matrix-docker-ansible-deploy

617 MiB

Struktur: 2d1b9f2dbf

Autor	SHA1	Nachricht	Datum
Max Klenk	1e68d8b2e5	allow to pass arguments to the postgres process	vor 5 Jahren
Chris van Dijk	6334f6c1ea	Remove hardcoded command paths in systemd unit files Depending on the distro, common commands like sleep and chown may either be located in /bin or /usr/bin. Systemd added path lookup to ExecStart in v239, allowing only the command name to be put in unit files and not the full path as historically required. At least Ubuntu 18.04 LTS is however still on v237 so we should maintain portability for a while longer.	vor 6 Jahren
Aaron Raimist	6fce809d10	Add config option to be able to access database outside of container	vor 7 Jahren
Slavi Pantaleev	ae7c8d1524	Use SyslogIdentifier to improve logging Reasoning is the same as for matrix-org/synapse#5023. For us, the journal used to contain `docker` for all services, which is not very helpful when looking at them all together (`journalctl -f`).	vor 7 Jahren
Hugues De Keyzer	c451025134	Fix indentation in templates Use Jinja2 lstrip_blocks option in templates to ensure consistent indentation in generated files.	vor 7 Jahren
Sylvia van Os	75b1528d13	Add the possibility to pass extra flags to the docker container	vor 7 Jahren
Slavi Pantaleev	0be7b25c64	Make (most) containers run with a read-only filesystem	vor 7 Jahren
Slavi Pantaleev	316d653d3e	Drop capabilities in containers We run containers as a non-root user (no effective capabilities). Still, if a setuid binary is available in a container image, it could potentially be used to give the user the default capabilities that the container was started with. For Docker, the default set currently is: - "CAP_CHOWN" - "CAP_DAC_OVERRIDE" - "CAP_FSETID" - "CAP_FOWNER" - "CAP_MKNOD" - "CAP_NET_RAW" - "CAP_SETGID" - "CAP_SETUID" - "CAP_SETFCAP" - "CAP_SETPCAP" - "CAP_NET_BIND_SERVICE" - "CAP_SYS_CHROOT" - "CAP_KILL" - "CAP_AUDIT_WRITE" We'd rather prevent such a potential escalation by dropping ALL capabilities. The problem is nicely explained here: https://github.com/projectatomic/atomic-site/issues/203	vor 7 Jahren
Slavi Pantaleev	51312b8250	Split playbook into multiple roles As suggested in #63 (Github issue), splitting the playbook's logic into multiple roles will be beneficial for maintainability. This patch realizes this split. Still, some components affect others, so the roles are not really independent of one another. For example: - disabling mxisd (`matrix_mxisd_enabled: false`), causes Synapse and riot-web to reconfigure themselves with other (public) Identity servers. - enabling matrix-corporal (`matrix_corporal_enabled: true`) affects how reverse-proxying (by `matrix-nginx-proxy`) is done, in order to put matrix-corporal's gateway server in front of Synapse We may be able to move away from such dependencies in the future, at the expense of a more complicated manual configuration, but it's probably not worth sacrificing the convenience we have now. As part of this work, the way we do "start components" has been redone now to use a loop, as suggested in #65 (Github issue). This should make restarting faster and more reliable.	vor 7 Jahren

9 Commits (2d1b9f2dbf33f4178d75c385c0264093ad842ec7)