From d20ff688dbc31d40f5a4616ee84bafce5a25d1da Mon Sep 17 00:00:00 2001 From: Slavi Pantaleev Date: Sun, 26 Feb 2023 11:03:42 +0200 Subject: [PATCH] Add native Traefik support to Sygnal --- docs/configuring-playbook-sygnal.md | 31 ++++++++-- group_vars/matrix_servers | 13 +++- .../matrix-nginx-proxy/defaults/main.yml | 5 -- .../matrix-nginx-proxy/templates/labels.j2 | 11 ---- roles/custom/matrix-sygnal/defaults/main.yml | 59 +++++++++++++++++-- .../tasks/{setup_install.yml => install.yml} | 35 +++++++---- roles/custom/matrix-sygnal/tasks/main.yml | 4 +- .../{setup_uninstall.yml => uninstall.yml} | 0 .../matrix-sygnal/tasks/validate_config.yml | 32 +++++++++- .../custom/matrix-sygnal/templates/labels.j2 | 45 ++++++++++++++ .../systemd/matrix-sygnal.service.j2 | 14 ++++- 11 files changed, 206 insertions(+), 43 deletions(-) rename roles/custom/matrix-sygnal/tasks/{setup_install.yml => install.yml} (78%) rename roles/custom/matrix-sygnal/tasks/{setup_uninstall.yml => uninstall.yml} (100%) create mode 100644 roles/custom/matrix-sygnal/templates/labels.j2 diff --git a/docs/configuring-playbook-sygnal.md b/docs/configuring-playbook-sygnal.md index 1a344530..786498c6 100644 --- a/docs/configuring-playbook-sygnal.md +++ b/docs/configuring-playbook-sygnal.md @@ -11,6 +11,31 @@ See the project's [documentation](https://github.com/matrix-org/sygnal) to learn This optional playbook component is only useful to people who develop/build their own Matrix client applications themselves. +## Decide on a domain and path + +By default, Sygnal is configured to use its own dedicated domain (`sygnal.DOMAIN`) and requires you to [adjust your DNS records](#adjusting-dns-records). + +You can override the domain and path like this: + +```yaml +# Switch to the domain used for Matrix services (`matrix.DOMAIN`), +# so we won't need to add additional DNS records for Sygnal. +matrix_sygnal_hostname: "{{ matrix_server_fqn_matrix }}" + +# Expose under the /sygnal subpath +matrix_sygnal_path_prefix: /sygnal +``` + +**NOTE**: When using `matrix-nginx-proxy` instead of Traefik, you won't be able to override the path prefix. You can only override the domain, but that needs to happen using another variable: `matrix_server_fqn_sygnal` (e.g. `matrix_server_fqn_sygnal: "push.{{ matrix_domain }}"`). + + +## Adjusting DNS records + +Once you've decided on the domain and path, **you may need to adjust your DNS** records to point the Sygnal domain to the Matrix server. + +If you've decided to reuse the `matrix.` domain, you won't need to do any extra DNS configuration. + + ## Adjusting the playbook configuration Add the following configuration to your `inventory/host_vars/matrix.DOMAIN/vars.yml` file (adapt to your needs): @@ -55,9 +80,7 @@ To do that, the above example configuration: ## Installing -Don't forget to add `sygnal.` to DNS as described in [Configuring DNS](configuring-dns.md) before running the playbook. - -After configuring the playbook, run the [installation](installing.md) command again: +After configuring the playbook and potentially [adjusting your DNS records](#adjusting-dns-records), run the [installation](installing.md) command: ``` ansible-playbook -i inventory/hosts setup.yml --tags=setup-all,start @@ -66,6 +89,6 @@ ansible-playbook -i inventory/hosts setup.yml --tags=setup-all,start ## Usage -To make use of your Sygnal installation, you'd need to build your own Matrix client application, which uses the same API keys (for [GCM/FCM](https://firebase.google.com/docs/cloud-messaging/)) and certificates (for [APNS](https://developer.apple.com/notifications/)) and is also pointed to `https://sygnal.DOMAIN` as the configured push server. +To make use of your Sygnal installation, you'd need to build your own Matrix client application, which uses the same API keys (for [GCM/FCM](https://firebase.google.com/docs/cloud-messaging/)) and certificates (for [APNS](https://developer.apple.com/notifications/)) and is to your Sygnal URL endpoint (e.g. `https://sygnal.DOMAIN`). Refer to Sygnal's [Notes for application developers](https://github.com/matrix-org/sygnal/blob/master/docs/applications.md) document. diff --git a/group_vars/matrix_servers b/group_vars/matrix_servers index 7f378380..359c6e3f 100755 --- a/group_vars/matrix_servers +++ b/group_vars/matrix_servers @@ -2443,7 +2443,7 @@ matrix_nginx_proxy_proxy_jitsi_enabled: "{{ matrix_jitsi_enabled }}" matrix_nginx_proxy_proxy_jitsi_manage_wellknown: "{{ matrix_jitsi_require_well_known }}" matrix_nginx_proxy_proxy_grafana_enabled: "{{ grafana_enabled and matrix_playbook_reverse_proxy_type in ['playbook-managed-nginx', 'other-nginx-non-container'] }}" -matrix_nginx_proxy_proxy_sygnal_enabled: "{{ matrix_sygnal_enabled }}" +matrix_nginx_proxy_proxy_sygnal_enabled: "{{ matrix_sygnal_enabled and matrix_playbook_reverse_proxy_type in ['playbook-managed-nginx', 'other-nginx-non-container'] }}" matrix_nginx_proxy_proxy_ntfy_enabled: "{{ ntfy_enabled and matrix_playbook_reverse_proxy_type in ['playbook-managed-nginx', 'other-nginx-non-container'] }}" matrix_nginx_proxy_container_labels_traefik_enabled: "{{ matrix_playbook_traefik_labels_enabled }}" @@ -2455,7 +2455,6 @@ matrix_nginx_proxy_container_labels_traefik_proxy_dimension_enabled: "{{ matrix_ matrix_nginx_proxy_container_labels_traefik_proxy_etherpad_enabled: "{{ matrix_etherpad_enabled and matrix_etherpad_mode == 'standalone' }}" matrix_nginx_proxy_container_labels_traefik_proxy_bot_go_neb_enabled: "{{ matrix_bot_go_neb_enabled }}" matrix_nginx_proxy_container_labels_traefik_proxy_jitsi_enabled: "{{ matrix_jitsi_enabled }}" -matrix_nginx_proxy_container_labels_traefik_proxy_sygnal_enabled: "{{ matrix_sygnal_enabled }}" matrix_nginx_proxy_proxy_matrix_corporal_api_enabled: "{{ matrix_corporal_enabled and matrix_corporal_http_api_enabled }}" matrix_nginx_proxy_proxy_matrix_corporal_api_addr_with_container: "matrix-corporal:41081" @@ -2931,8 +2930,18 @@ matrix_sygnal_enabled: false # If someone instals Prometheus via the playbook, they most likely wish to monitor Sygnal. matrix_sygnal_metrics_prometheus_enabled: "{{ matrix_prometheus_enabled }}" +matrix_sygnal_hostname: "{{ matrix_server_fqn_sygnal }}" + +matrix_sygnal_container_network: "{{ matrix_nginx_proxy_container_network if matrix_playbook_reverse_proxy_type == 'playbook-managed-nginx' else 'matrix-sygnal' }}" + +matrix_sygnal_container_additional_networks: "{{ [matrix_playbook_reverse_proxyable_services_additional_network] if matrix_playbook_reverse_proxyable_services_additional_network else [] }}" + matrix_sygnal_container_http_host_bind_port: "{{ (matrix_playbook_service_host_bind_interface_prefix ~ '6000') if matrix_playbook_service_host_bind_interface_prefix else '' }}" +matrix_sygnal_container_labels_traefik_enabled: "{{ matrix_playbook_traefik_labels_enabled }}" +matrix_sygnal_container_labels_traefik_docker_network: "{{ matrix_playbook_reverse_proxyable_services_additional_network }}" +matrix_sygnal_container_labels_traefik_entrypoints: "{{ devture_traefik_entrypoint_primary }}" + ###################################################################### # # /matrix-sygnal diff --git a/roles/custom/matrix-nginx-proxy/defaults/main.yml b/roles/custom/matrix-nginx-proxy/defaults/main.yml index 158a1b2b..a098a098 100644 --- a/roles/custom/matrix-nginx-proxy/defaults/main.yml +++ b/roles/custom/matrix-nginx-proxy/defaults/main.yml @@ -81,11 +81,6 @@ matrix_nginx_proxy_container_labels_traefik_proxy_jitsi_hostname: "{{ matrix_ser matrix_nginx_proxy_container_labels_traefik_proxy_jitsi_tls: "{{ matrix_nginx_proxy_container_labels_traefik_entrypoints != 'web' }}" matrix_nginx_proxy_container_labels_traefik_proxy_jitsi_rule: "Host(`{{ matrix_nginx_proxy_container_labels_traefik_proxy_jitsi_hostname }}`)" -matrix_nginx_proxy_container_labels_traefik_proxy_sygnal_enabled: false -matrix_nginx_proxy_container_labels_traefik_proxy_sygnal_hostname: "{{ matrix_server_fqn_sygnal }}" -matrix_nginx_proxy_container_labels_traefik_proxy_sygnal_tls: "{{ matrix_nginx_proxy_container_labels_traefik_entrypoints != 'web' }}" -matrix_nginx_proxy_container_labels_traefik_proxy_sygnal_rule: "Host(`{{ matrix_nginx_proxy_container_labels_traefik_proxy_sygnal_hostname }}`)" - # matrix_nginx_proxy_container_labels_additional_labels contains a multiline string with additional labels to add to the container label file. # See `../templates/labels.j2` for details. # diff --git a/roles/custom/matrix-nginx-proxy/templates/labels.j2 b/roles/custom/matrix-nginx-proxy/templates/labels.j2 index d177d2fb..6afa6029 100644 --- a/roles/custom/matrix-nginx-proxy/templates/labels.j2 +++ b/roles/custom/matrix-nginx-proxy/templates/labels.j2 @@ -86,17 +86,6 @@ traefik.http.routers.matrix-nginx-proxy-jitsi.tls.certResolver={{ matrix_nginx_p traefik.http.routers.matrix-nginx-proxy-jitsi.entrypoints={{ matrix_nginx_proxy_container_labels_traefik_entrypoints }} {% endif %} -{% if matrix_nginx_proxy_container_labels_traefik_proxy_sygnal_enabled %} -# Sygnal -traefik.http.routers.matrix-nginx-proxy-sygnal.rule={{ matrix_nginx_proxy_container_labels_traefik_proxy_sygnal_rule }} -traefik.http.routers.matrix-nginx-proxy-sygnal.service=matrix-nginx-proxy-web -traefik.http.routers.matrix-nginx-proxy-sygnal.tls={{ matrix_nginx_proxy_container_labels_traefik_proxy_sygnal_tls | to_json }} -{% if matrix_nginx_proxy_container_labels_traefik_proxy_sygnal_tls %} -traefik.http.routers.matrix-nginx-proxy-sygnal.tls.certResolver={{ matrix_nginx_proxy_container_labels_traefik_tls_certResolver }} -{% endif %} -traefik.http.routers.matrix-nginx-proxy-sygnal.entrypoints={{ matrix_nginx_proxy_container_labels_traefik_entrypoints }} -{% endif %} - traefik.http.services.matrix-nginx-proxy-web.loadbalancer.server.port=8080 diff --git a/roles/custom/matrix-sygnal/defaults/main.yml b/roles/custom/matrix-sygnal/defaults/main.yml index 1268d602..f3c1df4e 100644 --- a/roles/custom/matrix-sygnal/defaults/main.yml +++ b/roles/custom/matrix-sygnal/defaults/main.yml @@ -1,28 +1,77 @@ --- + # Sygnal is a reference Push Gateway for Matrix. # To make use of it for delivering push notificatins, you'll need to develop/build your own Matrix app. # Project source code URL: https://github.com/matrix-org/sygnal -matrix_sygnal_enabled: false +matrix_sygnal_enabled: true + +# The hostname at which Sygnal is served. +matrix_sygnal_hostname: '' + +# The path at which Sygnal is exposed. +# This value must either be `/` or not end with a slash (e.g. `/sygnal`). +matrix_sygnal_path_prefix: / + +matrix_sygnal_version: v0.12.0 matrix_sygnal_base_path: "{{ matrix_base_data_path }}/sygnal" matrix_sygnal_config_path: "{{ matrix_sygnal_base_path }}/config" matrix_sygnal_data_path: "{{ matrix_sygnal_base_path }}/data" -matrix_sygnal_version: v0.12.0 -matrix_sygnal_docker_image: "{{ matrix_container_global_registry_prefix }}matrixdotorg/sygnal:{{ matrix_sygnal_version }}" -matrix_sygnal_docker_image_force_pull: "{{ matrix_sygnal_docker_image.endswith(':latest') }}" - # List of systemd services that matrix-sygnal.service depends on. matrix_sygnal_systemd_required_services_list: ['docker.service'] # List of systemd services that matrix-sygnal.service wants matrix_sygnal_systemd_wanted_services_list: [] +matrix_sygnal_docker_image: "{{ matrix_sygnal_docker_image_registry_prefix }}matrixdotorg/sygnal:{{ matrix_sygnal_docker_image_tag }}" +matrix_sygnal_docker_image_tag: "{{ matrix_sygnal_version }}" +matrix_sygnal_docker_image_registry_prefix: "{{ matrix_container_global_registry_prefix }}" +matrix_sygnal_docker_image_force_pull: "{{ matrix_sygnal_docker_image.endswith(':latest') }}" + +# The base container network. It will be auto-created by this role if it doesn't exist already. +matrix_sygnal_container_network: "{{ matrix_sygnal_identifier }}" + +# A list of additional container networks that the container would be connected to. +# The role does not create these networks, so make sure they already exist. +# Use this to expose this container to another reverse proxy, which runs in a different container network. +matrix_sygnal_container_additional_networks: [] + # Controls whether the matrix-sygnal container exposes its HTTP port (tcp/6000 in the container). # # Takes an ":" or "" value (e.g. "127.0.0.1:6000"), or empty string to not expose. matrix_sygnal_container_http_host_bind_port: '' +# matrix_sygnal_container_labels_traefik_enabled controls whether labels to assist a Traefik reverse-proxy will be attached to the container. +# See `../templates/labels.j2` for details. +# +# To inject your own other container labels, see `matrix_sygnal_container_labels_additional_labels`. +matrix_sygnal_container_labels_traefik_enabled: true +matrix_sygnal_container_labels_traefik_docker_network: "{{ matrix_sygnal_container_network }}" +matrix_sygnal_container_labels_traefik_hostname: "{{ matrix_sygnal_hostname }}" +# The path prefix must either be `/` or not end with a slash (e.g. `/sygnal`). +matrix_sygnal_container_labels_traefik_path_prefix: "{{ matrix_sygnal_path_prefix }}" +matrix_sygnal_container_labels_traefik_rule: "Host(`{{ matrix_sygnal_container_labels_traefik_hostname }}`){% if matrix_sygnal_container_labels_traefik_path_prefix != '/' %} && PathPrefix(`{{ matrix_sygnal_container_labels_traefik_path_prefix }}`){% endif %}" +matrix_sygnal_container_labels_traefik_priority: 0 +matrix_sygnal_container_labels_traefik_entrypoints: web-secure +matrix_sygnal_container_labels_traefik_tls: "{{ matrix_sygnal_container_labels_traefik_entrypoints != 'web' }}" +matrix_sygnal_container_labels_traefik_tls_certResolver: default # noqa var-naming + +# Controls which additional headers to attach to all HTTP responses. +# To add your own headers, use `matrix_sygnal_container_labels_traefik_additional_response_headers_custom` +matrix_sygnal_container_labels_traefik_additional_response_headers: "{{ matrix_sygnal_container_labels_traefik_additional_response_headers_auto | combine(matrix_sygnal_container_labels_traefik_additional_response_headers_custom) }}" +matrix_sygnal_container_labels_traefik_additional_response_headers_auto: {} +matrix_sygnal_container_labels_traefik_additional_response_headers_custom: {} + +# matrix_sygnal_container_labels_additional_labels contains a multiline string with additional labels to add to the container label file. +# See `../templates/labels.j2` for details. +# +# Example: +# matrix_sygnal_container_labels_additional_labels: | +# my.label=1 +# another.label="here" +matrix_sygnal_container_labels_additional_labels: '' + # A list of extra arguments to pass to the container matrix_sygnal_container_extra_arguments: [] diff --git a/roles/custom/matrix-sygnal/tasks/setup_install.yml b/roles/custom/matrix-sygnal/tasks/install.yml similarity index 78% rename from roles/custom/matrix-sygnal/tasks/setup_install.yml rename to roles/custom/matrix-sygnal/tasks/install.yml index 7c9caf38..7ee75a94 100644 --- a/roles/custom/matrix-sygnal/tasks/setup_install.yml +++ b/roles/custom/matrix-sygnal/tasks/install.yml @@ -1,16 +1,5 @@ --- -- name: Ensure Sygnal image is pulled - community.docker.docker_image: - name: "{{ matrix_sygnal_docker_image }}" - source: "{{ 'pull' if ansible_version.major > 2 or ansible_version.minor > 7 else omit }}" - force_source: "{{ matrix_sygnal_docker_image_force_pull if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}" - force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else matrix_sygnal_docker_image_force_pull }}" - register: result - retries: "{{ devture_playbook_help_container_retries_count }}" - delay: "{{ devture_playbook_help_container_retries_delay }}" - until: result is not failed - - name: Ensure Sygnal paths exists ansible.builtin.file: path: "{{ item }}" @@ -31,6 +20,30 @@ owner: "{{ matrix_user_username }}" group: "{{ matrix_user_groupname }}" +- name: Ensure Sygnal labels installed + ansible.builtin.template: + src: "{{ role_path }}/templates/labels.j2" + dest: "{{ matrix_sygnal_base_path }}/labels" + mode: 0640 + owner: "{{ matrix_user_username }}" + group: "{{ matrix_user_groupname }}" + +- name: Ensure Sygnal image is pulled + community.docker.docker_image: + name: "{{ matrix_sygnal_docker_image }}" + source: "{{ 'pull' if ansible_version.major > 2 or ansible_version.minor > 7 else omit }}" + force_source: "{{ matrix_sygnal_docker_image_force_pull if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}" + force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else matrix_sygnal_docker_image_force_pull }}" + register: result + retries: "{{ devture_playbook_help_container_retries_count }}" + delay: "{{ devture_playbook_help_container_retries_delay }}" + until: result is not failed + +- name: Ensure Sygnal container network is created + community.general.docker_network: + name: "{{ matrix_sygnal_container_network }}" + driver: bridge + - name: Ensure matrix-sygnal.service installed ansible.builtin.template: src: "{{ role_path }}/templates/systemd/matrix-sygnal.service.j2" diff --git a/roles/custom/matrix-sygnal/tasks/main.yml b/roles/custom/matrix-sygnal/tasks/main.yml index ed801526..ba4cb876 100644 --- a/roles/custom/matrix-sygnal/tasks/main.yml +++ b/roles/custom/matrix-sygnal/tasks/main.yml @@ -5,7 +5,7 @@ ansible.builtin.include_tasks: "{{ role_path }}/tasks/validate_config.yml" - when: matrix_sygnal_enabled | bool - ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_install.yml" + ansible.builtin.include_tasks: "{{ role_path }}/tasks/install.yml" tags: - setup-all - setup-sygnal @@ -14,7 +14,7 @@ - block: - when: not matrix_sygnal_enabled | bool - ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_uninstall.yml" + ansible.builtin.include_tasks: "{{ role_path }}/tasks/uninstall.yml" tags: - setup-all - setup-sygnal diff --git a/roles/custom/matrix-sygnal/tasks/setup_uninstall.yml b/roles/custom/matrix-sygnal/tasks/uninstall.yml similarity index 100% rename from roles/custom/matrix-sygnal/tasks/setup_uninstall.yml rename to roles/custom/matrix-sygnal/tasks/uninstall.yml diff --git a/roles/custom/matrix-sygnal/tasks/validate_config.yml b/roles/custom/matrix-sygnal/tasks/validate_config.yml index 277bd1b2..1cdf2038 100644 --- a/roles/custom/matrix-sygnal/tasks/validate_config.yml +++ b/roles/custom/matrix-sygnal/tasks/validate_config.yml @@ -1,7 +1,37 @@ --- +- name: Fail if required Sygnal settings not defined + ansible.builtin.fail: + msg: > + You need to define a required configuration setting (`{{ item }}`). + when: "vars[item] == ''" + with_items: + - matrix_sygnal_hostname + - matrix_sygnal_path_prefix + - matrix_sygnal_container_network + +- when: matrix_sygnal_container_labels_traefik_enabled | bool + block: + - name: Fail if required Sygnal Traefik settings not defined + ansible.builtin.fail: + msg: >- + You need to define a required configuration setting (`{{ item }}`). + when: "vars[item] == ''" + with_items: + - matrix_sygnal_container_labels_traefik_hostname + - matrix_sygnal_container_labels_traefik_path_prefix + + # We ensure it doesn't end with a slash, because we handle both (slash and no-slash). + # Knowing that `matrix_sygnal_container_labels_traefik_path_prefix` does not end with a slash + # ensures we know how to set these routes up without having to do "does it end with a slash" checks elsewhere. + - name: Fail if matrix_sygnal_container_labels_traefik_path_prefix ends with a slash + ansible.builtin.fail: + msg: >- + matrix_sygnal_container_labels_traefik_path_prefix (`{{ matrix_sygnal_container_labels_traefik_path_prefix }}`) must either be `/` or not end with a slash (e.g. `/sygnal`). + when: "matrix_sygnal_container_labels_traefik_path_prefix != '/' and matrix_sygnal_container_labels_traefik_path_prefix[-1] == '/'" + - name: Fail if no Sygnal apps defined ansible.builtin.fail: msg: >- Enabling Sygnal requires that you specify at least one app in `matrix_sygnal_apps` - when: "matrix_sygnal_enabled and matrix_sygnal_apps | length == 0" + when: "matrix_sygnal_apps | length == 0" diff --git a/roles/custom/matrix-sygnal/templates/labels.j2 b/roles/custom/matrix-sygnal/templates/labels.j2 new file mode 100644 index 00000000..96480589 --- /dev/null +++ b/roles/custom/matrix-sygnal/templates/labels.j2 @@ -0,0 +1,45 @@ +{% if matrix_sygnal_container_labels_traefik_enabled %} +traefik.enable=true + +{% if matrix_sygnal_container_labels_traefik_docker_network %} +traefik.docker.network={{ matrix_sygnal_container_labels_traefik_docker_network }} +{% endif %} + +{% set middlewares = [] %} + +{% if matrix_sygnal_container_labels_traefik_path_prefix != '/' %} +traefik.http.middlewares.matrix-sygnal-slashless-redirect.redirectregex.regex=({{ matrix_sygnal_container_labels_traefik_path_prefix | quote }})$ +traefik.http.middlewares.matrix-sygnal-slashless-redirect.redirectregex.replacement=${1}/ +{% set middlewares = middlewares + ['matrix-sygnal-slashless-redirect'] %} +{% endif %} + +{% if matrix_sygnal_container_labels_traefik_path_prefix != '/' %} +traefik.http.middlewares.matrix-sygnal-strip-prefix.stripprefix.prefixes={{ matrix_sygnal_container_labels_traefik_path_prefix }} +{% set middlewares = middlewares + ['matrix-sygnal-strip-prefix'] %} +{% endif %} + +{% if matrix_sygnal_container_labels_traefik_additional_response_headers.keys() | length > 0 %} +{% for name, value in matrix_sygnal_container_labels_traefik_additional_response_headers.items() %} +traefik.http.middlewares.matrix-sygnal-add-headers.headers.customresponseheaders.{{ name }}={{ value }} +{% endfor %} +{% set middlewares = middlewares + ['matrix-sygnal-add-headers'] %} +{% endif %} + +traefik.http.routers.matrix-sygnal.rule={{ matrix_sygnal_container_labels_traefik_rule }} +{% if matrix_sygnal_container_labels_traefik_priority | int > 0 %} +traefik.http.routers.matrix-sygnal.priority={{ matrix_sygnal_container_labels_traefik_priority }} +{% endif %} +traefik.http.routers.matrix-sygnal.service=matrix-sygnal +{% if middlewares | length > 0 %} +traefik.http.routers.matrix-sygnal.middlewares={{ middlewares | join(',') }} +{% endif %} +traefik.http.routers.matrix-sygnal.entrypoints={{ matrix_sygnal_container_labels_traefik_entrypoints }} +traefik.http.routers.matrix-sygnal.tls={{ matrix_sygnal_container_labels_traefik_tls | to_json }} +{% if matrix_sygnal_container_labels_traefik_tls %} +traefik.http.routers.matrix-sygnal.tls.certResolver={{ matrix_sygnal_container_labels_traefik_tls_certResolver }} +{% endif %} + +traefik.http.services.matrix-sygnal.loadbalancer.server.port=6000 +{% endif %} + +{{ matrix_sygnal_container_labels_additional_labels }} diff --git a/roles/custom/matrix-sygnal/templates/systemd/matrix-sygnal.service.j2 b/roles/custom/matrix-sygnal/templates/systemd/matrix-sygnal.service.j2 index 646314df..49b513cd 100644 --- a/roles/custom/matrix-sygnal/templates/systemd/matrix-sygnal.service.j2 +++ b/roles/custom/matrix-sygnal/templates/systemd/matrix-sygnal.service.j2 @@ -16,15 +16,18 @@ Environment="HOME={{ devture_systemd_docker_base_systemd_unit_home_path }}" ExecStartPre=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} kill matrix-sygnal 2>/dev/null || true' ExecStartPre=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} rm matrix-sygnal 2>/dev/null || true' -ExecStart={{ devture_systemd_docker_base_host_command_docker }} run --rm --name matrix-sygnal \ +ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} create \ + --rm \ + --name=matrix-sygnal \ --log-driver=none \ --user={{ matrix_user_uid }}:{{ matrix_user_gid }} \ --cap-drop=ALL \ --env=SYGNAL_CONF=/config/sygnal.yaml \ - --network={{ matrix_docker_network }} \ + --network={{ matrix_sygnal_container_network }} \ {% if matrix_sygnal_container_http_host_bind_port %} -p {{ matrix_sygnal_container_http_host_bind_port }}:6000 \ {% endif %} + --label-file={{ matrix_sygnal_base_path }}/labels \ --mount type=bind,src={{ matrix_sygnal_config_path }},dst=/config \ --mount type=bind,src={{ matrix_sygnal_data_path }},dst=/data \ {% for arg in matrix_sygnal_container_extra_arguments %} @@ -32,8 +35,15 @@ ExecStart={{ devture_systemd_docker_base_host_command_docker }} run --rm --name {% endfor %} {{ matrix_sygnal_docker_image }} +{% for network in matrix_sygnal_container_additional_networks %} +ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} network connect {{ network }} matrix-sygnal +{% endfor %} + +ExecStart={{ devture_systemd_docker_base_host_command_docker }} start --attach matrix-sygnal + ExecStop=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} kill matrix-sygnal 2>/dev/null || true' ExecStop=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} rm matrix-sygnal 2>/dev/null || true' + Restart=always RestartSec=30 SyslogIdentifier=matrix-sygnal