You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
164 lines
4.4 KiB
164 lines
4.4 KiB
---
|
|
- name: 'install gnupg and ca-cert'
|
|
apt:
|
|
pkg:
|
|
- 'gnupg'
|
|
- 'ca-certificates'
|
|
tags:
|
|
- 'packages'
|
|
|
|
- name: 'add matrix gnupg key to apt'
|
|
apt_key:
|
|
id: 'AAF9AE843A7584B5A3E4CD2BCF45A512DE2DA058'
|
|
url: 'https://packages.matrix.org/debian/matrix-org-archive-keyring.gpg'
|
|
state: 'present'
|
|
tags:
|
|
- 'packages'
|
|
|
|
- name: 'add matrix apt repos'
|
|
apt_repository:
|
|
repo: '{{ item }}'
|
|
state: 'present'
|
|
loop:
|
|
- 'deb https://packages.matrix.org/debian/ bullseye main'
|
|
- 'deb-src https://packages.matrix.org/debian/ bullseye main'
|
|
tags:
|
|
- 'packages'
|
|
|
|
- name: 'set synapse server name'
|
|
debconf:
|
|
name: 'matrix-synapse-py3'
|
|
question: 'matrix-synapse/server-name'
|
|
vtype: 'string'
|
|
value: '{{ synapse_domain }}'
|
|
|
|
- name: 'install synapse'
|
|
import_role: name='service'
|
|
vars:
|
|
service_name: 'matrix-synapse'
|
|
service_packages:
|
|
- 'matrix-synapse-py3'
|
|
- 'postgresql'
|
|
- 'postgresql-contrib'
|
|
- 'python3-psycopg2'
|
|
|
|
- block:
|
|
- name: 'PGSQL | create synapse DB'
|
|
postgresql_db:
|
|
name: 'synapse'
|
|
encoding: 'UTF-8'
|
|
lc_collate: 'C'
|
|
lc_ctype: 'C'
|
|
template: 'template0'
|
|
- name: 'PGSQL | create synapse DB user'
|
|
postgresql_user:
|
|
name: 'matrix-synapse'
|
|
db: 'synapse'
|
|
priv: 'ALL'
|
|
become: true
|
|
become_method: 'su'
|
|
become_user: 'postgres'
|
|
|
|
#- name: fix synapse folders permissions
|
|
# file:
|
|
# path: "{{ item }}"
|
|
# owner: matrix-synapse
|
|
# group: nogroup
|
|
# mode: 0750
|
|
# state: directory
|
|
# with_items:
|
|
# - /etc/matrix-synapse
|
|
# - /etc/matrix-synapse/conf.d
|
|
|
|
- name: 'upload synapse reverse proxy conf'
|
|
template:
|
|
src: 'synapse.conf.j2'
|
|
dest: '/etc/nginx/locations/{{ synapse_nginx_fqdn }}/synapse.conf'
|
|
vars:
|
|
nginx_proxy_remote_host: '{{ synapse_nginx_proxy_remote_host }}'
|
|
nginx_proxy_location_path: '{{ synapse_nginx_proxy_location_path }}'
|
|
notify: 'restart nginx'
|
|
|
|
- name: 'try to read LDAP service password'
|
|
command: 'sed -n "s/^\s\+bind_password: \"\(.\+\)\"$/\1/p" /etc/matrix-synapse/homeserver.yaml'
|
|
register: synapse_read_ldap_passwd
|
|
no_log: true
|
|
tags:
|
|
- 'service_password'
|
|
|
|
- name: 'set LDAP service password'
|
|
set_fact:
|
|
synapse_ldap_passwd: '{{ synapse_read_ldap_passwd.stdout | d("") }}'
|
|
no_log: true
|
|
tags:
|
|
- 'service_password'
|
|
|
|
- block:
|
|
- name: 'LDAP | generate client service password'
|
|
gen_passwd: 'length=32'
|
|
register: 'synapse_ldap_gen_passwd'
|
|
no_log: true
|
|
tags:
|
|
- 'service_password'
|
|
- name: 'LDAP | set client service password on server'
|
|
delegate_to: 'localhost'
|
|
ldap_passwd:
|
|
dn: 'cn={{ host_fqdn }},ou=Server,{{ ldap_basedn }}'
|
|
passwd: '{{ synapse_ldap_gen_passwd.passwd }}'
|
|
server_uri: 'ldap://{{ ldap_server }}'
|
|
start_tls: '{{ ldap_tls_enabled }}'
|
|
bind_dn: '{{ ldap_admin_dn }}'
|
|
bind_pw: '{{ ldap_admin_pw }}'
|
|
- name: 'LDAP | set client service password on client'
|
|
set_fact:
|
|
synapse_ldap_passwd: '{{ synapse_ldap_gen_passwd.passwd }}'
|
|
no_log: true
|
|
when: synapse_ldap_passwd == '' or ldap_renew_secret
|
|
tags:
|
|
- 'service_password'
|
|
|
|
- name: 'LDAP | update client root ca'
|
|
copy:
|
|
content: '{{ ldap_tls_server_ca }}'
|
|
dest: '/etc/ldap/server_ca.crt'
|
|
|
|
- name: 'LDAP | configure client'
|
|
copy:
|
|
src: 'ldap.conf'
|
|
dest: '/etc/ldap/ldap.conf'
|
|
|
|
- name: 'get turn shared secret'
|
|
slurp:
|
|
path: '/etc/coturn_rest.secret'
|
|
register: coturn_secret
|
|
when: synapse_coturn_integration
|
|
delegate_to: '{{ coturn_host }}'
|
|
|
|
- name: 'upload synapse conf'
|
|
template:
|
|
src: 'homeserver.yaml.j2'
|
|
dest: '/etc/matrix-synapse/homeserver.yaml'
|
|
notify: 'reload matrix-synapse'
|
|
tags:
|
|
- 'service_password'
|
|
|
|
- name: 'MONITORING | add HTTP service'
|
|
block:
|
|
- name: 'MONITORING | add service to monitoring entry'
|
|
set_fact:
|
|
monitoring_entry: >
|
|
{{ monitoring_entry | default({}) | combine({
|
|
'address': ansible_host,
|
|
'vhosts_uri': { synapse_nginx_fqdn: {'/_matrix/client/versions': '{"versions":'} },
|
|
}, recursive=true) }}
|
|
- name: 'MONITORING | update monitoring facts'
|
|
set_fact:
|
|
monitoring_facts: >
|
|
{{ hostvars[monitoring_host]['monitoring_facts']
|
|
| default({})
|
|
| combine({host_fqdn: monitoring_entry}) }}
|
|
delegate_facts: true
|
|
delegate_to: '{{ monitoring_host }}'
|
|
tags:
|
|
- 'monitoring'
|
|
...
|