diff --git a/roles/matrix_maubot/README.md b/roles/matrix_maubot/README.md new file mode 100644 index 0000000..45a85fc --- /dev/null +++ b/roles/matrix_maubot/README.md @@ -0,0 +1,37 @@ +Matrix-maubot +========= + +This will setup a Matrix Maubot instance using their official docker container and traefik as a reverse proxy. + +Requirements +------------ + +You will need to have docker, docker-compose and traefik installed or declared as dependencies with their respective roles. + +**This role assumes that you have setup traefik with an endpoint called `websecure`.** + +**You will also need to manually setup the services configuration file!** + +Role Variables +-------------- + +**Please look at the [defaults/main.yml](defaults/main.yml) for all available variables and their description.** + +**Note: Lines that are commented out via `#` are usually still valid/used variables, but they are not defined by default, so they might enable a feature, when uncommenting/defining them!** + +### Global variables, that are used: + +- `proxy_network`: Defined by the local traefik installation, this is the shared proxy network used by traefik to reach the containers. (optional) +- `proxy_hiddenservice`: Defined by the local traefik installation, this is used to generate the alt-svc header for the alternative Tor domain. (optional) + +Dependencies +------------ + +- docker +- docker-compose +- traefik + +License +------- + +GPL-3.0-only diff --git a/roles/matrix_maubot/defaults/main.yml b/roles/matrix_maubot/defaults/main.yml new file mode 100644 index 0000000..e423348 --- /dev/null +++ b/roles/matrix_maubot/defaults/main.yml @@ -0,0 +1,48 @@ +--- +# Default variables for the matrix_maubot role + +# Infrastructure +# Ansible instructions to deploy the infrastructure +# Copyright (C) 2021 Saibotk +# +# This program is free software: you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation, version 3 of the License. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see . +# + +# The install location +matrix_maubot_install_location: /srv/matrix-maubot + +# The container data volume mount locations +matrix_maubot_data_location: "{{ matrix_maubot_install_location}}/data" +matrix_maubot_database_location: "{{ matrix_maubot_install_location}}/database" + +# The certresolver that is used by traefik for this domain +matrix_maubot_traefik_certresolver: letsencrypt_http + +# The domain that traefik will server maubot under +matrix_maubot_domain: "maubot.example.com" + +# The database password to use +matrix_maubot_database_password: "{{ lookup('passwordstore', matrix_maubot_domain + '/db create=true length=42') }}" + +# Container versions +# renovate: depName=dock.mau.dev/maubot/maubot +matrix_maubot_version: "latest" +# renovate: depName=docker.io/library/postgres +matrix_maubot_database_version: "13.4" + +# Container tag definitions +matrix_maubot_image_version: "{{ matrix_maubot_version }}" +matrix_maubot_database_image_version: "{{ matrix_maubot_database_version }}-alpine" + +# Enable or disable selinux handling +matrix_selinux_enabled: true diff --git a/roles/matrix_maubot/meta/main.yml b/roles/matrix_maubot/meta/main.yml new file mode 100644 index 0000000..95d4c47 --- /dev/null +++ b/roles/matrix_maubot/meta/main.yml @@ -0,0 +1,17 @@ +galaxy_info: + author: saibotk + description: Deploys a matrix maubot server via docker using traefik. + license: GPL-3.0-only + min_ansible_version: 2.9 + + platforms: + - name: CentOS + versions: + - 7 + + galaxy_tags: [] + +dependencies: + - docker + - docker_compose + - traefik diff --git a/roles/matrix_maubot/tasks/main.yml b/roles/matrix_maubot/tasks/main.yml new file mode 100644 index 0000000..9a53aa5 --- /dev/null +++ b/roles/matrix_maubot/tasks/main.yml @@ -0,0 +1,79 @@ +--- +# Tasks file for the matrix-maubot role + +# Infrastructure +# Ansible instructions to deploy the infrastructure +# Copyright (C) 2019-2020 Christoph (Sheogorath) Kern +# Copyright (C) 2019-2020 Alexander (w4tsn) Wellbrock +# Copyright (C) 2020-2021 Saibotk +# +# This program is free software: you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation, version 3 of the License. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see . +# + +- name: Update default SELinux contexts + sefcontext: + target: '{{ item }}(/.*)?' + setype: "container_file_t" + state: present + with_items: + - "{{ matrix_maubot_database_location }}" + - "{{ matrix_maubot_data_location }}" + when: + - matrix_selinux_enabled + become: true + +- name: Create install directory + file: + path: "{{ item }}" + state: directory + mode: '0700' + owner: 'root' + group: 'root' + with_items: + - "{{ matrix_maubot_install_location }}" + become: true + +- name: Create data directory + file: # noqa risky-file-permissions # Container manages permissions on its own + path: "{{ item }}" + state: directory + setype: "container_file_t" + with_items: + - "{{ matrix_maubot_database_location }}" + - "{{ matrix_maubot_data_location }}" + become: true + +- name: Deploy docker-compose.yml + template: + src: "docker-compose.yml" + dest: "{{ matrix_maubot_install_location }}/docker-compose.yml" + mode: '0600' + owner: 'root' + group: 'root' + validate: docker-compose -f %s config -q + tags: + - matrix + - maubot + become: true + +- name: Compose matrix-maubot + docker_compose: + state: present + project_src: "{{ matrix_maubot_install_location }}" + pull: true + remove_orphans: true + tags: + - docker + - matrix + - maubot + become: true diff --git a/roles/matrix_maubot/templates/docker-compose.yml b/roles/matrix_maubot/templates/docker-compose.yml new file mode 100644 index 0000000..de19947 --- /dev/null +++ b/roles/matrix_maubot/templates/docker-compose.yml @@ -0,0 +1,87 @@ +--- +# Infrastructure +# Ansible instructions to deploy the infrastructure +# Copyright (C) 2019-2020 Christoph (Sheogorath) Kern +# Copyright (C) 2021 Saibotk +# +# This program is free software: you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation, version 3 of the License. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see . +# + +version: '2' +services: + maubot: + image: dock.mau.dev/maubot/maubot:{{ matrix_maubot_image_version }} + mem_limit: 256mb + memswap_limit: 512mb + restart: always + security_opt: + - no-new-privileges + volumes: + - "{{ matrix_maubot_data_location }}:/data" + depends_on: + - database + labels: + - "traefik.http.routers.matrix-maubot.rule=Host(`{{ matrix_maubot_domain }}`) && PathPrefix(`/_matrix/maubot`)" + - "traefik.http.routers.matrix-maubot.entrypoints=websecure" + - "traefik.http.routers.matrix-maubot.tls.certresolver={{ matrix_maubot_traefik_certresolver }}" + - "traefik.http.routers.matrix-maubot.middlewares=matrix-maubot,compress" + - "traefik.http.routers.matrix-maubot.service=matrix-maubot" + - "traefik.http.services.matrix-maubot.loadbalancer.server.port=29316" + - "traefik.http.middlewares.matrix-maubot.headers.sslredirect=true" + - "traefik.http.middlewares.matrix-maubot.headers.stsSeconds=63072000" + - "traefik.http.middlewares.matrix-maubot.headers.referrerPolicy=no-referrer" + + - "traefik.enable=true" +{% if proxy_network is defined %} + - "traefik.docker.network={{ proxy_network }}" + +{% endif %} +{% if proxy_hiddenservice is defined and proxy_hiddenservice.content is defined %} + - "traefik.http.middlewares.matrix-maubot.headers.customresponseheaders.alt-svc=h2={{ proxy_hiddenservice['content'] | b64decode | trim }}:443; ma=2592000" +{% endif %} + + networks: + database: +{% if proxy_network is defined %} + {{ proxy_network }}: +{% endif %} + + database: + image: docker.io/library/postgres:{{ matrix_maubot_database_image_version }} + mem_limit: 512mb + memswap_limit: 768mb + read_only: true + security_opt: + - no-new-privileges + tmpfs: + - /run/postgresql:size=512K + - /tmp:size=128K + stop_grace_period: 2m + stop_signal: SIGINT + environment: + - "POSTGRES_USER=maubot" + - "POSTGRES_PASSWORD={{ matrix_maubot_database_password }}" + - "POSTGRES_INITDB_ARGS=--lc-collate C --lc-ctype C --encoding UTF8" + volumes: + - "{{ matrix_maubot_database_location }}:/var/lib/postgresql/data" + networks: + database: + restart: always + +networks: + database: + internal: true +{% if proxy_network is defined %} + {{ proxy_network }}: + external: true +{% endif %}