubot_docker_image }}"
source: build
force_source: "{{ matrix_bot_maubot_git_pull_results.changed if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}"
force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else matrix_mailer_git_pull_results.changed }}"
build:
dockerfile: Dockerfile
path: "{{ matrix_bot_maubot_docker_src_files_path }}"
pull: true
when: "matrix_bot_maubot_container_image_self_build|bool"
- name: Ensure matrix-bot-maubot.service installed
ansible.builtin.template:
src: "{{ role_path }}/templates/systemd/matrix-bot-maubot.service.j2"
dest: "{{ matrix_systemd_path }}/matrix-bot-maubot.service"
mode: 0644
register: matrix_bot_maubot_systemd_service_result
- name: Ensure systemd reloaded after matrix-bot-maubot.service installation
ansible.builtin.service:
daemon_reload: true
when: "matrix_bot_maubot_systemd_service_result.changed|bool"

36
roles/custom/matrix-bot-maubot/tasks/setup_uninstall.yml Normal file
View File

@ -0,0 +1,36 @@
---
- name: Check existence of matrix-maubot service
ansible.builtin.stat:
path: "{{ matrix_systemd_path }}/matrix-bot-maubot.service"
register: matrix_bot_maubot_service_stat
- name: Ensure matrix-bot-maubot is stopped
ansible.builtin.service:
name: matrix-bot-maubot
state: stopped
enabled: false
daemon_reload: true
register: stopping_result
when: "matrix_bot_maubot_service_stat.stat.exists | bool"
- name: Ensure matrix-bot-maubot.service doesn't exist
ansible.builtin.file:
path: "{{ matrix_systemd_path }}/matrix-bot-maubot.service"
state: absent
when: "matrix_bot_maubot_service_stat.stat.exists | bool"
- name: Ensure systemd reloaded after matrix-bot-maubot.service removal
ansible.builtin.service:
daemon_reload: true
when: "matrix_bot_maubot_service_stat.stat.exists | bool"
- name: Ensure Matrix maubot paths don't exist
ansible.builtin.file:
path: "{{ matrix_bot_maubot_base_path }}"
state: absent
- name: Ensure maubot Docker image doesn't exist
community.docker.docker_image:
name: "{{ matrix_bot_maubot_docker_image }}"
state: absent

10
roles/custom/matrix-bot-maubot/tasks/validate_config.yml Normal file
View File

@ -0,0 +1,10 @@
---
- name: Fail if required settings not defined
ansible.builtin.fail:
msg: >-
You need to define a required configuration setting (`{{ item }}`).
when: "vars[item] == ''"
with_items:
- matrix_bot_maubot_unshared_secret
- matrix_bot_maubot_admins

110
roles/custom/matrix-bot-maubot/templates/config/config.yaml.j2 Normal file
View File

@ -0,0 +1,110 @@
# The full URI to the database. SQLite and Postgres are fully supported.
# Other DBMSes supported by SQLAlchemy may or may not work.
# Format examples:
# SQLite: sqlite:///filename.db
# Postgres: postgresql://username:password@hostname/dbname
database: {{ matrix_bot_maubot_database_uri|to_json }}
# Separate database URL for the crypto database. "default" means use the same database as above.
crypto_database:
type: default
# Additional arguments for asyncpg.create_pool() or sqlite3.connect()
# https://magicstack.github.io/asyncpg/current/api/index.html#asyncpg.pool.create_pool
# https://docs.python.org/3/library/sqlite3.html#sqlite3.connect
# For sqlite, min_size is used as the connection thread pool size and max_size is ignored.
database_opts:
min_size: 1
max_size: 10
plugin_directories:
# The directory where uploaded new plugins should be stored.
upload: /data/plugins
# The directories from which plugins should be loaded.
# Duplicate plugin IDs will be moved to the trash.
load:
- /data/plugins
trash: /data/trash
# Configuration for storing plugin databases
plugin_databases:
# Some plugins still require sqlite, so configure a path here.
# postgres will be used if supported.
sqlite: /data/dbs
postgres: default
server:
# The IP and port to listen to.
hostname: 0.0.0.0
port: {{ matrix_bot_maubot_management_interface_port|to_json }}
# Public base URL where the server is visible.
public_url: {{ matrix_bot_maubot_bot_server_public_url|to_json }}
# The base management API path.
base_path: /_matrix/maubot/v1
# The base path for the UI.
ui_base_path: /_matrix/maubot
# The base path for plugin endpoints. The instance ID will be appended directly.
plugin_base_path: /_matrix/maubot/plugin/
# Override path from where to load UI resources.
# Set to false to using pkg_resources to find the path.
override_resource_path: /opt/maubot/frontend
# The base appservice API path. Use / for legacy appservice API and /_matrix/app/v1 for v1.
appservice_base_path: /_matrix/app/v1
# The shared secret to sign API access tokens.
# Set to "generate" to generate and save a new token at startup.
unshared_secret: {{ matrix_bot_maubot_unshared_secret|to_json }}
# Known homeservers. This is required for the `mbc auth` command and also allows
# more convenient access from the management UI. This is not required to create
# clients in the management UI, since you can also just type the homeserver URL
# into the box there.
homeservers:
{{ matrix_domain }}:
# Client-server API URL
url: "https://{{ matrix_server_fqn_matrix }}"
# registration_shared_secret from synapse config
# You can leave this empty if you don't have access to the homeserver.
# When this is empty, `mbc auth --register` won't work, but `mbc auth` (login) will.
secret: {{ matrix_bot_maubot_registration_shared_secret|to_json }}
# List of administrator users. Plaintext passwords will be bcrypted on startup. Set empty password
# to prevent normal login. Root is a special user that can't have a password and will always exist.
admins: {{ matrix_bot_maubot_admins | combine( {"root": ""} )|to_json }}
api_features:
login: true
plugin: true
plugin_upload: true
instance: true
instance_database: true
client: true
client_proxy: true
client_auth: true
dev_open: true
log: true
# Python logging configuration.
#
# See section 16.7.2 of the Python documentation for more info:
# https://docs.python.org/3.6/library/logging.config.html#configuration-dictionary-schema
logging:
version: 1
formatters:
colored:
(): maubot.lib.color_log.ColorFormatter
format: '[%(asctime)s] [%(levelname)s@%(name)s] %(message)s'
normal:
format: '[%(asctime)s] [%(levelname)s@%(name)s] %(message)s'
handlers:
console:
class: logging.StreamHandler
formatter: colored
loggers:
maubot:
level: {{ matrix_bot_maubot_logging_level|to_json }}
mau:
level: {{ matrix_bot_maubot_logging_level|to_json }}
aiohttp:
level: {{ matrix_bot_maubot_logging_level|to_json }}
root:
level: {{ matrix_bot_maubot_logging_level|to_json }}
handlers: [console]

43
roles/custom/matrix-bot-maubot/templates/systemd/matrix-bot-maubot.service.j2 Normal file
View File

@ -0,0 +1,43 @@
#jinja2: lstrip_blocks: "True"
[Unit]
Description=Maubot
{% for service in matrix_bot_maubot_systemd_required_services_list %}
Requires={{ service }}
After={{ service }}
{% endfor %}
{% for service in matrix_bot_maubot_systemd_wanted_services_list %}
Wants={{ service }}
{% endfor %}
DefaultDependencies=no
[Service]
Type=simple
Environment="HOME={{ matrix_systemd_unit_home_path }}"
ExecStartPre=-{{ matrix_host_command_sh }} -c '{{ matrix_host_command_docker }} kill matrix-bot-maubot 2>/dev/null || true'
ExecStartPre=-{{ matrix_host_command_sh }} -c '{{ matrix_host_command_docker }} rm matrix-bot-maubot 2>/dev/null || true'
ExecStart={{ matrix_host_command_docker }} run --rm --name matrix-bot-maubot \
--log-driver=none \
--user={{ matrix_user_uid }}:{{ matrix_user_gid }} \
--read-only \
--cap-drop=ALL \
--mount type=bind,src={{ matrix_bot_maubot_config_path }},dst=/config,ro \
--mount type=bind,src={{ matrix_bot_maubot_data_path }},dst=/data \
{% for arg in matrix_bot_maubot_container_extra_arguments %}
{{ arg }} \
{% endfor %}
--network={{ matrix_docker_network }} \
{% if matrix_bot_maubot_management_interface_http_bind_port %}
-p {{ matrix_bot_maubot_management_interface_http_bind_port }}:{{ matrix_bot_maubot_management_interface_port }} \
{% endif %}
{{ matrix_bot_maubot_docker_image }} \
python3 -m maubot -c /config/config.yaml --no-update
ExecStop=-{{ matrix_host_command_sh }} -c '{{ matrix_host_command_docker }} kill matrix-bot-maubot 2>/dev/null || true'
ExecStop=-{{ matrix_host_command_sh }} -c '{{ matrix_host_command_docker }} rm matrix-bot-maubot 2>/dev/null || true'
Restart=always
RestartSec=30
SyslogIdentifier=matrix-bot-maubot
[Install]
WantedBy=multi-user.target

59
roles/custom/matrix-bot-mjolnir/defaults/main.yml Normal file
View File

@ -0,0 +1,59 @@
---
# A moderation tool for Matrix
# Project source code URL: https://github.com/matrix-org/mjolnir
matrix_bot_mjolnir_enabled: true
matrix_bot_mjolnir_version: "v1.5.0"
matrix_bot_mjolnir_container_image_self_build: false
matrix_bot_mjolnir_container_image_self_build_repo: "https://github.com/matrix-org/mjolnir.git"
matrix_bot_mjolnir_docker_image: "{{ matrix_bot_mjolnir_docker_image_name_prefix }}matrixdotorg/mjolnir:{{ matrix_bot_mjolnir_version }}"
matrix_bot_mjolnir_docker_image_name_prefix: "{{ 'localhost/' if matrix_bot_mjolnir_container_image_self_build else matrix_container_global_registry_prefix }}"
matrix_bot_mjolnir_docker_image_force_pull: "{{ matrix_bot_mjolnir_docker_image.endswith(':latest') }}"
matrix_bot_mjolnir_base_path: "{{ matrix_base_data_path }}/mjolnir"
matrix_bot_mjolnir_config_path: "{{ matrix_bot_mjolnir_base_path }}/config"
matrix_bot_mjolnir_data_path: "{{ matrix_bot_mjolnir_base_path }}/data"
matrix_bot_mjolnir_docker_src_files_path: "{{ matrix_bot_mjolnir_base_path }}/docker-src"
# A list of extra arguments to pass to the container
matrix_bot_mjolnir_container_extra_arguments: []
# List of systemd services that matrix-bot-mjolnir.service depends on
matrix_bot_mjolnir_systemd_required_services_list: ['docker.service']
# List of systemd services that matrix-bot-mjolnir.service wants
matrix_bot_mjolnir_systemd_wanted_services_list: []
# The access token for the bot user
matrix_bot_mjolnir_access_token: ""
# The room ID where people can use the bot. The bot has no access controls, so
# anyone in this room can use the bot - secure your room!
# This should be a room alias or room ID - not a matrix.to URL.
# Note: Mjolnir is fairly verbose - expect a lot of messages from it.
matrix_bot_mjolnir_management_room: ""
# Default configuration template which covers the generic use case.
# You can customize it by controlling the various variables inside it.
#
# For a more advanced customization, you can extend the default (see `matrix_bot_mjolnir_configuration_extension_yaml`)
# or completely replace this variable with your own template.
matrix_bot_mjolnir_configuration_yaml: "{{ lookup('template', 'templates/production.yaml.j2') }}"
matrix_bot_mjolnir_configuration_extension_yaml: |
# Your custom YAML configuration goes here.
# This configuration extends the default starting configuration (`matrix_bot_mjolnir_configuration_yaml`).
#
# You can override individual variables from the default configuration, or introduce new ones.
#
# If you need something more special, you can take full control by
# completely redefining `matrix_bot_mjolnir_configuration_yaml`.
matrix_bot_mjolnir_configuration_extension: "{{ matrix_bot_mjolnir_configuration_extension_yaml | from_yaml if matrix_bot_mjolnir_configuration_extension_yaml | from_yaml is mapping else {} }}"
# Holds the final configuration (a combination of the default and its extension).
# You most likely don't need to touch this variable. Instead, see `matrix_bot_mjolnir_configuration_yaml`.
matrix_bot_mjolnir_configuration: "{{ matrix_bot_mjolnir_configuration_yaml | from_yaml | combine(matrix_bot_mjolnir_configuration_extension, recursive=True) }}"

11
roles/custom/matrix-bot-mjolnir/tasks/init.yml Normal file
View File

@ -0,0 +1,11 @@
---
# See https://github.com/spantaleev/matrix-docker-ansible-deploy/issues/1070
# and https://github.com/spantaleev/matrix-docker-ansible-deploy/commit/1ab507349c752042d26def3e95884f6df8886b74#commitcomment-51108407
- name: Fail if trying to self-build on Ansible < 2.8
ansible.builtin.fail:
msg: "To self-build the Mjolnir image, you should use Ansible 2.8 or higher. See docs/ansible.md"
when: "ansible_version.major == 2 and ansible_version.minor < 8 and matrix_bot_mjolnir_container_image_self_build and matrix_bot_mjolnir_enabled"
- ansible.builtin.set_fact:
matrix_systemd_services_list: "{{ matrix_systemd_services_list + ['matrix-bot-mjolnir.service'] }}"
when: matrix_bot_mjolnir_enabled | bool

23
roles/custom/matrix-bot-mjolnir/tasks/main.yml Normal file
View File

@ -0,0 +1,23 @@
---
- ansible.builtin.import_tasks: "{{ role_path }}/tasks/init.yml"
tags:
- always
- ansible.builtin.import_tasks: "{{ role_path }}/tasks/validate_config.yml"
when: "run_setup | bool and matrix_bot_mjolnir_enabled | bool"
tags:
- setup-all
- setup-bot-mjolnir
- ansible.builtin.import_tasks: "{{ role_path }}/tasks/setup_install.yml"
when: "run_setup | bool and matrix_bot_mjolnir_enabled | bool"
tags:
- setup-all
- setup-bot-mjolnir
- ansible.builtin.import_tasks: "{{ role_path }}/tasks/setup_uninstall.yml"
when: "run_setup | bool and not matrix_bot_mjolnir_enabled | bool"
tags:
- setup-all
- setup-bot-mjolnir

78
roles/custom/matrix-bot-mjolnir/tasks/setup_install.yml Normal file
View File

@ -0,0 +1,78 @@
---
- ansible.builtin.set_fact:
matrix_bot_mjolnir_requires_restart: false
- name: Ensure matrix-bot-mjolnir paths exist
ansible.builtin.file:
path: "{{ item.path }}"
state: directory
mode: 0750
owner: "{{ matrix_user_username }}"
group: "{{ matrix_user_groupname }}"
with_items:
- {path: "{{ matrix_bot_mjolnir_base_path }}", when: true}
- {path: "{{ matrix_bot_mjolnir_config_path }}", when: true}
- {path: "{{ matrix_bot_mjolnir_data_path }}", when: true}
- {path: "{{ matrix_bot_mjolnir_docker_src_files_path }}", when: "{{ matrix_bot_mjolnir_container_image_self_build }}"}
when: "item.when | bool"
- name: Ensure mjolnir Docker image is pulled
community.docker.docker_image:
name: "{{ matrix_bot_mjolnir_docker_image }}"
source: "{{ 'pull' if ansible_version.major > 2 or ansible_version.minor > 7 else omit }}"
force_source: "{{ matrix_bot_mjolnir_docker_image_force_pull if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}"
force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else matrix_bot_mjolnir_docker_image_force_pull }}"
when: "not matrix_bot_mjolnir_container_image_self_build | bool"
register: result
retries: "{{ matrix_container_retries_count }}"
delay: "{{ matrix_container_retries_delay }}"
until: result is not failed
- name: Ensure mjolnir repository is present on self-build
ansible.builtin.git:
repo: "{{ matrix_bot_mjolnir_container_image_self_build_repo }}"
dest: "{{ matrix_bot_mjolnir_docker_src_files_path }}"
version: "{{ matrix_bot_mjolnir_docker_image.split(':')[1] }}"
force: "yes"
become: true
become_user: "{{ matrix_user_username }}"
register: matrix_bot_mjolnir_git_pull_results
when: "matrix_bot_mjolnir_container_image_self_build | bool"
- name: Ensure mjolnir Docker image is built
community.docker.docker_image:
name: "{{ matrix_bot_mjolnir_docker_image }}"
source: build
force_source: "{{ matrix_bot_mjolnir_git_pull_results.changed }}"
build:
dockerfile: Dockerfile
path: "{{ matrix_bot_mjolnir_docker_src_files_path }}"
pull: true
when: "matrix_bot_mjolnir_container_image_self_build | bool"
- name: Ensure matrix-bot-mjolnir config installed
ansible.builtin.copy:
content: "{{ matrix_bot_mjolnir_configuration | to_nice_yaml(indent=2, width=999999) }}"
dest: "{{ matrix_bot_mjolnir_config_path }}/production.yaml"
mode: 0644
owner: "{{ matrix_user_username }}"
group: "{{ matrix_user_groupname }}"
- name: Ensure matrix-bot-mjolnir.service installed
ansible.builtin.template:
src: "{{ role_path }}/templates/systemd/matrix-bot-mjolnir.service.j2"
dest: "{{ matrix_systemd_path }}/matrix-bot-mjolnir.service"
mode: 0644
register: matrix_bot_mjolnir_systemd_service_result
- name: Ensure systemd reloaded after matrix-bot-mjolnir.service installation
ansible.builtin.service:
daemon_reload: true
when: "matrix_bot_mjolnir_systemd_service_result.changed | bool"
- name: Ensure matrix-bot-mjolnir.service restarted, if necessary
ansible.builtin.service:
name: "matrix-bot-mjolnir.service"
state: restarted
when: "matrix_bot_mjolnir_requires_restart | bool"

36
roles/custom/matrix-bot-mjolnir/tasks/setup_uninstall.yml Normal file
View File

@ -0,0 +1,36 @@
---
- name: Check existence of matrix-bot-mjolnir service
ansible.builtin.stat:
path: "{{ matrix_systemd_path }}/matrix-bot-mjolnir.service"
register: matrix_bot_mjolnir_service_stat
- name: Ensure matrix-bot-mjolnir is stopped
ansible.builtin.service:
name: matrix-bot-mjolnir
state: stopped
enabled: false
daemon_reload: true
register: stopping_result
when: "matrix_bot_mjolnir_service_stat.stat.exists | bool"
- name: Ensure matrix-bot-mjolnir.service doesn't exist
ansible.builtin.file:
path: "{{ matrix_systemd_path }}/matrix-bot-mjolnir.service"
state: absent
when: "matrix_bot_mjolnir_service_stat.stat.exists | bool"
- name: Ensure systemd reloaded after matrix-bot-mjolnir.service removal
ansible.builtin.service:
daemon_reload: true
when: "matrix_bot_mjolnir_service_stat.stat.exists | bool"
- name: Ensure matrix-bot-mjolnir paths don't exist
ansible.builtin.file:
path: "{{ matrix_bot_mjolnir_base_path }}"
state: absent
- name: Ensure mjolnir Docker image doesn't exist
community.docker.docker_image:
name: "{{ matrix_bot_mjolnir_docker_image }}"
state: absent

9
roles/custom/matrix-bot-mjolnir/tasks/validate_config.yml Normal file
View File

@ -0,0 +1,9 @@
---
- name: Fail if required variables are undefined
ansible.builtin.fail:
msg: "The `{{ item }}` variable must be defined and have a non-null value."
with_items:
- "matrix_bot_mjolnir_access_token"
- "matrix_bot_mjolnir_management_room"
when: "vars[item] == '' or vars[item] is none"

246
roles/custom/matrix-bot-mjolnir/templates/production.yaml.j2 Normal file
View File

@ -0,0 +1,246 @@
# Endpoint URL that Mjolnir uses to interact with the matrix homeserver (client-server API),
# set this to the pantalaimon URL if you're using that.
homeserverUrl: "{{ matrix_homeserver_url }}"
# Endpoint URL that Mjolnir could use to fetch events related to reports (client-server API and /_synapse/),
# only set this to the public-internet homeserver client API URL, do NOT set this to the pantalaimon URL.
rawHomeserverUrl: "{{ matrix_homeserver_url }}"
# Matrix Access Token to use, Mjolnir will only use this if pantalaimon.use is false.
accessToken: "{{ matrix_bot_mjolnir_access_token }}"
# Options related to Pantalaimon (https://github.com/matrix-org/pantalaimon)
#pantalaimon:
# # Whether or not Mjolnir will use pantalaimon to access the matrix homeserver,
# # set to `true` if you're using pantalaimon.
# #
# # Be sure to point homeserverUrl to the pantalaimon instance.
# #
# # Mjolnir will log in using the given username and password once,
# # then store the resulting access token in a file under dataPath.
# use: false
#
# # The username to login with.
# username: mjolnir
#
# # The password Mjolnir will login with.
# #
# # After successfully logging in once, this will be ignored, so this value can be blanked after first startup.
# password: your_password
# The path Mjolnir will store its state/data in, leave default ("/data/storage") when using containers.
dataPath: "/data"
# If true (the default), Mjolnir will only accept invites from users present in managementRoom.
autojoinOnlyIfManager: true
# If `autojoinOnlyIfManager` is false, only the members in this space can invite
# the bot to new rooms.
#acceptInvitesFromSpace: "!example:example.org"
# Whether Mjolnir should report ignored invites to the management room (if autojoinOnlyIfManager is true).
recordIgnoredInvites: false
# The room ID (or room alias) of the management room, anyone in this room can issue commands to Mjolnir.
#
# Mjolnir has no more granular access controls other than this, be sure you trust everyone in this room - secure it!
#
# This should be a room alias or room ID - not a matrix.to URL.
#
# Note: By default, Mjolnir is fairly verbose - expect a lot of messages in this room.
# (see verboseLogging to adjust this a bit.)
managementRoom: "{{ matrix_bot_mjolnir_management_room }}"
# Whether Mjolnir should log a lot more messages in the room,
# mainly involves "all-OK" messages, and debugging messages for when mjolnir checks bans in a room.
verboseLogging: false
# The log level of terminal (or container) output,
# can be one of DEBUG, INFO, WARN and ERROR, in increasing order of importance and severity.
#
# This should be at INFO or DEBUG in order to get support for Mjolnir problems.
logLevel: "INFO"
# Whether or not Mjolnir should synchronize policy lists immediately after startup.
# Equivalent to running '!mjolnir sync'.
syncOnStartup: true
# Whether or not Mjolnir should check moderation permissions in all protected rooms on startup.
# Equivalent to running `!mjolnir verify`.
verifyPermissionsOnStartup: true
# Whether or not Mjolnir should actually apply bans and policy lists,
# turn on to trial some untrusted configuration or lists.
noop: false
# Whether Mjolnir should check member lists quicker (by using a different endpoint),
# keep in mind that enabling this will miss invited (but not joined) users.
#
# Turn on if your bot is in (very) large rooms, or in large amounts of rooms.
fasterMembershipChecks: false
# A case-insensitive list of ban reasons to have the bot also automatically redact the user's messages for.
#
# If the bot sees you ban a user with a reason that is an (exact case-insensitive) match to this list,
# it will also remove the user's messages automatically.
#
# Typically this is useful to avoid having to give two commands to the bot.
# Advanced: Use asterisks to have the reason match using "globs"
# (f.e. "spam*testing" would match "spam for testing" as well as "spamtesting").
#
# See here for more info: https://www.digitalocean.com/community/tools/glob
# Note: Keep in mind that glob is NOT regex!
automaticallyRedactForReasons:
- "spam"
- "advertising"
# A list of rooms to protect. Mjolnir will add this to the list it knows from its account data.
#
# It won't, however, add it to the account data.
# Manually add the room via '!mjolnir rooms add' to have it stay protected regardless if this config value changes.
#
# Note: These must be matrix.to URLs
#protectedRooms:
# - "https://matrix.to/#/#yourroom:example.org"
# Whether or not to add all joined rooms to the "protected rooms" list
# (excluding the management room and watched policy list rooms, see below).
#
# Note that this effectively makes the protectedRooms and associated commands useless
# for regular rooms.
#
# Note: the management room is *excluded* from this condition.
# Explicitly add it as a protected room to protect it.
#
# Note: Ban list rooms the bot is watching but didn't create will not be protected.
# Explicitly add these rooms as a protected room list if you want them protected.
protectAllJoinedRooms: false
# Increase this delay to have Mjölnir wait longer between two consecutive backgrounded
# operations. The total duration of operations will be longer, but the homeserver won't
# be affected as much. Conversely, decrease this delay to have Mjölnir chain operations
# faster. The total duration of operations will generally be shorter, but the performance
# of the homeserver may be more impacted.
backgroundDelayMS: 500
# Server administration commands, these commands will only work if Mjolnir is
# a global server administrator, and the bot's server is a Synapse instance.
#admin:
# # Whether or not Mjolnir can temporarily take control of any eligible account from the local homeserver who's in the room
# # (with enough permissions) to "make" a user an admin.
# #
# # This only works if a local user with enough admin permissions is present in the room.
# enableMakeRoomAdminCommand: false
# Misc options for command handling and commands
commands:
# Whether or not the `!mjolnir` prefix is necessary to submit commands.
#
# If `true`, will allow commands like `!ban`, `!help`, etc.
#
# Note: Mjolnir can also be pinged by display name instead of having to use
# the !mjolnir prefix. For example, "my_moderator_bot: ban @spammer:example.org"
# will address only my_moderator_bot.
allowNoPrefix: false
# Any additional bot prefixes that Mjolnir will listen to. i.e. adding `mod` will allow `!mod help`.
additionalPrefixes:
- "mjolnir_bot"
# Whether or not commands with a wildcard (*) will require an additional `--force` argument
# in the command to be able to be submitted.
confirmWildcardBan: true
# Configuration specific to certain toggle-able protections
#protections:
# # Configuration for the wordlist plugin, which can ban users based if they say certain
# # blocked words shortly after joining.
# wordlist:
# # A list of case-insensitive keywords that the WordList protection will watch for from new users.
# #
# # WordList will ban users who use these words when first joining a room, so take caution when selecting them.
# #
# # For advanced usage, regex can also be used, see the following links for more information;
# # - https://www.digitalocean.com/community/tutorials/an-introduction-to-regular-expressions
# # - https://regexr.com/
# # - https://regexone.com/
# words:
# - "LoReM"
# - "IpSuM"
# - "DoLoR"
# - "aMeT"
#
# # For how long (in minutes) the user is "new" to the WordList plugin.
# #
# # After this time, the user will no longer be banned for using a word in the above wordlist.
# #
# # Set to zero to disable the timeout and make users *always* appear "new".
# # (users will always be banned if they say a bad word)
# minutesBeforeTrusting: 20
# Options for advanced monitoring of the health of the bot.
health:
# healthz options. These options are best for use in container environments
# like Kubernetes to detect how healthy the service is. The bot will report
# that it is unhealthy until it is able to process user requests. Typically
# this means that it'll flag itself as unhealthy for a number of minutes
# before saying "Now monitoring rooms" and flagging itself healthy.
#
# Health is flagged through HTTP status codes, defined below.
healthz:
# Whether the healthz integration should be enabled (default false)
enabled: false
# The port to expose the webserver on. Defaults to 8080.
port: 8080
# The address to listen for requests on. Defaults to all addresses.
address: "0.0.0.0"
# The path to expose the monitoring endpoint at. Defaults to `/healthz`
endpoint: "/healthz"
# The HTTP status code which reports that the bot is healthy/ready to
# process requests. Typically this should not be changed. Defaults to
# 200.
healthyStatus: 200
# The HTTP status code which reports that the bot is not healthy/ready.
# Defaults to 418.
unhealthyStatus: 418
# Options for exposing web APIs.
#web:
# # Whether to enable web APIs.
# enabled: false
#
# # The port to expose the webserver on. Defaults to 8080.
# port: 8080
#
# # The address to listen for requests on. Defaults to only the current
# # computer.
# address: localhost
#
# # Alternative setting to open to the entire web. Be careful,
# # as this will increase your security perimeter:
# #
# # address: "0.0.0.0"
#
# # A web API designed to intercept Matrix API
# # POST /_matrix/client/r0/rooms/{roomId}/report/{eventId}
# # and display readable abuse reports in the moderation room.
# #
# # If you wish to take advantage of this feature, you will need
# # to configure a reverse proxy, see e.g. test/nginx.conf
# abuseReporting:
# # Whether to enable this feature.
# enabled: false
# Whether or not to actively poll synapse for abuse reports, to be used
# instead of intercepting client calls to synapse's abuse endpoint, when that
# isn't possible/practical.
pollReports: false
# Whether or not new reports, received either by webapi or polling,
# should be printed to our managementRoom.
displayReports: false

42
roles/custom/matrix-bot-mjolnir/templates/systemd/matrix-bot-mjolnir.service.j2 Normal file
View File

@ -0,0 +1,42 @@
#jinja2: lstrip_blocks: "True"
[Unit]
Description=Matrix Mjolnir bot
{% for service in matrix_bot_mjolnir_systemd_required_services_list %}
Requires={{ service }}
After={{ service }}
{% endfor %}
{% for service in matrix_bot_mjolnir_systemd_required_services_list %}
Wants={{ service }}
{% endfor %}
DefaultDependencies=no
[Service]
Type=simple
Environment="HOME={{ matrix_systemd_unit_home_path }}"
ExecStartPre=-{{ matrix_host_command_sh }} -c '{{ matrix_host_command_docker }} kill matrix-bot-mjolnir 2>/dev/null || true'
ExecStartPre=-{{ matrix_host_command_sh }} -c '{{ matrix_host_command_docker }} rm matrix-bot-mjolnir 2>/dev/null || true'
# Intentional delay, so that the homeserver (we likely depend on) can manage to start.
ExecStartPre={{ matrix_host_command_sleep }} 5
ExecStart={{ matrix_host_command_docker }} run --rm --name matrix-bot-mjolnir \
--log-driver=none \
--user={{ matrix_user_uid }}:{{ matrix_user_gid }} \
--cap-drop=ALL \
--read-only \
--network={{ matrix_docker_network }} \
--mount type=bind,src={{ matrix_bot_mjolnir_config_path }},dst=/data/config,ro \
--mount type=bind,src={{ matrix_bot_mjolnir_data_path }},dst=/data \
{% for arg in matrix_bot_mjolnir_container_extra_arguments %}
{{ arg }} \
{% endfor %}
{{ matrix_bot_mjolnir_docker_image }}
ExecStop=-{{ matrix_host_command_sh }} -c '{{ matrix_host_command_docker }} kill matrix-bot-mjolnir 2>/dev/null || true'
ExecStop=-{{ matrix_host_command_sh }} -c '{{ matrix_host_command_docker }} rm matrix-bot-mjolnir 2>/dev/null || true'
Restart=always
RestartSec=30
SyslogIdentifier=matrix-bot-mjolnir
[Install]
WantedBy=multi-user.target

151
roles/custom/matrix-bot-postmoogle/defaults/main.yml Normal file
View File

@ -0,0 +1,151 @@
---
# postmoogle is an email to matrix bot
# Project source code URL: https://gitlab.com/etke.cc/postmoogle
matrix_bot_postmoogle_enabled: true
matrix_bot_postmoogle_container_image_self_build: false
matrix_bot_postmoogle_docker_repo: "https://gitlab.com/etke.cc/postmoogle.git"
matrix_bot_postmoogle_docker_repo_version: "{{ 'main' if matrix_bot_postmoogle_version == 'latest' else matrix_bot_postmoogle_version }}"
matrix_bot_postmoogle_docker_src_files_path: "{{ matrix_base_data_path }}/postmoogle/docker-src"
matrix_bot_postmoogle_version: v0.9.8
matrix_bot_postmoogle_docker_image: "{{ matrix_bot_postmoogle_docker_image_name_prefix }}postmoogle:{{ matrix_bot_postmoogle_version }}"
matrix_bot_postmoogle_docker_image_name_prefix: "{{ 'localhost/' if matrix_bot_postmoogle_container_image_self_build else 'registry.gitlab.com/etke.cc/' }}"
matrix_bot_postmoogle_docker_image_force_pull: "{{ matrix_bot_postmoogle_docker_image.endswith(':latest') }}"
matrix_bot_postmoogle_base_path: "{{ matrix_base_data_path }}/postmoogle"
matrix_bot_postmoogle_config_path: "{{ matrix_bot_postmoogle_base_path }}/config"
matrix_bot_postmoogle_data_path: "{{ matrix_bot_postmoogle_base_path }}/data"
# A list of extra arguments to pass to the container
matrix_bot_postmoogle_container_extra_arguments: []
# List of systemd services that matrix-bot-postmoogle.service depends on
matrix_bot_postmoogle_systemd_required_services_list: ['docker.service']
# List of systemd services that matrix-bot-postmoogle.service wants
matrix_bot_postmoogle_systemd_wanted_services_list: []
# Database-related configuration fields.
#
# To use SQLite, stick to these defaults.
#
# To use Postgres:
# - change the engine (`matrix_bot_postmoogle_database_engine: 'postgres'`)
# - adjust your database credentials via the `matrix_bot_postmoogle_database_*` variables
matrix_bot_postmoogle_database_engine: 'sqlite'
matrix_bot_postmoogle_sqlite_database_path_local: "{{ matrix_bot_postmoogle_data_path }}/bot.db"
matrix_bot_postmoogle_sqlite_database_path_in_container: "/data/bot.db"
matrix_bot_postmoogle_database_username: 'postmoogle'
matrix_bot_postmoogle_database_password: 'some-password'
matrix_bot_postmoogle_database_hostname: 'matrix-postgres'
matrix_bot_postmoogle_database_port: 5432
matrix_bot_postmoogle_database_name: 'postmoogle'
matrix_bot_postmoogle_database_connection_string: 'postgres://{{ matrix_bot_postmoogle_database_username }}:{{ matrix_bot_postmoogle_database_password }}@{{ matrix_bot_postmoogle_database_hostname }}:{{ matrix_bot_postmoogle_database_port }}/{{ matrix_bot_postmoogle_database_name }}?sslmode=disable'
matrix_bot_postmoogle_storage_database: "{{
{
'sqlite': matrix_bot_postmoogle_sqlite_database_path_in_container,
'postgres': matrix_bot_postmoogle_database_connection_string,
}[matrix_bot_postmoogle_database_engine]
}}"
matrix_bot_postmoogle_database_dialect: "{{
{
'sqlite': 'sqlite3',
'postgres': 'postgres',
}[matrix_bot_postmoogle_database_engine]
}}"
# The bot's username. This user needs to be created manually beforehand.
# Also see `matrix_bot_postmoogle_password`.
matrix_bot_postmoogle_login: "postmoogle"
# The password that the bot uses to authenticate.
matrix_bot_postmoogle_password: ''
matrix_bot_postmoogle_homeserver: "{{ matrix_homeserver_container_url }}"
# Command prefix
matrix_bot_postmoogle_prefix: '!pm'
# Max email size in megabytes, including attachments
matrix_bot_postmoogle_maxsize: '1024'
# DEPRECATED, use !pm users instead
# A list of whitelisted users allowed to use the bridge.
# If not defined, everyone is allowed.
# Example set of rules:
# matrix_bot_postmoogle_users:
# - @someone:example.com
# - @another:example.com
# - @bot.*:example.com
# - @*:another.com
matrix_bot_postmoogle_users:
- "@*:{{ matrix_domain }}"
# A list of admins
# Example set of rules:
# matrix_bot_postmoogle_admins:
# - @someone:example.com
# - @another:example.com
# - @bot.*:example.com
# - @*:another.com
matrix_bot_postmoogle_admins: "{{ [matrix_admin] if matrix_admin else [] }}"
# Sentry DSN
matrix_bot_postmoogle_sentry: ''
# Log level
matrix_bot_postmoogle_loglevel: 'INFO'
# Disable encryption
matrix_bot_postmoogle_noencryption: false
matrix_bot_postmoogle_domain: "{{ matrix_server_fqn_matrix }}"
# Password (passphrase) to encrypt account data
matrix_bot_postmoogle_data_secret: ""
# in-container ports
matrix_bot_postmoogle_port: '2525'
matrix_bot_postmoogle_tls_port: '25587'
# on-host ports
matrix_bot_postmoogle_smtp_host_bind_port: '25'
matrix_bot_postmoogle_submission_host_bind_port: '587'
### SSL
## on-host SSL dir
matrix_bot_postmoogle_ssl_path: ""
## in-container SSL paths
# matrix_bot_postmoogle_tls_cert is the SSL certificate's certificate.
# This is likely set via group_vars/matrix_servers, so you don't need to set it.
# If you do need to set it manually, note that this is an in-container path.
# To mount a certificates volumes into the container, use matrix_bot_postmoogle_ssl_path
# Example value: /ssl/live/{{ matrix_bot_postmoogle_domain }}/fullchain.pem
matrix_bot_postmoogle_tls_cert: ""
# matrix_bot_postmoogle_tls_key is the SSL certificate's key.
# This is likely set via group_vars/matrix_servers, so you don't need to set it.
# If you do need to set it manually, note that this is an in-container path.
# To mount a certificates volumes into the container, use matrix_bot_postmoogle_ssl_path
# Example value: /ssl/live/{{ matrix_bot_postmoogle_domain }}/privkey.pem
matrix_bot_postmoogle_tls_key: ""
# Mandatory TLS, even on plain SMTP port
matrix_bot_postmoogle_tls_required: false
# Additional environment variables to pass to the postmoogle container
#
# Example:
# matrix_bot_postmoogle_environment_variables_extension: |
# postmoogle_TEXT_DONE=Done
matrix_bot_postmoogle_environment_variables_extension: ''

5
roles/custom/matrix-bot-postmoogle/tasks/init.yml Normal file
View File

@ -0,0 +1,5 @@
---
- ansible.builtin.set_fact:
matrix_systemd_services_list: "{{ matrix_systemd_services_list + ['matrix-bot-postmoogle.service'] }}"
when: matrix_bot_postmoogle_enabled | bool

23
roles/custom/matrix-bot-postmoogle/tasks/main.yml Normal file
View File

@ -0,0 +1,23 @@
---
- ansible.builtin.import_tasks: "{{ role_path }}/tasks/init.yml"
tags:
- always
- ansible.builtin.import_tasks: "{{ role_path }}/tasks/validate_config.yml"
when: "run_setup | bool and matrix_bot_postmoogle_enabled | bool"
tags:
- setup-all
- setup-bot-postmoogle
- ansible.builtin.import_tasks: "{{ role_path }}/tasks/setup_install.yml"
when: "run_setup | bool and matrix_bot_postmoogle_enabled | bool"
tags:
- setup-all
- setup-bot-postmoogle
- ansible.builtin.import_tasks: "{{ role_path }}/tasks/setup_uninstall.yml"
when: "run_setup | bool and not matrix_bot_postmoogle_enabled | bool"
tags:
- setup-all
- setup-bot-postmoogle

93
roles/custom/matrix-bot-postmoogle/tasks/setup_install.yml Normal file
View File

@ -0,0 +1,93 @@
---
- when: "matrix_bot_postmoogle_database_engine == 'postgres'"
block:
- name: Check if an SQLite database already exists
ansible.builtin.stat:
path: "{{ matrix_bot_postmoogle_sqlite_database_path_local }}"
register: matrix_bot_postmoogle_sqlite_database_path_local_stat_result
- when: "matrix_bot_postmoogle_sqlite_database_path_local_stat_result.stat.exists | bool"
block:
- ansible.builtin.set_fact:
matrix_postgres_db_migration_request:
src: "{{ matrix_bot_postmoogle_sqlite_database_path_local }}"
dst: "{{ matrix_bot_postmoogle_database_connection_string }}"
caller: "{{ role_path | basename }}"
engine_variable_name: 'matrix_bot_postmoogle_database_engine'
engine_old: 'sqlite'
systemd_services_to_stop: ['matrix-bot-postmoogle.service']
- ansible.builtin.import_role:
name: custom/matrix-postgres
tasks_from: migrate_db_to_postgres
- ansible.builtin.set_fact:
matrix_bot_postmoogle_requires_restart: true
- name: Ensure postmoogle paths exist
ansible.builtin.file:
path: "{{ item.path }}"
state: directory
mode: 0750
owner: "{{ matrix_user_username }}"
group: "{{ matrix_user_groupname }}"
with_items:
- {path: "{{ matrix_bot_postmoogle_config_path }}", when: true}
- {path: "{{ matrix_bot_postmoogle_data_path }}", when: true}
- {path: "{{ matrix_bot_postmoogle_docker_src_files_path }}", when: matrix_bot_postmoogle_container_image_self_build}
when: "item.when | bool"
- name: Ensure postmoogle environment variables file created
ansible.builtin.template:
src: "{{ role_path }}/templates/env.j2"
dest: "{{ matrix_bot_postmoogle_config_path }}/env"
owner: "{{ matrix_user_username }}"
group: "{{ matrix_user_groupname }}"
mode: 0640
- name: Ensure postmoogle image is pulled
community.docker.docker_image:
name: "{{ matrix_bot_postmoogle_docker_image }}"
source: "{{ 'pull' if ansible_version.major > 2 or ansible_version.minor > 7 else omit }}"
force_source: "{{ matrix_bot_postmoogle_docker_image_force_pull if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}"
force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else matrix_bot_postmoogle_docker_image_force_pull }}"
when: "not matrix_bot_postmoogle_container_image_self_build | bool"
register: result
retries: "{{ matrix_container_retries_count }}"
delay: "{{ matrix_container_retries_delay }}"
until: result is not failed
- name: Ensure postmoogle repository is present on self-build
ansible.builtin.git:
repo: "{{ matrix_bot_postmoogle_docker_repo }}"
version: "{{ matrix_bot_postmoogle_docker_repo_version }}"
dest: "{{ matrix_bot_postmoogle_docker_src_files_path }}"
force: "yes"
become: true
become_user: "{{ matrix_user_username }}"
register: matrix_bot_postmoogle_git_pull_results
when: "matrix_bot_postmoogle_container_image_self_build | bool"
- name: Ensure postmoogle image is built
community.docker.docker_image:
name: "{{ matrix_bot_postmoogle_docker_image }}"
source: build
force_source: "{{ matrix_bot_postmoogle_git_pull_results.changed if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}"
force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else matrix_mailer_git_pull_results.changed }}"
build:
dockerfile: Dockerfile
path: "{{ matrix_bot_postmoogle_docker_src_files_path }}"
pull: true
when: "matrix_bot_postmoogle_container_image_self_build | bool"
- name: Ensure matrix-bot-postmoogle.service installed
ansible.builtin.template:
src: "{{ role_path }}/templates/systemd/matrix-bot-postmoogle.service.j2"
dest: "{{ matrix_systemd_path }}/matrix-bot-postmoogle.service"
mode: 0644
register: matrix_bot_postmoogle_systemd_service_result
- name: Ensure systemd reloaded after matrix-bot-postmoogle.service installation
ansible.builtin.service:
daemon_reload: true
when: "matrix_bot_postmoogle_systemd_service_result.changed | bool"

36
roles/custom/matrix-bot-postmoogle/tasks/setup_uninstall.yml Normal file
View File

@ -0,0 +1,36 @@
---
- name: Check existence of matrix-postmoogle service
ansible.builtin.stat:
path: "{{ matrix_systemd_path }}/matrix-bot-postmoogle.service"
register: matrix_bot_postmoogle_service_stat
- name: Ensure matrix-postmoogle is stopped
ansible.builtin.service:
name: matrix-bot-postmoogle
state: stopped
enabled: false
daemon_reload: true
register: stopping_result
when: "matrix_bot_postmoogle_service_stat.stat.exists | bool"
- name: Ensure matrix-bot-postmoogle.service doesn't exist
ansible.builtin.file:
path: "{{ matrix_systemd_path }}/matrix-bot-postmoogle.service"
state: absent
when: "matrix_bot_postmoogle_service_stat.stat.exists | bool"
- name: Ensure systemd reloaded after matrix-bot-postmoogle.service removal
ansible.builtin.service:
daemon_reload: true
when: "matrix_bot_postmoogle_service_stat.stat.exists | bool"
- name: Ensure Matrix postmoogle paths don't exist
ansible.builtin.file:
path: "{{ matrix_bot_postmoogle_base_path }}"
state: absent
- name: Ensure postmoogle Docker image doesn't exist
community.docker.docker_image:
name: "{{ matrix_bot_postmoogle_docker_image }}"
state: absent

9
roles/custom/matrix-bot-postmoogle/tasks/validate_config.yml Normal file
View File

@ -0,0 +1,9 @@
---
- name: Fail if required settings not defined
ansible.builtin.fail:
msg: >-
You need to define a required configuration setting (`{{ item }}`).
when: "vars[item] == ''"
with_items:
- "matrix_bot_postmoogle_password"

20
roles/custom/matrix-bot-postmoogle/templates/env.j2 Normal file
View File

@ -0,0 +1,20 @@
POSTMOOGLE_LOGIN={{ matrix_bot_postmoogle_login }}
POSTMOOGLE_PASSWORD={{ matrix_bot_postmoogle_password }}
POSTMOOGLE_HOMESERVER={{ matrix_bot_postmoogle_homeserver }}
POSTMOOGLE_DOMAIN={{ matrix_bot_postmoogle_domain }}
POSTMOOGLE_PORT={{ matrix_bot_postmoogle_port }}
POSTMOOGLE_DB_DSN={{ matrix_bot_postmoogle_database_connection_string }}
POSTMOOGLE_DB_DIALECT={{ matrix_bot_postmoogle_database_dialect }}
POSTMOOGLE_PREFIX={{ matrix_bot_postmoogle_prefix }}
POSTMOOGLE_MAXSIZE={{ matrix_bot_postmoogle_maxsize }}
POSTMOOGLE_SENTRY={{ matrix_bot_postmoogle_sentry }}
POSTMOOGLE_LOGLEVEL={{ matrix_bot_postmoogle_loglevel }}
POSTMOOGLE_NOENCRYPTION={{ matrix_bot_postmoogle_noencryption }}
POSTMOOGLE_ADMINS={{ matrix_bot_postmoogle_admins | join(' ') }}
POSTMOOGLE_TLS_PORT={{ matrix_bot_postmoogle_tls_port }}
POSTMOOGLE_TLS_CERT={{ matrix_bot_postmoogle_tls_cert }}
POSTMOOGLE_TLS_KEY={{ matrix_bot_postmoogle_tls_key }}
POSTMOOGLE_TLS_REQUIRED={{ matrix_bot_postmoogle_tls_required }}
POSTMOOGLE_DATA_SECRET={{ matrix_bot_postmoogle_data_secret }}
{{ matrix_bot_postmoogle_environment_variables_extension }}

Some files were not shown because too many files have changed in this diff Show More