Merge pull request #73 from spantaleev/split-into-multiple-roles
Split playbook into multiple rolesdevelopment
Slavi Pantaleev
6 years ago
committed by
GitHub
commit
906942f304
@ -0,0 +1,38 @@
|
||||
# The bare hostname which represents your identity.
|
||||
# This is something like "example.com".
|
||||
# Note: this playbook does not touch the server referenced here.
|
||||
hostname_identity: "{{ host_specific_hostname_identity|lower }}"
|
||||
|
||||
# This is where your data lives and what we set up here.
|
||||
# This and the Riot hostname (see below) are expected to be on the same server.
|
||||
hostname_matrix: "matrix.{{ hostname_identity }}"
|
||||
|
||||
# This is where you access the web UI from and what we set up here.
|
||||
# This and the Matrix hostname (see above) are expected to be on the same server.
|
||||
hostname_riot: "riot.{{ hostname_identity }}"
|
||||
|
||||
|
||||
matrix_user_username: "matrix"
|
||||
matrix_user_uid: 991
|
||||
matrix_user_gid: 991
|
||||
|
||||
matrix_base_data_path: "/matrix"
|
||||
matrix_base_data_path_mode: "750"
|
||||
|
||||
matrix_static_files_base_path: "{{ matrix_base_data_path }}/static-files"
|
||||
|
||||
matrix_homeserver_url: "https://{{ hostname_matrix }}"
|
||||
matrix_identity_server_url: "https://{{ matrix_synapse_trusted_third_party_id_servers[0] }}"
|
||||
|
||||
# The Docker network that all services would be put into
|
||||
matrix_docker_network: "matrix"
|
||||
|
||||
# Variables to Control which parts of our roles run.
|
||||
run_setup: true
|
||||
run_import_postgres: true
|
||||
run_upgrade_postgres: true
|
||||
run_start: true
|
||||
run_register_user: true
|
||||
run_import_sqlite_db: true
|
||||
run_import_media_store: true
|
||||
run_self_check: true
|
||||
@ -0,0 +1,9 @@
|
||||
---
|
||||
|
||||
- name: Get rid of old files and directories
|
||||
file:
|
||||
path: "{{ item }}"
|
||||
state: absent
|
||||
with_items:
|
||||
- "{{ matrix_base_data_path }}/environment-variables"
|
||||
- "{{ matrix_base_data_path }}/scratchpad"
|
||||
@ -0,0 +1,33 @@
|
||||
- import_tasks: "{{ role_path }}/tasks/clean_up_old_files.yml"
|
||||
when: run_setup
|
||||
tags:
|
||||
- setup-all
|
||||
|
||||
- import_tasks: "{{ role_path }}/tasks/setup_server_base.yml"
|
||||
when: run_setup
|
||||
tags:
|
||||
- setup-all
|
||||
|
||||
- import_tasks: "{{ role_path }}/tasks/setup_matrix_base.yml"
|
||||
when: run_setup
|
||||
tags:
|
||||
- setup-all
|
||||
|
||||
- import_tasks: "{{ role_path }}/tasks/setup_well_known.yml"
|
||||
when: run_setup
|
||||
tags:
|
||||
- setup-all
|
||||
- setup-mxisd
|
||||
- setup-synapse
|
||||
- setup-nginx-proxy
|
||||
|
||||
- import_tasks: "{{ role_path }}/tasks/sanity_check.yml"
|
||||
tags:
|
||||
- always
|
||||
|
||||
- import_tasks: "{{ role_path }}/tasks/self_check_dns.yml"
|
||||
delegate_to: 127.0.0.1
|
||||
become: false
|
||||
when: run_self_check
|
||||
tags:
|
||||
- self-check
|
||||
@ -0,0 +1,21 @@
|
||||
# We need others to be able to read these directories too,
|
||||
# so that matrix-nginx-proxy's nginx user can access the files.
|
||||
#
|
||||
# For running with another webserver, we recommend being part of the `matrix` group.
|
||||
- name: Ensure Matrix static-files path exists
|
||||
file:
|
||||
path: "{{ item }}"
|
||||
state: directory
|
||||
mode: 0755
|
||||
owner: "{{ matrix_user_username }}"
|
||||
group: "{{ matrix_user_username }}"
|
||||
with_items:
|
||||
- "{{ matrix_static_files_base_path }}/.well-known/matrix"
|
||||
|
||||
- name: Ensure Matrix /.well-known/matrix/client configured
|
||||
template:
|
||||
src: "{{ role_path }}/templates/static-files/well-known/matrix-client.j2"
|
||||
dest: "{{ matrix_static_files_base_path }}/.well-known/matrix"
|
||||
mode: 0644
|
||||
owner: "{{ matrix_user_username }}"
|
||||
group: "{{ matrix_user_username }}"
|
||||
@ -0,0 +1,3 @@
|
||||
# This will contain a list of enabled services that the playbook is managing.
|
||||
# Each component is expected to append its service name to this list.
|
||||
matrix_systemd_services_list: []
|
||||
@ -0,0 +1,4 @@
|
||||
- import_tasks: "{{ role_path }}/tasks/start.yml"
|
||||
when: run_start
|
||||
tags:
|
||||
- start
|
||||
@ -0,0 +1,18 @@
|
||||
---
|
||||
|
||||
- name: Ensure systemd reloaded
|
||||
service:
|
||||
daemon_reload: yes
|
||||
|
||||
- name: Ensure Matrix services stopped
|
||||
service:
|
||||
name: "{{ item }}"
|
||||
state: stopped
|
||||
with_items: "{{ matrix_systemd_services_list }}"
|
||||
|
||||
- name: Ensure Matrix services started
|
||||
service:
|
||||
name: "{{ item }}"
|
||||
enabled: yes
|
||||
state: started
|
||||
with_items: "{{ matrix_systemd_services_list }}"
|
||||
@ -0,0 +1,28 @@
|
||||
# Enable this to add support for matrix-corporal.
|
||||
# See: https://github.com/devture/matrix-corporal
|
||||
matrix_corporal_enabled: false
|
||||
|
||||
# Controls whether the matrix-corporal web server's ports are exposed outside of the container.
|
||||
# Normally, matrix-nginx-proxy is enabled and nginx can reach matrix-corporal over the container network.
|
||||
# If matrix-nginx-proxy is not enabled, or you otherwise have a need for it, you can expose
|
||||
# matrix-corporal's web-server ports to the local host (`127.0.0.1:41080` and `127.0.0.1:41081`).
|
||||
matrix_corporal_container_expose_ports: "{{ not matrix_nginx_proxy_enabled }}"
|
||||
|
||||
matrix_corporal_docker_image: "devture/matrix-corporal:1.2.2"
|
||||
matrix_corporal_base_path: "{{ matrix_base_data_path }}/corporal"
|
||||
matrix_corporal_config_dir_path: "{{ matrix_corporal_base_path }}/config"
|
||||
matrix_corporal_cache_dir_path: "{{ matrix_corporal_base_path }}/cache"
|
||||
matrix_corporal_var_dir_path: "{{ matrix_corporal_base_path }}/var"
|
||||
|
||||
matrix_corporal_matrix_timeout_milliseconds: 45000
|
||||
|
||||
matrix_corporal_reconciliation_retry_interval_milliseconds: 30000
|
||||
matrix_corporal_reconciliation_user_id_local_part: "matrix-corporal"
|
||||
|
||||
matrix_corporal_http_api_enabled: false
|
||||
matrix_corporal_http_api_auth_token: ""
|
||||
|
||||
# Matrix Corporal policy provider configuration (goes directly into the configuration's `PolicyProvider` value)
|
||||
matrix_corporal_policy_provider_config: ""
|
||||
|
||||
matrix_corporal_debug: false
|
||||
@ -0,0 +1,9 @@
|
||||
- name: Override configuration specifying where the Matrix Client API is
|
||||
set_fact:
|
||||
matrix_nginx_proxy_matrix_client_api_addr_with_proxy_container: "matrix-corporal:41080"
|
||||
matrix_nginx_proxy_matrix_client_api_addr_sans_proxy_container: "localhost:41080"
|
||||
when: "matrix_corporal_enabled"
|
||||
|
||||
- set_fact:
|
||||
matrix_systemd_services_list: "{{ matrix_systemd_services_list + ['matrix-corporal'] }}"
|
||||
when: "matrix_corporal_enabled"
|
||||
@ -0,0 +1,16 @@
|
||||
- import_tasks: "{{ role_path }}/tasks/init.yml"
|
||||
tags:
|
||||
- always
|
||||
|
||||
- import_tasks: "{{ role_path }}/tasks/setup_corporal.yml"
|
||||
when: run_setup
|
||||
tags:
|
||||
- setup-all
|
||||
- setup-corporal
|
||||
|
||||
- import_tasks: "{{ role_path }}/tasks/self_check_corporal.yml"
|
||||
delegate_to: 127.0.0.1
|
||||
become: false
|
||||
when: "run_self_check and matrix_corporal_enabled"
|
||||
tags:
|
||||
- self-check
|
||||
@ -0,0 +1,14 @@
|
||||
matrix_coturn_docker_image: "instrumentisto/coturn:4.5.0.8"
|
||||
|
||||
matrix_coturn_base_path: "{{ matrix_base_data_path }}/coturn"
|
||||
matrix_coturn_config_path: "{{ matrix_coturn_base_path }}/turnserver.conf"
|
||||
|
||||
# A shared secret (between Synapse and Coturn) used for authentication.
|
||||
# You can put any string here, but generating a strong one is preferred (e.g. `pwgen -s 64 1`).
|
||||
matrix_coturn_turn_static_auth_secret: ""
|
||||
|
||||
# UDP port-range to use for TURN
|
||||
matrix_coturn_turn_udp_min_port: 49152
|
||||
matrix_coturn_turn_udp_max_port: 49172
|
||||
|
||||
matrix_coturn_turn_external_ip_address: "{{ ansible_host }}"
|
||||
@ -0,0 +1,2 @@
|
||||
- set_fact:
|
||||
matrix_systemd_services_list: "{{ matrix_systemd_services_list + ['matrix-coturn'] }}"
|
||||
@ -0,0 +1,9 @@
|
||||
- import_tasks: "{{ role_path }}/tasks/init.yml"
|
||||
tags:
|
||||
- always
|
||||
|
||||
- import_tasks: "{{ role_path }}/tasks/setup_coturn.yml"
|
||||
when: run_setup
|
||||
tags:
|
||||
- setup-coturn
|
||||
- setup-all
|
||||
@ -0,0 +1,16 @@
|
||||
# By default, this playbook sets up a postfix mailer server (running in a container).
|
||||
# This is so that Matrix Synapse can send email reminders for unread messages.
|
||||
# Other services (like mxisd), however, also use that mailer to send emails through it.
|
||||
matrix_mailer_enabled: true
|
||||
|
||||
matrix_mailer_base_path: "{{ matrix_base_data_path }}/mailer"
|
||||
|
||||
matrix_mailer_docker_image: "panubo/postfix:latest"
|
||||
|
||||
matrix_mailer_sender_address: "matrix@{{ hostname_identity }}"
|
||||
matrix_mailer_relay_use: false
|
||||
matrix_mailer_relay_host_name: "mail.example.com"
|
||||
matrix_mailer_relay_host_port: 587
|
||||
matrix_mailer_relay_auth: false
|
||||
matrix_mailer_relay_auth_username: ""
|
||||
matrix_mailer_relay_auth_password: ""
|
||||
@ -0,0 +1,3 @@
|
||||
- set_fact:
|
||||
matrix_systemd_services_list: "{{ matrix_systemd_services_list + ['matrix-mailer'] }}"
|
||||
when: "matrix_mailer_enabled"
|
||||
@ -0,0 +1,9 @@
|
||||
- import_tasks: "{{ role_path }}/tasks/init.yml"
|
||||
tags:
|
||||
- always
|
||||
|
||||
- import_tasks: "{{ role_path }}/tasks/setup_mailer.yml"
|
||||
when: run_setup
|
||||
tags:
|
||||
- setup-mailer
|
||||
- setup-all
|
||||
@ -0,0 +1,101 @@
|
||||
# By default, this playbook installs the mxisd identity server on the same domain as Synapse (`hostname_matrix`).
|
||||
# If you wish to use the public identity servers (matrix.org, vector.im, riot.im) instead of your own,
|
||||
# you may wish to disable this.
|
||||
matrix_mxisd_enabled: true
|
||||
matrix_mxisd_docker_image: "kamax/mxisd:1.2.2"
|
||||
matrix_mxisd_base_path: "{{ matrix_base_data_path }}/mxisd"
|
||||
matrix_mxisd_config_path: "{{ matrix_mxisd_base_path }}/config"
|
||||
matrix_mxisd_data_path: "{{ matrix_mxisd_base_path }}/data"
|
||||
|
||||
# Controls whether the mxisd web server's port is exposed outside of the container.
|
||||
# Normally, matrix-nginx-proxy is enabled and nginx can reach mxisd over the container network.
|
||||
# If matrix-nginx-proxy is not enabled, or you otherwise have a need for it, you can expose
|
||||
# mxisd's web-server port to the local host (`127.0.0.1:8090`).
|
||||
matrix_mxisd_container_expose_port: "{{ not matrix_nginx_proxy_enabled }}"
|
||||
|
||||
# Your identity server is private by default.
|
||||
# To ensure maximum discovery, you can make your identity server
|
||||
# also forward lookups to the central matrix.org Identity server
|
||||
# (at the cost of potentially leaking all your contacts information).
|
||||
# Enabling this is discouraged. Learn more here: https://github.com/kamax-io/mxisd/blob/master/docs/features/identity.md#lookups
|
||||
matrix_mxisd_matrixorg_forwarding_enabled: false
|
||||
|
||||
# mxisd has serveral supported identity stores.
|
||||
# One of them (which we enable by default) is storing identities directly in Synapse's database.
|
||||
# Learn more here: https://github.com/kamax-matrix/mxisd/blob/master/docs/stores/synapse.md
|
||||
#
|
||||
# If you need to disable this in favor of some other store, you can toggle it to disabled here
|
||||
# and add your own mxisd configuration for the other store in `matrix_mxisd_configuration_extension_yaml`.
|
||||
matrix_mxisd_synapsesql_enabled: true
|
||||
matrix_mxisd_synapsesql_type: postgresql
|
||||
matrix_mxisd_synapsesql_connection: //{{ matrix_postgres_connection_hostname }}/{{ matrix_postgres_db_name }}?user={{ matrix_postgres_connection_username }}&password={{ matrix_postgres_connection_password }}
|
||||
|
||||
# Default mxisd configuration template which covers the generic use case.
|
||||
# You can customize it by controlling the various variables inside it.
|
||||
#
|
||||
# For a more advanced customization, you can extend the default (see `matrix_mxisd_configuration_extension_yaml`)
|
||||
# or completely replace this variable with your own template.
|
||||
matrix_mxisd_configuration_yaml: |
|
||||
matrix:
|
||||
domain: {{ hostname_identity }}
|
||||
|
||||
server:
|
||||
name: {{ hostname_matrix }}
|
||||
|
||||
key:
|
||||
path: /var/mxisd/sign.key
|
||||
|
||||
storage:
|
||||
provider:
|
||||
sqlite:
|
||||
database: /var/mxisd/mxisd.db
|
||||
|
||||
{% if matrix_mxisd_matrixorg_forwarding_enabled %}
|
||||
forward:
|
||||
servers: ['matrix-org']
|
||||
{% endif %}
|
||||
|
||||
threepid:
|
||||
medium:
|
||||
email:
|
||||
identity:
|
||||
from: {{ matrix_mailer_sender_address }}
|
||||
connectors:
|
||||
smtp:
|
||||
host: matrix-mailer
|
||||
port: 587
|
||||
tls: 0
|
||||
|
||||
synapseSql:
|
||||
enabled: {{ matrix_mxisd_synapsesql_enabled }}
|
||||
type: {{ matrix_mxisd_synapsesql_type }}
|
||||
connection: {{ matrix_mxisd_synapsesql_connection }}
|
||||
|
||||
matrix_mxisd_configuration_extension_yaml: |
|
||||
# Your custom YAML configuration for mxisd goes here.
|
||||
# This configuration extends the default starting configuration (`matrix_mxisd_configuration_yaml`).
|
||||
#
|
||||
# You can override individual variables from the default configuration, or introduce new ones.
|
||||
#
|
||||
# If you need something more special, you can take full control by
|
||||
# completely redefining `matrix_mxisd_configuration_yaml`.
|
||||
#
|
||||
# Example configuration extension follows:
|
||||
#
|
||||
# ldap:
|
||||
# enabled: true
|
||||
# connection:
|
||||
# host: ldapHostnameOrIp
|
||||
# tls: false
|
||||
# port: 389
|
||||
# baseDns: ['OU=Users,DC=example,DC=org']
|
||||
# bindDn: CN=My Mxisd User,OU=Users,DC=example,DC=org
|
||||
# bindPassword: TheUserPassword
|
||||
|
||||
# Doing `|from_yaml` when the extension contains nothing yields an empty string ("").
|
||||
# We need to ensure it's a dictionary or `|combine` (when building `matrix_mxisd_configuration`) will fail later.
|
||||
matrix_mxisd_configuration_extension: "{{ matrix_mxisd_configuration_extension_yaml|from_yaml if matrix_mxisd_configuration_extension_yaml|from_yaml else {} }}"
|
||||
|
||||
# Holds the final mxisd configuration (a combination of the default and its extension).
|
||||
# You most likely don't need to touch this variable. Instead, see `matrix_mxisd_configuration_yaml`.
|
||||
matrix_mxisd_configuration: "{{ matrix_mxisd_configuration_yaml|from_yaml|combine(matrix_mxisd_configuration_extension, recursive=True) }}"
|
||||
@ -0,0 +1,3 @@
|
||||
- set_fact:
|
||||
matrix_systemd_services_list: "{{ matrix_systemd_services_list + ['matrix-mxisd'] }}"
|
||||
when: "matrix_mxisd_enabled"
|
||||
@ -0,0 +1,13 @@
|
||||
- import_tasks: "{{ role_path }}/tasks/init.yml"
|
||||
tags:
|
||||
- always
|
||||
|
||||
- import_tasks: "{{ role_path }}/tasks/setup_mxisd.yml"
|
||||
tags:
|
||||
- setup-all
|
||||
- setup-mxisd
|
||||
|
||||
- import_tasks: "{{ role_path }}/tasks/self_check_mxisd.yml"
|
||||
delegate_to: 127.0.0.1
|
||||
become: false
|
||||
when: "run_self_check and matrix_mxisd_enabled"
|
||||
@ -0,0 +1,50 @@
|
||||
# By default, this playbook sets up its own nginx proxy server on port 80/443.
|
||||
# This is fine if you're dedicating the whole server to Matrix.
|
||||
# But in case that's not the case, you may wish to prevent that
|
||||
# and take care of proxying by yourself.
|
||||
matrix_nginx_proxy_enabled: true
|
||||
|
||||
matrix_nginx_proxy_docker_image: "nginx:1.15.8-alpine"
|
||||
|
||||
matrix_nginx_proxy_data_path: "{{ matrix_base_data_path }}/nginx-proxy"
|
||||
matrix_nginx_proxy_confd_path: "{{ matrix_nginx_proxy_data_path }}/conf.d"
|
||||
|
||||
# The addresses where the Matrix Client API is.
|
||||
# Certain extensions (like matrix-corporal) may override this in order to capture all traffic.
|
||||
matrix_nginx_proxy_matrix_client_api_addr_with_proxy_container: "matrix-synapse:8008"
|
||||
matrix_nginx_proxy_matrix_client_api_addr_sans_proxy_container: "localhost:8008"
|
||||
|
||||
# Specifies when to reload the matrix-nginx-proxy service so that
|
||||
# a new SSL certificate could go into effect.
|
||||
matrix_nginx_proxy_reload_cron_time_definition: "20 4 */5 * *"
|
||||
|
||||
# Specifies which SSL protocols to use when serving Riot and Synapse
|
||||
# Note TLSv1.3 is not yet available in dockerized nginx
|
||||
# See: https://github.com/nginxinc/docker-nginx/issues/190
|
||||
matrix_nginx_proxy_ssl_protocols: "TLSv1.1 TLSv1.2"
|
||||
|
||||
# By default, this playbook automatically retrieves and auto-renews
|
||||
# free SSL certificates from Let's Encrypt.
|
||||
#
|
||||
# The following retrieval methods are supported:
|
||||
# - "lets-encrypt" - the playbook obtains free SSL certificates from Let's Encrypt
|
||||
# - "self-signed" - the playbook generates and self-signs certificates
|
||||
# - "manually-managed" - lets you manage certificates by yourself (manually; see below)
|
||||
#
|
||||
# If you decide to manage certificates by yourself (`matrix_ssl_retrieval_method: manually-managed`),
|
||||
# you'd need to drop them into the directory specified by `matrix_ssl_config_dir_path`
|
||||
# obeying the following hierarchy:
|
||||
# - <matrix_ssl_config_dir_path>/live/<domain>/fullchain.pem
|
||||
# - <matrix_ssl_config_dir_path>/live/<domain>/privkey.pem
|
||||
# where <domain> refers to the domains that you need (usually `hostname_matrix` and `hostname_riot`).
|
||||
matrix_ssl_retrieval_method: "lets-encrypt"
|
||||
|
||||
# Controls whether to obtain production or staging certificates from Let's Encrypt.
|
||||
matrix_ssl_lets_encrypt_staging: false
|
||||
matrix_ssl_lets_encrypt_certbot_docker_image: "certbot/certbot:v0.30.0"
|
||||
matrix_ssl_lets_encrypt_certbot_standalone_http_port: 2402
|
||||
matrix_ssl_lets_encrypt_support_email: "{{ host_specific_matrix_ssl_lets_encrypt_support_email }}"
|
||||
|
||||
matrix_ssl_base_path: "{{ matrix_base_data_path }}/ssl"
|
||||
matrix_ssl_config_dir_path: "{{ matrix_ssl_base_path }}/config"
|
||||
matrix_ssl_log_dir_path: "{{ matrix_ssl_base_path }}/log"
|
||||
@ -0,0 +1,3 @@
|
||||
- set_fact:
|
||||
matrix_systemd_services_list: "{{ matrix_systemd_services_list + ['matrix-nginx-proxy'] }}"
|
||||
when: "matrix_nginx_proxy_enabled"
|
||||
@ -0,0 +1,23 @@
|
||||
- import_tasks: "{{ role_path }}/tasks/init.yml"
|
||||
tags:
|
||||
- always
|
||||
|
||||
- import_tasks: "{{ role_path }}/tasks/ssl/main.yml"
|
||||
when: run_setup
|
||||
tags:
|
||||
- setup-all
|
||||
- setup-nginx-proxy
|
||||
- setup-ssl
|
||||
|
||||
- import_tasks: "{{ role_path }}/tasks/setup_nginx_proxy.yml"
|
||||
when: run_setup
|
||||
tags:
|
||||
- setup-all
|
||||
- setup-nginx-proxy
|
||||
|
||||
- import_tasks: "{{ role_path }}/tasks/self_check_well_known.yml"
|
||||
delegate_to: 127.0.0.1
|
||||
become: false
|
||||
when: run_self_check
|
||||
tags:
|
||||
- self-check
|
||||
@ -0,0 +1,8 @@
|
||||
---
|
||||
|
||||
- name: Verify certificates
|
||||
include_tasks: "{{ role_path }}/tasks/ssl/setup_ssl_manually_managed_verify_for_domain.yml"
|
||||
with_items: "{{ domains_requiring_certificates }}"
|
||||
loop_control:
|
||||
loop_var: domain_name
|
||||
when: "matrix_ssl_retrieval_method == 'manually-managed'"
|
||||
@ -0,0 +1,15 @@
|
||||
# The defaults below cause a postgres server to be configured (running within a container).
|
||||
# Using an external server is possible by tweaking all of the parameters below.
|
||||
matrix_postgres_use_external: false
|
||||
matrix_postgres_connection_hostname: "matrix-postgres"
|
||||
matrix_postgres_connection_username: "synapse"
|
||||
matrix_postgres_connection_password: "synapse-password"
|
||||
matrix_postgres_db_name: "homeserver"
|
||||
|
||||
matrix_postgres_base_path: "{{ matrix_base_data_path }}/postgres"
|
||||
matrix_postgres_data_path: "{{ matrix_postgres_base_path }}/data"
|
||||
|
||||
matrix_postgres_docker_image_v9: "postgres:9.6.11-alpine"
|
||||
matrix_postgres_docker_image_v10: "postgres:10.6-alpine"
|
||||
matrix_postgres_docker_image_v11: "postgres:11.1-alpine"
|
||||
matrix_postgres_docker_image_latest: "{{ matrix_postgres_docker_image_v11 }}"
|
||||
@ -0,0 +1,3 @@
|
||||
- set_fact:
|
||||
matrix_systemd_services_list: "{{ matrix_systemd_services_list + ['matrix-postgres'] }}"
|
||||
when: "not matrix_postgres_use_external"
|
||||
@ -0,0 +1,24 @@
|
||||
- import_tasks: "{{ role_path }}/tasks/init.yml"
|
||||
tags:
|
||||
- always
|
||||
|
||||
- import_tasks: "{{ role_path }}/tasks/setup_postgres.yml"
|
||||
when: run_setup
|
||||
tags:
|
||||
- setup-postgres
|
||||
- setup-all
|
||||
|
||||
- import_tasks: "{{ role_path }}/tasks/import_postgres.yml"
|
||||
when: run_import_postgres
|
||||
tags:
|
||||
- import-postgres
|
||||
|
||||
- import_tasks: "{{ role_path }}/tasks/import_sqlite_db.yml"
|
||||
when: run_import_sqlite_db
|
||||
tags:
|
||||
- import-sqlite-db
|
||||
|
||||
- import_tasks: "{{ role_path }}/tasks/upgrade_postgres.yml"
|
||||
when: run_upgrade_postgres
|
||||
tags:
|
||||
- upgrade-postgres
|
||||
@ -0,0 +1,72 @@
|
||||
---
|
||||
|
||||
# We used to store Postgres data directly under `/matrix/postgres` (what is now considered `matrix_postgres_base_path`).
|
||||
#
|
||||
# From now on, we expect to store Postgres data one directory below now (`/matrix/postgres/data` - `matrix_postgres_data_path`).
|
||||
# We wish to use the base directory for other purposes (storing environment variable files, etc.).
|
||||
# Mixing those with the Postgres data is no good and it leads to Postgres's `initdb` complaining to initialize
|
||||
# a database in a non-empty directory.
|
||||
#
|
||||
# For this reason, we store the Postgres data in `/matrix/postgres/data` and need to relocate any installations
|
||||
# which still store it in the parent directory (`/matrix/postgres`).
|
||||
|
||||
- name: Check if old Postgres data directory is used
|
||||
stat:
|
||||
path: "{{ matrix_postgres_base_path }}/PG_VERSION"
|
||||
register: result_pg_old_data_dir_stat
|
||||
|
||||
- name: Warn if old Postgres data directory detected
|
||||
debug:
|
||||
msg: >
|
||||
Found that you have Postgres data in `{{ matrix_postgres_base_path }}`.
|
||||
From now on, Postgres data is supposed to be stored in `{{ matrix_postgres_data_path }}` instead.
|
||||
We'll stop Postgres and relocate the files there for you.
|
||||
when: "result_pg_old_data_dir_stat.stat.exists"
|
||||
|
||||
# We should stop Postgres first, before building a list of files,
|
||||
# as to ignore any `postmaster.pid` files, etc.
|
||||
- name: Ensure matrix-postgres is stopped
|
||||
service:
|
||||
name: matrix-postgres
|
||||
state: stopped
|
||||
daemon_reload: yes
|
||||
when: "result_pg_old_data_dir_stat.stat.exists"
|
||||
|
||||
- name: Find files and directories in old Postgres data path
|
||||
find:
|
||||
paths: "{{ matrix_postgres_base_path }}"
|
||||
file_type: any
|
||||
excludes: ["data"]
|
||||
register: "result_pg_old_data_dir_find"
|
||||
when: "result_pg_old_data_dir_stat.stat.exists"
|
||||
|
||||
- name: Ensure new Postgres data path exists
|
||||
file:
|
||||
path: "{{ matrix_postgres_data_path }}"
|
||||
state: directory
|
||||
mode: 0700
|
||||
owner: "{{ matrix_user_username }}"
|
||||
group: "{{ matrix_user_username }}"
|
||||
when: "result_pg_old_data_dir_stat.stat.exists"
|
||||
|
||||
- block:
|
||||
- name: Relocate Postgres data files from old directory to new
|
||||
command: "mv {{ item.path }} {{ matrix_postgres_data_path }}/{{ item.path|basename }}"
|
||||
with_items: "{{ result_pg_old_data_dir_find.files }}"
|
||||
when: "result_pg_old_data_dir_stat.stat.exists"
|
||||
|
||||
# Intentionally not starting matrix-postgres here.
|
||||
# It likely needs to be updated to point to the new directory.
|
||||
# In fact, let's even get rid of the outdated service, to ensure no one will start it
|
||||
# and have it initialize a new database.
|
||||
|
||||
- name: Ensure outdated matrix-postgres.service doesn't exist
|
||||
file:
|
||||
path: "/etc/systemd/system/matrix-postgres.service"
|
||||
state: absent
|
||||
when: "result_pg_old_data_dir_stat.stat.exists"
|
||||
|
||||
- name: Ensure systemd reloaded after getting rid of outdated matrix-postgres.service
|
||||
service:
|
||||
daemon_reload: yes
|
||||
when: "result_pg_old_data_dir_stat.stat.exists"
|
||||
@ -0,0 +1,32 @@
|
||||
# By default, this playbook installs the Riot.IM web UI on the `hostname_riot` domain.
|
||||
# If you wish to connect to your Matrix server by other means,
|
||||
# you may wish to disable this.
|
||||
matrix_riot_web_enabled: true
|
||||
|
||||
matrix_riot_web_docker_image: "bubuntux/riot-web:v0.17.8"
|
||||
|
||||
matrix_riot_web_data_path: "{{ matrix_base_data_path }}/riot-web"
|
||||
|
||||
# Riot config.json customizations
|
||||
matrix_riot_web_disable_custom_urls: true
|
||||
matrix_riot_web_disable_guests: true
|
||||
matrix_riot_web_integrations_ui_url: "https://scalar.vector.im/"
|
||||
matrix_riot_web_integrations_rest_url: "https://scalar.vector.im/api"
|
||||
matrix_riot_web_integrations_widgets_urls: "https://scalar.vector.im/api"
|
||||
matrix_riot_web_integrations_jitsi_widget_url: "https://scalar.vector.im/api/widgets/jitsi.html"
|
||||
# Riot public room directory server(s)
|
||||
matrix_riot_web_roomdir_servers: ['matrix.org']
|
||||
matrix_riot_web_welcome_user_id: "@riot-bot:matrix.org"
|
||||
|
||||
|
||||
# Riot home.html customizations
|
||||
# Default home.html template file
|
||||
matrix_riot_web_homepage_template: "{{ role_path }}/templates/home.html.j2"
|
||||
# Show general discussion about Matrix and Riot row
|
||||
matrix_riot_web_homepage_template_general: true
|
||||
# Show Matrix technical discussions row
|
||||
matrix_riot_web_homepage_template_technical: true
|
||||
# Show building services on Matrix row
|
||||
matrix_riot_web_homepage_template_building: true
|
||||
# Show contributing code to Matrix and Riot row
|
||||
matrix_riot_web_homepage_template_contributing: true
|
||||
@ -0,0 +1,3 @@
|
||||
- set_fact:
|
||||
matrix_systemd_services_list: "{{ matrix_systemd_services_list + ['matrix-riot-web'] }}"
|
||||
when: matrix_riot_web_enabled
|
||||
@ -0,0 +1,16 @@
|
||||
- import_tasks: "{{ role_path }}/tasks/init.yml"
|
||||
tags:
|
||||
- always
|
||||
|
||||
- import_tasks: "{{ role_path }}/tasks/setup_riot_web.yml"
|
||||
when: run_setup
|
||||
tags:
|
||||
- setup-all
|
||||
- setup-riot-web
|
||||
|
||||
- import_tasks: "{{ role_path }}/tasks/self_check_riot_web.yml"
|
||||
delegate_to: 127.0.0.1
|
||||
become: false
|
||||
when: "run_self_check and matrix_riot_web_enabled"
|
||||
tags:
|
||||
- self-check
|
||||
@ -1,463 +0,0 @@
|
||||
# The bare hostname which represents your identity.
|
||||
# This is something like "example.com".
|
||||
# Note: this playbook does not touch the server referenced here.
|
||||
hostname_identity: "{{ host_specific_hostname_identity|lower }}"
|
||||
|
||||
# This is where your data lives and what we set up here.
|
||||
# This and the Riot hostname (see below) are expected to be on the same server.
|
||||
hostname_matrix: "matrix.{{ hostname_identity }}"
|
||||
|
||||
# This is where you access the web UI from and what we set up here.
|
||||
# This and the Matrix hostname (see above) are expected to be on the same server.
|
||||
hostname_riot: "riot.{{ hostname_identity }}"
|
||||
|
||||
|
||||
matrix_user_username: "matrix"
|
||||
matrix_user_uid: 991
|
||||
matrix_user_gid: 991
|
||||
|
||||
matrix_base_data_path: "/matrix"
|
||||
matrix_environment_variables_data_path: "{{ matrix_base_data_path }}/environment-variables"
|
||||
matrix_static_files_base_path: "{{ matrix_base_data_path }}/static-files"
|
||||
|
||||
matrix_homeserver_url: "https://{{ hostname_matrix }}"
|
||||
matrix_identity_server_url: "https://{{ matrix_synapse_trusted_third_party_id_servers[0] }}"
|
||||
|
||||
# The Docker network that all services would be put into
|
||||
matrix_docker_network: "matrix"
|
||||
|
||||
|
||||
matrix_synapse_docker_image: "matrixdotorg/synapse:v0.34.1.1-py3"
|
||||
|
||||
matrix_synapse_base_path: "{{ matrix_base_data_path }}/synapse"
|
||||
matrix_synapse_config_dir_path: "{{ matrix_synapse_base_path }}/config"
|
||||
matrix_synapse_run_path: "{{ matrix_synapse_base_path }}/run"
|
||||
matrix_synapse_storage_path: "{{ matrix_synapse_base_path }}/storage"
|
||||
matrix_synapse_media_store_path: "{{ matrix_synapse_storage_path }}/media-store"
|
||||
matrix_synapse_ext_path: "{{ matrix_synapse_base_path }}/ext"
|
||||
|
||||
matrix_synapse_in_container_python_packages_path: "/usr/local/lib/python3.6/site-packages"
|
||||
|
||||
# Specifies which template files to use when configuring Synapse.
|
||||
# If you'd like to have your own different configuration, feel free to copy and paste
|
||||
# the original files into your inventory (e.g. in `inventory/host_vars/<host>/`)
|
||||
# and then change the specific host's `vars.yaml` file like this:
|
||||
# matrix_synapse_template_synapse_homeserver: "{{ playbook_dir }}/inventory/host_vars/<host>/homeserver.yaml.j2"
|
||||
matrix_synapse_template_synapse_homeserver: "{{ role_path }}/templates/synapse/homeserver.yaml.j2"
|
||||
matrix_synapse_template_synapse_log: "{{ role_path }}/templates/synapse/synapse.log.config.j2"
|
||||
|
||||
matrix_synapse_macaroon_secret_key: ""
|
||||
matrix_synapse_registration_shared_secret: "{{ matrix_synapse_macaroon_secret_key }}"
|
||||
matrix_synapse_form_secret: "{{ matrix_synapse_macaroon_secret_key }}"
|
||||
|
||||
# These are the identity servers that would be trusted by Synapse if mxisd is NOT enabled
|
||||
matrix_synapse_id_servers_public: ['vector.im', 'matrix.org']
|
||||
|
||||
# These are the identity servers that would be trusted by Synapse if mxisd IS enabled
|
||||
matrix_synapse_id_servers_own: "['{{ hostname_matrix }}']"
|
||||
|
||||
# The final list of identity servers to use for Synapse.
|
||||
# The first one would also be used as riot-web's default identity server.
|
||||
matrix_synapse_trusted_third_party_id_servers: "{{ matrix_synapse_id_servers_own if matrix_mxisd_enabled else matrix_synapse_id_servers_public }}"
|
||||
|
||||
matrix_synapse_max_upload_size_mb: 10
|
||||
matrix_synapse_max_log_file_size_mb: 100
|
||||
matrix_synapse_max_log_files_count: 10
|
||||
|
||||
# Log levels
|
||||
# Possible options are defined here https://docs.python.org/3/library/logging.html#logging-levels
|
||||
# warning: setting log level to DEBUG will make synapse log sensitive information such
|
||||
# as access tokens
|
||||
matrix_synapse_log_level: "INFO"
|
||||
matrix_synapse_storage_sql_log_level: "INFO"
|
||||
matrix_synapse_root_log_level: "INFO"
|
||||
|
||||
# Rate limits
|
||||
matrix_synapse_rc_messages_per_second: 0.2
|
||||
matrix_synapse_rc_message_burst_count: 10.0
|
||||
|
||||
# Enable this to allow Synapse to report utilization statistics about your server to matrix.org
|
||||
# (things like number of users, number of messages sent, uptime, load, etc.)
|
||||
matrix_synapse_report_stats: false
|
||||
|
||||
# Controls whether the Matrix server will track presence status (online, offline, unavailable) for users.
|
||||
# If users participate in large rooms with many other servers,
|
||||
# disabling this will decrease server load significantly.
|
||||
matrix_synapse_use_presence: true
|
||||
|
||||
# Controls whether people with access to the homeserver can register by themselves.
|
||||
matrix_synapse_enable_registration: false
|
||||
|
||||
# Users who register on this homeserver will automatically be joined to these rooms.
|
||||
# Rooms are to be specified using addresses (e.g. `#address:example.com`)
|
||||
matrix_synapse_auto_join_rooms: []
|
||||
|
||||
# Controls whether auto-join rooms (`matrix_synapse_auto_join_rooms`) are to be created
|
||||
# automatically if they don't already exist.
|
||||
matrix_synapse_autocreate_auto_join_rooms: true
|
||||
|
||||
# Controls password-peppering for Matrix Synapse. Not to be changed after initial setup.
|
||||
matrix_synapse_password_config_pepper: ""
|
||||
|
||||
# Controls the number of events that Matrix Synapse caches in memory.
|
||||
matrix_synapse_event_cache_size: "100K"
|
||||
|
||||
# Controls cache sizes for Matrix Synapse via the SYNAPSE_CACHE_FACTOR environment variable.
|
||||
# Raise this to increase cache sizes or lower it to potentially lower memory use.
|
||||
# To learn more, see:
|
||||
# - https://github.com/matrix-org/synapse#help-synapse-eats-all-my-ram
|
||||
# - https://github.com/matrix-org/synapse/issues/3939
|
||||
matrix_synapse_cache_factor: 0.5
|
||||
|
||||
# Controls whether Matrix Synapse will federate at all.
|
||||
# Disable this to completely isolate your server from the rest of the Matrix network.
|
||||
matrix_synapse_federation_enabled: true
|
||||
|
||||
# A list of domain names that are allowed to federate with the given Matrix Synapse server.
|
||||
# An empty list value (`[]`) will also effectively stop federation, but if that's the desired
|
||||
# result, it's better to accomplish it by changing `matrix_synapse_federation_enabled`.
|
||||
matrix_synapse_federation_domain_whitelist: ~
|
||||
|
||||
# A list of additional "volumes" to mount in the container.
|
||||
# This list gets populated dynamically based on Synapse extensions that have been enabled.
|
||||
# Contains definition objects like this: `{"src": "/outside", "dst": "/inside", "options": "rw|ro|slave|.."}
|
||||
matrix_synapse_container_additional_volumes: []
|
||||
|
||||
# A list of additional loggers to register in synapse.log.config.
|
||||
# This list gets populated dynamically based on Synapse extensions that have been enabled.
|
||||
# Contains definition objects like this: `{"name": "..", "level": "DEBUG"}
|
||||
matrix_synapse_additional_loggers: []
|
||||
|
||||
# A list of service config files
|
||||
# This list gets populated dynamically based on Synapse extensions that have been enabled.
|
||||
# Contains fs paths
|
||||
matrix_synapse_app_service_config_files: []
|
||||
|
||||
# This is set dynamically during execution depending on whether
|
||||
# any password providers have been enabled or not.
|
||||
matrix_synapse_password_providers_enabled: false
|
||||
|
||||
|
||||
# Enable this to activate the REST auth password provider module.
|
||||
# See: https://github.com/kamax-io/matrix-synapse-rest-auth
|
||||
matrix_synapse_ext_password_provider_rest_auth_enabled: false
|
||||
matrix_synapse_ext_password_provider_rest_auth_download_url: "https://raw.githubusercontent.com/kamax-io/matrix-synapse-rest-auth/v0.1.1/rest_auth_provider.py"
|
||||
matrix_synapse_ext_password_provider_rest_auth_endpoint: ""
|
||||
matrix_synapse_ext_password_provider_rest_auth_registration_enforce_lowercase: false
|
||||
matrix_synapse_ext_password_provider_rest_auth_registration_profile_name_autofill: true
|
||||
matrix_synapse_ext_password_provider_rest_auth_login_profile_name_autofill: false
|
||||
|
||||
# Enable this to activate the Shared Secret Auth password provider module.
|
||||
# See: https://github.com/devture/matrix-synapse-shared-secret-auth
|
||||
matrix_synapse_ext_password_provider_shared_secret_auth_enabled: false
|
||||
matrix_synapse_ext_password_provider_shared_secret_auth_download_url: "https://raw.githubusercontent.com/devture/matrix-synapse-shared-secret-auth/1.0.1/shared_secret_authenticator.py"
|
||||
matrix_synapse_ext_password_provider_shared_secret_auth_shared_secret: ""
|
||||
|
||||
# Enable this to activate LDAP password provider
|
||||
matrix_synapse_ext_password_provider_ldap_enabled: false
|
||||
matrix_synapse_ext_password_provider_ldap_uri: "ldap://ldap.mydomain.tld:389"
|
||||
matrix_synapse_ext_password_provider_ldap_start_tls: true
|
||||
matrix_synapse_ext_password_provider_ldap_base: ""
|
||||
matrix_synapse_ext_password_provider_ldap_attributes_uid: "uid"
|
||||
matrix_synapse_ext_password_provider_ldap_attributes_mail: "mail"
|
||||
matrix_synapse_ext_password_provider_ldap_attributes_name: "cn"
|
||||
matrix_synapse_ext_password_provider_ldap_bind_dn: ""
|
||||
matrix_synapse_ext_password_provider_ldap_bind_password: ""
|
||||
matrix_synapse_ext_password_provider_ldap_filter: ""
|
||||
|
||||
|
||||
# The defaults below cause a postgres server to be configured (running within a container).
|
||||
# Using an external server is possible by tweaking all of the parameters below.
|
||||
matrix_postgres_use_external: false
|
||||
matrix_postgres_connection_hostname: "matrix-postgres"
|
||||
matrix_postgres_connection_username: "synapse"
|
||||
matrix_postgres_connection_password: "synapse-password"
|
||||
matrix_postgres_db_name: "homeserver"
|
||||
|
||||
matrix_postgres_data_path: "{{ matrix_base_data_path }}/postgres"
|
||||
|
||||
matrix_postgres_docker_image_v9: "postgres:9.6.11-alpine"
|
||||
matrix_postgres_docker_image_v10: "postgres:10.6-alpine"
|
||||
matrix_postgres_docker_image_v11: "postgres:11.1-alpine"
|
||||
matrix_postgres_docker_image_latest: "{{ matrix_postgres_docker_image_v11 }}"
|
||||
|
||||
|
||||
matrix_coturn_docker_image: "instrumentisto/coturn:4.5.0.8"
|
||||
|
||||
matrix_coturn_base_path: "{{ matrix_base_data_path }}/coturn"
|
||||
matrix_coturn_config_path: "{{ matrix_coturn_base_path }}/turnserver.conf"
|
||||
|
||||
# A shared secret (between Synapse and Coturn) used for authentication.
|
||||
# You can put any string here, but generating a strong one is preferred (e.g. `pwgen -s 64 1`).
|
||||
matrix_coturn_turn_static_auth_secret: ""
|
||||
|
||||
# UDP port-range to use for TURN
|
||||
matrix_coturn_turn_udp_min_port: 49152
|
||||
matrix_coturn_turn_udp_max_port: 49172
|
||||
|
||||
matrix_coturn_turn_external_ip_address: "{{ ansible_host }}"
|
||||
|
||||
|
||||
matrix_s3_media_store_enabled: false
|
||||
matrix_s3_goofys_docker_image: "ewoutp/goofys:latest"
|
||||
matrix_s3_media_store_bucket_name: "your-bucket-name"
|
||||
matrix_s3_media_store_aws_access_key: "your-aws-access-key"
|
||||
matrix_s3_media_store_aws_secret_key: "your-aws-secret-key"
|
||||
matrix_s3_media_store_region: "eu-central-1"
|
||||
|
||||
|
||||
# By default, this playbook sets up a postfix mailer server (running in a container).
|
||||
# This is so that Matrix Synapse can send email reminders for unread messages.
|
||||
# Other services (like mxisd), however, also use that mailer to send emails through it.
|
||||
matrix_mailer_enabled: true
|
||||
|
||||
matrix_mailer_docker_image: "panubo/postfix:latest"
|
||||
|
||||
matrix_mailer_sender_address: "matrix@{{ hostname_identity }}"
|
||||
matrix_mailer_relay_use: false
|
||||
matrix_mailer_relay_host_name: "mail.example.com"
|
||||
matrix_mailer_relay_host_port: 587
|
||||
matrix_mailer_relay_auth: false
|
||||
matrix_mailer_relay_auth_username: ""
|
||||
matrix_mailer_relay_auth_password: ""
|
||||
|
||||
|
||||
# By default, this playbook installs the mxisd identity server on the same domain as Synapse (`hostname_matrix`).
|
||||
# If you wish to use the public identity servers (matrix.org, vector.im, riot.im) instead of your own,
|
||||
# you may wish to disable this.
|
||||
matrix_mxisd_enabled: true
|
||||
matrix_mxisd_docker_image: "kamax/mxisd:1.2.2"
|
||||
matrix_mxisd_base_path: "{{ matrix_base_data_path }}/mxisd"
|
||||
matrix_mxisd_config_path: "{{ matrix_mxisd_base_path }}/config"
|
||||
matrix_mxisd_data_path: "{{ matrix_mxisd_base_path }}/data"
|
||||
|
||||
# Your identity server is private by default.
|
||||
# To ensure maximum discovery, you can make your identity server
|
||||
# also forward lookups to the central matrix.org Identity server
|
||||
# (at the cost of potentially leaking all your contacts information).
|
||||
# Enabling this is discouraged. Learn more here: https://github.com/kamax-io/mxisd/blob/master/docs/features/identity.md#lookups
|
||||
matrix_mxisd_matrixorg_forwarding_enabled: false
|
||||
|
||||
# mxisd has serveral supported identity stores.
|
||||
# One of them (which we enable by default) is storing identities directly in Synapse's database.
|
||||
# Learn more here: https://github.com/kamax-matrix/mxisd/blob/master/docs/stores/synapse.md
|
||||
#
|
||||
# If you need to disable this in favor of some other store, you can toggle it to disabled here
|
||||
# and add your own mxisd configuration for the other store in `matrix_mxisd_configuration_extension_yaml`.
|
||||
matrix_mxisd_synapsesql_enabled: true
|
||||
matrix_mxisd_synapsesql_type: postgresql
|
||||
matrix_mxisd_synapsesql_connection: //{{ matrix_postgres_connection_hostname }}/{{ matrix_postgres_db_name }}?user={{ matrix_postgres_connection_username }}&password={{ matrix_postgres_connection_password }}
|
||||
|
||||
# Default mxisd configuration template which covers the generic use case.
|
||||
# You can customize it by controlling the various variables inside it.
|
||||
#
|
||||
# For a more advanced customization, you can extend the default (see `matrix_mxisd_configuration_extension_yaml`)
|
||||
# or completely replace this variable with your own template.
|
||||
matrix_mxisd_configuration_yaml: |
|
||||
matrix:
|
||||
domain: {{ hostname_identity }}
|
||||
|
||||
server:
|
||||
name: {{ hostname_matrix }}
|
||||
|
||||
key:
|
||||
path: /var/mxisd/sign.key
|
||||
|
||||
storage:
|
||||
provider:
|
||||
sqlite:
|
||||
database: /var/mxisd/mxisd.db
|
||||
|
||||
{% if matrix_mxisd_matrixorg_forwarding_enabled %}
|
||||
forward:
|
||||
servers: ['matrix-org']
|
||||
{% endif %}
|
||||
|
||||
threepid:
|
||||
medium:
|
||||
email:
|
||||
identity:
|
||||
from: {{ matrix_mailer_sender_address }}
|
||||
connectors:
|
||||
smtp:
|
||||
host: matrix-mailer
|
||||
port: 587
|
||||
tls: 0
|
||||
|
||||
synapseSql:
|
||||
enabled: {{ matrix_mxisd_synapsesql_enabled }}
|
||||
type: {{ matrix_mxisd_synapsesql_type }}
|
||||
connection: {{ matrix_mxisd_synapsesql_connection }}
|
||||
|
||||
matrix_mxisd_configuration_extension_yaml: |
|
||||
# Your custom YAML configuration for mxisd goes here.
|
||||
# This configuration extends the default starting configuration (`matrix_mxisd_configuration_yaml`).
|
||||
#
|
||||
# You can override individual variables from the default configuration, or introduce new ones.
|
||||
#
|
||||
# If you need something more special, you can take full control by
|
||||
# completely redefining `matrix_mxisd_configuration_yaml`.
|
||||
#
|
||||
# Example configuration extension follows:
|
||||
#
|
||||
# ldap:
|
||||
# enabled: true
|
||||
# connection:
|
||||
# host: ldapHostnameOrIp
|
||||
# tls: false
|
||||
# port: 389
|
||||
# baseDns: ['OU=Users,DC=example,DC=org']
|
||||
# bindDn: CN=My Mxisd User,OU=Users,DC=example,DC=org
|
||||
# bindPassword: TheUserPassword
|
||||
|
||||
# Doing `|from_yaml` when the extension contains nothing yields an empty string ("").
|
||||
# We need to ensure it's a dictionary or `|combine` (when building `matrix_mxisd_configuration`) will fail later.
|
||||
matrix_mxisd_configuration_extension: "{{ matrix_mxisd_configuration_extension_yaml|from_yaml if matrix_mxisd_configuration_extension_yaml|from_yaml else {} }}"
|
||||
|
||||
# Holds the final mxisd configuration (a combination of the default and its extension).
|
||||
# You most likely don't need to touch this variable. Instead, see `matrix_mxisd_configuration_yaml`.
|
||||
matrix_mxisd_configuration: "{{ matrix_mxisd_configuration_yaml|from_yaml|combine(matrix_mxisd_configuration_extension, recursive=True) }}"
|
||||
|
||||
|
||||
# Enable this to add support for matrix-corporal.
|
||||
# See: https://github.com/devture/matrix-corporal
|
||||
matrix_corporal_enabled: false
|
||||
|
||||
matrix_corporal_docker_image: "devture/matrix-corporal:1.2.2"
|
||||
matrix_corporal_base_path: "{{ matrix_base_data_path }}/corporal"
|
||||
matrix_corporal_config_dir_path: "{{ matrix_corporal_base_path }}/config"
|
||||
matrix_corporal_cache_dir_path: "{{ matrix_corporal_base_path }}/cache"
|
||||
matrix_corporal_var_dir_path: "{{ matrix_corporal_base_path }}/var"
|
||||
|
||||
matrix_corporal_matrix_timeout_milliseconds: 45000
|
||||
|
||||
matrix_corporal_reconciliation_retry_interval_milliseconds: 30000
|
||||
matrix_corporal_reconciliation_user_id_local_part: "matrix-corporal"
|
||||
|
||||
matrix_corporal_http_api_enabled: false
|
||||
matrix_corporal_http_api_auth_token: ""
|
||||
|
||||
# Matrix Corporal policy provider configuration (goes directly into the configuration's `PolicyProvider` value)
|
||||
matrix_corporal_policy_provider_config: ""
|
||||
|
||||
matrix_corporal_debug: false
|
||||
|
||||
|
||||
# By default, this playbook installs the Riot.IM web UI on the `hostname_riot` domain.
|
||||
# If you wish to connect to your Matrix server by other means,
|
||||
# you may wish to disable this.
|
||||
matrix_riot_web_enabled: true
|
||||
|
||||
matrix_riot_web_docker_image: "bubuntux/riot-web:v0.17.8"
|
||||
|
||||
matrix_riot_web_data_path: "{{ matrix_base_data_path }}/riot-web"
|
||||
|
||||
# Riot config.json customizations
|
||||
matrix_riot_web_disable_custom_urls: true
|
||||
matrix_riot_web_disable_guests: true
|
||||
matrix_riot_web_integrations_ui_url: "https://scalar.vector.im/"
|
||||
matrix_riot_web_integrations_rest_url: "https://scalar.vector.im/api"
|
||||
matrix_riot_web_integrations_widgets_urls: "https://scalar.vector.im/api"
|
||||
matrix_riot_web_integrations_jitsi_widget_url: "https://scalar.vector.im/api/widgets/jitsi.html"
|
||||
# Riot public room directory server(s)
|
||||
matrix_riot_web_roomdir_servers: ['matrix.org']
|
||||
matrix_riot_web_welcome_user_id: "@riot-bot:matrix.org"
|
||||
|
||||
|
||||
# Riot home.html customizations
|
||||
# Default home.html template file
|
||||
matrix_riot_web_homepage_template: "{{ role_path }}/templates/riot-web/home.html.j2"
|
||||
# Show general discussion about Matrix and Riot row
|
||||
matrix_riot_web_homepage_template_general: true
|
||||
# Show Matrix technical discussions row
|
||||
matrix_riot_web_homepage_template_technical: true
|
||||
# Show building services on Matrix row
|
||||
matrix_riot_web_homepage_template_building: true
|
||||
# Show contributing code to Matrix and Riot row
|
||||
matrix_riot_web_homepage_template_contributing: true
|
||||
|
||||
# Matrix mautrix is a Matrix <-> Telegram bridge
|
||||
# Enable telegram bridge
|
||||
matrix_mautrix_telegram_enabled: false
|
||||
|
||||
matrix_mautrix_telegram_docker_image: "tulir/mautrix-telegram:v0.4.0"
|
||||
|
||||
matrix_mautrix_telegram_base_path: "{{ matrix_base_data_path }}/mautrix-telegram"
|
||||
|
||||
# Get your own API keys at https://my.telegram.org/apps
|
||||
matrix_mautrix_telegram_api_id: YOUR_TELEGRAM_APP_ID
|
||||
matrix_mautrix_telegram_api_hash: YOUR_TELEGRAM_API_HASH
|
||||
# Mautrix telegram public endpoint to log in to telegram
|
||||
# Use an uuid so it's not easily discoverable
|
||||
matrix_mautrix_telegram_public_endpoint: "/{{ matrix_synapse_macaroon_secret_key | password_hash('sha512', 'telegram') | to_uuid }}"
|
||||
|
||||
|
||||
# Matrix mautrix is a Matrix <-> Whatsapp bridge
|
||||
# Enable whatsapp bridge
|
||||
matrix_mautrix_whatsapp_enabled: false
|
||||
|
||||
matrix_mautrix_whatsapp_docker_image: "tulir/mautrix-whatsapp:latest"
|
||||
|
||||
matrix_mautrix_whatsapp_base_path: "{{ matrix_base_data_path }}/mautrix-whatsapp"
|
||||
|
||||
|
||||
# By default, this playbook sets up its own nginx proxy server on port 80/443.
|
||||
# This is fine if you're dedicating the whole server to Matrix.
|
||||
# But in case that's not the case, you may wish to prevent that
|
||||
# and take care of proxying by yourself.
|
||||
matrix_nginx_proxy_enabled: true
|
||||
|
||||
matrix_nginx_proxy_docker_image: "nginx:1.15.8-alpine"
|
||||
|
||||
matrix_nginx_proxy_data_path: "{{ matrix_base_data_path }}/nginx-proxy"
|
||||
matrix_nginx_proxy_confd_path: "{{ matrix_nginx_proxy_data_path }}/conf.d"
|
||||
|
||||
# The addresses where the Matrix Client API is.
|
||||
# Certain extensions (like matrix-corporal) may override this in order to capture all traffic.
|
||||
matrix_nginx_proxy_matrix_client_api_addr_with_proxy_container: "matrix-synapse:8008"
|
||||
matrix_nginx_proxy_matrix_client_api_addr_sans_proxy_container: "localhost:8008"
|
||||
|
||||
# Specifies when to reload the matrix-nginx-proxy service so that
|
||||
# a new SSL certificate could go into effect.
|
||||
matrix_nginx_proxy_reload_cron_time_definition: "20 4 */5 * *"
|
||||
|
||||
# Specifies which SSL protocols to use when serving Riot and Synapse
|
||||
# Note TLSv1.3 is not yet available in dockerized nginx
|
||||
# See: https://github.com/nginxinc/docker-nginx/issues/190
|
||||
matrix_nginx_proxy_ssl_protocols: "TLSv1.1 TLSv1.2"
|
||||
|
||||
# By default, this playbook automatically retrieves and auto-renews
|
||||
# free SSL certificates from Let's Encrypt.
|
||||
#
|
||||
# The following retrieval methods are supported:
|
||||
# - "lets-encrypt" - the playbook obtains free SSL certificates from Let's Encrypt
|
||||
# - "self-signed" - the playbook generates and self-signs certificates
|
||||
# - "manually-managed" - lets you manage certificates by yourself (manually; see below)
|
||||
#
|
||||
# If you decide to manage certificates by yourself (`matrix_ssl_retrieval_method: manually-managed`),
|
||||
# you'd need to drop them into the directory specified by `matrix_ssl_config_dir_path`
|
||||
# obeying the following hierarchy:
|
||||
# - <matrix_ssl_config_dir_path>/live/<domain>/fullchain.pem
|
||||
# - <matrix_ssl_config_dir_path>/live/<domain>/privkey.pem
|
||||
# where <domain> refers to the domains that you need (usually `hostname_matrix` and `hostname_riot`).
|
||||
matrix_ssl_retrieval_method: "lets-encrypt"
|
||||
|
||||
# Controls whether to obtain production or staging certificates from Let's Encrypt.
|
||||
matrix_ssl_lets_encrypt_staging: false
|
||||
matrix_ssl_lets_encrypt_certbot_docker_image: "certbot/certbot:v0.30.0"
|
||||
matrix_ssl_lets_encrypt_certbot_standalone_http_port: 2402
|
||||
matrix_ssl_lets_encrypt_support_email: "{{ host_specific_matrix_ssl_lets_encrypt_support_email }}"
|
||||
|
||||
matrix_ssl_base_path: "{{ matrix_base_data_path }}/ssl"
|
||||
matrix_ssl_config_dir_path: "{{ matrix_ssl_base_path }}/config"
|
||||
matrix_ssl_log_dir_path: "{{ matrix_ssl_base_path }}/log"
|
||||
|
||||
# Variables to Control which parts of the role run.
|
||||
run_setup: true
|
||||
run_import_postgres: true
|
||||
run_upgrade_postgres: true
|
||||
run_start: true
|
||||
run_register_user: true
|
||||
run_import_sqlite_db: true
|
||||
run_import_media_store: true
|
||||
run_self_check: true
|
||||
@ -1,41 +0,0 @@
|
||||
---
|
||||
|
||||
- import_tasks: tasks/setup/main.yml
|
||||
when: run_setup
|
||||
|
||||
- import_tasks: tasks/import/import_postgres.yml
|
||||
tags:
|
||||
- import-postgres
|
||||
when: run_import_postgres
|
||||
|
||||
- import_tasks: tasks/upgrade_postgres.yml
|
||||
tags:
|
||||
- upgrade-postgres
|
||||
when: run_upgrade_postgres
|
||||
|
||||
- import_tasks: tasks/start.yml
|
||||
tags:
|
||||
- start
|
||||
when: run_start
|
||||
|
||||
- import_tasks: tasks/register_user.yml
|
||||
tags:
|
||||
- register-user
|
||||
when: run_register_user
|
||||
|
||||
- import_tasks: tasks/import/import_sqlite_db.yml
|
||||
tags:
|
||||
- import-sqlite-db
|
||||
when: run_import_sqlite_db
|
||||
|
||||
- import_tasks: tasks/import/import_media_store.yml
|
||||
tags:
|
||||
- import-media-store
|
||||
when: run_import_media_store
|
||||
|
||||
- import_tasks: tasks/self_check/main.yml
|
||||
delegate_to: 127.0.0.1
|
||||
become: false
|
||||
tags:
|
||||
- self-check
|
||||
when: run_self_check
|
||||
@ -1,18 +0,0 @@
|
||||
---
|
||||
|
||||
- import_tasks: tasks/self_check/self_check_dns.yml
|
||||
|
||||
- import_tasks: tasks/self_check/self_check_client_api.yml
|
||||
|
||||
- import_tasks: tasks/self_check/self_check_federation_api.yml
|
||||
|
||||
- import_tasks: tasks/self_check/self_check_riot_web.yml
|
||||
when: "matrix_riot_web_enabled"
|
||||
|
||||
- import_tasks: tasks/self_check/self_check_mxisd.yml
|
||||
when: "matrix_mxisd_enabled"
|
||||
|
||||
- import_tasks: tasks/self_check/self_check_well_known.yml
|
||||
|
||||
- import_tasks: tasks/self_check/self_check_corporal.yml
|
||||
when: "matrix_corporal_enabled"
|
||||
@ -1,77 +0,0 @@
|
||||
---
|
||||
|
||||
- import_tasks: tasks/setup/setup_sanity_check.yml
|
||||
tags:
|
||||
- always
|
||||
|
||||
- import_tasks: tasks/setup/setup_base.yml
|
||||
tags:
|
||||
- setup-all
|
||||
|
||||
- import_tasks: tasks/setup/setup_main.yml
|
||||
tags:
|
||||
- setup-all
|
||||
|
||||
- import_tasks: tasks/setup/ssl/main.yml
|
||||
tags:
|
||||
- setup-all
|
||||
- setup-ssl
|
||||
|
||||
- import_tasks: tasks/setup/setup_postgres.yml
|
||||
tags:
|
||||
- setup-all
|
||||
- setup-postgres
|
||||
|
||||
- import_tasks: tasks/setup/setup_goofys.yml
|
||||
tags:
|
||||
- setup-all
|
||||
- setup-goofys
|
||||
|
||||
- import_tasks: tasks/setup/setup_coturn.yml
|
||||
tags:
|
||||
- setup-all
|
||||
- setup-coturn
|
||||
|
||||
- import_tasks: tasks/setup/setup_mailer.yml
|
||||
tags:
|
||||
- setup-all
|
||||
- setup-mailer
|
||||
|
||||
- import_tasks: tasks/setup/setup_mxisd.yml
|
||||
tags:
|
||||
- setup-all
|
||||
- setup-mxisd
|
||||
|
||||
- import_tasks: tasks/setup/setup_corporal_overrides.yml
|
||||
tags:
|
||||
- always
|
||||
|
||||
- import_tasks: tasks/setup/setup_corporal.yml
|
||||
tags:
|
||||
- setup-all
|
||||
- setup-corporal
|
||||
|
||||
- import_tasks: tasks/setup/synapse/main.yml
|
||||
tags:
|
||||
- setup-all
|
||||
- setup-synapse
|
||||
- setup-coturn
|
||||
|
||||
- import_tasks: tasks/setup/setup_riot_web.yml
|
||||
tags:
|
||||
- setup-all
|
||||
- setup-riot-web
|
||||
|
||||
- import_tasks: tasks/setup/setup_well_known.yml
|
||||
tags:
|
||||
- setup-all
|
||||
- setup-mxisd
|
||||
- setup-synapse
|
||||
- setup-nginx-proxy
|
||||
- setup-well-known
|
||||
|
||||
- import_tasks: tasks/setup/setup_nginx_proxy.yml
|
||||
tags:
|
||||
- setup-all
|
||||
- setup-nginx-proxy
|
||||
- setup-well-known
|
||||
@ -1,11 +0,0 @@
|
||||
# These overrides run with the `always` tag,
|
||||
# because they're important not only for the `setup-corporal` tag, but for other tags too.
|
||||
#
|
||||
# We want an nginx-proxy rebuild (`--tags=setup-nginx-proxy`) to also go through here
|
||||
# and be affected by these overrides.
|
||||
|
||||
- name: Override configuration specifying where the Matrix Client API is
|
||||
set_fact:
|
||||
matrix_nginx_proxy_matrix_client_api_addr_with_proxy_container: "matrix-corporal:41080"
|
||||
matrix_nginx_proxy_matrix_client_api_addr_sans_proxy_container: "localhost:41080"
|
||||
when: "matrix_corporal_enabled"
|
||||
@ -1,8 +0,0 @@
|
||||
---
|
||||
|
||||
- name: Verify certificates
|
||||
include_tasks: "{{ role_path }}/tasks/setup/ssl/setup_ssl_manually_managed_verify_for_domain.yml"
|
||||
with_items: "{{ domains_requiring_certificates }}"
|
||||
loop_control:
|
||||
loop_var: domain_name
|
||||
when: "matrix_ssl_retrieval_method == 'manually-managed'"
|
||||
@ -1,11 +0,0 @@
|
||||
---
|
||||
|
||||
- import_tasks: tasks/setup/synapse/ext/setup_synapse_ext_rest_auth.yml
|
||||
|
||||
- import_tasks: tasks/setup/synapse/ext/setup_synapse_ext_shared_secret_auth.yml
|
||||
|
||||
- import_tasks: tasks/setup/synapse/ext/setup_synapse_ext_ldap_auth.yml
|
||||
|
||||
- import_tasks: tasks/setup/synapse/ext/setup_synapse_ext_mautrix_telegram.yml
|
||||
|
||||
- import_tasks: tasks/setup/synapse/ext/setup_synapse_ext_mautrix_whatsapp.yml
|
||||
@ -1,7 +0,0 @@
|
||||
---
|
||||
|
||||
- import_tasks: tasks/setup/synapse/setup_synapse_pre.yml
|
||||
|
||||
- import_tasks: tasks/setup/synapse/ext/main.yml
|
||||
|
||||
- import_tasks: tasks/setup/synapse/setup_synapse_main.yml
|
||||
@ -1,87 +0,0 @@
|
||||
---
|
||||
|
||||
- name: Ensure matrix-postgres autoruns and is restarted
|
||||
service:
|
||||
name: matrix-postgres
|
||||
enabled: yes
|
||||
state: restarted
|
||||
daemon_reload: yes
|
||||
when: "not matrix_postgres_use_external"
|
||||
|
||||
- name: Ensure matrix-goofys autoruns and is restarted
|
||||
service:
|
||||
name: matrix-goofys
|
||||
enabled: yes
|
||||
state: restarted
|
||||
daemon_reload: yes
|
||||
when: matrix_s3_media_store_enabled
|
||||
|
||||
- name: Ensure matrix-coturn autoruns and is restarted
|
||||
service:
|
||||
name: matrix-coturn
|
||||
enabled: yes
|
||||
state: restarted
|
||||
daemon_reload: yes
|
||||
|
||||
- name: Ensure matrix-mailer autoruns and is restarted
|
||||
service:
|
||||
name: matrix-mailer
|
||||
enabled: yes
|
||||
state: restarted
|
||||
daemon_reload: yes
|
||||
when: matrix_mailer_enabled
|
||||
|
||||
- name: Ensure matrix-mxisd autoruns and is restarted
|
||||
service:
|
||||
name: matrix-mxisd
|
||||
enabled: yes
|
||||
state: restarted
|
||||
daemon_reload: yes
|
||||
when: matrix_mxisd_enabled
|
||||
|
||||
- name: Ensure matrix-synapse autoruns and is restarted
|
||||
service:
|
||||
name: matrix-synapse
|
||||
enabled: yes
|
||||
state: restarted
|
||||
daemon_reload: yes
|
||||
|
||||
- name: Ensure matrix-riot-web autoruns and is restarted
|
||||
service:
|
||||
name: matrix-riot-web
|
||||
enabled: yes
|
||||
state: restarted
|
||||
daemon_reload: yes
|
||||
when: matrix_riot_web_enabled
|
||||
|
||||
- name: Ensure matrix-nginx-proxy autoruns and is restarted
|
||||
service:
|
||||
name: matrix-nginx-proxy
|
||||
enabled: yes
|
||||
state: restarted
|
||||
daemon_reload: yes
|
||||
when: matrix_nginx_proxy_enabled
|
||||
|
||||
- name: Ensure matrix-corporal autoruns and is restarted
|
||||
service:
|
||||
name: matrix-corporal
|
||||
enabled: yes
|
||||
state: restarted
|
||||
daemon_reload: yes
|
||||
when: matrix_corporal_enabled
|
||||
|
||||
- name: Ensure matrix-mautrix-telegram autoruns and is restarted
|
||||
service:
|
||||
name: matrix-mautrix-telegram
|
||||
enabled: yes
|
||||
state: restarted
|
||||
daemon_reload: yes
|
||||
when: matrix_mautrix_telegram_enabled
|
||||
|
||||
- name: Ensure matrix-mautrix-whatsapp autoruns and is restarted
|
||||
service:
|
||||
name: matrix-mautrix-whatsapp
|
||||
enabled: yes
|
||||
state: restarted
|
||||
daemon_reload: yes
|
||||
when: matrix_mautrix_whatsapp_enabled
|
||||
@ -0,0 +1,176 @@
|
||||
matrix_synapse_docker_image: "matrixdotorg/synapse:v0.34.1.1-py3"
|
||||
|
||||
matrix_synapse_base_path: "{{ matrix_base_data_path }}/synapse"
|
||||
matrix_synapse_config_dir_path: "{{ matrix_synapse_base_path }}/config"
|
||||
matrix_synapse_run_path: "{{ matrix_synapse_base_path }}/run"
|
||||
matrix_synapse_storage_path: "{{ matrix_synapse_base_path }}/storage"
|
||||
matrix_synapse_media_store_path: "{{ matrix_synapse_storage_path }}/media-store"
|
||||
matrix_synapse_ext_path: "{{ matrix_synapse_base_path }}/ext"
|
||||
|
||||
# Controls whether the Synapse container exposes the Client/Server API port (tcp/8008).
|
||||
# Normally, matrix-nginx-proxy is enabled and nginx can reach Synapse over the container network.
|
||||
# If matrix-nginx-proxy is not enabled, or you otherwise have a need for it, you can expose
|
||||
# the Client/Server API's port to the local host (`127.0.0.1:8008`).
|
||||
matrix_synapse_container_expose_client_server_api_port: "{{ not matrix_nginx_proxy_enabled }}"
|
||||
|
||||
matrix_synapse_in_container_python_packages_path: "/usr/local/lib/python3.6/site-packages"
|
||||
|
||||
# Specifies which template files to use when configuring Synapse.
|
||||
# If you'd like to have your own different configuration, feel free to copy and paste
|
||||
# the original files into your inventory (e.g. in `inventory/host_vars/<host>/`)
|
||||
# and then change the specific host's `vars.yaml` file like this:
|
||||
# matrix_synapse_template_synapse_homeserver: "{{ playbook_dir }}/inventory/host_vars/<host>/homeserver.yaml.j2"
|
||||
matrix_synapse_template_synapse_homeserver: "{{ role_path }}/templates/synapse/homeserver.yaml.j2"
|
||||
matrix_synapse_template_synapse_log: "{{ role_path }}/templates/synapse/synapse.log.config.j2"
|
||||
|
||||
matrix_synapse_macaroon_secret_key: ""
|
||||
matrix_synapse_registration_shared_secret: "{{ matrix_synapse_macaroon_secret_key }}"
|
||||
matrix_synapse_form_secret: "{{ matrix_synapse_macaroon_secret_key }}"
|
||||
|
||||
# These are the identity servers that would be trusted by Synapse if mxisd is NOT enabled
|
||||
matrix_synapse_id_servers_public: ['vector.im', 'matrix.org']
|
||||
|
||||
# These are the identity servers that would be trusted by Synapse if mxisd IS enabled
|
||||
matrix_synapse_id_servers_own: "['{{ hostname_matrix }}']"
|
||||
|
||||
# The final list of identity servers to use for Synapse.
|
||||
# The first one would also be used as riot-web's default identity server.
|
||||
matrix_synapse_trusted_third_party_id_servers: "{{ matrix_synapse_id_servers_own if matrix_mxisd_enabled else matrix_synapse_id_servers_public }}"
|
||||
|
||||
matrix_synapse_max_upload_size_mb: 10
|
||||
matrix_synapse_max_log_file_size_mb: 100
|
||||
matrix_synapse_max_log_files_count: 10
|
||||
|
||||
# Log levels
|
||||
# Possible options are defined here https://docs.python.org/3/library/logging.html#logging-levels
|
||||
# warning: setting log level to DEBUG will make synapse log sensitive information such
|
||||
# as access tokens
|
||||
matrix_synapse_log_level: "INFO"
|
||||
matrix_synapse_storage_sql_log_level: "INFO"
|
||||
matrix_synapse_root_log_level: "INFO"
|
||||
|
||||
# Rate limits
|
||||
matrix_synapse_rc_messages_per_second: 0.2
|
||||
matrix_synapse_rc_message_burst_count: 10.0
|
||||
|
||||
# Enable this to allow Synapse to report utilization statistics about your server to matrix.org
|
||||
# (things like number of users, number of messages sent, uptime, load, etc.)
|
||||
matrix_synapse_report_stats: false
|
||||
|
||||
# Controls whether the Matrix server will track presence status (online, offline, unavailable) for users.
|
||||
# If users participate in large rooms with many other servers,
|
||||
# disabling this will decrease server load significantly.
|
||||
matrix_synapse_use_presence: true
|
||||
|
||||
# Controls whether people with access to the homeserver can register by themselves.
|
||||
matrix_synapse_enable_registration: false
|
||||
|
||||
# Users who register on this homeserver will automatically be joined to these rooms.
|
||||
# Rooms are to be specified using addresses (e.g. `#address:example.com`)
|
||||
matrix_synapse_auto_join_rooms: []
|
||||
|
||||
# Controls whether auto-join rooms (`matrix_synapse_auto_join_rooms`) are to be created
|
||||
# automatically if they don't already exist.
|
||||
matrix_synapse_autocreate_auto_join_rooms: true
|
||||
|
||||
# Controls password-peppering for Matrix Synapse. Not to be changed after initial setup.
|
||||
matrix_synapse_password_config_pepper: ""
|
||||
|
||||
# Controls the number of events that Matrix Synapse caches in memory.
|
||||
matrix_synapse_event_cache_size: "100K"
|
||||
|
||||
# Controls cache sizes for Matrix Synapse via the SYNAPSE_CACHE_FACTOR environment variable.
|
||||
# Raise this to increase cache sizes or lower it to potentially lower memory use.
|
||||
# To learn more, see:
|
||||
# - https://github.com/matrix-org/synapse#help-synapse-eats-all-my-ram
|
||||
# - https://github.com/matrix-org/synapse/issues/3939
|
||||
matrix_synapse_cache_factor: 0.5
|
||||
|
||||
# Controls whether Matrix Synapse will federate at all.
|
||||
# Disable this to completely isolate your server from the rest of the Matrix network.
|
||||
matrix_synapse_federation_enabled: true
|
||||
|
||||
# A list of domain names that are allowed to federate with the given Matrix Synapse server.
|
||||
# An empty list value (`[]`) will also effectively stop federation, but if that's the desired
|
||||
# result, it's better to accomplish it by changing `matrix_synapse_federation_enabled`.
|
||||
matrix_synapse_federation_domain_whitelist: ~
|
||||
|
||||
# A list of additional "volumes" to mount in the container.
|
||||
# This list gets populated dynamically based on Synapse extensions that have been enabled.
|
||||
# Contains definition objects like this: `{"src": "/outside", "dst": "/inside", "options": "rw|ro|slave|.."}
|
||||
matrix_synapse_container_additional_volumes: []
|
||||
|
||||
# A list of additional loggers to register in synapse.log.config.
|
||||
# This list gets populated dynamically based on Synapse extensions that have been enabled.
|
||||
# Contains definition objects like this: `{"name": "..", "level": "DEBUG"}
|
||||
matrix_synapse_additional_loggers: []
|
||||
|
||||
# A list of service config files
|
||||
# This list gets populated dynamically based on Synapse extensions that have been enabled.
|
||||
# Contains fs paths
|
||||
matrix_synapse_app_service_config_files: []
|
||||
|
||||
# This is set dynamically during execution depending on whether
|
||||
# any password providers have been enabled or not.
|
||||
matrix_synapse_password_providers_enabled: false
|
||||
|
||||
|
||||
# Enable this to activate the REST auth password provider module.
|
||||
# See: https://github.com/kamax-io/matrix-synapse-rest-auth
|
||||
matrix_synapse_ext_password_provider_rest_auth_enabled: false
|
||||
matrix_synapse_ext_password_provider_rest_auth_download_url: "https://raw.githubusercontent.com/kamax-io/matrix-synapse-rest-auth/v0.1.1/rest_auth_provider.py"
|
||||
matrix_synapse_ext_password_provider_rest_auth_endpoint: ""
|
||||
matrix_synapse_ext_password_provider_rest_auth_registration_enforce_lowercase: false
|
||||
matrix_synapse_ext_password_provider_rest_auth_registration_profile_name_autofill: true
|
||||
matrix_synapse_ext_password_provider_rest_auth_login_profile_name_autofill: false
|
||||
|
||||
# Enable this to activate the Shared Secret Auth password provider module.
|
||||
# See: https://github.com/devture/matrix-synapse-shared-secret-auth
|
||||
matrix_synapse_ext_password_provider_shared_secret_auth_enabled: false
|
||||
matrix_synapse_ext_password_provider_shared_secret_auth_download_url: "https://raw.githubusercontent.com/devture/matrix-synapse-shared-secret-auth/1.0.1/shared_secret_authenticator.py"
|
||||
matrix_synapse_ext_password_provider_shared_secret_auth_shared_secret: ""
|
||||
|
||||
# Enable this to activate LDAP password provider
|
||||
matrix_synapse_ext_password_provider_ldap_enabled: false
|
||||
matrix_synapse_ext_password_provider_ldap_uri: "ldap://ldap.mydomain.tld:389"
|
||||
matrix_synapse_ext_password_provider_ldap_start_tls: true
|
||||
matrix_synapse_ext_password_provider_ldap_base: ""
|
||||
matrix_synapse_ext_password_provider_ldap_attributes_uid: "uid"
|
||||
matrix_synapse_ext_password_provider_ldap_attributes_mail: "mail"
|
||||
matrix_synapse_ext_password_provider_ldap_attributes_name: "cn"
|
||||
matrix_synapse_ext_password_provider_ldap_bind_dn: ""
|
||||
matrix_synapse_ext_password_provider_ldap_bind_password: ""
|
||||
matrix_synapse_ext_password_provider_ldap_filter: ""
|
||||
|
||||
|
||||
matrix_s3_media_store_enabled: false
|
||||
matrix_s3_goofys_docker_image: "ewoutp/goofys:latest"
|
||||
matrix_s3_media_store_bucket_name: "your-bucket-name"
|
||||
matrix_s3_media_store_aws_access_key: "your-aws-access-key"
|
||||
matrix_s3_media_store_aws_secret_key: "your-aws-secret-key"
|
||||
matrix_s3_media_store_region: "eu-central-1"
|
||||
|
||||
|
||||
# Matrix mautrix is a Matrix <-> Telegram bridge
|
||||
# Enable telegram bridge
|
||||
matrix_mautrix_telegram_enabled: false
|
||||
|
||||
matrix_mautrix_telegram_docker_image: "tulir/mautrix-telegram:v0.4.0"
|
||||
|
||||
matrix_mautrix_telegram_base_path: "{{ matrix_base_data_path }}/mautrix-telegram"
|
||||
|
||||
# Get your own API keys at https://my.telegram.org/apps
|
||||
matrix_mautrix_telegram_api_id: YOUR_TELEGRAM_APP_ID
|
||||
matrix_mautrix_telegram_api_hash: YOUR_TELEGRAM_API_HASH
|
||||
# Mautrix telegram public endpoint to log in to telegram
|
||||
# Use an uuid so it's not easily discoverable
|
||||
matrix_mautrix_telegram_public_endpoint: "/{{ matrix_synapse_macaroon_secret_key | password_hash('sha512', 'telegram') | to_uuid }}"
|
||||
|
||||
|
||||
# Matrix mautrix is a Matrix <-> Whatsapp bridge
|
||||
# Enable whatsapp bridge
|
||||
matrix_mautrix_whatsapp_enabled: false
|
||||
|
||||
matrix_mautrix_whatsapp_docker_image: "tulir/mautrix-whatsapp:latest"
|
||||
|
||||
matrix_mautrix_whatsapp_base_path: "{{ matrix_base_data_path }}/mautrix-whatsapp"
|
||||
@ -0,0 +1,5 @@
|
||||
---
|
||||
|
||||
- import_tasks: "{{ role_path }}/tasks/ext/mautrix-telegram/init.yml"
|
||||
|
||||
- import_tasks: "{{ role_path }}/tasks/ext/mautrix-whatsapp/init.yml"
|
||||
@ -0,0 +1,3 @@
|
||||
- set_fact:
|
||||
matrix_systemd_services_list: "{{ matrix_systemd_services_list + ['matrix-mautrix-telegram'] }}"
|
||||
when: matrix_mautrix_telegram_enabled
|
||||
@ -0,0 +1,3 @@
|
||||
- set_fact:
|
||||
matrix_systemd_services_list: "{{ matrix_systemd_services_list + ['matrix-mautrix-whatsapp'] }}"
|
||||
when: matrix_mautrix_whatsapp_enabled
|
||||
Some files were not shown because too many files have changed in this diff Show More
Loading…
Reference in new issue