mirror of
https://github.com/spantaleev/matrix-docker-ansible-deploy.git
synced 2024-12-09 14:50:34 +00:00
Remove all traces of matrix-nginx-proxy, add validation & uninstallation tasks
This commit is contained in:
Slavi Pantaleev
parent
18211810ef
commit
f4f3d57520
@ -63,7 +63,6 @@ Services that run on the server to make the various parts of your installation w
|
||||
| [PostgreSQL](https://www.postgresql.org/)| ✓ | Database for Synapse. [Using an external PostgreSQL server](docs/configuring-playbook-external-postgres.md) is also possible. | [Link](docs/configuring-playbook-external-postgres.md) |
|
||||
| [Coturn](https://github.com/coturn/coturn) | ✓ | STUN/TURN server for WebRTC audio/video calls | [Link](docs/configuring-playbook-turn.md) |
|
||||
| [Traefik](https://doc.traefik.io/traefik/) | ✓ | Web server, listening on ports 80, 443 and 8448 - standing in front of all the other services. Using your own webserver [is possible](docs/configuring-playbook-own-webserver.md) | [Link](docs/configuring-playbook-traefik.md) |
|
||||
| [nginx](http://nginx.org/) | x | (Deprecated) Web server, listening on ports 80, 443 and 8448 - standing in front of all the other services. Deprecated in favor of Traefik | [Link](docs/configuring-playbook-nginx.md) |
|
||||
| [Let's Encrypt](https://letsencrypt.org/) | ✓ | Free SSL certificate, which secures the connection to all components | [Link](docs/configuring-playbook-ssl-certificates.md) |
|
||||
| [ma1sd](https://github.com/ma1uta/ma1sd) | x | Matrix Identity Server | [Link](docs/configuring-playbook-ma1sd.md)
|
||||
| [Exim](https://www.exim.org/) | ✓ | Mail server, through which all Matrix services send outgoing email (can be configured to relay through another SMTP server) | [Link](docs/configuring-playbook-email.md) |
|
||||
|
||||
@ -10,9 +10,9 @@ Usually, there are 2 options:
|
||||
|
||||
- either get a separate server for the base domain, just for serving the files necessary for [Server Delegation via a well-known file](howto-server-delegation.md#server-delegation-via-a-well-known-file)
|
||||
|
||||
- or, arrange for the Matrix server to serve the base domain. This either involves you [using your own webserver](configuring-playbook-own-webserver.md) or making the integrated webserver (`matrix-nginx-proxy`) serve the base domain for you.
|
||||
- or, arrange for the Matrix server to serve the base domain. This either involves you [using your own webserver](configuring-playbook-own-webserver.md) or making the integrated webserver serve the base domain for you.
|
||||
|
||||
This documentation page tells you how to do the latter. With some easy changes, we make it possible to serve the base domain from the Matrix server via the integrated webserver (`matrix-nginx-proxy`).
|
||||
This documentation page tells you how to do the latter. With some easy changes, we make it possible to serve the base domain from the Matrix server via the integrated webserver.
|
||||
|
||||
Just **adjust your DNS records**, so that your base domain is pointed to the Matrix server's IP address (using a DNS `A` record) **and then use the following configuration**:
|
||||
|
||||
|
||||
@ -20,8 +20,6 @@ matrix_bot_buscarron_hostname: "{{ matrix_server_fqn_matrix }}"
|
||||
matrix_bot_buscarron_path_prefix: /buscarron
|
||||
```
|
||||
|
||||
**NOTE**: When using `matrix-nginx-proxy` instead of Traefik, you won't be able to override the path prefix. You can only override the domain, but that needs to happen using another variable: `matrix_server_fqn_buscarron` (e.g. `matrix_server_fqn_buscarron: "form.{{ matrix_domain }}"`).
|
||||
|
||||
|
||||
## Adjusting DNS records
|
||||
|
||||
|
||||
@ -39,8 +39,6 @@ matrix_bot_go_neb_hostname: "{{ matrix_server_fqn_matrix }}"
|
||||
matrix_bot_go_neb_path_prefix: /go-neb
|
||||
```
|
||||
|
||||
**NOTE**: When using `matrix-nginx-proxy` instead of Traefik, you won't be able to override the path prefix. You can only override the domain, but that needs to happen using another variable: `matrix_server_fqn_go_neb` (e.g. `matrix_server_fqn_go_neb: "mybot.{{ matrix_domain }}"`).
|
||||
|
||||
|
||||
## Adjusting DNS records
|
||||
|
||||
|
||||
@ -59,7 +59,7 @@ Unless indicated otherwise, the following endpoints are reachable on your `matri
|
||||
| widgets | `/hookshot/widgetapi/` | `matrix_hookshot_widgets_endpoint` | Widgets |
|
||||
| metrics | `/metrics/hookshot` | `matrix_hookshot_metrics_enabled` and exposure enabled via `matrix_hookshot_metrics_proxying_enabled` or `matrix_metrics_exposure_enabled`. Read more in the [Metrics section](#metrics) below. | Prometheus |
|
||||
|
||||
See also `matrix_hookshot_matrix_nginx_proxy_configuration` in [init.yml](/roles/custom/matrix-bridge-hookshot/tasks/inject_into_nginx_proxy.yml).
|
||||
Also see the various `matrix_hookshot_container_labels_*` variables in in [default/main.yml](/roles/custom/matrix-bridge-hookshot/default/main.yml), which expose URLs publicly.
|
||||
|
||||
The different listeners are also reachable *internally* in the docker-network via the container's name (configured by `matrix_hookshot_container_url`) and on different ports (e.g. `matrix_hookshot_appservice_port`). Read [main.yml](/roles/custom/matrix-bridge-hookshot/defaults/main.yml) in detail for more info.
|
||||
|
||||
|
||||
@ -41,12 +41,11 @@ With that, your server's users will only be able to talk among themselves, but n
|
||||
**Disabling federation does not necessarily disable the federation port** (`8448`). Services like [Dimension](configuring-playbook-dimension.md) and [ma1sd](configuring-playbook-ma1sd.md) normally rely on `openid` APIs exposed on that port. Even if you disable federation and only if necessary, we may still be exposing the federation port and serving the `openid` APIs there. To override this and completely disable Synapse's federation port use:
|
||||
|
||||
```yaml
|
||||
matrix_homeserver_federation_enabled: false
|
||||
|
||||
# This stops the federation port on the Synapse side (normally `matrix-synapse:8048` on the container network).
|
||||
matrix_synapse_federation_port_enabled: false
|
||||
|
||||
# This removes the `8448` virtual host from the matrix-nginx-proxy reverse-proxy server.
|
||||
matrix_nginx_proxy_proxy_matrix_federation_api_enabled: false
|
||||
|
||||
# This stops the federation port on the synapse-reverse-proxy-companion side (normally `matrix-synapse-reverse-proxy-companion:8048` on the container network).
|
||||
matrix_synapse_reverse_proxy_companion_federation_api_enabled: false
|
||||
```
|
||||
@ -55,6 +54,8 @@ matrix_synapse_reverse_proxy_companion_federation_api_enabled: false
|
||||
|
||||
Why? This change could be useful for people running small Synapse instances on small severs/VPSes to avoid being impacted by a simple DOS/DDOS when bandwidth, RAM, an CPU resources are limited and if your hosting provider does not provide a DOS/DDOS protection.
|
||||
|
||||
**NOTE**: this approach hasn't been tested with the new Traefik-only setup that the playbook started using in 2024-01. It may not work.
|
||||
|
||||
The following changes in the configuration file (`inventory/host_vars/matrix.<your-domain>/vars.yml`) will allow this and make it possible to proxy the federation through a CDN such as CloudFlare or any other:
|
||||
|
||||
```
|
||||
|
||||
@ -1,83 +1,3 @@
|
||||
# Configure Nginx (optional, advanced)
|
||||
|
||||
**Note**: the playbook is [in the process of moving to Traefik](../CHANGELOG.md#reverse-proxy-configuration-changes-and-initial-traefik-support). Traefik is already the default reverse-proxy for new installations and existing users are also strongly encouraged to switch to Traefik. As such, this **nginx documentation below may be incomplete or misleading**.
|
||||
|
||||
|
||||
## Using Nginx status
|
||||
|
||||
This will serve a statuspage to the hosting machine only. Useful for monitoring software like [longview](https://www.linode.com/docs/platform/longview/longview-app-for-nginx/)
|
||||
|
||||
```yaml
|
||||
matrix_nginx_proxy_proxy_matrix_nginx_status_enabled: true
|
||||
```
|
||||
|
||||
This will serve the status page under the following addresses:
|
||||
- `http://matrix.DOMAIN/nginx_status` (using HTTP)
|
||||
- `https://matrix.DOMAIN/nginx_status` (using HTTPS)
|
||||
|
||||
By default, if ```matrix_nginx_proxy_nginx_status_enabled``` is enabled, access to the status page would be allowed from the local IP address of the server. If you wish to allow access from other IP addresses, you can provide them as a list:
|
||||
|
||||
```yaml
|
||||
matrix_nginx_proxy_proxy_matrix_nginx_status_allowed_addresses:
|
||||
- 8.8.8.8
|
||||
- 1.1.1.1
|
||||
```
|
||||
|
||||
## Adjusting SSL in your server
|
||||
|
||||
You can adjust how the SSL is served by the nginx server using the `matrix_nginx_proxy_ssl_preset` variable. We support a few presets, based on the Mozilla Server Side TLS
|
||||
Recommended configurations. These presets influence the TLS Protocol, the SSL Cipher Suites and the `ssl_prefer_server_ciphers` variable of nginx.
|
||||
Possible values are:
|
||||
|
||||
- `"modern"` - For Modern clients that support TLS 1.3, with no need for backwards compatibility
|
||||
- `"intermediate"` (**default**) - Recommended configuration for a general-purpose server
|
||||
- `"old"` - Services accessed by very old clients or libraries, such as Internet Explorer 8 (Windows XP), Java 6, or OpenSSL 0.9.8
|
||||
|
||||
**Be really carefull when setting it to `"modern"`**. This could break comunication with other Matrix servers, limiting your federation posibilities.
|
||||
|
||||
Besides changing the preset (`matrix_nginx_proxy_ssl_preset`), you can also directly override these 3 variables:
|
||||
|
||||
- `matrix_nginx_proxy_ssl_protocols`: for specifying the supported TLS protocols.
|
||||
- `matrix_nginx_proxy_ssl_prefer_server_ciphers`: for specifying if the server or the client choice when negotiating the cipher. It can set to `on` or `off`.
|
||||
- `matrix_nginx_proxy_ssl_ciphers`: for specifying the SSL Cipher suites used by nginx.
|
||||
|
||||
For more information about these variables, check the `roles/custom/matrix-nginx-proxy/defaults/main.yml` file.
|
||||
|
||||
## Synapse + OpenID Connect for Single-Sign-On
|
||||
|
||||
If you want to use OpenID Connect as an SSO provider (as per the [Synapse OpenID docs](https://github.com/matrix-org/synapse/blob/develop/docs/openid.md)), you need to use the following configuration (in your `vars.yml` file) to instruct nginx to forward `/_synapse/oidc` to Synapse:
|
||||
|
||||
```yaml
|
||||
matrix_synapse_container_labels_public_client_synapse_oidc_api_enabled: true
|
||||
```
|
||||
|
||||
## Disable Nginx access logs
|
||||
|
||||
This will disable the access logging for nginx.
|
||||
|
||||
```yaml
|
||||
matrix_nginx_proxy_access_log_enabled: false
|
||||
```
|
||||
|
||||
## Additional configuration
|
||||
|
||||
This playbook also allows for additional configuration to be applied to the nginx server.
|
||||
|
||||
If you want this playbook to obtain and renew certificates for other domains, then you can set the `matrix_ssl_additional_domains_to_obtain_certificates_for` variable (as mentioned in the [Obtaining SSL certificates for additional domains](configuring-playbook-ssl-certificates.md#obtaining-ssl-certificates-for-additional-domains) documentation as well). Make sure that you have set the DNS configuration for the domains you want to include to point at your server.
|
||||
|
||||
```yaml
|
||||
matrix_ssl_additional_domains_to_obtain_certificates_for:
|
||||
- domain.one.example
|
||||
- domain.two.example
|
||||
```
|
||||
|
||||
You can include additional nginx configuration by setting the `matrix_nginx_proxy_proxy_http_additional_server_configuration_blocks` variable.
|
||||
|
||||
```yaml
|
||||
matrix_nginx_proxy_proxy_http_additional_server_configuration_blocks:
|
||||
- |
|
||||
# These lines will be included in the nginx configuration.
|
||||
# This is at the top level of the file, so you will need to define all of the `server { ... }` blocks.
|
||||
- |
|
||||
# For advanced use, have a look at the template files in `roles/custom/matrix-nginx-proxy/templates/nginx/conf.d`
|
||||
```
|
||||
Since 2024-01, this playbook no longer uses nginx as its reverse-proxy.
|
||||
|
||||
@ -6,9 +6,11 @@ If that's alright, you can skip this.
|
||||
|
||||
## Traefik
|
||||
|
||||
[Traefik](https://traefik.io/) is the default reverse-proxy for the playbook since [2023-02-26](../CHANGELOG.md/#2023-02-26).
|
||||
[Traefik](https://traefik.io/) is the default reverse-proxy for the playbook since [2023-02-26](../CHANGELOG.md/#2023-02-26) and serves **2 purposes**:
|
||||
|
||||
Besides serving public traffic, Traefik is also used for internal communication between addon services (briges, bots, etc.) and the homeserver.
|
||||
- serving public traffic and providing SSL-termination with certificates obtained from [Let's Encrypt](https://letsencrypt.org/). See [Adjusting SSL certificate retrieval](./configuring-playbook-ssl-certificates.md).
|
||||
|
||||
- assists internal communication between addon services (briges, bots, etc.) and the homeserver via an internal entrypoint (`matrix-internal-matrix-client-api`).
|
||||
|
||||
There are 2 ways to use Traefik with this playbook, as described below.
|
||||
|
||||
@ -24,7 +26,6 @@ devture_traefik_config_certificatesResolvers_acme_email: YOUR_EMAIL_ADDRESS
|
||||
|
||||
Traefik will manage SSL certificates for all services seamlessly.
|
||||
|
||||
**Note**: for a while longer, our old reverse-proxy (`matrix-nginx-proxy`) will still be installed in local-only mode. Do not be alarmed to see `matrix-nginx-proxy` running even when you've chosen Traefik as your reverse-proxy. In the near future, we'll be able to run without nginx, but we're not there yet.
|
||||
|
||||
### Traefik managed by you
|
||||
|
||||
@ -46,7 +47,7 @@ devture_traefik_certs_dumper_ssl_dir_path: "/path/to/your/traefiks/acme.json/dir
|
||||
|
||||
In this mode all roles will still have Traefik labels attached. You will, however, need to configure your Traefik instance and its entrypoints.
|
||||
|
||||
By default, the playbook configured services use a `web-secure` (443) and `matrix-federation` (8448) entrypoints, as well as a `default` certificate resolver.
|
||||
By default, the playbook configured a `default` certificate resolver and multiple entrypoints.
|
||||
|
||||
You need to configure 4 entrypoints for your Traefik server:
|
||||
|
||||
@ -186,57 +187,3 @@ Instead of [Fronting the integrated reverse-proxy webserver with another reverse
|
||||
This is more difficult, as you would need to handle the configuration for each service manually. Enabling additional services would come with extra manual work you need to do.
|
||||
|
||||
If your webserver is on the same machine, ensure your web server user (something like `http`, `apache`, `www-data`, `nginx`) is part of the `matrix` group. You should run something like this: `usermod -a -G matrix nginx`. This allows your webserver user to access files owned by the `matrix` group, so that it can serve static files from `/matrix/static-files`.
|
||||
|
||||
#### Using your own nginx reverse-proxy running on the same machine
|
||||
|
||||
**WARNING**: this type of setup is not maintained and will be removed in the near future. We recommend that you go for [Fronting the integrated reverse-proxy webserver with another reverse-proxy](#fronting-the-integrated-reverse-proxy-webserver-with-another-reverse-proxy) instead.
|
||||
|
||||
If you'll be using `nginx` running on the same machine (not in a container), you can make the playbook help you generate configuration for `nginx` with this configuration:
|
||||
|
||||
```yaml
|
||||
matrix_playbook_reverse_proxy_type: other-nginx-non-container
|
||||
|
||||
# If you want https configured in /matrix/nginx-proxy/conf.d/
|
||||
matrix_nginx_proxy_https_enabled: true
|
||||
|
||||
# If you will manage SSL certificates yourself, uncomment the line below
|
||||
# matrix_ssl_retrieval_method: none
|
||||
|
||||
# If you're using an old nginx version, consider using a custom protocol list
|
||||
# (removing `TLSv1.3` that is enabled by default) to suit your nginx version.
|
||||
# matrix_nginx_proxy_ssl_protocols: "TLSv1.2"
|
||||
```
|
||||
|
||||
You can most likely directly use the config files installed by this playbook at: `/matrix/nginx-proxy/conf.d`. Just include them in your own `nginx.conf` like this: `include /matrix/nginx-proxy/conf.d/*.conf;`
|
||||
|
||||
#### Using your own reverse-proxy running on the same machine or elsewhere
|
||||
|
||||
**WARNING**: this is difficult to set up, likely not very well supported and will be removed in the future. We recommend that you go for [Fronting the integrated reverse-proxy webserver with another reverse-proxy](#fronting-the-integrated-reverse-proxy-webserver-with-another-reverse-proxy) instead.
|
||||
|
||||
To reverse-proxy manually for each service, use configuration like this:
|
||||
|
||||
```yaml
|
||||
# If your reverse-proxy runs on the same machine:
|
||||
matrix_playbook_reverse_proxy_type: other-on-same-host
|
||||
|
||||
# Or, if it runs on another machine:
|
||||
# matrix_playbook_reverse_proxy_type: other-on-another-host
|
||||
|
||||
# Or, optionally customize the network interface prefix (note the trailing `:` character).
|
||||
# For other-on-same-host, the interface defaults to `127.0.0.1:`.
|
||||
# For other-on-another-host, the interface defaults to `0.0.0.0:`.
|
||||
# matrix_playbook_service_host_bind_interface_prefix: '192.168.30.4:'
|
||||
```
|
||||
|
||||
With this configuration, each service will be exposed on a custom port. Example:
|
||||
|
||||
- Synapse will be exposed on port `8008`
|
||||
- [Grafana](configuring-playbook-prometheus-grafana.md) will be exposed on port `3000`
|
||||
- [synapse-admin](configuring-playbook-synapse-admin.md) will be exposed on port `8766`
|
||||
|
||||
You can capture traffic for these services and forward it to their port.
|
||||
Some of these services are configured with certain default expecations with regard to hostname, path, etc., so it's not completely arbitrary where you can host them (unless you change the defaults).
|
||||
|
||||
For each new playbook service that you enable, you'll need special handling.
|
||||
|
||||
The [`examples/`](../examples/) directory contains examples for various servers: Caddy, Apache, HAproxy, Nginx, etc.
|
||||
|
||||
@ -20,8 +20,6 @@ matrix_rageshake_hostname: "{{ matrix_server_fqn_matrix }}"
|
||||
matrix_rageshake_path_prefix: /rageshake
|
||||
```
|
||||
|
||||
**NOTE**: When using `matrix-nginx-proxy` instead of Traefik, you won't be able to override the path prefix. You can only override the domain, but that needs to happen using another variable: `matrix_server_fqn_rageshake` (e.g. `matrix_server_fqn_rageshake: "some-domain.{{ matrix_domain }}"`).
|
||||
|
||||
|
||||
## Adjusting DNS records
|
||||
|
||||
|
||||
@ -10,8 +10,6 @@ Element X iOS is [available on TestFlight](https://testflight.apple.com/join/uZb
|
||||
|
||||
Element X Android is [available on the Github Releases page](https://github.com/element-hq/element-x-android/releases).
|
||||
|
||||
**NOTE**: The Sliding Sync proxy **only works with the Traefik reverse-proxy**. If you have an old server installation (from the time `matrix-nginx-proxy` was our default reverse-proxy - `matrix_playbook_reverse_proxy_type: playbook-managed-nginx`), you won't be able to use Sliding Sync.
|
||||
|
||||
**NOTE**: The sliding-sync proxy is **not required** when using the **Conduit homeserver**. Starting from version `0.6.0` Conduit has native support for some sliding sync features. If there are issues with the native implementation, you might have a better experience when enabling the sliding-sync proxy anyway.
|
||||
|
||||
## Decide on a domain and path
|
||||
|
||||
@ -26,8 +26,6 @@ matrix_sygnal_hostname: "{{ matrix_server_fqn_matrix }}"
|
||||
matrix_sygnal_path_prefix: /sygnal
|
||||
```
|
||||
|
||||
**NOTE**: When using `matrix-nginx-proxy` instead of Traefik, you won't be able to override the path prefix. You can only override the domain, but that needs to happen using another variable: `matrix_server_fqn_sygnal` (e.g. `matrix_server_fqn_sygnal: "push.{{ matrix_domain }}"`).
|
||||
|
||||
|
||||
## Adjusting DNS records
|
||||
|
||||
|
||||
@ -37,15 +37,3 @@ After installation, Synapse Admin will be accessible at: `https://matrix.DOMAIN/
|
||||
To use Synapse Admin, you need to have [registered at least one administrator account](registering-users.md) on your server.
|
||||
|
||||
The Homeserver URL to use on Synapse Admin's login page is: `https://matrix.DOMAIN`
|
||||
|
||||
### Sample configuration for running behind Caddy v2
|
||||
|
||||
Below is a sample configuration for using this playbook with a [Caddy](https://caddyserver.com/v2) 2.0 reverse proxy (non-default configuration where `matrix-nginx-proxy` is disabled - `matrix_nginx_proxy_enabled: false`).
|
||||
|
||||
```caddy
|
||||
# This is a basic configuration that will function the same as the default nginx proxy - exposing the synapse-admin panel to matrix.YOURSERVER.com/synapse-admin/
|
||||
handle_path /synapse-admin* {
|
||||
reverse_proxy localhost:8766 {
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
@ -73,7 +73,7 @@ matrix_synapse_oidc_providers:
|
||||
backchannel_logout_enabled: true # Optional
|
||||
```
|
||||
|
||||
**NOTE**: if you inject the OIDC configuration using `matrix_synapse_configuration_extension_yaml` (instead of `matrix_synapse_oidc_enabled: true` + `matrix_synapse_oidc_providers`), then the OIDC routes (`/_synapse/oidc`) will not be publicly exposed automatically. In such a case, you'd need to expose them manually by toggling: `matrix_synapse_container_labels_public_client_synapse_oidc_api_enabled: true`.
|
||||
**NOTE**: if you inject the OIDC configuration using `matrix_synapse_configuration_extension_yaml` (instead of `matrix_synapse_oidc_enabled: true` + `matrix_synapse_oidc_providers` as explained above), then the OIDC routes (`/_synapse/oidc`) will not be publicly exposed automatically. In such a case, you'd need to expose them manually by toggling: `matrix_synapse_container_labels_public_client_synapse_oidc_api_enabled: true`.
|
||||
|
||||
|
||||
## Customizing templates
|
||||
|
||||
@ -65,8 +65,6 @@ When you're done with all the configuration you'd like to do, continue with [Ins
|
||||
|
||||
- [Configure the Traefik reverse-proxy](configuring-playbook-traefik.md) (optional, advanced)
|
||||
|
||||
- (Deprecated) [Configure the Nginx reverse-proxy](configuring-playbook-nginx.md) (optional, advanced)
|
||||
|
||||
- [Using your own webserver, instead of this playbook's default reverse-proxy](configuring-playbook-own-webserver.md) (optional, advanced)
|
||||
|
||||
- [Adjusting TURN server configuration](configuring-playbook-turn.md) (optional, advanced)
|
||||
|
||||
@ -73,50 +73,22 @@ Based on your setup, you have different ways to go about it:
|
||||
- [Server Delegation via a DNS SRV record (advanced)](#server-delegation-via-a-dns-srv-record-advanced)
|
||||
- [Obtaining certificates](#obtaining-certificates)
|
||||
- [Serving the Federation API with your certificates](#serving-the-federation-api-with-your-certificates)
|
||||
- [Serving the Federation API with your certificates and matrix-nginx-proxy](#serving-the-federation-api-with-your-certificates-and-matrix-nginx-proxy)
|
||||
- [Serving the Federation API with your certificates and another webserver](#serving-the-federation-api-with-your-certificates-and-another-webserver)
|
||||
- [Serving the Federation API with your certificates and Synapse handling Federation](#serving-the-federation-api-with-your-certificates-and-synapse-handling-federation)
|
||||
|
||||
|
||||
### Serving the Federation API with your certificates and matrix-nginx-proxy
|
||||
|
||||
**If you are using matrix-nginx-proxy**, a reverse-proxy webserver used by default in this playbook, you only need to override the certificates used for the Matrix Federation API. You can do that using:
|
||||
|
||||
```yaml
|
||||
# Adjust paths below to point to your certificate.
|
||||
#
|
||||
# NOTE: these are in-container paths. `/matrix/ssl` on the host is mounted into the container
|
||||
# at the same path (`/matrix/ssl`) by default, so if that's the path you need, it would be seamless.
|
||||
matrix_nginx_proxy_proxy_matrix_federation_api_ssl_certificate: /matrix/ssl/config/live/<your-domain>/fullchain.pem
|
||||
matrix_nginx_proxy_proxy_matrix_federation_api_ssl_certificate_key: /matrix/ssl/config/live/<your-domain>/privkey.pem
|
||||
```
|
||||
|
||||
If your files are not in `/matrix/ssl` but in some other location, you would need to mount them into the container:
|
||||
|
||||
```yaml
|
||||
matrix_nginx_proxy_container_extra_arguments:
|
||||
- "--mount type=bind,src=/some/path/on/the/host,dst=/some/path/inside/the/container,ro"
|
||||
```
|
||||
|
||||
You then refer to them (for `matrix_nginx_proxy_proxy_matrix_federation_api_ssl_certificate` and `matrix_nginx_proxy_proxy_matrix_federation_api_ssl_certificate_key`) by using `/some/path/inside/the/container`.
|
||||
|
||||
Make sure to reload matrix-nginx-proxy once in a while (`systemctl reload matrix-nginx-proxy`), so that newer certificates can kick in.
|
||||
Reloading doesn't cause any downtime.
|
||||
|
||||
|
||||
### Serving the Federation API with your certificates and another webserver
|
||||
|
||||
**If you are NOT using matrix-nginx-proxy**, but rather some other webserver, you can set up reverse-proxying for the `tcp/8448` port by yourself.
|
||||
**If you are using some other webserver**, you can set up reverse-proxying for the `tcp/8448` port by yourself.
|
||||
Make sure to use the proper certificates for `<your-domain>` (not for `matrix.<your-domain>`) when serving the `tcp/8448` port.
|
||||
|
||||
Proxying needs to happen to `127.0.0.1:8048` (unencrypted Synapse federation listener).
|
||||
|
||||
Make sure to reload/restart your webserver once in a while, so that newer certificates can kick in.
|
||||
|
||||
As recommended in our [Fronting the integrated reverse-proxy webserver with another reverse-proxy](./configuring-playbook-own-webserver.md#fronting-the-integrated-reverse-proxy-webserver-with-another-reverse-proxy) documentation section, we recommend you to expose the Matrix Federation entrypoint from traffic at a local port (e.g. `127.0.0.1:8449`), so your reverese-proxy should send traffic there.
|
||||
|
||||
### Serving the Federation API with your certificates and Synapse handling Federation
|
||||
|
||||
**Alternatively**, if you are **NOT using matrix-nginx-proxy** and **would rather not use your own webserver for Federation traffic**, you can let Synapse handle Federation by itself.
|
||||
**Alternatively**, you can let Synapse handle Federation by itself.
|
||||
|
||||
To do that, make sure the certificate files are mounted into the Synapse container:
|
||||
|
||||
|
||||
@ -102,21 +102,6 @@ matrix_coturn_systemd_required_services_list: ['docker.service']
|
||||
# This changes the path of the loaded certificate, while maintaining the original functionality, we're now loading the wildcard certificate.
|
||||
matrix_coturn_container_additional_volumes: |
|
||||
{{
|
||||
(
|
||||
[
|
||||
{
|
||||
'src': (matrix_ssl_config_dir_path + '/live/*.' + matrix_domain + '/fullchain.pem'),
|
||||
'dst': '/fullchain.pem',
|
||||
'options': 'ro',
|
||||
},
|
||||
{
|
||||
'src': (matrix_ssl_config_dir_path + '/live/*.' + matrix_domain + '/privkey.pem'),
|
||||
'dst': '/privkey.pem',
|
||||
'options': 'ro',
|
||||
},
|
||||
] if matrix_playbook_reverse_proxy_type in ['playbook-managed-nginx', 'other-nginx-non-container'] and matrix_coturn_tls_enabled else []
|
||||
)
|
||||
+
|
||||
(
|
||||
[
|
||||
{
|
||||
@ -180,21 +165,6 @@ matrix_coturn_systemd_required_services_list: ['docker.service']
|
||||
# This changes the path of the loaded certificate, while maintaining the original functionality, we're now loading the wildcard certificate.
|
||||
matrix_coturn_container_additional_volumes: |
|
||||
{{
|
||||
(
|
||||
[
|
||||
{
|
||||
'src': (matrix_ssl_config_dir_path + '/live/*.' + matrix_domain + '/fullchain.pem'),
|
||||
'dst': '/fullchain.pem',
|
||||
'options': 'ro',
|
||||
},
|
||||
{
|
||||
'src': (matrix_ssl_config_dir_path + '/live/*.' + matrix_domain + '/privkey.pem'),
|
||||
'dst': '/privkey.pem',
|
||||
'options': 'ro',
|
||||
},
|
||||
] if matrix_playbook_reverse_proxy_type in ['playbook-managed-nginx', 'other-nginx-non-container'] and matrix_coturn_tls_enabled else []
|
||||
)
|
||||
+
|
||||
(
|
||||
[
|
||||
{
|
||||
|
||||
@ -4,15 +4,20 @@
|
||||
|
||||
You can check the status of your services by using `systemctl status`. Example:
|
||||
```
|
||||
sudo systemctl status matrix-nginx-proxy
|
||||
sudo systemctl status matrix-synapse
|
||||
|
||||
● matrix-nginx-proxy.service - Matrix nginx proxy server
|
||||
Loaded: loaded (/etc/systemd/system/matrix-nginx-proxy.service; enabled; vendor preset: enabled)
|
||||
Active: active (running) since Wed 2018-11-14 19:38:35 UTC; 49min ago
|
||||
● matrix-synapse.service - Synapse server
|
||||
Loaded: loaded (/etc/systemd/system/matrix-synapse.service; enabled; vendor preset: enabled)
|
||||
Active: active (running) since Sun 2024-01-14 09:13:06 UTC; 1h 31min ago
|
||||
```
|
||||
|
||||
You can see the logs by using journalctl. Example:
|
||||
```
|
||||
Docker containers that the playbook configures are supervised by [systemd](https://wiki.archlinux.org/title/Systemd) and their logs are configured to go to [systemd-journald](https://wiki.archlinux.org/title/Systemd/Journal).
|
||||
|
||||
To prevent double-logging, Docker logging is disabled by explicitly passing `--log-driver=none` to all containers. Due to this, you **cannot** view logs using `docker logs`.
|
||||
|
||||
To view systemd-journald logs using [journalctl](https://man.archlinux.org/man/journalctl.1), run a command like this:
|
||||
|
||||
```sh
|
||||
sudo journalctl -fu matrix-synapse
|
||||
```
|
||||
|
||||
|
||||
@ -27,10 +27,6 @@ matrix_playbook_traefik_labels_enabled: "{{ matrix_playbook_reverse_proxy_type i
|
||||
matrix_playbook_reverse_proxy_container_network: "{{ devture_traefik_container_network if devture_traefik_enabled else 'traefik' }}"
|
||||
matrix_playbook_reverse_proxy_hostname: "{{ devture_traefik_identifier if devture_traefik_enabled else 'traefik' }}"
|
||||
|
||||
matrix_playbook_ssl_retrieval_method: "{{ 'lets-encrypt' if devture_traefik_certs_dumper_enabled else matrix_ssl_retrieval_method }}"
|
||||
|
||||
matrix_playbook_ssl_enabled: "{{ matrix_playbook_ssl_retrieval_method in ['lets-encrypt', 'self-signed', 'manually-managed'] }}"
|
||||
|
||||
# A separate Matrix Federation entrypoint is always enabled, unless the federation port matches one of the ports for existing (default) entrypoints
|
||||
matrix_playbook_public_matrix_federation_api_traefik_entrypoint_enabled: "{{ matrix_federation_public_port not in [devture_traefik_config_entrypoint_web_port, devture_traefik_config_entrypoint_web_secure_port] }}"
|
||||
|
||||
@ -360,10 +356,6 @@ devture_systemd_service_manager_services_list_auto: |
|
||||
+
|
||||
([{'name': (exim_relay_identifier ~ '.service'), 'priority': 2000, 'groups': ['matrix', 'mailer', 'exim-relay']}] if exim_relay_enabled else [])
|
||||
+
|
||||
([{'name': 'matrix-nginx-proxy.service', 'priority': 3000, 'groups': ['matrix', 'nginx', 'nginx-proxy', 'reverse-proxies']}] if matrix_nginx_proxy_enabled else [])
|
||||
+
|
||||
(matrix_ssl_renewal_systemd_units_list | selectattr('applicable') | selectattr('enableable') | list )
|
||||
+
|
||||
([{'name': (ntfy_identifier + '.service'), 'priority': 800, 'groups': ['matrix', 'ntfy']}] if ntfy_enabled else [])
|
||||
+
|
||||
([{'name': (devture_postgres_identifier + '.service'), 'priority': 500, 'groups': ['matrix', 'postgres']}] if devture_postgres_enabled else [])
|
||||
@ -565,9 +557,6 @@ matrix_appservice_webhooks_systemd_required_services_list_auto: |
|
||||
|
||||
matrix_appservice_webhooks_container_image_self_build: "{{ matrix_architecture != 'amd64' }}"
|
||||
|
||||
# Normally, matrix-nginx-proxy is enabled and nginx can reach matrix-appservice-webhooks over the container network.
|
||||
# If matrix-nginx-proxy is not enabled, or you otherwise have a need for it, you can expose
|
||||
# matrix-appservice-webhooks' client-server port to the local host.
|
||||
matrix_appservice_webhooks_container_http_host_bind_port: "{{ (matrix_playbook_service_host_bind_interface_prefix ~ matrix_appservice_webhooks_matrix_port) if matrix_playbook_service_host_bind_interface_prefix else '' }}"
|
||||
|
||||
matrix_appservice_webhooks_container_network: "{{ matrix_addons_container_network }}"
|
||||
@ -677,9 +666,6 @@ matrix_appservice_irc_systemd_required_services_list_auto: |
|
||||
|
||||
matrix_appservice_irc_container_image_self_build: "{{ matrix_architecture != 'amd64' }}"
|
||||
|
||||
# Normally, matrix-nginx-proxy is enabled and nginx can reach matrix-appservice-irc over the container network.
|
||||
# If matrix-nginx-proxy is not enabled, or you otherwise have a need for it, you can expose
|
||||
# matrix-appservice-irc's client-server port to the local host.
|
||||
matrix_appservice_irc_container_http_host_bind_port: "{{ (matrix_playbook_service_host_bind_interface_prefix ~ '9999') if matrix_playbook_service_host_bind_interface_prefix else '' }}"
|
||||
|
||||
matrix_appservice_irc_container_network: "{{ matrix_addons_container_network }}"
|
||||
@ -2318,17 +2304,10 @@ matrix_bot_postmoogle_ssl_path: |-
|
||||
{
|
||||
'playbook-managed-traefik': devture_traefik_certs_dumper_dumped_certificates_dir_path,
|
||||
'other-traefik-container': devture_traefik_certs_dumper_dumped_certificates_dir_path,
|
||||
'playbook-managed-nginx': (matrix_ssl_config_dir_path if matrix_playbook_ssl_retrieval_method != 'none' else ''),
|
||||
'other-nginx-non-container': (matrix_ssl_config_dir_path if matrix_playbook_ssl_retrieval_method != 'none' else ''),
|
||||
'other-on-same-host': '',
|
||||
'other-on-another-host': '',
|
||||
'none': '',
|
||||
}[matrix_playbook_reverse_proxy_type]
|
||||
}}
|
||||
|
||||
matrix_playbook_bot_postmoogle_nginx_proxy_tls_cert: "{% for domain in matrix_bot_postmoogle_domains %}/ssl/live/{{ domain }}/fullchain.pem {% endfor %}"
|
||||
matrix_playbook_bot_postmoogle_nginx_proxy_key: "{% for domain in matrix_bot_postmoogle_domains %}/ssl/live/{{ domain }}/privkey.pem {% endfor %}"
|
||||
|
||||
matrix_playbook_bot_postmoogle_traefik_tls_cert: "{% for domain in matrix_bot_postmoogle_domains %}/ssl/{{ domain }}/certificate.crt {% endfor %}"
|
||||
matrix_playbook_bot_postmoogle_traefik_key: "{% for domain in matrix_bot_postmoogle_domains %}/ssl/{{ domain }}/privatekey.key {% endfor %}"
|
||||
|
||||
@ -2337,10 +2316,6 @@ matrix_bot_postmoogle_tls_cert: |-
|
||||
{
|
||||
'playbook-managed-traefik': matrix_playbook_bot_postmoogle_traefik_tls_cert,
|
||||
'other-traefik-container': matrix_playbook_bot_postmoogle_traefik_tls_cert,
|
||||
'playbook-managed-nginx': (matrix_playbook_bot_postmoogle_nginx_proxy_tls_cert if matrix_playbook_ssl_retrieval_method != 'none' else ''),
|
||||
'other-nginx-non-container': (matrix_playbook_bot_postmoogle_nginx_proxy_tls_cert if matrix_playbook_ssl_retrieval_method != 'none' else ''),
|
||||
'other-on-same-host': '',
|
||||
'other-on-another-host': '',
|
||||
'none': '',
|
||||
}[matrix_playbook_reverse_proxy_type]
|
||||
}}
|
||||
@ -2350,10 +2325,6 @@ matrix_bot_postmoogle_tls_key: |-
|
||||
{
|
||||
'playbook-managed-traefik': matrix_playbook_bot_postmoogle_traefik_key,
|
||||
'other-traefik-container': matrix_playbook_bot_postmoogle_traefik_key,
|
||||
'playbook-managed-nginx': (matrix_playbook_bot_postmoogle_nginx_proxy_key if matrix_playbook_ssl_retrieval_method != 'none' else ''),
|
||||
'other-nginx-non-container': (matrix_playbook_bot_postmoogle_nginx_proxy_key if matrix_playbook_ssl_retrieval_method != 'none' else ''),
|
||||
'other-on-same-host': '',
|
||||
'other-on-another-host': '',
|
||||
'none': '',
|
||||
}[matrix_playbook_reverse_proxy_type]
|
||||
}}
|
||||
@ -2736,17 +2707,13 @@ matrix_coturn_turn_external_ip_address: "{{ ansible_host }}"
|
||||
|
||||
matrix_coturn_turn_static_auth_secret: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'coturn.sas', rounds=655555) | to_uuid }}"
|
||||
|
||||
matrix_coturn_tls_enabled: "{{ matrix_playbook_ssl_retrieval_method != 'none' }}"
|
||||
matrix_coturn_tls_enabled: "{{ matrix_playbook_ssl_enabled }}"
|
||||
|
||||
matrix_coturn_tls_cert_path: |-
|
||||
{{
|
||||
{
|
||||
'playbook-managed-traefik': '/certificate.crt',
|
||||
'other-traefik-container': '/certificate.crt',
|
||||
'playbook-managed-nginx': '/fullchain.pem',
|
||||
'other-nginx-non-container': '/fullchain.pem',
|
||||
'other-on-same-host': '',
|
||||
'other-on-another-host': '',
|
||||
'none': '',
|
||||
}[matrix_playbook_reverse_proxy_type]
|
||||
}}
|
||||
@ -2756,31 +2723,12 @@ matrix_coturn_tls_key_path: |-
|
||||
{
|
||||
'playbook-managed-traefik': '/privatekey.key',
|
||||
'other-traefik-container': '/privatekey.key',
|
||||
'playbook-managed-nginx': '/privkey.pem',
|
||||
'other-nginx-non-container': '/privkey.pem',
|
||||
'other-on-same-host': '',
|
||||
'other-on-another-host': '',
|
||||
'none': '',
|
||||
}[matrix_playbook_reverse_proxy_type]
|
||||
}}
|
||||
|
||||
matrix_coturn_container_additional_volumes: |
|
||||
{{
|
||||
(
|
||||
[
|
||||
{
|
||||
'src': (matrix_ssl_config_dir_path + '/live/' + matrix_server_fqn_matrix + '/fullchain.pem'),
|
||||
'dst': '/fullchain.pem',
|
||||
'options': 'ro',
|
||||
},
|
||||
{
|
||||
'src': (matrix_ssl_config_dir_path + '/live/' + matrix_server_fqn_matrix + '/privkey.pem'),
|
||||
'dst': '/privkey.pem',
|
||||
'options': 'ro',
|
||||
},
|
||||
] if matrix_playbook_reverse_proxy_type in ['playbook-managed-nginx', 'other-nginx-non-container'] and matrix_coturn_tls_enabled else []
|
||||
)
|
||||
+
|
||||
(
|
||||
[
|
||||
{
|
||||
@ -2899,7 +2847,7 @@ etherpad_container_image_self_build: "{{ matrix_architecture not in ['amd64'] }}
|
||||
|
||||
etherpad_container_http_host_bind_port: "{{ (matrix_playbook_service_host_bind_interface_prefix ~ '9001') if matrix_playbook_service_host_bind_interface_prefix else '' }}"
|
||||
|
||||
etherpad_container_network: "{{ matrix_nginx_proxy_container_network if matrix_playbook_reverse_proxy_type == 'playbook-managed-nginx' else etherpad_identifier }}"
|
||||
etherpad_container_network: "{{ matrix_addons_container_network }}"
|
||||
|
||||
etherpad_container_additional_networks: |
|
||||
{{
|
||||
@ -2998,9 +2946,6 @@ jitsi_gid: "{{ matrix_user_gid }}"
|
||||
|
||||
jitsi_user_username: "{{ matrix_user_username }}"
|
||||
|
||||
# Normally, matrix-nginx-proxy is enabled and nginx can reach jitsi/web over the container network.
|
||||
# If matrix-nginx-proxy is not enabled, or you otherwise have a need for it, you can expose
|
||||
# the Jitsi HTTP port to the local host.
|
||||
jitsi_web_container_http_host_bind_port: "{{ (matrix_playbook_service_host_bind_interface_prefix ~ '13080') if matrix_playbook_service_host_bind_interface_prefix else '' }}"
|
||||
|
||||
jitsi_web_container_additional_networks_auto: |
|
||||
@ -3062,7 +3007,7 @@ jitsi_prosody_auth_matrix_uvs_sync_power_levels: "{{ matrix_user_verification_se
|
||||
jitsi_prosody_auth_matrix_uvs_auth_token: "{{ matrix_user_verification_service_uvs_auth_token }}"
|
||||
jitsi_prosody_auth_matrix_uvs_location: "{{ matrix_user_verification_service_container_url }}"
|
||||
|
||||
jitsi_self_check_validate_certificates: "{{ false if matrix_ssl_retrieval_method == 'self-signed' else true }}"
|
||||
jitsi_self_check_validate_certificates: "{{ matrix_playbook_ssl_enabled }}"
|
||||
|
||||
# Gravatar is enabled by default upstream, but there's no need to leak data there needlessly
|
||||
# when embedding Jitsi in Matrix rooms.
|
||||
@ -3168,9 +3113,6 @@ matrix_ma1sd_hostname: "{{ matrix_server_fqn_matrix }}"
|
||||
|
||||
matrix_ma1sd_container_image_self_build: "{{ matrix_architecture != 'amd64' }}"
|
||||
|
||||
# Normally, matrix-nginx-proxy is enabled and nginx can reach ma1sd over the container network.
|
||||
# If matrix-nginx-proxy is not enabled, or you otherwise have a need for it, you can expose
|
||||
# ma1sd's web-server port.
|
||||
matrix_ma1sd_container_http_host_bind_port: "{{ (matrix_playbook_service_host_bind_interface_prefix ~ '' ~ matrix_ma1sd_container_port | string) if matrix_playbook_service_host_bind_interface_prefix else '' }}"
|
||||
|
||||
matrix_ma1sd_container_network: "{{ matrix_homeserver_container_network }}"
|
||||
@ -3210,7 +3152,7 @@ matrix_ma1sd_threepid_medium_email_connectors_smtp_host: "{{ exim_relay_identifi
|
||||
matrix_ma1sd_threepid_medium_email_connectors_smtp_port: 8025
|
||||
matrix_ma1sd_threepid_medium_email_connectors_smtp_tls: 0
|
||||
|
||||
matrix_ma1sd_self_check_validate_certificates: "{{ false if matrix_playbook_ssl_retrieval_method == 'self-signed' else true }}"
|
||||
matrix_ma1sd_self_check_validate_certificates: "{{ matrix_playbook_ssl_enabled }}"
|
||||
|
||||
matrix_ma1sd_systemd_required_services_list_auto: |
|
||||
{{
|
||||
@ -3305,198 +3247,6 @@ matrix_media_repo_homeserver_federation_enabled: "{{ matrix_homeserver_federatio
|
||||
#
|
||||
######################################################################
|
||||
|
||||
######################################################################
|
||||
#
|
||||
# matrix-nginx-proxy
|
||||
#
|
||||
######################################################################
|
||||
|
||||
# This playbook installs its own nginx if
|
||||
# - it's explicitly enabled
|
||||
# - Traefik is in use. Not all services are Traefik-native yet, so we use reverse-proxy to some via a local-only matrix-nginx-proxy
|
||||
matrix_nginx_proxy_enabled: "{{ matrix_playbook_reverse_proxy_type in ['playbook-managed-nginx', 'playbook-managed-traefik', 'other-traefik-container'] }}"
|
||||
|
||||
# matrix-nginx-proxy is only to handle HTTPS only if it's the chosen reverse-proxy.
|
||||
# It may be enabled even if it's not chosen. See `matrix_nginx_proxy_enabled`.
|
||||
matrix_ssl_retrieval_method: "{{ 'lets-encrypt' if matrix_playbook_reverse_proxy_type == 'playbook-managed-nginx' else 'none' }}"
|
||||
matrix_nginx_proxy_https_enabled: "{{ matrix_playbook_reverse_proxy_type == 'playbook-managed-nginx' }}"
|
||||
|
||||
# matrix-nginx-proxy is to publish ports only if it's the chosen reverse-proxy.
|
||||
# It may be enabled even if it's not chosen. See `matrix_nginx_proxy_enabled`.
|
||||
matrix_nginx_proxy_container_http_host_bind_port: "{{ '80' if matrix_playbook_reverse_proxy_type == 'playbook-managed-nginx' else '' }}"
|
||||
matrix_nginx_proxy_container_federation_host_bind_port: "{{ matrix_federation_public_port if matrix_playbook_reverse_proxy_type == 'playbook-managed-nginx' else '' }}"
|
||||
|
||||
# matrix-nginx-proxy is to trust reverse-proxy forwarded protocol and headers, unless it's the "main" (chosen) reverse-proxy
|
||||
matrix_nginx_proxy_trust_forwarded_proto: "{{ matrix_playbook_reverse_proxy_type != 'playbook-managed-nginx' }}"
|
||||
matrix_nginx_proxy_x_forwarded_for: "{{ '$remote_addr' if matrix_playbook_reverse_proxy_type == 'playbook-managed-nginx' else '$proxy_add_x_forwarded_for' }}"
|
||||
|
||||
matrix_nginx_proxy_container_additional_networks: |
|
||||
{{
|
||||
(
|
||||
([matrix_playbook_reverse_proxyable_services_additional_network] if matrix_playbook_reverse_proxyable_services_additional_network else [])
|
||||
+
|
||||
([matrix_prometheus_nginxlog_exporter_container_network] if (matrix_prometheus_nginxlog_exporter_enabled and matrix_prometheus_nginxlog_exporter_container_network != matrix_nginx_proxy_container_network) else [])
|
||||
+
|
||||
([jitsi_container_network] if jitsi_enabled and matrix_playbook_reverse_proxy_type == 'playbook-managed-nginx' and jitsi_container_network != matrix_nginx_proxy_container_network else [])
|
||||
) | unique
|
||||
}}
|
||||
|
||||
matrix_nginx_proxy_proxy_matrix_client_api_addr_with_container: "{{ 'matrix-corporal:41080' if matrix_corporal_enabled else 'matrix-nginx-proxy:12080' }}"
|
||||
matrix_nginx_proxy_proxy_matrix_client_api_addr_sans_container: "{{ '127.0.0.1:41080' if matrix_corporal_enabled else '127.0.0.1:12080' }}"
|
||||
matrix_nginx_proxy_proxy_matrix_client_api_client_max_body_size_mb: |-
|
||||
{{
|
||||
{
|
||||
'synapse': matrix_synapse_max_upload_size_mb,
|
||||
'dendrite': (matrix_dendrite_max_file_size_bytes / 1024 / 1024) | round,
|
||||
'conduit': (matrix_conduit_max_request_size / 1024 / 1024) | round,
|
||||
}[matrix_homeserver_implementation]|int
|
||||
}}
|
||||
|
||||
matrix_nginx_proxy_proxy_matrix_enabled: true
|
||||
matrix_nginx_proxy_proxy_element_enabled: "{{ matrix_client_element_enabled and matrix_playbook_reverse_proxy_type in ['playbook-managed-nginx', 'other-nginx-non-container'] }}"
|
||||
matrix_nginx_proxy_proxy_hydrogen_enabled: "{{ matrix_client_hydrogen_enabled and matrix_playbook_reverse_proxy_type in ['playbook-managed-nginx', 'other-nginx-non-container'] }}"
|
||||
matrix_nginx_proxy_proxy_cinny_enabled: "{{ matrix_client_cinny_enabled and matrix_playbook_reverse_proxy_type in ['playbook-managed-nginx', 'other-nginx-non-container'] }}"
|
||||
matrix_nginx_proxy_proxy_schildichat_enabled: "{{ matrix_client_schildichat_enabled and matrix_playbook_reverse_proxy_type in ['playbook-managed-nginx', 'other-nginx-non-container'] }}"
|
||||
matrix_nginx_proxy_proxy_buscarron_enabled: "{{ matrix_bot_buscarron_enabled and matrix_playbook_reverse_proxy_type in ['playbook-managed-nginx', 'other-nginx-non-container'] }}"
|
||||
matrix_nginx_proxy_proxy_dimension_enabled: "{{ matrix_dimension_enabled and matrix_playbook_reverse_proxy_type in ['playbook-managed-nginx', 'other-nginx-non-container'] }}"
|
||||
matrix_nginx_proxy_proxy_rageshake_enabled: "{{ matrix_rageshake_enabled and matrix_playbook_reverse_proxy_type in ['playbook-managed-nginx', 'other-nginx-non-container'] }}"
|
||||
matrix_nginx_proxy_proxy_bot_go_neb_enabled: "{{ matrix_bot_go_neb_enabled and matrix_playbook_reverse_proxy_type in ['playbook-managed-nginx', 'other-nginx-non-container'] }}"
|
||||
matrix_nginx_proxy_proxy_mautrix_wsproxy_enabled: "{{ matrix_mautrix_wsproxy_enabled and matrix_playbook_reverse_proxy_type in ['playbook-managed-nginx', 'other-nginx-non-container'] }}"
|
||||
|
||||
matrix_nginx_proxy_proxy_jitsi_enabled: "{{ jitsi_enabled and matrix_playbook_reverse_proxy_type in ['playbook-managed-nginx', 'other-nginx-non-container'] }}"
|
||||
|
||||
matrix_nginx_proxy_proxy_grafana_enabled: "{{ grafana_enabled and matrix_playbook_reverse_proxy_type in ['playbook-managed-nginx', 'other-nginx-non-container'] }}"
|
||||
matrix_nginx_proxy_proxy_sygnal_enabled: "{{ matrix_sygnal_enabled and matrix_playbook_reverse_proxy_type in ['playbook-managed-nginx', 'other-nginx-non-container'] }}"
|
||||
matrix_nginx_proxy_proxy_ntfy_enabled: "{{ ntfy_enabled and matrix_playbook_reverse_proxy_type in ['playbook-managed-nginx', 'other-nginx-non-container'] }}"
|
||||
|
||||
|
||||
matrix_nginx_proxy_proxy_matrix_corporal_api_enabled: "{{ matrix_corporal_enabled and matrix_corporal_http_api_enabled and matrix_playbook_reverse_proxy_type in ['playbook-managed-nginx', 'other-nginx-non-container'] }}"
|
||||
matrix_nginx_proxy_proxy_matrix_corporal_api_addr_with_container: "matrix-corporal:41081"
|
||||
matrix_nginx_proxy_proxy_matrix_corporal_api_addr_sans_container: "127.0.0.1:41081"
|
||||
|
||||
# NOTE: we cannot disable this, even though matrix-media-repo is already natively exposed at the Traefik level.
|
||||
# See: https://github.com/spantaleev/matrix-docker-ansible-deploy/pull/3045#issuecomment-1867327001
|
||||
matrix_nginx_proxy_proxy_media_repo_enabled: "{{ matrix_media_repo_enabled }}"
|
||||
matrix_nginx_proxy_proxy_media_repo_addr_with_container: "{{ matrix_media_repo_identifier }}:{{ matrix_media_repo_port }}"
|
||||
matrix_nginx_proxy_proxy_media_repo_addr_sans_container: "127.0.0.1:{{ matrix_media_repo_port }}"
|
||||
|
||||
# By default, we do TLS termination for the Matrix Federation API (port 8448) at matrix-nginx-proxy.
|
||||
# Unless this is handled there OR Synapse's federation listener port is disabled, we'll reverse-proxy.
|
||||
matrix_nginx_proxy_proxy_matrix_federation_api_enabled: |-
|
||||
{{
|
||||
{
|
||||
'synapse': (matrix_synapse_federation_port_enabled and not matrix_synapse_tls_federation_listener_enabled),
|
||||
'dendrite': matrix_dendrite_federation_enabled,
|
||||
'conduit': matrix_conduit_allow_federation,
|
||||
}[matrix_homeserver_implementation]|bool
|
||||
}}
|
||||
|
||||
matrix_nginx_proxy_proxy_matrix_federation_api_addr_with_container: "matrix-nginx-proxy:12088"
|
||||
matrix_nginx_proxy_proxy_matrix_federation_api_addr_sans_container: "127.0.0.1:12088"
|
||||
|
||||
# When matrix-nginx-proxy is disabled, the actual port number that the vhost uses may begin to matter.
|
||||
matrix_nginx_proxy_proxy_matrix_federation_port: "{{ matrix_federation_public_port }}"
|
||||
|
||||
# OCSP stapling does not make sense when self-signed certificates are used.
|
||||
# See https://github.com/spantaleev/matrix-docker-ansible-deploy/issues/1073
|
||||
# and https://github.com/spantaleev/matrix-docker-ansible-deploy/pull/1074
|
||||
matrix_nginx_proxy_ocsp_stapling_enabled: "{{ matrix_playbook_ssl_retrieval_method != 'self-signed' }}"
|
||||
|
||||
matrix_nginx_proxy_systemd_wanted_services_list: |
|
||||
{{
|
||||
['matrix-' + matrix_homeserver_implementation + '.service']
|
||||
+
|
||||
(matrix_synapse_webserving_workers_systemd_services_list if matrix_homeserver_implementation == 'synapse' and matrix_synapse_workers_enabled else [])
|
||||
+
|
||||
(['matrix-synapse-reverse-proxy-companion.service'] if matrix_synapse_reverse_proxy_companion_enabled else [])
|
||||
+
|
||||
(['matrix-corporal.service'] if matrix_corporal_enabled else [])
|
||||
+
|
||||
([(matrix_media_repo_identifier + '.service')] if matrix_media_repo_enabled else [])
|
||||
+
|
||||
(['matrix-client-cinny.service'] if matrix_client_cinny_enabled and matrix_playbook_reverse_proxy_type in ['playbook-managed-nginx', 'other-nginx-non-container'] else [])
|
||||
+
|
||||
(['matrix-bot-buscarron.service'] if matrix_bot_buscarron_enabled and matrix_playbook_reverse_proxy_type in ['playbook-managed-nginx', 'other-nginx-non-container'] else [])
|
||||
+
|
||||
(['matrix-client-element.service'] if matrix_client_element_enabled and matrix_playbook_reverse_proxy_type in ['playbook-managed-nginx', 'other-nginx-non-container'] else [])
|
||||
+
|
||||
(['matrix-client-hydrogen.service'] if matrix_client_hydrogen_enabled and matrix_playbook_reverse_proxy_type in ['playbook-managed-nginx', 'other-nginx-non-container'] else [])
|
||||
+
|
||||
(['matrix-client-schildichat.service'] if matrix_client_schildichat_enabled and matrix_playbook_reverse_proxy_type in ['playbook-managed-nginx', 'other-nginx-non-container'] else [])
|
||||
+
|
||||
([(grafana_identifier + '.service')] if grafana_enabled and matrix_playbook_reverse_proxy_type in ['playbook-managed-nginx', 'other-nginx-non-container'] else [])
|
||||
+
|
||||
(['matrix-dimension.service'] if matrix_dimension_enabled and matrix_playbook_reverse_proxy_type in ['playbook-managed-nginx', 'other-nginx-non-container'] else [])
|
||||
+
|
||||
(['matrix-rageshake.service'] if matrix_rageshake_enabled and matrix_playbook_reverse_proxy_type in ['playbook-managed-nginx', 'other-nginx-non-container'] else [])
|
||||
+
|
||||
(['matrix-sygnal.service'] if matrix_sygnal_enabled and matrix_playbook_reverse_proxy_type in ['playbook-managed-nginx', 'other-nginx-non-container'] else [])
|
||||
+
|
||||
([(ntfy_identifier + '.service')] if ntfy_enabled and matrix_playbook_reverse_proxy_type in ['playbook-managed-nginx', 'other-nginx-non-container'] else [])
|
||||
+
|
||||
([(jitsi_identifier + '-web.service')] if jitsi_enabled and matrix_playbook_reverse_proxy_type in ['playbook-managed-nginx', 'other-nginx-non-container'] else [])
|
||||
+
|
||||
(['matrix-bot-go-neb.service'] if matrix_bot_go_neb_enabled and matrix_playbook_reverse_proxy_type in ['playbook-managed-nginx', 'other-nginx-non-container'] else [])
|
||||
+
|
||||
([etherpad_identifier + '.service'] if etherpad_enabled and matrix_playbook_reverse_proxy_type in ['playbook-managed-nginx', 'other-nginx-non-container'] else [])
|
||||
+
|
||||
(['matrix-hookshot.service'] if matrix_hookshot_enabled and matrix_playbook_reverse_proxy_type in ['playbook-managed-nginx', 'other-nginx-non-container'] else [])
|
||||
}}
|
||||
|
||||
matrix_ssl_domains_to_obtain_certificates_for: |
|
||||
{{
|
||||
([matrix_server_fqn_matrix])
|
||||
+
|
||||
([matrix_server_fqn_element] if matrix_client_element_enabled else [])
|
||||
+
|
||||
([matrix_server_fqn_hydrogen] if matrix_client_hydrogen_enabled else [])
|
||||
+
|
||||
([matrix_server_fqn_cinny] if matrix_client_cinny_enabled else [])
|
||||
+
|
||||
([matrix_server_fqn_schildichat] if matrix_client_schildichat_enabled else [])
|
||||
+
|
||||
([matrix_server_fqn_buscarron] if matrix_bot_buscarron_enabled else [])
|
||||
+
|
||||
([matrix_server_fqn_dimension] if matrix_dimension_enabled else [])
|
||||
+
|
||||
([matrix_server_fqn_bot_go_neb] if matrix_bot_go_neb_enabled else [])
|
||||
+
|
||||
([matrix_server_fqn_jitsi] if jitsi_enabled else [])
|
||||
+
|
||||
([matrix_server_fqn_grafana] if grafana_enabled else [])
|
||||
+
|
||||
([matrix_server_fqn_sygnal] if matrix_sygnal_enabled else [])
|
||||
+
|
||||
([matrix_server_fqn_mautrix_wsproxy] if matrix_mautrix_wsproxy_enabled else [])
|
||||
+
|
||||
([ntfy_hostname] if ntfy_enabled else [])
|
||||
+
|
||||
([matrix_server_fqn_rageshake] if matrix_rageshake_enabled else [])
|
||||
+
|
||||
(matrix_bot_postmoogle_domains if matrix_bot_postmoogle_enabled else [])
|
||||
+
|
||||
matrix_ssl_additional_domains_to_obtain_certificates_for
|
||||
}}
|
||||
|
||||
matrix_ssl_architecture: "{{
|
||||
{
|
||||
'amd64': 'amd64',
|
||||
'arm32': 'arm32v6',
|
||||
'arm64': 'arm64v8',
|
||||
}[matrix_architecture]
|
||||
}}"
|
||||
|
||||
matrix_ssl_pre_obtaining_required_service_name: "{{ 'matrix-dynamic-dns' if matrix_dynamic_dns_enabled else '' }}"
|
||||
|
||||
matrix_nginx_proxy_access_log_syslog_integration_enabled: "{{ matrix_prometheus_nginxlog_exporter_enabled }}"
|
||||
matrix_nginx_proxy_access_log_syslog_integration_server_port: "{{ (matrix_prometheus_nginxlog_exporter_identifier | string +':'+ matrix_prometheus_nginxlog_exporter_container_syslog_port | string) | default('') }}"
|
||||
|
||||
######################################################################
|
||||
#
|
||||
# /matrix-nginx-proxy
|
||||
#
|
||||
######################################################################
|
||||
|
||||
|
||||
########################################################################
|
||||
# #
|
||||
@ -3853,7 +3603,7 @@ matrix_sygnal_metrics_prometheus_enabled: "{{ prometheus_enabled }}"
|
||||
|
||||
matrix_sygnal_hostname: "{{ matrix_server_fqn_sygnal }}"
|
||||
|
||||
matrix_sygnal_container_network: "{{ matrix_nginx_proxy_container_network if matrix_playbook_reverse_proxy_type == 'playbook-managed-nginx' else 'matrix-sygnal' }}"
|
||||
matrix_sygnal_container_network: "{{ matrix_homeserver_container_network }}"
|
||||
|
||||
matrix_sygnal_container_additional_networks: "{{ [matrix_playbook_reverse_proxyable_services_additional_network] if matrix_playbook_reverse_proxyable_services_additional_network else [] }}"
|
||||
|
||||
@ -3887,8 +3637,6 @@ ntfy_gid: "{{ matrix_user_gid }}"
|
||||
|
||||
ntfy_hostname: "{{ matrix_server_fqn_ntfy }}"
|
||||
|
||||
ntfy_container_network: "{{ matrix_nginx_proxy_container_network if matrix_playbook_reverse_proxy_type == 'playbook-managed-nginx' else ntfy_identifier }}"
|
||||
|
||||
ntfy_container_additional_networks: "{{ [matrix_playbook_reverse_proxyable_services_additional_network] if matrix_playbook_reverse_proxyable_services_additional_network else [] }}"
|
||||
|
||||
ntfy_container_http_host_bind_port: "{{ (matrix_playbook_service_host_bind_interface_prefix ~ '2586') if matrix_playbook_service_host_bind_interface_prefix else '' }}"
|
||||
@ -3962,7 +3710,7 @@ matrix_client_element_integrations_rest_url: "{{ matrix_dimension_integrations_r
|
||||
matrix_client_element_integrations_widgets_urls: "{{ matrix_dimension_integrations_widgets_urls if matrix_dimension_enabled else ['https://scalar.vector.im/api'] }}"
|
||||
matrix_client_element_integrations_jitsi_widget_url: "{{ matrix_dimension_integrations_jitsi_widget_url if matrix_dimension_enabled else 'https://scalar.vector.im/api/widgets/jitsi.html' }}"
|
||||
|
||||
matrix_client_element_self_check_validate_certificates: "{{ false if matrix_playbook_ssl_retrieval_method == 'self-signed' else true }}"
|
||||
matrix_client_element_self_check_validate_certificates: "{{ matrix_playbook_ssl_enabled }}"
|
||||
|
||||
matrix_client_element_registration_enabled: "{{ matrix_synapse_enable_registration }}"
|
||||
|
||||
@ -4006,7 +3754,7 @@ matrix_client_hydrogen_container_labels_traefik_tls_certResolver: "{{ devture_tr
|
||||
|
||||
matrix_client_hydrogen_default_hs_url: "{{ matrix_homeserver_url }}"
|
||||
|
||||
matrix_client_hydrogen_self_check_validate_certificates: "{{ false if matrix_playbook_ssl_retrieval_method == 'self-signed' else true }}"
|
||||
matrix_client_hydrogen_self_check_validate_certificates: "{{ matrix_playbook_ssl_enabled }}"
|
||||
|
||||
######################################################################
|
||||
#
|
||||
@ -4037,7 +3785,7 @@ matrix_client_cinny_container_labels_traefik_tls_certResolver: "{{ devture_traef
|
||||
|
||||
matrix_client_cinny_default_hs_url: "{{ matrix_homeserver_url }}"
|
||||
|
||||
matrix_client_cinny_self_check_validate_certificates: "{{ false if matrix_playbook_ssl_retrieval_method == 'self-signed' else true }}"
|
||||
matrix_client_cinny_self_check_validate_certificates: "{{ matrix_playbook_ssl_enabled }}"
|
||||
|
||||
######################################################################
|
||||
#
|
||||
@ -4075,7 +3823,7 @@ matrix_client_schildichat_integrations_rest_url: "{{ matrix_dimension_integratio
|
||||
matrix_client_schildichat_integrations_widgets_urls: "{{ matrix_dimension_integrations_widgets_urls if matrix_dimension_enabled else ['https://scalar.vector.im/api'] }}"
|
||||
matrix_client_schildichat_integrations_jitsi_widget_url: "{{ matrix_dimension_integrations_jitsi_widget_url if matrix_dimension_enabled else 'https://scalar.vector.im/api/widgets/jitsi.html' }}"
|
||||
|
||||
matrix_client_schildichat_self_check_validate_certificates: "{{ false if matrix_playbook_ssl_retrieval_method == 'self-signed' else true }}"
|
||||
matrix_client_schildichat_self_check_validate_certificates: "{{ matrix_playbook_ssl_enabled }}"
|
||||
|
||||
matrix_client_schildichat_registration_enabled: "{{ matrix_synapse_enable_registration }}"
|
||||
|
||||
@ -4192,12 +3940,6 @@ matrix_synapse_email_smtp_port: 8025
|
||||
matrix_synapse_email_smtp_require_transport_security: false
|
||||
matrix_synapse_email_notif_from: "Matrix <{{ exim_relay_sender_address }}>"
|
||||
|
||||
# Even if TURN doesn't support TLS (it does by default),
|
||||
# it doesn't hurt to try a secure connection anyway.
|
||||
#
|
||||
# When Let's Encrypt certificates are used (the default case),
|
||||
# we don't enable `turns` endpoints, because WebRTC in Element can't talk to them.
|
||||
# Learn more here: https://github.com/spantaleev/matrix-docker-ansible-deploy/pull/1145
|
||||
matrix_synapse_turn_uris: |
|
||||
{{
|
||||
[]
|
||||
@ -4205,7 +3947,7 @@ matrix_synapse_turn_uris: |
|
||||
[
|
||||
'turns:' + matrix_server_fqn_matrix + '?transport=udp',
|
||||
'turns:' + matrix_server_fqn_matrix + '?transport=tcp',
|
||||
] if matrix_coturn_enabled and matrix_coturn_tls_enabled and matrix_playbook_ssl_retrieval_method != 'lets-encrypt' else []
|
||||
] if matrix_coturn_enabled and matrix_coturn_tls_enabled else []
|
||||
+
|
||||
[
|
||||
'turn:' + matrix_server_fqn_matrix + '?transport=udp',
|
||||
@ -4215,7 +3957,7 @@ matrix_synapse_turn_uris: |
|
||||
|
||||
matrix_synapse_turn_shared_secret: "{{ matrix_coturn_turn_static_auth_secret if matrix_coturn_enabled else '' }}"
|
||||
|
||||
matrix_synapse_self_check_validate_certificates: "{{ false if matrix_playbook_ssl_retrieval_method == 'self-signed' else true }}"
|
||||
matrix_synapse_self_check_validate_certificates: "{{ matrix_playbook_ssl_enabled }}"
|
||||
|
||||
matrix_synapse_systemd_required_services_list_auto: |
|
||||
{{
|
||||
@ -4356,7 +4098,7 @@ matrix_synapse_admin_container_http_host_bind_port: "{{ (matrix_playbook_service
|
||||
|
||||
matrix_synapse_admin_container_image_self_build: "{{ matrix_architecture not in ['arm64', 'amd64'] }}"
|
||||
|
||||
matrix_synapse_admin_container_network: "{{ matrix_nginx_proxy_container_network if matrix_playbook_reverse_proxy_type == 'playbook-managed-nginx' else 'matrix-synapse-admin' }}"
|
||||
matrix_synapse_admin_container_network: "{{ matrix_addons_container_network }}"
|
||||
|
||||
matrix_synapse_admin_container_additional_networks: "{{ [matrix_playbook_reverse_proxyable_services_additional_network] if matrix_playbook_reverse_proxyable_services_additional_network else [] }}"
|
||||
|
||||
@ -4522,9 +4264,6 @@ prometheus_container_additional_networks: |
|
||||
) | unique
|
||||
}}
|
||||
|
||||
# Normally, matrix-nginx-proxy is enabled and nginx can reach Prometheus over the container network.
|
||||
# If matrix-nginx-proxy is not enabled, or you otherwise have a need for it, you can expose
|
||||
# Prometheus' HTTP port to the local host.
|
||||
prometheus_container_http_host_bind_port: "{{ (matrix_playbook_service_host_bind_interface_prefix ~ '9090') if matrix_playbook_service_host_bind_interface_prefix else '' }}"
|
||||
|
||||
prometheus_config_rule_files_auto: |
|
||||
@ -4624,9 +4363,6 @@ grafana_container_labels_traefik_docker_network: "{{ matrix_playbook_reverse_pro
|
||||
grafana_container_labels_traefik_entrypoints: "{{ devture_traefik_entrypoint_primary }}"
|
||||
grafana_container_labels_traefik_tls_certResolver: "{{ devture_traefik_certResolver_primary }}"
|
||||
|
||||
# Normally, matrix-nginx-proxy is enabled and nginx can reach Grafana over the container network.
|
||||
# If matrix-nginx-proxy is not enabled, or you otherwise have a need for it, you can expose
|
||||
# Grafana's HTTP port to the local host.
|
||||
grafana_container_http_host_bind_port: "{{ (matrix_playbook_service_host_bind_interface_prefix ~ '3000') if matrix_playbook_service_host_bind_interface_prefix else '' }}"
|
||||
|
||||
grafana_provisioning_datasources: |
|
||||
@ -4733,7 +4469,7 @@ matrix_registration_shared_secret: |-
|
||||
|
||||
matrix_registration_server_location: "{{ matrix_addons_homeserver_client_api_url }}"
|
||||
|
||||
matrix_registration_api_validate_certs: "{{ false if matrix_playbook_ssl_retrieval_method == 'self-signed' else true }}"
|
||||
matrix_registration_api_validate_certs: "{{ matrix_playbook_ssl_enabled }}"
|
||||
|
||||
# Postgres is the default, except if not using internal Postgres server
|
||||
matrix_registration_database_engine: "{{ 'postgres' if devture_postgres_enabled else 'sqlite' }}"
|
||||
@ -4871,9 +4607,9 @@ matrix_dendrite_client_api_turn_uris: |
|
||||
|
||||
matrix_dendrite_client_api_turn_shared_secret: "{{ matrix_coturn_turn_static_auth_secret if matrix_coturn_enabled else '' }}"
|
||||
|
||||
matrix_dendrite_disable_tls_validation: "{{ true if matrix_playbook_ssl_retrieval_method == 'self-signed' else false }}"
|
||||
matrix_dendrite_disable_tls_validation: "{{ not matrix_playbook_ssl_enabled }}"
|
||||
|
||||
matrix_dendrite_self_check_validate_certificates: "{{ false if matrix_playbook_ssl_retrieval_method == 'self-signed' else true }}"
|
||||
matrix_dendrite_self_check_validate_certificates: "{{ matrix_playbook_ssl_enabled }}"
|
||||
|
||||
matrix_dendrite_trusted_id_servers: "{{ [matrix_server_fqn_matrix] if matrix_ma1sd_enabled else ['matrix.org', 'vector.im'] }}"
|
||||
|
||||
@ -4932,12 +4668,6 @@ matrix_conduit_container_labels_public_federation_api_traefik_entrypoints: "{{ m
|
||||
matrix_conduit_container_labels_internal_client_api_enabled: "{{ matrix_playbook_internal_matrix_client_api_traefik_entrypoint_enabled }}"
|
||||
matrix_conduit_container_labels_internal_client_api_traefik_entrypoints: "{{ matrix_playbook_internal_matrix_client_api_traefik_entrypoint_name }}"
|
||||
|
||||
# Even if TURN doesn't support TLS (it does by default),
|
||||
# it doesn't hurt to try a secure connection anyway.
|
||||
#
|
||||
# When Let's Encrypt certificates are used (the default case),
|
||||
# we don't enable `turns` endpoints, because WebRTC in Element can't talk to them.
|
||||
# Learn more here: https://github.com/spantaleev/matrix-docker-ansible-deploy/pull/1145
|
||||
matrix_conduit_turn_uris: |
|
||||
{{
|
||||
[]
|
||||
@ -4945,7 +4675,7 @@ matrix_conduit_turn_uris: |
|
||||
[
|
||||
'turns:' + matrix_server_fqn_matrix + '?transport=udp',
|
||||
'turns:' + matrix_server_fqn_matrix + '?transport=tcp',
|
||||
] if matrix_coturn_enabled and matrix_coturn_tls_enabled and matrix_playbook_ssl_retrieval_method != 'lets-encrypt' else []
|
||||
] if matrix_coturn_enabled and matrix_coturn_tls_enabled else []
|
||||
+
|
||||
[
|
||||
'turn:' + matrix_server_fqn_matrix + '?transport=udp',
|
||||
@ -5150,8 +4880,6 @@ devture_traefik_additional_entrypoints_auto: |
|
||||
([matrix_playbook_internal_matrix_client_api_traefik_entrypoint_definition] if matrix_playbook_internal_matrix_client_api_traefik_entrypoint_enabled else [])
|
||||
}}
|
||||
|
||||
devture_traefik_additional_domains_to_obtain_certificates_for: "{{ matrix_ssl_additional_domains_to_obtain_certificates_for }}"
|
||||
|
||||
devture_traefik_config_providers_docker_endpoint: "{{ devture_container_socket_proxy_endpoint if devture_container_socket_proxy_enabled else 'unix:///var/run/docker.sock' }}"
|
||||
|
||||
devture_traefik_container_additional_networks_auto: |
|
||||
|
||||
@ -209,12 +209,6 @@ matrix_metrics_exposure_http_basic_auth_users: ''
|
||||
# - the playbook will run a managed Traefik instance (matrix-traefik)
|
||||
# - Traefik will do SSL termination, unless you disable it (e.g. `devture_traefik_config_entrypoint_web_secure_enabled: false`)
|
||||
# - if SSL termination is enabled (as it is by default), you need to populate: `devture_traefik_config_certificatesResolvers_acme_email`
|
||||
# - it will also install matrix-nginx-proxy in local-only mode, while we migrate the rest of the services to a Traefik-native mode of working
|
||||
#
|
||||
# - `playbook-managed-nginx`
|
||||
# - the playbook will install matrix-nginx-proxy
|
||||
# - matrix-nginx-proxy will do SSL termination with Certbot, unless you change that (see `matrix_ssl_retrieval_method`)
|
||||
# - if SSL termination is enabled (as it is by default), you need to populate: `matrix_ssl_lets_encrypt_support_email`
|
||||
#
|
||||
# - `other-traefik-container`
|
||||
# - this playbook will not install Traefik
|
||||
@ -223,24 +217,11 @@ matrix_metrics_exposure_http_basic_auth_users: ''
|
||||
# - you need to set `matrix_playbook_reverse_proxyable_services_additional_network` to the name of your Traefik network
|
||||
# - Traefik certs dumper will be enabled by default (`devture_traefik_certs_dumper_enabled`). You need to point it to your Traefik's SSL certificates (`devture_traefik_certs_dumper_ssl_dir_path`)
|
||||
#
|
||||
# - `other-nginx-non-container`
|
||||
# - the playbook will not install matrix-nginx-proxy
|
||||
# - however, it will still dump some nginx configuration in /matrix/nginx/conf.d
|
||||
# - these configs are meant to be included into a locally-installed (without a container) nginx server
|
||||
# - all container services are exposed locally (e.g. `-p 127.0.0.1:8080:8080`)
|
||||
#
|
||||
# - `other-on-same-host`
|
||||
# - like other-nginx-non-container, but supposedly won't generate useless configuration in /matrix/nginx/conf.d in the future
|
||||
#
|
||||
# - `other-on-another-host`
|
||||
# - like other-on-same-host, but services are exposed on all interfaces (e.g. `-p 0.0.0.0:8080:8080`)
|
||||
# - configurable via `matrix_playbook_service_host_bind_interface_prefix`
|
||||
#
|
||||
# - `none`
|
||||
# - no reverse-proxy will be installed
|
||||
# - no nginx configuration will be dumped in /matrix/nginx/conf.d
|
||||
# - no port exposure will be done for any of the container services
|
||||
# - it's up to you to expose the ports you want, etc.
|
||||
# - this is unlikely to work well (if at all)
|
||||
matrix_playbook_reverse_proxy_type: ''
|
||||
|
||||
# Specifies the network that the reverse-proxy is operating at
|
||||
@ -252,6 +233,11 @@ matrix_playbook_reverse_proxy_hostname: 'matrix-traefik'
|
||||
# Controls the additional network that reverse-proxyable services will be connected to.
|
||||
matrix_playbook_reverse_proxyable_services_additional_network: "{{ matrix_playbook_reverse_proxy_container_network }}"
|
||||
|
||||
# Controls if various services think if SSL is enabled or not.
|
||||
# Disabling this does not actually disable Treafik's web-secure entrypoint and TLS termination settings.
|
||||
# For that, you'd need to use other variables. This one merely serves as an indicator if SSL is used or not.
|
||||
matrix_playbook_ssl_enabled: true
|
||||
|
||||
matrix_playbook_service_host_bind_interface_prefix: "{{ '' if matrix_playbook_reverse_proxy_type not in ['other-nginx-non-container', 'other-on-same-host', 'other-on-another-host'] else ('0.0.0.0:' if matrix_playbook_reverse_proxy_type == 'other-on-another-host' else '127.0.0.1:') }}"
|
||||
|
||||
# Controls whether to enable an additional Traefik entrypoint for the purpose of serving Matrix Federation.
|
||||
|
||||
@ -65,7 +65,7 @@
|
||||
- name: Fail if matrix_playbook_reverse_proxy_type is set incorrectly
|
||||
ansible.builtin.fail:
|
||||
msg: "Detected that variable matrix_playbook_reverse_proxy_type (current value: `{{ matrix_playbook_reverse_proxy_type }}`) appears to be set incorrectly. See roles/custom/matrix-base/defaults/main.yml for valid choices."
|
||||
when: matrix_playbook_reverse_proxy_type not in ['playbook-managed-traefik', 'playbook-managed-nginx', 'other-traefik-container', 'other-nginx-non-container', 'other-on-same-host', 'other-on-another-host', 'none']
|
||||
when: matrix_playbook_reverse_proxy_type not in ['playbook-managed-traefik', 'other-traefik-container', 'none']
|
||||
|
||||
- name: Fail if uppercase domain used
|
||||
ansible.builtin.fail:
|
||||
|
||||
@ -127,13 +127,9 @@ matrix_client_cinny_hsts_preload_enabled: false
|
||||
|
||||
# The hostname at which Cinny is served.
|
||||
# Only works with with Traefik reverse-proxying.
|
||||
# For matrix-nginx-proxy, `matrix_server_fqn_cinny` is used and this variable has no effect.
|
||||
matrix_client_cinny_hostname: "{{ matrix_server_fqn_cinny }}"
|
||||
|
||||
# The path at which Cinny is exposed.
|
||||
# When matrix-nginx-proxy is used, setting this to values other than `/` will cause configuration mismatches and trouble.
|
||||
#
|
||||
# If Traefik is used, the hostname is also configurable - see `matrix_client_cinny_container_labels_traefik_hostname`.
|
||||
# This value must either be `/` or not end with a slash (e.g. `/cinny`).
|
||||
matrix_client_cinny_path_prefix: /
|
||||
|
||||
|
||||
@ -130,14 +130,9 @@ matrix_client_element_floc_optout_enabled: true
|
||||
matrix_client_element_hsts_preload_enabled: false
|
||||
|
||||
# The hostname at which Element is served.
|
||||
# Only works with with Traefik reverse-proxying.
|
||||
# For matrix-nginx-proxy, `matrix_server_fqn_element` is used and this variable has no effect.
|
||||
matrix_client_element_hostname: "{{ matrix_server_fqn_element }}"
|
||||
|
||||
# The path at which Element is exposed.
|
||||
# When matrix-nginx-proxy is used, setting this to values other than `/` will cause configuration mismatches and trouble.
|
||||
#
|
||||
# If Traefik is used, the hostname is also configurable - see `matrix_client_element_container_labels_traefik_hostname`.
|
||||
# This value must either be `/` or not end with a slash (e.g. `/element`).
|
||||
matrix_client_element_path_prefix: /
|
||||
|
||||
|
||||
@ -125,14 +125,9 @@ matrix_client_hydrogen_floc_optout_enabled: true
|
||||
matrix_client_hydrogen_hsts_preload_enabled: false
|
||||
|
||||
# The hostname at which Hydrogen is served.
|
||||
# Only works with with Traefik reverse-proxying.
|
||||
# For matrix-nginx-proxy, `matrix_server_fqn_hydrogen` is used and this variable has no effect.
|
||||
matrix_client_hydrogen_hostname: "{{ matrix_server_fqn_hydrogen }}"
|
||||
|
||||
# The path at which Hydrogen is exposed.
|
||||
# When matrix-nginx-proxy is used, setting this to values other than `/` will cause configuration mismatches and trouble.
|
||||
#
|
||||
# If Traefik is used, the hostname is also configurable - see `matrix_client_hydrogen_container_labels_traefik_hostname`.
|
||||
# This value must either be `/` or not end with a slash (e.g. `/hydrogen`).
|
||||
matrix_client_hydrogen_path_prefix: /
|
||||
|
||||
|
||||
@ -124,14 +124,9 @@ matrix_client_schildichat_floc_optout_enabled: true
|
||||
matrix_client_schildichat_hsts_preload_enabled: false
|
||||
|
||||
# The hostname at which schildichat is served.
|
||||
# Only works with with Traefik reverse-proxying.
|
||||
# For matrix-nginx-proxy, `matrix_server_fqn_schildichat` is used and this variable has no effect.
|
||||
matrix_client_schildichat_hostname: "{{ matrix_server_fqn_schildichat }}"
|
||||
|
||||
# The path at which schildichat is exposed.
|
||||
# When matrix-nginx-proxy is used, setting this to values other than `/` will cause configuration mismatches and trouble.
|
||||
#
|
||||
# If Traefik is used, the hostname is also configurable - see `matrix_client_schildichat_container_labels_traefik_hostname`.
|
||||
# This value must either be `/` or not end with a slash (e.g. `/schildichat`).
|
||||
matrix_client_schildichat_path_prefix: /
|
||||
|
||||
|
||||
@ -27,7 +27,7 @@ matrix_dendrite_ext_path: "{{ matrix_dendrite_base_path }}/ext"
|
||||
matrix_dendrite_docker_src_files_path: "{{ matrix_dendrite_base_path }}/docker-src"
|
||||
|
||||
# By default, we make Dendrite only serve HTTP (not HTTPS).
|
||||
# HTTPS is usually served at the reverse-proxy side (usually via `matrix-nginx-proxy`).
|
||||
# HTTPS is usually served at the reverse-proxy side.
|
||||
#
|
||||
# To enable HTTPS serving by Dendrite (directly):
|
||||
# - `matrix_dendrite_https_bind_port` must be set
|
||||
|
||||
@ -1,495 +0,0 @@
|
||||
---
|
||||
# Project source code URL: https://github.com/nginx/nginx
|
||||
matrix_nginx_proxy_enabled: true
|
||||
# renovate: datasource=docker depName=nginx
|
||||
matrix_nginx_proxy_version: 1.25.3-alpine
|
||||
|
||||
# We use an official nginx image, which we fix-up to run unprivileged.
|
||||
# An alternative would be an `nginxinc/nginx-unprivileged` image, but
|
||||
# that is frequently out of date.
|
||||
matrix_nginx_proxy_docker_image: "{{ matrix_container_global_registry_prefix }}nginx:{{ matrix_nginx_proxy_version }}"
|
||||
matrix_nginx_proxy_docker_image_force_pull: "{{ matrix_nginx_proxy_docker_image.endswith(':latest') }}"
|
||||
|
||||
matrix_nginx_proxy_base_path: "{{ matrix_base_data_path }}/nginx-proxy"
|
||||
matrix_nginx_proxy_data_path: "{{ matrix_nginx_proxy_base_path }}/data"
|
||||
matrix_nginx_proxy_data_path_in_container: "/nginx-data"
|
||||
matrix_nginx_proxy_data_path_extension: "/matrix-domain"
|
||||
matrix_nginx_proxy_confd_path: "{{ matrix_nginx_proxy_base_path }}/conf.d"
|
||||
|
||||
# List of systemd services that matrix-nginx-proxy.service depends on
|
||||
matrix_nginx_proxy_systemd_required_services_list: ['docker.service']
|
||||
|
||||
# List of systemd services that matrix-nginx-proxy.service wants
|
||||
matrix_nginx_proxy_systemd_wanted_services_list: []
|
||||
|
||||
# The base container network.
|
||||
# Also see: matrix_nginx_proxy_container_additional_networks
|
||||
matrix_nginx_proxy_container_network: matrix-nginx-proxy
|
||||
|
||||
# A list of additional container networks that matrix-nginx-proxy would be connected to.
|
||||
# The playbook does not create these networks, so make sure they already exist.
|
||||
#
|
||||
# Use this to expose matrix-nginx-proxy to another reverse proxy, which runs in a different container network,
|
||||
# without exposing all other Matrix services to that other reverse-proxy.
|
||||
#
|
||||
# For background, see: https://github.com/spantaleev/matrix-docker-ansible-deploy/issues/1498
|
||||
matrix_nginx_proxy_container_additional_networks: []
|
||||
|
||||
# A list of additional "volumes" to mount in the container.
|
||||
# This list gets populated dynamically at runtime. You can provide a different default value,
|
||||
# if you wish to mount your own files into the container.
|
||||
# Contains definition objects like this: `{"src": "/outside", "dst": "/inside", "options": "rw|ro|slave|.."}
|
||||
matrix_nginx_proxy_container_additional_volumes: []
|
||||
|
||||
# A list of extra arguments to pass to the container
|
||||
matrix_nginx_proxy_container_extra_arguments: []
|
||||
|
||||
# Controls whether matrix-nginx-proxy serves its vhosts over HTTPS or HTTP.
|
||||
#
|
||||
# If enabled:
|
||||
# - SSL certificates would be expected to be available (see `matrix_ssl_retrieval_method`)
|
||||
# - the HTTP vhost would be made a redirect to the HTTPS vhost
|
||||
#
|
||||
# If not enabled:
|
||||
# - you don't need any SSL certificates (you can set `matrix_ssl_retrieval_method: none`)
|
||||
# - naturally, there's no HTTPS vhost
|
||||
# - services are served directly from the HTTP vhost
|
||||
matrix_nginx_proxy_https_enabled: true
|
||||
|
||||
# Controls whether matrix-nginx-proxy trusts an upstream server's X-Forwarded-Proto header
|
||||
#
|
||||
# Required if you disable HTTPS for the container (see `matrix_nginx_proxy_https_enabled`) and have an upstream server handle it instead.
|
||||
matrix_nginx_proxy_trust_forwarded_proto: false
|
||||
matrix_nginx_proxy_x_forwarded_proto_value: "{{ '$http_x_forwarded_proto' if matrix_nginx_proxy_trust_forwarded_proto else '$scheme' }}"
|
||||
|
||||
# Controls whether the matrix-nginx-proxy container exposes its HTTP port (tcp/8080 in the container).
|
||||
#
|
||||
# Takes an "<ip>:<port>" or "<port>" value (e.g. "127.0.0.1:80"), or empty string to not expose.
|
||||
matrix_nginx_proxy_container_http_host_bind_port: '80'
|
||||
|
||||
# Controls whether the matrix-nginx-proxy container exposes its HTTPS port (tcp/8443 in the container).
|
||||
#
|
||||
# Takes an "<ip>:<port>" or "<port>" value (e.g. "127.0.0.1:443"), or empty string to not expose.
|
||||
#
|
||||
# This only makes sense and applies if `matrix_nginx_proxy_https_enabled` is set to `true`.
|
||||
# Otherwise, there are no HTTPS vhosts to expose.
|
||||
matrix_nginx_proxy_container_https_host_bind_port: '443'
|
||||
|
||||
# Controls whether the matrix-nginx-proxy container exposes the Matrix Federation port (tcp/8448 in the container).
|
||||
#
|
||||
# Takes an "<ip>:<port>" or "<port>" value (e.g. "127.0.0.1:8448"), or empty string to not expose.
|
||||
#
|
||||
# This only makes sense and applies if `matrix_nginx_proxy_proxy_matrix_federation_api_enabled` is set to `true`.
|
||||
# Otherwise, there is no Matrix Federation port to expose.
|
||||
#
|
||||
# This port can take HTTP or HTTPS traffic, depending on `matrix_nginx_proxy_https_enabled`.
|
||||
# When HTTPS is disabled, you'd likely want to only expose the port locally, and front it with another HTTPS-enabled reverse-proxy.
|
||||
matrix_nginx_proxy_container_federation_host_bind_port: '8448'
|
||||
|
||||
# Option to disable the access log
|
||||
matrix_nginx_proxy_access_log_enabled: true
|
||||
|
||||
# Controls whether proxying the Element domain should be done.
|
||||
matrix_nginx_proxy_proxy_element_enabled: false
|
||||
matrix_nginx_proxy_proxy_element_hostname: "{{ matrix_server_fqn_element }}"
|
||||
|
||||
# Controls whether proxying the Hydrogen domain should be done.
|
||||
matrix_nginx_proxy_proxy_hydrogen_enabled: false
|
||||
matrix_nginx_proxy_proxy_hydrogen_hostname: "{{ matrix_server_fqn_hydrogen }}"
|
||||
|
||||
# Controls whether proxying the Cinny domain should be done.
|
||||
matrix_nginx_proxy_proxy_cinny_enabled: false
|
||||
matrix_nginx_proxy_proxy_cinny_hostname: "{{ matrix_server_fqn_cinny }}"
|
||||
|
||||
# Controls whether proxying the schildichat domain should be done.
|
||||
matrix_nginx_proxy_proxy_schildichat_enabled: false
|
||||
matrix_nginx_proxy_proxy_schildichat_hostname: "{{ matrix_server_fqn_schildichat }}"
|
||||
|
||||
# Controls whether proxying the buscarron domain should be done.
|
||||
matrix_nginx_proxy_proxy_buscarron_enabled: false
|
||||
matrix_nginx_proxy_proxy_buscarron_hostname: "{{ matrix_server_fqn_buscarron }}"
|
||||
|
||||
# Controls whether proxying the matrix domain should be done.
|
||||
matrix_nginx_proxy_proxy_matrix_enabled: false
|
||||
matrix_nginx_proxy_proxy_matrix_hostname: "{{ matrix_server_fqn_matrix }}"
|
||||
matrix_nginx_proxy_proxy_matrix_federation_hostname: "{{ matrix_nginx_proxy_proxy_matrix_hostname }}"
|
||||
# The port name used for federation in the nginx configuration.
|
||||
# This is not necessarily the port that it's actually on,
|
||||
# as port-mapping happens (`-p ..`) for the `matrix-nginx-proxy` container.
|
||||
matrix_nginx_proxy_proxy_matrix_federation_port: 8448
|
||||
|
||||
# Controls whether proxying the dimension domain should be done.
|
||||
matrix_nginx_proxy_proxy_dimension_enabled: false
|
||||
matrix_nginx_proxy_proxy_dimension_hostname: "{{ matrix_server_fqn_dimension }}"
|
||||
|
||||
# Controls whether proxying the rageshake domain should be done.
|
||||
matrix_nginx_proxy_proxy_rageshake_enabled: false
|
||||
matrix_nginx_proxy_proxy_rageshake_hostname: "{{ matrix_server_fqn_rageshake }}"
|
||||
|
||||
# Controls whether proxying the etherpad domain should be done.
|
||||
matrix_nginx_proxy_proxy_etherpad_enabled: false
|
||||
matrix_nginx_proxy_proxy_etherpad_hostname: "{{ matrix_server_fqn_etherpad }}"
|
||||
|
||||
# Controls whether proxying the goneb domain should be done.
|
||||
matrix_nginx_proxy_proxy_bot_go_neb_enabled: false
|
||||
matrix_nginx_proxy_proxy_bot_go_neb_hostname: "{{ matrix_server_fqn_bot_go_neb }}"
|
||||
|
||||
# Controls whether proxying the jitsi domain should be done.
|
||||
matrix_nginx_proxy_proxy_jitsi_enabled: false
|
||||
matrix_nginx_proxy_proxy_jitsi_hostname: "{{ matrix_server_fqn_jitsi }}"
|
||||
|
||||
# Controls whether proxying the grafana domain should be done.
|
||||
matrix_nginx_proxy_proxy_grafana_enabled: false
|
||||
matrix_nginx_proxy_proxy_grafana_hostname: "{{ matrix_server_fqn_grafana }}"
|
||||
|
||||
# Controls whether proxying the sygnal domain should be done.
|
||||
matrix_nginx_proxy_proxy_sygnal_enabled: false
|
||||
matrix_nginx_proxy_proxy_sygnal_hostname: "{{ matrix_server_fqn_sygnal }}"
|
||||
|
||||
# Controls whether proxying the mautrix wsproxy should be done.
|
||||
matrix_nginx_proxy_proxy_mautrix_wsproxy_enabled: false
|
||||
matrix_nginx_proxy_proxy_mautrix_wsproxy_hostname: "{{ matrix_server_fqn_mautrix_wsproxy }}"
|
||||
|
||||
# Controls whether proxying the ntfy domain should be done.
|
||||
matrix_nginx_proxy_proxy_ntfy_enabled: false
|
||||
matrix_nginx_proxy_proxy_ntfy_hostname: "{{ matrix_server_fqn_ntfy }}"
|
||||
|
||||
# Controls whether proxying for the matrix-corporal API (`/_matrix/corporal`) should be done (on the matrix domain)
|
||||
matrix_nginx_proxy_proxy_matrix_corporal_api_enabled: false
|
||||
matrix_nginx_proxy_proxy_matrix_corporal_api_addr_with_container: "matrix-corporal:41081"
|
||||
matrix_nginx_proxy_proxy_matrix_corporal_api_addr_sans_container: "127.0.0.1:41081"
|
||||
|
||||
# Controls whether proxying for the media repo (`/_matrix/media`) should be done (on the matrix domain)
|
||||
matrix_nginx_proxy_proxy_media_repo_enabled: false
|
||||
matrix_nginx_proxy_proxy_media_repo_addr_with_container: "matrix-media-repo:{{ matrix_media_repo_port }}"
|
||||
matrix_nginx_proxy_proxy_media_repo_addr_sans_container: "127.0.0.1:{{ matrix_media_repo_port }}"
|
||||
|
||||
# The addresses where the Matrix Client API is.
|
||||
# Certain extensions (like matrix-corporal) may override this in order to capture all traffic.
|
||||
matrix_nginx_proxy_proxy_matrix_client_api_addr_with_container: "matrix-nginx-proxy:12080"
|
||||
matrix_nginx_proxy_proxy_matrix_client_api_addr_sans_container: "127.0.0.1:12080"
|
||||
|
||||
# This needs to be equal or higher than the maximum upload size accepted by Synapse.
|
||||
matrix_nginx_proxy_proxy_matrix_client_api_client_max_body_size_mb: 50
|
||||
|
||||
# `matrix_nginx_proxy_proxy_matrix_client_api_forwarded_location_prefixes` holds
|
||||
# the location prefixes that get forwarded to the Matrix Client API server.
|
||||
# These locations get combined into a regex like this `^(/_matrix|/_synapse/client)`.
|
||||
matrix_nginx_proxy_proxy_matrix_client_api_forwarded_location_prefix_regexes: |
|
||||
{{
|
||||
(['/_matrix'])
|
||||
}}
|
||||
|
||||
# Controls whether proxying for the Matrix Federation API should be done.
|
||||
matrix_nginx_proxy_proxy_matrix_federation_api_enabled: false
|
||||
matrix_nginx_proxy_proxy_matrix_federation_api_addr_with_container: "matrix-nginx-proxy:12088"
|
||||
matrix_nginx_proxy_proxy_matrix_federation_api_addr_sans_container: "127.0.0.1:12088"
|
||||
matrix_nginx_proxy_proxy_matrix_federation_api_client_max_body_size_mb: "{{ (matrix_nginx_proxy_proxy_matrix_client_api_client_max_body_size_mb | int) * 3 }}"
|
||||
matrix_nginx_proxy_proxy_matrix_federation_api_ssl_certificate: "{{ matrix_ssl_config_dir_path }}/live/{{ matrix_nginx_proxy_proxy_matrix_hostname }}/fullchain.pem"
|
||||
matrix_nginx_proxy_proxy_matrix_federation_api_ssl_certificate_key: "{{ matrix_ssl_config_dir_path }}/live/{{ matrix_nginx_proxy_proxy_matrix_hostname }}/privkey.pem"
|
||||
matrix_nginx_proxy_proxy_matrix_federation_api_ssl_trusted_certificate: "{{ matrix_ssl_config_dir_path }}/live/{{ matrix_nginx_proxy_proxy_matrix_hostname }}/chain.pem"
|
||||
|
||||
# The tmpfs at /tmp needs to be large enough to handle multiple concurrent file uploads.
|
||||
matrix_nginx_proxy_tmp_directory_size_mb: "{{ (matrix_nginx_proxy_proxy_matrix_federation_api_client_max_body_size_mb | int) * 50 }}"
|
||||
matrix_nginx_proxy_tmp_cache_directory_size_mb: "{{ (matrix_nginx_proxy_synapse_cache_max_size_mb | int) * 2 }}"
|
||||
# A list of strings containing additional configuration blocks to add to the nginx server configuration (nginx.conf).
|
||||
# for big matrixservers to enlarge the number of open files to prevent timeouts
|
||||
# matrix_nginx_proxy_proxy_additional_configuration_blocks:
|
||||
# - 'worker_rlimit_nofile 30000;'
|
||||
matrix_nginx_proxy_proxy_additional_configuration_blocks: []
|
||||
|
||||
# A list of strings containing additional configuration blocks to add to the nginx event server configuration (nginx.conf).
|
||||
matrix_nginx_proxy_proxy_event_additional_configuration_blocks: []
|
||||
|
||||
# A list of strings containing additional configuration blocks to add to the nginx http's server configuration (nginx-http.conf).
|
||||
matrix_nginx_proxy_proxy_http_additional_server_configuration_blocks: []
|
||||
|
||||
# A list of strings containing additional configuration blocks to add to the base matrix server configuration (matrix-domain.conf).
|
||||
matrix_nginx_proxy_proxy_matrix_additional_server_configuration_blocks: []
|
||||