ConfigLMM 0.3.0 → 0.5.0

data/Plugins/Apps/Matrix/Matrix.conf.erb

@@ -1,12 +1,53 @@
 
 server {
+
+    <% if !config['TLS'] %>
+        listen       <%= config['Port'] %>;
+        listen  [::]:<%= config['Port'] %>;
+    <% else %>
+        <% if config['NginxVersion'] >= 1.25 %>
+            listen <%= config['Port'] %> ssl;
+            listen [::]:<%= config['Port'] %> ssl;
+            http2 on;
+            http3 on;
+            quic_retry on;
+            add_header Alt-Svc 'h3=":<%= config['Port'] %>"; ma=86400';
+        <% else %>
+            listen <%= config['Port'] %> ssl http2;
+            listen [::]:<%= config['Port'] %> ssl http2;
+        <% end %>
+
+        include config-lmm/ssl.conf;
+    <% end %>
+
+    server_name <%= config['Domain'] %>;
+
+    include config-lmm/errors.conf;
+
+    location / {
+        proxy_pass http://127.0.0.1:18300;
+        include config-lmm/proxy.conf;
+    }
+}
+
+server {
+
     <% if !config['TLS'] %>
         listen       <%= config['Port'] %>;
         listen  [::]:<%= config['Port'] %>;
     <% else %>
-        listen       <%= config['Port'] %> ssl;
-        listen  [::]:<%= config['Port'] %> ssl;
-        http2 on;
+        <% if config['NginxVersion'] >= 1.25 %>
+            listen <%= config['Port'] %> ssl;
+            listen [::]:<%= config['Port'] %> ssl;
+            http2 on;
+            http3 on;
+            quic_retry on;
+            add_header Alt-Svc 'h3=":<%= config['Port'] %>"; ma=86400';
+        <% else %>
+            listen <%= config['Port'] %> ssl http2;
+            listen [::]:<%= config['Port'] %> ssl http2;
+        <% end %>
+
         include config-lmm/ssl.conf;
     <% end %>
 
@@ -14,20 +55,17 @@ server {
     #listen 8448 ssl http2 default_server;
     #listen [::]:8448 ssl http2 default_server;
 
-    server_name <%= config['Domain'] %>;
-
-    access_log  /var/log/nginx/matrix.access.log;
-    error_log   /var/log/nginx/matrix.error.log;
+    server_name <%= config['SynapseDomain'] %>;
 
-    include config-lmm/private.conf;
     include config-lmm/errors.conf;
 
     location ~ ^(/_matrix|/_synapse/client) {
         # note: do not add a path (even a single /) after the port in `proxy_pass`,
         # otherwise nginx will canonicalise the URI and cause signature verification
         # errors.
-        proxy_pass http://localhost:8008;
+        proxy_pass http://127.0.0.1:8008;
         include config-lmm/proxy.conf;
+        proxy_intercept_errors off;
 
         # Nginx by default only allows file uploads up to 1M in size
         # Increase client_max_body_size to match max_upload_size defined in homeserver.yaml

data/Plugins/Apps/Matrix/Matrix.lmm.rb

@@ -1,10 +1,15 @@
 
 module ConfigLMM
     module LMM
-        class Matrix < Framework::NginxApp
+        class Matrix < Framework::Plugin
+
+            USER = 'matrix'
+            HOME_DIR = '/var/lib/matrix'
 
             def actionMatrixBuild(id, target, state, context, options)
-                writeNginxConfig(__dir__, 'Matrix', id, target, state, context, options)
+                Nginx.withConnection(local) do |nginxConnection|
+                    nginxConnection.writeConfig(__dir__, 'Matrix', target, state, context, options)
+                end
             end
 
             def actionMatrixDiff(id, target, activeState, context, options)
@@ -12,10 +17,119 @@ module ConfigLMM
             end
 
             def actionMatrixDeploy(id, target, activeState, context, options)
-                if !target['Location'] || target['Location'] == '@me'
-                    deployNginxConfig(id, target, activeState, context, options)
-                    activeState['Location'] = '@me'
+                raise Framework::PluginProcessError.new('Domain field must be set!') unless target['Domain']
+                raise Framework::PluginProcessError.new('ServerName field must be set!') unless target['ServerName']
+
+                target['Database'] ||= {}
+
+                self.withConnection(target['Location'], target) do |connection|
+                    Linux.withConnection(connection) do |linuxConnection|
+                        target['Database'] ||= {}
+                        dbPassword = self.configurePostgreSQL(target['Database'], linuxConnection, options)
+
+                        Podman.ensurePresent(linuxConnection, options)
+                        Podman.createUser(USER, HOME_DIR, 'Matrix', linuxConnection, options)
+                        linuxConnection.withUserShell(USER) do |shell|
+                            shell.createDirs(options, '~/data')
+                        end
+
+                        path = Podman.containersPath(HOME_DIR)
+                        linuxConnection.ensureFile("#{path}/Matrix.env", options)
+
+                        linuxConnection.setUserGroup("#{path}/Matrix.env", USER, USER, options)
+                        linuxConnection.setPrivate("#{path}/Matrix.env", options)
+
+                        homeserver = YAML.load_file(__dir__ + '/homeserver.yaml')
+                        configureHomeserver(homeserver, dbPassword, target)
+                        homeserverFile = options['output'] + '/homeserver.yaml'
+                        File.write(homeserverFile, homeserver.to_yaml)
+
+                        linuxConnection.upload(homeserverFile, HOME_DIR + '/data/', options)
+
+                        linuxConnection.upload(__dir__ + '/log.config', HOME_DIR + '/data/', options)
+                        linuxConnection.upload(__dir__ + '/config.json', HOME_DIR + '/', options)
+                        linuxConnection.setUserGroup("#{HOME_DIR}/data", USER, USER, options)
+
+                        linuxConnection.fileReplace("#{HOME_DIR}/config.json", '\$SYNAPSE_DOMAIN', target['SynapseDomain'], options)
+                        linuxConnection.fileReplace("#{HOME_DIR}/config.json", '\$SERVER_NAME', target['ServerName'], options)
+
+                        linuxConnection.upload(__dir__ + '/Synapse.container', path, options)
+                        linuxConnection.upload(__dir__ + '/Element.container', path, options)
+
+                        linuxConnection.reloadUserServices(USER, options)
+                        linuxConnection.restartUserService(USER, 'Synapse', options)
+                        linuxConnection.restartUserService(USER, 'Element', options)
+
+                        Nginx.withConnection(linuxConnection) do |nginxConnection|
+                            nginxConnection.provision(__dir__, 'Matrix', target, activeState, context, options)
+                        end
+                    end
+                end
+            end
+
+            def configureHomeserver(homeserver, dbPassword, target)
+                homeserver['server_name'] = target['ServerName']
+                homeserver['public_baseurl'] = "https://#{target['SynapseDomain'].downcase}/"
+
+                homeserver['database']['args']['password'] = dbPassword
+
+                homeserver['registration_shared_secret'] = SecureRandom.urlsafe_base64(45)
+                homeserver['macaroon_secret_key'] = SecureRandom.urlsafe_base64(45)
+                homeserver['form_secret'] = SecureRandom.urlsafe_base64(45)
+
+                if target['SMTP']
+                    host = target['SMTP']['Host']
+                    host = Podman::HOST_IP if host.to_s.empty? || ['localhost', '127.0.0.1'].include?(host)
+
+                    homeserver['email']['smtp_host'] = host
+                    if target['SMTP']['Port']
+                        homeserver['email']['smtp_port'] = target['SMTP']['Port']
+                    end
+                    if target['SMTP']['Username']
+                        homeserver['email']['smtp_user'] = target['SMTP']['Username']
+                        smtpPassword = nil
+                        if target['SMTP']['SecretId']
+                            smtpPassword = context.secrets.load(target['SMTP']['SecretId'], target['SMTP']['Username'].upcase + '_PASSWORD')
+                        end
+                        homeserver['email']['smtp_pass'] = smtpPassword if smtpPassword
+                    end
+
+                    homeserver['email']['notif_from'] = target['SMTP']['From']
+
+                    if target['SMTP']['Port'] == 465
+                        homeserver['email']['force_tls'] = true
+                    end
+                else
+                    homeserver.delete('email')
+                end
+
+                if target['OIDC']
+                    raise Framework::PluginProcessError.new('OIDC.SecretId must be set!') if target['OIDC']['SecretId'].to_s.empty?
+
+                    homeserver['oidc_providers'][0]['issuer'] = target['OIDC']['Issuer']
+
+                    clientId = context.secrets.load(target['OIDC']['SecretId'], 'MATRIX_CLIENT_ID')
+                    clientSecret = context.secrets.load(target['OIDC']['SecretId'], 'MATRIX_CLIENT_SECRET')
+
+                    if !clientId || !clientSecret
+                        prompt.say("Secrets #{context.secrets.getID(target['OIDC']['SecretId'], 'MATRIX_CLIENT_ID')} and #{context.secrets.getID(target['OIDC']['SecretId'], 'MATRIX_CLIENT_SECRET')} must be set!", :color => :magenta)
+                        raise 'Required secrets are missing!'
+                    end
+
+                    homeserver['oidc_providers'][0]['client_id'] = clientId
+                    homeserver['oidc_providers'][0]['client_secret'] = clientSecret
+                    homeserver['password_config']['enabled'] = false
+                else
+                    homeserver.delete('oidc_providers')
+                end
+            end
+
+            def configurePostgreSQL(dbSettings, linuxConnection, options)
+                password = SecureRandom.alphanumeric(20)
+                PostgreSQL.withConnection(dbSettings, linuxConnection) do |postgresConnection|
+                    postgresConnection.createUserAndDB(USER, password, options)
                 end
+                password
             end
 
         end

data/Plugins/Apps/Matrix/Synapse.container

@@ -0,0 +1,22 @@
+
+
+[Unit]
+Description=Matrix (Synapse) container
+After=local-fs.target
+
+[Container]
+ContainerName=Synapse
+Image=docker.io/matrixdotorg/synapse:latest
+EnvironmentFile=/var/lib/matrix/.config/containers/systemd/Matrix.env
+Network=slirp4netns:allow_host_loopback=true
+PublishPort=127.0.0.1:8008:8008
+UserNS=keep-id:uid=991,gid=991
+Volume=/var/lib/matrix/data:/data
+LogDriver=journald
+AutoUpdate=registry
+
+[Service]
+Restart=on-failure
+
+[Install]
+WantedBy=multi-user.target default.target

data/Plugins/Apps/Matrix/config.json

@@ -0,0 +1,50 @@
+{
+    "default_server_config": {
+        "m.homeserver": {
+            "base_url": "https://$SYNAPSE_DOMAIN",
+            "server_name": "$SERVER_NAME"
+        },
+        "m.identity_server": {
+            "base_url": "https://matrix.org"
+        }
+    },
+    "disable_custom_urls": false,
+    "disable_guests": false,
+    "disable_login_language_selector": false,
+    "disable_3pid_login": false,
+    "brand": "Element",
+    "integrations_ui_url": "https://scalar.vector.im/",
+    "integrations_rest_url": "https://scalar.vector.im/api",
+    "integrations_widgets_urls": [
+        "https://scalar.vector.im/_matrix/integrations/v1",
+        "https://scalar.vector.im/api",
+        "https://scalar-staging.vector.im/_matrix/integrations/v1",
+        "https://scalar-staging.vector.im/api",
+        "https://scalar-staging.riot.im/scalar/api"
+    ],
+    "default_widget_height": 280,
+    "default_country_code": "GB",
+    "show_labs_settings": false,
+    "features": {},
+    "default_federate": true,
+    "default_theme": "light",
+    "room_directory": {
+        "servers": ["matrix.org"]
+    },
+    "enable_presence_by_hs_url": {
+        "https://matrix.org": false,
+        "https://matrix-client.matrix.org": false
+    },
+    "setting_defaults": {
+        "breadcrumbs": true
+    },
+    "jitsi": {
+        "preferred_domain": "meet.element.io"
+    },
+    "element_call": {
+        "url": "https://call.element.io",
+        "participant_limit": 8,
+        "brand": "Element Call"
+    },
+    "map_style_url": "https://api.maptiler.com/maps/streets/style.json?key=fU3vlMsMn4Jb6dnEIFsx"
+}

data/Plugins/Apps/Matrix/homeserver.yaml

@@ -0,0 +1,70 @@
+# Configuration file for Synapse.
+#
+# This is a YAML file: see [1] for a quick introduction. Note in particular
+# that *indentation is important*: all the elements of a list or dictionary
+# should have the same indentation.
+#
+# [1] https://docs.ansible.com/ansible/latest/reference_appendices/YAMLSyntax.html
+#
+# For more information on how to configure Synapse, including a complete accounting of
+# each option, go to docs/usage/configuration/config_documentation.md or
+# https://element-hq.github.io/synapse/latest/usage/configuration/config_documentation.html
+server_name: $SERVER_NAME
+public_baseurl: https://$SYNAPSE_DOMAIN/
+pid_file: /data/homeserver.pid
+listeners:
+  - port: 8008
+    tls: false
+    type: http
+    x_forwarded: true
+    resources:
+      - names: [client, federation]
+        compress: false
+
+database:
+  name: psycopg2
+  allow_unsafe_locale: true
+  args:
+    user: matrix
+    password: $DB_PASSWORD
+    dbname: matrix
+    host: 10.0.2.2
+
+email:
+    smtp_host: 10.0.2.2
+    smtp_port: 25
+    smtp_user:
+    smtp_pass:
+    force_tls: false
+    notif_from:
+
+password_config:
+   enabled: true
+
+oidc_providers:
+  - idp_id: OIDC
+    idp_name: OIDC
+    discover: true
+    issuer: $OIDC_ISSUER
+    client_id: $CLIENT_ID
+    client_secret: $CLIENT_SECRET
+    scopes:
+      - "openid"
+      - "profile"
+      - "email"
+    user_mapping_provider:
+      config:
+        localpart_template: "{{ user.preferred_username }}"
+        display_name_template: "{{ user.name|capitalize }}"
+
+log_config: "/data/log.config"
+media_store_path: /data/media_store
+registration_shared_secret: $SECRET1
+report_stats: false
+macaroon_secret_key: $SECRET2
+form_secret: $SECRET3
+report_stats: false
+signing_key_path: "/data/signing.key"
+trusted_key_servers:
+  - server_name: "matrix.org"
+suppress_key_server_warning: true

data/Plugins/Apps/Matrix/log.config

@@ -0,0 +1,30 @@
+version: 1
+
+formatters:
+  precise:
+
+    format: '%(asctime)s - %(name)s - %(lineno)d - %(levelname)s - %(request)s - %(message)s'
+
+handlers:
+
+  console:
+    class: logging.StreamHandler
+    formatter: precise
+
+loggers:
+    # This is just here so we can leave `loggers` in the config regardless of whether
+    # we configure other loggers below (avoid empty yaml dict error).
+    _placeholder:
+        level: "INFO"
+
+    synapse.storage.SQL:
+        # beware: increasing this to DEBUG will make synapse log sensitive
+        # information such as access tokens.
+        level: INFO
+
+root:
+    level: INFO
+    handlers: [console]
+
+
+disable_existing_loggers: false

data/Plugins/Apps/Netdata/Netdata.conf.erb

@@ -16,9 +16,6 @@ server {
 
     server_name <%= config['Domain'] %>;
 
-    access_log  /var/log/nginx/netdata.access.log;
-    error_log   /var/log/nginx/netdata.error.log;
-
     include config-lmm/private.conf;
     include config-lmm/errors.conf;
 

data/Plugins/Apps/Netdata/Netdata.lmm.rb

@@ -14,7 +14,6 @@ module ConfigLMM
             def actionNetdataDeploy(id, target, activeState, context, options)
                 if !target['Location'] || target['Location'] == '@me'
                     deployNginxConfig(id, target, activeState, context, options)
-                    activeState['Location'] = '@me'
                 end
             end
 

data/Plugins/Apps/Nextcloud/Nextcloud.conf.erb

@@ -31,10 +31,7 @@ server
 
     server_name <%= config['Domain'] %>;
 
-    access_log  /var/log/nginx/nextcloud.access.log;
-    error_log   /var/log/nginx/nextcloud.error.log;
-
-    root /usr/share/webapps/nextcloud;
+    root <%= config['Root'] %>;
 
     include config-lmm/private.conf;
     include config-lmm/errors.conf;
@@ -142,6 +139,8 @@ server
         fastcgi_request_buffering off;
 
         fastcgi_max_temp_file_size 0;
+
+        fastcgi_hide_header X-Powered-By;
     }
 
     # Rule borrowed from `.htaccess`