overmind
/
matrix-docker-ansible-deploy
mirror of https://github.com/spantaleev/matrix-docker-ansible-deploy
1
0
Fork 0
Code Issues 0 Releases 0 Wiki Activity
Matrix Docker Ansible eploy
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
11750 Commits
13 Branches
72 MiB
 
 
Tree: aef0fad8b5
Branches Tags
${ item.name }
Create branch ${ searchTerm }
from 'aef0fad8b5'
${ noResults }
matrix-docker-ansible-deploy/roles/custom/matrix-bot-meowlnir/tasks/validate_config.yml

84 lines
4.9 KiB
Raw Blame History 

  1. # SPDX-FileCopyrightText: 2026 Slavi Pantaleev

  2. #

  3. # SPDX-License-Identifier: AGPL-3.0-or-later

  4. 

  5. ---

  6. 

  7. - name: Fail if required matrix-bot-meowlnir variables are undefined

  8.   ansible.builtin.fail:

  9.     msg: "The `{{ item.name }}` variable must be defined and have a non-null value."

  10.   with_items:

  11.     - {'name': 'matrix_bot_meowlnir_container_network', when: true}

  12.     - {'name': 'matrix_bot_meowlnir_config_homeserver_address', when: true}

  13.     - {'name': 'matrix_bot_meowlnir_config_homeserver_domain', when: true}

  14.     - {'name': 'matrix_bot_meowlnir_appservice_token', when: true}

  15.     - {'name': 'matrix_bot_meowlnir_homeserver_token', when: true}

  16.     - {'name': 'matrix_bot_meowlnir_config_meowlnir_management_secret', when: true}

  17.     - {'name': 'matrix_bot_meowlnir_config_meowlnir_data_secret', when: true}

  18.     - {'name': 'matrix_bot_meowlnir_config_antispam_secret', when: true}

  19.     - {'name': 'matrix_bot_meowlnir_config_encryption_pickle_key', when: true}

  20.     - {'name': 'matrix_bot_meowlnir_database_hostname', when: true}

  21.     - {'name': 'matrix_bot_meowlnir_database_password', when: true}

  22.     - {'name': 'matrix_bot_meowlnir_config_policy_server_signing_key', when: "{{ matrix_bot_meowlnir_policy_server_enabled }}"}

  23.     - {'name': 'matrix_bot_meowlnir_synapse_http_antispam_management_room_id', when: "{{ matrix_bot_meowlnir_synapse_http_antispam_enabled }}"}

  24.   when: "item.when | bool and (lookup('vars', item.name, default='') == '' or lookup('vars', item.name, default='') is none)"

  25. 

  26. # Meowlnir re-runs its configuration upgrader in memory on every start, and `generate` is resolved to a fresh random value each time.

  27. # A `generate` placeholder would therefore rotate the secret on every restart, invalidating the appservice registration or the encryption store.

  28. - name: Fail if matrix-bot-meowlnir secrets are set to the literal "generate"

  29.   ansible.builtin.fail:

  30.     msg: >-

  31.       The `{{ item }}` variable is set to `generate`. Meowlnir would then mint a new

  32.       secret on every restart, because the playbook runs it with `--no-update` and its

  33.       configuration file is managed by Ansible. Set an explicit, stable value instead.

  34.   when: "lookup('vars', item, default='') == 'generate'"

  35.   with_items:

  36.     - matrix_bot_meowlnir_appservice_token

  37.     - matrix_bot_meowlnir_homeserver_token

  38.     - matrix_bot_meowlnir_config_meowlnir_management_secret

  39.     - matrix_bot_meowlnir_config_meowlnir_data_secret

  40.     - matrix_bot_meowlnir_config_antispam_secret

  41.     - matrix_bot_meowlnir_config_encryption_pickle_key

  42.     - matrix_bot_meowlnir_config_policy_server_signing_key

  43. 

  44. # Bots exist only in Meowlnir's database and are created through its management API, so the whole roster and pruning path depends on that API being reachable.

  45. # Disabling it is only coherent for an installation whose bots were created some other way, which means an empty roster and pruning turned off.

  46. - name: Fail if the Meowlnir management API is disabled while the playbook manages bots

  47.   ansible.builtin.fail:

  48.     msg: >-

  49.       `matrix_bot_meowlnir_config_meowlnir_management_secret` is set to `disable`, which

  50.       turns Meowlnir's management API off. The playbook creates, updates and removes bots

  51.       through that API, so it cannot manage them while it is disabled.

  52.       Either give the secret a real value, or - if you manage Meowlnir's bots yourself -

  53.       leave `matrix_bot_meowlnir_bots_custom` empty and set

  54.       `matrix_bot_meowlnir_bots_pruning_enabled` to `false`.

  55.   when: >-

  56.     matrix_bot_meowlnir_config_meowlnir_management_secret == 'disable'

  57.     and (matrix_bot_meowlnir_bots | length > 0 or matrix_bot_meowlnir_bots_pruning_enabled | bool)

  58. 

  59. - name: Fail if the bot user prefix and the localpart template disagree

  60.   ansible.builtin.fail:

  61.     msg: >-

  62.       `matrix_bot_meowlnir_config_meowlnir4all_localpart_template` must start with

  63.       `matrix_bot_meowlnir_user_prefix` ({{ matrix_bot_meowlnir_user_prefix }}), or the bots

  64.       Meowlnir creates will fall outside the user namespace declared in its appservice

  65.       registration file, and the homeserver will refuse to let it operate them.

  66.   when: "not matrix_bot_meowlnir_config_meowlnir4all_localpart_template.startswith(matrix_bot_meowlnir_user_prefix)"

  67. 

  68. - name: Validate Meowlnir bot definitions

  69.   ansible.builtin.include_tasks: "{{ role_path }}/tasks/util/validate_bot.yml"

  70.   with_items: "{{ matrix_bot_meowlnir_bots }}"

  71.   loop_control:

  72.     loop_var: bot

  73. 

  74. - name: Fail if Meowlnir and Draupnir both claim the synapse-http-antispam module

  75.   ansible.builtin.fail:

  76.     msg: >-

  77.       Both `matrix_bot_meowlnir_synapse_http_antispam_enabled` and

  78.       `matrix_bot_draupnir_config_web_synapseHTTPAntispam_enabled` are enabled.

  79.       The playbook wires the synapse-http-antispam module up to a single consumer,

  80.       so you need to pick one of the two.

  81.   when:

  82.     - matrix_bot_meowlnir_synapse_http_antispam_enabled | bool

  83.     - matrix_bot_draupnir_config_web_synapseHTTPAntispam_enabled | default(false) | bool