57 lines
1.8 KiB
Markdown
57 lines
1.8 KiB
Markdown
deploy playbook after setup
|
||
```
|
||
ansible-playbook playbook.yml --ask-vault-pass
|
||
```
|
||
|
||
Check containers
|
||
```
|
||
ssh matrix.example.com
|
||
sudo podman ps
|
||
sudo podman logs synapse
|
||
```
|
||
|
||
test federation
|
||
```
|
||
curl https://{{ matrix_domain }}/_matrix/federation/v1/version
|
||
```
|
||
|
||
|
||
|
||
|
||
| Area | Recommendation |
|
||
|------|----------------|
|
||
| **TLS** | Use Certbot + Nginx plugin (`community.general.acme` Ansible module) |
|
||
| **Secrets** | Store DB passwords, secrets in **Ansible Vault** |
|
||
| **Updates** | Use `container_image: tag` with version pins (e.g., `v1.100.0`) |
|
||
| **Monitoring** | Add Prometheus metrics (`enable_metrics: true`) |
|
||
| **Coturn** | Deploy `coturn` (STUN/TURN) as separate container if needed |
|
||
| **Backups** | Backup `/var/lib/matrix-synapse` regularly |
|
||
| **Rootless Podman** | Use `podman user` namespaces + `podman system migrate` for portability |
|
||
|
||
|
||
## Using Hugo to create site ##
|
||
```
|
||
# Create & build site locally (run ON CONTROL NODE)
|
||
hugo new site mysite
|
||
cd mysite
|
||
echo 'theme = "ananke"' >> config.toml
|
||
hugo new posts/my-first-post.md
|
||
hugo # builds to /public
|
||
cp -r public ../fpov/roles/nginx-proxy/files/mysite/
|
||
```
|
||
|
||
1. Host boots: Podman creates pod with ports 80, 443, 8008, 8448 open.
|
||
2. Nginx starts, runs certbot-entrypoint.sh:
|
||
- Checks for /etc/letsencrypt/live/matrix.example.com
|
||
- If missing → runs certbot certonly --standalone on port 8080
|
||
- Writes certs to /etc/letsencrypt
|
||
3. Nginx loads TLS certs, serves static site + proxies /_matrix/
|
||
4. User visits https://matrix.example.com → gets your Hugo site.
|
||
5. User visits https://matrix.example.com/_matrix/client → gets Synapse.
|
||
6. ACME renewal: Certbot’s renew is dry-run on each start (you can also add cron via systemd unit if needed).
|
||
|
||
Certificate renewal
|
||
```
|
||
# /etc/cron.d/certbot-renew
|
||
0 3 * * * root podman exec nginx-matrix certbot renew --quiet
|
||
``` |