Move matrix-bridge-heisenbridge to its own container network

group_vars/matrix_servers

@@ -1479,17 +1479,24 @@ matrix_sms_bridge_homeserver_token: "{{ '%s' | format(matrix_homeserver_generic_
 # We don't enable bridges by default.
 matrix_heisenbridge_enabled: false
 
-matrix_heisenbridge_appservice_token: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'heisen.as.tok', rounds=655555) | to_uuid }}"
+matrix_heisenbridge_systemd_required_services_list_auto: |
+  {{
+    matrix_addons_homeserver_systemd_services_list
+  }}
 
-matrix_heisenbridge_homeserver_token: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'heisen.hs.tok', rounds=655555) | to_uuid }}"
+matrix_heisenbridge_container_network: "{{ matrix_addons_container_network }}"
 
-matrix_heisenbridge_systemd_wanted_services_list: |
+matrix_heisenbridge_container_additional_networks_auto: |-
   {{
-    ['matrix-' + matrix_homeserver_implementation + '.service']
+    ([] if matrix_addons_homeserver_container_network == '' else [matrix_addons_homeserver_container_network])
-    +
-    (['matrix-nginx-proxy.service'] if matrix_nginx_proxy_enabled else [])
   }}
 
+matrix_heisenbridge_appservice_token: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'heisen.as.tok', rounds=655555) | to_uuid }}"
+
+matrix_heisenbridge_homeserver_token: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'heisen.hs.tok', rounds=655555) | to_uuid }}"
+
+matrix_heisenbridge_homeserver_url: "{{ matrix_addons_homeserver_client_api_url }}"
+
 ######################################################################
 #
 # /matrix-bridge-heisenbridge

roles/custom/matrix-bridge-heisenbridge/defaults/main.yml

@@ -17,6 +17,12 @@ matrix_heisenbridge_identd_enabled: false
 
 matrix_heisenbridge_base_path: "{{ matrix_base_data_path }}/heisenbridge"
 
+matrix_heisenbridge_container_network: ""
+
+matrix_heisenbridge_container_additional_networks: "{{ matrix_heisenbridge_container_additional_networks_auto + matrix_heisenbridge_container_additional_networks_custom }}"
+matrix_heisenbridge_container_additional_networks_auto: []
+matrix_heisenbridge_container_additional_networks_custom: []
+
 # Controls how long to wait for the container to stop gracefully before killing it.
 # We use a small value here, because this container does not seem to handle the SIGTERM signal.
 matrix_heisenbridge_container_stop_grace_time_seconds: 1
@@ -25,12 +31,15 @@ matrix_heisenbridge_container_stop_grace_time_seconds: 1
 matrix_heisenbridge_container_extra_arguments: []
 
 # List of systemd services that service depends on.
-matrix_heisenbridge_systemd_required_services_list: ['docker.service']
+matrix_heisenbridge_systemd_required_services_list: "{{ matrix_heisenbridge_systemd_required_services_list_default + matrix_heisenbridge_systemd_required_services_list_auto + matrix_heisenbridge_systemd_required_services_list_custom }}"
+matrix_heisenbridge_systemd_required_services_list_default: ['docker.service']
+matrix_heisenbridge_systemd_required_services_list_auto: []
+matrix_heisenbridge_systemd_required_services_list_custom: []
 
 # List of systemd services that service wants
 matrix_heisenbridge_systemd_wanted_services_list: []
 
-matrix_heisenbridge_homeserver_url: "{{ matrix_homeserver_container_url }}"
+matrix_heisenbridge_homeserver_url: ""
 
 matrix_heisenbridge_appservice_token: ''
 matrix_heisenbridge_homeserver_token: ''

roles/custom/matrix-bridge-heisenbridge/tasks/main.yml

@@ -6,6 +6,9 @@
     - install-all
     - install-heisenbridge
   block:
+    - when: matrix_heisenbridge_enabled | bool
+      ansible.builtin.include_tasks: "{{ role_path }}/tasks/validate_config.yml"
+
     - when: matrix_heisenbridge_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_install.yml"
 

roles/custom/matrix-bridge-heisenbridge/tasks/setup_install.yml

@@ -29,6 +29,11 @@
     owner: "{{ matrix_user_username }}"
     group: "{{ matrix_user_groupname }}"
 
+- name: Ensure heisenbridge container network is created
+  community.general.docker_network:
+    name: "{{ matrix_heisenbridge_container_network }}"
+    driver: bridge
+
 - name: Ensure matrix-heisenbridge.service installed
   ansible.builtin.template:
     src: "{{ role_path }}/templates/systemd/matrix-heisenbridge.service.j2"

roles/custom/matrix-bridge-heisenbridge/tasks/validate_config.yml

@@ -0,0 +1,10 @@
+---
+
+- name: Fail if required heisenbridge settings not defined
+  ansible.builtin.fail:
+    msg: >-
+      You need to define a required configuration setting (`{{ item.name }}`).
+  when: "item.when | bool and vars[item.name] == ''"
+  with_items:
+    - {'name': 'matrix_heisenbridge_container_network', when: true}
+    - {'name': 'matrix_heisenbridge_homeserver_url', when: true}

roles/custom/matrix-bridge-heisenbridge/templates/systemd/matrix-heisenbridge.service.j2

@@ -16,30 +16,38 @@ Environment="HOME={{ devture_systemd_docker_base_systemd_unit_home_path }}"
 ExecStartPre=-{{ devture_systemd_docker_base_host_command_docker }} stop --time={{ matrix_heisenbridge_container_stop_grace_time_seconds }} matrix-heisenbridge
 ExecStartPre=-{{ devture_systemd_docker_base_host_command_docker }} rm matrix-heisenbridge
 
-ExecStart={{ devture_systemd_docker_base_host_command_docker }} run --rm --name matrix-heisenbridge \
+ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} create \
-          --log-driver=none \
+			--rm \
-          --user={{ matrix_user_uid }}:{{ matrix_user_gid }} \
+			--name=matrix-heisenbridge \
-          --cap-drop=ALL \
+			--log-driver=none \
-          --network={{ matrix_docker_network }} \
+			--user={{ matrix_user_uid }}:{{ matrix_user_gid }} \
-          {% if matrix_heisenbridge_identd_enabled %}
+			--cap-drop=ALL \
-          -p 113:13113 \
+			--network={{ matrix_heisenbridge_container_network }} \
-          {% endif %}
+			{% if matrix_heisenbridge_identd_enabled %}
-          -v {{ matrix_heisenbridge_base_path }}:/config:z \
+			-p 113:13113 \
-          {% for arg in matrix_heisenbridge_container_extra_arguments %}
+			{% endif %}
-          {{ arg }} \
+			--mount type=bind,src={{ matrix_heisenbridge_base_path }},dst=/config \
-          {% endfor %}
+			{% for arg in matrix_heisenbridge_container_extra_arguments %}
-          {{ matrix_heisenbridge_docker_image }} \
+			{{ arg }} \
-          {% if matrix_heisenbridge_identd_enabled %}
+			{% endfor %}
-          --identd \
+			{{ matrix_heisenbridge_docker_image }} \
-          --identd-port 13113 \
+			{% if matrix_heisenbridge_identd_enabled %}
-          {% endif %}
+			--identd \
-          {% if matrix_heisenbridge_owner %}
+			--identd-port 13113 \
-          -o {{ matrix_heisenbridge_owner }} \
+			{% endif %}
-          {% endif %}
+			{% if matrix_heisenbridge_owner %}
-          --config /config/registration.yaml \
+			-o {{ matrix_heisenbridge_owner }} \
-          --listen-address 0.0.0.0 \
+			{% endif %}
-          --listen-port 9898 \
+			--config /config/registration.yaml \
-          {{ matrix_heisenbridge_homeserver_url }}
+			--listen-address 0.0.0.0 \
+			--listen-port 9898 \
+			{{ matrix_heisenbridge_homeserver_url }}
+
+{% for network in matrix_heisenbridge_container_additional_networks %}
+ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} network connect {{ network }} matrix-heisenbridge
+{% endfor %}
+
+ExecStart={{ devture_systemd_docker_base_host_command_docker }} start --attach matrix-heisenbridge
 
 ExecStop=-{{ devture_systemd_docker_base_host_command_docker }} stop --time={{ matrix_heisenbridge_container_stop_grace_time_seconds }} matrix-heisenbridge
 ExecStop=-{{ devture_systemd_docker_base_host_command_docker }} rm matrix-heisenbridge