playbooks/matrix.yml

@@ -0,0 +1,24 @@
+---
+# Infrastructure
+# Ansible instructions to deploy the infrastructure
+# Copyright (C) 2020       Saibotk
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, version 3 of the License.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+- name: Install & configure Matrix
+  hosts: matrix
+  roles:
+    - docker
+    - docker_cleanup
+    - traefik
+    - matrix

playbooks/matrix_delegate.yml

@@ -0,0 +1,24 @@
+---
+# Infrastructure
+# Ansible instructions to deploy the infrastructure
+# Copyright (C) 2021       Saibotk
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, version 3 of the License.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+- name: Install & configure Matrix Delegate
+  hosts: matrix_delegate
+  roles:
+    - docker
+    - docker_cleanup
+    - traefik
+    - matrix_delegate

playbooks/matrix_maubot.yml

@@ -0,0 +1,24 @@
+---
+# Infrastructure
+# Ansible instructions to deploy the infrastructure
+# Copyright (C) 2021       Saibotk
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, version 3 of the License.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+- name: Install & configure Mauboot
+  hosts: matrix_maubot
+  roles:
+    - docker
+    - docker_cleanup
+    - traefik
+    - matrix_maubot

playbooks/matrix_sliding_sync.yml

@@ -0,0 +1,24 @@
+---
+# Infrastructure
+# Ansible instructions to deploy the infrastructure
+# Copyright (C) 2023       Saibotk
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, version 3 of the License.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+- name: Install & configure Matrix Sliding Sync
+  hosts: matrix_sliding_sync
+  roles:
+    - docker
+    - docker_cleanup
+    - traefik
+    - matrix_sliding_sync

playbooks/matrix_webhooks.yml

@@ -0,0 +1,24 @@
+---
+# Infrastructure
+# Ansible instructions to deploy the infrastructure
+# Copyright (C) 2021       Saibotk
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, version 3 of the License.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+- name: Install & configure Matrix Webhooks
+  hosts: matrix_webhooks
+  roles:
+    - docker
+    - docker_cleanup
+    - traefik
+    - matrix_webhooks

playbooks/synapse.yml

@@ -1,17 +0,0 @@
-- name: Install Synapse.
-
-  hosts: synapse
-
-  roles:
-    - role: podman
-      become: true
-      tags:
-        - always
-        - podman
-    - role: caddy
-      become: true
-      tags:
-        - always
-        - caddy
-    - role: synapse
-      become: true

roles/matrix/README.md

@@ -0,0 +1,36 @@
+Matrix
+=========
+
+This will setup a Matrix (Synapse) instance using their official docker container and traefik as a reverse proxy.
+Additionally, you may need to configure delegation, to do so take a look at the matrix_delegation role.
+
+Requirements
+------------
+
+You will need to have docker, docker-compose and traefik installed or declared as dependencies with their respective roles.
+
+**This role assumes that you have setup traefik with an endpoint called `websecure`.**
+
+Role Variables
+--------------
+
+**Please look at the [defaults/main.yml](defaults/main.yml) for all available variables and their description.**
+
+**Note: Lines that are commented out via `#` are usually still valid/used variables, but they are not defined by default, so they might enable a feature, when uncommenting/defining them!**  
+
+### Global variables, that are used:
+
+- `proxy_network`: Defined by the local traefik installation, this is the shared proxy network used by traefik to reach the containers. (optional)
+- `proxy_hiddenservice`: Defined by the local traefik installation, this is used to generate the alt-svc header for the alternative Tor domain. (optional)
+
+Dependencies
+------------
+
+- docker
+- docker-compose
+- traefik
+
+License
+-------
+
+GPL-3.0-only

roles/matrix/defaults/main.yml

@@ -0,0 +1,55 @@
+---
+# Default variables for the matrix role
+
+# Infrastructure
+# Ansible instructions to deploy the infrastructure
+# Copyright (C) 2019-2020  Christoph (Sheogorath) Kern
+# Copyright (C) 2021       Saibotk
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, version 3 of the License.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+#
+
+# The install location
+matrix_install_location: /srv/matrix
+
+# The container data volume mount locations
+matrix_data_location: "{{ matrix_install_location }}/data"
+matrix_database_location: "{{ matrix_install_location }}/database"
+
+# The certresolver that is used by traefik for this domain
+matrix_traefik_certresolver: letsencrypt_http
+
+# The domain that traefik will server synapse under
+matrix_synapse_servername: matrix.example.com
+matrix_synapse_domain: "{{ matrix_synapse_servername }}"
+
+# Additional synapse ENV options (keys will automatically be prefixed with SYNAPSE_)
+# see https://github.com/matrix-org/synapse/tree/develop/docker#generating-a-configuration-file
+# Note: Some keys are needed for generating the initial config file like "SYNAPSE_REPORT_STATS" and "SYNAPSE_SERVER_NAME"!
+matrix_synapse_options: {}
+
+# The database password to use
+matrix_database_password: "{{ lookup('passwordstore', matrix_synapse_domain + '/db create=true length=42') }}"
+
+# Container versions
+# renovate: depName=docker.io/matrixdotorg/synapse
+matrix_synapse_version: "1.118.0"
+# renovate: depName=docker.io/library/postgres
+matrix_database_version: "13.16"
+
+# Container tag definitions
+matrix_synapse_image_version: "v{{ matrix_synapse_version }}"
+matrix_database_image_version: "{{ matrix_database_version }}-alpine"
+
+# Enable or disable selinux handling
+matrix_selinux_enabled: true

roles/matrix/meta/main.yml

@@ -0,0 +1,44 @@
+galaxy_info:
+  author: saibotk
+  description: "Deploys a matrix server via docker using traefik."
+  license: GPL-3.0-only
+  min_ansible_version: "2.9"
+  standalone: true
+
+  platforms:
+    - name: EL
+      versions:
+        - all
+    - name: GenericUNIX
+      versions:
+        - all
+    - name: Fedora
+      versions:
+        - all
+    - name: opensuse
+      versions:
+        - all
+    - name: GenericBSD
+      versions:
+        - all
+    - name: FreeBSD
+      versions:
+        - all
+    - name: Ubuntu
+      versions:
+        - all
+    - name: SLES
+      versions:
+        - all
+    - name: GenericLinux
+      versions:
+        - all
+    - name: Debian
+      versions:
+        - all
+
+  galaxy_tags: []
+
+dependencies:
+  - role: docker
+  - role: traefik

roles/matrix/tasks/main.yml

@@ -0,0 +1,98 @@
+---
+# Tasks file for the matrix role
+
+# Infrastructure
+# Ansible instructions to deploy the infrastructure
+# Copyright (C) 2019-2020  Christoph (Sheogorath) Kern
+# Copyright (C) 2019-2020  Alexander (w4tsn) Wellbrock
+# Copyright (C) 2020       Saibotk
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, version 3 of the License.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+#
+
+- name: Update default SELinux contexts
+  community.general.sefcontext:
+    target: "{{ item }}(/.*)?"
+    setype: "container_file_t"
+    state: present
+  with_items:
+    - "{{ matrix_database_location }}"
+    - "{{ matrix_data_location }}"
+  when:
+    - matrix_selinux_enabled
+  become: true
+
+- name: Create install directory
+  ansible.builtin.file:
+    path: "{{ item }}"
+    state: directory
+    mode: "0700"
+    owner: "root"
+    group: "root"
+  with_items:
+    - "{{ matrix_install_location }}"
+  become: true
+
+- name: Create data directory
+  ansible.builtin.file: # noqa risky-file-permissions # Container manages permissions on its own
+    path: "{{ item }}"
+    state: directory
+    setype: "container_file_t"
+  with_items:
+    - "{{ matrix_database_location }}"
+    - "{{ matrix_data_location }}"
+  become: true
+
+- name: Deploy docker-compose.yml
+  ansible.builtin.template:
+    src: "docker-compose.yml"
+    dest: "{{ matrix_install_location }}/docker-compose.yml"
+    mode: "0600"
+    owner: "root"
+    group: "root"
+    validate: docker compose -f %s config -q
+  tags:
+    - matrix
+  become: true
+
+- name: Check if homeserver.yaml (config) exists
+  ansible.builtin.stat:
+    path: "{{ matrix_data_location }}/homeserver.yaml"
+  register: matrix_synapse_homeserver_yaml
+  tags:
+    - docker
+    - matrix
+  become: true
+
+- name: Generate synapse config
+  ansible.builtin.command: 'docker-compose run -e "SYNAPSE_SERVER_NAME={{ matrix_synapse_servername }}" synapse generate'
+  args:
+    chdir: "{{ matrix_install_location }}"
+    creates: "{{ matrix_data_location }}/homeserver.yaml"
+  tags:
+    - docker
+    - matrix
+  become: true
+  when:
+    - not matrix_synapse_homeserver_yaml.stat.exists
+
+- name: Compose matrix
+  community.docker.docker_compose_v2:
+    state: present
+    project_src: "{{ matrix_install_location }}"
+    pull: always
+    remove_orphans: true
+  tags:
+    - docker
+    - matrix
+  become: true

roles/matrix/templates/docker-compose.yml

@@ -0,0 +1,101 @@
+---
+# Infrastructure
+# Ansible instructions to deploy the infrastructure
+# Copyright (C) 2019-2020  Christoph (Sheogorath) Kern
+# Copyright (C) 2019-2020  Alexander (w4tsn) Wellbrock
+# Copyright (C) 2021       Saibotk
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, version 3 of the License.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+#
+
+version: '2'
+services:
+  synapse:
+    image: docker.io/matrixdotorg/synapse:{{ matrix_synapse_image_version }}
+    cpu_shares: 256
+    mem_limit: 1280mb
+    memswap_limit: 1536mb
+    read_only: true
+    restart: always
+    dns:
+      - "1.1.1.1"
+    security_opt:
+      - no-new-privileges
+    tmpfs:
+      - "/tmp:size=64M"
+      - "/compiled:size=128K"
+    environment:
+{% for key, value in matrix_synapse_options.items() %}
+      - "SYNAPSE_{{ key }}={{ value }}"
+{% endfor %}
+
+      - "POSTGRES_HOST=database"
+      - "POSTGRES_PASSWORD={{ matrix_database_password }}"
+    volumes:
+      - "{{ matrix_data_location }}:/data"
+    depends_on:
+      - database
+    labels:
+      - "traefik.http.routers.matrix.rule=Host(`{{ matrix_synapse_domain }}`) && PathPrefix(`/`)"
+      - "traefik.http.routers.matrix.entrypoints=websecure"
+      - "traefik.http.routers.matrix.tls.certresolver={{ matrix_traefik_certresolver }}"
+      - "traefik.http.routers.matrix.middlewares=matrix,compress"
+      - "traefik.http.routers.matrix.service=matrix"
+      - "traefik.http.services.matrix.loadbalancer.server.port=8008"
+      - "traefik.http.middlewares.matrix.headers.sslredirect=true"
+      - "traefik.http.middlewares.matrix.headers.stsSeconds=63072000"
+      - "traefik.http.middlewares.matrix.headers.referrerPolicy=no-referrer"
+
+      - "traefik.enable=true"
+{% if proxy_network is defined %}
+      - "traefik.docker.network={{ proxy_network }}"
+{% endif %}
+{% if proxy_hiddenservice is defined and proxy_hiddenservice.content is defined %}
+      - "traefik.http.middlewares.matrix.headers.customresponseheaders.alt-svc=h2={{ proxy_hiddenservice['content'] | b64decode | trim }}:443; ma=2592000"
+{% endif %}
+
+    networks:
+      database:
+{% if proxy_network is defined %}
+      {{ proxy_network }}:
+{% endif %}
+
+  database:
+    image: docker.io/library/postgres:{{ matrix_database_image_version }}
+    mem_limit: 512mb
+    memswap_limit: 768mb
+    read_only: true
+    security_opt:
+      - no-new-privileges
+    tmpfs:
+      - /run/postgresql:size=512K
+      - /tmp:size=128K
+    stop_grace_period: 2m
+    stop_signal: SIGINT
+    environment:
+      - "POSTGRES_USER=synapse"
+      - "POSTGRES_PASSWORD={{ matrix_database_password }}"
+      - "POSTGRES_INITDB_ARGS=--lc-collate C --lc-ctype C --encoding UTF8"
+    volumes:
+      - "{{ matrix_database_location }}:/var/lib/postgresql/data"
+    networks:
+      database:
+    restart: always
+
+networks:
+  database:
+    internal: true
+{% if proxy_network is defined %}
+  {{ proxy_network }}:
+    external: true
+{% endif %}

roles/matrix_delegate/README.md

@@ -0,0 +1,35 @@
+Matrix_delegate
+=========
+
+This will setup a small Matrix delegate nginx server using docker and traefik as a reverse proxy.
+
+Requirements
+------------
+
+You will need to have docker, docker-compose and traefik installed or declared as dependencies with their respective roles.
+
+**This role assumes that you have setup traefik with an endpoint called `websecure`.**
+
+Role Variables
+--------------
+
+**Please look at the [defaults/main.yml](defaults/main.yml) for all available variables and their description.**
+
+**Note: Lines that are commented out via `#` are usually still valid/used variables, but they are not defined by default, so they might enable a feature, when uncommenting/defining them!**  
+
+### Global variables, that are used:
+
+- `proxy_network`: Defined by the local traefik installation, this is the shared proxy network used by traefik to reach the containers. (optional)
+- `proxy_hiddenservice`: Defined by the local traefik installation, this is used to generate the alt-svc header for the alternative Tor domain. (optional)
+
+Dependencies
+------------
+
+- docker
+- docker-compose
+- traefik
+
+License
+-------
+
+GPL-3.0-only

roles/matrix_delegate/defaults/main.yml

@@ -0,0 +1,43 @@
+---
+# Default variables for the matrix_delegate role
+
+# Infrastructure
+# Ansible instructions to deploy the infrastructure
+# Copyright (C) 2021       Saibotk
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, version 3 of the License.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+#
+
+# The install location
+matrix_delegate_install_location: /srv/matrix_delegate
+
+# The certresolver that is used by traefik for this domain
+matrix_delegate_traefik_certresolver: letsencrypt_http
+
+# The domain that traefik will serve the delegate under
+# NOTE: This should be the same as the servername (right side of user ids).
+matrix_delegate_domain: example.com
+
+# The domain that the matrix homeserver is actually available under
+matrix_delegate_matrix_domain: matrix.example.com
+
+# The sliding sync proxy url to advertise
+matrix_delegate_sliding_sync_enabled: false
+matrix_delegate_sliding_sync_url: "https://{{ matrix_synapse_domain }}/sliding-sync"
+
+# Container versions
+# renovate: depName=docker.io/library/nginx
+matrix_delegate_nginx_version: "1.27"
+
+# Container tag definitions
+matrix_delegate_nginx_image_version: "{{ matrix_delegate_nginx_version }}-alpine"

roles/matrix_delegate/handlers/main.yml

@@ -0,0 +1,31 @@
+---
+# Handlers file for the matrix_delegate role
+
+# Infrastructure
+# Ansible instructions to deploy the infrastructure
+# Copyright (C) 2019-2020  Alexander (w4tsn) Wellbrock
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, version 3 of the License.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+#
+
+- name: Restart matrix delegate nginx
+  community.docker.docker_compose_v2:
+    services:
+      - delegate
+    state: restarted
+    project_src: "{{ matrix_delegate_install_location }}"
+  tags:
+    - docker
+    - matrix
+    - delegate
+  become: true

roles/matrix_delegate/meta/main.yml

@@ -0,0 +1,44 @@
+galaxy_info:
+  author: saibotk
+  description: "Deploys a matrix delegate server via docker using traefik."
+  license: GPL-3.0-only
+  min_ansible_version: "2.9"
+  standalone: true
+
+  platforms:
+    - name: EL
+      versions:
+        - all
+    - name: GenericUNIX
+      versions:
+        - all
+    - name: Fedora
+      versions:
+        - all
+    - name: opensuse
+      versions:
+        - all
+    - name: GenericBSD
+      versions:
+        - all
+    - name: FreeBSD
+      versions:
+        - all
+    - name: Ubuntu
+      versions:
+        - all
+    - name: SLES
+      versions:
+        - all
+    - name: GenericLinux
+      versions:
+        - all
+    - name: Debian
+      versions:
+        - all
+
+  galaxy_tags: []
+
+dependencies:
+  - role: docker
+  - role: traefik

roles/matrix_delegate/tasks/main.yml

@@ -0,0 +1,89 @@
+---
+# Tasks file for the matrix_delegate role
+
+# Infrastructure
+# Ansible instructions to deploy the infrastructure
+# Copyright (C) 2019-2020  Christoph (Sheogorath) Kern
+# Copyright (C) 2019-2020  Alexander (w4tsn) Wellbrock
+# Copyright (C) 2021       Saibotk
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, version 3 of the License.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+#
+
+- name: Create install directory
+  ansible.builtin.file:
+    path: "{{ item }}"
+    state: directory
+    mode: "0700"
+    owner: "root"
+    group: "root"
+  with_items:
+    - "{{ matrix_delegate_install_location }}"
+  become: true
+
+- name: Deploy docker-compose.yml
+  ansible.builtin.template:
+    src: "docker-compose.yml"
+    dest: "{{ matrix_delegate_install_location }}/docker-compose.yml"
+    mode: "0600"
+    owner: "root"
+    group: "root"
+    validate: docker compose -f %s config -q
+  tags:
+    - matrix
+    - delegate
+  become: true
+
+- name: Deploy delegation config files
+  ansible.builtin.template:
+    src: "{{ item }}"
+    dest: "{{ matrix_delegate_install_location }}/{{ item }}"
+    setype: "container_file_t"
+    mode: "0644"
+    owner: "root"
+    group: "root"
+  with_items:
+    - "server-delegation.json"
+    - "client-delegation.json"
+  tags:
+    - docker
+    - matrix
+    - delegate
+  become: true
+
+- name: Deploy nginx delegate config
+  ansible.builtin.template:
+    src: "delegate-nginx.conf"
+    dest: "{{ matrix_delegate_install_location }}/nginx.conf"
+    setype: "container_file_t"
+    mode: "0600"
+    owner: "root"
+    group: "root"
+  tags:
+    - docker
+    - matrix
+    - delegate
+  notify: Restart matrix delegate nginx
+  become: true
+
+- name: Compose matrix_delegate
+  community.docker.docker_compose_v2:
+    state: present
+    project_src: "{{ matrix_delegate_install_location }}"
+    pull: always
+    remove_orphans: true
+  tags:
+    - docker
+    - matrix
+    - delegate
+  become: true

roles/matrix_delegate/templates/client-delegation.json

@@ -0,0 +1,9 @@
+{
+    "m.homeserver": {
+      "base_url": "https://{{ matrix_delegate_matrix_domain }}"
+    }{% if matrix_delegate_sliding_sync_enabled %},
+    "org.matrix.msc3575.proxy": {
+		"url": "{{ matrix_delegate_sliding_sync_url }}"
+	}
+{% endif %}
+}

roles/matrix_delegate/templates/delegate-nginx.conf

@@ -0,0 +1,74 @@
+{{ ansible_managed | comment }}
+
+# From https://git.shivering-isles.com/w4tsn/infrastructure/-/blob/2d8d03a025b833e11533fa8610cc77cff7a59bb9/roles/matrix/templates/delegate-nginx.conf.j2
+
+# Infrastructure
+# Ansible instructions to deploy the infrastructure
+# Copyright (C) 2019-2020  Alexander (w4tsn) Wellbrock
+# Copyright (C) 2020       Saibotk
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, version 3 of the License.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+#
+
+worker_processes 1;
+
+error_log stderr;
+
+pid /tmp/nginx.pid;
+
+events {
+	worker_connections 1024;
+}
+
+http {
+  include           /etc/nginx/mime.types;
+  default_type      application/octet-stream;
+
+  access_log off;
+
+  # Turn off the bloody buffering to temp files
+  proxy_buffering off;
+
+  sendfile          on;
+  keepalive_timeout 120;
+
+  gzip              on;
+  gzip_types        text/plain application/json;
+
+  server_names_hash_bucket_size 128;
+
+  # These two should be the same or nginx will start writing
+  #  large request bodies to temp files
+  client_body_buffer_size 10m;
+  client_max_body_size    10m;
+
+  server {
+    listen 80;
+    server_name localhost;
+    server_tokens off;
+    set_real_ip_from 10.0.0.0/8;
+    set_real_ip_from 172.16.0.0/12;
+
+    location /.well-known/matrix {
+      root /usr/share/nginx/html;
+      {#
+        A somewhat long expires value is used to prevent outages
+        in case this is unreachable due to network failure or
+        due to the base domain's server completely dying.
+      #}
+      expires 4h;
+      default_type application/json;
+      add_header Access-Control-Allow-Origin *;
+    }
+  }
+}

roles/matrix_delegate/templates/docker-compose.yml

@@ -0,0 +1,65 @@
+---
+# Infrastructure
+# Ansible instructions to deploy the infrastructure
+# Copyright (C) 2019-2020  Christoph (Sheogorath) Kern
+# Copyright (C) 2019-2020  Alexander (w4tsn) Wellbrock
+# Copyright (C) 2021       Saibotk
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, version 3 of the License.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+#
+
+version: '2'
+services:
+  delegate:
+    image: docker.io/library/nginx:{{ matrix_delegate_nginx_image_version }}
+    mem_limit: 256mb
+    memswap_limit: 512mb
+    read_only: true
+    tmpfs:
+      - "/var/cache/nginx:size=10M"
+      - "/run/nginx:size=512K"
+      - "/tmp:size=128K"
+    security_opt:
+      - no-new-privileges
+    volumes:
+      - "{{ matrix_delegate_install_location }}/server-delegation.json:/usr/share/nginx/html/.well-known/matrix/server:ro"
+      - "{{ matrix_delegate_install_location }}/client-delegation.json:/usr/share/nginx/html/.well-known/matrix/client:ro"
+      - "{{ matrix_delegate_install_location }}/nginx.conf:/etc/nginx/nginx.conf:ro"
+    labels:
+      - "traefik.enable=true"
+
+      - "traefik.http.routers.matrix-delegate.rule=Host(`{{ matrix_delegate_domain }}`) && PathPrefix(`/.well-known/matrix`)"
+      - "traefik.http.routers.matrix-delegate.entrypoints=websecure"
+      - "traefik.http.routers.matrix-delegate.tls.certresolver={{ matrix_delegate_traefik_certresolver }}"
+      - "traefik.http.routers.matrix-delegate.middlewares=matrix-delegate,compress"
+      - "traefik.http.middlewares.matrix-delegate.headers.sslredirect=true"
+      - "traefik.http.middlewares.matrix-delegate.headers.stsSeconds=63072000"
+      - "traefik.http.middlewares.matrix-delegate.headers.referrerPolicy=no-referrer"
+
+{% if proxy_network is defined %}
+      - "traefik.docker.network={{ proxy_network }}"
+{% endif %}
+{% if proxy_hiddenservice is defined and proxy_hiddenservice.content is defined %}
+      - "traefik.http.middlewares.matrix-delegate.headers.customresponseheaders.alt-svc:h2={{ proxy_hiddenservice['content'] | b64decode | trim }}:443; ma=2592000"
+{% endif %}
+    restart: always
+{% if proxy_network is defined %}
+    networks:
+      {{ proxy_network }}:
+{% endif %}
+
+{% if proxy_network is defined %}
+networks:
+  {{ proxy_network }}:
+    external: true
+{% endif %}

roles/matrix_delegate/templates/server-delegation.json

@@ -0,0 +1,3 @@
+{
+  "m.server": "{{ matrix_delegate_matrix_domain }}:443"
+}

roles/matrix_maubot/README.md

@@ -0,0 +1,37 @@
+Matrix-maubot
+=========
+
+This will setup a Matrix Maubot instance using their official docker container and traefik as a reverse proxy.
+
+Requirements
+------------
+
+You will need to have docker, docker-compose and traefik installed or declared as dependencies with their respective roles.
+
+**This role assumes that you have setup traefik with an endpoint called `websecure`.**
+
+**You will also need to manually setup the services configuration file!**
+
+Role Variables
+--------------
+
+**Please look at the [defaults/main.yml](defaults/main.yml) for all available variables and their description.**
+
+**Note: Lines that are commented out via `#` are usually still valid/used variables, but they are not defined by default, so they might enable a feature, when uncommenting/defining them!**  
+
+### Global variables, that are used:
+
+- `proxy_network`: Defined by the local traefik installation, this is the shared proxy network used by traefik to reach the containers. (optional)
+- `proxy_hiddenservice`: Defined by the local traefik installation, this is used to generate the alt-svc header for the alternative Tor domain. (optional)
+
+Dependencies
+------------
+
+- docker
+- docker-compose
+- traefik
+
+License
+-------
+
+GPL-3.0-only

roles/matrix_maubot/defaults/main.yml

@@ -0,0 +1,48 @@
+---
+# Default variables for the matrix_maubot role
+
+# Infrastructure
+# Ansible instructions to deploy the infrastructure
+# Copyright (C) 2021       Saibotk
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, version 3 of the License.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+#
+
+# The install location
+matrix_maubot_install_location: /srv/matrix-maubot
+
+# The container data volume mount locations
+matrix_maubot_data_location: "{{ matrix_maubot_install_location }}/data"
+matrix_maubot_database_location: "{{ matrix_maubot_install_location }}/database"
+
+# The certresolver that is used by traefik for this domain
+matrix_maubot_traefik_certresolver: letsencrypt_http
+
+# The domain that traefik will server maubot under
+matrix_maubot_domain: "maubot.example.com"
+
+# The database password to use
+matrix_maubot_database_password: "{{ lookup('passwordstore', matrix_maubot_domain + '/db create=true length=42') }}"
+
+# Container versions
+# renovate: depName=dock.mau.dev/maubot/maubot
+matrix_maubot_version: "latest"
+# renovate: depName=docker.io/library/postgres
+matrix_maubot_database_version: "13.16"
+
+# Container tag definitions
+matrix_maubot_image_version: "{{ matrix_maubot_version }}"
+matrix_maubot_database_image_version: "{{ matrix_maubot_database_version }}-alpine"
+
+# Enable or disable selinux handling
+matrix_maubot_selinux_enabled: true

roles/matrix_maubot/meta/main.yml

@@ -0,0 +1,44 @@
+galaxy_info:
+  author: saibotk
+  description: "Deploys a matrix maubot server via docker using traefik."
+  license: GPL-3.0-only
+  min_ansible_version: "2.9"
+  standalone: true
+
+  platforms:
+    - name: EL
+      versions:
+        - all
+    - name: GenericUNIX
+      versions:
+        - all
+    - name: Fedora
+      versions:
+        - all
+    - name: opensuse
+      versions:
+        - all
+    - name: GenericBSD
+      versions:
+        - all
+    - name: FreeBSD
+      versions:
+        - all
+    - name: Ubuntu
+      versions:
+        - all
+    - name: SLES
+      versions:
+        - all
+    - name: GenericLinux
+      versions:
+        - all
+    - name: Debian
+      versions:
+        - all
+
+  galaxy_tags: []
+
+dependencies:
+  - role: docker
+  - role: traefik

roles/matrix_maubot/tasks/main.yml

@@ -0,0 +1,79 @@
+---
+# Tasks file for the matrix-maubot role
+
+# Infrastructure
+# Ansible instructions to deploy the infrastructure
+# Copyright (C) 2019-2020  Christoph (Sheogorath) Kern
+# Copyright (C) 2019-2020  Alexander (w4tsn) Wellbrock
+# Copyright (C) 2020-2021       Saibotk
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, version 3 of the License.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+#
+
+- name: Update default SELinux contexts
+  community.general.sefcontext:
+    target: "{{ item }}(/.*)?"
+    setype: "container_file_t"
+    state: present
+  with_items:
+    - "{{ matrix_maubot_database_location }}"
+    - "{{ matrix_maubot_data_location }}"
+  when:
+    - matrix_maubot_selinux_enabled
+  become: true
+
+- name: Create install directory
+  ansible.builtin.file:
+    path: "{{ item }}"
+    state: directory
+    mode: "0700"
+    owner: "root"
+    group: "root"
+  with_items:
+    - "{{ matrix_maubot_install_location }}"
+  become: true
+
+- name: Create data directory
+  ansible.builtin.file: # noqa risky-file-permissions # Container manages permissions on its own
+    path: "{{ item }}"
+    state: directory
+    setype: "container_file_t"
+  with_items:
+    - "{{ matrix_maubot_database_location }}"
+    - "{{ matrix_maubot_data_location }}"
+  become: true
+
+- name: Deploy docker-compose.yml
+  ansible.builtin.template:
+    src: "docker-compose.yml"
+    dest: "{{ matrix_maubot_install_location }}/docker-compose.yml"
+    mode: "0600"
+    owner: "root"
+    group: "root"
+    validate: docker compose -f %s config -q
+  tags:
+    - matrix
+    - maubot
+  become: true
+
+- name: Compose matrix-maubot
+  community.docker.docker_compose_v2:
+    state: present
+    project_src: "{{ matrix_maubot_install_location }}"
+    pull: always
+    remove_orphans: true
+  tags:
+    - docker
+    - matrix
+    - maubot
+  become: true

roles/matrix_maubot/templates/docker-compose.yml

@@ -0,0 +1,87 @@
+---
+# Infrastructure
+# Ansible instructions to deploy the infrastructure
+# Copyright (C) 2019-2020  Christoph (Sheogorath) Kern
+# Copyright (C) 2021       Saibotk
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, version 3 of the License.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+#
+
+version: '2'
+services:
+  maubot:
+    image: dock.mau.dev/maubot/maubot:{{ matrix_maubot_image_version }}
+    mem_limit: 256mb
+    memswap_limit: 512mb
+    restart: always
+    security_opt:
+      - no-new-privileges
+    volumes:
+      - "{{ matrix_maubot_data_location }}:/data"
+    depends_on:
+      - database
+    labels:
+      - "traefik.http.routers.matrix-maubot.rule=Host(`{{ matrix_maubot_domain }}`) && PathPrefix(`/_matrix/maubot`)"
+      - "traefik.http.routers.matrix-maubot.entrypoints=websecure"
+      - "traefik.http.routers.matrix-maubot.tls.certresolver={{ matrix_maubot_traefik_certresolver }}"
+      - "traefik.http.routers.matrix-maubot.middlewares=matrix-maubot,compress"
+      - "traefik.http.routers.matrix-maubot.service=matrix-maubot"
+      - "traefik.http.services.matrix-maubot.loadbalancer.server.port=29316"
+      - "traefik.http.middlewares.matrix-maubot.headers.sslredirect=true"
+      - "traefik.http.middlewares.matrix-maubot.headers.stsSeconds=63072000"
+      - "traefik.http.middlewares.matrix-maubot.headers.referrerPolicy=no-referrer"
+
+      - "traefik.enable=true"
+{% if proxy_network is defined %}
+      - "traefik.docker.network={{ proxy_network }}"
+
+{% endif %}
+{% if proxy_hiddenservice is defined and proxy_hiddenservice.content is defined %}
+      - "traefik.http.middlewares.matrix-maubot.headers.customresponseheaders.alt-svc=h2={{ proxy_hiddenservice['content'] | b64decode | trim }}:443; ma=2592000"
+{% endif %}
+
+    networks:
+      database:
+{% if proxy_network is defined %}
+      {{ proxy_network }}:
+{% endif %}
+
+  database:
+    image: docker.io/library/postgres:{{ matrix_maubot_database_image_version }}
+    mem_limit: 512mb
+    memswap_limit: 768mb
+    read_only: true
+    security_opt:
+      - no-new-privileges
+    tmpfs:
+      - /run/postgresql:size=512K
+      - /tmp:size=128K
+    stop_grace_period: 2m
+    stop_signal: SIGINT
+    environment:
+      - "POSTGRES_USER=maubot"
+      - "POSTGRES_PASSWORD={{ matrix_maubot_database_password }}"
+      - "POSTGRES_INITDB_ARGS=--lc-collate C --lc-ctype C --encoding UTF8"
+    volumes:
+      - "{{ matrix_maubot_database_location }}:/var/lib/postgresql/data"
+    networks:
+      database:
+    restart: always
+
+networks:
+  database:
+    internal: true
+{% if proxy_network is defined %}
+  {{ proxy_network }}:
+    external: true
+{% endif %}

roles/matrix_sliding_sync/README.md

@@ -0,0 +1,31 @@
+# Matrix Sliding Sync
+
+This will setup a Matrix Sliding Sync instance using their official docker container and traefik as a reverse proxy.
+Additionally, you may need to configure delegation, to do so take a look at the matrix_delegation role.
+
+## Requirements
+
+You will need to have docker, docker-compose and traefik installed or declared as dependencies with their respective roles.
+
+**This role assumes that you have setup traefik with an endpoint called `websecure`.**
+
+## Role Variables
+
+**Please look at the [defaults/main.yml](defaults/main.yml) for all available variables and their description.**
+
+**Note: Lines that are commented out via `#` are usually still valid/used variables, but they are not defined by default, so they might enable a feature, when uncommenting/defining them!**
+
+### Global variables, that are used:
+
+-   `proxy_network`: Defined by the local traefik installation, this is the shared proxy network used by traefik to reach the containers. (optional)
+-   `proxy_hiddenservice`: Defined by the local traefik installation, this is used to generate the alt-svc header for the alternative Tor domain. (optional)
+
+## Dependencies
+
+-   docker
+-   docker-compose
+-   traefik
+
+## License
+
+GPL-3.0-only

roles/matrix_sliding_sync/defaults/main.yml

@@ -0,0 +1,54 @@
+---
+# Default variables for the matrix_sliding_sync role
+
+# Infrastructure
+# Ansible instructions to deploy the infrastructure
+# Copyright (C) 2019-2020  Christoph (Sheogorath) Kern
+# Copyright (C) 2023       Saibotk
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, version 3 of the License.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+#
+
+# The install location
+matrix_sliding_sync_install_location: /srv/matrix_sliding_sync
+
+# The container data volume mount locations
+matrix_sliding_sync_data_location: "{{ matrix_sliding_sync_install_location }}/data"
+matrix_sliding_sync_database_location: "{{ matrix_sliding_sync_install_location }}/database"
+
+# The certresolver that is used by traefik for this domain
+matrix_sliding_sync_traefik_certresolver: letsencrypt_http
+
+# The domain that the sliding sync proxy is available under.
+# Note: This should be the same as the synapse domain, otherwise you will need
+# Custom dns entries etc.
+matrix_sliding_sync_domain: "{{ matrix_synapse_domain }}"
+
+# The database password to use
+matrix_sliding_sync_database_password: "{{ lookup('passwordstore', matrix_sliding_sync_synapse_domain + '/sliding-sync/db create=true length=42') }}"
+
+# A secret used to encrypt credentials in the DB
+matrix_sliding_sync_secret: "{{ lookup('passwordstore', matrix_sliding_sync_synapse_domain + '/sliding-sync/secret create=true length=42') }}"
+
+# Container versions
+# renovate: depName=ghcr.io/matrix-org/sliding-sync
+matrix_sliding_sync_version: "v0.99.13"
+# renovate: depName=docker.io/library/postgres
+matrix_sliding_sync_database_version: "16.4"
+
+# Container tag definitions
+matrix_sliding_sync_image_version: "{{ matrix_sliding_sync_version }}"
+matrix_sliding_sync_database_image_version: "{{ matrix_sliding_sync_database_version }}-alpine"
+
+# Enable or disable selinux handling
+matrix_sliding_sync_selinux_enabled: true

roles/matrix_sliding_sync/meta/main.yml

@@ -0,0 +1,44 @@
+galaxy_info:
+  author: saibotk
+  description: "Deploys a matrix sliding sync server via docker using traefik."
+  license: GPL-3.0-only
+  min_ansible_version: "2.9"
+  standalone: true
+
+  platforms:
+    - name: EL
+      versions:
+        - all
+    - name: GenericUNIX
+      versions:
+        - all
+    - name: Fedora
+      versions:
+        - all
+    - name: opensuse
+      versions:
+        - all
+    - name: GenericBSD
+      versions:
+        - all
+    - name: FreeBSD
+      versions:
+        - all
+    - name: Ubuntu
+      versions:
+        - all
+    - name: SLES
+      versions:
+        - all
+    - name: GenericLinux
+      versions:
+        - all
+    - name: Debian
+      versions:
+        - all
+
+  galaxy_tags: []
+
+dependencies:
+  - role: docker
+  - role: traefik

roles/matrix_sliding_sync/tasks/main.yml

@@ -0,0 +1,77 @@
+---
+# Tasks file for the matrix_sliding_sync role
+
+# Infrastructure
+# Ansible instructions to deploy the infrastructure
+# Copyright (C) 2019-2020  Christoph (Sheogorath) Kern
+# Copyright (C) 2019-2020  Alexander (w4tsn) Wellbrock
+# Copyright (C) 2020       Saibotk
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, version 3 of the License.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+#
+
+- name: Update default SELinux contexts
+  community.general.sefcontext:
+    target: "{{ item }}(/.*)?"
+    setype: "container_file_t"
+    state: present
+  with_items:
+    - "{{ matrix_sliding_sync_database_location }}"
+    - "{{ matrix_sliding_sync_data_location }}"
+  when:
+    - matrix_sliding_sync_selinux_enabled
+  become: true
+
+- name: Create install directory
+  ansible.builtin.file:
+    path: "{{ item }}"
+    state: directory
+    mode: "0700"
+    owner: "root"
+    group: "root"
+  with_items:
+    - "{{ matrix_sliding_sync_install_location }}"
+  become: true
+
+- name: Create data directory
+  ansible.builtin.file: # noqa risky-file-permissions # Container manages permissions on its own
+    path: "{{ item }}"
+    state: directory
+    setype: "container_file_t"
+  with_items:
+    - "{{ matrix_sliding_sync_database_location }}"
+    - "{{ matrix_sliding_sync_data_location }}"
+  become: true
+
+- name: Deploy docker-compose.yml
+  ansible.builtin.template:
+    src: "docker-compose.yml"
+    dest: "{{ matrix_sliding_sync_install_location }}/docker-compose.yml"
+    mode: "0600"
+    owner: "root"
+    group: "root"
+    validate: docker compose -f %s config -q
+  tags:
+    - matrix_sliding_sync
+  become: true
+
+- name: Compose matrix_sliding_sync
+  community.docker.docker_compose_v2:
+    state: present
+    project_src: "{{ matrix_sliding_sync_install_location }}"
+    pull: always
+    remove_orphans: true
+  tags:
+    - docker
+    - matrix_sliding_sync
+  become: true

roles/matrix_sliding_sync/templates/docker-compose.yml

@@ -0,0 +1,97 @@
+---
+# Infrastructure
+# Ansible instructions to deploy the infrastructure
+# Copyright (C) 2019-2020  Christoph (Sheogorath) Kern
+# Copyright (C) 2019-2020  Alexander (w4tsn) Wellbrock
+# Copyright (C) 2021-2023  Saibotk
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, version 3 of the License.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+#
+
+version: '2'
+services:
+  sliding_sync:
+    image: ghcr.io/matrix-org/sliding-sync:{{ matrix_sliding_sync_image_version }}
+    cpu_shares: 256
+    mem_limit: 512mb
+    memswap_limit: 756mb
+    read_only: true
+    restart: always
+    security_opt:
+      - no-new-privileges
+    tmpfs:
+      - "/tmp:size=64M"
+    environment:
+      - "SYNCV3_DB=user=slidingsync password={{ matrix_sliding_sync_database_password }} host=database port=5432 dbname=slidingsync sslmode=disable"
+      - "SYNCV3_SERVER=https://{{ matrix_synapse_domain }}"
+      - "SYNCV3_SECRET={{ matrix_sliding_sync_secret }}"
+      - "SYNCV3_BINDADDR=:8008"
+    volumes:
+      - "{{ matrix_sliding_sync_data_location }}:/data"
+    depends_on:
+      - database
+    labels:
+      - "traefik.http.routers.matrix-sliding-sync.rule=Host(`{{ matrix_sliding_sync_domain }}`) && PathPrefix(`/sliding-sync`)"
+      - "traefik.http.routers.matrix-sliding-sync.entrypoints=websecure"
+      - "traefik.http.routers.matrix-sliding-sync.tls.certresolver={{ matrix_sliding_sync_traefik_certresolver }}"
+      - "traefik.http.routers.matrix-sliding-sync.middlewares=matrix-sliding-sync,matrix-sliding-sync-strip-prefix"
+      - "traefik.http.routers.matrix-sliding-sync.service=matrix-sliding-sync"
+      - "traefik.http.services.matrix-sliding-sync.loadbalancer.server.port=8008"
+      - "traefik.http.middlewares.matrix-sliding-sync-strip-prefix.stripprefix.prefixes=/sliding-sync"
+      - "traefik.http.middlewares.matrix-sliding-sync.headers.sslredirect=true"
+      - "traefik.http.middlewares.matrix-sliding-sync.headers.stsSeconds=63072000"
+      - "traefik.http.middlewares.matrix-sliding-sync.headers.referrerPolicy=no-referrer"
+
+      - "traefik.enable=true"
+{% if proxy_network is defined %}
+      - "traefik.docker.network={{ proxy_network }}"
+{% endif %}
+{% if proxy_hiddenservice is defined and proxy_hiddenservice.content is defined %}
+      - "traefik.http.middlewares.matrix-sliding-sync.headers.customresponseheaders.alt-svc=h2={{ proxy_hiddenservice['content'] | b64decode | trim }}:443; ma=2592000"
+{% endif %}
+
+    networks:
+      database:
+{% if proxy_network is defined %}
+      {{ proxy_network }}:
+{% endif %}
+
+  database:
+    image: docker.io/library/postgres:{{ matrix_sliding_sync_database_image_version }}
+    mem_limit: 512mb
+    memswap_limit: 768mb
+    read_only: true
+    security_opt:
+      - no-new-privileges
+    tmpfs:
+      - /run/postgresql:size=512K
+      - /tmp:size=128K
+    stop_grace_period: 2m
+    stop_signal: SIGINT
+    environment:
+      - "POSTGRES_USER=slidingsync"
+      - "POSTGRES_PASSWORD={{ matrix_sliding_sync_database_password }}"
+      - "POSTGRES_INITDB_ARGS=--lc-collate C --lc-ctype C --encoding UTF8"
+    volumes:
+      - "{{ matrix_sliding_sync_database_location }}:/var/lib/postgresql/data"
+    networks:
+      database:
+    restart: always
+
+networks:
+  database:
+    internal: true
+{% if proxy_network is defined %}
+  {{ proxy_network }}:
+    external: true
+{% endif %}

roles/matrix_webhooks/README.md

@@ -0,0 +1,37 @@
+Matrix-Webhooks
+=========
+
+This will setup a [Matrix-Webhooks-appservice](https://github.com/turt2live/matrix-appservice-webhooks) instance using the official docker container and traefik as a reverse proxy.
+
+Requirements
+------------
+
+You will need to have docker, docker-compose and traefik installed or declared as dependencies with their respective roles.
+
+**This role assumes that you have setup traefik with an endpoint called `websecure`.**
+
+**You will also need to manually copy the appservice's registration file to your homeserver's directory and enable it in the config for this appservice to work!**
+
+Role Variables
+--------------
+
+**Please look at the [defaults/main.yml](defaults/main.yml) for all available variables and their description.**
+
+**Note: Lines that are commented out via `#` are usually still valid/used variables, but they are not defined by default, so they might enable a feature, when uncommenting/defining them!**  
+
+### Global variables, that are used:
+
+- `proxy_network`: Defined by the local traefik installation, this is the shared proxy network used by traefik to reach the containers. (optional)
+- `proxy_hiddenservice`: Defined by the local traefik installation, this is used to generate the alt-svc header for the alternative Tor domain. (optional)
+
+Dependencies
+------------
+
+- docker
+- docker-compose
+- traefik
+
+License
+-------
+
+GPL-3.0-only

roles/matrix_webhooks/defaults/main.yml

@@ -0,0 +1,48 @@
+---
+# Default variables for the matrix-webhooks role
+
+# Infrastructure
+# Ansible instructions to deploy the infrastructure
+# Copyright (C) 2021       Saibotk
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, version 3 of the License.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+#
+
+# The install location
+matrix_webhooks_install_location: /srv/matrix-webhooks
+
+# The location to store webhook related data in
+matrix_webhooks_data_location: "{{ matrix_webhooks_install_location }}/data"
+
+# Under which domain should the service be reachable via traefik
+matrix_webhooks_domain: "webhooks.example.com"
+
+# The certresolver that is used by traefik for this domain
+matrix_webhooks_traefik_certresolver: letsencrypt_http
+
+# The URL to the Client->Server API of the corresponding homeserver
+matrix_webhooks_hs_api_url: "https://matrix.example.com"
+
+# The domain part/right hand side of the MXID that this bot should run under (example: matrix.org)
+matrix_webhooks_hs_servername: "example.com"
+
+# Container versions
+# renovate: depName=docker.io/turt2live/matrix-appservice-webhooks
+matrix_webhooks_image_version: "latest"
+
+# The Provision API key
+matrix_webhooks_provisioning_key: "{{ lookup('passwordstore', matrix_webhooks_domain + '/provisioning-api create=true length=42') }}"
+
+# Webhook user profile (seems to be unused at the moment)
+matrix_webhooks_display_name: "Captain Webhook"
+matrix_webhooks_avatar: "http://i.imgur.com/IDOBtEJ.png"

roles/matrix_webhooks/handlers/main.yml

@@ -0,0 +1,31 @@
+---
+# Handlers file for the matrix-webhooks role
+
+# Infrastructure
+# Ansible instructions to deploy the infrastructure
+# Copyright (C) 2021  Saibotk
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, version 3 of the License.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+#
+
+- name: Restart matrix webhooks
+  community.docker.docker_compose_v2:
+    services:
+      - appservice-webhooks
+    state: restarted
+    project_src: "{{ matrix_webhooks_install_location }}"
+  tags:
+    - docker
+    - matrix
+    - webhooks
+  become: true

roles/matrix_webhooks/meta/main.yml

@@ -0,0 +1,44 @@
+galaxy_info:
+  author: saibotk
+  description: "Deploys a matrix webhook appservice server via docker using traefik."
+  license: GPL-3.0-only
+  min_ansible_version: "2.9"
+  standalone: true
+
+  platforms:
+    - name: EL
+      versions:
+        - all
+    - name: GenericUNIX
+      versions:
+        - all
+    - name: Fedora
+      versions:
+        - all
+    - name: opensuse
+      versions:
+        - all
+    - name: GenericBSD
+      versions:
+        - all
+    - name: FreeBSD
+      versions:
+        - all
+    - name: Ubuntu
+      versions:
+        - all
+    - name: SLES
+      versions:
+        - all
+    - name: GenericLinux
+      versions:
+        - all
+    - name: Debian
+      versions:
+        - all
+
+  galaxy_tags: []
+
+dependencies:
+  - role: docker
+  - role: traefik

roles/matrix_webhooks/tasks/main.yml

@@ -0,0 +1,102 @@
+---
+# Tasks file for the matrix-webhooks role
+
+# Infrastructure
+# Ansible instructions to deploy the infrastructure
+# Copyright (C) 2019-2020  Christoph (Sheogorath) Kern
+# Copyright (C) 2019-2020  Alexander (w4tsn) Wellbrock
+# Copyright (C) 2020-2021  Saibotk
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, version 3 of the License.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+#
+
+- name: Update default SELinux contexts
+  community.general.sefcontext:
+    target: "{{ item }}(/.*)?"
+    setype: "container_file_t"
+    state: present
+  with_items:
+    - "{{ matrix_webhooks_data_location }}"
+  become: true
+
+- name: Create install directory
+  ansible.builtin.file:
+    path: "{{ item }}"
+    state: directory
+    mode: "0700"
+    owner: "root"
+    group: "root"
+  with_items:
+    - "{{ matrix_webhooks_install_location }}"
+  become: true
+
+- name: Create data directory
+  ansible.builtin.file: # noqa risky-file-permissions # Container manages permissions on its own
+    path: "{{ item }}"
+    state: directory
+    setype: "container_file_t"
+  with_items:
+    - "{{ matrix_webhooks_data_location }}"
+  become: true
+
+- name: Deploy docker-compose.yml
+  ansible.builtin.template:
+    src: "docker-compose.yml"
+    dest: "{{ matrix_webhooks_install_location }}/docker-compose.yml"
+    mode: "0600"
+    owner: "root"
+    group: "root"
+    validate: docker compose -f %s config -q
+  tags:
+    - matrix
+    - webhooks
+  become: true
+
+- name: Deploy webhooks config files
+  ansible.builtin.template:
+    src: "{{ item }}"
+    dest: "{{ matrix_webhooks_data_location }}/{{ item }}"
+    setype: "container_file_t"
+    mode: "0640"
+    owner: "root"
+    group: "root"
+  with_items:
+    - "database.json"
+    - "config.yaml"
+  tags:
+    - docker
+    - matrix
+    - webhooks
+  notify: Restart matrix webhooks
+  become: true
+
+- name: Generate webhooks registration
+  ansible.builtin.command:
+    cmd: 'docker-compose run appservice-webhooks node index.js -r \
+      -f /data/appservice-registration-webhooks.yaml \
+      -u "https://{{ matrix_webhooks_domain }}" -c /data/config.yaml'
+    chdir: "{{ matrix_webhooks_install_location }}"
+    creates: "{{ matrix_webhooks_data_location }}/appservice-registration-webhooks.yaml"
+  become: true
+
+- name: Compose matrix-webhooks
+  community.docker.docker_compose_v2:
+    state: present
+    project_src: "{{ matrix_webhooks_install_location }}"
+    pull: always
+    remove_orphans: true
+  tags:
+    - docker
+    - matrix
+    - webhooks
+  become: true

roles/matrix_webhooks/templates/config.yaml

@@ -0,0 +1,39 @@
+{{ ansible_managed | comment }}
+
+# Configuration specific to the application service. All fields (unless otherwise marked) are required.
+homeserver:
+  # The domain for the client-server API calls.
+  url: "{{ matrix_webhooks_hs_api_url }}"
+
+  # The domain part for user IDs on this home server. Usually, but not always, this is the same as the
+  # home server's URL.
+  domain: "{{ matrix_webhooks_hs_servername }}"
+
+# Configuration specific to the bridge. All fields (unless otherwise marked) are required.
+webhookBot:
+  # The localpart to use for the bot. May require re-registering the application service.
+  localpart: "_webhook"
+
+  # Appearance options for the Matrix bot
+  appearance:
+    displayName: "{{ matrix_webhooks_display_name }}"
+    avatarUrl: "{{ matrix_webhooks_avatar }}" # webhook icon
+
+# Provisioning API options
+provisioning:
+  # Your secret for the API. Required for all provisioning API requests.
+  secret: '{{ matrix_webhooks_provisioning_key }}'
+
+# Configuration related to the web portion of the bridge. Handles the inbound webhooks
+web:
+  hookUrlBase: 'https://{{ matrix_webhooks_domain }}/'
+
+logging:
+  file: data/logs/webhook.log
+  console: true
+  consoleLevel: info
+  fileLevel: verbose
+  writeFiles: true
+  rotate:
+    size: 52428800 # bytes, default is 50mb
+    count: 5

roles/matrix_webhooks/templates/database.json

@@ -0,0 +1,13 @@
+{
+    "defaultEnv": {
+        "ENV": "NODE_ENV"
+    },
+    "development": {
+        "driver": "sqlite3",
+        "filename": "data/development.db"
+    },
+    "production": {
+        "driver": "sqlite3",
+        "filename": "data/production.db"
+    }
+}

roles/matrix_webhooks/templates/docker-compose.yml

@@ -0,0 +1,60 @@
+---
+# Infrastructure
+# Ansible instructions to deploy the infrastructure
+# Copyright (C) 2019-2020  Christoph (Sheogorath) Kern
+# Copyright (C) 2019-2020  Alexander (w4tsn) Wellbrock
+# Copyright (C) 2020       Saibotk
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, version 3 of the License.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+#
+
+version: '2'
+services:
+  appservice-webhooks:
+    image: docker.io/turt2live/matrix-appservice-webhooks:{{ matrix_webhooks_image_version }}
+    mem_limit: 128mb
+    memswap_limit: 256mb
+    read_only: true
+    security_opt:
+      - no-new-privileges
+    volumes:
+      - "{{ matrix_webhooks_data_location }}:/data"
+    labels:
+      - "traefik.enable=true"
+
+      - "traefik.http.routers.matrix-webhooks.rule=Host(`{{ matrix_webhooks_domain }}`) && PathPrefix(`/`)"
+      - "traefik.http.routers.matrix-webhooks.entrypoints=websecure"
+      - "traefik.http.routers.matrix-webhooks.tls.certresolver={{ matrix_webhooks_traefik_certresolver }}"
+      - "traefik.http.routers.matrix-webhooks.middlewares=matrix-webhooks,compress"
+      - "traefik.http.services.matrix-webhooks.loadbalancer.server.port=9000"
+      - "traefik.http.middlewares.matrix-webhooks.headers.sslredirect=true"
+      - "traefik.http.middlewares.matrix-webhooks.headers.stsSeconds=63072000"
+      - "traefik.http.middlewares.matrix-webhooks.headers.referrerPolicy=no-referrer"
+
+{% if proxy_network is defined %}
+      - "traefik.docker.network={{ proxy_network }}"
+{% endif %}
+{% if proxy_hiddenservice is defined and proxy_hiddenservice.content is defined %}
+      - "traefik.http.middlewares.matrix-webhooks.headers.customresponseheaders.alt-svc:h2={{ proxy_hiddenservice['content'] | b64decode | trim }}:443; ma=2592000"
+{% endif %}
+{% if proxy_network is defined %}
+    networks:
+      {{ proxy_network }}:
+{% endif %}
+    restart: always
+
+{% if proxy_network is defined %}
+networks:
+  {{ proxy_network }}:
+    external: true
+{% endif %}

roles/synapse/defaults/main.yml

@@ -1,38 +0,0 @@
-synapse_install_dir: "/opt/synapse"
-
-# The domain that users should be identified with, can be different than the server domain
-synapse_domain: matrix.example.com
-# The actual synapse domain
-synapse_server_domain: matrix.example.com
-
-synapse_containerimage: ghcr.io/element-hq/synapse
-# renovate: depName=ghcr.io/element-hq/synapse
-synapse_image_tag: "v1.122.0"
-
-synapse_postgres_containerimage: docker.io/library/postgres
-# renovate: depName=docker.io/library/postgres
-synapse_postgres_image_tag: "17.2-alpine"
-
-synapse_selinux_level: "{{ omit }}"
-synapse_postgres_selinux_level: "{{ omit }}"
-
-synapse_memory_low: 512m
-synapse_memory_high: 0
-synapse_swap_max: -1
-
-synapse_postgres_memory_low: 128m
-synapse_postgres_memory_high: 0
-synapse_postgres_swap_max: -1
-
-synapse_postgres_database_password: "{{ lookup('passwordstore', 'synapse.example.com/postgres/synapse_password' + ' create=true length=64') }}"
-
-# These are only needed for the inital run to setup the synapse database and user. On subsequent runs you can remove these.
-synapse_postgres_environment_vars:
-  POSTGRES_DB: "synapse"
-  POSTGRES_USER: "synapse"
-  POSTGRES_PASSWORD: "{{ synapse_postgres_database_password }}"
-  POSTGRES_INITDB_ARGS: "--lc-collate C --lc-ctype C --encoding UTF8"
-
-synapse_environment_vars:
-  SERVER_NAME: "{{ synapse_domain }}" # This can be different e.g. example.com with delegation
-  REPORT_STATS: 'no'

roles/synapse/handlers/main.yml

@@ -1,24 +0,0 @@
-- name: Apply new SELinux file context to filesystem.
-  ansible.builtin.command: "restorecon -irF {{ synapse_install_dir }}"
-  become: true
-  listen: "synapse selinux context changed"
-
-- name: Restart synapse service.
-  ansible.builtin.systemd:
-    state: restarted
-    name: synapse.service
-    daemon_reload: true
-  become: true
-  listen:
-    - "synapse service changed"
-    - "synapse selinux context changed"
-
-- name: Restart synapse-postgres service.
-  ansible.builtin.systemd:
-    state: restarted
-    name: synapse-postgres.service
-    daemon_reload: true
-  become: true
-  listen:
-    - "synapse postgres service changed"
-    - "synapse selinux context changed"

roles/synapse/meta/main.yml

@@ -1,20 +0,0 @@
-galaxy_info:
-  author: saibotk
-  description: Deploy synapse with podman and systemd.
-
-  issue_tracker_url: https://git.sipsofcode.de/saibotk-de/infrastructure/issues
-
-  license: GPL-3.0-only
-
-  min_ansible_version: "2.10"
-
-  platforms:
-    - name: Fedora
-      versions:
-        - "41"
-
-  standalone: true
-
-  galaxy_tags: []
-
-dependencies: []

roles/synapse/tasks/main.yml

@@ -1,140 +0,0 @@
-- name: Update default SELinux contexts
-  community.general.sefcontext:
-    target: "{{ item.target }}"
-    setype: "container_file_t"
-    selevel: "{{ item.selevel }}"
-    state: present
-  loop:
-    - target: "{{ synapse_install_dir }}/data(/.*)?"
-      selevel: "{{ synapse_selinux_level }}"
-    - target: "{{ synapse_install_dir }}/postgres(/.*)?"
-      selevel: "{{ synapse_postgres_selinux_level }}"
-  become: true
-  notify: "synapse selinux context changed"
-
-- name: Create synapse directories.
-  ansible.builtin.file:
-    path: "{{ synapse_install_dir }}"
-    owner: "root"
-    group: "root"
-    mode: "0700"
-    state: directory
-  become: true
-
-- name: Ensure synapse data directories exist.
-  block:
-    - name: Stat synapse data dir.
-      ansible.builtin.stat:
-        path: "{{ synapse_install_dir }}/data"
-      become: true
-      register: synapse_stat_data_dir
-
-    - name: Stat synapse postgres dir.
-      ansible.builtin.stat:
-        path: "{{ synapse_install_dir }}/postgres"
-      become: true
-      register: synapse_stat_postgres_dir
-
-    - name: Create synapse data directories.
-      ansible.builtin.file:
-        path: "{{ item.path }}"
-        state: directory
-        mode: "0700"
-        owner: "{{ item.owner }}"
-        group: "{{ item.group }}"
-      loop:
-        - path: "{{ synapse_install_dir }}/data"
-          owner: "{{ synapse_stat_data_dir.stat.uid | default('root') }}"
-          group: "{{ synapse_stat_data_dir.stat.gid | default('root') }}"
-        - path: "{{ synapse_install_dir }}/postgres"
-          owner: "{{ synapse_stat_postgres_dir.stat.uid | default('root') }}"
-          group: "{{ synapse_stat_postgres_dir.stat.gid | default('root') }}"
-      become: true
-
-- name: Deploy synapse environment file.
-  ansible.builtin.template:
-    src: synapse.env.j2
-    dest: "{{ synapse_install_dir }}/synapse.env"
-    mode: "0600"
-    owner: "root"
-    group: "root"
-  become: true
-  notify:
-    - "synapse service changed"
-
-- name: Deploy postgres environment file.
-  ansible.builtin.template:
-    src: synapse-postgres.env.j2
-    dest: "{{ synapse_install_dir }}/synapse-postgres.env"
-    mode: "0600"
-    owner: "root"
-    group: "root"
-  become: true
-  notify:
-    - "synapse postgres service changed"
-
-- name: Add caddy config file.
-  block:
-    - name: Check caddy config dir.
-      ansible.builtin.stat:
-        path: "{{ caddy_install_dir }}/config"
-      become: true
-      register: caddy_stat_config_dir
-
-    - name: Template caddy config for synapse.
-      ansible.builtin.template:
-        src: synapse.caddy.j2
-        dest: "{{ caddy_install_dir }}/config/synapse.caddy"
-        mode: "0600"
-        setype: "container_file_t"
-        selevel: "{{ caddy_selinux_level }}"
-        owner: "{{ caddy_stat_config_dir.stat.uid }}"
-        group: "{{ caddy_stat_config_dir.stat.gid }}"
-      notify: "caddy config changed"
-      become: true
-
-- name: Create synapse postgres socket volume.
-  ansible.builtin.template:
-    src: synapse-postgres-socket.volume
-    dest: /etc/containers/systemd/synapse-postgres-socket.volume
-    owner: "root"
-    group: "root"
-    mode: "0644"
-  become: true
-  notify:
-    - "synapse service changed"
-    - "synapse postgres service changed"
-
-- name: Create synapse container file.
-  ansible.builtin.template:
-    src: synapse.container.j2
-    dest: /etc/containers/systemd/synapse.container
-    owner: "root"
-    group: "root"
-    mode: "0644"
-  become: true
-  notify: "synapse service changed"
-
-- name: Create synapse postgres container file.
-  ansible.builtin.template:
-    src: synapse-postgres.container.j2
-    dest: /etc/containers/systemd/synapse-postgres.container
-    owner: "root"
-    group: "root"
-    mode: "0644"
-  become: true
-  notify: "synapse postgres service changed"
-
-- name: Flush handlers
-  ansible.builtin.meta: flush_handlers
-
-- name: Ensure synapse services are started and enabled.
-  ansible.builtin.systemd:
-    state: started
-    enabled: true
-    name: "{{ item }}"
-    daemon_reload: true
-  loop:
-    - synapse.service
-    - synapse-postgres.service
-  become: true

roles/synapse/templates/synapse-postgres-socket.volume

@@ -1,5 +0,0 @@
-{{ ansible_managed | comment }}
-
-[Volume]
-
-VolumeName = synapse-postgres-socket

roles/synapse/templates/synapse-postgres.container.j2

@@ -1,39 +0,0 @@
-{{ ansible_managed | comment }}
-
-[Unit]
-Description = Postgres for synapse
-
-[Service]
-Restart = always
-RestartSec = 5s
-
-[Container]
-Image = {{ synapse_postgres_containerimage }}:{{ synapse_postgres_image_tag }}
-ContainerName = synapse-postgres
-
-# AutoUpdate = registry
-LogDriver = journald
-
-# NoNewPrivileges = true
-ReadOnly = true
-DropCapability = all
-AddCapability = CHOWN DAC_OVERRIDE SETUID SETGID
-UserNS = auto:size=65535
-{% if synapse_postgres_selinux_level != omit %}
-SecurityLabelLevel = {{ synapse_postgres_selinux_level }}
-{% endif %}
-
-EnvironmentFile = {{ synapse_install_dir }}/synapse-postgres.env
-
-Volume = synapse-postgres-socket:/var/run/postgresql:U,z
-Volume = {{ synapse_install_dir }}/postgres:/var/lib/postgresql/data:U
-Tmpfs = /tmp:rw,noexec,nosuid,nodev,size=1m
-
-PodmanArgs = --memory={{ synapse_postgres_memory_high }}
-PodmanArgs = --memory-swap={{ synapse_postgres_swap_max }}
-PodmanArgs = --memory-reservation={{ synapse_postgres_memory_low }}
-
-PodmanArgs = --stop-signal=SIGINT
-
-[Install]
-WantedBy = default.target

roles/synapse/templates/synapse-postgres.env.j2

@@ -1,7 +0,0 @@
-{{ ansible_managed | comment}}
-
-{% if synapse_postgres_environment_vars is mapping %}
-{% for key, value in synapse_postgres_environment_vars.items() %}
-{{ key }}={{ value }}
-{% endfor %}
-{% endif %}

roles/synapse/templates/synapse.caddy.j2

@@ -1,63 +0,0 @@
-{{ ansible_managed | comment }}
-
-{{ synapse_server_domain }} {
-    encode gzip
-
-    header {
-        # enable HSTS
-        Strict-Transport-Security "max-age=31536000; preload;"
-
-        # disable clients from sniffing the media type
-        X-Content-Type-Options nosniff
-
-        # clickjacking protection
-        X-Frame-Options DENY
-
-        # keep referrer data off of HTTP connections
-        Referrer-Policy no-referrer-when-downgrade
-
-        # Server name removing
-        -Server
-    }
-
-    reverse_proxy synapse:8008
-}
-
-{{ synapse_domain }} {
-    encode gzip
-
-    header {
-        # enable HSTS
-        Strict-Transport-Security "max-age=31536000; preload;"
-
-        # disable clients from sniffing the media type
-        X-Content-Type-Options nosniff
-
-        # clickjacking protection
-        X-Frame-Options DENY
-
-        # keep referrer data off of HTTP connections
-        Referrer-Policy no-referrer-when-downgrade
-
-        # Server name removing
-        -Server
-    }
-
-    ## matrix client/server delegation
-    handle_path /.well-known/matrix/* {
-
-        header Access-Control-Allow-Origin *
-
-        ## `Content-Type: application/json` isn't required by the matrix spec
-        ## but some browsers (firefox) and some other tooling might preview json
-        ## content prettier when they are made aware via Content-Type
-        header Content-Type application/json
-
-        respond /client `{ "m.homeserver": { "base_url": "https://{{ synapse_server_domain }}" } }`
-
-        respond /server `{ "m.server": "{{ synapse_server_domain }}:443" }`
-
-        ## return http/404 if nothing matches
-        respond 404
-    }
-}

roles/synapse/templates/synapse.container.j2

@@ -1,44 +0,0 @@
-{{ ansible_managed | comment }}
-
-[Unit]
-Description = Synapse Server
-Requires = synapse-postgres.service
-After = synapse-postgres.service
-
-[Service]
-Restart = always
-RestartSec = 5s
-
-[Container]
-Image = {{ synapse_containerimage }}:{{ synapse_image_tag }}
-ContainerName = synapse
-
-# AutoUpdate = registry
-LogDriver = journald
-
-User = 991
-
-ReadOnly = true
-NoNewPrivileges = true
-DropCapability = all
-UserNS = auto:size=65535
-{% if synapse_selinux_level != omit %}
-SecurityLabelLevel = {{ synapse_selinux_level }}
-{% endif %}
-
-Network = caddy.network
-
-Tmpfs = /tmp:rw,noexec,nosuid,nodev,size=64M
-Tmpfs = /compiled:rw,noexec,nosuid,nodev,size=128K
-
-EnvironmentFile = {{ synapse_install_dir }}/synapse.env
-
-Volume = {{ synapse_install_dir }}/data:/data:U
-Volume = synapse-postgres-socket:/var/run/postgresql:z
-
-PodmanArgs = --memory={{ synapse_memory_high }}
-PodmanArgs = --memory-swap={{ synapse_swap_max }}
-PodmanArgs = --memory-reservation={{ synapse_memory_low }}
-
-[Install]
-WantedBy = default.target

roles/synapse/templates/synapse.env.j2

@@ -1,7 +0,0 @@
-{{ ansible_managed | comment}}
-
-{% if synapse_environment_vars is mapping %}
-{% for key, value in synapse_environment_vars.items() %}
-{{ key }}={{ value }}
-{% endfor %}
-{% endif %}