diff --git a/group_vars/matrix-servers b/group_vars/matrix-servers old mode 100644 new mode 100755 index e3337bf2b..9f06d8fef --- a/group_vars/matrix-servers +++ b/group_vars/matrix-servers @@ -99,6 +99,27 @@ matrix_coturn_enabled: true +###################################################################### +# +# matrix-dimension +# +###################################################################### + +matrix_dimension_enabled: false + +# Normally, matrix-nginx-proxy is enabled and nginx can reach Dimension over the container network. +# If matrix-nginx-proxy is not enabled, or you otherwise have a need for it, you can expose +# the Dimension HTTP port to the local host (`127.0.0.1:8184`). +matrix_dimension_container_expose_port: "{{ not matrix_nginx_proxy_enabled }}" + +###################################################################### +# +# /matrix-dimension +# +###################################################################### + + + ###################################################################### # # matrix-mailer @@ -184,6 +205,7 @@ matrix_nginx_proxy_proxy_matrix_client_api_client_max_body_size_mb: "{{ matrix_s matrix_nginx_proxy_proxy_matrix_enabled: true matrix_nginx_proxy_proxy_riot_enabled: "{{ matrix_riot_web_enabled }}" +matrix_nginx_proxy_proxy_dimension_enabled: "{{ matrix_dimension_enabled }}" matrix_nginx_proxy_proxy_matrix_corporal_api_enabled: "{{ matrix_corporal_enabled and matrix_corporal_http_api_enabled }}" matrix_nginx_proxy_proxy_matrix_corporal_api_addr_with_container: "matrix-corporal:41081" @@ -222,6 +244,8 @@ matrix_ssl_domains_to_obtain_certificates_for: | ([matrix_server_fqn_matrix]) + ([matrix_server_fqn_riot] if matrix_riot_web_enabled else []) + + + ([matrix_server_fqn_dimension] if matrix_dimension_enabled else []) }} ###################################################################### @@ -271,6 +295,12 @@ matrix_riot_web_container_expose_port: "{{ not matrix_nginx_proxy_enabled }}" matrix_riot_web_default_hs_url: "{{ matrix_homeserver_url }}" matrix_riot_web_default_is_url: "{{ matrix_identity_server_url }}" +# Use Dimension if enabled, otherwise fall back to Scalar +matrix_riot_web_integrations_ui_url: "{{ matrix_dimension_integrations_ui_url if matrix_dimension_enabled else 'https://scalar.vector.im/' }}" +matrix_riot_web_integrations_rest_url: "{{ matrix_dimension_integrations_rest_url if matrix_dimension_enabled else 'https://scalar.vector.im/api' }}" +matrix_riot_web_integrations_widgets_urls: "{{ matrix_dimension_integrations_widgets_urls if matrix_dimension_enabled else ['https://scalar.vector.im/api'] }}" +matrix_riot_web_integrations_jitsi_widget_url: "{{ matrix_dimension_integrations_jitsi_widget_url if matrix_dimension_enabled else 'https://scalar.vector.im/api/widgets/jitsi.html' }}" + ###################################################################### # # /matrix-riot-web diff --git a/roles/matrix-base/defaults/main.yml b/roles/matrix-base/defaults/main.yml old mode 100644 new mode 100755 index 251221734..863694082 --- a/roles/matrix-base/defaults/main.yml +++ b/roles/matrix-base/defaults/main.yml @@ -15,6 +15,9 @@ matrix_server_fqn_matrix: "matrix.{{ matrix_domain }}" # This and the Matrix FQN (see above) are expected to be on the same server. matrix_server_fqn_riot: "riot.{{ matrix_domain }}" +# This is where you access the Dimension. +matrix_server_fqn_dimension: "dimension.{{ matrix_domain }}" + matrix_user_username: "matrix" matrix_user_uid: 991 matrix_user_gid: 991 diff --git a/roles/matrix-dimension/defaults/main.yml b/roles/matrix-dimension/defaults/main.yml new file mode 100755 index 000000000..20c2f4e85 --- /dev/null +++ b/roles/matrix-dimension/defaults/main.yml @@ -0,0 +1,126 @@ +matrix_dimension_enabled: false + +# You are required to specify an access token for Dimension to work. +# For information on how to acquire an access token, visit https://t2bot.io/docs/access_tokens +matrix_dimension_access_token: "" + +# Users in form: ['@user1:domain.com', '@user2:domain.com'] +matrix_dimension_admins: [] + +matrix_dimension_base_path: "{{ matrix_base_data_path }}/dimension" + +matrix_dimension_docker_image: "turt2live/matrix-dimension:latest" + +# The user and group id correspond to the node user in the `turt2live/matrix-dimension` image. +matrix_dimension_user_uid: 1000 +matrix_dimension_user_gid: 1000 + +matrix_dimension_container_expose_port: false + +matrix_dimension_integrations_ui_url: "https://{{ matrix_server_fqn_dimension }}/riot" +matrix_dimension_integrations_rest_url: "https://{{ matrix_server_fqn_dimension }}/api/v1/scalar" +matrix_dimension_integrations_widgets_urls: ["https://{{ matrix_server_fqn_dimension }}/widgets"] +matrix_dimension_integrations_jitsi_widget_url: "https://{{ matrix_server_fqn_dimension }}/widgets/jitsi" + +# Default Dimension configuration template which covers the generic use case. +# You can customize it by controlling the various variables inside it. +# +# For a more advanced customization, you can extend the default (see `matrix_dimension_configuration_extension_yaml`) +# or completely replace this variable with your own template. +matrix_dimension_configuration_yaml: | + # The web settings for the service (API and UI). + # It is best to have this run on localhost and use a reverse proxy to access Dimension. + web: + port: 8184 + address: '0.0.0.0' + + # Homeserver configuration + homeserver: + # The domain name of the homeserver. This is used in many places, such as with go-neb + # setups, to identify the homeserver. + name: "{{ matrix_server_fqn_matrix }}" + + # The URL that Dimension, go-neb, and other services provisioned by Dimension should + # use to access the homeserver with. + clientServerUrl: "https://{{ matrix_server_fqn_matrix }}" + + # The URL that Dimension should use when trying to communicate with federated APIs on + # the homeserver. If not supplied or left empty Dimension will try to resolve the address + # through the normal federation process. + federationUrl: "http://matrix-synapse:8048" + + # The URL that Dimension will redirect media requests to for downloading media such as + # stickers. If not supplied or left empty Dimension will use the clientServerUrl. + #mediaUrl: "https://t2bot.io" + + # The access token Dimension should use for miscellaneous access to the homeserver. This + # should be for a user on the configured homeserver: any user will do, however it is + # recommended to use a dedicated user (such as @dimension:t2bot.io). For information on + # how to acquire an access token, visit https://t2bot.io/docs/access_tokens + accessToken: "{{ matrix_dimension_access_token }}" + + # These users can modify the integrations this Dimension supports. + # To access the admin interface, open Dimension in Riot and click the settings icon. + admins: {{ matrix_dimension_admins }} + + # IPs and CIDR ranges listed here will be blocked from being widgets. + # Note: Widgets may still be embedded with restricted content, although not through Dimension directly. + widgetBlacklist: + - 10.0.0.0/8 + - 172.16.0.0/12 + - 192.168.0.0/16 + - 127.0.0.0/8 + + # Where the database for Dimension is + database: + file: "dimension.db" + + # Display settings that apply to self-hosted go-neb instances + goneb: + # The avatars to set for each bot. Usually these don't need to be changed, however if your homeserver + # is not able to reach t2bot.io then you should specify your own here. To not use an avatar for a bot, + # make the bot's avatar an empty string. + avatars: + giphy: "mxc://t2bot.io/c5eaab3ef0133c1a61d3c849026deb27" + imgur: "mxc://t2bot.io/6749eaf2b302bb2188ae931b2eeb1513" + github: "mxc://t2bot.io/905b64b3cd8e2347f91a60c5eb0832e1" + wikipedia: "mxc://t2bot.io/7edfb54e9ad9e13fec0df22636feedf1" + travisci: "mxc://t2bot.io/7f4703126906fab8bb27df34a17707a8" + rss: "mxc://t2bot.io/aace4fcbd045f30afc1b4e5f0928f2f3" + google: "mxc://t2bot.io/636ad10742b66c4729bf89881a505142" + guggy: "mxc://t2bot.io/e7ef0ed0ba651aaf907655704f9a7526" + echo: "mxc://t2bot.io/3407ff2db96b4e954fcbf2c6c0415a13" + circleci: "mxc://t2bot.io/cf7d875845a82a6b21f5f66de78f6bee" + jira: "mxc://t2bot.io/f4a38ebcc4280ba5b950163ca3e7c329" + + # Settings for controlling how logging works + logging: + file: /dev/null + console: true + consoleLevel: verbose + fileLevel: info + rotate: + size: 52428800 # bytes, default is 50mb + count: 5 + + +matrix_dimension_configuration_extension_yaml: | + # Your custom YAML configuration for Dimension goes here. + # This configuration extends the default starting configuration (`matrix_dimension_configuration_yaml`). + # + # You can override individual variables from the default configuration, or introduce new ones. + # + # If you need something more special, you can take full control by + # completely redefining `matrix_dimension_configuration_yaml`. + # + # Example configuration extension follows: + # telegram: + # botToken: "YourTokenHere" + # + + +# Holds the final Dimension configuration (a combination of the default and its extension). +# You most likely don't need to touch this variable. Instead, see `matrix_dimension_configuration_yaml`. +matrix_dimension_configuration: "{{ matrix_dimension_configuration_yaml|from_yaml|combine(matrix_dimension_configuration_extension, recursive=True) }}" + + diff --git a/roles/matrix-dimension/tasks/init.yml b/roles/matrix-dimension/tasks/init.yml new file mode 100755 index 000000000..3e98de9db --- /dev/null +++ b/roles/matrix-dimension/tasks/init.yml @@ -0,0 +1,3 @@ +- set_fact: + matrix_systemd_services_list: "{{ matrix_systemd_services_list + ['matrix-dimension'] }}" + when: "matrix_dimension_enabled" \ No newline at end of file diff --git a/roles/matrix-dimension/tasks/main.yml b/roles/matrix-dimension/tasks/main.yml new file mode 100755 index 000000000..dd3bfc516 --- /dev/null +++ b/roles/matrix-dimension/tasks/main.yml @@ -0,0 +1,15 @@ +- import_tasks: "{{ role_path }}/tasks/init.yml" + tags: + - always + +- import_tasks: "{{ role_path }}/tasks/validate_config.yml" + when: run_setup + tags: + - setup-all + - setup-dimension + +- import_tasks: "{{ role_path }}/tasks/setup_dimension.yml" + when: run_setup + tags: + - setup-all + - setup-dimension \ No newline at end of file diff --git a/roles/matrix-dimension/tasks/setup_dimension.yml b/roles/matrix-dimension/tasks/setup_dimension.yml new file mode 100755 index 000000000..e8dea9eae --- /dev/null +++ b/roles/matrix-dimension/tasks/setup_dimension.yml @@ -0,0 +1,82 @@ +--- + +# +# Tasks related to setting up the dimension +# + +- name: Ensure Dimension base path exists + file: + path: "{{ matrix_dimension_base_path }}" + state: directory + mode: 0770 + owner: "{{ matrix_user_username }}" + group: "{{ matrix_dimension_user_gid }}" + when: matrix_dimension_enabled + +- name: Ensure Dimension config installed + copy: + content: "{{ matrix_dimension_configuration|to_nice_yaml }}" + dest: "{{ matrix_dimension_base_path }}/config.yaml" + mode: 0640 + owner: "{{ matrix_user_username }}" + group: "{{ matrix_dimension_user_gid }}" + when: matrix_dimension_enabled + +- name: Ensure Dimension image is pulled + docker_image: + name: "{{ matrix_dimension_docker_image }}" + when: matrix_dimension_enabled + +- name: Ensure matrix-dimension.service installed + template: + src: "{{ role_path }}/templates/systemd/matrix-dimension.service.j2" + dest: "/etc/systemd/system/matrix-dimension.service" + mode: 0644 + register: matrix_dimension_systemd_service_result + when: matrix_dimension_enabled + +- name: Ensure systemd reloaded after matrix-dimension.service installation + service: + daemon_reload: yes + when: "matrix_dimension_enabled and matrix_dimension_systemd_service_result.changed" + +# +# Tasks related to getting rid of the dimension (if it was previously enabled) +# + +- name: Check existence of matrix-dimension service + stat: + path: "/etc/systemd/system/matrix-dimension.service" + register: matrix_dimension_service_stat + when: not matrix_dimension_enabled + +- name: Ensure matrix-dimension is stopped + service: + name: matrix-dimension + state: stopped + daemon_reload: yes + register: stopping_result + when: "not matrix_dimension_enabled and matrix_dimension_service_stat.stat.exists" + +- name: Ensure matrix-dimension.service doesn't exist + file: + path: "/etc/systemd/system/matrix-dimension.service" + state: absent + when: "not matrix_dimension_enabled and matrix_dimension_service_stat.stat.exists" + +- name: Ensure systemd reloaded after matrix-dimension.service removal + service: + daemon_reload: yes + when: "not matrix_dimension_enabled and matrix_dimension_service_stat.stat.exists" + +- name: Ensure Dimension environment variables path doesn't exist + file: + path: "{{ matrix_dimension_base_path }}" + state: absent + when: "not matrix_dimension_enabled" + +- name: Ensure Dimension Docker image doesn't exist + docker_image: + name: "{{ matrix_dimension_docker_image }}" + state: absent + when: "not matrix_dimension_enabled" diff --git a/roles/matrix-dimension/tasks/validate_config.yml b/roles/matrix-dimension/tasks/validate_config.yml new file mode 100644 index 000000000..69971a9b4 --- /dev/null +++ b/roles/matrix-dimension/tasks/validate_config.yml @@ -0,0 +1,15 @@ +- name: Fail if required Dimension settings not defined + fail: + msg: >- + You need to define a required configuration setting (`{{ item }}`) for using Dimension. + with_items: + - "matrix_dimension_access_token" + when: "matrix_dimension_enabled and vars[item] == ''" + +- name: Fail if Matrix Federation is disabled + fail: + msg: >- + You need to enable Matrix Federation to use Dimension. Set `{{ item }}` to 'true'. + with_items: + - "matrix_synapse_federation_enabled" + when: "matrix_dimension_enabled and matrix_synapse_federation_enabled == false" diff --git a/roles/matrix-dimension/templates/systemd/matrix-dimension.service.j2 b/roles/matrix-dimension/templates/systemd/matrix-dimension.service.j2 new file mode 100755 index 000000000..554713d84 --- /dev/null +++ b/roles/matrix-dimension/templates/systemd/matrix-dimension.service.j2 @@ -0,0 +1,26 @@ +[Unit] +Description=Matrix Dimension +After=docker.service +Requires=docker.service + +[Service] +Type=simple +ExecStartPre=-/usr/bin/docker kill matrix-dimension +ExecStartPre=-/usr/bin/docker rm matrix-dimension +ExecStart=/usr/bin/docker run --rm --name matrix-dimension \ + --log-driver=none \ + --user={{ matrix_dimension_user_uid }}:{{ matrix_dimension_user_gid }} \ + --cap-drop=ALL \ + --network={{ matrix_docker_network }} \ + {% if matrix_dimension_container_expose_port %} + -p 127.0.0.1:8184:8184 \ + {% endif %} + -v {{ matrix_dimension_base_path }}:/data:rw \ + {{ matrix_dimension_docker_image }} +ExecStop=-/usr/bin/docker kill matrix-dimension +ExecStop=-/usr/bin/docker rm matrix-dimension +Restart=always +RestartSec=30 + +[Install] +WantedBy=multi-user.target diff --git a/roles/matrix-dimension/vars/main.yml b/roles/matrix-dimension/vars/main.yml new file mode 100755 index 000000000..107bb4fa8 --- /dev/null +++ b/roles/matrix-dimension/vars/main.yml @@ -0,0 +1,5 @@ +--- + +# Doing `|from_yaml` when the extension contains nothing yields an empty string (""). +# We need to ensure it's a dictionary or `|combine` (when building `matrix_dimension_configuration`) will fail later. +matrix_dimension_configuration_extension: "{{ matrix_dimension_configuration_extension_yaml|from_yaml if matrix_dimension_configuration_extension_yaml|from_yaml else {} }}" \ No newline at end of file diff --git a/roles/matrix-nginx-proxy/defaults/main.yml b/roles/matrix-nginx-proxy/defaults/main.yml old mode 100644 new mode 100755 index 0910dbc8b..4ecd92cf7 --- a/roles/matrix-nginx-proxy/defaults/main.yml +++ b/roles/matrix-nginx-proxy/defaults/main.yml @@ -28,6 +28,10 @@ matrix_nginx_proxy_proxy_riot_hostname: "{{ matrix_server_fqn_riot }}" matrix_nginx_proxy_proxy_matrix_enabled: false matrix_nginx_proxy_proxy_matrix_hostname: "{{ matrix_server_fqn_matrix }}" +# Controls whether proxying the dimension domain should be done. +matrix_nginx_proxy_proxy_dimension_enabled: false +matrix_nginx_proxy_proxy_dimension_hostname: "{{ matrix_server_fqn_dimension }}" + # Controls whether proxying for the matrix-corporal API (`/_matrix/corporal`) should be done (on the matrix domain) matrix_nginx_proxy_proxy_matrix_corporal_api_enabled: false matrix_nginx_proxy_proxy_matrix_corporal_api_addr_with_container: "matrix-corporal:41081" diff --git a/roles/matrix-nginx-proxy/tasks/setup_nginx_proxy.yml b/roles/matrix-nginx-proxy/tasks/setup_nginx_proxy.yml old mode 100644 new mode 100755 index b6aacab2f..267d2133c --- a/roles/matrix-nginx-proxy/tasks/setup_nginx_proxy.yml +++ b/roles/matrix-nginx-proxy/tasks/setup_nginx_proxy.yml @@ -66,6 +66,13 @@ mode: 0644 when: "matrix_nginx_proxy_proxy_riot_enabled" +- name: Ensure Matrix nginx-proxy configuration for dimension domain exists + template: + src: "{{ role_path }}/templates/nginx/conf.d/matrix-dimension.conf.j2" + dest: "{{ matrix_nginx_proxy_confd_path }}/matrix-dimension.conf" + mode: 0644 + when: "matrix_nginx_proxy_proxy_dimension_enabled" + # # Tasks related to setting up matrix-nginx-proxy # @@ -139,6 +146,12 @@ state: absent when: "not matrix_nginx_proxy_proxy_riot_enabled" +- name: Ensure Matrix nginx-proxy configuration for dimension domain deleted + file: + path: "{{ matrix_nginx_proxy_confd_path }}/matrix-dimension.conf" + state: absent + when: "not matrix_nginx_proxy_proxy_dimension_enabled" + - name: Ensure Matrix nginx-proxy configuration for main config override deleted file: path: "{{ matrix_nginx_proxy_data_path }}/nginx.conf" diff --git a/roles/matrix-nginx-proxy/templates/nginx/conf.d/matrix-dimension.conf.j2 b/roles/matrix-nginx-proxy/templates/nginx/conf.d/matrix-dimension.conf.j2 new file mode 100755 index 000000000..1886496b8 --- /dev/null +++ b/roles/matrix-nginx-proxy/templates/nginx/conf.d/matrix-dimension.conf.j2 @@ -0,0 +1,56 @@ +server { + listen {{ 8080 if matrix_nginx_proxy_enabled else 80 }}; + server_name {{ matrix_nginx_proxy_proxy_dimension_hostname }}; + + server_tokens off; + + location /.well-known/acme-challenge { + {% if matrix_nginx_proxy_enabled %} + {# Use the embedded DNS resolver in Docker containers to discover the service #} + resolver 127.0.0.11 valid=5s; + set $backend "matrix-certbot:8080"; + proxy_pass http://$backend; + {% else %} + {# Generic configuration for use outside of our container setup #} + proxy_pass http://127.0.0.1:{{ matrix_ssl_lets_encrypt_certbot_standalone_http_port }}; + {% endif %} + } + + location / { + return 301 https://$http_host$request_uri; + } +} + +server { + listen {{ 8443 if matrix_nginx_proxy_enabled else 443 }} ssl http2; + listen [::]:{{ 8443 if matrix_nginx_proxy_enabled else 443 }} ssl http2; + + server_name {{ matrix_nginx_proxy_proxy_dimension_hostname }}; + + server_tokens off; + root /dev/null; + + gzip on; + gzip_types text/plain application/json application/javascript text/css image/x-icon font/ttf image/gif; + + ssl_certificate {{ matrix_ssl_config_dir_path }}/live/{{ matrix_nginx_proxy_proxy_dimension_hostname }}/fullchain.pem; + ssl_certificate_key {{ matrix_ssl_config_dir_path }}/live/{{ matrix_nginx_proxy_proxy_dimension_hostname }}/privkey.pem; + ssl_protocols {{ matrix_nginx_proxy_ssl_protocols }}; + ssl_prefer_server_ciphers on; + ssl_ciphers "EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH"; + + location / { + {% if matrix_nginx_proxy_enabled %} + {# Use the embedded DNS resolver in Docker containers to discover the service #} + resolver 127.0.0.11 valid=5s; + set $backend "matrix-dimension:8184"; + proxy_pass http://$backend; + {% else %} + {# Generic configuration for use outside of our container setup #} + proxy_pass http://127.0.0.1:8184; + {% endif %} + + proxy_set_header Host $host; + proxy_set_header X-Forwarded-For $remote_addr; + } +} diff --git a/setup.yml b/setup.yml old mode 100644 new mode 100755 index a15d60636..3db1e5ca9 --- a/setup.yml +++ b/setup.yml @@ -12,5 +12,6 @@ - matrix-synapse - matrix-riot-web - matrix-mxisd + - matrix-dimension - matrix-nginx-proxy - matrix-common-after