From 0cdc393867d3ed5d8014cb2ed334d85f34a73b17 Mon Sep 17 00:00:00 2001 From: Suguru Hirahara Date: Mon, 16 Feb 2026 04:12:26 +0900 Subject: [PATCH 01/18] Use ansible-role-synapse-admin Signed-off-by: Suguru Hirahara --- docs/configuring-playbook-synapse-admin.md | 2 +- requirements.yml | 3 +++ setup.yml | 2 +- 3 files changed, 5 insertions(+), 2 deletions(-) diff --git a/docs/configuring-playbook-synapse-admin.md b/docs/configuring-playbook-synapse-admin.md index 475bce71d..d8d2bc5ad 100644 --- a/docs/configuring-playbook-synapse-admin.md +++ b/docs/configuring-playbook-synapse-admin.md @@ -65,7 +65,7 @@ There are some additional things you may wish to configure about the component. Take a look at: -- `roles/custom/matrix-synapse-admin/defaults/main.yml` for some variables that you can customize via your `vars.yml` file. You can override settings (even those that don't have dedicated playbook variables) using the `matrix_synapse_admin_configuration_extension_json` variable +- `roles/galaxy/synapse_admin/defaults/main.yml` for some variables that you can customize via your `vars.yml` file. You can override settings (even those that don't have dedicated playbook variables) using the `matrix_synapse_admin_configuration_extension_json` variable ## Installing diff --git a/requirements.yml b/requirements.yml index b1f5f46e8..e00bb3d6f 100644 --- a/requirements.yml +++ b/requirements.yml @@ -71,6 +71,9 @@ - src: git+https://github.com/mother-of-all-self-hosting/ansible-role-prometheus-postgres-exporter.git version: v0.19.0-0 name: prometheus_postgres_exporter +- src: git+https://github.com/mother-of-all-self-hosting/ansible-role-synapse-admin.git + version: v0.11.1-etke53-0 + name: synapse_admin - src: git+https://github.com/devture/com.devture.ansible.role.systemd_docker_base.git version: v1.4.1-0 name: systemd_docker_base diff --git a/setup.yml b/setup.yml index 7df31563b..cdf40180d 100644 --- a/setup.yml +++ b/setup.yml @@ -98,7 +98,7 @@ - custom/matrix-dendrite - custom/matrix-conduit - custom/matrix-continuwuity - - custom/matrix-synapse-admin + - galaxy/synapse_admin - custom/matrix-synapse-usage-exporter - galaxy/prometheus_node_exporter - galaxy/prometheus_postgres_exporter From 42afc170000eb34d32b65b9cb7ad3b2f48ba62fd Mon Sep 17 00:00:00 2001 From: Suguru Hirahara Date: Mon, 16 Feb 2026 04:16:06 +0900 Subject: [PATCH 02/18] Replace "matrix-synapse-admin" with "synapse-admin" Signed-off-by: Suguru Hirahara --- docs/configuring-playbook-synapse-admin.md | 2 +- docs/self-building.md | 2 +- group_vars/matrix_servers | 6 ++-- .../matrix-synapse-admin/defaults/main.yml | 10 +++--- .../tasks/setup_install.yml | 20 +++++------ .../tasks/setup_uninstall.yml | 14 ++++---- .../tasks/validate_config.yml | 4 +-- .../matrix-synapse-admin/templates/labels.j2 | 34 +++++++++---------- .../systemd/matrix-synapse-admin.service.j2 | 18 +++++----- 9 files changed, 55 insertions(+), 55 deletions(-) diff --git a/docs/configuring-playbook-synapse-admin.md b/docs/configuring-playbook-synapse-admin.md index d8d2bc5ad..20c40f636 100644 --- a/docs/configuring-playbook-synapse-admin.md +++ b/docs/configuring-playbook-synapse-admin.md @@ -88,6 +88,6 @@ To use Synapse Admin, you need to have [registered at least one administrator ac ## Troubleshooting -As with all other services, you can find the logs in [systemd-journald](https://www.freedesktop.org/software/systemd/man/systemd-journald.service.html) by logging in to the server with SSH and running `journalctl -fu matrix-synapse-admin`. +As with all other services, you can find the logs in [systemd-journald](https://www.freedesktop.org/software/systemd/man/systemd-journald.service.html) by logging in to the server with SSH and running `journalctl -fu synapse-admin`. If you have questions, you can join this community room and feel free to ask: [#synapse-admin:etke.cc](https://matrix.to/#/#synapse-admin:etke.cc) diff --git a/docs/self-building.md b/docs/self-building.md index 64870ef02..4ff10210a 100644 --- a/docs/self-building.md +++ b/docs/self-building.md @@ -26,7 +26,7 @@ Note that **not all components support self-building yet**. Possibly outdated list of roles where self-building the Docker image is currently possible: - `matrix-synapse` -- `matrix-synapse-admin` +- `synapse-admin` - `matrix-client-element` - `hydrogen` - `cinny` diff --git a/group_vars/matrix_servers b/group_vars/matrix_servers index e12a94fbd..cbe7926e5 100755 --- a/group_vars/matrix_servers +++ b/group_vars/matrix_servers @@ -855,7 +855,7 @@ devture_systemd_service_manager_services_list_auto: | }] if matrix_synapse_auto_compressor_enabled else []) + ([{ - 'name': 'matrix-synapse-admin.service', + 'name': 'synapse-admin.service', 'priority': 4000, 'restart_necessary': (matrix_synapse_admin_restart_necessary | bool), 'groups': ['matrix', 'synapse-admin'], @@ -4991,7 +4991,7 @@ matrix_synapse_reverse_proxy_companion_access_log_syslog_integration_server_port ###################################################################### # -# matrix-synapse-admin +# synapse-admin # ###################################################################### @@ -5172,7 +5172,7 @@ matrix_synapse_admin_config_asManagedUsers_auto: | ###################################################################### # -# /matrix-synapse-admin +# /synapse-admin # ###################################################################### diff --git a/roles/custom/matrix-synapse-admin/defaults/main.yml b/roles/custom/matrix-synapse-admin/defaults/main.yml index 418112ccb..03fb0d4ff 100644 --- a/roles/custom/matrix-synapse-admin/defaults/main.yml +++ b/roles/custom/matrix-synapse-admin/defaults/main.yml @@ -10,7 +10,7 @@ # SPDX-License-Identifier: AGPL-3.0-or-later --- -# matrix-synapse-admin is a web UI for managing the Synapse Matrix server +# synapse-admin is a web UI for managing the Synapse Matrix server # Project source code URL: https://github.com/Awesome-Technologies/synapse-admin # Fork source code URL: https://github.com/etkecc/synapse-admin @@ -36,14 +36,14 @@ matrix_synapse_admin_docker_image_registry_prefix_upstream_default: "ghcr.io/" matrix_synapse_admin_docker_image_force_pull: "{{ matrix_synapse_admin_docker_image.endswith(':latest') }}" # The base container network -matrix_synapse_admin_container_network: matrix-synapse-admin +matrix_synapse_admin_container_network: synapse-admin # A list of additional container networks that the container would be connected to. # The role does not create these networks, so make sure they already exist. # Use this to expose this container to a reverse proxy, which runs in a different container network. matrix_synapse_admin_container_additional_networks: [] -# Controls whether the matrix-synapse-admin container exposes its HTTP port (tcp/8080 in the container). +# Controls whether the synapse-admin container exposes its HTTP port (tcp/8080 in the container). # # Takes an ":" or "" value (e.g. "127.0.0.1:8766"), or empty string to not expose. matrix_synapse_admin_container_http_host_bind_port: '' @@ -94,10 +94,10 @@ matrix_synapse_admin_container_labels_traefik_additional_response_headers_custom # another.label="here" matrix_synapse_admin_container_labels_additional_labels: '' -# List of systemd services that matrix-synapse-admin.service depends on +# List of systemd services that synapse-admin.service depends on matrix_synapse_admin_systemd_required_services_list: "{{ [devture_systemd_docker_base_docker_service_name] if devture_systemd_docker_base_docker_service_name else [] }}" -# List of systemd services that matrix-synapse-admin.service wants +# List of systemd services that synapse-admin.service wants matrix_synapse_admin_systemd_wanted_services_list: [] # Specifies the value of the `X-XSS-Protection` header diff --git a/roles/custom/matrix-synapse-admin/tasks/setup_install.yml b/roles/custom/matrix-synapse-admin/tasks/setup_install.yml index 0a8675845..1521b348a 100644 --- a/roles/custom/matrix-synapse-admin/tasks/setup_install.yml +++ b/roles/custom/matrix-synapse-admin/tasks/setup_install.yml @@ -11,7 +11,7 @@ --- -- name: Ensure matrix-synapse-admin paths exists +- name: Ensure synapse-admin paths exists ansible.builtin.file: path: "{{ item.path }}" state: directory @@ -24,7 +24,7 @@ - {path: "{{ matrix_synapse_admin_docker_src_files_path }}", when: "{{ matrix_synapse_admin_container_image_self_build }}"} when: "item.when | bool" -- name: Ensure matrix-synapse-admin labels file is created +- name: Ensure synapse-admin labels file is created ansible.builtin.template: src: "{{ role_path }}/templates/labels.j2" dest: "{{ matrix_synapse_admin_base_path }}/labels" @@ -33,7 +33,7 @@ mode: 0640 register: matrix_synapse_admin_support_files_result -- name: Ensure matrix-synapse-admin configuration installed +- name: Ensure synapse-admin configuration installed ansible.builtin.copy: content: "{{ matrix_synapse_admin_configuration | to_nice_json }}" dest: "{{ matrix_synapse_admin_config_path }}/config.json" @@ -42,7 +42,7 @@ group: "{{ matrix_group_name }}" register: matrix_synapse_admin_config_result -- name: Ensure matrix-synapse-admin image is pulled +- name: Ensure synapse-admin image is pulled community.docker.docker_image: name: "{{ matrix_synapse_admin_docker_image }}" source: "{{ 'pull' if ansible_version.major > 2 or ansible_version.minor > 7 else omit }}" @@ -54,7 +54,7 @@ delay: "{{ devture_playbook_help_container_retries_delay }}" until: matrix_synapse_admin_container_image_pull_result is not failed -- name: Ensure matrix-synapse-admin repository is present when self-building +- name: Ensure synapse-admin repository is present when self-building ansible.builtin.git: repo: "{{ matrix_synapse_admin_container_image_self_build_repo }}" dest: "{{ matrix_synapse_admin_docker_src_files_path }}" @@ -65,7 +65,7 @@ register: matrix_synapse_admin_git_pull_results when: matrix_synapse_admin_container_image_self_build | bool -- name: Ensure matrix-synapse-admin Docker image is built +- name: Ensure synapse-admin Docker image is built community.docker.docker_image: name: "{{ matrix_synapse_admin_docker_image }}" source: build @@ -77,17 +77,17 @@ pull: true when: matrix_synapse_admin_container_image_self_build | bool -- name: Ensure matrix-synapse-admin container network is created +- name: Ensure synapse-admin container network is created community.general.docker_network: enable_ipv6: "{{ devture_systemd_docker_base_ipv6_enabled }}" name: "{{ matrix_synapse_admin_container_network }}" driver: bridge driver_options: "{{ devture_systemd_docker_base_container_networks_driver_options }}" -- name: Ensure matrix-synapse-admin.service installed +- name: Ensure synapse-admin.service installed ansible.builtin.template: - src: "{{ role_path }}/templates/systemd/matrix-synapse-admin.service.j2" - dest: "{{ devture_systemd_docker_base_systemd_path }}/matrix-synapse-admin.service" + src: "{{ role_path }}/templates/systemd/synapse-admin.service.j2" + dest: "{{ devture_systemd_docker_base_systemd_path }}/synapse-admin.service" mode: 0644 register: matrix_synapse_admin_systemd_service_result diff --git a/roles/custom/matrix-synapse-admin/tasks/setup_uninstall.yml b/roles/custom/matrix-synapse-admin/tasks/setup_uninstall.yml index 5436bc82b..a4bb0fd1d 100644 --- a/roles/custom/matrix-synapse-admin/tasks/setup_uninstall.yml +++ b/roles/custom/matrix-synapse-admin/tasks/setup_uninstall.yml @@ -4,26 +4,26 @@ --- -- name: Check existence of matrix-synapse-admin service +- name: Check existence of synapse-admin service ansible.builtin.stat: - path: "{{ devture_systemd_docker_base_systemd_path }}/matrix-synapse-admin.service" + path: "{{ devture_systemd_docker_base_systemd_path }}/synapse-admin.service" register: matrix_synapse_admin_service_stat - when: matrix_synapse_admin_service_stat.stat.exists | bool block: - - name: Ensure matrix-synapse-admin is stopped + - name: Ensure synapse-admin is stopped ansible.builtin.service: - name: matrix-synapse-admin + name: synapse-admin state: stopped enabled: false daemon_reload: true - - name: Ensure matrix-synapse-admin.service doesn't exist + - name: Ensure synapse-admin.service doesn't exist ansible.builtin.file: - path: "{{ devture_systemd_docker_base_systemd_path }}/matrix-synapse-admin.service" + path: "{{ devture_systemd_docker_base_systemd_path }}/synapse-admin.service" state: absent - - name: Ensure matrix-synapse-admin directory doesn't exist + - name: Ensure synapse-admin directory doesn't exist ansible.builtin.file: path: "{{ matrix_synapse_admin_base_path }}" state: absent diff --git a/roles/custom/matrix-synapse-admin/tasks/validate_config.yml b/roles/custom/matrix-synapse-admin/tasks/validate_config.yml index 2a3699d73..9a00d5803 100644 --- a/roles/custom/matrix-synapse-admin/tasks/validate_config.yml +++ b/roles/custom/matrix-synapse-admin/tasks/validate_config.yml @@ -6,7 +6,7 @@ --- -- name: (Deprecation) Catch and report renamed matrix-synapse-admin settings +- name: (Deprecation) Catch and report renamed synapse-admin settings ansible.builtin.fail: msg: >- Your configuration contains a variable, which now has a different name. @@ -22,7 +22,7 @@ - when: matrix_synapse_admin_container_labels_traefik_enabled | bool block: - - name: Fail if required matrix-synapse-admin Traefik settings not defined + - name: Fail if required synapse-admin Traefik settings not defined ansible.builtin.fail: msg: >- You need to define a required configuration setting (`{{ item }}`). diff --git a/roles/custom/matrix-synapse-admin/templates/labels.j2 b/roles/custom/matrix-synapse-admin/templates/labels.j2 index e030d49ca..4497daf9f 100644 --- a/roles/custom/matrix-synapse-admin/templates/labels.j2 +++ b/roles/custom/matrix-synapse-admin/templates/labels.j2 @@ -12,45 +12,45 @@ traefik.enable=true traefik.docker.network={{ matrix_synapse_admin_container_labels_traefik_docker_network }} {% endif %} -traefik.http.services.matrix-synapse-admin.loadbalancer.server.port=8080 +traefik.http.services.synapse-admin.loadbalancer.server.port=8080 {% set middlewares = [] %} {% if matrix_synapse_admin_container_labels_traefik_ipallowlist_sourcerange | length > 0 %} -traefik.http.middlewares.matrix-synapse-admin-ipallowlist.ipallowlist.sourcerange={{ matrix_synapse_admin_container_labels_traefik_ipallowlist_sourcerange | join(',') }} -{% set middlewares = middlewares + ['matrix-synapse-admin-ipallowlist'] %} +traefik.http.middlewares.synapse-admin-ipallowlist.ipallowlist.sourcerange={{ matrix_synapse_admin_container_labels_traefik_ipallowlist_sourcerange | join(',') }} +{% set middlewares = middlewares + ['synapse-admin-ipallowlist'] %} {% endif %} {% if matrix_synapse_admin_container_labels_traefik_path_prefix != '/' %} -traefik.http.middlewares.matrix-synapse-admin-slashless-redirect.redirectregex.regex=({{ matrix_synapse_admin_container_labels_traefik_path_prefix | quote }})$ -traefik.http.middlewares.matrix-synapse-admin-slashless-redirect.redirectregex.replacement=${1}/ -{% set middlewares = middlewares + ['matrix-synapse-admin-slashless-redirect'] %} +traefik.http.middlewares.synapse-admin-slashless-redirect.redirectregex.regex=({{ matrix_synapse_admin_container_labels_traefik_path_prefix | quote }})$ +traefik.http.middlewares.synapse-admin-slashless-redirect.redirectregex.replacement=${1}/ +{% set middlewares = middlewares + ['synapse-admin-slashless-redirect'] %} {% endif %} {% if matrix_synapse_admin_container_labels_traefik_path_prefix != '/' %} -traefik.http.middlewares.matrix-synapse-admin-strip-prefix.stripprefix.prefixes={{ matrix_synapse_admin_container_labels_traefik_path_prefix }} -{% set middlewares = middlewares + ['matrix-synapse-admin-strip-prefix'] %} +traefik.http.middlewares.synapse-admin-strip-prefix.stripprefix.prefixes={{ matrix_synapse_admin_container_labels_traefik_path_prefix }} +{% set middlewares = middlewares + ['synapse-admin-strip-prefix'] %} {% endif %} {% if matrix_synapse_admin_container_labels_traefik_additional_response_headers.keys() | length > 0 %} {% for name, value in matrix_synapse_admin_container_labels_traefik_additional_response_headers.items() %} -traefik.http.middlewares.matrix-synapse-admin-add-headers.headers.customresponseheaders.{{ name }}={{ value }} +traefik.http.middlewares.synapse-admin-add-headers.headers.customresponseheaders.{{ name }}={{ value }} {% endfor %} -{% set middlewares = middlewares + ['matrix-synapse-admin-add-headers'] %} +{% set middlewares = middlewares + ['synapse-admin-add-headers'] %} {% endif %} -traefik.http.routers.matrix-synapse-admin.rule={{ matrix_synapse_admin_container_labels_traefik_rule }} +traefik.http.routers.synapse-admin.rule={{ matrix_synapse_admin_container_labels_traefik_rule }} {% if matrix_synapse_admin_container_labels_traefik_priority | int > 0 %} -traefik.http.routers.matrix-synapse-admin.priority={{ matrix_synapse_admin_container_labels_traefik_priority }} +traefik.http.routers.synapse-admin.priority={{ matrix_synapse_admin_container_labels_traefik_priority }} {% endif %} {% if middlewares | length > 0 %} -traefik.http.routers.matrix-synapse-admin.middlewares={{ middlewares | join(',') }} +traefik.http.routers.synapse-admin.middlewares={{ middlewares | join(',') }} {% endif %} -traefik.http.routers.matrix-synapse-admin.service=matrix-synapse-admin -traefik.http.routers.matrix-synapse-admin.entrypoints={{ matrix_synapse_admin_container_labels_traefik_entrypoints }} -traefik.http.routers.matrix-synapse-admin.tls={{ matrix_synapse_admin_container_labels_traefik_tls | to_json }} +traefik.http.routers.synapse-admin.service=synapse-admin +traefik.http.routers.synapse-admin.entrypoints={{ matrix_synapse_admin_container_labels_traefik_entrypoints }} +traefik.http.routers.synapse-admin.tls={{ matrix_synapse_admin_container_labels_traefik_tls | to_json }} {% if matrix_synapse_admin_container_labels_traefik_tls %} -traefik.http.routers.matrix-synapse-admin.tls.certResolver={{ matrix_synapse_admin_container_labels_traefik_tls_certResolver }} +traefik.http.routers.synapse-admin.tls.certResolver={{ matrix_synapse_admin_container_labels_traefik_tls_certResolver }} {% endif %} {% endif %} diff --git a/roles/custom/matrix-synapse-admin/templates/systemd/matrix-synapse-admin.service.j2 b/roles/custom/matrix-synapse-admin/templates/systemd/matrix-synapse-admin.service.j2 index daf633a26..650265d1f 100644 --- a/roles/custom/matrix-synapse-admin/templates/systemd/matrix-synapse-admin.service.j2 +++ b/roles/custom/matrix-synapse-admin/templates/systemd/matrix-synapse-admin.service.j2 @@ -1,6 +1,6 @@ #jinja2: lstrip_blocks: True [Unit] -Description=matrix-synapse-admin +Description=synapse-admin {% for service in matrix_synapse_admin_systemd_required_services_list %} Requires={{ service }} After={{ service }} @@ -13,12 +13,12 @@ DefaultDependencies=no [Service] Type=simple Environment="HOME={{ devture_systemd_docker_base_systemd_unit_home_path }}" -ExecStartPre=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} stop -t {{ devture_systemd_docker_base_container_stop_grace_time_seconds }} matrix-synapse-admin 2>/dev/null || true' -ExecStartPre=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} rm matrix-synapse-admin 2>/dev/null || true' +ExecStartPre=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} stop -t {{ devture_systemd_docker_base_container_stop_grace_time_seconds }} synapse-admin 2>/dev/null || true' +ExecStartPre=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} rm synapse-admin 2>/dev/null || true' ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} create \ --rm \ - --name=matrix-synapse-admin \ + --name=synapse-admin \ --log-driver=none \ --cap-drop=ALL \ --read-only \ @@ -35,17 +35,17 @@ ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} create \ {{ matrix_synapse_admin_docker_image }} {% for network in matrix_synapse_admin_container_additional_networks %} -ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} network connect {{ network }} matrix-synapse-admin +ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} network connect {{ network }} synapse-admin {% endfor %} -ExecStart={{ devture_systemd_docker_base_host_command_docker }} start --attach matrix-synapse-admin +ExecStart={{ devture_systemd_docker_base_host_command_docker }} start --attach synapse-admin -ExecStop=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} stop -t {{ devture_systemd_docker_base_container_stop_grace_time_seconds }} matrix-synapse-admin 2>/dev/null || true' -ExecStop=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} rm matrix-synapse-admin 2>/dev/null || true' +ExecStop=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} stop -t {{ devture_systemd_docker_base_container_stop_grace_time_seconds }} synapse-admin 2>/dev/null || true' +ExecStop=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} rm synapse-admin 2>/dev/null || true' Restart=always RestartSec=30 -SyslogIdentifier=matrix-synapse-admin +SyslogIdentifier=synapse-admin [Install] WantedBy=multi-user.target From ebc487bd815b3fedf4944c6899c118647a5949d0 Mon Sep 17 00:00:00 2001 From: Suguru Hirahara Date: Mon, 16 Feb 2026 04:16:26 +0900 Subject: [PATCH 03/18] Replace `matrix_synapse_admin_` with `synapse_admin_` Signed-off-by: Suguru Hirahara --- CHANGELOG.md | 10 +- docs/configuring-playbook-synapse-admin.md | 12 +- group_vars/matrix_servers | 38 ++-- .../matrix-synapse-admin/defaults/main.yml | 168 +++++++++--------- .../matrix-synapse-admin/tasks/main.yml | 6 +- .../tasks/setup_install.yml | 62 +++---- .../tasks/setup_uninstall.yml | 6 +- .../tasks/validate_config.yml | 26 +-- .../matrix-synapse-admin/templates/labels.j2 | 38 ++-- .../systemd/matrix-synapse-admin.service.j2 | 22 +-- roles/custom/matrix-synapse/defaults/main.yml | 2 +- .../templates/synapse/homeserver.yaml.j2 | 2 +- .../tasks/validate_config.yml | 13 ++ 13 files changed, 209 insertions(+), 196 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 876d9d963..85acbab39 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -694,13 +694,13 @@ If upstream synapse-admin picks up the pace and improves, the etke.cc fork may d If you'd like to switch back to the original synapse-admin software, you can do so by adding the following configuration to your `vars.yml` file: ```yaml -matrix_synapse_admin_docker_image: "{{ matrix_synapse_admin_docker_image_registry_prefix }}awesometechnologies/synapse-admin:{{ matrix_synapse_admin_version }}" -matrix_synapse_admin_docker_image_registry_prefix_upstream: docker.io/ +synapse_admin_docker_image: "{{ synapse_admin_docker_image_registry_prefix }}awesometechnologies/synapse-admin:{{ synapse_admin_version }}" +synapse_admin_docker_image_registry_prefix_upstream: docker.io/ -matrix_synapse_admin_version: 0.10.3 +synapse_admin_version: 0.10.3 # If you need self-building (if running on arm32), uncomment this. -# matrix_synapse_admin_container_image_self_build_repo: "https://github.com/Awesome-Technologies/synapse-admin.git" +# synapse_admin_container_image_self_build_repo: "https://github.com/Awesome-Technologies/synapse-admin.git" ``` @@ -840,7 +840,7 @@ If you'd like **to go back to the old unrestricted behavior**, use the following ```yaml # Use this configuration to allow synapse-admin to manage any homeserver instance. -matrix_synapse_admin_config_restrictBaseUrl: [] +synapse_admin_config_restrictBaseUrl: [] ``` diff --git a/docs/configuring-playbook-synapse-admin.md b/docs/configuring-playbook-synapse-admin.md index 20c40f636..46747be59 100644 --- a/docs/configuring-playbook-synapse-admin.md +++ b/docs/configuring-playbook-synapse-admin.md @@ -33,7 +33,7 @@ If you wish to adjust it, see the section [below](#adjusting-the-synapse-admin-u To enable Synapse Admin, add the following configuration to your `inventory/host_vars/matrix.example.com/vars.yml` file: ```yaml -matrix_synapse_admin_enabled: true +synapse_admin_enabled: true ``` **Note**: Synapse Admin requires Synapse's [Admin APIs](https://element-hq.github.io/synapse/latest/usage/administration/admin_api/index.html) to function. Access to them is restricted with a valid access token, so exposing them publicly should not be a real security concern. Still, for additional security, we normally leave them unexposed, following [official Synapse reverse-proxying recommendations](https://element-hq.github.io/synapse/latest/reverse_proxy.html#synapse-administration-endpoints). Because Synapse Admin needs these APIs to function, when installing Synapse Admin, the playbook **automatically** exposes the Synapse Admin API publicly for you. Depending on the homeserver implementation you're using (Synapse, Dendrite), this is equivalent to: @@ -41,18 +41,18 @@ matrix_synapse_admin_enabled: true - for [Synapse](./configuring-playbook-synapse.md) (our default homeserver implementation): `matrix_synapse_container_labels_public_client_synapse_admin_api_enabled: true` - for [Dendrite](./configuring-playbook-dendrite.md): `matrix_dendrite_container_labels_public_client_synapse_admin_api_enabled: true` -By default, synapse-admin installation will be [restricted to only work with one homeserver](https://github.com/etkecc/synapse-admin/blob/e21e44362c879ac41f47c580b04210842b6ff3d7/README.md#restricting-available-homeserver) — the one managed by the playbook. To adjust these restrictions, tweak the `matrix_synapse_admin_config_restrictBaseUrl` variable. +By default, synapse-admin installation will be [restricted to only work with one homeserver](https://github.com/etkecc/synapse-admin/blob/e21e44362c879ac41f47c580b04210842b6ff3d7/README.md#restricting-available-homeserver) — the one managed by the playbook. To adjust these restrictions, tweak the `synapse_admin_config_restrictBaseUrl` variable. ### Adjusting the Synapse Admin URL (optional) -By tweaking the `matrix_synapse_admin_hostname` and `matrix_synapse_admin_path_prefix` variables, you can easily make the service available at a **different hostname and/or path** than the default one. +By tweaking the `synapse_admin_hostname` and `synapse_admin_path_prefix` variables, you can easily make the service available at a **different hostname and/or path** than the default one. Example additional configuration for your `vars.yml` file: ```yaml # Change the default hostname and path prefix -matrix_synapse_admin_hostname: admin.example.com -matrix_synapse_admin_path_prefix: / +synapse_admin_hostname: admin.example.com +synapse_admin_path_prefix: / ``` If you've changed the default hostname, you may need to create a CNAME record for the Synapse Admin domain (`admin.example.com`), which targets `matrix.example.com`. @@ -65,7 +65,7 @@ There are some additional things you may wish to configure about the component. Take a look at: -- `roles/galaxy/synapse_admin/defaults/main.yml` for some variables that you can customize via your `vars.yml` file. You can override settings (even those that don't have dedicated playbook variables) using the `matrix_synapse_admin_configuration_extension_json` variable +- `roles/galaxy/synapse_admin/defaults/main.yml` for some variables that you can customize via your `vars.yml` file. You can override settings (even those that don't have dedicated playbook variables) using the `synapse_admin_configuration_extension_json` variable ## Installing diff --git a/group_vars/matrix_servers b/group_vars/matrix_servers index cbe7926e5..67a6a3fda 100755 --- a/group_vars/matrix_servers +++ b/group_vars/matrix_servers @@ -857,9 +857,9 @@ devture_systemd_service_manager_services_list_auto: | ([{ 'name': 'synapse-admin.service', 'priority': 4000, - 'restart_necessary': (matrix_synapse_admin_restart_necessary | bool), + 'restart_necessary': (synapse_admin_restart_necessary | bool), 'groups': ['matrix', 'synapse-admin'], - }] if matrix_synapse_admin_enabled else []) + }] if synapse_admin_enabled else []) + ([{ 'name': (matrix_synapse_usage_exporter_identifier + '.service'), @@ -4754,7 +4754,7 @@ matrix_synapse_container_labels_matrix_labels_enabled: "{{ not matrix_synapse_wo matrix_synapse_container_labels_public_client_root_redirection_enabled: "{{ matrix_synapse_container_labels_public_client_root_redirection_url != '' }}" matrix_synapse_container_labels_public_client_root_redirection_url: "{{ (('https://' if matrix_playbook_ssl_enabled else 'http://') + matrix_server_fqn_element) if matrix_client_element_enabled else '' }}" -matrix_synapse_container_labels_public_client_synapse_admin_api_enabled: "{{ matrix_synapse_admin_enabled or matrix_element_admin_enabled }}" +matrix_synapse_container_labels_public_client_synapse_admin_api_enabled: "{{ synapse_admin_enabled or matrix_element_admin_enabled }}" matrix_synapse_container_labels_internal_client_synapse_admin_api_enabled: "{{ (matrix_bot_draupnir_enabled and matrix_bot_draupnir_admin_api_enabled) }}" matrix_synapse_container_labels_internal_client_synapse_admin_api_traefik_entrypoints: "{{ matrix_playbook_internal_matrix_client_api_traefik_entrypoint_name }}" @@ -4995,29 +4995,29 @@ matrix_synapse_reverse_proxy_companion_access_log_syslog_integration_server_port # ###################################################################### -matrix_synapse_admin_enabled: false +synapse_admin_enabled: false -matrix_synapse_admin_docker_image_registry_prefix_upstream: "{{ matrix_container_global_registry_prefix_override if matrix_container_global_registry_prefix_override else matrix_synapse_admin_docker_image_registry_prefix_upstream_default }}" +synapse_admin_docker_image_registry_prefix_upstream: "{{ matrix_container_global_registry_prefix_override if matrix_container_global_registry_prefix_override else synapse_admin_docker_image_registry_prefix_upstream_default }}" -matrix_synapse_admin_container_uid: "{{ matrix_user_uid }}" -matrix_synapse_admin_container_gid: "{{ matrix_user_gid }}" +synapse_admin_container_uid: "{{ matrix_user_uid }}" +synapse_admin_container_gid: "{{ matrix_user_gid }}" -matrix_synapse_admin_container_http_host_bind_port: "{{ (matrix_playbook_service_host_bind_interface_prefix ~ '8766') if matrix_playbook_service_host_bind_interface_prefix else '' }}" +synapse_admin_container_http_host_bind_port: "{{ (matrix_playbook_service_host_bind_interface_prefix ~ '8766') if matrix_playbook_service_host_bind_interface_prefix else '' }}" -matrix_synapse_admin_container_image_self_build: "{{ matrix_architecture not in ['arm64', 'amd64'] }}" +synapse_admin_container_image_self_build: "{{ matrix_architecture not in ['arm64', 'amd64'] }}" -matrix_synapse_admin_container_network: "{{ matrix_addons_container_network }}" +synapse_admin_container_network: "{{ matrix_addons_container_network }}" -matrix_synapse_admin_container_additional_networks: "{{ [matrix_playbook_reverse_proxyable_services_additional_network] if matrix_playbook_reverse_proxyable_services_additional_network else [] }}" +synapse_admin_container_additional_networks: "{{ [matrix_playbook_reverse_proxyable_services_additional_network] if matrix_playbook_reverse_proxyable_services_additional_network else [] }}" -matrix_synapse_admin_container_labels_traefik_enabled: "{{ matrix_playbook_reverse_proxy_type in ['playbook-managed-traefik', 'other-traefik-container'] }}" -matrix_synapse_admin_container_labels_traefik_docker_network: "{{ matrix_playbook_reverse_proxyable_services_additional_network }}" -matrix_synapse_admin_container_labels_traefik_entrypoints: "{{ traefik_entrypoint_primary }}" -matrix_synapse_admin_container_labels_traefik_tls_certResolver: "{{ traefik_certResolver_primary }}" +synapse_admin_container_labels_traefik_enabled: "{{ matrix_playbook_reverse_proxy_type in ['playbook-managed-traefik', 'other-traefik-container'] }}" +synapse_admin_container_labels_traefik_docker_network: "{{ matrix_playbook_reverse_proxyable_services_additional_network }}" +synapse_admin_container_labels_traefik_entrypoints: "{{ traefik_entrypoint_primary }}" +synapse_admin_container_labels_traefik_tls_certResolver: "{{ traefik_certResolver_primary }}" -matrix_synapse_admin_config_externalAuthProvider: "{{ matrix_authentication_service_enabled | default(false) or matrix_synapse_ext_password_provider_ldap_enabled | default(false) }}" +synapse_admin_config_externalAuthProvider: "{{ matrix_authentication_service_enabled | default(false) or matrix_synapse_ext_password_provider_ldap_enabled | default(false) }}" -matrix_synapse_admin_config_asManagedUsers_auto: | +synapse_admin_config_asManagedUsers_auto: | {{ ([ '^@'+(matrix_alertmanager_receiver_config_matrix_user_id_localpart | default('') | regex_escape) +':'+(matrix_domain | regex_escape)+'$', @@ -5633,7 +5633,7 @@ matrix_dendrite_container_labels_traefik_docker_network: "{{ matrix_playbook_rev matrix_dendrite_container_labels_traefik_entrypoints: "{{ traefik_entrypoint_primary }}" matrix_dendrite_container_labels_traefik_tls_certResolver: "{{ traefik_certResolver_primary }}" -matrix_dendrite_container_labels_public_client_synapse_admin_api_enabled: "{{ matrix_synapse_admin_enabled }}" +matrix_dendrite_container_labels_public_client_synapse_admin_api_enabled: "{{ synapse_admin_enabled }}" matrix_dendrite_container_labels_public_client_root_redirection_enabled: "{{ matrix_dendrite_container_labels_public_client_root_redirection_url != '' }}" matrix_dendrite_container_labels_public_client_root_redirection_url: "{{ (('https://' if matrix_playbook_ssl_enabled else 'http://') + matrix_server_fqn_element) if matrix_client_element_enabled else '' }}" @@ -5945,7 +5945,7 @@ matrix_static_files_file_matrix_client_property_m_tile_server_map_style_url: "{{ # We set this regardless of whether synapse-admin is enabled, because people may wish to use a hosted (externally) synapse-admin installation and still have it auto-configured. # See: https://github.com/etkecc/synapse-admin/pull/126 -matrix_static_files_file_matrix_client_property_cc_etke_synapse_admin_auto: "{{ matrix_synapse_admin_configuration if matrix_homeserver_implementation == 'synapse' else {} }}" +matrix_static_files_file_matrix_client_property_cc_etke_synapse_admin_auto: "{{ synapse_admin_configuration if matrix_homeserver_implementation == 'synapse' else {} }}" matrix_static_files_file_matrix_client_property_org_matrix_msc4143_rtc_foci_enabled: "{{ matrix_livekit_jwt_service_enabled }}" matrix_static_files_file_matrix_client_property_org_matrix_msc4143_rtc_foci_auto: |- diff --git a/roles/custom/matrix-synapse-admin/defaults/main.yml b/roles/custom/matrix-synapse-admin/defaults/main.yml index 03fb0d4ff..3622355e3 100644 --- a/roles/custom/matrix-synapse-admin/defaults/main.yml +++ b/roles/custom/matrix-synapse-admin/defaults/main.yml @@ -14,91 +14,91 @@ # Project source code URL: https://github.com/Awesome-Technologies/synapse-admin # Fork source code URL: https://github.com/etkecc/synapse-admin -matrix_synapse_admin_enabled: true +synapse_admin_enabled: true # A path on host where all related files will be saved -matrix_synapse_admin_base_path: "{{ matrix_base_data_path }}/synapse-admin" -matrix_synapse_admin_config_path: "{{ matrix_synapse_admin_base_path }}/config" -matrix_synapse_admin_docker_src_files_path: "{{ matrix_synapse_admin_base_path }}/docker-src" +synapse_admin_base_path: "{{ matrix_base_data_path }}/synapse-admin" +synapse_admin_config_path: "{{ synapse_admin_base_path }}/config" +synapse_admin_docker_src_files_path: "{{ synapse_admin_base_path }}/docker-src" -matrix_synapse_admin_container_uid: '' -matrix_synapse_admin_container_gid: '' +synapse_admin_container_uid: '' +synapse_admin_container_gid: '' -matrix_synapse_admin_container_image_self_build: false -matrix_synapse_admin_container_image_self_build_repo: "https://github.com/etkecc/synapse-admin.git" +synapse_admin_container_image_self_build: false +synapse_admin_container_image_self_build_repo: "https://github.com/etkecc/synapse-admin.git" # renovate: datasource=docker depName=ghcr.io/etkecc/synapse-admin -matrix_synapse_admin_version: v0.11.1-etke53 -matrix_synapse_admin_docker_image: "{{ matrix_synapse_admin_docker_image_registry_prefix }}etkecc/synapse-admin:{{ matrix_synapse_admin_version }}" -matrix_synapse_admin_docker_image_registry_prefix: "{{ 'localhost/' if matrix_synapse_admin_container_image_self_build else matrix_synapse_admin_docker_image_registry_prefix_upstream }}" -matrix_synapse_admin_docker_image_registry_prefix_upstream: "{{ matrix_synapse_admin_docker_image_registry_prefix_upstream_default }}" -matrix_synapse_admin_docker_image_registry_prefix_upstream_default: "ghcr.io/" -matrix_synapse_admin_docker_image_force_pull: "{{ matrix_synapse_admin_docker_image.endswith(':latest') }}" +synapse_admin_version: v0.11.1-etke53 +synapse_admin_docker_image: "{{ synapse_admin_docker_image_registry_prefix }}etkecc/synapse-admin:{{ synapse_admin_version }}" +synapse_admin_docker_image_registry_prefix: "{{ 'localhost/' if synapse_admin_container_image_self_build else synapse_admin_docker_image_registry_prefix_upstream }}" +synapse_admin_docker_image_registry_prefix_upstream: "{{ synapse_admin_docker_image_registry_prefix_upstream_default }}" +synapse_admin_docker_image_registry_prefix_upstream_default: "ghcr.io/" +synapse_admin_docker_image_force_pull: "{{ synapse_admin_docker_image.endswith(':latest') }}" # The base container network -matrix_synapse_admin_container_network: synapse-admin +synapse_admin_container_network: synapse-admin # A list of additional container networks that the container would be connected to. # The role does not create these networks, so make sure they already exist. # Use this to expose this container to a reverse proxy, which runs in a different container network. -matrix_synapse_admin_container_additional_networks: [] +synapse_admin_container_additional_networks: [] # Controls whether the synapse-admin container exposes its HTTP port (tcp/8080 in the container). # # Takes an ":" or "" value (e.g. "127.0.0.1:8766"), or empty string to not expose. -matrix_synapse_admin_container_http_host_bind_port: '' +synapse_admin_container_http_host_bind_port: '' # A list of extra arguments to pass to the container -matrix_synapse_admin_container_extra_arguments: [] +synapse_admin_container_extra_arguments: [] -# matrix_synapse_admin_container_labels_traefik_enabled controls whether labels to assist a Traefik reverse-proxy will be attached to the container. +# synapse_admin_container_labels_traefik_enabled controls whether labels to assist a Traefik reverse-proxy will be attached to the container. # See `../templates/labels.j2` for details. # -# To inject your own other container labels, see `matrix_synapse_admin_container_labels_additional_labels`. -matrix_synapse_admin_container_labels_traefik_enabled: true -matrix_synapse_admin_container_labels_traefik_docker_network: "{{ matrix_synapse_admin_container_network }}" -matrix_synapse_admin_container_labels_traefik_hostname: "{{ matrix_synapse_admin_hostname }}" +# To inject your own other container labels, see `synapse_admin_container_labels_additional_labels`. +synapse_admin_container_labels_traefik_enabled: true +synapse_admin_container_labels_traefik_docker_network: "{{ synapse_admin_container_network }}" +synapse_admin_container_labels_traefik_hostname: "{{ synapse_admin_hostname }}" # The path prefix must either be `/` or not end with a slash (e.g. `/synapse-admin`). -matrix_synapse_admin_container_labels_traefik_path_prefix: "{{ matrix_synapse_admin_path_prefix }}" -matrix_synapse_admin_container_labels_traefik_rule: "Host(`{{ matrix_synapse_admin_container_labels_traefik_hostname }}`){% if matrix_synapse_admin_container_labels_traefik_path_prefix != '/' %} && PathPrefix(`{{ matrix_synapse_admin_container_labels_traefik_path_prefix }}`){% endif %}" -matrix_synapse_admin_container_labels_traefik_priority: 0 -matrix_synapse_admin_container_labels_traefik_entrypoints: web-secure -matrix_synapse_admin_container_labels_traefik_tls: "{{ matrix_synapse_admin_container_labels_traefik_entrypoints != 'web' }}" -matrix_synapse_admin_container_labels_traefik_tls_certResolver: default # noqa var-naming +synapse_admin_container_labels_traefik_path_prefix: "{{ synapse_admin_path_prefix }}" +synapse_admin_container_labels_traefik_rule: "Host(`{{ synapse_admin_container_labels_traefik_hostname }}`){% if synapse_admin_container_labels_traefik_path_prefix != '/' %} && PathPrefix(`{{ synapse_admin_container_labels_traefik_path_prefix }}`){% endif %}" +synapse_admin_container_labels_traefik_priority: 0 +synapse_admin_container_labels_traefik_entrypoints: web-secure +synapse_admin_container_labels_traefik_tls: "{{ synapse_admin_container_labels_traefik_entrypoints != 'web' }}" +synapse_admin_container_labels_traefik_tls_certResolver: default # noqa var-naming # This setting is to define a list ip addresses to allow access to synapse-admin. # Each IP address should be in CIDR format, e.g. xxx.xxx.xxx.xxx/xx. # For more information, see: https://doc.traefik.io/traefik/middlewares/http/ipallowlist/ # If the list is empty, all IP addresses are allowed. -matrix_synapse_admin_container_labels_traefik_ipallowlist_sourcerange: [] +synapse_admin_container_labels_traefik_ipallowlist_sourcerange: [] # Controls which additional headers to attach to all HTTP responses. -# To add your own headers, use `matrix_synapse_admin_container_labels_traefik_additional_response_headers_custom` -matrix_synapse_admin_container_labels_traefik_additional_response_headers: "{{ matrix_synapse_admin_container_labels_traefik_additional_response_headers_auto | combine(matrix_synapse_admin_container_labels_traefik_additional_response_headers_custom) }}" -matrix_synapse_admin_container_labels_traefik_additional_response_headers_auto: | +# To add your own headers, use `synapse_admin_container_labels_traefik_additional_response_headers_custom` +synapse_admin_container_labels_traefik_additional_response_headers: "{{ synapse_admin_container_labels_traefik_additional_response_headers_auto | combine(synapse_admin_container_labels_traefik_additional_response_headers_custom) }}" +synapse_admin_container_labels_traefik_additional_response_headers_auto: | {{ {} - | combine ({'X-XSS-Protection': matrix_synapse_admin_http_header_xss_protection} if matrix_synapse_admin_http_header_xss_protection else {}) - | combine ({'X-Content-Type-Options': matrix_synapse_admin_http_header_content_type_options} if matrix_synapse_admin_http_header_content_type_options else {}) - | combine ({'Content-Security-Policy': matrix_synapse_admin_http_header_content_security_policy} if matrix_synapse_admin_http_header_content_security_policy else {}) - | combine ({'Permission-Policy': matrix_synapse_admin_http_header_content_permission_policy} if matrix_synapse_admin_http_header_content_permission_policy else {}) - | combine ({'Strict-Transport-Security': matrix_synapse_admin_http_header_strict_transport_security} if matrix_synapse_admin_http_header_strict_transport_security and matrix_synapse_admin_container_labels_traefik_tls else {}) + | combine ({'X-XSS-Protection': synapse_admin_http_header_xss_protection} if synapse_admin_http_header_xss_protection else {}) + | combine ({'X-Content-Type-Options': synapse_admin_http_header_content_type_options} if synapse_admin_http_header_content_type_options else {}) + | combine ({'Content-Security-Policy': synapse_admin_http_header_content_security_policy} if synapse_admin_http_header_content_security_policy else {}) + | combine ({'Permission-Policy': synapse_admin_http_header_content_permission_policy} if synapse_admin_http_header_content_permission_policy else {}) + | combine ({'Strict-Transport-Security': synapse_admin_http_header_strict_transport_security} if synapse_admin_http_header_strict_transport_security and synapse_admin_container_labels_traefik_tls else {}) }} -matrix_synapse_admin_container_labels_traefik_additional_response_headers_custom: {} +synapse_admin_container_labels_traefik_additional_response_headers_custom: {} -# matrix_synapse_admin_container_labels_additional_labels contains a multiline string with additional labels to add to the container label file. +# synapse_admin_container_labels_additional_labels contains a multiline string with additional labels to add to the container label file. # See `../templates/labels.j2` for details. # # Example: -# matrix_synapse_admin_container_labels_additional_labels: | +# synapse_admin_container_labels_additional_labels: | # my.label=1 # another.label="here" -matrix_synapse_admin_container_labels_additional_labels: '' +synapse_admin_container_labels_additional_labels: '' # List of systemd services that synapse-admin.service depends on -matrix_synapse_admin_systemd_required_services_list: "{{ [devture_systemd_docker_base_docker_service_name] if devture_systemd_docker_base_docker_service_name else [] }}" +synapse_admin_systemd_required_services_list: "{{ [devture_systemd_docker_base_docker_service_name] if devture_systemd_docker_base_docker_service_name else [] }}" # List of systemd services that synapse-admin.service wants -matrix_synapse_admin_systemd_wanted_services_list: [] +synapse_admin_systemd_wanted_services_list: [] # Specifies the value of the `X-XSS-Protection` header # Stops pages from loading when they detect reflected cross-site scripting (XSS) attacks. @@ -106,23 +106,23 @@ matrix_synapse_admin_systemd_wanted_services_list: [] # Learn more about it is here: # - https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-XSS-Protection # - https://portswigger.net/web-security/cross-site-scripting/reflected -matrix_synapse_admin_http_header_xss_protection: "1; mode=block" +synapse_admin_http_header_xss_protection: "1; mode=block" # Specifies the value of the `X-Content-Type-Options` header. # See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Content-Type-Options -matrix_synapse_admin_http_header_content_type_options: nosniff +synapse_admin_http_header_content_type_options: nosniff # Specifies the value of the `Content-Security-Policy` header. # See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy -matrix_synapse_admin_http_header_content_security_policy: frame-ancestors 'self' +synapse_admin_http_header_content_security_policy: frame-ancestors 'self' # Specifies the value of the `Permission-Policy` header. # See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Permission-Policy -matrix_synapse_admin_http_header_content_permission_policy: "{{ 'interest-cohort=()' if matrix_synapse_admin_floc_optout_enabled else '' }}" +synapse_admin_http_header_content_permission_policy: "{{ 'interest-cohort=()' if synapse_admin_floc_optout_enabled else '' }}" # Specifies the value of the `Strict-Transport-Security` header. # See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security -matrix_synapse_admin_http_header_strict_transport_security: "max-age=31536000; includeSubDomains{{ '; preload' if matrix_synapse_admin_hsts_preload_enabled else '' }}" +synapse_admin_http_header_strict_transport_security: "max-age=31536000; includeSubDomains{{ '; preload' if synapse_admin_hsts_preload_enabled else '' }}" # Controls whether to send a "Permissions-Policy interest-cohort=();" header along with all responses # @@ -132,8 +132,8 @@ matrix_synapse_admin_http_header_strict_transport_security: "max-age=31536000; i # - https://amifloced.org/ # # Of course, a better solution is to just stop using browsers (like Chrome), which participate in such tracking practices. -# See: `matrix_synapse_admin_content_permission_policy` -matrix_synapse_admin_floc_optout_enabled: true +# See: `synapse_admin_content_permission_policy` +synapse_admin_floc_optout_enabled: true # Controls if HSTS preloading is enabled # @@ -144,69 +144,69 @@ matrix_synapse_admin_floc_optout_enabled: true # - https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security # - https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security # - https://hstspreload.org/#opt-in -# See: `matrix_synapse_admin_http_header_strict_transport_security` -matrix_synapse_admin_hsts_preload_enabled: false +# See: `synapse_admin_http_header_strict_transport_security` +synapse_admin_hsts_preload_enabled: false # The hostname at which Synapse Admin is served. -matrix_synapse_admin_hostname: "{{ matrix_server_fqn_matrix }}" +synapse_admin_hostname: "{{ matrix_server_fqn_matrix }}" # The path at which Synapse Admin is exposed. # This value must either be `/` or not end with a slash (e.g. `/synapse-admin`). -matrix_synapse_admin_path_prefix: /synapse-admin +synapse_admin_path_prefix: /synapse-admin # Default synapse-admin configuration template which covers the generic use case. # You can customize it by controlling the various variables inside it. # -# For a more advanced customization, you can extend the default (see `matrix_synapse_admin_configuration_extension_json`) +# For a more advanced customization, you can extend the default (see `synapse_admin_configuration_extension_json`) # or completely replace this variable with your own template. # # The side-effect of this lookup is that Ansible would even parse the JSON for us, returning a dict. # This is unlike what it does when looking up YAML template files (no automatic parsing there). -matrix_synapse_admin_configuration_default: - restrictBaseUrl: "{{ matrix_synapse_admin_config_restrictBaseUrl }}" - externalAuthProvider: "{{ matrix_synapse_admin_config_externalAuthProvider }}" - corsCredentials: "{{ matrix_synapse_admin_config_corsCredentials }}" - asManagedUsers: "{{ matrix_synapse_admin_config_asManagedUsers }}" - menu: "{{ matrix_synapse_admin_config_menu }}" - -# Your custom JSON configuration for synapse-admin should go to `matrix_synapse_admin_configuration_extension_json`. -# This configuration extends the default starting configuration (`matrix_synapse_admin_configuration_default`). +synapse_admin_configuration_default: + restrictBaseUrl: "{{ synapse_admin_config_restrictBaseUrl }}" + externalAuthProvider: "{{ synapse_admin_config_externalAuthProvider }}" + corsCredentials: "{{ synapse_admin_config_corsCredentials }}" + asManagedUsers: "{{ synapse_admin_config_asManagedUsers }}" + menu: "{{ synapse_admin_config_menu }}" + +# Your custom JSON configuration for synapse-admin should go to `synapse_admin_configuration_extension_json`. +# This configuration extends the default starting configuration (`synapse_admin_configuration_default`). # # You can override individual variables from the default configuration, or introduce new ones. # # If you need something more special, you can take full control by -# completely redefining `matrix_synapse_admin_configuration_default`. +# completely redefining `synapse_admin_configuration_default`. # # Example configuration extension follows: # -# matrix_synapse_admin_configuration_extension_json: | +# synapse_admin_configuration_extension_json: | # { # "some_setting": true, # "another_setting": false # } -matrix_synapse_admin_configuration_extension_json: '{}' +synapse_admin_configuration_extension_json: '{}' -# This is similar to `matrix_synapse_admin_configuration_extension_json`, but intended for use by playbook or group vars -matrix_synapse_admin_configuration_extension_json_auto: '{}' +# This is similar to `synapse_admin_configuration_extension_json`, but intended for use by playbook or group vars +synapse_admin_configuration_extension_json_auto: '{}' -matrix_synapse_admin_configuration_extension: "{{ matrix_synapse_admin_configuration_extension_json_auto | from_json | combine(matrix_synapse_admin_configuration_extension_json | from_json if matrix_synapse_admin_configuration_extension_json | from_json is mapping else {}, recursive=True) }}" +synapse_admin_configuration_extension: "{{ synapse_admin_configuration_extension_json_auto | from_json | combine(synapse_admin_configuration_extension_json | from_json if synapse_admin_configuration_extension_json | from_json is mapping else {}, recursive=True) }}" # Holds the final synapse-admin configuration (a combination of the default and its extension). -# You most likely don't need to touch this variable. Instead, see `matrix_synapse_admin_configuration_default`. -matrix_synapse_admin_configuration: "{{ matrix_synapse_admin_configuration_default | combine(matrix_synapse_admin_configuration_extension, recursive=True) }}" +# You most likely don't need to touch this variable. Instead, see `synapse_admin_configuration_default`. +synapse_admin_configuration: "{{ synapse_admin_configuration_default | combine(synapse_admin_configuration_extension, recursive=True) }}" # Controls the restrictBaseUrl configuration setting, which, if defined, # restricts the homeserver(s), so that the user can no longer define a homeserver manually during login. -matrix_synapse_admin_config_restrictBaseUrl: "{{ matrix_homeserver_url }}" # noqa var-naming +synapse_admin_config_restrictBaseUrl: "{{ matrix_homeserver_url }}" # noqa var-naming # Controls the externalAuthProvider configuration setting, which, if defined, # enables a special compatibility mode that works better for external auth providers like LDAP, MAS, etc. -matrix_synapse_admin_config_externalAuthProvider: false # noqa var-naming +synapse_admin_config_externalAuthProvider: false # noqa var-naming # Controls the corsCredentials configuration setting, which, if defined, # allows including credentials (cookies, authorization headers, or TLS client certificates) in requests # ref: https://developer.mozilla.org/en-US/docs/Web/API/Fetch_API/Using_Fetch#including_credentials -matrix_synapse_admin_config_corsCredentials: "same-origin" # noqa var-naming +synapse_admin_config_corsCredentials: "same-origin" # noqa var-naming # Controls the menu configuration setting, which, if defined, adds new menu items to the Synapse Admin UI. # The format is a list of objects, where each object has the following keys: @@ -227,29 +227,29 @@ matrix_synapse_admin_config_corsCredentials: "same-origin" # noqa var-naming # "url": "https://github.com/etkecc/synapse-admin/issues" # } # ] -matrix_synapse_admin_config_menu: [] +synapse_admin_config_menu: [] # Controls the asManagedUsers configuration setting (managed by playbook), which, if defined, # restricts modifications of the specified users (e.g., bridge-managed). # You should use JS regex syntax to match the user IDs. # Example for mautrix-telegram: ["^@telegram_[a-zA-Z0-9]+:example\\.com$"] -# WARNING: you want to use matrix_synapse_admin_config_asManagedUsers_custom instead of this variable. -matrix_synapse_admin_config_asManagedUsers_auto: [] # noqa var-naming +# WARNING: you want to use synapse_admin_config_asManagedUsers_custom instead of this variable. +synapse_admin_config_asManagedUsers_auto: [] # noqa var-naming # Controls the asManagedUsers configuration setting (managed per host), which, if defined, # restricts modifications of the specified users (e.g., bridge-managed). # You should use JS regex syntax to match the user IDs. # Example for mautrix-telegram: ["^@telegram_[a-zA-Z0-9]+:example\\.com$"] -matrix_synapse_admin_config_asManagedUsers_custom: [] # noqa var-naming +synapse_admin_config_asManagedUsers_custom: [] # noqa var-naming # Controls the asManagedUsers configuration setting, which, if defined, # restricts modifications of the specified users (e.g., bridge-managed). # You should use JS regex syntax to match the user IDs. # Example for mautrix-telegram: ["^@telegram_[a-zA-Z0-9]+:example\\.com$"] -# WARNING: you want to use matrix_synapse_admin_config_asManagedUsers_custom instead of this variable. -matrix_synapse_admin_config_asManagedUsers: "{{ matrix_synapse_admin_config_asManagedUsers_auto + matrix_synapse_admin_config_asManagedUsers_custom }}" # noqa var-naming +# WARNING: you want to use synapse_admin_config_asManagedUsers_custom instead of this variable. +synapse_admin_config_asManagedUsers: "{{ synapse_admin_config_asManagedUsers_auto + synapse_admin_config_asManagedUsers_custom }}" # noqa var-naming -# matrix_synapse_admin_restart_necessary controls whether the service +# synapse_admin_restart_necessary controls whether the service # will be restarted (when true) or merely started (when false) by the # systemd service manager role (when conditional restart is enabled). # @@ -257,4 +257,4 @@ matrix_synapse_admin_config_asManagedUsers: "{{ matrix_synapse_admin_config_asMa # any configuration files, the systemd service file, or the container image changed. # The default of `false` means "no restart needed" — appropriate when the role's # installation tasks haven't run (e.g., due to --tags skipping them). -matrix_synapse_admin_restart_necessary: false +synapse_admin_restart_necessary: false diff --git a/roles/custom/matrix-synapse-admin/tasks/main.yml b/roles/custom/matrix-synapse-admin/tasks/main.yml index c66e9998e..f94d3cc9e 100644 --- a/roles/custom/matrix-synapse-admin/tasks/main.yml +++ b/roles/custom/matrix-synapse-admin/tasks/main.yml @@ -11,15 +11,15 @@ - install-all - install-synapse-admin block: - - when: matrix_synapse_admin_enabled | bool + - when: synapse_admin_enabled | bool ansible.builtin.include_tasks: "{{ role_path }}/tasks/validate_config.yml" - - when: matrix_synapse_admin_enabled | bool + - when: synapse_admin_enabled | bool ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_install.yml" - tags: - setup-all - setup-synapse-admin block: - - when: not matrix_synapse_admin_enabled | bool + - when: not synapse_admin_enabled | bool ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_uninstall.yml" diff --git a/roles/custom/matrix-synapse-admin/tasks/setup_install.yml b/roles/custom/matrix-synapse-admin/tasks/setup_install.yml index 1521b348a..ed9525438 100644 --- a/roles/custom/matrix-synapse-admin/tasks/setup_install.yml +++ b/roles/custom/matrix-synapse-admin/tasks/setup_install.yml @@ -19,68 +19,68 @@ owner: "{{ matrix_user_name }}" group: "{{ matrix_group_name }}" with_items: - - {path: "{{ matrix_synapse_admin_base_path }}", when: true} - - {path: "{{ matrix_synapse_admin_config_path }}", when: true} - - {path: "{{ matrix_synapse_admin_docker_src_files_path }}", when: "{{ matrix_synapse_admin_container_image_self_build }}"} + - {path: "{{ synapse_admin_base_path }}", when: true} + - {path: "{{ synapse_admin_config_path }}", when: true} + - {path: "{{ synapse_admin_docker_src_files_path }}", when: "{{ synapse_admin_container_image_self_build }}"} when: "item.when | bool" - name: Ensure synapse-admin labels file is created ansible.builtin.template: src: "{{ role_path }}/templates/labels.j2" - dest: "{{ matrix_synapse_admin_base_path }}/labels" + dest: "{{ synapse_admin_base_path }}/labels" owner: "{{ matrix_user_name }}" group: "{{ matrix_group_name }}" mode: 0640 - register: matrix_synapse_admin_support_files_result + register: synapse_admin_support_files_result - name: Ensure synapse-admin configuration installed ansible.builtin.copy: - content: "{{ matrix_synapse_admin_configuration | to_nice_json }}" - dest: "{{ matrix_synapse_admin_config_path }}/config.json" + content: "{{ synapse_admin_configuration | to_nice_json }}" + dest: "{{ synapse_admin_config_path }}/config.json" mode: 0644 owner: "{{ matrix_user_name }}" group: "{{ matrix_group_name }}" - register: matrix_synapse_admin_config_result + register: synapse_admin_config_result - name: Ensure synapse-admin image is pulled community.docker.docker_image: - name: "{{ matrix_synapse_admin_docker_image }}" + name: "{{ synapse_admin_docker_image }}" source: "{{ 'pull' if ansible_version.major > 2 or ansible_version.minor > 7 else omit }}" - force_source: "{{ matrix_synapse_admin_docker_image_force_pull if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}" - force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else matrix_synapse_admin_docker_image_force_pull }}" - when: not matrix_synapse_admin_container_image_self_build | bool - register: matrix_synapse_admin_container_image_pull_result + force_source: "{{ synapse_admin_docker_image_force_pull if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}" + force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else synapse_admin_docker_image_force_pull }}" + when: not synapse_admin_container_image_self_build | bool + register: synapse_admin_container_image_pull_result retries: "{{ devture_playbook_help_container_retries_count }}" delay: "{{ devture_playbook_help_container_retries_delay }}" - until: matrix_synapse_admin_container_image_pull_result is not failed + until: synapse_admin_container_image_pull_result is not failed - name: Ensure synapse-admin repository is present when self-building ansible.builtin.git: - repo: "{{ matrix_synapse_admin_container_image_self_build_repo }}" - dest: "{{ matrix_synapse_admin_docker_src_files_path }}" - version: "{{ matrix_synapse_admin_docker_image.split(':')[1] }}" + repo: "{{ synapse_admin_container_image_self_build_repo }}" + dest: "{{ synapse_admin_docker_src_files_path }}" + version: "{{ synapse_admin_docker_image.split(':')[1] }}" force: "yes" become: true become_user: "{{ matrix_user_name }}" - register: matrix_synapse_admin_git_pull_results - when: matrix_synapse_admin_container_image_self_build | bool + register: synapse_admin_git_pull_results + when: synapse_admin_container_image_self_build | bool - name: Ensure synapse-admin Docker image is built community.docker.docker_image: - name: "{{ matrix_synapse_admin_docker_image }}" + name: "{{ synapse_admin_docker_image }}" source: build - force_source: "{{ matrix_synapse_admin_git_pull_results.changed if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}" - force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else matrix_synapse_admin_git_pull_results.changed }}" + force_source: "{{ synapse_admin_git_pull_results.changed if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}" + force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else synapse_admin_git_pull_results.changed }}" build: dockerfile: Dockerfile - path: "{{ matrix_synapse_admin_docker_src_files_path }}" + path: "{{ synapse_admin_docker_src_files_path }}" pull: true - when: matrix_synapse_admin_container_image_self_build | bool + when: synapse_admin_container_image_self_build | bool - name: Ensure synapse-admin container network is created community.general.docker_network: enable_ipv6: "{{ devture_systemd_docker_base_ipv6_enabled }}" - name: "{{ matrix_synapse_admin_container_network }}" + name: "{{ synapse_admin_container_network }}" driver: bridge driver_options: "{{ devture_systemd_docker_base_container_networks_driver_options }}" @@ -89,14 +89,14 @@ src: "{{ role_path }}/templates/systemd/synapse-admin.service.j2" dest: "{{ devture_systemd_docker_base_systemd_path }}/synapse-admin.service" mode: 0644 - register: matrix_synapse_admin_systemd_service_result + register: synapse_admin_systemd_service_result - name: Determine whether Synapse Admin needs a restart ansible.builtin.set_fact: - matrix_synapse_admin_restart_necessary: >- + synapse_admin_restart_necessary: >- {{ - matrix_synapse_admin_support_files_result.changed | default(false) - or matrix_synapse_admin_config_result.changed | default(false) - or matrix_synapse_admin_systemd_service_result.changed | default(false) - or matrix_synapse_admin_container_image_pull_result.changed | default(false) + synapse_admin_support_files_result.changed | default(false) + or synapse_admin_config_result.changed | default(false) + or synapse_admin_systemd_service_result.changed | default(false) + or synapse_admin_container_image_pull_result.changed | default(false) }} diff --git a/roles/custom/matrix-synapse-admin/tasks/setup_uninstall.yml b/roles/custom/matrix-synapse-admin/tasks/setup_uninstall.yml index a4bb0fd1d..c4b5800ef 100644 --- a/roles/custom/matrix-synapse-admin/tasks/setup_uninstall.yml +++ b/roles/custom/matrix-synapse-admin/tasks/setup_uninstall.yml @@ -7,9 +7,9 @@ - name: Check existence of synapse-admin service ansible.builtin.stat: path: "{{ devture_systemd_docker_base_systemd_path }}/synapse-admin.service" - register: matrix_synapse_admin_service_stat + register: synapse_admin_service_stat -- when: matrix_synapse_admin_service_stat.stat.exists | bool +- when: synapse_admin_service_stat.stat.exists | bool block: - name: Ensure synapse-admin is stopped ansible.builtin.service: @@ -25,5 +25,5 @@ - name: Ensure synapse-admin directory doesn't exist ansible.builtin.file: - path: "{{ matrix_synapse_admin_base_path }}" + path: "{{ synapse_admin_base_path }}" state: absent diff --git a/roles/custom/matrix-synapse-admin/tasks/validate_config.yml b/roles/custom/matrix-synapse-admin/tasks/validate_config.yml index 9a00d5803..3eedc5ebc 100644 --- a/roles/custom/matrix-synapse-admin/tasks/validate_config.yml +++ b/roles/custom/matrix-synapse-admin/tasks/validate_config.yml @@ -13,14 +13,14 @@ Please rename the variable (`{{ item.old }}` -> `{{ item.new }}`) on your configuration file (vars.yml). when: "lookup('ansible.builtin.varnames', ('^' + item.old + '$'), wantlist=True) | length > 0" with_items: - - {'old': 'matrix_synapse_admin_docker_repo', 'new': 'matrix_synapse_admin_container_self_build_repo'} - - {'old': 'matrix_synapse_admin_container_self_build', 'new': 'matrix_synapse_admin_container_image_self_build'} - - {'old': 'matrix_synapse_admin_container_self_build_repo', 'new': 'matrix_synapse_admin_container_image_self_build_repo'} - - {'old': 'matrix_synapse_admin_public_endpoint', 'new': 'matrix_synapse_admin_path_prefix'} - - {'old': 'matrix_synapse_admin_nginx_proxy_integration_enabled', 'new': ''} - - {'old': 'matrix_synapse_admin_docker_image_name_prefix', 'new': 'matrix_synapse_admin_docker_image_registry_prefix'} + - {'old': 'synapse_admin_docker_repo', 'new': 'synapse_admin_container_self_build_repo'} + - {'old': 'synapse_admin_container_self_build', 'new': 'synapse_admin_container_image_self_build'} + - {'old': 'synapse_admin_container_self_build_repo', 'new': 'synapse_admin_container_image_self_build_repo'} + - {'old': 'synapse_admin_public_endpoint', 'new': 'synapse_admin_path_prefix'} + - {'old': 'synapse_admin_nginx_proxy_integration_enabled', 'new': ''} + - {'old': 'synapse_admin_docker_image_name_prefix', 'new': 'synapse_admin_docker_image_registry_prefix'} -- when: matrix_synapse_admin_container_labels_traefik_enabled | bool +- when: synapse_admin_container_labels_traefik_enabled | bool block: - name: Fail if required synapse-admin Traefik settings not defined ansible.builtin.fail: @@ -28,14 +28,14 @@ You need to define a required configuration setting (`{{ item }}`). when: "lookup('vars', item, default='') == ''" with_items: - - matrix_synapse_admin_container_labels_traefik_hostname - - matrix_synapse_admin_container_labels_traefik_path_prefix + - synapse_admin_container_labels_traefik_hostname + - synapse_admin_container_labels_traefik_path_prefix # We ensure it doesn't end with a slash, because we handle both (slash and no-slash). - # Knowing that `matrix_synapse_admin_container_labels_traefik_path_prefix` does not end with a slash + # Knowing that `synapse_admin_container_labels_traefik_path_prefix` does not end with a slash # ensures we know how to set these routes up without having to do "does it end with a slash" checks elsewhere. - - name: Fail if matrix_synapse_admin_container_labels_traefik_path_prefix ends with a slash + - name: Fail if synapse_admin_container_labels_traefik_path_prefix ends with a slash ansible.builtin.fail: msg: >- - matrix_synapse_admin_container_labels_traefik_path_prefix (`{{ matrix_synapse_admin_container_labels_traefik_path_prefix }}`) must either be `/` or not end with a slash (e.g. `/synapse-admin`). - when: "matrix_synapse_admin_container_labels_traefik_path_prefix != '/' and matrix_synapse_admin_container_labels_traefik_path_prefix[-1] == '/'" + synapse_admin_container_labels_traefik_path_prefix (`{{ synapse_admin_container_labels_traefik_path_prefix }}`) must either be `/` or not end with a slash (e.g. `/synapse-admin`). + when: "synapse_admin_container_labels_traefik_path_prefix != '/' and synapse_admin_container_labels_traefik_path_prefix[-1] == '/'" diff --git a/roles/custom/matrix-synapse-admin/templates/labels.j2 b/roles/custom/matrix-synapse-admin/templates/labels.j2 index 4497daf9f..5fbec3b80 100644 --- a/roles/custom/matrix-synapse-admin/templates/labels.j2 +++ b/roles/custom/matrix-synapse-admin/templates/labels.j2 @@ -5,54 +5,54 @@ SPDX-FileCopyrightText: 2025 MDAD project contributors SPDX-License-Identifier: AGPL-3.0-or-later #} -{% if matrix_synapse_admin_container_labels_traefik_enabled %} +{% if synapse_admin_container_labels_traefik_enabled %} traefik.enable=true -{% if matrix_synapse_admin_container_labels_traefik_docker_network %} -traefik.docker.network={{ matrix_synapse_admin_container_labels_traefik_docker_network }} +{% if synapse_admin_container_labels_traefik_docker_network %} +traefik.docker.network={{ synapse_admin_container_labels_traefik_docker_network }} {% endif %} traefik.http.services.synapse-admin.loadbalancer.server.port=8080 {% set middlewares = [] %} -{% if matrix_synapse_admin_container_labels_traefik_ipallowlist_sourcerange | length > 0 %} -traefik.http.middlewares.synapse-admin-ipallowlist.ipallowlist.sourcerange={{ matrix_synapse_admin_container_labels_traefik_ipallowlist_sourcerange | join(',') }} +{% if synapse_admin_container_labels_traefik_ipallowlist_sourcerange | length > 0 %} +traefik.http.middlewares.synapse-admin-ipallowlist.ipallowlist.sourcerange={{ synapse_admin_container_labels_traefik_ipallowlist_sourcerange | join(',') }} {% set middlewares = middlewares + ['synapse-admin-ipallowlist'] %} {% endif %} -{% if matrix_synapse_admin_container_labels_traefik_path_prefix != '/' %} -traefik.http.middlewares.synapse-admin-slashless-redirect.redirectregex.regex=({{ matrix_synapse_admin_container_labels_traefik_path_prefix | quote }})$ +{% if synapse_admin_container_labels_traefik_path_prefix != '/' %} +traefik.http.middlewares.synapse-admin-slashless-redirect.redirectregex.regex=({{ synapse_admin_container_labels_traefik_path_prefix | quote }})$ traefik.http.middlewares.synapse-admin-slashless-redirect.redirectregex.replacement=${1}/ {% set middlewares = middlewares + ['synapse-admin-slashless-redirect'] %} {% endif %} -{% if matrix_synapse_admin_container_labels_traefik_path_prefix != '/' %} -traefik.http.middlewares.synapse-admin-strip-prefix.stripprefix.prefixes={{ matrix_synapse_admin_container_labels_traefik_path_prefix }} +{% if synapse_admin_container_labels_traefik_path_prefix != '/' %} +traefik.http.middlewares.synapse-admin-strip-prefix.stripprefix.prefixes={{ synapse_admin_container_labels_traefik_path_prefix }} {% set middlewares = middlewares + ['synapse-admin-strip-prefix'] %} {% endif %} -{% if matrix_synapse_admin_container_labels_traefik_additional_response_headers.keys() | length > 0 %} -{% for name, value in matrix_synapse_admin_container_labels_traefik_additional_response_headers.items() %} +{% if synapse_admin_container_labels_traefik_additional_response_headers.keys() | length > 0 %} +{% for name, value in synapse_admin_container_labels_traefik_additional_response_headers.items() %} traefik.http.middlewares.synapse-admin-add-headers.headers.customresponseheaders.{{ name }}={{ value }} {% endfor %} {% set middlewares = middlewares + ['synapse-admin-add-headers'] %} {% endif %} -traefik.http.routers.synapse-admin.rule={{ matrix_synapse_admin_container_labels_traefik_rule }} -{% if matrix_synapse_admin_container_labels_traefik_priority | int > 0 %} -traefik.http.routers.synapse-admin.priority={{ matrix_synapse_admin_container_labels_traefik_priority }} +traefik.http.routers.synapse-admin.rule={{ synapse_admin_container_labels_traefik_rule }} +{% if synapse_admin_container_labels_traefik_priority | int > 0 %} +traefik.http.routers.synapse-admin.priority={{ synapse_admin_container_labels_traefik_priority }} {% endif %} {% if middlewares | length > 0 %} traefik.http.routers.synapse-admin.middlewares={{ middlewares | join(',') }} {% endif %} traefik.http.routers.synapse-admin.service=synapse-admin -traefik.http.routers.synapse-admin.entrypoints={{ matrix_synapse_admin_container_labels_traefik_entrypoints }} -traefik.http.routers.synapse-admin.tls={{ matrix_synapse_admin_container_labels_traefik_tls | to_json }} -{% if matrix_synapse_admin_container_labels_traefik_tls %} -traefik.http.routers.synapse-admin.tls.certResolver={{ matrix_synapse_admin_container_labels_traefik_tls_certResolver }} +traefik.http.routers.synapse-admin.entrypoints={{ synapse_admin_container_labels_traefik_entrypoints }} +traefik.http.routers.synapse-admin.tls={{ synapse_admin_container_labels_traefik_tls | to_json }} +{% if synapse_admin_container_labels_traefik_tls %} +traefik.http.routers.synapse-admin.tls.certResolver={{ synapse_admin_container_labels_traefik_tls_certResolver }} {% endif %} {% endif %} -{{ matrix_synapse_admin_container_labels_additional_labels }} +{{ synapse_admin_container_labels_additional_labels }} diff --git a/roles/custom/matrix-synapse-admin/templates/systemd/matrix-synapse-admin.service.j2 b/roles/custom/matrix-synapse-admin/templates/systemd/matrix-synapse-admin.service.j2 index 650265d1f..124dbb049 100644 --- a/roles/custom/matrix-synapse-admin/templates/systemd/matrix-synapse-admin.service.j2 +++ b/roles/custom/matrix-synapse-admin/templates/systemd/matrix-synapse-admin.service.j2 @@ -1,11 +1,11 @@ #jinja2: lstrip_blocks: True [Unit] Description=synapse-admin -{% for service in matrix_synapse_admin_systemd_required_services_list %} +{% for service in synapse_admin_systemd_required_services_list %} Requires={{ service }} After={{ service }} {% endfor %} -{% for service in matrix_synapse_admin_systemd_wanted_services_list %} +{% for service in synapse_admin_systemd_wanted_services_list %} Wants={{ service }} {% endfor %} DefaultDependencies=no @@ -22,19 +22,19 @@ ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} create \ --log-driver=none \ --cap-drop=ALL \ --read-only \ - --user={{ matrix_synapse_admin_container_uid }}:{{ matrix_synapse_admin_container_gid }} \ - --network={{ matrix_synapse_admin_container_network }} \ - {% if matrix_synapse_admin_container_http_host_bind_port %} - -p {{ matrix_synapse_admin_container_http_host_bind_port }}:8080 \ + --user={{ synapse_admin_container_uid }}:{{ synapse_admin_container_gid }} \ + --network={{ synapse_admin_container_network }} \ + {% if synapse_admin_container_http_host_bind_port %} + -p {{ synapse_admin_container_http_host_bind_port }}:8080 \ {% endif %} - --label-file={{ matrix_synapse_admin_base_path }}/labels \ - --mount type=bind,src={{ matrix_synapse_admin_config_path }}/config.json,dst=/var/public/config.json,ro \ - {% for arg in matrix_synapse_admin_container_extra_arguments %} + --label-file={{ synapse_admin_base_path }}/labels \ + --mount type=bind,src={{ synapse_admin_config_path }}/config.json,dst=/var/public/config.json,ro \ + {% for arg in synapse_admin_container_extra_arguments %} {{ arg }} \ {% endfor %} - {{ matrix_synapse_admin_docker_image }} + {{ synapse_admin_docker_image }} -{% for network in matrix_synapse_admin_container_additional_networks %} +{% for network in synapse_admin_container_additional_networks %} ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} network connect {{ network }} synapse-admin {% endfor %} diff --git a/roles/custom/matrix-synapse/defaults/main.yml b/roles/custom/matrix-synapse/defaults/main.yml index 71bf266ef..28e35f7e9 100644 --- a/roles/custom/matrix-synapse/defaults/main.yml +++ b/roles/custom/matrix-synapse/defaults/main.yml @@ -425,7 +425,7 @@ matrix_synapse_form_secret: "{{ matrix_synapse_macaroon_secret_key }}" # Controls how to reach server admin, used in ResouceLimitError -matrix_synapse_admin_contact: ~ +synapse_admin_contact: ~ matrix_synapse_max_upload_size_mb: 50 diff --git a/roles/custom/matrix-synapse/templates/synapse/homeserver.yaml.j2 b/roles/custom/matrix-synapse/templates/synapse/homeserver.yaml.j2 index 558dc1729..28da1fb4e 100644 --- a/roles/custom/matrix-synapse/templates/synapse/homeserver.yaml.j2 +++ b/roles/custom/matrix-synapse/templates/synapse/homeserver.yaml.j2 @@ -391,7 +391,7 @@ manhole_settings: # How to reach the server admin, used in ResourceLimitError # -admin_contact: {{ matrix_synapse_admin_contact | to_json }} +admin_contact: {{ synapse_admin_contact | to_json }} # Global blocking # diff --git a/roles/custom/matrix_playbook_migration/tasks/validate_config.yml b/roles/custom/matrix_playbook_migration/tasks/validate_config.yml index 3c2682b57..4173d2385 100644 --- a/roles/custom/matrix_playbook_migration/tasks/validate_config.yml +++ b/roles/custom/matrix_playbook_migration/tasks/validate_config.yml @@ -656,6 +656,19 @@ The following variables in your configuration need to be renamed: {{ lookup('ansible.builtin.varnames', '^matrix_dynamic_dns_.+', wantlist=True) | join(', ') }} when: "lookup('ansible.builtin.varnames', '^matrix_dynamic_dns_.+', wantlist=True) | length > 0" +- name: (Deprecation) Catch and report matrix-synapse-admin variables + ansible.builtin.fail: + msg: |- + The matrix-synapse-admin role in the playbook now lives under the MASH organization (https://github.com/mother-of-all-self-hosting/ansible-role-synapse-admin). + The new role is pretty much the same, but uses differently named variables. + + Please rename all `matrix_synapse_admin_`-prefixed variables (`matrix_synapse_admin_*` -> `synapse_admin_*`) on your configuration file (vars.yml). + + After renaming them, please do not forget to fetch the Ansible role. See docs/maintenance-upgrading-services.md for details about how to do so. + + The following variables in your configuration need to be renamed: {{ lookup('ansible.builtin.varnames', '^matrix_synapse_admin_.+', wantlist=True) | join(', ') }} + when: "lookup('ansible.builtin.varnames', '^matrix_synapse_admin_.+', wantlist=True) | length > 0" + - name: (Deprecation) Catch and report mautrix-facebook variables ansible.builtin.fail: msg: |- From 590e8c5c1de62965562881fb0efd6a813a603f73 Mon Sep 17 00:00:00 2001 From: Suguru Hirahara Date: Mon, 16 Feb 2026 04:16:37 +0900 Subject: [PATCH 04/18] Replace "synapse-admin" with "synapse_admin" Signed-off-by: Suguru Hirahara --- group_vars/matrix_servers | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/group_vars/matrix_servers b/group_vars/matrix_servers index 67a6a3fda..6f090a216 100755 --- a/group_vars/matrix_servers +++ b/group_vars/matrix_servers @@ -4991,7 +4991,7 @@ matrix_synapse_reverse_proxy_companion_access_log_syslog_integration_server_port ###################################################################### # -# synapse-admin +# synapse_admin # ###################################################################### @@ -5172,7 +5172,7 @@ synapse_admin_config_asManagedUsers_auto: | ###################################################################### # -# /synapse-admin +# /synapse_admin # ###################################################################### From 2a817b882c995e634a3aac7e92f3975aea556cbc Mon Sep 17 00:00:00 2001 From: Suguru Hirahara Date: Mon, 16 Feb 2026 04:16:50 +0900 Subject: [PATCH 05/18] Set "matrix-synapse-admin" to `synapse_admin_identifier` Signed-off-by: Suguru Hirahara --- docs/configuring-playbook-synapse-admin.md | 2 +- group_vars/matrix_servers | 4 +++- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/docs/configuring-playbook-synapse-admin.md b/docs/configuring-playbook-synapse-admin.md index 46747be59..f2b4cdd41 100644 --- a/docs/configuring-playbook-synapse-admin.md +++ b/docs/configuring-playbook-synapse-admin.md @@ -88,6 +88,6 @@ To use Synapse Admin, you need to have [registered at least one administrator ac ## Troubleshooting -As with all other services, you can find the logs in [systemd-journald](https://www.freedesktop.org/software/systemd/man/systemd-journald.service.html) by logging in to the server with SSH and running `journalctl -fu synapse-admin`. +As with all other services, you can find the logs in [systemd-journald](https://www.freedesktop.org/software/systemd/man/systemd-journald.service.html) by logging in to the server with SSH and running `journalctl -fu matrix-synapse-admin`. If you have questions, you can join this community room and feel free to ask: [#synapse-admin:etke.cc](https://matrix.to/#/#synapse-admin:etke.cc) diff --git a/group_vars/matrix_servers b/group_vars/matrix_servers index 6f090a216..05e75181f 100755 --- a/group_vars/matrix_servers +++ b/group_vars/matrix_servers @@ -855,7 +855,7 @@ devture_systemd_service_manager_services_list_auto: | }] if matrix_synapse_auto_compressor_enabled else []) + ([{ - 'name': 'synapse-admin.service', + 'name': (synapse_admin_identifier + '.service'), 'priority': 4000, 'restart_necessary': (synapse_admin_restart_necessary | bool), 'groups': ['matrix', 'synapse-admin'], @@ -4997,6 +4997,8 @@ matrix_synapse_reverse_proxy_companion_access_log_syslog_integration_server_port synapse_admin_enabled: false +synapse_admin_identifier: matrix-synapse-admin + synapse_admin_docker_image_registry_prefix_upstream: "{{ matrix_container_global_registry_prefix_override if matrix_container_global_registry_prefix_override else synapse_admin_docker_image_registry_prefix_upstream_default }}" synapse_admin_container_uid: "{{ matrix_user_uid }}" From 39d8c95ef7d0b572e6d761576922b1dfde0e08eb Mon Sep 17 00:00:00 2001 From: Suguru Hirahara Date: Mon, 16 Feb 2026 04:17:13 +0900 Subject: [PATCH 06/18] Set `synapse_admin_container_image_*` Signed-off-by: Suguru Hirahara --- CHANGELOG.md | 4 ++-- group_vars/matrix_servers | 3 ++- roles/custom/matrix-synapse-admin/defaults/main.yml | 10 +++++----- .../matrix-synapse-admin/tasks/setup_install.yml | 10 +++++----- .../matrix-synapse-admin/tasks/validate_config.yml | 2 +- .../templates/systemd/matrix-synapse-admin.service.j2 | 2 +- .../tasks/validate_config.yml | 5 +++++ 7 files changed, 21 insertions(+), 15 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 85acbab39..ed52c8041 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -694,8 +694,8 @@ If upstream synapse-admin picks up the pace and improves, the etke.cc fork may d If you'd like to switch back to the original synapse-admin software, you can do so by adding the following configuration to your `vars.yml` file: ```yaml -synapse_admin_docker_image: "{{ synapse_admin_docker_image_registry_prefix }}awesometechnologies/synapse-admin:{{ synapse_admin_version }}" -synapse_admin_docker_image_registry_prefix_upstream: docker.io/ +synapse_admin_container_image: "{{ synapse_admin_container_image_registry_prefix }}awesometechnologies/synapse-admin:{{ synapse_admin_version }}" +synapse_admin_container_image_registry_prefix_upstream: docker.io/ synapse_admin_version: 0.10.3 diff --git a/group_vars/matrix_servers b/group_vars/matrix_servers index 05e75181f..deaa0a177 100755 --- a/group_vars/matrix_servers +++ b/group_vars/matrix_servers @@ -4999,7 +4999,8 @@ synapse_admin_enabled: false synapse_admin_identifier: matrix-synapse-admin -synapse_admin_docker_image_registry_prefix_upstream: "{{ matrix_container_global_registry_prefix_override if matrix_container_global_registry_prefix_override else synapse_admin_docker_image_registry_prefix_upstream_default }}" +synapse_admin_container_image_registry_prefix: "{{ 'localhost/' if synapse_admin_container_image_self_build else synapse_admin_container_image_registry_prefix_upstream }}" +synapse_admin_container_image_registry_prefix_upstream: "{{ matrix_container_global_registry_prefix_override if matrix_container_global_registry_prefix_override else synapse_admin_container_image_registry_prefix_upstream_default }}" synapse_admin_container_uid: "{{ matrix_user_uid }}" synapse_admin_container_gid: "{{ matrix_user_gid }}" diff --git a/roles/custom/matrix-synapse-admin/defaults/main.yml b/roles/custom/matrix-synapse-admin/defaults/main.yml index 3622355e3..239c6a683 100644 --- a/roles/custom/matrix-synapse-admin/defaults/main.yml +++ b/roles/custom/matrix-synapse-admin/defaults/main.yml @@ -29,11 +29,11 @@ synapse_admin_container_image_self_build_repo: "https://github.com/etkecc/synaps # renovate: datasource=docker depName=ghcr.io/etkecc/synapse-admin synapse_admin_version: v0.11.1-etke53 -synapse_admin_docker_image: "{{ synapse_admin_docker_image_registry_prefix }}etkecc/synapse-admin:{{ synapse_admin_version }}" -synapse_admin_docker_image_registry_prefix: "{{ 'localhost/' if synapse_admin_container_image_self_build else synapse_admin_docker_image_registry_prefix_upstream }}" -synapse_admin_docker_image_registry_prefix_upstream: "{{ synapse_admin_docker_image_registry_prefix_upstream_default }}" -synapse_admin_docker_image_registry_prefix_upstream_default: "ghcr.io/" -synapse_admin_docker_image_force_pull: "{{ synapse_admin_docker_image.endswith(':latest') }}" +synapse_admin_container_image: "{{ synapse_admin_container_image_registry_prefix }}etkecc/synapse-admin:{{ synapse_admin_version }}" +synapse_admin_container_image_registry_prefix: "{{ 'localhost/' if synapse_admin_container_image_self_build else synapse_admin_container_image_registry_prefix_upstream }}" +synapse_admin_container_image_registry_prefix_upstream: "{{ synapse_admin_container_image_registry_prefix_upstream_default }}" +synapse_admin_container_image_registry_prefix_upstream_default: "ghcr.io/" +synapse_admin_container_image_force_pull: "{{ synapse_admin_container_image.endswith(':latest') }}" # The base container network synapse_admin_container_network: synapse-admin diff --git a/roles/custom/matrix-synapse-admin/tasks/setup_install.yml b/roles/custom/matrix-synapse-admin/tasks/setup_install.yml index ed9525438..d7def87b3 100644 --- a/roles/custom/matrix-synapse-admin/tasks/setup_install.yml +++ b/roles/custom/matrix-synapse-admin/tasks/setup_install.yml @@ -44,10 +44,10 @@ - name: Ensure synapse-admin image is pulled community.docker.docker_image: - name: "{{ synapse_admin_docker_image }}" + name: "{{ synapse_admin_container_image }}" source: "{{ 'pull' if ansible_version.major > 2 or ansible_version.minor > 7 else omit }}" - force_source: "{{ synapse_admin_docker_image_force_pull if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}" - force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else synapse_admin_docker_image_force_pull }}" + force_source: "{{ synapse_admin_container_image_force_pull if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}" + force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else synapse_admin_container_image_force_pull }}" when: not synapse_admin_container_image_self_build | bool register: synapse_admin_container_image_pull_result retries: "{{ devture_playbook_help_container_retries_count }}" @@ -58,7 +58,7 @@ ansible.builtin.git: repo: "{{ synapse_admin_container_image_self_build_repo }}" dest: "{{ synapse_admin_docker_src_files_path }}" - version: "{{ synapse_admin_docker_image.split(':')[1] }}" + version: "{{ synapse_admin_container_image.split(':')[1] }}" force: "yes" become: true become_user: "{{ matrix_user_name }}" @@ -67,7 +67,7 @@ - name: Ensure synapse-admin Docker image is built community.docker.docker_image: - name: "{{ synapse_admin_docker_image }}" + name: "{{ synapse_admin_container_image }}" source: build force_source: "{{ synapse_admin_git_pull_results.changed if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}" force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else synapse_admin_git_pull_results.changed }}" diff --git a/roles/custom/matrix-synapse-admin/tasks/validate_config.yml b/roles/custom/matrix-synapse-admin/tasks/validate_config.yml index 3eedc5ebc..b0a35b155 100644 --- a/roles/custom/matrix-synapse-admin/tasks/validate_config.yml +++ b/roles/custom/matrix-synapse-admin/tasks/validate_config.yml @@ -18,7 +18,7 @@ - {'old': 'synapse_admin_container_self_build_repo', 'new': 'synapse_admin_container_image_self_build_repo'} - {'old': 'synapse_admin_public_endpoint', 'new': 'synapse_admin_path_prefix'} - {'old': 'synapse_admin_nginx_proxy_integration_enabled', 'new': ''} - - {'old': 'synapse_admin_docker_image_name_prefix', 'new': 'synapse_admin_docker_image_registry_prefix'} + - {'old': 'synapse_admin_docker_image_name_prefix', 'new': 'synapse_admin_container_image_registry_prefix'} - when: synapse_admin_container_labels_traefik_enabled | bool block: diff --git a/roles/custom/matrix-synapse-admin/templates/systemd/matrix-synapse-admin.service.j2 b/roles/custom/matrix-synapse-admin/templates/systemd/matrix-synapse-admin.service.j2 index 124dbb049..b5413ce1b 100644 --- a/roles/custom/matrix-synapse-admin/templates/systemd/matrix-synapse-admin.service.j2 +++ b/roles/custom/matrix-synapse-admin/templates/systemd/matrix-synapse-admin.service.j2 @@ -32,7 +32,7 @@ ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} create \ {% for arg in synapse_admin_container_extra_arguments %} {{ arg }} \ {% endfor %} - {{ synapse_admin_docker_image }} + {{ synapse_admin_container_image }} {% for network in synapse_admin_container_additional_networks %} ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} network connect {{ network }} synapse-admin diff --git a/roles/custom/matrix_playbook_migration/tasks/validate_config.yml b/roles/custom/matrix_playbook_migration/tasks/validate_config.yml index 4173d2385..4168aa52c 100644 --- a/roles/custom/matrix_playbook_migration/tasks/validate_config.yml +++ b/roles/custom/matrix_playbook_migration/tasks/validate_config.yml @@ -95,6 +95,11 @@ - {'old': 'hydrogen_docker_image_registry_prefix_upstream', 'new': 'hydrogen_container_image_registry_prefix_upstream'} - {'old': 'hydrogen_docker_image_registry_prefix_upstream_default', 'new': 'hydrogen_container_image_registry_prefix_upstream_default'} + - {'old': 'synapse_admin_docker_image', 'new': 'synapse_admin_container_image'} + - {'old': 'synapse_admin_docker_image_registry_prefix', 'new': 'synapse_admin_container_image_registry_prefix'} + - {'old': 'synapse_admin_docker_image_registry_prefix_upstream', 'new': 'synapse_admin_container_image_registry_prefix_upstream'} + - {'old': 'synapse_admin_docker_image_registry_prefix_upstream_default', 'new': 'synapse_admin_container_image_registry_prefix_upstream_default'} + - name: (Deprecation) Catch and report matrix_postgres variables ansible.builtin.fail: msg: |- From 93fd8db339eab8a59c08347e14ba46ad4921177c Mon Sep 17 00:00:00 2001 From: Suguru Hirahara Date: Mon, 16 Feb 2026 04:17:24 +0900 Subject: [PATCH 07/18] Remove `synapse_admin_container_image_registry_prefix_*` Signed-off-by: Suguru Hirahara --- roles/custom/matrix-synapse-admin/defaults/main.yml | 2 -- 1 file changed, 2 deletions(-) diff --git a/roles/custom/matrix-synapse-admin/defaults/main.yml b/roles/custom/matrix-synapse-admin/defaults/main.yml index 239c6a683..e83e1fc00 100644 --- a/roles/custom/matrix-synapse-admin/defaults/main.yml +++ b/roles/custom/matrix-synapse-admin/defaults/main.yml @@ -30,8 +30,6 @@ synapse_admin_container_image_self_build_repo: "https://github.com/etkecc/synaps # renovate: datasource=docker depName=ghcr.io/etkecc/synapse-admin synapse_admin_version: v0.11.1-etke53 synapse_admin_container_image: "{{ synapse_admin_container_image_registry_prefix }}etkecc/synapse-admin:{{ synapse_admin_version }}" -synapse_admin_container_image_registry_prefix: "{{ 'localhost/' if synapse_admin_container_image_self_build else synapse_admin_container_image_registry_prefix_upstream }}" -synapse_admin_container_image_registry_prefix_upstream: "{{ synapse_admin_container_image_registry_prefix_upstream_default }}" synapse_admin_container_image_registry_prefix_upstream_default: "ghcr.io/" synapse_admin_container_image_force_pull: "{{ synapse_admin_container_image.endswith(':latest') }}" From 4b536d6926704de8e2223977ec4f07b9c033ebdf Mon Sep 17 00:00:00 2001 From: Suguru Hirahara Date: Mon, 16 Feb 2026 04:17:46 +0900 Subject: [PATCH 08/18] Move `synapse_admin_base_path` to matrix_servers Signed-off-by: Suguru Hirahara --- group_vars/matrix_servers | 2 ++ roles/custom/matrix-synapse-admin/defaults/main.yml | 1 - 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/group_vars/matrix_servers b/group_vars/matrix_servers index deaa0a177..1627eb2de 100755 --- a/group_vars/matrix_servers +++ b/group_vars/matrix_servers @@ -5173,6 +5173,8 @@ synapse_admin_config_asManagedUsers_auto: | ] if matrix_steam_bridge_enabled else []) }} +synapse_admin_base_path: "{{ matrix_base_data_path }}/synapse-admin" + ###################################################################### # # /synapse_admin diff --git a/roles/custom/matrix-synapse-admin/defaults/main.yml b/roles/custom/matrix-synapse-admin/defaults/main.yml index e83e1fc00..09d201fcb 100644 --- a/roles/custom/matrix-synapse-admin/defaults/main.yml +++ b/roles/custom/matrix-synapse-admin/defaults/main.yml @@ -17,7 +17,6 @@ synapse_admin_enabled: true # A path on host where all related files will be saved -synapse_admin_base_path: "{{ matrix_base_data_path }}/synapse-admin" synapse_admin_config_path: "{{ synapse_admin_base_path }}/config" synapse_admin_docker_src_files_path: "{{ synapse_admin_base_path }}/docker-src" From e2a87ea37955d23c033cd90112e951ce8bc7e801 Mon Sep 17 00:00:00 2001 From: Suguru Hirahara Date: Mon, 16 Feb 2026 04:20:29 +0900 Subject: [PATCH 09/18] Move `synapse_admin_hostname` to matrix_servers Signed-off-by: Suguru Hirahara --- group_vars/matrix_servers | 2 ++ roles/custom/matrix-synapse-admin/defaults/main.yml | 3 --- 2 files changed, 2 insertions(+), 3 deletions(-) diff --git a/group_vars/matrix_servers b/group_vars/matrix_servers index 1627eb2de..590c612c8 100755 --- a/group_vars/matrix_servers +++ b/group_vars/matrix_servers @@ -5175,6 +5175,8 @@ synapse_admin_config_asManagedUsers_auto: | synapse_admin_base_path: "{{ matrix_base_data_path }}/synapse-admin" +synapse_admin_hostname: "{{ matrix_server_fqn_matrix }}" + ###################################################################### # # /synapse_admin diff --git a/roles/custom/matrix-synapse-admin/defaults/main.yml b/roles/custom/matrix-synapse-admin/defaults/main.yml index 09d201fcb..016113d47 100644 --- a/roles/custom/matrix-synapse-admin/defaults/main.yml +++ b/roles/custom/matrix-synapse-admin/defaults/main.yml @@ -144,9 +144,6 @@ synapse_admin_floc_optout_enabled: true # See: `synapse_admin_http_header_strict_transport_security` synapse_admin_hsts_preload_enabled: false -# The hostname at which Synapse Admin is served. -synapse_admin_hostname: "{{ matrix_server_fqn_matrix }}" - # The path at which Synapse Admin is exposed. # This value must either be `/` or not end with a slash (e.g. `/synapse-admin`). synapse_admin_path_prefix: /synapse-admin From 3648397adec7a1d2a1fb56fb4189c142989c691f Mon Sep 17 00:00:00 2001 From: Suguru Hirahara Date: Mon, 16 Feb 2026 04:24:53 +0900 Subject: [PATCH 10/18] Move specific configurations to matrix_servers Signed-off-by: Suguru Hirahara --- group_vars/matrix_servers | 4 ++++ roles/custom/matrix-synapse-admin/defaults/main.yml | 8 -------- 2 files changed, 4 insertions(+), 8 deletions(-) diff --git a/group_vars/matrix_servers b/group_vars/matrix_servers index 590c612c8..82ee42c60 100755 --- a/group_vars/matrix_servers +++ b/group_vars/matrix_servers @@ -5020,6 +5020,8 @@ synapse_admin_container_labels_traefik_tls_certResolver: "{{ traefik_certResolve synapse_admin_config_externalAuthProvider: "{{ matrix_authentication_service_enabled | default(false) or matrix_synapse_ext_password_provider_ldap_enabled | default(false) }}" +synapse_admin_config_restrictBaseUrl: "{{ matrix_homeserver_url }}" # noqa var-naming + synapse_admin_config_asManagedUsers_auto: | {{ ([ @@ -5177,6 +5179,8 @@ synapse_admin_base_path: "{{ matrix_base_data_path }}/synapse-admin" synapse_admin_hostname: "{{ matrix_server_fqn_matrix }}" +synapse_admin_path_prefix: /synapse-admin + ###################################################################### # # /synapse_admin diff --git a/roles/custom/matrix-synapse-admin/defaults/main.yml b/roles/custom/matrix-synapse-admin/defaults/main.yml index 016113d47..5847ee044 100644 --- a/roles/custom/matrix-synapse-admin/defaults/main.yml +++ b/roles/custom/matrix-synapse-admin/defaults/main.yml @@ -144,10 +144,6 @@ synapse_admin_floc_optout_enabled: true # See: `synapse_admin_http_header_strict_transport_security` synapse_admin_hsts_preload_enabled: false -# The path at which Synapse Admin is exposed. -# This value must either be `/` or not end with a slash (e.g. `/synapse-admin`). -synapse_admin_path_prefix: /synapse-admin - # Default synapse-admin configuration template which covers the generic use case. # You can customize it by controlling the various variables inside it. # @@ -189,10 +185,6 @@ synapse_admin_configuration_extension: "{{ synapse_admin_configuration_extension # You most likely don't need to touch this variable. Instead, see `synapse_admin_configuration_default`. synapse_admin_configuration: "{{ synapse_admin_configuration_default | combine(synapse_admin_configuration_extension, recursive=True) }}" -# Controls the restrictBaseUrl configuration setting, which, if defined, -# restricts the homeserver(s), so that the user can no longer define a homeserver manually during login. -synapse_admin_config_restrictBaseUrl: "{{ matrix_homeserver_url }}" # noqa var-naming - # Controls the externalAuthProvider configuration setting, which, if defined, # enables a special compatibility mode that works better for external auth providers like LDAP, MAS, etc. synapse_admin_config_externalAuthProvider: false # noqa var-naming From 43ddd215f71fe5c8fb6be2b516ce0c0247435538 Mon Sep 17 00:00:00 2001 From: Suguru Hirahara Date: Mon, 16 Feb 2026 04:25:08 +0900 Subject: [PATCH 11/18] Replace `synapse_admin_container_uid` and `synapse_admin_container_gid` Signed-off-by: Suguru Hirahara --- group_vars/matrix_servers | 4 ++-- roles/custom/matrix-synapse-admin/defaults/main.yml | 4 ++-- .../templates/systemd/matrix-synapse-admin.service.j2 | 2 +- .../matrix_playbook_migration/tasks/validate_config.yml | 2 ++ 4 files changed, 7 insertions(+), 5 deletions(-) diff --git a/group_vars/matrix_servers b/group_vars/matrix_servers index 82ee42c60..9e7a21d29 100755 --- a/group_vars/matrix_servers +++ b/group_vars/matrix_servers @@ -5002,8 +5002,8 @@ synapse_admin_identifier: matrix-synapse-admin synapse_admin_container_image_registry_prefix: "{{ 'localhost/' if synapse_admin_container_image_self_build else synapse_admin_container_image_registry_prefix_upstream }}" synapse_admin_container_image_registry_prefix_upstream: "{{ matrix_container_global_registry_prefix_override if matrix_container_global_registry_prefix_override else synapse_admin_container_image_registry_prefix_upstream_default }}" -synapse_admin_container_uid: "{{ matrix_user_uid }}" -synapse_admin_container_gid: "{{ matrix_user_gid }}" +synapse_admin_uid: "{{ matrix_user_uid }}" +synapse_admin_gid: "{{ matrix_user_gid }}" synapse_admin_container_http_host_bind_port: "{{ (matrix_playbook_service_host_bind_interface_prefix ~ '8766') if matrix_playbook_service_host_bind_interface_prefix else '' }}" diff --git a/roles/custom/matrix-synapse-admin/defaults/main.yml b/roles/custom/matrix-synapse-admin/defaults/main.yml index 5847ee044..3edb3c131 100644 --- a/roles/custom/matrix-synapse-admin/defaults/main.yml +++ b/roles/custom/matrix-synapse-admin/defaults/main.yml @@ -20,8 +20,8 @@ synapse_admin_enabled: true synapse_admin_config_path: "{{ synapse_admin_base_path }}/config" synapse_admin_docker_src_files_path: "{{ synapse_admin_base_path }}/docker-src" -synapse_admin_container_uid: '' -synapse_admin_container_gid: '' +synapse_admin_uid: '' +synapse_admin_gid: '' synapse_admin_container_image_self_build: false synapse_admin_container_image_self_build_repo: "https://github.com/etkecc/synapse-admin.git" diff --git a/roles/custom/matrix-synapse-admin/templates/systemd/matrix-synapse-admin.service.j2 b/roles/custom/matrix-synapse-admin/templates/systemd/matrix-synapse-admin.service.j2 index b5413ce1b..086631f3f 100644 --- a/roles/custom/matrix-synapse-admin/templates/systemd/matrix-synapse-admin.service.j2 +++ b/roles/custom/matrix-synapse-admin/templates/systemd/matrix-synapse-admin.service.j2 @@ -22,7 +22,7 @@ ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} create \ --log-driver=none \ --cap-drop=ALL \ --read-only \ - --user={{ synapse_admin_container_uid }}:{{ synapse_admin_container_gid }} \ + --user={{ synapse_admin_uid }}:{{ synapse_admin_gid }} \ --network={{ synapse_admin_container_network }} \ {% if synapse_admin_container_http_host_bind_port %} -p {{ synapse_admin_container_http_host_bind_port }}:8080 \ diff --git a/roles/custom/matrix_playbook_migration/tasks/validate_config.yml b/roles/custom/matrix_playbook_migration/tasks/validate_config.yml index 4168aa52c..089874cd0 100644 --- a/roles/custom/matrix_playbook_migration/tasks/validate_config.yml +++ b/roles/custom/matrix_playbook_migration/tasks/validate_config.yml @@ -99,6 +99,8 @@ - {'old': 'synapse_admin_docker_image_registry_prefix', 'new': 'synapse_admin_container_image_registry_prefix'} - {'old': 'synapse_admin_docker_image_registry_prefix_upstream', 'new': 'synapse_admin_container_image_registry_prefix_upstream'} - {'old': 'synapse_admin_docker_image_registry_prefix_upstream_default', 'new': 'synapse_admin_container_image_registry_prefix_upstream_default'} + - {'old': 'synapse_admin_container_uid', 'new': 'synapse_admin_uid'} + - {'old': 'synapse_admin_container_gid', 'new': 'synapse_admin_gid'} - name: (Deprecation) Catch and report matrix_postgres variables ansible.builtin.fail: From d61ca8427a7102f30f6cb3b684d76a969029adfb Mon Sep 17 00:00:00 2001 From: Suguru Hirahara Date: Mon, 16 Feb 2026 04:25:20 +0900 Subject: [PATCH 12/18] Move items to catch and report the variables Signed-off-by: Suguru Hirahara --- .../matrix-synapse-admin/tasks/validate_config.yml | 14 -------------- .../tasks/validate_config.yml | 6 ++++++ 2 files changed, 6 insertions(+), 14 deletions(-) diff --git a/roles/custom/matrix-synapse-admin/tasks/validate_config.yml b/roles/custom/matrix-synapse-admin/tasks/validate_config.yml index b0a35b155..2dd06a601 100644 --- a/roles/custom/matrix-synapse-admin/tasks/validate_config.yml +++ b/roles/custom/matrix-synapse-admin/tasks/validate_config.yml @@ -6,20 +6,6 @@ --- -- name: (Deprecation) Catch and report renamed synapse-admin settings - ansible.builtin.fail: - msg: >- - Your configuration contains a variable, which now has a different name. - Please rename the variable (`{{ item.old }}` -> `{{ item.new }}`) on your configuration file (vars.yml). - when: "lookup('ansible.builtin.varnames', ('^' + item.old + '$'), wantlist=True) | length > 0" - with_items: - - {'old': 'synapse_admin_docker_repo', 'new': 'synapse_admin_container_self_build_repo'} - - {'old': 'synapse_admin_container_self_build', 'new': 'synapse_admin_container_image_self_build'} - - {'old': 'synapse_admin_container_self_build_repo', 'new': 'synapse_admin_container_image_self_build_repo'} - - {'old': 'synapse_admin_public_endpoint', 'new': 'synapse_admin_path_prefix'} - - {'old': 'synapse_admin_nginx_proxy_integration_enabled', 'new': ''} - - {'old': 'synapse_admin_docker_image_name_prefix', 'new': 'synapse_admin_container_image_registry_prefix'} - - when: synapse_admin_container_labels_traefik_enabled | bool block: - name: Fail if required synapse-admin Traefik settings not defined diff --git a/roles/custom/matrix_playbook_migration/tasks/validate_config.yml b/roles/custom/matrix_playbook_migration/tasks/validate_config.yml index 089874cd0..40cd60e69 100644 --- a/roles/custom/matrix_playbook_migration/tasks/validate_config.yml +++ b/roles/custom/matrix_playbook_migration/tasks/validate_config.yml @@ -101,6 +101,12 @@ - {'old': 'synapse_admin_docker_image_registry_prefix_upstream_default', 'new': 'synapse_admin_container_image_registry_prefix_upstream_default'} - {'old': 'synapse_admin_container_uid', 'new': 'synapse_admin_uid'} - {'old': 'synapse_admin_container_gid', 'new': 'synapse_admin_gid'} + - {'old': 'synapse_admin_docker_repo', 'new': 'synapse_admin_container_self_build_repo'} + - {'old': 'synapse_admin_container_self_build', 'new': 'synapse_admin_container_image_self_build'} + - {'old': 'synapse_admin_container_self_build_repo', 'new': 'synapse_admin_container_image_self_build_repo'} + - {'old': 'synapse_admin_public_endpoint', 'new': 'synapse_admin_path_prefix'} + - {'old': 'synapse_admin_nginx_proxy_integration_enabled', 'new': ''} + - {'old': 'synapse_admin_docker_image_name_prefix', 'new': 'synapse_admin_container_image_registry_prefix'} - name: (Deprecation) Catch and report matrix_postgres variables ansible.builtin.fail: From 092581f779d1230c6951d0100505bf076000ca2b Mon Sep 17 00:00:00 2001 From: Suguru Hirahara Date: Mon, 16 Feb 2026 04:25:29 +0900 Subject: [PATCH 13/18] Update a variable to catch and report Signed-off-by: Suguru Hirahara --- .../custom/matrix_playbook_migration/tasks/validate_config.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/roles/custom/matrix_playbook_migration/tasks/validate_config.yml b/roles/custom/matrix_playbook_migration/tasks/validate_config.yml index 40cd60e69..ef377d5fe 100644 --- a/roles/custom/matrix_playbook_migration/tasks/validate_config.yml +++ b/roles/custom/matrix_playbook_migration/tasks/validate_config.yml @@ -101,7 +101,7 @@ - {'old': 'synapse_admin_docker_image_registry_prefix_upstream_default', 'new': 'synapse_admin_container_image_registry_prefix_upstream_default'} - {'old': 'synapse_admin_container_uid', 'new': 'synapse_admin_uid'} - {'old': 'synapse_admin_container_gid', 'new': 'synapse_admin_gid'} - - {'old': 'synapse_admin_docker_repo', 'new': 'synapse_admin_container_self_build_repo'} + - {'old': 'synapse_admin_docker_repo', 'new': 'synapse_admin_container_image_self_build_repo'} - {'old': 'synapse_admin_container_self_build', 'new': 'synapse_admin_container_image_self_build'} - {'old': 'synapse_admin_container_self_build_repo', 'new': 'synapse_admin_container_image_self_build_repo'} - {'old': 'synapse_admin_public_endpoint', 'new': 'synapse_admin_path_prefix'} From c9f19a279f79c6d166607c305cb8796a25424a23 Mon Sep 17 00:00:00 2001 From: Suguru Hirahara Date: Mon, 16 Feb 2026 04:25:41 +0900 Subject: [PATCH 14/18] Set `synapse_admin_container_network_deletion_enabled` to `false` Signed-off-by: Suguru Hirahara --- group_vars/matrix_servers | 1 + 1 file changed, 1 insertion(+) diff --git a/group_vars/matrix_servers b/group_vars/matrix_servers index 9e7a21d29..60344d53b 100755 --- a/group_vars/matrix_servers +++ b/group_vars/matrix_servers @@ -5010,6 +5010,7 @@ synapse_admin_container_http_host_bind_port: "{{ (matrix_playbook_service_host_b synapse_admin_container_image_self_build: "{{ matrix_architecture not in ['arm64', 'amd64'] }}" synapse_admin_container_network: "{{ matrix_addons_container_network }}" +synapse_admin_container_network_deletion_enabled: false synapse_admin_container_additional_networks: "{{ [matrix_playbook_reverse_proxyable_services_additional_network] if matrix_playbook_reverse_proxyable_services_additional_network else [] }}" From 732380afc3b029342f6cb452690b6104913c9364 Mon Sep 17 00:00:00 2001 From: Suguru Hirahara Date: Mon, 16 Feb 2026 04:25:56 +0900 Subject: [PATCH 15/18] Remove matrix-synapse-admin in favor of ansible-role-synapse-admin Signed-off-by: Suguru Hirahara --- .../matrix-synapse-admin/defaults/main.yml | 246 ------------------ .../matrix-synapse-admin/tasks/main.yml | 25 -- .../tasks/setup_install.yml | 102 -------- .../tasks/setup_uninstall.yml | 29 --- .../tasks/validate_config.yml | 27 -- .../matrix-synapse-admin/templates/labels.j2 | 58 ----- .../systemd/matrix-synapse-admin.service.j2 | 51 ---- .../matrix-synapse-admin.service.j2.license | 4 - 8 files changed, 542 deletions(-) delete mode 100644 roles/custom/matrix-synapse-admin/defaults/main.yml delete mode 100644 roles/custom/matrix-synapse-admin/tasks/main.yml delete mode 100644 roles/custom/matrix-synapse-admin/tasks/setup_install.yml delete mode 100644 roles/custom/matrix-synapse-admin/tasks/setup_uninstall.yml delete mode 100644 roles/custom/matrix-synapse-admin/tasks/validate_config.yml delete mode 100644 roles/custom/matrix-synapse-admin/templates/labels.j2 delete mode 100644 roles/custom/matrix-synapse-admin/templates/systemd/matrix-synapse-admin.service.j2 delete mode 100644 roles/custom/matrix-synapse-admin/templates/systemd/matrix-synapse-admin.service.j2.license diff --git a/roles/custom/matrix-synapse-admin/defaults/main.yml b/roles/custom/matrix-synapse-admin/defaults/main.yml deleted file mode 100644 index 3edb3c131..000000000 --- a/roles/custom/matrix-synapse-admin/defaults/main.yml +++ /dev/null @@ -1,246 +0,0 @@ -# SPDX-FileCopyrightText: 2020 - 2021 Aaron Raimist -# SPDX-FileCopyrightText: 2020 - 2025 Slavi Pantaleev -# SPDX-FileCopyrightText: 2020 Dennis Ciba -# SPDX-FileCopyrightText: 2021 - 2025 MDAD project contributors -# SPDX-FileCopyrightText: 2021 Ahmad Haghighi -# SPDX-FileCopyrightText: 2022 - 2025 Nikita Chernyi -# SPDX-FileCopyrightText: 2022 Marko Weltzer -# SPDX-FileCopyrightText: 2023 Samuel Meenzen -# -# SPDX-License-Identifier: AGPL-3.0-or-later - ---- -# synapse-admin is a web UI for managing the Synapse Matrix server -# Project source code URL: https://github.com/Awesome-Technologies/synapse-admin -# Fork source code URL: https://github.com/etkecc/synapse-admin - -synapse_admin_enabled: true - -# A path on host where all related files will be saved -synapse_admin_config_path: "{{ synapse_admin_base_path }}/config" -synapse_admin_docker_src_files_path: "{{ synapse_admin_base_path }}/docker-src" - -synapse_admin_uid: '' -synapse_admin_gid: '' - -synapse_admin_container_image_self_build: false -synapse_admin_container_image_self_build_repo: "https://github.com/etkecc/synapse-admin.git" - -# renovate: datasource=docker depName=ghcr.io/etkecc/synapse-admin -synapse_admin_version: v0.11.1-etke53 -synapse_admin_container_image: "{{ synapse_admin_container_image_registry_prefix }}etkecc/synapse-admin:{{ synapse_admin_version }}" -synapse_admin_container_image_registry_prefix_upstream_default: "ghcr.io/" -synapse_admin_container_image_force_pull: "{{ synapse_admin_container_image.endswith(':latest') }}" - -# The base container network -synapse_admin_container_network: synapse-admin - -# A list of additional container networks that the container would be connected to. -# The role does not create these networks, so make sure they already exist. -# Use this to expose this container to a reverse proxy, which runs in a different container network. -synapse_admin_container_additional_networks: [] - -# Controls whether the synapse-admin container exposes its HTTP port (tcp/8080 in the container). -# -# Takes an ":" or "" value (e.g. "127.0.0.1:8766"), or empty string to not expose. -synapse_admin_container_http_host_bind_port: '' - -# A list of extra arguments to pass to the container -synapse_admin_container_extra_arguments: [] - -# synapse_admin_container_labels_traefik_enabled controls whether labels to assist a Traefik reverse-proxy will be attached to the container. -# See `../templates/labels.j2` for details. -# -# To inject your own other container labels, see `synapse_admin_container_labels_additional_labels`. -synapse_admin_container_labels_traefik_enabled: true -synapse_admin_container_labels_traefik_docker_network: "{{ synapse_admin_container_network }}" -synapse_admin_container_labels_traefik_hostname: "{{ synapse_admin_hostname }}" -# The path prefix must either be `/` or not end with a slash (e.g. `/synapse-admin`). -synapse_admin_container_labels_traefik_path_prefix: "{{ synapse_admin_path_prefix }}" -synapse_admin_container_labels_traefik_rule: "Host(`{{ synapse_admin_container_labels_traefik_hostname }}`){% if synapse_admin_container_labels_traefik_path_prefix != '/' %} && PathPrefix(`{{ synapse_admin_container_labels_traefik_path_prefix }}`){% endif %}" -synapse_admin_container_labels_traefik_priority: 0 -synapse_admin_container_labels_traefik_entrypoints: web-secure -synapse_admin_container_labels_traefik_tls: "{{ synapse_admin_container_labels_traefik_entrypoints != 'web' }}" -synapse_admin_container_labels_traefik_tls_certResolver: default # noqa var-naming -# This setting is to define a list ip addresses to allow access to synapse-admin. -# Each IP address should be in CIDR format, e.g. xxx.xxx.xxx.xxx/xx. -# For more information, see: https://doc.traefik.io/traefik/middlewares/http/ipallowlist/ -# If the list is empty, all IP addresses are allowed. -synapse_admin_container_labels_traefik_ipallowlist_sourcerange: [] - -# Controls which additional headers to attach to all HTTP responses. -# To add your own headers, use `synapse_admin_container_labels_traefik_additional_response_headers_custom` -synapse_admin_container_labels_traefik_additional_response_headers: "{{ synapse_admin_container_labels_traefik_additional_response_headers_auto | combine(synapse_admin_container_labels_traefik_additional_response_headers_custom) }}" -synapse_admin_container_labels_traefik_additional_response_headers_auto: | - {{ - {} - | combine ({'X-XSS-Protection': synapse_admin_http_header_xss_protection} if synapse_admin_http_header_xss_protection else {}) - | combine ({'X-Content-Type-Options': synapse_admin_http_header_content_type_options} if synapse_admin_http_header_content_type_options else {}) - | combine ({'Content-Security-Policy': synapse_admin_http_header_content_security_policy} if synapse_admin_http_header_content_security_policy else {}) - | combine ({'Permission-Policy': synapse_admin_http_header_content_permission_policy} if synapse_admin_http_header_content_permission_policy else {}) - | combine ({'Strict-Transport-Security': synapse_admin_http_header_strict_transport_security} if synapse_admin_http_header_strict_transport_security and synapse_admin_container_labels_traefik_tls else {}) - }} -synapse_admin_container_labels_traefik_additional_response_headers_custom: {} - -# synapse_admin_container_labels_additional_labels contains a multiline string with additional labels to add to the container label file. -# See `../templates/labels.j2` for details. -# -# Example: -# synapse_admin_container_labels_additional_labels: | -# my.label=1 -# another.label="here" -synapse_admin_container_labels_additional_labels: '' - -# List of systemd services that synapse-admin.service depends on -synapse_admin_systemd_required_services_list: "{{ [devture_systemd_docker_base_docker_service_name] if devture_systemd_docker_base_docker_service_name else [] }}" - -# List of systemd services that synapse-admin.service wants -synapse_admin_systemd_wanted_services_list: [] - -# Specifies the value of the `X-XSS-Protection` header -# Stops pages from loading when they detect reflected cross-site scripting (XSS) attacks. -# -# Learn more about it is here: -# - https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-XSS-Protection -# - https://portswigger.net/web-security/cross-site-scripting/reflected -synapse_admin_http_header_xss_protection: "1; mode=block" - -# Specifies the value of the `X-Content-Type-Options` header. -# See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Content-Type-Options -synapse_admin_http_header_content_type_options: nosniff - -# Specifies the value of the `Content-Security-Policy` header. -# See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy -synapse_admin_http_header_content_security_policy: frame-ancestors 'self' - -# Specifies the value of the `Permission-Policy` header. -# See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Permission-Policy -synapse_admin_http_header_content_permission_policy: "{{ 'interest-cohort=()' if synapse_admin_floc_optout_enabled else '' }}" - -# Specifies the value of the `Strict-Transport-Security` header. -# See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security -synapse_admin_http_header_strict_transport_security: "max-age=31536000; includeSubDomains{{ '; preload' if synapse_admin_hsts_preload_enabled else '' }}" - -# Controls whether to send a "Permissions-Policy interest-cohort=();" header along with all responses -# -# Learn more about what it is here: -# - https://www.eff.org/deeplinks/2021/03/googles-floc-terrible-idea -# - https://paramdeo.com/blog/opting-your-website-out-of-googles-floc-network -# - https://amifloced.org/ -# -# Of course, a better solution is to just stop using browsers (like Chrome), which participate in such tracking practices. -# See: `synapse_admin_content_permission_policy` -synapse_admin_floc_optout_enabled: true - -# Controls if HSTS preloading is enabled -# -# In its strongest and recommended form, the [HSTS policy](https://www.chromium.org/hsts) includes all subdomains, and -# indicates a willingness to be "preloaded" into browsers: -# `Strict-Transport-Security: max-age=31536000; includeSubDomains; preload` -# For more information visit: -# - https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security -# - https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security -# - https://hstspreload.org/#opt-in -# See: `synapse_admin_http_header_strict_transport_security` -synapse_admin_hsts_preload_enabled: false - -# Default synapse-admin configuration template which covers the generic use case. -# You can customize it by controlling the various variables inside it. -# -# For a more advanced customization, you can extend the default (see `synapse_admin_configuration_extension_json`) -# or completely replace this variable with your own template. -# -# The side-effect of this lookup is that Ansible would even parse the JSON for us, returning a dict. -# This is unlike what it does when looking up YAML template files (no automatic parsing there). -synapse_admin_configuration_default: - restrictBaseUrl: "{{ synapse_admin_config_restrictBaseUrl }}" - externalAuthProvider: "{{ synapse_admin_config_externalAuthProvider }}" - corsCredentials: "{{ synapse_admin_config_corsCredentials }}" - asManagedUsers: "{{ synapse_admin_config_asManagedUsers }}" - menu: "{{ synapse_admin_config_menu }}" - -# Your custom JSON configuration for synapse-admin should go to `synapse_admin_configuration_extension_json`. -# This configuration extends the default starting configuration (`synapse_admin_configuration_default`). -# -# You can override individual variables from the default configuration, or introduce new ones. -# -# If you need something more special, you can take full control by -# completely redefining `synapse_admin_configuration_default`. -# -# Example configuration extension follows: -# -# synapse_admin_configuration_extension_json: | -# { -# "some_setting": true, -# "another_setting": false -# } -synapse_admin_configuration_extension_json: '{}' - -# This is similar to `synapse_admin_configuration_extension_json`, but intended for use by playbook or group vars -synapse_admin_configuration_extension_json_auto: '{}' - -synapse_admin_configuration_extension: "{{ synapse_admin_configuration_extension_json_auto | from_json | combine(synapse_admin_configuration_extension_json | from_json if synapse_admin_configuration_extension_json | from_json is mapping else {}, recursive=True) }}" - -# Holds the final synapse-admin configuration (a combination of the default and its extension). -# You most likely don't need to touch this variable. Instead, see `synapse_admin_configuration_default`. -synapse_admin_configuration: "{{ synapse_admin_configuration_default | combine(synapse_admin_configuration_extension, recursive=True) }}" - -# Controls the externalAuthProvider configuration setting, which, if defined, -# enables a special compatibility mode that works better for external auth providers like LDAP, MAS, etc. -synapse_admin_config_externalAuthProvider: false # noqa var-naming - -# Controls the corsCredentials configuration setting, which, if defined, -# allows including credentials (cookies, authorization headers, or TLS client certificates) in requests -# ref: https://developer.mozilla.org/en-US/docs/Web/API/Fetch_API/Using_Fetch#including_credentials -synapse_admin_config_corsCredentials: "same-origin" # noqa var-naming - -# Controls the menu configuration setting, which, if defined, adds new menu items to the Synapse Admin UI. -# The format is a list of objects, where each object has the following keys: -# - `label` (string, required): The label of the menu item. -# - `i18n` (dict, optional): Dictionary of translations for the label. The keys should be BCP 47 language tags (e.g., en, fr, de) supported by Synapse Admin (see src/i18n). -# - `icon` (string, optional): The icon of the menu item, one of the https://github.com/etkecc/synapse-admin/blob/main/src/components/icons.ts -# - `url` (string, required): The URL of the menu item. -# Example: -# [ -# { -# "label": "Contact support", -# "i18n": { -# "de": "Support kontaktieren", -# "fr": "Contacter le support", -# "zh": "联系支持" -# }, -# "icon": "SupportAgent", -# "url": "https://github.com/etkecc/synapse-admin/issues" -# } -# ] -synapse_admin_config_menu: [] - -# Controls the asManagedUsers configuration setting (managed by playbook), which, if defined, -# restricts modifications of the specified users (e.g., bridge-managed). -# You should use JS regex syntax to match the user IDs. -# Example for mautrix-telegram: ["^@telegram_[a-zA-Z0-9]+:example\\.com$"] -# WARNING: you want to use synapse_admin_config_asManagedUsers_custom instead of this variable. -synapse_admin_config_asManagedUsers_auto: [] # noqa var-naming - -# Controls the asManagedUsers configuration setting (managed per host), which, if defined, -# restricts modifications of the specified users (e.g., bridge-managed). -# You should use JS regex syntax to match the user IDs. -# Example for mautrix-telegram: ["^@telegram_[a-zA-Z0-9]+:example\\.com$"] -synapse_admin_config_asManagedUsers_custom: [] # noqa var-naming - -# Controls the asManagedUsers configuration setting, which, if defined, -# restricts modifications of the specified users (e.g., bridge-managed). -# You should use JS regex syntax to match the user IDs. -# Example for mautrix-telegram: ["^@telegram_[a-zA-Z0-9]+:example\\.com$"] -# WARNING: you want to use synapse_admin_config_asManagedUsers_custom instead of this variable. -synapse_admin_config_asManagedUsers: "{{ synapse_admin_config_asManagedUsers_auto + synapse_admin_config_asManagedUsers_custom }}" # noqa var-naming - -# synapse_admin_restart_necessary controls whether the service -# will be restarted (when true) or merely started (when false) by the -# systemd service manager role (when conditional restart is enabled). -# -# This value is automatically computed during installation based on whether -# any configuration files, the systemd service file, or the container image changed. -# The default of `false` means "no restart needed" — appropriate when the role's -# installation tasks haven't run (e.g., due to --tags skipping them). -synapse_admin_restart_necessary: false diff --git a/roles/custom/matrix-synapse-admin/tasks/main.yml b/roles/custom/matrix-synapse-admin/tasks/main.yml deleted file mode 100644 index f94d3cc9e..000000000 --- a/roles/custom/matrix-synapse-admin/tasks/main.yml +++ /dev/null @@ -1,25 +0,0 @@ -# SPDX-FileCopyrightText: 2020 - 2024 Slavi Pantaleev -# SPDX-FileCopyrightText: 2022 Marko Weltzer -# -# SPDX-License-Identifier: AGPL-3.0-or-later - ---- - -- tags: - - setup-all - - setup-synapse-admin - - install-all - - install-synapse-admin - block: - - when: synapse_admin_enabled | bool - ansible.builtin.include_tasks: "{{ role_path }}/tasks/validate_config.yml" - - - when: synapse_admin_enabled | bool - ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_install.yml" - -- tags: - - setup-all - - setup-synapse-admin - block: - - when: not synapse_admin_enabled | bool - ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_uninstall.yml" diff --git a/roles/custom/matrix-synapse-admin/tasks/setup_install.yml b/roles/custom/matrix-synapse-admin/tasks/setup_install.yml deleted file mode 100644 index d7def87b3..000000000 --- a/roles/custom/matrix-synapse-admin/tasks/setup_install.yml +++ /dev/null @@ -1,102 +0,0 @@ -# SPDX-FileCopyrightText: 2020 - 2024 Slavi Pantaleev -# SPDX-FileCopyrightText: 2020 Dennis Ciba -# SPDX-FileCopyrightText: 2021 Aaron Raimist -# SPDX-FileCopyrightText: 2022 MDAD project contributors -# SPDX-FileCopyrightText: 2022 Marko Weltzer -# SPDX-FileCopyrightText: 2022 Nikita Chernyi -# SPDX-FileCopyrightText: 2022 Sebastian Gumprich -# SPDX-FileCopyrightText: 2024 David Mehren -# -# SPDX-License-Identifier: AGPL-3.0-or-later - ---- - -- name: Ensure synapse-admin paths exists - ansible.builtin.file: - path: "{{ item.path }}" - state: directory - mode: 0750 - owner: "{{ matrix_user_name }}" - group: "{{ matrix_group_name }}" - with_items: - - {path: "{{ synapse_admin_base_path }}", when: true} - - {path: "{{ synapse_admin_config_path }}", when: true} - - {path: "{{ synapse_admin_docker_src_files_path }}", when: "{{ synapse_admin_container_image_self_build }}"} - when: "item.when | bool" - -- name: Ensure synapse-admin labels file is created - ansible.builtin.template: - src: "{{ role_path }}/templates/labels.j2" - dest: "{{ synapse_admin_base_path }}/labels" - owner: "{{ matrix_user_name }}" - group: "{{ matrix_group_name }}" - mode: 0640 - register: synapse_admin_support_files_result - -- name: Ensure synapse-admin configuration installed - ansible.builtin.copy: - content: "{{ synapse_admin_configuration | to_nice_json }}" - dest: "{{ synapse_admin_config_path }}/config.json" - mode: 0644 - owner: "{{ matrix_user_name }}" - group: "{{ matrix_group_name }}" - register: synapse_admin_config_result - -- name: Ensure synapse-admin image is pulled - community.docker.docker_image: - name: "{{ synapse_admin_container_image }}" - source: "{{ 'pull' if ansible_version.major > 2 or ansible_version.minor > 7 else omit }}" - force_source: "{{ synapse_admin_container_image_force_pull if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}" - force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else synapse_admin_container_image_force_pull }}" - when: not synapse_admin_container_image_self_build | bool - register: synapse_admin_container_image_pull_result - retries: "{{ devture_playbook_help_container_retries_count }}" - delay: "{{ devture_playbook_help_container_retries_delay }}" - until: synapse_admin_container_image_pull_result is not failed - -- name: Ensure synapse-admin repository is present when self-building - ansible.builtin.git: - repo: "{{ synapse_admin_container_image_self_build_repo }}" - dest: "{{ synapse_admin_docker_src_files_path }}" - version: "{{ synapse_admin_container_image.split(':')[1] }}" - force: "yes" - become: true - become_user: "{{ matrix_user_name }}" - register: synapse_admin_git_pull_results - when: synapse_admin_container_image_self_build | bool - -- name: Ensure synapse-admin Docker image is built - community.docker.docker_image: - name: "{{ synapse_admin_container_image }}" - source: build - force_source: "{{ synapse_admin_git_pull_results.changed if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}" - force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else synapse_admin_git_pull_results.changed }}" - build: - dockerfile: Dockerfile - path: "{{ synapse_admin_docker_src_files_path }}" - pull: true - when: synapse_admin_container_image_self_build | bool - -- name: Ensure synapse-admin container network is created - community.general.docker_network: - enable_ipv6: "{{ devture_systemd_docker_base_ipv6_enabled }}" - name: "{{ synapse_admin_container_network }}" - driver: bridge - driver_options: "{{ devture_systemd_docker_base_container_networks_driver_options }}" - -- name: Ensure synapse-admin.service installed - ansible.builtin.template: - src: "{{ role_path }}/templates/systemd/synapse-admin.service.j2" - dest: "{{ devture_systemd_docker_base_systemd_path }}/synapse-admin.service" - mode: 0644 - register: synapse_admin_systemd_service_result - -- name: Determine whether Synapse Admin needs a restart - ansible.builtin.set_fact: - synapse_admin_restart_necessary: >- - {{ - synapse_admin_support_files_result.changed | default(false) - or synapse_admin_config_result.changed | default(false) - or synapse_admin_systemd_service_result.changed | default(false) - or synapse_admin_container_image_pull_result.changed | default(false) - }} diff --git a/roles/custom/matrix-synapse-admin/tasks/setup_uninstall.yml b/roles/custom/matrix-synapse-admin/tasks/setup_uninstall.yml deleted file mode 100644 index c4b5800ef..000000000 --- a/roles/custom/matrix-synapse-admin/tasks/setup_uninstall.yml +++ /dev/null @@ -1,29 +0,0 @@ -# SPDX-FileCopyrightText: 2022 - 2023 Slavi Pantaleev -# -# SPDX-License-Identifier: AGPL-3.0-or-later - ---- - -- name: Check existence of synapse-admin service - ansible.builtin.stat: - path: "{{ devture_systemd_docker_base_systemd_path }}/synapse-admin.service" - register: synapse_admin_service_stat - -- when: synapse_admin_service_stat.stat.exists | bool - block: - - name: Ensure synapse-admin is stopped - ansible.builtin.service: - name: synapse-admin - state: stopped - enabled: false - daemon_reload: true - - - name: Ensure synapse-admin.service doesn't exist - ansible.builtin.file: - path: "{{ devture_systemd_docker_base_systemd_path }}/synapse-admin.service" - state: absent - - - name: Ensure synapse-admin directory doesn't exist - ansible.builtin.file: - path: "{{ synapse_admin_base_path }}" - state: absent diff --git a/roles/custom/matrix-synapse-admin/tasks/validate_config.yml b/roles/custom/matrix-synapse-admin/tasks/validate_config.yml deleted file mode 100644 index 2dd06a601..000000000 --- a/roles/custom/matrix-synapse-admin/tasks/validate_config.yml +++ /dev/null @@ -1,27 +0,0 @@ -# SPDX-FileCopyrightText: 2020 - 2025 Slavi Pantaleev -# SPDX-FileCopyrightText: 2022 MDAD project contributors -# SPDX-FileCopyrightText: 2025 Suguru Hirahara -# -# SPDX-License-Identifier: AGPL-3.0-or-later - ---- - -- when: synapse_admin_container_labels_traefik_enabled | bool - block: - - name: Fail if required synapse-admin Traefik settings not defined - ansible.builtin.fail: - msg: >- - You need to define a required configuration setting (`{{ item }}`). - when: "lookup('vars', item, default='') == ''" - with_items: - - synapse_admin_container_labels_traefik_hostname - - synapse_admin_container_labels_traefik_path_prefix - - # We ensure it doesn't end with a slash, because we handle both (slash and no-slash). - # Knowing that `synapse_admin_container_labels_traefik_path_prefix` does not end with a slash - # ensures we know how to set these routes up without having to do "does it end with a slash" checks elsewhere. - - name: Fail if synapse_admin_container_labels_traefik_path_prefix ends with a slash - ansible.builtin.fail: - msg: >- - synapse_admin_container_labels_traefik_path_prefix (`{{ synapse_admin_container_labels_traefik_path_prefix }}`) must either be `/` or not end with a slash (e.g. `/synapse-admin`). - when: "synapse_admin_container_labels_traefik_path_prefix != '/' and synapse_admin_container_labels_traefik_path_prefix[-1] == '/'" diff --git a/roles/custom/matrix-synapse-admin/templates/labels.j2 b/roles/custom/matrix-synapse-admin/templates/labels.j2 deleted file mode 100644 index 5fbec3b80..000000000 --- a/roles/custom/matrix-synapse-admin/templates/labels.j2 +++ /dev/null @@ -1,58 +0,0 @@ -{# -SPDX-FileCopyrightText: 2023 - 2024 Slavi Pantaleev -SPDX-FileCopyrightText: 2025 MDAD project contributors - -SPDX-License-Identifier: AGPL-3.0-or-later -#} - -{% if synapse_admin_container_labels_traefik_enabled %} -traefik.enable=true - -{% if synapse_admin_container_labels_traefik_docker_network %} -traefik.docker.network={{ synapse_admin_container_labels_traefik_docker_network }} -{% endif %} - -traefik.http.services.synapse-admin.loadbalancer.server.port=8080 - -{% set middlewares = [] %} - -{% if synapse_admin_container_labels_traefik_ipallowlist_sourcerange | length > 0 %} -traefik.http.middlewares.synapse-admin-ipallowlist.ipallowlist.sourcerange={{ synapse_admin_container_labels_traefik_ipallowlist_sourcerange | join(',') }} -{% set middlewares = middlewares + ['synapse-admin-ipallowlist'] %} -{% endif %} - -{% if synapse_admin_container_labels_traefik_path_prefix != '/' %} -traefik.http.middlewares.synapse-admin-slashless-redirect.redirectregex.regex=({{ synapse_admin_container_labels_traefik_path_prefix | quote }})$ -traefik.http.middlewares.synapse-admin-slashless-redirect.redirectregex.replacement=${1}/ -{% set middlewares = middlewares + ['synapse-admin-slashless-redirect'] %} -{% endif %} - -{% if synapse_admin_container_labels_traefik_path_prefix != '/' %} -traefik.http.middlewares.synapse-admin-strip-prefix.stripprefix.prefixes={{ synapse_admin_container_labels_traefik_path_prefix }} -{% set middlewares = middlewares + ['synapse-admin-strip-prefix'] %} -{% endif %} - -{% if synapse_admin_container_labels_traefik_additional_response_headers.keys() | length > 0 %} -{% for name, value in synapse_admin_container_labels_traefik_additional_response_headers.items() %} -traefik.http.middlewares.synapse-admin-add-headers.headers.customresponseheaders.{{ name }}={{ value }} -{% endfor %} -{% set middlewares = middlewares + ['synapse-admin-add-headers'] %} -{% endif %} - -traefik.http.routers.synapse-admin.rule={{ synapse_admin_container_labels_traefik_rule }} -{% if synapse_admin_container_labels_traefik_priority | int > 0 %} -traefik.http.routers.synapse-admin.priority={{ synapse_admin_container_labels_traefik_priority }} -{% endif %} -{% if middlewares | length > 0 %} -traefik.http.routers.synapse-admin.middlewares={{ middlewares | join(',') }} -{% endif %} -traefik.http.routers.synapse-admin.service=synapse-admin -traefik.http.routers.synapse-admin.entrypoints={{ synapse_admin_container_labels_traefik_entrypoints }} -traefik.http.routers.synapse-admin.tls={{ synapse_admin_container_labels_traefik_tls | to_json }} -{% if synapse_admin_container_labels_traefik_tls %} -traefik.http.routers.synapse-admin.tls.certResolver={{ synapse_admin_container_labels_traefik_tls_certResolver }} -{% endif %} - -{% endif %} - -{{ synapse_admin_container_labels_additional_labels }} diff --git a/roles/custom/matrix-synapse-admin/templates/systemd/matrix-synapse-admin.service.j2 b/roles/custom/matrix-synapse-admin/templates/systemd/matrix-synapse-admin.service.j2 deleted file mode 100644 index 086631f3f..000000000 --- a/roles/custom/matrix-synapse-admin/templates/systemd/matrix-synapse-admin.service.j2 +++ /dev/null @@ -1,51 +0,0 @@ -#jinja2: lstrip_blocks: True -[Unit] -Description=synapse-admin -{% for service in synapse_admin_systemd_required_services_list %} -Requires={{ service }} -After={{ service }} -{% endfor %} -{% for service in synapse_admin_systemd_wanted_services_list %} -Wants={{ service }} -{% endfor %} -DefaultDependencies=no - -[Service] -Type=simple -Environment="HOME={{ devture_systemd_docker_base_systemd_unit_home_path }}" -ExecStartPre=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} stop -t {{ devture_systemd_docker_base_container_stop_grace_time_seconds }} synapse-admin 2>/dev/null || true' -ExecStartPre=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} rm synapse-admin 2>/dev/null || true' - -ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} create \ - --rm \ - --name=synapse-admin \ - --log-driver=none \ - --cap-drop=ALL \ - --read-only \ - --user={{ synapse_admin_uid }}:{{ synapse_admin_gid }} \ - --network={{ synapse_admin_container_network }} \ - {% if synapse_admin_container_http_host_bind_port %} - -p {{ synapse_admin_container_http_host_bind_port }}:8080 \ - {% endif %} - --label-file={{ synapse_admin_base_path }}/labels \ - --mount type=bind,src={{ synapse_admin_config_path }}/config.json,dst=/var/public/config.json,ro \ - {% for arg in synapse_admin_container_extra_arguments %} - {{ arg }} \ - {% endfor %} - {{ synapse_admin_container_image }} - -{% for network in synapse_admin_container_additional_networks %} -ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} network connect {{ network }} synapse-admin -{% endfor %} - -ExecStart={{ devture_systemd_docker_base_host_command_docker }} start --attach synapse-admin - -ExecStop=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} stop -t {{ devture_systemd_docker_base_container_stop_grace_time_seconds }} synapse-admin 2>/dev/null || true' -ExecStop=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} rm synapse-admin 2>/dev/null || true' - -Restart=always -RestartSec=30 -SyslogIdentifier=synapse-admin - -[Install] -WantedBy=multi-user.target diff --git a/roles/custom/matrix-synapse-admin/templates/systemd/matrix-synapse-admin.service.j2.license b/roles/custom/matrix-synapse-admin/templates/systemd/matrix-synapse-admin.service.j2.license deleted file mode 100644 index 9b305e18b..000000000 --- a/roles/custom/matrix-synapse-admin/templates/systemd/matrix-synapse-admin.service.j2.license +++ /dev/null @@ -1,4 +0,0 @@ -SPDX-FileCopyrightText: 2020 - 2025 Slavi Pantaleev -SPDX-FileCopyrightText: 2020 Dan Arnfield - -SPDX-License-Identifier: AGPL-3.0-or-later From 8b65461462bcbd077e3287467d8548a6308a9363 Mon Sep 17 00:00:00 2001 From: Suguru Hirahara Date: Mon, 16 Feb 2026 04:27:06 +0900 Subject: [PATCH 16/18] Update variables for Synapse Admin - Add `synapse_admin_scheme` - Update `synapse_admin_container_image_self_build_name` Signed-off-by: Suguru Hirahara --- group_vars/matrix_servers | 22 ++++++++++++---------- 1 file changed, 12 insertions(+), 10 deletions(-) diff --git a/group_vars/matrix_servers b/group_vars/matrix_servers index 60344d53b..9ce0d8222 100755 --- a/group_vars/matrix_servers +++ b/group_vars/matrix_servers @@ -4998,16 +4998,23 @@ matrix_synapse_reverse_proxy_companion_access_log_syslog_integration_server_port synapse_admin_enabled: false synapse_admin_identifier: matrix-synapse-admin - -synapse_admin_container_image_registry_prefix: "{{ 'localhost/' if synapse_admin_container_image_self_build else synapse_admin_container_image_registry_prefix_upstream }}" -synapse_admin_container_image_registry_prefix_upstream: "{{ matrix_container_global_registry_prefix_override if matrix_container_global_registry_prefix_override else synapse_admin_container_image_registry_prefix_upstream_default }}" +synapse_admin_base_path: "{{ matrix_base_data_path }}/synapse-admin" synapse_admin_uid: "{{ matrix_user_uid }}" synapse_admin_gid: "{{ matrix_user_gid }}" -synapse_admin_container_http_host_bind_port: "{{ (matrix_playbook_service_host_bind_interface_prefix ~ '8766') if matrix_playbook_service_host_bind_interface_prefix else '' }}" +synapse_admin_scheme: "{{ 'https' if matrix_playbook_ssl_enabled else 'http' }}" + +synapse_admin_hostname: "{{ matrix_server_fqn_matrix }}" + +synapse_admin_path_prefix: /synapse-admin + +synapse_admin_container_image_registry_prefix_upstream: "{{ matrix_container_global_registry_prefix_override if matrix_container_global_registry_prefix_override else synapse_admin_container_image_registry_prefix_upstream_default }}" synapse_admin_container_image_self_build: "{{ matrix_architecture not in ['arm64', 'amd64'] }}" +synapse_admin_container_image_self_build_name: "localhost/etkecc/synapse-admin:{{ synapse_admin_container_image_self_build_repo_version }}" + +synapse_admin_container_http_host_bind_port: "{{ (matrix_playbook_service_host_bind_interface_prefix ~ '8766') if matrix_playbook_service_host_bind_interface_prefix else '' }}" synapse_admin_container_network: "{{ matrix_addons_container_network }}" synapse_admin_container_network_deletion_enabled: false @@ -5021,6 +5028,7 @@ synapse_admin_container_labels_traefik_tls_certResolver: "{{ traefik_certResolve synapse_admin_config_externalAuthProvider: "{{ matrix_authentication_service_enabled | default(false) or matrix_synapse_ext_password_provider_ldap_enabled | default(false) }}" +# Restrict the service to only work with the homeserver managed by the playbook synapse_admin_config_restrictBaseUrl: "{{ matrix_homeserver_url }}" # noqa var-naming synapse_admin_config_asManagedUsers_auto: | @@ -5176,12 +5184,6 @@ synapse_admin_config_asManagedUsers_auto: | ] if matrix_steam_bridge_enabled else []) }} -synapse_admin_base_path: "{{ matrix_base_data_path }}/synapse-admin" - -synapse_admin_hostname: "{{ matrix_server_fqn_matrix }}" - -synapse_admin_path_prefix: /synapse-admin - ###################################################################### # # /synapse_admin From 30c6eb457a4bc526f05c7156aed63be8176ac99d Mon Sep 17 00:00:00 2001 From: Suguru Hirahara Date: Mon, 16 Feb 2026 04:31:11 +0900 Subject: [PATCH 17/18] Update CHANGELOG.md Signed-off-by: Suguru Hirahara --- CHANGELOG.md | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index ed52c8041..88108275d 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,3 +1,13 @@ +# 2026-02-16 + +## (BC Break) Synapse Admin role has been relocated and variable names need adjustments + +The role for [Synapse Admin](https://github.com/etkecc/synapse-admin) has been relocated to the [mother-of-all-self-hosting](https://github.com/mother-of-all-self-hosting) organization. + +Along with the relocation, the `matrix_synapse_admin_` prefix on its variable names has been renamed to `synapse_admin_`, so you need to adjust your `vars.yml` configuration. + +As always, the playbook would let you know about this and point out any variables you may have missed. + # 2026-02-13 ## Conditional service restart for `install-*` commands From 72d9dce6bf2dd2774c2079320b6196700321814a Mon Sep 17 00:00:00 2001 From: Suguru Hirahara Date: Mon, 16 Feb 2026 15:50:43 +0900 Subject: [PATCH 18/18] Replace `synapse_admin_contact` with `matrix_synapse_adminContact` `synapse_admin_` is reserved for Synapse Admin Signed-off-by: Suguru Hirahara --- roles/custom/matrix-synapse/defaults/main.yml | 2 +- .../custom/matrix-synapse/templates/synapse/homeserver.yaml.j2 | 2 +- .../custom/matrix_playbook_migration/tasks/validate_config.yml | 1 + 3 files changed, 3 insertions(+), 2 deletions(-) diff --git a/roles/custom/matrix-synapse/defaults/main.yml b/roles/custom/matrix-synapse/defaults/main.yml index 28e35f7e9..7a8c917b6 100644 --- a/roles/custom/matrix-synapse/defaults/main.yml +++ b/roles/custom/matrix-synapse/defaults/main.yml @@ -425,7 +425,7 @@ matrix_synapse_form_secret: "{{ matrix_synapse_macaroon_secret_key }}" # Controls how to reach server admin, used in ResouceLimitError -synapse_admin_contact: ~ +matrix_synapse_adminContact: ~ # noqa var-naming matrix_synapse_max_upload_size_mb: 50 diff --git a/roles/custom/matrix-synapse/templates/synapse/homeserver.yaml.j2 b/roles/custom/matrix-synapse/templates/synapse/homeserver.yaml.j2 index 28da1fb4e..c833706d3 100644 --- a/roles/custom/matrix-synapse/templates/synapse/homeserver.yaml.j2 +++ b/roles/custom/matrix-synapse/templates/synapse/homeserver.yaml.j2 @@ -391,7 +391,7 @@ manhole_settings: # How to reach the server admin, used in ResourceLimitError # -admin_contact: {{ synapse_admin_contact | to_json }} +admin_contact: {{ matrix_synapse_adminContact | to_json }} # Global blocking # diff --git a/roles/custom/matrix_playbook_migration/tasks/validate_config.yml b/roles/custom/matrix_playbook_migration/tasks/validate_config.yml index ef377d5fe..d61119da8 100644 --- a/roles/custom/matrix_playbook_migration/tasks/validate_config.yml +++ b/roles/custom/matrix_playbook_migration/tasks/validate_config.yml @@ -107,6 +107,7 @@ - {'old': 'synapse_admin_public_endpoint', 'new': 'synapse_admin_path_prefix'} - {'old': 'synapse_admin_nginx_proxy_integration_enabled', 'new': ''} - {'old': 'synapse_admin_docker_image_name_prefix', 'new': 'synapse_admin_container_image_registry_prefix'} + - {'old': 'matrix_synapse_admin_contact', 'new': 'matrix_synapse_adminContact'} - name: (Deprecation) Catch and report matrix_postgres variables ansible.builtin.fail: