Commit initial
This commit is contained in:
commit
d43d412e43
|
|
@ -0,0 +1,105 @@
|
|||
# Role : docker_synapse
|
||||
|
||||
## Services fournis
|
||||
|
||||
- main.yml : Installation de synapse sur un serveur docker_host
|
||||
|
||||
## Variables
|
||||
|
||||
Fournir les variables suivantes. Par exemple :
|
||||
|
||||
```yaml
|
||||
docker_synapse_fqdn: synapse.example.com
|
||||
docker_synapse_server_name: example.com
|
||||
docker_synapse_version: v1.64.0
|
||||
docker_synapse_data_dir: /data1
|
||||
docker_synapse_service_id: synapse
|
||||
docker_synapse_db: synapse
|
||||
docker_synapse_db_user: synapse
|
||||
docker_synapse_db_password: motdepassebdd
|
||||
docker_synapse_smtp_host: smtp.example.com
|
||||
docker_synapse_oidc_enabled: true
|
||||
docker_synapse_oidc_idp_name: "Libretic"
|
||||
docker_synapse_oidc_issuer: https://auth.libretic.fr/auth/realms/libretic
|
||||
docker_synapse_oidc_scopes: ["openid','profile','email"]
|
||||
docker_synapse_oidc_client_id: client_id
|
||||
docker_synapse_oidc_client_secret: client_secret
|
||||
|
||||
docker_synapse_registration_shared_secret: "coller_ici_registration_shared_secret"
|
||||
docker_synapse_macaroon_secret_key: "coller_ici_macaroon_secret_key"
|
||||
docker_synapse_form_secret: "coller_ici_form_secret"
|
||||
|
||||
docker_synapse_retention_options:
|
||||
default:
|
||||
-_min_lifetime: 1d
|
||||
- max_lifetime: 1y
|
||||
allowed_lifetime_min: 1d
|
||||
allowed_lifetime_max: 1y
|
||||
purge_jobs:
|
||||
- longest_max_lifetime: 3d
|
||||
interval: 12h
|
||||
- shortest_max_lifetime: 3d
|
||||
longest_max_lifetime: 1w
|
||||
interval: 1d
|
||||
- shortest_max_lifetime: 1w
|
||||
interval: 2d
|
||||
```
|
||||
|
||||
| Option | Valeur par défaut | Description |
|
||||
|-------------------------------------------|-------------------|---------------------------------------------------------------------------------------------|
|
||||
| docker_synapse_fqdn | | Le fqdn pour accéder à synapse |
|
||||
| docker_synapse_server_name | | Le domaine matrix (suffixe des id utilisateur) |
|
||||
| docker_synapse_version | | Version de l'image synapse |
|
||||
| docker_synapse_data_dir | | L'emplacement dans lequel se trouvent les volumes de donnees docker pour le service |
|
||||
| docker_synapse_service_id | | Le nom de service souhaité : conditionne le nommage des dossiers et le routage par traefik |
|
||||
| docker_synapse_db | | Le nom de la base de données |
|
||||
| docker_synapse_db_user | | Le nom du user propriétaire de la base de données |
|
||||
| docker_synapse_db_password | | Le mot de passe du user propriétaire de la base de données |
|
||||
| docker_synapse_smtp_host | | FQDN du serveur smtp pour l'envoi de mails par synapse |
|
||||
| docker_synapse_oidc_enabled | false | Active la configuration openid connect |
|
||||
| docker_synapse_oidc_idp_id | | Type de provider openid |
|
||||
| docker_synapse_oidc_idp_name | | Nom du provider (s'affiche dans les intitulés "Se connecter avec ...") |
|
||||
| docker_synapse_oidc_issuer | | Url vers le provider |
|
||||
| docker_synapse_oidc_scopes | | Liste de scopes openid connect |
|
||||
| docker_synapse_oidc_client_id | | client_id openid connect |
|
||||
| docker_synapse_oidc_client_secret | | secret associé au client id |
|
||||
| docker_synapse_registration_shared_secret | | registration_shared_secret obtenu avec docker_synapse_gen_config=true |
|
||||
| docker_synapse_macaroon_secret_key | | macaroon_secret_key obtenu avec docker_synapse_gen_config=true |
|
||||
| docker_synapse_form_secret | | form_secret obtenu avec docker_synapse_gen_config=true |
|
||||
| docker_synapse_smtp_enabled | false | Active la configuration smtp |
|
||||
| docker_synapse_smtp_host | | Serveur smtp |
|
||||
| docker_synapse_smtp_from | | Valeur du from pour l'envoi d'un courriel |
|
||||
| docker_synapse_smtp_app_name | | Valeur qui apparaitra dans les [ ] dans les sujets des courriels |
|
||||
| docker_synapse_gen_config | false | Demande au playbook de générer une configuration à partir de laquelle récupérer les secrets |
|
||||
| docker_synapse_retention_options | | Si précisé, active la section retention dans la configuration de synapse avec ces options |
|
||||
|
||||
|
||||
## Première installation
|
||||
|
||||
|
||||
- provisionner l'environnement une première fois en positionnant la variable docker_synapse_gen_config à true ; le playbook va générer des valeurs à copier/coller dans les variables de playbook de l'environnement
|
||||
|
||||
```
|
||||
ansible-playbook -i inventory/vms -i inventory/synapse setup_synapse.yml -e "{ docker_synapse_gen_config: true }"
|
||||
```
|
||||
|
||||
- poursuivre la configuration après avoir recopié dans l'inventaire les valeurs générées dans le homeserver.yml
|
||||
|
||||
```
|
||||
ansible-playbook -i inventory/vms -i inventory/synapse setup_synapse.yml"
|
||||
```
|
||||
|
||||
|
||||
- enregistrer un premier utilisateur administrateur administrateur
|
||||
|
||||
```
|
||||
docker exec -ti synapse_synapse_1 bash
|
||||
root@d9017ba62b36:/# register_new_matrix_user -c /data/homeserver.yaml http://localhost:8008
|
||||
New user localpart [root]: admin
|
||||
Password:
|
||||
Confirm password:
|
||||
Make admin [no]: yes
|
||||
Sending registration request...
|
||||
Success!
|
||||
root@d9017ba62b36:/#
|
||||
```
|
||||
|
|
@ -0,0 +1,5 @@
|
|||
docker_synapse_gen_config: false
|
||||
|
||||
docker_synapse_oidc_enabled: false
|
||||
|
||||
docker_synapse_smtp_enabled: false
|
||||
|
|
@ -0,0 +1,5 @@
|
|||
- name: docker-compose-up
|
||||
shell: |
|
||||
docker-compose up -d
|
||||
args:
|
||||
chdir: /opt/{{ docker_synapse_service_id }}/
|
||||
|
|
@ -0,0 +1,8 @@
|
|||
galaxy_info:
|
||||
author: Olivier Navas
|
||||
description: Modèle d'installation Libretic pour synapse
|
||||
license: GPL-3.0-only
|
||||
min_ansible_version: 2.9
|
||||
galaxy_tags: []
|
||||
|
||||
dependencies: []
|
||||
|
|
@ -0,0 +1,50 @@
|
|||
- name: docker directory
|
||||
file:
|
||||
path: /opt/{{ docker_synapse_service_id }}/
|
||||
state: directory
|
||||
|
||||
- name: prepare docker-compose.yml
|
||||
template:
|
||||
src: "{{ item }}"
|
||||
dest: /opt/{{ docker_synapse_service_id }}/
|
||||
with_items:
|
||||
- docker-compose.yml
|
||||
notify: docker-compose-up
|
||||
|
||||
|
||||
- name: generate secrets
|
||||
when: docker_synapse_gen_config is true
|
||||
block:
|
||||
|
||||
- name: docker-compose-gen-config
|
||||
shell: |
|
||||
docker-compose down
|
||||
docker-compose run --rm synapse generate
|
||||
cp -a {{ docker_synapse_data_dir }}/{{ docker_synapse_service_id }}/synapse_data/homeserver.yaml /opt/{{ docker_synapse_service_id }}/
|
||||
args:
|
||||
chdir: /opt/{{ docker_synapse_service_id }}/
|
||||
register: config
|
||||
|
||||
- debug:
|
||||
msg: "{{ config.stdout_lines }}"
|
||||
|
||||
- debug:
|
||||
msg: "Récupérer les valeurs suivantes du fichier de configuration qui vient d'être généré pour alimenter les variables du playbook synapse"
|
||||
|
||||
|
||||
- name: Playbook stops here if docker_synapse_gen_config is set
|
||||
assert:
|
||||
that:
|
||||
- docker_synapse_gen_config is false
|
||||
|
||||
|
||||
- name: prepare configuration
|
||||
template:
|
||||
src: "{{ item }}"
|
||||
dest: /opt/{{ docker_synapse_service_id }}/
|
||||
with_items:
|
||||
- homeserver.yaml
|
||||
notify: docker-compose-up
|
||||
|
||||
|
||||
|
||||
|
|
@ -0,0 +1,49 @@
|
|||
# {{ ansible_managed }}
|
||||
version: '3.1'
|
||||
|
||||
services:
|
||||
synapse:
|
||||
image: matrixdotorg/synapse:{{ docker_synapse_version }}
|
||||
volumes:
|
||||
- {{ docker_synapse_data_dir }}/{{ docker_synapse_service_id }}/synapse_data:/data
|
||||
{% if docker_synapse_gen_config is false %}
|
||||
- ./homeserver.yaml:/data/homeserver.yaml
|
||||
{% endif %}
|
||||
restart: always
|
||||
depends_on:
|
||||
- db
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.docker.network=traefik"
|
||||
- "traefik.http.routers.{{ docker_synapse_service_id }}.entrypoints=web"
|
||||
- "traefik.http.routers.{{ docker_synapse_service_id }}.rule=Host(`{{ docker_synapse_fqdn }}`)"
|
||||
- "traefik.http.services.{{ docker_synapse_service_id }}.loadbalancer.server.port=8008"
|
||||
networks:
|
||||
- synapse
|
||||
- traefik
|
||||
environment:
|
||||
- SYNAPSE_SERVER_NAME={{ docker_synapse_server_name }}
|
||||
- SYNAPSE_REPORT_STATS={{ docker_synapse_report_stats }}
|
||||
|
||||
db:
|
||||
restart: always
|
||||
image: postgres:14
|
||||
shm_size: 256mb
|
||||
networks:
|
||||
- synapse
|
||||
healthcheck:
|
||||
test: ['CMD', 'pg_isready', '-U', 'postgres']
|
||||
volumes:
|
||||
- {{ docker_synapse_data_dir }}/{{ docker_synapse_service_id }}/db_data:/var/lib/postgresql/data
|
||||
environment:
|
||||
POSTGRES_DB: "{{ docker_synapse_db_name }}"
|
||||
POSTGRES_USER: "{{ docker_synapse_db_user }}"
|
||||
POSTGRES_PASSWORD: "{{ docker_synapse_db_password }}"
|
||||
POSTGRES_INITDB_ARGS: "--encoding=UTF-8 --lc-collate=C --lc-ctype=C"
|
||||
|
||||
|
||||
networks:
|
||||
traefik:
|
||||
external: true
|
||||
synapse:
|
||||
internal: true
|
||||
|
|
@ -0,0 +1,77 @@
|
|||
# {{ ansible_managed }}
|
||||
server_name: "{{ docker_synapse_server_name }}"
|
||||
pid_file: /data/homeserver.pid
|
||||
listeners:
|
||||
- port: 8008
|
||||
tls: false
|
||||
type: http
|
||||
x_forwarded: true
|
||||
resources:
|
||||
- names: [client, federation]
|
||||
compress: false
|
||||
|
||||
database:
|
||||
name: psycopg2
|
||||
args:
|
||||
host: db
|
||||
database: {{ docker_synapse_db_name }}
|
||||
user: {{ docker_synapse_db_user }}
|
||||
password: {{ docker_synapse_db_password }}
|
||||
cp_min: 5
|
||||
cp_max: 10
|
||||
|
||||
log_config: "/data/{{ docker_synapse_server_name }}.log.config"
|
||||
media_store_path: /data/media_store
|
||||
registration_shared_secret: "{{ docker_synapse_registration_shared_secret }}"
|
||||
report_stats: false
|
||||
macaroon_secret_key: "{{ docker_synapse_macaroon_secret_key }}"
|
||||
form_secret: "{{ docker_synapse_form_secret }}"
|
||||
signing_key_path: "/data/{{ docker_synapse_server_name }}.signing.key"
|
||||
trusted_key_servers:
|
||||
- server_name: "matrix.org"
|
||||
|
||||
{% if docker_synapse_oidc_enabled is true %}
|
||||
oidc_providers:
|
||||
- idp_id: {{ docker_synapse_oidc_idp_id }}
|
||||
idp_name: "{{ docker_synapse_oidc_idp_name }}"
|
||||
issuer: "{{ docker_synapse_oidc_issuer }}"
|
||||
client_id: "{{ docker_synapse_oidc_client_id }}"
|
||||
client_secret: "{{ docker_synapse_oidc_client_secret }}"
|
||||
scopes: {{ docker_synapse_oidc_scopes }}
|
||||
user_mapping_provider:
|
||||
config:
|
||||
localpart_template: "{{ "{{ user.preferred_username }}" }}"
|
||||
display_name_template: "{{ "{{ user.name }}" }}"
|
||||
|
||||
password_config:
|
||||
enabled: only_for_reauth
|
||||
{% endif %}
|
||||
|
||||
|
||||
{% if docker_synapse_smtp_enabled is true %}
|
||||
email:
|
||||
smtp_host: "{{ docker_synapse_smtp_host }}"
|
||||
notif_from: "{{ docker_synapse_smtp_from }}"
|
||||
enable_notifs: true
|
||||
notif_for_new_users: false
|
||||
invite_client_location: https://app.element.io
|
||||
app_name: "{{ docker_synapse_smtp_app_name }}"
|
||||
|
||||
|
||||
subjects:
|
||||
message_from_person_in_room: "[%(app)s] Vous avez un message sur %(app)s de %(person)s dans le canal %(room)s..."
|
||||
message_from_person: "[%(app)s] Vous avez un message sur %(app)s de %(person)s..."
|
||||
messages_from_person: "[%(app)s] Vous avez des messages sur %(app)s de %(person)s..."
|
||||
messages_in_room: "[%(app)s] Vous avez des messages sur %(app)s dans le canal %(room)s..."
|
||||
messages_in_room_and_others: "[%(app)s] Vous avez des messages sur %(app)s dans le canal %(room)s et autres canaux..."
|
||||
messages_from_person_and_others: "[%(app)s] Vous avez des messages sur %(app)s de %(person)s et autres personnes..."
|
||||
invite_from_person_to_room: "[%(app)s] %(person)s vous a invité à rejoindre le canal %(room)s sur %(app)s..."
|
||||
invite_from_person: "[%(app)s] %(person)s vous a invité à discuter sur %(app)s..."
|
||||
password_reset: "[%(server_name)s] Mot de passe réinitialisé"
|
||||
email_validation: "[%(server_name)s] Validez votre adresse de courriel"
|
||||
{% endif %}
|
||||
|
||||
{% if docker_synapse_retention_options is defined %}
|
||||
retention: {{ docker_synapse_retention_options | combine({ 'enabled': true }) }}
|
||||
{% endif %}
|
||||
|
||||
Loading…
Reference in New Issue