Merge branch 'braid/matrix-ldap-registration-proxy' of https://github.com/TheOneWithTheBraid/matrix-docker-ansible-deploy into matrix-ldap-registration-proxy

CHANGELOG.md

@@ -1,3 +1,12 @@
+# 2022-09-09
+
+## Cactus Comments support
+
+Thanks to [Julian-Samuel Gebühr (@moan0s)](https://github.com/moan0s), the playbook can now set up [Cactus Comments](https://cactus.chat) - federated comment system for the web based on Matrix.
+
+See our [Setting up a Cactus Comments server](docs/configuring-playbook-cactus-comments.md) documentation to get started.
+
+
 # 2022-08-23
 
 ## Postmoogle email bridge support

README.md

@@ -139,6 +139,8 @@ Using this playbook, you can get the following services configured on your serve
 
 - (optional) the [Buscarron](https://gitlab.com/etke.cc/buscarron) bot - see [docs/configuring-playbook-bot-buscarron.md](docs/configuring-playbook-bot-buscarron.md) for setup documentation
 
+- (optional) [Cactus Comments](https://cactus.chat), a federated comment system built on matrix - see [docs/configuring-playbook-cactus-comments.md](docs/configuring-playbook-cactus-comments.md) for setup documentation
+
 Basically, this playbook aims to get you up-and-running with all the necessities around Matrix, without you having to do anything else.
 
 **Note**: the list above is exhaustive. It includes optional or even some advanced components that you will most likely not need.

docs/configuring-dns.md

@@ -28,18 +28,22 @@ If you are using Cloudflare DNS, make sure to disable the proxy and set all reco
 
 ## DNS settings for optional services/features
 
-| Type  | Host                         | Priority | Weight | Port | Target                 |
-| ----- | ---------------------------- | -------- | ------ | ---- | ---------------------- |
-| SRV   | `_matrix-identity._tcp`      | 10       | 0      | 443  | `matrix.<your-domain>` |
-| CNAME | `dimension`                  | -        | -      | -    | `matrix.<your-domain>` |
-| CNAME | `jitsi`                      | -        | -      | -    | `matrix.<your-domain>` |
-| CNAME | `stats`                      | -        | -      | -    | `matrix.<your-domain>` |
-| CNAME | `goneb`                      | -        | -      | -    | `matrix.<your-domain>` |
-| CNAME | `sygnal`                     | -        | -      | -    | `matrix.<your-domain>` |
-| CNAME | `ntfy`                       | -        | -      | -    | `matrix.<your-domain>` |
-| CNAME | `hydrogen`                   | -        | -      | -    | `matrix.<your-domain>` |
-| CNAME | `cinny`                      | -        | -      | -    | `matrix.<your-domain>` |
-| CNAME | `buscarron`                  | -        | -      | -    | `matrix.<your-domain>` |
+| Used by component                                                                                                       | Type  | Host                           | Priority | Weight | Port | Target                      |
+| ----------------------------------------------------------------------------------------------------------------------- | ----- | ------------------------------ | -------- | ------ | ---- | --------------------------- |
+| [ma1sd](configuring-playbook-ma1sd.md) identity server                                                                  | SRV   | `_matrix-identity._tcp`        | 10       | 0      | 443  | `matrix.<your-domain>`      |
+| [Dimension](configuring-playbook-dimension.md) integration server                                                       | CNAME | `dimension`                    | -        | -      | -    | `matrix.<your-domain>`      |
+| [Jitsi](configuring-playbook-jitsi.md) video-conferencing platform                                                      | CNAME | `jitsi`                        | -        | -      | -    | `matrix.<your-domain>`      |
+| [Prometheus/Grafana](configuring-playbook-prometheus-grafana.md) monitoring system                                      | CNAME | `stats`                        | -        | -      | -    | `matrix.<your-domain>`      |
+| [Go-NEB](configuring-playbook-bot-go-neb.md) bot                                                                        | CNAME | `goneb`                        | -        | -      | -    | `matrix.<your-domain>`      |
+| [Sygnal](configuring-playbook-sygnal.md) push notification gateway                                                      | CNAME | `sygnal`                       | -        | -      | -    | `matrix.<your-domain>`      |
+| [ntfy](configuring-playbook-ntfy.md) push notifications server                                                          | CNAME | `ntfy`                         | -        | -      | -    | `matrix.<your-domain>`      |
+| [Hydrogen](configuring-playbook-client-hydrogen.md) web client                                                          | CNAME | `hydrogen`                     | -        | -      | -    | `matrix.<your-domain>`      |
+| [Cinny](configuring-playbook-client-cinny.md) web client                                                                | CNAME | `cinny`                        | -        | -      | -    | `matrix.<your-domain>`      |
+| [Buscarron](configuring-playbook-bot-buscarron.md) helpdesk bot                                                         | CNAME | `buscarron`                    | -        | -      | -    | `matrix.<your-domain>`      |
+| [Postmoogle](configuring-playbook-bot-postmoogle.md)/[Email2Matrix](configuring-playbook-email2matrix.md) email bridges | MX    | `matrix`                       | 10       | 0      | -    | `matrix.<your-domain>`      |
+| [Postmoogle](configuring-playbook-bot-postmoogle.md) email bridge                                                       | TXT   | `matrix`                       | -        | -      | -    | `v=spf1 ip4:<your-ip> -all` |
+| [Postmoogle](configuring-playbook-bot-postmoogle.md) email bridge                                                       | TXT   | `_dmarc.matrix`                | -        | -      | -    | `v=DMARC1; p=quarantine;`   |
+| [Postmoogle](configuring-playbook-bot-postmoogle.md) email bridge                                                       | TXT   | `postmoogle._domainkey.matrix` | -        | -      | -    | get it from `!pm dkim`      |
 
 ## Subdomains setup
 
@@ -77,3 +81,8 @@ This is an optional feature for the optionally-installed [ma1sd service](configu
 Note: This `_matrix-identity._tcp` SRV record for the identity server is different from the `_matrix._tcp` that can be used for Synapse delegation. See [howto-server-delegation.md](howto-server-delegation.md) for more information about delegation.
 
 When you're done with the DNS configuration and ready to proceed, continue with [Getting the playbook](getting-the-playbook.md).
+
+## `_dmarc`, `postmoogle._domainkey` TXT and `matrix` MX records setup
+
+To make the [postmoogle](configuring-playbook-bot-postmoogle.md) email bridge enable its email sending features, you need to configure
+SPF (TXT), DMARC (TXT), DKIM (TXT) and MX records

docs/configuring-playbook-bot-matrix-registration-bot.md

@@ -56,7 +56,7 @@ ansible-playbook -i inventory/hosts setup.yml --tags=setup-all,start
 
 ## Usage
 
-To use the bot, create a **non-encrypted** room and invite `@bot.matrix-registration-bot:DOMAIN` (where `YOUR_DOMAIN` is your base domain, not the `matrix.` domain).
+To use the bot, create a **non-encrypted** room and invite `@bot.matrix-registration-bot:DOMAIN` (where `DOMAIN` is your base domain, not the `matrix.` domain).
 
 In this room send `help` and the bot will reply with all options.
 

docs/configuring-playbook-bot-postmoogle.md

@@ -35,6 +35,9 @@ matrix_bot_postmoogle_enabled: true
 matrix_bot_postmoogle_password: PASSWORD_FOR_THE_BOT
 ```
 
+You will also need to add several DNS records so that postmoogle can send emails.
+See [Configuring DNS](configuring-dns.md).
+
 
 ## Installing
 

docs/configuring-playbook-cactus-comments.md

@@ -0,0 +1,65 @@
+# Setting up Cactus Comments (optional)
+
+The playbook can install and configure [Cactus Comments](https://cactus.chat) for you.
+
+Cactus Comments is a **federated comment system** built on Matrix. The role allows you to self-host the system.
+It respects your privacy, and puts you in control.
+
+See the project's [documentation](https://cactus.chat/docs/getting-started/introduction/) to learn what it
+does and why it might be useful to you.
+
+
+## Configuration
+
+Add the following block to your `vars.yaml` and make sure to exchange the tokens to randomly generated values.
+
+```yaml
+#################
+## Cactus Chat ##
+#################
+
+matrix_cactus_comments_enabled: true
+
+# To allow guest comments without users needing to log in, you need to have guest registration enabled.
+# To do this you need to uncomment one of the following lines (depending if you are using synapse or dentrite as a homeserver)
+# If you don't know which one you use: The default is synapse ;)
+# matrix_synapse_allow_guest_access: true
+# matrix_dentrite_allow_guest_access
+```
+
+## Installing
+
+After configuring the playbook, run the [installation](installing.md) command again:
+
+```
+ansible-playbook -i inventory/hosts setup.yml --tags=setup-all,start
+```
+
+
+## Usage
+
+Upon starting Cactus Comments, a `bot.cactusbot` user account is created automatically.
+
+To get started, send a `help` message to the `@bot.cactusbot:your-homeserver.com` bot to confirm it's working.
+Then, register a site by typing: `register <sitename>`. You will then be invited into a moderation room.
+Now you are good to go and can include the comment section on your website!
+
+**Careful:** To really make use of self-hosting you need change a few things in comparison to the official docs!
+
+Insert the following snippet into you page and make sure to replace `example.com` with your base domain!
+
+
+```html
+<script type="text/javascript" src="https://matrix.example.com/cactus-comments/cactus.js"></script>
+<link rel="stylesheet" href="https://matrix.example.com/cactus-comments/style.css" type="text/css">
+<div id="comment-section"></div>
+<script>
+initComments({
+  node: document.getElementById("comment-section"),
+  defaultHomeserverUrl: "https://matrix.example.com:8448",
+  serverName: "example.com",
+  siteName: "YourSiteName",
+  commentSectionId: "1"
+})
+</script>
+```

docs/configuring-playbook-email2matrix.md

@@ -1,6 +1,7 @@
 # Setting up Email2Matrix (optional)
 
 **Note**: email bridging can also happen via the [Postmoogle](configuring-playbook-bot-postmoogle.md) bot supported by the playbook.
+Postmoogle is much more powerful and easier to use, so we recommend that you use it, instead of Email2Matrix.
 
 The playbook can install and configure [email2matrix](https://github.com/devture/email2matrix) for you.
 
@@ -9,6 +10,10 @@ See the project's [documentation](https://github.com/devture/email2matrix/blob/m
 
 ## Preparation
 
+### DNS configuration
+
+It's not strictly necessary, but you may increase the chances that incoming emails reach your server by adding an `MX` record for `matrix.DOMAIN`, as described in the [Configuring DNS](configuring-dns.md) documentation page.
+
 ### Port availability
 
 Ensure that port 25 is available on your Matrix server and open in your firewall.

docs/configuring-playbook.md

@@ -182,4 +182,4 @@ When you're done with all the configuration you'd like to do, continue with [Ins
 
 - [Setting up the ntfy push notifications server](configuring-playbook-ntfy.md) (optional)
 
-
+- [Setting up a Cactus Comments server](configuring-playbook-cactus-comments.md) - a federated comment system built on Matrix (optional)

docs/container-images.md

@@ -117,3 +117,5 @@ These services are not part of our default installation, but can be enabled by [
 - [matrixdotorg/sygnal](https://hub.docker.com/r/matrixdotorg/sygnal/) - [Sygnal](https://github.com/matrix-org/sygnal) is a reference Push Gateway for Matrix
 
 - [binwiederhier/ntfy](https://hub.docker.com/r/binwiederhier/ntfy/) - [ntfy](https://ntfy.sh/) is a self-hosted, UnifiedPush-compatible push notifications server
+
+- [cactuscomments/cactus-appservice](https://hub.docker.com/r/cactuscomments/cactus-appservice/) - [Cactus Comments](https://cactus.chat) a federated comment system built on Matrix

group_vars/matrix_servers

@@ -1210,6 +1210,9 @@ matrix_bot_buscarron_container_image_self_build: "{{ matrix_architecture not in
 
 # We don't enable bots by default.
 matrix_bot_postmoogle_enabled: false
+matrix_bot_postmoogle_ssl_path: "{{ matrix_ssl_config_dir_path }}"
+matrix_bot_postmoogle_tls_cert: "/ssl/live/{{ matrix_bot_postmoogle_domain }}/fullchain.pem"
+matrix_bot_postmoogle_tls_key: "/ssl/live/{{ matrix_bot_postmoogle_domain }}/privkey.pem"
 
 matrix_bot_postmoogle_systemd_required_services_list: |
   {{
@@ -1329,6 +1332,35 @@ matrix_backup_borg_systemd_required_services_list: |
 # /matrix-backup-borg
 #
 ######################################################################
+######################################################################
+#
+# matrix-cactus-comments
+#
+######################################################################
+
+matrix_cactus_comments_enabled: false
+
+# Derive secret values from homeserver secret
+matrix_cactus_comments_as_token: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'cactus.as.token') | to_uuid }}"
+matrix_cactus_comments_hs_token: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'cactus.hs.token') | to_uuid }}"
+
+matrix_cactus_comments_container_image_self_build: "{{ matrix_architecture not in ['amd64', 'arm32', 'arm64'] }}"
+matrix_cactus_comments_systemd_required_services_list: |
+  {{
+    (['docker.service'])
+    +
+    (['matrix-nginx-proxy.service'] if matrix_nginx_proxy_enabled else [])
+    +
+    (['matrix-' + matrix_homeserver_implementation + '.service'])
+  }}
+
+matrix_cactus_comments_client_nginx_path: "{{ '/cactus-comments/' if matrix_nginx_proxy_enabled else matrix_cactus_comments_client_path + '/' }}"
+
+######################################################################
+#
+# /matrix-cactus-comments
+#
+######################################################################
 
 ######################################################################
 #
@@ -1750,7 +1782,6 @@ matrix_nginx_proxy_synapse_generic_worker_client_server_locations: "{{ matrix_sy
 matrix_nginx_proxy_synapse_generic_worker_federation_locations: "{{ matrix_synapse_workers_generic_worker_federation_endpoints }}"
 matrix_nginx_proxy_synapse_media_repository_locations: "{{matrix_synapse_workers_media_repository_endpoints|default([]) }}"
 matrix_nginx_proxy_synapse_user_dir_locations: "{{ matrix_synapse_workers_user_dir_endpoints|default([]) }}"
-matrix_nginx_proxy_synapse_frontend_proxy_locations: "{{ matrix_synapse_workers_frontend_proxy_endpoints|default([]) }}"
 
 matrix_nginx_proxy_systemd_wanted_services_list: |
   {{
@@ -1811,6 +1842,8 @@ matrix_ssl_domains_to_obtain_certificates_for: |
     +
     ([matrix_server_fqn_ntfy] if matrix_ntfy_enabled else [])
     +
+    ([matrix_bot_postmoogle_domain] if matrix_bot_postmoogle_enabled else [])
+    +
     ([matrix_domain] if matrix_nginx_proxy_base_domain_serving_enabled else [])
     +
     matrix_ssl_additional_domains_to_obtain_certificates_for

roles/matrix-bot-postmoogle/defaults/main.yml

@@ -9,7 +9,7 @@ matrix_bot_postmoogle_docker_repo: "https://gitlab.com/etke.cc/postmoogle.git"
 matrix_bot_postmoogle_docker_repo_version: "{{ 'main' if matrix_bot_postmoogle_version == 'latest' else matrix_bot_postmoogle_version }}"
 matrix_bot_postmoogle_docker_src_files_path: "{{ matrix_base_data_path }}/postmoogle/docker-src"
 
-matrix_bot_postmoogle_version: v0.9.0
+matrix_bot_postmoogle_version: v0.9.1
 matrix_bot_postmoogle_docker_image: "{{ matrix_bot_postmoogle_docker_image_name_prefix }}postmoogle:{{ matrix_bot_postmoogle_version }}"
 matrix_bot_postmoogle_docker_image_name_prefix: "{{ 'localhost/' if matrix_bot_postmoogle_container_image_self_build else 'registry.gitlab.com/etke.cc/' }}"
 matrix_bot_postmoogle_docker_image_force_pull: "{{ matrix_bot_postmoogle_docker_image.endswith(':latest') }}"
@@ -110,11 +110,35 @@ matrix_bot_postmoogle_noencryption: false
 
 matrix_bot_postmoogle_domain: "{{ matrix_server_fqn_matrix }}"
 
-# in-container port
+# in-container ports
 matrix_bot_postmoogle_port: '2525'
+matrix_bot_postmoogle_tls_port: '25587'
 
-# on-host port
+# on-host ports
 matrix_bot_postmoogle_smtp_host_bind_port: '25'
+matrix_bot_postmoogle_submission_host_bind_port: '587'
+
+### SSL
+## on-host SSL dir
+matrix_bot_postmoogle_ssl_path: ""
+
+## in-container SSL paths
+# matrix_bot_postmoogle_tls_cert is the SSL certificate's certificate.
+# This is likely set via group_vars/matrix_servers, so you don't need to set it.
+# If you do need to set it manually, note that this is an in-container path.
+# To mount a certificates volumes into the container, use matrix_bot_postmoogle_ssl_path
+# Example value: /ssl/live/{{ matrix_bot_postmoogle_domain }}/fullchain.pem
+matrix_bot_postmoogle_tls_cert: ""
+
+# matrix_bot_postmoogle_tls_key is the SSL certificate's key.
+# This is likely set via group_vars/matrix_servers, so you don't need to set it.
+# If you do need to set it manually, note that this is an in-container path.
+# To mount a certificates volumes into the container, use matrix_bot_postmoogle_ssl_path
+# Example value: /ssl/live/{{ matrix_bot_postmoogle_domain }}/privkey.pem
+matrix_bot_postmoogle_tls_key: ""
+
+# Mandatory TLS, even on plain SMTP port
+matrix_bot_postmoogle_tls_required: false
 
 # Additional environment variables to pass to the postmoogle container
 #

roles/matrix-bot-postmoogle/templates/env.j2

@@ -10,7 +10,10 @@ POSTMOOGLE_MAXSIZE={{ matrix_bot_postmoogle_maxsize }}
 POSTMOOGLE_SENTRY={{ matrix_bot_postmoogle_sentry }}
 POSTMOOGLE_LOGLEVEL={{ matrix_bot_postmoogle_loglevel }}
 POSTMOOGLE_NOENCRYPTION={{ matrix_bot_postmoogle_noencryption }}
-POSTMOOGLE_USERS={{ matrix_bot_postmoogle_users | join(' ') }}
 POSTMOOGLE_ADMINS={{ matrix_bot_postmoogle_admins | join(' ') }}
+POSTMOOGLE_TLS_PORT={{ matrix_bot_postmoogle_tls_port }}
+POSTMOOGLE_TLS_CERT={{ matrix_bot_postmoogle_tls_cert }}
+POSTMOOGLE_TLS_KEY={{ matrix_bot_postmoogle_tls_key }}
+POSTMOOGLE_TLS_REQUIRED={{ matrix_bot_postmoogle_tls_required }}
 
 {{ matrix_bot_postmoogle_environment_variables_extension }}

roles/matrix-bot-postmoogle/templates/systemd/matrix-bot-postmoogle.service.j2

@@ -24,7 +24,13 @@ ExecStart={{ matrix_host_command_docker }} run --rm --name matrix-bot-postmoogle
 			--network={{ matrix_docker_network }} \
 			--env-file={{ matrix_bot_postmoogle_config_path }}/env \
 			-p {{ matrix_bot_postmoogle_smtp_host_bind_port }}:{{ matrix_bot_postmoogle_port }} \
+			{% if matrix_bot_postmoogle_ssl_path %}
+			-p {{ matrix_bot_postmoogle_submission_host_bind_port }}:{{ matrix_bot_postmoogle_tls_port }} \
+			{% endif %}
 			--mount type=bind,src={{ matrix_bot_postmoogle_data_path }},dst=/data \
+			{% if matrix_bot_postmoogle_ssl_path %}
+			--mount type=bind,src={{ matrix_bot_postmoogle_ssl_path }},dst=/ssl \
+			{% endif %}
 			{% for arg in matrix_bot_postmoogle_container_extra_arguments %}
 			{{ arg }} \
 			{% endfor %}

roles/matrix-bridge-appservice-irc/defaults/main.yml

@@ -11,7 +11,7 @@ matrix_appservice_irc_docker_src_files_path: "{{ matrix_base_data_path }}/appser
 
 # matrix_appservice_irc_version used to contain the full Docker image tag (e.g. `release-X.X.X`).
 # It's a bare version number now. We try to somewhat retain compatibility below.
-matrix_appservice_irc_version: 0.34.0
+matrix_appservice_irc_version: 0.35.0
 matrix_appservice_irc_docker_image: "{{ matrix_container_global_registry_prefix }}matrixdotorg/matrix-appservice-irc:{{ matrix_appservice_irc_docker_image_tag }}"
 matrix_appservice_irc_docker_image_tag: "{{ 'latest' if matrix_appservice_irc_version == 'latest' else ('release-' + matrix_appservice_irc_version) }}"
 matrix_appservice_irc_docker_image_force_pull: "{{ matrix_appservice_irc_docker_image.endswith(':latest') }}"

roles/matrix-cactus-comments/defaults/main.yml

@@ -0,0 +1,60 @@
+---
+# Cactus Comments is a federated comment system built on Matrix
+# Project source code URL: https://gitlab.com/cactus-comments/cactus-appservice
+# Project source code URL: https://gitlab.com/cactus-comments/cactus-client
+
+matrix_cactus_comments_enabled: true
+matrix_cactus_comments_serve_client_enabled: true
+matrix_cactus_comments_container_image_self_build: false
+matrix_cactus_comments_docker_repo: "https://gitlab.com/cactus-comments/cactus-appservice.git"
+matrix_cactus_comments_docker_repo_version: "{{ matrix_cactus_comments_version if matrix_cactus_comments_version != 'latest' else 'main' }}"
+matrix_cactus_comments_docker_src_files_path: "{{ matrix_cactus_comments_base_path }}/docker-src"
+
+
+matrix_cactus_comments_base_path: "{{ matrix_base_data_path }}/cactus-comments"
+matrix_cactus_comments_container_tmp_path: "{{ matrix_cactus_comments_base_path }}/tmp"
+matrix_cactus_comments_client_path: "{{ matrix_cactus_comments_base_path }}/client"
+matrix_cactus_comments_client_file_permissions: "0644"
+
+matrix_cactus_comments_app_service_config_file: "{{ matrix_cactus_comments_base_path }}/cactus_appservice.yaml"
+matrix_cactus_comments_app_service_env_file: "{{ matrix_cactus_comments_base_path }}/cactus.env"
+
+matrix_cactus_comments_as_token: ''
+matrix_cactus_comments_hs_token: ''
+matrix_cactus_comments_homeserver_url: "{{ matrix_homeserver_container_url }}"
+matrix_cactus_comments_user_id: "bot.cactusbot"
+matrix_cactus_comments_tmp_directory_size_mb: 1
+
+matrix_cactus_comments_container_port: 5000
+
+matrix_cactus_comments_version: 0.9.0
+matrix_cactus_comments_docker_image: "{{ matrix_container_global_registry_prefix }}cactuscomments/cactus-appservice:{{ matrix_cactus_comments_version }}"
+matrix_cactus_comments_docker_image_force_pull: "{{ matrix_cactus_comments_docker_image.endswith(':latest') }}"
+
+# matrix_cactus_comments_client_version specifies the version of the cactus-client release to use.
+# For available versions, see: https://gitlab.com/cactus-comments/cactus-client/-/releases
+# Also see: `matrix_cactus_comments_client_local_dir`
+matrix_cactus_comments_client_version: "0.13.0"
+
+# matrix_cactus_comments_client_local_dir specifies a local directory (on the Ansible controller, not on the remote server) with cactus-client files to use.
+# This is an alternative to `matrix_cactus_comments_client_version`, to be used when you'd like to
+# provide the files locally / manually.
+matrix_cactus_comments_client_local_dir: ''
+
+# matrix_cactus_comments_client_nginx_path specifies the path where nginx can access the client files.
+# The default value assumes a container setup. If you're running nginx without a container, consider adjusting this path
+matrix_cactus_comments_client_nginx_path: "/cactus-comments/"
+
+# matrix_cactus_comments_client_endpoint specifies where nginx will serve the files in nginx is enabled
+matrix_cactus_comments_client_endpoint: "/cactus-comments/"
+
+# List of systemd services that matrix-cactus-comments.service depends on
+matrix_bot_cactus_comments_systemd_required_services_list: ['docker.service']
+
+# List of systemd services that matrix-cactus-comments.service wants
+matrix_bot_cactus_comments_systemd_wanted_services_list: []
+
+# A list of extra arguments to pass to the container
+matrix_cactus_comments_container_extra_arguments: []
+
+matrix_cactus_comments_environment_variables_extension: ''

roles/matrix-cactus-comments/tasks/init.yml

@@ -0,0 +1,67 @@
+---
+
+- ansible.builtin.set_fact:
+    matrix_systemd_services_list: "{{ matrix_systemd_services_list + ['matrix-cactus-comments.service'] }}"
+  when: matrix_cactus_comments_enabled | bool
+
+# If the matrix-synapse role is not used, these variables may not exist.
+- ansible.builtin.set_fact:
+    matrix_homeserver_container_runtime_injected_arguments: >
+      {{
+        matrix_homeserver_container_runtime_injected_arguments | default([])
+        +
+        ["--mount type=bind,src={{ matrix_cactus_comments_app_service_config_file }},dst=/matrix-cactus-comments.yaml,ro"]
+      }}
+
+    matrix_homeserver_app_service_runtime_injected_config_files: >
+      {{
+        matrix_homeserver_app_service_runtime_injected_config_files | default([])
+        +
+        ["/matrix-cactus-comments.yaml"]
+      }}
+  when: matrix_cactus_comments_enabled | bool
+
+- block:
+    - name: Fail if matrix-nginx-proxy role already executed
+      ansible.builtin.fail:
+        msg: >-
+          Trying to append Cactus Comment's reverse-proxying configuration to matrix-nginx-proxy,
+          but it's pointless since the matrix-nginx-proxy role had already executed.
+          To fix this, please change the order of roles in your playbook,
+          so that the matrix-nginx-proxy role would run after the matrix-cactus-comments role.
+      when: matrix_nginx_proxy_role_executed | default(False) | bool
+
+    - name: Mount volume
+      ansible.builtin.set_fact:
+        matrix_nginx_proxy_container_additional_volumes: >
+          {{
+                    matrix_nginx_proxy_container_additional_volumes | default([])
+            +
+            [{"src": "{{ matrix_cactus_comments_client_path }}", "dst": "/cactus-comments/cactus-comments", "options": "ro"}]
+          }}
+    - name: Generate Cactus Comment proxying configuration for matrix-nginx-proxy
+      ansible.builtin.set_fact:
+        matrix_cactus_comments_nginx_proxy_configuration: |
+          location {{ matrix_cactus_comments_client_endpoint }} {
+              root {{ matrix_cactus_comments_client_nginx_path }};
+          }
+      when: "matrix_nginx_proxy_enabled | default(False) | bool"
+    - name: Register Cactus Comment proxying configuration with matrix-nginx-proxy
+      ansible.builtin.set_fact:
+        matrix_nginx_proxy_proxy_matrix_additional_server_configuration_blocks: |
+          {{
+            matrix_nginx_proxy_proxy_matrix_additional_server_configuration_blocks | default([])
+            +
+            [matrix_cactus_comments_nginx_proxy_configuration]
+          }}
+    - name: Warn about reverse-proxying if matrix-nginx-proxy not used
+      ansible.builtin.debug:
+        msg: >-
+          NOTE: You've enabled Cactus Comments but are not using the matrix-nginx-proxy
+          reverse proxy.
+          Please make sure that you're proxying client files in {{ matrix_cactus_comments_client_path }} correctly
+      when: "not matrix_nginx_proxy_enabled | default(False) | bool"
+
+  tags:
+    - always
+  when: matrix_cactus_comments_enabled | bool and matrix_cactus_comments_serve_client_enabled | bool

roles/matrix-cactus-comments/tasks/main.yml

@@ -0,0 +1,23 @@
+---
+
+- ansible.builtin.import_tasks: "{{ role_path }}/tasks/init.yml"
+  tags:
+    - always
+
+- ansible.builtin.import_tasks: "{{ role_path }}/tasks/validate_config.yml"
+  when: "run_setup | bool and matrix_cactus_comments_enabled | bool"
+  tags:
+    - setup-all
+    - setup-cactus-comments
+
+- ansible.builtin.import_tasks: "{{ role_path }}/tasks/setup_install.yml"
+  when: "run_setup | bool and matrix_cactus_comments_enabled | bool"
+  tags:
+    - setup-all
+    - setup-cactus-comments
+
+- ansible.builtin.import_tasks: "{{ role_path }}/tasks/setup_uninstall.yml"
+  when: "run_setup | bool and not matrix_cactus_comments_enabled | bool"
+  tags:
+    - setup-all
+    - setup-cactus-comments

roles/matrix-cactus-comments/tasks/setup_install.yml

@@ -0,0 +1,138 @@
+---
+
+- name: Ensure cactus comments paths exist
+  ansible.builtin.file:
+    path: "{{ item.path }}"
+    state: directory
+    mode: 0750
+    owner: "{{ matrix_user_username }}"
+    group: "{{ matrix_user_groupname }}"
+  with_items:
+    - {path: "{{ matrix_cactus_comments_base_path }}", when: true}
+    - {path: "{{ matrix_cactus_comments_client_path }}", when: true}
+    - {path: "{{ matrix_cactus_comments_container_tmp_path }}", when: true}
+    - {path: "{{ matrix_cactus_comments_docker_src_files_path }}", when: matrix_cactus_comments_container_image_self_build}
+  when: "item.when | bool"
+
+- name: Ensure cactus comments environment file created
+  ansible.builtin.template:
+    src: "{{ role_path }}/templates/env.j2"
+    dest: "{{ matrix_cactus_comments_app_service_env_file }}"
+    owner: "{{ matrix_user_username }}"
+    group: "{{ matrix_user_groupname }}"
+    mode: 0640
+
+- name: Ensure cactus comments appservice file created
+  ansible.builtin.template:
+    src: "{{ role_path }}/templates/cactus_appservice.yaml.j2"
+    dest: "{{ matrix_cactus_comments_app_service_config_file }}"
+    owner: "{{ matrix_user_username }}"
+    group: "{{ matrix_user_groupname }}"
+    mode: 0640
+
+- name: Ensure cactus comments image is pulled
+  docker_image:
+    name: "{{ matrix_cactus_comments_docker_image }}"
+    source: "{{ 'pull' if ansible_version.major > 2 or ansible_version.minor > 7 else omit }}"
+    force_source: "{{ matrix_cactus_comments_docker_image_force_pull if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}"
+    force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else matrix_cactus_comments_docker_image_force_pull }}"
+  when: "not matrix_cactus_comments_container_image_self_build | bool"
+  register: result
+  retries: "{{ matrix_container_retries_count }}"
+  delay: "{{ matrix_container_retries_delay }}"
+  until: result is not failed
+
+- name: Ensure cactus comments repository is present on self-build
+  ansible.builtin.git:
+    repo: "{{ matrix_cactus_comments_docker_repo }}"
+    version: "{{ matrix_cactus_comments_docker_repo_version }}"
+    dest: "{{ matrix_cactus_comments_docker_src_files_path }}"
+    force: "yes"
+  become: true
+  become_user: "{{ matrix_user_username }}"
+  register: matrix_cactus_comments_git_pull_results
+  when: "matrix_cactus_comments_container_image_self_build | bool"
+
+- name: Ensure cactus comments image is built
+  docker_image:
+    name: "{{ matrix_cactus_comments_docker_image }}"
+    source: build
+    force_source: "{{ matrix_cactus_comments_git_pull_results.changed if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}"
+    force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else matrix_mailer_git_pull_results.changed }}"
+    build:
+      dockerfile: Dockerfile
+      path: "{{ matrix_cactus_comments_docker_src_files_path }}"
+      pull: true
+  when: "matrix_cactus_comments_container_image_self_build | bool"
+
+- block:
+    - name: Download client binary to local folder
+      ansible.builtin.get_url:
+        url: "https://gitlab.com/cactus-comments/cactus-client/-/archive/v{{ matrix_cactus_comments_client_version }}/cactus-client-v{{ matrix_cactus_comments_client_version }}.tar.gz"
+        dest: "/tmp/cactus-comments-{{ matrix_cactus_comments_client_version }}.tar.gz"
+        mode: '0644'
+      register: _download_client
+      until: _download_client is succeeded
+      retries: 5
+      delay: 2
+      check_mode: false
+
+    - name: Unpack client
+      ansible.builtin.unarchive:
+        src: "/tmp/cactus-comments-{{ matrix_cactus_comments_client_version }}.tar.gz"
+        dest: "/tmp/"
+        remote_src: true
+        mode: 0600
+      check_mode: false
+
+    - name: Propagate client javascript file
+      ansible.builtin.copy:
+        src: "/tmp/cactus-client-v{{ matrix_cactus_comments_client_version }}/src/cactus.js"
+        remote_src: true
+        dest: "{{ matrix_cactus_comments_client_path }}/cactus.js"
+        mode: "{{ matrix_cactus_comments_client_file_permissions }}"
+        owner: "{{ matrix_user_username }}"
+        group: "{{ matrix_user_groupname }}"
+    - name: Propagate client style file
+      ansible.builtin.copy:
+        src: "/tmp/cactus-client-v{{ matrix_cactus_comments_client_version }}/src/style.css"
+        remote_src: true
+        dest: "{{ matrix_cactus_comments_client_path }}/style.css"
+        mode: "{{ matrix_cactus_comments_client_file_permissions }}"
+        owner: "{{ matrix_user_username }}"
+        group: "{{ matrix_user_groupname }}"
+  when: matrix_cactus_comments_client_local_dir | length == 0
+
+- block:
+    - name: Propagate locally distributed client javascreipt
+      ansible.builtin.copy:
+        src: "{{ matrix_cactus_comments_client_local_dir }}/src/cactus.js"
+        dest: "{{ matrix_cactus_comments_client_path }}/cactus.js"
+        mode: "{{ matrix_cactus_comments_client_file_permissions }}"
+        owner: "{{ matrix_user_username }}"
+        group: "{{ matrix_user_groupname }}"
+    - name: Propagate locally distributed client style.css
+      ansible.builtin.copy:
+        src: "{{ matrix_cactus_comments_client_local_dir }}/src/style.css"
+        dest: "{{ matrix_cactus_comments_client_path }}/style.css"
+        mode: "{{ matrix_cactus_comments_client_file_permissions }}"
+        owner: "{{ matrix_user_username }}"
+        group: "{{ matrix_user_groupname }}"
+  when: matrix_cactus_comments_client_local_dir | length > 0
+
+- name: Ensure matrix-cactus-comments.service installed
+  ansible.builtin.template:
+    src: "{{ role_path }}/templates/systemd/matrix-cactus-comments.service.j2"
+    dest: "{{ matrix_systemd_path }}/matrix-cactus-comments.service"
+    mode: 0644
+  register: matrix_cactus_comments_systemd_service_result
+
+- name: Ensure systemd reloaded after matrix-cactus-comments.service installation
+  ansible.builtin.service:
+    daemon_reload: true
+  when: "matrix_cactus_comments_systemd_service_result.changed | bool"
+
+- name: Ensure matrix-cactus-comments.service restarted, if necessary
+  ansible.builtin.service:
+    name: "matrix-cactus-comments.service"
+    state: restarted

roles/matrix-cactus-comments/tasks/setup_uninstall.yml

@@ -0,0 +1,36 @@
+---
+
+- name: Check existence of matrix-cactus-comments service
+  ansible.builtin.stat:
+    path: "{{ matrix_systemd_path }}/matrix-cactus-comments.service"
+  register: matrix_cactus_comments_service_stat
+
+- name: Ensure cactus comments is stopped
+  ansible.builtin.service:
+    name: matrix-cactus-comments
+    state: stopped
+    enabled: false
+    daemon_reload: true
+  register: stopping_result
+  when: "matrix_cactus_comments_service_stat.stat.exists | bool"
+
+- name: Ensure matrix-cactus-comments.service doesn't exist
+  ansible.builtin.file:
+    path: "{{ matrix_systemd_path }}/matrix-cactus-comments.service"
+    state: absent
+  when: "matrix_cactus_comments_service_stat.stat.exists | bool"
+
+- name: Ensure systemd reloaded after matrix-cactus-comments.service removal
+  ansible.builtin.service:
+    daemon_reload: true
+  when: "matrix_cactus_comments_service_stat.stat.exists | bool"
+
+- name: Ensure Matrix cactus comments paths don't exist
+  ansible.builtin.file:
+    path: "{{ matrix_cactus_comments_base_path }}"
+    state: absent
+
+- name: Ensure cactus comments Docker image doesn't exist
+  docker_image:
+    name: "{{ matrix_cactus_comments_docker_image }}"
+    state: absent

roles/matrix-cactus-comments/tasks/validate_config.yml

@@ -0,0 +1,10 @@
+---
+
+- name: Fail if required settings not defined
+  ansible.builtin.fail:
+    msg: >-
+      You need to define a required configuration setting (`{{ item }}`).
+  when: "vars[item] == ''"
+  with_items:
+    - "matrix_cactus_comments_as_token"
+    - "matrix_cactus_comments_hs_token"

roles/matrix-cactus-comments/templates/cactus_appservice.yaml.j2

@@ -0,0 +1,19 @@
+# A unique, user-defined ID of the application service which will never change.
+id: "Cactus Comments"
+
+# Where the cactus-appservice is hosted:
+url: "http://matrix-cactus-comments:{{ matrix_cactus_comments_container_port }}"
+
+# Unique tokens used to authenticate requests between our service and the
+# homeserver (and the other way). Use the sha256 hashes of something random.
+# CHANGE THESE VALUES.
+as_token: {{ matrix_cactus_comments_as_token | to_json }}
+hs_token: {{ matrix_cactus_comments_hs_token | to_json }}
+
+# The user id of the cactusbot which can be used to register and moderate sites
+sender_localpart: "{{ matrix_cactus_comments_user_id }}"
+
+namespaces:
+  aliases:
+    - exclusive: true
+      regex: "#comments_.*"

roles/matrix-cactus-comments/templates/env.j2

@@ -0,0 +1,6 @@
+CACTUS_HS_TOKEN={{ matrix_cactus_comments_hs_token }}
+CACTUS_AS_TOKEN={{ matrix_cactus_comments_as_token }}
+CACTUS_HOMESERVER_URL={{ matrix_cactus_comments_homeserver_url }}
+CACTUS_USER_ID=@{{ matrix_cactus_comments_user_id }}:{{ matrix_domain }}
+
+{{ matrix_cactus_comments_environment_variables_extension }}

roles/matrix-cactus-comments/templates/systemd/matrix-cactus-comments.service.j2

@@ -0,0 +1,36 @@
+#jinja2: lstrip_blocks: "True"
+[Unit]
+Description=Cactus Comments
+{% for service in matrix_bot_cactus_comments_systemd_required_services_list %}
+Requires={{ service }}
+After={{ service }}
+{% endfor %}
+{% for service in matrix_bot_cactus_comments_systemd_wanted_services_list %}
+Wants={{ service }}
+{% endfor %}
+DefaultDependencies=no
+
+[Service]
+Type=simple
+Environment="HOME={{ matrix_systemd_unit_home_path }}"
+ExecStartPre=-{{ matrix_host_command_sh }} -c '{{ matrix_host_command_docker }} kill matrix-cactus-comments 2>/dev/null || true'
+ExecStartPre=-{{ matrix_host_command_sh }} -c '{{ matrix_host_command_docker }} rm matrix-cactus-comments 2>/dev/null || true'
+
+ExecStart={{ matrix_host_command_docker }} run --rm --name matrix-cactus-comments \
+			--log-driver=none \
+			--cap-drop=ALL \
+			--user={{ matrix_user_uid }}:{{ matrix_user_gid }} \
+			--read-only \
+			--env-file {{ matrix_cactus_comments_app_service_env_file }} \
+			--tmpfs=/tmp:rw,noexec,nosuid,size={{ matrix_cactus_comments_tmp_directory_size_mb }}m \
+			--network={{ matrix_docker_network }} \
+			{{ matrix_cactus_comments_docker_image }}
+
+ExecStop=-{{ matrix_host_command_sh }} -c '{{ matrix_host_command_docker }} kill matrix-cactus-comments 2>/dev/null || true'
+ExecStop=-{{ matrix_host_command_sh }} -c '{{ matrix_host_command_docker }} rm matrix-cactus-comments 2>/dev/null || true'
+Restart=always
+RestartSec=30
+SyslogIdentifier=matrix-cactus-comments
+
+[Install]
+WantedBy=multi-user.target

roles/matrix-client-element/defaults/main.yml

@@ -10,7 +10,7 @@ matrix_client_element_container_image_self_build_repo: "https://github.com/vecto
 # - https://github.com/vector-im/element-web/issues/19544
 matrix_client_element_container_image_self_build_low_memory_system_patch_enabled: "{{ ansible_memtotal_mb < 4096 }}"
 
-matrix_client_element_version: v1.11.4
+matrix_client_element_version: v1.11.5
 matrix_client_element_docker_image: "{{ matrix_client_element_docker_image_name_prefix }}vectorim/element-web:{{ matrix_client_element_version }}"
 matrix_client_element_docker_image_name_prefix: "{{ 'localhost/' if matrix_client_element_container_image_self_build else matrix_container_global_registry_prefix }}"
 matrix_client_element_docker_image_force_pull: "{{ matrix_client_element_docker_image.endswith(':latest') }}"

roles/matrix-conduit/defaults/main.yml

@@ -38,7 +38,7 @@ matrix_conduit_max_request_size: 20_000_000
 
 # Maximum number of open files for Conduit's embedded RocksDB database
 # See https://github.com/facebook/rocksdb/wiki/RocksDB-Tuning-Guide#tuning-other-options
-# If not specified, Conduit defaults to a relatively low value of 20
+# By default, Conduit uses a relatively low value of 20.
 matrix_conduit_rocksdb_max_open_files: 64
 
 # Enables registration. If set to false, no users can register on this server.

roles/matrix-coturn/defaults/main.yml

@@ -8,7 +8,7 @@ matrix_coturn_container_image_self_build_repo: "https://github.com/coturn/coturn
 matrix_coturn_container_image_self_build_repo_version: "docker/{{ matrix_coturn_version }}"
 matrix_coturn_container_image_self_build_repo_dockerfile_path: "docker/coturn/alpine/Dockerfile"
 
-matrix_coturn_version: 4.5.2-r14
+matrix_coturn_version: 4.6.0-r0
 matrix_coturn_docker_image: "{{ matrix_coturn_docker_image_name_prefix }}coturn/coturn:{{ matrix_coturn_version }}-alpine"
 matrix_coturn_docker_image_name_prefix: "{{ 'localhost/' if matrix_coturn_container_image_self_build else matrix_container_global_registry_prefix }}"
 matrix_coturn_docker_image_force_pull: "{{ matrix_coturn_docker_image.endswith(':latest') }}"

roles/matrix-dendrite/defaults/main.yml

@@ -6,7 +6,7 @@ matrix_dendrite_enabled: true
 
 matrix_dendrite_docker_image: "{{ matrix_dendrite_docker_image_name_prefix }}matrixdotorg/dendrite-monolith:{{ matrix_dendrite_docker_image_tag }}"
 matrix_dendrite_docker_image_name_prefix: "docker.io/"
-matrix_dendrite_docker_image_tag: "v0.9.6"
+matrix_dendrite_docker_image_tag: "v0.9.8"
 matrix_dendrite_docker_image_force_pull: "{{ matrix_dendrite_docker_image.endswith(':latest') }}"
 
 matrix_dendrite_base_path: "{{ matrix_base_data_path }}/dendrite"

roles/matrix-dynamic-dns/defaults/main.yml

@@ -7,7 +7,7 @@ matrix_dynamic_dns_enabled: true
 # The dynamic dns daemon interval
 matrix_dynamic_dns_daemon_interval: '300'
 
-matrix_dynamic_dns_version: v3.9.1-ls97
+matrix_dynamic_dns_version: v3.9.1-ls98
 
 # The docker container to use when in mode
 matrix_dynamic_dns_docker_image: "{{ matrix_dynamic_dns_docker_image_name_prefix }}linuxserver/ddclient:{{ matrix_dynamic_dns_version }}"

roles/matrix-grafana/defaults/main.yml

@@ -5,7 +5,7 @@
 
 matrix_grafana_enabled: false
 
-matrix_grafana_version: 9.1.2
+matrix_grafana_version: 9.1.5
 matrix_grafana_docker_image: "{{ matrix_container_global_registry_prefix }}grafana/grafana:{{ matrix_grafana_version }}"
 matrix_grafana_docker_image_force_pull: "{{ matrix_grafana_docker_image.endswith(':latest') }}"
 

roles/matrix-ldap-registration-proxy/tasks/init.yml

@@ -7,7 +7,7 @@
   when: "ansible_version.major == 2 and ansible_version.minor < 8 and matrix_ldap_registration_proxy_container_image_self_build and matrix_ldap_registration_proxy_enabled | bool"
 
 - ansible.builtin.set_fact:
-    matrix_systemd_services_list: "{{ matrix_systemd_services_list + ['matrix-matrix-ldap-registration-proxy.service'] }}"
+    matrix_systemd_services_list: "{{ matrix_systemd_services_list + ['matrix-ldap-registration-proxy.service'] }}"
   when: matrix_ldap_registration_proxy_enabled | bool
 
 - block:
@@ -49,7 +49,7 @@
          NOTE: You've enabled the Matrix LDAP registration proxy bridge but are not using the matrix-nginx-proxy
          reverse proxy.
          Please make sure that you're proxying the `{{ matrix_ldap_registration_proxy_public_endpoint }}`
-         URL endpoint to the matrix-matrix-ldap-proxy container.
+         URL endpoint to the matrix-ldap-proxy container.
          You can expose the container's port using the `matrix_ldap_registration_proxy_container_http_host_bind_port` variable.
      when: "not matrix_nginx_proxy_enabled | default(False) | bool"
 

roles/matrix-ldap-registration-proxy/tasks/main.yml

@@ -5,19 +5,19 @@
     - always
 
 - ansible.builtin.import_tasks: "{{ role_path }}/tasks/validate_config.yml"
-  when: "run_setup | bool and matrix_matrix_ldap_registration_proxy_enabled | bool"
+  when: "run_setup | bool and matrix_ldap_registration_proxy_enabled | bool"
   tags:
     - setup-all
     - setup-matrix-ldap-registration-proxy
 
 - ansible.builtin.import_tasks: "{{ role_path }}/tasks/setup_install.yml"
-  when: "run_setup | bool and matrix_matrix_ldap_registration_proxy_enabled | bool"
+  when: "run_setup | bool and matrix_ldap_registration_proxy_enabled | bool"
   tags:
     - setup-all
     - setup-matrix-ldap-registration-proxy
 
 - ansible.builtin.import_tasks: "{{ role_path }}/tasks/setup_uninstall.yml"
-  when: "run_setup | bool and not matrix_matrix_ldap_registration_proxy_enabled | bool"
+  when: "run_setup | bool and not matrix_ldap_registration_proxy_enabled | bool"
   tags:
     - setup-all
     - setup-matrix-ldap-registration-proxy

roles/matrix-ldap-registration-proxy/tasks/setup_uninstall.yml

@@ -3,7 +3,7 @@
 - name: Check existence of matrix-matrix_ldap_registration_proxy service
   ansible.builtin.stat:
     path: "{{ matrix_systemd_path }}/matrix-ldap-registration-proxy.service"
-  register: matrix_matrix_ldap_registration_proxy_service_stat
+  register: matrix_ldap_registration_proxy_service_stat
 
 - name: Ensure matrix-matrix_ldap_registration_proxy is stopped
   ansible.builtin.service:
@@ -12,25 +12,25 @@
     enabled: false
     daemon_reload: true
   register: stopping_result
-  when: "matrix_matrix_ldap_registration_proxy_service_stat.stat.exists | bool"
+  when: "matrix_ldap_registration_proxy_service_stat.stat.exists | bool"
 
 - name: Ensure matrix-ldap-registration-proxy.service doesn't exist
   ansible.builtin.file:
     path: "{{ matrix_systemd_path }}/matrix-ldap-registration-proxy.service"
     state: absent
-  when: "matrix_matrix_ldap_registration_proxy_service_stat.stat.exists | bool"
+  when: "matrix_ldap_registration_proxy_service_stat.stat.exists | bool"
 
 - name: Ensure systemd reloaded after matrix-ldap-registration-proxy.service removal
   ansible.builtin.service:
     daemon_reload: true
-  when: "matrix_matrix_ldap_registration_proxy_service_stat.stat.exists | bool"
+  when: "matrix_ldap_registration_proxy_service_stat.stat.exists | bool"
 
 - name: Ensure Matrix matrix_ldap_registration_proxy paths don't exist
   ansible.builtin.file:
-    path: "{{ matrix_matrix_ldap_registration_proxy_base_path }}"
+    path: "{{ matrix_ldap_registration_proxy_base_path }}"
     state: absent
 
 - name: Ensure matrix_ldap_registration_proxy Docker image doesn't exist
   docker_image:
-    name: "{{ matrix_matrix_ldap_registration_proxy_docker_image }}"
+    name: "{{ matrix_ldap_registration_proxy_docker_image }}"
     state: absent

roles/matrix-nginx-proxy/defaults/main.yml

@@ -547,7 +547,7 @@ matrix_ssl_lets_encrypt_staging: false
 # Learn more here: https://eff-certbot.readthedocs.io/en/stable/using.html#changing-the-acme-server
 matrix_ssl_lets_encrypt_server: ''
 
-matrix_ssl_lets_encrypt_certbot_docker_image: "{{ matrix_container_global_registry_prefix }}certbot/certbot:{{ matrix_ssl_architecture }}-v1.28.0"
+matrix_ssl_lets_encrypt_certbot_docker_image: "{{ matrix_container_global_registry_prefix }}certbot/certbot:{{ matrix_ssl_architecture }}-v1.30.0"
 matrix_ssl_lets_encrypt_certbot_docker_image_force_pull: "{{ matrix_ssl_lets_encrypt_certbot_docker_image.endswith(':latest') }}"
 matrix_ssl_lets_encrypt_certbot_standalone_http_port: 2402
 matrix_ssl_lets_encrypt_support_email: ~
@@ -625,7 +625,6 @@ matrix_nginx_proxy_synapse_generic_worker_client_server_locations: []
 matrix_nginx_proxy_synapse_generic_worker_federation_locations: []
 matrix_nginx_proxy_synapse_media_repository_locations: []
 matrix_nginx_proxy_synapse_user_dir_locations: []
-matrix_nginx_proxy_synapse_frontend_proxy_locations: []
 
 # synapse content caching
 matrix_nginx_proxy_synapse_cache_enabled: false

roles/matrix-nginx-proxy/tasks/ssl/setup_ssl_lets_encrypt.yml

@@ -26,7 +26,7 @@
 
     - name: Obtain Let's Encrypt certificates
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/ssl/setup_ssl_lets_encrypt_obtain_for_domain.yml"
-      with_items: "{{ matrix_ssl_domains_to_obtain_certificates_for }}"
+      with_items: "{{ matrix_ssl_domains_to_obtain_certificates_for | unique }}"
       loop_control:
         loop_var: domain_name
 

roles/matrix-nginx-proxy/tasks/ssl/setup_ssl_manually_managed.yml

@@ -2,7 +2,7 @@
 
 - name: Verify certificates
   ansible.builtin.include_tasks: "{{ role_path }}/tasks/ssl/setup_ssl_manually_managed_verify_for_domain.yml"
-  with_items: "{{ matrix_ssl_domains_to_obtain_certificates_for }}"
+  with_items: "{{ matrix_ssl_domains_to_obtain_certificates_for | unique }}"
   loop_control:
     loop_var: domain_name
   when: "matrix_ssl_retrieval_method == 'manually-managed'"

roles/matrix-nginx-proxy/tasks/ssl/setup_ssl_self_signed.yml

@@ -5,7 +5,7 @@
 
 - name: Generate self-signed certificates
   ansible.builtin.include_tasks: "{{ role_path }}/tasks/ssl/setup_ssl_self_signed_obtain_for_domain.yml"
-  with_items: "{{ matrix_ssl_domains_to_obtain_certificates_for }}"
+  with_items: "{{ matrix_ssl_domains_to_obtain_certificates_for | unique }}"
   loop_control:
     loop_var: domain_name
   when: "matrix_ssl_retrieval_method == 'self-signed'"

roles/matrix-nginx-proxy/templates/nginx/conf.d/matrix-synapse.conf.j2

@@ -3,7 +3,6 @@
 {% set generic_workers = matrix_nginx_proxy_synapse_workers_list | selectattr('type', 'equalto', 'generic_worker') | list %}
 {% set media_repository_workers = matrix_nginx_proxy_synapse_workers_list | selectattr('type', 'equalto', 'media_repository') | list %}
 {% set user_dir_workers = matrix_nginx_proxy_synapse_workers_list | selectattr('type', 'equalto', 'user_dir') | list %}
-{% set frontend_proxy_workers = matrix_nginx_proxy_synapse_workers_list | selectattr('type', 'equalto', 'frontend_proxy') | list %}
 {% if matrix_nginx_proxy_synapse_workers_enabled %}
 	{% if matrix_nginx_proxy_synapse_cache_enabled %}
     	proxy_cache_path  {{ matrix_nginx_proxy_synapse_cache_path }} levels=1:2 keys_zone={{ matrix_nginx_proxy_synapse_cache_keys_zone_name }}:{{ matrix_nginx_proxy_synapse_cache_keys_zone_size }} inactive={{ matrix_nginx_proxy_synapse_cache_inactive_time }} max_size={{ matrix_nginx_proxy_synapse_cache_max_size_mb }}m;
@@ -26,18 +25,6 @@
 	}
 	{% endif %}
 
-	{% if frontend_proxy_workers %}
-	upstream frontend_proxy_upstream {
-		{% for worker in frontend_proxy_workers %}
-			{% if matrix_nginx_proxy_enabled %}
-				server "matrix-synapse-worker-{{ worker.type }}-{{ worker.instanceId }}:{{ worker.port }}";
-			{% else %}
-				server "127.0.0.1:{{ worker.port }}";
-			{% endif %}
-		{% endfor %}
-	}
-	{% endif %}
-
 	{% if media_repository_workers %}
 	upstream media_repository_upstream {
 		{% for worker in media_repository_workers %}
@@ -120,23 +107,6 @@ server {
 			}
 			{% endfor %}
 		{% endif %}
-
-		{% if frontend_proxy_workers %}
-			# https://github.com/matrix-org/synapse/blob/master/docs/workers.md#synapseappfrontend_proxy
-			{% for location in matrix_nginx_proxy_synapse_frontend_proxy_locations %}
-			location ~ {{ location }} {
-				proxy_pass http://frontend_proxy_upstream$request_uri;
-				proxy_set_header Host $host;
-			}
-			{% endfor %}
-			{% if matrix_nginx_proxy_synapse_presence_disabled %}
-			# FIXME: keep in sync with synapse workers documentation manually
-			location ~ ^/_matrix/client/(api/v1|r0|v3|unstable)/presence/[^/]+/status {
-				proxy_pass http://frontend_proxy_upstream$request_uri;
-				proxy_set_header Host $host;
-			}
-			{% endif %}
-		{% endif %}
 		{# Workers redirects END #}
 	{% endif %}
 

roles/matrix-synapse/defaults/main.yml

@@ -9,7 +9,7 @@ matrix_synapse_container_image_self_build_repo: "https://github.com/matrix-org/s
 
 matrix_synapse_docker_image: "{{ matrix_synapse_docker_image_name_prefix }}matrixdotorg/synapse:{{ matrix_synapse_docker_image_tag }}"
 matrix_synapse_docker_image_name_prefix: "{{ 'localhost/' if matrix_synapse_container_image_self_build else matrix_container_global_registry_prefix }}"
-matrix_synapse_version: v1.66.0
+matrix_synapse_version: v1.67.0
 matrix_synapse_docker_image_tag: "{{ matrix_synapse_version }}"
 matrix_synapse_docker_image_force_pull: "{{ matrix_synapse_docker_image.endswith(':latest') }}"
 
@@ -398,7 +398,6 @@ matrix_synapse_workers_presets:
     federation_sender_workers_count: 1
     media_repository_workers_count: 0
     user_dir_workers_count: 0
-    frontend_proxy_workers_count: 0
   one-of-each:
     generic_workers_count: 1
     pusher_workers_count: 1
@@ -410,7 +409,6 @@ matrix_synapse_workers_presets:
     # user_dir workers are deprecated since Synapse v1.59. This will be removed.
     # See: https://github.com/matrix-org/synapse/blob/v1.59.0/docs/upgrade.md#deprecation-of-the-synapseappappservice-and-synapseappuser_dir-worker-application-types
     user_dir_workers_count: 0
-    frontend_proxy_workers_count: 1
 
 # Controls whether the matrix-synapse container exposes the various worker ports
 # (see `port` and `metrics_port` in `matrix_synapse_workers_enabled_list`) outside of the container.
@@ -452,10 +450,6 @@ matrix_synapse_workers_user_dir_workers_count: 0
 matrix_synapse_workers_user_dir_workers_port_range_start: 18661
 matrix_synapse_workers_user_dir_workers_metrics_range_start: 19661
 
-matrix_synapse_workers_frontend_proxy_workers_count: "{{ matrix_synapse_workers_presets[matrix_synapse_workers_preset]['frontend_proxy_workers_count'] }}"
-matrix_synapse_workers_frontend_proxy_workers_port_range_start: 18771
-matrix_synapse_workers_frontend_proxy_workers_metrics_range_start: 19771
-
 # Default list of workers to spawn.
 #
 # Unless you populate this manually, this list is dynamically generated

roles/matrix-synapse/tasks/synapse/workers/init.yml

@@ -56,16 +56,6 @@
   register: "matrix_synapse_workers_list_results_media_repository_workers"
   loop: "{{ range(0, matrix_synapse_workers_media_repository_workers_count | int) | list }}"
 
-- name: Build frontend_proxy workers
-  ansible.builtin.set_fact:
-    worker:
-      type: 'frontend_proxy'
-      instanceId: "{{ matrix_synapse_workers_frontend_proxy_workers_port_range_start + item }}"
-      port: "{{ matrix_synapse_workers_frontend_proxy_workers_port_range_start + item }}"
-      metrics_port: "{{ matrix_synapse_workers_frontend_proxy_workers_metrics_range_start + item }}"
-  register: "matrix_synapse_workers_list_results_frontend_proxy_workers"
-  loop: "{{ range(0, matrix_synapse_workers_frontend_proxy_workers_count | int) | list }}"
-
 - ansible.builtin.set_fact:
     matrix_synapse_dynamic_workers_list: "{{ matrix_synapse_dynamic_workers_list | default([]) + [item.ansible_facts.worker] }}"
   with_items: |
@@ -79,8 +69,6 @@
       matrix_synapse_workers_list_results_appservice_workers.results
       +
       matrix_synapse_workers_list_results_media_repository_workers.results
-      +
-      matrix_synapse_workers_list_results_frontend_proxy_workers.results
     }}
 
 - ansible.builtin.set_fact:

roles/matrix-synapse/tasks/validate_config.yml

@@ -62,6 +62,9 @@
     - {'old': 'matrix_synapse_version_arm64', 'new': '<superseded by matrix_synapse_version - see https://github.com/matrix-org/synapse/pull/11810>'}
     - {'old': 'matrix_synapse_enable_group_creation', 'new': '<removed in Synapse v1.61.0 - use the new Spaces feature instead>'}
     - {'old': 'matrix_synapse_account_threepid_delegates_email', 'new': '<removed in Synapse v1.66.0 - make sure to configure email settings for Synapse - see https://matrix-org.github.io/synapse/v1.66/upgrade.html#delegation-of-email-validation-no-longer-supported>'}
+    - {'old': 'matrix_synapse_workers_frontend_proxy_workers_count', 'new': '<removed in favor of generic workers - see https://github.com/matrix-org/synapse/pull/13645>'}
+    - {'old': 'matrix_synapse_workers_frontend_proxy_workers_port_range_start', 'new': '<removed in favor of generic workers - see https://github.com/matrix-org/synapse/pull/13645>'}
+    - {'old': 'matrix_synapse_workers_frontend_proxy_workers_metrics_range_start', 'new': '<removed in favor of generic workers - see https://github.com/matrix-org/synapse/pull/13645>'}
 
 - name: (Deprecation) Catch and report renamed settings in matrix_synapse_configuration_extension_yaml
   ansible.builtin.fail:

roles/matrix-synapse/templates/synapse/worker.yaml.j2

@@ -11,7 +11,7 @@ worker_replication_http_port: {{ matrix_synapse_replication_http_port }}
 
 {% set http_resources = [] %}
 
-{% if matrix_synapse_worker_details.type in ['generic_worker', 'frontend_proxy', 'user_dir'] %}
+{% if matrix_synapse_worker_details.type in ['generic_worker', 'user_dir'] %}
   {% set http_resources = http_resources + ['client'] %}
 {% endif %}
 {% if matrix_synapse_worker_details.type in ['generic_worker'] %}
@@ -38,7 +38,7 @@ worker_listeners:
 {% endif %}
 {% endif %}
 
-{% if matrix_synapse_worker_details.type == 'frontend_proxy' %}
+{% if matrix_synapse_worker_details.type == 'generic_worker' %}
 worker_main_http_uri: http://matrix-synapse:{{ matrix_synapse_container_client_api_port }}
 {% endif %}
 

roles/matrix-synapse/vars/workers.yml

@@ -55,10 +55,12 @@ matrix_synapse_workers_generic_worker_endpoints:
   - ^/_matrix/client/(api/v1|r0|v3|unstable)/search$
 
   # Encryption requests
+  # Note that ^/_matrix/client/(r0|v3|unstable)/keys/upload/ requires `worker_main_http_uri`
   - ^/_matrix/client/(r0|v3|unstable)/keys/query$
   - ^/_matrix/client/(r0|v3|unstable)/keys/changes$
   - ^/_matrix/client/(r0|v3|unstable)/keys/claim$
   - ^/_matrix/client/(r0|v3|unstable)/room_keys/
+  - ^/_matrix/client/(r0|v3|unstable)/keys/upload/
 
   # Registration/login requests
   - ^/_matrix/client/(api/v1|r0|v3|unstable)/login$
@@ -172,7 +174,6 @@ matrix_synapse_workers_generic_worker_endpoints:
 
   # Additionally, the writing of specific streams (such as events) can be moved off
   # of the main process to a particular worker.
-  # (This is only supported with Redis-based replication.)
 
   # To enable this, the worker must have a HTTP replication listener configured,
   # have a `worker_name` and be listed in the `instance_map` config. The same worker
@@ -432,35 +433,9 @@ matrix_synapse_workers_user_dir_endpoints:
   # If `update_user_directory` is set to `false`, and this worker is not running,
   # the above endpoint may give outdated results.
 
-matrix_synapse_workers_frontend_proxy_endpoints:
-  # Proxies some frequently-requested client endpoints to add caching and remove
-  # load from the main synapse. It can handle REST endpoints matching the following
-  # regular expressions:
-
-  - ^/_matrix/client/(r0|v3|unstable)/keys/upload
-
-  # If `use_presence` is False in the homeserver config, it can also handle REST
-  # endpoints matching the following regular expressions:
-
-  # FIXME: ADDITIONAL CONDITIONS REQUIRED: to be enabled manually
-  # ^/_matrix/client/(api/v1|r0|v3|unstable)/presence/[^/]+/status
-
-  # This "stub" presence handler will pass through `GET` request but make the
-  # `PUT` effectively a no-op.
-
-  # It will proxy any requests it cannot handle to the main synapse instance. It
-  # must therefore be configured with the location of the main instance, via
-  # the `worker_main_http_uri` setting in the `frontend_proxy` worker configuration
-  # file. For example:
-
-  # ```yaml
-  # worker_main_http_uri: http://127.0.0.1:8008
-  # ```
-
 matrix_synapse_workers_avail_list:
   - appservice
   - federation_sender
-  - frontend_proxy
   - generic_worker
   - media_repository
   - pusher

setup.yml

@@ -46,6 +46,7 @@
     - matrix-bot-postmoogle
     - matrix-bot-go-neb
     - matrix-bot-mjolnir
+    - matrix-cactus-comments
     - matrix-synapse
     - matrix-dendrite
     - matrix-conduit