Initial work on getting nginx reverse proxying working with Dendrite

roles/matrix-dendrite/defaults/main.yml

@@ -14,6 +14,15 @@ matrix_dendrite_storage_path: "{{ matrix_dendrite_base_path }}/storage"
 matrix_dendrite_media_store_path: "{{ matrix_dendrite_storage_path }}/media-store"
 matrix_dendrite_ext_path: "{{ matrix_dendrite_base_path }}/ext"
 
+matrix_dendrite_container_http_bind_port: 8008
+
+# This is passed as a flag `-http-bind-address` flag to the Dendrite server in the container
+matrix_dendrite_container_http_bind_address: ":{{ matrix_dendrite_container_http_bind_port }}"
+
+# Dendrite monolith exposes both the Client API and the Federation API on the same port
+matrix_dendrite_container_client_api_port: "{{ matrix_dendrite_container_http_bind_port }}"
+matrix_dendrite_container_federation_api_plain_port: "{{ matrix_dendrite_container_http_bind_port }}"
+
 # Controls whether the matrix-dendrite container exposes the Client/Server API port (tcp/8008 in the container).
 #
 # Takes an "<ip>:<port>" or "<port>" value (e.g. "127.0.0.1:8008"), or empty string to not expose.
@@ -116,7 +125,10 @@ matrix_dendrite_trusted_id_servers:
 
 # Controls whether Dendrite will federate at all.
 # Disable this to completely isolate your server from the rest of the Matrix network.
-matrix_dendrite_disable_federation: false
+matrix_dendrite_federation_enabled: true
+
+# Controls whether the self-check feature should validate SSL certificates.
+matrix_dendrite_self_check_validate_certificates: true
 
 # Default Dendrite configuration template which covers the generic use case.
 # You can customize it by controlling the various variables inside it.

roles/matrix-dendrite/tasks/dendrite/setup_install.yml

@@ -68,7 +68,7 @@
 - name: Ensure systemd reloaded after matrix-dendrite.service installation
   service:
     daemon_reload: yes
-  when: "matrix_dendrite_systemd_service_result.changed"
+  when: "matrix_dendrite_systemd_service_result.changed|bool"
 
 - name: Ensure matrix-dendrite-create-account script created
   template:

roles/matrix-dendrite/tasks/main.yml

@@ -22,14 +22,14 @@
 - import_tasks: "{{ role_path }}/tasks/self_check_client_api.yml"
   delegate_to: 127.0.0.1
   become: false
-  when: run_self_check|bool
+  when: run_self_check|bool and matrix_dendrite_enabled|bool
   tags:
     - self-check
 
 - import_tasks: "{{ role_path }}/tasks/self_check_federation_api.yml"
   delegate_to: 127.0.0.1
   become: false
-  when: run_self_check|bool
+  when: run_self_check|bool and matrix_dendrite_enabled|bool
   tags:
     - self-check
 

roles/matrix-dendrite/tasks/self_check_client_api.yml

@@ -7,14 +7,12 @@
   register: result_matrix_dendrite_client_api
   ignore_errors: true
   check_mode: no
-  when: matrix_dendrite_enabled|bool
 
 - name: Fail if Matrix Client API not working
   fail:
     msg: "Failed checking Matrix Client API is up at `{{ matrix_server_fqn_matrix }}` (checked endpoint: `{{ matrix_dendrite_client_api_url_endpoint_public }}`). Is Dendrite running? Is port 443 open in your firewall? Full error: {{ result_matrix_dendrite_client_api }}"
-  when: "matrix_dendrite_enabled|bool and (result_matrix_dendrite_client_api.failed or 'json' not in result_matrix_dendrite_client_api)"
+  when: "(result_matrix_dendrite_client_api.failed or 'json' not in result_matrix_dendrite_client_api)"
 
 - name: Report working Matrix Client API
   debug:
     msg: "The Matrix Client API at `{{ matrix_server_fqn_matrix }}` (checked endpoint: `{{ matrix_dendrite_client_api_url_endpoint_public }}`) is working"
-  when: matrix_dendrite_enabled|bool

roles/matrix-dendrite/tasks/self_check_federation_api.yml

@@ -7,19 +7,18 @@
   register: result_matrix_dendrite_federation_api
   ignore_errors: true
   check_mode: no
-  when: matrix_dendrite_enabled|bool
 
 - name: Fail if Matrix Federation API not working
   fail:
     msg: "Failed checking Matrix Federation API is up at `{{ matrix_server_fqn_matrix }}` (checked endpoint: `{{ matrix_dendrite_federation_api_url_endpoint_public }}`). Is Dendrite running? Is port {{ matrix_federation_public_port }} open in your firewall? Full error: {{ result_matrix_dendrite_federation_api }}"
-  when: "matrix_dendrite_enabled|bool and matrix_dendrite_federation_enabled|bool and (result_matrix_dendrite_federation_api.failed or 'json' not in result_matrix_dendrite_federation_api)"
+  when: "matrix_dendrite_federation_enabled|bool and (result_matrix_dendrite_federation_api.failed or 'json' not in result_matrix_dendrite_federation_api)"
 
 - name: Fail if Matrix Federation API unexpectedly enabled
   fail:
     msg: "Matrix Federation API is up at `{{ matrix_server_fqn_matrix }}` (checked endpoint: `{{ matrix_dendrite_federation_api_url_endpoint_public }}`) despite being disabled."
-  when: "matrix_dendrite_enabled|bool and not matrix_dendrite_federation_enabled|bool and not result_matrix_dendrite_federation_api.failed"
+  when: "not matrix_dendrite_federation_enabled|bool and not result_matrix_dendrite_federation_api.failed"
 
 - name: Report working Matrix Federation API
   debug:
     msg: "The Matrix Federation API at `{{ matrix_server_fqn_matrix }}` (checked endpoint: `{{ matrix_dendrite_federation_api_url_endpoint_public }}`) is working"
-  when: "matrix_dendrite_enabled|bool and matrix_dendrite_federation_enabled|bool"
+  when: "matrix_dendrite_federation_enabled|bool"

roles/matrix-dendrite/templates/dendrite/dendrite.yaml.j2

@@ -64,7 +64,7 @@ global:
 
   # Disables federation. Dendrite will not be able to make any outbound HTTP requests
   # to other servers and the federation API will not be exposed.
-  disable_federation: {{ matrix_dendrite_disable_federation|to_json }}
+  disable_federation: {{ (not matrix_dendrite_federation_enabled)|to_json }}
 
   # Configuration for Kafka/Naffka.
   kafka:

roles/matrix-dendrite/templates/dendrite/systemd/matrix-dendrite.service.j2

@@ -44,7 +44,8 @@ ExecStart={{ matrix_host_command_docker }} run --rm --name matrix-dendrite \
 			{{ arg }} \
 			{% endfor %}
 			{{ matrix_dendrite_docker_image }} \
-			--config /data/dendrite.yaml
+			-config /data/dendrite.yaml \
+			-http-bind-address {{ matrix_dendrite_container_http_bind_address }}
 
 ExecStop=-{{ matrix_host_command_docker }} kill matrix-dendrite
 ExecStop=-{{ matrix_host_command_docker }} rm matrix-dendrite