mirror/matrix-docker-ansible-deploy
1
0
Fork 0
mirror of https://github.com/spantaleev/matrix-docker-ansible-deploy.git synced 2025-06-25 10:47:51 +02:00
Code Issues Packages Projects Releases Wiki Activity

separated livekit and jwt to separate roles

Browse Source
This commit is contained in:
wjbeckett
2024-09-30 22:20:46 +10:00
parent b907777ae5
commit 8cb3e33bbf
29 changed files with 634 additions and 366 deletions
Download Patch File Download Diff File Expand all files Collapse all files

26
roles/custom/matrix-element-call/defaults/main.yml
View File

@ -4,8 +4,6 @@ matrix_element_call_enabled: false
# Base path configuration
matrix_element_call_base_path: "{{ matrix_base_data_path }}/element-call"
matrix_element_call_config_path: "{{ matrix_element_call_base_path }}/config"
matrix_element_call_backend_path: "{{ matrix_element_call_base_path }}/backend"
matrix_homeserver_config_path: "{{ matrix_base_data_path }}/synapse/config/homeserver.yaml"
element_web_config_path: "{{ matrix_base_data_path }}/static-files/public/.well-known/matrix/client"
@ -16,24 +14,12 @@ matrix_element_call_container_additional_networks: [] # No additional networks
# Docker images
matrix_element_call_image: "ghcr.io/element-hq/element-call:latest"
matrix_jwt_service_image: "ghcr.io/element-hq/lk-jwt-service:latest-ci"
matrix_livekit_image: "livekit/livekit-server:latest"
redis_image: "redis:6-alpine"
# Ports
matrix_element_call_port: "8093"
matrix_jwt_service_port: "8881"
redis_port: "6379"
# LiveKit configuration
matrix_element_call_livekit_dev_key: "{{ matrix_livekit_dev_key }}" # Must be defined in host_vars
matrix_element_call_jwt_secret: "{{ matrix_jwt_secret }}" # Must be defined in host_vars
matrix_element_call_livekit_service_url: "wss://sfu.{{ matrix_domain }}:443"
matrix_element_call_livekit_hostname: "sfu.{{ matrix_domain }}"
# jwt configuration
matrix_element_call_jwt_hostname: "sfu-jwt.{{ matrix_domain }}"
# Well-known paths and domains (derived from matrix_domain)
matrix_element_call_domain: "call.{{ matrix_domain }}"
matrix_element_call_well_known_client_path: "{{ matrix_base_data_path }}/static-files/public/.well-known/matrix/client"
@ -47,7 +33,7 @@ redis_password: ""
# Traefik Configuration for Element Call
matrix_element_call_container_labels_traefik_enabled: true
matrix_element_call_container_labels_traefik_docker_network: "{{ matrix_element_callcontainer_network }}"
matrix_element_call_container_labels_traefik_docker_network: "{{ matrix_element_call_container_network }}"
matrix_element_call_container_labels_traefik_hostname: "{{ matrix_element_call_domain }}"
# The path prefix must either be `/` or not end with a slash (e.g. `/element`).
matrix_element_call_container_labels_traefik_path_prefix: "{{ matrix_element_call_path_prefix }}"
@ -112,11 +98,11 @@ matrix_element_call_http_header_content_security_policy: frame-ancestors 'self'
# Specifies the value of the `Permission-Policy` header.
# See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Permission-Policy
matrix_element_call_http_header_content_permission_policy: "{{ 'interest-cohort=()' if matrix_element_callfloc_optout_enabled else '' }}"
matrix_element_call_http_header_content_permission_policy: "{{ 'interest-cohort=()' if matrix_element_call_floc_optout_enabled else '' }}"
# Specifies the value of the `Strict-Transport-Security` header.
# See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security
matrix_element_call_http_header_strict_transport_security: "max-age=31536000; includeSubDomains{{ '; preload' if matrix_element_callhsts_preload_enabled else '' }}"
matrix_element_call_http_header_strict_transport_security: "max-age=31536000; includeSubDomains{{ '; preload' if matrix_element_call_hsts_preload_enabled else '' }}"
# Controls whether to send a "Permissions-Policy interest-cohort=();" header along with all responses
#
@ -126,8 +112,8 @@ matrix_element_call_http_header_strict_transport_security: "max-age=31536000; in
# - https://amifloced.org/
#
# Of course, a better solution is to just stop using browsers (like Chrome), which participate in such tracking practices.
# See: `matrix_element_callcontent_permission_policy`
matrix_element_callfloc_optout_enabled: true
# See: `matrix_element_call_content_permission_policy`
matrix_element_call_floc_optout_enabled: true
# Controls if HSTS preloading is enabled
#
@ -139,7 +125,7 @@ matrix_element_callfloc_optout_enabled: true
# - https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security
# - https://hstspreload.org/#opt-in
# See: `matrix_element_call_http_header_strict_transport_security`
matrix_element_callhsts_preload_enabled: false
matrix_element_call_hsts_preload_enabled: false
# Enable or disable metrics collection
matrix_element_call_metrics_enabled: false

22
roles/custom/matrix-element-call/tasks/create_element_json.yml
View File

@ -1,22 +0,0 @@
---
---
# Create the element.json file to point to Element Call
- name: Ensure .well-known/element directory exists
ansible.builtin.file:
path: "{{ matrix_element_call_well_known_element_path | dirname }}"
state: directory
mode: 0755
- name: Create or update the element.json file with Element Call config
ansible.builtin.copy:
dest: "{{ matrix_element_call_well_known_element_path }}"
content: |
{
"call": {
"widget_url": "{{ matrix_element_call_base_url }}"
}
}
mode: '0644'
owner: "{{ matrix_user_username }}"
group: "{{ matrix_user_groupname }}"

2
roles/custom/matrix-element-call/tasks/install.yml
View File

@ -175,7 +175,7 @@
"org.matrix.msc4143.rtc_foci": [
{
"type": "livekit",
"livekit_service_url": "{{ matrix_element_call_jwt_service_url }}"
"livekit_service_url": "{{ matrix_jwt_service_url }}"
}
]
marker: "# ANSIBLE MANAGED BLOCK - Element Call RTC FOCI"

166
roles/custom/matrix-element-call/tasks/install_docker_containers.yml
View File

@ -1,166 +0,0 @@
---
# Ensure Required Directories Exist
- name: Ensure matrix-element-call paths exist
ansible.builtin.file:
path: "{{ item.path }}"
state: directory
mode: 0750
owner: "{{ matrix_user_username }}"
group: "{{ matrix_user_groupname }}"
loop:
- path: "{{ matrix_element_call_base_path }}"
- path: "{{ matrix_element_call_base_path }}/data"
- path: "{{ matrix_element_call_base_path }}/config"
- path: "{{ matrix_element_call_base_path }}/backend" # For LiveKit and Redis config
# Ensure Configuration Files are in Place
- name: Ensure Element Call config.json is in place
ansible.builtin.template:
src: "{{ role_path }}/templates/config.json.j2"
dest: "{{ matrix_element_call_base_path }}/config/config.json"
mode: 0640
owner: "{{ matrix_user_username }}"
group: "{{ matrix_user_groupname }}"
- name: Ensure LiveKit livekit.yaml is in place
ansible.builtin.template:
src: "{{ role_path }}/templates/livekit.yaml.j2"
dest: "{{ matrix_element_call_base_path }}/backend/livekit.yaml"
mode: 0640
owner: "{{ matrix_user_username }}"
group: "{{ matrix_user_groupname }}"
- name: Ensure Redis redis.conf is in place
ansible.builtin.template:
src: "{{ role_path }}/templates/redis.conf.j2"
dest: "{{ matrix_element_call_base_path }}/backend/redis.conf"
mode: 0640
owner: "{{ matrix_user_username }}"
group: "{{ matrix_user_groupname }}"
- name: Ensure matrix-element-call environment file is in place
ansible.builtin.template:
src: "{{ role_path }}/templates/env.j2"
dest: "{{ matrix_element_call_base_path }}/config/env"
mode: 0640
owner: "{{ matrix_user_username }}"
group: "{{ matrix_user_groupname }}"
- name: Ensure matrix-element-call Docker labels file is in place
ansible.builtin.template:
src: "{{ role_path }}/templates/labels.j2"
dest: "{{ matrix_element_call_base_path }}/config/labels"
mode: 0640
owner: "{{ matrix_user_username }}"
group: "{{ matrix_user_groupname }}"
# Ensure Docker Images are Pulled
- name: Ensure matrix-element-call Docker image is pulled
community.docker.docker_image:
name: "{{ matrix_element_call_image }}"
source: pull
force_source: "{{ matrix_element_call_container_image_force_pull }}"
register: element_call_image_result
retries: "{{ devture_playbook_help_container_retries_count }}"
delay: "{{ devture_playbook_help_container_retries_delay }}"
until: element_call_image_result is not failed
- name: Ensure jwt-service Docker image is pulled
community.docker.docker_image:
name: "ghcr.io/element-hq/lk-jwt-service:latest-ci"
source: pull
register: jwt_image_result
retries: 3
delay: 10
until: jwt_image_result is not failed
- name: Ensure livekit Docker image is pulled
community.docker.docker_image:
name: "livekit/livekit-server:latest"
source: pull
register: livekit_image_result
retries: 3
delay: 10
until: livekit_image_result is not failed
- name: Ensure redis Docker image is pulled
community.docker.docker_image:
name: "redis:6-alpine"
source: pull
register: redis_image_result
retries: 3
delay: 10
until: redis_image_result is not failed
- name: Debug matrix_element_call_base_path
ansible.builtin.debug:
var: matrix_element_call_base_path
- name: Debug labels file content
ansible.builtin.debug:
msg: "{{ lookup('file', matrix_element_call_base_path ~ '/config/labels') | from_yaml }}"
# Ensure Docker Containers are Running
- name: Run matrix-element-call Docker container
community.docker.docker_container:
name: "matrix-element-call"
image: "{{ matrix_element_call_image }}"
state: started
restart_policy: unless-stopped
env_file: "{{ matrix_element_call_base_path }}/config/env"
labels: "{{ lookup('file', matrix_element_call_base_path ~ '/config/labels') | from_yaml }}"
networks:
- name: "{{ matrix_element_call_container_network }}"
volumes:
- "{{ matrix_element_call_base_path }}/config/config.json:/app/config.json"
- "{{ matrix_element_call_base_path }}/data:/data"
- name: Run jwt-service Docker container
community.docker.docker_container:
name: "matrix-jwt-service"
image: "ghcr.io/element-hq/lk-jwt-service:latest-ci"
state: started
restart_policy: unless-stopped
environment:
LIVEKIT_SECRET: "{{ matrix_element_call_livekit_dev_key }}" # User-specified key
LIVEKIT_URL: "{{ matrix_element_call_livekit_service_url }}"
LIVEKIT_KEY: "devkey"
networks:
- name: "{{ matrix_element_call_container_network }}"
- name: Run livekit Docker container
community.docker.docker_container:
name: "matrix-livekit"
image: "livekit/livekit-server:latest"
state: started
restart_policy: unless-stopped
command: "--dev --config /etc/livekit.yaml"
volumes:
- "{{ matrix_element_call_base_path }}/backend/livekit.yaml:/etc/livekit.yaml"
network_mode: "host"
- name: Run redis Docker container
community.docker.docker_container:
name: "matrix-redis"
image: "redis:6-alpine"
state: started
restart_policy: unless-stopped
command: redis-server /etc/redis.conf
volumes:
- "{{ matrix_element_call_base_path }}/backend/redis.conf:/etc/redis.conf"
networks:
- name: "{{ matrix_element_call_container_network }}"
# Ensure Systemd Services are Set Up
- name: Ensure matrix-element-call systemd service is installed
ansible.builtin.template:
src: "{{ role_path }}/templates/element-call.service.j2"
dest: "{{ devture_systemd_docker_base_systemd_path }}/matrix-element-call.service"
mode: 0644
- name: Ensure matrix-element-call systemd service is enabled and started
ansible.builtin.systemd:
name: matrix-element-call
enabled: true
state: started
daemon_reload: true

29
roles/custom/matrix-element-call/tasks/update_element_web_config.yml
View File

@ -1,29 +0,0 @@
---
# Update Element-Web config.json with Element Call features
- name: Ensure Element-Web config.json exists
ansible.builtin.file:
path: "{{ matrix_element_web_config_path }}"
state: file
mode: 0644
- name: Update Element-Web config.json with Element Call features
ansible.builtin.blockinfile:
path: "{{ matrix_element_web_config_path }}"
block: |
"features": {
"feature_video_rooms": true,
"feature_new_room_decoration_ui": true,
"feature_group_calls": true,
"feature_element_call_video_rooms": true
},
"element_call": {
"url": "{{ matrix_element_call_base_url }}",
"participant_limit": 8,
"brand": "Element Call",
"use_exclusively": true
}
marker: "# ANSIBLE MANAGED BLOCK - Element Call features"
mode: '0644'
owner: "{{ matrix_user_username }}"
group: "{{ matrix_user_groupname }}"

36
roles/custom/matrix-element-call/tasks/update_homeserver_config.yml
View File

@ -1,36 +0,0 @@
---
# Update the homeserver.yaml file with Element Call config
- name: Ensure homeserver.yaml exists
ansible.builtin.file:
path: "{{ matrix_homeserver_config_path }}"
state: file
mode: 0644
- name: Add listeners section for Element Call to homeserver.yaml
ansible.builtin.blockinfile:
path: "{{ matrix_homeserver_config_path }}"
block: |
listeners:
- port: 8008
tls: false
type: http
x_forwarded: true
resources:
- names: [client, federation, openid]
compress: false
marker: "# ANSIBLE MANAGED BLOCK - Element Call listeners"
mode: '0644'
owner: "{{ matrix_user_username }}"
group: "{{ matrix_user_groupname }}"
- name: Ensure serve_server_wellknown is enabled in homeserver.yaml
ansible.builtin.lineinfile:
path: "{{ matrix_homeserver_config_path }}"
line: "serve_server_wellknown: true"
insertafter: EOF
state: present
mode: '0644'
owner: "{{ matrix_user_username }}"
group: "{{ matrix_user_groupname }}"

24
roles/custom/matrix-element-call/tasks/update_well_known_client.yml
View File

@ -1,24 +0,0 @@
---
---
# Update the .well-known/matrix/client file with Element Call config
- name: Ensure .well-known directory exists
ansible.builtin.file:
path: "{{ matrix_element_call_well_known_client_path | dirname }}"
state: directory
mode: 0755
- name: Update .well-known/matrix/client file with Element Call config
ansible.builtin.blockinfile:
path: "{{ matrix_element_call_well_known_client_path }}"
block: |
"org.matrix.msc4143.rtc_foci": [
{
"type": "livekit",
"livekit_service_url": "{{ matrix_element_call_jwt_service_url }}"
}
]
create: yes
mode: '0644'
owner: "{{ matrix_user_username }}"
group: "{{ matrix_user_groupname }}"

2
roles/custom/matrix-element-call/tasks/validate_config.yml
View File

@ -14,4 +14,4 @@
- {'name': 'matrix_livekit_image', when: true}
- {'name': 'redis_image', when: true}
- {'name': 'matrix_element_call_livekit_dev_key', when: true}
- {'name': 'matrix_element_call_livekit_service_url', when: true}
- {'name': 'matrix_jwt_service_url', when: true}

2
roles/custom/matrix-element-call/templates/config.json.j2
View File

@ -6,6 +6,6 @@
}
},
"livekit": {
"livekit_service_url": "{{ matrix_element_call_livekit_service_url }}"
"livekit_service_url": "{{ matrix_jwt_service_url }}"
}
}

11
roles/custom/matrix-element-call/templates/env.j2
View File

@ -1,11 +0,0 @@
# Environment variables for Element Call
ELEMENT_CALL_SERVER_URL=https://{{ matrix_element_call_domain }}
LIVEKIT_KEY=devkey
LIVEKIT_URL={{ matrix_element_call_livekit_service_url }}
LIVEKIT_SECRET={{ matrix_element_call_jwt_secret }}
JWT_SERVICE_URL={{ matrix_element_call_jwt_service_url }}
# Optional additional environment variables provided by the user
{% for key, value in matrix_element_call_environment_variables_additional.items() %}
{{ key }}={{ value }}
{% endfor %}

13
roles/custom/matrix-element-call/templates/jwt-service-labels.j2
View File

@ -1,13 +0,0 @@
{% if matrix_element_call_container_labels_traefik_enabled %}
traefik.enable=true
{% if matrix_element_call_container_labels_traefik_docker_network %}
traefik.docker.network={{ matrix_element_call_container_labels_traefik_docker_network }}
{% endif %}
# Define the Traefik router rule for JWT Service
traefik.http.routers.jwt-router.rule=Host(`{{ matrix_element_call_jwt_hostname }}`)
traefik.http.routers.jwt-router.entrypoints={{ matrix_element_call_container_labels_traefik_entrypoints }}
traefik.http.routers.jwt-router.tls.certresolver={{ matrix_element_call_container_labels_traefik_tls_certResolver }}
traefik.http.services.jwt-service.loadbalancer.server.port=8881
{% endif %}

13
roles/custom/matrix-element-call/templates/livekit-labels.j2
View File

@ -1,13 +0,0 @@
{% if matrix_element_call_container_labels_traefik_enabled %}
traefik.enable=true
{% if matrix_element_call_container_labels_traefik_docker_network %}
traefik.docker.network={{ matrix_element_call_container_labels_traefik_docker_network }}
{% endif %}
# Define the Traefik router rule for LiveKit
traefik.http.routers.livekit-router.rule=Host(`{{ matrix_element_call_livekit_hostname }}`)
traefik.http.routers.livekit-router.entrypoints={{ matrix_element_call_container_labels_traefik_entrypoints }}
traefik.http.routers.livekit-router.tls.certresolver={{ matrix_element_call_container_labels_traefik_tls_certResolver }}
traefik.http.services.livekit-service.loadbalancer.server.port=7880
{% endif %}

20
roles/custom/matrix-element-call/templates/livekit.yaml.j2
View File

@ -1,20 +0,0 @@
port: 7880
bind_addresses:
- "0.0.0.0"
rtc:
tcp_port: 7881
port_range_start: 50100
port_range_end: 50200
use_external_ip: false
turn:
enabled: false
domain: localhost
cert_file: ""
key_file: ""
tls_port: 5349
udp_port: 443
external_tls: true
keys:
devkey: "{{ matrix_element_call_livekit_dev_key }}"

37
roles/custom/matrix-element-call/templates/systemd/matrix-jwt-service.service.j2
View File

@ -1,37 +0,0 @@
[Unit]
Description=Matrix JWT Service
After=docker.service
Requires=docker.service
[Service]
Type=simple
Environment="HOME={{ devture_systemd_docker_base_systemd_unit_home_path }}"
ExecStartPre=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} stop --time={{ devture_systemd_docker_base_container_stop_grace_time_seconds }} matrix-jwt-service 2>/dev/null || true'
ExecStartPre=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} rm matrix-jwt-service 2>/dev/null || true'
ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} create \
--rm \
--name=matrix-jwt-service \
--log-driver=none \
--user={{ matrix_user_uid }}:{{ matrix_user_gid }} \
--cap-drop=ALL \
--network={{ matrix_element_call_container_network }} \
-p {{ matrix_jwt_service_port }}:8080 \
--env-file={{ matrix_element_call_base_path }}/config/env \
--label-file={{ matrix_element_call_base_path }}/config/jwt-service-labels \
{{ matrix_jwt_service_image }}
{% for network in matrix_element_call_container_additional_networks %}
ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} network connect {{ network }} matrix-jwt-service
{% endfor %}
ExecStart={{ devture_systemd_docker_base_host_command_docker }} start --attach matrix-jwt-service
ExecStop=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} stop --time={{ devture_systemd_docker_base_container_stop_grace_time_seconds }} matrix-jwt-service 2>/dev/null || true'
ExecStop=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} rm matrix-jwt-service 2>/dev/null || true'
Restart=always
RestartSec=30
SyslogIdentifier=matrix-jwt-service
[Install]
WantedBy=multi-user.target

33
roles/custom/matrix-element-call/templates/systemd/matrix-livekit.service.j2
View File

@ -1,33 +0,0 @@
[Unit]
Description=Matrix LiveKit Service
After=docker.service
Requires=docker.service
[Service]
Type=simple
Environment="HOME={{ devture_systemd_docker_base_systemd_unit_home_path }}"
ExecStartPre=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} stop --time={{ devture_systemd_docker_base_container_stop_grace_time_seconds }} matrix-livekit 2>/dev/null || true'
ExecStartPre=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} rm matrix-livekit 2>/dev/null || true'
ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} create \
--rm \
--name=matrix-livekit \
--log-driver=none \
--user={{ matrix_user_uid }}:{{ matrix_user_gid }} \
--cap-drop=ALL \
--network=host \
--mount type=bind,src={{ matrix_element_call_backend_path }}/livekit.yaml,dst=/etc/livekit.yaml,ro \
--label-file={{ matrix_element_call_base_path }}/config/livekit-labels \
{{ matrix_livekit_image }} \
--dev --config /etc/livekit.yaml
ExecStart={{ devture_systemd_docker_base_host_command_docker }} start --attach matrix-livekit
ExecStop=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} stop --time={{ devture_systemd_docker_base_container_stop_grace_time_seconds }} matrix-livekit 2>/dev/null || true'
ExecStop=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} rm matrix-livekit 2>/dev/null || true'
Restart=always
RestartSec=30
SyslogIdentifier=matrix-livekit
[Install]
WantedBy=multi-user.target