overmind
/
matrix-docker-ansible-deploy
espelhamento de https://github.com/spantaleev/matrix-docker-ansible-deploy
1
0
Fork 0
Código Issues 0 Versões 0 Wiki Atividade
Matrix Docker Ansible eploy
Você não pode selecionar mais de 25 tópicos Os tópicos devem começar com uma letra ou um número, podem incluir traços ('-') e podem ter até 35 caracteres.
10937 Commits
13 Branches
36 MiB
 
 
Tag: 63b6bf4bc1
Branches Tags
${ item.name }
Criar branch ${ searchTerm }
de 63b6bf4bc1
${ noResults }
matrix-docker-ansible-deploy/roles/custom/matrix-synapse-reverse-prox.../defaults/main.yml

374 linhas
31 KiB
Original Anotar Histórico 

  1. # SPDX-FileCopyrightText: 2022 - 2024 Slavi Pantaleev

  2. # SPDX-FileCopyrightText: 2023 - 2024 Nikita Chernyi

  3. # SPDX-FileCopyrightText: 2023 Dan Arnfield

  4. # SPDX-FileCopyrightText: 2023 Samuel Meenzen

  5. # SPDX-FileCopyrightText: 2024 Charles Wright

  6. # SPDX-FileCopyrightText: 2024 David Mehren

  7. # SPDX-FileCopyrightText: 2024 Michael Hollister

  8. # SPDX-FileCopyrightText: 2024 - 2025 Catalan Lover <catalanlover@protonmail.com>

  9. #

  10. # SPDX-License-Identifier: AGPL-3.0-or-later

  11. 

  12. ---

  13. 

  14. # matrix-synapse-reverse-proxy-companion is a role which brings up a containerized nginx webserver which helps with reverse-proxying to Synapse when workers are enabled.

  15. #

  16. # When Synapse is NOT running in worker-mode, reverse-proxying is relatively simple (everything goes to `matrix-synapse:XXXX`).

  17. # In such cases, using this reverse-proxy companion is possible, but unnecessary - it's one more service in the stack, which also impacts performance a bit.

  18. #

  19. # When Synapse workers are enabled, however, the reverse-proxying configuration is much more complicated - certain requests need to go to certain workers, etc.

  20. # matrix-synapse-reverse-proxy-companion is the central place services that need to reach Synapse could be pointed to.

  21. #

  22. # Project source code URL: https://github.com/nginx/nginx

  23. 

  24. matrix_synapse_reverse_proxy_companion_enabled: true

  25. 

  26. # renovate: datasource=docker depName=nginx

  27. matrix_synapse_reverse_proxy_companion_version: 1.29.5-alpine

  28. 

  29. matrix_synapse_reverse_proxy_companion_base_path: "{{ matrix_synapse_base_path }}/reverse-proxy-companion"

  30. matrix_synapse_reverse_proxy_companion_confd_path: "{{ matrix_synapse_reverse_proxy_companion_base_path }}/conf.d"

  31. matrix_synapse_reverse_proxy_companion_njs_path: "{{ matrix_synapse_reverse_proxy_companion_base_path }}/njs"

  32. 

  33. # List of systemd services that matrix-synapse-reverse-proxy-companion.service depends on

  34. matrix_synapse_reverse_proxy_companion_systemd_required_services_list: "{{ matrix_synapse_reverse_proxy_companion_systemd_required_services_list_default + matrix_synapse_reverse_proxy_companion_systemd_required_services_list_auto + matrix_synapse_reverse_proxy_companion_systemd_required_services_list_custom }}"

  35. matrix_synapse_reverse_proxy_companion_systemd_required_services_list_default: "{{ [devture_systemd_docker_base_docker_service_name] if devture_systemd_docker_base_docker_service_name else [] }}"

  36. matrix_synapse_reverse_proxy_companion_systemd_required_services_list_auto: []

  37. matrix_synapse_reverse_proxy_companion_systemd_required_services_list_custom: []

  38. 

  39. # List of systemd services that matrix-synapse-reverse-proxy-companion.service wants

  40. matrix_synapse_reverse_proxy_companion_systemd_wanted_services_list: ['matrix-synapse.service']

  41. 

  42. # We use an official nginx image, which we fix-up to run unprivileged.

  43. # An alternative would be an `nginxinc/nginx-unprivileged` image, but

  44. # that is frequently out of date.

  45. matrix_synapse_reverse_proxy_companion_container_image: "{{ matrix_synapse_reverse_proxy_companion_container_image_registry_prefix }}nginx:{{ matrix_synapse_reverse_proxy_companion_container_image_tag }}"

  46. matrix_synapse_reverse_proxy_companion_container_image_registry_prefix: "{{ matrix_synapse_reverse_proxy_companion_container_image_registry_prefix_upstream }}"

  47. matrix_synapse_reverse_proxy_companion_container_image_registry_prefix_upstream: "{{ matrix_synapse_reverse_proxy_companion_container_image_registry_prefix_upstream_default }}"

  48. matrix_synapse_reverse_proxy_companion_container_image_registry_prefix_upstream_default: "docker.io/"

  49. matrix_synapse_reverse_proxy_companion_container_image_tag: "{{ matrix_synapse_reverse_proxy_companion_version }}"

  50. matrix_synapse_reverse_proxy_companion_container_image_force_pull: "{{ matrix_synapse_reverse_proxy_companion_container_image.endswith(':latest') }}"

  51. 

  52. matrix_synapse_reverse_proxy_companion_container_network: ""

  53. 

  54. # A list of additional container networks that matrix-synapse-reverse-proxy-companion would be connected to.

  55. # The playbook does not create these networks, so make sure they already exist.

  56. matrix_synapse_reverse_proxy_companion_container_additional_networks: "{{ matrix_synapse_reverse_proxy_companion_container_additional_networks_auto + matrix_synapse_reverse_proxy_companion_container_additional_networks_custom }}"

  57. matrix_synapse_reverse_proxy_companion_container_additional_networks_auto: []

  58. matrix_synapse_reverse_proxy_companion_container_additional_networks_custom: []

  59. 

  60. # Controls whether the matrix-synapse-reverse-proxy-companion container exposes its HTTP Client-Server API port (tcp/8008 in the container).

  61. #

  62. # Takes an "<ip>:<port>" or "<port>" value (e.g. "127.0.0.1:8008"), or empty string to not expose.

  63. matrix_synapse_reverse_proxy_companion_container_client_api_host_bind_port: ''

  64. 

  65. # Controls whether the matrix-synapse-reverse-proxy-companion container exposes its HTTP Federation (Server-Server) API port (tcp/8048 in the container).

  66. #

  67. # Takes an "<ip>:<port>" or "<port>" value (e.g. "127.0.0.1:8048"), or empty string to not expose.

  68. matrix_synapse_reverse_proxy_companion_container_federation_api_host_bind_port: ''

  69. 

  70. # matrix_synapse_reverse_proxy_companion_container_labels_traefik_enabled controls whether labels to assist a Traefik reverse-proxy will be attached to the container.

  71. # See `../templates/labels.j2` for details.

  72. #

  73. # To inject your own other container labels, see `matrix_synapse_reverse_proxy_companion_container_labels_additional_labels`.

  74. matrix_synapse_reverse_proxy_companion_container_labels_traefik_enabled: true

  75. matrix_synapse_reverse_proxy_companion_container_labels_traefik_docker_network: "{{ matrix_synapse_reverse_proxy_companion_container_network }}"

  76. matrix_synapse_reverse_proxy_companion_container_labels_traefik_entrypoints: web-secure

  77. matrix_synapse_reverse_proxy_companion_container_labels_traefik_tls_certResolver: default  # noqa var-naming

  78. matrix_synapse_reverse_proxy_companion_container_labels_traefik_hostname: ''

  79. 

  80. # Controls whether a compression middleware will be injected into the middlewares list.

  81. # This compression middleware is supposed to be defined elsewhere (using labels or a File provider, etc.) and is merely referenced by this router.

  82. matrix_synapse_reverse_proxy_companion_container_labels_traefik_compression_middleware_enabled: false

  83. matrix_synapse_reverse_proxy_companion_container_labels_traefik_compression_middleware_name: ""

  84. 

  85. # Controls whether labels will be added that expose the Client-Server API on a public Traefik entrypoint.

  86. matrix_synapse_reverse_proxy_companion_container_labels_public_client_api_enabled: true

  87. matrix_synapse_reverse_proxy_companion_container_labels_public_client_api_traefik_hostname: "{{ matrix_synapse_reverse_proxy_companion_container_labels_traefik_hostname }}"

  88. matrix_synapse_reverse_proxy_companion_container_labels_public_client_api_traefik_path_prefix: /_matrix

  89. matrix_synapse_reverse_proxy_companion_container_labels_public_client_api_traefik_rule: "Host(`{{ matrix_synapse_reverse_proxy_companion_container_labels_public_client_api_traefik_hostname }}`) && PathPrefix(`{{ matrix_synapse_reverse_proxy_companion_container_labels_public_client_api_traefik_path_prefix }}`)"

  90. matrix_synapse_reverse_proxy_companion_container_labels_public_client_api_traefik_priority: 0

  91. matrix_synapse_reverse_proxy_companion_container_labels_public_client_api_traefik_entrypoints: "{{ matrix_synapse_reverse_proxy_companion_container_labels_traefik_entrypoints }}"

  92. matrix_synapse_reverse_proxy_companion_container_labels_public_client_api_traefik_tls: "{{ matrix_synapse_reverse_proxy_companion_container_labels_public_client_api_traefik_entrypoints != 'web' }}"

  93. matrix_synapse_reverse_proxy_companion_container_labels_public_client_api_traefik_tls_certResolver: "{{ matrix_synapse_reverse_proxy_companion_container_labels_traefik_tls_certResolver }}"  # noqa var-naming

  94. 

  95. # Controls whether labels will be added that expose the Client-Server API on the internal Traefik entrypoint.

  96. # This is similar to `matrix_synapse_container_labels_public_client_api_enabled`, but the entrypoint and intent is different.

  97. matrix_synapse_reverse_proxy_companion_container_labels_internal_client_api_enabled: false

  98. matrix_synapse_reverse_proxy_companion_container_labels_internal_client_api_traefik_path_prefix: "{{ matrix_synapse_container_labels_public_client_api_traefik_path_prefix }}"

  99. matrix_synapse_reverse_proxy_companion_container_labels_internal_client_api_traefik_rule: "PathPrefix(`{{ matrix_synapse_reverse_proxy_companion_container_labels_internal_client_api_traefik_path_prefix }}`)"

  100. matrix_synapse_reverse_proxy_companion_container_labels_internal_client_api_traefik_priority: "{{ matrix_synapse_reverse_proxy_companion_container_labels_public_client_api_traefik_priority }}"

  101. matrix_synapse_reverse_proxy_companion_container_labels_internal_client_api_traefik_entrypoints: ""

  102. 

  103. # Controls whether labels will be added that expose the /_synapse/client paths

  104. matrix_synapse_reverse_proxy_companion_container_labels_public_client_synapse_client_api_enabled: true

  105. matrix_synapse_reverse_proxy_companion_container_labels_public_client_synapse_client_api_traefik_hostname: "{{ matrix_synapse_reverse_proxy_companion_container_labels_traefik_hostname }}"

  106. matrix_synapse_reverse_proxy_companion_container_labels_public_client_synapse_client_api_traefik_path_prefix: /_synapse/client

  107. matrix_synapse_reverse_proxy_companion_container_labels_public_client_synapse_client_api_traefik_rule: "Host(`{{ matrix_synapse_reverse_proxy_companion_container_labels_public_client_synapse_client_api_traefik_hostname }}`) && PathPrefix(`{{ matrix_synapse_reverse_proxy_companion_container_labels_public_client_synapse_client_api_traefik_path_prefix }}`)"

  108. matrix_synapse_reverse_proxy_companion_container_labels_public_client_synapse_client_api_traefik_priority: 0

  109. matrix_synapse_reverse_proxy_companion_container_labels_public_client_synapse_client_api_traefik_entrypoints: "{{ matrix_synapse_reverse_proxy_companion_container_labels_traefik_entrypoints }}"

  110. matrix_synapse_reverse_proxy_companion_container_labels_public_client_synapse_client_api_traefik_tls: "{{ matrix_synapse_reverse_proxy_companion_container_labels_public_client_synapse_client_api_traefik_entrypoints != 'web' }}"

  111. matrix_synapse_reverse_proxy_companion_container_labels_public_client_synapse_client_api_traefik_tls_certResolver: "{{ matrix_synapse_reverse_proxy_companion_container_labels_traefik_tls_certResolver }}"  # noqa var-naming

  112. 

  113. # Controls whether labels will be added that expose the /_synapse/admin paths

  114. # Following these recommendations (https://github.com/element-hq/synapse/blob/master/docs/reverse_proxy.md), by default, we don't.

  115. matrix_synapse_reverse_proxy_companion_container_labels_public_client_synapse_admin_api_enabled: false

  116. matrix_synapse_reverse_proxy_companion_container_labels_public_client_synapse_admin_api_traefik_hostname: "{{ matrix_synapse_reverse_proxy_companion_container_labels_traefik_hostname }}"

  117. matrix_synapse_reverse_proxy_companion_container_labels_public_client_synapse_admin_api_traefik_path_prefix: /_synapse/admin

  118. matrix_synapse_reverse_proxy_companion_container_labels_public_client_synapse_admin_api_traefik_rule: "Host(`{{ matrix_synapse_reverse_proxy_companion_container_labels_public_client_synapse_admin_api_traefik_hostname }}`) && PathPrefix(`{{ matrix_synapse_reverse_proxy_companion_container_labels_public_client_synapse_admin_api_traefik_path_prefix }}`)"

  119. matrix_synapse_reverse_proxy_companion_container_labels_public_client_synapse_admin_api_traefik_priority: 0

  120. matrix_synapse_reverse_proxy_companion_container_labels_public_client_synapse_admin_api_traefik_entrypoints: "{{ matrix_synapse_reverse_proxy_companion_container_labels_traefik_entrypoints }}"

  121. matrix_synapse_reverse_proxy_companion_container_labels_public_client_synapse_admin_api_traefik_tls: "{{ matrix_synapse_reverse_proxy_companion_container_labels_public_client_synapse_admin_api_traefik_entrypoints != 'web' }}"

  122. matrix_synapse_reverse_proxy_companion_container_labels_public_client_synapse_admin_api_traefik_tls_certResolver: "{{ matrix_synapse_reverse_proxy_companion_container_labels_traefik_tls_certResolver }}"  # noqa var-naming

  123. 

  124. # Controls whether labels will be added that expose the /_synapse/admin paths on the internal Traefik entrypoint.

  125. # This is similar to `matrix_synapse_container_labels_public_client_api_enabled`, but the entrypoint and intent is different.

  126. matrix_synapse_reverse_proxy_companion_container_labels_internal_client_synapse_admin_api_enabled: false

  127. matrix_synapse_reverse_proxy_companion_container_labels_internal_client_synapse_admin_api_traefik_path_prefix: "{{ matrix_synapse_container_labels_internal_client_synapse_admin_api_traefik_path_prefix }}"

  128. matrix_synapse_reverse_proxy_companion_container_labels_internal_client_synapse_admin_api_traefik_rule: "PathPrefix(`{{ matrix_synapse_reverse_proxy_companion_container_labels_internal_client_synapse_admin_api_traefik_path_prefix }}`)"

  129. matrix_synapse_reverse_proxy_companion_container_labels_internal_client_synapse_admin_api_traefik_priority: 0

  130. matrix_synapse_reverse_proxy_companion_container_labels_internal_client_synapse_admin_api_traefik_entrypoints: ""

  131. 

  132. # Controls whether labels will be added that expose the Server-Server API (Federation API).

  133. matrix_synapse_reverse_proxy_companion_container_labels_public_federation_api_enabled: "{{ matrix_synapse_reverse_proxy_companion_federation_api_enabled }}"

  134. matrix_synapse_reverse_proxy_companion_container_labels_public_federation_api_traefik_hostname: "{{ matrix_synapse_reverse_proxy_companion_container_labels_traefik_hostname }}"

  135. matrix_synapse_reverse_proxy_companion_container_labels_public_federation_api_traefik_path_prefix: /_matrix

  136. matrix_synapse_reverse_proxy_companion_container_labels_public_federation_api_traefik_rule: "Host(`{{ matrix_synapse_reverse_proxy_companion_container_labels_public_federation_api_traefik_hostname }}`) && PathPrefix(`{{ matrix_synapse_reverse_proxy_companion_container_labels_public_federation_api_traefik_path_prefix }}`)"

  137. matrix_synapse_reverse_proxy_companion_container_labels_public_federation_api_traefik_priority: 0

  138. matrix_synapse_reverse_proxy_companion_container_labels_public_federation_api_traefik_entrypoints: ''

  139. # TLS is force-enabled here, because the spec (https://spec.matrix.org/v1.9/server-server-api/#tls) says that the federation API must use HTTPS.

  140. matrix_synapse_reverse_proxy_companion_container_labels_public_federation_api_traefik_tls: true

  141. matrix_synapse_reverse_proxy_companion_container_labels_public_federation_api_traefik_tls_certResolver: "{{ matrix_synapse_reverse_proxy_companion_container_labels_traefik_tls_certResolver }}"  # noqa var-naming

  142. 

  143. # matrix_synapse_reverse_proxy_companion_container_labels_additional_labels contains a multiline string with additional labels to add to the container label file.

  144. # See `../templates/labels.j2` for details.

  145. #

  146. # Example:

  147. # matrix_synapse_reverse_proxy_companion_container_labels_additional_labels: |

  148. #   my.label=1

  149. #   another.label="here"

  150. matrix_synapse_reverse_proxy_companion_container_labels_additional_labels: ''

  151. 

  152. # A list of extra arguments to pass to the container

  153. # Also see `matrix_synapse_reverse_proxy_companion_container_arguments`

  154. matrix_synapse_reverse_proxy_companion_container_extra_arguments: []

  155. 

  156. # matrix_synapse_reverse_proxy_companion_container_extra_arguments_auto is a list of extra arguments to pass to the container.

  157. # This list is managed by the playbook. You're not meant to override this variable.

  158. # If you'd like to inject your own arguments, see `matrix_synapse_reverse_proxy_companion_container_extra_arguments`.

  159. matrix_synapse_reverse_proxy_companion_container_extra_arguments_auto: []

  160. 

  161. # matrix_synapse_reverse_proxy_companion_container_arguments holds the final list of extra arguments to pass to the container.

  162. # You're not meant to override this variable.

  163. # If you'd like to inject your own arguments, see `matrix_synapse_reverse_proxy_companion_container_extra_arguments`.

  164. matrix_synapse_reverse_proxy_companion_container_arguments: "{{ matrix_synapse_reverse_proxy_companion_container_extra_arguments + matrix_synapse_reverse_proxy_companion_container_extra_arguments_auto }}"

  165. 

  166. # The amount of worker processes and connections

  167. # Consider increasing these when you are expecting high amounts of traffic

  168. # http://nginx.org/en/docs/ngx_core_module.html#worker_connections

  169. matrix_synapse_reverse_proxy_companion_worker_processes: auto

  170. matrix_synapse_reverse_proxy_companion_worker_connections: 1024

  171. 

  172. # Option to disable the access log

  173. matrix_synapse_reverse_proxy_companion_access_log_enabled: true

  174. 

  175. # Controls whether to send access logs to a remote syslog-compatible server

  176. matrix_synapse_reverse_proxy_companion_access_log_syslog_integration_enabled: false

  177. matrix_synapse_reverse_proxy_companion_access_log_syslog_integration_server_port: ''

  178. # This is intentionally different. The maximum allowed length is 32 characters and dashes are not allowed.

  179. matrix_synapse_reverse_proxy_companion_access_log_syslog_integration_tag: matrix_synapse_rev_proxy_comp

  180. 

  181. # The tmpfs at /tmp needs to be large enough to handle multiple concurrent file uploads.

  182. matrix_synapse_reverse_proxy_companion_tmp_directory_size_mb: "{{ (matrix_synapse_reverse_proxy_companion_federation_api_client_max_body_size_mb | int) * 50 }}"

  183. matrix_synapse_reverse_proxy_companion_tmp_cache_directory_size_mb: "{{ (matrix_synapse_reverse_proxy_companion_synapse_cache_max_size_mb | int) * 2 }}"

  184. 

  185. # A list of strings containing additional configuration blocks to add to the nginx server configuration (nginx.conf).

  186. # for big matrixservers to enlarge the number of open files to prevent timeouts

  187. # matrix_synapse_reverse_proxy_companion_additional_configuration_blocks:

  188. #  - 'worker_rlimit_nofile 30000;'

  189. matrix_synapse_reverse_proxy_companion_additional_configuration_blocks: []

  190. 

  191. # A list of strings containing additional configuration blocks to add to the nginx event server configuration (nginx.conf).

  192. matrix_synapse_reverse_proxy_companion_event_additional_configuration_blocks: []

  193. 

  194. # A list of strings containing additional configuration blocks to add to the nginx http's server configuration (nginx-http.conf).

  195. matrix_synapse_reverse_proxy_companion_http_additional_server_configuration_blocks: []

  196. 

  197. # To increase request timeout in NGINX using proxy_read_timeout, proxy_connect_timeout, proxy_send_timeout, send_timeout directives

  198. # Nginx Default: proxy_connect_timeout 60s;   #Defines a timeout for establishing a connection with a proxied server

  199. # Nginx Default: proxy_send_timeout 60s;      #Sets a timeout for transmitting a request to the proxied server.

  200. # Nginx Default: proxy_read_timeout 60s;      #Defines a timeout for reading a response from the proxied server.

  201. # Nginx Default: send_timeout 60s;            #Sets a timeout for transmitting a response to the client.

  202. #

  203. # For more information visit:

  204. # http://nginx.org/en/docs/http/ngx_http_proxy_module.html

  205. # http://nginx.org/en/docs/http/ngx_http_core_module.html#send_timeout

  206. # https://www.nginx.com/resources/wiki/start/topics/examples/fullexample2/

  207. #

  208. # Here we are sticking with nginx default values change this value carefully.

  209. matrix_synapse_reverse_proxy_companion_proxy_connect_timeout: 60

  210. matrix_synapse_reverse_proxy_companion_proxy_send_timeout: 60

  211. matrix_synapse_reverse_proxy_companion_proxy_read_timeout: 60

  212. matrix_synapse_reverse_proxy_companion_send_timeout: 60

  213. 

  214. # For OCSP purposes, we need to define a resolver at the `server{}` level or `http{}` level (we do the latter).

  215. #

  216. # Otherwise, we get warnings like this:

  217. # > [warn] 22#22: no resolver defined to resolve r3.o.lencr.org while requesting certificate status, responder: r3.o.lencr.org, certificate: "/matrix/ssl/config/live/…/fullchain.pem"

  218. #

  219. # We point it to the internal Docker resolver, which likely delegates to nameservers defined in `/etc/resolv.conf`.

  220. matrix_synapse_reverse_proxy_companion_http_level_resolver: 127.0.0.11

  221. 

  222. matrix_synapse_reverse_proxy_companion_hostname: "matrix-synapse-reverse-proxy-companion"

  223. 

  224. # matrix_synapse_reverse_proxy_companion_client_api_addr specifies the address where the Client-Server API is

  225. matrix_synapse_reverse_proxy_companion_client_api_addr: 'matrix-synapse:{{ matrix_synapse_container_client_api_port }}'

  226. 

  227. # The maximum body size for client requests to any of the endpoints on the Client-Server API.

  228. # This needs to be equal or higher than the maximum upload size accepted by Synapse.

  229. matrix_synapse_reverse_proxy_companion_client_api_client_max_body_size_mb: 100

  230. 

  231. # The buffer size for client requests to any of the endpoints on the Client-Server API.

  232. matrix_synapse_reverse_proxy_companion_client_api_client_body_buffer_size_mb: "{{ matrix_synapse_reverse_proxy_companion_client_api_client_max_body_size_mb }}"

  233. 

  234. # matrix_synapse_reverse_proxy_companion_federation_api_enabled specifies whether reverse proxying for the Federation (Server-Server) API should be done

  235. matrix_synapse_reverse_proxy_companion_federation_api_enabled: true

  236. # matrix_synapse_reverse_proxy_companion_federation_api_addr specifies the address where the Federation (Server-Server) API is

  237. matrix_synapse_reverse_proxy_companion_federation_api_addr: 'matrix-synapse:{{ matrix_synapse_container_federation_api_plain_port }}'

  238. 

  239. # The maximum body size for client requests to any of the endpoints on the Federation API.

  240. # We auto-calculate this based on the Client-Server API's maximum body size, but use a minimum value to ensure we don't go to low.

  241. matrix_synapse_reverse_proxy_companion_federation_api_client_max_body_size_mb: "{{ [matrix_synapse_reverse_proxy_companion_federation_api_client_max_body_size_mb_minimum, (matrix_synapse_reverse_proxy_companion_client_api_client_max_body_size_mb | int) * 3] | max }}"

  242. matrix_synapse_reverse_proxy_companion_federation_api_client_max_body_size_mb_minimum: 100

  243. 

  244. # The buffer size for client requests to any of the endpoints on the Federation API.

  245. matrix_synapse_reverse_proxy_companion_federation_api_client_body_buffer_size_mb: "{{ matrix_synapse_reverse_proxy_companion_federation_api_client_max_body_size_mb }}"

  246. 

  247. # A list of strings containing additional configuration blocks to add to the nginx vhost handling the Synapse Client-Server API

  248. matrix_synapse_reverse_proxy_companion_synapse_client_api_additional_server_configuration_blocks: []

  249. 

  250. # A list of strings containing additional configuration blocks to add to the nginx vhost handling the Synapse Federation (Server-Server) API

  251. matrix_synapse_reverse_proxy_companion_synapse_federation_api_additional_server_configuration_blocks: []

  252. 

  253. 

  254. # synapse worker activation and endpoint mappings.

  255. # These are all populated via Ansible group variables.

  256. matrix_synapse_reverse_proxy_companion_synapse_workers_enabled: false

  257. matrix_synapse_reverse_proxy_companion_synapse_workers_list: []

  258. matrix_synapse_reverse_proxy_companion_synapse_room_worker_client_server_locations: []

  259. matrix_synapse_reverse_proxy_companion_synapse_room_worker_federation_locations: []

  260. matrix_synapse_reverse_proxy_companion_synapse_sync_worker_client_server_locations: []

  261. matrix_synapse_reverse_proxy_companion_synapse_client_reader_client_server_locations: []

  262. matrix_synapse_reverse_proxy_companion_synapse_federation_reader_federation_locations: []

  263. matrix_synapse_reverse_proxy_companion_synapse_generic_worker_client_server_locations: []

  264. matrix_synapse_reverse_proxy_companion_synapse_generic_worker_federation_locations: []

  265. matrix_synapse_reverse_proxy_companion_synapse_stream_writer_typing_stream_worker_client_server_locations: []

  266. matrix_synapse_reverse_proxy_companion_synapse_stream_writer_to_device_stream_worker_client_server_locations: []

  267. matrix_synapse_reverse_proxy_companion_synapse_stream_writer_account_data_stream_worker_client_server_locations: []

  268. matrix_synapse_reverse_proxy_companion_synapse_stream_writer_receipts_stream_worker_client_server_locations: []

  269. matrix_synapse_reverse_proxy_companion_synapse_stream_writer_presence_stream_worker_client_server_locations: []

  270. matrix_synapse_reverse_proxy_companion_synapse_media_repository_locations: []

  271. matrix_synapse_reverse_proxy_companion_synapse_user_dir_locations: []

  272. matrix_synapse_reverse_proxy_companion_client_server_main_override_locations_regex: ^/_matrix/client/(api/v1|r0|v3|unstable)/(account/3pid/|directory/list/room/|pushrules/|rooms/[^/]+/(forget|upgrade|report)|login/sso/redirect/|register)

  273. matrix_synapse_reverse_proxy_companion_client_server_sso_override_locations_regex: ^(/_matrix/client/(api/v1|r0|v3|unstable)/login/sso/redirect|/_synapse/client/(pick_username|(new_user_consent|oidc/callback|pick_idp|sso_register)$))

  274. # Related to MSC4108 (https://github.com/matrix-org/matrix-spec-proposals/pull/4108)

  275. matrix_synapse_reverse_proxy_companion_client_server_qr_code_login_locations_regex: ^(/_matrix/client/(unstable|v1)/org.matrix.msc4108/rendezvous|/_synapse/client/rendezvous)$

  276. 

  277. matrix_synapse_reverse_proxy_companion_federation_override_locations_regex: ^/_matrix/federation/v1/openid/userinfo$

  278. 

  279. # synapse content caching

  280. matrix_synapse_reverse_proxy_companion_synapse_cache_enabled: false

  281. matrix_synapse_reverse_proxy_companion_synapse_cache_path: /tmp/synapse-cache

  282. matrix_synapse_reverse_proxy_companion_synapse_cache_keys_zone_name: "STATIC"

  283. matrix_synapse_reverse_proxy_companion_synapse_cache_keys_zone_size: "10m"

  284. matrix_synapse_reverse_proxy_companion_synapse_cache_inactive_time: "48h"

  285. matrix_synapse_reverse_proxy_companion_synapse_cache_max_size_mb: 1024

  286. matrix_synapse_reverse_proxy_companion_synapse_cache_proxy_cache_valid_time: "24h"

  287. 

  288. 

  289. # Controls whether matrix-synapse-reverse-proxy-companion trusts an upstream server's X-Forwarded-Proto header.

  290. # The `matrix-synapse-reverse-proxy-companion` does not terminate SSL and always expects to be fronted by another reverse-proxy server.

  291. # As such, it trusts the protocol scheme forwarded by the upstream proxy.

  292. matrix_synapse_reverse_proxy_companion_trust_forwarded_proto: true

  293. matrix_synapse_reverse_proxy_companion_x_forwarded_proto_value: "{{ '$http_x_forwarded_proto' if matrix_synapse_reverse_proxy_companion_trust_forwarded_proto else '$scheme' }}"

  294. 

  295. 

  296. ########################################################################################

  297. #                                                                                      #

  298. # njs module                                                                           #

  299. #                                                                                      #

  300. ########################################################################################

  301. 

  302. # Controls whether the njs module is loaded.

  303. matrix_synapse_reverse_proxy_companion_njs_enabled: "{{ matrix_synapse_reverse_proxy_companion_whoami_sync_worker_router_enabled }}"

  304. 

  305. ########################################################################################

  306. #                                                                                      #

  307. # /njs module                                                                          #

  308. #                                                                                      #

  309. ########################################################################################

  310. 

  311. 

  312. ########################################################################################

  313. #                                                                                      #

  314. # Whoami-based sync worker routing                                                     #

  315. #                                                                                      #

  316. ########################################################################################

  317. 

  318. # Controls whether the whoami-based sync worker router is enabled.

  319. # When enabled, the reverse proxy will call Synapse's /_matrix/client/v3/account/whoami endpoint

  320. # to resolve access tokens to usernames, allowing consistent routing of requests from the same user

  321. # to the same sync worker regardless of which device or token they use.

  322. #

  323. # This works with any authentication system (native Synapse auth, MAS, etc.) because Synapse

  324. # handles the token validation internally.

  325. #

  326. # Enabled by default when there are sync workers, because sync workers benefit from user-level

  327. # stickiness due to their per-user in-memory caches.

  328. matrix_synapse_reverse_proxy_companion_whoami_sync_worker_router_enabled: "{{ matrix_synapse_reverse_proxy_companion_synapse_workers_list | selectattr('type', 'equalto', 'sync_worker') | list | length > 0 }}"

  329. 

  330. # The whoami endpoint path (Matrix spec endpoint).

  331. matrix_synapse_reverse_proxy_companion_whoami_sync_worker_router_endpoint: /_matrix/client/v3/account/whoami

  332. 

  333. # The full URL to the whoami endpoint.

  334. matrix_synapse_reverse_proxy_companion_whoami_sync_worker_router_url: "http://{{ matrix_synapse_reverse_proxy_companion_client_api_addr }}{{ matrix_synapse_reverse_proxy_companion_whoami_sync_worker_router_endpoint }}"

  335. 

  336. # Cache duration (in seconds) for whoami lookup results.

  337. # Token -> username mappings are cached to avoid repeated whoami calls.

  338. # A longer TTL reduces load on Synapse but means username changes take longer to take effect.

  339. matrix_synapse_reverse_proxy_companion_whoami_sync_worker_router_cache_ttl_seconds: 3600

  340. 

  341. # Size of the shared memory zone for caching whoami results (in megabytes).

  342. # Each cached entry is approximately 100-200 bytes.

  343. matrix_synapse_reverse_proxy_companion_whoami_sync_worker_router_cache_size_mb: 1

  344. 

  345. # Controls whether verbose logging is enabled for the whoami sync worker router.

  346. # When enabled, logs cache hits/misses and routing decisions.

  347. # Useful for debugging, but should be disabled in production.

  348. matrix_synapse_reverse_proxy_companion_whoami_sync_worker_router_logging_enabled: false

  349. 

  350. # The length of the access token to show in logs when logging is enabled.

  351. # Keeping this short is a good idea from a security perspective.

  352. matrix_synapse_reverse_proxy_companion_whoami_sync_worker_router_logging_token_length: 12

  353. 

  354. # Controls whether debug response headers are added to sync requests.

  355. # When enabled, adds X-Sync-Worker-Router-User-Identifier and X-Sync-Worker-Router-Upstream headers.

  356. # Useful for debugging routing behavior, but should be disabled in production.

  357. matrix_synapse_reverse_proxy_companion_whoami_sync_worker_router_debug_headers_enabled: false

  358. 

  359. ########################################################################################

  360. #                                                                                      #

  361. # /Whoami-based sync worker routing                                                    #

  362. #                                                                                      #

  363. ########################################################################################

  364. 

  365. # matrix_synapse_reverse_proxy_companion_restart_necessary controls whether the service

  366. # will be restarted (when true) or merely started (when false) by the

  367. # systemd service manager role (when conditional restart is enabled).

  368. #

  369. # This value is automatically computed during installation based on whether

  370. # any configuration files, the systemd service file, or the container image changed.

  371. # The default of `false` means "no restart needed" — appropriate when the role's

  372. # installation tasks haven't run (e.g., due to --tags skipping them).

  373. matrix_synapse_reverse_proxy_companion_restart_necessary: false