diff --git a/playbooks/matrix_delegate.yml b/playbooks/matrix_delegate.yml
new file mode 100644
index 0000000..b1fa2e4
--- /dev/null
+++ b/playbooks/matrix_delegate.yml
@@ -0,0 +1,27 @@
+---
+
+# Infrastructure
+# Ansible instructions to deploy the infrastructure
+# Copyright (C) 2021 Saibotk
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, version 3 of the License.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program. If not, see .
+
+- hosts: matrix_delegate
+ roles:
+ - docker
+ - docker_compose
+ - docker_cleanup
+ - traefik
+ - matrix_delegate
+ environment:
+ PYTHONPATH: /opt/ansible-dependencies/lib/python{{ env_ansible_deps_python_version | default(2.7) }}/site-packages
diff --git a/playbooks/site.yml b/playbooks/site.yml
index 97f4b8e..50cd718 100644
--- a/playbooks/site.yml
+++ b/playbooks/site.yml
@@ -28,6 +28,7 @@
- import_playbook: mastodon.yml
- import_playbook: codimd.yml
- import_playbook: matrix.yml
+- import_playbook: matrix_delegate.yml
- import_playbook: matrix_elementweb.yml
- import_playbook: matrix_webhooks.yml
- import_playbook: matrix_maubot.yml
diff --git a/roles/matrix_delegate/README.md b/roles/matrix_delegate/README.md
new file mode 100644
index 0000000..c5e7a38
--- /dev/null
+++ b/roles/matrix_delegate/README.md
@@ -0,0 +1,35 @@
+Matrix_delegate
+=========
+
+This will setup a small Matrix delegate nginx server using docker and traefik as a reverse proxy.
+
+Requirements
+------------
+
+You will need to have docker, docker-compose and traefik installed or declared as dependencies with their respective roles.
+
+**This role assumes that you have setup traefik with an endpoint called `websecure`.**
+
+Role Variables
+--------------
+
+**Please look at the [defaults/main.yml](defaults/main.yml) for all available variables and their description.**
+
+**Note: Lines that are commented out via `#` are usually still valid/used variables, but they are not defined by default, so they might enable a feature, when uncommenting/defining them!**
+
+### Global variables, that are used:
+
+- `proxy_network`: Defined by the local traefik installation, this is the shared proxy network used by traefik to reach the containers. (optional)
+- `proxy_hiddenservice`: Defined by the local traefik installation, this is used to generate the alt-svc header for the alternative Tor domain. (optional)
+
+Dependencies
+------------
+
+- docker
+- docker-compose
+- traefik
+
+License
+-------
+
+GPL-3.0-only
diff --git a/roles/matrix_delegate/defaults/main.yml b/roles/matrix_delegate/defaults/main.yml
new file mode 100644
index 0000000..0b7a002
--- /dev/null
+++ b/roles/matrix_delegate/defaults/main.yml
@@ -0,0 +1,39 @@
+---
+# Default variables for the matrix_delegate role
+
+# Infrastructure
+# Ansible instructions to deploy the infrastructure
+# Copyright (C) 2021 Saibotk
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, version 3 of the License.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program. If not, see .
+#
+
+# The install location
+matrix_delegate_install_location: /srv/matrix_delegate
+
+# The certresolver that is used by traefik for this domain
+matrix_delegate_traefik_certresolver: letsencrypt_http
+
+# The domain that traefik will serve the delegate under
+# NOTE: This should be the same as the servername (right side of user ids).
+matrix_delegate_domain: example.com
+
+# The domain that the matrix homeserver is actually available under
+matrix_delegate_matrix_domain: matrix.example.com
+
+# Container versions
+# renovate: depName=docker.io/library/nginx
+matrix_delegate_nginx_version: "1.21"
+
+# Container tag definitions
+matrix_delegate_nginx_image_version: "{{ matrix_delegate_nginx_version }}-alpine"
diff --git a/roles/matrix_delegate/handlers/main.yml b/roles/matrix_delegate/handlers/main.yml
new file mode 100644
index 0000000..d3a6bb1
--- /dev/null
+++ b/roles/matrix_delegate/handlers/main.yml
@@ -0,0 +1,32 @@
+---
+# Handlers file for the matrix_delegate role
+
+# Infrastructure
+# Ansible instructions to deploy the infrastructure
+# Copyright (C) 2019-2020 Alexander (w4tsn) Wellbrock
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, version 3 of the License.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program. If not, see .
+#
+
+- name: restart matrix delegate nginx
+ docker_compose:
+ services:
+ - delegate
+ state: present
+ project_src: "{{ matrix_delegate_install_location }}"
+ restarted: true
+ tags:
+ - docker
+ - matrix
+ - delegate
+ become: true
diff --git a/roles/matrix_delegate/meta/main.yml b/roles/matrix_delegate/meta/main.yml
new file mode 100644
index 0000000..8fb26e9
--- /dev/null
+++ b/roles/matrix_delegate/meta/main.yml
@@ -0,0 +1,17 @@
+galaxy_info:
+ author: saibotk
+ description: Deploys a matrix delegate server via docker using traefik.
+ license: GPL-3.0-only
+ min_ansible_version: 2.9
+
+ platforms:
+ - name: CentOS
+ versions:
+ - 7
+
+ galaxy_tags: []
+
+dependencies:
+ - docker
+ - docker_compose
+ - traefik
diff --git a/roles/matrix_delegate/tasks/main.yml b/roles/matrix_delegate/tasks/main.yml
new file mode 100644
index 0000000..2bb2dd7
--- /dev/null
+++ b/roles/matrix_delegate/tasks/main.yml
@@ -0,0 +1,89 @@
+---
+# Tasks file for the matrix_delegate role
+
+# Infrastructure
+# Ansible instructions to deploy the infrastructure
+# Copyright (C) 2019-2020 Christoph (Sheogorath) Kern
+# Copyright (C) 2019-2020 Alexander (w4tsn) Wellbrock
+# Copyright (C) 2021 Saibotk
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, version 3 of the License.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program. If not, see .
+#
+
+- name: Create install directory
+ file:
+ path: "{{ item }}"
+ state: directory
+ mode: '0700'
+ owner: 'root'
+ group: 'root'
+ with_items:
+ - "{{ matrix_delegate_install_location }}"
+ become: true
+
+- name: Deploy docker-compose.yml
+ template:
+ src: "docker-compose.yml"
+ dest: "{{ matrix_delegate_install_location }}/docker-compose.yml"
+ mode: '0600'
+ owner: 'root'
+ group: 'root'
+ validate: docker-compose -f %s config -q
+ tags:
+ - matrix
+ - delegate
+ become: true
+
+- name: Deploy delegation config files
+ template:
+ src: "{{ item }}"
+ dest: "{{ matrix_delegate_install_location }}/{{ item }}"
+ setype: "container_file_t"
+ mode: '0644'
+ owner: 'root'
+ group: 'root'
+ with_items:
+ - "server-delegation.json"
+ - "client-delegation.json"
+ tags:
+ - docker
+ - matrix
+ - delegate
+ become: true
+
+- name: Deploy nginx delegate config
+ template:
+ src: "delegate-nginx.conf"
+ dest: "{{ matrix_delegate_install_location }}/nginx.conf"
+ setype: "container_file_t"
+ mode: '0600'
+ owner: 'root'
+ group: 'root'
+ tags:
+ - docker
+ - matrix
+ - delegate
+ notify: restart matrix delegate nginx
+ become: true
+
+- name: Compose matrix_delegate
+ docker_compose:
+ state: present
+ project_src: "{{ matrix_delegate_install_location }}"
+ pull: true
+ remove_orphans: true
+ tags:
+ - docker
+ - matrix
+ - delegate
+ become: true
diff --git a/roles/matrix_delegate/templates/client-delegation.json b/roles/matrix_delegate/templates/client-delegation.json
new file mode 100644
index 0000000..d8e15b9
--- /dev/null
+++ b/roles/matrix_delegate/templates/client-delegation.json
@@ -0,0 +1,5 @@
+{
+ "m.homeserver": {
+ "base_url": "https://{{ matrix_delegate_matrix_domain }}"
+ }
+}
diff --git a/roles/matrix_delegate/templates/delegate-nginx.conf b/roles/matrix_delegate/templates/delegate-nginx.conf
new file mode 100644
index 0000000..bdcc2dd
--- /dev/null
+++ b/roles/matrix_delegate/templates/delegate-nginx.conf
@@ -0,0 +1,74 @@
+{{ ansible_managed | comment }}
+
+# From https://git.shivering-isles.com/w4tsn/infrastructure/-/blob/2d8d03a025b833e11533fa8610cc77cff7a59bb9/roles/matrix/templates/delegate-nginx.conf.j2
+
+# Infrastructure
+# Ansible instructions to deploy the infrastructure
+# Copyright (C) 2019-2020 Alexander (w4tsn) Wellbrock
+# Copyright (C) 2020 Saibotk
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, version 3 of the License.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program. If not, see .
+#
+
+worker_processes 1;
+
+error_log stderr;
+
+pid /tmp/nginx.pid;
+
+events {
+ worker_connections 1024;
+}
+
+http {
+ include /etc/nginx/mime.types;
+ default_type application/octet-stream;
+
+ access_log off;
+
+ # Turn off the bloody buffering to temp files
+ proxy_buffering off;
+
+ sendfile on;
+ keepalive_timeout 120;
+
+ gzip on;
+ gzip_types text/plain application/json;
+
+ server_names_hash_bucket_size 128;
+
+ # These two should be the same or nginx will start writing
+ # large request bodies to temp files
+ client_body_buffer_size 10m;
+ client_max_body_size 10m;
+
+ server {
+ listen 80;
+ server_name localhost;
+ server_tokens off;
+ set_real_ip_from 10.0.0.0/8;
+ set_real_ip_from 172.16.0.0/12;
+
+ location /.well-known/matrix {
+ root /usr/share/nginx/html;
+ {#
+ A somewhat long expires value is used to prevent outages
+ in case this is unreachable due to network failure or
+ due to the base domain's server completely dying.
+ #}
+ expires 4h;
+ default_type application/json;
+ add_header Access-Control-Allow-Origin *;
+ }
+ }
+}
diff --git a/roles/matrix_delegate/templates/docker-compose.yml b/roles/matrix_delegate/templates/docker-compose.yml
new file mode 100644
index 0000000..d485feb
--- /dev/null
+++ b/roles/matrix_delegate/templates/docker-compose.yml
@@ -0,0 +1,65 @@
+---
+# Infrastructure
+# Ansible instructions to deploy the infrastructure
+# Copyright (C) 2019-2020 Christoph (Sheogorath) Kern
+# Copyright (C) 2019-2020 Alexander (w4tsn) Wellbrock
+# Copyright (C) 2021 Saibotk
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, version 3 of the License.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program. If not, see .
+#
+
+version: '2'
+services:
+ delegate:
+ image: docker.io/library/nginx:{{ matrix_delegate_nginx_image_version }}
+ mem_limit: 256mb
+ memswap_limit: 512mb
+ read_only: true
+ tmpfs:
+ - "/var/cache/nginx:size=10M"
+ - "/run/nginx:size=512K"
+ - "/tmp:size=128K"
+ security_opt:
+ - no-new-privileges
+ volumes:
+ - "{{ matrix_delegate_install_location }}/server-delegation.json:/usr/share/nginx/html/.well-known/matrix/server:ro"
+ - "{{ matrix_delegate_install_location }}/client-delegation.json:/usr/share/nginx/html/.well-known/matrix/client:ro"
+ - "{{ matrix_delegate_install_location }}/nginx.conf:/etc/nginx/nginx.conf:ro"
+ labels:
+ - "traefik.enable=true"
+
+ - "traefik.http.routers.matrix-delegate.rule=Host(`{{ matrix_delegate_domain }}`) && PathPrefix(`/.well-known/matrix`)"
+ - "traefik.http.routers.matrix-delegate.entrypoints=websecure"
+ - "traefik.http.routers.matrix-delegate.tls.certresolver={{ matrix_delegate_traefik_certresolver }}"
+ - "traefik.http.routers.matrix-delegate.middlewares=matrix-delegate,compress"
+ - "traefik.http.middlewares.matrix-delegate.headers.sslredirect=true"
+ - "traefik.http.middlewares.matrix-delegate.headers.stsSeconds=63072000"
+ - "traefik.http.middlewares.matrix-delegate.headers.referrerPolicy=no-referrer"
+
+{% if proxy_network is defined %}
+ - "traefik.docker.network={{ proxy_network }}"
+{% endif %}
+{% if proxy_hiddenservice is defined and proxy_hiddenservice.content is defined %}
+ - "traefik.http.middlewares.matrix-delegate.headers.customresponseheaders.alt-svc:h2={{ proxy_hiddenservice['content'] | b64decode | trim }}:443; ma=2592000"
+{% endif %}
+ restart: always
+{% if proxy_network is defined %}
+ networks:
+ {{ proxy_network }}:
+{% endif %}
+
+{% if proxy_network is defined %}
+networks:
+ {{ proxy_network }}:
+ external: true
+{% endif %}
diff --git a/roles/matrix_delegate/templates/server-delegation.json b/roles/matrix_delegate/templates/server-delegation.json
new file mode 100644
index 0000000..5c38d85
--- /dev/null
+++ b/roles/matrix_delegate/templates/server-delegation.json
@@ -0,0 +1,3 @@
+{
+ "m.server": "{{ matrix_delegate_matrix_domain }}:443"
+}