main.yml 4.26 KB
Newer Older
1
2
---

3
- name: create ssl cert
Florian Pritz's avatar
Florian Pritz committed
4
  command: certbot certonly --email webmaster@archlinux.org --agree-tos --rsa-key-size 4096 --renew-by-default --webroot -w {{letsencrypt_validation_dir}} -d '{{ matrix_domain }}' creates='/etc/letsencrypt/live/{{ matrix_domain }}/fullchain.pem'
5
  when: 'matrix_domain is defined'
6
7

- name: install packages
8
  pacman: name=python,git,yarn,jemalloc,gcc,pkg-config,python2
9
10
11
12
13
14
15
16

- name: add synapse group
  group: name=synapse system=yes gid=198

- name: add synapse user
  user: name=synapse system=yes uid=198 group=synapse home=/var/lib/synapse shell=/bin/false createhome=no

- name: create synapse home
17
  file: path={{ item }} state=directory owner=synapse group=synapse mode=0700
18
19
20
21
22
  with_items:
    - /var/lib/synapse
    - /var/lib/synapse/irc-nedb
    - /var/lib/synapse/media_store
    - /var/lib/synapse/uploads
23

24
25
26
27
28
29
30
31
- name: make virtualenv
  command: python -m venv /var/lib/synapse/venv
  args:
    creates: /var/lib/synapse/venv/bin/python
  become: true
  become_user: synapse
  become_method: sudo

32
33
34
35
36
37
38
39
- name: install synapse
  pip:
    name:
      - 'matrix-synapse[postgres,systemd,url_preview]'
      - pip
    state: latest
    extra_args: '-U --upgrade-strategy=eager'
    virtualenv: /var/lib/synapse/venv
40
41
42
  become: yes
  become_user: synapse
  become_method: sudo
43
44
  notify:
    - restart synapse
45

46
- name: download matrix-appservice-irc
47
48
49
  git:
    repo: https://github.com/heftig/matrix-appservice-irc
    dest: /var/lib/synapse/matrix-appservice-irc
50
51
52
  become: yes
  become_user: synapse
  become_method: sudo
53
54
  notify:
    - restart matrix-appservice-irc
55

56

57
- name: install matrix-appservice-irc
58
  command: yarn install
59
60
61
62
63
64
  args:
    chdir: /var/lib/synapse/matrix-appservice-irc
    creates: /var/lib/synapse/matrix-appservice-irc/node_modules
  become: yes
  become_user: synapse
  become_method: sudo
65
66
  notify:
    - restart matrix-appservice-irc
67

68
69
70
71
72
73
74
75
76
- name: upgrade matrix-appservice-irc
  command: yarn upgrade
  args:
    chdir: /var/lib/synapse/matrix-appservice-irc
  become: yes
  become_user: synapse
  become_method: sudo
  # FIXME: Find out how to notify only when upgrade did something

77
78
79
80
81
82
83
- name: add synapse postgres db
  postgresql_db: db=synapse
  become: yes
  become_user: postgres
  become_method: su

- name: add synapse postgres user
84
  postgresql_user: db=synapse name=synapse password={{ vault_postgres_users.synapse }} encrypted=true
85
86
87
88
  become: yes
  become_user: postgres
  become_method: su

89
- name: create synapse config dir
90
91
92
93
94
95
96
97
  file: state=directory path=/etc/synapse owner=root group=synapse mode=0750

- name: install homeserver config
  template: src=homeserver.yaml.j2 dest=/etc/synapse/homeserver.yaml owner=root group=synapse mode=0640

- name: install log config
  copy: src=log_config.yaml dest=/etc/synapse/log_config.yaml owner=root group=root mode=0644

98
99
100
101
102
103
- name: install irc-bridge config
  template: src=irc-bridge.yaml.j2 dest=/etc/synapse/irc-bridge.yaml owner=root group=synapse mode=0640

- name: install irc-bridge registration
  template: src=appservice-registration-irc.yaml.j2 dest=/etc/synapse/appservice-registration-irc.yaml owner=root group=synapse mode=0640

104
105
- name: install signing key
  copy:
106
    content: '{{ vault_matrix_secrets[matrix_server_name].signing_key }}'
107
108
109
110
111
    dest: /etc/synapse/{{ matrix_server_name }}.signing.key
    owner: root
    group: synapse
    mode: 0640

112
113
- name: install ircpass key
  copy:
114
    content: '{{ vault_matrix_secrets[matrix_server_name].ircpass_key }}'
115
116
117
118
    dest: /etc/synapse/{{ matrix_server_name }}.ircpass.key
    owner: root
    group: synapse
    mode: 0640
119
120
121
122
123
124
125
126

- name: make nginx log dir
  file: path=/var/log/nginx/{{ matrix_domain }} state=directory owner=root group=root mode=0755

- name: set up nginx
  template: src=nginx.d.conf.j2 dest=/etc/nginx/nginx.d/matrix.conf owner=root group=root mode=0644
  notify:
    - reload nginx
127
  when: 'matrix_domain is defined'
128
  tags: ['nginx']
129
130
131
132
133
134
135

- name: install matrix units
  copy: src={{ item }} dest=/etc/systemd/system/{{ item }} owner=root group=root mode=0644
  with_items:
    - synapse.service
    - matrix-appservice-irc.service
  notify:
136
137
    - restart synapse
    - restart matrix-appservice-irc
138

139
- name: open firewall holes
140
141
142
143
  firewalld: port={{ item }} permanent=true state=enabled immediate=yes
  with_items:
    - 8848/tcp
    - 113/tcp
144
145
  when: configure_firewall
  tags:
146
    - firewall