From f364fba1828310383178ad0afac64e085b0b568a Mon Sep 17 00:00:00 2001 From: Krisztian Szegi Date: Tue, 14 Sep 2021 08:35:20 +0200 Subject: [PATCH 01/86] Fix tripping on timesync setup --- roles/matrix-base/defaults/main.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/roles/matrix-base/defaults/main.yml b/roles/matrix-base/defaults/main.yml index 31bff105..172564da 100644 --- a/roles/matrix-base/defaults/main.yml +++ b/roles/matrix-base/defaults/main.yml @@ -83,8 +83,8 @@ matrix_host_command_openssl: "/usr/bin/env openssl" matrix_host_command_systemctl: "/usr/bin/env systemctl" matrix_host_command_sh: "/usr/bin/env sh" -matrix_ntpd_package: "{{ 'systemd-timesyncd' if ansible_distribution == 'CentOS' and ansible_distribution_major_version > '7' else 'ntp' }}" -matrix_ntpd_service: "{{ 'systemd-timesyncd' if ansible_distribution == 'CentOS' and ansible_distribution_major_version > '7' else ('ntpd' if ansible_os_family == 'RedHat' or ansible_distribution == 'Archlinux' else 'ntp') }}" +matrix_ntpd_package: "{{ 'systemd-timesyncd' if ansible_distribution == 'CentOS' and ansible_distribution_major_version > '7' else ( 'systemd' if ansible_os_family == 'Suse' else 'ntp' ) }}" +matrix_ntpd_service: "{{ 'systemd-timesyncd' if ( (ansible_distribution == 'CentOS' and ansible_distribution_major_version > '7') or ansible_os_family == 'Suse') else ('ntpd' if ansible_os_family == 'RedHat' or ansible_distribution == 'Archlinux' else 'ntp') }}" matrix_homeserver_url: "https://{{ matrix_server_fqn_matrix }}" From d9fa2f7ed45114fdfaaa5c3e205a091a0d8e8191 Mon Sep 17 00:00:00 2001 From: HarHarLinks Date: Mon, 4 Oct 2021 19:53:38 +0200 Subject: [PATCH 02/86] add auto proxy synapse worker metrics when matrix_nginx_proxy_proxy_synapse_metrics is enabled --- roles/matrix-nginx-proxy/defaults/main.yml | 2 +- .../nginx/conf.d/matrix-synapse.conf.j2 | 18 ++++++++++++++++++ 2 files changed, 19 insertions(+), 1 deletion(-) diff --git a/roles/matrix-nginx-proxy/defaults/main.yml b/roles/matrix-nginx-proxy/defaults/main.yml index 79211a23..07e84ace 100644 --- a/roles/matrix-nginx-proxy/defaults/main.yml +++ b/roles/matrix-nginx-proxy/defaults/main.yml @@ -222,7 +222,7 @@ matrix_nginx_proxy_proxy_matrix_client_api_forwarded_location_prefix_regexes: | + (['/_synapse/admin'] if matrix_nginx_proxy_proxy_matrix_client_api_forwarded_location_synapse_admin_api_enabled else []) + - (['/_synapse/metrics'] if matrix_nginx_proxy_proxy_synapse_metrics else []) + (['/_synapse.*/metrics'] if matrix_nginx_proxy_proxy_synapse_metrics else []) }} # Specifies where requests for the root URI (`/`) on the `matrix.` domain should be redirected. diff --git a/roles/matrix-nginx-proxy/templates/nginx/conf.d/matrix-synapse.conf.j2 b/roles/matrix-nginx-proxy/templates/nginx/conf.d/matrix-synapse.conf.j2 index db111090..343f04e5 100644 --- a/roles/matrix-nginx-proxy/templates/nginx/conf.d/matrix-synapse.conf.j2 +++ b/roles/matrix-nginx-proxy/templates/nginx/conf.d/matrix-synapse.conf.j2 @@ -153,6 +153,24 @@ server { } {% endif %} + {% if matrix_nginx_proxy_enabled and matrix_nginx_proxy_proxy_synapse_metrics %} + {% for worker in matrix_prometheus_scraper_synapse_workers_enabled_list %} + {% if worker.metrics_port != 0 %} + location /_synapse-worker-{{ worker.type }}-{{ worker.instanceId }}/metrics { + resolver 127.0.0.11 valid=5s; + set $backend "matrix-synapse-worker-{{ worker.type }}-{{ worker.instanceId }}:{{ worker.metrics_port }}"; + proxy_pass http://$backend/_synapse/metrics; + proxy_set_header Host $host; + + {% if matrix_nginx_proxy_proxy_synapse_metrics_basic_auth_enabled %} + auth_basic "protected"; + auth_basic_user_file /nginx-data/matrix-synapse-metrics-htpasswd; + {% endif %} + } + {% endif %} + {% endfor %} + {% endif %} + {# Everything else just goes to the API server ##} location / { {% if matrix_nginx_proxy_enabled %} From 8c15555d007b6fa2bcfbf6feeda44ca30994c08b Mon Sep 17 00:00:00 2001 From: Slavi Pantaleev Date: Fri, 15 Oct 2021 09:27:26 +0300 Subject: [PATCH 03/86] Upgrade Element (1.9.0 -> 1.9.2) --- roles/matrix-client-element/defaults/main.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/roles/matrix-client-element/defaults/main.yml b/roles/matrix-client-element/defaults/main.yml index e2540315..614cdf24 100644 --- a/roles/matrix-client-element/defaults/main.yml +++ b/roles/matrix-client-element/defaults/main.yml @@ -3,7 +3,7 @@ matrix_client_element_enabled: true matrix_client_element_container_image_self_build: false matrix_client_element_container_image_self_build_repo: "https://github.com/vector-im/riot-web.git" -matrix_client_element_version: v1.9.0 +matrix_client_element_version: v1.9.2 matrix_client_element_docker_image: "{{ matrix_client_element_docker_image_name_prefix }}vectorim/element-web:{{ matrix_client_element_version }}" matrix_client_element_docker_image_name_prefix: "{{ 'localhost/' if matrix_client_element_container_image_self_build else matrix_container_global_registry_prefix }}" matrix_client_element_docker_image_force_pull: "{{ matrix_client_element_docker_image.endswith(':latest') }}" From 18395e73d3962d5108cfe24b801e3fcb358eec6a Mon Sep 17 00:00:00 2001 From: PC-Admin Date: Tue, 19 Oct 2021 17:45:15 +0800 Subject: [PATCH 04/86] GMH v0.6.3 --- .../surveys/bridge_discord_appservice.json.j2 | 66 +++++++++++++++++++ .../surveys/configure_corporal.json.j2 | 6 +- .../tasks/bridge_discord_appservice.yml | 62 +++++++++++++++++ roles/matrix-awx/tasks/main.yml | 9 +++ .../matrix-awx/tasks/purge_database_main.yml | 6 +- .../tasks/set_variables_corporal.yml | 8 ++- .../tasks/set_variables_synapse.yml | 4 +- roles/matrix-common-after/tasks/awx_post.yml | 5 ++ 8 files changed, 155 insertions(+), 11 deletions(-) create mode 100644 roles/matrix-awx/surveys/bridge_discord_appservice.json.j2 create mode 100644 roles/matrix-awx/tasks/bridge_discord_appservice.yml diff --git a/roles/matrix-awx/surveys/bridge_discord_appservice.json.j2 b/roles/matrix-awx/surveys/bridge_discord_appservice.json.j2 new file mode 100644 index 00000000..7252cc2c --- /dev/null +++ b/roles/matrix-awx/surveys/bridge_discord_appservice.json.j2 @@ -0,0 +1,66 @@ +{ + "name": "Bridge Discord Appservice", + "description": "Enables a private bridge you can use to connect Matrix rooms to Discord.", + "spec": [ + { + "question_name": "Enable Discord AppService Bridge", + "question_description": "Enables a private bridge you can use to connect Matrix rooms to Discord.", + "required": true, + "min": null, + "max": null, + "default": "{{ matrix_appservice_discord_enabled | string | lower }}", + "choices": "true\nfalse", + "new_question": true, + "variable": "matrix_appservice_discord_enabled", + "type": "multiplechoice" + }, + { + "question_name": "Discord Client ID", + "question_description": "The OAuth2 'CLIENT ID' which can be found in the 'OAuth2' tab of your new discord application: https://discord.com/developers/applications", + "required": true, + "min": 0, + "max": 128, + "default": "{{ matrix_appservice_discord_client_id | trim }}", + "choices": "", + "new_question": true, + "variable": "matrix_appservice_discord_client_id", + "type": "text" + }, + { + "question_name": "Discord Bot Token", + "question_description": "The Bot 'TOKEN' which can be found in the 'Bot' tab of your new discord application: https://discord.com/developers/applications", + "required": true, + "min": 0, + "max": 256, + "default": "{{ matrix_appservice_discord_bot_token | trim }}", + "choices": "", + "new_question": true, + "variable": "matrix_appservice_discord_bot_token", + "type": "password" + }, + { + "question_name": "Auto-Admin Matrix User", + "question_description": "The username you would like to be automatically joined and promoted to administrator (PL100) in bridged rooms. Exclude the '@' and server name postfix. So to create @stevo:example.org just enter 'stevo'.", + "required": false, + "min": 0, + "max": 1024, + "default": "", + "choices": "", + "new_question": true, + "variable": "awx_appservice_discord_admin_user", + "type": "text" + }, + { + "question_name": "Auto-Admin Rooms", + "question_description": "A list of rooms you want the user to be automatically joined and promoted to administrator (PL100) in. These should be the internal IDs (for example '!axfBUsKhfAjSMBdjKX:example.org') separated by newlines.", + "required": false, + "min": 0, + "max": 4096, + "default": "", + "choices": "", + "new_question": true, + "variable": "awx_appservice_discord_admin_rooms", + "type": "textarea" + } + ] +} diff --git a/roles/matrix-awx/surveys/configure_corporal.json.j2 b/roles/matrix-awx/surveys/configure_corporal.json.j2 index 7b782fd0..dc8cd4fd 100755 --- a/roles/matrix-awx/surveys/configure_corporal.json.j2 +++ b/roles/matrix-awx/surveys/configure_corporal.json.j2 @@ -66,10 +66,10 @@ "required": false, "min": 0, "max": 256, - "default": "{{ awx_corporal_http_api_auth_token }}", + "default": "{{ matrix_corporal_http_api_auth_token }}", "choices": "", "new_question": true, - "variable": "awx_corporal_http_api_auth_token", + "variable": "matrix_corporal_http_api_auth_token", "type": "password" }, { @@ -81,7 +81,7 @@ "default": "{{ awx_corporal_raise_ratelimits }}", "choices": "Normal\nRaised", "new_question": true, - "variable": "matrix_corporal_raise_ratelimits", + "variable": "awx_corporal_raise_ratelimits", "type": "multiplechoice" } ] diff --git a/roles/matrix-awx/tasks/bridge_discord_appservice.yml b/roles/matrix-awx/tasks/bridge_discord_appservice.yml new file mode 100644 index 00000000..ed1daa96 --- /dev/null +++ b/roles/matrix-awx/tasks/bridge_discord_appservice.yml @@ -0,0 +1,62 @@ + +- name: Record Bridge Discord AppService variables locally on AWX + delegate_to: 127.0.0.1 + lineinfile: + path: '{{ awx_cached_matrix_vars }}' + regexp: "^#? *{{ item.key | regex_escape() }}:" + line: "{{ item.key }}: {{ item.value }}" + insertafter: '# Bridge Discord AppService Start' + with_dict: + 'matrix_appservice_discord_enabled': '{{ matrix_appservice_discord_enabled }}' + 'matrix_appservice_discord_client_id': '{{ matrix_appservice_discord_client_id }}' + 'matrix_appservice_discord_bot_token': '{{ matrix_appservice_discord_bot_token }}' + +- name: Collect discord bot invite link + shell: + cat /matrix/appservice-discord/config/invite_link + register: awx_discord_appservice_link + +- name: If the raw inputs is not empty start constructing parsed awx_appservice_discord_admin_rooms list + set_fact: + awx_appservice_discord_admin_rooms_array: |- + {{ awx_appservice_discord_admin_rooms.splitlines() | to_json }} + when: awx_appservice_discord_admin_rooms | trim | length > 0 + +- name: Promote user to administer (PL100) of each room + command: | + docker exec -i matrix-appservice-discord /bin/sh -c 'cp /cfg/registration.yaml /tmp/discord-registration.yaml && cd /tmp && node /build/tools/adminme.js -c /cfg/config.yaml -m "{{ item.1 }}" -u "@{{ awx_appservice_discord_admin_user }}:{{ matrix_domain }}" -p 100' + with_indexed_items: + - "{{ awx_appservice_discord_admin_rooms_array }}" + when: ( awx_appservice_discord_admin_rooms | trim | length > 0 ) and ( awx_appservice_discord_admin_user is defined ) + +- name: Save new 'Bridge Discord Appservice' survey.json to the AWX tower, template + delegate_to: 127.0.0.1 + template: + src: 'roles/matrix-awx/surveys/bridge_discord_appservice.json.j2' + dest: '/var/lib/awx/projects/clients/{{ member_id }}/{{ subscription_id }}//bridge_discord_appservice.json' + +- name: Copy new 'Bridge Discord Appservice' survey.json to target machine + copy: + src: '/var/lib/awx/projects/clients/{{ member_id }}/{{ subscription_id }}/bridge_discord_appservice.json' + dest: '/matrix/awx/bridge_discord_appservice.json' + mode: '0660' + +- name: Recreate 'Bridge Discord Appservice' job template + delegate_to: 127.0.0.1 + awx.awx.tower_job_template: + name: "{{ matrix_domain }} - 3 - Bridge Discord AppService" + description: "Enables a private bridge you can use to connect Matrix rooms to Discord." + extra_vars: "{{ lookup('file', '/var/lib/awx/projects/clients/{{ member_id }}/{{ subscription_id }}/extra_vars.json') }}" + job_type: run + job_tags: "start,setup-all,bridge-discord-appservice" + inventory: "{{ member_id }}" + project: "{{ member_id }} - Matrix Docker Ansible Deploy" + playbook: setup.yml + credential: "{{ member_id }} - AWX SSH Key" + survey_enabled: true + survey_spec: "{{ lookup('file', '/var/lib/awx/projects/clients/{{ member_id }}/{{ subscription_id }}/bridge_discord_appservice.json') }}" + state: present + verbosity: 1 + tower_host: "https://{{ awx_host }}" + tower_oauthtoken: "{{ awx_session_token.ansible_facts.tower_token.token }}" + validate_certs: yes diff --git a/roles/matrix-awx/tasks/main.yml b/roles/matrix-awx/tasks/main.yml index ceb697ec..adc158c7 100755 --- a/roles/matrix-awx/tasks/main.yml +++ b/roles/matrix-awx/tasks/main.yml @@ -197,6 +197,15 @@ tags: - setup-synapse-admin +# Additional playbook to set the variable file during Discord Appservice Bridge configuration +- include_tasks: + file: "bridge_discord_appservice.yml" + apply: + tags: bridge-discord-appservice + when: run_setup|bool and matrix_awx_enabled|bool + tags: + - bridge-discord-appservice + # Delete AWX session token - include_tasks: file: "delete_session_token.yml" diff --git a/roles/matrix-awx/tasks/purge_database_main.yml b/roles/matrix-awx/tasks/purge_database_main.yml index c64a54dd..6b132091 100644 --- a/roles/matrix-awx/tasks/purge_database_main.yml +++ b/roles/matrix-awx/tasks/purge_database_main.yml @@ -84,7 +84,7 @@ when: (awx_purge_mode.find("No local users [recommended]") != -1) or (awx_purge_mode.find("Number of users [slower]") != -1) or (awx_purge_mode.find("Number of events [slower]") != -1) - name: Purge all rooms with no local users - include_tasks: awx_purge_database_no_local.yml + include_tasks: purge_database_no_local.yml loop: "{{ awx_room_list_no_local_users.splitlines() | flatten(levels=1) }}" when: (awx_purge_mode.find("No local users [recommended]") != -1) or (awx_purge_mode.find("Number of users [slower]") != -1) or (awx_purge_mode.find("Number of events [slower]") != -1) @@ -116,7 +116,7 @@ no_log: True - name: Purge all rooms with more then N users - include_tasks: awx_purge_database_users.yml + include_tasks: purge_database_users.yml loop: "{{ awx_room_list_joined_members.splitlines() | flatten(levels=1) }}" when: awx_purge_mode.find("Number of users [slower]") != -1 @@ -141,7 +141,7 @@ no_log: True - name: Purge all rooms with more then N events - include_tasks: awx_purge_database_events.yml + include_tasks: purge_database_events.yml loop: "{{ awx_room_list_state_events.splitlines() | flatten(levels=1) }}" when: awx_purge_mode.find("Number of events [slower]") != -1 diff --git a/roles/matrix-awx/tasks/set_variables_corporal.yml b/roles/matrix-awx/tasks/set_variables_corporal.yml index 3558f717..e911144d 100755 --- a/roles/matrix-awx/tasks/set_variables_corporal.yml +++ b/roles/matrix-awx/tasks/set_variables_corporal.yml @@ -84,14 +84,16 @@ line: "{{ item.key }}: {{ item.value }}" insertafter: '# Corporal Settings Start' with_dict: - 'awx_corporal_http_api_auth_token': '{{ awx_corporal_http_api_auth_token }}' - when: awx_corporal_http_api_auth_token|length > 0 + 'matrix_corporal_http_api_auth_token': '{{ matrix_corporal_http_api_auth_token }}' + when: ( matrix_corporal_http_api_auth_token|length > 0 ) and ( awx_corporal_policy_provider_mode != "Simple Static File" ) - name: Record 'Simple Static File' configuration variables in matrix_vars.yml delegate_to: 127.0.0.1 blockinfile: path: '{{ awx_cached_matrix_vars }}' - insertafter: "# Corporal Policy Provider Settings Start" + insertbefore: "# Corporal Policy Provider Settings End" + marker_begin: "Corporal" + marker_end: "Corporal" block: | matrix_corporal_policy_provider_config: | { diff --git a/roles/matrix-awx/tasks/set_variables_synapse.yml b/roles/matrix-awx/tasks/set_variables_synapse.yml index df6b2798..f0fe2369 100755 --- a/roles/matrix-awx/tasks/set_variables_synapse.yml +++ b/roles/matrix-awx/tasks/set_variables_synapse.yml @@ -38,7 +38,7 @@ set_fact: awx_synapse_auto_join_rooms_array: |- {{ awx_synapse_auto_join_rooms.splitlines() | to_json }} - when: awx_synapse_auto_join_rooms|length > 0 + when: awx_synapse_auto_join_rooms | length > 0 - name: Record Synapse variable 'matrix_synapse_auto_join_rooms' locally on AWX, if it's not blank delegate_to: 127.0.0.1 @@ -49,7 +49,7 @@ insertafter: '# Synapse Settings Start' with_dict: "matrix_synapse_auto_join_rooms": "{{ awx_synapse_auto_join_rooms_array }}" - when: awx_synapse_auto_join_rooms|length > 0 + when: awx_synapse_auto_join_rooms | length > 0 - name: Record Synapse Shared Secret if it's defined delegate_to: 127.0.0.1 diff --git a/roles/matrix-common-after/tasks/awx_post.yml b/roles/matrix-common-after/tasks/awx_post.yml index 8175267d..8dae00b4 100644 --- a/roles/matrix-common-after/tasks/awx_post.yml +++ b/roles/matrix-common-after/tasks/awx_post.yml @@ -62,3 +62,8 @@ group: matrix mode: '0770' when: awx_customise_base_domain_website is defined + +- name: Print Discord AppService Bot Link for user + debug: + msg: "{{ awx_discord_appservice_link.stdout }}" + when: awx_discord_appservice_link is defined From 1dab178a446570863e2d33b5739c5de7d5de2d58 Mon Sep 17 00:00:00 2001 From: Slavi Pantaleev Date: Tue, 19 Oct 2021 16:25:00 +0300 Subject: [PATCH 05/86] Upgrade Synapse (1.44.0 -> 1.45.0) --- roles/matrix-synapse/defaults/main.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/roles/matrix-synapse/defaults/main.yml b/roles/matrix-synapse/defaults/main.yml index 460483e0..6c52452d 100644 --- a/roles/matrix-synapse/defaults/main.yml +++ b/roles/matrix-synapse/defaults/main.yml @@ -15,8 +15,8 @@ matrix_synapse_docker_image_name_prefix: "{{ 'localhost/' if matrix_synapse_cont # amd64 gets released first. # arm32 relies on self-building, so the same version can be built immediately. # arm64 users need to wait for a prebuilt image to become available. -matrix_synapse_version: v1.44.0 -matrix_synapse_version_arm64: v1.44.0 +matrix_synapse_version: v1.45.0 +matrix_synapse_version_arm64: v1.45.0 matrix_synapse_docker_image_tag: "{{ matrix_synapse_version if matrix_architecture in ['arm32', 'amd64'] else matrix_synapse_version_arm64 }}" matrix_synapse_docker_image_force_pull: "{{ matrix_synapse_docker_image.endswith(':latest') }}" From a8556fb8beedfd3869e3b26ea02abed3c9b37ae2 Mon Sep 17 00:00:00 2001 From: Aaron R Date: Tue, 19 Oct 2021 22:57:01 -0500 Subject: [PATCH 06/86] Update installing.md to be a bit more clear This change should make it more obvious which order the steps must be done --- docs/installing.md | 30 ++++++++++++++++-------------- 1 file changed, 16 insertions(+), 14 deletions(-) diff --git a/docs/installing.md b/docs/installing.md index 0e9dadd1..8b1b51aa 100644 --- a/docs/installing.md +++ b/docs/installing.md @@ -1,25 +1,25 @@ # Installing +## 1. Installing the Matrix services + If you've [configured your DNS](configuring-dns.md) and have [configured the playbook](configuring-playbook.md), you can start the installation procedure. -Run this as-is to set up a server: +Run this command to install the Matrix services: ```bash ansible-playbook -i inventory/hosts setup.yml --tags=setup-all ``` -**Note**: if you don't use SSH keys for authentication, but rather a regular password, you may need to add `--ask-pass` to the above (and all other) Ansible commands. - -**Note**: if you **do** use SSH keys for authentication, **and** use a non-root user to *become* root (sudo), you may need to add `-K` (`--ask-become-pass`) to the above (and all other) Ansible commands. +The above command **doesn't start any services just yet** (another step does this later - below). Feel free to **re-run this setup command any time** you think something is off with the server configuration. -The above command **doesn't start any services just yet** (another step does this later - below). +**Notes**: +- if you **don't** use SSH keys for authentication, but rather a regular password, you may need to add `--ask-pass` to the above (and all other) Ansible commands. +- if you **do** use SSH keys for authentication, **and** use a non-root user to *become* root (sudo), you may need to add `-K` (`--ask-become-pass`) to the above (and all other) Ansible commands. -Feel free to **re-run this setup command any time** you think something is off with the server configuration. +## 2. Things you might want to do after installing -## Things you might want to do after installing - -After installing, but before starting the services, you may want to do additional things like: +**Before starting the services**, you may want to do additional things like: - [Importing an existing SQLite database (from another Synapse installation)](importing-synapse-sqlite.md) (optional) @@ -28,20 +28,22 @@ After installing, but before starting the services, you may want to do additiona - [Importing `media_store` data files from an existing Synapse installation](importing-synapse-media-store.md) (optional) -## Starting the services +## 3. Starting the services -When you're ready to start the Matrix services (and set them up to auto-start in the future): +When you're ready to start the Matrix services (and set them up to auto-start in the future), run this command: ```bash ansible-playbook -i inventory/hosts setup.yml --tags=start ``` -Now that services are running, you need to **finalize the installation process** (required for federation to work!) by [Configuring Service Discovery via .well-known](configuring-well-known.md) +## 4. Finalize the installation + +Now that services are running, you need to **finalize the installation process** (required for federation to work!) by [Configuring Service Discovery via .well-known](configuring-well-known.md). -## Things to do next +## 5. Things to do next -If you have started services and **finalized the installation process** (required for federation to work!) by [Configuring Service Discovery via .well-known](configuring-well-known.md), you can: +After you have started the services and **finalized the installation process** (required for federation to work!) by [Configuring Service Discovery via .well-known](configuring-well-known.md), you can: - [check if services work](maintenance-checking-services.md) - or [create your first Matrix user account](registering-users.md) From db81fa34151b7aa9179e0ae8f3f4f131d1b8ac67 Mon Sep 17 00:00:00 2001 From: Aaron R Date: Wed, 20 Oct 2021 01:33:03 -0500 Subject: [PATCH 07/86] Fix link to nginx files in configuring-playbook-own-webserver.md --- docs/configuring-playbook-own-webserver.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/configuring-playbook-own-webserver.md b/docs/configuring-playbook-own-webserver.md index 9a27e0b7..6a33ffbe 100644 --- a/docs/configuring-playbook-own-webserver.md +++ b/docs/configuring-playbook-own-webserver.md @@ -71,7 +71,7 @@ After following the [Preparation](#preparation) guide above, you can take a loo ### Using another external webserver -Feel free to look at the [examples/apache](../examples/apache) directory, or the [template files in the matrix-nginx-proxy role](../roles/matrix-nginx-proxy/templates/conf.d/). +Feel free to look at the [examples/apache](../examples/apache) directory, or the [template files in the matrix-nginx-proxy role](../roles/matrix-nginx-proxy/templates/nginx/conf.d/). ## Method 2: Fronting the integrated nginx reverse-proxy webserver with another reverse-proxy From 75cfad57ca5d4477bf2e3b6cce9baa3ac1c050db Mon Sep 17 00:00:00 2001 From: PC-Admin Date: Wed, 20 Oct 2021 18:00:55 +0800 Subject: [PATCH 08/86] GoMatrixHosting v0.6.3 hotfix --- .../matrix-awx/tasks/bridge_discord_appservice.yml | 5 ----- roles/matrix-common-after/tasks/awx_post.yml | 14 +++++++++++++- 2 files changed, 13 insertions(+), 6 deletions(-) diff --git a/roles/matrix-awx/tasks/bridge_discord_appservice.yml b/roles/matrix-awx/tasks/bridge_discord_appservice.yml index ed1daa96..7cb24028 100644 --- a/roles/matrix-awx/tasks/bridge_discord_appservice.yml +++ b/roles/matrix-awx/tasks/bridge_discord_appservice.yml @@ -11,11 +11,6 @@ 'matrix_appservice_discord_client_id': '{{ matrix_appservice_discord_client_id }}' 'matrix_appservice_discord_bot_token': '{{ matrix_appservice_discord_bot_token }}' -- name: Collect discord bot invite link - shell: - cat /matrix/appservice-discord/config/invite_link - register: awx_discord_appservice_link - - name: If the raw inputs is not empty start constructing parsed awx_appservice_discord_admin_rooms list set_fact: awx_appservice_discord_admin_rooms_array: |- diff --git a/roles/matrix-common-after/tasks/awx_post.yml b/roles/matrix-common-after/tasks/awx_post.yml index 8dae00b4..e98afb60 100644 --- a/roles/matrix-common-after/tasks/awx_post.yml +++ b/roles/matrix-common-after/tasks/awx_post.yml @@ -63,7 +63,19 @@ mode: '0770' when: awx_customise_base_domain_website is defined -- name: Print Discord AppService Bot Link for user +- name: Check if Discord AppService invite file exists + stat: + path: /matrix/appservice-discord/config/invite_link + register: awx_discord_appservice_link_file + when: ( awx_appservice_discord_admin_user is defined ) + +- name: Collect Discord AppService bot invite link if file exists + command: + cat /matrix/appservice-discord/config/invite_link + register: awx_discord_appservice_link + when: ( awx_discord_appservice_link_file.stat.exists == true ) and ( awx_appservice_discord_admin_user is defined ) + +- name: Print Discord AppService bot link for user debug: msg: "{{ awx_discord_appservice_link.stdout }}" when: awx_discord_appservice_link is defined From 4209c4208c1d6ae5f1fa4a6c064d991e060972d5 Mon Sep 17 00:00:00 2001 From: HarHarLinks Date: Tue, 19 Oct 2021 23:14:14 +0200 Subject: [PATCH 09/86] add own variable for worker metrics https://github.com/spantaleev/matrix-docker-ansible-deploy/pull/1311#issuecomment-945718866 --- group_vars/matrix_servers | 2 ++ roles/matrix-nginx-proxy/defaults/main.yml | 1 + .../templates/nginx/conf.d/matrix-synapse.conf.j2 | 2 +- 3 files changed, 4 insertions(+), 1 deletion(-) diff --git a/group_vars/matrix_servers b/group_vars/matrix_servers index acdb7b75..23833875 100755 --- a/group_vars/matrix_servers +++ b/group_vars/matrix_servers @@ -1296,6 +1296,8 @@ matrix_nginx_proxy_synapse_media_repository_locations: "{{matrix_synapse_workers matrix_nginx_proxy_synapse_user_dir_locations: "{{ matrix_synapse_workers_user_dir_endpoints|default([]) }}" matrix_nginx_proxy_synapse_frontend_proxy_locations: "{{ matrix_synapse_workers_frontend_proxy_endpoints|default([]) }}" +matrix_nginx_proxy_proxy_synapse_workers_enabled_list: "{{ matrix_synapse_workers_enabled_list }}" + matrix_nginx_proxy_systemd_wanted_services_list: | {{ (['matrix-synapse.service'] if matrix_synapse_enabled else []) diff --git a/roles/matrix-nginx-proxy/defaults/main.yml b/roles/matrix-nginx-proxy/defaults/main.yml index 07e84ace..8e633875 100644 --- a/roles/matrix-nginx-proxy/defaults/main.yml +++ b/roles/matrix-nginx-proxy/defaults/main.yml @@ -182,6 +182,7 @@ matrix_nginx_proxy_proxy_matrix_identity_api_addr_sans_container: "127.0.0.1:809 # Controls whether proxying for metrics (`/_synapse/metrics`) should be done (on the matrix domain) matrix_nginx_proxy_proxy_synapse_metrics: false +matrix_nginx_proxy_synapse_workers_enabled_list: [] matrix_nginx_proxy_proxy_synapse_metrics_basic_auth_enabled: false matrix_nginx_proxy_proxy_synapse_metrics_basic_auth_key: "" diff --git a/roles/matrix-nginx-proxy/templates/nginx/conf.d/matrix-synapse.conf.j2 b/roles/matrix-nginx-proxy/templates/nginx/conf.d/matrix-synapse.conf.j2 index 343f04e5..6933e967 100644 --- a/roles/matrix-nginx-proxy/templates/nginx/conf.d/matrix-synapse.conf.j2 +++ b/roles/matrix-nginx-proxy/templates/nginx/conf.d/matrix-synapse.conf.j2 @@ -154,7 +154,7 @@ server { {% endif %} {% if matrix_nginx_proxy_enabled and matrix_nginx_proxy_proxy_synapse_metrics %} - {% for worker in matrix_prometheus_scraper_synapse_workers_enabled_list %} + {% for worker in matrix_nginx_proxy_proxy_synapse_workers_enabled_list %} {% if worker.metrics_port != 0 %} location /_synapse-worker-{{ worker.type }}-{{ worker.instanceId }}/metrics { resolver 127.0.0.11 valid=5s; From dd4dc22619ea15319e0335d704b05251d5b77a70 Mon Sep 17 00:00:00 2001 From: HarHarLinks Date: Tue, 19 Oct 2021 23:32:28 +0200 Subject: [PATCH 10/86] add worker metrics documentation --- docs/configuring-playbook-prometheus-grafana.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/docs/configuring-playbook-prometheus-grafana.md b/docs/configuring-playbook-prometheus-grafana.md index b7f3caae..529104d2 100644 --- a/docs/configuring-playbook-prometheus-grafana.md +++ b/docs/configuring-playbook-prometheus-grafana.md @@ -58,6 +58,10 @@ Name | Description `matrix_nginx_proxy_proxy_synapse_metrics_basic_auth_key`|Set this to a password to use for HTTP Basic Auth for protecting `https://matrix.DOMAIN/_synapse/metrics` (the username is always `prometheus` - it's not configurable) `matrix_server_fqn_grafana`|Use this variable to override the domain at which the Grafana web user-interface is at (defaults to `stats.DOMAIN`) +### Collecting worker metrics to an external Prometheus server + +If you are using workers (`matrix_synapse_workers_enabled`) and have enabled `matrix_nginx_proxy_proxy_synapse_metrics` as described above, the playbook will also automatically proxy the all worker threads's metrics to `https://matrix.DOMAIN/_synapse-worker-TYPE-ID/metrics`, where `TYPE` corresponds to the type and `ID` to the instanceId of a worker as exemplified in `matrix_synapse_workers_enabled_list`. + ### Collecting system and Postgres metrics to an external Prometheus server (advanced) When you normally enable the Prometheus and Grafana via the playbook, it will also show general system (via node-exporter) and Postgres (via postgres-exporter) stats. If you are instead collecting your metrics to an external Prometheus server, you can follow this advanced configuration example to also export these stats. From ce41674e611917dcd608fb67d5ec9379b0926cf1 Mon Sep 17 00:00:00 2001 From: HarHarLinks Date: Wed, 20 Oct 2021 12:31:49 +0200 Subject: [PATCH 11/86] auto-generate prometheus.yml for workers metrics --- ...configuring-playbook-prometheus-grafana.md | 28 +++++++++++++ .../tasks/setup_nginx_proxy.yml | 15 +++++++ .../external_prometheus.yml.example.j2 | 40 +++++++++++++++++++ 3 files changed, 83 insertions(+) create mode 100644 roles/matrix-nginx-proxy/templates/prometheus/external_prometheus.yml.example.j2 diff --git a/docs/configuring-playbook-prometheus-grafana.md b/docs/configuring-playbook-prometheus-grafana.md index 529104d2..4edc2a81 100644 --- a/docs/configuring-playbook-prometheus-grafana.md +++ b/docs/configuring-playbook-prometheus-grafana.md @@ -62,6 +62,34 @@ Name | Description If you are using workers (`matrix_synapse_workers_enabled`) and have enabled `matrix_nginx_proxy_proxy_synapse_metrics` as described above, the playbook will also automatically proxy the all worker threads's metrics to `https://matrix.DOMAIN/_synapse-worker-TYPE-ID/metrics`, where `TYPE` corresponds to the type and `ID` to the instanceId of a worker as exemplified in `matrix_synapse_workers_enabled_list`. +The playbook also generates an exemplary prometheus.yml config file (`matrix_base_data_path/external_prometheus.yml.template`) with all the correct paths which you can copy to your Prometheus server and adapt to your needs, especially edit the specified `password_file` path and contents and path to your `synapse-v2.rules`. +It will look a bit like this: +```yaml +scrape_configs: + - job_name: 'synapse' + metrics_path: /_synapse/metrics + scheme: https + basic_auth: + username: prometheus + password_file: /etc/prometheus/password.pwd + static_configs: + - targets: ['matrix.DOMAIN:443'] + labels: + job: "master" + index: 1 + - job_name: 'synapse-generic_worker-1' + metrics_path: /_synapse-worker-generic_worker-18111/metrics + scheme: https + basic_auth: + username: prometheus + password_file: /etc/prometheus/password.pwd + static_configs: + - targets: ['matrix.DOMAIN:443'] + labels: + job: "generic_worker" + index: 18111 +``` + ### Collecting system and Postgres metrics to an external Prometheus server (advanced) When you normally enable the Prometheus and Grafana via the playbook, it will also show general system (via node-exporter) and Postgres (via postgres-exporter) stats. If you are instead collecting your metrics to an external Prometheus server, you can follow this advanced configuration example to also export these stats. diff --git a/roles/matrix-nginx-proxy/tasks/setup_nginx_proxy.yml b/roles/matrix-nginx-proxy/tasks/setup_nginx_proxy.yml index 149fadab..3dd828d2 100644 --- a/roles/matrix-nginx-proxy/tasks/setup_nginx_proxy.yml +++ b/roles/matrix-nginx-proxy/tasks/setup_nginx_proxy.yml @@ -38,6 +38,15 @@ mode: 0400 when: "matrix_nginx_proxy_proxy_synapse_metrics_basic_auth_enabled|bool and matrix_nginx_proxy_proxy_synapse_metrics|bool" +- name: Generate sample prometheus.yml for external scraping + template: + src: "{{ role_path }}/templates/prometheus/external_prometheus.yml.example.j2" + dest: "{{ matrix_base_data_path }}/external_prometheus.yml.example" + owner: "{{ matrix_user_username }}" + group: "{{ matrix_user_groupname }}" + mode: 0400 + when: matrix_nginx_proxy_proxy_synapse_metrics|bool + - name: Ensure Matrix nginx-proxy configured (generic) template: src: "{{ role_path }}/templates/nginx/conf.d/nginx-http.conf.j2" @@ -270,3 +279,9 @@ path: "{{ matrix_nginx_proxy_data_path }}/matrix-synapse-metrics-htpasswd" state: absent when: "not matrix_nginx_proxy_proxy_synapse_metrics_basic_auth_enabled|bool or not matrix_nginx_proxy_proxy_synapse_metrics|bool" + +- name: Ensure sample prometheus.yml for external scraping is deleted + file: + path: "{{ matrix_base_data_path }}/external_prometheus.yml.example" + state: absent + when: "not matrix_nginx_proxy_proxy_synapse_metrics|bool" diff --git a/roles/matrix-nginx-proxy/templates/prometheus/external_prometheus.yml.example.j2 b/roles/matrix-nginx-proxy/templates/prometheus/external_prometheus.yml.example.j2 new file mode 100644 index 00000000..36d61c05 --- /dev/null +++ b/roles/matrix-nginx-proxy/templates/prometheus/external_prometheus.yml.example.j2 @@ -0,0 +1,40 @@ +global: + scrape_interval: 5s + + # Attach these labels to any time series or alerts when communicating with + # external systems (federation, remote storage, Alertmanager). + external_labels: + monitor: 'synapse-{{ matrix_domain }}' + +rule_files: + - /etc/prometheus/synapse-v2.rules + +scrape_configs: + - job_name: 'synapse' + metrics_path: /_synapse/metrics + scheme: {{ 'https' if matrix_nginx_proxy_https_enabled else 'http' }} +{% if matrix_nginx_proxy_proxy_synapse_metrics_basic_auth_enabled %} + basic_auth: + username: prometheus + password_file: /path/to/your/passwordfile.pwd +{% endif %} + static_configs: + - targets: ['{{ matrix_server_fqn_matrix }}:{{ matrix_nginx_proxy_container_https_host_bind_port if matrix_nginx_proxy_https_enabled else matrix_nginx_proxy_container_http_host_bind_port }}'] + labels: + job: "master" + index: 1 +{% for worker in matrix_nginx_proxy_proxy_synapse_workers_enabled_list %} + - job_name: 'synapse-{{ worker.type }}-{{ worker.instanceId }}' + metrics_path: /_synapse-worker-{{ worker.type }}-{{ worker.instanceId }}/metrics + scheme: {{ 'https' if matrix_nginx_proxy_https_enabled else 'http' }} +{% if matrix_nginx_proxy_proxy_synapse_metrics_basic_auth_enabled %} + basic_auth: + username: prometheus + password_file: /path/to/your/passwordfile.pwd +{% endif %} + static_configs: + - targets: [{{ matrix_server_fqn_matrix }:{{ matrix_nginx_proxy_container_https_host_bind_port if matrix_nginx_proxy_https_enabled else matrix_nginx_proxy_container_http_host_bind_port }}'] + labels: + job: "{{ worker.type }}" + index: {{ worker.instanceId }} +{% endfor %} From 7b33fc8e1971a509e5aaee1af8d9781dab677e40 Mon Sep 17 00:00:00 2001 From: HarHarLinks Date: Wed, 20 Oct 2021 12:57:55 +0200 Subject: [PATCH 12/86] fixup! auto-generate prometheus.yml for workers metrics --- roles/matrix-nginx-proxy/tasks/setup_nginx_proxy.yml | 2 +- .../templates/prometheus/external_prometheus.yml.example.j2 | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/roles/matrix-nginx-proxy/tasks/setup_nginx_proxy.yml b/roles/matrix-nginx-proxy/tasks/setup_nginx_proxy.yml index 3dd828d2..e577491b 100644 --- a/roles/matrix-nginx-proxy/tasks/setup_nginx_proxy.yml +++ b/roles/matrix-nginx-proxy/tasks/setup_nginx_proxy.yml @@ -44,7 +44,7 @@ dest: "{{ matrix_base_data_path }}/external_prometheus.yml.example" owner: "{{ matrix_user_username }}" group: "{{ matrix_user_groupname }}" - mode: 0400 + mode: 0644 when: matrix_nginx_proxy_proxy_synapse_metrics|bool - name: Ensure Matrix nginx-proxy configured (generic) diff --git a/roles/matrix-nginx-proxy/templates/prometheus/external_prometheus.yml.example.j2 b/roles/matrix-nginx-proxy/templates/prometheus/external_prometheus.yml.example.j2 index 36d61c05..01a39ffa 100644 --- a/roles/matrix-nginx-proxy/templates/prometheus/external_prometheus.yml.example.j2 +++ b/roles/matrix-nginx-proxy/templates/prometheus/external_prometheus.yml.example.j2 @@ -33,7 +33,7 @@ scrape_configs: password_file: /path/to/your/passwordfile.pwd {% endif %} static_configs: - - targets: [{{ matrix_server_fqn_matrix }:{{ matrix_nginx_proxy_container_https_host_bind_port if matrix_nginx_proxy_https_enabled else matrix_nginx_proxy_container_http_host_bind_port }}'] + - targets: ['{{ matrix_server_fqn_matrix }}:{{ matrix_nginx_proxy_container_https_host_bind_port if matrix_nginx_proxy_https_enabled else matrix_nginx_proxy_container_http_host_bind_port }}'] labels: job: "{{ worker.type }}" index: {{ worker.instanceId }} From 5dc28682696a4e5f9a0ae17c3b786b025c73575e Mon Sep 17 00:00:00 2001 From: Slavi Pantaleev Date: Wed, 20 Oct 2021 15:08:07 +0300 Subject: [PATCH 13/86] Upgrade Synapse (1.45.0 -> 1.45.1) --- roles/matrix-synapse/defaults/main.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/roles/matrix-synapse/defaults/main.yml b/roles/matrix-synapse/defaults/main.yml index 6c52452d..d0df4f8d 100644 --- a/roles/matrix-synapse/defaults/main.yml +++ b/roles/matrix-synapse/defaults/main.yml @@ -15,8 +15,8 @@ matrix_synapse_docker_image_name_prefix: "{{ 'localhost/' if matrix_synapse_cont # amd64 gets released first. # arm32 relies on self-building, so the same version can be built immediately. # arm64 users need to wait for a prebuilt image to become available. -matrix_synapse_version: v1.45.0 -matrix_synapse_version_arm64: v1.45.0 +matrix_synapse_version: v1.45.1 +matrix_synapse_version_arm64: v1.45.1 matrix_synapse_docker_image_tag: "{{ matrix_synapse_version if matrix_architecture in ['arm32', 'amd64'] else matrix_synapse_version_arm64 }}" matrix_synapse_docker_image_force_pull: "{{ matrix_synapse_docker_image.endswith(':latest') }}" From 725150565a8231beba29a500912123aacbbf74d6 Mon Sep 17 00:00:00 2001 From: PC-Admin Date: Thu, 21 Oct 2021 09:47:07 +0800 Subject: [PATCH 14/86] GoMatrixHosting v0.6.3 hotfix2 --- roles/matrix-common-after/tasks/awx_post.yml | 12 ++++-------- 1 file changed, 4 insertions(+), 8 deletions(-) diff --git a/roles/matrix-common-after/tasks/awx_post.yml b/roles/matrix-common-after/tasks/awx_post.yml index e98afb60..4fbd5e55 100644 --- a/roles/matrix-common-after/tasks/awx_post.yml +++ b/roles/matrix-common-after/tasks/awx_post.yml @@ -63,19 +63,15 @@ mode: '0770' when: awx_customise_base_domain_website is defined -- name: Check if Discord AppService invite file exists - stat: - path: /matrix/appservice-discord/config/invite_link - register: awx_discord_appservice_link_file - when: ( awx_appservice_discord_admin_user is defined ) - - name: Collect Discord AppService bot invite link if file exists command: cat /matrix/appservice-discord/config/invite_link register: awx_discord_appservice_link - when: ( awx_discord_appservice_link_file.stat.exists == true ) and ( awx_appservice_discord_admin_user is defined ) + when: awx_appservice_discord_admin_user is defined + args: + removes: /matrix/appservice-discord/config/invite_link - name: Print Discord AppService bot link for user debug: msg: "{{ awx_discord_appservice_link.stdout }}" - when: awx_discord_appservice_link is defined + when: awx_discord_appservice_link.stdout is defined From 09ac950d170794e8d975e1a46a62ee8122d95317 Mon Sep 17 00:00:00 2001 From: Slavi Pantaleev Date: Thu, 21 Oct 2021 16:32:05 +0300 Subject: [PATCH 15/86] Fix dump importing (backup restore) into Postgres v14 In short, the problem is that older Postgres versions store passwords hashed as md5. When you dump such a database, the dump naturally also contains md5-hashed passwords. Restoring from that dump used to create users and updates their passwords with these md5 hashes. However, Postgres v14 prefers does not like md5-hashed passwords now (by default), which breaks connectivity. Postgres v14 prefers `scram-sha-256` for authentication. Our solution is to just ignore setting passwords (`ALTER ROLE ..` statements) when restoring dumps. We don't need to set passwords as defined in the dump anyway, because the playbook creates users and manages their passwords by itself. Fixes https://github.com/spantaleev/matrix-docker-ansible-deploy/issues/1340 --- roles/matrix-postgres/defaults/main.yml | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/roles/matrix-postgres/defaults/main.yml b/roles/matrix-postgres/defaults/main.yml index 53b1c0f4..91a31d99 100644 --- a/roles/matrix-postgres/defaults/main.yml +++ b/roles/matrix-postgres/defaults/main.yml @@ -63,7 +63,16 @@ matrix_postgres_additional_databases: [] # We either need to not create them or to ignore the `CREATE ROLE` statements in the dump. matrix_postgres_import_roles_to_ignore: [matrix_postgres_connection_username] -matrix_postgres_import_roles_ignore_regex: "^CREATE ROLE ({{ matrix_postgres_import_roles_to_ignore|join('|') }});" +# When importing an existing Postgres database (when restoring a backup) or when doing a Postgres upgrade (which dumps & restores), we'd like to avoid: +# - creating users (`CREATE ROLE ..`) +# - updating passwords for users (`ALTER ROLE matrix WITH SUPERUSER INHERIT NOCREATEROLE NOCREATEDB LOGIN NOREPLICATION NOBYPASSRLS PASSWORD 'md5...`) +# +# Both of these operations are done by the playbook anyway. +# Updating passwords is especially undesirable, because older versions hash passwords using md5 and export them as md5 hashes in the dump file, +# which is unsupported by default by newer Postgres versions (v14+). +# When users are created and passwords are set by the playbook, they end up hashed as `scram-sha-256` on Postgres v14+. +# If an md5-hashed password is restored on top, Postgres v14+ will refuse to authenticate users with it by default. +matrix_postgres_import_roles_ignore_regex: "^(CREATE|ALTER) ROLE ({{ matrix_postgres_import_roles_to_ignore|join('|') }})(;| WITH)" # A list of databases to avoid creating when importing (or upgrading) the database. # If a dump file contains the databases and they've also been created beforehand (see `matrix_postgres_additional_databases`), From d7af78066b1b81e890093863440a6d1bd768f35c Mon Sep 17 00:00:00 2001 From: Toni Spets Date: Fri, 3 Sep 2021 07:58:48 +0300 Subject: [PATCH 16/86] Upgrade Heisenbridge (1.2.1 -> 1.3.0) --- roles/matrix-bridge-heisenbridge/defaults/main.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/roles/matrix-bridge-heisenbridge/defaults/main.yml b/roles/matrix-bridge-heisenbridge/defaults/main.yml index 2f9380df..a8c6db96 100644 --- a/roles/matrix-bridge-heisenbridge/defaults/main.yml +++ b/roles/matrix-bridge-heisenbridge/defaults/main.yml @@ -3,7 +3,7 @@ matrix_heisenbridge_enabled: true -matrix_heisenbridge_version: 1.2.1 +matrix_heisenbridge_version: 1.3.0 matrix_heisenbridge_docker_image: "{{ matrix_container_global_registry_prefix }}hif1/heisenbridge:{{ matrix_heisenbridge_version }}" matrix_heisenbridge_docker_image_force_pull: "{{ matrix_heisenbridge_docker_image.endswith(':latest') }}" From 5f6bbafa17731eed8148cff5c22d99af3014b224 Mon Sep 17 00:00:00 2001 From: Kim Brose Date: Sun, 24 Oct 2021 16:00:42 +0200 Subject: [PATCH 17/86] fix space before tab in indent --- .../templates/nginx/conf.d/matrix-synapse.conf.j2 | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/roles/matrix-nginx-proxy/templates/nginx/conf.d/matrix-synapse.conf.j2 b/roles/matrix-nginx-proxy/templates/nginx/conf.d/matrix-synapse.conf.j2 index 6933e967..6f569327 100644 --- a/roles/matrix-nginx-proxy/templates/nginx/conf.d/matrix-synapse.conf.j2 +++ b/roles/matrix-nginx-proxy/templates/nginx/conf.d/matrix-synapse.conf.j2 @@ -168,7 +168,7 @@ server { {% endif %} } {% endif %} - {% endfor %} + {% endfor %} {% endif %} {# Everything else just goes to the API server ##} From d31cdb071ab226864434520706c83f6922c26a3e Mon Sep 17 00:00:00 2001 From: throwawayay Date: Mon, 25 Oct 2021 12:44:58 -0400 Subject: [PATCH 18/86] Upgrade Element (v1.9.3) https://github.com/vector-im/element-web/releases/tag/v1.9.3 --- roles/matrix-client-element/defaults/main.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/roles/matrix-client-element/defaults/main.yml b/roles/matrix-client-element/defaults/main.yml index 614cdf24..527b17e5 100644 --- a/roles/matrix-client-element/defaults/main.yml +++ b/roles/matrix-client-element/defaults/main.yml @@ -3,7 +3,7 @@ matrix_client_element_enabled: true matrix_client_element_container_image_self_build: false matrix_client_element_container_image_self_build_repo: "https://github.com/vector-im/riot-web.git" -matrix_client_element_version: v1.9.2 +matrix_client_element_version: v1.9.3 matrix_client_element_docker_image: "{{ matrix_client_element_docker_image_name_prefix }}vectorim/element-web:{{ matrix_client_element_version }}" matrix_client_element_docker_image_name_prefix: "{{ 'localhost/' if matrix_client_element_container_image_self_build else matrix_container_global_registry_prefix }}" matrix_client_element_docker_image_force_pull: "{{ matrix_client_element_docker_image.endswith(':latest') }}" From feda83abf08e51ed7aa36cfcb4fc4341ee56f197 Mon Sep 17 00:00:00 2001 From: Slavi Pantaleev Date: Wed, 27 Oct 2021 14:00:40 +0300 Subject: [PATCH 19/86] Mention that Hydrogen always undergoes self-building --- docs/alternative-architectures.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/alternative-architectures.md b/docs/alternative-architectures.md index 80749adf..a6c2a02a 100644 --- a/docs/alternative-architectures.md +++ b/docs/alternative-architectures.md @@ -21,6 +21,6 @@ matrix_architecture: "arm32" ## Implementation details -For `amd64`, prebuilt container images (see the [container images we use](container-images.md)) are used everywhere, because all images are available for this architecture. +For `amd64`, prebuilt container images (see the [container images we use](container-images.md)) are used for all components (except [Hydrogen](configuring-playbook-client-hydrogen.md), which goes through self-building). For other architectures, components which have a prebuilt image make use of it. If the component is not available for the specific architecture, [self-building](self-building.md) will be used. Not all components support self-building though, so your mileage may vary. From d09609b3bddf0898f3a617bad66d9cff12d36c7b Mon Sep 17 00:00:00 2001 From: sakkiii Date: Wed, 27 Oct 2021 23:11:01 +0530 Subject: [PATCH 20/86] Update prometheus (2.29.2 -> 2.30.3) --- roles/matrix-prometheus/defaults/main.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/roles/matrix-prometheus/defaults/main.yml b/roles/matrix-prometheus/defaults/main.yml index dc43eb48..1cbeed8b 100644 --- a/roles/matrix-prometheus/defaults/main.yml +++ b/roles/matrix-prometheus/defaults/main.yml @@ -3,7 +3,7 @@ matrix_prometheus_enabled: false -matrix_prometheus_version: v2.29.2 +matrix_prometheus_version: v2.30.3 matrix_prometheus_docker_image: "{{ matrix_container_global_registry_prefix }}prom/prometheus:{{ matrix_prometheus_version }}" matrix_prometheus_docker_image_force_pull: "{{ matrix_prometheus_docker_image.endswith(':latest') }}" From 0231302db9f0895c3f4cbc67f8a902b86426d1f5 Mon Sep 17 00:00:00 2001 From: sakkiii Date: Wed, 27 Oct 2021 23:14:14 +0530 Subject: [PATCH 21/86] Upgrade grafana (8.1.4 -> 8.2.2) --- roles/matrix-grafana/defaults/main.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/roles/matrix-grafana/defaults/main.yml b/roles/matrix-grafana/defaults/main.yml index 8df73e2d..8e4bd7bb 100644 --- a/roles/matrix-grafana/defaults/main.yml +++ b/roles/matrix-grafana/defaults/main.yml @@ -3,7 +3,7 @@ matrix_grafana_enabled: false -matrix_grafana_version: 8.1.4 +matrix_grafana_version: 8.2.2 matrix_grafana_docker_image: "{{ matrix_container_global_registry_prefix }}grafana/grafana:{{ matrix_grafana_version }}" matrix_grafana_docker_image_force_pull: "{{ matrix_grafana_docker_image.endswith(':latest') }}" From 0a10077c6319eba362f8d35cade309b076975a2f Mon Sep 17 00:00:00 2001 From: jariz Date: Thu, 28 Oct 2021 11:16:43 +0200 Subject: [PATCH 22/86] caddy example fixes - caddy v1 requires a path in the header directive - msisd has been replaced in favour of ma1sd --- examples/caddy/matrix-synapse | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/examples/caddy/matrix-synapse b/examples/caddy/matrix-synapse index 4202c759..c1893ebb 100644 --- a/examples/caddy/matrix-synapse +++ b/examples/caddy/matrix-synapse @@ -5,7 +5,7 @@ https://matrix.DOMAIN { root /matrix/static-files - header { + header / { Access-Control-Allow-Origin * Strict-Transport-Security "mag=age=31536000;" X-Frame-Options "DENY" @@ -13,10 +13,10 @@ https://matrix.DOMAIN { } # Identity server traffic - proxy /_matrix/identity matrix-msisd:8090 { + proxy /_matrix/identity matrix-ma1sd:8090 { transparent } - proxy /_matrix/client/r0/user_directory/search matrix-msisd:8090 { + proxy /_matrix/client/r0/user_directory/search matrix-ma1sd:8090 { transparent } From 32f15e9bf0edd4407169c412294d8915f5ec81be Mon Sep 17 00:00:00 2001 From: Thom Wiggers Date: Thu, 28 Oct 2021 15:21:58 +0200 Subject: [PATCH 23/86] update IRC appservice https://github.com/matrix-org/matrix-appservice-irc/releases/tag/0.32.1 --- roles/matrix-bridge-appservice-irc/defaults/main.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/roles/matrix-bridge-appservice-irc/defaults/main.yml b/roles/matrix-bridge-appservice-irc/defaults/main.yml index 35432aa0..57604b19 100644 --- a/roles/matrix-bridge-appservice-irc/defaults/main.yml +++ b/roles/matrix-bridge-appservice-irc/defaults/main.yml @@ -7,7 +7,7 @@ matrix_appservice_irc_container_self_build: false matrix_appservice_irc_docker_repo: "https://github.com/matrix-org/matrix-appservice-irc.git" matrix_appservice_irc_docker_src_files_path: "{{ matrix_base_data_path }}/appservice-irc/docker-src" -matrix_appservice_irc_version: release-0.31.0 +matrix_appservice_irc_version: release-0.32.1 matrix_appservice_irc_docker_image: "{{ matrix_container_global_registry_prefix }}matrixdotorg/matrix-appservice-irc:{{ matrix_appservice_irc_version }}" matrix_appservice_irc_docker_image_force_pull: "{{ matrix_appservice_irc_docker_image.endswith(':latest') }}" From 124b9608fcfab7ac43bfc74d568eaaa9e6711e1b Mon Sep 17 00:00:00 2001 From: Toni Spets Date: Fri, 3 Sep 2021 07:58:48 +0300 Subject: [PATCH 24/86] Upgrade Heisenbridge (1.3.0 -> 1.4.0) --- roles/matrix-bridge-heisenbridge/defaults/main.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/roles/matrix-bridge-heisenbridge/defaults/main.yml b/roles/matrix-bridge-heisenbridge/defaults/main.yml index a8c6db96..2be75e20 100644 --- a/roles/matrix-bridge-heisenbridge/defaults/main.yml +++ b/roles/matrix-bridge-heisenbridge/defaults/main.yml @@ -3,7 +3,7 @@ matrix_heisenbridge_enabled: true -matrix_heisenbridge_version: 1.3.0 +matrix_heisenbridge_version: 1.4.0 matrix_heisenbridge_docker_image: "{{ matrix_container_global_registry_prefix }}hif1/heisenbridge:{{ matrix_heisenbridge_version }}" matrix_heisenbridge_docker_image_force_pull: "{{ matrix_heisenbridge_docker_image.endswith(':latest') }}" From 63f5a88fa01f6d8497f7308074fe9cb8d64ad70b Mon Sep 17 00:00:00 2001 From: Slavi Pantaleev Date: Fri, 29 Oct 2021 10:29:54 +0300 Subject: [PATCH 25/86] Separate install/uninstall tasks for Element and Hydrogen --- roles/matrix-client-element/tasks/main.yml | 10 ++++- .../tasks/{setup.yml => setup_install.yml} | 45 ------------------- .../tasks/setup_uninstall.yml | 38 ++++++++++++++++ roles/matrix-client-hydrogen/tasks/main.yml | 10 ++++- .../tasks/{setup.yml => setup_install.yml} | 45 ------------------- .../tasks/setup_uninstall.yml | 38 ++++++++++++++++ 6 files changed, 92 insertions(+), 94 deletions(-) rename roles/matrix-client-element/tasks/{setup.yml => setup_install.yml} (73%) create mode 100644 roles/matrix-client-element/tasks/setup_uninstall.yml rename roles/matrix-client-hydrogen/tasks/{setup.yml => setup_install.yml} (70%) create mode 100644 roles/matrix-client-hydrogen/tasks/setup_uninstall.yml diff --git a/roles/matrix-client-element/tasks/main.yml b/roles/matrix-client-element/tasks/main.yml index cdc5fa97..f020382a 100644 --- a/roles/matrix-client-element/tasks/main.yml +++ b/roles/matrix-client-element/tasks/main.yml @@ -20,8 +20,14 @@ - setup-all - setup-client-element -- import_tasks: "{{ role_path }}/tasks/setup.yml" - when: run_setup|bool +- import_tasks: "{{ role_path }}/tasks/setup_install.yml" + when: "run_setup|bool and matrix_client_element_enabled|bool" + tags: + - setup-all + - setup-client-element + +- import_tasks: "{{ role_path }}/tasks/setup_uninstall.yml" + when: "run_setup|bool and not matrix_client_element_enabled|bool" tags: - setup-all - setup-client-element diff --git a/roles/matrix-client-element/tasks/setup.yml b/roles/matrix-client-element/tasks/setup_install.yml similarity index 73% rename from roles/matrix-client-element/tasks/setup.yml rename to roles/matrix-client-element/tasks/setup_install.yml index 117a09f4..908dfa00 100644 --- a/roles/matrix-client-element/tasks/setup.yml +++ b/roles/matrix-client-element/tasks/setup_install.yml @@ -1,9 +1,5 @@ --- -# -# Tasks related to setting up Element -# - - name: Ensure Element paths exists file: path: "{{ item.path }}" @@ -87,44 +83,3 @@ service: daemon_reload: yes when: "matrix_client_element_enabled and matrix_client_element_systemd_service_result.changed" - -# -# Tasks related to getting rid of Element (if it was previously enabled) -# - -- name: Check existence of matrix-client-element.service - stat: - path: "{{ matrix_systemd_path }}/matrix-client-element.service" - register: matrix_client_element_service_stat - when: "not matrix_client_element_enabled|bool" - -- name: Ensure matrix-client-element is stopped - service: - name: matrix-client-element - state: stopped - daemon_reload: yes - register: stopping_result - when: "not matrix_client_element_enabled|bool and matrix_client_element_service_stat.stat.exists" - -- name: Ensure matrix-client-element.service doesn't exist - file: - path: "{{ matrix_systemd_path }}/matrix-client-element.service" - state: absent - when: "not matrix_client_element_enabled|bool and matrix_client_element_service_stat.stat.exists" - -- name: Ensure systemd reloaded after matrix-client-element.service removal - service: - daemon_reload: yes - when: "not matrix_client_element_enabled|bool and matrix_client_element_service_stat.stat.exists" - -- name: Ensure Element paths doesn't exist - file: - path: "{{ matrix_client_element_data_path }}" - state: absent - when: "not matrix_client_element_enabled|bool" - -- name: Ensure Element Docker image doesn't exist - docker_image: - name: "{{ matrix_client_element_docker_image }}" - state: absent - when: "not matrix_client_element_enabled|bool" diff --git a/roles/matrix-client-element/tasks/setup_uninstall.yml b/roles/matrix-client-element/tasks/setup_uninstall.yml new file mode 100644 index 00000000..398a17e2 --- /dev/null +++ b/roles/matrix-client-element/tasks/setup_uninstall.yml @@ -0,0 +1,38 @@ +--- + +- name: Check existence of matrix-client-element.service + stat: + path: "{{ matrix_systemd_path }}/matrix-client-element.service" + register: matrix_client_element_service_stat + when: "not matrix_client_element_enabled|bool" + +- name: Ensure matrix-client-element is stopped + service: + name: matrix-client-element + state: stopped + daemon_reload: yes + register: stopping_result + when: "not matrix_client_element_enabled|bool and matrix_client_element_service_stat.stat.exists" + +- name: Ensure matrix-client-element.service doesn't exist + file: + path: "{{ matrix_systemd_path }}/matrix-client-element.service" + state: absent + when: "not matrix_client_element_enabled|bool and matrix_client_element_service_stat.stat.exists" + +- name: Ensure systemd reloaded after matrix-client-element.service removal + service: + daemon_reload: yes + when: "not matrix_client_element_enabled|bool and matrix_client_element_service_stat.stat.exists" + +- name: Ensure Element paths doesn't exist + file: + path: "{{ matrix_client_element_data_path }}" + state: absent + when: "not matrix_client_element_enabled|bool" + +- name: Ensure Element Docker image doesn't exist + docker_image: + name: "{{ matrix_client_element_docker_image }}" + state: absent + when: "not matrix_client_element_enabled|bool" diff --git a/roles/matrix-client-hydrogen/tasks/main.yml b/roles/matrix-client-hydrogen/tasks/main.yml index 6534db05..8d5c493f 100644 --- a/roles/matrix-client-hydrogen/tasks/main.yml +++ b/roles/matrix-client-hydrogen/tasks/main.yml @@ -8,8 +8,14 @@ - setup-all - setup-client-hydrogen -- import_tasks: "{{ role_path }}/tasks/setup.yml" - when: run_setup|bool +- import_tasks: "{{ role_path }}/tasks/setup_install.yml" + when: "run_setup|bool and matrix_client_hydrogen_enabled|bool" + tags: + - setup-all + - setup-client-hydrogen + +- import_tasks: "{{ role_path }}/tasks/setup_uninstall.yml" + when: "run_setup|bool and not matrix_client_hydrogen_enabled|bool" tags: - setup-all - setup-client-hydrogen diff --git a/roles/matrix-client-hydrogen/tasks/setup.yml b/roles/matrix-client-hydrogen/tasks/setup_install.yml similarity index 70% rename from roles/matrix-client-hydrogen/tasks/setup.yml rename to roles/matrix-client-hydrogen/tasks/setup_install.yml index a4ff7c3c..0c0dcf3b 100644 --- a/roles/matrix-client-hydrogen/tasks/setup.yml +++ b/roles/matrix-client-hydrogen/tasks/setup_install.yml @@ -1,9 +1,5 @@ --- -# -# Tasks related to setting up Hydrogen -# - - name: Ensure Hydrogen paths exists file: path: "{{ item.path }}" @@ -78,44 +74,3 @@ service: daemon_reload: yes when: "matrix_client_hydrogen_enabled and matrix_client_hydrogen_systemd_service_result.changed" - -# -# Tasks related to getting rid of Hydrogen (if it was previously enabled) -# - -- name: Check existence of matrix-client-hydrogen.service - stat: - path: "{{ matrix_systemd_path }}/matrix-client-hydrogen.service" - register: matrix_client_hydrogen_service_stat - when: "not matrix_client_hydrogen_enabled|bool" - -- name: Ensure matrix-client-hydrogen is stopped - service: - name: matrix-client-hydrogen - state: stopped - daemon_reload: yes - register: stopping_result - when: "not matrix_client_hydrogen_enabled|bool and matrix_client_hydrogen_service_stat.stat.exists" - -- name: Ensure matrix-client-hydrogen.service doesn't exist - file: - path: "{{ matrix_systemd_path }}/matrix-client-hydrogen.service" - state: absent - when: "not matrix_client_hydrogen_enabled|bool and matrix_client_hydrogen_service_stat.stat.exists" - -- name: Ensure systemd reloaded after matrix-client-hydrogen.service removal - service: - daemon_reload: yes - when: "not matrix_client_hydrogen_enabled|bool and matrix_client_hydrogen_service_stat.stat.exists" - -- name: Ensure Hydrogen paths doesn't exist - file: - path: "{{ matrix_client_hydrogen_data_path }}" - state: absent - when: "not matrix_client_hydrogen_enabled|bool" - -- name: Ensure Hydrogen Docker image doesn't exist - docker_image: - name: "{{ matrix_client_hydrogen_docker_image }}" - state: absent - when: "not matrix_client_hydrogen_enabled|bool" diff --git a/roles/matrix-client-hydrogen/tasks/setup_uninstall.yml b/roles/matrix-client-hydrogen/tasks/setup_uninstall.yml new file mode 100644 index 00000000..455b5a8d --- /dev/null +++ b/roles/matrix-client-hydrogen/tasks/setup_uninstall.yml @@ -0,0 +1,38 @@ +--- + +- name: Check existence of matrix-client-hydrogen.service + stat: + path: "{{ matrix_systemd_path }}/matrix-client-hydrogen.service" + register: matrix_client_hydrogen_service_stat + when: "not matrix_client_hydrogen_enabled|bool" + +- name: Ensure matrix-client-hydrogen is stopped + service: + name: matrix-client-hydrogen + state: stopped + daemon_reload: yes + register: stopping_result + when: "not matrix_client_hydrogen_enabled|bool and matrix_client_hydrogen_service_stat.stat.exists" + +- name: Ensure matrix-client-hydrogen.service doesn't exist + file: + path: "{{ matrix_systemd_path }}/matrix-client-hydrogen.service" + state: absent + when: "not matrix_client_hydrogen_enabled|bool and matrix_client_hydrogen_service_stat.stat.exists" + +- name: Ensure systemd reloaded after matrix-client-hydrogen.service removal + service: + daemon_reload: yes + when: "not matrix_client_hydrogen_enabled|bool and matrix_client_hydrogen_service_stat.stat.exists" + +- name: Ensure Hydrogen paths doesn't exist + file: + path: "{{ matrix_client_hydrogen_data_path }}" + state: absent + when: "not matrix_client_hydrogen_enabled|bool" + +- name: Ensure Hydrogen Docker image doesn't exist + docker_image: + name: "{{ matrix_client_hydrogen_docker_image }}" + state: absent + when: "not matrix_client_hydrogen_enabled|bool" From 39fa852ed615dbd7e347b12787227f7caf5239df Mon Sep 17 00:00:00 2001 From: Slavi Pantaleev Date: Fri, 29 Oct 2021 10:41:11 +0300 Subject: [PATCH 26/86] Remove unnecessary if checks Should have been done in 63f5a88fa01f6d8. --- .../tasks/setup_install.yml | 16 +++++++--------- .../tasks/setup_uninstall.yml | 9 +++------ .../tasks/setup_install.yml | 15 +++++++-------- .../tasks/setup_uninstall.yml | 9 +++------ 4 files changed, 20 insertions(+), 29 deletions(-) diff --git a/roles/matrix-client-element/tasks/setup_install.yml b/roles/matrix-client-element/tasks/setup_install.yml index 908dfa00..44124039 100644 --- a/roles/matrix-client-element/tasks/setup_install.yml +++ b/roles/matrix-client-element/tasks/setup_install.yml @@ -10,7 +10,7 @@ with_items: - { path: "{{ matrix_client_element_data_path }}", when: true } - { path: "{{ matrix_client_element_docker_src_files_path }}", when: "{{ matrix_client_element_container_image_self_build }}" } - when: matrix_client_element_enabled|bool and item.when + when: "item.when|bool" - name: Ensure Element Docker image is pulled docker_image: @@ -18,7 +18,7 @@ source: "{{ 'pull' if ansible_version.major > 2 or ansible_version.minor > 7 else omit }}" force_source: "{{ matrix_client_element_docker_image_force_pull if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}" force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else matrix_client_element_docker_image_force_pull }}" - when: matrix_client_element_enabled|bool and not matrix_client_element_container_image_self_build + when: "not matrix_client_element_container_image_self_build|bool" - name: Ensure Element repository is present on self-build git: @@ -27,7 +27,7 @@ version: "{{ matrix_client_element_docker_image.split(':')[1] }}" force: "yes" register: matrix_client_element_git_pull_results - when: "matrix_client_element_enabled|bool and matrix_client_element_container_image_self_build|bool" + when: "matrix_client_element_container_image_self_build|bool" - name: Ensure Element Docker image is built docker_image: @@ -39,7 +39,7 @@ dockerfile: Dockerfile path: "{{ matrix_client_element_docker_src_files_path }}" pull: yes - when: "matrix_client_element_enabled|bool and matrix_client_element_container_image_self_build|bool" + when: "matrix_client_element_container_image_self_build|bool" - name: Ensure Element configuration installed copy: @@ -48,7 +48,6 @@ mode: 0644 owner: "{{ matrix_user_username }}" group: "{{ matrix_user_groupname }}" - when: matrix_client_element_enabled|bool - name: Ensure Element config files installed template: @@ -61,7 +60,7 @@ - {src: "{{ role_path }}/templates/nginx.conf.j2", name: "nginx.conf"} - {src: "{{ matrix_client_element_page_template_welcome_path }}", name: "welcome.html"} - {src: "{{ matrix_client_element_embedded_pages_home_path }}", name: "home.html"} - when: "matrix_client_element_enabled|bool and item.src is not none" + when: "item.src is not none" - name: Ensure Element config files removed file: @@ -69,7 +68,7 @@ state: absent with_items: - {src: "{{ matrix_client_element_embedded_pages_home_path }}", name: "home.html"} - when: "matrix_client_element_enabled|bool and item.src is none" + when: "item.src is none" - name: Ensure matrix-client-element.service installed template: @@ -77,9 +76,8 @@ dest: "{{ matrix_systemd_path }}/matrix-client-element.service" mode: 0644 register: matrix_client_element_systemd_service_result - when: matrix_client_element_enabled|bool - name: Ensure systemd reloaded after matrix-client-element.service installation service: daemon_reload: yes - when: "matrix_client_element_enabled and matrix_client_element_systemd_service_result.changed" + when: "matrix_client_element_systemd_service_result.changed|bool" diff --git a/roles/matrix-client-element/tasks/setup_uninstall.yml b/roles/matrix-client-element/tasks/setup_uninstall.yml index 398a17e2..74a4720e 100644 --- a/roles/matrix-client-element/tasks/setup_uninstall.yml +++ b/roles/matrix-client-element/tasks/setup_uninstall.yml @@ -4,7 +4,6 @@ stat: path: "{{ matrix_systemd_path }}/matrix-client-element.service" register: matrix_client_element_service_stat - when: "not matrix_client_element_enabled|bool" - name: Ensure matrix-client-element is stopped service: @@ -12,27 +11,25 @@ state: stopped daemon_reload: yes register: stopping_result - when: "not matrix_client_element_enabled|bool and matrix_client_element_service_stat.stat.exists" + when: "matrix_client_element_service_stat.stat.exists|bool" - name: Ensure matrix-client-element.service doesn't exist file: path: "{{ matrix_systemd_path }}/matrix-client-element.service" state: absent - when: "not matrix_client_element_enabled|bool and matrix_client_element_service_stat.stat.exists" + when: "matrix_client_element_service_stat.stat.exists|bool" - name: Ensure systemd reloaded after matrix-client-element.service removal service: daemon_reload: yes - when: "not matrix_client_element_enabled|bool and matrix_client_element_service_stat.stat.exists" + when: "matrix_client_element_service_stat.stat.exists|bool" - name: Ensure Element paths doesn't exist file: path: "{{ matrix_client_element_data_path }}" state: absent - when: "not matrix_client_element_enabled|bool" - name: Ensure Element Docker image doesn't exist docker_image: name: "{{ matrix_client_element_docker_image }}" state: absent - when: "not matrix_client_element_enabled|bool" diff --git a/roles/matrix-client-hydrogen/tasks/setup_install.yml b/roles/matrix-client-hydrogen/tasks/setup_install.yml index 0c0dcf3b..b512a1a8 100644 --- a/roles/matrix-client-hydrogen/tasks/setup_install.yml +++ b/roles/matrix-client-hydrogen/tasks/setup_install.yml @@ -10,7 +10,7 @@ with_items: - { path: "{{ matrix_client_hydrogen_data_path }}", when: true } - { path: "{{ matrix_client_hydrogen_docker_src_files_path }}", when: "{{ matrix_client_hydrogen_container_image_self_build }}" } - when: matrix_client_hydrogen_enabled|bool and item.when + when: "item.when|bool" - name: Ensure Hydrogen Docker image is pulled docker_image: @@ -18,7 +18,7 @@ source: "{{ 'pull' if ansible_version.major > 2 or ansible_version.minor > 7 else omit }}" force_source: "{{ matrix_client_hydrogen_docker_image_force_pull if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}" force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else matrix_client_hydrogen_docker_image_force_pull }}" - when: matrix_client_hydrogen_enabled|bool and not matrix_client_hydrogen_container_image_self_build + when: "not matrix_client_hydrogen_container_image_self_build|bool" - name: Ensure Hydrogen repository is present on self-build git: @@ -27,7 +27,7 @@ version: "{{ matrix_client_hydrogen_docker_image.split(':')[1] }}" force: "yes" register: matrix_client_hydrogen_git_pull_results - when: "matrix_client_hydrogen_enabled|bool and matrix_client_hydrogen_container_image_self_build|bool" + when: "matrix_client_hydrogen_container_image_self_build|bool" - name: Ensure Hydrogen configuration installed copy: @@ -36,7 +36,7 @@ mode: 0644 owner: "{{ matrix_user_username }}" group: "{{ matrix_user_groupname }}" - when: "matrix_client_hydrogen_enabled|bool and matrix_client_hydrogen_container_image_self_build|bool" + when: "matrix_client_hydrogen_container_image_self_build|bool" - name: Ensure Hydrogen additional config files installed template: @@ -47,7 +47,7 @@ group: "{{ matrix_user_groupname }}" with_items: - {src: "{{ role_path }}/templates/nginx.conf.j2", name: "nginx.conf"} - when: "matrix_client_hydrogen_enabled|bool and item.src is not none" + when: "item.src is not none" # This step MUST come after the steps to install the configuration files because the config files # are currently only read at build time, not at run time like most other components in the playbook @@ -60,7 +60,7 @@ dockerfile: Dockerfile path: "{{ matrix_client_hydrogen_docker_src_files_path }}" pull: yes - when: "matrix_client_hydrogen_enabled|bool and matrix_client_hydrogen_container_image_self_build|bool" + when: "matrix_client_hydrogen_container_image_self_build|bool" - name: Ensure matrix-client-hydrogen.service installed template: @@ -68,9 +68,8 @@ dest: "{{ matrix_systemd_path }}/matrix-client-hydrogen.service" mode: 0644 register: matrix_client_hydrogen_systemd_service_result - when: matrix_client_hydrogen_enabled|bool - name: Ensure systemd reloaded after matrix-client-hydrogen.service installation service: daemon_reload: yes - when: "matrix_client_hydrogen_enabled and matrix_client_hydrogen_systemd_service_result.changed" + when: "matrix_client_hydrogen_systemd_service_result.changed|bool" diff --git a/roles/matrix-client-hydrogen/tasks/setup_uninstall.yml b/roles/matrix-client-hydrogen/tasks/setup_uninstall.yml index 455b5a8d..d72f9e3f 100644 --- a/roles/matrix-client-hydrogen/tasks/setup_uninstall.yml +++ b/roles/matrix-client-hydrogen/tasks/setup_uninstall.yml @@ -4,7 +4,6 @@ stat: path: "{{ matrix_systemd_path }}/matrix-client-hydrogen.service" register: matrix_client_hydrogen_service_stat - when: "not matrix_client_hydrogen_enabled|bool" - name: Ensure matrix-client-hydrogen is stopped service: @@ -12,27 +11,25 @@ state: stopped daemon_reload: yes register: stopping_result - when: "not matrix_client_hydrogen_enabled|bool and matrix_client_hydrogen_service_stat.stat.exists" + when: "matrix_client_hydrogen_service_stat.stat.exists|bool" - name: Ensure matrix-client-hydrogen.service doesn't exist file: path: "{{ matrix_systemd_path }}/matrix-client-hydrogen.service" state: absent - when: "not matrix_client_hydrogen_enabled|bool and matrix_client_hydrogen_service_stat.stat.exists" + when: "matrix_client_hydrogen_service_stat.stat.exists|bool" - name: Ensure systemd reloaded after matrix-client-hydrogen.service removal service: daemon_reload: yes - when: "not matrix_client_hydrogen_enabled|bool and matrix_client_hydrogen_service_stat.stat.exists" + when: "matrix_client_hydrogen_service_stat.stat.exists|bool" - name: Ensure Hydrogen paths doesn't exist file: path: "{{ matrix_client_hydrogen_data_path }}" state: absent - when: "not matrix_client_hydrogen_enabled|bool" - name: Ensure Hydrogen Docker image doesn't exist docker_image: name: "{{ matrix_client_hydrogen_docker_image }}" state: absent - when: "not matrix_client_hydrogen_enabled|bool" From c8a8035de45e72f187fdd4f3736a57f3fa2f592b Mon Sep 17 00:00:00 2001 From: Slavi Pantaleev Date: Fri, 29 Oct 2021 11:13:01 +0300 Subject: [PATCH 27/86] Make it possible to self-build Element on low-memory devices (<4G RAM) Fixes https://github.com/spantaleev/matrix-docker-ansible-deploy/issues/1357 --- .../matrix-client-element/tasks/setup_install.yml | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/roles/matrix-client-element/tasks/setup_install.yml b/roles/matrix-client-element/tasks/setup_install.yml index 44124039..c8f1900f 100644 --- a/roles/matrix-client-element/tasks/setup_install.yml +++ b/roles/matrix-client-element/tasks/setup_install.yml @@ -29,6 +29,20 @@ register: matrix_client_element_git_pull_results when: "matrix_client_element_container_image_self_build|bool" +# See: +# - https://github.com/spantaleev/matrix-docker-ansible-deploy/issues/1357 +# - https://github.com/vector-im/element-web/issues/19544 +- name: Patch webpack.config.js to support building on low-memory (<4G RAM) devices + lineinfile: + path: "{{ matrix_client_element_docker_src_files_path }}/webpack.config.js" + regexp: '(\s+)splitChunks: \{' + line: '\1splitChunks: { maxSize: 100000,' + backrefs: yes + owner: root + group: root + mode: '0644' + when: "matrix_client_element_container_image_self_build|bool and ansible_memtotal_mb < 4096" + - name: Ensure Element Docker image is built docker_image: name: "{{ matrix_client_element_docker_image }}" From fc593bc8ab58c0430eea75da4df157ece5451bc9 Mon Sep 17 00:00:00 2001 From: Slavi Pantaleev Date: Sat, 30 Oct 2021 09:53:56 +0300 Subject: [PATCH 28/86] Increase shm-size for Postgres container to fix VACUUM Related to https://github.com/spantaleev/matrix-docker-ansible-deploy/issues/1268 Related to https://github.com/spantaleev/matrix-docker-ansible-deploy/issues/1364 Fixes https://github.com/spantaleev/matrix-docker-ansible-deploy/issues/1362 --- .../templates/systemd/matrix-postgres.service.j2 | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/roles/matrix-postgres/templates/systemd/matrix-postgres.service.j2 b/roles/matrix-postgres/templates/systemd/matrix-postgres.service.j2 index 6d1b1c6f..81d99fe7 100644 --- a/roles/matrix-postgres/templates/systemd/matrix-postgres.service.j2 +++ b/roles/matrix-postgres/templates/systemd/matrix-postgres.service.j2 @@ -11,6 +11,10 @@ Environment="HOME={{ matrix_systemd_unit_home_path }}" ExecStartPre=-{{ matrix_host_command_sh }} -c '{{ matrix_host_command_docker }} kill matrix-postgres 2>/dev/null' ExecStartPre=-{{ matrix_host_command_sh }} -c '{{ matrix_host_command_docker }} rm matrix-postgres 2>/dev/null' +# We need /dev/shm to be larger than the default to allow VACUUM to work. +# See: +# - https://github.com/spantaleev/matrix-docker-ansible-deploy/issues/1362 +# - https://github.com/spantaleev/matrix-docker-ansible-deploy/issues/1268 ExecStart={{ matrix_host_command_docker }} run --rm --name matrix-postgres \ --log-driver=none \ --user={{ matrix_user_uid }}:{{ matrix_user_gid }} \ @@ -18,6 +22,7 @@ ExecStart={{ matrix_host_command_docker }} run --rm --name matrix-postgres \ --read-only \ --tmpfs=/tmp:rw,noexec,nosuid,size=100m \ --tmpfs=/run/postgresql:rw,noexec,nosuid,size=100m \ + --shm-size="256m" \ --network={{ matrix_docker_network }} \ {% if matrix_postgres_container_postgres_bind_port %} -p {{ matrix_postgres_container_postgres_bind_port }}:5432 \ From 65182ea0f2958a07df79474a337309827f3bb8de Mon Sep 17 00:00:00 2001 From: "Patrick C. F. Ernzer" Date: Sat, 30 Oct 2021 13:10:39 +0200 Subject: [PATCH 29/86] fixes #1365 docker-ce does not like quotes around the shm-size value --- .../templates/systemd/matrix-postgres.service.j2 | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/roles/matrix-postgres/templates/systemd/matrix-postgres.service.j2 b/roles/matrix-postgres/templates/systemd/matrix-postgres.service.j2 index 81d99fe7..d62a689a 100644 --- a/roles/matrix-postgres/templates/systemd/matrix-postgres.service.j2 +++ b/roles/matrix-postgres/templates/systemd/matrix-postgres.service.j2 @@ -22,7 +22,7 @@ ExecStart={{ matrix_host_command_docker }} run --rm --name matrix-postgres \ --read-only \ --tmpfs=/tmp:rw,noexec,nosuid,size=100m \ --tmpfs=/run/postgresql:rw,noexec,nosuid,size=100m \ - --shm-size="256m" \ + --shm-size=256m \ --network={{ matrix_docker_network }} \ {% if matrix_postgres_container_postgres_bind_port %} -p {{ matrix_postgres_container_postgres_bind_port }}:5432 \ From c6c68e00a42b6fa54477d80a209444f2fdc6b461 Mon Sep 17 00:00:00 2001 From: PC-Admin Date: Sun, 31 Oct 2021 08:56:48 +0800 Subject: [PATCH 30/86] merge upstream --- roles/matrix-awx/surveys/bridge_discord_appservice.json.j2 | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/roles/matrix-awx/surveys/bridge_discord_appservice.json.j2 b/roles/matrix-awx/surveys/bridge_discord_appservice.json.j2 index 7252cc2c..85b00a5f 100644 --- a/roles/matrix-awx/surveys/bridge_discord_appservice.json.j2 +++ b/roles/matrix-awx/surveys/bridge_discord_appservice.json.j2 @@ -15,7 +15,7 @@ "type": "multiplechoice" }, { - "question_name": "Discord Client ID", + "question_name": "Discord OAuth2 Client ID", "question_description": "The OAuth2 'CLIENT ID' which can be found in the 'OAuth2' tab of your new discord application: https://discord.com/developers/applications", "required": true, "min": 0, From 17fc055d53f79f4cb8a9fc914419d0a9518729ba Mon Sep 17 00:00:00 2001 From: Toni Spets Date: Sun, 31 Oct 2021 18:31:31 +0200 Subject: [PATCH 31/86] Upgrade Heisenbridge (1.4.0 -> 1.4.1) --- roles/matrix-bridge-heisenbridge/defaults/main.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/roles/matrix-bridge-heisenbridge/defaults/main.yml b/roles/matrix-bridge-heisenbridge/defaults/main.yml index 2be75e20..2cb6e491 100644 --- a/roles/matrix-bridge-heisenbridge/defaults/main.yml +++ b/roles/matrix-bridge-heisenbridge/defaults/main.yml @@ -3,7 +3,7 @@ matrix_heisenbridge_enabled: true -matrix_heisenbridge_version: 1.4.0 +matrix_heisenbridge_version: 1.4.1 matrix_heisenbridge_docker_image: "{{ matrix_container_global_registry_prefix }}hif1/heisenbridge:{{ matrix_heisenbridge_version }}" matrix_heisenbridge_docker_image_force_pull: "{{ matrix_heisenbridge_docker_image.endswith(':latest') }}" From dcda17595ade9a077bb84b1474d8869e8845a4d3 Mon Sep 17 00:00:00 2001 From: b Date: Sun, 31 Oct 2021 21:06:22 +0200 Subject: [PATCH 32/86] change port 8090 to matrix_ma1sd_default_port --- group_vars/matrix_servers | 10 +++++----- roles/matrix-awx/tasks/set_variables_ma1sd.yml | 2 +- roles/matrix-ma1sd/defaults/main.yml | 3 ++- .../templates/systemd/matrix-ma1sd.service.j2 | 2 +- roles/matrix-nginx-proxy/defaults/main.yml | 12 ++++++------ 5 files changed, 15 insertions(+), 14 deletions(-) diff --git a/group_vars/matrix_servers b/group_vars/matrix_servers index 6d56307e..b5976bfa 100755 --- a/group_vars/matrix_servers +++ b/group_vars/matrix_servers @@ -1212,7 +1212,7 @@ matrix_ma1sd_container_image_self_build: "{{ matrix_architecture != 'amd64' }}" # Normally, matrix-nginx-proxy is enabled and nginx can reach ma1sd over the container network. # If matrix-nginx-proxy is not enabled, or you otherwise have a need for it, you can expose # ma1sd's web-server port. -matrix_ma1sd_container_http_host_bind_port: "{{ '' if matrix_nginx_proxy_enabled else '127.0.0.1:8090' }}" +matrix_ma1sd_container_http_host_bind_port: "{{ '' if matrix_nginx_proxy_enabled else '127.0.0.1:' + matrix_ma1sd_default_port|string }}" # We enable Synapse integration via its Postgres database by default. # When using another Identity store, you might wish to disable this and define @@ -1294,8 +1294,8 @@ matrix_nginx_proxy_proxy_matrix_corporal_api_addr_with_container: "matrix-corpor matrix_nginx_proxy_proxy_matrix_corporal_api_addr_sans_container: "127.0.0.1:41081" matrix_nginx_proxy_proxy_matrix_identity_api_enabled: "{{ matrix_ma1sd_enabled }}" -matrix_nginx_proxy_proxy_matrix_identity_api_addr_with_container: "matrix-ma1sd:8090" -matrix_nginx_proxy_proxy_matrix_identity_api_addr_sans_container: "127.0.0.1:8090" +matrix_nginx_proxy_proxy_matrix_identity_api_addr_with_container: "matrix-ma1sd:{{ matrix_ma1sd_default_port }}" +matrix_nginx_proxy_proxy_matrix_identity_api_addr_sans_container: "127.0.0.1:{{ matrix_ma1sd_default_port }}" # By default, we do TLS termination for the Matrix Federation API (port 8448) at matrix-nginx-proxy. # Unless this is handled there OR Synapse's federation listener port is disabled, we'll reverse-proxy. @@ -1709,8 +1709,8 @@ matrix_synapse_container_image_self_build: "{{ matrix_architecture not in ['arm6 # When ma1sd is enabled, we can use it to validate email addresses and phone numbers. # Synapse can validate email addresses by itself as well, but it's probably not what we want by default when we have an identity server. -matrix_synapse_account_threepid_delegates_email: "{{ 'http://matrix-ma1sd:8090' if matrix_ma1sd_enabled else '' }}" -matrix_synapse_account_threepid_delegates_msisdn: "{{ 'http://matrix-ma1sd:8090' if matrix_ma1sd_enabled else '' }}" +matrix_synapse_account_threepid_delegates_email: "{{ 'http://matrix-ma1sd:{{ matrix_ma1sd_default_port }}' if matrix_ma1sd_enabled else '' }}" +matrix_synapse_account_threepid_delegates_msisdn: "{{ 'http://matrix-ma1sd:{{ matrix_ma1sd_default_port }}' if matrix_ma1sd_enabled else '' }}" # Normally, matrix-nginx-proxy is enabled and nginx can reach Synapse over the container network. # If matrix-nginx-proxy is not enabled, or you otherwise have a need for it, diff --git a/roles/matrix-awx/tasks/set_variables_ma1sd.yml b/roles/matrix-awx/tasks/set_variables_ma1sd.yml index 0f4234f1..81012d28 100755 --- a/roles/matrix-awx/tasks/set_variables_ma1sd.yml +++ b/roles/matrix-awx/tasks/set_variables_ma1sd.yml @@ -30,7 +30,7 @@ insertafter: '# Synapse Extension Start' with_dict: 'matrix_synapse_awx_password_provider_rest_auth_enabled': 'true' - 'matrix_synapse_awx_password_provider_rest_auth_endpoint': '"http://matrix-ma1sd:8090"' + 'matrix_synapse_awx_password_provider_rest_auth_endpoint': '"http://matrix-ma1sd:{{ matrix_ma1sd_default_port }}"' when: awx_matrix_ma1sd_auth_store == 'LDAP/AD' - name: Remove entire ma1sd configuration extension diff --git a/roles/matrix-ma1sd/defaults/main.yml b/roles/matrix-ma1sd/defaults/main.yml index f91189f5..adee0b44 100644 --- a/roles/matrix-ma1sd/defaults/main.yml +++ b/roles/matrix-ma1sd/defaults/main.yml @@ -19,7 +19,8 @@ matrix_ma1sd_docker_src_files_path: "{{ matrix_ma1sd_base_path }}/docker-src/ma1 matrix_ma1sd_config_path: "{{ matrix_ma1sd_base_path }}/config" matrix_ma1sd_data_path: "{{ matrix_ma1sd_base_path }}/data" -# Controls whether the matrix-ma1sd container exposes its HTTP port (tcp/8090 in the container). +matrix_ma1sd_default_port: 8090 +# Controls whether the matrix-ma1sd container exposes its HTTP port (tcp/{{ matrix_ma1sd_default_port }} in the container). # # Takes an ":" or "" value (e.g. "127.0.0.1:8090"), or empty string to not expose. matrix_ma1sd_container_http_host_bind_port: '' diff --git a/roles/matrix-ma1sd/templates/systemd/matrix-ma1sd.service.j2 b/roles/matrix-ma1sd/templates/systemd/matrix-ma1sd.service.j2 index c2adffc0..696e8008 100644 --- a/roles/matrix-ma1sd/templates/systemd/matrix-ma1sd.service.j2 +++ b/roles/matrix-ma1sd/templates/systemd/matrix-ma1sd.service.j2 @@ -26,7 +26,7 @@ ExecStart={{ matrix_host_command_docker }} run --rm --name matrix-ma1sd \ --tmpfs=/tmp:rw,exec,nosuid,size=10m \ --network={{ matrix_docker_network }} \ {% if matrix_ma1sd_container_http_host_bind_port %} - -p {{ matrix_ma1sd_container_http_host_bind_port }}:8090 \ + -p {{ matrix_ma1sd_container_http_host_bind_port }}:{{ matrix_ma1sd_default_port }} \ {% endif %} {% if matrix_ma1sd_verbose_logging %} -e MA1SD_LOG_LEVEL=debug \ diff --git a/roles/matrix-nginx-proxy/defaults/main.yml b/roles/matrix-nginx-proxy/defaults/main.yml index 3bd273cf..ff917c90 100644 --- a/roles/matrix-nginx-proxy/defaults/main.yml +++ b/roles/matrix-nginx-proxy/defaults/main.yml @@ -165,20 +165,20 @@ matrix_nginx_proxy_proxy_matrix_corporal_api_addr_sans_container: "127.0.0.1:410 # This can be used to forward the API endpoint to another service, augmenting the functionality of Synapse's own User Directory Search. # To learn more, see: https://github.com/ma1uta/ma1sd/blob/master/docs/features/directory.md matrix_nginx_proxy_proxy_matrix_user_directory_search_enabled: false -matrix_nginx_proxy_proxy_matrix_user_directory_search_addr_with_container: "matrix-ma1sd:8090" -matrix_nginx_proxy_proxy_matrix_user_directory_search_addr_sans_container: "127.0.0.1:8090" +matrix_nginx_proxy_proxy_matrix_user_directory_search_addr_with_container: "matrix-ma1sd:{{ matrix_ma1sd_default_port }}" +matrix_nginx_proxy_proxy_matrix_user_directory_search_addr_sans_container: "127.0.0.1:{{ matrix_ma1sd_default_port }}" # Controls whether proxying for 3PID-based registration (`/_matrix/client/r0/register/(email|msisdn)/requestToken`) should be done (on the matrix domain). # This allows another service to control registrations involving 3PIDs. # To learn more, see: https://github.com/ma1uta/ma1sd/blob/master/docs/features/registration.md matrix_nginx_proxy_proxy_matrix_3pid_registration_enabled: false -matrix_nginx_proxy_proxy_matrix_3pid_registration_addr_with_container: "matrix-ma1sd:8090" -matrix_nginx_proxy_proxy_matrix_3pid_registration_addr_sans_container: "127.0.0.1:8090" +matrix_nginx_proxy_proxy_matrix_3pid_registration_addr_with_container: "matrix-ma1sd:{{ matrix_ma1sd_default_port }}" +matrix_nginx_proxy_proxy_matrix_3pid_registration_addr_sans_container: "127.0.0.1:{{ matrix_ma1sd_default_port }}" # Controls whether proxying for the Identity API (`/_matrix/identity`) should be done (on the matrix domain) matrix_nginx_proxy_proxy_matrix_identity_api_enabled: false -matrix_nginx_proxy_proxy_matrix_identity_api_addr_with_container: "matrix-ma1sd:8090" -matrix_nginx_proxy_proxy_matrix_identity_api_addr_sans_container: "127.0.0.1:8090" +matrix_nginx_proxy_proxy_matrix_identity_api_addr_with_container: "matrix-ma1sd:{{ matrix_ma1sd_default_port }}" +matrix_nginx_proxy_proxy_matrix_identity_api_addr_sans_container: "127.0.0.1:{{ matrix_ma1sd_default_port }}" # Controls whether proxying for metrics (`/_synapse/metrics`) should be done (on the matrix domain) matrix_nginx_proxy_proxy_synapse_metrics: false From 0434e3bf8f37144f725b52cc2801db7c4a6f369a Mon Sep 17 00:00:00 2001 From: Slavi Pantaleev Date: Mon, 1 Nov 2021 09:06:58 +0200 Subject: [PATCH 33/86] Allow force-patching webpack.config.js when self-building Element We were applying the low-memory system patch to webpack.config.js on systems with < 4GB memory. From now on, we also let people force-enable patching by toggling the `matrix_client_element_container_image_self_build_low_memory_system_patch_enabled` variable. Related to https://github.com/spantaleev/matrix-docker-ansible-deploy/issues/1357 --- roles/matrix-client-element/defaults/main.yml | 4 ++++ roles/matrix-client-element/tasks/setup_install.yml | 2 +- 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/roles/matrix-client-element/defaults/main.yml b/roles/matrix-client-element/defaults/main.yml index 527b17e5..104b778f 100644 --- a/roles/matrix-client-element/defaults/main.yml +++ b/roles/matrix-client-element/defaults/main.yml @@ -2,6 +2,10 @@ matrix_client_element_enabled: true matrix_client_element_container_image_self_build: false matrix_client_element_container_image_self_build_repo: "https://github.com/vector-im/riot-web.git" +# Controls whether to patch webpack.config.js when self-building, so that building can pass on low-memory systems (< 4 GB RAM): +# - https://github.com/spantaleev/matrix-docker-ansible-deploy/issues/1357 +# - https://github.com/vector-im/element-web/issues/19544 +matrix_client_element_container_image_self_build_low_memory_system_patch_enabled: "{{ ansible_memtotal_mb < 4096 }}" matrix_client_element_version: v1.9.3 matrix_client_element_docker_image: "{{ matrix_client_element_docker_image_name_prefix }}vectorim/element-web:{{ matrix_client_element_version }}" diff --git a/roles/matrix-client-element/tasks/setup_install.yml b/roles/matrix-client-element/tasks/setup_install.yml index c8f1900f..b14a0dd5 100644 --- a/roles/matrix-client-element/tasks/setup_install.yml +++ b/roles/matrix-client-element/tasks/setup_install.yml @@ -41,7 +41,7 @@ owner: root group: root mode: '0644' - when: "matrix_client_element_container_image_self_build|bool and ansible_memtotal_mb < 4096" + when: "matrix_client_element_container_image_self_build|bool and matrix_client_element_container_image_self_build_low_memory_system_patch_enabled|bool" - name: Ensure Element Docker image is built docker_image: From ff3bd12015aaf0205eebba0c8241cc9ae9607b82 Mon Sep 17 00:00:00 2001 From: Slavi Pantaleev Date: Mon, 1 Nov 2021 10:48:17 +0200 Subject: [PATCH 34/86] Upgrade devture/ansible (2.9.14-r0 -> 2.10.7-r0) --- docs/ansible.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/ansible.md b/docs/ansible.md index ff513bbf..50251540 100644 --- a/docs/ansible.md +++ b/docs/ansible.md @@ -51,7 +51,7 @@ docker run -it --rm \ -v `pwd`:/work \ -v $HOME/.ssh/id_rsa:/root/.ssh/id_rsa:ro \ --entrypoint=/bin/sh \ -docker.io/devture/ansible:2.9.14-r0 +docker.io/devture/ansible:2.10.7-r0 ``` The above command tries to mount an SSH key (`$HOME/.ssh/id_rsa`) into the container (at `/root/.ssh/id_rsa`). From 9688d071a8966a316c385b15f2406225ce1a5653 Mon Sep 17 00:00:00 2001 From: borisrunakov <93043305+borisrunakov@users.noreply.github.com> Date: Mon, 1 Nov 2021 12:02:02 +0200 Subject: [PATCH 35/86] fix matrix_synapse_account_threepid_delegates_email and matrix_synapse_account_threepid_delegates_msisdn (#1370) * fix for string concatenation on matrix_synapse_account_threepid_delegates_email and matrix_synapse_account_threepid_delegates_msisdn * .editorconfig should not be ignored * Restore .gitignore Co-authored-by: b Co-authored-by: Slavi Pantaleev --- group_vars/matrix_servers | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/group_vars/matrix_servers b/group_vars/matrix_servers index b5976bfa..d58f4dda 100755 --- a/group_vars/matrix_servers +++ b/group_vars/matrix_servers @@ -1709,8 +1709,8 @@ matrix_synapse_container_image_self_build: "{{ matrix_architecture not in ['arm6 # When ma1sd is enabled, we can use it to validate email addresses and phone numbers. # Synapse can validate email addresses by itself as well, but it's probably not what we want by default when we have an identity server. -matrix_synapse_account_threepid_delegates_email: "{{ 'http://matrix-ma1sd:{{ matrix_ma1sd_default_port }}' if matrix_ma1sd_enabled else '' }}" -matrix_synapse_account_threepid_delegates_msisdn: "{{ 'http://matrix-ma1sd:{{ matrix_ma1sd_default_port }}' if matrix_ma1sd_enabled else '' }}" +matrix_synapse_account_threepid_delegates_email: "{{ 'http://matrix-ma1sd:' + matrix_ma1sd_default_port|string if matrix_ma1sd_enabled else '' }}" +matrix_synapse_account_threepid_delegates_msisdn: "{{ 'http://matrix-ma1sd:' + matrix_ma1sd_default_port|string if matrix_ma1sd_enabled else '' }}" # Normally, matrix-nginx-proxy is enabled and nginx can reach Synapse over the container network. # If matrix-nginx-proxy is not enabled, or you otherwise have a need for it, From dae117c91bc1c17081b7b68e1cd3673d3af6c8c4 Mon Sep 17 00:00:00 2001 From: Slavi Pantaleev Date: Tue, 2 Nov 2021 15:57:18 +0200 Subject: [PATCH 36/86] Bump Hydrogen (0.2.7 -> 0.2.19) --- roles/matrix-client-hydrogen/defaults/main.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/roles/matrix-client-hydrogen/defaults/main.yml b/roles/matrix-client-hydrogen/defaults/main.yml index e84d56cf..3cfb2337 100644 --- a/roles/matrix-client-hydrogen/defaults/main.yml +++ b/roles/matrix-client-hydrogen/defaults/main.yml @@ -5,7 +5,7 @@ matrix_client_hydrogen_enabled: true matrix_client_hydrogen_container_image_self_build: true matrix_client_hydrogen_container_image_self_build_repo: "https://github.com/vector-im/hydrogen-web.git" -matrix_client_hydrogen_version: v0.2.7 +matrix_client_hydrogen_version: v0.2.19 matrix_client_hydrogen_docker_image: "{{ matrix_client_hydrogen_docker_image_name_prefix }}vectorim/hydrogen-web:{{ matrix_client_hydrogen_version }}" matrix_client_hydrogen_docker_image_name_prefix: "{{ 'localhost/' if matrix_client_hydrogen_container_image_self_build }}" matrix_client_hydrogen_docker_image_force_pull: "{{ matrix_client_hydrogen_docker_image.endswith(':latest') }}" From 7b8b595e81f9f49b233ece86f0d9b254d5b9411d Mon Sep 17 00:00:00 2001 From: Slavi Pantaleev Date: Tue, 2 Nov 2021 17:42:13 +0200 Subject: [PATCH 37/86] Upgrade Synapse (1.45.1 -> 1.46.0) --- roles/matrix-synapse/defaults/main.yml | 4 +- .../templates/synapse/homeserver.yaml.j2 | 83 ++++++++++--------- 2 files changed, 44 insertions(+), 43 deletions(-) diff --git a/roles/matrix-synapse/defaults/main.yml b/roles/matrix-synapse/defaults/main.yml index d0df4f8d..ce596c6b 100644 --- a/roles/matrix-synapse/defaults/main.yml +++ b/roles/matrix-synapse/defaults/main.yml @@ -15,8 +15,8 @@ matrix_synapse_docker_image_name_prefix: "{{ 'localhost/' if matrix_synapse_cont # amd64 gets released first. # arm32 relies on self-building, so the same version can be built immediately. # arm64 users need to wait for a prebuilt image to become available. -matrix_synapse_version: v1.45.1 -matrix_synapse_version_arm64: v1.45.1 +matrix_synapse_version: v1.46.0 +matrix_synapse_version_arm64: v1.46.0 matrix_synapse_docker_image_tag: "{{ matrix_synapse_version if matrix_architecture in ['arm32', 'amd64'] else matrix_synapse_version_arm64 }}" matrix_synapse_docker_image_force_pull: "{{ matrix_synapse_docker_image.endswith(':latest') }}" diff --git a/roles/matrix-synapse/templates/synapse/homeserver.yaml.j2 b/roles/matrix-synapse/templates/synapse/homeserver.yaml.j2 index 9e558632..cebe7a1f 100644 --- a/roles/matrix-synapse/templates/synapse/homeserver.yaml.j2 +++ b/roles/matrix-synapse/templates/synapse/homeserver.yaml.j2 @@ -492,6 +492,48 @@ redaction_retention_period: {{ matrix_synapse_redaction_retention_period }} user_ips_max_age: {{ matrix_synapse_user_ips_max_age }} +# Inhibits the /requestToken endpoints from returning an error that might leak +# information about whether an e-mail address is in use or not on this +# homeserver. +# Note that for some endpoints the error situation is the e-mail already being +# used, and for others the error is entering the e-mail being unused. +# If this option is enabled, instead of returning an error, these endpoints will +# act as if no error happened and return a fake session ID ('sid') to clients. +# +#request_token_inhibit_3pid_errors: true + +# A list of domains that the domain portion of 'next_link' parameters +# must match. +# +# This parameter is optionally provided by clients while requesting +# validation of an email or phone number, and maps to a link that +# users will be automatically redirected to after validation +# succeeds. Clients can make use this parameter to aid the validation +# process. +# +# The whitelist is applied whether the homeserver or an +# identity server is handling validation. +# +# The default value is no whitelist functionality; all domains are +# allowed. Setting this value to an empty list will instead disallow +# all domains. +# +#next_link_domain_whitelist: ["matrix.org"] + +# Templates to use when generating email or HTML page contents. +# +templates: + # Directory in which Synapse will try to find template files to use to generate + # email or HTML page contents. + # If not set, or a file is not found within the template directory, a default + # template from within the Synapse package will be used. + # + # See https://matrix-org.github.io/synapse/latest/templates.html for more + # information about using custom templates. + # + #custom_template_directory: /path/to/custom/templates/ + + # Message retention policy at the server level. # # Room admins and mods can define a retention period for their rooms using the @@ -561,47 +603,6 @@ retention: # - shortest_max_lifetime: 3d # interval: 1d -# Inhibits the /requestToken endpoints from returning an error that might leak -# information about whether an e-mail address is in use or not on this -# homeserver. -# Note that for some endpoints the error situation is the e-mail already being -# used, and for others the error is entering the e-mail being unused. -# If this option is enabled, instead of returning an error, these endpoints will -# act as if no error happened and return a fake session ID ('sid') to clients. -# -#request_token_inhibit_3pid_errors: true - -# A list of domains that the domain portion of 'next_link' parameters -# must match. -# -# This parameter is optionally provided by clients while requesting -# validation of an email or phone number, and maps to a link that -# users will be automatically redirected to after validation -# succeeds. Clients can make use this parameter to aid the validation -# process. -# -# The whitelist is applied whether the homeserver or an -# identity server is handling validation. -# -# The default value is no whitelist functionality; all domains are -# allowed. Setting this value to an empty list will instead disallow -# all domains. -# -#next_link_domain_whitelist: ["matrix.org"] - -# Templates to use when generating email or HTML page contents. -# -templates: - # Directory in which Synapse will try to find template files to use to generate - # email or HTML page contents. - # If not set, or a file is not found within the template directory, a default - # template from within the Synapse package will be used. - # - # See https://matrix-org.github.io/synapse/latest/templates.html for more - # information about using custom templates. - # - #custom_template_directory: /path/to/custom/templates/ - ## TLS ## From 967e5d6f37141da141fbd1c57544d5663cce06f9 Mon Sep 17 00:00:00 2001 From: Luca Di Carlo Date: Wed, 3 Nov 2021 21:12:06 +0100 Subject: [PATCH 38/86] chore: adding some explanations about setting prometheus password --- docs/configuring-playbook-prometheus-grafana.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/configuring-playbook-prometheus-grafana.md b/docs/configuring-playbook-prometheus-grafana.md index 4edc2a81..2bb88a3c 100644 --- a/docs/configuring-playbook-prometheus-grafana.md +++ b/docs/configuring-playbook-prometheus-grafana.md @@ -55,7 +55,7 @@ Name | Description `matrix_synapse_metrics_enabled`|Set this to `true` to make Synapse expose metrics (locally, on the container network) `matrix_nginx_proxy_proxy_synapse_metrics`|Set this to `true` to make matrix-nginx-proxy expose the Synapse metrics at `https://matrix.DOMAIN/_synapse/metrics` `matrix_nginx_proxy_proxy_synapse_metrics_basic_auth_enabled`|Set this to `true` to password-protect (using HTTP Basic Auth) `https://matrix.DOMAIN/_synapse/metrics` (the username is always `prometheus`, the password is defined in `matrix_nginx_proxy_proxy_synapse_metrics_basic_auth_key`) -`matrix_nginx_proxy_proxy_synapse_metrics_basic_auth_key`|Set this to a password to use for HTTP Basic Auth for protecting `https://matrix.DOMAIN/_synapse/metrics` (the username is always `prometheus` - it's not configurable) +`matrix_nginx_proxy_proxy_synapse_metrics_basic_auth_key`|Set this to a password to use for HTTP Basic Auth for protecting `https://matrix.DOMAIN/_synapse/metrics` (the username is always `prometheus` - it's not configurable).Do not write the password in plain text. See `man 1 htpasswd` or use `htpasswd -c mypass.htpasswd prometheus` to generate the expected hash for nginx. `matrix_server_fqn_grafana`|Use this variable to override the domain at which the Grafana web user-interface is at (defaults to `stats.DOMAIN`) ### Collecting worker metrics to an external Prometheus server From 12be1033e5fda4c8e32e96022e7bf5c977695e9d Mon Sep 17 00:00:00 2001 From: Slavi Pantaleev Date: Thu, 4 Nov 2021 00:28:58 +0200 Subject: [PATCH 39/86] Add missing space --- docs/configuring-playbook-prometheus-grafana.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/configuring-playbook-prometheus-grafana.md b/docs/configuring-playbook-prometheus-grafana.md index 2bb88a3c..892bffb2 100644 --- a/docs/configuring-playbook-prometheus-grafana.md +++ b/docs/configuring-playbook-prometheus-grafana.md @@ -55,7 +55,7 @@ Name | Description `matrix_synapse_metrics_enabled`|Set this to `true` to make Synapse expose metrics (locally, on the container network) `matrix_nginx_proxy_proxy_synapse_metrics`|Set this to `true` to make matrix-nginx-proxy expose the Synapse metrics at `https://matrix.DOMAIN/_synapse/metrics` `matrix_nginx_proxy_proxy_synapse_metrics_basic_auth_enabled`|Set this to `true` to password-protect (using HTTP Basic Auth) `https://matrix.DOMAIN/_synapse/metrics` (the username is always `prometheus`, the password is defined in `matrix_nginx_proxy_proxy_synapse_metrics_basic_auth_key`) -`matrix_nginx_proxy_proxy_synapse_metrics_basic_auth_key`|Set this to a password to use for HTTP Basic Auth for protecting `https://matrix.DOMAIN/_synapse/metrics` (the username is always `prometheus` - it's not configurable).Do not write the password in plain text. See `man 1 htpasswd` or use `htpasswd -c mypass.htpasswd prometheus` to generate the expected hash for nginx. +`matrix_nginx_proxy_proxy_synapse_metrics_basic_auth_key`|Set this to a password to use for HTTP Basic Auth for protecting `https://matrix.DOMAIN/_synapse/metrics` (the username is always `prometheus` - it's not configurable). Do not write the password in plain text. See `man 1 htpasswd` or use `htpasswd -c mypass.htpasswd prometheus` to generate the expected hash for nginx. `matrix_server_fqn_grafana`|Use this variable to override the domain at which the Grafana web user-interface is at (defaults to `stats.DOMAIN`) ### Collecting worker metrics to an external Prometheus server From 09ac6a0e8cbc5eab3e7522f24f53b72bb82ff17f Mon Sep 17 00:00:00 2001 From: Toni Spets Date: Fri, 5 Nov 2021 10:31:31 +0200 Subject: [PATCH 40/86] Upgrade Heisenbridge (1.4.1 -> 1.5.0) --- roles/matrix-bridge-heisenbridge/defaults/main.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/roles/matrix-bridge-heisenbridge/defaults/main.yml b/roles/matrix-bridge-heisenbridge/defaults/main.yml index 2cb6e491..f25f502f 100644 --- a/roles/matrix-bridge-heisenbridge/defaults/main.yml +++ b/roles/matrix-bridge-heisenbridge/defaults/main.yml @@ -3,7 +3,7 @@ matrix_heisenbridge_enabled: true -matrix_heisenbridge_version: 1.4.1 +matrix_heisenbridge_version: 1.5.0 matrix_heisenbridge_docker_image: "{{ matrix_container_global_registry_prefix }}hif1/heisenbridge:{{ matrix_heisenbridge_version }}" matrix_heisenbridge_docker_image_force_pull: "{{ matrix_heisenbridge_docker_image.endswith(':latest') }}" From 6eaa8ac65a79a3076c60b139aabfc8e382326a57 Mon Sep 17 00:00:00 2001 From: b Date: Fri, 5 Nov 2021 15:31:10 +0200 Subject: [PATCH 41/86] add server_name to matrix-synapsel.conf only if matrix_nginx_proxy_enabled --- .../templates/nginx/conf.d/matrix-synapse.conf.j2 | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/roles/matrix-nginx-proxy/templates/nginx/conf.d/matrix-synapse.conf.j2 b/roles/matrix-nginx-proxy/templates/nginx/conf.d/matrix-synapse.conf.j2 index 6f569327..30f4877c 100644 --- a/roles/matrix-nginx-proxy/templates/nginx/conf.d/matrix-synapse.conf.j2 +++ b/roles/matrix-nginx-proxy/templates/nginx/conf.d/matrix-synapse.conf.j2 @@ -62,7 +62,9 @@ server { listen 12080; - server_name {{ matrix_nginx_proxy_proxy_synapse_hostname }}; + {% if matrix_nginx_proxy_enabled %} + server_name {{ matrix_nginx_proxy_proxy_synapse_hostname }}; + {% endif %} server_tokens off; root /dev/null; @@ -194,8 +196,10 @@ server { {% if matrix_nginx_proxy_proxy_synapse_federation_api_enabled %} server { listen 12088; + {% if matrix_nginx_proxy_enabled %} + server_name {{ matrix_nginx_proxy_proxy_synapse_hostname }}; + {% endif %} - server_name {{ matrix_nginx_proxy_proxy_synapse_hostname }}; server_tokens off; root /dev/null; From 143b0f26d97b1f6ec4351434e7c2e3e3c64dadac Mon Sep 17 00:00:00 2001 From: Slavi Pantaleev Date: Mon, 8 Nov 2021 10:34:09 +0200 Subject: [PATCH 42/86] Restore usage of some _environment_variables_extension Jitsi variables Fixes https://github.com/spantaleev/matrix-docker-ansible-deploy/issues/1377 Regresion since https://github.com/spantaleev/matrix-docker-ansible-deploy/pull/1139 --- roles/matrix-jitsi/templates/jvb/env.j2 | 4 +++- roles/matrix-jitsi/templates/web/env.j2 | 4 +++- 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/roles/matrix-jitsi/templates/jvb/env.j2 b/roles/matrix-jitsi/templates/jvb/env.j2 index a927314e..6edae6d4 100644 --- a/roles/matrix-jitsi/templates/jvb/env.j2 +++ b/roles/matrix-jitsi/templates/jvb/env.j2 @@ -22,4 +22,6 @@ JVB_OCTO_BIND_ADDRESS JVB_OCTO_PUBLIC_ADDRESS JVB_OCTO_BIND_PORT JVB_OCTO_REGION -TZ={{ matrix_jitsi_timezone }} \ No newline at end of file +TZ={{ matrix_jitsi_timezone }} + +{{ matrix_jitsi_jvb_environment_variables_extension }} diff --git a/roles/matrix-jitsi/templates/web/env.j2 b/roles/matrix-jitsi/templates/web/env.j2 index c4faa5ba..2ff6befc 100644 --- a/roles/matrix-jitsi/templates/web/env.j2 +++ b/roles/matrix-jitsi/templates/web/env.j2 @@ -91,4 +91,6 @@ XMPP_DOMAIN={{ matrix_jitsi_xmpp_domain }} XMPP_GUEST_DOMAIN={{ matrix_jitsi_xmpp_guest_domain }} XMPP_MUC_DOMAIN={{ matrix_jitsi_xmpp_muc_domain }} XMPP_RECORDER_DOMAIN={{ matrix_jitsi_recorder_domain }} -TOKEN_AUTH_URL \ No newline at end of file +TOKEN_AUTH_URL + +{{ matrix_jitsi_web_environment_variables_extension }} From 367cddb715dcd75cb5e1bb9eca2cce997b69fc25 Mon Sep 17 00:00:00 2001 From: teutat3s <10206665+teutat3s@users.noreply.github.com> Date: Tue, 9 Nov 2021 15:01:18 +0100 Subject: [PATCH 43/86] Upgrade Element (v1.9.4) --- roles/matrix-client-element/defaults/main.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/roles/matrix-client-element/defaults/main.yml b/roles/matrix-client-element/defaults/main.yml index 104b778f..1273859d 100644 --- a/roles/matrix-client-element/defaults/main.yml +++ b/roles/matrix-client-element/defaults/main.yml @@ -7,7 +7,7 @@ matrix_client_element_container_image_self_build_repo: "https://github.com/vecto # - https://github.com/vector-im/element-web/issues/19544 matrix_client_element_container_image_self_build_low_memory_system_patch_enabled: "{{ ansible_memtotal_mb < 4096 }}" -matrix_client_element_version: v1.9.3 +matrix_client_element_version: v1.9.4 matrix_client_element_docker_image: "{{ matrix_client_element_docker_image_name_prefix }}vectorim/element-web:{{ matrix_client_element_version }}" matrix_client_element_docker_image_name_prefix: "{{ 'localhost/' if matrix_client_element_container_image_self_build else matrix_container_global_registry_prefix }}" matrix_client_element_docker_image_force_pull: "{{ matrix_client_element_docker_image.endswith(':latest') }}" From 735c966ab69cc8aa141a341426ad401631417dac Mon Sep 17 00:00:00 2001 From: Slavi Pantaleev Date: Wed, 10 Nov 2021 17:39:21 +0200 Subject: [PATCH 44/86] Disable systemd services when stopping to uninstall them Until now, we were leaving services "enabled" (symlinks in /etc/systemd/system/multi-user.target.wants/). We clean these up now. Broken symlinks may still exist in older installations that enabled/disabled services. We're not taking care to fix these up. It's just a cosmetic defect anyway. --- roles/matrix-bot-go-neb/tasks/setup_uninstall.yml | 1 + roles/matrix-bot-matrix-reminder-bot/tasks/setup_uninstall.yml | 1 + roles/matrix-bot-mjolnir/tasks/setup_uninstall.yml | 1 + roles/matrix-bridge-appservice-discord/tasks/setup_install.yml | 1 + .../matrix-bridge-appservice-discord/tasks/setup_uninstall.yml | 1 + roles/matrix-bridge-appservice-irc/tasks/setup_uninstall.yml | 1 + roles/matrix-bridge-appservice-slack/tasks/setup_uninstall.yml | 1 + .../tasks/setup_uninstall.yml | 1 + roles/matrix-bridge-beeper-linkedin/tasks/setup_uninstall.yml | 1 + roles/matrix-bridge-heisenbridge/tasks/setup_uninstall.yml | 1 + roles/matrix-bridge-mautrix-facebook/tasks/setup_install.yml | 1 + roles/matrix-bridge-mautrix-facebook/tasks/setup_uninstall.yml | 1 + roles/matrix-bridge-mautrix-googlechat/tasks/setup_install.yml | 1 + .../matrix-bridge-mautrix-googlechat/tasks/setup_uninstall.yml | 1 + roles/matrix-bridge-mautrix-hangouts/tasks/setup_install.yml | 1 + roles/matrix-bridge-mautrix-hangouts/tasks/setup_uninstall.yml | 1 + .../matrix-bridge-mautrix-instagram/tasks/setup_uninstall.yml | 1 + roles/matrix-bridge-mautrix-signal/tasks/setup_uninstall.yml | 2 ++ roles/matrix-bridge-mautrix-telegram/tasks/setup_install.yml | 1 + roles/matrix-bridge-mautrix-telegram/tasks/setup_uninstall.yml | 1 + roles/matrix-bridge-mautrix-whatsapp/tasks/setup_install.yml | 1 + roles/matrix-bridge-mautrix-whatsapp/tasks/setup_uninstall.yml | 1 + .../matrix-bridge-mx-puppet-discord/tasks/setup_uninstall.yml | 1 + roles/matrix-bridge-mx-puppet-groupme/tasks/setup_install.yml | 1 + .../matrix-bridge-mx-puppet-groupme/tasks/setup_uninstall.yml | 1 + .../tasks/setup_uninstall.yml | 1 + roles/matrix-bridge-mx-puppet-skype/tasks/setup_install.yml | 1 + roles/matrix-bridge-mx-puppet-skype/tasks/setup_uninstall.yml | 1 + roles/matrix-bridge-mx-puppet-slack/tasks/setup_install.yml | 1 + roles/matrix-bridge-mx-puppet-slack/tasks/setup_uninstall.yml | 1 + roles/matrix-bridge-mx-puppet-steam/tasks/setup_install.yml | 1 + roles/matrix-bridge-mx-puppet-steam/tasks/setup_uninstall.yml | 1 + roles/matrix-bridge-mx-puppet-twitter/tasks/setup_install.yml | 1 + .../matrix-bridge-mx-puppet-twitter/tasks/setup_uninstall.yml | 1 + roles/matrix-bridge-sms/tasks/setup_uninstall.yml | 3 ++- roles/matrix-client-element/tasks/migrate_riot_web.yml | 1 + roles/matrix-client-element/tasks/setup_uninstall.yml | 1 + roles/matrix-client-hydrogen/tasks/setup_uninstall.yml | 1 + roles/matrix-corporal/tasks/setup_corporal.yml | 1 + roles/matrix-coturn/tasks/setup_uninstall.yml | 2 ++ roles/matrix-dimension/tasks/setup_uninstall.yml | 1 + roles/matrix-dynamic-dns/tasks/uninstall.yml | 1 + roles/matrix-email2matrix/tasks/setup_uninstall.yml | 1 + roles/matrix-etherpad/tasks/setup_uninstall.yml | 1 + roles/matrix-grafana/tasks/setup.yml | 1 + roles/matrix-jitsi/tasks/setup_jitsi_jicofo.yml | 1 + roles/matrix-jitsi/tasks/setup_jitsi_jvb.yml | 1 + roles/matrix-jitsi/tasks/setup_jitsi_prosody.yml | 1 + roles/matrix-jitsi/tasks/setup_jitsi_web.yml | 1 + roles/matrix-ma1sd/tasks/migrate_mxisd.yml | 1 + roles/matrix-ma1sd/tasks/setup_uninstall.yml | 1 + roles/matrix-mailer/tasks/setup_mailer.yml | 1 + roles/matrix-nginx-proxy/tasks/setup_nginx_proxy.yml | 1 + roles/matrix-postgres-backup/tasks/setup_postgres_backup.yml | 1 + .../matrix-postgres/tasks/migrate_postgres_data_directory.yml | 2 +- roles/matrix-prometheus-node-exporter/tasks/setup.yml | 1 + roles/matrix-prometheus-postgres-exporter/tasks/setup.yml | 1 + roles/matrix-prometheus/tasks/setup_uninstall.yml | 1 + roles/matrix-redis/tasks/setup_redis.yml | 1 + roles/matrix-registration/tasks/setup_uninstall.yml | 1 + roles/matrix-sygnal/tasks/setup_uninstall.yml | 1 + roles/matrix-synapse-admin/tasks/setup.yml | 1 + roles/matrix-synapse/tasks/goofys/setup_uninstall.yml | 1 + roles/matrix-synapse/tasks/import_media_store.yml | 1 + roles/matrix-synapse/tasks/synapse/setup_uninstall.yml | 1 + 65 files changed, 68 insertions(+), 2 deletions(-) diff --git a/roles/matrix-bot-go-neb/tasks/setup_uninstall.yml b/roles/matrix-bot-go-neb/tasks/setup_uninstall.yml index 49ad1fe7..3610eb44 100644 --- a/roles/matrix-bot-go-neb/tasks/setup_uninstall.yml +++ b/roles/matrix-bot-go-neb/tasks/setup_uninstall.yml @@ -9,6 +9,7 @@ service: name: matrix-bot-go-neb state: stopped + enabled: no daemon_reload: yes register: stopping_result when: "matrix_bot_go_neb_service_stat.stat.exists|bool" diff --git a/roles/matrix-bot-matrix-reminder-bot/tasks/setup_uninstall.yml b/roles/matrix-bot-matrix-reminder-bot/tasks/setup_uninstall.yml index 141e61ba..d7e41201 100644 --- a/roles/matrix-bot-matrix-reminder-bot/tasks/setup_uninstall.yml +++ b/roles/matrix-bot-matrix-reminder-bot/tasks/setup_uninstall.yml @@ -9,6 +9,7 @@ service: name: matrix-bot-matrix-reminder-bot state: stopped + enabled: no daemon_reload: yes register: stopping_result when: "matrix_bot_matrix_reminder_bot_service_stat.stat.exists|bool" diff --git a/roles/matrix-bot-mjolnir/tasks/setup_uninstall.yml b/roles/matrix-bot-mjolnir/tasks/setup_uninstall.yml index 7127543e..7fff5e13 100644 --- a/roles/matrix-bot-mjolnir/tasks/setup_uninstall.yml +++ b/roles/matrix-bot-mjolnir/tasks/setup_uninstall.yml @@ -9,6 +9,7 @@ service: name: matrix-bot-mjolnir state: stopped + enabled: no daemon_reload: yes register: stopping_result when: "matrix_bot_mjolnir_service_stat.stat.exists|bool" diff --git a/roles/matrix-bridge-appservice-discord/tasks/setup_install.yml b/roles/matrix-bridge-appservice-discord/tasks/setup_install.yml index 6d3fdd0f..546e5043 100644 --- a/roles/matrix-bridge-appservice-discord/tasks/setup_install.yml +++ b/roles/matrix-bridge-appservice-discord/tasks/setup_install.yml @@ -54,6 +54,7 @@ service: name: matrix-appservice-discord state: stopped + enabled: no daemon_reload: yes failed_when: false when: "matrix_appservice_discord_stat_db.stat.exists" diff --git a/roles/matrix-bridge-appservice-discord/tasks/setup_uninstall.yml b/roles/matrix-bridge-appservice-discord/tasks/setup_uninstall.yml index 4e8c1fdc..5dd8075d 100644 --- a/roles/matrix-bridge-appservice-discord/tasks/setup_uninstall.yml +++ b/roles/matrix-bridge-appservice-discord/tasks/setup_uninstall.yml @@ -9,6 +9,7 @@ service: name: matrix-appservice-discord state: stopped + enabled: no daemon_reload: yes when: "matrix_appservice_discord_service_stat.stat.exists" diff --git a/roles/matrix-bridge-appservice-irc/tasks/setup_uninstall.yml b/roles/matrix-bridge-appservice-irc/tasks/setup_uninstall.yml index 2b5e5dfd..51507817 100644 --- a/roles/matrix-bridge-appservice-irc/tasks/setup_uninstall.yml +++ b/roles/matrix-bridge-appservice-irc/tasks/setup_uninstall.yml @@ -9,6 +9,7 @@ service: name: matrix-appservice-irc state: stopped + enabled: no daemon_reload: yes when: "matrix_appservice_irc_service_stat.stat.exists" diff --git a/roles/matrix-bridge-appservice-slack/tasks/setup_uninstall.yml b/roles/matrix-bridge-appservice-slack/tasks/setup_uninstall.yml index 0b83d02e..2dfe1c7b 100644 --- a/roles/matrix-bridge-appservice-slack/tasks/setup_uninstall.yml +++ b/roles/matrix-bridge-appservice-slack/tasks/setup_uninstall.yml @@ -9,6 +9,7 @@ service: name: matrix-appservice-slack state: stopped + enabled: no daemon_reload: yes when: "matrix_appservice_slack_service_stat.stat.exists" diff --git a/roles/matrix-bridge-appservice-webhooks/tasks/setup_uninstall.yml b/roles/matrix-bridge-appservice-webhooks/tasks/setup_uninstall.yml index d8e973ce..81440b88 100644 --- a/roles/matrix-bridge-appservice-webhooks/tasks/setup_uninstall.yml +++ b/roles/matrix-bridge-appservice-webhooks/tasks/setup_uninstall.yml @@ -9,6 +9,7 @@ service: name: matrix-appservice-webhooks state: stopped + enabled: no daemon_reload: yes when: "matrix_appservice_webhooks_service_stat.stat.exists" diff --git a/roles/matrix-bridge-beeper-linkedin/tasks/setup_uninstall.yml b/roles/matrix-bridge-beeper-linkedin/tasks/setup_uninstall.yml index 004b788e..175613f0 100644 --- a/roles/matrix-bridge-beeper-linkedin/tasks/setup_uninstall.yml +++ b/roles/matrix-bridge-beeper-linkedin/tasks/setup_uninstall.yml @@ -9,6 +9,7 @@ service: name: matrix-beeper-linkedin state: stopped + enabled: no daemon_reload: yes when: "matrix_beeper_linkedin_service_stat.stat.exists" diff --git a/roles/matrix-bridge-heisenbridge/tasks/setup_uninstall.yml b/roles/matrix-bridge-heisenbridge/tasks/setup_uninstall.yml index 853faf7a..cf100a89 100644 --- a/roles/matrix-bridge-heisenbridge/tasks/setup_uninstall.yml +++ b/roles/matrix-bridge-heisenbridge/tasks/setup_uninstall.yml @@ -9,6 +9,7 @@ service: name: matrix-heisenbridge state: stopped + enabled: no daemon_reload: yes when: "matrix_heisenbridge_service_stat.stat.exists" diff --git a/roles/matrix-bridge-mautrix-facebook/tasks/setup_install.yml b/roles/matrix-bridge-mautrix-facebook/tasks/setup_install.yml index fb9dcca4..d5230bca 100644 --- a/roles/matrix-bridge-mautrix-facebook/tasks/setup_install.yml +++ b/roles/matrix-bridge-mautrix-facebook/tasks/setup_install.yml @@ -86,6 +86,7 @@ service: name: matrix-mautrix-facebook state: stopped + enabled: no daemon_reload: yes failed_when: false when: "matrix_mautrix_facebook_stat_database.stat.exists" diff --git a/roles/matrix-bridge-mautrix-facebook/tasks/setup_uninstall.yml b/roles/matrix-bridge-mautrix-facebook/tasks/setup_uninstall.yml index efc8aa74..abbce350 100644 --- a/roles/matrix-bridge-mautrix-facebook/tasks/setup_uninstall.yml +++ b/roles/matrix-bridge-mautrix-facebook/tasks/setup_uninstall.yml @@ -9,6 +9,7 @@ service: name: matrix-mautrix-facebook state: stopped + enabled: no daemon_reload: yes when: "matrix_mautrix_facebook_service_stat.stat.exists" diff --git a/roles/matrix-bridge-mautrix-googlechat/tasks/setup_install.yml b/roles/matrix-bridge-mautrix-googlechat/tasks/setup_install.yml index f68ee505..293e8817 100644 --- a/roles/matrix-bridge-mautrix-googlechat/tasks/setup_install.yml +++ b/roles/matrix-bridge-mautrix-googlechat/tasks/setup_install.yml @@ -85,6 +85,7 @@ service: name: matrix-mautrix-googlechat state: stopped + enabled: no daemon_reload: yes failed_when: false when: "matrix_mautrix_googlechat_stat_database.stat.exists" diff --git a/roles/matrix-bridge-mautrix-googlechat/tasks/setup_uninstall.yml b/roles/matrix-bridge-mautrix-googlechat/tasks/setup_uninstall.yml index d3adb7e2..bdcaa6e7 100644 --- a/roles/matrix-bridge-mautrix-googlechat/tasks/setup_uninstall.yml +++ b/roles/matrix-bridge-mautrix-googlechat/tasks/setup_uninstall.yml @@ -9,6 +9,7 @@ service: name: matrix-mautrix-googlechat state: stopped + enabled: no daemon_reload: yes when: "matrix_mautrix_googlechat_service_stat.stat.exists" diff --git a/roles/matrix-bridge-mautrix-hangouts/tasks/setup_install.yml b/roles/matrix-bridge-mautrix-hangouts/tasks/setup_install.yml index d5373134..fb5236fd 100644 --- a/roles/matrix-bridge-mautrix-hangouts/tasks/setup_install.yml +++ b/roles/matrix-bridge-mautrix-hangouts/tasks/setup_install.yml @@ -85,6 +85,7 @@ service: name: matrix-mautrix-hangouts state: stopped + enabled: no daemon_reload: yes failed_when: false when: "matrix_mautrix_hangouts_stat_database.stat.exists" diff --git a/roles/matrix-bridge-mautrix-hangouts/tasks/setup_uninstall.yml b/roles/matrix-bridge-mautrix-hangouts/tasks/setup_uninstall.yml index 14413e94..34348cfd 100644 --- a/roles/matrix-bridge-mautrix-hangouts/tasks/setup_uninstall.yml +++ b/roles/matrix-bridge-mautrix-hangouts/tasks/setup_uninstall.yml @@ -9,6 +9,7 @@ service: name: matrix-mautrix-hangouts state: stopped + enabled: no daemon_reload: yes when: "matrix_mautrix_hangouts_service_stat.stat.exists" diff --git a/roles/matrix-bridge-mautrix-instagram/tasks/setup_uninstall.yml b/roles/matrix-bridge-mautrix-instagram/tasks/setup_uninstall.yml index c5c8a3e6..02e20b61 100644 --- a/roles/matrix-bridge-mautrix-instagram/tasks/setup_uninstall.yml +++ b/roles/matrix-bridge-mautrix-instagram/tasks/setup_uninstall.yml @@ -8,6 +8,7 @@ service: name: matrix-mautrix-instagram state: stopped + enabled: no daemon_reload: yes when: "matrix_mautrix_instagram_service_stat.stat.exists" diff --git a/roles/matrix-bridge-mautrix-signal/tasks/setup_uninstall.yml b/roles/matrix-bridge-mautrix-signal/tasks/setup_uninstall.yml index 2ca6a9a9..b36ef81d 100644 --- a/roles/matrix-bridge-mautrix-signal/tasks/setup_uninstall.yml +++ b/roles/matrix-bridge-mautrix-signal/tasks/setup_uninstall.yml @@ -10,6 +10,7 @@ service: name: matrix-mautrix-signal-daemon state: stopped + enabled: no daemon_reload: yes when: "matrix_mautrix_signal_daemon_service_stat.stat.exists" @@ -29,6 +30,7 @@ service: name: matrix-mautrix-signal state: stopped + enabled: no daemon_reload: yes when: "matrix_mautrix_signal_service_stat.stat.exists" diff --git a/roles/matrix-bridge-mautrix-telegram/tasks/setup_install.yml b/roles/matrix-bridge-mautrix-telegram/tasks/setup_install.yml index e2e583f2..1e87f1ae 100644 --- a/roles/matrix-bridge-mautrix-telegram/tasks/setup_install.yml +++ b/roles/matrix-bridge-mautrix-telegram/tasks/setup_install.yml @@ -107,6 +107,7 @@ service: name: matrix-mautrix-telegram state: stopped + enabled: no daemon_reload: yes failed_when: false when: "matrix_mautrix_telegram_stat_database.stat.exists" diff --git a/roles/matrix-bridge-mautrix-telegram/tasks/setup_uninstall.yml b/roles/matrix-bridge-mautrix-telegram/tasks/setup_uninstall.yml index b14bd737..bc84edbb 100644 --- a/roles/matrix-bridge-mautrix-telegram/tasks/setup_uninstall.yml +++ b/roles/matrix-bridge-mautrix-telegram/tasks/setup_uninstall.yml @@ -9,6 +9,7 @@ service: name: matrix-mautrix-telegram state: stopped + enabled: no daemon_reload: yes when: "matrix_mautrix_telegram_service_stat.stat.exists" diff --git a/roles/matrix-bridge-mautrix-whatsapp/tasks/setup_install.yml b/roles/matrix-bridge-mautrix-whatsapp/tasks/setup_install.yml index f3dd0570..ddd49dd0 100644 --- a/roles/matrix-bridge-mautrix-whatsapp/tasks/setup_install.yml +++ b/roles/matrix-bridge-mautrix-whatsapp/tasks/setup_install.yml @@ -93,6 +93,7 @@ service: name: matrix-mautrix-whatsapp state: stopped + enabled: no daemon_reload: yes failed_when: false when: "matrix_mautrix_whatsapp_stat_database.stat.exists" diff --git a/roles/matrix-bridge-mautrix-whatsapp/tasks/setup_uninstall.yml b/roles/matrix-bridge-mautrix-whatsapp/tasks/setup_uninstall.yml index 93f5c4c8..7dd4b402 100644 --- a/roles/matrix-bridge-mautrix-whatsapp/tasks/setup_uninstall.yml +++ b/roles/matrix-bridge-mautrix-whatsapp/tasks/setup_uninstall.yml @@ -9,6 +9,7 @@ service: name: matrix-mautrix-whatsapp state: stopped + enabled: no daemon_reload: yes when: "matrix_mautrix_whatsapp_service_stat.stat.exists" diff --git a/roles/matrix-bridge-mx-puppet-discord/tasks/setup_uninstall.yml b/roles/matrix-bridge-mx-puppet-discord/tasks/setup_uninstall.yml index b5b83c98..a0298ad9 100644 --- a/roles/matrix-bridge-mx-puppet-discord/tasks/setup_uninstall.yml +++ b/roles/matrix-bridge-mx-puppet-discord/tasks/setup_uninstall.yml @@ -9,6 +9,7 @@ service: name: matrix-mx-puppet-discord state: stopped + enabled: no daemon_reload: yes when: "matrix_mx_puppet_discord_service_stat.stat.exists" diff --git a/roles/matrix-bridge-mx-puppet-groupme/tasks/setup_install.yml b/roles/matrix-bridge-mx-puppet-groupme/tasks/setup_install.yml index b1d5f0b5..3ed4867c 100644 --- a/roles/matrix-bridge-mx-puppet-groupme/tasks/setup_install.yml +++ b/roles/matrix-bridge-mx-puppet-groupme/tasks/setup_install.yml @@ -31,6 +31,7 @@ service: name: matrix-mx-puppet-groupme state: stopped + enabled: no daemon_reload: yes failed_when: false when: "matrix_mx_puppet_groupme_stat_database.stat.exists" diff --git a/roles/matrix-bridge-mx-puppet-groupme/tasks/setup_uninstall.yml b/roles/matrix-bridge-mx-puppet-groupme/tasks/setup_uninstall.yml index cc4fdfa5..f9ecce58 100644 --- a/roles/matrix-bridge-mx-puppet-groupme/tasks/setup_uninstall.yml +++ b/roles/matrix-bridge-mx-puppet-groupme/tasks/setup_uninstall.yml @@ -9,6 +9,7 @@ service: name: matrix-mx-puppet-groupme state: stopped + enabled: no daemon_reload: yes when: "matrix_mx_puppet_groupme_service_stat.stat.exists" diff --git a/roles/matrix-bridge-mx-puppet-instagram/tasks/setup_uninstall.yml b/roles/matrix-bridge-mx-puppet-instagram/tasks/setup_uninstall.yml index 4b5e67ac..9ad4e13d 100644 --- a/roles/matrix-bridge-mx-puppet-instagram/tasks/setup_uninstall.yml +++ b/roles/matrix-bridge-mx-puppet-instagram/tasks/setup_uninstall.yml @@ -9,6 +9,7 @@ service: name: matrix-mx-puppet-instagram state: stopped + enabled: no daemon_reload: yes when: "matrix_mx_puppet_instagram_service_stat.stat.exists" diff --git a/roles/matrix-bridge-mx-puppet-skype/tasks/setup_install.yml b/roles/matrix-bridge-mx-puppet-skype/tasks/setup_install.yml index 997a6317..a39e7acf 100644 --- a/roles/matrix-bridge-mx-puppet-skype/tasks/setup_install.yml +++ b/roles/matrix-bridge-mx-puppet-skype/tasks/setup_install.yml @@ -31,6 +31,7 @@ service: name: matrix-mx-puppet-skype state: stopped + enabled: no daemon_reload: yes failed_when: false when: "matrix_mx_puppet_skype_stat_database.stat.exists" diff --git a/roles/matrix-bridge-mx-puppet-skype/tasks/setup_uninstall.yml b/roles/matrix-bridge-mx-puppet-skype/tasks/setup_uninstall.yml index 72b3a945..a1af7e33 100644 --- a/roles/matrix-bridge-mx-puppet-skype/tasks/setup_uninstall.yml +++ b/roles/matrix-bridge-mx-puppet-skype/tasks/setup_uninstall.yml @@ -9,6 +9,7 @@ service: name: matrix-mx-puppet-skype state: stopped + enabled: no daemon_reload: yes when: "matrix_mx_puppet_skype_service_stat.stat.exists" diff --git a/roles/matrix-bridge-mx-puppet-slack/tasks/setup_install.yml b/roles/matrix-bridge-mx-puppet-slack/tasks/setup_install.yml index d816ceeb..8ef8ac4e 100644 --- a/roles/matrix-bridge-mx-puppet-slack/tasks/setup_install.yml +++ b/roles/matrix-bridge-mx-puppet-slack/tasks/setup_install.yml @@ -31,6 +31,7 @@ service: name: matrix-mx-puppet-slack state: stopped + enabled: no daemon_reload: yes failed_when: false when: "matrix_mx_puppet_slack_stat_database.stat.exists" diff --git a/roles/matrix-bridge-mx-puppet-slack/tasks/setup_uninstall.yml b/roles/matrix-bridge-mx-puppet-slack/tasks/setup_uninstall.yml index 73314a66..f6e7d33e 100644 --- a/roles/matrix-bridge-mx-puppet-slack/tasks/setup_uninstall.yml +++ b/roles/matrix-bridge-mx-puppet-slack/tasks/setup_uninstall.yml @@ -9,6 +9,7 @@ service: name: matrix-mx-puppet-slack state: stopped + enabled: no daemon_reload: yes when: "matrix_mx_puppet_slack_service_stat.stat.exists" diff --git a/roles/matrix-bridge-mx-puppet-steam/tasks/setup_install.yml b/roles/matrix-bridge-mx-puppet-steam/tasks/setup_install.yml index 3bcef36e..a92d63fb 100644 --- a/roles/matrix-bridge-mx-puppet-steam/tasks/setup_install.yml +++ b/roles/matrix-bridge-mx-puppet-steam/tasks/setup_install.yml @@ -31,6 +31,7 @@ service: name: matrix-mx-puppet-steam state: stopped + enabled: no daemon_reload: yes failed_when: false when: "matrix_mx_puppet_steam_stat_database.stat.exists" diff --git a/roles/matrix-bridge-mx-puppet-steam/tasks/setup_uninstall.yml b/roles/matrix-bridge-mx-puppet-steam/tasks/setup_uninstall.yml index 1ee95eb3..608bde73 100644 --- a/roles/matrix-bridge-mx-puppet-steam/tasks/setup_uninstall.yml +++ b/roles/matrix-bridge-mx-puppet-steam/tasks/setup_uninstall.yml @@ -9,6 +9,7 @@ service: name: matrix-mx-puppet-steam state: stopped + enabled: no daemon_reload: yes when: "matrix_mx_puppet_steam_service_stat.stat.exists" diff --git a/roles/matrix-bridge-mx-puppet-twitter/tasks/setup_install.yml b/roles/matrix-bridge-mx-puppet-twitter/tasks/setup_install.yml index 5767ed17..a6250a16 100644 --- a/roles/matrix-bridge-mx-puppet-twitter/tasks/setup_install.yml +++ b/roles/matrix-bridge-mx-puppet-twitter/tasks/setup_install.yml @@ -31,6 +31,7 @@ service: name: matrix-mx-puppet-twitter state: stopped + enabled: no daemon_reload: yes failed_when: false when: "matrix_mx_puppet_twitter_stat_database.stat.exists" diff --git a/roles/matrix-bridge-mx-puppet-twitter/tasks/setup_uninstall.yml b/roles/matrix-bridge-mx-puppet-twitter/tasks/setup_uninstall.yml index 1d663531..1382ee58 100644 --- a/roles/matrix-bridge-mx-puppet-twitter/tasks/setup_uninstall.yml +++ b/roles/matrix-bridge-mx-puppet-twitter/tasks/setup_uninstall.yml @@ -9,6 +9,7 @@ service: name: matrix-mx-puppet-twitter state: stopped + enabled: no daemon_reload: yes when: "matrix_mx_puppet_twitter_service_stat.stat.exists" diff --git a/roles/matrix-bridge-sms/tasks/setup_uninstall.yml b/roles/matrix-bridge-sms/tasks/setup_uninstall.yml index 03ddaad0..ad8442bc 100644 --- a/roles/matrix-bridge-sms/tasks/setup_uninstall.yml +++ b/roles/matrix-bridge-sms/tasks/setup_uninstall.yml @@ -9,6 +9,7 @@ service: name: matrix-sms-bridge state: stopped + enabled: no daemon_reload: yes when: "matrix_sms_bridge_service_stat.stat.exists" @@ -16,4 +17,4 @@ file: path: "{{ matrix_systemd_path }}/matrix-sms-bridge.service" state: absent - when: "matrix_sms_bridge_service_stat.stat.exists" \ No newline at end of file + when: "matrix_sms_bridge_service_stat.stat.exists" diff --git a/roles/matrix-client-element/tasks/migrate_riot_web.yml b/roles/matrix-client-element/tasks/migrate_riot_web.yml index dd0eb0f8..304e9fbf 100644 --- a/roles/matrix-client-element/tasks/migrate_riot_web.yml +++ b/roles/matrix-client-element/tasks/migrate_riot_web.yml @@ -10,6 +10,7 @@ service: name: matrix-riot-web state: stopped + enabled: no daemon_reload: yes register: stopping_result when: "matrix_client_element_enabled|bool and matrix_client_riot_web_service_stat.stat.exists" diff --git a/roles/matrix-client-element/tasks/setup_uninstall.yml b/roles/matrix-client-element/tasks/setup_uninstall.yml index 74a4720e..82805b78 100644 --- a/roles/matrix-client-element/tasks/setup_uninstall.yml +++ b/roles/matrix-client-element/tasks/setup_uninstall.yml @@ -9,6 +9,7 @@ service: name: matrix-client-element state: stopped + enabled: no daemon_reload: yes register: stopping_result when: "matrix_client_element_service_stat.stat.exists|bool" diff --git a/roles/matrix-client-hydrogen/tasks/setup_uninstall.yml b/roles/matrix-client-hydrogen/tasks/setup_uninstall.yml index d72f9e3f..64d20166 100644 --- a/roles/matrix-client-hydrogen/tasks/setup_uninstall.yml +++ b/roles/matrix-client-hydrogen/tasks/setup_uninstall.yml @@ -9,6 +9,7 @@ service: name: matrix-client-hydrogen state: stopped + enabled: no daemon_reload: yes register: stopping_result when: "matrix_client_hydrogen_service_stat.stat.exists|bool" diff --git a/roles/matrix-corporal/tasks/setup_corporal.yml b/roles/matrix-corporal/tasks/setup_corporal.yml index e668de27..8e007c4f 100644 --- a/roles/matrix-corporal/tasks/setup_corporal.yml +++ b/roles/matrix-corporal/tasks/setup_corporal.yml @@ -83,6 +83,7 @@ service: name: matrix-corporal state: stopped + enabled: no daemon_reload: yes register: stopping_result when: "not matrix_corporal_enabled|bool and matrix_corporal_service_stat.stat.exists" diff --git a/roles/matrix-coturn/tasks/setup_uninstall.yml b/roles/matrix-coturn/tasks/setup_uninstall.yml index 4674903f..b642c6d0 100644 --- a/roles/matrix-coturn/tasks/setup_uninstall.yml +++ b/roles/matrix-coturn/tasks/setup_uninstall.yml @@ -10,6 +10,7 @@ service: name: matrix-coturn state: stopped + enabled: no daemon_reload: yes when: "matrix_coturn_service_stat.stat.exists|bool" @@ -17,6 +18,7 @@ service: name: matrix-coturn state: stopped + enabled: no daemon_reload: yes failed_when: false when: "matrix_coturn_service_stat.stat.exists|bool" diff --git a/roles/matrix-dimension/tasks/setup_uninstall.yml b/roles/matrix-dimension/tasks/setup_uninstall.yml index 9bc4ac8b..21f34df0 100644 --- a/roles/matrix-dimension/tasks/setup_uninstall.yml +++ b/roles/matrix-dimension/tasks/setup_uninstall.yml @@ -9,6 +9,7 @@ service: name: matrix-dimension state: stopped + enabled: no daemon_reload: yes register: stopping_result when: "matrix_dimension_service_stat.stat.exists|bool" diff --git a/roles/matrix-dynamic-dns/tasks/uninstall.yml b/roles/matrix-dynamic-dns/tasks/uninstall.yml index f3caba25..9d511051 100644 --- a/roles/matrix-dynamic-dns/tasks/uninstall.yml +++ b/roles/matrix-dynamic-dns/tasks/uninstall.yml @@ -9,6 +9,7 @@ service: name: matrix-dynamic-dns state: stopped + enabled: no daemon_reload: yes when: "matrix_dynamic_dns_service_stat.stat.exists" diff --git a/roles/matrix-email2matrix/tasks/setup_uninstall.yml b/roles/matrix-email2matrix/tasks/setup_uninstall.yml index b0b44cca..270b9250 100644 --- a/roles/matrix-email2matrix/tasks/setup_uninstall.yml +++ b/roles/matrix-email2matrix/tasks/setup_uninstall.yml @@ -9,6 +9,7 @@ service: name: matrix-email2matrix state: stopped + enabled: no daemon_reload: yes register: stopping_result when: "matrix_email2matrix_service_stat.stat.exists|bool" diff --git a/roles/matrix-etherpad/tasks/setup_uninstall.yml b/roles/matrix-etherpad/tasks/setup_uninstall.yml index 8f40f420..a63d3fb1 100644 --- a/roles/matrix-etherpad/tasks/setup_uninstall.yml +++ b/roles/matrix-etherpad/tasks/setup_uninstall.yml @@ -9,6 +9,7 @@ service: name: matrix-etherpad state: stopped + enabled: no daemon_reload: yes register: stopping_result when: "matrix_etherpad_service_stat.stat.exists|bool" diff --git a/roles/matrix-grafana/tasks/setup.yml b/roles/matrix-grafana/tasks/setup.yml index 00d2e230..c5cee64c 100644 --- a/roles/matrix-grafana/tasks/setup.yml +++ b/roles/matrix-grafana/tasks/setup.yml @@ -93,6 +93,7 @@ service: name: matrix-grafana state: stopped + enabled: no daemon_reload: yes register: stopping_result when: "not matrix_grafana_enabled|bool and matrix_grafana_service_stat.stat.exists" diff --git a/roles/matrix-jitsi/tasks/setup_jitsi_jicofo.yml b/roles/matrix-jitsi/tasks/setup_jitsi_jicofo.yml index dd2a7bd2..4e2be696 100644 --- a/roles/matrix-jitsi/tasks/setup_jitsi_jicofo.yml +++ b/roles/matrix-jitsi/tasks/setup_jitsi_jicofo.yml @@ -68,6 +68,7 @@ service: name: matrix-jitsi-jicofo state: stopped + enabled: no daemon_reload: yes register: stopping_result when: "not matrix_jitsi_enabled|bool and matrix_jitsi_jicofo_service_stat.stat.exists" diff --git a/roles/matrix-jitsi/tasks/setup_jitsi_jvb.yml b/roles/matrix-jitsi/tasks/setup_jitsi_jvb.yml index b73426db..558a6cf1 100644 --- a/roles/matrix-jitsi/tasks/setup_jitsi_jvb.yml +++ b/roles/matrix-jitsi/tasks/setup_jitsi_jvb.yml @@ -68,6 +68,7 @@ service: name: matrix-jitsi-jvb state: stopped + enabled: no daemon_reload: yes register: stopping_result when: "not matrix_jitsi_enabled|bool and matrix_jitsi_jvb_service_stat.stat.exists" diff --git a/roles/matrix-jitsi/tasks/setup_jitsi_prosody.yml b/roles/matrix-jitsi/tasks/setup_jitsi_prosody.yml index fd051fda..39a571ae 100644 --- a/roles/matrix-jitsi/tasks/setup_jitsi_prosody.yml +++ b/roles/matrix-jitsi/tasks/setup_jitsi_prosody.yml @@ -59,6 +59,7 @@ service: name: matrix-jitsi-prosody state: stopped + enabled: no daemon_reload: yes register: stopping_result when: "not matrix_jitsi_enabled|bool and matrix_jitsi_prosody_service_stat.stat.exists" diff --git a/roles/matrix-jitsi/tasks/setup_jitsi_web.yml b/roles/matrix-jitsi/tasks/setup_jitsi_web.yml index 2b8a2cd2..4fdcc67b 100644 --- a/roles/matrix-jitsi/tasks/setup_jitsi_web.yml +++ b/roles/matrix-jitsi/tasks/setup_jitsi_web.yml @@ -69,6 +69,7 @@ service: name: matrix-jitsi-web state: stopped + enabled: no daemon_reload: yes register: stopping_result when: "not matrix_jitsi_enabled|bool and matrix_jitsi_web_service_stat.stat.exists" diff --git a/roles/matrix-ma1sd/tasks/migrate_mxisd.yml b/roles/matrix-ma1sd/tasks/migrate_mxisd.yml index 1d966204..c36c3de9 100644 --- a/roles/matrix-ma1sd/tasks/migrate_mxisd.yml +++ b/roles/matrix-ma1sd/tasks/migrate_mxisd.yml @@ -23,6 +23,7 @@ service: name: matrix-mxisd state: stopped + enabled: no daemon_reload: yes when: "matrix_mxisd_service_stat.stat.exists" diff --git a/roles/matrix-ma1sd/tasks/setup_uninstall.yml b/roles/matrix-ma1sd/tasks/setup_uninstall.yml index b36ab508..153f6e08 100644 --- a/roles/matrix-ma1sd/tasks/setup_uninstall.yml +++ b/roles/matrix-ma1sd/tasks/setup_uninstall.yml @@ -9,6 +9,7 @@ service: name: matrix-ma1sd state: stopped + enabled: no daemon_reload: yes register: stopping_result when: "matrix_ma1sd_service_stat.stat.exists|bool" diff --git a/roles/matrix-mailer/tasks/setup_mailer.yml b/roles/matrix-mailer/tasks/setup_mailer.yml index 251a52da..def17883 100644 --- a/roles/matrix-mailer/tasks/setup_mailer.yml +++ b/roles/matrix-mailer/tasks/setup_mailer.yml @@ -79,6 +79,7 @@ service: name: matrix-mailer state: stopped + enabled: no daemon_reload: yes register: stopping_result when: "not matrix_mailer_enabled|bool and matrix_mailer_service_stat.stat.exists" diff --git a/roles/matrix-nginx-proxy/tasks/setup_nginx_proxy.yml b/roles/matrix-nginx-proxy/tasks/setup_nginx_proxy.yml index e577491b..d325d2f0 100644 --- a/roles/matrix-nginx-proxy/tasks/setup_nginx_proxy.yml +++ b/roles/matrix-nginx-proxy/tasks/setup_nginx_proxy.yml @@ -193,6 +193,7 @@ service: name: matrix-nginx-proxy state: stopped + enabled: no daemon_reload: yes register: stopping_result when: "not matrix_nginx_proxy_enabled|bool and matrix_nginx_proxy_service_stat.stat.exists" diff --git a/roles/matrix-postgres-backup/tasks/setup_postgres_backup.yml b/roles/matrix-postgres-backup/tasks/setup_postgres_backup.yml index 9761088d..68eae443 100644 --- a/roles/matrix-postgres-backup/tasks/setup_postgres_backup.yml +++ b/roles/matrix-postgres-backup/tasks/setup_postgres_backup.yml @@ -69,6 +69,7 @@ service: name: matrix-postgres-backup state: stopped + enabled: no daemon_reload: yes when: "not matrix_postgres_backup_enabled|bool and matrix_postgres_backup_service_stat.stat.exists" diff --git a/roles/matrix-postgres/tasks/migrate_postgres_data_directory.yml b/roles/matrix-postgres/tasks/migrate_postgres_data_directory.yml index ef5fbf47..e62feee3 100644 --- a/roles/matrix-postgres/tasks/migrate_postgres_data_directory.yml +++ b/roles/matrix-postgres/tasks/migrate_postgres_data_directory.yml @@ -69,4 +69,4 @@ - name: Ensure systemd reloaded after getting rid of outdated matrix-postgres.service service: daemon_reload: yes - when: "result_pg_old_data_dir_stat.stat.exists" \ No newline at end of file + when: "result_pg_old_data_dir_stat.stat.exists" diff --git a/roles/matrix-prometheus-node-exporter/tasks/setup.yml b/roles/matrix-prometheus-node-exporter/tasks/setup.yml index 34086e6c..fa8eb767 100644 --- a/roles/matrix-prometheus-node-exporter/tasks/setup.yml +++ b/roles/matrix-prometheus-node-exporter/tasks/setup.yml @@ -38,6 +38,7 @@ service: name: matrix-prometheus-node-exporter state: stopped + enabled: no daemon_reload: yes register: stopping_result when: "not matrix_prometheus_node_exporter_enabled|bool and matrix_prometheus_node_exporter_service_stat.stat.exists" diff --git a/roles/matrix-prometheus-postgres-exporter/tasks/setup.yml b/roles/matrix-prometheus-postgres-exporter/tasks/setup.yml index 076ece1a..37743b66 100644 --- a/roles/matrix-prometheus-postgres-exporter/tasks/setup.yml +++ b/roles/matrix-prometheus-postgres-exporter/tasks/setup.yml @@ -38,6 +38,7 @@ service: name: matrix-prometheus-postgres-exporter state: stopped + enabled: no daemon_reload: yes register: stopping_result when: "not matrix_prometheus_postgres_exporter_enabled|bool and matrix_prometheus_postgres_exporter_service_stat.stat.exists" diff --git a/roles/matrix-prometheus/tasks/setup_uninstall.yml b/roles/matrix-prometheus/tasks/setup_uninstall.yml index dd46a222..d99c1a8e 100644 --- a/roles/matrix-prometheus/tasks/setup_uninstall.yml +++ b/roles/matrix-prometheus/tasks/setup_uninstall.yml @@ -9,6 +9,7 @@ service: name: matrix-prometheus state: stopped + enabled: no daemon_reload: yes register: stopping_result when: "matrix_prometheus_service_stat.stat.exists|bool" diff --git a/roles/matrix-redis/tasks/setup_redis.yml b/roles/matrix-redis/tasks/setup_redis.yml index 6f00282b..f1f32238 100644 --- a/roles/matrix-redis/tasks/setup_redis.yml +++ b/roles/matrix-redis/tasks/setup_redis.yml @@ -72,6 +72,7 @@ service: name: matrix-redis state: stopped + enabled: no daemon_reload: yes when: "not matrix_redis_enabled|bool and matrix_redis_service_stat.stat.exists" diff --git a/roles/matrix-registration/tasks/setup_uninstall.yml b/roles/matrix-registration/tasks/setup_uninstall.yml index 573f8170..8afd1084 100644 --- a/roles/matrix-registration/tasks/setup_uninstall.yml +++ b/roles/matrix-registration/tasks/setup_uninstall.yml @@ -9,6 +9,7 @@ service: name: matrix-registration state: stopped + enabled: no daemon_reload: yes register: stopping_result when: "matrix_registration_service_stat.stat.exists|bool" diff --git a/roles/matrix-sygnal/tasks/setup_uninstall.yml b/roles/matrix-sygnal/tasks/setup_uninstall.yml index dc50078c..f2b6133f 100644 --- a/roles/matrix-sygnal/tasks/setup_uninstall.yml +++ b/roles/matrix-sygnal/tasks/setup_uninstall.yml @@ -9,6 +9,7 @@ service: name: matrix-sygnal state: stopped + enabled: no daemon_reload: yes register: stopping_result when: "matrix_sygnal_service_stat.stat.exists|bool" diff --git a/roles/matrix-synapse-admin/tasks/setup.yml b/roles/matrix-synapse-admin/tasks/setup.yml index 6fb47fb3..d54583af 100644 --- a/roles/matrix-synapse-admin/tasks/setup.yml +++ b/roles/matrix-synapse-admin/tasks/setup.yml @@ -59,6 +59,7 @@ service: name: matrix-synapse-admin state: stopped + enabled: no daemon_reload: yes register: stopping_result when: "not matrix_synapse_admin_enabled|bool and matrix_synapse_admin_service_stat.stat.exists" diff --git a/roles/matrix-synapse/tasks/goofys/setup_uninstall.yml b/roles/matrix-synapse/tasks/goofys/setup_uninstall.yml index 91d43456..317a5371 100644 --- a/roles/matrix-synapse/tasks/goofys/setup_uninstall.yml +++ b/roles/matrix-synapse/tasks/goofys/setup_uninstall.yml @@ -7,6 +7,7 @@ service: name: matrix-goofys state: stopped + enabled: no daemon_reload: yes register: stopping_result when: "matrix_goofys_service_stat.stat.exists" diff --git a/roles/matrix-synapse/tasks/import_media_store.yml b/roles/matrix-synapse/tasks/import_media_store.yml index 487bcb35..42455b44 100644 --- a/roles/matrix-synapse/tasks/import_media_store.yml +++ b/roles/matrix-synapse/tasks/import_media_store.yml @@ -44,6 +44,7 @@ service: name: matrix-synapse state: stopped + enabled: no daemon_reload: yes register: stopping_result diff --git a/roles/matrix-synapse/tasks/synapse/setup_uninstall.yml b/roles/matrix-synapse/tasks/synapse/setup_uninstall.yml index f1cdf167..070856e4 100644 --- a/roles/matrix-synapse/tasks/synapse/setup_uninstall.yml +++ b/roles/matrix-synapse/tasks/synapse/setup_uninstall.yml @@ -7,6 +7,7 @@ service: name: matrix-synapse state: stopped + enabled: no daemon_reload: yes register: stopping_result when: "matrix_synapse_service_stat.stat.exists" From 7a4f49c457e6346989152b0679907a51d25c631c Mon Sep 17 00:00:00 2001 From: sakkiii Date: Wed, 10 Nov 2021 22:52:23 +0530 Subject: [PATCH 45/86] Nginx Minio Update (1.21.3 -> 1.21.4) --- roles/matrix-nginx-proxy/defaults/main.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/roles/matrix-nginx-proxy/defaults/main.yml b/roles/matrix-nginx-proxy/defaults/main.yml index ff917c90..e3c19d86 100644 --- a/roles/matrix-nginx-proxy/defaults/main.yml +++ b/roles/matrix-nginx-proxy/defaults/main.yml @@ -1,5 +1,5 @@ matrix_nginx_proxy_enabled: true -matrix_nginx_proxy_version: 1.21.3-alpine +matrix_nginx_proxy_version: 1.21.4-alpine # We use an official nginx image, which we fix-up to run unprivileged. # An alternative would be an `nginxinc/nginx-unprivileged` image, but From cd26af2f6fac44b49f4cd9f098e16a64c89104fe Mon Sep 17 00:00:00 2001 From: sakkiii Date: Wed, 10 Nov 2021 22:58:45 +0530 Subject: [PATCH 46/86] Certbot Update (v1.20.0 -> v1.21.0) --- roles/matrix-nginx-proxy/defaults/main.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/roles/matrix-nginx-proxy/defaults/main.yml b/roles/matrix-nginx-proxy/defaults/main.yml index e3c19d86..3bb2723d 100644 --- a/roles/matrix-nginx-proxy/defaults/main.yml +++ b/roles/matrix-nginx-proxy/defaults/main.yml @@ -437,7 +437,7 @@ matrix_ssl_additional_domains_to_obtain_certificates_for: [] # Controls whether to obtain production or staging certificates from Let's Encrypt. matrix_ssl_lets_encrypt_staging: false -matrix_ssl_lets_encrypt_certbot_docker_image: "{{ matrix_container_global_registry_prefix }}certbot/certbot:{{ matrix_ssl_architecture }}-v1.20.0" +matrix_ssl_lets_encrypt_certbot_docker_image: "{{ matrix_container_global_registry_prefix }}certbot/certbot:{{ matrix_ssl_architecture }}-v1.21.0" matrix_ssl_lets_encrypt_certbot_docker_image_force_pull: "{{ matrix_ssl_lets_encrypt_certbot_docker_image.endswith(':latest') }}" matrix_ssl_lets_encrypt_certbot_standalone_http_port: 2402 matrix_ssl_lets_encrypt_support_email: ~ From c4d2c8394ca90facc7605ab2bc16b4cc993b0c84 Mon Sep 17 00:00:00 2001 From: Slavi Pantaleev Date: Thu, 11 Nov 2021 15:42:34 +0200 Subject: [PATCH 47/86] Abort if on an unsupported Postgres version (v9.6) Official support ends today (2021-11-11). Synapse still supports v9.6, but we'd better force users to transition to newer versions anyway. --- roles/matrix-postgres/tasks/setup_postgres.yml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/roles/matrix-postgres/tasks/setup_postgres.yml b/roles/matrix-postgres/tasks/setup_postgres.yml index 4294bc11..96a20d25 100644 --- a/roles/matrix-postgres/tasks/setup_postgres.yml +++ b/roles/matrix-postgres/tasks/setup_postgres.yml @@ -18,6 +18,11 @@ matrix_postgres_docker_image_to_use: "{{ matrix_postgres_docker_image_latest if matrix_postgres_detected_version_corresponding_docker_image == '' else matrix_postgres_detected_version_corresponding_docker_image }}" when: matrix_postgres_enabled|bool +- name: Abort if on an unsupported Postgres version + fail: + msg: "You're on Postgres {{ matrix_postgres_detected_version }}, which is no longer supported. To upgrade, see docs/maintenance-postgres.md" + when: "matrix_postgres_enabled|bool and matrix_postgres_detected_version.startswith('9.')" + - name: Inject warning if on an old version of Postgres set_fact: matrix_playbook_runtime_results: | From b19576030188381b353766e90f63117ac1e165a7 Mon Sep 17 00:00:00 2001 From: Slavi Pantaleev Date: Thu, 11 Nov 2021 16:04:11 +0200 Subject: [PATCH 48/86] Mention dropped Postgres v9.6 support in the changelog Related to c4d2c8394ca90f --- CHANGELOG.md | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index c706b4a6..7e124159 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,3 +1,12 @@ +# 2021-11-11 + +## Dropped support for Postgres v9.6 + +Postgres v9.6 reached its end of life today, so the playbook will refuse to run for you if you're still on that version. + +Synapse still supports v9.6 (for now), but we're retiring support for it early, to avoid having to maintain support for so many Postgres versions. Users that are still on Postgres v9.6 can easily [upgrade Postgres](docs/maintenance-postgres.md#upgrading-postgresql) via the playbook. + + # 2021-10-23 ## Hangouts bridge no longer updated, superseded by a Googlechat bridge From f01b9c386519e8967bc01ee32bec39bfcbc682b7 Mon Sep 17 00:00:00 2001 From: Toni Spets Date: Fri, 12 Nov 2021 04:50:29 +0200 Subject: [PATCH 49/86] Upgrade Heisenbridge (1.5.0 -> 1.6.0) --- roles/matrix-bridge-heisenbridge/defaults/main.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/roles/matrix-bridge-heisenbridge/defaults/main.yml b/roles/matrix-bridge-heisenbridge/defaults/main.yml index f25f502f..9a87a6da 100644 --- a/roles/matrix-bridge-heisenbridge/defaults/main.yml +++ b/roles/matrix-bridge-heisenbridge/defaults/main.yml @@ -3,7 +3,7 @@ matrix_heisenbridge_enabled: true -matrix_heisenbridge_version: 1.5.0 +matrix_heisenbridge_version: 1.6.0 matrix_heisenbridge_docker_image: "{{ matrix_container_global_registry_prefix }}hif1/heisenbridge:{{ matrix_heisenbridge_version }}" matrix_heisenbridge_docker_image_force_pull: "{{ matrix_heisenbridge_docker_image.endswith(':latest') }}" From c0656448f75d9fc09b6b290a7d987da2a1c76b4a Mon Sep 17 00:00:00 2001 From: JokerGermany <30293477+JokerGermany@users.noreply.github.com> Date: Sat, 13 Nov 2021 01:18:22 +0100 Subject: [PATCH 50/86] Port 80 for IPv6 --- .../templates/nginx/conf.d/matrix-base-domain.conf.j2 | 1 + .../templates/nginx/conf.d/matrix-bot-go-neb.conf.j2 | 4 +++- .../templates/nginx/conf.d/matrix-client-element.conf.j2 | 2 ++ .../templates/nginx/conf.d/matrix-client-hydrogen.conf.j2 | 2 ++ .../templates/nginx/conf.d/matrix-dimension.conf.j2 | 4 +++- .../templates/nginx/conf.d/matrix-domain.conf.j2 | 2 ++ .../templates/nginx/conf.d/matrix-grafana.conf.j2 | 6 ++++-- .../templates/nginx/conf.d/matrix-jitsi.conf.j2 | 2 ++ .../templates/nginx/conf.d/matrix-riot-web.conf.j2 | 2 ++ .../templates/nginx/conf.d/matrix-sygnal.conf.j2 | 2 ++ 10 files changed, 23 insertions(+), 4 deletions(-) diff --git a/roles/matrix-nginx-proxy/templates/nginx/conf.d/matrix-base-domain.conf.j2 b/roles/matrix-nginx-proxy/templates/nginx/conf.d/matrix-base-domain.conf.j2 index b0294283..3aff997d 100644 --- a/roles/matrix-nginx-proxy/templates/nginx/conf.d/matrix-base-domain.conf.j2 +++ b/roles/matrix-nginx-proxy/templates/nginx/conf.d/matrix-base-domain.conf.j2 @@ -36,6 +36,7 @@ server { listen {{ 8080 if matrix_nginx_proxy_enabled else 80 }}; + listen [::]:{{ 8080 if matrix_nginx_proxy_enabled else 80 }}; server_name {{ matrix_nginx_proxy_base_domain_hostname }}; server_tokens off; diff --git a/roles/matrix-nginx-proxy/templates/nginx/conf.d/matrix-bot-go-neb.conf.j2 b/roles/matrix-nginx-proxy/templates/nginx/conf.d/matrix-bot-go-neb.conf.j2 index 6cb5f57a..79269f43 100644 --- a/roles/matrix-nginx-proxy/templates/nginx/conf.d/matrix-bot-go-neb.conf.j2 +++ b/roles/matrix-nginx-proxy/templates/nginx/conf.d/matrix-bot-go-neb.conf.j2 @@ -33,6 +33,8 @@ server { listen {{ 8080 if matrix_nginx_proxy_enabled else 80 }}; + listen [::]:{{ 8080 if matrix_nginx_proxy_enabled else 80 }}; + server_name {{ matrix_nginx_proxy_proxy_bot_go_neb_hostname }}; server_tokens off; @@ -83,7 +85,7 @@ server { ssl_stapling_verify on; ssl_trusted_certificate {{ matrix_ssl_config_dir_path }}/live/{{ matrix_nginx_proxy_proxy_bot_go_neb_hostname }}/chain.pem; {% endif %} - + {% if matrix_nginx_proxy_ssl_session_tickets_off %} ssl_session_tickets off; {% endif %} diff --git a/roles/matrix-nginx-proxy/templates/nginx/conf.d/matrix-client-element.conf.j2 b/roles/matrix-nginx-proxy/templates/nginx/conf.d/matrix-client-element.conf.j2 index 2f4f4aa1..095d5fcf 100644 --- a/roles/matrix-nginx-proxy/templates/nginx/conf.d/matrix-client-element.conf.j2 +++ b/roles/matrix-nginx-proxy/templates/nginx/conf.d/matrix-client-element.conf.j2 @@ -41,6 +41,8 @@ server { listen {{ 8080 if matrix_nginx_proxy_enabled else 80 }}; + listen [::]:{{ 8080 if matrix_nginx_proxy_enabled else 80 }}; + server_name {{ matrix_nginx_proxy_proxy_element_hostname }}; diff --git a/roles/matrix-nginx-proxy/templates/nginx/conf.d/matrix-client-hydrogen.conf.j2 b/roles/matrix-nginx-proxy/templates/nginx/conf.d/matrix-client-hydrogen.conf.j2 index 1ea4a344..c0794205 100644 --- a/roles/matrix-nginx-proxy/templates/nginx/conf.d/matrix-client-hydrogen.conf.j2 +++ b/roles/matrix-nginx-proxy/templates/nginx/conf.d/matrix-client-hydrogen.conf.j2 @@ -39,6 +39,8 @@ server { listen {{ 8080 if matrix_nginx_proxy_enabled else 80 }}; + listen [::]:{{ 8080 if matrix_nginx_proxy_enabled else 80 }}; + server_name {{ matrix_nginx_proxy_proxy_hydrogen_hostname }}; diff --git a/roles/matrix-nginx-proxy/templates/nginx/conf.d/matrix-dimension.conf.j2 b/roles/matrix-nginx-proxy/templates/nginx/conf.d/matrix-dimension.conf.j2 index ef8ee972..292cc4c2 100644 --- a/roles/matrix-nginx-proxy/templates/nginx/conf.d/matrix-dimension.conf.j2 +++ b/roles/matrix-nginx-proxy/templates/nginx/conf.d/matrix-dimension.conf.j2 @@ -36,6 +36,8 @@ server { listen {{ 8080 if matrix_nginx_proxy_enabled else 80 }}; + listen [::]:{{ 8080 if matrix_nginx_proxy_enabled else 80 }}; + server_name {{ matrix_nginx_proxy_proxy_dimension_hostname }}; server_tokens off; @@ -86,7 +88,7 @@ server { ssl_stapling_verify on; ssl_trusted_certificate {{ matrix_ssl_config_dir_path }}/live/{{ matrix_nginx_proxy_proxy_dimension_hostname }}/chain.pem; {% endif %} - + {% if matrix_nginx_proxy_ssl_session_tickets_off %} ssl_session_tickets off; {% endif %} diff --git a/roles/matrix-nginx-proxy/templates/nginx/conf.d/matrix-domain.conf.j2 b/roles/matrix-nginx-proxy/templates/nginx/conf.d/matrix-domain.conf.j2 index b6506b43..02201b9c 100644 --- a/roles/matrix-nginx-proxy/templates/nginx/conf.d/matrix-domain.conf.j2 +++ b/roles/matrix-nginx-proxy/templates/nginx/conf.d/matrix-domain.conf.j2 @@ -161,6 +161,8 @@ server { listen {{ 8080 if matrix_nginx_proxy_enabled else 80 }}; + listen [::]:{{ 8080 if matrix_nginx_proxy_enabled else 80 }}; + server_name {{ matrix_nginx_proxy_proxy_matrix_hostname }}; server_tokens off; diff --git a/roles/matrix-nginx-proxy/templates/nginx/conf.d/matrix-grafana.conf.j2 b/roles/matrix-nginx-proxy/templates/nginx/conf.d/matrix-grafana.conf.j2 index 0f7c43c5..209c1cd0 100644 --- a/roles/matrix-nginx-proxy/templates/nginx/conf.d/matrix-grafana.conf.j2 +++ b/roles/matrix-nginx-proxy/templates/nginx/conf.d/matrix-grafana.conf.j2 @@ -43,6 +43,8 @@ server { listen {{ 8080 if matrix_nginx_proxy_enabled else 80 }}; + listen [::]:{{ 8080 if matrix_nginx_proxy_enabled else 80 }}; + server_name {{ matrix_nginx_proxy_proxy_grafana_hostname }}; @@ -94,12 +96,12 @@ server { ssl_stapling_verify on; ssl_trusted_certificate {{ matrix_ssl_config_dir_path }}/live/{{ matrix_nginx_proxy_proxy_grafana_hostname }}/chain.pem; {% endif %} - + {% if matrix_nginx_proxy_ssl_session_tickets_off %} ssl_session_tickets off; {% endif %} ssl_session_cache {{ matrix_nginx_proxy_ssl_session_cache }}; - ssl_session_timeout {{ matrix_nginx_proxy_ssl_session_timeout }}; + ssl_session_timeout {{ matrix_nginx_proxy_ssl_session_timeout }}; {{ render_vhost_directives() }} } diff --git a/roles/matrix-nginx-proxy/templates/nginx/conf.d/matrix-jitsi.conf.j2 b/roles/matrix-nginx-proxy/templates/nginx/conf.d/matrix-jitsi.conf.j2 index 86d95453..7fccce94 100644 --- a/roles/matrix-nginx-proxy/templates/nginx/conf.d/matrix-jitsi.conf.j2 +++ b/roles/matrix-nginx-proxy/templates/nginx/conf.d/matrix-jitsi.conf.j2 @@ -78,6 +78,8 @@ server { listen {{ 8080 if matrix_nginx_proxy_enabled else 80 }}; + listen [::]:{{ 8080 if matrix_nginx_proxy_enabled else 80 }}; + server_name {{ matrix_nginx_proxy_proxy_jitsi_hostname }}; server_tokens off; diff --git a/roles/matrix-nginx-proxy/templates/nginx/conf.d/matrix-riot-web.conf.j2 b/roles/matrix-nginx-proxy/templates/nginx/conf.d/matrix-riot-web.conf.j2 index d153d5c2..5bcbeba5 100644 --- a/roles/matrix-nginx-proxy/templates/nginx/conf.d/matrix-riot-web.conf.j2 +++ b/roles/matrix-nginx-proxy/templates/nginx/conf.d/matrix-riot-web.conf.j2 @@ -24,6 +24,8 @@ server { listen {{ 8080 if matrix_nginx_proxy_enabled else 80 }}; + listen [::]:{{ 8080 if matrix_nginx_proxy_enabled else 80 }}; + server_name {{ matrix_nginx_proxy_proxy_riot_compat_redirect_hostname }}; diff --git a/roles/matrix-nginx-proxy/templates/nginx/conf.d/matrix-sygnal.conf.j2 b/roles/matrix-nginx-proxy/templates/nginx/conf.d/matrix-sygnal.conf.j2 index 9c4af1d9..ba442b37 100644 --- a/roles/matrix-nginx-proxy/templates/nginx/conf.d/matrix-sygnal.conf.j2 +++ b/roles/matrix-nginx-proxy/templates/nginx/conf.d/matrix-sygnal.conf.j2 @@ -35,6 +35,8 @@ server { listen {{ 8080 if matrix_nginx_proxy_enabled else 80 }}; + listen [::]:{{ 8080 if matrix_nginx_proxy_enabled else 80 }}; + server_name {{ matrix_nginx_proxy_proxy_sygnal_hostname }}; server_tokens off; From 7756cc4c8ee05612c53660122131be399328d0c5 Mon Sep 17 00:00:00 2001 From: b Date: Sun, 14 Nov 2021 20:30:13 +0200 Subject: [PATCH 51/86] replace port 8048 with matrix_synapse_container_default_federation_port --- group_vars/matrix_servers | 3 ++- roles/matrix-dimension/defaults/main.yml | 2 +- roles/matrix-nginx-proxy/defaults/main.yml | 4 ++-- roles/matrix-synapse/defaults/main.yml | 2 +- roles/matrix-synapse/templates/synapse/homeserver.yaml.j2 | 2 +- .../templates/synapse/systemd/matrix-synapse.service.j2 | 2 +- 6 files changed, 8 insertions(+), 7 deletions(-) diff --git a/group_vars/matrix_servers b/group_vars/matrix_servers index d58f4dda..cfca8c92 100755 --- a/group_vars/matrix_servers +++ b/group_vars/matrix_servers @@ -1720,7 +1720,8 @@ matrix_synapse_account_threepid_delegates_msisdn: "{{ 'http://matrix-ma1sd:' + m matrix_synapse_container_client_api_host_bind_port: "{{ '' if matrix_nginx_proxy_enabled else '127.0.0.1:8008' }}" # # For exposing the Matrix Federation API's plain port (plain HTTP) to the local host. -matrix_synapse_container_federation_api_plain_host_bind_port: "{{ '' if matrix_nginx_proxy_enabled else '127.0.0.1:8048' }}" +matrix_synapse_container_default_federation_port: 8048 +matrix_synapse_container_federation_api_plain_host_bind_port: "{{ '' if matrix_nginx_proxy_enabled else '127.0.0.1:' + matrix_synapse_container_default_federation_port|string }}" # # For exposing the Matrix Federation API's TLS port (HTTPS) to the internet on all network interfaces. matrix_synapse_container_federation_api_tls_host_bind_port: "{{ matrix_federation_public_port if (matrix_synapse_federation_enabled and matrix_synapse_tls_federation_listener_enabled) else '' }}" diff --git a/roles/matrix-dimension/defaults/main.yml b/roles/matrix-dimension/defaults/main.yml index f7a84ca1..a5e0bf1a 100644 --- a/roles/matrix-dimension/defaults/main.yml +++ b/roles/matrix-dimension/defaults/main.yml @@ -39,7 +39,7 @@ matrix_dimension_integrations_rest_url: "https://{{ matrix_server_fqn_dimension matrix_dimension_integrations_widgets_urls: ["https://{{ matrix_server_fqn_dimension }}/widgets"] matrix_dimension_integrations_jitsi_widget_url: "https://{{ matrix_server_fqn_dimension }}/widgets/jitsi" -matrix_dimension_homeserver_federationUrl: "http://matrix-synapse:8048" +matrix_dimension_homeserver_federationUrl: ""http://matrix-synapse:{{matrix_synapse_container_default_federation_port|string}}"" # Database-related configuration fields. diff --git a/roles/matrix-nginx-proxy/defaults/main.yml b/roles/matrix-nginx-proxy/defaults/main.yml index 3bb2723d..af549b94 100644 --- a/roles/matrix-nginx-proxy/defaults/main.yml +++ b/roles/matrix-nginx-proxy/defaults/main.yml @@ -116,8 +116,8 @@ matrix_nginx_proxy_proxy_synapse_enabled: false matrix_nginx_proxy_proxy_synapse_hostname: "matrix-nginx-proxy" matrix_nginx_proxy_proxy_synapse_federation_api_enabled: "{{ matrix_nginx_proxy_proxy_matrix_federation_api_enabled }}" # The addresses where the Federation API is, when using Synapse. -matrix_nginx_proxy_proxy_synapse_federation_api_addr_with_container: "matrix-synapse:8048" -matrix_nginx_proxy_proxy_synapse_federation_api_addr_sans_container: "localhost:8048" +matrix_nginx_proxy_proxy_synapse_federation_api_addr_with_container: "matrix-synapse:{{matrix_synapse_container_default_federation_port|string}}" +matrix_nginx_proxy_proxy_synapse_federation_api_addr_sans_container: "localhost:{{matrix_synapse_container_default_federation_port|string}}" # Controls whether proxying the Element domain should be done. matrix_nginx_proxy_proxy_element_enabled: false diff --git a/roles/matrix-synapse/defaults/main.yml b/roles/matrix-synapse/defaults/main.yml index ce596c6b..eb9d8e66 100644 --- a/roles/matrix-synapse/defaults/main.yml +++ b/roles/matrix-synapse/defaults/main.yml @@ -146,7 +146,7 @@ matrix_synapse_federation_rr_transactions_per_room_per_second: 50 # Controls whether the TLS federation listener is enabled (tcp/8448). # Only makes sense if federation is enabled (`matrix_synapse_federation_enabled`). -# Note that federation may potentially be enabled as non-TLS on tcp/8048 as well. +# Note that federation may potentially be enabled as non-TLS on `matrix_synapse_container_default_federation_port` as well. # If you're serving Synapse behind an HTTPS-capable reverse-proxy, # you can disable the TLS listener (`matrix_synapse_tls_federation_listener_enabled: false`). matrix_synapse_tls_federation_listener_enabled: true diff --git a/roles/matrix-synapse/templates/synapse/homeserver.yaml.j2 b/roles/matrix-synapse/templates/synapse/homeserver.yaml.j2 index cebe7a1f..2bfec1b4 100644 --- a/roles/matrix-synapse/templates/synapse/homeserver.yaml.j2 +++ b/roles/matrix-synapse/templates/synapse/homeserver.yaml.j2 @@ -302,7 +302,7 @@ listeners: {% if matrix_synapse_federation_port_enabled %} # Unsecure HTTP listener (Federation API): for when matrix traffic passes through a reverse proxy # that unwraps TLS. - - port: 8048 + - port: {{ matrix_synapse_container_default_federation_port }} tls: false bind_addresses: ['::'] type: http diff --git a/roles/matrix-synapse/templates/synapse/systemd/matrix-synapse.service.j2 b/roles/matrix-synapse/templates/synapse/systemd/matrix-synapse.service.j2 index 2fbaac7b..d58f1f19 100644 --- a/roles/matrix-synapse/templates/synapse/systemd/matrix-synapse.service.j2 +++ b/roles/matrix-synapse/templates/synapse/systemd/matrix-synapse.service.j2 @@ -46,7 +46,7 @@ ExecStart={{ matrix_host_command_docker }} run --rm --name matrix-synapse \ -p {{ matrix_synapse_container_federation_api_tls_host_bind_port }}:8448 \ {% endif %} {% if matrix_synapse_federation_enabled and matrix_synapse_container_federation_api_plain_host_bind_port %} - -p {{ matrix_synapse_container_federation_api_plain_host_bind_port }}:8048 \ + -p {{ matrix_synapse_container_federation_api_plain_host_bind_port }}:{{ matrix_synapse_container_default_federation_port }} \ {% endif %} {% if matrix_synapse_metrics_enabled and matrix_synapse_container_metrics_api_host_bind_port %} -p {{ matrix_synapse_container_metrics_api_host_bind_port }}:{{ matrix_synapse_metrics_port }} \ From 5e97f5a4e6319a057905a8fd2c4d9bb409f3d1cb Mon Sep 17 00:00:00 2001 From: b Date: Sun, 14 Nov 2021 20:57:27 +0200 Subject: [PATCH 52/86] fixed matrix_dimension_homeserver_federationUrl --- roles/matrix-dimension/defaults/main.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/roles/matrix-dimension/defaults/main.yml b/roles/matrix-dimension/defaults/main.yml index a5e0bf1a..48958020 100644 --- a/roles/matrix-dimension/defaults/main.yml +++ b/roles/matrix-dimension/defaults/main.yml @@ -39,7 +39,7 @@ matrix_dimension_integrations_rest_url: "https://{{ matrix_server_fqn_dimension matrix_dimension_integrations_widgets_urls: ["https://{{ matrix_server_fqn_dimension }}/widgets"] matrix_dimension_integrations_jitsi_widget_url: "https://{{ matrix_server_fqn_dimension }}/widgets/jitsi" -matrix_dimension_homeserver_federationUrl: ""http://matrix-synapse:{{matrix_synapse_container_default_federation_port|string}}"" +matrix_dimension_homeserver_federationUrl: "http://matrix-synapse:{{matrix_synapse_container_default_federation_port|string}}" # Database-related configuration fields. From 61b743f86dcc05c308747adc7ab7756383b2fd92 Mon Sep 17 00:00:00 2001 From: Aaron Raimist Date: Sun, 14 Nov 2021 19:10:56 +0000 Subject: [PATCH 53/86] Postgres Minor Updates (14.1, 13.5, 12.9, 11.14, 10.19) --- roles/matrix-postgres/defaults/main.yml | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/roles/matrix-postgres/defaults/main.yml b/roles/matrix-postgres/defaults/main.yml index 91a31d99..42413286 100644 --- a/roles/matrix-postgres/defaults/main.yml +++ b/roles/matrix-postgres/defaults/main.yml @@ -18,11 +18,11 @@ matrix_postgres_architecture: amd64 matrix_postgres_docker_image_suffix: "{{ '-alpine' if matrix_postgres_architecture in ['amd64', 'arm64'] else '' }}" matrix_postgres_docker_image_v9: "{{ matrix_container_global_registry_prefix }}postgres:9.6.23{{ matrix_postgres_docker_image_suffix }}" -matrix_postgres_docker_image_v10: "{{ matrix_container_global_registry_prefix }}postgres:10.18{{ matrix_postgres_docker_image_suffix }}" -matrix_postgres_docker_image_v11: "{{ matrix_container_global_registry_prefix }}postgres:11.13{{ matrix_postgres_docker_image_suffix }}" -matrix_postgres_docker_image_v12: "{{ matrix_container_global_registry_prefix }}postgres:12.8{{ matrix_postgres_docker_image_suffix }}" -matrix_postgres_docker_image_v13: "{{ matrix_container_global_registry_prefix }}postgres:13.4{{ matrix_postgres_docker_image_suffix }}" -matrix_postgres_docker_image_v14: "{{ matrix_container_global_registry_prefix }}postgres:14.0{{ matrix_postgres_docker_image_suffix }}" +matrix_postgres_docker_image_v10: "{{ matrix_container_global_registry_prefix }}postgres:10.19{{ matrix_postgres_docker_image_suffix }}" +matrix_postgres_docker_image_v11: "{{ matrix_container_global_registry_prefix }}postgres:11.14{{ matrix_postgres_docker_image_suffix }}" +matrix_postgres_docker_image_v12: "{{ matrix_container_global_registry_prefix }}postgres:12.9{{ matrix_postgres_docker_image_suffix }}" +matrix_postgres_docker_image_v13: "{{ matrix_container_global_registry_prefix }}postgres:13.5{{ matrix_postgres_docker_image_suffix }}" +matrix_postgres_docker_image_v14: "{{ matrix_container_global_registry_prefix }}postgres:14.1{{ matrix_postgres_docker_image_suffix }}" matrix_postgres_docker_image_latest: "{{ matrix_postgres_docker_image_v14 }}" # This variable is assigned at runtime. Overriding its value has no effect. From afccc2b11fc8b8ac02ccc659dfc9497d58f55686 Mon Sep 17 00:00:00 2001 From: b Date: Sun, 14 Nov 2021 23:32:25 +0200 Subject: [PATCH 54/86] make 8448 configurable instead of hard coded --- roles/matrix-synapse/defaults/main.yml | 2 ++ roles/matrix-synapse/templates/synapse/homeserver.yaml.j2 | 2 +- .../templates/synapse/systemd/matrix-synapse.service.j2 | 2 +- 3 files changed, 4 insertions(+), 2 deletions(-) diff --git a/roles/matrix-synapse/defaults/main.yml b/roles/matrix-synapse/defaults/main.yml index ce596c6b..c42d1f21 100644 --- a/roles/matrix-synapse/defaults/main.yml +++ b/roles/matrix-synapse/defaults/main.yml @@ -27,6 +27,8 @@ matrix_synapse_storage_path: "{{ matrix_synapse_base_path }}/storage" matrix_synapse_media_store_path: "{{ matrix_synapse_storage_path }}/media-store" matrix_synapse_ext_path: "{{ matrix_synapse_base_path }}/ext" + matrix_synapse_container_default_federation_api_port: 8448 + # Controls whether the matrix-synapse container exposes the Client/Server API port (tcp/8008 in the container). # # Takes an ":" or "" value (e.g. "127.0.0.1:8008"), or empty string to not expose. diff --git a/roles/matrix-synapse/templates/synapse/homeserver.yaml.j2 b/roles/matrix-synapse/templates/synapse/homeserver.yaml.j2 index cebe7a1f..b3e4478b 100644 --- a/roles/matrix-synapse/templates/synapse/homeserver.yaml.j2 +++ b/roles/matrix-synapse/templates/synapse/homeserver.yaml.j2 @@ -276,7 +276,7 @@ listeners: {% if matrix_synapse_federation_port_enabled and matrix_synapse_tls_federation_listener_enabled %} # TLS-enabled listener: for when matrix traffic is sent directly to synapse. - - port: 8448 + - port: {{ matrix_federation_public_port }} tls: true bind_addresses: ['::'] type: http diff --git a/roles/matrix-synapse/templates/synapse/systemd/matrix-synapse.service.j2 b/roles/matrix-synapse/templates/synapse/systemd/matrix-synapse.service.j2 index 2fbaac7b..c5329642 100644 --- a/roles/matrix-synapse/templates/synapse/systemd/matrix-synapse.service.j2 +++ b/roles/matrix-synapse/templates/synapse/systemd/matrix-synapse.service.j2 @@ -43,7 +43,7 @@ ExecStart={{ matrix_host_command_docker }} run --rm --name matrix-synapse \ -p {{ matrix_synapse_container_client_api_host_bind_port }}:8008 \ {% endif %} {% if matrix_synapse_federation_enabled and matrix_synapse_tls_federation_listener_enabled and matrix_synapse_container_federation_api_tls_host_bind_port %} - -p {{ matrix_synapse_container_federation_api_tls_host_bind_port }}:8448 \ + -p {{ matrix_synapse_container_federation_api_tls_host_bind_port }}:{{ matrix_synapse_container_default_federation_api_port }} \ {% endif %} {% if matrix_synapse_federation_enabled and matrix_synapse_container_federation_api_plain_host_bind_port %} -p {{ matrix_synapse_container_federation_api_plain_host_bind_port }}:8048 \ From 1d0e594defe2809714ad6e57fa8039522a7551ac Mon Sep 17 00:00:00 2001 From: iucca Date: Sun, 14 Nov 2021 23:45:07 +0100 Subject: [PATCH 55/86] updated whatsapp config, backfill doesn't work --- roles/matrix-base/defaults/main.yml | 6 + .../templates/config.yaml.j2 | 203 ++++++++++++------ .../templates/synapse/homeserver.yaml.j2 | 5 + 3 files changed, 144 insertions(+), 70 deletions(-) diff --git a/roles/matrix-base/defaults/main.yml b/roles/matrix-base/defaults/main.yml index bf376c94..a6f287f6 100644 --- a/roles/matrix-base/defaults/main.yml +++ b/roles/matrix-base/defaults/main.yml @@ -98,6 +98,10 @@ matrix_identity_server_url: ~ matrix_integration_manager_rest_url: ~ matrix_integration_manager_ui_url: ~ +# Enable backfilling history sync payloads from bridges using batch sending? +# This requires a server with MSC2716 support, which is currently an experimental feature in synapse. +matrix_bridges_backfill_enabled: false + # The domain name where a Jitsi server is self-hosted. # If set, `/.well-known/matrix/client` will suggest Element clients to use that Jitsi server. # See: https://github.com/vector-im/element-web/blob/develop/docs/jitsi.md#configuring-element-to-use-your-self-hosted-jitsi-server @@ -121,6 +125,8 @@ matrix_client_element_e2ee_secure_backup_setup_methods: [] # The Docker network that all services would be put into matrix_docker_network: "matrix" + + # Controls whether we'll preserve the vars.yml file on the Matrix server. # If you have a differently organized inventory, you may wish to disable this feature, # or to repoint `matrix_vars_yml_snapshotting_src` to the file you'd like to preserve. diff --git a/roles/matrix-bridge-mautrix-whatsapp/templates/config.yaml.j2 b/roles/matrix-bridge-mautrix-whatsapp/templates/config.yaml.j2 index b3b1caf1..849b15d4 100644 --- a/roles/matrix-bridge-mautrix-whatsapp/templates/config.yaml.j2 +++ b/roles/matrix-bridge-mautrix-whatsapp/templates/config.yaml.j2 @@ -7,6 +7,10 @@ homeserver: domain: {{ matrix_mautrix_whatsapp_homeserver_domain }} # Application service host/registration related details. # Changing these values requires regeneration of the registration. + # The URL to push real-time bridge status to. + # If set, the bridge will make POST requests to this URL whenever a user's whatsapp connection state changes. + # The bridge will use the appservice as_token to authorize requests. +# status_endpoint: "null" appservice: # The address that the homeserver can use to connect to this appservice. @@ -28,9 +32,6 @@ appservice: max_open_conns: 20 max_idle_conns: 2 - # Path to the Matrix room state store. - state_store_path: ./mx-state.json - # The unique ID of this appservice. id: whatsapp # Appservice bot details. @@ -51,79 +52,142 @@ bridge: # Localpart template of MXIDs for WhatsApp users. # {{ '{{.}}' }} is replaced with the phone number of the WhatsApp user. username_template: "{{ 'whatsapp_{{.}}' }}" - # Displayname template for WhatsApp users. - # {{ '{{.Notify'}}' }} - nickname set by the WhatsApp user - # {{ '{{.Jid}}' }} - phone number (international format) - # The following variables are also available, but will cause problems on multi-user instances: - # {{ '{{.Name}}' }} - display name from contact list - # {{ '{{.Short}}' }} - short display name from contact list - displayname_template: "{{ '{{if .Notify}}{{.Notify}}{{else}}{{.Jid}}{{end}} (WA)' }}" - # WhatsApp connection timeout in seconds. - connection_timeout: 20 - # Maximum number of times to retry connecting on connection error. - max_connection_attempts: 3 - # Number of seconds to wait between connection attempts. - # Negative numbers are exponential backoff: -connection_retry_delay + 1 + 2^attempts - connection_retry_delay: -1 - # Whether or not the bridge should send a notice to the user's management room when it retries connecting. - # If false, it will only report when it stops retrying. - report_connection_retry: true - # Maximum number of seconds to wait for chats to be sent at startup. - # If this is too low and you have lots of chats, it could cause backfilling to fail. - chat_list_wait: 30 - # Maximum number of seconds to wait to sync portals before force unlocking message processing. - # If this is too low and you have lots of chats, it could cause backfilling to fail. - portal_sync_wait: 600 - - # Whether or not to send call start/end notices to Matrix. - call_notices: - start: true - end: true - - # Number of chats to sync for new users. - initial_chat_sync_count: 10 - # Number of old messages to fill when creating new portal rooms. - initial_history_fill_count: 20 - # Maximum number of chats to sync when recovering from downtime. - # Set to -1 to sync all new chats during downtime. - recovery_chat_sync_limit: -1 - # Whether or not to sync history when recovering from downtime. - recovery_history_backfill: true - # Maximum number of seconds since last message in chat to skip - # syncing the chat in any case. This setting will take priority - # over both recovery_chat_sync_limit and initial_chat_sync_count. - # Default is 3 days = 259200 seconds - sync_max_chat_age: 259200 - - # Whether or not to sync with custom puppets to receive EDUs that - # are not normally sent to appservices. + displayname_template: "{{ '{{if .PushName}}{{.PushName}}{{else if .BusinessName}}{{.BusinessName}}{{else}}{{.JID}}{{end}} (WA)' }}" + + # Should the bridge send a read receipt from the bridge bot when a message has been sent to WhatsApp? + delivery_receipts: false + # Should incoming calls send a message to the Matrix room? + call_start_notices: true + # Should another user's cryptographic identity changing send a message to Matrix? + identity_change_notices: false + # Should a "reactions not yet supported" warning be sent to the Matrix room when a user reacts to a message? + reaction_notices: true + + portal_message_buffer: 128 + + # Settings for handling history sync payloads. These settings only apply right after login, + # because the phone only sends the history sync data once, and there's no way to re-request it + # (other than logging out and back in again). + history_sync: + # Should the bridge create portals for chats in the history sync payload? + create_portals: true + # Maximum age of chats in seconds to create portals for. Set to 0 to create portals for all chats in sync payload. + max_age: 604800 + # Enable backfilling history sync payloads from WhatsApp using batch sending? + # This requires a server with MSC2716 support, which is currently an experimental feature in synapse. + # It can be enabled by setting experimental_features -> msc2716_enabled to true in homeserver.yaml. + # Note that as of Synapse 1.46, there are still some bugs with the implementation, especially if using event persistence workers. + backfill: {{ matrix_bridges_backfill_enabled }} + # Use double puppets for backfilling? + # In order to use this, the double puppets must be in the appservice's user ID namespace + # (because the bridge can't use the double puppet access token with batch sending). + # This only affects double puppets on the local server, double puppets on other servers will never be used. + double_puppet_backfill: {{ matrix_bridges_backfill_enabled }} + # Should the bridge request a full sync from the phone when logging in? + # This bumps the size of history syncs from 3 months to 1 year. + request_full_sync: false + + user_avatar_sync: true + # Should Matrix users leaving groups be bridged to WhatsApp? + bridge_matrix_leave: true + + + # Should the bridge sync with double puppeting to receive EDUs that aren't normally sent to appservices. sync_with_custom_puppets: true - # Shared secret for https://github.com/devture/matrix-synapse-shared-secret-auth + # Should the bridge update the m.direct account data event when double puppeting is enabled. + # Note that updating the m.direct event is not atomic (except with mautrix-asmux) + # and is therefore prone to race conditions. + sync_direct_chat_list: false + # When double puppeting is enabled, users can use `!wa toggle` to change whether + # presence and read receipts are bridged. These settings set the default values. + # Existing users won't be affected when these are changed. + default_bridge_receipts: true + default_bridge_presence: true + # Servers to always allow double puppeting from + double_puppet_server_map: "{{ matrix_domain }}" + + # Allow using double puppeting from any server with a valid client .well-known file. + double_puppet_allow_discovery: false + # Shared secrets for https://github.com/devture/matrix-synapse-shared-secret-auth # - # If set, custom puppets will be enabled automatically for local users + # If set, double puppeting will be enabled automatically for local users # instead of users having to find an access token and run `login-matrix` # manually. - login_shared_secret: {{ matrix_mautrix_whatsapp_login_shared_secret|to_json }} - - # Whether or not to invite own WhatsApp user's Matrix puppet into private - # chat portals when backfilling if needed. - # This always uses the default puppet instead of custom puppets due to - # rate limits and timestamp massaging. - invite_own_puppet_for_backfilling: true - # Whether or not to explicitly set the avatar and room name for private - # chat portal rooms. This can be useful if the previous field works fine, - # but causes room avatar/name bugs. - private_chat_portal_meta: false + login_shared_secret_map: + "{{ matrix_mautrix_whatsapp_homeserver_domain }}": {{ matrix_mautrix_whatsapp_login_shared_secret|to_json }} + + # Should the bridge explicitly set the avatar and room name for private chat portal rooms? + private_chat_portal_meta: false + # Should Matrix m.notice-type messages be bridged? + bridge_notices: true + # Set this to true to tell the bridge to re-send m.bridge events to all rooms on the next run. + # This field will automatically be changed back to false after it, except if the config file is not writable. + resend_bridge_info: false + # When using double puppeting, should muted chats be muted in Matrix? + mute_bridging: false + # When using double puppeting, should archived chats be moved to a specific tag in Matrix? + # Note that WhatsApp unarchives chats when a message is received, which will also be mirrored to Matrix. + # This can be set to a tag (e.g. m.lowpriority), or null to disable. + archive_tag: null + # Same as above, but for pinned chats. The favorite tag is called m.favourite + pinned_tag: null + # Should mute status and tags only be bridged when the portal room is created? + tag_only_on_create: true + # Should WhatsApp status messages be bridged into a Matrix room? + # Disabling this won't affect already created status broadcast rooms. + enable_status_broadcast: true + # Should the bridge use thumbnails from WhatsApp? + # They're disabled by default due to very low resolution. + whatsapp_thumbnail: false # Allow invite permission for user. User can invite any bots to room with whatsapp # users (private chat and groups) allow_user_invite: false + # Whether or not created rooms should have federation enabled. + # If false, created portal rooms will never be federated. + federate_rooms: true # The prefix for commands. Only required in non-management rooms. command_prefix: "!wa" + # Messages sent upon joining a management room. + # Markdown is supported. The defaults are listed below. + management_room_text: + # Sent when joining a room. + welcome: "Hello, I'm a WhatsApp bridge bot." + # Sent when joining a management room and the user is already logged in. + welcome_connected: "Use `help` for help." + # Sent when joining a management room and the user is not logged in. + welcome_unconnected: "Use `help` for help or `login` to log in." + # Optional extra text sent when joining a management room. + additional_help: "" + + # End-to-bridge encryption support options. + # + # See https://docs.mau.fi/bridges/general/end-to-bridge-encryption.html for more info. + encryption: + # Allow encryption, work in group chat rooms with e2ee enabled + allow: false + # Default to encryption, force-enable encryption in all portals the bridge creates + # This will cause the bridge bot to be in private chats for the encryption to work properly. + # It is recommended to also set private_chat_portal_meta to true when using this. + default: false + # Options for automatic key sharing. + key_sharing: + # Enable key sharing? If enabled, key requests for rooms where users are in will be fulfilled. + # You must use a client that supports requesting keys from other users to use this feature. + allow: false + # Require the requesting device to have a valid cross-signing signature? + # This doesn't require that the bridge has verified the device, only that the user has verified it. + # Not yet implemented. + require_cross_signing: false + # Require devices to be verified by the bridge? + # Verification by the bridge is not yet implemented. + require_verification: true + # Permissions for using the bridge. # Permitted values: + # relay - Talk through the relaybot (if enabled), no access otherwise # user - Access to use the bridge to chat with a WhatsApp account. # admin - User level and some additional administration tools # Permitted keys: @@ -133,15 +197,13 @@ bridge: permissions: "{{ matrix_mautrix_whatsapp_homeserver_domain }}": user - relaybot: - # Whether or not relaybot support is enabled. + # Settings for relay mode + relay: + # Whether relay mode should be allowed. If allowed, `!wa set-relay` can be used to turn any + # authenticated user into a relaybot for that chat. enabled: false - # The management room for the bot. This is where all status notifications are posted and - # in this room, you can use `!wa ` instead of `!wa relaybot `. Omitting - # the command prefix completely like in user management rooms is not possible. - management: '!foo:example.com' - # List of users to invite to all created rooms that include the relaybot. - invites: [] + # Should only admins be allowed to set themselves as relay users? + admin_only: true # The formats to use when sending messages to WhatsApp via the relaybot. message_formats: m.text: "{{ '{{ .Sender.Displayname }}' }}: {{ '{{ .Message }}' }}" @@ -152,6 +214,7 @@ bridge: m.audio: "{{ '{{ .Sender.Displayname }}' }}: sent an audio file" m.video: "{{ '{{ .Sender.Displayname }}' }}: sent a video" m.location: "{{ '{{ .Sender.Displayname }}' }}: sent a location" + # Logging config. logging: # The directory for log files. Will be created if not found. diff --git a/roles/matrix-synapse/templates/synapse/homeserver.yaml.j2 b/roles/matrix-synapse/templates/synapse/homeserver.yaml.j2 index cebe7a1f..aa99d94d 100644 --- a/roles/matrix-synapse/templates/synapse/homeserver.yaml.j2 +++ b/roles/matrix-synapse/templates/synapse/homeserver.yaml.j2 @@ -2875,6 +2875,11 @@ opentracing: # events: worker1 # typing: worker1 +{% if matrix_bridges_backfill_enabled %} +Experimental: + msc2716_enabled: true +{% endif %} + # The worker that is used to run background tasks (e.g. cleaning up expired # data). If not provided this defaults to the main process. # From 4ff8fddd72d8a17ca567ccfcd8489ef7235027fd Mon Sep 17 00:00:00 2001 From: iucca Date: Sun, 14 Nov 2021 23:57:52 +0100 Subject: [PATCH 56/86] updated whatsapp config, backfill doesn't work --- docs/configuring-playbook-bridge-mautrix-whatsapp.md | 9 +++++++++ .../templates/config.yaml.j2 | 2 +- 2 files changed, 10 insertions(+), 1 deletion(-) diff --git a/docs/configuring-playbook-bridge-mautrix-whatsapp.md b/docs/configuring-playbook-bridge-mautrix-whatsapp.md index 1e5f7038..0101cecc 100644 --- a/docs/configuring-playbook-bridge-mautrix-whatsapp.md +++ b/docs/configuring-playbook-bridge-mautrix-whatsapp.md @@ -10,6 +10,15 @@ Use the following playbook configuration: matrix_mautrix_whatsapp_enabled: true ``` +## Enable backfilling history +This requires a server with MSC2716 support, which is currently an experimental feature in synapse. +Note that as of Synapse 1.46, there are still some bugs with the implementation, especially if using event persistence workers. + +Use the following playbook configuration: + +```yaml +matrix_bridges_backfill_enabled: true +``` ## Set up Double Puppeting diff --git a/roles/matrix-bridge-mautrix-whatsapp/templates/config.yaml.j2 b/roles/matrix-bridge-mautrix-whatsapp/templates/config.yaml.j2 index 849b15d4..8e6d8eda 100644 --- a/roles/matrix-bridge-mautrix-whatsapp/templates/config.yaml.j2 +++ b/roles/matrix-bridge-mautrix-whatsapp/templates/config.yaml.j2 @@ -10,7 +10,7 @@ homeserver: # The URL to push real-time bridge status to. # If set, the bridge will make POST requests to this URL whenever a user's whatsapp connection state changes. # The bridge will use the appservice as_token to authorize requests. -# status_endpoint: "null" + status_endpoint: "null" appservice: # The address that the homeserver can use to connect to this appservice. From 708a7108b3d9c6814e9c9a0fe34c7eb795befe91 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Arthur=20Brugi=C3=A8re?= <16764085+RoiArthurB@users.noreply.github.com> Date: Mon, 15 Nov 2021 10:29:13 +0700 Subject: [PATCH 57/86] Upgrade Mautrix Facebook bridge version --- roles/matrix-bridge-mautrix-facebook/defaults/main.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/roles/matrix-bridge-mautrix-facebook/defaults/main.yml b/roles/matrix-bridge-mautrix-facebook/defaults/main.yml index 6c1d6b69..2b453bab 100644 --- a/roles/matrix-bridge-mautrix-facebook/defaults/main.yml +++ b/roles/matrix-bridge-mautrix-facebook/defaults/main.yml @@ -6,7 +6,7 @@ matrix_mautrix_facebook_enabled: true matrix_mautrix_facebook_container_image_self_build: false matrix_mautrix_facebook_container_image_self_build_repo: "https://mau.dev/mautrix/facebook.git" -matrix_mautrix_facebook_version: v0.3.1 +matrix_mautrix_facebook_version: v0.3.2 matrix_mautrix_facebook_docker_image: "{{ matrix_mautrix_facebook_docker_image_name_prefix }}mautrix/facebook:{{ matrix_mautrix_facebook_version }}" matrix_mautrix_facebook_docker_image_name_prefix: "{{ 'localhost/' if matrix_mautrix_facebook_container_image_self_build else 'dock.mau.dev/' }}" matrix_mautrix_facebook_docker_image_force_pull: "{{ matrix_mautrix_facebook_docker_image.endswith(':latest') }}" From 8abe1ac483407a7f1e2ab9fdf31f717038dfeeb7 Mon Sep 17 00:00:00 2001 From: Slavi Pantaleev Date: Mon, 15 Nov 2021 08:18:39 +0200 Subject: [PATCH 58/86] Warn people if on an old SQLite-supporting mautrix-facebook version Related to https://github.com/spantaleev/matrix-docker-ansible-deploy/pull/1401 https://github.com/mautrix/facebook/releases/tag/v0.3.2 says that this version re-adds SQLite support. --- CHANGELOG.md | 2 ++ .../tasks/validate_config.yml | 14 +++----------- 2 files changed, 5 insertions(+), 11 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 7e124159..43af8dd1 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -253,6 +253,8 @@ The fact that we've renamed Synapse's database from `homeserver` to `synapse` (i ## (Breaking Change) The mautrix-facebook bridge now requires a Postgres database +**Update from 2021-11-15**: SQLite support has been re-added to the mautrix-facebook bridge in [v0.3.2](https://github.com/mautrix/facebook/releases/tag/v0.3.2). You can ignore this changelog entry. + A new version of the [mautrix-facebook](https://github.com/tulir/mautrix-facebook) bridge has been released. It's a full rewrite of its backend and the bridge now requires Postgres. New versions of the bridge can no longer run on SQLite. **TLDR**: if you're NOT using an [external Postgres server](docs/configuring-playbook-external-postgres.md) and have NOT forcefully kept the bridge on SQLite during [The big move to all-on-Postgres (potentially dangerous)](#the-big-move-to-all-on-postgres-potentially-dangerous), you will be automatically upgraded without manual intervention. All you need to do is send a `login` message to the Facebook bridge bot again. diff --git a/roles/matrix-bridge-mautrix-facebook/tasks/validate_config.yml b/roles/matrix-bridge-mautrix-facebook/tasks/validate_config.yml index 0879bad9..1e482efb 100644 --- a/roles/matrix-bridge-mautrix-facebook/tasks/validate_config.yml +++ b/roles/matrix-bridge-mautrix-facebook/tasks/validate_config.yml @@ -10,22 +10,14 @@ - "matrix_mautrix_facebook_homeserver_token" - block: - - name: Fail if on SQLite, unless on the last version supporting SQLite - fail: - msg: >- - You're trying to use the mautrix-facebook bridge with an SQLite database. - Going forward, this bridge only supports Postgres. - To learn more about this, see our changelog: https://github.com/spantaleev/matrix-docker-ansible-deploy/blob/master/CHANGELOG.md#breaking-change-the-mautrix-facebook-bridge-now-requires-a-postgres-database - when: "not matrix_mautrix_facebook_docker_image.endswith(':da1b4ec596e334325a1589e70829dea46e73064b')" - - - name: Inject warning if still on SQLite + - name: Inject warning if on an old SQLite-supporting version set_fact: matrix_playbook_runtime_results: | {{ matrix_playbook_runtime_results|default([]) + [ - "NOTE: Your mautrix-facebook bridge setup is still on SQLite. Your bridge is not getting any updates and will likely stop working at some point. To learn more about this, see our changelog: https://github.com/spantaleev/matrix-docker-ansible-deploy/blob/master/CHANGELOG.md#breaking-change-the-mautrix-facebook-bridge-now-requires-a-postgres-database" + "NOTE: Your mautrix-facebook bridge is still on SQLite and on the last version that supported it, before support was dropped. Support has been subsequently re-added in v0.3.2, so we advise you to upgrade (by removing your `matrix_mautrix_facebook_docker_image` definition from vars.yml)" ] }} - when: "matrix_mautrix_facebook_database_engine == 'sqlite'" + when: "matrix_mautrix_facebook_database_engine == 'sqlite' and matrix_mautrix_facebook_docker_image.endswith(':da1b4ec596e334325a1589e70829dea46e73064b')" From c08880d175fdbb737784e8043c58e49a48ba2502 Mon Sep 17 00:00:00 2001 From: Slavi Pantaleev Date: Mon, 15 Nov 2021 09:15:44 +0200 Subject: [PATCH 59/86] Upgrade postgres-backup to v14 --- roles/matrix-postgres-backup/defaults/main.yml | 1 + .../tasks/util/detect_existing_postgres_version.yml | 5 +++++ 2 files changed, 6 insertions(+) diff --git a/roles/matrix-postgres-backup/defaults/main.yml b/roles/matrix-postgres-backup/defaults/main.yml index 522764ac..e1f252fe 100644 --- a/roles/matrix-postgres-backup/defaults/main.yml +++ b/roles/matrix-postgres-backup/defaults/main.yml @@ -32,6 +32,7 @@ matrix_postgres_backup_docker_image_v10: "{{ matrix_container_global_registry_pr matrix_postgres_backup_docker_image_v11: "{{ matrix_container_global_registry_prefix }}prodrigestivill/postgres-backup-local:11{{ matrix_postgres_backup_docker_image_suffix }}" matrix_postgres_backup_docker_image_v12: "{{ matrix_container_global_registry_prefix }}prodrigestivill/postgres-backup-local:12{{ matrix_postgres_backup_docker_image_suffix }}" matrix_postgres_backup_docker_image_v13: "{{ matrix_container_global_registry_prefix }}prodrigestivill/postgres-backup-local:13{{ matrix_postgres_backup_docker_image_suffix }}" +matrix_postgres_backup_docker_image_v14: "{{ matrix_container_global_registry_prefix }}prodrigestivill/postgres-backup-local:14{{ matrix_postgres_backup_docker_image_suffix }}" matrix_postgres_backup_docker_image_latest: "{{ matrix_postgres_backup_docker_image_v13 }}" # This variable is assigned at runtime. Overriding its value has no effect. diff --git a/roles/matrix-postgres-backup/tasks/util/detect_existing_postgres_version.yml b/roles/matrix-postgres-backup/tasks/util/detect_existing_postgres_version.yml index 87a81f74..10828cc7 100644 --- a/roles/matrix-postgres-backup/tasks/util/detect_existing_postgres_version.yml +++ b/roles/matrix-postgres-backup/tasks/util/detect_existing_postgres_version.yml @@ -54,3 +54,8 @@ set_fact: matrix_postgres_backup_detected_version_corresponding_docker_image: "{{ matrix_postgres_backup_docker_image_v12 }}" when: "matrix_postgres_backup_detected_version == '12' or matrix_postgres_backup_detected_version.startswith('12.')" + +- name: Determine corresponding Docker image to detected version (use 13.x, if detected) + set_fact: + matrix_postgres_backup_detected_version_corresponding_docker_image: "{{ matrix_postgres_backup_docker_image_v13 }}" + when: "matrix_postgres_backup_detected_version == '13' or matrix_postgres_backup_detected_version.startswith('13.')" From 266bdbc902e430f8bb566c955fb8ff58772904c9 Mon Sep 17 00:00:00 2001 From: Slavi Pantaleev Date: Mon, 15 Nov 2021 10:29:25 +0200 Subject: [PATCH 60/86] Update matrix-corporal documentation --- docs/configuring-playbook-matrix-corporal.md | 41 +++++++++++++++++++- 1 file changed, 40 insertions(+), 1 deletion(-) diff --git a/docs/configuring-playbook-matrix-corporal.md b/docs/configuring-playbook-matrix-corporal.md index fb12e94a..eb635c64 100644 --- a/docs/configuring-playbook-matrix-corporal.md +++ b/docs/configuring-playbook-matrix-corporal.md @@ -37,6 +37,7 @@ matrix_synapse_ext_password_provider_rest_auth_endpoint: "http://matrix-corporal matrix_corporal_enabled: true +# See below for an example of how to use a locally-stored static policy matrix_corporal_policy_provider_config: | { "Type": "http", @@ -74,10 +75,48 @@ Matrix Corporal operates with a specific Matrix user on your server. By default, it's `matrix-corporal` (controllable by the `matrix_corporal_reconciliation_user_id_local_part` setting, see above). No matter what Matrix user id you configure to run it with, make sure that: -- the Matrix Corporal user is created by [registering it](registering-users.md). Use a password you remember, as you'll need to log in from time to time to create or join rooms +- the Matrix Corporal user is created by [registering it](registering-users.md) **with administrator privileges**. Use a password you remember, as you'll need to log in from time to time to create or join rooms - the Matrix Corporal user is joined and has Admin/Moderator-level access to any rooms you want it to manage +### Using a locally-stored static policy + +If you'd like to use a [static policy file](https://github.com/devture/matrix-corporal/blob/master/docs/policy-providers.md#static-file-pull-style-policy-provider), you can use a configuration like this: + +```yaml +matrix_corporal_policy_provider_config: | + { + "Type": "static_file", + "Path": "/etc/matrix-corporal/policy.json" + } + +# Modify the policy below as you see fit +matrix_aux_file_definitions: + - dest: "{{ matrix_corporal_config_dir_path }}/policy.json" + content: | + { + "schemaVersion": 1, + "identificationStamp": "stamp-1", + "flags": { + "allowCustomUserDisplayNames": false, + "allowCustomUserAvatars": false, + "forbidRoomCreation": false, + "forbidEncryptedRoomCreation": true, + "forbidUnencryptedRoomCreation": false, + "allowCustomPassthroughUserPasswords": true, + "allowUnauthenticatedPasswordResets": false, + "allow3pidLogin": false + }, + "managedCommunityIds": [], + "managedRoomIds": [], + "users": [] + } +``` + +To learn more about what the policy configuration, see the matrix-corporal documentation on [policy](https://github.com/devture/matrix-corporal/blob/master/docs/policy.md). + +Each time you update the policy in your `vars.yml` file, you'd need to re-run the playbook and restart matrix-corporal (`--tags=setup-all,start` or `--tags=setup-aux-files,setup-corporal,start`). + ## Matrix Corporal files From 0d4764a21346e168bc3a9c6f1248bc2cf6986eff Mon Sep 17 00:00:00 2001 From: Slavi Pantaleev Date: Mon, 15 Nov 2021 11:24:01 +0200 Subject: [PATCH 61/86] Upgrade matrix-corporal (2.1.2 -> 2.1.3) 2.1.3 fixes a security vulnerability, which allowed attackers to circuimvent policy checks by sending HTTP requests with trailing slashes. Learn more in the matrix-corporal changelog: https://github.com/devture/matrix-corporal/blob/master/CHANGELOG.md --- roles/matrix-corporal/defaults/main.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/roles/matrix-corporal/defaults/main.yml b/roles/matrix-corporal/defaults/main.yml index 313f79a8..fd6b65d3 100644 --- a/roles/matrix-corporal/defaults/main.yml +++ b/roles/matrix-corporal/defaults/main.yml @@ -22,7 +22,7 @@ matrix_corporal_container_extra_arguments: [] # List of systemd services that matrix-corporal.service depends on matrix_corporal_systemd_required_services_list: ['docker.service'] -matrix_corporal_version: 2.1.2 +matrix_corporal_version: 2.1.3 matrix_corporal_docker_image: "{{ matrix_corporal_docker_image_name_prefix }}devture/matrix-corporal:{{ matrix_corporal_docker_image_tag }}" matrix_corporal_docker_image_name_prefix: "{{ 'localhost/' if matrix_corporal_container_image_self_build else matrix_container_global_registry_prefix }}" matrix_corporal_docker_image_tag: "{{ matrix_corporal_version }}" # for backward-compatibility From 07496069c8cad666d8cdbe3ac9cec466f556dfd5 Mon Sep 17 00:00:00 2001 From: b Date: Mon, 15 Nov 2021 12:07:54 +0200 Subject: [PATCH 62/86] rellocating variables for consistency --- group_vars/matrix_servers | 8 ++++++-- roles/matrix-dimension/defaults/main.yml | 2 +- roles/matrix-nginx-proxy/defaults/main.yml | 5 +++-- roles/matrix-synapse/defaults/main.yml | 4 +++- roles/matrix-synapse/templates/synapse/homeserver.yaml.j2 | 2 +- .../templates/synapse/systemd/matrix-synapse.service.j2 | 2 +- 6 files changed, 15 insertions(+), 8 deletions(-) diff --git a/group_vars/matrix_servers b/group_vars/matrix_servers index cfca8c92..e67403b3 100755 --- a/group_vars/matrix_servers +++ b/group_vars/matrix_servers @@ -1047,6 +1047,8 @@ matrix_dimension_enabled: false # the Dimension HTTP port to the local host. matrix_dimension_container_http_host_bind_port: "{{ '' if matrix_nginx_proxy_enabled else '127.0.0.1:8184' }}" +matrix_dimension_homeserver_federationUrl: "http://matrix-synapse:{{matrix_synapse_container_federation_port|string}}" + matrix_integration_manager_rest_url: "{{ matrix_dimension_integrations_rest_url if matrix_dimension_enabled else None }}" matrix_integration_manager_ui_url: "{{ matrix_dimension_integrations_ui_url if matrix_dimension_enabled else None }}" @@ -1306,6 +1308,9 @@ matrix_nginx_proxy_proxy_matrix_federation_api_addr_sans_container: "127.0.0.1:1 # Settings controlling matrix-synapse-proxy.conf matrix_nginx_proxy_proxy_synapse_enabled: "{{ matrix_synapse_enabled }}" +matrix_nginx_proxy_proxy_synapse_federation_api_addr_with_container: "matrix-synapse:{{matrix_synapse_container_federation_port|string}}" +matrix_nginx_proxy_proxy_synapse_federation_api_addr_sans_container: "localhost:{{matrix_synapse_container_federation_port|string}}" + # When matrix-nginx-proxy is disabled, the actual port number that the vhost uses may begin to matter. matrix_nginx_proxy_proxy_matrix_federation_port: "{{ matrix_federation_public_port }}" @@ -1720,8 +1725,7 @@ matrix_synapse_account_threepid_delegates_msisdn: "{{ 'http://matrix-ma1sd:' + m matrix_synapse_container_client_api_host_bind_port: "{{ '' if matrix_nginx_proxy_enabled else '127.0.0.1:8008' }}" # # For exposing the Matrix Federation API's plain port (plain HTTP) to the local host. -matrix_synapse_container_default_federation_port: 8048 -matrix_synapse_container_federation_api_plain_host_bind_port: "{{ '' if matrix_nginx_proxy_enabled else '127.0.0.1:' + matrix_synapse_container_default_federation_port|string }}" +matrix_synapse_container_federation_api_plain_host_bind_port: "{{ '' if matrix_nginx_proxy_enabled else '127.0.0.1:' + matrix_synapse_container_federation_port|string }}" # # For exposing the Matrix Federation API's TLS port (HTTPS) to the internet on all network interfaces. matrix_synapse_container_federation_api_tls_host_bind_port: "{{ matrix_federation_public_port if (matrix_synapse_federation_enabled and matrix_synapse_tls_federation_listener_enabled) else '' }}" diff --git a/roles/matrix-dimension/defaults/main.yml b/roles/matrix-dimension/defaults/main.yml index 48958020..fc1f17a6 100644 --- a/roles/matrix-dimension/defaults/main.yml +++ b/roles/matrix-dimension/defaults/main.yml @@ -39,7 +39,7 @@ matrix_dimension_integrations_rest_url: "https://{{ matrix_server_fqn_dimension matrix_dimension_integrations_widgets_urls: ["https://{{ matrix_server_fqn_dimension }}/widgets"] matrix_dimension_integrations_jitsi_widget_url: "https://{{ matrix_server_fqn_dimension }}/widgets/jitsi" -matrix_dimension_homeserver_federationUrl: "http://matrix-synapse:{{matrix_synapse_container_default_federation_port|string}}" +matrix_dimension_homeserver_federationUrl: "" # Database-related configuration fields. diff --git a/roles/matrix-nginx-proxy/defaults/main.yml b/roles/matrix-nginx-proxy/defaults/main.yml index af549b94..ea26084e 100644 --- a/roles/matrix-nginx-proxy/defaults/main.yml +++ b/roles/matrix-nginx-proxy/defaults/main.yml @@ -115,9 +115,10 @@ matrix_nginx_proxy_proxy_riot_compat_redirect_hostname: "riot.{{ matrix_domain } matrix_nginx_proxy_proxy_synapse_enabled: false matrix_nginx_proxy_proxy_synapse_hostname: "matrix-nginx-proxy" matrix_nginx_proxy_proxy_synapse_federation_api_enabled: "{{ matrix_nginx_proxy_proxy_matrix_federation_api_enabled }}" + # The addresses where the Federation API is, when using Synapse. -matrix_nginx_proxy_proxy_synapse_federation_api_addr_with_container: "matrix-synapse:{{matrix_synapse_container_default_federation_port|string}}" -matrix_nginx_proxy_proxy_synapse_federation_api_addr_sans_container: "localhost:{{matrix_synapse_container_default_federation_port|string}}" +matrix_nginx_proxy_proxy_synapse_federation_api_addr_with_container: "" +matrix_nginx_proxy_proxy_synapse_federation_api_addr_sans_container: "" # Controls whether proxying the Element domain should be done. matrix_nginx_proxy_proxy_element_enabled: false diff --git a/roles/matrix-synapse/defaults/main.yml b/roles/matrix-synapse/defaults/main.yml index eb9d8e66..8e32764a 100644 --- a/roles/matrix-synapse/defaults/main.yml +++ b/roles/matrix-synapse/defaults/main.yml @@ -27,6 +27,8 @@ matrix_synapse_storage_path: "{{ matrix_synapse_base_path }}/storage" matrix_synapse_media_store_path: "{{ matrix_synapse_storage_path }}/media-store" matrix_synapse_ext_path: "{{ matrix_synapse_base_path }}/ext" +matrix_synapse_container_federation_port: 8048 + # Controls whether the matrix-synapse container exposes the Client/Server API port (tcp/8008 in the container). # # Takes an ":" or "" value (e.g. "127.0.0.1:8008"), or empty string to not expose. @@ -146,7 +148,7 @@ matrix_synapse_federation_rr_transactions_per_room_per_second: 50 # Controls whether the TLS federation listener is enabled (tcp/8448). # Only makes sense if federation is enabled (`matrix_synapse_federation_enabled`). -# Note that federation may potentially be enabled as non-TLS on `matrix_synapse_container_default_federation_port` as well. +# Note that federation may potentially be enabled as non-TLS on `matrix_synapse_container_federation_port` as well. # If you're serving Synapse behind an HTTPS-capable reverse-proxy, # you can disable the TLS listener (`matrix_synapse_tls_federation_listener_enabled: false`). matrix_synapse_tls_federation_listener_enabled: true diff --git a/roles/matrix-synapse/templates/synapse/homeserver.yaml.j2 b/roles/matrix-synapse/templates/synapse/homeserver.yaml.j2 index 2bfec1b4..7a7cdfa5 100644 --- a/roles/matrix-synapse/templates/synapse/homeserver.yaml.j2 +++ b/roles/matrix-synapse/templates/synapse/homeserver.yaml.j2 @@ -302,7 +302,7 @@ listeners: {% if matrix_synapse_federation_port_enabled %} # Unsecure HTTP listener (Federation API): for when matrix traffic passes through a reverse proxy # that unwraps TLS. - - port: {{ matrix_synapse_container_default_federation_port }} + - port: {{ matrix_synapse_container_default_federation_port|to_json }} tls: false bind_addresses: ['::'] type: http diff --git a/roles/matrix-synapse/templates/synapse/systemd/matrix-synapse.service.j2 b/roles/matrix-synapse/templates/synapse/systemd/matrix-synapse.service.j2 index d58f1f19..0224c3fb 100644 --- a/roles/matrix-synapse/templates/synapse/systemd/matrix-synapse.service.j2 +++ b/roles/matrix-synapse/templates/synapse/systemd/matrix-synapse.service.j2 @@ -46,7 +46,7 @@ ExecStart={{ matrix_host_command_docker }} run --rm --name matrix-synapse \ -p {{ matrix_synapse_container_federation_api_tls_host_bind_port }}:8448 \ {% endif %} {% if matrix_synapse_federation_enabled and matrix_synapse_container_federation_api_plain_host_bind_port %} - -p {{ matrix_synapse_container_federation_api_plain_host_bind_port }}:{{ matrix_synapse_container_default_federation_port }} \ + -p {{ matrix_synapse_container_federation_api_plain_host_bind_port }}:{{ matrix_synapse_container_federation_port }} \ {% endif %} {% if matrix_synapse_metrics_enabled and matrix_synapse_container_metrics_api_host_bind_port %} -p {{ matrix_synapse_container_metrics_api_host_bind_port }}:{{ matrix_synapse_metrics_port }} \ From 8c3e25de1bfb98b79ee84c8a0598eacb75cf9e77 Mon Sep 17 00:00:00 2001 From: boris runakov Date: Mon, 15 Nov 2021 13:01:22 +0200 Subject: [PATCH 63/86] renamed var to matrix_synapse_container_federation_api_port --- roles/matrix-synapse/defaults/main.yml | 2 +- roles/matrix-synapse/templates/synapse/homeserver.yaml.j2 | 2 +- .../templates/synapse/systemd/matrix-synapse.service.j2 | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/roles/matrix-synapse/defaults/main.yml b/roles/matrix-synapse/defaults/main.yml index c42d1f21..7a889fbd 100644 --- a/roles/matrix-synapse/defaults/main.yml +++ b/roles/matrix-synapse/defaults/main.yml @@ -27,7 +27,7 @@ matrix_synapse_storage_path: "{{ matrix_synapse_base_path }}/storage" matrix_synapse_media_store_path: "{{ matrix_synapse_storage_path }}/media-store" matrix_synapse_ext_path: "{{ matrix_synapse_base_path }}/ext" - matrix_synapse_container_default_federation_api_port: 8448 + matrix_synapse_container_federation_api_port: 8448 # Controls whether the matrix-synapse container exposes the Client/Server API port (tcp/8008 in the container). # diff --git a/roles/matrix-synapse/templates/synapse/homeserver.yaml.j2 b/roles/matrix-synapse/templates/synapse/homeserver.yaml.j2 index b3e4478b..43f9baf8 100644 --- a/roles/matrix-synapse/templates/synapse/homeserver.yaml.j2 +++ b/roles/matrix-synapse/templates/synapse/homeserver.yaml.j2 @@ -276,7 +276,7 @@ listeners: {% if matrix_synapse_federation_port_enabled and matrix_synapse_tls_federation_listener_enabled %} # TLS-enabled listener: for when matrix traffic is sent directly to synapse. - - port: {{ matrix_federation_public_port }} + - port: {{ matrix_synapse_container_federation_api_port }} tls: true bind_addresses: ['::'] type: http diff --git a/roles/matrix-synapse/templates/synapse/systemd/matrix-synapse.service.j2 b/roles/matrix-synapse/templates/synapse/systemd/matrix-synapse.service.j2 index c5329642..f4e62936 100644 --- a/roles/matrix-synapse/templates/synapse/systemd/matrix-synapse.service.j2 +++ b/roles/matrix-synapse/templates/synapse/systemd/matrix-synapse.service.j2 @@ -43,7 +43,7 @@ ExecStart={{ matrix_host_command_docker }} run --rm --name matrix-synapse \ -p {{ matrix_synapse_container_client_api_host_bind_port }}:8008 \ {% endif %} {% if matrix_synapse_federation_enabled and matrix_synapse_tls_federation_listener_enabled and matrix_synapse_container_federation_api_tls_host_bind_port %} - -p {{ matrix_synapse_container_federation_api_tls_host_bind_port }}:{{ matrix_synapse_container_default_federation_api_port }} \ + -p {{ matrix_synapse_container_federation_api_tls_host_bind_port }}:{{ matrix_synapse_container_federation_api_port }} \ {% endif %} {% if matrix_synapse_federation_enabled and matrix_synapse_container_federation_api_plain_host_bind_port %} -p {{ matrix_synapse_container_federation_api_plain_host_bind_port }}:8048 \ From 994c0e504cffbee5af5051ada8fcb4abe3ddc3cf Mon Sep 17 00:00:00 2001 From: Slavi Pantaleev Date: Mon, 15 Nov 2021 14:46:44 +0200 Subject: [PATCH 64/86] Ensure some matrix-nginx-proxy variables are defined Related to https://github.com/spantaleev/matrix-docker-ansible-deploy/pull/1397 --- roles/matrix-nginx-proxy/tasks/validate_config.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/roles/matrix-nginx-proxy/tasks/validate_config.yml b/roles/matrix-nginx-proxy/tasks/validate_config.yml index 9661ae5e..39a2dfe5 100644 --- a/roles/matrix-nginx-proxy/tasks/validate_config.yml +++ b/roles/matrix-nginx-proxy/tasks/validate_config.yml @@ -43,5 +43,7 @@ msg: "The `{{ item }}` variable must be defined and have a non-null value" with_items: - "matrix_ssl_lets_encrypt_support_email" + - "matrix_nginx_proxy_proxy_synapse_federation_api_addr_sans_container" + - "matrix_nginx_proxy_proxy_synapse_federation_api_addr_with_container" when: "vars[item] == '' or vars[item] is none" when: "matrix_ssl_retrieval_method == 'lets-encrypt'" From edf63bfdd7a65b487a55b9762d30823e08f7b399 Mon Sep 17 00:00:00 2001 From: Slavi Pantaleev Date: Mon, 15 Nov 2021 14:48:25 +0200 Subject: [PATCH 65/86] Add some to_json invocations --- roles/matrix-synapse/templates/synapse/homeserver.yaml.j2 | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/roles/matrix-synapse/templates/synapse/homeserver.yaml.j2 b/roles/matrix-synapse/templates/synapse/homeserver.yaml.j2 index 43f9baf8..4e5ddea3 100644 --- a/roles/matrix-synapse/templates/synapse/homeserver.yaml.j2 +++ b/roles/matrix-synapse/templates/synapse/homeserver.yaml.j2 @@ -269,14 +269,14 @@ default_room_version: {{ matrix_synapse_default_room_version|to_json }} listeners: {% if matrix_synapse_metrics_enabled %} - type: metrics - port: {{ matrix_synapse_metrics_port }} + port: {{ matrix_synapse_metrics_port|to_json }} bind_addresses: - '0.0.0.0' {% endif %} {% if matrix_synapse_federation_port_enabled and matrix_synapse_tls_federation_listener_enabled %} # TLS-enabled listener: for when matrix traffic is sent directly to synapse. - - port: {{ matrix_synapse_container_federation_api_port }} + - port: {{ matrix_synapse_container_federation_api_port|to_json }} tls: true bind_addresses: ['::'] type: http From ba48aa70f73fb54a37c4e13ed32cd80ce83a8018 Mon Sep 17 00:00:00 2001 From: Slavi Pantaleev Date: Mon, 15 Nov 2021 14:52:08 +0200 Subject: [PATCH 66/86] Fix variable name typo Related to https://github.com/spantaleev/matrix-docker-ansible-deploy/pull/1397 --- roles/matrix-synapse/templates/synapse/homeserver.yaml.j2 | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/roles/matrix-synapse/templates/synapse/homeserver.yaml.j2 b/roles/matrix-synapse/templates/synapse/homeserver.yaml.j2 index e88ed256..1a1cf6eb 100644 --- a/roles/matrix-synapse/templates/synapse/homeserver.yaml.j2 +++ b/roles/matrix-synapse/templates/synapse/homeserver.yaml.j2 @@ -302,7 +302,7 @@ listeners: {% if matrix_synapse_federation_port_enabled %} # Unsecure HTTP listener (Federation API): for when matrix traffic passes through a reverse proxy # that unwraps TLS. - - port: {{ matrix_synapse_container_default_federation_port|to_json }} + - port: {{ matrix_synapse_container_federation_port|to_json }} tls: false bind_addresses: ['::'] type: http From c1bc7b9f934a1862442a4e0d7e81f017ccb101d3 Mon Sep 17 00:00:00 2001 From: Slavi Pantaleev Date: Mon, 15 Nov 2021 14:56:11 +0200 Subject: [PATCH 67/86] Rename variables to prevent confusion Related to https://github.com/spantaleev/matrix-docker-ansible-deploy/pull/1397 and https://github.com/spantaleev/matrix-docker-ansible-deploy/pull/1399 --- group_vars/matrix_servers | 8 ++++---- roles/matrix-synapse/defaults/main.yml | 6 +++--- roles/matrix-synapse/templates/synapse/homeserver.yaml.j2 | 4 ++-- .../templates/synapse/systemd/matrix-synapse.service.j2 | 4 ++-- 4 files changed, 11 insertions(+), 11 deletions(-) diff --git a/group_vars/matrix_servers b/group_vars/matrix_servers index e67403b3..52dc671c 100755 --- a/group_vars/matrix_servers +++ b/group_vars/matrix_servers @@ -1047,7 +1047,7 @@ matrix_dimension_enabled: false # the Dimension HTTP port to the local host. matrix_dimension_container_http_host_bind_port: "{{ '' if matrix_nginx_proxy_enabled else '127.0.0.1:8184' }}" -matrix_dimension_homeserver_federationUrl: "http://matrix-synapse:{{matrix_synapse_container_federation_port|string}}" +matrix_dimension_homeserver_federationUrl: "http://matrix-synapse:{{matrix_synapse_container_federation_api_plain_port|string}}" matrix_integration_manager_rest_url: "{{ matrix_dimension_integrations_rest_url if matrix_dimension_enabled else None }}" matrix_integration_manager_ui_url: "{{ matrix_dimension_integrations_ui_url if matrix_dimension_enabled else None }}" @@ -1308,8 +1308,8 @@ matrix_nginx_proxy_proxy_matrix_federation_api_addr_sans_container: "127.0.0.1:1 # Settings controlling matrix-synapse-proxy.conf matrix_nginx_proxy_proxy_synapse_enabled: "{{ matrix_synapse_enabled }}" -matrix_nginx_proxy_proxy_synapse_federation_api_addr_with_container: "matrix-synapse:{{matrix_synapse_container_federation_port|string}}" -matrix_nginx_proxy_proxy_synapse_federation_api_addr_sans_container: "localhost:{{matrix_synapse_container_federation_port|string}}" +matrix_nginx_proxy_proxy_synapse_federation_api_addr_with_container: "matrix-synapse:{{matrix_synapse_container_federation_api_plain_port|string}}" +matrix_nginx_proxy_proxy_synapse_federation_api_addr_sans_container: "localhost:{{matrix_synapse_container_federation_api_plain_port|string}}" # When matrix-nginx-proxy is disabled, the actual port number that the vhost uses may begin to matter. matrix_nginx_proxy_proxy_matrix_federation_port: "{{ matrix_federation_public_port }}" @@ -1725,7 +1725,7 @@ matrix_synapse_account_threepid_delegates_msisdn: "{{ 'http://matrix-ma1sd:' + m matrix_synapse_container_client_api_host_bind_port: "{{ '' if matrix_nginx_proxy_enabled else '127.0.0.1:8008' }}" # # For exposing the Matrix Federation API's plain port (plain HTTP) to the local host. -matrix_synapse_container_federation_api_plain_host_bind_port: "{{ '' if matrix_nginx_proxy_enabled else '127.0.0.1:' + matrix_synapse_container_federation_port|string }}" +matrix_synapse_container_federation_api_plain_host_bind_port: "{{ '' if matrix_nginx_proxy_enabled else '127.0.0.1:' + matrix_synapse_container_federation_api_plain_port|string }}" # # For exposing the Matrix Federation API's TLS port (HTTPS) to the internet on all network interfaces. matrix_synapse_container_federation_api_tls_host_bind_port: "{{ matrix_federation_public_port if (matrix_synapse_federation_enabled and matrix_synapse_tls_federation_listener_enabled) else '' }}" diff --git a/roles/matrix-synapse/defaults/main.yml b/roles/matrix-synapse/defaults/main.yml index cfc985b4..624a6b5e 100644 --- a/roles/matrix-synapse/defaults/main.yml +++ b/roles/matrix-synapse/defaults/main.yml @@ -27,9 +27,9 @@ matrix_synapse_storage_path: "{{ matrix_synapse_base_path }}/storage" matrix_synapse_media_store_path: "{{ matrix_synapse_storage_path }}/media-store" matrix_synapse_ext_path: "{{ matrix_synapse_base_path }}/ext" -matrix_synapse_container_federation_api_port: 8448 +matrix_synapse_container_federation_api_tls_port: 8448 -matrix_synapse_container_federation_port: 8048 +matrix_synapse_container_federation_api_plain_port: 8048 # Controls whether the matrix-synapse container exposes the Client/Server API port (tcp/8008 in the container). # @@ -150,7 +150,7 @@ matrix_synapse_federation_rr_transactions_per_room_per_second: 50 # Controls whether the TLS federation listener is enabled (tcp/8448). # Only makes sense if federation is enabled (`matrix_synapse_federation_enabled`). -# Note that federation may potentially be enabled as non-TLS on `matrix_synapse_container_federation_port` as well. +# Note that federation may potentially be enabled as non-TLS on `matrix_synapse_container_federation_api_plain_port` as well. # If you're serving Synapse behind an HTTPS-capable reverse-proxy, # you can disable the TLS listener (`matrix_synapse_tls_federation_listener_enabled: false`). matrix_synapse_tls_federation_listener_enabled: true diff --git a/roles/matrix-synapse/templates/synapse/homeserver.yaml.j2 b/roles/matrix-synapse/templates/synapse/homeserver.yaml.j2 index 1a1cf6eb..a8e0ab6f 100644 --- a/roles/matrix-synapse/templates/synapse/homeserver.yaml.j2 +++ b/roles/matrix-synapse/templates/synapse/homeserver.yaml.j2 @@ -276,7 +276,7 @@ listeners: {% if matrix_synapse_federation_port_enabled and matrix_synapse_tls_federation_listener_enabled %} # TLS-enabled listener: for when matrix traffic is sent directly to synapse. - - port: {{ matrix_synapse_container_federation_api_port|to_json }} + - port: {{ matrix_synapse_container_federation_api_tls_port|to_json }} tls: true bind_addresses: ['::'] type: http @@ -302,7 +302,7 @@ listeners: {% if matrix_synapse_federation_port_enabled %} # Unsecure HTTP listener (Federation API): for when matrix traffic passes through a reverse proxy # that unwraps TLS. - - port: {{ matrix_synapse_container_federation_port|to_json }} + - port: {{ matrix_synapse_container_federation_api_plain_port|to_json }} tls: false bind_addresses: ['::'] type: http diff --git a/roles/matrix-synapse/templates/synapse/systemd/matrix-synapse.service.j2 b/roles/matrix-synapse/templates/synapse/systemd/matrix-synapse.service.j2 index 011d30f7..0451fd8d 100644 --- a/roles/matrix-synapse/templates/synapse/systemd/matrix-synapse.service.j2 +++ b/roles/matrix-synapse/templates/synapse/systemd/matrix-synapse.service.j2 @@ -43,10 +43,10 @@ ExecStart={{ matrix_host_command_docker }} run --rm --name matrix-synapse \ -p {{ matrix_synapse_container_client_api_host_bind_port }}:8008 \ {% endif %} {% if matrix_synapse_federation_enabled and matrix_synapse_tls_federation_listener_enabled and matrix_synapse_container_federation_api_tls_host_bind_port %} - -p {{ matrix_synapse_container_federation_api_tls_host_bind_port }}:{{ matrix_synapse_container_federation_api_port }} \ + -p {{ matrix_synapse_container_federation_api_tls_host_bind_port }}:{{ matrix_synapse_container_federation_api_tls_port }} \ {% endif %} {% if matrix_synapse_federation_enabled and matrix_synapse_container_federation_api_plain_host_bind_port %} - -p {{ matrix_synapse_container_federation_api_plain_host_bind_port }}:{{ matrix_synapse_container_federation_port }} \ + -p {{ matrix_synapse_container_federation_api_plain_host_bind_port }}:{{ matrix_synapse_container_federation_api_plain_port }} \ {% endif %} {% if matrix_synapse_metrics_enabled and matrix_synapse_container_metrics_api_host_bind_port %} -p {{ matrix_synapse_container_metrics_api_host_bind_port }}:{{ matrix_synapse_metrics_port }} \ From e72ae8bc484cfc1e35a2cd463ec81bebdf2a3342 Mon Sep 17 00:00:00 2001 From: Slavi Pantaleev Date: Mon, 15 Nov 2021 17:23:25 +0200 Subject: [PATCH 68/86] Upgrade matrix-corporal (2.1.3 -> 2.1.4) --- roles/matrix-corporal/defaults/main.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/roles/matrix-corporal/defaults/main.yml b/roles/matrix-corporal/defaults/main.yml index fd6b65d3..ccc7ef65 100644 --- a/roles/matrix-corporal/defaults/main.yml +++ b/roles/matrix-corporal/defaults/main.yml @@ -22,7 +22,7 @@ matrix_corporal_container_extra_arguments: [] # List of systemd services that matrix-corporal.service depends on matrix_corporal_systemd_required_services_list: ['docker.service'] -matrix_corporal_version: 2.1.3 +matrix_corporal_version: 2.1.4 matrix_corporal_docker_image: "{{ matrix_corporal_docker_image_name_prefix }}devture/matrix-corporal:{{ matrix_corporal_docker_image_tag }}" matrix_corporal_docker_image_name_prefix: "{{ 'localhost/' if matrix_corporal_container_image_self_build else matrix_container_global_registry_prefix }}" matrix_corporal_docker_image_tag: "{{ matrix_corporal_version }}" # for backward-compatibility From ae122466fc232d21da3cd5cdf5fcdf0a4625d460 Mon Sep 17 00:00:00 2001 From: iucca Date: Mon, 15 Nov 2021 19:23:28 +0100 Subject: [PATCH 69/86] updated whatsapp config --- docs/configuring-playbook-bridge-mautrix-whatsapp.md | 11 +++++++++-- roles/matrix-base/defaults/main.yml | 4 ---- .../templates/config.yaml.j2 | 10 +++++++--- .../templates/synapse/homeserver.yaml.j2 | 5 ----- 4 files changed, 16 insertions(+), 14 deletions(-) diff --git a/docs/configuring-playbook-bridge-mautrix-whatsapp.md b/docs/configuring-playbook-bridge-mautrix-whatsapp.md index 0101cecc..1e94e618 100644 --- a/docs/configuring-playbook-bridge-mautrix-whatsapp.md +++ b/docs/configuring-playbook-bridge-mautrix-whatsapp.md @@ -13,11 +13,18 @@ matrix_mautrix_whatsapp_enabled: true ## Enable backfilling history This requires a server with MSC2716 support, which is currently an experimental feature in synapse. Note that as of Synapse 1.46, there are still some bugs with the implementation, especially if using event persistence workers. - Use the following playbook configuration: ```yaml -matrix_bridges_backfill_enabled: true +matrix_synapse_configuration_extension_yaml: | + experimental_features: + msc2716_enabled: true +``` +```yaml +matrix_mautrix_whatsapp_configuration_extension_yaml: + bridge: + history_sync: + backfill: true ``` ## Set up Double Puppeting diff --git a/roles/matrix-base/defaults/main.yml b/roles/matrix-base/defaults/main.yml index a6f287f6..f61a5381 100644 --- a/roles/matrix-base/defaults/main.yml +++ b/roles/matrix-base/defaults/main.yml @@ -98,10 +98,6 @@ matrix_identity_server_url: ~ matrix_integration_manager_rest_url: ~ matrix_integration_manager_ui_url: ~ -# Enable backfilling history sync payloads from bridges using batch sending? -# This requires a server with MSC2716 support, which is currently an experimental feature in synapse. -matrix_bridges_backfill_enabled: false - # The domain name where a Jitsi server is self-hosted. # If set, `/.well-known/matrix/client` will suggest Element clients to use that Jitsi server. # See: https://github.com/vector-im/element-web/blob/develop/docs/jitsi.md#configuring-element-to-use-your-self-hosted-jitsi-server diff --git a/roles/matrix-bridge-mautrix-whatsapp/templates/config.yaml.j2 b/roles/matrix-bridge-mautrix-whatsapp/templates/config.yaml.j2 index 8e6d8eda..133cba2a 100644 --- a/roles/matrix-bridge-mautrix-whatsapp/templates/config.yaml.j2 +++ b/roles/matrix-bridge-mautrix-whatsapp/templates/config.yaml.j2 @@ -33,7 +33,7 @@ appservice: max_idle_conns: 2 # The unique ID of this appservice. - id: whatsapp + id: whatsappbot # Appservice bot details. bot: # Username of the appservice bot. @@ -77,12 +77,13 @@ bridge: # This requires a server with MSC2716 support, which is currently an experimental feature in synapse. # It can be enabled by setting experimental_features -> msc2716_enabled to true in homeserver.yaml. # Note that as of Synapse 1.46, there are still some bugs with the implementation, especially if using event persistence workers. - backfill: {{ matrix_bridges_backfill_enabled }} + backfill: false # Use double puppets for backfilling? # In order to use this, the double puppets must be in the appservice's user ID namespace # (because the bridge can't use the double puppet access token with batch sending). # This only affects double puppets on the local server, double puppets on other servers will never be used. - double_puppet_backfill: {{ matrix_bridges_backfill_enabled }} + # Doesn't work out of box with this playbook + double_puppet_backfill: false # Should the bridge request a full sync from the phone when logging in? # This bumps the size of history syncs from 3 months to 1 year. request_full_sync: false @@ -137,6 +138,9 @@ bridge: # Should WhatsApp status messages be bridged into a Matrix room? # Disabling this won't affect already created status broadcast rooms. enable_status_broadcast: true + # Should the status broadcast room be muted and moved into low priority by default? + # This is only applied when creating the room, the user can unmute/untag it later. + mute_status_broadcast: true # Should the bridge use thumbnails from WhatsApp? # They're disabled by default due to very low resolution. whatsapp_thumbnail: false diff --git a/roles/matrix-synapse/templates/synapse/homeserver.yaml.j2 b/roles/matrix-synapse/templates/synapse/homeserver.yaml.j2 index aa99d94d..cebe7a1f 100644 --- a/roles/matrix-synapse/templates/synapse/homeserver.yaml.j2 +++ b/roles/matrix-synapse/templates/synapse/homeserver.yaml.j2 @@ -2875,11 +2875,6 @@ opentracing: # events: worker1 # typing: worker1 -{% if matrix_bridges_backfill_enabled %} -Experimental: - msc2716_enabled: true -{% endif %} - # The worker that is used to run background tasks (e.g. cleaning up expired # data). If not provided this defaults to the main process. # From 3535c9711791591fa6ebc3ba53355b5e1a97523a Mon Sep 17 00:00:00 2001 From: iucca Date: Mon, 15 Nov 2021 19:25:08 +0100 Subject: [PATCH 70/86] updated whatsapp config --- roles/matrix-bridge-mautrix-whatsapp/templates/config.yaml.j2 | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/roles/matrix-bridge-mautrix-whatsapp/templates/config.yaml.j2 b/roles/matrix-bridge-mautrix-whatsapp/templates/config.yaml.j2 index 133cba2a..35865893 100644 --- a/roles/matrix-bridge-mautrix-whatsapp/templates/config.yaml.j2 +++ b/roles/matrix-bridge-mautrix-whatsapp/templates/config.yaml.j2 @@ -33,7 +33,7 @@ appservice: max_idle_conns: 2 # The unique ID of this appservice. - id: whatsappbot + id: whatsapp # Appservice bot details. bot: # Username of the appservice bot. From adf2dc13b394b9520aa67b0e629c9bde7ede38d1 Mon Sep 17 00:00:00 2001 From: IUCCA <33322841+IUCCA@users.noreply.github.com> Date: Mon, 15 Nov 2021 19:27:49 +0100 Subject: [PATCH 71/86] Update main.yml --- roles/matrix-base/defaults/main.yml | 2 -- 1 file changed, 2 deletions(-) diff --git a/roles/matrix-base/defaults/main.yml b/roles/matrix-base/defaults/main.yml index f61a5381..bf376c94 100644 --- a/roles/matrix-base/defaults/main.yml +++ b/roles/matrix-base/defaults/main.yml @@ -121,8 +121,6 @@ matrix_client_element_e2ee_secure_backup_setup_methods: [] # The Docker network that all services would be put into matrix_docker_network: "matrix" - - # Controls whether we'll preserve the vars.yml file on the Matrix server. # If you have a differently organized inventory, you may wish to disable this feature, # or to repoint `matrix_vars_yml_snapshotting_src` to the file you'd like to preserve. From 788999d29cce126bace2b8e907e99c9b32fb423c Mon Sep 17 00:00:00 2001 From: iucca Date: Mon, 15 Nov 2021 19:34:56 +0100 Subject: [PATCH 72/86] updated whatsapp config --- docs/configuring-playbook-bridge-mautrix-whatsapp.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/docs/configuring-playbook-bridge-mautrix-whatsapp.md b/docs/configuring-playbook-bridge-mautrix-whatsapp.md index 1e94e618..2af38be1 100644 --- a/docs/configuring-playbook-bridge-mautrix-whatsapp.md +++ b/docs/configuring-playbook-bridge-mautrix-whatsapp.md @@ -8,7 +8,8 @@ Use the following playbook configuration: ```yaml matrix_mautrix_whatsapp_enabled: true -``` +``` +Whatsapp multidevice beta is required, now it is enough if Whatsapp is connected to the Internet every 2 weeks. ## Enable backfilling history This requires a server with MSC2716 support, which is currently an experimental feature in synapse. From 1ec67f49b07c5c096288ed73021ecf2770b4a1f4 Mon Sep 17 00:00:00 2001 From: boris runakov Date: Mon, 15 Nov 2021 22:43:05 +0200 Subject: [PATCH 73/86] replaced 8008 where possible --- group_vars/matrix_servers | 6 +++--- .../scripts/matrix_build_room_list.py | 5 +++-- .../tasks/purge_database_build_list.yml | 4 ++-- .../matrix-awx/tasks/purge_database_events.yml | 4 ++-- roles/matrix-awx/tasks/purge_database_main.yml | 18 +++++++++--------- .../tasks/purge_database_no_local.yml | 6 +++--- .../matrix-awx/tasks/purge_database_users.yml | 6 +++--- roles/matrix-awx/tasks/purge_media_local.yml | 6 +++--- roles/matrix-awx/tasks/purge_media_main.yml | 10 +++++----- roles/matrix-awx/tasks/purge_media_remote.yml | 6 +++--- roles/matrix-base/defaults/main.yml | 2 +- .../defaults/main.yml | 4 ++-- .../defaults/main.yml | 2 +- roles/matrix-bridge-sms/defaults/main.yml | 2 +- roles/matrix-corporal/defaults/main.yml | 2 +- roles/matrix-ma1sd/defaults/main.yml | 2 +- roles/matrix-nginx-proxy/defaults/main.yml | 4 ++-- roles/matrix-synapse/defaults/main.yml | 4 +++- .../templates/synapse/homeserver.yaml.j2 | 2 +- .../synapse/systemd/matrix-synapse.service.j2 | 2 +- .../matrix-synapse-register-user.j2 | 4 ++-- .../templates/synapse/worker.yaml.j2 | 2 +- roles/matrix-synapse/vars/workers.yml | 2 +- 23 files changed, 54 insertions(+), 51 deletions(-) diff --git a/group_vars/matrix_servers b/group_vars/matrix_servers index 52dc671c..139ccb02 100755 --- a/group_vars/matrix_servers +++ b/group_vars/matrix_servers @@ -19,9 +19,9 @@ matrix_container_global_registry_prefix: "docker.io/" matrix_identity_server_url: "{{ ('https://' + matrix_server_fqn_matrix) if matrix_ma1sd_enabled else None }}" -# If Synapse workers are enabled and matrix-nginx-proxy is disabled, certain APIs may not work over 'http://matrix-synapse:8008'. +# If Synapse workers are enabled and matrix-nginx-proxy is disabled, certain APIs may not work over 'http://matrix-synapse:{{ matrix_synapse_container_client_api_port }}'. # This is because we explicitly disable them for the main Synapse process. -matrix_homeserver_container_url: "{{ 'http://matrix-nginx-proxy:12080' if matrix_nginx_proxy_enabled else 'http://matrix-synapse:8008' }}" +matrix_homeserver_container_url: "{{ 'http://matrix-nginx-proxy:12080' if matrix_nginx_proxy_enabled else 'http://matrix-synapse:'+ matrix_synapse_container_client_api_port|string }}" ###################################################################### # @@ -1722,7 +1722,7 @@ matrix_synapse_account_threepid_delegates_msisdn: "{{ 'http://matrix-ma1sd:' + m # you can expose Synapse's ports to the host. # # For exposing the Matrix Client API's port (plain HTTP) to the local host. -matrix_synapse_container_client_api_host_bind_port: "{{ '' if matrix_nginx_proxy_enabled else '127.0.0.1:8008' }}" +matrix_synapse_container_client_api_host_bind_port: "{{ '' if matrix_nginx_proxy_enabled else '127.0.0.1:' + matrix_synapse_container_client_api_port|string }}" # # For exposing the Matrix Federation API's plain port (plain HTTP) to the local host. matrix_synapse_container_federation_api_plain_host_bind_port: "{{ '' if matrix_nginx_proxy_enabled else '127.0.0.1:' + matrix_synapse_container_federation_api_plain_port|string }}" diff --git a/roles/matrix-awx/scripts/matrix_build_room_list.py b/roles/matrix-awx/scripts/matrix_build_room_list.py index 3abfcd8c..94779ca7 100644 --- a/roles/matrix-awx/scripts/matrix_build_room_list.py +++ b/roles/matrix-awx/scripts/matrix_build_room_list.py @@ -5,10 +5,11 @@ import json janitor_token = sys.argv[1] synapse_container_ip = sys.argv[2] +synapse_container_port = sys.argv[3] # collect total amount of rooms -rooms_raw_url = 'http://' + synapse_container_ip + ':8008/_synapse/admin/v1/rooms' +rooms_raw_url = 'http://' + synapse_container_ip + ':' + synapse_container_port + '/_synapse/admin/v1/rooms' rooms_raw_header = {'Authorization': 'Bearer ' + janitor_token} rooms_raw = requests.get(rooms_raw_url, headers=rooms_raw_header) rooms_raw_python = json.loads(rooms_raw.text) @@ -19,7 +20,7 @@ total_rooms = rooms_raw_python["total_rooms"] room_list_file = open("/tmp/room_list_complete.json", "w") for i in range(0, total_rooms, 100): - rooms_inc_url = 'http://' + synapse_container_ip + ':8008/_synapse/admin/v1/rooms?from=' + str(i) + rooms_inc_url = 'http://' + synapse_container_ip + ':' + synapse_container_port + '/_synapse/admin/v1/rooms?from=' + str(i) rooms_inc = requests.get(rooms_inc_url, headers=rooms_raw_header) room_list_file.write(rooms_inc.text) diff --git a/roles/matrix-awx/tasks/purge_database_build_list.yml b/roles/matrix-awx/tasks/purge_database_build_list.yml index 5ca57d22..339510f0 100644 --- a/roles/matrix-awx/tasks/purge_database_build_list.yml +++ b/roles/matrix-awx/tasks/purge_database_build_list.yml @@ -2,9 +2,9 @@ - name: Collect entire room list into stdout shell: | - curl -X GET --header "Authorization: Bearer {{ janitors_token.stdout[1:-1] }}" '{{ synapse_container_ip.stdout }}:8008/_synapse/admin/v1/rooms?from={{ item }}' + curl -X GET --header "Authorization: Bearer {{ janitors_token.stdout[1:-1] }}" '{{ synapse_container_ip.stdout }}:{{ matrix_synapse_container_client_api_port }}/_synapse/admin/v1/rooms?from={{ item }}' register: awx_rooms_output - + - name: Print stdout to file delegate_to: 127.0.0.1 shell: | diff --git a/roles/matrix-awx/tasks/purge_database_events.yml b/roles/matrix-awx/tasks/purge_database_events.yml index aaef3cba..586bc17c 100644 --- a/roles/matrix-awx/tasks/purge_database_events.yml +++ b/roles/matrix-awx/tasks/purge_database_events.yml @@ -2,11 +2,11 @@ - name: Purge all rooms with more then N events shell: | - curl --header "Authorization: Bearer {{ awx_janitors_token.stdout[1:-1] }}" -X POST -H "Content-Type: application/json" -d '{ "delete_local_events": false, "purge_up_to_ts": {{ awx_purge_epoche_time.stdout }}000 }' "{{ awx_synapse_container_ip.stdout }}:8008/_synapse/admin/v1/purge_history/{{ item[1:-1] }}" + curl --header "Authorization: Bearer {{ awx_janitors_token.stdout[1:-1] }}" -X POST -H "Content-Type: application/json" -d '{ "delete_local_events": false, "purge_up_to_ts": {{ awx_purge_epoche_time.stdout }}000 }' "{{ awx_synapse_container_ip.stdout }}:{{ matrix_synapse_container_client_api_port }}/_synapse/admin/v1/purge_history/{{ item[1:-1] }}" register: awx_purge_command - name: Print output of purge command - debug: + debug: msg: "{{ awx_purge_command.stdout }}" - name: Pause for 5 seconds to let Synapse breathe diff --git a/roles/matrix-awx/tasks/purge_database_main.yml b/roles/matrix-awx/tasks/purge_database_main.yml index 6b132091..2cdf0330 100644 --- a/roles/matrix-awx/tasks/purge_database_main.yml +++ b/roles/matrix-awx/tasks/purge_database_main.yml @@ -31,7 +31,7 @@ - name: Collect access token for janitor user shell: | - curl -X POST -d '{"type":"m.login.password", "user":"janitor", "password":"{{ awx_janitor_user_password }}"}' "{{ awx_synapse_container_ip.stdout }}:8008/_matrix/client/r0/login" | jq '.access_token' + curl -X POST -d '{"type":"m.login.password", "user":"janitor", "password":"{{ awx_janitor_user_password }}"}' "{{ awx_synapse_container_ip.stdout }}:{{ matrix_synapse_container_client_api_port }}/_matrix/client/r0/login" | jq '.access_token' when: (awx_purge_mode.find("No local users [recommended]") != -1) or (awx_purge_mode.find("Number of users [slower]") != -1) or (awx_purge_mode.find("Number of events [slower]") != -1) register: awx_janitors_token no_log: True @@ -47,7 +47,7 @@ - name: Run build_room_list.py script shell: | - runuser -u matrix -- python3 /usr/local/bin/matrix_build_room_list.py {{ awx_janitors_token.stdout[1:-1] }} {{ awx_synapse_container_ip.stdout }} + runuser -u matrix -- python3 /usr/local/bin/matrix_build_room_list.py {{ awx_janitors_token.stdout[1:-1] }} {{ awx_synapse_container_ip.stdout }} {{ matrix_synapse_container_client_api_port.stdout }} register: awx_rooms_total when: (awx_purge_mode.find("No local users [recommended]") != -1) or (awx_purge_mode.find("Number of users [slower]") != -1) or (awx_purge_mode.find("Number of events [slower]") != -1) @@ -69,7 +69,7 @@ shell: | jq 'try .rooms[] | select(.joined_local_members == 0) | .room_id' < /tmp/{{ subscription_id }}_room_list_complete.json > /tmp/{{ subscription_id }}_room_list_no_local_users.txt when: (awx_purge_mode.find("No local users [recommended]") != -1) or (awx_purge_mode.find("Number of users [slower]") != -1) or (awx_purge_mode.find("Number of events [slower]") != -1) - + - name: Count number of rooms with no local users delegate_to: 127.0.0.1 shell: | @@ -84,7 +84,7 @@ when: (awx_purge_mode.find("No local users [recommended]") != -1) or (awx_purge_mode.find("Number of users [slower]") != -1) or (awx_purge_mode.find("Number of events [slower]") != -1) - name: Purge all rooms with no local users - include_tasks: purge_database_no_local.yml + include_tasks: purge_database_no_local.yml loop: "{{ awx_room_list_no_local_users.splitlines() | flatten(levels=1) }}" when: (awx_purge_mode.find("No local users [recommended]") != -1) or (awx_purge_mode.find("Number of users [slower]") != -1) or (awx_purge_mode.find("Number of events [slower]") != -1) @@ -116,7 +116,7 @@ no_log: True - name: Purge all rooms with more then N users - include_tasks: purge_database_users.yml + include_tasks: purge_database_users.yml loop: "{{ awx_room_list_joined_members.splitlines() | flatten(levels=1) }}" when: awx_purge_mode.find("Number of users [slower]") != -1 @@ -141,7 +141,7 @@ no_log: True - name: Purge all rooms with more then N events - include_tasks: purge_database_events.yml + include_tasks: purge_database_events.yml loop: "{{ awx_room_list_state_events.splitlines() | flatten(levels=1) }}" when: awx_purge_mode.find("Number of events [slower]") != -1 @@ -171,7 +171,7 @@ wait: yes tower_host: "https://{{ awx_host }}" tower_oauthtoken: "{{ awx_session_token.ansible_facts.tower_token.token }}" - validate_certs: yes + validate_certs: yes when: (awx_purge_mode.find("No local users [recommended]") != -1) or (awx_purge_mode.find("Number of users [slower]") != -1) or (awx_purge_mode.find("Number of events [slower]") != -1) or (awx_purge_mode.find("Skip purging rooms [faster]") != -1) - name: Revert 'Deploy/Update a Server' job template @@ -237,7 +237,7 @@ wait: yes tower_host: "https://{{ awx_host }}" tower_oauthtoken: "{{ awx_session_token.ansible_facts.tower_token.token }}" - validate_certs: yes + validate_certs: yes when: (awx_purge_mode.find("Perform final shrink") != -1) - name: Revert 'Deploy/Update a Server' job template @@ -272,7 +272,7 @@ when: (awx_purge_mode.find("Perform final shrink") != -1) no_log: True -- name: Print total number of rooms processed +- name: Print total number of rooms processed debug: msg: '{{ awx_rooms_total.stdout }}' when: (awx_purge_mode.find("No local users [recommended]") != -1) or (awx_purge_mode.find("Number of users [slower]") != -1) or (awx_purge_mode.find("Number of events [slower]") != -1) diff --git a/roles/matrix-awx/tasks/purge_database_no_local.yml b/roles/matrix-awx/tasks/purge_database_no_local.yml index 33f99c49..e464f56d 100644 --- a/roles/matrix-awx/tasks/purge_database_no_local.yml +++ b/roles/matrix-awx/tasks/purge_database_no_local.yml @@ -2,11 +2,11 @@ - name: Purge all rooms with no local users shell: | - curl --header "Authorization: Bearer {{ awx_janitors_token.stdout[1:-1] }}" -X POST -H "Content-Type: application/json" -d '{ "room_id": {{ item }} }' '{{ awx_synapse_container_ip.stdout }}:8008/_synapse/admin/v1/purge_room' + curl --header "Authorization: Bearer {{ awx_janitors_token.stdout[1:-1] }}" -X POST -H "Content-Type: application/json" -d '{ "room_id": {{ item }} }' '{{ awx_synapse_container_ip.stdout }}:{{ matrix_synapse_container_client_api_port }}/_synapse/admin/v1/purge_room' register: awx_purge_command - + - name: Print output of purge command - debug: + debug: msg: "{{ awx_purge_command.stdout }}" - name: Pause for 5 seconds to let Synapse breathe diff --git a/roles/matrix-awx/tasks/purge_database_users.yml b/roles/matrix-awx/tasks/purge_database_users.yml index 1c8da14d..d315a9ef 100644 --- a/roles/matrix-awx/tasks/purge_database_users.yml +++ b/roles/matrix-awx/tasks/purge_database_users.yml @@ -2,11 +2,11 @@ - name: Purge all rooms with more then N users shell: | - curl --header "Authorization: Bearer {{ awx_janitors_token.stdout[1:-1] }}" -X POST -H "Content-Type: application/json" -d '{ "delete_local_events": false, "purge_up_to_ts": {{ awx_purge_epoche_time.stdout }}000 }' "{{ awx_synapse_container_ip.stdout }}:8008/_synapse/admin/v1/purge_history/{{ item[1:-1] }}" + curl --header "Authorization: Bearer {{ awx_janitors_token.stdout[1:-1] }}" -X POST -H "Content-Type: application/json" -d '{ "delete_local_events": false, "purge_up_to_ts": {{ awx_purge_epoche_time.stdout }}000 }' "{{ awx_synapse_container_ip.stdout }}:{{ matrix_synapse_container_client_api_port }}/_synapse/admin/v1/purge_history/{{ item[1:-1] }}" register: awx_purge_command - + - name: Print output of purge command - debug: + debug: msg: "{{ awx_purge_command.stdout }}" - name: Pause for 5 seconds to let Synapse breathe diff --git a/roles/matrix-awx/tasks/purge_media_local.yml b/roles/matrix-awx/tasks/purge_media_local.yml index 2074d5d8..7ef79eca 100644 --- a/roles/matrix-awx/tasks/purge_media_local.yml +++ b/roles/matrix-awx/tasks/purge_media_local.yml @@ -7,11 +7,11 @@ - name: Purge local media to specific date shell: | - curl -X POST --header "Authorization: Bearer {{ awx_janitors_token.stdout[1:-1] }}" '{{ awx_synapse_container_ip.stdout }}:8008/_synapse/admin/v1/media/matrix.{{ matrix_domain }}/delete?before_ts={{ awx_epoche_time.stdout }}000' + curl -X POST --header "Authorization: Bearer {{ awx_janitors_token.stdout[1:-1] }}" '{{ awx_synapse_container_ip.stdout }}:{{ matrix_synapse_container_client_api_port }}/_synapse/admin/v1/media/matrix.{{ matrix_domain }}/delete?before_ts={{ awx_epoche_time.stdout }}000' register: awx_purge_command - + - name: Print output of purge command - debug: + debug: msg: "{{ awx_purge_command.stdout }}" - name: Pause for 5 seconds to let Synapse breathe diff --git a/roles/matrix-awx/tasks/purge_media_main.yml b/roles/matrix-awx/tasks/purge_media_main.yml index 9c5f6bfb..0c322b85 100644 --- a/roles/matrix-awx/tasks/purge_media_main.yml +++ b/roles/matrix-awx/tasks/purge_media_main.yml @@ -9,7 +9,7 @@ include_vars: file: '/var/lib/awx/projects/clients/{{ member_id }}/{{ subscription_id }}/matrix_vars.yml' no_log: True - + - name: Ensure curl and jq intalled on target machine apt: pkg: @@ -23,7 +23,7 @@ - name: Collect access token for janitor user shell: | - curl -XPOST -d '{"type":"m.login.password", "user":"janitor", "password":"{{ awx_janitor_user_password }}"}' "{{ awx_synapse_container_ip.stdout }}:8008/_matrix/client/r0/login" | jq '.access_token' + curl -XPOST -d '{"type":"m.login.password", "user":"janitor", "password":"{{ awx_janitor_user_password }}"}' "{{ awx_synapse_container_ip.stdout }}:{{ matrix_synapse_container_client_api_port }}/_matrix/client/r0/login" | jq '.access_token' register: awx_janitors_token no_log: True @@ -31,7 +31,7 @@ delegate_to: 127.0.0.1 shell: "dateseq {{ matrix_purge_from_date }} {{ matrix_purge_to_date }}" register: awx_purge_dates - + - name: Calculate initial size of local media repository shell: du -sh /matrix/synapse/storage/media-store/local* register: awx_local_media_size_before @@ -47,12 +47,12 @@ no_log: True - name: Purge local media with loop - include_tasks: purge_media_local.yml + include_tasks: purge_media_local.yml loop: "{{ awx_purge_dates.stdout_lines | flatten(levels=1) }}" when: awx_purge_media_type == "Local Media" - name: Purge remote media with loop - include_tasks: purge_media_remote.yml + include_tasks: purge_media_remote.yml loop: "{{ awx_purge_dates.stdout_lines | flatten(levels=1) }}" when: awx_purge_media_type == "Remote Media" diff --git a/roles/matrix-awx/tasks/purge_media_remote.yml b/roles/matrix-awx/tasks/purge_media_remote.yml index 1418d9a6..5bb71918 100644 --- a/roles/matrix-awx/tasks/purge_media_remote.yml +++ b/roles/matrix-awx/tasks/purge_media_remote.yml @@ -7,11 +7,11 @@ - name: Purge remote media to specific date shell: | - curl -X POST --header "Authorization: Bearer {{ awx_janitors_token.stdout[1:-1] }}" '{{ awx_synapse_container_ip.stdout }}:8008/_synapse/admin/v1/purge_media_cache?before_ts={{ awx_epoche_time.stdout }}000' + curl -X POST --header "Authorization: Bearer {{ awx_janitors_token.stdout[1:-1] }}" '{{ awx_synapse_container_ip.stdout }}:{{ matrix_synapse_container_client_api_port }}/_synapse/admin/v1/purge_media_cache?before_ts={{ awx_epoche_time.stdout }}000' register: awx_purge_command - + - name: Print output of purge command - debug: + debug: msg: "{{ awx_purge_command.stdout }}" - name: Pause for 5 seconds to let Synapse breathe diff --git a/roles/matrix-base/defaults/main.yml b/roles/matrix-base/defaults/main.yml index bf376c94..8f3203ab 100644 --- a/roles/matrix-base/defaults/main.yml +++ b/roles/matrix-base/defaults/main.yml @@ -91,7 +91,7 @@ matrix_homeserver_url: "https://{{ matrix_server_fqn_matrix }}" # Specifies where the homeserver is on the container network. # Where this is depends on whether there's a reverse-proxy in front of it, etc. # This likely gets overriden elsewhere. -matrix_homeserver_container_url: "http://matrix-synapse:8008" +matrix_homeserver_container_url: "http://matrix-synapse:{{ matrix_synapse_container_client_api_port }}" matrix_identity_server_url: ~ diff --git a/roles/matrix-bridge-appservice-slack/defaults/main.yml b/roles/matrix-bridge-appservice-slack/defaults/main.yml index 10b3d7b4..317ea0c0 100644 --- a/roles/matrix-bridge-appservice-slack/defaults/main.yml +++ b/roles/matrix-bridge-appservice-slack/defaults/main.yml @@ -33,7 +33,7 @@ matrix_appservice_slack_slack_port: 9003 matrix_appservice_slack_container_http_host_bind_port: '' matrix_appservice_slack_homeserver_media_url: "{{ matrix_server_fqn_matrix }}" -matrix_appservice_slack_homeserver_url: "http://matrix-synapse:8008" +matrix_appservice_slack_homeserver_url: "http://matrix-synapse:{{ matrix_synapse_container_client_api_port }}" matrix_appservice_slack_homeserver_domain: "{{ matrix_domain }}" matrix_appservice_slack_appservice_url: 'http://matrix-appservice-slack' @@ -82,7 +82,7 @@ matrix_appservice_slack_configuration_extension_yaml: | # Optional #matrix_admin_room: "!aBcDeF:matrix.org" #homeserver: - # url: http://localhost:8008 + # url: http://localhost:{{ matrix_synapse_container_client_api_port }} # server_name: my.server # Optional #tls: diff --git a/roles/matrix-bridge-appservice-webhooks/defaults/main.yml b/roles/matrix-bridge-appservice-webhooks/defaults/main.yml index 2b9fe310..e051ea22 100644 --- a/roles/matrix-bridge-appservice-webhooks/defaults/main.yml +++ b/roles/matrix-bridge-appservice-webhooks/defaults/main.yml @@ -36,7 +36,7 @@ matrix_appservice_webhooks_matrix_port: 6789 matrix_appservice_webhooks_container_http_host_bind_port: '' matrix_appservice_webhooks_homeserver_media_url: "{{ matrix_server_fqn_matrix }}" -matrix_appservice_webhooks_homeserver_url: "http://matrix-synapse:8008" +matrix_appservice_webhooks_homeserver_url: "http://matrix-synapse:{{ matrix_synapse_container_client_api_port }}" matrix_appservice_webhooks_homeserver_domain: "{{ matrix_domain }}" matrix_appservice_webhooks_appservice_url: 'http://matrix-appservice-webhooks' diff --git a/roles/matrix-bridge-sms/defaults/main.yml b/roles/matrix-bridge-sms/defaults/main.yml index 55f99101..8f2f79a0 100644 --- a/roles/matrix-bridge-sms/defaults/main.yml +++ b/roles/matrix-bridge-sms/defaults/main.yml @@ -26,7 +26,7 @@ matrix_sms_bridge_systemd_wanted_services_list: [] matrix_sms_bridge_appservice_url: 'http://matrix-sms-bridge:8080' matrix_sms_bridge_homeserver_hostname: 'matrix-synapse' -matrix_sms_bridge_homeserver_port: '8008' +matrix_sms_bridge_homeserver_port: "{{ matrix_synapse_container_client_api_port }}" matrix_sms_bridge_homserver_domain: "{{ matrix_domain }}" matrix_sms_bridge_default_room: '' diff --git a/roles/matrix-corporal/defaults/main.yml b/roles/matrix-corporal/defaults/main.yml index fd6b65d3..d542fd77 100644 --- a/roles/matrix-corporal/defaults/main.yml +++ b/roles/matrix-corporal/defaults/main.yml @@ -36,7 +36,7 @@ matrix_corporal_var_dir_path: "{{ matrix_corporal_base_path }}/var" matrix_corporal_matrix_homeserver_domain_name: "{{ matrix_domain }}" -# Controls where matrix-corporal can reach your Synapse server (e.g. "http://matrix-synapse:8008"). +# Controls where matrix-corporal can reach your Synapse server (e.g. "http://matrix-synapse:{{ matrix_synapse_container_client_api_port }}"). # If Synapse runs on the same machine, you may need to add its service to `matrix_corporal_systemd_required_services_list`. matrix_corporal_matrix_homeserver_api_endpoint: "" diff --git a/roles/matrix-ma1sd/defaults/main.yml b/roles/matrix-ma1sd/defaults/main.yml index adee0b44..9e1e611a 100644 --- a/roles/matrix-ma1sd/defaults/main.yml +++ b/roles/matrix-ma1sd/defaults/main.yml @@ -83,7 +83,7 @@ matrix_ma1sd_threepid_medium_email_connectors_smtp_password: "" # so that ma1sd can rewrite the original URL to one that would reach the homeserver. matrix_ma1sd_dns_overwrite_enabled: false matrix_ma1sd_dns_overwrite_homeserver_client_name: "{{ matrix_server_fqn_matrix }}" -matrix_ma1sd_dns_overwrite_homeserver_client_value: "http://matrix-synapse:8008" +matrix_ma1sd_dns_overwrite_homeserver_client_value: "http://matrix-synapse:{{ matrix_synapse_container_client_api_port }}" # Override the default session templates # To use this, fill in the template variables with the full desired template as a multi-line YAML variable diff --git a/roles/matrix-nginx-proxy/defaults/main.yml b/roles/matrix-nginx-proxy/defaults/main.yml index ea26084e..368d9bdd 100644 --- a/roles/matrix-nginx-proxy/defaults/main.yml +++ b/roles/matrix-nginx-proxy/defaults/main.yml @@ -197,8 +197,8 @@ matrix_nginx_proxy_proxy_matrix_client_api_addr_with_container: "matrix-nginx-pr matrix_nginx_proxy_proxy_matrix_client_api_addr_sans_container: "127.0.0.1:12080" # The addresses where the Matrix Client API is, when using Synapse. -matrix_nginx_proxy_proxy_synapse_client_api_addr_with_container: "matrix-synapse:8008" -matrix_nginx_proxy_proxy_synapse_client_api_addr_sans_container: "127.0.0.1:8008" +matrix_nginx_proxy_proxy_synapse_client_api_addr_with_container: "matrix-synapse:{{ matrix_synapse_container_client_api_port }}" +matrix_nginx_proxy_proxy_synapse_client_api_addr_sans_container: "127.0.0.1:{{ matrix_synapse_container_client_api_port }}" # This needs to be equal or higher than the maximum upload size accepted by Synapse. matrix_nginx_proxy_proxy_matrix_client_api_client_max_body_size_mb: 50 diff --git a/roles/matrix-synapse/defaults/main.yml b/roles/matrix-synapse/defaults/main.yml index 624a6b5e..a6feb1ab 100644 --- a/roles/matrix-synapse/defaults/main.yml +++ b/roles/matrix-synapse/defaults/main.yml @@ -27,11 +27,13 @@ matrix_synapse_storage_path: "{{ matrix_synapse_base_path }}/storage" matrix_synapse_media_store_path: "{{ matrix_synapse_storage_path }}/media-store" matrix_synapse_ext_path: "{{ matrix_synapse_base_path }}/ext" +matrix_synapse_container_client_api_port: 8008 + matrix_synapse_container_federation_api_tls_port: 8448 matrix_synapse_container_federation_api_plain_port: 8048 -# Controls whether the matrix-synapse container exposes the Client/Server API port (tcp/8008 in the container). +# Controls whether the matrix-synapse container exposes the Client/Server API port (tcp/{{ matrix_synapse_container_client_api_port }} in the container). # # Takes an ":" or "" value (e.g. "127.0.0.1:8008"), or empty string to not expose. matrix_synapse_container_client_api_host_bind_port: '' diff --git a/roles/matrix-synapse/templates/synapse/homeserver.yaml.j2 b/roles/matrix-synapse/templates/synapse/homeserver.yaml.j2 index a8e0ab6f..e1ee7307 100644 --- a/roles/matrix-synapse/templates/synapse/homeserver.yaml.j2 +++ b/roles/matrix-synapse/templates/synapse/homeserver.yaml.j2 @@ -289,7 +289,7 @@ listeners: # Unsecure HTTP listener (Client API): for when matrix traffic passes through a reverse proxy # that unwraps TLS. - - port: 8008 + - port: {{ matrix_synapse_container_client_api_port|tojson }} tls: false bind_addresses: ['::'] type: http diff --git a/roles/matrix-synapse/templates/synapse/systemd/matrix-synapse.service.j2 b/roles/matrix-synapse/templates/synapse/systemd/matrix-synapse.service.j2 index 0451fd8d..7fec6649 100644 --- a/roles/matrix-synapse/templates/synapse/systemd/matrix-synapse.service.j2 +++ b/roles/matrix-synapse/templates/synapse/systemd/matrix-synapse.service.j2 @@ -40,7 +40,7 @@ ExecStart={{ matrix_host_command_docker }} run --rm --name matrix-synapse \ --tmpfs=/tmp:rw,noexec,nosuid,size={{ matrix_synapse_tmp_directory_size_mb }}m \ --network={{ matrix_docker_network }} \ {% if matrix_synapse_container_client_api_host_bind_port %} - -p {{ matrix_synapse_container_client_api_host_bind_port }}:8008 \ + -p {{ matrix_synapse_container_client_api_host_bind_port }}:{{ matrix_synapse_container_client_api_port }} \ {% endif %} {% if matrix_synapse_federation_enabled and matrix_synapse_tls_federation_listener_enabled and matrix_synapse_container_federation_api_tls_host_bind_port %} -p {{ matrix_synapse_container_federation_api_tls_host_bind_port }}:{{ matrix_synapse_container_federation_api_tls_port }} \ diff --git a/roles/matrix-synapse/templates/synapse/usr-local-bin/matrix-synapse-register-user.j2 b/roles/matrix-synapse/templates/synapse/usr-local-bin/matrix-synapse-register-user.j2 index 456c0667..228cc9ea 100644 --- a/roles/matrix-synapse/templates/synapse/usr-local-bin/matrix-synapse-register-user.j2 +++ b/roles/matrix-synapse/templates/synapse/usr-local-bin/matrix-synapse-register-user.j2 @@ -11,7 +11,7 @@ password=$2 admin=$3 if [ "$admin" -eq "1" ]; then - docker exec matrix-synapse register_new_matrix_user -u "$user" -p "$password" -c /data/homeserver.yaml --admin http://localhost:8008 + docker exec matrix-synapse register_new_matrix_user -u "$user" -p "$password" -c /data/homeserver.yaml --admin http://localhost:{{ matrix_synapse_container_client_api_port }} else - docker exec matrix-synapse register_new_matrix_user -u "$user" -p "$password" -c /data/homeserver.yaml --no-admin http://localhost:8008 + docker exec matrix-synapse register_new_matrix_user -u "$user" -p "$password" -c /data/homeserver.yaml --no-admin http://localhost:{{ matrix_synapse_container_client_api_port }} fi diff --git a/roles/matrix-synapse/templates/synapse/worker.yaml.j2 b/roles/matrix-synapse/templates/synapse/worker.yaml.j2 index 36ae5a7e..40714f44 100644 --- a/roles/matrix-synapse/templates/synapse/worker.yaml.j2 +++ b/roles/matrix-synapse/templates/synapse/worker.yaml.j2 @@ -38,7 +38,7 @@ worker_listeners: {% endif %} {% if matrix_synapse_worker_details.type == 'frontend_proxy' %} -worker_main_http_uri: http://matrix-synapse:8008 +worker_main_http_uri: http://matrix-synapse:{{ matrix_synapse_container_client_api_port }} {% endif %} worker_daemonize: false diff --git a/roles/matrix-synapse/vars/workers.yml b/roles/matrix-synapse/vars/workers.yml index 049ae9b5..fda7227c 100644 --- a/roles/matrix-synapse/vars/workers.yml +++ b/roles/matrix-synapse/vars/workers.yml @@ -319,7 +319,7 @@ matrix_synapse_workers_frontend_proxy_endpoints: # the `worker_main_http_uri` setting in the `frontend_proxy` worker configuration # file. For example: - # worker_main_http_uri: http://127.0.0.1:8008 + # worker_main_http_uri: http://127.0.0.1:{{ matrix_synapse_container_client_api_port }} matrix_synapse_workers_avail_list: - appservice From b272e6147ad923174edb85b20a4a2f78148ad25f Mon Sep 17 00:00:00 2001 From: iucca Date: Tue, 16 Nov 2021 13:37:11 +0100 Subject: [PATCH 74/86] Resolved server_map --- .../defaults/main.yml | 1 + .../templates/config.yaml.j2 | 19 +++---------------- 2 files changed, 4 insertions(+), 16 deletions(-) diff --git a/roles/matrix-bridge-mautrix-whatsapp/defaults/main.yml b/roles/matrix-bridge-mautrix-whatsapp/defaults/main.yml index 7409fb4d..a39cdeb9 100644 --- a/roles/matrix-bridge-mautrix-whatsapp/defaults/main.yml +++ b/roles/matrix-bridge-mautrix-whatsapp/defaults/main.yml @@ -74,6 +74,7 @@ matrix_mautrix_whatsapp_appservice_database_uri: "{{ # Can be set to enable automatic double-puppeting via Shared Secret Auth (https://github.com/devture/matrix-synapse-shared-secret-auth). matrix_mautrix_whatsapp_login_shared_secret: '' +matrix_mautrix_whatsapp_login_shared_secret_map: "{{ {matrix_mautrix_whatsapp_homeserver_domain: matrix_mautrix_whatsapp_login_shared_secret} if matrix_mautrix_whatsapp_login_shared_secret else {} }}" # Default mautrix-whatsapp configuration template which covers the generic use case. # You can customize it by controlling the various variables inside it. diff --git a/roles/matrix-bridge-mautrix-whatsapp/templates/config.yaml.j2 b/roles/matrix-bridge-mautrix-whatsapp/templates/config.yaml.j2 index 35865893..a4335936 100644 --- a/roles/matrix-bridge-mautrix-whatsapp/templates/config.yaml.j2 +++ b/roles/matrix-bridge-mautrix-whatsapp/templates/config.yaml.j2 @@ -15,11 +15,9 @@ homeserver: appservice: # The address that the homeserver can use to connect to this appservice. address: {{ matrix_mautrix_whatsapp_appservice_address }} - # The hostname and port where this appservice should listen. hostname: 0.0.0.0 port: 8080 - # Database config. database: # The database type. "sqlite3" and "postgres" are supported. @@ -31,7 +29,6 @@ appservice: # Maximum number of connections. Mostly relevant for Postgres. max_open_conns: 20 max_idle_conns: 2 - # The unique ID of this appservice. id: whatsapp # Appservice bot details. @@ -42,7 +39,6 @@ appservice: # to leave display name/avatar as-is. displayname: WhatsApp bridge bot avatar: mxc://maunium.net/NeXNQarUbrlYBiPCpprYsRqr - # Authentication tokens for AS <-> HS communication. Autogenerated; do not modify. as_token: "{{ matrix_mautrix_whatsapp_appservice_token }}" hs_token: "{{ matrix_mautrix_whatsapp_homeserver_token }}" @@ -53,7 +49,6 @@ bridge: # {{ '{{.}}' }} is replaced with the phone number of the WhatsApp user. username_template: "{{ 'whatsapp_{{.}}' }}" displayname_template: "{{ '{{if .PushName}}{{.PushName}}{{else if .BusinessName}}{{.BusinessName}}{{else}}{{.JID}}{{end}} (WA)' }}" - # Should the bridge send a read receipt from the bridge bot when a message has been sent to WhatsApp? delivery_receipts: false # Should incoming calls send a message to the Matrix room? @@ -62,9 +57,7 @@ bridge: identity_change_notices: false # Should a "reactions not yet supported" warning be sent to the Matrix room when a user reacts to a message? reaction_notices: true - portal_message_buffer: 128 - # Settings for handling history sync payloads. These settings only apply right after login, # because the phone only sends the history sync data once, and there's no way to re-request it # (other than logging out and back in again). @@ -87,12 +80,9 @@ bridge: # Should the bridge request a full sync from the phone when logging in? # This bumps the size of history syncs from 3 months to 1 year. request_full_sync: false - user_avatar_sync: true # Should Matrix users leaving groups be bridged to WhatsApp? bridge_matrix_leave: true - - # Should the bridge sync with double puppeting to receive EDUs that aren't normally sent to appservices. sync_with_custom_puppets: true # Should the bridge update the m.direct account data event when double puppeting is enabled. @@ -105,8 +95,8 @@ bridge: default_bridge_receipts: true default_bridge_presence: true # Servers to always allow double puppeting from - double_puppet_server_map: "{{ matrix_domain }}" - + double_puppet_server_map: + "{{ matrix_mautrix_whatsapp_homeserver_domain }}": {{ matrix_mautrix_whatsapp_homeserver_address }} # Allow using double puppeting from any server with a valid client .well-known file. double_puppet_allow_discovery: false # Shared secrets for https://github.com/devture/matrix-synapse-shared-secret-auth @@ -114,10 +104,7 @@ bridge: # If set, double puppeting will be enabled automatically for local users # instead of users having to find an access token and run `login-matrix` # manually. - login_shared_secret_map: - "{{ matrix_mautrix_whatsapp_homeserver_domain }}": {{ matrix_mautrix_whatsapp_login_shared_secret|to_json }} - - + login_shared_secret_map: {{ matrix_mautrix_whatsapp_login_shared_secret_map|to_json }} # Should the bridge explicitly set the avatar and room name for private chat portal rooms? private_chat_portal_meta: false # Should Matrix m.notice-type messages be bridged? From 949ae80117e6f58e4bb415cfc1db576a077d2afc Mon Sep 17 00:00:00 2001 From: iucca Date: Tue, 16 Nov 2021 14:22:06 +0100 Subject: [PATCH 75/86] added server_map variable and renamed secret_map --- roles/matrix-bridge-mautrix-whatsapp/defaults/main.yml | 9 ++++++--- .../templates/config.yaml.j2 | 2 +- 2 files changed, 7 insertions(+), 4 deletions(-) diff --git a/roles/matrix-bridge-mautrix-whatsapp/defaults/main.yml b/roles/matrix-bridge-mautrix-whatsapp/defaults/main.yml index a39cdeb9..3d630fcf 100644 --- a/roles/matrix-bridge-mautrix-whatsapp/defaults/main.yml +++ b/roles/matrix-bridge-mautrix-whatsapp/defaults/main.yml @@ -36,7 +36,6 @@ matrix_mautrix_whatsapp_homeserver_token: '' matrix_mautrix_whatsapp_appservice_bot_username: whatsappbot - # Database-related configuration fields. # # To use SQLite, stick to these defaults. @@ -71,10 +70,14 @@ matrix_mautrix_whatsapp_appservice_database_uri: "{{ }[matrix_mautrix_whatsapp_database_engine] }}" - # Can be set to enable automatic double-puppeting via Shared Secret Auth (https://github.com/devture/matrix-synapse-shared-secret-auth). matrix_mautrix_whatsapp_login_shared_secret: '' -matrix_mautrix_whatsapp_login_shared_secret_map: "{{ {matrix_mautrix_whatsapp_homeserver_domain: matrix_mautrix_whatsapp_login_shared_secret} if matrix_mautrix_whatsapp_login_shared_secret else {} }}" +matrix_mautrix_whatsapp_bridge_login_shared_secret_map: + "{{ {matrix_mautrix_whatsapp_homeserver_domain: matrix_mautrix_whatsapp_login_shared_secret} if matrix_mautrix_whatsapp_login_shared_secret else {} }}" + +# Servers to always allow double puppeting from +matrix_mautrix_whatsapp_bridge_double_puppet_server_map: + "{{ matrix_mautrix_whatsapp_homeserver_domain : matrix_mautrix_whatsapp_homeserver_address }}" # Default mautrix-whatsapp configuration template which covers the generic use case. # You can customize it by controlling the various variables inside it. diff --git a/roles/matrix-bridge-mautrix-whatsapp/templates/config.yaml.j2 b/roles/matrix-bridge-mautrix-whatsapp/templates/config.yaml.j2 index a4335936..394f16a6 100644 --- a/roles/matrix-bridge-mautrix-whatsapp/templates/config.yaml.j2 +++ b/roles/matrix-bridge-mautrix-whatsapp/templates/config.yaml.j2 @@ -104,7 +104,7 @@ bridge: # If set, double puppeting will be enabled automatically for local users # instead of users having to find an access token and run `login-matrix` # manually. - login_shared_secret_map: {{ matrix_mautrix_whatsapp_login_shared_secret_map|to_json }} + login_shared_secret_map: {{ matrix_mautrix_whatsapp_bridge_login_shared_secret_map|to_json }} # Should the bridge explicitly set the avatar and room name for private chat portal rooms? private_chat_portal_meta: false # Should Matrix m.notice-type messages be bridged? From d3a9ec98de7d336be98b2432919720f45a5b8101 Mon Sep 17 00:00:00 2001 From: boris runakov Date: Tue, 16 Nov 2021 21:03:21 +0200 Subject: [PATCH 76/86] refactoring --- group_vars/matrix_servers | 7 +++++++ roles/matrix-base/defaults/main.yml | 2 +- roles/matrix-base/tasks/validate_config.yml | 9 +++++++++ roles/matrix-bridge-appservice-slack/defaults/main.yml | 2 +- .../tasks/validate_config.yml | 1 + .../matrix-bridge-appservice-webhooks/defaults/main.yml | 2 +- .../tasks/validate_config.yml | 1 + roles/matrix-bridge-sms/defaults/main.yml | 2 +- roles/matrix-bridge-sms/tasks/validate_config.yml | 1 + roles/matrix-ma1sd/defaults/main.yml | 2 +- roles/matrix-ma1sd/tasks/validate_config.yml | 1 + roles/matrix-nginx-proxy/defaults/main.yml | 4 ++-- roles/matrix-nginx-proxy/tasks/validate_config.yml | 2 ++ .../matrix-synapse/templates/synapse/homeserver.yaml.j2 | 2 +- 14 files changed, 30 insertions(+), 8 deletions(-) create mode 100644 roles/matrix-base/tasks/validate_config.yml diff --git a/group_vars/matrix_servers b/group_vars/matrix_servers index 139ccb02..7aa10625 100755 --- a/group_vars/matrix_servers +++ b/group_vars/matrix_servers @@ -113,6 +113,7 @@ matrix_appservice_webhooks_container_http_host_bind_port: "{{ '' if matrix_nginx matrix_appservice_webhooks_appservice_token: "{{ matrix_synapse_macaroon_secret_key | password_hash('sha512', 'webhook.as.token') | to_uuid }}" +matrix_appservice_webhooks_homeserver_url: "http://matrix-synapse:{{ matrix_synapse_container_client_api_port }}" matrix_appservice_webhooks_homeserver_token: "{{ matrix_synapse_macaroon_secret_key | password_hash('sha512', 'webhook.hs.token') | to_uuid }}" matrix_appservice_webhooks_id_token: "{{ matrix_synapse_macaroon_secret_key | password_hash('sha512', 'webhook.id.token') | to_uuid }}" @@ -151,6 +152,7 @@ matrix_appservice_slack_container_http_host_bind_port: "{{ '' if matrix_nginx_pr matrix_appservice_slack_appservice_token: "{{ matrix_synapse_macaroon_secret_key | password_hash('sha512', 'slack.as.token') | to_uuid }}" +matrix_appservice_slack_homeserver_url: "http://matrix-synapse:{{ matrix_synapse_container_client_api_port }}" matrix_appservice_slack_homeserver_token: "{{ matrix_synapse_macaroon_secret_key | password_hash('sha512', 'slack.hs.token') | to_uuid }}" matrix_appservice_slack_id_token: "{{ matrix_synapse_macaroon_secret_key | password_hash('sha512', 'slack.id.token') | to_uuid }}" @@ -567,6 +569,7 @@ matrix_sms_bridge_systemd_required_services_list: | matrix_sms_bridge_appservice_token: "{{ matrix_synapse_macaroon_secret_key | password_hash('sha512', 'sms.as.token') | to_uuid }}" +matrix_sms_bridge_homeserver_port: "{{ matrix_synapse_container_client_api_port }}" matrix_sms_bridge_homeserver_token: "{{ matrix_synapse_macaroon_secret_key | password_hash('sha512', 'sms.hs.token') | to_uuid }}" ###################################################################### @@ -1216,6 +1219,7 @@ matrix_ma1sd_container_image_self_build: "{{ matrix_architecture != 'amd64' }}" # ma1sd's web-server port. matrix_ma1sd_container_http_host_bind_port: "{{ '' if matrix_nginx_proxy_enabled else '127.0.0.1:' + matrix_ma1sd_default_port|string }}" + # We enable Synapse integration via its Postgres database by default. # When using another Identity store, you might wish to disable this and define # your own configuration in `matrix_ma1sd_configuration_extension_yaml`. @@ -1308,6 +1312,9 @@ matrix_nginx_proxy_proxy_matrix_federation_api_addr_sans_container: "127.0.0.1:1 # Settings controlling matrix-synapse-proxy.conf matrix_nginx_proxy_proxy_synapse_enabled: "{{ matrix_synapse_enabled }}" +matrix_nginx_proxy_proxy_synapse_client_api_addr_with_container: "matrix-synapse:{{ matrix_synapse_container_client_api_port }}" +matrix_nginx_proxy_proxy_synapse_client_api_addr_sans_container: "127.0.0.1:{{ matrix_synapse_container_client_api_port }}" + matrix_nginx_proxy_proxy_synapse_federation_api_addr_with_container: "matrix-synapse:{{matrix_synapse_container_federation_api_plain_port|string}}" matrix_nginx_proxy_proxy_synapse_federation_api_addr_sans_container: "localhost:{{matrix_synapse_container_federation_api_plain_port|string}}" diff --git a/roles/matrix-base/defaults/main.yml b/roles/matrix-base/defaults/main.yml index 8f3203ab..6639c223 100644 --- a/roles/matrix-base/defaults/main.yml +++ b/roles/matrix-base/defaults/main.yml @@ -91,7 +91,7 @@ matrix_homeserver_url: "https://{{ matrix_server_fqn_matrix }}" # Specifies where the homeserver is on the container network. # Where this is depends on whether there's a reverse-proxy in front of it, etc. # This likely gets overriden elsewhere. -matrix_homeserver_container_url: "http://matrix-synapse:{{ matrix_synapse_container_client_api_port }}" +matrix_homeserver_container_url: "" matrix_identity_server_url: ~ diff --git a/roles/matrix-base/tasks/validate_config.yml b/roles/matrix-base/tasks/validate_config.yml new file mode 100644 index 00000000..8bb3fca0 --- /dev/null +++ b/roles/matrix-base/tasks/validate_config.yml @@ -0,0 +1,9 @@ +--- + +- name: Fail if required Matrix Base settings not defined + fail: + msg: >- + You need to define a required configuration setting (`{{ item }}`) for using this playbook. + when: "vars[item] == ''" + with_items: + - "matrix_homeserver_container_url" \ No newline at end of file diff --git a/roles/matrix-bridge-appservice-slack/defaults/main.yml b/roles/matrix-bridge-appservice-slack/defaults/main.yml index 317ea0c0..4f4d5e2f 100644 --- a/roles/matrix-bridge-appservice-slack/defaults/main.yml +++ b/roles/matrix-bridge-appservice-slack/defaults/main.yml @@ -33,7 +33,7 @@ matrix_appservice_slack_slack_port: 9003 matrix_appservice_slack_container_http_host_bind_port: '' matrix_appservice_slack_homeserver_media_url: "{{ matrix_server_fqn_matrix }}" -matrix_appservice_slack_homeserver_url: "http://matrix-synapse:{{ matrix_synapse_container_client_api_port }}" +matrix_appservice_slack_homeserver_url: "" matrix_appservice_slack_homeserver_domain: "{{ matrix_domain }}" matrix_appservice_slack_appservice_url: 'http://matrix-appservice-slack' diff --git a/roles/matrix-bridge-appservice-slack/tasks/validate_config.yml b/roles/matrix-bridge-appservice-slack/tasks/validate_config.yml index 8af10f2f..e02c6ab0 100644 --- a/roles/matrix-bridge-appservice-slack/tasks/validate_config.yml +++ b/roles/matrix-bridge-appservice-slack/tasks/validate_config.yml @@ -8,5 +8,6 @@ with_items: - "matrix_appservice_slack_control_room_id" - "matrix_appservice_slack_appservice_token" + - "matrix_appservice_slack_homeserver_url" - "matrix_appservice_slack_homeserver_token" - "matrix_appservice_slack_id_token" diff --git a/roles/matrix-bridge-appservice-webhooks/defaults/main.yml b/roles/matrix-bridge-appservice-webhooks/defaults/main.yml index e051ea22..25419900 100644 --- a/roles/matrix-bridge-appservice-webhooks/defaults/main.yml +++ b/roles/matrix-bridge-appservice-webhooks/defaults/main.yml @@ -36,7 +36,7 @@ matrix_appservice_webhooks_matrix_port: 6789 matrix_appservice_webhooks_container_http_host_bind_port: '' matrix_appservice_webhooks_homeserver_media_url: "{{ matrix_server_fqn_matrix }}" -matrix_appservice_webhooks_homeserver_url: "http://matrix-synapse:{{ matrix_synapse_container_client_api_port }}" +matrix_appservice_webhooks_homeserver_url: "" matrix_appservice_webhooks_homeserver_domain: "{{ matrix_domain }}" matrix_appservice_webhooks_appservice_url: 'http://matrix-appservice-webhooks' diff --git a/roles/matrix-bridge-appservice-webhooks/tasks/validate_config.yml b/roles/matrix-bridge-appservice-webhooks/tasks/validate_config.yml index b92a0eb9..48f63e68 100644 --- a/roles/matrix-bridge-appservice-webhooks/tasks/validate_config.yml +++ b/roles/matrix-bridge-appservice-webhooks/tasks/validate_config.yml @@ -7,6 +7,7 @@ when: "vars[item] == ''" with_items: - "matrix_appservice_webhooks_appservice_token" + - "matrix_appservice_webhooks_homeserver_url" - "matrix_appservice_webhooks_homeserver_token" - "matrix_appservice_webhooks_id_token" - "matrix_appservice_webhooks_api_secret" diff --git a/roles/matrix-bridge-sms/defaults/main.yml b/roles/matrix-bridge-sms/defaults/main.yml index 8f2f79a0..d3a686ce 100644 --- a/roles/matrix-bridge-sms/defaults/main.yml +++ b/roles/matrix-bridge-sms/defaults/main.yml @@ -26,7 +26,7 @@ matrix_sms_bridge_systemd_wanted_services_list: [] matrix_sms_bridge_appservice_url: 'http://matrix-sms-bridge:8080' matrix_sms_bridge_homeserver_hostname: 'matrix-synapse' -matrix_sms_bridge_homeserver_port: "{{ matrix_synapse_container_client_api_port }}" +matrix_sms_bridge_homeserver_port: "" matrix_sms_bridge_homserver_domain: "{{ matrix_domain }}" matrix_sms_bridge_default_room: '' diff --git a/roles/matrix-bridge-sms/tasks/validate_config.yml b/roles/matrix-bridge-sms/tasks/validate_config.yml index 6dc6ce9c..f89b18fa 100644 --- a/roles/matrix-bridge-sms/tasks/validate_config.yml +++ b/roles/matrix-bridge-sms/tasks/validate_config.yml @@ -7,6 +7,7 @@ when: "vars[item] == ''" with_items: - "matrix_sms_bridge_appservice_token" + - "matrix_sms_bridge_homeserver_port" - "matrix_sms_bridge_homeserver_token" - "matrix_sms_bridge_default_region" - "matrix_sms_bridge_default_timezone" diff --git a/roles/matrix-ma1sd/defaults/main.yml b/roles/matrix-ma1sd/defaults/main.yml index 9e1e611a..35a48e97 100644 --- a/roles/matrix-ma1sd/defaults/main.yml +++ b/roles/matrix-ma1sd/defaults/main.yml @@ -83,7 +83,7 @@ matrix_ma1sd_threepid_medium_email_connectors_smtp_password: "" # so that ma1sd can rewrite the original URL to one that would reach the homeserver. matrix_ma1sd_dns_overwrite_enabled: false matrix_ma1sd_dns_overwrite_homeserver_client_name: "{{ matrix_server_fqn_matrix }}" -matrix_ma1sd_dns_overwrite_homeserver_client_value: "http://matrix-synapse:{{ matrix_synapse_container_client_api_port }}" +matrix_ma1sd_dns_overwrite_homeserver_client_value: "" # Override the default session templates # To use this, fill in the template variables with the full desired template as a multi-line YAML variable diff --git a/roles/matrix-ma1sd/tasks/validate_config.yml b/roles/matrix-ma1sd/tasks/validate_config.yml index 4f80b154..1c64b134 100644 --- a/roles/matrix-ma1sd/tasks/validate_config.yml +++ b/roles/matrix-ma1sd/tasks/validate_config.yml @@ -46,6 +46,7 @@ when: "vars[item] == ''" with_items: - "matrix_ma1sd_threepid_medium_email_connectors_smtp_host" + - "matrix_ma1sd_dns_overwrite_homeserver_client_value" - name: (Deprecation) Catch and report renamed ma1sd variables fail: diff --git a/roles/matrix-nginx-proxy/defaults/main.yml b/roles/matrix-nginx-proxy/defaults/main.yml index 368d9bdd..96468c20 100644 --- a/roles/matrix-nginx-proxy/defaults/main.yml +++ b/roles/matrix-nginx-proxy/defaults/main.yml @@ -197,8 +197,8 @@ matrix_nginx_proxy_proxy_matrix_client_api_addr_with_container: "matrix-nginx-pr matrix_nginx_proxy_proxy_matrix_client_api_addr_sans_container: "127.0.0.1:12080" # The addresses where the Matrix Client API is, when using Synapse. -matrix_nginx_proxy_proxy_synapse_client_api_addr_with_container: "matrix-synapse:{{ matrix_synapse_container_client_api_port }}" -matrix_nginx_proxy_proxy_synapse_client_api_addr_sans_container: "127.0.0.1:{{ matrix_synapse_container_client_api_port }}" +matrix_nginx_proxy_proxy_synapse_client_api_addr_with_container: "" +matrix_nginx_proxy_proxy_synapse_client_api_addr_sans_container: "" # This needs to be equal or higher than the maximum upload size accepted by Synapse. matrix_nginx_proxy_proxy_matrix_client_api_client_max_body_size_mb: 50 diff --git a/roles/matrix-nginx-proxy/tasks/validate_config.yml b/roles/matrix-nginx-proxy/tasks/validate_config.yml index 39a2dfe5..0de93873 100644 --- a/roles/matrix-nginx-proxy/tasks/validate_config.yml +++ b/roles/matrix-nginx-proxy/tasks/validate_config.yml @@ -45,5 +45,7 @@ - "matrix_ssl_lets_encrypt_support_email" - "matrix_nginx_proxy_proxy_synapse_federation_api_addr_sans_container" - "matrix_nginx_proxy_proxy_synapse_federation_api_addr_with_container" + - "matrix_nginx_proxy_proxy_synapse_client_api_addr_with_container" + - "matrix_nginx_proxy_proxy_synapse_client_api_addr_sans_container" when: "vars[item] == '' or vars[item] is none" when: "matrix_ssl_retrieval_method == 'lets-encrypt'" diff --git a/roles/matrix-synapse/templates/synapse/homeserver.yaml.j2 b/roles/matrix-synapse/templates/synapse/homeserver.yaml.j2 index e1ee7307..1f699ee2 100644 --- a/roles/matrix-synapse/templates/synapse/homeserver.yaml.j2 +++ b/roles/matrix-synapse/templates/synapse/homeserver.yaml.j2 @@ -289,7 +289,7 @@ listeners: # Unsecure HTTP listener (Client API): for when matrix traffic passes through a reverse proxy # that unwraps TLS. - - port: {{ matrix_synapse_container_client_api_port|tojson }} + - port: {{ matrix_synapse_container_client_api_port|to_json }} tls: false bind_addresses: ['::'] type: http From 394ecb0accf02397c1614588fc3a61343e8d30b2 Mon Sep 17 00:00:00 2001 From: boris runakov Date: Tue, 16 Nov 2021 21:14:28 +0200 Subject: [PATCH 77/86] remove default from variable name --- group_vars/matrix_servers | 10 +++++----- roles/matrix-awx/tasks/set_variables_ma1sd.yml | 2 +- roles/matrix-ma1sd/defaults/main.yml | 4 ++-- .../templates/systemd/matrix-ma1sd.service.j2 | 2 +- roles/matrix-nginx-proxy/defaults/main.yml | 12 ++++++------ 5 files changed, 15 insertions(+), 15 deletions(-) diff --git a/group_vars/matrix_servers b/group_vars/matrix_servers index 52dc671c..a1dc5f7f 100755 --- a/group_vars/matrix_servers +++ b/group_vars/matrix_servers @@ -1214,7 +1214,7 @@ matrix_ma1sd_container_image_self_build: "{{ matrix_architecture != 'amd64' }}" # Normally, matrix-nginx-proxy is enabled and nginx can reach ma1sd over the container network. # If matrix-nginx-proxy is not enabled, or you otherwise have a need for it, you can expose # ma1sd's web-server port. -matrix_ma1sd_container_http_host_bind_port: "{{ '' if matrix_nginx_proxy_enabled else '127.0.0.1:' + matrix_ma1sd_default_port|string }}" +matrix_ma1sd_container_http_host_bind_port: "{{ '' if matrix_nginx_proxy_enabled else '127.0.0.1:' + matrix_ma1sd_container_port|string }}" # We enable Synapse integration via its Postgres database by default. # When using another Identity store, you might wish to disable this and define @@ -1296,8 +1296,8 @@ matrix_nginx_proxy_proxy_matrix_corporal_api_addr_with_container: "matrix-corpor matrix_nginx_proxy_proxy_matrix_corporal_api_addr_sans_container: "127.0.0.1:41081" matrix_nginx_proxy_proxy_matrix_identity_api_enabled: "{{ matrix_ma1sd_enabled }}" -matrix_nginx_proxy_proxy_matrix_identity_api_addr_with_container: "matrix-ma1sd:{{ matrix_ma1sd_default_port }}" -matrix_nginx_proxy_proxy_matrix_identity_api_addr_sans_container: "127.0.0.1:{{ matrix_ma1sd_default_port }}" +matrix_nginx_proxy_proxy_matrix_identity_api_addr_with_container: "matrix-ma1sd:{{ matrix_ma1sd_container_port }}" +matrix_nginx_proxy_proxy_matrix_identity_api_addr_sans_container: "127.0.0.1:{{ matrix_ma1sd_container_port }}" # By default, we do TLS termination for the Matrix Federation API (port 8448) at matrix-nginx-proxy. # Unless this is handled there OR Synapse's federation listener port is disabled, we'll reverse-proxy. @@ -1714,8 +1714,8 @@ matrix_synapse_container_image_self_build: "{{ matrix_architecture not in ['arm6 # When ma1sd is enabled, we can use it to validate email addresses and phone numbers. # Synapse can validate email addresses by itself as well, but it's probably not what we want by default when we have an identity server. -matrix_synapse_account_threepid_delegates_email: "{{ 'http://matrix-ma1sd:' + matrix_ma1sd_default_port|string if matrix_ma1sd_enabled else '' }}" -matrix_synapse_account_threepid_delegates_msisdn: "{{ 'http://matrix-ma1sd:' + matrix_ma1sd_default_port|string if matrix_ma1sd_enabled else '' }}" +matrix_synapse_account_threepid_delegates_email: "{{ 'http://matrix-ma1sd:' + matrix_ma1sd_container_port|string if matrix_ma1sd_enabled else '' }}" +matrix_synapse_account_threepid_delegates_msisdn: "{{ 'http://matrix-ma1sd:' + matrix_ma1sd_container_port|string if matrix_ma1sd_enabled else '' }}" # Normally, matrix-nginx-proxy is enabled and nginx can reach Synapse over the container network. # If matrix-nginx-proxy is not enabled, or you otherwise have a need for it, diff --git a/roles/matrix-awx/tasks/set_variables_ma1sd.yml b/roles/matrix-awx/tasks/set_variables_ma1sd.yml index 81012d28..db5037d1 100755 --- a/roles/matrix-awx/tasks/set_variables_ma1sd.yml +++ b/roles/matrix-awx/tasks/set_variables_ma1sd.yml @@ -30,7 +30,7 @@ insertafter: '# Synapse Extension Start' with_dict: 'matrix_synapse_awx_password_provider_rest_auth_enabled': 'true' - 'matrix_synapse_awx_password_provider_rest_auth_endpoint': '"http://matrix-ma1sd:{{ matrix_ma1sd_default_port }}"' + 'matrix_synapse_awx_password_provider_rest_auth_endpoint': '"http://matrix-ma1sd:{{ matrix_ma1sd_container_port }}"' when: awx_matrix_ma1sd_auth_store == 'LDAP/AD' - name: Remove entire ma1sd configuration extension diff --git a/roles/matrix-ma1sd/defaults/main.yml b/roles/matrix-ma1sd/defaults/main.yml index adee0b44..0b9144dd 100644 --- a/roles/matrix-ma1sd/defaults/main.yml +++ b/roles/matrix-ma1sd/defaults/main.yml @@ -19,8 +19,8 @@ matrix_ma1sd_docker_src_files_path: "{{ matrix_ma1sd_base_path }}/docker-src/ma1 matrix_ma1sd_config_path: "{{ matrix_ma1sd_base_path }}/config" matrix_ma1sd_data_path: "{{ matrix_ma1sd_base_path }}/data" -matrix_ma1sd_default_port: 8090 -# Controls whether the matrix-ma1sd container exposes its HTTP port (tcp/{{ matrix_ma1sd_default_port }} in the container). +matrix_ma1sd_container_port: 8090 +# Controls whether the matrix-ma1sd container exposes its HTTP port (tcp/{{ matrix_ma1sd_container_port }} in the container). # # Takes an ":" or "" value (e.g. "127.0.0.1:8090"), or empty string to not expose. matrix_ma1sd_container_http_host_bind_port: '' diff --git a/roles/matrix-ma1sd/templates/systemd/matrix-ma1sd.service.j2 b/roles/matrix-ma1sd/templates/systemd/matrix-ma1sd.service.j2 index 696e8008..8e5cc6dd 100644 --- a/roles/matrix-ma1sd/templates/systemd/matrix-ma1sd.service.j2 +++ b/roles/matrix-ma1sd/templates/systemd/matrix-ma1sd.service.j2 @@ -26,7 +26,7 @@ ExecStart={{ matrix_host_command_docker }} run --rm --name matrix-ma1sd \ --tmpfs=/tmp:rw,exec,nosuid,size=10m \ --network={{ matrix_docker_network }} \ {% if matrix_ma1sd_container_http_host_bind_port %} - -p {{ matrix_ma1sd_container_http_host_bind_port }}:{{ matrix_ma1sd_default_port }} \ + -p {{ matrix_ma1sd_container_http_host_bind_port }}:{{ matrix_ma1sd_container_port }} \ {% endif %} {% if matrix_ma1sd_verbose_logging %} -e MA1SD_LOG_LEVEL=debug \ diff --git a/roles/matrix-nginx-proxy/defaults/main.yml b/roles/matrix-nginx-proxy/defaults/main.yml index ea26084e..fba0f4ea 100644 --- a/roles/matrix-nginx-proxy/defaults/main.yml +++ b/roles/matrix-nginx-proxy/defaults/main.yml @@ -166,20 +166,20 @@ matrix_nginx_proxy_proxy_matrix_corporal_api_addr_sans_container: "127.0.0.1:410 # This can be used to forward the API endpoint to another service, augmenting the functionality of Synapse's own User Directory Search. # To learn more, see: https://github.com/ma1uta/ma1sd/blob/master/docs/features/directory.md matrix_nginx_proxy_proxy_matrix_user_directory_search_enabled: false -matrix_nginx_proxy_proxy_matrix_user_directory_search_addr_with_container: "matrix-ma1sd:{{ matrix_ma1sd_default_port }}" -matrix_nginx_proxy_proxy_matrix_user_directory_search_addr_sans_container: "127.0.0.1:{{ matrix_ma1sd_default_port }}" +matrix_nginx_proxy_proxy_matrix_user_directory_search_addr_with_container: "matrix-ma1sd:{{ matrix_ma1sd_container_port }}" +matrix_nginx_proxy_proxy_matrix_user_directory_search_addr_sans_container: "127.0.0.1:{{ matrix_ma1sd_container_port }}" # Controls whether proxying for 3PID-based registration (`/_matrix/client/r0/register/(email|msisdn)/requestToken`) should be done (on the matrix domain). # This allows another service to control registrations involving 3PIDs. # To learn more, see: https://github.com/ma1uta/ma1sd/blob/master/docs/features/registration.md matrix_nginx_proxy_proxy_matrix_3pid_registration_enabled: false -matrix_nginx_proxy_proxy_matrix_3pid_registration_addr_with_container: "matrix-ma1sd:{{ matrix_ma1sd_default_port }}" -matrix_nginx_proxy_proxy_matrix_3pid_registration_addr_sans_container: "127.0.0.1:{{ matrix_ma1sd_default_port }}" +matrix_nginx_proxy_proxy_matrix_3pid_registration_addr_with_container: "matrix-ma1sd:{{ matrix_ma1sd_container_port }}" +matrix_nginx_proxy_proxy_matrix_3pid_registration_addr_sans_container: "127.0.0.1:{{ matrix_ma1sd_container_port }}" # Controls whether proxying for the Identity API (`/_matrix/identity`) should be done (on the matrix domain) matrix_nginx_proxy_proxy_matrix_identity_api_enabled: false -matrix_nginx_proxy_proxy_matrix_identity_api_addr_with_container: "matrix-ma1sd:{{ matrix_ma1sd_default_port }}" -matrix_nginx_proxy_proxy_matrix_identity_api_addr_sans_container: "127.0.0.1:{{ matrix_ma1sd_default_port }}" +matrix_nginx_proxy_proxy_matrix_identity_api_addr_with_container: "matrix-ma1sd:{{ matrix_ma1sd_container_port }}" +matrix_nginx_proxy_proxy_matrix_identity_api_addr_sans_container: "127.0.0.1:{{ matrix_ma1sd_container_port }}" # Controls whether proxying for metrics (`/_synapse/metrics`) should be done (on the matrix domain) matrix_nginx_proxy_proxy_synapse_metrics: false From 75cb4ce3b02ba0cd005e6cb008b2bc0227eb60dd Mon Sep 17 00:00:00 2001 From: Slavi Pantaleev Date: Wed, 17 Nov 2021 10:38:52 +0200 Subject: [PATCH 78/86] Add warning about matrix_ma1sd_default_port being renamed Related to https://github.com/spantaleev/matrix-docker-ansible-deploy/pull/1403 --- roles/matrix-ma1sd/tasks/validate_config.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/roles/matrix-ma1sd/tasks/validate_config.yml b/roles/matrix-ma1sd/tasks/validate_config.yml index 1c64b134..5f621fca 100644 --- a/roles/matrix-ma1sd/tasks/validate_config.yml +++ b/roles/matrix-ma1sd/tasks/validate_config.yml @@ -57,6 +57,7 @@ with_items: - {'old': 'matrix_ma1sd_container_expose_port', 'new': ''} - {'old': 'matrix_ma1sd_threepid_medium_email_custom_unbind_fraudulent_template', 'new': 'matrix_ma1sd_threepid_medium_email_custom_session_unbind_notification_template'} + - {'old': 'matrix_ma1sd_default_port', 'new': 'matrix_ma1sd_container_port'} - name: (Deprecation) Catch and report mxisd variables fail: From f8fe68b38523b20cf5896d46a7cf8582ad35eaa0 Mon Sep 17 00:00:00 2001 From: Aaron Raimist Date: Wed, 17 Nov 2021 14:54:49 +0000 Subject: [PATCH 79/86] Allow workers to serve new v3 APIs https://github.com/matrix-org/synapse/pull/11371/commits/1f196f59cb91a1a7f8206e4dd0c93fcd05c2d9c1 --- .../nginx/conf.d/matrix-synapse.conf.j2 | 2 +- .../files/workers-doc-to-yaml.awk | 2 +- roles/matrix-synapse/vars/workers.yml | 70 +++++++++---------- 3 files changed, 37 insertions(+), 37 deletions(-) diff --git a/roles/matrix-nginx-proxy/templates/nginx/conf.d/matrix-synapse.conf.j2 b/roles/matrix-nginx-proxy/templates/nginx/conf.d/matrix-synapse.conf.j2 index 30f4877c..720b5086 100644 --- a/roles/matrix-nginx-proxy/templates/nginx/conf.d/matrix-synapse.conf.j2 +++ b/roles/matrix-nginx-proxy/templates/nginx/conf.d/matrix-synapse.conf.j2 @@ -120,7 +120,7 @@ server { {% endfor %} {% if matrix_nginx_proxy_synapse_presence_disabled %} # FIXME: keep in sync with synapse workers documentation manually - location ~ ^/_matrix/client/(api/v1|r0|unstable)/presence/[^/]+/status { + location ~ ^/_matrix/client/(api/v1|r0|v3|unstable)/presence/[^/]+/status { proxy_pass http://frontend_proxy_upstream$request_uri; proxy_set_header Host $host; } diff --git a/roles/matrix-synapse/files/workers-doc-to-yaml.awk b/roles/matrix-synapse/files/workers-doc-to-yaml.awk index d9295e32..ca58b486 100755 --- a/roles/matrix-synapse/files/workers-doc-to-yaml.awk +++ b/roles/matrix-synapse/files/workers-doc-to-yaml.awk @@ -86,7 +86,7 @@ enable_parsing { # FIXME: https://github.com/matrix-org/synapse/issues/7530 # https://github.com/spantaleev/matrix-docker-ansible-deploy/pull/456#issuecomment-719015911 - if (api_endpoint_regex == "^/_matrix/client/(r0|unstable)/auth/.*/fallback/web$") { + if (api_endpoint_regex == "^/_matrix/client/(r0|v3|unstable)/auth/.*/fallback/web$") { worker_stanza_append(" # FIXME: possible bug with SSO and multiple generic workers\n") worker_stanza_append(" # see https://github.com/matrix-org/synapse/issues/7530\n") worker_stanza_append(" # " api_endpoint_regex linefeed) diff --git a/roles/matrix-synapse/vars/workers.yml b/roles/matrix-synapse/vars/workers.yml index 049ae9b5..db9b519e 100644 --- a/roles/matrix-synapse/vars/workers.yml +++ b/roles/matrix-synapse/vars/workers.yml @@ -5,10 +5,10 @@ matrix_synapse_workers_generic_worker_endpoints: # expressions: # Sync requests - - ^/_matrix/client/(v2_alpha|r0)/sync$ - - ^/_matrix/client/(api/v1|v2_alpha|r0)/events$ - - ^/_matrix/client/(api/v1|r0)/initialSync$ - - ^/_matrix/client/(api/v1|r0)/rooms/[^/]+/initialSync$ + - ^/_matrix/client/(v2_alpha|r0|v3)/sync$ + - ^/_matrix/client/(api/v1|v2_alpha|r0|v3)/events$ + - ^/_matrix/client/(api/v1|r0|v3)/initialSync$ + - ^/_matrix/client/(api/v1|r0|v3)/rooms/[^/]+/initialSync$ # Federation requests - ^/_matrix/federation/v1/event/ @@ -39,40 +39,40 @@ matrix_synapse_workers_generic_worker_endpoints: - ^/_matrix/federation/v1/send/ # Client API requests - - ^/_matrix/client/(api/v1|r0|unstable)/createRoom$ - - ^/_matrix/client/(api/v1|r0|unstable)/publicRooms$ - - ^/_matrix/client/(api/v1|r0|unstable)/rooms/.*/joined_members$ - - ^/_matrix/client/(api/v1|r0|unstable)/rooms/.*/context/.*$ - - ^/_matrix/client/(api/v1|r0|unstable)/rooms/.*/members$ - - ^/_matrix/client/(api/v1|r0|unstable)/rooms/.*/state$ + - ^/_matrix/client/(api/v1|r0|v3|unstable)/createRoom$ + - ^/_matrix/client/(api/v1|r0|v3|unstable)/publicRooms$ + - ^/_matrix/client/(api/v1|r0|v3|unstable)/rooms/.*/joined_members$ + - ^/_matrix/client/(api/v1|r0|v3|unstable)/rooms/.*/context/.*$ + - ^/_matrix/client/(api/v1|r0|v3|unstable)/rooms/.*/members$ + - ^/_matrix/client/(api/v1|r0|v3|unstable)/rooms/.*/state$ - ^/_matrix/client/unstable/org.matrix.msc2946/rooms/.*/spaces$ - ^/_matrix/client/unstable/org.matrix.msc2946/rooms/.*/hierarchy$ - ^/_matrix/client/unstable/im.nheko.summary/rooms/.*/summary$ - - ^/_matrix/client/(api/v1|r0|unstable)/account/3pid$ - - ^/_matrix/client/(api/v1|r0|unstable)/devices$ - - ^/_matrix/client/(api/v1|r0|unstable)/keys/query$ - - ^/_matrix/client/(api/v1|r0|unstable)/keys/changes$ + - ^/_matrix/client/(api/v1|r0|v3|unstable)/account/3pid$ + - ^/_matrix/client/(api/v1|r0|v3|unstable)/devices$ + - ^/_matrix/client/(api/v1|r0|v3|unstable)/keys/query$ + - ^/_matrix/client/(api/v1|r0|v3|unstable)/keys/changes$ - ^/_matrix/client/versions$ - - ^/_matrix/client/(api/v1|r0|unstable)/voip/turnServer$ - - ^/_matrix/client/(api/v1|r0|unstable)/joined_groups$ - - ^/_matrix/client/(api/v1|r0|unstable)/publicised_groups$ - - ^/_matrix/client/(api/v1|r0|unstable)/publicised_groups/ - - ^/_matrix/client/(api/v1|r0|unstable)/rooms/.*/event/ - - ^/_matrix/client/(api/v1|r0|unstable)/joined_rooms$ - - ^/_matrix/client/(api/v1|r0|unstable)/search$ + - ^/_matrix/client/(api/v1|r0|v3|unstable)/voip/turnServer$ + - ^/_matrix/client/(api/v1|r0|v3|unstable)/joined_groups$ + - ^/_matrix/client/(api/v1|r0|v3|unstable)/publicised_groups$ + - ^/_matrix/client/(api/v1|r0|v3|unstable)/publicised_groups/ + - ^/_matrix/client/(api/v1|r0|v3|unstable)/rooms/.*/event/ + - ^/_matrix/client/(api/v1|r0|v3|unstable)/joined_rooms$ + - ^/_matrix/client/(api/v1|r0|v3|unstable)/search$ # Registration/login requests - - ^/_matrix/client/(api/v1|r0|unstable)/login$ - - ^/_matrix/client/(r0|unstable)/register$ + - ^/_matrix/client/(api/v1|r0|v3|unstable)/login$ + - ^/_matrix/client/(r0|v3|unstable)/register$ - ^/_matrix/client/unstable/org.matrix.msc3231/register/org.matrix.msc3231.login.registration_token/validity$ # Event sending requests - - ^/_matrix/client/(api/v1|r0|unstable)/rooms/.*/redact - - ^/_matrix/client/(api/v1|r0|unstable)/rooms/.*/send - - ^/_matrix/client/(api/v1|r0|unstable)/rooms/.*/state/ - - ^/_matrix/client/(api/v1|r0|unstable)/rooms/.*/(join|invite|leave|ban|unban|kick)$ - - ^/_matrix/client/(api/v1|r0|unstable)/join/ - - ^/_matrix/client/(api/v1|r0|unstable)/profile/ + - ^/_matrix/client/(api/v1|r0|v3|unstable)/rooms/.*/redact + - ^/_matrix/client/(api/v1|r0|v3|unstable)/rooms/.*/send + - ^/_matrix/client/(api/v1|r0|v3|unstable)/rooms/.*/state/ + - ^/_matrix/client/(api/v1|r0|v3|unstable)/rooms/.*/(join|invite|leave|ban|unban|kick)$ + - ^/_matrix/client/(api/v1|r0|v3|unstable)/join/ + - ^/_matrix/client/(api/v1|r0|v3|unstable)/profile/ # Additionally, the following REST endpoints can be handled for GET requests: @@ -86,7 +86,7 @@ matrix_synapse_workers_generic_worker_endpoints: # for the room are in flight: # FIXME: ADDITIONAL CONDITIONS REQUIRED: to be enabled manually - # ^/_matrix/client/(api/v1|r0|unstable)/rooms/.*/messages$ + # ^/_matrix/client/(api/v1|r0|v3|unstable)/rooms/.*/messages$ # Additionally, the following endpoints should be included if Synapse is configured # to use SSO (you only need to include the ones for whichever SSO provider you're @@ -94,7 +94,7 @@ matrix_synapse_workers_generic_worker_endpoints: # for all SSO providers # FIXME: ADDITIONAL CONDITIONS REQUIRED: to be enabled manually - # ^/_matrix/client/(api/v1|r0|unstable)/login/sso/redirect + # ^/_matrix/client/(api/v1|r0|v3|unstable)/login/sso/redirect # ^/_synapse/client/pick_idp$ # ^/_synapse/client/pick_username # ^/_synapse/client/new_user_consent$ @@ -110,7 +110,7 @@ matrix_synapse_workers_generic_worker_endpoints: # CAS requests. # FIXME: ADDITIONAL CONDITIONS REQUIRED: to be enabled manually - # ^/_matrix/client/(api/v1|r0|unstable)/login/cas/ticket$ + # ^/_matrix/client/(api/v1|r0|v3|unstable)/login/cas/ticket$ # Ensure that all SSO logins go to a single process. # For multiple workers not handling the SSO endpoints properly, see @@ -292,7 +292,7 @@ matrix_synapse_workers_user_dir_endpoints: # Handles searches in the user directory. It can handle REST endpoints matching # the following regular expressions: - - ^/_matrix/client/(api/v1|r0|unstable)/user_directory/search$ + - ^/_matrix/client/(api/v1|r0|v3|unstable)/user_directory/search$ # When using this worker you must also set `update_user_directory: False` in the # shared configuration file to stop the main synapse running background @@ -303,13 +303,13 @@ matrix_synapse_workers_frontend_proxy_endpoints: # load from the main synapse. It can handle REST endpoints matching the following # regular expressions: - - ^/_matrix/client/(api/v1|r0|unstable)/keys/upload + - ^/_matrix/client/(api/v1|r0|v3|unstable)/keys/upload # If `use_presence` is False in the homeserver config, it can also handle REST # endpoints matching the following regular expressions: # FIXME: ADDITIONAL CONDITIONS REQUIRED: to be enabled manually - # ^/_matrix/client/(api/v1|r0|unstable)/presence/[^/]+/status + # ^/_matrix/client/(api/v1|r0|v3|unstable)/presence/[^/]+/status # This "stub" presence handler will pass through `GET` request but make the # `PUT` effectively a no-op. From e1a6d1e4b231abb07b8203d988489caf7902093d Mon Sep 17 00:00:00 2001 From: Slavi Pantaleev Date: Wed, 17 Nov 2021 17:21:15 +0200 Subject: [PATCH 80/86] Upgrade Synapse (1.46.0 -> 1.47.0) We had to remove UID/GID environment variables that we used to pass to the Synapse container, because it was causing a problem after https://github.com/matrix-org/synapse/pull/11209 We were using both `--user` and UID/GID environment variables until now. --- roles/matrix-synapse/defaults/main.yml | 4 +-- .../tasks/synapse/setup_install.yml | 2 -- .../templates/synapse/homeserver.yaml.j2 | 31 ++++++++++++++----- .../systemd/matrix-synapse-worker.service.j2 | 2 -- .../synapse/systemd/matrix-synapse.service.j2 | 2 -- roles/matrix-synapse/vars/workers.yml | 18 ++++++----- 6 files changed, 36 insertions(+), 23 deletions(-) diff --git a/roles/matrix-synapse/defaults/main.yml b/roles/matrix-synapse/defaults/main.yml index a6feb1ab..e48e3e89 100644 --- a/roles/matrix-synapse/defaults/main.yml +++ b/roles/matrix-synapse/defaults/main.yml @@ -15,8 +15,8 @@ matrix_synapse_docker_image_name_prefix: "{{ 'localhost/' if matrix_synapse_cont # amd64 gets released first. # arm32 relies on self-building, so the same version can be built immediately. # arm64 users need to wait for a prebuilt image to become available. -matrix_synapse_version: v1.46.0 -matrix_synapse_version_arm64: v1.46.0 +matrix_synapse_version: v1.47.0 +matrix_synapse_version_arm64: v1.47.0 matrix_synapse_docker_image_tag: "{{ matrix_synapse_version if matrix_architecture in ['arm32', 'amd64'] else matrix_synapse_version_arm64 }}" matrix_synapse_docker_image_force_pull: "{{ matrix_synapse_docker_image.endswith(':latest') }}" diff --git a/roles/matrix-synapse/tasks/synapse/setup_install.yml b/roles/matrix-synapse/tasks/synapse/setup_install.yml index b658cfff..09ec798d 100644 --- a/roles/matrix-synapse/tasks/synapse/setup_install.yml +++ b/roles/matrix-synapse/tasks/synapse/setup_install.yml @@ -67,8 +67,6 @@ --user={{ matrix_user_uid }}:{{ matrix_user_gid }} --cap-drop=ALL --mount type=bind,src={{ matrix_synapse_config_dir_path }},dst=/data - -e UID={{ matrix_user_uid }} - -e GID={{ matrix_user_gid }} -e SYNAPSE_CONFIG_PATH=/data/homeserver.yaml -e SYNAPSE_SERVER_NAME={{ matrix_server_fqn_matrix }} -e SYNAPSE_REPORT_STATS=no diff --git a/roles/matrix-synapse/templates/synapse/homeserver.yaml.j2 b/roles/matrix-synapse/templates/synapse/homeserver.yaml.j2 index 1f699ee2..1780fb91 100644 --- a/roles/matrix-synapse/templates/synapse/homeserver.yaml.j2 +++ b/roles/matrix-synapse/templates/synapse/homeserver.yaml.j2 @@ -66,8 +66,28 @@ pid_file: /homeserver.pid # Otherwise, it should be the URL to reach Synapse's client HTTP listener (see # 'listeners' below). # +# Defaults to 'https:///'. +# public_baseurl: https://{{ matrix_server_fqn_matrix }}/ +# Uncomment the following to tell other servers to send federation traffic on +# port 443. +# +# By default, other servers will try to reach our server on port 8448, which can +# be inconvenient in some environments. +# +# Provided 'https:///' on port 443 is routed to Synapse, this +# option configures Synapse to serve a file at +# 'https:///.well-known/matrix/server'. This will tell other +# servers to send traffic to port 443 instead. +# +# See https://matrix-org.github.io/synapse/latest/delegate.html for more +# information. +# +# Defaults to 'false'. +# +#serve_server_wellknown: true + # Set the soft limit on the number of file descriptors synapse can use # Zero is used to indicate synapse should set the soft limit to the # hard limit. @@ -1271,7 +1291,7 @@ allow_guest_access: {{ matrix_synapse_allow_guest_access|to_json }} # in on this server. # # (By default, no suggestion is made, so it is left up to the client. -# This setting is ignored unless public_baseurl is also set.) +# This setting is ignored unless public_baseurl is also explicitly set.) # #default_identity_server: https://matrix.org @@ -1296,8 +1316,6 @@ allow_guest_access: {{ matrix_synapse_allow_guest_access|to_json }} # by the Matrix Identity Service API specification: # https://matrix.org/docs/spec/identity_service/latest # -# If a delegate is specified, the config option public_baseurl must also be filled out. -# account_threepid_delegates: email: {{ matrix_synapse_account_threepid_delegates_email|to_json }} msisdn: {{ matrix_synapse_account_threepid_delegates_msisdn|to_json }} @@ -1990,11 +2008,10 @@ sso: # phishing attacks from evil.site. To avoid this, include a slash after the # hostname: "https://my.client/". # - # If public_baseurl is set, then the login fallback page (used by clients - # that don't natively support the required login flows) is whitelisted in - # addition to any URLs in this list. + # The login fallback page (used by clients that don't natively support the + # required login flows) is whitelisted in addition to any URLs in this list. # - # By default, this list is empty. + # By default, this list contains only the login fallback page. # #client_whitelist: # - https://riot.im/develop diff --git a/roles/matrix-synapse/templates/synapse/systemd/matrix-synapse-worker.service.j2 b/roles/matrix-synapse/templates/synapse/systemd/matrix-synapse-worker.service.j2 index 6c90c9a3..43dc42d1 100644 --- a/roles/matrix-synapse/templates/synapse/systemd/matrix-synapse-worker.service.j2 +++ b/roles/matrix-synapse/templates/synapse/systemd/matrix-synapse-worker.service.j2 @@ -17,8 +17,6 @@ ExecStartPre={{ matrix_host_command_sleep }} 5 ExecStart={{ matrix_host_command_docker }} run --rm --name {{ matrix_synapse_worker_container_name }} \ --log-driver=none \ --user={{ matrix_user_uid }}:{{ matrix_user_gid }} \ - -e UID={{ matrix_user_uid }} \ - -e GID={{ matrix_user_gid }} \ --cap-drop=ALL \ --read-only \ --tmpfs=/tmp:rw,noexec,nosuid,size={{ matrix_synapse_tmp_directory_size_mb }}m \ diff --git a/roles/matrix-synapse/templates/synapse/systemd/matrix-synapse.service.j2 b/roles/matrix-synapse/templates/synapse/systemd/matrix-synapse.service.j2 index 7fec6649..188db5ef 100644 --- a/roles/matrix-synapse/templates/synapse/systemd/matrix-synapse.service.j2 +++ b/roles/matrix-synapse/templates/synapse/systemd/matrix-synapse.service.j2 @@ -33,8 +33,6 @@ ExecStartPre={{ matrix_host_command_sleep }} 3 ExecStart={{ matrix_host_command_docker }} run --rm --name matrix-synapse \ --log-driver=none \ --user={{ matrix_user_uid }}:{{ matrix_user_gid }} \ - --env=UID={{ matrix_user_uid }} \ - --env=GID={{ matrix_user_gid }} \ --cap-drop=ALL \ --read-only \ --tmpfs=/tmp:rw,noexec,nosuid,size={{ matrix_synapse_tmp_directory_size_mb }}m \ diff --git a/roles/matrix-synapse/vars/workers.yml b/roles/matrix-synapse/vars/workers.yml index fda7227c..ad9a7315 100644 --- a/roles/matrix-synapse/vars/workers.yml +++ b/roles/matrix-synapse/vars/workers.yml @@ -271,19 +271,19 @@ matrix_synapse_workers_media_repository_endpoints: # expose the `media` resource. For example: # ```yaml - # worker_listeners: - # - type: http - # port: 8085 - # resources: - # - names: - # - media + # worker_listeners: + # - type: http + # port: 8085 + # resources: + # - names: + # - media # ``` # Note that if running multiple media repositories they must be on the same server # and you must configure a single instance to run the background tasks, e.g.: # ```yaml - # media_instance_running_background_jobs: "media-repository-1" + # media_instance_running_background_jobs: "media-repository-1" # ``` # Note that if a reverse proxy is used , then `/_matrix/media/` must be routed for both inbound client and federation requests (if they are handled separately). @@ -319,7 +319,9 @@ matrix_synapse_workers_frontend_proxy_endpoints: # the `worker_main_http_uri` setting in the `frontend_proxy` worker configuration # file. For example: - # worker_main_http_uri: http://127.0.0.1:{{ matrix_synapse_container_client_api_port }} + # ```yaml + # worker_main_http_uri: http://127.0.0.1:8008 + # ``` matrix_synapse_workers_avail_list: - appservice From d41e9230da30a5f12beac49ad4d66c53d8750f2d Mon Sep 17 00:00:00 2001 From: rakshazi Date: Wed, 17 Nov 2021 21:34:46 +0200 Subject: [PATCH 81/86] expose smtp_user and smtp_pass to ansible configs (role: matrix-synapse) --- roles/matrix-synapse/defaults/main.yml | 2 ++ roles/matrix-synapse/templates/synapse/homeserver.yaml.j2 | 5 ++--- 2 files changed, 4 insertions(+), 3 deletions(-) diff --git a/roles/matrix-synapse/defaults/main.yml b/roles/matrix-synapse/defaults/main.yml index e48e3e89..dc8a9eb0 100644 --- a/roles/matrix-synapse/defaults/main.yml +++ b/roles/matrix-synapse/defaults/main.yml @@ -473,6 +473,8 @@ matrix_synapse_turn_allow_guests: False matrix_synapse_email_enabled: false matrix_synapse_email_smtp_host: "" matrix_synapse_email_smtp_port: 587 +matrix_synapse_email_smtp_user: "" +matrix_synapse_email_smtp_pass: "" matrix_synapse_email_smtp_require_transport_security: false matrix_synapse_email_notif_from: "Matrix " matrix_synapse_email_client_base_url: "https://{{ matrix_server_fqn_element }}" diff --git a/roles/matrix-synapse/templates/synapse/homeserver.yaml.j2 b/roles/matrix-synapse/templates/synapse/homeserver.yaml.j2 index 1780fb91..042ea083 100644 --- a/roles/matrix-synapse/templates/synapse/homeserver.yaml.j2 +++ b/roles/matrix-synapse/templates/synapse/homeserver.yaml.j2 @@ -2338,9 +2338,8 @@ email: # Username/password for authentication to the SMTP server. By default, no # authentication is attempted. - # - #smtp_user: "exampleusername" - #smtp_pass: "examplepassword" + smtp_user: {{ matrix_synapse_email_smtp_user|string|to_json }} + smtp_pass: {{ matrix_synapse_email_smtp_pass|string|to_json }} # Uncomment the following to require TLS transport security for SMTP. # By default, Synapse will connect over plain text, and will then switch to From 110d91b06ed235957d263ce85e62dade022940e3 Mon Sep 17 00:00:00 2001 From: Toni Spets Date: Thu, 18 Nov 2021 13:05:30 +0200 Subject: [PATCH 82/86] Upgrade Heisenbridge (1.6.0 -> 1.7.0) --- roles/matrix-bridge-heisenbridge/defaults/main.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/roles/matrix-bridge-heisenbridge/defaults/main.yml b/roles/matrix-bridge-heisenbridge/defaults/main.yml index 9a87a6da..9a769432 100644 --- a/roles/matrix-bridge-heisenbridge/defaults/main.yml +++ b/roles/matrix-bridge-heisenbridge/defaults/main.yml @@ -3,7 +3,7 @@ matrix_heisenbridge_enabled: true -matrix_heisenbridge_version: 1.6.0 +matrix_heisenbridge_version: 1.7.0 matrix_heisenbridge_docker_image: "{{ matrix_container_global_registry_prefix }}hif1/heisenbridge:{{ matrix_heisenbridge_version }}" matrix_heisenbridge_docker_image_force_pull: "{{ matrix_heisenbridge_docker_image.endswith(':latest') }}" From 2e73dac39fb55c4f526d7deba173f0b9e9f6d180 Mon Sep 17 00:00:00 2001 From: Slavi Pantaleev Date: Fri, 19 Nov 2021 10:51:46 +0200 Subject: [PATCH 83/86] Upgrade matrix-corporal (2.1.4 -> 2.2.0) There was also a 2.1.5 security release made today. 2.2.0 contains the same security fix + more. Both make handling of Client-Server API v3-prefixed requests better. Related to https://github.com/spantaleev/matrix-docker-ansible-deploy/pull/1404 --- roles/matrix-corporal/defaults/main.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/roles/matrix-corporal/defaults/main.yml b/roles/matrix-corporal/defaults/main.yml index 5c90fe99..f6040263 100644 --- a/roles/matrix-corporal/defaults/main.yml +++ b/roles/matrix-corporal/defaults/main.yml @@ -22,7 +22,7 @@ matrix_corporal_container_extra_arguments: [] # List of systemd services that matrix-corporal.service depends on matrix_corporal_systemd_required_services_list: ['docker.service'] -matrix_corporal_version: 2.1.4 +matrix_corporal_version: 2.2.0 matrix_corporal_docker_image: "{{ matrix_corporal_docker_image_name_prefix }}devture/matrix-corporal:{{ matrix_corporal_docker_image_tag }}" matrix_corporal_docker_image_name_prefix: "{{ 'localhost/' if matrix_corporal_container_image_self_build else matrix_container_global_registry_prefix }}" matrix_corporal_docker_image_tag: "{{ matrix_corporal_version }}" # for backward-compatibility From 2734adfb4e30bfabe5b2b8f2d01c1ea4cc049e15 Mon Sep 17 00:00:00 2001 From: Slavi Pantaleev Date: Sat, 20 Nov 2021 09:28:27 +0200 Subject: [PATCH 84/86] Upgrade matrix-corporal (2.2.0 -> 2.2.1) --- roles/matrix-corporal/defaults/main.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/roles/matrix-corporal/defaults/main.yml b/roles/matrix-corporal/defaults/main.yml index f6040263..dfc71479 100644 --- a/roles/matrix-corporal/defaults/main.yml +++ b/roles/matrix-corporal/defaults/main.yml @@ -22,7 +22,7 @@ matrix_corporal_container_extra_arguments: [] # List of systemd services that matrix-corporal.service depends on matrix_corporal_systemd_required_services_list: ['docker.service'] -matrix_corporal_version: 2.2.0 +matrix_corporal_version: 2.2.1 matrix_corporal_docker_image: "{{ matrix_corporal_docker_image_name_prefix }}devture/matrix-corporal:{{ matrix_corporal_docker_image_tag }}" matrix_corporal_docker_image_name_prefix: "{{ 'localhost/' if matrix_corporal_container_image_self_build else matrix_container_global_registry_prefix }}" matrix_corporal_docker_image_tag: "{{ matrix_corporal_version }}" # for backward-compatibility From fc751f0330ac487de1ba4526eca969da8889abf4 Mon Sep 17 00:00:00 2001 From: Slavi Pantaleev Date: Sat, 20 Nov 2021 09:31:04 +0200 Subject: [PATCH 85/86] Upgrade exim-relay (4.94.2-r0-4 -> 4.94.2-r0-5) --- roles/matrix-mailer/defaults/main.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/roles/matrix-mailer/defaults/main.yml b/roles/matrix-mailer/defaults/main.yml index 71a33752..e60ea50f 100644 --- a/roles/matrix-mailer/defaults/main.yml +++ b/roles/matrix-mailer/defaults/main.yml @@ -7,7 +7,7 @@ matrix_mailer_container_image_self_build_repository_url: "https://github.com/dev matrix_mailer_container_image_self_build_src_files_path: "{{ matrix_mailer_base_path }}/docker-src" matrix_mailer_container_image_self_build_version: "{{ matrix_mailer_docker_image.split(':')[1] }}" -matrix_mailer_version: 4.94.2-r0-4 +matrix_mailer_version: 4.94.2-r0-5 matrix_mailer_docker_image: "{{ matrix_mailer_docker_image_name_prefix }}devture/exim-relay:{{ matrix_mailer_version }}" matrix_mailer_docker_image_name_prefix: "{{ 'localhost/' if matrix_mailer_container_image_self_build else matrix_container_global_registry_prefix }}" matrix_mailer_docker_image_force_pull: "{{ matrix_mailer_docker_image.endswith(':latest') }}" From e11e31e2c602b775b94b8292cfbd26ad2964346d Mon Sep 17 00:00:00 2001 From: WobbelTheBear Date: Mon, 22 Nov 2021 16:53:20 +0100 Subject: [PATCH 86/86] Update main.yml --- roles/matrix-client-element/defaults/main.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/roles/matrix-client-element/defaults/main.yml b/roles/matrix-client-element/defaults/main.yml index 1273859d..b05f0d85 100644 --- a/roles/matrix-client-element/defaults/main.yml +++ b/roles/matrix-client-element/defaults/main.yml @@ -7,7 +7,7 @@ matrix_client_element_container_image_self_build_repo: "https://github.com/vecto # - https://github.com/vector-im/element-web/issues/19544 matrix_client_element_container_image_self_build_low_memory_system_patch_enabled: "{{ ansible_memtotal_mb < 4096 }}" -matrix_client_element_version: v1.9.4 +matrix_client_element_version: v1.9.5 matrix_client_element_docker_image: "{{ matrix_client_element_docker_image_name_prefix }}vectorim/element-web:{{ matrix_client_element_version }}" matrix_client_element_docker_image_name_prefix: "{{ 'localhost/' if matrix_client_element_container_image_self_build else matrix_container_global_registry_prefix }}" matrix_client_element_docker_image_force_pull: "{{ matrix_client_element_docker_image.endswith(':latest') }}"