created potential branch
This commit is contained in:
64
README.md
64
README.md
@@ -1,64 +0,0 @@
|
|||||||
deploy playbook after setup
|
|
||||||
```
|
|
||||||
ansible-playbook playbook.yml --ask-vault-pass
|
|
||||||
```
|
|
||||||
|
|
||||||
Check containers
|
|
||||||
```
|
|
||||||
ssh matrix.example.com
|
|
||||||
sudo podman ps
|
|
||||||
sudo podman logs synapse
|
|
||||||
```
|
|
||||||
|
|
||||||
test federation
|
|
||||||
```
|
|
||||||
curl https://{{ matrix_domain }}/_matrix/federation/v1/version
|
|
||||||
```
|
|
||||||
|
|
||||||
## to generate config files default before deploymenta and templating ##
|
|
||||||
```
|
|
||||||
podman run -it --rm \
|
|
||||||
-v "$(pwd)":/data \
|
|
||||||
-e SYNAPSE_SERVER_NAME=my.matrix.host \
|
|
||||||
-e SYNAPSE_REPORT_STATS=yes \
|
|
||||||
docker.io/matrixdotorg/synapse:latest generate
|
|
||||||
```
|
|
||||||
|
|
||||||
|
|
||||||
| Area | Recommendation |
|
|
||||||
|------|----------------|
|
|
||||||
| **TLS** | Use Certbot + Nginx plugin (`community.general.acme` Ansible module) |
|
|
||||||
| **Secrets** | Store DB passwords, secrets in **Ansible Vault** |
|
|
||||||
| **Updates** | Use `container_image: tag` with version pins (e.g., `v1.100.0`) |
|
|
||||||
| **Monitoring** | Add Prometheus metrics (`enable_metrics: true`) |
|
|
||||||
| **Coturn** | Deploy `coturn` (STUN/TURN) as separate container if needed |
|
|
||||||
| **Backups** | Backup `/var/lib/matrix-synapse` regularly |
|
|
||||||
| **Rootless Podman** | Use `podman user` namespaces + `podman system migrate` for portability |
|
|
||||||
|
|
||||||
|
|
||||||
## Using Hugo to create site ##
|
|
||||||
```
|
|
||||||
# Create & build site locally (run ON CONTROL NODE)
|
|
||||||
hugo new site mysite
|
|
||||||
cd mysite
|
|
||||||
echo 'theme = "ananke"' >> config.toml
|
|
||||||
hugo new posts/my-first-post.md
|
|
||||||
hugo # builds to /public
|
|
||||||
cp -r public ../fpov/roles/nginx-proxy/files/mysite/
|
|
||||||
```
|
|
||||||
|
|
||||||
1. Host boots: Podman creates pod with ports 80, 443, 8008, 8448 open.
|
|
||||||
2. Nginx starts, runs certbot-entrypoint.sh:
|
|
||||||
- Checks for /etc/letsencrypt/live/matrix.example.com
|
|
||||||
- If missing → runs certbot certonly --standalone on port 8080
|
|
||||||
- Writes certs to /etc/letsencrypt
|
|
||||||
3. Nginx loads TLS certs, serves static site + proxies /_matrix/
|
|
||||||
4. User visits https://matrix.example.com → gets your Hugo site.
|
|
||||||
5. User visits https://matrix.example.com/_matrix/client → gets Synapse.
|
|
||||||
6. ACME renewal: Certbot’s renew is dry-run on each start (you can also add cron via systemd unit if needed).
|
|
||||||
|
|
||||||
Certificate renewal
|
|
||||||
```
|
|
||||||
# /etc/cron.d/certbot-renew
|
|
||||||
0 3 * * * root podman exec nginx-matrix certbot renew --quiet
|
|
||||||
```
|
|
||||||
261
deploy_matrix.yml
Normal file
261
deploy_matrix.yml
Normal file
@@ -0,0 +1,261 @@
|
|||||||
|
---
|
||||||
|
- name: Deploy Matrix + TURN + Traefik + NGINX + Teamspeak
|
||||||
|
hosts: all
|
||||||
|
become: true
|
||||||
|
collections:
|
||||||
|
- containers.podman
|
||||||
|
|
||||||
|
vars_files:
|
||||||
|
- ../vars/vars.yml # ← our variable file
|
||||||
|
|
||||||
|
tasks:
|
||||||
|
|
||||||
|
# -----------------------------------------------------------------
|
||||||
|
# (unchanged) Install podman, create network, create volumes …
|
||||||
|
# -----------------------------------------------------------------
|
||||||
|
- name: Install podman package
|
||||||
|
ansible.builtin.package:
|
||||||
|
name: podman
|
||||||
|
state: present
|
||||||
|
|
||||||
|
- name: Create podman network "{{ podman_network }}"
|
||||||
|
containers.podman.podman_network:
|
||||||
|
name: "{{ podman_network }}"
|
||||||
|
driver: bridge
|
||||||
|
subnet: "10.88.0.0/16"
|
||||||
|
state: present
|
||||||
|
|
||||||
|
- name: Ensure required podman volumes exist
|
||||||
|
containers.podman.podman_volume:
|
||||||
|
name: "{{ item }}"
|
||||||
|
driver: local
|
||||||
|
state: present
|
||||||
|
loop:
|
||||||
|
- "{{ vol_traefik }}"
|
||||||
|
- "{{ vol_synapse }}"
|
||||||
|
- "{{ vol_media }}"
|
||||||
|
- "{{ vol_turn }}"
|
||||||
|
- "{{ vol_nginx }}"
|
||||||
|
- "{{ vol_teamspeak }}" # <-- new volume
|
||||||
|
|
||||||
|
# -----------------------------------------------------------------
|
||||||
|
# Render all configuration files from the templates
|
||||||
|
# -----------------------------------------------------------------
|
||||||
|
- name: Render static Traefik config
|
||||||
|
ansible.builtin.template:
|
||||||
|
src: ../templates/traefik_static.toml.j2
|
||||||
|
dest: "{{ static_traefik_path }}"
|
||||||
|
mode: "0644"
|
||||||
|
|
||||||
|
- name: Render dynamic Traefik config
|
||||||
|
ansible.builtin.template:
|
||||||
|
src: ../templates/traefik_dynamic.yml.j2
|
||||||
|
dest: "{{ dynamic_traefik_path }}"
|
||||||
|
mode: "0644"
|
||||||
|
|
||||||
|
- name: Render coturn config
|
||||||
|
ansible.builtin.template:
|
||||||
|
src: ../templates/turnserver.conf.j2
|
||||||
|
dest: "{{ turn_conf_path }}"
|
||||||
|
mode: "0644"
|
||||||
|
|
||||||
|
- name: Render Synapse homeserver.yaml
|
||||||
|
ansible.builtin.template:
|
||||||
|
src: ../templates/homeserver.yaml.j2
|
||||||
|
dest: "{{ synapse_cfg_path }}"
|
||||||
|
mode: "0644"
|
||||||
|
|
||||||
|
- name: Render landing page index.html
|
||||||
|
ansible.builtin.template:
|
||||||
|
src: ../templates/landing.html.j2 # path relative to this playbook file
|
||||||
|
dest: "{{ nginx_html_path }}" # we already defined this variable in vars.yml
|
||||||
|
mode: "0644"
|
||||||
|
|
||||||
|
# -----------------------------------------------------------------
|
||||||
|
# Start the NGINX container (unchanged – just mounts the file we created)
|
||||||
|
# -----------------------------------------------------------------
|
||||||
|
- name: Start NGINX landing‑page container
|
||||||
|
containers.podman.podman_container:
|
||||||
|
name: landing
|
||||||
|
image: "{{ nginx_image }}"
|
||||||
|
state: started
|
||||||
|
ports:
|
||||||
|
- "8080:80"
|
||||||
|
volumes:
|
||||||
|
- "{{ vol_nginx }}:/usr/share/nginx/html:ro"
|
||||||
|
- "{{ nginx_html_path }}:/usr/share/nginx/html/index.html:ro"
|
||||||
|
network: "{{ podman_network }}"
|
||||||
|
restart_policy: always
|
||||||
|
|
||||||
|
|
||||||
|
# -----------------------------------------------------------------
|
||||||
|
# Pull required images (including Teamspeak)
|
||||||
|
# -----------------------------------------------------------------
|
||||||
|
- name: Pull Traefik image
|
||||||
|
containers.podman.podman_image:
|
||||||
|
name: "{{ traefik_image }}"
|
||||||
|
state: present
|
||||||
|
|
||||||
|
- name: Pull coturn image
|
||||||
|
containers.podman.podman_image:
|
||||||
|
name: "{{ turn_image }}"
|
||||||
|
state: present
|
||||||
|
|
||||||
|
- name: Pull Synapse image
|
||||||
|
containers.podman.podman_image:
|
||||||
|
name: "{{ synapse_image }}"
|
||||||
|
state: present
|
||||||
|
|
||||||
|
- name: Pull NGINX image
|
||||||
|
containers.podman.podman_image:
|
||||||
|
name: "{{ nginx_image }}"
|
||||||
|
state: present
|
||||||
|
|
||||||
|
- name: Pull Teamspeak image
|
||||||
|
containers.podman.podman_image:
|
||||||
|
name: "{{ teamspeak_image }}"
|
||||||
|
state: present
|
||||||
|
|
||||||
|
# -----------------------------------------------------------------
|
||||||
|
# Start containers (Traefik, TURN, Synapse, NGINX – unchanged)
|
||||||
|
# -----------------------------------------------------------------
|
||||||
|
- name: Start Traefik container
|
||||||
|
containers.podman.podman_container:
|
||||||
|
name: traefik
|
||||||
|
image: "{{ traefik_image }}"
|
||||||
|
state: started
|
||||||
|
ports:
|
||||||
|
- "{{ traefik_http_port }}:{{ traefik_http_port }}"
|
||||||
|
- "{{ traefik_https_port }}:{{ traefik_https_port }}"
|
||||||
|
- "{{ teamspeak_tcp_port }}:{{ teamspeak_tcp_port }}" # expose TCP entrypoint on host
|
||||||
|
volumes:
|
||||||
|
- "{{ vol_traefik }}:/etc/traefik"
|
||||||
|
- "{{ static_traefik_path }}:{{ static_traefik_path }}:ro"
|
||||||
|
- "{{ dynamic_traefik_path }}:{{ dynamic_traefik_path }}:ro"
|
||||||
|
network: "{{ podman_network }}"
|
||||||
|
restart_policy: always
|
||||||
|
|
||||||
|
- name: Start coturn container
|
||||||
|
containers.podman.podman_container:
|
||||||
|
name: turn
|
||||||
|
image: "{{ turn_image }}"
|
||||||
|
state: started
|
||||||
|
ports:
|
||||||
|
- "{{ turn_listen_port }}:{{ turn_listen_port }}/udp"
|
||||||
|
- "{{ turn_listen_port }}:{{ turn_listen_port }}/tcp"
|
||||||
|
- "{{ turn_tls_port }}:{{ turn_tls_port }}/udp"
|
||||||
|
- "{{ turn_tls_port }}:{{ turn_tls_port }}/tcp"
|
||||||
|
volumes:
|
||||||
|
- "{{ vol_turn }}:/var/lib/turn"
|
||||||
|
- "{{ turn_conf_path }}:/etc/turnserver.conf:ro"
|
||||||
|
command: "-c /etc/turnserver.conf"
|
||||||
|
network: "{{ podman_network }}"
|
||||||
|
restart_policy: always
|
||||||
|
|
||||||
|
- name: Start Synapse container
|
||||||
|
containers.podman.podman_container:
|
||||||
|
name: synapse
|
||||||
|
image: "{{ synapse_image }}"
|
||||||
|
state: started
|
||||||
|
env:
|
||||||
|
SYNAPSE_SERVER_NAME: "{{ matrix_domain }}"
|
||||||
|
SYNAPSE_REPORT_STATS: "yes"
|
||||||
|
ports:
|
||||||
|
- "{{ synapse_http_port }}:{{ synapse_http_port }}"
|
||||||
|
volumes:
|
||||||
|
- "{{ vol_synapse }}:/data"
|
||||||
|
- "{{ vol_media }}:/data/media_store"
|
||||||
|
- "{{ synapse_cfg_path }}:/data/homeserver.yaml:ro"
|
||||||
|
network: "{{ podman_network }}"
|
||||||
|
restart_policy: always
|
||||||
|
|
||||||
|
- name: Start NGINX landing‑page container
|
||||||
|
containers.podman.podman_container:
|
||||||
|
name: landing
|
||||||
|
image: "{{ nginx_image }}"
|
||||||
|
state: started
|
||||||
|
ports:
|
||||||
|
- "8080:80"
|
||||||
|
volumes:
|
||||||
|
- "{{ vol_nginx }}:/usr/share/nginx/html:ro"
|
||||||
|
- "{{ nginx_html_path }}:/usr/share/nginx/html/index.html:ro"
|
||||||
|
network: "{{ podman_network }}"
|
||||||
|
restart_policy: always
|
||||||
|
|
||||||
|
# -----------------------------------------------------------------
|
||||||
|
# **NEW** – Start Teamspeak container
|
||||||
|
# -----------------------------------------------------------------
|
||||||
|
- name: Start Teamspeak container
|
||||||
|
containers.podman.podman_container:
|
||||||
|
name: "{{ teamspeak_container_name }}"
|
||||||
|
image: "{{ teamspeak_image }}"
|
||||||
|
state: started
|
||||||
|
ports:
|
||||||
|
# UDP voice port – exposed directly on the host (no Traefik)
|
||||||
|
- "{{ teamspeak_udp_port }}:{{ teamspeak_udp_port }}/udp"
|
||||||
|
# TCP query port – Traefik will forward it (see static config)
|
||||||
|
- "{{ teamspeak_tcp_port }}:{{ teamspeak_tcp_port }}/tcp"
|
||||||
|
# Optional file‑transfer port (exposed directly)
|
||||||
|
- "{{ teamspeak_file_port }}:{{ teamspeak_file_port }}/tcp"
|
||||||
|
volumes:
|
||||||
|
- "{{ vol_teamspeak }}:/var/ts3server"
|
||||||
|
network: "{{ podman_network }}"
|
||||||
|
restart_policy: always
|
||||||
|
|
||||||
|
# -----------------------------------------------------------------
|
||||||
|
# (optional) generate systemd units for the new container
|
||||||
|
# -----------------------------------------------------------------
|
||||||
|
- name: Generate systemd unit for Teamspeak
|
||||||
|
containers.podman.podman_generate_systemd:
|
||||||
|
name: "{{ teamspeak_container_name }}"
|
||||||
|
state: present
|
||||||
|
dest: "/etc/systemd/system/{{ teamspeak_container_name }}.service"
|
||||||
|
when: generate_systemd | bool
|
||||||
|
|
||||||
|
# -----------------------------------------------------------------
|
||||||
|
# (unchanged) systemd unit generation for the other containers
|
||||||
|
# -----------------------------------------------------------------
|
||||||
|
- name: Generate systemd unit for Traefik
|
||||||
|
containers.podman.podman_generate_systemd:
|
||||||
|
name: traefik
|
||||||
|
state: present
|
||||||
|
dest: "/etc/systemd/system/traefik.service"
|
||||||
|
when: generate_systemd | bool
|
||||||
|
|
||||||
|
- name: Generate systemd unit for TURN
|
||||||
|
containers.podman.podman_generate_systemd:
|
||||||
|
name: turn
|
||||||
|
state: present
|
||||||
|
dest: "/etc/systemd/system/turn.service"
|
||||||
|
when: generate_systemd | bool
|
||||||
|
|
||||||
|
- name: Generate systemd unit for Synapse
|
||||||
|
containers.podman.podman_generate_systemd:
|
||||||
|
name: synapse
|
||||||
|
state: present
|
||||||
|
dest: "/etc/systemd/system/synapse.service"
|
||||||
|
when: generate_systemd | bool
|
||||||
|
|
||||||
|
- name: Generate systemd unit for landing page
|
||||||
|
containers.podman.podman_generate_systemd:
|
||||||
|
name: landing
|
||||||
|
state: present
|
||||||
|
dest: "/etc/systemd/system/landing.service"
|
||||||
|
when: generate_systemd | bool
|
||||||
|
|
||||||
|
- name: Reload systemd daemon (if units were created)
|
||||||
|
ansible.builtin.systemd:
|
||||||
|
daemon_reload: yes
|
||||||
|
when: generate_systemd | bool
|
||||||
|
|
||||||
|
# -----------------------------------------------------------------
|
||||||
|
# Debug – list containers
|
||||||
|
# -----------------------------------------------------------------
|
||||||
|
- name: List running podman containers
|
||||||
|
containers.podman.podman_ps:
|
||||||
|
all: true
|
||||||
|
register: ps_out
|
||||||
|
|
||||||
|
- name: Show container list
|
||||||
|
ansible.builtin.debug:
|
||||||
|
var: ps_out.containers
|
||||||
@@ -1,25 +0,0 @@
|
|||||||
# Variables
|
|
||||||
matrix_domain: "matrix.example.com"
|
|
||||||
landing_domain: "example.com" # or same as matrix_domain + path-based routing
|
|
||||||
podman_user: "matrix" # set to 'root' for rootful
|
|
||||||
podman_pod_name: "matrix-pod"
|
|
||||||
|
|
||||||
synapse_data_dir: "/var/lib/matrix-synapse"
|
|
||||||
nginx_config_dir: "/etc/nginx/conf.d"
|
|
||||||
nginx_webroot: "/var/www/landing"
|
|
||||||
|
|
||||||
# Database (PostgreSQL)
|
|
||||||
db_name: "synapse"
|
|
||||||
db_user: "synapse"
|
|
||||||
db_pass: "{{ synapse_db_pass | mandatory }}"
|
|
||||||
synapse_db_pass: "supersecretpassword" # use vault for real deployments!
|
|
||||||
|
|
||||||
|
|
||||||
matrix_domain: "matrix.example.com"
|
|
||||||
landing_domain: "example.com" # optional, or use same domain + path-based routing
|
|
||||||
|
|
||||||
# For certbot
|
|
||||||
certbot_email: "admin@example.com"
|
|
||||||
|
|
||||||
# Static site path
|
|
||||||
nginx_webroot: "/var/lib/matrix-nginx"
|
|
||||||
@@ -1,7 +0,0 @@
|
|||||||
[matrix_servers]
|
|
||||||
matrix.example.com ansible_host=203.0.113.10
|
|
||||||
|
|
||||||
[all:vars]
|
|
||||||
ansible_user=deploy
|
|
||||||
ansible_ssh_private_key_file=~/.ssh/id_rsa
|
|
||||||
podman_user=matrix # rootless user (or 'root' for rootful)
|
|
||||||
6
inventory/hosts.yml
Normal file
6
inventory/hosts.yml
Normal file
@@ -0,0 +1,6 @@
|
|||||||
|
all:
|
||||||
|
hosts:
|
||||||
|
podman-host1: # <-- change to the host that will run Podman
|
||||||
|
ansible_host: 192.168.1.10 # its IP or DNS name
|
||||||
|
ansible_user: youruser # user that can sudo
|
||||||
|
ansible_become: true
|
||||||
19
playbook.yml
19
playbook.yml
@@ -1,19 +0,0 @@
|
|||||||
- name: Deploy Matrix + Nginx + Static Site with TLS
|
|
||||||
hosts: matrix_servers
|
|
||||||
become: yes
|
|
||||||
vars:
|
|
||||||
synapse_db_pass: "{{ vault_synapse_db_pass }}"
|
|
||||||
certbot_email: "{{ vault_certbot_email | default('admin@example.com') }}"
|
|
||||||
|
|
||||||
tasks:
|
|
||||||
- name: Setup common dependencies
|
|
||||||
import_role:
|
|
||||||
name: common
|
|
||||||
|
|
||||||
- name: Deploy Nginx + Static Site + TLS (with Certbot)
|
|
||||||
import_role:
|
|
||||||
name: nginx-proxy
|
|
||||||
|
|
||||||
- name: Deploy Synapse (PostgreSQL + containers)
|
|
||||||
import_role:
|
|
||||||
name: matrix-synapse
|
|
||||||
@@ -1,40 +0,0 @@
|
|||||||
# Configuration file for Synapse.
|
|
||||||
#
|
|
||||||
# This is a YAML file: see [1] for a quick introduction. Note in particular
|
|
||||||
# that *indentation is important*: all the elements of a list or dictionary
|
|
||||||
# should have the same indentation.
|
|
||||||
#
|
|
||||||
# [1] https://docs.ansible.com/ansible/latest/reference_appendices/YAMLSyntax.html
|
|
||||||
#
|
|
||||||
# For more information on how to configure Synapse, including a complete accounting of
|
|
||||||
# each option, go to docs/usage/configuration/config_documentation.md or
|
|
||||||
# https://element-hq.github.io/synapse/latest/usage/configuration/config_documentation.html
|
|
||||||
server_name: "my.matrix.host"
|
|
||||||
pid_file: /data/homeserver.pid
|
|
||||||
listeners:
|
|
||||||
- port: 8008
|
|
||||||
resources:
|
|
||||||
- compress: false
|
|
||||||
names:
|
|
||||||
- client
|
|
||||||
- federation
|
|
||||||
tls: false
|
|
||||||
type: http
|
|
||||||
x_forwarded: true
|
|
||||||
database:
|
|
||||||
name: sqlite3
|
|
||||||
args:
|
|
||||||
database: /data/homeserver.db
|
|
||||||
log_config: "/data/my.matrix.host.log.config"
|
|
||||||
media_store_path: /data/media_store
|
|
||||||
registration_shared_secret: "uC7Pv@:r=@Slvhx7Ex*An8QHXWnPRyI9+COZr_&;Kh*,~lGpql"
|
|
||||||
report_stats: true
|
|
||||||
macaroon_secret_key: "+QUdDhvNc9*@MORp9K-TjuGp1j5Ff-mUBS+pjkmAFWR0Y3#da8"
|
|
||||||
form_secret: "meZSlI7K.EI-6hmXcjzCNf2IwrThcnoVr2X0iohOV7K5a_w^Ud"
|
|
||||||
signing_key_path: "/data/my.matrix.host.signing.key"
|
|
||||||
trusted_key_servers:
|
|
||||||
- server_name: "matrix.org"
|
|
||||||
|
|
||||||
|
|
||||||
# vim:ft=yaml
|
|
||||||
|
|
||||||
@@ -1,39 +0,0 @@
|
|||||||
version: 1
|
|
||||||
|
|
||||||
formatters:
|
|
||||||
precise:
|
|
||||||
|
|
||||||
format: '%(asctime)s - %(name)s - %(lineno)d - %(levelname)s - %(request)s - %(message)s'
|
|
||||||
|
|
||||||
|
|
||||||
handlers:
|
|
||||||
|
|
||||||
|
|
||||||
console:
|
|
||||||
class: logging.StreamHandler
|
|
||||||
formatter: precise
|
|
||||||
|
|
||||||
loggers:
|
|
||||||
# This is just here so we can leave `loggers` in the config regardless of whether
|
|
||||||
# we configure other loggers below (avoid empty yaml dict error).
|
|
||||||
_placeholder:
|
|
||||||
level: "INFO"
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
synapse.storage.SQL:
|
|
||||||
# beware: increasing this to DEBUG will make synapse log sensitive
|
|
||||||
# information such as access tokens.
|
|
||||||
level: INFO
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
root:
|
|
||||||
level: INFO
|
|
||||||
|
|
||||||
|
|
||||||
handlers: [console]
|
|
||||||
|
|
||||||
|
|
||||||
disable_existing_loggers: false
|
|
||||||
@@ -1,23 +0,0 @@
|
|||||||
- name: Ensure Podman is installed
|
|
||||||
package:
|
|
||||||
name: podman
|
|
||||||
state: present
|
|
||||||
|
|
||||||
- name: Create matrix user (for rootless)
|
|
||||||
user:
|
|
||||||
name: "{{ podman_user }}"
|
|
||||||
shell: /bin/bash
|
|
||||||
createhome: yes
|
|
||||||
groups: wheel
|
|
||||||
when: podman_user != "root"
|
|
||||||
|
|
||||||
- name: Create data directories
|
|
||||||
file:
|
|
||||||
path: "{{ item }}"
|
|
||||||
state: directory
|
|
||||||
owner: "{{ podman_user }}"
|
|
||||||
group: "{{ podman_user }}"
|
|
||||||
mode: '0755'
|
|
||||||
loop:
|
|
||||||
- "{{ synapse_data_dir }}"
|
|
||||||
- "{{ nginx_webroot }}"
|
|
||||||
@@ -1,69 +0,0 @@
|
|||||||
- name: Generate signing key (if missing)
|
|
||||||
command: >
|
|
||||||
podman run --rm -v "{{ synapse_data_dir }}:/data"
|
|
||||||
ghcr.io/element-hq/synapse:latest
|
|
||||||
generate-config --server-name "{{ matrix_domain }}"
|
|
||||||
--report-stats no
|
|
||||||
-o /data/homeserver.yaml
|
|
||||||
args:
|
|
||||||
creates: "{{ synapse_data_dir }}/homeserver.yaml"
|
|
||||||
|
|
||||||
- name: Copy homeserver.yaml (configured)
|
|
||||||
template:
|
|
||||||
src: synapse/homeserver.yaml.j2
|
|
||||||
dest: "{{ synapse_data_dir }}/homeserver.yaml"
|
|
||||||
owner: "{{ podman_user }}"
|
|
||||||
group: "{{ podman_user }}"
|
|
||||||
mode: '0644'
|
|
||||||
|
|
||||||
- name: Ensure PostgreSQL database exists
|
|
||||||
become_user: postgres
|
|
||||||
community.postgresql.postgresql_db:
|
|
||||||
name: "{{ db_name }}"
|
|
||||||
state: present
|
|
||||||
delegate_to: "{{ inventory_hostname }}" # assuming DB on same host
|
|
||||||
|
|
||||||
- name: Ensure PostgreSQL user exists
|
|
||||||
become_user: postgres
|
|
||||||
community.postgresql.postgresql_user:
|
|
||||||
name: "{{ db_user }}"
|
|
||||||
password: "{{ db_pass }}"
|
|
||||||
priv: "{{ db_name }}.*:ALL"
|
|
||||||
state: present
|
|
||||||
delegate_to: "{{ inventory_hostname }}"
|
|
||||||
|
|
||||||
- name: Create Podman pod
|
|
||||||
command: >
|
|
||||||
podman pod create
|
|
||||||
--name {{ podman_pod_name }}
|
|
||||||
--publish 8008:8008 # synapse
|
|
||||||
--publish 8448:8448 # federation
|
|
||||||
when: podman_user != "root"
|
|
||||||
changed_when: false
|
|
||||||
|
|
||||||
- name: Run PostgreSQL container
|
|
||||||
container:
|
|
||||||
name: synapse-db
|
|
||||||
image: docker.io/library/postgres:15-alpine
|
|
||||||
state: started
|
|
||||||
restart_policy: unless-stopped
|
|
||||||
pod: "{{ podman_pod_name }}"
|
|
||||||
env:
|
|
||||||
POSTGRES_DB: "{{ db_name }}"
|
|
||||||
POSTGRES_USER: "{{ db_user }}"
|
|
||||||
POSTGRES_PASSWORD: "{{ db_pass }}"
|
|
||||||
volumes:
|
|
||||||
- "{{ synapse_data_dir }}/db:/var/lib/postgresql/data"
|
|
||||||
register: pg_cont
|
|
||||||
|
|
||||||
- name: Run Synapse container
|
|
||||||
container:
|
|
||||||
name: synapse
|
|
||||||
image: ghcr.io/element-hq/synapse:latest
|
|
||||||
state: started
|
|
||||||
restart_policy: unless-stopped
|
|
||||||
pod: "{{ podman_pod_name }}"
|
|
||||||
volumes:
|
|
||||||
- "{{ synapse_data_dir }}:/data"
|
|
||||||
command: >
|
|
||||||
-c /data/homeserver.yaml
|
|
||||||
@@ -1,37 +0,0 @@
|
|||||||
server_name: "{{ matrix_domain }}"
|
|
||||||
enable_metrics: false
|
|
||||||
report_stats: false
|
|
||||||
|
|
||||||
listeners:
|
|
||||||
- port: 8008
|
|
||||||
type: http
|
|
||||||
tls: false
|
|
||||||
resources:
|
|
||||||
- names: [client, federation]
|
|
||||||
compress: true
|
|
||||||
|
|
||||||
database:
|
|
||||||
name: psycopg2
|
|
||||||
args:
|
|
||||||
user: "{{ db_user }}"
|
|
||||||
password: "{{ db_pass }}"
|
|
||||||
database: "{{ db_name }}"
|
|
||||||
host: "localhost"
|
|
||||||
port: 5432
|
|
||||||
|
|
||||||
registration_shared_secret: "{{ synapse_registration_secret }}"
|
|
||||||
tls_certificate_path: "/data/tls.crt"
|
|
||||||
private_key_path: "/data/tls.key"
|
|
||||||
|
|
||||||
federation_domain_whitelist:
|
|
||||||
- matrix.org
|
|
||||||
- gitter.im
|
|
||||||
|
|
||||||
# Optional: Rate limits
|
|
||||||
rc_flood_control:
|
|
||||||
interval: 1000
|
|
||||||
burst_count: 3
|
|
||||||
|
|
||||||
# Enable password login
|
|
||||||
enable_registration: true
|
|
||||||
enable_registration_without_verification: true
|
|
||||||
@@ -1,104 +0,0 @@
|
|||||||
- name: Ensure web root exists (for ACME)
|
|
||||||
file:
|
|
||||||
path: "/var/www/{{ matrix_domain }}"
|
|
||||||
state: directory
|
|
||||||
mode: '0755'
|
|
||||||
|
|
||||||
- name: Copy compiled site to host (for volume mount)
|
|
||||||
copy:
|
|
||||||
src: "files/mysite/"
|
|
||||||
dest: "{{ nginx_webroot }}/mysite/"
|
|
||||||
mode: '0644'
|
|
||||||
vars:
|
|
||||||
nginx_webroot: "/var/lib/matrix-nginx"
|
|
||||||
|
|
||||||
- name: Ensure nginx data dir exists
|
|
||||||
file:
|
|
||||||
path: "{{ item }}"
|
|
||||||
state: directory
|
|
||||||
mode: '0755'
|
|
||||||
loop:
|
|
||||||
- "/var/lib/matrix-nginx"
|
|
||||||
- "/var/lib/matrix-nginx/certbot"
|
|
||||||
|
|
||||||
- name: Create custom Nginx image (if missing)
|
|
||||||
command: >
|
|
||||||
podman build
|
|
||||||
-f "{{ role_path }}/templates/Dockerfile-nginx-certbot.j2"
|
|
||||||
-t nginx-matrix:latest
|
|
||||||
"{{ role_path }}/templates/"
|
|
||||||
args:
|
|
||||||
creates: /var/lib/containers/storage/overlay-images/... # (use container_exists check instead)
|
|
||||||
register: build_result
|
|
||||||
changed_when: false
|
|
||||||
|
|
||||||
- name: Create Podman pod
|
|
||||||
command: >
|
|
||||||
podman pod create
|
|
||||||
--name {{ podman_pod_name }}
|
|
||||||
--publish 80:80
|
|
||||||
--publish 443:443
|
|
||||||
--publish 8008:8008
|
|
||||||
--publish 8448:8448
|
|
||||||
changed_when: false
|
|
||||||
|
|
||||||
- name: Run Nginx container (with TLS & site)
|
|
||||||
container:
|
|
||||||
name: nginx-matrix
|
|
||||||
image: nginx-matrix:latest
|
|
||||||
state: started
|
|
||||||
restart_policy: unless-stopped
|
|
||||||
pod: "{{ podman_pod_name }}"
|
|
||||||
volumes:
|
|
||||||
- "/var/lib/matrix-nginx/mysite:/usr/share/nginx/html/mysite:ro"
|
|
||||||
- "/var/lib/matrix-nginx/certbot:/etc/letsencrypt"
|
|
||||||
env:
|
|
||||||
NGINX_HOST: "{{ matrix_domain }}"
|
|
||||||
security_opt:
|
|
||||||
- label: disable # if rootless: disable SELinux
|
|
||||||
register: nginx_cont
|
|
||||||
|
|
||||||
- name: Run Synapse (PostgreSQL & all)
|
|
||||||
# ... (existing synapse task from before)
|
|
||||||
|
|
||||||
- name: Install Nginx
|
|
||||||
package:
|
|
||||||
name: nginx
|
|
||||||
state: present
|
|
||||||
|
|
||||||
- name: Create web root for landing page
|
|
||||||
file:
|
|
||||||
path: "{{ nginx_webroot }}"
|
|
||||||
state: directory
|
|
||||||
mode: '0755'
|
|
||||||
|
|
||||||
- name: Deploy landing page HTML
|
|
||||||
copy:
|
|
||||||
content: |
|
|
||||||
<!DOCTYPE html>
|
|
||||||
<html>
|
|
||||||
<head><title>Welcome</title></head>
|
|
||||||
<body>
|
|
||||||
<h1>Welcome to Matrix!</h1>
|
|
||||||
<p>Visit <a href="/_matrix">Matrix</a></p>
|
|
||||||
</body>
|
|
||||||
</html>
|
|
||||||
dest: "{{ nginx_webroot }}/index.html"
|
|
||||||
mode: '0644'
|
|
||||||
|
|
||||||
- name: Deploy Nginx config
|
|
||||||
template:
|
|
||||||
src: nginx/default.conf.j2
|
|
||||||
dest: "/etc/nginx/conf.d/{{ matrix_domain }}.conf"
|
|
||||||
mode: '0644'
|
|
||||||
|
|
||||||
- name: Remove default config (optional)
|
|
||||||
file:
|
|
||||||
path: "/etc/nginx/conf.d/default.conf"
|
|
||||||
state: absent
|
|
||||||
|
|
||||||
- name: Restart & enable Nginx
|
|
||||||
service:
|
|
||||||
name: nginx
|
|
||||||
state: restarted
|
|
||||||
enabled: yes
|
|
||||||
@@ -1,11 +0,0 @@
|
|||||||
FROM nginx:1.25-alpine
|
|
||||||
|
|
||||||
# Install Certbot (Python-based)
|
|
||||||
RUN apk add --no-cache certbot python3 py3-pip
|
|
||||||
|
|
||||||
# Add entrypoint script to auto-renew certs (optional)
|
|
||||||
COPY certbot-entrypoint.sh /usr/local/bin/certbot-entrypoint.sh
|
|
||||||
RUN chmod +x /usr/local/bin/certbot-entrypoint.sh
|
|
||||||
|
|
||||||
ENTRYPOINT ["/usr/local/bin/certbot-entrypoint.sh"]
|
|
||||||
CMD ["nginx", "-g", "daemon off;"]
|
|
||||||
@@ -1,23 +0,0 @@
|
|||||||
#!/bin/sh
|
|
||||||
set -e
|
|
||||||
|
|
||||||
# Generate cert if not exists (first-run)
|
|
||||||
if [ ! -d "/etc/letsencrypt/live/{{ matrix_domain }}" ]; then
|
|
||||||
echo "Requesting initial Let's Encrypt certificate..."
|
|
||||||
certbot certonly --standalone \
|
|
||||||
--non-interactive --agree-tos --email admin@{{ matrix_domain }} \
|
|
||||||
-d {{ matrix_domain }} \
|
|
||||||
--domain {{ matrix_domain }} \
|
|
||||||
--preferred-challenges http \
|
|
||||||
--http-01-port 8080 \
|
|
||||||
--server https://acme-v02.api.letsencrypt.org/directory || true
|
|
||||||
|
|
||||||
# For staging (dev): use --server https://acme-staging-v02.api.letsencrypt.org/directory
|
|
||||||
fi
|
|
||||||
|
|
||||||
# Try to renew (non-blocking)
|
|
||||||
echo "Attempting certificate renewal..."
|
|
||||||
certbot renew --dry-run --quiet || true
|
|
||||||
|
|
||||||
# Start Nginx (certs will be loaded if they exist)
|
|
||||||
exec "$@"
|
|
||||||
@@ -1,60 +0,0 @@
|
|||||||
# Redirect HTTP → HTTPS (except ACME challenges)
|
|
||||||
server {
|
|
||||||
listen 80;
|
|
||||||
server_name {{ matrix_domain }} {{ landing_domain }};
|
|
||||||
|
|
||||||
# ACME-challenge (for Let's Encrypt)
|
|
||||||
location ~ /.well-known/acme-challenge/ {
|
|
||||||
root /var/www;
|
|
||||||
try_files $uri =404;
|
|
||||||
}
|
|
||||||
|
|
||||||
location / {
|
|
||||||
return 301 https://$host$request_uri;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
# HTTPS server
|
|
||||||
server {
|
|
||||||
listen 443 ssl http2;
|
|
||||||
server_name {{ matrix_domain }};
|
|
||||||
|
|
||||||
# TLS certs (mounted from Let's Encrypt dir)
|
|
||||||
ssl_certificate /etc/letsencrypt/live/{{ matrix_domain }}/fullchain.pem;
|
|
||||||
ssl_certificate_key /etc/letsencrypt/live/{{ matrix_domain }}/privkey.pem;
|
|
||||||
ssl_trusted_certificate /etc/letsencrypt/live/{{ matrix_domain }}/chain.pem;
|
|
||||||
|
|
||||||
ssl_session_cache shared:SSL:10m;
|
|
||||||
ssl_protocols TLSv1.2 TLSv1.3;
|
|
||||||
ssl_ciphers HIGH:!aNULL:!MD5;
|
|
||||||
|
|
||||||
# Serve static site (root)
|
|
||||||
location / {
|
|
||||||
root /usr/share/nginx/html/mysite;
|
|
||||||
try_files $uri $uri/ /index.html;
|
|
||||||
}
|
|
||||||
|
|
||||||
# Matrix Synapse (client)
|
|
||||||
location /_matrix/ {
|
|
||||||
proxy_pass http://127.0.0.1:8008/_matrix/;
|
|
||||||
proxy_set_header Host $host;
|
|
||||||
proxy_set_header X-Real-IP $remote_addr;
|
|
||||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
||||||
proxy_set_header X-Forwarded-Proto $scheme;
|
|
||||||
proxy_buffering off;
|
|
||||||
}
|
|
||||||
|
|
||||||
# Federation
|
|
||||||
location /_matrix/federation/v1/ {
|
|
||||||
proxy_pass http://127.0.0.1:8448/_matrix/federation/v1/;
|
|
||||||
proxy_set_header Host $host;
|
|
||||||
proxy_set_header X-Real-IP $remote_addr;
|
|
||||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
||||||
proxy_set_header X-Forwarded-Proto $scheme;
|
|
||||||
}
|
|
||||||
|
|
||||||
# Optional: Add a Matrix admin link
|
|
||||||
location /admin {
|
|
||||||
return 301 https://matrix-admin.example.com; # or proxy to a UI like SynapseAdmin
|
|
||||||
}
|
|
||||||
}
|
|
||||||
31
templates/homeserver.yaml.j2
Normal file
31
templates/homeserver.yaml.j2
Normal file
@@ -0,0 +1,31 @@
|
|||||||
|
server_name: "{{ matrix_domain }}"
|
||||||
|
|
||||||
|
listeners:
|
||||||
|
- port: {{ synapse_http_port }}
|
||||||
|
bind_addresses: ['0.0.0.0']
|
||||||
|
type: http
|
||||||
|
tls: false
|
||||||
|
x_forwarded: true
|
||||||
|
resources:
|
||||||
|
- names: [client, federation]
|
||||||
|
compress: true
|
||||||
|
|
||||||
|
# -------------------------------------------------
|
||||||
|
# TURN (WebRTC) – injected from the variables above
|
||||||
|
# -------------------------------------------------
|
||||||
|
turn_uris:
|
||||||
|
- "turn:{{ matrix_domain }}:{{ turn_listen_port }}?transport=udp"
|
||||||
|
- "turn:{{ matrix_domain }}:{{ turn_tls_port }}?transport=tcp"
|
||||||
|
- "turns:{{ matrix_domain }}:{{ turn_tls_port }}?transport=tcp"
|
||||||
|
turn_shared_secret: "{{ turn_secret }}"
|
||||||
|
turn_user_lifetime: "86400000" # 1 day in ms (optional)
|
||||||
|
|
||||||
|
# -----------------------------------------------------------------
|
||||||
|
# NEW – Google OIDC provider
|
||||||
|
# -----------------------------------------------------------------
|
||||||
|
oidc_providers:
|
||||||
|
- idp_id: google
|
||||||
|
issuer: "https://accounts.google.com"
|
||||||
|
client_id: "{{ google_oidc_client_id }}"
|
||||||
|
client_secret: "{{ google_oidc_client_secret }}"
|
||||||
|
scopes: {{ google_oidc_scopes | to_nice_yaml | indent(6) }}
|
||||||
26
templates/landing.html.j2
Normal file
26
templates/landing.html.j2
Normal file
@@ -0,0 +1,26 @@
|
|||||||
|
<!DOCTYPE html>
|
||||||
|
<html lang="en">
|
||||||
|
<head>
|
||||||
|
<meta charset="UTF-8">
|
||||||
|
<title>{{ landing_title }}</title>
|
||||||
|
<style>
|
||||||
|
body { font-family: Arial, Helvetica, sans-serif; text-align: center; margin-top: 5rem; }
|
||||||
|
h1 { font-size: 2.2rem; }
|
||||||
|
p { font-size: 1.1rem; line-height: 1.5; max-width: 600px; margin: 0 auto; }
|
||||||
|
a { color: #0066cc; }
|
||||||
|
</style>
|
||||||
|
</head>
|
||||||
|
<body>
|
||||||
|
<h1>{{ landing_title }}</h1>
|
||||||
|
|
||||||
|
<p>{{ landing_tagline }}</p>
|
||||||
|
|
||||||
|
<p>
|
||||||
|
{{ landing_message | replace('\n','<br>') }}
|
||||||
|
</p>
|
||||||
|
|
||||||
|
<p>
|
||||||
|
<a href="https://{{ matrix_domain }}">Go to Matrix login page →</a>
|
||||||
|
</p>
|
||||||
|
</body>
|
||||||
|
</html>
|
||||||
40
templates/traefik_dynamic.yml.j2
Normal file
40
templates/traefik_dynamic.yml.j2
Normal file
@@ -0,0 +1,40 @@
|
|||||||
|
http:
|
||||||
|
routers:
|
||||||
|
synapse:
|
||||||
|
entryPoints:
|
||||||
|
- websecure
|
||||||
|
rule: "Host(`{{ matrix_domain }}`)"
|
||||||
|
service: synapse
|
||||||
|
tls:
|
||||||
|
certResolver: myresolver
|
||||||
|
landing:
|
||||||
|
entryPoints:
|
||||||
|
- websecure
|
||||||
|
rule: "Host(`{{ landing_domain }}`)"
|
||||||
|
service: landing
|
||||||
|
tls:
|
||||||
|
certResolver: myresolver
|
||||||
|
|
||||||
|
services:
|
||||||
|
synapse:
|
||||||
|
loadBalancer:
|
||||||
|
servers:
|
||||||
|
- url: "http://{{ podman_network }}:{{ synapse_http_port }}/"
|
||||||
|
landing:
|
||||||
|
loadBalancer:
|
||||||
|
servers:
|
||||||
|
- url: "http://{{ podman_network }}:8080/"
|
||||||
|
|
||||||
|
# ---------- TCP router for Teamspeak query ----------
|
||||||
|
tcp:
|
||||||
|
routers:
|
||||||
|
teamspeak:
|
||||||
|
entryPoints:
|
||||||
|
- teamspeak
|
||||||
|
rule: "HostSNI(`{{ teamspeak_domain }}`)" # optional – works like Host for TCP
|
||||||
|
service: teamspeak
|
||||||
|
services:
|
||||||
|
teamspeak:
|
||||||
|
loadBalancer:
|
||||||
|
servers:
|
||||||
|
- address: "{{ podman_network }}:{{ teamspeak_tcp_port }}"
|
||||||
23
templates/traefik_static.toml.j2
Normal file
23
templates/traefik_static.toml.j2
Normal file
@@ -0,0 +1,23 @@
|
|||||||
|
[log]
|
||||||
|
level = "INFO"
|
||||||
|
|
||||||
|
[accessLog]
|
||||||
|
|
||||||
|
[entryPoints]
|
||||||
|
[entryPoints.web]
|
||||||
|
address = ":{{ traefik_http_port }}"
|
||||||
|
[entryPoints.websecure]
|
||||||
|
address = ":{{ traefik_https_port }}"
|
||||||
|
|
||||||
|
# ---------- TCP entrypoint for Teamspeak query ----------
|
||||||
|
[entryPoints.teamspeak]
|
||||||
|
address = ":{{ teamspeak_tcp_port }}"
|
||||||
|
|
||||||
|
[providers]
|
||||||
|
[providers.file]
|
||||||
|
filename = "{{ dynamic_traefik_path }}"
|
||||||
|
watch = true
|
||||||
|
|
||||||
|
[certificatesResolvers.myresolver.acme]
|
||||||
|
email = "{{ matrix_email }}"
|
||||||
|
storage = "/etc/traefik/acme.json"
|
||||||
16
templates/turnserver.conf.j2
Normal file
16
templates/turnserver.conf.j2
Normal file
@@ -0,0 +1,16 @@
|
|||||||
|
listening-port={{ turn_listen_port }}
|
||||||
|
tls-listening-port={{ turn_tls_port }}
|
||||||
|
|
||||||
|
realm={{ matrix_domain }}
|
||||||
|
static-auth-secret={{ turn_secret }}
|
||||||
|
|
||||||
|
# If your host sits behind NAT and you need to force the public IP, uncomment:
|
||||||
|
# external-ip=YOUR_PUBLIC_IP
|
||||||
|
|
||||||
|
allowed-peer-ip=0.0.0.0/0
|
||||||
|
|
||||||
|
listening-ip=0.0.0.0
|
||||||
|
listening-ip=::0
|
||||||
|
|
||||||
|
log-file=/var/log/turnserver.log
|
||||||
|
verbose
|
||||||
82
vars/vars.yml
Normal file
82
vars/vars.yml
Normal file
@@ -0,0 +1,82 @@
|
|||||||
|
# --------------------------------------------------------------
|
||||||
|
# General
|
||||||
|
# --------------------------------------------------------------
|
||||||
|
matrix_domain: "matrix.fpov.space"
|
||||||
|
landing_domain: "org.fpov.space
|
||||||
|
teamspeak_domain: "ts.fpov.space" # <-- new
|
||||||
|
matrix_email: "boxswappers@gmail.com"
|
||||||
|
|
||||||
|
# --------------------------------------------------------------
|
||||||
|
# Ports
|
||||||
|
# --------------------------------------------------------------
|
||||||
|
traefik_http_port: 80
|
||||||
|
traefik_https_port: 443
|
||||||
|
|
||||||
|
# --- TURN -------------------------------------------------------
|
||||||
|
turn_listen_port: 3478
|
||||||
|
turn_tls_port: 5349
|
||||||
|
turn_secret: "CHANGE-ME-TO-HEX-STRING"
|
||||||
|
|
||||||
|
# --- Synapse ----------------------------------------------------
|
||||||
|
synapse_http_port: 8008
|
||||||
|
synapse_version: "latest"
|
||||||
|
|
||||||
|
# --- Teamspeak ---------------------------------------------------
|
||||||
|
teamspeak_image: "docker.io/teamspeak:latest"
|
||||||
|
teamspeak_container_name: teamspeak
|
||||||
|
teamspeak_udp_port: 9987 # voice (UDP) – exposed directly on the host
|
||||||
|
teamspeak_tcp_port: 10011 # query (TCP) – will be routed via Traefik
|
||||||
|
teamspeak_file_port: 30033 # file‑transfer (TCP) – optional, expose directly
|
||||||
|
|
||||||
|
# --------------------------------------------------------------
|
||||||
|
# Container images
|
||||||
|
# --------------------------------------------------------------
|
||||||
|
traefik_image: "docker.io/traefik:latest"
|
||||||
|
turn_image: "docker.io/coturn/coturn:latest"
|
||||||
|
synapse_image: "docker.io/matrixdotorg/synapse:{{ synapse_version }}"
|
||||||
|
nginx_image: "docker.io/nginx:alpine"
|
||||||
|
|
||||||
|
# --------------------------------------------------------------
|
||||||
|
# Podman names & volumes
|
||||||
|
# --------------------------------------------------------------
|
||||||
|
podman_network: matrix_net
|
||||||
|
vol_traefik: traefik_data
|
||||||
|
vol_synapse: synapse_config
|
||||||
|
vol_media: synapse_media
|
||||||
|
vol_turn: turn_data
|
||||||
|
vol_nginx: nginx_html
|
||||||
|
vol_teamspeak: teamspeak_data # <-- new volume
|
||||||
|
|
||||||
|
# --------------------------------------------------------------
|
||||||
|
# Paths on the target host (temporary files)
|
||||||
|
# --------------------------------------------------------------
|
||||||
|
static_traefik_path: "/tmp/traefik_static.toml"
|
||||||
|
dynamic_traefik_path: "/tmp/traefik_dynamic.yml"
|
||||||
|
turn_conf_path: "/tmp/turnserver.conf"
|
||||||
|
synapse_cfg_path: "/tmp/homeserver.yaml"
|
||||||
|
nginx_html_path: "/tmp/index.html"
|
||||||
|
|
||||||
|
|
||||||
|
# -----------------------------------------------------------------
|
||||||
|
# NEW – Google OAuth2 (OpenID Connect) credentials
|
||||||
|
# -----------------------------------------------------------------
|
||||||
|
google_oidc_client_id: "YOUR_GOOGLE_CLIENT_ID"
|
||||||
|
google_oidc_client_secret: "YOUR_GOOGLE_CLIENT_SECRET"
|
||||||
|
|
||||||
|
# Optional – the scopes you want to request (the default works for most cases)
|
||||||
|
google_oidc_scopes:
|
||||||
|
- openid
|
||||||
|
- email
|
||||||
|
- profile
|
||||||
|
|
||||||
|
# --------------------------------------------------------------
|
||||||
|
# Landing page HTML
|
||||||
|
# --------------------------------------------------------------
|
||||||
|
matrix_domain: "matrix.example.com"
|
||||||
|
landing_title: "Welcome to {{ matrix_domain }}" # you can embed other vars here
|
||||||
|
landing_tagline: "Matrix + Traefik + Teamspeak – all in one stack"
|
||||||
|
landing_message: |
|
||||||
|
This host runs a Matrix homeserver (Synapse), a reverse‑proxy (Traefik) with
|
||||||
|
automatic Let’s Encrypt certificates, a TURN server for voice/video, and a
|
||||||
|
simple landing page.
|
||||||
|
|
||||||
Reference in New Issue
Block a user