mirror of
https://github.com/spantaleev/matrix-docker-ansible-deploy.git
synced 2026-07-02 21:42:21 +03:00
Compare commits
10 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 Aine
|
f16c8dfcbf | ||
 renovate[bot]
|
eb393b4eb8 | ||
 Slavi Pantaleev
|
92c204394a | ||
|
Slavi Pantaleev
|
a1015b6df2 | ||
|
Slavi Pantaleev
|
2a581cce62 | ||
|
Slavi Pantaleev
|
c21a80d232 | ||
 Suguru Hirahara
|
baa740fcda | ||
 Suguru Hirahara
|
66d66f67f8 | ||
|
renovate[bot]
|
c1a8ca6397 | ||
|
Suguru Hirahara
|
4310fb83c1 |
+34
-2
@@ -1,3 +1,37 @@
|
||||
# 2026-02-08
|
||||
|
||||
## Zulip bridge has been removed from the playbook
|
||||
|
||||
Zulip bridge has been removed from the playbook, as it doesn't work, and the maintainer seems to have abandoned it. See [this issue](https://github.com/GearKite/MatrixZulipBridge/issues/23) for more context.
|
||||
|
||||
## Switched to faster secret derivation for service passwords
|
||||
|
||||
We've switched the method used for deriving service passwords (database passwords, appservice tokens, etc.) from the `matrix_homeserver_generic_secret_key` variable.
|
||||
|
||||
The old method used `password_hash('sha512', rounds=655555)` (655,555 rounds of SHA-512 hashing), which was designed for protecting low-entropy human passwords against brute-force attacks. For deriving secrets from an already high-entropy secret key, this many rounds provide no additional security - the secret key's entropy is what protects the derived passwords, not the computational cost of hashing.
|
||||
|
||||
The new method uses a single-round `hash('sha512')` with a unique salt per service. This is equally secure for this use case (SHA-512 remains preimage-resistant; brute-forcing a high-entropy key is infeasible regardless of rounds), while being dramatically faster.
|
||||
|
||||
On a fast mini PC, evaluating `postgres_managed_databases` (which references multiple database passwords) dropped from **~10.7 seconds to ~0.6 seconds**. The Postgres role evaluates this variable multiple times during a run, so the cumulative savings are significant. All other roles that reference derived passwords also benefit.
|
||||
|
||||
**What this means for users**: all derived service passwords (database passwords, appservice tokens, etc.) will change on the next playbook run. The main/superuser database password (`postgres_connection_password`) is not affected, as it is hardcoded in inventory variables rather than derived via hashing. All services will receive their new passwords as part of the same run, so this should be a seamless, non-user-impacting change.
|
||||
|
||||
## (BC Break) Dynamic DNS role has been relocated and variable names need adjustments
|
||||
|
||||
The role for Dynamic DNS has been relocated to the [mother-of-all-self-hosting](https://github.com/mother-of-all-self-hosting) organization.
|
||||
|
||||
Along with the relocation, the `matrix_dynamic_dns_` prefix on its variable names has been renamed to `ddclient_`, so you need to adjust your `vars.yml` configuration.
|
||||
|
||||
As always, the playbook would let you know about this and point out any variables you may have missed.
|
||||
|
||||
## ma1sd has been removed from the playbook
|
||||
|
||||
[ma1sd](./docs/configuring-playbook-ma1sd.md) has been removed from the playbook, as it has been unmaintained for a long time.
|
||||
|
||||
The playbook will let you know if you're using any `matrix_ma1sd_*` variables. You'll need to remove them from `vars.yml` and potentially [uninstall the component manually](./docs/configuring-playbook-ma1sd.md#uninstalling-the-component-manually).
|
||||
|
||||
Please note that some of the functions can be achieved with other components. For example, if you wish to implement LDAP integration, you might as well check out [the LDAP provider module for Synapse](./docs/configuring-playbook-ldap-auth.md) instead.
|
||||
|
||||
# 2026-02-07
|
||||
|
||||
## (BC Break) Cinny role has been relocated and variable names need adjustments
|
||||
@@ -12,8 +46,6 @@ You need to do the following replacement:
|
||||
|
||||
As always, the playbook would let you know about this and point out any variables you may have missed.
|
||||
|
||||
# 2026-02-06
|
||||
|
||||
## The Sliding Sync proxy has been removed from the playbook
|
||||
|
||||
The [Sliding Sync proxy](./docs/configuring-playbook-sliding-sync-proxy.md) has been removed from the playbook, as it's been replaced with a different method (called Simplified Sliding Sync) integrated to newer homeservers by default (**Conduit** homeserver from version `0.6.0` or **Synapse** from version `1.114`).
|
||||
|
||||
@@ -79,7 +79,6 @@ Services that run on the server to make the various parts of your installation w
|
||||
| [Traefik](https://doc.traefik.io/traefik/) | ✅ | Web server, listening on ports 80, 443 and 8448 - standing in front of all the other services. [Using your own webserver](docs/configuring-playbook-own-webserver.md) is also possible. | [Link](docs/configuring-playbook-traefik.md) |
|
||||
| [Let's Encrypt](https://letsencrypt.org/) | ✅ | Free SSL certificate, which secures the connection to all components | [Link](docs/configuring-playbook-ssl-certificates.md) |
|
||||
| [Exim](https://www.exim.org/) | ✅ | Mail server, through which all Matrix services send outgoing email (can be configured to relay through another SMTP server) | [Link](docs/configuring-playbook-email.md) |
|
||||
| [ma1sd](https://github.com/ma1uta/ma1sd) | ❌ | Matrix Identity Server | [Link](docs/configuring-playbook-ma1sd.md)
|
||||
| [ddclient](https://github.com/linuxserver/docker-ddclient) | ❌ | Dynamic DNS | [Link](docs/configuring-playbook-dynamic-dns.md) |
|
||||
| [LiveKit Server](https://github.com/livekit/livekit) | ❌ | WebRTC server for audio/video calls | [Link](docs/configuring-playbook-livekit-server.md) |
|
||||
| [Livekit JWT Service](https://github.com/livekit/livekit-jwt-service) | ❌ | JWT service for integrating [Element Call](./configuring-playbook-element-call.md) with [LiveKit Server](./configuring-playbook-livekit-server.md) | [Link](docs/configuring-playbook-livekit-jwt-service.md) |
|
||||
@@ -134,7 +133,6 @@ Bridges can be used to connect your Matrix installation with third-party communi
|
||||
| [matrix-sms-bridge](https://github.com/benkuly/matrix-sms-bridge) | ❌ | Bridge to SMS | [Link](docs/configuring-playbook-bridge-matrix-bridge-sms.md) |
|
||||
| [matrix-steam-bridge](https://github.com/jasonlaguidice/matrix-steam-bridge) | ❌ | Bridge to [Steam](https://steampowered.com/) | [Link](docs/configuring-playbook-bridge-steam.md) |
|
||||
| [matrix-wechat](https://github.com/duo/matrix-wechat) | ❌ | Bridge to [WeChat](https://www.wechat.com/) | [Link](docs/configuring-playbook-bridge-wechat.md) |
|
||||
| [MatrixZulipBridge](https://github.com/GearKite/MatrixZulipBridge) | ❌ | Puppeting appservice bridge for [Zulip](https://zulip.com/) | [Link](docs/configuring-playbook-bridge-zulip.md) |
|
||||
| [Heisenbridge](https://github.com/hifi/heisenbridge) | ❌ | Bouncer-style bridge to [IRC](https://wikipedia.org/wiki/Internet_Relay_Chat) | [Link](docs/configuring-playbook-bridge-heisenbridge.md) |
|
||||
| [mx-puppet-groupme](https://gitlab.com/xangelix-pub/matrix/mx-puppet-groupme) | ❌ | Bridge to [GroupMe](https://groupme.com/) | [Link](docs/configuring-playbook-bridge-mx-puppet-groupme.md) |
|
||||
| [mx-puppet-steam](https://codeberg.org/icewind/mx-puppet-steam) | ❌ | Bridge to [Steam](https://steamapp.com/) | [Link](docs/configuring-playbook-bridge-mx-puppet-steam.md) |
|
||||
|
||||
@@ -1,83 +0,0 @@
|
||||
<!--
|
||||
SPDX-FileCopyrightText: 2021 - 2024 Slavi Pantaleev
|
||||
SPDX-FileCopyrightText: 2021 Toni Spets
|
||||
SPDX-FileCopyrightText: 2024 - 2025 Suguru Hirahara
|
||||
|
||||
SPDX-License-Identifier: AGPL-3.0-or-later
|
||||
-->
|
||||
|
||||
# Setting up a Zulip bridge (optional)
|
||||
|
||||
The playbook can install and configure [MatrixZulipBridge](https://github.com/GearKite/MatrixZulipBridge) for you.
|
||||
|
||||
See the project's [documentation](https://github.com/GearKite/MatrixZulipBridge/blob/main/README.md) to learn what it does and why it might be useful to you.
|
||||
|
||||
## Adjusting DNS records (optional)
|
||||
|
||||
By default, this playbook installs the Zulip bridge on the `matrix.` subdomain, at the `/zulip` path (https://matrix.example.com/zulip). This makes it easy to install it, because it **doesn't require additional DNS records to be set up**. If that's okay, you can skip this section.
|
||||
|
||||
If you wish to adjust it, see the section [below](#adjusting-the-zulip-bridge-url-optional) for details about DNS configuration.
|
||||
|
||||
## Adjusting the playbook configuration
|
||||
|
||||
To enable the Zulip bridge, add the following configuration to your `inventory/host_vars/matrix.example.com/vars.yml` file:
|
||||
|
||||
```yaml
|
||||
matrix_zulip_bridge_enabled: true
|
||||
|
||||
# Uncomment to add one or more admins to this bridge:
|
||||
#
|
||||
# matrix_zulip_bridge_owner:
|
||||
# - '@yourAdminAccount:{{ matrix_domain }}'
|
||||
#
|
||||
# … unless you've made yourself an admin of all bots/bridges like this:
|
||||
#
|
||||
# matrix_admin: '@yourAdminAccount:{{ matrix_domain }}'
|
||||
```
|
||||
|
||||
### Adjusting the Zulip bridge URL (optional)
|
||||
|
||||
By tweaking the `matrix_zulip_bridge_hostname` and `matrix_zulip_bridge_path_prefix` variables, you can easily make the service available at a **different hostname and/or path** than the default one.
|
||||
|
||||
Example additional configuration for your `vars.yml` file:
|
||||
|
||||
```yaml
|
||||
# Change the default hostname and path prefix
|
||||
matrix_zulip_bridge_hostname: zulip.example.com
|
||||
matrix_zulip_bridge_path_prefix: /
|
||||
```
|
||||
|
||||
If you've changed the default hostname, you may need to create a CNAME record for the Zulip bridge domain (`zulip.example.com`), which targets `matrix.example.com`.
|
||||
|
||||
When setting, replace `example.com` with your own.
|
||||
|
||||
### Extending the configuration
|
||||
|
||||
There are some additional things you may wish to configure about the bridge.
|
||||
|
||||
Take a look at:
|
||||
|
||||
- `roles/custom/matrix-bridge-zulip/defaults/main.yml` for some variables that you can customize via your `vars.yml` file
|
||||
|
||||
## Installing
|
||||
|
||||
After configuring the playbook and potentially [adjusting your DNS records](#adjusting-dns-records), run the playbook with [playbook tags](playbook-tags.md) as below:
|
||||
|
||||
<!-- NOTE: let this conservative command run (instead of install-all) to make it clear that failure of the command means something is clearly broken. -->
|
||||
```sh
|
||||
ansible-playbook -i inventory/hosts setup.yml --tags=setup-all,start
|
||||
```
|
||||
|
||||
The shortcut commands with the [`just` program](just.md) are also available: `just install-all` or `just setup-all`
|
||||
|
||||
`just install-all` is useful for maintaining your setup quickly ([2x-5x faster](../CHANGELOG.md#2x-5x-performance-improvements-in-playbook-runtime) than `just setup-all`) when its components remain unchanged. If you adjust your `vars.yml` to remove other components, you'd need to run `just setup-all`, or these components will still remain installed. Note these shortcuts run the `ensure-matrix-users-created` tag too.
|
||||
|
||||
## Usage
|
||||
|
||||
To use the bridge, you need to start a chat with `@zulipbot:example.com` (where `example.com` is your base domain, not the `matrix.` domain). If the bridge ignores you and a DM is not accepted then the owner setting may be wrong.
|
||||
|
||||
If you encounter issues or feel lost you can join the project room at [#matrixzulipbridge:shema.lv](https://matrix.to/#/#matrixzulipbridge:shema.lv) for help.
|
||||
|
||||
## Troubleshooting
|
||||
|
||||
As with all other services, you can find the logs in [systemd-journald](https://www.freedesktop.org/software/systemd/man/systemd-journald.service.html) by logging in to the server with SSH and running `journalctl -fu matrix-bridge-zulip`.
|
||||
@@ -1,7 +1,20 @@
|
||||
<!--
|
||||
SPDX-FileCopyrightText: 2020 Aaron Raimist
|
||||
SPDX-FileCopyrightText: 2020 Chris van Dijk
|
||||
SPDX-FileCopyrightText: 2020 Dominik Zajac
|
||||
SPDX-FileCopyrightText: 2020 Mickaël Cornière
|
||||
SPDX-FileCopyrightText: 2020 Scott Crossen
|
||||
SPDX-FileCopyrightText: 2020 Slavi Pantaleev
|
||||
SPDX-FileCopyrightText: 2024 - 2025 Suguru Hirahara
|
||||
SPDX-FileCopyrightText: 2020-2024 MDAD project contributors
|
||||
SPDX-FileCopyrightText: 2020-2024 Slavi Pantaleev
|
||||
SPDX-FileCopyrightText: 2022 François Darveau
|
||||
SPDX-FileCopyrightText: 2022 Julian Foad
|
||||
SPDX-FileCopyrightText: 2022 Warren Bailey
|
||||
SPDX-FileCopyrightText: 2023 Antonis Christofides
|
||||
SPDX-FileCopyrightText: 2023 Felix Stupp
|
||||
SPDX-FileCopyrightText: 2023 Julian-Samuel Gebühr
|
||||
SPDX-FileCopyrightText: 2023 Pierre 'McFly' Marty
|
||||
SPDX-FileCopyrightText: 2024 Tiz
|
||||
SPDX-FileCopyrightText: 2024-2026 Suguru Hirahara
|
||||
|
||||
SPDX-License-Identifier: AGPL-3.0-or-later
|
||||
-->
|
||||
@@ -12,6 +25,10 @@ The playbook can configure Dynamic DNS with [ddclient](https://github.com/ddc
|
||||
|
||||
Most cloud providers / ISPs will charge you extra for a static IP address. If you're not hosting a highly reliable homeserver you can workaround this via dynamic DNS.
|
||||
|
||||
For details about configuring the [Ansible role for ddclient](https://github.com/mother-of-all-self-hosting/ansible-role-ddclient), you can check them via:
|
||||
- 🌐 [the role's documentation](https://github.com/mother-of-all-self-hosting/ansible-role-ddclient/blob/main/docs/configuring-ddclient.md) online
|
||||
- 📁 `roles/galaxy/ddclient/docs/configuring-ddclient.md` locally, if you have [fetched the Ansible roles](../installing.md)
|
||||
|
||||
## Prerequisite
|
||||
|
||||
You'll need to authenticate with your DNS provider somehow, in most cases this is simply a username and password but can differ from provider to provider. Please consult with your providers documentation and the upstream [ddclient documentation](https://github.com/ddclient/ddclient/blob/main/ddclient.conf.in) to determine what you'll need to provide to authenticate.
|
||||
@@ -21,17 +38,23 @@ You'll need to authenticate with your DNS provider somehow, in most cases this i
|
||||
To enable dynamic DNS, add the following configuration to your `inventory/host_vars/matrix.example.com/vars.yml` file:
|
||||
|
||||
```yaml
|
||||
matrix_dynamic_dns_enabled: true
|
||||
ddclient_enabled: true
|
||||
|
||||
matrix_dynamic_dns_domain_configurations:
|
||||
ddclient_domain_configurations:
|
||||
- provider: example.net
|
||||
protocol: dyndn2
|
||||
protocol: dyndns2
|
||||
username: YOUR_USERNAME_HERE
|
||||
password: YOUR_PASSWORD_HERE
|
||||
domain: "{{ matrix_domain }}"
|
||||
```
|
||||
|
||||
Keep in mind that certain providers may require a different configuration of the `matrix_dynamic_dns_domain_configurations` variable, for provider specific examples see the [upstream documentation](https://github.com/ddclient/ddclient/blob/main/ddclient.conf.in).
|
||||
Keep in mind that certain providers may require a different configuration of the `ddclient_domain_configurations` variable, for provider specific examples see the [upstream documentation](https://github.com/ddclient/ddclient/blob/main/ddclient.conf.in).
|
||||
|
||||
### Configuring the endpoint to obtain IP address (optional)
|
||||
|
||||
The playbook sets the default endpoint for obtaining the IP address to `https://cloudflare.com/cdn-cgi/trace`. You can replace it by specifying yours to `ddclient_web` and `ddclient_web_skip` if necessary.
|
||||
|
||||
Refer to [this section](https://github.com/mother-of-all-self-hosting/ansible-role-ddclient/blob/main/docs/configuring-ddclient.md#setting-the-endpoint-to-obtain-ip-address-optional) for more information.
|
||||
|
||||
### Extending the configuration
|
||||
|
||||
@@ -39,7 +62,7 @@ There are some additional things you may wish to configure about the component.
|
||||
|
||||
Take a look at:
|
||||
|
||||
- `roles/custom/matrix-dynamic-dns/defaults/main.yml` for some variables that you can customize via your `vars.yml` file
|
||||
- `roles/galaxy/ddclient/defaults/main.yml` for some variables that you can customize via your `vars.yml` file
|
||||
|
||||
## Installing
|
||||
|
||||
@@ -63,4 +86,4 @@ Additional resources:
|
||||
|
||||
## Troubleshooting
|
||||
|
||||
As with all other services, you can find the logs in [systemd-journald](https://www.freedesktop.org/software/systemd/man/systemd-journald.service.html) by logging in to the server with SSH and running `journalctl -fu matrix-dynamic-dns`. However, due to an [upstream issue](https://github.com/linuxserver/docker-ddclient/issues/54#issuecomment-1153143132) the logging output is not always complete. For advanced debugging purposes running the `ddclient` tool outside of the container is useful via the following: `ddclient -file ./ddclient.conf -daemon=0 -debug -verbose -noquiet`.
|
||||
See [this section](https://github.com/mother-of-all-self-hosting/ansible-role-ddclient/blob/main/docs/configuring-ddclient.md#troubleshooting) on the role's documentation for details.
|
||||
|
||||
@@ -44,7 +44,7 @@ matrix_homeserver_federation_enabled: false
|
||||
|
||||
With that, your server's users will only be able to talk among themselves, but not to anyone who is on another server.
|
||||
|
||||
**Disabling federation does not necessarily disable the federation port** (`8448`). Services like [Dimension](configuring-playbook-dimension.md) and [ma1sd](configuring-playbook-ma1sd.md) normally rely on `openid` APIs exposed on that port. Even if you disable federation and only if necessary, we may still be exposing the federation port and serving the `openid` APIs there. To override this and completely disable Synapse's federation port use:
|
||||
**Disabling federation does not necessarily disable the federation port** (`8448`). Services like [Dimension](configuring-playbook-dimension.md) normally rely on `openid` APIs exposed on that port. Even if you disable federation and only if necessary, we may still be exposing the federation port and serving the `openid` APIs there. To override this and completely disable Synapse's federation port use:
|
||||
|
||||
```yaml
|
||||
matrix_homeserver_federation_enabled: false
|
||||
|
||||
@@ -1,176 +1,37 @@
|
||||
<!--
|
||||
SPDX-FileCopyrightText: 2018 - 2024 Slavi Pantaleev
|
||||
SPDX-FileCopyrightText: 2019 - 2020 MDAD project contributors
|
||||
SPDX-FileCopyrightText: 2018-2025 Slavi Pantaleev
|
||||
SPDX-FileCopyrightText: 2019 Eduardo Beltrame
|
||||
SPDX-FileCopyrightText: 2019 Noah Fleischmann
|
||||
SPDX-FileCopyrightText: 2020 Justin Croonenberghs
|
||||
SPDX-FileCopyrightText: 2019-2022, 2024 MDAD project contributors
|
||||
SPDX-FileCopyrightText: 2020 Hugues Morisset
|
||||
SPDX-FileCopyrightText: 2020 Marcel Partap
|
||||
SPDX-FileCopyrightText: 2024 - 2025 Suguru Hirahara
|
||||
SPDX-FileCopyrightText: 2020 Tulir Asokan
|
||||
SPDX-FileCopyrightText: 2020, 2023 Justin Croonenberghs
|
||||
SPDX-FileCopyrightText: 2022 Dennis Ciba
|
||||
SPDX-FileCopyrightText: 2022 Vladimir Panteleev
|
||||
SPDX-FileCopyrightText: 2023 Kuba Orlik
|
||||
SPDX-FileCopyrightText: 2023 Pierre 'McFly' Marty
|
||||
SPDX-FileCopyrightText: 2023 Samuel Meenzen
|
||||
SPDX-FileCopyrightText: 2024 Fabio Bonelli
|
||||
SPDX-FileCopyrightText: 2024-2026 Suguru Hirahara
|
||||
|
||||
SPDX-License-Identifier: AGPL-3.0-or-later
|
||||
-->
|
||||
|
||||
# Setting up ma1sd Identity Server (optional)
|
||||
# Setting up ma1sd Identity Server (optional, removed)
|
||||
|
||||
> [!WARNING]
|
||||
> Since ma1sd has been unmaintained for years (the latest commit and release being from 2021) and the future of identity server's role in the Matrix specification is uncertain, **we recommend not bothering with installing it unless it's the only way you can do what you need to do**.
|
||||
>
|
||||
> Please note that certain things can be achieved with other components. For example, if you wish to implement LDAP integration, you might as well check out [the LDAP provider module for Synapse](./configuring-playbook-ldap-auth.md) instead.
|
||||
🪦 The playbook used to be able to install and configure the [ma1sd](https://github.com/ma1uta/ma1sd) Identity Server, but no longer includes this component, as it has been unmaintained for a long time.
|
||||
|
||||
The playbook can configure the [ma1sd](https://github.com/ma1uta/ma1sd) Identity Server for you. It is a fork of [mxisd](https://github.com/kamax-io/mxisd) which was pronounced end of life 2019-06-21.
|
||||
Please note that some of the functions can be achieved with other components. For example, if you wish to implement LDAP integration, you might as well check out [the LDAP provider module for Synapse](./configuring-playbook-ldap-auth.md) instead.
|
||||
|
||||
ma1sd is used for 3PIDs (3rd party identifiers like E-mail and phone numbers) and some [enhanced features](https://github.com/ma1uta/ma1sd/#features). It is private by default, potentially at the expense of user discoverability.
|
||||
## Uninstalling the component manually
|
||||
|
||||
See the project's [documentation](https://github.com/ma1uta/ma1sd/blob/master/README.md) to learn what it does and why it might be useful to you.
|
||||
If you still have the ma1sd Identity Server installed on your Matrix server, the playbook can no longer help you uninstall it and you will need to do it manually. To uninstall manually, run these commands on the server:
|
||||
|
||||
## Prerequisites
|
||||
|
||||
### Open Matrix Federation port
|
||||
|
||||
Enabling the ma1sd service will automatically reconfigure your Synapse homeserver to expose the `openid` API endpoints on the Matrix Federation port (usually `8448`), even if [federation](configuring-playbook-federation.md) is disabled. If you enable the component, make sure that the port is accessible.
|
||||
|
||||
## Adjusting DNS records
|
||||
|
||||
To make the ma1sd Identity Server enable its federation features, set up a SRV record that looks like this:
|
||||
|
||||
- Name: `_matrix-identity._tcp` (use this text as-is)
|
||||
- Content: `10 0 443 matrix.example.com` (replace `example.com` with your own)
|
||||
|
||||
See [ma1sd's documentation](https://github.com/ma1uta/ma1sd/wiki/mxisd-and-your-privacy#choices-are-never-easy) for information on the privacy implications of setting up this SRV record.
|
||||
|
||||
When setting up a SRV record, if you are asked for a service and protocol instead of a hostname split the host value from the table where the period is. For example use service as `_matrix-identity` and protocol as `_tcp`.
|
||||
|
||||
**Note**: This `_matrix-identity._tcp` SRV record for the identity server is different from the `_matrix._tcp` that can be used for Synapse delegation. See [howto-server-delegation.md](howto-server-delegation.md) for more information about delegation.
|
||||
|
||||
## Adjusting the playbook configuration
|
||||
|
||||
To enable ma1sd, add the following configuration to your `inventory/host_vars/matrix.example.com/vars.yml` file:
|
||||
|
||||
```yaml
|
||||
matrix_ma1sd_enabled: true
|
||||
```
|
||||
|
||||
### Matrix.org lookup forwarding
|
||||
|
||||
To ensure maximum discovery, you can make your identity server also forward lookups to the central matrix.org Identity server (at the cost of potentially leaking all your contacts information).
|
||||
|
||||
Enabling this is discouraged and you'd better [learn more](https://github.com/ma1uta/ma1sd/blob/master/docs/features/identity.md#lookups) before proceeding.
|
||||
|
||||
To enable matrix.org forwarding, add the following configuration to your `vars.yml` file:
|
||||
|
||||
```yaml
|
||||
matrix_ma1sd_matrixorg_forwarding_enabled: true
|
||||
```
|
||||
|
||||
### Extending the configuration
|
||||
|
||||
There are some additional things you may wish to configure about the component.
|
||||
|
||||
Take a look at:
|
||||
|
||||
- `roles/custom/matrix-ma1sd/defaults/main.yml` for some variables that you can customize via your `vars.yml` file. You can override settings (even those that don't have dedicated playbook variables) using the `matrix_ma1sd_configuration_extension_yaml` variable
|
||||
|
||||
You can refer to the [ma1sd website](https://github.com/ma1uta/ma1sd) for more details and configuration options.
|
||||
|
||||
#### Customizing email templates
|
||||
|
||||
If you'd like to change the default email templates used by ma1sd, take a look at the `matrix_ma1sd_threepid_medium_email_custom_` variables (in the `roles/custom/matrix-ma1sd/defaults/main.yml` file.
|
||||
|
||||
#### ma1sd-controlled Registration
|
||||
|
||||
To use the [Registration](https://github.com/ma1uta/ma1sd/blob/master/docs/features/registration.md) feature of ma1sd, you can make use of the following variables:
|
||||
|
||||
- `matrix_synapse_enable_registration` — to enable user-initiated registration in Synapse
|
||||
|
||||
- `matrix_synapse_enable_registration_captcha` — to validate registering users using reCAPTCHA, as described in the [enabling reCAPTCHA](configuring-captcha.md) documentation.
|
||||
|
||||
- `matrix_synapse_registrations_require_3pid` — a list of 3pid types (among `'email'`, `'msisdn'`) required by the Synapse server for registering
|
||||
|
||||
- variables prefixed with `matrix_ma1sd_container_labels_` (e.g. `matrix_ma1sd_container_labels_matrix_client_3pid_registration_enabled`) — to configure the Traefik reverse-proxy to capture and send registration requests to ma1sd (instead of Synapse), so it can apply its additional functionality
|
||||
|
||||
- `matrix_ma1sd_configuration_extension_yaml` — to configure ma1sd as required. See the [Registration feature's docs](https://github.com/ma1uta/ma1sd/blob/master/docs/features/registration.md) for inspiration. Also see the [Additional features](#additional-features) section below to learn more about how to use `matrix_ma1sd_configuration_extension_yaml`.
|
||||
|
||||
**Note**: For this to work, either the homeserver needs to [federate](configuring-playbook-federation.md) or the `openid` APIs need to exposed on the federation port. When federation is disabled and ma1sd is enabled, we automatically expose the `openid` APIs (only!) on the federation port. Make sure the federation port (usually `https://matrix.example.com:8448`) is whitelisted in your firewall (even if you don't actually use/need federation).
|
||||
|
||||
#### Authentication
|
||||
|
||||
[Authentication](https://github.com/ma1uta/ma1sd/blob/master/docs/features/authentication.md) provides the possibility to use your own [Identity Stores](https://github.com/ma1uta/ma1sd/blob/master/docs/stores/README.md) (for example LDAP) to authenticate users on your Homeserver.
|
||||
|
||||
To enable authentication against an LDAP server, add the following configuration to your `vars.yml` file:
|
||||
|
||||
```yaml
|
||||
matrix_synapse_ext_password_provider_rest_auth_enabled: true
|
||||
|
||||
# matrix-ma1sd is the hostname of the ma1sd Docker container
|
||||
matrix_synapse_ext_password_provider_rest_auth_endpoint: "http://matrix-ma1sd:8090"
|
||||
|
||||
matrix_ma1sd_configuration_extension_yaml: |
|
||||
ldap:
|
||||
enabled: true
|
||||
connection:
|
||||
host: ldapHostnameOrIp
|
||||
tls: false
|
||||
port: 389
|
||||
baseDNs: ['OU=Users,DC=example,DC=org']
|
||||
bindDn: CN=My ma1sd User,OU=Users,DC=example,DC=org
|
||||
bindPassword: TheUserPassword
|
||||
```
|
||||
|
||||
#### Example: SMS verification
|
||||
|
||||
If your use case requires mobile verification, it is quite simple to integrate ma1sd with [Twilio](https://www.twilio.com/), an online telephony services gateway. Their prices are reasonable for low-volume projects and integration can be done with the following configuration:
|
||||
|
||||
```yaml
|
||||
matrix_ma1sd_configuration_extension_yaml: |
|
||||
threepid:
|
||||
medium:
|
||||
msisdn:
|
||||
connectors:
|
||||
twilio:
|
||||
account_sid: '<secret-SID>'
|
||||
auth_token: '<secret-token>'
|
||||
number: '+<msisdn-number>'
|
||||
```
|
||||
|
||||
#### Example: Open Registration for every Domain
|
||||
|
||||
If you want to open registration for any domain, you have to setup the allowed domains with ma1sd's `blacklist` and `whitelist`. The default behavior when neither the `blacklist`, nor the `whitelist` match, is to allow registration. Beware: you can't block toplevel domains (aka `.xy`) because the internal architecture of ma1sd doesn't allow that.
|
||||
|
||||
```yaml
|
||||
matrix_ma1sd_configuration_extension_yaml: |
|
||||
register:
|
||||
policy:
|
||||
allowed: true
|
||||
threepid:
|
||||
email:
|
||||
domain:
|
||||
blacklist: ~
|
||||
whitelist: ~
|
||||
```
|
||||
|
||||
## Installing
|
||||
|
||||
After configuring the playbook, run it with [playbook tags](playbook-tags.md) as below:
|
||||
|
||||
<!-- NOTE: let this conservative command run (instead of install-all) to make it clear that failure of the command means something is clearly broken. -->
|
||||
```sh
|
||||
ansible-playbook -i inventory/hosts setup.yml --tags=setup-all,start
|
||||
```
|
||||
|
||||
The shortcut commands with the [`just` program](just.md) are also available: `just install-all` or `just setup-all`
|
||||
|
||||
`just install-all` is useful for maintaining your setup quickly ([2x-5x faster](../CHANGELOG.md#2x-5x-performance-improvements-in-playbook-runtime) than `just setup-all`) when its components remain unchanged. If you adjust your `vars.yml` to remove other components, you'd need to run `just setup-all`, or these components will still remain installed. Note these shortcuts run the `ensure-matrix-users-created` tag too.
|
||||
|
||||
## Troubleshooting
|
||||
|
||||
If email address validation emails sent by ma1sd are not reaching you, you should look into [Adjusting email-sending settings](configuring-playbook-email.md).
|
||||
|
||||
As with all other services, you can find the logs in [systemd-journald](https://www.freedesktop.org/software/systemd/man/systemd-journald.service.html) by logging in to the server with SSH and running `journalctl -fu matrix-ma1sd`.
|
||||
|
||||
### Increase logging verbosity
|
||||
|
||||
If you want to increase the verbosity, add the following configuration to your `vars.yml` file and re-run the playbook:
|
||||
|
||||
```yaml
|
||||
# See: https://github.com/ma1uta/ma1sd/blob/master/docs/troubleshooting.md#increase-verbosity
|
||||
matrix_ma1sd_verbose_logging: true
|
||||
systemctl disable --now matrix-ma1sd.service
|
||||
|
||||
rm -rf /matrix/ma1sd
|
||||
|
||||
/matrix/postgres/bin/cli-non-interactive 'DROP DATABASE matrix_ma1sd;'
|
||||
```
|
||||
|
||||
@@ -18,7 +18,7 @@ Add the following configuration to your `inventory/host_vars/matrix.example.com/
|
||||
|
||||
```yaml
|
||||
matrix_synapse_ext_password_provider_rest_auth_enabled: true
|
||||
matrix_synapse_ext_password_provider_rest_auth_endpoint: "http://matrix-ma1sd:8090"
|
||||
matrix_synapse_ext_password_provider_rest_auth_endpoint: SET_YOUR_ENDPOINT_HERE
|
||||
matrix_synapse_ext_password_provider_rest_auth_registration_enforce_lowercase: false
|
||||
matrix_synapse_ext_password_provider_rest_auth_registration_profile_name_autofill: true
|
||||
matrix_synapse_ext_password_provider_rest_auth_login_profile_name_autofill: false
|
||||
@@ -47,9 +47,4 @@ The shortcut commands with the [`just` program](just.md) are also available: `ju
|
||||
|
||||
## Usage
|
||||
|
||||
### Use ma1sd Identity Server for the backend (not recommended)
|
||||
|
||||
This module does not provide direct integration with any backend. For the backend you can use [ma1sd](https://github.com/ma1uta/ma1sd) Identity Server, which can be configured with the playbook.
|
||||
|
||||
> [!WARNING]
|
||||
> We recommend not bothering with installing ma1sd as it has been unmaintained for years. If you wish to install it anyway, consult the [ma1sd Identity Server configuration](configuring-playbook-ma1sd.md).
|
||||
This module does not provide direct integration with any backend. Please prepare one by yourself for it.
|
||||
|
||||
@@ -70,8 +70,6 @@ For a more custom setup, see the [Other configuration options](#other-configurat
|
||||
|
||||
- [Adjusting email-sending settings](configuring-playbook-email.md)
|
||||
|
||||
- [Setting up ma1sd Identity Server](configuring-playbook-ma1sd.md)
|
||||
|
||||
- [Setting up Dynamic DNS](configuring-playbook-dynamic-dns.md)
|
||||
|
||||
- Server connectivity:
|
||||
@@ -188,8 +186,6 @@ Bridges can be used to connect your Matrix installation with third-party communi
|
||||
|
||||
- [Setting up WeChat bridging](configuring-playbook-bridge-wechat.md)
|
||||
|
||||
- [Setting up Zulip bridging](configuring-playbook-bridge-zulip.md)
|
||||
|
||||
### Bots
|
||||
|
||||
Bots provide various additional functionality to your installation.
|
||||
@@ -277,6 +273,8 @@ Various services that don't fit any other categories.
|
||||
|
||||
- [Setting up Go Skype Bridge bridging](configuring-playbook-bridge-go-skype-bridge.md) (removed; Skype has been discontinued since May 2025)
|
||||
|
||||
- [Setting up ma1sd Identity Server](configuring-playbook-ma1sd.md) (removed; this component has been unmaintained for a long time, so it has been removed from the playbook.)
|
||||
|
||||
- [Setting up matrix-bot-chatgpt](configuring-playbook-bot-chatgpt.md) (unmaintained; the bridge's author suggests taking a look at [baibot](https://github.com/etkecc/baibot) as a replacement, which can also be [installed using this playbook](configuring-playbook-bot-baibot.md))
|
||||
|
||||
- [Setting up Mautrix Facebook bridging](configuring-playbook-bridge-mautrix-facebook.md) (deprecated in favor of the Messenger/Instagram bridge with [mautrix-meta-messenger](configuring-playbook-bridge-mautrix-meta-messenger.md))
|
||||
|
||||
@@ -53,7 +53,6 @@ Services that run on the server to make the various parts of your installation w
|
||||
| [Traefik](configuring-playbook-traefik.md) | [Traefik](https://hub.docker.com/_/traefik/) | ✅ | Web server, listening on ports 80, 443 and 8448 — standing in front of all the other services. [Using your own webserver](configuring-playbook-own-webserver.md) is also possible. |
|
||||
| [Let's Encrypt](configuring-playbook-ssl-certificates.md) | [certbot/certbot](https://hub.docker.com/r/certbot/certbot/) | ✅ | [Certbot](https://certbot.eff.org/) tool for obtaining SSL certificates from [Let's Encrypt](https://letsencrypt.org/) |
|
||||
| [Exim](configuring-playbook-email.md) | [devture/exim-relay](https://hub.docker.com/r/devture/exim-relay/) | ✅ | Mail server, through which all Matrix services send outgoing email (can be configured to relay through another SMTP server) |
|
||||
| [ma1sd](configuring-playbook-ma1sd.md) | [ma1uta/ma1sd](https://hub.docker.com/r/ma1uta/ma1sd/) | ❌ | Matrix Identity Server |
|
||||
| [ddclient](configuring-playbook-dynamic-dns.md) | [linuxserver/ddclient](https://hub.docker.com/r/linuxserver/ddclient) | ❌ | Update dynamic DNS entries for accounts on Dynamic DNS Network Service Provider |
|
||||
| [LiveKit Server](configuring-playbook-livekit-server.md) | [livekit/livekit-server](https://hub.docker.com/r/livekit/livekit-server/) | ❌ | WebRTC server for audio/video calls |
|
||||
| [Livekit JWT Service](configuring-playbook-livekit-jwt-service.md) | [element-hq/lk-jwt-service](https://ghcr.io/element-hq/lk-jwt-service) | ❌ | JWT service for integrating [Element Call](./configuring-playbook-element-call.md) with [LiveKit Server](./configuring-playbook-livekit-server.md) |
|
||||
@@ -107,7 +106,6 @@ Bridges can be used to connect your Matrix installation with third-party communi
|
||||
| [matrix-hookshot](configuring-playbook-bridge-hookshot.md) | [halfshot/matrix-hookshot](https://hub.docker.com/r/halfshot/matrix-hookshot) | ❌ | Bridge for generic webhooks and multiple project management services, such as GitHub, GitLab, Figma, and Jira in particular |
|
||||
| [matrix-sms-bridge](configuring-playbook-bridge-matrix-bridge-sms.md) | [folivonet/matrix-sms-bridge](https://hub.docker.com/repository/docker/folivonet/matrix-sms-bridge) | ❌ | Bridge to SMS |
|
||||
| [matrix-wechat](configuring-playbook-bridge-wechat.md) | [lxduo/matrix-wechat](https://hub.docker.com/r/lxduo/matrix-wechat) | ❌ | Bridge to [WeChat](https://www.wechat.com/) |
|
||||
| [MatrixZulipBridge](configuring-playbook-bridge-zulip.md) | [GearKite/MatrixZulipBridge](https://ghcr.io/gearkite/matrixzulipbridge) | ❌ | Puppeting appservice bridge for [Zulip](https://zulip.com/) |
|
||||
| [Heisenbridge](configuring-playbook-bridge-heisenbridge.md) | [hif1/heisenbridge](https://hub.docker.com/r/hif1/heisenbridge) | ❌ | Bouncer-style bridge to [IRC](https://wikipedia.org/wiki/Internet_Relay_Chat) |
|
||||
| [mx-puppet-groupme](configuring-playbook-bridge-mx-puppet-groupme.md) | [xangelix/mx-puppet-groupme](https://hub.docker.com/r/xangelix/mx-puppet-groupme) | ❌ | Bridge to [GroupMe](https://groupme.com/) |
|
||||
| [matrix-steam-bridge](configuring-playbook-bridge-steam.md) | [jasonlaguidice/matrix-steam-bridge](https://github.com/jasonlaguidice/matrix-steam-bridge/pkgs/container/matrix-steam-bridge) | ❌ | Bridge to [Steam](https://steampowered.com/) |
|
||||
@@ -177,6 +175,7 @@ The list of the deprecated or unmaintained services is available [here](configur
|
||||
| [Dimension](configuring-playbook-dimension.md) | [turt2live/matrix-dimension](https://hub.docker.com/r/turt2live/matrix-dimension) | ❌ | Open source integration manager for Matrix clients |
|
||||
| [Email2Matrix](configuring-playbook-email2matrix.md) | [devture/email2matrix](https://hub.docker.com/r/devture/email2matrix/) | ❌ | Bridge for relaying emails to Matrix rooms |
|
||||
| [Go-NEB](configuring-playbook-bot-go-neb.md) | [matrixdotorg/go-neb](https://hub.docker.com/r/matrixdotorg/go-neb) | ❌ | Multi functional bot written in Go |
|
||||
| [ma1sd](configuring-playbook-ma1sd.md) | [ma1uta/ma1sd](https://hub.docker.com/r/ma1uta/ma1sd/) | ❌ | Matrix Identity Server |
|
||||
| [matrix-appservice-webhooks](configuring-playbook-bridge-appservice-webhooks.md) | [turt2live/matrix-appservice-webhooks](https://hub.docker.com/r/turt2live/matrix-appservice-webhooks) | ❌ | Bridge for slack compatible webhooks ([ConcourseCI](https://concourse-ci.org/), [Slack](https://slack.com/) etc. pp.) |
|
||||
| [matrix-chatgpt-bot](configuring-playbook-bot-chatgpt.md) | [matrixgpt/matrix-chatgpt-bot](https://ghcr.io/matrixgpt/matrix-chatgpt-bot) | ❌ | Accessing ChatGPT via your favourite Matrix client |
|
||||
| [mautrix-facebook](configuring-playbook-bridge-mautrix-facebook.md) | [mautrix/facebook](https://mau.dev/mautrix/facebook/container_registry) | ❌ | Bridge to [Facebook](https://facebook.com/) |
|
||||
|
||||
@@ -34,7 +34,6 @@ Possibly outdated list of roles where self-building the Docker image is currentl
|
||||
- `matrix-coturn`
|
||||
- `matrix-corporal`
|
||||
- `matrix-dimension`
|
||||
- `matrix-ma1sd`
|
||||
- `exim-relay`
|
||||
- `matrix-bridge-hookshot`
|
||||
- `matrix-bridge-appservice-irc`
|
||||
|
||||
+127
-286
@@ -114,8 +114,6 @@ matrix_homeserver_container_extra_arguments_auto: |
|
||||
+
|
||||
(['--mount type=bind,src=' + matrix_hookshot_base_path + '/registration.yml,dst=/hookshot-registration.yml,ro'] if matrix_hookshot_enabled else [])
|
||||
+
|
||||
(['--mount type=bind,src=' + matrix_zulip_bridge_base_path + '/registration.yaml,dst=/matrixzulipbridge-registration.yaml,ro'] if matrix_zulip_bridge_enabled else [])
|
||||
+
|
||||
(['--mount type=bind,src=' + matrix_mautrix_bluesky_config_path + '/registration.yaml,dst=/matrix-mautrix-bluesky-registration.yaml,ro'] if matrix_mautrix_bluesky_enabled else [])
|
||||
+
|
||||
(['--mount type=bind,src=' + matrix_mautrix_discord_config_path + '/registration.yaml,dst=/matrix-mautrix-discord-registration.yaml,ro'] if matrix_mautrix_discord_enabled else [])
|
||||
@@ -175,8 +173,6 @@ matrix_homeserver_app_service_config_files_auto: |
|
||||
+
|
||||
(['/hookshot-registration.yml'] if matrix_hookshot_enabled else [])
|
||||
+
|
||||
(['/matrixzulipbridge-registration.yaml'] if matrix_zulip_bridge_enabled else [])
|
||||
+
|
||||
(['/matrix-mautrix-bluesky-registration.yaml'] if matrix_mautrix_bluesky_enabled else [])
|
||||
+
|
||||
(['/matrix-mautrix-discord-registration.yaml'] if matrix_mautrix_discord_enabled else [])
|
||||
@@ -302,8 +298,6 @@ devture_systemd_service_manager_services_list_auto: |
|
||||
+
|
||||
([{'name': 'matrix-hookshot.service', 'priority': 2000, 'groups': ['matrix', 'bridges', 'hookshot', 'bridge-hookshot']}] if matrix_hookshot_enabled else [])
|
||||
+
|
||||
([{'name': 'matrix-zulip-bridge.service', 'priority': 2000, 'groups': ['matrix', 'bridges', 'zulip']}] if matrix_zulip_bridge_enabled else [])
|
||||
+
|
||||
([{'name': 'matrix-mautrix-bluesky.service', 'priority': 2000, 'groups': ['matrix', 'bridges', 'mautrix-bluesky']}] if matrix_mautrix_bluesky_enabled else [])
|
||||
+
|
||||
([{'name': 'matrix-mautrix-discord.service', 'priority': 2000, 'groups': ['matrix', 'bridges', 'mautrix-discord']}] if matrix_mautrix_discord_enabled else [])
|
||||
@@ -368,7 +362,7 @@ devture_systemd_service_manager_services_list_auto: |
|
||||
+
|
||||
([{'name': 'matrix-dimension.service', 'priority': 4000, 'groups': ['matrix', 'integration-managers', 'dimension']}] if matrix_dimension_enabled else [])
|
||||
+
|
||||
([{'name': 'matrix-dynamic-dns.service', 'priority': 5000, 'groups': ['matrix', 'dynamic-dns']}] if matrix_dynamic_dns_enabled else [])
|
||||
([{'name': (ddclient_identifier + '.service'), 'priority': 5000, 'groups': ['matrix', 'ddclient', 'dynamic-dns']}] if ddclient_enabled else [])
|
||||
+
|
||||
([{'name': (etherpad_identifier + '.service'), 'priority': 4000, 'groups': ['matrix', 'etherpad']}] if etherpad_enabled else [])
|
||||
+
|
||||
@@ -384,8 +378,6 @@ devture_systemd_service_manager_services_list_auto: |
|
||||
+
|
||||
([{'name': 'matrix-ldap-registration-proxy.service', 'priority': 2000, 'groups': ['matrix', 'ldap-registration-proxy']}] if matrix_ldap_registration_proxy_enabled else [])
|
||||
+
|
||||
([{'name': 'matrix-ma1sd.service', 'priority': 2000, 'groups': ['matrix', 'ma1sd']}] if matrix_ma1sd_enabled else [])
|
||||
+
|
||||
([{'name': (matrix_media_repo_identifier + '.service'), 'priority': 4000, 'groups': ['matrix', 'matrix-media-repo']}] if matrix_media_repo_enabled else [])
|
||||
+
|
||||
([{'name': (exim_relay_identifier ~ '.service'), 'priority': 800, 'groups': ['matrix', 'mailer', 'exim-relay']}] if exim_relay_enabled else [])
|
||||
@@ -508,8 +500,6 @@ docker_daemon_options: "{{ matrix_playbook_docker_installation_daemon_options }}
|
||||
#
|
||||
######################################################################
|
||||
|
||||
matrix_identity_server_url: "{{ (('https://' if matrix_playbook_ssl_enabled else 'http://') + matrix_server_fqn_matrix) if matrix_ma1sd_enabled else None }}"
|
||||
|
||||
matrix_homeserver_systemd_services_list: |-
|
||||
{{
|
||||
(
|
||||
@@ -614,10 +604,10 @@ matrix_authentication_service_hostname: "{{ matrix_server_fqn_matrix }}"
|
||||
matrix_authentication_service_path_prefix: /auth
|
||||
|
||||
matrix_authentication_service_config_database_host: "{{ postgres_connection_hostname if postgres_enabled else '' }}"
|
||||
matrix_authentication_service_config_database_password: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'mas.db', rounds=655555) | to_uuid }}"
|
||||
matrix_authentication_service_config_database_password: "{{ (matrix_homeserver_generic_secret_key + ':mas.db') | hash('sha512') | to_uuid }}"
|
||||
|
||||
matrix_authentication_service_config_matrix_homeserver: "{{ matrix_domain }}"
|
||||
matrix_authentication_service_config_matrix_secret: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'mas.hs.secret', rounds=655555) | to_uuid }}"
|
||||
matrix_authentication_service_config_matrix_secret: "{{ (matrix_homeserver_generic_secret_key + ':mas.hs.secret') | hash('sha512') | to_uuid }}"
|
||||
matrix_authentication_service_config_matrix_endpoint: "{{ matrix_homeserver_container_url }}"
|
||||
|
||||
# We're using a non-default configuration which:
|
||||
@@ -731,15 +721,15 @@ matrix_appservice_discord_container_additional_networks_auto: |-
|
||||
# If the homeserver disables presence, it's likely better (less wasteful) to also disable presence on the bridge side.
|
||||
matrix_appservice_discord_bridge_disablePresence: "{{ (not matrix_synapse_presence_enabled) if matrix_homeserver_implementation == 'synapse' else false }}"
|
||||
|
||||
matrix_appservice_discord_appservice_token: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'discord.as.token', rounds=655555) | to_uuid }}"
|
||||
matrix_appservice_discord_appservice_token: "{{ (matrix_homeserver_generic_secret_key + ':discord.as.token') | hash('sha512') | to_uuid }}"
|
||||
|
||||
matrix_appservice_discord_homeserver_token: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'discord.hs.token', rounds=655555) | to_uuid }}"
|
||||
matrix_appservice_discord_homeserver_token: "{{ (matrix_homeserver_generic_secret_key + ':discord.hs.token') | hash('sha512') | to_uuid }}"
|
||||
|
||||
# We only make this use Postgres if our own Postgres server is enabled.
|
||||
# It's only then (for now) that we can automatically create the necessary database and user for this service.
|
||||
matrix_appservice_discord_database_engine: "{{ 'postgres' if postgres_enabled else 'sqlite' }}"
|
||||
matrix_appservice_discord_database_hostname: "{{ postgres_connection_hostname if postgres_enabled else '' }}"
|
||||
matrix_appservice_discord_database_password: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'as.discord.db', rounds=655555) | to_uuid }}"
|
||||
matrix_appservice_discord_database_password: "{{ (matrix_homeserver_generic_secret_key + ':as.discord.db') | hash('sha512') | to_uuid }}"
|
||||
|
||||
######################################################################
|
||||
#
|
||||
@@ -789,17 +779,17 @@ matrix_appservice_slack_container_labels_traefik_docker_network: "{{ matrix_play
|
||||
matrix_appservice_slack_container_labels_traefik_entrypoints: "{{ traefik_entrypoint_primary }}"
|
||||
matrix_appservice_slack_container_labels_traefik_tls_certResolver: "{{ traefik_certResolver_primary }}"
|
||||
|
||||
matrix_appservice_slack_appservice_token: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'slack.as.token', rounds=655555) | to_uuid }}"
|
||||
matrix_appservice_slack_appservice_token: "{{ (matrix_homeserver_generic_secret_key + ':slack.as.token') | hash('sha512') | to_uuid }}"
|
||||
|
||||
matrix_appservice_slack_homeserver_url: "{{ matrix_addons_homeserver_client_api_url }}"
|
||||
matrix_appservice_slack_homeserver_token: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'slack.hs.token', rounds=655555) | to_uuid }}"
|
||||
matrix_appservice_slack_homeserver_token: "{{ (matrix_homeserver_generic_secret_key + ':slack.hs.token') | hash('sha512') | to_uuid }}"
|
||||
|
||||
matrix_appservice_slack_id_token: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'slack.id.token', rounds=655555) | to_uuid }}"
|
||||
matrix_appservice_slack_id_token: "{{ (matrix_homeserver_generic_secret_key + ':slack.id.token') | hash('sha512') | to_uuid }}"
|
||||
|
||||
# Postgres is the default, except if not using internal Postgres server
|
||||
matrix_appservice_slack_database_engine: "{{ 'postgres' if postgres_enabled else 'nedb' }}"
|
||||
matrix_appservice_slack_database_hostname: "{{ postgres_connection_hostname if postgres_enabled else '' }}"
|
||||
matrix_appservice_slack_database_password: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'as.slack.db', rounds=655555) | to_uuid }}"
|
||||
matrix_appservice_slack_database_password: "{{ (matrix_homeserver_generic_secret_key + ':as.slack.db') | hash('sha512') | to_uuid }}"
|
||||
matrix_appservice_slack_database_container_network: "{{ postgres_container_network if postgres_enabled else '' }}"
|
||||
|
||||
######################################################################
|
||||
@@ -847,14 +837,14 @@ matrix_appservice_irc_container_additional_networks_auto: |-
|
||||
# IRC bridge presence, for performance reasons.
|
||||
matrix_appservice_irc_homeserver_enablePresence: "{{ matrix_synapse_presence_enabled if matrix_homeserver_implementation == 'synapse' else true }}"
|
||||
|
||||
matrix_appservice_irc_appservice_token: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'irc.as.token', rounds=655555) | to_uuid }}"
|
||||
matrix_appservice_irc_appservice_token: "{{ (matrix_homeserver_generic_secret_key + ':irc.as.token') | hash('sha512') | to_uuid }}"
|
||||
|
||||
matrix_appservice_irc_homeserver_url: "{{ matrix_addons_homeserver_client_api_url }}"
|
||||
matrix_appservice_irc_homeserver_token: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'irc.hs.token', rounds=655555) | to_uuid }}"
|
||||
matrix_appservice_irc_homeserver_token: "{{ (matrix_homeserver_generic_secret_key + ':irc.hs.token') | hash('sha512') | to_uuid }}"
|
||||
|
||||
matrix_appservice_irc_database_engine: "{{ 'postgres' if postgres_enabled else 'nedb' }}"
|
||||
matrix_appservice_irc_database_hostname: "{{ postgres_connection_hostname if postgres_enabled else '' }}"
|
||||
matrix_appservice_irc_database_password: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'as.irc.db', rounds=655555) | to_uuid }}"
|
||||
matrix_appservice_irc_database_password: "{{ (matrix_homeserver_generic_secret_key + ':as.irc.db') | hash('sha512') | to_uuid }}"
|
||||
matrix_appservice_irc_database_container_network: "{{ postgres_container_network if postgres_enabled else '' }}"
|
||||
|
||||
matrix_appservice_irc_ircService_mediaProxy_publicUrl_scheme: "{{ 'https' if matrix_playbook_ssl_enabled else 'http' }}" # noqa var-naming
|
||||
@@ -901,10 +891,10 @@ matrix_appservice_kakaotalk_container_additional_networks_auto: |-
|
||||
) | unique
|
||||
}}
|
||||
|
||||
matrix_appservice_kakaotalk_appservice_token: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'as.kakao.hs', rounds=655555) | to_uuid }}"
|
||||
matrix_appservice_kakaotalk_appservice_token: "{{ (matrix_homeserver_generic_secret_key + ':as.kakao.hs') | hash('sha512') | to_uuid }}"
|
||||
|
||||
matrix_appservice_kakaotalk_homeserver_address: "{{ matrix_addons_homeserver_client_api_url }}"
|
||||
matrix_appservice_kakaotalk_homeserver_token: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'as.kakao.hs', rounds=655555) | to_uuid }}"
|
||||
matrix_appservice_kakaotalk_homeserver_token: "{{ (matrix_homeserver_generic_secret_key + ':as.kakao.hs') | hash('sha512') | to_uuid }}"
|
||||
|
||||
matrix_appservice_kakaotalk_homeserver_async_media: "{{ matrix_homeserver_implementation in ['synapse'] }}"
|
||||
|
||||
@@ -912,7 +902,7 @@ matrix_appservice_kakaotalk_login_shared_secret: "{{ matrix_synapse_ext_password
|
||||
|
||||
matrix_appservice_kakaotalk_database_engine: "{{ 'postgres' if postgres_enabled else 'sqlite' }}"
|
||||
matrix_appservice_kakaotalk_database_hostname: "{{ postgres_connection_hostname if postgres_enabled else '' }}"
|
||||
matrix_appservice_kakaotalk_database_password: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'as.kakao.db', rounds=655555) | to_uuid }}"
|
||||
matrix_appservice_kakaotalk_database_password: "{{ (matrix_homeserver_generic_secret_key + ':as.kakao.db') | hash('sha512') | to_uuid }}"
|
||||
|
||||
######################################################################
|
||||
#
|
||||
@@ -952,10 +942,10 @@ matrix_beeper_linkedin_container_additional_networks_auto: |-
|
||||
) | unique
|
||||
}}
|
||||
|
||||
matrix_beeper_linkedin_appservice_token: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'linked.as.token', rounds=655555) | to_uuid }}"
|
||||
matrix_beeper_linkedin_appservice_token: "{{ (matrix_homeserver_generic_secret_key + ':linked.as.token') | hash('sha512') | to_uuid }}"
|
||||
|
||||
matrix_beeper_linkedin_homeserver_address: "{{ matrix_addons_homeserver_client_api_url }}"
|
||||
matrix_beeper_linkedin_homeserver_token: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'linked.hs.token', rounds=655555) | to_uuid }}"
|
||||
matrix_beeper_linkedin_homeserver_token: "{{ (matrix_homeserver_generic_secret_key + ':linked.hs.token') | hash('sha512') | to_uuid }}"
|
||||
|
||||
matrix_beeper_linkedin_homeserver_async_media: "{{ matrix_homeserver_implementation in ['synapse'] }}"
|
||||
|
||||
@@ -975,7 +965,7 @@ matrix_beeper_linkedin_bridge_login_shared_secret_map_auto: |-
|
||||
matrix_beeper_linkedin_bridge_presence: "{{ (matrix_synapse_presence_enabled if matrix_synapse_enabled else true) if matrix_homeserver_implementation == 'synapse' else true }}"
|
||||
|
||||
matrix_beeper_linkedin_database_hostname: "{{ postgres_connection_hostname if postgres_enabled else '' }}"
|
||||
matrix_beeper_linkedin_database_password: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'maulinkedin.db', rounds=655555) | to_uuid }}"
|
||||
matrix_beeper_linkedin_database_password: "{{ (matrix_homeserver_generic_secret_key + ':maulinkedin.db') | hash('sha512') | to_uuid }}"
|
||||
|
||||
######################################################################
|
||||
#
|
||||
@@ -1024,14 +1014,14 @@ matrix_mautrix_bluesky_container_labels_traefik_tls_certResolver: "{{ traefik_ce
|
||||
matrix_mautrix_bluesky_container_labels_metrics_middleware_basic_auth_enabled: "{{ matrix_metrics_exposure_http_basic_auth_enabled }}"
|
||||
matrix_mautrix_bluesky_container_labels_metrics_middleware_basic_auth_users: "{{ matrix_metrics_exposure_http_basic_auth_users }}"
|
||||
|
||||
matrix_mautrix_bluesky_appservice_token: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'bsky.as.token', rounds=655555) | to_uuid }}"
|
||||
matrix_mautrix_bluesky_appservice_token: "{{ (matrix_homeserver_generic_secret_key + ':bsky.as.token') | hash('sha512') | to_uuid }}"
|
||||
|
||||
matrix_mautrix_bluesky_homeserver_address: "{{ matrix_addons_homeserver_client_api_url }}"
|
||||
matrix_mautrix_bluesky_homeserver_token: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'bsky.hs.token', rounds=655555) | to_uuid }}"
|
||||
matrix_mautrix_bluesky_homeserver_token: "{{ (matrix_homeserver_generic_secret_key + ':bsky.hs.token') | hash('sha512') | to_uuid }}"
|
||||
|
||||
matrix_mautrix_bluesky_homeserver_async_media: "{{ matrix_homeserver_implementation in ['synapse'] }}"
|
||||
|
||||
matrix_mautrix_bluesky_provisioning_shared_secret: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'mau.bsky.prov', rounds=655555) | to_uuid }}"
|
||||
matrix_mautrix_bluesky_provisioning_shared_secret: "{{ (matrix_homeserver_generic_secret_key + ':mau.bsky.prov') | hash('sha512') | to_uuid }}"
|
||||
|
||||
matrix_mautrix_bluesky_double_puppet_secrets_auto: |-
|
||||
{{
|
||||
@@ -1049,7 +1039,7 @@ matrix_mautrix_bluesky_metrics_proxying_hostname: "{{ matrix_metrics_exposure_ho
|
||||
matrix_mautrix_bluesky_metrics_proxying_path_prefix: "{{ matrix_metrics_exposure_path_prefix }}/mautrix-bluesky"
|
||||
|
||||
matrix_mautrix_bluesky_database_hostname: "{{ postgres_connection_hostname if postgres_enabled else '' }}"
|
||||
matrix_mautrix_bluesky_database_password: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'mau.twt.db', rounds=655555) | to_uuid if postgres_enabled else '' }}"
|
||||
matrix_mautrix_bluesky_database_password: "{{ (matrix_homeserver_generic_secret_key + ':mau.twt.db') | hash('sha512') | to_uuid if postgres_enabled else '' }}"
|
||||
|
||||
######################################################################
|
||||
#
|
||||
@@ -1095,14 +1085,14 @@ matrix_mautrix_discord_systemd_required_services_list_auto: |
|
||||
([postgres_identifier ~ '.service'] if (postgres_enabled and matrix_mautrix_discord_database_hostname == postgres_connection_hostname) else [])
|
||||
}}
|
||||
|
||||
matrix_mautrix_discord_appservice_token: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'maudisc.as.tok', rounds=655555) | to_uuid }}"
|
||||
matrix_mautrix_discord_appservice_token: "{{ (matrix_homeserver_generic_secret_key + ':maudisc.as.tok') | hash('sha512') | to_uuid }}"
|
||||
|
||||
matrix_mautrix_discord_homeserver_address: "{{ matrix_addons_homeserver_client_api_url }}"
|
||||
matrix_mautrix_discord_homeserver_token: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'maudisc.hs.tok', rounds=655555) | to_uuid }}"
|
||||
matrix_mautrix_discord_homeserver_token: "{{ (matrix_homeserver_generic_secret_key + ':maudisc.hs.tok') | hash('sha512') | to_uuid }}"
|
||||
|
||||
matrix_mautrix_discord_homeserver_async_media: "{{ matrix_homeserver_implementation in ['synapse'] }}"
|
||||
|
||||
matrix_mautrix_discord_bridge_avatar_proxy_key: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'maudisc.avatar', rounds=655555) | to_uuid }}"
|
||||
matrix_mautrix_discord_bridge_avatar_proxy_key: "{{ (matrix_homeserver_generic_secret_key + ':maudisc.avatar') | hash('sha512') | to_uuid }}"
|
||||
|
||||
matrix_mautrix_discord_hostname: "{{ matrix_server_fqn_matrix }}"
|
||||
matrix_mautrix_discord_scheme: "{{ 'https' if matrix_playbook_ssl_enabled else 'http' }}"
|
||||
@@ -1123,7 +1113,7 @@ matrix_mautrix_discord_bridge_login_shared_secret_map_auto: |-
|
||||
# Postgres is the default, except if not using internal Postgres server
|
||||
matrix_mautrix_discord_database_engine: "{{ 'postgres' if postgres_enabled else 'sqlite' }}"
|
||||
matrix_mautrix_discord_database_hostname: "{{ postgres_connection_hostname if postgres_enabled else '' }}"
|
||||
matrix_mautrix_discord_database_password: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'maudiscord.db', rounds=655555) | to_uuid }}"
|
||||
matrix_mautrix_discord_database_password: "{{ (matrix_homeserver_generic_secret_key + ':maudiscord.db') | hash('sha512') | to_uuid }}"
|
||||
|
||||
######################################################################
|
||||
#
|
||||
@@ -1163,10 +1153,10 @@ matrix_mautrix_slack_container_additional_networks_auto: |-
|
||||
) | unique
|
||||
}}
|
||||
|
||||
matrix_mautrix_slack_appservice_token: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'mauslack.as.tok', rounds=655555) | to_uuid }}"
|
||||
matrix_mautrix_slack_appservice_token: "{{ (matrix_homeserver_generic_secret_key + ':mauslack.as.tok') | hash('sha512') | to_uuid }}"
|
||||
|
||||
matrix_mautrix_slack_homeserver_address: "{{ matrix_addons_homeserver_client_api_url }}"
|
||||
matrix_mautrix_slack_homeserver_token: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'mauslack.hs.tok', rounds=655555) | to_uuid }}"
|
||||
matrix_mautrix_slack_homeserver_token: "{{ (matrix_homeserver_generic_secret_key + ':mauslack.hs.tok') | hash('sha512') | to_uuid }}"
|
||||
|
||||
matrix_mautrix_slack_homeserver_async_media: "{{ matrix_homeserver_implementation in ['synapse'] }}"
|
||||
|
||||
@@ -1182,10 +1172,10 @@ matrix_mautrix_slack_double_puppet_secrets_auto: |-
|
||||
# Postgres is the default, except if not using internal Postgres server
|
||||
matrix_mautrix_slack_database_engine: "{{ 'postgres' if postgres_enabled else 'sqlite' }}"
|
||||
matrix_mautrix_slack_database_hostname: "{{ postgres_connection_hostname if postgres_enabled else '' }}"
|
||||
matrix_mautrix_slack_database_password: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'mauslack.db', rounds=655555) | to_uuid }}"
|
||||
matrix_mautrix_slack_database_password: "{{ (matrix_homeserver_generic_secret_key + ':mauslack.db') | hash('sha512') | to_uuid }}"
|
||||
|
||||
matrix_mautrix_slack_provisioning_shared_secret: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'mau.slack.prov', rounds=655555) | to_uuid }}"
|
||||
matrix_mautrix_slack_public_media_signing_key: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'mau.slack.pmed', rounds=655555) | to_uuid }}"
|
||||
matrix_mautrix_slack_provisioning_shared_secret: "{{ (matrix_homeserver_generic_secret_key + ':mau.slack.prov') | hash('sha512') | to_uuid }}"
|
||||
matrix_mautrix_slack_public_media_signing_key: "{{ (matrix_homeserver_generic_secret_key + ':mau.slack.pmed') | hash('sha512') | to_uuid }}"
|
||||
|
||||
######################################################################
|
||||
#
|
||||
@@ -1238,10 +1228,10 @@ matrix_mautrix_googlechat_container_labels_public_endpoint_hostname: "{{ matrix_
|
||||
matrix_mautrix_googlechat_container_labels_metrics_middleware_basic_auth_enabled: "{{ matrix_metrics_exposure_http_basic_auth_enabled }}"
|
||||
matrix_mautrix_googlechat_container_labels_metrics_middleware_basic_auth_users: "{{ matrix_metrics_exposure_http_basic_auth_users }}"
|
||||
|
||||
matrix_mautrix_googlechat_appservice_token: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'gc.as.token', rounds=655555) | to_uuid }}"
|
||||
matrix_mautrix_googlechat_appservice_token: "{{ (matrix_homeserver_generic_secret_key + ':gc.as.token') | hash('sha512') | to_uuid }}"
|
||||
|
||||
matrix_mautrix_googlechat_homeserver_address: "{{ matrix_addons_homeserver_client_api_url }}"
|
||||
matrix_mautrix_googlechat_homeserver_token: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'gc.hs.token', rounds=655555) | to_uuid }}"
|
||||
matrix_mautrix_googlechat_homeserver_token: "{{ (matrix_homeserver_generic_secret_key + ':gc.hs.token') | hash('sha512') | to_uuid }}"
|
||||
|
||||
matrix_mautrix_googlechat_login_shared_secret: |-
|
||||
{{
|
||||
@@ -1263,7 +1253,7 @@ matrix_mautrix_googlechat_metrics_proxying_path_prefix: "{{ matrix_metrics_expos
|
||||
# Postgres is the default, except if not using internal Postgres server
|
||||
matrix_mautrix_googlechat_database_engine: "{{ 'postgres' if postgres_enabled else 'sqlite' }}"
|
||||
matrix_mautrix_googlechat_database_hostname: "{{ postgres_connection_hostname if postgres_enabled else '' }}"
|
||||
matrix_mautrix_googlechat_database_password: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'mau.gc.db', rounds=655555) | to_uuid }}"
|
||||
matrix_mautrix_googlechat_database_password: "{{ (matrix_homeserver_generic_secret_key + ':mau.gc.db') | hash('sha512') | to_uuid }}"
|
||||
|
||||
######################################################################
|
||||
#
|
||||
@@ -1314,11 +1304,11 @@ matrix_mautrix_signal_container_labels_metrics_middleware_basic_auth_users: "{{
|
||||
|
||||
matrix_mautrix_signal_homeserver_domain: '{{ matrix_domain }}'
|
||||
matrix_mautrix_signal_homeserver_address: "{{ matrix_addons_homeserver_client_api_url }}"
|
||||
matrix_mautrix_signal_homeserver_token: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'si.hs.token', rounds=655555) | to_uuid }}"
|
||||
matrix_mautrix_signal_homeserver_token: "{{ (matrix_homeserver_generic_secret_key + ':si.hs.token') | hash('sha512') | to_uuid }}"
|
||||
|
||||
matrix_mautrix_signal_homeserver_async_media: "{{ matrix_homeserver_implementation in ['synapse'] }}"
|
||||
|
||||
matrix_mautrix_signal_appservice_token: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'si.as.token', rounds=655555) | to_uuid }}"
|
||||
matrix_mautrix_signal_appservice_token: "{{ (matrix_homeserver_generic_secret_key + ':si.as.token') | hash('sha512') | to_uuid }}"
|
||||
|
||||
matrix_mautrix_signal_double_puppet_secrets_auto: |-
|
||||
{{
|
||||
@@ -1337,10 +1327,10 @@ matrix_mautrix_signal_metrics_proxying_path_prefix: "{{ matrix_metrics_exposure_
|
||||
|
||||
matrix_mautrix_signal_database_engine: "{{ 'postgres' if postgres_enabled else 'sqlite' }}"
|
||||
matrix_mautrix_signal_database_hostname: "{{ postgres_connection_hostname if postgres_enabled else '' }}"
|
||||
matrix_mautrix_signal_database_password: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'mau.signal.db', rounds=655555) | to_uuid }}"
|
||||
matrix_mautrix_signal_database_password: "{{ (matrix_homeserver_generic_secret_key + ':mau.signal.db') | hash('sha512') | to_uuid }}"
|
||||
|
||||
matrix_mautrix_signal_provisioning_shared_secret: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'mau.signal.prov', rounds=655555) | to_uuid }}"
|
||||
matrix_mautrix_signal_public_media_signing_key: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'mau.signal.pmed', rounds=655555) | to_uuid }}"
|
||||
matrix_mautrix_signal_provisioning_shared_secret: "{{ (matrix_homeserver_generic_secret_key + ':mau.signal.prov') | hash('sha512') | to_uuid }}"
|
||||
matrix_mautrix_signal_public_media_signing_key: "{{ (matrix_homeserver_generic_secret_key + ':mau.signal.pmed') | hash('sha512') | to_uuid }}"
|
||||
|
||||
######################################################################
|
||||
#
|
||||
@@ -1390,11 +1380,11 @@ matrix_mautrix_meta_messenger_container_labels_traefik_tls_certResolver: "{{ tra
|
||||
matrix_mautrix_meta_messenger_container_labels_metrics_middleware_basic_auth_enabled: "{{ matrix_metrics_exposure_http_basic_auth_enabled }}"
|
||||
matrix_mautrix_meta_messenger_container_labels_metrics_middleware_basic_auth_users: "{{ matrix_metrics_exposure_http_basic_auth_users }}"
|
||||
|
||||
matrix_mautrix_meta_messenger_appservice_token: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'mau.meta.fb.as', rounds=655555) | to_uuid }}"
|
||||
matrix_mautrix_meta_messenger_appservice_token: "{{ (matrix_homeserver_generic_secret_key + ':mau.meta.fb.as') | hash('sha512') | to_uuid }}"
|
||||
|
||||
matrix_mautrix_meta_messenger_homeserver_address: "{{ matrix_addons_homeserver_client_api_url }}"
|
||||
|
||||
matrix_mautrix_meta_messenger_homeserver_token: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'mau.meta.fb.hs', rounds=655555) | to_uuid }}"
|
||||
matrix_mautrix_meta_messenger_homeserver_token: "{{ (matrix_homeserver_generic_secret_key + ':mau.meta.fb.hs') | hash('sha512') | to_uuid }}"
|
||||
|
||||
matrix_mautrix_meta_messenger_homeserver_async_media: "{{ matrix_homeserver_implementation in ['synapse'] }}"
|
||||
|
||||
@@ -1417,7 +1407,7 @@ matrix_mautrix_meta_messenger_metrics_proxying_path_prefix: "{{ matrix_metrics_e
|
||||
# and point them to a migration path.
|
||||
matrix_mautrix_meta_messenger_database_engine: "{{ 'postgres' if postgres_enabled else 'sqlite3-fk-wal' }}"
|
||||
matrix_mautrix_meta_messenger_database_hostname: "{{ postgres_connection_hostname if (postgres_enabled and matrix_mautrix_meta_messenger_database_engine == 'postgres') else '' }}"
|
||||
matrix_mautrix_meta_messenger_database_password: "{{ ('%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'mau.fb.db', rounds=655555) | to_uuid) if (postgres_enabled and matrix_mautrix_meta_messenger_database_engine == 'postgres') else '' }}"
|
||||
matrix_mautrix_meta_messenger_database_password: "{{ ((matrix_homeserver_generic_secret_key + ':mau.fb.db') | hash('sha512') | to_uuid) if (postgres_enabled and matrix_mautrix_meta_messenger_database_engine == 'postgres') else '' }}"
|
||||
|
||||
######################################################################
|
||||
#
|
||||
@@ -1468,11 +1458,11 @@ matrix_mautrix_meta_instagram_container_labels_traefik_tls_certResolver: "{{ tra
|
||||
matrix_mautrix_meta_instagram_container_labels_metrics_middleware_basic_auth_enabled: "{{ matrix_metrics_exposure_http_basic_auth_enabled }}"
|
||||
matrix_mautrix_meta_instagram_container_labels_metrics_middleware_basic_auth_users: "{{ matrix_metrics_exposure_http_basic_auth_users }}"
|
||||
|
||||
matrix_mautrix_meta_instagram_appservice_token: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'mau.meta.ig.as', rounds=655555) | to_uuid }}"
|
||||
matrix_mautrix_meta_instagram_appservice_token: "{{ (matrix_homeserver_generic_secret_key + ':mau.meta.ig.as') | hash('sha512') | to_uuid }}"
|
||||
|
||||
matrix_mautrix_meta_instagram_homeserver_address: "{{ matrix_addons_homeserver_client_api_url }}"
|
||||
|
||||
matrix_mautrix_meta_instagram_homeserver_token: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'mau.meta.ig.hs', rounds=655555) | to_uuid }}"
|
||||
matrix_mautrix_meta_instagram_homeserver_token: "{{ (matrix_homeserver_generic_secret_key + ':mau.meta.ig.hs') | hash('sha512') | to_uuid }}"
|
||||
|
||||
matrix_mautrix_meta_instagram_homeserver_async_media: "{{ matrix_homeserver_implementation in ['synapse'] }}"
|
||||
|
||||
@@ -1495,7 +1485,7 @@ matrix_mautrix_meta_instagram_metrics_proxying_path_prefix: "{{ matrix_metrics_e
|
||||
# and point them to a migration path.
|
||||
matrix_mautrix_meta_instagram_database_engine: "{{ 'postgres' if postgres_enabled else 'sqlite3-fk-wal' }}"
|
||||
matrix_mautrix_meta_instagram_database_hostname: "{{ postgres_connection_hostname if (postgres_enabled and matrix_mautrix_meta_instagram_database_engine == 'postgres') else '' }}"
|
||||
matrix_mautrix_meta_instagram_database_password: "{{ ('%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'mau.fb.db', rounds=655555) | to_uuid) if (postgres_enabled and matrix_mautrix_meta_instagram_database_engine == 'postgres') else '' }}"
|
||||
matrix_mautrix_meta_instagram_database_password: "{{ ((matrix_homeserver_generic_secret_key + ':mau.fb.db') | hash('sha512') | to_uuid) if (postgres_enabled and matrix_mautrix_meta_instagram_database_engine == 'postgres') else '' }}"
|
||||
|
||||
######################################################################
|
||||
#
|
||||
@@ -1514,7 +1504,7 @@ matrix_mautrix_meta_instagram_database_password: "{{ ('%s' | format(matrix_homes
|
||||
matrix_mautrix_telegram_enabled: false
|
||||
|
||||
matrix_mautrix_telegram_hostname: "{{ matrix_server_fqn_matrix }}"
|
||||
matrix_mautrix_telegram_path_prefix: "/{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'telegram', rounds=655555) | to_uuid }}"
|
||||
matrix_mautrix_telegram_path_prefix: "/{{ (matrix_homeserver_generic_secret_key + ':telegram') | hash('sha512') | to_uuid }}"
|
||||
|
||||
matrix_mautrix_telegram_systemd_required_services_list_auto: |
|
||||
{{
|
||||
@@ -1555,11 +1545,11 @@ matrix_mautrix_telegram_container_labels_traefik_tls_certResolver: "{{ traefik_c
|
||||
matrix_mautrix_telegram_container_labels_metrics_middleware_basic_auth_enabled: "{{ matrix_metrics_exposure_http_basic_auth_enabled }}"
|
||||
matrix_mautrix_telegram_container_labels_metrics_middleware_basic_auth_users: "{{ matrix_metrics_exposure_http_basic_auth_users }}"
|
||||
|
||||
matrix_mautrix_telegram_appservice_token: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'telegr.as.token', rounds=655555) | to_uuid }}"
|
||||
matrix_mautrix_telegram_appservice_token: "{{ (matrix_homeserver_generic_secret_key + ':telegr.as.token') | hash('sha512') | to_uuid }}"
|
||||
|
||||
matrix_mautrix_telegram_homeserver_domain: "{{ matrix_domain }}"
|
||||
matrix_mautrix_telegram_homeserver_address: "{{ matrix_addons_homeserver_client_api_url }}"
|
||||
matrix_mautrix_telegram_homeserver_token: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'telegr.hs.token', rounds=655555) | to_uuid }}"
|
||||
matrix_mautrix_telegram_homeserver_token: "{{ (matrix_homeserver_generic_secret_key + ':telegr.hs.token') | hash('sha512') | to_uuid }}"
|
||||
|
||||
matrix_mautrix_telegram_homeserver_async_media: "{{ matrix_homeserver_implementation in ['synapse'] }}"
|
||||
|
||||
@@ -1585,7 +1575,7 @@ matrix_mautrix_telegram_metrics_proxying_path_prefix: "{{ matrix_metrics_exposur
|
||||
# Postgres is the default, except if not using internal Postgres server
|
||||
matrix_mautrix_telegram_database_engine: "{{ 'postgres' if postgres_enabled else 'sqlite' }}"
|
||||
matrix_mautrix_telegram_database_hostname: "{{ postgres_connection_hostname if postgres_enabled else '' }}"
|
||||
matrix_mautrix_telegram_database_password: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'mau.telegram.db', rounds=655555) | to_uuid }}"
|
||||
matrix_mautrix_telegram_database_password: "{{ (matrix_homeserver_generic_secret_key + ':mau.telegram.db') | hash('sha512') | to_uuid }}"
|
||||
|
||||
######################################################################
|
||||
#
|
||||
@@ -1634,14 +1624,14 @@ matrix_mautrix_twitter_container_labels_traefik_tls_certResolver: "{{ traefik_ce
|
||||
matrix_mautrix_twitter_container_labels_metrics_middleware_basic_auth_enabled: "{{ matrix_metrics_exposure_http_basic_auth_enabled }}"
|
||||
matrix_mautrix_twitter_container_labels_metrics_middleware_basic_auth_users: "{{ matrix_metrics_exposure_http_basic_auth_users }}"
|
||||
|
||||
matrix_mautrix_twitter_appservice_token: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'twt.as.token', rounds=655555) | to_uuid }}"
|
||||
matrix_mautrix_twitter_appservice_token: "{{ (matrix_homeserver_generic_secret_key + ':twt.as.token') | hash('sha512') | to_uuid }}"
|
||||
|
||||
matrix_mautrix_twitter_homeserver_address: "{{ matrix_addons_homeserver_client_api_url }}"
|
||||
matrix_mautrix_twitter_homeserver_token: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'twt.hs.token', rounds=655555) | to_uuid }}"
|
||||
matrix_mautrix_twitter_homeserver_token: "{{ (matrix_homeserver_generic_secret_key + ':twt.hs.token') | hash('sha512') | to_uuid }}"
|
||||
|
||||
matrix_mautrix_twitter_homeserver_async_media: "{{ matrix_homeserver_implementation in ['synapse'] }}"
|
||||
|
||||
matrix_mautrix_twitter_provisioning_shared_secret: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'mau.twit.prov', rounds=655555) | to_uuid }}"
|
||||
matrix_mautrix_twitter_provisioning_shared_secret: "{{ (matrix_homeserver_generic_secret_key + ':mau.twit.prov') | hash('sha512') | to_uuid }}"
|
||||
|
||||
matrix_mautrix_twitter_double_puppet_secrets_auto: |-
|
||||
{{
|
||||
@@ -1659,7 +1649,7 @@ matrix_mautrix_twitter_metrics_proxying_hostname: "{{ matrix_metrics_exposure_ho
|
||||
matrix_mautrix_twitter_metrics_proxying_path_prefix: "{{ matrix_metrics_exposure_path_prefix }}/mautrix-twitter"
|
||||
|
||||
matrix_mautrix_twitter_database_hostname: "{{ postgres_connection_hostname if postgres_enabled else '' }}"
|
||||
matrix_mautrix_twitter_database_password: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'mau.twt.db', rounds=655555) | to_uuid if postgres_enabled else '' }}"
|
||||
matrix_mautrix_twitter_database_password: "{{ (matrix_homeserver_generic_secret_key + ':mau.twt.db') | hash('sha512') | to_uuid if postgres_enabled else '' }}"
|
||||
|
||||
######################################################################
|
||||
#
|
||||
@@ -1708,10 +1698,10 @@ matrix_mautrix_gmessages_container_labels_traefik_tls_certResolver: "{{ traefik_
|
||||
matrix_mautrix_gmessages_container_labels_metrics_middleware_basic_auth_enabled: "{{ matrix_metrics_exposure_http_basic_auth_enabled }}"
|
||||
matrix_mautrix_gmessages_container_labels_metrics_middleware_basic_auth_users: "{{ matrix_metrics_exposure_http_basic_auth_users }}"
|
||||
|
||||
matrix_mautrix_gmessages_appservice_token: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'gmessa.as.token', rounds=655555) | to_uuid }}"
|
||||
matrix_mautrix_gmessages_appservice_token: "{{ (matrix_homeserver_generic_secret_key + ':gmessa.as.token') | hash('sha512') | to_uuid }}"
|
||||
|
||||
matrix_mautrix_gmessages_homeserver_address: "{{ matrix_addons_homeserver_client_api_url }}"
|
||||
matrix_mautrix_gmessages_homeserver_token: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'gmessa.hs.token', rounds=655555) | to_uuid }}"
|
||||
matrix_mautrix_gmessages_homeserver_token: "{{ (matrix_homeserver_generic_secret_key + ':gmessa.hs.token') | hash('sha512') | to_uuid }}"
|
||||
|
||||
matrix_mautrix_gmessages_homeserver_async_media: "{{ matrix_homeserver_implementation in ['synapse'] }}"
|
||||
|
||||
@@ -1733,7 +1723,7 @@ matrix_mautrix_gmessages_metrics_proxying_path_prefix: "{{ matrix_metrics_exposu
|
||||
# Postgres is the default, except if not using internal Postgres server
|
||||
matrix_mautrix_gmessages_database_engine: "{{ 'postgres' if postgres_enabled else 'sqlite' }}"
|
||||
matrix_mautrix_gmessages_database_hostname: "{{ postgres_connection_hostname if postgres_enabled else '' }}"
|
||||
matrix_mautrix_gmessages_database_password: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'maugmessages.db', rounds=655555) | to_uuid }}"
|
||||
matrix_mautrix_gmessages_database_password: "{{ (matrix_homeserver_generic_secret_key + ':maugmessages.db') | hash('sha512') | to_uuid }}"
|
||||
|
||||
######################################################################
|
||||
#
|
||||
@@ -1785,7 +1775,7 @@ matrix_mautrix_wsproxy_container_labels_traefik_entrypoints: "{{ traefik_entrypo
|
||||
matrix_mautrix_wsproxy_container_labels_traefik_tls_certResolver: "{{ traefik_certResolver_primary }}"
|
||||
|
||||
matrix_mautrix_wsproxy_syncproxy_database_hostname: "{{ postgres_connection_hostname if postgres_enabled else '' }}"
|
||||
matrix_mautrix_wsproxy_syncproxy_database_password: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'wsproxy.db', rounds=655555) | to_uuid }}"
|
||||
matrix_mautrix_wsproxy_syncproxy_database_password: "{{ (matrix_homeserver_generic_secret_key + ':wsproxy.db') | hash('sha512') | to_uuid }}"
|
||||
|
||||
######################################################################
|
||||
#
|
||||
@@ -1828,21 +1818,21 @@ matrix_wechat_container_additional_networks_auto: |-
|
||||
) | unique
|
||||
}}
|
||||
|
||||
matrix_wechat_appservice_token: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'wechat.as.token', rounds=655555) | to_uuid }}"
|
||||
matrix_wechat_appservice_token: "{{ (matrix_homeserver_generic_secret_key + ':wechat.as.token') | hash('sha512') | to_uuid }}"
|
||||
|
||||
matrix_wechat_homeserver_address: "{{ matrix_addons_homeserver_client_api_url }}"
|
||||
matrix_wechat_homeserver_token: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'wechat.hs.token', rounds=655555) | to_uuid }}"
|
||||
matrix_wechat_homeserver_token: "{{ (matrix_homeserver_generic_secret_key + ':wechat.hs.token') | hash('sha512') | to_uuid }}"
|
||||
|
||||
matrix_wechat_homeserver_async_media: "{{ matrix_homeserver_implementation in ['synapse'] }}"
|
||||
|
||||
matrix_wechat_login_shared_secret: "{{ matrix_synapse_ext_password_provider_shared_secret_auth_shared_secret if matrix_synapse_ext_password_provider_shared_secret_auth_enabled else '' }}"
|
||||
|
||||
matrix_wechat_bridge_listen_secret: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'wechat.lstn', rounds=655555) | to_uuid }}"
|
||||
matrix_wechat_bridge_listen_secret: "{{ (matrix_homeserver_generic_secret_key + ':wechat.lstn') | hash('sha512') | to_uuid }}"
|
||||
|
||||
# Postgres is the default, except if not using internal Postgres server
|
||||
matrix_wechat_database_engine: "{{ 'postgres' if postgres_enabled else 'sqlite' }}"
|
||||
matrix_wechat_database_hostname: "{{ postgres_connection_hostname if postgres_enabled else '' }}"
|
||||
matrix_wechat_database_password: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'gowechat.db', rounds=655555) | to_uuid }}"
|
||||
matrix_wechat_database_password: "{{ (matrix_homeserver_generic_secret_key + ':gowechat.db') | hash('sha512') | to_uuid }}"
|
||||
|
||||
######################################################################
|
||||
#
|
||||
@@ -1891,10 +1881,10 @@ matrix_mautrix_whatsapp_systemd_required_services_list_auto: |
|
||||
([postgres_identifier ~ '.service'] if postgres_enabled and matrix_mautrix_whatsapp_database_hostname == postgres_connection_hostname else [])
|
||||
}}
|
||||
|
||||
matrix_mautrix_whatsapp_appservice_token: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'whats.as.token', rounds=655555) | to_uuid }}"
|
||||
matrix_mautrix_whatsapp_appservice_token: "{{ (matrix_homeserver_generic_secret_key + ':wa.as.token') | hash('sha512') | to_uuid }}"
|
||||
|
||||
matrix_mautrix_whatsapp_homeserver_address: "{{ matrix_addons_homeserver_client_api_url }}"
|
||||
matrix_mautrix_whatsapp_homeserver_token: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'whats.hs.token', rounds=655555) | to_uuid }}"
|
||||
matrix_mautrix_whatsapp_homeserver_token: "{{ (matrix_homeserver_generic_secret_key + ':wa.hs.token') | hash('sha512') | to_uuid }}"
|
||||
|
||||
matrix_mautrix_whatsapp_homeserver_async_media: "{{ matrix_homeserver_implementation in ['synapse'] }}"
|
||||
|
||||
@@ -1916,7 +1906,7 @@ matrix_mautrix_whatsapp_metrics_proxying_path_prefix: "{{ matrix_metrics_exposur
|
||||
# Postgres is the default, except if not using internal Postgres server
|
||||
matrix_mautrix_whatsapp_database_engine: "{{ 'postgres' if postgres_enabled else 'sqlite' }}"
|
||||
matrix_mautrix_whatsapp_database_hostname: "{{ postgres_connection_hostname if postgres_enabled else '' }}"
|
||||
matrix_mautrix_whatsapp_database_password: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'mauwhatsapp.db', rounds=655555) | to_uuid }}"
|
||||
matrix_mautrix_whatsapp_database_password: "{{ (matrix_homeserver_generic_secret_key + ':mauwhatsapp.db') | hash('sha512') | to_uuid }}"
|
||||
|
||||
######################################################################
|
||||
#
|
||||
@@ -1947,11 +1937,11 @@ matrix_sms_bridge_container_additional_networks_auto: |-
|
||||
([] if matrix_addons_homeserver_container_network == '' else [matrix_addons_homeserver_container_network])
|
||||
}}
|
||||
|
||||
matrix_sms_bridge_appservice_token: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'sms.as.token', rounds=655555) | to_uuid }}"
|
||||
matrix_sms_bridge_appservice_token: "{{ (matrix_homeserver_generic_secret_key + ':sms.as.token') | hash('sha512') | to_uuid }}"
|
||||
|
||||
matrix_sms_bridge_homeserver_hostname: "{{ (matrix_homeserver_container_client_api_endpoint | split(':'))[0] }}"
|
||||
matrix_sms_bridge_homeserver_port: "{{ (matrix_homeserver_container_client_api_endpoint | split(':'))[1] }}"
|
||||
matrix_sms_bridge_homeserver_token: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'sms.hs.token', rounds=655555) | to_uuid }}"
|
||||
matrix_sms_bridge_homeserver_token: "{{ (matrix_homeserver_generic_secret_key + ':sms.hs.token') | hash('sha512') | to_uuid }}"
|
||||
|
||||
######################################################################
|
||||
#
|
||||
@@ -1993,9 +1983,9 @@ matrix_heisenbridge_container_labels_traefik_docker_network: "{{ matrix_playbook
|
||||
matrix_heisenbridge_container_labels_traefik_entrypoints: "{{ traefik_entrypoint_primary }}"
|
||||
matrix_heisenbridge_container_labels_traefik_tls_certResolver: "{{ traefik_certResolver_primary }}"
|
||||
|
||||
matrix_heisenbridge_appservice_token: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'heisen.as.tok', rounds=655555) | to_uuid }}"
|
||||
matrix_heisenbridge_appservice_token: "{{ (matrix_homeserver_generic_secret_key + ':heisen.as.tok') | hash('sha512') | to_uuid }}"
|
||||
|
||||
matrix_heisenbridge_homeserver_token: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'heisen.hs.tok', rounds=655555) | to_uuid }}"
|
||||
matrix_heisenbridge_homeserver_token: "{{ (matrix_homeserver_generic_secret_key + ':heisen.hs.tok') | hash('sha512') | to_uuid }}"
|
||||
|
||||
matrix_heisenbridge_homeserver_url: "{{ matrix_addons_homeserver_client_api_url }}"
|
||||
|
||||
@@ -2018,9 +2008,9 @@ matrix_hookshot_docker_image_registry_prefix_upstream: "{{ matrix_container_glob
|
||||
|
||||
matrix_hookshot_container_image_self_build: "{{ matrix_architecture not in ['arm64', 'amd64'] }}"
|
||||
|
||||
matrix_hookshot_appservice_token: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'hookshot.as.tok', rounds=655555) | to_uuid }}"
|
||||
matrix_hookshot_appservice_token: "{{ (matrix_homeserver_generic_secret_key + ':hookshot.as.tok') | hash('sha512') | to_uuid }}"
|
||||
|
||||
matrix_hookshot_homeserver_token: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'hookshot.hs.tok', rounds=655555) | to_uuid }}"
|
||||
matrix_hookshot_homeserver_token: "{{ (matrix_homeserver_generic_secret_key + ':hookshot.hs.tok') | hash('sha512') | to_uuid }}"
|
||||
|
||||
matrix_hookshot_homeserver_address: "{{ matrix_addons_homeserver_client_api_url }}"
|
||||
|
||||
@@ -2078,55 +2068,6 @@ matrix_hookshot_public_hostname: "{{ matrix_server_fqn_matrix }}"
|
||||
#
|
||||
######################################################################
|
||||
|
||||
######################################################################
|
||||
#
|
||||
# matrix-bridge-zulip
|
||||
#
|
||||
######################################################################
|
||||
|
||||
# We don't enable bridges by default.
|
||||
matrix_zulip_bridge_enabled: false
|
||||
|
||||
matrix_zulip_bridge_scheme: "{{ 'https' if matrix_playbook_ssl_enabled else 'http' }}"
|
||||
|
||||
# Set this to your Matrix ID if you want to enforce the owner, otherwise first _local_ user becomes one
|
||||
matrix_zulip_bridge_owner: "{{ matrix_admin if matrix_admin else '' }}"
|
||||
|
||||
matrix_zulip_bridge_systemd_required_services_list_auto: |
|
||||
{{
|
||||
matrix_addons_homeserver_systemd_services_list
|
||||
}}
|
||||
|
||||
matrix_zulip_bridge_docker_image_registry_prefix_upstream: "{{ matrix_container_global_registry_prefix_override if matrix_container_global_registry_prefix_override else matrix_zulip_bridge_docker_image_registry_prefix_upstream_default }}"
|
||||
|
||||
matrix_zulip_bridge_container_network: "{{ matrix_addons_container_network }}"
|
||||
|
||||
matrix_zulip_bridge_container_additional_networks_auto: |-
|
||||
{{
|
||||
(
|
||||
([] if matrix_addons_homeserver_container_network == '' else [matrix_addons_homeserver_container_network])
|
||||
+
|
||||
[matrix_playbook_reverse_proxyable_services_additional_network] if (matrix_zulip_bridge_container_labels_traefik_enabled and matrix_playbook_reverse_proxyable_services_additional_network) else []
|
||||
) | unique
|
||||
}}
|
||||
|
||||
matrix_zulip_bridge_container_labels_traefik_enabled: "{{ matrix_playbook_reverse_proxy_type in ['playbook-managed-traefik', 'other-traefik-container'] }}"
|
||||
matrix_zulip_bridge_container_labels_traefik_docker_network: "{{ matrix_playbook_reverse_proxyable_services_additional_network }}"
|
||||
matrix_zulip_bridge_container_labels_traefik_entrypoints: "{{ traefik_entrypoint_primary }}"
|
||||
matrix_zulip_bridge_container_labels_traefik_tls_certResolver: "{{ traefik_certResolver_primary }}"
|
||||
|
||||
matrix_zulip_bridge_appservice_token: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'zulip.as.tok', rounds=655555) | to_uuid }}"
|
||||
|
||||
matrix_zulip_bridge_homeserver_token: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'zulip.hs.tok', rounds=655555) | to_uuid }}"
|
||||
|
||||
matrix_zulip_bridge_homeserver_url: "{{ matrix_addons_homeserver_client_api_url }}"
|
||||
|
||||
######################################################################
|
||||
#
|
||||
# /matrix-bridge-zulip
|
||||
#
|
||||
######################################################################
|
||||
|
||||
######################################################################
|
||||
#
|
||||
# matrix-bridge-mx-puppet-steam
|
||||
@@ -2158,10 +2099,10 @@ matrix_mx_puppet_steam_container_additional_networks_auto: |-
|
||||
) | unique
|
||||
}}
|
||||
|
||||
matrix_mx_puppet_steam_appservice_token: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'mxste.as.tok', rounds=655555) | to_uuid }}"
|
||||
matrix_mx_puppet_steam_appservice_token: "{{ (matrix_homeserver_generic_secret_key + ':mxste.as.tok') | hash('sha512') | to_uuid }}"
|
||||
|
||||
matrix_mx_puppet_steam_homeserver_address: "{{ matrix_addons_homeserver_client_api_url }}"
|
||||
matrix_mx_puppet_steam_homeserver_token: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'mxste.hs.tok', rounds=655555) | to_uuid }}"
|
||||
matrix_mx_puppet_steam_homeserver_token: "{{ (matrix_homeserver_generic_secret_key + ':mxste.hs.tok') | hash('sha512') | to_uuid }}"
|
||||
|
||||
matrix_mx_puppet_steam_login_shared_secret: "{{ matrix_synapse_ext_password_provider_shared_secret_auth_shared_secret if matrix_synapse_ext_password_provider_shared_secret_auth_enabled else '' }}"
|
||||
|
||||
@@ -2170,7 +2111,7 @@ matrix_mx_puppet_steam_presence_enabled: "{{ matrix_homeserver_implementation !=
|
||||
# Postgres is the default, except if not using internal Postgres server
|
||||
matrix_mx_puppet_steam_database_engine: "{{ 'postgres' if postgres_enabled else 'sqlite' }}"
|
||||
matrix_mx_puppet_steam_database_hostname: "{{ postgres_connection_hostname if postgres_enabled else '' }}"
|
||||
matrix_mx_puppet_steam_database_password: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'mxpup.steam.db', rounds=655555) | to_uuid }}"
|
||||
matrix_mx_puppet_steam_database_password: "{{ (matrix_homeserver_generic_secret_key + ':mxpup.steam.db') | hash('sha512') | to_uuid }}"
|
||||
|
||||
######################################################################
|
||||
#
|
||||
@@ -2210,10 +2151,10 @@ matrix_mx_puppet_groupme_container_additional_networks_auto: |-
|
||||
) | unique
|
||||
}}
|
||||
|
||||
matrix_mx_puppet_groupme_appservice_token: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'mxgro.as.tok', rounds=655555) | to_uuid }}"
|
||||
matrix_mx_puppet_groupme_appservice_token: "{{ (matrix_homeserver_generic_secret_key + ':mxgro.as.tok') | hash('sha512') | to_uuid }}"
|
||||
|
||||
matrix_mx_puppet_groupme_homeserver_address: "{{ matrix_addons_homeserver_client_api_url }}"
|
||||
matrix_mx_puppet_groupme_homeserver_token: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'mxgro.hs.tok', rounds=655555) | to_uuid }}"
|
||||
matrix_mx_puppet_groupme_homeserver_token: "{{ (matrix_homeserver_generic_secret_key + ':mxgro.hs.tok') | hash('sha512') | to_uuid }}"
|
||||
|
||||
matrix_mx_puppet_groupme_login_shared_secret: "{{ matrix_synapse_ext_password_provider_shared_secret_auth_shared_secret if matrix_synapse_ext_password_provider_shared_secret_auth_enabled else '' }}"
|
||||
|
||||
@@ -2222,7 +2163,7 @@ matrix_mx_puppet_groupme_presence_enabled: "{{ matrix_homeserver_implementation
|
||||
# Postgres is the default, except if not using internal Postgres server
|
||||
matrix_mx_puppet_groupme_database_engine: "{{ 'postgres' if postgres_enabled else 'sqlite' }}"
|
||||
matrix_mx_puppet_groupme_database_hostname: "{{ postgres_connection_hostname if postgres_enabled else '' }}"
|
||||
matrix_mx_puppet_groupme_database_password: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'mxpup.groupme.db', rounds=655555) | to_uuid }}"
|
||||
matrix_mx_puppet_groupme_database_password: "{{ (matrix_homeserver_generic_secret_key + ':mxpup.groupme.db') | hash('sha512') | to_uuid }}"
|
||||
|
||||
######################################################################
|
||||
#
|
||||
@@ -2287,7 +2228,7 @@ matrix_postmoogle_systemd_required_services_list_auto: |
|
||||
# Postgres is the default, except if not using internal Postgres server
|
||||
matrix_postmoogle_database_engine: "{{ 'postgres' if postgres_enabled else 'sqlite' }}"
|
||||
matrix_postmoogle_database_hostname: "{{ postgres_connection_hostname if postgres_enabled else '' }}"
|
||||
matrix_postmoogle_database_password: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'postmoogle.db', rounds=655555) | to_uuid }}"
|
||||
matrix_postmoogle_database_password: "{{ (matrix_homeserver_generic_secret_key + ':postmoogle.db') | hash('sha512') | to_uuid }}"
|
||||
|
||||
matrix_postmoogle_homeserver: "{{ matrix_addons_homeserver_client_api_url }}"
|
||||
|
||||
@@ -2349,16 +2290,16 @@ matrix_steam_bridge_container_labels_traefik_tls_certResolver: "{{ traefik_certR
|
||||
matrix_steam_bridge_container_labels_metrics_middleware_basic_auth_enabled: "{{ matrix_metrics_exposure_http_basic_auth_enabled }}"
|
||||
matrix_steam_bridge_container_labels_metrics_middleware_basic_auth_users: "{{ matrix_metrics_exposure_http_basic_auth_users }}"
|
||||
|
||||
matrix_steam_bridge_appservice_token: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'steam.as.token', rounds=655555) | to_uuid }}"
|
||||
matrix_steam_bridge_appservice_token: "{{ (matrix_homeserver_generic_secret_key + ':steam.as.token') | hash('sha512') | to_uuid }}"
|
||||
|
||||
matrix_steam_bridge_homeserver_address: "{{ matrix_addons_homeserver_client_api_url }}"
|
||||
matrix_steam_bridge_homeserver_token: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'steam.hs.token', rounds=655555) | to_uuid }}"
|
||||
matrix_steam_bridge_homeserver_token: "{{ (matrix_homeserver_generic_secret_key + ':steam.hs.token') | hash('sha512') | to_uuid }}"
|
||||
|
||||
matrix_steam_bridge_homeserver_async_media: "{{ matrix_homeserver_implementation in ['synapse'] }}"
|
||||
|
||||
matrix_steam_bridge_public_media_signing_key: "{{ ('%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'steam.pub.key', rounds=655555) | to_uuid) if matrix_steam_bridge_public_media_enabled else '' }}"
|
||||
matrix_steam_bridge_public_media_signing_key: "{{ ((matrix_homeserver_generic_secret_key + ':steam.pub.key') | hash('sha512') | to_uuid) if matrix_steam_bridge_public_media_enabled else '' }}"
|
||||
|
||||
matrix_steam_bridge_provisioning_shared_secret: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'steam.prov', rounds=655555) | to_uuid }}"
|
||||
matrix_steam_bridge_provisioning_shared_secret: "{{ (matrix_homeserver_generic_secret_key + ':steam.prov') | hash('sha512') | to_uuid }}"
|
||||
|
||||
matrix_steam_bridge_double_puppet_secrets_auto: |-
|
||||
{{
|
||||
@@ -2376,7 +2317,7 @@ matrix_steam_bridge_metrics_proxying_hostname: "{{ matrix_metrics_exposure_hostn
|
||||
matrix_steam_bridge_metrics_proxying_path_prefix: "{{ matrix_metrics_exposure_path_prefix }}/matrix-steam-bridge"
|
||||
|
||||
matrix_steam_bridge_database_hostname: "{{ postgres_connection_hostname if postgres_enabled else '' }}"
|
||||
matrix_steam_bridge_database_password: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'mau.twt.db', rounds=655555) | to_uuid if postgres_enabled else '' }}"
|
||||
matrix_steam_bridge_database_password: "{{ (matrix_homeserver_generic_secret_key + ':mau.twt.db') | hash('sha512') | to_uuid if postgres_enabled else '' }}"
|
||||
|
||||
######################################################################
|
||||
#
|
||||
@@ -2420,7 +2361,7 @@ matrix_bot_matrix_reminder_bot_matrix_homeserver_url: "{{ matrix_addons_homeserv
|
||||
# Postgres is the default, except if not using internal Postgres server
|
||||
matrix_bot_matrix_reminder_bot_database_engine: "{{ 'postgres' if postgres_enabled else 'sqlite' }}"
|
||||
matrix_bot_matrix_reminder_bot_database_hostname: "{{ postgres_connection_hostname if postgres_enabled else '' }}"
|
||||
matrix_bot_matrix_reminder_bot_database_password: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'reminder.bot.db', rounds=655555) | to_uuid }}"
|
||||
matrix_bot_matrix_reminder_bot_database_password: "{{ (matrix_homeserver_generic_secret_key + ':reminder.bot.db') | hash('sha512') | to_uuid }}"
|
||||
|
||||
matrix_bot_matrix_reminder_bot_allowlist_enabled: true
|
||||
matrix_bot_matrix_reminder_bot_allowlist_regexes_auto:
|
||||
@@ -2525,7 +2466,7 @@ matrix_bot_maubot_container_labels_management_hostname: "{{ matrix_server_fqn_ma
|
||||
# Postgres is the default, except if not using internal Postgres server
|
||||
matrix_bot_maubot_database_engine: "{{ 'postgres' if postgres_enabled else 'sqlite' }}"
|
||||
matrix_bot_maubot_database_hostname: "{{ postgres_connection_hostname if postgres_enabled else '' }}"
|
||||
matrix_bot_maubot_database_password: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'mxpup.dsc.db', rounds=655555) | to_uuid }}"
|
||||
matrix_bot_maubot_database_password: "{{ (matrix_homeserver_generic_secret_key + ':mxpup.dsc.db') | hash('sha512') | to_uuid }}"
|
||||
|
||||
######################################################################
|
||||
#
|
||||
@@ -2583,7 +2524,7 @@ matrix_bot_honoroit_homeserver: "{{ matrix_addons_homeserver_client_api_url }}"
|
||||
# Postgres is the default, except if not using internal Postgres server
|
||||
matrix_bot_honoroit_database_engine: "{{ 'postgres' if postgres_enabled else 'sqlite' }}"
|
||||
matrix_bot_honoroit_database_hostname: "{{ postgres_connection_hostname if postgres_enabled else '' }}"
|
||||
matrix_bot_honoroit_database_password: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'honoroit.bot.db', rounds=655555) | to_uuid }}"
|
||||
matrix_bot_honoroit_database_password: "{{ (matrix_homeserver_generic_secret_key + ':honoroit.bot.db') | hash('sha512') | to_uuid }}"
|
||||
matrix_bot_honoroit_container_image_self_build: "{{ matrix_architecture not in ['amd64', 'arm64'] }}"
|
||||
|
||||
######################################################################
|
||||
@@ -2637,7 +2578,7 @@ matrix_bot_buscarron_homeserver: "{{ matrix_addons_homeserver_client_api_url }}"
|
||||
# Postgres is the default, except if not using internal Postgres server
|
||||
matrix_bot_buscarron_database_engine: "{{ 'postgres' if postgres_enabled else 'sqlite' }}"
|
||||
matrix_bot_buscarron_database_hostname: "{{ postgres_connection_hostname if postgres_enabled else '' }}"
|
||||
matrix_bot_buscarron_database_password: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'buscarron.bot.db', rounds=655555) | to_uuid }}"
|
||||
matrix_bot_buscarron_database_password: "{{ (matrix_homeserver_generic_secret_key + ':buscarron.bot.db') | hash('sha512') | to_uuid }}"
|
||||
|
||||
######################################################################
|
||||
#
|
||||
@@ -2808,7 +2749,7 @@ matrix_bot_draupnir_container_labels_web_abuseReporting_traefik_entrypoints: "{{
|
||||
matrix_bot_draupnir_container_labels_web_abuseReporting_traefik_tls_certResolver: "{{ traefik_certResolver_primary }}"
|
||||
|
||||
#The salt is size restricted here as a maximum salt size of 16 characters exists due to the functions used.
|
||||
matrix_bot_draupnir_config_web_synapseHTTPAntispam_authorization: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'draupnir.httpmod', rounds=655555) | to_uuid }}" # noqa var-naming
|
||||
matrix_bot_draupnir_config_web_synapseHTTPAntispam_authorization: "{{ (matrix_homeserver_generic_secret_key + ':draupnir.httpmod') | hash('sha512') | to_uuid }}" # noqa var-naming
|
||||
|
||||
######################################################################
|
||||
#
|
||||
@@ -2848,11 +2789,11 @@ matrix_appservice_draupnir_for_all_container_additional_networks_auto: |-
|
||||
) | unique
|
||||
}}
|
||||
|
||||
matrix_appservice_draupnir_for_all_appservice_token: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'd4a.as.token', rounds=655555) | to_uuid }}"
|
||||
matrix_appservice_draupnir_for_all_homeserver_token: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'd4a.hs.token', rounds=655555) | to_uuid }}"
|
||||
matrix_appservice_draupnir_for_all_appservice_token: "{{ (matrix_homeserver_generic_secret_key + ':d4a.as.token') | hash('sha512') | to_uuid }}"
|
||||
matrix_appservice_draupnir_for_all_homeserver_token: "{{ (matrix_homeserver_generic_secret_key + ':d4a.hs.token') | hash('sha512') | to_uuid }}"
|
||||
|
||||
matrix_appservice_draupnir_for_all_database_hostname: "{{ postgres_connection_hostname if postgres_enabled else '' }}"
|
||||
matrix_appservice_draupnir_for_all_database_password: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'as.d4a.db', rounds=655555) | to_uuid }}"
|
||||
matrix_appservice_draupnir_for_all_database_password: "{{ (matrix_homeserver_generic_secret_key + ':as.d4a.db') | hash('sha512') | to_uuid }}"
|
||||
|
||||
######################################################################
|
||||
#
|
||||
@@ -2869,8 +2810,8 @@ matrix_appservice_draupnir_for_all_database_password: "{{ '%s' | format(matrix_h
|
||||
|
||||
matrix_appservice_double_puppet_enabled: false
|
||||
|
||||
matrix_appservice_double_puppet_registration_as_token: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'as.doub.pup', rounds=655555) | to_uuid }}"
|
||||
matrix_appservice_double_puppet_registration_hs_token: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'hs.doub.pup', rounds=655555) | to_uuid }}"
|
||||
matrix_appservice_double_puppet_registration_as_token: "{{ (matrix_homeserver_generic_secret_key + ':as.doub.pup') | hash('sha512') | to_uuid }}"
|
||||
matrix_appservice_double_puppet_registration_hs_token: "{{ (matrix_homeserver_generic_secret_key + ':hs.doub.pup') | hash('sha512') | to_uuid }}"
|
||||
|
||||
######################################################################
|
||||
#
|
||||
@@ -2987,8 +2928,8 @@ matrix_cactus_comments_container_additional_networks_auto: |-
|
||||
([] if matrix_addons_homeserver_container_network == '' else [matrix_addons_homeserver_container_network])
|
||||
}}
|
||||
|
||||
matrix_cactus_comments_as_token: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'cactus.as.token', rounds=655555) | to_uuid }}"
|
||||
matrix_cactus_comments_hs_token: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'cactus.hs.token', rounds=655555) | to_uuid }}"
|
||||
matrix_cactus_comments_as_token: "{{ (matrix_homeserver_generic_secret_key + ':cactus.as.token') | hash('sha512') | to_uuid }}"
|
||||
matrix_cactus_comments_hs_token: "{{ (matrix_homeserver_generic_secret_key + ':cactus.hs.token') | hash('sha512') | to_uuid }}"
|
||||
|
||||
matrix_cactus_comments_homeserver_url: "{{ matrix_addons_homeserver_client_api_url }}"
|
||||
|
||||
@@ -3167,10 +3108,10 @@ matrix_coturn_container_image_self_build: "{{ matrix_architecture not in ['amd64
|
||||
# to allow auto-detection (via an EchoIP service) to happen at runtime.
|
||||
matrix_coturn_turn_external_ip_address: "{{ ansible_host }}"
|
||||
|
||||
matrix_coturn_turn_static_auth_secret: "{{ ('%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'coturn.sas', rounds=655555) | to_uuid) if matrix_coturn_authentication_method == 'auth-secret' else '' }}"
|
||||
matrix_coturn_turn_static_auth_secret: "{{ ((matrix_homeserver_generic_secret_key + ':coturn.sas') | hash('sha512') | to_uuid) if matrix_coturn_authentication_method == 'auth-secret' else '' }}"
|
||||
|
||||
matrix_coturn_lt_cred_mech_username: "{{ ('%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'coturn.user', rounds=655555) | to_uuid) if matrix_coturn_authentication_method == 'lt-cred-mech' else '' }}"
|
||||
matrix_coturn_lt_cred_mech_password: "{{ ('%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'coturn.pass', rounds=655555) | to_uuid) if matrix_coturn_authentication_method == 'lt-cred-mech' else '' }}"
|
||||
matrix_coturn_lt_cred_mech_username: "{{ ((matrix_homeserver_generic_secret_key + ':coturn.user') | hash('sha512') | to_uuid) if matrix_coturn_authentication_method == 'lt-cred-mech' else '' }}"
|
||||
matrix_coturn_lt_cred_mech_password: "{{ ((matrix_homeserver_generic_secret_key + ':coturn.pass') | hash('sha512') | to_uuid) if matrix_coturn_authentication_method == 'lt-cred-mech' else '' }}"
|
||||
|
||||
matrix_coturn_tls_enabled: "{{ matrix_playbook_ssl_enabled }}"
|
||||
|
||||
@@ -3282,7 +3223,7 @@ matrix_dimension_systemd_required_services_list_auto: |
|
||||
# Postgres is the default, except if not using internal Postgres server
|
||||
matrix_dimension_database_engine: "{{ 'postgres' if postgres_enabled else 'sqlite' }}"
|
||||
matrix_dimension_database_hostname: "{{ postgres_connection_hostname if postgres_enabled else '' }}"
|
||||
matrix_dimension_database_password: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'dimension.db', rounds=655555) | to_uuid }}"
|
||||
matrix_dimension_database_password: "{{ (matrix_homeserver_generic_secret_key + ':dimension.db') | hash('sha512') | to_uuid }}"
|
||||
|
||||
######################################################################
|
||||
#
|
||||
@@ -3338,7 +3279,7 @@ etherpad_systemd_required_services_list_auto: |
|
||||
etherpad_database_postgres_hostname: "{{ postgres_connection_hostname if postgres_enabled else '' }}"
|
||||
etherpad_database_name: matrix_etherpad
|
||||
etherpad_database_postgres_username: matrix_etherpad
|
||||
etherpad_database_postgres_password: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'etherpad.db', rounds=655555) | to_uuid }}"
|
||||
etherpad_database_postgres_password: "{{ (matrix_homeserver_generic_secret_key + ':etherpad.db') | hash('sha512') | to_uuid }}"
|
||||
|
||||
######################################################################
|
||||
#
|
||||
@@ -3348,19 +3289,26 @@ etherpad_database_postgres_password: "{{ '%s' | format(matrix_homeserver_generic
|
||||
|
||||
######################################################################
|
||||
#
|
||||
# matrix-dynamic-dns
|
||||
# ddclient
|
||||
#
|
||||
######################################################################
|
||||
|
||||
matrix_dynamic_dns_enabled: false
|
||||
ddclient_enabled: false
|
||||
|
||||
matrix_dynamic_dns_docker_image_registry_prefix_upstream: "{{ matrix_container_global_registry_prefix_override if matrix_container_global_registry_prefix_override else matrix_dynamic_dns_docker_image_registry_prefix_upstream_default }}"
|
||||
ddclient_identifier: matrix-dynamic-dns
|
||||
|
||||
matrix_dynamic_dns_container_network: matrix-dynamic-dns
|
||||
ddclient_base_path: "{{ matrix_base_data_path }}/dynamic-dns"
|
||||
|
||||
ddclient_container_image_registry_prefix: "{{ 'localhost/' if ddclient_container_image_self_build else ddclient_container_image_registry_prefix_upstream }}"
|
||||
ddclient_container_image_registry_prefix_upstream: "{{ matrix_container_global_registry_prefix_override if matrix_container_global_registry_prefix_override else ddclient_docker_image_registry_prefix_upstream_default }}"
|
||||
|
||||
ddclient_web: "https://cloudflare.com/cdn-cgi/trace"
|
||||
|
||||
ddclient_web_skip: "ip="
|
||||
|
||||
######################################################################
|
||||
#
|
||||
# /matrix-dynamic-dns
|
||||
# /ddclient
|
||||
#
|
||||
######################################################################
|
||||
|
||||
@@ -3419,9 +3367,9 @@ jitsi_container_labels_traefik_docker_network: "{{ matrix_playbook_reverse_proxy
|
||||
jitsi_container_labels_traefik_entrypoints: "{{ traefik_entrypoint_primary }}"
|
||||
jitsi_container_labels_traefik_tls_certResolver: "{{ traefik_certResolver_primary }}"
|
||||
|
||||
jitsi_jibri_xmpp_password: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'jibri', rounds=655555) | to_uuid }}"
|
||||
jitsi_jicofo_auth_password: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'jicofo', rounds=655555) | to_uuid }}"
|
||||
jitsi_jvb_auth_password: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'jvb', rounds=655555) | to_uuid }}"
|
||||
jitsi_jibri_xmpp_password: "{{ (matrix_homeserver_generic_secret_key + ':jibri') | hash('sha512') | to_uuid }}"
|
||||
jitsi_jicofo_auth_password: "{{ (matrix_homeserver_generic_secret_key + ':jicofo') | hash('sha512') | to_uuid }}"
|
||||
jitsi_jvb_auth_password: "{{ (matrix_homeserver_generic_secret_key + ':jvb') | hash('sha512') | to_uuid }}"
|
||||
|
||||
jitsi_web_stun_servers: |
|
||||
{{
|
||||
@@ -3543,95 +3491,6 @@ exim_relay_container_image_self_build: "{{ matrix_architecture not in ['amd64',
|
||||
# #
|
||||
########################################################################
|
||||
|
||||
|
||||
######################################################################
|
||||
#
|
||||
# matrix-ma1sd
|
||||
#
|
||||
######################################################################
|
||||
|
||||
# We no longer install the ma1sd identity server by default.
|
||||
#
|
||||
# The main reason we used to install ma1sd by default in the past was to
|
||||
# prevent Element from talking to the `matrix.org` / `vector.im` identity servers,
|
||||
# by forcing it to talk to our own self-hosted (but otherwise useless) identity server instead,
|
||||
# thus preventing contact list leaks.
|
||||
#
|
||||
# Since Element no longer defaults to using a public identity server if another one is not provided,
|
||||
# we can stop installing ma1sd.
|
||||
matrix_ma1sd_enabled: false
|
||||
|
||||
matrix_ma1sd_scheme: "{{ 'https' if matrix_playbook_ssl_enabled else 'http' }}"
|
||||
matrix_ma1sd_hostname: "{{ matrix_server_fqn_matrix }}"
|
||||
|
||||
matrix_ma1sd_docker_image_registry_prefix_upstream: "{{ matrix_container_global_registry_prefix_override if matrix_container_global_registry_prefix_override else matrix_ma1sd_docker_image_registry_prefix_upstream_default }}"
|
||||
|
||||
matrix_ma1sd_container_image_self_build: "{{ matrix_architecture != 'amd64' }}"
|
||||
|
||||
matrix_ma1sd_container_http_host_bind_port: "{{ (matrix_playbook_service_host_bind_interface_prefix ~ '' ~ matrix_ma1sd_container_port | string) if matrix_playbook_service_host_bind_interface_prefix else '' }}"
|
||||
|
||||
matrix_ma1sd_container_network: "{{ matrix_homeserver_container_network }}"
|
||||
|
||||
matrix_ma1sd_container_additional_networks_auto: |
|
||||
{{
|
||||
(
|
||||
([matrix_homeserver_container_network] if (matrix_ma1sd_container_network != matrix_homeserver_container_network) else [])
|
||||
+
|
||||
([postgres_container_network] if (postgres_enabled and matrix_ma1sd_database_hostname == postgres_connection_hostname and matrix_ma1sd_container_network != postgres_container_network) else [])
|
||||
+
|
||||
([exim_relay_container_network] if (exim_relay_enabled and matrix_ma1sd_threepid_medium_email_connectors_smtp_host == exim_relay_identifier and matrix_ma1sd_container_network != exim_relay_container_network) else [])
|
||||
+
|
||||
([matrix_playbook_reverse_proxyable_services_additional_network] if (matrix_playbook_reverse_proxyable_services_additional_network and matrix_ma1sd_container_labels_traefik_enabled) else [])
|
||||
) | unique
|
||||
}}
|
||||
|
||||
matrix_ma1sd_container_labels_traefik_enabled: "{{ matrix_playbook_reverse_proxy_type in ['playbook-managed-traefik', 'other-traefik-container'] }}"
|
||||
matrix_ma1sd_container_labels_traefik_docker_network: "{{ matrix_playbook_reverse_proxyable_services_additional_network }}"
|
||||
matrix_ma1sd_container_labels_traefik_entrypoints: "{{ traefik_entrypoint_primary }}"
|
||||
matrix_ma1sd_container_labels_traefik_tls_certResolver: "{{ traefik_certResolver_primary }}"
|
||||
|
||||
# We enable Synapse integration via its Postgres database by default.
|
||||
# When using another Identity store, you might wish to disable this and define
|
||||
# your own configuration in `matrix_ma1sd_configuration_extension_yaml`.
|
||||
matrix_ma1sd_synapsesql_enabled: true
|
||||
matrix_ma1sd_synapsesql_type: postgresql
|
||||
matrix_ma1sd_synapsesql_connection: //{{ matrix_synapse_database_host }}/{{ matrix_synapse_database_database }}?user={{ matrix_synapse_database_user | urlencode() }}&password={{ matrix_synapse_database_password | urlencode() }}
|
||||
|
||||
matrix_ma1sd_dns_overwrite_enabled: true
|
||||
matrix_ma1sd_dns_overwrite_homeserver_client_name: "{{ matrix_server_fqn_matrix }}"
|
||||
matrix_ma1sd_dns_overwrite_homeserver_client_value: "{{ matrix_addons_homeserver_client_api_url }}"
|
||||
|
||||
# By default, we send mail through the exim relay service.
|
||||
matrix_ma1sd_threepid_medium_email_identity_from: "{{ exim_relay_sender_address }}"
|
||||
matrix_ma1sd_threepid_medium_email_connectors_smtp_host: "{{ exim_relay_identifier }}"
|
||||
matrix_ma1sd_threepid_medium_email_connectors_smtp_port: 8025
|
||||
matrix_ma1sd_threepid_medium_email_connectors_smtp_tls: 0
|
||||
|
||||
matrix_ma1sd_self_check_validate_certificates: "{{ matrix_playbook_ssl_enabled }}"
|
||||
|
||||
matrix_ma1sd_systemd_required_services_list_auto: |
|
||||
{{
|
||||
matrix_addons_homeserver_systemd_services_list
|
||||
+
|
||||
([postgres_identifier ~ '.service'] if (postgres_enabled and matrix_ma1sd_database_hostname == postgres_connection_hostname) else [])
|
||||
}}
|
||||
|
||||
matrix_ma1sd_systemd_wanted_services_list_auto: |
|
||||
{{
|
||||
([exim_relay_identifier ~ '.service'] if (exim_relay_enabled and matrix_ma1sd_threepid_medium_email_connectors_smtp_host == exim_relay_identifier) else [])
|
||||
}}
|
||||
|
||||
# Postgres is the default, except if not using internal Postgres server
|
||||
matrix_ma1sd_database_engine: "{{ 'postgres' if postgres_enabled else 'sqlite' }}"
|
||||
matrix_ma1sd_database_hostname: "{{ postgres_connection_hostname if postgres_enabled else '' }}"
|
||||
matrix_ma1sd_database_password: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'ma1sd.db', rounds=655555) | to_uuid }}"
|
||||
|
||||
######################################################################
|
||||
#
|
||||
# /matrix-ma1sd
|
||||
#
|
||||
######################################################################
|
||||
|
||||
######################################################################
|
||||
#
|
||||
# matrix-media-repo
|
||||
@@ -3676,7 +3535,7 @@ matrix_media_repo_container_labels_traefik_metrics_middleware_basic_auth_users:
|
||||
|
||||
matrix_media_repo_database_hostname: "{{ postgres_connection_hostname if postgres_enabled else '' }}"
|
||||
matrix_media_repo_database_username: matrix_media_repo
|
||||
matrix_media_repo_database_password: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'mediarepo.db', rounds=655555) | to_uuid }}"
|
||||
matrix_media_repo_database_password: "{{ (matrix_homeserver_generic_secret_key + ':mediarepo.db') | hash('sha512') | to_uuid }}"
|
||||
matrix_media_repo_database_name: matrix_media_repo
|
||||
|
||||
matrix_media_repo_systemd_required_services_list_auto: |
|
||||
@@ -3823,12 +3682,6 @@ postgres_managed_databases_auto: |
|
||||
'password': matrix_authentication_service_config_database_password,
|
||||
}] if (matrix_authentication_service_enabled and matrix_authentication_service_config_database_host == postgres_connection_hostname) else [])
|
||||
+
|
||||
([{
|
||||
'name': matrix_ma1sd_database_name,
|
||||
'username': matrix_ma1sd_database_username,
|
||||
'password': matrix_ma1sd_database_password,
|
||||
}] if (matrix_ma1sd_enabled and matrix_ma1sd_database_engine == 'postgres' and matrix_ma1sd_database_hostname == postgres_connection_hostname) else [])
|
||||
+
|
||||
([{
|
||||
'name': matrix_bot_matrix_reminder_bot_database_name,
|
||||
'username': matrix_bot_matrix_reminder_bot_database_username,
|
||||
@@ -4436,11 +4289,6 @@ matrix_synapse_rust_synapse_compress_state_docker_image_registry_prefix_upstream
|
||||
|
||||
matrix_synapse_container_image_self_build: "{{ matrix_architecture not in ['arm64', 'amd64'] }}"
|
||||
|
||||
matrix_synapse_account_threepid_delegates_msisdn_mas1sd_url: "{{ ('http://matrix-ma1sd:' + matrix_ma1sd_container_port| string) }}"
|
||||
|
||||
# When ma1sd is enabled, we can use it to validate phone numbers. It's something that the homeserver cannot do by itself.
|
||||
matrix_synapse_account_threepid_delegates_msisdn: "{{ matrix_synapse_account_threepid_delegates_msisdn_mas1sd_url if matrix_ma1sd_enabled else '' }}"
|
||||
|
||||
# For exposing the Matrix Federation API's TLS port (HTTPS) to the internet on all network interfaces.
|
||||
matrix_synapse_container_federation_api_tls_host_bind_port: "{{ matrix_federation_public_port if (matrix_synapse_federation_enabled and matrix_synapse_tls_federation_listener_enabled) else '' }}"
|
||||
#
|
||||
@@ -4463,8 +4311,6 @@ matrix_synapse_container_additional_networks_auto: |
|
||||
+
|
||||
([exim_relay_container_network] if (exim_relay_enabled and matrix_synapse_email_enabled and matrix_synapse_email_smtp_host == exim_relay_identifier and matrix_synapse_container_network != exim_relay_container_network) else [])
|
||||
+
|
||||
([matrix_ma1sd_container_network] if (matrix_ma1sd_enabled and matrix_synapse_account_threepid_delegates_msisdn == matrix_synapse_account_threepid_delegates_msisdn_mas1sd_url and matrix_synapse_container_network != matrix_ma1sd_container_network) else [])
|
||||
+
|
||||
([matrix_bot_draupnir_container_network] if (matrix_synapse_ext_synapse_http_antispam_enabled and matrix_synapse_ext_synapse_http_antispam_config_base_url == matrix_bot_draupnir_synapse_http_antispam_config_base_url and matrix_bot_draupnir_container_network != matrix_synapse_container_network) else [])
|
||||
) | unique
|
||||
}}
|
||||
@@ -4502,16 +4348,16 @@ matrix_synapse_container_labels_internal_client_api_traefik_entrypoints: "{{ mat
|
||||
matrix_synapse_workers_container_host_bind_address: "{{ matrix_playbook_service_host_bind_interface_prefix[0:-1] if (matrix_synapse_workers_enabled and matrix_playbook_service_host_bind_interface_prefix) else '' }}"
|
||||
|
||||
matrix_synapse_database_host: "{{ postgres_connection_hostname if postgres_enabled else '' }}"
|
||||
matrix_synapse_database_password: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'synapse.db', rounds=655555) | to_uuid }}"
|
||||
matrix_synapse_database_password: "{{ (matrix_homeserver_generic_secret_key + ':synapse.db') | hash('sha512') | to_uuid }}"
|
||||
|
||||
matrix_synapse_macaroon_secret_key: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'synapse.mac', rounds=655555) | to_uuid }}"
|
||||
matrix_synapse_macaroon_secret_key: "{{ (matrix_homeserver_generic_secret_key + ':synapse.mac') | hash('sha512') | to_uuid }}"
|
||||
|
||||
# We do not enable TLS in Synapse by default, since it's handled by Traefik.
|
||||
matrix_synapse_tls_federation_listener_enabled: false
|
||||
matrix_synapse_tls_certificate_path: ~
|
||||
matrix_synapse_tls_private_key_path: ~
|
||||
|
||||
matrix_synapse_federation_port_openid_resource_required: "{{ not matrix_synapse_federation_enabled and (matrix_dimension_enabled or matrix_ma1sd_enabled or matrix_user_verification_service_enabled or matrix_livekit_jwt_service_enabled) }}"
|
||||
matrix_synapse_federation_port_openid_resource_required: "{{ not matrix_synapse_federation_enabled and (matrix_dimension_enabled or matrix_user_verification_service_enabled or matrix_livekit_jwt_service_enabled) }}"
|
||||
|
||||
matrix_synapse_metrics_enabled: "{{ prometheus_enabled or matrix_metrics_exposure_enabled }}"
|
||||
|
||||
@@ -4801,11 +4647,6 @@ matrix_synapse_admin_config_asManagedUsers_auto: |
|
||||
'^@hbirc_[a-zA-Z0-9]+:'+(matrix_domain | regex_escape)+'$',
|
||||
] if matrix_heisenbridge_enabled else [])
|
||||
+
|
||||
([
|
||||
'^@zulipbot:'+(matrix_domain | regex_escape)+'$',
|
||||
'^@zulip_[a-zA-Z0-9]+:'+(matrix_domain | regex_escape)+'$',
|
||||
] if matrix_zulip_bridge_enabled else [])
|
||||
+
|
||||
([
|
||||
'^@hookshot:'+(matrix_domain | regex_escape)+'$',
|
||||
'^@_github_[a-zA-Z0-9]+:'+(matrix_domain | regex_escape)+'$',
|
||||
@@ -5005,7 +4846,7 @@ prometheus_postgres_exporter_container_labels_metrics_middleware_basic_auth_user
|
||||
|
||||
prometheus_postgres_exporter_database_hostname: "{{ postgres_connection_hostname if postgres_enabled else '' }}"
|
||||
prometheus_postgres_exporter_database_username: matrix_prometheus_postgres_exporter
|
||||
prometheus_postgres_exporter_database_password: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'prometheus.pg.db', rounds=655555) | to_uuid }}"
|
||||
prometheus_postgres_exporter_database_password: "{{ (matrix_homeserver_generic_secret_key + ':prometheus.pg.db') | hash('sha512') | to_uuid }}"
|
||||
prometheus_postgres_exporter_database_name: matrix_prometheus_postgres_exporter
|
||||
|
||||
prometheus_postgres_exporter_systemd_required_services_list_auto: |
|
||||
@@ -5322,7 +5163,7 @@ matrix_registration_api_validate_certs: "{{ matrix_playbook_ssl_enabled }}"
|
||||
# Postgres is the default, except if not using internal Postgres server
|
||||
matrix_registration_database_engine: "{{ 'postgres' if postgres_enabled else 'sqlite' }}"
|
||||
matrix_registration_database_hostname: "{{ postgres_connection_hostname if postgres_enabled else '' }}"
|
||||
matrix_registration_database_password: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'mx.registr.db', rounds=655555) | to_uuid }}"
|
||||
matrix_registration_database_password: "{{ (matrix_homeserver_generic_secret_key + ':mx.registr.db') | hash('sha512') | to_uuid }}"
|
||||
|
||||
######################################################################
|
||||
#
|
||||
@@ -5381,11 +5222,11 @@ matrix_dendrite_metrics_proxying_enabled: "{{ matrix_dendrite_metrics_enabled an
|
||||
matrix_dendrite_metrics_proxying_hostname: "{{ matrix_metrics_exposure_hostname }}"
|
||||
matrix_dendrite_metrics_proxying_path_prefix: "{{ matrix_metrics_exposure_path_prefix }}/dendrite"
|
||||
|
||||
matrix_dendrite_client_api_registration_shared_secret: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'dendrite.rss', rounds=655555) | to_uuid }}"
|
||||
matrix_dendrite_client_api_registration_shared_secret: "{{ (matrix_homeserver_generic_secret_key + ':dendrite.rss') | hash('sha512') | to_uuid }}"
|
||||
|
||||
matrix_dendrite_database_hostname: "{{ postgres_connection_hostname if postgres_enabled else '' }}"
|
||||
|
||||
matrix_dendrite_database_password: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'dendrite.db', rounds=655555) | to_uuid }}"
|
||||
matrix_dendrite_database_password: "{{ (matrix_homeserver_generic_secret_key + ':dendrite.db') | hash('sha512') | to_uuid }}"
|
||||
|
||||
matrix_dendrite_client_api_turn_uris: "{{ matrix_coturn_turn_uris if matrix_coturn_enabled else [] }}"
|
||||
matrix_dendrite_client_api_turn_shared_secret: "{{ matrix_coturn_turn_static_auth_secret if (matrix_coturn_enabled and matrix_coturn_authentication_method == 'auth-secret') else '' }}"
|
||||
@@ -5396,7 +5237,7 @@ matrix_dendrite_disable_tls_validation: "{{ not matrix_playbook_ssl_enabled }}"
|
||||
|
||||
matrix_dendrite_self_check_validate_certificates: "{{ matrix_playbook_ssl_enabled }}"
|
||||
|
||||
matrix_dendrite_trusted_id_servers: "{{ [matrix_server_fqn_matrix] if matrix_ma1sd_enabled else ['matrix.org', 'vector.im'] }}"
|
||||
matrix_dendrite_trusted_id_servers: "{{ ['matrix.org', 'vector.im'] }}"
|
||||
|
||||
matrix_dendrite_systemd_required_services_list_auto: |
|
||||
{{
|
||||
@@ -5680,7 +5521,7 @@ matrix_user_verification_service_uvs_homeserver_url: "{{ matrix_addons_homeserve
|
||||
# We connect via the container network (private IPs), so we need to disable IP checks
|
||||
matrix_user_verification_service_uvs_disable_ip_blacklist: "{{ matrix_synapse_enabled }}"
|
||||
|
||||
matrix_user_verification_service_uvs_auth_token: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'uvs.auth.token', rounds=655555) | to_uuid }}"
|
||||
matrix_user_verification_service_uvs_auth_token: "{{ (matrix_homeserver_generic_secret_key + ':uvs.auth.token') | hash('sha512') | to_uuid }}"
|
||||
|
||||
######################################################################
|
||||
#
|
||||
@@ -6076,9 +5917,9 @@ matrix_livekit_jwt_service_container_labels_traefik_tls_certResolver: "{{ traefi
|
||||
|
||||
matrix_livekit_jwt_service_environment_variable_livekit_url: "{{ livekit_server_websocket_public_url }}"
|
||||
|
||||
matrix_livekit_jwt_service_environment_variable_livekit_key: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'lk.key', rounds=655555) | to_uuid }}"
|
||||
matrix_livekit_jwt_service_environment_variable_livekit_key: "{{ (matrix_homeserver_generic_secret_key + ':lk.key') | hash('sha512') | to_uuid }}"
|
||||
|
||||
matrix_livekit_jwt_service_environment_variable_livekit_secret: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'lk.secret', rounds=655555) | to_uuid }}"
|
||||
matrix_livekit_jwt_service_environment_variable_livekit_secret: "{{ (matrix_homeserver_generic_secret_key + ':lk.secret') | hash('sha512') | to_uuid }}"
|
||||
|
||||
matrix_livekit_jwt_service_environment_variable_livekit_full_access_homeservers_list: ["{{ matrix_domain }}"]
|
||||
|
||||
|
||||
@@ -17,7 +17,7 @@ packaging==26.0
|
||||
Pygments==2.19.2
|
||||
PyYAML==6.0.3
|
||||
requests==2.32.5
|
||||
setuptools==81.0.0
|
||||
setuptools==82.0.0
|
||||
snowballstemmer==3.0.1
|
||||
Sphinx==9.1.0
|
||||
sphinx-intl==2.3.2
|
||||
|
||||
@@ -45,7 +45,7 @@ msgid "To enable dynamic DNS, add the following configuration to your `inventory
|
||||
msgstr ""
|
||||
|
||||
#: ../../../docs/configuring-playbook-dynamic-dns.md:34
|
||||
msgid "Keep in mind that certain providers may require a different configuration of the `matrix_dynamic_dns_domain_configurations` variable, for provider specific examples see the [upstream documentation](https://github.com/ddclient/ddclient/blob/main/ddclient.conf.in)."
|
||||
msgid "Keep in mind that certain providers may require a different configuration of the `ddclient_domain_configurations` variable, for provider specific examples see the [upstream documentation](https://github.com/ddclient/ddclient/blob/main/ddclient.conf.in)."
|
||||
msgstr ""
|
||||
|
||||
#: ../../../docs/configuring-playbook-dynamic-dns.md:36
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
# SOME DESCRIPTIVE TITLE.
|
||||
# Copyright (C) 2018-2025, Slavi Pantaleev, Aine Etke, MDAD community members
|
||||
# Copyright (C) 2018-2026, Slavi Pantaleev, Aine Etke, MDAD community members
|
||||
# This file is distributed under the same license as the matrix-docker-ansible-deploy package.
|
||||
# FIRST AUTHOR <EMAIL@ADDRESS>, YEAR.
|
||||
#
|
||||
@@ -8,7 +8,7 @@ msgid ""
|
||||
msgstr ""
|
||||
"Project-Id-Version: matrix-docker-ansible-deploy \n"
|
||||
"Report-Msgid-Bugs-To: \n"
|
||||
"POT-Creation-Date: 2025-11-06 23:09+0900\n"
|
||||
"POT-Creation-Date: 2026-02-06 16:30+0900\n"
|
||||
"PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
|
||||
"Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
|
||||
"Language-Team: LANGUAGE <LL@li.org>\n"
|
||||
@@ -16,214 +16,22 @@ msgstr ""
|
||||
"Content-Type: text/plain; charset=UTF-8\n"
|
||||
"Content-Transfer-Encoding: 8bit\n"
|
||||
|
||||
#: ../../../docs/configuring-playbook-ma1sd.md:12
|
||||
msgid "Setting up ma1sd Identity Server (optional)"
|
||||
msgstr ""
|
||||
|
||||
#: ../../../docs/configuring-playbook-ma1sd.md:14
|
||||
msgid "[!WARNING] Since ma1sd has been unmaintained for years (the latest commit and release being from 2021) and the future of identity server's role in the Matrix specification is uncertain, **we recommend not bothering with installing it unless it's the only way you can do what you need to do**."
|
||||
msgstr ""
|
||||
|
||||
#: ../../../docs/configuring-playbook-ma1sd.md:17
|
||||
msgid "Please note that certain things can be achieved with other components. For example, if you wish to implement LDAP integration, you might as well check out [the LDAP provider module for Synapse](./configuring-playbook-ldap-auth.md) instead."
|
||||
msgstr ""
|
||||
|
||||
#: ../../../docs/configuring-playbook-ma1sd.md:19
|
||||
msgid "The playbook can configure the [ma1sd](https://github.com/ma1uta/ma1sd) Identity Server for you. It is a fork of [mxisd](https://github.com/kamax-io/mxisd) which was pronounced end of life 2019-06-21."
|
||||
msgstr ""
|
||||
|
||||
#: ../../../docs/configuring-playbook-ma1sd.md:21
|
||||
msgid "ma1sd is used for 3PIDs (3rd party identifiers like E-mail and phone numbers) and some [enhanced features](https://github.com/ma1uta/ma1sd/#features). It is private by default, potentially at the expense of user discoverability."
|
||||
msgid "Setting up ma1sd Identity Server (optional, removed)"
|
||||
msgstr ""
|
||||
|
||||
#: ../../../docs/configuring-playbook-ma1sd.md:23
|
||||
msgid "See the project's [documentation](https://github.com/ma1uta/ma1sd/blob/master/README.md) to learn what it does and why it might be useful to you."
|
||||
msgid "🪦 The playbook used to be able to install and configure the [ma1sd](https://github.com/ma1uta/ma1sd) Identity Server, but no longer includes this component, as it has been unmaintained for a long time."
|
||||
msgstr ""
|
||||
|
||||
#: ../../../docs/configuring-playbook-ma1sd.md:25
|
||||
msgid "Prerequisites"
|
||||
msgid "Please note that some of the functions can be achieved with other components. For example, if you wish to implement LDAP integration, you might as well check out [the LDAP provider module for Synapse](./configuring-playbook-ldap-auth.md) instead."
|
||||
msgstr ""
|
||||
|
||||
#: ../../../docs/configuring-playbook-ma1sd.md:27
|
||||
msgid "Open Matrix Federation port"
|
||||
msgid "Uninstalling the component manually"
|
||||
msgstr ""
|
||||
|
||||
#: ../../../docs/configuring-playbook-ma1sd.md:29
|
||||
msgid "Enabling the ma1sd service will automatically reconfigure your Synapse homeserver to expose the `openid` API endpoints on the Matrix Federation port (usually `8448`), even if [federation](configuring-playbook-federation.md) is disabled. If you enable the component, make sure that the port is accessible."
|
||||
msgstr ""
|
||||
|
||||
#: ../../../docs/configuring-playbook-ma1sd.md:31
|
||||
msgid "Adjusting DNS records"
|
||||
msgstr ""
|
||||
|
||||
#: ../../../docs/configuring-playbook-ma1sd.md:33
|
||||
msgid "To make the ma1sd Identity Server enable its federation features, set up a SRV record that looks like this:"
|
||||
msgstr ""
|
||||
|
||||
#: ../../../docs/configuring-playbook-ma1sd.md:35
|
||||
msgid "Name: `_matrix-identity._tcp` (use this text as-is)"
|
||||
msgstr ""
|
||||
|
||||
#: ../../../docs/configuring-playbook-ma1sd.md:36
|
||||
msgid "Content: `10 0 443 matrix.example.com` (replace `example.com` with your own)"
|
||||
msgstr ""
|
||||
|
||||
#: ../../../docs/configuring-playbook-ma1sd.md:38
|
||||
msgid "See [ma1sd's documentation](https://github.com/ma1uta/ma1sd/wiki/mxisd-and-your-privacy#choices-are-never-easy) for information on the privacy implications of setting up this SRV record."
|
||||
msgstr ""
|
||||
|
||||
#: ../../../docs/configuring-playbook-ma1sd.md:40
|
||||
msgid "When setting up a SRV record, if you are asked for a service and protocol instead of a hostname split the host value from the table where the period is. For example use service as `_matrix-identity` and protocol as `_tcp`."
|
||||
msgstr ""
|
||||
|
||||
#: ../../../docs/configuring-playbook-ma1sd.md:42
|
||||
msgid "**Note**: This `_matrix-identity._tcp` SRV record for the identity server is different from the `_matrix._tcp` that can be used for Synapse delegation. See [howto-server-delegation.md](howto-server-delegation.md) for more information about delegation."
|
||||
msgstr ""
|
||||
|
||||
#: ../../../docs/configuring-playbook-ma1sd.md:44
|
||||
msgid "Adjusting the playbook configuration"
|
||||
msgstr ""
|
||||
|
||||
#: ../../../docs/configuring-playbook-ma1sd.md:46
|
||||
msgid "To enable ma1sd, add the following configuration to your `inventory/host_vars/matrix.example.com/vars.yml` file:"
|
||||
msgstr ""
|
||||
|
||||
#: ../../../docs/configuring-playbook-ma1sd.md:52
|
||||
msgid "Matrix.org lookup forwarding"
|
||||
msgstr ""
|
||||
|
||||
#: ../../../docs/configuring-playbook-ma1sd.md:54
|
||||
msgid "To ensure maximum discovery, you can make your identity server also forward lookups to the central matrix.org Identity server (at the cost of potentially leaking all your contacts information)."
|
||||
msgstr ""
|
||||
|
||||
#: ../../../docs/configuring-playbook-ma1sd.md:56
|
||||
msgid "Enabling this is discouraged and you'd better [learn more](https://github.com/ma1uta/ma1sd/blob/master/docs/features/identity.md#lookups) before proceeding."
|
||||
msgstr ""
|
||||
|
||||
#: ../../../docs/configuring-playbook-ma1sd.md:58
|
||||
msgid "To enable matrix.org forwarding, add the following configuration to your `vars.yml` file:"
|
||||
msgstr ""
|
||||
|
||||
#: ../../../docs/configuring-playbook-ma1sd.md:64
|
||||
msgid "Extending the configuration"
|
||||
msgstr ""
|
||||
|
||||
#: ../../../docs/configuring-playbook-ma1sd.md:66
|
||||
msgid "There are some additional things you may wish to configure about the component."
|
||||
msgstr ""
|
||||
|
||||
#: ../../../docs/configuring-playbook-ma1sd.md:68
|
||||
msgid "Take a look at:"
|
||||
msgstr ""
|
||||
|
||||
#: ../../../docs/configuring-playbook-ma1sd.md:70
|
||||
msgid "`roles/custom/matrix-ma1sd/defaults/main.yml` for some variables that you can customize via your `vars.yml` file. You can override settings (even those that don't have dedicated playbook variables) using the `matrix_ma1sd_configuration_extension_yaml` variable"
|
||||
msgstr ""
|
||||
|
||||
#: ../../../docs/configuring-playbook-ma1sd.md:72
|
||||
msgid "You can refer to the [ma1sd website](https://github.com/ma1uta/ma1sd) for more details and configuration options."
|
||||
msgstr ""
|
||||
|
||||
#: ../../../docs/configuring-playbook-ma1sd.md:74
|
||||
msgid "Customizing email templates"
|
||||
msgstr ""
|
||||
|
||||
#: ../../../docs/configuring-playbook-ma1sd.md:76
|
||||
msgid "If you'd like to change the default email templates used by ma1sd, take a look at the `matrix_ma1sd_threepid_medium_email_custom_` variables (in the `roles/custom/matrix-ma1sd/defaults/main.yml` file."
|
||||
msgstr ""
|
||||
|
||||
#: ../../../docs/configuring-playbook-ma1sd.md:78
|
||||
msgid "ma1sd-controlled Registration"
|
||||
msgstr ""
|
||||
|
||||
#: ../../../docs/configuring-playbook-ma1sd.md:80
|
||||
msgid "To use the [Registration](https://github.com/ma1uta/ma1sd/blob/master/docs/features/registration.md) feature of ma1sd, you can make use of the following variables:"
|
||||
msgstr ""
|
||||
|
||||
#: ../../../docs/configuring-playbook-ma1sd.md:82
|
||||
msgid "`matrix_synapse_enable_registration` — to enable user-initiated registration in Synapse"
|
||||
msgstr ""
|
||||
|
||||
#: ../../../docs/configuring-playbook-ma1sd.md:84
|
||||
msgid "`matrix_synapse_enable_registration_captcha` — to validate registering users using reCAPTCHA, as described in the [enabling reCAPTCHA](configuring-captcha.md) documentation."
|
||||
msgstr ""
|
||||
|
||||
#: ../../../docs/configuring-playbook-ma1sd.md:86
|
||||
msgid "`matrix_synapse_registrations_require_3pid` — a list of 3pid types (among `'email'`, `'msisdn'`) required by the Synapse server for registering"
|
||||
msgstr ""
|
||||
|
||||
#: ../../../docs/configuring-playbook-ma1sd.md:88
|
||||
msgid "variables prefixed with `matrix_ma1sd_container_labels_` (e.g. `matrix_ma1sd_container_labels_matrix_client_3pid_registration_enabled`) — to configure the Traefik reverse-proxy to capture and send registration requests to ma1sd (instead of Synapse), so it can apply its additional functionality"
|
||||
msgstr ""
|
||||
|
||||
#: ../../../docs/configuring-playbook-ma1sd.md:90
|
||||
msgid "`matrix_ma1sd_configuration_extension_yaml` — to configure ma1sd as required. See the [Registration feature's docs](https://github.com/ma1uta/ma1sd/blob/master/docs/features/registration.md) for inspiration. Also see the [Additional features](#additional-features) section below to learn more about how to use `matrix_ma1sd_configuration_extension_yaml`."
|
||||
msgstr ""
|
||||
|
||||
#: ../../../docs/configuring-playbook-ma1sd.md:92
|
||||
msgid "**Note**: For this to work, either the homeserver needs to [federate](configuring-playbook-federation.md) or the `openid` APIs need to exposed on the federation port. When federation is disabled and ma1sd is enabled, we automatically expose the `openid` APIs (only!) on the federation port. Make sure the federation port (usually `https://matrix.example.com:8448`) is whitelisted in your firewall (even if you don't actually use/need federation)."
|
||||
msgstr ""
|
||||
|
||||
#: ../../../docs/configuring-playbook-ma1sd.md:94
|
||||
msgid "Authentication"
|
||||
msgstr ""
|
||||
|
||||
#: ../../../docs/configuring-playbook-ma1sd.md:96
|
||||
msgid "[Authentication](https://github.com/ma1uta/ma1sd/blob/master/docs/features/authentication.md) provides the possibility to use your own [Identity Stores](https://github.com/ma1uta/ma1sd/blob/master/docs/stores/README.md) (for example LDAP) to authenticate users on your Homeserver."
|
||||
msgstr ""
|
||||
|
||||
#: ../../../docs/configuring-playbook-ma1sd.md:98
|
||||
msgid "To enable authentication against an LDAP server, add the following configuration to your `vars.yml` file:"
|
||||
msgstr ""
|
||||
|
||||
#: ../../../docs/configuring-playbook-ma1sd.md:118
|
||||
msgid "Example: SMS verification"
|
||||
msgstr ""
|
||||
|
||||
#: ../../../docs/configuring-playbook-ma1sd.md:120
|
||||
msgid "If your use case requires mobile verification, it is quite simple to integrate ma1sd with [Twilio](https://www.twilio.com/), an online telephony services gateway. Their prices are reasonable for low-volume projects and integration can be done with the following configuration:"
|
||||
msgstr ""
|
||||
|
||||
#: ../../../docs/configuring-playbook-ma1sd.md:134
|
||||
msgid "Example: Open Registration for every Domain"
|
||||
msgstr ""
|
||||
|
||||
#: ../../../docs/configuring-playbook-ma1sd.md:136
|
||||
msgid "If you want to open registration for any domain, you have to setup the allowed domains with ma1sd's `blacklist` and `whitelist`. The default behavior when neither the `blacklist`, nor the `whitelist` match, is to allow registration. Beware: you can't block toplevel domains (aka `.xy`) because the internal architecture of ma1sd doesn't allow that."
|
||||
msgstr ""
|
||||
|
||||
#: ../../../docs/configuring-playbook-ma1sd.md:150
|
||||
msgid "Installing"
|
||||
msgstr ""
|
||||
|
||||
#: ../../../docs/configuring-playbook-ma1sd.md:152
|
||||
msgid "After configuring the playbook, run it with [playbook tags](playbook-tags.md) as below:"
|
||||
msgstr ""
|
||||
|
||||
#: ../../../docs/configuring-playbook-ma1sd.md:159
|
||||
msgid "The shortcut commands with the [`just` program](just.md) are also available: `just install-all` or `just setup-all`"
|
||||
msgstr ""
|
||||
|
||||
#: ../../../docs/configuring-playbook-ma1sd.md:161
|
||||
msgid "`just install-all` is useful for maintaining your setup quickly ([2x-5x faster](../CHANGELOG.md#2x-5x-performance-improvements-in-playbook-runtime) than `just setup-all`) when its components remain unchanged. If you adjust your `vars.yml` to remove other components, you'd need to run `just setup-all`, or these components will still remain installed. Note these shortcuts run the `ensure-matrix-users-created` tag too."
|
||||
msgstr ""
|
||||
|
||||
#: ../../../docs/configuring-playbook-ma1sd.md:163
|
||||
msgid "Troubleshooting"
|
||||
msgstr ""
|
||||
|
||||
#: ../../../docs/configuring-playbook-ma1sd.md:165
|
||||
msgid "If email address validation emails sent by ma1sd are not reaching you, you should look into [Adjusting email-sending settings](configuring-playbook-email.md)."
|
||||
msgstr ""
|
||||
|
||||
#: ../../../docs/configuring-playbook-ma1sd.md:167
|
||||
msgid "As with all other services, you can find the logs in [systemd-journald](https://www.freedesktop.org/software/systemd/man/systemd-journald.service.html) by logging in to the server with SSH and running `journalctl -fu matrix-ma1sd`."
|
||||
msgstr ""
|
||||
|
||||
#: ../../../docs/configuring-playbook-ma1sd.md:169
|
||||
msgid "Increase logging verbosity"
|
||||
msgstr ""
|
||||
|
||||
#: ../../../docs/configuring-playbook-ma1sd.md:171
|
||||
msgid "If you want to increase the verbosity, add the following configuration to your `vars.yml` file and re-run the playbook:"
|
||||
msgid "If you still have the ma1sd Identity Server installed on your Matrix server, the playbook can no longer help you uninstall it and you will need to do it manually. To uninstall manually, run these commands on the server:"
|
||||
msgstr ""
|
||||
|
||||
+6
-2
@@ -12,6 +12,10 @@
|
||||
- src: git+https://github.com/mother-of-all-self-hosting/ansible-role-container-socket-proxy.git
|
||||
version: v0.4.2-1
|
||||
name: container_socket_proxy
|
||||
- src: git+https://github.com/mother-of-all-self-hosting/ansible-role-ddclient.git
|
||||
version: v4.0.0-0
|
||||
name: ddclient
|
||||
activation_prefix: ddclient_
|
||||
- src: git+https://github.com/geerlingguy/ansible-role-docker
|
||||
version: 8.0.0
|
||||
name: docker
|
||||
@@ -46,7 +50,7 @@
|
||||
version: dd6e15246b7a9a2d921e0b3f9cd8a4a917a1bb2f
|
||||
name: playbook_state_preserver
|
||||
- src: git+https://github.com/mother-of-all-self-hosting/ansible-role-postgres.git
|
||||
version: v18.1-3
|
||||
version: v18.1-4
|
||||
name: postgres
|
||||
- src: git+https://github.com/mother-of-all-self-hosting/ansible-role-postgres-backup.git
|
||||
version: v18-0
|
||||
@@ -64,7 +68,7 @@
|
||||
version: v1.4.1-0
|
||||
name: systemd_docker_base
|
||||
- src: git+https://github.com/devture/com.devture.ansible.role.systemd_service_manager.git
|
||||
version: v1.0.0-4
|
||||
version: v1.1.0-0
|
||||
name: systemd_service_manager
|
||||
- src: git+https://github.com/devture/com.devture.ansible.role.timesync.git
|
||||
version: v1.1.0-1
|
||||
|
||||
@@ -368,7 +368,7 @@ matrix_playbook_public_matrix_federation_api_traefik_entrypoint_definition:
|
||||
# This entrypoint provides local addons (e.g. bridges, bots, etc.) with the ability to easily & quickly communicate with the homeserver and/or related software.
|
||||
# Such services can reach the homeserver over the public internet (e.g. https://matrix.example.com), but this is slow due to networking and SSL-termination.
|
||||
# Talking directly to the homeserver (e.g. `http://matrix-synapse:8008`) is another option, but does not allow other homeserver-related software
|
||||
# (e.g. identity servers like ma1sd, media repository servers like matrix-media-repo, firewalls like matrix-corporal)
|
||||
# (e.g. media repository servers like matrix-media-repo, firewalls like matrix-corporal)
|
||||
# to register itself for certain homeserver routes.
|
||||
#
|
||||
# For example: when matrix-media-repo is enabled, it wishes to handle `/_matrix/media` both publicly and internally.
|
||||
|
||||
@@ -76,7 +76,6 @@ matrix_bot_go_neb_container_labels_traefik_additional_response_headers_auto: |
|
||||
{{
|
||||
{}
|
||||
| combine ({'X-XSS-Protection': matrix_bot_go_neb_http_header_xss_protection} if matrix_bot_go_neb_http_header_xss_protection else {})
|
||||
| combine ({'X-Frame-Options': matrix_bot_go_neb_http_header_frame_options} if matrix_bot_go_neb_http_header_frame_options else {})
|
||||
| combine ({'X-Content-Type-Options': matrix_bot_go_neb_http_header_content_type_options} if matrix_bot_go_neb_http_header_content_type_options else {})
|
||||
| combine ({'Content-Security-Policy': matrix_bot_go_neb_http_header_content_security_policy} if matrix_bot_go_neb_http_header_content_security_policy else {})
|
||||
| combine ({'Permission-Policy': matrix_bot_go_neb_http_header_content_permission_policy} if matrix_bot_go_neb_http_header_content_permission_policy else {})
|
||||
@@ -113,10 +112,6 @@ matrix_bot_go_neb_systemd_wanted_services_list: []
|
||||
# - https://portswigger.net/web-security/cross-site-scripting/reflected
|
||||
matrix_bot_go_neb_http_header_xss_protection: "1; mode=block"
|
||||
|
||||
# Specifies the value of the `X-Frame-Options` header which controls whether framing can happen.
|
||||
# See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options
|
||||
matrix_bot_go_neb_http_header_frame_options: SAMEORIGIN
|
||||
|
||||
# Specifies the value of the `X-Content-Type-Options` header.
|
||||
# See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Content-Type-Options
|
||||
matrix_bot_go_neb_http_header_content_type_options: nosniff
|
||||
|
||||
@@ -1,122 +0,0 @@
|
||||
# SPDX-FileCopyrightText: 2021 - 2022 Toni Spets
|
||||
# SPDX-FileCopyrightText: 2022 - 2023 Nikita Chernyi
|
||||
# SPDX-FileCopyrightText: 2022 - 2025 Slavi Pantaleev
|
||||
# SPDX-FileCopyrightText: 2022 MDAD project contributors
|
||||
# SPDX-FileCopyrightText: 2022 Marko Weltzer
|
||||
# SPDX-FileCopyrightText: 2023 Samuel Meenzen
|
||||
# SPDX-FileCopyrightText: 2024 - 2025 Suguru Hirahara
|
||||
#
|
||||
# SPDX-License-Identifier: AGPL-3.0-or-later
|
||||
|
||||
---
|
||||
# MatrixZulipBridge is a puppeting appservice bridge for Zulip
|
||||
# Project source code URL: https://github.com/GearKite/MatrixZulipBridge
|
||||
|
||||
matrix_zulip_bridge_enabled: true
|
||||
|
||||
matrix_zulip_bridge_scheme: https
|
||||
matrix_zulip_bridge_hostname: "{{ matrix_server_fqn_matrix }}"
|
||||
matrix_zulip_bridge_path_prefix: "/zulip"
|
||||
|
||||
# renovate: datasource=docker depName=ghcr.io/gearkite/matrixzulipbridge
|
||||
matrix_zulip_bridge_version: v0.4.1
|
||||
matrix_zulip_bridge_docker_image: "{{ matrix_zulip_bridge_docker_image_registry_prefix }}gearkite/matrixzulipbridge:{{ matrix_zulip_bridge_version }}"
|
||||
matrix_zulip_bridge_docker_image_registry_prefix: "{{ matrix_zulip_bridge_docker_image_registry_prefix_upstream }}"
|
||||
matrix_zulip_bridge_docker_image_registry_prefix_upstream: "{{ matrix_zulip_bridge_docker_image_registry_prefix_upstream_default }}"
|
||||
matrix_zulip_bridge_docker_image_registry_prefix_upstream_default: ghcr.io/
|
||||
matrix_zulip_bridge_docker_image_force_pull: "{{ matrix_zulip_bridge_docker_image.endswith(':latest') }}"
|
||||
|
||||
matrix_zulip_bridge_base_path: "{{ matrix_base_data_path }}/zulip"
|
||||
|
||||
matrix_zulip_bridge_container_network: ""
|
||||
|
||||
# The port number in the container
|
||||
matrix_zulip_bridge_container_http_port: 9898
|
||||
|
||||
matrix_zulip_bridge_container_additional_networks: "{{ matrix_zulip_bridge_container_additional_networks_auto + matrix_zulip_bridge_container_additional_networks_custom }}"
|
||||
matrix_zulip_bridge_container_additional_networks_auto: []
|
||||
matrix_zulip_bridge_container_additional_networks_custom: []
|
||||
|
||||
# Controls how long to wait for the container to stop gracefully before killing it.
|
||||
# We use a small value here, because this container does not seem to handle the SIGTERM signal.
|
||||
matrix_zulip_bridge_container_stop_grace_time_seconds: 1
|
||||
|
||||
# matrix_zulip_bridge_container_labels_traefik_enabled controls whether labels to assist a Traefik reverse-proxy will be attached to the container.
|
||||
# See `../templates/labels.j2` for details.
|
||||
#
|
||||
# To inject your own other container labels, see `matrix_zulip_bridge_container_labels_additional_labels`.
|
||||
matrix_zulip_bridge_container_labels_traefik_enabled: true
|
||||
matrix_zulip_bridge_container_labels_traefik_docker_network: "{{ matrix_zulip_bridge_container_network }}"
|
||||
matrix_zulip_bridge_container_labels_traefik_hostname: "{{ matrix_zulip_bridge_hostname }}"
|
||||
matrix_zulip_bridge_container_labels_traefik_path_prefix: "{{ matrix_zulip_bridge_path_prefix }}"
|
||||
matrix_zulip_bridge_container_labels_traefik_entrypoints: web-secure
|
||||
matrix_zulip_bridge_container_labels_traefik_tls_certResolver: default # noqa var-naming
|
||||
|
||||
# Controls if the media router is enabled
|
||||
matrix_zulip_bridge_container_labels_traefik_media_enabled: true
|
||||
matrix_zulip_bridge_container_labels_traefik_media_hostname: "{{ matrix_zulip_bridge_container_labels_traefik_hostname }}"
|
||||
# The path prefix must either be `/` or not end with a slash (e.g. `/zulip`).
|
||||
matrix_zulip_bridge_container_labels_traefik_media_path_prefix: "{{ '' if matrix_zulip_bridge_container_labels_traefik_path_prefix == '/' else (matrix_zulip_bridge_container_labels_traefik_path_prefix) }}/_bridge_zulip/media"
|
||||
matrix_zulip_bridge_container_labels_traefik_media_rule: "Host(`{{ matrix_zulip_bridge_container_labels_traefik_media_hostname }}`){% if matrix_zulip_bridge_container_labels_traefik_media_path_prefix != '/' %} && PathPrefix(`{{ matrix_zulip_bridge_container_labels_traefik_media_path_prefix }}`){% endif %}"
|
||||
matrix_zulip_bridge_container_labels_traefik_media_priority: 0
|
||||
matrix_zulip_bridge_container_labels_traefik_media_entrypoints: "{{ matrix_zulip_bridge_container_labels_traefik_entrypoints }}"
|
||||
matrix_zulip_bridge_container_labels_traefik_media_tls: "{{ matrix_zulip_bridge_container_labels_traefik_media_entrypoints != 'web' }}"
|
||||
matrix_zulip_bridge_container_labels_traefik_media_tls_certResolver: "{{ matrix_zulip_bridge_container_labels_traefik_tls_certResolver }}" # noqa var-naming
|
||||
|
||||
# matrix_zulip_bridge_container_labels_additional_labels contains a multiline string with additional labels to add to the container label file.
|
||||
# See `../templates/labels.j2` for details.
|
||||
#
|
||||
# Example:
|
||||
# matrix_zulip_bridge_container_labels_additional_labels: |
|
||||
# my.label=1
|
||||
# another.label="here"
|
||||
matrix_zulip_bridge_container_labels_additional_labels: ''
|
||||
|
||||
# A list of extra arguments to pass to the container
|
||||
matrix_zulip_bridge_container_extra_arguments: []
|
||||
|
||||
# List of systemd services that service depends on.
|
||||
matrix_zulip_bridge_systemd_required_services_list: "{{ matrix_zulip_bridge_systemd_required_services_list_default + matrix_zulip_bridge_systemd_required_services_list_auto + matrix_zulip_bridge_systemd_required_services_list_custom }}"
|
||||
matrix_zulip_bridge_systemd_required_services_list_default: "{{ [devture_systemd_docker_base_docker_service_name] if devture_systemd_docker_base_docker_service_name else [] }}"
|
||||
matrix_zulip_bridge_systemd_required_services_list_auto: []
|
||||
matrix_zulip_bridge_systemd_required_services_list_custom: []
|
||||
|
||||
# List of systemd services that service wants
|
||||
matrix_zulip_bridge_systemd_wanted_services_list: []
|
||||
|
||||
matrix_zulip_bridge_homeserver_url: ""
|
||||
|
||||
matrix_zulip_bridge_appservice_token: ''
|
||||
matrix_zulip_bridge_homeserver_token: ''
|
||||
|
||||
matrix_zulip_bridge_config_media_url: "{{ matrix_zulip_bridge_scheme }}://{{ matrix_zulip_bridge_hostname }}"
|
||||
# This matches the hardcoded `DEFAULT_MEDIA_PATH` in MatrixZulipBridge, but uses `matrix_zulip_bridge_path_prefix` as the path prefix.
|
||||
# See: https://github.com/GearKite/MatrixZulipBridge/blob/2ba51f3da2ad8bd33460c953ef91a9cfc585a2d4/matrixzulipbridge/__main__.py#L87
|
||||
matrix_zulip_bridge_config_media_path: "{{ matrix_zulip_bridge_container_labels_traefik_media_path_prefix }}/v3/download/{netloc}{path}{filename}"
|
||||
matrix_zulip_bridge_config_media_key: "{{ matrix_zulip_bridge_homeserver_token }}"
|
||||
matrix_zulip_bridge_config_displayname: "Zulip bridge bot"
|
||||
|
||||
matrix_zulip_bridge_registration_yaml_bridge_zulip:
|
||||
media_url: "{{ matrix_zulip_bridge_config_media_url }}"
|
||||
media_path: "{{ matrix_zulip_bridge_config_media_path }}"
|
||||
media_key: "{{ matrix_zulip_bridge_config_media_key }}"
|
||||
displayname: "{{ matrix_zulip_bridge_config_displayname }}"
|
||||
|
||||
# Default registration file consumed by both the homeserver and MatrixZulipBridge.
|
||||
# Besides registration information, it contains configuration (see the Zulip bridge key).
|
||||
matrix_zulip_bridge_registration_yaml:
|
||||
id: zulip
|
||||
url: http://matrix-zulip-bridge:{{ matrix_zulip_bridge_container_http_port }}
|
||||
as_token: "{{ matrix_zulip_bridge_appservice_token }}"
|
||||
hs_token: "{{ matrix_zulip_bridge_homeserver_token }}"
|
||||
rate_limited: false
|
||||
sender_localpart: zulipbot
|
||||
namespaces:
|
||||
users:
|
||||
- regex: '@zulip_.*'
|
||||
exclusive: true
|
||||
aliases: []
|
||||
rooms: []
|
||||
zulipbridge: "{{ matrix_zulip_bridge_registration_yaml_bridge_zulip }}"
|
||||
|
||||
matrix_zulip_bridge_registration: "{{ matrix_zulip_bridge_registration_yaml | from_yaml }}"
|
||||
@@ -1,29 +0,0 @@
|
||||
# SPDX-FileCopyrightText: 2021 Toni Spets
|
||||
# SPDX-FileCopyrightText: 2022 - 2024 Slavi Pantaleev
|
||||
# SPDX-FileCopyrightText: 2022 Marko Weltzer
|
||||
# SPDX-FileCopyrightText: 2025 Suguru Hirahara
|
||||
#
|
||||
# SPDX-License-Identifier: AGPL-3.0-or-later
|
||||
|
||||
---
|
||||
- name: Perform the Zulip bridge installation tasks
|
||||
when: matrix_zulip_bridge_enabled | bool
|
||||
tags:
|
||||
- setup-all
|
||||
- setup-bridge-zulip
|
||||
- install-all
|
||||
- install-bridge-zulip
|
||||
block:
|
||||
- name: Validate the Zulip bridge configuration
|
||||
ansible.builtin.include_tasks: "{{ role_path }}/tasks/validate_config.yml"
|
||||
- name: Install the Zulip bridge
|
||||
ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_install.yml"
|
||||
|
||||
- name: Perform the Zulip bridge uninstallation tasks
|
||||
when: not matrix_zulip_bridge_enabled | bool
|
||||
tags:
|
||||
- setup-all
|
||||
- setup-bridge-zulip
|
||||
block:
|
||||
- name: Uninstall the Zulip bridge
|
||||
ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_uninstall.yml"
|
||||
@@ -1,62 +0,0 @@
|
||||
# SPDX-FileCopyrightText: 2021 Toni Spets
|
||||
# SPDX-FileCopyrightText: 2022 - 2024 Slavi Pantaleev
|
||||
# SPDX-FileCopyrightText: 2022 Jim Myhrberg
|
||||
# SPDX-FileCopyrightText: 2022 Marko Weltzer
|
||||
# SPDX-FileCopyrightText: 2022 Nikita Chernyi
|
||||
# SPDX-FileCopyrightText: 2022 Sebastian Gumprich
|
||||
# SPDX-FileCopyrightText: 2024 David Mehren
|
||||
#
|
||||
# SPDX-License-Identifier: AGPL-3.0-or-later
|
||||
|
||||
---
|
||||
- name: Ensure the Zulip bridge image is pulled
|
||||
community.docker.docker_image:
|
||||
name: "{{ matrix_zulip_bridge_docker_image }}"
|
||||
source: "{{ 'pull' if ansible_version.major > 2 or ansible_version.minor > 7 else omit }}"
|
||||
force_source: "{{ matrix_zulip_bridge_docker_image_force_pull if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}"
|
||||
force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else matrix_zulip_bridge_docker_image_force_pull }}"
|
||||
register: result
|
||||
retries: "{{ devture_playbook_help_container_retries_count }}"
|
||||
delay: "{{ devture_playbook_help_container_retries_delay }}"
|
||||
until: result is not failed
|
||||
|
||||
- name: Ensure the Zulip bridge paths exist
|
||||
ansible.builtin.file:
|
||||
path: "{{ item }}"
|
||||
state: directory
|
||||
mode: "0750"
|
||||
owner: "{{ matrix_user_name }}"
|
||||
group: "{{ matrix_group_name }}"
|
||||
with_items:
|
||||
- "{{ matrix_zulip_bridge_base_path }}"
|
||||
|
||||
- name: Ensure the Zulip bridge registration.yaml installed if provided
|
||||
ansible.builtin.copy:
|
||||
content: "{{ matrix_zulip_bridge_registration | to_nice_yaml(indent=2, width=999999) }}"
|
||||
dest: "{{ matrix_zulip_bridge_base_path }}/registration.yaml"
|
||||
mode: "0644"
|
||||
owner: "{{ matrix_user_name }}"
|
||||
group: "{{ matrix_group_name }}"
|
||||
|
||||
- name: Ensure the Zulip bridge support files installed
|
||||
ansible.builtin.template:
|
||||
src: "{{ role_path }}/templates/{{ item }}.j2"
|
||||
dest: "{{ matrix_zulip_bridge_base_path }}/{{ item }}"
|
||||
mode: "0640"
|
||||
owner: "{{ matrix_user_name }}"
|
||||
group: "{{ matrix_group_name }}"
|
||||
with_items:
|
||||
- labels
|
||||
|
||||
- name: Ensure the Zulip bridge container network is created
|
||||
community.general.docker_network:
|
||||
enable_ipv6: "{{ devture_systemd_docker_base_ipv6_enabled }}"
|
||||
name: "{{ matrix_zulip_bridge_container_network }}"
|
||||
driver: bridge
|
||||
driver_options: "{{ devture_systemd_docker_base_container_networks_driver_options }}"
|
||||
|
||||
- name: Ensure matrix-zulip-bridge.service installed
|
||||
ansible.builtin.template:
|
||||
src: "{{ role_path }}/templates/systemd/matrix-zulip-bridge.service.j2"
|
||||
dest: "{{ devture_systemd_docker_base_systemd_path }}/matrix-zulip-bridge.service"
|
||||
mode: "0644"
|
||||
@@ -1,26 +0,0 @@
|
||||
# SPDX-FileCopyrightText: 2021 - 2022 Slavi Pantaleev
|
||||
# SPDX-FileCopyrightText: 2021 Michael Sasser
|
||||
# SPDX-FileCopyrightText: 2021 Toni Spets
|
||||
# SPDX-FileCopyrightText: 2022 Marko Weltzer
|
||||
#
|
||||
# SPDX-License-Identifier: AGPL-3.0-or-later
|
||||
|
||||
---
|
||||
- name: Check existence of matrix-bridge-zulip service
|
||||
ansible.builtin.stat:
|
||||
path: "{{ devture_systemd_docker_base_systemd_path }}/matrix-zulip-bridge.service"
|
||||
register: matrix_zulip_bridge_service_stat
|
||||
|
||||
- when: matrix_zulip_bridge_service_stat.stat.exists | bool
|
||||
block:
|
||||
- name: Ensure matrix-bridge-zulip is stopped
|
||||
ansible.builtin.service:
|
||||
name: matrix-zulip-bridge
|
||||
state: stopped
|
||||
enabled: false
|
||||
daemon_reload: true
|
||||
|
||||
- name: Ensure matrix-zulip-bridge.service doesn't exist
|
||||
ansible.builtin.file:
|
||||
path: "{{ devture_systemd_docker_base_systemd_path }}/matrix-zulip-bridge.service"
|
||||
state: absent
|
||||
@@ -1,14 +0,0 @@
|
||||
# SPDX-FileCopyrightText: 2024 Slavi Pantaleev
|
||||
# SPDX-FileCopyrightText: 2024 Suguru Hirahara
|
||||
#
|
||||
# SPDX-License-Identifier: AGPL-3.0-or-later
|
||||
|
||||
---
|
||||
- name: Fail if required the Zulip bridge settings not defined
|
||||
ansible.builtin.fail:
|
||||
msg: >-
|
||||
You need to define a required configuration setting (`{{ item.name }}`).
|
||||
when: "item.when | bool and lookup('vars', item.name, default='') | string | length == 0"
|
||||
with_items:
|
||||
- {"name": "matrix_zulip_bridge_container_network", when: true}
|
||||
- {"name": "matrix_zulip_bridge_homeserver_url", when: true}
|
||||
@@ -1,58 +0,0 @@
|
||||
{#
|
||||
SPDX-FileCopyrightText: 2024 Slavi Pantaleev
|
||||
|
||||
SPDX-License-Identifier: AGPL-3.0-or-later
|
||||
#}
|
||||
|
||||
{% if matrix_zulip_bridge_container_labels_traefik_enabled %}
|
||||
traefik.enable=true
|
||||
|
||||
{% if matrix_zulip_bridge_container_labels_traefik_docker_network %}
|
||||
traefik.docker.network={{ matrix_zulip_bridge_container_labels_traefik_docker_network }}
|
||||
{% endif %}
|
||||
|
||||
traefik.http.services.matrix-zulip-bridge.loadbalancer.server.port={{ matrix_zulip_bridge_container_http_port }}
|
||||
|
||||
{% set middlewares = [] %}
|
||||
|
||||
{% if matrix_zulip_bridge_container_labels_traefik_path_prefix != '/' %}
|
||||
traefik.http.middlewares.matrix-bridge-zulip-strip-prefix.stripprefix.prefixes={{ matrix_zulip_bridge_container_labels_traefik_path_prefix }}
|
||||
{% set middlewares = middlewares + ['matrix-bridge-zulip-strip-prefix'] %}
|
||||
{% endif %}
|
||||
|
||||
{% if matrix_zulip_bridge_container_labels_traefik_media_enabled %}
|
||||
##########################################################################
|
||||
# #
|
||||
# Media #
|
||||
# #
|
||||
##########################################################################
|
||||
|
||||
traefik.http.routers.matrix-bridge-zulip-media.rule={{ matrix_zulip_bridge_container_labels_traefik_media_rule }}
|
||||
|
||||
{% if matrix_zulip_bridge_container_labels_traefik_media_priority | int > 0 %}
|
||||
traefik.http.routers.matrix-bridge-zulip-media.priority={{ matrix_zulip_bridge_container_labels_traefik_media_priority }}
|
||||
{% endif %}
|
||||
|
||||
{% if middlewares | length > 0 %}
|
||||
traefik.http.routers.matrix-bridge-zulip-media.middlewares={{ middlewares | join(',') }}
|
||||
{% endif %}
|
||||
|
||||
traefik.http.routers.matrix-bridge-zulip-media.service=matrix-bridge-zulip
|
||||
traefik.http.routers.matrix-bridge-zulip-media.entrypoints={{ matrix_zulip_bridge_container_labels_traefik_entrypoints }}
|
||||
|
||||
traefik.http.routers.matrix-bridge-zulip-media.tls={{ matrix_zulip_bridge_container_labels_traefik_media_tls | to_json }}
|
||||
{% if matrix_zulip_bridge_container_labels_traefik_media_entrypoints %}
|
||||
traefik.http.routers.matrix-bridge-zulip-media.tls.certResolver={{ matrix_zulip_bridge_container_labels_traefik_media_tls_certResolver }}
|
||||
{% endif %}
|
||||
|
||||
##########################################################################
|
||||
# #
|
||||
# /Media #
|
||||
# #
|
||||
##########################################################################
|
||||
{% endif %}
|
||||
|
||||
|
||||
{% endif %}
|
||||
|
||||
{{ matrix_zulip_bridge_container_labels_additional_labels }}
|
||||
@@ -1,60 +0,0 @@
|
||||
{#
|
||||
SPDX-FileCopyrightText: 2021 Toni Spets
|
||||
SPDX-FileCopyrightText: 2022 - 2025 Slavi Pantaleev
|
||||
SPDX-FileCopyrightText: 2025 Suguru Hirahara
|
||||
|
||||
SPDX-License-Identifier: AGPL-3.0-or-later
|
||||
#}
|
||||
|
||||
[Unit]
|
||||
Description=a puppeting appservice bridge for Zulip
|
||||
{% for service in matrix_zulip_bridge_systemd_required_services_list %}
|
||||
Requires={{ service }}
|
||||
After={{ service }}
|
||||
{% endfor %}
|
||||
{% for service in matrix_zulip_bridge_systemd_wanted_services_list %}
|
||||
Wants={{ service }}
|
||||
{% endfor %}
|
||||
DefaultDependencies=no
|
||||
|
||||
[Service]
|
||||
Type=simple
|
||||
Environment="HOME={{ devture_systemd_docker_base_systemd_unit_home_path }}"
|
||||
ExecStartPre=-{{ devture_systemd_docker_base_host_command_docker }} stop -t {{ matrix_zulip_bridge_container_stop_grace_time_seconds }} matrix-bridge-zulip
|
||||
ExecStartPre=-{{ devture_systemd_docker_base_host_command_docker }} rm matrix-bridge-zulip
|
||||
|
||||
ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} create \
|
||||
--rm \
|
||||
--name=matrix-bridge-zulip \
|
||||
--log-driver=none \
|
||||
--user={{ matrix_user_uid }}:{{ matrix_user_gid }} \
|
||||
--cap-drop=ALL \
|
||||
--network={{ matrix_zulip_bridge_container_network }} \
|
||||
--mount type=bind,src={{ matrix_zulip_bridge_base_path }},dst=/config \
|
||||
--label-file={{ matrix_zulip_bridge_base_path }}/labels \
|
||||
{% for arg in matrix_zulip_bridge_container_extra_arguments %}
|
||||
{{ arg }} \
|
||||
{% endfor %}
|
||||
{{ matrix_zulip_bridge_docker_image }} \
|
||||
{% if matrix_zulip_bridge_owner %}
|
||||
-o {{ matrix_zulip_bridge_owner }} \
|
||||
{% endif %}
|
||||
--config /config/registration.yaml \
|
||||
--listen-address 0.0.0.0 \
|
||||
--listen-port {{ matrix_zulip_bridge_container_http_port }} \
|
||||
{{ matrix_zulip_bridge_homeserver_url }}
|
||||
|
||||
{% for network in matrix_zulip_bridge_container_additional_networks %}
|
||||
ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} network connect {{ network }} matrix-bridge-zulip
|
||||
{% endfor %}
|
||||
|
||||
ExecStart={{ devture_systemd_docker_base_host_command_docker }} start --attach matrix-bridge-zulip
|
||||
|
||||
ExecStop=-{{ devture_systemd_docker_base_host_command_docker }} stop -t {{ matrix_zulip_bridge_container_stop_grace_time_seconds }} matrix-bridge-zulip
|
||||
ExecStop=-{{ devture_systemd_docker_base_host_command_docker }} rm matrix-bridge-zulip
|
||||
Restart=always
|
||||
RestartSec=30
|
||||
SyslogIdentifier=matrix-bridge-zulip
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
@@ -87,7 +87,6 @@ matrix_client_element_container_labels_traefik_additional_response_headers_auto:
|
||||
{{
|
||||
{}
|
||||
| combine ({'X-XSS-Protection': matrix_client_element_http_header_xss_protection} if matrix_client_element_http_header_xss_protection else {})
|
||||
| combine ({'X-Frame-Options': matrix_client_element_http_header_frame_options} if matrix_client_element_http_header_frame_options else {})
|
||||
| combine ({'X-Content-Type-Options': matrix_client_element_http_header_content_type_options} if matrix_client_element_http_header_content_type_options else {})
|
||||
| combine ({'Content-Security-Policy': matrix_client_element_http_header_content_security_policy} if matrix_client_element_http_header_content_security_policy else {})
|
||||
| combine ({'Permission-Policy': matrix_client_element_http_header_content_permission_policy} if matrix_client_element_http_header_content_permission_policy else {})
|
||||
@@ -123,10 +122,6 @@ matrix_client_element_container_healthcheck_cmd: ""
|
||||
# - https://portswigger.net/web-security/cross-site-scripting/reflected
|
||||
matrix_client_element_http_header_xss_protection: "1; mode=block"
|
||||
|
||||
# Specifies the value of the `X-Frame-Options` header which controls whether framing can happen.
|
||||
# See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options
|
||||
matrix_client_element_http_header_frame_options: SAMEORIGIN
|
||||
|
||||
# Specifies the value of the `X-Content-Type-Options` header.
|
||||
# See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Content-Type-Options
|
||||
matrix_client_element_http_header_content_type_options: nosniff
|
||||
|
||||
@@ -66,7 +66,6 @@ matrix_client_fluffychat_container_labels_traefik_additional_response_headers_au
|
||||
{{
|
||||
{}
|
||||
| combine ({'X-XSS-Protection': matrix_client_fluffychat_http_header_xss_protection} if matrix_client_fluffychat_http_header_xss_protection else {})
|
||||
| combine ({'X-Frame-Options': matrix_client_fluffychat_http_header_frame_options} if matrix_client_fluffychat_http_header_frame_options else {})
|
||||
| combine ({'X-Content-Type-Options': matrix_client_fluffychat_http_header_content_type_options} if matrix_client_fluffychat_http_header_content_type_options else {})
|
||||
| combine ({'Content-Security-Policy': matrix_client_fluffychat_http_header_content_security_policy} if matrix_client_fluffychat_http_header_content_security_policy else {})
|
||||
| combine ({'Permission-Policy': matrix_client_fluffychat_http_header_content_permission_policy} if matrix_client_fluffychat_http_header_content_permission_policy else {})
|
||||
@@ -100,10 +99,6 @@ matrix_client_fluffychat_systemd_required_services_list_custom: []
|
||||
# - https://portswigger.net/web-security/cross-site-scripting/reflected
|
||||
matrix_client_fluffychat_http_header_xss_protection: "1; mode=block"
|
||||
|
||||
# Specifies the value of the `X-Frame-Options` header which controls whether framing can happen.
|
||||
# See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options
|
||||
matrix_client_fluffychat_http_header_frame_options: SAMEORIGIN
|
||||
|
||||
# Specifies the value of the `X-Content-Type-Options` header.
|
||||
# See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Content-Type-Options
|
||||
matrix_client_fluffychat_http_header_content_type_options: nosniff
|
||||
|
||||
@@ -68,7 +68,6 @@ matrix_client_hydrogen_container_labels_traefik_additional_response_headers_auto
|
||||
{{
|
||||
{}
|
||||
| combine ({'X-XSS-Protection': matrix_client_hydrogen_http_header_xss_protection} if matrix_client_hydrogen_http_header_xss_protection else {})
|
||||
| combine ({'X-Frame-Options': matrix_client_hydrogen_http_header_frame_options} if matrix_client_hydrogen_http_header_frame_options else {})
|
||||
| combine ({'X-Content-Type-Options': matrix_client_hydrogen_http_header_content_type_options} if matrix_client_hydrogen_http_header_content_type_options else {})
|
||||
| combine ({'Content-Security-Policy': matrix_client_hydrogen_http_header_content_security_policy} if matrix_client_hydrogen_http_header_content_security_policy else {})
|
||||
| combine ({'Permission-Policy': matrix_client_hydrogen_http_header_content_permission_policy} if matrix_client_hydrogen_http_header_content_permission_policy else {})
|
||||
@@ -99,10 +98,6 @@ matrix_client_hydrogen_systemd_required_services_list: "{{ [devture_systemd_dock
|
||||
# - https://portswigger.net/web-security/cross-site-scripting/reflected
|
||||
matrix_client_hydrogen_http_header_xss_protection: "1; mode=block"
|
||||
|
||||
# Specifies the value of the `X-Frame-Options` header which controls whether framing can happen.
|
||||
# See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options
|
||||
matrix_client_hydrogen_http_header_frame_options: SAMEORIGIN
|
||||
|
||||
# Specifies the value of the `X-Content-Type-Options` header.
|
||||
# See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Content-Type-Options
|
||||
matrix_client_hydrogen_http_header_content_type_options: nosniff
|
||||
|
||||
@@ -64,7 +64,6 @@ matrix_client_schildichat_container_labels_traefik_additional_response_headers_a
|
||||
{{
|
||||
{}
|
||||
| combine ({'X-XSS-Protection': matrix_client_schildichat_http_header_xss_protection} if matrix_client_schildichat_http_header_xss_protection else {})
|
||||
| combine ({'X-Frame-Options': matrix_client_schildichat_http_header_frame_options} if matrix_client_schildichat_http_header_frame_options else {})
|
||||
| combine ({'X-Content-Type-Options': matrix_client_schildichat_http_header_content_type_options} if matrix_client_schildichat_http_header_content_type_options else {})
|
||||
| combine ({'Content-Security-Policy': matrix_client_schildichat_http_header_content_security_policy} if matrix_client_schildichat_http_header_content_security_policy else {})
|
||||
| combine ({'Permission-Policy': matrix_client_schildichat_http_header_content_permission_policy} if matrix_client_schildichat_http_header_content_permission_policy else {})
|
||||
@@ -95,10 +94,6 @@ matrix_client_schildichat_systemd_required_services_list: "{{ [devture_systemd_d
|
||||
# - https://portswigger.net/web-security/cross-site-scripting/reflected
|
||||
matrix_client_schildichat_http_header_xss_protection: "1; mode=block"
|
||||
|
||||
# Specifies the value of the `X-Frame-Options` header which controls whether framing can happen.
|
||||
# See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options
|
||||
matrix_client_schildichat_http_header_frame_options: SAMEORIGIN
|
||||
|
||||
# Specifies the value of the `X-Content-Type-Options` header.
|
||||
# See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Content-Type-Options
|
||||
matrix_client_schildichat_http_header_content_type_options: nosniff
|
||||
|
||||
@@ -1,79 +0,0 @@
|
||||
# SPDX-FileCopyrightText: 2020 - 2025 Slavi Pantaleev
|
||||
# SPDX-FileCopyrightText: 2020 Scott Crossen
|
||||
# SPDX-FileCopyrightText: 2021 - 2022 MDAD project contributors
|
||||
# SPDX-FileCopyrightText: 2021 Ahmad Haghighi
|
||||
# SPDX-FileCopyrightText: 2022 Marko Weltzer
|
||||
# SPDX-FileCopyrightText: 2022 Nikita Chernyi
|
||||
# SPDX-FileCopyrightText: 2023 Samuel Meenzen
|
||||
#
|
||||
# SPDX-License-Identifier: AGPL-3.0-or-later
|
||||
|
||||
---
|
||||
# Project source code URL: https://github.com/linuxserver/docker-ddclient
|
||||
|
||||
# Whether dynamic dns is enabled
|
||||
matrix_dynamic_dns_enabled: true
|
||||
|
||||
# The dynamic dns daemon interval
|
||||
matrix_dynamic_dns_daemon_interval: '300'
|
||||
|
||||
# renovate: datasource=docker depName=linuxserver/ddclient versioning=semver
|
||||
matrix_dynamic_dns_version: 4.0.0
|
||||
|
||||
# The docker container to use when in mode
|
||||
matrix_dynamic_dns_docker_image: "{{ matrix_dynamic_dns_docker_image_registry_prefix }}linuxserver/ddclient:{{ matrix_dynamic_dns_version }}"
|
||||
|
||||
matrix_dynamic_dns_docker_image_registry_prefix: "{{ 'localhost/' if matrix_dynamic_dns_container_image_self_build else matrix_dynamic_dns_docker_image_registry_prefix_upstream }}"
|
||||
matrix_dynamic_dns_docker_image_registry_prefix_upstream: "{{ matrix_dynamic_dns_docker_image_registry_prefix_upstream_default }}"
|
||||
matrix_dynamic_dns_docker_image_registry_prefix_upstream_default: docker.io/
|
||||
|
||||
# The image to force pull
|
||||
matrix_dynamic_dns_docker_image_force_pull: "{{ matrix_dynamic_dns_docker_image.endswith(':latest') }}"
|
||||
|
||||
matrix_dynamic_dns_container_network: ''
|
||||
|
||||
matrix_dynamic_dns_container_additional_networks: "{{ matrix_dynamic_dns_container_additional_networks_auto + matrix_dynamic_dns_container_additional_networks_custom }}"
|
||||
matrix_dynamic_dns_container_additional_networks_auto: []
|
||||
matrix_dynamic_dns_container_additional_networks_custom: []
|
||||
|
||||
# List of extra arguments to pass to the container mode
|
||||
matrix_dynamic_dns_container_extra_arguments: []
|
||||
|
||||
# List of wanted services when running in mode
|
||||
matrix_dynamic_dns_systemd_wanted_services_list: []
|
||||
|
||||
# List of required services when running in mode
|
||||
matrix_dynamic_dns_systemd_required_services_list: "{{ [devture_systemd_docker_base_docker_service_name] if devture_systemd_docker_base_docker_service_name else [] }}"
|
||||
|
||||
# Build the container from source when running in mode
|
||||
matrix_dynamic_dns_container_image_self_build: false
|
||||
matrix_dynamic_dns_container_image_self_build_repo: "https://github.com/linuxserver/docker-ddclient.git"
|
||||
matrix_dynamic_dns_container_image_self_build_repo_branch: "{{ matrix_dynamic_dns_version }}"
|
||||
|
||||
# Config paths
|
||||
matrix_dynamic_dns_base_path: "{{ matrix_base_data_path }}/dynamic-dns"
|
||||
matrix_dynamic_dns_config_path: "{{ matrix_dynamic_dns_base_path }}/config"
|
||||
matrix_dynamic_dns_docker_src_files_path: "{{ matrix_dynamic_dns_base_path }}/docker-src"
|
||||
|
||||
# Config options
|
||||
matrix_dynamic_dns_use: "web"
|
||||
|
||||
# The endpoint to use to determine your external IP
|
||||
matrix_dynamic_dns_web: "https://cloudflare.com/cdn-cgi/trace"
|
||||
|
||||
# The field to extract the IP from
|
||||
# If your endpoint defined in `matrix_dynamic_dns_web` doesn't need this, just set it to ""
|
||||
matrix_dynamic_dns_web_skip: "ip="
|
||||
|
||||
matrix_dynamic_dns_additional_configuration_blocks: []
|
||||
|
||||
# Holds the configurations (the domains to update DNS for, the providers they use, etc.)
|
||||
#
|
||||
# Example:
|
||||
# matrix_dynamic_dns_domain_configurations:
|
||||
# - provider: domains.google.com
|
||||
# protocol: dyndn2
|
||||
# username: XXXXXXXXXXXXXXXX
|
||||
# password: XXXXXXXXXXXXXXXX
|
||||
# domain: "{{ matrix_domain }}"
|
||||
matrix_dynamic_dns_domain_configurations: []
|
||||
@@ -1,26 +0,0 @@
|
||||
# SPDX-FileCopyrightText: 2020 Scott Crossen
|
||||
# SPDX-FileCopyrightText: 2022 - 2023 Slavi Pantaleev
|
||||
# SPDX-FileCopyrightText: 2022 Marko Weltzer
|
||||
#
|
||||
# SPDX-License-Identifier: AGPL-3.0-or-later
|
||||
|
||||
---
|
||||
|
||||
- tags:
|
||||
- setup-all
|
||||
- setup-dynamic-dns
|
||||
- install-all
|
||||
- install-dynamic-dns
|
||||
block:
|
||||
- when: matrix_dynamic_dns_enabled | bool
|
||||
ansible.builtin.include_tasks: "{{ role_path }}/tasks/validate_config.yml"
|
||||
|
||||
- when: matrix_dynamic_dns_enabled | bool
|
||||
ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_install.yml"
|
||||
|
||||
- tags:
|
||||
- setup-all
|
||||
- setup-dynamic-dns
|
||||
block:
|
||||
- when: not matrix_dynamic_dns_enabled | bool
|
||||
ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_uninstall.yml"
|
||||
@@ -1,79 +0,0 @@
|
||||
# SPDX-FileCopyrightText: 2020 - 2024 Slavi Pantaleev
|
||||
# SPDX-FileCopyrightText: 2020 Scott Crossen
|
||||
# SPDX-FileCopyrightText: 2022 Marko Weltzer
|
||||
# SPDX-FileCopyrightText: 2022 Nikita Chernyi
|
||||
# SPDX-FileCopyrightText: 2022 Sebastian Gumprich
|
||||
# SPDX-FileCopyrightText: 2024 David Mehren
|
||||
#
|
||||
# SPDX-License-Identifier: AGPL-3.0-or-later
|
||||
|
||||
---
|
||||
|
||||
- name: Ensure Dynamic DNS image is pulled
|
||||
community.docker.docker_image:
|
||||
name: "{{ matrix_dynamic_dns_docker_image }}"
|
||||
source: "{{ 'pull' if ansible_version.major > 2 or ansible_version.minor > 7 else omit }}"
|
||||
force_source: "{{ matrix_dynamic_dns_docker_image_force_pull if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}"
|
||||
force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else matrix_dynamic_dns_docker_image_force_pull }}"
|
||||
when: matrix_dynamic_dns_enabled | bool and not matrix_dynamic_dns_container_image_self_build
|
||||
register: result
|
||||
retries: "{{ devture_playbook_help_container_retries_count }}"
|
||||
delay: "{{ devture_playbook_help_container_retries_delay }}"
|
||||
until: result is not failed
|
||||
|
||||
- name: Ensure Dynamic DNS paths exist
|
||||
ansible.builtin.file:
|
||||
path: "{{ item.path }}"
|
||||
state: directory
|
||||
mode: 0751
|
||||
owner: "{{ matrix_user_name }}"
|
||||
group: "{{ matrix_group_name }}"
|
||||
with_items:
|
||||
- {path: "{{ matrix_dynamic_dns_base_path }}", when: true}
|
||||
- {path: "{{ matrix_dynamic_dns_config_path }}", when: true}
|
||||
- {path: "{{ matrix_dynamic_dns_docker_src_files_path }}", when: "{{ matrix_dynamic_dns_container_image_self_build }}"}
|
||||
when: matrix_dynamic_dns_enabled | bool and item.when | bool
|
||||
|
||||
- name: Ensure Dynamic DNS repository is present on self build
|
||||
ansible.builtin.git:
|
||||
repo: "{{ matrix_dynamic_dns_container_image_self_build_repo }}"
|
||||
version: "{{ matrix_dynamic_dns_container_image_self_build_repo_branch }}"
|
||||
dest: "{{ matrix_dynamic_dns_docker_src_files_path }}"
|
||||
force: "yes"
|
||||
become: true
|
||||
become_user: "{{ matrix_user_name }}"
|
||||
register: matrix_dynamic_dns_git_pull_results
|
||||
when: "matrix_dynamic_dns_enabled | bool and matrix_dynamic_dns_container_image_self_build | bool"
|
||||
|
||||
- name: Ensure Dynamic DNS Docker image is built
|
||||
community.docker.docker_image:
|
||||
name: "{{ matrix_dynamic_dns_docker_image }}"
|
||||
source: build
|
||||
force_source: "{{ matrix_dynamic_dns_git_pull_results.changed if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}"
|
||||
force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else matrix_dynamic_dns_git_pull_results.changed }}"
|
||||
build:
|
||||
dockerfile: Dockerfile
|
||||
path: "{{ matrix_dynamic_dns_docker_src_files_path }}"
|
||||
pull: true
|
||||
when: "matrix_dynamic_dns_enabled | bool and matrix_dynamic_dns_container_image_self_build | bool"
|
||||
|
||||
- name: Ensure Dynamic DNS ddclient.conf installed
|
||||
ansible.builtin.template:
|
||||
src: "{{ role_path }}/templates/ddclient.conf.j2"
|
||||
dest: "{{ matrix_dynamic_dns_config_path }}/ddclient.conf"
|
||||
mode: 0644
|
||||
owner: "{{ matrix_user_name }}"
|
||||
group: "{{ matrix_group_name }}"
|
||||
|
||||
- name: Ensure matrix-dynamic-dns container network is created
|
||||
community.general.docker_network:
|
||||
enable_ipv6: "{{ devture_systemd_docker_base_ipv6_enabled }}"
|
||||
name: "{{ matrix_dynamic_dns_container_network }}"
|
||||
driver: bridge
|
||||
driver_options: "{{ devture_systemd_docker_base_container_networks_driver_options }}"
|
||||
|
||||
- name: Ensure matrix-dynamic-dns.service installed
|
||||
ansible.builtin.template:
|
||||
src: "{{ role_path }}/templates/systemd/matrix-dynamic-dns.service.j2"
|
||||
dest: "/etc/systemd/system/matrix-dynamic-dns.service"
|
||||
mode: 0644
|
||||
@@ -1,26 +0,0 @@
|
||||
# SPDX-FileCopyrightText: 2020 - 2022 Slavi Pantaleev
|
||||
# SPDX-FileCopyrightText: 2020 Scott Crossen
|
||||
# SPDX-FileCopyrightText: 2022 Marko Weltzer
|
||||
#
|
||||
# SPDX-License-Identifier: AGPL-3.0-or-later
|
||||
|
||||
---
|
||||
|
||||
- name: Check existence of matrix-dynamic-dns service
|
||||
ansible.builtin.stat:
|
||||
path: "{{ devture_systemd_docker_base_systemd_path }}/matrix-dynamic-dns.service"
|
||||
register: matrix_dynamic_dns_service_stat
|
||||
|
||||
- when: matrix_dynamic_dns_service_stat.stat.exists | bool
|
||||
block:
|
||||
- name: Ensure matrix-dynamic-dns is stopped
|
||||
ansible.builtin.service:
|
||||
name: matrix-dynamic-dns
|
||||
state: stopped
|
||||
enabled: false
|
||||
daemon_reload: true
|
||||
|
||||
- name: Ensure matrix-dynamic-dns.service doesn't exist
|
||||
ansible.builtin.file:
|
||||
path: "{{ devture_systemd_docker_base_systemd_path }}/matrix-dynamic-dns.service"
|
||||
state: absent
|
||||
@@ -1,37 +0,0 @@
|
||||
# SPDX-FileCopyrightText: 2020 - 2025 Slavi Pantaleev
|
||||
# SPDX-FileCopyrightText: 2020 Scott Crossen
|
||||
#
|
||||
# SPDX-License-Identifier: AGPL-3.0-or-later
|
||||
|
||||
---
|
||||
|
||||
- name: Fail if no matrix-dynamic-dns configurations specified
|
||||
ansible.builtin.fail:
|
||||
msg: >-
|
||||
You need to define at least one configuration in `matrix_dynamic_dns_domain_configurations` for using matrix-dynamic-dns.
|
||||
when: "matrix_dynamic_dns_domain_configurations | length == 0"
|
||||
|
||||
- name: Fail if required matrix-dynamic-dns settings not defined in configuration blocks
|
||||
ansible.builtin.fail:
|
||||
msg: >-
|
||||
One of the configurations in matrix_dynamic_dns_domain_configurations is missing a required key (domain, protocol).
|
||||
when: "'domain' not in configuration or 'protocol' not in configuration"
|
||||
with_items: "{{ matrix_dynamic_dns_domain_configurations }}"
|
||||
loop_control:
|
||||
loop_var: configuration
|
||||
|
||||
- name: Fail if required matrix-dynamic-dns settings not defined
|
||||
ansible.builtin.fail:
|
||||
msg: >-
|
||||
You need to define a required configuration setting (`{{ item.name }}`).
|
||||
when: "item.when | bool and lookup('vars', item.name, default='') | string | length == 0"
|
||||
with_items:
|
||||
- {'name': 'matrix_dynamic_dns_container_network', when: true}
|
||||
|
||||
- name: (Deprecation) Catch and report renamed matrix-dynamic-dns variables
|
||||
ansible.builtin.fail:
|
||||
msg: >-
|
||||
The variable `{{ item.old }}` is deprecated. Please use `{{ item.new }}` instead.
|
||||
when: "lookup('ansible.builtin.varnames', ('^' + item.old + '$'), wantlist=True) | length > 0"
|
||||
with_items:
|
||||
- {'old': 'matrix_dynamic_dns_container_image_name_prefix', 'new': 'matrix_dynamic_dns_docker_image_registry_prefix'}
|
||||
@@ -1,78 +0,0 @@
|
||||
{#
|
||||
SPDX-FileCopyrightText: 2020 Scott Crossen
|
||||
SPDX-FileCopyrightText: 2022 Slavi Pantaleev
|
||||
|
||||
SPDX-License-Identifier: AGPL-3.0-or-later
|
||||
#}
|
||||
|
||||
daemon={{ matrix_dynamic_dns_daemon_interval }}
|
||||
syslog=no
|
||||
pid=/var/run/ddclient/ddclient.pid
|
||||
ssl=yes
|
||||
use={{ matrix_dynamic_dns_use }}
|
||||
web='{{ matrix_dynamic_dns_web }}'
|
||||
{% if matrix_dynamic_dns_web_skip %}
|
||||
web-skip='{{ matrix_dynamic_dns_web_skip }}'
|
||||
{% endif %}
|
||||
|
||||
{% for matrix_dynamic_dns_additional_configuration in matrix_dynamic_dns_additional_configuration_blocks %}
|
||||
{{ matrix_dynamic_dns_additional_configuration }}
|
||||
{% endfor %}
|
||||
|
||||
{% for dynamic_dns_domain_configuration in matrix_dynamic_dns_domain_configurations %}
|
||||
protocol={{ dynamic_dns_domain_configuration.protocol }}
|
||||
|
||||
{% if 'apikey' in dynamic_dns_domain_configuration %}
|
||||
apikey={{ dynamic_dns_domain_configuration.apikey }}
|
||||
{% endif %}
|
||||
|
||||
{% if 'secretapikey' in dynamic_dns_domain_configuration %}
|
||||
secretapikey={{ dynamic_dns_domain_configuration.secretapikey }}
|
||||
{% endif %}
|
||||
|
||||
{% if 'rootdomain' in dynamic_dns_domain_configuration %}
|
||||
root-domain={{ dynamic_dns_domain_configuration.rootdomain }}
|
||||
{% endif %}
|
||||
|
||||
{% if 'provider' in dynamic_dns_domain_configuration %}
|
||||
server={{ dynamic_dns_domain_configuration.provider }}
|
||||
{% endif %}
|
||||
|
||||
{% if 'username' in dynamic_dns_domain_configuration %}
|
||||
login='{{ dynamic_dns_domain_configuration.username }}'
|
||||
{% endif %}
|
||||
|
||||
{% if 'password' in dynamic_dns_domain_configuration %}
|
||||
password='{{ dynamic_dns_domain_configuration.password }}'
|
||||
{% endif %}
|
||||
|
||||
{% if 'static' in dynamic_dns_domain_configuration %}
|
||||
static=yes
|
||||
{% endif %}
|
||||
|
||||
{% if 'custom' in dynamic_dns_domain_configuration %}
|
||||
custom=yes
|
||||
{% endif %}
|
||||
|
||||
{% if 'zone' in dynamic_dns_domain_configuration %}
|
||||
zone={{ dynamic_dns_domain_configuration.zone }}
|
||||
{% endif %}
|
||||
|
||||
{% if 'ttl' in dynamic_dns_domain_configuration %}
|
||||
ttl={{ dynamic_dns_domain_configuration.ttl }}
|
||||
{% endif %}
|
||||
|
||||
{% if 'mx' in dynamic_dns_domain_configuration %}
|
||||
mx={{ dynamic_dns_domain_configuration.mx }}
|
||||
{% endif %}
|
||||
|
||||
{% if 'wildcard' in dynamic_dns_domain_configuration %}
|
||||
wildcard=yes
|
||||
{% endif %}
|
||||
|
||||
{% if 'script' in dynamic_dns_domain_configuration %}
|
||||
script={{ dynamic_dns_domain_configuration.script }}
|
||||
{% endif %}
|
||||
|
||||
{{ dynamic_dns_domain_configuration.domain }}
|
||||
{% endfor %}
|
||||
@@ -1,46 +0,0 @@
|
||||
#jinja2: lstrip_blocks: True
|
||||
[Unit]
|
||||
Description=Matrix Dynamic DNS
|
||||
{% for service in matrix_dynamic_dns_systemd_required_services_list %}
|
||||
Requires={{ service }}
|
||||
After={{ service }}
|
||||
{% endfor %}
|
||||
{% for service in matrix_dynamic_dns_systemd_wanted_services_list %}
|
||||
Wants={{ service }}
|
||||
{% endfor %}
|
||||
DefaultDependencies=no
|
||||
|
||||
[Service]
|
||||
Type=simple
|
||||
Environment="HOME={{ devture_systemd_docker_base_systemd_unit_home_path }}"
|
||||
ExecStartPre=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} stop -t {{ devture_systemd_docker_base_container_stop_grace_time_seconds }} matrix-dynamic-dns 2>/dev/null || true'
|
||||
ExecStartPre=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} rm matrix-dynamic-dns 2>/dev/null || true'
|
||||
|
||||
ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} create \
|
||||
--rm \
|
||||
--name=matrix-dynamic-dns \
|
||||
--log-driver=none \
|
||||
--network={{ matrix_dynamic_dns_container_network }} \
|
||||
-e PUID={{ matrix_user_uid }} \
|
||||
-e PGID={{ matrix_user_gid }} \
|
||||
--mount type=bind,src={{ matrix_dynamic_dns_config_path }},dst=/config \
|
||||
{% for arg in matrix_dynamic_dns_container_extra_arguments %}
|
||||
{{ arg }} \
|
||||
{% endfor %}
|
||||
{{ matrix_dynamic_dns_docker_image }}
|
||||
|
||||
|
||||
{% for network in matrix_dynamic_dns_container_additional_networks %}
|
||||
ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} network connect {{ network }} matrix-dynamic-dns
|
||||
{% endfor %}
|
||||
|
||||
ExecStart={{ devture_systemd_docker_base_host_command_docker }} start --attach matrix-dynamic-dns
|
||||
|
||||
ExecStop=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} stop -t {{ devture_systemd_docker_base_container_stop_grace_time_seconds }} matrix-dynamic-dns 2>/dev/null || true'
|
||||
ExecStop=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} rm matrix-dynamic-dns 2>/dev/null || true'
|
||||
Restart=always
|
||||
RestartSec=30
|
||||
SyslogIdentifier=matrix-dynamic-dns
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
-4
@@ -1,4 +0,0 @@
|
||||
SPDX-FileCopyrightText: 2020 - 2025 Slavi Pantaleev
|
||||
SPDX-FileCopyrightText: 2020 Scott Crossen
|
||||
|
||||
SPDX-License-Identifier: AGPL-3.0-or-later
|
||||
@@ -1,250 +0,0 @@
|
||||
# SPDX-FileCopyrightText: 2020 - 2022 MDAD project contributors
|
||||
# SPDX-FileCopyrightText: 2020 - 2024 Slavi Pantaleev
|
||||
# SPDX-FileCopyrightText: 2020 Marcel Partap
|
||||
# SPDX-FileCopyrightText: 2020 Matt Cengia
|
||||
# SPDX-FileCopyrightText: 2021 Aaron Raimist
|
||||
# SPDX-FileCopyrightText: 2021 Ahmad Haghighi
|
||||
# SPDX-FileCopyrightText: 2021 boris runakov
|
||||
# SPDX-FileCopyrightText: 2022 Marko Weltzer
|
||||
# SPDX-FileCopyrightText: 2022 Nikita Chernyi
|
||||
# SPDX-FileCopyrightText: 2023 Samuel Meenzen
|
||||
# SPDX-FileCopyrightText: 2024 - 2025 Suguru Hirahara
|
||||
#
|
||||
# SPDX-License-Identifier: AGPL-3.0-or-later
|
||||
|
||||
---
|
||||
# ma1sd is a Federated Matrix Identity Server
|
||||
# Project source code URL: https://github.com/ma1uta/ma1sd
|
||||
|
||||
matrix_ma1sd_enabled: true
|
||||
|
||||
matrix_ma1sd_scheme: https
|
||||
matrix_ma1sd_hostname: ''
|
||||
|
||||
matrix_ma1sd_container_image_self_build: false
|
||||
matrix_ma1sd_container_image_self_build_repo: "https://github.com/ma1uta/ma1sd.git"
|
||||
matrix_ma1sd_container_image_self_build_branch: "{{ matrix_ma1sd_version }}"
|
||||
|
||||
# renovate: datasource=docker depName=ma1uta/ma1sd
|
||||
matrix_ma1sd_version: "2.5.0"
|
||||
|
||||
matrix_ma1sd_docker_image: "{{ matrix_ma1sd_docker_image_registry_prefix }}ma1uta/ma1sd:{{ matrix_ma1sd_version }}"
|
||||
matrix_ma1sd_docker_image_registry_prefix: "{{ 'localhost/' if matrix_ma1sd_container_image_self_build else matrix_ma1sd_docker_image_registry_prefix_upstream }}"
|
||||
matrix_ma1sd_docker_image_registry_prefix_upstream: "{{ matrix_ma1sd_docker_image_registry_prefix_upstream_default }}"
|
||||
matrix_ma1sd_docker_image_registry_prefix_upstream_default: "docker.io/"
|
||||
matrix_ma1sd_docker_image_force_pull: "{{ matrix_ma1sd_docker_image.endswith(':latest') }}"
|
||||
|
||||
matrix_ma1sd_base_path: "{{ matrix_base_data_path }}/ma1sd"
|
||||
# We need the docker src directory to be named ma1sd. See: https://github.com/spantaleev/matrix-docker-ansible-deploy/pull/588
|
||||
matrix_ma1sd_docker_src_files_path: "{{ matrix_ma1sd_base_path }}/docker-src/ma1sd"
|
||||
matrix_ma1sd_config_path: "{{ matrix_ma1sd_base_path }}/config"
|
||||
matrix_ma1sd_data_path: "{{ matrix_ma1sd_base_path }}/data"
|
||||
|
||||
matrix_ma1sd_container_port: 8090
|
||||
# Controls whether the matrix-ma1sd container exposes its HTTP port (tcp/{{ matrix_ma1sd_container_port }} in the container).
|
||||
#
|
||||
# Takes an "<ip>:<port>" or "<port>" value (e.g. "127.0.0.1:8090"), or empty string to not expose.
|
||||
matrix_ma1sd_container_http_host_bind_port: ''
|
||||
|
||||
# A list of extra arguments to pass to the container
|
||||
matrix_ma1sd_container_extra_arguments: []
|
||||
|
||||
# List of systemd services that matrix-ma1sd.service depends on
|
||||
matrix_ma1sd_systemd_required_services_list: "{{ matrix_ma1sd_systemd_required_services_list_default + matrix_ma1sd_systemd_required_services_list_auto + matrix_ma1sd_systemd_required_services_list_custom }}"
|
||||
matrix_ma1sd_systemd_required_services_list_default: "{{ [devture_systemd_docker_base_docker_service_name] if devture_systemd_docker_base_docker_service_name else [] }}"
|
||||
matrix_ma1sd_systemd_required_services_list_auto: []
|
||||
matrix_ma1sd_systemd_required_services_list_custom: []
|
||||
|
||||
# List of systemd services that matrix-ma1sd.service wants
|
||||
matrix_ma1sd_systemd_wanted_services_list: "{{ matrix_ma1sd_systemd_wanted_services_list_default + matrix_ma1sd_systemd_wanted_services_list_auto + matrix_ma1sd_systemd_wanted_services_list_custom }}"
|
||||
matrix_ma1sd_systemd_wanted_services_list_default: []
|
||||
matrix_ma1sd_systemd_wanted_services_list_auto: []
|
||||
matrix_ma1sd_systemd_wanted_services_list_custom: []
|
||||
|
||||
# The base container network. It will be auto-created by this role if it doesn't exist already.
|
||||
matrix_ma1sd_container_network: ""
|
||||
|
||||
# A list of additional container networks that matrix-ma1sd would be connected to.
|
||||
# The playbook does not create these networks, so make sure they already exist.
|
||||
#
|
||||
# Use this to expose matrix-ma1sd to another docker network, that matrix-ma1sd might have to reach for authentication (e.g. an ldap instance)
|
||||
matrix_ma1sd_container_additional_networks: "{{ matrix_ma1sd_container_additional_networks_auto + matrix_ma1sd_container_additional_networks_custom }}"
|
||||
matrix_ma1sd_container_additional_networks_auto: []
|
||||
matrix_ma1sd_container_additional_networks_custom: []
|
||||
|
||||
# matrix_ma1sd_container_labels_traefik_enabled controls whether labels to assist a Traefik reverse-proxy will be attached to the container.
|
||||
# See `../templates/labels.j2` for details.
|
||||
#
|
||||
# To inject your own other container labels, see `matrix_ma1sd_container_labels_additional_labels`.
|
||||
matrix_ma1sd_container_labels_traefik_enabled: true
|
||||
matrix_ma1sd_container_labels_traefik_docker_network: "{{ matrix_ma1sd_container_network }}"
|
||||
matrix_ma1sd_container_labels_traefik_entrypoints: web-secure
|
||||
matrix_ma1sd_container_labels_traefik_tls_certResolver: default # noqa var-naming
|
||||
|
||||
# Controls whether labels will be added that expose ma1sd's /_matrix/identity endpoints
|
||||
matrix_ma1sd_container_labels_matrix_identity_enabled: "{{ matrix_ma1sd_container_labels_traefik_enabled }}"
|
||||
matrix_ma1sd_container_labels_matrix_identity_hostname: "{{ matrix_ma1sd_hostname }}"
|
||||
matrix_ma1sd_container_labels_matrix_identity_path_prefix: "/_matrix/identity"
|
||||
matrix_ma1sd_container_labels_matrix_identity_traefik_rule: "Host(`{{ matrix_ma1sd_container_labels_matrix_identity_hostname }}`) && PathPrefix(`{{ matrix_ma1sd_container_labels_matrix_identity_path_prefix }}`)"
|
||||
matrix_ma1sd_container_labels_matrix_identity_traefik_priority: 0
|
||||
matrix_ma1sd_container_labels_matrix_identity_traefik_entrypoints: "{{ matrix_ma1sd_container_labels_traefik_entrypoints }}"
|
||||
matrix_ma1sd_container_labels_matrix_identity_traefik_tls: "{{ matrix_ma1sd_container_labels_matrix_identity_traefik_entrypoints != 'web' }}"
|
||||
matrix_ma1sd_container_labels_matrix_identity_traefik_tls_certResolver: "{{ matrix_ma1sd_container_labels_traefik_tls_certResolver }}" # noqa var-naming
|
||||
|
||||
# Controls whether labels will be added that expose ma1sd's /_matrix/client/VERSION/user_directory/search endpoint
|
||||
matrix_ma1sd_container_labels_matrix_client_user_directory_search_enabled: "{{ matrix_ma1sd_container_labels_traefik_enabled }}"
|
||||
matrix_ma1sd_container_labels_matrix_client_user_directory_search_hostname: "{{ matrix_ma1sd_hostname }}"
|
||||
matrix_ma1sd_container_labels_matrix_client_user_directory_search_path_regexp: "/_matrix/client/(?P<version>(r0|v3))/user_directory/search"
|
||||
matrix_ma1sd_container_labels_matrix_client_user_directory_search_traefik_rule: "Host(`{{ matrix_ma1sd_container_labels_matrix_client_user_directory_search_hostname }}`) && PathRegexp(`{{ matrix_ma1sd_container_labels_matrix_client_user_directory_search_path_regexp }}`)"
|
||||
matrix_ma1sd_container_labels_matrix_client_user_directory_search_traefik_priority: 0
|
||||
matrix_ma1sd_container_labels_matrix_client_user_directory_search_traefik_entrypoints: "{{ matrix_ma1sd_container_labels_traefik_entrypoints }}"
|
||||
matrix_ma1sd_container_labels_matrix_client_user_directory_search_traefik_tls: "{{ matrix_ma1sd_container_labels_matrix_client_user_directory_search_traefik_entrypoints != 'web' }}"
|
||||
matrix_ma1sd_container_labels_matrix_client_user_directory_search_traefik_tls_certResolver: "{{ matrix_ma1sd_container_labels_traefik_tls_certResolver }}" # noqa var-naming
|
||||
|
||||
# Controls whether labels will be added that expose ma1sd's /_matrix/client/VERSION/register/TYPE/requestToken endpoints
|
||||
# This allows another service to control registrations involving 3PIDs.
|
||||
# To learn more, see: https://github.com/ma1uta/ma1sd/blob/master/docs/features/registration.md
|
||||
matrix_ma1sd_container_labels_matrix_client_3pid_registration_enabled: false
|
||||
matrix_ma1sd_container_labels_matrix_client_3pid_registration_hostname: "{{ matrix_ma1sd_hostname }}"
|
||||
matrix_ma1sd_container_labels_matrix_client_3pid_registration_path_regexp: "/_matrix/client/(?P<version>(r0|v3))/register/(?P<type>(email|msisdn))/requestToken"
|
||||
matrix_ma1sd_container_labels_matrix_client_3pid_registration_traefik_rule: "Host(`{{ matrix_ma1sd_container_labels_matrix_client_3pid_registration_hostname }}`) && PathRegexp(`{{ matrix_ma1sd_container_labels_matrix_client_3pid_registration_path_regexp }}`)"
|
||||
matrix_ma1sd_container_labels_matrix_client_3pid_registration_traefik_priority: 0
|
||||
matrix_ma1sd_container_labels_matrix_client_3pid_registration_traefik_entrypoints: "{{ matrix_ma1sd_container_labels_traefik_entrypoints }}"
|
||||
matrix_ma1sd_container_labels_matrix_client_3pid_registration_traefik_tls: "{{ matrix_ma1sd_container_labels_matrix_client_3pid_registration_traefik_entrypoints != 'web' }}"
|
||||
matrix_ma1sd_container_labels_matrix_client_3pid_registration_traefik_tls_certResolver: "{{ matrix_ma1sd_container_labels_traefik_tls_certResolver }}" # noqa var-naming
|
||||
|
||||
# matrix_ma1sd_container_labels_additional_labels contains a multiline string with additional labels to add to the container label file.
|
||||
# See `../templates/labels.j2` for details.
|
||||
#
|
||||
# Example:
|
||||
# matrix_ma1sd_container_labels_additional_labels: |
|
||||
# my.label=1
|
||||
# another.label="here"
|
||||
matrix_ma1sd_container_labels_additional_labels: ''
|
||||
|
||||
# Your identity server is private by default.
|
||||
# To ensure maximum discovery, you can make your identity server
|
||||
# also forward lookups to the central matrix.org Identity server
|
||||
# (at the cost of potentially leaking all your contacts information).
|
||||
# Enabling this is discouraged. Learn more here: https://github.com/ma1uta/ma1sd/blob/master/docs/features/identity.md#lookups
|
||||
matrix_ma1sd_matrixorg_forwarding_enabled: false
|
||||
|
||||
# Database-related configuration fields.
|
||||
#
|
||||
# To use SQLite, stick to these defaults.
|
||||
#
|
||||
# To use Postgres:
|
||||
# - change the engine (`matrix_ma1sd_database_engine: 'postgres'`)
|
||||
# - adjust your database credentials via the `matrix_ma1sd_database_*` variables
|
||||
matrix_ma1sd_database_engine: 'sqlite'
|
||||
|
||||
matrix_ma1sd_sqlite_database_path_local: "{{ matrix_ma1sd_data_path }}/ma1sd.db"
|
||||
matrix_ma1sd_sqlite_database_path_in_container: "/var/ma1sd/ma1sd.db"
|
||||
|
||||
matrix_ma1sd_database_username: 'matrix_ma1sd'
|
||||
matrix_ma1sd_database_password: 'some-password'
|
||||
matrix_ma1sd_database_hostname: ''
|
||||
matrix_ma1sd_database_port: 5432
|
||||
matrix_ma1sd_database_name: 'matrix_ma1sd'
|
||||
|
||||
matrix_ma1sd_database_connection_string: 'postgresql://{{ matrix_ma1sd_database_username }}:{{ matrix_ma1sd_database_password }}@{{ matrix_ma1sd_database_hostname }}:{{ matrix_ma1sd_database_port }}/{{ matrix_ma1sd_database_name }}'
|
||||
|
||||
|
||||
# ma1sd has several supported identity stores.
|
||||
# One of them is storing identities directly in Synapse's database.
|
||||
# Learn more here: https://github.com/ma1uta/ma1sd/blob/master/docs/stores/synapse.md
|
||||
matrix_ma1sd_synapsesql_enabled: false
|
||||
matrix_ma1sd_synapsesql_type: ""
|
||||
matrix_ma1sd_synapsesql_connection: ""
|
||||
|
||||
# Setting up email-sending settings is required for using ma1sd.
|
||||
matrix_ma1sd_threepid_medium_email_identity_from: "matrix@{{ matrix_domain }}"
|
||||
matrix_ma1sd_threepid_medium_email_connectors_smtp_host: ""
|
||||
matrix_ma1sd_threepid_medium_email_connectors_smtp_port: 587
|
||||
matrix_ma1sd_threepid_medium_email_connectors_smtp_tls: 1
|
||||
matrix_ma1sd_threepid_medium_email_connectors_smtp_login: ""
|
||||
matrix_ma1sd_threepid_medium_email_connectors_smtp_password: ""
|
||||
|
||||
# DNS overwrites are useful for telling ma1sd how it can reach the homeserver directly.
|
||||
# Useful when reverse-proxying certain URLs (e.g. `/_matrix/client/r0/user_directory/search`) to ma1sd,
|
||||
# so that ma1sd can rewrite the original URL to one that would reach the homeserver.
|
||||
matrix_ma1sd_dns_overwrite_enabled: false
|
||||
matrix_ma1sd_dns_overwrite_homeserver_client_name: "{{ matrix_server_fqn_matrix }}"
|
||||
matrix_ma1sd_dns_overwrite_homeserver_client_value: ""
|
||||
|
||||
# Override the default session templates
|
||||
# To use this, fill in the template variables with the full desired template as a multi-line YAML variable
|
||||
#
|
||||
# More info:
|
||||
# https://github.com/ma1uta/ma1sd/blob/master/docs/threepids/session/session-views.md
|
||||
matrix_ma1sd_view_session_custom_templates_enabled: false
|
||||
# Defaults to: https://github.com/ma1uta/ma1sd/blob/master/src/main/resources/templates/session/tokenSubmitSuccess.html
|
||||
matrix_ma1sd_view_session_custom_onTokenSubmit_success_template: "" # noqa var-naming
|
||||
# Defaults to: https://github.com/ma1uta/ma1sd/blob/master/src/main/resources/templates/session/tokenSubmitFailure.html
|
||||
matrix_ma1sd_view_session_custom_onTokenSubmit_failure_template: "" # noqa var-naming
|
||||
|
||||
# Override the default email templates
|
||||
# To use this, fill in the template variables with the full desired template as a multi-line YAML variable
|
||||
#
|
||||
# More info:
|
||||
# https://github.com/ma1uta/ma1sd/blob/master/docs/threepids/notification/template-generator.md
|
||||
# https://github.com/ma1uta/ma1sd/tree/master/src/main/resources/threepids/email
|
||||
matrix_ma1sd_threepid_medium_email_custom_templates_enabled: false
|
||||
# Defaults to: https://github.com/ma1uta/ma1sd/blob/master/src/main/resources/threepids/email/invite-template.eml
|
||||
matrix_ma1sd_threepid_medium_email_custom_invite_template: ""
|
||||
# Defaults to: https://github.com/ma1uta/ma1sd/blob/master/src/main/resources/threepids/email/validate-template.eml
|
||||
matrix_ma1sd_threepid_medium_email_custom_session_validation_template: ""
|
||||
# Defaults to: https://github.com/ma1uta/ma1sd/blob/master/src/main/resources/threepids/email/unbind-notification.eml
|
||||
matrix_ma1sd_threepid_medium_email_custom_session_unbind_notification_template: ""
|
||||
# Defaults to: https://github.com/ma1uta/ma1sd/blob/master/src/main/resources/threepids/email/mxid-template.eml
|
||||
matrix_ma1sd_threepid_medium_email_custom_matrixid_template: ""
|
||||
|
||||
matrix_ma1sd_self_check_endpoint_url: "{{ matrix_ma1sd_scheme }}://{{ matrix_ma1sd_hostname }}/_matrix/identity/api/v1"
|
||||
# Controls whether the self-check feature should validate SSL certificates.
|
||||
matrix_ma1sd_self_check_validate_certificates: true
|
||||
|
||||
# Controls ma1sd logging verbosity for troubleshooting.
|
||||
#
|
||||
# See: https://github.com/ma1uta/ma1sd/blob/master/docs/troubleshooting.md#increase-verbosity
|
||||
matrix_ma1sd_verbose_logging: false
|
||||
|
||||
# Setting up support for API prefixes
|
||||
matrix_ma1sd_v1_enabled: true
|
||||
matrix_ma1sd_v2_enabled: true
|
||||
|
||||
# Fix for missing 3PIDS bug
|
||||
matrix_ma1sd_hashing_enabled: true
|
||||
|
||||
# Default ma1sd configuration template which covers the generic use case.
|
||||
# You can customize it by controlling the various variables inside it.
|
||||
#
|
||||
# For a more advanced customization, you can extend the default (see `matrix_ma1sd_configuration_extension_yaml`)
|
||||
# or completely replace this variable with your own template.
|
||||
matrix_ma1sd_configuration_yaml: "{{ lookup('template', 'templates/ma1sd.yaml.j2') }}"
|
||||
|
||||
matrix_ma1sd_configuration_extension_yaml: |
|
||||
# Your custom YAML configuration for ma1sd goes here.
|
||||
# This configuration extends the default starting configuration (`matrix_ma1sd_configuration_yaml`).
|
||||
#
|
||||
# You can override individual variables from the default configuration, or introduce new ones.
|
||||
#
|
||||
# If you need something more special, you can take full control by
|
||||
# completely redefining `matrix_ma1sd_configuration_yaml`.
|
||||
#
|
||||
# Example configuration extension follows:
|
||||
#
|
||||
# ldap:
|
||||
# enabled: true
|
||||
# connection:
|
||||
# host: ldapHostnameOrIp
|
||||
# tls: false
|
||||
# port: 389
|
||||
# baseDNs: ['OU=Users,DC=example,DC=org']
|
||||
# bindDn: CN=My Ma1sd User,OU=Users,DC=example,DC=org
|
||||
# bindPassword: TheUserPassword
|
||||
|
||||
matrix_ma1sd_configuration_extension: "{{ matrix_ma1sd_configuration_extension_yaml | from_yaml if matrix_ma1sd_configuration_extension_yaml | from_yaml is mapping else {} }}"
|
||||
|
||||
# Holds the final ma1sd configuration (a combination of the default and its extension).
|
||||
# You most likely don't need to touch this variable. Instead, see `matrix_ma1sd_configuration_yaml`.
|
||||
matrix_ma1sd_configuration: "{{ matrix_ma1sd_configuration_yaml | from_yaml | combine(matrix_ma1sd_configuration_extension, recursive=True) }}"
|
||||
@@ -1,33 +0,0 @@
|
||||
# SPDX-FileCopyrightText: 2020 - 2024 Slavi Pantaleev
|
||||
# SPDX-FileCopyrightText: 2020 Marcel Partap
|
||||
# SPDX-FileCopyrightText: 2022 Marko Weltzer
|
||||
#
|
||||
# SPDX-License-Identifier: AGPL-3.0-or-later
|
||||
|
||||
---
|
||||
|
||||
- tags:
|
||||
- setup-all
|
||||
- setup-ma1sd
|
||||
- install-all
|
||||
- install-ma1sd
|
||||
block:
|
||||
- when: matrix_ma1sd_enabled | bool
|
||||
ansible.builtin.include_tasks: "{{ role_path }}/tasks/validate_config.yml"
|
||||
|
||||
- when: matrix_ma1sd_enabled | bool
|
||||
ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_install.yml"
|
||||
|
||||
- tags:
|
||||
- setup-all
|
||||
- setup-ma1sd
|
||||
block:
|
||||
- when: not matrix_ma1sd_enabled | bool
|
||||
ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_uninstall.yml"
|
||||
|
||||
- tags:
|
||||
- self-check
|
||||
- self-check-ma1sd
|
||||
block:
|
||||
- when: matrix_ma1sd_enabled | bool
|
||||
ansible.builtin.include_tasks: "{{ role_path }}/tasks/self_check.yml"
|
||||
@@ -1,28 +0,0 @@
|
||||
# SPDX-FileCopyrightText: 2020 MDAD project contributors
|
||||
# SPDX-FileCopyrightText: 2020 Marcel Partap
|
||||
# SPDX-FileCopyrightText: 2022 - 2024 Slavi Pantaleev
|
||||
# SPDX-FileCopyrightText: 2022 Marko Weltzer
|
||||
#
|
||||
# SPDX-License-Identifier: AGPL-3.0-or-later
|
||||
|
||||
---
|
||||
|
||||
- name: Check ma1sd Identity Service
|
||||
ansible.builtin.uri:
|
||||
url: "{{ matrix_ma1sd_self_check_endpoint_url }}"
|
||||
follow_redirects: none
|
||||
validate_certs: "{{ matrix_ma1sd_self_check_validate_certificates }}"
|
||||
check_mode: false
|
||||
register: result_ma1sd
|
||||
ignore_errors: true
|
||||
delegate_to: 127.0.0.1
|
||||
become: false
|
||||
|
||||
- name: Fail if ma1sd Identity Service not working
|
||||
ansible.builtin.fail:
|
||||
msg: "Failed checking ma1sd is up at `{{ matrix_ma1sd_hostname }}` (checked endpoint: `{{ matrix_ma1sd_self_check_endpoint_url }}`). Is ma1sd running? Is port 443 open in your firewall? Full error: {{ result_ma1sd }}"
|
||||
when: "result_ma1sd.failed or 'json' not in result_ma1sd"
|
||||
|
||||
- name: Report working ma1sd Identity Service
|
||||
ansible.builtin.debug:
|
||||
msg: "ma1sd at `{{ matrix_ma1sd_hostname }}` is working (checked endpoint: `{{ matrix_ma1sd_self_check_endpoint_url }}`)"
|
||||
@@ -1,167 +0,0 @@
|
||||
# SPDX-FileCopyrightText: 2020 - 2024 Slavi Pantaleev
|
||||
# SPDX-FileCopyrightText: 2020 Chris van Dijk
|
||||
# SPDX-FileCopyrightText: 2020 Marcel Partap
|
||||
# SPDX-FileCopyrightText: 2020 Matt Cengia
|
||||
# SPDX-FileCopyrightText: 2020 Stuart Mumford
|
||||
# SPDX-FileCopyrightText: 2022 Jim Myhrberg
|
||||
# SPDX-FileCopyrightText: 2022 MDAD project contributors
|
||||
# SPDX-FileCopyrightText: 2022 Marko Weltzer
|
||||
# SPDX-FileCopyrightText: 2022 Nikita Chernyi
|
||||
# SPDX-FileCopyrightText: 2022 Sebastian Gumprich
|
||||
# SPDX-FileCopyrightText: 2024 David Mehren
|
||||
#
|
||||
# SPDX-License-Identifier: AGPL-3.0-or-later
|
||||
|
||||
---
|
||||
|
||||
- name: Ensure ma1sd paths exist
|
||||
ansible.builtin.file:
|
||||
path: "{{ item.path }}"
|
||||
state: directory
|
||||
mode: 0750
|
||||
owner: "{{ matrix_user_name }}"
|
||||
group: "{{ matrix_group_name }}"
|
||||
with_items:
|
||||
- {path: "{{ matrix_ma1sd_config_path }}", when: true}
|
||||
- {path: "{{ matrix_ma1sd_data_path }}", when: true}
|
||||
- {path: "{{ matrix_ma1sd_docker_src_files_path }}", when: "{{ matrix_ma1sd_container_image_self_build }}"}
|
||||
when: "item.when | bool"
|
||||
|
||||
# These (SQLite -> Postgres) migration tasks are usually at the top,
|
||||
# but we'd like to run them after `migrate_mxisd.yml`, which requires the ma1sd paths to exist.
|
||||
- ansible.builtin.set_fact:
|
||||
matrix_ma1sd_requires_restart: false
|
||||
|
||||
- when: "matrix_ma1sd_database_engine == 'postgres'"
|
||||
block:
|
||||
- name: Check if an SQLite database already exists
|
||||
ansible.builtin.stat:
|
||||
path: "{{ matrix_ma1sd_sqlite_database_path_local }}"
|
||||
register: matrix_ma1sd_sqlite_database_path_local_stat_result
|
||||
|
||||
- when: "matrix_ma1sd_sqlite_database_path_local_stat_result.stat.exists | bool"
|
||||
block:
|
||||
- ansible.builtin.include_role:
|
||||
name: galaxy/postgres
|
||||
tasks_from: migrate_db_to_postgres
|
||||
vars:
|
||||
postgres_db_migration_request:
|
||||
src: "{{ matrix_ma1sd_sqlite_database_path_local }}"
|
||||
dst: "{{ matrix_ma1sd_database_connection_string }}"
|
||||
caller: "{{ role_path | basename }}"
|
||||
engine_variable_name: 'matrix_ma1sd_database_engine'
|
||||
engine_old: 'sqlite'
|
||||
systemd_services_to_stop: ['matrix-ma1sd.service']
|
||||
pgloader_options: ['--with "quote identifiers"']
|
||||
|
||||
- ansible.builtin.set_fact:
|
||||
matrix_ma1sd_requires_restart: true
|
||||
|
||||
- name: Ensure ma1sd image is pulled
|
||||
community.docker.docker_image:
|
||||
name: "{{ matrix_ma1sd_docker_image }}"
|
||||
source: "{{ 'pull' if ansible_version.major > 2 or ansible_version.minor > 7 else omit }}"
|
||||
force_source: "{{ matrix_ma1sd_docker_image_force_pull if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}"
|
||||
force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else matrix_ma1sd_docker_image_force_pull }}"
|
||||
when: "not matrix_ma1sd_container_image_self_build | bool"
|
||||
register: result
|
||||
retries: "{{ devture_playbook_help_container_retries_count }}"
|
||||
delay: "{{ devture_playbook_help_container_retries_delay }}"
|
||||
until: result is not failed
|
||||
|
||||
- when: "matrix_ma1sd_container_image_self_build | bool"
|
||||
block:
|
||||
- name: Ensure ma1sd repository is present on self-build
|
||||
ansible.builtin.git:
|
||||
repo: "{{ matrix_ma1sd_container_image_self_build_repo }}"
|
||||
dest: "{{ matrix_ma1sd_docker_src_files_path }}"
|
||||
version: "{{ matrix_ma1sd_container_image_self_build_branch }}"
|
||||
force: "yes"
|
||||
become: true
|
||||
become_user: "{{ matrix_user_name }}"
|
||||
register: matrix_ma1sd_git_pull_results
|
||||
|
||||
- name: Ensure ma1sd container image is built
|
||||
ansible.builtin.command:
|
||||
cmd: |-
|
||||
{{ devture_systemd_docker_base_host_command_docker }} buildx build
|
||||
--tag={{ matrix_ma1sd_docker_image }}
|
||||
--file={{ matrix_ma1sd_docker_src_files_path }}/Dockerfile
|
||||
{{ matrix_ma1sd_docker_src_files_path }}
|
||||
changed_when: true
|
||||
|
||||
- name: Ensure ma1sd config installed
|
||||
ansible.builtin.copy:
|
||||
content: "{{ matrix_ma1sd_configuration | to_nice_yaml(indent=2, width=999999) }}"
|
||||
dest: "{{ matrix_ma1sd_config_path }}/ma1sd.yaml"
|
||||
mode: 0644
|
||||
owner: "{{ matrix_user_name }}"
|
||||
group: "{{ matrix_group_name }}"
|
||||
|
||||
- name: Ensure custom view templates are installed, if any
|
||||
ansible.builtin.copy:
|
||||
content: "{{ item.value }}"
|
||||
dest: "{{ matrix_ma1sd_config_path }}/{{ item.location }}"
|
||||
mode: 0644
|
||||
owner: "{{ matrix_user_name }}"
|
||||
group: "{{ matrix_group_name }}"
|
||||
with_items:
|
||||
- {value: "{{ matrix_ma1sd_view_session_custom_onTokenSubmit_success_template }}", location: 'tokenSubmitSuccess.html'}
|
||||
- {value: "{{ matrix_ma1sd_view_session_custom_onTokenSubmit_failure_template }}", location: 'tokenSubmitFailure.html'}
|
||||
when: "matrix_ma1sd_view_session_custom_templates_enabled | bool and item.value"
|
||||
|
||||
- name: Ensure custom email templates are installed, if any
|
||||
ansible.builtin.copy:
|
||||
content: "{{ item.value }}"
|
||||
dest: "{{ matrix_ma1sd_config_path }}/{{ item.location }}"
|
||||
mode: 0644
|
||||
owner: "{{ matrix_user_name }}"
|
||||
group: "{{ matrix_group_name }}"
|
||||
with_items:
|
||||
- {value: "{{ matrix_ma1sd_threepid_medium_email_custom_invite_template }}", location: 'invite-template.eml'}
|
||||
- {value: "{{ matrix_ma1sd_threepid_medium_email_custom_session_validation_template }}", location: 'validate-template.eml'}
|
||||
- {value: "{{ matrix_ma1sd_threepid_medium_email_custom_session_unbind_notification_template }}", location: 'unbind-notification.eml'}
|
||||
- {value: "{{ matrix_ma1sd_threepid_medium_email_custom_matrixid_template }}", location: 'mxid-template.eml'}
|
||||
when: "matrix_ma1sd_threepid_medium_email_custom_templates_enabled | bool and item.value"
|
||||
|
||||
# Only cleaning up for people who define the respective templates
|
||||
- name: (Cleanup) Ensure custom email templates are not in data/ anymore (we've put them in config/)
|
||||
ansible.builtin.file:
|
||||
path: "{{ matrix_ma1sd_data_path }}/{{ item.location }}"
|
||||
state: absent
|
||||
with_items:
|
||||
- {value: "{{ matrix_ma1sd_threepid_medium_email_custom_invite_template }}", location: 'invite-template.eml'}
|
||||
- {value: "{{ matrix_ma1sd_threepid_medium_email_custom_session_validation_template }}", location: 'validate-template.eml'}
|
||||
- {value: "{{ matrix_ma1sd_threepid_medium_email_custom_session_unbind_notification_template }}", location: 'unbind-notification.eml'}
|
||||
- {value: "{{ matrix_ma1sd_threepid_medium_email_custom_matrixid_template }}", location: 'mxid-template.eml'}
|
||||
when: "matrix_ma1sd_threepid_medium_email_custom_templates_enabled | bool and item.value"
|
||||
|
||||
- name: Ensure ma1sd support files installed
|
||||
ansible.builtin.template:
|
||||
src: "{{ role_path }}/templates/{{ item }}.j2"
|
||||
dest: "{{ matrix_ma1sd_base_path }}/{{ item }}"
|
||||
mode: 0640
|
||||
owner: "{{ matrix_user_name }}"
|
||||
group: "{{ matrix_group_name }}"
|
||||
with_items:
|
||||
- labels
|
||||
|
||||
- name: Ensure ma1sd container network is created
|
||||
community.general.docker_network:
|
||||
enable_ipv6: "{{ devture_systemd_docker_base_ipv6_enabled }}"
|
||||
name: "{{ matrix_ma1sd_container_network }}"
|
||||
driver: bridge
|
||||
driver_options: "{{ devture_systemd_docker_base_container_networks_driver_options }}"
|
||||
|
||||
- name: Ensure matrix-ma1sd.service installed
|
||||
ansible.builtin.template:
|
||||
src: "{{ role_path }}/templates/systemd/matrix-ma1sd.service.j2"
|
||||
dest: "{{ devture_systemd_docker_base_systemd_path }}/matrix-ma1sd.service"
|
||||
mode: 0644
|
||||
|
||||
- name: Ensure matrix-ma1sd.service restarted, if necessary
|
||||
ansible.builtin.service:
|
||||
name: "matrix-ma1sd.service"
|
||||
state: restarted
|
||||
daemon_reload: true
|
||||
when: "matrix_ma1sd_requires_restart | bool"
|
||||
@@ -1,31 +0,0 @@
|
||||
# SPDX-FileCopyrightText: 2020 - 2024 Slavi Pantaleev
|
||||
# SPDX-FileCopyrightText: 2022 Marko Weltzer
|
||||
# SPDX-FileCopyrightText: 2022 Sebastian Gumprich
|
||||
#
|
||||
# SPDX-License-Identifier: AGPL-3.0-or-later
|
||||
|
||||
---
|
||||
|
||||
- name: Check existence of matrix-ma1sd service
|
||||
ansible.builtin.stat:
|
||||
path: "{{ devture_systemd_docker_base_systemd_path }}/matrix-ma1sd.service"
|
||||
register: matrix_ma1sd_service_stat
|
||||
|
||||
- when: matrix_ma1sd_service_stat.stat.exists | bool
|
||||
block:
|
||||
- name: Ensure matrix-ma1sd is stopped
|
||||
ansible.builtin.service:
|
||||
name: matrix-ma1sd
|
||||
state: stopped
|
||||
enabled: false
|
||||
daemon_reload: true
|
||||
|
||||
- name: Ensure matrix-ma1sd.service doesn't exist
|
||||
ansible.builtin.file:
|
||||
path: "{{ devture_systemd_docker_base_systemd_path }}/matrix-ma1sd.service"
|
||||
state: absent
|
||||
|
||||
- name: Ensure Matrix ma1sd paths don't exist
|
||||
ansible.builtin.file:
|
||||
path: "{{ matrix_ma1sd_base_path }}"
|
||||
state: absent
|
||||
@@ -1,86 +0,0 @@
|
||||
# SPDX-FileCopyrightText: 2020 - 2025 Slavi Pantaleev
|
||||
# SPDX-FileCopyrightText: 2020 Marcel Partap
|
||||
# SPDX-FileCopyrightText: 2021 boris runakov
|
||||
# SPDX-FileCopyrightText: 2025 Suguru Hirahara
|
||||
#
|
||||
# SPDX-License-Identifier: AGPL-3.0-or-later
|
||||
|
||||
---
|
||||
|
||||
- name: (Deprecation) Warn about ma1sd variables that are not used anymore
|
||||
ansible.builtin.fail:
|
||||
msg: >
|
||||
The `{{ item }}` variable defined in your configuration is not used by this playbook anymore!
|
||||
You'll need to adapt to the new way of extending ma1sd configuration.
|
||||
See the CHANGELOG and the `matrix_ma1sd_configuration_extension_yaml` variable for more information and examples.
|
||||
when: "lookup('ansible.builtin.varnames', ('^' + item + '$'), wantlist=True) | length > 0"
|
||||
with_items:
|
||||
- 'matrix_ma1sd_ldap_enabled'
|
||||
- 'matrix_ma1sd_ldap_connection_host'
|
||||
- 'matrix_ma1sd_ldap_connection_tls'
|
||||
- 'matrix_ma1sd_ldap_connection_port'
|
||||
- 'matrix_ma1sd_ldap_connection_baseDn'
|
||||
- 'matrix_ma1sd_ldap_connection_baseDns'
|
||||
- 'matrix_ma1sd_ldap_connection_bindDn'
|
||||
- 'matrix_ma1sd_ldap_connection_bindPassword'
|
||||
- 'matrix_ma1sd_ldap_filter'
|
||||
- 'matrix_ma1sd_ldap_attribute_uid_type'
|
||||
- 'matrix_ma1sd_ldap_attribute_uid_value'
|
||||
- 'matrix_ma1sd_ldap_connection_bindPassword'
|
||||
- 'matrix_ma1sd_ldap_attribute_name'
|
||||
- 'matrix_ma1sd_ldap_attribute_threepid_email'
|
||||
- 'matrix_ma1sd_ldap_attribute_threepid_msisdn'
|
||||
- 'matrix_ma1sd_ldap_identity_filter'
|
||||
- 'matrix_ma1sd_ldap_identity_medium'
|
||||
- 'matrix_ma1sd_ldap_auth_filter'
|
||||
- 'matrix_ma1sd_ldap_directory_filter'
|
||||
- 'matrix_ma1sd_template_config'
|
||||
- 'matrix_ma1sd_architecture'
|
||||
|
||||
- name: Ensure ma1sd configuration does not contain any dot-notation keys
|
||||
ansible.builtin.fail:
|
||||
msg: >
|
||||
Since version 1.3.0, ma1sd will not accept property-style configuration keys.
|
||||
You have defined a key (`{{ item.key }}`) which contains a dot.
|
||||
Instead, use nesting. See: https://github.com/ma1uta/ma1sd/wiki/Upgrade-Notes#v130
|
||||
when: "'.' in item.key"
|
||||
with_dict: "{{ matrix_ma1sd_configuration }}"
|
||||
|
||||
- name: Fail if required ma1sd settings not defined
|
||||
ansible.builtin.fail:
|
||||
msg: >
|
||||
You need to define a required configuration setting (`{{ item.name }}`).
|
||||
when: "item.when | bool and lookup('vars', item.name, default='') | string | length == 0"
|
||||
with_items:
|
||||
- {'name': 'matrix_ma1sd_hostname', when: true}
|
||||
- {'name': 'matrix_ma1sd_threepid_medium_email_connectors_smtp_host', when: true}
|
||||
- {'name': 'matrix_ma1sd_dns_overwrite_homeserver_client_value', when: true}
|
||||
- {'name': 'matrix_ma1sd_database_hostname', when: "{{ matrix_ma1sd_database_engine == 'postgres' }}"}
|
||||
- {'name': 'matrix_ma1sd_container_network', when: true}
|
||||
- {'name': 'matrix_ma1sd_container_labels_matrix_identity_hostname', when: "{{ matrix_ma1sd_container_labels_matrix_identity_enabled }}"}
|
||||
- {'name': 'matrix_ma1sd_container_labels_matrix_identity_path_prefix', when: "{{ matrix_ma1sd_container_labels_matrix_identity_enabled }}"}
|
||||
- {'name': 'matrix_ma1sd_container_labels_matrix_client_user_directory_search_hostname', when: "{{ matrix_ma1sd_container_labels_matrix_client_user_directory_search_enabled }}"}
|
||||
- {'name': 'matrix_ma1sd_container_labels_matrix_client_user_directory_search_path_regexp', when: "{{ matrix_ma1sd_container_labels_matrix_client_user_directory_search_enabled }}"}
|
||||
- {'name': 'matrix_ma1sd_container_labels_matrix_client_3pid_registration_path_regexp', when: "{{ matrix_ma1sd_container_labels_matrix_client_3pid_registration_enabled }}"}
|
||||
|
||||
- name: (Deprecation) Catch and report renamed ma1sd variables
|
||||
ansible.builtin.fail:
|
||||
msg: >-
|
||||
Your configuration contains a variable, which now has a different name.
|
||||
Please rename the variable (`{{ item.old }}` -> `{{ item.new }}`) on your configuration file (vars.yml).
|
||||
when: "lookup('ansible.builtin.varnames', ('^' + item.old + '$'), wantlist=True) | length > 0"
|
||||
with_items:
|
||||
- {'old': 'matrix_ma1sd_container_expose_port', 'new': '<superseded by matrix_ma1sd_container_http_host_bind_port>'}
|
||||
- {'old': 'matrix_ma1sd_threepid_medium_email_custom_unbind_fraudulent_template', 'new': 'matrix_ma1sd_threepid_medium_email_custom_session_unbind_notification_template'}
|
||||
- {'old': 'matrix_ma1sd_default_port', 'new': 'matrix_ma1sd_container_port'}
|
||||
- {'old': 'matrix_ma1sd_container_labels_matrix_client_user_directory_search_path', 'new': 'matrix_ma1sd_container_labels_matrix_client_user_directory_search_path_regexp'}
|
||||
- {'old': 'matrix_ma1sd_container_labels_matrix_client_3pid_registration_path', 'new': 'matrix_ma1sd_container_labels_matrix_client_3pid_registration_path_regexp'}
|
||||
- {'old': 'matrix_ma1sd_docker_image_name_prefix', 'new': 'matrix_ma1sd_docker_image_registry_prefix'}
|
||||
|
||||
- name: (Deprecation) Catch and report mxisd variables
|
||||
ansible.builtin.fail:
|
||||
msg: >-
|
||||
mxisd is deprecated and has been replaced with ma1sd (https://github.com/ma1uta/ma1sd), a compatible fork.
|
||||
The playbook will migrate your existing mxisd configuration and data automatically, but you need to adjust variable names.
|
||||
Please rename these variables (`matrix_mxisd_*` -> `matrix_ma1sd_*`) on your configuration file (vars.yml): {{ lookup('ansible.builtin.varnames', '^matrix_mxisd_.+', wantlist=True) | join(', ') }}
|
||||
when: "lookup('ansible.builtin.varnames', '^matrix_mxisd_.+', wantlist=True) | length > 0"
|
||||
@@ -1,124 +0,0 @@
|
||||
{#
|
||||
SPDX-FileCopyrightText: 2024 Slavi Pantaleev
|
||||
|
||||
SPDX-License-Identifier: AGPL-3.0-or-later
|
||||
#}
|
||||
|
||||
{% if matrix_ma1sd_container_labels_traefik_enabled %}
|
||||
traefik.enable=true
|
||||
|
||||
{% if matrix_ma1sd_container_labels_traefik_docker_network %}
|
||||
traefik.docker.network={{ matrix_ma1sd_container_labels_traefik_docker_network }}
|
||||
{% endif %}
|
||||
|
||||
traefik.http.services.matrix-ma1sd.loadbalancer.server.port={{ matrix_ma1sd_container_port }}
|
||||
|
||||
{% if matrix_ma1sd_container_labels_matrix_identity_enabled %}
|
||||
############################################################
|
||||
# #
|
||||
# Matrix Identity APIs (/_matrix/identity) #
|
||||
# #
|
||||
############################################################
|
||||
|
||||
traefik.http.routers.matrix-ma1sd-matrix-identity.rule={{ matrix_ma1sd_container_labels_matrix_identity_traefik_rule }}
|
||||
|
||||
{% if matrix_ma1sd_container_labels_matrix_identity_traefik_priority | int > 0 %}
|
||||
traefik.http.routers.matrix-ma1sd-matrix-identity.priority={{ matrix_ma1sd_container_labels_matrix_identity_traefik_priority }}
|
||||
{% endif %}
|
||||
|
||||
traefik.http.routers.matrix-ma1sd-matrix-identity.service=matrix-ma1sd
|
||||
traefik.http.routers.matrix-ma1sd-matrix-identity.entrypoints={{ matrix_ma1sd_container_labels_matrix_identity_traefik_entrypoints }}
|
||||
|
||||
traefik.http.routers.matrix-ma1sd-matrix-identity.tls={{ matrix_ma1sd_container_labels_matrix_identity_traefik_tls | to_json }}
|
||||
{% if matrix_ma1sd_container_labels_matrix_identity_traefik_tls %}
|
||||
traefik.http.routers.matrix-ma1sd-matrix-identity.tls.certResolver={{ matrix_ma1sd_container_labels_matrix_identity_traefik_tls_certResolver }}
|
||||
{% endif %}
|
||||
|
||||
############################################################
|
||||
# #
|
||||
# /Matrix Identity APIs (/_matrix/identity) #
|
||||
# #
|
||||
############################################################
|
||||
{% endif %}
|
||||
|
||||
|
||||
{% if matrix_ma1sd_container_labels_matrix_client_user_directory_search_enabled %}
|
||||
############################################################
|
||||
# #
|
||||
# Matrix Client user-directory search API endpoint #
|
||||
# (/_matrix/client/VERSION/user_directory/search) #
|
||||
# #
|
||||
############################################################
|
||||
|
||||
# ma1sd only supports /_matrix/client/r0/user_directory/search
|
||||
# while we potentially handle /_matrix/client/v3/user_directory/search as well,
|
||||
# so we need to transparently reroute.
|
||||
traefik.http.middlewares.matrix-ma1sd-matrix-client-user-directory-search-replacepath.replacepath.path=/_matrix/client/r0/user_directory/search
|
||||
|
||||
traefik.http.routers.matrix-ma1sd-matrix-client-user-directory-search.rule={{ matrix_ma1sd_container_labels_matrix_client_user_directory_search_traefik_rule }}
|
||||
|
||||
traefik.http.routers.matrix-ma1sd-matrix-client-user-directory-search.middlewares=matrix-ma1sd-matrix-client-user-directory-search-replacepath
|
||||
|
||||
{% if matrix_ma1sd_container_labels_matrix_client_user_directory_search_traefik_priority | int > 0 %}
|
||||
traefik.http.routers.matrix-ma1sd-matrix-client-user-directory-search.priority={{ matrix_ma1sd_container_labels_matrix_client_user_directory_search_traefik_priority }}
|
||||
{% endif %}
|
||||
|
||||
traefik.http.routers.matrix-ma1sd-matrix-client-user-directory-search.service=matrix-ma1sd
|
||||
traefik.http.routers.matrix-ma1sd-matrix-client-user-directory-search.entrypoints={{ matrix_ma1sd_container_labels_matrix_client_user_directory_search_traefik_entrypoints }}
|
||||
|
||||
traefik.http.routers.matrix-ma1sd-matrix-client-user-directory-search.tls={{ matrix_ma1sd_container_labels_matrix_client_user_directory_search_traefik_tls | to_json }}
|
||||
{% if matrix_ma1sd_container_labels_matrix_client_user_directory_search_traefik_tls %}
|
||||
traefik.http.routers.matrix-ma1sd-matrix-client-user-directory-search.tls.certResolver={{ matrix_ma1sd_container_labels_matrix_client_user_directory_search_traefik_tls_certResolver }}
|
||||
{% endif %}
|
||||
|
||||
############################################################
|
||||
# #
|
||||
# /Matrix Client user-directory search API endpoint #
|
||||
# (/_matrix/client/VERSION/user_directory/search) #
|
||||
# #
|
||||
############################################################
|
||||
{% endif %}
|
||||
|
||||
|
||||
{% if matrix_ma1sd_container_labels_matrix_client_user_directory_search_enabled %}
|
||||
############################################################
|
||||
# #
|
||||
# Matrix Client 3pid registration API endpoint #
|
||||
# (/_matrix/client/VERSION/register/TYPE/requestToken) #
|
||||
# #
|
||||
############################################################
|
||||
|
||||
# ma1sd only supports /_matrix/client/r0/register/TYPE/requestToken
|
||||
# while we potentially handle /_matrix/client/v3/register/TYPE/requestToken as well,
|
||||
# so we need to transparently reroute.
|
||||
traefik.http.middlewares.matrix-ma1sd-matrix-client-3pid-registration-replacepathregex.replacepathregex.regex=^/_matrix/client/([^/]+)/register/([^/]+)/requestToken
|
||||
traefik.http.middlewares.matrix-ma1sd-matrix-client-3pid-registration-replacepathregex.replacepathregex.replacement=/_matrix/client/r0/register/${2}/requestToken
|
||||
|
||||
traefik.http.routers.matrix-ma1sd-matrix-client-3pid-registration.rule={{ matrix_ma1sd_container_labels_matrix_client_3pid_registration_traefik_rule }}
|
||||
|
||||
traefik.http.routers.matrix-ma1sd-matrix-client-3pid-registration.middlewares=matrix-ma1sd-matrix-client-3pid-registration-replacepathregex
|
||||
|
||||
{% if matrix_ma1sd_container_labels_matrix_client_3pid_registration_traefik_priority | int > 0 %}
|
||||
traefik.http.routers.matrix-ma1sd-matrix-client-3pid-registration.priority={{ matrix_ma1sd_container_labels_matrix_client_3pid_registration_traefik_priority }}
|
||||
{% endif %}
|
||||
|
||||
traefik.http.routers.matrix-ma1sd-matrix-client-3pid-registration.service=matrix-ma1sd
|
||||
traefik.http.routers.matrix-ma1sd-matrix-client-3pid-registration.entrypoints={{ matrix_ma1sd_container_labels_matrix_client_3pid_registration_traefik_entrypoints }}
|
||||
|
||||
traefik.http.routers.matrix-ma1sd-matrix-client-3pid-registration.tls={{ matrix_ma1sd_container_labels_matrix_client_3pid_registration_traefik_tls | to_json }}
|
||||
{% if matrix_ma1sd_container_labels_matrix_client_3pid_registration_traefik_tls %}
|
||||
traefik.http.routers.matrix-ma1sd-matrix-client-3pid-registration.tls.certResolver={{ matrix_ma1sd_container_labels_matrix_client_3pid_registration_traefik_tls_certResolver }}
|
||||
{% endif %}
|
||||
|
||||
############################################################
|
||||
# #
|
||||
# /Matrix Client 3pid registration API endpoint #
|
||||
# (/_matrix/client/VERSION/register/TYPE/requestToken) #
|
||||
# #
|
||||
############################################################
|
||||
{% endif %}
|
||||
|
||||
|
||||
{% endif %}
|
||||
|
||||
{{ matrix_ma1sd_container_labels_additional_labels }}
|
||||
@@ -1,104 +0,0 @@
|
||||
#jinja2: lstrip_blocks: True
|
||||
matrix:
|
||||
domain: {{ matrix_domain }}
|
||||
v1: {{ matrix_ma1sd_v1_enabled|to_json }}
|
||||
v2: {{ matrix_ma1sd_v2_enabled|to_json }}
|
||||
|
||||
server:
|
||||
name: {{ matrix_server_fqn_matrix }}
|
||||
|
||||
key:
|
||||
path: /var/ma1sd/sign.key
|
||||
|
||||
storage:
|
||||
{% if matrix_ma1sd_database_engine == 'sqlite' %}
|
||||
backend: sqlite
|
||||
provider:
|
||||
sqlite:
|
||||
database: {{ matrix_ma1sd_sqlite_database_path_in_container|to_json }}
|
||||
{% elif matrix_ma1sd_database_engine == 'postgres' %}
|
||||
backend: postgresql
|
||||
provider:
|
||||
postgresql:
|
||||
database: //{{ matrix_ma1sd_database_hostname }}:{{ matrix_ma1sd_database_port }}/{{ matrix_ma1sd_database_name }}
|
||||
username: {{ matrix_ma1sd_database_username|to_json }}
|
||||
password: {{ matrix_ma1sd_database_password|to_json }}
|
||||
{% endif %}
|
||||
|
||||
{% if matrix_ma1sd_dns_overwrite_enabled %}
|
||||
dns:
|
||||
overwrite:
|
||||
homeserver:
|
||||
client:
|
||||
- name: {{ matrix_ma1sd_dns_overwrite_homeserver_client_name }}
|
||||
value: {{ matrix_ma1sd_dns_overwrite_homeserver_client_value }}
|
||||
{% endif %}
|
||||
|
||||
{% if matrix_ma1sd_matrixorg_forwarding_enabled %}
|
||||
forward:
|
||||
servers: ['matrix-org']
|
||||
{% endif %}
|
||||
|
||||
threepid:
|
||||
medium:
|
||||
email:
|
||||
identity:
|
||||
from: {{ matrix_ma1sd_threepid_medium_email_identity_from }}
|
||||
connectors:
|
||||
smtp:
|
||||
host: {{ matrix_ma1sd_threepid_medium_email_connectors_smtp_host }}
|
||||
port: {{ matrix_ma1sd_threepid_medium_email_connectors_smtp_port }}
|
||||
tls: {{ matrix_ma1sd_threepid_medium_email_connectors_smtp_tls }}
|
||||
login: {{ matrix_ma1sd_threepid_medium_email_connectors_smtp_login }}
|
||||
password: {{ matrix_ma1sd_threepid_medium_email_connectors_smtp_password }}
|
||||
{% if matrix_ma1sd_threepid_medium_email_custom_templates_enabled %}
|
||||
generators:
|
||||
template:
|
||||
{% if matrix_ma1sd_threepid_medium_email_custom_invite_template %}
|
||||
invite: '/etc/ma1sd/invite-template.eml'
|
||||
{% endif %}
|
||||
{% if matrix_ma1sd_threepid_medium_email_custom_session_validation_template or matrix_ma1sd_threepid_medium_email_custom_session_unbind_notification_template %}
|
||||
session:
|
||||
{% if matrix_ma1sd_threepid_medium_email_custom_session_validation_template %}
|
||||
validation: '/etc/ma1sd/validate-template.eml'
|
||||
{% endif %}
|
||||
{% if matrix_ma1sd_threepid_medium_email_custom_session_unbind_notification_template %}
|
||||
unbind:
|
||||
notification: '/etc/ma1sd/unbind-notification.eml'
|
||||
{% endif %}
|
||||
{% endif %}
|
||||
{% if matrix_ma1sd_threepid_medium_email_custom_matrixid_template %}
|
||||
generic:
|
||||
matrixId: '/etc/ma1sd/mxid-template.eml'
|
||||
{% endif %}
|
||||
{% endif %}
|
||||
|
||||
{% if matrix_ma1sd_view_session_custom_templates_enabled %}
|
||||
view:
|
||||
session:
|
||||
onTokenSubmit:
|
||||
{% if matrix_ma1sd_view_session_custom_onTokenSubmit_success_template %}
|
||||
success: '/etc/ma1sd/tokenSubmitSuccess.html'
|
||||
{% endif %}
|
||||
{% if matrix_ma1sd_view_session_custom_onTokenSubmit_failure_template %}
|
||||
failure: '/etc/ma1sd/tokenSubmitFailure.html'
|
||||
{% endif %}
|
||||
{% endif %}
|
||||
|
||||
{% if matrix_ma1sd_hashing_enabled %}
|
||||
hashing:
|
||||
enabled: true # enable or disable the hash lookup MSC2140 (default is false)
|
||||
pepperLength: 20 # length of the pepper value (default is 20)
|
||||
rotationPolicy: per_requests # or `per_seconds` how often the hashes will be updating
|
||||
hashStorageType: sql # or `in_memory` where the hashes will be stored
|
||||
algorithms:
|
||||
- none # the same as v1 bulk lookup
|
||||
- sha256 # hash the 3PID and pepper.
|
||||
delay: 2m # how often hashes will be updated if rotation policy = per_seconds (default is 10s)
|
||||
requests: 10
|
||||
{% endif %}
|
||||
|
||||
synapseSql:
|
||||
enabled: {{ matrix_ma1sd_synapsesql_enabled|to_json }}
|
||||
type: {{ matrix_ma1sd_synapsesql_type|to_json }}
|
||||
connection: {{ matrix_ma1sd_synapsesql_connection|to_json }}
|
||||
@@ -1,4 +0,0 @@
|
||||
SPDX-FileCopyrightText: 2020 - 2022 Slavi Pantaleev
|
||||
SPDX-FileCopyrightText: 2020 MDAD project contributors
|
||||
|
||||
SPDX-License-Identifier: AGPL-3.0-or-later
|
||||
@@ -1,57 +0,0 @@
|
||||
#jinja2: lstrip_blocks: True
|
||||
[Unit]
|
||||
Description=Matrix ma1sd Identity server
|
||||
{% for service in matrix_ma1sd_systemd_required_services_list %}
|
||||
Requires={{ service }}
|
||||
After={{ service }}
|
||||
{% endfor %}
|
||||
{% for service in matrix_ma1sd_systemd_wanted_services_list %}
|
||||
Wants={{ service }}
|
||||
{% endfor %}
|
||||
DefaultDependencies=no
|
||||
|
||||
[Service]
|
||||
Type=simple
|
||||
Environment="HOME={{ devture_systemd_docker_base_systemd_unit_home_path }}"
|
||||
ExecStartPre=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} stop -t {{ devture_systemd_docker_base_container_stop_grace_time_seconds }} matrix-ma1sd 2>/dev/null || true'
|
||||
ExecStartPre=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} rm matrix-ma1sd 2>/dev/null || true'
|
||||
|
||||
# ma1sd writes an SQLite shared library (libsqlitejdbc.so) to /tmp and executes it from there,
|
||||
# so /tmp needs to be mounted with an exec option.
|
||||
ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} create \
|
||||
--rm \
|
||||
--name=matrix-ma1sd \
|
||||
--log-driver=none \
|
||||
--user={{ matrix_user_uid }}:{{ matrix_user_gid }} \
|
||||
--cap-drop=ALL \
|
||||
--read-only \
|
||||
--tmpfs=/tmp:rw,exec,nosuid,size=10m \
|
||||
--network={{ matrix_ma1sd_container_network }} \
|
||||
{% if matrix_ma1sd_container_http_host_bind_port %}
|
||||
-p {{ matrix_ma1sd_container_http_host_bind_port }}:{{ matrix_ma1sd_container_port }} \
|
||||
{% endif %}
|
||||
{% if matrix_ma1sd_verbose_logging %}
|
||||
-e MA1SD_LOG_LEVEL=debug \
|
||||
{% endif %}
|
||||
--mount type=bind,src={{ matrix_ma1sd_config_path }},dst=/etc/ma1sd,ro \
|
||||
--mount type=bind,src={{ matrix_ma1sd_data_path }},dst=/var/ma1sd \
|
||||
--label-file={{ matrix_ma1sd_base_path }}/labels \
|
||||
{% for arg in matrix_ma1sd_container_extra_arguments %}
|
||||
{{ arg }} \
|
||||
{% endfor %}
|
||||
{{ matrix_ma1sd_docker_image }}
|
||||
|
||||
{% for network in matrix_ma1sd_container_additional_networks %}
|
||||
ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} network connect {{ network }} matrix-ma1sd
|
||||
{% endfor %}
|
||||
|
||||
ExecStart={{ devture_systemd_docker_base_host_command_docker }} start --attach matrix-ma1sd
|
||||
|
||||
ExecStop=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} stop -t {{ devture_systemd_docker_base_container_stop_grace_time_seconds }} matrix-ma1sd 2>/dev/null || true'
|
||||
ExecStop=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} rm matrix-ma1sd 2>/dev/null || true'
|
||||
Restart=always
|
||||
RestartSec=30
|
||||
SyslogIdentifier=matrix-ma1sd
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
@@ -1,7 +0,0 @@
|
||||
SPDX-FileCopyrightText: 2020 - 2025 Slavi Pantaleev
|
||||
SPDX-FileCopyrightText: 2020 Chris van Dijk
|
||||
SPDX-FileCopyrightText: 2020 Marcel Partap
|
||||
SPDX-FileCopyrightText: 2021 - 2022 MDAD project contributors
|
||||
SPDX-FileCopyrightText: 2021 boris runakov
|
||||
|
||||
SPDX-License-Identifier: AGPL-3.0-or-later
|
||||
@@ -1,10 +0,0 @@
|
||||
# SPDX-FileCopyrightText: 2020 Marcel Partap
|
||||
# SPDX-FileCopyrightText: 2022 Slavi Pantaleev
|
||||
#
|
||||
# SPDX-License-Identifier: AGPL-3.0-or-later
|
||||
|
||||
---
|
||||
|
||||
# Doing `|from_yaml` when the extension contains nothing yields an empty string ("").
|
||||
# We need to ensure it's a dictionary or `|combine` (when building `matrix_ma1sd_configuration`) will fail later.
|
||||
matrix_ma1sd_configuration_extension: "{{ matrix_ma1sd_configuration_extension_yaml | from_yaml if matrix_ma1sd_configuration_extension_yaml | from_yaml else {} }}"
|
||||
@@ -78,7 +78,6 @@ matrix_synapse_admin_container_labels_traefik_additional_response_headers_auto:
|
||||
{{
|
||||
{}
|
||||
| combine ({'X-XSS-Protection': matrix_synapse_admin_http_header_xss_protection} if matrix_synapse_admin_http_header_xss_protection else {})
|
||||
| combine ({'X-Frame-Options': matrix_synapse_admin_http_header_frame_options} if matrix_synapse_admin_http_header_frame_options else {})
|
||||
| combine ({'X-Content-Type-Options': matrix_synapse_admin_http_header_content_type_options} if matrix_synapse_admin_http_header_content_type_options else {})
|
||||
| combine ({'Content-Security-Policy': matrix_synapse_admin_http_header_content_security_policy} if matrix_synapse_admin_http_header_content_security_policy else {})
|
||||
| combine ({'Permission-Policy': matrix_synapse_admin_http_header_content_permission_policy} if matrix_synapse_admin_http_header_content_permission_policy else {})
|
||||
@@ -109,10 +108,6 @@ matrix_synapse_admin_systemd_wanted_services_list: []
|
||||
# - https://portswigger.net/web-security/cross-site-scripting/reflected
|
||||
matrix_synapse_admin_http_header_xss_protection: "1; mode=block"
|
||||
|
||||
# Specifies the value of the `X-Frame-Options` header which controls whether framing can happen.
|
||||
# See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options
|
||||
matrix_synapse_admin_http_header_frame_options: SAMEORIGIN
|
||||
|
||||
# Specifies the value of the `X-Content-Type-Options` header.
|
||||
# See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Content-Type-Options
|
||||
matrix_synapse_admin_http_header_content_type_options: nosniff
|
||||
|
||||
@@ -522,7 +522,7 @@ matrix_synapse_http_listener_resource_names: ["client"]
|
||||
|
||||
# Resources served on Synapse's federation port.
|
||||
# When disabling federation, we may wish to serve the `openid` resource here,
|
||||
# so that services like Dimension and ma1sd can work.
|
||||
# so that services like Dimension can work.
|
||||
matrix_synapse_federation_listener_resource_names: "{{ ['federation'] if matrix_synapse_federation_enabled else (['openid'] if matrix_synapse_federation_port_openid_resource_required else []) }}"
|
||||
|
||||
# Enable this to allow Synapse to report utilization statistics about your server to matrix.org
|
||||
@@ -721,7 +721,7 @@ matrix_synapse_federation_enabled: true
|
||||
matrix_synapse_federation_port_enabled: "{{ matrix_synapse_federation_enabled or matrix_synapse_federation_port_openid_resource_required }}"
|
||||
|
||||
# Controls whether an `openid` listener is to be enabled. Useful when disabling federation,
|
||||
# but needing the `openid` APIs for Dimension or an identity server like ma1sd.
|
||||
# but needing the `openid` APIs for Dimension.
|
||||
matrix_synapse_federation_port_openid_resource_required: false
|
||||
|
||||
# A list of domain names that are allowed to federate with the given Synapse server.
|
||||
|
||||
+29
-4
@@ -4,9 +4,9 @@
|
||||
|
||||
---
|
||||
|
||||
- name: Ensure Matrix Authentication Service user registered - {{ user.username | quote }}
|
||||
ansible.builtin.command:
|
||||
cmd: |-
|
||||
- name: Build Matrix Authentication Service user registration command - {{ user.username | quote }}
|
||||
ansible.builtin.set_fact:
|
||||
matrix_authentication_service_register_user_command: |-
|
||||
{{ devture_systemd_docker_base_host_command_docker }} exec matrix-authentication-service
|
||||
mas-cli manage register-user
|
||||
-p {{ user.initial_password | quote }}
|
||||
@@ -18,6 +18,31 @@
|
||||
--no-admin
|
||||
{% endif %}
|
||||
{{ user.username | quote }}
|
||||
|
||||
- name: Ensure Matrix Authentication Service user registered - {{ user.username | quote }}
|
||||
ansible.builtin.command:
|
||||
cmd: "{{ matrix_authentication_service_register_user_command }}"
|
||||
register: matrix_authentication_service_register_user_result
|
||||
changed_when: "matrix_authentication_service_register_user_result.rc == 0 and 'Error: User already exists' not in matrix_authentication_service_register_user_result.stderr"
|
||||
failed_when: "matrix_authentication_service_register_user_result.rc != 0 and 'Error: User already exists' not in matrix_authentication_service_register_user_result.stderr"
|
||||
failed_when: >-
|
||||
matrix_authentication_service_register_user_result.rc != 0
|
||||
and 'Error: User already exists' not in matrix_authentication_service_register_user_result.stderr
|
||||
and 'password authentication failed' not in matrix_authentication_service_register_user_result.stderr
|
||||
|
||||
- when: "'password authentication failed' in matrix_authentication_service_register_user_result.stderr | default('')"
|
||||
block:
|
||||
- name: Restart Matrix Authentication Service due to database authentication failure (likely a password change)
|
||||
ansible.builtin.service:
|
||||
name: "matrix-authentication-service.service"
|
||||
state: restarted
|
||||
|
||||
- name: Wait for Matrix Authentication Service to start after restart
|
||||
ansible.builtin.pause:
|
||||
seconds: "{{ matrix_user_creator_homeserver_start_wait_time_seconds }}"
|
||||
|
||||
- name: Retry Matrix Authentication Service user registration - {{ user.username | quote }}
|
||||
ansible.builtin.command:
|
||||
cmd: "{{ matrix_authentication_service_register_user_command }}"
|
||||
register: matrix_authentication_service_register_user_result
|
||||
changed_when: "matrix_authentication_service_register_user_result.rc == 0 and 'Error: User already exists' not in matrix_authentication_service_register_user_result.stderr"
|
||||
failed_when: "matrix_authentication_service_register_user_result.rc != 0 and 'Error: User already exists' not in matrix_authentication_service_register_user_result.stderr"
|
||||
|
||||
@@ -73,11 +73,18 @@
|
||||
- {'old': 'matrix_playbook_reverse_proxy_traefik_middleware_compession_enabled', 'new': 'matrix_playbook_reverse_proxy_traefik_middleware_compression_enabled'}
|
||||
- {'old': 'matrix_playbook_reverse_proxy_traefik_middleware_compession_name', 'new': 'matrix_playbook_reverse_proxy_traefik_middleware_compression_name'}
|
||||
|
||||
- {'old': 'matrix_synapse_account_threepid_delegates_msisdn_mas1sd_url', 'new': '<removed>'}
|
||||
|
||||
- {'old': 'cinny_docker_image', 'new': 'cinny_container_image'}
|
||||
- {'old': 'cinny_docker_image_registry_prefix', 'new': 'cinny_container_image_registry_prefix'}
|
||||
- {'old': 'cinny_docker_image_registry_prefix_upstream', 'new': 'cinny_container_image_registry_prefix_upstream'}
|
||||
- {'old': 'cinny_docker_image_registry_prefix_upstream_default', 'new': 'cinny_container_image_registry_prefix_upstream_default'}
|
||||
|
||||
- {'old': 'ddclient_docker_image', 'new': 'ddclient_container_image'}
|
||||
- {'old': 'ddclient_docker_image_registry_prefix', 'new': 'ddclient_container_image_registry_prefix'}
|
||||
- {'old': 'ddclient_docker_image_registry_prefix_upstream', 'new': 'ddclient_container_image_registry_prefix_upstream'}
|
||||
- {'old': 'ddclient_docker_image_registry_prefix_upstream_default', 'new': 'ddclient_container_image_registry_prefix_upstream_default'}
|
||||
|
||||
- name: (Deprecation) Catch and report matrix_postgres variables
|
||||
ansible.builtin.fail:
|
||||
msg: |-
|
||||
@@ -372,17 +379,17 @@
|
||||
- {'old': 'matrix_nginx_proxy_proxy_matrix_client_api_forwarded_location_synapse_client_api_enabled', 'new': 'matrix_synapse_container_labels_public_client_synapse_client_api_enabled'}
|
||||
- {'old': 'matrix_nginx_proxy_proxy_matrix_client_api_forwarded_location_synapse_oidc_api_enabled', 'new': '<replaced by matrix_synapse_container_labels_public_client_synapse_oidc_api_enabled, but if you use matrix_synapse_oidc_enabled then it would be toggled automatically; see the new recommended OIDC example configuration in docs/configuring-playbook-synapse.md>'}
|
||||
- {'old': 'matrix_nginx_proxy_proxy_matrix_client_api_forwarded_location_synapse_admin_api_enabled', 'new': 'matrix_synapse_container_labels_public_client_synapse_admin_api_enabled'}
|
||||
- {'old': 'matrix_nginx_proxy_proxy_matrix_identity_api_enabled', 'new': '<superseded by matrix_ma1sd_container_labels_traefik_enabled and matrix_ma1sd_container_labels_matrix_identity_enabled>'}
|
||||
- {'old': 'matrix_nginx_proxy_proxy_matrix_identity_api_enabled', 'new': '<removed>'}
|
||||
- {'old': 'matrix_nginx_proxy_proxy_matrix_identity_api_addr_with_container', 'new': '<removed>'}
|
||||
- {'old': 'matrix_nginx_proxy_proxy_matrix_identity_api_addr_sans_container', 'new': '<removed>'}
|
||||
- {'old': 'matrix_nginx_proxy_proxy_matrix_user_directory_search_enabled', 'new': '<superseded by matrix_ma1sd_container_labels_traefik_enabled and matrix_ma1sd_container_labels_matrix_client_user_directory_search_enabled>'}
|
||||
- {'old': 'matrix_nginx_proxy_proxy_matrix_user_directory_search_enabled', 'new': '<removed>'}
|
||||
- {'old': 'matrix_nginx_proxy_proxy_matrix_user_directory_search_addr_with_container', 'new': '<removed>'}
|
||||
- {'old': 'matrix_nginx_proxy_proxy_matrix_user_directory_search_addr_sans_container', 'new': '<removed>'}
|
||||
- {'old': 'matrix_nginx_proxy_proxy_matrix_user_directory_search_v3_to_r0_redirect_enabled', 'new': '<superseded by matrix_ma1sd_container_labels_matrix_client_user_directory_search_path_regexp>'}
|
||||
- {'old': 'matrix_nginx_proxy_proxy_matrix_3pid_registration_enabled', 'new': 'matrix_ma1sd_container_labels_matrix_client_3pid_registration_enabled'}
|
||||
- {'old': 'matrix_nginx_proxy_proxy_matrix_user_directory_search_v3_to_r0_redirect_enabled', 'new': '<removed>'}
|
||||
- {'old': 'matrix_nginx_proxy_proxy_matrix_3pid_registration_enabled', 'new': '<removed>'}
|
||||
- {'old': 'matrix_nginx_proxy_proxy_matrix_3pid_registration_addr_with_container', 'new': '<removed>'}
|
||||
- {'old': 'matrix_nginx_proxy_proxy_matrix_3pid_registration_addr_sans_container', 'new': '<removed>'}
|
||||
- {'old': 'matrix_nginx_proxy_proxy_matrix_3pid_registration_v3_to_r0_redirect_enabled', 'new': '<superseded by matrix_ma1sd_container_labels_matrix_client_3pid_registration_path_regexp>'}
|
||||
- {'old': 'matrix_nginx_proxy_proxy_matrix_3pid_registration_v3_to_r0_redirect_enabled', 'new': '<removed>'}
|
||||
- {'old': 'matrix_nginx_proxy_proxy_conduit_enabled', 'new': 'matrix_conduit_container_labels_traefik_enabled'}
|
||||
- {'old': 'matrix_nginx_proxy_proxy_conduit_block_federation_api_on_client_port', 'new': '<not supported anymore - the /_matrix/federation endpoints are now also being served on the Client-Server API port>'}
|
||||
- {'old': 'matrix_nginx_proxy_proxy_conduit_federation_api_enabled', 'new': 'matrix_conduit_container_labels_public_federation_api_enabled'}
|
||||
@@ -539,6 +546,18 @@
|
||||
The following variables in your configuration need to be renamed: {{ lookup('ansible.builtin.varnames', '^devture_container_socket_proxy_.+', wantlist=True) | join(', ') }}
|
||||
when: "lookup('ansible.builtin.varnames', '^devture_container_socket_proxy_.+', wantlist=True) | length > 0"
|
||||
|
||||
- name: (Deprecation) Catch and report ma1sd variables
|
||||
ansible.builtin.fail:
|
||||
msg: |-
|
||||
ma1sd was completely removed from the playbook in February 2026.
|
||||
|
||||
Please remove all `matrix_ma1sd_*` variables from your configuration file (vars.yml).
|
||||
|
||||
You may also wish to uninstall the component manually. See `docs/configuring-playbook-ma1sd.md` for more information.
|
||||
|
||||
The following variables in your configuration need to be removed: {{ lookup('ansible.builtin.varnames', '^matrix_ma1sd_.+', wantlist=True) | join(', ') }}
|
||||
when: "lookup('ansible.builtin.varnames', '^matrix_ma1sd_.+', wantlist=True) | length > 0"
|
||||
|
||||
- name: (Deprecation) Catch and report matrix-appservice-webhooks variables
|
||||
ansible.builtin.fail:
|
||||
msg: |-
|
||||
@@ -576,6 +595,19 @@
|
||||
The following variables in your configuration need to be renamed: {{ lookup('ansible.builtin.varnames', '^matrix_client_cinny_.+', wantlist=True) | join(', ') }}
|
||||
when: "lookup('ansible.builtin.varnames', '^matrix_client_cinny_.+', wantlist=True) | length > 0"
|
||||
|
||||
- name: (Deprecation) Catch and report matrix-dynamic-dns variables
|
||||
ansible.builtin.fail:
|
||||
msg: |-
|
||||
The matrix-dynamic-dns role in the playbook now lives under the MASH organization (https://github.com/mother-of-all-self-hosting/ansible-role-ddclient).
|
||||
The new role is pretty much the same, but uses differently named variables.
|
||||
|
||||
Please rename all `matrix_dynamic_dns_`-prefixed variables (`matrix_dynamic_dns_*` -> `ddclient_*`) on your configuration file (vars.yml).
|
||||
|
||||
After renaming them, please do not forget to fetch the Ansible role. See docs/maintenance-upgrading-services.md for details about how to do so.
|
||||
|
||||
The following variables in your configuration need to be renamed: {{ lookup('ansible.builtin.varnames', '^matrix_dynamic_dns_.+', wantlist=True) | join(', ') }}
|
||||
when: "lookup('ansible.builtin.varnames', '^matrix_dynamic_dns_.+', wantlist=True) | length > 0"
|
||||
|
||||
- name: (Deprecation) Catch and report mautrix-facebook variables
|
||||
ansible.builtin.fail:
|
||||
msg: |-
|
||||
|
||||
@@ -42,7 +42,7 @@
|
||||
- install-all
|
||||
|
||||
- custom/matrix-base
|
||||
- custom/matrix-dynamic-dns
|
||||
- galaxy/ddclient
|
||||
- galaxy/exim_relay
|
||||
|
||||
- role: galaxy/postgres
|
||||
@@ -79,7 +79,6 @@
|
||||
- custom/matrix-bridge-steam
|
||||
- custom/matrix-bridge-heisenbridge
|
||||
- custom/matrix-bridge-hookshot
|
||||
- custom/matrix-bridge-zulip
|
||||
- custom/matrix-bot-matrix-reminder-bot
|
||||
- custom/matrix-bot-matrix-registration-bot
|
||||
- custom/matrix-bot-maubot
|
||||
@@ -117,7 +116,6 @@
|
||||
- galaxy/jitsi
|
||||
- custom/matrix-user-verification-service
|
||||
- custom/matrix-ldap-registration-proxy
|
||||
- custom/matrix-ma1sd
|
||||
- custom/matrix-dimension
|
||||
- galaxy/etherpad
|
||||
- custom/matrix-sygnal
|
||||
|
||||
Reference in New Issue
Block a user