diff --git a/.github/workflows/matrix.yml b/.github/workflows/matrix.yml index f38ae3525..d10ebec57 100644 --- a/.github/workflows/matrix.yml +++ b/.github/workflows/matrix.yml @@ -11,7 +11,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Check out - uses: actions/checkout@v3 + uses: actions/checkout@v4 - name: Run yamllint uses: frenck/action-yamllint@v1.4.1 ansible-lint: @@ -19,7 +19,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Check out - uses: actions/checkout@v3 + uses: actions/checkout@v4 - name: Run ansible-lint uses: ansible-community/ansible-lint-action@v6.17.0 with: diff --git a/CHANGELOG.md b/CHANGELOG.md index 587e47617..2430fa991 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,3 +1,12 @@ +# 2023-08-31 + +## SchildiChat support + +Thanks to [Aine](https://gitlab.com/etke.cc) of [etke.cc](https://etke.cc/), the playbook can now set up the [SchildiChat](https://github.com/SchildiChat/schildichat-desktop) client. + +See our [Configuring SchildiChat](docs/configuring-playbook-client-schildichat.md) documentation to get started. + + # 2023-08-23 ## mautrix-wsproxy support @@ -396,7 +405,7 @@ Additional details are available in the [Authenticate using Matrix OpenID (Auth- ## Draupnir moderation tool (bot) support -Thanks to [FSG-Cat](https://github.com/FSG-Cat), the playbook can now install and configure the [Draupnir](https://github.com/Gnuxie/Draupnir) moderation tool (bot). Draupnir is a fork of [Mjolnir](docs/configuring-playbook-bot-mjolnir.md) (which the playbook has supported for a long time) maintained by Mjolnir's former lead developer. +Thanks to [FSG-Cat](https://github.com/FSG-Cat), the playbook can now install and configure the [Draupnir](https://github.com/the-draupnir-project/Draupnir) moderation tool (bot). Draupnir is a fork of [Mjolnir](docs/configuring-playbook-bot-mjolnir.md) (which the playbook has supported for a long time) maintained by Mjolnir's former lead developer. Additional details are available in [Setting up Draupnir](docs/configuring-playbook-bot-draupnir.md). diff --git a/README.md b/README.md index 71d46f822..42f540c71 100644 --- a/README.md +++ b/README.md @@ -47,9 +47,10 @@ Web clients for matrix that you can host on your own domains. | Name | Default? | Description | Documentation | | ---- | -------- | ----------- | ------------- | -[Element](https://app.element.io/) | ✓ | Web UI, which is configured to connect to your own Synapse server by default | [Link](docs/configuring-playbook-client-element.md) | -| [Hydrogen](https://github.com/vector-im/hydrogen-web) | x | Web client | [Link](docs/configuring-playbook-client-hydrogen.md) | -| [Cinny](https://github.com/ajbura/cinny) | x | Web client | [Link](docs/configuring-playbook-client-cinny.md) | +| [Element](https://app.element.io/) | ✓ | Web UI, which is configured to connect to your own Synapse server by default | [Link](docs/configuring-playbook-client-element.md) | +| [Hydrogen](https://github.com/vector-im/hydrogen-web) | x | Lightweight matrix client with legacy and mobile browser support | [Link](docs/configuring-playbook-client-hydrogen.md) | +| [Cinny](https://github.com/ajbura/cinny) | x | Simple, elegant and secure web client | [Link](docs/configuring-playbook-client-cinny.md) | +| [SchildiChat](https://schildi.chat/) | x | Based on Element, with a more traditional instant messaging experience | [Link](docs/configuring-playbook-client-schildichat.md) | @@ -100,33 +101,33 @@ Bridges can be used to connect your matrix installation with third-party communi | Name | Default? | Description | Documentation | | ---- | -------- | ----------- | ------------- | -| [mautrix-discord](https://github.com/mautrix/discord) | x | Bridge for bridging your Matrix server to [Discord](https://discord.com/) | [Link](docs/configuring-playbook-bridge-mautrix-discord.md) | -| [mautrix-slack](https://github.com/mautrix/slack) | x | Bridge for bridging your Matrix server to [Slack](https://slack.com/) | [Link](docs/configuring-playbook-bridge-mautrix-slack.md) | -| [mautrix-telegram](https://github.com/mautrix/telegram) | x | Bridge for bridging your Matrix server to [Telegram](https://telegram.org/) | [Link](docs/configuring-playbook-bridge-mautrix-telegram.md) | -| [mautrix-gmessages](https://github.com/mautrix/gmessages) | x | Bridge for bridging your Matrix server to [Google Messages](https://messages.google.com/) | [Link](docs/configuring-playbook-bridge-mautrix-gmessages.md) | -| [mautrix-whatsapp](https://github.com/mautrix/whatsapp) | x | Bridge for bridging your Matrix server to [WhatsApp](https://www.whatsapp.com/) | [Link](docs/configuring-playbook-bridge-mautrix-whatsapp.md) | -| [mautrix-facebook](https://github.com/mautrix/facebook) | x | Bridge for bridging your Matrix server to [Facebook](https://facebook.com/) | [Link](docs/configuring-playbook-bridge-mautrix-facebook.md) | -| [mautrix-twitter](https://github.com/mautrix/twitter) | x | Bridge for bridging your Matrix server to [Twitter](https://twitter.com/) | [Link](docs/configuring-playbook-bridge-mautrix-twitter.md) | -| [mautrix-hangouts](https://github.com/mautrix/hangouts) | x | Bridge for bridging your Matrix server to [Google Hangouts](https://en.wikipedia.org/wiki/Google_Hangouts) | [Link](docs/configuring-playbook-bridge-mautrix-hangouts.md) | -| [mautrix-googlechat](https://github.com/mautrix/googlechat) | x | Bridge for bridging your Matrix server to [Google Chat](https://en.wikipedia.org/wiki/Google_Chat) | [Link](docs/configuring-playbook-bridge-mautrix-googlechat.md) | -| [mautrix-instagram](https://github.com/mautrix/instagram) | x | Bridge for bridging your Matrix server to [Instagram](https://instagram.com/) | [Link](docs/configuring-playbook-bridge-mautrix-instagram.md) | -| [mautrix-signal](https://github.com/mautrix/signal) | x | Bridge for bridging your Matrix server to [Signal](https://www.signal.org/) | [Link](docs/configuring-playbook-bridge-mautrix-signal.md) | -| [beeper-linkedin](https://github.com/beeper/linkedin) | x | Bridge for bridging your Matrix server to [LinkedIn](https://www.linkedin.com/) | [Link](docs/configuring-playbook-bridge-beeper-linkedin.md) | -| [matrix-appservice-irc](https://github.com/matrix-org/matrix-appservice-irc) | x | Bridge for bridging your Matrix server to [IRC](https://wikipedia.org/wiki/Internet_Relay_Chat) | [Link](docs/configuring-playbook-bridge-appservice-irc.md) | -| [matrix-appservice-discord](https://github.com/Half-Shot/matrix-appservice-discord) | x | Bridge for bridging your Matrix server to [Discord](https://discordapp.com/) | [Link](docs/configuring-playbook-bridge-appservice-discord.md) | -| [matrix-appservice-slack](https://github.com/matrix-org/matrix-appservice-slack) | x | Bridge for bridging your Matrix server to [Slack](https://slack.com/) | [Link](docs/configuring-playbook-bridge-appservice-slack.md) | +| [mautrix-discord](https://github.com/mautrix/discord) | x | Bridge to [Discord](https://discord.com/) | [Link](docs/configuring-playbook-bridge-mautrix-discord.md) | +| [mautrix-slack](https://github.com/mautrix/slack) | x | Bridge to [Slack](https://slack.com/) | [Link](docs/configuring-playbook-bridge-mautrix-slack.md) | +| [mautrix-telegram](https://github.com/mautrix/telegram) | x | Bridge to [Telegram](https://telegram.org/) | [Link](docs/configuring-playbook-bridge-mautrix-telegram.md) | +| [mautrix-gmessages](https://github.com/mautrix/gmessages) | x | Bridge to [Google Messages](https://messages.google.com/) | [Link](docs/configuring-playbook-bridge-mautrix-gmessages.md) | +| [mautrix-whatsapp](https://github.com/mautrix/whatsapp) | x | Bridge to [WhatsApp](https://www.whatsapp.com/) | [Link](docs/configuring-playbook-bridge-mautrix-whatsapp.md) | +| [mautrix-facebook](https://github.com/mautrix/facebook) | x | Bridge to [Facebook](https://facebook.com/) | [Link](docs/configuring-playbook-bridge-mautrix-facebook.md) | +| [mautrix-twitter](https://github.com/mautrix/twitter) | x | Bridge to [Twitter](https://twitter.com/) | [Link](docs/configuring-playbook-bridge-mautrix-twitter.md) | +| [mautrix-hangouts](https://github.com/mautrix/hangouts) | x | Bridge to [Google Hangouts](https://en.wikipedia.org/wiki/Google_Hangouts) | [Link](docs/configuring-playbook-bridge-mautrix-hangouts.md) | +| [mautrix-googlechat](https://github.com/mautrix/googlechat) | x | Bridge to [Google Chat](https://en.wikipedia.org/wiki/Google_Chat) | [Link](docs/configuring-playbook-bridge-mautrix-googlechat.md) | +| [mautrix-instagram](https://github.com/mautrix/instagram) | x | Bridge to [Instagram](https://instagram.com/) | [Link](docs/configuring-playbook-bridge-mautrix-instagram.md) | +| [mautrix-signal](https://github.com/mautrix/signal) | x | Bridge to [Signal](https://www.signal.org/) | [Link](docs/configuring-playbook-bridge-mautrix-signal.md) | +| [beeper-linkedin](https://github.com/beeper/linkedin) | x | Bridge to [LinkedIn](https://www.linkedin.com/) | [Link](docs/configuring-playbook-bridge-beeper-linkedin.md) | +| [matrix-appservice-irc](https://github.com/matrix-org/matrix-appservice-irc) | x | Bridge to [IRC](https://wikipedia.org/wiki/Internet_Relay_Chat) | [Link](docs/configuring-playbook-bridge-appservice-irc.md) | +| [matrix-appservice-discord](https://github.com/Half-Shot/matrix-appservice-discord) | x | Bridge to [Discord](https://discordapp.com/) | [Link](docs/configuring-playbook-bridge-appservice-discord.md) | +| [matrix-appservice-slack](https://github.com/matrix-org/matrix-appservice-slack) | x | Bridge to [Slack](https://slack.com/) | [Link](docs/configuring-playbook-bridge-appservice-slack.md) | | [matrix-appservice-webhooks](https://github.com/turt2live/matrix-appservice-webhooks) | x | Bridge for slack compatible webhooks ([ConcourseCI](https://concourse-ci.org/), [Slack](https://slack.com/) etc. pp.) | [Link](docs/configuring-playbook-bridge-appservice-webhooks.md) | -| [matrix-hookshot](https://github.com/Half-Shot/matrix-hookshot) | x | Bridge for bridging Matrix to generic webhooks and multiple project management services, such as GitHub, GitLab, Figma, and Jira in particular | [Link](docs/configuring-playbook-bridge-hookshot.md) | -| [matrix-sms-bridge](https://github.com/benkuly/matrix-sms-bridge) | x | Bridge for bridging your Matrix server to SMS | [Link](docs/configuring-playbook-bridge-matrix-bridge-sms.md) | -| [Heisenbridge](https://github.com/hifi/heisenbridge) | x | Bridge for bridging your Matrix server to IRC bouncer-style | [Link](docs/configuring-playbook-bridge-heisenbridge.md) | -| [go-skype-bridge](https://github.com/kelaresg/go-skype-bridge) | x | Bridge for bridging your Matrix server to [Skype](https://www.skype.com) | [Link](docs/configuring-playbook-bridge-go-skype-bridge.md) | -| [mx-puppet-slack](https://hub.docker.com/r/sorunome/mx-puppet-slack) | x | Bridge for bridging your Matrix server to [Slack](https://slack.com) | [Link](docs/configuring-playbook-bridge-mx-puppet-slack.md) | +| [matrix-hookshot](https://github.com/Half-Shot/matrix-hookshot) | x | Bridge for generic webhooks and multiple project management services, such as GitHub, GitLab, Figma, and Jira in particular | [Link](docs/configuring-playbook-bridge-hookshot.md) | +| [matrix-sms-bridge](https://github.com/benkuly/matrix-sms-bridge) | x | Bridge to SMS | [Link](docs/configuring-playbook-bridge-matrix-bridge-sms.md) | +| [Heisenbridge](https://github.com/hifi/heisenbridge) | x | Bouncer-style bridge to [IRC](https://wikipedia.org/wiki/Internet_Relay_Chat) | [Link](docs/configuring-playbook-bridge-heisenbridge.md) | +| [go-skype-bridge](https://github.com/kelaresg/go-skype-bridge) | x | Bridge to [Skype](https://www.skype.com) | [Link](docs/configuring-playbook-bridge-go-skype-bridge.md) | +| [mx-puppet-slack](https://hub.docker.com/r/sorunome/mx-puppet-slack) | x | Bridge to [Slack](https://slack.com) | [Link](docs/configuring-playbook-bridge-mx-puppet-slack.md) | | [mx-puppet-instagram](https://github.com/Sorunome/mx-puppet-instagram) | x | Bridge for Instagram-DMs ([Instagram](https://www.instagram.com/)) | [Link](docs/configuring-playbook-bridge-mx-puppet-instagram.md) | | [mx-puppet-twitter](https://github.com/Sorunome/mx-puppet-twitter) | x | Bridge for Twitter-DMs ([Twitter](https://twitter.com/)) | [Link](docs/configuring-playbook-bridge-mx-puppet-twitter.md) | -| [mx-puppet-discord](https://github.com/matrix-discord/mx-puppet-discord) | x | Bridge for [Discord](https://discordapp.com/) | [Link](docs/configuring-playbook-bridge-mx-puppet-discord.md) | -| [mx-puppet-groupme](https://gitlab.com/xangelix-pub/matrix/mx-puppet-groupme) | x | Bridge for [GroupMe](https://groupme.com/) | [Link](docs/configuring-playbook-bridge-mx-puppet-groupme.md) | -| [mx-puppet-steam](https://github.com/icewind1991/mx-puppet-steam) | x | Bridge for [Steam](https://steamapp.com/) | [Link](docs/configuring-playbook-bridge-mx-puppet-steam.md) | -| [Email2Matrix](https://github.com/devture/email2matrix) | x | Bridge for relaying email messages to Matrix rooms | [Link](docs/configuring-playbook-email2matrix.md) | +| [mx-puppet-discord](https://github.com/matrix-discord/mx-puppet-discord) | x | Bridge to [Discord](https://discordapp.com/) | [Link](docs/configuring-playbook-bridge-mx-puppet-discord.md) | +| [mx-puppet-groupme](https://gitlab.com/xangelix-pub/matrix/mx-puppet-groupme) | x | Bridge to [GroupMe](https://groupme.com/) | [Link](docs/configuring-playbook-bridge-mx-puppet-groupme.md) | +| [mx-puppet-steam](https://github.com/icewind1991/mx-puppet-steam) | x | Bridge to [Steam](https://steamapp.com/) | [Link](docs/configuring-playbook-bridge-mx-puppet-steam.md) | +| [Email2Matrix](https://github.com/devture/email2matrix) | x | Bridge for relaying emails to Matrix rooms | [Link](docs/configuring-playbook-email2matrix.md) | ### Bots @@ -142,7 +143,7 @@ Bots provide various additional functionality to your installation. | [Postmoogle](https://gitlab.com/etke.cc/postmoogle) | x | Email to matrix bot | [Link](docs/configuring-playbook-bot-postmoogle.md) | | [Go-NEB](https://github.com/matrix-org/go-neb) | x | A multi functional bot written in Go | [Link](docs/configuring-playbook-bot-go-neb.md) | | [Mjolnir](https://github.com/matrix-org/mjolnir) | x | A moderation tool for Matrix | [Link](docs/configuring-playbook-bot-mjolnir.md) | -| [Draupnir](https://github.com/Gnuxie/Draupnir) | x | A moderation tool for Matrix (Fork of Mjolnir) | [Link](docs/configuring-playbook-bot-draupnir.md) | +| [Draupnir](https://github.com/the-draupnir-project/Draupnir) | x | A moderation tool for Matrix (Fork of Mjolnir) | [Link](docs/configuring-playbook-bot-draupnir.md) | | [Buscarron](https://gitlab.com/etke.cc/buscarron) | x | Web forms (HTTP POST) to matrix | [Link](docs/configuring-playbook-bot-buscarron.md) | | [matrix-chatgpt-bot](https://github.com/matrixgpt/matrix-chatgpt-bot) | x | ChatGPT from matrix | [Link](docs/configuring-playbook-bot-chatgpt.md) | diff --git a/docs/configuring-dns.md b/docs/configuring-dns.md index 862534584..5b9464fe4 100644 --- a/docs/configuring-dns.md +++ b/docs/configuring-dns.md @@ -42,6 +42,7 @@ When you're done configuring DNS, proceed to [Configuring the playbook](configur | [Etherpad](configuring-playbook-etherpad.md) collaborative text editor | CNAME | `etherpad` | - | - | - | `matrix.` | | [Hydrogen](configuring-playbook-client-hydrogen.md) web client | CNAME | `hydrogen` | - | - | - | `matrix.` | | [Cinny](configuring-playbook-client-cinny.md) web client | CNAME | `cinny` | - | - | - | `matrix.` | +| [SchildiChat](configuring-playbook-client-schildichat.md) web client | CNAME | `schildichat` | - | - | - | `matrix.` | | [wsproxy](configuring-playbook-bridge-mautrix-wsproxy.md) sms bridge | CNAME | `wsproxy` | - | - | - | `matrix.` | | [Buscarron](configuring-playbook-bot-buscarron.md) helpdesk bot | CNAME | `buscarron` | - | - | - | `matrix.` | | [Postmoogle](configuring-playbook-bot-postmoogle.md)/[Email2Matrix](configuring-playbook-email2matrix.md) email bridges | MX | `matrix` | 10 | 0 | - | `matrix.` | diff --git a/docs/configuring-playbook-bot-draupnir.md b/docs/configuring-playbook-bot-draupnir.md index 23fa644f1..f60b777cc 100644 --- a/docs/configuring-playbook-bot-draupnir.md +++ b/docs/configuring-playbook-bot-draupnir.md @@ -1,8 +1,8 @@ # Setting up draupnir (optional) -The playbook can install and configure the [draupnir](https://github.com/Gnuxie/Draupnir) moderation bot for you. +The playbook can install and configure the [draupnir](https://github.com/the-draupnir-project/Draupnir) moderation bot for you. -See the project's [documentation](https://github.com/Gnuxie/Draupnir) to learn what it does and why it might be useful to you. +See the project's [documentation](https://github.com/the-draupnir-project/Draupnir) to learn what it does and why it might be useful to you. If your migrating from Mjolnir skip to step 5b. @@ -77,7 +77,7 @@ ansible-playbook -i inventory/hosts setup.yml --tags=setup-all,start ## Usage -You can refer to the upstream [documentation](https://github.com/Gnuxie/Draupnir) for additional ways to use and configure draupnir. Check out their [quickstart guide](https://github.com/matrix-org/draupnir/blob/main/docs/moderators.md#quick-usage) for some basic commands you can give to the bot. +You can refer to the upstream [documentation](https://github.com/the-draupnir-project/Draupnir) for additional ways to use and configure draupnir. Check out their [quickstart guide](https://github.com/matrix-org/draupnir/blob/main/docs/moderators.md#quick-usage) for some basic commands you can give to the bot. You can configure additional options by adding the `matrix_bot_draupnir_configuration_extension_yaml` variable to your `inventory/host_vars/matrix.DOMAIN/vars.yml` file. diff --git a/docs/configuring-playbook-bridge-appservice-discord.md b/docs/configuring-playbook-bridge-appservice-discord.md index d37724c07..bd30d5aae 100644 --- a/docs/configuring-playbook-bridge-appservice-discord.md +++ b/docs/configuring-playbook-bridge-appservice-discord.md @@ -1,7 +1,7 @@ # Setting up Appservice Discord (optional) -**Note**: bridging to [Discord](https://discordapp.com/) can also happen via the [mx-puppet-discord](configuring-playbook-bridge-mx-puppet-discord.md) and [mautrix-discord](configuring-playbook-bridge-mautrix-discord.md) bridges supported by the playbook. -- For using as a Bot we are recommend the Appservice Discord bridge (the one being discussed here), because it supports plumbing. +**Note**: bridging to [Discord](https://discordapp.com/) can also happen via the [mx-puppet-discord](configuring-playbook-bridge-mx-puppet-discord.md) and [mautrix-discord](configuring-playbook-bridge-mautrix-discord.md) bridges supported by the playbook. +- For using as a Bot we are recommend the Appservice Discord bridge (the one being discussed here), because it supports plumbing. - For personal use we recommend the [mautrix-discord](configuring-playbook-bridge-mautrix-discord.md) bridge, because it is the most fully-featured and stable of the 3 Discord bridges supported by the playbook. The playbook can install and configure [matrix-appservice-discord](https://github.com/Half-Shot/matrix-appservice-discord) for you. @@ -23,8 +23,14 @@ matrix_appservice_discord_enabled: true matrix_appservice_discord_client_id: "YOUR DISCORD APP CLIENT ID" matrix_appservice_discord_bot_token: "YOUR DISCORD APP BOT TOKEN" ``` +5. As of Synapse 1.90.0, you will need to add the following to `matrix_synapse_configuration_extension_yaml` to enable the [backwards compatibility](https://matrix-org.github.io/synapse/latest/upgrade#upgrading-to-v1900) that this bridge needs: +```yaml +matrix_synapse_configuration_extension_yaml: | + use_appservice_legacy_authorization: true +``` +*Note*: This deprecated method is considered insecure. -5. If you've already installed Matrix services using the playbook before, you'll need to re-run it (`--tags=setup-all,start`). If not, proceed with [configuring other playbook services](configuring-playbook.md) and then with [Installing](installing.md). Get back to this guide once ready. +6. If you've already installed Matrix services using the playbook before, you'll need to re-run it (`--tags=setup-all,start`). If not, proceed with [configuring other playbook services](configuring-playbook.md) and then with [Installing](installing.md). Get back to this guide once ready. Other configuration options are available via the `matrix_appservice_discord_configuration_extension_yaml` variable. diff --git a/docs/configuring-playbook-bridge-appservice-webhooks.md b/docs/configuring-playbook-bridge-appservice-webhooks.md index f4fbfbc0f..3a4c7ea5b 100644 --- a/docs/configuring-playbook-bridge-appservice-webhooks.md +++ b/docs/configuring-playbook-bridge-appservice-webhooks.md @@ -26,22 +26,29 @@ you can adjust this in `inventory/host_vars/matrix./vars.yml` as we matrix_appservice_webhooks_log_level: '' ``` -3. If you've already installed Matrix services using the playbook before, you'll need to re-run it (`--tags=setup-all,start`). If not, proceed with [configuring other playbook services](configuring-playbook.md) and then with [Installing](installing.md). Get back to this guide once ready. +3. As of Synapse 1.90.0, you will need to add the following to `matrix_synapse_configuration_extension_yaml` to enable the [backwards compatibility](https://matrix-org.github.io/synapse/latest/upgrade#upgrading-to-v1900) that this bridge needs: +```yaml +matrix_synapse_configuration_extension_yaml: | + use_appservice_legacy_authorization: true +``` +*Note*: This deprecated method is considered insecure. + +4. If you've already installed Matrix services using the playbook before, you'll need to re-run it (`--tags=setup-all,start`). If not, proceed with [configuring other playbook services](configuring-playbook.md) and then with [Installing](installing.md). Get back to this guide once ready. -4. If you're using the [Dimension Integration Manager](configuring-playbook-dimension.md), you can configure the Webhooks bridge by opening the Dimension integration manager -> Settings -> Bridges and selecting edit action for "Webhook Bridge". Press "Add self-hosted Bridge" button and populate "Provisioning URL" & "Shared Secret" values from `/matrix/appservice-webhooks/config/config.yaml` file's homeserver URL value and provisioning secret value, respectively. +5. If you're using the [Dimension Integration Manager](configuring-playbook-dimension.md), you can configure the Webhooks bridge by opening the Dimension integration manager -> Settings -> Bridges and selecting edit action for "Webhook Bridge". Press "Add self-hosted Bridge" button and populate "Provisioning URL" & "Shared Secret" values from `/matrix/appservice-webhooks/config/config.yaml` file's homeserver URL value and provisioning secret value, respectively. -5. Invite the bridge bot user to your room: +6. Invite the bridge bot user to your room: - either with `/invite @_webhook:` (*Note*: Make sure you have administration permissions in your room) - or simply add the bridge bot to a private channel (personal channels imply you being an administrator) -6. Send a message to the bridge bot in order to receive a private message including the webhook link. +7. Send a message to the bridge bot in order to receive a private message including the webhook link. ``` !webhook ``` -7. The JSON body for posting messages will have to look like this: +8. The JSON body for posting messages will have to look like this: ```json { "text": "Hello world!", diff --git a/docs/configuring-playbook-client-schildichat.md b/docs/configuring-playbook-client-schildichat.md new file mode 100644 index 000000000..eeab99a76 --- /dev/null +++ b/docs/configuring-playbook-client-schildichat.md @@ -0,0 +1,42 @@ +# Configuring SchildiChat (optional) + +By default, this playbook does not install the [SchildiChat](https://github.com/SchildiChat/schildichat-desktop) Matrix client web application. + +**WARNING**: SchildiChat is based on Element-web, but its releases are lagging behind. As an example (from 2023-08-31), SchildiChat is 10 releases behind (it being based on element-web `v1.11.30`, while element-web is now on `v1.11.40`). Element-web frequently suffers from security issues, so running something based on an ancient Element-web release is **dangerous**. Use SchildiChat at your own risk! + + +## Enabling SchildiChat + +If you'd like for the playbook to install SchildiChat, you can enable it in your configuration file (`inventory/host_vars/matrix./vars.yml`): + +```yaml +matrix_client_schildichat_enabled: true +``` + + +## Configuring SchildiChat settings + +The playbook provides some customization variables you could use to change schildichat's settings. + +Their defaults are defined in [`roles/custom/matrix-client-schildichat/defaults/main.yml`](../roles/custom/matrix-client-schildichat/defaults/main.yml) and they ultimately end up in the generated `/matrix/schildichat/config.json` file (on the server). This file is generated from the [`roles/custom/matrix-client-schildichat/templates/config.json.j2`](../roles/custom/matrix-client-schildichat/templates/config.json.j2) template. + +**If there's an existing variable** which controls a setting you wish to change, you can simply define that variable in your configuration file (`inventory/host_vars/matrix./vars.yml`) and [re-run the playbook](installing.md) to apply the changes. + +Alternatively, **if there is no pre-defined variable** for an schildichat setting you wish to change: + +- you can either **request a variable to be created** (or you can submit such a contribution yourself). Keep in mind that it's **probably not a good idea** to create variables for each one of schildichat's various settings that rarely get used. + +- or, you can **extend and override the default configuration** ([`config.json.j2`](../roles/custom/matrix-client-schildichat/templates/config.json.j2)) by making use of the `matrix_client_schildichat_configuration_extension_json_` variable. You can find information about this in [`roles/custom/matrix-client-schildichat/defaults/main.yml`](../roles/custom/matrix-client-schildichat/defaults/main.yml). + +- or, if extending the configuration is still not powerful enough for your needs, you can **override the configuration completely** using `matrix_client_schildichat_configuration_default` (or `matrix_client_schildichat_configuration`). You can find information about this in [`roles/custom/matrix-client-schildichat/defaults/main.yml`](../roles/custom/matrix-client-schildichat/defaults/main.yml). + + +## Themes + +To change the look of schildichat, you can define your own themes manually by using the `matrix_client_schildichat_setting_defaults_custom_themes` setting. + +Or better yet, you can automatically pull it all themes provided by the [aaronraimist/element-themes](https://github.com/aaronraimist/element-themes) project by simply flipping a flag (`matrix_client_schildichat_themes_enabled: true`). + +If you make your own theme, we encourage you to submit it to the **aaronraimist/element-themes** project, so that the whole community could easily enjoy it. + +Note that for a custom theme to work well, all schildichat instances that you use must have the same theme installed. diff --git a/docs/configuring-playbook-jitsi.md b/docs/configuring-playbook-jitsi.md index 1213f46a7..53eb35ded 100644 --- a/docs/configuring-playbook-jitsi.md +++ b/docs/configuring-playbook-jitsi.md @@ -218,20 +218,44 @@ jitsi_prosody_container_jvb_host_bind_port: 5222 (The default is empty; if it's set then docker forwards the port.) -The nginx configuration will also need to be updated in order to deal with the additional JVB servers. This is achieved via its own configuration variable -`matrix_nginx_proxy_proxy_jitsi_additional_jvbs`, which contains a dictionary of server ids to ip addresses. +Applied together this will allow you to provision extra JVB instances which will register themselves with the prosody service and be available for jicofo +to route conferences too. -For example, +To make Traefik reverse-proxy to these additional JVBs (living on other hosts), **you would need to add the following Traefik configuration extension**: -``` yaml -matrix_nginx_proxy_proxy_jitsi_additional_jvbs: - jvb-2: 192.168.0.2 - jvb-3: 192.168.0.3 -``` +```yaml +# Traefik proxying for additional JVBs. These can't be configured using Docker +# labels, like the first JVB is, because they run on different hosts, so we add +# the necessary configuration to the file provider. +devture_traefik_provider_configuration_extension_yaml: | + http: + routers: + {% for host in groups['jitsi_jvb_servers'] %} + additional-{{ hostvars[host]['jitsi_jvb_server_id'] }}-router: + entryPoints: + - "{{ devture_traefik_entrypoint_primary }}" + rule: "Host(`{{ jitsi_hostname }}`) && PathPrefix(`/colibri-ws/{{ hostvars[host]['jitsi_jvb_server_id'] }}/`)" + service: additional-{{ hostvars[host]['jitsi_jvb_server_id'] }}-service + {% if devture_traefik_entrypoint_primary != 'web' %} -Applied together this will allow you to provision extra JVB instances which will register themselves with the prosody service and be available for jicofo -to route conferences too. + tls: + certResolver: "{{ devture_traefik_certResolver_primary }}" + + {% endif %} + + {% endfor %} + + services: + {% for host in groups['jitsi_jvb_servers'] %} + + additional-{{ hostvars[host]['jitsi_jvb_server_id'] }}-service: + loadBalancer: + servers: + - url: "http://{{ host }}:9090/" + + {% endfor %} +``` ## (Optional) Enable Gravatar diff --git a/docs/configuring-playbook.md b/docs/configuring-playbook.md index 4da625453..d4195c581 100644 --- a/docs/configuring-playbook.md +++ b/docs/configuring-playbook.md @@ -82,6 +82,8 @@ When you're done with all the configuration you'd like to do, continue with [Ins - [Setting up Cinny](configuring-playbook-client-cinny.md) - a web client focusing primarily on simple, elegant and secure interface (optional) +- [Setting up SchildiChat](configuring-playbook-client-schildichat.md) - a web client based on [Element](https://element.io/) with some extras and tweaks (optional) + ### Authentication and user-related diff --git a/docs/maintenance-migrating.md b/docs/maintenance-migrating.md index fd5936914..4c1f71198 100644 --- a/docs/maintenance-migrating.md +++ b/docs/maintenance-migrating.md @@ -5,7 +5,7 @@ # Migrating to new server 1. Prepare by lowering DNS TTL for your domains (`matrix.DOMAIN`, etc.), so that DNS record changes (step 4 below) would happen faster, leading to less downtime -2. Stop all services on the old server and make sure they won't be starting again. Execute this on the old server: `systemctl disable --now matrix*` +2. Stop all services on the old server and make sure they won't be starting again. Execute this on the old server: `systemctl disable --now matrix*` (you might have to cd to /etc/systemd/system/ first) 3. Copy directory `/matrix` from the old server to the new server. Make sure to preserve ownership and permissions (use `cp -p` or `rsync -ar`)! 4. Make sure your DNS records are adjusted to point to the new server's IP address 5. Remove old server from the `inventory/hosts` file and add new server. diff --git a/group_vars/matrix_servers b/group_vars/matrix_servers index 816fb2b1b..af4051156 100755 --- a/group_vars/matrix_servers +++ b/group_vars/matrix_servers @@ -312,6 +312,8 @@ devture_systemd_service_manager_services_list_auto: | + ([{'name': 'matrix-client-hydrogen.service', 'priority': 2000, 'groups': ['matrix', 'clients', 'hydrogen', 'client-hydrogen']}] if matrix_client_hydrogen_enabled else []) + + ([{'name': 'matrix-client-schildichat.service', 'priority': 2000, 'groups': ['matrix', 'clients', 'schildichat', 'client-schildichat']}] if matrix_client_schildichat_enabled else []) + + ([{'name': ('matrix-' + matrix_homeserver_implementation + '.service'), 'priority': 1000, 'groups': ['matrix', 'homeservers', matrix_homeserver_implementation]}] if matrix_homeserver_enabled else []) + ([{'name': 'matrix-corporal.service', 'priority': 1500, 'groups': ['matrix', 'corporal']}] if matrix_corporal_enabled else []) @@ -2752,6 +2754,7 @@ matrix_nginx_proxy_proxy_matrix_enabled: true matrix_nginx_proxy_proxy_element_enabled: "{{ matrix_client_element_enabled and matrix_playbook_reverse_proxy_type in ['playbook-managed-nginx', 'other-nginx-non-container'] }}" matrix_nginx_proxy_proxy_hydrogen_enabled: "{{ matrix_client_hydrogen_enabled and matrix_playbook_reverse_proxy_type in ['playbook-managed-nginx', 'other-nginx-non-container'] }}" matrix_nginx_proxy_proxy_cinny_enabled: "{{ matrix_client_cinny_enabled and matrix_playbook_reverse_proxy_type in ['playbook-managed-nginx', 'other-nginx-non-container'] }}" +matrix_nginx_proxy_proxy_schildichat_enabled: "{{ matrix_client_schildichat_enabled and matrix_playbook_reverse_proxy_type in ['playbook-managed-nginx', 'other-nginx-non-container'] }}" matrix_nginx_proxy_proxy_buscarron_enabled: "{{ matrix_bot_buscarron_enabled and matrix_playbook_reverse_proxy_type in ['playbook-managed-nginx', 'other-nginx-non-container'] }}" matrix_nginx_proxy_proxy_dimension_enabled: "{{ matrix_dimension_enabled and matrix_playbook_reverse_proxy_type in ['playbook-managed-nginx', 'other-nginx-non-container'] }}" matrix_nginx_proxy_proxy_rageshake_enabled: "{{ matrix_rageshake_enabled and matrix_playbook_reverse_proxy_type in ['playbook-managed-nginx', 'other-nginx-non-container'] }}" @@ -2852,6 +2855,8 @@ matrix_nginx_proxy_systemd_wanted_services_list: | + (['matrix-client-hydrogen.service'] if matrix_client_hydrogen_enabled and matrix_playbook_reverse_proxy_type in ['playbook-managed-nginx', 'other-nginx-non-container'] else []) + + (['matrix-client-schildichat.service'] if matrix_client_schildichat_enabled and matrix_playbook_reverse_proxy_type in ['playbook-managed-nginx', 'other-nginx-non-container'] else []) + + ([(grafana_identifier + '.service')] if grafana_enabled and matrix_playbook_reverse_proxy_type in ['playbook-managed-nginx', 'other-nginx-non-container'] else []) + (['matrix-dimension.service'] if matrix_dimension_enabled and matrix_playbook_reverse_proxy_type in ['playbook-managed-nginx', 'other-nginx-non-container'] else []) @@ -2883,6 +2888,8 @@ matrix_ssl_domains_to_obtain_certificates_for: | + ([matrix_server_fqn_cinny] if matrix_client_cinny_enabled else []) + + ([matrix_server_fqn_schildichat] if matrix_client_schildichat_enabled else []) + + ([matrix_server_fqn_buscarron] if matrix_bot_buscarron_enabled else []) + ([matrix_server_fqn_dimension] if matrix_dimension_enabled else []) @@ -3485,6 +3492,60 @@ matrix_client_cinny_self_check_validate_certificates: "{{ false if matrix_playbo # ###################################################################### +###################################################################### +# +# matrix-client-schildichat +# +###################################################################### + +matrix_client_schildichat_enabled: false + +matrix_client_schildichat_container_image_self_build: "{{ matrix_architecture not in ['arm64', 'amd64'] }}" + +# Normally, matrix-nginx-proxy is enabled and nginx can reach schildichat over the container network. +# If matrix-nginx-proxy is not enabled, or you otherwise have a need for it, you can expose +# the schildichat HTTP port to the local host. +matrix_client_schildichat_container_http_host_bind_port: "{{ (matrix_playbook_service_host_bind_interface_prefix ~ '8765') if matrix_playbook_service_host_bind_interface_prefix else '' }}" + +matrix_client_schildichat_container_network: "{{ matrix_nginx_proxy_container_network if matrix_playbook_reverse_proxy_type == 'playbook-managed-nginx' else 'matrix-client-schildichat' }}" + +matrix_client_schildichat_container_additional_networks: "{{ [matrix_playbook_reverse_proxyable_services_additional_network] if matrix_playbook_reverse_proxyable_services_additional_network else [] }}" + +matrix_client_schildichat_container_labels_traefik_enabled: "{{ matrix_playbook_reverse_proxy_type in ['playbook-managed-traefik', 'other-traefik-container'] }}" +matrix_client_schildichat_container_labels_traefik_docker_network: "{{ matrix_playbook_reverse_proxyable_services_additional_network }}" +matrix_client_schildichat_container_labels_traefik_entrypoints: "{{ devture_traefik_entrypoint_primary }}" +matrix_client_schildichat_container_labels_traefik_tls_certResolver: "{{ devture_traefik_certResolver_primary }}" + +matrix_client_schildichat_default_hs_url: "{{ matrix_homeserver_url }}" +matrix_client_schildichat_default_is_url: "{{ matrix_identity_server_url }}" + +# Use Dimension if enabled, otherwise fall back to Scalar +matrix_client_schildichat_integrations_ui_url: "{{ matrix_dimension_integrations_ui_url if matrix_dimension_enabled else 'https://scalar.vector.im/' }}" +matrix_client_schildichat_integrations_rest_url: "{{ matrix_dimension_integrations_rest_url if matrix_dimension_enabled else 'https://scalar.vector.im/api' }}" +matrix_client_schildichat_integrations_widgets_urls: "{{ matrix_dimension_integrations_widgets_urls if matrix_dimension_enabled else ['https://scalar.vector.im/api'] }}" +matrix_client_schildichat_integrations_jitsi_widget_url: "{{ matrix_dimension_integrations_jitsi_widget_url if matrix_dimension_enabled else 'https://scalar.vector.im/api/widgets/jitsi.html' }}" + +matrix_client_schildichat_self_check_validate_certificates: "{{ false if matrix_playbook_ssl_retrieval_method == 'self-signed' else true }}" + +matrix_client_schildichat_registration_enabled: "{{ matrix_synapse_enable_registration }}" + +matrix_client_schildichat_enable_presence_by_hs_url: | + {{ + none + if matrix_synapse_presence_enabled + else {matrix_client_schildichat_default_hs_url: false} + }} + +matrix_client_schildichat_welcome_user_id: ~ + +matrix_client_schildichat_jitsi_preferred_domain: "{{ matrix_server_fqn_jitsi if jitsi_enabled else '' }}" + +###################################################################### +# +# /matrix-client-schildichat +# +###################################################################### + ###################################################################### # # matrix-synapse diff --git a/requirements.yml b/requirements.yml index 28382d055..2edf4db97 100644 --- a/requirements.yml +++ b/requirements.yml @@ -4,7 +4,7 @@ version: v1.0.0-1 name: auxiliary - src: git+https://gitlab.com/etke.cc/roles/backup_borg.git - version: v1.2.4-1.8.2-0 + version: v1.2.5-1.8.2-0 - src: git+https://github.com/devture/com.devture.ansible.role.container_socket_proxy.git version: v0.1.1-2 - src: git+https://github.com/devture/com.devture.ansible.role.docker_sdk_for_python.git @@ -16,7 +16,7 @@ - src: git+https://github.com/devture/com.devture.ansible.role.playbook_state_preserver.git version: ff2fd42e1c1a9e28e3312bbd725395f9c2fc7f16 - src: git+https://github.com/devture/com.devture.ansible.role.postgres.git - version: v15.3-0 + version: v15.4-1 - src: git+https://github.com/devture/com.devture.ansible.role.postgres_backup.git version: a0cc7c1c696872ba8880d9c5e5a54098de825030 - src: git+https://github.com/devture/com.devture.ansible.role.systemd_docker_base.git @@ -30,19 +30,19 @@ - src: git+https://github.com/devture/com.devture.ansible.role.traefik_certs_dumper.git version: v2.8.1-0 - src: git+https://gitlab.com/etke.cc/roles/etherpad.git - version: v1.9.2-0 + version: v1.9.2-1 - src: git+https://github.com/geerlingguy/ansible-role-docker version: 6.2.0 name: geerlingguy.docker - src: git+https://gitlab.com/etke.cc/roles/grafana.git - version: v10.0.3-0 + version: v10.1.1-0 - src: git+https://github.com/mother-of-all-self-hosting/ansible-role-jitsi.git - version: v8615-2 + version: v8922-1 name: jitsi - src: git+https://gitlab.com/etke.cc/roles/ntfy.git - version: v2.7.0-0 + version: v2.7.0-2 - src: git+https://github.com/mother-of-all-self-hosting/ansible-role-prometheus.git - version: v2.45.0-1 + version: v2.47.0-0 name: prometheus - src: git+https://gitlab.com/etke.cc/roles/prometheus_node_exporter.git version: v1.6.1-0 diff --git a/roles/custom/matrix-base/defaults/main.yml b/roles/custom/matrix-base/defaults/main.yml index cd85b0ab4..6ea4e2307 100644 --- a/roles/custom/matrix-base/defaults/main.yml +++ b/roles/custom/matrix-base/defaults/main.yml @@ -72,6 +72,9 @@ matrix_server_fqn_hydrogen: "hydrogen.{{ matrix_domain }}" # This is where you access the Cinny web client from (if enabled via matrix_client_cinny_enabled; disabled by default). matrix_server_fqn_cinny: "cinny.{{ matrix_domain }}" +# This is where you access the schildichat web client from (if enabled via matrix_client_schildichat_enabled; disabled by default). +matrix_server_fqn_schildichat: "schildichat.{{ matrix_domain }}" + # This is where you access the buscarron bot from (if enabled via matrix_bot_buscarron_enabled; disabled by default). matrix_server_fqn_buscarron: "buscarron.{{ matrix_domain }}" diff --git a/roles/custom/matrix-bot-draupnir/defaults/main.yml b/roles/custom/matrix-bot-draupnir/defaults/main.yml index b7e56c34c..ae65b4ffe 100644 --- a/roles/custom/matrix-bot-draupnir/defaults/main.yml +++ b/roles/custom/matrix-bot-draupnir/defaults/main.yml @@ -1,13 +1,13 @@ --- # A moderation tool for Matrix -# Project source code URL: https://github.com/Gnuxie/Draupnir +# Project source code URL: https://github.com/the-draupnir-project/Draupnir matrix_bot_draupnir_enabled: true -matrix_bot_draupnir_version: "v1.84.0" +matrix_bot_draupnir_version: "v1.85.1" matrix_bot_draupnir_container_image_self_build: false -matrix_bot_draupnir_container_image_self_build_repo: "https://github.com/Gnuxie/Draupnir.git" +matrix_bot_draupnir_container_image_self_build_repo: "https://github.com/the-draupnir-project/Draupnir.git" matrix_bot_draupnir_docker_image: "{{ matrix_bot_draupnir_docker_image_name_prefix }}gnuxie/draupnir:{{ matrix_bot_draupnir_version }}" matrix_bot_draupnir_docker_image_name_prefix: "{{ 'localhost/' if matrix_bot_draupnir_container_image_self_build else matrix_container_global_registry_prefix }}" @@ -36,6 +36,16 @@ matrix_bot_draupnir_access_token: "" # Note: draupnir is fairly verbose - expect a lot of messages from it. matrix_bot_draupnir_management_room: "" +# Disable Server ACL is used if you want to not give the bot the right to apply Server ACLs in rooms without complaints from the bot. +# This setting is described the following way in the Configuration. +# +# Whether or not Draupnir should apply `m.room.server_acl` events. +# DO NOT change this to `true` unless you are very confident that you know what you are doing. +# +# Please follow the advice of upstream and only change this value if you know what your doing. +# Its Exposed here because its common enough to be valid to expose. +matrix_bot_draupnir_disable_server_acl: "false" + # Default configuration template which covers the generic use case. # You can customize it by controlling the various variables inside it. # diff --git a/roles/custom/matrix-bot-draupnir/templates/production.yaml.j2 b/roles/custom/matrix-bot-draupnir/templates/production.yaml.j2 index 95acbd356..36488a111 100644 --- a/roles/custom/matrix-bot-draupnir/templates/production.yaml.j2 +++ b/roles/custom/matrix-bot-draupnir/templates/production.yaml.j2 @@ -51,9 +51,11 @@ recordIgnoredInvites: false # (see verboseLogging to adjust this a bit.) managementRoom: "{{ matrix_bot_draupnir_management_room }}" +# Deprecated and will be removed in a future version. +# Running with verboseLogging is unsupported. # Whether Draupnir should log a lot more messages in the room, -# mainly involves "all-OK" messages, and debugging messages for when Draupnir checks bans in a room. -verboseLogging: false +# mainly involves "all-OK" messages, and debugging messages for when draupnir checks bans in a room. +#verboseLogging: false # The log level of terminal (or container) output, # can be one of DEBUG, INFO, WARN and ERROR, in increasing order of importance and severity. @@ -73,6 +75,10 @@ verifyPermissionsOnStartup: true # turn on to trial some untrusted configuration or lists. noop: false +# Whether or not Draupnir should apply `m.room.server_acl` events. +# DO NOT change this to `true` unless you are very confident that you know what you are doing. +disableServerACL: "{{ matrix_bot_draupnir_disable_server_acl }}" + # Whether Draupnir should check member lists quicker (by using a different endpoint), # keep in mind that enabling this will miss invited (but not joined) users. # diff --git a/roles/custom/matrix-bot-honoroit/defaults/main.yml b/roles/custom/matrix-bot-honoroit/defaults/main.yml index 788b8066f..fa852fb8d 100644 --- a/roles/custom/matrix-bot-honoroit/defaults/main.yml +++ b/roles/custom/matrix-bot-honoroit/defaults/main.yml @@ -20,7 +20,7 @@ matrix_bot_honoroit_docker_repo: "https://gitlab.com/etke.cc/honoroit.git" matrix_bot_honoroit_docker_repo_version: "{{ matrix_bot_honoroit_version }}" matrix_bot_honoroit_docker_src_files_path: "{{ matrix_base_data_path }}/honoroit/docker-src" -matrix_bot_honoroit_version: v0.9.18 +matrix_bot_honoroit_version: v0.9.19 matrix_bot_honoroit_docker_image: "{{ matrix_bot_honoroit_docker_image_name_prefix }}etke.cc/honoroit:{{ matrix_bot_honoroit_version }}" matrix_bot_honoroit_docker_image_name_prefix: "{{ 'localhost/' if matrix_bot_honoroit_container_image_self_build else 'registry.gitlab.com/' }}" matrix_bot_honoroit_docker_image_force_pull: "{{ matrix_bot_honoroit_docker_image.endswith(':latest') }}" diff --git a/roles/custom/matrix-bridge-mautrix-gmessages/defaults/main.yml b/roles/custom/matrix-bridge-mautrix-gmessages/defaults/main.yml index 8d5ce244e..4050544c0 100644 --- a/roles/custom/matrix-bridge-mautrix-gmessages/defaults/main.yml +++ b/roles/custom/matrix-bridge-mautrix-gmessages/defaults/main.yml @@ -6,7 +6,7 @@ matrix_mautrix_gmessages_enabled: true matrix_mautrix_gmessages_container_image_self_build: false matrix_mautrix_gmessages_container_image_self_build_repo: "https://github.com/mautrix/gmessages.git" -matrix_mautrix_gmessages_container_image_self_build_branch: "{{ 'master' if matrix_mautrix_gmessages_version == 'latest' else matrix_mautrix_gmessages_version }}" +matrix_mautrix_gmessages_container_image_self_build_branch: "{{ 'main' if matrix_mautrix_gmessages_version == 'latest' else matrix_mautrix_gmessages_version }}" matrix_mautrix_gmessages_version: v0.1.0 # See: https://mau.dev/mautrix/gmessages/container_registry diff --git a/roles/custom/matrix-client-element/defaults/main.yml b/roles/custom/matrix-client-element/defaults/main.yml index b9a1aabae..dae669d02 100644 --- a/roles/custom/matrix-client-element/defaults/main.yml +++ b/roles/custom/matrix-client-element/defaults/main.yml @@ -10,7 +10,7 @@ matrix_client_element_container_image_self_build_repo: "https://github.com/vecto # - https://github.com/vector-im/element-web/issues/19544 matrix_client_element_container_image_self_build_low_memory_system_patch_enabled: "{{ ansible_memtotal_mb < 4096 }}" -matrix_client_element_version: v1.11.39 +matrix_client_element_version: v1.11.42 matrix_client_element_docker_image: "{{ matrix_client_element_docker_image_name_prefix }}vectorim/element-web:{{ matrix_client_element_version }}" matrix_client_element_docker_image_name_prefix: "{{ 'localhost/' if matrix_client_element_container_image_self_build else matrix_container_global_registry_prefix }}" matrix_client_element_docker_image_force_pull: "{{ matrix_client_element_docker_image.endswith(':latest') }}" diff --git a/roles/custom/matrix-client-hydrogen/defaults/main.yml b/roles/custom/matrix-client-hydrogen/defaults/main.yml index de16c8b69..46421f8d9 100644 --- a/roles/custom/matrix-client-hydrogen/defaults/main.yml +++ b/roles/custom/matrix-client-hydrogen/defaults/main.yml @@ -6,7 +6,7 @@ matrix_client_hydrogen_enabled: true matrix_client_hydrogen_container_image_self_build: false matrix_client_hydrogen_container_image_self_build_repo: "https://github.com/vector-im/hydrogen-web.git" -matrix_client_hydrogen_version: v0.4.0 +matrix_client_hydrogen_version: v0.4.1 matrix_client_hydrogen_docker_image: "{{ matrix_client_hydrogen_docker_image_name_prefix }}vector-im/hydrogen-web:{{ matrix_client_hydrogen_version }}" matrix_client_hydrogen_docker_image_name_prefix: "{{ 'localhost/' if matrix_client_hydrogen_container_image_self_build else 'ghcr.io/' }}" matrix_client_hydrogen_docker_image_force_pull: "{{ matrix_client_hydrogen_docker_image.endswith(':latest') }}" diff --git a/roles/custom/matrix-client-schildichat/defaults/main.yml b/roles/custom/matrix-client-schildichat/defaults/main.yml new file mode 100644 index 000000000..e446e755c --- /dev/null +++ b/roles/custom/matrix-client-schildichat/defaults/main.yml @@ -0,0 +1,312 @@ +--- +# Project source code URL: https://github.com/SchildiChat/schildichat-desktop + +matrix_client_schildichat_enabled: true + +matrix_client_schildichat_container_image_self_build: false + +matrix_client_schildichat_version: v1.11.30-sc.2 +matrix_client_schildichat_docker_image: "{{ matrix_client_schildichat_docker_image_name_prefix }}etke.cc/schildichat-web:{{ matrix_client_schildichat_version }}" +matrix_client_schildichat_docker_image_name_prefix: "{{ 'localhost/' if matrix_client_schildichat_container_image_self_build else 'registry.gitlab.com/' }}" +matrix_client_schildichat_docker_image_force_pull: "{{ matrix_client_schildichat_docker_image.endswith(':latest') }}" + +matrix_client_schildichat_data_path: "{{ matrix_base_data_path }}/client-schildichat" +matrix_client_schildichat_docker_src_files_path: "{{ matrix_client_schildichat_data_path }}/docker-src" + +# The base container network +matrix_client_schildichat_container_network: matrix-client-schildichat + +# A list of additional container networks that the container would be connected to. +# The role does not create these networks, so make sure they already exist. +# Use this to expose this container to a reverse proxy, which runs in a different container network. +matrix_client_schildichat_container_additional_networks: [] + +# Controls whether the matrix-client-schildichat container exposes its HTTP port (tcp/8080 in the container). +# +# Takes an ":" or "" value (e.g. "127.0.0.1:8765"), or empty string to not expose. +matrix_client_schildichat_container_http_host_bind_port: '' + +# matrix_client_schildichat_container_labels_traefik_enabled controls whether labels to assist a Traefik reverse-proxy will be attached to the container. +# See `../templates/labels.j2` for details. +# +# To inject your own other container labels, see `matrix_client_schildichat_container_labels_additional_labels`. +matrix_client_schildichat_container_labels_traefik_enabled: true +matrix_client_schildichat_container_labels_traefik_docker_network: "{{ matrix_client_schildichat_container_network }}" +matrix_client_schildichat_container_labels_traefik_hostname: "{{ matrix_client_schildichat_hostname }}" +# The path prefix must either be `/` or not end with a slash (e.g. `/schildichat`). +matrix_client_schildichat_container_labels_traefik_path_prefix: "{{ matrix_client_schildichat_path_prefix }}" +matrix_client_schildichat_container_labels_traefik_rule: "Host(`{{ matrix_client_schildichat_container_labels_traefik_hostname }}`){% if matrix_client_schildichat_container_labels_traefik_path_prefix != '/' %} && PathPrefix(`{{ matrix_client_schildichat_container_labels_traefik_path_prefix }}`){% endif %}" +matrix_client_schildichat_container_labels_traefik_priority: 0 +matrix_client_schildichat_container_labels_traefik_entrypoints: web-secure +matrix_client_schildichat_container_labels_traefik_tls: "{{ matrix_client_schildichat_container_labels_traefik_entrypoints != 'web' }}" +matrix_client_schildichat_container_labels_traefik_tls_certResolver: default # noqa var-naming + +# Controls which additional headers to attach to all HTTP responses. +# To add your own headers, use `matrix_client_schildichat_container_labels_traefik_additional_response_headers_custom` +matrix_client_schildichat_container_labels_traefik_additional_response_headers: "{{ matrix_client_schildichat_container_labels_traefik_additional_response_headers_auto | combine(matrix_client_schildichat_container_labels_traefik_additional_response_headers_custom) }}" +matrix_client_schildichat_container_labels_traefik_additional_response_headers_auto: | + {{ + {} + | combine ({'X-XSS-Protection': matrix_client_schildichat_http_header_xss_protection} if matrix_client_schildichat_http_header_xss_protection else {}) + | combine ({'X-Frame-Options': matrix_client_schildichat_http_header_frame_options} if matrix_client_schildichat_http_header_frame_options else {}) + | combine ({'X-Content-Type-Options': matrix_client_schildichat_http_header_content_type_options} if matrix_client_schildichat_http_header_content_type_options else {}) + | combine ({'Content-Security-Policy': matrix_client_schildichat_http_header_content_security_policy} if matrix_client_schildichat_http_header_content_security_policy else {}) + | combine ({'Permission-Policy': matrix_client_schildichat_http_header_content_permission_policy} if matrix_client_schildichat_http_header_content_permission_policy else {}) + | combine ({'Strict-Transport-Security': matrix_client_schildichat_http_header_strict_transport_security} if matrix_client_schildichat_http_header_strict_transport_security and matrix_client_schildichat_container_labels_traefik_tls else {}) + }} +matrix_client_schildichat_container_labels_traefik_additional_response_headers_custom: {} + +# matrix_client_schildichat_container_labels_additional_labels contains a multiline string with additional labels to add to the container label file. +# See `../templates/labels.j2` for details. +# +# Example: +# matrix_client_schildichat_container_labels_additional_labels: | +# my.label=1 +# another.label="here" +matrix_client_schildichat_container_labels_additional_labels: '' + +# A list of extra arguments to pass to the container +matrix_client_schildichat_container_extra_arguments: [] + +# List of systemd services that matrix-client-schildichat.service depends on +matrix_client_schildichat_systemd_required_services_list: ['docker.service'] + +# Specifies the value of the `X-XSS-Protection` header +# Stops pages from loading when they detect reflected cross-site scripting (XSS) attacks. +# +# Learn more about it is here: +# - https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-XSS-Protection +# - https://portswigger.net/web-security/cross-site-scripting/reflected +matrix_client_schildichat_http_header_xss_protection: "1; mode=block" + +# Specifies the value of the `X-Frame-Options` header which controls whether framing can happen. +# See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options +matrix_client_schildichat_http_header_frame_options: SAMEORIGIN + +# Specifies the value of the `X-Content-Type-Options` header. +# See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Content-Type-Options +matrix_client_schildichat_http_header_content_type_options: nosniff + +# Specifies the value of the `Content-Security-Policy` header. +# See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy +matrix_client_schildichat_http_header_content_security_policy: frame-ancestors 'self' + +# Specifies the value of the `Permission-Policy` header. +# See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Permission-Policy +matrix_client_schildichat_http_header_content_permission_policy: "{{ 'interest-cohort=()' if matrix_client_schildichat_floc_optout_enabled else '' }}" + +# Specifies the value of the `Strict-Transport-Security` header. +# See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security +matrix_client_schildichat_http_header_strict_transport_security: "max-age=31536000; includeSubDomains{{ '; preload' if matrix_client_schildichat_hsts_preload_enabled else '' }}" + +# Controls whether to send a "Permissions-Policy interest-cohort=();" header along with all responses +# +# Learn more about what it is here: +# - https://www.eff.org/deeplinks/2021/03/googles-floc-terrible-idea +# - https://paramdeo.com/blog/opting-your-website-out-of-googles-floc-network +# - https://amifloced.org/ +# +# Of course, a better solution is to just stop using browsers (like Chrome), which participate in such tracking practices. +# See: `matrix_client_schildichat_content_permission_policy` +matrix_client_schildichat_floc_optout_enabled: true + +# Controls if HSTS preloading is enabled +# +# In its strongest and recommended form, the [HSTS policy](https://www.chromium.org/hsts) includes all subdomains, and +# indicates a willingness to be "preloaded" into browsers: +# `Strict-Transport-Security: max-age=31536000; includeSubDomains; preload` +# For more information visit: +# - https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security +# - https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security +# - https://hstspreload.org/#opt-in +# See: `matrix_client_schildichat_http_header_strict_transport_security` +matrix_client_schildichat_hsts_preload_enabled: false + +# The hostname at which schildichat is served. +# Only works with with Traefik reverse-proxying. +# For matrix-nginx-proxy, `matrix_server_fqn_schildichat` is used and this variable has no effect. +matrix_client_schildichat_hostname: "{{ matrix_server_fqn_schildichat }}" + +# The path at which schildichat is exposed. +# When matrix-nginx-proxy is used, setting this to values other than `/` will cause configuration mismatches and trouble. +# +# If Traefik is used, the hostname is also configurable - see `matrix_client_schildichat_container_labels_traefik_hostname`. +# This value must either be `/` or not end with a slash (e.g. `/schildichat`). +matrix_client_schildichat_path_prefix: / + +# schildichat config.json customizations +matrix_client_schildichat_default_server_name: "{{ matrix_domain }}" +matrix_client_schildichat_default_hs_url: "" +matrix_client_schildichat_default_is_url: ~ +matrix_client_schildichat_disable_custom_urls: true +matrix_client_schildichat_disable_guests: true +matrix_client_schildichat_integrations_ui_url: "https://scalar.vector.im/" +matrix_client_schildichat_integrations_rest_url: "https://scalar.vector.im/api" +matrix_client_schildichat_integrations_widgets_urls: ["https://scalar.vector.im/api"] +matrix_client_schildichat_integrations_jitsi_widget_url: "https://scalar.vector.im/api/widgets/jitsi.html" +matrix_client_schildichat_permalink_prefix: "https://matrix.to" # noqa var-naming +matrix_client_schildichat_bug_report_endpoint_url: "https://element.io/bugreports/submit" +matrix_client_schildichat_show_lab_settings: true # noqa var-naming +# schildichat public room directory server(s) +matrix_client_schildichat_room_directory_servers: ['matrix.org'] +matrix_client_schildichat_welcome_user_id: ~ +# Branding of schildichat +matrix_client_schildichat_brand: "schildichat" + +# URL to Logo on welcome page +matrix_client_schildichat_welcome_logo: "themes/element/img/logos/element-logo.svg" + +# URL of link on welcome image +matrix_client_schildichat_welcome_logo_link: "https://schildi.chat" + +matrix_client_schildichat_welcome_headline: "_t('Welcome to SchildiChat')" +matrix_client_schildichat_welcome_text: "_t('Decentralised, encrypted chat & collaboration powered by [matrix]')" + +# Links, shown in footer of welcome page: +# [{"text": "Link text", "url": "https://link.target"}, {"text": "Other link"}] +matrix_client_schildichat_branding_auth_footer_links: ~ # noqa var-naming + +# URL to image, shown during Login +matrix_client_schildichat_branding_auth_header_logo_url: "{{ matrix_client_schildichat_welcome_logo }}" # noqa var-naming + +# URL to Wallpaper, shown in background of welcome page +matrix_client_schildichat_branding_welcome_background_url: ~ # noqa var-naming + +matrix_client_schildichat_page_template_welcome_path: "{{ role_path }}/templates/welcome.html.j2" + +# By default, there's no schildichat homepage (when logged in). If you wish to have one, +# point this to a `home.html` template file on your local filesystem. +matrix_client_schildichat_embedded_pages_home_path: ~ + +matrix_client_schildichat_jitsi_preferred_domain: '' # noqa var-naming + +# Controls whether the self-check feature should validate SSL certificates. +matrix_client_schildichat_self_check_validate_certificates: true + +# don't show the registration button on welcome page +matrix_client_schildichat_registration_enabled: false + +# Default country code on welcome page when login by phone number +matrix_client_schildichat_default_country_code: "GB" + +# Controls whether presence will be enabled +matrix_client_schildichat_enable_presence_by_hs_url: ~ + +# Controls whether custom schildichat themes will be installed. +# When enabled, all themes found in the `matrix_client_schildichat_themes_repository_url` repository +# will be installed and enabled automatically. +matrix_client_schildichat_themes_enabled: false +matrix_client_schildichat_themes_repository_url: https://github.com/aaronraimist/element-themes +matrix_client_schildichat_themes_repository_version: master + +# Controls the default theme +matrix_client_schildichat_default_theme: 'light' + +# Controls the `setting_defaults.custom_themes` setting of the schildichat configuration. +# You can use this setting to define custom themes. +# +# Also, look at `matrix_client_schildichat_themes_enabled` for a way to pull in a bunch of custom themes automatically. +# If you define your own themes here and set `matrix_client_schildichat_themes_enabled: true`, your themes will be preserved as well. +# +# Note that for a custom theme to work well, all schildichat instances that you use must have the same theme installed. +matrix_client_schildichat_setting_defaults_custom_themes: [] # noqa var-naming + +# Default schildichat configuration template which covers the generic use case. +# You can customize it by controlling the various variables inside it. +# +# For a more advanced customization, you can extend the default (see `matrix_client_schildichat_configuration_extension_json`) +# or completely replace this variable with your own template. +# +# The side-effect of this lookup is that Ansible would even parse the JSON for us, returning a dict. +# This is unlike what it does when looking up YAML template files (no automatic parsing there). +matrix_client_schildichat_configuration_default: "{{ lookup('template', 'templates/config.json.j2') }}" + +# Your custom JSON configuration for schildichat should go to `matrix_client_schildichat_configuration_extension_json`. +# This configuration extends the default starting configuration (`matrix_client_schildichat_configuration_default`). +# +# You can override individual variables from the default configuration, or introduce new ones. +# +# If you need something more special, you can take full control by +# completely redefining `matrix_client_schildichat_configuration_default`. +# +# Example configuration extension follows: +# +# matrix_client_schildichat_configuration_extension_json: | +# { +# "disable_3pid_login": true, +# "disable_login_language_selector": true +# } +matrix_client_schildichat_configuration_extension_json: '{}' + +matrix_client_schildichat_configuration_extension: "{{ matrix_client_schildichat_configuration_extension_json | from_json if matrix_client_schildichat_configuration_extension_json | from_json is mapping else {} }}" + +# Holds the final schildichat configuration (a combination of the default and its extension). +# You most likely don't need to touch this variable. Instead, see `matrix_client_schildichat_configuration_default`. +matrix_client_schildichat_configuration: "{{ matrix_client_schildichat_configuration_default | combine(matrix_client_schildichat_configuration_extension, recursive=True) }}" + +# schildichat Location sharing functionality +# More info: https://element.io/blog/element-launches-e2ee-location-sharing/ +# How to host your own map tile server: https://matrix.org/docs/guides/map-tile-server +matrix_client_schildichat_location_sharing_enabled: false + +# Default schildichat location sharing map style configuration template which covers the generic use case. +# You can customize it by controlling the various variables inside it. +# +# For a more advanced customization, you can extend the default (see `matrix_client_schildichat_location_sharing_map_style_extension_json`) +# or completely replace this variable with your own template. +# +# The side-effect of this lookup is that Ansible would even parse the JSON for us, returning a dict. +# This is unlike what it does when looking up YAML template files (no automatic parsing there). +matrix_client_schildichat_location_sharing_map_style_default: "{{ lookup('template', 'templates/map_style.json.j2') }}" + +# Your custom JSON configuration for schildichat location sharing map style should go to `matrix_client_schildichat_location_sharing_map_style_extension_json`. +# This configuration extends the default starting configuration (`matrix_client_schildichat_location_sharing_map_style_default`). +# +# You can override individual variables from the default configuration, or introduce new ones. +# +# If you need something more special, you can take full control by +# completely redefining `matrix_client_schildichat_location_sharing_map_style_default`. +# +# Example configuration override follows: +# +# matrix_client_schildichat_location_sharing_map_style_extension_json: | +# { +# "sources": { +# "localsource": { +# "tileSize": 512 +# } +# } +# } +# +# Example configuration extension follows: +# +# matrix_client_schildichat_location_sharing_map_style_extension_json: | +# { +# "sources": { +# "anothersource": { +# "attribution": "", +# "tileSize": 256, +# "tiles": ["https://anothertile.example.com/{z}/{x}/{y}.png"], +# "type": "raster" +# } +# } +# } +matrix_client_schildichat_location_sharing_map_style_extension_json: '{}' + +matrix_client_schildichat_location_sharing_map_style_extension: "{{ matrix_client_schildichat_location_sharing_map_style_extension_json | from_json if matrix_client_schildichat_location_sharing_map_style_extension_json | from_json is mapping else {} }}" + +# Holds the final schildichat location sharing map style configuration (a combination of the default and its extension). +# You most likely don't need to touch this variable. Instead, see `matrix_client_schildichat_location_sharing_map_style_default`. +matrix_client_schildichat_location_sharing_map_style: "{{ matrix_client_schildichat_location_sharing_map_style_default | combine(matrix_client_schildichat_location_sharing_map_style_extension, recursive=True) }}" + +# Example tile servers configuration +# matrix_client_schildichat_location_sharing_map_style_content_sources_localsource_tiles: ["https://tile.example.com/{z}/{x}/{y}.png"] +# or +# matrix_client_schildichat_location_sharing_map_style_content_sources_localsource_tiles: ["https://s1.example.com/{z}/{x}/{y}.png", "https://s2.example.com/{z}/{x}/{y}.png", "https://s3.example.com/{z}/{x}/{y}.png"] +matrix_client_schildichat_location_sharing_map_style_content_sources_localsource_tiles: [] + +# Map attribution (optional): +# Attribution for OpenStreetMap would be like this: +# matrix_client_schildichat_location_sharing_map_style_content_sources_localsource_attribution: "© OpenStreetMap contributors" +# Leave blank, if map does not require attribution. +matrix_client_schildichat_location_sharing_map_style_content_sources_localsource_attribution: "" diff --git a/roles/custom/matrix-client-schildichat/tasks/main.yml b/roles/custom/matrix-client-schildichat/tasks/main.yml new file mode 100644 index 000000000..240dee1cf --- /dev/null +++ b/roles/custom/matrix-client-schildichat/tasks/main.yml @@ -0,0 +1,29 @@ +--- + +- tags: + - setup-all + - setup-client-schildichat + - install-all + - install-client-schildichat + block: + - when: matrix_client_schildichat_enabled | bool + ansible.builtin.include_tasks: "{{ role_path }}/tasks/validate_config.yml" + + - when: matrix_client_schildichat_enabled | bool + ansible.builtin.include_tasks: "{{ role_path }}/tasks/prepare_themes.yml" + + - when: matrix_client_schildichat_enabled | bool + ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_install.yml" + +- tags: + - setup-all + - setup-client-schildichat + block: + - when: not matrix_client_schildichat_enabled | bool + ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_uninstall.yml" + +- tags: + - self-check + block: + - when: matrix_client_schildichat_enabled | bool + ansible.builtin.include_tasks: "{{ role_path }}/tasks/self_check.yml" diff --git a/roles/custom/matrix-client-schildichat/tasks/prepare_themes.yml b/roles/custom/matrix-client-schildichat/tasks/prepare_themes.yml new file mode 100644 index 000000000..9e29ef90c --- /dev/null +++ b/roles/custom/matrix-client-schildichat/tasks/prepare_themes.yml @@ -0,0 +1,47 @@ +--- + +# +# Tasks related to setting up schildichat themes +# + +- when: matrix_client_schildichat_themes_enabled | bool + run_once: true + delegate_to: 127.0.0.1 + become: false + block: + - name: Ensure schildichat themes repository is pulled + ansible.builtin.git: + repo: "{{ matrix_client_schildichat_themes_repository_url }}" + version: "{{ matrix_client_schildichat_themes_repository_version }}" + dest: "{{ role_path }}/files/scratchpad/themes" + + - name: Find all schildichat theme files + ansible.builtin.find: + paths: "{{ role_path }}/files/scratchpad/themes" + patterns: "*.json" + recurse: true + register: matrix_client_schildichat_theme_file_list + + - name: Read schildichat theme + ansible.builtin.slurp: + path: "{{ item.path }}" + register: "matrix_client_schildichat_theme_file_contents" + with_items: "{{ matrix_client_schildichat_theme_file_list.files }}" + + - name: Load schildichat theme + ansible.builtin.set_fact: + matrix_client_schildichat_setting_defaults_custom_themes: "{{ matrix_client_schildichat_setting_defaults_custom_themes + [item['content'] | b64decode | from_json] }}" # noqa var-naming + with_items: "{{ matrix_client_schildichat_theme_file_contents.results }}" + +# +# Tasks related to getting rid of schildichat themes (if it was previously enabled) +# + +- name: Ensure schildichat themes repository is removed + ansible.builtin.file: + path: "{{ role_path }}/files/scratchpad/themes" + state: absent + run_once: true + delegate_to: 127.0.0.1 + become: false + when: "not matrix_client_schildichat_themes_enabled | bool" diff --git a/roles/custom/matrix-client-schildichat/tasks/self_check.yml b/roles/custom/matrix-client-schildichat/tasks/self_check.yml new file mode 100644 index 000000000..2963e2ba5 --- /dev/null +++ b/roles/custom/matrix-client-schildichat/tasks/self_check.yml @@ -0,0 +1,24 @@ +--- + +- ansible.builtin.set_fact: + matrix_client_schildichat_url_endpoint_public: "https://{{ matrix_server_fqn_schildichat }}/config.json" + +- name: Check schildichat + ansible.builtin.uri: + url: "{{ matrix_client_schildichat_url_endpoint_public }}" + follow_redirects: none + validate_certs: "{{ matrix_client_schildichat_self_check_validate_certificates }}" + register: matrix_client_schildichat_self_check_result + check_mode: false + ignore_errors: true + delegate_to: 127.0.0.1 + become: false + +- name: Fail if schildichat not working + ansible.builtin.fail: + msg: "Failed checking schildichat is up at `{{ matrix_server_fqn_schildichat }}` (checked endpoint: `{{ matrix_client_schildichat_url_endpoint_public }}`). Is schildichat running? Is port 443 open in your firewall? Full error: {{ matrix_client_schildichat_self_check_result }}" + when: "matrix_client_schildichat_self_check_result.failed or 'json' not in matrix_client_schildichat_self_check_result" + +- name: Report working schildichat + ansible.builtin.debug: + msg: "schildichat at `{{ matrix_server_fqn_schildichat }}` is working (checked endpoint: `{{ matrix_client_schildichat_url_endpoint_public }}`)" diff --git a/roles/custom/matrix-client-schildichat/tasks/setup_install.yml b/roles/custom/matrix-client-schildichat/tasks/setup_install.yml new file mode 100644 index 000000000..c2c7b7486 --- /dev/null +++ b/roles/custom/matrix-client-schildichat/tasks/setup_install.yml @@ -0,0 +1,109 @@ +--- + +- name: Ensure schildichat paths exists + ansible.builtin.file: + path: "{{ item.path }}" + state: directory + mode: 0750 + owner: "{{ matrix_user_username }}" + group: "{{ matrix_user_groupname }}" + with_items: + - {path: "{{ matrix_client_schildichat_data_path }}", when: true} + - {path: "{{ matrix_client_schildichat_docker_src_files_path }}", when: "{{ matrix_client_schildichat_container_image_self_build }}"} + when: "item.when | bool" + +- name: Ensure schildichat Docker image is pulled + community.docker.docker_image: + name: "{{ matrix_client_schildichat_docker_image }}" + source: "{{ 'pull' if ansible_version.major > 2 or ansible_version.minor > 7 else omit }}" + force_source: "{{ matrix_client_schildichat_docker_image_force_pull if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}" + force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else matrix_client_schildichat_docker_image_force_pull }}" + when: "not matrix_client_schildichat_container_image_self_build | bool" + register: result + retries: "{{ devture_playbook_help_container_retries_count }}" + delay: "{{ devture_playbook_help_container_retries_delay }}" + until: result is not failed + +- name: Ensure schildichat repository is present on self-build + ansible.builtin.git: + repo: "{{ matrix_client_schildichat_container_image_self_build_repo }}" + dest: "{{ matrix_client_schildichat_docker_src_files_path }}" + version: "{{ matrix_client_schildichat_docker_image.split(':')[1] }}" + force: "yes" + become: true + become_user: "{{ matrix_user_username }}" + register: matrix_client_schildichat_git_pull_results + when: "matrix_client_schildichat_container_image_self_build | bool" + +# See: +# - https://github.com/spantaleev/matrix-docker-ansible-deploy/issues/1357 +# - https://github.com/vector-im/schildichat-web/issues/19544 +- name: Patch webpack.config.js to support building on low-memory (<4G RAM) devices + ansible.builtin.lineinfile: + path: "{{ matrix_client_schildichat_docker_src_files_path }}/webpack.config.js" + regexp: '(\s+)splitChunks: \{' + line: '\1splitChunks: { maxSize: 100000,' + backrefs: true + owner: root + group: root + mode: '0644' + when: "matrix_client_schildichat_container_image_self_build | bool and matrix_client_schildichat_container_image_self_build_low_memory_system_patch_enabled | bool" + +- name: Ensure schildichat Docker image is built + ansible.builtin.command: + cmd: |- + {{ devture_systemd_docker_base_host_command_docker }} buildx build + --tag={{ matrix_client_schildichat_docker_image }} + --file={{ matrix_client_schildichat_docker_src_files_path }}/Dockerfile + {{ matrix_client_schildichat_docker_src_files_path }} + changed_when: true + when: matrix_client_schildichat_container_image_self_build | bool + +- name: Ensure schildichat configuration installed + ansible.builtin.copy: + content: "{{ matrix_client_schildichat_configuration | to_nice_json }}" + dest: "{{ matrix_client_schildichat_data_path }}/config.json" + mode: 0644 + owner: "{{ matrix_user_username }}" + group: "{{ matrix_user_groupname }}" + +- name: Ensure schildichat location sharing map style installed + when: matrix_client_schildichat_location_sharing_enabled | bool + ansible.builtin.copy: + content: "{{ matrix_client_schildichat_location_sharing_map_style | to_nice_json }}" + dest: "{{ matrix_client_schildichat_data_path }}/map_style.json" + mode: 0644 + owner: "{{ matrix_user_username }}" + group: "{{ matrix_user_groupname }}" + +- name: Ensure schildichat config files installed + ansible.builtin.template: + src: "{{ item.src }}" + dest: "{{ matrix_client_schildichat_data_path }}/{{ item.name }}" + mode: 0644 + owner: "{{ matrix_user_username }}" + group: "{{ matrix_user_groupname }}" + with_items: + - {src: "{{ role_path }}/templates/labels.j2", name: "labels"} + - {src: "{{ matrix_client_schildichat_page_template_welcome_path }}", name: "welcome.html"} + - {src: "{{ matrix_client_schildichat_embedded_pages_home_path }}", name: "home.html"} + when: "item.src is not none" + +- name: Ensure schildichat config files removed + ansible.builtin.file: + path: "{{ matrix_client_schildichat_data_path }}/{{ item.name }}" + state: absent + with_items: + - {src: "{{ matrix_client_schildichat_embedded_pages_home_path }}", name: "home.html"} + when: "item.src is none" + +- name: Ensure schildichat container network is created + community.general.docker_network: + name: "{{ matrix_client_schildichat_container_network }}" + driver: bridge + +- name: Ensure matrix-client-schildichat.service installed + ansible.builtin.template: + src: "{{ role_path }}/templates/systemd/matrix-client-schildichat.service.j2" + dest: "{{ devture_systemd_docker_base_systemd_path }}/matrix-client-schildichat.service" + mode: 0644 diff --git a/roles/custom/matrix-client-schildichat/tasks/setup_uninstall.yml b/roles/custom/matrix-client-schildichat/tasks/setup_uninstall.yml new file mode 100644 index 000000000..f752ba300 --- /dev/null +++ b/roles/custom/matrix-client-schildichat/tasks/setup_uninstall.yml @@ -0,0 +1,25 @@ +--- + +- name: Check existence of matrix-client-schildichat.service + ansible.builtin.stat: + path: "{{ devture_systemd_docker_base_systemd_path }}/matrix-client-schildichat.service" + register: matrix_client_schildichat_service_stat + +- when: matrix_client_schildichat_service_stat.stat.exists | bool + block: + - name: Ensure matrix-client-schildichat is stopped + ansible.builtin.service: + name: matrix-client-schildichat + state: stopped + enabled: false + daemon_reload: true + + - name: Ensure matrix-client-schildichat.service doesn't exist + ansible.builtin.file: + path: "{{ devture_systemd_docker_base_systemd_path }}/matrix-client-schildichat.service" + state: absent + + - name: Ensure schildichat path doesn't exist + ansible.builtin.file: + path: "{{ matrix_client_schildichat_data_path }}" + state: absent diff --git a/roles/custom/matrix-client-schildichat/tasks/validate_config.yml b/roles/custom/matrix-client-schildichat/tasks/validate_config.yml new file mode 100644 index 000000000..f01626453 --- /dev/null +++ b/roles/custom/matrix-client-schildichat/tasks/validate_config.yml @@ -0,0 +1,37 @@ +--- + +- name: Fail if required schildichat settings not defined + ansible.builtin.fail: + msg: > + You need to define a required configuration setting (`{{ item }}`) for using schildichat. + when: "vars[item] == ''" + with_items: + - "matrix_client_schildichat_default_hs_url" + +- name: Fail if schildichat location sharing enabled, but no tile server defined + ansible.builtin.fail: + msg: >- + You need to define at least one map tile server in matrix_client_schildichat_location_sharing_map_style_content_sources_localsource_tiles list + when: + - matrix_client_schildichat_location_sharing_enabled | bool + - matrix_client_schildichat_location_sharing_map_style_content_sources_localsource_tiles | length == 0 + +- when: matrix_client_schildichat_container_labels_traefik_enabled | bool + block: + - name: Fail if required matrix-client-schildichat Traefik settings not defined + ansible.builtin.fail: + msg: >- + You need to define a required configuration setting (`{{ item }}`). + when: "vars[item] == ''" + with_items: + - matrix_client_schildichat_container_labels_traefik_hostname + - matrix_client_schildichat_container_labels_traefik_path_prefix + + # We ensure it doesn't end with a slash, because we handle both (slash and no-slash). + # Knowing that `matrix_client_schildichat_container_labels_traefik_path_prefix` does not end with a slash + # ensures we know how to set these routes up without having to do "does it end with a slash" checks elsewhere. + - name: Fail if matrix_client_schildichat_container_labels_traefik_path_prefix ends with a slash + ansible.builtin.fail: + msg: >- + matrix_client_schildichat_container_labels_traefik_path_prefix (`{{ matrix_client_schildichat_container_labels_traefik_path_prefix }}`) must either be `/` or not end with a slash (e.g. `/schildichat`). + when: "matrix_client_schildichat_container_labels_traefik_path_prefix != '/' and matrix_client_schildichat_container_labels_traefik_path_prefix[-1] == '/'" diff --git a/roles/custom/matrix-client-schildichat/templates/config.json.j2 b/roles/custom/matrix-client-schildichat/templates/config.json.j2 new file mode 100644 index 000000000..fcf60f5d5 --- /dev/null +++ b/roles/custom/matrix-client-schildichat/templates/config.json.j2 @@ -0,0 +1,49 @@ +{ + "default_server_config": { + "m.homeserver": { + "base_url": {{ matrix_client_schildichat_default_hs_url | string | to_json }}, + "server_name": {{ matrix_client_schildichat_default_server_name | string | to_json }} + }, + "m.identity_server": { + "base_url": {{ matrix_client_schildichat_default_is_url | string | to_json }} + } + }, + "setting_defaults": { + "custom_themes": {{ matrix_client_schildichat_setting_defaults_custom_themes | to_json }} + }, + "default_theme": {{ matrix_client_schildichat_default_theme | string | to_json }}, + "default_country_code": {{ matrix_client_schildichat_default_country_code | string | to_json }}, + "permalink_prefix": {{ matrix_client_schildichat_permalink_prefix | string | to_json }}, + "disable_custom_urls": {{ matrix_client_schildichat_disable_custom_urls | to_json }}, + "disable_guests": {{ matrix_client_schildichat_disable_guests | to_json }}, + "brand": {{ matrix_client_schildichat_brand | to_json }}, + "integrations_ui_url": {{ matrix_client_schildichat_integrations_ui_url | string | to_json }}, + "integrations_rest_url": {{ matrix_client_schildichat_integrations_rest_url | string | to_json }}, + "integrations_widgets_urls": {{ matrix_client_schildichat_integrations_widgets_urls | to_json }}, + "integrations_jitsi_widget_url": {{ matrix_client_schildichat_integrations_jitsi_widget_url | string | to_json }}, + "bug_report_endpoint_url": {{ matrix_client_schildichat_bug_report_endpoint_url | to_json }}, + "show_labs_settings": {{ matrix_client_schildichat_show_lab_settings | to_json }}, + "room_directory": { + "servers": {{ matrix_client_schildichat_room_directory_servers | to_json }} + }, + "welcome_user_id": {{ matrix_client_schildichat_welcome_user_id | to_json }}, + {% if matrix_client_schildichat_enable_presence_by_hs_url is not none %} + "enable_presence_by_hs_url": {{ matrix_client_schildichat_enable_presence_by_hs_url | to_json }}, + {% endif %} + "embedded_pages": { + "homeUrl": {{ matrix_client_schildichat_embedded_pages_home_url | string | to_json }} + }, + {% if matrix_client_schildichat_jitsi_preferred_domain %} + "jitsi": { + "preferred_domain": {{ matrix_client_schildichat_jitsi_preferred_domain | to_json }} + }, + {% endif %} + {% if matrix_client_schildichat_location_sharing_enabled %} + "map_style_url": "https://{{ matrix_server_fqn_schildichat }}/map_style.json", + {% endif %} + "branding": { + "auth_footer_links": {{ matrix_client_schildichat_branding_auth_footer_links | to_json }}, + "auth_header_logo_url": {{ matrix_client_schildichat_branding_auth_header_logo_url | to_json }}, + "welcome_background_url": {{ matrix_client_schildichat_branding_welcome_background_url | to_json }} + } +} diff --git a/roles/custom/matrix-client-schildichat/templates/labels.j2 b/roles/custom/matrix-client-schildichat/templates/labels.j2 new file mode 100644 index 000000000..85e279821 --- /dev/null +++ b/roles/custom/matrix-client-schildichat/templates/labels.j2 @@ -0,0 +1,45 @@ +{% if matrix_client_schildichat_container_labels_traefik_enabled %} +traefik.enable=true + +{% if matrix_client_schildichat_container_labels_traefik_docker_network %} +traefik.docker.network={{ matrix_client_schildichat_container_labels_traefik_docker_network }} +{% endif %} + +{% set middlewares = [] %} + +{% if matrix_client_schildichat_container_labels_traefik_path_prefix != '/' %} +traefik.http.middlewares.matrix-client-schildichat-slashless-redirect.redirectregex.regex=({{ matrix_client_schildichat_container_labels_traefik_path_prefix | quote }})$ +traefik.http.middlewares.matrix-client-schildichat-slashless-redirect.redirectregex.replacement=${1}/ +{% set middlewares = middlewares + ['matrix-client-schildichat-slashless-redirect'] %} +{% endif %} + +{% if matrix_client_schildichat_container_labels_traefik_path_prefix != '/' %} +traefik.http.middlewares.matrix-client-schildichat-strip-prefix.stripprefix.prefixes={{ matrix_client_schildichat_container_labels_traefik_path_prefix }} +{% set middlewares = middlewares + ['matrix-client-schildichat-strip-prefix'] %} +{% endif %} + +{% if matrix_client_schildichat_container_labels_traefik_additional_response_headers.keys() | length > 0 %} +{% for name, value in matrix_client_schildichat_container_labels_traefik_additional_response_headers.items() %} +traefik.http.middlewares.matrix-client-schildichat-add-headers.headers.customresponseheaders.{{ name }}={{ value }} +{% endfor %} +{% set middlewares = middlewares + ['matrix-client-schildichat-add-headers'] %} +{% endif %} + +traefik.http.routers.matrix-client-schildichat.rule={{ matrix_client_schildichat_container_labels_traefik_rule }} +{% if matrix_client_schildichat_container_labels_traefik_priority | int > 0 %} +traefik.http.routers.matrix-client-schildichat.priority={{ matrix_client_schildichat_container_labels_traefik_priority }} +{% endif %} +traefik.http.routers.matrix-client-schildichat.service=matrix-client-schildichat +{% if middlewares | length > 0 %} +traefik.http.routers.matrix-client-schildichat.middlewares={{ middlewares | join(',') }} +{% endif %} +traefik.http.routers.matrix-client-schildichat.entrypoints={{ matrix_client_schildichat_container_labels_traefik_entrypoints }} +traefik.http.routers.matrix-client-schildichat.tls={{ matrix_client_schildichat_container_labels_traefik_tls | to_json }} +{% if matrix_client_schildichat_container_labels_traefik_tls %} +traefik.http.routers.matrix-client-schildichat.tls.certResolver={{ matrix_client_schildichat_container_labels_traefik_tls_certResolver }} +{% endif %} + +traefik.http.services.matrix-client-schildichat.loadbalancer.server.port=8080 +{% endif %} + +{{ matrix_client_schildichat_container_labels_additional_labels }} diff --git a/roles/custom/matrix-client-schildichat/templates/map_style.json.j2 b/roles/custom/matrix-client-schildichat/templates/map_style.json.j2 new file mode 100644 index 000000000..5889e0eb0 --- /dev/null +++ b/roles/custom/matrix-client-schildichat/templates/map_style.json.j2 @@ -0,0 +1,18 @@ +{ + "layers": [ + { + "id": "locallayer", + "source": "localsource", + "type": "raster" + } + ], + "sources": { + "localsource": { + "attribution": {{ matrix_client_schildichat_location_sharing_map_style_content_sources_localsource_attribution|to_json }}, + "tileSize": 256, + "tiles": {{ matrix_client_schildichat_location_sharing_map_style_content_sources_localsource_tiles|to_json }}, + "type": "raster" + } + }, + "version": 8 +} diff --git a/roles/custom/matrix-client-schildichat/templates/systemd/matrix-client-schildichat.service.j2 b/roles/custom/matrix-client-schildichat/templates/systemd/matrix-client-schildichat.service.j2 new file mode 100644 index 000000000..8905f1ed7 --- /dev/null +++ b/roles/custom/matrix-client-schildichat/templates/systemd/matrix-client-schildichat.service.j2 @@ -0,0 +1,57 @@ +#jinja2: lstrip_blocks: "True" +[Unit] +Description=Matrix schildichat server +{% for service in matrix_client_schildichat_systemd_required_services_list %} +Requires={{ service }} +After={{ service }} +{% endfor %} +DefaultDependencies=no + +[Service] +Type=simple +Environment="HOME={{ devture_systemd_docker_base_systemd_unit_home_path }}" +ExecStartPre=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} kill matrix-client-schildichat 2>/dev/null || true' +ExecStartPre=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} rm matrix-client-schildichat 2>/dev/null || true' + +ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} create \ + --rm \ + --name=matrix-client-schildichat \ + --log-driver=none \ + --user={{ matrix_user_uid }}:{{ matrix_user_gid }} \ + --cap-drop=ALL \ + --read-only \ + --network={{ matrix_client_schildichat_container_network }} \ + {% if matrix_client_schildichat_container_http_host_bind_port %} + -p {{ matrix_client_schildichat_container_http_host_bind_port }}:8080 \ + {% endif %} + --label-file={{ matrix_client_schildichat_data_path }}/labels \ + --tmpfs=/tmp:rw,noexec,nosuid,size=10m \ + --mount type=bind,src={{ matrix_client_schildichat_data_path }}/config.json,dst=/usr/share/nginx/html/config.json,ro \ + --mount type=bind,src={{ matrix_client_schildichat_data_path }}/config.json,dst=/usr/share/nginx/html/config.{{ matrix_server_fqn_schildichat }}.json,ro \ + {% if matrix_client_schildichat_location_sharing_enabled %} + --mount type=bind,src={{ matrix_client_schildichat_data_path }}/map_style.json,dst=/usr/share/nginx/html/map_style.json,ro \ + {% endif %} + {% if matrix_client_schildichat_embedded_pages_home_path is not none %} + --mount type=bind,src={{ matrix_client_schildichat_data_path }}/home.html,dst=/usr/share/nginx/html/home.html,ro \ + {% endif %} + --mount type=bind,src={{ matrix_client_schildichat_data_path }}/welcome.html,dst=/usr/share/nginx/html/welcome.html,ro \ + {% for arg in matrix_client_schildichat_container_extra_arguments %} + {{ arg }} \ + {% endfor %} + {{ matrix_client_schildichat_docker_image }} + +{% for network in matrix_client_schildichat_container_additional_networks %} +ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} network connect {{ network }} matrix-client-schildichat +{% endfor %} + +ExecStart={{ devture_systemd_docker_base_host_command_docker }} start --attach matrix-client-schildichat + +ExecStop=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} kill matrix-client-schildichat 2>/dev/null || true' +ExecStop=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} rm matrix-client-schildichat 2>/dev/null || true' + +Restart=always +RestartSec=30 +SyslogIdentifier=matrix-client-schildichat + +[Install] +WantedBy=multi-user.target diff --git a/roles/custom/matrix-client-schildichat/templates/welcome.html.j2 b/roles/custom/matrix-client-schildichat/templates/welcome.html.j2 new file mode 100644 index 000000000..f5b22b645 --- /dev/null +++ b/roles/custom/matrix-client-schildichat/templates/welcome.html.j2 @@ -0,0 +1,205 @@ +#jinja2: lstrip_blocks: "True" + + +
+ + + +

{{ matrix_client_schildichat_welcome_headline }}

+

{{ matrix_client_schildichat_welcome_text }}

+
+
+ +
_t("Sign In")
+ +{% if matrix_client_schildichat_registration_enabled %} + +
_t("Create Account")
+ +{% endif %} +
+{% if matrix_client_schildichat_disable_guests != true %} + + +
+ +
+ +{% endif %} +
+
diff --git a/roles/custom/matrix-client-schildichat/vars/main.yml b/roles/custom/matrix-client-schildichat/vars/main.yml new file mode 100644 index 000000000..bbd0d3dd0 --- /dev/null +++ b/roles/custom/matrix-client-schildichat/vars/main.yml @@ -0,0 +1,3 @@ +--- + +matrix_client_schildichat_embedded_pages_home_url: "{{ ('' if matrix_client_schildichat_embedded_pages_home_path is none else 'home.html') }}" diff --git a/roles/custom/matrix-nginx-proxy/defaults/main.yml b/roles/custom/matrix-nginx-proxy/defaults/main.yml index a817b225d..b67140ba4 100644 --- a/roles/custom/matrix-nginx-proxy/defaults/main.yml +++ b/roles/custom/matrix-nginx-proxy/defaults/main.yml @@ -212,6 +212,10 @@ matrix_nginx_proxy_proxy_hydrogen_hostname: "{{ matrix_server_fqn_hydrogen }}" matrix_nginx_proxy_proxy_cinny_enabled: false matrix_nginx_proxy_proxy_cinny_hostname: "{{ matrix_server_fqn_cinny }}" +# Controls whether proxying the schildichat domain should be done. +matrix_nginx_proxy_proxy_schildichat_enabled: false +matrix_nginx_proxy_proxy_schildichat_hostname: "{{ matrix_server_fqn_schildichat }}" + # Controls whether proxying the buscarron domain should be done. matrix_nginx_proxy_proxy_buscarron_enabled: false matrix_nginx_proxy_proxy_buscarron_hostname: "{{ matrix_server_fqn_buscarron }}" @@ -421,6 +425,9 @@ matrix_nginx_proxy_proxy_hydrogen_additional_server_configuration_blocks: [] # A list of strings containing additional configuration blocks to add to Cinny's server configuration (matrix-client-cinny.conf). matrix_nginx_proxy_proxy_cinny_additional_server_configuration_blocks: [] +# A list of strings containing additional configuration blocks to add to schildichat's server configuration (matrix-client-schildichat.conf). +matrix_nginx_proxy_proxy_schildichat_additional_server_configuration_blocks: [] + # A list of strings containing additional configuration blocks to add to buscarron's server configuration (matrix-bot-buscarron.conf). matrix_nginx_proxy_proxy_buscarron_additional_server_configuration_blocks: [] @@ -701,12 +708,3 @@ matrix_nginx_proxy_proxy_matrix_nginx_status_allowed_addresses: ['{{ ansible_def # http://nginx.org/en/docs/ngx_core_module.html#worker_connections matrix_nginx_proxy_worker_processes: auto matrix_nginx_proxy_worker_connections: 1024 - -# A mapping of JVB server ids to hostname/ipa addresses used to add additional jvb blocks -# to the Jitsi's server configuration (matrix-jitsi.conf) -# Note: avoid using the JVB server id "jvb-1" as this is reserved for the main host. -# Example: -# matrix_nginx_proxy_proxy_jitsi_additional_jvbs: -# jvb-2: 192.168.0.1 -# jvb-3: 192.168.0.2 -matrix_nginx_proxy_proxy_jitsi_additional_jvbs: {} diff --git a/roles/custom/matrix-nginx-proxy/tasks/setup_nginx_proxy.yml b/roles/custom/matrix-nginx-proxy/tasks/setup_nginx_proxy.yml index 2c54d6759..600a3f08f 100644 --- a/roles/custom/matrix-nginx-proxy/tasks/setup_nginx_proxy.yml +++ b/roles/custom/matrix-nginx-proxy/tasks/setup_nginx_proxy.yml @@ -115,6 +115,13 @@ mode: 0644 when: matrix_nginx_proxy_proxy_cinny_enabled | bool +- name: Ensure Matrix nginx-proxy configuration for schildichat domain exists + ansible.builtin.template: + src: "{{ role_path }}/templates/nginx/conf.d/matrix-client-schildichat.conf.j2" + dest: "{{ matrix_nginx_proxy_confd_path }}/matrix-client-schildichat.conf" + mode: 0644 + when: matrix_nginx_proxy_proxy_schildichat_enabled | bool + - name: Ensure Matrix nginx-proxy configuration for buscarron domain exists ansible.builtin.template: src: "{{ role_path }}/templates/nginx/conf.d/matrix-bot-buscarron.conf.j2" diff --git a/roles/custom/matrix-nginx-proxy/tasks/validate_config.yml b/roles/custom/matrix-nginx-proxy/tasks/validate_config.yml index 8d63876a8..6f96ec786 100644 --- a/roles/custom/matrix-nginx-proxy/tasks/validate_config.yml +++ b/roles/custom/matrix-nginx-proxy/tasks/validate_config.yml @@ -16,6 +16,7 @@ - {'old': 'matrix_nginx_proxy_reload_cron_time_definition', 'new': ''} - {'old': 'matrix_nginx_proxy_container_labels_traefik_proxy_matrix_rule', 'new': ''} - {'old': 'matrix_nginx_proxy_container_labels_traefik_proxy_matrix_hostname', 'new': ''} + - {'old': 'matrix_nginx_proxy_proxy_jitsi_additional_jvbs', 'new': ''} - name: Fail on unknown matrix_ssl_retrieval_method ansible.builtin.fail: diff --git a/roles/custom/matrix-nginx-proxy/templates/nginx/conf.d/matrix-client-schildichat.conf.j2 b/roles/custom/matrix-nginx-proxy/templates/nginx/conf.d/matrix-client-schildichat.conf.j2 new file mode 100644 index 000000000..4919eb9ef --- /dev/null +++ b/roles/custom/matrix-nginx-proxy/templates/nginx/conf.d/matrix-client-schildichat.conf.j2 @@ -0,0 +1,106 @@ +#jinja2: lstrip_blocks: "True" + +{% macro render_vhost_directives() %} + gzip on; + gzip_types text/plain application/json application/javascript text/css image/x-icon font/ttf image/gif; + + {% if matrix_nginx_proxy_hsts_preload_enabled %} + add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always; + {% else %} + add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always; + {% endif %} + add_header X-Content-Type-Options nosniff; + add_header X-XSS-Protection "{{ matrix_nginx_proxy_xss_protection }}"; + add_header X-Frame-Options SAMEORIGIN; + add_header Content-Security-Policy "frame-ancestors 'self'"; + + {% if matrix_nginx_proxy_floc_optout_enabled %} + add_header Permissions-Policy interest-cohort=() always; + {% endif %} + + + {% for configuration_block in matrix_nginx_proxy_proxy_schildichat_additional_server_configuration_blocks %} + {{- configuration_block }} + {% endfor %} + + location / { + {% if matrix_nginx_proxy_enabled %} + {# Use the embedded DNS resolver in Docker containers to discover the service #} + resolver {{ matrix_nginx_proxy_http_level_resolver }} valid=5s; + set $backend "matrix-client-schildichat:8080"; + proxy_pass http://$backend; + {% else %} + {# Generic configuration for use outside of our container setup #} + proxy_pass http://127.0.0.1:8765; + {% endif %} + + proxy_set_header Host $host; + proxy_set_header X-Forwarded-For {{ matrix_nginx_proxy_x_forwarded_for }}; + } +{% endmacro %} + +server { + listen {{ 8080 if matrix_nginx_proxy_enabled else 80 }}; + listen [::]:{{ 8080 if matrix_nginx_proxy_enabled else 80 }}; + + + server_name {{ matrix_nginx_proxy_proxy_schildichat_hostname }}; + + server_tokens off; + root /dev/null; + + {% if matrix_nginx_proxy_https_enabled %} + location /.well-known/acme-challenge { + {% if matrix_nginx_proxy_enabled %} + {# Use the embedded DNS resolver in Docker containers to discover the service #} + resolver {{ matrix_nginx_proxy_http_level_resolver }} valid=5s; + set $backend "matrix-certbot:8080"; + proxy_pass http://$backend; + {% else %} + {# Generic configuration for use outside of our container setup #} + proxy_pass http://127.0.0.1:{{ matrix_ssl_lets_encrypt_certbot_standalone_http_port }}; + {% endif %} + } + + location / { + return 301 https://$http_host$request_uri; + } + {% else %} + {{ render_vhost_directives() }} + {% endif %} +} + +{% if matrix_nginx_proxy_https_enabled %} +server { + listen {{ 8443 if matrix_nginx_proxy_enabled else 443 }} ssl http2; + listen [::]:{{ 8443 if matrix_nginx_proxy_enabled else 443 }} ssl http2; + + server_name {{ matrix_nginx_proxy_proxy_schildichat_hostname }}; + + server_tokens off; + root /dev/null; + + ssl_certificate {{ matrix_ssl_config_dir_path }}/live/{{ matrix_nginx_proxy_proxy_schildichat_hostname }}/fullchain.pem; + ssl_certificate_key {{ matrix_ssl_config_dir_path }}/live/{{ matrix_nginx_proxy_proxy_schildichat_hostname }}/privkey.pem; + + ssl_protocols {{ matrix_nginx_proxy_ssl_protocols }}; + {% if matrix_nginx_proxy_ssl_ciphers != "" %} + ssl_ciphers {{ matrix_nginx_proxy_ssl_ciphers }}; + {% endif %} + ssl_prefer_server_ciphers {{ matrix_nginx_proxy_ssl_prefer_server_ciphers }}; + + {% if matrix_nginx_proxy_ocsp_stapling_enabled %} + ssl_stapling on; + ssl_stapling_verify on; + ssl_trusted_certificate {{ matrix_ssl_config_dir_path }}/live/{{ matrix_nginx_proxy_proxy_schildichat_hostname }}/chain.pem; + {% endif %} + + {% if matrix_nginx_proxy_ssl_session_tickets_off %} + ssl_session_tickets off; + {% endif %} + ssl_session_cache {{ matrix_nginx_proxy_ssl_session_cache }}; + ssl_session_timeout {{ matrix_nginx_proxy_ssl_session_timeout }}; + + {{ render_vhost_directives() }} +} +{% endif %} diff --git a/roles/custom/matrix-nginx-proxy/templates/nginx/conf.d/matrix-jitsi.conf.j2 b/roles/custom/matrix-nginx-proxy/templates/nginx/conf.d/matrix-jitsi.conf.j2 index 5493c2b00..f745f866c 100644 --- a/roles/custom/matrix-nginx-proxy/templates/nginx/conf.d/matrix-jitsi.conf.j2 +++ b/roles/custom/matrix-nginx-proxy/templates/nginx/conf.d/matrix-jitsi.conf.j2 @@ -53,10 +53,10 @@ tcp_nodelay on; } - {% for id, ip_address in matrix_nginx_proxy_proxy_jitsi_additional_jvbs.items() %} + {% for host in groups['jitsi_jvb_servers'] | default([]) %} # colibri (JVB) websockets for additional JVBs - location ~ ^/colibri-ws/{{ id | regex_escape }}/(.*) { - proxy_pass http://{{ ip_address }}:9090/colibri-ws/{{ id }}/$1$is_args$args; + location ~ ^/colibri-ws/{{ hostvars[host]['jitsi_jvb_server_id'] | regex_escape }}/(.*) { + proxy_pass http://{{ host }}:9090/colibri-ws/{{ hostvars[host]['jitsi_jvb_server_id'] }}/$1$is_args$args; proxy_set_header Host $host; proxy_set_header X-Forwarded-For {{ matrix_nginx_proxy_x_forwarded_for }}; diff --git a/roles/custom/matrix-nginx-proxy/templates/nginx/conf.d/matrix-ntfy.conf.j2 b/roles/custom/matrix-nginx-proxy/templates/nginx/conf.d/matrix-ntfy.conf.j2 index 7d5c8a0ed..fbae47e17 100644 --- a/roles/custom/matrix-nginx-proxy/templates/nginx/conf.d/matrix-ntfy.conf.j2 +++ b/roles/custom/matrix-nginx-proxy/templates/nginx/conf.d/matrix-ntfy.conf.j2 @@ -21,7 +21,7 @@ {% if matrix_nginx_proxy_enabled %} {# Use the embedded DNS resolver in Docker containers to discover the service #} resolver {{ matrix_nginx_proxy_http_level_resolver }} valid=5s; - set $backend "matrix-ntfy:80"; + set $backend "matrix-ntfy:8080"; proxy_pass http://$backend; {% else %} {# Generic configuration for use outside of our container setup #} diff --git a/roles/custom/matrix-sliding-sync/defaults/main.yml b/roles/custom/matrix-sliding-sync/defaults/main.yml index c0347d2f9..73e794c25 100644 --- a/roles/custom/matrix-sliding-sync/defaults/main.yml +++ b/roles/custom/matrix-sliding-sync/defaults/main.yml @@ -1,10 +1,11 @@ --- # Sliding Sync Proxy is an implementation of MSC3575 for the new sliding sync +# Project source code URL: https://github.com/matrix-org/sliding-sync matrix_sliding_sync_enabled: true -matrix_sliding_sync_version: v0.99.5 +matrix_sliding_sync_version: v0.99.10 matrix_sliding_sync_scheme: https diff --git a/roles/custom/matrix-synapse/defaults/main.yml b/roles/custom/matrix-synapse/defaults/main.yml index c48ff09c6..9b62bc536 100644 --- a/roles/custom/matrix-synapse/defaults/main.yml +++ b/roles/custom/matrix-synapse/defaults/main.yml @@ -4,7 +4,7 @@ matrix_synapse_enabled: true -matrix_synapse_version: v1.90.0 +matrix_synapse_version: v1.92.1 matrix_synapse_username: '' matrix_synapse_uid: '' @@ -438,7 +438,24 @@ matrix_synapse_container_additional_volumes: [] # A list of additional loggers to register in synapse.log.config. # This list gets populated dynamically based on Synapse extensions that have been enabled. # Contains definition objects like this: `{"name": "..", "level": "DEBUG"} -matrix_synapse_additional_loggers: [] +matrix_synapse_additional_loggers: "{{ matrix_synapse_additional_loggers_auto + matrix_synapse_additional_loggers_custom }}" + +matrix_synapse_additional_loggers_auto: + # By default, we're disabling some useless (and even toxic) spammy WARNING-level logs. + # Related to: + # - https://github.com/matrix-org/synapse/issues/16208 + # - https://github.com/matrix-org/synapse/issues/16101 + # - https://github.com/spantaleev/matrix-docker-ansible-deploy/issues/2853 + - name: synapse.http.matrixfederationclient + level: CRITICAL + - name: synapse.federation.sender.per_destination_queue + level: CRITICAL + - name: synapse.handlers.device + level: CRITICAL + - name: synapse.replication.tcp.handler + level: CRITICAL + +matrix_synapse_additional_loggers_custom: [] # A list of appservice config files (in-container filesystem paths). # This list gets populated dynamically based on Synapse extensions that have been enabled. @@ -825,7 +842,7 @@ matrix_synapse_ext_spam_checker_synapse_simple_antispam_config_blocked_homeserve # See: https://github.com/matrix-org/mjolnir#synapse-module matrix_synapse_ext_spam_checker_mjolnir_antispam_enabled: false matrix_synapse_ext_spam_checker_mjolnir_antispam_git_repository_url: "https://github.com/matrix-org/mjolnir" -matrix_synapse_ext_spam_checker_mjolnir_antispam_git_version: "4008e3f65d3745b9307dd31f1c5aa80c13a61a58" +matrix_synapse_ext_spam_checker_mjolnir_antispam_git_version: "v1.6.4" matrix_synapse_ext_spam_checker_mjolnir_antispam_config_block_invites: true # Flag messages sent by servers/users in the ban lists as spam. Currently # this means that spammy messages will appear as empty to users. Default @@ -840,7 +857,16 @@ matrix_synapse_ext_spam_checker_mjolnir_antispam_config_block_usernames: false # these rooms. # ["!roomid:example.org"] matrix_synapse_ext_spam_checker_mjolnir_antispam_config_ban_lists: [] - +# A dictionary with various fields controlling max length. +# See https://github.com/matrix-org/mjolnir/blob/main/docs/synapse_module.md for details. +matrix_synapse_ext_spam_checker_mjolnir_antispam_config_message_max_length: {} +# Actual configuration passed to the mjolnir-antispam Synapse module +matrix_synapse_ext_spam_checker_mjolnir_antispam_config: + block_invites: "{{ matrix_synapse_ext_spam_checker_mjolnir_antispam_config_block_invites }}" + block_messages: "{{ matrix_synapse_ext_spam_checker_mjolnir_antispam_config_block_messages }}" + block_usernames: "{{ matrix_synapse_ext_spam_checker_mjolnir_antispam_config_block_usernames }}" + ban_lists: "{{ matrix_synapse_ext_spam_checker_mjolnir_antispam_config_ban_lists }}" + message_max_length: "{{ matrix_synapse_ext_spam_checker_mjolnir_antispam_config_message_max_length }}" # Enable this to activate the E2EE disabling Synapse module. # See: https://github.com/digitalentity/matrix_encryption_disabler @@ -943,12 +969,6 @@ matrix_synapse_default_room_version: "10" # The upstream default is `false`, but we try to make Synapse less wasteful of resources, so we do things differently. matrix_synapse_forget_rooms_on_leave: true -# Controls the Synapse `spam_checker` setting. -# -# If a spam-checker extension is enabled, this variable's value is set automatically by the playbook during runtime. -# If not, you can also control its value manually. -matrix_synapse_spam_checker: [] - # Controls the Synapse `modules` list. # You can define your own list of modules here. See the `modules` syntax in `homeserver.yaml.j2` # Certain Synapse extensions that you can enable below auto-inject themselves into `matrix_synapse_modules` at runtime. @@ -988,9 +1008,9 @@ matrix_synapse_redaction_retention_period: 7d matrix_synapse_user_ips_max_age: 28d -matrix_synapse_rust_synapse_compress_state_docker_image: "{{ matrix_synapse_rust_synapse_compress_state_docker_image_name_prefix }}mb-saces/rust-synapse-compress-state:latest" +matrix_synapse_rust_synapse_compress_state_docker_image: "{{ matrix_synapse_rust_synapse_compress_state_docker_image_name_prefix }}mb-saces/rust-synapse-tools:v0.0.1" matrix_synapse_rust_synapse_compress_state_docker_image_name_prefix: "registry.gitlab.com/" -matrix_synapse_rust_synapse_compress_state_docker_image_force_pull: "{{ matrix_synapse_rust_synapse_compress_state_docker_image.endswith(':latest') }}" +matrix_synapse_rust_synapse_compress_state_docker_image_force_pull: "{{ matrix_synapse_rust_synapse_compress_state_docker_image.endswith(':stable') or matrix_synapse_rust_synapse_compress_state_docker_image.endswith(':latest') }}" matrix_synapse_rust_synapse_compress_state_base_path: "{{ matrix_base_data_path }}/rust-synapse-compress-state" matrix_synapse_rust_synapse_compress_state_synapse_compress_state_in_container_path: "/usr/local/bin/synapse_compress_state" diff --git a/roles/custom/matrix-synapse/tasks/ext/encryption-disabler/setup_install.yml b/roles/custom/matrix-synapse/tasks/ext/encryption-disabler/setup_install.yml index 3725545fd..b8046033b 100644 --- a/roles/custom/matrix-synapse/tasks/ext/encryption-disabler/setup_install.yml +++ b/roles/custom/matrix-synapse/tasks/ext/encryption-disabler/setup_install.yml @@ -33,9 +33,9 @@ ["--mount type=bind,src={{ matrix_synapse_ext_path }}/matrix_e2ee_filter.py,dst={{ matrix_synapse_in_container_python_packages_path }}/matrix_e2ee_filter.py,ro"] }} - matrix_synapse_additional_loggers: > + matrix_synapse_additional_loggers_auto: > {{ - matrix_synapse_additional_loggers + matrix_synapse_additional_loggers_auto + [{'name': 'matrix_e2ee_filter', 'level': 'INFO'}] }} diff --git a/roles/custom/matrix-synapse/tasks/ext/ldap-auth/setup_install.yml b/roles/custom/matrix-synapse/tasks/ext/ldap-auth/setup_install.yml index c13a04044..6d4843771 100644 --- a/roles/custom/matrix-synapse/tasks/ext/ldap-auth/setup_install.yml +++ b/roles/custom/matrix-synapse/tasks/ext/ldap-auth/setup_install.yml @@ -3,9 +3,9 @@ - ansible.builtin.set_fact: matrix_synapse_password_providers_enabled: true - matrix_synapse_additional_loggers: > + matrix_synapse_additional_loggers_auto: > {{ - matrix_synapse_additional_loggers + matrix_synapse_additional_loggers_auto + [{'name': 'ldap_auth_provider', 'level': 'INFO'}] }} diff --git a/roles/custom/matrix-synapse/tasks/ext/mjolnir-antispam/setup_install.yml b/roles/custom/matrix-synapse/tasks/ext/mjolnir-antispam/setup_install.yml index f32188080..0fc2a7506 100644 --- a/roles/custom/matrix-synapse/tasks/ext/mjolnir-antispam/setup_install.yml +++ b/roles/custom/matrix-synapse/tasks/ext/mjolnir-antispam/setup_install.yml @@ -14,18 +14,13 @@ become_user: "{{ matrix_synapse_username }}" - ansible.builtin.set_fact: - matrix_synapse_spam_checker: > + matrix_synapse_modules: > {{ - matrix_synapse_spam_checker + matrix_synapse_modules | default([]) + [{ - "module": "mjolnir.AntiSpam", - "config": { - "block_invites": matrix_synapse_ext_spam_checker_mjolnir_antispam_config_block_invites, - "block_messages": matrix_synapse_ext_spam_checker_mjolnir_antispam_config_block_messages, - "block_usernames": matrix_synapse_ext_spam_checker_mjolnir_antispam_config_block_usernames, - "ban_lists": matrix_synapse_ext_spam_checker_mjolnir_antispam_config_ban_lists, - } + "module": "mjolnir.Module", + "config": matrix_synapse_ext_spam_checker_mjolnir_antispam_config, }] }} diff --git a/roles/custom/matrix-synapse/tasks/ext/rest-auth/setup_install.yml b/roles/custom/matrix-synapse/tasks/ext/rest-auth/setup_install.yml index ad58830a6..4c59a4b1f 100644 --- a/roles/custom/matrix-synapse/tasks/ext/rest-auth/setup_install.yml +++ b/roles/custom/matrix-synapse/tasks/ext/rest-auth/setup_install.yml @@ -28,9 +28,9 @@ ["--mount type=bind,src={{ matrix_synapse_ext_path }}/rest_auth_provider.py,dst={{ matrix_synapse_in_container_python_packages_path }}/rest_auth_provider.py,ro"] }} - matrix_synapse_additional_loggers: > + matrix_synapse_additional_loggers_auto: > {{ - matrix_synapse_additional_loggers + matrix_synapse_additional_loggers_auto + [{'name': 'rest_auth_provider', 'level': 'INFO'}] }} diff --git a/roles/custom/matrix-synapse/tasks/ext/shared-secret-auth/setup_install.yml b/roles/custom/matrix-synapse/tasks/ext/shared-secret-auth/setup_install.yml index c974bd2cf..ecec3e803 100644 --- a/roles/custom/matrix-synapse/tasks/ext/shared-secret-auth/setup_install.yml +++ b/roles/custom/matrix-synapse/tasks/ext/shared-secret-auth/setup_install.yml @@ -43,9 +43,9 @@ ["--mount type=bind,src={{ matrix_synapse_ext_path }}/shared_secret_authenticator.py,dst={{ matrix_synapse_in_container_python_packages_path }}/shared_secret_authenticator.py,ro"] }} - matrix_synapse_additional_loggers: > + matrix_synapse_additional_loggers_auto: > {{ - matrix_synapse_additional_loggers + matrix_synapse_additional_loggers_auto + [{'name': 'shared_secret_authenticator', 'level': 'INFO'}] }} diff --git a/roles/custom/matrix-synapse/tasks/main.yml b/roles/custom/matrix-synapse/tasks/main.yml index 743dab5fe..2a8a00942 100644 --- a/roles/custom/matrix-synapse/tasks/main.yml +++ b/roles/custom/matrix-synapse/tasks/main.yml @@ -36,8 +36,8 @@ - setup-all - setup-synapse block: - - when: not matrix_synapse_enabled | bool - ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_uninstall.yml" + # This always runs because it handles uninstallation for sub-components too. + - ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_uninstall.yml" - tags: - import-synapse-media-store diff --git a/roles/custom/matrix-synapse/tasks/setup_uninstall.yml b/roles/custom/matrix-synapse/tasks/setup_uninstall.yml index 7ce5e13dd..66cda3e7d 100644 --- a/roles/custom/matrix-synapse/tasks/setup_uninstall.yml +++ b/roles/custom/matrix-synapse/tasks/setup_uninstall.yml @@ -4,7 +4,8 @@ - setup-all - setup-synapse block: - - ansible.builtin.include_tasks: "{{ role_path }}/tasks/ext/setup_uninstall.yml" + - when: not matrix_synapse_enabled | bool + ansible.builtin.include_tasks: "{{ role_path }}/tasks/ext/setup_uninstall.yml" - tags: - setup-all @@ -17,7 +18,8 @@ - setup-all - setup-synapse block: - - ansible.builtin.include_tasks: "{{ role_path }}/tasks/synapse/setup_uninstall.yml" + - when: not matrix_synapse_enabled | bool + ansible.builtin.include_tasks: "{{ role_path }}/tasks/synapse/setup_uninstall.yml" - tags: - setup-all diff --git a/roles/custom/matrix-synapse/tasks/validate_config.yml b/roles/custom/matrix-synapse/tasks/validate_config.yml index 607c75b8c..64397a493 100644 --- a/roles/custom/matrix-synapse/tasks/validate_config.yml +++ b/roles/custom/matrix-synapse/tasks/validate_config.yml @@ -66,7 +66,7 @@ - {'old': 'matrix_synapse_ext_s3_storage_provider_path', 'new': 'matrix_synapse_ext_s3_storage_provider_base_path'} - {'old': 'matrix_synapse_send_federation', 'new': ''} - {'old': 'matrix_synapse_start_pushers', 'new': ''} - + - {'old': 'matrix_synapse_spam_checker', 'new': ''} - name: (Deprecation) Catch and report renamed settings in matrix_synapse_configuration_extension_yaml ansible.builtin.fail: diff --git a/roles/custom/matrix-synapse/templates/synapse/homeserver.yaml.j2 b/roles/custom/matrix-synapse/templates/synapse/homeserver.yaml.j2 index e12bdb194..7b1c1dfd1 100644 --- a/roles/custom/matrix-synapse/templates/synapse/homeserver.yaml.j2 +++ b/roles/custom/matrix-synapse/templates/synapse/homeserver.yaml.j2 @@ -2570,20 +2570,6 @@ push: #group_unread_count_by_room: false -# Spam checkers are third-party modules that can block specific actions -# of local users, such as creating rooms and registering undesirable -# usernames, as well as remote users by redacting incoming events. -# -# spam_checker: - #- module: "my_custom_project.SuperSpamChecker" - # config: - # example_option: 'things' - #- module: "some_other_project.BadEventStopper" - # config: - # example_stop_events_from: ['@bad:example.com'] -spam_checker: {{ matrix_synapse_spam_checker|to_json }} - - ## Rooms ## # Controls whether locally-created rooms should be end-to-end encrypted by diff --git a/roles/custom/matrix-synapse/vars/main.yml b/roles/custom/matrix-synapse/vars/main.yml index a12b44017..47cbc2a01 100644 --- a/roles/custom/matrix-synapse/vars/main.yml +++ b/roles/custom/matrix-synapse/vars/main.yml @@ -170,6 +170,7 @@ matrix_synapse_workers_generic_worker_endpoints: - ^/_matrix/client/(r0|v3|unstable)/user/.*/filter(/|$) - ^/_matrix/client/(api/v1|r0|v3|unstable)/directory/room/.*$ - ^/_matrix/client/(r0|v3|unstable)/capabilities$ + - ^/_matrix/client/(r0|v3|unstable)/notifications$ # Encryption requests # Note that ^/_matrix/client/(r0|v3|unstable)/keys/upload/ requires `worker_main_http_uri` diff --git a/setup.yml b/setup.yml index 0c324700f..8c58b74ed 100644 --- a/setup.yml +++ b/setup.yml @@ -102,6 +102,7 @@ - custom/matrix-client-element - custom/matrix-client-hydrogen - custom/matrix-client-cinny + - custom/matrix-client-schildichat - galaxy/jitsi - custom/matrix-user-verification-service - custom/matrix-ldap-registration-proxy