ansol
/
matrix-docker-ansible-deploy
mirror of https://github.com/spantaleev/matrix-docker-ansible-deploy.git
7
0
Fork 0
Code Issues Projects Releases Wiki Activity

Set default values where sensible and remove unnecessary conditionals in .env.j2. 

Check for empty string instead of Null to verify if an openid_server_name is pinned.
This commit is contained in:
Paul N 2023-02-06 15:19:58 +01:00
parent d67d8c07f5
commit 96dd86d33b
4 changed files with 12 additions and 20 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
docs/configuring-playbook-user-verification-service.md
View File

@ -81,10 +81,10 @@ In case Jitsi is also managed by this playbook and 'matrix' authentication in Ji
In theory (however currently untested), UVS can handle federation. Simply set:
```yaml
matrix_user_verification_service_uvs_openid_verify_server_name: ~
matrix_user_verification_service_uvs_openid_verify_server_name: ""
```
using host_vars to override the group_vars.
in your host_vars.
This will instruct UVS to verify the OpenID token against any domain given in a request.
Homeserver discovery is done via '.well-known/matrix/server' of the given domain.

4
group_vars/matrix_servers
View File

@ -3212,10 +3212,6 @@ matrix_user_verification_service_uvs_disable_ip_blacklist: "{{'true' if matrix_s
matrix_user_verification_service_uvs_auth_token: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'uvs.auth.token', rounds=655555) | to_uuid }}"
# Pin UVS to only check openId Tokens for the matrix_server_name configured by this playbook.
# This is not the homeserverURL, but rather the domain in the matrix "user ID"
matrix_user_verification_service_uvs_openid_verify_server_name: "{{ matrix_domain }}"
######################################################################
#
# /matrix-user-verification-service

13
roles/custom/matrix-user-verification-service/defaults/main.yml
View File

@ -48,14 +48,15 @@ matrix_user_verification_service_uvs_disable_ip_blacklist: false
# need have the header "Authorization: Bearer changeme".
# matrix_user_verification_service_uvs_auth_token: changeme
# Matrix server name to verify OpenID tokens against. See below section.
# Defaults to empty value which means verification is made against
# whatever Matrix server name passed in with the token
# matrix_user_verification_service_uvs_openid_verify_server_name: matrix.org
# Matrix server name to verify OpenID tokens against.
# Pin UVS to only check openId Tokens for the matrix_server_name configured by this playbook.
# This is not the homeserverURL, but rather the domain in the matrix "user ID"
# UVS can also be instructed to verify against the Matrix server name passed in the token, to enable set to ""
matrix_user_verification_service_uvs_openid_verify_server_name: "{{ matrix_domain }}"
# Log level, defaults to 'info'
# Log level
# See choices here: https://github.com/winstonjs/winston#logging-levels
matrix_user_verification_service_uvs_log_level: warning
matrix_user_verification_service_uvs_log_level: info
######################################################################

11
roles/custom/matrix-user-verification-service/templates/.env.j2
View File

@ -1,14 +1,9 @@
UVS_ACCESS_TOKEN={{ matrix_user_verification_service_uvs_access_token }}
UVS_HOMESERVER_URL={{ matrix_user_verification_service_uvs_homeserver_url }}
UVS_DISABLE_IP_BLACKLIST={{ matrix_user_verification_service_uvs_disable_ip_blacklist }}
{% if matrix_user_verification_service_uvs_auth_token is defined and matrix_user_verification_service_uvs_auth_token|length %}
UVS_AUTH_TOKEN={{ matrix_user_verification_service_uvs_auth_token }}
{% endif %}
{% if matrix_user_verification_service_uvs_openid_verify_server_name is defined and matrix_user_verification_service_uvs_openid_verify_server_name|length %}
UVS_LOG_LEVEL={{ matrix_user_verification_service_uvs_log_level }}
UVS_AUTH_TOKEN={{ matrix_user_verification_service_uvs_auth_token }}
{% if matrix_user_verification_service_uvs_openid_verify_server_name | length > 0 %}
UVS_OPENID_VERIFY_SERVER_NAME={{ matrix_user_verification_service_uvs_openid_verify_server_name }}
{% endif %}
{% if matrix_user_verification_service_uvs_log_level is defined and matrix_user_verification_service_uvs_log_level|length %}
UVS_LOG_LEVEL={{ matrix_user_verification_service_uvs_log_level }}
{% endif %}