Migrate matrix from soyuz to hcloud

host_vars/matrix.archlinux.org

+---
+filesystem: btrfs
+
+postgres_backup_dir: "/var/lib/postgres/backup"
+zabbix_agent_templates:
+  - Template OS Linux
+  - Template App Borg Backup
+  - Template App PostgreSQL

playbooks/matrix.archlinux.org.yml

@@ -8,8 +8,8 @@
     - { role: tools }
     - { role: firewalld }
     - { role: sshd }
-    - { role: root_ssh }
     - { role: unbound }
+    - { role: root_ssh }
     - { role: borg-client }
     - { role: certbot }
     - { role: nginx }

playbooks/soyuz.yml

@@ -22,8 +22,6 @@
       postgres_maintenance_work_mem: 1GB
       postgres_effective_cache_size: 32GB
       tags: ['postgres']
-    - { role: oidentd, tags: ['oidentd'] }
-    - { role: matrix, tags: ['matrix'] }
     - { role: syncrepo, mirror_domain: "mirror.pkgbuild.com", tags: ['syncrepo', 'nginx'] }
     - { role: sogrep, tags: ['sogrep'] }
     - { role: archbuild, tags: ['archbuild'] }

roles/matrix/files/matrix-appservice-irc.service

@@ -10,6 +10,7 @@ ExecStart=/usr/bin/node app.js \
   -c /etc/synapse/irc-bridge.yaml \
   -f /etc/synapse/appservice-registration-irc.yaml \
   -p 8499
+AmbientCapabilities=CAP_NET_BIND_SERVICE
 
 [Install]
 WantedBy=multi-user.target

roles/matrix/tasks/main.yml

@@ -5,7 +5,7 @@
   when: 'matrix_domain is defined'
 
 - name: install packages
-  pacman: name=python,git,yarn,jemalloc
+  pacman: name=python,git,yarn,jemalloc,gcc,pkg-config,python2
 
 - name: add synapse group
   group: name=synapse system=yes gid=198
@@ -14,13 +14,21 @@
   user: name=synapse system=yes uid=198 group=synapse home=/var/lib/synapse shell=/bin/false createhome=no
 
 - name: create synapse home
-  file: path={{ item }} state=directory owner=synapse group=synapse mode=0755
+  file: path={{ item }} state=directory owner=synapse group=synapse mode=0700
   with_items:
     - /var/lib/synapse
     - /var/lib/synapse/irc-nedb
     - /var/lib/synapse/media_store
     - /var/lib/synapse/uploads
 
+- name: make virtualenv
+  command: python -m venv /var/lib/synapse/venv
+  args:
+    creates: /var/lib/synapse/venv/bin/python
+  become: true
+  become_user: synapse
+  become_method: sudo
+
 - name: install synapse
   pip:
     name:
@@ -29,7 +37,6 @@
     state: latest
     extra_args: '-U --upgrade-strategy=eager'
     virtualenv: /var/lib/synapse/venv
-    virtualenv_command: '-m venv'
   become: yes
   become_user: synapse
   become_method: sudo
@@ -130,7 +137,10 @@
     - restart matrix-appservice-irc
 
 - name: open firewall holes
-  firewalld: port=8448/tcp permanent=true state=enabled immediate=yes
+  firewalld: port={{ item }} permanent=true state=enabled immediate=yes
+  with_items:
+    - 8848/tcp
+    - 113/tcp
   when: configure_firewall
   tags:
     - firewall

roles/matrix/templates/irc-bridge.yaml.j2

@@ -357,7 +357,7 @@ ircService:
     # incoming requests to 113 to a high numbered port. Set the port to listen
     # on instead of 113 here.
     # Default: 113.
-    port: 1113
+    port: 113
     # The address to listen on for incoming ident requests.
     # Default: 0.0.0.0
     address: "::"