From ae759bd86e5205982574962132381e6153627b16 Mon Sep 17 00:00:00 2001 From: Michael Hollister Date: Sat, 16 Dec 2023 14:27:41 -0600 Subject: [PATCH 1/6] Added missing MMR federation directives --- .../nginx/conf.d/matrix-domain.conf.j2 | 93 +++++++++++++++++++ 1 file changed, 93 insertions(+) diff --git a/roles/custom/matrix-nginx-proxy/templates/nginx/conf.d/matrix-domain.conf.j2 b/roles/custom/matrix-nginx-proxy/templates/nginx/conf.d/matrix-domain.conf.j2 index 01224e0fb..cbaf5ead1 100644 --- a/roles/custom/matrix-nginx-proxy/templates/nginx/conf.d/matrix-domain.conf.j2 +++ b/roles/custom/matrix-nginx-proxy/templates/nginx/conf.d/matrix-domain.conf.j2 @@ -390,6 +390,99 @@ server { ssl_session_timeout {{ matrix_nginx_proxy_ssl_session_timeout }}; {% endif %} + {% if matrix_nginx_proxy_proxy_media_repo_enabled %} + # Redirect all media endpoints to the media-repo + location ^~ /_matrix/media { + {% if matrix_nginx_proxy_enabled %} + {# Use the embedded DNS resolver in Docker containers to discover the service #} + resolver {{ matrix_nginx_proxy_http_level_resolver }} valid=5s; + set $backend "{{ matrix_nginx_proxy_proxy_media_repo_addr_with_container }}"; + proxy_pass http://$backend; + {% else %} + {# Generic configuration for use outside of our container setup #} + proxy_pass http://{{ matrix_nginx_proxy_proxy_media_repo_addr_sans_container }}; + {% endif %} + + # Make sure this matches your homeserver in media-repo.yaml + # You may have to manually specify it if using delegation or the + # incoming Host doesn't match. + proxy_set_header Host $host; + + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $remote_addr; + + client_body_buffer_size {{ ((matrix_media_repo_max_bytes | int) / 4) | int }}; + client_max_body_size {{ matrix_media_repo_max_bytes }}; + } + + # Redirect other endpoints registered by the media-repo to its container + # /_matrix/client/r0/logout + # /_matrix/client/r0/logout/all + location ~ ^/_matrix/client/(r0|v1|v3|unstable)/(logout|logout/all) { + {% if matrix_nginx_proxy_enabled %} + {# Use the embedded DNS resolver in Docker containers to discover the service #} + resolver {{ matrix_nginx_proxy_http_level_resolver }} valid=5s; + set $backend "{{ matrix_nginx_proxy_proxy_media_repo_addr_with_container }}"; + proxy_pass http://$backend; + {% else %} + {# Generic configuration for use outside of our container setup #} + proxy_pass http://{{ matrix_nginx_proxy_proxy_media_repo_addr_sans_container }}; + {% endif %} + + # Make sure this matches your homeserver in media-repo.yaml + # You may have to manually specify it if using delegation or the + # incoming Host doesn't match. + proxy_set_header Host $host; + + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $remote_addr; + } + + # Redirect other endpoints registered by the media-repo to its container + # /_matrix/client/r0/admin/purge_media_cache + # /_matrix/client/r0/admin/quarantine_media/{roomId:[^/]+} + location ~ ^/_matrix/client/(r0|v1|v3|unstable)/admin/(purge_media_cache|quarantine_media/.*) { + {% if matrix_nginx_proxy_enabled %} + {# Use the embedded DNS resolver in Docker containers to discover the service #} + resolver {{ matrix_nginx_proxy_http_level_resolver }} valid=5s; + set $backend "{{ matrix_nginx_proxy_proxy_media_repo_addr_with_container }}"; + proxy_pass http://$backend; + {% else %} + {# Generic configuration for use outside of our container setup #} + proxy_pass http://{{ matrix_nginx_proxy_proxy_media_repo_addr_sans_container }}; + {% endif %} + + # Make sure this matches your homeserver in media-repo.yaml + # You may have to manually specify it if using delegation or the + # incoming Host doesn't match. + proxy_set_header Host $host; + + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $remote_addr; + } + + # Redirect other endpoints registered by the media-repo to its container + location ^~ /_matrix/client/unstable/io.t2bot.media { + {% if matrix_nginx_proxy_enabled %} + {# Use the embedded DNS resolver in Docker containers to discover the service #} + resolver {{ matrix_nginx_proxy_http_level_resolver }} valid=5s; + set $backend "{{ matrix_nginx_proxy_proxy_media_repo_addr_with_container }}"; + proxy_pass http://$backend; + {% else %} + {# Generic configuration for use outside of our container setup #} + proxy_pass http://{{ matrix_nginx_proxy_proxy_media_repo_addr_sans_container }}; + {% endif %} + + # Make sure this matches your homeserver in media-repo.yaml + # You may have to manually specify it if using delegation or the + # incoming Host doesn't match. + proxy_set_header Host $host; + + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $remote_addr; + } + {% endif %} + location / { {% if matrix_nginx_proxy_enabled %} {# Use the embedded DNS resolver in Docker containers to discover the service #} From 805280355cc6044d85c1c394b468cda12ad7e7b6 Mon Sep 17 00:00:00 2001 From: Michael Hollister Date: Sat, 16 Dec 2023 16:52:04 -0600 Subject: [PATCH 2/6] Changed mxc links to matrix_domain instead of matrix_server_fqn_matrix --- roles/custom/matrix-media-repo/defaults/main.yml | 2 +- .../templates/nginx/conf.d/matrix-domain.conf.j2 | 16 ++++++++-------- 2 files changed, 9 insertions(+), 9 deletions(-) diff --git a/roles/custom/matrix-media-repo/defaults/main.yml b/roles/custom/matrix-media-repo/defaults/main.yml index 8aada0896..31bf4bd5b 100644 --- a/roles/custom/matrix-media-repo/defaults/main.yml +++ b/roles/custom/matrix-media-repo/defaults/main.yml @@ -153,7 +153,7 @@ matrix_media_repo_homeservers_auto: # This should match the server_name of your homeserver, and the Host header # provided to the media repo. - name: "{{ matrix_server_fqn_matrix }}" + name: "{{ matrix_domain }}" # The base URL to where the homeserver can actually be reached by MMR. csApi: "http://{{ matrix_nginx_proxy_proxy_matrix_client_api_addr_with_container }}" diff --git a/roles/custom/matrix-nginx-proxy/templates/nginx/conf.d/matrix-domain.conf.j2 b/roles/custom/matrix-nginx-proxy/templates/nginx/conf.d/matrix-domain.conf.j2 index cbaf5ead1..d9e2d1037 100644 --- a/roles/custom/matrix-nginx-proxy/templates/nginx/conf.d/matrix-domain.conf.j2 +++ b/roles/custom/matrix-nginx-proxy/templates/nginx/conf.d/matrix-domain.conf.j2 @@ -110,7 +110,7 @@ # Make sure this matches your homeserver in media-repo.yaml # You may have to manually specify it if using delegation or the # incoming Host doesn't match. - proxy_set_header Host $host; + proxy_set_header Host {{ matrix_domain }}; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $remote_addr; @@ -136,7 +136,7 @@ # Make sure this matches your homeserver in media-repo.yaml # You may have to manually specify it if using delegation or the # incoming Host doesn't match. - proxy_set_header Host $host; + proxy_set_header Host {{ matrix_domain }}; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $remote_addr; @@ -159,7 +159,7 @@ # Make sure this matches your homeserver in media-repo.yaml # You may have to manually specify it if using delegation or the # incoming Host doesn't match. - proxy_set_header Host $host; + proxy_set_header Host {{ matrix_domain }}; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $remote_addr; @@ -180,7 +180,7 @@ # Make sure this matches your homeserver in media-repo.yaml # You may have to manually specify it if using delegation or the # incoming Host doesn't match. - proxy_set_header Host $host; + proxy_set_header Host {{ matrix_domain }}; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $remote_addr; @@ -406,7 +406,7 @@ server { # Make sure this matches your homeserver in media-repo.yaml # You may have to manually specify it if using delegation or the # incoming Host doesn't match. - proxy_set_header Host $host; + proxy_set_header Host {{ matrix_domain }}; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $remote_addr; @@ -432,7 +432,7 @@ server { # Make sure this matches your homeserver in media-repo.yaml # You may have to manually specify it if using delegation or the # incoming Host doesn't match. - proxy_set_header Host $host; + proxy_set_header Host {{ matrix_domain }}; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $remote_addr; @@ -455,7 +455,7 @@ server { # Make sure this matches your homeserver in media-repo.yaml # You may have to manually specify it if using delegation or the # incoming Host doesn't match. - proxy_set_header Host $host; + proxy_set_header Host {{ matrix_domain }}; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $remote_addr; @@ -476,7 +476,7 @@ server { # Make sure this matches your homeserver in media-repo.yaml # You may have to manually specify it if using delegation or the # incoming Host doesn't match. - proxy_set_header Host $host; + proxy_set_header Host {{ matrix_domain }}; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $remote_addr; From 0908c6b662caa6a9b7c0e3b49d7978d29348141b Mon Sep 17 00:00:00 2001 From: Michael Hollister Date: Wed, 20 Dec 2023 13:38:46 -0600 Subject: [PATCH 3/6] Added Traefik support to MMR --- group_vars/matrix_servers | 17 +- .../matrix-media-repo/defaults/main.yml | 93 ++++++++++- .../matrix-media-repo/tasks/setup_install.yml | 1 + .../templates/media-repo/labels.j2 | 147 ++++++++++++++++++ .../systemd/matrix-media-repo.service.j2 | 3 +- 5 files changed, 256 insertions(+), 5 deletions(-) mode change 100644 => 100755 roles/custom/matrix-media-repo/defaults/main.yml mode change 100644 => 100755 roles/custom/matrix-media-repo/tasks/setup_install.yml create mode 100755 roles/custom/matrix-media-repo/templates/media-repo/labels.j2 mode change 100644 => 100755 roles/custom/matrix-media-repo/templates/media-repo/systemd/matrix-media-repo.service.j2 diff --git a/group_vars/matrix_servers b/group_vars/matrix_servers index 5b3cc8244..d7f60275b 100755 --- a/group_vars/matrix_servers +++ b/group_vars/matrix_servers @@ -2693,10 +2693,21 @@ matrix_ma1sd_database_password: "{{ '%s' | format(matrix_homeserver_generic_secr # ###################################################################### -matrix_media_repo_enabled: false -matrix_media_repo_container_network: "{{ matrix_docker_network }}" +matrix_media_repo_identifier: matrix-media-repo -matrix_media_repo_container_labels_traefik_enabled: false +matrix_media_repo_enabled: false +matrix_media_repo_container_network: "{{ matrix_nginx_proxy_container_network if matrix_playbook_reverse_proxy_type == 'playbook-managed-nginx' else matrix_media_repo_identifier }}" + +matrix_media_repo_container_additional_networks: | + {{ + ( + ([matrix_playbook_reverse_proxyable_services_additional_network] if matrix_playbook_reverse_proxyable_services_additional_network else []) + + + ([devture_postgres_container_network] if devture_postgres_enabled and devture_postgres_container_network != matrix_media_repo_container_network else []) + ) | unique + }} + +matrix_media_repo_container_labels_traefik_enabled: "{{ matrix_playbook_traefik_labels_enabled }}" matrix_media_repo_container_labels_traefik_docker_network: "{{ matrix_playbook_reverse_proxyable_services_additional_network }}" matrix_media_repo_container_labels_traefik_entrypoints: "{{ devture_traefik_entrypoint_primary }}" matrix_media_repo_container_labels_traefik_tls_certResolver: "{{ devture_traefik_certResolver_primary }}" diff --git a/roles/custom/matrix-media-repo/defaults/main.yml b/roles/custom/matrix-media-repo/defaults/main.yml old mode 100644 new mode 100755 index 31bf4bd5b..194012ea9 --- a/roles/custom/matrix-media-repo/defaults/main.yml +++ b/roles/custom/matrix-media-repo/defaults/main.yml @@ -34,7 +34,7 @@ matrix_media_repo_systemd_required_services_list: ["docker.service"] matrix_media_repo_systemd_wanted_services_list: [] # The base container network. It will be auto-created by this role if it doesn't exist already. -matrix_media_repo_container_network: "{{ matrix_docker_network }}" +matrix_media_repo_container_network: "{{ matrix_media_repo_identifier }}" # A list of additional container networks that the container would be connected to. # The role does not create these networks, so make sure they already exist. @@ -54,6 +54,97 @@ matrix_media_repo_container_metrics_host_bind_port: "" # Extra arguments for the Docker container matrix_media_repo_container_extra_arguments: [] +# matrix_media_repo_container_labels_traefik_enabled controls whether labels to assist a Traefik reverse-proxy will be attached to the container. +# See `../templates/labels.j2` for details. +# +# To inject your own other container labels, see `matrix_media_repo_container_labels_additional_labels`. +matrix_media_repo_container_labels_traefik_enabled: true +matrix_media_repo_container_labels_traefik_docker_network: "{{ matrix_media_repo_container_network }}" + +matrix_media_repo_container_labels_traefik_media_path_prefix: "/_matrix/media" +matrix_media_repo_container_labels_traefik_media_rule: "Host(`{{ matrix_server_fqn_matrix }}`) && PathPrefix(`{{ matrix_media_repo_container_labels_traefik_media_path_prefix | quote }}`)" +matrix_media_repo_container_labels_traefik_media_priority: 0 +matrix_media_repo_container_labels_traefik_media_entrypoints: web-secure +matrix_media_repo_container_labels_traefik_media_tls: "{{ matrix_media_repo_container_labels_traefik_media_entrypoints != 'web' }}" +matrix_media_repo_container_labels_traefik_media_tls_certResolver: default # noqa var-naming + +# /_matrix/client/r0/logout +# /_matrix/client/r0/logout/all +matrix_media_repo_container_labels_traefik_logout_path_prefix: "/_matrix/client/{version:(r0|v1|v3|unstable)}/{endpoint:(logout|logout/all)}" +matrix_media_repo_container_labels_traefik_logout_rule: "Host(`{{ matrix_server_fqn_matrix }}`) && PathPrefix(`{{ matrix_media_repo_container_labels_traefik_logout_path_prefix }}`)" +matrix_media_repo_container_labels_traefik_logout_priority: 0 +matrix_media_repo_container_labels_traefik_logout_entrypoints: web-secure +matrix_media_repo_container_labels_traefik_logout_tls: "{{ matrix_media_repo_container_labels_traefik_logout_entrypoints != 'web' }}" +matrix_media_repo_container_labels_traefik_logout_tls_certResolver: default # noqa var-naming + +# /_matrix/client/r0/admin/purge_media_cache +# /_matrix/client/r0/admin/quarantine_media/{roomId:[^/]+} +matrix_media_repo_container_labels_traefik_admin_path_prefix: "/_matrix/client/{version:(r0|v1|v3|unstable)}/admin/{endpoint:(purge_media_cache|quarantine_media/.*)}" +matrix_media_repo_container_labels_traefik_admin_rule: "Host(`{{ matrix_server_fqn_matrix }}`) && PathPrefix(`{{ matrix_media_repo_container_labels_traefik_admin_path_prefix }}`)" +matrix_media_repo_container_labels_traefik_admin_priority: 0 +matrix_media_repo_container_labels_traefik_admin_entrypoints: web-secure +matrix_media_repo_container_labels_traefik_admin_tls: "{{ matrix_media_repo_container_labels_traefik_admin_entrypoints != 'web' }}" +matrix_media_repo_container_labels_traefik_admin_tls_certResolver: default # noqa var-naming + +matrix_media_repo_container_labels_traefik_t2bot_path_prefix: "/_matrix/client/unstable/io.t2bot.media" +matrix_media_repo_container_labels_traefik_t2bot_rule: "Host(`{{ matrix_server_fqn_matrix }}`) && PathPrefix(`{{ matrix_media_repo_container_labels_traefik_t2bot_path_prefix | quote }}`)" +matrix_media_repo_container_labels_traefik_t2bot_priority: 0 +matrix_media_repo_container_labels_traefik_t2bot_entrypoints: web-secure +matrix_media_repo_container_labels_traefik_t2bot_tls: "{{ matrix_media_repo_container_labels_traefik_t2bot_entrypoints != 'web' }}" +matrix_media_repo_container_labels_traefik_t2bot_tls_certResolver: default # noqa var-naming + +# Traefik federation labels +matrix_media_repo_container_labels_traefik_media_federation_path_prefix: "/_matrix/media" +matrix_media_repo_container_labels_traefik_media_federation_rule: "Host(`{{ matrix_server_fqn_matrix }}`) && PathPrefix(`{{ matrix_media_repo_container_labels_traefik_media_path_prefix | quote }}`)" +matrix_media_repo_container_labels_traefik_media_federation_priority: 0 +matrix_media_repo_container_labels_traefik_media_federation_entrypoints: "{{ matrix_federation_traefik_entrypoint }}" +matrix_media_repo_container_labels_traefik_media_federation_tls: "{{ matrix_media_repo_container_labels_traefik_media_entrypoints != 'web' }}" +matrix_media_repo_container_labels_traefik_media_federation_tls_certResolver: default # noqa var-naming + +# /_matrix/client/r0/logout +# /_matrix/client/r0/logout/all +matrix_media_repo_container_labels_traefik_logout_federation_path_prefix: "/_matrix/client/{version:(r0|v1|v3|unstable)}/{endpoint:(logout|logout/all)}" +matrix_media_repo_container_labels_traefik_logout_federation_rule: "Host(`{{ matrix_server_fqn_matrix }}`) && PathPrefix(`{{ matrix_media_repo_container_labels_traefik_logout_path_prefix }}`)" +matrix_media_repo_container_labels_traefik_logout_federation_priority: 0 +matrix_media_repo_container_labels_traefik_logout_federation_entrypoints: "{{ matrix_federation_traefik_entrypoint }}" +matrix_media_repo_container_labels_traefik_logout_federation_tls: "{{ matrix_media_repo_container_labels_traefik_logout_entrypoints != 'web' }}" +matrix_media_repo_container_labels_traefik_logout_federation_tls_certResolver: default # noqa var-naming + +# /_matrix/client/r0/admin/purge_media_cache +# /_matrix/client/r0/admin/quarantine_media/{roomId:[^/]+} +matrix_media_repo_container_labels_traefik_admin_federation_path_prefix: "/_matrix/client/{version:(r0|v1|v3|unstable)}/admin/{endpoint:(purge_media_cache|quarantine_media/.*)}" +matrix_media_repo_container_labels_traefik_admin_federation_rule: "Host(`{{ matrix_server_fqn_matrix }}`) && PathPrefix(`{{ matrix_media_repo_container_labels_traefik_admin_path_prefix }}`)" +matrix_media_repo_container_labels_traefik_admin_federation_priority: 0 +matrix_media_repo_container_labels_traefik_admin_federation_entrypoints: "{{ matrix_federation_traefik_entrypoint }}" +matrix_media_repo_container_labels_traefik_admin_federation_tls: "{{ matrix_media_repo_container_labels_traefik_admin_entrypoints != 'web' }}" +matrix_media_repo_container_labels_traefik_admin_federation_tls_certResolver: default # noqa var-naming + +matrix_media_repo_container_labels_traefik_t2bot_federation_path_prefix: "/_matrix/client/unstable/io.t2bot.media" +matrix_media_repo_container_labels_traefik_t2bot_federation_rule: "Host(`{{ matrix_server_fqn_matrix }}`) && PathPrefix(`{{ matrix_media_repo_container_labels_traefik_t2bot_path_prefix | quote }}`)" +matrix_media_repo_container_labels_traefik_t2bot_federation_priority: 0 +matrix_media_repo_container_labels_traefik_t2bot_federation_entrypoints: "{{ matrix_federation_traefik_entrypoint }}" +matrix_media_repo_container_labels_traefik_t2bot_federation_tls: "{{ matrix_media_repo_container_labels_traefik_t2bot_entrypoints != 'web' }}" +matrix_media_repo_container_labels_traefik_t2bot_federation_tls_certResolver: default # noqa var-naming + +# Controls which additional headers to attach to all HTTP requests. +# To add your own headers, use `matrix_media_repo_container_labels_traefik_additional_request_headers_custom` +matrix_media_repo_container_labels_traefik_additional_request_headers: "{{ matrix_media_repo_container_labels_traefik_additional_request_headers_auto | combine(matrix_media_repo_container_labels_traefik_additional_request_headers_custom) }}" +matrix_media_repo_container_labels_traefik_additional_request_headers_auto: | + {{ + {} + | combine ({'X-Forwarded-Host': matrix_domain} if matrix_domain else {}) + }} +matrix_media_repo_container_labels_traefik_additional_request_headers_custom: {} + +# matrix_media_repo_container_labels_additional_labels contains a multiline string with additional labels to add to the container label file. +# See `../templates/labels.j2` for details. +# +# Example: +# matrix_media_repo_container_labels_additional_labels: | +# my.label=1 +# another.label="here" +matrix_media_repo_container_labels_additional_labels: '' + # matrix_media_repo_dashboard_urls contains a list of URLs with Grafana dashboard definitions. # If the Grafana role is enabled, these dashboards will be downloaded. matrix_media_repo_dashboard_urls: diff --git a/roles/custom/matrix-media-repo/tasks/setup_install.yml b/roles/custom/matrix-media-repo/tasks/setup_install.yml old mode 100644 new mode 100755 index 3bcbed966..b36df6d9a --- a/roles/custom/matrix-media-repo/tasks/setup_install.yml +++ b/roles/custom/matrix-media-repo/tasks/setup_install.yml @@ -27,6 +27,7 @@ group: "{{ matrix_user_groupname }}" with_items: - env + - labels - name: Ensure media-repo configuration installed ansible.builtin.template: diff --git a/roles/custom/matrix-media-repo/templates/media-repo/labels.j2 b/roles/custom/matrix-media-repo/templates/media-repo/labels.j2 new file mode 100755 index 000000000..b1217f090 --- /dev/null +++ b/roles/custom/matrix-media-repo/templates/media-repo/labels.j2 @@ -0,0 +1,147 @@ +{% if matrix_media_repo_container_labels_traefik_enabled %} +traefik.enable=true + +{% if matrix_media_repo_container_labels_traefik_docker_network %} +traefik.docker.network={{ matrix_media_repo_container_labels_traefik_docker_network }} +{% endif %} + +{% set middlewares = [] %} + +{% if matrix_media_repo_container_labels_traefik_additional_request_headers.keys() | length > 0 %} +{% for name, value in matrix_media_repo_container_labels_traefik_additional_request_headers.items() %} +traefik.http.middlewares.matrix-media-repo-add-headers.headers.customrequestheaders.{{ name }}={{ value }} +{% endfor %} +{% set middlewares = middlewares + ['matrix-media-repo-add-headers'] %} +{% endif %} + +# Matrix Client +traefik.http.routers.matrix-media-repo-media.rule={{ matrix_media_repo_container_labels_traefik_media_rule }} +{% if matrix_media_repo_container_labels_traefik_media_priority | int > 0 %} +traefik.http.routers.matrix-media-repo-media.priority={{ matrix_media_repo_container_labels_traefik_media_priority }} +{% endif %} +{% if middlewares | length > 0 %} +traefik.http.routers.matrix-media-repo-media.middlewares={{ middlewares | join(',') }} +{% endif %} +traefik.http.routers.matrix-media-repo-media.service=matrix-media-repo +traefik.http.routers.matrix-media-repo-media.entrypoints={{ matrix_media_repo_container_labels_traefik_media_entrypoints }} +traefik.http.routers.matrix-media-repo-media.tls={{ matrix_media_repo_container_labels_traefik_media_tls | to_json }} +{% if matrix_media_repo_container_labels_traefik_media_tls %} +traefik.http.routers.matrix-media-repo-media.tls.certResolver={{ matrix_media_repo_container_labels_traefik_media_tls_certResolver }} +{% endif %} + +{% if matrix_media_repo_access_tokens_max_cache_time_seconds > 0 %} + +traefik.http.routers.matrix-media-repo-logout.rule={{ matrix_media_repo_container_labels_traefik_logout_rule }} +{% if matrix_media_repo_container_labels_traefik_logout_priority | int > 0 %} +traefik.http.routers.matrix-media-repo-logout.priority={{ matrix_media_repo_container_labels_traefik_logout_priority }} +{% endif %} +{% if middlewares | length > 0 %} +traefik.http.routers.matrix-media-repo-logout.middlewares={{ middlewares | join(',') }} +{% endif %} +traefik.http.routers.matrix-media-repo-logout.service=matrix-media-repo +traefik.http.routers.matrix-media-repo-logout.entrypoints={{ matrix_media_repo_container_labels_traefik_logout_entrypoints }} +traefik.http.routers.matrix-media-repo-logout.tls={{ matrix_media_repo_container_labels_traefik_logout_tls | to_json }} +{% if matrix_media_repo_container_labels_traefik_logout_tls %} +traefik.http.routers.matrix-media-repo-logout.tls.certResolver={{ matrix_media_repo_container_labels_traefik_logout_tls_certResolver }} +{% endif %} + +{% endif %} + +traefik.http.routers.matrix-media-repo-admin-federation.rule={{ matrix_media_repo_container_labels_traefik_admin_rule }} +{% if matrix_media_repo_container_labels_traefik_admin_priority | int > 0 %} +traefik.http.routers.matrix-media-repo-admin-federation.priority={{ matrix_media_repo_container_labels_traefik_admin_priority }} +{% endif %} +{% if middlewares | length > 0 %} +traefik.http.routers.matrix-media-repo-admin-federation.middlewares={{ middlewares | join(',') }} +{% endif %} +traefik.http.routers.matrix-media-repo-admin-federation.service=matrix-media-repo +traefik.http.routers.matrix-media-repo-admin-federation.entrypoints={{ matrix_media_repo_container_labels_traefik_admin_entrypoints }} +traefik.http.routers.matrix-media-repo-admin-federation.tls={{ matrix_media_repo_container_labels_traefik_admin_tls | to_json }} +{% if matrix_media_repo_container_labels_traefik_admin_tls %} +traefik.http.routers.matrix-media-repo-admin-federation.tls.certResolver={{ matrix_media_repo_container_labels_traefik_admin_tls_certResolver }} +{% endif %} + +traefik.http.routers.matrix-media-repo-t2bot.rule={{ matrix_media_repo_container_labels_traefik_t2bot_rule }} +{% if matrix_media_repo_container_labels_traefik_t2bot_priority | int > 0 %} +traefik.http.routers.matrix-media-repo-t2bot.priority={{ matrix_media_repo_container_labels_traefik_t2bot_priority }} +{% endif %} +{% if middlewares | length > 0 %} +traefik.http.routers.matrix-media-repo-t2bot.middlewares={{ middlewares | join(',') }} +{% endif %} +traefik.http.routers.matrix-media-repo-t2bot.service=matrix-media-repo +traefik.http.routers.matrix-media-repo-t2bot.entrypoints={{ matrix_media_repo_container_labels_traefik_t2bot_entrypoints }} +traefik.http.routers.matrix-media-repo-t2bot.tls={{ matrix_media_repo_container_labels_traefik_t2bot_tls | to_json }} +{% if matrix_media_repo_container_labels_traefik_t2bot_tls %} +traefik.http.routers.matrix-media-repo-t2bot.tls.certResolver={{ matrix_media_repo_container_labels_traefik_t2bot_tls_certResolver }} +{% endif %} + +# Matrix Federation +{% if matrix_nginx_proxy_proxy_matrix_federation_api_enabled %} + +traefik.http.routers.matrix-media-repo-media-federation.rule={{ matrix_media_repo_container_labels_traefik_media_federation_rule }} +{% if matrix_media_repo_container_labels_traefik_media_federation_priority | int > 0 %} +traefik.http.routers.matrix-media-repo-media-federation.priority={{ matrix_media_repo_container_labels_traefik_media_federation_priority }} +{% endif %} +{% if middlewares | length > 0 %} +traefik.http.routers.matrix-media-repo-media-federation.middlewares={{ middlewares | join(',') }} +{% endif %} +traefik.http.routers.matrix-media-repo-media-federation.service=matrix-media-repo +traefik.http.routers.matrix-media-repo-media-federation.entrypoints={{ matrix_media_repo_container_labels_traefik_media_federation_entrypoints }} +traefik.http.routers.matrix-media-repo-media-federation.tls={{ matrix_media_repo_container_labels_traefik_media_federation_tls | to_json }} +{% if matrix_media_repo_container_labels_traefik_media_federation_tls %} +traefik.http.routers.matrix-media-repo-media-federation.tls.certResolver={{ matrix_media_repo_container_labels_traefik_media_federation_tls_certResolver }} +{% endif %} + +{% if matrix_media_repo_access_tokens_max_cache_time_seconds > 0 %} + +traefik.http.routers.matrix-media-repo-logout-federation.rule={{ matrix_media_repo_container_labels_traefik_logout_federation_rule }} +{% if matrix_media_repo_container_labels_traefik_logout_federation_priority | int > 0 %} +traefik.http.routers.matrix-media-repo-logout-federation.priority={{ matrix_media_repo_container_labels_traefik_logout_federation_priority }} +{% endif %} +{% if middlewares | length > 0 %} +traefik.http.routers.matrix-media-repo-logout-federation.middlewares={{ middlewares | join(',') }} +{% endif %} +traefik.http.routers.matrix-media-repo-logout-federation.service=matrix-media-repo +traefik.http.routers.matrix-media-repo-logout-federation.entrypoints={{ matrix_media_repo_container_labels_traefik_logout_federation_entrypoints }} +traefik.http.routers.matrix-media-repo-logout-federation.tls={{ matrix_media_repo_container_labels_traefik_logout_federation_tls | to_json }} +{% if matrix_media_repo_container_labels_traefik_logout_federation_tls %} +traefik.http.routers.matrix-media-repo-logout-federation.tls.certResolver={{ matrix_media_repo_container_labels_traefik_logout_federation_tls_certResolver }} +{% endif %} + +{% endif %} + +traefik.http.routers.matrix-media-repo-admin.rule={{ matrix_media_repo_container_labels_traefik_admin_federation_rule }} +{% if matrix_media_repo_container_labels_traefik_admin_federation_priority | int > 0 %} +traefik.http.routers.matrix-media-repo-admin.priority={{ matrix_media_repo_container_labels_traefik_admin_federation_priority }} +{% endif %} +{% if middlewares | length > 0 %} +traefik.http.routers.matrix-media-repo-admin.middlewares={{ middlewares | join(',') }} +{% endif %} +traefik.http.routers.matrix-media-repo-admin.service=matrix-media-repo +traefik.http.routers.matrix-media-repo-admin.entrypoints={{ matrix_media_repo_container_labels_traefik_admin_federation_entrypoints }} +traefik.http.routers.matrix-media-repo-admin.tls={{ matrix_media_repo_container_labels_traefik_admin_federation_tls | to_json }} +{% if matrix_media_repo_container_labels_traefik_admin_federation_tls %} +traefik.http.routers.matrix-media-repo-admin.tls.certResolver={{ matrix_media_repo_container_labels_traefik_admin_federation_tls_certResolver }} +{% endif %} + +traefik.http.routers.matrix-media-repo-t2bot-federation.rule={{ matrix_media_repo_container_labels_traefik_t2bot_federation_rule }} +{% if matrix_media_repo_container_labels_traefik_t2bot_federation_priority | int > 0 %} +traefik.http.routers.matrix-media-repo-t2bot-federation.priority={{ matrix_media_repo_container_labels_traefik_t2bot_federation_priority }} +{% endif %} +{% if middlewares | length > 0 %} +traefik.http.routers.matrix-media-repo-t2bot-federation.middlewares={{ middlewares | join(',') }} +{% endif %} +traefik.http.routers.matrix-media-repo-t2bot-federation.service=matrix-media-repo +traefik.http.routers.matrix-media-repo-t2bot-federation.entrypoints={{ matrix_media_repo_container_labels_traefik_t2bot_federation_entrypoints }} +traefik.http.routers.matrix-media-repo-t2bot-federation.tls={{ matrix_media_repo_container_labels_traefik_t2bot_federation_tls | to_json }} +{% if matrix_media_repo_container_labels_traefik_t2bot_federation_tls %} +traefik.http.routers.matrix-media-repo-t2bot-federation.tls.certResolver={{ matrix_media_repo_container_labels_traefik_t2bot_federation_tls_certResolver }} +{% endif %} + +{% endif %} + +traefik.http.services.matrix-media-repo.loadbalancer.server.port={{ matrix_media_repo_port }} + +{% endif %} + +{{ matrix_media_repo_container_labels_additional_labels }} diff --git a/roles/custom/matrix-media-repo/templates/media-repo/systemd/matrix-media-repo.service.j2 b/roles/custom/matrix-media-repo/templates/media-repo/systemd/matrix-media-repo.service.j2 old mode 100644 new mode 100755 index 0defeb085..ea2fb125f --- a/roles/custom/matrix-media-repo/templates/media-repo/systemd/matrix-media-repo.service.j2 +++ b/roles/custom/matrix-media-repo/templates/media-repo/systemd/matrix-media-repo.service.j2 @@ -22,8 +22,9 @@ ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} create \ --log-driver=none \ --user={{ matrix_user_uid }}:{{ matrix_user_gid }} \ --cap-drop=ALL \ - --network={{ matrix_docker_network }} \ + --network={{ matrix_media_repo_container_network }} \ --env-file={{ matrix_media_repo_base_path }}/env \ + --label-file={{ matrix_media_repo_base_path }}/labels \ {% if matrix_media_repo_container_http_host_bind_port %} -p {{ matrix_media_repo_container_http_host_bind_port }}:{{ matrix_media_repo_port }} \ {% endif %} From a4c3bedf4b14eb6275fd2903a30eb545b4b7e387 Mon Sep 17 00:00:00 2001 From: Curious Date: Fri, 22 Dec 2023 07:44:34 +0800 Subject: [PATCH 4/6] Fix "SSL_do_handshake() failed" in nginx reverse-proxy In nginx reverse-proxy, when the upstream server relies on SNI, the reverser-proxy may return 502 by follow error: ``` *10 SSL_do_handshake() failed (SSL: error:0A000410:SSL routines::sslv3 alert handshake failure:SSL alert number 40) while SSL handshaking to upstream, client: 172.19.0.1, server: example.host, request: "GET /.well-known/matrix/client HTTP/2.0", upstream: "https:///.well-known/matrix/client", host: "" ``` This problem often arises when the upstream server is behind the CDN, setting `proxy_ssl_server_name` to `on` will solve it. --- docs/configuring-well-known.md | 1 + 1 file changed, 1 insertion(+) diff --git a/docs/configuring-well-known.md b/docs/configuring-well-known.md index fd548aa63..993578159 100644 --- a/docs/configuring-well-known.md +++ b/docs/configuring-well-known.md @@ -123,6 +123,7 @@ server { location /.well-known/matrix { proxy_pass https://matrix.example.com/.well-known/matrix; proxy_set_header X-Forwarded-For $remote_addr; + proxy_ssl_server_name on; } # other configuration From ce013a325c0512946752bb1bc80b2e56f06a1612 Mon Sep 17 00:00:00 2001 From: Slavi Pantaleev Date: Fri, 22 Dec 2023 08:43:10 +0200 Subject: [PATCH 5/6] Remove duplicate matrix_media_repo_identifier definition from group_vars/matrix_servers `matrix_media_repo_identifier` is already defined in the role defaults, which is a better role to have it anyway. --- group_vars/matrix_servers | 2 -- roles/custom/matrix-media-repo/defaults/main.yml | 2 +- 2 files changed, 1 insertion(+), 3 deletions(-) diff --git a/group_vars/matrix_servers b/group_vars/matrix_servers index d7f60275b..ba9e11bba 100755 --- a/group_vars/matrix_servers +++ b/group_vars/matrix_servers @@ -2693,8 +2693,6 @@ matrix_ma1sd_database_password: "{{ '%s' | format(matrix_homeserver_generic_secr # ###################################################################### -matrix_media_repo_identifier: matrix-media-repo - matrix_media_repo_enabled: false matrix_media_repo_container_network: "{{ matrix_nginx_proxy_container_network if matrix_playbook_reverse_proxy_type == 'playbook-managed-nginx' else matrix_media_repo_identifier }}" diff --git a/roles/custom/matrix-media-repo/defaults/main.yml b/roles/custom/matrix-media-repo/defaults/main.yml index 194012ea9..702bfcba5 100755 --- a/roles/custom/matrix-media-repo/defaults/main.yml +++ b/roles/custom/matrix-media-repo/defaults/main.yml @@ -9,7 +9,7 @@ matrix_media_repo_enabled: false # matrix_media_repo_identifier controls the identifier of this media-repo instance, which influences: # - the default storage path -# - the names of systemd services +# - the names of systemd services and containers matrix_media_repo_identifier: matrix-media-repo matrix_media_repo_container_image_self_build: false From e7a911a7faa119ed3ad002d37c0568a2656a78c0 Mon Sep 17 00:00:00 2001 From: Slavi Pantaleev Date: Fri, 22 Dec 2023 09:18:44 +0200 Subject: [PATCH 6/6] Add note about matrix_nginx_proxy_proxy_media_repo_enabled --- group_vars/matrix_servers | 2 ++ 1 file changed, 2 insertions(+) diff --git a/group_vars/matrix_servers b/group_vars/matrix_servers index ba9e11bba..a960ccbba 100755 --- a/group_vars/matrix_servers +++ b/group_vars/matrix_servers @@ -2810,6 +2810,8 @@ matrix_nginx_proxy_proxy_matrix_identity_api_enabled: "{{ matrix_ma1sd_enabled } matrix_nginx_proxy_proxy_matrix_identity_api_addr_with_container: "matrix-ma1sd:{{ matrix_ma1sd_container_port }}" matrix_nginx_proxy_proxy_matrix_identity_api_addr_sans_container: "127.0.0.1:{{ matrix_ma1sd_container_port }}" +# NOTE: we cannot disable this, even though matrix-media-repo is already natively exposed at the Traefik level. +# See: https://github.com/spantaleev/matrix-docker-ansible-deploy/pull/3045#issuecomment-1867327001 matrix_nginx_proxy_proxy_media_repo_enabled: "{{ matrix_media_repo_enabled }}" matrix_nginx_proxy_proxy_media_repo_addr_with_container: "{{ matrix_media_repo_identifier }}:{{ matrix_media_repo_port }}" matrix_nginx_proxy_proxy_media_repo_addr_sans_container: "127.0.0.1:{{ matrix_media_repo_port }}"