From 96f3d4fbba5b71658f1737813d2ed9e0f40a885c Mon Sep 17 00:00:00 2001 From: Slavi Pantaleev Date: Mon, 31 Aug 2026 06:55:31 +0300 Subject: [PATCH] Configure FluffyChat's internal HTTP port --- .../defaults/main.yml | 2 +- .../molecule/default/molecule.yml | 3 ++ .../molecule/default/verify.yml | 47 +++++++++++++++++-- .../matrix-client-fluffychat.service.j2 | 1 + 4 files changed, 48 insertions(+), 5 deletions(-) diff --git a/roles/custom/matrix-client-fluffychat/defaults/main.yml b/roles/custom/matrix-client-fluffychat/defaults/main.yml index 08e219837..ad51321b8 100644 --- a/roles/custom/matrix-client-fluffychat/defaults/main.yml +++ b/roles/custom/matrix-client-fluffychat/defaults/main.yml @@ -36,7 +36,7 @@ matrix_client_fluffychat_container_additional_networks_custom: [] # Configures the port number used inside the container image. matrix_client_fluffychat_container_http_port: 8080 -# Controls whether the matrix-client-fluffychat container exposes its HTTP port (tcp/8080 in the container). +# Controls whether the matrix-client-fluffychat container exposes its configured HTTP port (tcp/8080 by default). # # Takes an ":" or "" value (e.g. "127.0.0.1:8080"), or empty string to not expose. # diff --git a/roles/custom/matrix-client-fluffychat/molecule/default/molecule.yml b/roles/custom/matrix-client-fluffychat/molecule/default/molecule.yml index 1144aea6e..8d28f756c 100644 --- a/roles/custom/matrix-client-fluffychat/molecule/default/molecule.yml +++ b/roles/custom/matrix-client-fluffychat/molecule/default/molecule.yml @@ -34,6 +34,9 @@ provisioner: matrix_client_fluffychat_container_network: matrix-client-fluffychat-molecule + # The image defaults to 8080, so this proves the role configures the listener itself. + matrix_client_fluffychat_container_http_port: 8765 + # The live /config.json response is the weight-bearing proof that this # non-default setting reached the browser client through the role's mount. matrix_client_fluffychat_config_defaultHomeserver: homeserver.fluffy.molecule.local diff --git a/roles/custom/matrix-client-fluffychat/molecule/default/verify.yml b/roles/custom/matrix-client-fluffychat/molecule/default/verify.yml index 995152702..d2e7eb40e 100644 --- a/roles/custom/matrix-client-fluffychat/molecule/default/verify.yml +++ b/roles/custom/matrix-client-fluffychat/molecule/default/verify.yml @@ -60,7 +60,7 @@ - --show-error - --write-out - "\nHTTP_STATUS=%{http_code}" - - http://matrix-client-fluffychat:8080/ + - "http://matrix-client-fluffychat:{{ matrix_client_fluffychat_container_http_port }}/" register: matrix_client_fluffychat_root_http changed_when: false until: "'HTTP_STATUS=200' in matrix_client_fluffychat_root_http.stdout" @@ -91,7 +91,7 @@ - --show-error - --write-out - "\nHTTP_STATUS=%{http_code}\nCONTENT_TYPE=%{content_type}" - - http://matrix-client-fluffychat:8080/config.json + - "http://matrix-client-fluffychat:{{ matrix_client_fluffychat_container_http_port }}/config.json" register: matrix_client_fluffychat_config_http changed_when: false failed_when: false @@ -140,7 +140,7 @@ - /dev/null - --write-out - "HTTP_STATUS=%{http_code}\nCONTENT_TYPE=%{content_type}\nSIZE=%{size_download}" - - "http://matrix-client-fluffychat:8080/{{ matrix_client_fluffychat_application_asset_path }}" + - "http://matrix-client-fluffychat:{{ matrix_client_fluffychat_container_http_port }}/{{ matrix_client_fluffychat_application_asset_path }}" register: matrix_client_fluffychat_asset_http changed_when: false failed_when: false @@ -192,7 +192,7 @@ that: - matrix_client_fluffychat_labels_parsed['traefik.enable'] == 'true' - matrix_client_fluffychat_labels_parsed['traefik.docker.network'] == matrix_client_fluffychat_container_network - - matrix_client_fluffychat_labels_parsed['traefik.http.services.matrix-client-fluffychat.loadbalancer.server.port'] == '8080' + - matrix_client_fluffychat_labels_parsed['traefik.http.services.matrix-client-fluffychat.loadbalancer.server.port'] == (matrix_client_fluffychat_container_http_port | string) - matrix_client_fluffychat_labels_parsed['traefik.http.routers.matrix-client-fluffychat.rule'] == 'Host(`chat.fluffy.molecule.local`) && PathPrefix(`/fluffy`)' - matrix_client_fluffychat_labels_parsed['traefik.http.routers.matrix-client-fluffychat.priority'] == '731' - matrix_client_fluffychat_labels_parsed['traefik.http.routers.matrix-client-fluffychat.entrypoints'] == 'web' @@ -228,12 +228,20 @@ that: - matrix_client_fluffychat_runtime.Config.Labels['traefik.enable'] == 'true' - matrix_client_fluffychat_runtime.Config.Labels['traefik.docker.network'] == matrix_client_fluffychat_container_network + - matrix_client_fluffychat_runtime.Config.Labels['traefik.http.services.matrix-client-fluffychat.loadbalancer.server.port'] == (matrix_client_fluffychat_container_http_port | string) - matrix_client_fluffychat_runtime.Config.Labels['traefik.http.routers.matrix-client-fluffychat.priority'] == '731' - matrix_client_fluffychat_runtime.Config.Labels['molecule.fluffychat.coverage'] == 'enabled' - matrix_client_fluffychat_runtime.Config.Labels['molecule.fluffychat.extra-argument'] == 'reached' fail_msg: "The running container does not carry the labels the role rendered and passed" success_msg: "The configured labels reached the running container" + - name: Assert the configured internal port reached the running container + ansible.builtin.assert: + that: + - "('SERVER_PORT=' ~ (matrix_client_fluffychat_container_http_port | string)) in matrix_client_fluffychat_runtime.Config.Env" + fail_msg: "The running container did not receive its configured internal HTTP port" + success_msg: "The configured internal HTTP port reached the running container" + - name: Assert the running container uses the exact image and version the role pins ansible.builtin.assert: that: @@ -320,6 +328,37 @@ fail_msg: "The configured container hostname extra argument did not reach Docker" success_msg: "The configured container extra argument reached Docker" + - name: Probe the image's default HTTP port + ansible.builtin.command: + argv: + - docker + - run + - --rm + - --network={{ matrix_client_fluffychat_container_network }} + - "{{ molecule_shared_image_curl }}" + - --silent + - --show-error + - --connect-timeout + - "2" + - --max-time + - "3" + - --output + - /dev/null + - --write-out + - "HTTP_STATUS=%{http_code}" + - http://matrix-client-fluffychat:8080/ + register: matrix_client_fluffychat_default_port_http + changed_when: false + failed_when: false + + - name: Assert the image's default HTTP port is closed + ansible.builtin.assert: + that: + - matrix_client_fluffychat_default_port_http.rc != 0 + - matrix_client_fluffychat_default_port_http.stdout != 'HTTP_STATUS=200' + fail_msg: "FluffyChat still listens on the image's default port instead of only the configured port" + success_msg: "FluffyChat no longer listens on the image's default HTTP port" + - name: Ask Docker for FluffyChat's published ports ansible.builtin.command: argv: diff --git a/roles/custom/matrix-client-fluffychat/templates/systemd/matrix-client-fluffychat.service.j2 b/roles/custom/matrix-client-fluffychat/templates/systemd/matrix-client-fluffychat.service.j2 index f5ee16627..6e7b23cce 100644 --- a/roles/custom/matrix-client-fluffychat/templates/systemd/matrix-client-fluffychat.service.j2 +++ b/roles/custom/matrix-client-fluffychat/templates/systemd/matrix-client-fluffychat.service.j2 @@ -18,6 +18,7 @@ ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} create \ --name=matrix-client-fluffychat \ --log-driver=none \ --user={{ matrix_user_uid }}:{{ matrix_user_gid }} \ + --env=SERVER_PORT={{ matrix_client_fluffychat_container_http_port }} \ --cap-drop=ALL \ --read-only \ --network={{ matrix_client_fluffychat_container_network }} \