main.yml 8.87 KB
Newer Older
1
2
---

3
- name: create ssl cert
4
5
6
7
  include_role:
    name: certificate
  vars:
    domains: ["{{ matrix_domain }}"]
8
  when: 'matrix_domain is defined'
9
10

- name: install packages
11
12
  pacman:
    name:
13
      - coturn
14
15
16
17
18
      - freetype2
      - gcc
      - git
      - jemalloc
      - libffi
19
      - libjpeg-turbo
20
      - libolm
21
22
23
24
25
26
27
28
29
30
      - libtiff
      - libwebp
      - libxslt
      - libzip
      - make
      - npm
      - openssl
      - pkgconf
      - postgresql-libs
      - python
31
      - python-passlib
32
      - redis
33
34
      - tcl
      - tk
35
      - yarn
36
      - zlib
37
38
39
40
41
42
43
44

- name: add synapse group
  group: name=synapse system=yes gid=198

- name: add synapse user
  user: name=synapse system=yes uid=198 group=synapse home=/var/lib/synapse shell=/bin/false createhome=no

- name: create synapse home
45
  file: path={{ item }} state=directory owner=synapse group=synapse mode=0700
46
47
48
  with_items:
    - /var/lib/synapse
    - /var/lib/synapse/media_store
49
50
51
    - /var/lib/synapse/mjolnir-data
    - /var/lib/synapse/pantalaimon-data

52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
- name: make virtualenvs
  command: 'python -m venv {{ item }}'
  args:
    creates: '{{ item }}/bin/python'
  become: true
  become_user: synapse
  become_method: sudo
  with_items:
    - /var/lib/synapse/venv
    - /var/lib/synapse/venv-pantalaimon

- name: update virtualenvs
  pip:
    name:
      - pip
      - wheel
    state: latest
    extra_args: '--upgrade-strategy=eager'
    virtualenv: '{{ item }}'
Kristian Klausen's avatar
Kristian Klausen committed
71
  become: true
72
73
74
75
76
77
78
79
80
  become_user: synapse
  become_method: sudo
  with_items:
    - /var/lib/synapse/venv
    - /var/lib/synapse/venv-pantalaimon

- name: install synapse
  pip:
    name:
81
      - 'matrix-synapse[postgres,systemd,url_preview,redis,oidc]==1.39.0'
82
83
84
    state: latest
    extra_args: '--upgrade-strategy=eager'
    virtualenv: /var/lib/synapse/venv
Kristian Klausen's avatar
Kristian Klausen committed
85
  become: true
86
87
  become_user: synapse
  become_method: sudo
88
  register: synapse_pip
89
90
91
92
93
94
  notify:
    - restart synapse

- name: install pantalaimon
  pip:
    name:
95
      - 'pantalaimon==0.10.2'
96
97
98
    state: latest
    extra_args: '--upgrade-strategy=eager'
    virtualenv: /var/lib/synapse/venv-pantalaimon
Kristian Klausen's avatar
Kristian Klausen committed
99
  become: true
100
101
102
103
104
  become_user: synapse
  become_method: sudo
  notify:
    - restart pantalaimon

105
106
107
108
- name: download mjolnir
  git:
    repo: https://github.com/matrix-org/mjolnir
    dest: /var/lib/synapse/mjolnir
109
    version: v0.1.18
Kristian Klausen's avatar
Kristian Klausen committed
110
  become: true
111
112
  become_user: synapse
  become_method: sudo
113
  register: mjolnir_git
114
115
116
117
118
119
  notify:
    - restart mjolnir

- name: install mjolnir
  community.general.yarn:
    path: /var/lib/synapse/mjolnir
Kristian Klausen's avatar
Kristian Klausen committed
120
  become: true
121
122
  become_user: synapse
  become_method: sudo
123
  when: mjolnir_git.changed
124
125
126
127
128
129
130
131

- name: build mjolnir
  command: yarn build
  args:
    chdir: /var/lib/synapse/mjolnir
  become: true
  become_user: synapse
  become_method: sudo
132
  when: mjolnir_git.changed
133

134
- name: install mjolnir antispam module
135
136
  pip:
    name:
137
      - /var/lib/synapse/mjolnir/synapse_antispam
138
    state: latest
139
    virtualenv: /var/lib/synapse/venv
Kristian Klausen's avatar
Kristian Klausen committed
140
  become: true
141
142
  become_user: synapse
  become_method: sudo
143
  when: synapse_pip.changed or mjolnir_git.changed
144
145
  notify:
    - restart synapse
146

147
- name: download matrix-appservice-irc
148
  git:
149
    repo: https://github.com/matrix-org/matrix-appservice-irc
150
    dest: /var/lib/synapse/matrix-appservice-irc
151
    version: 0.27.0
Kristian Klausen's avatar
Kristian Klausen committed
152
  become: true
153
154
  become_user: synapse
  become_method: sudo
155
  register: irc_git
156
157
  notify:
    - restart matrix-appservice-irc
158
159

- name: install matrix-appservice-irc
160
  community.general.npm:
161
    path: /var/lib/synapse/matrix-appservice-irc
162
    ci: true
Kristian Klausen's avatar
Kristian Klausen committed
163
  become: true
164
165
  become_user: synapse
  become_method: sudo
166
  when: irc_git.changed
167

168
169
170
171
172
- name: install pg_hba.conf
  copy: src=pg_hba.conf dest=/var/lib/postgres/data/pg_hba.conf owner=postgres group=postgres mode=0600
  notify:
    - restart postgres

173
174
- name: add synapse postgres db
  postgresql_db: db=synapse
Kristian Klausen's avatar
Kristian Klausen committed
175
  become: true
176
177
178
179
  become_user: postgres
  become_method: su

- name: add synapse postgres user
180
  postgresql_user: db=synapse user=synapse password={{ vault_postgres_users.synapse }}
Kristian Klausen's avatar
Kristian Klausen committed
181
  become: true
182
183
184
185
186
  become_user: postgres
  become_method: su

- name: add irc postgres db
  postgresql_db: db=irc
Kristian Klausen's avatar
Kristian Klausen committed
187
  become: true
188
189
190
  become_user: postgres
  become_method: su

191
- name: create synapse config dir
192
193
194
195
  file: path={{ item }} state=directory owner=root group=synapse mode=0750
  with_items:
    - /etc/synapse
    - /etc/synapse/mjolnir
196
197
198

- name: install homeserver config
  template: src=homeserver.yaml.j2 dest=/etc/synapse/homeserver.yaml owner=root group=synapse mode=0640
199
200
  notify:
    - restart synapse
201

202
203
204
205
206
- name: install static config
  copy: src={{ item }} dest=/etc/synapse/{{ item }} owner=root group=root mode=0644
  with_items:
    - log_config.yaml
    - worker-appservice.yaml
207
    - worker-federation_reader.yaml
208
    - worker-federation_sender.yaml
209
    - worker-media_repository.yaml
210
211
  notify:
    - restart synapse
212

213
214
215
216
217
218
219
220
221
222
- name: install pantalaimon config
  template: src=pantalaimon.conf.j2 dest=/etc/synapse/pantalaimon.conf owner=root group=synapse mode=0644
  notify:
    - restart pantalaimon

- name: install mjolnir config
  template: src=mjolnir.yaml.j2 dest=/etc/synapse/mjolnir/production.yaml owner=root group=synapse mode=0640
  notify:
    - restart mjolnir

223
224
- name: install irc-bridge config
  template: src=irc-bridge.yaml.j2 dest=/etc/synapse/irc-bridge.yaml owner=root group=synapse mode=0640
225
226
  notify:
    - restart matrix-appservice-irc
227
228
229

- name: install irc-bridge registration
  template: src=appservice-registration-irc.yaml.j2 dest=/etc/synapse/appservice-registration-irc.yaml owner=root group=synapse mode=0640
230
231
  notify:
    - restart synapse
232

233
234
- name: install signing key
  copy:
235
    content: '{{ vault_matrix_secrets.signing_key }}'
236
237
238
239
240
    dest: /etc/synapse/{{ matrix_server_name }}.signing.key
    owner: root
    group: synapse
    mode: 0640

241
242
- name: install ircpass key
  copy:
243
    content: '{{ vault_matrix_secrets.ircpass_key }}'
244
245
246
247
    dest: /etc/synapse/{{ matrix_server_name }}.ircpass.key
    owner: root
    group: synapse
    mode: 0640
248

249
250
251
252
253
254
255
256
257
- name: create htpasswd for matrix metrics endpoint
  htpasswd:
    path: "{{ matrix_metrics_htpasswd }}"
    name: "{{ vault_matrix_secrets.metrics_user }}"
    password: "{{ vault_matrix_secrets.metrics_password }}"
    owner: root
    group: http
    mode: 0640

258
259
260
261
262
263
264
- name: make nginx log dir
  file: path=/var/log/nginx/{{ matrix_domain }} state=directory owner=root group=root mode=0755

- name: set up nginx
  template: src=nginx.d.conf.j2 dest=/etc/nginx/nginx.d/matrix.conf owner=root group=root mode=0644
  notify:
    - reload nginx
265
  when: 'matrix_domain is defined'
266
  tags: ['nginx']
267

268
- name: install turnserver.conf
269
  template: src=turnserver.conf.j2 dest=/etc/turnserver/turnserver.conf owner=turnserver group=turnserver mode=0600
270
271
272
273
274
275
  notify:
    - restart turnserver

- name: install turnserver cert renewal hook
  copy: src=letsencrypt.hook.d dest=/etc/letsencrypt/hook.d/turnserver owner=root group=root mode=0755

276
- name: install synapse units
277
278
279
  copy: src={{ item }} dest=/etc/systemd/system/{{ item }} owner=root group=root mode=0644
  with_items:
    - synapse.service
280
281
282
283
    - synapse-worker@.service
  notify:
    - restart synapse

284
285
286
287
288
289
290
291
292
293
294
295
296
297
- name: install pantalaimon units
  copy: src={{ item }} dest=/etc/systemd/system/{{ item }} owner=root group=root mode=0644
  with_items:
    - pantalaimon.service
  notify:
    - restart pantalaimon

- name: install mjolnir units
  copy: src={{ item }} dest=/etc/systemd/system/{{ item }} owner=root group=root mode=0644
  with_items:
    - mjolnir.service
  notify:
    - restart mjolnir

298
299
300
- name: install matrix-appservice-irc units
  copy: src={{ item }} dest=/etc/systemd/system/{{ item }} owner=root group=root mode=0644
  with_items:
301
    - matrix-appservice-irc.service
302
303
304
  notify:
    - restart matrix-appservice-irc

305
306
307
308
309
310
311
- name: install turnserver units
  copy: src={{ item }} dest=/etc/systemd/system/{{ item }} owner=root group=root mode=0644
  with_items:
    - turnserver.service
  notify:
    - restart turnserver

312
313
314
315
316
- name: enable synapse units
  service: name={{ item }} enabled=yes
  with_items:
    - synapse.service
    - synapse-worker@appservice.service
317
    - synapse-worker@federation_reader.service
318
    - synapse-worker@federation_sender.service
319
    - synapse-worker@media_repository.service
320
  notify:
321
    - restart synapse
322

323
324
325
326
327
328
329
330
331
332
- name: enable pantalaimon units
  service: name={{ item }} enabled=yes
  with_items:
    - pantalaimon.service

- name: enable mjolnir units
  service: name={{ item }} enabled=yes
  with_items:
    - mjolnir.service

333
334
335
336
- name: enable matrix-appservice-irc units
  service: name={{ item }} enabled=yes
  with_items:
    - matrix-appservice-irc.service
337

338
339
340
341
342
- name: enable turnserver units
  service: name={{ item }} enabled=yes
  with_items:
    - turnserver.service

343
- name: open firewall holes
344
  ansible.posix.firewalld: port={{ item }} permanent=true state=enabled immediate=yes
345
  with_items:
346
    # synapse's identd
347
    - 113/tcp
348
349
350
351
352
353
    # turnserver
    - 3478-3479/tcp
    - 3478-3479/udp
    - 5349-5350/tcp
    - 5349-5350/udp
    - 33000-33999/udp
354
355
  when: configure_firewall
  tags:
356
    - firewall