From 0b18f03195367f5f9de9f8e8235fc683bc8006a1 Mon Sep 17 00:00:00 2001 From: Aine Date: Thu, 23 Mar 2023 19:06:16 +0200 Subject: [PATCH 1/2] honoroit - add proper networking configuration and traefik labels --- group_vars/matrix_servers | 21 +++++++++ .../matrix-bot-honoroit/defaults/main.yml | 45 +++++++++++++++++++ .../tasks/setup_install.yml | 9 ++-- .../matrix-bot-honoroit/templates/labels.j2 | 45 +++++++++++++++++++ .../systemd/matrix-bot-honoroit.service.j2 | 13 +++++- 5 files changed, 128 insertions(+), 5 deletions(-) create mode 100644 roles/custom/matrix-bot-honoroit/templates/labels.j2 diff --git a/group_vars/matrix_servers b/group_vars/matrix_servers index 0b8d7e25e..bb892a8b3 100755 --- a/group_vars/matrix_servers +++ b/group_vars/matrix_servers @@ -1671,6 +1671,27 @@ matrix_bot_honoroit_database_hostname: "{{ devture_postgres_connection_hostname matrix_bot_honoroit_database_password: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'honoroit.bot.db', rounds=655555) | to_uuid }}" matrix_bot_honoroit_container_image_self_build: "{{ matrix_architecture not in ['amd64', 'arm64'] }}" +matrix_bot_honoroit_container_network: "{{ matrix_docker_network if matrix_playbook_reverse_proxy_type == 'playbook-managed-nginx' else 'matrix-bot-honoroit' }}" + +# For now, we attach this to the matrix-nginx-proxy network (unless that's the same network as the main one for us), +# because that's where the homeserver is expected to be accessed from. +# In the future, this will need to be redone. +matrix_bot_honoroit_container_additional_networks: | + {{ + ( + ([matrix_playbook_reverse_proxyable_services_additional_network] if matrix_playbook_reverse_proxyable_services_additional_network else []) + + + ([matrix_nginx_proxy_container_network] if matrix_nginx_proxy_enabled and matrix_bot_honoroit_container_network != matrix_nginx_proxy_container_network else []) + + + ([devture_postgres_container_network] if devture_postgres_enabled and devture_postgres_container_network != matrix_bot_honoroit_container_network else []) + ) | unique + }} + +matrix_bot_honoroit_container_labels_traefik_enabled: "{{ matrix_playbook_traefik_labels_enabled }}" +matrix_bot_honoroit_container_labels_traefik_docker_network: "{{ matrix_playbook_reverse_proxyable_services_additional_network }}" +matrix_bot_honoroit_container_labels_traefik_entrypoints: "{{ devture_traefik_entrypoint_primary }}" +matrix_bot_honoroit_container_labels_traefik_tls_certResolver: "{{ devture_traefik_certResolver_primary }}" + ###################################################################### # # /matrix-bot-honoroit diff --git a/roles/custom/matrix-bot-honoroit/defaults/main.yml b/roles/custom/matrix-bot-honoroit/defaults/main.yml index 42f766824..38d02d343 100644 --- a/roles/custom/matrix-bot-honoroit/defaults/main.yml +++ b/roles/custom/matrix-bot-honoroit/defaults/main.yml @@ -4,6 +4,13 @@ matrix_bot_honoroit_enabled: true +# The hostname at which honoroit is served. +matrix_bot_honoroit_hostname: '' + +# The path at which honoroit is exposed. +# This value must either be `/` or not end with a slash (e.g. `/honoroit`). +matrix_bot_honoroit_path_prefix: / + matrix_bot_honoroit_container_image_self_build: false matrix_bot_honoroit_docker_repo: "https://gitlab.com/etke.cc/honoroit.git" matrix_bot_honoroit_docker_repo_version: "{{ matrix_bot_honoroit_version }}" @@ -19,6 +26,44 @@ matrix_bot_honoroit_config_path: "{{ matrix_bot_honoroit_base_path }}/config" matrix_bot_honoroit_data_path: "{{ matrix_bot_honoroit_base_path }}/data" matrix_bot_honoroit_data_store_path: "{{ matrix_bot_honoroit_data_path }}/store" +# The base container network. It will be auto-created by this role if it doesn't exist already. +matrix_bot_honoroit_container_network: matrix-bot-honoroit + +# A list of additional container networks that the container would be connected to. +# The role does not create these networks, so make sure they already exist. +# Use this to expose this container to another reverse proxy, which runs in a different container network. +matrix_bot_honoroit_container_additional_networks: [] + +# matrix_bot_honoroit_container_labels_traefik_enabled controls whether labels to assist a Traefik reverse-proxy will be attached to the container. +# See `../templates/labels.j2` for details. +# +# To inject your own other container labels, see `matrix_bot_honoroit_container_labels_additional_labels`. +matrix_bot_honoroit_container_labels_traefik_enabled: true +matrix_bot_honoroit_container_labels_traefik_docker_network: "{{ matrix_bot_honoroit_container_network }}" +matrix_bot_honoroit_container_labels_traefik_hostname: "{{ matrix_bot_honoroit_hostname }}" +# The path prefix must either be `/` or not end with a slash (e.g. `/honoroit`). +matrix_bot_honoroit_container_labels_traefik_path_prefix: "{{ matrix_bot_honoroit_path_prefix }}" +matrix_bot_honoroit_container_labels_traefik_rule: "Host(`{{ matrix_bot_honoroit_container_labels_traefik_hostname }}`){% if matrix_bot_honoroit_container_labels_traefik_path_prefix != '/' %} && PathPrefix(`{{ matrix_bot_honoroit_container_labels_traefik_path_prefix }}`){% endif %}" +matrix_bot_honoroit_container_labels_traefik_priority: 0 +matrix_bot_honoroit_container_labels_traefik_entrypoints: web-secure +matrix_bot_honoroit_container_labels_traefik_tls: "{{ matrix_bot_honoroit_container_labels_traefik_entrypoints != 'web' }}" +matrix_bot_honoroit_container_labels_traefik_tls_certResolver: default # noqa var-naming + +# Controls which additional headers to attach to all HTTP responses. +# To add your own headers, use `matrix_bot_honoroit_container_labels_traefik_additional_response_headers_custom` +matrix_bot_honoroit_container_labels_traefik_additional_response_headers: "{{ matrix_bot_honoroit_container_labels_traefik_additional_response_headers_auto | combine(matrix_bot_honoroit_container_labels_traefik_additional_response_headers_custom) }}" +matrix_bot_honoroit_container_labels_traefik_additional_response_headers_auto: {} +matrix_bot_honoroit_container_labels_traefik_additional_response_headers_custom: {} + +# matrix_bot_buscarron_container_labels_additional_labels contains a multiline string with additional labels to add to the container label file. +# See `../templates/labels.j2` for details. +# +# Example: +# matrix_bot_buscarron_container_labels_additional_labels: | +# my.label=1 +# another.label="here" +matrix_bot_buscarron_container_labels_additional_labels: '' + # A list of extra arguments to pass to the container matrix_bot_honoroit_container_extra_arguments: [] diff --git a/roles/custom/matrix-bot-honoroit/tasks/setup_install.yml b/roles/custom/matrix-bot-honoroit/tasks/setup_install.yml index f7b264a83..14b5a0e47 100644 --- a/roles/custom/matrix-bot-honoroit/tasks/setup_install.yml +++ b/roles/custom/matrix-bot-honoroit/tasks/setup_install.yml @@ -40,13 +40,16 @@ - {path: "{{ matrix_bot_honoroit_docker_src_files_path }}", when: true} when: "item.when | bool" -- name: Ensure honoroit environment variables file created +- name: Ensure honoroit support files installed ansible.builtin.template: - src: "{{ role_path }}/templates/env.j2" - dest: "{{ matrix_bot_honoroit_config_path }}/env" + src: "{{ role_path }}/templates/{{ item }}.j2" + dest: "{{ matrix_bot_honoroit_config_path }}/{{ item }}" owner: "{{ matrix_user_username }}" group: "{{ matrix_user_groupname }}" mode: 0640 + with_items: + - env + - labels - name: Ensure honoroit image is pulled community.docker.docker_image: diff --git a/roles/custom/matrix-bot-honoroit/templates/labels.j2 b/roles/custom/matrix-bot-honoroit/templates/labels.j2 new file mode 100644 index 000000000..f03af34a2 --- /dev/null +++ b/roles/custom/matrix-bot-honoroit/templates/labels.j2 @@ -0,0 +1,45 @@ +{% if matrix_bot_honoroit_container_labels_traefik_enabled %} +traefik.enable=true + +{% if matrix_bot_honoroit_container_labels_traefik_docker_network %} +traefik.docker.network={{ matrix_bot_honoroit_container_labels_traefik_docker_network }} +{% endif %} + +{% set middlewares = [] %} + +{% if matrix_bot_honoroit_container_labels_traefik_path_prefix != '/' %} +traefik.http.middlewares.matrix-bot-honoroit-slashless-redirect.redirectregex.regex=({{ matrix_bot_honoroit_container_labels_traefik_path_prefix | quote }})$ +traefik.http.middlewares.matrix-bot-honoroit-slashless-redirect.redirectregex.replacement=${1}/ +{% set middlewares = middlewares + ['matrix-bot-honoroit-slashless-redirect'] %} +{% endif %} + +{% if matrix_bot_honoroit_container_labels_traefik_path_prefix != '/' %} +traefik.http.middlewares.matrix-bot-honoroit-strip-prefix.stripprefix.prefixes={{ matrix_bot_honoroit_container_labels_traefik_path_prefix }} +{% set middlewares = middlewares + ['matrix-bot-honoroit-strip-prefix'] %} +{% endif %} + +{% if matrix_bot_honoroit_container_labels_traefik_additional_response_headers.keys() | length > 0 %} +{% for name, value in matrix_bot_honoroit_container_labels_traefik_additional_response_headers.items() %} +traefik.http.middlewares.matrix-bot-honoroit-add-headers.headers.customresponseheaders.{{ name }}={{ value }} +{% endfor %} +{% set middlewares = middlewares + ['matrix-bot-honoroit-add-headers'] %} +{% endif %} + +traefik.http.routers.matrix-bot-honoroit.rule={{ matrix_bot_honoroit_container_labels_traefik_rule }} +{% if matrix_bot_honoroit_container_labels_traefik_priority | int > 0 %} +traefik.http.routers.matrix-bot-honoroit.priority={{ matrix_bot_honoroit_container_labels_traefik_priority }} +{% endif %} +traefik.http.routers.matrix-bot-honoroit.service=matrix-bot-honoroit +{% if middlewares | length > 0 %} +traefik.http.routers.matrix-bot-honoroit.middlewares={{ middlewares | join(',') }} +{% endif %} +traefik.http.routers.matrix-bot-honoroit.entrypoints={{ matrix_bot_honoroit_container_labels_traefik_entrypoints }} +traefik.http.routers.matrix-bot-honoroit.tls={{ matrix_bot_honoroit_container_labels_traefik_tls | to_json }} +{% if matrix_bot_honoroit_container_labels_traefik_tls %} +traefik.http.routers.matrix-bot-honoroit.tls.certResolver={{ matrix_bot_honoroit_container_labels_traefik_tls_certResolver }} +{% endif %} + +traefik.http.services.matrix-bot-honoroit.loadbalancer.server.port=8080 +{% endif %} + +{{ matrix_bot_honoroit_container_labels_additional_labels }} diff --git a/roles/custom/matrix-bot-honoroit/templates/systemd/matrix-bot-honoroit.service.j2 b/roles/custom/matrix-bot-honoroit/templates/systemd/matrix-bot-honoroit.service.j2 index 2cce62da5..44fe9a2fc 100644 --- a/roles/custom/matrix-bot-honoroit/templates/systemd/matrix-bot-honoroit.service.j2 +++ b/roles/custom/matrix-bot-honoroit/templates/systemd/matrix-bot-honoroit.service.j2 @@ -16,19 +16,28 @@ Environment="HOME={{ devture_systemd_docker_base_systemd_unit_home_path }}" ExecStartPre=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} kill matrix-bot-honoroit 2>/dev/null || true' ExecStartPre=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} rm matrix-bot-honoroit 2>/dev/null || true' -ExecStart={{ devture_systemd_docker_base_host_command_docker }} run --rm --name matrix-bot-honoroit \ +ExecStart={{ devture_systemd_docker_base_host_command_docker }} create \ + --rm \ + --name=matrix-bot-honoroit \ --log-driver=none \ --user={{ matrix_user_uid }}:{{ matrix_user_gid }} \ --cap-drop=ALL \ --read-only \ - --network={{ matrix_docker_network }} \ + --network={{ matrix_bot_honoroit_container_network }} \ --env-file={{ matrix_bot_honoroit_config_path }}/env \ + --label-file={{ matrix_bot_honoroit_config_path }}/labels \ --mount type=bind,src={{ matrix_bot_honoroit_data_path }},dst=/data \ {% for arg in matrix_bot_honoroit_container_extra_arguments %} {{ arg }} \ {% endfor %} {{ matrix_bot_honoroit_docker_image }} +{% for network in matrix_bot_honoroit_container_additional_networks %} +ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} network connect {{ network }} matrix-bot-honoroit +{% endfor %} + +ExecStart={{ devture_systemd_docker_base_host_command_docker }} start --attach matrix-bot-honoroit + ExecStop=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} kill matrix-bot-honoroit 2>/dev/null || true' ExecStop=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} rm matrix-bot-honoroit 2>/dev/null || true' Restart=always From 15ce37723561958b431a5ed9bdafacc979e3d0ec Mon Sep 17 00:00:00 2001 From: Aine Date: Thu, 23 Mar 2023 19:09:34 +0200 Subject: [PATCH 2/2] honoroit - add matrix_bot_honoroit_hostname into group vars --- group_vars/matrix_servers | 1 + 1 file changed, 1 insertion(+) diff --git a/group_vars/matrix_servers b/group_vars/matrix_servers index bb892a8b3..499a714b4 100755 --- a/group_vars/matrix_servers +++ b/group_vars/matrix_servers @@ -1653,6 +1653,7 @@ matrix_bot_maubot_database_password: "{{ '%s' | format(matrix_homeserver_generic # We don't enable bots by default. matrix_bot_honoroit_enabled: false +matrix_bot_honoroit_hostname: "{{ matrix_server_fqn_matrix }}" matrix_bot_honoroit_systemd_required_services_list: | {{