Slavi Pantaleev
6 years ago
parent
7e543f32d9
commit
ea43d46b70
@ -0,0 +1,15 @@
|
||||
# Setting up the REST authentication password provider module
|
||||
|
||||
The playbook can now install and configure [matrix-synapse-rest-auth](https://github.com/kamax-io/matrix-synapse-rest-auth) for you.
|
||||
|
||||
See that project's documentation to learn what it does and why it might be useful to you.
|
||||
|
||||
If you decide that you'd like to let this playbook install it for you, you need soem configuration like this:
|
||||
|
||||
```yaml
|
||||
matrix_synapse_ext_password_provider_rest_auth_enabled: true
|
||||
matrix_synapse_ext_password_provider_rest_auth_endpoint: "http://change.me.example.com:12345"
|
||||
matrix_synapse_ext_password_provider_rest_auth_registration_enforce_lowercase: false
|
||||
matrix_synapse_ext_password_provider_rest_auth_registration_profile_name_autofill: true
|
||||
matrix_synapse_ext_password_provider_rest_auth_login_profile_name_autofill: false
|
||||
```
|
||||
@ -1,99 +1,7 @@
|
||||
---
|
||||
|
||||
- name: Fail if Macaroon key is missing
|
||||
fail:
|
||||
msg: "You need to set a secret in the matrix_synapse_macaroon_secret_key variable"
|
||||
when: "matrix_synapse_macaroon_secret_key == ''"
|
||||
- include: tasks/setup_synapse_pre.yml
|
||||
|
||||
- name: Ensure Matrix Synapse paths exist
|
||||
file:
|
||||
path: "{{ item }}"
|
||||
state: directory
|
||||
mode: 0750
|
||||
owner: "{{ matrix_user_username }}"
|
||||
group: "{{ matrix_user_username }}"
|
||||
with_items:
|
||||
- "{{ matrix_synapse_config_dir_path }}"
|
||||
- "{{ matrix_synapse_run_path }}"
|
||||
- "{{ matrix_synapse_storage_path }}"
|
||||
# We handle matrix_synapse_media_store_path below, not here,
|
||||
# because if it's using S3fs and it's already mounted (from before),
|
||||
# trying to chown/chmod it here will cause trouble.
|
||||
- include: tasks/setup_synapse_ext.yml
|
||||
|
||||
# This will throw a Permission Denied error if already mounted using fuse
|
||||
- name: Check Matrix Synapse media store path
|
||||
stat: path="{{ matrix_synapse_media_store_path }}"
|
||||
register: local_path_media_store_stat
|
||||
ignore_errors: yes
|
||||
|
||||
# This is separate and conditional, to ensure we don't execute it
|
||||
# if the path already exists or we failed to check, because it's mounted using fuse.
|
||||
- name: Ensure Matrix media store path exists
|
||||
file:
|
||||
path: "{{ matrix_synapse_media_store_path }}"
|
||||
state: directory
|
||||
mode: 0750
|
||||
owner: "{{ matrix_user_username }}"
|
||||
group: "{{ matrix_user_username }}"
|
||||
when: "not local_path_media_store_stat.failed and not local_path_media_store_stat.stat.exists"
|
||||
|
||||
- name: Ensure Matrix Docker image is pulled
|
||||
docker_image:
|
||||
name: "{{ matrix_docker_image_synapse }}"
|
||||
|
||||
- name: Check if a Matrix Synapse configuration exists
|
||||
stat:
|
||||
path: "{{ matrix_synapse_config_dir_path }}/homeserver.yaml"
|
||||
register: matrix_synapse_config_stat
|
||||
|
||||
# We do this mostly so that the keys would get generated.
|
||||
# We'll replace the rest of the configuration with our own templates below.
|
||||
- name: Generate initial Matrix config
|
||||
docker_container:
|
||||
name: matrix-config
|
||||
image: "{{ matrix_docker_image_synapse }}"
|
||||
detach: no
|
||||
cleanup: yes
|
||||
command: generate
|
||||
env:
|
||||
SYNAPSE_CONFIG_PATH: "/data/homeserver.yaml"
|
||||
SYNAPSE_SERVER_NAME: "{{ hostname_matrix }}"
|
||||
SYNAPSE_REPORT_STATS: "no"
|
||||
user: "{{ matrix_user_uid }}:{{ matrix_user_gid }}"
|
||||
volumes:
|
||||
- "{{ matrix_synapse_config_dir_path }}:/data"
|
||||
when: "not matrix_synapse_config_stat.stat.exists"
|
||||
|
||||
- name: Ensure Matrix homeserver config installed
|
||||
template:
|
||||
src: "{{ matrix_synapse_template_synapse_homeserver }}"
|
||||
dest: "{{ matrix_synapse_config_dir_path }}/homeserver.yaml"
|
||||
mode: 0644
|
||||
|
||||
- name: Ensure Matrix log config installed
|
||||
template:
|
||||
src: "{{ matrix_synapse_template_synapse_log }}"
|
||||
dest: "{{ matrix_synapse_config_dir_path }}/{{ hostname_matrix }}.log.config"
|
||||
mode: 0644
|
||||
|
||||
- name: Ensure matrix-synapse.service installed
|
||||
template:
|
||||
src: "{{ role_path }}/templates/systemd/matrix-synapse.service.j2"
|
||||
dest: "/etc/systemd/system/matrix-synapse.service"
|
||||
mode: 0644
|
||||
|
||||
- name: Ensure matrix-synapse-register-user script created
|
||||
template:
|
||||
src: "{{ role_path }}/templates/usr-local-bin/matrix-synapse-register-user.j2"
|
||||
dest: "/usr/local/bin/matrix-synapse-register-user"
|
||||
mode: 0750
|
||||
|
||||
- name: Allow access to Matrix ports in firewalld
|
||||
firewalld:
|
||||
port: "{{ item }}"
|
||||
state: enabled
|
||||
immediate: yes
|
||||
permanent: yes
|
||||
with_items:
|
||||
- '8448/tcp' # Matrix federation
|
||||
when: ansible_os_family == 'RedHat'
|
||||
- include: tasks/setup_synapse_main.yml
|
||||
|
||||
@ -0,0 +1,3 @@
|
||||
---
|
||||
|
||||
- include: tasks/setup_synapse_ext_rest_auth.yml
|
||||
@ -0,0 +1,45 @@
|
||||
---
|
||||
|
||||
#
|
||||
# Tasks related to setting up matrix-synapse-rest-auth
|
||||
#
|
||||
|
||||
- name: Download matrix-synapse-rest-auth
|
||||
get_url:
|
||||
url: "{{ matrix_synapse_ext_password_provider_rest_auth_download_url }}"
|
||||
dest: "{{ matrix_synapse_ext_path }}/rest_auth_provider.py"
|
||||
mode: 0440
|
||||
owner: "{{ matrix_user_username }}"
|
||||
group: "{{ matrix_user_username }}"
|
||||
|
||||
- set_fact:
|
||||
matrix_synapse_password_providers_enabled: true
|
||||
when: "matrix_synapse_ext_password_provider_rest_auth_enabled"
|
||||
|
||||
- set_fact:
|
||||
matrix_synapse_container_additional_volumes: >
|
||||
{{ matrix_synapse_container_additional_volumes }}
|
||||
+
|
||||
{{ [{'src': '{{ matrix_synapse_ext_path }}/rest_auth_provider.py', 'dst': '/usr/local/lib/python2.7/site-packages/rest_auth_provider.py', 'options': 'ro'}] }}
|
||||
when: "matrix_synapse_ext_password_provider_rest_auth_enabled"
|
||||
|
||||
- set_fact:
|
||||
matrix_synapse_additional_loggers: >
|
||||
{{ matrix_synapse_additional_loggers }}
|
||||
+
|
||||
{{ [{'name': 'rest_auth_provider', 'level': 'DEBUG'}] }}
|
||||
when: "matrix_synapse_ext_password_provider_rest_auth_enabled"
|
||||
|
||||
- debug: var="matrix_synapse_container_additional_volumes"
|
||||
|
||||
- debug: var="matrix_synapse_additional_loggers"
|
||||
|
||||
#
|
||||
# Tasks related to getting rid of matrix-synapse-rest-auth (if it was previously enabled)
|
||||
#
|
||||
|
||||
- name: Ensure matrix-synapse-rest-auth doesn't exist
|
||||
file:
|
||||
path: "{{ matrix_synapse_ext_path }}/rest_auth_provider.py"
|
||||
state: absent
|
||||
when: "not matrix_synapse_ext_password_provider_rest_auth_enabled"
|
||||
@ -0,0 +1,84 @@
|
||||
---
|
||||
|
||||
- name: Fail if Macaroon key is missing
|
||||
fail:
|
||||
msg: "You need to set a secret in the matrix_synapse_macaroon_secret_key variable"
|
||||
when: "matrix_synapse_macaroon_secret_key == ''"
|
||||
|
||||
# This will throw a Permission Denied error if already mounted using fuse
|
||||
- name: Check Matrix Synapse media store path
|
||||
stat: path="{{ matrix_synapse_media_store_path }}"
|
||||
register: local_path_media_store_stat
|
||||
ignore_errors: yes
|
||||
|
||||
# This is separate and conditional, to ensure we don't execute it
|
||||
# if the path already exists or we failed to check, because it's mounted using fuse.
|
||||
- name: Ensure Matrix media store path exists
|
||||
file:
|
||||
path: "{{ matrix_synapse_media_store_path }}"
|
||||
state: directory
|
||||
mode: 0750
|
||||
owner: "{{ matrix_user_username }}"
|
||||
group: "{{ matrix_user_username }}"
|
||||
when: "not local_path_media_store_stat.failed and not local_path_media_store_stat.stat.exists"
|
||||
|
||||
- name: Ensure Matrix Docker image is pulled
|
||||
docker_image:
|
||||
name: "{{ matrix_docker_image_synapse }}"
|
||||
|
||||
- name: Check if a Matrix Synapse configuration exists
|
||||
stat:
|
||||
path: "{{ matrix_synapse_config_dir_path }}/homeserver.yaml"
|
||||
register: matrix_synapse_config_stat
|
||||
|
||||
# We do this mostly so that the keys would get generated.
|
||||
# We'll replace the rest of the configuration with our own templates below.
|
||||
- name: Generate initial Matrix config
|
||||
docker_container:
|
||||
name: matrix-config
|
||||
image: "{{ matrix_docker_image_synapse }}"
|
||||
detach: no
|
||||
cleanup: yes
|
||||
command: generate
|
||||
env:
|
||||
SYNAPSE_CONFIG_PATH: "/data/homeserver.yaml"
|
||||
SYNAPSE_SERVER_NAME: "{{ hostname_matrix }}"
|
||||
SYNAPSE_REPORT_STATS: "no"
|
||||
user: "{{ matrix_user_uid }}:{{ matrix_user_gid }}"
|
||||
volumes:
|
||||
- "{{ matrix_synapse_config_dir_path }}:/data"
|
||||
when: "not matrix_synapse_config_stat.stat.exists"
|
||||
|
||||
- name: Ensure Matrix homeserver config installed
|
||||
template:
|
||||
src: "{{ matrix_synapse_template_synapse_homeserver }}"
|
||||
dest: "{{ matrix_synapse_config_dir_path }}/homeserver.yaml"
|
||||
mode: 0644
|
||||
|
||||
- name: Ensure Matrix log config installed
|
||||
template:
|
||||
src: "{{ matrix_synapse_template_synapse_log }}"
|
||||
dest: "{{ matrix_synapse_config_dir_path }}/{{ hostname_matrix }}.log.config"
|
||||
mode: 0644
|
||||
|
||||
- name: Ensure matrix-synapse.service installed
|
||||
template:
|
||||
src: "{{ role_path }}/templates/systemd/matrix-synapse.service.j2"
|
||||
dest: "/etc/systemd/system/matrix-synapse.service"
|
||||
mode: 0644
|
||||
|
||||
- name: Ensure matrix-synapse-register-user script created
|
||||
template:
|
||||
src: "{{ role_path }}/templates/usr-local-bin/matrix-synapse-register-user.j2"
|
||||
dest: "/usr/local/bin/matrix-synapse-register-user"
|
||||
mode: 0750
|
||||
|
||||
- name: Allow access to Matrix ports in firewalld
|
||||
firewalld:
|
||||
port: "{{ item }}"
|
||||
state: enabled
|
||||
immediate: yes
|
||||
permanent: yes
|
||||
with_items:
|
||||
- '8448/tcp' # Matrix federation
|
||||
when: ansible_os_family == 'RedHat'
|
||||
@ -0,0 +1,17 @@
|
||||
---
|
||||
|
||||
- name: Ensure Matrix Synapse paths exist
|
||||
file:
|
||||
path: "{{ item }}"
|
||||
state: directory
|
||||
mode: 0750
|
||||
owner: "{{ matrix_user_username }}"
|
||||
group: "{{ matrix_user_username }}"
|
||||
with_items:
|
||||
- "{{ matrix_synapse_config_dir_path }}"
|
||||
- "{{ matrix_synapse_run_path }}"
|
||||
- "{{ matrix_synapse_storage_path }}"
|
||||
- "{{ matrix_synapse_ext_path }}"
|
||||
# We handle matrix_synapse_media_store_path elsewhere (in setup_synapse.yml),
|
||||
# because if it's using S3fs and it's already mounted (from before),
|
||||
# trying to chown/chmod it here will cause trouble.
|
||||
Loading…
Reference in new issue