roles/matrix-synapse: add coturn integration support

roles/matrix-synapse/defaults/main.yaml

@@ -6,3 +6,7 @@ matrix_domain: '{{ domain }}'
 ldap_server: 'ldap1.dmz.{{ domain }}'
 ldap_domain: '{{ domain }}'
 ldap_basedn: 'dc={{ ldap_domain.replace(".", ",dc=") }}'
+turn_integration: true
+turn_host: 'matrix'
+turn_fqdn: 'turn.{{ domain }}'
+turn_port: '3478'

roles/matrix-synapse/tasks/main.yaml

@@ -78,7 +78,7 @@
 
 - name: 'generate matrix ldap password'
   gen_passwd: 'length=32'
-  register: 'new_passwd'
+  register: new_passwd
   tags:
     - 'service_password'
 
@@ -104,6 +104,12 @@
     src: 'ldap.conf'
     dest: '/etc/ldap/ldap.conf'
 
+- name: 'get turn shared secret'
+  slurp:
+    path: '/etc/coturn_rest.secret'
+  register: coturn_secret
+  when: turn_integration
+  delegate_to: '{{ turn_host }}'
 
 - name: 'upload synapse conf'
   template:

roles/matrix-synapse/templates/homeserver.yaml.j2

@@ -842,13 +842,14 @@ media_store_path: "/var/lib/matrix-synapse/media"
 
 ## TURN ##
 
+{% if turn_integration %}
 # The public URIs of the TURN server to give to clients
 #
-#turn_uris: []
+turn_uris: [ "turn:{{ turn_fqdn }}:{{ turn_port }}?transport=udp", "turn:{{ turn_fqdn }}:{{ turn_port }}?transport=tcp" ]
 
 # The shared secret used to compute passwords for the TURN server
 #
-#turn_shared_secret: "YOUR_SHARED_SECRET"
+turn_shared_secret: "{{ coturn_secret.content | b64decode }}"
 
 # The Username and password if the TURN server needs them and
 # does not use a token
@@ -858,7 +859,7 @@ media_store_path: "/var/lib/matrix-synapse/media"
 
 # How long generated TURN credentials last
 #
-#turn_user_lifetime: 1h
+turn_user_lifetime: 86400000
 
 # Whether guests should be allowed to use the TURN server.
 # This defaults to True, otherwise VoIP will be unreliable for guests.
@@ -866,8 +867,8 @@ media_store_path: "/var/lib/matrix-synapse/media"
 # connect to arbitrary endpoints without having first signed up for a
 # valid account (e.g. by passing a CAPTCHA).
 #
-#turn_allow_guests: true
-
+turn_allow_guests: false
+{% endif %}
 
 ## Registration ##
 #