matrix-docker-ansible-deploy

Commit graph

Autor	SHA1	Nachricht	Datum
Aaron Raimist	6fce809d10	Add config option to be able to access database outside of container	vor 6 Jahren
Slavi Pantaleev	ae7c8d1524	Use SyslogIdentifier to improve logging Reasoning is the same as for matrix-org/synapse#5023. For us, the journal used to contain `docker` for all services, which is not very helpful when looking at them all together (`journalctl -f`).	vor 6 Jahren
Hugues De Keyzer	c451025134	Fix indentation in templates Use Jinja2 lstrip_blocks option in templates to ensure consistent indentation in generated files.	vor 6 Jahren
Sylvia van Os	75b1528d13	Add the possibility to pass extra flags to the docker container	vor 6 Jahren
Lyubomir Popov	134faa3139	Add the ability to update user passwords with ansible (when using the matrix-postgres container).	vor 6 Jahren
Slavi Pantaleev	a43bcd81fe	Rename some variables	vor 7 Jahren
Slavi Pantaleev	0be7b25c64	Make (most) containers run with a read-only filesystem	vor 7 Jahren
Slavi Pantaleev	9438402f61	Drop capabilities in a few more places Continuation of `316d653d3e`	vor 7 Jahren
Slavi Pantaleev	316d653d3e	Drop capabilities in containers We run containers as a non-root user (no effective capabilities). Still, if a setuid binary is available in a container image, it could potentially be used to give the user the default capabilities that the container was started with. For Docker, the default set currently is: - "CAP_CHOWN" - "CAP_DAC_OVERRIDE" - "CAP_FSETID" - "CAP_FOWNER" - "CAP_MKNOD" - "CAP_NET_RAW" - "CAP_SETGID" - "CAP_SETUID" - "CAP_SETFCAP" - "CAP_SETPCAP" - "CAP_NET_BIND_SERVICE" - "CAP_SYS_CHROOT" - "CAP_KILL" - "CAP_AUDIT_WRITE" We'd rather prevent such a potential escalation by dropping ALL capabilities. The problem is nicely explained here: https://github.com/projectatomic/atomic-site/issues/203	vor 7 Jahren
Slavi Pantaleev	1a80058a2a	Indent (non-YAML) using tabs Fixes #83 (Github issue)	vor 7 Jahren
Slavi Pantaleev	51312b8250	Split playbook into multiple roles As suggested in #63 (Github issue), splitting the playbook's logic into multiple roles will be beneficial for maintainability. This patch realizes this split. Still, some components affect others, so the roles are not really independent of one another. For example: - disabling mxisd (`matrix_mxisd_enabled: false`), causes Synapse and riot-web to reconfigure themselves with other (public) Identity servers. - enabling matrix-corporal (`matrix_corporal_enabled: true`) affects how reverse-proxying (by `matrix-nginx-proxy`) is done, in order to put matrix-corporal's gateway server in front of Synapse We may be able to move away from such dependencies in the future, at the expense of a more complicated manual configuration, but it's probably not worth sacrificing the convenience we have now. As part of this work, the way we do "start components" has been redone now to use a loop, as suggested in #65 (Github issue). This should make restarting faster and more reliable.	vor 7 Jahren

12 Commits (cb57cd503e80bc8e024d855e14ea328e887c762f)