From c3399b03eb8e5ecf91735a221896507163bb9d28 Mon Sep 17 00:00:00 2001 From: Alexander Meindl Date: Tue, 27 Feb 2024 09:23:50 +0100 Subject: [PATCH] working on dendrite support --- roles/dendrite/defaults/main.yml | 20 ++ roles/dendrite/meta/main.yml | 25 ++ roles/dendrite/tasks/main.yml | 24 ++ roles/dendrite/tasks/nginx.yml | 38 +++ roles/dendrite/tasks/postgresql.yml | 45 +++ roles/dendrite/tasks/remove.yml | 23 ++ roles/dendrite/tasks/setup.yml | 28 ++ roles/dendrite/templates/dendrite.yaml.j2 | 364 +++++++++++++++++++++ roles/element_web/defaults/main.yml | 55 ++++ roles/element_web/meta/main.yml | 25 ++ roles/element_web/tasks/main.yml | 16 + roles/element_web/tasks/nginx.yml | 71 ++++ roles/element_web/tasks/remove.yml | 23 ++ roles/element_web/tasks/setup.yml | 36 ++ roles/element_web/templates/config.json.j2 | 54 +++ roles/element_web/templates/vhost.j2 | 62 ++++ roles/ethercalc/tasks/main.yml | 10 +- roles/ethercalc/tasks/remove.yml | 12 + roles/ethercalc/templates/vhost.j2 | 2 +- roles/golang/defaults/main.yml | 3 +- roles/hedgedoc/templates/vhost.j2 | 2 +- 21 files changed, 931 insertions(+), 7 deletions(-) create mode 100644 roles/dendrite/defaults/main.yml create mode 100644 roles/dendrite/meta/main.yml create mode 100644 roles/dendrite/tasks/main.yml create mode 100644 roles/dendrite/tasks/nginx.yml create mode 100644 roles/dendrite/tasks/postgresql.yml create mode 100644 roles/dendrite/tasks/remove.yml create mode 100644 roles/dendrite/tasks/setup.yml create mode 100644 roles/dendrite/templates/dendrite.yaml.j2 create mode 100644 roles/element_web/defaults/main.yml create mode 100644 roles/element_web/meta/main.yml create mode 100644 roles/element_web/tasks/main.yml create mode 100644 roles/element_web/tasks/nginx.yml create mode 100644 roles/element_web/tasks/remove.yml create mode 100644 roles/element_web/tasks/setup.yml create mode 100644 roles/element_web/templates/config.json.j2 create mode 100644 roles/element_web/templates/vhost.j2 diff --git a/roles/dendrite/defaults/main.yml b/roles/dendrite/defaults/main.yml new file mode 100644 index 0000000..f6a7c7e --- /dev/null +++ b/roles/dendrite/defaults/main.yml @@ -0,0 +1,20 @@ +--- + +# see https://github.com/matrix-org/dendrite + +dendrite_required_packages: [] + +dendrite_remove: false + +dendrite_db_name: dendrite +dendrite_db_user: dendrite +dendrite_db_password: '{{ [ansible_machine_id, ansible_hostname, "dendrite"] | join | hash("md5") }}' +dendrite_db_role_flags: CREATEDB +dendrite_db_host: /run/postgresql + +# see https://docs.gitlab.com/ee/install/installation.html#3-go +# NOTE: version should be tests in gitlab pipeline +# SEE https://gitlab.com/gitlab-org/gitlab/-/blob/master/.gitlab/ci/workhorse.gitlab-ci.yml#L30 +# https://go.dev/dl/ -> linux-amd64.tar.gz +dendrite_go_version: '1.21.7' +dendrite_go_sha256_checksum: a9bc1ccedbfde059f25b3a2ad81ae4cdf21192ae207dfd3ccbbfe99c3749e233 diff --git a/roles/dendrite/meta/main.yml b/roles/dendrite/meta/main.yml new file mode 100644 index 0000000..4acd63c --- /dev/null +++ b/roles/dendrite/meta/main.yml @@ -0,0 +1,25 @@ +--- +dependencies: + - role: alphanodes.setup.common + - role: alphanodes.setup.ssl + - role: alphanodes.setup.nginx + +galaxy_info: + description: Setup element-web + author: alexandermeindl + company: AlphaNodes GmbH + license: Apache License 2.0 + min_ansible_version: '2.14' + platforms: + - name: Ubuntu + versions: + - focal + - jammy + - name: Debian + versions: + - buster + - bullseye + - bookworm + galaxy_tags: + - element + - matrix diff --git a/roles/dendrite/tasks/main.yml b/roles/dendrite/tasks/main.yml new file mode 100644 index 0000000..26f4729 --- /dev/null +++ b/roles/dendrite/tasks/main.yml @@ -0,0 +1,24 @@ +--- + +- name: Include PostgreSQL tasks + ansible.builtin.include_tasks: postgresql.yml + tags: + - dendrite + - matrix + - postgresql + when: not dendrite_remove | bool + +- name: Include setup tasks + ansible.builtin.include_tasks: setup.yml + when: not dendrite_remove | bool + tags: + - dendrite + - matrix + +- name: Include remove tasks + ansible.builtin.include_tasks: remove.yml + when: dendrite_remove | bool + tags: + - dendrite + - matrix + - remove diff --git a/roles/dendrite/tasks/nginx.yml b/roles/dendrite/tasks/nginx.yml new file mode 100644 index 0000000..e294b5b --- /dev/null +++ b/roles/dendrite/tasks/nginx.yml @@ -0,0 +1,38 @@ +--- + +- name: Set TLS files for letsencrypt + ansible.builtin.set_fact: + vhost_letsencrypt_cert: "{{ element_web_vhost_letsencrypt_cert }}" + vhost_letsencrypt_key: "{{ element_web_vhost_letsencrypt_key }}" + force_letsencrypt: true + when: + - element_web_vhost_letsencrypt is defined + - element_web_vhost_letsencrypt + +- name: Check trusted TLS cert + ansible.builtin.stat: + path: /etc/ssl/certs/{{ element_web_vhost_ssl_cert }}_trusted.crt + register: trusted_cert + when: element_web_vhost_letsencrypt is undefined or not element_web_vhost_letsencrypt + +- name: Set TLS files + ansible.builtin.set_fact: + vhost_ssl_cert: "{{ element_web_vhost_ssl_cert }}" + vhost_ssl_with_trusted_cert: "{{ trusted_cert.stat.exists | bool }}" + when: element_web_vhost_letsencrypt is undefined or not element_web_vhost_letsencrypt + +- name: Update element web vhost configuration + tags: nginx + ansible.builtin.template: + src: vhost.j2 + dest: /etc/nginx/sites-available/element_web.conf + mode: 0644 + notify: Reload nginx + +- name: Enable element web vhost + tags: nginx + ansible.builtin.file: + src: /etc/nginx/sites-available/element_web.conf + dest: /etc/nginx/sites-enabled/element_web.conf + state: link + notify: Reload nginx diff --git a/roles/dendrite/tasks/postgresql.yml b/roles/dendrite/tasks/postgresql.yml new file mode 100644 index 0000000..e3274fc --- /dev/null +++ b/roles/dendrite/tasks/postgresql.yml @@ -0,0 +1,45 @@ +--- + +- name: Include postgresql role + ansible.builtin.include_role: + name: alphanodes.setup.postgresql + +- name: Create dendrite postgresql database user + become_user: postgres + become: true + community.postgresql.postgresql_user: + name: '{{ dendrite_db_user }}' + password: '{{ dendrite_db_password }}' + role_attr_flags: "{{ dendrite_db_role_flags | default('CREATEDB') }}" + state: present + no_log: true + +- name: Be sure pg_trgm extension exists + become_user: postgres + become: true + community.postgresql.postgresql_ext: + name: pg_trgm + db: template1 + +- name: Be sure btree_gist extension exists + become_user: postgres + become: true + community.postgresql.postgresql_ext: + name: btree_gist + db: template1 + +- name: Be sure plpgsql extension exists + become_user: postgres + become: true + community.postgresql.postgresql_ext: + name: plpgsql + db: template1 + +- name: Be sure dendrite postgresql databases exists + become_user: postgres + become: true + community.postgresql.postgresql_db: + name: '{{ dendrite_db_name }}' + owner: '{{ dendrite_db_user }}' + template: template1 + state: present diff --git a/roles/dendrite/tasks/remove.yml b/roles/dendrite/tasks/remove.yml new file mode 100644 index 0000000..e50ec81 --- /dev/null +++ b/roles/dendrite/tasks/remove.yml @@ -0,0 +1,23 @@ +--- + +- name: Remove element-web package + ansible.builtin.apt: + name: element-web + purge: true + state: absent + +- name: Remove element-web apt repository + ansible.builtin.deb822_repository: + name: element-web + state: absent + +- name: Remove configuration files + ansible.builtin.file: + name: '{{ item }}' + state: absent + loop: + - /etc/nginx/sites-available/element-web.conf + - /etc/nginx/sites-enabled/element-web.conf + - /etc/element-web + notify: + - Restart nginx diff --git a/roles/dendrite/tasks/setup.yml b/roles/dendrite/tasks/setup.yml new file mode 100644 index 0000000..e838a33 --- /dev/null +++ b/roles/dendrite/tasks/setup.yml @@ -0,0 +1,28 @@ +--- + +- name: Ensure required packages are installed + ansible.builtin.apt: + name: "{{ dendrite_required_packages }}" + state: present + +- name: Include Go role + ansible.builtin.include_role: + name: alphanodes.setup.golang + vars: + golang_version: '{{ dendrite_go_version | default(omit) }}' + golang_sha256_checksum: '{{ dendrite_go_sha256_checksum | default(omit) }}' + +- name: Ensure Element configuration installed + ansible.builtin.template: + src: config.json.j2 + dest: /etc/element-web/config.json + mode: 0644 + owner: root + group: root + +- name: Include nginx tasks + ansible.builtin.include_tasks: nginx.yml + when: not dendrite_remove | bool + tags: + - dendrite + - matrix diff --git a/roles/dendrite/templates/dendrite.yaml.j2 b/roles/dendrite/templates/dendrite.yaml.j2 new file mode 100644 index 0000000..8616e12 --- /dev/null +++ b/roles/dendrite/templates/dendrite.yaml.j2 @@ -0,0 +1,364 @@ +# This is the Dendrite configuration file. +# +# The configuration is split up into sections - each Dendrite component has a +# configuration section, in addition to the "global" section which applies to +# all components. + +# The version of the configuration file. +version: 2 + +# Global Matrix configuration. This configuration applies to all components. +global: + # The domain name of this homeserver. + server_name: localhost + + # The path to the signing private key file, used to sign requests and events. + # Note that this is NOT the same private key as used for TLS! To generate a + # signing key, use "./bin/generate-keys --private-key matrix_key.pem". + private_key: matrix_key.pem + + # The paths and expiry timestamps (as a UNIX timestamp in millisecond precision) + # to old signing keys that were formerly in use on this domain name. These + # keys will not be used for federation request or event signing, but will be + # provided to any other homeserver that asks when trying to verify old events. + old_private_keys: + # If the old private key file is available: + # - private_key: old_matrix_key.pem + # expired_at: 1601024554498 + # If only the public key (in base64 format) and key ID are known: + # - public_key: mn59Kxfdq9VziYHSBzI7+EDPDcBS2Xl7jeUdiiQcOnM= + # key_id: ed25519:mykeyid + # expired_at: 1601024554498 + + # How long a remote server can cache our server signing key before requesting it + # again. Increasing this number will reduce the number of requests made by other + # servers for our key but increases the period that a compromised key will be + # considered valid by other homeservers. + key_validity_period: 168h0m0s + + # Global database connection pool, for PostgreSQL monolith deployments only. If + # this section is populated then you can omit the "database" blocks in all other + # sections. For monolith deployments using SQLite databases, + # you must configure the "database" block for each component instead. + database: + connection_string: postgresql://username:password@hostname/dendrite?sslmode=disable + max_open_conns: 90 + max_idle_conns: 5 + conn_max_lifetime: -1 + + # Configuration for in-memory caches. Caches can often improve performance by + # keeping frequently accessed items (like events, identifiers etc.) in memory + # rather than having to read them from the database. + cache: + # The estimated maximum size for the global cache in bytes, or in terabytes, + # gigabytes, megabytes or kilobytes when the appropriate 'tb', 'gb', 'mb' or + # 'kb' suffix is specified. Note that this is not a hard limit, nor is it a + # memory limit for the entire process. A cache that is too small may ultimately + # provide little or no benefit. + max_size_estimated: 1gb + + # The maximum amount of time that a cache entry can live for in memory before + # it will be evicted and/or refreshed from the database. Lower values result in + # easier admission of new cache entries but may also increase database load in + # comparison to higher values, so adjust conservatively. Higher values may make + # it harder for new items to make it into the cache, e.g. if new rooms suddenly + # become popular. + max_age: 1h + + # The server name to delegate server-server communications to, with optional port + # e.g. localhost:443 + well_known_server_name: "" + + # The base URL to delegate client-server communications to e.g. https://localhost + well_known_client_name: "" + + # The server name to delegate sliding sync communications to, with optional port. + # Requires `well_known_client_name` to also be configured. + well_known_sliding_sync_proxy: "" + + # Lists of domains that the server will trust as identity servers to verify third + # party identifiers such as phone numbers and email addresses. + trusted_third_party_id_servers: + - matrix.org + - vector.im + + # Disables federation. Dendrite will not be able to communicate with other servers + # in the Matrix federation and the federation API will not be exposed. + disable_federation: false + + # Configures the handling of presence events. Inbound controls whether we receive + # presence events from other servers, outbound controls whether we send presence + # events for our local users to other servers. + presence: + enable_inbound: false + enable_outbound: false + + # Configures phone-home statistics reporting. These statistics contain the server + # name, number of active users and some information on your deployment config. + # We use this information to understand how Dendrite is being used in the wild. + report_stats: + enabled: false + endpoint: https://panopticon.matrix.org/push + + # Server notices allows server admins to send messages to all users on the server. + server_notices: + enabled: false + # The local part, display name and avatar URL (as a mxc:// URL) for the user that + # will send the server notices. These are visible to all users on the deployment. + local_part: "_server" + display_name: "Server Alerts" + avatar_url: "" + # The room name to be used when sending server notices. This room name will + # appear in user clients. + room_name: "Server Alerts" + + # Configuration for NATS JetStream + jetstream: + # A list of NATS Server addresses to connect to. If none are specified, an + # internal NATS server will be started automatically when running Dendrite in + # monolith mode. + addresses: + # - localhost:4222 + + # Disable the validation of TLS certificates of NATS. This is + # not recommended in production since it may allow NATS traffic + # to be sent to an insecure endpoint. + disable_tls_validation: false + + # Persistent directory to store JetStream streams in. This directory should be + # preserved across Dendrite restarts. + storage_path: ./ + + # The prefix to use for stream names for this homeserver - really only useful + # if you are running more than one Dendrite server on the same NATS deployment. + topic_prefix: Dendrite + + # Configuration for Prometheus metric collection. + metrics: + enabled: false + basic_auth: + username: metrics + password: metrics + + # Optional DNS cache. The DNS cache may reduce the load on DNS servers if there + # is no local caching resolver available for use. + dns_cache: + enabled: false + cache_size: 256 + cache_lifetime: "5m" # 5 minutes; https://pkg.go.dev/time@master#ParseDuration + +# Configuration for the Appservice API. +app_service_api: + # Disable the validation of TLS certificates of appservices. This is + # not recommended in production since it may allow appservice traffic + # to be sent to an insecure endpoint. + disable_tls_validation: false + + # Send the access_token query parameter with appservice requests in addition + # to the Authorization header. This can cause hs_tokens to be saved to logs, + # so it should not be enabled unless absolutely necessary. + legacy_auth: false + # Use the legacy unprefixed paths for appservice requests. + legacy_paths: false + + # Appservice configuration files to load into this homeserver. + config_files: + # - /path/to/appservice_registration.yaml + +# Configuration for the Client API. +client_api: + # Prevents new users from being able to register on this homeserver, except when + # using the registration shared secret below. + registration_disabled: true + + # Prevents new guest accounts from being created. Guest registration is also + # disabled implicitly by setting 'registration_disabled' above. + guests_disabled: true + + # If set, allows registration by anyone who knows the shared secret, regardless + # of whether registration is otherwise disabled. + registration_shared_secret: "" + + # Whether to require reCAPTCHA for registration. If you have enabled registration + # then this is HIGHLY RECOMMENDED to reduce the risk of your homeserver being used + # for coordinated spam attacks. + enable_registration_captcha: false + + # Settings for ReCAPTCHA. + recaptcha_public_key: "" + recaptcha_private_key: "" + recaptcha_bypass_secret: "" + + # To use hcaptcha.com instead of ReCAPTCHA, set the following parameters, otherwise just keep them empty. + # recaptcha_siteverify_api: "https://hcaptcha.com/siteverify" + # recaptcha_api_js_url: "https://js.hcaptcha.com/1/api.js" + # recaptcha_form_field: "h-captcha-response" + # recaptcha_sitekey_class: "h-captcha" + + + # TURN server information that this homeserver should send to clients. + turn: + turn_user_lifetime: "5m" + turn_uris: + # - turn:turn.server.org?transport=udp + # - turn:turn.server.org?transport=tcp + turn_shared_secret: "" + # If your TURN server requires static credentials, then you will need to enter + # them here instead of supplying a shared secret. Note that these credentials + # will be visible to clients! + # turn_username: "" + # turn_password: "" + + # Settings for rate-limited endpoints. Rate limiting kicks in after the threshold + # number of "slots" have been taken by requests from a specific host. Each "slot" + # will be released after the cooloff time in milliseconds. Server administrators + # and appservice users are exempt from rate limiting by default. + rate_limiting: + enabled: true + threshold: 20 + cooloff_ms: 500 + exempt_user_ids: + # - "@user:domain.com" + +# Configuration for the Federation API. +federation_api: + # How many times we will try to resend a failed transaction to a specific server. The + # backoff is 2**x seconds, so 1 = 2 seconds, 2 = 4 seconds, 3 = 8 seconds etc. Once + # the max retries are exceeded, Dendrite will no longer try to send transactions to + # that server until it comes back to life and connects to us again. + send_max_retries: 16 + + # Disable the validation of TLS certificates of remote federated homeservers. Do not + # enable this option in production as it presents a security risk! + disable_tls_validation: false + + # Disable HTTP keepalives, which also prevents connection reuse. Dendrite will typically + # keep HTTP connections open to remote hosts for 5 minutes as they can be reused much + # more quickly than opening new connections each time. Disabling keepalives will close + # HTTP connections immediately after a successful request but may result in more CPU and + # memory being used on TLS handshakes for each new connection instead. + disable_http_keepalives: false + + # Perspective keyservers to use as a backup when direct key fetches fail. This may + # be required to satisfy key requests for servers that are no longer online when + # joining some rooms. + key_perspectives: + - server_name: matrix.org + keys: + - key_id: ed25519:auto + public_key: Noi6WqcDj0QmPxCNQqgezwTlBKrfqehY1u2FyWP9uYw + - key_id: ed25519:a_RXGa + public_key: l8Hft5qXKn1vfHrg3p4+W8gELQVo8N13JkluMfmn2sQ + + # This option will control whether Dendrite will prefer to look up keys directly + # or whether it should try perspective servers first, using direct fetches as a + # last resort. + prefer_direct_fetch: false + +# Configuration for the Media API. +media_api: + # Storage path for uploaded media. May be relative or absolute. + base_path: ./media_store + + # The maximum allowed file size (in bytes) for media uploads to this homeserver + # (0 = unlimited). If using a reverse proxy, ensure it allows requests at least + #this large (e.g. the client_max_body_size setting in nginx). + max_file_size_bytes: 10485760 + + # Whether to dynamically generate thumbnails if needed. + dynamic_thumbnails: false + + # The maximum number of simultaneous thumbnail generators to run. + max_thumbnail_generators: 10 + + # A list of thumbnail sizes to be generated for media content. + thumbnail_sizes: + - width: 32 + height: 32 + method: crop + - width: 96 + height: 96 + method: crop + - width: 640 + height: 480 + method: scale + +# Configuration for enabling experimental MSCs on this homeserver. +mscs: + mscs: + # - msc2836 # (Threading, see https://github.com/matrix-org/matrix-doc/pull/2836) + +# Configuration for the Sync API. +sync_api: + # This option controls which HTTP header to inspect to find the real remote IP + # address of the client. This is likely required if Dendrite is running behind + # a reverse proxy server. + # real_ip_header: X-Real-IP + + # Configuration for the full-text search engine. + search: + # Whether or not search is enabled. + enabled: false + + # The path where the search index will be created in. + index_path: "./searchindex" + + # The language most likely to be used on the server - used when indexing, to + # ensure the returned results match expectations. A full list of possible languages + # can be found at https://github.com/blevesearch/bleve/tree/master/analysis/lang + language: "en" + +# Configuration for the User API. +user_api: + # The cost when hashing passwords on registration/login. Default: 10. Min: 4, Max: 31 + # See https://pkg.go.dev/golang.org/x/crypto/bcrypt for more information. + # Setting this lower makes registration/login consume less CPU resources at the cost + # of security should the database be compromised. Setting this higher makes registration/login + # consume more CPU resources but makes it harder to brute force password hashes. This value + # can be lowered if performing tests or on embedded Dendrite instances (e.g WASM builds). + bcrypt_cost: 10 + + # The length of time that a token issued for a relying party from + # /_matrix/client/r0/user/{userId}/openid/request_token endpoint + # is considered to be valid in milliseconds. + # The default lifetime is 3600000ms (60 minutes). + # openid_token_lifetime_ms: 3600000 + + # Users who register on this homeserver will automatically be joined to the rooms listed under "auto_join_rooms" option. + # By default, any room aliases included in this list will be created as a publicly joinable room + # when the first user registers for the homeserver. If the room already exists, + # make certain it is a publicly joinable room, i.e. the join rule of the room must be set to 'public'. + # As Spaces are just rooms under the hood, Space aliases may also be used. + auto_join_rooms: + # - "#main:matrix.org" + + # The number of workers to start for the DeviceListUpdater. Defaults to 8. + # This only needs updating if the "InputDeviceListUpdate" stream keeps growing indefinitely. + # worker_count: 8 + +# Configuration for Opentracing. +# See https://github.com/matrix-org/dendrite/tree/master/docs/tracing for information on +# how this works and how to set it up. +tracing: + enabled: false + jaeger: + serviceName: "" + disabled: false + rpc_metrics: false + tags: [] + sampler: null + reporter: null + headers: null + baggage_restrictions: null + throttler: null + +# Logging configuration. The "std" logging type controls the logs being sent to +# stdout. The "file" logging type controls logs being written to a log folder on +# the disk. Supported log levels are "debug", "info", "warn", "error". +logging: + - type: std + level: info + - type: file + level: info + params: + path: ./logs diff --git a/roles/element_web/defaults/main.yml b/roles/element_web/defaults/main.yml new file mode 100644 index 0000000..f31326c --- /dev/null +++ b/roles/element_web/defaults/main.yml @@ -0,0 +1,55 @@ +--- + +# install https://github.com/element-hq/element-web + +element_web_required_packages: + - element-web + +# see https://github.com/element-hq/element-web/blob/develop/docs/install.md#debian-package +element_web_apt_url: https://packages.element.io/debian/ +element_web_apt_key_url: https://packages.element.io/debian/element-io-archive-keyring.gpg +element_web_apt_suites: default +element_web_apt_components: main + +element_web_path: /usr/share/element-web + +element_web_vhost_server: element.localhost +element_web_vhost_users: [] +element_web_vhost_for_zabbix: false + +element_web_vhost_letsencrypt: false +element_web_vhost_ssl_cert: '{{ ssl_certs[0].name }}' +element_web_vhost_letsencrypt_cert: '{{ letsencrypt_certs[0] | default(omit) }}' +element_web_vhost_letsencrypt_key: '{{ letsencrypt_keys[0] | default(omit) }}' + +element_web_enabled: true + +# do uninstall element web, set it to true +element_web_remove: false + +# element configuration +element_web_default_hs_url: "https://matrix-client.matrix.org" +element_web_default_server_name: "matrix.org" +element_web_default_is_url: "https://vector.im" +element_web_show_lab_settings: true +element_web_jitsi_preferred_domain: "meet.ffmuc.net" +# Links, shown in footer of welcome page: +# [{"text": "Link text", "url": "https://link.target"}, {"text": "Other link"}] +element_web_branding_auth_footer_links: + - { "text": "Impressum", "url": "https://alphanodes.com/de/impressum"} + - { "text": "Datenschutz ", "url": "https://alphanodes.com/de/datenschutzbestimmungen"} + - { "text": "AlphaNodes", "url": "https://alphanodes.com/de/"} +# URL to image, shown during Login +element_web_branding_auth_header_logo_url: "themes/element/img/logos/element-logo.svg" +# URL to Wallpaper, shown in background of welcome page +element_web_branding_welcome_background_url: ~ # noqa var-naming +# Element public room directory server(s) +element_web_room_directory_servers: ['matrix.org'] +# Branding of Element +element_web_brand: 'AlphaNodes Element' +element_web_default_country_code: 'GB' +element_web_default_theme: 'light' +element_web_disable_custom_urls: false +element_web_disable_guests: false +element_web_disable_login_language_selector: false +element_web_disable_3pid_login: false diff --git a/roles/element_web/meta/main.yml b/roles/element_web/meta/main.yml new file mode 100644 index 0000000..4acd63c --- /dev/null +++ b/roles/element_web/meta/main.yml @@ -0,0 +1,25 @@ +--- +dependencies: + - role: alphanodes.setup.common + - role: alphanodes.setup.ssl + - role: alphanodes.setup.nginx + +galaxy_info: + description: Setup element-web + author: alexandermeindl + company: AlphaNodes GmbH + license: Apache License 2.0 + min_ansible_version: '2.14' + platforms: + - name: Ubuntu + versions: + - focal + - jammy + - name: Debian + versions: + - buster + - bullseye + - bookworm + galaxy_tags: + - element + - matrix diff --git a/roles/element_web/tasks/main.yml b/roles/element_web/tasks/main.yml new file mode 100644 index 0000000..e551c4d --- /dev/null +++ b/roles/element_web/tasks/main.yml @@ -0,0 +1,16 @@ +--- + +- name: Include setup tasks + ansible.builtin.include_tasks: setup.yml + when: not element_web_remove | bool + tags: + - element + - matrix + +- name: Include remove tasks + ansible.builtin.include_tasks: remove.yml + when: element_web_remove | bool + tags: + - element + - matrix + - remove diff --git a/roles/element_web/tasks/nginx.yml b/roles/element_web/tasks/nginx.yml new file mode 100644 index 0000000..a7e468b --- /dev/null +++ b/roles/element_web/tasks/nginx.yml @@ -0,0 +1,71 @@ +--- + +# restart required, because file can be not available before +- name: Protect element web vhost user + community.general.htpasswd: + path: /etc/nginx/.htpasswd_element_web + name: '{{ item.user }}' + password: '{{ item.password }}' + owner: root + group: '{{ nginx_group }}' + mode: 0640 + loop: '{{ element_web_vhost_users | default([]) }}' + when: + - element_web_vhost_users is defined + - element_web_vhost_users | length > 0 + notify: Restart nginx + +- name: Remove .htpasswd_element_web, if no base auth is in use + ansible.builtin.file: + path: /etc/nginx/.htpasswd_element_web + state: absent + when: element_web_vhost_users | length < 1 + notify: Restart nginx + +- name: Enable block + when: element_web_enabled + block: + - name: Set TLS files for letsencrypt + ansible.builtin.set_fact: + vhost_letsencrypt_cert: "{{ element_web_vhost_letsencrypt_cert }}" + vhost_letsencrypt_key: "{{ element_web_vhost_letsencrypt_key }}" + force_letsencrypt: true + when: + - element_web_vhost_letsencrypt is defined + - element_web_vhost_letsencrypt + + - name: Check trusted TLS cert + ansible.builtin.stat: + path: /etc/ssl/certs/{{ element_web_vhost_ssl_cert }}_trusted.crt + register: trusted_cert + when: element_web_vhost_letsencrypt is undefined or not element_web_vhost_letsencrypt + + - name: Set TLS files + ansible.builtin.set_fact: + vhost_ssl_cert: "{{ element_web_vhost_ssl_cert }}" + vhost_ssl_with_trusted_cert: "{{ trusted_cert.stat.exists | bool }}" + when: element_web_vhost_letsencrypt is undefined or not element_web_vhost_letsencrypt + + - name: Update element web vhost configuration + tags: nginx + ansible.builtin.template: + src: vhost.j2 + dest: /etc/nginx/sites-available/element_web.conf + mode: 0644 + notify: Reload nginx + + - name: Enable element web vhost + tags: nginx + ansible.builtin.file: + src: /etc/nginx/sites-available/element_web.conf + dest: /etc/nginx/sites-enabled/element_web.conf + state: link + notify: Reload nginx + +- name: Disable block + when: not element_web_enabled + block: + - name: Ensure element_web vhost is disabled + ansible.builtin.file: + path: /etc/nginx/sites-enabled/element_web.conf + state: absent diff --git a/roles/element_web/tasks/remove.yml b/roles/element_web/tasks/remove.yml new file mode 100644 index 0000000..e50ec81 --- /dev/null +++ b/roles/element_web/tasks/remove.yml @@ -0,0 +1,23 @@ +--- + +- name: Remove element-web package + ansible.builtin.apt: + name: element-web + purge: true + state: absent + +- name: Remove element-web apt repository + ansible.builtin.deb822_repository: + name: element-web + state: absent + +- name: Remove configuration files + ansible.builtin.file: + name: '{{ item }}' + state: absent + loop: + - /etc/nginx/sites-available/element-web.conf + - /etc/nginx/sites-enabled/element-web.conf + - /etc/element-web + notify: + - Restart nginx diff --git a/roles/element_web/tasks/setup.yml b/roles/element_web/tasks/setup.yml new file mode 100644 index 0000000..bffaf5f --- /dev/null +++ b/roles/element_web/tasks/setup.yml @@ -0,0 +1,36 @@ +--- + +- name: Add element-web apt repository + ansible.builtin.deb822_repository: + name: element-web + uris: '{{ element_web_apt_url }}' + types: deb + suites: '{{ element_web_apt_suites }}' + components: '{{ element_web_apt_components }}' + signed_by: '{{ element_web_apt_key_url }}' + state: present + register: element_web_repo + +- name: Update apt cache + apt: + update_cache: true + when: element_web_repo.changed + tags: + - skip_ansible_lint + +- name: Ensure required packages are installed + ansible.builtin.apt: + name: "{{ element_web_required_packages }}" + state: present + +- name: Ensure Element configuration installed + ansible.builtin.template: + src: config.json.j2 + dest: /etc/element-web/config.json + mode: 0644 + owner: root + group: root + +- name: Include nginx tasks + ansible.builtin.include_tasks: nginx.yml + when: not element_web_remove | bool diff --git a/roles/element_web/templates/config.json.j2 b/roles/element_web/templates/config.json.j2 new file mode 100644 index 0000000..e11a180 --- /dev/null +++ b/roles/element_web/templates/config.json.j2 @@ -0,0 +1,54 @@ +{ + "default_server_config": { + "m.homeserver": { + "base_url": {{ element_web_default_hs_url | string | to_json }}, + "server_name": {{ element_web_default_server_name | string | to_json }} + }, + "m.identity_server": { + "base_url": {{ element_web_default_is_url | string | to_json }} + } + }, + "disable_custom_urls": {{ element_web_disable_custom_urls | to_json }}, + "disable_guests": {{ element_web_disable_guests | to_json }}, + "disable_login_language_selector": {{ element_web_disable_login_language_selector | to_json }}, + "disable_3pid_login": {{ element_web_disable_3pid_login | to_json }}, + "brand": {{ element_web_brand | to_json }}, + "integrations_ui_url": "https://scalar.vector.im/", + "integrations_rest_url": "https://scalar.vector.im/api", + "integrations_widgets_urls": [ + "https://scalar.vector.im/_matrix/integrations/v1", + "https://scalar.vector.im/api", + "https://scalar-staging.vector.im/_matrix/integrations/v1", + "https://scalar-staging.vector.im/api", + "https://scalar-staging.riot.im/scalar/api" + ], + "default_country_code": {{ element_web_default_country_code | string | to_json }}, + "show_labs_settings": {{ element_web_show_lab_settings | to_json }}, + "features": {}, + "default_federate": true, + "default_theme": {{ element_web_default_theme | string | to_json }}, + "room_directory": { + "servers": {{ element_web_room_directory_servers | to_json }} + }, + "enable_presence_by_hs_url": { + "https://matrix.org": false, + "https://matrix-client.matrix.org": false + }, + "setting_defaults": { + "breadcrumbs": true + }, + "jitsi": { + "preferred_domain": {{ element_web_jitsi_preferred_domain | to_json }} + }, + "branding": { + "auth_footer_links": {{ element_web_branding_auth_footer_links | to_json }}, + "auth_header_logo_url": {{ element_web_branding_auth_header_logo_url | to_json }}, + "welcome_background_url": {{ element_web_branding_welcome_background_url | to_json }} + }, + "element_call": { + "url": "https://call.element.io", + "participant_limit": 8, + "brand": "Element Call" + }, + "map_style_url": "https://api.maptiler.com/maps/streets/style.json?key=fU3vlMsMn4Jb6dnEIFsx" +} diff --git a/roles/element_web/templates/vhost.j2 b/roles/element_web/templates/vhost.j2 new file mode 100644 index 0000000..5f7dc86 --- /dev/null +++ b/roles/element_web/templates/vhost.j2 @@ -0,0 +1,62 @@ +{{ ansible_managed | comment }} +# nginx element-web configuration + +server { + listen 443 {{ nginx_ssl_listen_option }}; +{% if nginx_with_ipv6 %} + listen [::]:443 {{ nginx_ssl_listen_option }}; +{% endif %} + server_name {{ element_web_vhost_server }}; + root {{ element_web_path }}; + index index.html; + + {% include 'templates/nginx_ssl.inc.j2' with context %} + + # Make sure to set Content-Security-Policy when this is not aleady done with the default headers. + add_header Content-Security-Policy "frame-ancestors 'none'"; + + {% if element_web_vhost_users|length > 0 -%} + # access protection + auth_basic "Restricted access only"; + auth_basic_user_file /etc/nginx/.htpasswd_element_web; + {% endif %} + + {% include 'templates/nginx_error_handler_static.inc.j2' with context %} + + {% if element_web_vhost_includes is defined -%} + {% for include in element_web_vhost_includes -%} + include {{ include }}.conf; + {% endfor %} + {% endif %} + +} + +server { + listen 80; +{% if nginx_with_ipv6 %} + listen [::]:80; +{% endif %} + server_name {{ element_web_vhost_server }}; + + return 301 https://{{ element_web_vhost_server }}$request_uri; +} + +{% if element_web_redirects is defined -%} +server { + server_name {{ element_web_redirects | join(' ') }}; + listen 80; + listen 443 {{ nginx_ssl_listen_option }}; +{% if nginx_with_ipv6 %} + listen [::]:80; + listen [::]:443 {{ nginx_ssl_listen_option }}; +{% endif %} + + {% include 'templates/nginx_ssl.inc.j2' with context %} + + return 301 https://{{ element_web_vhost_server }}$request_uri; +} +{% endif %} + +{% if element_web_vhost_for_zabbix %} +{% include 'templates/nginx_monitoring.inc.j2' with context %} +{% endif %} diff --git a/roles/ethercalc/tasks/main.yml b/roles/ethercalc/tasks/main.yml index 10be152..063dfc3 100644 --- a/roles/ethercalc/tasks/main.yml +++ b/roles/ethercalc/tasks/main.yml @@ -3,14 +3,18 @@ - name: Include setup tasks ansible.builtin.include_tasks: setup.yml when: not ethercalc_remove | bool - tags: ethercalc + tags: + - ethercalc - name: Include nginx tasks ansible.builtin.include_tasks: nginx.yml when: not ethercalc_remove | bool - tags: ethercalc + tags: + - ethercalc - name: Include remove tasks ansible.builtin.include_tasks: remove.yml when: ethercalc_remove | bool - tags: ethercalc + tags: + - ethercalc + - remove diff --git a/roles/ethercalc/tasks/remove.yml b/roles/ethercalc/tasks/remove.yml index eb70156..aebcf14 100644 --- a/roles/ethercalc/tasks/remove.yml +++ b/roles/ethercalc/tasks/remove.yml @@ -5,3 +5,15 @@ name: ethercalc state: stopped enabled: false + +- name: Remove configuration files + ansible.builtin.file: + name: '{{ item }}' + state: absent + loop: + - /etc/nginx/sites-available/ethercalc.conf + - /etc/nginx/sites-enabled/ethercalc.conf + - /etc/systemd/system/ethercalc.service + - /etc/systemd/system/multi-user.target.wants/ethercalc.service + notify: + - Restart nginx diff --git a/roles/ethercalc/templates/vhost.j2 b/roles/ethercalc/templates/vhost.j2 index 4e3d516..11084b5 100644 --- a/roles/ethercalc/templates/vhost.j2 +++ b/roles/ethercalc/templates/vhost.j2 @@ -29,7 +29,7 @@ server { {% if ethercalc_vhost_users|length > 0 -%} # access protection auth_basic "Restricted access only"; - auth_basic_user_file /etc/nginx/.htpasswd_codipad; + auth_basic_user_file /etc/nginx/.htpasswd_ethercalc; {% endif %} {% include 'templates/nginx_error_handler_static.inc.j2' with context %} diff --git a/roles/golang/defaults/main.yml b/roles/golang/defaults/main.yml index 921f843..ce880cf 100755 --- a/roles/golang/defaults/main.yml +++ b/roles/golang/defaults/main.yml @@ -4,8 +4,7 @@ # use fixed version e.g. '1.20.11' or latest # see https://go.dev/dl/ golang_version: latest -golang_arch: amd64 - +golang_arch: "{{ 'arm64' if ansible_architecture == 'aarch64' else 'amd64' }}" # use it with fixed version # golang_sha256_checksum: ef79a11aa095a08772d2a69e4f152f897c4e96ee297b0dc20264b7dec2961abe diff --git a/roles/hedgedoc/templates/vhost.j2 b/roles/hedgedoc/templates/vhost.j2 index 1be8256..7606462 100644 --- a/roles/hedgedoc/templates/vhost.j2 +++ b/roles/hedgedoc/templates/vhost.j2 @@ -37,7 +37,7 @@ server { {% if hedgedoc_vhost_users|length > 0 -%} # access protection auth_basic "Restricted access only"; - auth_basic_user_file /etc/nginx/.htpasswd_codipad; + auth_basic_user_file /etc/nginx/.htpasswd_hedgedoc; {% endif %} {% include 'templates/nginx_error_handler_static.inc.j2' with context %}