matrix-docker-ansible-deploy/roles/matrix-coturn/templates/systemd/matrix-coturn.service.j2

[Unit]
Description=Matrix Coturn server
{% for service in matrix_coturn_systemd_required_services_list %}
Requires={{ service }}
After={{ service }}
{% endfor %}

[Service]
Type=simple
ExecStartPre=-/usr/bin/docker kill matrix-coturn
ExecStartPre=-/usr/bin/docker rm matrix-coturn
ExecStart=/usr/bin/docker run --rm --name matrix-coturn \
			--log-driver=none \
			--user={{ matrix_user_uid }}:{{ matrix_user_gid }} \
			--cap-drop=ALL \
			--read-only \
			--tmpfs=/var/tmp:rw,noexec,nosuid,size=100m \
			-p 3478:3478 \
			-p 3478:3478/udp \
			-p {{ matrix_coturn_turn_udp_min_port }}-{{ matrix_coturn_turn_udp_max_port }}:{{ matrix_coturn_turn_udp_min_port }}-{{ matrix_coturn_turn_udp_max_port }}/udp \
			-v {{ matrix_coturn_config_path }}:/turnserver.conf:ro \
			{{ matrix_coturn_docker_image }} \
			-c /turnserver.conf
ExecStop=-/usr/bin/docker kill matrix-coturn
ExecStop=-/usr/bin/docker rm matrix-coturn
Restart=always
RestartSec=30

[Install]
WantedBy=multi-user.target
Switch Docker image to official one Switching from from avhost/docker-matrix (silviof/docker-matrix) to matrixdotorg/synapse. The avhost/docker-matrix (silviof/docker-matrix) image used to bundle in the coturn STUN/TURN server, so as part of the move, we're separating this to a separately-ran service (matrix-coturn.service, powered by instrumentisto/coturn-docker-image) 7 years ago			`[Unit]`
			`Description=Matrix Coturn server`
Make roles more independent of one another With this change, the following roles are now only dependent on the minimal `matrix-base` role: - `matrix-corporal` - `matrix-coturn` - `matrix-mailer` - `matrix-mxisd` - `matrix-postgres` - `matrix-riot-web` - `matrix-synapse` The `matrix-nginx-proxy` role still does too much and remains dependent on the others. Wiring up the various (now-independent) roles happens via a glue variables file (`group_vars/matrix-servers`). It's triggered for all hosts in the `matrix-servers` group. According to Ansible's rules of priority, we have the following chain of inclusion/overriding now: - role defaults (mostly empty or good for independent usage) - playbook glue variables (`group_vars/matrix-servers`) - inventory host variables (`inventory/host_vars/matrix.<your-domain>`) All roles default to enabling their main component (e.g. `matrix_mxisd_enabled: true`, `matrix_riot_web_enabled: true`). Reasoning: if a role is included in a playbook (especially separately, in another playbook), it should "work" by default. Our playbook disables some of those if they are not generally useful (e.g. `matrix_corporal_enabled: false`). 6 years ago			`{% for service in matrix_coturn_systemd_required_services_list %}`
			`Requires={{ service }}`
			`After={{ service }}`
			`{% endfor %}`
Switch Docker image to official one Switching from from avhost/docker-matrix (silviof/docker-matrix) to matrixdotorg/synapse. The avhost/docker-matrix (silviof/docker-matrix) image used to bundle in the coturn STUN/TURN server, so as part of the move, we're separating this to a separately-ran service (matrix-coturn.service, powered by instrumentisto/coturn-docker-image) 7 years ago
			`[Service]`
			`Type=simple`
			`ExecStartPre=-/usr/bin/docker kill matrix-coturn`
			`ExecStartPre=-/usr/bin/docker rm matrix-coturn`
			`ExecStart=/usr/bin/docker run --rm --name matrix-coturn \`
Disable Docker container logging `--log-driver=none` is used for all Docker containers now. All these containers are started through systemd anyway and get logged in journald, so there's no need for Docker to be logging the same thing using the default `json-file` driver. Doing that was growing `/var/lib/docker/containers/..` infinitely until service/container restart. As a result of this, things like `docker logs matrix-synapse` won't work anymore. `journalctl -u matrix-synapse` is how one can see the logs. 6 years ago			`--log-driver=none \`
Switch Docker image to official one Switching from from avhost/docker-matrix (silviof/docker-matrix) to matrixdotorg/synapse. The avhost/docker-matrix (silviof/docker-matrix) image used to bundle in the coturn STUN/TURN server, so as part of the move, we're separating this to a separately-ran service (matrix-coturn.service, powered by instrumentisto/coturn-docker-image) 7 years ago			`--user={{ matrix_user_uid }}:{{ matrix_user_gid }} \`
Drop capabilities in containers We run containers as a non-root user (no effective capabilities). Still, if a setuid binary is available in a container image, it could potentially be used to give the user the default capabilities that the container was started with. For Docker, the default set currently is: - "CAP_CHOWN" - "CAP_DAC_OVERRIDE" - "CAP_FSETID" - "CAP_FOWNER" - "CAP_MKNOD" - "CAP_NET_RAW" - "CAP_SETGID" - "CAP_SETUID" - "CAP_SETFCAP" - "CAP_SETPCAP" - "CAP_NET_BIND_SERVICE" - "CAP_SYS_CHROOT" - "CAP_KILL" - "CAP_AUDIT_WRITE" We'd rather prevent such a potential escalation by dropping ALL capabilities. The problem is nicely explained here: https://github.com/projectatomic/atomic-site/issues/203 6 years ago			`--cap-drop=ALL \`
Make (most) containers run with a read-only filesystem 6 years ago			`--read-only \`
			`--tmpfs=/var/tmp:rw,noexec,nosuid,size=100m \`
Switch Docker image to official one Switching from from avhost/docker-matrix (silviof/docker-matrix) to matrixdotorg/synapse. The avhost/docker-matrix (silviof/docker-matrix) image used to bundle in the coturn STUN/TURN server, so as part of the move, we're separating this to a separately-ran service (matrix-coturn.service, powered by instrumentisto/coturn-docker-image) 7 years ago			`-p 3478:3478 \`
			`-p 3478:3478/udp \`
			`-p {{ matrix_coturn_turn_udp_min_port }}-{{ matrix_coturn_turn_udp_max_port }}:{{ matrix_coturn_turn_udp_min_port }}-{{ matrix_coturn_turn_udp_max_port }}/udp \`
			`-v {{ matrix_coturn_config_path }}:/turnserver.conf:ro \`
Rename playbook variables so they are consistently prefixed Pretty much all variables live in their own `matrix_<whatever>` prefix now and are grouped closer together in the default variables file (`roles/matrix-server/defaults/main.yml`). 6 years ago			`{{ matrix_coturn_docker_image }} \`
Switch Docker image to official one Switching from from avhost/docker-matrix (silviof/docker-matrix) to matrixdotorg/synapse. The avhost/docker-matrix (silviof/docker-matrix) image used to bundle in the coturn STUN/TURN server, so as part of the move, we're separating this to a separately-ran service (matrix-coturn.service, powered by instrumentisto/coturn-docker-image) 7 years ago			`-c /turnserver.conf`
			`ExecStop=-/usr/bin/docker kill matrix-coturn`
			`ExecStop=-/usr/bin/docker rm matrix-coturn`
			`Restart=always`
			`RestartSec=30`

			`[Install]`
			`WantedBy=multi-user.target`