bf2b540807
Harden Traefik security by accessing the Docker API through docker-socket-proxy
...
With these changes, we:
- install https://github.com/Tecnativa/docker-socket-proxy via the
https://github.com/devture/com.devture.ansible.role.container_socket_proxy Ansible role
- make Traefik access the Docker API via TCP by connecting to this
socket proxy
- .. which allows us to run the Traefik container with less privileges
(non-`root`, dropped capabilities)
2 years ago
10b5350370
Add Traefik support to Go-NEB bot
...
Completely untested.
2 years ago
f8966cd8da
Default etherpad_hostname to matrix_server_fqn_etherpad for backward compatibility
2 years ago
124fbeda04
Switch to using an external Etherpad role
...
This new role also adds native Traefik support and support for other
(non-`amd64`) architectures via self-building.
2 years ago
b0845984b3
Only enable Traefik certs dumper if the ACME certificate resolver for Traefik is enabled
...
If someone disables ACME, then they're using their own certificates
somehow. There's nothing to dump from an `acme.json` file.
2 years ago
f7149103e4
Remove matrix_playbook_traefik_certs_dumper_role_enabled in favor of just devture_traefik_certs_dumper_enabled
...
We don't need these 2 roughly-the-same settings related to the
traefik-certs-dumper role.
For Traefik, it makes sense, because it's a component used by the
various related playbooks and they could step onto each other's toes
if the role is enabled, but Traefik is disabled (in that case, uninstall
tasks will run).
As for Traefik certs dumper, the other related playbooks don't have it,
so there's no conflict. Even if they used it, each one would use its own
instance (different `devture_traefik_certs_dumper_identifier`), so there
wouldn't be a conflict and uninstall tasks can run without any danger.
2 years ago
b388a01ab7
Wire all certResolver variables to devture_traefik_certResolver_primary
...
This allows people wishing to change or unset the resolver,
to have a single variable which they can toggle.
Unsetting the resolver is useful for using your own certificates
(not coming from a certificate resolver).
2 years ago
9e7415afa2
Ensure Buscarron is part of the Postgres network
2 years ago
058a54fd05
Add native Traefik support to Dimension
2 years ago
b84f25309b
Add matrix_homeserver_container_network
2 years ago
d20ff688db
Add native Traefik support to Sygnal
2 years ago
348dd8e76b
Remove double space
2 years ago
725b2beed7
Add native Traefik support to Buscarron
2 years ago
bc5dda2b3a
Reorder some Buscarron default variables and fix some typos
...
Fixes a regression introduced in 0220c851e8
2 years ago
0220c851e8
Add multiple container networks support to Buscarron
2 years ago
233e253264
Add native Traefik support to rageshake
2 years ago
306679103b
Require self-building of rageshake for arm64
...
There are no arm64 images published.. yet
2 years ago
55f43dcc6d
Fixup matrix-rageshake section in group vars
2 years ago
40f037b36d
Add rageshake server
2 years ago
5e7f30a129
Fix appservice-discord/appservice-slack/appservice-webhooks port troubles with external reverse-proxy
...
Continuation of 6cda711
2 years ago
632026513e
Add matrix_synapse_uid, matrix_synapse_gid and matrix_synapse_username
2 years ago
990a6369e1
Switch to using an external Redis role
2 years ago
964aa0e84d
Switch to using an external Ntfy role
...
The newly extracted role also has native Traefik support,
so we no longer need to rely on `matrix-nginx-proxy` for
reverse-proxying to Ntfy.
The new role uses port `80` inside the container (not `8080`, like
before), because that's the default assumption of the officially
published container image. Using a custom port (like `8080`), means the
default healthcheck command (which hardcodes port `80`) doesn't work.
Instead of fiddling to override the healthcheck command, we've decided
to stick to the default port instead. This only affects the
inside-the-container port, not any external ports.
The new role also supports adding the network ranges of the container's
multiple additional networks as "exempt hosts". Previously, only one
network's address range was added to "exempt hosts".
2 years ago
e80b98c3ad
Do not mount SSL certificates into Coturn if TLS is disabled for it
2 years ago
bb7895678c
Fix typo
2 years ago
7c5826f1c3
Break dependency between matrix-prometheus-nginxlog-exporter and the Grafana role
...
Wiring happens via `group_vars/matrix_servers` now.
2 years ago
1006b8d899
Replace matrix-grafana with an external role
2 years ago
94124263a7
Add matrix_prometheus_container_network/matrix_prometheus_container_additional_networks
2 years ago
c85d48c45c
Remove Traefik labels for Hydrogen & Cinny from matrix-nginx-proxy
...
Related to 6a52be7987
2 years ago
f28e7ef9c7
Add (native) Traefik support to matrix-client-cinny
...
Previously, it had to go through matrix-nginx-proxy.
It's exposed to Traefik directly via container labels now
2 years ago
6a52be7987
Add (native) Traefik support to matrix-client-hydrogen
...
Previously, it had to go through matrix-nginx-proxy.
It's exposed to Traefik directly via container labels now
Serving at a path other than `/` doesn't work well yet.
2 years ago
e51e4eec09
Add (native) Traefik support to matrix-client-element
...
Previously, it had to go through matrix-nginx-proxy.
It's exposed to Traefik directly via container labels now
2 years ago
b2d8718233
Fix synapse-admin reverse-proxying regression for "playbook-managed-nginx"
...
Regression since 3d9aa8387e
2 years ago
6cda711c0b
Fix incorrect host_bind_port syntax (extra `:`) affecting certain deployments
...
Fixes https://github.com/spantaleev/matrix-docker-ansible-deploy/issues/2474
Seems like this affected all "own webserver" deployments, which required
port exposure.
`playbook-managed-traefik` and `playbook-managed-nginx` were not affected.
2 years ago
3d9aa8387e
Add (native) Traefik support to synapse-admin
...
Previously, it had to go through matrix-nginx-proxy.
It's exposed to Traefik directly via container labels now.
2 years ago
33b4f7031b
restore borg prefixes
2 years ago
266195ab45
Upgrade backup_borg (v1.2.3-1.7.5-1 -> v1.2.3-1.7.6-0)
...
Supersedes https://github.com/spantaleev/matrix-docker-ansible-deploy/pull/2472
2 years ago
23f7720247
Add missing backup_borg_base_path override
2 years ago
38904c08b0
Wire backup_borg_username
...
It's probably unnecessary, as this user is only used in the borg container
internally, but.. It doesn't hurt to set it to `matrix`.
2 years ago
78c35136b2
Replace matrix-backup-borg with an external role
2 years ago
972043cfaf
Fix trying to start devture-traefik when not necessarily enabled
...
Fixes https://github.com/spantaleev/matrix-docker-ansible-deploy/issues/2465
2 years ago
f1a1ce8a91
Merge pull request #2464 from spantaleev/traefik
...
Reverse-proxy configuration changes and initial Traefik support
2 years ago
b3f6436a0d
Do not enable the Traefik role when reverse-proxy = other-traefik-container
2 years ago
be471250dd
Move services that crash without hs connectivity to after proxy.
2 years ago
94be74e633
Improve traefik-certs-dumper defaults for other-traefik-container setups
...
We'd like to auto-enable traefik-certs-dumper for these setups.
`devture_traefik_certs_dumper_ssl_dir_path` will be empty though,
so the role's validation will point people in the right direction.
2 years ago
f37a7a21f1
Delay Postmoogle startup to help Traefik-based setups
2 years ago
8309a21303
Rename reverse proxy types and fix Hookshot http/https urlPrefix issue
2 years ago
97f65e8dff
Minor fixes to allow for Traefik without SSL
2 years ago
28d2eb593c
Add matrix_playbook_reverse_proxy_type variable which influences all other services
2 years ago
06ccd71edc
Merge branch 'master' into traefik
2 years ago
Slavi Pantaleev
Benjamin Kampmann
Aine
Catalan Lover