corrected spelling of config for synapse

README.md

@@ -1,6 +1,20 @@
+## Test deployment ##
 ```
 ansible-playbook secure.yml -i inventory/hosts.yml --check --diff
 ```
+```
+ansible-playbook deploy_matrix.yml -i inventory/hosts.yml --check --diff
+```
+
+## Deploy ##
+
+```
+ansible-playbook secure.yml -i inventory/hosts.yml --check --diff
+```
+```
+ansible-playbook deploy_matrix.yml -i inventory/hosts.yml --check --diff
+```
+
 
 ```
 ansible-galaxy collection install containers.podman

deploy_matrix.yml

@@ -22,7 +22,7 @@
       containers.podman.podman_network:
         name: "{{ podman_network }}"
         driver: bridge
-        subnet: "10.88.0.0/16"
+        subnet: "10.36.0.0/16"
         state: present
 
     - name: Ensure required podman volumes exist
@@ -72,38 +72,50 @@
     # -----------------------------------------------------------------
     - name: Render static Traefik config
       ansible.builtin.template:
-        src: ../templates/traefik_static.toml.j2
+        src: traefik_static.toml.j2
         dest: "{{ static_traefik_path }}"
         mode: "0644"
 
     - name: Render dynamic Traefik config
       ansible.builtin.template:
-        src: ../templates/traefik_dynamic.yml.j2
+        src: traefik_dynamic.yml.j2
         dest: "{{ dynamic_traefik_path }}"
         mode: "0644"
 
     - name: Render coturn config
       ansible.builtin.template:
-        src: ../templates/turnserver.conf.j2
+        src: turnserver.conf.j2
         dest: "{{ turn_conf_path }}"
         mode: "0644"
 
     - name: Render Synapse homeserver.yaml
       ansible.builtin.template:
-        src: ../templates/homeserver.yaml.j2
+        src: homeserver.yaml.j2
         dest: "{{ synapse_cfg_path }}"
         mode: "0644"
 
     - name: Render landing page index.html
       ansible.builtin.template:
-        src: ../templates/landing.html.j2    # path relative to this playbook file
+        src: landing.html.j2    # path relative to this playbook file
         dest: "{{ nginx_html_path }}"        # we already defined this variable in vars.yml
         mode: "0644"
 
+    - name: Render Synapse Secret key
+      ansible.builtin.template:
+        src: matrix.fpov.space.signing.key
+        dest: "{{ synapse_secret_key_path }}"
+        mode: "0600"
+
+    - name: Render Synapse log config file
+      ansible.builtin.template:
+        src: matrix.fpov.space.log.config.j2
+        dest: "{{ synapse_log_config }}"
+
+
     # -----------------------------------------------------------------
     # Start the NGINX container (unchanged – just mounts the file we created)
     # -----------------------------------------------------------------
-    - name: Start NGINX landing‑page container
+    - name: Start NGINX landing-page container
       containers.podman.podman_container:
         name: landing
         image: "{{ nginx_image }}"
@@ -128,7 +140,7 @@
         ports:
           - "{{ traefik_http_port }}:{{ traefik_http_port }}"
           - "{{ traefik_https_port }}:{{ traefik_https_port }}"
-          - "{{ teamspeak_tcp_port }}:{{ teamspeak_tcp_port }}"   # expose TCP entrypoint on host
+#          - "{{ teamspeak_tcp_port }}:{{ teamspeak_tcp_port }}"   # expose TCP entrypoint on host
         volumes:
           - "{{ vol_traefik }}:/etc/traefik"
           - "{{ static_traefik_path }}:{{ static_traefik_path }}:ro"
@@ -166,11 +178,13 @@
         volumes:
           - "{{ vol_synapse }}:/data"
           - "{{ vol_media }}:/data/media_store"
-          - "{{ synapse_cfg_path }}:/data/homeserver.yaml:ro"
+          - "{{ synapse_cfg_path }}:/data/homeserver.yaml:ro:Z"
+          - "{{ synapse_secret_key_path }}:/data/my.matrix.host.signing.key:ro:Z"
+          - "{{ synapse_log_config }}:/data/matrix.fpov.space.log.config:ro:Z"
         network: "{{ podman_network }}"
         restart_policy: always
 
-    - name: Start NGINX landing‑page container
+    - name: Start NGINX landing-page container
       containers.podman.podman_container:
         name: landing
         image: "{{ nginx_image }}"
@@ -203,57 +217,41 @@
         network: "{{ podman_network }}"
         restart_policy: always
 
-    # -----------------------------------------------------------------
+    # # -----------------------------------------------------------------
-    # generate systemd units for containers 
+    # # generate systemd units for containers 
-    # -----------------------------------------------------------------
+    # # -----------------------------------------------------------------
-    - name: Generate systemd unit for Teamspeak
+    # - name: Generate systemd unit for Teamspeak
-      containers.podman.podman_generate_systemd:
+    #   containers.podman.podman_generate_systemd:
-        name: "{{ teamspeak_container_name }}"
+    #     name: "{{ teamspeak_container_name }}"
-        state: present
+    #     state: present
-        dest: "/etc/systemd/system/{{ teamspeak_container_name }}.service"
+    #     dest: "/etc/systemd/system/{{ teamspeak_container_name }}.service"
-      when: generate_systemd | bool
 
-    - name: Generate systemd unit for Traefik
+    # - name: Generate systemd unit for Traefik
-      containers.podman.podman_generate_systemd:
+    #   containers.podman.podman_generate_systemd:
-        name: traefik
+    #     name: traefik
-        state: present
+    #     state: present
-        dest: "/etc/systemd/system/traefik.service"
+    #     dest: "/etc/systemd/system/traefik.service"
-      when: generate_systemd | bool
 
-    - name: Generate systemd unit for TURN
+    # - name: Generate systemd unit for TURN
-      containers.podman.podman_generate_systemd:
+    #   containers.podman.podman_generate_systemd:
-        name: turn
+    #     name: turn
-        state: present
+    #     state: present
-        dest: "/etc/systemd/system/turn.service"
+    #     dest: "/etc/systemd/system/turn.service"
-      when: generate_systemd | bool
 
-    - name: Generate systemd unit for Synapse
+    # - name: Generate systemd unit for Synapse
-      containers.podman.podman_generate_systemd:
+    #   containers.podman.podman_generate_systemd:
-        name: synapse
+    #     name: synapse
-        state: present
+    #     state: present
-        dest: "/etc/systemd/system/synapse.service"
+    #     dest: "/etc/systemd/system/synapse.service"
-      when: generate_systemd | bool
 
-    - name: Generate systemd unit for landing page
+    # - name: Generate systemd unit for landing page
-      containers.podman.podman_generate_systemd:
+    #   containers.podman.podman_generate_systemd:
-        name: landing
+    #     name: landing
-        state: present
+    #     state: present
-        dest: "/etc/systemd/system/landing.service"
+    #     dest: "/etc/systemd/system/landing.service"
-      when: generate_systemd | bool
 
-    - name: Reload systemd daemon (if units were created)
+    # - name: Reload systemd daemon (if units were created)
-      ansible.builtin.systemd:
+    #   ansible.builtin.systemd:
-        daemon_reload: yes
+    #     daemon_reload: yes
-      when: generate_systemd | bool
 
-    # -----------------------------------------------------------------
-    # Debug – list containers
-    # -----------------------------------------------------------------
-    - name: List running podman containers
-      containers.podman.podman_ps:
-        all: true
-      register: ps_out
 
-    - name: Show container list
-      ansible.builtin.debug:
-        var: ps_out.containers

templates/homeserver.yaml.j2

@@ -1,16 +1,16 @@
 server_name: "{{ matrix_domain }}"
-trusted_key_servers:
+pid_file: /data/homeserver.pid
-  - server_name: "{{ matrix_domain }}"
-
 listeners:
   - port: {{ synapse_http_port }}
     bind_addresses: ['0.0.0.0']
-    type: http
-    tls: false
-    x_forwarded: true
     resources:
-      - names: [client, federation]
+    - compress: true
-        compress: true
+      names:
+      - client
+      - federation
+    tls: false
+    type: http
+    x_forwarded: true
 
 # -------------------------------------------------
 # TURN (WebRTC) – injected from the variables above
@@ -39,12 +39,12 @@ database:
   name: sqlite3
   args:
     database: /data/homeserver.db
-log_config: "/data/my.matrix.host.log.config"
 media_store_path: /data/media_store
+log_config: "/data/matrix.fpov.space.log.config"
 registration_shared_secret: "{{ registration_shared_secret }}"
-report_stats: true
+report_stats: false
 macaroon_secret_key: "{{ macaroon_secret_key }}
 form_secret: "{{ form_secret }}"
 signing_key_path: "/data/my.matrix.host.signing.key"
 trusted_key_servers:
-  - server_name: "matrix.org"
+  - server_name: "{{ matrix_domain }}"

templates/matrix.fpov.space.log.config.j2

@@ -0,0 +1,36 @@
+version: 1
+
+formatters:
+  precise:
+    
+    format: '%(asctime)s - %(name)s - %(lineno)d - %(levelname)s - %(request)s - %(message)s'
+    
+
+handlers:
+
+
+  console:
+    class: logging.StreamHandler
+    formatter: precise
+
+loggers:
+    # This is just here so we can leave `loggers` in the config regardless of whether
+    # we configure other loggers below (avoid empty yaml dict error).
+    _placeholder:
+        level: "INFO"
+
+    
+    
+    synapse.storage.SQL:
+        # beware: increasing this to DEBUG will make synapse log sensitive
+        # information such as access tokens.
+        level: INFO
+    
+
+    
+
+root:
+    level: INFO
+
+
+    handlers: [console]

vars/vars.yml

@@ -1,10 +1,10 @@
 # --------------------------------------------------------------
 # General
 # --------------------------------------------------------------
-public_ipv4: 15.204.117.53
+public_ipv4: "15.204.117.53"
 matrix_domain: "matrix.fpov.space"
-landing_domain: "org.fpov.space
+landing_domain: "org.fpov.space"
-teamspeak_domain: "ts.fpov.space"          # <-- new
+teamspeak_domain: "ts.fpov.space"         
 matrix_email: "boxswappers@gmail.com"
 
 # --------------------------------------------------------------
@@ -22,9 +22,9 @@ turn_secret: "7A9F2C4E1B8D6035A2F7E9C1B4D68053"
 synapse_http_port: 8008
 
 # --- Matrix ------------------------------------------------------
-registration_shared_secret: "uC7Pv@:r=@Slvhx7Ex*An8QHXWnPRyI9+COZr_&;Kh*,~lGpql"
+registration_shared_secret: "1KFs@=d&l6BGPD0GAwa55ePu+bF7Vgtk@~x#l3tQyKl#_q0etp"
-macaroon_secret_key: "+QUdDhvNc9*@MORp9K-TjuGp1j5Ff-mUBS+pjkmAFWR0Y3#da8"
+macaroon_secret_key: "5GongrU~_kQ9L1-f.nU21sdiz~e63+Wwq;iS7XdPA2giDqZ#xH"
-form_secret: "meZSlI7K.EI-6hmXcjzCNf2IwrThcnoVr2X0iohOV7K5a_w^Ud"
+form_secret: "Ubwo=AThaygGi0iySK*H4i9xUOORCQM#eDMd@E,DqW3DcfqYJG"
 
 # --- Teamspeak ---------------------------------------------------
 teamspeak_image: "docker.io/teamspeak:3.13.7"
@@ -33,9 +33,15 @@ teamspeak_udp_port: 9987          # voice (UDP) – exposed directly on the host
 teamspeak_tcp_port: 10011         # query (TCP) – will be routed via Traefik
 teamspeak_file_port: 30033        # file‑transfer (TCP) – optional, expose directly
 
+#----Postgres-----------------------------------------------------
+postgres_db: synapse
+postgres_user: mMwHLfdO6tz5N
+postgres_pw: 9mKeSFE7tH2eY
+
 # --------------------------------------------------------------
 # Container images
 # --------------------------------------------------------------
+posgres_image: "docker.io/postgres:16-alpine"
 traefik_image: "docker.io/traefik:v3.6.11"
 turn_image:    "docker.io/coturn/coturn:4.9.0"
 synapse_image: "docker.io/matrixdotorg/synapse:latest"
@@ -50,7 +56,7 @@ vol_synapse:   synapse_config
 vol_media:    synapse_media
 vol_turn:      turn_data
 vol_nginx:     nginx_html
-vol_teamspeak: teamspeak_data          # <-- new volume
+vol_teamspeak: teamspeak_data        
 
 # --------------------------------------------------------------
 # Paths on the target host (temporary files)
@@ -60,7 +66,8 @@ dynamic_traefik_path: "/tmp/traefik_dynamic.yml"
 turn_conf_path:       "/tmp/turnserver.conf"
 synapse_cfg_path:     "/tmp/homeserver.yaml"
 nginx_html_path:      "/tmp/index.html"
-
+synapse_secret_key_path: "/tmp/matrix.fpov.space.log.config"
+synapse_log_config: "/tmp/matrix.fpov.space.log.config"
 
 # -----------------------------------------------------------------
 # NEW – Google OAuth2 (OpenID Connect) credentials