Add a role to install 'ntfy' push-notification server.

This commit adds a 'matrix-ntfy' role that runs Ntfy server in Docker with
simple configuration, and plumbing to add the role to the playbook.

TODO: documentation, self-check, database persistence.
This commit is contained in:
Julian Foad 2022-06-21 14:31:21 +01:00
parent 2e4fad6194
commit ec9f8e2931
12 changed files with 309 additions and 0 deletions

View File

@ -1552,6 +1552,7 @@ matrix_nginx_proxy_proxy_bot_go_neb_enabled: "{{ matrix_bot_go_neb_enabled }}"
matrix_nginx_proxy_proxy_jitsi_enabled: "{{ matrix_jitsi_enabled }}"
matrix_nginx_proxy_proxy_grafana_enabled: "{{ matrix_grafana_enabled }}"
matrix_nginx_proxy_proxy_sygnal_enabled: "{{ matrix_sygnal_enabled }}"
matrix_nginx_proxy_proxy_ntfy_enabled: "{{ matrix_ntfy_enabled }}"
matrix_nginx_proxy_proxy_matrix_corporal_api_enabled: "{{ matrix_corporal_enabled and matrix_corporal_http_api_enabled }}"
matrix_nginx_proxy_proxy_matrix_corporal_api_addr_with_container: "matrix-corporal:41081"
@ -1634,6 +1635,8 @@ matrix_nginx_proxy_systemd_wanted_services_list: |
+
(['matrix-sygnal.service'] if matrix_sygnal_enabled else [])
+
(['matrix-ntfy.service'] if matrix_ntfy_enabled else [])
+
(['matrix-jitsi.service'] if matrix_jitsi_enabled else [])
+
(['matrix-bot-go-neb.service'] if matrix_bot_go_neb_enabled else [])
@ -1667,6 +1670,8 @@ matrix_ssl_domains_to_obtain_certificates_for: |
+
([matrix_server_fqn_sygnal] if matrix_sygnal_enabled else [])
+
([matrix_server_fqn_ntfy] if matrix_ntfy_enabled else [])
+
([matrix_domain] if matrix_nginx_proxy_base_domain_serving_enabled else [])
+
matrix_ssl_additional_domains_to_obtain_certificates_for
@ -1960,6 +1965,20 @@ matrix_sygnal_container_http_host_bind_port: "{{ '' if matrix_nginx_proxy_enable
#
######################################################################
######################################################################
#
# matrix-ntfy
#
######################################################################
matrix_ntfy_enabled: false
######################################################################
#
# /matrix-ntfy
#
######################################################################
######################################################################
#
# matrix-redis

View File

@ -59,6 +59,9 @@ matrix_server_fqn_grafana: "stats.{{ matrix_domain }}"
# This is where you access the Sygnal push gateway.
matrix_server_fqn_sygnal: "sygnal.{{ matrix_domain }}"
# This is where you access the ntfy push notification service.
matrix_server_fqn_ntfy: "ntfy.{{ matrix_domain }}"
matrix_federation_public_port: 8448
# The architecture that your server runs.

View File

@ -192,6 +192,10 @@ matrix_nginx_proxy_proxy_grafana_hostname: "{{ matrix_server_fqn_grafana }}"
matrix_nginx_proxy_proxy_sygnal_enabled: false
matrix_nginx_proxy_proxy_sygnal_hostname: "{{ matrix_server_fqn_sygnal }}"
# Controls whether proxying the ntfy domain should be done.
matrix_nginx_proxy_proxy_ntfy_enabled: false
matrix_nginx_proxy_proxy_ntfy_hostname: "{{ matrix_server_fqn_ntfy }}"
# Controls whether proxying for (Prometheus) metrics (`/metrics/*`) for the various services should be done (on the matrix domain)
# If the internal Prometheus server (`matrix-prometheus` role) is used, proxying is not necessary, since Prometheus can access each container directly.
# This is only useful when an external Prometheus will be collecting metrics.
@ -365,6 +369,9 @@ matrix_nginx_proxy_proxy_grafana_additional_server_configuration_blocks: []
# A list of strings containing additional configuration blocks to add to Sygnal's server configuration (matrix-sygnal.conf).
matrix_nginx_proxy_proxy_sygnal_additional_server_configuration_blocks: []
# A list of strings containing additional configuration blocks to add to ntfy's server configuration (matrix-ntfy.conf).
matrix_nginx_proxy_proxy_ntfy_additional_server_configuration_blocks: []
# A list of strings containing additional configuration blocks to add to the base domain server configuration (matrix-base-domain.conf).
matrix_nginx_proxy_proxy_domain_additional_server_configuration_blocks: []

View File

@ -138,6 +138,13 @@
mode: 0644
when: matrix_nginx_proxy_proxy_sygnal_enabled|bool
- name: Ensure Matrix nginx-proxy configuration for ntfy domain exists
template:
src: "{{ role_path }}/templates/nginx/conf.d/matrix-ntfy.conf.j2"
dest: "{{ matrix_nginx_proxy_confd_path }}/matrix-ntfy.conf"
mode: 0644
when: matrix_nginx_proxy_proxy_ntfy_enabled|bool
- name: Ensure Matrix nginx-proxy configuration for Matrix domain exists
template:
src: "{{ role_path }}/templates/nginx/conf.d/matrix-domain.conf.j2"
@ -288,6 +295,12 @@
state: absent
when: "not matrix_nginx_proxy_proxy_sygnal_enabled|bool"
- name: Ensure Matrix nginx-proxy configuration for ntfy domain deleted
file:
path: "{{ matrix_nginx_proxy_confd_path }}/matrix-ntfy.conf"
state: absent
when: "not matrix_nginx_proxy_proxy_ntfy_enabled|bool"
- name: Ensure Matrix nginx-proxy homepage for base domain deleted
file:
path: "{{ matrix_nginx_proxy_data_path }}/matrix-domain/index.html"

View File

@ -0,0 +1,100 @@
#jinja2: lstrip_blocks: "True"
{% macro render_vhost_directives() %}
gzip on;
gzip_types text/plain application/json application/javascript text/css image/x-icon font/ttf image/gif;
{% if matrix_nginx_proxy_hsts_preload_enabled %}
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
{% else %}
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
{% endif %}
add_header X-XSS-Protection "{{ matrix_nginx_proxy_xss_protection }}";
add_header X-Content-Type-Options nosniff;
add_header X-Frame-Options DENY;
{% for configuration_block in matrix_nginx_proxy_proxy_ntfy_additional_server_configuration_blocks %}
{{- configuration_block }}
{% endfor %}
location / {
{% if matrix_nginx_proxy_enabled %}
{# Use the embedded DNS resolver in Docker containers to discover the service #}
resolver 127.0.0.11 valid=5s;
set $backend "matrix-ntfy:80";
proxy_pass http://$backend;
{% else %}
{# Generic configuration for use outside of our container setup #}
proxy_pass http://127.0.0.1:80;
{% endif %}
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For {{ matrix_nginx_proxy_x_forwarded_for }};
proxy_set_header X-Forwarded-Proto {{ matrix_nginx_proxy_x_forwarded_proto_value }};
}
{% endmacro %}
server {
listen {{ 8080 if matrix_nginx_proxy_enabled else 80 }};
listen [::]:{{ 8080 if matrix_nginx_proxy_enabled else 80 }};
server_name {{ matrix_nginx_proxy_proxy_ntfy_hostname }};
server_tokens off;
root /dev/null;
{% if matrix_nginx_proxy_https_enabled %}
location /.well-known/acme-challenge {
{% if matrix_nginx_proxy_enabled %}
{# Use the embedded DNS resolver in Docker containers to discover the service #}
resolver 127.0.0.11 valid=5s;
set $backend "matrix-certbot:8080";
proxy_pass http://$backend;
{% else %}
{# Generic configuration for use outside of our container setup #}
proxy_pass http://127.0.0.1:{{ matrix_ssl_lets_encrypt_certbot_standalone_http_port }};
{% endif %}
}
location / {
return 301 https://$http_host$request_uri;
}
{% else %}
{{ render_vhost_directives() }}
{% endif %}
}
{% if matrix_nginx_proxy_https_enabled %}
server {
listen {{ 8443 if matrix_nginx_proxy_enabled else 443 }} ssl http2;
listen [::]:{{ 8443 if matrix_nginx_proxy_enabled else 443 }} ssl http2;
server_name {{ matrix_nginx_proxy_proxy_ntfy_hostname }};
server_tokens off;
root /dev/null;
ssl_certificate {{ matrix_ssl_config_dir_path }}/live/{{ matrix_nginx_proxy_proxy_ntfy_hostname }}/fullchain.pem;
ssl_certificate_key {{ matrix_ssl_config_dir_path }}/live/{{ matrix_nginx_proxy_proxy_ntfy_hostname }}/privkey.pem;
ssl_protocols {{ matrix_nginx_proxy_ssl_protocols }};
{% if matrix_nginx_proxy_ssl_ciphers != '' %}
ssl_ciphers {{ matrix_nginx_proxy_ssl_ciphers }};
{% endif %}
ssl_prefer_server_ciphers {{ matrix_nginx_proxy_ssl_prefer_server_ciphers }};
{% if matrix_nginx_proxy_ocsp_stapling_enabled %}
ssl_stapling on;
ssl_stapling_verify on;
ssl_trusted_certificate {{ matrix_ssl_config_dir_path }}/live/{{ matrix_nginx_proxy_proxy_ntfy_hostname }}/chain.pem;
{% endif %}
{% if matrix_nginx_proxy_ssl_session_tickets_off %}
ssl_session_tickets off;
{% endif %}
ssl_session_cache {{ matrix_nginx_proxy_ssl_session_cache }};
ssl_session_timeout {{ matrix_nginx_proxy_ssl_session_timeout }};
{{ render_vhost_directives() }}
}
{% endif %}

View File

@ -0,0 +1,40 @@
# A role to install the [ntfy](https://ntfy.sh) push-notification server.
The ntfy server and clients implement self-hosted support push notifications
from Matrix (and other) servers to Android (and other) clients, using the
[UnifiedPush](https://unifiedpush.org) standard.
This role installs ntfy server in Docker. It is intended to support push
notifications, via UnifiedPush, from the Matrix and Matrix-related services
that are installed alongside it to any clients that support UnifiedPush.
This role is not intended to support other features of the ntfy server and
clients.
# Using the ntfy role
Configure the role by adding settings in your Ansible inventory.
The only required setting is to enable ntfy:
matrix_ntfy_enabled: true
The default domain for ntfy is `ntfy.<matrix_domain>`. This can be changed
with the `matrix_server_fqn_ntfy` variable:
matrix_server_fqn_ntfy: "my-ntfy.{{ matrix_domain }}"
Other ntfy settings can be configured by adding extra arguments to the
docker run command, e.g.:
matrix_ntfy_container_extra_arguments:
- '--env=NTFY_LOG_LEVEL=DEBUG'
# TODO
- Documentation.
- Self-check.
- Mount the ntfy database to disk so subscriptions persist across restarts.
- Authentication?

View File

@ -0,0 +1,16 @@
---
matrix_ntfy_enabled: true
matrix_ntfy_base_path: "{{ matrix_base_data_path }}/ntfy"
matrix_ntfy_version: v1.27.2
matrix_ntfy_docker_image: "{{ matrix_container_global_registry_prefix }}binwiederhier/ntfy:{{ matrix_ntfy_version }}"
matrix_ntfy_docker_image_force_pull: "{{ matrix_ntfy_docker_image.endswith(':latest') }}"
# Controls whether the container exposes its HTTP port (tcp/8080 in the container).
#
# Takes an "<ip>:<port>" or "<port>" value (e.g. "127.0.0.1:8768"), or empty string to not expose.
matrix_ntfy_container_http_host_bind_port: ''
# A list of extra arguments to pass to the container
matrix_ntfy_container_extra_arguments: []

View File

@ -0,0 +1,5 @@
---
- set_fact:
matrix_systemd_services_list: "{{ matrix_systemd_services_list + ['matrix-ntfy.service'] }}"
when: matrix_ntfy_enabled|bool

View File

@ -0,0 +1,10 @@
---
- import_tasks: "{{ role_path }}/tasks/init.yml"
tags:
- always
- import_tasks: "{{ role_path }}/tasks/setup.yml"
tags:
- setup-all
- setup-ntfy

View File

@ -0,0 +1,58 @@
---
#
# Tasks related to setting up matrix-ntfy
#
- name: Ensure matrix-ntfy image is pulled
docker_image:
name: "{{ matrix_ntfy_docker_image }}"
source: "{{ 'pull' if ansible_version.major > 2 or ansible_version.minor > 7 else omit }}"
force_source: "{{ matrix_ntfy_docker_image_force_pull if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}"
force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else matrix_ntfy_docker_image_force_pull }}"
when: "matrix_ntfy_enabled|bool"
register: result
retries: "{{ matrix_container_retries_count }}"
delay: "{{ matrix_container_retries_delay }}"
until: result is not failed
- name: Ensure matrix-ntfy.service installed
template:
src: "{{ role_path }}/templates/systemd/matrix-ntfy.service.j2"
dest: "{{ matrix_systemd_path }}/matrix-ntfy.service"
mode: 0644
register: matrix_ntfy_systemd_service_result
when: matrix_ntfy_enabled|bool
- name: Ensure systemd reloaded after matrix-ntfy.service installation
service:
daemon_reload: true
when: "matrix_ntfy_enabled|bool and matrix_ntfy_systemd_service_result.changed"
#
# Tasks related to getting rid of matrix-ntfy (if it was previously enabled)
#
- name: Check existence of matrix-ntfy service
stat:
path: "{{ matrix_systemd_path }}/matrix-ntfy.service"
register: matrix_ntfy_service_stat
- name: Ensure matrix-ntfy is stopped
service:
name: matrix-ntfy
state: stopped
enabled: false
daemon_reload: true
register: stopping_result
when: "not matrix_ntfy_enabled|bool and matrix_ntfy_service_stat.stat.exists"
- name: Ensure matrix-ntfy.service doesn't exist
file:
path: "{{ matrix_systemd_path }}/matrix-ntfy.service"
state: absent
when: "not matrix_ntfy_enabled|bool and matrix_ntfy_service_stat.stat.exists"
- name: Ensure systemd reloaded after matrix-ntfy.service removal
service:
daemon_reload: true
when: "not matrix_ntfy_enabled|bool and matrix_ntfy_service_stat.stat.exists"

View File

@ -0,0 +1,37 @@
#jinja2: lstrip_blocks: "True"
[Unit]
Description=matrix-ntfy
After=docker.service
Requires=docker.service
DefaultDependencies=no
[Service]
Type=simple
Environment="HOME={{ matrix_systemd_unit_home_path }}"
ExecStartPre=-{{ matrix_host_command_sh }} -c '{{ matrix_host_command_docker }} kill matrix-ntfy 2>/dev/null || true'
ExecStartPre=-{{ matrix_host_command_sh }} -c '{{ matrix_host_command_docker }} rm matrix-ntfy 2>/dev/null || true'
ExecStart={{ matrix_host_command_docker }} run --rm --name matrix-ntfy \
--log-driver=none \
--user={{ matrix_user_uid }}:{{ matrix_user_gid }} \
--cap-drop=ALL \
--read-only \
{% for arg in matrix_ntfy_container_extra_arguments %}
{{ arg }} \
{% endfor %}
--network={{ matrix_docker_network }} \
{% if matrix_ntfy_container_http_host_bind_port %}
-p {{ matrix_ntfy_container_http_host_bind_port }}:80 \
{% endif %}
--env NTFY_BASE_URL=https://{{ matrix_server_fqn_ntfy }} \
{{ matrix_ntfy_docker_image }} \
serve --behind-proxy
ExecStop=-{{ matrix_host_command_sh }} -c '{{ matrix_host_command_docker }} kill matrix-ntfy 2>/dev/null || true'
ExecStop=-{{ matrix_host_command_sh }} -c '{{ matrix_host_command_docker }} rm matrix-ntfy 2>/dev/null || true'
Restart=always
RestartSec=30
SyslogIdentifier=matrix-ntfy
[Install]
WantedBy=multi-user.target

View File

@ -60,6 +60,7 @@
- matrix-etherpad
- matrix-email2matrix
- matrix-sygnal
- matrix-ntfy
- matrix-nginx-proxy
- matrix-coturn
- matrix-aux