boxswapper/fpov
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

created potential branch

Browse Source
This commit is contained in:
boxswapper
2026-03-19 23:09:55 -06:00
parent 362309a51d
commit cc29d886f2
22 changed files with 485 additions and 521 deletions
Download Patch File Download Diff File Expand all files Collapse all files

64
README.md
View File

@@ -1,64 +0,0 @@
deploy playbook after setup
```
ansible-playbook playbook.yml --ask-vault-pass
```
Check containers
```
ssh matrix.example.com
sudo podman ps
sudo podman logs synapse
```
test federation
```
curl https://{{ matrix_domain }}/_matrix/federation/v1/version
```
## to generate config files default before deploymenta and templating ##
```
podman run -it --rm \
-v "$(pwd)":/data \
-e SYNAPSE_SERVER_NAME=my.matrix.host \
-e SYNAPSE_REPORT_STATS=yes \
docker.io/matrixdotorg/synapse:latest generate
```
| Area | Recommendation |
|------|----------------|
| **TLS** | Use Certbot + Nginx plugin (`community.general.acme` Ansible module) |
| **Secrets** | Store DB passwords, secrets in **Ansible Vault** |
| **Updates** | Use `container_image: tag` with version pins (e.g., `v1.100.0`) |
| **Monitoring** | Add Prometheus metrics (`enable_metrics: true`) |
| **Coturn** | Deploy `coturn` (STUN/TURN) as separate container if needed |
| **Backups** | Backup `/var/lib/matrix-synapse` regularly |
| **Rootless Podman** | Use `podman user` namespaces + `podman system migrate` for portability |
## Using Hugo to create site ##
```
# Create & build site locally (run ON CONTROL NODE)
hugo new site mysite
cd mysite
echo 'theme = "ananke"' >> config.toml
hugo new posts/my-first-post.md
hugo # builds to /public
cp -r public ../fpov/roles/nginx-proxy/files/mysite/
```
1. Host boots: Podman creates pod with ports 80, 443, 8008, 8448 open.
2. Nginx starts, runs certbot-entrypoint.sh:
- Checks for /etc/letsencrypt/live/matrix.example.com
- If missing → runs certbot certonly --standalone on port 8080
- Writes certs to /etc/letsencrypt
3. Nginx loads TLS certs, serves static site + proxies /_matrix/
4. User visits https://matrix.example.com → gets your Hugo site.
5. User visits https://matrix.example.com/_matrix/client → gets Synapse.
6. ACME renewal: Certbot’s renew is dry-run on each start (you can also add cron via systemd unit if needed).
Certificate renewal
```
# /etc/cron.d/certbot-renew
0 3 * * * root podman exec nginx-matrix certbot renew --quiet
```

261
deploy_matrix.yml Normal file
View File

@@ -0,0 +1,261 @@
---
- name: Deploy Matrix + TURN + Traefik + NGINX + Teamspeak
hosts: all
become: true
collections:
- containers.podman
vars_files:
- ../vars/vars.yml # ← our variable file
tasks:
# -----------------------------------------------------------------
# (unchanged) Install podman, create network, create volumes …
# -----------------------------------------------------------------
- name: Install podman package
ansible.builtin.package:
name: podman
state: present
- name: Create podman network "{{ podman_network }}"
containers.podman.podman_network:
name: "{{ podman_network }}"
driver: bridge
subnet: "10.88.0.0/16"
state: present
- name: Ensure required podman volumes exist
containers.podman.podman_volume:
name: "{{ item }}"
driver: local
state: present
loop:
- "{{ vol_traefik }}"
- "{{ vol_synapse }}"
- "{{ vol_media }}"
- "{{ vol_turn }}"
- "{{ vol_nginx }}"
- "{{ vol_teamspeak }}" # <-- new volume
# -----------------------------------------------------------------
# Render all configuration files from the templates
# -----------------------------------------------------------------
- name: Render static Traefik config
ansible.builtin.template:
src: ../templates/traefik_static.toml.j2
dest: "{{ static_traefik_path }}"
mode: "0644"
- name: Render dynamic Traefik config
ansible.builtin.template:
src: ../templates/traefik_dynamic.yml.j2
dest: "{{ dynamic_traefik_path }}"
mode: "0644"
- name: Render coturn config
ansible.builtin.template:
src: ../templates/turnserver.conf.j2
dest: "{{ turn_conf_path }}"
mode: "0644"
- name: Render Synapse homeserver.yaml
ansible.builtin.template:
src: ../templates/homeserver.yaml.j2
dest: "{{ synapse_cfg_path }}"
mode: "0644"
- name: Render landing page index.html
ansible.builtin.template:
src: ../templates/landing.html.j2 # path relative to this playbook file
dest: "{{ nginx_html_path }}" # we already defined this variable in vars.yml
mode: "0644"
# -----------------------------------------------------------------
# Start the NGINX container (unchanged – just mounts the file we created)
# -----------------------------------------------------------------
- name: Start NGINX landing‑page container
containers.podman.podman_container:
name: landing
image: "{{ nginx_image }}"
state: started
ports:
- "8080:80"
volumes:
- "{{ vol_nginx }}:/usr/share/nginx/html:ro"
- "{{ nginx_html_path }}:/usr/share/nginx/html/index.html:ro"
network: "{{ podman_network }}"
restart_policy: always
# -----------------------------------------------------------------
# Pull required images (including Teamspeak)
# -----------------------------------------------------------------
- name: Pull Traefik image
containers.podman.podman_image:
name: "{{ traefik_image }}"
state: present
- name: Pull coturn image
containers.podman.podman_image:
name: "{{ turn_image }}"
state: present
- name: Pull Synapse image
containers.podman.podman_image:
name: "{{ synapse_image }}"
state: present
- name: Pull NGINX image
containers.podman.podman_image:
name: "{{ nginx_image }}"
state: present
- name: Pull Teamspeak image
containers.podman.podman_image:
name: "{{ teamspeak_image }}"
state: present
# -----------------------------------------------------------------
# Start containers (Traefik, TURN, Synapse, NGINX – unchanged)
# -----------------------------------------------------------------
- name: Start Traefik container
containers.podman.podman_container:
name: traefik
image: "{{ traefik_image }}"
state: started
ports:
- "{{ traefik_http_port }}:{{ traefik_http_port }}"
- "{{ traefik_https_port }}:{{ traefik_https_port }}"
- "{{ teamspeak_tcp_port }}:{{ teamspeak_tcp_port }}" # expose TCP entrypoint on host
volumes:
- "{{ vol_traefik }}:/etc/traefik"
- "{{ static_traefik_path }}:{{ static_traefik_path }}:ro"
- "{{ dynamic_traefik_path }}:{{ dynamic_traefik_path }}:ro"
network: "{{ podman_network }}"
restart_policy: always
- name: Start coturn container
containers.podman.podman_container:
name: turn
image: "{{ turn_image }}"
state: started
ports:
- "{{ turn_listen_port }}:{{ turn_listen_port }}/udp"
- "{{ turn_listen_port }}:{{ turn_listen_port }}/tcp"
- "{{ turn_tls_port }}:{{ turn_tls_port }}/udp"
- "{{ turn_tls_port }}:{{ turn_tls_port }}/tcp"
volumes:
- "{{ vol_turn }}:/var/lib/turn"
- "{{ turn_conf_path }}:/etc/turnserver.conf:ro"
command: "-c /etc/turnserver.conf"
network: "{{ podman_network }}"
restart_policy: always
- name: Start Synapse container
containers.podman.podman_container:
name: synapse
image: "{{ synapse_image }}"
state: started
env:
SYNAPSE_SERVER_NAME: "{{ matrix_domain }}"
SYNAPSE_REPORT_STATS: "yes"
ports:
- "{{ synapse_http_port }}:{{ synapse_http_port }}"
volumes:
- "{{ vol_synapse }}:/data"
- "{{ vol_media }}:/data/media_store"
- "{{ synapse_cfg_path }}:/data/homeserver.yaml:ro"
network: "{{ podman_network }}"
restart_policy: always
- name: Start NGINX landing‑page container
containers.podman.podman_container:
name: landing
image: "{{ nginx_image }}"
state: started
ports:
- "8080:80"
volumes:
- "{{ vol_nginx }}:/usr/share/nginx/html:ro"
- "{{ nginx_html_path }}:/usr/share/nginx/html/index.html:ro"
network: "{{ podman_network }}"
restart_policy: always
# -----------------------------------------------------------------
# **NEW** – Start Teamspeak container
# -----------------------------------------------------------------
- name: Start Teamspeak container
containers.podman.podman_container:
name: "{{ teamspeak_container_name }}"
image: "{{ teamspeak_image }}"
state: started
ports:
# UDP voice port – exposed directly on the host (no Traefik)
- "{{ teamspeak_udp_port }}:{{ teamspeak_udp_port }}/udp"
# TCP query port – Traefik will forward it (see static config)
- "{{ teamspeak_tcp_port }}:{{ teamspeak_tcp_port }}/tcp"
# Optional file‑transfer port (exposed directly)
- "{{ teamspeak_file_port }}:{{ teamspeak_file_port }}/tcp"
volumes:
- "{{ vol_teamspeak }}:/var/ts3server"
network: "{{ podman_network }}"
restart_policy: always
# -----------------------------------------------------------------
# (optional) generate systemd units for the new container
# -----------------------------------------------------------------
- name: Generate systemd unit for Teamspeak
containers.podman.podman_generate_systemd:
name: "{{ teamspeak_container_name }}"
state: present
dest: "/etc/systemd/system/{{ teamspeak_container_name }}.service"
when: generate_systemd | bool
# -----------------------------------------------------------------
# (unchanged) systemd unit generation for the other containers
# -----------------------------------------------------------------
- name: Generate systemd unit for Traefik
containers.podman.podman_generate_systemd:
name: traefik
state: present
dest: "/etc/systemd/system/traefik.service"
when: generate_systemd | bool
- name: Generate systemd unit for TURN
containers.podman.podman_generate_systemd:
name: turn
state: present
dest: "/etc/systemd/system/turn.service"
when: generate_systemd | bool
- name: Generate systemd unit for Synapse
containers.podman.podman_generate_systemd:
name: synapse
state: present
dest: "/etc/systemd/system/synapse.service"
when: generate_systemd | bool
- name: Generate systemd unit for landing page
containers.podman.podman_generate_systemd:
name: landing
state: present
dest: "/etc/systemd/system/landing.service"
when: generate_systemd | bool
- name: Reload systemd daemon (if units were created)
ansible.builtin.systemd:
daemon_reload: yes
when: generate_systemd | bool
# -----------------------------------------------------------------
# Debug – list containers
# -----------------------------------------------------------------
- name: List running podman containers
containers.podman.podman_ps:
all: true
register: ps_out
- name: Show container list
ansible.builtin.debug:
var: ps_out.containers

25
group_vars/all.yml
View File

@@ -1,25 +0,0 @@
# Variables
matrix_domain: "matrix.example.com"
landing_domain: "example.com" # or same as matrix_domain + path-based routing
podman_user: "matrix" # set to 'root' for rootful
podman_pod_name: "matrix-pod"
synapse_data_dir: "/var/lib/matrix-synapse"
nginx_config_dir: "/etc/nginx/conf.d"
nginx_webroot: "/var/www/landing"
# Database (PostgreSQL)
db_name: "synapse"
db_user: "synapse"
db_pass: "{{ synapse_db_pass | mandatory }}"
synapse_db_pass: "supersecretpassword" # use vault for real deployments!
matrix_domain: "matrix.example.com"
landing_domain: "example.com" # optional, or use same domain + path-based routing
# For certbot
certbot_email: "admin@example.com"
# Static site path
nginx_webroot: "/var/lib/matrix-nginx"

7
inventory.ini
View File

@@ -1,7 +0,0 @@
[matrix_servers]
matrix.example.com ansible_host=203.0.113.10
[all:vars]
ansible_user=deploy
ansible_ssh_private_key_file=~/.ssh/id_rsa
podman_user=matrix # rootless user (or 'root' for rootful)

6
inventory/hosts.yml Normal file
View File

@@ -0,0 +1,6 @@
all:
hosts:
podman-host1: # <-- change to the host that will run Podman
ansible_host: 192.168.1.10 # its IP or DNS name
ansible_user: youruser # user that can sudo
ansible_become: true

19
playbook.yml
View File

@@ -1,19 +0,0 @@
- name: Deploy Matrix + Nginx + Static Site with TLS
hosts: matrix_servers
become: yes
vars:
synapse_db_pass: "{{ vault_synapse_db_pass }}"
certbot_email: "{{ vault_certbot_email | default('admin@example.com') }}"
tasks:
- name: Setup common dependencies
import_role:
name: common
- name: Deploy Nginx + Static Site + TLS (with Certbot)
import_role:
name: nginx-proxy
- name: Deploy Synapse (PostgreSQL + containers)
import_role:
name: matrix-synapse

40
references/synapse-config/homeserver.yaml
View File

@@ -1,40 +0,0 @@
# Configuration file for Synapse.
#
# This is a YAML file: see [1] for a quick introduction. Note in particular
# that *indentation is important*: all the elements of a list or dictionary
# should have the same indentation.
#
# [1] https://docs.ansible.com/ansible/latest/reference_appendices/YAMLSyntax.html
#
# For more information on how to configure Synapse, including a complete accounting of
# each option, go to docs/usage/configuration/config_documentation.md or
# https://element-hq.github.io/synapse/latest/usage/configuration/config_documentation.html
server_name: "my.matrix.host"
pid_file: /data/homeserver.pid
listeners:
- port: 8008
resources:
- compress: false
names:
- client
- federation
tls: false
type: http
x_forwarded: true
database:
name: sqlite3
args:
database: /data/homeserver.db
log_config: "/data/my.matrix.host.log.config"
media_store_path: /data/media_store
registration_shared_secret: "uC7Pv@:r=@Slvhx7Ex*An8QHXWnPRyI9+COZr_&;Kh*,~lGpql"
report_stats: true
macaroon_secret_key: "+QUdDhvNc9*@MORp9K-TjuGp1j5Ff-mUBS+pjkmAFWR0Y3#da8"
form_secret: "meZSlI7K.EI-6hmXcjzCNf2IwrThcnoVr2X0iohOV7K5a_w^Ud"
signing_key_path: "/data/my.matrix.host.signing.key"
trusted_key_servers:
- server_name: "matrix.org"
# vim:ft=yaml

39
references/synapse-config/my.matrix.host.log.config
View File

@@ -1,39 +0,0 @@
version: 1
formatters:
precise:
format: '%(asctime)s - %(name)s - %(lineno)d - %(levelname)s - %(request)s - %(message)s'
handlers:
console:
class: logging.StreamHandler
formatter: precise
loggers:
# This is just here so we can leave `loggers` in the config regardless of whether
# we configure other loggers below (avoid empty yaml dict error).
_placeholder:
level: "INFO"
synapse.storage.SQL:
# beware: increasing this to DEBUG will make synapse log sensitive
# information such as access tokens.
level: INFO
root:
level: INFO
handlers: [console]
disable_existing_loggers: false

23
roles/common/tasks/main.yml
View File

@@ -1,23 +0,0 @@
- name: Ensure Podman is installed
package:
name: podman
state: present
- name: Create matrix user (for rootless)
user:
name: "{{ podman_user }}"
shell: /bin/bash
createhome: yes
groups: wheel
when: podman_user != "root"
- name: Create data directories
file:
path: "{{ item }}"
state: directory
owner: "{{ podman_user }}"
group: "{{ podman_user }}"
mode: '0755'
loop:
- "{{ synapse_data_dir }}"
- "{{ nginx_webroot }}"

69
roles/matrix-synapse/tasks/main.yml
View File

@@ -1,69 +0,0 @@
- name: Generate signing key (if missing)
command: >
podman run --rm -v "{{ synapse_data_dir }}:/data"
ghcr.io/element-hq/synapse:latest
generate-config --server-name "{{ matrix_domain }}"
--report-stats no
-o /data/homeserver.yaml
args:
creates: "{{ synapse_data_dir }}/homeserver.yaml"
- name: Copy homeserver.yaml (configured)
template:
src: synapse/homeserver.yaml.j2
dest: "{{ synapse_data_dir }}/homeserver.yaml"
owner: "{{ podman_user }}"
group: "{{ podman_user }}"
mode: '0644'
- name: Ensure PostgreSQL database exists
become_user: postgres
community.postgresql.postgresql_db:
name: "{{ db_name }}"
state: present
delegate_to: "{{ inventory_hostname }}" # assuming DB on same host
- name: Ensure PostgreSQL user exists
become_user: postgres
community.postgresql.postgresql_user:
name: "{{ db_user }}"
password: "{{ db_pass }}"
priv: "{{ db_name }}.*:ALL"
state: present
delegate_to: "{{ inventory_hostname }}"
- name: Create Podman pod
command: >
podman pod create
--name {{ podman_pod_name }}
--publish 8008:8008 # synapse
--publish 8448:8448 # federation
when: podman_user != "root"
changed_when: false
- name: Run PostgreSQL container
container:
name: synapse-db
image: docker.io/library/postgres:15-alpine
state: started
restart_policy: unless-stopped
pod: "{{ podman_pod_name }}"
env:
POSTGRES_DB: "{{ db_name }}"
POSTGRES_USER: "{{ db_user }}"
POSTGRES_PASSWORD: "{{ db_pass }}"
volumes:
- "{{ synapse_data_dir }}/db:/var/lib/postgresql/data"
register: pg_cont
- name: Run Synapse container
container:
name: synapse
image: ghcr.io/element-hq/synapse:latest
state: started
restart_policy: unless-stopped
pod: "{{ podman_pod_name }}"
volumes:
- "{{ synapse_data_dir }}:/data"
command: >
-c /data/homeserver.yaml

37
roles/matrix-synapse/templates/homeserver.yaml.j2
View File

@@ -1,37 +0,0 @@
server_name: "{{ matrix_domain }}"
enable_metrics: false
report_stats: false
listeners:
- port: 8008
type: http
tls: false
resources:
- names: [client, federation]
compress: true
database:
name: psycopg2
args:
user: "{{ db_user }}"
password: "{{ db_pass }}"
database: "{{ db_name }}"
host: "localhost"
port: 5432
registration_shared_secret: "{{ synapse_registration_secret }}"
tls_certificate_path: "/data/tls.crt"
private_key_path: "/data/tls.key"
federation_domain_whitelist:
- matrix.org
- gitter.im
# Optional: Rate limits
rc_flood_control:
interval: 1000
burst_count: 3
# Enable password login
enable_registration: true
enable_registration_without_verification: true

0
roles/nginx-proxy/files/mysite/index.html
View File

104
roles/nginx-proxy/tasks/main.yml
View File

@@ -1,104 +0,0 @@
- name: Ensure web root exists (for ACME)
file:
path: "/var/www/{{ matrix_domain }}"
state: directory
mode: '0755'
- name: Copy compiled site to host (for volume mount)
copy:
src: "files/mysite/"
dest: "{{ nginx_webroot }}/mysite/"
mode: '0644'
vars:
nginx_webroot: "/var/lib/matrix-nginx"
- name: Ensure nginx data dir exists
file:
path: "{{ item }}"
state: directory
mode: '0755'
loop:
- "/var/lib/matrix-nginx"
- "/var/lib/matrix-nginx/certbot"
- name: Create custom Nginx image (if missing)
command: >
podman build
-f "{{ role_path }}/templates/Dockerfile-nginx-certbot.j2"
-t nginx-matrix:latest
"{{ role_path }}/templates/"
args:
creates: /var/lib/containers/storage/overlay-images/... # (use container_exists check instead)
register: build_result
changed_when: false
- name: Create Podman pod
command: >
podman pod create
--name {{ podman_pod_name }}
--publish 80:80
--publish 443:443
--publish 8008:8008
--publish 8448:8448
changed_when: false
- name: Run Nginx container (with TLS & site)
container:
name: nginx-matrix
image: nginx-matrix:latest
state: started
restart_policy: unless-stopped
pod: "{{ podman_pod_name }}"
volumes:
- "/var/lib/matrix-nginx/mysite:/usr/share/nginx/html/mysite:ro"
- "/var/lib/matrix-nginx/certbot:/etc/letsencrypt"
env:
NGINX_HOST: "{{ matrix_domain }}"
security_opt:
- label: disable # if rootless: disable SELinux
register: nginx_cont
- name: Run Synapse (PostgreSQL & all)
# ... (existing synapse task from before)
- name: Install Nginx
package:
name: nginx
state: present
- name: Create web root for landing page
file:
path: "{{ nginx_webroot }}"
state: directory
mode: '0755'
- name: Deploy landing page HTML
copy:
content: |
<!DOCTYPE html>
<html>
<head><title>Welcome</title></head>
<body>
<h1>Welcome to Matrix!</h1>
<p>Visit <a href="/_matrix">Matrix</a></p>
</body>
</html>
dest: "{{ nginx_webroot }}/index.html"
mode: '0644'
- name: Deploy Nginx config
template:
src: nginx/default.conf.j2
dest: "/etc/nginx/conf.d/{{ matrix_domain }}.conf"
mode: '0644'
- name: Remove default config (optional)
file:
path: "/etc/nginx/conf.d/default.conf"
state: absent
- name: Restart & enable Nginx
service:
name: nginx
state: restarted
enabled: yes

11
roles/nginx-proxy/templates/Dockerfile-nginx-certbot.j2
View File

@@ -1,11 +0,0 @@
FROM nginx:1.25-alpine
# Install Certbot (Python-based)
RUN apk add --no-cache certbot python3 py3-pip
# Add entrypoint script to auto-renew certs (optional)
COPY certbot-entrypoint.sh /usr/local/bin/certbot-entrypoint.sh
RUN chmod +x /usr/local/bin/certbot-entrypoint.sh
ENTRYPOINT ["/usr/local/bin/certbot-entrypoint.sh"]
CMD ["nginx", "-g", "daemon off;"]

23
roles/nginx-proxy/templates/certbot-entrypoint.sh
View File

@@ -1,23 +0,0 @@
#!/bin/sh
set -e
# Generate cert if not exists (first-run)
if [ ! -d "/etc/letsencrypt/live/{{ matrix_domain }}" ]; then
echo "Requesting initial Let's Encrypt certificate..."
certbot certonly --standalone \
--non-interactive --agree-tos --email admin@{{ matrix_domain }} \
-d {{ matrix_domain }} \
--domain {{ matrix_domain }} \
--preferred-challenges http \
--http-01-port 8080 \
--server https://acme-v02.api.letsencrypt.org/directory || true
# For staging (dev): use --server https://acme-staging-v02.api.letsencrypt.org/directory
fi
# Try to renew (non-blocking)
echo "Attempting certificate renewal..."
certbot renew --dry-run --quiet || true
# Start Nginx (certs will be loaded if they exist)
exec "$@"

60
roles/nginx-proxy/templates/default.conf.j2
View File

@@ -1,60 +0,0 @@
# Redirect HTTP → HTTPS (except ACME challenges)
server {
listen 80;
server_name {{ matrix_domain }} {{ landing_domain }};
# ACME-challenge (for Let's Encrypt)
location ~ /.well-known/acme-challenge/ {
root /var/www;
try_files $uri =404;
}
location / {
return 301 https://$host$request_uri;
}
}
# HTTPS server
server {
listen 443 ssl http2;
server_name {{ matrix_domain }};
# TLS certs (mounted from Let's Encrypt dir)
ssl_certificate /etc/letsencrypt/live/{{ matrix_domain }}/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/{{ matrix_domain }}/privkey.pem;
ssl_trusted_certificate /etc/letsencrypt/live/{{ matrix_domain }}/chain.pem;
ssl_session_cache shared:SSL:10m;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers HIGH:!aNULL:!MD5;
# Serve static site (root)
location / {
root /usr/share/nginx/html/mysite;
try_files $uri $uri/ /index.html;
}
# Matrix Synapse (client)
location /_matrix/ {
proxy_pass http://127.0.0.1:8008/_matrix/;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_buffering off;
}
# Federation
location /_matrix/federation/v1/ {
proxy_pass http://127.0.0.1:8448/_matrix/federation/v1/;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
# Optional: Add a Matrix admin link
location /admin {
return 301 https://matrix-admin.example.com; # or proxy to a UI like SynapseAdmin
}
}

31
templates/homeserver.yaml.j2 Normal file
View File

@@ -0,0 +1,31 @@
server_name: "{{ matrix_domain }}"
listeners:
- port: {{ synapse_http_port }}
bind_addresses: ['0.0.0.0']
type: http
tls: false
x_forwarded: true
resources:
- names: [client, federation]
compress: true
# -------------------------------------------------
# TURN (WebRTC) – injected from the variables above
# -------------------------------------------------
turn_uris:
- "turn:{{ matrix_domain }}:{{ turn_listen_port }}?transport=udp"
- "turn:{{ matrix_domain }}:{{ turn_tls_port }}?transport=tcp"
- "turns:{{ matrix_domain }}:{{ turn_tls_port }}?transport=tcp"
turn_shared_secret: "{{ turn_secret }}"
turn_user_lifetime: "86400000" # 1 day in ms (optional)
# -----------------------------------------------------------------
# NEW – Google OIDC provider
# -----------------------------------------------------------------
oidc_providers:
- idp_id: google
issuer: "https://accounts.google.com"
client_id: "{{ google_oidc_client_id }}"
client_secret: "{{ google_oidc_client_secret }}"
scopes: {{ google_oidc_scopes | to_nice_yaml | indent(6) }}

26
templates/landing.html.j2 Normal file
View File

@@ -0,0 +1,26 @@
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<title>{{ landing_title }}</title>
<style>
body { font-family: Arial, Helvetica, sans-serif; text-align: center; margin-top: 5rem; }
h1 { font-size: 2.2rem; }
p { font-size: 1.1rem; line-height: 1.5; max-width: 600px; margin: 0 auto; }
a { color: #0066cc; }
</style>
</head>
<body>
<h1>{{ landing_title }}</h1>
<p>{{ landing_tagline }}</p>
<p>
{{ landing_message | replace('\n','<br>') }}
</p>
<p>
<a href="https://{{ matrix_domain }}">Go to Matrix login page →</a>
</p>
</body>
</html>

40
templates/traefik_dynamic.yml.j2 Normal file
View File

@@ -0,0 +1,40 @@
http:
routers:
synapse:
entryPoints:
- websecure
rule: "Host(`{{ matrix_domain }}`)"
service: synapse
tls:
certResolver: myresolver
landing:
entryPoints:
- websecure
rule: "Host(`{{ landing_domain }}`)"
service: landing
tls:
certResolver: myresolver
services:
synapse:
loadBalancer:
servers:
- url: "http://{{ podman_network }}:{{ synapse_http_port }}/"
landing:
loadBalancer:
servers:
- url: "http://{{ podman_network }}:8080/"
# ---------- TCP router for Teamspeak query ----------
tcp:
routers:
teamspeak:
entryPoints:
- teamspeak
rule: "HostSNI(`{{ teamspeak_domain }}`)" # optional – works like Host for TCP
service: teamspeak
services:
teamspeak:
loadBalancer:
servers:
- address: "{{ podman_network }}:{{ teamspeak_tcp_port }}"

23
templates/traefik_static.toml.j2 Normal file
View File

@@ -0,0 +1,23 @@
[log]
level = "INFO"
[accessLog]
[entryPoints]
[entryPoints.web]
address = ":{{ traefik_http_port }}"
[entryPoints.websecure]
address = ":{{ traefik_https_port }}"
# ---------- TCP entrypoint for Teamspeak query ----------
[entryPoints.teamspeak]
address = ":{{ teamspeak_tcp_port }}"
[providers]
[providers.file]
filename = "{{ dynamic_traefik_path }}"
watch = true
[certificatesResolvers.myresolver.acme]
email = "{{ matrix_email }}"
storage = "/etc/traefik/acme.json"

16
templates/turnserver.conf.j2 Normal file
View File

@@ -0,0 +1,16 @@
listening-port={{ turn_listen_port }}
tls-listening-port={{ turn_tls_port }}
realm={{ matrix_domain }}
static-auth-secret={{ turn_secret }}
# If your host sits behind NAT and you need to force the public IP, uncomment:
# external-ip=YOUR_PUBLIC_IP
allowed-peer-ip=0.0.0.0/0
listening-ip=0.0.0.0
listening-ip=::0
log-file=/var/log/turnserver.log
verbose

82
vars/vars.yml Normal file
View File

@@ -0,0 +1,82 @@
# --------------------------------------------------------------
# General
# --------------------------------------------------------------
matrix_domain: "matrix.fpov.space"
landing_domain: "org.fpov.space
teamspeak_domain: "ts.fpov.space" # <-- new
matrix_email: "boxswappers@gmail.com"
# --------------------------------------------------------------
# Ports
# --------------------------------------------------------------
traefik_http_port: 80
traefik_https_port: 443
# --- TURN -------------------------------------------------------
turn_listen_port: 3478
turn_tls_port: 5349
turn_secret: "CHANGE-ME-TO-HEX-STRING"
# --- Synapse ----------------------------------------------------
synapse_http_port: 8008
synapse_version: "latest"
# --- Teamspeak ---------------------------------------------------
teamspeak_image: "docker.io/teamspeak:latest"
teamspeak_container_name: teamspeak
teamspeak_udp_port: 9987 # voice (UDP) – exposed directly on the host
teamspeak_tcp_port: 10011 # query (TCP) – will be routed via Traefik
teamspeak_file_port: 30033 # file‑transfer (TCP) – optional, expose directly
# --------------------------------------------------------------
# Container images
# --------------------------------------------------------------
traefik_image: "docker.io/traefik:latest"
turn_image: "docker.io/coturn/coturn:latest"
synapse_image: "docker.io/matrixdotorg/synapse:{{ synapse_version }}"
nginx_image: "docker.io/nginx:alpine"
# --------------------------------------------------------------
# Podman names & volumes
# --------------------------------------------------------------
podman_network: matrix_net
vol_traefik: traefik_data
vol_synapse: synapse_config
vol_media: synapse_media
vol_turn: turn_data
vol_nginx: nginx_html
vol_teamspeak: teamspeak_data # <-- new volume
# --------------------------------------------------------------
# Paths on the target host (temporary files)
# --------------------------------------------------------------
static_traefik_path: "/tmp/traefik_static.toml"
dynamic_traefik_path: "/tmp/traefik_dynamic.yml"
turn_conf_path: "/tmp/turnserver.conf"
synapse_cfg_path: "/tmp/homeserver.yaml"
nginx_html_path: "/tmp/index.html"
# -----------------------------------------------------------------
# NEW – Google OAuth2 (OpenID Connect) credentials
# -----------------------------------------------------------------
google_oidc_client_id: "YOUR_GOOGLE_CLIENT_ID"
google_oidc_client_secret: "YOUR_GOOGLE_CLIENT_SECRET"
# Optional – the scopes you want to request (the default works for most cases)
google_oidc_scopes:
- openid
- email
- profile
# --------------------------------------------------------------
# Landing page HTML
# --------------------------------------------------------------
matrix_domain: "matrix.example.com"
landing_title: "Welcome to {{ matrix_domain }}" # you can embed other vars here
landing_tagline: "Matrix + Traefik + Teamspeak – all in one stack"
landing_message: |
This host runs a Matrix homeserver (Synapse), a reverse‑proxy (Traefik) with
automatic Let’s Encrypt certificates, a TURN server for voice/video, and a
simple landing page.