v0.1.5

galaxy.yml

@@ -3,7 +3,7 @@ namespace: uumas
 name: podman
 description: Roles for installing services in podman containers
 readme: README.md
-version: 0.1.1
+version: 0.1.5
 repository: "https://git.uumas.fi/uumas/ansible-podman"
 license_file: LICENSE
 authors:

roles/container/tasks/main.yaml

@@ -16,7 +16,9 @@
     network_name: "{{ network.name }}"
     network_subnet: "{{ _container_network_subnet }}"
     network_range: "{{ _container_network_range }}"
-  when: network_created_networks is not defined or network.name not in network_created_networks
+  when:
+    - "'.' not in network.name"
+    - network_created_networks is not defined or network.name not in network_created_networks
   loop: "{{ container_networks }}"
   loop_control:
     loop_var: network

roles/container/vars/main/network.yaml

@@ -3,7 +3,7 @@ _container_networks: >-
   {{
     container_networks
     | map(attribute='name')
-    | map('regex_replace', '$', '.network')
+    | map('regex_replace', '^(?!.*\.)(.*)$', '\1.network')
     | zip(container_networks | map(attribute='ip', default=''))
     | map('reject', 'equalto', '')
     | map('join', ':ip=')

roles/euro_office/README.md

@@ -0,0 +1 @@
+Sets up a Euro Office podman container.

roles/euro_office/meta/argument_specs.yaml

@@ -0,0 +1,14 @@
+---
+argument_specs:
+  main:
+    description: Sets up a Euro Office podman container.
+    options:
+      euro_office_domains:
+        description: A list of domains the container should listen on.
+        type: list
+        required: true
+        elements: str
+      euro_office_jwt_secret:
+        description: JWT secret, must be at least 32 characters long
+        type: str
+        required: true

roles/euro_office/tasks/main.yaml

@@ -0,0 +1,34 @@
+---
+- name: Euro-Office service
+  ansible.builtin.import_role:
+    name: service
+  vars:
+    service_name: euro-office
+    service_container_image: ghcr.io/euro-office/documentserver:latest
+    service_container_mounts:
+      - type: volume
+        source: data
+        destination: /var/lib/euro-office/documentserver
+      - type: volume
+        source: private
+        destination: /var/www/euro-office/Data
+      - type: copy
+        source: fonts/
+        destination: /usr/share/fonts/custom
+    service_container_http_port: 80
+    service_domains: "{{ euro_office_domains }}"
+    service_database_type: postgres
+    service_database_secret_type: env
+    service_database_secret_target: DB_PWD
+    service_redis: true
+    service_container_secrets:
+      - name: jwt
+        type: env
+        target: JWT_SECRET
+        value: "{{ euro_office_jwt_secret }}"
+    service_container_env:
+      DB_HOST: postgres
+      DB_USER: euro_office
+      DB_NAME: euro_office
+      DB_PASSWORD__FILE: /run/secrets/postgres
+      REDIS_SERVER_HOST: redis

roles/mautrix_whatsapp/README.md

@@ -0,0 +1 @@
+Sets up a mautrix-whatsapp bridge

roles/mautrix_whatsapp/defaults/main.yaml

@@ -0,0 +1,5 @@
+---
+mautrix_whatsapp_os_name: Matrix bridge
+mautrix_whatsapp_bot_displayname: WhatsApp bridge
+mautrix_whatsapp_default_relays: []
+mautrix_whatsapp_permissions: {}

roles/mautrix_whatsapp/meta/argument_specs.yaml

@@ -0,0 +1,57 @@
+---
+argument_specs:
+  main:
+    description:
+      - Sets up a mautrix-whatsapp bridge
+    options:
+      mautrix_whatsapp_homeserver_name:
+        description: Matrix server name of homeserver the bridge is connected to.
+        type: str
+        required: true
+      mautrix_whatsapp_as_token:
+        description: A secret token that the application service will use to authenticate requests to the homeserver
+        type: str
+        required: true
+      mautrix_whatsapp_hs_token:
+        description: A secret token that the homeserver will use authenticate requests to the application service
+        type: str
+        required: true
+      mautrix_whatsapp_doublepuppet_token:
+        description: Double puppeting as token to impersonate matrix users
+        type: str
+        required: true
+      mautrix_whatsapp_os_name:
+        description: Device name that's shown in the "WhatsApp Web" section in the mobile app
+        type: str
+        required: false
+        default: Matrix bridge
+      mautrix_whatsapp_bot_displayname:
+        description: Display name for the bridge bot
+        type: str
+        required: false
+        default: WhatsApp bridge
+      mautrix_whatsapp_default_relays:
+        description: List of user login IDs which anyone can set as a relay, as long as the relay user is in the room
+        type: list
+        required: false
+        default: []
+        elements: str
+      mautrix_whatsapp_permissions:
+        description: Permissions for using the bridge. All users are given the relay permission regardless of this.
+        type: list
+        required: false
+        default: []
+        elements: dict
+        options:
+          key:
+            description: Domain or user id to apply permission value to
+            type: str
+            required: true
+          value:
+            description: Permission value to apply
+            type: str
+            required: true
+            choices:
+              - commands
+              - user
+              - admin

roles/mautrix_whatsapp/tasks/main.yaml

@@ -0,0 +1,32 @@
+---
+- name: Mautrix-WhatsApp container
+  ansible.builtin.import_role:
+    name: service
+  vars:
+    service_name: mautrix-whatsapp
+    service_container_image: "{{ _mautrix_whatsapp_image }}"
+    service_container_user: 1337:1337
+    service_container_command:
+      - /usr/bin/mautrix-whatsapp
+      - --no-update
+    service_database_type: postgres
+    service_container_additional_networks:
+      - synapse-mautrix-whatsapp
+    service_container_mounts:
+      - type: template
+        source: config.yaml.j2
+        destination: /data/config.yaml
+    service_container_secrets:
+      - name: as-token
+        value: "{{ mautrix_whatsapp_as_token }}"
+      - name: hs-token
+        value: "{{ mautrix_whatsapp_hs_token }}"
+      - name: doublepuppet-token
+        value: as_token:{{ mautrix_whatsapp_doublepuppet_token }}
+      - name: encryption-pickle-key
+    service_container_env:
+      BRIDGE_DATABASE__URI_FILE: /run/secrets/postgres-url
+      BRIDGE_APPSERVICE__AS_TOKEN_FILE: /run/secrets/as-token
+      BRIDGE_APPSERVICE__HS_TOKEN_FILE: /run/secrets/hs-token
+      BRIDGE_ENCRYPTION__PICKLE_KEY: /run/secrets/encryption-pickle-key
+      "BRIDGE_DOUBLE_PUPPET__SECRETS__{{ mautrix_whatsapp_homeserver_name }}": /run/secrets/doublepuppet-token

roles/mautrix_whatsapp/templates/config.yaml.j2

@@ -0,0 +1,73 @@
+---
+# vim:ft=yaml
+# {{ ansible_managed }}
+
+network:
+  os_name: "{{ mautrix_whatsapp_os_name }}"
+  
+  send_presence_on_typing: true
+  url_previews: true
+  extev_polls: true
+
+bridge:
+  cleanup_on_logout:
+    enabled: true
+    manual:
+      private: nothing
+      relayed: nothing
+      shared_no_users: kick
+      shared_has_users: kick
+    bad_credentials:
+      private: nothing
+      relayed: nothing
+      shared_no_users: kick
+      shared_has_users: kick
+
+  relay:
+    enabled: true
+    admin_only: true
+    default_relays:
+      {{ mautrix_whatsapp_default_relays | to_nice_yaml | indent(4) }}
+  permissions:
+    "*": relay
+{% for item in mautrix_whatsapp_permissions %}
+    "{{ item.key }}": {{ item.value }}
+{% endfor %}
+
+database:
+  type: postgres
+    
+homeserver:
+  address: http://synapse:8009
+  domain: {{ mautrix_whatsapp_homeserver_name }}
+  async_media: true
+
+appservice:
+  address: http://mautrix-whatsapp:8080
+  hostname: 0.0.0.0
+  port: 8080
+  id: whatsapp
+  bot:
+    username: whatsappbot
+    displayname: {{ mautrix_whatsapp_bot_displayname }}
+
+matrix:
+  delivery_receipts: true
+
+provisioning:
+  shared_secret: disable
+
+encryption:
+  allow: true
+  default: false
+  msc4190: true
+
+  allow_key_sharing: true
+
+env_config_prefix: BRIDGE_
+
+logging:
+    min_level: info
+    writers:
+      - type: stdout
+        format: pretty-colored

roles/mautrix_whatsapp/vars/main.yaml

@@ -0,0 +1,2 @@
+---
+_mautrix_whatsapp_image: dock.mau.dev/mautrix/whatsapp:latest

roles/nextcloud/handlers/main.yaml

@@ -2,6 +2,7 @@
 - name: Unregister AppAPI daemon
   containers.podman.podman_container_exec:
     name: nextcloud
+    user: www-data
     argv:
       - /var/www/html/occ
       - app_api:daemon:unregister
@@ -14,6 +15,7 @@
 - name: Register AppAPI daemon
   containers.podman.podman_container_exec:
     name: nextcloud
+    user: www-data
     argv:
       - /bin/sh
       - -c

roles/service/defaults/main.yaml

@@ -28,6 +28,9 @@ service_database_secret_target: "{{ service_database_type }}"
 service_postgres_image: docker.io/pgautoupgrade/pgautoupgrade
 service_postgres_tag: alpine
 service_redis: false
+service_tailscale: false
+service_tailscale_login_server: ""
+service_tailscale_apikey: ""
 
 service_additional_containers: []
 

roles/service/meta/argument_specs.yaml

@@ -163,7 +163,7 @@ argument_specs:
               - Mount source.
               - If mount type is volume, name of the volume.
               - If mount type is bind, host path to bind mount inside the container.
-              - If mount type is template, the name of the template file, must end in .j2
+              - If mount type is template, the name of the template file, must end in .j2.
               - If mount type is copy, name of the file or directory to copy. Directory name must end in /.
             type: str
             required: true
@@ -220,9 +220,18 @@ argument_specs:
               Command used to verify templated file validity.
               Will be run in a temporary container using the same container image as the main service.
               File will be available in the same place as in the service container (destination).
-              Only applicable if mount type is template
+              Only applicable if mount type is template.
             type: str
             required: false
+          template_directory:
+            description: >-
+              Whether to create a directory and mount it at the destination file's parent directory.
+              This is required for container to see templated file changes without restart.
+              Only applicable if mount type is template.
+            type: bool
+            required: false
+            default: false
+
       service_container_devices:
         description: List of devices to be added inside the service main container.
         type: list
@@ -326,6 +335,7 @@ argument_specs:
             host <service database type> on the default port.
           - The database user will be <service name>
           - The password will be accessible as secret at /run/secrets/<service database type>
+          - A postgres url is accessible as secret at /run/secrets/postgres-url
           - >
             The password will also be available as the
             service_podman_secrets['<service name>-<service database type>'] variable.
@@ -377,6 +387,23 @@ argument_specs:
         type: bool
         required: false
         default: false
+      service_tailscale:
+        description: >-
+          Whether to install tailscale in a container and have the service container use its
+          network. This will make the container accessible over tailscale.
+        type: bool
+        required: false
+        default: false
+      service_tailscale_login_server:
+        description: Tailscale login server. Required if tailscale is enabled.
+        type: str
+        required: false
+        default: ""
+      service_tailscale_apikey:
+        description: Tailscale API key. Required if tailscale is enabled.
+        type: str
+        required: false
+        default: ""
 
       service_additional_containers:
         description:
@@ -592,6 +619,13 @@ argument_specs:
             type: str
             required: false
             default: ""
+          tailscale:
+            description: >-
+              Whether to install tailscale in a container and this container use its
+              network. This will make the container accessible over tailscale.
+            type: bool
+            required: false
+            default: false
           secrets:
             description:
               - >

roles/service/tasks/additional.yaml

@@ -1,5 +1,5 @@
 ---
-- name: Additional containers for {{ service_name }}
+- name: Additional container {{ _service_additional_container.name }}
   ansible.builtin.include_role:
     name: container
   vars:
@@ -11,7 +11,11 @@
     container_mounts: "{{ _service_additional_container_mounts }}"
     container_devices: "{{ _service_additional_container.devices }}"
     container_publish_ports: "{{ _service_additional_container_publish_ports }}"
-    container_networks: "{{ _service_additional_container_networks }}"
+    container_networks: >-
+      {{
+        _service_additional_container_networks if not _service_additional_container.tailscale
+        else [{'name': _service_additional_container.name ~ '-tailscale.container'}]
+      }}
     container_hostname: "{{ _service_additional_container.name | regex_replace('^' ~ service_name ~ '-', '') }}"
     container_secrets: "{{ _service_additional_container_secrets }}"
     container_env: "{{ _service_additional_container.env }}"
@@ -21,13 +25,23 @@
     container_requires: "{{ _service_additional_container_requires }}"
     container_wants: "{{ _service_additional_container_wants }}"
     container_auto_update: "{{ service_auto_update }}"
-  loop: "{{ _service_additional_containers }}"
-  loop_control:
-    loop_var: _service_additional_container
-    index_var: _service_additional_container_index
 
-- name: Socat sockets for additional containers of {{ service_name }}
-  ansible.builtin.include_tasks: additional_socat.yaml
-  loop: "{{ _service_additional_containers }}"
+- name: Socat for socket published ports of {{ _service_additional_container.name }}
+  ansible.builtin.include_role:
+    name: socat
+  loop: "{{  _service_additional_container_publish_socket_ports }}"
   loop_control:
-    loop_var: _service_additional_container
+    loop_var: publish_port
+  vars:
+    socat_service_name: "{{ service_name }}-{{ publish_port.name }}"
+    socat_target_container: "{{ _service_additional_container.name }}"
+    socat_target_http_port: "{{ publish_port.container_port }}"
+    socat_auto_update: "{{ service_auto_update }}"
+
+- name: Tailscale for {{ _service_additional_container.name }}
+  ansible.builtin.include_tasks: tailscale.yaml
+  when: _service_additional_container.tailscale
+  vars:
+    _service_tailscale_container_name: "{{ _service_additional_container.name }}"
+    _service_tailscale_networks: "{{ _service_additional_container_networks }}"
+    _service_tailscale_hostname: "{{ _service_additional_container.name | regex_replace('^' ~ service_name ~ '-', '') }}"

roles/service/tasks/additional_socat.yaml

@@ -1,12 +0,0 @@
----
-- name: Socat for socket published ports of {{ service_name }}
-  ansible.builtin.include_role:
-    name: socat
-  loop: "{{  _service_additional_container_publish_socket_ports }}"
-  loop_control:
-    loop_var: publish_port
-  vars:
-    socat_service_name: "{{ service_name }}-{{ publish_port.name }}"
-    socat_target_container: "{{ _service_additional_container.name }}"
-    socat_target_http_port: "{{ publish_port.container_port }}"
-    socat_auto_update: "{{ service_auto_update }}"

roles/service/tasks/host_mounts.yaml

@@ -13,28 +13,29 @@
 
 - name: Create service template mount directories
   ansible.builtin.file:
-    path: "{{ _service_host_directory }}/mounts/{{ item }}"
+    path: "{{ item }}"
     state: directory
     mode: "0700"
-  loop: "{{ _service_all_template_mount_directories }}"
+  loop: "{{ _service_all_template_mount_host_files | map('dirname') | unique }}"
 
 - name: Template files for template mounts
   ansible.builtin.template:
-    src: "{{ item[0].source }}"
-    dest: "{{ item[1] }}"
-    mode: "{{ item[0].mode | default('0644') }}"
-    validate: "{{ validate if item[0].template_validate_command is defined else omit }}"
+    src: "{{ item.source }}"
+    dest: "{{ item.hostfile }}"
+    mode: "{{ item.mode | default('0644') }}"
+    validate: "{{ validate if item.template_validate_command is defined else omit }}"
   notify: >-
     {{ 'Reload' if service_container_reload_method != 'none' else 'Restart' }}
     container service {{ service_name }}
-  loop: "{{ _service_all_template_mounts | zip(_service_all_template_mount_host_files) }}"
+  loop: "{{ _service_all_template_mounts_full }}"
   vars:
-    validate: >-
-      podman run --rm
-      -v %s:{{ item[0].destination }}:ro
-      --entrypoint {{ item[0].template_validate_command.split(' ', 1)[0] }}
-      {{ service_container_image }}
-      {{ item[0].template_validate_command.split(' ', 1)[1] }}
+    validate: "{{ _service_template_validate_command }}"
+
+- name: Ensure no legacy templated files present
+  ansible.builtin.file:
+    path: "{{ _service_host_directory }}/mounts/{{ item.source | regex_replace('\\.j2$', '') }}"
+    state: absent
+  loop: "{{ _service_all_template_mounts_full }}"
 
 - name: Copy files for copy mounts
   ansible.builtin.copy:

roles/service/tasks/main.yaml

@@ -5,14 +5,21 @@
 - name: Database for {{ service_name }}
   ansible.builtin.include_tasks: database.yaml
   when: _service_setup_database
-
 - name: Redis for {{ service_name }}
   ansible.builtin.include_tasks: redis.yaml
   when: service_redis
 
 - name: Secrets for {{ service_name }}
   ansible.builtin.include_tasks: secrets.yaml
-  when: _service_container_secrets | length > 0
+  when: _service_container_secrets | length > 0 or service_tailscale
+
+- name: Tailscale for {{ service_name }}
+  ansible.builtin.include_tasks: tailscale.yaml
+  when: service_tailscale
+  vars:
+    _service_tailscale_container_name: "{{ service_name }}"
+    _service_tailscale_networks: "{{ _service_networks }}"
+    _service_tailscale_hostname: "{{ service_name }}"
 
 - name: Template mounts for {{ service_name }}
   ansible.builtin.include_tasks: host_mounts.yaml
@@ -20,7 +27,10 @@
 
 - name: Additional containers for {{ service_name }}
   ansible.builtin.include_tasks: additional.yaml
-  when: _service_additional_containers | length > 0
+  loop: "{{ _service_additional_containers }}"
+  loop_control:
+    loop_var: _service_additional_container
+    index_var: _service_additional_container_index
 
 - name: Native socket for {{ service_name }}
   ansible.builtin.include_role:

roles/service/tasks/tailscale.yaml

@@ -0,0 +1,60 @@
+---
+- name: Create tailscale preauthkey secret for {{ _service_tailscale_container_name }}
+  when:
+    - not ansible_check_mode
+    - "_service_tailscale_container_name ~ '-tailscale-preauthkey' not in service_podman_secrets"
+  block:
+    - name: Get preauthkey from tailscale API
+      ansible.builtin.uri:
+        url: "{{ service_tailscale_login_server }}/api/v1/preauthkey"
+        headers:
+          Authorization: Bearer {{ service_tailscale_apikey }}
+        method: POST
+        body:
+          expiration: >-
+            {{
+              now(utc=true).replace(
+                day=now(utc=true).day if now(utc=true).hour != 23 else now(utc=true).day + 1,
+                hour=now(utc=true).hour + 1 if now(utc=true).hour != 23 else 0
+              ).isoformat()
+            }}Z
+          aclTags:
+            - tag:container
+            - "tag:{{ _service_tailscale_container_name }}"
+        body_format: json
+      register: _service_tailscale_preauthkey
+    - name: Create preauthkey secret
+      containers.podman.podman_secret:
+        name: "{{ _service_tailscale_container_name }}-tailscale-preauthkey"
+        data: "{{ _service_tailscale_preauthkey.json.preAuthKey.key }}"
+      no_log: true
+
+- name: Tailscale container for {{ _service_tailscale_container_name }}
+  ansible.builtin.import_role:
+    name: container
+  vars:
+    container_name: "{{ _service_tailscale_container_name }}-tailscale"
+    container_image: docker.io/tailscale/tailscale:latest
+    container_networks: "{{ _service_tailscale_networks }}"
+    container_hostname: "{{ _service_tailscale_hostname }}"
+    container_add_capabilities:
+      - NET_ADMIN
+    container_devices:
+      - source: /dev/net/tun
+    container_mounts:
+      - type: volume
+        source: "{{ _service_tailscale_container_name }}-tailscale"
+        destination: /var/lib/tailscale
+    container_auto_update: "{{ service_auto_update }}"
+    container_secrets:
+      - name: "{{ _service_tailscale_container_name }}-tailscale-preauthkey"
+        target: preauthkey
+    container_env:
+      TS_STATE_DIR: /var/lib/tailscale
+      TS_AUTHKEY: file:/run/secrets/preauthkey
+      TS_EXTRA_ARGS: --login-server={{ service_tailscale_login_server }}
+      TS_HOSTNAME: "{{ _service_tailscale_container_name }}"
+      TS_AUTH_ONCE: "true"
+      TS_NO_LOGS_NO_SUPPORT: "true"
+      TS_USERSPACE: "false"
+      TS_ACCEPT_DNS: "true"

roles/service/vars/main/additional.yaml

@@ -1,6 +1,7 @@
 ---
 _service_additional_container_defaults:
   image: "{{ service_container_image }}"
+  tailscale: false
   requires: []
   wants: []
 

roles/service/vars/main/general.yaml

@@ -1,5 +1,5 @@
 ---
-_service_container_networks: >-
+_service_networks: >-
   {{
     [{
       'name': service_name,
@@ -21,6 +21,10 @@ _service_container_networks: >-
       )
     ) | map('community.general.dict_kv', 'name')
   }}
+_service_container_networks: >-
+  {{
+    [{'name': service_name ~ '-tailscale.container'}] if service_tailscale else _service_networks
+  }}
 _service_static_ip: "{{ service_container_ip | length > 0 }}"
 
 _service_container_requires: >-

roles/service/vars/main/mounts.yaml

@@ -25,21 +25,60 @@ _service_container_bind_mounts: >-
     service_container_mounts | selectattr('type', '==', 'bind') +
     ([ _service_container_socket_mount ] if _service_native_socket else [])
   }}
-_service_container_template_mounts: >-
+
+_service_template_mounts_hostfiles: >-
   {{
-    ([{'readonly': true}] * _service_template_mounts | length) |
-    zip(
-      _service_template_mounts |
-        community.general.remove_keys(['mode', 'template_validate_command']),
-      _service_template_mounts |
-        map(attribute='source') |
-        map('regex_replace', '\.j2$', '') |
-        map('regex_replace', '^', _service_host_directory ~ '/mounts/') |
-        map('community.general.dict_kv', 'source'),
-      ([{'type': 'bind'}] * _service_template_mounts | length)
+    _service_template_mounts
+    | map(attribute='destination')
+    | map('dirname')
+    | map('replace', '/', '_')
+    | map('regex_replace', '^', _service_host_directory ~ '/mounts/')
+    | zip(
+      _service_template_mounts
+      | map(attribute='destination')
+      | map('basename')
+    )
+    | map('path_join')
+    | map('community.general.dict_kv', 'hostfile')
+  }}
+_service_template_mounts_full: >-
+  {{
+    ([{'readonly': true, 'template_directory': false}] * _service_template_mounts | length)
+    | zip(
+      _service_template_mounts,
+      _service_template_mounts_hostfiles
+    )
+    | map('combine')
+  }}
+_service_template_mounts_plain: "{{ _service_template_mounts_full | rejectattr('template_directory') }}"
+_service_container_template_mounts_plain: >-
+  {{
+    _service_template_mounts_plain
+    | community.general.remove_keys(['mode', 'template_validate_command', 'template_directory', 'hostfile'])
+    | zip(
+      _service_template_mounts_plain
+      | map(attribute='hostfile')
+      | map('community.general.dict_kv', 'source'),
+      ([{'type': 'bind'}] * _service_template_mounts_plain | length)
     ) |
     map('combine')
   }}
+_service_template_mounts_directory: "{{ _service_template_mounts_full | selectattr('template_directory') }}"
+_service_container_template_mounts_directory: >-
+  {{
+    _service_template_mounts_directory
+    | community.general.remove_keys(['mode', 'template_validate_command', 'template_directory', 'hostfile'])
+    | zip(
+      _service_template_mounts_directory
+      | map(attribute='hostfile')
+      | map('dirname')
+      | map('community.general.dict_kv', 'source'),
+      ([{'type': 'bind'}] * _service_template_mounts_directory | length)
+    )
+    | map('combine')
+    | unique
+  }}
+
 _service_container_copy_mounts: >-
   {{
     ([{'readonly': true}] * _service_copy_mounts | length) |
@@ -58,40 +97,49 @@ _service_container_copy_mounts: >-
 
 _service_container_mounts: >-
   {{
-    _service_container_volume_mounts +
-    _service_container_bind_mounts +
-    _service_container_template_mounts +
-    _service_container_copy_mounts
+    _service_container_volume_mounts
+    + _service_container_bind_mounts
+    + _service_container_template_mounts_plain
+    + _service_container_template_mounts_directory
+    + _service_container_copy_mounts
   }}
 
 
 _service_all_template_mounts: >-
   {{
     (
-      _service_template_mounts +
-      (
-        _service_additional_containers |
-        map(attribute='mounts', default=[]) |
-        flatten
+      _service_template_mounts
+      + (
+        _service_additional_containers
+        | map(attribute='mounts', default=[])
+        | flatten
       )
-    ) |
-      selectattr('type', '==', 'template') |
-      unique
-  }}
-_service_all_template_mount_directories: >-
-  {{
-    _service_all_template_mounts |
-      map(attribute='source') |
-      map('dirname') |
-      unique |
-      select('!=', '')
+    )
+    | selectattr('type', '==', 'template')
+    | unique
   }}
 _service_all_template_mount_host_files: >-
   {{
-    _service_all_template_mounts |
-      map(attribute='source') |
-      map('regex_replace', '\.j2$', '') |
-      map('regex_replace', '^', _service_host_directory ~ '/mounts/')
+    _service_all_template_mounts
+    | map(attribute='destination')
+    | map('dirname')
+    | map('replace', '/', '_')
+    | map('regex_replace', '^', _service_host_directory ~ '/mounts/')
+    | zip(
+      _service_all_template_mounts
+      | map(attribute='destination')
+      | map('basename')
+    )
+    | map('path_join')
+  }}
+_service_all_template_mounts_full: >-
+  {{
+    ([{'readonly': true, 'template_directory': false}] * _service_all_template_mounts | length)
+    | zip(
+      _service_all_template_mounts,
+      _service_all_template_mount_host_files | map('community.general.dict_kv', 'hostfile')
+    )
+    | map('combine')
   }}
 
 _service_all_copy_mounts: >-
@@ -109,7 +157,7 @@ _service_all_copy_mounts: >-
   }}
 _service_all_copy_mount_host_files: >-
   {{
-    _service_all_copy_mounts |
-      map(attribute='source') |
-      map('regex_replace', '^', _service_host_directory ~ '/mounts/')
+    _service_all_copy_mounts
+    | map(attribute='source')
+    | map('regex_replace', '^', _service_host_directory ~ '/mounts/')
   }}

roles/service/vars/main/template_validate.yaml

@@ -0,0 +1,24 @@
+---
+_service_template_validate_secrets: >-
+  {{
+    _service_container_secrets
+    | map(attribute='name')
+    | zip(
+      _service_container_secrets
+      | community.general.remove_keys(['name', 'value', 'length'])
+      | map('items')
+      | map('map', 'join', '=')
+      | map('join', ',')
+    )
+    | map('join', ',')
+    | map('regex_replace', '^', '--secret ')
+    | join(' ')
+  }}
+
+_service_template_validate_command: >-
+  podman run --rm
+  -v %s:{{ item.destination }}:ro
+  --entrypoint {{ item.template_validate_command.split(' ', 1)[0] }}
+  {{ _service_template_validate_secrets }}
+  {{ service_container_image }}
+  {{ item.template_validate_command.split(' ', 1)[1] }}

roles/synapse/defaults/main.yaml

@@ -19,3 +19,5 @@ synapse_auto_join_rooms: []
 
 synapse_smtp_server: ""
 synapse_oidc_provider_client_id: ""
+
+synapse_appservices: []

roles/synapse/meta/argument_specs.yaml

@@ -116,3 +116,29 @@ argument_specs:
         type: str
         required: false
         default: 16-alpine
+
+      synapse_appservices:
+        description: List of appservices to run with synapse. They will be installed in separate containers.
+        type: list
+        required: false
+        default: []
+        elements: dict
+        options:
+          id:
+            description: A unique, user-defined ID of the application service which will never change
+            type: str
+            required: true
+          host:
+            description: Hostname the appservice is accessible to synapse at
+            type: str
+            required: true
+          as_token:
+            description: A secret token that the application service will use to authenticate requests to the homeserver
+            type: str
+            required: true
+          hs_token:
+            description: A secret token that the homeserver will use authenticate requests to the application service
+            type: str
+            required: true
+      synapse_doublepuppet_token:
+        description: Double puppeting token for appservices. Required if synapse_appservices is not empty.

roles/synapse/tasks/main.yaml

@@ -15,26 +15,11 @@
     name: service
   vars:
     service_name: synapse
-    service_container_image: "{{ _synapse_image_name }}"
+    service_container_image: ghcr.io/element-hq/synapse:latest
     service_database_type: postgres
     service_postgres_tag: "{{ synapse_postgres_tag }}"
-    service_container_mounts:
-      - type: template
-        source: homeserver.yaml.j2
-        destination: /data/homeserver.yaml
-      - type: template
-        source: log.yaml.j2
-        destination: /data/log.yaml
-      - type: volume
-        source: media
-        destination: /data/media
-        user: "991"
-        group: "991"
-    service_container_secrets:
-      - name: signing-key
-        value: "{{ synapse_signing_key }}"
-      - name: mas-client-secret
-      - name: mas-homeserver-secret
+    service_container_mounts: "{{ _synapse_mounts }}"
+    service_container_secrets: "{{ _synapse_secrets }}"
     service_container_env:
       SYNAPSE_SERVER_NAME: "{{ synapse_server_name }}"
       SYNAPSE_REPORT_STATS: "no"
@@ -47,13 +32,14 @@
         proxy_target_socket: /run/matrix-authentication-service-caddy-socket-proxy.sock
     service_wants:
       - matrix-authentication-service.service
+    service_container_additional_networks: "{{ _synapse_additional_networks }}"
 
 - name: Matrix authentication service for synapse
   ansible.builtin.import_role:
     name: matrix_authentication_service
   vars:
     matrix_authentication_service_additional_networks:
-      - synapse
+      - synapse-mas
     matrix_authentication_service_secrets: "{{ synapse_mas_secrets }}"
     matrix_authentication_service_domain: "{{ synapse_mas_domain }}"
     matrix_authentication_service_homeserver_name: "{{ synapse_server_name }}"

roles/synapse/templates/appservice-registration.yaml.j2

@@ -0,0 +1,21 @@
+---
+# vim:ft=yaml
+# {{ ansible_managed }}
+{% set id = item.destination.split('/')[-1].split('-')[0] %}
+{% set appservice = synapse_appservices | selectattr('id', 'equalto', id) | first %}
+
+id: {{ id }}
+url: http://{{ appservice.host }}:8080
+as_token: {{ appservice.as_token }}
+hs_token: {{ appservice.hs_token }}
+sender_localpart: {{ id }}senderlocalpart
+rate_limited: false
+namespaces:
+    users:
+        - regex: ^@{{ id }}bot:{{ synapse_server_name | replace('.', '\.') }}$
+          exclusive: true
+        - regex: ^@{{ id }}_.*:{{ synapse_server_name | replace('.', '\.') }}$
+          exclusive: true
+de.sorunome.msc2409.push_ephemeral: true
+receive_ephemeral: true
+io.element.msc4190: true

roles/synapse/templates/doublepuppet-registration.yaml.j2

@@ -0,0 +1,15 @@
+---
+# vim:ft=yaml
+# {{ ansible_managed }}
+
+id: doublepuppet
+url:
+as_token: "{{ synapse_doublepuppet_token }}"
+hs_token: doublepuppethstoken
+sender_localpart: doublepuppetsenderlocalpart
+rate_limited: false
+
+namespaces:
+  users:
+    - regex: '@.*:{{ synapse_server_name | replace(".", "\.") }}'
+      exclusive: false

roles/synapse/templates/homeserver.yaml.j2

@@ -81,7 +81,7 @@ url_preview_ip_range_blacklist:
 
 turn_uris: {{ synapse_turn_uris }}
 {% if synapse_turn_uris | length > 0 %}
-turn_shared_secret: {{ synapse_turn_shared_secret }}
+turn_shared_secret_file: /run/secrets/turn-shared-secret
 {% endif %}
 turn_user_lifetime: 1d
 turn_allow_guests: false
@@ -109,4 +109,10 @@ autocreate_auto_join_rooms: false
 matrix_authentication_service:
   enabled: true
   endpoint: http://matrix-authentication-service:8080/
-  secret: "{{ service_podman_secrets['synapse-mas-homeserver-secret'] }}"
+  secret_path: /run/secrets/mas-homeserver-secret
+
+{% if synapse_appservices | length > 0 %}
+app_service_config_files:
+  - {{ _synapse_doublepuppet_registration_mount.destination }}
+  {{ _synapse_appservice_registration_mounts | map(attribute='destination') | to_nice_yaml | indent(2) }}
+{% endif %}

roles/synapse/vars/main.yaml

@@ -1,2 +1,59 @@
 ---
-_synapse_image_name: ghcr.io/element-hq/synapse:latest
+_synapse_additional_networks: >-
+  {{
+    ['synapse-mas']
+    + (
+      synapse_appservices
+      | map(attribute='host')
+      | map('regex_replace', '^', 'synapse-')
+    )
+  }}
+
+_synapse_main_secrets:
+  - name: signing-key
+    value: "{{ synapse_signing_key }}"
+  - name: mas-client-secret
+  - name: mas-homeserver-secret
+_synapse_turn_secrets:
+  - name: turn-shared-secret
+    value: "{{ synapse_turn_shared_secret }}"
+_synapse_secrets: >-
+  {{
+    _synapse_main_secrets
+    + (_synapse_turn_secrets if synapse_turn_uris | length > 0 else [])
+  }}
+
+_synapse_base_mounts:
+  - type: template
+    source: homeserver.yaml.j2
+    destination: /data/homeserver.yaml
+    template_validate_command: python -m synapse.config -c /data/homeserver.yaml --no-secrets-in-config
+  - type: template
+    source: log.yaml.j2
+    destination: /data/log.yaml
+  - type: volume
+    source: media
+    destination: /data/media
+    user: "991"
+    group: "991"
+_synapse_doublepuppet_registration_mount:
+  type: template
+  source: doublepuppet-registration.yaml.j2
+  destination: /data/doublepuppet-registration.yaml
+_synapse_appservice_registration_mounts: >-
+  {{
+    ([{'type': 'template', 'source': 'appservice-registration.yaml.j2'}] * synapse_appservices | length)
+    | zip(
+      synapse_appservices
+      | map(attribute='id')
+      | map('regex_replace', '^', '/data/appservices/')
+      | map('regex_replace', '$', '-registration.yaml')
+      | map('community.general.dict_kv', 'destination')
+    ) | map('combine')
+  }}
+_synapse_mounts: >-
+  {{
+    _synapse_base_mounts
+    + ([_synapse_doublepuppet_registration_mount] if synapse_appservices | length > 0 else [])
+    + _synapse_appservice_registration_mounts
+  }}