main.yml 6.2 KB
Newer Older
1
2
---

3
- name: create ssl cert
4
  command: certbot certonly --email webmaster@archlinux.org --agree-tos --rsa-key-size 4096 --renew-by-default --webroot -w {{ letsencrypt_validation_dir }} -d '{{ matrix_domain }}' creates='/etc/letsencrypt/live/{{ matrix_domain }}/fullchain.pem'
5
  when: 'matrix_domain is defined'
6
7

- name: install packages
8
9
  pacman:
    name:
10
      - coturn
11
12
13
14
15
      - freetype2
      - gcc
      - git
      - jemalloc
      - libffi
16
      - libjpeg-turbo
17
18
19
20
21
22
23
24
25
26
27
      - libtiff
      - libwebp
      - libxslt
      - libzip
      - make
      - npm
      - openssl
      - pkgconf
      - postgresql-libs
      - python
      - python2
28
      - redis
29
30
31
      - tcl
      - tk
      - zlib
32
33
34
35
36
37
38
39

- name: add synapse group
  group: name=synapse system=yes gid=198

- name: add synapse user
  user: name=synapse system=yes uid=198 group=synapse home=/var/lib/synapse shell=/bin/false createhome=no

- name: create synapse home
40
  file: path={{ item }} state=directory owner=synapse group=synapse mode=0700
41
42
43
  with_items:
    - /var/lib/synapse
    - /var/lib/synapse/media_store
44

45
46
47
48
49
50
51
52
- name: make virtualenv
  command: python -m venv /var/lib/synapse/venv
  args:
    creates: /var/lib/synapse/venv/bin/python
  become: true
  become_user: synapse
  become_method: sudo

53
54
55
- name: install synapse
  pip:
    name:
56
      - 'matrix-synapse[postgres,systemd,url_preview,redis]'
57
      - pip
58
    state: latest
59
60
    extra_args: '-U --upgrade-strategy=eager'
    virtualenv: /var/lib/synapse/venv
61
62
63
  become: yes
  become_user: synapse
  become_method: sudo
64
65
  notify:
    - restart synapse
66

67
- name: download matrix-appservice-irc
68
  git:
69
    repo: https://github.com/matrix-org/matrix-appservice-irc
70
    dest: /var/lib/synapse/matrix-appservice-irc
71
    version: master
72
73
74
  become: yes
  become_user: synapse
  become_method: sudo
75
76
  notify:
    - restart matrix-appservice-irc
77
78

- name: install matrix-appservice-irc
79
80
  npm:
    path: /var/lib/synapse/matrix-appservice-irc
81
82
83
  become: yes
  become_user: synapse
  become_method: sudo
84
85
  notify:
    - restart matrix-appservice-irc
86

87
88
89
90
91
- name: install pg_hba.conf
  copy: src=pg_hba.conf dest=/var/lib/postgres/data/pg_hba.conf owner=postgres group=postgres mode=0600
  notify:
    - restart postgres

92
93
94
95
96
97
98
- name: add synapse postgres db
  postgresql_db: db=synapse
  become: yes
  become_user: postgres
  become_method: su

- name: add synapse postgres user
99
100
101
102
103
104
105
  postgresql_user: db=synapse user=synapse password={{ vault_postgres_users.synapse }}
  become: yes
  become_user: postgres
  become_method: su

- name: add irc postgres db
  postgresql_db: db=irc
106
107
108
109
  become: yes
  become_user: postgres
  become_method: su

110
- name: create synapse config dir
111
112
113
114
  file: state=directory path=/etc/synapse owner=root group=synapse mode=0750

- name: install homeserver config
  template: src=homeserver.yaml.j2 dest=/etc/synapse/homeserver.yaml owner=root group=synapse mode=0640
115
116
  notify:
    - restart synapse
117

118
119
120
121
122
- name: install static config
  copy: src={{ item }} dest=/etc/synapse/{{ item }} owner=root group=root mode=0644
  with_items:
    - log_config.yaml
    - worker-appservice.yaml
123
    - worker-federation_reader.yaml
124
    - worker-federation_sender.yaml
125
    - worker-media_repository.yaml
126
127
  notify:
    - restart synapse
128

129
130
- name: install irc-bridge config
  template: src=irc-bridge.yaml.j2 dest=/etc/synapse/irc-bridge.yaml owner=root group=synapse mode=0640
131
132
  notify:
    - restart matrix-appservice-irc
133
134
135

- name: install irc-bridge registration
  template: src=appservice-registration-irc.yaml.j2 dest=/etc/synapse/appservice-registration-irc.yaml owner=root group=synapse mode=0640
136
137
  notify:
    - restart synapse
138

139
140
- name: install signing key
  copy:
141
    content: '{{ vault_matrix_secrets[matrix_server_name].signing_key }}'
142
143
144
145
146
    dest: /etc/synapse/{{ matrix_server_name }}.signing.key
    owner: root
    group: synapse
    mode: 0640

147
148
- name: install ircpass key
  copy:
149
    content: '{{ vault_matrix_secrets[matrix_server_name].ircpass_key }}'
150
151
152
153
    dest: /etc/synapse/{{ matrix_server_name }}.ircpass.key
    owner: root
    group: synapse
    mode: 0640
154
155
156
157
158
159
160
161

- name: make nginx log dir
  file: path=/var/log/nginx/{{ matrix_domain }} state=directory owner=root group=root mode=0755

- name: set up nginx
  template: src=nginx.d.conf.j2 dest=/etc/nginx/nginx.d/matrix.conf owner=root group=root mode=0644
  notify:
    - reload nginx
162
  when: 'matrix_domain is defined'
163
  tags: ['nginx']
164

165
166
167
168
169
170
171
172
- name: install turnserver.conf
  template: src=turnserver.conf.j2 dest=/etc/turnserver/turnserver.conf owner=root group=root mode=0644
  notify:
    - restart turnserver

- name: install turnserver cert renewal hook
  copy: src=letsencrypt.hook.d dest=/etc/letsencrypt/hook.d/turnserver owner=root group=root mode=0755

173
- name: install synapse units
174
175
176
  copy: src={{ item }} dest=/etc/systemd/system/{{ item }} owner=root group=root mode=0644
  with_items:
    - synapse.service
177
178
179
180
181
182
183
    - synapse-worker@.service
  notify:
    - restart synapse

- name: install matrix-appservice-irc units
  copy: src={{ item }} dest=/etc/systemd/system/{{ item }} owner=root group=root mode=0644
  with_items:
184
    - matrix-appservice-irc.service
185
186
187
  notify:
    - restart matrix-appservice-irc

188
189
190
191
192
193
194
- name: install turnserver units
  copy: src={{ item }} dest=/etc/systemd/system/{{ item }} owner=root group=root mode=0644
  with_items:
    - turnserver.service
  notify:
    - restart turnserver

195
196
197
198
199
- name: enable synapse units
  service: name={{ item }} enabled=yes
  with_items:
    - synapse.service
    - synapse-worker@appservice.service
200
    - synapse-worker@federation_reader.service
201
    - synapse-worker@federation_sender.service
202
    - synapse-worker@media_repository.service
203
  notify:
204
    - restart synapse
205
206
207
208
209
210

- name: enable matrix-appservice-irc units
  service: name={{ item }} enabled=yes
  with_items:
    - matrix-appservice-irc.service
  notify:
211
    - restart matrix-appservice-irc
212

213
214
215
216
217
218
219
- name: enable turnserver units
  service: name={{ item }} enabled=yes
  with_items:
    - turnserver.service
  notify:
    - restart turnserver

220
- name: open firewall holes
221
  ansible.posix.firewalld: port={{ item }} permanent=true state=enabled immediate=yes
222
  with_items:
223
    # synapse's identd
224
    - 113/tcp
225
226
227
228
229
230
    # turnserver
    - 3478-3479/tcp
    - 3478-3479/udp
    - 5349-5350/tcp
    - 5349-5350/udp
    - 33000-33999/udp
231
232
  when: configure_firewall
  tags:
233
    - firewall