mirror of
https://github.com/spantaleev/matrix-docker-ansible-deploy.git
synced 2025-02-11 17:48:57 +01:00
Compare commits
21 Commits
cb422390f7
...
ab1b79204a
| Author | SHA1 | Date | |
|---|---|---|---|
|
ab1b79204a | ||
|
a8372f3613 | ||
|
9a17e7c24e | ||
|
6a124f15b3 | ||
|
|
4399b6dc80 | ||
|
a691b20cf2 | ||
|
|
8e41eb57c5 | ||
|
|
fe65a0a405 | ||
|
|
28f419402e | ||
|
|
bfc6bf16d6 | ||
|
7081124237 | ||
|
|
2d1c8c7c01 | ||
|
9f72062fea | ||
|
|
fea8df5ca2 | ||
|
1e8d4c5ba0 | ||
|
|
74b9a47ddb | ||
|
|
c5f263a9cd | ||
|
|
21ad191e9b | ||
|
|
564b3cf169 | ||
|
|
c57c9f68c0 | ||
|
|
61851df37a |
@ -4,23 +4,48 @@ The playbook can install and configure the [matrix-alertmanager-receiver](https:
|
||||
|
||||
See the project's [documentation](https://github.com/metio/matrix-alertmanager-receiver/blob/main/README.md) to learn what it does and why it might be useful to you.
|
||||
|
||||
At the moment, **setting up this service's bot requires some manual actions** as described below in [Account and room preparation](#account-and-room-preparation).
|
||||
|
||||
This service is meant to be used with an external [Alertmanager](https://prometheus.io/docs/alerting/latest/alertmanager/) instance. It's **not** meant to be integrated with the [Prometheus & Grafana stack](./configuring-playbook-prometheus-grafana.md) installed by this playbook, because the Alertmanager component is not installed by it.
|
||||
|
||||
## Prerequisites
|
||||
|
||||
### Register the bot account
|
||||
|
||||
This service uses a bot (with a username specified in `matrix_alertmanager_receiver_config_matrix_user_id_localpart`) for delivering messages.
|
||||
|
||||
The playbook does not automatically create users for you. You **need to register the bot user manually** before setting up the bot.
|
||||
|
||||
Choose a strong password for the bot. You can generate a good password with a command like this: `pwgen -s 64 1`.
|
||||
|
||||
You can use the playbook to [register a new user](registering-users.md):
|
||||
|
||||
```sh
|
||||
ansible-playbook -i inventory/hosts setup.yml --extra-vars='username=bot.alertmanager.receiver password=PASSWORD_FOR_THE_BOT admin=no' --tags=register-user
|
||||
```
|
||||
|
||||
### Get an access token
|
||||
|
||||
The bot requires an access token to be able to connect to your homeserver. Refer to the documentation on [how to obtain an access token](obtaining-access-tokens.md).
|
||||
|
||||
### Join to rooms as the bot manually
|
||||
|
||||
ℹ️ **This bot does not accept room invitations automatically**. To deliver messages to rooms, the bot must be joined to all rooms manually.
|
||||
|
||||
For each new room you would like the bot to deliver alerts to, invite the bot to the room.
|
||||
|
||||
Then, log in as the bot using any Matrix client of your choosing, accept the room invitation from the bot's account, and log out.
|
||||
|
||||
## Adjusting the playbook configuration
|
||||
|
||||
To enable matrix-alertmanager-receiver, add the following configuration to your `inventory/host_vars/matrix.example.com/vars.yml` file:
|
||||
Add the following configuration to your `inventory/host_vars/matrix.example.com/vars.yml` file. Make sure to replace `ACCESS_TOKEN_HERE` with the one created [above](#get-an-access-token).
|
||||
|
||||
```yaml
|
||||
matrix_alertmanager_receiver_enabled: true
|
||||
|
||||
# If you'd like to change the username for this bot, uncomment and adjust. Otherwise, remove.
|
||||
# Uncomment and adjust this part if you'd like to use a username different than the default
|
||||
# matrix_alertmanager_receiver_config_matrix_user_id_localpart: "bot.alertmanager.receiver"
|
||||
|
||||
# Specify the bot user's access token here.
|
||||
# See the "Account and room preparation" section below.
|
||||
matrix_alertmanager_receiver_config_matrix_access_token: ''
|
||||
matrix_alertmanager_receiver_config_matrix_access_token: "ACCESS_TOKEN_HERE"
|
||||
|
||||
# Optionally, configure some mappings (URL-friendly room name -> actual Matrix room ID).
|
||||
#
|
||||
@ -57,25 +82,9 @@ See [Configuring DNS](configuring-dns.md) for details about DNS changes.
|
||||
|
||||
If you've decided to use the default hostname, you won't need to do any extra DNS configuration.
|
||||
|
||||
## Account and room preparation
|
||||
|
||||
The playbook can automatically create users, but it cannot automatically obtain access tokens, nor perform any of the other manual actions below.
|
||||
|
||||
`matrix-alertmanager-receiver` uses a bot (with a username specified in `matrix_alertmanager_receiver_config_matrix_user_id_localpart` - see above) for delivering messages. You need to **manually register this bot acccount and obtain an access token for it**.
|
||||
|
||||
1. [Register a new user](registering-users.md): `ansible-playbook -i inventory/hosts setup.yml --extra-vars='username=bot.alertmanager.receiver password=PASSWORD_FOR_THE_BOT admin=no' --tags=register-user`
|
||||
2. [Obtain an access token](obtaining-access-tokens.md) for the bot's user account
|
||||
3. Invite the bot to a room where you'd like to alerts to be delivered
|
||||
4. Log in as the bot using any Matrix client of your choosing, accept the room invitation from the bot's account and log out
|
||||
5. (Optionally) Adjust `matrix_alertmanager_receiver_config_matrix_room_mapping` to create a mapping between the new room and its ID
|
||||
|
||||
Steps 1 and 2 above only need to be done once, while preparing your [configuration](#adjusting-the-playbook-configuration).
|
||||
|
||||
Steps 3 and 4 need to be done for each new room you'd like the bot to deliver alerts to. Step 5 is optional and provides cleaner `/alert/` URLs.
|
||||
|
||||
## Installing
|
||||
|
||||
Now that you've [prepared the bot account and room](#account-and-room-preparation), [configured the playbook](#adjusting-the-playbook-configuration), and potentially [adjusted your DNS records](#adjusting-dns-records), you can run the playbook with [playbook tags](playbook-tags.md) as below:
|
||||
After configuring the playbook and potentially [adjusting your DNS records](#adjusting-dns-records), run the playbook with [playbook tags](playbook-tags.md) as below:
|
||||
|
||||
<!-- NOTE: let this conservative command run (instead of install-all) to make it clear that failure of the command means something is clearly broken. -->
|
||||
```sh
|
||||
@ -111,6 +120,4 @@ route:
|
||||
- receiver: matrix
|
||||
```
|
||||
|
||||
.. where `URL_HERE` looks like `https://matrix.example.com/matrix-alertmanager-receiver-RANDOM_VALUE_HERE/alert/some-room-name` or `https://matrix.example.com/matrix-alertmanager-receiver-RANDOM_VALUE_HERE/alert/!qporfwt:example.com`.
|
||||
|
||||
This bot does **not** accept room invitations automatically (like many other bots do). To deliver messages to rooms, **the bot must be joined to all rooms manually** - see Step 4 of the [Account and room preparation](#account-and-room-preparation) section.
|
||||
where `URL_HERE` looks like `https://matrix.example.com/matrix-alertmanager-receiver-RANDOM_VALUE_HERE/alert/some-room-name` or `https://matrix.example.com/matrix-alertmanager-receiver-RANDOM_VALUE_HERE/alert/!qporfwt:example.com`.
|
||||
|
||||
@ -16,36 +16,65 @@ Normal Draupnir does come with the benefit of access to Synapse Admin features.
|
||||
|
||||
Draupnir for all does not support external tooling like [MRU](https://mru.rory.gay) as it can't access Draupnir's user account.
|
||||
|
||||
## Installation
|
||||
## Prerequisites
|
||||
|
||||
### Create a main management room.
|
||||
### Create a main management room
|
||||
|
||||
The playbook does not create a management room for your Main Draupnir. This task you have to do on your own.
|
||||
The playbook does not create a management room for your Main Draupnir. You **need to create the room manually** before setting up the bot.
|
||||
|
||||
Note that the room must be unencrypted.
|
||||
|
||||
<!-- TODO: enable Pantalaimon as configuring-playbook-bot-draupnir.md -->
|
||||
|
||||
The management room has to be given an alias and be public when you are setting up the bot for the first time as the bot does not differentiate between invites and invites to the management room.
|
||||
|
||||
This management room is used to control who has access to your D4A deployment. The room stores this data inside of the control room state so your bot must have sufficient powerlevel to send custom state events. This is default 50 or moderator as Element clients call this powerlevel.
|
||||
|
||||
As noted in the Draupnir install instructions the control room is sensitive. The following is said about the control room in the Draupnir install instructions.
|
||||
>Anyone in this room can control the bot so it is important that you only invite trusted users to this room. The room must be unencrypted since the playbook does not support installing Pantalaimon yet.
|
||||
As noted in the Draupnir install instructions the control room is sensitive. **Anyone in this room can control the bot so it is important that you only invite trusted users to this room.**
|
||||
|
||||
### Give your main management room an alias.
|
||||
### Set an alias to the management room
|
||||
|
||||
Give the room from step 1 an alias. This alias can be anything you want and its recommended for increased security during the setup phase of the bot that you make this alias be a random string. You can give your room a secondary human readable alias when it has been locked down after setup phase.
|
||||
Next, set an alias to the management room.
|
||||
|
||||
### Adjusting the playbook configuration.
|
||||
This alias can be anything you want. However, for increased security during the setup phase, it is recommended to make this alias be a random string. When it has been locked down after setup phase, you can give your room a secondary human readable alias.
|
||||
|
||||
Add the following configuration to your `inventory/host_vars/matrix.example.com/vars.yml` file (adapt to your needs):
|
||||
## Adjusting the playbook configuration
|
||||
|
||||
You must replace `ALIAS_FROM_STEP_2_GOES_HERE` with the alias you created in step 2.
|
||||
Add the following configuration to your `inventory/host_vars/matrix.example.com/vars.yml` file. Make sure to replace `MANAGEMENT_ROOM_ALIAS_HERE`.
|
||||
|
||||
```yaml
|
||||
matrix_appservice_draupnir_for_all_enabled: true
|
||||
|
||||
matrix_appservice_draupnir_for_all_master_control_room_alias: "ALIAS_FROM_STEP_2_GOES_HERE"
|
||||
matrix_appservice_draupnir_for_all_master_control_room_alias: "MANAGEMENT_ROOM_ALIAS_HERE"
|
||||
```
|
||||
|
||||
### Installing
|
||||
### Extending the configuration
|
||||
|
||||
You can configure additional options by adding the `matrix_appservice_draupnir_for_all_extension_yaml` variable.
|
||||
|
||||
For example, to change Draupnir's `protectAllJoinedRooms` option to `true`, add the following configuration to your `inventory/host_vars/matrix.example.com/vars.yml` file:
|
||||
|
||||
```yaml
|
||||
matrix_appservice_draupnir_for_all_extension_yaml: |
|
||||
# Your custom YAML configuration goes here.
|
||||
# This configuration extends the default starting configuration (`matrix_appservice_draupnir_for_all_yaml`).
|
||||
#
|
||||
# You can override individual variables from the default configuration, or introduce new ones.
|
||||
#
|
||||
# If you need something more special, you can take full control by
|
||||
# completely redefining `matrix_appservice_draupnir_for_all_yaml`.
|
||||
protectAllJoinedRooms: true
|
||||
```
|
||||
|
||||
You can refer to the upstream [documentation](https://github.com/the-draupnir-project/Draupnir) for more configuration documentation.
|
||||
|
||||
**Notes**:
|
||||
|
||||
- The playbook ships a full copy of the example config that does transfer to provisioned Draupnirs in the production-bots.yaml.j2 file in the template directory of the role.
|
||||
|
||||
- Config extension does not affect the appservices config as this config is not extensible in current Draupnir anyway. It instead touches the config passed to the Draupnirs that your Appservice creates. So the example above (`protectAllJoinedRooms: true`) makes all provisioned Draupnirs protect all joined rooms.
|
||||
|
||||
## Installing
|
||||
|
||||
After configuring the playbook, run it with [playbook tags](playbook-tags.md) as below:
|
||||
|
||||
@ -66,7 +95,7 @@ ansible-playbook -i inventory/hosts setup.yml --tags=setup-all,ensure-matrix-use
|
||||
|
||||
If you made it through all the steps above and your main control room was joined by a user called `@draupnir-main:example.com` you have succesfully installed Draupnir for All and can now start using it.
|
||||
|
||||
The installation of Draupnir for all in this playbook is very much Alpha quality. Usage-wise, Draupnir for allis almost identical to Draupnir bot mode.
|
||||
The installation of Draupnir for all in this playbook is very much Alpha quality. Usage-wise, Draupnir for all is almost identical to Draupnir bot mode.
|
||||
|
||||
### Granting Users the ability to use D4A
|
||||
|
||||
@ -76,30 +105,8 @@ The bot requires a powerlevel of 50 in the management room to control who is all
|
||||
|
||||
To allow users or whole homeservers you type /plain @draupnir-main:example.com allow `target` and target can be either a MXID or a wildcard like `@*:example.com` to allow all users on example.com to register. We use /plain to force the client to not attempt to mess with this command as it can break Wildcard commands especially.
|
||||
|
||||
### How to provision a D4A once you are allowed to.
|
||||
### How to provision a D4A once you are allowed to
|
||||
|
||||
Open a DM with @draupnir-main:example.com and if using an Element client send a message into this DM to finalise creating it. The bot will reject this invite and you will shortly get invited to the Draupnir control room for your newly provisioned Draupnir. From here its just a normal Draupnir experience.
|
||||
To provision a D4A, you need to start a chat with `@draupnir-main:example.com`. The bot will reject this invite and you will shortly get invited to the Draupnir control room for your newly provisioned Draupnir. From here its just a normal Draupnir experience.
|
||||
|
||||
Congratulations if you made it all the way here because you now have a fully working Draupnir for all deployment.
|
||||
|
||||
### Configuration of D4A
|
||||
|
||||
You can refer to the upstream [documentation](https://github.com/the-draupnir-project/Draupnir) for more configuration documentation. Please note that the playbook ships a full copy of the example config that does transfer to provisioned Draupnirs in the production-bots.yaml.j2 file in the template directory of the role.
|
||||
|
||||
Please note that Config extension does not affect the appservices config as this config is not extensible in current Draupnir anyways. Config extension instead touches the config passed to the Draupnirs that your Appservice creates. So for example below makes all provisioned Draupnirs protect all joined rooms.
|
||||
|
||||
You can configure additional options by adding the `matrix_appservice_draupnir_for_all_extension_yaml` variable to your `inventory/host_vars/matrix.example.com/vars.yml` file.
|
||||
|
||||
For example to change Draupnir's `protectAllJoinedRooms` option to `true` you would add the following to your `vars.yml` file.
|
||||
|
||||
```yaml
|
||||
matrix_appservice_draupnir_for_all_extension_yaml: |
|
||||
# Your custom YAML configuration goes here.
|
||||
# This configuration extends the default starting configuration (`matrix_appservice_draupnir_for_all_yaml`).
|
||||
#
|
||||
# You can override individual variables from the default configuration, or introduce new ones.
|
||||
#
|
||||
# If you need something more special, you can take full control by
|
||||
# completely redefining `matrix_appservice_draupnir_for_all_yaml`.
|
||||
protectAllJoinedRooms: true
|
||||
```
|
||||
|
||||
@ -6,13 +6,13 @@ See the project's [documentation](https://github.com/the-draupnir-project/Draupn
|
||||
|
||||
This documentation page is about installing Draupnir in bot mode. As an alternative, you can run a multi-instance Draupnir deployment by installing [Draupnir in appservice mode](./configuring-playbook-appservice-draupnir-for-all.md) (called Draupnir-for-all) instead.
|
||||
|
||||
If your migrating from Mjolnir skip to step 5b.
|
||||
If your migrating from Mjolnir skip to [this section](#migrating-from-mjolnir-only-required-if-migrating).
|
||||
|
||||
## Register the bot account
|
||||
## Prerequisites
|
||||
|
||||
The playbook does not automatically create users for you. The bot requires an access token to be able to connect to your homeserver.
|
||||
### Register the bot account
|
||||
|
||||
You **need to register the bot user manually** before setting up the bot.
|
||||
The playbook does not automatically create users for you. You **need to register the bot user manually** before setting up the bot.
|
||||
|
||||
Choose a strong password for the bot. You can generate a good password with a command like this: `pwgen -s 64 1`.
|
||||
|
||||
@ -22,25 +22,41 @@ You can use the playbook to [register a new user](registering-users.md):
|
||||
ansible-playbook -i inventory/hosts setup.yml --extra-vars='username=bot.draupnir password=PASSWORD_FOR_THE_BOT admin=no' --tags=register-user
|
||||
```
|
||||
|
||||
If you would like Draupnir to be able to deactivate users, move aliases, shutdown rooms, show abuse reports ([see below](#abuse-reports)), etc then it must be a server admin so you need to change `admin=no` to `admin=yes` in the command above.
|
||||
If you would like Draupnir to be able to deactivate users, move aliases, shutdown rooms, show abuse reports (see [below](#abuse-reports)), etc then it must be a server admin so you need to change `admin=no` to `admin=yes` in the command above.
|
||||
|
||||
## Get an access token
|
||||
### Get an access token
|
||||
|
||||
Refer to the documentation on [how to obtain an access token](obtaining-access-tokens.md).
|
||||
The bot requires an access token to be able to connect to your homeserver. Refer to the documentation on [how to obtain an access token](obtaining-access-tokens.md).
|
||||
|
||||
## Make sure the account is free from rate limiting
|
||||
### Make sure the account is free from rate limiting
|
||||
|
||||
You will need to prevent Synapse from rate limiting the bot's account. This is not an optional step. If you do not do this step Draupnir will crash. This can be done using Synapse's [admin API](https://matrix-org.github.io/synapse/latest/admin_api/user_admin_api.html#override-ratelimiting-for-users). Please ask for help if you are uncomfortable with these steps or run into issues.
|
||||
If your homeserver's implementation is Synapse, you will need to prevent it from rate limiting the bot's account. **This is a required step. If you do not configure it, Draupnir will crash.**
|
||||
|
||||
If your Synapse Admin API is exposed to the internet for some reason like running the Synapse Admin Role [Link](configuring-playbook-synapse-admin.md) or running `matrix_synapse_container_labels_public_client_synapse_admin_api_enabled: true` in your playbook config. If your API is not externally exposed you should still be able to on the local host for your synapse run these commands.
|
||||
This can be done using Synapse's [Admin APIs](https://element-hq.github.io/synapse/latest/admin_api/user_admin_api.html#override-ratelimiting-for-users). They can be accessed both externally and internally.
|
||||
|
||||
The following command works on semi up to date Windows 10 installs and All Windows 11 installations and other systems that ship curl. `curl --header "Authorization: Bearer <access_token>" -X POST https://matrix.example.com/_synapse/admin/v1/users/@bot.draupnir:example.com/override_ratelimit` Replace `@bot.draupnir:example.com` with the MXID of your Draupnir and example.com with your homeserver domain. You can easily obtain an access token for a homeserver admin account the same way you can obtain an access token for Draupnir itself. If you made Draupnir Admin you can just use the Draupnir token.
|
||||
To expose the APIs publicly, add the following configuration to your `inventory/host_vars/matrix.example.com/vars.yml` file.
|
||||
|
||||
## Create a management room
|
||||
```yaml
|
||||
matrix_synapse_container_labels_public_client_synapse_admin_api_enabled: true
|
||||
```
|
||||
|
||||
The APIs can also be accessed via [Synapse Admin](https://github.com/etkecc/synapse-admin), a web UI tool you can use to administrate users, rooms, media, etc. on your Matrix server. The playbook can install and configure Synapse Admin for you. For details about it, see [this page](configuring-playbook-synapse-admin.md).
|
||||
|
||||
**Note**: access to the APIs is restricted with a valid access token, so exposing them publicly should not be a real security concern. Still, doing so is not recommended for additional security. See [official Synapse reverse-proxying recommendations](https://element-hq.github.io/synapse/latest/reverse_proxy.html#synapse-administration-endpoints).
|
||||
|
||||
To discharge rate limiting, run the following command on systems that ship curl (note that it does not work on outdated Windows 10). Even if the APIs are not exposed to the internet, you should still be able to run the command on the homeserver locally. Before running it, make sure to replace `@bot.draupnir:example.com` with the MXID of your Draupnir:
|
||||
|
||||
```sh
|
||||
curl --header "Authorization: Bearer <access_token>" -X POST https://matrix.example.com/_synapse/admin/v1/users/@bot.draupnir:example.com/override_ratelimit
|
||||
```
|
||||
|
||||
You can obtain an access token for a homeserver admin account in the same way as you can do so for Draupnir itself. If you have made Draupnir an admin, you can just use the Draupnir token.
|
||||
|
||||
### Create a management room
|
||||
|
||||
Using your own account, create a new invite only room that you will use to manage the bot. This is the room where you will see the status of the bot and where you will send commands to the bot, such as the command to ban a user from another room. Anyone in this room can control the bot so it is important that you only invite trusted users to this room.
|
||||
|
||||
If you make the management room encrypted (E2EE), then you MUST enable and use Pantalaimon (see below).
|
||||
If you make the management room encrypted (E2EE), then you MUST enable and use Pantalaimon (see [below](#configuration-with-e2ee-support)).
|
||||
|
||||
Once you have created the room you need to copy the room ID so you can tell the bot to use that room. In Element Web you can do this by going to the room's settings, clicking Advanced, and then copying the internal room ID. The room ID will look something like `!qporfwt:example.com`.
|
||||
|
||||
@ -48,9 +64,22 @@ Finally invite the `@bot.draupnir:example.com` account you created earlier into
|
||||
|
||||
## Adjusting the playbook configuration
|
||||
|
||||
Decide whether you want Draupnir to be capable of operating in end-to-end encrypted (E2EE) rooms. This includes the management room and the moderated rooms. To support E2EE, Draupnir needs to [use Pantalaimon](configuring-playbook-pantalaimon.md).
|
||||
Add the following configuration to your `inventory/host_vars/matrix.example.com/vars.yml` file. Make sure to replace `MANAGEMENT_ROOM_ID_HERE`.
|
||||
|
||||
### a. Configuration with E2EE support
|
||||
```yaml
|
||||
# Enable Draupnir
|
||||
matrix_bot_draupnir_enabled: true
|
||||
|
||||
matrix_bot_draupnir_management_room: "MANAGEMENT_ROOM_ID_HERE"
|
||||
```
|
||||
|
||||
### End-to-End Encryption support
|
||||
|
||||
Decide whether you want Draupnir to be capable of operating in end-to-end encrypted (E2EE) rooms. This includes the management room and the moderated rooms.
|
||||
|
||||
To support E2EE, Draupnir needs to [use Pantalaimon](configuring-playbook-pantalaimon.md).
|
||||
|
||||
#### Configuration with E2EE support
|
||||
|
||||
When using Pantalaimon, Draupnir will log in to its bot account itself through Pantalaimon, so configure its username and password.
|
||||
|
||||
@ -60,17 +89,12 @@ Add the following configuration to your `inventory/host_vars/matrix.example.com/
|
||||
# Enable Pantalaimon. See docs/configuring-playbook-pantalaimon.md
|
||||
matrix_pantalaimon_enabled: true
|
||||
|
||||
# Enable Draupnir
|
||||
matrix_bot_draupnir_enabled: true
|
||||
|
||||
# Tell Draupnir to use Pantalaimon
|
||||
matrix_bot_draupnir_pantalaimon_use: true
|
||||
|
||||
# User name and password for the bot. Required when using Pantalaimon.
|
||||
matrix_bot_draupnir_pantalaimon_username: "DRAUPNIR_USERNAME_FROM_STEP_1"
|
||||
matrix_bot_draupnir_pantalaimon_password: ### you should create a secure password for the bot account
|
||||
|
||||
matrix_bot_draupnir_management_room: "ROOM_ID_FROM_STEP_4_GOES_HERE"
|
||||
# User name and password for the bot you have created above. Required when using Pantalaimon.
|
||||
matrix_bot_draupnir_pantalaimon_username: "bot.draupnir"
|
||||
matrix_bot_draupnir_pantalaimon_password: "PASSWORD_FOR_THE_BOT"
|
||||
```
|
||||
|
||||
The playbook's `group_vars` will configure other required settings. If using this role separately without the playbook, you also need to configure the two URLs that Draupnir uses to reach the homeserver, one through Pantalaimon and one "raw". This example is taken from the playbook's `group_vars`:
|
||||
@ -85,23 +109,47 @@ matrix_bot_draupnir_homeserver_url: "{{ 'http://matrix-pantalaimon:8009' if matr
|
||||
matrix_bot_draupnir_raw_homeserver_url: "{{ matrix_addons_homeserver_client_api_url }}"
|
||||
```
|
||||
|
||||
### b. Configuration without E2EE support
|
||||
#### Configuration without E2EE support
|
||||
|
||||
When NOT using Pantalaimon, Draupnir does not log in by itself and you must give it an access token for its bot account.
|
||||
|
||||
Add the following configuration to your `inventory/host_vars/matrix.example.com/vars.yml` file (adapt to your needs):
|
||||
|
||||
You must replace `ACCESS_TOKEN_FROM_STEP_2_GOES_HERE` and `ROOM_ID_FROM_STEP_4_GOES_HERE` with your own values.
|
||||
Add the following configuration to your `inventory/host_vars/matrix.example.com/vars.yml` file. Make sure to replace `ACCESS_TOKEN_HERE` with the one created [above](#get-an-access-token).
|
||||
|
||||
```yaml
|
||||
matrix_bot_draupnir_enabled: true
|
||||
|
||||
matrix_bot_draupnir_access_token: "ACCESS_TOKEN_FROM_STEP_2_GOES_HERE"
|
||||
|
||||
matrix_bot_draupnir_management_room: "ROOM_ID_FROM_STEP_4_GOES_HERE"
|
||||
matrix_bot_draupnir_access_token: "ACCESS_TOKEN_HERE"
|
||||
```
|
||||
|
||||
### c. Migrating from Mjolnir (Only required if migrating.)
|
||||
### Abuse Reports
|
||||
|
||||
Draupnir supports two methods to receive reports in the management room.
|
||||
|
||||
The first method intercepts the report API endpoint of the client-server API, which requires integration with the reverse proxy in front of the homeserver. If you are using traefik, this playbook can set this up for you:
|
||||
|
||||
```yaml
|
||||
matrix_bot_draupnir_abuse_reporting_enabled: true
|
||||
```
|
||||
|
||||
The other method polls an Synapse Admin API endpoint, hence it is available only if using Synapse and if the Draupnir user is an admin (see [above](#register-the-bot-account)). To enable it, set `pollReports: true` on `vars.yml` file as below.
|
||||
|
||||
### Extending the configuration
|
||||
|
||||
You can configure additional options by adding the `matrix_bot_draupnir_configuration_extension_yaml` variable.
|
||||
|
||||
For example, to change Draupnir's `pollReports` option to `true`, add the following configuration to your `inventory/host_vars/matrix.example.com/vars.yml` file:
|
||||
|
||||
```yaml
|
||||
matrix_bot_draupnir_configuration_extension_yaml: |
|
||||
# Your custom YAML configuration goes here.
|
||||
# This configuration extends the default starting configuration (`matrix_bot_draupnir_configuration_yaml`).
|
||||
#
|
||||
# You can override individual variables from the default configuration, or introduce new ones.
|
||||
#
|
||||
# If you need something more special, you can take full control by
|
||||
# completely redefining `matrix_bot_draupnir_configuration_yaml`.
|
||||
pollReports: true
|
||||
```
|
||||
|
||||
### Migrating from Mjolnir (Only required if migrating)
|
||||
|
||||
Replace your `matrix_bot_mjolnir` config with `matrix_bot_draupnir` config. Also disable Mjolnir if you're doing migration.
|
||||
|
||||
@ -193,38 +241,3 @@ To **set a specific option for a given protection**, send a command like this: `
|
||||
To **enable a given protection**, send a command like this: `!draupnir enable PROTECTION_NAME` (e.g. `!draupnir enable JoinWaveShortCircuit`).
|
||||
|
||||
To **disable a given protection**, send a command like this: `!draupnir disable PROTECTION_NAME` (e.g. `!draupnir disable JoinWaveShortCircuit`).
|
||||
|
||||
## Extending the configuration
|
||||
|
||||
You can configure additional options by adding the `matrix_bot_draupnir_configuration_extension_yaml` variable to your `inventory/host_vars/matrix.example.com/vars.yml` file.
|
||||
|
||||
For example to change Draupnir's `recordIgnoredInvites` option to `true` you would add the following to your `vars.yml` file.
|
||||
|
||||
```yaml
|
||||
matrix_bot_draupnir_configuration_extension_yaml: |
|
||||
# Your custom YAML configuration goes here.
|
||||
# This configuration extends the default starting configuration (`matrix_bot_draupnir_configuration_yaml`).
|
||||
#
|
||||
# You can override individual variables from the default configuration, or introduce new ones.
|
||||
#
|
||||
# If you need something more special, you can take full control by
|
||||
# completely redefining `matrix_bot_draupnir_configuration_yaml`.
|
||||
recordIgnoredInvites: true
|
||||
```
|
||||
|
||||
## Abuse Reports
|
||||
|
||||
Draupnir supports two methods to receive reports in the management room.
|
||||
|
||||
The first method intercepts the report API endpoint of the client-server API, which requires integration with the reverse proxy in front of the homeserver. If you are using traefik, this playbook can set this up for you:
|
||||
|
||||
```yaml
|
||||
matrix_bot_draupnir_abuse_reporting_enabled: true
|
||||
```
|
||||
|
||||
The other method polls an synapse admin API endpoint and is hence only available when using synapse and when the Draupnir user is an admin user (see step 1). To enable it, set `pollReports: true` in Draupnir's config:
|
||||
|
||||
```yaml
|
||||
matrix_bot_draupnir_configuration_extension_yaml: |
|
||||
pollReports: true
|
||||
```
|
||||
|
||||
@ -4,11 +4,11 @@ The playbook can install and configure the [Mjolnir](https://github.com/matrix-o
|
||||
|
||||
See the project's [documentation](https://github.com/matrix-org/mjolnir/blob/main/README.md) to learn what it does and why it might be useful to you.
|
||||
|
||||
## Register the bot account
|
||||
## Prerequisites
|
||||
|
||||
The playbook does not automatically create users for you. The bot requires an access token to be able to connect to your homeserver.
|
||||
### Register the bot account
|
||||
|
||||
You **need to register the bot user manually** before setting up the bot.
|
||||
The playbook does not automatically create users for you. You **need to register the bot user manually** before setting up the bot.
|
||||
|
||||
Choose a strong password for the bot. You can generate a good password with a command like this: `pwgen -s 64 1`.
|
||||
|
||||
@ -20,23 +20,39 @@ ansible-playbook -i inventory/hosts setup.yml --extra-vars='username=bot.mjolnir
|
||||
|
||||
If you would like Mjolnir to be able to deactivate users, move aliases, shutdown rooms, etc then it must be a server admin so you need to change `admin=no` to `admin=yes` in the command above.
|
||||
|
||||
## Get an access token
|
||||
### Get an access token
|
||||
|
||||
Refer to the documentation on [how to obtain an access token](obtaining-access-tokens.md).
|
||||
The bot requires an access token to be able to connect to your homeserver. Refer to the documentation on [how to obtain an access token](obtaining-access-tokens.md).
|
||||
|
||||
## Make sure the account is free from rate limiting
|
||||
### Make sure the account is free from rate limiting
|
||||
|
||||
You will need to prevent Synapse from rate limiting the bot's account. This is not an optional step. If you do not do this step Mjolnir will crash. This can be done using Synapse's [admin API](https://matrix-org.github.io/synapse/latest/admin_api/user_admin_api.html#override-ratelimiting-for-users). Please ask for help if you are uncomfortable with these steps or run into issues.
|
||||
If your homeserver's implementation is Synapse, you will need to prevent it from rate limiting the bot's account. **This is a required step. If you do not configure it, Mjolnir will crash.**
|
||||
|
||||
If your Synapse Admin API is exposed to the internet for some reason like running the Synapse Admin Role [Link](configuring-playbook-synapse-admin.md) or running `matrix_synapse_container_labels_public_client_synapse_admin_api_enabled: true` in your playbook config. If your API is not externally exposed you should still be able to on the local host for your synapse run these commands.
|
||||
This can be done using Synapse's [Admin APIs](https://element-hq.github.io/synapse/latest/admin_api/user_admin_api.html#override-ratelimiting-for-users). They can be accessed both externally and internally.
|
||||
|
||||
The following command works on semi up to date Windows 10 installs and All Windows 11 installations and other systems that ship curl. `curl --header "Authorization: Bearer <access_token>" -X POST https://matrix.example.com/_synapse/admin/v1/users/@bot.mjolnir:example.com/override_ratelimit` Replace `@bot.mjolnir:example.com` with the MXID of your Mjolnir and example.com with your homeserver domain. You can easily obtain an access token for a homeserver admin account the same way you can obtain an access token for Mjolnir itself. If you made Mjolnir Admin you can just use the Mjolnir token.
|
||||
To expose the APIs publicly, add the following configuration to your `inventory/host_vars/matrix.example.com/vars.yml` file.
|
||||
|
||||
## Create a management room
|
||||
```yaml
|
||||
matrix_synapse_container_labels_public_client_synapse_admin_api_enabled: true
|
||||
```
|
||||
|
||||
The APIs can also be accessed via [Synapse Admin](https://github.com/etkecc/synapse-admin), a web UI tool you can use to administrate users, rooms, media, etc. on your Matrix server. The playbook can install and configure Synapse Admin for you. For details about it, see [this page](configuring-playbook-synapse-admin.md).
|
||||
|
||||
**Note**: access to the APIs is restricted with a valid access token, so exposing them publicly should not be a real security concern. Still, doing so is not recommended for additional security. See [official Synapse reverse-proxying recommendations](https://element-hq.github.io/synapse/latest/reverse_proxy.html#synapse-administration-endpoints).
|
||||
|
||||
To discharge rate limiting, run the following command on systems that ship curl (note that it does not work on outdated Windows 10). Even if the APIs are not exposed to the internet, you should still be able to run the command on the homeserver locally. Before running it, make sure to replace `@bot.mjolnir:example.com` with the MXID of your Mjolnir:
|
||||
|
||||
```sh
|
||||
curl --header "Authorization: Bearer <access_token>" -X POST https://matrix.example.com/_synapse/admin/v1/users/@bot.mjolnir:example.com/override_ratelimit
|
||||
```
|
||||
|
||||
You can obtain an access token for a homeserver admin account in the same way as you can do so for Mjolnir itself. If you have made Mjolnir an admin, you can just use the Mjolnir token.
|
||||
|
||||
### Create a management room
|
||||
|
||||
Using your own account, create a new invite only room that you will use to manage the bot. This is the room where you will see the status of the bot and where you will send commands to the bot, such as the command to ban a user from another room. Anyone in this room can control the bot so it is important that you only invite trusted users to this room.
|
||||
|
||||
If you make the management room encrypted (E2EE), then you MUST enable and use Pantalaimon (see below).
|
||||
If you make the management room encrypted (E2EE), then you MUST enable and use Pantalaimon (see [below](#configuration-with-e2ee-support)).
|
||||
|
||||
Once you have created the room you need to copy the room ID so you can tell the bot to use that room. In Element Web you can do this by going to the room's settings, clicking Advanced, and then copying the internal room ID. The room ID will look something like `!qporfwt:example.com`.
|
||||
|
||||
@ -44,9 +60,22 @@ Finally invite the `@bot.mjolnir:example.com` account you created earlier into t
|
||||
|
||||
## Adjusting the playbook configuration
|
||||
|
||||
Decide whether you want Mjolnir to be capable of operating in end-to-end encrypted (E2EE) rooms. This includes the management room and the moderated rooms. To support E2EE, Mjolnir needs to [use Pantalaimon](configuring-playbook-pantalaimon.md).
|
||||
Add the following configuration to your `inventory/host_vars/matrix.example.com/vars.yml` file. Make sure to replace `MANAGEMENT_ROOM_ID_HERE`.
|
||||
|
||||
### a. Configuration with E2EE support
|
||||
```yaml
|
||||
# Enable Mjolnir
|
||||
matrix_bot_mjolnir_enabled: true
|
||||
|
||||
matrix_bot_mjolnir_management_room: "MANAGEMENT_ROOM_ID_HERE"
|
||||
```
|
||||
|
||||
### End-to-End Encryption support
|
||||
|
||||
Decide whether you want Mjolnir to be capable of operating in end-to-end encrypted (E2EE) rooms. This includes the management room and the moderated rooms.
|
||||
|
||||
To support E2EE, Mjolnir needs to [use Pantalaimon](configuring-playbook-pantalaimon.md).
|
||||
|
||||
#### Configuration with E2EE support
|
||||
|
||||
When using Pantalaimon, Mjolnir will log in to its bot account itself through Pantalaimon, so configure its username and password.
|
||||
|
||||
@ -56,17 +85,12 @@ Add the following configuration to your `inventory/host_vars/matrix.example.com/
|
||||
# Enable Pantalaimon. See docs/configuring-playbook-pantalaimon.md
|
||||
matrix_pantalaimon_enabled: true
|
||||
|
||||
# Enable Mjolnir
|
||||
matrix_bot_mjolnir_enabled: true
|
||||
|
||||
# Tell Mjolnir to use Pantalaimon
|
||||
matrix_bot_mjolnir_pantalaimon_use: true
|
||||
|
||||
# User name and password for the bot. Required when using Pantalaimon.
|
||||
matrix_bot_mjolnir_pantalaimon_username: "MJOLNIR_USERNAME_FROM_STEP_1"
|
||||
matrix_bot_mjolnir_pantalaimon_password: ### you should create a secure password for the bot account
|
||||
|
||||
matrix_bot_mjolnir_management_room: "ROOM_ID_FROM_STEP_4_GOES_HERE"
|
||||
# User name and password for the bot you have created above. Required when using Pantalaimon.
|
||||
matrix_bot_mjolnir_pantalaimon_username: "bot.mjolnir"
|
||||
matrix_bot_mjolnir_pantalaimon_password: "PASSWORD_FOR_THE_BOT"
|
||||
```
|
||||
|
||||
The playbook's `group_vars` will configure other required settings. If using this role separately without the playbook, you also need to configure the two URLs that Mjolnir uses to reach the homeserver, one through Pantalaimon and one "raw". This example is taken from the playbook's `group_vars`:
|
||||
@ -81,25 +105,19 @@ matrix_bot_mjolnir_homeserver_url: "{{ 'http://matrix-pantalaimon:8009' if matri
|
||||
matrix_bot_mjolnir_raw_homeserver_url: "{{ matrix_addons_homeserver_client_api_url }}"
|
||||
```
|
||||
|
||||
### b. Configuration without E2EE support
|
||||
#### Configuration without E2EE support
|
||||
|
||||
When NOT using Pantalaimon, Mjolnir does not log in by itself and you must give it an access token for its bot account.
|
||||
|
||||
Add the following configuration to your `inventory/host_vars/matrix.example.com/vars.yml` file (adapt to your needs):
|
||||
|
||||
You must replace `ACCESS_TOKEN_FROM_STEP_2_GOES_HERE` and `ROOM_ID_FROM_STEP_4_GOES_HERE` with your own values.
|
||||
Add the following configuration to your `inventory/host_vars/matrix.example.com/vars.yml` file. Make sure to replace `ACCESS_TOKEN_HERE` with the one created [above](#get-an-access-token).
|
||||
|
||||
```yaml
|
||||
matrix_bot_mjolnir_enabled: true
|
||||
|
||||
matrix_bot_mjolnir_access_token: "ACCESS_TOKEN_FROM_STEP_2_GOES_HERE"
|
||||
|
||||
matrix_bot_mjolnir_management_room: "ROOM_ID_FROM_STEP_4_GOES_HERE"
|
||||
matrix_bot_mjolnir_access_token: "ACCESS_TOKEN_HERE"
|
||||
```
|
||||
|
||||
## Adding Mjolnir synapse antispam module (optional)
|
||||
### Adding Mjolnir synapse antispam module (optional)
|
||||
|
||||
Add the following configuration to your `inventory/host_vars/matrix.example.com/vars.yml` file (adapt to your needs):
|
||||
To enable Mjolnir synapse antispam module, add the following configuration to your `inventory/host_vars/matrix.example.com/vars.yml` file (adapt to your needs):
|
||||
|
||||
```yaml
|
||||
matrix_synapse_ext_spam_checker_mjolnir_antispam_enabled: true
|
||||
@ -109,6 +127,24 @@ matrix_synapse_ext_spam_checker_mjolnir_antispam_config_block_usernames: false
|
||||
matrix_synapse_ext_spam_checker_mjolnir_antispam_config_ban_lists: []
|
||||
```
|
||||
|
||||
### Extending the configuration
|
||||
|
||||
You can configure additional options by adding the `matrix_bot_mjolnir_configuration_extension_yaml` variable to your `inventory/host_vars/matrix.example.com/vars.yml` file.
|
||||
|
||||
For example, to change Mjolnir's `recordIgnoredInvites` option to `true`, add the following configuration to your `inventory/host_vars/matrix.example.com/vars.yml` file:
|
||||
|
||||
```yaml
|
||||
matrix_bot_mjolnir_configuration_extension_yaml: |
|
||||
# Your custom YAML configuration goes here.
|
||||
# This configuration extends the default starting configuration (`matrix_bot_mjolnir_configuration_yaml`).
|
||||
#
|
||||
# You can override individual variables from the default configuration, or introduce new ones.
|
||||
#
|
||||
# If you need something more special, you can take full control by
|
||||
# completely redefining `matrix_bot_mjolnir_configuration_yaml`.
|
||||
recordIgnoredInvites: true
|
||||
```
|
||||
|
||||
## Installing
|
||||
|
||||
After configuring the playbook, run it with [playbook tags](playbook-tags.md) as below:
|
||||
@ -131,19 +167,3 @@ ansible-playbook -i inventory/hosts setup.yml --tags=setup-all,ensure-matrix-use
|
||||
## Usage
|
||||
|
||||
You can refer to the upstream [documentation](https://github.com/matrix-org/mjolnir) for additional ways to use and configure Mjolnir. Check out their [quickstart guide](https://github.com/matrix-org/mjolnir#quickstart-guide) for some basic commands you can give to the bot.
|
||||
|
||||
You can configure additional options by adding the `matrix_bot_mjolnir_configuration_extension_yaml` variable to your `inventory/host_vars/matrix.example.com/vars.yml` file.
|
||||
|
||||
For example to change Mjolnir's `recordIgnoredInvites` option to `true` you would add the following to your `vars.yml` file.
|
||||
|
||||
```yaml
|
||||
matrix_bot_mjolnir_configuration_extension_yaml: |
|
||||
# Your custom YAML configuration goes here.
|
||||
# This configuration extends the default starting configuration (`matrix_bot_mjolnir_configuration_yaml`).
|
||||
#
|
||||
# You can override individual variables from the default configuration, or introduce new ones.
|
||||
#
|
||||
# If you need something more special, you can take full control by
|
||||
# completely redefining `matrix_bot_mjolnir_configuration_yaml`.
|
||||
recordIgnoredInvites: true
|
||||
```
|
||||
|
||||
@ -2,31 +2,58 @@
|
||||
|
||||
The playbook can install and configure [matrix-hookshot](https://github.com/matrix-org/matrix-hookshot) for you.
|
||||
|
||||
Hookshot can bridge [Webhooks](https://en.wikipedia.org/wiki/Webhook) from software project management services such as GitHub, GitLab, JIRA, and Figma, as well as generic webhooks.
|
||||
Hookshot can bridge [Webhooks](https://en.wikipedia.org/wiki/Webhook) from software project management services such as GitHub, GitLab, Jira, and Figma, as well as generic webhooks.
|
||||
|
||||
See the project's [documentation](https://matrix-org.github.io/matrix-hookshot/latest/hookshot.html) to learn what it does and why it might be useful to you.
|
||||
|
||||
**Note**: the playbook also supports [matrix-appservice-webhooks](configuring-playbook-bridge-appservice-webhooks.md), which however was deprecated by its author.
|
||||
|
||||
## Setup Instructions
|
||||
## Prerequisites
|
||||
|
||||
Refer to the [official instructions](https://matrix-org.github.io/matrix-hookshot/latest/setup.html) to learn what the individual options do.
|
||||
### Download GitHub app private key (optional)
|
||||
|
||||
1. Enable the bridge by adding `matrix_hookshot_enabled: true` to your `vars.yml` file
|
||||
2. For each of the services (GitHub, GitLab, Jira, Figma, generic webhooks) fill in the respective variables `matrix_hookshot_service_*` listed in [main.yml](/roles/custom/matrix-bridge-hookshot/defaults/main.yml) as required.
|
||||
3. Take special note of the `matrix_hookshot_*_enabled` variables. Services that need no further configuration are enabled by default (GitLab, Generic), while you must first add the required configuration and enable the others (GitHub, Jira, Figma).
|
||||
4. If you're setting up the GitHub bridge, you'll need to generate and download a private key file after you created your GitHub app. Copy the contents of that file to the variable `matrix_hookshot_github_private_key` so the playbook can install it for you, or use one of the [other methods](#manage-github-private-key-with-aux-role) explained below.
|
||||
5. If you've already installed Matrix services using the playbook before, you'll need to re-run it (`--tags=setup-all,start`). If not, proceed with [configuring other playbook services](configuring-playbook.md) and then with [Installing](installing.md). Get back to this guide once ready. Hookshot can be set up individually using the tag `setup-hookshot`.
|
||||
If you're setting up the GitHub bridge, you need to create your GitHub app, and generate a private key file of it.
|
||||
|
||||
Other configuration options are available via the `matrix_hookshot_configuration_extension_yaml` and `matrix_hookshot_registration_extension_yaml` variables, see the comments in [main.yml](/roles/custom/matrix-bridge-hookshot/defaults/main.yml) for how to use them.
|
||||
You need to download the private key file, if you will install the file manually or with the `aux` role. For details, see [the section below](#manage-github-private-key-with-aux-role).
|
||||
|
||||
Finally, run the playbook (see [installing](installing.md)).
|
||||
## Adjusting the playbook configuration
|
||||
|
||||
### End-to-bridge encryption
|
||||
Add the following configuration to your `inventory/host_vars/matrix.example.com/vars.yml` file. Make sure to replace `GITHUB_PRIVATE_KEY_HERE` with the one created [above](#download-github-app-private-key).
|
||||
|
||||
You can enable [encryption](https://matrix-org.github.io/matrix-hookshot/latest/advanced/encryption.html) for Hookshot by adding `matrix_hookshot_encryption_enabled: true` to your configuration (`vars.yml`) and [executing the playbook](installing.md) again.
|
||||
```yaml
|
||||
matrix_hookshot_enabled: true
|
||||
|
||||
Should the crypto store be corrupted, you can reset it by executing this Ansible playbook with the tag `reset-hookshot-encryption` added, for example `ansible-playbook -i inventory/hosts setup.yml --tags=reset-hookshot-encryption`.
|
||||
# Uncomment to enable end-to-bridge encryption.
|
||||
# See: https://matrix-org.github.io/matrix-hookshot/latest/advanced/encryption.html
|
||||
# matrix_hookshot_experimental_encryption_enabled: true
|
||||
|
||||
# Uncomment and paste the contents of GitHub app private key to enable GitHub bridge.
|
||||
# Alternatively, you can use one of the other methods explained below on the "Manage GitHub Private Key with aux role" section.
|
||||
# matrix_hookshot_github_private_key: "GITHUB_PRIVATE_KEY_HERE"
|
||||
```
|
||||
|
||||
For each of the services (GitHub, GitLab, Jira, Figma, and generic webhooks) fill in the respective variables `matrix_hookshot_service_*` listed in [main.yml](../roles/custom/matrix-bridge-hookshot/defaults/main.yml) as required.
|
||||
|
||||
Take special note of the `matrix_hookshot_*_enabled` variables. Services that need no further configuration are enabled by default (GitLab and generic webhooks), while you must first add the required configuration and enable the others (GitHub, Jira, and Figma).
|
||||
|
||||
### Extending the configuration
|
||||
|
||||
You can configure additional options by adding the `matrix_hookshot_configuration_extension_yaml` and `matrix_hookshot_registration_extension_yaml` variables.
|
||||
|
||||
Refer the [official instructions](https://matrix-org.github.io/matrix-hookshot/latest/setup.html) and the comments in [main.yml](../roles/custom/matrix-bridge-hookshot/defaults/main.yml) to learn what the individual options do.
|
||||
|
||||
## Installing
|
||||
|
||||
After configuring the playbook, run it with [playbook tags](playbook-tags.md) as below:
|
||||
|
||||
<!-- NOTE: let this conservative command run (instead of install-all) to make it clear that failure of the command means something is clearly broken. -->
|
||||
```sh
|
||||
ansible-playbook -i inventory/hosts setup.yml --tags=setup-all,start
|
||||
```
|
||||
|
||||
The shortcut commands with the [`just` program](just.md) are also available: `just install-service hookshot` or `just setup-all`
|
||||
|
||||
`just install-service hookshot` is useful for maintaining your setup quickly when its components remain unchanged. If you adjust your `vars.yml` to remove other components, you'd need to run `just setup-all`, or these components will still remain installed. Note `just setup-all` runs the `ensure-matrix-users-created` tag too.
|
||||
|
||||
## Usage
|
||||
|
||||
@ -34,11 +61,19 @@ To use the bridge, you need to create a room and invite the Hookshot bot (`@hook
|
||||
|
||||
Make sure the bot is able to send state events (usually the Moderator power level in clients).
|
||||
|
||||
Send a `!hookshot help` message to see a list of help commands.
|
||||
Send `!hookshot help` to the room to see the bridge's help menu for additional commands.
|
||||
|
||||
Refer to [Hookshot's documentation](https://matrix-org.github.io/matrix-hookshot/latest/usage.html) for more details about using the bridge's various features.
|
||||
|
||||
**Important**: Note that the different listeners are bound to certain paths which might differ from those assumed by the hookshot documentation, see [URLs for bridges setup](#urls-for-bridges-setup) below.
|
||||
💡 **Note**: the different listeners are bound to certain paths which might differ from those assumed by the hookshot documentation. See [URLs for bridges setup](#urls-for-bridges-setup) below.
|
||||
|
||||
### Reset crypto store
|
||||
|
||||
Should the crypto store be corrupted, you can reset it by executing this Ansible playbook with the tag `reset-hookshot-encryption` added:
|
||||
|
||||
```sh
|
||||
ansible-playbook -i inventory/hosts setup.yml --tags=reset-hookshot-encryption
|
||||
```
|
||||
|
||||
## More setup documentation
|
||||
|
||||
@ -46,30 +81,31 @@ Refer to [Hookshot's documentation](https://matrix-org.github.io/matrix-hookshot
|
||||
|
||||
Unless indicated otherwise, the following endpoints are reachable on your `matrix.` subdomain (if the feature is enabled).
|
||||
|
||||
| listener | default path | variable | used as |
|
||||
| Listener | Default path | Variable | Used as |
|
||||
|---|---|---|---|
|
||||
| - | `/hookshot/webhooks/` | `matrix_hookshot_webhook_endpoint` | Webhook-prefix, which affects all webhook-related URLs below |
|
||||
| generic | `/hookshot/webhooks/webhook` | `matrix_hookshot_generic_endpoint` | Generic webhooks |
|
||||
| github oauth | `/hookshot/webhooks/oauth` | `matrix_hookshot_github_oauth_endpoint` | GitHub "Callback URL" |
|
||||
| jira oauth | `/hookshot/webhooks/jira/oauth` | `matrix_hookshot_jira_oauth_endpoint` | JIRA OAuth |
|
||||
| jira oauth | `/hookshot/webhooks/jira/oauth` | `matrix_hookshot_jira_oauth_endpoint` | Jira OAuth |
|
||||
| figma endpoint | `/hookshot/webhooks/figma/webhook` | `matrix_hookshot_figma_endpoint` | Figma |
|
||||
| provisioning | `/hookshot/v1/` | `matrix_hookshot_provisioning_endpoint` | Dimension [provisioning](#provisioning-api) |
|
||||
| appservice | `/hookshot/_matrix/app/` | `matrix_hookshot_appservice_endpoint` | Matrix server |
|
||||
| widgets | `/hookshot/widgetapi/` | `matrix_hookshot_widgets_endpoint` | Widgets |
|
||||
| metrics | `/metrics/hookshot` | `matrix_hookshot_metrics_enabled` and exposure enabled via `matrix_hookshot_metrics_proxying_enabled` or `matrix_metrics_exposure_enabled`. Read more in the [Metrics section](#metrics) below. | Prometheus |
|
||||
|
||||
Also see the various `matrix_hookshot_container_labels_*` variables in [main.yml](/roles/custom/matrix-bridge-hookshot/defaults/main.yml), which expose URLs publicly.
|
||||
Also see the various `matrix_hookshot_container_labels_*` variables in [main.yml](../roles/custom/matrix-bridge-hookshot/defaults/main.yml), which expose URLs publicly
|
||||
|
||||
The different listeners are also reachable *internally* in the docker-network via the container's name (configured by `matrix_hookshot_container_url`) and on different ports (e.g. `matrix_hookshot_appservice_port`). Read [main.yml](/roles/custom/matrix-bridge-hookshot/defaults/main.yml) in detail for more info.
|
||||
The different listeners are also reachable *internally* in the docker-network via the container's name (configured by `matrix_hookshot_container_url`) and on different ports (e.g. `matrix_hookshot_appservice_port`). Read [main.yml](../roles/custom/matrix-bridge-hookshot/defaults/main.yml) in detail for more info.
|
||||
|
||||
### Manage GitHub Private Key with aux role
|
||||
|
||||
The GitHub bridge requires you to install a private key file. This can be done in multiple ways:
|
||||
- copy the *contents* of the downloaded file and set the variable `matrix_hookshot_github_private_key` to the contents (see example in [main.yml](/roles/custom/matrix-bridge-hookshot/defaults/main.yml)).
|
||||
|
||||
- copy the *contents* of the downloaded file and set the variable `matrix_hookshot_github_private_key` to the contents (see example in [main.yml](../roles/custom/matrix-bridge-hookshot/defaults/main.yml)).
|
||||
- somehow copy the file to the path `{{ matrix_hookshot_base_path }}/{{ matrix_hookshot_github_private_key_file }}` (default: `/matrix/hookshot/private-key.pem`) on the server manually.
|
||||
- use the [`aux` role](https://github.com/mother-of-all-self-hosting/ansible-role-aux) to copy the file from an arbitrary path on your ansible client to the correct path on the server.
|
||||
|
||||
To use the `aux` role, make sure the `matrix_hookshot_github_private_key` variable is empty. Then add the following additional configuration:
|
||||
To use the `aux` role, make sure the `matrix_hookshot_github_private_key` variable is empty. Then add the following configuration to your `inventory/host_vars/matrix.example.com/vars.yml` file:
|
||||
|
||||
```yaml
|
||||
aux_file_definitions:
|
||||
|
||||
@ -84,16 +84,17 @@ Refer to the official documentation [here](https://github.com/devture/email2matr
|
||||
|
||||
## Installing
|
||||
|
||||
To enable Email2Matrix, run the playbook with [playbook tags](playbook-tags.md) as below:
|
||||
After configuring the playbook, run it with [playbook tags](playbook-tags.md) as below:
|
||||
|
||||
<!-- NOTE: let this conservative command run (instead of install-all) to make it clear that failure of the command means something is clearly broken. -->
|
||||
```sh
|
||||
ansible-playbook -i inventory/hosts setup.yml --tags=setup-email2matrix,start
|
||||
ansible-playbook -i inventory/hosts setup.yml --tags=setup-all,start
|
||||
```
|
||||
|
||||
**Notes**:
|
||||
|
||||
- The shortcut commands with the [`just` program](just.md) are also available: `just run-tags setup-email2matrix,start` or `just setup-all`
|
||||
- The shortcut commands with the [`just` program](just.md) are also available: `just install-service email2matrix` or `just setup-all`
|
||||
|
||||
`just run-tags setup-email2matrix,start` is useful for maintaining your setup quickly when its components remain unchanged. If you adjust your `vars.yml` to remove other components, you'd need to run `just setup-all`, or these components will still remain installed. Note `just setup-all` runs the `ensure-matrix-users-created` tag too.
|
||||
`just install-service email2matrix` is useful for maintaining your setup quickly when its components remain unchanged. If you adjust your `vars.yml` to remove other components, you'd need to run `just setup-all`, or these components will still remain installed. Note `just setup-all` runs the `ensure-matrix-users-created` tag too.
|
||||
|
||||
- After installation, you may wish to send a test email to the email address assigned to `mailbox1` (default: `mailbox1@matrix.example.com`) to make sure that Email2Matrix works as expected.
|
||||
|
||||
@ -87,15 +87,16 @@ This will instruct UVS to verify the OpenID token against any domain given in a
|
||||
|
||||
## Installing
|
||||
|
||||
After these variables have been set, run the playbook with [playbook tags](playbook-tags.md) as below to restart UVS:
|
||||
After configuring the playbook, run it with [playbook tags](playbook-tags.md) as below:
|
||||
|
||||
<!-- NOTE: let this conservative command run (instead of install-all) to make it clear that failure of the command means something is clearly broken. -->
|
||||
```sh
|
||||
ansible-playbook -i inventory/hosts setup.yml --tags=setup-matrix-user-verification-service,start
|
||||
ansible-playbook -i inventory/hosts setup.yml --tags=setup-all,start
|
||||
```
|
||||
|
||||
The shortcut commands with the [`just` program](just.md) are also available: `just run-tags setup-matrix-user-verification-service,start` or `just setup-all`
|
||||
The shortcut commands with the [`just` program](just.md) are also available: `just install-service matrix-user-verification-service` or `just setup-all`
|
||||
|
||||
`just run-tags setup-matrix-user-verification-service,start` is useful for maintaining your setup quickly when its components remain unchanged. If you adjust your `vars.yml` to remove other components, you'd need to run `just setup-all`, or these components will still remain installed. Note `just setup-all` runs the `ensure-matrix-users-created` tag too.
|
||||
`just install-service matrix-user-verification-service` is useful for maintaining your setup quickly when its components remain unchanged. If you adjust your `vars.yml` to remove other components, you'd need to run `just setup-all`, or these components will still remain installed. Note `just setup-all` runs the `ensure-matrix-users-created` tag too.
|
||||
|
||||
## Logging
|
||||
|
||||
|
||||
@ -1600,7 +1600,10 @@ matrix_mautrix_meta_messenger_container_labels_traefik_tls_certResolver: "{{ tra
|
||||
matrix_mautrix_meta_messenger_container_labels_metrics_middleware_basic_auth_enabled: "{{ matrix_metrics_exposure_http_basic_auth_enabled }}"
|
||||
matrix_mautrix_meta_messenger_container_labels_metrics_middleware_basic_auth_users: "{{ matrix_metrics_exposure_http_basic_auth_users }}"
|
||||
|
||||
matrix_mautrix_meta_messenger_container_labels_bridgev2_traefik_hostname: "{{ matrix_server_fqn_matrix }}"
|
||||
|
||||
matrix_mautrix_meta_messenger_appservice_token: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'mau.meta.fb.as', rounds=655555) | to_uuid }}"
|
||||
matrix_mautrix_meta_messenger_appservice_bridgev2_enabled: false
|
||||
|
||||
matrix_mautrix_meta_messenger_homeserver_address: "{{ matrix_addons_homeserver_client_api_url }}"
|
||||
|
||||
@ -1674,7 +1677,10 @@ matrix_mautrix_meta_instagram_container_labels_traefik_tls_certResolver: "{{ tra
|
||||
matrix_mautrix_meta_instagram_container_labels_metrics_middleware_basic_auth_enabled: "{{ matrix_metrics_exposure_http_basic_auth_enabled }}"
|
||||
matrix_mautrix_meta_instagram_container_labels_metrics_middleware_basic_auth_users: "{{ matrix_metrics_exposure_http_basic_auth_users }}"
|
||||
|
||||
matrix_mautrix_meta_instagram_container_labels_bridgev2_traefik_hostname: "{{ matrix_server_fqn_matrix }}"
|
||||
|
||||
matrix_mautrix_meta_instagram_appservice_token: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'mau.meta.ig.as', rounds=655555) | to_uuid }}"
|
||||
matrix_mautrix_meta_instagram_appservice_bridgev2_enabled: false
|
||||
|
||||
matrix_mautrix_meta_instagram_homeserver_address: "{{ matrix_addons_homeserver_client_api_url }}"
|
||||
|
||||
@ -2064,6 +2070,8 @@ matrix_mautrix_whatsapp_container_labels_traefik_tls_certResolver: "{{ traefik_c
|
||||
matrix_mautrix_whatsapp_container_labels_metrics_middleware_basic_auth_enabled: "{{ matrix_metrics_exposure_http_basic_auth_enabled }}"
|
||||
matrix_mautrix_whatsapp_container_labels_metrics_middleware_basic_auth_users: "{{ matrix_metrics_exposure_http_basic_auth_users }}"
|
||||
|
||||
matrix_mautrix_whatsapp_container_labels_bridgev2_traefik_hostname: "{{ matrix_server_fqn_matrix }}"
|
||||
|
||||
matrix_mautrix_whatsapp_systemd_required_services_list_auto: |
|
||||
{{
|
||||
matrix_addons_homeserver_systemd_services_list
|
||||
@ -2072,6 +2080,7 @@ matrix_mautrix_whatsapp_systemd_required_services_list_auto: |
|
||||
}}
|
||||
|
||||
matrix_mautrix_whatsapp_appservice_token: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'whats.as.token', rounds=655555) | to_uuid }}"
|
||||
matrix_mautrix_whatsapp_appservice_bridgev2_enabled: false
|
||||
|
||||
matrix_mautrix_whatsapp_homeserver_address: "{{ matrix_addons_homeserver_client_api_url }}"
|
||||
matrix_mautrix_whatsapp_homeserver_token: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'whats.hs.token', rounds=655555) | to_uuid }}"
|
||||
@ -5943,6 +5952,15 @@ matrix_static_files_file_matrix_client_property_cc_etke_synapse_admin_auto: "{{
|
||||
|
||||
matrix_static_files_file_matrix_server_property_m_server: "{{ matrix_server_fqn_matrix_federation }}:{{ matrix_federation_public_port }}"
|
||||
|
||||
# mautrix-manager auto-configuration disabled by default
|
||||
matrix_static_files_file_matrix_mautrix_enabled: false
|
||||
matrix_static_files_file_matrix_mautrix_property_fi_mau_bridges:
|
||||
- "https://bridges.example.com/signal"
|
||||
# TODO populate with enabled bridges
|
||||
|
||||
matrix_static_files_file_matrix_mautrix_property_fi_mau_external_bridge_servers:
|
||||
[]
|
||||
|
||||
matrix_static_files_scheme: "{{ 'https' if matrix_playbook_ssl_enabled else 'http' }}"
|
||||
|
||||
matrix_static_files_self_check_hostname_matrix: "{{ matrix_server_fqn_matrix }}"
|
||||
|
||||
@ -25,7 +25,7 @@
|
||||
version: v11.4.0-0
|
||||
name: grafana
|
||||
- src: git+https://github.com/mother-of-all-self-hosting/ansible-role-jitsi.git
|
||||
version: v9823-1
|
||||
version: v9909-0
|
||||
name: jitsi
|
||||
- src: git+https://github.com/mother-of-all-self-hosting/ansible-role-keydb.git
|
||||
version: v6.3.4-3
|
||||
|
||||
@ -6,7 +6,7 @@
|
||||
matrix_alertmanager_receiver_enabled: true
|
||||
|
||||
# renovate: datasource=docker depName=docker.io/metio/matrix-alertmanager-receiver
|
||||
matrix_alertmanager_receiver_version: 2024.12.11
|
||||
matrix_alertmanager_receiver_version: 2024.12.18
|
||||
|
||||
matrix_alertmanager_receiver_scheme: https
|
||||
|
||||
|
||||
@ -5,7 +5,7 @@
|
||||
matrix_bot_mjolnir_enabled: true
|
||||
|
||||
# renovate: datasource=docker depName=matrixdotorg/mjolnir
|
||||
matrix_bot_mjolnir_version: "v1.9.0"
|
||||
matrix_bot_mjolnir_version: "v1.9.1"
|
||||
|
||||
matrix_bot_mjolnir_container_image_self_build: false
|
||||
matrix_bot_mjolnir_container_image_self_build_repo: "https://github.com/matrix-org/mjolnir.git"
|
||||
|
||||
@ -55,6 +55,17 @@ matrix_mautrix_meta_instagram_container_labels_metrics_middleware_basic_auth_ena
|
||||
# See: https://doc.traefik.io/traefik/middlewares/http/basicauth/#users
|
||||
matrix_mautrix_meta_instagram_container_labels_metrics_middleware_basic_auth_users: ''
|
||||
|
||||
# Controls whether labels will be added that expose the bridge's bridgev2 API endpoints
|
||||
matrix_mautrix_meta_instagram_container_labels_bridgev2_enabled: "{{ matrix_mautrix_meta_instagram_appservice_bridgev2_enabled }}"
|
||||
matrix_mautrix_meta_instagram_container_labels_bridgev2_traefik_hostname: ""
|
||||
# Following two variables should be RegEx-escaped, see https://doc.traefik.io/traefik/middlewares/http/replacepathregex/
|
||||
matrix_mautrix_meta_instagram_container_labels_bridgev2_traefik_stripprefix: "/_matrix/{{ matrix_mautrix_meta_instagram_identifier }}"
|
||||
matrix_mautrix_meta_instagram_container_labels_bridgev2_traefik_rule: "Host(`{{ matrix_mautrix_meta_instagram_container_labels_bridgev2_traefik_hostname }}`) && PathPrefix(`{{ matrix_mautrix_meta_instagram_container_labels_bridgev2_traefik_stripprefix }}`)"
|
||||
matrix_mautrix_meta_instagram_container_labels_bridgev2_traefik_priority: 0
|
||||
matrix_mautrix_meta_instagram_container_labels_bridgev2_traefik_entrypoints: "{{ matrix_mautrix_meta_instagram_container_labels_traefik_entrypoints }}"
|
||||
matrix_mautrix_meta_instagram_container_labels_bridgev2_traefik_tls: "{{ matrix_mautrix_meta_instagram_container_labels_metrics_traefik_entrypoints != 'web' }}"
|
||||
matrix_mautrix_meta_instagram_container_labels_bridgev2_traefik_tls_certResolver: "{{ matrix_mautrix_meta_instagram_container_labels_traefik_tls_certResolver }}" # noqa var-naming
|
||||
|
||||
# matrix_mautrix_meta_instagram_container_labels_additional_labels contains a multiline string with additional labels to add to the container label file.
|
||||
# See `../templates/labels.j2` for details.
|
||||
#
|
||||
@ -144,6 +155,10 @@ matrix_mautrix_meta_instagram_appservice_database_uri: |-
|
||||
|
||||
matrix_mautrix_meta_instagram_appservice_token: ''
|
||||
|
||||
# Whether to make public the bridgev2 API endpoints.
|
||||
# See https://spec.mau.fi/megabridge/
|
||||
matrix_mautrix_meta_instagram_appservice_bridgev2_enabled: false
|
||||
|
||||
# Controls which service this bridge is for.
|
||||
# Valid options:
|
||||
# * facebook - connect to FB Messenger via facebook.com
|
||||
|
||||
@ -8,6 +8,7 @@
|
||||
with_items:
|
||||
- {'name': 'matrix_mautrix_meta_instagram_metrics_proxying_hostname', when: "{{ matrix_mautrix_meta_instagram_metrics_proxying_enabled }}"}
|
||||
- {'name': 'matrix_mautrix_meta_instagram_metrics_proxying_path_prefix', when: "{{ matrix_mautrix_meta_instagram_metrics_proxying_enabled }}"}
|
||||
- {'name': 'matrix_mautrix_meta_instagram_container_labels_bridgev2_traefik_hostname', when: "{{ matrix_mautrix_meta_instagram_container_labels_bridgev2_enabled }}"}
|
||||
- {'name': 'matrix_mautrix_meta_instagram_appservice_token', when: true}
|
||||
- {'name': 'matrix_mautrix_meta_instagram_homeserver_token', when: true}
|
||||
- {'name': 'matrix_mautrix_meta_instagram_container_network', when: true}
|
||||
|
||||
@ -43,6 +43,38 @@ traefik.http.routers.{{ matrix_mautrix_meta_instagram_identifier }}-metrics.tls.
|
||||
{% endif %}
|
||||
|
||||
|
||||
{% if matrix_mautrix_meta_instagram_container_labels_bridgev2_enabled %}
|
||||
############################################################
|
||||
# #
|
||||
# Appservice Bridgev2 API #
|
||||
# #
|
||||
############################################################
|
||||
|
||||
traefik.http.middlewares.{{ matrix_mautrix_meta_instagram_identifier }}-bridgev2-stripprefix.stripprefix.prefixes={{ matrix_mautrix_meta_instagram_container_labels_bridgev2_traefik_stripprefix }}
|
||||
traefik.http.routers.{{ matrix_mautrix_meta_instagram_identifier }}-bridgev2.middlewares={{ matrix_mautrix_meta_instagram_identifier }}-bridgev2-stripprefix
|
||||
|
||||
traefik.http.routers.{{ matrix_mautrix_meta_instagram_identifier }}-bridgev2.rule={{ matrix_mautrix_meta_instagram_container_labels_bridgev2_traefik_rule }}
|
||||
|
||||
{% if matrix_mautrix_meta_instagram_container_labels_bridgev2_traefik_priority | int > 0 %}
|
||||
traefik.http.routers.{{ matrix_mautrix_meta_instagram_identifier }}-bridgev2.priority={{ matrix_mautrix_meta_instagram_container_labels_bridgev2_traefik_priority }}
|
||||
{% endif %}
|
||||
|
||||
traefik.http.routers.{{ matrix_mautrix_meta_instagram_identifier }}-bridgev2.service={{ matrix_mautrix_meta_instagram_identifier }}-appservice
|
||||
traefik.http.routers.{{ matrix_mautrix_meta_instagram_identifier }}-bridgev2.entrypoints={{ matrix_mautrix_meta_instagram_container_labels_bridgev2_traefik_entrypoints }}
|
||||
|
||||
traefik.http.routers.{{ matrix_mautrix_meta_instagram_identifier }}-bridgev2.tls={{ matrix_mautrix_meta_instagram_container_labels_bridgev2_traefik_tls | to_json }}
|
||||
{% if matrix_mautrix_meta_instagram_container_labels_bridgev2_traefik_tls %}
|
||||
traefik.http.routers.{{ matrix_mautrix_meta_instagram_identifier }}-bridgev2.tls.certResolver={{ matrix_mautrix_meta_instagram_container_labels_bridgev2_traefik_tls_certResolver }}
|
||||
{% endif %}
|
||||
|
||||
############################################################
|
||||
# #
|
||||
# /Appservice Bridgev2 API #
|
||||
# #
|
||||
############################################################
|
||||
{% endif %}
|
||||
|
||||
|
||||
{% endif %}
|
||||
|
||||
{{ matrix_mautrix_meta_instagram_container_labels_additional_labels }}
|
||||
|
||||
@ -55,6 +55,17 @@ matrix_mautrix_meta_messenger_container_labels_metrics_middleware_basic_auth_ena
|
||||
# See: https://doc.traefik.io/traefik/middlewares/http/basicauth/#users
|
||||
matrix_mautrix_meta_messenger_container_labels_metrics_middleware_basic_auth_users: ''
|
||||
|
||||
# Controls whether labels will be added that expose the bridge's bridgev2 API endpoints
|
||||
matrix_mautrix_meta_messenger_container_labels_bridgev2_enabled: "{{ matrix_mautrix_meta_messenger_appservice_bridgev2_enabled }}"
|
||||
matrix_mautrix_meta_messenger_container_labels_bridgev2_traefik_hostname: ""
|
||||
# Following two variables should be RegEx-escaped, see https://doc.traefik.io/traefik/middlewares/http/replacepathregex/
|
||||
matrix_mautrix_meta_messenger_container_labels_bridgev2_traefik_stripprefix: "/_matrix/{{ matrix_mautrix_meta_messenger_identifier }}"
|
||||
matrix_mautrix_meta_messenger_container_labels_bridgev2_traefik_rule: "Host(`{{ matrix_mautrix_meta_messenger_container_labels_bridgev2_traefik_hostname }}`) && PathPrefix(`{{ matrix_mautrix_meta_messenger_container_labels_bridgev2_traefik_stripprefix }}`)"
|
||||
matrix_mautrix_meta_messenger_container_labels_bridgev2_traefik_priority: 0
|
||||
matrix_mautrix_meta_messenger_container_labels_bridgev2_traefik_entrypoints: "{{ matrix_mautrix_meta_messenger_container_labels_traefik_entrypoints }}"
|
||||
matrix_mautrix_meta_messenger_container_labels_bridgev2_traefik_tls: "{{ matrix_mautrix_meta_messenger_container_labels_metrics_traefik_entrypoints != 'web' }}"
|
||||
matrix_mautrix_meta_messenger_container_labels_bridgev2_traefik_tls_certResolver: "{{ matrix_mautrix_meta_messenger_container_labels_traefik_tls_certResolver }}" # noqa var-naming
|
||||
|
||||
# matrix_mautrix_meta_messenger_container_labels_additional_labels contains a multiline string with additional labels to add to the container label file.
|
||||
# See `../templates/labels.j2` for details.
|
||||
#
|
||||
@ -144,6 +155,10 @@ matrix_mautrix_meta_messenger_appservice_database_uri: |-
|
||||
|
||||
matrix_mautrix_meta_messenger_appservice_token: ''
|
||||
|
||||
# Whether to make public the bridgev2 API endpoints.
|
||||
# See https://spec.mau.fi/megabridge/
|
||||
matrix_mautrix_meta_messenger_appservice_bridgev2_enabled: false
|
||||
|
||||
# Controls which service this bridge is for.
|
||||
# Valid options:
|
||||
# * facebook - connect to FB Messenger via facebook.com
|
||||
|
||||
@ -8,6 +8,7 @@
|
||||
with_items:
|
||||
- {'name': 'matrix_mautrix_meta_messenger_metrics_proxying_hostname', when: "{{ matrix_mautrix_meta_messenger_metrics_proxying_enabled }}"}
|
||||
- {'name': 'matrix_mautrix_meta_messenger_metrics_proxying_path_prefix', when: "{{ matrix_mautrix_meta_messenger_metrics_proxying_enabled }}"}
|
||||
- {'name': 'matrix_mautrix_meta_messenger_container_labels_bridgev2_traefik_hostname', when: "{{ matrix_mautrix_meta_messenger_container_labels_bridgev2_enabled }}"}
|
||||
- {'name': 'matrix_mautrix_meta_messenger_appservice_token', when: true}
|
||||
- {'name': 'matrix_mautrix_meta_messenger_homeserver_token', when: true}
|
||||
- {'name': 'matrix_mautrix_meta_messenger_container_network', when: true}
|
||||
|
||||
@ -43,6 +43,38 @@ traefik.http.routers.{{ matrix_mautrix_meta_messenger_identifier }}-metrics.tls.
|
||||
{% endif %}
|
||||
|
||||
|
||||
{% if matrix_mautrix_meta_messenger_container_labels_bridgev2_enabled %}
|
||||
############################################################
|
||||
# #
|
||||
# Appservice Bridgev2 API #
|
||||
# #
|
||||
############################################################
|
||||
|
||||
traefik.http.middlewares.{{ matrix_mautrix_meta_messenger_identifier }}-bridgev2-stripprefix.stripprefix.prefixes={{ matrix_mautrix_meta_messenger_container_labels_bridgev2_traefik_stripprefix }}
|
||||
traefik.http.routers.{{ matrix_mautrix_meta_messenger_identifier }}-bridgev2.middlewares={{ matrix_mautrix_meta_messenger_identifier }}-bridgev2-stripprefix
|
||||
|
||||
traefik.http.routers.{{ matrix_mautrix_meta_messenger_identifier }}-bridgev2.rule={{ matrix_mautrix_meta_messenger_container_labels_bridgev2_traefik_rule }}
|
||||
|
||||
{% if matrix_mautrix_meta_messenger_container_labels_bridgev2_traefik_priority | int > 0 %}
|
||||
traefik.http.routers.{{ matrix_mautrix_meta_messenger_identifier }}-bridgev2.priority={{ matrix_mautrix_meta_messenger_container_labels_bridgev2_traefik_priority }}
|
||||
{% endif %}
|
||||
|
||||
traefik.http.routers.{{ matrix_mautrix_meta_messenger_identifier }}-bridgev2.service={{ matrix_mautrix_meta_messenger_identifier }}-appservice
|
||||
traefik.http.routers.{{ matrix_mautrix_meta_messenger_identifier }}-bridgev2.entrypoints={{ matrix_mautrix_meta_messenger_container_labels_bridgev2_traefik_entrypoints }}
|
||||
|
||||
traefik.http.routers.{{ matrix_mautrix_meta_messenger_identifier }}-bridgev2.tls={{ matrix_mautrix_meta_messenger_container_labels_bridgev2_traefik_tls | to_json }}
|
||||
{% if matrix_mautrix_meta_messenger_container_labels_bridgev2_traefik_tls %}
|
||||
traefik.http.routers.{{ matrix_mautrix_meta_messenger_identifier }}-bridgev2.tls.certResolver={{ matrix_mautrix_meta_messenger_container_labels_bridgev2_traefik_tls_certResolver }}
|
||||
{% endif %}
|
||||
|
||||
############################################################
|
||||
# #
|
||||
# /Appservice Bridgev2 API #
|
||||
# #
|
||||
############################################################
|
||||
{% endif %}
|
||||
|
||||
|
||||
{% endif %}
|
||||
|
||||
{{ matrix_mautrix_meta_messenger_container_labels_additional_labels }}
|
||||
|
||||
@ -4,6 +4,8 @@
|
||||
|
||||
matrix_mautrix_whatsapp_enabled: true
|
||||
|
||||
matrix_mautrix_whatsapp_identifier: matrix-mautrix-whatsapp
|
||||
|
||||
matrix_mautrix_whatsapp_container_image_self_build: false
|
||||
matrix_mautrix_whatsapp_container_image_self_build_repo: "https://mau.dev/mautrix/whatsapp.git"
|
||||
matrix_mautrix_whatsapp_container_image_self_build_branch: "{{ 'master' if matrix_mautrix_whatsapp_version == 'latest' else matrix_mautrix_whatsapp_version }}"
|
||||
@ -23,7 +25,11 @@ matrix_mautrix_whatsapp_docker_src_files_path: "{{ matrix_mautrix_whatsapp_base_
|
||||
|
||||
matrix_mautrix_whatsapp_homeserver_address: ""
|
||||
matrix_mautrix_whatsapp_homeserver_domain: "{{ matrix_domain }}"
|
||||
matrix_mautrix_whatsapp_appservice_address: "http://matrix-mautrix-whatsapp:8080"
|
||||
matrix_mautrix_whatsapp_appservice_address: "http://{{ matrix_mautrix_whatsapp_identifier }}:8080"
|
||||
|
||||
# Whether to make public the bridgev2 API endpoints.
|
||||
# See https://spec.mau.fi/megabridge/
|
||||
matrix_mautrix_whatsapp_appservice_bridgev2_enabled: false
|
||||
|
||||
matrix_mautrix_whatsapp_extev_polls: false
|
||||
|
||||
@ -55,6 +61,17 @@ matrix_mautrix_whatsapp_container_labels_metrics_middleware_basic_auth_enabled:
|
||||
# See: https://doc.traefik.io/traefik/middlewares/http/basicauth/#users
|
||||
matrix_mautrix_whatsapp_container_labels_metrics_middleware_basic_auth_users: ''
|
||||
|
||||
# Controls whether labels will be added that expose the bridge's bridgev2 API endpoints
|
||||
matrix_mautrix_whatsapp_container_labels_bridgev2_enabled: "{{ matrix_mautrix_whatsapp_appservice_bridgev2_enabled }}"
|
||||
matrix_mautrix_whatsapp_container_labels_bridgev2_traefik_hostname: ""
|
||||
# Following two variables should be RegEx-escaped, see https://doc.traefik.io/traefik/middlewares/http/replacepathregex/
|
||||
matrix_mautrix_whatsapp_container_labels_bridgev2_traefik_stripprefix: "/_matrix/{{ matrix_mautrix_whatsapp_identifier }}"
|
||||
matrix_mautrix_whatsapp_container_labels_bridgev2_traefik_rule: "Host(`{{ matrix_mautrix_whatsapp_container_labels_bridgev2_traefik_hostname }}`) && PathPrefix(`{{ matrix_mautrix_whatsapp_container_labels_bridgev2_traefik_stripprefix }}`)"
|
||||
matrix_mautrix_whatsapp_container_labels_bridgev2_traefik_priority: 0
|
||||
matrix_mautrix_whatsapp_container_labels_bridgev2_traefik_entrypoints: "{{ matrix_mautrix_whatsapp_container_labels_traefik_entrypoints }}"
|
||||
matrix_mautrix_whatsapp_container_labels_bridgev2_traefik_tls: "{{ matrix_mautrix_whatsapp_container_labels_metrics_traefik_entrypoints != 'web' }}"
|
||||
matrix_mautrix_whatsapp_container_labels_bridgev2_traefik_tls_certResolver: "{{ matrix_mautrix_whatsapp_container_labels_traefik_tls_certResolver }}" # noqa var-naming
|
||||
|
||||
# matrix_mautrix_whatsapp_container_labels_additional_labels contains a multiline string with additional labels to add to the container label file.
|
||||
# See `../templates/labels.j2` for details.
|
||||
#
|
||||
|
||||
@ -22,7 +22,7 @@
|
||||
caller: "{{ role_path | basename }}"
|
||||
engine_variable_name: 'matrix_mautrix_whatsapp_database_engine'
|
||||
engine_old: 'sqlite'
|
||||
systemd_services_to_stop: ['matrix-mautrix-whatsapp.service']
|
||||
systemd_services_to_stop: ['{{ matrix_mautrix_whatsapp_identifier }}.service']
|
||||
pgloader_options: ['--with "quote identifiers"']
|
||||
|
||||
- ansible.builtin.set_fact:
|
||||
@ -89,7 +89,7 @@
|
||||
|
||||
- name: (Data relocation) Ensure matrix-mautrix-whatsapp.service is stopped
|
||||
ansible.builtin.service:
|
||||
name: matrix-mautrix-whatsapp
|
||||
name: "{{ matrix_mautrix_whatsapp_identifier }}"
|
||||
state: stopped
|
||||
enabled: false
|
||||
daemon_reload: true
|
||||
@ -146,12 +146,12 @@
|
||||
- name: Ensure matrix-mautrix-whatsapp.service installed
|
||||
ansible.builtin.template:
|
||||
src: "{{ role_path }}/templates/systemd/matrix-mautrix-whatsapp.service.j2"
|
||||
dest: "{{ devture_systemd_docker_base_systemd_path }}/matrix-mautrix-whatsapp.service"
|
||||
dest: "{{ devture_systemd_docker_base_systemd_path }}/{{ matrix_mautrix_whatsapp_identifier }}.service"
|
||||
mode: 0644
|
||||
|
||||
- name: Ensure matrix-mautrix-whatsapp.service restarted, if necessary
|
||||
ansible.builtin.service:
|
||||
name: "matrix-mautrix-whatsapp.service"
|
||||
name: "{{ matrix_mautrix_whatsapp_identifier }}.service"
|
||||
state: restarted
|
||||
daemon_reload: true
|
||||
when: "matrix_mautrix_whatsapp_requires_restart | bool"
|
||||
|
||||
@ -2,19 +2,19 @@
|
||||
|
||||
- name: Check existence of matrix-mautrix-whatsapp service
|
||||
ansible.builtin.stat:
|
||||
path: "{{ devture_systemd_docker_base_systemd_path }}/matrix-mautrix-whatsapp.service"
|
||||
path: "{{ devture_systemd_docker_base_systemd_path }}/{{ matrix_mautrix_whatsapp_identifier }}.service"
|
||||
register: matrix_mautrix_whatsapp_service_stat
|
||||
|
||||
- when: matrix_mautrix_whatsapp_service_stat.stat.exists | bool
|
||||
block:
|
||||
- name: Ensure matrix-mautrix-whatsapp is stopped
|
||||
ansible.builtin.service:
|
||||
name: matrix-mautrix-whatsapp
|
||||
name: "{{ matrix_mautrix_whatsapp_identifier }}"
|
||||
state: stopped
|
||||
enabled: false
|
||||
daemon_reload: true
|
||||
|
||||
- name: Ensure matrix-mautrix-whatsapp.service doesn't exist
|
||||
ansible.builtin.file:
|
||||
path: "{{ devture_systemd_docker_base_systemd_path }}/matrix-mautrix-whatsapp.service"
|
||||
path: "{{ devture_systemd_docker_base_systemd_path }}/{{ matrix_mautrix_whatsapp_identifier }}.service"
|
||||
state: absent
|
||||
|
||||
@ -10,6 +10,7 @@
|
||||
- {'name': 'matrix_mautrix_whatsapp_homeserver_address', when: true}
|
||||
- {'name': 'matrix_mautrix_whatsapp_homeserver_token', when: true}
|
||||
- {'name': 'matrix_mautrix_whatsapp_database_hostname', when: "{{ matrix_mautrix_whatsapp_database_engine == 'postgres' }}"}
|
||||
- {'name': 'matrix_mautrix_whatsapp_container_labels_bridgev2_traefik_hostname', when: "{{ matrix_mautrix_whatsapp_container_labels_bridgev2_enabled }}"}
|
||||
|
||||
- name: (Deprecation) Catch and report renamed settings
|
||||
ansible.builtin.fail:
|
||||
|
||||
@ -5,7 +5,8 @@ traefik.enable=true
|
||||
traefik.docker.network={{ matrix_mautrix_whatsapp_container_labels_traefik_docker_network }}
|
||||
{% endif %}
|
||||
|
||||
traefik.http.services.matrix-mautrix-whatsapp-metrics.loadbalancer.server.port=8001
|
||||
traefik.http.services.{{ matrix_mautrix_whatsapp_identifier }}-appservice.loadbalancer.server.port=8080
|
||||
traefik.http.services.{{ matrix_mautrix_whatsapp_identifier }}-metrics.loadbalancer.server.port=8001
|
||||
|
||||
{% if matrix_mautrix_whatsapp_container_labels_metrics_enabled %}
|
||||
############################################################
|
||||
@ -15,22 +16,22 @@ traefik.http.services.matrix-mautrix-whatsapp-metrics.loadbalancer.server.port=8
|
||||
############################################################
|
||||
|
||||
{% if matrix_mautrix_whatsapp_container_labels_metrics_middleware_basic_auth_enabled %}
|
||||
traefik.http.middlewares.matrix-mautrix-whatsapp-metrics-basic-auth.basicauth.users={{ matrix_mautrix_whatsapp_container_labels_metrics_middleware_basic_auth_users }}
|
||||
traefik.http.routers.matrix-mautrix-whatsapp-metrics.middlewares=matrix-mautrix-whatsapp-metrics-basic-auth
|
||||
traefik.http.middlewares.{{ matrix_mautrix_whatsapp_identifier }}-metrics-basic-auth.basicauth.users={{ matrix_mautrix_whatsapp_container_labels_metrics_middleware_basic_auth_users }}
|
||||
traefik.http.routers.{{ matrix_mautrix_whatsapp_identifier }}-metrics.middlewares={{ matrix_mautrix_whatsapp_identifier }}-metrics-basic-auth
|
||||
{% endif %}
|
||||
|
||||
traefik.http.routers.matrix-mautrix-whatsapp-metrics.rule={{ matrix_mautrix_whatsapp_container_labels_metrics_traefik_rule }}
|
||||
traefik.http.routers.{{ matrix_mautrix_whatsapp_identifier }}-metrics.rule={{ matrix_mautrix_whatsapp_container_labels_metrics_traefik_rule }}
|
||||
|
||||
{% if matrix_mautrix_whatsapp_container_labels_metrics_traefik_priority | int > 0 %}
|
||||
traefik.http.routers.matrix-mautrix-whatsapp-metrics.priority={{ matrix_mautrix_whatsapp_container_labels_metrics_traefik_priority }}
|
||||
traefik.http.routers.{{ matrix_mautrix_whatsapp_identifier }}-metrics.priority={{ matrix_mautrix_whatsapp_container_labels_metrics_traefik_priority }}
|
||||
{% endif %}
|
||||
|
||||
traefik.http.routers.matrix-mautrix-whatsapp-metrics.service=matrix-mautrix-whatsapp-metrics
|
||||
traefik.http.routers.matrix-mautrix-whatsapp-metrics.entrypoints={{ matrix_mautrix_whatsapp_container_labels_metrics_traefik_entrypoints }}
|
||||
traefik.http.routers.{{ matrix_mautrix_whatsapp_identifier }}-metrics.service={{ matrix_mautrix_whatsapp_identifier }}-metrics
|
||||
traefik.http.routers.{{ matrix_mautrix_whatsapp_identifier }}-metrics.entrypoints={{ matrix_mautrix_whatsapp_container_labels_metrics_traefik_entrypoints }}
|
||||
|
||||
traefik.http.routers.matrix-mautrix-whatsapp-metrics.tls={{ matrix_mautrix_whatsapp_container_labels_metrics_traefik_tls | to_json }}
|
||||
traefik.http.routers.{{ matrix_mautrix_whatsapp_identifier }}-metrics.tls={{ matrix_mautrix_whatsapp_container_labels_metrics_traefik_tls | to_json }}
|
||||
{% if matrix_mautrix_whatsapp_container_labels_metrics_traefik_tls %}
|
||||
traefik.http.routers.matrix-mautrix-whatsapp-metrics.tls.certResolver={{ matrix_mautrix_whatsapp_container_labels_metrics_traefik_tls_certResolver }}
|
||||
traefik.http.routers.{{ matrix_mautrix_whatsapp_identifier }}-metrics.tls.certResolver={{ matrix_mautrix_whatsapp_container_labels_metrics_traefik_tls_certResolver }}
|
||||
{% endif %}
|
||||
|
||||
############################################################
|
||||
@ -40,6 +41,36 @@ traefik.http.routers.matrix-mautrix-whatsapp-metrics.tls.certResolver={{ matrix_
|
||||
############################################################
|
||||
{% endif %}
|
||||
|
||||
{% if matrix_mautrix_whatsapp_container_labels_bridgev2_enabled %}
|
||||
############################################################
|
||||
# #
|
||||
# Appservice Bridgev2 API #
|
||||
# #
|
||||
############################################################
|
||||
|
||||
traefik.http.middlewares.{{ matrix_mautrix_whatsapp_identifier }}-bridgev2-stripprefix.stripprefix.prefixes={{ matrix_mautrix_whatsapp_container_labels_bridgev2_traefik_stripprefix }}
|
||||
traefik.http.routers.{{ matrix_mautrix_whatsapp_identifier }}-bridgev2.middlewares={{ matrix_mautrix_whatsapp_identifier }}-bridgev2-stripprefix
|
||||
|
||||
traefik.http.routers.{{ matrix_mautrix_whatsapp_identifier }}-bridgev2.rule={{ matrix_mautrix_whatsapp_container_labels_bridgev2_traefik_rule }}
|
||||
|
||||
{% if matrix_mautrix_whatsapp_container_labels_bridgev2_traefik_priority | int > 0 %}
|
||||
traefik.http.routers.{{ matrix_mautrix_whatsapp_identifier }}-bridgev2.priority={{ matrix_mautrix_whatsapp_container_labels_bridgev2_traefik_priority }}
|
||||
{% endif %}
|
||||
|
||||
traefik.http.routers.{{ matrix_mautrix_whatsapp_identifier }}-bridgev2.service={{ matrix_mautrix_whatsapp_identifier }}-appservice
|
||||
traefik.http.routers.{{ matrix_mautrix_whatsapp_identifier }}-bridgev2.entrypoints={{ matrix_mautrix_whatsapp_container_labels_bridgev2_traefik_entrypoints }}
|
||||
|
||||
traefik.http.routers.{{ matrix_mautrix_whatsapp_identifier }}-bridgev2.tls={{ matrix_mautrix_whatsapp_container_labels_bridgev2_traefik_tls | to_json }}
|
||||
{% if matrix_mautrix_whatsapp_container_labels_bridgev2_traefik_tls %}
|
||||
traefik.http.routers.{{ matrix_mautrix_whatsapp_identifier }}-bridgev2.tls.certResolver={{ matrix_mautrix_whatsapp_container_labels_bridgev2_traefik_tls_certResolver }}
|
||||
{% endif %}
|
||||
|
||||
############################################################
|
||||
# #
|
||||
# /Appservice Bridgev2 API #
|
||||
# #
|
||||
############################################################
|
||||
{% endif %}
|
||||
|
||||
{% endif %}
|
||||
|
||||
|
||||
@ -13,12 +13,12 @@ DefaultDependencies=no
|
||||
[Service]
|
||||
Type=simple
|
||||
Environment="HOME={{ devture_systemd_docker_base_systemd_unit_home_path }}"
|
||||
ExecStartPre=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} stop --time={{ devture_systemd_docker_base_container_stop_grace_time_seconds }} matrix-mautrix-whatsapp 2>/dev/null || true'
|
||||
ExecStartPre=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} rm matrix-mautrix-whatsapp 2>/dev/null || true'
|
||||
ExecStartPre=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} stop --time={{ devture_systemd_docker_base_container_stop_grace_time_seconds }} {{ matrix_mautrix_whatsapp_identifier }} 2>/dev/null || true'
|
||||
ExecStartPre=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} rm {{ matrix_mautrix_whatsapp_identifier }} 2>/dev/null || true'
|
||||
|
||||
ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} create \
|
||||
--rm \
|
||||
--name=matrix-mautrix-whatsapp \
|
||||
--name={{ matrix_mautrix_whatsapp_identifier }} \
|
||||
--log-driver=none \
|
||||
--user={{ matrix_user_uid }}:{{ matrix_user_gid }} \
|
||||
--cap-drop=ALL \
|
||||
@ -34,16 +34,16 @@ ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} create \
|
||||
/usr/bin/mautrix-whatsapp -c /config/config.yaml -r /config/registration.yaml
|
||||
|
||||
{% for network in matrix_mautrix_whatsapp_container_additional_networks %}
|
||||
ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} network connect {{ network }} matrix-mautrix-whatsapp
|
||||
ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} network connect {{ network }} {{ matrix_mautrix_whatsapp_identifier }}
|
||||
{% endfor %}
|
||||
|
||||
ExecStart={{ devture_systemd_docker_base_host_command_docker }} start --attach matrix-mautrix-whatsapp
|
||||
ExecStart={{ devture_systemd_docker_base_host_command_docker }} start --attach {{ matrix_mautrix_whatsapp_identifier }}
|
||||
|
||||
ExecStop=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} stop --time={{ devture_systemd_docker_base_container_stop_grace_time_seconds }} matrix-mautrix-whatsapp 2>/dev/null || true'
|
||||
ExecStop=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} rm matrix-mautrix-whatsapp 2>/dev/null || true'
|
||||
ExecStop=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} stop --time={{ devture_systemd_docker_base_container_stop_grace_time_seconds }} {{ matrix_mautrix_whatsapp_identifier }} 2>/dev/null || true'
|
||||
ExecStop=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} rm {{ matrix_mautrix_whatsapp_identifier }} 2>/dev/null || true'
|
||||
Restart=always
|
||||
RestartSec=30
|
||||
SyslogIdentifier=matrix-mautrix-whatsapp
|
||||
SyslogIdentifier={{ matrix_mautrix_whatsapp_identifier }}
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
|
||||
@ -11,7 +11,7 @@ matrix_client_element_container_image_self_build_repo: "https://github.com/eleme
|
||||
matrix_client_element_container_image_self_build_low_memory_system_patch_enabled: "{{ ansible_memtotal_mb < 4096 }}"
|
||||
|
||||
# renovate: datasource=docker depName=vectorim/element-web
|
||||
matrix_client_element_version: v1.11.87
|
||||
matrix_client_element_version: v1.11.88
|
||||
|
||||
matrix_client_element_docker_image: "{{ matrix_client_element_docker_image_name_prefix }}vectorim/element-web:{{ matrix_client_element_version }}"
|
||||
matrix_client_element_docker_image_name_prefix: "{{ 'localhost/' if matrix_client_element_container_image_self_build else matrix_container_global_registry_prefix }}"
|
||||
|
||||
@ -349,6 +349,65 @@ matrix_static_files_file_matrix_support_configuration: "{{ matrix_static_files_f
|
||||
# #
|
||||
########################################################################
|
||||
|
||||
########################################################################
|
||||
# #
|
||||
# Related to /.well-known/matrix/mautrix #
|
||||
# #
|
||||
########################################################################
|
||||
|
||||
# Controls whether a `/.well-known/matrix/mautrix` file is generated and used at all.
|
||||
# For details about this file, see mautrix/manager auto-configuration section : https://github.com/mautrix/manager#auto-configuration
|
||||
#
|
||||
# This is not enabled by default, as for it to be useful, other information is necessary.
|
||||
# See `matrix_static_files_file_matrix_mautrix_property_fi_mau_bridges`, `matrix_static_files_file_matrix_mautrix_property_fi_mau_external_bridge_servers`, etc.
|
||||
matrix_static_files_file_matrix_mautrix_enabled: false
|
||||
|
||||
# Controls the fi.mau.bridges property in the /.well-known/matrix/mautrix file
|
||||
# It indexes local bridges implementing the bridgev2 API
|
||||
# Example entry : https://bridges.example.com/signal
|
||||
matrix_static_files_file_matrix_mautrix_property_fi_mau_bridges: []
|
||||
|
||||
# Controls the fi.mau.external_bridge_servers property in the /.well-known/matrix/mautrix file
|
||||
# It indexes remote servers with bridges implementing the bridgev2 API
|
||||
# Example entry : anotherserver.example.org
|
||||
matrix_static_files_file_matrix_mautrix_property_fi_mau_external_bridge_servers:
|
||||
[]
|
||||
|
||||
# Default /.well-known/matrix/mautrix configuration template which covers the generic use case.
|
||||
# You can customize it by controlling the various variables inside it.
|
||||
#
|
||||
# For a more advanced customization, you can extend the default (see `matrix_static_files_file_matrix_mautrix_configuration_extension_json`)
|
||||
# or completely replace this variable with your own template.
|
||||
matrix_static_files_file_matrix_mautrix_configuration_json: "{{ lookup('template', 'templates/public/.well-known/matrix/mautrix.j2') }}"
|
||||
|
||||
# Your custom JSON configuration for /.well-known/matrix/mautrix should go to `matrix_static_files_file_matrix_mautrix_configuration_extension_json`.
|
||||
# This configuration extends the default starting configuration (`matrix_static_files_file_matrix_mautrix_configuration_extension_json`).
|
||||
#
|
||||
# You can override individual variables from the default configuration, or introduce new ones.
|
||||
#
|
||||
# If you need something more special, you can take full control by
|
||||
# completely redefining `matrix_static_files_file_matrix_mautrix_configuration_json`.
|
||||
#
|
||||
# Example configuration extension follows:
|
||||
#
|
||||
# matrix_static_files_file_matrix_mautrix_configuration_extension_json: |
|
||||
# {
|
||||
# "m.another": "value",
|
||||
# "m.yet_another": 3
|
||||
# }
|
||||
matrix_static_files_file_matrix_mautrix_configuration_extension_json: "{}"
|
||||
|
||||
matrix_static_files_file_matrix_mautrix_configuration_extension: "{{ matrix_static_files_file_matrix_mautrix_configuration_extension_json | from_json if matrix_static_files_file_matrix_mautrix_configuration_extension_json | from_json is mapping else {} }}"
|
||||
|
||||
# Holds the final /.well-known/matrix/mautrix configuration (a combination of the default and its extension).
|
||||
# You most likely don't need to touch this variable. Instead, see `matrix_static_files_file_matrix_mautrix_configuration_json` or `matrix_static_files_file_matrix_mautrix_configuration_extension_json`.
|
||||
matrix_static_files_file_matrix_mautrix_configuration: "{{ matrix_static_files_file_matrix_mautrix_configuration_json | combine(matrix_static_files_file_matrix_mautrix_configuration_extension, recursive=True) }}"
|
||||
|
||||
########################################################################
|
||||
# #
|
||||
# /Related to /.well-known/matrix/mautrix #
|
||||
# #
|
||||
########################################################################
|
||||
|
||||
########################################################################
|
||||
# #
|
||||
|
||||
@ -52,6 +52,10 @@
|
||||
dest: "{{ matrix_static_files_public_well_known_matrix_path }}/support"
|
||||
when: "{{ matrix_static_files_file_matrix_support_enabled }}"
|
||||
|
||||
- content: "{{ matrix_static_files_file_matrix_mautrix_configuration | to_nice_json }}"
|
||||
dest: "{{ matrix_static_files_public_well_known_matrix_path }}/mautrix"
|
||||
when: "{{ matrix_static_files_file_matrix_mautrix_enabled }}"
|
||||
|
||||
# This one will not be deleted if `matrix_static_files_file_index_html_enabled` flips to `false`.
|
||||
# See the comment for `matrix_static_files_file_index_html_enabled` to learn why.
|
||||
- content: "{{ matrix_static_files_file_index_html_template }}"
|
||||
@ -70,6 +74,12 @@
|
||||
state: absent
|
||||
when: "not matrix_static_files_file_matrix_support_enabled | bool"
|
||||
|
||||
- name: Ensure /.well-known/matrix/mautrix file deleted if not enabled
|
||||
ansible.builtin.file:
|
||||
path: "{{ matrix_static_files_public_well_known_matrix_path }}/mautrix"
|
||||
state: absent
|
||||
when: "not matrix_static_files_file_matrix_mautrix_enabled | bool"
|
||||
|
||||
- name: Ensure matrix-static-files container image is pulled
|
||||
community.docker.docker_image:
|
||||
name: "{{ matrix_static_files_container_image }}"
|
||||
|
||||
@ -24,6 +24,21 @@
|
||||
ansible.builtin.set_fact:
|
||||
well_known_file_checks: "{{ well_known_file_checks + [well_known_file_check_matrix_server] }}"
|
||||
|
||||
- when: matrix_static_files_file_matrix_mautrix_enabled | bool
|
||||
block:
|
||||
- name: Prepare /.well-known/matrix/mautrix to well-known files to check, if enabled
|
||||
ansible.builtin.set_fact:
|
||||
well_known_file_check_matrix_mautrix:
|
||||
path: /.well-known/matrix/mautrix
|
||||
purpose: Mautrix bridge discovery
|
||||
cors: true
|
||||
follow_redirects: safe
|
||||
validate_certs: "{{ matrix_static_files_self_check_validate_certificates }}"
|
||||
|
||||
- name: Inject /.well-known/matrix/mautrix to well-known files to check, if enabled
|
||||
ansible.builtin.set_fact:
|
||||
well_known_file_checks: "{{ well_known_file_checks + [well_known_file_check_matrix_mautrix] }}"
|
||||
|
||||
- name: Perform well-known checks
|
||||
ansible.builtin.include_tasks: "{{ role_path }}/tasks/self_check_well_known_file.yml"
|
||||
with_items: "{{ well_known_file_checks }}"
|
||||
|
||||
@ -0,0 +1,4 @@
|
||||
{
|
||||
"fi.mau.bridges": {{ matrix_static_files_file_matrix_mautrix_property_fi_mau_bridges|to_json }},
|
||||
"fi.mau.external_bridge_servers": {{ matrix_static_files_file_matrix_mautrix_property_fi_mau_external_bridge_servers|to_json }}
|
||||
}
|
||||
Loading…
x
Reference in New Issue
Block a user