From 39e45b02980a4f4c71f2b88234c208401358cf83 Mon Sep 17 00:00:00 2001 From: Slavi Pantaleev Date: Sun, 7 Jan 2024 14:53:22 +0200 Subject: [PATCH] Move matrix-bridge-heisenbridge to its own container network --- group_vars/matrix_servers | 19 +++++-- .../defaults/main.yml | 13 ++++- .../matrix-bridge-heisenbridge/tasks/main.yml | 3 + .../tasks/setup_install.yml | 5 ++ .../tasks/validate_config.yml | 10 ++++ .../systemd/matrix-heisenbridge.service.j2 | 56 +++++++++++-------- 6 files changed, 74 insertions(+), 32 deletions(-) create mode 100644 roles/custom/matrix-bridge-heisenbridge/tasks/validate_config.yml diff --git a/group_vars/matrix_servers b/group_vars/matrix_servers index 78c06932f..685db733c 100755 --- a/group_vars/matrix_servers +++ b/group_vars/matrix_servers @@ -1479,17 +1479,24 @@ matrix_sms_bridge_homeserver_token: "{{ '%s' | format(matrix_homeserver_generic_ # We don't enable bridges by default. matrix_heisenbridge_enabled: false -matrix_heisenbridge_appservice_token: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'heisen.as.tok', rounds=655555) | to_uuid }}" +matrix_heisenbridge_systemd_required_services_list_auto: | + {{ + matrix_addons_homeserver_systemd_services_list + }} -matrix_heisenbridge_homeserver_token: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'heisen.hs.tok', rounds=655555) | to_uuid }}" +matrix_heisenbridge_container_network: "{{ matrix_addons_container_network }}" -matrix_heisenbridge_systemd_wanted_services_list: | +matrix_heisenbridge_container_additional_networks_auto: |- {{ - ['matrix-' + matrix_homeserver_implementation + '.service'] - + - (['matrix-nginx-proxy.service'] if matrix_nginx_proxy_enabled else []) + ([] if matrix_addons_homeserver_container_network == '' else [matrix_addons_homeserver_container_network]) }} +matrix_heisenbridge_appservice_token: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'heisen.as.tok', rounds=655555) | to_uuid }}" + +matrix_heisenbridge_homeserver_token: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'heisen.hs.tok', rounds=655555) | to_uuid }}" + +matrix_heisenbridge_homeserver_url: "{{ matrix_addons_homeserver_client_api_url }}" + ###################################################################### # # /matrix-bridge-heisenbridge diff --git a/roles/custom/matrix-bridge-heisenbridge/defaults/main.yml b/roles/custom/matrix-bridge-heisenbridge/defaults/main.yml index 8ffcf3122..31c313abc 100644 --- a/roles/custom/matrix-bridge-heisenbridge/defaults/main.yml +++ b/roles/custom/matrix-bridge-heisenbridge/defaults/main.yml @@ -17,6 +17,12 @@ matrix_heisenbridge_identd_enabled: false matrix_heisenbridge_base_path: "{{ matrix_base_data_path }}/heisenbridge" +matrix_heisenbridge_container_network: "" + +matrix_heisenbridge_container_additional_networks: "{{ matrix_heisenbridge_container_additional_networks_auto + matrix_heisenbridge_container_additional_networks_custom }}" +matrix_heisenbridge_container_additional_networks_auto: [] +matrix_heisenbridge_container_additional_networks_custom: [] + # Controls how long to wait for the container to stop gracefully before killing it. # We use a small value here, because this container does not seem to handle the SIGTERM signal. matrix_heisenbridge_container_stop_grace_time_seconds: 1 @@ -25,12 +31,15 @@ matrix_heisenbridge_container_stop_grace_time_seconds: 1 matrix_heisenbridge_container_extra_arguments: [] # List of systemd services that service depends on. -matrix_heisenbridge_systemd_required_services_list: ['docker.service'] +matrix_heisenbridge_systemd_required_services_list: "{{ matrix_heisenbridge_systemd_required_services_list_default + matrix_heisenbridge_systemd_required_services_list_auto + matrix_heisenbridge_systemd_required_services_list_custom }}" +matrix_heisenbridge_systemd_required_services_list_default: ['docker.service'] +matrix_heisenbridge_systemd_required_services_list_auto: [] +matrix_heisenbridge_systemd_required_services_list_custom: [] # List of systemd services that service wants matrix_heisenbridge_systemd_wanted_services_list: [] -matrix_heisenbridge_homeserver_url: "{{ matrix_homeserver_container_url }}" +matrix_heisenbridge_homeserver_url: "" matrix_heisenbridge_appservice_token: '' matrix_heisenbridge_homeserver_token: '' diff --git a/roles/custom/matrix-bridge-heisenbridge/tasks/main.yml b/roles/custom/matrix-bridge-heisenbridge/tasks/main.yml index 5b92520d1..b281d00bf 100644 --- a/roles/custom/matrix-bridge-heisenbridge/tasks/main.yml +++ b/roles/custom/matrix-bridge-heisenbridge/tasks/main.yml @@ -6,6 +6,9 @@ - install-all - install-heisenbridge block: + - when: matrix_heisenbridge_enabled | bool + ansible.builtin.include_tasks: "{{ role_path }}/tasks/validate_config.yml" + - when: matrix_heisenbridge_enabled | bool ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_install.yml" diff --git a/roles/custom/matrix-bridge-heisenbridge/tasks/setup_install.yml b/roles/custom/matrix-bridge-heisenbridge/tasks/setup_install.yml index 23b7de5d9..728a3975a 100644 --- a/roles/custom/matrix-bridge-heisenbridge/tasks/setup_install.yml +++ b/roles/custom/matrix-bridge-heisenbridge/tasks/setup_install.yml @@ -29,6 +29,11 @@ owner: "{{ matrix_user_username }}" group: "{{ matrix_user_groupname }}" +- name: Ensure heisenbridge container network is created + community.general.docker_network: + name: "{{ matrix_heisenbridge_container_network }}" + driver: bridge + - name: Ensure matrix-heisenbridge.service installed ansible.builtin.template: src: "{{ role_path }}/templates/systemd/matrix-heisenbridge.service.j2" diff --git a/roles/custom/matrix-bridge-heisenbridge/tasks/validate_config.yml b/roles/custom/matrix-bridge-heisenbridge/tasks/validate_config.yml new file mode 100644 index 000000000..6f9516e3d --- /dev/null +++ b/roles/custom/matrix-bridge-heisenbridge/tasks/validate_config.yml @@ -0,0 +1,10 @@ +--- + +- name: Fail if required heisenbridge settings not defined + ansible.builtin.fail: + msg: >- + You need to define a required configuration setting (`{{ item.name }}`). + when: "item.when | bool and vars[item.name] == ''" + with_items: + - {'name': 'matrix_heisenbridge_container_network', when: true} + - {'name': 'matrix_heisenbridge_homeserver_url', when: true} diff --git a/roles/custom/matrix-bridge-heisenbridge/templates/systemd/matrix-heisenbridge.service.j2 b/roles/custom/matrix-bridge-heisenbridge/templates/systemd/matrix-heisenbridge.service.j2 index 6bb6b81b1..a399ac880 100644 --- a/roles/custom/matrix-bridge-heisenbridge/templates/systemd/matrix-heisenbridge.service.j2 +++ b/roles/custom/matrix-bridge-heisenbridge/templates/systemd/matrix-heisenbridge.service.j2 @@ -16,30 +16,38 @@ Environment="HOME={{ devture_systemd_docker_base_systemd_unit_home_path }}" ExecStartPre=-{{ devture_systemd_docker_base_host_command_docker }} stop --time={{ matrix_heisenbridge_container_stop_grace_time_seconds }} matrix-heisenbridge ExecStartPre=-{{ devture_systemd_docker_base_host_command_docker }} rm matrix-heisenbridge -ExecStart={{ devture_systemd_docker_base_host_command_docker }} run --rm --name matrix-heisenbridge \ - --log-driver=none \ - --user={{ matrix_user_uid }}:{{ matrix_user_gid }} \ - --cap-drop=ALL \ - --network={{ matrix_docker_network }} \ - {% if matrix_heisenbridge_identd_enabled %} - -p 113:13113 \ - {% endif %} - -v {{ matrix_heisenbridge_base_path }}:/config:z \ - {% for arg in matrix_heisenbridge_container_extra_arguments %} - {{ arg }} \ - {% endfor %} - {{ matrix_heisenbridge_docker_image }} \ - {% if matrix_heisenbridge_identd_enabled %} - --identd \ - --identd-port 13113 \ - {% endif %} - {% if matrix_heisenbridge_owner %} - -o {{ matrix_heisenbridge_owner }} \ - {% endif %} - --config /config/registration.yaml \ - --listen-address 0.0.0.0 \ - --listen-port 9898 \ - {{ matrix_heisenbridge_homeserver_url }} +ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} create \ + --rm \ + --name=matrix-heisenbridge \ + --log-driver=none \ + --user={{ matrix_user_uid }}:{{ matrix_user_gid }} \ + --cap-drop=ALL \ + --network={{ matrix_heisenbridge_container_network }} \ + {% if matrix_heisenbridge_identd_enabled %} + -p 113:13113 \ + {% endif %} + --mount type=bind,src={{ matrix_heisenbridge_base_path }},dst=/config \ + {% for arg in matrix_heisenbridge_container_extra_arguments %} + {{ arg }} \ + {% endfor %} + {{ matrix_heisenbridge_docker_image }} \ + {% if matrix_heisenbridge_identd_enabled %} + --identd \ + --identd-port 13113 \ + {% endif %} + {% if matrix_heisenbridge_owner %} + -o {{ matrix_heisenbridge_owner }} \ + {% endif %} + --config /config/registration.yaml \ + --listen-address 0.0.0.0 \ + --listen-port 9898 \ + {{ matrix_heisenbridge_homeserver_url }} + +{% for network in matrix_heisenbridge_container_additional_networks %} +ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} network connect {{ network }} matrix-heisenbridge +{% endfor %} + +ExecStart={{ devture_systemd_docker_base_host_command_docker }} start --attach matrix-heisenbridge ExecStop=-{{ devture_systemd_docker_base_host_command_docker }} stop --time={{ matrix_heisenbridge_container_stop_grace_time_seconds }} matrix-heisenbridge ExecStop=-{{ devture_systemd_docker_base_host_command_docker }} rm matrix-heisenbridge