current config, stull unable to default login to ldap

.gitignore

@@ -1,2 +1,3 @@
 vault_pw
 *.key
+notes

README.md

@@ -1,64 +1,44 @@
-deploy playbook after setup
+## Test deployment ##
 ```
-ansible-playbook playbook.yml --ask-vault-pass
+ansible-playbook secure.yml -i inventory/hosts.yml --check --diff
+```
+```
+ansible-playbook deploy_matrix.yml -i inventory/hosts.yml --check --diff
 ```
 
-Check containers
+## Deploy ##
+
 ```
-ssh matrix.example.com
-sudo podman ps
-sudo podman logs synapse
+ansible-playbook secure.yml -i inventory/hosts.yml
+```
+```
+ansible-playbook deploy_matrix.yml -i inventory/hosts.yml 
+```
+## Matrix Administration ##
+[synapse-admin on github](https://github.com/Awesome-Technologies/synapse-admin)
+
+- Create User
+```
+sudo podman exec -it synapse register_new_matrix_user -c /data/homeserver.yaml http://localhost:8008
 ```
 
-test federation
-```
-curl https://{{ matrix_domain }}/_matrix/federation/v1/version
-```
+# List users
+sudo podman exec -it synapse curl -H "Authorization: Bearer YOUR_ADMIN_TOKEN" "http://localhost:8008/_synapse/admin/v2/users"
 
-## to generate config files default before deploymenta and templating ##
-```
-podman run -it --rm \
-  -v "$(pwd)":/data \
-  -e SYNAPSE_SERVER_NAME=my.matrix.host \
-  -e SYNAPSE_REPORT_STATS=yes \
-  docker.io/matrixdotorg/synapse:latest generate
-```
+# Deactivate user
+sudo podman exec -i synapse curl -X POST -H "Authorization: Bearer YOUR_ADMIN_TOKEN" -H "Content-Type: application/json" -d '{"erase": true}' "http://localhost:8008/_synapse/admin/v1/deactivate/@user:domain.com"
+
+# List rooms
+sudo podman exec -it synapse curl -H "Authorization: Bearer YOUR_ADMIN_TOKEN" "http://localhost:8008/_synapse/admin/v1/rooms"
+
+# Delete room
+sudo podman exec -i synapse curl -X DELETE -H "Authorization: Bearer YOUR_ADMIN_TOKEN" -H "Content-Type: application/json" -d '{}' "http://localhost:8008/_synapse/admin/v2/rooms/!roomid:domain.com"   
 
 
-| Area | Recommendation |
-|------|----------------|
-| **TLS** | Use Certbot + Nginx plugin (`community.general.acme` Ansible module) |
-| **Secrets** | Store DB passwords, secrets in **Ansible Vault** |
-| **Updates** | Use `container_image: tag` with version pins (e.g., `v1.100.0`) |
-| **Monitoring** | Add Prometheus metrics (`enable_metrics: true`) |
-| **Coturn** | Deploy `coturn` (STUN/TURN) as separate container if needed |
-| **Backups** | Backup `/var/lib/matrix-synapse` regularly |
-| **Rootless Podman** | Use `podman user` namespaces + `podman system migrate` for portability |
-
-
-## Using Hugo to create site ##
+## Clean up everything ## 
+you will lose all persistence as well
 ```
-# Create & build site locally (run ON CONTROL NODE)
-hugo new site mysite
-cd mysite
-echo 'theme = "ananke"' >> config.toml
-hugo new posts/my-first-post.md
-hugo  # builds to /public
-cp -r public ../fpov/roles/nginx-proxy/files/mysite/
-```
-
-1. Host boots: Podman creates pod with ports 80, 443, 8008, 8448 open.
-2. Nginx starts, runs certbot-entrypoint.sh:
-- Checks for /etc/letsencrypt/live/matrix.example.com
-- If missing → runs certbot certonly --standalone on port 8080
-- Writes certs to /etc/letsencrypt
-3. Nginx loads TLS certs, serves static site + proxies /_matrix/
-4. User visits https://matrix.example.com → gets your Hugo site.
-5. User visits https://matrix.example.com/_matrix/client → gets Synapse.
-6. ACME renewal: Certbot’s renew is dry-run on each start (you can also add cron via systemd unit if needed).
-
-Certificate renewal
-```
-# /etc/cron.d/certbot-renew
-0 3 * * * root podman exec nginx-matrix certbot renew --quiet
+ansible-playbook prune.yml -i inventory/hosts.yml 
 ```
+### Consider this ###
+LDAP ldif file

deploy_matrix.yml

@@ -0,0 +1,273 @@
+---
+- name: Deploy Element + Matrix + Matrix_admin + TURN + NGINX-PM + Teamspeak
+  hosts: all
+  become: true
+  collections:
+    - containers.podman
+
+  vars_files:
+    - ../vars/vars.yml                     # ← our variable file
+
+  tasks:
+
+    # -----------------------------------------------------------------
+    # Install podman, create network, create volumes …
+    # -----------------------------------------------------------------
+    - name: Install podman package
+      ansible.builtin.package:
+        name: podman
+        state: present
+
+    - name: Create podman network "{{ podman_network }}"
+      containers.podman.podman_network:
+        name: "{{ podman_network }}"
+        driver: bridge
+        subnet: "10.36.0.0/16"
+        state: present
+
+    - name: Ensure required podman volumes exist
+      containers.podman.podman_volume:
+        name: "{{ item }}"
+        driver: local
+        state: present
+      loop:
+        - "{{ vol_synapse }}"
+        - "{{ vol_media }}"
+        - "{{ vol_turn }}"
+        - "{{ vol_nginx }}"
+        - "{{ vol_teamspeak }}"
+        - "{{ vol_db }}"  
+        - "{{ npm_data }}"
+        - "{{ npm_letsencrypt }}"
+        - "{{ lemonldap_data }}"
+        - "{{ lemonldap_cfg }}" 
+        - "{{ lemonldap_lib }}"
+        - "{{ lemonldap_nginx }}"
+
+    # -----------------------------------------------------------------
+    # Pull required images (including Teamspeak)
+    # -----------------------------------------------------------------
+
+    - name: Pull coturn image
+      containers.podman.podman_image:
+        name: "{{ turn_image }}"
+        state: present
+
+    - name: Pull Synapse image
+      containers.podman.podman_image:
+        name: "{{ synapse_image }}"
+        state: present
+
+    - name: Pull NGINX image
+      containers.podman.podman_image:
+        name: "{{ nginx_image }}"
+        state: present
+
+    - name: Pull Teamspeak image
+      containers.podman.podman_image:
+        name: "{{ teamspeak_image }}"
+        state: present
+    
+    - name: Pull Nginx Proxy Manager image
+      containers.podman.podman_image:
+        name: "{{ npm_image }}"
+        state: present
+
+    - name: Pull Postgres DB image
+      containers.podman.podman_image:
+        name: "{{ db_image }}"
+        state: present
+
+    - name: Pull LemonLDAP image
+      containers.podman.podman_image:
+        name: "{{ lemonldap_image }}"
+        state: present
+
+    # -----------------------------------------------------------------
+    # Render all configuration files from the templates
+    # -----------------------------------------------------------------
+
+    - name: Render coturn config
+      ansible.builtin.template:
+        src: turnserver.conf.j2
+        dest: "{{ turn_conf_path }}"
+        mode: "0644"
+
+    - name: Render Synapse homeserver.yaml
+      ansible.builtin.template:
+        src: homeserver.yaml.j2
+        dest: "{{ synapse_cfg_path }}"
+        mode: "0644"
+
+    - name: Render landing page index.html
+      ansible.builtin.template:
+        src: landing.html.j2    
+        dest: "{{ nginx_html_path }}"        
+        mode: "0644"
+
+    - name: Render Synapse Secret key
+      ansible.builtin.template:
+        src: matrix.fpov.space.signing.key
+        dest: "{{ synapse_secret_key_path }}"
+        mode: "0644"
+
+    - name: Render Synapse log config file
+      ansible.builtin.template:
+        src: matrix.fpov.space.log.config.j2
+        dest: "{{ synapse_log_config }}"
+        mode: "0644"
+
+    - name: Render Element config file
+      ansible.builtin.template:
+        src: config.json.j2
+        dest: "{{ element_config_path }}"
+        mode: "0644"
+
+    # -----------------------------------------------------------------
+    # Start the NGINX Proxy Manager Container
+    # -----------------------------------------------------------------
+
+    - name: Start Nginx Proxy manager
+      containers.podman.podman_container:
+        name: npm 
+        image: "{{ npm_image }}"
+        state: started
+        ports:
+          - "80:80"
+          - "443:443"
+          - "81:81"
+        volumes:
+          - "{{ npm_data }}:/data"
+          - "{{ npm_letsencrypt }}:/etc/letsencrypt"
+        network: "{{ podman_network }}"
+
+    # -----------------------------------------------------------------
+    # Start the Coturn container
+    # -----------------------------------------------------------------
+
+    - name: Start coturn container
+      containers.podman.podman_container:
+        name: turn
+        image: "{{ turn_image }}"
+        state: started
+        ports:
+          - "{{ turn_listen_port }}:{{ turn_listen_port }}/udp"
+          - "{{ turn_listen_port }}:{{ turn_listen_port }}/tcp"
+          - "{{ turn_tls_port }}:{{ turn_tls_port }}/udp"
+          - "{{ turn_tls_port }}:{{ turn_tls_port }}/tcp"
+        volumes:
+          - "{{ vol_turn }}:/var/lib/turn"
+          - "{{ turn_conf_path }}:/etc/turnserver.conf:ro"
+        command: "-c /etc/turnserver.conf"
+        network: "{{ podman_network }}"
+        restart_policy: always
+
+
+    # -----------------------------------------------------------------
+    # Start the Matrix-Synaps and supporting DB containers
+    # -----------------------------------------------------------------
+
+    - name: start Database container
+      containers.podman.podman_container:
+        name: synapse-db
+        image: "{{ db_image }}"
+        state: started
+        env:
+          POSTGRES_USER: "{{ postgres_user }}"
+          POSTGRES_PASSWORD: "{{ postgres_pw }}"
+          POSTGRES_DB: "{{ postgres_db }}"
+        volumes:
+          - "{{ vol_db }}:/var/lib/postgresql/data"        
+        network: "{{ podman_network }}"
+        restart_policy: always
+
+    - name: Start Synapse container
+      containers.podman.podman_container:
+        name: "{{ matrix_container_name }}"  
+        image: "{{ synapse_image }}"
+        state: started
+        ports:
+          - "{{ synapse_http_port }}:{{ synapse_http_port }}"
+        volumes:
+          - "{{ vol_synapse }}:/data"
+          - "{{ vol_media }}:/data/media_store:Z"
+          - "{{ synapse_cfg_path }}:/data/homeserver.yaml:Z"
+          - "{{ synapse_secret_key_path }}:/data/matrix.fpov.space.signing.key:Z"
+          - "{{ synapse_log_config }}:/data/matrix.fpov.space.log.config:Z"
+        network: "{{ podman_network }}"
+        restart_policy: always
+
+    # -----------------------------------------------------------------
+    # Start the Teamspeak Container
+    # -----------------------------------------------------------------
+
+    - name: Start Teamspeak container
+      containers.podman.podman_container:
+        name: "{{ teamspeak_container_name }}"
+        image: "{{ teamspeak_image }}"
+        env:
+          TS3SERVER_LICENSE: accept
+        state: started
+        ports:
+          # UDP voice port – exposed directly on the host (no Traefik)
+          - "{{ teamspeak_udp_port }}:{{ teamspeak_udp_port }}/udp"
+          # TCP query port – Traefik will forward it (see static config)
+          - "{{ teamspeak_tcp_port }}:{{ teamspeak_tcp_port }}/tcp"
+          # Optional file‑transfer port (exposed directly)
+          - "{{ teamspeak_file_port }}:{{ teamspeak_file_port }}/tcp"
+        volumes:
+          - "{{ vol_teamspeak }}:/var/ts3server"
+        network: "{{ podman_network }}"
+        restart_policy: always
+
+    # -----------------------------------------------------------------
+    # Matrix Admin Panel
+    # -----------------------------------------------------------------
+
+    - name: Start Matrix Admin panel
+      containers.podman.podman_container:
+        name: "{{ admin_container_name }}"
+        image: "{{ synapse_admin_image }}"
+        state: started
+        network: "{{ podman_network }}"
+        restart_policy: always
+
+    # -----------------------------------------------------------------
+    # Element Web app
+    #------------------------------------------------------------------
+    - name: start Element Web Application
+      containers.podman.podman_container:
+        name: "{{ element_container_name }}"
+        image: "{{ element_image }}"
+        env:
+          ELEMENT_WEB_PORT=8008
+        state: started
+        volumes:
+          - "{{ element_config_path }}:/app/config.json:Z"
+        network: "{{ podman_network }}"
+        restart_policy: always
+
+    # -----------------------------------------------------------------
+    # LemonLDAP-NG 
+    #------------------------------------------------------------------
+    - name: Start LemonLDAP container
+      containers.podman.podman_container:
+        name: "{{ lemonldap_container_name }}"
+        image: "{{ lemonldap_image }}"
+        state: started
+        env:
+          SSODOMAIN="{{ top_domain }}"
+          PORTAL_HOSTNAME="{{ ldap_portal_hostname }}"
+          MANAGER_HOSTNAME="{{ ldap_manager_hostname }}"
+          HANDLER_HOSTNAME="{{ ldap_handler_hostname }}"
+          PORT="{{ lemonldap_port }}"
+          FASTCGI_LISTEN_PORT="{{ lemonldap_cgi_port }}"
+          IPV4_only="true"
+          PRESERVEFILES="/etc/lemonldap-ng /var/lib/lemonldap-ng/conf /var/lib/lemonldap-ng/sessions /var/lib/lemonldap-ng/psessions /etc/nginx/sites-enabled"
+        volumes:
+          - "{{ lemonldap_cfg }}:/etc/lemonldap-ng:Z" 
+          - "{{ lemonldap_data }}:/usr/share:Z" 
+          - "{{ lemonldap_lib }}:/var/lib/lemonldap-ng:Z" 
+          - "{{ lemonldap_nginx }}:/etc/nginx/sites-enabled:Z"         
+        network: "{{ podman_network }}"
+        restart_policy: always

group_vars/all.yml

@@ -1,31 +0,0 @@
-# Variables
-matrix_domain: "matrix.example.com"
-landing_domain: "example.com"  # or same as matrix_domain + path-based routing
-podman_user: "matrix"          # set to 'root' for rootful
-podman_pod_name: "matrix-pod"
-
-synapse_data_dir: "/var/lib/matrix-synapse"
-nginx_config_dir: "/etc/nginx/conf.d"
-nginx_webroot: "/var/www/landing"
-
-# Database (PostgreSQL)
-db_name: "synapse"
-db_user: "synapse"
-db_pass: "{{ synapse_db_pass | mandatory }}"
-synapse_db_pass: "supersecretpassword"  # use vault for real deployments!
-
-
-matrix_domain: "matrix.example.com"
-landing_domain: "example.com"  # optional, or use same domain + path-based routing
-
-# For certbot
-certbot_email: "admin@example.com"
-
-# Static site path
-nginx_webroot: "/var/lib/matrix-nginx"
-
-coturn_shared_secret: "{{ 'your-secret-key' | password_hash('sha512', 'salt') }}"
-# Or generate randomly:
-# coturn_shared_secret: "{{ 24 | random_string | password_hash('sha512') }}"
-coturn_username: "matrix-turn"
-coturn_password: "{{ vault_coturn_password }}"

inventory.ini

@@ -1,7 +0,0 @@
-[matrix_servers]
-matrix.example.com ansible_host=203.0.113.10
-
-[all:vars]
-ansible_user=deploy
-ansible_ssh_private_key_file=~/.ssh/id_rsa
-podman_user=matrix  # rootless user (or 'root' for rootful)

inventory/hosts.yml

@@ -0,0 +1,6 @@
+all:
+  hosts:
+    podman-host1:                # <-- change to the host that will run Podman
+      ansible_host: 15.204.117.53 # its IP or DNS name
+      ansible_user: fedora      # user that can sudo
+      ansible_become: true

playbook.yml

@@ -1,19 +0,0 @@
-- name: Deploy Matrix + Nginx + Static Site with TLS
-  hosts: matrix_servers
-  become: yes
-  vars:
-    synapse_db_pass: "{{ vault_synapse_db_pass }}"
-    certbot_email: "{{ vault_certbot_email | default('admin@example.com') }}"
-
-  tasks:
-    - name: Setup common dependencies
-      import_role:
-        name: common
-
-    - name: Deploy Nginx + Static Site + TLS (with Certbot)
-      import_role:
-        name: nginx-proxy
-
-    - name: Deploy Synapse (PostgreSQL + containers)
-      import_role:
-        name: matrix-synapse

prune.yml

@@ -0,0 +1,14 @@
+---
+- name: prune all Podman resources
+  hosts: all
+  become: true
+  collections:
+    - containers.podman
+
+  tasks:
+    - name: Prune all Podman resources
+      containers.podman.podman_prune:
+        system: true
+        system_all: true
+        system_volumes: true
+    

references/synapse-config/homeserver.yaml

@@ -1,40 +0,0 @@
-# Configuration file for Synapse.
-#
-# This is a YAML file: see [1] for a quick introduction. Note in particular
-# that *indentation is important*: all the elements of a list or dictionary
-# should have the same indentation.
-#
-# [1] https://docs.ansible.com/ansible/latest/reference_appendices/YAMLSyntax.html
-#
-# For more information on how to configure Synapse, including a complete accounting of
-# each option, go to docs/usage/configuration/config_documentation.md or
-# https://element-hq.github.io/synapse/latest/usage/configuration/config_documentation.html
-server_name: "my.matrix.host"
-pid_file: /data/homeserver.pid
-listeners:
-  - port: 8008
-    resources:
-    - compress: false
-      names:
-      - client
-      - federation
-    tls: false
-    type: http
-    x_forwarded: true
-database:
-  name: sqlite3
-  args:
-    database: /data/homeserver.db
-log_config: "/data/my.matrix.host.log.config"
-media_store_path: /data/media_store
-registration_shared_secret: "uC7Pv@:r=@Slvhx7Ex*An8QHXWnPRyI9+COZr_&;Kh*,~lGpql"
-report_stats: true
-macaroon_secret_key: "+QUdDhvNc9*@MORp9K-TjuGp1j5Ff-mUBS+pjkmAFWR0Y3#da8"
-form_secret: "meZSlI7K.EI-6hmXcjzCNf2IwrThcnoVr2X0iohOV7K5a_w^Ud"
-signing_key_path: "/data/my.matrix.host.signing.key"
-trusted_key_servers:
-  - server_name: "matrix.org"
-
-
-# vim:ft=yaml
-

roles/common/tasks/main.yml

@@ -1,30 +0,0 @@
-- name: Ensure Podman is installed
-  package:
-    name: podman
-    state: present
-
-- name: Create matrix user (for rootless)
-  user:
-    name: "{{ podman_user }}"
-    shell: /bin/bash
-    createhome: yes
-    groups: wheel
-  when: podman_user != "root"
-
-- name: Create data directories
-  file:
-    path: "{{ item }}"
-    state: directory
-    owner: "{{ podman_user }}"
-    group: "{{ podman_user }}"
-    mode: '0755'
-  loop:
-    - "{{ synapse_data_dir }}"
-    - "{{ nginx_webroot }}"
-
-# roles/matrix-synapse/tasks/main.yml
-- name: Restart Synapse to reload TURN config
-  container:
-    name: synapse
-    state: started
-    restart: yes

roles/matrix-synapse/tasks/main.yml

@@ -1,94 +0,0 @@
-- name: Generate signing key (if missing)
-  command: >
-    podman run --rm -v "{{ synapse_data_dir }}:/data"
-    ghcr.io/element-hq/synapse:latest
-    generate-config --server-name "{{ matrix_domain }}"
-    --report-stats no
-    -o /data/homeserver.yaml
-  args:
-    creates: "{{ synapse_data_dir }}/homeserver.yaml"
-
-- name: Copy homeserver.yaml (configured)
-  template:
-    src: synapse/homeserver.yaml.j2
-    dest: "{{ synapse_data_dir }}/homeserver.yaml"
-    owner: "{{ podman_user }}"
-    group: "{{ podman_user }}"
-    mode: '0644'
-
-- name: Ensure PostgreSQL database exists
-  become_user: postgres
-  community.postgresql.postgresql_db:
-    name: "{{ db_name }}"
-    state: present
-  delegate_to: "{{ inventory_hostname }}"  # assuming DB on same host
-
-- name: Ensure PostgreSQL user exists
-  become_user: postgres
-  community.postgresql.postgresql_user:
-    name: "{{ db_user }}"
-    password: "{{ db_pass }}"
-    priv: "{{ db_name }}.*:ALL"
-    state: present
-  delegate_to: "{{ inventory_hostname }}"
-
-- name: Create Podman pod
-  command: >
-    podman pod create
-    --name {{ podman_pod_name }}
-    --publish 8008:8008  # synapse
-    --publish 8448:8448  # federation
-  when: podman_user != "root"
-  changed_when: false
-
-- name: Run PostgreSQL container
-  container:
-    name: synapse-db
-    image: docker.io/library/postgres:15-alpine
-    state: started
-    restart_policy: unless-stopped
-    pod: "{{ podman_pod_name }}"
-    env:
-      POSTGRES_DB: "{{ db_name }}"
-      POSTGRES_USER: "{{ db_user }}"
-      POSTGRES_PASSWORD: "{{ db_pass }}"
-    volumes:
-      - "{{ synapse_data_dir }}/db:/var/lib/postgresql/data"
-  register: pg_cont
-
-- name: Run Synapse container
-  container:
-    name: synapse
-    image: ghcr.io/element-hq/synapse:latest
-    state: started
-    restart_policy: unless-stopped
-    pod: "{{ podman_pod_name }}"
-    volumes:
-      - "{{ synapse_data_dir }}:/data"
-    command: >
-      -c /data/homeserver.yaml
-#----- Coturn + Synapse 
-- name: Run Coturn container (STUN/TURN server)
-  container:
-    name: coturn
-    image: coturn/coturn:latest
-    state: started
-    restart_policy: unless-stopped
-    pod: "{{ podman_pod_name }}"
-    env:
-      LISTENING_PORT: "3478"
-      ALTERNATE_LISTENING_PORT: "5349"
-      RELAY_ADDRESS: "{{ ansible_default_ipv4.address }}"  # or your server IP
-      EXTERNAL_IP: "{{ ansible_default_ipv4.address }}"
-      # Shared secret for dynamic credentials
-      TURNSERVER_STATIC_AUTH_SECRET: "{{ coturn_shared_secret }}"
-      # Enable TLS
-      TURNSERVER_TLS_LISTENING_PORT: "5349"
-      TURNSERVER_CERT: "/etc/turnserver/tls.crt"
-      TURNSERVER_PKEY: "/etc/turnserver/tls.key"
-      NO_AUTH_TIMESTAMPS: "true"
-      REALM: "{{ matrix_domain }}"
-    # Mount TLS certs (same as Nginx) if you want encrypted TURN (recommended)
-    volumes:
-      - "/var/lib/matrix-nginx/certbot/live/{{ matrix_domain }}:/etc/turnserver:ro"
-  register: coturn_cont

roles/matrix-synapse/templates/homeserver.yaml.j2

@@ -1,58 +0,0 @@
-server_name: "{{ matrix_domain }}"
-enable_metrics: false
-report_stats: false
-
-listeners:
-  - port: 8008
-    type: http
-    tls: false
-    resources:
-      - names: [client, federation]
-        compress: true
-
-database:
-  name: psycopg2
-  args:
-    user: "{{ db_user }}"
-    password: "{{ db_pass }}"
-    database: "{{ db_name }}"
-    host: "localhost"
-    port: 5432
-
-registration_shared_secret: "{{ synapse_registration_secret }}"
-tls_certificate_path: "/data/tls.crt"
-private_key_path: "/data/tls.key"
-
-federation_domain_whitelist:
-  - matrix.org
-  - gitter.im
-
-# Optional: Rate limits
-rc_flood_control:
-  interval: 1000
-  burst_count: 3
-
-# Enable password login
-enable_registration: true
-enable_registration_without_verification: true
-
-
-## -- turn settings
-# Voice & Video Chat Settings
-media_store_path: /data/media_store
-max_image_pixels: 32000000  # 32MP max
-
-# TURN/STUN server config
-turn_uris:
-  - "turn:{{ matrix_domain }}:3478?transport=udp"
-  - "turn:{{ matrix_domain }}:3478?transport=tcp"
-  - "turns:{{ matrix_domain }}:5349?transport=tcp"  # encrypted TURN
-
-turn_shared_secret: "{{ coturn_shared_secret }}"
-turn_username: "{{ coturn_username }}"
-turn_password: "{{ coturn_password }}"
-turn_time_limit: 86400  # 24h (optional)
-turn_allow_guests: true  # allow non-Matrix users (e.g., web guests)
-
-# Optional: Enable call features
-enable_call_signalling: true

roles/nginx-proxy/tasks/main.yml

@@ -1,104 +0,0 @@
-- name: Ensure web root exists (for ACME)
-  file:
-    path: "/var/www/{{ matrix_domain }}"
-    state: directory
-    mode: '0755'
-
-- name: Copy compiled site to host (for volume mount)
-  copy:
-    src: "files/mysite/"
-    dest: "{{ nginx_webroot }}/mysite/"
-    mode: '0644'
-  vars:
-    nginx_webroot: "/var/lib/matrix-nginx"
-
-- name: Ensure nginx data dir exists
-  file:
-    path: "{{ item }}"
-    state: directory
-    mode: '0755'
-  loop:
-    - "/var/lib/matrix-nginx"
-    - "/var/lib/matrix-nginx/certbot"
-
-- name: Create custom Nginx image (if missing)
-  command: >
-    podman build
-    -f "{{ role_path }}/templates/Dockerfile-nginx-certbot.j2"
-    -t nginx-matrix:latest
-    "{{ role_path }}/templates/"
-  args:
-    creates: /var/lib/containers/storage/overlay-images/... # (use container_exists check instead)
-  register: build_result
-  changed_when: false
-
-- name: Create Podman pod
-  command: >
-    podman pod create
-    --name {{ podman_pod_name }}
-    --publish 80:80
-    --publish 443:443
-    --publish 8008:8008
-    --publish 8448:8448
-  changed_when: false
-
-- name: Run Nginx container (with TLS & site)
-  container:
-    name: nginx-matrix
-    image: nginx-matrix:latest
-    state: started
-    restart_policy: unless-stopped
-    pod: "{{ podman_pod_name }}"
-    volumes:
-      - "/var/lib/matrix-nginx/mysite:/usr/share/nginx/html/mysite:ro"
-      - "/var/lib/matrix-nginx/certbot:/etc/letsencrypt"
-    env:
-      NGINX_HOST: "{{ matrix_domain }}"
-    security_opt:
-      - label: disable  # if rootless: disable SELinux
-  register: nginx_cont
-
-- name: Run Synapse (PostgreSQL & all)
-  # ... (existing synapse task from before)
-
-- name: Install Nginx
-  package:
-    name: nginx
-    state: present
-
-- name: Create web root for landing page
-  file:
-    path: "{{ nginx_webroot }}"
-    state: directory
-    mode: '0755'
-
-- name: Deploy landing page HTML
-  copy:
-    content: |
-      <!DOCTYPE html>
-      <html>
-      <head><title>Welcome</title></head>
-      <body>
-        <h1>Welcome to Matrix!</h1>
-        <p>Visit <a href="/_matrix">Matrix</a></p>
-      </body>
-      </html>
-    dest: "{{ nginx_webroot }}/index.html"
-    mode: '0644'
-
-- name: Deploy Nginx config
-  template:
-    src: nginx/default.conf.j2
-    dest: "/etc/nginx/conf.d/{{ matrix_domain }}.conf"
-    mode: '0644'
-
-- name: Remove default config (optional)
-  file:
-    path: "/etc/nginx/conf.d/default.conf"
-    state: absent
-
-- name: Restart & enable Nginx
-  service:
-    name: nginx
-    state: restarted
-    enabled: yes

roles/nginx-proxy/templates/Dockerfile-nginx-certbot.j2

@@ -1,11 +0,0 @@
-FROM nginx:1.25-alpine
-
-# Install Certbot (Python-based)
-RUN apk add --no-cache certbot python3 py3-pip
-
-# Add entrypoint script to auto-renew certs (optional)
-COPY certbot-entrypoint.sh /usr/local/bin/certbot-entrypoint.sh
-RUN chmod +x /usr/local/bin/certbot-entrypoint.sh
-
-ENTRYPOINT ["/usr/local/bin/certbot-entrypoint.sh"]
-CMD ["nginx", "-g", "daemon off;"]

roles/nginx-proxy/templates/certbot-entrypoint.sh

@@ -1,23 +0,0 @@
-#!/bin/sh
-set -e
-
-# Generate cert if not exists (first-run)
-if [ ! -d "/etc/letsencrypt/live/{{ matrix_domain }}" ]; then
-  echo "Requesting initial Let's Encrypt certificate..."
-  certbot certonly --standalone \
-    --non-interactive --agree-tos --email admin@{{ matrix_domain }} \
-    -d {{ matrix_domain }} \
-    --domain {{ matrix_domain }} \
-    --preferred-challenges http \
-    --http-01-port 8080 \
-    --server https://acme-v02.api.letsencrypt.org/directory || true
-
-  # For staging (dev): use --server https://acme-staging-v02.api.letsencrypt.org/directory
-fi
-
-# Try to renew (non-blocking)
-echo "Attempting certificate renewal..."
-certbot renew --dry-run --quiet || true
-
-# Start Nginx (certs will be loaded if they exist)
-exec "$@"

roles/nginx-proxy/templates/default.conf.j2

@@ -1,93 +0,0 @@
-# Redirect HTTP → HTTPS (except ACME challenges)
-server {
-    listen 80;
-    server_name {{ matrix_domain }} {{ landing_domain }};
-
-    # ACME-challenge (for Let's Encrypt)
-    location ~ /.well-known/acme-challenge/ {
-        root /var/www;
-        try_files $uri =404;
-    }
-
-    location / {
-        return 301 https://$host$request_uri;
-    }
-}
-
-# HTTPS server
-server {
-    listen 443 ssl http2;
-    server_name {{ matrix_domain }};
-
-    # TLS certs (mounted from Let's Encrypt dir)
-    ssl_certificate /etc/letsencrypt/live/{{ matrix_domain }}/fullchain.pem;
-    ssl_certificate_key /etc/letsencrypt/live/{{ matrix_domain }}/privkey.pem;
-    ssl_trusted_certificate /etc/letsencrypt/live/{{ matrix_domain }}/chain.pem;
-
-    ssl_session_cache shared:SSL:10m;
-    ssl_protocols TLSv1.2 TLSv1.3;
-    ssl_ciphers HIGH:!aNULL:!MD5;
-
-    # Serve static site (root)
-    location / {
-        root /usr/share/nginx/html/mysite;
-        try_files $uri $uri/ /index.html;
-    }
-
-    # Matrix Synapse (client)
-    location /_matrix/ {
-        proxy_pass http://127.0.0.1:8008/_matrix/;
-        proxy_set_header Host $host;
-        proxy_set_header X-Real-IP $remote_addr;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Proto $scheme;
-        proxy_buffering off;
-    }
-
-    # Federation
-    location /_matrix/federation/v1/ {
-        proxy_pass http://127.0.0.1:8448/_matrix/federation/v1/;
-        proxy_set_header Host $host;
-        proxy_set_header X-Real-IP $remote_addr;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Proto $scheme;
-    }
-
-    # Optional: Add a Matrix admin link
-    location /admin {
-        return 301 https://matrix-admin.example.com; # or proxy to a UI like SynapseAdmin
-    }
-}
-
-#--- Coturn changes --- #
-
-# TURN over TLS (port 443) — proxied to Coturn's 5349
-# Only needed if you want TURN on 443 (avoids firewall issues)
-map $http_upgrade $connection_upgrade {
-    default upgrade;
-    ''      close;
-}
-
-upstream coturn_tls {
-    server 127.0.0.1:5349;
-}
-
-server {
-    listen 443 ssl http2;
-    server_name {{ matrix_domain }};
-
-    # ... [existing TLS config] ...
-
-    # TURN over TLS (for UDP/TCP fallback on port 443)
-    location /turn {
-        proxy_pass https://coturn_tls;
-        proxy_http_version 1.1;
-        proxy_set_header Upgrade $http_upgrade;
-        proxy_set_header Connection $connection_upgrade;
-        proxy_set_header Host $host;
-        proxy_read_timeout 86400;
-    }
-
-    # Or simpler: proxy UDP via a dedicated TCP tunnel (advanced)
-    # For most cases, just expose 3478/5349 directly → no Nginx needed!
-}

secure.yml

@@ -0,0 +1,51 @@
+---
+- name: Secure and Update Fedora 43 Server
+  hosts: all
+  become: true
+  gather_facts: true
+  
+  vars:
+    ansible_python_interpreter: /usr/bin/python3.14
+  tasks:
+    # Update system
+    - name: Update all packages (safe upgrade)
+      ansible.builtin.dnf:
+        name: "*"
+        state: latest
+        update_cache: true
+
+    - name: Install security tools
+      ansible.builtin.dnf:
+        name:
+          - audit
+          - fail2ban
+          - dnf-automatic
+        state: present
+
+
+    - name: Configure dnf-automatic for security updates only
+      ansible.builtin.template:
+        src: automatic.conf.j2
+        dest: /etc/dnf/automatic.conf
+
+
+    - name: Ensure dnf-automatic timer is enabled
+      ansible.builtin.systemd:
+        name: dnf-automatic.timer
+        state: started
+        enabled: true
+
+    # Ensure SELinux is enforcing
+    - name: Ensure SELinux is in enforcing mode
+      ansible.posix.selinux:
+        policy: targeted
+        state: enforcing
+
+    # Enable and start fail2ban
+    - name: Enable and start fail2ban
+      ansible.builtin.service:
+        name: fail2ban
+        state: started
+        enabled: true
+
+

templates/automatic.conf.j2

@@ -0,0 +1,4 @@
+[commands]
+upgrade_type = security
+apply_updates = yes
+download_updates = yes   

templates/config.json.j2

@@ -0,0 +1,15 @@
+{
+  "default_server_config": {
+    "m.homeserver": {
+      "base_url": "https://{{ matrix_domain1 }}",
+      "server_name": "{{ top_domain }}"
+    }
+  },
+  "disable_custom_urls": true,
+  "disable_guests": true,
+  "brand": "{{ element_brand }}",
+  "default_theme": "dark",
+  "roomDirectory": {
+    "servers": ["{{ top_domain }}"]
+  }
+}

templates/homeserver.yaml.j2

@@ -0,0 +1,61 @@
+server_name: "{{ matrix_domain1 }}"
+pid_file: /data/homeserver.pid
+listeners:
+  - port: {{ synapse_http_port }}
+    resources:
+    - compress: true
+      names:
+      - client
+      - federation
+    tls: false
+    type: http
+    x_forwarded: true
+
+room_list_publication_rules:
+  - user_id: "*"
+    alias: "*"
+    room_id: "*"
+    action: allow   
+
+turn_uris:
+    - "turn:{{ turn_domain }}:{{ turn_listen_port }}?transport=udp"
+    - "turn:{{ turn_domain }}:{{ turn_tls_port }}?transport=tcp"
+    - "turns:{{ turn_domain }}:{{ turn_tls_port }}?transport=tcp"
+    - "turns:{{ turn_domain }}:{{ turn_listen_port }}?transport=udp"
+
+turn_shared_secret: "{{ turn_secret }}"
+turn_user_lifetime: "1h" 
+turn_allow_guests: "true"
+
+enable_registration: true
+registration_requires_token: true
+
+
+federation_domain_whitelist: []
+auto_join_rooms:
+  - "#star-citizen:matrix.fpov.space"
+  - "#welcome:matrix.fpov.space"
+
+max_upload_size: 200M
+
+media_store_path: /data/media_store
+log_config: "/data/matrix.fpov.space.log.config"
+registration_shared_secret: "{{ registration_shared_secret }}"
+report_stats: false
+macaroon_secret_key: "{{ macaroon_secret_key }}"
+form_secret: "{{ form_secret }}"
+signing_key_path: "/data/matrix.fpov.space.signing.key"
+trusted_key_servers:
+  - server_name: "{{ matrix_domain1 }}"
+
+database:
+  name: psycopg2
+  allow_unsafe_locale: true
+  args:
+    user: "{{ postgres_user }}"
+    password: "{{ postgres_pw }}"
+    database: "{{ postgres_db }}"
+    host: synapse-db
+    port: 5432
+    cp_min: 5
+    cp_max: 10

templates/landing.html.j2

@@ -0,0 +1,26 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+    <meta charset="UTF-8">
+    <title>{{ landing_title }}</title>
+    <style>
+        body { font-family: Arial, Helvetica, sans-serif; text-align: center; margin-top: 5rem; }
+        h1   { font-size: 2.2rem; }
+        p    { font-size: 1.1rem; line-height: 1.5; max-width: 600px; margin: 0 auto; }
+        a    { color: #0066cc; }
+    </style>
+</head>
+<body>
+    <h1>{{ landing_title }}</h1>
+
+    <p>{{ landing_tagline }}</p>
+
+    <p>
+        {{ landing_message | replace('\n','<br>') }}
+    </p>
+
+    <p>
+        <a href="https://{{ matrix_domain }}">Go to Matrix login page →</a>
+    </p>
+</body>
+</html>

templates/lemonldap-ng.ini.j2

@@ -0,0 +1,421 @@
+;/etc/lemonldap-ng/lemonldap-ng.ini
+;==============================================================================
+; LemonLDAP::NG local configuration parameters
+;
+; This file is dedicated to configuration parameters override
+; You can set here configuration parameters that will be used only by
+; local LemonLDAP::NG elements
+;
+; Section "all" is always read first before "portal", "handler"
+; and "manager"
+;
+; Section "configuration" is used to load global configuration and set cache
+; (replace old storage.conf file)
+;
+; Other section are only read by the specific LemonLDAP::NG component
+;==============================================================================
+
+[all]
+
+; CUSTOM FUNCTION
+; If you want to create customFunctions in rules, declare them here:
+;require = /path/to/custom/file1.pm, /path/to/custom/file2.pm
+; Prevent Portal to crash if Perl module is not found
+;requireDontDie = 1
+;customFunctions = function1 function2
+;customFunctions = Package::func1 Package::func2
+
+; CROSS-DOMAIN
+; If you have some handlers that are not registered on the main domain,
+; uncomment this
+;cda = 1
+
+; SAFE JAIL
+; Comment this to configure Safe jail with Manager.
+; It can also be disabled from here by setting value to 0.
+; Warning: this can allow malicious code in custom functions or rules
+useSafeJail = 1
+
+; LOGGING
+;
+; 1 - Defined logging level
+;   Set here one of error, warn, notice, info or debug
+logLevel=info
+logger = Lemonldap::NG::Common::Logger::Std
+; Note that this has no effect for Apache2 logging: Apache LogLevel is used instead
+;   Uncomment this to dump $req and $env variables. Require logLevel = debug
+;logParams = 1
+;
+; 2 - Change logger
+;
+;   By default, logging is set to:
+;    - Lemonldap::NG::Common::Logger::Apache2  for ApacheMP2 handlers
+;    - Lemonldap::NG::Common::Logger::Syslog   for FastCGI (Nginx)
+;    - Lemonldap::NG::Common::Logger::Std      for PSGI applications (manager,
+;                                              portal,...) when they are not
+;                                              launched by FastCGI server
+;   Other loggers availables:
+;    - Lemonldap::NG::Common::Logger::Log4perl to use Log4perl
+;
+;   "Std" is redirected to the web server logs for Apache. For Nginx, only if
+;   request failed
+;
+;   You can overload this in this section (for all) or in another section if
+;   you want to change logger for a specified app.
+;
+;   LLNG uses 2 loggers: 1 for technical logs (logger), 1 for user actions
+;   (userLogger). "userLogger" uses the same class as "logger" if not set.
+;logger     = Lemonldap::NG::Common::Logger::Syslog
+;userLogger = Lemonldap::NG::Common::Logger::Log4perl
+;
+; 2.1 - Using Syslog
+;
+;   For Syslog logging, you can also overwrite facilities. Default values:
+;logger             = Lemonldap::NG::Common::Logger::Syslog
+;syslogFacility     = daemon
+;syslogOptions      = cons,pid,ndelay
+;userSyslogFacility = auth
+;userSyslogOptions  = cons,pid,ndelay
+;
+; You can also pass additional parameters. Example to change host:
+;syslogSockOptions  = { host => "my.syslog.com", port => 6514 }
+;
+; 2.2 - Using Log4perl
+;
+;   If you want to use Log4perl, you can set these parameters. Here are default
+;   values:
+;logger             = Lemonldap::NG::Common::Logger::Log4perl
+;log4perlConfFile   = /etc/log4perl.conf
+;log4perlLogger     = LLNG
+;log4perlUserLogger = LLNGuser
+;
+;   Here, Log4perl configuration is read from /etc/log4perl.conf. The "LLNG"
+;   value points to the logger class. Example:
+;     log4perl.logger.LLNG      = WARN, File1
+;     log4perl.logger.LLNGuser  = INFO, File2
+;     ...
+
+; CONFIGURATION CHECK
+;
+; LLNG checks configuration at server start. If you use "reload" mechanism,
+; local cache will be updated. Configuration is checked locally every
+; 10 minutes by each LLNG component. You can change this value using
+; `checkTime` (time in seconds).
+; To increase performances, you should comment this parameter and rely on cache.
+checkTime = 1
+
+[configuration]
+
+; confTimeout: maximum time to get configuration (default 10)
+;confTimeout = 5
+
+; GLOBAL CONFIGURATION ACCESS TYPE
+; (File, REST, SOAP, CDBI/RDBI, LDAP, YAMLFile)
+; Set here the parameters needed to access to LemonLDAP::NG configuration.
+; You have to set "type" to one of the followings :
+;
+; * File/YAMLFile: you have to set 'dirName' parameter. Example:
+;
+;           type = File ; or type = YAMLFile
+;           dirName = /var/lib/lemonldap-ng/conf
+;           ; Optimize JSON for readability instead of performance
+;           prettyPrint = 1
+;
+; * CDBI/RDBI : you have to set 'dbiChain' (required) and 'dbiUser' and 'dbiPassword'
+;         if needed. Example:
+;
+;           type        = CDBI
+;          ;type        = RDBI
+;           dbiChain    = DBI:MariaDB:database=lemonldap-ng;host=1.2.3.4
+;           dbiUser     = lemonldap
+;           dbiPassword = password
+;
+; * REST: REST configuration access is a sort of proxy: the portal is
+;         configured to use the real session storage type (DBI or File for
+;         example).
+;         You have to set 'baseUrl' parameter. Example:
+;
+;           type         = REST
+;           baseUrl      = https://auth.fpov.space/config
+;           lwpOpts      = { timeout => 5 }
+;           lwpSslOpts   = { SSL_ca_file => "..." }
+;           user         = lemonldap
+;           password     = mypassword
+;           realm        = myrealm
+;
+; * LDAP: you have to set ldapServer, ldapConfBase, ldapBindDN and ldapBindPassword.
+;
+;           type                 = LDAP
+;           ldapServer           = ldap://localhost
+;           ldapConfBase         = ou=conf,ou=applications,dc=example,dc=com
+;           ldapBindDN           = cn=manager,dc=example,dc=com
+;           ldapBindPassword     = secret
+;           ldapObjectClass      = applicationProcess
+;           ldapAttributeId      = cn
+;           ldapAttributeContent = description
+
+type=File
+dirName = /var/lib/lemonldap-ng/conf
+; Optimize for readability instead of performance
+prettyPrint = 1
+
+; LOCAL CACHE CONFIGURATION
+;
+; To increase performances, use a local cache for the configuration. You have
+; to choose a Cache::Cache module and set its parameters. Example:
+;
+;           localStorage = Cache::FileCache
+;           localStorageOptions={                             \
+;               'namespace'          => 'lemonldap-ng-config',\
+;               'default_expires_in' => 600,                  \
+;               'directory_umask'    => '007',                \
+;               'cache_root'         => '/var/cache/lemonldap-ng',       \
+;               'cache_depth'        => 3,                    \
+;           }
+localStorage=Cache::FileCache
+localStorageOptions={                             \
+    'namespace'          => 'lemonldap-ng-config',\
+    'default_expires_in' => 600,                  \
+    'directory_umask'    => '007',                \
+    'cache_root'         => '/var/cache/lemonldap-ng',       \
+    'cache_depth'        => 3,                    \
+}
+
+[apply]
+
+; reload URLs for distant Hanlders
+
+
+[portal]
+
+; PORTAL CUSTOMIZATION
+
+; I - Required parameters
+
+; staticPrefix: relative (or URL) location of static HTML components
+staticPrefix = /static
+
+; location of HTML templates directory
+templateDir  = /usr/share/lemonldap-ng/portal/templates
+
+; languages: available languages for portal interface
+languages    = en, fr, vi, it, ar, de, fi, tr, pl, zh_TW, es, pt_BR, he, ru, mfe, sk
+
+; II - Optional parameters (overwrite configuration)
+
+; Name of the skin
+;portalSkin = pastel
+; Modules displayed
+;portalDisplayLogout = 1
+;portalDisplayResetPassword = 1
+;portalDisplayChangePassword = 1
+;portalDisplayAppslist = 1
+;portalDisplayLoginHistory = 1
+; Require the old password when changing password
+;portalRequireOldPassword = 1
+; Attribute displayed as connected user
+;portalUserAttr = mail
+; Old menu HTML code
+; Enable it if you use old templates
+;useOldMenuItems=1
+; Override error codes
+;error_0 = You are well authenticated!
+; Custom template parameters
+; For example to use <TMPL_VAR NAME="myparam">
+;tpl_myparam = test
+
+; COMBINATION FORMS
+; If you want to fix forms to display, you can use this;
+;combinationForms = standardform, yubikeyform
+
+;syslog = auth
+; SOAP FUNCTIONS
+; Remove comment to activate SOAP Functions getCookies(user,pwd) and
+; error(language, code)
+;Soap = 1
+; Note that getAttibutes() will be activated but on a different URI
+; (http://auth.fpov.space/sessions)
+; You can also restrict attributes and macros exported by getAttributes
+;exportedAttr = uid mail
+
+; PASSWORD POLICY
+; Remove comment to use LDAP Password Policy
+;ldapPpolicyControl = 1
+; Remove comment to store password in session (use with caution)
+;storePassword = 1
+; Remove comment to use LDAP modify password extension
+; (beware of compatibility with LDAP Password Policy)
+;ldapSetPassword    = 1
+; RESET PASSWORD BY MAIL
+; SMTP server (default to localhost), set to '' to use default mail service
+;SMTPServer = localhost
+; SMTP auth user
+;SMTPAuthUser = toto
+; SMTP auth password
+;SMTPAuthPass = secret
+; Mail From address
+;mailFrom = noreply@example.com
+; Reply To
+;mailReplyTo = noreply@example.com
+; Mail confirmation URL
+;mailUrl = http://reset.fpov.space
+; Mail subject for confirmation message
+;mailConfirmSubject = [LemonLDAP::NG] Password reset confirmation
+; Mail body for confiramtion (can use $url for confirmation URL, and other session
+; infos, like $cn). Keep comment to use HTML templates
+;mailConfirmBody = Hello $cn,\n\nClick here to receive your new password: $url
+; Mail subject for new password message
+;mailSubject = [LemonLDAP::NG] Your new password
+; Mail body for new password (can use $password for generated password, and other session
+; infos, like $cn). Keep comment to use HTML templates
+;mailBody = Hello $cn,\n\nYour new password is $password
+; LDAP filter to use
+;mailLDAPFilter = '(&(mail=$mail)(objectClass=inetOrgPerson))'
+; Random regexp for password generation
+;randomPasswordRegexp = [A-Z]{3}[a-z]{5}.\d{2}
+; LDAP GROUPS
+; Set the base DN of your groups branch
+;ldapGroupBase = ou=groups,dc=example,dc=com
+; Objectclass used by groups
+;ldapGroupObjectClass = groupOfUniqueNames
+; Attribute used by groups to store member
+;ldapGroupAttributeName = uniqueMember
+; Attribute used by user to link to groups
+;ldapGroupAttributeNameUser = dn
+; Attribute used to identify a group. The group will be displayed as
+; cn|mail|status, where cn, mail and status will be replaced by their
+; values.
+;ldapGroupAttributeNameSearch = cn mail
+
+; NOTIFICATIONS SERVICE
+; Use it to be able to notify messages during authentication
+;notification = 1
+; Note that the SOAP function newNotification will be activated on
+; http://auth.fpov.space/notification
+; If you want to hide this, just protect "/index.fcgi/notification" in
+; your Apache configuration file
+; XSS protection bypass
+; By default, the portal refuses redirections that come from sites not
+; registered in the configuration (manager) except for those coming
+; from trusted domains. By default, trustedDomains contains the domain
+; declared in the manager. You can set trustedDomains to empty value so
+; that, undeclared sites will be rejected. You can also set here a list
+; of trusted domains or hosts separated by spaces. This is usefull if
+; your website use LemonLDAP::NG without handler with SOAP functions.
+;trustedDomains = my.trusted.host example2.com
+
+; Check XSS
+; Set to 0 to disable error on XSS attack detection
+;checkXSS = 0
+
+; pdata cookie domain
+; pdata cookie could not be sent with cross domains AJAX request
+; Null is default value
+;pdataDomain = example.com
+
+; CUSTOM PLUGINS
+; If you want to add custom plugins, set list here (comma separated)
+; Read Lemonldap::NG::Portal::Main::Plugin(3pm) man page.
+;customPlugins = ::My::Package1, ::My::Package2
+
+; To avoid bad/expired OTT if "authssl" and "auth" are served by different Load Balancers
+; you can override OTT configuration to store Upgrade or Issuer OTT into global storage
+;forceGlobalStorageUpgradeOTT = 1
+;forceGlobalStorageIssuerOTT = 1
+
+[handler]
+
+; Handler cache configuration
+; You can overwrite here local session cache settings in manager:
+;          localSessionStorage=Cache::FileCache
+;          localSessionStorageOptions={                         \
+;              'namespace'          => 'lemonldap-ng-sessions', \
+;              'default_expires_in' => 600,                     \
+;              'directory_umask'    => '007',                   \
+;              'cache_root'         => '/var/cache/lemonldap-ng',          \
+;              'cache_depth'        => 3,                       \
+;          }
+
+; Set https to 1 if your handler protect a https website (used only for
+; redirections to the portal)
+;https = 0
+; Set port if your handler protects a website on a non standard port
+; - 80 for http, 443 for https (used only for redirections to the portal)
+;port = 8080
+; Set status to 1 if you want to have the report of activity (used for
+; example to inform MRTG)
+status = 0
+; Set useRedirectOnForbidden to 1 if you want to use REDIRECT and not FORBIDDEN
+; when a user is not allowed by Handler
+;useRedirectOnForbidden = 1
+; Hide LemonLDAP::NG Handler in Apache Server Signature
+;hideSignature = 1
+; Set ServiceToken timeout
+;handlerServiceTokenTTL = 30
+; Set Impersonation/ContextSwitching prefix
+; impersonationPrefix = real_
+useRedirectOnError = 1
+
+; Zimbra Handler parameters
+;zimbraPreAuthKey = XXXX
+;zimbraAccountKey = uid
+;zimbraBy =id
+;zimbraUrl = /service/preauth
+;zimbraSsoUrl = ^/zimbrasso$
+
+[manager]
+
+; Manager protection: by default, the manager is protected by a demo account.
+; You can protect it :
+; * by Apache itself,
+; * by the parameter 'protection' which can take one of the following
+; values :
+;   * authenticate : all authenticated users can access
+;   * manager      : manager is protected like other virtual hosts: you
+;                    have to set rules in the corresponding virtual host
+;   * <rule>       : you can set here directly the rule to apply
+;   * none         : no protection
+protection   = manager
+
+; staticPrefix: relative (or URL) location of static HTML components
+staticPrefix = /static
+; docPrefix: relative (or URL) location of embedded documentation
+docPrefix = /doc
+
+; instanceName: Display LLNG instance name
+;instanceName = Demo
+; customCSS: CSS file to customize Manager
+;customCSS = css/custom.css
+; customPortalUrl: Override Portal drop-down menu links
+;customPortalUrl = http://external-portal.internal.com
+
+; location of HTML templates directory
+templateDir  = /usr/share/lemonldap-ng/manager/htdocs/templates
+
+; languages: available languages for manager interface
+languages    = en, fr, it, vi, ar, tr, pl, zh_TW, es, he, pt_BR, ru
+
+; Manager modules enabled
+; Set here the list of modules you want to see in manager interface
+; The first will be used as default module displayed
+;enabledModules = conf, sessions, notifications, 2ndFA, viewer
+enabledModules = conf, sessions, notifications, 2ndFA
+
+; To avoid restricted users to edit configuration, defaulModule MUST be different than 'conf'
+; 'conf' is set by default
+;defaultModule = viewer
+
+; Viewer module allows us to edit configuration in read-only mode
+; Options can be set with specific rules like this :
+;viewerAllowBrowser = $uid eq 'dwho'
+;viewerAllowDiff = $uid ne 'dwho'
+;
+; Viewer options - Default values
+;viewerHiddenKeys = samlIDPMetaDataNodes samlSPMetaDataNodes managerPassword ManagerDn globalStorageOptions persistentStorageOptions
+;viewerAllowBrowser = 0
+;viewerAllowDiff = 0
+
+;[node-handler]
+;
+;This section is for node-lemonldap-ng-handler
+;nodeVhosts = test3.fpov.space, test4.fpov.space

templates/matrix.fpov.space.log.config.j2

@@ -21,7 +21,7 @@ loggers:
 
     
     
-    synapse.storage.SQL:
+    synapse.storage.psycopg2:
         # beware: increasing this to DEBUG will make synapse log sensitive
         # information such as access tokens.
         level: INFO
@@ -34,6 +34,3 @@ root:
 
 
     handlers: [console]
-
-
-disable_existing_loggers: false

templates/turnserver.conf.j2

@@ -0,0 +1,14 @@
+syslog
+
+lt-cred-mech
+use-auth-secret
+static-auth-secret="{{ turn_static_secret }}"
+realm="{{ matrix_domain1 }}"
+
+# cert=/etc/letsencrypt/live/turn.example.org/fullchain.pem
+# pkey=/etc/letsencrypt/live/turn.example.org/privkey.pem
+
+no-udp
+external-ip="{{ public_ipv4 }}"
+min-port=64000
+max-port=65535

vars/vars.yml

@@ -0,0 +1,136 @@
+# --------------------------------------------------------------
+# General
+# --------------------------------------------------------------
+top_domain: fpov.space
+public_ipv4: "15.204.117.53"
+matrix_domain1: "matrix.fpov.space"
+site_domain: "org.fpov.space"
+teamspeak_domain: "ts.fpov.space"     
+turn_domain: "turn.fpov.space"
+matrix_email: "boxswappers@gmail.com"
+admin_domain: "mtxadm.fpov.space"
+element_domain: "element.fpov.space"
+ldap_manager_hostname: "manager.fpov.space"
+ldap_handler_hostname: "reload.fpov.space"
+ldap_portal_hostname: "auth.fpov.space"
+# --------------------------------------------------------------
+# Ports
+# --------------------------------------------------------------
+traefik_http_port: 80
+traefik_https_port: 443
+
+# --- TURN -------------------------------------------------------
+turn_listen_port: 3478
+turn_tls_port: 5349
+turn_secret: "7A9F2C4E1B8D6035A2F7E9C1B4D68053"
+turn_static_secret: "fordeathyoudietoday"
+
+# --- Synapse ----------------------------------------------------
+synapse_http_port: 8008
+synapse_api_port: 8448
+
+# --- Matrix ------------------------------------------------------
+registration_shared_secret: "1KFs@=d&l6BGPD0GAwa55ePu+bF7Vgtk@~x#l3tQyKl#_q0etp"
+macaroon_secret_key: "5GongrU~_kQ9L1-f.nU21sdiz~e63+Wwq;iS7XdPA2giDqZ#xH"
+form_secret: "Ubwo=AThaygGi0iySK*H4i9xUOORCQM#eDMd@E,DqW3DcfqYJG"
+matrix_container_name: "synapse"
+
+# --- Teamspeak ---------------------------------------------------
+teamspeak_container_name: teamspeak
+teamspeak_udp_port: 9987          # voice (UDP) – exposed directly on the host
+teamspeak_tcp_port: 10011         # query (TCP) – will be routed via Traefik
+teamspeak_file_port: 30033        # file‑transfer (TCP) – optional, expose directly
+
+#----Postgres-----------------------------------------------------
+postgres_db: synapse
+postgres_user: mMwHLfdO6tz5N
+postgres_pw: 9mKeSFE7tH2eY
+
+# --------------------------------------------------------------
+# Container images
+# --------------------------------------------------------------
+db_image: "docker.io/postgres:16-alpine"
+traefik_image: "docker.io/traefik:latest"
+turn_image:    "docker.io/coturn/coturn:latest"
+synapse_image: "docker.io/matrixdotorg/synapse:latest"
+nginx_image:   "docker.io/nginx:latest"
+npm_image: "docker.io/jc21/nginx-proxy-manager:latest"
+teamspeak_image: "docker.io/teamspeak:latest"
+synapse_admin_image: "docker.io/awesometechnologies/synapse-admin:latest"
+element_image: "docker.io/vectorim/element-web:latest"
+lemonldap_image: "docker.io/lemonldapng/lemonldap-ng:latest"
+
+
+# --------------------------------------------------------------
+# Podman names & volumes
+# --------------------------------------------------------------
+podman_network: matrix_net
+vol_traefik:   traefik_data
+vol_synapse:   synapse_config
+vol_media:    synapse_media
+vol_turn:      turn_data
+vol_nginx:     nginx_html
+vol_teamspeak: teamspeak_data   
+npm_data: npm_data
+npm_letsencrypt: letsencrypt  
+vol_db: postgres_db   
+lemonldap_data: ldap_data
+lemonldap_cfg: ldap_cfg
+lemonldap_lib: ldap_lib
+lemonldap_nginx: ldap_nginx
+
+# --------------------------------------------------------------
+# Paths on the target host (temporary files)
+# --------------------------------------------------------------
+static_traefik_path: "/tmp/traefik_static.toml"
+dynamic_traefik_path: "/tmp/traefik_dynamic.yml"
+turn_conf_path:       "/tmp/turnserver.conf"
+synapse_cfg_path:     "/tmp/homeserver.yaml"
+nginx_html_path:      "/tmp/index.html"
+synapse_secret_key_path: "/tmp/matrix.fpov.space.signing.key"
+synapse_log_config: "/tmp/matrix.fpov.space.log.config"
+element_config_path: "/tmp/config.json"
+
+# -----------------------------------------------------------------
+# Synapse Admin
+#------------------------------------------------------------------
+admin_container_name: mtxadm
+
+#------------------------------------------------------------------
+# Element App
+#------------------------------------------------------------------
+element_brand: "FPoV Chat"
+element_container_name: "element"
+# -----------------------------------------------------------------
+# Google OAuth2 (OpenID Connect) credentials
+# -----------------------------------------------------------------
+google_oidc_client_id: "YOUR_GOOGLE_CLIENT_ID"
+google_oidc_client_secret: "YOUR_GOOGLE_CLIENT_SECRET"
+
+# Optional – the scopes you want to request (the default works for most cases)
+google_oidc_scopes:
+  - openid
+  - email
+  - profile
+
+# --------------------------------------------------------------
+# Landing page HTML
+# --------------------------------------------------------------
+matrix_domain: "matrix.example.com"
+landing_title: "Welcome to {{ matrix_domain }}"   # you can embed other vars here
+landing_tagline: "Matrix + Traefik + Teamspeak – all in one stack"
+landing_message: |
+  This host runs a Matrix homeserver (Synapse), a reverse-proxy (Traefik) with
+  automatic Let’s Encrypt certificates, a TURN server for voice/video, and a
+  simple landing page.
+
+# --------------------------------------------------------------
+# Lemon LDAP
+# --------------------------------------------------------------
+lemonldap_container_name: "lemon"
+lemonldap_http_port: "8118"
+lemonldap_https_port: "444"
+lemonldap_port: "80"
+lemonldap_cgi_port: "9000"
+
+ldap_ssodomain: "auth.fpov.space"