From 064072679230b1609eae4133baef26fb229c56cc Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Johan=20Swetz=C3=A9n?= Date: Fri, 18 Aug 2023 20:46:10 +0200 Subject: [PATCH] Complete network and traefik support for wsproxy --- group_vars/matrix_servers | 26 +++++++++-- .../defaults/main.yml | 37 +++++++++++++++ .../tasks/setup_install.yml | 7 +++ .../systemd/matrix-mautrix-wsproxy.service.j2 | 5 +++ .../templates/wsproxy-labels.j2 | 45 +++++++++++++++++++ 5 files changed, 117 insertions(+), 3 deletions(-) create mode 100644 roles/custom/matrix-bridge-mautrix-wsproxy/templates/wsproxy-labels.j2 diff --git a/group_vars/matrix_servers b/group_vars/matrix_servers index e9e627045..9319bf38b 100755 --- a/group_vars/matrix_servers +++ b/group_vars/matrix_servers @@ -1227,14 +1227,34 @@ matrix_mautrix_wsproxy_systemd_required_services_list: | {{ ['docker.service'] + - (['matrix-' + matrix_homeserver_implementation + '.service']) + ['matrix-' + matrix_homeserver_implementation + '.service'] + + + ([devture_postgres_identifier ~ '.service'] if devture_postgres_enabled else []) + - (['matrix-postgres.service'] if devture_postgres_enabled else []) + (['matrix-nginx-proxy.service'] if matrix_nginx_proxy_enabled else []) }} -matrix_mautrix_wsproxy_homeserver_domain: '{{ matrix_domain }}' +matrix_mautrix_wsproxy_homeserver_domain: "{{ matrix_domain }}" matrix_mautrix_wsproxy_homeserver_address: "{{ matrix_homeserver_container_url }}" +matrix_mautrix_wsproxy_hostname: "{{ matrix_server_fqn_matrix }}" +matrix_mautrix_wsproxy_path_prefix: /_matrix/wsproxy + +matrix_mautrix_wsproxy_container_additional_networks: | + {{ + ( + ([matrix_playbook_reverse_proxyable_services_additional_network] if matrix_playbook_reverse_proxyable_services_additional_network else []) + + + ([matrix_nginx_proxy_container_network] if matrix_nginx_proxy_enabled and matrix_nginx_proxy_container_network != matrix_mautrix_wsproxy_container_network else []) + + + ([devture_postgres_container_network] if devture_postgres_enabled and devture_postgres_container_network != matrix_mautrix_wsproxy_container_network else []) + ) | unique + }} + +matrix_mautrix_wsproxy_container_labels_traefik_enabled: "{{ matrix_playbook_reverse_proxy_type in ['playbook-managed-traefik', 'other-traefik-container'] }}" +matrix_mautrix_wsproxy_container_labels_traefik_docker_network: "{{ matrix_playbook_reverse_proxyable_services_additional_network }}" +matrix_mautrix_wsproxy_container_labels_traefik_entrypoints: "{{ devture_traefik_entrypoint_primary }}" +matrix_mautrix_wsproxy_container_labels_traefik_tls_certResolver: "{{ devture_traefik_certResolver_primary }}" ###################################################################### # diff --git a/roles/custom/matrix-bridge-mautrix-wsproxy/defaults/main.yml b/roles/custom/matrix-bridge-mautrix-wsproxy/defaults/main.yml index 986f35d3b..fa80ee88b 100644 --- a/roles/custom/matrix-bridge-mautrix-wsproxy/defaults/main.yml +++ b/roles/custom/matrix-bridge-mautrix-wsproxy/defaults/main.yml @@ -16,10 +16,46 @@ matrix_mautrix_wsproxy_data_path: "{{ matrix_mautrix_wsproxy_base_path }}/data" matrix_mautrix_wsproxy_homeserver_address: "{{ matrix_homeserver_container_url }}" matrix_mautrix_wsproxy_homeserver_domain: "{{ matrix_domain }}" +matrix_mautrix_wsproxy_bind_port: true matrix_mautrix_wsproxy_port: 29331 matrix_mautrix_wsproxy_appservice_address: "http://matrix-mautrix-wsproxy:{{ matrix_mautrix_wsproxy_port }}" +matrix_mautrix_wsproxy_hostname: "" +matrix_mautrix_wsproxy_path_prefix: "" + +# The base container network. It will be auto-created by this role if it doesn't exist already. +matrix_mautrix_wsproxy_container_network: matrix-mautrix-wsproxy + +# matrix_mautrix_wsproxy_container_labels_traefik_enabled controls whether labels to assist a Traefik reverse-proxy will be attached to the container. +# See `../templates/labels.j2` for details. +# +# To inject your own other container labels, see `matrix_mautrix_wsproxy_container_labels_additional_labels`. +matrix_mautrix_wsproxy_container_labels_traefik_enabled: true +matrix_mautrix_wsproxy_container_labels_traefik_docker_network: "{{ matrix_mautrix_wsproxy_container_network }}" +matrix_mautrix_wsproxy_container_labels_traefik_hostname: "{{ matrix_mautrix_wsproxy_hostname }}" +# The path prefix must either be `/` or not end with a slash (e.g. `/wsproxy`). +matrix_mautrix_wsproxy_container_labels_traefik_path_prefix: "{{ matrix_mautrix_wsproxy_path_prefix }}" +matrix_mautrix_wsproxy_container_labels_traefik_rule: "Host(`{{ matrix_mautrix_wsproxy_container_labels_traefik_hostname }}`){% if matrix_mautrix_wsproxy_container_labels_traefik_path_prefix != '/' %} && PathPrefix(`{{ matrix_mautrix_wsproxy_container_labels_traefik_path_prefix }}`){% endif %}" +matrix_mautrix_wsproxy_container_labels_traefik_priority: 0 +matrix_mautrix_wsproxy_container_labels_traefik_entrypoints: web-secure +matrix_mautrix_wsproxy_container_labels_traefik_tls: "{{ matrix_mautrix_wsproxy_container_labels_traefik_entrypoints != 'web' }}" +matrix_mautrix_wsproxy_container_labels_traefik_tls_certResolver: default # noqa var-naming + +# Controls which additional headers to attach to all HTTP responses. +# To add your own headers, use `matrix_mautrix_wsproxy_container_labels_traefik_additional_response_headers_custom` +matrix_mautrix_wsproxy_container_labels_traefik_additional_response_headers_auto: {} +matrix_mautrix_wsproxy_container_labels_traefik_additional_response_headers_custom: {} +matrix_mautrix_wsproxy_container_labels_traefik_additional_response_headers: "{{ matrix_mautrix_wsproxy_container_labels_traefik_additional_response_headers_auto | combine(matrix_mautrix_wsproxy_container_labels_traefik_additional_response_headers_custom) }}" + +# matrix_mautrix_wsproxy_container_labels_additional_labels contains a multiline string with additional labels to add to the container label file. +# See `../templates/labels.j2` for details. +# +# Example: +# matrix_mautrix_wsproxy_container_labels_additional_labels: | +# my.label=1 +# another.label="here" +matrix_mautrix_wsproxy_container_labels_additional_labels: '' # A list of extra arguments to pass to the container matrix_mautrix_wsproxy_container_extra_arguments: [] @@ -105,6 +141,7 @@ matrix_mautrix_wsproxy_syncproxy_systemd_wanted_services_list: [] matrix_mautrix_wsproxy_syncproxy_shared_secret: '' matrix_mautrix_wsproxy_syncproxy_port: 29332 +matrix_mautrix_wsproxy_syncproxy_bind_port: true matrix_mautrix_wsproxy_syncproxy_appservice_address: "http://matrix-mautrix-wsproxy-syncproxy:{{ matrix_mautrix_wsproxy_syncproxy_port }}" # Database-related configuration fields diff --git a/roles/custom/matrix-bridge-mautrix-wsproxy/tasks/setup_install.yml b/roles/custom/matrix-bridge-mautrix-wsproxy/tasks/setup_install.yml index fbfe707e9..212ef39a2 100644 --- a/roles/custom/matrix-bridge-mautrix-wsproxy/tasks/setup_install.yml +++ b/roles/custom/matrix-bridge-mautrix-wsproxy/tasks/setup_install.yml @@ -23,6 +23,8 @@ group: "{{ matrix_user_groupname }}" with_items: - syncproxy-env + - wsproxy-labels + - name: Ensure Mautrix wsproxy image is pulled community.docker.docker_image: name: "{{ matrix_mautrix_wsproxy_docker_image }}" @@ -78,6 +80,11 @@ owner: "{{ matrix_user_username }}" group: "{{ matrix_user_groupname }}" +- name: Ensure mautrix-wsproxy container network is created + community.general.docker_network: + name: "{{ matrix_mautrix_wsproxy_container_network }}" + driver: bridge + - name: Ensure matrix-mautrix-wsproxy.service installed ansible.builtin.template: src: "{{ role_path }}/templates/systemd/matrix-mautrix-wsproxy.service.j2" diff --git a/roles/custom/matrix-bridge-mautrix-wsproxy/templates/systemd/matrix-mautrix-wsproxy.service.j2 b/roles/custom/matrix-bridge-mautrix-wsproxy/templates/systemd/matrix-mautrix-wsproxy.service.j2 index ee7261eec..e83934071 100644 --- a/roles/custom/matrix-bridge-mautrix-wsproxy/templates/systemd/matrix-mautrix-wsproxy.service.j2 +++ b/roles/custom/matrix-bridge-mautrix-wsproxy/templates/systemd/matrix-mautrix-wsproxy.service.j2 @@ -28,12 +28,17 @@ ExecStart={{ devture_systemd_docker_base_host_command_docker }} run --rm --name -p {{ matrix_mautrix_wsproxy_port }}:29331 \ {% endif %} --mount type=bind,src={{ matrix_mautrix_wsproxy_config_path }},dst=/data \ + --label-file={{ matrix_bridge_wsproxy_data_path }}/wsproxy-labels \ {% for arg in matrix_mautrix_wsproxy_container_extra_arguments %} {{ arg }} \ {% endfor %} {{ matrix_mautrix_wsproxy_docker_image }} \ /usr/bin/mautrix-wsproxy -config /data/config.yaml +{% for network in matrix_mautrix_wsproxy_container_additional_networks %} +ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} network connect {{ network }} {{ matrix_mautrix_wsproxy_container_network }} +{% endfor %} + ExecStop=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} kill matrix-mautrix-wsproxy 2>/dev/null' ExecStop=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} rm matrix-mautrix-wsproxy 2>/dev/null' Restart=always diff --git a/roles/custom/matrix-bridge-mautrix-wsproxy/templates/wsproxy-labels.j2 b/roles/custom/matrix-bridge-mautrix-wsproxy/templates/wsproxy-labels.j2 new file mode 100644 index 000000000..d2dd72ea2 --- /dev/null +++ b/roles/custom/matrix-bridge-mautrix-wsproxy/templates/wsproxy-labels.j2 @@ -0,0 +1,45 @@ +{% if matrix_mautrix_wsproxy_container_labels_traefik_enabled %} +traefik.enable=true + +{% if matrix_mautrix_wsproxy_container_labels_traefik_docker_network %} +traefik.docker.network={{ matrix_mautrix_wsproxy_container_labels_traefik_docker_network }} +{% endif %} + +{% set middlewares = [] %} + +{% if matrix_mautrix_wsproxy_container_labels_traefik_path_prefix != '/' %} +traefik.http.middlewares.matrix-mautrix-wsproxy-slashless-redirect.redirectregex.regex=({{ matrix_mautrix_wsproxy_container_labels_traefik_path_prefix | quote }})$ +traefik.http.middlewares.matrix-mautrix-wsproxy-slashless-redirect.redirectregex.replacement=${1}/ +{% set middlewares = middlewares + ['matrix-mautrix-wsproxy-slashless-redirect'] %} +{% endif %} + +{% if matrix_mautrix_wsproxy_container_labels_traefik_path_prefix != '/' %} +traefik.http.middlewares.matrix-mautrix-wsproxy-strip-prefix.stripprefix.prefixes={{ matrix_mautrix_wsproxy_container_labels_traefik_path_prefix }} +{% set middlewares = middlewares + ['matrix-mautrix-wsproxy-strip-prefix'] %} +{% endif %} + +{% if matrix_mautrix_wsproxy_container_labels_traefik_additional_response_headers.keys() | length > 0 %} +{% for name, value in matrix_mautrix_wsproxy_container_labels_traefik_additional_response_headers.items() %} +traefik.http.middlewares.matrix-mautrix-wsproxy-add-headers.headers.customresponseheaders.{{ name }}={{ value }} +{% endfor %} +{% set middlewares = middlewares + ['matrix-mautrix-wsproxy-add-headers'] %} +{% endif %} + +traefik.http.routers.matrix-mautrix-wsproxy.rule={{ matrix_mautrix_wsproxy_container_labels_traefik_rule }} +{% if matrix_mautrix_wsproxy_container_labels_traefik_priority | int > 0 %} +traefik.http.routers.matrix-mautrix-wsproxy.priority={{ matrix_mautrix_wsproxy_container_labels_traefik_priority }} +{% endif %} +traefik.http.routers.matrix-mautrix-wsproxy.service=matrix-mautrix-wsproxy +{% if middlewares | length > 0 %} +traefik.http.routers.matrix-mautrix-wsproxy.middlewares={{ middlewares | join(',') }} +{% endif %} +traefik.http.routers.matrix-mautrix-wsproxy.entrypoints={{ matrix_mautrix_wsproxy_container_labels_traefik_entrypoints }} +traefik.http.routers.matrix-mautrix-wsproxy.tls={{ matrix_mautrix_wsproxy_container_labels_traefik_tls | to_json }} +{% if matrix_mautrix_wsproxy_container_labels_traefik_tls %} +traefik.http.routers.matrix-mautrix-wsproxy.tls.certResolver={{ matrix_mautrix_wsproxy_container_labels_traefik_tls_certResolver }} +{% endif %} + +traefik.http.services.matrix-sliding-sync.loadbalancer.server.port=8008 +{% endif %} + +{{ matrix_mautrix_wsproxy_container_labels_additional_labels }}