diff --git a/roles/custom/matrix-matrixto/defaults/main.yml b/roles/custom/matrix-matrixto/defaults/main.yml index 748781ffe..702ffdabe 100644 --- a/roles/custom/matrix-matrixto/defaults/main.yml +++ b/roles/custom/matrix-matrixto/defaults/main.yml @@ -9,111 +9,111 @@ --- # Project source code URL: https://app.radicle.xyz/nodes/seed.radicle.garden/rad%3Az3Re1EQbd186vUQDwHByYiLadsVWY -matrixto_enabled: true +matrix_matrixto_enabled: true -matrixto_identifier: matrix-matrixto -matrixto_base_path: "/{{ matrixto_identifier }}" +matrix_matrixto_identifier: matrix-matrixto +matrix_matrixto_base_path: "/{{ matrix_matrixto_identifier }}" -matrixto_version: 1.2.17-1 +matrix_matrixto_version: 1.2.17-1 -matrixto_scheme: https +matrix_matrixto_scheme: https # The hostname at which Matrix.to is served. -matrixto_hostname: "" +matrix_matrixto_hostname: "" # The path at which Matrix.to is exposed. # This value must either be `/` or not end with a slash (e.g. `/matrixto`). # # Hosting Matrix.to under a subpath does not seem to be possible due to Matrix.to's # technical limitations. -matrixto_path_prefix: / +matrix_matrixto_path_prefix: / -matrixto_container_image: "{{ matrixto_container_image_registry_prefix }}shirahara/matrixto:{{ matrixto_container_image_tag }}" -matrixto_container_image_tag: "{{ matrixto_version }}" -matrixto_container_image_registry_prefix: "{{ matrixto_container_image_registry_prefix_upstream }}" -matrixto_container_image_registry_prefix_upstream: "{{ matrixto_container_image_registry_prefix_upstream_default }}" -matrixto_container_image_registry_prefix_upstream_default: "" -matrixto_container_image_force_pull: "{{ matrixto_container_image.endswith(':latest') }}" +matrix_matrixto_container_image: "{{ matrix_matrixto_container_image_registry_prefix }}shirahara/matrixto:{{ matrix_matrixto_container_image_tag }}" +matrix_matrixto_container_image_tag: "{{ matrix_matrixto_version }}" +matrix_matrixto_container_image_registry_prefix: "{{ matrix_matrixto_container_image_registry_prefix_upstream }}" +matrix_matrixto_container_image_registry_prefix_upstream: "{{ matrix_matrixto_container_image_registry_prefix_upstream_default }}" +matrix_matrixto_container_image_registry_prefix_upstream_default: "" +matrix_matrixto_container_image_force_pull: "{{ matrix_matrixto_container_image.endswith(':latest') }}" -matrixto_container_image_self_build: true -matrixto_container_image_self_build_name: "shirahara/matrixto:{{ matrixto_container_image_self_build_repo_version }}" -matrixto_container_image_self_build_repo: "https://seed.radicle.garden/z3Re1EQbd186vUQDwHByYiLadsVWY.git" -matrixto_container_image_self_build_repo_version: "{{ matrixto_version if matrixto_version != 'latest' else 'main' }}" -matrixto_container_image_self_build_src_files_path: "{{ matrixto_base_path }}/docker-src" +matrix_matrixto_container_image_self_build: true +matrix_matrixto_container_image_self_build_name: "shirahara/matrixto:{{ matrix_matrixto_container_image_self_build_repo_version }}" +matrix_matrixto_container_image_self_build_repo: "https://seed.radicle.garden/z3Re1EQbd186vUQDwHByYiLadsVWY.git" +matrix_matrixto_container_image_self_build_repo_version: "{{ matrix_matrixto_version if matrix_matrixto_version != 'latest' else 'main' }}" +matrix_matrixto_container_image_self_build_src_files_path: "{{ matrix_matrixto_base_path }}/docker-src" # Controls whether the container exposes its HTTP port (tcp/8080 in the container). # # Takes an ":" or "" value (e.g. "127.0.0.1:2586"), or empty string to not expose. -matrixto_container_http_host_bind_port: "" +matrix_matrixto_container_http_host_bind_port: "" # The base container network. It will be auto-created by this role if it doesn't exist already. -matrixto_container_network: "{{ matrixto_identifier }}" +matrix_matrixto_container_network: "{{ matrix_matrixto_identifier }}" # The port number in the container -matrixto_container_http_port: 5000 +matrix_matrixto_container_http_port: 5000 # A list of additional container networks that the container would be connected to. # The role does not create these networks, so make sure they already exist. # Use this to expose this container to another reverse proxy, which runs in a different container network. -matrixto_container_additional_networks: "{{ matrixto_container_additional_networks_auto + matrixto_container_additional_networks_custom }}" -matrixto_container_additional_networks_auto: [] -matrixto_container_additional_networks_custom: [] +matrix_matrixto_container_additional_networks: "{{ matrix_matrixto_container_additional_networks_auto + matrix_matrixto_container_additional_networks_custom }}" +matrix_matrixto_container_additional_networks_auto: [] +matrix_matrixto_container_additional_networks_custom: [] # A list of additional "volumes" to mount in the container. # This list gets populated dynamically at runtime. You can provide a different default value, # if you wish to mount your own files into the container. # Contains definition objects like this: `{"type": "bind", "src": "/outside", "dst": "/inside", "options": "readonly"}. # See the `--mount` documentation for the `docker run` command. -matrixto_container_additional_volumes: "{{ matrixto_container_additional_volumes_auto + matrixto_container_additional_volumes_custom }}" -matrixto_container_additional_volumes_auto: [] -matrixto_container_additional_volumes_custom: [] +matrix_matrixto_container_additional_volumes: "{{ matrix_matrixto_container_additional_volumes_auto + matrix_matrixto_container_additional_volumes_custom }}" +matrix_matrixto_container_additional_volumes_auto: [] +matrix_matrixto_container_additional_volumes_custom: [] -# matrixto_container_labels_traefik_enabled controls whether labels to assist a Traefik reverse-proxy will be attached to the container. +# matrix_matrixto_container_labels_traefik_enabled controls whether labels to assist a Traefik reverse-proxy will be attached to the container. # See `../templates/labels.j2` for details. # -# To inject your own other container labels, see `matrixto_container_labels_additional_labels`. -matrixto_container_labels_traefik_enabled: true -matrixto_container_labels_traefik_docker_network: "{{ matrixto_container_network }}" -matrixto_container_labels_traefik_hostname: "{{ matrixto_hostname }}" +# To inject your own other container labels, see `matrix_matrixto_container_labels_additional_labels`. +matrix_matrixto_container_labels_traefik_enabled: true +matrix_matrixto_container_labels_traefik_docker_network: "{{ matrix_matrixto_container_network }}" +matrix_matrixto_container_labels_traefik_hostname: "{{ matrix_matrixto_hostname }}" # The path prefix must either be `/` or not end with a slash (e.g. `/matrixto`). -matrixto_container_labels_traefik_path_prefix: "{{ matrixto_path_prefix }}" -matrixto_container_labels_traefik_rule: "Host(`{{ matrixto_container_labels_traefik_hostname }}`){% if matrixto_container_labels_traefik_path_prefix != '/' %} && PathPrefix(`{{ matrixto_container_labels_traefik_path_prefix }}`){% endif %}" -matrixto_container_labels_traefik_priority: 0 -matrixto_container_labels_traefik_entrypoints: web-secure -matrixto_container_labels_traefik_tls: "{{ matrixto_container_labels_traefik_entrypoints != 'web' }}" -matrixto_container_labels_traefik_tls_certResolver: default # noqa var-naming +matrix_matrixto_container_labels_traefik_path_prefix: "{{ matrix_matrixto_path_prefix }}" +matrix_matrixto_container_labels_traefik_rule: "Host(`{{ matrix_matrixto_container_labels_traefik_hostname }}`){% if matrix_matrixto_container_labels_traefik_path_prefix != '/' %} && PathPrefix(`{{ matrix_matrixto_container_labels_traefik_path_prefix }}`){% endif %}" +matrix_matrixto_container_labels_traefik_priority: 0 +matrix_matrixto_container_labels_traefik_entrypoints: web-secure +matrix_matrixto_container_labels_traefik_tls: "{{ matrix_matrixto_container_labels_traefik_entrypoints != 'web' }}" +matrix_matrixto_container_labels_traefik_tls_certResolver: default # noqa var-naming # Controls which additional headers to attach to all HTTP requests. -# To add your own custom request headers, use `matrixto_container_labels_traefik_additional_request_headers_custom` -matrixto_container_labels_traefik_additional_request_headers: "{{ matrixto_container_labels_traefik_additional_request_headers_auto | combine(matrixto_container_labels_traefik_additional_request_headers_custom) }}" -matrixto_container_labels_traefik_additional_request_headers_auto: {} -matrixto_container_labels_traefik_additional_request_headers_custom: {} +# To add your own custom request headers, use `matrix_matrixto_container_labels_traefik_additional_request_headers_custom` +matrix_matrixto_container_labels_traefik_additional_request_headers: "{{ matrix_matrixto_container_labels_traefik_additional_request_headers_auto | combine(matrix_matrixto_container_labels_traefik_additional_request_headers_custom) }}" +matrix_matrixto_container_labels_traefik_additional_request_headers_auto: {} +matrix_matrixto_container_labels_traefik_additional_request_headers_custom: {} # Controls which additional headers to attach to all HTTP responses. -# To add your own custom response headers, use `matrixto_container_labels_traefik_additional_response_headers_custom` -matrixto_container_labels_traefik_additional_response_headers: "{{ matrixto_container_labels_traefik_additional_response_headers_auto | combine(matrixto_container_labels_traefik_additional_response_headers_custom) }}" -matrixto_container_labels_traefik_additional_response_headers_auto: | +# To add your own custom response headers, use `matrix_matrixto_container_labels_traefik_additional_response_headers_custom` +matrix_matrixto_container_labels_traefik_additional_response_headers: "{{ matrix_matrixto_container_labels_traefik_additional_response_headers_auto | combine(matrix_matrixto_container_labels_traefik_additional_response_headers_custom) }}" +matrix_matrixto_container_labels_traefik_additional_response_headers_auto: | {{ {} - | combine ({'X-XSS-Protection': matrixto_http_header_xss_protection} if matrixto_http_header_xss_protection else {}) - | combine ({'X-Content-Type-Options': matrixto_http_header_content_type_options} if matrixto_http_header_content_type_options else {}) - | combine ({'Content-Security-Policy': matrixto_http_header_content_security_policy} if matrixto_http_header_content_security_policy else {}) - | combine ({'Permissions-Policy': matrixto_http_header_permissions_policy} if matrixto_http_header_permissions_policy else {}) - | combine ({'Strict-Transport-Security': matrixto_http_header_strict_transport_security} if matrixto_http_header_strict_transport_security and matrixto_container_labels_traefik_tls else {}) + | combine ({'X-XSS-Protection': matrix_matrixto_http_header_xss_protection} if matrix_matrixto_http_header_xss_protection else {}) + | combine ({'X-Content-Type-Options': matrix_matrixto_http_header_content_type_options} if matrix_matrixto_http_header_content_type_options else {}) + | combine ({'Content-Security-Policy': matrix_matrixto_http_header_content_security_policy} if matrix_matrixto_http_header_content_security_policy else {}) + | combine ({'Permissions-Policy': matrix_matrixto_http_header_permissions_policy} if matrix_matrixto_http_header_permissions_policy else {}) + | combine ({'Strict-Transport-Security': matrix_matrixto_http_header_strict_transport_security} if matrix_matrixto_http_header_strict_transport_security and matrix_matrixto_container_labels_traefik_tls else {}) }} -matrixto_container_labels_traefik_additional_response_headers_custom: {} +matrix_matrixto_container_labels_traefik_additional_response_headers_custom: {} -# matrixto_container_labels_additional_labels contains a multiline string with additional labels to add to the container label file. +# matrix_matrixto_container_labels_additional_labels contains a multiline string with additional labels to add to the container label file. # See `../templates/labels.j2` for details. # # Example: -# matrixto_container_labels_additional_labels: | +# matrix_matrixto_container_labels_additional_labels: | # my.label=1 # another.label="here" -matrixto_container_labels_additional_labels: "" +matrix_matrixto_container_labels_additional_labels: "" # A list of extra arguments to pass to the container (`docker run` command) -matrixto_container_extra_arguments: [] +matrix_matrixto_container_extra_arguments: [] # Specifies the value of the `X-XSS-Protection` header # Stops pages from loading when they detect reflected cross-site scripting (XSS) attacks. @@ -121,23 +121,23 @@ matrixto_container_extra_arguments: [] # Learn more about it is here: # - https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-XSS-Protection # - https://portswigger.net/web-security/cross-site-scripting/reflected -matrixto_http_header_xss_protection: "1; mode=block" +matrix_matrixto_http_header_xss_protection: "1; mode=block" # Specifies the value of the `X-Content-Type-Options` header. # See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Content-Type-Options -matrixto_http_header_content_type_options: nosniff +matrix_matrixto_http_header_content_type_options: nosniff # Specifies the value of the `Content-Security-Policy` header. # See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy -matrixto_http_header_content_security_policy: frame-ancestors 'self' +matrix_matrixto_http_header_content_security_policy: frame-ancestors 'self' # Specifies the value of the `Permissions-Policy` header. # See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Permissions-Policy -matrixto_http_header_permissions_policy: "{{ 'interest-cohort=()' if matrixto_floc_optout_enabled else '' }}" +matrix_matrixto_http_header_permissions_policy: "{{ 'interest-cohort=()' if matrix_matrixto_floc_optout_enabled else '' }}" # Specifies the value of the `Strict-Transport-Security` header. # See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security -matrixto_http_header_strict_transport_security: "max-age=31536000; includeSubDomains{{ '; preload' if matrixto_hsts_preload_enabled else '' }}" +matrix_matrixto_http_header_strict_transport_security: "max-age=31536000; includeSubDomains{{ '; preload' if matrix_matrixto_hsts_preload_enabled else '' }}" # Controls whether to send a "Permissions-Policy interest-cohort=();" header along with all responses # @@ -147,8 +147,8 @@ matrixto_http_header_strict_transport_security: "max-age=31536000; includeSubDom # - https://amifloced.org/ # # Of course, a better solution is to just stop using browsers (like Chrome), which participate in such tracking practices. -# See: `matrixto_http_header_permissions_policy` -matrixto_floc_optout_enabled: true +# See: `matrix_matrixto_http_header_permissions_policy` +matrix_matrixto_floc_optout_enabled: true # Controls if HSTS preloading is enabled # @@ -159,20 +159,20 @@ matrixto_floc_optout_enabled: true # - https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security # - https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security # - https://hstspreload.org/#opt-in -# See: `matrixto_http_header_strict_transport_security` -matrixto_hsts_preload_enabled: false +# See: `matrix_matrixto_http_header_strict_transport_security` +matrix_matrixto_hsts_preload_enabled: false # List of systemd services that the Matrix.to systemd service depends on -matrixto_systemd_required_services_list: "{{ matrixto_systemd_required_services_list_default + matrixto_systemd_required_services_list_auto + matrixto_systemd_required_services_list_custom }}" -matrixto_systemd_required_services_list_default: "{{ [devture_systemd_docker_base_docker_service_name] if devture_systemd_docker_base_docker_service_name else [] }}" -matrixto_systemd_required_services_list_auto: [] -matrixto_systemd_required_services_list_custom: [] +matrix_matrixto_systemd_required_services_list: "{{ matrix_matrixto_systemd_required_services_list_default + matrix_matrixto_systemd_required_services_list_auto + matrix_matrixto_systemd_required_services_list_custom }}" +matrix_matrixto_systemd_required_services_list_default: "{{ [devture_systemd_docker_base_docker_service_name] if devture_systemd_docker_base_docker_service_name else [] }}" +matrix_matrixto_systemd_required_services_list_auto: [] +matrix_matrixto_systemd_required_services_list_custom: [] # List of systemd services that the Matrix.to systemd service wants -matrixto_systemd_wanted_services_list: "{{ matrixto_systemd_wanted_services_list_default + matrixto_systemd_wanted_services_list_auto + matrixto_systemd_wanted_services_list_custom }}" -matrixto_systemd_wanted_services_list_default: [] -matrixto_systemd_wanted_services_list_auto: [] -matrixto_systemd_wanted_services_list_custom: [] +matrix_matrixto_systemd_wanted_services_list: "{{ matrix_matrixto_systemd_wanted_services_list_default + matrix_matrixto_systemd_wanted_services_list_auto + matrix_matrixto_systemd_wanted_services_list_custom }}" +matrix_matrixto_systemd_wanted_services_list_default: [] +matrix_matrixto_systemd_wanted_services_list_auto: [] +matrix_matrixto_systemd_wanted_services_list_custom: [] # Additional environment variables. -matrixto_environment_variables_additional_variables: "" +matrix_matrixto_environment_variables_additional_variables: "" diff --git a/roles/custom/matrix-matrixto/tasks/install.yml b/roles/custom/matrix-matrixto/tasks/install.yml index fa78fa33a..51a316c43 100644 --- a/roles/custom/matrix-matrixto/tasks/install.yml +++ b/roles/custom/matrix-matrixto/tasks/install.yml @@ -12,12 +12,12 @@ owner: "{{ matrix_user_name }}" group: "{{ matrix_group_name }}" with_items: - - "{{ matrixto_base_path }}" + - "{{ matrix_matrixto_base_path }}" - name: Ensure Matrix.to support files installed ansible.builtin.template: src: "{{ role_path }}/templates/{{ item }}.j2" - dest: "{{ matrixto_base_path }}/{{ item }}" + dest: "{{ matrix_matrixto_base_path }}/{{ item }}" mode: "0640" owner: "{{ matrix_user_name }}" group: "{{ matrix_group_name }}" @@ -26,15 +26,15 @@ - labels - name: Run if self-building of Matrix.to container image is not enabled - when: "not matrixto_container_image_self_build | bool" + when: "not matrix_matrixto_container_image_self_build | bool" block: - name: Ensure Matrix.to container image is pulled via community.docker.docker_image when: devture_systemd_docker_base_container_image_pull_method == 'ansible-module' community.docker.docker_image: - name: "{{ matrixto_container_image }}" + name: "{{ matrix_matrixto_container_image }}" source: "{{ 'pull' if ansible_version.major > 2 or ansible_version.minor > 7 else omit }}" - force_source: "{{ matrixto_container_image_force_pull if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}" - force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else matrixto_container_image_force_pull }}" + force_source: "{{ matrix_matrixto_container_image_force_pull if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}" + force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else matrix_matrixto_container_image_force_pull }}" register: result retries: "{{ devture_playbook_help_container_retries_count }}" delay: "{{ devture_playbook_help_container_retries_delay }}" @@ -43,7 +43,7 @@ - name: Ensure Matrix.to container image is pulled via ansible.builtin.command when: devture_systemd_docker_base_container_image_pull_method == 'command' ansible.builtin.command: - cmd: "{{ devture_systemd_docker_base_host_command_docker }} pull {{ matrixto_container_image }}" + cmd: "{{ devture_systemd_docker_base_host_command_docker }} pull {{ matrix_matrixto_container_image }}" register: result retries: "{{ devture_playbook_help_container_retries_count }}" delay: "{{ devture_playbook_help_container_retries_delay }}" @@ -51,25 +51,25 @@ changed_when: "'Downloaded newer image' in result.stdout" - name: Run if self-building of Matrix.to container image is enabled - when: "matrixto_container_image_self_build | bool" + when: "matrix_matrixto_container_image_self_build | bool" block: - name: Ensure Matrix.to repository is present on self-build ansible.builtin.git: - repo: "{{ matrixto_container_image_self_build_repo }}" - version: "{{ matrixto_container_image_self_build_repo_version }}" - dest: "{{ matrixto_container_image_self_build_src_files_path }}" + repo: "{{ matrix_matrixto_container_image_self_build_repo }}" + version: "{{ matrix_matrixto_container_image_self_build_repo_version }}" + dest: "{{ matrix_matrixto_container_image_self_build_src_files_path }}" force: "yes" - register: matrixto_git_pull_results + register: matrix_matrixto_git_pull_results - name: Ensure Matrix.to container image is built community.docker.docker_image: - name: "{{ matrixto_container_image_self_build_name }}" + name: "{{ matrix_matrixto_container_image_self_build_name }}" source: build - force_source: "{{ matrixto_git_pull_results.changed if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}" - force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else matrixto_git_pull_results.changed }}" + force_source: "{{ matrix_matrixto_git_pull_results.changed if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}" + force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else matrix_matrixto_git_pull_results.changed }}" build: dockerfile: Dockerfile - path: "{{ matrixto_container_image_self_build_src_files_path }}" + path: "{{ matrix_matrixto_container_image_self_build_src_files_path }}" pull: true args: @@ -77,7 +77,7 @@ when: devture_systemd_docker_base_container_network_creation_method == 'ansible-module' community.docker.docker_network: enable_ipv6: "{{ devture_systemd_docker_base_ipv6_enabled }}" - name: "{{ matrixto_container_network }}" + name: "{{ matrix_matrixto_container_network }}" driver: bridge driver_options: "{{ devture_systemd_docker_base_container_networks_driver_options }}" @@ -88,7 +88,7 @@ {{ devture_systemd_docker_base_host_command_docker }} network create {% if devture_systemd_docker_base_ipv6_enabled %}--ipv6{% endif %} {{ devture_systemd_docker_base_container_networks_driver_options_string }} - {{ matrixto_container_network }} + {{ matrix_matrixto_container_network }} register: network_creation_result changed_when: network_creation_result.rc == 0 failed_when: network_creation_result.rc != 0 and 'already exists' not in network_creation_result.stderr @@ -96,5 +96,5 @@ - name: Ensure Matrix.to systemd service is present ansible.builtin.template: src: "{{ role_path }}/templates/systemd/matrix-matrixto.service.j2" - dest: "{{ devture_systemd_docker_base_systemd_path }}/{{ matrixto_identifier }}.service" + dest: "{{ devture_systemd_docker_base_systemd_path }}/{{ matrix_matrixto_identifier }}.service" mode: "0644" diff --git a/roles/custom/matrix-matrixto/tasks/main.yml b/roles/custom/matrix-matrixto/tasks/main.yml index 3de2759af..c600287f5 100644 --- a/roles/custom/matrix-matrixto/tasks/main.yml +++ b/roles/custom/matrix-matrixto/tasks/main.yml @@ -5,7 +5,7 @@ --- - name: Perform Matrix.to installation tasks - when: matrixto_enabled | bool + when: matrix_matrixto_enabled | bool tags: - setup-all - setup-matrixto @@ -18,7 +18,7 @@ ansible.builtin.include_tasks: "{{ role_path }}/tasks/install.yml" - name: Perform Matrix.to uninstallation tasks - when: not matrixto_enabled | bool + when: not matrix_matrixto_enabled | bool tags: - setup-all - setup-matrixto diff --git a/roles/custom/matrix-matrixto/tasks/uninstall.yml b/roles/custom/matrix-matrixto/tasks/uninstall.yml index b8f4f7f74..8eb66b561 100644 --- a/roles/custom/matrix-matrixto/tasks/uninstall.yml +++ b/roles/custom/matrix-matrixto/tasks/uninstall.yml @@ -6,28 +6,28 @@ --- - name: Check existence of Matrix.to systemd service ansible.builtin.stat: - path: "{{ devture_systemd_docker_base_systemd_path }}/{{ matrixto_identifier }}.service" - register: matrixto_service_stat + path: "{{ devture_systemd_docker_base_systemd_path }}/{{ matrix_matrixto_identifier }}.service" + register: matrix_matrixto_service_stat - name: Uninstall Matrix.to systemd services and files - when: matrixto_service_stat.stat.exists | bool + when: matrix_matrixto_service_stat.stat.exists | bool block: - name: Ensure Matrix.to systemd service is stopped ansible.builtin.service: - name: "{{ matrixto_identifier }}" + name: "{{ matrix_matrixto_identifier }}" state: stopped enabled: false daemon_reload: true - name: Ensure Matrix.to systemd service does not exist ansible.builtin.file: - path: "{{ devture_systemd_docker_base_systemd_path }}/{{ matrixto_identifier }}.service" + path: "{{ devture_systemd_docker_base_systemd_path }}/{{ matrix_matrixto_identifier }}.service" state: absent - name: Ensure Matrix.to container network does not exist via community.docker.docker_network when: devture_systemd_docker_base_container_network_creation_method == 'ansible-module' community.docker.docker_network: - name: "{{ matrixto_container_network }}" + name: "{{ matrix_matrixto_container_network }}" state: absent - name: Ensure Matrix.to container network does not exist via ansible.builtin.command @@ -35,11 +35,11 @@ ansible.builtin.command: cmd: >- {{ devture_systemd_docker_base_host_command_docker }} network rm - {{ matrixto_container_network }} + {{ matrix_matrixto_container_network }} register: network_deletion_result - changed_when: matrixto_container_network in network_deletion_result.stdout + changed_when: matrix_matrixto_container_network in network_deletion_result.stdout - name: Ensure Matrix.to path does not exist ansible.builtin.file: - path: "{{ matrixto_base_path }}" + path: "{{ matrix_matrixto_base_path }}" state: absent diff --git a/roles/custom/matrix-matrixto/tasks/validate_config.yml b/roles/custom/matrix-matrixto/tasks/validate_config.yml index 36d7806c0..f7d807d18 100644 --- a/roles/custom/matrix-matrixto/tasks/validate_config.yml +++ b/roles/custom/matrix-matrixto/tasks/validate_config.yml @@ -10,12 +10,12 @@ You need to define a required configuration setting (`{{ item }}`). when: "lookup('vars', item, default='') | string | length == 0" with_items: - - matrixto_hostname - - matrixto_path_prefix - - matrixto_container_network + - matrix_matrixto_hostname + - matrix_matrixto_path_prefix + - matrix_matrixto_container_network - name: Run if Traefik is enabled - when: matrixto_container_labels_traefik_enabled | bool + when: matrix_matrixto_container_labels_traefik_enabled | bool block: - name: Fail if Traefik settings required for Matrix.to are not defined ansible.builtin.fail: @@ -23,21 +23,21 @@ You need to define a required configuration setting (`{{ item }}`). when: "lookup('vars', item, default='') | string | length == 0" with_items: - - matrixto_container_labels_traefik_hostname - - matrixto_container_labels_traefik_path_prefix + - matrix_matrixto_container_labels_traefik_hostname + - matrix_matrixto_container_labels_traefik_path_prefix - - name: Fail if matrixto_container_labels_traefik_path_prefix is different than / + - name: Fail if matrix_matrixto_container_labels_traefik_path_prefix is different than / ansible.builtin.fail: msg: >- - matrixto_container_labels_traefik_path_prefix (`{{ matrixto_container_labels_traefik_path_prefix }}`) must be `/`. + matrix_matrixto_container_labels_traefik_path_prefix (`{{ matrix_matrixto_container_labels_traefik_path_prefix }}`) must be `/`. Matrix.to does not support hosting under a subpath yet. - when: "matrixto_container_labels_traefik_path_prefix != '/'" + when: "matrix_matrixto_container_labels_traefik_path_prefix != '/'" # We ensure it doesn't end with a slash, because we handle both (slash and no-slash). - # Knowing that `matrixto_container_labels_traefik_path_prefix` does not end with a slash + # Knowing that `matrix_matrixto_container_labels_traefik_path_prefix` does not end with a slash # ensures we know how to set these routes up without having to do "does it end with a slash" checks elsewhere. - - name: Fail if matrixto_container_labels_traefik_path_prefix ends with a slash + - name: Fail if matrix_matrixto_container_labels_traefik_path_prefix ends with a slash ansible.builtin.fail: msg: >- - matrixto_container_labels_traefik_path_prefix (`{{ matrixto_container_labels_traefik_path_prefix }}`) must either be `/` or not end with a slash (e.g. `/matrixto`). - when: "matrixto_container_labels_traefik_path_prefix != '/' and matrixto_container_labels_traefik_path_prefix[-1] == '/'" + matrix_matrixto_container_labels_traefik_path_prefix (`{{ matrix_matrixto_container_labels_traefik_path_prefix }}`) must either be `/` or not end with a slash (e.g. `/matrixto`). + when: "matrix_matrixto_container_labels_traefik_path_prefix != '/' and matrix_matrixto_container_labels_traefik_path_prefix[-1] == '/'" diff --git a/roles/custom/matrix-matrixto/templates/env.j2 b/roles/custom/matrix-matrixto/templates/env.j2 index 90bde8e04..f9c78d0f3 100644 --- a/roles/custom/matrix-matrixto/templates/env.j2 +++ b/roles/custom/matrix-matrixto/templates/env.j2 @@ -4,4 +4,4 @@ SPDX-FileCopyrightText: 2025 Suguru Hirahara SPDX-License-Identifier: AGPL-3.0-or-later #} -{{ matrixto_environment_variables_additional_variables }} +{{ matrix_matrixto_environment_variables_additional_variables }} diff --git a/roles/custom/matrix-matrixto/templates/labels.j2 b/roles/custom/matrix-matrixto/templates/labels.j2 index affd54a24..54c45a4b6 100644 --- a/roles/custom/matrix-matrixto/templates/labels.j2 +++ b/roles/custom/matrix-matrixto/templates/labels.j2 @@ -5,55 +5,55 @@ SPDX-FileCopyrightText: 2025 Suguru Hirahara SPDX-License-Identifier: AGPL-3.0-or-later #} -{% if matrixto_container_labels_traefik_enabled %} +{% if matrix_matrixto_container_labels_traefik_enabled %} traefik.enable=true -{% if matrixto_container_labels_traefik_docker_network %} -traefik.docker.network={{ matrixto_container_labels_traefik_docker_network }} +{% if matrix_matrixto_container_labels_traefik_docker_network %} +traefik.docker.network={{ matrix_matrixto_container_labels_traefik_docker_network }} {% endif %} {% set middlewares = [] %} -{% if matrixto_container_labels_traefik_path_prefix != '/' %} -traefik.http.middlewares.{{ matrixto_identifier }}-slashless-redirect.redirectregex.regex=^({{ matrixto_container_labels_traefik_path_prefix | quote }})$ -traefik.http.middlewares.{{ matrixto_identifier }}-slashless-redirect.redirectregex.replacement=${1}/ -{% set middlewares = middlewares + [matrixto_identifier + '-slashless-redirect'] %} +{% if matrix_matrixto_container_labels_traefik_path_prefix != '/' %} +traefik.http.middlewares.{{ matrix_matrixto_identifier }}-slashless-redirect.redirectregex.regex=^({{ matrix_matrixto_container_labels_traefik_path_prefix | quote }})$ +traefik.http.middlewares.{{ matrix_matrixto_identifier }}-slashless-redirect.redirectregex.replacement=${1}/ +{% set middlewares = middlewares + [matrix_matrixto_identifier + '-slashless-redirect'] %} {% endif %} -{% if matrixto_container_labels_traefik_path_prefix != '/' %} -traefik.http.middlewares.{{ matrixto_identifier }}-strip-prefix.stripprefix.prefixes={{ matrixto_container_labels_traefik_path_prefix }} -{% set middlewares = middlewares + [matrixto_identifier + '-strip-prefix'] %} +{% if matrix_matrixto_container_labels_traefik_path_prefix != '/' %} +traefik.http.middlewares.{{ matrix_matrixto_identifier }}-strip-prefix.stripprefix.prefixes={{ matrix_matrixto_container_labels_traefik_path_prefix }} +{% set middlewares = middlewares + [matrix_matrixto_identifier + '-strip-prefix'] %} {% endif %} -{% if matrixto_container_labels_traefik_additional_request_headers.keys() | length > 0 %} -{% for name, value in matrixto_container_labels_traefik_additional_request_headers.items() %} -traefik.http.middlewares.{{ matrixto_identifier }}-add-request-headers.headers.customrequestheaders.{{ name }}={{ value }} +{% if matrix_matrixto_container_labels_traefik_additional_request_headers.keys() | length > 0 %} +{% for name, value in matrix_matrixto_container_labels_traefik_additional_request_headers.items() %} +traefik.http.middlewares.{{ matrix_matrixto_identifier }}-add-request-headers.headers.customrequestheaders.{{ name }}={{ value }} {% endfor %} -{% set middlewares = middlewares + [matrixto_identifier + '-add-request-headers'] %} +{% set middlewares = middlewares + [matrix_matrixto_identifier + '-add-request-headers'] %} {% endif %} -{% if matrixto_container_labels_traefik_additional_response_headers.keys() | length > 0 %} -{% for name, value in matrixto_container_labels_traefik_additional_response_headers.items() %} -traefik.http.middlewares.{{ matrixto_identifier }}-add-response-headers.headers.customresponseheaders.{{ name }}={{ value }} +{% if matrix_matrixto_container_labels_traefik_additional_response_headers.keys() | length > 0 %} +{% for name, value in matrix_matrixto_container_labels_traefik_additional_response_headers.items() %} +traefik.http.middlewares.{{ matrix_matrixto_identifier }}-add-response-headers.headers.customresponseheaders.{{ name }}={{ value }} {% endfor %} -{% set middlewares = middlewares + [matrixto_identifier + '-add-response-headers'] %} +{% set middlewares = middlewares + [matrix_matrixto_identifier + '-add-response-headers'] %} {% endif %} -traefik.http.routers.{{ matrixto_identifier }}.rule={{ matrixto_container_labels_traefik_rule }} -{% if matrixto_container_labels_traefik_priority | int > 0 %} -traefik.http.routers.{{ matrixto_identifier }}.priority={{ matrixto_container_labels_traefik_priority }} +traefik.http.routers.{{ matrix_matrixto_identifier }}.rule={{ matrix_matrixto_container_labels_traefik_rule }} +{% if matrix_matrixto_container_labels_traefik_priority | int > 0 %} +traefik.http.routers.{{ matrix_matrixto_identifier }}.priority={{ matrix_matrixto_container_labels_traefik_priority }} {% endif %} -traefik.http.routers.{{ matrixto_identifier }}.service={{ matrixto_identifier }} +traefik.http.routers.{{ matrix_matrixto_identifier }}.service={{ matrix_matrixto_identifier }} {% if middlewares | length > 0 %} -traefik.http.routers.{{ matrixto_identifier }}.middlewares={{ middlewares | join(',') }} +traefik.http.routers.{{ matrix_matrixto_identifier }}.middlewares={{ middlewares | join(',') }} {% endif %} -traefik.http.routers.{{ matrixto_identifier }}.entrypoints={{ matrixto_container_labels_traefik_entrypoints }} -traefik.http.routers.{{ matrixto_identifier }}.tls={{ matrixto_container_labels_traefik_tls | to_json }} -{% if matrixto_container_labels_traefik_tls %} -traefik.http.routers.{{ matrixto_identifier }}.tls.certResolver={{ matrixto_container_labels_traefik_tls_certResolver }} +traefik.http.routers.{{ matrix_matrixto_identifier }}.entrypoints={{ matrix_matrixto_container_labels_traefik_entrypoints }} +traefik.http.routers.{{ matrix_matrixto_identifier }}.tls={{ matrix_matrixto_container_labels_traefik_tls | to_json }} +{% if matrix_matrixto_container_labels_traefik_tls %} +traefik.http.routers.{{ matrix_matrixto_identifier }}.tls.certResolver={{ matrix_matrixto_container_labels_traefik_tls_certResolver }} {% endif %} -traefik.http.services.{{ matrixto_identifier }}.loadbalancer.server.port={{ matrixto_container_http_port }} +traefik.http.services.{{ matrix_matrixto_identifier }}.loadbalancer.server.port={{ matrix_matrixto_container_http_port }} {% endif %} -{{ matrixto_container_labels_additional_labels }} +{{ matrix_matrixto_container_labels_additional_labels }} diff --git a/roles/custom/matrix-matrixto/templates/systemd/matrix-matrixto.service.j2 b/roles/custom/matrix-matrixto/templates/systemd/matrix-matrixto.service.j2 index a09f10b99..920f423a5 100644 --- a/roles/custom/matrix-matrixto/templates/systemd/matrix-matrixto.service.j2 +++ b/roles/custom/matrix-matrixto/templates/systemd/matrix-matrixto.service.j2 @@ -7,12 +7,12 @@ SPDX-License-Identifier: AGPL-3.0-or-later #} [Unit] -Description=Matrix.to ({{ matrixto_identifier }}) -{% for service in matrixto_systemd_required_services_list %} +Description=Matrix.to ({{ matrix_matrixto_identifier }}) +{% for service in matrix_matrixto_systemd_required_services_list %} Requires={{ service }} After={{ service }} {% endfor %} -{% for service in matrixto_systemd_wanted_services_list %} +{% for service in matrix_matrixto_systemd_wanted_services_list %} Wants={{ service }} {% endfor %} DefaultDependencies=no @@ -20,40 +20,40 @@ DefaultDependencies=no [Service] Type=simple Environment="HOME={{ devture_systemd_docker_base_systemd_unit_home_path }}" -ExecStartPre=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} stop -t {{ devture_systemd_docker_base_container_stop_grace_time_seconds }} {{ matrixto_identifier }} 2>/dev/null || true' -ExecStartPre=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} rm {{ matrixto_identifier }} 2>/dev/null || true' +ExecStartPre=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} stop -t {{ devture_systemd_docker_base_container_stop_grace_time_seconds }} {{ matrix_matrixto_identifier }} 2>/dev/null || true' +ExecStartPre=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} rm {{ matrix_matrixto_identifier }} 2>/dev/null || true' ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} create \ --rm \ - --name={{ matrixto_identifier }} \ + --name={{ matrix_matrixto_identifier }} \ --log-driver=none \ --user={{ matrix_user_uid }}:{{ matrix_user_gid }} \ --cap-drop=ALL \ --read-only \ - --network={{ matrixto_container_network }} \ - {% if matrixto_container_http_host_bind_port %} - -p {{ matrixto_container_http_host_bind_port }}:{{ matrixto_container_http_port }} \ + --network={{ matrix_matrixto_container_network }} \ + {% if matrix_matrixto_container_http_host_bind_port %} + -p {{ matrix_matrixto_container_http_host_bind_port }}:{{ matrix_matrixto_container_http_port }} \ {% endif %} - --env-file={{ matrixto_base_path }}/env \ - --label-file={{ matrixto_base_path }}/labels \ + --env-file={{ matrix_matrixto_base_path }}/env \ + --label-file={{ matrix_matrixto_base_path }}/labels \ --tmpfs=/tmp:rw,noexec,nosuid,size=128m \ - {% for arg in matrixto_container_extra_arguments %} + {% for arg in matrix_matrixto_container_extra_arguments %} {{ arg }} \ {% endfor %} - {{ matrixto_container_image_self_build_name if matrixto_container_image_self_build else matrixto_container_image }} + {{ matrix_matrixto_container_image_self_build_name if matrix_matrixto_container_image_self_build else matrix_matrixto_container_image }} -{% for network in matrixto_container_additional_networks %} -ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} network connect {{ network }} {{ matrixto_identifier }} +{% for network in matrix_matrixto_container_additional_networks %} +ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} network connect {{ network }} {{ matrix_matrixto_identifier }} {% endfor %} -ExecStart={{ devture_systemd_docker_base_host_command_docker }} start --attach {{ matrixto_identifier }} +ExecStart={{ devture_systemd_docker_base_host_command_docker }} start --attach {{ matrix_matrixto_identifier }} -ExecStop=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} stop -t {{ devture_systemd_docker_base_container_stop_grace_time_seconds }} {{ matrixto_identifier }} 2>/dev/null || true' -ExecStop=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} rm {{ matrixto_identifier }} 2>/dev/null || true' +ExecStop=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} stop -t {{ devture_systemd_docker_base_container_stop_grace_time_seconds }} {{ matrix_matrixto_identifier }} 2>/dev/null || true' +ExecStop=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} rm {{ matrix_matrixto_identifier }} 2>/dev/null || true' Restart=always RestartSec=30 -SyslogIdentifier={{ matrixto_identifier }} +SyslogIdentifier={{ matrix_matrixto_identifier }} [Install] WantedBy=multi-user.target