overmind
/
matrix-docker-ansible-deploy
mirror of https://github.com/spantaleev/matrix-docker-ansible-deploy
1
0
Fork 0
Code Issues 0 Releases 0 Wiki Activity
Matrix Docker Ansible eploy
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
11293 Commits
12 Branches
772 MiB
 
 
Branch: master
Branches Tags
${ item.name }
Create branch ${ searchTerm }
from 'master'
${ noResults }
matrix-docker-ansible-deploy/roles/custom/matrix-synapse/tasks/validate_config.yml

229 lines
21 KiB
Raw Permalink Blame History 

  1. # SPDX-FileCopyrightText: 2019 - 2024 Slavi Pantaleev

  2. # SPDX-FileCopyrightText: 2024 Charles Wright

  3. # SPDX-FileCopyrightText: 2024 MDAD project contributors

  4. #

  5. # SPDX-License-Identifier: AGPL-3.0-or-later

  6. 

  7. ---

  8. 

  9. - name: (Deprecation) Catch and report renamed settings

  10.   ansible.builtin.fail:

  11.     msg: >-

  12.       Your configuration contains a variable, which now has a different name.

  13.       Please rename the variable (`{{ item.old }}` -> `{{ item.new }}`) on your configuration file (vars.yml).

  14.   when: "lookup('ansible.builtin.varnames', ('^' + item.old + '$'), wantlist=True) | length > 0"

  15.   with_items:

  16.     - {'old': 'matrix_synapse_email_riot_base_url', 'new': '<superseded by client_base_url>'}

  17.     - {'old': 'matrix_synapse_container_expose_api_port', 'new': '<superseded by matrix_synapse_container_federation_api_plain_host_bind_port>'}

  18.     - {'old': 'matrix_synapse_no_tls', 'new': '<removed>'}

  19.     - {'old': 'matrix_enable_room_list_search', 'new': 'matrix_synapse_enable_room_list_search'}

  20.     - {'old': 'matrix_alias_creation_rules', 'new': 'matrix_synapse_alias_creation_rules'}

  21.     - {'old': 'matrix_room_list_publication_rules', 'new': 'matrix_synapse_room_list_publication_rules'}

  22.     - {'old': 'matrix_synapse_rc_messages_per_second', 'new': '<per_second subkey of matrix_synapse_rc_message>'}

  23.     - {'old': 'matrix_synapse_rc_message_burst_count', 'new': '<burst_count subkey of matrix_synapse_rc_message>'}

  24.     - {'old': 'matrix_synapse_federation_rc_window_size', 'new': '<window_size subkey of matrix_synapse_rc_federation>'}

  25.     - {'old': 'matrix_synapse_federation_rc_sleep_limit', 'new': '<sleep_limit subkey of matrix_synapse_rc_federation>'}

  26.     - {'old': 'matrix_synapse_federation_rc_sleep_delay', 'new': '<sleep_delay subkey of matrix_synapse_rc_federation>'}

  27.     - {'old': 'matrix_synapse_federation_rc_reject_limit', 'new': '<reject_limit subkey of matrix_synapse_rc_federation>'}

  28.     - {'old': 'matrix_synapse_federation_rc_concurrent', 'new': '<concurrent subkey of matrix_synapse_rc_federation>'}

  29.     - {'old': 'matrix_synapse_container_expose_client_api_port', 'new': '<superseded by matrix_synapse_container_client_api_host_bind_port>'}

  30.     - {'old': 'matrix_synapse_container_expose_federation_api_port', 'new': '<superseded by matrix_synapse_container_federation_api_plain_host_bind_port>'}

  31.     - {'old': 'matrix_synapse_container_expose_metrics_port', 'new': '<superseded by matrix_synapse_container_metrics_api_host_bind_port>'}

  32.     - {'old': 'matrix_synapse_cache_factor', 'new': 'matrix_synapse_caches_global_factor'}

  33.     - {'old': 'matrix_synapse_trusted_third_party_id_servers', 'new': '<deprecated in Synapse v0.99.4 and removed in Synapse v1.19.0>'}

  34.     - {'old': 'matrix_synapse_use_presence', 'new': 'matrix_synapse_presence_enabled'}

  35.     - {'old': 'matrix_synapse_version_arm64', 'new': '<superseded by matrix_synapse_version - see https://github.com/matrix-org/synapse/pull/11810>'}

  36.     - {'old': 'matrix_synapse_enable_group_creation', 'new': '<removed in Synapse v1.61.0 - use the new Spaces feature instead>'}

  37.     - {'old': 'matrix_synapse_account_threepid_delegates_email', 'new': '<removed in Synapse v1.66.0 - make sure to configure email settings for Synapse - see https://matrix-org.github.io/synapse/v1.66/upgrade.html#delegation-of-email-validation-no-longer-supported>'}

  38.     - {'old': 'matrix_synapse_workers_frontend_proxy_workers_count', 'new': '<removed in favor of generic workers - see https://github.com/matrix-org/synapse/pull/13645>'}

  39.     - {'old': 'matrix_synapse_workers_frontend_proxy_workers_port_range_start', 'new': '<removed in favor of generic workers - see https://github.com/matrix-org/synapse/pull/13645>'}

  40.     - {'old': 'matrix_synapse_workers_frontend_proxy_workers_metrics_range_start', 'new': '<removed in favor of generic workers - see https://github.com/matrix-org/synapse/pull/13645>'}

  41.     - {'old': 'matrix_synapse_ext_s3_storage_provider_path', 'new': 'matrix_synapse_ext_s3_storage_provider_base_path'}

  42.     - {'old': 'matrix_synapse_send_federation', 'new': '<unnecessary - Synapse relies on federation_sender_instances now>'}

  43.     - {'old': 'matrix_synapse_start_pushers', 'new': '<unnecessary - Synapse relies on pusher_instances now>'}

  44.     - {'old': 'matrix_synapse_spam_checker', 'new': '<superseded by matrix_synapse_modules>'}

  45.     - {'old': 'matrix_synapse_caches_autotuning_max_cache_memory_usage', 'new': 'matrix_synapse_cache_autotuning_max_cache_memory_usage'}

  46.     - {'old': 'matrix_synapse_caches_autotuning_target_cache_memory_usage', 'new': 'matrix_synapse_cache_autotuning_target_cache_memory_usage'}

  47.     - {'old': 'matrix_synapse_caches_autotuning_min_cache_ttl', 'new': 'matrix_synapse_cache_autotuning_min_cache_ttl'}

  48.     - {'old': 'matrix_synapse_memtotal_kb', 'new': '<superseded by matrix_synapse_cache_size_calculations_memtotal_bytes>'}

  49.     - {'old': 'matrix_synapse_docker_image_name_prefix', 'new': 'matrix_synapse_container_image_registry_prefix'}

  50.     - {'old': 'matrix_s3_goofys_docker_image_name_prefix', 'new': 'matrix_s3_goofys_container_image_registry_prefix'}

  51.     - {'old': 'matrix_synapse_rust_synapse_compress_state_docker_image_name_prefix', 'new': 'matrix_synapse_rust_synapse_compress_state_container_image_registry_prefix'}

  52.     - {'old': 'matrix_s3_goofys_docker_image', 'new': 'matrix_s3_goofys_container_image'}

  53.     - {'old': 'matrix_s3_goofys_docker_image_force_pull', 'new': 'matrix_s3_goofys_container_image_force_pull'}

  54.     - {'old': 'matrix_s3_goofys_docker_image_registry_prefix', 'new': 'matrix_s3_goofys_container_image_registry_prefix'}

  55.     - {'old': 'matrix_s3_goofys_docker_image_registry_prefix_upstream', 'new': 'matrix_s3_goofys_container_image_registry_prefix_upstream'}

  56.     - {'old': 'matrix_s3_goofys_docker_image_registry_prefix_upstream_default', 'new': 'matrix_s3_goofys_container_image_registry_prefix_upstream_default'}

  57.     - {'old': 'matrix_synapse_docker_image', 'new': 'matrix_synapse_container_image'}

  58.     - {'old': 'matrix_synapse_docker_image_name', 'new': 'matrix_synapse_container_image_name'}

  59.     - {'old': 'matrix_synapse_docker_image_tag', 'new': 'matrix_synapse_container_image_tag'}

  60.     - {'old': 'matrix_synapse_docker_image_force_pull', 'new': 'matrix_synapse_container_image_force_pull'}

  61.     - {'old': 'matrix_synapse_docker_image_registry_prefix', 'new': 'matrix_synapse_container_image_registry_prefix'}

  62.     - {'old': 'matrix_synapse_docker_image_registry_prefix_upstream', 'new': 'matrix_synapse_container_image_registry_prefix_upstream'}

  63.     - {'old': 'matrix_synapse_docker_image_registry_prefix_upstream_default', 'new': 'matrix_synapse_container_image_registry_prefix_upstream_default'}

  64.     - {'old': 'matrix_synapse_docker_src_files_path', 'new': 'matrix_synapse_container_src_files_path'}

  65.     - {'old': 'matrix_synapse_docker_image_customized', 'new': 'matrix_synapse_container_image_customized'}

  66.     - {'old': 'matrix_synapse_docker_image_customized_build_nocache', 'new': 'matrix_synapse_container_image_customized_build_nocache'}

  67.     - {'old': 'matrix_synapse_docker_image_customized_force_source', 'new': 'matrix_synapse_container_image_customized_force_source'}

  68.     - {'old': 'matrix_synapse_docker_image_final', 'new': 'matrix_synapse_container_image_final'}

  69.     - {'old': 'matrix_synapse_customized_docker_src_files_path', 'new': 'matrix_synapse_customized_container_src_files_path'}

  70.     - {'old': 'matrix_synapse_rust_synapse_compress_state_docker_image', 'new': 'matrix_synapse_rust_synapse_compress_state_container_image'}

  71.     - {'old': 'matrix_synapse_rust_synapse_compress_state_docker_image_version', 'new': 'matrix_synapse_rust_synapse_compress_state_container_image_version'}

  72.     - {'old': 'matrix_synapse_rust_synapse_compress_state_docker_image_force_pull', 'new': 'matrix_synapse_rust_synapse_compress_state_container_image_force_pull'}

  73.     - {'old': 'matrix_synapse_rust_synapse_compress_state_docker_image_registry_prefix', 'new': 'matrix_synapse_rust_synapse_compress_state_container_image_registry_prefix'}

  74.     - {'old': 'matrix_synapse_rust_synapse_compress_state_docker_image_registry_prefix_upstream', 'new': 'matrix_synapse_rust_synapse_compress_state_container_image_registry_prefix_upstream'}

  75.     - {'old': 'matrix_synapse_rust_synapse_compress_state_docker_image_registry_prefix_upstream_default', 'new': 'matrix_synapse_rust_synapse_compress_state_container_image_registry_prefix_upstream_default'}

  76. 

  77.     - {'old': 'matrix_synapse_experimental_features_msc3202_device_masquerading_enabled', 'new': '<removed - this feature is enabled by default now'}

  78. 

  79.     - {'old': 'matrix_synapse_experimental_features_msc3861_enabled', 'new': 'matrix_synapse_matrix_authentication_service_enabled'}

  80.     - {'old': 'matrix_synapse_experimental_features_msc3861_issuer', 'new': '<superseded by matrix_synapse_matrix_authentication_service_endpoint>'}

  81.     - {'old': 'matrix_synapse_experimental_features_msc3861_client_id', 'new': '<removed>'}

  82.     - {'old': 'matrix_synapse_experimental_features_msc3861_client_auth_method', 'new': '<removed>'}

  83.     - {'old': 'matrix_synapse_experimental_features_msc3861_client_secret', 'new': '<removed>'}

  84.     - {'old': 'matrix_synapse_experimental_features_msc3861_admin_token', 'new': '<removed>'}

  85.     - {'old': 'matrix_synapse_experimental_features_msc3861_account_management_url', 'new': '<removed>'}

  86. 

  87.     - {'old': 'matrix_synapse_experimental_features_msc4133_enabled', 'new': '<removed - this feature is enabled by default now>'}

  88. 

  89.     - {'old': 'matrix_synapse_container_image_customizations_s3_storage_provider_installation_old_boto_workaround_enabled', 'new': '<removed; see https://github.com/spantaleev/matrix-docker-ansible-deploy/issues/4637>'}

  90. 

  91.     - {'old': 'matrix_synapse_container_image_force_pull', 'new': '<removed> (the new community.docker.docker_image_pull module handles this natively)'}

  92.     - {'old': 'matrix_s3_goofys_container_image_force_pull', 'new': '<removed> (the new community.docker.docker_image_pull module handles this natively)'}

  93.     - {'old': 'matrix_synapse_rust_synapse_compress_state_container_image_force_pull', 'new': '<removed> (the new community.docker.docker_image_pull module handles this natively)'}

  94.     - {'old': 'matrix_synapse_reverse_proxy_companion_container_image_force_pull', 'new': '<removed> (the new community.docker.docker_image_pull module handles this natively)'}

  95. 

  96. - name: (Deprecation) Catch and report renamed settings in matrix_synapse_configuration_extension_yaml

  97.   ansible.builtin.fail:

  98.     msg: >-

  99.       Your matrix_synapse_configuration_extension_yaml configuration contains a variable, which now has a different name.

  100.       Please rename the variable (`{{ item.old }}` -> `{{ item.new }}`) on your configuration file (vars.yml).

  101.   when: "item.old in matrix_synapse_configuration_extension"

  102.   with_items:

  103.     - {'old': 'federation_ip_range_blacklist', 'new': 'ip_range_blacklist'}

  104. 

  105. - name: Fail if required Synapse settings not defined

  106.   ansible.builtin.fail:

  107.     msg: >-

  108.       You need to define a required configuration setting (`{{ item.name }}`).

  109.   when: "item.when | bool and lookup('vars', item.name, default='') | string | length == 0"

  110.   with_items:

  111.     - {'name': 'matrix_synapse_username', when: true}

  112.     - {'name': 'matrix_synapse_uid', when: true}

  113.     - {'name': 'matrix_synapse_gid', when: true}

  114.     - {'name': 'matrix_synapse_container_network', when: true}

  115.     - {'name': 'matrix_synapse_macaroon_secret_key', when: true}

  116.     - {'name': 'matrix_synapse_database_host', when: true}

  117.     - {'name': 'matrix_synapse_database_user', when: true}

  118.     - {'name': 'matrix_synapse_database_password', when: true}

  119.     - {'name': 'matrix_synapse_database_database', when: true}

  120. 

  121.     - {'name': 'matrix_synapse_container_labels_public_client_root_traefik_hostname', when: "{{ matrix_synapse_container_labels_public_client_root_enabled }}"}

  122.     - {'name': 'matrix_synapse_container_labels_public_client_root_redirection_url', when: "{{ matrix_synapse_container_labels_public_client_root_redirection_enabled }}"}

  123. 

  124.     - {'name': 'matrix_synapse_container_labels_public_client_api_traefik_hostname', when: "{{ matrix_synapse_container_labels_public_client_api_enabled }}"}

  125. 

  126.     - {'name': 'matrix_synapse_container_labels_internal_client_api_traefik_entrypoints', when: "{{ matrix_synapse_container_labels_internal_client_api_enabled }}"}

  127.     - {'name': 'matrix_synapse_container_labels_internal_client_synapse_admin_api_traefik_entrypoints', when: "{{ matrix_synapse_container_labels_internal_client_synapse_admin_api_enabled }}"}

  128. 

  129.     - {'name': 'matrix_synapse_container_labels_public_client_synapse_client_api_traefik_hostname', when: "{{ matrix_synapse_container_labels_public_client_synapse_client_api_enabled }}"}

  130.     - {'name': 'matrix_synapse_container_labels_public_client_synapse_admin_api_traefik_hostname', when: "{{ matrix_synapse_container_labels_public_client_synapse_admin_api_enabled }}"}

  131. 

  132.     - {'name': 'matrix_synapse_container_labels_public_federation_api_traefik_hostname', when: "{{ matrix_synapse_container_labels_public_federation_api_enabled }}"}

  133.     - {'name': 'matrix_synapse_container_labels_public_federation_api_traefik_entrypoints', when: "{{ matrix_synapse_container_labels_public_federation_api_enabled }}"}

  134. 

  135.     - {'name': 'matrix_synapse_metrics_proxying_hostname', when: "{{ matrix_synapse_metrics_proxying_enabled }}"}

  136.     - {'name': 'matrix_synapse_metrics_proxying_path_prefix', when: "{{ matrix_synapse_metrics_proxying_enabled }}"}

  137. 

  138.     - {'name': 'matrix_synapse_matrix_authentication_service_endpoint', when: "{{ matrix_synapse_matrix_authentication_service_enabled }}"}

  139.     - {'name': 'matrix_synapse_matrix_authentication_service_secret', when: "{{ matrix_synapse_matrix_authentication_service_enabled }}"}

  140. 

  141.     - {'name': 'matrix_synapse_container_labels_traefik_compression_middleware_name', when: "{{ matrix_synapse_container_labels_traefik_compression_middleware_enabled }}"}

  142. 

  143. - name: Fail if asking for more than 1 instance of single-instance workers

  144.   ansible.builtin.fail:

  145.     msg: >-

  146.       `{{ item }}` cannot be more than 1. This is a single-instance worker.

  147.   when: "lookup('vars', item, default='') | int > 1"

  148.   with_items:

  149.     - "matrix_synapse_workers_appservice_workers_count"

  150.     - "matrix_synapse_workers_user_dir_workers_count"

  151.     - "matrix_synapse_workers_background_workers_count"

  152.     - "matrix_synapse_workers_stream_writer_typing_stream_workers_count"

  153.     - "matrix_synapse_workers_stream_writer_to_device_stream_workers_count"

  154.     - "matrix_synapse_workers_stream_writer_account_data_stream_workers_count"

  155.     - "matrix_synapse_workers_stream_writer_receipts_stream_workers_count"

  156.     - "matrix_synapse_workers_stream_writer_presence_stream_workers_count"

  157.     - "matrix_synapse_workers_stream_writer_push_rules_stream_workers_count"

  158. 

  159. - name: Fail if matrix-synapse-reverse-proxy-companion access log format is invalid

  160.   ansible.builtin.fail:

  161.     msg: >-

  162.       `matrix_synapse_reverse_proxy_companion_access_log_format` must be one of:

  163.       {{ matrix_synapse_reverse_proxy_companion_access_log_format_presets.keys() | sort | join(', ') }}

  164.   when: "matrix_synapse_reverse_proxy_companion_access_log_format not in matrix_synapse_reverse_proxy_companion_access_log_format_presets"

  165. 

  166. - name: Fail when mixing generic workers with new specialized workers

  167.   ansible.builtin.fail:

  168.     msg: >-

  169.       Generic workers should not be mixed with the new specialized worker types (room workers, sync workers, client readers, and federation readers)

  170.   when: matrix_synapse_workers_generic_workers_count | int > 0 and ((matrix_synapse_workers_room_workers_count | int + matrix_synapse_workers_sync_workers_count | int + matrix_synapse_workers_client_reader_workers_count | int + matrix_synapse_workers_federation_reader_workers_count | int) > 0)

  171. 

  172. - when: matrix_synapse_container_image_customizations_templates_enabled | bool

  173.   block:

  174.     - name: Fail if required `matrix_synapse_container_image_customizations_templates_*` settings not defined

  175.       ansible.builtin.fail:

  176.         msg: >-

  177.           You need to define a required configuration setting (`{{ item }}`) when enabling `matrix_synapse_container_image_customizations_templates_enabled`.

  178.       when: "lookup('vars', item, default='') == ''"

  179.       with_items:

  180.         - matrix_synapse_container_image_customizations_templates_git_repository_url

  181.         - matrix_synapse_container_image_customizations_templates_git_repository_branch

  182. 

  183.     - name: Fail if required `matrix_synapse_container_image_customizations_templates_git_repository_keyscan_*` settings not defined

  184.       ansible.builtin.fail:

  185.         msg: >-

  186.           You need to define a required configuration setting (`{{ item }}`) when enabling `matrix_synapse_container_image_customizations_templates_git_repository_keyscan`.

  187.       when: "matrix_synapse_container_image_customizations_templates_git_repository_keyscan_enabled | bool and lookup('vars', item, default='') == ''"

  188.       with_items:

  189.         - matrix_synapse_container_image_customizations_templates_git_repository_keyscan_hostname

  190. 

  191. - name: Fail if known Synapse password provider modules are enabled when auth is delegated to Matrix Authentication Service

  192.   ansible.builtin.fail:

  193.     msg: "When Synapse is delegating authentication to Matrix Authentication Service (`matrix_synapse_matrix_authentication_service_enabled: true`), it does not make sense to enable password provider modules, because it is not Synapse that is handling authentication. Please disable {{ item }} before enabling Matrix Authentication Service integration for Synapse. Synapse will refuse to start otherwise."

  194.   when: matrix_synapse_matrix_authentication_service_enabled and lookup('vars', item, default='') | bool

  195.   with_items:

  196.     - matrix_synapse_ext_password_provider_rest_auth_enabled

  197.     - matrix_synapse_ext_password_provider_shared_secret_auth_enabled

  198.     - matrix_synapse_ext_password_provider_ldap_enabled

  199. 

  200. - name: Fail if password config is enabled for Synapse when auth is delegated to Matrix Authentication Service

  201.   ansible.builtin.fail:

  202.     msg: "When Synapse is delegating authentication to Matrix Authentication Service (`matrix_synapse_matrix_authentication_service_enabled: true`), it doesn't make sense to enable the password config (`matrix_synapse_password_config_enabled: true`), because it is not Synapse that is handling authentication. Please remove your `matrix_synapse_password_config_enabled: true` setting before enabling Matrix Authentication Service integration for Synapse. Synapse will refuse to start otherwise."

  203.   when: matrix_synapse_matrix_authentication_service_enabled and matrix_synapse_password_config_enabled

  204. 

  205. - name: Fail if registration is enabled for Synapse when auth is delegated to Matrix Authentication Service

  206.   ansible.builtin.fail:

  207.     msg: "When Synapse is delegating authentication to Matrix Authentication Service (`matrix_synapse_matrix_authentication_service_enabled: true`), it doesn't make sense to enable registration (`matrix_synapse_enable_registration: true`), because it is not Synapse that is handling authentication. Synapse will refuse to start otherwise."

  208.   when: matrix_synapse_matrix_authentication_service_enabled and matrix_synapse_enable_registration

  209. 

  210. - name: Fail if registration CAPTCHA is enabled for Synapse when auth is delegated to Matrix Authentication Service

  211.   ansible.builtin.fail:

  212.     msg: "When Synapse is delegating authentication to Matrix Authentication Service (`matrix_synapse_matrix_authentication_service_enabled: true`), it doesn't make sense to enable registration CAPTCHA (`matrix_synapse_enable_registration_captcha: true`), because it is not Synapse that is handling authentication. Synapse will refuse to start otherwise."

  213.   when: matrix_synapse_matrix_authentication_service_enabled and matrix_synapse_enable_registration_captcha

  214. 

  215. - name: Fail if OpenID Connect is enabled for Synapse when auth is delegated to Matrix Authentication Service

  216.   ansible.builtin.fail:

  217.     msg: "When Synapse is delegating authentication to Matrix Authentication Service (`matrix_synapse_matrix_authentication_service_enabled: true`), it doesn't make sense to enable OpenID Connect (`matrix_synapse_oidc_enabled: true`), because it is not Synapse that is handling authentication. Synapse will refuse to start otherwise."

  218.   when: matrix_synapse_matrix_authentication_service_enabled and matrix_synapse_oidc_enabled and not matrix_authentication_service_migration_in_progress

  219. 

  220. - name: Fail if CAS config is enabled for Synapse when auth is delegated to Matrix Authentication Service

  221.   ansible.builtin.fail:

  222.     msg: "When Synapse is delegating authentication to Matrix Authentication Service (`matrix_synapse_matrix_authentication_service_enabled: true`), it doesn't make sense to enable CAS config (`matrix_synapse_cas_config_enabled: true`), because it is not Synapse that is handling authentication. Synapse will refuse to start otherwise."

  223.   when: matrix_synapse_matrix_authentication_service_enabled and matrix_synapse_cas_config_enabled

  224. 

  225. - name: Fail if QR code login (MSC4108) is enabled while Matrix Authentication Service is not

  226.   ansible.builtin.fail:

  227.     msg: "When Synapse QR code login is enabled (MSC4108 via `matrix_synapse_experimental_features_msc4108_enabled`), Matrix Authentication Service integration (`matrix_synapse_matrix_authentication_service_enabled`) must also be enabled."

  228.   when: matrix_synapse_experimental_features_msc4108_enabled and not matrix_synapse_matrix_authentication_service_enabled