jowj/matrix-docker-ansible-deploy
1
0
Fork 0
forked from mirrors/matrix-docker-ansible-deploy
Code Issues Pull Requests Releases Wiki Activity
810028c12b
matrix-docker-ansible-deploy/README.md

144 lines
9.0 KiB
Markdown
Raw Normal View History

Initial commit
2017-07-31 20:07:30 +00:00
# Matrix (An open network for secure, decentralized communication) server setup using Ansible and Docker
## Purpose
This Ansible playbook is meant to easily let you run your own [Matrix](http://matrix.org/) homeserver.
That is, it lets you join the Matrix network with your own `@<username>:<your-domain>` identifier, all hosted on your own server.
Using this playbook, you can get the following services configured on your server:
Update README and changelog
2019-05-21 02:04:58 +00:00
- (optional, default) a [Synapse](https://github.com/matrix-org/synapse) homeserver - storing your data and managing your presence in the [Matrix](http://matrix.org/) network
Initial commit
2017-07-31 20:07:30 +00:00
Make roles more independent of one another With this change, the following roles are now only dependent on the minimal `matrix-base` role: - `matrix-corporal` - `matrix-coturn` - `matrix-mailer` - `matrix-mxisd` - `matrix-postgres` - `matrix-riot-web` - `matrix-synapse` The `matrix-nginx-proxy` role still does too much and remains dependent on the others. Wiring up the various (now-independent) roles happens via a glue variables file (`group_vars/matrix-servers`). It's triggered for all hosts in the `matrix-servers` group. According to Ansible's rules of priority, we have the following chain of inclusion/overriding now: - role defaults (mostly empty or good for independent usage) - playbook glue variables (`group_vars/matrix-servers`) - inventory host variables (`inventory/host_vars/matrix.<your-domain>`) All roles default to enabling their main component (e.g. `matrix_mxisd_enabled: true`, `matrix_riot_web_enabled: true`). Reasoning: if a role is included in a playbook (especially separately, in another playbook), it should "work" by default. Our playbook disables some of those if they are not generally useful (e.g. `matrix_corporal_enabled: false`).
2019-01-16 16:05:48 +00:00
- (optional) [Amazon S3](https://aws.amazon.com/s3/) storage for Synapse's content repository (`media_store`) files using [Goofys](https://github.com/kahing/goofys)
Add support for storing Matrix Synapse's media_store to Amazon S3
2017-09-07 15:26:41 +00:00
Make roles more independent of one another With this change, the following roles are now only dependent on the minimal `matrix-base` role: - `matrix-corporal` - `matrix-coturn` - `matrix-mailer` - `matrix-mxisd` - `matrix-postgres` - `matrix-riot-web` - `matrix-synapse` The `matrix-nginx-proxy` role still does too much and remains dependent on the others. Wiring up the various (now-independent) roles happens via a glue variables file (`group_vars/matrix-servers`). It's triggered for all hosts in the `matrix-servers` group. According to Ansible's rules of priority, we have the following chain of inclusion/overriding now: - role defaults (mostly empty or good for independent usage) - playbook glue variables (`group_vars/matrix-servers`) - inventory host variables (`inventory/host_vars/matrix.<your-domain>`) All roles default to enabling their main component (e.g. `matrix_mxisd_enabled: true`, `matrix_riot_web_enabled: true`). Reasoning: if a role is included in a playbook (especially separately, in another playbook), it should "work" by default. Our playbook disables some of those if they are not generally useful (e.g. `matrix_corporal_enabled: false`).
2019-01-16 16:05:48 +00:00
- (optional, default) [PostgreSQL](https://www.postgresql.org/) database for Synapse. [Using an external PostgreSQL server](docs/configuring-playbook-external-postgres.md) is also possible.
Initial commit
2017-07-31 20:07:30 +00:00
Make roles more independent of one another With this change, the following roles are now only dependent on the minimal `matrix-base` role: - `matrix-corporal` - `matrix-coturn` - `matrix-mailer` - `matrix-mxisd` - `matrix-postgres` - `matrix-riot-web` - `matrix-synapse` The `matrix-nginx-proxy` role still does too much and remains dependent on the others. Wiring up the various (now-independent) roles happens via a glue variables file (`group_vars/matrix-servers`). It's triggered for all hosts in the `matrix-servers` group. According to Ansible's rules of priority, we have the following chain of inclusion/overriding now: - role defaults (mostly empty or good for independent usage) - playbook glue variables (`group_vars/matrix-servers`) - inventory host variables (`inventory/host_vars/matrix.<your-domain>`) All roles default to enabling their main component (e.g. `matrix_mxisd_enabled: true`, `matrix_riot_web_enabled: true`). Reasoning: if a role is included in a playbook (especially separately, in another playbook), it should "work" by default. Our playbook disables some of those if they are not generally useful (e.g. `matrix_corporal_enabled: false`).
2019-01-16 16:05:48 +00:00
- (optional, default) a [coturn](https://github.com/coturn/coturn) STUN/TURN server for WebRTC audio/video calls
Update README
2018-08-15 06:01:41 +00:00
Add support for 2 more SSL certificate retrieval methods Adds support for managing certificates manually and for having the playbook generate self-signed certificates for you. With this, Let's Encrypt usage is no longer required. Fixes Github issue #50.
2018-12-23 09:00:12 +00:00
- (optional, default) free [Let's Encrypt](https://letsencrypt.org/) SSL certificate, which secures the connection to the Synapse server and the Riot web UI
Initial commit
2017-07-31 20:07:30 +00:00
Make roles more independent of one another With this change, the following roles are now only dependent on the minimal `matrix-base` role: - `matrix-corporal` - `matrix-coturn` - `matrix-mailer` - `matrix-mxisd` - `matrix-postgres` - `matrix-riot-web` - `matrix-synapse` The `matrix-nginx-proxy` role still does too much and remains dependent on the others. Wiring up the various (now-independent) roles happens via a glue variables file (`group_vars/matrix-servers`). It's triggered for all hosts in the `matrix-servers` group. According to Ansible's rules of priority, we have the following chain of inclusion/overriding now: - role defaults (mostly empty or good for independent usage) - playbook glue variables (`group_vars/matrix-servers`) - inventory host variables (`inventory/host_vars/matrix.<your-domain>`) All roles default to enabling their main component (e.g. `matrix_mxisd_enabled: true`, `matrix_riot_web_enabled: true`). Reasoning: if a role is included in a playbook (especially separately, in another playbook), it should "work" by default. Our playbook disables some of those if they are not generally useful (e.g. `matrix_corporal_enabled: false`).
2019-01-16 16:05:48 +00:00
- (optional, default) a [Riot](https://riot.im/) web UI, which is configured to connect to your own Synapse server by default
Initial commit
2017-07-31 20:07:30 +00:00
Make it clearer that not all components are necessary
2018-11-26 08:35:08 +00:00
- (optional, default) an [mxisd](https://github.com/kamax-io/mxisd) Matrix Identity server
Add mxisd Identity Server support
2018-08-15 07:23:22 +00:00
Make (most) containers start as non-root This makes all containers (except mautrix-telegram and mautrix-whatsapp), start as a non-root user. We do this, because we don't trust some of the images. In any case, we'd rather not trust ALL images and avoid giving `root` access at all. We can't be sure they would drop privileges or what they might do before they do it. Because Postfix doesn't support running as non-root, it had to be replaced by an Exim mail server. The matrix-nginx-proxy nginx container image is patched up (by replacing its main configuration) so that it can work as non-root. It seems like there's no other good image that we can use and that is up-to-date (https://hub.docker.com/r/nginxinc/nginx-unprivileged is outdated). Likewise for riot-web (https://hub.docker.com/r/bubuntux/riot-web/), we patch it up ourselves when starting (replacing the main nginx configuration). Ideally, it would be fixed upstream so we can simplify.
2019-01-27 18:25:13 +00:00
- (optional, default) an [Exim](https://www.exim.org/) mail server, through which all Matrix services send outgoing email (can be configured to relay through another SMTP server)
Initial commit
2017-07-31 20:07:30 +00:00
Make it clearer that not all components are necessary
2018-11-26 08:35:08 +00:00
- (optional, default) an [nginx](http://nginx.org/) web server, listening on ports 80 and 443 - standing in front of all the other services. Using your own webserver [is possible](docs/configuring-playbook-own-webserver.md)
Add support for not taking over a server (no matrix-nginx-proxy) and disabling Riot
2017-09-12 09:41:44 +00:00
Make it clearer that not all components are necessary
2018-11-26 08:35:08 +00:00
- (optional, advanced) the [matrix-synapse-rest-auth](https://github.com/kamax-io/matrix-synapse-rest-auth) REST authentication password provider module
Add matrix-synapse-rest-auth support
2018-08-17 06:02:12 +00:00
Make it clearer that not all components are necessary
2018-11-26 08:35:08 +00:00
- (optional, advanced) the [matrix-synapse-shared-secret-auth](https://github.com/devture/matrix-synapse-shared-secret-auth) password provider module
Update README
2018-08-20 14:30:05 +00:00
Add LDAP auth password provider documentation and changelog description
2018-11-28 09:21:03 +00:00
- (optional, advanced) the [matrix-synapse-ldap3](https://github.com/matrix-org/matrix-synapse-ldap3) LDAP Auth password provider module
Make it clearer that not all components are necessary
2018-11-26 08:35:08 +00:00
- (optional, advanced) the [Matrix Corporal](https://github.com/devture/matrix-corporal) reconciliator and gateway for a managed Matrix server
Update README
2018-08-26 15:12:24 +00:00
Update README
2018-09-08 07:21:09 +00:00
- (optional) the [mautrix-telegram](https://github.com/tulir/mautrix-telegram) bridge for bridging your Matrix server to [Telegram](https://telegram.org/)
Update README
2018-10-26 16:48:49 +00:00
- (optional) the [mautrix-whatsapp](https://github.com/tulir/mautrix-whatsapp) bridge for bridging your Matrix server to [Whatsapp](https://www.whatsapp.com/)
Add mautrix-facebook doc
2019-05-08 14:33:09 +00:00
- (optional) the [mautrix-facebook](https://github.com/tulir/mautrix-facebook) bridge for bridging your Matrix server to [facebook](https://facebook.com/)
Add support for matrix-appservice-irc
2019-01-31 05:37:23 +00:00
- (optional) the [matrix-appservice-irc](https://github.com/TeDomum/matrix-appservice-irc) bridge for bridging your Matrix server to [IRC](https://wikipedia.org/wiki/Internet_Relay_Chat)
Add matrix-appservice-discord bridge Bridge is setup to work on the matrix side with this, but the discord invite link is not automatically generated.
2019-03-03 17:22:52 +00:00
- (optional) the [matrix-appservice-discord](https://github.com/Half-Shot/matrix-appservice-discord) bridge for bridging your Matrix server to [Discord](https://discordapp.com/)
Provide Dimension documentation
2019-03-10 08:12:31 +00:00
- (optional) [Dimension](https://github.com/turt2live/matrix-dimension), an open source integrations manager for matrix clients
Initial commit
2017-07-31 20:07:30 +00:00
Basically, this playbook aims to get you up-and-running with all the basic necessities around Matrix, without you having to do anything else.
Make it clearer that not all components are necessary
2018-11-26 08:35:08 +00:00
**Note**: the list above is exhaustive. It includes optional or even some advanced components that you will most likely not need.
Sticking with the defaults (which install a subset of the above components) is the best choice, especially for a new installation.
You can always re-run the playbook later to add or remove components.
Initial commit
2017-07-31 20:07:30 +00:00
## What's different about this Ansible playbook?
Fix typo
2018-01-10 10:10:56 +00:00
This is similar to the [EMnify/matrix-synapse-auto-deploy](https://github.com/EMnify/matrix-synapse-auto-deploy) Ansible deployment, but:
Initial commit
2017-07-31 20:07:30 +00:00
Split README into a bunch of files in docs/
2018-08-08 07:07:02 +00:00
- this one is a complete Ansible playbook (instead of just a role), so it's **easier to run** - especially for folks not familiar with Ansible
Initial commit
2017-07-31 20:07:30 +00:00
Update README
2018-08-15 08:41:36 +00:00
- this one installs and hooks together **a lot more Matrix-related services** for you (see above)
Initial commit
2017-07-31 20:07:30 +00:00
- this one **can be re-ran many times** without causing trouble
Add support for Debian (9+) and Ubuntu (16.04+)
2017-09-11 20:24:05 +00:00
- works on both **CentOS** (7.0+) and Debian-based distributions (**Debian** 9/Stretch+, **Ubuntu** 16.04+)
Split README into a bunch of files in docs/
2018-08-08 07:07:02 +00:00
- this one installs everything in a single directory (`/matrix` by default) and **doesn't "contaminate" your server** with files all over the place
Add support for not taking over a server (no matrix-nginx-proxy) and disabling Riot
2017-09-12 09:41:44 +00:00
Split README into a bunch of files in docs/
2018-08-08 07:07:02 +00:00
- this one **doesn't necessarily take over** ports 80 and 443. By default, it sets up nginx for you there, but you can also [use your own webserver](docs/configuring-playbook-own-webserver.md)
Add support for not taking over a server (no matrix-nginx-proxy) and disabling Riot
2017-09-12 09:41:44 +00:00
Document the Docker images being used
2018-05-29 06:48:53 +00:00
- this one **runs everything in Docker containers**, so it's likely more predictable and less fragile (see [Docker images used by this playbook](#docker-images-used-by-this-playbook))
Initial commit
2017-07-31 20:07:30 +00:00
- this one retrieves and automatically renews free [Let's Encrypt](https://letsencrypt.org/) **SSL certificates** for you
Add support for using an external PostgreSQL server
2017-09-08 13:53:24 +00:00
- this one optionally can store the `media_store` content repository files on [Amazon S3](https://aws.amazon.com/s3/) (but defaults to storing files on the server's filesystem)
Make roles more independent of one another With this change, the following roles are now only dependent on the minimal `matrix-base` role: - `matrix-corporal` - `matrix-coturn` - `matrix-mailer` - `matrix-mxisd` - `matrix-postgres` - `matrix-riot-web` - `matrix-synapse` The `matrix-nginx-proxy` role still does too much and remains dependent on the others. Wiring up the various (now-independent) roles happens via a glue variables file (`group_vars/matrix-servers`). It's triggered for all hosts in the `matrix-servers` group. According to Ansible's rules of priority, we have the following chain of inclusion/overriding now: - role defaults (mostly empty or good for independent usage) - playbook glue variables (`group_vars/matrix-servers`) - inventory host variables (`inventory/host_vars/matrix.<your-domain>`) All roles default to enabling their main component (e.g. `matrix_mxisd_enabled: true`, `matrix_riot_web_enabled: true`). Reasoning: if a role is included in a playbook (especially separately, in another playbook), it should "work" by default. Our playbook disables some of those if they are not generally useful (e.g. `matrix_corporal_enabled: false`).
2019-01-16 16:05:48 +00:00
- this one optionally **allows you to use an external PostgreSQL server** for Synapse's database (but defaults to running one in a container)
Add support for storing Matrix Synapse's media_store to Amazon S3
2017-09-07 15:26:41 +00:00
Initial commit
2017-07-31 20:07:30 +00:00
Split README into a bunch of files in docs/
2018-08-08 07:07:02 +00:00
## Installation
Initial commit
2017-07-31 20:07:30 +00:00
Split README into a bunch of files in docs/
2018-08-08 07:07:02 +00:00
To configure and install Matrix on your own server, follow the [README in the docs/ directory](docs/README.md).
Initial commit
2017-07-31 20:07:30 +00:00
Indicate that some distributions require a manual python install
2018-06-21 06:42:27 +00:00
Split README into a bunch of files in docs/
2018-08-08 07:07:02 +00:00
## Changes
Initial commit
2017-07-31 20:07:30 +00:00
Split README into a bunch of files in docs/
2018-08-08 07:07:02 +00:00
This playbook evolves over time, sometimes with backward-incompatible changes.
Initial commit
2017-07-31 20:07:30 +00:00
Split README into a bunch of files in docs/
2018-08-08 07:07:02 +00:00
When updating the playbook, refer to [the changelog](CHANGELOG.md) to catch up with what's new.
Add support for not taking over a server (no matrix-nginx-proxy) and disabling Riot
2017-09-12 09:41:44 +00:00
Document the Docker images being used
2018-05-29 06:48:53 +00:00
## Docker images used by this playbook
This playbook sets up your server using the following Docker images:
Update README and changelog
2019-05-21 02:04:58 +00:00
- [matrixdotorg/synapse](https://hub.docker.com/r/matrixdotorg/synapse/) - the official [Synapse](https://github.com/matrix-org/synapse) Matrix homeserver (optional)
Document the Docker images being used
2018-05-29 06:48:53 +00:00
Mark some Docker images as optional
2019-02-28 12:23:17 +00:00
- [instrumentisto/coturn](https://hub.docker.com/r/instrumentisto/coturn/) - the [Coturn](https://github.com/coturn/coturn) STUN/TURN server (optional)
Document the Docker images being used
2018-05-29 06:48:53 +00:00
Update README to link to bubuntux/riot-web
2019-01-11 21:29:45 +00:00
- [bubuntux/riot-web](https://hub.docker.com/r/bubuntux/riot-web/) - the [Riot.im](https://about.riot.im/) web client (optional)
Document the Docker images being used
2018-05-29 06:48:53 +00:00
Add mxisd Identity Server support
2018-08-15 07:23:22 +00:00
- [kamax/mxisd](https://hub.docker.com/r/kamax/mxisd/) - the [mxisd](https://github.com/kamax-io/mxisd) Matrix Identity server (optional)
Document the Docker images being used
2018-05-29 06:48:53 +00:00
- [postgres](https://hub.docker.com/_/postgres/) - the [Postgres](https://www.postgresql.org/) database server (optional)
Change Goofys Docker image (clodproto/goofys -> ewoutp/goofys) The new image is built in a much better way (2-stage build) and is 10x smaller. In terms of Goofys version recency, it's about the same.. Both images (and others alike) seem to not use version tags, but rather some `:latest` (master), with ewoutp/goofys being a bit more recent than clodproto/goofys. Not using version tags is good (in this case), because the last Goofys release seems to be from about a year ago and there had been a bunch of bugfixes afterwards.
2018-12-20 12:30:24 +00:00
- [ewoutp/goofys](https://hub.docker.com/r/ewoutp/goofys/) - the [Goofys](https://github.com/kahing/goofys) Amazon [S3](https://aws.amazon.com/s3/) file-system-mounting program (optional)
Document the Docker images being used
2018-05-29 06:48:53 +00:00
Make (most) containers start as non-root This makes all containers (except mautrix-telegram and mautrix-whatsapp), start as a non-root user. We do this, because we don't trust some of the images. In any case, we'd rather not trust ALL images and avoid giving `root` access at all. We can't be sure they would drop privileges or what they might do before they do it. Because Postfix doesn't support running as non-root, it had to be replaced by an Exim mail server. The matrix-nginx-proxy nginx container image is patched up (by replacing its main configuration) so that it can work as non-root. It seems like there's no other good image that we can use and that is up-to-date (https://hub.docker.com/r/nginxinc/nginx-unprivileged is outdated). Likewise for riot-web (https://hub.docker.com/r/bubuntux/riot-web/), we patch it up ourselves when starting (replacing the main nginx configuration). Ideally, it would be fixed upstream so we can simplify.
2019-01-27 18:25:13 +00:00
- [devture/exim-relay](https://hub.docker.com/r/devture/exim-relay/) - the [Exim](https://www.exim.org/) email server (optional)
Update README
2018-08-15 06:01:41 +00:00
Update README
2018-08-26 15:12:24 +00:00
- [devture/matrix-corporal](https://hub.docker.com/r/devture/matrix-corporal/) - [Matrix Corporal](https://github.com/devture/matrix-corporal): reconciliator and gateway for a managed Matrix server (optional)
Document the Docker images being used
2018-05-29 06:48:53 +00:00
- [nginx](https://hub.docker.com/_/nginx/) - the [nginx](http://nginx.org/) web server (optional)
Mark some Docker images as optional
2019-02-28 12:23:17 +00:00
- [certbot/certbot](https://hub.docker.com/r/certbot/certbot/) - the [certbot](https://certbot.eff.org/) tool for obtaining SSL certificates from [Let's Encrypt](https://letsencrypt.org/) (optional)
Update README
2018-08-29 07:12:48 +00:00
Update README
2018-09-08 07:21:09 +00:00
- [tulir/mautrix-telegram](https://hub.docker.com/r/tulir/mautrix-telegram/) - the [mautrix-telegram](https://github.com/tulir/mautrix-telegram) bridge to [Telegram](https://telegram.org/) (optional)
Update README
2018-10-26 16:48:49 +00:00
- [tulir/mautrix-whatsapp](https://hub.docker.com/r/tulir/mautrix-whatsapp/) - the [mautrix-whatsapp](https://github.com/tulir/mautrix-whatsapp) bridge to [Whatsapp](https://www.whatsapp.com/) (optional)
Add mautrix-facebook doc
2019-05-08 14:33:09 +00:00
- [tulir/mautrix-facebook](https://hub.docker.com/r/tulir/mautrix-facebook/) - the [mautrix-facebook](https://github.com/tulir/mautrix-facebook) bridge to [Facebook](https://facebook.com/) (optional)
Add support for matrix-appservice-irc
2019-01-31 05:37:23 +00:00
- [tedomum/matrix-appservice-irc](https://hub.docker.com/r/tedomum/matrix-appservice-irc/) - the [matrix-appservice-irc](https://github.com/TeDomum/matrix-appservice-irc) bridge to [IRC](https://wikipedia.org/wiki/Internet_Relay_Chat) (optional)
Fix incorrect Docker image name in README
2019-03-11 16:25:12 +00:00
- [halfshot/matrix-appservice-discord](https://hub.docker.com/r/halfshot/matrix-appservice-discord) - the [matrix-appservice-discord](https://github.com/Half-Shot/matrix-appservice-discord) bridge to [Discord](https://discordapp.com/) (optional)
Add matrix-appservice-discord bridge Bridge is setup to work on the matrix side with this, but the discord invite link is not automatically generated.
2019-03-03 17:22:52 +00:00
Provide Dimension documentation
2019-03-10 08:12:31 +00:00
- [turt2live/matrix-dimension](https://hub.docker.com/r/turt2live/matrix-dimension) - the [Dimension](https://dimension.t2bot.io/) integrations manager (optional)
Document the Docker images being used
2018-05-29 06:48:53 +00:00
Initial commit
2017-07-31 20:07:30 +00:00
## Deficiencies
This Ansible playbook can be improved in the following ways:
- setting up automatic backups to one or more storage providers
Add support information
2018-05-29 06:58:36 +00:00
## Support
Add information about the IRC support channel
2018-11-23 11:23:01 +00:00
- Matrix room: [#matrix-docker-ansible-deploy:devture.com](https://matrix.to/#/#matrix-docker-ansible-deploy:devture.com)
Add support information
2018-05-29 06:58:36 +00:00
Add information about the IRC support channel
2018-11-23 11:23:01 +00:00
- IRC channel: `#matrix-docker-ansible-deploy` on the [Freenode](https://freenode.net/) IRC network (irc.freenode.net)
- Github issues: [spantaleev/matrix-docker-ansible-deploy/issues](https://github.com/spantaleev/matrix-docker-ansible-deploy/issues)
Reference in New Issue Copy Permalink