From 1f988969a5e91d3b2e4421f35db1563ca4ac957d Mon Sep 17 00:00:00 2001 From: Scott Crossen Date: Tue, 13 Oct 2020 16:18:38 -0700 Subject: [PATCH 01/42] Added role for dynamic dns --- docs/configuring-playbook-budget-builds.md | 21 +++++++++++++ docs/configuring-playbook.md | 1 + roles/matrix-dynamic-dns/defaults/main.yml | 14 +++++++++ roles/matrix-dynamic-dns/tasks/init.yml | 4 +++ roles/matrix-dynamic-dns/tasks/install.yml | 24 ++++++++++++++ roles/matrix-dynamic-dns/tasks/main.yml | 28 +++++++++++++++++ .../tasks/platform/archlinux.yml | 16 ++++++++++ .../tasks/platform/centos.yml | 23 ++++++++++++++ .../tasks/platform/debian.yml | 18 +++++++++++ .../tasks/platform/main.yml | 11 +++++++ roles/matrix-dynamic-dns/tasks/uninstall.yml | 31 +++++++++++++++++++ .../tasks/validate_config.yml | 19 ++++++++++++ .../templates/ddclient.conf.j2 | 7 +++++ .../matrix-dynamic-dns/templates/ddclient.j2 | 4 +++ setup.yml | 1 + 15 files changed, 222 insertions(+) create mode 100644 docs/configuring-playbook-budget-builds.md create mode 100644 roles/matrix-dynamic-dns/defaults/main.yml create mode 100644 roles/matrix-dynamic-dns/tasks/init.yml create mode 100644 roles/matrix-dynamic-dns/tasks/install.yml create mode 100644 roles/matrix-dynamic-dns/tasks/main.yml create mode 100644 roles/matrix-dynamic-dns/tasks/platform/archlinux.yml create mode 100644 roles/matrix-dynamic-dns/tasks/platform/centos.yml create mode 100644 roles/matrix-dynamic-dns/tasks/platform/debian.yml create mode 100644 roles/matrix-dynamic-dns/tasks/platform/main.yml create mode 100644 roles/matrix-dynamic-dns/tasks/uninstall.yml create mode 100644 roles/matrix-dynamic-dns/tasks/validate_config.yml create mode 100644 roles/matrix-dynamic-dns/templates/ddclient.conf.j2 create mode 100644 roles/matrix-dynamic-dns/templates/ddclient.j2 diff --git a/docs/configuring-playbook-budget-builds.md b/docs/configuring-playbook-budget-builds.md new file mode 100644 index 000000000..0fb738356 --- /dev/null +++ b/docs/configuring-playbook-budget-builds.md @@ -0,0 +1,21 @@ +# Tips for deploying Matrix on a Budget + +## Dynamic DNS + +Most cloud providers / ISPs will charge you extra for a static IP address. If you're +not hosting a highly reliable homeserver you can workaround this via dynamic DNS. To +set this up, you'll need to get the username/password from your DNS provider. For +google domains, this process is described [here](https://support.google.com/domains/answer/6147083). +After you've gotten the proper credentials you can add the following config to your `host-vars`: + +``` +matrix_dynamic_dns_username: XXXXXXXXXXXXXXXX +matrix_dynamic_dns_password: XXXXXXXXXXXXXXXX +matrix_dynamic_dns_provider: 'domains.google.com' +``` + +## Additional Reading + +Additional resources: + +- https://matrix.org/docs/guides/free-small-matrix-server \ No newline at end of file diff --git a/docs/configuring-playbook.md b/docs/configuring-playbook.md index b174637ef..8b0c55370 100644 --- a/docs/configuring-playbook.md +++ b/docs/configuring-playbook.md @@ -33,6 +33,7 @@ When you're done with all the configuration you'd like to do, continue with [Ins - [Setting up the Jitsi video-conferencing platform](configuring-playbook-jitsi.md) (optional) +- [Setting up budget builds or resource-constrained builds](configuring-playbook-budget-builds.md) (optional) ### Core service adjustments diff --git a/roles/matrix-dynamic-dns/defaults/main.yml b/roles/matrix-dynamic-dns/defaults/main.yml new file mode 100644 index 000000000..a0afc99ea --- /dev/null +++ b/roles/matrix-dynamic-dns/defaults/main.yml @@ -0,0 +1,14 @@ +# Whether dynamic dns is enabled +matrix_dynamic_dns_enabled: true + +# Allowed values: 'daemon', 'dhcp' +matrix_dynamic_dns_mode: 'dhcp' + +# The DNS provider domain +matrix_dynamic_dns_provider: 'domains.google.com' + +# The dynamic dns protocol +matrix_dynamic_dns_protocol: 'dyndns2' + +# The dynamic dns daemon interval +matrix_dynamic_dns_daemon_interval: '300' diff --git a/roles/matrix-dynamic-dns/tasks/init.yml b/roles/matrix-dynamic-dns/tasks/init.yml new file mode 100644 index 000000000..4cddb8b55 --- /dev/null +++ b/roles/matrix-dynamic-dns/tasks/init.yml @@ -0,0 +1,4 @@ +- set_fact: + matrix_systemd_services_list: "{{ matrix_systemd_services_list + ['ddclient'] }}" + when: "matrix_dynamic_dns_enabled|bool" + \ No newline at end of file diff --git a/roles/matrix-dynamic-dns/tasks/install.yml b/roles/matrix-dynamic-dns/tasks/install.yml new file mode 100644 index 000000000..edaf6864e --- /dev/null +++ b/roles/matrix-dynamic-dns/tasks/install.yml @@ -0,0 +1,24 @@ +--- + +- name: Ensure ddclient domain config exists + template: + src: "{{ role_path }}/templates/ddclient.conf.j2" + dest: "/etc/ddclient.conf" + mode: 0600 + register: matrix_dynamic_dns_ddclient_domain_config + +- name: Ensure ddclient client config directory exists + file: + path: "/etc/default" + state: directory + mode: 0700 + owner: "{{ user_username }}" + group: "{{ user_groupname }}" + +- name: Ensure ddclient client config exists + template: + src: "{{ role_path }}/templates/ddclient.j2" + dest: "/etc/default/ddclient" + mode: 0600 + register: matrix_dynamic_dns_ddclient_client_config + \ No newline at end of file diff --git a/roles/matrix-dynamic-dns/tasks/main.yml b/roles/matrix-dynamic-dns/tasks/main.yml new file mode 100644 index 000000000..727bf16e6 --- /dev/null +++ b/roles/matrix-dynamic-dns/tasks/main.yml @@ -0,0 +1,28 @@ +- import_tasks: "{{ role_path }}/tasks/init.yml" + tags: + - always + +- import_tasks: "{{ role_path }}/tasks/validate_config.yml" + when: "run_setup|bool and matrix_dynamic_dns_enabled|bool" + tags: + - setup-all + - setup-dynamic-dns + +- import_tasks: "{{ role_path }}/tasks/install.yml" + when: "run_setup|bool and matrix_dynamic_dns_enabled|bool" + tags: + - setup-all + - setup-dynamic-dns + +- import_tasks: "{{ role_path }}/tasks/platform/main.yml" + when: "run_setup|bool" + tags: + - setup-all + - setup-dynamic-dns + +- import_tasks: "{{ role_path }}/tasks/uninstall.yml" + when: "run_setup|bool and not matrix_dynamic_dns_enabled|bool" + tags: + - setup-all + - setup-dynamic-dns + \ No newline at end of file diff --git a/roles/matrix-dynamic-dns/tasks/platform/archlinux.yml b/roles/matrix-dynamic-dns/tasks/platform/archlinux.yml new file mode 100644 index 000000000..773cfce69 --- /dev/null +++ b/roles/matrix-dynamic-dns/tasks/platform/archlinux.yml @@ -0,0 +1,16 @@ +--- + +- name: Ensure ddclient is installed + pacman: + name: ddclient + state: latest + when: "run_setup|bool and matrix_dynamic_dns_enabled|bool" + +- name: Ensure ddclient is uninstalled + pacman: + name: ddclient + state: absent + update_cache: true + become: true + when: "run_setup|bool and not matrix_dynamic_dns_enabled|bool" + \ No newline at end of file diff --git a/roles/matrix-dynamic-dns/tasks/platform/centos.yml b/roles/matrix-dynamic-dns/tasks/platform/centos.yml new file mode 100644 index 000000000..5e84ef10d --- /dev/null +++ b/roles/matrix-dynamic-dns/tasks/platform/centos.yml @@ -0,0 +1,23 @@ +--- + +- name: Ensure yum packages are installed + yum: + name: epel-release + state: latest + update_cache: yes + when: "run_setup|bool and matrix_dynamic_dns_enabled|bool" + +- name: Ensure ddclient is installed + yum: + name: ddclient + state: latest + when: "run_setup|bool and matrix_dynamic_dns_enabled|bool" + +- name: Ensure ddclient is uninstalled + yum: + name: + - ddclient + - epel-release + state: absent + when: "run_setup|bool and not matrix_dynamic_dns_enabled|bool" + \ No newline at end of file diff --git a/roles/matrix-dynamic-dns/tasks/platform/debian.yml b/roles/matrix-dynamic-dns/tasks/platform/debian.yml new file mode 100644 index 000000000..f6d664fd5 --- /dev/null +++ b/roles/matrix-dynamic-dns/tasks/platform/debian.yml @@ -0,0 +1,18 @@ +--- + +- name: Ensure ddclient is installed + apt: + name: ddclient + state: present + update_cache: true + become: true + when: "run_setup|bool and matrix_dynamic_dns_enabled|bool" + +- name: Ensure ddclient is uninstalled + apt: + name: ddclient + state: absent + update_cache: true + become: true + when: "run_setup|bool and not matrix_dynamic_dns_enabled|bool" + \ No newline at end of file diff --git a/roles/matrix-dynamic-dns/tasks/platform/main.yml b/roles/matrix-dynamic-dns/tasks/platform/main.yml new file mode 100644 index 000000000..ca9737493 --- /dev/null +++ b/roles/matrix-dynamic-dns/tasks/platform/main.yml @@ -0,0 +1,11 @@ +--- + +- include_tasks: "{{ role_path }}/tasks/platform/centos.yml" + when: ansible_distribution == 'CentOS' + +# The instructions are the same for Debian, Ubuntu, and Raspbian +- include_tasks: "{{ role_path }}/tasks/platform/debian.yml" + when: ansible_distribution == 'Debian' + +- include_tasks: "{{ role_path }}/tasks/platform/archlinux.yml" + when: ansible_distribution == 'Archlinux' diff --git a/roles/matrix-dynamic-dns/tasks/uninstall.yml b/roles/matrix-dynamic-dns/tasks/uninstall.yml new file mode 100644 index 000000000..27604585c --- /dev/null +++ b/roles/matrix-dynamic-dns/tasks/uninstall.yml @@ -0,0 +1,31 @@ +--- + +- name: Check existence of ddclient.service + stat: + path: "{{ systemd_path }}/ddclient.service" + register: matrix_dynamic_dns_ddclient_service_stat + +- name: Ensure ddclient.service is stopped + service: + name: dynamic-dns + state: stopped + daemon_reload: yes + when: "matrix_dynamic_dns_ddclient_service_stat.stat.exists" + +- name: Ensure systemd reloaded after ddclient.service removal + service: + daemon_reload: yes + when: "matrix_dynamic_dns_ddclient_service_stat.stat.exists" + +- name: Ensure ddclient.service doesn't exist + file: + path: "{{ systemd_path }}/ddclient.service" + state: absent + when: "matrix_dynamic_dns_ddclient_service_stat.stat.exists" + +- name: Ensure ddclient configuration files don't exist + file: + path: + - "etc/ddclient.conf" + - "etc/default/ddclient" + state: absent diff --git a/roles/matrix-dynamic-dns/tasks/validate_config.yml b/roles/matrix-dynamic-dns/tasks/validate_config.yml new file mode 100644 index 000000000..bb351e49d --- /dev/null +++ b/roles/matrix-dynamic-dns/tasks/validate_config.yml @@ -0,0 +1,19 @@ +--- + +- name: Fail if required settings not defined + fail: + msg: >- + You need to define a required configuration setting (`{{ item }}`). + when: "vars[item] == ''" + with_items: + - "matrix_dynamic_dns_username" + - "matrix_dynamic_dns_password" + - "matrix_domain" + - "matrix_dynamic_dns_provider" + - "matrix_dynamic_dns_mode" + +- name: Fail if dynamic dns mode is incorrect + fail: + msg: >- + matrix_dynamic_dns_mode needs to be set to 'daemon' or 'startup' + when: "matrix_dynamic_dns_enabled and matrix_dynamic_dns_mode != 'daemon' and matrix_dynamic_dns_mode != 'dhcp'" diff --git a/roles/matrix-dynamic-dns/templates/ddclient.conf.j2 b/roles/matrix-dynamic-dns/templates/ddclient.conf.j2 new file mode 100644 index 000000000..dcb5c1e48 --- /dev/null +++ b/roles/matrix-dynamic-dns/templates/ddclient.conf.j2 @@ -0,0 +1,7 @@ +protocol={{ matrix_dynamic_dns_protocol }} +use=web +ssl=yes +server={{ matrix_dynamic_dns_provider }} +login='{{ matrix_dynamic_dns_username }}' +password='{{ matrix_dynamic_dns_password }}' +{{ matrix_domain }} \ No newline at end of file diff --git a/roles/matrix-dynamic-dns/templates/ddclient.j2 b/roles/matrix-dynamic-dns/templates/ddclient.j2 new file mode 100644 index 000000000..eb5d053d6 --- /dev/null +++ b/roles/matrix-dynamic-dns/templates/ddclient.j2 @@ -0,0 +1,4 @@ +run_dhclient="{{ (matrix_dynamic_dns_mode == 'dhcp') | lower }}" +run_ipup="false" +run_daemon="{{ (matrix_dynamic_dns_mode == 'daemon') | lower }}" +daemon_interval="{{ matrix_dynamic_dns_daemon_interval }}" diff --git a/setup.yml b/setup.yml index 68c4e4eee..f07f02789 100755 --- a/setup.yml +++ b/setup.yml @@ -5,6 +5,7 @@ roles: - matrix-base + - dynamic-dns - matrix-mailer - matrix-postgres - matrix-corporal From 53bc7a77e1c851132e41df963c650d434418652a Mon Sep 17 00:00:00 2001 From: Scott Crossen Date: Tue, 13 Oct 2020 16:47:09 -0700 Subject: [PATCH 02/42] fixed EOF issues --- roles/matrix-dynamic-dns/tasks/init.yml | 1 - roles/matrix-dynamic-dns/tasks/install.yml | 1 - roles/matrix-dynamic-dns/tasks/main.yml | 1 - roles/matrix-dynamic-dns/tasks/platform/archlinux.yml | 1 - roles/matrix-dynamic-dns/tasks/platform/centos.yml | 1 - roles/matrix-dynamic-dns/tasks/platform/debian.yml | 1 - roles/matrix-dynamic-dns/templates/ddclient.conf.j2 | 2 +- 7 files changed, 1 insertion(+), 7 deletions(-) diff --git a/roles/matrix-dynamic-dns/tasks/init.yml b/roles/matrix-dynamic-dns/tasks/init.yml index 4cddb8b55..97f5eaecf 100644 --- a/roles/matrix-dynamic-dns/tasks/init.yml +++ b/roles/matrix-dynamic-dns/tasks/init.yml @@ -1,4 +1,3 @@ - set_fact: matrix_systemd_services_list: "{{ matrix_systemd_services_list + ['ddclient'] }}" when: "matrix_dynamic_dns_enabled|bool" - \ No newline at end of file diff --git a/roles/matrix-dynamic-dns/tasks/install.yml b/roles/matrix-dynamic-dns/tasks/install.yml index edaf6864e..0948e79dd 100644 --- a/roles/matrix-dynamic-dns/tasks/install.yml +++ b/roles/matrix-dynamic-dns/tasks/install.yml @@ -21,4 +21,3 @@ dest: "/etc/default/ddclient" mode: 0600 register: matrix_dynamic_dns_ddclient_client_config - \ No newline at end of file diff --git a/roles/matrix-dynamic-dns/tasks/main.yml b/roles/matrix-dynamic-dns/tasks/main.yml index 727bf16e6..7646dd139 100644 --- a/roles/matrix-dynamic-dns/tasks/main.yml +++ b/roles/matrix-dynamic-dns/tasks/main.yml @@ -25,4 +25,3 @@ tags: - setup-all - setup-dynamic-dns - \ No newline at end of file diff --git a/roles/matrix-dynamic-dns/tasks/platform/archlinux.yml b/roles/matrix-dynamic-dns/tasks/platform/archlinux.yml index 773cfce69..10e208021 100644 --- a/roles/matrix-dynamic-dns/tasks/platform/archlinux.yml +++ b/roles/matrix-dynamic-dns/tasks/platform/archlinux.yml @@ -13,4 +13,3 @@ update_cache: true become: true when: "run_setup|bool and not matrix_dynamic_dns_enabled|bool" - \ No newline at end of file diff --git a/roles/matrix-dynamic-dns/tasks/platform/centos.yml b/roles/matrix-dynamic-dns/tasks/platform/centos.yml index 5e84ef10d..7375ad32b 100644 --- a/roles/matrix-dynamic-dns/tasks/platform/centos.yml +++ b/roles/matrix-dynamic-dns/tasks/platform/centos.yml @@ -20,4 +20,3 @@ - epel-release state: absent when: "run_setup|bool and not matrix_dynamic_dns_enabled|bool" - \ No newline at end of file diff --git a/roles/matrix-dynamic-dns/tasks/platform/debian.yml b/roles/matrix-dynamic-dns/tasks/platform/debian.yml index f6d664fd5..c41dbaf99 100644 --- a/roles/matrix-dynamic-dns/tasks/platform/debian.yml +++ b/roles/matrix-dynamic-dns/tasks/platform/debian.yml @@ -15,4 +15,3 @@ update_cache: true become: true when: "run_setup|bool and not matrix_dynamic_dns_enabled|bool" - \ No newline at end of file diff --git a/roles/matrix-dynamic-dns/templates/ddclient.conf.j2 b/roles/matrix-dynamic-dns/templates/ddclient.conf.j2 index dcb5c1e48..6d8736884 100644 --- a/roles/matrix-dynamic-dns/templates/ddclient.conf.j2 +++ b/roles/matrix-dynamic-dns/templates/ddclient.conf.j2 @@ -4,4 +4,4 @@ ssl=yes server={{ matrix_dynamic_dns_provider }} login='{{ matrix_dynamic_dns_username }}' password='{{ matrix_dynamic_dns_password }}' -{{ matrix_domain }} \ No newline at end of file +{{ matrix_domain }} From 51cca4c312b70ac09de5c423681c69e045e725cf Mon Sep 17 00:00:00 2001 From: Scott Crossen Date: Fri, 16 Oct 2020 21:21:58 -0700 Subject: [PATCH 03/42] Added containerization --- roles/matrix-dynamic-dns/defaults/main.yml | 45 +++++++++++--- roles/matrix-dynamic-dns/tasks/init.yml | 6 +- .../tasks/install_daemon.yml | 59 +++++++++++++++++++ .../tasks/{install.yml => install_dhcp.yml} | 14 +++-- roles/matrix-dynamic-dns/tasks/main.yml | 18 ++++-- .../tasks/uninstall_daemon.yml | 24 ++++++++ .../{uninstall.yml => uninstall_dhcp.yml} | 12 ++-- .../tasks/validate_config.yml | 4 +- .../templates/ddclient.conf.j2 | 22 +++++-- .../matrix-dynamic-dns/templates/ddclient.j2 | 4 -- .../systemd/matrix-dynamic-dns.service.j2 | 41 +++++++++++++ setup.yml | 2 +- 12 files changed, 211 insertions(+), 40 deletions(-) create mode 100644 roles/matrix-dynamic-dns/tasks/install_daemon.yml rename roles/matrix-dynamic-dns/tasks/{install.yml => install_dhcp.yml} (55%) create mode 100644 roles/matrix-dynamic-dns/tasks/uninstall_daemon.yml rename roles/matrix-dynamic-dns/tasks/{uninstall.yml => uninstall_dhcp.yml} (93%) delete mode 100644 roles/matrix-dynamic-dns/templates/ddclient.j2 create mode 100644 roles/matrix-dynamic-dns/templates/systemd/matrix-dynamic-dns.service.j2 diff --git a/roles/matrix-dynamic-dns/defaults/main.yml b/roles/matrix-dynamic-dns/defaults/main.yml index a0afc99ea..c24908377 100644 --- a/roles/matrix-dynamic-dns/defaults/main.yml +++ b/roles/matrix-dynamic-dns/defaults/main.yml @@ -1,14 +1,43 @@ # Whether dynamic dns is enabled -matrix_dynamic_dns_enabled: true +matrix_dynamic_dns_enabled: false # Allowed values: 'daemon', 'dhcp' -matrix_dynamic_dns_mode: 'dhcp' - -# The DNS provider domain -matrix_dynamic_dns_provider: 'domains.google.com' - -# The dynamic dns protocol -matrix_dynamic_dns_protocol: 'dyndns2' +matrix_dynamic_dns_mode: 'daemon' # The dynamic dns daemon interval matrix_dynamic_dns_daemon_interval: '300' + +# The docker container to use when in daemon mode +matrix_dynamic_dns_docker_image: 'linuxserver/ddclient' + +# The image to force pull +matrix_dynamic_dns_docker_image_force_pull: "{{ matrix_dynamic_dns_docker_image.endswith(':latest') }}" + +# List of extra arguments to pass to the ontainer daemon mode +matrix_dynamic_dns_container_extra_arguments: [] + +# List of wanted services when running in daemon mode +matrix_dynamic_dns_systemd_wanted_services_list: [] + +# List of required services when running in daemon mode +matrix_dynamic_dns_systemd_required_services_list: ['docker.service'] + +# Build the container from source when running in daemon mode +matrix_dynamic_dns_container_image_self_build: false + +# Config paths +matrix_dynamic_dns_base_path: "{{ matrix_base_data_path }}/dynamic-dns" +matrix_dynamic_dns_config_path: "{{ matrix_dynamic_dns_base_path }}/config" +matrix_dynamic_dns_docker_src_files_path: "{{ matrix_dynamic_dns_base_path }}/docker-src" + +# Config options +matrix_dynamic_dns_use: "web" +matrix_dynamic_dns_static: false +matrix_dynamic_dns_custom: false +matrix_dynamic_dns_zone: "" +matrix_dynamic_dns_ttl: "" +matrix_dynamic_dns_mx: "" +matrix_dynamic_dns_wildcard: false +matrix_dynamic_dns_protocol: 'dyndns2' +matrix_dynamic_dns_provider: 'domains.google.com' +matrix_dynamic_dns_domain: '{{ matrix_domain }}' diff --git a/roles/matrix-dynamic-dns/tasks/init.yml b/roles/matrix-dynamic-dns/tasks/init.yml index 97f5eaecf..2954ac9a7 100644 --- a/roles/matrix-dynamic-dns/tasks/init.yml +++ b/roles/matrix-dynamic-dns/tasks/init.yml @@ -1,3 +1,7 @@ - set_fact: matrix_systemd_services_list: "{{ matrix_systemd_services_list + ['ddclient'] }}" - when: "matrix_dynamic_dns_enabled|bool" + when: "matrix_dynamic_dns_enabled|bool and matrix_dynamic_dns_mode == 'dhcp'" + +- set_fact: + matrix_systemd_services_list: "{{ matrix_systemd_services_list + ['matrix-dynamic-dns'] }}" + when: "matrix_dynamic_dns_enabled|bool and matrix_dynamic_dns_mode == 'daemon'" diff --git a/roles/matrix-dynamic-dns/tasks/install_daemon.yml b/roles/matrix-dynamic-dns/tasks/install_daemon.yml new file mode 100644 index 000000000..816dc7c39 --- /dev/null +++ b/roles/matrix-dynamic-dns/tasks/install_daemon.yml @@ -0,0 +1,59 @@ +--- + +- name: Ensure Dynamic DNS image is pulled + docker_image: + name: "{{ matrix_dynamic_dns_docker_image }}" + source: "{{ 'pull' if ansible_version.major > 2 or ansible_version.minor > 7 else omit }}" + force_source: "{{ matrix_dynamic_dns_docker_image_force_pull if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}" + force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else matrix_dynamic_dns_docker_image_force_pull }}" + when: matrix_dynamic_dns_enabled|bool and not matrix_dynamic_dns_container_image_self_build + +- name: Ensure Dynamic DNS paths exist + file: + path: "{{ item.path }}" + state: directory + mode: 0750 + owner: "{{ matrix_user_username }}" + group: "{{ matrix_user_groupname }}" + with_items: + - { path: "{{ matrix_dynamic_dns_base_path }}", when: true } + - { path: "{{ matrix_dynamic_dns_config_path }}", when: true } + - { path: "{{ matrix_dynamic_dns_docker_src_files_path }}", when: "{{ matrix_dynamic_dns_container_image_self_build }}" } + when: matrix_dynamic_dns_enabled|bool and item.when|bool + +- name: Ensure Dynamic DNS repository is present on self build + git: + repo: https://github.com/linuxserver/docker-ddclient.git + dest: "{{ matrix_dynamic_dns_docker_src_files_path }}" + force: "yes" + when: "matrix_dynamic_dns_enabled|bool and matrix_dynamic_dns_container_image_self_build" + +- name: Ensure Dynamic DNS Docker image is built + docker_image: + name: "{{ matrix_dynamic_dns_docker_image }}" + source: build + build: + dockerfile: Dockerfile + path: "{{ matrix_dynamic_dns_docker_src_files_path }}" + pull: yes + when: "matrix_dynamic_dns_enabled|bool and matrix_dynamic_dns_container_image_self_build" + +- name: Ensure Dynamic DNS ddclient.conf installed + template: + src: "{{ role_path }}/templates/ddclient.conf.j2" + dest: "{{ matrix_dynamic_dns_config_path }}/ddclient.conf" + mode: 0644 + owner: "{{ matrix_user_username }}" + group: "{{ matrix_user_groupname }}" + +- name: Ensure matrix-dynamic-dns.service installed + template: + src: "{{ role_path }}/templates/systemd/matrix-dynamic-dns.service.j2" + dest: "/etc/systemd/system/matrix-dynamic-dns.service" + mode: 0644 + register: matrix_dynamic_dns_systemd_service_result + +- name: Ensure systemd reloaded after matrix-dynamic-dns.service installation + service: + daemon_reload: yes + when: "matrix_dynamic_dns_systemd_service_result.changed" diff --git a/roles/matrix-dynamic-dns/tasks/install.yml b/roles/matrix-dynamic-dns/tasks/install_dhcp.yml similarity index 55% rename from roles/matrix-dynamic-dns/tasks/install.yml rename to roles/matrix-dynamic-dns/tasks/install_dhcp.yml index 0948e79dd..cb340686c 100644 --- a/roles/matrix-dynamic-dns/tasks/install.yml +++ b/roles/matrix-dynamic-dns/tasks/install_dhcp.yml @@ -5,19 +5,21 @@ src: "{{ role_path }}/templates/ddclient.conf.j2" dest: "/etc/ddclient.conf" mode: 0600 - register: matrix_dynamic_dns_ddclient_domain_config - name: Ensure ddclient client config directory exists file: path: "/etc/default" state: directory mode: 0700 - owner: "{{ user_username }}" - group: "{{ user_groupname }}" + owner: "{{ matrix_user_username }}" + group: "{{ matrix_user_groupname }}" - name: Ensure ddclient client config exists - template: - src: "{{ role_path }}/templates/ddclient.j2" + copy: + content: "run_dhclient=\"true\"\nrun_ipup=\"false\"\nrun_daemon=\"false\"" dest: "/etc/default/ddclient" mode: 0600 - register: matrix_dynamic_dns_ddclient_client_config + owner: "{{ matrix_user_username }}" + group: "{{ matrix_user_groupname }}" + +- import_tasks: "{{ role_path }}/tasks/platform/main.yml" diff --git a/roles/matrix-dynamic-dns/tasks/main.yml b/roles/matrix-dynamic-dns/tasks/main.yml index 7646dd139..2d999568a 100644 --- a/roles/matrix-dynamic-dns/tasks/main.yml +++ b/roles/matrix-dynamic-dns/tasks/main.yml @@ -8,20 +8,26 @@ - setup-all - setup-dynamic-dns -- import_tasks: "{{ role_path }}/tasks/install.yml" - when: "run_setup|bool and matrix_dynamic_dns_enabled|bool" +- import_tasks: "{{ role_path }}/tasks/install_dhcp.yml" + when: "run_setup|bool and matrix_dynamic_dns_enabled|bool and matrix_dynamic_dns_mode == 'dhcp'" tags: - setup-all - setup-dynamic-dns -- import_tasks: "{{ role_path }}/tasks/platform/main.yml" - when: "run_setup|bool" +- import_tasks: "{{ role_path }}/tasks/uninstall_dhcp.yml" + when: "run_setup|bool and not matrix_dynamic_dns_enabled|bool and matrix_dynamic_dns_mode == 'dhcp'" tags: - setup-all - setup-dynamic-dns -- import_tasks: "{{ role_path }}/tasks/uninstall.yml" - when: "run_setup|bool and not matrix_dynamic_dns_enabled|bool" +- import_tasks: "{{ role_path }}/tasks/install_daemon.yml" + when: "run_setup|bool and matrix_dynamic_dns_enabled|bool and matrix_dynamic_dns_mode == 'daemon'" + tags: + - setup-all + - setup-dynamic-dns + +- import_tasks: "{{ role_path }}/tasks/uninstall_daemon.yml" + when: "run_setup|bool and not matrix_dynamic_dns_enabled|bool and matrix_dynamic_dns_mode == 'daemon'" tags: - setup-all - setup-dynamic-dns diff --git a/roles/matrix-dynamic-dns/tasks/uninstall_daemon.yml b/roles/matrix-dynamic-dns/tasks/uninstall_daemon.yml new file mode 100644 index 000000000..8480f3c31 --- /dev/null +++ b/roles/matrix-dynamic-dns/tasks/uninstall_daemon.yml @@ -0,0 +1,24 @@ +--- + +- name: Check existence of matrix-dynamic-dns service + stat: + path: "{{ systemd_path }}m/matrix-dynamic-dns.service" + register: matrix_dynamic_dns_service_stat + +- name: Ensure matrix-dynamic-dns is stopped + service: + name: matrix-dynamic-dns + state: stopped + daemon_reload: yes + when: "matrix_dynamic_dns_service_stat.stat.exists" + +- name: Ensure matrix-dynamic-dns.service doesn't exist + file: + path: "{{ systemd_path }}m/matrix-dynamic-dns.service" + state: absent + when: "matrix_dynamic_dns_service_stat.stat.exists" + +- name: Ensure systemd reloaded after matrix-dynamic-dns.service removal + service: + daemon_reload: yes + when: "matrix_dynamic_dns_service_stat.stat.exists" diff --git a/roles/matrix-dynamic-dns/tasks/uninstall.yml b/roles/matrix-dynamic-dns/tasks/uninstall_dhcp.yml similarity index 93% rename from roles/matrix-dynamic-dns/tasks/uninstall.yml rename to roles/matrix-dynamic-dns/tasks/uninstall_dhcp.yml index 27604585c..09018f680 100644 --- a/roles/matrix-dynamic-dns/tasks/uninstall.yml +++ b/roles/matrix-dynamic-dns/tasks/uninstall_dhcp.yml @@ -1,5 +1,7 @@ --- +- import_tasks: "{{ role_path }}/tasks/platform/main.yml" + - name: Check existence of ddclient.service stat: path: "{{ systemd_path }}/ddclient.service" @@ -12,11 +14,6 @@ daemon_reload: yes when: "matrix_dynamic_dns_ddclient_service_stat.stat.exists" -- name: Ensure systemd reloaded after ddclient.service removal - service: - daemon_reload: yes - when: "matrix_dynamic_dns_ddclient_service_stat.stat.exists" - - name: Ensure ddclient.service doesn't exist file: path: "{{ systemd_path }}/ddclient.service" @@ -29,3 +26,8 @@ - "etc/ddclient.conf" - "etc/default/ddclient" state: absent + +- name: Ensure systemd reloaded after ddclient.service removal + service: + daemon_reload: yes + when: "matrix_dynamic_dns_ddclient_service_stat.stat.exists" diff --git a/roles/matrix-dynamic-dns/tasks/validate_config.yml b/roles/matrix-dynamic-dns/tasks/validate_config.yml index bb351e49d..650f9b709 100644 --- a/roles/matrix-dynamic-dns/tasks/validate_config.yml +++ b/roles/matrix-dynamic-dns/tasks/validate_config.yml @@ -6,8 +6,6 @@ You need to define a required configuration setting (`{{ item }}`). when: "vars[item] == ''" with_items: - - "matrix_dynamic_dns_username" - - "matrix_dynamic_dns_password" - "matrix_domain" - "matrix_dynamic_dns_provider" - "matrix_dynamic_dns_mode" @@ -15,5 +13,5 @@ - name: Fail if dynamic dns mode is incorrect fail: msg: >- - matrix_dynamic_dns_mode needs to be set to 'daemon' or 'startup' + matrix_dynamic_dns_mode needs to be set to 'daemon' or 'dhcp' when: "matrix_dynamic_dns_enabled and matrix_dynamic_dns_mode != 'daemon' and matrix_dynamic_dns_mode != 'dhcp'" diff --git a/roles/matrix-dynamic-dns/templates/ddclient.conf.j2 b/roles/matrix-dynamic-dns/templates/ddclient.conf.j2 index 6d8736884..ffbf4c05c 100644 --- a/roles/matrix-dynamic-dns/templates/ddclient.conf.j2 +++ b/roles/matrix-dynamic-dns/templates/ddclient.conf.j2 @@ -1,7 +1,17 @@ -protocol={{ matrix_dynamic_dns_protocol }} -use=web +{% if matrix_dynamic_dns_mode == "daemon" %}} +daemon={{ matrix_dynamic_dns_daemon_interval }} +syslog=no +pid=/var/run/ddclient/ddclient.pid {% endif %} ssl=yes -server={{ matrix_dynamic_dns_provider }} -login='{{ matrix_dynamic_dns_username }}' -password='{{ matrix_dynamic_dns_password }}' -{{ matrix_domain }} +use={{ matrix_dynamic_dns_use }} +protocol={{ matrix_dynamic_dns_protocol }} +server={{ matrix_dynamic_dns_provider }} {% if matrix_dynamic_dns_username %} +login='{{ matrix_dynamic_dns_username }}' {% endif %} {% if matrix_dynamic_dns_username %} +password='{{ matrix_dynamic_dns_password }}' {% endif %} {% if matrix_dynamic_dns_static %} +static=yes {% endif %} {% if matrix_dynamic_dns_custom %} +custom=yes {% endif %} {% if matrix_dynamic_dns_zone %} +zone={{ matrix_dynamic_dns_zone }} {% endif %} {% if matrix_dynamic_dns_ttl %} +ttl={{ matrix_dynamic_dns_ttl }} {% endif %} {% if matrix_dynamic_dns_mx %} +mx={{ matrix_dynamic_dns_mx }} {% endif %} {% if matrix_dynamic_dns_wildcard %} +wildcard=yes {% endif %} +{{ matrix_dynamic_dns_domain }} diff --git a/roles/matrix-dynamic-dns/templates/ddclient.j2 b/roles/matrix-dynamic-dns/templates/ddclient.j2 deleted file mode 100644 index eb5d053d6..000000000 --- a/roles/matrix-dynamic-dns/templates/ddclient.j2 +++ /dev/null @@ -1,4 +0,0 @@ -run_dhclient="{{ (matrix_dynamic_dns_mode == 'dhcp') | lower }}" -run_ipup="false" -run_daemon="{{ (matrix_dynamic_dns_mode == 'daemon') | lower }}" -daemon_interval="{{ matrix_dynamic_dns_daemon_interval }}" diff --git a/roles/matrix-dynamic-dns/templates/systemd/matrix-dynamic-dns.service.j2 b/roles/matrix-dynamic-dns/templates/systemd/matrix-dynamic-dns.service.j2 new file mode 100644 index 000000000..9f866e1ee --- /dev/null +++ b/roles/matrix-dynamic-dns/templates/systemd/matrix-dynamic-dns.service.j2 @@ -0,0 +1,41 @@ +#jinja2: lstrip_blocks: "True" +[Unit] +Description=Matrix Dynamic DNS +{% for service in matrix_dynamic_dns_systemd_required_services_list %} +Requires={{ service }} +After={{ service }} +{% endfor %} +{% for service in matrix_dynamic_dns_systemd_wanted_services_list %} +Wants={{ service }} +{% endfor %} + +[Service] +Type=simple +ExecStartPre=-{{ matrix_host_command_docker }} kill matrix-dynamic-dns +ExecStartPre=-{{ matrix_host_command_docker }} rm matrix-dynamic-dns + +# Intentional delay, so that the homeserver (we likely depend on) can manage to start. +ExecStartPre={{ matrix_host_command_sleep }} 5 + +ExecStart={{ matrix_host_command_docker }} run --rm --name matrix-dynamic-dns \ + --log-driver=none \ + --user={{ matrix_user_uid }}:{{ matrix_user_gid }} \ + --cap-drop=ALL \ + --network={{ matrix_docker_network }} \ + -e PUID={{ matrix_user_uid }} \ + -e PGID={{ matrix_user_gid }} \ + -e CONFIG_PATH=/config/config.yaml \ + -v {{ matrix_dynamic_dns_config_path }}:/config:z \ + {% for arg in matrix_dynamic_dns_container_extra_arguments %} + {{ arg }} \ + {% endfor %} + {{ matrix_dynamic_dns_docker_image }} + +ExecStop=-{{ matrix_host_command_docker }} kill matrix-dynamic-dns +ExecStop=-{{ matrix_host_command_docker }} rm matrix-dynamic-dns +Restart=always +RestartSec=30 +SyslogIdentifier=matrix-dynamic-dns + +[Install] +WantedBy=multi-user.target diff --git a/setup.yml b/setup.yml index f07f02789..a1f4f9ab6 100755 --- a/setup.yml +++ b/setup.yml @@ -5,7 +5,7 @@ roles: - matrix-base - - dynamic-dns + - matrix-dynamic-dns - matrix-mailer - matrix-postgres - matrix-corporal From 806f98447c771adaf4fa027346e5df8cd32c15c9 Mon Sep 17 00:00:00 2001 From: Scott Crossen Date: Fri, 16 Oct 2020 21:26:58 -0700 Subject: [PATCH 04/42] Removed directory creation --- roles/matrix-dynamic-dns/tasks/install_dhcp.yml | 8 -------- 1 file changed, 8 deletions(-) diff --git a/roles/matrix-dynamic-dns/tasks/install_dhcp.yml b/roles/matrix-dynamic-dns/tasks/install_dhcp.yml index cb340686c..31f881783 100644 --- a/roles/matrix-dynamic-dns/tasks/install_dhcp.yml +++ b/roles/matrix-dynamic-dns/tasks/install_dhcp.yml @@ -6,14 +6,6 @@ dest: "/etc/ddclient.conf" mode: 0600 -- name: Ensure ddclient client config directory exists - file: - path: "/etc/default" - state: directory - mode: 0700 - owner: "{{ matrix_user_username }}" - group: "{{ matrix_user_groupname }}" - - name: Ensure ddclient client config exists copy: content: "run_dhclient=\"true\"\nrun_ipup=\"false\"\nrun_daemon=\"false\"" From 8e6d7d9022711154929d538ca7b912f2d76b1fbb Mon Sep 17 00:00:00 2001 From: Scott Crossen Date: Fri, 16 Oct 2020 21:28:43 -0700 Subject: [PATCH 05/42] changed domain naming --- docs/configuring-playbook-budget-builds.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/configuring-playbook-budget-builds.md b/docs/configuring-playbook-budget-builds.md index 0fb738356..318c3c0cb 100644 --- a/docs/configuring-playbook-budget-builds.md +++ b/docs/configuring-playbook-budget-builds.md @@ -6,7 +6,7 @@ Most cloud providers / ISPs will charge you extra for a static IP address. If yo not hosting a highly reliable homeserver you can workaround this via dynamic DNS. To set this up, you'll need to get the username/password from your DNS provider. For google domains, this process is described [here](https://support.google.com/domains/answer/6147083). -After you've gotten the proper credentials you can add the following config to your `host-vars`: +After you've gotten the proper credentials you can add the following config to your inventory/host_vars/matrix.DOMAIN/vars.yml: ``` matrix_dynamic_dns_username: XXXXXXXXXXXXXXXX From de1511b4bbf2f6ee1924a3796eee5d66933039c0 Mon Sep 17 00:00:00 2001 From: Scott Crossen Date: Fri, 16 Oct 2020 21:31:07 -0700 Subject: [PATCH 06/42] Fixed valdiation --- roles/matrix-dynamic-dns/tasks/validate_config.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/roles/matrix-dynamic-dns/tasks/validate_config.yml b/roles/matrix-dynamic-dns/tasks/validate_config.yml index 650f9b709..61a8ea236 100644 --- a/roles/matrix-dynamic-dns/tasks/validate_config.yml +++ b/roles/matrix-dynamic-dns/tasks/validate_config.yml @@ -6,7 +6,7 @@ You need to define a required configuration setting (`{{ item }}`). when: "vars[item] == ''" with_items: - - "matrix_domain" + - "matrix_dynamic_dns_domain" - "matrix_dynamic_dns_provider" - "matrix_dynamic_dns_mode" From 19721be8b11ef55964cd2255617b869e949419a5 Mon Sep 17 00:00:00 2001 From: Scott Crossen Date: Sun, 18 Oct 2020 21:05:23 -0700 Subject: [PATCH 07/42] removed dhcp option --- roles/matrix-dynamic-dns/defaults/main.yml | 13 +++----- roles/matrix-dynamic-dns/tasks/init.yml | 6 +--- .../tasks/{install_daemon.yml => install.yml} | 0 .../matrix-dynamic-dns/tasks/install_dhcp.yml | 17 ---------- roles/matrix-dynamic-dns/tasks/main.yml | 20 +++-------- .../{uninstall_daemon.yml => uninstall.yml} | 0 .../tasks/uninstall_dhcp.yml | 33 ------------------- .../tasks/validate_config.yml | 7 ---- .../templates/ddclient.conf.j2 | 3 +- 9 files changed, 11 insertions(+), 88 deletions(-) rename roles/matrix-dynamic-dns/tasks/{install_daemon.yml => install.yml} (100%) delete mode 100644 roles/matrix-dynamic-dns/tasks/install_dhcp.yml rename roles/matrix-dynamic-dns/tasks/{uninstall_daemon.yml => uninstall.yml} (100%) delete mode 100644 roles/matrix-dynamic-dns/tasks/uninstall_dhcp.yml diff --git a/roles/matrix-dynamic-dns/defaults/main.yml b/roles/matrix-dynamic-dns/defaults/main.yml index c24908377..e57b47da4 100644 --- a/roles/matrix-dynamic-dns/defaults/main.yml +++ b/roles/matrix-dynamic-dns/defaults/main.yml @@ -1,28 +1,25 @@ # Whether dynamic dns is enabled matrix_dynamic_dns_enabled: false -# Allowed values: 'daemon', 'dhcp' -matrix_dynamic_dns_mode: 'daemon' - # The dynamic dns daemon interval matrix_dynamic_dns_daemon_interval: '300' -# The docker container to use when in daemon mode +# The docker container to use when in mode matrix_dynamic_dns_docker_image: 'linuxserver/ddclient' # The image to force pull matrix_dynamic_dns_docker_image_force_pull: "{{ matrix_dynamic_dns_docker_image.endswith(':latest') }}" -# List of extra arguments to pass to the ontainer daemon mode +# List of extra arguments to pass to the ontainer mode matrix_dynamic_dns_container_extra_arguments: [] -# List of wanted services when running in daemon mode +# List of wanted services when running in mode matrix_dynamic_dns_systemd_wanted_services_list: [] -# List of required services when running in daemon mode +# List of required services when running in mode matrix_dynamic_dns_systemd_required_services_list: ['docker.service'] -# Build the container from source when running in daemon mode +# Build the container from source when running in mode matrix_dynamic_dns_container_image_self_build: false # Config paths diff --git a/roles/matrix-dynamic-dns/tasks/init.yml b/roles/matrix-dynamic-dns/tasks/init.yml index 2954ac9a7..7b87fdb13 100644 --- a/roles/matrix-dynamic-dns/tasks/init.yml +++ b/roles/matrix-dynamic-dns/tasks/init.yml @@ -1,7 +1,3 @@ -- set_fact: - matrix_systemd_services_list: "{{ matrix_systemd_services_list + ['ddclient'] }}" - when: "matrix_dynamic_dns_enabled|bool and matrix_dynamic_dns_mode == 'dhcp'" - - set_fact: matrix_systemd_services_list: "{{ matrix_systemd_services_list + ['matrix-dynamic-dns'] }}" - when: "matrix_dynamic_dns_enabled|bool and matrix_dynamic_dns_mode == 'daemon'" + when: "matrix_dynamic_dns_enabled|bool" diff --git a/roles/matrix-dynamic-dns/tasks/install_daemon.yml b/roles/matrix-dynamic-dns/tasks/install.yml similarity index 100% rename from roles/matrix-dynamic-dns/tasks/install_daemon.yml rename to roles/matrix-dynamic-dns/tasks/install.yml diff --git a/roles/matrix-dynamic-dns/tasks/install_dhcp.yml b/roles/matrix-dynamic-dns/tasks/install_dhcp.yml deleted file mode 100644 index 31f881783..000000000 --- a/roles/matrix-dynamic-dns/tasks/install_dhcp.yml +++ /dev/null @@ -1,17 +0,0 @@ ---- - -- name: Ensure ddclient domain config exists - template: - src: "{{ role_path }}/templates/ddclient.conf.j2" - dest: "/etc/ddclient.conf" - mode: 0600 - -- name: Ensure ddclient client config exists - copy: - content: "run_dhclient=\"true\"\nrun_ipup=\"false\"\nrun_daemon=\"false\"" - dest: "/etc/default/ddclient" - mode: 0600 - owner: "{{ matrix_user_username }}" - group: "{{ matrix_user_groupname }}" - -- import_tasks: "{{ role_path }}/tasks/platform/main.yml" diff --git a/roles/matrix-dynamic-dns/tasks/main.yml b/roles/matrix-dynamic-dns/tasks/main.yml index 2d999568a..f9aaab8f5 100644 --- a/roles/matrix-dynamic-dns/tasks/main.yml +++ b/roles/matrix-dynamic-dns/tasks/main.yml @@ -8,26 +8,14 @@ - setup-all - setup-dynamic-dns -- import_tasks: "{{ role_path }}/tasks/install_dhcp.yml" - when: "run_setup|bool and matrix_dynamic_dns_enabled|bool and matrix_dynamic_dns_mode == 'dhcp'" +- import_tasks: "{{ role_path }}/tasks/install.yml" + when: "run_setup|bool and matrix_dynamic_dns_enabled|bool" tags: - setup-all - setup-dynamic-dns -- import_tasks: "{{ role_path }}/tasks/uninstall_dhcp.yml" - when: "run_setup|bool and not matrix_dynamic_dns_enabled|bool and matrix_dynamic_dns_mode == 'dhcp'" - tags: - - setup-all - - setup-dynamic-dns - -- import_tasks: "{{ role_path }}/tasks/install_daemon.yml" - when: "run_setup|bool and matrix_dynamic_dns_enabled|bool and matrix_dynamic_dns_mode == 'daemon'" - tags: - - setup-all - - setup-dynamic-dns - -- import_tasks: "{{ role_path }}/tasks/uninstall_daemon.yml" - when: "run_setup|bool and not matrix_dynamic_dns_enabled|bool and matrix_dynamic_dns_mode == 'daemon'" +- import_tasks: "{{ role_path }}/tasks/uninstall.yml" + when: "run_setup|bool and not matrix_dynamic_dns_enabled|bool" tags: - setup-all - setup-dynamic-dns diff --git a/roles/matrix-dynamic-dns/tasks/uninstall_daemon.yml b/roles/matrix-dynamic-dns/tasks/uninstall.yml similarity index 100% rename from roles/matrix-dynamic-dns/tasks/uninstall_daemon.yml rename to roles/matrix-dynamic-dns/tasks/uninstall.yml diff --git a/roles/matrix-dynamic-dns/tasks/uninstall_dhcp.yml b/roles/matrix-dynamic-dns/tasks/uninstall_dhcp.yml deleted file mode 100644 index 09018f680..000000000 --- a/roles/matrix-dynamic-dns/tasks/uninstall_dhcp.yml +++ /dev/null @@ -1,33 +0,0 @@ ---- - -- import_tasks: "{{ role_path }}/tasks/platform/main.yml" - -- name: Check existence of ddclient.service - stat: - path: "{{ systemd_path }}/ddclient.service" - register: matrix_dynamic_dns_ddclient_service_stat - -- name: Ensure ddclient.service is stopped - service: - name: dynamic-dns - state: stopped - daemon_reload: yes - when: "matrix_dynamic_dns_ddclient_service_stat.stat.exists" - -- name: Ensure ddclient.service doesn't exist - file: - path: "{{ systemd_path }}/ddclient.service" - state: absent - when: "matrix_dynamic_dns_ddclient_service_stat.stat.exists" - -- name: Ensure ddclient configuration files don't exist - file: - path: - - "etc/ddclient.conf" - - "etc/default/ddclient" - state: absent - -- name: Ensure systemd reloaded after ddclient.service removal - service: - daemon_reload: yes - when: "matrix_dynamic_dns_ddclient_service_stat.stat.exists" diff --git a/roles/matrix-dynamic-dns/tasks/validate_config.yml b/roles/matrix-dynamic-dns/tasks/validate_config.yml index 61a8ea236..2895f4071 100644 --- a/roles/matrix-dynamic-dns/tasks/validate_config.yml +++ b/roles/matrix-dynamic-dns/tasks/validate_config.yml @@ -8,10 +8,3 @@ with_items: - "matrix_dynamic_dns_domain" - "matrix_dynamic_dns_provider" - - "matrix_dynamic_dns_mode" - -- name: Fail if dynamic dns mode is incorrect - fail: - msg: >- - matrix_dynamic_dns_mode needs to be set to 'daemon' or 'dhcp' - when: "matrix_dynamic_dns_enabled and matrix_dynamic_dns_mode != 'daemon' and matrix_dynamic_dns_mode != 'dhcp'" diff --git a/roles/matrix-dynamic-dns/templates/ddclient.conf.j2 b/roles/matrix-dynamic-dns/templates/ddclient.conf.j2 index ffbf4c05c..651712dbf 100644 --- a/roles/matrix-dynamic-dns/templates/ddclient.conf.j2 +++ b/roles/matrix-dynamic-dns/templates/ddclient.conf.j2 @@ -1,7 +1,6 @@ -{% if matrix_dynamic_dns_mode == "daemon" %}} daemon={{ matrix_dynamic_dns_daemon_interval }} syslog=no -pid=/var/run/ddclient/ddclient.pid {% endif %} +pid=/var/run/ddclient/ddclient.pid ssl=yes use={{ matrix_dynamic_dns_use }} protocol={{ matrix_dynamic_dns_protocol }} From e7d79a95dc9a20948ea439cc308e185057fafd3a Mon Sep 17 00:00:00 2001 From: Scott Crossen Date: Mon, 19 Oct 2020 10:46:02 -0700 Subject: [PATCH 08/42] removed platform-specific stuff --- .../tasks/platform/archlinux.yml | 15 ------------- .../tasks/platform/centos.yml | 22 ------------------- .../tasks/platform/debian.yml | 17 -------------- .../tasks/platform/main.yml | 11 ---------- 4 files changed, 65 deletions(-) delete mode 100644 roles/matrix-dynamic-dns/tasks/platform/archlinux.yml delete mode 100644 roles/matrix-dynamic-dns/tasks/platform/centos.yml delete mode 100644 roles/matrix-dynamic-dns/tasks/platform/debian.yml delete mode 100644 roles/matrix-dynamic-dns/tasks/platform/main.yml diff --git a/roles/matrix-dynamic-dns/tasks/platform/archlinux.yml b/roles/matrix-dynamic-dns/tasks/platform/archlinux.yml deleted file mode 100644 index 10e208021..000000000 --- a/roles/matrix-dynamic-dns/tasks/platform/archlinux.yml +++ /dev/null @@ -1,15 +0,0 @@ ---- - -- name: Ensure ddclient is installed - pacman: - name: ddclient - state: latest - when: "run_setup|bool and matrix_dynamic_dns_enabled|bool" - -- name: Ensure ddclient is uninstalled - pacman: - name: ddclient - state: absent - update_cache: true - become: true - when: "run_setup|bool and not matrix_dynamic_dns_enabled|bool" diff --git a/roles/matrix-dynamic-dns/tasks/platform/centos.yml b/roles/matrix-dynamic-dns/tasks/platform/centos.yml deleted file mode 100644 index 7375ad32b..000000000 --- a/roles/matrix-dynamic-dns/tasks/platform/centos.yml +++ /dev/null @@ -1,22 +0,0 @@ ---- - -- name: Ensure yum packages are installed - yum: - name: epel-release - state: latest - update_cache: yes - when: "run_setup|bool and matrix_dynamic_dns_enabled|bool" - -- name: Ensure ddclient is installed - yum: - name: ddclient - state: latest - when: "run_setup|bool and matrix_dynamic_dns_enabled|bool" - -- name: Ensure ddclient is uninstalled - yum: - name: - - ddclient - - epel-release - state: absent - when: "run_setup|bool and not matrix_dynamic_dns_enabled|bool" diff --git a/roles/matrix-dynamic-dns/tasks/platform/debian.yml b/roles/matrix-dynamic-dns/tasks/platform/debian.yml deleted file mode 100644 index c41dbaf99..000000000 --- a/roles/matrix-dynamic-dns/tasks/platform/debian.yml +++ /dev/null @@ -1,17 +0,0 @@ ---- - -- name: Ensure ddclient is installed - apt: - name: ddclient - state: present - update_cache: true - become: true - when: "run_setup|bool and matrix_dynamic_dns_enabled|bool" - -- name: Ensure ddclient is uninstalled - apt: - name: ddclient - state: absent - update_cache: true - become: true - when: "run_setup|bool and not matrix_dynamic_dns_enabled|bool" diff --git a/roles/matrix-dynamic-dns/tasks/platform/main.yml b/roles/matrix-dynamic-dns/tasks/platform/main.yml deleted file mode 100644 index ca9737493..000000000 --- a/roles/matrix-dynamic-dns/tasks/platform/main.yml +++ /dev/null @@ -1,11 +0,0 @@ ---- - -- include_tasks: "{{ role_path }}/tasks/platform/centos.yml" - when: ansible_distribution == 'CentOS' - -# The instructions are the same for Debian, Ubuntu, and Raspbian -- include_tasks: "{{ role_path }}/tasks/platform/debian.yml" - when: ansible_distribution == 'Debian' - -- include_tasks: "{{ role_path }}/tasks/platform/archlinux.yml" - when: ansible_distribution == 'Archlinux' From efeb651789871128eaa6a09706b5cf1999000e3c Mon Sep 17 00:00:00 2001 From: Scott Crossen Date: Mon, 19 Oct 2020 11:25:01 -0700 Subject: [PATCH 09/42] Removed typo --- roles/matrix-dynamic-dns/tasks/uninstall.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/roles/matrix-dynamic-dns/tasks/uninstall.yml b/roles/matrix-dynamic-dns/tasks/uninstall.yml index 8480f3c31..1be0e1906 100644 --- a/roles/matrix-dynamic-dns/tasks/uninstall.yml +++ b/roles/matrix-dynamic-dns/tasks/uninstall.yml @@ -2,7 +2,7 @@ - name: Check existence of matrix-dynamic-dns service stat: - path: "{{ systemd_path }}m/matrix-dynamic-dns.service" + path: "{{ systemd_path }}/matrix-dynamic-dns.service" register: matrix_dynamic_dns_service_stat - name: Ensure matrix-dynamic-dns is stopped @@ -14,7 +14,7 @@ - name: Ensure matrix-dynamic-dns.service doesn't exist file: - path: "{{ systemd_path }}m/matrix-dynamic-dns.service" + path: "{{ systemd_path }}/matrix-dynamic-dns.service" state: absent when: "matrix_dynamic_dns_service_stat.stat.exists" From 94dcceb7b9c77ca5b1be02c53aa9a12e310df5e5 Mon Sep 17 00:00:00 2001 From: Scott Crossen Date: Mon, 19 Oct 2020 11:26:37 -0700 Subject: [PATCH 10/42] removed intentional delay --- .../templates/systemd/matrix-dynamic-dns.service.j2 | 4 ---- 1 file changed, 4 deletions(-) diff --git a/roles/matrix-dynamic-dns/templates/systemd/matrix-dynamic-dns.service.j2 b/roles/matrix-dynamic-dns/templates/systemd/matrix-dynamic-dns.service.j2 index 9f866e1ee..9c11e148b 100644 --- a/roles/matrix-dynamic-dns/templates/systemd/matrix-dynamic-dns.service.j2 +++ b/roles/matrix-dynamic-dns/templates/systemd/matrix-dynamic-dns.service.j2 @@ -13,10 +13,6 @@ Wants={{ service }} Type=simple ExecStartPre=-{{ matrix_host_command_docker }} kill matrix-dynamic-dns ExecStartPre=-{{ matrix_host_command_docker }} rm matrix-dynamic-dns - -# Intentional delay, so that the homeserver (we likely depend on) can manage to start. -ExecStartPre={{ matrix_host_command_sleep }} 5 - ExecStart={{ matrix_host_command_docker }} run --rm --name matrix-dynamic-dns \ --log-driver=none \ --user={{ matrix_user_uid }}:{{ matrix_user_gid }} \ From 1227349d0cd6671df2fbf30fac0193727ec0d928 Mon Sep 17 00:00:00 2001 From: Ivar Troost Date: Sat, 24 Oct 2020 17:03:24 +0200 Subject: [PATCH 11/42] Fix docker mount instruction in documentation The SSL certificates should be accessible to the nginx proxy container, not the synapse container. --- docs/howto-server-delegation.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/howto-server-delegation.md b/docs/howto-server-delegation.md index 5235b843b..1ea1091a2 100644 --- a/docs/howto-server-delegation.md +++ b/docs/howto-server-delegation.md @@ -89,7 +89,7 @@ matrix_nginx_proxy_proxy_matrix_federation_api_ssl_certificate_key: /matrix/ssl/ If your files are not in `/matrix/ssl` but in some other location, you would need to mount them into the container: ```yaml -matrix_synapse_container_extra_arguments: +matrix_nginx_proxy_container_extra_arguments: - "--mount type=bind,src=/some/path/on/the/host,dst=/some/path/inside/the/container,ro" ``` From 63a49bb2dc7780e023b2801a7230cda529b2b3c1 Mon Sep 17 00:00:00 2001 From: Slavi Pantaleev Date: Mon, 26 Oct 2020 10:36:38 +0200 Subject: [PATCH 12/42] Do not expose /_synapse/admin publicly by default Fixes #685 (Github Issue). --- CHANGELOG.md | 16 ++++++++++ examples/apache/matrix-synapse.conf | 2 ++ examples/caddy/matrix-synapse | 8 +++-- roles/matrix-nginx-proxy/defaults/main.yml | 20 +++++++++++++ .../nginx/conf.d/matrix-synapse.conf.j2 | 29 ++++--------------- 5 files changed, 48 insertions(+), 27 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 247e4e149..6b6dd8e54 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,3 +1,19 @@ +# 2020-10-26 + +## (Compatibility Break) /_synapse/admin is no longer publicly exposed by default + +We used to expose the Synapse Admin APIs publicly (at `https://matrix.DOMAIN/_synapse/admin`). +These APIs require authentication with a valid access token, so it's not that big a deal to expose them. + +However, following [official Synapse's reverse-proxying recommendations](https://github.com/matrix-org/synapse/blob/master/docs/reverse_proxy.md#synapse-administration-endpoints), we're no longer exposing `/_synapse/admin` by default. + +If you'd like to restore restore the old behavior and expose `/_synapse/admin` publicly, you can use the following configuration (in your `vars.yml`): + +```yaml +matrix_nginx_proxy_proxy_matrix_client_api_forwarded_location_synapse_admin_api_enabled: true +``` + + # 2020-10-02 ## Minimum Ansible version raised to v2.7.0 diff --git a/examples/apache/matrix-synapse.conf b/examples/apache/matrix-synapse.conf index 3e09121fa..e4266b81f 100644 --- a/examples/apache/matrix-synapse.conf +++ b/examples/apache/matrix-synapse.conf @@ -43,6 +43,8 @@ AllowEncodedSlashes NoDecode ProxyPass /_matrix http://127.0.0.1:8008/_matrix retry=0 nocanon ProxyPassReverse /_matrix http://127.0.0.1:8008/_matrix + ProxyPass /_synapse/client http://127.0.0.1:8008/_synapse/client retry=0 nocanon + ProxyPassReverse /_synapse/client http://127.0.0.1:8008/_synapse/client # Map /.well-known/matrix/client for client discovery Alias /.well-known/matrix/client /matrix/static-files/.well-known/matrix/client diff --git a/examples/caddy/matrix-synapse b/examples/caddy/matrix-synapse index 30f7c5a23..4202c7592 100644 --- a/examples/caddy/matrix-synapse +++ b/examples/caddy/matrix-synapse @@ -21,9 +21,11 @@ https://matrix.DOMAIN { } # Synapse Client<>Server API - proxy / matrix-synapse:8008 { + proxy /_matrix matrix-synapse:8008 { + transparent + except /_matrix/identity/ /_matrix/client/r0/user_directory/search + } + proxy /_synapse/client matrix-synapse:8008 { transparent - except /.well-known/ /_matrix/identity/ /_matrix/client/r0/user_directory/search } - } diff --git a/roles/matrix-nginx-proxy/defaults/main.yml b/roles/matrix-nginx-proxy/defaults/main.yml index 643d723e3..89007a85a 100644 --- a/roles/matrix-nginx-proxy/defaults/main.yml +++ b/roles/matrix-nginx-proxy/defaults/main.yml @@ -149,6 +149,26 @@ matrix_nginx_proxy_proxy_matrix_client_api_addr_sans_container: "127.0.0.1:8008" # This needs to be equal or higher than the maximum upload size accepted by Synapse. matrix_nginx_proxy_proxy_matrix_client_api_client_max_body_size_mb: 25 + +# Tells wheter `/_synapse/client` is forwarded to the Matrix Client API server. +matrix_nginx_proxy_proxy_matrix_client_api_forwarded_location_synapse_client_api_enabled: true + +# Tells wheter `/_synapse/admin` is forwarded to the Matrix Client API server. +# Following these recommendations (https://github.com/matrix-org/synapse/blob/master/docs/reverse_proxy.md), by default, we don't. +matrix_nginx_proxy_proxy_matrix_client_api_forwarded_location_synapse_admin_api_enabled: false + +# `matrix_nginx_proxy_proxy_matrix_client_api_forwarded_location_prefixes` holds +# the location prefixes that get forwarded to the Matrix Client API server. +# These locations get combined into a regex like this `^(/_matrix|/_synapse/client)`. +matrix_nginx_proxy_proxy_matrix_client_api_forwarded_location_prefix_regexes: | + {{ + (['/_matrix']) + + + (['/_synapse/client'] if matrix_nginx_proxy_proxy_matrix_client_api_forwarded_location_synapse_client_api_enabled else []) + + + (['/_synapse/admin'] if matrix_nginx_proxy_proxy_matrix_client_api_forwarded_location_synapse_admin_api_enabled else []) + }} + # Controls whether proxying for the Matrix Federation API should be done. matrix_nginx_proxy_proxy_matrix_federation_api_enabled: false matrix_nginx_proxy_proxy_matrix_federation_api_addr_with_container: "matrix-synapse:8048" diff --git a/roles/matrix-nginx-proxy/templates/nginx/conf.d/matrix-synapse.conf.j2 b/roles/matrix-nginx-proxy/templates/nginx/conf.d/matrix-synapse.conf.j2 index 8fd879586..8bcc9bc6f 100644 --- a/roles/matrix-nginx-proxy/templates/nginx/conf.d/matrix-synapse.conf.j2 +++ b/roles/matrix-nginx-proxy/templates/nginx/conf.d/matrix-synapse.conf.j2 @@ -105,29 +105,6 @@ {{- configuration_block }} {% endfor %} - {# - This handles the Matrix Client API only. - The Matrix Federation API is handled by a separate vhost. - #} - location /_matrix { - {% if matrix_nginx_proxy_enabled %} - {# Use the embedded DNS resolver in Docker containers to discover the service #} - resolver 127.0.0.11 valid=5s; - set $backend "{{ matrix_nginx_proxy_proxy_matrix_client_api_addr_with_container }}"; - proxy_pass http://$backend; - {% else %} - {# Generic configuration for use outside of our container setup #} - proxy_pass http://{{ matrix_nginx_proxy_proxy_matrix_client_api_addr_sans_container }}; - {% endif %} - - proxy_set_header Host $host; - proxy_set_header X-Forwarded-For $remote_addr; - - client_body_buffer_size 25M; - client_max_body_size {{ matrix_nginx_proxy_proxy_matrix_client_api_client_max_body_size_mb }}M; - proxy_max_temp_file_size 0; - } - {% if matrix_nginx_proxy_proxy_synapse_metrics %} location /_synapse/metrics { {% if matrix_nginx_proxy_enabled %} @@ -150,7 +127,11 @@ } {% endif %} - location /_synapse { + {# + This handles the Matrix Client API only. + The Matrix Federation API is handled by a separate vhost. + #} + location ~* ^({{ matrix_nginx_proxy_proxy_matrix_client_api_forwarded_location_prefix_regexes|join('|') }}) { {% if matrix_nginx_proxy_enabled %} {# Use the embedded DNS resolver in Docker containers to discover the service #} resolver 127.0.0.11 valid=5s; From 70f0b97a0aa8adb84833480ec3c53aab51eec349 Mon Sep 17 00:00:00 2001 From: Slavi Pantaleev Date: Tue, 27 Oct 2020 14:24:02 +0200 Subject: [PATCH 13/42] Upgrade Synapse (v1.21.2 -> v1.22.0) --- group_vars/matrix_servers | 2 +- roles/matrix-synapse/defaults/main.yml | 6 +++--- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/group_vars/matrix_servers b/group_vars/matrix_servers index 00cdbdfbb..a817f1e63 100755 --- a/group_vars/matrix_servers +++ b/group_vars/matrix_servers @@ -917,7 +917,7 @@ matrix_client_element_jitsi_preferredDomain: "{{ matrix_server_fqn_jitsi if matr # ###################################################################### -matrix_synapse_container_image_self_build: "{{ matrix_architecture != 'amd64'}}" +matrix_synapse_container_image_self_build: "{{ matrix_architecture not in ['arm32', 'arm64', 'amd64'] }}" # When ma1sd is enabled, we can use it to validate email addresses and phone numbers. # Synapse can validate email addresses by itself as well, but it's probably not what we want by default when we have an identity server. diff --git a/roles/matrix-synapse/defaults/main.yml b/roles/matrix-synapse/defaults/main.yml index fd8eaa528..450a26be2 100644 --- a/roles/matrix-synapse/defaults/main.yml +++ b/roles/matrix-synapse/defaults/main.yml @@ -5,7 +5,7 @@ matrix_synapse_enabled: true matrix_synapse_container_image_self_build: false -matrix_synapse_docker_image: "matrixdotorg/synapse:v1.21.2" +matrix_synapse_docker_image: "matrixdotorg/synapse:v1.22.0" matrix_synapse_docker_image_force_pull: "{{ matrix_synapse_docker_image.endswith(':latest') }}" matrix_synapse_base_path: "{{ matrix_base_data_path }}/synapse" @@ -73,7 +73,7 @@ matrix_synapse_registration_shared_secret: "{{ matrix_synapse_macaroon_secret_ke matrix_synapse_allow_guest_access: false matrix_synapse_form_secret: "{{ matrix_synapse_macaroon_secret_key }}" -matrix_synapse_max_upload_size_mb: 10 +matrix_synapse_max_upload_size_mb: 50 # The tmpfs at /tmp needs to be large enough to handle multiple concurrent file uploads. matrix_synapse_tmp_directory_size_mb: "{{ matrix_synapse_max_upload_size_mb * 50 }}" @@ -349,7 +349,7 @@ matrix_synapse_room_list_publication_rules: room_id: "*" action: allow -matrix_synapse_default_room_version: "5" +matrix_synapse_default_room_version: "6" # Controls the Synapse `spam_checker` setting. # From 7d211b71e2123ba0a62f2264497c6d4696243e61 Mon Sep 17 00:00:00 2001 From: Slavi Pantaleev Date: Tue, 27 Oct 2020 14:30:43 +0200 Subject: [PATCH 14/42] Restore self-building on ARM for Synapse for now While v1.22.0 supposedly has multi-arch Docker images (thanks to https://github.com/matrix-org/synapse/pull/7921), I can't them on Docker Hub yet, so I'm backing out of this change for now and letting people fall back to self-building there. --- group_vars/matrix_servers | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/group_vars/matrix_servers b/group_vars/matrix_servers index a817f1e63..817b4c8f8 100755 --- a/group_vars/matrix_servers +++ b/group_vars/matrix_servers @@ -917,7 +917,7 @@ matrix_client_element_jitsi_preferredDomain: "{{ matrix_server_fqn_jitsi if matr # ###################################################################### -matrix_synapse_container_image_self_build: "{{ matrix_architecture not in ['arm32', 'arm64', 'amd64'] }}" +matrix_synapse_container_image_self_build: "{{ matrix_architecture not in ['amd64'] }}" # When ma1sd is enabled, we can use it to validate email addresses and phone numbers. # Synapse can validate email addresses by itself as well, but it's probably not what we want by default when we have an identity server. From 5a7d26599786cdd075610a130f85556248350035 Mon Sep 17 00:00:00 2001 From: Slavi Pantaleev Date: Tue, 27 Oct 2020 20:33:37 +0200 Subject: [PATCH 15/42] Fix Synapse Admin not working due to unexposed Synapse Admin APIs Regression since 63a49bb2dc7780. Related to #685 (Github Issue). We now automatically expose the APIs when Synapse Admin is enabled. --- docs/configuring-playbook-synapse-admin.md | 2 ++ group_vars/matrix_servers | 2 ++ 2 files changed, 4 insertions(+) diff --git a/docs/configuring-playbook-synapse-admin.md b/docs/configuring-playbook-synapse-admin.md index b3eafaea4..a2f5e6463 100644 --- a/docs/configuring-playbook-synapse-admin.md +++ b/docs/configuring-playbook-synapse-admin.md @@ -15,6 +15,8 @@ Add the following configuration to your `inventory/host_vars/matrix.DOMAIN/vars. matrix_synapse_admin_enabled: true ``` +**Note**: enabling Synapse Admin automatically exposes Synapse's Administration APIs (equivalent to `matrix_nginx_proxy_proxy_matrix_client_api_forwarded_location_synapse_admin_api_enabled: true`). + ## Installing diff --git a/group_vars/matrix_servers b/group_vars/matrix_servers index 817b4c8f8..71a6bc85b 100755 --- a/group_vars/matrix_servers +++ b/group_vars/matrix_servers @@ -769,6 +769,8 @@ matrix_nginx_proxy_proxy_matrix_client_api_addr_with_container: "{{ 'matrix-corp matrix_nginx_proxy_proxy_matrix_client_api_addr_sans_container: "{{ '127.0.0.1:41080' if matrix_corporal_enabled else '127.0.0.1:8008' }}" matrix_nginx_proxy_proxy_matrix_client_api_client_max_body_size_mb: "{{ matrix_synapse_max_upload_size_mb }}" +matrix_nginx_proxy_proxy_matrix_client_api_forwarded_location_synapse_admin_api_enabled: "{{ matrix_synapse_admin_enabled }}" + matrix_nginx_proxy_proxy_matrix_enabled: true matrix_nginx_proxy_proxy_element_enabled: "{{ matrix_client_element_enabled }}" matrix_nginx_proxy_proxy_dimension_enabled: "{{ matrix_dimension_enabled }}" From 67d0f264636c5b7bb67f47698545beca9e85d8b0 Mon Sep 17 00:00:00 2001 From: Slavi Pantaleev Date: Tue, 27 Oct 2020 20:41:52 +0200 Subject: [PATCH 16/42] Improve wording a bit --- docs/configuring-playbook-synapse-admin.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/configuring-playbook-synapse-admin.md b/docs/configuring-playbook-synapse-admin.md index a2f5e6463..68d703052 100644 --- a/docs/configuring-playbook-synapse-admin.md +++ b/docs/configuring-playbook-synapse-admin.md @@ -15,7 +15,7 @@ Add the following configuration to your `inventory/host_vars/matrix.DOMAIN/vars. matrix_synapse_admin_enabled: true ``` -**Note**: enabling Synapse Admin automatically exposes Synapse's Administration APIs (equivalent to `matrix_nginx_proxy_proxy_matrix_client_api_forwarded_location_synapse_admin_api_enabled: true`). +**Note**: Synapse Admin requires Synapse's [Admin APIs](https://github.com/matrix-org/synapse/tree/master/docs/admin_api) to function. Access to them is restricted with a valid access token, so exposing them publicly should not be a real security concern. Still, for additional security, we normally leave them unexposed, following [official Synapse reverse-proxying recommendations](https://github.com/matrix-org/synapse/blob/master/docs/reverse_proxy.md#synapse-administration-endpoints). Because Synapse Admin needs these APIs to function, when installing Synapse Admin, we **automatically** exposes them publicly for you (equivalent to `matrix_nginx_proxy_proxy_matrix_client_api_forwarded_location_synapse_admin_api_enabled: true`). ## Installing From ef07aa8e5df1e8708b6e3a5437570d7677f4cf18 Mon Sep 17 00:00:00 2001 From: Slavi Pantaleev Date: Wed, 28 Oct 2020 09:38:04 +0200 Subject: [PATCH 17/42] Prevent certain nginx location blocks from being ignored The regex introduced in 63a49bb2dc778 seems to take precedence over the bare location blocks, causing a regression. > It is important to understand that, by default, Nginx will serve regular expression matches in preference to prefix matches. > However, it evaluates prefix locations first, allowing for the administer to override this tendency by specifying locations using the = and ^~ modifiers. Source: https://www.digitalocean.com/community/tutorials/understanding-nginx-server-and-location-block-selection-algorithms --- .../templates/nginx/conf.d/matrix-synapse.conf.j2 | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/roles/matrix-nginx-proxy/templates/nginx/conf.d/matrix-synapse.conf.j2 b/roles/matrix-nginx-proxy/templates/nginx/conf.d/matrix-synapse.conf.j2 index 8bcc9bc6f..463aec075 100644 --- a/roles/matrix-nginx-proxy/templates/nginx/conf.d/matrix-synapse.conf.j2 +++ b/roles/matrix-nginx-proxy/templates/nginx/conf.d/matrix-synapse.conf.j2 @@ -34,7 +34,7 @@ {% endif %} {% if matrix_nginx_proxy_proxy_matrix_corporal_api_enabled %} - location /_matrix/corporal { + location ^~ /_matrix/corporal { {% if matrix_nginx_proxy_enabled %} {# Use the embedded DNS resolver in Docker containers to discover the service #} resolver 127.0.0.11 valid=5s; @@ -51,7 +51,7 @@ {% endif %} {% if matrix_nginx_proxy_proxy_matrix_identity_api_enabled %} - location /_matrix/identity { + location ^~ /_matrix/identity { {% if matrix_nginx_proxy_enabled %} {# Use the embedded DNS resolver in Docker containers to discover the service #} resolver 127.0.0.11 valid=5s; @@ -68,7 +68,7 @@ {% endif %} {% if matrix_nginx_proxy_proxy_matrix_user_directory_search_enabled %} - location /_matrix/client/r0/user_directory/search { + location ^~ /_matrix/client/r0/user_directory/search { {% if matrix_nginx_proxy_enabled %} {# Use the embedded DNS resolver in Docker containers to discover the service #} resolver 127.0.0.11 valid=5s; From 4700e803897d2ceb12e328e8dbfa688bb849e0b5 Mon Sep 17 00:00:00 2001 From: Slavi Pantaleev Date: Wed, 28 Oct 2020 10:02:47 +0200 Subject: [PATCH 18/42] Raise standalone default Matrix Client API client_max_body_size We do this to match Synapse's new default "max_upload_size" (50MB). This `matrix_nginx_proxy_proxy_matrix_client_api_client_max_body_size_mb` default value only affects standalone usage of the `matrix-nginx-proxy` role. When the role is used in the context of the playbook, the value is dynamically assigned from `group_vars/matrix_servers`. Somewhat related to #692 (Github Issue). --- roles/matrix-nginx-proxy/defaults/main.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/roles/matrix-nginx-proxy/defaults/main.yml b/roles/matrix-nginx-proxy/defaults/main.yml index 89007a85a..2ce8eb30c 100644 --- a/roles/matrix-nginx-proxy/defaults/main.yml +++ b/roles/matrix-nginx-proxy/defaults/main.yml @@ -147,7 +147,7 @@ matrix_nginx_proxy_proxy_synapse_metrics_basic_auth_key: "" matrix_nginx_proxy_proxy_matrix_client_api_addr_with_container: "matrix-synapse:8008" matrix_nginx_proxy_proxy_matrix_client_api_addr_sans_container: "127.0.0.1:8008" # This needs to be equal or higher than the maximum upload size accepted by Synapse. -matrix_nginx_proxy_proxy_matrix_client_api_client_max_body_size_mb: 25 +matrix_nginx_proxy_proxy_matrix_client_api_client_max_body_size_mb: 50 # Tells wheter `/_synapse/client` is forwarded to the Matrix Client API server. From 9a46647010989a0d8925f771240de9d49692b56b Mon Sep 17 00:00:00 2001 From: Slavi Pantaleev Date: Wed, 28 Oct 2020 10:39:12 +0200 Subject: [PATCH 19/42] Make https://matrix.DOMAIN/ redirect to https://element.DOMAIN/ Fixes #696 (Github Issue) --- CHANGELOG.md | 14 ++++++++++++++ group_vars/matrix_servers | 2 ++ roles/matrix-nginx-proxy/defaults/main.yml | 6 ++++++ .../templates/nginx/conf.d/matrix-synapse.conf.j2 | 6 +++++- 4 files changed, 27 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 6b6dd8e54..089d06508 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,3 +1,17 @@ +# 2020-10-28 + +## (Compatibility Break) https://matrix.DOMAIN/ now redirects to https://element.DOMAIN/ + +Until now, we used to serve a static page coming from Synapse at `https://matrix.DOMAIN/`. This page was not very useful to anyone. + +Since `matrix.DOMAIN` may be accessed by regular users in certain conditions, it's probably better to redirect them to a better place (e.g. to the [Element](docs/configuring-playbook-client-element.md) client). + +If Element is installed (`matrix_client_element_enabled: true`, which it is by default), we now redirect people to it, instead of showing them a Synapse static page. + +If you'd like to control where the redirect goes, use the `matrix_nginx_proxy_proxy_matrix_client_redirect_root_uri_to_domain` variable. +To restore the old behavior of not redirecting anywhere and serving the Synapse static page, set it to an empty value (`matrix_nginx_proxy_proxy_matrix_client_redirect_root_uri_to_domain: ""`). + + # 2020-10-26 ## (Compatibility Break) /_synapse/admin is no longer publicly exposed by default diff --git a/group_vars/matrix_servers b/group_vars/matrix_servers index 71a6bc85b..eabce668c 100755 --- a/group_vars/matrix_servers +++ b/group_vars/matrix_servers @@ -771,6 +771,8 @@ matrix_nginx_proxy_proxy_matrix_client_api_client_max_body_size_mb: "{{ matrix_s matrix_nginx_proxy_proxy_matrix_client_api_forwarded_location_synapse_admin_api_enabled: "{{ matrix_synapse_admin_enabled }}" +matrix_nginx_proxy_proxy_matrix_client_redirect_root_uri_to_domain: "{{ matrix_server_fqn_element if matrix_client_element_enabled else '' }}" + matrix_nginx_proxy_proxy_matrix_enabled: true matrix_nginx_proxy_proxy_element_enabled: "{{ matrix_client_element_enabled }}" matrix_nginx_proxy_proxy_dimension_enabled: "{{ matrix_dimension_enabled }}" diff --git a/roles/matrix-nginx-proxy/defaults/main.yml b/roles/matrix-nginx-proxy/defaults/main.yml index 2ce8eb30c..6d9ff33bd 100644 --- a/roles/matrix-nginx-proxy/defaults/main.yml +++ b/roles/matrix-nginx-proxy/defaults/main.yml @@ -169,6 +169,12 @@ matrix_nginx_proxy_proxy_matrix_client_api_forwarded_location_prefix_regexes: | (['/_synapse/admin'] if matrix_nginx_proxy_proxy_matrix_client_api_forwarded_location_synapse_admin_api_enabled else []) }} +# Specifies where requests for the root URI (`/`) on the `matrix.` domain should be redirected. +# If this has an empty value, they're just passed to the homeserver, which serves a static page. +# If you'd like to make `https://matrix.DOMAIN` redirect to `https://element.DOMAIN` (or something of that sort), specify the domain name here. +# Example value: `element.DOMAIN` (or `{{ matrix_server_fqn_element }}`). +matrix_nginx_proxy_proxy_matrix_client_redirect_root_uri_to_domain: "" + # Controls whether proxying for the Matrix Federation API should be done. matrix_nginx_proxy_proxy_matrix_federation_api_enabled: false matrix_nginx_proxy_proxy_matrix_federation_api_addr_with_container: "matrix-synapse:8048" diff --git a/roles/matrix-nginx-proxy/templates/nginx/conf.d/matrix-synapse.conf.j2 b/roles/matrix-nginx-proxy/templates/nginx/conf.d/matrix-synapse.conf.j2 index 463aec075..adbee18e6 100644 --- a/roles/matrix-nginx-proxy/templates/nginx/conf.d/matrix-synapse.conf.j2 +++ b/roles/matrix-nginx-proxy/templates/nginx/conf.d/matrix-synapse.conf.j2 @@ -151,7 +151,11 @@ } location / { - rewrite ^/$ /_matrix/static/ last; + {% if matrix_nginx_proxy_proxy_matrix_client_redirect_root_uri_to_domain %} + return 302 $scheme://{{ matrix_nginx_proxy_proxy_matrix_client_redirect_root_uri_to_domain }}$request_uri; + {% else %} + rewrite ^/$ /_matrix/static/ last; + {% endif %} } {% endmacro %} From c1c6eaefff7eb40ef133b72870af8c77b569076c Mon Sep 17 00:00:00 2001 From: Slavi Pantaleev Date: Wed, 28 Oct 2020 17:34:39 +0200 Subject: [PATCH 20/42] Upgrade Element (1.7.10 -> 1.7.12) --- roles/matrix-client-element/defaults/main.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/roles/matrix-client-element/defaults/main.yml b/roles/matrix-client-element/defaults/main.yml index d2b9258f0..100a23b48 100644 --- a/roles/matrix-client-element/defaults/main.yml +++ b/roles/matrix-client-element/defaults/main.yml @@ -2,7 +2,7 @@ matrix_client_element_enabled: true matrix_client_element_container_image_self_build: false -matrix_client_element_docker_image: "vectorim/riot-web:v1.7.10" +matrix_client_element_docker_image: "vectorim/riot-web:v1.7.12" matrix_client_element_docker_image_force_pull: "{{ matrix_client_element_docker_image.endswith(':latest') }}" matrix_client_element_data_path: "{{ matrix_base_data_path }}/client-element" From 56ebeb1ae26ecc58888979efd327c3c25c2ac0b4 Mon Sep 17 00:00:00 2001 From: Slavi Pantaleev Date: Thu, 29 Oct 2020 07:35:53 +0200 Subject: [PATCH 21/42] Revert "Restore self-building on ARM for Synapse for now" This reverts commit 7d211b71e2123ba0a62f2264497c6d4696243e61. The multi-arch images are now available, as discussed in #699 (Github Issue). --- group_vars/matrix_servers | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/group_vars/matrix_servers b/group_vars/matrix_servers index eabce668c..ceaab812b 100755 --- a/group_vars/matrix_servers +++ b/group_vars/matrix_servers @@ -921,7 +921,7 @@ matrix_client_element_jitsi_preferredDomain: "{{ matrix_server_fqn_jitsi if matr # ###################################################################### -matrix_synapse_container_image_self_build: "{{ matrix_architecture not in ['amd64'] }}" +matrix_synapse_container_image_self_build: "{{ matrix_architecture not in ['arm32', 'arm64', 'amd64'] }}" # When ma1sd is enabled, we can use it to validate email addresses and phone numbers. # Synapse can validate email addresses by itself as well, but it's probably not what we want by default when we have an identity server. From c33d007306761a56a9cf909d62088089c6a8cef1 Mon Sep 17 00:00:00 2001 From: Aaron Raimist Date: Thu, 29 Oct 2020 11:46:58 -0500 Subject: [PATCH 22/42] Switch to the new vectorim/element-web Docker image --- README.md | 2 +- docs/configuring-dns.md | 2 +- docs/configuring-playbook-client-element.md | 2 +- roles/matrix-client-element/defaults/main.yml | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/README.md b/README.md index 72018115a..1a2079377 100644 --- a/README.md +++ b/README.md @@ -128,7 +128,7 @@ This playbook sets up your server using the following Docker images: - [instrumentisto/coturn](https://hub.docker.com/r/instrumentisto/coturn/) - the [Coturn](https://github.com/coturn/coturn) STUN/TURN server (optional) -- [vectorim/riot-web](https://hub.docker.com/r/vectorim/riot-web/) - the [Element](https://element.io/) web client (optional) +- [vectorim/element-web](https://hub.docker.com/r/vectorim/element-web/) - the [Element](https://element.io/) web client (optional) - [ma1uta/ma1sd](https://hub.docker.com/r/ma1uta/ma1sd/) - the [ma1sd](https://github.com/ma1uta/ma1sd) Matrix Identity server (optional) diff --git a/docs/configuring-dns.md b/docs/configuring-dns.md index 08bc905e0..9d7384772 100644 --- a/docs/configuring-dns.md +++ b/docs/configuring-dns.md @@ -34,7 +34,7 @@ DNS records marked with `(*)` above are optional. They refer to services that wi As the table above illustrates, you need to create 2 subdomains (`matrix.` and `element.`) and point both of them to your new server's IP address (DNS `A` record or `CNAME` record is fine). -The `element.` subdomain is necessary, because this playbook installs the [Element](https://github.com/vector-im/riot-web) web client for you. +The `element.` subdomain is necessary, because this playbook installs the [Element](https://github.com/vector-im/element-web) web client for you. If you'd rather instruct the playbook not to install Element (`matrix_client_element_enabled: false` when [Configuring the playbook](configuring-playbook.md) later), feel free to skip the `element.` DNS record. The `dimension.` subdomain may be necessary, because this playbook could install the [Dimension integrations manager](http://dimension.t2bot.io/) for you. Dimension installation is disabled by default, because it's only possible to install it after the other Matrix services are working (see [Setting up Dimension](configuring-playbook-dimension.md) later). If you do not wish to set up Dimension, feel free to skip the `dimension.` DNS record. diff --git a/docs/configuring-playbook-client-element.md b/docs/configuring-playbook-client-element.md index 8b0eb331f..45299c558 100644 --- a/docs/configuring-playbook-client-element.md +++ b/docs/configuring-playbook-client-element.md @@ -1,6 +1,6 @@ # Configuring Element (optional) -By default, this playbook installs the [Element](https://github.com/vector-im/riot-web) Matrix client web application. +By default, this playbook installs the [Element](https://github.com/vector-im/element-web) Matrix client web application. If that's okay, you can skip this document. diff --git a/roles/matrix-client-element/defaults/main.yml b/roles/matrix-client-element/defaults/main.yml index 100a23b48..76bc7142a 100644 --- a/roles/matrix-client-element/defaults/main.yml +++ b/roles/matrix-client-element/defaults/main.yml @@ -2,7 +2,7 @@ matrix_client_element_enabled: true matrix_client_element_container_image_self_build: false -matrix_client_element_docker_image: "vectorim/riot-web:v1.7.12" +matrix_client_element_docker_image: "vectorim/element-web:v1.7.12" matrix_client_element_docker_image_force_pull: "{{ matrix_client_element_docker_image.endswith(':latest') }}" matrix_client_element_data_path: "{{ matrix_base_data_path }}/client-element" From 5c91e56898cc0ded68afda1c892fc20edb01ebd5 Mon Sep 17 00:00:00 2001 From: Slavi Pantaleev Date: Fri, 30 Oct 2020 19:35:55 +0200 Subject: [PATCH 23/42] Upgrade Synapse (v1.22.0 -> v1.22.1) --- roles/matrix-synapse/defaults/main.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/roles/matrix-synapse/defaults/main.yml b/roles/matrix-synapse/defaults/main.yml index 450a26be2..5777e802a 100644 --- a/roles/matrix-synapse/defaults/main.yml +++ b/roles/matrix-synapse/defaults/main.yml @@ -5,7 +5,7 @@ matrix_synapse_enabled: true matrix_synapse_container_image_self_build: false -matrix_synapse_docker_image: "matrixdotorg/synapse:v1.22.0" +matrix_synapse_docker_image: "matrixdotorg/synapse:v1.22.1" matrix_synapse_docker_image_force_pull: "{{ matrix_synapse_docker_image.endswith(':latest') }}" matrix_synapse_base_path: "{{ matrix_base_data_path }}/synapse" From ef68d3d2961c603d79e5fdda6d2b350ac694147e Mon Sep 17 00:00:00 2001 From: Slavi Pantaleev Date: Mon, 2 Nov 2020 11:10:03 +0200 Subject: [PATCH 24/42] Add support for reverse-proxying /_synapse/oidc This broke in 63a49bb2dc7780e023b28. Proxying the OpenID Connect endpoints is now possible, but needs to be enabled explicitly now. Supersedes #702 (Github Pull Request). This patch builds up on the idea from that Pull Request, but does things in a cleaner way. --- docs/configuring-playbook-nginx.md | 9 +++++++++ docs/configuring-playbook-synapse.md | 5 +++++ roles/matrix-nginx-proxy/defaults/main.yml | 9 +++++++-- 3 files changed, 21 insertions(+), 2 deletions(-) diff --git a/docs/configuring-playbook-nginx.md b/docs/configuring-playbook-nginx.md index e0b4911ef..945864e97 100644 --- a/docs/configuring-playbook-nginx.md +++ b/docs/configuring-playbook-nginx.md @@ -23,3 +23,12 @@ matrix_nginx_proxy_proxy_matrix_nginx_status_allowed_addresses: - 8.8.8.8 - 1.1.1.1 ``` + + +## Synapse + OpenID Connect for Single-Sign-On + +If you want to use OpenID Connect as an SSO provider (as per the [Synapse OpenID docs](https://github.com/matrix-org/synapse/blob/develop/docs/openid.md)), you need to use the following configuration (in your `vars.yml` file) to instruct nginx to forward `/_synapse/oidc` to Synapse: + +```yaml +matrix_nginx_proxy_proxy_matrix_client_api_forwarded_location_synapse_oidc_api_enabled: true +``` diff --git a/docs/configuring-playbook-synapse.md b/docs/configuring-playbook-synapse.md index 019a651ff..9ae1e903f 100644 --- a/docs/configuring-playbook-synapse.md +++ b/docs/configuring-playbook-synapse.md @@ -21,3 +21,8 @@ Alternatively, **if there is no pre-defined variable** for a Synapse setting you ## Synapse Admin Certain Synapse administration tasks (managing users and rooms, etc.) can be performed via a web user-interace, if you install [Synapse Admin](configuring-playbook-synapse-admin.md). + + +## Synapse + OpenID Connect for Single-Sign-On + +If you'd like to use OpenID Connect authentication with Synapse, you'll need some additional reverse-proxy configuration (see [our nginx reverse-proxy doc page](configuring-playbook-nginx.md#synapse-openid-connect-for-single-sign-on)). diff --git a/roles/matrix-nginx-proxy/defaults/main.yml b/roles/matrix-nginx-proxy/defaults/main.yml index 6d9ff33bd..546f1f1dd 100644 --- a/roles/matrix-nginx-proxy/defaults/main.yml +++ b/roles/matrix-nginx-proxy/defaults/main.yml @@ -150,10 +150,13 @@ matrix_nginx_proxy_proxy_matrix_client_api_addr_sans_container: "127.0.0.1:8008" matrix_nginx_proxy_proxy_matrix_client_api_client_max_body_size_mb: 50 -# Tells wheter `/_synapse/client` is forwarded to the Matrix Client API server. +# Tells whether `/_synapse/client` is forwarded to the Matrix Client API server. matrix_nginx_proxy_proxy_matrix_client_api_forwarded_location_synapse_client_api_enabled: true -# Tells wheter `/_synapse/admin` is forwarded to the Matrix Client API server. +# Tells whether `/_synapse/oidc` is forwarded to the Matrix Client API server. +matrix_nginx_proxy_proxy_matrix_client_api_forwarded_location_synapse_oidc_api_enabled: false + +# Tells whether `/_synapse/admin` is forwarded to the Matrix Client API server. # Following these recommendations (https://github.com/matrix-org/synapse/blob/master/docs/reverse_proxy.md), by default, we don't. matrix_nginx_proxy_proxy_matrix_client_api_forwarded_location_synapse_admin_api_enabled: false @@ -166,6 +169,8 @@ matrix_nginx_proxy_proxy_matrix_client_api_forwarded_location_prefix_regexes: | + (['/_synapse/client'] if matrix_nginx_proxy_proxy_matrix_client_api_forwarded_location_synapse_client_api_enabled else []) + + (['/_synapse/oidc'] if matrix_nginx_proxy_proxy_matrix_client_api_forwarded_location_synapse_oidc_api_enabled else []) + + (['/_synapse/admin'] if matrix_nginx_proxy_proxy_matrix_client_api_forwarded_location_synapse_admin_api_enabled else []) }} From 350c39d7457f325bc814800934c5e843bccadd97 Mon Sep 17 00:00:00 2001 From: Slavi Pantaleev Date: Mon, 2 Nov 2020 11:13:25 +0200 Subject: [PATCH 25/42] Update comment --- roles/matrix-nginx-proxy/defaults/main.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/roles/matrix-nginx-proxy/defaults/main.yml b/roles/matrix-nginx-proxy/defaults/main.yml index 546f1f1dd..dc25b7925 100644 --- a/roles/matrix-nginx-proxy/defaults/main.yml +++ b/roles/matrix-nginx-proxy/defaults/main.yml @@ -154,6 +154,7 @@ matrix_nginx_proxy_proxy_matrix_client_api_client_max_body_size_mb: 50 matrix_nginx_proxy_proxy_matrix_client_api_forwarded_location_synapse_client_api_enabled: true # Tells whether `/_synapse/oidc` is forwarded to the Matrix Client API server. +# Enable this if you need OpenID Connect authentication support. matrix_nginx_proxy_proxy_matrix_client_api_forwarded_location_synapse_oidc_api_enabled: false # Tells whether `/_synapse/admin` is forwarded to the Matrix Client API server. From e894befd87dce731debad58e77fd0de33e303732 Mon Sep 17 00:00:00 2001 From: Scott Crossen Date: Sat, 7 Nov 2020 17:34:16 -0800 Subject: [PATCH 26/42] Updates to reviewer comments --- ...md => configuring-playbook-dynamic-dns.md} | 13 ++++---- docs/configuring-playbook.md | 2 +- group_vars/matrix_servers | 17 +++++++++++ roles/matrix-dynamic-dns/defaults/main.yml | 14 ++------- roles/matrix-dynamic-dns/tasks/install.yml | 2 +- .../tasks/validate_config.yml | 10 +++---- .../templates/ddclient.conf.j2 | 30 ++++++++++++------- .../systemd/matrix-dynamic-dns.service.j2 | 3 -- ...tup_ssl_lets_encrypt_obtain_for_domain.yml | 12 ++++++++ 9 files changed, 66 insertions(+), 37 deletions(-) rename docs/{configuring-playbook-budget-builds.md => configuring-playbook-dynamic-dns.md} (65%) diff --git a/docs/configuring-playbook-budget-builds.md b/docs/configuring-playbook-dynamic-dns.md similarity index 65% rename from docs/configuring-playbook-budget-builds.md rename to docs/configuring-playbook-dynamic-dns.md index 318c3c0cb..1047eaf19 100644 --- a/docs/configuring-playbook-budget-builds.md +++ b/docs/configuring-playbook-dynamic-dns.md @@ -1,6 +1,6 @@ -# Tips for deploying Matrix on a Budget +# Dynamic DNS -## Dynamic DNS +## Setup Most cloud providers / ISPs will charge you extra for a static IP address. If you're not hosting a highly reliable homeserver you can workaround this via dynamic DNS. To @@ -9,13 +9,14 @@ google domains, this process is described [here](https://support.google.com/doma After you've gotten the proper credentials you can add the following config to your inventory/host_vars/matrix.DOMAIN/vars.yml: ``` -matrix_dynamic_dns_username: XXXXXXXXXXXXXXXX -matrix_dynamic_dns_password: XXXXXXXXXXXXXXXX -matrix_dynamic_dns_provider: 'domains.google.com' +matrix_dynamic_dns_domain_configurations: | + {{ + [{'provider': 'domains.google.com', 'protocol': 'dyndn2', 'username': 'XXXXXXXXXXXXXXXX', 'password': 'XXXXXXXXXXXXXXXX', 'domain': matrix_domain}] + }} ``` ## Additional Reading Additional resources: -- https://matrix.org/docs/guides/free-small-matrix-server \ No newline at end of file +- https://matrix.org/docs/guides/free-small-matrix-server diff --git a/docs/configuring-playbook.md b/docs/configuring-playbook.md index 8b0c55370..7ef58b2f6 100644 --- a/docs/configuring-playbook.md +++ b/docs/configuring-playbook.md @@ -33,7 +33,7 @@ When you're done with all the configuration you'd like to do, continue with [Ins - [Setting up the Jitsi video-conferencing platform](configuring-playbook-jitsi.md) (optional) -- [Setting up budget builds or resource-constrained builds](configuring-playbook-budget-builds.md) (optional) +- [Setting Dynamic DNS](configuring-playbook-dynamic-dns.md) (optional) ### Core service adjustments diff --git a/group_vars/matrix_servers b/group_vars/matrix_servers index 00cdbdfbb..2be361c96 100755 --- a/group_vars/matrix_servers +++ b/group_vars/matrix_servers @@ -619,6 +619,23 @@ matrix_dimension_homeserver_federationUrl: "http://matrix-synapse:{{ 8048 if mat ###################################################################### + +###################################################################### +# +# matrix-dynamic-dns +# +###################################################################### + +matrix_dynamic_dns_domain_configurations: [] + +###################################################################### +# +# /matrix-dynamic-dns +# +###################################################################### + + + ###################################################################### # # matrix-email2matrix diff --git a/roles/matrix-dynamic-dns/defaults/main.yml b/roles/matrix-dynamic-dns/defaults/main.yml index e57b47da4..8c86d35c4 100644 --- a/roles/matrix-dynamic-dns/defaults/main.yml +++ b/roles/matrix-dynamic-dns/defaults/main.yml @@ -1,11 +1,11 @@ # Whether dynamic dns is enabled -matrix_dynamic_dns_enabled: false +matrix_dynamic_dns_enabled: "{{ matrix_dynamic_dns_domain_configurations is defined }}" # The dynamic dns daemon interval matrix_dynamic_dns_daemon_interval: '300' # The docker container to use when in mode -matrix_dynamic_dns_docker_image: 'linuxserver/ddclient' +matrix_dynamic_dns_docker_image: 'linuxserver/ddclient:v3.9.1-ls45' # The image to force pull matrix_dynamic_dns_docker_image_force_pull: "{{ matrix_dynamic_dns_docker_image.endswith(':latest') }}" @@ -28,13 +28,5 @@ matrix_dynamic_dns_config_path: "{{ matrix_dynamic_dns_base_path }}/config" matrix_dynamic_dns_docker_src_files_path: "{{ matrix_dynamic_dns_base_path }}/docker-src" # Config options +matrix_dynamic_dns_additional_configuration_blocks: [] matrix_dynamic_dns_use: "web" -matrix_dynamic_dns_static: false -matrix_dynamic_dns_custom: false -matrix_dynamic_dns_zone: "" -matrix_dynamic_dns_ttl: "" -matrix_dynamic_dns_mx: "" -matrix_dynamic_dns_wildcard: false -matrix_dynamic_dns_protocol: 'dyndns2' -matrix_dynamic_dns_provider: 'domains.google.com' -matrix_dynamic_dns_domain: '{{ matrix_domain }}' diff --git a/roles/matrix-dynamic-dns/tasks/install.yml b/roles/matrix-dynamic-dns/tasks/install.yml index 816dc7c39..225738bfd 100644 --- a/roles/matrix-dynamic-dns/tasks/install.yml +++ b/roles/matrix-dynamic-dns/tasks/install.yml @@ -12,7 +12,7 @@ file: path: "{{ item.path }}" state: directory - mode: 0750 + mode: 0751 owner: "{{ matrix_user_username }}" group: "{{ matrix_user_groupname }}" with_items: diff --git a/roles/matrix-dynamic-dns/tasks/validate_config.yml b/roles/matrix-dynamic-dns/tasks/validate_config.yml index 2895f4071..c6e4c4a66 100644 --- a/roles/matrix-dynamic-dns/tasks/validate_config.yml +++ b/roles/matrix-dynamic-dns/tasks/validate_config.yml @@ -1,10 +1,10 @@ --- -- name: Fail if required settings not defined +- name: Fail if required settings not defined in configuration blocks fail: msg: >- You need to define a required configuration setting (`{{ item }}`). - when: "vars[item] == ''" - with_items: - - "matrix_dynamic_dns_domain" - - "matrix_dynamic_dns_provider" + when: "'domain' not in configuration == '' or 'provider' not in configuration == '' or 'protocol' not in configuration == ''" + with_items: "{{ matrix_dynamic_dns_domain_configurations }}" + loop_control: + loop_var: configuration diff --git a/roles/matrix-dynamic-dns/templates/ddclient.conf.j2 b/roles/matrix-dynamic-dns/templates/ddclient.conf.j2 index 651712dbf..1480d834e 100644 --- a/roles/matrix-dynamic-dns/templates/ddclient.conf.j2 +++ b/roles/matrix-dynamic-dns/templates/ddclient.conf.j2 @@ -3,14 +3,24 @@ syslog=no pid=/var/run/ddclient/ddclient.pid ssl=yes use={{ matrix_dynamic_dns_use }} -protocol={{ matrix_dynamic_dns_protocol }} -server={{ matrix_dynamic_dns_provider }} {% if matrix_dynamic_dns_username %} -login='{{ matrix_dynamic_dns_username }}' {% endif %} {% if matrix_dynamic_dns_username %} -password='{{ matrix_dynamic_dns_password }}' {% endif %} {% if matrix_dynamic_dns_static %} -static=yes {% endif %} {% if matrix_dynamic_dns_custom %} -custom=yes {% endif %} {% if matrix_dynamic_dns_zone %} -zone={{ matrix_dynamic_dns_zone }} {% endif %} {% if matrix_dynamic_dns_ttl %} -ttl={{ matrix_dynamic_dns_ttl }} {% endif %} {% if matrix_dynamic_dns_mx %} -mx={{ matrix_dynamic_dns_mx }} {% endif %} {% if matrix_dynamic_dns_wildcard %} + +{% for dynamic_dns_domain_configuration in matrix_dynamic_dns_domain_configurations %} +protocol={{ dynamic_dns_domain_configuration.protocol }} +server={{ dynamic_dns_domain_configuration.provider }} {% if 'username' in dynamic_dns_domain_configuration %} +login='{{ dynamic_dns_domain_configuration.username }}' {% endif %} {% if 'password' in dynamic_dns_domain_configuration %} +password='{{ dynamic_dns_domain_configuration.password }}' {% endif %} {% if 'static' in dynamic_dns_domain_configuration %} +static=yes {% endif %} {% if 'custom' in dynamic_dns_domain_configuration %} +custom=yes {% endif %} {% if 'zone' in dynamic_dns_domain_configuration %} +zone={{ dynamic_dns_domain_configuration.zone }} {% endif %} {% if 'ttl' in dynamic_dns_domain_configuration %} +ttl={{ dynamic_dns_domain_configuration.ttl }} {% endif %} {% if 'mx' in dynamic_dns_domain_configuration %} +mx={{ dynamic_dns_domain_configuration.mx }} {% endif %} {% if 'wildcard' in dynamic_dns_domain_configuration %} wildcard=yes {% endif %} -{{ matrix_dynamic_dns_domain }} +{{ dynamic_dns_domain_configuration.domain }} + +{% endfor %} + + +{% for matrix_dynamic_dns_additional_configuration in matrix_dynamic_dns_additional_configuration_blocks %} +{{ matrix_dynamic_dns_additional_configuration }} + +{% endfor %} diff --git a/roles/matrix-dynamic-dns/templates/systemd/matrix-dynamic-dns.service.j2 b/roles/matrix-dynamic-dns/templates/systemd/matrix-dynamic-dns.service.j2 index 9c11e148b..7e73b5879 100644 --- a/roles/matrix-dynamic-dns/templates/systemd/matrix-dynamic-dns.service.j2 +++ b/roles/matrix-dynamic-dns/templates/systemd/matrix-dynamic-dns.service.j2 @@ -15,12 +15,9 @@ ExecStartPre=-{{ matrix_host_command_docker }} kill matrix-dynamic-dns ExecStartPre=-{{ matrix_host_command_docker }} rm matrix-dynamic-dns ExecStart={{ matrix_host_command_docker }} run --rm --name matrix-dynamic-dns \ --log-driver=none \ - --user={{ matrix_user_uid }}:{{ matrix_user_gid }} \ - --cap-drop=ALL \ --network={{ matrix_docker_network }} \ -e PUID={{ matrix_user_uid }} \ -e PGID={{ matrix_user_gid }} \ - -e CONFIG_PATH=/config/config.yaml \ -v {{ matrix_dynamic_dns_config_path }}:/config:z \ {% for arg in matrix_dynamic_dns_container_extra_arguments %} {{ arg }} \ diff --git a/roles/matrix-nginx-proxy/tasks/ssl/setup_ssl_lets_encrypt_obtain_for_domain.yml b/roles/matrix-nginx-proxy/tasks/ssl/setup_ssl_lets_encrypt_obtain_for_domain.yml index e80b655df..0c12fa939 100644 --- a/roles/matrix-nginx-proxy/tasks/ssl/setup_ssl_lets_encrypt_obtain_for_domain.yml +++ b/roles/matrix-nginx-proxy/tasks/ssl/setup_ssl_lets_encrypt_obtain_for_domain.yml @@ -12,6 +12,18 @@ - set_fact: domain_name_needs_cert: "{{ not domain_name_certificate_path_stat.stat.exists }}" +- name: Ensure dynamic dns has ran + service: + name: "dynamic-dns" + state: started + register: dynamic_dns_service_update + when: "domain_name_needs_cert|bool and matrix_dynamic_dns_enabled|bool" + +- name: Sleep for 60 seconds so that DNS records can be updated + wait_for: + timeout: 60 + when: dynamic_dns_service_update.changed + # This will fail if there is something running on port 80 (like matrix-nginx-proxy). # We suppress the error, as we'll try another method below. - name: Attempt initial SSL certificate retrieval with standalone authenticator (directly) From c448aa54a1eda4fba76ce20aec0ef6909b1411dd Mon Sep 17 00:00:00 2001 From: Eneko Nieto Date: Sun, 8 Nov 2020 22:39:08 +0100 Subject: [PATCH 27/42] Added docker-compose example for launching Traefik. --- docs/configuring-playbook-own-webserver.md | 35 ++++++++++++++++++++++ 1 file changed, 35 insertions(+) diff --git a/docs/configuring-playbook-own-webserver.md b/docs/configuring-playbook-own-webserver.md index 2c4b43a21..54afce6d9 100644 --- a/docs/configuring-playbook-own-webserver.md +++ b/docs/configuring-playbook-own-webserver.md @@ -193,3 +193,38 @@ Note that this configuration on its own does **not** redirect traffic on port 80 scheme = "https" permanent = true ``` + +You can use the following `docker-compose.yml` as example to launch Traefik. + +```yaml +version: "3.3" + +services: + + traefik: + image: "traefik:v2.3" + restart: always + container_name: "traefik" + networks: + - traefik + command: + - "--api.insecure=true" + - "--providers.docker=true" + - "--providers.docker.network=traefik" + - "--providers.docker.exposedbydefault=false" + - "--entrypoints.websecure.address=:443" + - "--entrypoints.synapse.address=:8448" + - "--certificatesresolvers.default.acme.tlschallenge=true" + - "--certificatesresolvers.default.acme.email=YOUR EMAIL" + - "--certificatesresolvers.default.acme.storage=/letsencrypt/acme.json" + ports: + - "443:443" + - "8080:8080" + volumes: + - "./letsencrypt:/letsencrypt" + - "/var/run/docker.sock:/var/run/docker.sock:ro" + +networks: + traefik: + external: true +``` From 2c33aa3ec54533f70e7558baec5c62a7e51fbbde Mon Sep 17 00:00:00 2001 From: Eneko Nieto Date: Mon, 9 Nov 2020 00:03:15 +0100 Subject: [PATCH 28/42] Fixed entrypoint name. --- docs/configuring-playbook-own-webserver.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/configuring-playbook-own-webserver.md b/docs/configuring-playbook-own-webserver.md index 54afce6d9..dac783766 100644 --- a/docs/configuring-playbook-own-webserver.md +++ b/docs/configuring-playbook-own-webserver.md @@ -212,7 +212,7 @@ services: - "--providers.docker=true" - "--providers.docker.network=traefik" - "--providers.docker.exposedbydefault=false" - - "--entrypoints.websecure.address=:443" + - "--entrypoints.web-secure.address=:443" - "--entrypoints.synapse.address=:8448" - "--certificatesresolvers.default.acme.tlschallenge=true" - "--certificatesresolvers.default.acme.email=YOUR EMAIL" From 59bb6b297138dd586198a6aa463c55f6374d23bc Mon Sep 17 00:00:00 2001 From: Scott Crossen Date: Mon, 9 Nov 2020 13:32:58 -0800 Subject: [PATCH 29/42] responded to reviewer comments --- docs/configuring-playbook-dynamic-dns.md | 1 + group_vars/matrix_servers | 1 + roles/matrix-dynamic-dns/defaults/main.yml | 2 +- 3 files changed, 3 insertions(+), 1 deletion(-) diff --git a/docs/configuring-playbook-dynamic-dns.md b/docs/configuring-playbook-dynamic-dns.md index 1047eaf19..e46d87c00 100644 --- a/docs/configuring-playbook-dynamic-dns.md +++ b/docs/configuring-playbook-dynamic-dns.md @@ -9,6 +9,7 @@ google domains, this process is described [here](https://support.google.com/doma After you've gotten the proper credentials you can add the following config to your inventory/host_vars/matrix.DOMAIN/vars.yml: ``` +matrix_dyanmic_dns_enabled: true matrix_dynamic_dns_domain_configurations: | {{ [{'provider': 'domains.google.com', 'protocol': 'dyndn2', 'username': 'XXXXXXXXXXXXXXXX', 'password': 'XXXXXXXXXXXXXXXX', 'domain': matrix_domain}] diff --git a/group_vars/matrix_servers b/group_vars/matrix_servers index 2be361c96..86d910882 100755 --- a/group_vars/matrix_servers +++ b/group_vars/matrix_servers @@ -626,6 +626,7 @@ matrix_dimension_homeserver_federationUrl: "http://matrix-synapse:{{ 8048 if mat # ###################################################################### +matrix_dyanmic_dns_enabled: false matrix_dynamic_dns_domain_configurations: [] ###################################################################### diff --git a/roles/matrix-dynamic-dns/defaults/main.yml b/roles/matrix-dynamic-dns/defaults/main.yml index 8c86d35c4..cb17c90c2 100644 --- a/roles/matrix-dynamic-dns/defaults/main.yml +++ b/roles/matrix-dynamic-dns/defaults/main.yml @@ -1,5 +1,5 @@ # Whether dynamic dns is enabled -matrix_dynamic_dns_enabled: "{{ matrix_dynamic_dns_domain_configurations is defined }}" +matrix_dynamic_dns_enabled: true # The dynamic dns daemon interval matrix_dynamic_dns_daemon_interval: '300' From 235299939da49d5b7984a4deb66b626fa07504ce Mon Sep 17 00:00:00 2001 From: Slavi Pantaleev Date: Tue, 10 Nov 2020 09:30:00 +0200 Subject: [PATCH 30/42] Upgrade nginx (1.19.3 -> 1.19.4) --- roles/matrix-nginx-proxy/defaults/main.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/roles/matrix-nginx-proxy/defaults/main.yml b/roles/matrix-nginx-proxy/defaults/main.yml index dc25b7925..e36270b75 100644 --- a/roles/matrix-nginx-proxy/defaults/main.yml +++ b/roles/matrix-nginx-proxy/defaults/main.yml @@ -3,7 +3,7 @@ matrix_nginx_proxy_enabled: true # We use an official nginx image, which we fix-up to run unprivileged. # An alternative would be an `nginxinc/nginx-unprivileged` image, but # that is frequently out of date. -matrix_nginx_proxy_docker_image: "nginx:1.19.3-alpine" +matrix_nginx_proxy_docker_image: "nginx:1.19.4-alpine" matrix_nginx_proxy_docker_image_force_pull: "{{ matrix_nginx_proxy_docker_image.endswith(':latest') }}" matrix_nginx_proxy_base_path: "{{ matrix_base_data_path }}/nginx-proxy" From 31619e0968dc060107447da9de764a20cf64e5a6 Mon Sep 17 00:00:00 2001 From: Aaron Raimist Date: Tue, 10 Nov 2020 11:27:15 -0600 Subject: [PATCH 31/42] Upgrade Element (1.7.12 -> 1.7.13) --- roles/matrix-client-element/defaults/main.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/roles/matrix-client-element/defaults/main.yml b/roles/matrix-client-element/defaults/main.yml index 76bc7142a..c591b0258 100644 --- a/roles/matrix-client-element/defaults/main.yml +++ b/roles/matrix-client-element/defaults/main.yml @@ -2,7 +2,7 @@ matrix_client_element_enabled: true matrix_client_element_container_image_self_build: false -matrix_client_element_docker_image: "vectorim/element-web:v1.7.12" +matrix_client_element_docker_image: "vectorim/element-web:v1.7.13" matrix_client_element_docker_image_force_pull: "{{ matrix_client_element_docker_image.endswith(':latest') }}" matrix_client_element_data_path: "{{ matrix_base_data_path }}/client-element" From 73d5faa1f9567548b54a7d9ff888cebdb93392f0 Mon Sep 17 00:00:00 2001 From: Slavi Pantaleev Date: Tue, 10 Nov 2020 23:30:38 +0200 Subject: [PATCH 32/42] Fix variable name typo --- docs/configuring-playbook-dynamic-dns.md | 2 +- group_vars/matrix_servers | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/configuring-playbook-dynamic-dns.md b/docs/configuring-playbook-dynamic-dns.md index e46d87c00..4251291be 100644 --- a/docs/configuring-playbook-dynamic-dns.md +++ b/docs/configuring-playbook-dynamic-dns.md @@ -9,7 +9,7 @@ google domains, this process is described [here](https://support.google.com/doma After you've gotten the proper credentials you can add the following config to your inventory/host_vars/matrix.DOMAIN/vars.yml: ``` -matrix_dyanmic_dns_enabled: true +matrix_dynamic_dns_enabled: true matrix_dynamic_dns_domain_configurations: | {{ [{'provider': 'domains.google.com', 'protocol': 'dyndn2', 'username': 'XXXXXXXXXXXXXXXX', 'password': 'XXXXXXXXXXXXXXXX', 'domain': matrix_domain}] diff --git a/group_vars/matrix_servers b/group_vars/matrix_servers index 86d910882..e199ea86c 100755 --- a/group_vars/matrix_servers +++ b/group_vars/matrix_servers @@ -626,7 +626,7 @@ matrix_dimension_homeserver_federationUrl: "http://matrix-synapse:{{ 8048 if mat # ###################################################################### -matrix_dyanmic_dns_enabled: false +matrix_dynamic_dns_enabled: false matrix_dynamic_dns_domain_configurations: [] ###################################################################### From 5c5f828405f5a279b9a1b1df14f7ecbf51d755e1 Mon Sep 17 00:00:00 2001 From: Slavi Pantaleev Date: Tue, 10 Nov 2020 23:33:27 +0200 Subject: [PATCH 33/42] Use more YAML-like syntax for the dynamic DNS configurations Related to #681 (Github Pull Request) --- docs/configuring-playbook-dynamic-dns.md | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/docs/configuring-playbook-dynamic-dns.md b/docs/configuring-playbook-dynamic-dns.md index 4251291be..cec53e4a4 100644 --- a/docs/configuring-playbook-dynamic-dns.md +++ b/docs/configuring-playbook-dynamic-dns.md @@ -8,12 +8,20 @@ set this up, you'll need to get the username/password from your DNS provider. Fo google domains, this process is described [here](https://support.google.com/domains/answer/6147083). After you've gotten the proper credentials you can add the following config to your inventory/host_vars/matrix.DOMAIN/vars.yml: -``` +```yaml matrix_dynamic_dns_enabled: true + matrix_dynamic_dns_domain_configurations: | {{ [{'provider': 'domains.google.com', 'protocol': 'dyndn2', 'username': 'XXXXXXXXXXXXXXXX', 'password': 'XXXXXXXXXXXXXXXX', 'domain': matrix_domain}] }} + +matrix_dynamic_dns_domain_configurations: + - provider: domains.google.com + protocol: dyndn2 + username: XXXXXXXXXXXXXXXX + password: XXXXXXXXXXXXXXXX + domain: "{{ matrix_domain }}" ``` ## Additional Reading From fef44b93d33d1e2c6835d50eef1f6c79f01d3ea2 Mon Sep 17 00:00:00 2001 From: Slavi Pantaleev Date: Tue, 10 Nov 2020 23:33:58 +0200 Subject: [PATCH 34/42] Define the matrix_dynamic_dns_domain_configurations variable in the role Having it unset in the role itself (while referencign it) is a little strange. Now people can look at the `roles/matrix-dynamic-dns/defaults/main.yml` file and figure out everything that's necessary to run the role. Related to #681 (Github Pull Request) --- roles/matrix-dynamic-dns/defaults/main.yml | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/roles/matrix-dynamic-dns/defaults/main.yml b/roles/matrix-dynamic-dns/defaults/main.yml index cb17c90c2..0d34ccea3 100644 --- a/roles/matrix-dynamic-dns/defaults/main.yml +++ b/roles/matrix-dynamic-dns/defaults/main.yml @@ -27,6 +27,17 @@ matrix_dynamic_dns_base_path: "{{ matrix_base_data_path }}/dynamic-dns" matrix_dynamic_dns_config_path: "{{ matrix_dynamic_dns_base_path }}/config" matrix_dynamic_dns_docker_src_files_path: "{{ matrix_dynamic_dns_base_path }}/docker-src" +# Holds the configurations (the domains to update DNS for, the providers they use, etc.) +# +# Example: +# matrix_dynamic_dns_domain_configurations: +# - provider: domains.google.com +# protocol: dyndn2 +# username: XXXXXXXXXXXXXXXX +# password: XXXXXXXXXXXXXXXX +# domain: "{{ matrix_domain }}" +matrix_dynamic_dns_domain_configurations: [] + # Config options matrix_dynamic_dns_additional_configuration_blocks: [] matrix_dynamic_dns_use: "web" From 97a7c8b0f08d91ec68f946c5def9cea79dbfef5e Mon Sep 17 00:00:00 2001 From: Slavi Pantaleev Date: Tue, 10 Nov 2020 23:43:15 +0200 Subject: [PATCH 35/42] Fix matrix_dynamic_dns_domain_configurations validation check - `item` was undefined - `'key' in configurations == ''` was doing the wrong thing Related to #681 (Github Pull Request) --- roles/matrix-dynamic-dns/tasks/validate_config.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/roles/matrix-dynamic-dns/tasks/validate_config.yml b/roles/matrix-dynamic-dns/tasks/validate_config.yml index c6e4c4a66..3976a4b0d 100644 --- a/roles/matrix-dynamic-dns/tasks/validate_config.yml +++ b/roles/matrix-dynamic-dns/tasks/validate_config.yml @@ -3,8 +3,8 @@ - name: Fail if required settings not defined in configuration blocks fail: msg: >- - You need to define a required configuration setting (`{{ item }}`). - when: "'domain' not in configuration == '' or 'provider' not in configuration == '' or 'protocol' not in configuration == ''" + One of the configurations in matrix_dynamic_dns_domain_configurations is missing a required key (domain, provider, protocol). + when: "'domain' not in configuration or 'provider' not in configuration or 'protocol' not in configuration" with_items: "{{ matrix_dynamic_dns_domain_configurations }}" loop_control: loop_var: configuration From 8782919d8509ea53b5bdd16d7d672b053ff59cca Mon Sep 17 00:00:00 2001 From: Slavi Pantaleev Date: Tue, 10 Nov 2020 23:44:09 +0200 Subject: [PATCH 36/42] Ensure matrix_dynamic_dns_domain_configurations contains configurations If `matrix_dynamic_dns_enabled`, we'd like to ensure there's at least one configuration defined. Related to #681 (Github Pull Request) --- roles/matrix-dynamic-dns/tasks/validate_config.yml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/roles/matrix-dynamic-dns/tasks/validate_config.yml b/roles/matrix-dynamic-dns/tasks/validate_config.yml index 3976a4b0d..8f0001eaa 100644 --- a/roles/matrix-dynamic-dns/tasks/validate_config.yml +++ b/roles/matrix-dynamic-dns/tasks/validate_config.yml @@ -1,5 +1,11 @@ --- +- name: Fail if no configurations specified + fail: + msg: >- + You need to define at least one configuration in `matrix_dynamic_dns_domain_configurations` for using matrix-dynamic-dns. + when: "matrix_dynamic_dns_domain_configurations|length == 0" + - name: Fail if required settings not defined in configuration blocks fail: msg: >- From 1427286cec29db8fb821dce963b2aa6c54c04845 Mon Sep 17 00:00:00 2001 From: Slavi Pantaleev Date: Tue, 10 Nov 2020 23:46:33 +0200 Subject: [PATCH 37/42] Integrate matrix-dynamic-dns with matrix-nginx-proxy without causing a dependency We'd like the roles to be self-contained (as much as possible). Thus, the `matrix-nginx-proxy` shouldn't reference any variables from other roles. Instead, we rely on injection via `group_vars/matrix_servers`. Related to #681 (Github Pull Request) --- group_vars/matrix_servers | 2 ++ roles/matrix-nginx-proxy/defaults/main.yml | 4 ++++ ...tup_ssl_lets_encrypt_obtain_for_domain.yml | 21 ++++++++++--------- 3 files changed, 17 insertions(+), 10 deletions(-) diff --git a/group_vars/matrix_servers b/group_vars/matrix_servers index e199ea86c..f38284e8c 100755 --- a/group_vars/matrix_servers +++ b/group_vars/matrix_servers @@ -851,6 +851,8 @@ matrix_ssl_architecture: "{{ }[matrix_architecture] }}" +matrix_ssl_pre_obtaining_required_service_name: "{{ 'matrix-dynamic-dns' if matrix_dynamic_dns_enabled else '' }} + ###################################################################### # # /matrix-nginx-proxy diff --git a/roles/matrix-nginx-proxy/defaults/main.yml b/roles/matrix-nginx-proxy/defaults/main.yml index 3b9dd60b4..4bf57f616 100644 --- a/roles/matrix-nginx-proxy/defaults/main.yml +++ b/roles/matrix-nginx-proxy/defaults/main.yml @@ -243,6 +243,10 @@ matrix_ssl_base_path: "{{ matrix_base_data_path }}/ssl" matrix_ssl_config_dir_path: "{{ matrix_ssl_base_path }}/config" matrix_ssl_log_dir_path: "{{ matrix_ssl_base_path }}/log" +# If you'd like to start some service before a certificate is obtained, specify it here. +# This could be something like `matrix-dynamic-dns`, etc. +matrix_ssl_pre_obtaining_required_service_name: ~ +matrix_ssl_pre_obtaining_required_service_start_wait_time_seconds: 60 # nginx status page configurations. matrix_nginx_proxy_proxy_matrix_nginx_status_enabled: false diff --git a/roles/matrix-nginx-proxy/tasks/ssl/setup_ssl_lets_encrypt_obtain_for_domain.yml b/roles/matrix-nginx-proxy/tasks/ssl/setup_ssl_lets_encrypt_obtain_for_domain.yml index 0c12fa939..3dea71fb4 100644 --- a/roles/matrix-nginx-proxy/tasks/ssl/setup_ssl_lets_encrypt_obtain_for_domain.yml +++ b/roles/matrix-nginx-proxy/tasks/ssl/setup_ssl_lets_encrypt_obtain_for_domain.yml @@ -12,17 +12,18 @@ - set_fact: domain_name_needs_cert: "{{ not domain_name_certificate_path_stat.stat.exists }}" -- name: Ensure dynamic dns has ran - service: - name: "dynamic-dns" - state: started - register: dynamic_dns_service_update - when: "domain_name_needs_cert|bool and matrix_dynamic_dns_enabled|bool" +- block: + - name: Ensure required service for obtaining is started + service: + name: "{{ matrix_ssl_pre_obtaining_required_service_name }}" + state: started + register: matrix_ssl_pre_obtaining_required_service_start_result -- name: Sleep for 60 seconds so that DNS records can be updated - wait_for: - timeout: 60 - when: dynamic_dns_service_update.changed + - name: Wait some time, so that the required service for obtaining can start + wait_for: + timeout: "{{ matrix_ssl_service_to_start_before_obtaining_start_wait_time_seconds }}" + when: "matrix_ssl_pre_obtaining_required_service_start_result.changed|bool" + when: "domain_name_needs_cert|bool and matrix_ssl_pre_obtaining_required_service_name != ''" # This will fail if there is something running on port 80 (like matrix-nginx-proxy). # We suppress the error, as we'll try another method below. From 2708f9aec71bb3f829979825bd8c2dbe66dcfc1f Mon Sep 17 00:00:00 2001 From: Slavi Pantaleev Date: Tue, 10 Nov 2020 23:50:41 +0200 Subject: [PATCH 38/42] Remove duplicate configuration in docs page Related to #681 (Github Pull Request) --- docs/configuring-playbook-dynamic-dns.md | 5 ----- 1 file changed, 5 deletions(-) diff --git a/docs/configuring-playbook-dynamic-dns.md b/docs/configuring-playbook-dynamic-dns.md index cec53e4a4..c06bcf434 100644 --- a/docs/configuring-playbook-dynamic-dns.md +++ b/docs/configuring-playbook-dynamic-dns.md @@ -11,11 +11,6 @@ After you've gotten the proper credentials you can add the following config to y ```yaml matrix_dynamic_dns_enabled: true -matrix_dynamic_dns_domain_configurations: | - {{ - [{'provider': 'domains.google.com', 'protocol': 'dyndn2', 'username': 'XXXXXXXXXXXXXXXX', 'password': 'XXXXXXXXXXXXXXXX', 'domain': matrix_domain}] - }} - matrix_dynamic_dns_domain_configurations: - provider: domains.google.com protocol: dyndn2 From de0987e8064181c606efd4f2c6aaa8b6c97b7dbc Mon Sep 17 00:00:00 2001 From: Slavi Pantaleev Date: Tue, 10 Nov 2020 23:51:38 +0200 Subject: [PATCH 39/42] Remove unnecessary variable definition Related to #681 (Github Pull Request) --- group_vars/matrix_servers | 1 - 1 file changed, 1 deletion(-) diff --git a/group_vars/matrix_servers b/group_vars/matrix_servers index f38284e8c..c2e40507a 100755 --- a/group_vars/matrix_servers +++ b/group_vars/matrix_servers @@ -627,7 +627,6 @@ matrix_dimension_homeserver_federationUrl: "http://matrix-synapse:{{ 8048 if mat ###################################################################### matrix_dynamic_dns_enabled: false -matrix_dynamic_dns_domain_configurations: [] ###################################################################### # From d910df2b1cc1b8e497c7a643d22852a625492bb3 Mon Sep 17 00:00:00 2001 From: Slavi Pantaleev Date: Wed, 11 Nov 2020 00:00:52 +0200 Subject: [PATCH 40/42] Announce Dynamic DNS support Related to #681 (Github Pull Request) --- CHANGELOG.md | 9 +++++++++ docs/configuring-playbook-dynamic-dns.md | 3 ++- 2 files changed, 11 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 089d06508..aa378ae38 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,3 +1,12 @@ +# 2020-11-10 + +## Dynamic DNS support + +Thanks to [Scott Crossen](https://github.com/scottcrossen), the playbook can now manage Dynamic DNS for you using [ddclient](https://ddclient.net/). + +To learn more, follow our [Dynamic DNS docs page](docs/configuring-playbook-dynamic-dns.md). + + # 2020-10-28 ## (Compatibility Break) https://matrix.DOMAIN/ now redirects to https://element.DOMAIN/ diff --git a/docs/configuring-playbook-dynamic-dns.md b/docs/configuring-playbook-dynamic-dns.md index c06bcf434..bc58c2736 100644 --- a/docs/configuring-playbook-dynamic-dns.md +++ b/docs/configuring-playbook-dynamic-dns.md @@ -6,7 +6,7 @@ Most cloud providers / ISPs will charge you extra for a static IP address. If yo not hosting a highly reliable homeserver you can workaround this via dynamic DNS. To set this up, you'll need to get the username/password from your DNS provider. For google domains, this process is described [here](https://support.google.com/domains/answer/6147083). -After you've gotten the proper credentials you can add the following config to your inventory/host_vars/matrix.DOMAIN/vars.yml: +After you've gotten the proper credentials you can add the following config to your `inventory/host_vars/matrix.DOMAIN/vars.yml`: ```yaml matrix_dynamic_dns_enabled: true @@ -19,6 +19,7 @@ matrix_dynamic_dns_domain_configurations: domain: "{{ matrix_domain }}" ``` + ## Additional Reading Additional resources: From b5435db3386da670de8add53aa0278a0b99fd330 Mon Sep 17 00:00:00 2001 From: Slavi Pantaleev Date: Wed, 11 Nov 2020 00:22:09 +0200 Subject: [PATCH 41/42] Fix syntax error in group_vars/matrix_servers --- group_vars/matrix_servers | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/group_vars/matrix_servers b/group_vars/matrix_servers index 8bda2bbe5..742391c34 100755 --- a/group_vars/matrix_servers +++ b/group_vars/matrix_servers @@ -854,7 +854,7 @@ matrix_ssl_architecture: "{{ }[matrix_architecture] }}" -matrix_ssl_pre_obtaining_required_service_name: "{{ 'matrix-dynamic-dns' if matrix_dynamic_dns_enabled else '' }} +matrix_ssl_pre_obtaining_required_service_name: "{{ 'matrix-dynamic-dns' if matrix_dynamic_dns_enabled else '' }}" ###################################################################### # From 4dbec2470f3fb8d96af2de0c9db24a1d3baf3c44 Mon Sep 17 00:00:00 2001 From: Slavi Pantaleev Date: Wed, 11 Nov 2020 00:45:02 +0200 Subject: [PATCH 42/42] Fix systemd_path being undefined breakage Regression since #681 (Github Pull Request). Fixes #715 (Github Issue). --- roles/matrix-dynamic-dns/tasks/uninstall.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/roles/matrix-dynamic-dns/tasks/uninstall.yml b/roles/matrix-dynamic-dns/tasks/uninstall.yml index 1be0e1906..98dca0e85 100644 --- a/roles/matrix-dynamic-dns/tasks/uninstall.yml +++ b/roles/matrix-dynamic-dns/tasks/uninstall.yml @@ -2,7 +2,7 @@ - name: Check existence of matrix-dynamic-dns service stat: - path: "{{ systemd_path }}/matrix-dynamic-dns.service" + path: "{{ matrix_systemd_path }}/matrix-dynamic-dns.service" register: matrix_dynamic_dns_service_stat - name: Ensure matrix-dynamic-dns is stopped @@ -14,7 +14,7 @@ - name: Ensure matrix-dynamic-dns.service doesn't exist file: - path: "{{ systemd_path }}/matrix-dynamic-dns.service" + path: "{{ matrix_systemd_path }}/matrix-dynamic-dns.service" state: absent when: "matrix_dynamic_dns_service_stat.stat.exists"