* Use `ansible-role-cinny` Signed-off-by: Suguru Hirahara <did🔑z6MkvVZk1A3KBApWJXv2Ju4H14ErDfRGxh8zxdXSZ4vACDg5> * Replace `matrix-client-cinny` and `matrix_client_cinny` with `cinny` Signed-off-by: Suguru Hirahara <did🔑z6MkvVZk1A3KBApWJXv2Ju4H14ErDfRGxh8zxdXSZ4vACDg5> * Set `matrix-client-cinny` to `cinny_identifier` Signed-off-by: Suguru Hirahara <did🔑z6MkvVZk1A3KBApWJXv2Ju4H14ErDfRGxh8zxdXSZ4vACDg5> * Set `cinny_container_image_*` Signed-off-by: Suguru Hirahara <did🔑z6MkvVZk1A3KBApWJXv2Ju4H14ErDfRGxh8zxdXSZ4vACDg5> * Remove `cinny_container_image_registry_prefix_*` Signed-off-by: Suguru Hirahara <did🔑z6MkvVZk1A3KBApWJXv2Ju4H14ErDfRGxh8zxdXSZ4vACDg5> * Replace `cinny_data_path` with `cinny_base_path` Signed-off-by: Suguru Hirahara <did🔑z6MkvVZk1A3KBApWJXv2Ju4H14ErDfRGxh8zxdXSZ4vACDg5> * Move `cinny_hostname` to `matrix_servers` Signed-off-by: Suguru Hirahara <did🔑z6MkvVZk1A3KBApWJXv2Ju4H14ErDfRGxh8zxdXSZ4vACDg5> * Add `cinny_uid` and `cinny_gid` Signed-off-by: Suguru Hirahara <did🔑z6MkvVZk1A3KBApWJXv2Ju4H14ErDfRGxh8zxdXSZ4vACDg5> * Remove `matrix-client-cinny` in favor of ansible-role-cinny Signed-off-by: Suguru Hirahara <did🔑z6MkvVZk1A3KBApWJXv2Ju4H14ErDfRGxh8zxdXSZ4vACDg5> * Update CHANGELOG.md Signed-off-by: Suguru Hirahara <did🔑z6MkvVZk1A3KBApWJXv2Ju4H14ErDfRGxh8zxdXSZ4vACDg5> --------- Signed-off-by: Suguru Hirahara <did🔑z6MkvVZk1A3KBApWJXv2Ju4H14ErDfRGxh8zxdXSZ4vACDg5> Co-authored-by: Suguru Hirahara <did🔑z6MkvVZk1A3KBApWJXv2Ju4H14ErDfRGxh8zxdXSZ4vACDg5>pull/4898/head
| @@ -1,3 +1,17 @@ | |||||
| # 2026-02-07 | |||||
| ## (BC Break) Cinny role has been relocated and variable names need adjustments | |||||
| The role for Cinny has been relocated to the [mother-of-all-self-hosting](https://github.com/mother-of-all-self-hosting) organization. | |||||
| Along with the relocation, the `matrix_client_cinny_` prefix was dropped from its variable names, so you need to adjust your `vars.yml` configuration. | |||||
| You need to do the following replacement: | |||||
| - `matrix_client_cinny_` -> `cinny_` | |||||
| As always, the playbook would let you know about this and point out any variables you may have missed. | |||||
| # 2026-02-06 | # 2026-02-06 | ||||
| ## The Sliding Sync proxy has been removed from the playbook | ## The Sliding Sync proxy has been removed from the playbook | ||||
| @@ -27,26 +27,26 @@ When setting, replace `example.com` with your own. | |||||
| To enable Cinny, add the following configuration to your `inventory/host_vars/matrix.example.com/vars.yml` file: | To enable Cinny, add the following configuration to your `inventory/host_vars/matrix.example.com/vars.yml` file: | ||||
| ```yaml | ```yaml | ||||
| matrix_client_cinny_enabled: true | |||||
| cinny_enabled: true | |||||
| ``` | ``` | ||||
| ### Adjusting the Cinny URL (optional) | ### Adjusting the Cinny URL (optional) | ||||
| By tweaking the `matrix_client_cinny_hostname` variable, you can easily make the service available at a **different hostname** than the default one. | |||||
| By tweaking the `cinny_hostname` variable, you can easily make the service available at a **different hostname** than the default one. | |||||
| Example additional configuration for your `vars.yml` file: | Example additional configuration for your `vars.yml` file: | ||||
| ```yaml | ```yaml | ||||
| # Switch to a different domain (`app.example.com`) than the default one (`cinny.example.com`) | # Switch to a different domain (`app.example.com`) than the default one (`cinny.example.com`) | ||||
| matrix_client_cinny_hostname: "app.{{ matrix_domain }}" | |||||
| cinny_hostname: "app.{{ matrix_domain }}" | |||||
| # Expose under the /cinny subpath | # Expose under the /cinny subpath | ||||
| # matrix_client_cinny_path_prefix: /cinny | |||||
| # cinny_path_prefix: /cinny | |||||
| ``` | ``` | ||||
| After changing the domain, **you may need to adjust your DNS** records to point the Cinny domain to the Matrix server. | After changing the domain, **you may need to adjust your DNS** records to point the Cinny domain to the Matrix server. | ||||
| **Note**: while there is a `matrix_client_cinny_path_prefix` variable for changing the path where Cinny is served, overriding it is [not possible](https://github.com/spantaleev/matrix-docker-ansible-deploy/issues/3701), because Cinny requires an application rebuild (with a tweaked build config) to be functional under a custom path. You'd need to serve Cinny at a dedicated subdomain. | |||||
| **Note**: while there is a `cinny_path_prefix` variable for changing the path where Cinny is served, overriding it is [not possible](https://github.com/spantaleev/matrix-docker-ansible-deploy/issues/3701), because Cinny requires an application rebuild (with a tweaked build config) to be functional under a custom path. You'd need to serve Cinny at a dedicated subdomain. | |||||
| ### Extending the configuration | ### Extending the configuration | ||||
| @@ -54,8 +54,8 @@ There are some additional things you may wish to configure about the component. | |||||
| Take a look at: | Take a look at: | ||||
| - `roles/custom/matrix-client-cinny/defaults/main.yml` for some variables that you can customize via your `vars.yml` file | |||||
| - `roles/custom/matrix-client-cinny/templates/config.json.j2` for the component's default configuration. You can override settings (even those that don't have dedicated playbook variables) using the `matrix_client_cinny_configuration_extension_json` variable | |||||
| - `roles/galaxy/cinny/defaults/main.yml` for some variables that you can customize via your `vars.yml` file | |||||
| - `roles/galaxy/cinny/templates/config.json.j2` for the component's default configuration. You can override settings (even those that don't have dedicated playbook variables) using the `cinny_configuration_extension_json` variable | |||||
| ## Installing | ## Installing | ||||
| @@ -29,7 +29,7 @@ Possibly outdated list of roles where self-building the Docker image is currentl | |||||
| - `matrix-synapse-admin` | - `matrix-synapse-admin` | ||||
| - `matrix-client-element` | - `matrix-client-element` | ||||
| - `matrix-client-hydrogen` | - `matrix-client-hydrogen` | ||||
| - `matrix-client-cinny` | |||||
| - `cinny` | |||||
| - `matrix-registration` | - `matrix-registration` | ||||
| - `matrix-coturn` | - `matrix-coturn` | ||||
| - `matrix-corporal` | - `matrix-corporal` | ||||
| @@ -344,7 +344,7 @@ devture_systemd_service_manager_services_list_auto: | | |||||
| + | + | ||||
| ([{'name': 'matrix-cactus-comments-client.service', 'priority': 2000, 'groups': ['matrix', 'cactus-comments-client']}] if matrix_cactus_comments_client_enabled else []) | ([{'name': 'matrix-cactus-comments-client.service', 'priority': 2000, 'groups': ['matrix', 'cactus-comments-client']}] if matrix_cactus_comments_client_enabled else []) | ||||
| + | + | ||||
| ([{'name': 'matrix-client-cinny.service', 'priority': 2000, 'groups': ['matrix', 'clients', 'cinny', 'client-cinny']}] if matrix_client_cinny_enabled else []) | |||||
| ([{'name': (cinny_identifier + '.service'), 'priority': 2000, 'groups': ['matrix', 'clients', 'cinny', 'client-cinny']}] if cinny_enabled else []) | |||||
| + | + | ||||
| ([{'name': 'matrix-client-element.service', 'priority': 2000, 'groups': ['matrix', 'clients', 'element', 'client-element']}] if matrix_client_element_enabled else []) | ([{'name': 'matrix-client-element.service', 'priority': 2000, 'groups': ['matrix', 'clients', 'element', 'client-element']}] if matrix_client_element_enabled else []) | ||||
| + | + | ||||
| @@ -4282,39 +4282,49 @@ matrix_client_hydrogen_self_check_validate_certificates: "{{ matrix_playbook_ssl | |||||
| ###################################################################### | ###################################################################### | ||||
| # | # | ||||
| # matrix-client-cinny | |||||
| # cinny | |||||
| # | # | ||||
| ###################################################################### | ###################################################################### | ||||
| matrix_client_cinny_enabled: false | |||||
| cinny_enabled: false | |||||
| matrix_client_cinny_docker_image_registry_prefix_upstream: "{{ matrix_container_global_registry_prefix_override if matrix_container_global_registry_prefix_override else matrix_client_cinny_docker_image_registry_prefix_upstream_default }}" | |||||
| cinny_identifier: matrix-client-cinny | |||||
| matrix_client_cinny_container_image_self_build: "{{ matrix_architecture not in ['arm64', 'amd64'] }}" | |||||
| cinny_uid: "{{ matrix_user_uid }}" | |||||
| cinny_gid: "{{ matrix_user_gid }}" | |||||
| matrix_client_cinny_container_http_host_bind_port: "{{ (matrix_playbook_service_host_bind_interface_prefix ~ '8080') if matrix_playbook_service_host_bind_interface_prefix else '' }}" | |||||
| cinny_container_image_registry_prefix: "{{ 'localhost/' if cinny_container_image_self_build else cinny_container_image_registry_prefix_upstream }}" | |||||
| cinny_container_image_registry_prefix_upstream: "{{ matrix_container_global_registry_prefix_override if matrix_container_global_registry_prefix_override else cinny_container_image_registry_prefix_upstream_default }}" | |||||
| matrix_client_cinny_container_network: "{{ matrix_addons_container_network }}" | |||||
| cinny_container_image_self_build: "{{ matrix_architecture not in ['arm64', 'amd64'] }}" | |||||
| matrix_client_cinny_container_additional_networks: "{{ [matrix_playbook_reverse_proxyable_services_additional_network] if (matrix_client_cinny_container_labels_traefik_enabled and matrix_playbook_reverse_proxyable_services_additional_network) else [] }}" | |||||
| cinny_container_http_host_bind_port: "{{ (matrix_playbook_service_host_bind_interface_prefix ~ '8080') if matrix_playbook_service_host_bind_interface_prefix else '' }}" | |||||
| matrix_client_cinny_container_labels_traefik_enabled: "{{ matrix_playbook_reverse_proxy_type in ['playbook-managed-traefik', 'other-traefik-container'] }}" | |||||
| matrix_client_cinny_container_labels_traefik_docker_network: "{{ matrix_playbook_reverse_proxyable_services_additional_network }}" | |||||
| matrix_client_cinny_container_labels_traefik_entrypoints: "{{ traefik_entrypoint_primary }}" | |||||
| matrix_client_cinny_container_labels_traefik_tls_certResolver: "{{ traefik_certResolver_primary }}" | |||||
| cinny_container_network: "{{ matrix_addons_container_network }}" | |||||
| matrix_client_cinny_container_labels_traefik_compression_middleware_enabled: "{{ matrix_playbook_reverse_proxy_traefik_middleware_compression_enabled }}" | |||||
| matrix_client_cinny_container_labels_traefik_compression_middleware_name: "{{ matrix_playbook_reverse_proxy_traefik_middleware_compression_name if matrix_playbook_reverse_proxy_traefik_middleware_compression_enabled else '' }}" | |||||
| cinny_container_additional_networks: "{{ [matrix_playbook_reverse_proxyable_services_additional_network] if (cinny_container_labels_traefik_enabled and matrix_playbook_reverse_proxyable_services_additional_network) else [] }}" | |||||
| matrix_client_cinny_scheme: "{{ 'https' if matrix_playbook_ssl_enabled else 'http' }}" | |||||
| cinny_container_labels_traefik_enabled: "{{ matrix_playbook_reverse_proxy_type in ['playbook-managed-traefik', 'other-traefik-container'] }}" | |||||
| cinny_container_labels_traefik_docker_network: "{{ matrix_playbook_reverse_proxyable_services_additional_network }}" | |||||
| cinny_container_labels_traefik_entrypoints: "{{ traefik_entrypoint_primary }}" | |||||
| cinny_container_labels_traefik_tls_certResolver: "{{ traefik_certResolver_primary }}" | |||||
| matrix_client_cinny_default_hs_url: "{{ matrix_homeserver_url }}" | |||||
| cinny_container_labels_traefik_compression_middleware_enabled: "{{ matrix_playbook_reverse_proxy_traefik_middleware_compression_enabled }}" | |||||
| cinny_container_labels_traefik_compression_middleware_name: "{{ matrix_playbook_reverse_proxy_traefik_middleware_compression_name if matrix_playbook_reverse_proxy_traefik_middleware_compression_enabled else '' }}" | |||||
| matrix_client_cinny_self_check_validate_certificates: "{{ matrix_playbook_ssl_enabled }}" | |||||
| cinny_scheme: "{{ 'https' if matrix_playbook_ssl_enabled else 'http' }}" | |||||
| cinny_default_hs_url: "{{ matrix_homeserver_url }}" | |||||
| cinny_self_check_validate_certificates: "{{ matrix_playbook_ssl_enabled }}" | |||||
| cinny_base_path: "{{ matrix_base_data_path }}/client-cinny" | |||||
| cinny_hostname: "{{ matrix_server_fqn_cinny }}" | |||||
| ###################################################################### | ###################################################################### | ||||
| # | # | ||||
| # /matrix-client-cinny | |||||
| # /cinny | |||||
| # | # | ||||
| ###################################################################### | ###################################################################### | ||||
| @@ -6,6 +6,9 @@ | |||||
| - src: git+https://github.com/mother-of-all-self-hosting/ansible-role-backup_borg.git | - src: git+https://github.com/mother-of-all-self-hosting/ansible-role-backup_borg.git | ||||
| version: v1.4.3-2.1.1-0 | version: v1.4.3-2.1.1-0 | ||||
| name: backup_borg | name: backup_borg | ||||
| - src: git+https://github.com/mother-of-all-self-hosting/ansible-role-cinny.git | |||||
| version: v4.10.2-1 | |||||
| name: cinny | |||||
| - src: git+https://github.com/mother-of-all-self-hosting/ansible-role-container-socket-proxy.git | - src: git+https://github.com/mother-of-all-self-hosting/ansible-role-container-socket-proxy.git | ||||
| version: v0.4.2-1 | version: v0.4.2-1 | ||||
| name: container_socket_proxy | name: container_socket_proxy | ||||
| @@ -109,7 +109,7 @@ matrix_server_fqn_element: "element.{{ matrix_domain }}" | |||||
| # This is where you access the Hydrogen web client from (if enabled via matrix_client_hydrogen_enabled; disabled by default). | # This is where you access the Hydrogen web client from (if enabled via matrix_client_hydrogen_enabled; disabled by default). | ||||
| matrix_server_fqn_hydrogen: "hydrogen.{{ matrix_domain }}" | matrix_server_fqn_hydrogen: "hydrogen.{{ matrix_domain }}" | ||||
| # This is where you access the Cinny web client from (if enabled via matrix_client_cinny_enabled; disabled by default). | |||||
| # This is where you access the Cinny web client from (if enabled via cinny_enabled; disabled by default). | |||||
| matrix_server_fqn_cinny: "cinny.{{ matrix_domain }}" | matrix_server_fqn_cinny: "cinny.{{ matrix_domain }}" | ||||
| # This is where you access the SchildiChat Web from (if enabled via matrix_client_schildichat_enabled; disabled by default). | # This is where you access the SchildiChat Web from (if enabled via matrix_client_schildichat_enabled; disabled by default). | ||||
| @@ -1,209 +0,0 @@ | |||||
| # SPDX-FileCopyrightText: 2022 - 2024 Nikita Chernyi | |||||
| # SPDX-FileCopyrightText: 2022 - 2024 Slavi Pantaleev | |||||
| # SPDX-FileCopyrightText: 2022 László Várady | |||||
| # SPDX-FileCopyrightText: 2022 MDAD project contributors | |||||
| # SPDX-FileCopyrightText: 2022 Marko Weltzer | |||||
| # SPDX-FileCopyrightText: 2023 Samuel Meenzen | |||||
| # SPDX-FileCopyrightText: 2024 Suguru Hirahara | |||||
| # | |||||
| # SPDX-License-Identifier: AGPL-3.0-or-later | |||||
| --- | |||||
| # Project source code URL: https://github.com/ajbura/cinny | |||||
| matrix_client_cinny_enabled: true | |||||
| matrix_client_cinny_container_image_self_build: false | |||||
| matrix_client_cinny_container_image_self_build_repo: "https://github.com/ajbura/cinny.git" | |||||
| # renovate: datasource=docker depName=ajbura/cinny | |||||
| matrix_client_cinny_version: v4.10.2 | |||||
| matrix_client_cinny_docker_image: "{{ matrix_client_cinny_docker_image_registry_prefix }}ajbura/cinny:{{ matrix_client_cinny_version }}" | |||||
| matrix_client_cinny_docker_image_registry_prefix: "{{ 'localhost/' if matrix_client_cinny_container_image_self_build else matrix_client_cinny_docker_image_registry_prefix_upstream }}" | |||||
| matrix_client_cinny_docker_image_registry_prefix_upstream: "{{ matrix_client_cinny_docker_image_registry_prefix_upstream_default }}" | |||||
| matrix_client_cinny_docker_image_registry_prefix_upstream_default: docker.io/ | |||||
| matrix_client_cinny_docker_image_force_pull: "{{ matrix_client_cinny_docker_image.endswith(':latest') }}" | |||||
| matrix_client_cinny_data_path: "{{ matrix_base_data_path }}/client-cinny" | |||||
| matrix_client_cinny_docker_src_files_path: "{{ matrix_client_cinny_data_path }}/docker-src" | |||||
| # The base container network | |||||
| matrix_client_cinny_container_network: '' | |||||
| # A list of additional container networks that the container would be connected to. | |||||
| # The role does not create these networks, so make sure they already exist. | |||||
| # Use this to expose this container to a reverse proxy, which runs in a different container network. | |||||
| matrix_client_cinny_container_additional_networks: [] | |||||
| # Controls whether the container exposes its HTTP port (tcp/8080 in the container). | |||||
| # | |||||
| # Takes an "<ip>:<port>" or "<port>" value (e.g. "127.0.0.1:8768"), or empty string to not expose. | |||||
| matrix_client_cinny_container_http_host_bind_port: '' | |||||
| # matrix_client_cinny_container_labels_traefik_enabled controls whether labels to assist a Traefik reverse-proxy will be attached to the container. | |||||
| # See `../templates/labels.j2` for details. | |||||
| # | |||||
| # To inject your own other container labels, see `matrix_client_cinny_container_labels_additional_labels`. | |||||
| matrix_client_cinny_container_labels_traefik_enabled: true | |||||
| matrix_client_cinny_container_labels_traefik_docker_network: "{{ matrix_client_cinny_container_network }}" | |||||
| matrix_client_cinny_container_labels_traefik_hostname: "{{ matrix_client_cinny_hostname }}" | |||||
| # The path prefix must either be `/` or not end with a slash (e.g. `/cinny`). | |||||
| matrix_client_cinny_container_labels_traefik_path_prefix: "{{ matrix_client_cinny_path_prefix }}" | |||||
| matrix_client_cinny_container_labels_traefik_rule: "Host(`{{ matrix_client_cinny_container_labels_traefik_hostname }}`){% if matrix_client_cinny_container_labels_traefik_path_prefix != '/' %} && PathPrefix(`{{ matrix_client_cinny_container_labels_traefik_path_prefix }}`){% endif %}" | |||||
| matrix_client_cinny_container_labels_traefik_priority: 0 | |||||
| matrix_client_cinny_container_labels_traefik_entrypoints: web-secure | |||||
| matrix_client_cinny_container_labels_traefik_tls: "{{ matrix_client_cinny_container_labels_traefik_entrypoints != 'web' }}" | |||||
| matrix_client_cinny_container_labels_traefik_tls_certResolver: default # noqa var-naming | |||||
| # Controls whether a compression middleware will be injected into the middlewares list. | |||||
| # This compression middleware is supposed to be defined elsewhere (using labels or a File provider, etc.) and is merely referenced by this router. | |||||
| matrix_client_cinny_container_labels_traefik_compression_middleware_enabled: false | |||||
| matrix_client_cinny_container_labels_traefik_compression_middleware_name: "" | |||||
| # Controls which additional headers to attach to all HTTP responses. | |||||
| # To add your own headers, use `matrix_client_cinny_container_labels_traefik_additional_response_headers_custom` | |||||
| matrix_client_cinny_container_labels_traefik_additional_response_headers: "{{ matrix_client_cinny_container_labels_traefik_additional_response_headers_auto | combine(matrix_client_cinny_container_labels_traefik_additional_response_headers_custom) }}" | |||||
| matrix_client_cinny_container_labels_traefik_additional_response_headers_auto: | | |||||
| {{ | |||||
| {} | |||||
| | combine ({'X-XSS-Protection': matrix_client_cinny_http_header_xss_protection} if matrix_client_cinny_http_header_xss_protection else {}) | |||||
| | combine ({'X-Frame-Options': matrix_client_cinny_http_header_frame_options} if matrix_client_cinny_http_header_frame_options else {}) | |||||
| | combine ({'X-Content-Type-Options': matrix_client_cinny_http_header_content_type_options} if matrix_client_cinny_http_header_content_type_options else {}) | |||||
| | combine ({'Content-Security-Policy': matrix_client_cinny_http_header_content_security_policy} if matrix_client_cinny_http_header_content_security_policy else {}) | |||||
| | combine ({'Permission-Policy': matrix_client_cinny_http_header_content_permission_policy} if matrix_client_cinny_http_header_content_permission_policy else {}) | |||||
| | combine ({'Strict-Transport-Security': matrix_client_cinny_http_header_strict_transport_security} if matrix_client_cinny_http_header_strict_transport_security and matrix_client_cinny_container_labels_traefik_tls else {}) | |||||
| }} | |||||
| matrix_client_cinny_container_labels_traefik_additional_response_headers_custom: {} | |||||
| # matrix_client_cinny_container_labels_additional_labels contains a multiline string with additional labels to add to the container label file. | |||||
| # See `../templates/labels.j2` for details. | |||||
| # | |||||
| # Example: | |||||
| # matrix_client_cinny_container_labels_additional_labels: | | |||||
| # my.label=1 | |||||
| # another.label="here" | |||||
| matrix_client_cinny_container_labels_additional_labels: '' | |||||
| # A list of extra arguments to pass to the container | |||||
| matrix_client_cinny_container_extra_arguments: [] | |||||
| # List of systemd services that matrix-client-cinny.service depends on | |||||
| matrix_client_cinny_systemd_required_services_list: "{{ [devture_systemd_docker_base_docker_service_name] if devture_systemd_docker_base_docker_service_name else [] }}" | |||||
| # Specifies the value of the `X-XSS-Protection` header | |||||
| # Stops pages from loading when they detect reflected cross-site scripting (XSS) attacks. | |||||
| # | |||||
| # Learn more about it is here: | |||||
| # - https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-XSS-Protection | |||||
| # - https://portswigger.net/web-security/cross-site-scripting/reflected | |||||
| matrix_client_cinny_http_header_xss_protection: "1; mode=block" | |||||
| # Specifies the value of the `X-Frame-Options` header which controls whether framing can happen. | |||||
| # See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options | |||||
| matrix_client_cinny_http_header_frame_options: SAMEORIGIN | |||||
| # Specifies the value of the `X-Content-Type-Options` header. | |||||
| # See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Content-Type-Options | |||||
| matrix_client_cinny_http_header_content_type_options: nosniff | |||||
| # Specifies the value of the `Content-Security-Policy` header. | |||||
| # See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy | |||||
| matrix_client_cinny_http_header_content_security_policy: frame-ancestors 'self' | |||||
| # Specifies the value of the `Permission-Policy` header. | |||||
| # See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Permission-Policy | |||||
| matrix_client_cinny_http_header_content_permission_policy: "{{ 'interest-cohort=()' if matrix_client_cinny_floc_optout_enabled else '' }}" | |||||
| # Specifies the value of the `Strict-Transport-Security` header. | |||||
| # See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security | |||||
| matrix_client_cinny_http_header_strict_transport_security: "max-age=31536000; includeSubDomains{{ '; preload' if matrix_client_cinny_hsts_preload_enabled else '' }}" | |||||
| # Controls whether to send a "Permissions-Policy interest-cohort=();" header along with all responses | |||||
| # | |||||
| # Learn more about what it is here: | |||||
| # - https://www.eff.org/deeplinks/2021/03/googles-floc-terrible-idea | |||||
| # - https://paramdeo.com/blog/opting-your-website-out-of-googles-floc-network | |||||
| # - https://amifloced.org/ | |||||
| # | |||||
| # Of course, a better solution is to just stop using browsers (like Chrome), which participate in such tracking practices. | |||||
| # See: `matrix_client_cinny_content_permission_policy` | |||||
| matrix_client_cinny_floc_optout_enabled: true | |||||
| # Controls if HSTS preloading is enabled | |||||
| # | |||||
| # In its strongest and recommended form, the [HSTS policy](https://www.chromium.org/hsts) includes all subdomains, and | |||||
| # indicates a willingness to be "preloaded" into browsers: | |||||
| # `Strict-Transport-Security: max-age=31536000; includeSubDomains; preload` | |||||
| # For more information visit: | |||||
| # - https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security | |||||
| # - https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security | |||||
| # - https://hstspreload.org/#opt-in | |||||
| # See: `matrix_client_cinny_http_header_strict_transport_security` | |||||
| matrix_client_cinny_hsts_preload_enabled: false | |||||
| matrix_client_cinny_scheme: https | |||||
| # The hostname at which Cinny is served. | |||||
| # Only works with with Traefik reverse-proxying. | |||||
| matrix_client_cinny_hostname: "{{ matrix_server_fqn_cinny }}" | |||||
| # The path at which Cinny is exposed. | |||||
| # This value must either be `/` or not end with a slash (e.g. `/cinny`). | |||||
| matrix_client_cinny_path_prefix: / | |||||
| # Controls whether the self-check feature should validate SSL certificates. | |||||
| matrix_client_cinny_self_check_validate_certificates: true | |||||
| # Default homeserver URL to use in the `config.json` file. | |||||
| # See `matrix_client_cinny_config_homeserverList`. | |||||
| matrix_client_cinny_default_hs_url: "" | |||||
| # Controls whether the Cinny access log is enabled | |||||
| matrix_client_cinny_access_log_enabled: true | |||||
| # Controls the `defaultHomeserver` value in the `config.json` file. | |||||
| matrix_client_cinny_config_defaultHomeserver: 0 # noqa var-naming | |||||
| # Controls the `homeserverList` value in the `config.json` file. | |||||
| matrix_client_cinny_config_homeserverList: "{{ [matrix_client_cinny_default_hs_url] }}" # noqa var-naming | |||||
| # Controls the `allowCustomHomeservers` value in the `config.json` file. | |||||
| matrix_client_cinny_config_allowCustomHomeservers: true # noqa var-naming | |||||
| # Controls the `featuredCommunities.spaces` value in the `config.json` file. | |||||
| matrix_client_cinny_config_featuredCommunities_spaces: [] # noqa var-naming | |||||
| # Controls the `featuredCommunities.rooms` value in the `config.json` file. | |||||
| matrix_client_cinny_config_featuredCommunities_rooms: [] # noqa var-naming | |||||
| # Controls the `featuredCommunities.servers` value in the `config.json` file. | |||||
| matrix_client_cinny_config_featuredCommunities_servers: ["matrix.org"] # noqa var-naming | |||||
| # Controls the `featuredCommunities.openAsDefault` value in the `config.json` file. | |||||
| matrix_client_cinny_config_featuredCommunities_openAsDefault: false # noqa var-naming | |||||
| # Default Cinny configuration template which covers the generic use case. | |||||
| # You can customize it by controlling the various variables inside it. | |||||
| # | |||||
| # For a more advanced customization, you can extend the default (see `matrix_client_cinny_configuration_extension_json`) | |||||
| # or completely replace this variable with your own template. | |||||
| # | |||||
| # The side-effect of this lookup is that Ansible would even parse the JSON for us, returning a dict. | |||||
| # This is unlike what it does when looking up YAML template files (no automatic parsing there). | |||||
| matrix_client_cinny_configuration_default: "{{ lookup('template', 'templates/config.json.j2', convert_data=False) | from_json }}" | |||||
| # Your custom JSON configuration for Cinny should go to `matrix_client_cinny_configuration_extension_json`. | |||||
| # This configuration extends the default starting configuration (`matrix_client_cinny_configuration_default`). | |||||
| # | |||||
| # You can override individual variables from the default configuration, or introduce new ones. | |||||
| # | |||||
| # If you need something more special, you can take full control by | |||||
| # completely redefining `matrix_client_cinny_configuration_default`. | |||||
| matrix_client_cinny_configuration_extension_json: '{}' | |||||
| matrix_client_cinny_configuration_extension: "{{ matrix_client_cinny_configuration_extension_json | from_json if matrix_client_cinny_configuration_extension_json | from_json is mapping else {} }}" | |||||
| # Holds the final Cinny configuration (a combination of the default and its extension). | |||||
| # You most likely don't need to touch this variable. Instead, see `matrix_client_cinny_configuration_default`. | |||||
| matrix_client_cinny_configuration: "{{ matrix_client_cinny_configuration_default | combine(matrix_client_cinny_configuration_extension, recursive=True) }}" | |||||
| @@ -1,32 +0,0 @@ | |||||
| # SPDX-FileCopyrightText: 2022 - 2023 Slavi Pantaleev | |||||
| # SPDX-FileCopyrightText: 2022 MDAD project contributors | |||||
| # SPDX-FileCopyrightText: 2022 Marko Weltzer | |||||
| # | |||||
| # SPDX-License-Identifier: AGPL-3.0-or-later | |||||
| --- | |||||
| - tags: | |||||
| - setup-all | |||||
| - setup-client-cinny | |||||
| - install-all | |||||
| - install-client-cinny | |||||
| block: | |||||
| - when: matrix_client_cinny_enabled | bool | |||||
| ansible.builtin.include_tasks: "{{ role_path }}/tasks/validate_config.yml" | |||||
| - when: matrix_client_cinny_enabled | bool | |||||
| ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_install.yml" | |||||
| - tags: | |||||
| - setup-all | |||||
| - setup-client-cinny | |||||
| block: | |||||
| - when: not matrix_client_cinny_enabled | bool | |||||
| ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_uninstall.yml" | |||||
| - tags: | |||||
| - self-check | |||||
| block: | |||||
| - when: matrix_client_cinny_enabled | bool | |||||
| ansible.builtin.include_tasks: "{{ role_path }}/tasks/self_check.yml" | |||||
| @@ -1,30 +0,0 @@ | |||||
| # SPDX-FileCopyrightText: 2022 - 2024 Slavi Pantaleev | |||||
| # SPDX-FileCopyrightText: 2022 MDAD project contributors | |||||
| # SPDX-FileCopyrightText: 2022 Marko Weltzer | |||||
| # | |||||
| # SPDX-License-Identifier: AGPL-3.0-or-later | |||||
| --- | |||||
| - ansible.builtin.set_fact: | |||||
| matrix_client_cinny_url_endpoint_public: "{{ matrix_client_cinny_scheme }}://{{ matrix_client_cinny_hostname }}{{ matrix_client_cinny_path_prefix }}/config.json" | |||||
| - name: Check Cinny | |||||
| ansible.builtin.uri: | |||||
| url: "{{ matrix_client_cinny_url_endpoint_public }}" | |||||
| follow_redirects: none | |||||
| validate_certs: "{{ matrix_client_cinny_self_check_validate_certificates }}" | |||||
| register: matrix_client_cinny_self_check_result | |||||
| check_mode: false | |||||
| ignore_errors: true | |||||
| delegate_to: 127.0.0.1 | |||||
| become: false | |||||
| - name: Fail if Cinny not working | |||||
| ansible.builtin.fail: | |||||
| msg: "Failed checking Cinny is up at `{{ matrix_client_cinny_hostname }}` (checked endpoint: `{{ matrix_client_cinny_url_endpoint_public }}`). Is Cinny running? Is port 443 open in your firewall? Full error: {{ matrix_client_cinny_self_check_result }}" | |||||
| when: "matrix_client_cinny_self_check_result.failed or 'json' not in matrix_client_cinny_self_check_result" | |||||
| - name: Report working Cinny | |||||
| ansible.builtin.debug: | |||||
| msg: "Cinny at `{{ matrix_client_cinny_hostname }}` is working (checked endpoint: `{{ matrix_client_cinny_url_endpoint_public }}`)" | |||||
| @@ -1,87 +0,0 @@ | |||||
| # SPDX-FileCopyrightText: 2022 - 2024 Slavi Pantaleev | |||||
| # SPDX-FileCopyrightText: 2022 MDAD project contributors | |||||
| # SPDX-FileCopyrightText: 2022 Marko Weltzer | |||||
| # SPDX-FileCopyrightText: 2022 Nikita Chernyi | |||||
| # SPDX-FileCopyrightText: 2022 Sebastian Gumprich | |||||
| # SPDX-FileCopyrightText: 2024 David Mehren | |||||
| # | |||||
| # SPDX-License-Identifier: AGPL-3.0-or-later | |||||
| --- | |||||
| - name: Ensure Cinny paths exists | |||||
| ansible.builtin.file: | |||||
| path: "{{ item.path }}" | |||||
| state: directory | |||||
| mode: 0750 | |||||
| owner: "{{ matrix_user_name }}" | |||||
| group: "{{ matrix_group_name }}" | |||||
| with_items: | |||||
| - {path: "{{ matrix_client_cinny_data_path }}", when: true} | |||||
| - {path: "{{ matrix_client_cinny_docker_src_files_path }}", when: "{{ matrix_client_cinny_container_image_self_build }}"} | |||||
| when: "item.when | bool" | |||||
| - name: Ensure Cinny Docker image is pulled | |||||
| community.docker.docker_image: | |||||
| name: "{{ matrix_client_cinny_docker_image }}" | |||||
| source: "{{ 'pull' if ansible_version.major > 2 or ansible_version.minor > 7 else omit }}" | |||||
| force_source: "{{ matrix_client_cinny_docker_image_force_pull if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}" | |||||
| force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else matrix_client_cinny_docker_image_force_pull }}" | |||||
| when: "not matrix_client_cinny_container_image_self_build | bool" | |||||
| register: result | |||||
| retries: "{{ devture_playbook_help_container_retries_count }}" | |||||
| delay: "{{ devture_playbook_help_container_retries_delay }}" | |||||
| until: result is not failed | |||||
| - name: Ensure Cinny repository is present on self-build | |||||
| ansible.builtin.git: | |||||
| repo: "{{ matrix_client_cinny_container_image_self_build_repo }}" | |||||
| dest: "{{ matrix_client_cinny_docker_src_files_path }}" | |||||
| version: "{{ matrix_client_cinny_docker_image.split(':')[1] }}" | |||||
| force: "yes" | |||||
| become: true | |||||
| become_user: "{{ matrix_user_name }}" | |||||
| register: matrix_client_cinny_git_pull_results | |||||
| when: "matrix_client_cinny_container_image_self_build | bool" | |||||
| - name: Ensure Cinny configuration installed | |||||
| ansible.builtin.copy: | |||||
| content: "{{ matrix_client_cinny_configuration | to_nice_json }}" | |||||
| dest: "{{ matrix_client_cinny_data_path }}/config.json" | |||||
| mode: 0644 | |||||
| owner: "{{ matrix_user_name }}" | |||||
| group: "{{ matrix_group_name }}" | |||||
| - name: Ensure Cinny additional config files installed | |||||
| ansible.builtin.template: | |||||
| src: "{{ item.src }}" | |||||
| dest: "{{ matrix_client_cinny_data_path }}/{{ item.name }}" | |||||
| mode: 0644 | |||||
| owner: "{{ matrix_user_name }}" | |||||
| group: "{{ matrix_group_name }}" | |||||
| with_items: | |||||
| - {src: "{{ role_path }}/templates/nginx.conf.j2", name: "nginx.conf"} | |||||
| - {src: "{{ role_path }}/templates/labels.j2", name: "labels"} | |||||
| - name: Ensure Cinny Docker image is built | |||||
| community.docker.docker_image: | |||||
| name: "{{ matrix_client_cinny_docker_image }}" | |||||
| source: build | |||||
| force_source: "{{ matrix_client_cinny_git_pull_results.changed }}" | |||||
| build: | |||||
| dockerfile: Dockerfile | |||||
| path: "{{ matrix_client_cinny_docker_src_files_path }}" | |||||
| pull: true | |||||
| when: "matrix_client_cinny_container_image_self_build | bool" | |||||
| - name: Ensure Cinny container network is created | |||||
| community.general.docker_network: | |||||
| enable_ipv6: "{{ devture_systemd_docker_base_ipv6_enabled }}" | |||||
| name: "{{ matrix_client_cinny_container_network }}" | |||||
| driver: bridge | |||||
| driver_options: "{{ devture_systemd_docker_base_container_networks_driver_options }}" | |||||
| - name: Ensure matrix-client-cinny.service installed | |||||
| ansible.builtin.template: | |||||
| src: "{{ role_path }}/templates/systemd/matrix-client-cinny.service.j2" | |||||
| dest: "{{ devture_systemd_docker_base_systemd_path }}/matrix-client-cinny.service" | |||||
| mode: 0644 | |||||
| @@ -1,31 +0,0 @@ | |||||
| # SPDX-FileCopyrightText: 2022 MDAD project contributors | |||||
| # SPDX-FileCopyrightText: 2022 Marko Weltzer | |||||
| # SPDX-FileCopyrightText: 2022 Sebastian Gumprich | |||||
| # SPDX-FileCopyrightText: 2022 Slavi Pantaleev | |||||
| # | |||||
| # SPDX-License-Identifier: AGPL-3.0-or-later | |||||
| --- | |||||
| - name: Check existence of matrix-client-cinny.service | |||||
| ansible.builtin.stat: | |||||
| path: "{{ devture_systemd_docker_base_systemd_path }}/matrix-client-cinny.service" | |||||
| register: matrix_client_cinny_service_stat | |||||
| - when: matrix_client_cinny_service_stat.stat.exists | bool | |||||
| block: | |||||
| - name: Ensure matrix-client-cinny is stopped | |||||
| ansible.builtin.service: | |||||
| name: matrix-client-cinny | |||||
| state: stopped | |||||
| enabled: false | |||||
| daemon_reload: true | |||||
| - name: Ensure matrix-client-cinny.service doesn't exist | |||||
| ansible.builtin.file: | |||||
| path: "{{ devture_systemd_docker_base_systemd_path }}/matrix-client-cinny.service" | |||||
| state: absent | |||||
| - name: Ensure Cinny paths doesn't exist | |||||
| ansible.builtin.file: | |||||
| path: "{{ matrix_client_cinny_data_path }}" | |||||
| state: absent | |||||
| @@ -1,51 +0,0 @@ | |||||
| # SPDX-FileCopyrightText: 2022 - 2024 Slavi Pantaleev | |||||
| # SPDX-FileCopyrightText: 2022 MDAD project contributors | |||||
| # | |||||
| # SPDX-License-Identifier: AGPL-3.0-or-later | |||||
| --- | |||||
| - name: Fail if required Cinny settings not defined | |||||
| ansible.builtin.fail: | |||||
| msg: > | |||||
| You need to define a required configuration setting (`{{ item }}`) to use Cinny. | |||||
| when: "item.when | bool and lookup('vars', item.name, default='') | string | length == 0" | |||||
| with_items: | |||||
| - {'name': 'matrix_client_cinny_default_hs_url', when: true} | |||||
| - {'name': 'matrix_client_cinny_container_network', when: true} | |||||
| - {'name': 'matrix_client_cinny_container_labels_traefik_compression_middleware_name', when: "{{ matrix_client_cinny_container_labels_traefik_compression_middleware_enabled }}"} | |||||
| - name: (Deprecation) Catch and report renamed Cinny variables | |||||
| ansible.builtin.fail: | |||||
| msg: >- | |||||
| The variable `{{ item.old }}` is deprecated. Please use `{{ item.new }}` instead. | |||||
| when: "lookup('ansible.builtin.varnames', ('^' + item.old + '$'), wantlist=True) | length > 0" | |||||
| with_items: | |||||
| - {'old': 'matrix_client_cinny_container_image_name_prefix', 'new': 'matrix_client_cinny_container_image_registry_prefix'} | |||||
| - name: Fail if matrix_client_cinny_path_prefix is not / | |||||
| ansible.builtin.fail: | |||||
| msg: >- | |||||
| `matrix_client_cinny_path_prefix` is set to `{{ matrix_client_cinny_path_prefix }}` in your configuration, but Cinny no longer supports hosting under a path prefix without an application rebuild. | |||||
| Consider removing your `matrix_client_cinny_path_prefix` override and adjusting the Cinny hostname via `matrix_server_fqn_cinny` or `matrix_client_cinny_hostname`. | |||||
| See https://github.com/spantaleev/matrix-docker-ansible-deploy/issues/3701 | |||||
| when: "matrix_client_cinny_path_prefix != '/'" | |||||
| - when: matrix_client_cinny_container_labels_traefik_enabled | bool | |||||
| block: | |||||
| - name: Fail if required matrix-client-cinny Traefik settings not defined | |||||
| ansible.builtin.fail: | |||||
| msg: >- | |||||
| You need to define a required configuration setting (`{{ item }}`). | |||||
| when: "lookup('vars', item, default='') == ''" | |||||
| with_items: | |||||
| - matrix_client_cinny_container_labels_traefik_hostname | |||||
| - matrix_client_cinny_container_labels_traefik_path_prefix | |||||
| # We ensure it doesn't end with a slash, because we handle both (slash and no-slash). | |||||
| # Knowing that `matrix_client_cinny_container_labels_traefik_path_prefix` does not end with a slash | |||||
| # ensures we know how to set these routes up without having to do "does it end with a slash" checks elsewhere. | |||||
| - name: Fail if matrix_client_cinny_container_labels_traefik_path_prefix ends with a slash | |||||
| ansible.builtin.fail: | |||||
| msg: >- | |||||
| matrix_client_cinny_container_labels_traefik_path_prefix (`{{ matrix_client_cinny_container_labels_traefik_path_prefix }}`) must either be `/` or not end with a slash (e.g. `/cinny`). | |||||
| when: "matrix_client_cinny_container_labels_traefik_path_prefix != '/' and matrix_client_cinny_container_labels_traefik_path_prefix[-1] == '/'" | |||||
| @@ -1,11 +0,0 @@ | |||||
| { | |||||
| "defaultHomeserver": {{ matrix_client_cinny_config_defaultHomeserver | to_json }}, | |||||
| "homeserverList": {{ matrix_client_cinny_config_homeserverList | to_json }}, | |||||
| "allowCustomHomeservers": {{ matrix_client_cinny_config_allowCustomHomeservers | to_json }}, | |||||
| "featuredCommunities": { | |||||
| "spaces": {{ matrix_client_cinny_config_featuredCommunities_spaces | to_json }}, | |||||
| "rooms": {{ matrix_client_cinny_config_featuredCommunities_rooms | to_json }}, | |||||
| "servers": {{ matrix_client_cinny_config_featuredCommunities_servers | to_json }}, | |||||
| "openAsDefault": {{ matrix_client_cinny_config_featuredCommunities_openAsDefault | to_json }} | |||||
| } | |||||
| } | |||||
| @@ -1,4 +0,0 @@ | |||||
| SPDX-FileCopyrightText: 2022 MDAD project contributors | |||||
| SPDX-FileCopyrightText: 2022 Slavi Pantaleev | |||||
| SPDX-License-Identifier: AGPL-3.0-or-later | |||||
| @@ -1,56 +0,0 @@ | |||||
| {# | |||||
| SPDX-FileCopyrightText: 2023 - 2024 Slavi Pantaleev | |||||
| SPDX-License-Identifier: AGPL-3.0-or-later | |||||
| #} | |||||
| {% if matrix_client_cinny_container_labels_traefik_enabled %} | |||||
| traefik.enable=true | |||||
| {% if matrix_client_cinny_container_labels_traefik_docker_network %} | |||||
| traefik.docker.network={{ matrix_client_cinny_container_labels_traefik_docker_network }} | |||||
| {% endif %} | |||||
| traefik.http.services.matrix-client-cinny.loadbalancer.server.port=8080 | |||||
| {% set middlewares = [] %} | |||||
| {% if matrix_client_cinny_container_labels_traefik_compression_middleware_enabled %} | |||||
| {% set middlewares = middlewares + [matrix_client_cinny_container_labels_traefik_compression_middleware_name] %} | |||||
| {% endif %} | |||||
| {% if matrix_client_cinny_container_labels_traefik_path_prefix != '/' %} | |||||
| traefik.http.middlewares.matrix-client-cinny-slashless-redirect.redirectregex.regex=({{ matrix_client_cinny_container_labels_traefik_path_prefix | quote }})$ | |||||
| traefik.http.middlewares.matrix-client-cinny-slashless-redirect.redirectregex.replacement=${1}/ | |||||
| {% set middlewares = middlewares + ['matrix-client-cinny-slashless-redirect'] %} | |||||
| {% endif %} | |||||
| {% if matrix_client_cinny_container_labels_traefik_path_prefix != '/' %} | |||||
| traefik.http.middlewares.matrix-client-cinny-strip-prefix.stripprefix.prefixes={{ matrix_client_cinny_container_labels_traefik_path_prefix }} | |||||
| {% set middlewares = middlewares + ['matrix-client-cinny-strip-prefix'] %} | |||||
| {% endif %} | |||||
| {% if matrix_client_cinny_container_labels_traefik_additional_response_headers.keys() | length > 0 %} | |||||
| {% for name, value in matrix_client_cinny_container_labels_traefik_additional_response_headers.items() %} | |||||
| traefik.http.middlewares.matrix-client-cinny-add-headers.headers.customresponseheaders.{{ name }}={{ value }} | |||||
| {% endfor %} | |||||
| {% set middlewares = middlewares + ['matrix-client-cinny-add-headers'] %} | |||||
| {% endif %} | |||||
| traefik.http.routers.matrix-client-cinny.rule={{ matrix_client_cinny_container_labels_traefik_rule }} | |||||
| {% if matrix_client_cinny_container_labels_traefik_priority | int > 0 %} | |||||
| traefik.http.routers.matrix-client-cinny.priority={{ matrix_client_cinny_container_labels_traefik_priority }} | |||||
| {% endif %} | |||||
| traefik.http.routers.matrix-client-cinny.service=matrix-client-cinny | |||||
| {% if middlewares | length > 0 %} | |||||
| traefik.http.routers.matrix-client-cinny.middlewares={{ middlewares | join(',') }} | |||||
| {% endif %} | |||||
| traefik.http.routers.matrix-client-cinny.entrypoints={{ matrix_client_cinny_container_labels_traefik_entrypoints }} | |||||
| traefik.http.routers.matrix-client-cinny.tls={{ matrix_client_cinny_container_labels_traefik_tls | to_json }} | |||||
| {% if matrix_client_cinny_container_labels_traefik_tls %} | |||||
| traefik.http.routers.matrix-client-cinny.tls.certResolver={{ matrix_client_cinny_container_labels_traefik_tls_certResolver }} | |||||
| {% endif %} | |||||
| {% endif %} | |||||
| {{ matrix_client_cinny_container_labels_additional_labels }} | |||||
| @@ -1,75 +0,0 @@ | |||||
| #jinja2: lstrip_blocks: True | |||||
| # This is a custom nginx configuration file that we use in the container (instead of the default one), | |||||
| # because it allows us to run nginx with a non-root user. | |||||
| # | |||||
| # For this to work, the default vhost file (`/etc/nginx/conf.d/default.conf`) also needs to be removed. | |||||
| # (mounting `/dev/null` over `/etc/nginx/conf.d/default.conf` works well) | |||||
| # | |||||
| # The following changes have been done compared to a default nginx configuration file: | |||||
| # - default server port is changed (80 -> 8080), so that a non-root user can bind it | |||||
| # - various temp paths are changed to `/tmp`, so that a non-root user can write to them | |||||
| # - the `user` directive was removed, as we don't want nginx to switch users | |||||
| worker_processes 1; | |||||
| error_log /var/log/nginx/error.log warn; | |||||
| pid /tmp/nginx.pid; | |||||
| events { | |||||
| worker_connections 1024; | |||||
| } | |||||
| http { | |||||
| proxy_temp_path /tmp/proxy_temp; | |||||
| client_body_temp_path /tmp/client_temp; | |||||
| fastcgi_temp_path /tmp/fastcgi_temp; | |||||
| uwsgi_temp_path /tmp/uwsgi_temp; | |||||
| scgi_temp_path /tmp/scgi_temp; | |||||
| include /etc/nginx/mime.types; | |||||
| default_type application/octet-stream; | |||||
| log_format main '$remote_addr - $remote_user [$time_local] "$request" ' | |||||
| '$status $body_bytes_sent "$http_referer" ' | |||||
| '"$http_user_agent" "$http_x_forwarded_for"'; | |||||
| {% if matrix_client_cinny_access_log_enabled %} | |||||
| access_log /var/log/nginx/access.log main; | |||||
| {% else %} | |||||
| access_log off; | |||||
| {% endif %} | |||||
| sendfile on; | |||||
| #tcp_nopush on; | |||||
| keepalive_timeout 65; | |||||
| #gzip on; | |||||
| server { | |||||
| listen 8080; | |||||
| server_name localhost; | |||||
| root /usr/share/nginx/html; | |||||
| location / { | |||||
| # Inspired by: https://raw.githubusercontent.com/cinnyapp/cinny/dev/docker-nginx.conf | |||||
| root /usr/share/nginx/html; | |||||
| rewrite ^/config.json$ /config.json break; | |||||
| rewrite ^/manifest.json$ /manifest.json break; | |||||
| rewrite ^.*/olm.wasm$ /olm.wasm break; | |||||
| rewrite ^/sw.js$ /sw.js break; | |||||
| rewrite ^/pdf.worker.min.js$ /pdf.worker.min.js break; | |||||
| rewrite ^/public/(.*)$ /public/$1 break; | |||||
| rewrite ^/assets/(.*)$ /assets/$1 break; | |||||
| rewrite ^(.+)$ /index.html break; | |||||
| } | |||||
| } | |||||
| } | |||||
| @@ -1,5 +0,0 @@ | |||||
| SPDX-FileCopyrightText: 2019 - 2024 Slavi Pantaleev | |||||
| SPDX-FileCopyrightText: 2022 MDAD project contributors | |||||
| SPDX-FileCopyrightText: 2024 James Reilly | |||||
| SPDX-License-Identifier: AGPL-3.0-or-later | |||||
| @@ -1,50 +0,0 @@ | |||||
| #jinja2: lstrip_blocks: True | |||||
| [Unit] | |||||
| Description=Matrix Cinny Client | |||||
| {% for service in matrix_client_cinny_systemd_required_services_list %} | |||||
| Requires={{ service }} | |||||
| After={{ service }} | |||||
| {% endfor %} | |||||
| DefaultDependencies=no | |||||
| [Service] | |||||
| Type=simple | |||||
| Environment="HOME={{ devture_systemd_docker_base_systemd_unit_home_path }}" | |||||
| ExecStartPre=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} stop -t {{ devture_systemd_docker_base_container_stop_grace_time_seconds }} matrix-client-cinny 2>/dev/null || true' | |||||
| ExecStartPre=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} rm matrix-client-cinny 2>/dev/null || true' | |||||
| ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} create \ | |||||
| --rm \ | |||||
| --name=matrix-client-cinny \ | |||||
| --log-driver=none \ | |||||
| --user={{ matrix_user_uid }}:{{ matrix_user_gid }} \ | |||||
| --cap-drop=ALL \ | |||||
| --read-only \ | |||||
| --network={{ matrix_client_cinny_container_network }} \ | |||||
| {% if matrix_client_cinny_container_http_host_bind_port %} | |||||
| -p {{ matrix_client_cinny_container_http_host_bind_port }}:8080 \ | |||||
| {% endif %} | |||||
| --label-file={{ matrix_client_cinny_data_path }}/labels \ | |||||
| --tmpfs=/tmp:rw,noexec,nosuid,size=10m \ | |||||
| --mount type=bind,src={{ matrix_client_cinny_data_path }}/nginx.conf,dst=/etc/nginx/nginx.conf,ro \ | |||||
| --mount type=bind,src={{ matrix_client_cinny_data_path }}/config.json,dst=/app/config.json,ro \ | |||||
| {% for arg in matrix_client_cinny_container_extra_arguments %} | |||||
| {{ arg }} \ | |||||
| {% endfor %} | |||||
| {{ matrix_client_cinny_docker_image }} | |||||
| {% for network in matrix_client_cinny_container_additional_networks %} | |||||
| ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} network connect {{ network }} matrix-client-cinny | |||||
| {% endfor %} | |||||
| ExecStart={{ devture_systemd_docker_base_host_command_docker }} start --attach matrix-client-cinny | |||||
| ExecStop=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} stop -t {{ devture_systemd_docker_base_container_stop_grace_time_seconds }} matrix-client-cinny 2>/dev/null || true' | |||||
| ExecStop=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} rm matrix-client-cinny 2>/dev/null || true' | |||||
| Restart=always | |||||
| RestartSec=30 | |||||
| SyslogIdentifier=matrix-client-cinny | |||||
| [Install] | |||||
| WantedBy=multi-user.target | |||||
| @@ -1,4 +0,0 @@ | |||||
| SPDX-FileCopyrightText: 2022 - 2025 Slavi Pantaleev | |||||
| SPDX-FileCopyrightText: 2022 MDAD project contributors | |||||
| SPDX-License-Identifier: AGPL-3.0-or-later | |||||
| @@ -1,6 +1,6 @@ | |||||
| # SPDX-FileCopyrightText: 2022 - 2025 Slavi Pantaleev | |||||
| # SPDX-FileCopyrightText: 2024 - 2025 MDAD project contributors | |||||
| # SPDX-FileCopyrightText: 2024 - 2025 Suguru Hirahara | |||||
| # SPDX-FileCopyrightText: 2022-2025 Slavi Pantaleev | |||||
| # SPDX-FileCopyrightText: 2024, 2025 MDAD project contributors | |||||
| # SPDX-FileCopyrightText: 2024-2026 Suguru Hirahara | |||||
| # | # | ||||
| # SPDX-License-Identifier: AGPL-3.0-or-later | # SPDX-License-Identifier: AGPL-3.0-or-later | ||||
| @@ -73,6 +73,11 @@ | |||||
| - {'old': 'matrix_playbook_reverse_proxy_traefik_middleware_compession_enabled', 'new': 'matrix_playbook_reverse_proxy_traefik_middleware_compression_enabled'} | - {'old': 'matrix_playbook_reverse_proxy_traefik_middleware_compession_enabled', 'new': 'matrix_playbook_reverse_proxy_traefik_middleware_compression_enabled'} | ||||
| - {'old': 'matrix_playbook_reverse_proxy_traefik_middleware_compession_name', 'new': 'matrix_playbook_reverse_proxy_traefik_middleware_compression_name'} | - {'old': 'matrix_playbook_reverse_proxy_traefik_middleware_compession_name', 'new': 'matrix_playbook_reverse_proxy_traefik_middleware_compression_name'} | ||||
| - {'old': 'cinny_docker_image', 'new': 'cinny_container_image'} | |||||
| - {'old': 'cinny_docker_image_registry_prefix', 'new': 'cinny_container_image_registry_prefix'} | |||||
| - {'old': 'cinny_docker_image_registry_prefix_upstream', 'new': 'cinny_container_image_registry_prefix_upstream'} | |||||
| - {'old': 'cinny_docker_image_registry_prefix_upstream_default', 'new': 'cinny_container_image_registry_prefix_upstream_default'} | |||||
| - name: (Deprecation) Catch and report matrix_postgres variables | - name: (Deprecation) Catch and report matrix_postgres variables | ||||
| ansible.builtin.fail: | ansible.builtin.fail: | ||||
| msg: |- | msg: |- | ||||
| @@ -558,6 +563,19 @@ | |||||
| The following variables in your configuration need to be removed: {{ lookup('ansible.builtin.varnames', '^matrix_bot_chatgpt_.+', wantlist=True) | join(', ') }} | The following variables in your configuration need to be removed: {{ lookup('ansible.builtin.varnames', '^matrix_bot_chatgpt_.+', wantlist=True) | join(', ') }} | ||||
| when: "lookup('ansible.builtin.varnames', '^matrix_bot_chatgpt_.+', wantlist=True) | length > 0" | when: "lookup('ansible.builtin.varnames', '^matrix_bot_chatgpt_.+', wantlist=True) | length > 0" | ||||
| - name: (Deprecation) Catch and report matrix-client-cinny variables | |||||
| ansible.builtin.fail: | |||||
| msg: |- | |||||
| The matrix-client-cinny role in the playbook now lives under the MASH organization (https://github.com/mother-of-all-self-hosting/ansible-role-cinny). | |||||
| The new role is pretty much the same, but uses differently named variables. | |||||
| Please rename all `matrix_client_cinny_`-prefixed variables (`matrix_client_cinny_*` -> `cinny_*`) on your configuration file (vars.yml). | |||||
| After renaming them, please do not forget to fetch the Ansible role. See docs/maintenance-upgrading-services.md for details about how to do so. | |||||
| The following variables in your configuration need to be renamed: {{ lookup('ansible.builtin.varnames', '^matrix_client_cinny_.+', wantlist=True) | join(', ') }} | |||||
| when: "lookup('ansible.builtin.varnames', '^matrix_client_cinny_.+', wantlist=True) | length > 0" | |||||
| - name: (Deprecation) Catch and report mautrix-facebook variables | - name: (Deprecation) Catch and report mautrix-facebook variables | ||||
| ansible.builtin.fail: | ansible.builtin.fail: | ||||
| msg: |- | msg: |- | ||||
| @@ -111,7 +111,7 @@ | |||||
| - custom/matrix-registration | - custom/matrix-registration | ||||
| - custom/matrix-client-element | - custom/matrix-client-element | ||||
| - custom/matrix-client-hydrogen | - custom/matrix-client-hydrogen | ||||
| - custom/matrix-client-cinny | |||||
| - galaxy/cinny | |||||
| - custom/matrix-client-schildichat | - custom/matrix-client-schildichat | ||||
| - custom/matrix-client-fluffychat | - custom/matrix-client-fluffychat | ||||
| - galaxy/jitsi | - galaxy/jitsi | ||||