diff --git a/README.md b/README.md deleted file mode 100644 index 6035c58..0000000 --- a/README.md +++ /dev/null @@ -1,64 +0,0 @@ -deploy playbook after setup -``` -ansible-playbook playbook.yml --ask-vault-pass -``` - -Check containers -``` -ssh matrix.example.com -sudo podman ps -sudo podman logs synapse -``` - -test federation -``` -curl https://{{ matrix_domain }}/_matrix/federation/v1/version -``` - -## to generate config files default before deploymenta and templating ## -``` -podman run -it --rm \ - -v "$(pwd)":/data \ - -e SYNAPSE_SERVER_NAME=my.matrix.host \ - -e SYNAPSE_REPORT_STATS=yes \ - docker.io/matrixdotorg/synapse:latest generate -``` - - -| Area | Recommendation | -|------|----------------| -| **TLS** | Use Certbot + Nginx plugin (`community.general.acme` Ansible module) | -| **Secrets** | Store DB passwords, secrets in **Ansible Vault** | -| **Updates** | Use `container_image: tag` with version pins (e.g., `v1.100.0`) | -| **Monitoring** | Add Prometheus metrics (`enable_metrics: true`) | -| **Coturn** | Deploy `coturn` (STUN/TURN) as separate container if needed | -| **Backups** | Backup `/var/lib/matrix-synapse` regularly | -| **Rootless Podman** | Use `podman user` namespaces + `podman system migrate` for portability | - - -## Using Hugo to create site ## -``` -# Create & build site locally (run ON CONTROL NODE) -hugo new site mysite -cd mysite -echo 'theme = "ananke"' >> config.toml -hugo new posts/my-first-post.md -hugo # builds to /public -cp -r public ../fpov/roles/nginx-proxy/files/mysite/ -``` - -1. Host boots: Podman creates pod with ports 80, 443, 8008, 8448 open. -2. Nginx starts, runs certbot-entrypoint.sh: -- Checks for /etc/letsencrypt/live/matrix.example.com -- If missing → runs certbot certonly --standalone on port 8080 -- Writes certs to /etc/letsencrypt -3. Nginx loads TLS certs, serves static site + proxies /_matrix/ -4. User visits https://matrix.example.com → gets your Hugo site. -5. User visits https://matrix.example.com/_matrix/client → gets Synapse. -6. ACME renewal: Certbot’s renew is dry-run on each start (you can also add cron via systemd unit if needed). - -Certificate renewal -``` -# /etc/cron.d/certbot-renew -0 3 * * * root podman exec nginx-matrix certbot renew --quiet -``` \ No newline at end of file diff --git a/deploy_matrix.yml b/deploy_matrix.yml new file mode 100644 index 0000000..fcb133f --- /dev/null +++ b/deploy_matrix.yml @@ -0,0 +1,261 @@ +--- +- name: Deploy Matrix + TURN + Traefik + NGINX + Teamspeak + hosts: all + become: true + collections: + - containers.podman + + vars_files: + - ../vars/vars.yml # ← our variable file + + tasks: + + # ----------------------------------------------------------------- + # (unchanged) Install podman, create network, create volumes … + # ----------------------------------------------------------------- + - name: Install podman package + ansible.builtin.package: + name: podman + state: present + + - name: Create podman network "{{ podman_network }}" + containers.podman.podman_network: + name: "{{ podman_network }}" + driver: bridge + subnet: "10.88.0.0/16" + state: present + + - name: Ensure required podman volumes exist + containers.podman.podman_volume: + name: "{{ item }}" + driver: local + state: present + loop: + - "{{ vol_traefik }}" + - "{{ vol_synapse }}" + - "{{ vol_media }}" + - "{{ vol_turn }}" + - "{{ vol_nginx }}" + - "{{ vol_teamspeak }}" # <-- new volume + + # ----------------------------------------------------------------- + # Render all configuration files from the templates + # ----------------------------------------------------------------- + - name: Render static Traefik config + ansible.builtin.template: + src: ../templates/traefik_static.toml.j2 + dest: "{{ static_traefik_path }}" + mode: "0644" + + - name: Render dynamic Traefik config + ansible.builtin.template: + src: ../templates/traefik_dynamic.yml.j2 + dest: "{{ dynamic_traefik_path }}" + mode: "0644" + + - name: Render coturn config + ansible.builtin.template: + src: ../templates/turnserver.conf.j2 + dest: "{{ turn_conf_path }}" + mode: "0644" + + - name: Render Synapse homeserver.yaml + ansible.builtin.template: + src: ../templates/homeserver.yaml.j2 + dest: "{{ synapse_cfg_path }}" + mode: "0644" + + - name: Render landing page index.html + ansible.builtin.template: + src: ../templates/landing.html.j2 # path relative to this playbook file + dest: "{{ nginx_html_path }}" # we already defined this variable in vars.yml + mode: "0644" + + # ----------------------------------------------------------------- + # Start the NGINX container (unchanged – just mounts the file we created) + # ----------------------------------------------------------------- + - name: Start NGINX landing‑page container + containers.podman.podman_container: + name: landing + image: "{{ nginx_image }}" + state: started + ports: + - "8080:80" + volumes: + - "{{ vol_nginx }}:/usr/share/nginx/html:ro" + - "{{ nginx_html_path }}:/usr/share/nginx/html/index.html:ro" + network: "{{ podman_network }}" + restart_policy: always + + + # ----------------------------------------------------------------- + # Pull required images (including Teamspeak) + # ----------------------------------------------------------------- + - name: Pull Traefik image + containers.podman.podman_image: + name: "{{ traefik_image }}" + state: present + + - name: Pull coturn image + containers.podman.podman_image: + name: "{{ turn_image }}" + state: present + + - name: Pull Synapse image + containers.podman.podman_image: + name: "{{ synapse_image }}" + state: present + + - name: Pull NGINX image + containers.podman.podman_image: + name: "{{ nginx_image }}" + state: present + + - name: Pull Teamspeak image + containers.podman.podman_image: + name: "{{ teamspeak_image }}" + state: present + + # ----------------------------------------------------------------- + # Start containers (Traefik, TURN, Synapse, NGINX – unchanged) + # ----------------------------------------------------------------- + - name: Start Traefik container + containers.podman.podman_container: + name: traefik + image: "{{ traefik_image }}" + state: started + ports: + - "{{ traefik_http_port }}:{{ traefik_http_port }}" + - "{{ traefik_https_port }}:{{ traefik_https_port }}" + - "{{ teamspeak_tcp_port }}:{{ teamspeak_tcp_port }}" # expose TCP entrypoint on host + volumes: + - "{{ vol_traefik }}:/etc/traefik" + - "{{ static_traefik_path }}:{{ static_traefik_path }}:ro" + - "{{ dynamic_traefik_path }}:{{ dynamic_traefik_path }}:ro" + network: "{{ podman_network }}" + restart_policy: always + + - name: Start coturn container + containers.podman.podman_container: + name: turn + image: "{{ turn_image }}" + state: started + ports: + - "{{ turn_listen_port }}:{{ turn_listen_port }}/udp" + - "{{ turn_listen_port }}:{{ turn_listen_port }}/tcp" + - "{{ turn_tls_port }}:{{ turn_tls_port }}/udp" + - "{{ turn_tls_port }}:{{ turn_tls_port }}/tcp" + volumes: + - "{{ vol_turn }}:/var/lib/turn" + - "{{ turn_conf_path }}:/etc/turnserver.conf:ro" + command: "-c /etc/turnserver.conf" + network: "{{ podman_network }}" + restart_policy: always + + - name: Start Synapse container + containers.podman.podman_container: + name: synapse + image: "{{ synapse_image }}" + state: started + env: + SYNAPSE_SERVER_NAME: "{{ matrix_domain }}" + SYNAPSE_REPORT_STATS: "yes" + ports: + - "{{ synapse_http_port }}:{{ synapse_http_port }}" + volumes: + - "{{ vol_synapse }}:/data" + - "{{ vol_media }}:/data/media_store" + - "{{ synapse_cfg_path }}:/data/homeserver.yaml:ro" + network: "{{ podman_network }}" + restart_policy: always + + - name: Start NGINX landing‑page container + containers.podman.podman_container: + name: landing + image: "{{ nginx_image }}" + state: started + ports: + - "8080:80" + volumes: + - "{{ vol_nginx }}:/usr/share/nginx/html:ro" + - "{{ nginx_html_path }}:/usr/share/nginx/html/index.html:ro" + network: "{{ podman_network }}" + restart_policy: always + + # ----------------------------------------------------------------- + # **NEW** – Start Teamspeak container + # ----------------------------------------------------------------- + - name: Start Teamspeak container + containers.podman.podman_container: + name: "{{ teamspeak_container_name }}" + image: "{{ teamspeak_image }}" + state: started + ports: + # UDP voice port – exposed directly on the host (no Traefik) + - "{{ teamspeak_udp_port }}:{{ teamspeak_udp_port }}/udp" + # TCP query port – Traefik will forward it (see static config) + - "{{ teamspeak_tcp_port }}:{{ teamspeak_tcp_port }}/tcp" + # Optional file‑transfer port (exposed directly) + - "{{ teamspeak_file_port }}:{{ teamspeak_file_port }}/tcp" + volumes: + - "{{ vol_teamspeak }}:/var/ts3server" + network: "{{ podman_network }}" + restart_policy: always + + # ----------------------------------------------------------------- + # (optional) generate systemd units for the new container + # ----------------------------------------------------------------- + - name: Generate systemd unit for Teamspeak + containers.podman.podman_generate_systemd: + name: "{{ teamspeak_container_name }}" + state: present + dest: "/etc/systemd/system/{{ teamspeak_container_name }}.service" + when: generate_systemd | bool + + # ----------------------------------------------------------------- + # (unchanged) systemd unit generation for the other containers + # ----------------------------------------------------------------- + - name: Generate systemd unit for Traefik + containers.podman.podman_generate_systemd: + name: traefik + state: present + dest: "/etc/systemd/system/traefik.service" + when: generate_systemd | bool + + - name: Generate systemd unit for TURN + containers.podman.podman_generate_systemd: + name: turn + state: present + dest: "/etc/systemd/system/turn.service" + when: generate_systemd | bool + + - name: Generate systemd unit for Synapse + containers.podman.podman_generate_systemd: + name: synapse + state: present + dest: "/etc/systemd/system/synapse.service" + when: generate_systemd | bool + + - name: Generate systemd unit for landing page + containers.podman.podman_generate_systemd: + name: landing + state: present + dest: "/etc/systemd/system/landing.service" + when: generate_systemd | bool + + - name: Reload systemd daemon (if units were created) + ansible.builtin.systemd: + daemon_reload: yes + when: generate_systemd | bool + + # ----------------------------------------------------------------- + # Debug – list containers + # ----------------------------------------------------------------- + - name: List running podman containers + containers.podman.podman_ps: + all: true + register: ps_out + + - name: Show container list + ansible.builtin.debug: + var: ps_out.containers \ No newline at end of file diff --git a/group_vars/all.yml b/group_vars/all.yml deleted file mode 100644 index b046ca4..0000000 --- a/group_vars/all.yml +++ /dev/null @@ -1,25 +0,0 @@ -# Variables -matrix_domain: "matrix.example.com" -landing_domain: "example.com" # or same as matrix_domain + path-based routing -podman_user: "matrix" # set to 'root' for rootful -podman_pod_name: "matrix-pod" - -synapse_data_dir: "/var/lib/matrix-synapse" -nginx_config_dir: "/etc/nginx/conf.d" -nginx_webroot: "/var/www/landing" - -# Database (PostgreSQL) -db_name: "synapse" -db_user: "synapse" -db_pass: "{{ synapse_db_pass | mandatory }}" -synapse_db_pass: "supersecretpassword" # use vault for real deployments! - - -matrix_domain: "matrix.example.com" -landing_domain: "example.com" # optional, or use same domain + path-based routing - -# For certbot -certbot_email: "admin@example.com" - -# Static site path -nginx_webroot: "/var/lib/matrix-nginx" \ No newline at end of file diff --git a/inventory.ini b/inventory.ini deleted file mode 100644 index 3d54689..0000000 --- a/inventory.ini +++ /dev/null @@ -1,7 +0,0 @@ -[matrix_servers] -matrix.example.com ansible_host=203.0.113.10 - -[all:vars] -ansible_user=deploy -ansible_ssh_private_key_file=~/.ssh/id_rsa -podman_user=matrix # rootless user (or 'root' for rootful) diff --git a/inventory/hosts.yml b/inventory/hosts.yml new file mode 100644 index 0000000..ce7c12a --- /dev/null +++ b/inventory/hosts.yml @@ -0,0 +1,6 @@ +all: + hosts: + podman-host1: # <-- change to the host that will run Podman + ansible_host: 192.168.1.10 # its IP or DNS name + ansible_user: youruser # user that can sudo + ansible_become: true \ No newline at end of file diff --git a/playbook.yml b/playbook.yml deleted file mode 100644 index 8655b48..0000000 --- a/playbook.yml +++ /dev/null @@ -1,19 +0,0 @@ -- name: Deploy Matrix + Nginx + Static Site with TLS - hosts: matrix_servers - become: yes - vars: - synapse_db_pass: "{{ vault_synapse_db_pass }}" - certbot_email: "{{ vault_certbot_email | default('admin@example.com') }}" - - tasks: - - name: Setup common dependencies - import_role: - name: common - - - name: Deploy Nginx + Static Site + TLS (with Certbot) - import_role: - name: nginx-proxy - - - name: Deploy Synapse (PostgreSQL + containers) - import_role: - name: matrix-synapse diff --git a/references/synapse-config/homeserver.yaml b/references/synapse-config/homeserver.yaml deleted file mode 100644 index e9223d7..0000000 --- a/references/synapse-config/homeserver.yaml +++ /dev/null @@ -1,40 +0,0 @@ -# Configuration file for Synapse. -# -# This is a YAML file: see [1] for a quick introduction. Note in particular -# that *indentation is important*: all the elements of a list or dictionary -# should have the same indentation. -# -# [1] https://docs.ansible.com/ansible/latest/reference_appendices/YAMLSyntax.html -# -# For more information on how to configure Synapse, including a complete accounting of -# each option, go to docs/usage/configuration/config_documentation.md or -# https://element-hq.github.io/synapse/latest/usage/configuration/config_documentation.html -server_name: "my.matrix.host" -pid_file: /data/homeserver.pid -listeners: - - port: 8008 - resources: - - compress: false - names: - - client - - federation - tls: false - type: http - x_forwarded: true -database: - name: sqlite3 - args: - database: /data/homeserver.db -log_config: "/data/my.matrix.host.log.config" -media_store_path: /data/media_store -registration_shared_secret: "uC7Pv@:r=@Slvhx7Ex*An8QHXWnPRyI9+COZr_&;Kh*,~lGpql" -report_stats: true -macaroon_secret_key: "+QUdDhvNc9*@MORp9K-TjuGp1j5Ff-mUBS+pjkmAFWR0Y3#da8" -form_secret: "meZSlI7K.EI-6hmXcjzCNf2IwrThcnoVr2X0iohOV7K5a_w^Ud" -signing_key_path: "/data/my.matrix.host.signing.key" -trusted_key_servers: - - server_name: "matrix.org" - - -# vim:ft=yaml - diff --git a/references/synapse-config/my.matrix.host.log.config b/references/synapse-config/my.matrix.host.log.config deleted file mode 100644 index 832f0fa..0000000 --- a/references/synapse-config/my.matrix.host.log.config +++ /dev/null @@ -1,39 +0,0 @@ -version: 1 - -formatters: - precise: - - format: '%(asctime)s - %(name)s - %(lineno)d - %(levelname)s - %(request)s - %(message)s' - - -handlers: - - - console: - class: logging.StreamHandler - formatter: precise - -loggers: - # This is just here so we can leave `loggers` in the config regardless of whether - # we configure other loggers below (avoid empty yaml dict error). - _placeholder: - level: "INFO" - - - - synapse.storage.SQL: - # beware: increasing this to DEBUG will make synapse log sensitive - # information such as access tokens. - level: INFO - - - - -root: - level: INFO - - - handlers: [console] - - -disable_existing_loggers: false \ No newline at end of file diff --git a/roles/common/tasks/main.yml b/roles/common/tasks/main.yml deleted file mode 100644 index b5835fe..0000000 --- a/roles/common/tasks/main.yml +++ /dev/null @@ -1,23 +0,0 @@ -- name: Ensure Podman is installed - package: - name: podman - state: present - -- name: Create matrix user (for rootless) - user: - name: "{{ podman_user }}" - shell: /bin/bash - createhome: yes - groups: wheel - when: podman_user != "root" - -- name: Create data directories - file: - path: "{{ item }}" - state: directory - owner: "{{ podman_user }}" - group: "{{ podman_user }}" - mode: '0755' - loop: - - "{{ synapse_data_dir }}" - - "{{ nginx_webroot }}" diff --git a/roles/matrix-synapse/tasks/main.yml b/roles/matrix-synapse/tasks/main.yml deleted file mode 100644 index 342510d..0000000 --- a/roles/matrix-synapse/tasks/main.yml +++ /dev/null @@ -1,69 +0,0 @@ -- name: Generate signing key (if missing) - command: > - podman run --rm -v "{{ synapse_data_dir }}:/data" - ghcr.io/element-hq/synapse:latest - generate-config --server-name "{{ matrix_domain }}" - --report-stats no - -o /data/homeserver.yaml - args: - creates: "{{ synapse_data_dir }}/homeserver.yaml" - -- name: Copy homeserver.yaml (configured) - template: - src: synapse/homeserver.yaml.j2 - dest: "{{ synapse_data_dir }}/homeserver.yaml" - owner: "{{ podman_user }}" - group: "{{ podman_user }}" - mode: '0644' - -- name: Ensure PostgreSQL database exists - become_user: postgres - community.postgresql.postgresql_db: - name: "{{ db_name }}" - state: present - delegate_to: "{{ inventory_hostname }}" # assuming DB on same host - -- name: Ensure PostgreSQL user exists - become_user: postgres - community.postgresql.postgresql_user: - name: "{{ db_user }}" - password: "{{ db_pass }}" - priv: "{{ db_name }}.*:ALL" - state: present - delegate_to: "{{ inventory_hostname }}" - -- name: Create Podman pod - command: > - podman pod create - --name {{ podman_pod_name }} - --publish 8008:8008 # synapse - --publish 8448:8448 # federation - when: podman_user != "root" - changed_when: false - -- name: Run PostgreSQL container - container: - name: synapse-db - image: docker.io/library/postgres:15-alpine - state: started - restart_policy: unless-stopped - pod: "{{ podman_pod_name }}" - env: - POSTGRES_DB: "{{ db_name }}" - POSTGRES_USER: "{{ db_user }}" - POSTGRES_PASSWORD: "{{ db_pass }}" - volumes: - - "{{ synapse_data_dir }}/db:/var/lib/postgresql/data" - register: pg_cont - -- name: Run Synapse container - container: - name: synapse - image: ghcr.io/element-hq/synapse:latest - state: started - restart_policy: unless-stopped - pod: "{{ podman_pod_name }}" - volumes: - - "{{ synapse_data_dir }}:/data" - command: > - -c /data/homeserver.yaml diff --git a/roles/matrix-synapse/templates/homeserver.yaml.j2 b/roles/matrix-synapse/templates/homeserver.yaml.j2 deleted file mode 100644 index 8a2e0b6..0000000 --- a/roles/matrix-synapse/templates/homeserver.yaml.j2 +++ /dev/null @@ -1,37 +0,0 @@ -server_name: "{{ matrix_domain }}" -enable_metrics: false -report_stats: false - -listeners: - - port: 8008 - type: http - tls: false - resources: - - names: [client, federation] - compress: true - -database: - name: psycopg2 - args: - user: "{{ db_user }}" - password: "{{ db_pass }}" - database: "{{ db_name }}" - host: "localhost" - port: 5432 - -registration_shared_secret: "{{ synapse_registration_secret }}" -tls_certificate_path: "/data/tls.crt" -private_key_path: "/data/tls.key" - -federation_domain_whitelist: - - matrix.org - - gitter.im - -# Optional: Rate limits -rc_flood_control: - interval: 1000 - burst_count: 3 - -# Enable password login -enable_registration: true -enable_registration_without_verification: true diff --git a/roles/nginx-proxy/files/mysite/index.html b/roles/nginx-proxy/files/mysite/index.html deleted file mode 100644 index e69de29..0000000 diff --git a/roles/nginx-proxy/tasks/main.yml b/roles/nginx-proxy/tasks/main.yml deleted file mode 100644 index f1e8f40..0000000 --- a/roles/nginx-proxy/tasks/main.yml +++ /dev/null @@ -1,104 +0,0 @@ -- name: Ensure web root exists (for ACME) - file: - path: "/var/www/{{ matrix_domain }}" - state: directory - mode: '0755' - -- name: Copy compiled site to host (for volume mount) - copy: - src: "files/mysite/" - dest: "{{ nginx_webroot }}/mysite/" - mode: '0644' - vars: - nginx_webroot: "/var/lib/matrix-nginx" - -- name: Ensure nginx data dir exists - file: - path: "{{ item }}" - state: directory - mode: '0755' - loop: - - "/var/lib/matrix-nginx" - - "/var/lib/matrix-nginx/certbot" - -- name: Create custom Nginx image (if missing) - command: > - podman build - -f "{{ role_path }}/templates/Dockerfile-nginx-certbot.j2" - -t nginx-matrix:latest - "{{ role_path }}/templates/" - args: - creates: /var/lib/containers/storage/overlay-images/... # (use container_exists check instead) - register: build_result - changed_when: false - -- name: Create Podman pod - command: > - podman pod create - --name {{ podman_pod_name }} - --publish 80:80 - --publish 443:443 - --publish 8008:8008 - --publish 8448:8448 - changed_when: false - -- name: Run Nginx container (with TLS & site) - container: - name: nginx-matrix - image: nginx-matrix:latest - state: started - restart_policy: unless-stopped - pod: "{{ podman_pod_name }}" - volumes: - - "/var/lib/matrix-nginx/mysite:/usr/share/nginx/html/mysite:ro" - - "/var/lib/matrix-nginx/certbot:/etc/letsencrypt" - env: - NGINX_HOST: "{{ matrix_domain }}" - security_opt: - - label: disable # if rootless: disable SELinux - register: nginx_cont - -- name: Run Synapse (PostgreSQL & all) - # ... (existing synapse task from before) - -- name: Install Nginx - package: - name: nginx - state: present - -- name: Create web root for landing page - file: - path: "{{ nginx_webroot }}" - state: directory - mode: '0755' - -- name: Deploy landing page HTML - copy: - content: | - - - Welcome - -

Welcome to Matrix!

-

Visit Matrix

- - - dest: "{{ nginx_webroot }}/index.html" - mode: '0644' - -- name: Deploy Nginx config - template: - src: nginx/default.conf.j2 - dest: "/etc/nginx/conf.d/{{ matrix_domain }}.conf" - mode: '0644' - -- name: Remove default config (optional) - file: - path: "/etc/nginx/conf.d/default.conf" - state: absent - -- name: Restart & enable Nginx - service: - name: nginx - state: restarted - enabled: yes diff --git a/roles/nginx-proxy/templates/Dockerfile-nginx-certbot.j2 b/roles/nginx-proxy/templates/Dockerfile-nginx-certbot.j2 deleted file mode 100644 index 686fd9c..0000000 --- a/roles/nginx-proxy/templates/Dockerfile-nginx-certbot.j2 +++ /dev/null @@ -1,11 +0,0 @@ -FROM nginx:1.25-alpine - -# Install Certbot (Python-based) -RUN apk add --no-cache certbot python3 py3-pip - -# Add entrypoint script to auto-renew certs (optional) -COPY certbot-entrypoint.sh /usr/local/bin/certbot-entrypoint.sh -RUN chmod +x /usr/local/bin/certbot-entrypoint.sh - -ENTRYPOINT ["/usr/local/bin/certbot-entrypoint.sh"] -CMD ["nginx", "-g", "daemon off;"] \ No newline at end of file diff --git a/roles/nginx-proxy/templates/certbot-entrypoint.sh b/roles/nginx-proxy/templates/certbot-entrypoint.sh deleted file mode 100644 index feb5aa4..0000000 --- a/roles/nginx-proxy/templates/certbot-entrypoint.sh +++ /dev/null @@ -1,23 +0,0 @@ -#!/bin/sh -set -e - -# Generate cert if not exists (first-run) -if [ ! -d "/etc/letsencrypt/live/{{ matrix_domain }}" ]; then - echo "Requesting initial Let's Encrypt certificate..." - certbot certonly --standalone \ - --non-interactive --agree-tos --email admin@{{ matrix_domain }} \ - -d {{ matrix_domain }} \ - --domain {{ matrix_domain }} \ - --preferred-challenges http \ - --http-01-port 8080 \ - --server https://acme-v02.api.letsencrypt.org/directory || true - - # For staging (dev): use --server https://acme-staging-v02.api.letsencrypt.org/directory -fi - -# Try to renew (non-blocking) -echo "Attempting certificate renewal..." -certbot renew --dry-run --quiet || true - -# Start Nginx (certs will be loaded if they exist) -exec "$@" \ No newline at end of file diff --git a/roles/nginx-proxy/templates/default.conf.j2 b/roles/nginx-proxy/templates/default.conf.j2 deleted file mode 100644 index 00dc23a..0000000 --- a/roles/nginx-proxy/templates/default.conf.j2 +++ /dev/null @@ -1,60 +0,0 @@ -# Redirect HTTP → HTTPS (except ACME challenges) -server { - listen 80; - server_name {{ matrix_domain }} {{ landing_domain }}; - - # ACME-challenge (for Let's Encrypt) - location ~ /.well-known/acme-challenge/ { - root /var/www; - try_files $uri =404; - } - - location / { - return 301 https://$host$request_uri; - } -} - -# HTTPS server -server { - listen 443 ssl http2; - server_name {{ matrix_domain }}; - - # TLS certs (mounted from Let's Encrypt dir) - ssl_certificate /etc/letsencrypt/live/{{ matrix_domain }}/fullchain.pem; - ssl_certificate_key /etc/letsencrypt/live/{{ matrix_domain }}/privkey.pem; - ssl_trusted_certificate /etc/letsencrypt/live/{{ matrix_domain }}/chain.pem; - - ssl_session_cache shared:SSL:10m; - ssl_protocols TLSv1.2 TLSv1.3; - ssl_ciphers HIGH:!aNULL:!MD5; - - # Serve static site (root) - location / { - root /usr/share/nginx/html/mysite; - try_files $uri $uri/ /index.html; - } - - # Matrix Synapse (client) - location /_matrix/ { - proxy_pass http://127.0.0.1:8008/_matrix/; - proxy_set_header Host $host; - proxy_set_header X-Real-IP $remote_addr; - proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; - proxy_set_header X-Forwarded-Proto $scheme; - proxy_buffering off; - } - - # Federation - location /_matrix/federation/v1/ { - proxy_pass http://127.0.0.1:8448/_matrix/federation/v1/; - proxy_set_header Host $host; - proxy_set_header X-Real-IP $remote_addr; - proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; - proxy_set_header X-Forwarded-Proto $scheme; - } - - # Optional: Add a Matrix admin link - location /admin { - return 301 https://matrix-admin.example.com; # or proxy to a UI like SynapseAdmin - } -} \ No newline at end of file diff --git a/templates/homeserver.yaml.j2 b/templates/homeserver.yaml.j2 new file mode 100644 index 0000000..69c8e1b --- /dev/null +++ b/templates/homeserver.yaml.j2 @@ -0,0 +1,31 @@ +server_name: "{{ matrix_domain }}" + +listeners: + - port: {{ synapse_http_port }} + bind_addresses: ['0.0.0.0'] + type: http + tls: false + x_forwarded: true + resources: + - names: [client, federation] + compress: true + +# ------------------------------------------------- +# TURN (WebRTC) – injected from the variables above +# ------------------------------------------------- +turn_uris: + - "turn:{{ matrix_domain }}:{{ turn_listen_port }}?transport=udp" + - "turn:{{ matrix_domain }}:{{ turn_tls_port }}?transport=tcp" + - "turns:{{ matrix_domain }}:{{ turn_tls_port }}?transport=tcp" +turn_shared_secret: "{{ turn_secret }}" +turn_user_lifetime: "86400000" # 1 day in ms (optional) + +# ----------------------------------------------------------------- +# NEW – Google OIDC provider +# ----------------------------------------------------------------- +oidc_providers: + - idp_id: google + issuer: "https://accounts.google.com" + client_id: "{{ google_oidc_client_id }}" + client_secret: "{{ google_oidc_client_secret }}" + scopes: {{ google_oidc_scopes | to_nice_yaml | indent(6) }} \ No newline at end of file diff --git a/templates/landing.html.j2 b/templates/landing.html.j2 new file mode 100644 index 0000000..e3437ac --- /dev/null +++ b/templates/landing.html.j2 @@ -0,0 +1,26 @@ + + + + + {{ landing_title }} + + + +

{{ landing_title }}

+ +

{{ landing_tagline }}

+ +

+ {{ landing_message | replace('\n','
') }} +

+ +

+ Go to Matrix login page → +

+ + \ No newline at end of file diff --git a/templates/traefik_dynamic.yml.j2 b/templates/traefik_dynamic.yml.j2 new file mode 100644 index 0000000..bb1681e --- /dev/null +++ b/templates/traefik_dynamic.yml.j2 @@ -0,0 +1,40 @@ +http: + routers: + synapse: + entryPoints: + - websecure + rule: "Host(`{{ matrix_domain }}`)" + service: synapse + tls: + certResolver: myresolver + landing: + entryPoints: + - websecure + rule: "Host(`{{ landing_domain }}`)" + service: landing + tls: + certResolver: myresolver + + services: + synapse: + loadBalancer: + servers: + - url: "http://{{ podman_network }}:{{ synapse_http_port }}/" + landing: + loadBalancer: + servers: + - url: "http://{{ podman_network }}:8080/" + +# ---------- TCP router for Teamspeak query ---------- +tcp: + routers: + teamspeak: + entryPoints: + - teamspeak + rule: "HostSNI(`{{ teamspeak_domain }}`)" # optional – works like Host for TCP + service: teamspeak + services: + teamspeak: + loadBalancer: + servers: + - address: "{{ podman_network }}:{{ teamspeak_tcp_port }}" \ No newline at end of file diff --git a/templates/traefik_static.toml.j2 b/templates/traefik_static.toml.j2 new file mode 100644 index 0000000..35ab112 --- /dev/null +++ b/templates/traefik_static.toml.j2 @@ -0,0 +1,23 @@ +[log] + level = "INFO" + +[accessLog] + +[entryPoints] + [entryPoints.web] + address = ":{{ traefik_http_port }}" + [entryPoints.websecure] + address = ":{{ traefik_https_port }}" + + # ---------- TCP entrypoint for Teamspeak query ---------- + [entryPoints.teamspeak] + address = ":{{ teamspeak_tcp_port }}" + +[providers] + [providers.file] + filename = "{{ dynamic_traefik_path }}" + watch = true + +[certificatesResolvers.myresolver.acme] + email = "{{ matrix_email }}" + storage = "/etc/traefik/acme.json" \ No newline at end of file diff --git a/templates/turnserver.conf.j2 b/templates/turnserver.conf.j2 new file mode 100644 index 0000000..d98173d --- /dev/null +++ b/templates/turnserver.conf.j2 @@ -0,0 +1,16 @@ +listening-port={{ turn_listen_port }} +tls-listening-port={{ turn_tls_port }} + +realm={{ matrix_domain }} +static-auth-secret={{ turn_secret }} + +# If your host sits behind NAT and you need to force the public IP, uncomment: +# external-ip=YOUR_PUBLIC_IP + +allowed-peer-ip=0.0.0.0/0 + +listening-ip=0.0.0.0 +listening-ip=::0 + +log-file=/var/log/turnserver.log +verbose \ No newline at end of file diff --git a/vars/vars.yml b/vars/vars.yml new file mode 100644 index 0000000..9568c8d --- /dev/null +++ b/vars/vars.yml @@ -0,0 +1,82 @@ +# -------------------------------------------------------------- +# General +# -------------------------------------------------------------- +matrix_domain: "matrix.fpov.space" +landing_domain: "org.fpov.space +teamspeak_domain: "ts.fpov.space" # <-- new +matrix_email: "boxswappers@gmail.com" + +# -------------------------------------------------------------- +# Ports +# -------------------------------------------------------------- +traefik_http_port: 80 +traefik_https_port: 443 + +# --- TURN ------------------------------------------------------- +turn_listen_port: 3478 +turn_tls_port: 5349 +turn_secret: "CHANGE-ME-TO-HEX-STRING" + +# --- Synapse ---------------------------------------------------- +synapse_http_port: 8008 +synapse_version: "latest" + +# --- Teamspeak --------------------------------------------------- +teamspeak_image: "docker.io/teamspeak:latest" +teamspeak_container_name: teamspeak +teamspeak_udp_port: 9987 # voice (UDP) – exposed directly on the host +teamspeak_tcp_port: 10011 # query (TCP) – will be routed via Traefik +teamspeak_file_port: 30033 # file‑transfer (TCP) – optional, expose directly + +# -------------------------------------------------------------- +# Container images +# -------------------------------------------------------------- +traefik_image: "docker.io/traefik:latest" +turn_image: "docker.io/coturn/coturn:latest" +synapse_image: "docker.io/matrixdotorg/synapse:{{ synapse_version }}" +nginx_image: "docker.io/nginx:alpine" + +# -------------------------------------------------------------- +# Podman names & volumes +# -------------------------------------------------------------- +podman_network: matrix_net +vol_traefik: traefik_data +vol_synapse: synapse_config +vol_media: synapse_media +vol_turn: turn_data +vol_nginx: nginx_html +vol_teamspeak: teamspeak_data # <-- new volume + +# -------------------------------------------------------------- +# Paths on the target host (temporary files) +# -------------------------------------------------------------- +static_traefik_path: "/tmp/traefik_static.toml" +dynamic_traefik_path: "/tmp/traefik_dynamic.yml" +turn_conf_path: "/tmp/turnserver.conf" +synapse_cfg_path: "/tmp/homeserver.yaml" +nginx_html_path: "/tmp/index.html" + + +# ----------------------------------------------------------------- +# NEW – Google OAuth2 (OpenID Connect) credentials +# ----------------------------------------------------------------- +google_oidc_client_id: "YOUR_GOOGLE_CLIENT_ID" +google_oidc_client_secret: "YOUR_GOOGLE_CLIENT_SECRET" + +# Optional – the scopes you want to request (the default works for most cases) +google_oidc_scopes: + - openid + - email + - profile + +# -------------------------------------------------------------- +# Landing page HTML +# -------------------------------------------------------------- +matrix_domain: "matrix.example.com" +landing_title: "Welcome to {{ matrix_domain }}" # you can embed other vars here +landing_tagline: "Matrix + Traefik + Teamspeak – all in one stack" +landing_message: | + This host runs a Matrix homeserver (Synapse), a reverse‑proxy (Traefik) with + automatic Let’s Encrypt certificates, a TURN server for voice/video, and a + simple landing page. +