From d6518d404e10c5bb553c5573e09fbe7f1d10a2d7 Mon Sep 17 00:00:00 2001 From: uumas Date: Mon, 21 Sep 2026 05:51:48 +0300 Subject: [PATCH] synapse: Add support for appservices and use secrets better --- roles/synapse/defaults/main.yaml | 2 + roles/synapse/meta/argument_specs.yaml | 26 ++++++++ roles/synapse/tasks/main.yaml | 24 ++------ .../templates/appservice-registration.yaml.j2 | 21 +++++++ .../doublepuppet-registration.yaml.j2 | 15 +++++ roles/synapse/templates/homeserver.yaml.j2 | 10 +++- roles/synapse/vars/main.yaml | 59 ++++++++++++++++++- 7 files changed, 135 insertions(+), 22 deletions(-) create mode 100644 roles/synapse/templates/appservice-registration.yaml.j2 create mode 100644 roles/synapse/templates/doublepuppet-registration.yaml.j2 diff --git a/roles/synapse/defaults/main.yaml b/roles/synapse/defaults/main.yaml index a31db76..be0112c 100644 --- a/roles/synapse/defaults/main.yaml +++ b/roles/synapse/defaults/main.yaml @@ -19,3 +19,5 @@ synapse_auto_join_rooms: [] synapse_smtp_server: "" synapse_oidc_provider_client_id: "" + +synapse_appservices: [] diff --git a/roles/synapse/meta/argument_specs.yaml b/roles/synapse/meta/argument_specs.yaml index c961e2c..9f71aa8 100644 --- a/roles/synapse/meta/argument_specs.yaml +++ b/roles/synapse/meta/argument_specs.yaml @@ -116,3 +116,29 @@ argument_specs: type: str required: false default: 16-alpine + + synapse_appservices: + description: List of appservices to run with synapse. They will be installed in separate containers. + type: list + required: false + default: [] + elements: dict + options: + id: + description: A unique, user-defined ID of the application service which will never change + type: str + required: true + host: + description: Hostname the appservice is accessible to synapse at + type: str + required: true + as_token: + description: A secret token that the application service will use to authenticate requests to the homeserver + type: str + required: true + hs_token: + description: A secret token that the homeserver will use authenticate requests to the application service + type: str + required: true + synapse_doublepuppet_token: + description: Double puppeting token for appservices. Required if synapse_appservices is not empty. diff --git a/roles/synapse/tasks/main.yaml b/roles/synapse/tasks/main.yaml index c730411..471ebf0 100644 --- a/roles/synapse/tasks/main.yaml +++ b/roles/synapse/tasks/main.yaml @@ -15,26 +15,11 @@ name: service vars: service_name: synapse - service_container_image: "{{ _synapse_image_name }}" + service_container_image: ghcr.io/element-hq/synapse:latest service_database_type: postgres service_postgres_tag: "{{ synapse_postgres_tag }}" - service_container_mounts: - - type: template - source: homeserver.yaml.j2 - destination: /data/homeserver.yaml - - type: template - source: log.yaml.j2 - destination: /data/log.yaml - - type: volume - source: media - destination: /data/media - user: "991" - group: "991" - service_container_secrets: - - name: signing-key - value: "{{ synapse_signing_key }}" - - name: mas-client-secret - - name: mas-homeserver-secret + service_container_mounts: "{{ _synapse_mounts }}" + service_container_secrets: "{{ _synapse_secrets }}" service_container_env: SYNAPSE_SERVER_NAME: "{{ synapse_server_name }}" SYNAPSE_REPORT_STATS: "no" @@ -47,13 +32,14 @@ proxy_target_socket: /run/matrix-authentication-service-caddy-socket-proxy.sock service_wants: - matrix-authentication-service.service + service_container_additional_networks: "{{ _synapse_additional_networks }}" - name: Matrix authentication service for synapse ansible.builtin.import_role: name: matrix_authentication_service vars: matrix_authentication_service_additional_networks: - - synapse + - synapse-mas matrix_authentication_service_secrets: "{{ synapse_mas_secrets }}" matrix_authentication_service_domain: "{{ synapse_mas_domain }}" matrix_authentication_service_homeserver_name: "{{ synapse_server_name }}" diff --git a/roles/synapse/templates/appservice-registration.yaml.j2 b/roles/synapse/templates/appservice-registration.yaml.j2 new file mode 100644 index 0000000..3344102 --- /dev/null +++ b/roles/synapse/templates/appservice-registration.yaml.j2 @@ -0,0 +1,21 @@ +--- +# vim:ft=yaml +# {{ ansible_managed }} +{% set id = item.destination.split('/')[-1].split('-')[0] %} +{% set appservice = synapse_appservices | selectattr('id', 'equalto', id) | first %} + +id: {{ id }} +url: http://{{ appservice.host }}:8080 +as_token: {{ appservice.as_token }} +hs_token: {{ appservice.hs_token }} +sender_localpart: {{ id }}senderlocalpart +rate_limited: false +namespaces: + users: + - regex: ^@{{ id }}bot:{{ synapse_server_name | replace('.', '\.') }}$ + exclusive: true + - regex: ^@{{ id }}_.*:{{ synapse_server_name | replace('.', '\.') }}$ + exclusive: true +de.sorunome.msc2409.push_ephemeral: true +receive_ephemeral: true +io.element.msc4190: true diff --git a/roles/synapse/templates/doublepuppet-registration.yaml.j2 b/roles/synapse/templates/doublepuppet-registration.yaml.j2 new file mode 100644 index 0000000..6eeeffd --- /dev/null +++ b/roles/synapse/templates/doublepuppet-registration.yaml.j2 @@ -0,0 +1,15 @@ +--- +# vim:ft=yaml +# {{ ansible_managed }} + +id: doublepuppet +url: +as_token: "{{ synapse_doublepuppet_token }}" +hs_token: doublepuppethstoken +sender_localpart: doublepuppetsenderlocalpart +rate_limited: false + +namespaces: + users: + - regex: '@.*:{{ synapse_server_name | replace(".", "\.") }}' + exclusive: false diff --git a/roles/synapse/templates/homeserver.yaml.j2 b/roles/synapse/templates/homeserver.yaml.j2 index 51b0e5b..8a29af5 100644 --- a/roles/synapse/templates/homeserver.yaml.j2 +++ b/roles/synapse/templates/homeserver.yaml.j2 @@ -81,7 +81,7 @@ url_preview_ip_range_blacklist: turn_uris: {{ synapse_turn_uris }} {% if synapse_turn_uris | length > 0 %} -turn_shared_secret: {{ synapse_turn_shared_secret }} +turn_shared_secret_file: /run/secrets/turn-shared-secret {% endif %} turn_user_lifetime: 1d turn_allow_guests: false @@ -109,4 +109,10 @@ autocreate_auto_join_rooms: false matrix_authentication_service: enabled: true endpoint: http://matrix-authentication-service:8080/ - secret: "{{ service_podman_secrets['synapse-mas-homeserver-secret'] }}" + secret_path: /run/secrets/mas-homeserver-secret + +{% if synapse_appservices | length > 0 %} +app_service_config_files: + - {{ _synapse_doublepuppet_registration_mount.destination }} + {{ _synapse_appservice_registration_mounts | map(attribute='destination') | to_nice_yaml | indent(2) }} +{% endif %} diff --git a/roles/synapse/vars/main.yaml b/roles/synapse/vars/main.yaml index 0f4511d..e488bfc 100644 --- a/roles/synapse/vars/main.yaml +++ b/roles/synapse/vars/main.yaml @@ -1,2 +1,59 @@ --- -_synapse_image_name: ghcr.io/element-hq/synapse:latest +_synapse_additional_networks: >- + {{ + ['synapse-mas'] + + ( + synapse_appservices + | map(attribute='host') + | map('regex_replace', '^', 'synapse-') + ) + }} + +_synapse_main_secrets: + - name: signing-key + value: "{{ synapse_signing_key }}" + - name: mas-client-secret + - name: mas-homeserver-secret +_synapse_turn_secrets: + - name: turn-shared-secret + value: "{{ synapse_turn_shared_secret }}" +_synapse_secrets: >- + {{ + _synapse_main_secrets + + (_synapse_turn_secrets if synapse_turn_uris | length > 0 else []) + }} + +_synapse_base_mounts: + - type: template + source: homeserver.yaml.j2 + destination: /data/homeserver.yaml + template_validate_command: python -m synapse.config -c /data/homeserver.yaml --no-secrets-in-config + - type: template + source: log.yaml.j2 + destination: /data/log.yaml + - type: volume + source: media + destination: /data/media + user: "991" + group: "991" +_synapse_doublepuppet_registration_mount: + type: template + source: doublepuppet-registration.yaml.j2 + destination: /data/doublepuppet-registration.yaml +_synapse_appservice_registration_mounts: >- + {{ + ([{'type': 'template', 'source': 'appservice-registration.yaml.j2'}] * synapse_appservices | length) + | zip( + synapse_appservices + | map(attribute='id') + | map('regex_replace', '^', '/data/appservices/') + | map('regex_replace', '$', '-registration.yaml') + | map('community.general.dict_kv', 'destination') + ) | map('combine') + }} +_synapse_mounts: >- + {{ + _synapse_base_mounts + + ([_synapse_doublepuppet_registration_mount] if synapse_appservices | length > 0 else []) + + _synapse_appservice_registration_mounts + }}