matrix-docker-ansible-deploy

8 Commits

Include renames

Author	SHA1	Message	Date
Slavi Pantaleev	5cc69ca7eb	Add whoami-based sync worker routing for user-level sticky sessions This adds a new routing mechanism for sync workers that resolves access tokens to usernames via Synapse's whoami endpoint, enabling true user-level sticky routing regardless of which device or token is used. Previously, sticky routing relied on parsing the username from native Synapse tokens (`syt_<base64 username>_...`), which only works with native Synapse auth and provides device-level stickiness at best. This new approach works with any auth system (native Synapse, MAS, etc.) because Synapse handles token validation internally. Implementation uses nginx's auth_request module with an njs script because: - The whoami lookup requires an async HTTP subrequest (ngx.fetch) - js_set handlers must return synchronously and don't support async operations - auth_request allows the async lookup to complete, then captures the result via response headers into nginx variables The njs script: - Extracts access tokens from Authorization header or query parameter - Calls Synapse's whoami endpoint to resolve token -> username - Caches results in a shared memory zone to minimize latency - Returns the username via a `X-User-Identifier` header The username is then used by nginx's upstream hash directive for consistent worker selection. This leverages nginx's built-in health checking and failover.	2026-02-04 04:06:59 +02:00
Aine	cbbf20004c	replace access log ip anonymization with vars to control access logs Lock Threads / action (push) Has been cancelled Matrix CI / yamllint (push) Has been cancelled Matrix CI / ansible-lint (push) Has been cancelled Matrix CI / Run pre-commit (push) Has been cancelled	2025-07-30 14:40:48 +01:00
Aine	e8c7091c3f	update nginx configs for cinny, hydrogen, and synapse reverse proxy companion with ip anonymization	2025-07-30 12:59:42 +01:00
Slavi Pantaleev	51ab9ed9ff	Adjust `lstrip_blocks` to use a `bool` value for compatibility with ansible-core>=2.19.0 Related to https://github.com/spantaleev/matrix-docker-ansible-deploy/issues/4445	2025-07-26 17:58:12 +03:00
Slavi Pantaleev	58a8f79d95	Remove gzip support from synapse-reverse-proxy-companion gzipping certain responses is known to cause problems with QR code logins. Fixes https://github.com/spantaleev/matrix-docker-ansible-deploy/issues/3749 Gzipping at the synapse-reverse-proxy-companion level and not at the level of the outer-most reverse-proxy (Traefik) also sounds non-ideal. This change only affects setups powered by Synapse workers. Non-worker setups (and setups powered by other homeservers) were not having their requests go through synapse-reverse-proxy-companion anyway, so this change does not affect them. Future patches may enable response compression support at the Traefik level for all setups.	2024-11-13 21:48:18 +02:00
Slavi Pantaleev	a78a749f75	Define matrix_synapse_reverse_proxy_companion_access_log_syslog_integration_server_port in the role defaults and make the tag configurable	2024-01-13 16:43:46 +02:00
ikkemaniac GitHub ikkemaniac	8ebf18a885	add prometheus-nginxlog-exporter role (#2315 ) * add prometheus-nginxlog-exporter role * Rename matrix_prometheus_nginxlog_exporter_container_url to matrix_prometheus_nginxlog_exporter_container_hostname * avoid referencing variables from other roles, handover info using group_vars/matrix_servers * fix: stop service when uninstalling fix: typo move available arch's into a var fix: text * fix: prometheus enabled condition Co-authored-by: ikkemaniac <ikkemaniac@localhost>	2022-12-07 16:58:36 +02:00
Slavi Pantaleev	e9e84341a9	Reverse-proxy to Synapse via matrix-synapse-reverse-proxy-companion Fixes https://github.com/spantaleev/matrix-docker-ansible-deploy/issues/2090	2022-11-20 16:43:33 +02:00