mirror/matrix-docker-ansible-deploy
1
0
Fork 0
mirror of https://github.com/spantaleev/matrix-docker-ansible-deploy.git synced 2024-11-06 02:37:31 +01:00
Code Issues Packages Projects Releases Wiki Activity

Initial work on matrix-homeserver-proxy role and eliminating matrix-nginx-proxy

Browse Source 
This is still very far from usable.

Various bridges and bots are still talking to
`matrix-nginx-proxy` instead of the new `matrix-homeserver-proxy` role.
These services need to be reworked. While reworking them,
various cleanups are being done as well as adding Traefik-labels to
those that need them.
This commit is contained in:
Slavi Pantaleev 2024-01-02 15:56:56 +02:00
parent c744d29567
commit 4a6287c528
35 changed files with 968 additions and 166 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

243
group_vars/matrix_servers
View File

@ -189,6 +189,17 @@ matrix_homeserver_app_service_config_files_auto: |
(['/matrix-cactus-comments.yaml'] if matrix_cactus_comments_enabled else [])
}}
matrix_bridges_homeserver_container_network: "{{ matrix_homeserver_proxy_container_network if matrix_homeserver_proxy_enabled else matrix_homeserver_container_network }}"
matrix_bridges_homeserver_client_api_url: "{{ matrix_homeserver_proxy_client_api_url if matrix_homeserver_proxy_enabled else matrix_homeserver_container_url }}"
matrix_bridges_homeserver_systemd_services_list: "{{ ([matrix_homeserver_proxy_ident + '.service']) if matrix_homeserver_proxy_enabled else matrix_homeserver_systemd_services_list }}"
matrix_bots_homeserver_container_network: "{{ matrix_homeserver_proxy_container_network if matrix_homeserver_proxy_enabled else matrix_homeserver_container_network }}"
matrix_bots_homeserver_client_api_url: "{{ matrix_homeserver_proxy_client_api_url if matrix_homeserver_proxy_enabled else matrix_homeserver_container_url }}"
matrix_bots_homeserver_systemd_services_list: "{{ ([matrix_homeserver_proxy_ident + '.service']) if matrix_homeserver_proxy_enabled else matrix_homeserver_systemd_services_list }}"
# Starting from version `0.6.0` conduit natively supports some sync v3 (sliding-sync) features.
matrix_homeserver_sliding_sync_url: "{{ matrix_sliding_sync_base_url if matrix_sliding_sync_enabled else (matrix_homeserver_url if matrix_homeserver_implementation in ['conduit'] else '') }}"
########################################################################
# #
# /base #
@ -260,7 +271,7 @@ devture_systemd_service_manager_services_list_auto: |
+
([{'name': 'matrix-heisenbridge.service', 'priority': 2000, 'groups': ['matrix', 'bridges', 'heisenbridge']}] if matrix_heisenbridge_enabled else [])
+
([{'name': 'matrix-hookshot.service', 'priority': 2000, 'groups': ['matrix', 'bridges', 'hookshot']}] if matrix_hookshot_enabled else [])
([{'name': 'matrix-hookshot.service', 'priority': 2000, 'groups': ['matrix', 'bridges', 'hookshot', 'bridge-hookshot']}] if matrix_hookshot_enabled else [])
+
([{'name': 'matrix-mautrix-discord.service', 'priority': 2000, 'groups': ['matrix', 'bridges', 'mautrix-discord']}] if matrix_mautrix_discord_enabled else [])
+
@ -352,6 +363,8 @@ devture_systemd_service_manager_services_list_auto: |
+
(matrix_ssl_renewal_systemd_units_list | selectattr('applicable') | selectattr('enableable') | list )
+
([{'name': (matrix_homeserver_proxy_ident + '.service'), 'priority': 3000, 'groups': ['matrix', 'reverse-proxies']}] if matrix_homeserver_proxy_enabled else [])
+
([{'name': (ntfy_identifier + '.service'), 'priority': 800, 'groups': ['matrix', 'ntfy']}] if ntfy_enabled else [])
+
([{'name': (devture_postgres_identifier + '.service'), 'priority': 500, 'groups': ['matrix', 'postgres']}] if devture_postgres_enabled else [])
@ -445,28 +458,39 @@ devture_playbook_state_preserver_commit_hash_preservation_dst: "{{ matrix_base_d
matrix_identity_server_url: "{{ ('https://' + matrix_server_fqn_matrix) if matrix_ma1sd_enabled else None }}"
matrix_homeserver_container_url: |-
matrix_homeserver_systemd_services_list: |-
{{
'http://matrix-nginx-proxy:12080' if matrix_nginx_proxy_enabled else {
'synapse': ('http://matrix-synapse-reverse-proxy-companion:8008' if matrix_synapse_reverse_proxy_companion_enabled else 'http://matrix-synapse:'+ matrix_synapse_container_client_api_port|string),
'dendrite': ('http://matrix-dendrite:' + matrix_dendrite_http_bind_port|string),
'conduit': ('http://matrix-conduit:' + matrix_conduit_port_number|string),
(
([('matrix-' + matrix_homeserver_implementation + '.service')] if matrix_homeserver_implementation != 'synapse' else [])
+
([('matrix-' + matrix_homeserver_implementation + '.service')] if matrix_homeserver_implementation == 'synapse' and not matrix_synapse_reverse_proxy_companion_enabled else [])
+
(['matrix-synapse-reverse-proxy-companion.service'] if matrix_synapse_reverse_proxy_companion_enabled else [])
) | unique
}}
matrix_homeserver_container_client_api_endpoint: |-
{{
{
'synapse': ('matrix-synapse-reverse-proxy-companion:8008' if matrix_synapse_reverse_proxy_companion_enabled else 'http://matrix-synapse:'+ matrix_synapse_container_client_api_port|string),
'dendrite': ('matrix-dendrite:' + matrix_dendrite_http_bind_port|string),
'conduit': ('matrix-conduit:' + matrix_conduit_port_number|string),
}[matrix_homeserver_implementation]
}}
matrix_homeserver_container_federation_url: |-
matrix_homeserver_container_federation_api_endpoint: |-
{{
'http://matrix-nginx-proxy:12088' if matrix_nginx_proxy_enabled else {
'synapse': ('http://matrix-synapse-reverse-proxy-companion:8048' if matrix_synapse_reverse_proxy_companion_enabled else 'http://matrix-synapse:'+ matrix_synapse_container_federation_api_plain_port|string),
'dendrite': ('http://matrix-dendrite:' + matrix_dendrite_http_bind_port|string),
'conduit': ('http://matrix-conduit:' + matrix_conduit_port_number|string),
{
'synapse': ('matrix-synapse-reverse-proxy-companion:8048' if matrix_synapse_reverse_proxy_companion_enabled else 'http://matrix-synapse:'+ matrix_synapse_container_federation_api_plain_port|string),
'dendrite': ('matrix-dendrite:' + matrix_dendrite_http_bind_port|string),
'conduit': ('matrix-conduit:' + matrix_conduit_port_number|string),
}[matrix_homeserver_implementation]
}}
matrix_homeserver_container_network: |-
{{
matrix_nginx_proxy_container_network if matrix_nginx_proxy_enabled else {
'synapse': matrix_synapse_container_network,
{
'synapse': (matrix_synapse_reverse_proxy_companion_container_network if matrix_synapse_reverse_proxy_companion_enabled else matrix_synapse_container_network),
'dendrite': matrix_dendrite_container_network,
'conduit': matrix_conduit_container_network,
}[matrix_homeserver_implementation]
@ -862,22 +886,35 @@ matrix_mautrix_facebook_enabled: false
matrix_mautrix_facebook_container_image_self_build: "{{ matrix_architecture not in ['amd64', 'arm64'] }}"
matrix_mautrix_facebook_systemd_required_services_list: |
matrix_mautrix_facebook_container_network: "{{ matrix_bridges_container_network }}"
matrix_mautrix_facebook_container_additional_networks_auto: |-
{{
['docker.service']
(
([] if matrix_bridges_homeserver_container_network == '' else [matrix_bridges_homeserver_container_network])
+
['matrix-' + matrix_homeserver_implementation + '.service']
([devture_postgres_container_network] if devture_postgres_enabled and matrix_mautrix_facebook_database_hostname == devture_postgres_connection_hostname else [])
+
([devture_postgres_identifier ~ '.service'] if devture_postgres_enabled else [])
([matrix_playbook_reverse_proxyable_services_additional_network] if matrix_playbook_reverse_proxyable_services_additional_network and matrix_mautrix_facebook_container_labels_traefik_enabled else [])
) | unique
}}
matrix_mautrix_facebook_systemd_required_services_list_auto: |
{{
matrix_bots_homeserver_systemd_services_list
+
(['matrix-nginx-proxy.service'] if matrix_nginx_proxy_enabled else [])
([devture_postgres_identifier ~ '.service'] if devture_postgres_enabled and matrix_mautrix_facebook_database_hostname == devture_postgres_connection_hostname else [])
}}
matrix_mautrix_facebook_appservice_token: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'fb.as.token', rounds=655555) | to_uuid }}"
matrix_mautrix_facebook_homeserver_address: "{{ matrix_bridges_homeserver_client_api_url }}"
matrix_mautrix_facebook_homeserver_token: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'fb.hs.token', rounds=655555) | to_uuid }}"
matrix_mautrix_facebook_public_endpoint: "/{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'facebook', rounds=655555) | to_uuid }}"
matrix_mautrix_facebook_appservice_public_enabled: true
matrix_mautrix_facebook_appservice_public_hostname: "{{ matrix_server_fqn_matrix }}"
matrix_mautrix_facebook_appservice_public_prefix: "/{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'facebook', rounds=655555) | to_uuid }}"
matrix_mautrix_facebook_container_http_host_bind_port: "{{ (matrix_playbook_service_host_bind_interface_prefix ~ '9008') if matrix_playbook_service_host_bind_interface_prefix else '' }}"
@ -885,18 +922,25 @@ matrix_mautrix_facebook_login_shared_secret: "{{ matrix_synapse_ext_password_pro
matrix_mautrix_facebook_bridge_presence: "{{ matrix_synapse_presence_enabled if matrix_synapse_enabled else true }}"
# People using an external Prometheus server will need to toggle all of these to be able to consume metrics remotely:
# - `matrix_mautrix_facebook_metrics_enabled`
# - `matrix_mautrix_facebook_proxying_metrics_enabled`
# - `matrix_nginx_proxy_proxy_matrix_metrics_enabled`
matrix_mautrix_facebook_metrics_enabled: "{{ prometheus_enabled }}"
matrix_mautrix_facebook_metrics_proxying_enabled: "{{ matrix_mautrix_facebook_metrics_enabled and matrix_metrics_exposure_enabled }}"
matrix_mautrix_facebook_metrics_proxying_hostname: "{{ matrix_metrics_exposure_hostname }}"
matrix_mautrix_facebook_metrics_proxying_path_prefix: "{{ matrix_metrics_exposure_path_prefix }}/mautrix-facebook"
matrix_mautrix_facebook_container_labels_metrics_middleware_basic_auth_enabled: "{{ matrix_metrics_exposure_http_basic_auth_enabled }}"
matrix_mautrix_facebook_container_labels_metrics_middleware_basic_auth_users: "{{ matrix_metrics_exposure_http_basic_auth_users }}"
# We'd like to force-set people with external Postgres to SQLite, so the bridge role can complain
# and point them to a migration path.
matrix_mautrix_facebook_database_engine: "{{ 'postgres' if devture_postgres_enabled else 'sqlite' }}"
matrix_mautrix_facebook_database_hostname: "{{ devture_postgres_connection_hostname if devture_postgres_enabled else '' }}"
matrix_mautrix_facebook_database_password: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'mau.fb.db', rounds=655555) | to_uuid }}"
matrix_mautrix_facebook_container_labels_traefik_enabled: "{{ matrix_playbook_reverse_proxy_type in ['playbook-managed-traefik', 'other-traefik-container'] }}"
matrix_mautrix_facebook_container_labels_traefik_docker_network: "{{ matrix_playbook_reverse_proxyable_services_additional_network }}"
matrix_mautrix_facebook_container_labels_traefik_entrypoints: "{{ devture_traefik_entrypoint_primary }}"
matrix_mautrix_facebook_container_labels_traefik_tls_certResolver: "{{ devture_traefik_certResolver_primary }}"
######################################################################
#
# /matrix-bridge-mautrix-facebook
@ -1374,11 +1418,11 @@ matrix_hookshot_appservice_token: "{{ '%s' | format(matrix_homeserver_generic_se
matrix_hookshot_homeserver_token: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'hookshot.hs.tok', rounds=655555) | to_uuid }}"
matrix_hookshot_homeserver_address: "{{ matrix_bridges_homeserver_client_api_url }}"
matrix_hookshot_systemd_wanted_services_list: |
{{
(['matrix-' + matrix_homeserver_implementation + '.service'])
+
(['matrix-nginx-proxy.service'] if matrix_nginx_proxy_enabled else [])
matrix_bridges_homeserver_systemd_services_list
+
([(redis_identifier + '.service')] if redis_enabled and matrix_hookshot_queue_host == redis_identifier else [])
}}
@ -1388,9 +1432,15 @@ matrix_hookshot_systemd_wanted_services_list: |
# because connectivity is still potentially troublesome and is to be investigated.
matrix_hookshot_queue_host: "{{ redis_identifier if redis_enabled and matrix_hookshot_experimental_encryption_enabled else '' }}"
matrix_hookshot_container_network: "{{ matrix_bridges_container_network }}"
matrix_hookshot_container_additional_networks_auto: |
{{
(
([] if matrix_bridges_homeserver_container_network == '' else [matrix_bridges_homeserver_container_network])
+
([redis_container_network] if redis_enabled and matrix_hookshot_queue_host == redis_identifier else [])
)
}}
matrix_hookshot_container_http_host_bind_ports_defaultmapping:
@ -1411,6 +1461,13 @@ matrix_hookshot_provisioning_enabled: "{{ matrix_hookshot_provisioning_secret an
# - `matrix_nginx_proxy_proxy_matrix_metrics_enabled`
matrix_hookshot_metrics_enabled: "{{ prometheus_enabled }}"
# TODO - implement
# matrix_hookshot_metrics_metrics_proxying_enabled: "{{ matrix_hookshot_metrics_enabled and matrix_metrics_exposure_enabled }}"
# matrix_hookshot_metrics_metrics_proxying_hostname: "{{ matrix_metrics_exposure_hostname }}"
# matrix_hookshot_metrics_metrics_proxying_path_prefix: "{{ matrix_metrics_exposure_path_prefix }}/hookshot"
# matrix_hookshot_metrics_container_labels_metrics_middleware_basic_auth_enabled: "{{ matrix_metrics_exposure_http_basic_auth_enabled }}"
# matrix_hookshot_metrics_container_labels_metrics_middleware_basic_auth_users: "{{ matrix_metrics_exposure_http_basic_auth_users }}"
matrix_hookshot_urlprefix_port_enabled: "{{ matrix_nginx_proxy_container_https_host_bind_port == 443 if matrix_nginx_proxy_https_enabled else matrix_nginx_proxy_container_https_host_bind_port == 80 }}"
matrix_hookshot_urlprefix_port: ":{{ matrix_nginx_proxy_container_https_host_bind_port if matrix_nginx_proxy_https_enabled else matrix_nginx_proxy_container_http_host_bind_port }}"
matrix_hookshot_urlprefix: "{{ 'https' if matrix_playbook_ssl_enabled else 'http' }}://{{ matrix_server_fqn_matrix }}{{ matrix_hookshot_urlprefix_port if matrix_hookshot_urlprefix_port_enabled else '' }}"
@ -1668,15 +1725,11 @@ matrix_mx_puppet_groupme_database_password: "{{ '%s' | format(matrix_homeserver_
# We don't enable bots by default.
matrix_bot_matrix_reminder_bot_enabled: false
matrix_bot_matrix_reminder_bot_systemd_required_services_list: |
matrix_bot_matrix_reminder_bot_systemd_required_services_list_auto: |
{{
['docker.service']
matrix_bots_homeserver_systemd_services_list
+
['matrix-' + matrix_homeserver_implementation + '.service']
+
([devture_postgres_identifier ~ '.service'] if devture_postgres_enabled else [])
+
(['matrix-nginx-proxy.service'] if matrix_nginx_proxy_enabled else [])
([devture_postgres_identifier ~ '.service'] if devture_postgres_enabled and matrix_bot_matrix_reminder_bot_database_hostname == devture_postgres_connection_hostname else [])
}}
# Postgres is the default, except if not using internal Postgres server
@ -1685,6 +1738,18 @@ matrix_bot_matrix_reminder_bot_database_hostname: "{{ devture_postgres_connectio
matrix_bot_matrix_reminder_bot_database_password: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'reminder.bot.db', rounds=655555) | to_uuid }}"
matrix_bot_matrix_reminder_bot_container_image_self_build: "{{ matrix_architecture != 'amd64' }}"
matrix_bot_matrix_reminder_bot_container_network: "{{ matrix_bots_container_network }}"
matrix_bot_matrix_reminder_bot_container_additional_networks_auto: |-
{{
(
([] if matrix_bots_homeserver_container_network == '' else [matrix_bots_homeserver_container_network])
+
([devture_postgres_container_network] if devture_postgres_enabled and matrix_bot_matrix_reminder_bot_database_hostname == devture_postgres_connection_hostname else [])
) | unique
}}
matrix_bot_matrix_reminder_bot_matrix_homeserver_url: "{{ matrix_bots_homeserver_client_api_url }}"
######################################################################
#
# /matrix-bot-matrix-reminder-bot
@ -1938,13 +2003,11 @@ matrix_bot_postmoogle_tls_key: |-
matrix_playbook_bot_postmoogle_traefik_certs_dumper_waiter_services: "{% for domain in matrix_bot_postmoogle_domains %}{{ devture_traefik_certs_dumper_identifier }}-wait-for-domain@{{ domain }}.service {% endfor %}"
matrix_bot_postmoogle_systemd_required_services_list: |
matrix_bot_postmoogle_systemd_required_services_list_auto: |
{{
['docker.service']
matrix_bots_homeserver_systemd_services_list
+
([devture_postgres_identifier ~ '.service'] if devture_postgres_enabled else [])
+
(['matrix-synapse.service'] if matrix_synapse_enabled else [])
([devture_postgres_identifier ~ '.service'] if devture_postgres_enabled and matrix_bot_postmoogle_database_hostname == matrix_bot_postmoogle_database_hostname else [])
+
(matrix_playbook_bot_postmoogle_traefik_certs_dumper_waiter_services | trim | split(' ') if matrix_playbook_reverse_proxy_type in ['playbook-managed-traefik', 'other-traefik-container'] and devture_traefik_certs_dumper_enabled else [])
}}
@ -1954,6 +2017,19 @@ matrix_bot_postmoogle_database_engine: "{{ 'postgres' if devture_postgres_enable
matrix_bot_postmoogle_database_hostname: "{{ devture_postgres_connection_hostname if devture_postgres_enabled else '' }}"
matrix_bot_postmoogle_database_password: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'postmoogle.db', rounds=655555) | to_uuid }}"
matrix_bot_postmoogle_homeserver: "{{ matrix_bots_homeserver_client_api_url }}"
matrix_bot_postmoogle_container_network: "{{ matrix_bots_container_network }}"
matrix_bot_postmoogle_container_additional_networks_auto: |-
{{
(
([] if matrix_bots_homeserver_container_network == '' else [matrix_bots_homeserver_container_network])
+
([devture_postgres_container_network] if devture_postgres_enabled and matrix_bot_matrix_reminder_bot_database_hostname == devture_postgres_connection_hostname else [])
) | unique
}}
######################################################################
#
# /matrix-bot-postmoogle
@ -1972,6 +2048,13 @@ matrix_bot_chatgpt_enabled: false
matrix_bot_chatgpt_container_image_self_build: "{{ matrix_architecture not in ['amd64', 'arm64'] }}"
matrix_bot_chatgpt_container_network: "{{ matrix_bots_container_network }}"
matrix_bot_chatgpt_container_additional_networks_auto: "{{ [] if matrix_bots_homeserver_container_network == '' else [matrix_bots_homeserver_container_network] }}"
matrix_bot_chatgpt_matrix_homeserver_url: "{{ matrix_bots_homeserver_client_api_url }}"
matrix_bot_chatgpt_systemd_required_services_list_auto: "{{ matrix_bots_homeserver_systemd_services_list }}"
######################################################################
#
# /matrix-bot-chatgpt
@ -2974,6 +3057,81 @@ matrix_nginx_proxy_access_log_syslog_integration_server_port: "{{ (matrix_promet
######################################################################
######################################################################
# #
# matrix-homeserver-proxy #
# #
######################################################################
# The playbook always enables the homeserver proxy for now.
# TODO - consider not enabling it if not necessary
matrix_homeserver_proxy_enabled: true
matrix_homeserver_proxy_access_log_syslog_integration_enabled: "{{ matrix_prometheus_nginxlog_exporter_enabled }}"
matrix_homeserver_proxy_access_log_syslog_integration_server_port: "{{ (matrix_prometheus_nginxlog_exporter_container_hostname | string + ':' + matrix_prometheus_nginxlog_exporter_container_syslog_port | string) | default('') }}"
matrix_homeserver_proxy_container_additional_networks: |
{{
(
([matrix_playbook_reverse_proxyable_services_additional_network] if matrix_playbook_reverse_proxyable_services_additional_network else [])
+
([
{
'synapse': matrix_synapse_container_network,
'dendrite': matrix_dendrite_container_network,
'conduit': matrix_conduit_container_network,
}[matrix_homeserver_implementation] | string
])
) | unique
}}
matrix_homeserver_proxy_client_api_addr: "{{ 'matrix-corporal:41080' if matrix_corporal_enabled else matrix_homeserver_container_client_api_endpoint }}"
matrix_homeserver_proxy_client_api_client_max_body_size_mb: |-
{{
{
'synapse': matrix_synapse_max_upload_size_mb,
'dendrite': (matrix_dendrite_max_file_size_bytes / 1024 / 1024) | round,
'conduit': (matrix_conduit_max_request_size / 1024 / 1024) | round,
}[matrix_homeserver_implementation]|int
}}
matrix_homeserver_proxy_federation_api_addr: "{{ matrix_homeserver_container_federation_api_endpoint }}"
# matrix_nginx_proxy_proxy_matrix_identity_api_enabled: "{{ matrix_ma1sd_enabled }}"
# matrix_nginx_proxy_proxy_matrix_identity_api_addr_with_container: "matrix-ma1sd:{{ matrix_ma1sd_container_port }}"
# matrix_nginx_proxy_proxy_matrix_identity_api_addr_sans_container: "127.0.0.1:{{ matrix_ma1sd_container_port }}"
# # NOTE: we cannot disable this, even though matrix-media-repo is already natively exposed at the Traefik level.
# # See: https://github.com/spantaleev/matrix-docker-ansible-deploy/pull/3045#issuecomment-1867327001
# matrix_nginx_proxy_proxy_media_repo_enabled: "{{ matrix_media_repo_enabled }}"
# matrix_nginx_proxy_proxy_media_repo_addr_with_container: "{{ matrix_media_repo_identifier }}:{{ matrix_media_repo_port }}"
# matrix_nginx_proxy_proxy_media_repo_addr_sans_container: "127.0.0.1:{{ matrix_media_repo_port }}"
# matrix_nginx_proxy_proxy_matrix_user_directory_search_enabled: "{{ matrix_ma1sd_enabled }}"
# matrix_nginx_proxy_proxy_matrix_user_directory_search_addr_with_container: "{{ matrix_nginx_proxy_proxy_matrix_identity_api_addr_with_container }}"
# matrix_nginx_proxy_proxy_matrix_user_directory_search_addr_sans_container: "{{ matrix_nginx_proxy_proxy_matrix_identity_api_addr_sans_container }}"
matrix_homeserver_proxy_systemd_wanted_services_list_auto: |
{{
matrix_homeserver_systemd_services_list
+
(['matrix-corporal.service'] if matrix_corporal_enabled else [])
+
(['matrix-ma1sd.service'] if matrix_ma1sd_enabled else [])
+
([(matrix_media_repo_identifier + '.service')] if matrix_media_repo_enabled else [])
}}
# matrix_nginx_proxy_access_log_syslog_integration_enabled: "{{ matrix_prometheus_nginxlog_exporter_enabled }}"
# matrix_nginx_proxy_access_log_syslog_integration_server_port: "{{ (matrix_prometheus_nginxlog_exporter_container_hostname | string +':'+ matrix_prometheus_nginxlog_exporter_container_syslog_port | string) | default('') }}"
######################################################################
# #
# /matrix-homeserver-proxy #
# #
######################################################################
########################################################################
# #
# com.devture.ansible.role.postgres #
@ -4157,7 +4315,7 @@ matrix_sliding_sync_container_additional_networks: |
(
([matrix_playbook_reverse_proxyable_services_additional_network] if matrix_playbook_reverse_proxyable_services_additional_network else [])
+
([matrix_nginx_proxy_container_network] if matrix_nginx_proxy_enabled and matrix_nginx_proxy_container_network != matrix_sliding_sync_container_network else [])
([] if matrix_homeserver_container_network in ['', matrix_sliding_sync_container_network] else [matrix_homeserver_container_network])
+
([devture_postgres_container_network] if devture_postgres_enabled and devture_postgres_container_network != matrix_sliding_sync_container_network else [])
) | unique
@ -4172,11 +4330,9 @@ matrix_sliding_sync_systemd_required_services_list: |
{{
['docker.service']
+
['matrix-' + matrix_homeserver_implementation + '.service']
matrix_homeserver_systemd_services_list
+
([devture_postgres_identifier ~ '.service'] if devture_postgres_enabled else [])
+
(['matrix-nginx-proxy.service'] if matrix_nginx_proxy_enabled else [])
}}
matrix_sliding_sync_environment_variable_syncv3_secret: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'ss.secret', rounds=655555) | to_uuid }}"
@ -4184,9 +4340,6 @@ matrix_sliding_sync_environment_variable_syncv3_secret: "{{ '%s' | format(matrix
matrix_sliding_sync_database_hostname: "{{ devture_postgres_connection_hostname if devture_postgres_enabled else '' }}"
matrix_sliding_sync_database_password: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'ss.db', rounds=655555) | to_uuid }}"
# Starting from version `0.6.0` conduit natively supports some sync v3 (sliding-sync) features.
matrix_homeserver_sliding_sync_url: "{{ matrix_sliding_sync_base_url if matrix_sliding_sync_enabled else matrix_homeserver_url if matrix_conduit_enabled else '' }}"
######################################################################
#
# /matrix-sliding-sync

57
roles/custom/matrix-base/defaults/main.yml
View File

@ -19,6 +19,30 @@ matrix_bridges_encryption_enabled: false
# Global var to enable/disable relay mode across all bridges with relay mode support
matrix_bridges_relay_enabled: false
# A container network where all bridges would live.
matrix_bridges_container_network: matrix-bridges
# The container network that the homeserver lives on and bridges should be connected to
matrix_bridges_homeserver_container_network: "{{ matrix_homeserver_container_network }}"
# The URL where bridges can reach the homeserver.
matrix_bridges_homeserver_client_api_url: "{{ matrix_homeserver_container_url }}"
# The systemd services (representing the homeserver) that bridges should depend on
matrix_bridges_homeserver_systemd_services_list: "{{ matrix_homeserver_systemd_services_list }}"
# A container network where all bots would live.
matrix_bots_container_network: matrix-bots
# The container network that the homeserver lives on and bots should be connected to
matrix_bots_homeserver_container_network: "{{ matrix_homeserver_container_network }}"
# The URL where bots can reach the homeserver.
matrix_bots_homeserver_client_api_url: "{{ matrix_homeserver_container_url }}"
# The systemd services (representing the homeserver) that bots should depend on
matrix_bots_homeserver_systemd_services_list: "{{ matrix_homeserver_systemd_services_list }}"
# matrix_homeserver_enabled controls whether to enable the homeserver systemd service, etc.
#
# Unless you're wrapping this playbook in another one
@ -146,15 +170,27 @@ matrix_host_command_openssl: "/usr/bin/env openssl"
matrix_homeserver_url: "https://{{ matrix_server_fqn_matrix }}"
# Specifies where the homeserver's Client-Server API is on the container network.
# Where this is depends on whether there's a reverse-proxy in front of the homeserver, which homeserver it is, etc.
# This likely gets overriden elsewhere.
matrix_homeserver_container_url: ""
# Specifies on which container network the homeserver is.
matrix_homeserver_container_network: ""
# Specifies where the homeserver's Federation API is on the container network.
# Specifies which systemd services are responsible for the homeserver
matrix_homeserver_systemd_services_list: []
# Specifies where the homeserver's Client-Server API is on the container network (matrix_homeserver_container_network).
matrix_homeserver_container_url: "http://{{ matrix_homeserver_container_client_api_endpoint }}"
# Specifies where the homeserver's Client-Server API is on the container network (matrix_homeserver_container_network).
# Where this is depends on whether there's a reverse-proxy in front of the homeserver, which homeserver it is, etc.
# This likely gets overriden elsewhere.
matrix_homeserver_container_federation_url: ""
matrix_homeserver_container_client_api_endpoint: ""
# Specifies where the homeserver's Federation API is on the container network (matrix_homeserver_container_network).
matrix_homeserver_container_federation_url: "http://{{ matrix_homeserver_container_federation_api_endpoint }}"
# Specifies where the homeserver's Federation API is on the container network (matrix_homeserver_container_network).
# Where this is depends on whether there's a reverse-proxy in front of the homeserver, which homeserver it is, etc.
# This likely gets overriden elsewhere.
matrix_homeserver_container_federation_api_endpoint: ""
# Specifies the public url of the Sync v3 (sliding-sync) API.
# This will be used to set the `org.matrix.msc3575.proxy` property in `/.well-known/matrix/client`.
@ -294,6 +330,15 @@ matrix_well_known_matrix_support_enabled: false
matrix_homeserver_container_extra_arguments_auto: []
matrix_homeserver_app_service_config_files_auto: []
# Controls whether various services should expose metrics publicly.
# If Prometheus is operating on the same machine, exposing metrics publicly is not necessary.
matrix_metrics_exposure_enabled: false
matrix_metrics_exposure_hostname: "{{ matrix_server_fqn_matrix }}"
matrix_metrics_exposure_path_prefix: /metrics
matrix_metrics_exposure_http_basic_auth_enabled: false
# See https://doc.traefik.io/traefik/middlewares/http/basicauth/#users
matrix_metrics_exposure_http_basic_auth_users: ''
# Specifies the type of reverse-proxy used by the playbook.
#
# Changing this has an effect on whether a reverse-proxy is installed at all and what its type is,

4
roles/custom/matrix-base/tasks/validate_config.yml
View File

@ -44,8 +44,8 @@
- {'var': matrix_domain, 'value': "{{ matrix_domain | default('') }}"}
- {'var': matrix_server_fqn_matrix, 'value': "{{ matrix_server_fqn_matrix | default('') }}"}
- {'var': matrix_server_fqn_element, 'value': "{{ matrix_server_fqn_element | default('') }}"}
- {'var': matrix_homeserver_container_url, 'value': "{{ matrix_homeserver_container_url | default('') }}"}
- {'var': matrix_homeserver_container_federation_url, 'value': "{{ matrix_homeserver_container_federation_url | default('') }}"}
- {'var': matrix_homeserver_container_client_api_endpoint, 'value': "{{ matrix_homeserver_container_client_api_endpoint | default('') }}"}
- {'var': matrix_homeserver_container_federation_api_endpoint, 'value': "{{ matrix_homeserver_container_federation_api_endpoint | default('') }}"}
- {'var': matrix_architecture, 'value': "{{ matrix_architecture | default('') }}"}
when: "item.value is none or item.value == ''"

13
roles/custom/matrix-bot-chatgpt/defaults/main.yml
View File

@ -26,11 +26,20 @@ matrix_bot_chatgpt_container_src_path: "{{ matrix_bot_chatgpt_base_path }}/conta
# We use a small value here, because this container does not seem to handle the SIGTERM signal.
matrix_bot_chatgpt_container_stop_grace_time_seconds: 1
matrix_bot_chatgpt_container_network: ""
matrix_bot_chatgpt_container_additional_networks: "{{ matrix_bot_chatgpt_container_additional_networks_auto + matrix_bot_chatgpt_container_additional_networks_custom }}"
matrix_bot_chatgpt_container_additional_networks_auto: []
matrix_bot_chatgpt_container_additional_networks_custom: []
# A list of extra arguments to pass to the container
matrix_bot_chatgpt_container_extra_arguments: []
# List of systemd services that matrix-bot-chatgpt.service depends on
matrix_bot_chatgpt_systemd_required_services_list: ['docker.service']
matrix_bot_chatgpt_systemd_required_services_list: "{{ matrix_bot_chatgpt_systemd_required_services_list_default + matrix_bot_chatgpt_systemd_required_services_list_auto + matrix_bot_chatgpt_systemd_required_services_list_custom }}"
matrix_bot_chatgpt_systemd_required_services_list_default: ['docker.service']
matrix_bot_chatgpt_systemd_required_services_list_auto: []
matrix_bot_chatgpt_systemd_required_services_list_custom: []
# List of systemd services that matrix-bot-chatgpt.service wants
matrix_bot_chatgpt_systemd_wanted_services_list: []
@ -47,7 +56,7 @@ matrix_bot_chatgpt_keyv_bot_storage: true
# Matrix Static Settings (required, see notes)
# Defaults to "https://matrix.org"
matrix_bot_chatgpt_matrix_homeserver_url: "{{ matrix_homeserver_container_url }}" # MATRIX_HOMESERVER_URL=
matrix_bot_chatgpt_matrix_homeserver_url: "" # MATRIX_HOMESERVER_URL=
# With the @ and :DOMAIN, ie @SOMETHING:DOMAIN, needs to be set, created manually beforehand.
matrix_bot_chatgpt_matrix_bot_username_localpart: 'bot.chatgpt'
matrix_bot_chatgpt_matrix_bot_username: "@{{ matrix_bot_chatgpt_matrix_bot_username_localpart }}:{{ matrix_domain }}" # MATRIX_BOT_USERNAME=

5
roles/custom/matrix-bot-chatgpt/tasks/install.yml
View File

@ -56,6 +56,11 @@
path: "{{ matrix_bot_chatgpt_container_src_path }}"
pull: true
- name: Ensure chatgpt container network is created
community.general.docker_network:
name: "{{ matrix_bot_chatgpt_container_network }}"
driver: bridge
- name: Ensure matrix-bot-chatgpt.service installed
ansible.builtin.template:
src: "{{ role_path }}/templates/systemd/matrix-bot-chatgpt.service.j2"

2
roles/custom/matrix-bot-chatgpt/tasks/validate_config.yml
View File

@ -8,6 +8,8 @@
with_items:
- {'name': 'matrix_bot_chatgpt_openai_api_key', when: true}
- {'name': 'matrix_bot_chatgpt_matrix_bot_username', when: true}
- {'name': 'matrix_bot_chatgpt_container_network', when: true}
- {'name': 'matrix_bot_chatgpt_matrix_homeserver_url', when: true}
- name: Fail if OpenAI configuration not up-to-date.
ansible.builtin.fail:

10
roles/custom/matrix-bot-chatgpt/templates/systemd/matrix-bot-chatgpt.service.j2
View File

@ -16,7 +16,7 @@ Environment="HOME={{ devture_systemd_docker_base_systemd_unit_home_path }}"
ExecStartPre=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} stop --time={{ matrix_bot_chatgpt_container_stop_grace_time_seconds }} matrix-bot-chatgpt 2>/dev/null || true'
ExecStartPre=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} rm matrix-bot-chatgpt 2>/dev/null || true'
ExecStart={{ devture_systemd_docker_base_host_command_docker }} run \
ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} create \
--rm \
--name=matrix-bot-chatgpt \
--log-driver=none \
@ -24,7 +24,7 @@ ExecStart={{ devture_systemd_docker_base_host_command_docker }} run \
--cap-drop=ALL \
--read-only \
--tmpfs /tmp \
--network={{ matrix_docker_network }} \
--network={{ matrix_bot_chatgpt_container_network }} \
--env-file={{ matrix_bot_chatgpt_config_path }}/env \
--mount type=bind,src={{ matrix_bot_chatgpt_data_path }},dst=/data \
--env HOME=/data/home \
@ -33,6 +33,12 @@ ExecStart={{ devture_systemd_docker_base_host_command_docker }} run \
{% endfor %}
{{ matrix_bot_chatgpt_container_image }}
{% for network in matrix_bot_chatgpt_container_additional_networks %}
ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} network connect {{ network }} matrix-bot-chatgpt
{% endfor %}
ExecStart={{ devture_systemd_docker_base_host_command_docker }} start --attach matrix-bot-chatgpt
ExecStop=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} stop --time={{ matrix_bot_chatgpt_container_stop_grace_time_seconds }} matrix-bot-chatgpt 2>/dev/null || true'
ExecStop=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} rm matrix-bot-chatgpt 2>/dev/null || true'
Restart=always

14
roles/custom/matrix-bot-matrix-reminder-bot/defaults/main.yml
View File

@ -24,13 +24,21 @@ matrix_bot_matrix_reminder_bot_command_prefix: "!"
# A list of extra arguments to pass to the container
matrix_bot_matrix_reminder_bot_container_extra_arguments: []
matrix_bot_matrix_reminder_bot_container_network: ""
matrix_bot_matrix_reminder_bot_container_additional_networks: "{{ matrix_bot_matrix_reminder_bot_container_additional_networks_auto + matrix_bot_matrix_reminder_bot_container_additional_networks_custom }}"
matrix_bot_matrix_reminder_bot_container_additional_networks_auto: []
matrix_bot_matrix_reminder_bot_container_additional_networks_custom: []
# List of systemd services that matrix-bot-matrix-reminder-bot.service depends on
matrix_bot_matrix_reminder_bot_systemd_required_services_list: ['docker.service']
matrix_bot_matrix_reminder_bot_systemd_required_services_list: "{{ matrix_bot_matrix_reminder_bot_systemd_required_services_list_default + matrix_bot_matrix_reminder_bot_systemd_required_services_list_auto + matrix_bot_matrix_reminder_bot_systemd_required_services_list_custom }}"
matrix_bot_matrix_reminder_bot_systemd_required_services_list_default: ['docker.service']
matrix_bot_matrix_reminder_bot_systemd_required_services_list_auto: []
matrix_bot_matrix_reminder_bot_systemd_required_services_list_custom: []
# List of systemd services that matrix-bot-matrix-reminder-bot.service wants
matrix_bot_matrix_reminder_bot_systemd_wanted_services_list: []
# Database-related configuration fields.
#
# To use SQLite, stick to these defaults.
@ -68,7 +76,7 @@ matrix_bot_matrix_reminder_bot_matrix_user_id: '@{{ matrix_bot_matrix_reminder_b
# The password that the bot uses to authenticate.
matrix_bot_matrix_reminder_bot_matrix_user_password: ''
matrix_bot_matrix_reminder_bot_matrix_homeserver_url: "{{ matrix_homeserver_container_url }}"
matrix_bot_matrix_reminder_bot_matrix_homeserver_url: ""
# The timezone to use when creating reminders.
# Examples: 'Europe/London', 'Etc/UTC'

2
roles/custom/matrix-bot-matrix-reminder-bot/tasks/validate_config.yml
View File

@ -8,6 +8,8 @@
with_items:
- {'name': 'matrix_bot_matrix_reminder_bot_matrix_user_password', when: true}
- {'name': 'matrix_bot_matrix_reminder_bot_reminders_timezone', when: true}
- {'name': 'matrix_bot_matrix_reminder_bot_container_network', when: true}
- {'name': 'matrix_bot_matrix_reminder_bot_matrix_homeserver_url', when: true}
- {'name': 'matrix_bot_matrix_reminder_bot_database_hostname', when: "{{ matrix_bot_matrix_reminder_bot_database_engine == 'postgres' }}"}
- name: (Deprecation) Catch and report renamed matrix-reminder-bot settings

12
roles/custom/matrix-bot-matrix-reminder-bot/templates/systemd/matrix-bot-matrix-reminder-bot.service.j2
View File

@ -16,12 +16,14 @@ Environment="HOME={{ devture_systemd_docker_base_systemd_unit_home_path }}"
ExecStartPre=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} stop --time={{ devture_systemd_docker_base_container_stop_grace_time_seconds }} matrix-bot-matrix-reminder-bot 2>/dev/null || true'
ExecStartPre=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} rm matrix-bot-matrix-reminder-bot 2>/dev/null || true'
ExecStart={{ devture_systemd_docker_base_host_command_docker }} run --rm --name matrix-bot-matrix-reminder-bot \
ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} create \
--rm \
--name=matrix-bot-matrix-reminder-bot \
--log-driver=none \
--user={{ matrix_user_uid }}:{{ matrix_user_gid }} \
--cap-drop=ALL \
--read-only \
--network={{ matrix_docker_network }} \
--network={{ matrix_bot_matrix_reminder_bot_container_network }} \
-e 'TZ={{ matrix_bot_matrix_reminder_bot_reminders_timezone }}' \
--mount type=bind,src={{ matrix_bot_matrix_reminder_bot_config_path }},dst=/config,ro \
--mount type=bind,src={{ matrix_bot_matrix_reminder_bot_data_path }},dst=/data \
@ -32,6 +34,12 @@ ExecStart={{ devture_systemd_docker_base_host_command_docker }} run --rm --name
{{ matrix_bot_matrix_reminder_bot_docker_image }} \
-c "matrix-reminder-bot /config/config.yaml"
{% for network in matrix_bot_matrix_reminder_bot_container_additional_networks %}
ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} network connect {{ network }} matrix-bot-matrix-reminder-bot
{% endfor %}
ExecStart={{ devture_systemd_docker_base_host_command_docker }} start --attach matrix-bot-matrix-reminder-bot
ExecStop=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} stop --time={{ devture_systemd_docker_base_container_stop_grace_time_seconds }} matrix-bot-matrix-reminder-bot 2>/dev/null || true'
ExecStop=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} rm matrix-bot-matrix-reminder-bot 2>/dev/null || true'
Restart=always

14
roles/custom/matrix-bot-postmoogle/defaults/main.yml
View File

@ -19,16 +19,24 @@ matrix_bot_postmoogle_base_path: "{{ matrix_base_data_path }}/postmoogle"
matrix_bot_postmoogle_config_path: "{{ matrix_bot_postmoogle_base_path }}/config"
matrix_bot_postmoogle_data_path: "{{ matrix_bot_postmoogle_base_path }}/data"
matrix_bot_postmoogle_container_network: ""
matrix_bot_postmoogle_container_additional_networks: "{{ matrix_bot_postmoogle_container_additional_networks_auto + matrix_bot_postmoogle_container_additional_networks_custom }}"
matrix_bot_postmoogle_container_additional_networks_auto: []
matrix_bot_postmoogle_container_additional_networks_custom: []
# A list of extra arguments to pass to the container
matrix_bot_postmoogle_container_extra_arguments: []
# List of systemd services that matrix-bot-postmoogle.service depends on
matrix_bot_postmoogle_systemd_required_services_list: ['docker.service']
matrix_bot_postmoogle_systemd_required_services_list: "{{ matrix_bot_postmoogle_systemd_required_services_list_default + matrix_bot_postmoogle_systemd_required_services_list_auto + matrix_bot_postmoogle_systemd_required_services_list_custom }}"
matrix_bot_postmoogle_systemd_required_services_list_default: ['docker.service']
matrix_bot_postmoogle_systemd_required_services_list_auto: []
matrix_bot_postmoogle_systemd_required_services_list_custom: []
# List of systemd services that matrix-bot-postmoogle.service wants
matrix_bot_postmoogle_systemd_wanted_services_list: []
# Database-related configuration fields.
#
# To use SQLite, stick to these defaults.
@ -75,7 +83,7 @@ matrix_bot_postmoogle_password: ''
# Alternative to password - shared secret requires matrix_bot_postmoogle_login to be MXID
matrix_bot_postmoogle_sharedsecret: ''
matrix_bot_postmoogle_homeserver: "{{ matrix_homeserver_container_url }}"
matrix_bot_postmoogle_homeserver: ""
# Command prefix
matrix_bot_postmoogle_prefix: '!pm'

5
roles/custom/matrix-bot-postmoogle/tasks/setup_install.yml
View File

@ -79,6 +79,11 @@
pull: true
when: "matrix_bot_postmoogle_container_image_self_build | bool"
- name: Ensure postmoogle container network is created
community.general.docker_network:
name: "{{ matrix_bot_postmoogle_container_network }}"
driver: bridge
- name: Ensure matrix-bot-postmoogle.service installed
ansible.builtin.template:
src: "{{ role_path }}/templates/systemd/matrix-bot-postmoogle.service.j2"

2
roles/custom/matrix-bot-postmoogle/tasks/validate_config.yml
View File

@ -7,4 +7,6 @@
when: "item.when | bool and vars[item.name] == ''"
with_items:
- {'name': 'matrix_bot_postmoogle_password', when: true}
- {'name': 'matrix_bot_postmoogle_container_network', when: true}
- {'name': 'matrix_bot_postmoogle_homeserver', when: true}
- {'name': 'matrix_bot_postmoogle_database_hostname', when: "{{ matrix_bot_postmoogle_database_engine == 'postgres' }}"}

12
roles/custom/matrix-bot-postmoogle/templates/systemd/matrix-bot-postmoogle.service.j2
View File

@ -16,12 +16,14 @@ Environment="HOME={{ devture_systemd_docker_base_systemd_unit_home_path }}"
ExecStartPre=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} stop --time={{ devture_systemd_docker_base_container_stop_grace_time_seconds }} matrix-bot-postmoogle 2>/dev/null || true'
ExecStartPre=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} rm matrix-bot-postmoogle 2>/dev/null || true'
ExecStart={{ devture_systemd_docker_base_host_command_docker }} run --rm --name matrix-bot-postmoogle \
ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} create \
--rm \
--name=matrix-bot-postmoogle \
--log-driver=none \
--user={{ matrix_user_uid }}:{{ matrix_user_gid }} \
--cap-drop=ALL \
--read-only \
--network={{ matrix_docker_network }} \
--network={{ matrix_bot_postmoogle_container_network }} \
--env-file={{ matrix_bot_postmoogle_config_path }}/env \
-p {{ matrix_bot_postmoogle_smtp_host_bind_port }}:{{ matrix_bot_postmoogle_port }} \
{% if matrix_bot_postmoogle_ssl_path %}
@ -36,6 +38,12 @@ ExecStart={{ devture_systemd_docker_base_host_command_docker }} run --rm --name
{% endfor %}
{{ matrix_bot_postmoogle_docker_image }}
{% for network in matrix_bot_postmoogle_container_additional_networks %}
ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} network connect {{ network }} matrix-bot-postmoogle
{% endfor %}
ExecStart={{ devture_systemd_docker_base_host_command_docker }} start --attach matrix-bot-postmoogle
ExecStop=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} stop --time={{ devture_systemd_docker_base_container_stop_grace_time_seconds }} matrix-bot-postmoogle 2>/dev/null || true'
ExecStop=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} rm matrix-bot-postmoogle 2>/dev/null || true'
Restart=always

5
roles/custom/matrix-bridge-hookshot/defaults/main.yml
View File

@ -224,7 +224,10 @@ matrix_hookshot_container_network: "{{ matrix_docker_network }}"
matrix_hookshot_container_extra_arguments: []
# List of systemd services that service depends on.
matrix_hookshot_systemd_required_services_list: ['docker.service']
matrix_hookshot_systemd_required_services_list: "{{ matrix_hookshot_systemd_required_services_list_default + matrix_hookshot_systemd_required_services_list_auto + matrix_hookshot_systemd_required_services_list_custom }}"
matrix_hookshot_systemd_required_services_list_default: ['docker.service']
matrix_hookshot_systemd_required_services_list_auto: []
matrix_hookshot_systemd_required_services_list_custom: []
# List of systemd services that service wants
matrix_hookshot_systemd_wanted_services_list: []

3
roles/custom/matrix-bridge-hookshot/tasks/main.yml
View File

@ -18,8 +18,10 @@
- tags:
- setup-all
- setup-hookshot
- setup-bridge-hookshot
- install-all
- install-hookshot
- install-bridge-hookshot
block:
- when: matrix_hookshot_enabled | bool
ansible.builtin.include_tasks: "{{ role_path }}/tasks/validate_config.yml"
@ -30,6 +32,7 @@
- tags:
- setup-all
- setup-hookshot
- setup-bridge-hookshot
block:
- when: not matrix_hookshot_enabled | bool
ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_uninstall.yml"

69
roles/custom/matrix-bridge-mautrix-facebook/defaults/main.yml
View File

@ -20,22 +20,69 @@ matrix_mautrix_facebook_docker_src_files_path: "{{ matrix_mautrix_facebook_base_
matrix_mautrix_facebook_command_prefix: "!fb"
# Whether or not the public-facing endpoints should be enabled (web-based login)
matrix_mautrix_facebook_appservice_public_enabled: true
# Mautrix Facebook public endpoint to log in to Facebook
matrix_mautrix_facebook_public_endpoint: ''
matrix_mautrix_facebook_homeserver_address: "{{ matrix_homeserver_container_url }}"
matrix_mautrix_facebook_homeserver_domain: '{{ matrix_domain }}'
# Whether or not the public-facing endpoints should be enabled (web-based login)
matrix_mautrix_facebook_appservice_public_enabled: false
# Mautrix Facebook public endpoint to log in to Facebook
matrix_mautrix_facebook_appservice_public_prefix: ''
matrix_mautrix_facebook_appservice_public_hostname: ''
matrix_mautrix_facebook_appservice_public_external: "{{ ('https://' + matrix_mautrix_facebook_appservice_public_hostname + matrix_mautrix_facebook_appservice_public_prefix) if matrix_mautrix_facebook_appservice_public_enabled else '' }}"
matrix_mautrix_facebook_appservice_address: 'http://matrix-mautrix-facebook:29319'
matrix_mautrix_facebook_appservice_public_external: 'https://{{ matrix_server_fqn_matrix }}{{ matrix_mautrix_facebook_public_endpoint }}'
matrix_mautrix_facebook_container_network: ""
matrix_mautrix_facebook_container_additional_networks: "{{ matrix_mautrix_facebook_container_additional_networks_auto + matrix_mautrix_facebook_container_additional_networks_custom }}"
matrix_mautrix_facebook_container_additional_networks_auto: []
matrix_mautrix_facebook_container_additional_networks_custom: []
# A list of extra arguments to pass to the container
matrix_mautrix_facebook_container_extra_arguments: []
# matrix_mautrix_facebook_container_labels_traefik_enabled controls whether labels to assist a Traefik reverse-proxy will be attached to the container.
# See `../templates/labels.j2` for details.
#
# To inject your own other container labels, see `matrix_mautrix_facebook_container_labels_additional_labels`.
matrix_mautrix_facebook_container_labels_traefik_enabled: true
matrix_mautrix_facebook_container_labels_traefik_docker_network: "{{ matrix_mautrix_facebook_container_network }}"
matrix_mautrix_facebook_container_labels_traefik_entrypoints: web-secure
matrix_mautrix_facebook_container_labels_traefik_tls_certResolver: default
# Controls whether labels will be added that expose mautrix-facebook's public endpoint
matrix_mautrix_facebook_container_labels_public_endpoint_enabled: "{{ matrix_mautrix_facebook_appservice_public_enabled }}"
matrix_mautrix_facebook_container_labels_public_endpoint_traefik_rule: "Host(`{{ matrix_mautrix_facebook_appservice_public_hostname }}`) && PathPrefix(`{{ matrix_mautrix_facebook_appservice_public_prefix }}`)"
matrix_mautrix_facebook_container_labels_public_endpoint_traefik_priority: 0
matrix_mautrix_facebook_container_labels_public_endpoint_traefik_entrypoints: "{{ matrix_mautrix_facebook_container_labels_traefik_entrypoints }}"
matrix_mautrix_facebook_container_labels_public_endpoint_traefik_tls: "{{ matrix_mautrix_facebook_container_labels_public_endpoint_traefik_entrypoints != 'web' }}"
matrix_mautrix_facebook_container_labels_public_endpoint_traefik_tls_certResolver: "{{ matrix_mautrix_facebook_container_labels_traefik_tls_certResolver }}" # noqa var-naming
# Controls whether labels will be added that expose mautrix-facebook's metrics
matrix_mautrix_facebook_container_labels_metrics_enabled: "{{ matrix_mautrix_facebook_metrics_enabled and matrix_mautrix_facebook_metrics_proxying_enabled }}"
matrix_mautrix_facebook_container_labels_metrics_traefik_rule: "Host(`{{ matrix_mautrix_facebook_metrics_proxying_hostname }}`) && PathPrefix(`{{ matrix_mautrix_facebook_metrics_proxying_path_prefix }}`)"
matrix_mautrix_facebook_container_labels_metrics_traefik_priority: 0
matrix_mautrix_facebook_container_labels_metrics_traefik_entrypoints: "{{ matrix_mautrix_facebook_container_labels_traefik_entrypoints }}"
matrix_mautrix_facebook_container_labels_metrics_traefik_tls: "{{ matrix_mautrix_facebook_container_labels_public_endpoint_traefik_entrypoints != 'web' }}"
matrix_mautrix_facebook_container_labels_metrics_traefik_tls_certResolver: "{{ matrix_mautrix_facebook_container_labels_traefik_tls_certResolver }}" # noqa var-naming
matrix_mautrix_facebook_container_labels_metrics_middleware_basic_auth_enabled: false
# See: https://doc.traefik.io/traefik/middlewares/http/basicauth/#users
matrix_mautrix_facebook_container_labels_metrics_middleware_basic_auth_users: ''
# matrix_mautrix_facebook_container_labels_additional_labels contains a multiline string with additional labels to add to the container label file.
# See `../templates/labels.j2` for details.
#
# Example:
# matrix_mautrix_facebook_container_labels_additional_labels: |
# my.label=1
# another.label="here"
matrix_mautrix_facebook_container_labels_additional_labels: ''
# List of systemd services that matrix-mautrix-facebook.service depends on.
matrix_mautrix_facebook_systemd_required_services_list: ['docker.service']
matrix_mautrix_facebook_systemd_required_services_list: "{{ matrix_mautrix_facebook_systemd_required_services_list_default + matrix_mautrix_facebook_systemd_required_services_list_auto + matrix_mautrix_facebook_systemd_required_services_list_custom }}"
matrix_mautrix_facebook_systemd_required_services_list_default: ['docker.service']
matrix_mautrix_facebook_systemd_required_services_list_auto: []
matrix_mautrix_facebook_systemd_required_services_list_custom: []
# List of systemd services that matrix-mautrix-facebook.service wants
matrix_mautrix_facebook_systemd_wanted_services_list: []
@ -52,10 +99,10 @@ matrix_mautrix_facebook_federate_rooms: true
# If metrics need to be consumed by another (external) Prometheus server, consider exposing them via `matrix_mautrix_facebook_metrics_proxying_enabled`.
matrix_mautrix_facebook_metrics_enabled: false
# Controls whether metrics should be proxied (exposed) on `matrix.DOMAIN/metrics/mautrix-facebook`.
# This will only work take effect if `matrix_nginx_proxy_proxy_matrix_metrics_enabled: true`.
# See the `matrix-nginx-proxy` role for details about enabling `matrix_nginx_proxy_proxy_matrix_metrics_enabled`.
# Controls whether metrics should be exposed on `matrix.DOMAIN/metrics/mautrix-facebook`.
matrix_mautrix_facebook_metrics_proxying_enabled: false
matrix_mautrix_facebook_metrics_proxying_hostname: ''
matrix_mautrix_facebook_metrics_proxying_path_prefix: ''
matrix_mautrix_facebook_bridge_permissions: |
{{

69
roles/custom/matrix-bridge-mautrix-facebook/tasks/inject_into_nginx_proxy.yml
View File

@ -1,69 +0,0 @@
---
- name: Fail if matrix-nginx-proxy role already executed
ansible.builtin.fail:
msg: >-
Trying to append Mautrix Facebook's reverse-proxying configuration to matrix-nginx-proxy,
but it's pointless since the matrix-nginx-proxy role had already executed.
To fix this, please change the order of roles in your playbook,
so that the matrix-nginx-proxy role would run after the matrix-bridge-mautrix-facebook role.
when: matrix_nginx_proxy_role_executed | default(False) | bool
- name: Generate Mautrix Facebook proxying configuration for matrix-nginx-proxy
ansible.builtin.set_fact:
matrix_mautrix_facebook_matrix_nginx_proxy_configuration: |
location {{ matrix_mautrix_facebook_public_endpoint }} {
{% if matrix_nginx_proxy_enabled | default(False) %}
{# Use the embedded DNS resolver in Docker containers to discover the service #}
resolver 127.0.0.11 valid=5s;
set $backend "matrix-mautrix-facebook:29319";
proxy_pass http://$backend;
{% else %}
{# Generic configuration for use outside of our container setup #}
proxy_pass http://127.0.0.1:9008;
{% endif %}
}
- name: Register Mautrix Facebook proxying configuration with matrix-nginx-proxy
ansible.builtin.set_fact:
matrix_nginx_proxy_proxy_matrix_additional_server_configuration_blocks: |
{{
matrix_nginx_proxy_proxy_matrix_additional_server_configuration_blocks | default([])
+
[matrix_mautrix_facebook_matrix_nginx_proxy_configuration]
}}
- name: Warn about reverse-proxying if matrix-nginx-proxy not used
ansible.builtin.debug:
msg: >-
NOTE: You've enabled the Mautrix Facebook bridge but are not using the matrix-nginx-proxy
reverse proxy.
Please make sure that you're proxying the `{{ matrix_mautrix_facebook_public_endpoint }}`
URL endpoint to the matrix-mautrix-facebook container.
You can expose the container's port using the `matrix_mautrix_facebook_container_http_host_bind_port` variable.
when: "not matrix_nginx_proxy_enabled | default(False) | bool"
- when: matrix_mautrix_facebook_metrics_proxying_enabled | bool
block:
- name: Generate mautrix-facebook metrics proxying configuration for matrix-nginx-proxy (matrix.DOMAIN/metrics/mautrix-facebook)
ansible.builtin.set_fact:
matrix_mautrix_facebook_nginx_metrics_configuration_block: |
location /metrics/mautrix-facebook {
{% if matrix_nginx_proxy_enabled | default(False) %}
{# Use the embedded DNS resolver in Docker containers to discover the service #}
resolver 127.0.0.11 valid=5s;
set $backend "matrix-mautrix-facebook:8000";
proxy_pass http://$backend/metrics;
{% else %}
return 404 "matrix-nginx-proxy is disabled and no host port was bound to the container, so metrics are unavailable";
{% endif %}
}
- name: Register mautrix-facebook metrics proxying configuration with matrix-nginx-proxy (matrix.DOMAIN/metrics/mautrix-facebook)
ansible.builtin.set_fact:
matrix_nginx_proxy_proxy_matrix_metrics_additional_system_location_configuration_blocks: |
{{
matrix_nginx_proxy_proxy_matrix_metrics_additional_system_location_configuration_blocks | default([])
+
[matrix_mautrix_facebook_nginx_metrics_configuration_block]
}}

9
roles/custom/matrix-bridge-mautrix-facebook/tasks/main.yml
View File

@ -1,14 +1,5 @@
---
- tags:
- setup-all
- setup-nginx-proxy
- install-all
- install-nginx-proxy
block:
- when: matrix_mautrix_facebook_enabled | bool and matrix_mautrix_facebook_appservice_public_enabled | bool
ansible.builtin.include_tasks: "{{ role_path }}/tasks/inject_into_nginx_proxy.yml"
- tags:
- setup-all
- setup-mautrix-facebook

10
roles/custom/matrix-bridge-mautrix-facebook/tasks/setup_install.yml
View File

@ -113,6 +113,16 @@
owner: "{{ matrix_user_username }}"
group: "{{ matrix_user_groupname }}"
- name: Ensure mautrix-facebook support files installed
ansible.builtin.template:
src: "{{ role_path }}/templates/{{ item }}.j2"
dest: "{{ matrix_mautrix_facebook_base_path }}/{{ item }}"
mode: 0640
owner: "{{ matrix_user_username }}"
group: "{{ matrix_user_groupname }}"
with_items:
- labels
- name: Ensure matrix-mautrix-facebook.service installed
ansible.builtin.template:
src: "{{ role_path }}/templates/systemd/matrix-mautrix-facebook.service.j2"

17
roles/custom/matrix-bridge-mautrix-facebook/tasks/validate_config.yml
View File

@ -1,14 +1,28 @@
---
- name: (Deprecation) Catch and report renamed mautrix-facebook settings
ansible.builtin.fail:
msg: >-
Your configuration contains a variable, which now has a different name.
Please change your configuration to rename the variable (`{{ item.old }}` -> `{{ item.new }}`).
when: "item.old in vars"
with_items:
- {'old': 'matrix_mautrix_facebook_public_endpoint', 'new': 'matrix_mautrix_facebook_appservice_public_prefix'}
- name: Fail if required mautrix-facebook settings not defined
ansible.builtin.fail:
msg: >-
You need to define a required configuration setting (`{{ item.name }}`).
when: "item.when | bool and vars[item.name] == ''"
with_items:
- {'name': 'matrix_mautrix_facebook_public_endpoint', when: true}
- {'name': 'matrix_mautrix_facebook_appservice_public_hostname', when: "{{ matrix_mautrix_facebook_appservice_public_enabled }}"}
- {'name': 'matrix_mautrix_facebook_appservice_public_prefix', when: "{{ matrix_mautrix_facebook_appservice_public_enabled }}"}
- {'name': 'matrix_mautrix_facebook_metrics_proxying_hostname', when: "{{ matrix_mautrix_facebook_metrics_enabled }}"}
- {'name': 'matrix_mautrix_facebook_metrics_proxying_path_prefix', when: "{{ matrix_mautrix_facebook_metrics_enabled }}"}
- {'name': 'matrix_mautrix_facebook_appservice_token', when: true}
- {'name': 'matrix_mautrix_facebook_homeserver_token', when: true}
- {'name': 'matrix_mautrix_facebook_container_network', when: true}
- {'name': 'matrix_mautrix_facebook_homeserver_address', when: true}
- {'name': 'matrix_mautrix_facebook_database_hostname', when: "{{ matrix_mautrix_facebook_database_engine == 'postgres' }}"}
- when: "matrix_mautrix_facebook_database_engine == 'sqlite' and matrix_mautrix_facebook_docker_image.endswith(':da1b4ec596e334325a1589e70829dea46e73064b')"
@ -23,3 +37,4 @@
"NOTE: Your mautrix-facebook bridge is still on SQLite and on the last version that supported it, before support was dropped. Support has been subsequently re-added in v0.3.2, so we advise you to upgrade (by removing your `matrix_mautrix_facebook_docker_image` definition from vars.yml)"
]
}}

2
roles/custom/matrix-bridge-mautrix-facebook/templates/config.yaml.j2
View File

@ -37,7 +37,7 @@ appservice:
# Whether or not the public-facing endpoints should be enabled.
enabled: {{ matrix_mautrix_facebook_appservice_public_enabled|to_json }}
# The prefix to use in the public-facing endpoints.
prefix: {{ matrix_mautrix_facebook_public_endpoint|to_json }}
prefix: {{ matrix_mautrix_facebook_appservice_public_prefix|to_json }}
# The base URL where the public-facing endpoints are available. The prefix is not added
# implicitly.
external: {{ matrix_mautrix_facebook_appservice_public_external|to_json }}

45
roles/custom/matrix-bridge-mautrix-facebook/templates/labels.j2 Normal file
View File

@ -0,0 +1,45 @@
{% if matrix_mautrix_facebook_container_labels_traefik_enabled %}
traefik.enable=true
{% if matrix_mautrix_facebook_container_labels_traefik_docker_network %}
traefik.docker.network={{ matrix_mautrix_facebook_container_labels_traefik_docker_network }}
{% endif %}
{# Public endpoint #}
{% if matrix_mautrix_facebook_container_labels_public_endpoint_enabled %}
traefik.http.routers.matrix-mautrix-facebook-public-endpoint.rule={{ matrix_mautrix_facebook_container_labels_public_endpoint_traefik_rule }}
{% if matrix_mautrix_facebook_container_labels_public_endpoint_traefik_priority | int > 0 %}
traefik.http.routers.matrix-mautrix-facebook-public-endpoint.priority={{ matrix_mautrix_facebook_container_labels_public_endpoint_traefik_priority }}
{% endif %}
traefik.http.routers.matrix-mautrix-facebook-public-endpoint.service=matrix-mautrix-facebook-appservice
traefik.http.routers.matrix-mautrix-facebook-public-endpoint.entrypoints={{ matrix_mautrix_facebook_container_labels_public_endpoint_traefik_entrypoints }}
traefik.http.routers.matrix-mautrix-facebook-public-endpoint.tls={{ matrix_mautrix_facebook_container_labels_public_endpoint_traefik_tls | to_json }}
{% if matrix_mautrix_facebook_container_labels_public_endpoint_traefik_tls %}
traefik.http.routers.matrix-mautrix-facebook-public-endpoint.tls.certResolver={{ matrix_mautrix_facebook_container_labels_public_endpoint_traefik_tls_certResolver }}
{% endif %}
traefik.http.services.matrix-mautrix-facebook-appservice.loadbalancer.server.port=29319
{% endif %}
{# Metrics #}
{% if matrix_mautrix_facebook_container_labels_metrics_enabled %}
traefik.http.routers.matrix-mautrix-facebook-metrics.rule={{ matrix_mautrix_facebook_container_labels_metrics_traefik_rule }}
{% if matrix_mautrix_facebook_container_labels_metrics_traefik_priority | int > 0 %}
traefik.http.routers.matrix-mautrix-facebook-metrics.priority={{ matrix_mautrix_facebook_container_labels_metrics_traefik_priority }}
{% endif %}
traefik.http.routers.matrix-mautrix-facebook-metrics.service=matrix-mautrix-facebook-metrics
traefik.http.routers.matrix-mautrix-facebook-metrics.entrypoints={{ matrix_mautrix_facebook_container_labels_metrics_traefik_entrypoints }}
traefik.http.routers.matrix-mautrix-facebook-metrics.tls={{ matrix_mautrix_facebook_container_labels_metrics_traefik_tls | to_json }}
{% if matrix_mautrix_facebook_container_labels_metrics_traefik_tls %}
traefik.http.routers.matrix-mautrix-facebook-metrics.tls.certResolver={{ matrix_mautrix_facebook_container_labels_metrics_traefik_tls_certResolver }}
{% endif %}
{% if matrix_mautrix_facebook_container_labels_metrics_middleware_basic_auth_enabled %}
traefik.http.routers.matrix-mautrix-facebook-metrics.middlewares=matrix-mautrix-facebook-metrics-basic-auth
traefik.http.middlewares.matrix-mautrix-facebook-metrics-basic-auth.basicauth.users={{ matrix_mautrix_facebook_container_labels_metrics_middleware_basic_auth_users }}
{% endif %}
traefik.http.services.matrix-mautrix-facebook-metrics.loadbalancer.server.port=8000
{% endif %}
{% endif %}
{{ matrix_mautrix_facebook_container_labels_additional_labels }}

17
roles/custom/matrix-bridge-mautrix-facebook/templates/systemd/matrix-mautrix-facebook.service.j2
View File

@ -19,22 +19,31 @@ ExecStartPre=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_s
# Intentional delay, so that the homeserver (we likely depend on) can manage to start.
ExecStartPre={{ matrix_host_command_sleep }} 5
ExecStart={{ devture_systemd_docker_base_host_command_docker }} run --rm --name matrix-mautrix-facebook \
ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} create \
--rm \
--name=matrix-mautrix-facebook \
--log-driver=none \
--user={{ matrix_user_uid }}:{{ matrix_user_gid }} \
--cap-drop=ALL \
--network={{ matrix_docker_network }} \
--network={{ matrix_mautrix_facebook_container_network }} \
{% if matrix_mautrix_facebook_appservice_public_enabled and matrix_mautrix_facebook_container_http_host_bind_port %}
-p {{ matrix_mautrix_facebook_container_http_host_bind_port }}:29319 \
{% endif %}
-v {{ matrix_mautrix_facebook_config_path }}:/config:z \
-v {{ matrix_mautrix_facebook_data_path }}:/data:z \
--mount type=bind,src={{ matrix_mautrix_facebook_config_path }},dst=/config \
--mount type=bind,src={{ matrix_mautrix_facebook_data_path }},dst=/data \
--label-file={{ matrix_mautrix_facebook_base_path }}/labels \
{% for arg in matrix_mautrix_facebook_container_extra_arguments %}
{{ arg }} \
{% endfor %}
{{ matrix_mautrix_facebook_docker_image }} \
python3 -m mautrix_facebook -c /config/config.yaml --no-update
{% for network in matrix_mautrix_facebook_container_additional_networks %}
ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} network connect {{ network }} matrix-mautrix-facebook
{% endfor %}
ExecStart={{ devture_systemd_docker_base_host_command_docker }} start --attach matrix-mautrix-facebook
ExecStop=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} stop --time={{ devture_systemd_docker_base_container_stop_grace_time_seconds }} matrix-mautrix-facebook 2>/dev/null || true'
ExecStop=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} rm matrix-mautrix-facebook 2>/dev/null || true'
Restart=always

179
roles/custom/matrix-homeserver-proxy/defaults/main.yml Normal file
View File

@ -0,0 +1,179 @@
---
# matrix-homeserver-proxy is a role which brings up a containerized nginx webserver which helps with reverse-proxying to the Matrix homeserver (Synapse, etc.).
#
# Certain services (like matrix-media-repo, matrix-corporal, identity servers, etc.) may need to capture some requests destined for the homeserver
# and handle them instead of it.
#
# This role helps other services (bots, bridges, etc.) reach the homeserver in a way that:
# - is not very direct, so as to allow for some routes (media repo, etc.) to actually go elsewhere
# - is not via the public network and/or via HTTPS, which introduces major performance penalties
#
# Performance-wise, benchmarks show that:
# - each local (container) nginx hop adds about a 200 rps penalty
# - SSL termination (on the Traefik side) adds a 350 rps penalty
# - going over the public network adds another 70 rps penalty
#
# It's something like this for an existing flow (which will be gone soon):
# 1. public network, Traefik + SSL: 70 rps
# 2. `matrix-nginx-proxy:8008`: 600 rps
# 3. `matrix-nginx-proxy:12080` 850 rps
# 4. `matrix-synapse-reverse-proxy-companion:8008`: 1000 rps
# 5. `matrix-synapse:8008`: 1200 rps
#
# Traefik was additionally benchmarked to see where the slowness comes from. Results are like this:
# 1. public network, Traefik + SSL: 70 rps
# 2. local (container) network, Traefik + SSL: 150 rps
# 3. local (container) network, Traefik without SSL: 500 rps
# 4. `matrix-nginx-proxy:8008`: 600 rps
#
# It's obvious that minimizing the number of hops helps a lot and that not using SSL and/or the public network is important.
matrix_homeserver_proxy_enabled: true
matrix_homeserver_proxy_ident: matrix-homeserver-proxy
# renovate: datasource=docker depName=nginx
matrix_homeserver_proxy_version: 1.25.3-alpine
matrix_homeserver_proxy_base_path: "{{ matrix_base_data_path }}/homeserver-proxy"
matrix_homeserver_proxy_confd_path: "{{ matrix_homeserver_proxy_base_path }}/conf.d"
# List of systemd services that matrix-homeserver-proxy.service depends on
matrix_homeserver_proxy_systemd_required_services_list: ['docker.service']
# List of systemd services that matrix-homeserver-proxy.service wants
matrix_homeserver_proxy_systemd_wanted_services_list: "{{ matrix_homeserver_proxy_systemd_wanted_services_list_auto + matrix_homeserver_proxy_systemd_wanted_services_list_custom }}"
matrix_homeserver_proxy_systemd_wanted_services_list_auto: []
matrix_homeserver_proxy_systemd_wanted_services_list_custom: []
# We use an official nginx image, which we fix-up to run unprivileged.
# An alternative would be an `nginxinc/nginx-unprivileged` image, but that is frequently out of date.
matrix_homeserver_proxy_container_image: "{{ matrix_container_global_registry_prefix }}nginx:{{ matrix_homeserver_proxy_version }}"
matrix_homeserver_proxy_container_image_force_pull: "{{ matrix_homeserver_proxy_container_image.endswith(':latest') }}"
matrix_homeserver_proxy_container_network: matrix-homeserver-proxy
# A list of additional container networks that matrix-homeserver-proxy would be connected to.
# The playbook does not create these networks, so make sure they already exist.
matrix_homeserver_proxy_container_additional_networks: []
# Controls whether the matrix-homeserver-proxy container exposes its HTTP Client-Server API port (tcp/8008 in the container).
#
# Takes an "<ip>:<port>" or "<port>" value (e.g. "127.0.0.1:8008"), or empty string to not expose.
matrix_homeserver_proxy_container_client_api_host_bind_port: ''
# Controls whether the matrix-homeserver-proxy container exposes its HTTP Federation (Server-Server) API port (tcp/8048 in the container).
#
# Takes an "<ip>:<port>" or "<port>" value (e.g. "127.0.0.1:8048"), or empty string to not expose.
matrix_homeserver_proxy_container_federation_api_host_bind_port: ''
# Option to disable the access log
matrix_homeserver_proxy_access_log_enabled: true
# The tmpfs at /tmp needs to be large enough to handle multiple concurrent file uploads.
matrix_homeserver_proxy_tmp_directory_size_mb: "{{ (matrix_homeserver_proxy_federation_api_client_max_body_size_mb | int) * 50 }}"
matrix_homeserver_proxy_tmp_cache_directory_size_mb: "{{ (matrix_homeserver_proxy_cache_max_size_mb | int) * 2 }}"
# A list of strings containing additional configuration blocks to add to the nginx server configuration (nginx.conf).
# for big matrixservers to enlarge the number of open files to prevent timeouts
# matrix_homeserver_proxy_additional_configuration_blocks:
# - 'worker_rlimit_nofile 30000;'
matrix_homeserver_proxy_additional_configuration_blocks: []
# A list of strings containing additional configuration blocks to add to the nginx event server configuration (nginx.conf).
matrix_homeserver_proxy_event_additional_configuration_blocks: []
# A list of strings containing additional configuration blocks to add to the nginx http's server configuration (nginx-http.conf).
matrix_homeserver_proxy_http_additional_server_configuration_blocks: []
# To increase request timeout in NGINX using proxy_read_timeout, proxy_connect_timeout, proxy_send_timeout, send_timeout directives
# Nginx Default: proxy_connect_timeout 60s; #Defines a timeout for establishing a connection with a proxied server
# Nginx Default: proxy_send_timeout 60s; #Sets a timeout for transmitting a request to the proxied server.
# Nginx Default: proxy_read_timeout 60s; #Defines a timeout for reading a response from the proxied server.
# Nginx Default: send_timeout 60s; #Sets a timeout for transmitting a response to the client.
#
# For more information visit:
# http://nginx.org/en/docs/http/ngx_http_proxy_module.html
# http://nginx.org/en/docs/http/ngx_http_core_module.html#send_timeout
# https://www.nginx.com/resources/wiki/start/topics/examples/fullexample2/
#
# Here we are sticking with nginx default values change this value carefully.
matrix_homeserver_proxy_proxy_connect_timeout: 60
matrix_homeserver_proxy_proxy_send_timeout: 60
matrix_homeserver_proxy_proxy_read_timeout: 60
matrix_homeserver_proxy_send_timeout: 60
# For OCSP purposes, we need to define a resolver at the `server{}` level or `http{}` level (we do the latter).
#
# Otherwise, we get warnings like this:
# > [warn] 22#22: no resolver defined to resolve r3.o.lencr.org while requesting certificate status, responder: r3.o.lencr.org, certificate: "/matrix/ssl/config/live/.../fullchain.pem"
#
# We point it to the internal Docker resolver, which likely delegates to nameservers defined in `/etc/resolv.conf`.
matrix_homeserver_proxy_http_level_resolver: 127.0.0.11
matrix_homeserver_proxy_hostname: "{{ matrix_homeserver_proxy_ident }}"
# matrix_homeserver_proxy_client_api_addr specifies the address where the Client-Server API is
matrix_homeserver_proxy_client_api_addr: ''
# This needs to be equal or higher than the maximum upload size accepted by the homeserver.
matrix_homeserver_proxy_client_api_client_max_body_size_mb: 50
# Tells whether `/_synapse/client` is forwarded to the Matrix Client API server.
matrix_homeserver_proxy_client_api_forwarded_location_synapse_client_api_enabled: true
# Tells whether `/_synapse/oidc` is forwarded to the Matrix Client API server.
# Enable this if you need OpenID Connect authentication support.
matrix_homeserver_proxy_client_api_forwarded_location_synapse_oidc_api_enabled: false
# Tells whether `/_synapse/admin` is forwarded to the Matrix Client API server.
# Following these recommendations (https://github.com/matrix-org/synapse/blob/master/docs/reverse_proxy.md), by default, we don't.
matrix_homeserver_proxy_client_api_forwarded_location_synapse_admin_api_enabled: false
# `matrix_homeserver_proxy_client_api_forwarded_location_prefix_regexes` holds
# the location prefixes that get forwarded to the Matrix Client API server.
# These locations get combined into a regex like this `^(/_matrix|/_synapse/client)`.
matrix_homeserver_proxy_client_api_forwarded_location_prefix_regexes: |
{{
(['/_matrix'])
+
(['/_synapse/client'] if matrix_homeserver_proxy_client_api_forwarded_location_synapse_client_api_enabled else [])
+
(['/_synapse/oidc'] if matrix_homeserver_proxy_client_api_forwarded_location_synapse_oidc_api_enabled else [])
+
(['/_synapse/admin'] if matrix_homeserver_proxy_client_api_forwarded_location_synapse_admin_api_enabled else [])
}}
# Specifies where requests for the root URI (`/`) on the `matrix.` domain should be redirected.
# If this has an empty value, they're just passed to the homeserver, which serves a static page.
# If you'd like to make `https://matrix.DOMAIN` redirect to `https://element.DOMAIN` (or something of that sort), specify the domain name here.
# Example value: `element.DOMAIN` (or `{{ matrix_server_fqn_element }}`).
matrix_homeserver_proxy_client_redirect_root_uri_to_domain: ""
# A list of strings containing additional configuration blocks to add to the nginx vhost handling the Client-Server API
matrix_homeserver_proxy_client_api_additional_server_configuration_blocks: "{{ matrix_homeserver_proxy_client_api_additional_server_configuration_blocks_auto + matrix_homeserver_proxy_client_api_additional_server_configuration_blocks_custom }}"
matrix_homeserver_proxy_client_api_additional_server_configuration_blocks_auto: []
matrix_homeserver_proxy_client_api_additional_server_configuration_blocks_custom: []
# matrix_homeserver_proxy_federation_api_enabled specifies whether reverse proxying for the Federation (Server-Server) API should be done
matrix_homeserver_proxy_federation_api_enabled: true
# matrix_homeserver_proxy_federation_api_addr specifies the address where the Federation (Server-Server) API is
matrix_homeserver_proxy_federation_api_addr: ''
matrix_homeserver_proxy_federation_api_client_max_body_size_mb: "{{ (matrix_homeserver_proxy_client_api_client_max_body_size_mb | int) * 3 }}"
# A list of strings containing additional configuration blocks to add to the nginx vhost handling the Federation (Server-Server) API
matrix_homeserver_proxy_federation_api_additional_server_configuration_blocks: "{{ matrix_homeserver_proxy_federation_api_additional_server_configuration_blocks_auto + matrix_homeserver_proxy_federation_api_additional_server_configuration_blocks_custom }}"
matrix_homeserver_proxy_federation_api_additional_server_configuration_blocks_auto: []
matrix_homeserver_proxy_federation_api_additional_server_configuration_blocks_custom: []
# Controls whether matrix-homeserver-proxy trusts an upstream server's X-Forwarded-Proto header.
# The `matrix-homeserver-proxy` does not terminate SSL and always expects to be fronted by another reverse-proxy server.
# As such, it trusts the protocol scheme forwarded by the upstream proxy.
matrix_homeserver_proxy_trust_forwarded_proto: true
matrix_homeserver_proxy_x_forwarded_proto_value: "{{ '$http_x_forwarded_proto' if matrix_homeserver_proxy_trust_forwarded_proto else '$scheme' }}"
# The amount of worker processes and connections
# Consider increasing these when you are expecting high amounts of traffic
# http://nginx.org/en/docs/ngx_core_module.html#worker_connections
matrix_homeserver_proxy_worker_processes: auto
matrix_homeserver_proxy_worker_connections: 1024

49
roles/custom/matrix-homeserver-proxy/tasks/install.yml Normal file
View File

@ -0,0 +1,49 @@
---
- name: Ensure Matrix Homeserver Proxy paths exist
ansible.builtin.file:
path: "{{ item }}"
state: directory
mode: 0750
owner: "{{ matrix_user_username }}"
group: "{{ matrix_user_groupname }}"
with_items:
- "{{ matrix_homeserver_proxy_base_path }}"
- "{{ matrix_homeserver_proxy_confd_path }}"
- name: Ensure Matrix Homeserver Proxy is configured
ansible.builtin.template:
src: "{{ item.src }}"
dest: "{{ item.dest }}"
owner: "{{ matrix_user_username }}"
group: "{{ matrix_user_groupname }}"
mode: 0644
with_items:
- src: "{{ role_path }}/templates/nginx/nginx.conf.j2"
dest: "{{ matrix_homeserver_proxy_base_path }}/nginx.conf"
- src: "{{ role_path }}/templates/nginx/conf.d/nginx-http.conf.j2"
dest: "{{ matrix_homeserver_proxy_confd_path }}/nginx-http.conf"
- src: "{{ role_path }}/templates/nginx/conf.d/matrix-homeserver-proxy.conf.j2"
dest: "{{ matrix_homeserver_proxy_confd_path }}/matrix-homeserver-proxy.conf"
- name: Ensure Matrix Homeserver Proxy nginx container image is pulled
community.docker.docker_image:
name: "{{ matrix_homeserver_proxy_container_image }}"
source: "{{ 'pull' if ansible_version.major > 2 or ansible_version.minor > 7 else omit }}"
force_source: "{{ matrix_homeserver_proxy_container_image_force_pull if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}"
force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else matrix_homeserver_proxy_container_image_force_pull }}"
register: result
retries: "{{ devture_playbook_help_container_retries_count }}"
delay: "{{ devture_playbook_help_container_retries_delay }}"
until: result is not failed
- name: Ensure Matrix Homeserver Proxy container network is created
community.general.docker_network:
name: "{{ matrix_homeserver_proxy_container_network }}"
driver: bridge
- name: Ensure Matrix Homeserver Proxy systemd service is installed
ansible.builtin.template:
src: "{{ role_path }}/templates/systemd/matrix-homeserver-proxy.service.j2"
dest: "{{ devture_systemd_docker_base_systemd_path }}/{{ matrix_homeserver_proxy_ident }}.service"
mode: 0644

20
roles/custom/matrix-homeserver-proxy/tasks/main.yml Normal file
View File

@ -0,0 +1,20 @@
---
- tags:
- setup-all
- setup-homeserver-proxy
- setup-synapse
- install-all
- install-homeserver-proxy
- install-synapse
block:
- when: matrix_homeserver_proxy_enabled | bool
ansible.builtin.include_tasks: "{{ role_path }}/tasks/install.yml"
- tags:
- setup-all
- setup-homeserver-proxy
- setup-synapse
block:
- when: not matrix_homeserver_proxy_enabled | bool
ansible.builtin.include_tasks: "{{ role_path }}/tasks/uninstall.yml"

25
roles/custom/matrix-homeserver-proxy/tasks/uninstall.yml Normal file
View File

@ -0,0 +1,25 @@
---
- name: Check existence of Matrix Homeserver Proxy systemd service
ansible.builtin.stat:
path: "{{ devture_systemd_docker_base_systemd_path }}/{{ matrix_homeserver_proxy_ident }}.service"
register: matrix_homeserver_proxy_service_stat
- when: matrix_homeserver_proxy_service_stat.stat.exists | bool
block:
- name: Ensure Matrix Homeserver Proxy systemd service is stopped
ansible.builtin.service:
name: "{{ matrix_homeserver_proxy_ident }}"
state: stopped
enabled: false
daemon_reload: true
- name: Ensure Matrix Homeserver Proxy systemd service doesn't exist
ansible.builtin.file:
path: "{{ devture_systemd_docker_base_systemd_path }}/{{ matrix_homeserver_proxy_ident }}.service"
state: absent
- name: Ensure Matrix Homeserver Proxy directory is deleted
ansible.builtin.file:
path: "{{ matrix_homeserver_proxy_base_path }}"
state: absent

62
roles/custom/matrix-homeserver-proxy/templates/nginx/conf.d/matrix-homeserver-proxy.conf.j2 Normal file
View File

@ -0,0 +1,62 @@
#jinja2: lstrip_blocks: "True"
server {
listen 8008;
server_name {{ matrix_homeserver_proxy_hostname }};
server_tokens off;
root /dev/null;
gzip on;
gzip_types text/plain application/json;
{% for configuration_block in matrix_homeserver_proxy_client_api_additional_server_configuration_blocks %}
{{- configuration_block }}
{% endfor %}
{# Everything else just goes to the API server ##}
location / {
{# Use the embedded DNS resolver in Docker containers to discover the service #}
resolver {{ matrix_homeserver_proxy_http_level_resolver }} valid=5s;
set $backend "{{ matrix_homeserver_proxy_client_api_addr }}";
proxy_pass http://$backend;
proxy_set_header Host $host;
client_body_buffer_size 25M;
client_max_body_size {{ matrix_homeserver_proxy_client_api_client_max_body_size_mb }}M;
proxy_max_temp_file_size 0;
}
}
{% if matrix_homeserver_proxy_federation_api_enabled %}
server {
listen 8048;
server_name {{ matrix_homeserver_proxy_hostname }};
server_tokens off;
root /dev/null;
gzip on;
gzip_types text/plain application/json;
{% for configuration_block in matrix_homeserver_proxy_federation_api_additional_server_configuration_blocks %}
{{- configuration_block }}
{% endfor %}
{# Everything else just goes to the API server ##}
location / {
{# Use the embedded DNS resolver in Docker containers to discover the service #}
resolver {{ matrix_homeserver_proxy_http_level_resolver }} valid=5s;
set $backend "{{ matrix_homeserver_proxy_federation_api_addr }}";
proxy_pass http://$backend;
proxy_set_header Host $host;
client_body_buffer_size 25M;
client_max_body_size {{ matrix_homeserver_proxy_federation_api_client_max_body_size_mb }}M;
proxy_max_temp_file_size 0;
}
}
{% endif %}

13
roles/custom/matrix-homeserver-proxy/templates/nginx/conf.d/nginx-http.conf.j2 Normal file
View File

@ -0,0 +1,13 @@
#jinja2: lstrip_blocks: "True"
# The default is aligned to the CPU's cache size,
# which can sometimes be too low.
# Thus, we ensure a larger bucket size value is used.
server_names_hash_bucket_size 64;
{% if matrix_homeserver_proxy_http_level_resolver %}
resolver {{ matrix_homeserver_proxy_http_level_resolver }};
{% endif %}
{% for configuration_block in matrix_homeserver_proxy_http_additional_server_configuration_blocks %}
{{- configuration_block }}
{% endfor %}

77
roles/custom/matrix-homeserver-proxy/templates/nginx/nginx.conf.j2 Normal file
View File

@ -0,0 +1,77 @@
#jinja2: lstrip_blocks: "True"
# This is a custom nginx configuration file that we use in the container (instead of the default one),
# because it allows us to run nginx with a non-root user.
#
# For this to work, the default vhost file (`/etc/nginx/conf.d/default.conf`) also needs to be removed.
#
# The following changes have been done compared to a default nginx configuration file:
# - various temp paths are changed to `/tmp`, so that a non-root user can write to them
# - the `user` directive was removed, as we don't want nginx to switch users
worker_processes {{ matrix_homeserver_proxy_worker_processes }};
error_log /var/log/nginx/error.log warn;
pid /tmp/nginx.pid;
{% for configuration_block in matrix_homeserver_proxy_additional_configuration_blocks %}
{{- configuration_block }}
{% endfor %}
events {
worker_connections {{ matrix_homeserver_proxy_worker_connections }};
{% for configuration_block in matrix_homeserver_proxy_event_additional_configuration_blocks %}
{{- configuration_block }}
{% endfor %}
}
http {
proxy_temp_path /tmp/proxy_temp;
client_body_temp_path /tmp/client_temp;
fastcgi_temp_path /tmp/fastcgi_temp;
uwsgi_temp_path /tmp/uwsgi_temp;
scgi_temp_path /tmp/scgi_temp;
include /etc/nginx/mime.types;
default_type application/octet-stream;
log_format main '$remote_addr - $remote_user [$time_local] "$request" '
'$status $body_bytes_sent "$http_referer" '
'"$http_user_agent" "$http_x_forwarded_for"';
{% if matrix_homeserver_proxy_access_log_enabled %}
access_log /var/log/nginx/access.log main;
{% endif %}
{% if matrix_homeserver_proxy_access_log_syslog_integration_enabled %}
log_format prometheus_fmt 'matrix-homeserver-proxy $server_name - $upstream_addr - $remote_addr - $remote_user [$time_local] '
'$host "$request" '
'$status "$http_referer" '
'"$http_user_agent" "$http_x_forwarded_for"';
access_log syslog:server={{ matrix_homeserver_proxy_access_log_syslog_integration_server_port }},tag=matrix_nginx_proxy_companion prometheus_fmt;
{% endif %}
{% if not matrix_homeserver_proxy_access_log_enabled and not matrix_homeserver_proxy_access_log_syslog_integration_enabled %}
access_log off;
{% endif %}
proxy_connect_timeout {{ matrix_homeserver_proxy_proxy_connect_timeout }};
proxy_send_timeout {{ matrix_homeserver_proxy_proxy_send_timeout }};
proxy_read_timeout {{ matrix_homeserver_proxy_proxy_read_timeout }};
send_timeout {{ matrix_homeserver_proxy_send_timeout }};
sendfile on;
#tcp_nopush on;
keepalive_timeout 65;
server_tokens off;
#gzip on;
{# Map directive needed for proxied WebSocket upgrades #}
map $http_upgrade $connection_upgrade {
default upgrade;
'' close;
}
include /etc/nginx/conf.d/*.conf;
}

52
roles/custom/matrix-homeserver-proxy/templates/systemd/matrix-homeserver-proxy.service.j2 Executable file
View File

@ -0,0 +1,52 @@
#jinja2: lstrip_blocks: "True"
[Unit]
Description=Matrix Homeserver Proxy
{% for service in matrix_homeserver_proxy_systemd_required_services_list %}
Requires={{ service }}
After={{ service }}
{% endfor %}
{% for service in matrix_homeserver_proxy_systemd_wanted_services_list %}
Wants={{ service }}
{% endfor %}
DefaultDependencies=no
[Service]
Type=simple
Environment="HOME={{ devture_systemd_docker_base_systemd_unit_home_path }}"
ExecStartPre=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} stop --time={{ devture_systemd_docker_base_container_stop_grace_time_seconds }} matrix-homeserver-proxy 2>/dev/null || true'
ExecStartPre=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} rm matrix-homeserver-proxy 2>/dev/null || true'
ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} create \
--rm \
--name=matrix-homeserver-proxy \
--log-driver=none \
--user={{ matrix_user_uid }}:{{ matrix_user_gid }} \
--cap-drop=ALL \
--read-only \
--tmpfs=/tmp:rw,noexec,nosuid,size={{ matrix_homeserver_proxy_tmp_directory_size_mb }}m \
--network={{ matrix_homeserver_proxy_container_network }} \
{% if matrix_homeserver_proxy_container_client_api_host_bind_port %}
-p {{ matrix_homeserver_proxy_container_client_api_host_bind_port }}:8008 \
{% endif %}
{% if matrix_homeserver_proxy_container_federation_api_host_bind_port %}
-p {{ matrix_homeserver_proxy_container_federation_api_host_bind_port }}:8048 \
{% endif %}
--mount type=bind,src={{ matrix_homeserver_proxy_base_path }}/nginx.conf,dst=/etc/nginx/nginx.conf,ro \
--mount type=bind,src={{ matrix_homeserver_proxy_confd_path }},dst=/etc/nginx/conf.d,ro \
{{ matrix_homeserver_proxy_container_image }}
{% for network in matrix_homeserver_proxy_container_additional_networks %}
ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} network connect {{ network }} matrix-homeserver-proxy
{% endfor %}
ExecStart={{ devture_systemd_docker_base_host_command_docker }} start --attach matrix-homeserver-proxy
ExecStop=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} stop --time={{ devture_systemd_docker_base_container_stop_grace_time_seconds }} matrix-homeserver-proxy 2>/dev/null || true'
ExecStop=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} rm matrix-homeserver-proxy 2>/dev/null || true'
ExecReload={{ devture_systemd_docker_base_host_command_docker }} exec matrix-homeserver-proxy /usr/sbin/nginx -s reload
Restart=always
RestartSec=30
SyslogIdentifier=matrix-homeserver-proxy
[Install]
WantedBy=multi-user.target

4
roles/custom/matrix-homeserver-proxy/vars/main.yml Normal file
View File

@ -0,0 +1,4 @@
---
matrix_homeserver_proxy_client_api_url: "http://{{ matrix_homeserver_proxy_ident }}:8008"
matrix_homeserver_proxy_federation_api_url: "http://{{ matrix_homeserver_proxy_ident }}:8048"

5
roles/custom/matrix_playbook_migration/tasks/validate_config.yml
View File

@ -60,6 +60,11 @@
- {'old': 'jitsi_require_well_known', 'new': 'jitsi_web_well_known_element_jitsi_enabled'}
- {'old': 'jitsi_wellknown_element_jitsi_json', 'new': 'jitsi_web_well_known_element_jitsi_json'}
- {'old': 'matrix_nginx_proxy_proxy_matrix_metrics_enabled', 'new': 'matrix_metrics_exposure_enabled'}
- {'old': 'matrix_nginx_proxy_proxy_matrix_metrics_basic_auth_enabled', 'new': 'matrix_metrics_exposure_http_basic_auth_enabled'}
- {'old': 'matrix_nginx_proxy_proxy_matrix_metrics_basic_auth_username', 'new': '<superseded by matrix_metrics_exposure_http_basic_auth_users>'}
- {'old': 'matrix_nginx_proxy_proxy_matrix_metrics_basic_auth_password', 'new': '<superseded by matrix_metrics_exposure_http_basic_auth_users>'}
- name: (Deprecation) Catch and report matrix_postgres variables
ansible.builtin.fail:
msg: |-

1
setup.yml
View File

@ -116,6 +116,7 @@
- custom/matrix-sygnal
- galaxy/ntfy
- custom/matrix-nginx-proxy
- custom/matrix-homeserver-proxy
- custom/matrix-coturn
- custom/matrix-media-repo