From ebc487bd815b3fedf4944c6899c118647a5949d0 Mon Sep 17 00:00:00 2001 From: Suguru Hirahara Date: Mon, 16 Feb 2026 04:16:26 +0900 Subject: [PATCH] Replace `matrix_synapse_admin_` with `synapse_admin_` Signed-off-by: Suguru Hirahara --- CHANGELOG.md | 10 +- docs/configuring-playbook-synapse-admin.md | 12 +- group_vars/matrix_servers | 38 ++-- .../matrix-synapse-admin/defaults/main.yml | 168 +++++++++--------- .../matrix-synapse-admin/tasks/main.yml | 6 +- .../tasks/setup_install.yml | 62 +++---- .../tasks/setup_uninstall.yml | 6 +- .../tasks/validate_config.yml | 26 +-- .../matrix-synapse-admin/templates/labels.j2 | 38 ++-- .../systemd/matrix-synapse-admin.service.j2 | 22 +-- roles/custom/matrix-synapse/defaults/main.yml | 2 +- .../templates/synapse/homeserver.yaml.j2 | 2 +- .../tasks/validate_config.yml | 13 ++ 13 files changed, 209 insertions(+), 196 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 876d9d963..85acbab39 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -694,13 +694,13 @@ If upstream synapse-admin picks up the pace and improves, the etke.cc fork may d If you'd like to switch back to the original synapse-admin software, you can do so by adding the following configuration to your `vars.yml` file: ```yaml -matrix_synapse_admin_docker_image: "{{ matrix_synapse_admin_docker_image_registry_prefix }}awesometechnologies/synapse-admin:{{ matrix_synapse_admin_version }}" -matrix_synapse_admin_docker_image_registry_prefix_upstream: docker.io/ +synapse_admin_docker_image: "{{ synapse_admin_docker_image_registry_prefix }}awesometechnologies/synapse-admin:{{ synapse_admin_version }}" +synapse_admin_docker_image_registry_prefix_upstream: docker.io/ -matrix_synapse_admin_version: 0.10.3 +synapse_admin_version: 0.10.3 # If you need self-building (if running on arm32), uncomment this. -# matrix_synapse_admin_container_image_self_build_repo: "https://github.com/Awesome-Technologies/synapse-admin.git" +# synapse_admin_container_image_self_build_repo: "https://github.com/Awesome-Technologies/synapse-admin.git" ``` @@ -840,7 +840,7 @@ If you'd like **to go back to the old unrestricted behavior**, use the following ```yaml # Use this configuration to allow synapse-admin to manage any homeserver instance. -matrix_synapse_admin_config_restrictBaseUrl: [] +synapse_admin_config_restrictBaseUrl: [] ``` diff --git a/docs/configuring-playbook-synapse-admin.md b/docs/configuring-playbook-synapse-admin.md index 20c40f636..46747be59 100644 --- a/docs/configuring-playbook-synapse-admin.md +++ b/docs/configuring-playbook-synapse-admin.md @@ -33,7 +33,7 @@ If you wish to adjust it, see the section [below](#adjusting-the-synapse-admin-u To enable Synapse Admin, add the following configuration to your `inventory/host_vars/matrix.example.com/vars.yml` file: ```yaml -matrix_synapse_admin_enabled: true +synapse_admin_enabled: true ``` **Note**: Synapse Admin requires Synapse's [Admin APIs](https://element-hq.github.io/synapse/latest/usage/administration/admin_api/index.html) to function. Access to them is restricted with a valid access token, so exposing them publicly should not be a real security concern. Still, for additional security, we normally leave them unexposed, following [official Synapse reverse-proxying recommendations](https://element-hq.github.io/synapse/latest/reverse_proxy.html#synapse-administration-endpoints). Because Synapse Admin needs these APIs to function, when installing Synapse Admin, the playbook **automatically** exposes the Synapse Admin API publicly for you. Depending on the homeserver implementation you're using (Synapse, Dendrite), this is equivalent to: @@ -41,18 +41,18 @@ matrix_synapse_admin_enabled: true - for [Synapse](./configuring-playbook-synapse.md) (our default homeserver implementation): `matrix_synapse_container_labels_public_client_synapse_admin_api_enabled: true` - for [Dendrite](./configuring-playbook-dendrite.md): `matrix_dendrite_container_labels_public_client_synapse_admin_api_enabled: true` -By default, synapse-admin installation will be [restricted to only work with one homeserver](https://github.com/etkecc/synapse-admin/blob/e21e44362c879ac41f47c580b04210842b6ff3d7/README.md#restricting-available-homeserver) — the one managed by the playbook. To adjust these restrictions, tweak the `matrix_synapse_admin_config_restrictBaseUrl` variable. +By default, synapse-admin installation will be [restricted to only work with one homeserver](https://github.com/etkecc/synapse-admin/blob/e21e44362c879ac41f47c580b04210842b6ff3d7/README.md#restricting-available-homeserver) — the one managed by the playbook. To adjust these restrictions, tweak the `synapse_admin_config_restrictBaseUrl` variable. ### Adjusting the Synapse Admin URL (optional) -By tweaking the `matrix_synapse_admin_hostname` and `matrix_synapse_admin_path_prefix` variables, you can easily make the service available at a **different hostname and/or path** than the default one. +By tweaking the `synapse_admin_hostname` and `synapse_admin_path_prefix` variables, you can easily make the service available at a **different hostname and/or path** than the default one. Example additional configuration for your `vars.yml` file: ```yaml # Change the default hostname and path prefix -matrix_synapse_admin_hostname: admin.example.com -matrix_synapse_admin_path_prefix: / +synapse_admin_hostname: admin.example.com +synapse_admin_path_prefix: / ``` If you've changed the default hostname, you may need to create a CNAME record for the Synapse Admin domain (`admin.example.com`), which targets `matrix.example.com`. @@ -65,7 +65,7 @@ There are some additional things you may wish to configure about the component. Take a look at: -- `roles/galaxy/synapse_admin/defaults/main.yml` for some variables that you can customize via your `vars.yml` file. You can override settings (even those that don't have dedicated playbook variables) using the `matrix_synapse_admin_configuration_extension_json` variable +- `roles/galaxy/synapse_admin/defaults/main.yml` for some variables that you can customize via your `vars.yml` file. You can override settings (even those that don't have dedicated playbook variables) using the `synapse_admin_configuration_extension_json` variable ## Installing diff --git a/group_vars/matrix_servers b/group_vars/matrix_servers index cbe7926e5..67a6a3fda 100755 --- a/group_vars/matrix_servers +++ b/group_vars/matrix_servers @@ -857,9 +857,9 @@ devture_systemd_service_manager_services_list_auto: | ([{ 'name': 'synapse-admin.service', 'priority': 4000, - 'restart_necessary': (matrix_synapse_admin_restart_necessary | bool), + 'restart_necessary': (synapse_admin_restart_necessary | bool), 'groups': ['matrix', 'synapse-admin'], - }] if matrix_synapse_admin_enabled else []) + }] if synapse_admin_enabled else []) + ([{ 'name': (matrix_synapse_usage_exporter_identifier + '.service'), @@ -4754,7 +4754,7 @@ matrix_synapse_container_labels_matrix_labels_enabled: "{{ not matrix_synapse_wo matrix_synapse_container_labels_public_client_root_redirection_enabled: "{{ matrix_synapse_container_labels_public_client_root_redirection_url != '' }}" matrix_synapse_container_labels_public_client_root_redirection_url: "{{ (('https://' if matrix_playbook_ssl_enabled else 'http://') + matrix_server_fqn_element) if matrix_client_element_enabled else '' }}" -matrix_synapse_container_labels_public_client_synapse_admin_api_enabled: "{{ matrix_synapse_admin_enabled or matrix_element_admin_enabled }}" +matrix_synapse_container_labels_public_client_synapse_admin_api_enabled: "{{ synapse_admin_enabled or matrix_element_admin_enabled }}" matrix_synapse_container_labels_internal_client_synapse_admin_api_enabled: "{{ (matrix_bot_draupnir_enabled and matrix_bot_draupnir_admin_api_enabled) }}" matrix_synapse_container_labels_internal_client_synapse_admin_api_traefik_entrypoints: "{{ matrix_playbook_internal_matrix_client_api_traefik_entrypoint_name }}" @@ -4995,29 +4995,29 @@ matrix_synapse_reverse_proxy_companion_access_log_syslog_integration_server_port # ###################################################################### -matrix_synapse_admin_enabled: false +synapse_admin_enabled: false -matrix_synapse_admin_docker_image_registry_prefix_upstream: "{{ matrix_container_global_registry_prefix_override if matrix_container_global_registry_prefix_override else matrix_synapse_admin_docker_image_registry_prefix_upstream_default }}" +synapse_admin_docker_image_registry_prefix_upstream: "{{ matrix_container_global_registry_prefix_override if matrix_container_global_registry_prefix_override else synapse_admin_docker_image_registry_prefix_upstream_default }}" -matrix_synapse_admin_container_uid: "{{ matrix_user_uid }}" -matrix_synapse_admin_container_gid: "{{ matrix_user_gid }}" +synapse_admin_container_uid: "{{ matrix_user_uid }}" +synapse_admin_container_gid: "{{ matrix_user_gid }}" -matrix_synapse_admin_container_http_host_bind_port: "{{ (matrix_playbook_service_host_bind_interface_prefix ~ '8766') if matrix_playbook_service_host_bind_interface_prefix else '' }}" +synapse_admin_container_http_host_bind_port: "{{ (matrix_playbook_service_host_bind_interface_prefix ~ '8766') if matrix_playbook_service_host_bind_interface_prefix else '' }}" -matrix_synapse_admin_container_image_self_build: "{{ matrix_architecture not in ['arm64', 'amd64'] }}" +synapse_admin_container_image_self_build: "{{ matrix_architecture not in ['arm64', 'amd64'] }}" -matrix_synapse_admin_container_network: "{{ matrix_addons_container_network }}" +synapse_admin_container_network: "{{ matrix_addons_container_network }}" -matrix_synapse_admin_container_additional_networks: "{{ [matrix_playbook_reverse_proxyable_services_additional_network] if matrix_playbook_reverse_proxyable_services_additional_network else [] }}" +synapse_admin_container_additional_networks: "{{ [matrix_playbook_reverse_proxyable_services_additional_network] if matrix_playbook_reverse_proxyable_services_additional_network else [] }}" -matrix_synapse_admin_container_labels_traefik_enabled: "{{ matrix_playbook_reverse_proxy_type in ['playbook-managed-traefik', 'other-traefik-container'] }}" -matrix_synapse_admin_container_labels_traefik_docker_network: "{{ matrix_playbook_reverse_proxyable_services_additional_network }}" -matrix_synapse_admin_container_labels_traefik_entrypoints: "{{ traefik_entrypoint_primary }}" -matrix_synapse_admin_container_labels_traefik_tls_certResolver: "{{ traefik_certResolver_primary }}" +synapse_admin_container_labels_traefik_enabled: "{{ matrix_playbook_reverse_proxy_type in ['playbook-managed-traefik', 'other-traefik-container'] }}" +synapse_admin_container_labels_traefik_docker_network: "{{ matrix_playbook_reverse_proxyable_services_additional_network }}" +synapse_admin_container_labels_traefik_entrypoints: "{{ traefik_entrypoint_primary }}" +synapse_admin_container_labels_traefik_tls_certResolver: "{{ traefik_certResolver_primary }}" -matrix_synapse_admin_config_externalAuthProvider: "{{ matrix_authentication_service_enabled | default(false) or matrix_synapse_ext_password_provider_ldap_enabled | default(false) }}" +synapse_admin_config_externalAuthProvider: "{{ matrix_authentication_service_enabled | default(false) or matrix_synapse_ext_password_provider_ldap_enabled | default(false) }}" -matrix_synapse_admin_config_asManagedUsers_auto: | +synapse_admin_config_asManagedUsers_auto: | {{ ([ '^@'+(matrix_alertmanager_receiver_config_matrix_user_id_localpart | default('') | regex_escape) +':'+(matrix_domain | regex_escape)+'$', @@ -5633,7 +5633,7 @@ matrix_dendrite_container_labels_traefik_docker_network: "{{ matrix_playbook_rev matrix_dendrite_container_labels_traefik_entrypoints: "{{ traefik_entrypoint_primary }}" matrix_dendrite_container_labels_traefik_tls_certResolver: "{{ traefik_certResolver_primary }}" -matrix_dendrite_container_labels_public_client_synapse_admin_api_enabled: "{{ matrix_synapse_admin_enabled }}" +matrix_dendrite_container_labels_public_client_synapse_admin_api_enabled: "{{ synapse_admin_enabled }}" matrix_dendrite_container_labels_public_client_root_redirection_enabled: "{{ matrix_dendrite_container_labels_public_client_root_redirection_url != '' }}" matrix_dendrite_container_labels_public_client_root_redirection_url: "{{ (('https://' if matrix_playbook_ssl_enabled else 'http://') + matrix_server_fqn_element) if matrix_client_element_enabled else '' }}" @@ -5945,7 +5945,7 @@ matrix_static_files_file_matrix_client_property_m_tile_server_map_style_url: "{{ # We set this regardless of whether synapse-admin is enabled, because people may wish to use a hosted (externally) synapse-admin installation and still have it auto-configured. # See: https://github.com/etkecc/synapse-admin/pull/126 -matrix_static_files_file_matrix_client_property_cc_etke_synapse_admin_auto: "{{ matrix_synapse_admin_configuration if matrix_homeserver_implementation == 'synapse' else {} }}" +matrix_static_files_file_matrix_client_property_cc_etke_synapse_admin_auto: "{{ synapse_admin_configuration if matrix_homeserver_implementation == 'synapse' else {} }}" matrix_static_files_file_matrix_client_property_org_matrix_msc4143_rtc_foci_enabled: "{{ matrix_livekit_jwt_service_enabled }}" matrix_static_files_file_matrix_client_property_org_matrix_msc4143_rtc_foci_auto: |- diff --git a/roles/custom/matrix-synapse-admin/defaults/main.yml b/roles/custom/matrix-synapse-admin/defaults/main.yml index 03fb0d4ff..3622355e3 100644 --- a/roles/custom/matrix-synapse-admin/defaults/main.yml +++ b/roles/custom/matrix-synapse-admin/defaults/main.yml @@ -14,91 +14,91 @@ # Project source code URL: https://github.com/Awesome-Technologies/synapse-admin # Fork source code URL: https://github.com/etkecc/synapse-admin -matrix_synapse_admin_enabled: true +synapse_admin_enabled: true # A path on host where all related files will be saved -matrix_synapse_admin_base_path: "{{ matrix_base_data_path }}/synapse-admin" -matrix_synapse_admin_config_path: "{{ matrix_synapse_admin_base_path }}/config" -matrix_synapse_admin_docker_src_files_path: "{{ matrix_synapse_admin_base_path }}/docker-src" +synapse_admin_base_path: "{{ matrix_base_data_path }}/synapse-admin" +synapse_admin_config_path: "{{ synapse_admin_base_path }}/config" +synapse_admin_docker_src_files_path: "{{ synapse_admin_base_path }}/docker-src" -matrix_synapse_admin_container_uid: '' -matrix_synapse_admin_container_gid: '' +synapse_admin_container_uid: '' +synapse_admin_container_gid: '' -matrix_synapse_admin_container_image_self_build: false -matrix_synapse_admin_container_image_self_build_repo: "https://github.com/etkecc/synapse-admin.git" +synapse_admin_container_image_self_build: false +synapse_admin_container_image_self_build_repo: "https://github.com/etkecc/synapse-admin.git" # renovate: datasource=docker depName=ghcr.io/etkecc/synapse-admin -matrix_synapse_admin_version: v0.11.1-etke53 -matrix_synapse_admin_docker_image: "{{ matrix_synapse_admin_docker_image_registry_prefix }}etkecc/synapse-admin:{{ matrix_synapse_admin_version }}" -matrix_synapse_admin_docker_image_registry_prefix: "{{ 'localhost/' if matrix_synapse_admin_container_image_self_build else matrix_synapse_admin_docker_image_registry_prefix_upstream }}" -matrix_synapse_admin_docker_image_registry_prefix_upstream: "{{ matrix_synapse_admin_docker_image_registry_prefix_upstream_default }}" -matrix_synapse_admin_docker_image_registry_prefix_upstream_default: "ghcr.io/" -matrix_synapse_admin_docker_image_force_pull: "{{ matrix_synapse_admin_docker_image.endswith(':latest') }}" +synapse_admin_version: v0.11.1-etke53 +synapse_admin_docker_image: "{{ synapse_admin_docker_image_registry_prefix }}etkecc/synapse-admin:{{ synapse_admin_version }}" +synapse_admin_docker_image_registry_prefix: "{{ 'localhost/' if synapse_admin_container_image_self_build else synapse_admin_docker_image_registry_prefix_upstream }}" +synapse_admin_docker_image_registry_prefix_upstream: "{{ synapse_admin_docker_image_registry_prefix_upstream_default }}" +synapse_admin_docker_image_registry_prefix_upstream_default: "ghcr.io/" +synapse_admin_docker_image_force_pull: "{{ synapse_admin_docker_image.endswith(':latest') }}" # The base container network -matrix_synapse_admin_container_network: synapse-admin +synapse_admin_container_network: synapse-admin # A list of additional container networks that the container would be connected to. # The role does not create these networks, so make sure they already exist. # Use this to expose this container to a reverse proxy, which runs in a different container network. -matrix_synapse_admin_container_additional_networks: [] +synapse_admin_container_additional_networks: [] # Controls whether the synapse-admin container exposes its HTTP port (tcp/8080 in the container). # # Takes an ":" or "" value (e.g. "127.0.0.1:8766"), or empty string to not expose. -matrix_synapse_admin_container_http_host_bind_port: '' +synapse_admin_container_http_host_bind_port: '' # A list of extra arguments to pass to the container -matrix_synapse_admin_container_extra_arguments: [] +synapse_admin_container_extra_arguments: [] -# matrix_synapse_admin_container_labels_traefik_enabled controls whether labels to assist a Traefik reverse-proxy will be attached to the container. +# synapse_admin_container_labels_traefik_enabled controls whether labels to assist a Traefik reverse-proxy will be attached to the container. # See `../templates/labels.j2` for details. # -# To inject your own other container labels, see `matrix_synapse_admin_container_labels_additional_labels`. -matrix_synapse_admin_container_labels_traefik_enabled: true -matrix_synapse_admin_container_labels_traefik_docker_network: "{{ matrix_synapse_admin_container_network }}" -matrix_synapse_admin_container_labels_traefik_hostname: "{{ matrix_synapse_admin_hostname }}" +# To inject your own other container labels, see `synapse_admin_container_labels_additional_labels`. +synapse_admin_container_labels_traefik_enabled: true +synapse_admin_container_labels_traefik_docker_network: "{{ synapse_admin_container_network }}" +synapse_admin_container_labels_traefik_hostname: "{{ synapse_admin_hostname }}" # The path prefix must either be `/` or not end with a slash (e.g. `/synapse-admin`). -matrix_synapse_admin_container_labels_traefik_path_prefix: "{{ matrix_synapse_admin_path_prefix }}" -matrix_synapse_admin_container_labels_traefik_rule: "Host(`{{ matrix_synapse_admin_container_labels_traefik_hostname }}`){% if matrix_synapse_admin_container_labels_traefik_path_prefix != '/' %} && PathPrefix(`{{ matrix_synapse_admin_container_labels_traefik_path_prefix }}`){% endif %}" -matrix_synapse_admin_container_labels_traefik_priority: 0 -matrix_synapse_admin_container_labels_traefik_entrypoints: web-secure -matrix_synapse_admin_container_labels_traefik_tls: "{{ matrix_synapse_admin_container_labels_traefik_entrypoints != 'web' }}" -matrix_synapse_admin_container_labels_traefik_tls_certResolver: default # noqa var-naming +synapse_admin_container_labels_traefik_path_prefix: "{{ synapse_admin_path_prefix }}" +synapse_admin_container_labels_traefik_rule: "Host(`{{ synapse_admin_container_labels_traefik_hostname }}`){% if synapse_admin_container_labels_traefik_path_prefix != '/' %} && PathPrefix(`{{ synapse_admin_container_labels_traefik_path_prefix }}`){% endif %}" +synapse_admin_container_labels_traefik_priority: 0 +synapse_admin_container_labels_traefik_entrypoints: web-secure +synapse_admin_container_labels_traefik_tls: "{{ synapse_admin_container_labels_traefik_entrypoints != 'web' }}" +synapse_admin_container_labels_traefik_tls_certResolver: default # noqa var-naming # This setting is to define a list ip addresses to allow access to synapse-admin. # Each IP address should be in CIDR format, e.g. xxx.xxx.xxx.xxx/xx. # For more information, see: https://doc.traefik.io/traefik/middlewares/http/ipallowlist/ # If the list is empty, all IP addresses are allowed. -matrix_synapse_admin_container_labels_traefik_ipallowlist_sourcerange: [] +synapse_admin_container_labels_traefik_ipallowlist_sourcerange: [] # Controls which additional headers to attach to all HTTP responses. -# To add your own headers, use `matrix_synapse_admin_container_labels_traefik_additional_response_headers_custom` -matrix_synapse_admin_container_labels_traefik_additional_response_headers: "{{ matrix_synapse_admin_container_labels_traefik_additional_response_headers_auto | combine(matrix_synapse_admin_container_labels_traefik_additional_response_headers_custom) }}" -matrix_synapse_admin_container_labels_traefik_additional_response_headers_auto: | +# To add your own headers, use `synapse_admin_container_labels_traefik_additional_response_headers_custom` +synapse_admin_container_labels_traefik_additional_response_headers: "{{ synapse_admin_container_labels_traefik_additional_response_headers_auto | combine(synapse_admin_container_labels_traefik_additional_response_headers_custom) }}" +synapse_admin_container_labels_traefik_additional_response_headers_auto: | {{ {} - | combine ({'X-XSS-Protection': matrix_synapse_admin_http_header_xss_protection} if matrix_synapse_admin_http_header_xss_protection else {}) - | combine ({'X-Content-Type-Options': matrix_synapse_admin_http_header_content_type_options} if matrix_synapse_admin_http_header_content_type_options else {}) - | combine ({'Content-Security-Policy': matrix_synapse_admin_http_header_content_security_policy} if matrix_synapse_admin_http_header_content_security_policy else {}) - | combine ({'Permission-Policy': matrix_synapse_admin_http_header_content_permission_policy} if matrix_synapse_admin_http_header_content_permission_policy else {}) - | combine ({'Strict-Transport-Security': matrix_synapse_admin_http_header_strict_transport_security} if matrix_synapse_admin_http_header_strict_transport_security and matrix_synapse_admin_container_labels_traefik_tls else {}) + | combine ({'X-XSS-Protection': synapse_admin_http_header_xss_protection} if synapse_admin_http_header_xss_protection else {}) + | combine ({'X-Content-Type-Options': synapse_admin_http_header_content_type_options} if synapse_admin_http_header_content_type_options else {}) + | combine ({'Content-Security-Policy': synapse_admin_http_header_content_security_policy} if synapse_admin_http_header_content_security_policy else {}) + | combine ({'Permission-Policy': synapse_admin_http_header_content_permission_policy} if synapse_admin_http_header_content_permission_policy else {}) + | combine ({'Strict-Transport-Security': synapse_admin_http_header_strict_transport_security} if synapse_admin_http_header_strict_transport_security and synapse_admin_container_labels_traefik_tls else {}) }} -matrix_synapse_admin_container_labels_traefik_additional_response_headers_custom: {} +synapse_admin_container_labels_traefik_additional_response_headers_custom: {} -# matrix_synapse_admin_container_labels_additional_labels contains a multiline string with additional labels to add to the container label file. +# synapse_admin_container_labels_additional_labels contains a multiline string with additional labels to add to the container label file. # See `../templates/labels.j2` for details. # # Example: -# matrix_synapse_admin_container_labels_additional_labels: | +# synapse_admin_container_labels_additional_labels: | # my.label=1 # another.label="here" -matrix_synapse_admin_container_labels_additional_labels: '' +synapse_admin_container_labels_additional_labels: '' # List of systemd services that synapse-admin.service depends on -matrix_synapse_admin_systemd_required_services_list: "{{ [devture_systemd_docker_base_docker_service_name] if devture_systemd_docker_base_docker_service_name else [] }}" +synapse_admin_systemd_required_services_list: "{{ [devture_systemd_docker_base_docker_service_name] if devture_systemd_docker_base_docker_service_name else [] }}" # List of systemd services that synapse-admin.service wants -matrix_synapse_admin_systemd_wanted_services_list: [] +synapse_admin_systemd_wanted_services_list: [] # Specifies the value of the `X-XSS-Protection` header # Stops pages from loading when they detect reflected cross-site scripting (XSS) attacks. @@ -106,23 +106,23 @@ matrix_synapse_admin_systemd_wanted_services_list: [] # Learn more about it is here: # - https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-XSS-Protection # - https://portswigger.net/web-security/cross-site-scripting/reflected -matrix_synapse_admin_http_header_xss_protection: "1; mode=block" +synapse_admin_http_header_xss_protection: "1; mode=block" # Specifies the value of the `X-Content-Type-Options` header. # See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Content-Type-Options -matrix_synapse_admin_http_header_content_type_options: nosniff +synapse_admin_http_header_content_type_options: nosniff # Specifies the value of the `Content-Security-Policy` header. # See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy -matrix_synapse_admin_http_header_content_security_policy: frame-ancestors 'self' +synapse_admin_http_header_content_security_policy: frame-ancestors 'self' # Specifies the value of the `Permission-Policy` header. # See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Permission-Policy -matrix_synapse_admin_http_header_content_permission_policy: "{{ 'interest-cohort=()' if matrix_synapse_admin_floc_optout_enabled else '' }}" +synapse_admin_http_header_content_permission_policy: "{{ 'interest-cohort=()' if synapse_admin_floc_optout_enabled else '' }}" # Specifies the value of the `Strict-Transport-Security` header. # See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security -matrix_synapse_admin_http_header_strict_transport_security: "max-age=31536000; includeSubDomains{{ '; preload' if matrix_synapse_admin_hsts_preload_enabled else '' }}" +synapse_admin_http_header_strict_transport_security: "max-age=31536000; includeSubDomains{{ '; preload' if synapse_admin_hsts_preload_enabled else '' }}" # Controls whether to send a "Permissions-Policy interest-cohort=();" header along with all responses # @@ -132,8 +132,8 @@ matrix_synapse_admin_http_header_strict_transport_security: "max-age=31536000; i # - https://amifloced.org/ # # Of course, a better solution is to just stop using browsers (like Chrome), which participate in such tracking practices. -# See: `matrix_synapse_admin_content_permission_policy` -matrix_synapse_admin_floc_optout_enabled: true +# See: `synapse_admin_content_permission_policy` +synapse_admin_floc_optout_enabled: true # Controls if HSTS preloading is enabled # @@ -144,69 +144,69 @@ matrix_synapse_admin_floc_optout_enabled: true # - https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security # - https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security # - https://hstspreload.org/#opt-in -# See: `matrix_synapse_admin_http_header_strict_transport_security` -matrix_synapse_admin_hsts_preload_enabled: false +# See: `synapse_admin_http_header_strict_transport_security` +synapse_admin_hsts_preload_enabled: false # The hostname at which Synapse Admin is served. -matrix_synapse_admin_hostname: "{{ matrix_server_fqn_matrix }}" +synapse_admin_hostname: "{{ matrix_server_fqn_matrix }}" # The path at which Synapse Admin is exposed. # This value must either be `/` or not end with a slash (e.g. `/synapse-admin`). -matrix_synapse_admin_path_prefix: /synapse-admin +synapse_admin_path_prefix: /synapse-admin # Default synapse-admin configuration template which covers the generic use case. # You can customize it by controlling the various variables inside it. # -# For a more advanced customization, you can extend the default (see `matrix_synapse_admin_configuration_extension_json`) +# For a more advanced customization, you can extend the default (see `synapse_admin_configuration_extension_json`) # or completely replace this variable with your own template. # # The side-effect of this lookup is that Ansible would even parse the JSON for us, returning a dict. # This is unlike what it does when looking up YAML template files (no automatic parsing there). -matrix_synapse_admin_configuration_default: - restrictBaseUrl: "{{ matrix_synapse_admin_config_restrictBaseUrl }}" - externalAuthProvider: "{{ matrix_synapse_admin_config_externalAuthProvider }}" - corsCredentials: "{{ matrix_synapse_admin_config_corsCredentials }}" - asManagedUsers: "{{ matrix_synapse_admin_config_asManagedUsers }}" - menu: "{{ matrix_synapse_admin_config_menu }}" - -# Your custom JSON configuration for synapse-admin should go to `matrix_synapse_admin_configuration_extension_json`. -# This configuration extends the default starting configuration (`matrix_synapse_admin_configuration_default`). +synapse_admin_configuration_default: + restrictBaseUrl: "{{ synapse_admin_config_restrictBaseUrl }}" + externalAuthProvider: "{{ synapse_admin_config_externalAuthProvider }}" + corsCredentials: "{{ synapse_admin_config_corsCredentials }}" + asManagedUsers: "{{ synapse_admin_config_asManagedUsers }}" + menu: "{{ synapse_admin_config_menu }}" + +# Your custom JSON configuration for synapse-admin should go to `synapse_admin_configuration_extension_json`. +# This configuration extends the default starting configuration (`synapse_admin_configuration_default`). # # You can override individual variables from the default configuration, or introduce new ones. # # If you need something more special, you can take full control by -# completely redefining `matrix_synapse_admin_configuration_default`. +# completely redefining `synapse_admin_configuration_default`. # # Example configuration extension follows: # -# matrix_synapse_admin_configuration_extension_json: | +# synapse_admin_configuration_extension_json: | # { # "some_setting": true, # "another_setting": false # } -matrix_synapse_admin_configuration_extension_json: '{}' +synapse_admin_configuration_extension_json: '{}' -# This is similar to `matrix_synapse_admin_configuration_extension_json`, but intended for use by playbook or group vars -matrix_synapse_admin_configuration_extension_json_auto: '{}' +# This is similar to `synapse_admin_configuration_extension_json`, but intended for use by playbook or group vars +synapse_admin_configuration_extension_json_auto: '{}' -matrix_synapse_admin_configuration_extension: "{{ matrix_synapse_admin_configuration_extension_json_auto | from_json | combine(matrix_synapse_admin_configuration_extension_json | from_json if matrix_synapse_admin_configuration_extension_json | from_json is mapping else {}, recursive=True) }}" +synapse_admin_configuration_extension: "{{ synapse_admin_configuration_extension_json_auto | from_json | combine(synapse_admin_configuration_extension_json | from_json if synapse_admin_configuration_extension_json | from_json is mapping else {}, recursive=True) }}" # Holds the final synapse-admin configuration (a combination of the default and its extension). -# You most likely don't need to touch this variable. Instead, see `matrix_synapse_admin_configuration_default`. -matrix_synapse_admin_configuration: "{{ matrix_synapse_admin_configuration_default | combine(matrix_synapse_admin_configuration_extension, recursive=True) }}" +# You most likely don't need to touch this variable. Instead, see `synapse_admin_configuration_default`. +synapse_admin_configuration: "{{ synapse_admin_configuration_default | combine(synapse_admin_configuration_extension, recursive=True) }}" # Controls the restrictBaseUrl configuration setting, which, if defined, # restricts the homeserver(s), so that the user can no longer define a homeserver manually during login. -matrix_synapse_admin_config_restrictBaseUrl: "{{ matrix_homeserver_url }}" # noqa var-naming +synapse_admin_config_restrictBaseUrl: "{{ matrix_homeserver_url }}" # noqa var-naming # Controls the externalAuthProvider configuration setting, which, if defined, # enables a special compatibility mode that works better for external auth providers like LDAP, MAS, etc. -matrix_synapse_admin_config_externalAuthProvider: false # noqa var-naming +synapse_admin_config_externalAuthProvider: false # noqa var-naming # Controls the corsCredentials configuration setting, which, if defined, # allows including credentials (cookies, authorization headers, or TLS client certificates) in requests # ref: https://developer.mozilla.org/en-US/docs/Web/API/Fetch_API/Using_Fetch#including_credentials -matrix_synapse_admin_config_corsCredentials: "same-origin" # noqa var-naming +synapse_admin_config_corsCredentials: "same-origin" # noqa var-naming # Controls the menu configuration setting, which, if defined, adds new menu items to the Synapse Admin UI. # The format is a list of objects, where each object has the following keys: @@ -227,29 +227,29 @@ matrix_synapse_admin_config_corsCredentials: "same-origin" # noqa var-naming # "url": "https://github.com/etkecc/synapse-admin/issues" # } # ] -matrix_synapse_admin_config_menu: [] +synapse_admin_config_menu: [] # Controls the asManagedUsers configuration setting (managed by playbook), which, if defined, # restricts modifications of the specified users (e.g., bridge-managed). # You should use JS regex syntax to match the user IDs. # Example for mautrix-telegram: ["^@telegram_[a-zA-Z0-9]+:example\\.com$"] -# WARNING: you want to use matrix_synapse_admin_config_asManagedUsers_custom instead of this variable. -matrix_synapse_admin_config_asManagedUsers_auto: [] # noqa var-naming +# WARNING: you want to use synapse_admin_config_asManagedUsers_custom instead of this variable. +synapse_admin_config_asManagedUsers_auto: [] # noqa var-naming # Controls the asManagedUsers configuration setting (managed per host), which, if defined, # restricts modifications of the specified users (e.g., bridge-managed). # You should use JS regex syntax to match the user IDs. # Example for mautrix-telegram: ["^@telegram_[a-zA-Z0-9]+:example\\.com$"] -matrix_synapse_admin_config_asManagedUsers_custom: [] # noqa var-naming +synapse_admin_config_asManagedUsers_custom: [] # noqa var-naming # Controls the asManagedUsers configuration setting, which, if defined, # restricts modifications of the specified users (e.g., bridge-managed). # You should use JS regex syntax to match the user IDs. # Example for mautrix-telegram: ["^@telegram_[a-zA-Z0-9]+:example\\.com$"] -# WARNING: you want to use matrix_synapse_admin_config_asManagedUsers_custom instead of this variable. -matrix_synapse_admin_config_asManagedUsers: "{{ matrix_synapse_admin_config_asManagedUsers_auto + matrix_synapse_admin_config_asManagedUsers_custom }}" # noqa var-naming +# WARNING: you want to use synapse_admin_config_asManagedUsers_custom instead of this variable. +synapse_admin_config_asManagedUsers: "{{ synapse_admin_config_asManagedUsers_auto + synapse_admin_config_asManagedUsers_custom }}" # noqa var-naming -# matrix_synapse_admin_restart_necessary controls whether the service +# synapse_admin_restart_necessary controls whether the service # will be restarted (when true) or merely started (when false) by the # systemd service manager role (when conditional restart is enabled). # @@ -257,4 +257,4 @@ matrix_synapse_admin_config_asManagedUsers: "{{ matrix_synapse_admin_config_asMa # any configuration files, the systemd service file, or the container image changed. # The default of `false` means "no restart needed" — appropriate when the role's # installation tasks haven't run (e.g., due to --tags skipping them). -matrix_synapse_admin_restart_necessary: false +synapse_admin_restart_necessary: false diff --git a/roles/custom/matrix-synapse-admin/tasks/main.yml b/roles/custom/matrix-synapse-admin/tasks/main.yml index c66e9998e..f94d3cc9e 100644 --- a/roles/custom/matrix-synapse-admin/tasks/main.yml +++ b/roles/custom/matrix-synapse-admin/tasks/main.yml @@ -11,15 +11,15 @@ - install-all - install-synapse-admin block: - - when: matrix_synapse_admin_enabled | bool + - when: synapse_admin_enabled | bool ansible.builtin.include_tasks: "{{ role_path }}/tasks/validate_config.yml" - - when: matrix_synapse_admin_enabled | bool + - when: synapse_admin_enabled | bool ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_install.yml" - tags: - setup-all - setup-synapse-admin block: - - when: not matrix_synapse_admin_enabled | bool + - when: not synapse_admin_enabled | bool ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_uninstall.yml" diff --git a/roles/custom/matrix-synapse-admin/tasks/setup_install.yml b/roles/custom/matrix-synapse-admin/tasks/setup_install.yml index 1521b348a..ed9525438 100644 --- a/roles/custom/matrix-synapse-admin/tasks/setup_install.yml +++ b/roles/custom/matrix-synapse-admin/tasks/setup_install.yml @@ -19,68 +19,68 @@ owner: "{{ matrix_user_name }}" group: "{{ matrix_group_name }}" with_items: - - {path: "{{ matrix_synapse_admin_base_path }}", when: true} - - {path: "{{ matrix_synapse_admin_config_path }}", when: true} - - {path: "{{ matrix_synapse_admin_docker_src_files_path }}", when: "{{ matrix_synapse_admin_container_image_self_build }}"} + - {path: "{{ synapse_admin_base_path }}", when: true} + - {path: "{{ synapse_admin_config_path }}", when: true} + - {path: "{{ synapse_admin_docker_src_files_path }}", when: "{{ synapse_admin_container_image_self_build }}"} when: "item.when | bool" - name: Ensure synapse-admin labels file is created ansible.builtin.template: src: "{{ role_path }}/templates/labels.j2" - dest: "{{ matrix_synapse_admin_base_path }}/labels" + dest: "{{ synapse_admin_base_path }}/labels" owner: "{{ matrix_user_name }}" group: "{{ matrix_group_name }}" mode: 0640 - register: matrix_synapse_admin_support_files_result + register: synapse_admin_support_files_result - name: Ensure synapse-admin configuration installed ansible.builtin.copy: - content: "{{ matrix_synapse_admin_configuration | to_nice_json }}" - dest: "{{ matrix_synapse_admin_config_path }}/config.json" + content: "{{ synapse_admin_configuration | to_nice_json }}" + dest: "{{ synapse_admin_config_path }}/config.json" mode: 0644 owner: "{{ matrix_user_name }}" group: "{{ matrix_group_name }}" - register: matrix_synapse_admin_config_result + register: synapse_admin_config_result - name: Ensure synapse-admin image is pulled community.docker.docker_image: - name: "{{ matrix_synapse_admin_docker_image }}" + name: "{{ synapse_admin_docker_image }}" source: "{{ 'pull' if ansible_version.major > 2 or ansible_version.minor > 7 else omit }}" - force_source: "{{ matrix_synapse_admin_docker_image_force_pull if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}" - force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else matrix_synapse_admin_docker_image_force_pull }}" - when: not matrix_synapse_admin_container_image_self_build | bool - register: matrix_synapse_admin_container_image_pull_result + force_source: "{{ synapse_admin_docker_image_force_pull if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}" + force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else synapse_admin_docker_image_force_pull }}" + when: not synapse_admin_container_image_self_build | bool + register: synapse_admin_container_image_pull_result retries: "{{ devture_playbook_help_container_retries_count }}" delay: "{{ devture_playbook_help_container_retries_delay }}" - until: matrix_synapse_admin_container_image_pull_result is not failed + until: synapse_admin_container_image_pull_result is not failed - name: Ensure synapse-admin repository is present when self-building ansible.builtin.git: - repo: "{{ matrix_synapse_admin_container_image_self_build_repo }}" - dest: "{{ matrix_synapse_admin_docker_src_files_path }}" - version: "{{ matrix_synapse_admin_docker_image.split(':')[1] }}" + repo: "{{ synapse_admin_container_image_self_build_repo }}" + dest: "{{ synapse_admin_docker_src_files_path }}" + version: "{{ synapse_admin_docker_image.split(':')[1] }}" force: "yes" become: true become_user: "{{ matrix_user_name }}" - register: matrix_synapse_admin_git_pull_results - when: matrix_synapse_admin_container_image_self_build | bool + register: synapse_admin_git_pull_results + when: synapse_admin_container_image_self_build | bool - name: Ensure synapse-admin Docker image is built community.docker.docker_image: - name: "{{ matrix_synapse_admin_docker_image }}" + name: "{{ synapse_admin_docker_image }}" source: build - force_source: "{{ matrix_synapse_admin_git_pull_results.changed if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}" - force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else matrix_synapse_admin_git_pull_results.changed }}" + force_source: "{{ synapse_admin_git_pull_results.changed if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}" + force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else synapse_admin_git_pull_results.changed }}" build: dockerfile: Dockerfile - path: "{{ matrix_synapse_admin_docker_src_files_path }}" + path: "{{ synapse_admin_docker_src_files_path }}" pull: true - when: matrix_synapse_admin_container_image_self_build | bool + when: synapse_admin_container_image_self_build | bool - name: Ensure synapse-admin container network is created community.general.docker_network: enable_ipv6: "{{ devture_systemd_docker_base_ipv6_enabled }}" - name: "{{ matrix_synapse_admin_container_network }}" + name: "{{ synapse_admin_container_network }}" driver: bridge driver_options: "{{ devture_systemd_docker_base_container_networks_driver_options }}" @@ -89,14 +89,14 @@ src: "{{ role_path }}/templates/systemd/synapse-admin.service.j2" dest: "{{ devture_systemd_docker_base_systemd_path }}/synapse-admin.service" mode: 0644 - register: matrix_synapse_admin_systemd_service_result + register: synapse_admin_systemd_service_result - name: Determine whether Synapse Admin needs a restart ansible.builtin.set_fact: - matrix_synapse_admin_restart_necessary: >- + synapse_admin_restart_necessary: >- {{ - matrix_synapse_admin_support_files_result.changed | default(false) - or matrix_synapse_admin_config_result.changed | default(false) - or matrix_synapse_admin_systemd_service_result.changed | default(false) - or matrix_synapse_admin_container_image_pull_result.changed | default(false) + synapse_admin_support_files_result.changed | default(false) + or synapse_admin_config_result.changed | default(false) + or synapse_admin_systemd_service_result.changed | default(false) + or synapse_admin_container_image_pull_result.changed | default(false) }} diff --git a/roles/custom/matrix-synapse-admin/tasks/setup_uninstall.yml b/roles/custom/matrix-synapse-admin/tasks/setup_uninstall.yml index a4bb0fd1d..c4b5800ef 100644 --- a/roles/custom/matrix-synapse-admin/tasks/setup_uninstall.yml +++ b/roles/custom/matrix-synapse-admin/tasks/setup_uninstall.yml @@ -7,9 +7,9 @@ - name: Check existence of synapse-admin service ansible.builtin.stat: path: "{{ devture_systemd_docker_base_systemd_path }}/synapse-admin.service" - register: matrix_synapse_admin_service_stat + register: synapse_admin_service_stat -- when: matrix_synapse_admin_service_stat.stat.exists | bool +- when: synapse_admin_service_stat.stat.exists | bool block: - name: Ensure synapse-admin is stopped ansible.builtin.service: @@ -25,5 +25,5 @@ - name: Ensure synapse-admin directory doesn't exist ansible.builtin.file: - path: "{{ matrix_synapse_admin_base_path }}" + path: "{{ synapse_admin_base_path }}" state: absent diff --git a/roles/custom/matrix-synapse-admin/tasks/validate_config.yml b/roles/custom/matrix-synapse-admin/tasks/validate_config.yml index 9a00d5803..3eedc5ebc 100644 --- a/roles/custom/matrix-synapse-admin/tasks/validate_config.yml +++ b/roles/custom/matrix-synapse-admin/tasks/validate_config.yml @@ -13,14 +13,14 @@ Please rename the variable (`{{ item.old }}` -> `{{ item.new }}`) on your configuration file (vars.yml). when: "lookup('ansible.builtin.varnames', ('^' + item.old + '$'), wantlist=True) | length > 0" with_items: - - {'old': 'matrix_synapse_admin_docker_repo', 'new': 'matrix_synapse_admin_container_self_build_repo'} - - {'old': 'matrix_synapse_admin_container_self_build', 'new': 'matrix_synapse_admin_container_image_self_build'} - - {'old': 'matrix_synapse_admin_container_self_build_repo', 'new': 'matrix_synapse_admin_container_image_self_build_repo'} - - {'old': 'matrix_synapse_admin_public_endpoint', 'new': 'matrix_synapse_admin_path_prefix'} - - {'old': 'matrix_synapse_admin_nginx_proxy_integration_enabled', 'new': ''} - - {'old': 'matrix_synapse_admin_docker_image_name_prefix', 'new': 'matrix_synapse_admin_docker_image_registry_prefix'} + - {'old': 'synapse_admin_docker_repo', 'new': 'synapse_admin_container_self_build_repo'} + - {'old': 'synapse_admin_container_self_build', 'new': 'synapse_admin_container_image_self_build'} + - {'old': 'synapse_admin_container_self_build_repo', 'new': 'synapse_admin_container_image_self_build_repo'} + - {'old': 'synapse_admin_public_endpoint', 'new': 'synapse_admin_path_prefix'} + - {'old': 'synapse_admin_nginx_proxy_integration_enabled', 'new': ''} + - {'old': 'synapse_admin_docker_image_name_prefix', 'new': 'synapse_admin_docker_image_registry_prefix'} -- when: matrix_synapse_admin_container_labels_traefik_enabled | bool +- when: synapse_admin_container_labels_traefik_enabled | bool block: - name: Fail if required synapse-admin Traefik settings not defined ansible.builtin.fail: @@ -28,14 +28,14 @@ You need to define a required configuration setting (`{{ item }}`). when: "lookup('vars', item, default='') == ''" with_items: - - matrix_synapse_admin_container_labels_traefik_hostname - - matrix_synapse_admin_container_labels_traefik_path_prefix + - synapse_admin_container_labels_traefik_hostname + - synapse_admin_container_labels_traefik_path_prefix # We ensure it doesn't end with a slash, because we handle both (slash and no-slash). - # Knowing that `matrix_synapse_admin_container_labels_traefik_path_prefix` does not end with a slash + # Knowing that `synapse_admin_container_labels_traefik_path_prefix` does not end with a slash # ensures we know how to set these routes up without having to do "does it end with a slash" checks elsewhere. - - name: Fail if matrix_synapse_admin_container_labels_traefik_path_prefix ends with a slash + - name: Fail if synapse_admin_container_labels_traefik_path_prefix ends with a slash ansible.builtin.fail: msg: >- - matrix_synapse_admin_container_labels_traefik_path_prefix (`{{ matrix_synapse_admin_container_labels_traefik_path_prefix }}`) must either be `/` or not end with a slash (e.g. `/synapse-admin`). - when: "matrix_synapse_admin_container_labels_traefik_path_prefix != '/' and matrix_synapse_admin_container_labels_traefik_path_prefix[-1] == '/'" + synapse_admin_container_labels_traefik_path_prefix (`{{ synapse_admin_container_labels_traefik_path_prefix }}`) must either be `/` or not end with a slash (e.g. `/synapse-admin`). + when: "synapse_admin_container_labels_traefik_path_prefix != '/' and synapse_admin_container_labels_traefik_path_prefix[-1] == '/'" diff --git a/roles/custom/matrix-synapse-admin/templates/labels.j2 b/roles/custom/matrix-synapse-admin/templates/labels.j2 index 4497daf9f..5fbec3b80 100644 --- a/roles/custom/matrix-synapse-admin/templates/labels.j2 +++ b/roles/custom/matrix-synapse-admin/templates/labels.j2 @@ -5,54 +5,54 @@ SPDX-FileCopyrightText: 2025 MDAD project contributors SPDX-License-Identifier: AGPL-3.0-or-later #} -{% if matrix_synapse_admin_container_labels_traefik_enabled %} +{% if synapse_admin_container_labels_traefik_enabled %} traefik.enable=true -{% if matrix_synapse_admin_container_labels_traefik_docker_network %} -traefik.docker.network={{ matrix_synapse_admin_container_labels_traefik_docker_network }} +{% if synapse_admin_container_labels_traefik_docker_network %} +traefik.docker.network={{ synapse_admin_container_labels_traefik_docker_network }} {% endif %} traefik.http.services.synapse-admin.loadbalancer.server.port=8080 {% set middlewares = [] %} -{% if matrix_synapse_admin_container_labels_traefik_ipallowlist_sourcerange | length > 0 %} -traefik.http.middlewares.synapse-admin-ipallowlist.ipallowlist.sourcerange={{ matrix_synapse_admin_container_labels_traefik_ipallowlist_sourcerange | join(',') }} +{% if synapse_admin_container_labels_traefik_ipallowlist_sourcerange | length > 0 %} +traefik.http.middlewares.synapse-admin-ipallowlist.ipallowlist.sourcerange={{ synapse_admin_container_labels_traefik_ipallowlist_sourcerange | join(',') }} {% set middlewares = middlewares + ['synapse-admin-ipallowlist'] %} {% endif %} -{% if matrix_synapse_admin_container_labels_traefik_path_prefix != '/' %} -traefik.http.middlewares.synapse-admin-slashless-redirect.redirectregex.regex=({{ matrix_synapse_admin_container_labels_traefik_path_prefix | quote }})$ +{% if synapse_admin_container_labels_traefik_path_prefix != '/' %} +traefik.http.middlewares.synapse-admin-slashless-redirect.redirectregex.regex=({{ synapse_admin_container_labels_traefik_path_prefix | quote }})$ traefik.http.middlewares.synapse-admin-slashless-redirect.redirectregex.replacement=${1}/ {% set middlewares = middlewares + ['synapse-admin-slashless-redirect'] %} {% endif %} -{% if matrix_synapse_admin_container_labels_traefik_path_prefix != '/' %} -traefik.http.middlewares.synapse-admin-strip-prefix.stripprefix.prefixes={{ matrix_synapse_admin_container_labels_traefik_path_prefix }} +{% if synapse_admin_container_labels_traefik_path_prefix != '/' %} +traefik.http.middlewares.synapse-admin-strip-prefix.stripprefix.prefixes={{ synapse_admin_container_labels_traefik_path_prefix }} {% set middlewares = middlewares + ['synapse-admin-strip-prefix'] %} {% endif %} -{% if matrix_synapse_admin_container_labels_traefik_additional_response_headers.keys() | length > 0 %} -{% for name, value in matrix_synapse_admin_container_labels_traefik_additional_response_headers.items() %} +{% if synapse_admin_container_labels_traefik_additional_response_headers.keys() | length > 0 %} +{% for name, value in synapse_admin_container_labels_traefik_additional_response_headers.items() %} traefik.http.middlewares.synapse-admin-add-headers.headers.customresponseheaders.{{ name }}={{ value }} {% endfor %} {% set middlewares = middlewares + ['synapse-admin-add-headers'] %} {% endif %} -traefik.http.routers.synapse-admin.rule={{ matrix_synapse_admin_container_labels_traefik_rule }} -{% if matrix_synapse_admin_container_labels_traefik_priority | int > 0 %} -traefik.http.routers.synapse-admin.priority={{ matrix_synapse_admin_container_labels_traefik_priority }} +traefik.http.routers.synapse-admin.rule={{ synapse_admin_container_labels_traefik_rule }} +{% if synapse_admin_container_labels_traefik_priority | int > 0 %} +traefik.http.routers.synapse-admin.priority={{ synapse_admin_container_labels_traefik_priority }} {% endif %} {% if middlewares | length > 0 %} traefik.http.routers.synapse-admin.middlewares={{ middlewares | join(',') }} {% endif %} traefik.http.routers.synapse-admin.service=synapse-admin -traefik.http.routers.synapse-admin.entrypoints={{ matrix_synapse_admin_container_labels_traefik_entrypoints }} -traefik.http.routers.synapse-admin.tls={{ matrix_synapse_admin_container_labels_traefik_tls | to_json }} -{% if matrix_synapse_admin_container_labels_traefik_tls %} -traefik.http.routers.synapse-admin.tls.certResolver={{ matrix_synapse_admin_container_labels_traefik_tls_certResolver }} +traefik.http.routers.synapse-admin.entrypoints={{ synapse_admin_container_labels_traefik_entrypoints }} +traefik.http.routers.synapse-admin.tls={{ synapse_admin_container_labels_traefik_tls | to_json }} +{% if synapse_admin_container_labels_traefik_tls %} +traefik.http.routers.synapse-admin.tls.certResolver={{ synapse_admin_container_labels_traefik_tls_certResolver }} {% endif %} {% endif %} -{{ matrix_synapse_admin_container_labels_additional_labels }} +{{ synapse_admin_container_labels_additional_labels }} diff --git a/roles/custom/matrix-synapse-admin/templates/systemd/matrix-synapse-admin.service.j2 b/roles/custom/matrix-synapse-admin/templates/systemd/matrix-synapse-admin.service.j2 index 650265d1f..124dbb049 100644 --- a/roles/custom/matrix-synapse-admin/templates/systemd/matrix-synapse-admin.service.j2 +++ b/roles/custom/matrix-synapse-admin/templates/systemd/matrix-synapse-admin.service.j2 @@ -1,11 +1,11 @@ #jinja2: lstrip_blocks: True [Unit] Description=synapse-admin -{% for service in matrix_synapse_admin_systemd_required_services_list %} +{% for service in synapse_admin_systemd_required_services_list %} Requires={{ service }} After={{ service }} {% endfor %} -{% for service in matrix_synapse_admin_systemd_wanted_services_list %} +{% for service in synapse_admin_systemd_wanted_services_list %} Wants={{ service }} {% endfor %} DefaultDependencies=no @@ -22,19 +22,19 @@ ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} create \ --log-driver=none \ --cap-drop=ALL \ --read-only \ - --user={{ matrix_synapse_admin_container_uid }}:{{ matrix_synapse_admin_container_gid }} \ - --network={{ matrix_synapse_admin_container_network }} \ - {% if matrix_synapse_admin_container_http_host_bind_port %} - -p {{ matrix_synapse_admin_container_http_host_bind_port }}:8080 \ + --user={{ synapse_admin_container_uid }}:{{ synapse_admin_container_gid }} \ + --network={{ synapse_admin_container_network }} \ + {% if synapse_admin_container_http_host_bind_port %} + -p {{ synapse_admin_container_http_host_bind_port }}:8080 \ {% endif %} - --label-file={{ matrix_synapse_admin_base_path }}/labels \ - --mount type=bind,src={{ matrix_synapse_admin_config_path }}/config.json,dst=/var/public/config.json,ro \ - {% for arg in matrix_synapse_admin_container_extra_arguments %} + --label-file={{ synapse_admin_base_path }}/labels \ + --mount type=bind,src={{ synapse_admin_config_path }}/config.json,dst=/var/public/config.json,ro \ + {% for arg in synapse_admin_container_extra_arguments %} {{ arg }} \ {% endfor %} - {{ matrix_synapse_admin_docker_image }} + {{ synapse_admin_docker_image }} -{% for network in matrix_synapse_admin_container_additional_networks %} +{% for network in synapse_admin_container_additional_networks %} ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} network connect {{ network }} synapse-admin {% endfor %} diff --git a/roles/custom/matrix-synapse/defaults/main.yml b/roles/custom/matrix-synapse/defaults/main.yml index 71bf266ef..28e35f7e9 100644 --- a/roles/custom/matrix-synapse/defaults/main.yml +++ b/roles/custom/matrix-synapse/defaults/main.yml @@ -425,7 +425,7 @@ matrix_synapse_form_secret: "{{ matrix_synapse_macaroon_secret_key }}" # Controls how to reach server admin, used in ResouceLimitError -matrix_synapse_admin_contact: ~ +synapse_admin_contact: ~ matrix_synapse_max_upload_size_mb: 50 diff --git a/roles/custom/matrix-synapse/templates/synapse/homeserver.yaml.j2 b/roles/custom/matrix-synapse/templates/synapse/homeserver.yaml.j2 index 558dc1729..28da1fb4e 100644 --- a/roles/custom/matrix-synapse/templates/synapse/homeserver.yaml.j2 +++ b/roles/custom/matrix-synapse/templates/synapse/homeserver.yaml.j2 @@ -391,7 +391,7 @@ manhole_settings: # How to reach the server admin, used in ResourceLimitError # -admin_contact: {{ matrix_synapse_admin_contact | to_json }} +admin_contact: {{ synapse_admin_contact | to_json }} # Global blocking # diff --git a/roles/custom/matrix_playbook_migration/tasks/validate_config.yml b/roles/custom/matrix_playbook_migration/tasks/validate_config.yml index 3c2682b57..4173d2385 100644 --- a/roles/custom/matrix_playbook_migration/tasks/validate_config.yml +++ b/roles/custom/matrix_playbook_migration/tasks/validate_config.yml @@ -656,6 +656,19 @@ The following variables in your configuration need to be renamed: {{ lookup('ansible.builtin.varnames', '^matrix_dynamic_dns_.+', wantlist=True) | join(', ') }} when: "lookup('ansible.builtin.varnames', '^matrix_dynamic_dns_.+', wantlist=True) | length > 0" +- name: (Deprecation) Catch and report matrix-synapse-admin variables + ansible.builtin.fail: + msg: |- + The matrix-synapse-admin role in the playbook now lives under the MASH organization (https://github.com/mother-of-all-self-hosting/ansible-role-synapse-admin). + The new role is pretty much the same, but uses differently named variables. + + Please rename all `matrix_synapse_admin_`-prefixed variables (`matrix_synapse_admin_*` -> `synapse_admin_*`) on your configuration file (vars.yml). + + After renaming them, please do not forget to fetch the Ansible role. See docs/maintenance-upgrading-services.md for details about how to do so. + + The following variables in your configuration need to be renamed: {{ lookup('ansible.builtin.varnames', '^matrix_synapse_admin_.+', wantlist=True) | join(', ') }} + when: "lookup('ansible.builtin.varnames', '^matrix_synapse_admin_.+', wantlist=True) | length > 0" + - name: (Deprecation) Catch and report mautrix-facebook variables ansible.builtin.fail: msg: |-