deploy playbook after setup
ansible-playbook playbook.yml --ask-vault-pass
Check containers
ssh matrix.example.com
sudo podman ps
sudo podman logs synapse
test federation
curl https://{{ matrix_domain }}/_matrix/federation/v1/version
to generate config files default before deploymenta and templating
podman run -it --rm \
-v "$(pwd)":/data \
-e SYNAPSE_SERVER_NAME=my.matrix.host \
-e SYNAPSE_REPORT_STATS=yes \
docker.io/matrixdotorg/synapse:latest generate
| Area | Recommendation |
|---|---|
| TLS | Use Certbot + Nginx plugin (community.general.acme Ansible module) |
| Secrets | Store DB passwords, secrets in Ansible Vault |
| Updates | Use container_image: tag with version pins (e.g., v1.100.0) |
| Monitoring | Add Prometheus metrics (enable_metrics: true) |
| Coturn | Deploy coturn (STUN/TURN) as separate container if needed |
| Backups | Backup /var/lib/matrix-synapse regularly |
| Rootless Podman | Use podman user namespaces + podman system migrate for portability |
Using Hugo to create site
# Create & build site locally (run ON CONTROL NODE)
hugo new site mysite
cd mysite
echo 'theme = "ananke"' >> config.toml
hugo new posts/my-first-post.md
hugo # builds to /public
cp -r public ../fpov/roles/nginx-proxy/files/mysite/
- Host boots: Podman creates pod with ports 80, 443, 8008, 8448 open.
- Nginx starts, runs certbot-entrypoint.sh:
- Checks for /etc/letsencrypt/live/matrix.example.com
- If missing → runs certbot certonly --standalone on port 8080
- Writes certs to /etc/letsencrypt
- Nginx loads TLS certs, serves static site + proxies /_matrix/
- User visits https://matrix.example.com → gets your Hugo site.
- User visits https://matrix.example.com/_matrix/client → gets Synapse.
- ACME renewal: Certbot’s renew is dry-run on each start (you can also add cron via systemd unit if needed).
Certificate renewal
# /etc/cron.d/certbot-renew
0 3 * * * root podman exec nginx-matrix certbot renew --quiet