Merge branch 'spantaleev:master' into 3031-feat-add-signalgo-bridge

group_vars/matrix_servers

@@ -2188,6 +2188,20 @@ matrix_corporal_container_image_self_build: "{{ matrix_architecture not in ['amd
 matrix_corporal_container_http_gateway_host_bind_port: "{{ (matrix_playbook_service_host_bind_interface_prefix ~ '41080') if matrix_playbook_service_host_bind_interface_prefix else '' }}"
 matrix_corporal_container_http_api_host_bind_port: "{{ (matrix_playbook_service_host_bind_interface_prefix ~ '41081') if matrix_playbook_service_host_bind_interface_prefix else '' }}"
 
+matrix_corporal_container_labels_traefik_enabled: "{{ matrix_playbook_reverse_proxy_type in ['playbook-managed-traefik', 'other-traefik-container'] }}"
+matrix_corporal_container_labels_traefik_docker_network: "{{ matrix_playbook_reverse_proxyable_services_additional_network }}"
+matrix_corporal_container_labels_traefik_entrypoints: "{{ devture_traefik_entrypoint_primary }}"
+matrix_corporal_container_labels_traefik_tls_certResolver: "{{ devture_traefik_certResolver_primary }}"
+
+matrix_corporal_container_additional_networks: |
+  {{
+    (
+      ([matrix_playbook_reverse_proxyable_services_additional_network] if matrix_playbook_reverse_proxyable_services_additional_network else [])
+      +
+      ([matrix_nginx_proxy_container_network] if matrix_nginx_proxy_enabled and matrix_nginx_proxy_container_network != matrix_corporal_container_network else [])
+    ) | unique
+  }}
+
 matrix_corporal_systemd_required_services_list: |
   {{
     (['docker.service'])
@@ -2796,7 +2810,7 @@ matrix_nginx_proxy_container_labels_traefik_tls_certResolver: "{{ devture_traefi
 
 matrix_nginx_proxy_container_labels_traefik_proxy_matrix_enabled: true
 
-matrix_nginx_proxy_proxy_matrix_corporal_api_enabled: "{{ matrix_corporal_enabled and matrix_corporal_http_api_enabled }}"
+matrix_nginx_proxy_proxy_matrix_corporal_api_enabled: "{{ matrix_corporal_enabled and matrix_corporal_http_api_enabled and matrix_playbook_reverse_proxy_type in ['playbook-managed-nginx', 'other-nginx-non-container'] }}"
 matrix_nginx_proxy_proxy_matrix_corporal_api_addr_with_container: "matrix-corporal:41081"
 matrix_nginx_proxy_proxy_matrix_corporal_api_addr_sans_container: "127.0.0.1:41081"
 
@@ -4283,6 +4297,12 @@ matrix_user_creator_users_auto: |
       'initial_type': 'admin',
     }] if matrix_bot_matrix_registration_bot_enabled else [])
     +
+    ([{
+      'username': matrix_bot_chatgpt_matrix_bot_username_localpart,
+      'initial_password': matrix_bot_chatgpt_matrix_bot_password,
+      'initial_type': 'bot',
+    }] if matrix_bot_chatgpt_enabled and matrix_bot_chatgpt_matrix_bot_password | length > 0 else [])
+    +
     ([{
       'username': matrix_bot_matrix_reminder_bot_matrix_user_id_localpart,
       'initial_password': matrix_bot_matrix_reminder_bot_matrix_user_password,

roles/custom/matrix-corporal/defaults/main.yml

@@ -4,6 +4,9 @@
 
 matrix_corporal_enabled: true
 
+# renovate: datasource=docker depName=devture/matrix-corporal
+matrix_corporal_version: 2.7.0
+
 matrix_corporal_container_image_self_build: false
 matrix_corporal_container_image_self_build_repo: "https://github.com/devture/matrix-corporal.git"
 
@@ -20,11 +23,45 @@ matrix_corporal_container_http_api_host_bind_port: ''
 # A list of extra arguments to pass to the container
 matrix_corporal_container_extra_arguments: []
 
+# The base container network. It will be auto-created by this role if it doesn't exist already.
+matrix_corporal_container_network: "{{ matrix_docker_network }}"
+
+# A list of additional container networks that the container would be connected to.
+# The role does not create these networks, so make sure they already exist.
+# Use this to expose this container to another reverse proxy, which runs in a different container network.
+matrix_corporal_container_additional_networks: "{{ matrix_corporal_container_additional_networks_auto + matrix_corporal_container_additional_networks_custom }}"
+matrix_corporal_container_additional_networks_auto: []
+matrix_corporal_container_additional_networks_custom: []
+
+# matrix_corporal_container_labels_traefik_enabled controls whether labels to assist a Traefik reverse-proxy will be attached to the container.
+# See `../templates/labels.j2` for details.
+#
+# To inject your own other container labels, see `matrix_corporal_container_labels_additional_labels`.
+matrix_corporal_container_labels_traefik_enabled: true
+matrix_corporal_container_labels_traefik_docker_network: "{{ matrix_corporal_container_network }}"
+matrix_corporal_container_labels_traefik_entrypoints: web-secure
+matrix_corporal_container_labels_traefik_tls: "{{ matrix_corporal_container_labels_traefik_entrypoints != 'web' }}"
+matrix_corporal_container_labels_traefik_tls_certResolver: default  # noqa var-naming
+
+# Controls whether labels will be added that expose matrix-corporal's HTTP API
+matrix_corporal_container_labels_api_enabled: "{{ matrix_corporal_http_api_enabled }}"
+matrix_corporal_container_labels_api_traefik_rule: "Host(`{{ matrix_corporal_matrix_homeserver_api_domain_name }}`) && PathPrefix(`/_matrix/corporal`)"
+matrix_corporal_container_labels_api_traefik_priority: 0
+matrix_corporal_container_labels_api_traefik_entrypoints: "{{ matrix_corporal_container_labels_traefik_entrypoints }}"
+matrix_corporal_container_labels_api_traefik_tls: "{{ matrix_corporal_container_labels_traefik_tls }}"
+matrix_corporal_container_labels_api_traefik_tls_certResolver: "{{ matrix_corporal_container_labels_traefik_tls_certResolver }}"  # noqa var-naming
+
+# matrix_corporal_container_labels_additional_labels contains a multiline string with additional labels to add to the container label file.
+# See `../templates/labels.j2` for details.
+#
+# Example:
+# matrix_corporal_container_labels_additional_labels: |
+#   my.label=1
+#   another.label="here"
+matrix_corporal_container_labels_additional_labels: ''
+
 # List of systemd services that matrix-corporal.service depends on
 matrix_corporal_systemd_required_services_list: ['docker.service']
-
-# renovate: datasource=docker depName=devture/matrix-corporal
-matrix_corporal_version: 2.7.0
 matrix_corporal_docker_image: "{{ matrix_corporal_docker_image_name_prefix }}devture/matrix-corporal:{{ matrix_corporal_docker_image_tag }}"
 matrix_corporal_docker_image_name_prefix: "{{ 'localhost/' if matrix_corporal_container_image_self_build else matrix_container_global_registry_prefix }}"
 matrix_corporal_docker_image_tag: "{{ matrix_corporal_version }}"  # for backward-compatibility
@@ -37,6 +74,7 @@ matrix_corporal_cache_dir_path: "{{ matrix_corporal_base_path }}/cache"
 matrix_corporal_var_dir_path: "{{ matrix_corporal_base_path }}/var"
 
 matrix_corporal_matrix_homeserver_domain_name: "{{ matrix_domain }}"
+matrix_corporal_matrix_homeserver_api_domain_name: "{{ matrix_server_fqn_matrix }}"
 
 # Controls where matrix-corporal can reach your Synapse server (e.g. "http://matrix-synapse-reverse-proxy-companion:{{ matrix_synapse_container_client_api_port }}").
 # If Synapse runs on the same machine, you may need to add its service to `matrix_corporal_systemd_required_services_list`.

roles/custom/matrix-corporal/tasks/setup_install.yml

@@ -8,6 +8,7 @@
     owner: "{{ matrix_user_username }}"
     group: "{{ matrix_user_groupname }}"
   with_items:
+    - "{{ matrix_corporal_base_path }}"
     - "{{ matrix_corporal_config_dir_path }}"
     - "{{ matrix_corporal_cache_dir_path }}"
     - "{{ matrix_corporal_var_dir_path }}"
@@ -55,6 +56,16 @@
     owner: "{{ matrix_user_username }}"
     group: "{{ matrix_user_groupname }}"
 
+- name: Ensure Matrix Corporal support files installed
+  ansible.builtin.template:
+    src: "{{ role_path }}/templates/{{ item }}.j2"
+    dest: "{{ matrix_corporal_base_path }}/{{ item }}"
+    mode: 0640
+    owner: "{{ matrix_user_username }}"
+    group: "{{ matrix_user_groupname }}"
+  with_items:
+    - labels
+
 - name: Ensure matrix-corporal.service installed
   ansible.builtin.template:
     src: "{{ role_path }}/templates/systemd/matrix-corporal.service.j2"

roles/custom/matrix-corporal/templates/labels.j2

@@ -0,0 +1,26 @@
+{% if matrix_corporal_container_labels_traefik_enabled %}
+traefik.enable=true
+
+{% if matrix_corporal_container_labels_traefik_docker_network %}
+traefik.docker.network={{ matrix_corporal_container_labels_traefik_docker_network }}
+{% endif %}
+
+{# HTTP API #}
+{% if matrix_corporal_container_labels_api_enabled %}
+traefik.http.routers.matrix-corporal-api.rule={{ matrix_corporal_container_labels_api_traefik_rule }}
+{% if matrix_corporal_container_labels_api_traefik_priority | int > 0 %}
+traefik.http.routers.matrix-corporal-api.priority={{ matrix_corporal_container_labels_api_traefik_priority }}
+{% endif %}
+traefik.http.routers.matrix-corporal-api.service=matrix-corporal-api
+traefik.http.routers.matrix-corporal-api.entrypoints={{ matrix_corporal_container_labels_api_traefik_entrypoints }}
+traefik.http.routers.matrix-corporal-api.tls={{ matrix_corporal_container_labels_api_traefik_tls | to_json }}
+{% if matrix_corporal_container_labels_api_traefik_tls %}
+traefik.http.routers.matrix-corporal-api.tls.certResolver={{ matrix_corporal_container_labels_api_traefik_tls_certResolver }}
+{% endif %}
+traefik.http.services.matrix-corporal-api.loadbalancer.server.port=41081
+{% endif %}
+
+
+{% endif %}
+
+{{ matrix_corporal_container_labels_additional_labels }}

roles/custom/matrix-corporal/templates/systemd/matrix-corporal.service.j2

@@ -13,12 +13,15 @@ Environment="HOME={{ devture_systemd_docker_base_systemd_unit_home_path }}"
 ExecStartPre=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} stop --time={{ devture_systemd_docker_base_container_stop_grace_time_seconds }} matrix-corporal 2>/dev/null || true'
 ExecStartPre=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} rm matrix-corporal 2>/dev/null || true'
 
-ExecStart={{ devture_systemd_docker_base_host_command_docker }} run --rm --name matrix-corporal \
+ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} create \
+			--rm \
+			--name=matrix-corporal \
 			--log-driver=none \
 			--user={{ matrix_user_uid }}:{{ matrix_user_gid }} \
 			--cap-drop=ALL \
 			--read-only \
-			--network={{ matrix_docker_network }} \
+			--network={{ matrix_corporal_container_network }} \
+			--label-file={{ matrix_corporal_base_path }}/labels \
 			{% if matrix_corporal_container_http_gateway_host_bind_port %}
 			-p {{ matrix_corporal_container_http_gateway_host_bind_port }}:41080 \
 			{% endif %}
@@ -34,6 +37,12 @@ ExecStart={{ devture_systemd_docker_base_host_command_docker }} run --rm --name
 			{{ matrix_corporal_docker_image }} \
 			/matrix-corporal -config=/etc/matrix-corporal/config.json
 
+{% for network in matrix_corporal_container_additional_networks %}
+ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} network connect {{ network }} matrix-corporal
+{% endfor %}
+
+ExecStart={{ devture_systemd_docker_base_host_command_docker }} start --attach matrix-corporal
+
 ExecStop=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} stop --time={{ devture_systemd_docker_base_container_stop_grace_time_seconds }} matrix-corporal 2>/dev/null || true'
 ExecStop=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} rm matrix-corporal 2>/dev/null || true'
 Restart=always