Add WIP Synapse configuration

coreos-config/roles/compose_project/templates/blog/docker-compose.yaml

@@ -6,7 +6,7 @@ services:
     image: registry.tobiasmanske.de/tobiasmanske.de:latest
     labels:
       - "traefik.enable=true"
-      - "traefik.http.routers.tobiasmanskede.rule=Host(`tobiasmanske.de`) || Host(`www.tobiasmanske.de`)"
+      - "traefik.http.routers.tobiasmanskede.rule=(Host(`tobiasmanske.de`) || Host(`www.tobiasmanske.de`)) && !PathPrefix(`/{path:(_matrix|_synapse|.well-known/matrix)}/`)"
       - "traefik.http.routers.tobiasmanskede.entryPoints=websecure"
       - "traefik.http.services.tobiasmanskede.loadbalancer.server.port=80"
     restart: always

coreos-config/roles/compose_project/templates/matrix/.env

@@ -0,0 +1 @@
+COMPOSE_PROJECT_NAME=matrix

coreos-config/roles/compose_project/templates/matrix/docker-compose.yaml

@@ -0,0 +1,79 @@
+---
+version: '3.9'
+
+services:
+
+  synapse:
+    image: matrixdotorg/synapse:latest
+    # Since synapse does not retry to connect to the database, restart upon
+    # failure
+    restart: unless-stopped
+    # See the readme for a full documentation of the environment settings
+    # NOTE: You must edit homeserver.yaml to use postgres, it defaults to sqlite
+    environment:
+      - SYNAPSE_CONFIG_DIR=/config
+      - SYNAPSE_CONFIG_PATH=/config/homeserver.yaml
+      - TZ=Europe/Berlin
+    volumes:
+      - synapse_data:/data
+      - ./synapse-config:/config:ro,Z
+    depends_on:
+      - db
+    networks:
+      - default
+      - gateway
+      - backend
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.matrix-synapse.rule=Host(`{{ matrix.baseurl }}`) && PathPrefix(`/_{path:(matrix|synapse/client)}/`)"
+      - "traefik.http.routers.matrix-synapse.entryPoints=websecure"
+      - "traefik.http.services.matrix-synapse.loadbalancer.server.port=8008"
+
+  db:
+    image: postgres:15
+    restart: always
+    environment:
+      - POSTGRES_USER={{ matrix.db.user }}
+      - POSTGRES_DB={{ matrix.db.database }}
+      - POSTGRES_PASSWORD={{ matrix.db.password }}
+      - POSTGRES_INITDB_ARGS=--encoding=UTF-8 --lc-collate=C --lc-ctype=C
+    volumes:
+      - db_data:/var/lib/postgresql/data
+    networks:
+      - backend
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+
+  nginx:
+    # FIXME: This could be caddyv2
+    image: nginx:stable
+    restart: unless-stopped
+    volumes:
+      - ./nginx-well-known.conf:/etc/nginx/conf.d/matrix.conf:ro,Z
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.matrix-well-known.rule=Host(`{{ matrix.baseurl }}`) && PathPrefix(`/.well-known/matrix/`)"
+      - "traefik.http.routers.matrix-well-known.entrypoints=websecure"
+      - "traefik.http.services.matrix-well-known.loadbalancer.server.port=80"
+    networks:
+      - gateway
+
+  redis:
+    image: redis:6.2.1
+    restart: unless-stopped
+    networks:
+      - backend
+
+networks:
+  backend:
+    internal: true
+  gateway:
+    external: true
+
+volumes:
+  synapse_data:
+  db_data:
+...

coreos-config/roles/compose_project/templates/matrix/nginx-well-known.conf

@@ -0,0 +1,15 @@
+server {
+    listen 80;
+    server_name {{ matrix.baseurl }};
+    location /.well-known/matrix/client {
+        return 200 '{"m.homeserver": {"base_url": "https://{{ matrix.baseurl }}"} }';
+        default_type application/json;
+        add_header Access-Control-Allow-Origin *;
+    }
+    location /.well-known/matrix/server {
+        return 200 '{"m.server": "synapse.{{ matrix.baseurl }}:443" }';
+        default_type application/json;
+        add_header Access-Control-Allow-Origin *;
+    }
+}
+

coreos-config/roles/compose_project/templates/matrix/synapse-config/homeserver.yaml

@@ -0,0 +1,65 @@
+# Configuration file for Synapse.
+#
+# This is a YAML file: see [1] for a quick introduction. Note in particular
+# that *indentation is important*: all the elements of a list or dictionary
+# should have the same indentation.
+#
+# [1] https://docs.ansible.com/ansible/latest/reference_appendices/YAMLSyntax.html
+#
+# For more information on how to configure Synapse, including a complete accounting of
+# each option, go to docs/usage/configuration/config_documentation.md or
+# https://matrix-org.github.io/synapse/latest/usage/configuration/config_documentation.html
+server_name: "tobiasmanske.de"
+pid_file: /data/homeserver.pid
+listeners:
+  - port: 8008
+    tls: false
+    type: http
+    x_forwarded: true
+    resources:
+      - names: [client, federation]
+        compress: false
+database:
+  name: psycopg2
+  args:
+    user: {{ matrix.db.user }}
+    password: {{ matrix.db.password }}
+    database: {{ matrix.db.database }}
+    host: db
+    cp_min: 5
+    cp_max: 10
+log_config: "/config/tobiasmanske.de.log.config"
+media_store_path: /data/media_store
+registration_shared_secret: "{{ matrix.secrets.registration }}"
+report_stats: true
+macaroon_secret_key: "{{ matrix.secrets.macaroon }}"
+form_secret: "{{ matrix.secrets.form }}"
+signing_key_path: "/config/tobiasmanske.de.signing.key"
+trusted_key_servers:
+  - server_name: "matrix.org"
+oidc_providers:
+  - idp_id: keycloak
+    idp_name: "KeyCloak"
+    issuer: "{{ matrix.oidc.issuer }}"
+    client_id: "{{ matrix.oidc.client_id }}"
+    client_secret: "{{ matrix.oidc.client_secret }}"
+    scopes: ["openid", "profile"]
+    user_mapping_provider:
+      config:
+{% raw %}
+        localpart_template: "{{ user.preferred_username }}"
+        display_name_template: "{{ user.name }}"
+{% endraw %}
+    backchannel_logout_enabled: true # Optional
+
+enable_registration: false
+password_config:
+  enabled: false
+
+redis:
+  enabled: true
+  host: redis
+  port: 6379
+
+
+# vim:ft=yaml

coreos-config/roles/compose_project/templates/matrix/synapse-config/tobiasmanske.de.log.config

@@ -0,0 +1,32 @@
+version: 1
+
+formatters:
+  precise:
+    
+    format: '%(asctime)s - %(name)s - %(lineno)d - %(levelname)s - %(request)s - %(message)s'
+    
+
+handlers:
+
+
+  console:
+    class: logging.StreamHandler
+    formatter: precise
+
+
+
+loggers:
+    synapse.storage.SQL:
+        # beware: increasing this to DEBUG will make synapse log sensitive
+        # information such as access tokens.
+        level: INFO
+
+
+root:
+    level: INFO
+
+
+    handlers: [console]
+
+
+disable_existing_loggers: false

coreos-config/roles/compose_project/templates/matrix/synapse-config/tobiasmanske.de.signing.key

@@ -0,0 +1,8 @@
+$ANSIBLE_VAULT;1.2;AES256;secrets
+64326434386632376335333966336365333663393130323464333266383639383264616662623333
+6437306539633766376336663263393038306162333234340a383237386331636366616266316265
+39626638623562623835633035643231656263653437346266333264643830323062353930356462
+3936633165633434320a656463656536383539346138383630343137383861613538323735393131
+61383237626533316433633866396434663230633239396661333831653531363732646561656164
+35353264613364613832653536333632356132666434616134316339383934616264323261366366
+633838383264646531663039343639383036