overmind
/
matrix-docker-ansible-deploy
réplica de https://github.com/spantaleev/matrix-docker-ansible-deploy
1
0
Fork 0
Código Incidencias 0 Lanzamientos 0 Wiki Actividad
Matrix Docker Ansible eploy
No puede seleccionar más de 25 temas Los temas deben comenzar con una letra o número, pueden incluir guiones ('-') y pueden tener hasta 35 caracteres de largo.
936 Commits
13 Ramas
36 MiB
 
 
Árbol: 810d0fb0e4
Ramas Etiquetas
${ item.name }
Crear rama ${ searchTerm }
desde '810d0fb0e4'
${ noResults }
matrix-docker-ansible-deploy/roles/matrix-nginx-proxy/defaults/main.yml

172 líneas
9.7 KiB
Original Blame Histórico 

  1. matrix_nginx_proxy_enabled: true

  2. 

  3. # We use an official nginx image, which we fix-up to run unprivileged.

  4. # An alternative would be an `nginxinc/nginx-unprivileged` image, but

  5. # that is frequently out of date.

  6. matrix_nginx_proxy_docker_image: "nginx:1.17.4-alpine"

  7. matrix_nginx_proxy_docker_image_force_pull: "{{ matrix_nginx_proxy_docker_image.endswith(':latest') }}"

  8. 

  9. matrix_nginx_proxy_base_path: "{{ matrix_base_data_path }}/nginx-proxy"

  10. matrix_nginx_proxy_data_path: "{{ matrix_nginx_proxy_base_path }}/data"

  11. matrix_nginx_proxy_confd_path: "{{ matrix_nginx_proxy_base_path }}/conf.d"

  12. 

  13. # List of systemd services that matrix-nginx-proxy.service depends on

  14. matrix_nginx_proxy_systemd_required_services_list: ['docker.service']

  15. 

  16. # List of systemd services that matrix-nginx-proxy.service wants

  17. matrix_nginx_proxy_systemd_wanted_services_list: []

  18. 

  19. # A list of additional "volumes" to mount in the container.

  20. # This list gets populated dynamically at runtime. You can provide a different default value,

  21. # if you wish to mount your own files into the container.

  22. # Contains definition objects like this: `{"src": "/outside", "dst": "/inside", "options": "rw|ro|slave|.."}

  23. matrix_nginx_proxy_container_additional_volumes: []

  24. 

  25. # A list of extra arguments to pass to the container

  26. matrix_nginx_proxy_container_extra_arguments: []

  27. 

  28. 

  29. # Controls whether matrix-nginx-proxy should serve the base domain.

  30. #

  31. # This is useful for when you only have your Matrix server, but you need to serve

  32. # to serve `/.well-known/matrix/*` files from the base domain for the needs of

  33. # Server-Discovery (Federation) and for Client-Discovery.

  34. #

  35. # Besides serving these Matrix files, a homepage would be served with content

  36. # as specified in the `matrix_nginx_proxy_base_domain_homepage_template` variable.

  37. # You can also put additional files to use for this webpage

  38. # in the `{{ matrix_nginx_proxy_data_path }}/matrix-domain` (`/matrix/nginx-proxy/data/matrix-domain`) directory.

  39. matrix_nginx_proxy_base_domain_serving_enabled: false

  40. 

  41. matrix_nginx_proxy_base_domain_hostname: "{{ matrix_domain }}"

  42. 

  43. # Controls whether `matrix_nginx_proxy_base_domain_homepage_template` would be dumped to an `index.html` file

  44. # in the `/matrix/nginx-proxy/data/matrix-domain` directory.

  45. #

  46. # If you would instead like to serve a static website by yourself, you can disable this.

  47. # When disabled, you're expected to put website files in `/matrix/nginx-proxy/data/matrix-domain` manually

  48. # and can expect that the playbook won't intefere with the `index.html` file.

  49. matrix_nginx_proxy_base_domain_homepage_enabled: true

  50. 

  51. matrix_nginx_proxy_base_domain_homepage_template: |-

  52.   <!doctype html>

  53.   <meta charset="utf-8" />

  54.   <html>

  55.     <body>

  56.       Hello from {{ matrix_domain }}!

  57.     </body>

  58.   </html>

  59. 

  60. 

  61. # Controls whether proxying the riot domain should be done.

  62. matrix_nginx_proxy_proxy_riot_enabled: false

  63. matrix_nginx_proxy_proxy_riot_hostname: "{{ matrix_server_fqn_riot }}"

  64. 

  65. # Controls whether proxying the matrix domain should be done.

  66. matrix_nginx_proxy_proxy_matrix_enabled: false

  67. matrix_nginx_proxy_proxy_matrix_hostname: "{{ matrix_server_fqn_matrix }}"

  68. 

  69. # Controls whether proxying the dimension domain should be done.

  70. matrix_nginx_proxy_proxy_dimension_enabled: false

  71. matrix_nginx_proxy_proxy_dimension_hostname: "{{ matrix_server_fqn_dimension }}"

  72. 

  73. # Controls whether proxying for the matrix-corporal API (`/_matrix/corporal`) should be done (on the matrix domain)

  74. matrix_nginx_proxy_proxy_matrix_corporal_api_enabled: false

  75. matrix_nginx_proxy_proxy_matrix_corporal_api_addr_with_container: "matrix-corporal:41081"

  76. matrix_nginx_proxy_proxy_matrix_corporal_api_addr_sans_container: "127.0.0.1:41081"

  77. 

  78. # Controls whether proxying for the User Directory Search API (`/_matrix/client/r0/user_directory/search`) should be done (on the matrix domain).

  79. # This can be used to forward the API endpoint to another service, augmenting the functionality of Synapse's own User Directory Search.

  80. # To learn more, see: https://github.com/kamax-matrix/mxisd/blob/master/docs/features/directory.md

  81. matrix_nginx_proxy_proxy_matrix_user_directory_search_enabled: false

  82. matrix_nginx_proxy_proxy_matrix_user_directory_search_addr_with_container: "matrix-mxisd:8090"

  83. matrix_nginx_proxy_proxy_matrix_user_directory_search_addr_sans_container: "127.0.0.1:8090"

  84. 

  85. # Controls whether proxying for 3PID-based registration (`/_matrix/client/r0/register/(email|msisdn)/requestToken`) should be done (on the matrix domain).

  86. # This allows another service to control registrations involving 3PIDs.

  87. # To learn more, see: https://github.com/kamax-matrix/mxisd/blob/master/docs/features/registration.md

  88. matrix_nginx_proxy_proxy_matrix_3pid_registration_enabled: false

  89. matrix_nginx_proxy_proxy_matrix_3pid_registration_addr_with_container: "matrix-mxisd:8090"

  90. matrix_nginx_proxy_proxy_matrix_3pid_registration_addr_sans_container: "127.0.0.1:8090"

  91. 

  92. # Controls whether proxying for the Identity API (`/_matrix/identity`) should be done (on the matrix domain)

  93. matrix_nginx_proxy_proxy_matrix_identity_api_enabled: false

  94. matrix_nginx_proxy_proxy_matrix_identity_api_addr_with_container: "matrix-mxisd:8090"

  95. matrix_nginx_proxy_proxy_matrix_identity_api_addr_sans_container: "127.0.0.1:8090"

  96. 

  97. # Controls whether proxying for metrics (`/_synapse/metrics`) should be done (on the matrix domain)

  98. matrix_nginx_proxy_proxy_synapse_metrics: false

  99. matrix_nginx_proxy_proxy_synapse_metrics_basic_auth_enabled: false

  100. matrix_nginx_proxy_proxy_synapse_metrics_basic_auth_key: ""

  101. 

  102. # The addresses where the Matrix Client API is.

  103. # Certain extensions (like matrix-corporal) may override this in order to capture all traffic.

  104. matrix_nginx_proxy_proxy_matrix_client_api_addr_with_container: "matrix-synapse:8008"

  105. matrix_nginx_proxy_proxy_matrix_client_api_addr_sans_container: "127.0.0.1:8008"

  106. # This needs to be equal or higher than the maximum upload size accepted by Synapse.

  107. matrix_nginx_proxy_proxy_matrix_client_api_client_max_body_size_mb: 25

  108. 

  109. # Controls whether proxying for the Matrix Federation API should be done.

  110. matrix_nginx_proxy_proxy_matrix_federation_api_enabled: false

  111. matrix_nginx_proxy_proxy_matrix_federation_api_addr_with_container: "matrix-synapse:8048"

  112. matrix_nginx_proxy_proxy_matrix_federation_api_addr_sans_container: "localhost:8048"

  113. matrix_nginx_proxy_proxy_matrix_federation_api_client_max_body_size_mb: "{{ (matrix_nginx_proxy_proxy_matrix_client_api_client_max_body_size_mb | int) * 3 }}"

  114. matrix_nginx_proxy_proxy_matrix_federation_api_ssl_certificate: "{{ matrix_ssl_config_dir_path }}/live/{{ matrix_nginx_proxy_proxy_matrix_hostname }}/fullchain.pem"

  115. matrix_nginx_proxy_proxy_matrix_federation_api_ssl_certificate_key: "{{ matrix_ssl_config_dir_path }}/live/{{ matrix_nginx_proxy_proxy_matrix_hostname }}/privkey.pem"

  116. 

  117. # The tmpfs at /tmp needs to be large enough to handle multiple concurrent file uploads.

  118. matrix_nginx_proxy_tmp_directory_size_mb: "{{ (matrix_nginx_proxy_proxy_matrix_federation_api_client_max_body_size_mb | int) * 50 }}"

  119. 

  120. # A list of strings containing additional configuration blocks to add to the matrix domain's server configuration.

  121. matrix_nginx_proxy_proxy_matrix_additional_server_configuration_blocks: []

  122. 

  123. # Specifies when to reload the matrix-nginx-proxy service so that

  124. # a new SSL certificate could go into effect.

  125. matrix_nginx_proxy_reload_cron_time_definition: "20 4 */5 * *"

  126. 

  127. # Specifies which SSL protocols to use when serving Riot and Synapse

  128. matrix_nginx_proxy_ssl_protocols: "TLSv1.1 TLSv1.2 TLSv1.3"

  129. 

  130. # Controls whether the self-check feature should validate SSL certificates.

  131. matrix_nginx_proxy_self_check_validate_certificates: true

  132. 

  133. # By default, this playbook automatically retrieves and auto-renews

  134. # free SSL certificates from Let's Encrypt.

  135. #

  136. # The following retrieval methods are supported:

  137. # - "lets-encrypt" - the playbook obtains free SSL certificates from Let's Encrypt

  138. # - "self-signed" - the playbook generates and self-signs certificates

  139. # - "manually-managed" - lets you manage certificates by yourself (manually; see below)

  140. # - "none" - like "manually-managed", but doesn't care if you don't drop certificates in the location it expects

  141. #

  142. # If you decide to manage certificates by yourself (`matrix_ssl_retrieval_method: manually-managed`),

  143. # you'd need to drop them into the directory specified by `matrix_ssl_config_dir_path`

  144. # obeying the following hierarchy:

  145. # - <matrix_ssl_config_dir_path>/live/<domain>/fullchain.pem

  146. # - <matrix_ssl_config_dir_path>/live/<domain>/privkey.pem

  147. # where <domain> refers to the domains that you need (usually `matrix_server_fqn_matrix` and `matrix_server_fqn_riot`).

  148. #

  149. # The "none" type (`matrix_ssl_retrieval_method: none`), simply means that no certificate retrieval will happen.

  150. # It's useful for when you've disabled the nginx proxy (`matrix_nginx_proxy_enabled: false`)

  151. # and you'll be using another reverse-proxy server (like Apache) with your own certificates, managed by yourself.

  152. matrix_ssl_retrieval_method: "lets-encrypt"

  153. 

  154. # The list of domains that this role will obtain certificates for.

  155. matrix_ssl_domains_to_obtain_certificates_for: []

  156. 

  157. # Controls whether to obtain production or staging certificates from Let's Encrypt.

  158. matrix_ssl_lets_encrypt_staging: false

  159. matrix_ssl_lets_encrypt_certbot_docker_image: "certbot/certbot:v0.38.0"

  160. matrix_ssl_lets_encrypt_certbot_docker_image_force_pull: "{{ matrix_ssl_lets_encrypt_certbot_docker_image.endswith(':latest') }}"

  161. matrix_ssl_lets_encrypt_certbot_standalone_http_port: 2402

  162. matrix_ssl_lets_encrypt_support_email: ~

  163. 

  164. matrix_ssl_base_path: "{{ matrix_base_data_path }}/ssl"

  165. matrix_ssl_config_dir_path: "{{ matrix_ssl_base_path }}/config"

  166. matrix_ssl_log_dir_path: "{{ matrix_ssl_base_path }}/log"

  167. 

  168. 

  169. # ngnix status page configurations.

  170. matrix_nginx_proxy_proxy_matrix_nginx_status_enabled: false

  171. matrix_nginx_proxy_proxy_matrix_nginx_status_allowed_addresses: ['{{ ansible_default_ipv4.address }}']