94 lines
2.8 KiB
YAML
94 lines
2.8 KiB
YAML
- name: Generate signing key (if missing)
|
|
command: >
|
|
podman run --rm -v "{{ synapse_data_dir }}:/data"
|
|
ghcr.io/element-hq/synapse:latest
|
|
generate-config --server-name "{{ matrix_domain }}"
|
|
--report-stats no
|
|
-o /data/homeserver.yaml
|
|
args:
|
|
creates: "{{ synapse_data_dir }}/homeserver.yaml"
|
|
|
|
- name: Copy homeserver.yaml (configured)
|
|
template:
|
|
src: synapse/homeserver.yaml.j2
|
|
dest: "{{ synapse_data_dir }}/homeserver.yaml"
|
|
owner: "{{ podman_user }}"
|
|
group: "{{ podman_user }}"
|
|
mode: '0644'
|
|
|
|
- name: Ensure PostgreSQL database exists
|
|
become_user: postgres
|
|
community.postgresql.postgresql_db:
|
|
name: "{{ db_name }}"
|
|
state: present
|
|
delegate_to: "{{ inventory_hostname }}" # assuming DB on same host
|
|
|
|
- name: Ensure PostgreSQL user exists
|
|
become_user: postgres
|
|
community.postgresql.postgresql_user:
|
|
name: "{{ db_user }}"
|
|
password: "{{ db_pass }}"
|
|
priv: "{{ db_name }}.*:ALL"
|
|
state: present
|
|
delegate_to: "{{ inventory_hostname }}"
|
|
|
|
- name: Create Podman pod
|
|
command: >
|
|
podman pod create
|
|
--name {{ podman_pod_name }}
|
|
--publish 8008:8008 # synapse
|
|
--publish 8448:8448 # federation
|
|
when: podman_user != "root"
|
|
changed_when: false
|
|
|
|
- name: Run PostgreSQL container
|
|
container:
|
|
name: synapse-db
|
|
image: docker.io/library/postgres:15-alpine
|
|
state: started
|
|
restart_policy: unless-stopped
|
|
pod: "{{ podman_pod_name }}"
|
|
env:
|
|
POSTGRES_DB: "{{ db_name }}"
|
|
POSTGRES_USER: "{{ db_user }}"
|
|
POSTGRES_PASSWORD: "{{ db_pass }}"
|
|
volumes:
|
|
- "{{ synapse_data_dir }}/db:/var/lib/postgresql/data"
|
|
register: pg_cont
|
|
|
|
- name: Run Synapse container
|
|
container:
|
|
name: synapse
|
|
image: ghcr.io/element-hq/synapse:latest
|
|
state: started
|
|
restart_policy: unless-stopped
|
|
pod: "{{ podman_pod_name }}"
|
|
volumes:
|
|
- "{{ synapse_data_dir }}:/data"
|
|
command: >
|
|
-c /data/homeserver.yaml
|
|
#----- Coturn + Synapse
|
|
- name: Run Coturn container (STUN/TURN server)
|
|
container:
|
|
name: coturn
|
|
image: coturn/coturn:latest
|
|
state: started
|
|
restart_policy: unless-stopped
|
|
pod: "{{ podman_pod_name }}"
|
|
env:
|
|
LISTENING_PORT: "3478"
|
|
ALTERNATE_LISTENING_PORT: "5349"
|
|
RELAY_ADDRESS: "{{ ansible_default_ipv4.address }}" # or your server IP
|
|
EXTERNAL_IP: "{{ ansible_default_ipv4.address }}"
|
|
# Shared secret for dynamic credentials
|
|
TURNSERVER_STATIC_AUTH_SECRET: "{{ coturn_shared_secret }}"
|
|
# Enable TLS
|
|
TURNSERVER_TLS_LISTENING_PORT: "5349"
|
|
TURNSERVER_CERT: "/etc/turnserver/tls.crt"
|
|
TURNSERVER_PKEY: "/etc/turnserver/tls.key"
|
|
NO_AUTH_TIMESTAMPS: "true"
|
|
REALM: "{{ matrix_domain }}"
|
|
# Mount TLS certs (same as Nginx) if you want encrypted TURN (recommended)
|
|
volumes:
|
|
- "/var/lib/matrix-nginx/certbot/live/{{ matrix_domain }}:/etc/turnserver:ro"
|
|
register: coturn_cont |