synapse: Add media_repository worker

This one has a trivial NGINX config.

roles/matrix/files/worker-media_repository.yaml

+worker_app: synapse.app.media_repository
+worker_listeners:
+  - port: 8013
+    type: http
+    x_forwarded: true
+    bind_addresses: ['::1', '127.0.0.1']
+    resources:
+      - names: [media]
+        compress: false
+
+# vim:ft=yaml sw=2 et:

roles/matrix/tasks/main.yml

@@ -88,6 +88,7 @@
     - log_config.yaml
     - worker-appservice.yaml
     - worker-federation_sender.yaml
+    - worker-media_repository.yaml
   notify:
     - restart synapse
 
@@ -148,6 +149,7 @@
     - synapse.service
     - synapse-worker@appservice.service
     - synapse-worker@federation_sender.service
+    - synapse-worker@media_repository.service
   notify:
     - restart synapse
 

roles/matrix/templates/homeserver.yaml.j2

@@ -703,7 +703,7 @@ log_config: "/etc/synapse/log_config.yaml"
 # Enable the media store service in the Synapse master. Uncomment the
 # following if you are using a separate media store worker.
 #
-#enable_media_repo: false
+enable_media_repo: false
 
 # Directory where uploaded images and attachments are stored.
 #

roles/matrix/templates/nginx.d.conf.j2

@@ -2,6 +2,10 @@ upstream matrix {
     server 127.0.0.1:8008;
 }
 
+upstream matrix_media_repository {
+    server 127.0.0.1:8013;
+}
+
 server {
     listen       80;
     listen       [::]:80;
@@ -30,6 +34,13 @@ server {
     ssl_certificate_key  /etc/letsencrypt/live/{{ matrix_domain }}/privkey.pem;
     ssl_trusted_certificate /etc/letsencrypt/live/{{ matrix_domain }}/chain.pem;
 
+    location /_matrix/media {
+        access_log   /var/log/nginx/{{ matrix_domain }}/access.log main;
+        proxy_pass http://matrix_media_repository;
+        proxy_set_header X-Forwarded-For $remote_addr;
+        proxy_read_timeout 900s;
+    }
+
     location /_matrix {
         access_log   /var/log/nginx/{{ matrix_domain }}/access.log main;
         proxy_pass http://matrix;