Signed-off-by: Suguru Hirahara <did🔑z6MkvVZk1A3KBApWJXv2Ju4H14ErDfRGxh8zxdXSZ4vACDg5>
pull/4915/head
| @@ -24,22 +24,22 @@ When setting, replace `example.com` with your own. | |||||
| To enable Hydrogen, add the following configuration to your `inventory/host_vars/matrix.example.com/vars.yml` file: | To enable Hydrogen, add the following configuration to your `inventory/host_vars/matrix.example.com/vars.yml` file: | ||||
| ```yaml | ```yaml | ||||
| matrix_client_hydrogen_enabled: true | |||||
| hydrogen_enabled: true | |||||
| ``` | ``` | ||||
| ### Adjusting the Hydrogen URL (optional) | ### Adjusting the Hydrogen URL (optional) | ||||
| By tweaking the `matrix_client_hydrogen_hostname` and `matrix_client_hydrogen_path_prefix` variables, you can easily make the service available at a **different hostname and/or path** than the default one. | |||||
| By tweaking the `hydrogen_hostname` and `hydrogen_path_prefix` variables, you can easily make the service available at a **different hostname and/or path** than the default one. | |||||
| Example additional configuration for your `vars.yml` file: | Example additional configuration for your `vars.yml` file: | ||||
| ```yaml | ```yaml | ||||
| # Switch to the domain used for Matrix services (`matrix.example.com`), | # Switch to the domain used for Matrix services (`matrix.example.com`), | ||||
| # so we won't need to add additional DNS records for Hydrogen. | # so we won't need to add additional DNS records for Hydrogen. | ||||
| matrix_client_hydrogen_hostname: "{{ matrix_server_fqn_matrix }}" | |||||
| hydrogen_hostname: "{{ matrix_server_fqn_matrix }}" | |||||
| # Expose under the /hydrogen subpath | # Expose under the /hydrogen subpath | ||||
| matrix_client_hydrogen_path_prefix: /hydrogen | |||||
| hydrogen_path_prefix: /hydrogen | |||||
| ``` | ``` | ||||
| After changing the domain, **you may need to adjust your DNS** records to point the Hydrogen domain to the Matrix server. | After changing the domain, **you may need to adjust your DNS** records to point the Hydrogen domain to the Matrix server. | ||||
| @@ -53,7 +53,7 @@ There are some additional things you may wish to configure about the client. | |||||
| Take a look at: | Take a look at: | ||||
| - `roles/galaxy/hydrogen/defaults/main.yml` for some variables that you can customize via your `vars.yml` file | - `roles/galaxy/hydrogen/defaults/main.yml` for some variables that you can customize via your `vars.yml` file | ||||
| - `roles/galaxy/hydrogen/templates/config.json.j2` for the client's default configuration. You can override settings (even those that don't have dedicated playbook variables) using the `matrix_client_hydrogen_configuration_extension_json` variable | |||||
| - `roles/galaxy/hydrogen/templates/config.json.j2` for the client's default configuration. You can override settings (even those that don't have dedicated playbook variables) using the `hydrogen_configuration_extension_json` variable | |||||
| ## Installing | ## Installing | ||||
| @@ -70,4 +70,4 @@ The shortcut commands with the [`just` program](just.md) are also available: `ju | |||||
| ## Troubleshooting | ## Troubleshooting | ||||
| As with all other services, you can find the logs in [systemd-journald](https://www.freedesktop.org/software/systemd/man/systemd-journald.service.html) by logging in to the server with SSH and running `journalctl -fu matrix-client-hydrogen`. | |||||
| As with all other services, you can find the logs in [systemd-journald](https://www.freedesktop.org/software/systemd/man/systemd-journald.service.html) by logging in to the server with SSH and running `journalctl -fu hydrogen`. | |||||
| @@ -28,7 +28,7 @@ Possibly outdated list of roles where self-building the Docker image is currentl | |||||
| - `matrix-synapse` | - `matrix-synapse` | ||||
| - `matrix-synapse-admin` | - `matrix-synapse-admin` | ||||
| - `matrix-client-element` | - `matrix-client-element` | ||||
| - `matrix-client-hydrogen` | |||||
| - `hydrogen` | |||||
| - `cinny` | - `cinny` | ||||
| - `matrix-registration` | - `matrix-registration` | ||||
| - `coturn` | - `coturn` | ||||
| @@ -357,7 +357,7 @@ devture_systemd_service_manager_services_list_auto: | | |||||
| + | + | ||||
| ([{'name': 'matrix-client-element.service', 'priority': 2000, 'groups': ['matrix', 'clients', 'element', 'client-element']}] if matrix_client_element_enabled else []) | ([{'name': 'matrix-client-element.service', 'priority': 2000, 'groups': ['matrix', 'clients', 'element', 'client-element']}] if matrix_client_element_enabled else []) | ||||
| + | + | ||||
| ([{'name': 'matrix-client-hydrogen.service', 'priority': 2000, 'groups': ['matrix', 'clients', 'hydrogen', 'client-hydrogen']}] if matrix_client_hydrogen_enabled else []) | |||||
| ([{'name': 'hydrogen.service', 'priority': 2000, 'groups': ['matrix', 'clients', 'hydrogen', 'client-hydrogen']}] if hydrogen_enabled else []) | |||||
| + | + | ||||
| ([{'name': 'matrix-client-schildichat.service', 'priority': 2000, 'groups': ['matrix', 'clients', 'schildichat', 'client-schildichat']}] if matrix_client_schildichat_enabled else []) | ([{'name': 'matrix-client-schildichat.service', 'priority': 2000, 'groups': ['matrix', 'clients', 'schildichat', 'client-schildichat']}] if matrix_client_schildichat_enabled else []) | ||||
| + | + | ||||
| @@ -4124,39 +4124,39 @@ matrix_client_element_element_call_url: "{{ matrix_element_call_public_url if ma | |||||
| ###################################################################### | ###################################################################### | ||||
| # | # | ||||
| # matrix-client-hydrogen | |||||
| # hydrogen | |||||
| # | # | ||||
| ###################################################################### | ###################################################################### | ||||
| matrix_client_hydrogen_enabled: false | |||||
| hydrogen_enabled: false | |||||
| matrix_client_hydrogen_docker_image_registry_prefix_upstream: "{{ matrix_container_global_registry_prefix_override if matrix_container_global_registry_prefix_override else matrix_client_hydrogen_docker_image_registry_prefix_upstream_default }}" | |||||
| hydrogen_docker_image_registry_prefix_upstream: "{{ matrix_container_global_registry_prefix_override if matrix_container_global_registry_prefix_override else hydrogen_docker_image_registry_prefix_upstream_default }}" | |||||
| matrix_client_hydrogen_container_image_self_build: "{{ matrix_architecture not in ['arm64', 'amd64'] }}" | |||||
| hydrogen_container_image_self_build: "{{ matrix_architecture not in ['arm64', 'amd64'] }}" | |||||
| matrix_client_hydrogen_container_http_host_bind_port: "{{ (matrix_playbook_service_host_bind_interface_prefix ~ '8768') if matrix_playbook_service_host_bind_interface_prefix else '' }}" | |||||
| hydrogen_container_http_host_bind_port: "{{ (matrix_playbook_service_host_bind_interface_prefix ~ '8768') if matrix_playbook_service_host_bind_interface_prefix else '' }}" | |||||
| matrix_client_hydrogen_container_network: "{{ matrix_addons_container_network }}" | |||||
| hydrogen_container_network: "{{ matrix_addons_container_network }}" | |||||
| matrix_client_hydrogen_container_additional_networks: "{{ [matrix_playbook_reverse_proxyable_services_additional_network] if (matrix_client_hydrogen_container_labels_traefik_enabled and matrix_playbook_reverse_proxyable_services_additional_network) else [] }}" | |||||
| hydrogen_container_additional_networks: "{{ [matrix_playbook_reverse_proxyable_services_additional_network] if (hydrogen_container_labels_traefik_enabled and matrix_playbook_reverse_proxyable_services_additional_network) else [] }}" | |||||
| matrix_client_hydrogen_container_labels_traefik_enabled: "{{ matrix_playbook_reverse_proxy_type in ['playbook-managed-traefik', 'other-traefik-container'] }}" | |||||
| matrix_client_hydrogen_container_labels_traefik_docker_network: "{{ matrix_playbook_reverse_proxyable_services_additional_network }}" | |||||
| matrix_client_hydrogen_container_labels_traefik_entrypoints: "{{ traefik_entrypoint_primary }}" | |||||
| matrix_client_hydrogen_container_labels_traefik_tls_certResolver: "{{ traefik_certResolver_primary }}" | |||||
| hydrogen_container_labels_traefik_enabled: "{{ matrix_playbook_reverse_proxy_type in ['playbook-managed-traefik', 'other-traefik-container'] }}" | |||||
| hydrogen_container_labels_traefik_docker_network: "{{ matrix_playbook_reverse_proxyable_services_additional_network }}" | |||||
| hydrogen_container_labels_traefik_entrypoints: "{{ traefik_entrypoint_primary }}" | |||||
| hydrogen_container_labels_traefik_tls_certResolver: "{{ traefik_certResolver_primary }}" | |||||
| matrix_client_hydrogen_container_labels_traefik_compression_middleware_enabled: "{{ matrix_playbook_reverse_proxy_traefik_middleware_compression_enabled }}" | |||||
| matrix_client_hydrogen_container_labels_traefik_compression_middleware_name: "{{ matrix_playbook_reverse_proxy_traefik_middleware_compression_name if matrix_playbook_reverse_proxy_traefik_middleware_compression_enabled else '' }}" | |||||
| hydrogen_container_labels_traefik_compression_middleware_enabled: "{{ matrix_playbook_reverse_proxy_traefik_middleware_compression_enabled }}" | |||||
| hydrogen_container_labels_traefik_compression_middleware_name: "{{ matrix_playbook_reverse_proxy_traefik_middleware_compression_name if matrix_playbook_reverse_proxy_traefik_middleware_compression_enabled else '' }}" | |||||
| matrix_client_hydrogen_scheme: "{{ 'https' if matrix_playbook_ssl_enabled else 'http' }}" | |||||
| hydrogen_scheme: "{{ 'https' if matrix_playbook_ssl_enabled else 'http' }}" | |||||
| matrix_client_hydrogen_default_hs_url: "{{ matrix_homeserver_url }}" | |||||
| hydrogen_default_hs_url: "{{ matrix_homeserver_url }}" | |||||
| matrix_client_hydrogen_self_check_validate_certificates: "{{ matrix_playbook_ssl_enabled }}" | |||||
| hydrogen_self_check_validate_certificates: "{{ matrix_playbook_ssl_enabled }}" | |||||
| ###################################################################### | ###################################################################### | ||||
| # | # | ||||
| # /matrix-client-hydrogen | |||||
| # /hydrogen | |||||
| # | # | ||||
| ###################################################################### | ###################################################################### | ||||
| @@ -106,7 +106,7 @@ matrix_server_fqn_matrix_federation: '{{ matrix_server_fqn_matrix }}' | |||||
| # This and the Matrix FQN (see above) are expected to be on the same server. | # This and the Matrix FQN (see above) are expected to be on the same server. | ||||
| matrix_server_fqn_element: "element.{{ matrix_domain }}" | matrix_server_fqn_element: "element.{{ matrix_domain }}" | ||||
| # This is where you access the Hydrogen web client from (if enabled via matrix_client_hydrogen_enabled; disabled by default). | |||||
| # This is where you access the Hydrogen web client from (if enabled via hydrogen_enabled; disabled by default). | |||||
| matrix_server_fqn_hydrogen: "hydrogen.{{ matrix_domain }}" | matrix_server_fqn_hydrogen: "hydrogen.{{ matrix_domain }}" | ||||
| # This is where you access the Cinny web client from (if enabled via cinny_enabled; disabled by default). | # This is where you access the Cinny web client from (if enabled via cinny_enabled; disabled by default). | ||||
| @@ -12,83 +12,83 @@ | |||||
| --- | --- | ||||
| # Project source code URL: https://github.com/element-hq/hydrogen-web | # Project source code URL: https://github.com/element-hq/hydrogen-web | ||||
| matrix_client_hydrogen_enabled: true | |||||
| hydrogen_enabled: true | |||||
| matrix_client_hydrogen_container_image_self_build: false | |||||
| matrix_client_hydrogen_container_image_self_build_repo: "https://github.com/element-hq/hydrogen-web.git" | |||||
| hydrogen_container_image_self_build: false | |||||
| hydrogen_container_image_self_build_repo: "https://github.com/element-hq/hydrogen-web.git" | |||||
| # renovate: datasource=docker depName=ghcr.io/element-hq/hydrogen-web | # renovate: datasource=docker depName=ghcr.io/element-hq/hydrogen-web | ||||
| matrix_client_hydrogen_version: v0.5.1 | |||||
| matrix_client_hydrogen_docker_image: "{{ matrix_client_hydrogen_docker_image_registry_prefix }}element-hq/hydrogen-web:{{ matrix_client_hydrogen_version }}" | |||||
| matrix_client_hydrogen_docker_image_registry_prefix: "{{ 'localhost/' if matrix_client_hydrogen_container_image_self_build else matrix_client_hydrogen_docker_image_registry_prefix_upstream }}" | |||||
| matrix_client_hydrogen_docker_image_registry_prefix_upstream: "{{ matrix_client_hydrogen_docker_image_registry_prefix_upstream_default }}" | |||||
| matrix_client_hydrogen_docker_image_registry_prefix_upstream_default: ghcr.io/ | |||||
| matrix_client_hydrogen_docker_image_force_pull: "{{ matrix_client_hydrogen_docker_image.endswith(':latest') }}" | |||||
| hydrogen_version: v0.5.1 | |||||
| hydrogen_docker_image: "{{ hydrogen_docker_image_registry_prefix }}element-hq/hydrogen-web:{{ hydrogen_version }}" | |||||
| hydrogen_docker_image_registry_prefix: "{{ 'localhost/' if hydrogen_container_image_self_build else hydrogen_docker_image_registry_prefix_upstream }}" | |||||
| hydrogen_docker_image_registry_prefix_upstream: "{{ hydrogen_docker_image_registry_prefix_upstream_default }}" | |||||
| hydrogen_docker_image_registry_prefix_upstream_default: ghcr.io/ | |||||
| hydrogen_docker_image_force_pull: "{{ hydrogen_docker_image.endswith(':latest') }}" | |||||
| matrix_client_hydrogen_data_path: "{{ matrix_base_data_path }}/client-hydrogen" | |||||
| matrix_client_hydrogen_docker_src_files_path: "{{ matrix_client_hydrogen_data_path }}/docker-src" | |||||
| hydrogen_data_path: "{{ matrix_base_data_path }}/client-hydrogen" | |||||
| hydrogen_docker_src_files_path: "{{ hydrogen_data_path }}/docker-src" | |||||
| # The base container network | # The base container network | ||||
| matrix_client_hydrogen_container_network: '' | |||||
| hydrogen_container_network: '' | |||||
| # A list of additional container networks that the container would be connected to. | # A list of additional container networks that the container would be connected to. | ||||
| # The role does not create these networks, so make sure they already exist. | # The role does not create these networks, so make sure they already exist. | ||||
| # Use this to expose this container to a reverse proxy, which runs in a different container network. | # Use this to expose this container to a reverse proxy, which runs in a different container network. | ||||
| matrix_client_hydrogen_container_additional_networks: [] | |||||
| hydrogen_container_additional_networks: [] | |||||
| # Controls whether the container exposes its HTTP port (tcp/8080 in the container). | # Controls whether the container exposes its HTTP port (tcp/8080 in the container). | ||||
| # | # | ||||
| # Takes an "<ip>:<port>" or "<port>" value (e.g. "127.0.0.1:8768"), or empty string to not expose. | # Takes an "<ip>:<port>" or "<port>" value (e.g. "127.0.0.1:8768"), or empty string to not expose. | ||||
| matrix_client_hydrogen_container_http_host_bind_port: '' | |||||
| hydrogen_container_http_host_bind_port: '' | |||||
| # matrix_client_hydrogen_container_labels_traefik_enabled controls whether labels to assist a Traefik reverse-proxy will be attached to the container. | |||||
| # hydrogen_container_labels_traefik_enabled controls whether labels to assist a Traefik reverse-proxy will be attached to the container. | |||||
| # See `../templates/labels.j2` for details. | # See `../templates/labels.j2` for details. | ||||
| # | # | ||||
| # To inject your own other container labels, see `matrix_client_hydrogen_container_labels_additional_labels`. | |||||
| matrix_client_hydrogen_container_labels_traefik_enabled: true | |||||
| matrix_client_hydrogen_container_labels_traefik_docker_network: "{{ matrix_client_hydrogen_container_network }}" | |||||
| matrix_client_hydrogen_container_labels_traefik_hostname: "{{ matrix_client_hydrogen_hostname }}" | |||||
| # To inject your own other container labels, see `hydrogen_container_labels_additional_labels`. | |||||
| hydrogen_container_labels_traefik_enabled: true | |||||
| hydrogen_container_labels_traefik_docker_network: "{{ hydrogen_container_network }}" | |||||
| hydrogen_container_labels_traefik_hostname: "{{ hydrogen_hostname }}" | |||||
| # The path prefix must either be `/` or not end with a slash (e.g. `/hydrogen`). | # The path prefix must either be `/` or not end with a slash (e.g. `/hydrogen`). | ||||
| matrix_client_hydrogen_container_labels_traefik_path_prefix: "{{ matrix_client_hydrogen_path_prefix }}" | |||||
| matrix_client_hydrogen_container_labels_traefik_rule: "Host(`{{ matrix_client_hydrogen_container_labels_traefik_hostname }}`){% if matrix_client_hydrogen_container_labels_traefik_path_prefix != '/' %} && PathPrefix(`{{ matrix_client_hydrogen_container_labels_traefik_path_prefix }}`){% endif %}" | |||||
| matrix_client_hydrogen_container_labels_traefik_priority: 0 | |||||
| matrix_client_hydrogen_container_labels_traefik_entrypoints: web-secure | |||||
| matrix_client_hydrogen_container_labels_traefik_tls: "{{ matrix_client_hydrogen_container_labels_traefik_entrypoints != 'web' }}" | |||||
| matrix_client_hydrogen_container_labels_traefik_tls_certResolver: default # noqa var-naming | |||||
| hydrogen_container_labels_traefik_path_prefix: "{{ hydrogen_path_prefix }}" | |||||
| hydrogen_container_labels_traefik_rule: "Host(`{{ hydrogen_container_labels_traefik_hostname }}`){% if hydrogen_container_labels_traefik_path_prefix != '/' %} && PathPrefix(`{{ hydrogen_container_labels_traefik_path_prefix }}`){% endif %}" | |||||
| hydrogen_container_labels_traefik_priority: 0 | |||||
| hydrogen_container_labels_traefik_entrypoints: web-secure | |||||
| hydrogen_container_labels_traefik_tls: "{{ hydrogen_container_labels_traefik_entrypoints != 'web' }}" | |||||
| hydrogen_container_labels_traefik_tls_certResolver: default # noqa var-naming | |||||
| # Controls whether a compression middleware will be injected into the middlewares list. | # Controls whether a compression middleware will be injected into the middlewares list. | ||||
| # This compression middleware is supposed to be defined elsewhere (using labels or a File provider, etc.) and is merely referenced by this router. | # This compression middleware is supposed to be defined elsewhere (using labels or a File provider, etc.) and is merely referenced by this router. | ||||
| matrix_client_hydrogen_container_labels_traefik_compression_middleware_enabled: false | |||||
| matrix_client_hydrogen_container_labels_traefik_compression_middleware_name: "" | |||||
| hydrogen_container_labels_traefik_compression_middleware_enabled: false | |||||
| hydrogen_container_labels_traefik_compression_middleware_name: "" | |||||
| # Controls which additional headers to attach to all HTTP responses. | # Controls which additional headers to attach to all HTTP responses. | ||||
| # To add your own headers, use `matrix_client_hydrogen_container_labels_traefik_additional_response_headers_custom` | |||||
| matrix_client_hydrogen_container_labels_traefik_additional_response_headers: "{{ matrix_client_hydrogen_container_labels_traefik_additional_response_headers_auto | combine(matrix_client_hydrogen_container_labels_traefik_additional_response_headers_custom) }}" | |||||
| matrix_client_hydrogen_container_labels_traefik_additional_response_headers_auto: | | |||||
| # To add your own headers, use `hydrogen_container_labels_traefik_additional_response_headers_custom` | |||||
| hydrogen_container_labels_traefik_additional_response_headers: "{{ hydrogen_container_labels_traefik_additional_response_headers_auto | combine(hydrogen_container_labels_traefik_additional_response_headers_custom) }}" | |||||
| hydrogen_container_labels_traefik_additional_response_headers_auto: | | |||||
| {{ | {{ | ||||
| {} | {} | ||||
| | combine ({'X-XSS-Protection': matrix_client_hydrogen_http_header_xss_protection} if matrix_client_hydrogen_http_header_xss_protection else {}) | |||||
| | combine ({'X-Content-Type-Options': matrix_client_hydrogen_http_header_content_type_options} if matrix_client_hydrogen_http_header_content_type_options else {}) | |||||
| | combine ({'Content-Security-Policy': matrix_client_hydrogen_http_header_content_security_policy} if matrix_client_hydrogen_http_header_content_security_policy else {}) | |||||
| | combine ({'Permission-Policy': matrix_client_hydrogen_http_header_content_permission_policy} if matrix_client_hydrogen_http_header_content_permission_policy else {}) | |||||
| | combine ({'Strict-Transport-Security': matrix_client_hydrogen_http_header_strict_transport_security} if matrix_client_hydrogen_http_header_strict_transport_security and matrix_client_hydrogen_container_labels_traefik_tls else {}) | |||||
| | combine ({'X-XSS-Protection': hydrogen_http_header_xss_protection} if hydrogen_http_header_xss_protection else {}) | |||||
| | combine ({'X-Content-Type-Options': hydrogen_http_header_content_type_options} if hydrogen_http_header_content_type_options else {}) | |||||
| | combine ({'Content-Security-Policy': hydrogen_http_header_content_security_policy} if hydrogen_http_header_content_security_policy else {}) | |||||
| | combine ({'Permission-Policy': hydrogen_http_header_content_permission_policy} if hydrogen_http_header_content_permission_policy else {}) | |||||
| | combine ({'Strict-Transport-Security': hydrogen_http_header_strict_transport_security} if hydrogen_http_header_strict_transport_security and hydrogen_container_labels_traefik_tls else {}) | |||||
| }} | }} | ||||
| matrix_client_hydrogen_container_labels_traefik_additional_response_headers_custom: {} | |||||
| hydrogen_container_labels_traefik_additional_response_headers_custom: {} | |||||
| # matrix_client_hydrogen_container_labels_additional_labels contains a multiline string with additional labels to add to the container label file. | |||||
| # hydrogen_container_labels_additional_labels contains a multiline string with additional labels to add to the container label file. | |||||
| # See `../templates/labels.j2` for details. | # See `../templates/labels.j2` for details. | ||||
| # | # | ||||
| # Example: | # Example: | ||||
| # matrix_client_hydrogen_container_labels_additional_labels: | | |||||
| # hydrogen_container_labels_additional_labels: | | |||||
| # my.label=1 | # my.label=1 | ||||
| # another.label="here" | # another.label="here" | ||||
| matrix_client_hydrogen_container_labels_additional_labels: '' | |||||
| hydrogen_container_labels_additional_labels: '' | |||||
| # A list of extra arguments to pass to the container | # A list of extra arguments to pass to the container | ||||
| matrix_client_hydrogen_container_extra_arguments: [] | |||||
| hydrogen_container_extra_arguments: [] | |||||
| # List of systemd services that matrix-client-hydrogen.service depends on | |||||
| matrix_client_hydrogen_systemd_required_services_list: "{{ [devture_systemd_docker_base_docker_service_name] if devture_systemd_docker_base_docker_service_name else [] }}" | |||||
| # List of systemd services that hydrogen.service depends on | |||||
| hydrogen_systemd_required_services_list: "{{ [devture_systemd_docker_base_docker_service_name] if devture_systemd_docker_base_docker_service_name else [] }}" | |||||
| # Specifies the value of the `X-XSS-Protection` header | # Specifies the value of the `X-XSS-Protection` header | ||||
| # Stops pages from loading when they detect reflected cross-site scripting (XSS) attacks. | # Stops pages from loading when they detect reflected cross-site scripting (XSS) attacks. | ||||
| @@ -96,23 +96,23 @@ matrix_client_hydrogen_systemd_required_services_list: "{{ [devture_systemd_dock | |||||
| # Learn more about it is here: | # Learn more about it is here: | ||||
| # - https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-XSS-Protection | # - https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-XSS-Protection | ||||
| # - https://portswigger.net/web-security/cross-site-scripting/reflected | # - https://portswigger.net/web-security/cross-site-scripting/reflected | ||||
| matrix_client_hydrogen_http_header_xss_protection: "1; mode=block" | |||||
| hydrogen_http_header_xss_protection: "1; mode=block" | |||||
| # Specifies the value of the `X-Content-Type-Options` header. | # Specifies the value of the `X-Content-Type-Options` header. | ||||
| # See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Content-Type-Options | # See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Content-Type-Options | ||||
| matrix_client_hydrogen_http_header_content_type_options: nosniff | |||||
| hydrogen_http_header_content_type_options: nosniff | |||||
| # Specifies the value of the `Content-Security-Policy` header. | # Specifies the value of the `Content-Security-Policy` header. | ||||
| # See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy | # See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy | ||||
| matrix_client_hydrogen_http_header_content_security_policy: frame-ancestors 'self' | |||||
| hydrogen_http_header_content_security_policy: frame-ancestors 'self' | |||||
| # Specifies the value of the `Permission-Policy` header. | # Specifies the value of the `Permission-Policy` header. | ||||
| # See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Permission-Policy | # See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Permission-Policy | ||||
| matrix_client_hydrogen_http_header_content_permission_policy: "{{ 'interest-cohort=()' if matrix_client_hydrogen_floc_optout_enabled else '' }}" | |||||
| hydrogen_http_header_content_permission_policy: "{{ 'interest-cohort=()' if hydrogen_floc_optout_enabled else '' }}" | |||||
| # Specifies the value of the `Strict-Transport-Security` header. | # Specifies the value of the `Strict-Transport-Security` header. | ||||
| # See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security | # See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security | ||||
| matrix_client_hydrogen_http_header_strict_transport_security: "max-age=31536000; includeSubDomains{{ '; preload' if matrix_client_hydrogen_hsts_preload_enabled else '' }}" | |||||
| hydrogen_http_header_strict_transport_security: "max-age=31536000; includeSubDomains{{ '; preload' if hydrogen_hsts_preload_enabled else '' }}" | |||||
| # Controls whether to send a "Permissions-Policy interest-cohort=();" header along with all responses | # Controls whether to send a "Permissions-Policy interest-cohort=();" header along with all responses | ||||
| # | # | ||||
| @@ -122,8 +122,8 @@ matrix_client_hydrogen_http_header_strict_transport_security: "max-age=31536000; | |||||
| # - https://amifloced.org/ | # - https://amifloced.org/ | ||||
| # | # | ||||
| # Of course, a better solution is to just stop using browsers (like Chrome), which participate in such tracking practices. | # Of course, a better solution is to just stop using browsers (like Chrome), which participate in such tracking practices. | ||||
| # See: `matrix_client_hydrogen_content_permission_policy` | |||||
| matrix_client_hydrogen_floc_optout_enabled: true | |||||
| # See: `hydrogen_content_permission_policy` | |||||
| hydrogen_floc_optout_enabled: true | |||||
| # Controls if HSTS preloading is enabled | # Controls if HSTS preloading is enabled | ||||
| # | # | ||||
| @@ -134,53 +134,53 @@ matrix_client_hydrogen_floc_optout_enabled: true | |||||
| # - https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security | # - https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security | ||||
| # - https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security | # - https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security | ||||
| # - https://hstspreload.org/#opt-in | # - https://hstspreload.org/#opt-in | ||||
| # See: `matrix_client_hydrogen_http_header_strict_transport_security` | |||||
| matrix_client_hydrogen_hsts_preload_enabled: false | |||||
| # See: `hydrogen_http_header_strict_transport_security` | |||||
| hydrogen_hsts_preload_enabled: false | |||||
| matrix_client_hydrogen_scheme: https | |||||
| hydrogen_scheme: https | |||||
| # The hostname at which Hydrogen is served. | # The hostname at which Hydrogen is served. | ||||
| matrix_client_hydrogen_hostname: "{{ matrix_server_fqn_hydrogen }}" | |||||
| hydrogen_hostname: "{{ matrix_server_fqn_hydrogen }}" | |||||
| # The path at which Hydrogen is exposed. | # The path at which Hydrogen is exposed. | ||||
| # This value must either be `/` or not end with a slash (e.g. `/hydrogen`). | # This value must either be `/` or not end with a slash (e.g. `/hydrogen`). | ||||
| matrix_client_hydrogen_path_prefix: / | |||||
| hydrogen_path_prefix: / | |||||
| # Controls whether the self-check feature should validate SSL certificates. | # Controls whether the self-check feature should validate SSL certificates. | ||||
| matrix_client_hydrogen_self_check_validate_certificates: true | |||||
| hydrogen_self_check_validate_certificates: true | |||||
| # Controls whether the access log is enabled. | # Controls whether the access log is enabled. | ||||
| matrix_client_hydrogen_access_log_enabled: true | |||||
| hydrogen_access_log_enabled: true | |||||
| # config.json | # config.json | ||||
| matrix_client_hydrogen_push: | |||||
| hydrogen_push: | |||||
| appId: io.element.hydrogen.web | appId: io.element.hydrogen.web | ||||
| gatewayUrl: https://matrix.org | gatewayUrl: https://matrix.org | ||||
| applicationServerKey: "BC-gpSdVHEXhvHSHS0AzzWrQoukv2BE7KzpoPO_FfPacqOo3l1pdqz7rSgmB04pZCWaHPz7XRe6fjLaC-WPDopM" | applicationServerKey: "BC-gpSdVHEXhvHSHS0AzzWrQoukv2BE7KzpoPO_FfPacqOo3l1pdqz7rSgmB04pZCWaHPz7XRe6fjLaC-WPDopM" | ||||
| matrix_client_hydrogen_default_hs_url: "" | |||||
| matrix_client_hydrogen_bugReportEndpointUrl: "https://element.io/bugreports/submit" # noqa var-naming | |||||
| hydrogen_default_hs_url: "" | |||||
| hydrogen_bugReportEndpointUrl: "https://element.io/bugreports/submit" # noqa var-naming | |||||
| # Default Hydrogen configuration template which covers the generic use case. | # Default Hydrogen configuration template which covers the generic use case. | ||||
| # You can customize it by controlling the various variables inside it. | # You can customize it by controlling the various variables inside it. | ||||
| # | # | ||||
| # For a more advanced customization, you can extend the default (see `matrix_client_hydrogen_configuration_extension_json`) | |||||
| # For a more advanced customization, you can extend the default (see `hydrogen_configuration_extension_json`) | |||||
| # or completely replace this variable with your own template. | # or completely replace this variable with your own template. | ||||
| # | # | ||||
| # The side-effect of this lookup is that Ansible would even parse the JSON for us, returning a dict. | # The side-effect of this lookup is that Ansible would even parse the JSON for us, returning a dict. | ||||
| # This is unlike what it does when looking up YAML template files (no automatic parsing there). | # This is unlike what it does when looking up YAML template files (no automatic parsing there). | ||||
| matrix_client_hydrogen_configuration_default: "{{ lookup('template', 'templates/config.json.j2', convert_data=False) | from_json }}" | |||||
| hydrogen_configuration_default: "{{ lookup('template', 'templates/config.json.j2', convert_data=False) | from_json }}" | |||||
| # Your custom JSON configuration for Hydrogen should go to `matrix_client_hydrogen_configuration_extension_json`. | |||||
| # This configuration extends the default starting configuration (`matrix_client_hydrogen_configuration_default`). | |||||
| # Your custom JSON configuration for Hydrogen should go to `hydrogen_configuration_extension_json`. | |||||
| # This configuration extends the default starting configuration (`hydrogen_configuration_default`). | |||||
| # | # | ||||
| # You can override individual variables from the default configuration, or introduce new ones. | # You can override individual variables from the default configuration, or introduce new ones. | ||||
| # | # | ||||
| # If you need something more special, you can take full control by | # If you need something more special, you can take full control by | ||||
| # completely redefining `matrix_client_hydrogen_configuration_default`. | |||||
| # completely redefining `hydrogen_configuration_default`. | |||||
| # | # | ||||
| # Example configuration extension follows: | # Example configuration extension follows: | ||||
| # | # | ||||
| # matrix_client_hydrogen_configuration_extension_json: | | |||||
| # hydrogen_configuration_extension_json: | | |||||
| # { | # { | ||||
| # "push": { | # "push": { | ||||
| # "appId": "io.element.hydrogen.web", | # "appId": "io.element.hydrogen.web", | ||||
| @@ -189,10 +189,10 @@ matrix_client_hydrogen_configuration_default: "{{ lookup('template', 'templates/ | |||||
| # }, | # }, | ||||
| # "defaultHomeServer": "matrix.org" | # "defaultHomeServer": "matrix.org" | ||||
| # } | # } | ||||
| matrix_client_hydrogen_configuration_extension_json: '{}' | |||||
| hydrogen_configuration_extension_json: '{}' | |||||
| matrix_client_hydrogen_configuration_extension: "{{ matrix_client_hydrogen_configuration_extension_json | from_json if matrix_client_hydrogen_configuration_extension_json | from_json is mapping else {} }}" | |||||
| hydrogen_configuration_extension: "{{ hydrogen_configuration_extension_json | from_json if hydrogen_configuration_extension_json | from_json is mapping else {} }}" | |||||
| # Holds the final Hydrogen configuration (a combination of the default and its extension). | # Holds the final Hydrogen configuration (a combination of the default and its extension). | ||||
| # You most likely don't need to touch this variable. Instead, see `matrix_client_hydrogen_configuration_default`. | |||||
| matrix_client_hydrogen_configuration: "{{ matrix_client_hydrogen_configuration_default | combine(matrix_client_hydrogen_configuration_extension, recursive=True) }}" | |||||
| # You most likely don't need to touch this variable. Instead, see `hydrogen_configuration_default`. | |||||
| hydrogen_configuration: "{{ hydrogen_configuration_default | combine(hydrogen_configuration_extension, recursive=True) }}" | |||||
| @@ -12,21 +12,21 @@ | |||||
| - install-all | - install-all | ||||
| - install-client-hydrogen | - install-client-hydrogen | ||||
| block: | block: | ||||
| - when: matrix_client_hydrogen_enabled | bool | |||||
| - when: hydrogen_enabled | bool | |||||
| ansible.builtin.include_tasks: "{{ role_path }}/tasks/validate_config.yml" | ansible.builtin.include_tasks: "{{ role_path }}/tasks/validate_config.yml" | ||||
| - when: matrix_client_hydrogen_enabled | bool | |||||
| - when: hydrogen_enabled | bool | |||||
| ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_install.yml" | ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_install.yml" | ||||
| - tags: | - tags: | ||||
| - setup-all | - setup-all | ||||
| - setup-client-hydrogen | - setup-client-hydrogen | ||||
| block: | block: | ||||
| - when: not matrix_client_hydrogen_enabled | bool | |||||
| - when: not hydrogen_enabled | bool | |||||
| ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_uninstall.yml" | ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_uninstall.yml" | ||||
| - tags: | - tags: | ||||
| - self-check | - self-check | ||||
| block: | block: | ||||
| - when: matrix_client_hydrogen_enabled | bool | |||||
| - when: hydrogen_enabled | bool | |||||
| ansible.builtin.include_tasks: "{{ role_path }}/tasks/self_check.yml" | ansible.builtin.include_tasks: "{{ role_path }}/tasks/self_check.yml" | ||||
| @@ -7,14 +7,14 @@ | |||||
| --- | --- | ||||
| - ansible.builtin.set_fact: | - ansible.builtin.set_fact: | ||||
| matrix_client_hydrogen_url_endpoint_public: "{{ matrix_client_hydrogen_scheme }}://{{ matrix_client_hydrogen_hostname }}{{ matrix_client_hydrogen_path_prefix }}/config.json" | |||||
| hydrogen_url_endpoint_public: "{{ hydrogen_scheme }}://{{ hydrogen_hostname }}{{ hydrogen_path_prefix }}/config.json" | |||||
| - name: Check Hydrogen | - name: Check Hydrogen | ||||
| ansible.builtin.uri: | ansible.builtin.uri: | ||||
| url: "{{ matrix_client_hydrogen_url_endpoint_public }}" | |||||
| url: "{{ hydrogen_url_endpoint_public }}" | |||||
| follow_redirects: none | follow_redirects: none | ||||
| validate_certs: "{{ matrix_client_hydrogen_self_check_validate_certificates }}" | |||||
| register: matrix_client_hydrogen_self_check_result | |||||
| validate_certs: "{{ hydrogen_self_check_validate_certificates }}" | |||||
| register: hydrogen_self_check_result | |||||
| check_mode: false | check_mode: false | ||||
| ignore_errors: true | ignore_errors: true | ||||
| delegate_to: 127.0.0.1 | delegate_to: 127.0.0.1 | ||||
| @@ -22,9 +22,9 @@ | |||||
| - name: Fail if Hydrogen not working | - name: Fail if Hydrogen not working | ||||
| ansible.builtin.fail: | ansible.builtin.fail: | ||||
| msg: "Failed checking Hydrogen is up at `{{ matrix_client_hydrogen_hostname }}` (checked endpoint: `{{ matrix_client_hydrogen_url_endpoint_public }}`). Is Hydrogen running? Is port 443 open in your firewall? Full error: {{ matrix_client_hydrogen_self_check_result }}" | |||||
| when: "matrix_client_hydrogen_self_check_result.failed or 'json' not in matrix_client_hydrogen_self_check_result" | |||||
| msg: "Failed checking Hydrogen is up at `{{ hydrogen_hostname }}` (checked endpoint: `{{ hydrogen_url_endpoint_public }}`). Is Hydrogen running? Is port 443 open in your firewall? Full error: {{ hydrogen_self_check_result }}" | |||||
| when: "hydrogen_self_check_result.failed or 'json' not in hydrogen_self_check_result" | |||||
| - name: Report working Hydrogen | - name: Report working Hydrogen | ||||
| ansible.builtin.debug: | ansible.builtin.debug: | ||||
| msg: "Hydrogen at `{{ matrix_client_hydrogen_hostname }}` is working (checked endpoint: `{{ matrix_client_hydrogen_url_endpoint_public }}`)" | |||||
| msg: "Hydrogen at `{{ hydrogen_hostname }}` is working (checked endpoint: `{{ hydrogen_url_endpoint_public }}`)" | |||||
| @@ -19,25 +19,25 @@ | |||||
| owner: "{{ matrix_user_name }}" | owner: "{{ matrix_user_name }}" | ||||
| group: "{{ matrix_group_name }}" | group: "{{ matrix_group_name }}" | ||||
| with_items: | with_items: | ||||
| - {path: "{{ matrix_client_hydrogen_data_path }}", when: true} | |||||
| - {path: "{{ matrix_client_hydrogen_docker_src_files_path }}", when: "{{ matrix_client_hydrogen_container_image_self_build }}"} | |||||
| - {path: "{{ hydrogen_data_path }}", when: true} | |||||
| - {path: "{{ hydrogen_docker_src_files_path }}", when: "{{ hydrogen_container_image_self_build }}"} | |||||
| when: "item.when | bool" | when: "item.when | bool" | ||||
| - when: "matrix_client_hydrogen_container_image_self_build | bool" | |||||
| - when: "hydrogen_container_image_self_build | bool" | |||||
| block: | block: | ||||
| - name: Ensure Hydrogen repository is present on self-build | - name: Ensure Hydrogen repository is present on self-build | ||||
| ansible.builtin.git: | ansible.builtin.git: | ||||
| repo: "{{ matrix_client_hydrogen_container_image_self_build_repo }}" | |||||
| dest: "{{ matrix_client_hydrogen_docker_src_files_path }}" | |||||
| version: "{{ matrix_client_hydrogen_docker_image.split(':')[1] }}" | |||||
| repo: "{{ hydrogen_container_image_self_build_repo }}" | |||||
| dest: "{{ hydrogen_docker_src_files_path }}" | |||||
| version: "{{ hydrogen_docker_image.split(':')[1] }}" | |||||
| force: "yes" | force: "yes" | ||||
| become: true | become: true | ||||
| become_user: "{{ matrix_user_name }}" | become_user: "{{ matrix_user_name }}" | ||||
| register: matrix_client_hydrogen_git_pull_results | |||||
| register: hydrogen_git_pull_results | |||||
| - name: Check if Hydrogen Docker image exists | - name: Check if Hydrogen Docker image exists | ||||
| ansible.builtin.command: "{{ devture_systemd_docker_base_host_command_docker }} images --quiet --filter 'reference={{ matrix_client_hydrogen_docker_image }}'" | |||||
| register: matrix_client_hydrogen_docker_image_check_result | |||||
| ansible.builtin.command: "{{ devture_systemd_docker_base_host_command_docker }} images --quiet --filter 'reference={{ hydrogen_docker_image }}'" | |||||
| register: hydrogen_docker_image_check_result | |||||
| changed_when: false | changed_when: false | ||||
| # Invoking the `docker build` command here, instead of calling the `docker_image` Ansible module, | # Invoking the `docker build` command here, instead of calling the `docker_image` Ansible module, | ||||
| @@ -45,24 +45,24 @@ | |||||
| # See: https://github.com/ansible-collections/community.general/issues/514 | # See: https://github.com/ansible-collections/community.general/issues/514 | ||||
| - name: Ensure Hydrogen Docker image is built | - name: Ensure Hydrogen Docker image is built | ||||
| ansible.builtin.shell: | ansible.builtin.shell: | ||||
| chdir: "{{ matrix_client_hydrogen_docker_src_files_path }}" | |||||
| chdir: "{{ hydrogen_docker_src_files_path }}" | |||||
| cmd: | | cmd: | | ||||
| {{ devture_systemd_docker_base_host_command_docker }} build \ | {{ devture_systemd_docker_base_host_command_docker }} build \ | ||||
| -t "{{ matrix_client_hydrogen_docker_image }}" \ | |||||
| -t "{{ hydrogen_docker_image }}" \ | |||||
| -f Dockerfile \ | -f Dockerfile \ | ||||
| . | . | ||||
| environment: | environment: | ||||
| DOCKER_BUILDKIT: 1 | DOCKER_BUILDKIT: 1 | ||||
| changed_when: true | changed_when: true | ||||
| when: "matrix_client_hydrogen_git_pull_results.changed | bool or matrix_client_hydrogen_docker_image_check_result.stdout == ''" | |||||
| when: "hydrogen_git_pull_results.changed | bool or hydrogen_docker_image_check_result.stdout == ''" | |||||
| - name: Ensure Hydrogen Docker image is pulled | - name: Ensure Hydrogen Docker image is pulled | ||||
| community.docker.docker_image: | community.docker.docker_image: | ||||
| name: "{{ matrix_client_hydrogen_docker_image }}" | |||||
| name: "{{ hydrogen_docker_image }}" | |||||
| source: "{{ 'pull' if ansible_version.major > 2 or ansible_version.minor > 7 else omit }}" | source: "{{ 'pull' if ansible_version.major > 2 or ansible_version.minor > 7 else omit }}" | ||||
| force_source: "{{ matrix_client_hydrogen_docker_image_force_pull if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}" | |||||
| force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else matrix_client_hydrogen_docker_image_force_pull }}" | |||||
| when: "not matrix_client_hydrogen_container_image_self_build | bool" | |||||
| force_source: "{{ hydrogen_docker_image_force_pull if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}" | |||||
| force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else hydrogen_docker_image_force_pull }}" | |||||
| when: "not hydrogen_container_image_self_build | bool" | |||||
| register: result | register: result | ||||
| retries: "{{ devture_playbook_help_container_retries_count }}" | retries: "{{ devture_playbook_help_container_retries_count }}" | ||||
| delay: "{{ devture_playbook_help_container_retries_delay }}" | delay: "{{ devture_playbook_help_container_retries_delay }}" | ||||
| @@ -70,8 +70,8 @@ | |||||
| - name: Ensure Hydrogen configuration installed | - name: Ensure Hydrogen configuration installed | ||||
| ansible.builtin.copy: | ansible.builtin.copy: | ||||
| content: "{{ matrix_client_hydrogen_configuration | to_nice_json }}" | |||||
| dest: "{{ matrix_client_hydrogen_data_path }}/config.json" | |||||
| content: "{{ hydrogen_configuration | to_nice_json }}" | |||||
| dest: "{{ hydrogen_data_path }}/config.json" | |||||
| mode: 0644 | mode: 0644 | ||||
| owner: "{{ matrix_user_name }}" | owner: "{{ matrix_user_name }}" | ||||
| group: "{{ matrix_group_name }}" | group: "{{ matrix_group_name }}" | ||||
| @@ -79,7 +79,7 @@ | |||||
| - name: Ensure Hydrogen additional config files installed | - name: Ensure Hydrogen additional config files installed | ||||
| ansible.builtin.template: | ansible.builtin.template: | ||||
| src: "{{ item.src }}" | src: "{{ item.src }}" | ||||
| dest: "{{ matrix_client_hydrogen_data_path }}/{{ item.name }}" | |||||
| dest: "{{ hydrogen_data_path }}/{{ item.name }}" | |||||
| mode: 0644 | mode: 0644 | ||||
| owner: "{{ matrix_user_name }}" | owner: "{{ matrix_user_name }}" | ||||
| group: "{{ matrix_group_name }}" | group: "{{ matrix_group_name }}" | ||||
| @@ -90,12 +90,12 @@ | |||||
| - name: Ensure Hydrogen container network is created | - name: Ensure Hydrogen container network is created | ||||
| community.general.docker_network: | community.general.docker_network: | ||||
| enable_ipv6: "{{ devture_systemd_docker_base_ipv6_enabled }}" | enable_ipv6: "{{ devture_systemd_docker_base_ipv6_enabled }}" | ||||
| name: "{{ matrix_client_hydrogen_container_network }}" | |||||
| name: "{{ hydrogen_container_network }}" | |||||
| driver: bridge | driver: bridge | ||||
| driver_options: "{{ devture_systemd_docker_base_container_networks_driver_options }}" | driver_options: "{{ devture_systemd_docker_base_container_networks_driver_options }}" | ||||
| - name: Ensure matrix-client-hydrogen.service installed | |||||
| - name: Ensure hydrogen.service installed | |||||
| ansible.builtin.template: | ansible.builtin.template: | ||||
| src: "{{ role_path }}/templates/systemd/matrix-client-hydrogen.service.j2" | |||||
| dest: "{{ devture_systemd_docker_base_systemd_path }}/matrix-client-hydrogen.service" | |||||
| src: "{{ role_path }}/templates/systemd/hydrogen.service.j2" | |||||
| dest: "{{ devture_systemd_docker_base_systemd_path }}/hydrogen.service" | |||||
| mode: 0644 | mode: 0644 | ||||
| @@ -6,26 +6,26 @@ | |||||
| --- | --- | ||||
| - name: Check existence of matrix-client-hydrogen.service | |||||
| - name: Check existence of hydrogen.service | |||||
| ansible.builtin.stat: | ansible.builtin.stat: | ||||
| path: "{{ devture_systemd_docker_base_systemd_path }}/matrix-client-hydrogen.service" | |||||
| register: matrix_client_hydrogen_service_stat | |||||
| path: "{{ devture_systemd_docker_base_systemd_path }}/hydrogen.service" | |||||
| register: hydrogen_service_stat | |||||
| - when: matrix_client_hydrogen_service_stat.stat.exists | bool | |||||
| - when: hydrogen_service_stat.stat.exists | bool | |||||
| block: | block: | ||||
| - name: Ensure matrix-client-hydrogen is stopped | |||||
| - name: Ensure hydrogen is stopped | |||||
| ansible.builtin.service: | ansible.builtin.service: | ||||
| name: matrix-client-hydrogen | |||||
| name: hydrogen | |||||
| state: stopped | state: stopped | ||||
| enabled: false | enabled: false | ||||
| daemon_reload: true | daemon_reload: true | ||||
| - name: Ensure matrix-client-hydrogen.service doesn't exist | |||||
| - name: Ensure hydrogen.service doesn't exist | |||||
| ansible.builtin.file: | ansible.builtin.file: | ||||
| path: "{{ devture_systemd_docker_base_systemd_path }}/matrix-client-hydrogen.service" | |||||
| path: "{{ devture_systemd_docker_base_systemd_path }}/hydrogen.service" | |||||
| state: absent | state: absent | ||||
| - name: Ensure Hydrogen paths doesn't exist | - name: Ensure Hydrogen paths doesn't exist | ||||
| ansible.builtin.file: | ansible.builtin.file: | ||||
| path: "{{ matrix_client_hydrogen_data_path }}" | |||||
| path: "{{ hydrogen_data_path }}" | |||||
| state: absent | state: absent | ||||
| @@ -12,9 +12,9 @@ | |||||
| You need to define a required configuration setting (`{{ item }}`) to use Hydrogen. | You need to define a required configuration setting (`{{ item }}`) to use Hydrogen. | ||||
| when: "item.when | bool and lookup('vars', item.name, default='') | string | length == 0" | when: "item.when | bool and lookup('vars', item.name, default='') | string | length == 0" | ||||
| with_items: | with_items: | ||||
| - {'name': 'matrix_client_hydrogen_default_hs_url', when: "{{ matrix_client_hydrogen_container_image_self_build }}"} | |||||
| - {'name': 'matrix_client_hydrogen_container_network', when: true} | |||||
| - {'name': 'matrix_client_hydrogen_container_labels_traefik_compression_middleware_name', when: "{{ matrix_client_hydrogen_container_labels_traefik_compression_middleware_enabled }}"} | |||||
| - {'name': 'hydrogen_default_hs_url', when: "{{ hydrogen_container_image_self_build }}"} | |||||
| - {'name': 'hydrogen_container_network', when: true} | |||||
| - {'name': 'hydrogen_container_labels_traefik_compression_middleware_name', when: "{{ hydrogen_container_labels_traefik_compression_middleware_enabled }}"} | |||||
| - name: (Deprecation) Catch and report renamed Hydrogen variables | - name: (Deprecation) Catch and report renamed Hydrogen variables | ||||
| ansible.builtin.fail: | ansible.builtin.fail: | ||||
| @@ -22,24 +22,24 @@ | |||||
| The variable `{{ item.old }}` is deprecated. Please use `{{ item.new }}` instead. | The variable `{{ item.old }}` is deprecated. Please use `{{ item.new }}` instead. | ||||
| when: "lookup('ansible.builtin.varnames', ('^' + item.old + '$'), wantlist=True) | length > 0" | when: "lookup('ansible.builtin.varnames', ('^' + item.old + '$'), wantlist=True) | length > 0" | ||||
| with_items: | with_items: | ||||
| - {'old': 'matrix_client_hydrogen_container_image_name_prefix', 'new': 'matrix_client_hydrogen_container_image_registry_prefix'} | |||||
| - {'old': 'hydrogen_container_image_name_prefix', 'new': 'hydrogen_container_image_registry_prefix'} | |||||
| - when: matrix_client_hydrogen_container_labels_traefik_enabled | bool | |||||
| - when: hydrogen_container_labels_traefik_enabled | bool | |||||
| block: | block: | ||||
| - name: Fail if required matrix-client-hydrogen Traefik settings not defined | |||||
| - name: Fail if required hydrogen Traefik settings not defined | |||||
| ansible.builtin.fail: | ansible.builtin.fail: | ||||
| msg: >- | msg: >- | ||||
| You need to define a required configuration setting (`{{ item }}`). | You need to define a required configuration setting (`{{ item }}`). | ||||
| when: "lookup('vars', item, default='') == ''" | when: "lookup('vars', item, default='') == ''" | ||||
| with_items: | with_items: | ||||
| - matrix_client_hydrogen_container_labels_traefik_hostname | |||||
| - matrix_client_hydrogen_container_labels_traefik_path_prefix | |||||
| - hydrogen_container_labels_traefik_hostname | |||||
| - hydrogen_container_labels_traefik_path_prefix | |||||
| # We ensure it doesn't end with a slash, because we handle both (slash and no-slash). | # We ensure it doesn't end with a slash, because we handle both (slash and no-slash). | ||||
| # Knowing that `matrix_client_hydrogen_container_labels_traefik_path_prefix` does not end with a slash | |||||
| # Knowing that `hydrogen_container_labels_traefik_path_prefix` does not end with a slash | |||||
| # ensures we know how to set these routes up without having to do "does it end with a slash" checks elsewhere. | # ensures we know how to set these routes up without having to do "does it end with a slash" checks elsewhere. | ||||
| - name: Fail if matrix_client_hydrogen_container_labels_traefik_path_prefix ends with a slash | |||||
| - name: Fail if hydrogen_container_labels_traefik_path_prefix ends with a slash | |||||
| ansible.builtin.fail: | ansible.builtin.fail: | ||||
| msg: >- | msg: >- | ||||
| matrix_client_hydrogen_container_labels_traefik_path_prefix (`{{ matrix_client_hydrogen_container_labels_traefik_path_prefix }}`) must either be `/` or not end with a slash (e.g. `/hydrogen`). | |||||
| when: "matrix_client_hydrogen_container_labels_traefik_path_prefix != '/' and matrix_client_hydrogen_container_labels_traefik_path_prefix[-1] == '/'" | |||||
| hydrogen_container_labels_traefik_path_prefix (`{{ hydrogen_container_labels_traefik_path_prefix }}`) must either be `/` or not end with a slash (e.g. `/hydrogen`). | |||||
| when: "hydrogen_container_labels_traefik_path_prefix != '/' and hydrogen_container_labels_traefik_path_prefix[-1] == '/'" | |||||
| @@ -1,9 +1,9 @@ | |||||
| { | { | ||||
| "push": {{ matrix_client_hydrogen_push | to_json }}, | |||||
| "defaultHomeServer": {{ matrix_client_hydrogen_default_hs_url | string | to_json }}, | |||||
| "bugReportEndpointUrl": {{ matrix_client_hydrogen_bugReportEndpointUrl | to_json }}, | |||||
| "push": {{ hydrogen_push | to_json }}, | |||||
| "defaultHomeServer": {{ hydrogen_default_hs_url | string | to_json }}, | |||||
| "bugReportEndpointUrl": {{ hydrogen_bugReportEndpointUrl | to_json }}, | |||||
| "themeManifests": [ | "themeManifests": [ | ||||
| "{{ '' if matrix_client_hydrogen_path_prefix == '/' else matrix_client_hydrogen_path_prefix }}/assets/theme-element.json" | |||||
| "{{ '' if hydrogen_path_prefix == '/' else hydrogen_path_prefix }}/assets/theme-element.json" | |||||
| ], | ], | ||||
| "defaultTheme": { | "defaultTheme": { | ||||
| "light": "element-light", | "light": "element-light", | ||||
| @@ -4,53 +4,53 @@ SPDX-FileCopyrightText: 2023 - 2024 Slavi Pantaleev | |||||
| SPDX-License-Identifier: AGPL-3.0-or-later | SPDX-License-Identifier: AGPL-3.0-or-later | ||||
| #} | #} | ||||
| {% if matrix_client_hydrogen_container_labels_traefik_enabled %} | |||||
| {% if hydrogen_container_labels_traefik_enabled %} | |||||
| traefik.enable=true | traefik.enable=true | ||||
| {% if matrix_client_hydrogen_container_labels_traefik_docker_network %} | |||||
| traefik.docker.network={{ matrix_client_hydrogen_container_labels_traefik_docker_network }} | |||||
| {% if hydrogen_container_labels_traefik_docker_network %} | |||||
| traefik.docker.network={{ hydrogen_container_labels_traefik_docker_network }} | |||||
| {% endif %} | {% endif %} | ||||
| traefik.http.services.matrix-client-hydrogen.loadbalancer.server.port=8080 | |||||
| traefik.http.services.hydrogen.loadbalancer.server.port=8080 | |||||
| {% set middlewares = [] %} | {% set middlewares = [] %} | ||||
| {% if matrix_client_hydrogen_container_labels_traefik_compression_middleware_enabled %} | |||||
| {% set middlewares = middlewares + [matrix_client_hydrogen_container_labels_traefik_compression_middleware_name] %} | |||||
| {% if hydrogen_container_labels_traefik_compression_middleware_enabled %} | |||||
| {% set middlewares = middlewares + [hydrogen_container_labels_traefik_compression_middleware_name] %} | |||||
| {% endif %} | {% endif %} | ||||
| {% if matrix_client_hydrogen_container_labels_traefik_path_prefix != '/' %} | |||||
| traefik.http.middlewares.matrix-client-hydrogen-slashless-redirect.redirectregex.regex=({{ matrix_client_hydrogen_container_labels_traefik_path_prefix | quote }})$ | |||||
| traefik.http.middlewares.matrix-client-hydrogen-slashless-redirect.redirectregex.replacement=${1}/ | |||||
| {% set middlewares = middlewares + ['matrix-client-hydrogen-slashless-redirect'] %} | |||||
| {% if hydrogen_container_labels_traefik_path_prefix != '/' %} | |||||
| traefik.http.middlewares.hydrogen-slashless-redirect.redirectregex.regex=({{ hydrogen_container_labels_traefik_path_prefix | quote }})$ | |||||
| traefik.http.middlewares.hydrogen-slashless-redirect.redirectregex.replacement=${1}/ | |||||
| {% set middlewares = middlewares + ['hydrogen-slashless-redirect'] %} | |||||
| {% endif %} | {% endif %} | ||||
| {% if matrix_client_hydrogen_container_labels_traefik_path_prefix != '/' %} | |||||
| traefik.http.middlewares.matrix-client-hydrogen-strip-prefix.stripprefix.prefixes={{ matrix_client_hydrogen_container_labels_traefik_path_prefix }} | |||||
| {% set middlewares = middlewares + ['matrix-client-hydrogen-strip-prefix'] %} | |||||
| {% if hydrogen_container_labels_traefik_path_prefix != '/' %} | |||||
| traefik.http.middlewares.hydrogen-strip-prefix.stripprefix.prefixes={{ hydrogen_container_labels_traefik_path_prefix }} | |||||
| {% set middlewares = middlewares + ['hydrogen-strip-prefix'] %} | |||||
| {% endif %} | {% endif %} | ||||
| {% if matrix_client_hydrogen_container_labels_traefik_additional_response_headers.keys() | length > 0 %} | |||||
| {% for name, value in matrix_client_hydrogen_container_labels_traefik_additional_response_headers.items() %} | |||||
| traefik.http.middlewares.matrix-client-hydrogen-add-headers.headers.customresponseheaders.{{ name }}={{ value }} | |||||
| {% if hydrogen_container_labels_traefik_additional_response_headers.keys() | length > 0 %} | |||||
| {% for name, value in hydrogen_container_labels_traefik_additional_response_headers.items() %} | |||||
| traefik.http.middlewares.hydrogen-add-headers.headers.customresponseheaders.{{ name }}={{ value }} | |||||
| {% endfor %} | {% endfor %} | ||||
| {% set middlewares = middlewares + ['matrix-client-hydrogen-add-headers'] %} | |||||
| {% set middlewares = middlewares + ['hydrogen-add-headers'] %} | |||||
| {% endif %} | {% endif %} | ||||
| traefik.http.routers.matrix-client-hydrogen.rule={{ matrix_client_hydrogen_container_labels_traefik_rule }} | |||||
| {% if matrix_client_hydrogen_container_labels_traefik_priority | int > 0 %} | |||||
| traefik.http.routers.matrix-client-hydrogen.priority={{ matrix_client_hydrogen_container_labels_traefik_priority }} | |||||
| traefik.http.routers.hydrogen.rule={{ hydrogen_container_labels_traefik_rule }} | |||||
| {% if hydrogen_container_labels_traefik_priority | int > 0 %} | |||||
| traefik.http.routers.hydrogen.priority={{ hydrogen_container_labels_traefik_priority }} | |||||
| {% endif %} | {% endif %} | ||||
| traefik.http.routers.matrix-client-hydrogen.service=matrix-client-hydrogen | |||||
| traefik.http.routers.hydrogen.service=hydrogen | |||||
| {% if middlewares | length > 0 %} | {% if middlewares | length > 0 %} | ||||
| traefik.http.routers.matrix-client-hydrogen.middlewares={{ middlewares | join(',') }} | |||||
| traefik.http.routers.hydrogen.middlewares={{ middlewares | join(',') }} | |||||
| {% endif %} | {% endif %} | ||||
| traefik.http.routers.matrix-client-hydrogen.entrypoints={{ matrix_client_hydrogen_container_labels_traefik_entrypoints }} | |||||
| traefik.http.routers.matrix-client-hydrogen.tls={{ matrix_client_hydrogen_container_labels_traefik_tls | to_json }} | |||||
| {% if matrix_client_hydrogen_container_labels_traefik_tls %} | |||||
| traefik.http.routers.matrix-client-hydrogen.tls.certResolver={{ matrix_client_hydrogen_container_labels_traefik_tls_certResolver }} | |||||
| traefik.http.routers.hydrogen.entrypoints={{ hydrogen_container_labels_traefik_entrypoints }} | |||||
| traefik.http.routers.hydrogen.tls={{ hydrogen_container_labels_traefik_tls | to_json }} | |||||
| {% if hydrogen_container_labels_traefik_tls %} | |||||
| traefik.http.routers.hydrogen.tls.certResolver={{ hydrogen_container_labels_traefik_tls_certResolver }} | |||||
| {% endif %} | {% endif %} | ||||
| {% endif %} | {% endif %} | ||||
| {{ matrix_client_hydrogen_container_labels_additional_labels }} | |||||
| {{ hydrogen_container_labels_additional_labels }} | |||||
| @@ -35,7 +35,7 @@ http { | |||||
| '$status $body_bytes_sent "$http_referer" ' | '$status $body_bytes_sent "$http_referer" ' | ||||
| '"$http_user_agent" "$http_x_forwarded_for"'; | '"$http_user_agent" "$http_x_forwarded_for"'; | ||||
| {% if matrix_client_hydrogen_access_log_enabled %} | |||||
| {% if hydrogen_access_log_enabled %} | |||||
| access_log /var/log/nginx/access.log main; | access_log /var/log/nginx/access.log main; | ||||
| {% else %} | {% else %} | ||||
| access_log off; | access_log off; | ||||
| @@ -1,7 +1,7 @@ | |||||
| #jinja2: lstrip_blocks: True | #jinja2: lstrip_blocks: True | ||||
| [Unit] | [Unit] | ||||
| Description=Matrix Hydrogen Client | Description=Matrix Hydrogen Client | ||||
| {% for service in matrix_client_hydrogen_systemd_required_services_list %} | |||||
| {% for service in hydrogen_systemd_required_services_list %} | |||||
| Requires={{ service }} | Requires={{ service }} | ||||
| After={{ service }} | After={{ service }} | ||||
| {% endfor %} | {% endfor %} | ||||
| @@ -10,41 +10,41 @@ DefaultDependencies=no | |||||
| [Service] | [Service] | ||||
| Type=simple | Type=simple | ||||
| Environment="HOME={{ devture_systemd_docker_base_systemd_unit_home_path }}" | Environment="HOME={{ devture_systemd_docker_base_systemd_unit_home_path }}" | ||||
| ExecStartPre=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} stop -t {{ devture_systemd_docker_base_container_stop_grace_time_seconds }} matrix-client-hydrogen 2>/dev/null || true' | |||||
| ExecStartPre=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} rm matrix-client-hydrogen 2>/dev/null || true' | |||||
| ExecStartPre=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} stop -t {{ devture_systemd_docker_base_container_stop_grace_time_seconds }} hydrogen 2>/dev/null || true' | |||||
| ExecStartPre=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} rm hydrogen 2>/dev/null || true' | |||||
| ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} create \ | ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} create \ | ||||
| --rm \ | --rm \ | ||||
| --name=matrix-client-hydrogen \ | |||||
| --name=hydrogen \ | |||||
| --log-driver=none \ | --log-driver=none \ | ||||
| --user={{ matrix_user_uid }}:{{ matrix_user_gid }} \ | --user={{ matrix_user_uid }}:{{ matrix_user_gid }} \ | ||||
| --cap-drop=ALL \ | --cap-drop=ALL \ | ||||
| --read-only \ | --read-only \ | ||||
| --network={{ matrix_client_hydrogen_container_network }} \ | |||||
| {% if matrix_client_hydrogen_container_http_host_bind_port %} | |||||
| -p {{ matrix_client_hydrogen_container_http_host_bind_port }}:8080 \ | |||||
| --network={{ hydrogen_container_network }} \ | |||||
| {% if hydrogen_container_http_host_bind_port %} | |||||
| -p {{ hydrogen_container_http_host_bind_port }}:8080 \ | |||||
| {% endif %} | {% endif %} | ||||
| --label-file={{ matrix_client_hydrogen_data_path }}/labels \ | |||||
| --label-file={{ hydrogen_data_path }}/labels \ | |||||
| --tmpfs=/tmp:rw,noexec,nosuid,size=10m \ | --tmpfs=/tmp:rw,noexec,nosuid,size=10m \ | ||||
| --mount type=bind,src={{ matrix_client_hydrogen_data_path }}/nginx.conf,dst=/etc/nginx/nginx.conf,ro \ | |||||
| --mount type=bind,src={{ matrix_client_hydrogen_data_path }}/config.json,dst=/config.json.bundled,ro \ | |||||
| {% for arg in matrix_client_hydrogen_container_extra_arguments %} | |||||
| --mount type=bind,src={{ hydrogen_data_path }}/nginx.conf,dst=/etc/nginx/nginx.conf,ro \ | |||||
| --mount type=bind,src={{ hydrogen_data_path }}/config.json,dst=/config.json.bundled,ro \ | |||||
| {% for arg in hydrogen_container_extra_arguments %} | |||||
| {{ arg }} \ | {{ arg }} \ | ||||
| {% endfor %} | {% endfor %} | ||||
| {{ matrix_client_hydrogen_docker_image }} | |||||
| {{ hydrogen_docker_image }} | |||||
| {% for network in matrix_client_hydrogen_container_additional_networks %} | |||||
| ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} network connect {{ network }} matrix-client-hydrogen | |||||
| {% for network in hydrogen_container_additional_networks %} | |||||
| ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} network connect {{ network }} hydrogen | |||||
| {% endfor %} | {% endfor %} | ||||
| ExecStart={{ devture_systemd_docker_base_host_command_docker }} start --attach matrix-client-hydrogen | |||||
| ExecStart={{ devture_systemd_docker_base_host_command_docker }} start --attach hydrogen | |||||
| ExecStop=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} stop -t {{ devture_systemd_docker_base_container_stop_grace_time_seconds }} matrix-client-hydrogen 2>/dev/null || true' | |||||
| ExecStop=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} rm matrix-client-hydrogen 2>/dev/null || true' | |||||
| ExecStop=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} stop -t {{ devture_systemd_docker_base_container_stop_grace_time_seconds }} hydrogen 2>/dev/null || true' | |||||
| ExecStop=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} rm hydrogen 2>/dev/null || true' | |||||
| Restart=always | Restart=always | ||||
| RestartSec=30 | RestartSec=30 | ||||
| SyslogIdentifier=matrix-client-hydrogen | |||||
| SyslogIdentifier=hydrogen | |||||
| [Install] | [Install] | ||||
| WantedBy=multi-user.target | WantedBy=multi-user.target | ||||
| @@ -600,6 +600,19 @@ | |||||
| The following variables in your configuration need to be renamed: {{ lookup('ansible.builtin.varnames', '^matrix_client_cinny_.+', wantlist=True) | join(', ') }} | The following variables in your configuration need to be renamed: {{ lookup('ansible.builtin.varnames', '^matrix_client_cinny_.+', wantlist=True) | join(', ') }} | ||||
| when: "lookup('ansible.builtin.varnames', '^matrix_client_cinny_.+', wantlist=True) | length > 0" | when: "lookup('ansible.builtin.varnames', '^matrix_client_cinny_.+', wantlist=True) | length > 0" | ||||
| - name: (Deprecation) Catch and report matrix-client-hydrogen variables | |||||
| ansible.builtin.fail: | |||||
| msg: |- | |||||
| The matrix-client-hydrogen role in the playbook now lives under the MASH organization (https://github.com/mother-of-all-self-hosting/ansible-role-hydrogen). | |||||
| The new role is pretty much the same, but uses differently named variables. | |||||
| Please rename all `matrix_client_hydrogen_`-prefixed variables (`matrix_client_hydrogen_*` -> `hydrogen_*`) on your configuration file (vars.yml). | |||||
| After renaming them, please do not forget to fetch the Ansible role. See docs/maintenance-upgrading-services.md for details about how to do so. | |||||
| The following variables in your configuration need to be renamed: {{ lookup('ansible.builtin.varnames', '^matrix_client_hydrogen_.+', wantlist=True) | join(', ') }} | |||||
| when: "lookup('ansible.builtin.varnames', '^matrix_client_hydrogen_.+', wantlist=True) | length > 0" | |||||
| - name: (Deprecation) Catch and report matrix-coturn variables | - name: (Deprecation) Catch and report matrix-coturn variables | ||||
| ansible.builtin.fail: | ansible.builtin.fail: | ||||
| msg: |- | msg: |- | ||||