From e7978dbdca91351e235d36ae25a74a0a7266f155 Mon Sep 17 00:00:00 2001
From: SaltireSoul <rinld0jsg@mozmail.com>
Date: Tue, 5 Apr 2022 03:40:37 +0100
Subject: [PATCH] Dendrite 0.7.0

---
 group_vars/matrix_servers                     |  14 +-
 roles/matrix-dendrite/defaults/main.yml       |  11 +-
 .../matrix-dendrite/tasks/setup_dendrite.yml  |   1 +
 .../templates/dendrite/dendrite.yaml.j2       | 176 ++++++++----------
 .../systemd/matrix-dendrite.service.j2        |   1 +
 5 files changed, 83 insertions(+), 120 deletions(-)

diff --git a/group_vars/matrix_servers b/group_vars/matrix_servers
index 26485d68..de81e2a6 100755
--- a/group_vars/matrix_servers
+++ b/group_vars/matrix_servers
@@ -1592,15 +1592,11 @@ matrix_postgres_additional_databases: |
     }] if (matrix_synapse_enabled and matrix_synapse_database_database != matrix_postgres_db_name and matrix_synapse_database_host == 'matrix-postgres') else [])
     +
     ([{
-      'name': matrix_dendrite_naffka_database,
-      'username': matrix_dendrite_database_user,
-      'password': matrix_dendrite_database_password,
-    },{
       'name': matrix_dendrite_appservice_database,
       'username': matrix_dendrite_database_user,
       'password': matrix_dendrite_database_password,
     },{
-      'name': matrix_dendrite_federationsender_database,
+      'name': matrix_dendrite_federationapi_database,
       'username': matrix_dendrite_database_user,
       'password': matrix_dendrite_database_password,
     },{
@@ -1615,20 +1611,16 @@ matrix_postgres_additional_databases: |
       'name': matrix_dendrite_room_database,
       'username': matrix_dendrite_database_user,
       'password': matrix_dendrite_database_password,
-    },{
-      'name': matrix_dendrite_singingkeyserver_database,
-      'username': matrix_dendrite_database_user,
-      'password': matrix_dendrite_database_password,
     },{
       'name': matrix_dendrite_syncapi_database,
       'username': matrix_dendrite_database_user,
       'password': matrix_dendrite_database_password,
     },{
-      'name': matrix_dendrite_account_database,
+      'name': matrix_dendrite_userapi_database,
       'username': matrix_dendrite_database_user,
       'password': matrix_dendrite_database_password,
     },{
-      'name': matrix_dendrite_device_database,
+      'name': matrix_dendrite_pushserver_database,
       'username': matrix_dendrite_database_user,
       'password': matrix_dendrite_database_password,
     },{
diff --git a/roles/matrix-dendrite/defaults/main.yml b/roles/matrix-dendrite/defaults/main.yml
index ec3937c7..99ceb1a0 100644
--- a/roles/matrix-dendrite/defaults/main.yml
+++ b/roles/matrix-dendrite/defaults/main.yml
@@ -6,13 +6,14 @@ matrix_dendrite_enabled: true
 
 matrix_dendrite_docker_image: "{{ matrix_dendrite_docker_image_name_prefix }}matrixdotorg/dendrite-monolith:{{ matrix_dendrite_docker_image_tag }}"
 matrix_dendrite_docker_image_name_prefix: "docker.io/"
-matrix_dendrite_docker_image_tag: "v0.5.1"
+matrix_dendrite_docker_image_tag: "v0.7.0"
 matrix_dendrite_docker_image_force_pull: "{{ matrix_dendrite_docker_image.endswith(':latest') }}"
 
 matrix_dendrite_base_path: "{{ matrix_base_data_path }}/dendrite"
 matrix_dendrite_config_dir_path: "{{ matrix_dendrite_base_path }}/config"
 matrix_dendrite_storage_path: "{{ matrix_dendrite_base_path }}/storage"
 matrix_dendrite_media_store_path: "{{ matrix_dendrite_storage_path }}/media-store"
+matrix_dendrite_nats_storage_path: "{{ matrix_dendrite_base_path }}/nats"
 matrix_dendrite_ext_path: "{{ matrix_dendrite_base_path }}/ext"
 
 # By default, we make Dendrite only serve HTTP (not HTTPS).
@@ -114,16 +115,14 @@ matrix_dendrite_database_str: "postgresql://{{ matrix_dendrite_database_user }}:
 matrix_dendrite_database_hostname: "matrix-postgres"
 matrix_dendrite_database_user: "dendrite"
 matrix_dendrite_database_password: "itsasecret"
-matrix_dendrite_naffka_database: "dendrite_naffka"
 matrix_dendrite_appservice_database: "dendrite_appservice"
-matrix_dendrite_federationsender_database: "dendrite_federationsender"
+matrix_dendrite_federationapi_database: "dendrite_federationapi"
 matrix_dendrite_keyserver_database: "dendrite_keyserver"
 matrix_dendrite_mediaapi_database: "dendrite_mediaapi"
 matrix_dendrite_room_database: "dendrite_room"
-matrix_dendrite_singingkeyserver_database: "dendrite_sigingkeyserver"
 matrix_dendrite_syncapi_database: "dendrite_syncapi"
-matrix_dendrite_account_database: "dendrite_account"
-matrix_dendrite_device_database: "dendrite_device"
+matrix_dendrite_userapi_database: "dendrite_userapi"
+matrix_dendrite_pushserver_database: "dendrite_pushserver"
 matrix_dendrite_mscs_database: "dendrite_mscs"
 
 matrix_dendrite_turn_uris: []
diff --git a/roles/matrix-dendrite/tasks/setup_dendrite.yml b/roles/matrix-dendrite/tasks/setup_dendrite.yml
index cbe0cf84..fc306759 100644
--- a/roles/matrix-dendrite/tasks/setup_dendrite.yml
+++ b/roles/matrix-dendrite/tasks/setup_dendrite.yml
@@ -9,6 +9,7 @@
   with_items:
     - {path: "{{ matrix_dendrite_config_dir_path }}", when: true}
     - {path: "{{ matrix_dendrite_ext_path }}", when: true}
+    - {path: "{{ matrix_dendrite_nats_storage_path }}", when: true}
   when: "matrix_dendrite_enabled|bool and item.when"
 
 - import_tasks: "{{ role_path }}/tasks/dendrite/setup.yml"
diff --git a/roles/matrix-dendrite/templates/dendrite/dendrite.yaml.j2 b/roles/matrix-dendrite/templates/dendrite/dendrite.yaml.j2
index 102dd2f5..01bb72f7 100644
--- a/roles/matrix-dendrite/templates/dendrite/dendrite.yaml.j2
+++ b/roles/matrix-dendrite/templates/dendrite/dendrite.yaml.j2
@@ -28,7 +28,7 @@
 # connection can be idle in seconds - a negative value is unlimited.
 
 # The version of the configuration file.
-version: 1
+version: 2
 
 # Global Matrix configuration. This configuration applies to all components.
 global:
@@ -66,34 +66,40 @@ global:
   # to other servers and the federation API will not be exposed.
   disable_federation: {{ (not matrix_dendrite_federation_enabled)|to_json }}
 
-  # Configuration for Kafka/Naffka.
-  kafka:
-    # List of Kafka broker addresses to connect to. This is not needed if using
-    # Naffka in monolith mode.
-    addresses: []
-
-    # The prefix to use for Kafka topic names for this homeserver. Change this only if
-    # you are running more than one Dendrite homeserver on the same Kafka deployment.
+  # Server notices allows server admins to send messages to all users.
+  server_notices:
+    enabled: false
+    # The server localpart to be used when sending notices, ensure this is not yet taken
+    local_part: "_server"
+    # The displayname to be used when sending notices
+    display_name: "Server alerts"
+    # The mxid of the avatar to use
+    avatar_url: ""
+    # The roomname to be used when creating messages
+    room_name: "Server Alerts"
+
+  # Configuration for NATS JetStream
+  jetstream:
+    # A list of NATS Server addresses to connect to. If none are specified, an
+    # internal NATS server will be started automatically when running Dendrite
+    # in monolith mode. It is required to specify the address of at least one
+    # NATS Server node if running in polylith mode.
+    addresses:
+    #  - jetstream:4222
+
+    # Keep all NATS streams in memory, rather than persisting it to the storage
+    # path below. This option is present primarily for integration testing and
+    # should not be used on a real world Dendrite deployment.
+    in_memory: false
+
+    # Persistent directory to store JetStream streams in. This directory
+    # should be preserved across Dendrite restarts.
+    storage_path: "/matrix-nats-store"
+
+    # The prefix to use for stream names for this homeserver - really only
+    # useful if running more than one Dendrite on the same NATS deployment.
     topic_prefix: Dendrite
 
-    # Whether to use Naffka instead of Kafka. This is only available in monolith
-    # mode, but means that you can run a single-process server without requiring
-    # Kafka.
-    use_naffka: true
-
-    # The max size a Kafka message is allowed to use.
-    # You only need to change this value, if you encounter issues with too large messages.
-    # Must be less than/equal to "max.message.bytes" configured in Kafka.
-    # Defaults to 8388608 bytes.
-    # max_message_bytes: 8388608
-
-    # Naffka database options. Not required when using Kafka.
-    naffka_database:
-      connection_string: {{ matrix_dendrite_database_str }}/{{ matrix_dendrite_naffka_database }}?sslmode=disable
-      max_open_conns: 10
-      max_idle_conns: 2
-      conn_max_lifetime: -1
-
   # Configuration for Prometheus metric collection.
   metrics:
     # Whether or not Prometheus metrics are enabled.
@@ -126,11 +132,6 @@ app_service_api:
     max_idle_conns: 2
     conn_max_lifetime: -1
 
-  # Disable the validation of TLS certificates of appservices. This is
-  # not recommended in production since it may allow appservice traffic
-  # to be sent to an unverified endpoint.
-  disable_tls_validation: false
-
   # Appservice configuration files to load into this homeserver.
   config_files: {{ matrix_dendrite_app_service_config_files|to_json }}
 
@@ -146,6 +147,10 @@ client_api:
   # using the registration shared secret below.
   registration_disabled: {{ matrix_dendrite_registration_disabled|to_json }}
 
+  # Prevents new guest accounts from being created. Guest registration is also
+  # disabled implicitly by setting 'registration_disabled' above.
+  guests_disabled: true
+
   # If set, allows registration by anyone who knows the shared secret, regardless of
   # whether registration is otherwise disabled.
   registration_shared_secret: {{ matrix_dendrite_registration_shared_secret|string|to_json }}
@@ -175,12 +180,6 @@ client_api:
     threshold: {{ matrix_dendrite_rate_limiting_threshold|to_json }}
     cooloff_ms: {{ matrix_dendrite_rate_limiting_cooloff_ms|to_json }}
 
-# Configuration for the EDU server.
-edu_server:
-  internal_api:
-    listen: http://0.0.0.0:7778
-    connect: http://edu_server:7778
-
 # Configuration for the Federation API.
 federation_api:
   internal_api:
@@ -188,20 +187,8 @@ federation_api:
     connect: http://federation_api:7772
   external_api:
     listen: http://0.0.0.0:8072
-
-  # List of paths to X.509 certificates to be used by the external federation listeners.
-  # These certificates will be used to calculate the TLS fingerprints and other servers
-  # will expect the certificate to match these fingerprints. Certificates must be in PEM
-  # format.
-  federation_certificates: []
-
-# Configuration for the Federation Sender.
-federation_sender:
-  internal_api:
-    listen: http://0.0.0.0:7775
-    connect: http://federation_sender:7775
   database:
-    connection_string: {{ matrix_dendrite_database_str }}/{{ matrix_dendrite_federationsender_database }}?sslmode=disable
+    connection_string: {{ matrix_dendrite_database_str }}/{{ matrix_dendrite_federationapi_database }}?sslmode=disable
     max_open_conns: 10
     max_idle_conns: 2
     conn_max_lifetime: -1
@@ -221,6 +208,22 @@ federation_sender:
     host: localhost
     port: 8080
 
+  # Perspective keyservers to use as a backup when direct key fetches fail. This may
+  # be required to satisfy key requests for servers that are no longer online when
+  # joining some rooms.
+  key_perspectives:
+    - server_name: matrix.org
+      keys:
+        - key_id: ed25519:auto
+          public_key: Noi6WqcDj0QmPxCNQqgezwTlBKrfqehY1u2FyWP9uYw
+        - key_id: ed25519:a_RXGa
+          public_key: l8Hft5qXKn1vfHrg3p4+W8gELQVo8N13JkluMfmn2sQ
+
+  # This option will control whether Dendrite will prefer to look up keys directly
+  # or whether it should try perspective servers first, using direct fetches as a
+  # last resort.
+  prefer_direct_fetch: false
+
 # Configuration for the Key Server (for end-to-end encryption).
 key_server:
   internal_api:
@@ -261,15 +264,15 @@ media_api:
 
   # A list of thumbnail sizes to be generated for media content.
   thumbnail_sizes:
-  - width: 32
-    height: 32
-    method: crop
-  - width: 96
-    height: 96
-    method: crop
-  - width: 640
-    height: 480
-    method: scale
+    - width: 32
+      height: 32
+      method: crop
+    - width: 96
+      height: 96
+      method: crop
+    - width: 640
+      height: 480
+      method: scale
 
 # Configuration for experimental MSC's
 mscs:
@@ -295,40 +298,13 @@ room_server:
     max_idle_conns: 2
     conn_max_lifetime: -1
 
-# Configuration for the Signing Key Server (for server signing keys).
-signing_key_server:
-  internal_api:
-    listen: http://0.0.0.0:7780
-    connect: http://signing_key_server:7780
-  database:
-    connection_string: {{ matrix_dendrite_database_str }}/{{ matrix_dendrite_singingkeyserver_database }}?sslmode=disable
-    max_open_conns: 10
-    max_idle_conns: 2
-    conn_max_lifetime: -1
-
-  # Perspective keyservers to use as a backup when direct key fetches fail. This may
-  # be required to satisfy key requests for servers that are no longer online when
-  # joining some rooms.
-  key_perspectives:
-  - server_name: matrix.org
-    keys:
-    - key_id: ed25519:auto
-      public_key: Noi6WqcDj0QmPxCNQqgezwTlBKrfqehY1u2FyWP9uYw
-    - key_id: ed25519:a_RXGa
-      public_key: l8Hft5qXKn1vfHrg3p4+W8gELQVo8N13JkluMfmn2sQ
-
-  # This option will control whether Dendrite will prefer to look up keys directly
-  # or whether it should try perspective servers first, using direct fetches as a
-  # last resort.
-  prefer_direct_fetch: false
-
 # Configuration for the Sync API.
 sync_api:
   internal_api:
     listen: http://0.0.0.0:7773
     connect: http://sync_api:7773
   external_api:
-      listen: http://0.0.0.0:8073
+    listen: http://0.0.0.0:8073
   database:
     connection_string: {{ matrix_dendrite_database_str }}/{{ matrix_dendrite_syncapi_database }}?sslmode=disable
     max_open_conns: 10
@@ -343,31 +319,25 @@ sync_api:
 
 # Configuration for the User API.
 user_api:
-  # The cost when hashing passwords on registration/login. Default: 10. Min: 4, Max: 31
-  # See https://pkg.go.dev/golang.org/x/crypto/bcrypt for more information.
-  # Setting this lower makes registration/login consume less CPU resources at the cost of security
-  # should the database be compromised. Setting this higher makes registration/login consume more
-  # CPU resources but makes it harder to brute force password hashes.
-  # This value can be low if performing tests or on embedded Dendrite instances (e.g WASM builds)
-  # bcrypt_cost: 10
   internal_api:
     listen: http://0.0.0.0:7781
     connect: http://user_api:7781
   account_database:
-    connection_string: {{ matrix_dendrite_database_str }}/{{ matrix_dendrite_account_database }}?sslmode=disable
+    connection_string: {{ matrix_dendrite_database_str }}/{{ matrix_dendrite_userapi_database }}?sslmode=disable
     max_open_conns: 10
     max_idle_conns: 2
     conn_max_lifetime: -1
-  device_database:
-    connection_string: {{ matrix_dendrite_database_str }}/{{ matrix_dendrite_device_database }}?sslmode=disable
+
+# Configuration for the Push Server API.
+push_server:
+  internal_api:
+    listen: http://localhost:7782
+    connect: http://localhost:7782
+  database:
+    connection_string: {{ matrix_dendrite_database_str }}/{{ matrix_dendrite_pushserver_database }}?sslmode=disable
     max_open_conns: 10
     max_idle_conns: 2
     conn_max_lifetime: -1
-  # The length of time that a token issued for a relying party from
-  # /_matrix/client/r0/user/{userId}/openid/request_token endpoint
-  # is considered to be valid in milliseconds.
-  # The default lifetime is 3600000ms (60 minutes).
-  # openid_token_lifetime_ms: 3600000
 
 # Configuration for Opentracing.
 # See https://github.com/matrix-org/dendrite/tree/master/docs/tracing for information on
diff --git a/roles/matrix-dendrite/templates/dendrite/systemd/matrix-dendrite.service.j2 b/roles/matrix-dendrite/templates/dendrite/systemd/matrix-dendrite.service.j2
index e14734dd..e1c42cbc 100644
--- a/roles/matrix-dendrite/templates/dendrite/systemd/matrix-dendrite.service.j2
+++ b/roles/matrix-dendrite/templates/dendrite/systemd/matrix-dendrite.service.j2
@@ -37,6 +37,7 @@ ExecStart={{ matrix_host_command_docker }} run --rm --name matrix-dendrite \
 			{% endif %}
 			--mount type=bind,src={{ matrix_dendrite_config_dir_path }},dst=/data,ro \
 			--mount type=bind,src={{ matrix_dendrite_storage_path }},dst=/matrix-media-store-parent,bind-propagation=slave \
+			--mount type=bind,src={{ matrix_dendrite_nats_storage_path }},dst=/matrix-nats-store,bind-propagation=slave \
 			{% for volume in matrix_dendrite_container_additional_volumes %}
 			-v {{ volume.src }}:{{ volume.dst }}:{{ volume.options }} \
 			{% endfor %}