Narrow down the pass locations for Matrix to just server endpoints

This reverts commit 0586eb5ce9.

inventory/group_vars/all.yml

@@ -269,6 +269,15 @@ secret_snmp_rouser_privacy_passphrase: !vault |
           3764363538636232630a383730323433343239663461373030383132626532306130363965316661
           64353932376139613765303764313463353366663535653135393637633835353566
 
+# For Synapse
+secret_synapse_db_pass: !vault |
+          $ANSIBLE_VAULT;1.1;AES256
+          38343663383430353236366263666664376162666635633764646539383239613864363838663262
+          3165313832643330346336613465323439316461643432660a623337373562626431613561323566
+          64323162623530303965316634666532333034313864663133663933623438313230386261623064
+          3663623537333161630a616263656362633461366462613366323262363734353233373330393932
+          36653333643632313139396631633962386533323330346639363736353863313763
+
 # For home media stuff
 secret_transmission_user_pass: !vault |
           $ANSIBLE_VAULT;1.1;AES256

playbooks/prod_com.yml

@@ -0,0 +1,41 @@
+#!/usr/bin/env ansible-playbook
+# vim:ft=ansible:
+# Webservers
+---
+- hosts: com1.desu.ltd
+  module_defaults:
+    docker_container:
+      state: started
+      restart_policy: unless-stopped
+      pull: yes
+  pre_tasks:
+    - name: ensure docker network
+      docker_network: name=web
+      tags: [ docker ]
+  tasks:
+    - name: include tasks for applications
+      include_tasks: tasks/{{ item }}
+      with_items:
+        - web/synapse.yml
+      tags: [ always ]
+  roles:
+    - role: backup
+      vars:
+        backup_s3backup_list_extra:
+          - /data
+      tags: [ backup ]
+    - role: ingress
+      vars:
+        ingress_servers:
+          - name: matrix.desu.ltd
+            proxies:
+              - location: ~* ^(\/_matrix|\/_synapse\/client)
+                pass: http://synapse:8008
+            locations:
+              - location: /
+                contents: |
+                  default_type text/html;
+                  return 200 'Watch this space...';
+            directives:
+              - "client_max_body_size 0"
+      tags: [ web, docker, ingress ]

playbooks/prod_db.yml

@@ -39,6 +39,8 @@
             password: "{{ secret_peertube_db_pass }}"
           - name: pleroma-cowfee
             password: "{{ secret_pleroma_9iron_db_pass }}"
+          - name: synapse-desultd
+            password: "{{ secret_synapse_db_pass }}"
         postgresql_databases:
           - name: gitea-desultd
             owner: gitea-desultd
@@ -54,4 +56,8 @@
             owner: pleroma-cowfee
           - name: peertube
             owner: peertube-cowfee
+          - name: synapse-desultd
+            lc_collate: C
+            lc_ctype: C
+            owner: synapse-desultd
       tags: [ db, psql ]

playbooks/prod_web.yml

@@ -46,6 +46,15 @@
           # desu.ltd
           - name: desu.ltd
             proxy_pass: http://desultd:80
+            locations:
+              - location: /.well-known/matrix/server
+                contents: |
+                  default_type application/json;
+                  return 200 '{"m.server":"matrix.desu.ltd:443"}';
+              - location: /.well-known/matrix/client
+                contents: |
+                  default_type application/json;
+                  return 200 '{"m.homeserver":{"base_url":"https://matrix.desu.ltd"}}';
           - name: git.desu.ltd
             proxy_pass: http://gitea:3000
           - name: nc.desu.ltd

playbooks/tasks/web/synapse.yml

@@ -0,0 +1,15 @@
+# vim:ft=ansible:
+- name: docker deploy synapse
+  docker_container:
+    name: synapse
+    image: matrixdotorg/synapse:latest
+    env:
+      TZ: "America/Chicago"
+      SYNAPSE_SERVER_NAME: matrix.desu.ltd
+      SYNAPSE_REPORT_STATS: "no"
+    networks:
+      - name: web
+        aliases: [ "synapse" ]
+    volumes:
+      - /data/synapse:/data
+  tags: [ docker, synapse ]

site.yml

@@ -19,6 +19,7 @@
   # Production configuration
 - import_playbook: playbooks/prod_db.yml
 - import_playbook: playbooks/prod_web.yml
+- import_playbook: playbooks/prod_com.yml
 - import_playbook: playbooks/prod_game.yml
   # Supplementary tags
 - import_playbook: playbooks/tags_ansible.yml