Added Traefik support to MMR

group_vars/matrix_servers

@@ -2693,10 +2693,21 @@ matrix_ma1sd_database_password: "{{ '%s' | format(matrix_homeserver_generic_secr
 #
 ######################################################################
 
-matrix_media_repo_enabled: false
+matrix_media_repo_identifier: matrix-media-repo
-matrix_media_repo_container_network: "{{ matrix_docker_network }}"
 
-matrix_media_repo_container_labels_traefik_enabled: false
+matrix_media_repo_enabled: false
+matrix_media_repo_container_network: "{{ matrix_nginx_proxy_container_network if matrix_playbook_reverse_proxy_type == 'playbook-managed-nginx' else matrix_media_repo_identifier }}"
+
+matrix_media_repo_container_additional_networks: |
+  {{
+    (
+      ([matrix_playbook_reverse_proxyable_services_additional_network] if matrix_playbook_reverse_proxyable_services_additional_network else [])
+      +
+      ([devture_postgres_container_network] if devture_postgres_enabled and devture_postgres_container_network != matrix_media_repo_container_network else [])
+    ) | unique
+  }}
+
+matrix_media_repo_container_labels_traefik_enabled: "{{ matrix_playbook_traefik_labels_enabled }}"
 matrix_media_repo_container_labels_traefik_docker_network: "{{ matrix_playbook_reverse_proxyable_services_additional_network }}"
 matrix_media_repo_container_labels_traefik_entrypoints: "{{ devture_traefik_entrypoint_primary }}"
 matrix_media_repo_container_labels_traefik_tls_certResolver: "{{ devture_traefik_certResolver_primary }}"

roles/custom/matrix-media-repo/defaults/main.yml

@@ -34,7 +34,7 @@ matrix_media_repo_systemd_required_services_list: ["docker.service"]
 matrix_media_repo_systemd_wanted_services_list: []
 
 # The base container network. It will be auto-created by this role if it doesn't exist already.
-matrix_media_repo_container_network: "{{ matrix_docker_network }}"
+matrix_media_repo_container_network: "{{ matrix_media_repo_identifier }}"
 
 # A list of additional container networks that the container would be connected to.
 # The role does not create these networks, so make sure they already exist.
@@ -54,6 +54,97 @@ matrix_media_repo_container_metrics_host_bind_port: ""
 # Extra arguments for the Docker container
 matrix_media_repo_container_extra_arguments: []
 
+# matrix_media_repo_container_labels_traefik_enabled controls whether labels to assist a Traefik reverse-proxy will be attached to the container.
+# See `../templates/labels.j2` for details.
+#
+# To inject your own other container labels, see `matrix_media_repo_container_labels_additional_labels`.
+matrix_media_repo_container_labels_traefik_enabled: true
+matrix_media_repo_container_labels_traefik_docker_network: "{{ matrix_media_repo_container_network }}"
+
+matrix_media_repo_container_labels_traefik_media_path_prefix: "/_matrix/media"
+matrix_media_repo_container_labels_traefik_media_rule: "Host(`{{ matrix_server_fqn_matrix }}`) && PathPrefix(`{{ matrix_media_repo_container_labels_traefik_media_path_prefix | quote }}`)"
+matrix_media_repo_container_labels_traefik_media_priority: 0
+matrix_media_repo_container_labels_traefik_media_entrypoints: web-secure
+matrix_media_repo_container_labels_traefik_media_tls: "{{ matrix_media_repo_container_labels_traefik_media_entrypoints != 'web' }}"
+matrix_media_repo_container_labels_traefik_media_tls_certResolver: default  # noqa var-naming
+
+# /_matrix/client/r0/logout
+# /_matrix/client/r0/logout/all
+matrix_media_repo_container_labels_traefik_logout_path_prefix: "/_matrix/client/{version:(r0|v1|v3|unstable)}/{endpoint:(logout|logout/all)}"
+matrix_media_repo_container_labels_traefik_logout_rule: "Host(`{{ matrix_server_fqn_matrix }}`) && PathPrefix(`{{ matrix_media_repo_container_labels_traefik_logout_path_prefix }}`)"
+matrix_media_repo_container_labels_traefik_logout_priority: 0
+matrix_media_repo_container_labels_traefik_logout_entrypoints: web-secure
+matrix_media_repo_container_labels_traefik_logout_tls: "{{ matrix_media_repo_container_labels_traefik_logout_entrypoints != 'web' }}"
+matrix_media_repo_container_labels_traefik_logout_tls_certResolver: default  # noqa var-naming
+
+# /_matrix/client/r0/admin/purge_media_cache
+# /_matrix/client/r0/admin/quarantine_media/{roomId:[^/]+}
+matrix_media_repo_container_labels_traefik_admin_path_prefix: "/_matrix/client/{version:(r0|v1|v3|unstable)}/admin/{endpoint:(purge_media_cache|quarantine_media/.*)}"
+matrix_media_repo_container_labels_traefik_admin_rule: "Host(`{{ matrix_server_fqn_matrix }}`) && PathPrefix(`{{ matrix_media_repo_container_labels_traefik_admin_path_prefix }}`)"
+matrix_media_repo_container_labels_traefik_admin_priority: 0
+matrix_media_repo_container_labels_traefik_admin_entrypoints: web-secure
+matrix_media_repo_container_labels_traefik_admin_tls: "{{ matrix_media_repo_container_labels_traefik_admin_entrypoints != 'web' }}"
+matrix_media_repo_container_labels_traefik_admin_tls_certResolver: default  # noqa var-naming
+
+matrix_media_repo_container_labels_traefik_t2bot_path_prefix: "/_matrix/client/unstable/io.t2bot.media"
+matrix_media_repo_container_labels_traefik_t2bot_rule: "Host(`{{ matrix_server_fqn_matrix }}`) && PathPrefix(`{{ matrix_media_repo_container_labels_traefik_t2bot_path_prefix | quote }}`)"
+matrix_media_repo_container_labels_traefik_t2bot_priority: 0
+matrix_media_repo_container_labels_traefik_t2bot_entrypoints: web-secure
+matrix_media_repo_container_labels_traefik_t2bot_tls: "{{ matrix_media_repo_container_labels_traefik_t2bot_entrypoints != 'web' }}"
+matrix_media_repo_container_labels_traefik_t2bot_tls_certResolver: default  # noqa var-naming
+
+# Traefik federation labels
+matrix_media_repo_container_labels_traefik_media_federation_path_prefix: "/_matrix/media"
+matrix_media_repo_container_labels_traefik_media_federation_rule: "Host(`{{ matrix_server_fqn_matrix }}`) && PathPrefix(`{{ matrix_media_repo_container_labels_traefik_media_path_prefix | quote }}`)"
+matrix_media_repo_container_labels_traefik_media_federation_priority: 0
+matrix_media_repo_container_labels_traefik_media_federation_entrypoints: "{{ matrix_federation_traefik_entrypoint }}"
+matrix_media_repo_container_labels_traefik_media_federation_tls: "{{ matrix_media_repo_container_labels_traefik_media_entrypoints != 'web' }}"
+matrix_media_repo_container_labels_traefik_media_federation_tls_certResolver: default  # noqa var-naming
+
+# /_matrix/client/r0/logout
+# /_matrix/client/r0/logout/all
+matrix_media_repo_container_labels_traefik_logout_federation_path_prefix: "/_matrix/client/{version:(r0|v1|v3|unstable)}/{endpoint:(logout|logout/all)}"
+matrix_media_repo_container_labels_traefik_logout_federation_rule: "Host(`{{ matrix_server_fqn_matrix }}`) && PathPrefix(`{{ matrix_media_repo_container_labels_traefik_logout_path_prefix }}`)"
+matrix_media_repo_container_labels_traefik_logout_federation_priority: 0
+matrix_media_repo_container_labels_traefik_logout_federation_entrypoints: "{{ matrix_federation_traefik_entrypoint }}"
+matrix_media_repo_container_labels_traefik_logout_federation_tls: "{{ matrix_media_repo_container_labels_traefik_logout_entrypoints != 'web' }}"
+matrix_media_repo_container_labels_traefik_logout_federation_tls_certResolver: default  # noqa var-naming
+
+# /_matrix/client/r0/admin/purge_media_cache
+# /_matrix/client/r0/admin/quarantine_media/{roomId:[^/]+}
+matrix_media_repo_container_labels_traefik_admin_federation_path_prefix: "/_matrix/client/{version:(r0|v1|v3|unstable)}/admin/{endpoint:(purge_media_cache|quarantine_media/.*)}"
+matrix_media_repo_container_labels_traefik_admin_federation_rule: "Host(`{{ matrix_server_fqn_matrix }}`) && PathPrefix(`{{ matrix_media_repo_container_labels_traefik_admin_path_prefix }}`)"
+matrix_media_repo_container_labels_traefik_admin_federation_priority: 0
+matrix_media_repo_container_labels_traefik_admin_federation_entrypoints: "{{ matrix_federation_traefik_entrypoint }}"
+matrix_media_repo_container_labels_traefik_admin_federation_tls: "{{ matrix_media_repo_container_labels_traefik_admin_entrypoints != 'web' }}"
+matrix_media_repo_container_labels_traefik_admin_federation_tls_certResolver: default  # noqa var-naming
+
+matrix_media_repo_container_labels_traefik_t2bot_federation_path_prefix: "/_matrix/client/unstable/io.t2bot.media"
+matrix_media_repo_container_labels_traefik_t2bot_federation_rule: "Host(`{{ matrix_server_fqn_matrix }}`) && PathPrefix(`{{ matrix_media_repo_container_labels_traefik_t2bot_path_prefix | quote }}`)"
+matrix_media_repo_container_labels_traefik_t2bot_federation_priority: 0
+matrix_media_repo_container_labels_traefik_t2bot_federation_entrypoints: "{{ matrix_federation_traefik_entrypoint }}"
+matrix_media_repo_container_labels_traefik_t2bot_federation_tls: "{{ matrix_media_repo_container_labels_traefik_t2bot_entrypoints != 'web' }}"
+matrix_media_repo_container_labels_traefik_t2bot_federation_tls_certResolver: default  # noqa var-naming
+
+# Controls which additional headers to attach to all HTTP requests.
+# To add your own headers, use `matrix_media_repo_container_labels_traefik_additional_request_headers_custom`
+matrix_media_repo_container_labels_traefik_additional_request_headers: "{{ matrix_media_repo_container_labels_traefik_additional_request_headers_auto | combine(matrix_media_repo_container_labels_traefik_additional_request_headers_custom) }}"
+matrix_media_repo_container_labels_traefik_additional_request_headers_auto: |
+  {{
+    {}
+    | combine ({'X-Forwarded-Host': matrix_domain} if matrix_domain else {})
+  }}
+matrix_media_repo_container_labels_traefik_additional_request_headers_custom: {}
+
+# matrix_media_repo_container_labels_additional_labels contains a multiline string with additional labels to add to the container label file.
+# See `../templates/labels.j2` for details.
+#
+# Example:
+# matrix_media_repo_container_labels_additional_labels: |
+#   my.label=1
+#   another.label="here"
+matrix_media_repo_container_labels_additional_labels: ''
+
 # matrix_media_repo_dashboard_urls contains a list of URLs with Grafana dashboard definitions.
 # If the Grafana role is enabled, these dashboards will be downloaded.
 matrix_media_repo_dashboard_urls:

roles/custom/matrix-media-repo/tasks/setup_install.yml

@@ -27,6 +27,7 @@
     group: "{{ matrix_user_groupname }}"
   with_items:
     - env
+    - labels
 
 - name: Ensure media-repo configuration installed
   ansible.builtin.template:

roles/custom/matrix-media-repo/templates/media-repo/labels.j2

@@ -0,0 +1,147 @@
+{% if matrix_media_repo_container_labels_traefik_enabled %}
+traefik.enable=true
+
+{% if matrix_media_repo_container_labels_traefik_docker_network %}
+traefik.docker.network={{ matrix_media_repo_container_labels_traefik_docker_network }}
+{% endif %}
+
+{% set middlewares = [] %}
+
+{% if matrix_media_repo_container_labels_traefik_additional_request_headers.keys() | length > 0 %}
+{% for name, value in matrix_media_repo_container_labels_traefik_additional_request_headers.items() %}
+traefik.http.middlewares.matrix-media-repo-add-headers.headers.customrequestheaders.{{ name }}={{ value }}
+{% endfor %}
+{% set middlewares = middlewares + ['matrix-media-repo-add-headers'] %}
+{% endif %}
+
+# Matrix Client
+traefik.http.routers.matrix-media-repo-media.rule={{ matrix_media_repo_container_labels_traefik_media_rule }}
+{% if matrix_media_repo_container_labels_traefik_media_priority | int > 0 %}
+traefik.http.routers.matrix-media-repo-media.priority={{ matrix_media_repo_container_labels_traefik_media_priority }}
+{% endif %}
+{% if middlewares | length > 0 %}
+traefik.http.routers.matrix-media-repo-media.middlewares={{ middlewares | join(',') }}
+{% endif %}
+traefik.http.routers.matrix-media-repo-media.service=matrix-media-repo
+traefik.http.routers.matrix-media-repo-media.entrypoints={{ matrix_media_repo_container_labels_traefik_media_entrypoints }}
+traefik.http.routers.matrix-media-repo-media.tls={{ matrix_media_repo_container_labels_traefik_media_tls | to_json }}
+{% if matrix_media_repo_container_labels_traefik_media_tls %}
+traefik.http.routers.matrix-media-repo-media.tls.certResolver={{ matrix_media_repo_container_labels_traefik_media_tls_certResolver }}
+{% endif %}
+
+{% if matrix_media_repo_access_tokens_max_cache_time_seconds > 0 %}
+
+traefik.http.routers.matrix-media-repo-logout.rule={{ matrix_media_repo_container_labels_traefik_logout_rule }}
+{% if matrix_media_repo_container_labels_traefik_logout_priority | int > 0 %}
+traefik.http.routers.matrix-media-repo-logout.priority={{ matrix_media_repo_container_labels_traefik_logout_priority }}
+{% endif %}
+{% if middlewares | length > 0 %}
+traefik.http.routers.matrix-media-repo-logout.middlewares={{ middlewares | join(',') }}
+{% endif %}
+traefik.http.routers.matrix-media-repo-logout.service=matrix-media-repo
+traefik.http.routers.matrix-media-repo-logout.entrypoints={{ matrix_media_repo_container_labels_traefik_logout_entrypoints }}
+traefik.http.routers.matrix-media-repo-logout.tls={{ matrix_media_repo_container_labels_traefik_logout_tls | to_json }}
+{% if matrix_media_repo_container_labels_traefik_logout_tls %}
+traefik.http.routers.matrix-media-repo-logout.tls.certResolver={{ matrix_media_repo_container_labels_traefik_logout_tls_certResolver }}
+{% endif %}
+
+{% endif %}
+
+traefik.http.routers.matrix-media-repo-admin-federation.rule={{ matrix_media_repo_container_labels_traefik_admin_rule }}
+{% if matrix_media_repo_container_labels_traefik_admin_priority | int > 0 %}
+traefik.http.routers.matrix-media-repo-admin-federation.priority={{ matrix_media_repo_container_labels_traefik_admin_priority }}
+{% endif %}
+{% if middlewares | length > 0 %}
+traefik.http.routers.matrix-media-repo-admin-federation.middlewares={{ middlewares | join(',') }}
+{% endif %}
+traefik.http.routers.matrix-media-repo-admin-federation.service=matrix-media-repo
+traefik.http.routers.matrix-media-repo-admin-federation.entrypoints={{ matrix_media_repo_container_labels_traefik_admin_entrypoints }}
+traefik.http.routers.matrix-media-repo-admin-federation.tls={{ matrix_media_repo_container_labels_traefik_admin_tls | to_json }}
+{% if matrix_media_repo_container_labels_traefik_admin_tls %}
+traefik.http.routers.matrix-media-repo-admin-federation.tls.certResolver={{ matrix_media_repo_container_labels_traefik_admin_tls_certResolver }}
+{% endif %}
+
+traefik.http.routers.matrix-media-repo-t2bot.rule={{ matrix_media_repo_container_labels_traefik_t2bot_rule }}
+{% if matrix_media_repo_container_labels_traefik_t2bot_priority | int > 0 %}
+traefik.http.routers.matrix-media-repo-t2bot.priority={{ matrix_media_repo_container_labels_traefik_t2bot_priority }}
+{% endif %}
+{% if middlewares | length > 0 %}
+traefik.http.routers.matrix-media-repo-t2bot.middlewares={{ middlewares | join(',') }}
+{% endif %}
+traefik.http.routers.matrix-media-repo-t2bot.service=matrix-media-repo
+traefik.http.routers.matrix-media-repo-t2bot.entrypoints={{ matrix_media_repo_container_labels_traefik_t2bot_entrypoints }}
+traefik.http.routers.matrix-media-repo-t2bot.tls={{ matrix_media_repo_container_labels_traefik_t2bot_tls | to_json }}
+{% if matrix_media_repo_container_labels_traefik_t2bot_tls %}
+traefik.http.routers.matrix-media-repo-t2bot.tls.certResolver={{ matrix_media_repo_container_labels_traefik_t2bot_tls_certResolver }}
+{% endif %}
+
+# Matrix Federation
+{% if matrix_nginx_proxy_proxy_matrix_federation_api_enabled %}
+
+traefik.http.routers.matrix-media-repo-media-federation.rule={{ matrix_media_repo_container_labels_traefik_media_federation_rule }}
+{% if matrix_media_repo_container_labels_traefik_media_federation_priority | int > 0 %}
+traefik.http.routers.matrix-media-repo-media-federation.priority={{ matrix_media_repo_container_labels_traefik_media_federation_priority }}
+{% endif %}
+{% if middlewares | length > 0 %}
+traefik.http.routers.matrix-media-repo-media-federation.middlewares={{ middlewares | join(',') }}
+{% endif %}
+traefik.http.routers.matrix-media-repo-media-federation.service=matrix-media-repo
+traefik.http.routers.matrix-media-repo-media-federation.entrypoints={{ matrix_media_repo_container_labels_traefik_media_federation_entrypoints }}
+traefik.http.routers.matrix-media-repo-media-federation.tls={{ matrix_media_repo_container_labels_traefik_media_federation_tls | to_json }}
+{% if matrix_media_repo_container_labels_traefik_media_federation_tls %}
+traefik.http.routers.matrix-media-repo-media-federation.tls.certResolver={{ matrix_media_repo_container_labels_traefik_media_federation_tls_certResolver }}
+{% endif %}
+
+{% if matrix_media_repo_access_tokens_max_cache_time_seconds > 0 %}
+
+traefik.http.routers.matrix-media-repo-logout-federation.rule={{ matrix_media_repo_container_labels_traefik_logout_federation_rule }}
+{% if matrix_media_repo_container_labels_traefik_logout_federation_priority | int > 0 %}
+traefik.http.routers.matrix-media-repo-logout-federation.priority={{ matrix_media_repo_container_labels_traefik_logout_federation_priority }}
+{% endif %}
+{% if middlewares | length > 0 %}
+traefik.http.routers.matrix-media-repo-logout-federation.middlewares={{ middlewares | join(',') }}
+{% endif %}
+traefik.http.routers.matrix-media-repo-logout-federation.service=matrix-media-repo
+traefik.http.routers.matrix-media-repo-logout-federation.entrypoints={{ matrix_media_repo_container_labels_traefik_logout_federation_entrypoints }}
+traefik.http.routers.matrix-media-repo-logout-federation.tls={{ matrix_media_repo_container_labels_traefik_logout_federation_tls | to_json }}
+{% if matrix_media_repo_container_labels_traefik_logout_federation_tls %}
+traefik.http.routers.matrix-media-repo-logout-federation.tls.certResolver={{ matrix_media_repo_container_labels_traefik_logout_federation_tls_certResolver }}
+{% endif %}
+
+{% endif %}
+
+traefik.http.routers.matrix-media-repo-admin.rule={{ matrix_media_repo_container_labels_traefik_admin_federation_rule }}
+{% if matrix_media_repo_container_labels_traefik_admin_federation_priority | int > 0 %}
+traefik.http.routers.matrix-media-repo-admin.priority={{ matrix_media_repo_container_labels_traefik_admin_federation_priority }}
+{% endif %}
+{% if middlewares | length > 0 %}
+traefik.http.routers.matrix-media-repo-admin.middlewares={{ middlewares | join(',') }}
+{% endif %}
+traefik.http.routers.matrix-media-repo-admin.service=matrix-media-repo
+traefik.http.routers.matrix-media-repo-admin.entrypoints={{ matrix_media_repo_container_labels_traefik_admin_federation_entrypoints }}
+traefik.http.routers.matrix-media-repo-admin.tls={{ matrix_media_repo_container_labels_traefik_admin_federation_tls | to_json }}
+{% if matrix_media_repo_container_labels_traefik_admin_federation_tls %}
+traefik.http.routers.matrix-media-repo-admin.tls.certResolver={{ matrix_media_repo_container_labels_traefik_admin_federation_tls_certResolver }}
+{% endif %}
+
+traefik.http.routers.matrix-media-repo-t2bot-federation.rule={{ matrix_media_repo_container_labels_traefik_t2bot_federation_rule }}
+{% if matrix_media_repo_container_labels_traefik_t2bot_federation_priority | int > 0 %}
+traefik.http.routers.matrix-media-repo-t2bot-federation.priority={{ matrix_media_repo_container_labels_traefik_t2bot_federation_priority }}
+{% endif %}
+{% if middlewares | length > 0 %}
+traefik.http.routers.matrix-media-repo-t2bot-federation.middlewares={{ middlewares | join(',') }}
+{% endif %}
+traefik.http.routers.matrix-media-repo-t2bot-federation.service=matrix-media-repo
+traefik.http.routers.matrix-media-repo-t2bot-federation.entrypoints={{ matrix_media_repo_container_labels_traefik_t2bot_federation_entrypoints }}
+traefik.http.routers.matrix-media-repo-t2bot-federation.tls={{ matrix_media_repo_container_labels_traefik_t2bot_federation_tls | to_json }}
+{% if matrix_media_repo_container_labels_traefik_t2bot_federation_tls %}
+traefik.http.routers.matrix-media-repo-t2bot-federation.tls.certResolver={{ matrix_media_repo_container_labels_traefik_t2bot_federation_tls_certResolver }}
+{% endif %}
+
+{% endif %}
+
+traefik.http.services.matrix-media-repo.loadbalancer.server.port={{ matrix_media_repo_port }}
+
+{% endif %}
+
+{{ matrix_media_repo_container_labels_additional_labels }}

roles/custom/matrix-media-repo/templates/media-repo/systemd/matrix-media-repo.service.j2

@@ -22,8 +22,9 @@ ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} create \
 			--log-driver=none \
 			--user={{ matrix_user_uid }}:{{ matrix_user_gid }} \
 			--cap-drop=ALL \
-			--network={{ matrix_docker_network }} \
+			--network={{ matrix_media_repo_container_network }} \
 			--env-file={{ matrix_media_repo_base_path }}/env \
+			--label-file={{ matrix_media_repo_base_path }}/labels \
 			{% if matrix_media_repo_container_http_host_bind_port %}
 			-p {{ matrix_media_repo_container_http_host_bind_port }}:{{ matrix_media_repo_port }} \
 			{% endif %}