created potential branch

templates/homeserver.yaml.j2

@@ -0,0 +1,31 @@
+server_name: "{{ matrix_domain }}"
+
+listeners:
+  - port: {{ synapse_http_port }}
+    bind_addresses: ['0.0.0.0']
+    type: http
+    tls: false
+    x_forwarded: true
+    resources:
+      - names: [client, federation]
+        compress: true
+
+# -------------------------------------------------
+# TURN (WebRTC) – injected from the variables above
+# -------------------------------------------------
+turn_uris:
+  - "turn:{{ matrix_domain }}:{{ turn_listen_port }}?transport=udp"
+  - "turn:{{ matrix_domain }}:{{ turn_tls_port }}?transport=tcp"
+  - "turns:{{ matrix_domain }}:{{ turn_tls_port }}?transport=tcp"
+turn_shared_secret: "{{ turn_secret }}"
+turn_user_lifetime: "86400000"   # 1 day in ms (optional)
+
+# -----------------------------------------------------------------
+# NEW – Google OIDC provider
+# -----------------------------------------------------------------
+oidc_providers:
+  - idp_id: google
+    issuer: "https://accounts.google.com"
+    client_id: "{{ google_oidc_client_id }}"
+    client_secret: "{{ google_oidc_client_secret }}"
+    scopes: {{ google_oidc_scopes | to_nice_yaml | indent(6) }}

templates/landing.html.j2

@@ -0,0 +1,26 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+    <meta charset="UTF-8">
+    <title>{{ landing_title }}</title>
+    <style>
+        body { font-family: Arial, Helvetica, sans-serif; text-align: center; margin-top: 5rem; }
+        h1   { font-size: 2.2rem; }
+        p    { font-size: 1.1rem; line-height: 1.5; max-width: 600px; margin: 0 auto; }
+        a    { color: #0066cc; }
+    </style>
+</head>
+<body>
+    <h1>{{ landing_title }}</h1>
+
+    <p>{{ landing_tagline }}</p>
+
+    <p>
+        {{ landing_message | replace('\n','<br>') }}
+    </p>
+
+    <p>
+        <a href="https://{{ matrix_domain }}">Go to Matrix login page →</a>
+    </p>
+</body>
+</html>

templates/traefik_dynamic.yml.j2

@@ -0,0 +1,40 @@
+http:
+  routers:
+    synapse:
+      entryPoints:
+        - websecure
+      rule: "Host(`{{ matrix_domain }}`)"
+      service: synapse
+      tls:
+        certResolver: myresolver
+    landing:
+      entryPoints:
+        - websecure
+      rule: "Host(`{{ landing_domain }}`)"
+      service: landing
+      tls:
+        certResolver: myresolver
+
+  services:
+    synapse:
+      loadBalancer:
+        servers:
+          - url: "http://{{ podman_network }}:{{ synapse_http_port }}/"
+    landing:
+      loadBalancer:
+        servers:
+          - url: "http://{{ podman_network }}:8080/"
+
+# ---------- TCP router for Teamspeak query ----------
+tcp:
+  routers:
+    teamspeak:
+      entryPoints:
+        - teamspeak
+      rule: "HostSNI(`{{ teamspeak_domain }}`)"   # optional – works like Host for TCP
+      service: teamspeak
+  services:
+    teamspeak:
+      loadBalancer:
+        servers:
+          - address: "{{ podman_network }}:{{ teamspeak_tcp_port }}"

templates/traefik_static.toml.j2

@@ -0,0 +1,23 @@
+[log]
+  level = "INFO"
+
+[accessLog]
+
+[entryPoints]
+  [entryPoints.web]
+    address = ":{{ traefik_http_port }}"
+  [entryPoints.websecure]
+    address = ":{{ traefik_https_port }}"
+
+  # ---------- TCP entrypoint for Teamspeak query ----------
+  [entryPoints.teamspeak]
+    address = ":{{ teamspeak_tcp_port }}"
+
+[providers]
+  [providers.file]
+    filename = "{{ dynamic_traefik_path }}"
+    watch = true
+
+[certificatesResolvers.myresolver.acme]
+  email = "{{ matrix_email }}"
+  storage = "/etc/traefik/acme.json"

templates/turnserver.conf.j2

@@ -0,0 +1,16 @@
+listening-port={{ turn_listen_port }}
+tls-listening-port={{ turn_tls_port }}
+
+realm={{ matrix_domain }}
+static-auth-secret={{ turn_secret }}
+
+# If your host sits behind NAT and you need to force the public IP, uncomment:
+# external-ip=YOUR_PUBLIC_IP
+
+allowed-peer-ip=0.0.0.0/0
+
+listening-ip=0.0.0.0
+listening-ip=::0
+
+log-file=/var/log/turnserver.log
+verbose