diff --git a/playbooks/matrix_delegate.yml b/playbooks/matrix_delegate.yml new file mode 100644 index 0000000..b1fa2e4 --- /dev/null +++ b/playbooks/matrix_delegate.yml @@ -0,0 +1,27 @@ +--- + +# Infrastructure +# Ansible instructions to deploy the infrastructure +# Copyright (C) 2021 Saibotk +# +# This program is free software: you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation, version 3 of the License. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see . + +- hosts: matrix_delegate + roles: + - docker + - docker_compose + - docker_cleanup + - traefik + - matrix_delegate + environment: + PYTHONPATH: /opt/ansible-dependencies/lib/python{{ env_ansible_deps_python_version | default(2.7) }}/site-packages diff --git a/playbooks/site.yml b/playbooks/site.yml index 97f4b8e..50cd718 100644 --- a/playbooks/site.yml +++ b/playbooks/site.yml @@ -28,6 +28,7 @@ - import_playbook: mastodon.yml - import_playbook: codimd.yml - import_playbook: matrix.yml +- import_playbook: matrix_delegate.yml - import_playbook: matrix_elementweb.yml - import_playbook: matrix_webhooks.yml - import_playbook: matrix_maubot.yml diff --git a/roles/matrix_delegate/README.md b/roles/matrix_delegate/README.md new file mode 100644 index 0000000..c5e7a38 --- /dev/null +++ b/roles/matrix_delegate/README.md @@ -0,0 +1,35 @@ +Matrix_delegate +========= + +This will setup a small Matrix delegate nginx server using docker and traefik as a reverse proxy. + +Requirements +------------ + +You will need to have docker, docker-compose and traefik installed or declared as dependencies with their respective roles. + +**This role assumes that you have setup traefik with an endpoint called `websecure`.** + +Role Variables +-------------- + +**Please look at the [defaults/main.yml](defaults/main.yml) for all available variables and their description.** + +**Note: Lines that are commented out via `#` are usually still valid/used variables, but they are not defined by default, so they might enable a feature, when uncommenting/defining them!** + +### Global variables, that are used: + +- `proxy_network`: Defined by the local traefik installation, this is the shared proxy network used by traefik to reach the containers. (optional) +- `proxy_hiddenservice`: Defined by the local traefik installation, this is used to generate the alt-svc header for the alternative Tor domain. (optional) + +Dependencies +------------ + +- docker +- docker-compose +- traefik + +License +------- + +GPL-3.0-only diff --git a/roles/matrix_delegate/defaults/main.yml b/roles/matrix_delegate/defaults/main.yml new file mode 100644 index 0000000..0b7a002 --- /dev/null +++ b/roles/matrix_delegate/defaults/main.yml @@ -0,0 +1,39 @@ +--- +# Default variables for the matrix_delegate role + +# Infrastructure +# Ansible instructions to deploy the infrastructure +# Copyright (C) 2021 Saibotk +# +# This program is free software: you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation, version 3 of the License. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see . +# + +# The install location +matrix_delegate_install_location: /srv/matrix_delegate + +# The certresolver that is used by traefik for this domain +matrix_delegate_traefik_certresolver: letsencrypt_http + +# The domain that traefik will serve the delegate under +# NOTE: This should be the same as the servername (right side of user ids). +matrix_delegate_domain: example.com + +# The domain that the matrix homeserver is actually available under +matrix_delegate_matrix_domain: matrix.example.com + +# Container versions +# renovate: depName=docker.io/library/nginx +matrix_delegate_nginx_version: "1.21" + +# Container tag definitions +matrix_delegate_nginx_image_version: "{{ matrix_delegate_nginx_version }}-alpine" diff --git a/roles/matrix_delegate/handlers/main.yml b/roles/matrix_delegate/handlers/main.yml new file mode 100644 index 0000000..d3a6bb1 --- /dev/null +++ b/roles/matrix_delegate/handlers/main.yml @@ -0,0 +1,32 @@ +--- +# Handlers file for the matrix_delegate role + +# Infrastructure +# Ansible instructions to deploy the infrastructure +# Copyright (C) 2019-2020 Alexander (w4tsn) Wellbrock +# +# This program is free software: you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation, version 3 of the License. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see . +# + +- name: restart matrix delegate nginx + docker_compose: + services: + - delegate + state: present + project_src: "{{ matrix_delegate_install_location }}" + restarted: true + tags: + - docker + - matrix + - delegate + become: true diff --git a/roles/matrix_delegate/meta/main.yml b/roles/matrix_delegate/meta/main.yml new file mode 100644 index 0000000..8fb26e9 --- /dev/null +++ b/roles/matrix_delegate/meta/main.yml @@ -0,0 +1,17 @@ +galaxy_info: + author: saibotk + description: Deploys a matrix delegate server via docker using traefik. + license: GPL-3.0-only + min_ansible_version: 2.9 + + platforms: + - name: CentOS + versions: + - 7 + + galaxy_tags: [] + +dependencies: + - docker + - docker_compose + - traefik diff --git a/roles/matrix_delegate/tasks/main.yml b/roles/matrix_delegate/tasks/main.yml new file mode 100644 index 0000000..2bb2dd7 --- /dev/null +++ b/roles/matrix_delegate/tasks/main.yml @@ -0,0 +1,89 @@ +--- +# Tasks file for the matrix_delegate role + +# Infrastructure +# Ansible instructions to deploy the infrastructure +# Copyright (C) 2019-2020 Christoph (Sheogorath) Kern +# Copyright (C) 2019-2020 Alexander (w4tsn) Wellbrock +# Copyright (C) 2021 Saibotk +# +# This program is free software: you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation, version 3 of the License. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see . +# + +- name: Create install directory + file: + path: "{{ item }}" + state: directory + mode: '0700' + owner: 'root' + group: 'root' + with_items: + - "{{ matrix_delegate_install_location }}" + become: true + +- name: Deploy docker-compose.yml + template: + src: "docker-compose.yml" + dest: "{{ matrix_delegate_install_location }}/docker-compose.yml" + mode: '0600' + owner: 'root' + group: 'root' + validate: docker-compose -f %s config -q + tags: + - matrix + - delegate + become: true + +- name: Deploy delegation config files + template: + src: "{{ item }}" + dest: "{{ matrix_delegate_install_location }}/{{ item }}" + setype: "container_file_t" + mode: '0644' + owner: 'root' + group: 'root' + with_items: + - "server-delegation.json" + - "client-delegation.json" + tags: + - docker + - matrix + - delegate + become: true + +- name: Deploy nginx delegate config + template: + src: "delegate-nginx.conf" + dest: "{{ matrix_delegate_install_location }}/nginx.conf" + setype: "container_file_t" + mode: '0600' + owner: 'root' + group: 'root' + tags: + - docker + - matrix + - delegate + notify: restart matrix delegate nginx + become: true + +- name: Compose matrix_delegate + docker_compose: + state: present + project_src: "{{ matrix_delegate_install_location }}" + pull: true + remove_orphans: true + tags: + - docker + - matrix + - delegate + become: true diff --git a/roles/matrix_delegate/templates/client-delegation.json b/roles/matrix_delegate/templates/client-delegation.json new file mode 100644 index 0000000..d8e15b9 --- /dev/null +++ b/roles/matrix_delegate/templates/client-delegation.json @@ -0,0 +1,5 @@ +{ + "m.homeserver": { + "base_url": "https://{{ matrix_delegate_matrix_domain }}" + } +} diff --git a/roles/matrix_delegate/templates/delegate-nginx.conf b/roles/matrix_delegate/templates/delegate-nginx.conf new file mode 100644 index 0000000..bdcc2dd --- /dev/null +++ b/roles/matrix_delegate/templates/delegate-nginx.conf @@ -0,0 +1,74 @@ +{{ ansible_managed | comment }} + +# From https://git.shivering-isles.com/w4tsn/infrastructure/-/blob/2d8d03a025b833e11533fa8610cc77cff7a59bb9/roles/matrix/templates/delegate-nginx.conf.j2 + +# Infrastructure +# Ansible instructions to deploy the infrastructure +# Copyright (C) 2019-2020 Alexander (w4tsn) Wellbrock +# Copyright (C) 2020 Saibotk +# +# This program is free software: you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation, version 3 of the License. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see . +# + +worker_processes 1; + +error_log stderr; + +pid /tmp/nginx.pid; + +events { + worker_connections 1024; +} + +http { + include /etc/nginx/mime.types; + default_type application/octet-stream; + + access_log off; + + # Turn off the bloody buffering to temp files + proxy_buffering off; + + sendfile on; + keepalive_timeout 120; + + gzip on; + gzip_types text/plain application/json; + + server_names_hash_bucket_size 128; + + # These two should be the same or nginx will start writing + # large request bodies to temp files + client_body_buffer_size 10m; + client_max_body_size 10m; + + server { + listen 80; + server_name localhost; + server_tokens off; + set_real_ip_from 10.0.0.0/8; + set_real_ip_from 172.16.0.0/12; + + location /.well-known/matrix { + root /usr/share/nginx/html; + {# + A somewhat long expires value is used to prevent outages + in case this is unreachable due to network failure or + due to the base domain's server completely dying. + #} + expires 4h; + default_type application/json; + add_header Access-Control-Allow-Origin *; + } + } +} diff --git a/roles/matrix_delegate/templates/docker-compose.yml b/roles/matrix_delegate/templates/docker-compose.yml new file mode 100644 index 0000000..d485feb --- /dev/null +++ b/roles/matrix_delegate/templates/docker-compose.yml @@ -0,0 +1,65 @@ +--- +# Infrastructure +# Ansible instructions to deploy the infrastructure +# Copyright (C) 2019-2020 Christoph (Sheogorath) Kern +# Copyright (C) 2019-2020 Alexander (w4tsn) Wellbrock +# Copyright (C) 2021 Saibotk +# +# This program is free software: you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation, version 3 of the License. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see . +# + +version: '2' +services: + delegate: + image: docker.io/library/nginx:{{ matrix_delegate_nginx_image_version }} + mem_limit: 256mb + memswap_limit: 512mb + read_only: true + tmpfs: + - "/var/cache/nginx:size=10M" + - "/run/nginx:size=512K" + - "/tmp:size=128K" + security_opt: + - no-new-privileges + volumes: + - "{{ matrix_delegate_install_location }}/server-delegation.json:/usr/share/nginx/html/.well-known/matrix/server:ro" + - "{{ matrix_delegate_install_location }}/client-delegation.json:/usr/share/nginx/html/.well-known/matrix/client:ro" + - "{{ matrix_delegate_install_location }}/nginx.conf:/etc/nginx/nginx.conf:ro" + labels: + - "traefik.enable=true" + + - "traefik.http.routers.matrix-delegate.rule=Host(`{{ matrix_delegate_domain }}`) && PathPrefix(`/.well-known/matrix`)" + - "traefik.http.routers.matrix-delegate.entrypoints=websecure" + - "traefik.http.routers.matrix-delegate.tls.certresolver={{ matrix_delegate_traefik_certresolver }}" + - "traefik.http.routers.matrix-delegate.middlewares=matrix-delegate,compress" + - "traefik.http.middlewares.matrix-delegate.headers.sslredirect=true" + - "traefik.http.middlewares.matrix-delegate.headers.stsSeconds=63072000" + - "traefik.http.middlewares.matrix-delegate.headers.referrerPolicy=no-referrer" + +{% if proxy_network is defined %} + - "traefik.docker.network={{ proxy_network }}" +{% endif %} +{% if proxy_hiddenservice is defined and proxy_hiddenservice.content is defined %} + - "traefik.http.middlewares.matrix-delegate.headers.customresponseheaders.alt-svc:h2={{ proxy_hiddenservice['content'] | b64decode | trim }}:443; ma=2592000" +{% endif %} + restart: always +{% if proxy_network is defined %} + networks: + {{ proxy_network }}: +{% endif %} + +{% if proxy_network is defined %} +networks: + {{ proxy_network }}: + external: true +{% endif %} diff --git a/roles/matrix_delegate/templates/server-delegation.json b/roles/matrix_delegate/templates/server-delegation.json new file mode 100644 index 0000000..5c38d85 --- /dev/null +++ b/roles/matrix_delegate/templates/server-delegation.json @@ -0,0 +1,3 @@ +{ + "m.server": "{{ matrix_delegate_matrix_domain }}:443" +}