synapse: Add support for appservices and use secrets better

roles/synapse/defaults/main.yaml

@@ -19,3 +19,5 @@ synapse_auto_join_rooms: []
 
 synapse_smtp_server: ""
 synapse_oidc_provider_client_id: ""
+
+synapse_appservices: []

roles/synapse/meta/argument_specs.yaml

@@ -116,3 +116,29 @@ argument_specs:
         type: str
         required: false
         default: 16-alpine
+
+      synapse_appservices:
+        description: List of appservices to run with synapse. They will be installed in separate containers.
+        type: list
+        required: false
+        default: []
+        elements: dict
+        options:
+          id:
+            description: A unique, user-defined ID of the application service which will never change
+            type: str
+            required: true
+          host:
+            description: Hostname the appservice is accessible to synapse at
+            type: str
+            required: true
+          as_token:
+            description: A secret token that the application service will use to authenticate requests to the homeserver
+            type: str
+            required: true
+          hs_token:
+            description: A secret token that the homeserver will use authenticate requests to the application service
+            type: str
+            required: true
+      synapse_doublepuppet_token:
+        description: Double puppeting token for appservices. Required if synapse_appservices is not empty.

roles/synapse/tasks/main.yaml

@@ -15,26 +15,11 @@
     name: service
   vars:
     service_name: synapse
-    service_container_image: "{{ _synapse_image_name }}"
+    service_container_image: ghcr.io/element-hq/synapse:latest
     service_database_type: postgres
     service_postgres_tag: "{{ synapse_postgres_tag }}"
-    service_container_mounts:
-      - type: template
-        source: homeserver.yaml.j2
-        destination: /data/homeserver.yaml
-      - type: template
-        source: log.yaml.j2
-        destination: /data/log.yaml
-      - type: volume
-        source: media
-        destination: /data/media
-        user: "991"
-        group: "991"
-    service_container_secrets:
-      - name: signing-key
-        value: "{{ synapse_signing_key }}"
-      - name: mas-client-secret
-      - name: mas-homeserver-secret
+    service_container_mounts: "{{ _synapse_mounts }}"
+    service_container_secrets: "{{ _synapse_secrets }}"
     service_container_env:
       SYNAPSE_SERVER_NAME: "{{ synapse_server_name }}"
       SYNAPSE_REPORT_STATS: "no"
@@ -47,13 +32,14 @@
         proxy_target_socket: /run/matrix-authentication-service-caddy-socket-proxy.sock
     service_wants:
       - matrix-authentication-service.service
+    service_container_additional_networks: "{{ _synapse_additional_networks }}"
 
 - name: Matrix authentication service for synapse
   ansible.builtin.import_role:
     name: matrix_authentication_service
   vars:
     matrix_authentication_service_additional_networks:
-      - synapse
+      - synapse-mas
     matrix_authentication_service_secrets: "{{ synapse_mas_secrets }}"
     matrix_authentication_service_domain: "{{ synapse_mas_domain }}"
     matrix_authentication_service_homeserver_name: "{{ synapse_server_name }}"

roles/synapse/templates/appservice-registration.yaml.j2

@@ -0,0 +1,21 @@
+---
+# vim:ft=yaml
+# {{ ansible_managed }}
+{% set id = item.destination.split('/')[-1].split('-')[0] %}
+{% set appservice = synapse_appservices | selectattr('id', 'equalto', id) | first %}
+
+id: {{ id }}
+url: http://{{ appservice.host }}:8080
+as_token: {{ appservice.as_token }}
+hs_token: {{ appservice.hs_token }}
+sender_localpart: {{ id }}senderlocalpart
+rate_limited: false
+namespaces:
+    users:
+        - regex: ^@{{ id }}bot:{{ synapse_server_name | replace('.', '\.') }}$
+          exclusive: true
+        - regex: ^@{{ id }}_.*:{{ synapse_server_name | replace('.', '\.') }}$
+          exclusive: true
+de.sorunome.msc2409.push_ephemeral: true
+receive_ephemeral: true
+io.element.msc4190: true

roles/synapse/templates/doublepuppet-registration.yaml.j2

@@ -0,0 +1,15 @@
+---
+# vim:ft=yaml
+# {{ ansible_managed }}
+
+id: doublepuppet
+url:
+as_token: "{{ synapse_doublepuppet_token }}"
+hs_token: doublepuppethstoken
+sender_localpart: doublepuppetsenderlocalpart
+rate_limited: false
+
+namespaces:
+  users:
+    - regex: '@.*:{{ synapse_server_name | replace(".", "\.") }}'
+      exclusive: false

roles/synapse/templates/homeserver.yaml.j2

@@ -81,7 +81,7 @@ url_preview_ip_range_blacklist:
 
 turn_uris: {{ synapse_turn_uris }}
 {% if synapse_turn_uris | length > 0 %}
-turn_shared_secret: {{ synapse_turn_shared_secret }}
+turn_shared_secret_file: /run/secrets/turn-shared-secret
 {% endif %}
 turn_user_lifetime: 1d
 turn_allow_guests: false
@@ -109,4 +109,10 @@ autocreate_auto_join_rooms: false
 matrix_authentication_service:
   enabled: true
   endpoint: http://matrix-authentication-service:8080/
-  secret: "{{ service_podman_secrets['synapse-mas-homeserver-secret'] }}"
+  secret_path: /run/secrets/mas-homeserver-secret
+
+{% if synapse_appservices | length > 0 %}
+app_service_config_files:
+  - {{ _synapse_doublepuppet_registration_mount.destination }}
+  {{ _synapse_appservice_registration_mounts | map(attribute='destination') | to_nice_yaml | indent(2) }}
+{% endif %}

roles/synapse/vars/main.yaml

@@ -1,2 +1,59 @@
 ---
-_synapse_image_name: ghcr.io/element-hq/synapse:latest
+_synapse_additional_networks: >-
+  {{
+    ['synapse-mas']
+    + (
+      synapse_appservices
+      | map(attribute='host')
+      | map('regex_replace', '^', 'synapse-')
+    )
+  }}
+
+_synapse_main_secrets:
+  - name: signing-key
+    value: "{{ synapse_signing_key }}"
+  - name: mas-client-secret
+  - name: mas-homeserver-secret
+_synapse_turn_secrets:
+  - name: turn-shared-secret
+    value: "{{ synapse_turn_shared_secret }}"
+_synapse_secrets: >-
+  {{
+    _synapse_main_secrets
+    + (_synapse_turn_secrets if synapse_turn_uris | length > 0 else [])
+  }}
+
+_synapse_base_mounts:
+  - type: template
+    source: homeserver.yaml.j2
+    destination: /data/homeserver.yaml
+    template_validate_command: python -m synapse.config -c /data/homeserver.yaml --no-secrets-in-config
+  - type: template
+    source: log.yaml.j2
+    destination: /data/log.yaml
+  - type: volume
+    source: media
+    destination: /data/media
+    user: "991"
+    group: "991"
+_synapse_doublepuppet_registration_mount:
+  type: template
+  source: doublepuppet-registration.yaml.j2
+  destination: /data/doublepuppet-registration.yaml
+_synapse_appservice_registration_mounts: >-
+  {{
+    ([{'type': 'template', 'source': 'appservice-registration.yaml.j2'}] * synapse_appservices | length)
+    | zip(
+      synapse_appservices
+      | map(attribute='id')
+      | map('regex_replace', '^', '/data/appservices/')
+      | map('regex_replace', '$', '-registration.yaml')
+      | map('community.general.dict_kv', 'destination')
+    ) | map('combine')
+  }}
+_synapse_mounts: >-
+  {{
+    _synapse_base_mounts
+    + ([_synapse_doublepuppet_registration_mount] if synapse_appservices | length > 0 else [])
+    + _synapse_appservice_registration_mounts
+  }}