From b3f3ad0b7dfc521a9234a6787f9e6988994c8c7c Mon Sep 17 00:00:00 2001 From: boxswapper Date: Fri, 20 Mar 2026 17:13:20 -0600 Subject: [PATCH] again corrected signing key location and removed extra command for synapse server --- deploy_matrix.yml | 89 ++++++++++++++++++++++-------------- templates/homeserver.yaml.j2 | 28 ++++-------- templates/turnserver.conf.j2 | 4 +- vars/vars.yml | 10 ++-- 4 files changed, 73 insertions(+), 58 deletions(-) diff --git a/deploy_matrix.yml b/deploy_matrix.yml index 838023e..58099f3 100644 --- a/deploy_matrix.yml +++ b/deploy_matrix.yml @@ -68,6 +68,10 @@ name: "{{ npm_image }}" state: present + - name: Pull Postgres DB image + containers.podman.podman_image: + name: "{{ db_image }}" + state: present # ----------------------------------------------------------------- # Render all configuration files from the templates @@ -143,41 +147,58 @@ # Start containers (Traefik, TURN, Synapse, NGINX – unchanged) # ----------------------------------------------------------------- - # - name: Start coturn container - # containers.podman.podman_container: - # name: turn - # image: "{{ turn_image }}" - # state: started - # ports: - # - "{{ turn_listen_port }}:{{ turn_listen_port }}/udp" - # - "{{ turn_listen_port }}:{{ turn_listen_port }}/tcp" - # - "{{ turn_tls_port }}:{{ turn_tls_port }}/udp" - # - "{{ turn_tls_port }}:{{ turn_tls_port }}/tcp" - # volumes: - # - "{{ vol_turn }}:/var/lib/turn" - # - "{{ turn_conf_path }}:/etc/turnserver.conf:ro" - # command: "-c /etc/turnserver.conf" - # network: "{{ podman_network }}" - # restart_policy: always + - name: Start coturn container + containers.podman.podman_container: + name: turn + image: "{{ turn_image }}" + state: started + ports: + - "{{ turn_listen_port }}:{{ turn_listen_port }}/udp" + - "{{ turn_listen_port }}:{{ turn_listen_port }}/tcp" + - "{{ turn_tls_port }}:{{ turn_tls_port }}/udp" + - "{{ turn_tls_port }}:{{ turn_tls_port }}/tcp" + volumes: + - "{{ vol_turn }}:/var/lib/turn" + - "{{ turn_conf_path }}:/etc/turnserver.conf:ro" + command: "-c /etc/turnserver.conf" + network: "{{ podman_network }}" + restart_policy: always + + - name: Start Synapse container + containers.podman.podman_container: + name: synapse + image: "{{ synapse_image }}" + state: started + env: + SYNAPSE_POSTGRES_USER: "{{ postgres_user }}" + SYNAPSE_POSTGRES_PASSWORD: "{{ postgres_pw }}" + SYNAPSE_POSTGRES_DBNAME: "{{ postgres_db }}" + SYNAPSE_POSTGRES_HOST: synapse-db + SYNAPSE_POSTGRES_PORT: 5432 + ports: + - "{{ synapse_http_port }}:{{ synapse_http_port }}" + volumes: + - "{{ vol_synapse }}:/data" + - "{{ vol_media }}:/data/media_store" + - "{{ synapse_cfg_path }}:/data/homeserver.yaml:Z" + - "{{ synapse_secret_key_path }}:/data/matrix.fpov.space.signing.key:Z" + - "{{ synapse_log_config }}:/data/matrix.fpov.space.log.config:Z" + network: "{{ podman_network }}" + restart_policy: always + - name: start Database container + containers.podman.podman_container: + name: synapse-db + image: "{{ db_image }}" + state: started + env: + POSTGRES_USER: "{{ postgres_user }}" + POSTGRES_PASSWORD: "{{ postgres_pw }}" + POSTGRES_DB: "{{ postgres_db }}" + volumes: + - "{{ vol_db }}:/var/lib/postgresql/data" + network: "{{ podman_network }}" + restart_policy: always - # - name: Start Synapse container - # containers.podman.podman_container: - # name: synapse - # image: "{{ synapse_image }}" - # state: started - # env: - # SYNAPSE_SERVER_NAME: "{{ matrix_domain }}" - # SYNAPSE_REPORT_STATS: "yes" - # ports: - # - "{{ synapse_http_port }}:{{ synapse_http_port }}" - # volumes: - # - "{{ vol_synapse }}:/data" - # - "{{ vol_media }}:/data/media_store" - # - "{{ synapse_cfg_path }}:/data/homeserver.yaml:Z" - # - "{{ synapse_secret_key_path }}:/data/my.matrix.host.signing.key:Z" - # - "{{ synapse_log_config }}:/data/matrix.fpov.space.log.config:Z" - # network: "{{ podman_network }}" - # restart_policy: always # - name: Start NGINX landing-page container # containers.podman.podman_container: diff --git a/templates/homeserver.yaml.j2 b/templates/homeserver.yaml.j2 index 144a367..1fd0edc 100644 --- a/templates/homeserver.yaml.j2 +++ b/templates/homeserver.yaml.j2 @@ -2,7 +2,6 @@ server_name: "{{ matrix_domain }}" pid_file: /data/homeserver.pid listeners: - port: {{ synapse_http_port }} - bind_addresses: ['0.0.0.0'] resources: - compress: true names: @@ -12,30 +11,21 @@ listeners: type: http x_forwarded: true -# ------------------------------------------------- -# TURN (WebRTC) – injected from the variables above -# ------------------------------------------------- -turn_uris: - - "turn:{{ matrix_domain }}:{{ turn_listen_port }}?transport=udp" - - "turn:{{ matrix_domain }}:{{ turn_tls_port }}?transport=tcp" - - "turns:{{ matrix_domain }}:{{ turn_tls_port }}?transport=tcp" -turn_shared_secret: "{{ turn_secret }}" -turn_user_lifetime: "86400000" # 1 day in ms (optional) +turn: + uris: + - "turn:{{ matrix_domain }}:{{ turn_listen_port }}?transport=udp" + - "turn:{{ matrix_domain }}:{{ turn_tls_port }}?transport=tcp" + - "turns:{{ matrix_domain }}:{{ turn_tls_port }}?transport=tcp" + turn_shared_secret: "{{ turn_secret }}" + turn_user_lifetime: "86400000" # 1 day in ms (optional) -# ----------------------------------------------------------------- -# Database provider -#------------------------------------------------------------------ -database: - name: sqlite3 - args: - database: /data/homeserver.db media_store_path: /data/media_store log_config: "/data/matrix.fpov.space.log.config" registration_shared_secret: "{{ registration_shared_secret }}" report_stats: false -macaroon_secret_key: "{{ macaroon_secret_key }} +macaroon_secret_key: "{{ macaroon_secret_key }}" form_secret: "{{ form_secret }}" -signing_key_path: "/data/my.matrix.host.signing.key" +signing_key_path: "/data/matrix.fpov.space.signing.key" trusted_key_servers: - server_name: "{{ matrix_domain }}" diff --git a/templates/turnserver.conf.j2 b/templates/turnserver.conf.j2 index e7415e7..351cd9c 100644 --- a/templates/turnserver.conf.j2 +++ b/templates/turnserver.conf.j2 @@ -13,4 +13,6 @@ listening-ip=0.0.0.0 listening-ip=::0 log-file=/var/log/turnserver.log -verbose \ No newline at end of file +verbose + +shared-secret="{{ turn_secret }}" \ No newline at end of file diff --git a/vars/vars.yml b/vars/vars.yml index dc384f2..a0b6542 100644 --- a/vars/vars.yml +++ b/vars/vars.yml @@ -4,7 +4,7 @@ public_ipv4: "15.204.117.53" matrix_domain: "matrix.fpov.space" landing_domain: "org.fpov.space" -teamspeak_domain: "ts.fpov.space" +teamspeak_domain: "ts.fpov.space" matrix_email: "boxswappers@gmail.com" # -------------------------------------------------------------- @@ -41,13 +41,14 @@ postgres_pw: 9mKeSFE7tH2eY # -------------------------------------------------------------- # Container images # -------------------------------------------------------------- -posgres_image: "docker.io/postgres:16-alpine" +db_image: "docker.io/postgres:16-alpine" traefik_image: "docker.io/traefik:v3.6.11" turn_image: "docker.io/coturn/coturn:4.9.0" synapse_image: "docker.io/matrixdotorg/synapse:latest" nginx_image: "docker.io/nginx:alpine" npm_image: "docker.io/jc21/nginx-proxy-manager:latest" + # -------------------------------------------------------------- # Podman names & volumes # -------------------------------------------------------------- @@ -59,7 +60,8 @@ vol_turn: turn_data vol_nginx: nginx_html vol_teamspeak: teamspeak_data npm_data: npm_data -npm_letsencrypt: letsencrypt +npm_letsencrypt: letsencrypt +vol_db: postgres_db # -------------------------------------------------------------- # Paths on the target host (temporary files) @@ -69,7 +71,7 @@ dynamic_traefik_path: "/tmp/traefik_dynamic.yml" turn_conf_path: "/tmp/turnserver.conf" synapse_cfg_path: "/tmp/homeserver.yaml" nginx_html_path: "/tmp/index.html" -synapse_secret_key_path: "/tmp/matrix.fpov.space.log.config" +synapse_secret_key_path: "/tmp/matrix.fpov.space.signing.key" synapse_log_config: "/tmp/matrix.fpov.space.log.config" # -----------------------------------------------------------------