updated to allow voice chat

.gitignore

@@ -1 +1,2 @@
 vault_pw
+*.key

README.md

@@ -15,7 +15,14 @@ test federation
 curl https://{{ matrix_domain }}/_matrix/federation/v1/version
 ```
 
-
+## to generate config files default before deploymenta and templating ##
+```
+podman run -it --rm \
+  -v "$(pwd)":/data \
+  -e SYNAPSE_SERVER_NAME=my.matrix.host \
+  -e SYNAPSE_REPORT_STATS=yes \
+  docker.io/matrixdotorg/synapse:latest generate
+```
 
 
 | Area | Recommendation |

group_vars/all.yml

@@ -1,42 +1,31 @@
-$ANSIBLE_VAULT;1.1;AES256
+# Variables
-64353034326537373762336464383964336133663564333362623733636134633235353362613430
+matrix_domain: "matrix.example.com"
-6639396262306130393035643463333166333437613832310a323130306134366634326365373962
+landing_domain: "example.com"  # or same as matrix_domain + path-based routing
-61663763363964623437633134616365646166303036613863326330333533313230613364653638
+podman_user: "matrix"          # set to 'root' for rootful
-6230303436346137390a313635633366363637636135373736353337613639313538666230393530
+podman_pod_name: "matrix-pod"
-33306661653632666439633566326564623962653063646366366638643235613738346635346263
+
-31616566666563643866656364373731326238393863663737666435366663633332336436663563
+synapse_data_dir: "/var/lib/matrix-synapse"
-30336337306562613133346163363539613034373033613834353962656539336131646232383134
+nginx_config_dir: "/etc/nginx/conf.d"
-64653735613332643437613733343032356261386266636337353534306264663031613730383331
+nginx_webroot: "/var/www/landing"
-63323631383830363034633238396131626636373163636266326632306230616430343038643039
+
-36663532356436386335386537353739393335343661366366656364656538313866666139383832
+# Database (PostgreSQL)
-39363933623836353265316536653036626165333436653534323531363734393065346563383264
+db_name: "synapse"
-32313336313361653337393437326430393465303632326332653735383264646165316238656235
+db_user: "synapse"
-39313966663934626337303932303366353365663865393764613132306634653830373936326466
+db_pass: "{{ synapse_db_pass | mandatory }}"
-34376431656165323838663137363730303833646330653165623238393061653763363636626265
+synapse_db_pass: "supersecretpassword"  # use vault for real deployments!
-61333036646663663564333762333535383132396137626639393135343765323165346432343531
+
-62366132643931643239316633643738363166623030613938326134326235323634656266323234
+
-39666632303730393161373935383066613834376237323162653833363039333761656232633731
+matrix_domain: "matrix.example.com"
-37366161373931306166636532363362646634306336666135353066353632643138656339343739
+landing_domain: "example.com"  # optional, or use same domain + path-based routing
-31343966626237343665353963616632396433323138666662323166663337323037343233323539
+
-62653630376331393532313435356664626639393461356138303833656631613536653338316661
+# For certbot
-61383938636339343332376463663334343436303334346230663964613734653763343563633163
+certbot_email: "admin@example.com"
-64303764353766643635303637353661626462393933336361653463333739613562343131653032
+
-39303561633534323537323261323466393437316164366332363832313131376165363234633930
+# Static site path
-63373463326132303366303861623630343735633835623437303832653763396538313962396237
+nginx_webroot: "/var/lib/matrix-nginx"
-66626165323132633963333137363466613364323031356362393331636661353130313539313831
+
-66346536323764646464376631353931343034366566373363363532646166303562343131306638
+coturn_shared_secret: "{{ 'your-secret-key' | password_hash('sha512', 'salt') }}"
-66383064363964613962646630303634633537623763656336373939376533623637353364626433
+# Or generate randomly:
-38643162386562643566376133646239386462633931626236613635396662663239633461343061
+# coturn_shared_secret: "{{ 24 | random_string | password_hash('sha512') }}"
-65626236633238613663303831653133656664653466346564346535336532336130626662356532
+coturn_username: "matrix-turn"
-35393134653131363262613038303332303838323332326232623639653937613935356536343231
+coturn_password: "{{ vault_coturn_password }}"
-32383131353530633735393730366665386661336139383830653836353239626330633461656132
-65663765303863313733313834393762643537636464356534613263353061333166636434393566
-34656465323335376231373835613566353461663232353138313566653736633631313130653161
-35366230326263626633343031373362623331363735313861356462333765613765363363646230
-38353265396331616666626639396538383261313132363765613332613137653737303562633237
-33306265333732623161356435626432313136626439333861333234373739306331306330626138
-62353861643539323737376561633664383964653533353939303761313036623464356463383931
-31356365626537303061306438626231656665613931386531343439343436646463393632646262
-63356136336437383436346135333435663637336434356232633061656231633336303165393964
-37383063613936396135303835313235666239626530653833343835663763333536323934323065
-36393437313662666134376333303134613035643264643334356136343633336639

references/synapse-config/homeserver.yaml

@@ -0,0 +1,40 @@
+# Configuration file for Synapse.
+#
+# This is a YAML file: see [1] for a quick introduction. Note in particular
+# that *indentation is important*: all the elements of a list or dictionary
+# should have the same indentation.
+#
+# [1] https://docs.ansible.com/ansible/latest/reference_appendices/YAMLSyntax.html
+#
+# For more information on how to configure Synapse, including a complete accounting of
+# each option, go to docs/usage/configuration/config_documentation.md or
+# https://element-hq.github.io/synapse/latest/usage/configuration/config_documentation.html
+server_name: "my.matrix.host"
+pid_file: /data/homeserver.pid
+listeners:
+  - port: 8008
+    resources:
+    - compress: false
+      names:
+      - client
+      - federation
+    tls: false
+    type: http
+    x_forwarded: true
+database:
+  name: sqlite3
+  args:
+    database: /data/homeserver.db
+log_config: "/data/my.matrix.host.log.config"
+media_store_path: /data/media_store
+registration_shared_secret: "uC7Pv@:r=@Slvhx7Ex*An8QHXWnPRyI9+COZr_&;Kh*,~lGpql"
+report_stats: true
+macaroon_secret_key: "+QUdDhvNc9*@MORp9K-TjuGp1j5Ff-mUBS+pjkmAFWR0Y3#da8"
+form_secret: "meZSlI7K.EI-6hmXcjzCNf2IwrThcnoVr2X0iohOV7K5a_w^Ud"
+signing_key_path: "/data/my.matrix.host.signing.key"
+trusted_key_servers:
+  - server_name: "matrix.org"
+
+
+# vim:ft=yaml
+

references/synapse-config/my.matrix.host.log.config

@@ -0,0 +1,39 @@
+version: 1
+
+formatters:
+  precise:
+    
+    format: '%(asctime)s - %(name)s - %(lineno)d - %(levelname)s - %(request)s - %(message)s'
+    
+
+handlers:
+
+
+  console:
+    class: logging.StreamHandler
+    formatter: precise
+
+loggers:
+    # This is just here so we can leave `loggers` in the config regardless of whether
+    # we configure other loggers below (avoid empty yaml dict error).
+    _placeholder:
+        level: "INFO"
+
+    
+    
+    synapse.storage.SQL:
+        # beware: increasing this to DEBUG will make synapse log sensitive
+        # information such as access tokens.
+        level: INFO
+    
+
+    
+
+root:
+    level: INFO
+
+
+    handlers: [console]
+
+
+disable_existing_loggers: false

roles/common/tasks/main.yml

@@ -21,3 +21,10 @@
   loop:
     - "{{ synapse_data_dir }}"
     - "{{ nginx_webroot }}"
+
+# roles/matrix-synapse/tasks/main.yml
+- name: Restart Synapse to reload TURN config
+  container:
+    name: synapse
+    state: started
+    restart: yes

roles/matrix-synapse/tasks/main.yml

@@ -67,3 +67,28 @@
       - "{{ synapse_data_dir }}:/data"
     command: >
       -c /data/homeserver.yaml
+#----- Coturn + Synapse 
+- name: Run Coturn container (STUN/TURN server)
+  container:
+    name: coturn
+    image: coturn/coturn:latest
+    state: started
+    restart_policy: unless-stopped
+    pod: "{{ podman_pod_name }}"
+    env:
+      LISTENING_PORT: "3478"
+      ALTERNATE_LISTENING_PORT: "5349"
+      RELAY_ADDRESS: "{{ ansible_default_ipv4.address }}"  # or your server IP
+      EXTERNAL_IP: "{{ ansible_default_ipv4.address }}"
+      # Shared secret for dynamic credentials
+      TURNSERVER_STATIC_AUTH_SECRET: "{{ coturn_shared_secret }}"
+      # Enable TLS
+      TURNSERVER_TLS_LISTENING_PORT: "5349"
+      TURNSERVER_CERT: "/etc/turnserver/tls.crt"
+      TURNSERVER_PKEY: "/etc/turnserver/tls.key"
+      NO_AUTH_TIMESTAMPS: "true"
+      REALM: "{{ matrix_domain }}"
+    # Mount TLS certs (same as Nginx) if you want encrypted TURN (recommended)
+    volumes:
+      - "/var/lib/matrix-nginx/certbot/live/{{ matrix_domain }}:/etc/turnserver:ro"
+  register: coturn_cont

roles/matrix-synapse/templates/homeserver.yaml.j2

@@ -35,3 +35,24 @@ rc_flood_control:
 # Enable password login
 enable_registration: true
 enable_registration_without_verification: true
+
+
+## -- turn settings
+# Voice & Video Chat Settings
+media_store_path: /data/media_store
+max_image_pixels: 32000000  # 32MP max
+
+# TURN/STUN server config
+turn_uris:
+  - "turn:{{ matrix_domain }}:3478?transport=udp"
+  - "turn:{{ matrix_domain }}:3478?transport=tcp"
+  - "turns:{{ matrix_domain }}:5349?transport=tcp"  # encrypted TURN
+
+turn_shared_secret: "{{ coturn_shared_secret }}"
+turn_username: "{{ coturn_username }}"
+turn_password: "{{ coturn_password }}"
+turn_time_limit: 86400  # 24h (optional)
+turn_allow_guests: true  # allow non-Matrix users (e.g., web guests)
+
+# Optional: Enable call features
+enable_call_signalling: true

roles/nginx-proxy/templates/Dockerfile-nginx-certbot.j2

@@ -0,0 +1,11 @@
+FROM nginx:1.25-alpine
+
+# Install Certbot (Python-based)
+RUN apk add --no-cache certbot python3 py3-pip
+
+# Add entrypoint script to auto-renew certs (optional)
+COPY certbot-entrypoint.sh /usr/local/bin/certbot-entrypoint.sh
+RUN chmod +x /usr/local/bin/certbot-entrypoint.sh
+
+ENTRYPOINT ["/usr/local/bin/certbot-entrypoint.sh"]
+CMD ["nginx", "-g", "daemon off;"]

roles/nginx-proxy/templates/certbot-entrypoint.sh

@@ -0,0 +1,23 @@
+#!/bin/sh
+set -e
+
+# Generate cert if not exists (first-run)
+if [ ! -d "/etc/letsencrypt/live/{{ matrix_domain }}" ]; then
+  echo "Requesting initial Let's Encrypt certificate..."
+  certbot certonly --standalone \
+    --non-interactive --agree-tos --email admin@{{ matrix_domain }} \
+    -d {{ matrix_domain }} \
+    --domain {{ matrix_domain }} \
+    --preferred-challenges http \
+    --http-01-port 8080 \
+    --server https://acme-v02.api.letsencrypt.org/directory || true
+
+  # For staging (dev): use --server https://acme-staging-v02.api.letsencrypt.org/directory
+fi
+
+# Try to renew (non-blocking)
+echo "Attempting certificate renewal..."
+certbot renew --dry-run --quiet || true
+
+# Start Nginx (certs will be loaded if they exist)
+exec "$@"

roles/nginx-proxy/templates/default.conf.j2

@@ -58,3 +58,36 @@ server {
         return 301 https://matrix-admin.example.com; # or proxy to a UI like SynapseAdmin
     }
 }
+
+#--- Coturn changes --- #
+
+# TURN over TLS (port 443) — proxied to Coturn's 5349
+# Only needed if you want TURN on 443 (avoids firewall issues)
+map $http_upgrade $connection_upgrade {
+    default upgrade;
+    ''      close;
+}
+
+upstream coturn_tls {
+    server 127.0.0.1:5349;
+}
+
+server {
+    listen 443 ssl http2;
+    server_name {{ matrix_domain }};
+
+    # ... [existing TLS config] ...
+
+    # TURN over TLS (for UDP/TCP fallback on port 443)
+    location /turn {
+        proxy_pass https://coturn_tls;
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection $connection_upgrade;
+        proxy_set_header Host $host;
+        proxy_read_timeout 86400;
+    }
+
+    # Or simpler: proxy UDP via a dedicated TCP tunnel (advanced)
+    # For most cases, just expose 3478/5349 directly → no Nginx needed!
+}