Add native Traefik support to matrix-corporal (HTTP API)

group_vars/matrix_servers

@@ -2194,6 +2194,20 @@ matrix_corporal_container_image_self_build: "{{ matrix_architecture not in ['amd
 matrix_corporal_container_http_gateway_host_bind_port: "{{ (matrix_playbook_service_host_bind_interface_prefix ~ '41080') if matrix_playbook_service_host_bind_interface_prefix else '' }}"
 matrix_corporal_container_http_api_host_bind_port: "{{ (matrix_playbook_service_host_bind_interface_prefix ~ '41081') if matrix_playbook_service_host_bind_interface_prefix else '' }}"
 
+matrix_corporal_container_labels_traefik_enabled: "{{ matrix_playbook_reverse_proxy_type in ['playbook-managed-traefik', 'other-traefik-container'] }}"
+matrix_corporal_container_labels_traefik_docker_network: "{{ matrix_playbook_reverse_proxyable_services_additional_network }}"
+matrix_corporal_container_labels_traefik_entrypoints: "{{ devture_traefik_entrypoint_primary }}"
+matrix_corporal_container_labels_traefik_tls_certResolver: "{{ devture_traefik_certResolver_primary }}"
+
+matrix_corporal_container_additional_networks: |
+  {{
+    (
+      ([matrix_playbook_reverse_proxyable_services_additional_network] if matrix_playbook_reverse_proxyable_services_additional_network else [])
+      +
+      ([matrix_nginx_proxy_container_network] if matrix_nginx_proxy_enabled and matrix_nginx_proxy_container_network != matrix_corporal_container_network else [])
+    ) | unique
+  }}
+
 matrix_corporal_systemd_required_services_list: |
   {{
     (['docker.service'])
@@ -2802,7 +2816,7 @@ matrix_nginx_proxy_container_labels_traefik_tls_certResolver: "{{ devture_traefi
 
 matrix_nginx_proxy_container_labels_traefik_proxy_matrix_enabled: true
 
-matrix_nginx_proxy_proxy_matrix_corporal_api_enabled: "{{ matrix_corporal_enabled and matrix_corporal_http_api_enabled }}"
+matrix_nginx_proxy_proxy_matrix_corporal_api_enabled: "{{ matrix_corporal_enabled and matrix_corporal_http_api_enabled and matrix_playbook_reverse_proxy_type in ['playbook-managed-nginx', 'other-nginx-non-container'] }}"
 matrix_nginx_proxy_proxy_matrix_corporal_api_addr_with_container: "matrix-corporal:41081"
 matrix_nginx_proxy_proxy_matrix_corporal_api_addr_sans_container: "127.0.0.1:41081"
 

roles/custom/matrix-corporal/defaults/main.yml

@@ -33,6 +33,33 @@ matrix_corporal_container_additional_networks: "{{ matrix_corporal_container_add
 matrix_corporal_container_additional_networks_auto: []
 matrix_corporal_container_additional_networks_custom: []
 
+# matrix_corporal_container_labels_traefik_enabled controls whether labels to assist a Traefik reverse-proxy will be attached to the container.
+# See `../templates/labels.j2` for details.
+#
+# To inject your own other container labels, see `matrix_corporal_container_labels_additional_labels`.
+matrix_corporal_container_labels_traefik_enabled: true
+matrix_corporal_container_labels_traefik_docker_network: "{{ matrix_corporal_container_network }}"
+matrix_corporal_container_labels_traefik_entrypoints: web-secure
+matrix_corporal_container_labels_traefik_tls: "{{ matrix_corporal_container_labels_traefik_entrypoints != 'web' }}"
+matrix_corporal_container_labels_traefik_tls_certResolver: default  # noqa var-naming
+
+# Controls whether labels will be added that expose matrix-corporal's HTTP API
+matrix_corporal_container_labels_api_enabled: "{{ matrix_corporal_http_api_enabled }}"
+matrix_corporal_container_labels_api_traefik_rule: "Host(`{{ matrix_corporal_matrix_homeserver_api_domain_name }}`) && PathPrefix(`/_matrix/corporal`)"
+matrix_corporal_container_labels_api_traefik_priority: 0
+matrix_corporal_container_labels_api_traefik_entrypoints: "{{ matrix_corporal_container_labels_traefik_entrypoints }}"
+matrix_corporal_container_labels_api_traefik_tls: "{{ matrix_corporal_container_labels_traefik_tls }}"
+matrix_corporal_container_labels_api_traefik_tls_certResolver: "{{ matrix_corporal_container_labels_traefik_tls_certResolver }}"  # noqa var-naming
+
+# matrix_corporal_container_labels_additional_labels contains a multiline string with additional labels to add to the container label file.
+# See `../templates/labels.j2` for details.
+#
+# Example:
+# matrix_corporal_container_labels_additional_labels: |
+#   my.label=1
+#   another.label="here"
+matrix_corporal_container_labels_additional_labels: ''
+
 # List of systemd services that matrix-corporal.service depends on
 matrix_corporal_systemd_required_services_list: ['docker.service']
 matrix_corporal_docker_image: "{{ matrix_corporal_docker_image_name_prefix }}devture/matrix-corporal:{{ matrix_corporal_docker_image_tag }}"
@@ -47,6 +74,7 @@ matrix_corporal_cache_dir_path: "{{ matrix_corporal_base_path }}/cache"
 matrix_corporal_var_dir_path: "{{ matrix_corporal_base_path }}/var"
 
 matrix_corporal_matrix_homeserver_domain_name: "{{ matrix_domain }}"
+matrix_corporal_matrix_homeserver_api_domain_name: "{{ matrix_server_fqn_matrix }}"
 
 # Controls where matrix-corporal can reach your Synapse server (e.g. "http://matrix-synapse-reverse-proxy-companion:{{ matrix_synapse_container_client_api_port }}").
 # If Synapse runs on the same machine, you may need to add its service to `matrix_corporal_systemd_required_services_list`.

roles/custom/matrix-corporal/tasks/setup_install.yml

@@ -8,6 +8,7 @@
     owner: "{{ matrix_user_username }}"
     group: "{{ matrix_user_groupname }}"
   with_items:
+    - "{{ matrix_corporal_base_path }}"
     - "{{ matrix_corporal_config_dir_path }}"
     - "{{ matrix_corporal_cache_dir_path }}"
     - "{{ matrix_corporal_var_dir_path }}"
@@ -55,6 +56,16 @@
     owner: "{{ matrix_user_username }}"
     group: "{{ matrix_user_groupname }}"
 
+- name: Ensure Matrix Corporal support files installed
+  ansible.builtin.template:
+    src: "{{ role_path }}/templates/{{ item }}.j2"
+    dest: "{{ matrix_corporal_base_path }}/{{ item }}"
+    mode: 0640
+    owner: "{{ matrix_user_username }}"
+    group: "{{ matrix_user_groupname }}"
+  with_items:
+    - labels
+
 - name: Ensure matrix-corporal.service installed
   ansible.builtin.template:
     src: "{{ role_path }}/templates/systemd/matrix-corporal.service.j2"

roles/custom/matrix-corporal/templates/labels.j2

@@ -0,0 +1,26 @@
+{% if matrix_corporal_container_labels_traefik_enabled %}
+traefik.enable=true
+
+{% if matrix_corporal_container_labels_traefik_docker_network %}
+traefik.docker.network={{ matrix_corporal_container_labels_traefik_docker_network }}
+{% endif %}
+
+{# HTTP API #}
+{% if matrix_corporal_container_labels_api_enabled %}
+traefik.http.routers.matrix-corporal-api.rule={{ matrix_corporal_container_labels_api_traefik_rule }}
+{% if matrix_corporal_container_labels_api_traefik_priority | int > 0 %}
+traefik.http.routers.matrix-corporal-api.priority={{ matrix_corporal_container_labels_api_traefik_priority }}
+{% endif %}
+traefik.http.routers.matrix-corporal-api.service=matrix-corporal-api
+traefik.http.routers.matrix-corporal-api.entrypoints={{ matrix_corporal_container_labels_api_traefik_entrypoints }}
+traefik.http.routers.matrix-corporal-api.tls={{ matrix_corporal_container_labels_api_traefik_tls | to_json }}
+{% if matrix_corporal_container_labels_api_traefik_tls %}
+traefik.http.routers.matrix-corporal-api.tls.certResolver={{ matrix_corporal_container_labels_api_traefik_tls_certResolver }}
+{% endif %}
+traefik.http.services.matrix-corporal-api.loadbalancer.server.port=41081
+{% endif %}
+
+
+{% endif %}
+
+{{ matrix_corporal_container_labels_additional_labels }}

roles/custom/matrix-corporal/templates/systemd/matrix-corporal.service.j2

@@ -21,6 +21,7 @@ ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} create \
 			--cap-drop=ALL \
 			--read-only \
 			--network={{ matrix_corporal_container_network }} \
+			--label-file={{ matrix_corporal_base_path }}/labels \
 			{% if matrix_corporal_container_http_gateway_host_bind_port %}
 			-p {{ matrix_corporal_container_http_gateway_host_bind_port }}:41080 \
 			{% endif %}