overmind
/
matrix-docker-ansible-deploy
ミラー元 https://github.com/spantaleev/matrix-docker-ansible-deploy
1
0
フォーク 0
コード 課題 0 リリース 0 Wiki アクティビティ
Matrix Docker Ansible eploy
選択できるのは25トピックまでです。 トピックは、先頭が英数字で、英数字とダッシュ('-')を使用した35文字以内のものにしてください。
10303 コミット
13 ブランチ
14 GiB
 
 
ブランチ: stabilize-mas
ブランチ タグ
${ item.name }
ブランチ ${ searchTerm } を作成
'stabilize-mas' から
${ noResults }
matrix-docker-ansible-deploy/roles/custom/matrix-synapse-reverse-prox.../templates/nginx/conf.d/matrix-synapse-reverse-prox...

335 行
17 KiB
Raw パーマリンク Blame 履歴 

  1. #jinja2: lstrip_blocks: True

  2. 

  3. {% set room_workers = matrix_synapse_reverse_proxy_companion_synapse_workers_list | selectattr('type', 'equalto', 'room_worker') | list %}

  4. {% set sync_workers = matrix_synapse_reverse_proxy_companion_synapse_workers_list | selectattr('type', 'equalto', 'sync_worker') | list %}

  5. {% set client_reader_workers = matrix_synapse_reverse_proxy_companion_synapse_workers_list | selectattr('type', 'equalto', 'client_reader') | list %}

  6. {% set federation_reader_workers = matrix_synapse_reverse_proxy_companion_synapse_workers_list | selectattr('type', 'equalto', 'federation_reader') | list %}

  7. {% set generic_workers = matrix_synapse_reverse_proxy_companion_synapse_workers_list | selectattr('type', 'equalto', 'generic_worker') | list %}

  8. {% set stream_writer_typing_stream_workers = matrix_synapse_reverse_proxy_companion_synapse_workers_list | selectattr('type', 'equalto', 'stream_writer') | selectattr('stream_writer_stream', 'equalto', 'typing') | list %}

  9. {% set stream_writer_to_device_stream_workers = matrix_synapse_reverse_proxy_companion_synapse_workers_list | selectattr('type', 'equalto', 'stream_writer') | selectattr('stream_writer_stream', 'equalto', 'to_device') | list %}

  10. {% set stream_writer_account_data_stream_workers = matrix_synapse_reverse_proxy_companion_synapse_workers_list | selectattr('type', 'equalto', 'stream_writer') | selectattr('stream_writer_stream', 'equalto', 'account_data') | list %}

  11. {% set stream_writer_receipts_stream_workers = matrix_synapse_reverse_proxy_companion_synapse_workers_list | selectattr('type', 'equalto', 'stream_writer') | selectattr('stream_writer_stream', 'equalto', 'receipts') | list %}

  12. {% set stream_writer_presence_stream_workers = matrix_synapse_reverse_proxy_companion_synapse_workers_list | selectattr('type', 'equalto', 'stream_writer') | selectattr('stream_writer_stream', 'equalto', 'presence') | list %}

  13. {% set media_repository_workers = matrix_synapse_reverse_proxy_companion_synapse_workers_list | selectattr('type', 'equalto', 'media_repository') | list %}

  14. {% set user_dir_workers = matrix_synapse_reverse_proxy_companion_synapse_workers_list | selectattr('type', 'equalto', 'user_dir') | list %}

  15. 

  16. {% macro render_worker_upstream(name, workers, load_balance) %}

  17. 	upstream {{ name }} {

  18. 		{#

  19. 			We need to use a zone so that the upstream is stored in shared memory,

  20. 			otherwise we can't use `resolve` below, as reported by nginx:

  21. 			> resolving names at run time requires upstream ".." in ... to be in shared memory

  22. 		#}

  23. 		zone {{ name }} 64k;

  24. 

  25. 		{{ load_balance }}

  26. 		keepalive {{ ((workers | length) * 2) | string }};

  27. 		resolver {{ matrix_synapse_reverse_proxy_companion_http_level_resolver }} valid=5s;

  28. 		{% for worker in workers %}

  29. 			server "{{ worker.name }}:{{ worker.port }}" resolve;

  30. 		{% endfor %}

  31. 	}

  32. {% endmacro %}

  33. 

  34. {% macro render_locations_to_upstream(locations, upstream_name) %}

  35. 	{% for location in locations %}

  36. 	location ~ {{ location }} {

  37. 		proxy_pass http://{{ upstream_name }}$request_uri;

  38. 		proxy_http_version 1.1;

  39. 		proxy_set_header Connection "";

  40. 	}

  41. 	{% endfor %}

  42. {% endmacro %}

  43. 

  44. {% if matrix_synapse_reverse_proxy_companion_synapse_workers_enabled %}

  45. 

  46. # Maps from https://tcpipuk.github.io/synapse/deployment/nginx.html#mapsconf

  47. # Client username from access token

  48. map $arg_access_token $accesstoken_from_urlparam {

  49.   default                    $arg_access_token;

  50.   "~syt_(?<username>.*?)_.*" $username;

  51. }

  52. # Client username from MXID

  53. map $http_authorization $mxid_localpart {

  54.   default                           $http_authorization;

  55.   "~Bearer syt_(?<username>.*?)_.*" $username;

  56.   ""                                $accesstoken_from_urlparam;

  57. }

  58. # Whether to upgrade HTTP connection

  59. map $http_upgrade $connection_upgrade {

  60.   default upgrade;

  61.   '' close;

  62. }

  63. #Extract room name from URI

  64. map $request_uri $room_name {

  65.   ~^/_matrix/(client|federation)/.*?(?:%21|!)(?<room>[A-Za-z0-9._=\-\/]+)(?::|%3A)[A-Za-z0-9._=\-\/]+ $room;

  66. }

  67. # End maps

  68. 

  69. 	{% if matrix_synapse_reverse_proxy_companion_synapse_cache_enabled %}

  70.     	proxy_cache_path  {{ matrix_synapse_reverse_proxy_companion_synapse_cache_path }} levels=1:2 keys_zone={{ matrix_synapse_reverse_proxy_companion_synapse_cache_keys_zone_name }}:{{ matrix_synapse_reverse_proxy_companion_synapse_cache_keys_zone_size }} inactive={{ matrix_synapse_reverse_proxy_companion_synapse_cache_inactive_time }} max_size={{ matrix_synapse_reverse_proxy_companion_synapse_cache_max_size_mb }}m;

  71. 	{% endif %}

  72. 	# Round Robin "upstream" pools for workers

  73. 

  74. 	{% if room_workers | length > 0 %}

  75. 	{{- render_worker_upstream('room_workers_upstream', room_workers, 'hash $room_name consistent;') }}

  76. 	{% endif %}

  77. 

  78. 	{% if sync_workers | length > 0 %}

  79. 	{{- render_worker_upstream('sync_workers_upstream', sync_workers, 'hash $mxid_localpart consistent;') }}

  80. 	{% endif %}

  81. 

  82. 	{% if client_reader_workers | length > 0 %}

  83. 	{{- render_worker_upstream('client_reader_workers_upstream', client_reader_workers, 'least_conn;') }}

  84. 	{% endif %}

  85. 

  86. 	{% if federation_reader_workers | length > 0 %}

  87. 	{{- render_worker_upstream('federation_reader_workers_upstream', federation_reader_workers, 'hash $http_x_forwarded_for;') }}

  88. 	{% endif %}

  89. 

  90. 	{% if generic_workers | length > 0 %}

  91. 	{{- render_worker_upstream('generic_workers_upstream', generic_workers, 'hash $http_x_forwarded_for;') }}

  92. 	{% endif %}

  93. 

  94. 	{% if stream_writer_typing_stream_workers | length > 0 %}

  95. 	{{- render_worker_upstream('stream_writer_typing_stream_workers_upstream', stream_writer_typing_stream_workers, '') }}

  96. 	{% endif %}

  97. 

  98. 	{% if stream_writer_to_device_stream_workers | length > 0 %}

  99. 	{{- render_worker_upstream('stream_writer_to_device_stream_workers_upstream', stream_writer_to_device_stream_workers, '') }}

  100. 	{% endif %}

  101. 

  102. 	{% if stream_writer_account_data_stream_workers | length > 0 %}

  103. 	{{- render_worker_upstream('stream_writer_account_data_stream_workers_upstream', stream_writer_account_data_stream_workers, '') }}

  104. 	{% endif %}

  105. 

  106. 	{% if stream_writer_receipts_stream_workers | length > 0 %}

  107. 	{{- render_worker_upstream('stream_writer_receipts_stream_workers_upstream', stream_writer_receipts_stream_workers, '') }}

  108. 	{% endif %}

  109. 

  110. 	{% if stream_writer_presence_stream_workers | length > 0 %}

  111. 	{{- render_worker_upstream('stream_writer_presence_stream_workers_upstream', stream_writer_presence_stream_workers, '') }}

  112. 	{% endif %}

  113. 

  114. 	{% if media_repository_workers | length > 0 %}

  115. 	{{- render_worker_upstream('media_repository_workers_upstream', media_repository_workers, 'least_conn;') }}

  116. 	{% endif %}

  117. 

  118. 	{% if user_dir_workers | length > 0 %}

  119. 	{{- render_worker_upstream('user_dir_workers_upstream', user_dir_workers, '') }}

  120. 	{% endif %}

  121. {% endif %}

  122. 

  123. server {

  124. 	listen 8008;

  125. 	server_name {{ matrix_synapse_reverse_proxy_companion_hostname }};

  126. 

  127. 	server_tokens off;

  128. 	root /dev/null;

  129. 

  130. 	client_max_body_size {{ matrix_synapse_reverse_proxy_companion_client_api_client_max_body_size_mb }}M;

  131. 	client_body_buffer_size {{ matrix_synapse_reverse_proxy_companion_client_api_client_body_buffer_size_mb }}M;

  132. 

  133. 	proxy_buffering on;

  134. 	proxy_max_temp_file_size 0;

  135. 	proxy_set_header Host $host;

  136. 

  137. 	{% if matrix_synapse_reverse_proxy_companion_synapse_workers_enabled %}

  138. 		# Client-server overrides — These locations must go to the main Synapse process

  139. 		location ~ {{ matrix_synapse_reverse_proxy_companion_client_server_main_override_locations_regex }} {

  140. 			{# FIXME: This block was copied from the main Synapse fallback below.  It would be better to have it in one place and avoid duplication. #}

  141. 			{# Use the embedded DNS resolver in Docker containers to discover the service #}

  142. 			resolver {{ matrix_synapse_reverse_proxy_companion_http_level_resolver }} valid=5s;

  143. 			set $backend "{{ matrix_synapse_reverse_proxy_companion_client_api_addr }}";

  144. 			proxy_pass http://$backend;

  145. 		}

  146. 

  147. 		# Client-server SSO overrides — These locations must go to the main Synapse process

  148. 		location ~ {{ matrix_synapse_reverse_proxy_companion_client_server_sso_override_locations_regex }} {

  149. 			{# FIXME: This block was copied from the main Synapse fallback below.  It would be better to have it in one place and avoid duplication. #}

  150. 			{# Use the embedded DNS resolver in Docker containers to discover the service #}

  151. 			resolver {{ matrix_synapse_reverse_proxy_companion_http_level_resolver }} valid=5s;

  152. 			set $backend "{{ matrix_synapse_reverse_proxy_companion_client_api_addr }}";

  153. 			proxy_pass http://$backend;

  154. 		}

  155. 

  156. 		# QR code login (`rendezvous`) locations need to go to the same Synapse process.

  157. 		# It doesn't necessarily need to be the main process, but it needs to be consistent.

  158. 		# For simplicity, we'll send them to the main process though.

  159. 		location ~ {{ matrix_synapse_reverse_proxy_companion_client_server_qr_code_login_locations_regex }} {

  160. 			{# FIXME: This block was copied from the main Synapse fallback below.  It would be better to have it in one place and avoid duplication. #}

  161. 			{# Use the embedded DNS resolver in Docker containers to discover the service #}

  162. 			resolver {{ matrix_synapse_reverse_proxy_companion_http_level_resolver }} valid=5s;

  163. 			set $backend "{{ matrix_synapse_reverse_proxy_companion_client_api_addr }}";

  164. 			proxy_pass http://$backend;

  165. 		}

  166. 

  167. 		{# Workers redirects BEGIN #}

  168. 

  169. 		{% if generic_workers | length > 0 %}

  170. 			# https://matrix-org.github.io/synapse/latest/workers.html#synapseappgeneric_worker

  171. 			{{ render_locations_to_upstream(matrix_synapse_reverse_proxy_companion_synapse_generic_worker_client_server_locations, 'generic_workers_upstream') }}

  172. 		{% endif %}

  173. 

  174. 		{% if stream_writer_typing_stream_workers | length > 0 %}

  175. 			# https://matrix-org.github.io/synapse/latest/workers.html#the-typing-stream

  176. 			{{ render_locations_to_upstream(matrix_synapse_reverse_proxy_companion_synapse_stream_writer_typing_stream_worker_client_server_locations, 'stream_writer_typing_stream_workers_upstream') }}

  177. 		{% endif %}

  178. 

  179. 		{% if stream_writer_to_device_stream_workers | length > 0 %}

  180. 			# https://matrix-org.github.io/synapse/latest/workers.html#the-to_device-stream

  181. 			{{ render_locations_to_upstream(matrix_synapse_reverse_proxy_companion_synapse_stream_writer_to_device_stream_worker_client_server_locations, 'stream_writer_to_device_stream_workers_upstream') }}

  182. 		{% endif %}

  183. 

  184. 		{% if stream_writer_account_data_stream_workers | length > 0 %}

  185. 			# https://matrix-org.github.io/synapse/latest/workers.html#the-account_data-stream

  186. 			{{ render_locations_to_upstream(matrix_synapse_reverse_proxy_companion_synapse_stream_writer_account_data_stream_worker_client_server_locations, 'stream_writer_account_data_stream_workers_upstream') }}

  187. 		{% endif %}

  188. 

  189. 		{% if stream_writer_receipts_stream_workers | length > 0 %}

  190. 			# https://matrix-org.github.io/synapse/latest/workers.html#the-receipts-stream

  191. 			{{ render_locations_to_upstream(matrix_synapse_reverse_proxy_companion_synapse_stream_writer_receipts_stream_worker_client_server_locations, 'stream_writer_receipts_stream_workers_upstream') }}

  192. 		{% endif %}

  193. 

  194. 		{% if stream_writer_presence_stream_workers | length > 0 %}

  195. 			# https://matrix-org.github.io/synapse/latest/workers.html#the-presence-stream

  196. 			{{ render_locations_to_upstream(matrix_synapse_reverse_proxy_companion_synapse_stream_writer_presence_stream_worker_client_server_locations, 'stream_writer_presence_stream_workers_upstream') }}

  197. 		{% endif %}

  198. 

  199. 		{% if room_workers | length > 0 %}

  200. 			# room workers

  201. 			# https://tcpipuk.github.io/synapse/deployment/workers.html

  202. 			# https://tcpipuk.github.io/synapse/deployment/nginx.html#locationsconf

  203. 			{{ render_locations_to_upstream(matrix_synapse_reverse_proxy_companion_synapse_room_worker_client_server_locations, 'room_workers_upstream') }}

  204. 		{% endif %}

  205. 

  206. 		{% if sync_workers | length > 0 %}

  207. 			# sync workers

  208. 			# https://tcpipuk.github.io/synapse/deployment/workers.html

  209. 			# https://tcpipuk.github.io/synapse/deployment/nginx.html#locationsconf

  210. 			{{ render_locations_to_upstream(matrix_synapse_reverse_proxy_companion_synapse_sync_worker_client_server_locations, 'sync_workers_upstream') }}

  211. 		{% endif %}

  212. 

  213. 		{% if client_reader_workers | length > 0 %}

  214. 			# client_reader workers

  215. 			# https://tcpipuk.github.io/synapse/deployment/workers.html

  216. 			# https://tcpipuk.github.io/synapse/deployment/nginx.html#locationsconf

  217. 			{{ render_locations_to_upstream(matrix_synapse_reverse_proxy_companion_synapse_client_reader_client_server_locations, 'client_reader_workers_upstream') }}

  218. 		{% endif %}

  219. 

  220. 		{% if media_repository_workers | length > 0 %}

  221. 			# https://matrix-org.github.io/synapse/latest/workers.html#synapseappmedia_repository

  222. 			{% for location in matrix_synapse_reverse_proxy_companion_synapse_media_repository_locations %}

  223. 			location ~ {{ location }} {

  224. 				proxy_pass http://media_repository_workers_upstream$request_uri;

  225. 

  226. 				{% if matrix_synapse_reverse_proxy_companion_synapse_cache_enabled %}

  227. 					proxy_cache            {{ matrix_synapse_reverse_proxy_companion_synapse_cache_keys_zone_name }};

  228. 					proxy_cache_valid      any {{ matrix_synapse_reverse_proxy_companion_synapse_cache_proxy_cache_valid_time }};

  229. 					proxy_force_ranges on;

  230. 					add_header X-Cache-Status $upstream_cache_status;

  231. 				{% endif %}

  232. 			}

  233. 			{% endfor %}

  234. 		{% endif %}

  235. 

  236. 		{% if user_dir_workers | length > 0 %}

  237. 			# https://matrix-org.github.io/synapse/latest/workers.html#updating-the-user-directory

  238. 			{{ render_locations_to_upstream(matrix_synapse_reverse_proxy_companion_synapse_user_dir_locations, 'user_dir_workers_upstream') }}

  239. 		{% endif %}

  240. 		{# Workers redirects END #}

  241. 	{% endif %}

  242. 

  243. 	{% for configuration_block in matrix_synapse_reverse_proxy_companion_synapse_client_api_additional_server_configuration_blocks %}

  244. 		{{- configuration_block }}

  245. 	{% endfor %}

  246. 

  247. 	{# Everything else just goes to the API server ##}

  248. 	location / {

  249. 		{# Use the embedded DNS resolver in Docker containers to discover the service #}

  250. 		resolver {{ matrix_synapse_reverse_proxy_companion_http_level_resolver }} valid=5s;

  251. 		set $backend "{{ matrix_synapse_reverse_proxy_companion_client_api_addr }}";

  252. 		proxy_pass http://$backend;

  253. 	}

  254. }

  255. 

  256. {% if matrix_synapse_reverse_proxy_companion_federation_api_enabled %}

  257. server {

  258. 	listen 8048;

  259. 	server_name {{ matrix_synapse_reverse_proxy_companion_hostname }};

  260. 

  261. 	server_tokens off;

  262. 	root /dev/null;

  263. 

  264. 	client_max_body_size {{ matrix_synapse_reverse_proxy_companion_federation_api_client_max_body_size_mb }}M;

  265. 	client_body_buffer_size {{ matrix_synapse_reverse_proxy_companion_federation_api_client_body_buffer_size_mb }}M;

  266. 

  267. 	proxy_buffering on;

  268. 	proxy_max_temp_file_size 0;

  269. 	proxy_set_header Host $host;

  270. 

  271. 	{% if matrix_synapse_reverse_proxy_companion_synapse_workers_enabled %}

  272. 		# Federation overrides — These locations must go to the main Synapse process

  273. 		location ~ {{ matrix_synapse_reverse_proxy_companion_federation_override_locations_regex }} {

  274. 			{# FIXME: This block was copied from the fallback location below.  It would be better to have it in one place and avoid duplication. #}

  275. 			{# Use the embedded DNS resolver in Docker containers to discover the service #}

  276. 			resolver {{ matrix_synapse_reverse_proxy_companion_http_level_resolver }} valid=5s;

  277. 			set $backend "{{ matrix_synapse_reverse_proxy_companion_federation_api_addr }}";

  278. 			proxy_pass http://$backend;

  279. 		}

  280. 

  281. 		{% if room_workers | length > 0 %}

  282. 			# https://tcpipuk.github.io/synapse/deployment/workers.html

  283. 			{{ render_locations_to_upstream(matrix_synapse_reverse_proxy_companion_synapse_room_worker_federation_locations, 'room_workers_upstream') }}

  284. 		{% endif %}

  285. 

  286. 		{% if generic_workers | length > 0 %}

  287. 			# https://matrix-org.github.io/synapse/latest/workers.html#synapseappgeneric_worker

  288. 			{{ render_locations_to_upstream(matrix_synapse_reverse_proxy_companion_synapse_generic_worker_federation_locations, 'generic_workers_upstream') }}

  289. 		{% endif %}

  290. 

  291. 		{% if media_repository_workers | length > 0 %}

  292. 			# https://matrix-org.github.io/synapse/latest/workers.html#synapseappmedia_repository

  293. 			{% for location in matrix_synapse_reverse_proxy_companion_synapse_media_repository_locations %}

  294. 			location ~ {{ location }} {

  295. 				proxy_pass http://media_repository_workers_upstream$request_uri;

  296. 

  297. 				{% if matrix_synapse_reverse_proxy_companion_synapse_cache_enabled %}

  298. 					proxy_buffering        on;

  299. 					proxy_cache            {{ matrix_synapse_reverse_proxy_companion_synapse_cache_keys_zone_name }};

  300. 					proxy_cache_valid      any  {{ matrix_synapse_reverse_proxy_companion_synapse_cache_proxy_cache_valid_time }};

  301. 					proxy_force_ranges on;

  302. 					add_header X-Cache-Status $upstream_cache_status;

  303. 				{% endif %}

  304. 			}

  305. 			{% endfor %}

  306. 		{% endif %}

  307. 

  308. 		{#

  309. 			This is last, because we'd like more-specific requests (e.g. `/_matrix/federation/v1/media/` that may be handled by a media repository worker, if enabled)

  310. 			to be routed to more specialized workers via their respective `locations` defined earlier (above).

  311. 

  312. 			As https://nginx.org/en/docs/http/ngx_http_core_module.html#location says about location matching:

  313. 			> .. Then regular expressions are checked, in the order of their appearance in the configuration file.

  314. 

  315. 			See: https://github.com/spantaleev/matrix-docker-ansible-deploy/issues/3918

  316. 		#}

  317. 		{% if federation_reader_workers | length > 0 %}

  318. 			# https://tcpipuk.github.io/synapse/deployment/workers.html

  319. 			{{ render_locations_to_upstream(matrix_synapse_reverse_proxy_companion_synapse_federation_reader_federation_locations, 'federation_reader_workers_upstream') }}

  320. 		{% endif %}

  321. 	{% endif %}

  322. 

  323. 	{% for configuration_block in matrix_synapse_reverse_proxy_companion_synapse_federation_api_additional_server_configuration_blocks %}

  324. 		{{- configuration_block }}

  325. 	{% endfor %}

  326. 

  327. 	location / {

  328. 		{# Use the embedded DNS resolver in Docker containers to discover the service #}

  329. 		resolver {{ matrix_synapse_reverse_proxy_companion_http_level_resolver }} valid=5s;

  330. 		set $backend "{{ matrix_synapse_reverse_proxy_companion_federation_api_addr }}";

  331. 		proxy_pass http://$backend;

  332. 	}

  333. }

  334. {% endif %}