Skip to content

Commit e3183ba

Browse files
GoMatrixHostingGoMatrixHosting
committed
Merge remote-tracking branch 'upstream/master' into gomatrixhosting-testing
2 parents 871df86 + d38c0e1 commit e3183ba

File tree

21 files changed

+121
-41
lines changed

21 files changed

+121
-41
lines changed

‎docs/configuring-playbook-own-webserver.md‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -108,6 +108,9 @@ matrix_nginx_proxy_container_federation_host_bind_port: '127.0.0.1:8449'
108108
# Since we don't obtain any certificates (`matrix_ssl_retrieval_method: none` above), it won't work by default.
109109
# An alternative is to tweak some of: `matrix_coturn_tls_enabled`, `matrix_coturn_tls_cert_path` and `matrix_coturn_tls_key_path`.
110110
matrix_coturn_enabled: false
111+
112+
# Trust the reverse proxy to send the correct `X-Forwarded-Proto` header as it is handling the SSL connection.
113+
matrix_nginx_proxy_trust_forwarded_proto: true
111114
```
112115
113116
With this, nginx would still be in use, but it would not bother with anything SSL related or with taking up public ports.

‎docs/configuring-playbook-prometheus-grafana.md‎

Lines changed: 33 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -56,8 +56,40 @@ Name | Description
5656
`matrix_nginx_proxy_proxy_synapse_metrics`|Set this to `true` to make matrix-nginx-proxy expose the Synapse metrics at `https://matrix.DOMAIN/_synapse/metrics`
5757
`matrix_nginx_proxy_proxy_synapse_metrics_basic_auth_enabled`|Set this to `true` to password-protect (using HTTP Basic Auth) `https://matrix.DOMAIN/_synapse/metrics` (the username is always `prometheus`, the password is defined in `matrix_nginx_proxy_proxy_synapse_metrics_basic_auth_key`)
5858
`matrix_nginx_proxy_proxy_synapse_metrics_basic_auth_key`|Set this to a password to use for HTTP Basic Auth for protecting `https://matrix.DOMAIN/_synapse/metrics` (the username is always `prometheus` - it's not configurable)
59-
`matrix_server_fqn_grafana`|Use this variable to override the domain at which the Grafana web user-interface is at (defaults to `stats.DOMAIN`).
59+
`matrix_server_fqn_grafana`|Use this variable to override the domain at which the Grafana web user-interface is at (defaults to `stats.DOMAIN`)
6060

61+
### Collecting system and Postgres metrics to an external Prometheus server (advanced)
62+
63+
When you normally enable the Prometheus and Grafana via the playbook, it will also show general system (via node-exporter) and Postgres (via postgres-exporter) stats. If you are instead collecting your metrics to an external Prometheus server, you can follow this advanced configuration example to also export these stats.
64+
65+
It would be possible to use `matrix_prometheus_node_exporter_container_http_host_bind_port` etc., but that is not always the best choice, for example because your server is on a public network.
66+
67+
Use the following variables in addition to the ones mentioned above:
68+
69+
Name | Description
70+
-----|----------
71+
`matrix_nginx_proxy_proxy_grafana_enabled`|Set this to `true` to make the stats subdomain (`matrix_server_fqn_grafana`) available via the Nginx proxy
72+
`matrix_ssl_additional_domains_to_obtain_certificates_for`|Add `"{{ matrix_server_fqn_grafana }}"` to this list to have letsencrypt fetch a certificate for the stats subdomain
73+
`matrix_prometheus_node_exporter_enabled`|Set this to `true` to enable the node (general system stats) exporter
74+
`matrix_prometheus_postgres_exporter_enabled`|Set this to `true` to enable the Postgres exporter
75+
`matrix_nginx_proxy_proxy_grafana_additional_server_configuration_blocks`|Add locations to this list depending on which of the above exporters you enabled (see below)
76+
77+
```nginx
78+
matrix_nginx_proxy_proxy_grafana_additional_server_configuration_blocks:
79+
- 'location /node-exporter/ {
80+
resolver 127.0.0.11 valid=5s;
81+
proxy_pass http://matrix-prometheus-node-exporter:9100/;
82+
auth_basic "protected";
83+
auth_basic_user_file /nginx-data/matrix-synapse-metrics-htpasswd;
84+
}'
85+
- 'location /postgres-exporter/ {
86+
resolver 127.0.0.11 valid=5s;
87+
proxy_pass http://matrix-prometheus-postgres-exporter:9187/;
88+
auth_basic "protected";
89+
auth_basic_user_file /nginx-data/matrix-synapse-metrics-htpasswd;
90+
}'
91+
```
92+
You can customize the `location`s to your liking, just point your Prometheus to there later (e.g. `stats.DOMAIN/node-exporter/metrics`). Nginx is very picky about the `proxy_pass`syntax: take care to follow the example closely and note the trailing slash as well as absent use of variables. postgres-exporter uses the nonstandard port 9187.
6193

6294
## More information
6395

‎docs/self-building.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,7 @@ List of roles where self-building the Docker image is currently possible:
2222
- `matrix-mailer`
2323
- `matrix-bridge-appservice-irc`
2424
- `matrix-bridge-appservice-slack`
25+
- `matrix-bridge-appservice-webhooks`
2526
- `matrix-bridge-mautrix-facebook`
2627
- `matrix-bridge-mautrix-hangouts`
2728
- `matrix-bridge-mautrix-telegram`

‎group_vars/matrix_servers‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -104,6 +104,8 @@ matrix_appservice_discord_database_password: "{{ matrix_synapse_macaroon_secret_
104104
# We don't enable bridges by default.
105105
matrix_appservice_webhooks_enabled: false
106106

107+
matrix_appservice_webhooks_container_image_self_build: "{{ matrix_architecture != 'amd64' }}"
108+
107109
# Normally, matrix-nginx-proxy is enabled and nginx can reach matrix-appservice-webhooks over the container network.
108110
# If matrix-nginx-proxy is not enabled, or you otherwise have a need for it, you can expose
109111
# matrix-appservice-webhooks' client-server port to the local host.

‎roles/matrix-base/defaults/main.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -83,8 +83,8 @@ matrix_host_command_openssl: "/usr/bin/env openssl"
8383
matrix_host_command_systemctl: "/usr/bin/env systemctl"
8484
matrix_host_command_sh: "/usr/bin/env sh"
8585

86-
matrix_ntpd_package: "{{ 'systemd-timesyncd' if ansible_distribution == 'CentOS' and ansible_distribution_major_version > '7' else 'ntp' }}"
87-
matrix_ntpd_service: "{{ 'systemd-timesyncd' if ansible_distribution == 'CentOS' and ansible_distribution_major_version > '7' else ('ntpd' if ansible_os_family == 'RedHat' or ansible_distribution == 'Archlinux' else 'ntp') }}"
86+
matrix_ntpd_package: "{{ 'systemd-timesyncd' if (ansible_distribution == 'CentOS' and ansible_distribution_major_version > '7') or (ansible_distribution == 'Ubuntu' and ansible_distribution_major_version > '18') else 'ntp' }}"
87+
matrix_ntpd_service: "{{ 'systemd-timesyncd' if (ansible_distribution == 'CentOS' and ansible_distribution_major_version > '7') or (ansible_distribution == 'Ubuntu' and ansible_distribution_major_version > '18') or ansible_distribution == 'Archlinux' else ('ntpd' if ansible_os_family == 'RedHat' else 'ntp') }}"
8888

8989
matrix_homeserver_url: "https://{{ matrix_server_fqn_matrix }}"
9090

‎roles/matrix-base/tasks/server_base/setup_archlinux.yml‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,6 @@
44
pacman:
55
name:
66
- python-docker
7-
- "{{ matrix_ntpd_package }}"
87
# TODO This needs to be verified. Which version do we need?
98
- fuse3
109
- python-dnspython

‎roles/matrix-bridge-appservice-webhooks/defaults/main.yml‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,13 +3,20 @@
33

44
matrix_appservice_webhooks_enabled: true
55

6+
matrix_appservice_webhooks_container_image_self_build: false
7+
matrix_appservice_webhooks_container_image_self_build_repo: "https://github.com/turt2live/matrix-appservice-webhooks"
8+
matrix_appservice_webhooks_container_image_self_build_repo_version: "{{ 'master' if matrix_appservice_webhooks_version == 'latest' else matrix_appservice_webhooks_version }}"
9+
matrix_appservice_webhooks_container_image_self_build_repo_dockerfile_path: "Dockerfile"
10+
611
matrix_appservice_webhooks_version: latest
7-
matrix_appservice_webhooks_docker_image: "{{ matrix_container_global_registry_prefix }}turt2live/matrix-appservice-webhooks:{{ matrix_appservice_webhooks_version }}"
12+
matrix_appservice_webhooks_docker_image: "{{ matrix_appservice_webhooks_docker_image_name_prefix }}turt2live/matrix-appservice-webhooks:{{ matrix_appservice_webhooks_version }}"
13+
matrix_appservice_webhooks_docker_image_name_prefix: "{{ 'localhost/' if matrix_appservice_webhooks_container_image_self_build else matrix_container_global_registry_prefix }}"
814
matrix_appservice_webhooks_docker_image_force_pull: "{{ matrix_appservice_webhooks_docker_image.endswith(':latest') }}"
915

1016
matrix_appservice_webhooks_base_path: "{{ matrix_base_data_path }}/appservice-webhooks"
1117
matrix_appservice_webhooks_config_path: "{{ matrix_appservice_webhooks_base_path }}/config"
1218
matrix_appservice_webhooks_data_path: "{{ matrix_appservice_webhooks_base_path }}/data"
19+
matrix_appservice_webhooks_docker_src_files_path: "{{ matrix_appservice_webhooks_base_path }}/docker-src"
1320

1421
# If nginx-proxy is disabled, the bridge itself expects its endpoint to be on its own domain (e.g. "localhost:6789")
1522
matrix_appservice_webhooks_public_endpoint: /appservice-webhooks

‎roles/matrix-bridge-appservice-webhooks/tasks/setup_install.yml‎

Lines changed: 35 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1,23 +1,47 @@
11
---
22

3-
- name: Ensure Appservice webhooks image is pulled
4-
docker_image:
5-
name: "{{ matrix_appservice_webhooks_docker_image }}"
6-
source: "{{ 'pull' if ansible_version.major > 2 or ansible_version.minor > 7 else omit }}"
7-
force_source: "{{ matrix_appservice_webhooks_docker_image_force_pull if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}"
8-
force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else matrix_appservice_webhooks_docker_image_force_pull }}"
9-
103
- name: Ensure AppService webhooks paths exist
114
file:
12-
path: "{{ item }}"
5+
path: "{{ item.path }}"
136
state: directory
147
mode: 0750
158
owner: "{{ matrix_user_username }}"
169
group: "{{ matrix_user_groupname }}"
1710
with_items:
18-
- "{{ matrix_appservice_webhooks_base_path }}"
19-
- "{{ matrix_appservice_webhooks_config_path }}"
20-
- "{{ matrix_appservice_webhooks_data_path }}"
11+
- { path: "{{ matrix_appservice_webhooks_base_path }}", when: true }
12+
- { path: "{{ matrix_appservice_webhooks_config_path }}", when: true }
13+
- { path: "{{ matrix_appservice_webhooks_data_path }}", when: true }
14+
- { path: "{{ matrix_appservice_webhooks_docker_src_files_path }}", when: "{{ matrix_appservice_webhooks_container_image_self_build }}"}
15+
when: "item.when|bool"
16+
17+
- name: Ensure Appservice webhooks image is pulled
18+
docker_image:
19+
name: "{{ matrix_appservice_webhooks_docker_image }}"
20+
source: "{{ 'pull' if ansible_version.major > 2 or ansible_version.minor > 7 else omit }}"
21+
force_source: "{{ matrix_appservice_webhooks_docker_image_force_pull if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}"
22+
force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else matrix_appservice_webhooks_docker_image_force_pull }}"
23+
when: "not matrix_appservice_webhooks_container_image_self_build|bool"
24+
25+
- block:
26+
- name: Ensure Appservice webhooks repository is present on self-build
27+
git:
28+
repo: "{{ matrix_appservice_webhooks_container_image_self_build_repo }}"
29+
dest: "{{ matrix_appservice_webhooks_docker_src_files_path }}"
30+
version: "{{ matrix_appservice_webhooks_container_image_self_build_repo_version }}"
31+
force: "yes"
32+
register: matrix_appservice_webhooks_git_pull_results
33+
34+
- name: Ensure Appservice webhooks Docker image is built
35+
docker_image:
36+
name: "{{ matrix_appservice_webhooks_docker_image }}"
37+
source: build
38+
force_source: "{{ matrix_appservice_webhooks_git_pull_results.changed if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}"
39+
force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else matrix_appservice_webhooks_git_pull_results.changed }}"
40+
build:
41+
dockerfile: "{{ matrix_appservice_webhooks_container_image_self_build_repo_dockerfile_path }}"
42+
path: "{{ matrix_appservice_webhooks_docker_src_files_path }}"
43+
pull: yes
44+
when: "matrix_appservice_webhooks_container_image_self_build|bool"
2145

2246
- name: Ensure Matrix Appservice webhooks config is installed
2347
copy:

‎roles/matrix-bridge-beeper-linkedin/defaults/main.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33

44
matrix_beeper_linkedin_enabled: true
55

6-
matrix_beeper_linkedin_version: v0.5.0
6+
matrix_beeper_linkedin_version: v0.5.1
77
# See: https://gitlab.com/beeper/linkedin/container_registry
88
matrix_beeper_linkedin_docker_image: "registry.gitlab.com/beeper/linkedin:{{ matrix_beeper_linkedin_version }}-amd64"
99
matrix_beeper_linkedin_docker_image_force_pull: "{{ matrix_beeper_linkedin_docker_image.endswith(':latest-amd64') }}"

‎roles/matrix-bridge-heisenbridge/defaults/main.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33

44
matrix_heisenbridge_enabled: true
55

6-
matrix_heisenbridge_version: 1.2.0
6+
matrix_heisenbridge_version: 1.2.1
77
matrix_heisenbridge_docker_image: "{{ matrix_container_global_registry_prefix }}hif1/heisenbridge:{{ matrix_heisenbridge_version }}"
88
matrix_heisenbridge_docker_image_force_pull: "{{ matrix_heisenbridge_docker_image.endswith(':latest') }}"
99

0 commit comments

Comments
 (0)