mirror of
https://github.com/spantaleev/matrix-docker-ansible-deploy.git
synced 2025-02-06 23:35:30 +01:00
Compare commits
63 Commits
6076f525e8
...
23dd042288
| Author | SHA1 | Date | |
|---|---|---|---|
|
23dd042288 | ||
|
44cc2afc11 | ||
|
769a31d3ca | ||
|
b1dec4a123 | ||
|
|
e38f433177 | ||
|
|
12b67f7925 | ||
|
|
43d1760077 | ||
|
|
c7148d8b05 | ||
|
|
39c21816ca | ||
|
|
01bed6d512 | ||
|
|
54af9606db | ||
|
|
3b0a433ec8 | ||
|
|
0df0f8578e | ||
|
|
ba0ef316cc | ||
|
|
7fc8509f04 | ||
|
|
6e9c143d56 | ||
|
7e45325338 | ||
|
|
fa85ba28dd | ||
|
|
5e4c930d90 | ||
|
|
8078a743e2 | ||
|
|
5bf09f5fdc | ||
|
|
8f11e1d5bc | ||
|
|
a6cdb2c571 | ||
|
|
8f9dfdee4e | ||
|
|
3c23b643d8 | ||
|
|
4f87328ff1 | ||
|
|
d8c288c941 | ||
|
|
e5c4650cf8 | ||
|
ab3c4edea7 | ||
|
|
135039b276 | ||
|
|
09c42477bb | ||
|
|
bba3b95344 | ||
|
|
757233d53c | ||
|
c7f8b7cd1a | ||
|
|
471e004ff7 | ||
|
|
83e9818db7 | ||
|
|
cdbdb43514 | ||
|
|
131e164e46 | ||
|
|
af89261b92 | ||
|
|
bb827f44b1 | ||
|
|
dd23e2d1c9 | ||
|
|
8937572939 | ||
|
|
ce46511563 | ||
|
|
9a1e08b2f0 | ||
|
|
ac02351ab7 | ||
|
|
76e6bf3966 | ||
|
|
439e012f03 | ||
|
|
edc24022f2 | ||
|
|
c97dbc9ec6 | ||
|
|
f19cbe6dd4 | ||
|
|
774f3de863 | ||
|
|
f802df6e6d | ||
|
|
f62bdcc697 | ||
|
|
b94d4d1862 | ||
|
|
f7d4ffc20c | ||
|
|
04cf09bdb0 | ||
|
|
3ca0f4221f | ||
|
|
74e7f41aea | ||
|
|
614dc4a51b | ||
|
|
934deda88a | ||
|
|
fc9dac763d | ||
|
|
d628b7f9d3 | ||
|
|
5b76b662cb |
@ -4,7 +4,7 @@
|
||||
|
||||
- [Prerequisites](prerequisites.md) - go here to a guided installation using this Ansible playbook
|
||||
|
||||
- [Configuring your DNS server](configuring-dns.md)
|
||||
- [Configuring your DNS settings](configuring-dns.md)
|
||||
|
||||
- [Getting this playbook's source code](getting-the-playbook.md)
|
||||
|
||||
@ -12,22 +12,28 @@
|
||||
|
||||
- [Installing](installing.md)
|
||||
|
||||
- **Importing data from another server installation**
|
||||
|
||||
- [Importing an existing SQLite database (from another Synapse installation)](importing-synapse-sqlite.md) (optional)
|
||||
|
||||
- [Importing an existing Postgres database (from another installation)](importing-postgres.md) (optional)
|
||||
|
||||
- [Importing `media_store` data files from an existing Synapse installation](importing-synapse-media-store.md) (optional)
|
||||
|
||||
- [Server Delegation](howto-server-delegation.md)
|
||||
|
||||
- Server Delegation via a well-known file (recommended): [Installing well-known files on the base domain's server](configuring-well-known.md#installing-well-known-files-on-the-base-domain-s-server)
|
||||
|
||||
- [Serving the base domain](configuring-playbook-base-domain-serving.md)
|
||||
|
||||
- [Server Delegation via a DNS SRV record (advanced)](howto-srv-server-delegation.md)
|
||||
|
||||
- [Playbook tags](playbook-tags.md)
|
||||
|
||||
- **Importing data from another server installation**
|
||||
|
||||
- [Importing an existing SQLite database (from another Synapse installation)](importing-synapse-sqlite.md) (optional)
|
||||
|
||||
- [Importing an existing Postgres database (from another installation)](importing-postgres.md) (optional)
|
||||
|
||||
- [Importing `media_store` data files from an existing Synapse installation](importing-synapse-media-store.md) (optional)
|
||||
|
||||
- [Registering users](registering-users.md)
|
||||
|
||||
- [Updating users passwords](updating-users-passwords.md)
|
||||
|
||||
- [Configuring service discovery via .well-known](configuring-well-known.md)
|
||||
|
||||
- [Maintenance / checking if services work](maintenance-checking-services.md)
|
||||
|
||||
- [Maintenance / upgrading services](maintenance-upgrading-services.md)
|
||||
|
||||
@ -1,102 +1,78 @@
|
||||
# Configuring your DNS server
|
||||
# Configuring your DNS settings
|
||||
|
||||
<sup>⚡️[Quick start](README.md) | [Prerequisites](prerequisites.md) > Configuring your DNS server > [Getting the playbook](getting-the-playbook.md) > [Configuring the playbook](configuring-playbook.md) > [Installing](installing.md) </sup>
|
||||
<sup>⚡️[Quick start](README.md) | [Prerequisites](prerequisites.md) > Configuring your DNS settings > [Getting the playbook](getting-the-playbook.md) > [Configuring the playbook](configuring-playbook.md) > [Installing](installing.md)</sup>
|
||||
|
||||
To set up Matrix on your domain, you'd need to do some DNS configuration.
|
||||
|
||||
To use an identifier like `@<username>:example.com`, you don't actually need to install anything on the actual `example.com` server.
|
||||
## DNS setting for server delegation (optional)
|
||||
|
||||
You do, however, need to instruct the Matrix network that Matrix services for `example.com` are delegated over to `matrix.example.com`.
|
||||
In the sample `vars.yml` ([`examples/vars.yml`](../examples/vars.yml)), we recommend to use a short user identifier like `@<username>:example.com`.
|
||||
|
||||
As we discuss in [Server Delegation](howto-server-delegation.md), there are 2 different ways to set up such delegation:
|
||||
To use such an identifier, you don't need to install anything on the actual `example.com` server. Instead, you need to instruct the Matrix network that Matrix services for `example.com` are redirected over to `matrix.example.com`. This redirection is also known as "delegation".
|
||||
|
||||
- either by serving a `https://example.com/.well-known/matrix/server` file (from the base domain!)
|
||||
- or by using a `_matrix._tcp` DNS SRV record (don't confuse this with the `_matrix-identity._tcp` SRV record described below)
|
||||
As we discuss in [Server Delegation](howto-server-delegation.md), server delegation can be configured in either of these ways:
|
||||
|
||||
This playbook mostly discusses the well-known file method, because it's easier to manage with regard to certificates. If you decide to go with the alternative method ([Server Delegation via a DNS SRV record (advanced)](howto-server-delegation.md#server-delegation-via-a-dns-srv-record-advanced)), please be aware that the general flow that this playbook guides you through may not match what you need to do.
|
||||
- Setting up a `/.well-known/matrix/server` file on the base domain (`example.com`)
|
||||
- Setting up a `_matrix._tcp` DNS SRV record
|
||||
|
||||
For simplicity reasons, this playbook recommends you to set up server delegation via a `/.well-known/matrix/server` file, instead of using a DNS SRV record.
|
||||
|
||||
If you choose the recommended method (file-based delegation), you do not need to configure the DNS record to enable server delegation. You will need to add a necessary configuration later, when you [finalize the installation](installing.md#finalize-the-installation) after installing and starting Matrix services.
|
||||
|
||||
On the other hand, if you choose this method (setting up a DNS SRV record), you need to configure the additional DNS record as well as adjust SSL certificate handling. Take a look at this documentation for more information: [Server Delegation via a DNS SRV record (advanced)](howto-server-delegation.md#server-delegation-via-a-dns-srv-record-advanced)
|
||||
|
||||
## DNS settings for services enabled by default
|
||||
|
||||
| Type | Host | Priority | Weight | Port | Target |
|
||||
| ----- | ---------------------------- | -------- | ------ | ---- | ---------------------- |
|
||||
| A | `matrix` | - | - | - | `matrix-server-IP` |
|
||||
To serve the base domain (`example.com`) and [Element Web](configuring-playbook-client-element-web.md) with the default subdomain, adjust DNS records as below.
|
||||
|
||||
| Type | Host | Priority | Weight | Port | Target |
|
||||
| ----- | ---------------------------- | -------- | ------ | ---- | ---------------------|
|
||||
| A | `matrix` | - | - | - | `matrix-server-IP` |
|
||||
| CNAME | `element` | - | - | - | `matrix.example.com` |
|
||||
|
||||
As the table illustrates, you need to create 2 subdomains (`matrix.example.com` and `element.example.com`) and point both of them to your server's IP address (DNS `A` record or `CNAME` record is fine).
|
||||
|
||||
The `element.example.com` subdomain is necessary, because this playbook installs the [Element Web](https://github.com/element-hq/element-web) client for you by default. If you'd rather instruct the playbook not to install Element Web (`matrix_client_element_enabled: false` when [Configuring the playbook](configuring-playbook.md) later), feel free to skip the `element.example.com` DNS record.
|
||||
|
||||
Be mindful as to how long it will take for the DNS records to propagate.
|
||||
|
||||
If you are using Cloudflare DNS, make sure to disable the proxy and set all records to `DNS only`. Otherwise, fetching certificates will fail.
|
||||
|
||||
## DNS settings for optional services/features
|
||||
|
||||
| Used by component | Type | Host | Priority | Weight | Port | Target |
|
||||
| -------------------------------------------------------------------------------------------------------------------------- | ----- | ------------------------------ | -------- | ------ | ---- | --------------------------- |
|
||||
| [ma1sd](configuring-playbook-ma1sd.md) identity server | SRV | `_matrix-identity._tcp` | 10 | 0 | 443 | `matrix.example.com` |
|
||||
| [Dimension](configuring-playbook-dimension.md) integration server | CNAME | `dimension` | - | - | - | `matrix.example.com` |
|
||||
| [Jitsi](configuring-playbook-jitsi.md) video-conferencing platform | CNAME | `jitsi` | - | - | - | `matrix.example.com` |
|
||||
| [Prometheus/Grafana](configuring-playbook-prometheus-grafana.md) monitoring system | CNAME | `stats` | - | - | - | `matrix.example.com` |
|
||||
| [Go-NEB](configuring-playbook-bot-go-neb.md) bot | CNAME | `goneb` | - | - | - | `matrix.example.com` |
|
||||
| [Sygnal](configuring-playbook-sygnal.md) push notification gateway | CNAME | `sygnal` | - | - | - | `matrix.example.com` |
|
||||
| [ntfy](configuring-playbook-ntfy.md) push notifications server | CNAME | `ntfy` | - | - | - | `matrix.example.com` |
|
||||
| [Etherpad](configuring-playbook-etherpad.md) collaborative text editor | CNAME | `etherpad` | - | - | - | `matrix.example.com` |
|
||||
| [Hydrogen](configuring-playbook-client-hydrogen.md) web client | CNAME | `hydrogen` | - | - | - | `matrix.example.com` |
|
||||
| [Cinny](configuring-playbook-client-cinny.md) web client | CNAME | `cinny` | - | - | - | `matrix.example.com` |
|
||||
| [SchildiChat Web](configuring-playbook-client-schildichat-web.md) client | CNAME | `schildichat` | - | - | - | `matrix.example.com` |
|
||||
| [wsproxy](configuring-playbook-bridge-mautrix-wsproxy.md) sms bridge | CNAME | `wsproxy` | - | - | - | `matrix.example.com` |
|
||||
| [Buscarron](configuring-playbook-bot-buscarron.md) helpdesk bot | CNAME | `buscarron` | - | - | - | `matrix.example.com` |
|
||||
| [rageshake](docs/configuring-playbook-rageshake.md) bug report server | CNAME | `rageshake` | - | - | - | `matrix.example.com` |
|
||||
| [Postmoogle](configuring-playbook-bridge-postmoogle.md)/[Email2Matrix](configuring-playbook-email2matrix.md) email bridges | MX | `matrix` | 10 | 0 | - | `matrix.example.com` |
|
||||
| [Postmoogle](configuring-playbook-bridge-postmoogle.md) email bridge | TXT | `matrix` | - | - | - | `v=spf1 ip4:<your-ip> -all` |
|
||||
| [Postmoogle](configuring-playbook-bridge-postmoogle.md) email bridge | TXT | `_dmarc.matrix` | - | - | - | `v=DMARC1; p=quarantine;` |
|
||||
| [Postmoogle](configuring-playbook-bridge-postmoogle.md) email bridge | TXT | `postmoogle._domainkey.matrix` | - | - | - | get it from `!pm dkim` |
|
||||
For other services which may need subdomain settings, see the table below and configure the DNS (`CNAME`) records accordingly.
|
||||
|
||||
| Used by component | Type | Host | Priority | Weight | Port | Target |
|
||||
| -------------------------------------------------------------------------------------------------------------------------- | ----- | ------------------------------ | -------- | ------ | ---- | -----------------------------------|
|
||||
| [Dimension](configuring-playbook-dimension.md) integration server | CNAME | `dimension` | - | - | - | `matrix.example.com` |
|
||||
| [Jitsi](configuring-playbook-jitsi.md) video-conferencing platform | CNAME | `jitsi` | - | - | - | `matrix.example.com` |
|
||||
| [Prometheus/Grafana](configuring-playbook-prometheus-grafana.md) monitoring system | CNAME | `stats` | - | - | - | `matrix.example.com` |
|
||||
| [Go-NEB](configuring-playbook-bot-go-neb.md) bot | CNAME | `goneb` | - | - | - | `matrix.example.com` |
|
||||
| [Sygnal](configuring-playbook-sygnal.md) push notification gateway | CNAME | `sygnal` | - | - | - | `matrix.example.com` |
|
||||
| [ntfy](configuring-playbook-ntfy.md) push notifications server | CNAME | `ntfy` | - | - | - | `matrix.example.com` |
|
||||
| [Etherpad](configuring-playbook-etherpad.md) collaborative text editor | CNAME | `etherpad` | - | - | - | `matrix.example.com` |
|
||||
| [Hydrogen](configuring-playbook-client-hydrogen.md) web client | CNAME | `hydrogen` | - | - | - | `matrix.example.com` |
|
||||
| [Cinny](configuring-playbook-client-cinny.md) web client | CNAME | `cinny` | - | - | - | `matrix.example.com` |
|
||||
| [SchildiChat Web](configuring-playbook-client-schildichat-web.md) client | CNAME | `schildichat` | - | - | - | `matrix.example.com` |
|
||||
| [wsproxy](configuring-playbook-bridge-mautrix-wsproxy.md) sms bridge | CNAME | `wsproxy` | - | - | - | `matrix.example.com` |
|
||||
| [Buscarron](configuring-playbook-bot-buscarron.md) helpdesk bot | CNAME | `buscarron` | - | - | - | `matrix.example.com` |
|
||||
| [rageshake](configuring-playbook-rageshake.md) bug report server | CNAME | `rageshake` | - | - | - | `matrix.example.com` |
|
||||
| [ma1sd](configuring-playbook-ma1sd.md) identity server | SRV | `_matrix-identity._tcp` | 10 | 0 | 443 | `matrix.example.com` |
|
||||
| [Postmoogle](configuring-playbook-bridge-postmoogle.md)/[Email2Matrix](configuring-playbook-email2matrix.md) email bridges | MX | `matrix` | 10 | 0 | - | `matrix.example.com` |
|
||||
| [Postmoogle](configuring-playbook-bridge-postmoogle.md) email bridge | TXT | `matrix` | - | - | - | `v=spf1 ip4:matrix-server-IP -all` |
|
||||
| [Postmoogle](configuring-playbook-bridge-postmoogle.md) email bridge | TXT | `_dmarc.matrix` | - | - | - | `v=DMARC1; p=quarantine;` |
|
||||
| [Postmoogle](configuring-playbook-bridge-postmoogle.md) email bridge | TXT | `postmoogle._domainkey.matrix` | - | - | - | get it from `!pm dkim` |
|
||||
|
||||
### SRV record for ma1sd
|
||||
|
||||
To make ma1sd enable its federation features, you need to set up a `_matrix-identity._tcp` SRV record. Don't confuse this with the `_matrix._tcp` SRV record for server delegation. See the table above and [this section](configuring-playbook-ma1sd.md#adjusting-dns-records) for values which need to be specified.
|
||||
|
||||
When setting up a SRV record, if you are asked for a service and protocol instead of a hostname split the host value from the table where the period is. For example use service as `_matrix-identity` and protocol as `_tcp`.
|
||||
|
||||
## Subdomains setup
|
||||
### MX and TXT records for Postmoogle
|
||||
|
||||
As the table above illustrates, you need to create 2 subdomains (`matrix.example.com` and `element.example.com`) and point both of them to your new server's IP address (DNS `A` record or `CNAME` record is fine).
|
||||
|
||||
The `element.example.com` subdomain may be necessary, because this playbook installs the [Element Web](https://github.com/element-hq/element-web) client for you. If you'd rather instruct the playbook not to install Element Web (`matrix_client_element_enabled: false` when [Configuring the playbook](configuring-playbook.md) later), feel free to skip the `element.example.com` DNS record.
|
||||
|
||||
The `dimension.example.com` subdomain may be necessary, because this playbook could install the [Dimension integration manager](http://dimension.t2bot.io/) for you. The installation of Dimension is disabled by default, because it's only possible to install it after the other Matrix services are working (see [Setting up Dimension integration manager](configuring-playbook-dimension.md) later). If you do not wish to set up Dimension, feel free to skip the `dimension.example.com` DNS record.
|
||||
|
||||
The `jitsi.example.com` subdomain may be necessary, because this playbook could install the [Jitsi video-conferencing platform](https://jitsi.org/) for you. The installation of Jitsi is disabled by default, because it may be heavy and is not a core required component. To learn how to install it, see our [Jitsi](configuring-playbook-jitsi.md) guide. If you do not wish to set up Jitsi, feel free to skip the `jitsi.example.com` DNS record.
|
||||
|
||||
The `stats.example.com` subdomain may be necessary, because this playbook could install [Grafana](https://grafana.com/) and setup performance metrics for you. The installation of Grafana is disabled by default, it is not a core required component. To learn how to install it, see our [metrics and graphs guide](configuring-playbook-prometheus-grafana.md). If you do not wish to set up Grafana, feel free to skip the `stats.example.com` DNS record. It is possible to install Prometheus without installing Grafana, this would also not require the `stats.example.com` subdomain.
|
||||
|
||||
The `goneb.example.com` subdomain may be necessary, because this playbook could install the [Go-NEB](https://github.com/matrix-org/go-neb) bot. The installation of Go-NEB is disabled by default, it is not a core required component. To learn how to install it, see our [configuring Go-NEB guide](configuring-playbook-bot-go-neb.md). If you do not wish to set up Go-NEB, feel free to skip the `goneb.example.com` DNS record.
|
||||
|
||||
The `sygnal.example.com` subdomain may be necessary, because this playbook could install the [Sygnal](https://github.com/matrix-org/sygnal) push gateway. The installation of Sygnal is disabled by default, it is not a core required component. To learn how to install it, see our [configuring Sygnal guide](configuring-playbook-sygnal.md). If you do not wish to set up Sygnal (you probably don't, unless you're also developing/building your own Matrix apps), feel free to skip the `sygnal.example.com` DNS record.
|
||||
|
||||
The `ntfy.example.com` subdomain may be necessary, because this playbook could install the [ntfy](https://ntfy.sh/) UnifiedPush-compatible push notifications server. The installation of ntfy is disabled by default, it is not a core required component. To learn how to install it, see our [configuring ntfy guide](configuring-playbook-ntfy.md). If you do not wish to set up ntfy, feel free to skip the `ntfy.example.com` DNS record.
|
||||
|
||||
The `etherpad.example.com` subdomain may be necessary, because this playbook could install the [Etherpad](https://etherpad.org/) a highly customizable open source online editor providing collaborative editing in really real-time. The installation of Etherpad is disabled by default, it is not a core required component. To learn how to install it, see our [configuring Etherpad guide](configuring-playbook-etherpad.md). If you do not wish to set up Etherpad, feel free to skip the `etherpad.example.com` DNS record.
|
||||
|
||||
The `hydrogen.example.com` subdomain may be necessary, because this playbook could install the [Hydrogen](https://github.com/element-hq/hydrogen-web) web client. The installation of Hydrogen is disabled by default, it is not a core required component. To learn how to install it, see our [configuring Hydrogen guide](configuring-playbook-client-hydrogen.md). If you do not wish to set up Hydrogen, feel free to skip the `hydrogen.example.com` DNS record.
|
||||
|
||||
The `cinny.example.com` subdomain may be necessary, because this playbook could install the [Cinny](https://github.com/ajbura/cinny) web client. The installation of Cinny is disabled by default, it is not a core required component. To learn how to install it, see our [configuring Cinny guide](configuring-playbook-client-cinny.md). If you do not wish to set up Cinny, feel free to skip the `cinny.example.com` DNS record.
|
||||
|
||||
The `schildichat.example.com` subdomain may be necessary, because this playbook could install the [SchildiChat Web](https://github.com/SchildiChat/schildichat-desktop) client. The installation of SchildiChat Web is disabled by default, it is not a core required component. To learn how to install it, see our [configuring SchildiChat Web guide](configuring-playbook-client-schildichat-web.md). If you do not wish to set up SchildiChat Web, feel free to skip the `schildichat.example.com` DNS record.
|
||||
|
||||
The `wsproxy.example.com` subdomain may be necessary, because this playbook could install the [wsproxy](https://github.com/mautrix/wsproxy) web client. The installation of wsproxy is disabled by default, it is not a core required component. To learn how to install it, see our [configuring wsproxy guide](configuring-playbook-bridge-mautrix-wsproxy.md). If you do not wish to set up wsproxy, feel free to skip the `wsproxy.example.com` DNS record.
|
||||
|
||||
The `buscarron.example.com` subdomain may be necessary, because this playbook could install the [Buscarron](https://github.com/etkecc/buscarron) bot. The installation of Buscarron is disabled by default, it is not a core required component. To learn how to install it, see our [configuring Buscarron guide](configuring-playbook-bot-buscarron.md). If you do not wish to set up Buscarron, feel free to skip the `buscarron.example.com` DNS record.
|
||||
|
||||
The `rageshake.example.com` subdomain may be necessary, because this playbook could install the [rageshake](https://github.com/matrix-org/rageshake) bug report server. The installation of rageshake is disabled by default, it is not a core required component. To learn how to install it, see our [configuring rageshake guide](configuring-playbook-rageshake.md). If you do not wish to set up rageshake, feel free to skip the `rageshake.example.com` DNS record.
|
||||
|
||||
## `_matrix-identity._tcp` SRV record setup
|
||||
|
||||
To make the [ma1sd](https://github.com/ma1uta/ma1sd) Identity Server (which this playbook may optionally install for you) enable its federation features, set up an SRV record that looks like this:
|
||||
- Name: `_matrix-identity._tcp` (use this text as-is)
|
||||
- Content: `10 0 443 matrix.example.com` (replace `example.com` with your own)
|
||||
|
||||
This is an optional feature for the optionally-installed [ma1sd service](configuring-playbook-ma1sd.md). See [ma1sd's documentation](https://github.com/ma1uta/ma1sd/wiki/mxisd-and-your-privacy#choices-are-never-easy) for information on the privacy implications of setting up this SRV record.
|
||||
|
||||
**Note**: This `_matrix-identity._tcp` SRV record for the identity server is different from the `_matrix._tcp` that can be used for Synapse delegation. See [howto-server-delegation.md](howto-server-delegation.md) for more information about delegation.
|
||||
|
||||
## `_dmarc`, `postmoogle._domainkey` TXT and `matrix` MX records setup
|
||||
|
||||
To make the [postmoogle](configuring-playbook-bridge-postmoogle.md) email bridge enable its email sending features, you need to configure SPF (TXT), DMARC (TXT), DKIM (TXT) and MX records
|
||||
To make Postmoogle enable its email sending features, you need to configure MX and TXT (SPF, DMARC, and DKIM) records. See the table above for values which need to be specified.
|
||||
|
||||
---------------------------------------------
|
||||
|
||||
When you're done with the DNS configuration and ready to proceed, continue with [Getting the playbook](getting-the-playbook.md).
|
||||
[▶️](getting-the-playbook.md) When you're done with the DNS configuration and ready to proceed, continue with [Getting the playbook](getting-the-playbook.md).
|
||||
|
||||
@ -1,8 +1,15 @@
|
||||
# Serving the base domain (optional)
|
||||
|
||||
This playbook sets up services on your Matrix server (`matrix.example.com`). To have this server officially be responsible for Matrix services for the base domain (`example.com`), you need to set up [Server Delegation](howto-server-delegation.md). This is normally done by [configuring well-known](configuring-well-known.md) files on the base domain.
|
||||
By default, this playbook sets up services on your Matrix server (`matrix.example.com`), but has it configured so that it presents itself as the base domain (`example.com`). To have this server officially be responsible for Matrix services for the base domain (`example.com`), you need to set up server delegation / redirection.
|
||||
|
||||
People who don't have a separate server to dedicate to the base domain have trouble arranging this.
|
||||
As we discuss in [Server Delegation](howto-server-delegation.md), server delegation / redirection can be configured in either of these ways:
|
||||
|
||||
- Setting up a `/.well-known/matrix/server` file on the base domain (`example.com`)
|
||||
- Setting up a `_matrix._tcp` DNS SRV record
|
||||
|
||||
For simplicity reasons, this playbook recommends you to set up server delegation via a `/.well-known/matrix/server` file.
|
||||
|
||||
However, those who don't have a separate server to dedicate to the base domain have trouble arranging this.
|
||||
|
||||
Usually, there are 2 options:
|
||||
|
||||
@ -12,7 +19,7 @@ Usually, there are 2 options:
|
||||
|
||||
This documentation page tells you how to do the latter. With some easy changes, we make it possible to serve the base domain from the Matrix server via the integrated webserver.
|
||||
|
||||
Just **adjust your DNS records**, so that your base domain is pointed to the Matrix server's IP address (using a DNS `A` record) **and then add the following configuration** to your `inventory/host_vars/matrix.example.com/vars.yml` file:
|
||||
Just [**adjust your DNS records**](configuring-dns.md), so that your base domain is pointed to the Matrix server's IP address (using a DNS `A` record) **and then add the following configuration** to your `inventory/host_vars/matrix.example.com/vars.yml` file:
|
||||
|
||||
```yaml
|
||||
matrix_static_files_container_labels_base_domain_enabled: true
|
||||
@ -22,7 +29,7 @@ Doing this, the playbook will:
|
||||
|
||||
- obtain an SSL certificate for the base domain, just like it does for all other domains (see [how we handle SSL certificates](configuring-playbook-ssl-certificates.md))
|
||||
|
||||
- serve the `/.well-known/matrix/*` files which are necessary for [Federation Server Discovery](configuring-well-known.md#introduction-to-client-server-discovery) (also see [Server Delegation](howto-server-delegation.md)) and [Client-Server discovery](configuring-well-known.md#introduction-to-client-server-discovery)
|
||||
- serve the `/.well-known/matrix/*` files which are necessary for [Federation Server Discovery](configuring-well-known.md#federation-server-discovery) (also see [Server Delegation](howto-server-delegation.md)) and [Client-Server discovery](configuring-well-known.md#client-server-discovery)
|
||||
|
||||
- serve a simple homepage at `https://example.com` with content `Hello from example.com` (configurable via the `matrix_static_files_file_index_html_template` variable). You can also [serve a more complicated static website](#serving-a-static-website-at-the-base-domain).
|
||||
|
||||
|
||||
@ -35,7 +35,7 @@ Refer to the documentation on [how to obtain an access token](obtaining-access-t
|
||||
|
||||
You will need to prevent Synapse from rate limiting the bot's account. This is not an optional step. If you do not do this step Draupnir will crash. This can be done using Synapse's [admin API](https://matrix-org.github.io/synapse/latest/admin_api/user_admin_api.html#override-ratelimiting-for-users). Please ask for help if you are uncomfortable with these steps or run into issues.
|
||||
|
||||
If your Synapse Admin API is exposed to the internet for some reason like running the Synapse Admin Role [Link](/docs/configuring-playbook-synapse-admin.md) or running `matrix_synapse_container_labels_public_client_synapse_admin_api_enabled: true` in your playbook config. If your API is not externally exposed you should still be able to on the local host for your synapse run these commands.
|
||||
If your Synapse Admin API is exposed to the internet for some reason like running the Synapse Admin Role [Link](configuring-playbook-synapse-admin.md) or running `matrix_synapse_container_labels_public_client_synapse_admin_api_enabled: true` in your playbook config. If your API is not externally exposed you should still be able to on the local host for your synapse run these commands.
|
||||
|
||||
The following command works on semi up to date Windows 10 installs and All Windows 11 installations and other systems that ship curl. `curl --header "Authorization: Bearer <access_token>" -X POST https://matrix.example.com/_synapse/admin/v1/users/@example:example.com/override_ratelimit` Replace `@example:example.com` with the MXID of your Draupnir and example.com with your homeserver domain. You can easily obtain an access token for a homeserver admin account the same way you can obtain an access token for Draupnir itself. If you made Draupnir Admin you can just use the Draupnir token.
|
||||
|
||||
|
||||
@ -31,7 +31,7 @@ Refer to the documentation on [how to obtain an access token](obtaining-access-t
|
||||
|
||||
You will need to prevent Synapse from rate limiting the bot's account. This is not an optional step. If you do not do this step Mjolnir will crash. This can be done using Synapse's [admin API](https://matrix-org.github.io/synapse/latest/admin_api/user_admin_api.html#override-ratelimiting-for-users). Please ask for help if you are uncomfortable with these steps or run into issues.
|
||||
|
||||
If your Synapse Admin API is exposed to the internet for some reason like running the Synapse Admin Role [Link](/docs/configuring-playbook-synapse-admin.md) or running `matrix_synapse_container_labels_public_client_synapse_admin_api_enabled: true` in your playbook config. If your API is not externally exposed you should still be able to on the local host for your synapse run these commands.
|
||||
If your Synapse Admin API is exposed to the internet for some reason like running the Synapse Admin Role [Link](configuring-playbook-synapse-admin.md) or running `matrix_synapse_container_labels_public_client_synapse_admin_api_enabled: true` in your playbook config. If your API is not externally exposed you should still be able to on the local host for your synapse run these commands.
|
||||
|
||||
The following command works on semi up to date Windows 10 installs and All Windows 11 installations and other systems that ship curl. `curl --header "Authorization: Bearer <access_token>" -X POST https://matrix.example.com/_synapse/admin/v1/users/@example:example.com/override_ratelimit` Replace `@example:example.com` with the MXID of your Mjolnir and example.com with your homeserver domain. You can easily obtain an access token for a homeserver admin account the same way you can obtain an access token for Mjolnir itself. If you made Mjolnir Admin you can just use the Mjolnir token.
|
||||
|
||||
|
||||
@ -54,7 +54,7 @@ Send `login YOUR_LINKEDIN_EMAIL_ADDRESS` to the bridge bot to enable bridging fo
|
||||
|
||||
If you run into trouble, check the [Troubleshooting](#troubleshooting) section below.
|
||||
|
||||
After successfully enabling bridging, you may wish to [set up Double Puppeting](#set-up-double-puppeting), if you haven't already done so.
|
||||
After successfully enabling bridging, you may wish to [set up Double Puppeting](#set-up-double-puppeting-by-enabling-appservice-double-puppet-or-shared-secret-auth), if you haven't already done so.
|
||||
|
||||
|
||||
## Troubleshooting
|
||||
|
||||
@ -60,7 +60,7 @@ Unless indicated otherwise, the following endpoints are reachable on your `matri
|
||||
| widgets | `/hookshot/widgetapi/` | `matrix_hookshot_widgets_endpoint` | Widgets |
|
||||
| metrics | `/metrics/hookshot` | `matrix_hookshot_metrics_enabled` and exposure enabled via `matrix_hookshot_metrics_proxying_enabled` or `matrix_metrics_exposure_enabled`. Read more in the [Metrics section](#metrics) below. | Prometheus |
|
||||
|
||||
Also see the various `matrix_hookshot_container_labels_*` variables in [default/main.yml](/roles/custom/matrix-bridge-hookshot/default/main.yml), which expose URLs publicly.
|
||||
Also see the various `matrix_hookshot_container_labels_*` variables in [main.yml](/roles/custom/matrix-bridge-hookshot/defaults/main.yml), which expose URLs publicly.
|
||||
|
||||
The different listeners are also reachable *internally* in the docker-network via the container's name (configured by `matrix_hookshot_container_url`) and on different ports (e.g. `matrix_hookshot_appservice_port`). Read [main.yml](/roles/custom/matrix-bridge-hookshot/defaults/main.yml) in detail for more info.
|
||||
|
||||
|
||||
@ -4,7 +4,11 @@ This playbook can install the [SchildiChat Web](https://github.com/SchildiChat/s
|
||||
|
||||
SchildiChat Web is a feature-rich messenger for Matrix based on Element Web with some extras and tweaks. It can be installed alongside or instead of Element Web.
|
||||
|
||||
**WARNING**: SchildiChat Web is based on Element Web, but its releases are lagging behind. As an example (from 2024-02-26), SchildiChat Web is 22 releases behind (it being based on Element Web `v1.11.36`, while Element Web is now on `v1.11.58`). Element Web frequently suffers from security issues, so running something based on an ancient Element Web release is **dangerous**. Use SchildiChat Web at your own risk!
|
||||
💡 **Note**: the latest version of SchildiChat Web is also available on the web, hosted by 3rd parties. If you trust giving your credentials to the following 3rd party Single Page Application, you can consider using it from there:
|
||||
|
||||
- [app.schildi.chat](https://app.schildi.chat/), hosted by the [SchildiChat](https://schildi.chat/) developers
|
||||
|
||||
**WARNING**: SchildiChat Web is based on Element Web, but its releases are lagging behind. As of 2024-11, SchildiChat Web is many releases behind (it being based on Element Web `v1.11.36`, while Element Web is now on `v1.11.85`). Element Web frequently suffers from security issues (see [here](https://github.com/element-hq/element-web/security) for known issues), so running something based on an ancient Element Web release is **unsafe**. Use SchildiChat Web at your own risk!
|
||||
|
||||
## Adjusting the playbook configuration
|
||||
|
||||
|
||||
@ -50,7 +50,7 @@ After configuring the playbook and potentially [adjusting your DNS records](#adj
|
||||
|
||||
The Etherpad UI should be available at `https://etherpad.example.com`, while the admin UI (if enabled) should then be available at `https://etherpad.example.com/admin`.
|
||||
|
||||
If you've [decided on another hostname or path-prefix](#decide-on-a-domain-and-path) (e.g. `https://matrix.example.com/etherpad`), adjust these URLs accordingly before usage.
|
||||
If you've [decided on another hostname or path-prefix](#adjusting-the-etherpad-url) (e.g. `https://matrix.example.com/etherpad`), adjust these URLs accordingly before usage.
|
||||
|
||||
|
||||
### Managing / Deleting old pads
|
||||
|
||||
@ -2,6 +2,7 @@
|
||||
|
||||
By default, your server federates with the whole Matrix network. That is, people on your server can communicate with people on any other Matrix server.
|
||||
|
||||
**Note**: in the sample `vars.yml` ([`examples/vars.yml`](../examples/vars.yml)), we recommend to use a short user identifier like `@<username>:example.com` and set up [server delegation](howto-server-delegation.md) / redirection. Without a proper configuration, your server will effectively not be part of the Matrix network. If you find your server is not federated, make sure to [check whether services work](maintenance-checking-services.md) and your server is properly delegated.
|
||||
|
||||
## Federating only with select servers
|
||||
|
||||
|
||||
147
docs/configuring-playbook-fluffygate.md
Normal file
147
docs/configuring-playbook-fluffygate.md
Normal file
@ -0,0 +1,147 @@
|
||||
# Setting up Fluffygate (optional)
|
||||
|
||||
The playbook can install and configure [Fluffygate](https://github.com/krille-chan/fluffygate), a simple Push Gateway for Fluffychat.
|
||||
|
||||
See the project's documentation to learn what it does and why it might be useful to you.
|
||||
|
||||
**Note**: most people don't need to install their own gateway. This optional playbook component is only useful to people who develop/build their own Matrix client applications themselves, as you'll need access to your own Firebase/FCM and APNS credentials.
|
||||
|
||||
## Adjusting the playbook configuration
|
||||
|
||||
To enable Fluffygate, add the following configuration to your `inventory/host_vars/matrix.example.com/vars.yml` file:
|
||||
|
||||
```yaml
|
||||
matrix_fluffygate_enabled: true
|
||||
|
||||
# Basic app information
|
||||
matrix_fluffygate_app_name: "Your App Name"
|
||||
matrix_fluffygate_app_website: "https://example.com"
|
||||
|
||||
# Firebase/FCM configuration (for Android / IOS)
|
||||
matrix_fluffygate_firebase_project: "your-firebase-project-id"
|
||||
matrix_fluffygate_firebase_key: |
|
||||
{
|
||||
# Your Firebase service account key JSON content
|
||||
}
|
||||
|
||||
# Notification settings
|
||||
matrix_fluffygate_notification_title: "{count} new messages"
|
||||
matrix_fluffygate_notification_body: "{body}"
|
||||
|
||||
# Android specific notification options
|
||||
matrix_fluffygate_android_notification_options:
|
||||
priority: high
|
||||
notification:
|
||||
sound: "default"
|
||||
icon: "notifications_icon"
|
||||
tag: "default_notification"
|
||||
|
||||
# APNS specific notification options (for iOS)
|
||||
matrix_fluffygate_apns_notification_options:
|
||||
headers:
|
||||
apns-priority: "10"
|
||||
payload:
|
||||
aps:
|
||||
sound: "default"
|
||||
badge: "{count}"
|
||||
mutable-content: 1
|
||||
```
|
||||
|
||||
For a complete list of available configuration options, see the `defaults/main.yml` file in the role.
|
||||
|
||||
### Required Configuration
|
||||
|
||||
The following settings are required and must be defined:
|
||||
- `matrix_fluffygate_hostname`
|
||||
- `matrix_fluffygate_path_prefix`
|
||||
- `matrix_fluffygate_container_network`
|
||||
- `matrix_fluffygate_app_name`
|
||||
- `matrix_fluffygate_app_website`
|
||||
|
||||
### Adjusting the Fluffygate URL
|
||||
|
||||
By default, this playbook installs Fluffygate at the root path (`/`) of the configured hostname. You can customize both the hostname and path prefix using these variables:
|
||||
|
||||
```yaml
|
||||
# Configure the hostname where Fluffygate will be served
|
||||
matrix_fluffygate_hostname: "push.example.com"
|
||||
|
||||
# Configure a custom path prefix (must either be '/' or not end with a slash)
|
||||
matrix_fluffygate_path_prefix: /push
|
||||
```
|
||||
|
||||
### Traefik Integration
|
||||
|
||||
Fluffygate includes built-in support for Traefik as a reverse proxy. The following settings control this integration:
|
||||
|
||||
```yaml
|
||||
# Enable/disable Traefik labels
|
||||
matrix_fluffygate_container_labels_traefik_enabled: true
|
||||
|
||||
# Configure the Traefik network
|
||||
matrix_fluffygate_container_labels_traefik_docker_network: "{{ matrix_fluffygate_container_network }}"
|
||||
|
||||
# Additional Traefik configuration
|
||||
matrix_fluffygate_container_labels_traefik_rule: "Host(`{{ matrix_fluffygate_container_labels_traefik_hostname }}`)"
|
||||
matrix_fluffygate_container_labels_traefik_priority: 0
|
||||
matrix_fluffygate_container_labels_traefik_entrypoints: web-secure
|
||||
```
|
||||
|
||||
## Adjusting DNS records
|
||||
|
||||
You will need to configure your DNS records to point the Fluffygate hostname to your server. This typically involves creating either:
|
||||
- an A record pointing to your server's IPv4 address
|
||||
- a CNAME record pointing to your server's hostname
|
||||
|
||||
## Installing
|
||||
|
||||
After configuring the playbook and adjusting your DNS records, run the installation command:
|
||||
|
||||
```bash
|
||||
ansible-playbook -i inventory/hosts setup.yml --tags=setup-all,start
|
||||
```
|
||||
|
||||
To install only Fluffygate, you can use:
|
||||
|
||||
```bash
|
||||
ansible-playbook -i inventory/hosts setup.yml --tags=setup-fluffygate,start
|
||||
```
|
||||
|
||||
## Usage
|
||||
|
||||
To make use of your Fluffygate installation:
|
||||
|
||||
1. Configure your Matrix client application to use your Fluffygate URL as the push gateway
|
||||
2. Ensure your app uses the same Firebase/FCM credentials for Android notifications
|
||||
3. Ensure your app uses the same APNS certificates/credentials for iOS notifications
|
||||
4. Configure the notification templates and options as needed through the playbook variables
|
||||
|
||||
### Debugging
|
||||
|
||||
If you need to troubleshoot issues:
|
||||
|
||||
1. Enable debug logs by setting:
|
||||
```yaml
|
||||
matrix_fluffygate_debug_logs: true
|
||||
```
|
||||
|
||||
2. Check the container logs:
|
||||
```bash
|
||||
docker logs matrix-fluffygate
|
||||
```
|
||||
|
||||
## Uninstalling
|
||||
|
||||
To remove Fluffygate, first disable it in your `inventory/host_vars/matrix.example.com/vars.yml`:
|
||||
|
||||
```yaml
|
||||
matrix_fluffygate_enabled: false
|
||||
```
|
||||
|
||||
Then run the playbook:
|
||||
|
||||
```bash
|
||||
ansible-playbook -i inventory/hosts setup.yml --tags=setup-fluffygate,start
|
||||
```
|
||||
|
||||
This will stop the service and remove all associated files.
|
||||
@ -46,7 +46,7 @@ By default, you will need to create a CNAME record for `jitsi`. See [Configuring
|
||||
|
||||
By default the Jitsi Meet instance does not require any kind of login and is open to use for anyone without registration.
|
||||
|
||||
If you're fine with such an open Jitsi instance, please skip to [Apply changes](#apply-changes).
|
||||
If you're fine with such an open Jitsi instance, please skip to [Installing](#installing).
|
||||
|
||||
If you would like to control who is allowed to open meetings on your new Jitsi instance, then please follow the following steps to enable Jitsi's authentication and optionally guests mode.
|
||||
|
||||
|
||||
@ -34,6 +34,16 @@ matrix_ma1sd_matrixorg_forwarding_enabled: true
|
||||
|
||||
If you'd like to change the default email templates used by ma1sd, take a look at the `matrix_ma1sd_threepid_medium_email_custom_` variables (in the `roles/custom/matrix-ma1sd/defaults/main.yml` file.
|
||||
|
||||
## Adjusting DNS records
|
||||
|
||||
To make the ma1sd Identity Server enable its federation features, set up an SRV record that looks like this:
|
||||
- Name: `_matrix-identity._tcp` (use this text as-is)
|
||||
- Content: `10 0 443 matrix.example.com` (replace `example.com` with your own)
|
||||
|
||||
See [ma1sd's documentation](https://github.com/ma1uta/ma1sd/wiki/mxisd-and-your-privacy#choices-are-never-easy) for information on the privacy implications of setting up this SRV record.
|
||||
|
||||
**Note**: This `_matrix-identity._tcp` SRV record for the identity server is different from the `_matrix._tcp` that can be used for Synapse delegation. See [howto-server-delegation.md](howto-server-delegation.md) for more information about delegation.
|
||||
|
||||
## Installing
|
||||
|
||||
After configuring the playbook, run the [installation](installing.md) command: `just install-all` or `just setup-all`
|
||||
@ -44,7 +54,7 @@ To use the [Registration](https://github.com/ma1uta/ma1sd/blob/master/docs/featu
|
||||
|
||||
- `matrix_synapse_enable_registration` - to enable user-initiated registration in Synapse
|
||||
|
||||
- `matrix_synapse_enable_registration_captcha` - to validate registering users using reCAPTCHA, as described in the [enabling reCAPTCHA](configuring_captcha.md) documentation.
|
||||
- `matrix_synapse_enable_registration_captcha` - to validate registering users using reCAPTCHA, as described in the [enabling reCAPTCHA](configuring-captcha.md) documentation.
|
||||
|
||||
- `matrix_synapse_registrations_require_3pid` - a list of 3pid types (among `'email'`, `'msisdn'`) required by the Synapse server for registering
|
||||
|
||||
|
||||
@ -32,7 +32,7 @@ If you have local media store files and wish to migrate to Backblaze B2 subseque
|
||||
|
||||
## Migrating from local filesystem storage to S3
|
||||
|
||||
It's a good idea to [make a complete server backup](faq.md#how-do-i-backup-the-data-on-my-server) before migrating your local media store to an S3-backed one.
|
||||
It's a good idea to [make a complete server backup](faq.md#how-do-i-back-up-the-data-on-my-server) before migrating your local media store to an S3-backed one.
|
||||
|
||||
After making the backup, follow one of the guides below for a migration path from a locally-stored media store to one stored on S3-compatible storage:
|
||||
|
||||
|
||||
@ -104,7 +104,7 @@ matrix_synapse_oidc_enabled: true
|
||||
matrix_synapse_oidc_providers:
|
||||
- idp_id: keycloak
|
||||
idp_name: "My KeyCloak server"
|
||||
issuer: "https://url.ix/auth/realms/{realm_name}"
|
||||
issuer: "https://url.ix/realms/{realm_name}"
|
||||
client_id: "matrix"
|
||||
client_secret: "{{ vault_synapse_keycloak }}"
|
||||
scopes: ["openid", "profile"]
|
||||
|
||||
@ -1,14 +1,8 @@
|
||||
# Configuring the playbook
|
||||
|
||||
<sup>⚡️[Quick start](README.md) | [Prerequisites](prerequisites.md) > [Configuring your DNS server](configuring-dns.md) > [Getting the playbook](getting-the-playbook.md) > Configuring the playbook > [Installing](installing.md) </sup>
|
||||
<sup>⚡️[Quick start](README.md) | [Prerequisites](prerequisites.md) > [Configuring your DNS settings](configuring-dns.md) > [Getting the playbook](getting-the-playbook.md) > Configuring the playbook > [Installing](installing.md)</sup>
|
||||
|
||||
To configure the Ansible playbook, you need to have done the following things:
|
||||
|
||||
- have a server where Matrix services will run
|
||||
- [configured your DNS records](configuring-dns.md)
|
||||
- [retrieved the playbook's source code](getting-the-playbook.md) to your computer
|
||||
|
||||
You can then follow these steps inside the playbook directory:
|
||||
If you've configured your DNS records and retrieved the playbook's source code to your computer, you can start configuring the playbook. To do so, follow these steps inside the playbook directory:
|
||||
|
||||
1. create a directory to hold your configuration (`mkdir -p inventory/host_vars/matrix.example.com` where `example.com` is your "base domain")
|
||||
|
||||
@ -28,7 +22,7 @@ For a basic Matrix installation, that's all you need.
|
||||
|
||||
For a more custom setup, see the [Other configuration options](#other-configuration-options) below.
|
||||
|
||||
When you're done with all the configuration you'd like to do, continue with [Installing](installing.md).
|
||||
[▶️](installing.md) When you're done with all the configuration you'd like to do, continue with [Installing](installing.md).
|
||||
|
||||
|
||||
## Other configuration options
|
||||
@ -64,8 +58,6 @@ When you're done with all the configuration you'd like to do, continue with [Ins
|
||||
|
||||
- [Controlling Matrix federation](configuring-playbook-federation.md)
|
||||
|
||||
- [Serving the base domain](configuring-playbook-base-domain-serving.md)
|
||||
|
||||
### Clients
|
||||
|
||||
Web clients for Matrix that you can host on your own domains.
|
||||
@ -106,7 +98,7 @@ Extend and modify how users are authenticated on your homeserver.
|
||||
|
||||
Use alternative file storage to the default `media_store` folder.
|
||||
|
||||
- [Storing Matrix media files on Amazon S3 with Goofys](docs/configuring-playbook-s3-goofys.md)
|
||||
- [Storing Matrix media files on Amazon S3 with Goofys](configuring-playbook-s3-goofys.md)
|
||||
|
||||
- [Storing Synapse media files on Amazon S3 or another compatible Object Storage](configuring-playbook-s3.md)
|
||||
|
||||
@ -205,7 +197,7 @@ Services that help you in administrating and monitoring your Matrix installation
|
||||
|
||||
- [Enabling metrics and graphs (Prometheus, Grafana) for your Matrix server](configuring-playbook-prometheus-grafana.md)
|
||||
|
||||
- [Enabling metrics and graphs for NginX logs](docs/configuring-playbook-prometheus-nginxlog.md)
|
||||
- [Enabling metrics and graphs for NginX logs](configuring-playbook-prometheus-nginxlog.md)
|
||||
|
||||
- [Setting up the rageshake bug report server](configuring-playbook-rageshake.md)
|
||||
|
||||
|
||||
@ -1,49 +1,46 @@
|
||||
# Configuring Service Discovery via .well-known
|
||||
|
||||
Service discovery is a way for the Matrix network to discover where a Matrix server is.
|
||||
This documentation page explains how to configure Service discovery via `/.well-known/` files. Service discovery is a way for the Matrix network to discover where a Matrix server is.
|
||||
|
||||
There are 2 types of well-known service discovery that Matrix makes use of:
|
||||
## Types of well-known service discovery mechanism
|
||||
|
||||
- (important) **Federation Server discovery** (`/.well-known/matrix/server`) -- assists other servers in the Matrix network with finding your server. Without a proper configuration, your server will effectively not be part of the Matrix network. Learn more in [Introduction to Federation Server Discovery](#introduction-to-federation-server-discovery)
|
||||
There are 3 types of well-known service discovery mechanism that Matrix makes use of:
|
||||
|
||||
- (not that important) **Client Server discovery** (`/.well-known/matrix/client`) -- assists programs that you use to connect to your server (e.g. Element Web), so that they can make it more convenient for you by automatically configuring the "Homeserver URL" and "Identity Server URL" addresses. Learn more in [Introduction to Client Server Discovery](#introduction-to-client-server-discovery)
|
||||
- (important) **Federation Server discovery** (`/.well-known/matrix/server`) -- assists other servers in the Matrix network with finding your server. With the default playbook configuration specified on the sample `vars.yml` ([`examples/vars.yml`](../examples/vars.yml)), this is necessary for federation to work. Without a proper configuration, your server will effectively not be part of the Matrix network.
|
||||
|
||||
- (less important) **Client Server discovery** (`/.well-known/matrix/client`) -- assists programs that you use to connect to your server (e.g. Element Web), so that they can make it more convenient for you by automatically configuring the "Homeserver URL" and "Identity Server URL" addresses.
|
||||
|
||||
## Introduction to Federation Server Discovery
|
||||
- (optional) **Support service discovery** (`/.well-known/matrix/support`) -- returns server admin contact and support page of the domain.
|
||||
|
||||
All services created by this playbook are meant to be installed on their own server (such as `matrix.example.com`).
|
||||
### Federation Server Discovery
|
||||
|
||||
As [per the Server-Server specification](https://matrix.org/docs/spec/server_server/r0.1.0.html#server-discovery), to use a Matrix user identifier like `@<username>:example.com` while hosting services on a subdomain like `matrix.example.com`, the Matrix network needs to be instructed of such delegation/redirection.
|
||||
All services created by this playbook are meant to be installed on their own server (such as `matrix.example.com`), instead of the base domain (`example.com`).
|
||||
|
||||
Server delegation can be configured using DNS SRV records or by setting up a `/.well-known/matrix/server` file on the base domain (`example.com`).
|
||||
As [per the Server-Server specification](https://matrix.org/docs/spec/server_server/r0.1.0.html#server-discovery), to use a short Matrix user identifier like `@user:example.com` while hosting services on a subdomain such as `matrix.example.com`, the Matrix network needs to be instructed of [server delegation](howto-server-delegation.md) / redirection.
|
||||
|
||||
Both methods have their place and will continue to do so. You only need to use just one of these delegation methods. For simplicity reasons, our setup advocates for the `/.well-known/matrix/server` method and guides you into using that.
|
||||
For simplicity reasons, this playbook recommends you to set up server delegation via a `/.well-known/matrix/server` file.
|
||||
|
||||
To learn how to set up `/.well-known/matrix/server`, read the Installing section below.
|
||||
If you set up the DNS SRV record for server delegation instead, take a look at this documentation for more information: [Server Delegation via a DNS SRV record (advanced)](howto-server-delegation.md#server-delegation-via-a-dns-srv-record-advanced)
|
||||
|
||||
|
||||
## Introduction to Client Server Discovery
|
||||
### Client Server Discovery
|
||||
|
||||
Client Server Service discovery lets various client programs which support it, to receive a full user ID (e.g. `@username:example.com`) and determine where the Matrix server is automatically (e.g. `https://matrix.example.com`).
|
||||
|
||||
This lets you (and your users) easily connect to your Matrix server without having to customize connection URLs. When using client programs that support it, you won't need to point them to `https://matrix.example.com` in Custom Server options manually anymore. The connection URL would be discovered automatically from your full username.
|
||||
|
||||
Without /.well-known/matrix/client, the client will make the wrong "homeserver URL" assumption (it will default to using https://example.com, and users will need to notice and adjust it manually (changing it to https://matrix.example.com).
|
||||
|
||||
As [per the Client-Server specification](https://matrix.org/docs/spec/client_server/r0.4.0.html#server-discovery) Matrix does Client Server service discovery using a `/.well-known/matrix/client` file hosted on the base domain (e.g. `example.com`).
|
||||
|
||||
However, this playbook installs your Matrix server on another domain (e.g. `matrix.example.com`) and not on the base domain (e.g. `example.com`), so it takes a little extra manual effort to set up the file.
|
||||
|
||||
To learn how to set it up, read the Installing section below.
|
||||
### (Optional) Support Service Discovery
|
||||
|
||||
[MSC 1929](https://github.com/matrix-org/matrix-spec-proposals/pull/1929), which was added to [Matrix Specification version v1.10](https://spec.matrix.org/v1.10/client-server-api/#getwell-knownmatrixsupport), specifies a way to add contact details of admins, as well as a link to a support page for users who are having issues with the service. Automated services may also index this information and use it for abuse reports, etc.
|
||||
|
||||
## (Optional) Introduction to Homeserver Admin Contact and Support page
|
||||
To enable it, add the following configuration to your `inventory/host_vars/matrix.example.com/vars.yml` file:
|
||||
|
||||
[MSC 1929](https://github.com/matrix-org/matrix-spec-proposals/pull/1929) specifies a way to add contact details of admins, as well as a link to a support page for users who are having issues with the service. Automated services may also index this information and use it for abuse reports, etc.
|
||||
|
||||
The two playbook variables that you could look for, if you're interested in being an early adopter, are: `matrix_static_files_file_matrix_support_property_m_contacts` and `matrix_static_files_file_matrix_support_property_m_support_page`.
|
||||
|
||||
Example snippet for `vars.yml`:
|
||||
|
||||
```
|
||||
```yaml
|
||||
# Enable generation of `/.well-known/matrix/support`.
|
||||
matrix_static_files_file_matrix_support_enabled: true
|
||||
|
||||
@ -62,25 +59,31 @@ matrix_static_files_file_matrix_support_property_m_contacts:
|
||||
matrix_static_files_file_matrix_support_property_m_support_page: "https://example.com/support"
|
||||
```
|
||||
|
||||
To learn how to set up `/.well-known/matrix/support` for the base domain, read the Installing section below.
|
||||
|
||||
|
||||
## Installing well-known files on the base domain's server
|
||||
|
||||
To implement the two service discovery mechanisms, your base domain's server (e.g. `example.com`) needs to run an HTTPS-capable webserver.
|
||||
To implement the service discovery mechanisms, your base domain's server (e.g. `example.com`) needs to run an HTTPS-capable webserver.
|
||||
|
||||
If you don't have a server for your base domain at all, you can use the Matrix server for this. See [Serving the base domain](configuring-playbook-base-domain-serving.md) to learn how the playbook can help you set it up. If you decide to go this route, you don't need to read ahead in this document. When **Serving the base domain**, the playbook takes care to serve the appropriate well-known files automatically.
|
||||
### Serving the base domain from the Matrix server via the playbook
|
||||
|
||||
If you don't have a server for your base domain at all, you can use the Matrix server for this. If you don't need the base domain (e.g. `example.com`) for anything else (hosting a website, etc.), you can point it to the Matrix server's IP address and tell the playbook to configure it.
|
||||
|
||||
**This is the easiest way to set up well-known serving** -- letting the playbook handle the whole base domain for you (including SSL certificates, etc.) and take care to serve the appropriate well-known files automatically.
|
||||
|
||||
If you decide to go this route, you don't need to read ahead in this document. Instead, go to [Serving the base domain](configuring-playbook-base-domain-serving.md) to learn how the playbook can help you set it up.
|
||||
|
||||
However, if you need to use the base domain for other things, this method is less suitable than the one explained below.
|
||||
|
||||
### Manually installing well-known files on the base domain's server
|
||||
|
||||
If you're managing the base domain by yourself somehow, you'll need to set up serving of some `/.well-known/matrix/*` files from it via HTTPS.
|
||||
|
||||
To make things easy for you to set up, this playbook generates and hosts 2 well-known files on the Matrix domain's server. The files are generated at `/matrix/static-files/.well-known/matrix/` and hosted at `https://matrix.example.com/.well-known/matrix/server` and `https://matrix.example.com/.well-known/matrix/client`, even though this is the wrong place to host them.
|
||||
To make things easy for you to set up, this playbook generates and hosts a few well-known files on the Matrix domain's server. The files are generated at the `/matrix/static-files/public/.well-known/matrix/` path on the server and hosted at URLs like `https://matrix.example.com/.well-known/matrix/server` and `https://matrix.example.com/.well-known/matrix/client`, even though this is the wrong place to host them.
|
||||
|
||||
You have 3 options when it comes to installing the files on the base domain's server:
|
||||
You have two options when it comes to installing the files on the base domain's server:
|
||||
|
||||
#### (Option 1): **Copying the files manually** to your base domain's server
|
||||
|
||||
### (Option 1): **Copying the files manually** to your base domain's server
|
||||
|
||||
**Hint**: Option 2 and 3 (below) are generally a better way to do this. Make sure to go with them, if possible.
|
||||
**Hint**: Option 2 is generally a better way to do this. Make sure to go with it, if possible.
|
||||
|
||||
All you need to do is:
|
||||
|
||||
@ -90,17 +93,7 @@ All you need to do is:
|
||||
|
||||
This is relatively easy to do and possibly your only choice if you can only host static files from the base domain's server. It is, however, **a little fragile**, as future updates performed by this playbook may regenerate the well-known files and you may need to notice that and copy them over again.
|
||||
|
||||
|
||||
### (Option 2): **Serving the base domain** from the Matrix server via the playbook
|
||||
|
||||
If you don't need the base domain (e.g. `example.com`) for anything else (hosting a website, etc.), you can point it to the Matrix server's IP address and tell the playbook to configure it.
|
||||
|
||||
This is the easiest way to set up well-known serving -- letting the playbook handle the whole base domain for you (including SSL certificates, etc.). However, if you need to use the base domain for other things (such as hosting some website, etc.), going with Option 1 or Option 3 might be more suitable.
|
||||
|
||||
See [Serving the base domain](configuring-playbook-base-domain-serving.md) to learn how the playbook can help you set it up.
|
||||
|
||||
|
||||
### (Option 3): **Setting up reverse-proxying** of the well-known files from the base domain's server to the Matrix server
|
||||
#### (Option 2): **Setting up reverse-proxying** of the well-known files from the base domain's server to the Matrix server
|
||||
|
||||
This option is less fragile and generally better.
|
||||
|
||||
@ -118,7 +111,7 @@ server {
|
||||
location /.well-known/matrix {
|
||||
proxy_pass https://matrix.example.com/.well-known/matrix;
|
||||
proxy_set_header X-Forwarded-For $remote_addr;
|
||||
proxy_ssl_server_name on;
|
||||
proxy_ssl_server_name on;
|
||||
}
|
||||
|
||||
# other configuration
|
||||
|
||||
@ -95,7 +95,7 @@ Bridges can be used to connect your Matrix installation with third-party communi
|
||||
| [mx-puppet-groupme](configuring-playbook-bridge-mx-puppet-groupme.md) | [xangelix/mx-puppet-groupme](https://hub.docker.com/r/xangelix/mx-puppet-groupme) | ❌ | Bridge to [GroupMe](https://groupme.com/) |
|
||||
| [mx-puppet-steam](configuring-playbook-bridge-mx-puppet-steam.md) | [icewind1991/mx-puppet-steam](https://hub.docker.com/r/icewind1991/mx-puppet-steam) | ❌ | Bridge to [Steam](https://steamapp.com/) |
|
||||
| [Email2Matrix](configuring-playbook-email2matrix.md) | [devture/email2matrix](https://hub.docker.com/r/devture/email2matrix/) | ❌ | Bridge for relaying emails to Matrix rooms |
|
||||
| [Postmoogle](docs/configuring-playbook-bridge-postmoogle.md) | [etke.cc/postmoogle](https://github.com/etkecc/postmoogle/container_registry) | ❌ | Email to Matrix bridge |
|
||||
| [Postmoogle](configuring-playbook-bridge-postmoogle.md) | [etke.cc/postmoogle](https://github.com/etkecc/postmoogle/container_registry) | ❌ | Email to Matrix bridge |
|
||||
|
||||
## Bots
|
||||
|
||||
|
||||
10
docs/faq.md
10
docs/faq.md
@ -226,15 +226,15 @@ Using a separate domain name is easier to manage (although it's a little hard to
|
||||
|
||||
We allow `matrix.example.com` to be the Matrix server handling Matrix stuff for `example.com` by [Server Delegation](howto-server-delegation.md). During the installation procedure, we recommend that you set up server delegation using the [.well-known](configuring-well-known.md) method.
|
||||
|
||||
If you'd really like to install Matrix services directly on the base domain, see [How do I install on matrix.example.com without involving the base domain?](#how-do-i-install-on-matrix-example-com-without-involving-the-base-domain)
|
||||
If you'd really like to install Matrix services directly on the base domain, see [How do I install on matrix.example.com without involving the base domain?](#how-do-i-install-on-matrixexamplecom-without-involving-the-base-domain)
|
||||
|
||||
### I don't control anything on the base domain and can't set up delegation to matrix.example.com. What do I do?
|
||||
|
||||
If you're not in control of your base domain (or the server handling it) at all, you can take a look at [How do I install on matrix.example.com without involving the base domain?](#how-do-i-install-on-matrix-example-com-without-involving-the-base-domain)
|
||||
If you're not in control of your base domain (or the server handling it) at all, you can take a look at [How do I install on matrix.example.com without involving the base domain?](#how-do-i-install-on-matrixexamplecom-without-involving-the-base-domain)
|
||||
|
||||
### I can't set up HTTPS on the base domain. How will I get Matrix federating?
|
||||
|
||||
If you really can't obtain an HTTPS certificate for your base domain, you can take a look at [How do I install on matrix.example.com without involving the base domain?](#how-do-i-install-on-matrix-example-com-without-involving-the-base-domain)
|
||||
If you really can't obtain an HTTPS certificate for your base domain, you can take a look at [How do I install on matrix.example.com without involving the base domain?](#how-do-i-install-on-matrixexamplecom-without-involving-the-base-domain)
|
||||
|
||||
### How do I install on matrix.example.com without involving the base domain?
|
||||
|
||||
@ -371,7 +371,7 @@ Yes, you can.
|
||||
|
||||
You generally need to do a playbook installation (start at the [Prerequisites](prerequisites.md) page), followed by importing your existing data into it.
|
||||
|
||||
This Ansible playbook guides you into installing a server for `example.com` (user identifiers are like this: `@user:example.com`), while the server is at `matrix.example.com`. If your existing setup has a server name (`server_name` configuration setting in Synapse's `homeserver.yaml` file) other than the base `example.com`, you may need to tweak some additional variables. This FAQ entry may be of use if you're dealing with a more complicated setup - [How do I install on matrix.example.com without involving the base domain?](#how-do-i-install-on-matrix-example-com-without-involving-the-base-domain)
|
||||
This Ansible playbook guides you into installing a server for `example.com` (user identifiers are like this: `@user:example.com`), while the server is at `matrix.example.com`. If your existing setup has a server name (`server_name` configuration setting in Synapse's `homeserver.yaml` file) other than the base `example.com`, you may need to tweak some additional variables. This FAQ entry may be of use if you're dealing with a more complicated setup - [How do I install on matrix.example.com without involving the base domain?](#how-do-i-install-on-matrixexamplecom-without-involving-the-base-domain)
|
||||
|
||||
After configuring the playbook and installing and **before starting** services (done with `ansible-playbook ... --tags=start`) you'd import [your SQLite](importing-synapse-sqlite.md) (or [Postgres](importing-postgres.md)) database and also [import your media store](importing-synapse-media-store.md).
|
||||
|
||||
@ -451,7 +451,7 @@ You can later restore these roughly like this:
|
||||
- restore the `/matrix` directory and files on the new server manually
|
||||
- run the playbook again (see [Installing](installing.md)), but **don't** start services yet (**don't run** `... --tags=start`). This step will fix any file permission mismatches and will also set up additional software (Docker, etc.) and files on the server (systemd service, etc.).
|
||||
- perform a Postgres database import (see [Importing Postgres](importing-postgres.md)) to restore your database backup
|
||||
- start services (see [Starting the services](installing.md#starting-the-services))
|
||||
- start services (see [Finalize the installation](installing.md#finalize-the-installation))
|
||||
|
||||
If your server's IP address has changed, you may need to [set up DNS](configuring-dns.md) again.
|
||||
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
# Getting the playbook
|
||||
|
||||
<sup>⚡️[Quick start](README.md) | [Prerequisites](prerequisites.md) > [Configuring your DNS server](configuring-dns.md) > Getting the playbook > [Configuring the playbook](configuring-playbook.md) > [Installing](installing.md) </sup>
|
||||
<sup>⚡️[Quick start](README.md) | [Prerequisites](prerequisites.md) > [Configuring your DNS settings](configuring-dns.md) > Getting the playbook > [Configuring the playbook](configuring-playbook.md) > [Installing](installing.md)</sup>
|
||||
|
||||
This Ansible playbook is meant to be executed on your own computer (not the Matrix server).
|
||||
|
||||
@ -37,4 +37,4 @@ You can extract this archive anywhere. You'll get a directory called `matrix-doc
|
||||
|
||||
---------------------------------------------
|
||||
|
||||
No matter which method you've used to download the playbook, you can proceed by [Configuring the playbook](configuring-playbook.md).
|
||||
[▶️](configuring-playbook.md) No matter which method you've used to download the playbook, you can proceed by [Configuring the playbook](configuring-playbook.md).
|
||||
|
||||
@ -1,20 +1,23 @@
|
||||
# Server Delegation
|
||||
|
||||
To have a server on a subdomain (e.g. `matrix.example.com`) handle Matrix federation traffic for the base domain (`example.com`), we need to instruct the Matrix network of such a delegation.
|
||||
By default, this playbook sets up services on your Matrix server (`matrix.example.com`). To have this server officially be responsible for Matrix services for the base domain (`example.com`), you need to set up server delegation / redirection.
|
||||
|
||||
By default, this playbook guides you into setting up [Server Delegation via a well-known file](#server-delegation-via-a-well-known-file). However, that method may have some downsides that are not to your liking. Hence this guide about alternative ways to set up Server Delegation.
|
||||
Server delegation can be configured in either of these ways:
|
||||
|
||||
It is a complicated matter, so unless you are affected by the [Downsides of well-known-based Server Delegation](#downsides-of-well-known-based-server-delegation), we suggest you stay on the simple/default path.
|
||||
- [Setting up a `/.well-known/matrix/server` file](#server-delegation-via-a-well-known-file) on the base domain (`example.com`)
|
||||
- [Setting up a `_matrix._tcp` DNS SRV record](#server-delegation-via-a-dns-srv-record-advanced)
|
||||
|
||||
Both methods have their place and will continue to do so. You only need to use just one of these delegation methods.
|
||||
|
||||
For simplicity reasons, this playbook recommends you to set up server delegation via a `/.well-known/matrix/server` file. However, that method may have some downsides that are not to your liking. Hence this guide about alternative ways to set up Server Delegation.
|
||||
|
||||
**Note**: as an alternative, it is possible to install the server such that it uses only the `matrix.example.com` domain (instead of identifying as the shorter base domain - `example.com`). This should be helpful if you are not in control of anything on the base domain (`example.com`). In this case, you would not need to configure server delegation, but you would need to add other configuration. For more information, see [How do I install on matrix.example.com without involving the base domain?](faq.md#how-do-i-install-on-matrix-example-com-without-involving-the-base-domain) on our FAQ.
|
||||
|
||||
## Server Delegation via a well-known file
|
||||
|
||||
Serving a `/.well-known/matrix/server` file from the base domain is the most straightforward way to set up server delegation, but it suffers from some problems that we list in [Downsides of well-known-based Server Delegation](#downsides-of-well-known-based-server-delegation).
|
||||
|
||||
As we already mention in [Configuring DNS](configuring-dns.md) and [Configuring Service Discovery via .well-known](configuring-well-known.md), this playbook already properly guides you into setting up such delegation by means of a `/.well-known/matrix/server` file served from the base domain (`example.com`).
|
||||
|
||||
If this is okay with you, feel free to not read ahead.
|
||||
This playbook recommends you to set up server delegation by means of a `/.well-known/matrix/server` file served from the base domain (`example.com`), as this is the most straightforward way to set up the delegation.
|
||||
|
||||
To configure server delegation with the well-known file, check this section on [Configuring Service Discovery via .well-known](configuring-well-known.md): [Installing well-known files on the base domain's server](configuring-well-known.md#installing-well-known-files-on-the-base-domain-s-server)
|
||||
|
||||
### Downsides of well-known-based Server Delegation
|
||||
|
||||
@ -33,7 +36,7 @@ Otherwise, you can decide to go against the default for this playbook, and inste
|
||||
|
||||
## Server Delegation via a DNS SRV record (advanced)
|
||||
|
||||
**Note**: doing Server Delegation via a DNS SRV record is a more **advanced** way to do it and is not the default for this playbook. This is usually **much more complicated** to set up, so **we don't recommend it**. If you're not an experience sysadmin, you'd better stay away from this.
|
||||
**Note**: doing Server Delegation via a DNS SRV record is a more **advanced** way to do it and is not the default for this playbook. This is usually **much more complicated** to set up, so **we don't recommend it**. If you're not an experienced sysadmin, you'd better stay away from this.
|
||||
|
||||
As per the [Server-Server spec](https://matrix.org/docs/spec/server_server/r0.1.0.html#server-discovery), it's possible to do Server Delegation using only a SRV record (without a `/.well-known/matrix/server` file).
|
||||
|
||||
@ -47,7 +50,7 @@ To use DNS SRV record validation, you need to:
|
||||
|
||||
- ensure that you are serving the Matrix Federation API (tcp/8448) with a certificate for `example.com` (not `matrix.example.com`!). Getting this certificate to the `matrix.example.com` server may be complicated. The playbook's automatic SSL obtaining/renewal flow will likely not work and you'll need to copy certificates around manually. See below.
|
||||
|
||||
For more details on [how to configure the playbook to work with SRV delegation](howto-srv-server-delegation.md)
|
||||
For more details on how to configure the playbook to work with SRV delegation, take a look at this documentation: [Server Delegation via a DNS SRV record (advanced)](howto-srv-server-delegation.md)
|
||||
|
||||
### Obtaining certificates
|
||||
|
||||
@ -64,27 +67,9 @@ Regardless of which method for obtaining certificates you've used, once you've m
|
||||
|
||||
Based on your setup, you have different ways to go about it:
|
||||
|
||||
- [Server Delegation](#server-delegation)
|
||||
- [Server Delegation via a well-known file](#server-delegation-via-a-well-known-file)
|
||||
- [Downsides of well-known-based Server Delegation](#downsides-of-well-known-based-server-delegation)
|
||||
- [Server Delegation via a DNS SRV record (advanced)](#server-delegation-via-a-dns-srv-record-advanced)
|
||||
- [Obtaining certificates](#obtaining-certificates)
|
||||
- [Serving the Federation API with your certificates](#serving-the-federation-api-with-your-certificates)
|
||||
- [Serving the Federation API with your certificates and another webserver](#serving-the-federation-api-with-your-certificates-and-another-webserver)
|
||||
- [Serving the Federation API with your certificates and Synapse handling Federation](#serving-the-federation-api-with-your-certificates-and-synapse-handling-federation)
|
||||
#### Serving the Federation API with your certificates and Synapse handling Federation
|
||||
|
||||
|
||||
|
||||
|
||||
### Serving the Federation API with your certificates and another webserver
|
||||
|
||||
**If you are using some other webserver**, you can set up reverse-proxying for the `tcp/8448` port by yourself. Make sure to use the proper certificates for `example.com` (not for `matrix.example.com`) when serving the `tcp/8448` port.
|
||||
|
||||
As recommended in our [Fronting the integrated reverse-proxy webserver with another reverse-proxy](./configuring-playbook-own-webserver.md#fronting-the-integrated-reverse-proxy-webserver-with-another-reverse-proxy) documentation section, we recommend you to expose the Matrix Federation entrypoint from traffic at a local port (e.g. `127.0.0.1:8449`), so your reverese-proxy should send traffic there.
|
||||
|
||||
### Serving the Federation API with your certificates and Synapse handling Federation
|
||||
|
||||
**Alternatively**, you can let Synapse handle Federation by itself.
|
||||
You can let Synapse handle Federation by itself.
|
||||
|
||||
To do that, make sure the certificate files are mounted into the Synapse container:
|
||||
|
||||
@ -102,3 +87,9 @@ matrix_synapse_tls_private_key_path: /some/path/inside/the/container/private.key
|
||||
```
|
||||
|
||||
Make sure to reload Synapse once in a while (`systemctl reload matrix-synapse`), so that newer certificates can kick in. Reloading doesn't cause any downtime.
|
||||
|
||||
#### Serving the Federation API with your certificates and another webserver
|
||||
|
||||
**Alternatively**, if you are using another webserver, you can set up reverse-proxying for the `tcp/8448` port by yourself. Make sure to use the proper certificates for `example.com` (not for `matrix.example.com`) when serving the `tcp/8448` port.
|
||||
|
||||
As recommended in our [Fronting the integrated reverse-proxy webserver with another reverse-proxy](./configuring-playbook-own-webserver.md#fronting-the-integrated-reverse-proxy-webserver-with-another-reverse-proxy) documentation section, we recommend you to expose the Matrix Federation entrypoint from traffic at a local port (e.g. `127.0.0.1:8449`), so your reverese-proxy should send traffic there.
|
||||
|
||||
@ -73,7 +73,7 @@ traefik_configuration_extension_yaml: |
|
||||
storage: {{ traefik_config_certificatesResolvers_acme_storage | to_json }}
|
||||
|
||||
# 2. Configure the environment variables needed by Rraefik to automate the ACME DNS Challenge (example for Cloudflare)
|
||||
traefik_environment_variables: |
|
||||
traefik_environment_variables_additional_variables: |
|
||||
CF_API_EMAIL=redacted
|
||||
CF_ZONE_API_TOKEN=redacted
|
||||
CF_DNS_API_TOKEN=redacted
|
||||
@ -153,7 +153,7 @@ traefik_configuration_extension_yaml: |
|
||||
traefik_certResolver_primary: "dns"
|
||||
|
||||
# Configure the environment variables needed by Traefik to automate the ACME DNS Challenge (example for Cloudflare)
|
||||
traefik_environment_variables: |
|
||||
traefik_environment_variables_additional_variables: |
|
||||
CF_API_EMAIL=redacted
|
||||
CF_ZONE_API_TOKEN=redacted
|
||||
CF_DNS_API_TOKEN=redacted
|
||||
|
||||
@ -1,8 +1,8 @@
|
||||
# Installing
|
||||
|
||||
<sup>⚡️[Quick start](README.md) | [Prerequisites](prerequisites.md) > [Configuring your DNS server](configuring-dns.md) > [Getting the playbook](getting-the-playbook.md) > [Configuring the playbook](configuring-playbook.md) > Installing </sup>
|
||||
<sup>⚡️[Quick start](README.md) | [Prerequisites](prerequisites.md) > [Configuring your DNS settings](configuring-dns.md) > [Getting the playbook](getting-the-playbook.md) > [Configuring the playbook](configuring-playbook.md) > Installing</sup>
|
||||
|
||||
If you've [configured your DNS](configuring-dns.md) and have [configured the playbook](configuring-playbook.md), you can start the installation procedure.
|
||||
If you've configured your DNS records and the playbook, you can start the installation procedure.
|
||||
|
||||
## Update Ansible roles
|
||||
|
||||
@ -66,15 +66,39 @@ You can now:
|
||||
ansible-playbook -i inventory/hosts setup.yml --tags=ensure-matrix-users-created,start
|
||||
```
|
||||
|
||||
## Create your user account
|
||||
|
||||
ℹ️ *You can skip this step if you have installed a server and imported old data to it.*
|
||||
|
||||
As you have configured your brand new server and the client, you need to **create your user account** on your Matrix server.
|
||||
|
||||
After creating the user account, you can log in to it with [Element Web](configuring-playbook-client-element-web.md) that this playbook has installed for you at this URL: `https://element.example.com/`.
|
||||
|
||||
To register a user via this Ansible playbook, run the command below on your local computer.
|
||||
|
||||
**Notes**:
|
||||
- Before running it, make sure to edit `YOUR_USERNAME_HERE` and `YOUR_PASSWORD_HERE`
|
||||
- In the command below, `YOUR_USERNAME_HERE` is just a plain username (like `john`), not your full `@user:example.com` identifier
|
||||
|
||||
```sh
|
||||
ansible-playbook -i inventory/hosts setup.yml --extra-vars='username=YOUR_USERNAME_HERE password=YOUR_PASSWORD_HERE admin=<yes|no>' --tags=register-user
|
||||
|
||||
# Example: `ansible-playbook -i inventory/hosts setup.yml --extra-vars='username=john password=secret-password admin=yes' --tags=register-user`
|
||||
```
|
||||
|
||||
For more information, see the documentation for [registering users](registering-users.md).
|
||||
|
||||
## Finalize the installation
|
||||
|
||||
Now that services are running, you need to **finalize the installation process** (required for federation to work!) by [Configuring Service Discovery via .well-known](configuring-well-known.md).
|
||||
Now you've configured Matrix services and your user account, you need to **finalize the installation process** by [setting up Matrix delegation (redirection)](howto-server-delegation.md), so that your Matrix server (`matrix.example.com`) can present itself as the base domain (`example.com`) in the Matrix network.
|
||||
|
||||
If you need the base domain (`example.com`) for anything else such as hosting a website, you have to configure it manually, following the procedure described on the linked documentation.
|
||||
This is required for federation to work! Without a proper configuration, your server will effectively not be part of the Matrix network.
|
||||
|
||||
If you need the base domain for anything else such as hosting a website, you have to configure it manually, following the procedure described on the linked documentation.
|
||||
|
||||
However, if you do not need the base domain for anything else, the easiest way of configuring it is to [serve the base domain](configuring-playbook-base-domain-serving.md) from the integrated web server. It will enable you to use a Matrix user identifier like `@<username>:example.com` while hosting services on a subdomain like `matrix.example.com`.
|
||||
|
||||
To configure Service Discovery in this way, add the following configuration to your `inventory/host_vars/matrix.example.com/vars.yml` file:
|
||||
To configure server delegation in this way, add the following configuration to your `inventory/host_vars/matrix.example.com/vars.yml` file:
|
||||
|
||||
```yaml
|
||||
matrix_static_files_container_labels_base_domain_enabled: true
|
||||
@ -91,7 +115,6 @@ ansible-playbook -i inventory/hosts setup.yml --tags=install-all,start
|
||||
After finilizing the installation, you can:
|
||||
|
||||
- [check if services work](maintenance-checking-services.md)
|
||||
- or [create your first Matrix user account](registering-users.md)
|
||||
- or [set up additional services](configuring-playbook.md#other-configuration-options) (bridges to other chat networks, bots, etc.)
|
||||
- or learn how to [upgrade services when new versions are released](maintenance-upgrading-services.md)
|
||||
- or learn how to [maintain your server](faq.md#maintenance)
|
||||
|
||||
@ -1,8 +1,22 @@
|
||||
# Prerequisites
|
||||
|
||||
<sup>⚡️[Quick start](README.md) | Prerequisites > [Configuring your DNS server](configuring-dns.md) > [Getting the playbook](getting-the-playbook.md) > [Configuring the playbook](configuring-playbook.md) > [Installing](installing.md) </sup>
|
||||
<sup>⚡️[Quick start](README.md) | Prerequisites > [Configuring your DNS settings](configuring-dns.md) > [Getting the playbook](getting-the-playbook.md) > [Configuring the playbook](configuring-playbook.md) > [Installing](installing.md)</sup>
|
||||
|
||||
To install Matrix services using this Ansible playbook, you need:
|
||||
To install Matrix services using this Ansible playbook, you need to prepare several requirements both on your local computer (where you will run the playbook to configure the server) and the server (where the playbook will install the Matrix services for you). **These requirements need to be set up manually** before proceeding to the next step.
|
||||
|
||||
## Your local computer
|
||||
|
||||
- [Ansible](http://ansible.com/) program. It's used to run this playbook and configures your server for you. Take a look at [our guide about Ansible](ansible.md) for more information, as well as [version requirements](ansible.md#supported-ansible-versions) and alternative ways to run Ansible.
|
||||
|
||||
- [passlib](https://passlib.readthedocs.io/en/stable/index.html) Python library. See [this official documentation](https://passlib.readthedocs.io/en/stable/install.html#installation-instructions) for an instruction to install it. On most distros, you need to install some `python-passlib` or `py3-passlib` package, etc.
|
||||
|
||||
- [`git`](https://git-scm.com/) as the recommended way to download the playbook. `git` may also be required on the server if you will be [self-building](self-building.md) components.
|
||||
|
||||
- [`just`](https://github.com/casey/just) for running `just roles`, `just update`, etc. (see [`justfile`](../justfile)), although you can also run these commands manually
|
||||
|
||||
- Strong password (random strings) generator. The playbook often requires you to create a strong password and use it for settings on `vars.yml`, components, etc. As any tools should be fine, this playbook has adopted [`pwgen`](https://linux.die.net/man/1/pwgen) (running `pwgen -s 64 1`). [Password Tech](https://pwgen-win.sourceforge.io/), formerly known as "PWGen for Windows", is available as free and open source password generator for Windows. Generally, using a random generator available on the internet is not recommended.
|
||||
|
||||
## Server
|
||||
|
||||
- (Recommended) An **x86** server ([What kind of server specs do I need?](faq.md#what-kind-of-server-specs-do-i-need)) running one of these operating systems that make use of [systemd](https://systemd.io/):
|
||||
- **Archlinux**
|
||||
@ -18,17 +32,9 @@ To install Matrix services using this Ansible playbook, you need:
|
||||
|
||||
- `root` access to your server (or a user capable of elevating to `root` via `sudo`).
|
||||
|
||||
- [Python](https://www.python.org/) being installed on the server. Most distributions install Python by default, but some don't (e.g. Ubuntu 18.04) and require manual installation (something like `apt-get install python3`). On some distros, Ansible may incorrectly [detect the Python version](https://docs.ansible.com/ansible/latest/reference_appendices/interpreter_discovery.html) (2 vs 3) and you may need to explicitly specify the interpreter path in `inventory/hosts` during installation (e.g. `ansible_python_interpreter=/usr/bin/python3`)
|
||||
- [Python](https://www.python.org/). Most distributions install Python by default, but some don't (e.g. Ubuntu 18.04) and require manual installation (something like `apt-get install python3`). On some distros, Ansible may incorrectly [detect the Python version](https://docs.ansible.com/ansible/latest/reference_appendices/interpreter_discovery.html) (2 vs 3) and you may need to explicitly specify the interpreter path in `inventory/hosts` during installation (e.g. `ansible_python_interpreter=/usr/bin/python3`)
|
||||
|
||||
- [sudo](https://www.sudo.ws/) being installed on the server, even when you've configured Ansible to log in as `root`. Some distributions, like a minimal Debian net install, do not include the `sudo` package by default.
|
||||
|
||||
- The [Ansible](http://ansible.com/) program being installed on your own computer. It's used to run this playbook and configures your server for you. Take a look at [our guide about Ansible](ansible.md) for more information, as well as [version requirements](ansible.md#supported-ansible-versions) and alternative ways to run Ansible.
|
||||
|
||||
- the [passlib](https://passlib.readthedocs.io/en/stable/index.html) Python library installed on the computer you run Ansible. On most distros, you need to install some `python-passlib` or `py3-passlib` package, etc.
|
||||
|
||||
- [`git`](https://git-scm.com/) is the recommended way to download the playbook to your computer. `git` may also be required on the server if you will be [self-building](self-building.md) components.
|
||||
|
||||
- [`just`](https://github.com/casey/just) for running `just roles`, `just update`, etc. (see [`justfile`](../justfile)), although you can also run these commands manually
|
||||
- [sudo](https://www.sudo.ws/), even when you've configured Ansible to log in as `root`. Some distributions, like a minimal Debian net install, do not include the `sudo` package by default.
|
||||
|
||||
- An HTTPS-capable web server at the base domain name (`example.com`) which is capable of serving static files. Unless you decide to [Serve the base domain from the Matrix server](configuring-playbook-base-domain-serving.md) or alternatively, to use DNS SRV records for [Server Delegation](howto-server-delegation.md).
|
||||
|
||||
@ -48,4 +54,4 @@ To install Matrix services using this Ansible playbook, you need:
|
||||
|
||||
---------------------------------------------
|
||||
|
||||
When ready to proceed, continue with [Configuring DNS](configuring-dns.md).
|
||||
[▶️](configuring-dns.md) When ready to proceed, continue with [Configuring DNS](configuring-dns.md).
|
||||
|
||||
@ -9,7 +9,7 @@ Table of contents:
|
||||
- [Managing users via a Web UI](#managing-users-via-a-web-ui)
|
||||
- [Letting certain users register on your private server](#letting-certain-users-register-on-your-private-server)
|
||||
- [Enabling public user registration](#enabling-public-user-registration)
|
||||
- [Adding/Removing Administrator privileges to an existing Synapse user](#addingremoving-administrator-privileges-to-an-existing-synapse-user)
|
||||
- [Adding/Removing Administrator privileges to an existing user](#addingremoving-administrator-privileges-to-an-existing-user)
|
||||
|
||||
|
||||
## Registering users manually
|
||||
@ -79,11 +79,6 @@ This `register-user` script actually invokes the `mas-cli manage register-user`
|
||||
⚠ **Warning**: Matrix Authentication Service [still insists](https://github.com/element-hq/matrix-authentication-service/issues/1505) on having a verified email address for each user. Upon a user's first login, they will be asked to confirm their email address. This requires that email sending is [configured](./configuring-playbook-email.md). You can also consult the [Working around email deliverability issues](./configuring-playbook-matrix-authentication-service.md#working-around-email-deliverability-issues) section for more information.
|
||||
|
||||
|
||||
## Things to do after registering users
|
||||
|
||||
If you've just installed Matrix and created some users, **to finalize the installation process** it's best if you proceed with [Configuring service discovery via .well-known](configuring-well-known.md)
|
||||
|
||||
|
||||
## Managing users via a Web UI
|
||||
|
||||
To manage users more easily (via a web user-interace), you can install [Synapse Admin](configuring-playbook-synapse-admin.md).
|
||||
|
||||
@ -15,7 +15,7 @@ ansible-playbook -i inventory/hosts setup.yml --extra-vars='username=<your-usern
|
||||
|
||||
## Option 2 (if you are using an external Postgres server):
|
||||
|
||||
You can manually generate the password hash by using the command-line after **SSH**-ing to your server (requires that [all services have been started](installing.md#starting-the-services)):
|
||||
You can manually generate the password hash by using the command-line after **SSH**-ing to your server (requires that [all services have been started](installing.md#finalize-the-installation):
|
||||
|
||||
```
|
||||
docker exec -it matrix-synapse /usr/local/bin/hash_password -c /data/homeserver.yaml
|
||||
@ -36,7 +36,7 @@ Use the Synapse User Admin API as described here: https://github.com/element-hq/
|
||||
|
||||
This requires an [access token](obtaining-access-tokens.md) from a server admin account. *This method will also log the user out of all of their clients while the other options do not.*
|
||||
|
||||
If you didn't make your account a server admin when you created it, you can learn how to switch it now by reading about it in [Adding/Removing Administrator privileges to an existing Synapse user](registering-users.md#addingremoving-administrator-privileges-to-an-existing-synapse-user).
|
||||
If you didn't make your account a server admin when you created it, you can learn how to switch it now by reading about it in [Adding/Removing Administrator privileges to an existing user in Synapse](registering-users.md#addingremoving-administrator-privileges-to-an-existing-user-in-synapse).
|
||||
|
||||
### Example:
|
||||
To set @user:example.com's password to `correct_horse_battery_staple` you could use this curl command:
|
||||
|
||||
@ -25,7 +25,7 @@
|
||||
version: v11.3.0-0
|
||||
name: grafana
|
||||
- src: git+https://github.com/mother-of-all-self-hosting/ansible-role-jitsi.git
|
||||
version: v9823-0
|
||||
version: v9823-1
|
||||
name: jitsi
|
||||
- src: git+https://github.com/mother-of-all-self-hosting/ansible-role-keydb.git
|
||||
version: v6.3.4-3
|
||||
|
||||
@ -9,7 +9,7 @@ matrix_mautrix_discord_container_image_self_build_repo: "https://mau.dev/mautrix
|
||||
matrix_mautrix_discord_container_image_self_build_branch: "{{ 'main' if matrix_mautrix_discord_version == 'latest' else matrix_mautrix_discord_version }}"
|
||||
|
||||
# renovate: datasource=docker depName=dock.mau.dev/mautrix/discord
|
||||
matrix_mautrix_discord_version: v0.7.0
|
||||
matrix_mautrix_discord_version: v0.7.1
|
||||
|
||||
# See: https://mau.dev/mautrix/discord/container_registry
|
||||
matrix_mautrix_discord_docker_image: "{{ matrix_mautrix_discord_docker_image_name_prefix }}mautrix/discord:{{ matrix_mautrix_discord_version }}"
|
||||
|
||||
@ -9,7 +9,7 @@ matrix_mautrix_gmessages_container_image_self_build_repo: "https://github.com/ma
|
||||
matrix_mautrix_gmessages_container_image_self_build_branch: "{{ 'main' if matrix_mautrix_gmessages_version == 'latest' else matrix_mautrix_gmessages_version }}"
|
||||
|
||||
# renovate: datasource=docker depName=dock.mau.dev/mautrix/gmessages
|
||||
matrix_mautrix_gmessages_version: v0.5.1
|
||||
matrix_mautrix_gmessages_version: v0.5.2
|
||||
|
||||
# See: https://mau.dev/mautrix/gmessages/container_registry
|
||||
matrix_mautrix_gmessages_docker_image: "{{ matrix_mautrix_gmessages_docker_image_name_prefix }}mautrix/gmessages:{{ matrix_mautrix_gmessages_version }}"
|
||||
|
||||
@ -13,7 +13,7 @@ matrix_mautrix_meta_instagram_enabled: true
|
||||
matrix_mautrix_meta_instagram_identifier: matrix-mautrix-meta-instagram
|
||||
|
||||
# renovate: datasource=docker depName=dock.mau.dev/mautrix/meta
|
||||
matrix_mautrix_meta_instagram_version: v0.4.1
|
||||
matrix_mautrix_meta_instagram_version: v0.4.2
|
||||
|
||||
matrix_mautrix_meta_instagram_base_path: "{{ matrix_base_data_path }}/mautrix-meta-instagram"
|
||||
matrix_mautrix_meta_instagram_config_path: "{{ matrix_mautrix_meta_instagram_base_path }}/config"
|
||||
|
||||
@ -13,7 +13,7 @@ matrix_mautrix_meta_messenger_enabled: true
|
||||
matrix_mautrix_meta_messenger_identifier: matrix-mautrix-meta-messenger
|
||||
|
||||
# renovate: datasource=docker depName=dock.mau.dev/mautrix/meta
|
||||
matrix_mautrix_meta_messenger_version: v0.4.1
|
||||
matrix_mautrix_meta_messenger_version: v0.4.2
|
||||
|
||||
matrix_mautrix_meta_messenger_base_path: "{{ matrix_base_data_path }}/mautrix-meta-messenger"
|
||||
matrix_mautrix_meta_messenger_config_path: "{{ matrix_mautrix_meta_messenger_base_path }}/config"
|
||||
|
||||
@ -9,7 +9,7 @@ matrix_mautrix_signal_container_image_self_build_repo: "https://mau.dev/mautrix/
|
||||
matrix_mautrix_signal_container_image_self_build_branch: "{{ 'main' if matrix_mautrix_signal_version == 'latest' else matrix_mautrix_signal_version }}"
|
||||
|
||||
# renovate: datasource=docker depName=dock.mau.dev/mautrix/signal
|
||||
matrix_mautrix_signal_version: v0.7.2
|
||||
matrix_mautrix_signal_version: v0.7.3
|
||||
|
||||
# See: https://mau.dev/mautrix/signal/container_registry
|
||||
matrix_mautrix_signal_docker_image: "{{ matrix_mautrix_signal_docker_image_name_prefix }}mautrix/signal:{{ matrix_mautrix_signal_docker_image_tag }}"
|
||||
|
||||
@ -9,7 +9,7 @@ matrix_mautrix_slack_container_image_self_build_repo: "https://mau.dev/mautrix/s
|
||||
matrix_mautrix_slack_container_image_self_build_branch: "{{ 'main' if matrix_mautrix_slack_version == 'latest' else matrix_mautrix_slack_version }}"
|
||||
|
||||
# renovate: datasource=docker depName=dock.mau.dev/mautrix/slack
|
||||
matrix_mautrix_slack_version: v0.1.2
|
||||
matrix_mautrix_slack_version: v0.1.3
|
||||
# See: https://mau.dev/mautrix/slack/container_registry
|
||||
matrix_mautrix_slack_docker_image: "{{ matrix_mautrix_slack_docker_image_name_prefix }}mautrix/slack:{{ matrix_mautrix_slack_version }}"
|
||||
matrix_mautrix_slack_docker_image_name_prefix: "{{ 'localhost/' if matrix_mautrix_slack_container_image_self_build else 'dock.mau.dev/' }}"
|
||||
|
||||
@ -9,7 +9,7 @@ matrix_mautrix_whatsapp_container_image_self_build_repo: "https://mau.dev/mautri
|
||||
matrix_mautrix_whatsapp_container_image_self_build_branch: "{{ 'master' if matrix_mautrix_whatsapp_version == 'latest' else matrix_mautrix_whatsapp_version }}"
|
||||
|
||||
# renovate: datasource=docker depName=dock.mau.dev/mautrix/whatsapp
|
||||
matrix_mautrix_whatsapp_version: v0.11.0
|
||||
matrix_mautrix_whatsapp_version: v0.11.1
|
||||
|
||||
# See: https://mau.dev/mautrix/whatsapp/container_registry
|
||||
matrix_mautrix_whatsapp_docker_image: "{{ matrix_mautrix_whatsapp_docker_image_name_prefix }}mautrix/whatsapp:{{ matrix_mautrix_whatsapp_version }}"
|
||||
|
||||
137
roles/custom/matrix-fluffygate/defaults/main.yml
Normal file
137
roles/custom/matrix-fluffygate/defaults/main.yml
Normal file
@ -0,0 +1,137 @@
|
||||
---
|
||||
|
||||
# Fluffygate is a reference Push Gateway for Matrix.
|
||||
# To make use of it for delivering push notificatins, you'll need to develop/build your own Matrix app.
|
||||
# Project source code URL: https://github.com/matrix-org/fluffygate
|
||||
matrix_fluffygate_enabled: true
|
||||
matrix_fluffygate_identifier: 'matrix-fluffygate'
|
||||
|
||||
# App information
|
||||
matrix_fluffygate_app_name: "Fluffygate"
|
||||
matrix_fluffygate_app_website: "https://example.com"
|
||||
matrix_fluffygate_debug_logs: false
|
||||
|
||||
# Notification settings
|
||||
matrix_fluffygate_notification_title: "{count} new messages"
|
||||
matrix_fluffygate_notification_body: "{body}"
|
||||
|
||||
# Android notification options
|
||||
matrix_fluffygate_android_notification_options:
|
||||
priority: high
|
||||
notification:
|
||||
sound: "default"
|
||||
icon: "notifications_icon"
|
||||
tag: "default_notification"
|
||||
|
||||
# APNS notification options
|
||||
matrix_fluffygate_apns_notification_options:
|
||||
headers:
|
||||
apns-priority: "10"
|
||||
payload:
|
||||
aps:
|
||||
sound: "default"
|
||||
badge: "{count}"
|
||||
mutable-content: 1
|
||||
|
||||
matrix_fluffygate_firebase_key: '' # JSON key file contents
|
||||
matrix_fluffygate_firebase_project: '' # Firebase project ID
|
||||
|
||||
# The hostname at which Fluffygate is served.
|
||||
matrix_fluffygate_hostname: ''
|
||||
|
||||
# The path at which Fluffygate is exposed.
|
||||
# This value must either be `/` or not end with a slash (e.g. `/fluffygate`).
|
||||
matrix_fluffygate_path_prefix: /
|
||||
|
||||
# renovate: datasource=docker depName=matrixdotorg/fluffygate
|
||||
matrix_fluffygate_version: 1.0.3
|
||||
|
||||
matrix_fluffygate_base_path: "{{ matrix_base_data_path }}/fluffygate"
|
||||
matrix_fluffygate_config_path: "{{ matrix_fluffygate_base_path }}/config"
|
||||
matrix_fluffygate_data_path: "{{ matrix_fluffygate_base_path }}/data"
|
||||
|
||||
# List of systemd services that matrix-fluffygate.service depends on.
|
||||
matrix_fluffygate_systemd_required_services_list: "{{ [devture_systemd_docker_base_docker_service_name] if devture_systemd_docker_base_docker_service_name else [] }}"
|
||||
|
||||
# List of systemd services that matrix-fluffygate.service wants
|
||||
matrix_fluffygate_systemd_wanted_services_list: []
|
||||
|
||||
matrix_fluffygate_docker_image: "{{ matrix_fluffygate_docker_image_registry_prefix }}djangoflow/fluffygate:{{ matrix_fluffygate_docker_image_tag }}"
|
||||
matrix_fluffygate_docker_image_tag: "{{ matrix_fluffygate_version }}"
|
||||
matrix_fluffygate_docker_image_registry_prefix: "{{ matrix_container_global_registry_prefix }}"
|
||||
matrix_fluffygate_docker_image_force_pull: "{{ matrix_fluffygate_docker_image.endswith(':latest') }}"
|
||||
|
||||
# The base container network. It will be auto-created by this role if it doesn't exist already.
|
||||
matrix_fluffygate_container_network: "{{ traefik_container_network }}"
|
||||
|
||||
# A list of additional container networks that the container would be connected to.
|
||||
# The role does not create these networks, so make sure they already exist.
|
||||
# Use this to expose this container to another reverse proxy, which runs in a different container network.
|
||||
matrix_fluffygate_container_additional_networks: []
|
||||
|
||||
# Controls whether the matrix-fluffygate container exposes its HTTP port (tcp/6000 in the container).
|
||||
#
|
||||
# Takes an "<ip>:<port>" or "<port>" value (e.g. "127.0.0.1:6000"), or empty string to not expose.
|
||||
matrix_fluffygate_container_http_host_bind_port: ''
|
||||
|
||||
# matrix_fluffygate_container_labels_traefik_enabled controls whether labels to assist a Traefik reverse-proxy will be attached to the container.
|
||||
# See `../templates/labels.j2` for details.
|
||||
#
|
||||
# To inject your own other container labels, see `matrix_fluffygate_container_labels_additional_labels`.
|
||||
matrix_fluffygate_container_labels_traefik_enabled: true
|
||||
matrix_fluffygate_container_labels_traefik_docker_network: "{{ matrix_fluffygate_container_network }}"
|
||||
matrix_fluffygate_container_labels_traefik_hostname: "{{ matrix_fluffygate_hostname }}"
|
||||
# The path prefix must either be `/` or not end with a slash (e.g. `/fluffygate`).
|
||||
matrix_fluffygate_container_labels_traefik_path_prefix: "{{ matrix_fluffygate_path_prefix }}"
|
||||
matrix_fluffygate_container_labels_traefik_rule: "Host(`{{ matrix_fluffygate_container_labels_traefik_hostname }}`){% if matrix_fluffygate_container_labels_traefik_path_prefix != '/' %} && PathPrefix(`{{ matrix_fluffygate_container_labels_traefik_path_prefix }}`){% endif %}"
|
||||
matrix_fluffygate_container_labels_traefik_priority: 0
|
||||
matrix_fluffygate_container_labels_traefik_entrypoints: web-secure
|
||||
matrix_fluffygate_container_labels_traefik_tls: "{{ matrix_fluffygate_container_labels_traefik_entrypoints != 'web' }}"
|
||||
matrix_fluffygate_container_labels_traefik_tls_certResolver: default # noqa var-naming
|
||||
|
||||
# Controls which additional headers to attach to all HTTP responses.
|
||||
# To add your own headers, use `matrix_fluffygate_container_labels_traefik_additional_response_headers_custom`
|
||||
matrix_fluffygate_container_labels_traefik_additional_response_headers: "{{ matrix_fluffygate_container_labels_traefik_additional_response_headers_auto | combine(matrix_fluffygate_container_labels_traefik_additional_response_headers_custom) }}"
|
||||
matrix_fluffygate_container_labels_traefik_additional_response_headers_auto: {}
|
||||
matrix_fluffygate_container_labels_traefik_additional_response_headers_custom: {}
|
||||
|
||||
# matrix_fluffygate_container_labels_additional_labels contains a multiline string with additional labels to add to the container label file.
|
||||
# See `../templates/labels.j2` for details.
|
||||
#
|
||||
# Example:
|
||||
# matrix_fluffygate_container_labels_additional_labels: |
|
||||
# my.label=1
|
||||
# another.label="here"
|
||||
matrix_fluffygate_container_labels_additional_labels: ''
|
||||
|
||||
# A list of extra arguments to pass to the container
|
||||
matrix_fluffygate_container_extra_arguments: []
|
||||
|
||||
matrix_fluffygate_metrics_prometheus_enabled: false
|
||||
|
||||
# Default Fluffygate configuration template which covers the generic use case.
|
||||
# You can customize it by controlling the various variables inside it.
|
||||
#
|
||||
# For a more advanced customization, you can extend the default (see `matrix_fluffygate_configuration_extension_yaml`)
|
||||
# or completely replace this variable with your own template.
|
||||
matrix_fluffygate_configuration_yaml: "{{ lookup('template', 'templates/config.yaml.j2') }}"
|
||||
|
||||
matrix_fluffygate_configuration_extension_yaml: |
|
||||
# Your custom YAML configuration for Fluffygate goes here.
|
||||
# This configuration extends the default starting configuration (`matrix_fluffygate_configuration_yaml`).
|
||||
#
|
||||
# You can override individual variables from the default configuration, or introduce new ones.
|
||||
#
|
||||
# If you need something more special, you can take full control by
|
||||
# completely redefining `matrix_fluffygate_configuration_yaml`.
|
||||
#
|
||||
# Example configuration extension follows:
|
||||
# metrics:
|
||||
# opentracing:
|
||||
# enabled: true
|
||||
|
||||
matrix_fluffygate_configuration_extension: "{{ matrix_fluffygate_configuration_extension_yaml | from_yaml if matrix_fluffygate_configuration_extension_yaml | from_yaml is mapping else {} }}"
|
||||
|
||||
# Holds the final fluffygate configuration (a combination of the default and its extension).
|
||||
# You most likely don't need to touch this variable. Instead, see `matrix_fluffygate_configuration_yaml`.
|
||||
matrix_fluffygate_configuration: "{{ matrix_fluffygate_configuration_yaml | from_yaml | combine(matrix_fluffygate_configuration_extension, recursive=True) }}"
|
||||
62
roles/custom/matrix-fluffygate/tasks/install.yml
Normal file
62
roles/custom/matrix-fluffygate/tasks/install.yml
Normal file
@ -0,0 +1,62 @@
|
||||
---
|
||||
|
||||
- name: Ensure Fluffygate paths exists
|
||||
ansible.builtin.file:
|
||||
path: "{{ item }}"
|
||||
state: directory
|
||||
mode: 0750
|
||||
owner: "{{ matrix_user_username }}"
|
||||
group: "{{ matrix_user_groupname }}"
|
||||
with_items:
|
||||
- "{{ matrix_fluffygate_base_path }}"
|
||||
- "{{ matrix_fluffygate_config_path }}"
|
||||
- "{{ matrix_fluffygate_data_path }}"
|
||||
|
||||
- name: Ensure Fluffygate config installed
|
||||
ansible.builtin.copy:
|
||||
content: "{{ matrix_fluffygate_configuration | to_nice_yaml(indent=2, width=999999) }}"
|
||||
dest: "{{ matrix_fluffygate_config_path }}/config.yaml"
|
||||
mode: 0640
|
||||
owner: "{{ matrix_user_username }}"
|
||||
group: "{{ matrix_user_groupname }}"
|
||||
|
||||
- name: Ensure Firebase key file is created when enabled
|
||||
ansible.builtin.copy:
|
||||
content: "{{ matrix_fluffygate_firebase_key }}"
|
||||
dest: "{{ matrix_fluffygate_data_path }}/firebase-key.json"
|
||||
mode: 0600
|
||||
owner: "{{ matrix_user_username }}"
|
||||
group: "{{ matrix_user_groupname }}"
|
||||
when: matrix_fluffygate_firebase_key != ''
|
||||
|
||||
- name: Ensure Fluffygate labels installed
|
||||
ansible.builtin.template:
|
||||
src: "{{ role_path }}/templates/labels.j2"
|
||||
dest: "{{ matrix_fluffygate_base_path }}/labels"
|
||||
mode: 0640
|
||||
owner: "{{ matrix_user_username }}"
|
||||
group: "{{ matrix_user_groupname }}"
|
||||
|
||||
- name: Ensure Fluffygate image is pulled
|
||||
community.docker.docker_image:
|
||||
name: "{{ matrix_fluffygate_docker_image }}"
|
||||
source: "{{ 'pull' if ansible_version.major > 2 or ansible_version.minor > 7 else omit }}"
|
||||
force_source: "{{ matrix_fluffygate_docker_image_force_pull if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}"
|
||||
force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else matrix_fluffygate_docker_image_force_pull }}"
|
||||
register: result
|
||||
retries: "{{ devture_playbook_help_container_retries_count }}"
|
||||
delay: "{{ devture_playbook_help_container_retries_delay }}"
|
||||
until: result is not failed
|
||||
|
||||
- name: Ensure Fluffygate container network is created
|
||||
community.general.docker_network:
|
||||
enable_ipv6: "{{ devture_systemd_docker_base_ipv6_enabled }}"
|
||||
name: "{{ matrix_fluffygate_container_network }}"
|
||||
driver: bridge
|
||||
driver_options: "{{ devture_systemd_docker_base_container_networks_driver_options }}"
|
||||
|
||||
- name: Ensure matrix-fluffygate.service installed
|
||||
ansible.builtin.template:
|
||||
src: "{{ role_path }}/templates/systemd/matrix-fluffygate.service.j2"
|
||||
dest: "{{ devture_systemd_docker_base_systemd_path }}/matrix-fluffygate.service"
|
||||
mode: 0644
|
||||
20
roles/custom/matrix-fluffygate/tasks/main.yml
Normal file
20
roles/custom/matrix-fluffygate/tasks/main.yml
Normal file
@ -0,0 +1,20 @@
|
||||
---
|
||||
|
||||
- tags:
|
||||
- setup-all
|
||||
- setup-fluffygate
|
||||
- install-all
|
||||
- install-fluffygate
|
||||
block:
|
||||
- when: matrix_fluffygate_enabled | bool
|
||||
ansible.builtin.include_tasks: "{{ role_path }}/tasks/validate_config.yml"
|
||||
|
||||
- when: matrix_fluffygate_enabled | bool
|
||||
ansible.builtin.include_tasks: "{{ role_path }}/tasks/install.yml"
|
||||
|
||||
- tags:
|
||||
- setup-all
|
||||
- setup-fluffygate
|
||||
block:
|
||||
- when: not matrix_fluffygate_enabled | bool
|
||||
ansible.builtin.include_tasks: "{{ role_path }}/tasks/uninstall.yml"
|
||||
25
roles/custom/matrix-fluffygate/tasks/uninstall.yml
Normal file
25
roles/custom/matrix-fluffygate/tasks/uninstall.yml
Normal file
@ -0,0 +1,25 @@
|
||||
---
|
||||
|
||||
- name: Check existence of matrix-fluffygate service
|
||||
ansible.builtin.stat:
|
||||
path: "{{ devture_systemd_docker_base_systemd_path }}/matrix-fluffygate.service"
|
||||
register: matrix_fluffygate_service_stat
|
||||
|
||||
- when: matrix_fluffygate_service_stat.stat.exists | bool
|
||||
block:
|
||||
- name: Ensure matrix-fluffygate is stopped
|
||||
ansible.builtin.service:
|
||||
name: matrix-fluffygate
|
||||
state: stopped
|
||||
enabled: false
|
||||
daemon_reload: true
|
||||
|
||||
- name: Ensure matrix-fluffygate.service doesn't exist
|
||||
ansible.builtin.file:
|
||||
path: "{{ devture_systemd_docker_base_systemd_path }}/matrix-fluffygate.service"
|
||||
state: absent
|
||||
|
||||
- name: Ensure Fluffygate base directory doesn't exist
|
||||
ansible.builtin.file:
|
||||
path: "{{ matrix_fluffygate_base_path }}"
|
||||
state: absent
|
||||
40
roles/custom/matrix-fluffygate/tasks/validate_config.yml
Normal file
40
roles/custom/matrix-fluffygate/tasks/validate_config.yml
Normal file
@ -0,0 +1,40 @@
|
||||
---
|
||||
|
||||
- name: Fail if required Fluffygate settings not defined
|
||||
ansible.builtin.fail:
|
||||
msg: >
|
||||
You need to define a required configuration setting (`{{ item }}`).
|
||||
when: "vars[item] == ''"
|
||||
with_items:
|
||||
- matrix_fluffygate_hostname
|
||||
- matrix_fluffygate_path_prefix
|
||||
- matrix_fluffygate_container_network
|
||||
|
||||
- when: matrix_fluffygate_container_labels_traefik_enabled | bool
|
||||
block:
|
||||
- name: Fail if required Fluffygate Traefik settings not defined
|
||||
ansible.builtin.fail:
|
||||
msg: >-
|
||||
You need to define a required configuration setting (`{{ item }}`).
|
||||
when: "vars[item] == ''"
|
||||
with_items:
|
||||
- matrix_fluffygate_container_labels_traefik_hostname
|
||||
- matrix_fluffygate_container_labels_traefik_path_prefix
|
||||
|
||||
# We ensure it doesn't end with a slash, because we handle both (slash and no-slash).
|
||||
# Knowing that `matrix_fluffygate_container_labels_traefik_path_prefix` does not end with a slash
|
||||
# ensures we know how to set these routes up without having to do "does it end with a slash" checks elsewhere.
|
||||
- name: Fail if matrix_fluffygate_container_labels_traefik_path_prefix ends with a slash
|
||||
ansible.builtin.fail:
|
||||
msg: >-
|
||||
matrix_fluffygate_container_labels_traefik_path_prefix (`{{ matrix_fluffygate_container_labels_traefik_path_prefix }}`) must either be `/` or not end with a slash (e.g. `/fluffygate`).
|
||||
when: "matrix_fluffygate_container_labels_traefik_path_prefix != '/' and matrix_fluffygate_container_labels_traefik_path_prefix[-1] == '/'"
|
||||
|
||||
- name: Fail if required Fluffygate settings not defined
|
||||
ansible.builtin.fail:
|
||||
msg: >
|
||||
You need to define a required configuration setting (`{{ item }}`).
|
||||
when: "vars[item] == ''"
|
||||
with_items:
|
||||
- matrix_fluffygate_app_name
|
||||
- matrix_fluffygate_app_website
|
||||
26
roles/custom/matrix-fluffygate/templates/config.yaml.j2
Normal file
26
roles/custom/matrix-fluffygate/templates/config.yaml.j2
Normal file
@ -0,0 +1,26 @@
|
||||
port: 8080
|
||||
bindAddress: "0.0.0.0"
|
||||
|
||||
# Information about the corresponding app
|
||||
appName: "{{ matrix_fluffygate_app_name }}"
|
||||
appWebsite: "{{ matrix_fluffygate_app_website }}"
|
||||
|
||||
# (Optional) Display logs for debugging
|
||||
debugLogs: {{ matrix_fluffygate_debug_logs | to_json }}
|
||||
|
||||
# The default notification title and body. {count} will be replaced by the unread
|
||||
# count of the push notification. Won't be set by default for clearing notifications.
|
||||
notificationTitle: "{{ matrix_fluffygate_notification_title }}"
|
||||
notificationBody: "{{ matrix_fluffygate_notification_body }}"
|
||||
|
||||
# Add json keys to send to fcm for android and apns configurations
|
||||
androidNotificationOptions: {{ matrix_fluffygate_android_notification_options | to_json }}
|
||||
apnsNotificationOptions: {{ matrix_fluffygate_apns_notification_options | to_json }}
|
||||
|
||||
# You firebase project ID and the path to the key file for your service account.
|
||||
{% if matrix_fluffygate_firebase_project %}
|
||||
projectId: "{{ matrix_fluffygate_firebase_project }}"
|
||||
{% endif %}
|
||||
{% if matrix_fluffygate_firebase_key %}
|
||||
fcmKeyFilePath: "/data/firebase-key.json"
|
||||
{% endif %}
|
||||
46
roles/custom/matrix-fluffygate/templates/labels.j2
Normal file
46
roles/custom/matrix-fluffygate/templates/labels.j2
Normal file
@ -0,0 +1,46 @@
|
||||
{% if matrix_fluffygate_container_labels_traefik_enabled %}
|
||||
traefik.enable=true
|
||||
|
||||
{% if matrix_fluffygate_container_labels_traefik_docker_network %}
|
||||
traefik.docker.network={{ matrix_fluffygate_container_labels_traefik_docker_network }}
|
||||
{% endif %}
|
||||
|
||||
traefik.http.services.matrix-fluffygate.loadbalancer.server.port=8080
|
||||
|
||||
{% set middlewares = [] %}
|
||||
|
||||
{% if matrix_fluffygate_container_labels_traefik_path_prefix != '/' %}
|
||||
traefik.http.middlewares.matrix-fluffygate-slashless-redirect.redirectregex.regex=({{ matrix_fluffygate_container_labels_traefik_path_prefix | quote }})$
|
||||
traefik.http.middlewares.matrix-fluffygate-slashless-redirect.redirectregex.replacement=${1}/
|
||||
{% set middlewares = middlewares + ['matrix-fluffygate-slashless-redirect'] %}
|
||||
{% endif %}
|
||||
|
||||
{% if matrix_fluffygate_container_labels_traefik_path_prefix != '/' %}
|
||||
traefik.http.middlewares.matrix-fluffygate-strip-prefix.stripprefix.prefixes={{ matrix_fluffygate_container_labels_traefik_path_prefix }}
|
||||
{% set middlewares = middlewares + ['matrix-fluffygate-strip-prefix'] %}
|
||||
{% endif %}
|
||||
|
||||
{% if matrix_fluffygate_container_labels_traefik_additional_response_headers.keys() | length > 0 %}
|
||||
{% for name, value in matrix_fluffygate_container_labels_traefik_additional_response_headers.items() %}
|
||||
traefik.http.middlewares.matrix-fluffygate-add-headers.headers.customresponseheaders.{{ name }}={{ value }}
|
||||
{% endfor %}
|
||||
{% set middlewares = middlewares + ['matrix-fluffygate-add-headers'] %}
|
||||
{% endif %}
|
||||
|
||||
traefik.http.routers.matrix-fluffygate.rule={{ matrix_fluffygate_container_labels_traefik_rule }}
|
||||
{% if matrix_fluffygate_container_labels_traefik_priority | int > 0 %}
|
||||
traefik.http.routers.matrix-fluffygate.priority={{ matrix_fluffygate_container_labels_traefik_priority }}
|
||||
{% endif %}
|
||||
traefik.http.routers.matrix-fluffygate.service=matrix-fluffygate
|
||||
{% if middlewares | length > 0 %}
|
||||
traefik.http.routers.matrix-fluffygate.middlewares={{ middlewares | join(',') }}
|
||||
{% endif %}
|
||||
traefik.http.routers.matrix-fluffygate.entrypoints={{ matrix_fluffygate_container_labels_traefik_entrypoints }}
|
||||
traefik.http.routers.matrix-fluffygate.tls={{ matrix_fluffygate_container_labels_traefik_tls | to_json }}
|
||||
{% if matrix_fluffygate_container_labels_traefik_tls %}
|
||||
traefik.http.routers.matrix-fluffygate.tls.certResolver={{ matrix_fluffygate_container_labels_traefik_tls_certResolver }}
|
||||
{% endif %}
|
||||
|
||||
{% endif %}
|
||||
|
||||
{{ matrix_fluffygate_container_labels_additional_labels }}
|
||||
@ -0,0 +1,51 @@
|
||||
#jinja2: lstrip_blocks: "True"
|
||||
[Unit]
|
||||
Description=Matrix Fluffygate
|
||||
{% for service in matrix_fluffygate_systemd_required_services_list %}
|
||||
Requires={{ service }}
|
||||
After={{ service }}
|
||||
{% endfor %}
|
||||
{% for service in matrix_fluffygate_systemd_wanted_services_list %}
|
||||
Wants={{ service }}
|
||||
{% endfor %}
|
||||
DefaultDependencies=no
|
||||
|
||||
[Service]
|
||||
Type=simple
|
||||
Environment="HOME={{ devture_systemd_docker_base_systemd_unit_home_path }}"
|
||||
ExecStartPre=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} stop --time={{ devture_systemd_docker_base_container_stop_grace_time_seconds }} matrix-fluffygate 2>/dev/null || true'
|
||||
ExecStartPre=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} rm matrix-fluffygate 2>/dev/null || true'
|
||||
|
||||
ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} create \
|
||||
--rm \
|
||||
--name=matrix-fluffygate \
|
||||
--log-driver=none \
|
||||
--user={{ matrix_user_uid }}:{{ matrix_user_gid }} \
|
||||
--cap-drop=ALL \
|
||||
--network={{ matrix_fluffygate_container_network }} \
|
||||
{% if matrix_fluffygate_container_http_host_bind_port %}
|
||||
-p {{ matrix_fluffygate_container_http_host_bind_port }}:6000 \
|
||||
{% endif %}
|
||||
--label-file={{ matrix_fluffygate_base_path }}/labels \
|
||||
--mount type=bind,src={{ matrix_fluffygate_config_path }},dst=/etc/fluffygate \
|
||||
--mount type=bind,src={{ matrix_fluffygate_data_path }},dst=/data \
|
||||
{% for arg in matrix_fluffygate_container_extra_arguments %}
|
||||
{{ arg }} \
|
||||
{% endfor %}
|
||||
{{ matrix_fluffygate_docker_image }}
|
||||
|
||||
{% for network in matrix_fluffygate_container_additional_networks %}
|
||||
ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} network connect {{ network }} matrix-fluffygate
|
||||
{% endfor %}
|
||||
|
||||
ExecStart={{ devture_systemd_docker_base_host_command_docker }} start --attach matrix-fluffygate
|
||||
|
||||
ExecStop=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} stop --time={{ devture_systemd_docker_base_container_stop_grace_time_seconds }} matrix-fluffygate 2>/dev/null || true'
|
||||
ExecStop=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} rm matrix-fluffygate 2>/dev/null || true'
|
||||
|
||||
Restart=always
|
||||
RestartSec=30
|
||||
SyslogIdentifier=matrix-fluffygate
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
@ -370,6 +370,27 @@ matrix_synapse_media_retention_remote_media_lifetime:
|
||||
# Controls the list of additional oembed providers to be added to the homeserver.
|
||||
matrix_synapse_oembed_additional_providers: []
|
||||
|
||||
# Controls message retention policies
|
||||
matrix_synapse_retention_enabled: false
|
||||
# "A single var to control them all" - applied to all retention period vars, applied only if a value is set, e.g. : "1d", "1w", "1m", "1y"
|
||||
matrix_synapse_retention_period: ""
|
||||
# The default min lifetime, applied only if a value is set, e.g. : "1d", "1w", "1m", "1y"
|
||||
matrix_synapse_retention_default_policy_min_lifetime: "{{ matrix_synapse_retention_period }}"
|
||||
# The default max lifetime, applied only if a value is set, e.g. : "1d", "1w", "1m", "1y"
|
||||
matrix_synapse_retention_default_policy_max_lifetime: "{{ matrix_synapse_retention_period }}"
|
||||
# The allowed min lifetime, applied only if a value is set, e.g. : "1d", "1w", "1m", "1y"
|
||||
matrix_synapse_retention_allowed_lifetime_min: "{{ matrix_synapse_retention_period }}"
|
||||
# The allowed max lifetime, applied only if a value is set, e.g. : "1d", "1w", "1m", "1y"
|
||||
matrix_synapse_retention_allowed_lifetime_max: "{{ matrix_synapse_retention_period }}"
|
||||
# The list of the purge jobs, structure (all fields are optional, example below contains all available variants):
|
||||
# - longest_max_lifetime: "1d"
|
||||
# shortest_max_lifetime: "1d"
|
||||
# interval: "12h"
|
||||
# - longest_max_lifetime: "1d"
|
||||
# - shortest_max_lifetime: "1d"
|
||||
# - interval: "12h"
|
||||
matrix_synapse_retention_purge_jobs: []
|
||||
|
||||
# The tmpfs at /tmp needs to be large enough to handle multiple concurrent file uploads.
|
||||
matrix_synapse_tmp_directory_size_mb: "{{ matrix_synapse_max_upload_size_mb * 50 }}"
|
||||
|
||||
|
||||
@ -590,26 +590,37 @@ templates:
|
||||
# purged are ignored and not stored again.
|
||||
#
|
||||
retention:
|
||||
{% if matrix_synapse_retention_enabled %}
|
||||
# The message retention policies feature is disabled by default. Uncomment the
|
||||
# following line to enable it.
|
||||
#
|
||||
#enabled: true
|
||||
enabled: {{ matrix_synapse_retention_enabled|to_json }}
|
||||
|
||||
# Default retention policy. If set, Synapse will apply it to rooms that lack the
|
||||
# 'm.room.retention' state event. Currently, the value of 'min_lifetime' doesn't
|
||||
# matter much because Synapse doesn't take it into account yet.
|
||||
#
|
||||
#default_policy:
|
||||
# min_lifetime: 1d
|
||||
# max_lifetime: 1y
|
||||
{% if matrix_synapse_retention_default_policy_min_lifetime | length > 0 or matrix_synapse_retention_default_policy_max_lifetime | length > 0 %}
|
||||
default_policy:
|
||||
{% if matrix_synapse_retention_default_policy_min_lifetime | length > 0 %}
|
||||
min_lifetime: {{ matrix_synapse_retention_default_policy_min_lifetime|to_json }}
|
||||
{% endif %}
|
||||
{% if matrix_synapse_retention_default_policy_max_lifetime | length > 0 %}
|
||||
max_lifetime: {{ matrix_synapse_retention_default_policy_max_lifetime|to_json }}
|
||||
{% endif %}
|
||||
{% endif %}
|
||||
|
||||
# Retention policy limits. If set, and the state of a room contains a
|
||||
# 'm.room.retention' event in its state which contains a 'min_lifetime' or a
|
||||
# 'max_lifetime' that's out of these bounds, Synapse will cap the room's policy
|
||||
# to these limits when running purge jobs.
|
||||
#
|
||||
#allowed_lifetime_min: 1d
|
||||
#allowed_lifetime_max: 1y
|
||||
{% if matrix_synapse_retention_allowed_lifetime_min | length > 0 %}
|
||||
allowed_lifetime_min: {{ matrix_synapse_retention_allowed_lifetime_min|to_json }}
|
||||
{% endif %}
|
||||
{% if matrix_synapse_retention_allowed_lifetime_max | length > 0 %}
|
||||
allowed_lifetime_max: {{ matrix_synapse_retention_allowed_lifetime_max|to_json }}
|
||||
{% endif %}
|
||||
|
||||
# Server admins can define the settings of the background jobs purging the
|
||||
# events which lifetime has expired under the 'purge_jobs' section.
|
||||
@ -640,12 +651,8 @@ retention:
|
||||
# room's policy to these values is done after the policies are retrieved from
|
||||
# Synapse's database (which is done using the range specified in a purge job's
|
||||
# configuration).
|
||||
#
|
||||
#purge_jobs:
|
||||
# - longest_max_lifetime: 3d
|
||||
# interval: 12h
|
||||
# - shortest_max_lifetime: 3d
|
||||
# interval: 1d
|
||||
purge_jobs: {{ matrix_synapse_retention_purge_jobs | to_json }}
|
||||
{% endif %}
|
||||
|
||||
|
||||
## TLS ##
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user