Compare commits
31 commits
main
...
temp-20251
| Author | SHA1 | Date | |
|---|---|---|---|
|
c8d4e4756e | ||
|
|
cdeedc7ac3 | ||
|
|
b356e6c1af | ||
|
|
cbfde41f55 | ||
|
|
7c6ad2cef6 | ||
|
|
ccfcc4ab79 | ||
|
|
3ebae9194a | ||
|
|
29d3d26dfc | ||
|
|
d5ae0ac074 | ||
|
|
01a3fa5fb7 | ||
|
|
beb8bb2c51 | ||
|
|
639917512a | ||
|
|
2d7a0abd5d | ||
|
|
d9c266aafb | ||
|
|
8eed714d88 | ||
|
|
8dac3eef4f | ||
|
|
a2f22c3b70 | ||
|
|
f3b8a3c4ec | ||
|
|
1c50d0223f | ||
|
|
2da64d257f | ||
|
|
0002ae76af | ||
|
|
326296d6ce | ||
|
|
52e14d8f8d | ||
|
|
71aea3040a | ||
|
|
da1e27459f | ||
|
|
c4db57b83a | ||
|
|
4a7a75651c | ||
|
|
4a439cf375 | ||
|
|
50aa1eabaa | ||
|
|
8953d1ee99 | ||
|
|
b31e9f1e57 |
|
|
@ -1,24 +0,0 @@
|
||||||
{
|
|
||||||
"nullable": false,
|
|
||||||
"type": "object",
|
|
||||||
"properties": {
|
|
||||||
"domain": {
|
|
||||||
"nullable": false,
|
|
||||||
"type": "string"
|
|
||||||
},
|
|
||||||
"tls_mode": {
|
|
||||||
"nullable": false,
|
|
||||||
"type": "string",
|
|
||||||
"options": [
|
|
||||||
"disable",
|
|
||||||
"enable",
|
|
||||||
"force"
|
|
||||||
],
|
|
||||||
"enum": "force"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"additionalProperties": false,
|
|
||||||
"required": [
|
|
||||||
"domain"
|
|
||||||
]
|
|
||||||
}
|
|
||||||
|
|
@ -1,5 +1,4 @@
|
||||||
{
|
{
|
||||||
"cfg_authelia_and_nginx_defaults": {
|
"var_authelia_and_nginx_domain": "authelia.example.org",
|
||||||
"tls_mode": "force"
|
"var_authelia_and_nginx_tls_mode": "force"
|
||||||
}
|
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -1,11 +1,4 @@
|
||||||
[
|
[
|
||||||
{
|
|
||||||
"name": "show vars",
|
|
||||||
"when": "switch_show_vars",
|
|
||||||
"ansible.builtin.debug": {
|
|
||||||
"var": "vars.cfg_authelia_and_nginx"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
{
|
{
|
||||||
"name": "deactivate default site",
|
"name": "deactivate default site",
|
||||||
"become": true,
|
"become": true,
|
||||||
|
|
@ -19,7 +12,7 @@
|
||||||
"become": true,
|
"become": true,
|
||||||
"ansible.builtin.template": {
|
"ansible.builtin.template": {
|
||||||
"src": "conf.j2",
|
"src": "conf.j2",
|
||||||
"dest": "/etc/nginx/sites-available/{{cfg_authelia_and_nginx.domain}}"
|
"dest": "/etc/nginx/sites-available/{{var_authelia_and_nginx_domain}}"
|
||||||
}
|
}
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
|
|
@ -27,8 +20,8 @@
|
||||||
"become": true,
|
"become": true,
|
||||||
"ansible.builtin.file": {
|
"ansible.builtin.file": {
|
||||||
"state": "link",
|
"state": "link",
|
||||||
"src": "/etc/nginx/sites-available/{{cfg_authelia_and_nginx.domain}}",
|
"src": "/etc/nginx/sites-available/{{var_authelia_and_nginx_domain}}",
|
||||||
"dest": "/etc/nginx/sites-enabled/{{cfg_authelia_and_nginx.domain}}"
|
"dest": "/etc/nginx/sites-enabled/{{var_authelia_and_nginx_domain}}"
|
||||||
}
|
}
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
|
|
|
||||||
|
|
@ -45,27 +45,27 @@
|
||||||
{% endmacro %}
|
{% endmacro %}
|
||||||
|
|
||||||
server {
|
server {
|
||||||
server_name {{cfg_authelia_and_nginx.domain}};
|
server_name {{var_authelia_and_nginx_domain}};
|
||||||
|
|
||||||
listen 80;
|
listen 80;
|
||||||
listen [::]:80;
|
listen [::]:80;
|
||||||
|
|
||||||
{% if (cfg_authelia_and_nginx.tls_mode == 'force') %}
|
{% if (var_authelia_and_nginx_tls_mode == 'force') %}
|
||||||
return 301 https://$http_host$request_uri;
|
return 301 https://$http_host$request_uri;
|
||||||
{% else %}
|
{% else %}
|
||||||
{{ authelia_common() }}
|
{{ authelia_common() }}
|
||||||
{% endif %}
|
{% endif %}
|
||||||
}
|
}
|
||||||
|
|
||||||
{% if (cfg_authelia_and_nginx.tls_mode != 'disable') %}
|
{% if (var_authelia_and_nginx_tls_mode != 'disable') %}
|
||||||
server {
|
server {
|
||||||
server_name {{cfg_authelia_and_nginx.domain}};
|
server_name {{var_authelia_and_nginx_domain}};
|
||||||
|
|
||||||
listen [::]:443 ssl http2;
|
listen [::]:443 ssl http2;
|
||||||
listen 443 ssl http2;
|
listen 443 ssl http2;
|
||||||
|
|
||||||
ssl_certificate_key /etc/ssl/private/{{cfg_authelia_and_nginx.domain}}.pem;
|
ssl_certificate_key /etc/ssl/private/{{var_authelia_and_nginx_domain}}.pem;
|
||||||
ssl_certificate /etc/ssl/fullchains/{{cfg_authelia_and_nginx.domain}}.pem;
|
ssl_certificate /etc/ssl/fullchains/{{var_authelia_and_nginx_domain}}.pem;
|
||||||
include /etc/nginx/ssl-hardening.conf;
|
include /etc/nginx/ssl-hardening.conf;
|
||||||
|
|
||||||
{{ authelia_common() }}
|
{{ authelia_common() }}
|
||||||
|
|
|
||||||
15
roles/authelia-and-nginx/vardef.json
Normal file
15
roles/authelia-and-nginx/vardef.json
Normal file
|
|
@ -0,0 +1,15 @@
|
||||||
|
{
|
||||||
|
"domain": {
|
||||||
|
"type": "string",
|
||||||
|
"mandatory": false
|
||||||
|
},
|
||||||
|
"tls_mode": {
|
||||||
|
"type": "string",
|
||||||
|
"options": [
|
||||||
|
"disable",
|
||||||
|
"enable",
|
||||||
|
"force"
|
||||||
|
],
|
||||||
|
"mandatory": false
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
@ -1,25 +0,0 @@
|
||||||
{
|
|
||||||
"nullable": false,
|
|
||||||
"type": "object",
|
|
||||||
"properties": {
|
|
||||||
"hedgedoc_url_base": {
|
|
||||||
"nullable": false,
|
|
||||||
"type": "string"
|
|
||||||
},
|
|
||||||
"client_id": {
|
|
||||||
"nullable": false,
|
|
||||||
"type": "string",
|
|
||||||
"default": "hedgedoc"
|
|
||||||
},
|
|
||||||
"client_secret": {
|
|
||||||
"nullable": false,
|
|
||||||
"type": "string"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"additionalProperties": false,
|
|
||||||
"required": [
|
|
||||||
"hedgedoc_url_base",
|
|
||||||
"client_id",
|
|
||||||
"client_secret"
|
|
||||||
]
|
|
||||||
}
|
|
||||||
|
|
@ -1,5 +1,5 @@
|
||||||
{
|
{
|
||||||
"cfg_authelia_for_hedgedoc_defaults": {
|
"var_authelia_for_hedgedoc_hedgedoc_url_base": "https://hedgedoc.example.org",
|
||||||
"client_id": "hedgedoc"
|
"var_authelia_for_hedgedoc_client_id": "hedgedoc",
|
||||||
}
|
"var_authelia_for_hedgedoc_client_secret": "REPLACE_ME"
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -1,16 +1,9 @@
|
||||||
[
|
[
|
||||||
{
|
|
||||||
"name": "show vars",
|
|
||||||
"when": "switch_show_vars",
|
|
||||||
"ansible.builtin.debug": {
|
|
||||||
"var": "vars.cfg_authelia_for_hedgedoc"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
{
|
{
|
||||||
"name": "configuration | compute client secret hash",
|
"name": "configuration | compute client secret hash",
|
||||||
"become": true,
|
"become": true,
|
||||||
"ansible.builtin.shell": {
|
"ansible.builtin.shell": {
|
||||||
"cmd": "authelia crypto hash generate bcrypt --password {{cfg_authelia_for_hedgedoc.client_secret}} | cut --delimiter=' ' --fields='2-'"
|
"cmd": "authelia crypto hash generate bcrypt --password {{var_authelia_for_hedgedoc_client_secret}} | cut --delimiter=' ' --fields='2-'"
|
||||||
},
|
},
|
||||||
"register": "temp_authelia_for_hedgedoc_client_secret_hashed"
|
"register": "temp_authelia_for_hedgedoc_client_secret_hashed"
|
||||||
},
|
},
|
||||||
|
|
|
||||||
|
|
@ -1,5 +1,5 @@
|
||||||
{
|
{
|
||||||
"client_id": "{{cfg_authelia_for_hedgedoc.client_id}}",
|
"client_id": "{{var_authelia_for_hedgedoc_client_id}}",
|
||||||
"client_secret": "{{temp_authelia_for_hedgedoc_client_secret_hashed.stdout}}",
|
"client_secret": "{{temp_authelia_for_hedgedoc_client_secret_hashed.stdout}}",
|
||||||
"client_name": "Hedgedoc",
|
"client_name": "Hedgedoc",
|
||||||
"public": false,
|
"public": false,
|
||||||
|
|
@ -10,7 +10,7 @@
|
||||||
"profile"
|
"profile"
|
||||||
],
|
],
|
||||||
"redirect_uris": [
|
"redirect_uris": [
|
||||||
"{{cfg_authelia_for_hedgedoc.hedgedoc_url_base}}/auth/oauth2/callback"
|
"{{var_authelia_for_hedgedoc_hedgedoc_url_base}}/auth/oauth2/callback"
|
||||||
],
|
],
|
||||||
"response_types": [
|
"response_types": [
|
||||||
"code"
|
"code"
|
||||||
|
|
|
||||||
|
|
@ -4,7 +4,8 @@
|
||||||
"properties": {
|
"properties": {
|
||||||
"owncloud_url_base": {
|
"owncloud_url_base": {
|
||||||
"nullable": false,
|
"nullable": false,
|
||||||
"type": "string"
|
"type": "string",
|
||||||
|
"default": "https://owncloud.example.org"
|
||||||
},
|
},
|
||||||
"web": {
|
"web": {
|
||||||
"nullable": true,
|
"nullable": true,
|
||||||
|
|
@ -68,12 +69,12 @@
|
||||||
"nullable": true,
|
"nullable": true,
|
||||||
"type": "object",
|
"type": "object",
|
||||||
"properties": {
|
"properties": {
|
||||||
"client_id": {
|
"ios_client_id": {
|
||||||
"nullable": false,
|
"nullable": false,
|
||||||
"type": "string",
|
"type": "string",
|
||||||
"default": "mxd5OQDk6es5LzOzRvidJNfXLUZS2oN3oUFeXPP8LpPrhx3UroJFduGEYIBOxkY1"
|
"default": "mxd5OQDk6es5LzOzRvidJNfXLUZS2oN3oUFeXPP8LpPrhx3UroJFduGEYIBOxkY1"
|
||||||
},
|
},
|
||||||
"client_secret": {
|
"ios_client_secret": {
|
||||||
"nullable": false,
|
"nullable": false,
|
||||||
"type": "string",
|
"type": "string",
|
||||||
"default": "KFeFWWEZO9TkisIQzR3fo7hfiMXlOpaqP8CFuTbSHzV1TUuGECglPxpiVKJfOXIx"
|
"default": "KFeFWWEZO9TkisIQzR3fo7hfiMXlOpaqP8CFuTbSHzV1TUuGECglPxpiVKJfOXIx"
|
||||||
|
|
@ -88,10 +89,5 @@
|
||||||
},
|
},
|
||||||
"additionalProperties": false,
|
"additionalProperties": false,
|
||||||
"required": [
|
"required": [
|
||||||
"owncloud_url_base",
|
|
||||||
"web",
|
|
||||||
"desktop",
|
|
||||||
"android",
|
|
||||||
"ios"
|
|
||||||
]
|
]
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -1,5 +1,6 @@
|
||||||
{
|
{
|
||||||
"cfg_authelia_for_owncloud_defaults": {
|
"cfg_authelia_for_owncloud_defaults": {
|
||||||
|
"owncloud_url_base": "https://owncloud.example.org",
|
||||||
"web": {
|
"web": {
|
||||||
"client_id": "owncloud_web"
|
"client_id": "owncloud_web"
|
||||||
},
|
},
|
||||||
|
|
|
||||||
|
|
@ -2,7 +2,7 @@
|
||||||
"client_id": "{{cfg_authelia_for_owncloud.android.client_id}}",
|
"client_id": "{{cfg_authelia_for_owncloud.android.client_id}}",
|
||||||
"client_secret": "{{temp_authelia_for_owncloud_android_client_secret_hashed.stdout}}",
|
"client_secret": "{{temp_authelia_for_owncloud_android_client_secret_hashed.stdout}}",
|
||||||
"client_name": "ownCloud | Android Client",
|
"client_name": "ownCloud | Android Client",
|
||||||
|
|
||||||
"public": false,
|
"public": false,
|
||||||
"authorization_policy": "one_factor",
|
"authorization_policy": "one_factor",
|
||||||
"require_pkce": true,
|
"require_pkce": true,
|
||||||
|
|
|
||||||
|
|
@ -2,7 +2,7 @@
|
||||||
"client_id": "{{cfg_authelia_for_owncloud.desktop.client_id}}",
|
"client_id": "{{cfg_authelia_for_owncloud.desktop.client_id}}",
|
||||||
"client_secret": "{{temp_authelia_for_owncloud_desktop_client_secret_hashed.stdout}}",
|
"client_secret": "{{temp_authelia_for_owncloud_desktop_client_secret_hashed.stdout}}",
|
||||||
"client_name": "ownCloud | Desktop Client",
|
"client_name": "ownCloud | Desktop Client",
|
||||||
|
|
||||||
"public": false,
|
"public": false,
|
||||||
"authorization_policy": "one_factor",
|
"authorization_policy": "one_factor",
|
||||||
"require_pkce": true,
|
"require_pkce": true,
|
||||||
|
|
|
||||||
|
|
@ -10,8 +10,7 @@
|
||||||
"scopes": [
|
"scopes": [
|
||||||
"openid",
|
"openid",
|
||||||
"email",
|
"email",
|
||||||
"profile",
|
"profile"
|
||||||
"groups"
|
|
||||||
],
|
],
|
||||||
"userinfo_signed_response_alg": "none",
|
"userinfo_signed_response_alg": "none",
|
||||||
"token_endpoint_auth_method": "client_secret_post"
|
"token_endpoint_auth_method": "client_secret_post"
|
||||||
|
|
|
||||||
|
|
@ -7,30 +7,10 @@
|
||||||
"type": "string",
|
"type": "string",
|
||||||
"default": "0.0.0.0"
|
"default": "0.0.0.0"
|
||||||
},
|
},
|
||||||
"domain": {
|
|
||||||
"nullable": false,
|
|
||||||
"type": "string"
|
|
||||||
},
|
|
||||||
"session_domain": {
|
|
||||||
"nullable": false,
|
|
||||||
"type": "string"
|
|
||||||
},
|
|
||||||
"redirect_url": {
|
|
||||||
"nullable": false,
|
|
||||||
"type": "string"
|
|
||||||
},
|
|
||||||
"jwt_secret": {
|
"jwt_secret": {
|
||||||
"nullable": false,
|
"nullable": false,
|
||||||
"type": "string"
|
"type": "string"
|
||||||
},
|
},
|
||||||
"session_secret": {
|
|
||||||
"nullable": false,
|
|
||||||
"type": "string"
|
|
||||||
},
|
|
||||||
"storage_encryption_key": {
|
|
||||||
"nullable": false,
|
|
||||||
"type": "string"
|
|
||||||
},
|
|
||||||
"users_file_path": {
|
"users_file_path": {
|
||||||
"nullable": false,
|
"nullable": false,
|
||||||
"type": "string",
|
"type": "string",
|
||||||
|
|
@ -41,6 +21,29 @@
|
||||||
"type": "string",
|
"type": "string",
|
||||||
"default": "/var/authelia/log.jsonl"
|
"default": "/var/authelia/log.jsonl"
|
||||||
},
|
},
|
||||||
|
"domain": {
|
||||||
|
"nullable": false,
|
||||||
|
"type": "string",
|
||||||
|
"default": "authelia.example.org"
|
||||||
|
},
|
||||||
|
"redirect_url": {
|
||||||
|
"nullable": false,
|
||||||
|
"type": "string",
|
||||||
|
"default": "https://example.org"
|
||||||
|
},
|
||||||
|
"session_domain": {
|
||||||
|
"nullable": false,
|
||||||
|
"type": "string",
|
||||||
|
"default": "example.org"
|
||||||
|
},
|
||||||
|
"session_secret": {
|
||||||
|
"nullable": false,
|
||||||
|
"type": "string"
|
||||||
|
},
|
||||||
|
"storage_encryption_key": {
|
||||||
|
"nullable": false,
|
||||||
|
"type": "string"
|
||||||
|
},
|
||||||
"storage": {
|
"storage": {
|
||||||
"anyOf": [
|
"anyOf": [
|
||||||
{
|
{
|
||||||
|
|
@ -50,8 +53,7 @@
|
||||||
"kind": {
|
"kind": {
|
||||||
"nullable": false,
|
"nullable": false,
|
||||||
"type": "string",
|
"type": "string",
|
||||||
"enum": ["sqlite"],
|
"enum": ["sqlite"]
|
||||||
"default": "sqlite"
|
|
||||||
},
|
},
|
||||||
"data": {
|
"data": {
|
||||||
"nullable": false,
|
"nullable": false,
|
||||||
|
|
@ -65,7 +67,6 @@
|
||||||
},
|
},
|
||||||
"additionalProperties": false,
|
"additionalProperties": false,
|
||||||
"required": [
|
"required": [
|
||||||
"path"
|
|
||||||
],
|
],
|
||||||
"default": {
|
"default": {
|
||||||
}
|
}
|
||||||
|
|
@ -73,11 +74,8 @@
|
||||||
},
|
},
|
||||||
"additionalProperties": false,
|
"additionalProperties": false,
|
||||||
"required": [
|
"required": [
|
||||||
"kind",
|
"kind"
|
||||||
"data"
|
]
|
||||||
],
|
|
||||||
"default": {
|
|
||||||
}
|
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"nullable": false,
|
"nullable": false,
|
||||||
|
|
@ -119,23 +117,15 @@
|
||||||
},
|
},
|
||||||
"additionalProperties": false,
|
"additionalProperties": false,
|
||||||
"required": [
|
"required": [
|
||||||
"host",
|
"password"
|
||||||
"port",
|
]
|
||||||
"username",
|
|
||||||
"password",
|
|
||||||
"schema"
|
|
||||||
],
|
|
||||||
"default": {
|
|
||||||
}
|
|
||||||
}
|
}
|
||||||
},
|
},
|
||||||
"additionalProperties": false,
|
"additionalProperties": false,
|
||||||
"required": [
|
"required": [
|
||||||
"kind",
|
"kind",
|
||||||
"data"
|
"data"
|
||||||
],
|
]
|
||||||
"default": {
|
|
||||||
}
|
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"nullable": false,
|
"nullable": false,
|
||||||
|
|
@ -177,30 +167,22 @@
|
||||||
},
|
},
|
||||||
"additionalProperties": false,
|
"additionalProperties": false,
|
||||||
"required": [
|
"required": [
|
||||||
"host",
|
"password"
|
||||||
"port",
|
]
|
||||||
"username",
|
|
||||||
"password",
|
|
||||||
"schema"
|
|
||||||
],
|
|
||||||
"default": {
|
|
||||||
}
|
|
||||||
}
|
}
|
||||||
},
|
},
|
||||||
"additionalProperties": false,
|
"additionalProperties": false,
|
||||||
"required": [
|
"required": [
|
||||||
"kind",
|
"kind",
|
||||||
"data"
|
"data"
|
||||||
],
|
]
|
||||||
"default": {
|
|
||||||
}
|
|
||||||
}
|
}
|
||||||
]
|
]
|
||||||
},
|
},
|
||||||
"ntp_server": {
|
"ntp_server": {
|
||||||
"nullable": false,
|
"nullable": false,
|
||||||
"type": "string",
|
"type": "string",
|
||||||
"default": "time.cloudflare.com:123"
|
"mandatory": false
|
||||||
},
|
},
|
||||||
"password_reset": {
|
"password_reset": {
|
||||||
"nullable": false,
|
"nullable": false,
|
||||||
|
|
@ -219,8 +201,6 @@
|
||||||
},
|
},
|
||||||
"additionalProperties": false,
|
"additionalProperties": false,
|
||||||
"required": [
|
"required": [
|
||||||
"enabled",
|
|
||||||
"custom_url"
|
|
||||||
],
|
],
|
||||||
"default": {
|
"default": {
|
||||||
}
|
}
|
||||||
|
|
@ -234,22 +214,15 @@
|
||||||
"kind": {
|
"kind": {
|
||||||
"nullable": false,
|
"nullable": false,
|
||||||
"type": "string",
|
"type": "string",
|
||||||
"enum": ["file"],
|
"enum": ["file"]
|
||||||
"default": "file"
|
|
||||||
},
|
},
|
||||||
"data": {
|
"data": {
|
||||||
"nullable": false,
|
"nullable": false,
|
||||||
"type": "object",
|
"type": "object",
|
||||||
"properties": {
|
"properties": {
|
||||||
"path": {
|
|
||||||
"nullable": false,
|
|
||||||
"type": "string",
|
|
||||||
"default": "/var/authelia/notifications"
|
|
||||||
}
|
|
||||||
},
|
},
|
||||||
"additionalProperties": false,
|
"additionalProperties": false,
|
||||||
"required": [
|
"required": [
|
||||||
"path"
|
|
||||||
],
|
],
|
||||||
"default": {
|
"default": {
|
||||||
}
|
}
|
||||||
|
|
@ -257,11 +230,8 @@
|
||||||
},
|
},
|
||||||
"additionalProperties": false,
|
"additionalProperties": false,
|
||||||
"required": [
|
"required": [
|
||||||
"kind",
|
"kind"
|
||||||
"data"
|
]
|
||||||
],
|
|
||||||
"default": {
|
|
||||||
}
|
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"nullable": false,
|
"nullable": false,
|
||||||
|
|
@ -270,8 +240,7 @@
|
||||||
"kind": {
|
"kind": {
|
||||||
"nullable": false,
|
"nullable": false,
|
||||||
"type": "string",
|
"type": "string",
|
||||||
"enum": ["smtp"],
|
"enum": ["smtp"]
|
||||||
"default": "smtp"
|
|
||||||
},
|
},
|
||||||
"data": {
|
"data": {
|
||||||
"nullable": false,
|
"nullable": false,
|
||||||
|
|
@ -279,7 +248,8 @@
|
||||||
"properties": {
|
"properties": {
|
||||||
"host": {
|
"host": {
|
||||||
"nullable": false,
|
"nullable": false,
|
||||||
"type": "string"
|
"type": "string",
|
||||||
|
"default": "smtp.example.org"
|
||||||
},
|
},
|
||||||
"port": {
|
"port": {
|
||||||
"nullable": false,
|
"nullable": false,
|
||||||
|
|
@ -303,11 +273,7 @@
|
||||||
},
|
},
|
||||||
"additionalProperties": false,
|
"additionalProperties": false,
|
||||||
"required": [
|
"required": [
|
||||||
"host",
|
"password"
|
||||||
"port",
|
|
||||||
"username",
|
|
||||||
"password",
|
|
||||||
"sender"
|
|
||||||
]
|
]
|
||||||
}
|
}
|
||||||
},
|
},
|
||||||
|
|
@ -315,9 +281,7 @@
|
||||||
"required": [
|
"required": [
|
||||||
"kind",
|
"kind",
|
||||||
"data"
|
"data"
|
||||||
],
|
]
|
||||||
"default": {
|
|
||||||
}
|
|
||||||
}
|
}
|
||||||
]
|
]
|
||||||
},
|
},
|
||||||
|
|
@ -374,7 +338,7 @@
|
||||||
},
|
},
|
||||||
"additionalProperties": false,
|
"additionalProperties": false,
|
||||||
"required": [
|
"required": [
|
||||||
"access_token",
|
"acces_token",
|
||||||
"refresh_token"
|
"refresh_token"
|
||||||
]
|
]
|
||||||
},
|
},
|
||||||
|
|
@ -420,30 +384,15 @@
|
||||||
},
|
},
|
||||||
"additionalProperties": false,
|
"additionalProperties": false,
|
||||||
"required": [
|
"required": [
|
||||||
"hmac_secret",
|
"hmac_secret"
|
||||||
"lifespan",
|
]
|
||||||
"cors_endpoints"
|
|
||||||
],
|
|
||||||
"default": {
|
|
||||||
}
|
|
||||||
}
|
}
|
||||||
},
|
},
|
||||||
"additionalProperties": false,
|
"additionalProperties": false,
|
||||||
"required": [
|
"required": [
|
||||||
"listen_address",
|
|
||||||
"domain",
|
|
||||||
"session_domain",
|
|
||||||
"redirect_url",
|
|
||||||
"jwt_secret",
|
"jwt_secret",
|
||||||
"session_secret",
|
"session_secret",
|
||||||
"storage_encryption_key",
|
"storage_encryption_key",
|
||||||
"users_file_path",
|
|
||||||
"log_file_path",
|
|
||||||
"storage",
|
|
||||||
"ntp_server",
|
|
||||||
"notification",
|
|
||||||
"oidc"
|
"oidc"
|
||||||
],
|
]
|
||||||
"default": {
|
|
||||||
}
|
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -3,6 +3,9 @@
|
||||||
"listen_address": "0.0.0.0",
|
"listen_address": "0.0.0.0",
|
||||||
"users_file_path": "/var/authelia/users.yml",
|
"users_file_path": "/var/authelia/users.yml",
|
||||||
"log_file_path": "/var/authelia/log.jsonl",
|
"log_file_path": "/var/authelia/log.jsonl",
|
||||||
|
"domain": "authelia.example.org",
|
||||||
|
"redirect_url": "https://example.org",
|
||||||
|
"session_domain": "example.org",
|
||||||
"storage": {
|
"storage": {
|
||||||
"kind": "sqlite",
|
"kind": "sqlite",
|
||||||
"data": {
|
"data": {
|
||||||
|
|
|
||||||
|
|
@ -1,24 +0,0 @@
|
||||||
{
|
|
||||||
"nullable": false,
|
|
||||||
"type": "object",
|
|
||||||
"properties": {
|
|
||||||
"domain": {
|
|
||||||
"nullable": false,
|
|
||||||
"type": "string"
|
|
||||||
},
|
|
||||||
"tls_mode": {
|
|
||||||
"nullable": false,
|
|
||||||
"type": "string",
|
|
||||||
"options": [
|
|
||||||
"disable",
|
|
||||||
"enable",
|
|
||||||
"force"
|
|
||||||
],
|
|
||||||
"default": "force"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"additionalProperties": false,
|
|
||||||
"required": [
|
|
||||||
"domain"
|
|
||||||
]
|
|
||||||
}
|
|
||||||
|
|
@ -1,5 +1,4 @@
|
||||||
{
|
{
|
||||||
"cfg_hedgedoc_and_nginx_defaults": {
|
"var_hedgedoc_and_nginx_domain": "hedgedoc.example.org",
|
||||||
"tls_mode": "force"
|
"var_hedgedoc_and_nginx_tls_mode": "force"
|
||||||
}
|
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -1,11 +1,4 @@
|
||||||
[
|
[
|
||||||
{
|
|
||||||
"name": "show vars",
|
|
||||||
"when": "switch_show_vars",
|
|
||||||
"ansible.builtin.debug": {
|
|
||||||
"var": "vars.cfg_hedgedoc_and_nginx"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
{
|
{
|
||||||
"name": "deactivate default site",
|
"name": "deactivate default site",
|
||||||
"become": true,
|
"become": true,
|
||||||
|
|
@ -19,7 +12,7 @@
|
||||||
"become": true,
|
"become": true,
|
||||||
"ansible.builtin.template": {
|
"ansible.builtin.template": {
|
||||||
"src": "conf.j2",
|
"src": "conf.j2",
|
||||||
"dest": "/etc/nginx/sites-available/{{cfg_hedgedoc_and_nginx.domain}}"
|
"dest": "/etc/nginx/sites-available/{{var_hedgedoc_and_nginx_domain}}"
|
||||||
}
|
}
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
|
|
@ -27,8 +20,8 @@
|
||||||
"become": true,
|
"become": true,
|
||||||
"ansible.builtin.file": {
|
"ansible.builtin.file": {
|
||||||
"state": "link",
|
"state": "link",
|
||||||
"src": "/etc/nginx/sites-available/{{cfg_hedgedoc_and_nginx.domain}}",
|
"src": "/etc/nginx/sites-available/{{var_hedgedoc_and_nginx_domain}}",
|
||||||
"dest": "/etc/nginx/sites-enabled/{{cfg_hedgedoc_and_nginx.domain}}"
|
"dest": "/etc/nginx/sites-enabled/{{var_hedgedoc_and_nginx_domain}}"
|
||||||
}
|
}
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
|
|
|
||||||
|
|
@ -24,27 +24,27 @@ map $http_upgrade $connection_upgrade {
|
||||||
{% endmacro %}
|
{% endmacro %}
|
||||||
|
|
||||||
server {
|
server {
|
||||||
server_name {{cfg_hedgedoc_and_nginx.domain}};
|
server_name {{var_hedgedoc_and_nginx_domain}};
|
||||||
|
|
||||||
listen 80;
|
listen 80;
|
||||||
listen [::]:80;
|
listen [::]:80;
|
||||||
|
|
||||||
{% if (cfg_hedgedoc_and_nginx.tls_mode == 'force') %}
|
{% if (var_element_and_nginx_tls_mode == 'force') %}
|
||||||
return 301 https://$http_host$request_uri;
|
return 301 https://$http_host$request_uri;
|
||||||
{% else %}
|
{% else %}
|
||||||
{{ hedgedoc_common() }}
|
{{ hedgedoc_common() }}
|
||||||
{% endif %}
|
{% endif %}
|
||||||
}
|
}
|
||||||
|
|
||||||
{% if (cfg_hedgedoc_and_nginx.tls_mode != 'disable') %}
|
{% if (var_hedgedoc_and_nginx_tls_mode != 'disable') %}
|
||||||
server {
|
server {
|
||||||
server_name {{cfg_hedgedoc_and_nginx.domain}};
|
server_name {{var_hedgedoc_and_nginx_domain}};
|
||||||
|
|
||||||
listen [::]:443 ssl http2;
|
listen [::]:443 ssl http2;
|
||||||
listen 443 ssl http2;
|
listen 443 ssl http2;
|
||||||
|
|
||||||
ssl_certificate_key /etc/ssl/private/{{cfg_hedgedoc_and_nginx.domain}}.pem;
|
ssl_certificate_key /etc/ssl/private/{{var_hedgedoc_and_nginx_domain}}.pem;
|
||||||
ssl_certificate /etc/ssl/fullchains/{{cfg_hedgedoc_and_nginx.domain}}.pem;
|
ssl_certificate /etc/ssl/fullchains/{{var_hedgedoc_and_nginx_domain}}.pem;
|
||||||
include /etc/nginx/ssl-hardening.conf;
|
include /etc/nginx/ssl-hardening.conf;
|
||||||
|
|
||||||
{{ hedgedoc_common() }}
|
{{ hedgedoc_common() }}
|
||||||
|
|
|
||||||
15
roles/hedgedoc-and-nginx/vardef.json
Normal file
15
roles/hedgedoc-and-nginx/vardef.json
Normal file
|
|
@ -0,0 +1,15 @@
|
||||||
|
{
|
||||||
|
"domain": {
|
||||||
|
"type": "string",
|
||||||
|
"mandatory": false
|
||||||
|
},
|
||||||
|
"tls_mode": {
|
||||||
|
"type": "string",
|
||||||
|
"options": [
|
||||||
|
"disable",
|
||||||
|
"enable",
|
||||||
|
"force"
|
||||||
|
],
|
||||||
|
"mandatory": false
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
@ -1,248 +0,0 @@
|
||||||
{
|
|
||||||
"nullable": false,
|
|
||||||
"type": "object",
|
|
||||||
"properties": {
|
|
||||||
"user_name": {
|
|
||||||
"nullable": false,
|
|
||||||
"type": "string",
|
|
||||||
"default": "hedgedoc"
|
|
||||||
},
|
|
||||||
"directory": {
|
|
||||||
"nullable": false,
|
|
||||||
"type": "string",
|
|
||||||
"default": "/opt/hedgedoc"
|
|
||||||
},
|
|
||||||
"version": {
|
|
||||||
"nullable": false,
|
|
||||||
"type": "string",
|
|
||||||
"default": "1.10.3"
|
|
||||||
},
|
|
||||||
"domain": {
|
|
||||||
"nullable": false,
|
|
||||||
"type": "string"
|
|
||||||
},
|
|
||||||
"session_secret": {
|
|
||||||
"nullable": false,
|
|
||||||
"type": "string"
|
|
||||||
},
|
|
||||||
"database": {
|
|
||||||
"anyOf": [
|
|
||||||
{
|
|
||||||
"nullable": false,
|
|
||||||
"type": "object",
|
|
||||||
"properties": {
|
|
||||||
"kind": {
|
|
||||||
"nullable": false,
|
|
||||||
"type": "string",
|
|
||||||
"enum": ["sqlite"],
|
|
||||||
"default": "sqlite"
|
|
||||||
},
|
|
||||||
"data": {
|
|
||||||
"nullable": false,
|
|
||||||
"type": "object",
|
|
||||||
"properties": {
|
|
||||||
"path": {
|
|
||||||
"nullable": false,
|
|
||||||
"type": "string",
|
|
||||||
"default": "/var/hedgedoc/data.sqlite"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"additionalProperties": false,
|
|
||||||
"required": [
|
|
||||||
"path"
|
|
||||||
],
|
|
||||||
"default": {
|
|
||||||
}
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"additionalProperties": false,
|
|
||||||
"required": [
|
|
||||||
"kind",
|
|
||||||
"data"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"nullable": false,
|
|
||||||
"type": "object",
|
|
||||||
"properties": {
|
|
||||||
"kind": {
|
|
||||||
"nullable": false,
|
|
||||||
"type": "string",
|
|
||||||
"enum": ["postgresql"],
|
|
||||||
"default": "postgresql"
|
|
||||||
},
|
|
||||||
"data": {
|
|
||||||
"nullable": false,
|
|
||||||
"type": "object",
|
|
||||||
"properties": {
|
|
||||||
"host": {
|
|
||||||
"nullable": false,
|
|
||||||
"type": "string",
|
|
||||||
"default": "localhost"
|
|
||||||
},
|
|
||||||
"port": {
|
|
||||||
"nullable": false,
|
|
||||||
"type": "integer",
|
|
||||||
"default": 5432
|
|
||||||
},
|
|
||||||
"username": {
|
|
||||||
"nullable": false,
|
|
||||||
"type": "string",
|
|
||||||
"default": "hedgedoc_user"
|
|
||||||
},
|
|
||||||
"password": {
|
|
||||||
"nullable": false,
|
|
||||||
"type": "string"
|
|
||||||
},
|
|
||||||
"schema": {
|
|
||||||
"nullable": false,
|
|
||||||
"type": "string",
|
|
||||||
"default": "hedgedoc"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"additionalProperties": false,
|
|
||||||
"required": [
|
|
||||||
"host",
|
|
||||||
"port",
|
|
||||||
"username",
|
|
||||||
"password",
|
|
||||||
"schema"
|
|
||||||
]
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"additionalProperties": false,
|
|
||||||
"required": [
|
|
||||||
"kind",
|
|
||||||
"data"
|
|
||||||
]
|
|
||||||
}
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"authentication": {
|
|
||||||
"anyOf": [
|
|
||||||
{
|
|
||||||
"nullable": false,
|
|
||||||
"type": "object",
|
|
||||||
"properties": {
|
|
||||||
"kind": {
|
|
||||||
"nullable": false,
|
|
||||||
"type": "string",
|
|
||||||
"enum": ["internal"],
|
|
||||||
"default": "internal"
|
|
||||||
},
|
|
||||||
"data": {
|
|
||||||
"nullable": false,
|
|
||||||
"type": "object",
|
|
||||||
"properties": {
|
|
||||||
},
|
|
||||||
"additionalProperties": false,
|
|
||||||
"required": [
|
|
||||||
],
|
|
||||||
"default": {
|
|
||||||
}
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"additionalProperties": false,
|
|
||||||
"required": [
|
|
||||||
"kind",
|
|
||||||
"data"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"nullable": false,
|
|
||||||
"type": "object",
|
|
||||||
"properties": {
|
|
||||||
"kind": {
|
|
||||||
"nullable": false,
|
|
||||||
"type": "string",
|
|
||||||
"enum": ["authelia"],
|
|
||||||
"default": "authelia"
|
|
||||||
},
|
|
||||||
"data": {
|
|
||||||
"nullable": false,
|
|
||||||
"type": "object",
|
|
||||||
"properties": {
|
|
||||||
"url_base": {
|
|
||||||
"nullable": false,
|
|
||||||
"type": "string"
|
|
||||||
},
|
|
||||||
"client_id": {
|
|
||||||
"nullable": false,
|
|
||||||
"type": "string",
|
|
||||||
"default": "hedgedoc"
|
|
||||||
},
|
|
||||||
"client_secret": {
|
|
||||||
"nullable": false,
|
|
||||||
"type": "string"
|
|
||||||
},
|
|
||||||
"provider_name": {
|
|
||||||
"nullable": false,
|
|
||||||
"type": "string",
|
|
||||||
"default": "Authelia"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"additionalProperties": false,
|
|
||||||
"required": [
|
|
||||||
"url_base",
|
|
||||||
"client_id",
|
|
||||||
"client_secret",
|
|
||||||
"provider_name"
|
|
||||||
]
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"additionalProperties": false,
|
|
||||||
"required": [
|
|
||||||
"kind",
|
|
||||||
"data"
|
|
||||||
]
|
|
||||||
}
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"guest_allow_create": {
|
|
||||||
"nullable": false,
|
|
||||||
"type": "boolean",
|
|
||||||
"default": false
|
|
||||||
},
|
|
||||||
"guest_allow_change": {
|
|
||||||
"nullable": false,
|
|
||||||
"type": "boolean",
|
|
||||||
"default": false
|
|
||||||
},
|
|
||||||
"free_names_mode": {
|
|
||||||
"nullable": false,
|
|
||||||
"type": "string",
|
|
||||||
"enum": [
|
|
||||||
"never",
|
|
||||||
"authed",
|
|
||||||
"always"
|
|
||||||
],
|
|
||||||
"default": "authed"
|
|
||||||
},
|
|
||||||
"log_level": {
|
|
||||||
"nullable": false,
|
|
||||||
"type": "string",
|
|
||||||
"enum": [
|
|
||||||
"debug",
|
|
||||||
"verbose",
|
|
||||||
"info",
|
|
||||||
"warn",
|
|
||||||
"error"
|
|
||||||
],
|
|
||||||
"default": "error"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"additionalProperties": false,
|
|
||||||
"required": [
|
|
||||||
"user_name",
|
|
||||||
"directory",
|
|
||||||
"version",
|
|
||||||
"domain",
|
|
||||||
"session_secret",
|
|
||||||
"database",
|
|
||||||
"authentication",
|
|
||||||
"guest_allow_create",
|
|
||||||
"guest_allow_change",
|
|
||||||
"free_names_mode",
|
|
||||||
"log_level"
|
|
||||||
]
|
|
||||||
}
|
|
||||||
|
|
@ -1,22 +1,21 @@
|
||||||
{
|
{
|
||||||
"cfg_hedgedoc_defaults": {
|
"var_hedgedoc_user_name": "hedgedoc",
|
||||||
"user_name": "hedgedoc",
|
"var_hedgedoc_directory": "/opt/hedgedoc",
|
||||||
"directory": "/opt/hedgedoc",
|
"var_hedgedoc_version": "1.9.9",
|
||||||
"version": "1.10.3",
|
"var_hedgedoc_session_secret": "REPLACE_ME",
|
||||||
"database": {
|
"var_hedgedoc_database_kind": "sqlite",
|
||||||
"kind": "sqlite",
|
"var_hedgedoc_database_data_sqlite_path": "/var/hedgedoc/data.sqlite",
|
||||||
"data": {
|
"var_hedgedoc_database_data_postgresql_host": "localhost",
|
||||||
"path": "/var/hedgedoc/data.sqlite"
|
"var_hedgedoc_database_data_postgresql_port": 5432,
|
||||||
}
|
"var_hedgedoc_database_data_postgresql_username": "hedgedoc_user",
|
||||||
},
|
"var_hedgedoc_database_data_postgresql_password": "REPLACE_ME",
|
||||||
"authentication": {
|
"var_hedgedoc_database_data_postgresql_schema": "hedgedoc",
|
||||||
"kind": "internal",
|
"var_hedgedoc_domain": "hedgedoc.example.org",
|
||||||
"data": {
|
"var_hedgedoc_authentication_kind": "internal",
|
||||||
}
|
"var_hedgedoc_authentication_data_authelia_client_id": "hedgedoc",
|
||||||
},
|
"var_hedgedoc_authentication_data_authelia_client_secret": "REPLACE_ME",
|
||||||
"guest_allow_create": false,
|
"var_hedgedoc_authentication_data_authelia_url_base": "https://authelia.example.org",
|
||||||
"guest_allow_change": false,
|
"var_hedgedoc_guest_allow_create": false,
|
||||||
"free_names_mode": "authed",
|
"var_hedgedoc_guest_allow_change": false,
|
||||||
"log_level": "error"
|
"var_hedgedoc_free_names_mode": "authed"
|
||||||
}
|
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -1,11 +1,4 @@
|
||||||
[
|
[
|
||||||
{
|
|
||||||
"name": "show vars",
|
|
||||||
"when": "switch_show_vars",
|
|
||||||
"ansible.builtin.debug": {
|
|
||||||
"var": "vars.cfg_hedgedoc"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
{
|
{
|
||||||
"name": "packages",
|
"name": "packages",
|
||||||
"become": true,
|
"become": true,
|
||||||
|
|
@ -33,41 +26,16 @@
|
||||||
"name": "user",
|
"name": "user",
|
||||||
"become": true,
|
"become": true,
|
||||||
"ansible.builtin.user": {
|
"ansible.builtin.user": {
|
||||||
"name": "{{cfg_hedgedoc.user_name}}",
|
"name": "{{var_hedgedoc_user_name}}",
|
||||||
"create_home": true,
|
"create_home": true,
|
||||||
"home": "{{cfg_hedgedoc.directory}}"
|
"home": "{{var_hedgedoc_directory}}"
|
||||||
}
|
}
|
||||||
},
|
},
|
||||||
{
|
|
||||||
"name": "database",
|
|
||||||
"when": "cfg_hedgedoc.database.kind == 'sqlite'",
|
|
||||||
"block": [
|
|
||||||
{
|
|
||||||
"name": "database | directory",
|
|
||||||
"become": true,
|
|
||||||
"ansible.builtin.file": {
|
|
||||||
"state": "directory",
|
|
||||||
"path": "{{cfg_hedgedoc.database.data.sqlite.path | dirname}}",
|
|
||||||
"owner": "{{cfg_hedgedoc.user_name}}"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"name": "database | file",
|
|
||||||
"become": true,
|
|
||||||
"ansible.builtin.file": {
|
|
||||||
"state": "touch",
|
|
||||||
"path": "{{cfg_hedgedoc.database.data.sqlite.path}}",
|
|
||||||
"owner": "{{cfg_hedgedoc.user_name}}"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
]
|
|
||||||
|
|
||||||
},
|
|
||||||
{
|
{
|
||||||
"name": "download",
|
"name": "download",
|
||||||
"become": false,
|
"become": false,
|
||||||
"ansible.builtin.get_url": {
|
"ansible.builtin.get_url": {
|
||||||
"url": "https://github.com/hedgedoc/hedgedoc/releases/download/{{cfg_hedgedoc.version}}/hedgedoc-{{cfg_hedgedoc.version}}.tar.gz",
|
"url": "https://github.com/hedgedoc/hedgedoc/releases/download/{{var_hedgedoc_version}}/hedgedoc-{{var_hedgedoc_version}}.tar.gz",
|
||||||
"dest": "/tmp/hedgedoc.tar.gz"
|
"dest": "/tmp/hedgedoc.tar.gz"
|
||||||
}
|
}
|
||||||
},
|
},
|
||||||
|
|
@ -77,8 +45,8 @@
|
||||||
"ansible.builtin.unarchive": {
|
"ansible.builtin.unarchive": {
|
||||||
"remote_src": true,
|
"remote_src": true,
|
||||||
"src": "/tmp/hedgedoc.tar.gz",
|
"src": "/tmp/hedgedoc.tar.gz",
|
||||||
"dest": "{{cfg_hedgedoc.directory | dirname}}",
|
"dest": "{{var_hedgedoc_directory | dirname}}",
|
||||||
"owner": "{{cfg_hedgedoc.user_name}}"
|
"owner": "{{var_hedgedoc_user_name}}"
|
||||||
}
|
}
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
|
|
@ -86,7 +54,7 @@
|
||||||
"become": true,
|
"become": true,
|
||||||
"become_user": "hedgedoc",
|
"become_user": "hedgedoc",
|
||||||
"ansible.builtin.command": {
|
"ansible.builtin.command": {
|
||||||
"chdir": "{{cfg_hedgedoc.directory}}",
|
"chdir": "{{var_hedgedoc_directory}}",
|
||||||
"cmd": "bin/setup"
|
"cmd": "bin/setup"
|
||||||
}
|
}
|
||||||
},
|
},
|
||||||
|
|
@ -95,7 +63,7 @@
|
||||||
"become": true,
|
"become": true,
|
||||||
"ansible.builtin.template": {
|
"ansible.builtin.template": {
|
||||||
"src": "config.json.j2",
|
"src": "config.json.j2",
|
||||||
"dest": "{{cfg_hedgedoc.directory}}/config.json"
|
"dest": "{{var_hedgedoc_directory}}/config.json"
|
||||||
}
|
}
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
|
|
|
||||||
|
|
@ -1,61 +1,61 @@
|
||||||
{
|
{
|
||||||
"production": {
|
"production": {
|
||||||
"loglevel": "{{cfg_hedgedoc.log_level}}",
|
"loglevel": "error",
|
||||||
{% if cfg_hedgedoc.database.kind == 'sqlite' %}
|
{% if var_hedgedoc_database_kind == 'sqlite' %}
|
||||||
"db": {
|
"db": {
|
||||||
"dialect": "sqlite",
|
"dialect": "sqlite",
|
||||||
"storage": "{{cfg_hedgedoc.database.data.sqlite.path}}"
|
"storage": "{{var_hedgedoc_database_data_sqlite_path}}"
|
||||||
},
|
},
|
||||||
{% endif %}
|
{% endif %}
|
||||||
{% if cfg_hedgedoc.database.kind == 'postgresql' %}
|
{% if var_hedgedoc_database_kind == 'postgresql' %}
|
||||||
"db": {
|
"db": {
|
||||||
"dialect": "postgres",
|
"dialect": "postgres",
|
||||||
"host": "{{cfg_hedgedoc.database.data.postgresql.host}}",
|
"host": "{{var_hedgedoc_database_data_postgresql_host}}",
|
||||||
"port": {{cfg_hedgedoc.database.data.postgresql.port | to_json}},
|
"port": {{var_hedgedoc_database_data_postgresql_port | to_json}},
|
||||||
"username": "{{cfg_hedgedoc.database.data.postgresql.username}}",
|
"username": "{{var_hedgedoc_database_data_postgresql_username}}",
|
||||||
"password": "{{cfg_hedgedoc.database.data.postgresql.password}}",
|
"password": "{{var_hedgedoc_database_data_postgresql_password}}",
|
||||||
"database": "{{cfg_hedgedoc.database.data.postgresql.schema}}"
|
"database": "{{var_hedgedoc_database_data_postgresql_schema}}"
|
||||||
},
|
},
|
||||||
{% endif %}
|
{% endif %}
|
||||||
"sessionSecret": "{{cfg_hedgedoc.session_secret}}",
|
"sessionSecret": "{{var_hedgedoc_session_secret}}",
|
||||||
"host": "localhost",
|
"host": "localhost",
|
||||||
"allowOrigin": [
|
"allowOrigin": [
|
||||||
"localhost"
|
"localhost"
|
||||||
],
|
],
|
||||||
"domain": "{{cfg_hedgedoc.domain}}",
|
"domain": "{{var_hedgedoc_domain}}",
|
||||||
"urlAddPort": false,
|
"urlAddPort": false,
|
||||||
"protocolUseSSL": true,
|
"protocolUseSSL": true,
|
||||||
{% if cfg_hedgedoc.authentication.kind == 'internal' %}
|
{% if var_hedgedoc_authentication_kind == 'internal' %}
|
||||||
"email": true,
|
"email": true,
|
||||||
"allowEmailRegister": true,
|
"allowEmailRegister": true,
|
||||||
{% endif %}
|
{% endif %}
|
||||||
{% if cfg_hedgedoc.authentication.kind == 'authelia' %}
|
{% if var_hedgedoc_authentication_kind == 'authelia' %}
|
||||||
"oauth2": {
|
"oauth2": {
|
||||||
"providerName": "{{cfg_hedgedoc.authentication.data.authelia.provider_name}}",
|
"providerName": "{{var_hedgedoc_authentication_data_authelia_provider_name}}",
|
||||||
"clientID": "{{cfg_hedgedoc.authentication.data.authelia.client_id}}",
|
"clientID": "{{var_hedgedoc_authentication_data_authelia_client_id}}",
|
||||||
"clientSecret": "{{cfg_hedgedoc.authentication.data.authelia.client_secret}}",
|
"clientSecret": "{{var_hedgedoc_authentication_data_authelia_client_secret}}",
|
||||||
"scope": "openid email profile",
|
"scope": "openid email profile",
|
||||||
"userProfileUsernameAttr": "sub",
|
"userProfileUsernameAttr": "sub",
|
||||||
"userProfileDisplayNameAttr": "name",
|
"userProfileDisplayNameAttr": "name",
|
||||||
"userProfileEmailAttr": "email",
|
"userProfileEmailAttr": "email",
|
||||||
"userProfileURL": "{{cfg_hedgedoc.authentication.data.authelia.url_base}}/api/oidc/userinfo",
|
"userProfileURL": "{{var_hedgedoc_authentication_data_authelia_url_base}}/api/oidc/userinfo",
|
||||||
"tokenURL": "{{cfg_hedgedoc.authentication.data.authelia.url_base}}/api/oidc/token",
|
"tokenURL": "{{var_hedgedoc_authentication_data_authelia_url_base}}/api/oidc/token",
|
||||||
"authorizationURL": "{{cfg_hedgedoc.authentication.data.authelia.url_base}}/api/oidc/authorization"
|
"authorizationURL": "{{var_hedgedoc_authentication_data_authelia_url_base}}/api/oidc/authorization"
|
||||||
},
|
},
|
||||||
"email": false,
|
"email": false,
|
||||||
"allowEmailRegister": false,
|
"allowEmailRegister": false,
|
||||||
{% endif %}
|
{% endif %}
|
||||||
"allowAnonymous": {{cfg_hedgedoc.guest_allow_create | to_json}},
|
"allowAnonymous": {{var_hedgedoc_guest_allow_create | to_json}},
|
||||||
"allowAnonymousEdits": {{cfg_hedgedoc.guest_allow_change | to_json}},
|
"allowAnonymousEdits": {{var_hedgedoc_guest_allow_change | to_json}},
|
||||||
{% if cfg_hedgedoc.free_names_mode == 'never' %}
|
{% if var_hedgedoc_free_names_mode == 'never' %}
|
||||||
"allowFreeURL": false,
|
"allowFreeURL": false,
|
||||||
"requireFreeURLAuthentication": false,
|
"requireFreeURLAuthentication": false,
|
||||||
{% endif %}
|
{% endif %}
|
||||||
{% if cfg_hedgedoc.free_names_mode == 'authed' %}
|
{% if var_hedgedoc_free_names_mode == 'authed' %}
|
||||||
"allowFreeURL": true,
|
"allowFreeURL": true,
|
||||||
"requireFreeURLAuthentication": true,
|
"requireFreeURLAuthentication": true,
|
||||||
{% endif %}
|
{% endif %}
|
||||||
{% if cfg_hedgedoc.free_names_mode == 'always' %}
|
{% if var_hedgedoc_free_names_mode == 'always' %}
|
||||||
"allowFreeURL": true,
|
"allowFreeURL": true,
|
||||||
"requireFreeURLAuthentication": false,
|
"requireFreeURLAuthentication": false,
|
||||||
{% endif %}
|
{% endif %}
|
||||||
|
|
|
||||||
|
|
@ -3,8 +3,8 @@ Description=Hedgedoc
|
||||||
After=multi-user.target
|
After=multi-user.target
|
||||||
|
|
||||||
[Service]
|
[Service]
|
||||||
WorkingDirectory={{cfg_hedgedoc.directory}}
|
WorkingDirectory={{var_hedgedoc_directory}}
|
||||||
User={{cfg_hedgedoc.user_name}}
|
User={{var_hedgedoc_user_name}}
|
||||||
Environment="NODE_ENV=production"
|
Environment="NODE_ENV=production"
|
||||||
ExecStart=yarn start
|
ExecStart=yarn start
|
||||||
SyslogIdentifier=hedgedoc
|
SyslogIdentifier=hedgedoc
|
||||||
|
|
|
||||||
87
roles/hedgedoc/vardef.json
Normal file
87
roles/hedgedoc/vardef.json
Normal file
|
|
@ -0,0 +1,87 @@
|
||||||
|
{
|
||||||
|
"user_name": {
|
||||||
|
"type": "string",
|
||||||
|
"mandatory": false
|
||||||
|
},
|
||||||
|
"directory": {
|
||||||
|
"type": "string",
|
||||||
|
"mandatory": false
|
||||||
|
},
|
||||||
|
"version": {
|
||||||
|
"type": "string",
|
||||||
|
"mandatory": false
|
||||||
|
},
|
||||||
|
"session_secret": {
|
||||||
|
"type": "string",
|
||||||
|
"mandatory": true
|
||||||
|
},
|
||||||
|
"database_kind": {
|
||||||
|
"type": "string",
|
||||||
|
"mandatory": false,
|
||||||
|
"options": [
|
||||||
|
"sqlite",
|
||||||
|
"postgresql",
|
||||||
|
"mariadb"
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"database_data_sqlite_path": {
|
||||||
|
"type": "string",
|
||||||
|
"mandatory": false
|
||||||
|
},
|
||||||
|
"database_data_postgresql_host": {
|
||||||
|
"type": "string",
|
||||||
|
"mandatory": false
|
||||||
|
},
|
||||||
|
"database_data_postgresql_port": {
|
||||||
|
"type": "integer",
|
||||||
|
"mandatory": false
|
||||||
|
},
|
||||||
|
"database_data_postgresql_username": {
|
||||||
|
"type": "string",
|
||||||
|
"mandatory": false
|
||||||
|
},
|
||||||
|
"database_data_postgresql_password": {
|
||||||
|
"type": "string",
|
||||||
|
"mandatory": false
|
||||||
|
},
|
||||||
|
"database_data_postgresql_schema": {
|
||||||
|
"type": "string",
|
||||||
|
"mandatory": false
|
||||||
|
},
|
||||||
|
"domain": {
|
||||||
|
"type": "string",
|
||||||
|
"mandatory": false
|
||||||
|
},
|
||||||
|
"authentication_kind": {
|
||||||
|
"type": "string",
|
||||||
|
"mandatory": false,
|
||||||
|
"options": [
|
||||||
|
"internal",
|
||||||
|
"authelia"
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"authentication_data_authelia_client_id": {
|
||||||
|
"type": "string",
|
||||||
|
"mandatory": false
|
||||||
|
},
|
||||||
|
"authentication_data_authelia_client_secret": {
|
||||||
|
"type": "string",
|
||||||
|
"mandatory": false
|
||||||
|
},
|
||||||
|
"authentication_data_authelia_url_base": {
|
||||||
|
"type": "string",
|
||||||
|
"mandatory": false
|
||||||
|
},
|
||||||
|
"guest_allow_create": {
|
||||||
|
"type": "boolean",
|
||||||
|
"mandatory": false
|
||||||
|
},
|
||||||
|
"guest_allow_change": {
|
||||||
|
"type": "boolean",
|
||||||
|
"mandatory": false
|
||||||
|
},
|
||||||
|
"free_names_mode": {
|
||||||
|
"type": "string",
|
||||||
|
"mandatory": false
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
@ -1,158 +0,0 @@
|
||||||
{
|
|
||||||
"nullable": false,
|
|
||||||
"type": "object",
|
|
||||||
"properties": {
|
|
||||||
"user_name": {
|
|
||||||
"nullable": false,
|
|
||||||
"type": "string",
|
|
||||||
"default": "mautrix"
|
|
||||||
},
|
|
||||||
"directory": {
|
|
||||||
"nullable": false,
|
|
||||||
"type": "string",
|
|
||||||
"default": "/opt/mautrix-signal"
|
|
||||||
},
|
|
||||||
"database": {
|
|
||||||
"nullable": false,
|
|
||||||
"type": "object",
|
|
||||||
"properties": {
|
|
||||||
"host": {
|
|
||||||
"nullable": false,
|
|
||||||
"type": "string",
|
|
||||||
"default": "localhost"
|
|
||||||
},
|
|
||||||
"port": {
|
|
||||||
"nullable": false,
|
|
||||||
"type": "integer",
|
|
||||||
"default": 5432
|
|
||||||
},
|
|
||||||
"username": {
|
|
||||||
"nullable": false,
|
|
||||||
"type": "string",
|
|
||||||
"default": "mautrix_signal_user"
|
|
||||||
},
|
|
||||||
"password": {
|
|
||||||
"nullable": false,
|
|
||||||
"type": "string"
|
|
||||||
},
|
|
||||||
"schema": {
|
|
||||||
"nullable": false,
|
|
||||||
"type": "string",
|
|
||||||
"default": "mautrix_signal"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"additionalProperties": false,
|
|
||||||
"required": [
|
|
||||||
"password"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"homeserver": {
|
|
||||||
"nullable": false,
|
|
||||||
"type": "object",
|
|
||||||
"properties": {
|
|
||||||
"address": {
|
|
||||||
"nullable": false,
|
|
||||||
"type": "string",
|
|
||||||
"default": "http://localhost:8008"
|
|
||||||
},
|
|
||||||
"domain": {
|
|
||||||
"nullable": false,
|
|
||||||
"type": "string",
|
|
||||||
"default": "synapse.example.org"
|
|
||||||
},
|
|
||||||
"conf_directory": {
|
|
||||||
"nullable": false,
|
|
||||||
"type": "string",
|
|
||||||
"default": "/etc/matrix-synapse/conf.d"
|
|
||||||
},
|
|
||||||
"appservices_directory": {
|
|
||||||
"nullable": false,
|
|
||||||
"type": "string",
|
|
||||||
"default": "/etc/matrix-synapse/appservices.d"
|
|
||||||
},
|
|
||||||
"user_name": {
|
|
||||||
"nullable": false,
|
|
||||||
"type": "string",
|
|
||||||
"default": "matrix-synapse"
|
|
||||||
},
|
|
||||||
"service_name": {
|
|
||||||
"nullable": false,
|
|
||||||
"type": "string",
|
|
||||||
"default": "matrix-synapse"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"additionalProperties": false,
|
|
||||||
"required": [
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"formats": {
|
|
||||||
"nullable": false,
|
|
||||||
"type": "object",
|
|
||||||
"properties": {
|
|
||||||
"displayname": {
|
|
||||||
"nullable": false,
|
|
||||||
"type": "string"
|
|
||||||
},
|
|
||||||
"messages": {
|
|
||||||
"nullable": false,
|
|
||||||
"type": "object",
|
|
||||||
"properties": {
|
|
||||||
"displayname": {
|
|
||||||
"nullable": false,
|
|
||||||
"type": "string"
|
|
||||||
},
|
|
||||||
"text": {
|
|
||||||
"nullable": false,
|
|
||||||
"type": "string",
|
|
||||||
"default": "<b>{{ .Sender.DisambiguatedName }}</b>: {{ .Message }}"
|
|
||||||
},
|
|
||||||
"notice": {
|
|
||||||
"nullable": false,
|
|
||||||
"type": "string",
|
|
||||||
"default": "<b>{{ .Sender.DisambiguatedName }}</b>: {{ .Message }}"
|
|
||||||
},
|
|
||||||
"emote": {
|
|
||||||
"nullable": false,
|
|
||||||
"type": "string",
|
|
||||||
"default": "* <b>{{ .Sender.DisambiguatedName }}</b> {{ .Message }}"
|
|
||||||
},
|
|
||||||
"file": {
|
|
||||||
"nullable": false,
|
|
||||||
"type": "string",
|
|
||||||
"default": "<b>{{ .Sender.DisambiguatedName }}</b> sent a file{{ if .Caption }}: {{ .Caption }}{{ end }}"
|
|
||||||
},
|
|
||||||
"image": {
|
|
||||||
"nullable": false,
|
|
||||||
"type": "string",
|
|
||||||
"default": "<b>{{ .Sender.DisambiguatedName }}</b> sent an image{{ if .Caption }}: {{ .Caption }}{{ end }}"
|
|
||||||
},
|
|
||||||
"audio": {
|
|
||||||
"nullable": false,
|
|
||||||
"type": "string",
|
|
||||||
"default": "<b>{{ .Sender.DisambiguatedName }}</b> sent an audio file{{ if .Caption }}: {{ .Caption }}{{ end }}"
|
|
||||||
},
|
|
||||||
"video": {
|
|
||||||
"nullable": false,
|
|
||||||
"type": "string",
|
|
||||||
"default": "<b>{{ .Sender.DisambiguatedName }}</b> sent a video{{ if .Caption }}: {{ .Caption }}{{ end }}"
|
|
||||||
},
|
|
||||||
"location": {
|
|
||||||
"nullable": false,
|
|
||||||
"type": "string",
|
|
||||||
"default": "<b>{{ .Sender.DisambiguatedName }}</b> sent a location{{ if .Caption }}: {{ .Caption }}{{ end }}"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"additionalProperties": false,
|
|
||||||
"required": [
|
|
||||||
]
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"additionalProperties": false,
|
|
||||||
"required": [
|
|
||||||
]
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"additionalProperties": false,
|
|
||||||
"required": [
|
|
||||||
]
|
|
||||||
}
|
|
||||||
|
|
@ -1,33 +0,0 @@
|
||||||
{
|
|
||||||
"cfg_mautrix_signal_defaults": {
|
|
||||||
"user_name": "mautrix",
|
|
||||||
"directory": "/opt/mautrix-signal",
|
|
||||||
"database": {
|
|
||||||
"host": "localhost",
|
|
||||||
"port": 5432,
|
|
||||||
"username": "mautrix_signal_user",
|
|
||||||
"schema": "mautrix_signal"
|
|
||||||
},
|
|
||||||
"homeserver": {
|
|
||||||
"address": "http://localhost:8008",
|
|
||||||
"domain": "synapse.example.org",
|
|
||||||
"conf_directory": "/etc/matrix-synapse/conf.d",
|
|
||||||
"appservices_directory": "/etc/matrix-synapse/appservices.d",
|
|
||||||
"user_name": "matrix-synapse",
|
|
||||||
"service_name": "matrix-synapse"
|
|
||||||
},
|
|
||||||
"formats": {
|
|
||||||
"displayname": "{{ .DisambiguatedName }}",
|
|
||||||
"messages": {
|
|
||||||
"text": "<b>{{ .Sender.DisambiguatedName }}</b>: {{ .Message }}",
|
|
||||||
"notice": "<b>{{ .Sender.DisambiguatedName }}</b>: {{ .Message }}",
|
|
||||||
"emote": "* <b>{{ .Sender.DisambiguatedName }}</b> {{ .Message }}",
|
|
||||||
"file": "<b>{{ .Sender.DisambiguatedName }}</b> sent a file{{ if .Caption }}: {{ .Caption }}{{ end }}",
|
|
||||||
"image": "<b>{{ .Sender.DisambiguatedName }}</b> sent an image{{ if .Caption }}: {{ .Caption }}{{ end }}",
|
|
||||||
"audio": "<b>{{ .Sender.DisambiguatedName }}</b> sent an audio file{{ if .Caption }}: {{ .Caption }}{{ end }}",
|
|
||||||
"video": "<b>{{ .Sender.DisambiguatedName }}</b> sent a video{{ if .Caption }}: {{ .Caption }}{{ end }}",
|
|
||||||
"location": "<b>{{ .Sender.DisambiguatedName }}</b> sent a location{{ if .Caption }}: {{ .Caption }}{{ end }}"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
@ -1,132 +0,0 @@
|
||||||
[
|
|
||||||
{
|
|
||||||
"name": "show vars",
|
|
||||||
"when": "switch_show_vars",
|
|
||||||
"ansible.builtin.debug": {
|
|
||||||
"var": "vars.cfg_mautrix_signal"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"name": "user",
|
|
||||||
"become": true,
|
|
||||||
"ansible.builtin.user": {
|
|
||||||
"name": "{{cfg_mautrix_signal.user_name}}",
|
|
||||||
"create_home": true,
|
|
||||||
"home": "{{cfg_mautrix_signal.directory}}"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"name": "fetch",
|
|
||||||
"ansible.builtin.block": [
|
|
||||||
{
|
|
||||||
"name": "download",
|
|
||||||
"ansible.builtin.get_url": {
|
|
||||||
"url": "https://mau.dev/mautrix/signal/-/jobs/artifacts/main/download?job=build%20amd64",
|
|
||||||
"dest": "/tmp/mautrix-signal.zip"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"name": "unpack",
|
|
||||||
"ansible.builtin.unarchive": {
|
|
||||||
"remote_src": true,
|
|
||||||
"src": "/tmp/mautrix-signal.zip",
|
|
||||||
"dest": "{{cfg_mautrix_signal.directory}}"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
]
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"name": "conf",
|
|
||||||
"ansible.builtin.block": [
|
|
||||||
{
|
|
||||||
"name": "conf | base",
|
|
||||||
"become": true,
|
|
||||||
"become_user": "{{cfg_mautrix_signal.user_name}}",
|
|
||||||
"ansible.builtin.template": {
|
|
||||||
"src": "config.yaml.j2",
|
|
||||||
"dest": "{{cfg_mautrix_signal.directory}}/config.yaml"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"name": "conf | appservice registration | generate",
|
|
||||||
"become": true,
|
|
||||||
"become_user": "{{cfg_mautrix_signal.user_name}}",
|
|
||||||
"ansible.builtin.command": {
|
|
||||||
"chdir": "{{cfg_mautrix_signal.directory}}",
|
|
||||||
"cmd": "./mautrix-signal --generate-registration --config {{cfg_mautrix_signal.directory}}/config.yaml --registration /tmp/registration.yaml"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"name": "conf | appservice registration | adjust",
|
|
||||||
"become": true,
|
|
||||||
"ansible.builtin.file": {
|
|
||||||
"path": "/tmp/registration.yaml",
|
|
||||||
"dest": "{{cfg_mautrix_signal.directory}}/registration.yaml",
|
|
||||||
"owner": "{{cfg_mautrix_signal.homeserver.user_name}}"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
]
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"name": "matrix homeserver",
|
|
||||||
"ansible.builtin.block": [
|
|
||||||
{
|
|
||||||
"name": "matrix homeserver | appservice directory",
|
|
||||||
"become": true,
|
|
||||||
"ansible.builtin.file": {
|
|
||||||
"mode": "directory",
|
|
||||||
"path": "{{cfg_mautrix_signal.homeserver.appservices_directory}}",
|
|
||||||
"owner": "{{cfg_mautrix_signal.homeserver.user_name}}"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"name": "matrix homeserver | insert appservice registration | copy to destination",
|
|
||||||
"become": true,
|
|
||||||
"ansible.builtin.copy": {
|
|
||||||
"remote_src": true,
|
|
||||||
"src": "{{cfg_mautrix_signal.directory}}/registration.yaml",
|
|
||||||
"dest": "{{cfg_mautrix_signal.homeserver.appservices_directory}}/bridge-mautrix-signal.yaml",
|
|
||||||
"owner": "{{cfg_mautrix_signal.homeserver.user_name}}"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"name": "matrix homeserver | insert appservice registration | delete source",
|
|
||||||
"become": true,
|
|
||||||
"ansible.builtin.file": {
|
|
||||||
"mode": "absent",
|
|
||||||
"path": "{{cfg_mautrix_signal.directory}}/registration.yaml"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"become": true,
|
|
||||||
"ansible.builtin.template": {
|
|
||||||
"src": "matrix-appservice.yaml.j2",
|
|
||||||
"dest": "{{cfg_mautrix_signal.homeserver.conf_directory}}/bridge-mautrix-signal.yaml",
|
|
||||||
"owner": "{{cfg_mautrix_signal.homeserver.user_name}}"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
]
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"name": "service",
|
|
||||||
"ansible.builtin.block": [
|
|
||||||
{
|
|
||||||
"name": "service | define",
|
|
||||||
"become": true,
|
|
||||||
"ansible.builtin.template": {
|
|
||||||
"src": "systemd-unit.j2",
|
|
||||||
"dest": "/etc/systemd/system/mautrix-signal.service"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"name": "service | start",
|
|
||||||
"become": true,
|
|
||||||
"ansible.builtin.systemd_service": {
|
|
||||||
"enabled": true,
|
|
||||||
"state": "started",
|
|
||||||
"name": "mautrix-signal"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
]
|
|
||||||
}
|
|
||||||
]
|
|
||||||
|
|
@ -1,500 +0,0 @@
|
||||||
# Network-specific config options
|
|
||||||
network:
|
|
||||||
# Displayname template for Signal users.
|
|
||||||
# {{.ProfileName}} - The Signal profile name set by the user.
|
|
||||||
# {{.ContactName}} - The name for the user from your phone's contact list. This is not safe on multi-user instances.
|
|
||||||
# {{.Nickname}} - The nickname set for the user in the native Signal app. This is not safe on multi-user instances.
|
|
||||||
# {{.PhoneNumber}} - The phone number of the user.
|
|
||||||
# {{.UUID}} - The UUID of the Signal user.
|
|
||||||
# {{.AboutEmoji}} - The emoji set by the user in their profile.
|
|
||||||
displayname_template: '{{or .ProfileName .PhoneNumber "Unknown user"}}'
|
|
||||||
# Should avatars from the user's contact list be used? This is not safe on multi-user instances.
|
|
||||||
use_contact_avatars: false
|
|
||||||
# Should the bridge request the user's contact list from the phone on startup?
|
|
||||||
sync_contacts_on_startup: true
|
|
||||||
# Should the bridge sync ghost user info even if profile fetching fails? This is not safe on multi-user instances.
|
|
||||||
use_outdated_profiles: false
|
|
||||||
# Should the Signal user's phone number be included in the room topic in private chat portal rooms?
|
|
||||||
number_in_topic: true
|
|
||||||
# Default device name that shows up in the Signal app.
|
|
||||||
device_name: mautrix-signal
|
|
||||||
# Avatar image for the Note to Self room.
|
|
||||||
note_to_self_avatar: mxc://maunium.net/REBIVrqjZwmaWpssCZpBlmlL
|
|
||||||
# Format for generating URLs from location messages for sending to Signal.
|
|
||||||
# Google Maps: 'https://www.google.com/maps/place/%[1]s,%[2]s'
|
|
||||||
# OpenStreetMap: 'https://www.openstreetmap.org/?mlat=%[1]s&mlon=%[2]s'
|
|
||||||
location_format: 'https://www.google.com/maps/place/%[1]s,%[2]s'
|
|
||||||
# Should view-once messages disappear shortly after sending a read receipt on Matrix?
|
|
||||||
disappear_view_once: false
|
|
||||||
# Should polls be sent using unstable MSC3381 event types?
|
|
||||||
extev_polls: false
|
|
||||||
|
|
||||||
|
|
||||||
# Config options that affect the central bridge module.
|
|
||||||
bridge:
|
|
||||||
# The prefix for commands. Only required in non-management rooms.
|
|
||||||
command_prefix: '!signal'
|
|
||||||
# Should the bridge create a space for each login containing the rooms that account is in?
|
|
||||||
personal_filtering_spaces: true
|
|
||||||
# Whether the bridge should set names and avatars explicitly for DM portals.
|
|
||||||
# This is only necessary when using clients that don't support MSC4171.
|
|
||||||
private_chat_portal_meta: true
|
|
||||||
# Should events be handled asynchronously within portal rooms?
|
|
||||||
# If true, events may end up being out of order, but slow events won't block other ones.
|
|
||||||
# This is not yet safe to use.
|
|
||||||
async_events: false
|
|
||||||
# Should every user have their own portals rather than sharing them?
|
|
||||||
# By default, users who are in the same group on the remote network will be
|
|
||||||
# in the same Matrix room bridged to that group. If this is set to true,
|
|
||||||
# every user will get their own Matrix room instead.
|
|
||||||
# SETTING THIS IS IRREVERSIBLE AND POTENTIALLY DESTRUCTIVE IF PORTALS ALREADY EXIST.
|
|
||||||
split_portals: false
|
|
||||||
# Should the bridge resend `m.bridge` events to all portals on startup?
|
|
||||||
resend_bridge_info: false
|
|
||||||
# Should `m.bridge` events be sent without a state key?
|
|
||||||
# By default, the bridge uses a unique key that won't conflict with other bridges.
|
|
||||||
no_bridge_info_state_key: false
|
|
||||||
# Should bridge connection status be sent to the management room as `m.notice` events?
|
|
||||||
# These contain the same data that can be posted to an external HTTP server using homeserver -> status_endpoint.
|
|
||||||
# Allowed values: none, errors, all
|
|
||||||
bridge_status_notices: errors
|
|
||||||
# How long after an unknown error should the bridge attempt a full reconnect?
|
|
||||||
# Must be at least 1 minute. The bridge will add an extra ±20% jitter to this value.
|
|
||||||
unknown_error_auto_reconnect: null
|
|
||||||
|
|
||||||
# Should leaving Matrix rooms be bridged as leaving groups on the remote network?
|
|
||||||
bridge_matrix_leave: false
|
|
||||||
# Should `m.notice` messages be bridged?
|
|
||||||
bridge_notices: false
|
|
||||||
# Should room tags only be synced when creating the portal? Tags mean things like favorite/pin and archive/low priority.
|
|
||||||
# Tags currently can't be synced back to the remote network, so a continuous sync means tagging from Matrix will be undone.
|
|
||||||
tag_only_on_create: true
|
|
||||||
# List of tags to allow bridging. If empty, no tags will be bridged.
|
|
||||||
only_bridge_tags: [m.favourite, m.lowpriority]
|
|
||||||
# Should room mute status only be synced when creating the portal?
|
|
||||||
# Like tags, mutes can't currently be synced back to the remote network.
|
|
||||||
mute_only_on_create: true
|
|
||||||
# Should the bridge check the db to ensure that incoming events haven't been handled before
|
|
||||||
deduplicate_matrix_messages: false
|
|
||||||
# Should cross-room reply metadata be bridged?
|
|
||||||
# Most Matrix clients don't support this and servers may reject such messages too.
|
|
||||||
cross_room_replies: false
|
|
||||||
# If a state event fails to bridge, should the bridge revert any state changes made by that event?
|
|
||||||
revert_failed_state_changes: false
|
|
||||||
# In portals with no relay set, should Matrix users be kicked if they're
|
|
||||||
# not logged into an account that's in the remote chat?
|
|
||||||
kick_matrix_users: true
|
|
||||||
|
|
||||||
# What should be done to portal rooms when a user logs out or is logged out?
|
|
||||||
# Permitted values:
|
|
||||||
# nothing - Do nothing, let the user stay in the portals
|
|
||||||
# kick - Remove the user from the portal rooms, but don't delete them
|
|
||||||
# unbridge - Remove all ghosts in the room and disassociate it from the remote chat
|
|
||||||
# delete - Remove all ghosts and users from the room (i.e. delete it)
|
|
||||||
cleanup_on_logout:
|
|
||||||
# Should cleanup on logout be enabled at all?
|
|
||||||
enabled: false
|
|
||||||
# Settings for manual logouts (explicitly initiated by the Matrix user)
|
|
||||||
manual:
|
|
||||||
# Action for private portals which will never be shared with other Matrix users.
|
|
||||||
private: nothing
|
|
||||||
# Action for portals with a relay user configured.
|
|
||||||
relayed: nothing
|
|
||||||
# Action for portals which may be shared, but don't currently have any other Matrix users.
|
|
||||||
shared_no_users: nothing
|
|
||||||
# Action for portals which have other logged-in Matrix users.
|
|
||||||
shared_has_users: nothing
|
|
||||||
# Settings for credentials being invalidated (initiated by the remote network, possibly through user action).
|
|
||||||
# Keys have the same meanings as in the manual section.
|
|
||||||
bad_credentials:
|
|
||||||
private: nothing
|
|
||||||
relayed: nothing
|
|
||||||
shared_no_users: nothing
|
|
||||||
shared_has_users: nothing
|
|
||||||
|
|
||||||
# Settings for relay mode
|
|
||||||
relay:
|
|
||||||
# Whether relay mode should be allowed. If allowed, the set-relay command can be used to turn any
|
|
||||||
# authenticated user into a relaybot for that chat.
|
|
||||||
enabled: false
|
|
||||||
# Should only admins be allowed to set themselves as relay users?
|
|
||||||
# If true, non-admins can only set users listed in default_relays as relays in a room.
|
|
||||||
admin_only: true
|
|
||||||
# List of user login IDs which anyone can set as a relay, as long as the relay user is in the room.
|
|
||||||
default_relays: []
|
|
||||||
# The formats to use when sending messages via the relaybot.
|
|
||||||
# Available variables:
|
|
||||||
# .Sender.UserID - The Matrix user ID of the sender.
|
|
||||||
# .Sender.Displayname - The display name of the sender (if set).
|
|
||||||
# .Sender.RequiresDisambiguation - Whether the sender's name may be confused with the name of another user in the room.
|
|
||||||
# .Sender.DisambiguatedName - The disambiguated name of the sender. This will be the displayname if set,
|
|
||||||
# plus the user ID in parentheses if the displayname is not unique.
|
|
||||||
# If the displayname is not set, this is just the user ID.
|
|
||||||
# .Message - The `formatted_body` field of the message.
|
|
||||||
# .Caption - The `formatted_body` field of the message, if it's a caption. Otherwise an empty string.
|
|
||||||
# .FileName - The name of the file being sent.
|
|
||||||
message_formats:
|
|
||||||
m.text: "{{cfg_mautrix_signal.formats.messages.text}}"
|
|
||||||
m.notice: "{{cfg_mautrix_signal.formats.messages.notice}}"
|
|
||||||
m.emote: "{{cfg_mautrix_signal.formats.messages.emote}}"
|
|
||||||
m.file: "{{cfg_mautrix_signal.formats.messages.file}}"
|
|
||||||
m.image: "{{cfg_mautrix_signal.formats.messages.image}}"
|
|
||||||
m.audio: "{{cfg_mautrix_signal.formats.messages.audio}}"
|
|
||||||
m.video: "{{cfg_mautrix_signal.formats.messages.video}}"
|
|
||||||
m.location: "{{cfg_mautrix_signal.formats.messages.location}}"
|
|
||||||
# For networks that support per-message displaynames (i.e. Slack and Discord), the template for those names.
|
|
||||||
# This has all the Sender variables available under message_formats (but without the .Sender prefix).
|
|
||||||
# Note that you need to manually remove the displayname from message_formats above.
|
|
||||||
displayname_format: "{{cfg_mautrix_signal.formats.displayname}}"
|
|
||||||
|
|
||||||
# Permissions for using the bridge.
|
|
||||||
# Permitted values:
|
|
||||||
# relay - Talk through the relaybot (if enabled), no access otherwise
|
|
||||||
# commands - Access to use commands in the bridge, but not login.
|
|
||||||
# user - Access to use the bridge with puppeting.
|
|
||||||
# admin - Full access, user level with some additional administration tools.
|
|
||||||
# Permitted keys:
|
|
||||||
# * - All Matrix users
|
|
||||||
# domain - All users on that homeserver
|
|
||||||
# mxid - Specific user
|
|
||||||
permissions:
|
|
||||||
"*": relay
|
|
||||||
"example.com": user
|
|
||||||
"@admin:example.com": admin
|
|
||||||
|
|
||||||
# Config for the bridge's database.
|
|
||||||
database:
|
|
||||||
# The database type. "sqlite3-fk-wal" and "postgres" are supported.
|
|
||||||
type: postgres
|
|
||||||
# The database URI.
|
|
||||||
# SQLite: A raw file path is supported, but `file:<path>?_txlock=immediate` is recommended.
|
|
||||||
# https://github.com/mattn/go-sqlite3#connection-string
|
|
||||||
# Postgres: Connection string. For example, postgres://user:password@host/database?sslmode=disable
|
|
||||||
# To connect via Unix socket, use something like postgres:///dbname?host=/var/run/postgresql
|
|
||||||
uri: postgres://{{cfg_mautrix_signal.database.username}}:{{cfg_mautrix_signal.database.password}}@{{cfg_mautrix_signal.database.host}}:{{cfg_mautrix_signal.database.port | string}}/{{cfg_mautrix_signal.database.schema}}?sslmode=disable
|
|
||||||
# Maximum number of connections.
|
|
||||||
max_open_conns: 5
|
|
||||||
max_idle_conns: 1
|
|
||||||
# Maximum connection idle time and lifetime before they're closed. Disabled if null.
|
|
||||||
# Parsed with https://pkg.go.dev/time#ParseDuration
|
|
||||||
max_conn_idle_time: null
|
|
||||||
max_conn_lifetime: null
|
|
||||||
|
|
||||||
# Homeserver details.
|
|
||||||
homeserver:
|
|
||||||
# The address that this appservice can use to connect to the homeserver.
|
|
||||||
# Local addresses without HTTPS are generally recommended when the bridge is running on the same machine,
|
|
||||||
# but https also works if they run on different machines.
|
|
||||||
address: {{cfg_mautrix_signal.homeserver.address}}
|
|
||||||
# The domain of the homeserver (also known as server_name, used for MXIDs, etc).
|
|
||||||
domain: {{cfg_mautrix_signal.homeserver.domain}}
|
|
||||||
|
|
||||||
# What software is the homeserver running?
|
|
||||||
# Standard Matrix homeservers like Synapse, Dendrite and Conduit should just use "standard" here.
|
|
||||||
software: standard
|
|
||||||
# The URL to push real-time bridge status to.
|
|
||||||
# If set, the bridge will make POST requests to this URL whenever a user's remote network connection state changes.
|
|
||||||
# The bridge will use the appservice as_token to authorize requests.
|
|
||||||
status_endpoint:
|
|
||||||
# Endpoint for reporting per-message status.
|
|
||||||
# If set, the bridge will make POST requests to this URL when processing a message from Matrix.
|
|
||||||
# It will make one request when receiving the message (step BRIDGE), one after decrypting if applicable
|
|
||||||
# (step DECRYPTED) and one after sending to the remote network (step REMOTE). Errors will also be reported.
|
|
||||||
# The bridge will use the appservice as_token to authorize requests.
|
|
||||||
message_send_checkpoint_endpoint:
|
|
||||||
# Does the homeserver support https://github.com/matrix-org/matrix-spec-proposals/pull/2246?
|
|
||||||
async_media: false
|
|
||||||
|
|
||||||
# Should the bridge use a websocket for connecting to the homeserver?
|
|
||||||
# The server side is currently not documented anywhere and is only implemented by mautrix-wsproxy,
|
|
||||||
# mautrix-asmux (deprecated), and hungryserv (proprietary).
|
|
||||||
websocket: false
|
|
||||||
# How often should the websocket be pinged? Pinging will be disabled if this is zero.
|
|
||||||
ping_interval_seconds: 0
|
|
||||||
|
|
||||||
# Application service host/registration related details.
|
|
||||||
# Changing these values requires regeneration of the registration (except when noted otherwise)
|
|
||||||
appservice:
|
|
||||||
# The address that the homeserver can use to connect to this appservice.
|
|
||||||
# Like the homeserver address, a local non-https address is recommended when the bridge is on the same machine.
|
|
||||||
# If the bridge is elsewhere, you must secure the connection yourself (e.g. with https or wireguard)
|
|
||||||
# If you want to use https, you need to use a reverse proxy. The bridge does not have TLS support built in.
|
|
||||||
address: http://localhost:29328
|
|
||||||
# A public address that external services can use to reach this appservice.
|
|
||||||
# This is only needed for things like public media. A reverse proxy is generally necessary when using this field.
|
|
||||||
# This value doesn't affect the registration file.
|
|
||||||
public_address: https://bridge.example.com
|
|
||||||
|
|
||||||
# The hostname and port where this appservice should listen.
|
|
||||||
# For Docker, you generally have to change the hostname to 0.0.0.0.
|
|
||||||
hostname: 127.0.0.1
|
|
||||||
port: 29328
|
|
||||||
|
|
||||||
# The unique ID of this appservice.
|
|
||||||
id: signal
|
|
||||||
# Appservice bot details.
|
|
||||||
bot:
|
|
||||||
# Username of the appservice bot.
|
|
||||||
username: signalbot
|
|
||||||
# Display name and avatar for bot. Set to "remove" to remove display name/avatar, leave empty
|
|
||||||
# to leave display name/avatar as-is.
|
|
||||||
displayname: Signal bridge bot
|
|
||||||
avatar: mxc://maunium.net/wPJgTQbZOtpBFmDNkiNEMDUp
|
|
||||||
|
|
||||||
# Whether to receive ephemeral events via appservice transactions.
|
|
||||||
ephemeral_events: true
|
|
||||||
# Should incoming events be handled asynchronously?
|
|
||||||
# This may be necessary for large public instances with lots of messages going through.
|
|
||||||
# However, messages will not be guaranteed to be bridged in the same order they were sent in.
|
|
||||||
# This value doesn't affect the registration file.
|
|
||||||
async_transactions: false
|
|
||||||
|
|
||||||
# Authentication tokens for AS <-> HS communication. Autogenerated; do not modify.
|
|
||||||
as_token: "This value is generated when generating the registration"
|
|
||||||
hs_token: "This value is generated when generating the registration"
|
|
||||||
|
|
||||||
# Localpart template of MXIDs for remote users.
|
|
||||||
# {{.}} is replaced with the internal ID of the user.
|
|
||||||
username_template: signal_{{.}}
|
|
||||||
|
|
||||||
# Config options that affect the Matrix connector of the bridge.
|
|
||||||
matrix:
|
|
||||||
# Whether the bridge should send the message status as a custom com.beeper.message_send_status event.
|
|
||||||
message_status_events: false
|
|
||||||
# Whether the bridge should send a read receipt after successfully bridging a message.
|
|
||||||
delivery_receipts: false
|
|
||||||
# Whether the bridge should send error notices via m.notice events when a message fails to bridge.
|
|
||||||
message_error_notices: true
|
|
||||||
# Whether the bridge should update the m.direct account data event when double puppeting is enabled.
|
|
||||||
sync_direct_chat_list: true
|
|
||||||
# Whether created rooms should have federation enabled. If false, created portal rooms
|
|
||||||
# will never be federated. Changing this option requires recreating rooms.
|
|
||||||
federate_rooms: true
|
|
||||||
# The threshold as bytes after which the bridge should roundtrip uploads via the disk
|
|
||||||
# rather than keeping the whole file in memory.
|
|
||||||
upload_file_threshold: 5242880
|
|
||||||
|
|
||||||
# Segment-compatible analytics endpoint for tracking some events, like provisioning API login and encryption errors.
|
|
||||||
analytics:
|
|
||||||
# API key to send with tracking requests. Tracking is disabled if this is null.
|
|
||||||
token: null
|
|
||||||
# Address to send tracking requests to.
|
|
||||||
url: https://api.segment.io/v1/track
|
|
||||||
# Optional user ID for tracking events. If null, defaults to using Matrix user ID.
|
|
||||||
user_id: null
|
|
||||||
|
|
||||||
# Settings for provisioning API
|
|
||||||
provisioning:
|
|
||||||
# Shared secret for authentication. If set to "generate" or null, a random secret will be generated,
|
|
||||||
# or if set to "disable", the provisioning API will be disabled. Must be at least 16 characters.
|
|
||||||
shared_secret: generate
|
|
||||||
# Whether to allow provisioning API requests to be authed using Matrix access tokens.
|
|
||||||
# This follows the same rules as double puppeting to determine which server to contact to check the token,
|
|
||||||
# which means that by default, it only works for users on the same server as the bridge.
|
|
||||||
allow_matrix_auth: true
|
|
||||||
# Enable debug API at /debug with provisioning authentication.
|
|
||||||
debug_endpoints: false
|
|
||||||
# Enable session transfers between bridges. Note that this only validates Matrix or shared secret
|
|
||||||
# auth before passing live network client credentials down in the response.
|
|
||||||
enable_session_transfers: false
|
|
||||||
|
|
||||||
# Some networks require publicly accessible media download links (e.g. for user avatars when using Discord webhooks).
|
|
||||||
# These settings control whether the bridge will provide such public media access.
|
|
||||||
public_media:
|
|
||||||
# Should public media be enabled at all?
|
|
||||||
# The public_address field under the appservice section MUST be set when enabling public media.
|
|
||||||
enabled: false
|
|
||||||
# A key for signing public media URLs.
|
|
||||||
# If set to "generate", a random key will be generated.
|
|
||||||
signing_key: generate
|
|
||||||
# Number of seconds that public media URLs are valid for.
|
|
||||||
# If set to 0, URLs will never expire.
|
|
||||||
expiry: 0
|
|
||||||
# Length of hash to use for public media URLs. Must be between 0 and 32.
|
|
||||||
hash_length: 32
|
|
||||||
# The path prefix for generated URLs. Note that this will NOT change the path where media is actually served.
|
|
||||||
# If you change this, you must configure your reverse proxy to rewrite the path accordingly.
|
|
||||||
path_prefix: /_mautrix/publicmedia
|
|
||||||
# Should the bridge store media metadata in the database in order to support encrypted media and generate shorter URLs?
|
|
||||||
# If false, the generated URLs will just have the MXC URI and a HMAC signature.
|
|
||||||
# The hash_length field will be used to decide the length of the generated URL.
|
|
||||||
# This also allows invalidating URLs by deleting the database entry.
|
|
||||||
use_database: false
|
|
||||||
|
|
||||||
# Settings for converting remote media to custom mxc:// URIs instead of reuploading.
|
|
||||||
# More details can be found at https://docs.mau.fi/bridges/go/discord/direct-media.html
|
|
||||||
direct_media:
|
|
||||||
# Should custom mxc:// URIs be used instead of reuploading media?
|
|
||||||
enabled: false
|
|
||||||
# The server name to use for the custom mxc:// URIs.
|
|
||||||
# This server name will effectively be a real Matrix server, it just won't implement anything other than media.
|
|
||||||
# You must either set up .well-known delegation from this domain to the bridge, or proxy the domain directly to the bridge.
|
|
||||||
server_name: discord-media.example.com
|
|
||||||
# Optionally a custom .well-known response. This defaults to `server_name:443`
|
|
||||||
well_known_response:
|
|
||||||
# Optionally specify a custom prefix for the media ID part of the MXC URI.
|
|
||||||
media_id_prefix:
|
|
||||||
# If the remote network supports media downloads over HTTP, then the bridge will use MSC3860/MSC3916
|
|
||||||
# media download redirects if the requester supports it. Optionally, you can force redirects
|
|
||||||
# and not allow proxying at all by setting this to false.
|
|
||||||
# This option does nothing if the remote network does not support media downloads over HTTP.
|
|
||||||
allow_proxy: true
|
|
||||||
# Matrix server signing key to make the federation tester pass, same format as synapse's .signing.key file.
|
|
||||||
# This key is also used to sign the mxc:// URIs to ensure only the bridge can generate them.
|
|
||||||
server_key: generate
|
|
||||||
|
|
||||||
# Settings for backfilling messages.
|
|
||||||
# Note that the exact way settings are applied depends on the network connector.
|
|
||||||
# See https://docs.mau.fi/bridges/general/backfill.html for more details.
|
|
||||||
backfill:
|
|
||||||
# Whether to do backfilling at all.
|
|
||||||
enabled: false
|
|
||||||
# Maximum number of messages to backfill in empty rooms.
|
|
||||||
max_initial_messages: 50
|
|
||||||
# Maximum number of missed messages to backfill after bridge restarts.
|
|
||||||
max_catchup_messages: 500
|
|
||||||
# If a backfilled chat is older than this number of hours,
|
|
||||||
# mark it as read even if it's unread on the remote network.
|
|
||||||
unread_hours_threshold: 720
|
|
||||||
# Settings for backfilling threads within other backfills.
|
|
||||||
threads:
|
|
||||||
# Maximum number of messages to backfill in a new thread.
|
|
||||||
max_initial_messages: 50
|
|
||||||
# Settings for the backwards backfill queue. This only applies when connecting to
|
|
||||||
# Beeper as standard Matrix servers don't support inserting messages into history.
|
|
||||||
queue:
|
|
||||||
# Should the backfill queue be enabled?
|
|
||||||
enabled: false
|
|
||||||
# Number of messages to backfill in one batch.
|
|
||||||
batch_size: 100
|
|
||||||
# Delay between batches in seconds.
|
|
||||||
batch_delay: 20
|
|
||||||
# Maximum number of batches to backfill per portal.
|
|
||||||
# If set to -1, all available messages will be backfilled.
|
|
||||||
max_batches: -1
|
|
||||||
# Optional network-specific overrides for max batches.
|
|
||||||
# Interpretation of this field depends on the network connector.
|
|
||||||
max_batches_override: {}
|
|
||||||
|
|
||||||
# Settings for enabling double puppeting
|
|
||||||
double_puppet:
|
|
||||||
# Servers to always allow double puppeting from.
|
|
||||||
# This is only for other servers and should NOT contain the server the bridge is on.
|
|
||||||
servers:
|
|
||||||
anotherserver.example.org: https://matrix.anotherserver.example.org
|
|
||||||
# Whether to allow client API URL discovery for other servers. When using this option,
|
|
||||||
# users on other servers can use double puppeting even if their server URLs aren't
|
|
||||||
# explicitly added to the servers map above.
|
|
||||||
allow_discovery: false
|
|
||||||
# Shared secrets for automatic double puppeting.
|
|
||||||
# See https://docs.mau.fi/bridges/general/double-puppeting.html for instructions.
|
|
||||||
secrets:
|
|
||||||
example.com: as_token:foobar
|
|
||||||
|
|
||||||
# End-to-bridge encryption support options.
|
|
||||||
#
|
|
||||||
# See https://docs.mau.fi/bridges/general/end-to-bridge-encryption.html for more info.
|
|
||||||
encryption:
|
|
||||||
# Whether to enable encryption at all. If false, the bridge will not function in encrypted rooms.
|
|
||||||
allow: false
|
|
||||||
# Whether to force-enable encryption in all bridged rooms.
|
|
||||||
default: false
|
|
||||||
# Whether to require all messages to be encrypted and drop any unencrypted messages.
|
|
||||||
require: false
|
|
||||||
# Whether to use MSC3202/MSC4203 instead of /sync long polling for receiving encryption-related data.
|
|
||||||
# This option is not yet compatible with standard Matrix servers like Synapse and should not be used.
|
|
||||||
# Changing this option requires updating the appservice registration file.
|
|
||||||
appservice: false
|
|
||||||
# Whether to use MSC4190 instead of appservice login to create the bridge bot device.
|
|
||||||
# Requires the homeserver to support MSC4190 and the device masquerading parts of MSC3202.
|
|
||||||
# Only relevant when using end-to-bridge encryption, required when using encryption with next-gen auth (MSC3861).
|
|
||||||
# Changing this option requires updating the appservice registration file.
|
|
||||||
msc4190: false
|
|
||||||
# Should the bridge bot generate a recovery key and cross-signing keys and verify itself?
|
|
||||||
# Note that without the latest version of MSC4190, this will fail if you reset the bridge database.
|
|
||||||
# The generated recovery key will be saved in the kv_store table under `recovery_key`.
|
|
||||||
self_sign: false
|
|
||||||
# Enable key sharing? If enabled, key requests for rooms where users are in will be fulfilled.
|
|
||||||
# You must use a client that supports requesting keys from other users to use this feature.
|
|
||||||
allow_key_sharing: true
|
|
||||||
# Pickle key for encrypting encryption keys in the bridge database.
|
|
||||||
# If set to generate, a random key will be generated.
|
|
||||||
pickle_key: generate
|
|
||||||
# Options for deleting megolm sessions from the bridge.
|
|
||||||
delete_keys:
|
|
||||||
# Beeper-specific: delete outbound sessions when hungryserv confirms
|
|
||||||
# that the user has uploaded the key to key backup.
|
|
||||||
delete_outbound_on_ack: false
|
|
||||||
# Don't store outbound sessions in the inbound table.
|
|
||||||
dont_store_outbound: false
|
|
||||||
# Ratchet megolm sessions forward after decrypting messages.
|
|
||||||
ratchet_on_decrypt: false
|
|
||||||
# Delete fully used keys (index >= max_messages) after decrypting messages.
|
|
||||||
delete_fully_used_on_decrypt: false
|
|
||||||
# Delete previous megolm sessions from same device when receiving a new one.
|
|
||||||
delete_prev_on_new_session: false
|
|
||||||
# Delete megolm sessions received from a device when the device is deleted.
|
|
||||||
delete_on_device_delete: false
|
|
||||||
# Periodically delete megolm sessions when 2x max_age has passed since receiving the session.
|
|
||||||
periodically_delete_expired: false
|
|
||||||
# Delete inbound megolm sessions that don't have the received_at field used for
|
|
||||||
# automatic ratcheting and expired session deletion. This is meant as a migration
|
|
||||||
# to delete old keys prior to the bridge update.
|
|
||||||
delete_outdated_inbound: false
|
|
||||||
# What level of device verification should be required from users?
|
|
||||||
#
|
|
||||||
# Valid levels:
|
|
||||||
# unverified - Send keys to all device in the room.
|
|
||||||
# cross-signed-untrusted - Require valid cross-signing, but trust all cross-signing keys.
|
|
||||||
# cross-signed-tofu - Require valid cross-signing, trust cross-signing keys on first use (and reject changes).
|
|
||||||
# cross-signed-verified - Require valid cross-signing, plus a valid user signature from the bridge bot.
|
|
||||||
# Note that creating user signatures from the bridge bot is not currently possible.
|
|
||||||
# verified - Require manual per-device verification
|
|
||||||
# (currently only possible by modifying the `trust` column in the `crypto_device` database table).
|
|
||||||
verification_levels:
|
|
||||||
# Minimum level for which the bridge should send keys to when bridging messages from the remote network to Matrix.
|
|
||||||
receive: unverified
|
|
||||||
# Minimum level that the bridge should accept for incoming Matrix messages.
|
|
||||||
send: unverified
|
|
||||||
# Minimum level that the bridge should require for accepting key requests.
|
|
||||||
share: cross-signed-tofu
|
|
||||||
# Options for Megolm room key rotation. These options allow you to configure the m.room.encryption event content.
|
|
||||||
# See https://spec.matrix.org/v1.10/client-server-api/#mroomencryption for more information about that event.
|
|
||||||
rotation:
|
|
||||||
# Enable custom Megolm room key rotation settings. Note that these
|
|
||||||
# settings will only apply to rooms created after this option is set.
|
|
||||||
enable_custom: false
|
|
||||||
# The maximum number of milliseconds a session should be used
|
|
||||||
# before changing it. The Matrix spec recommends 604800000 (a week)
|
|
||||||
# as the default.
|
|
||||||
milliseconds: 604800000
|
|
||||||
# The maximum number of messages that should be sent with a given a
|
|
||||||
# session before changing it. The Matrix spec recommends 100 as the
|
|
||||||
# default.
|
|
||||||
messages: 100
|
|
||||||
# Disable rotating keys when a user's devices change?
|
|
||||||
# You should not enable this option unless you understand all the implications.
|
|
||||||
disable_device_change_key_rotation: false
|
|
||||||
|
|
||||||
# Prefix for environment variables. All variables with this prefix must map to valid config fields.
|
|
||||||
# Nesting in variable names is represented with a dot (.).
|
|
||||||
# If there are no dots in the name, two underscores (__) are replaced with a dot.
|
|
||||||
#
|
|
||||||
# e.g. if the prefix is set to `BRIDGE_`, then `BRIDGE_APPSERVICE__AS_TOKEN` will set appservice.as_token.
|
|
||||||
# `BRIDGE_appservice.as_token` would work as well, but can't be set in a shell as easily.
|
|
||||||
#
|
|
||||||
# If this is null, reading config fields from environment will be disabled.
|
|
||||||
env_config_prefix: null
|
|
||||||
|
|
||||||
# Logging config. See https://github.com/tulir/zeroconfig for details.
|
|
||||||
logging:
|
|
||||||
min_level: debug
|
|
||||||
writers:
|
|
||||||
- type: stdout
|
|
||||||
format: pretty-colored
|
|
||||||
- type: file
|
|
||||||
format: json
|
|
||||||
filename: ./logs/bridge.log
|
|
||||||
max_size: 100
|
|
||||||
max_backups: 10
|
|
||||||
compress: false
|
|
||||||
|
|
@ -1 +0,0 @@
|
||||||
app_service_config_files: [{{cfg_mautrix_signal.homeserver.appservices_directory}}/bridge-mautrix-signal.yaml]
|
|
||||||
|
|
@ -1,12 +0,0 @@
|
||||||
[Unit]
|
|
||||||
Description=Mautrix Signal
|
|
||||||
After=multi-user.target
|
|
||||||
|
|
||||||
[Service]
|
|
||||||
WorkingDirectory={{cfg_mautrix_signal.directory}}
|
|
||||||
User={{cfg_mautrix_signal.user_name}}
|
|
||||||
ExecStart={{cfg_mautrix_signal.directory}}/mautrix-signal
|
|
||||||
SyslogIdentifier=mautrix-signal
|
|
||||||
|
|
||||||
[Install]
|
|
||||||
WantedBy=multi-user.target
|
|
||||||
|
|
@ -9,7 +9,7 @@
|
||||||
"default": null
|
"default": null
|
||||||
},
|
},
|
||||||
"dhparam_size": {
|
"dhparam_size": {
|
||||||
"nullable": true,
|
"nullable": false,
|
||||||
"type": "integer",
|
"type": "integer",
|
||||||
"default": null
|
"default": null
|
||||||
},
|
},
|
||||||
|
|
@ -21,8 +21,5 @@
|
||||||
},
|
},
|
||||||
"additionalProperties": false,
|
"additionalProperties": false,
|
||||||
"required": [
|
"required": [
|
||||||
"auto_reload_interval",
|
|
||||||
"dhparam_size",
|
|
||||||
"improved_security"
|
|
||||||
]
|
]
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -1,7 +1,6 @@
|
||||||
{
|
{
|
||||||
"cfg_nginx_defaults": {
|
"cfg_nginx_defaults": {
|
||||||
"auto_reload_interval": null,
|
"auto_reload_interval": null,
|
||||||
"dhparam_size": null,
|
"dhparam_size": 2048
|
||||||
"improved_security": false
|
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -1,31 +0,0 @@
|
||||||
{
|
|
||||||
"nullable": false,
|
|
||||||
"type": "object",
|
|
||||||
"properties": {
|
|
||||||
"domain": {
|
|
||||||
"nullable": false,
|
|
||||||
"type": "string"
|
|
||||||
},
|
|
||||||
"tls_mode": {
|
|
||||||
"nullable": false,
|
|
||||||
"type": "string",
|
|
||||||
"enum": [
|
|
||||||
"disable",
|
|
||||||
"enable",
|
|
||||||
"force"
|
|
||||||
],
|
|
||||||
"default": "force"
|
|
||||||
},
|
|
||||||
"maximum_upload_size": {
|
|
||||||
"nullable": false,
|
|
||||||
"type": "string",
|
|
||||||
"default": "1G"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"additionalProperties": false,
|
|
||||||
"required": [
|
|
||||||
"domain",
|
|
||||||
"tls_mode",
|
|
||||||
"maximum_upload_size"
|
|
||||||
]
|
|
||||||
}
|
|
||||||
|
|
@ -1,6 +1,5 @@
|
||||||
{
|
{
|
||||||
"cfg_owncloud_and_nginx_defaults": {
|
"var_owncloud_and_nginx_domain": "owncloud.example.org",
|
||||||
"tls_mode": "force",
|
"var_owncloud_and_nginx_tls_mode": "force",
|
||||||
"maximum_upload_size": "1G"
|
"var_owncloud_and_nginx_maximum_upload_size": "1G"
|
||||||
}
|
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -1,11 +1,4 @@
|
||||||
[
|
[
|
||||||
{
|
|
||||||
"name": "show vars",
|
|
||||||
"when": "switch_show_vars",
|
|
||||||
"ansible.builtin.debug": {
|
|
||||||
"var": "vars.cfg_owncloud_and_nginx"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
{
|
{
|
||||||
"name": "deactivate default site",
|
"name": "deactivate default site",
|
||||||
"become": true,
|
"become": true,
|
||||||
|
|
@ -19,7 +12,7 @@
|
||||||
"become": true,
|
"become": true,
|
||||||
"ansible.builtin.template": {
|
"ansible.builtin.template": {
|
||||||
"src": "conf.j2",
|
"src": "conf.j2",
|
||||||
"dest": "/etc/nginx/sites-available/{{cfg_owncloud_and_nginx.domain}}"
|
"dest": "/etc/nginx/sites-available/{{var_owncloud_and_nginx_domain}}"
|
||||||
}
|
}
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
|
|
@ -27,8 +20,8 @@
|
||||||
"become": true,
|
"become": true,
|
||||||
"ansible.builtin.file": {
|
"ansible.builtin.file": {
|
||||||
"state": "link",
|
"state": "link",
|
||||||
"src": "/etc/nginx/sites-available/{{cfg_owncloud_and_nginx.domain}}",
|
"src": "/etc/nginx/sites-available/{{var_owncloud_and_nginx_domain}}",
|
||||||
"dest": "/etc/nginx/sites-enabled/{{cfg_owncloud_and_nginx.domain}}"
|
"dest": "/etc/nginx/sites-enabled/{{var_owncloud_and_nginx_domain}}"
|
||||||
}
|
}
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
|
|
|
||||||
|
|
@ -1,7 +1,7 @@
|
||||||
{% macro owncloud_common() %}
|
{% macro owncloud_common() %}
|
||||||
location / {
|
location / {
|
||||||
proxy_pass http://localhost:9200;
|
proxy_pass http://localhost:9200;
|
||||||
client_max_body_size {{cfg_owncloud_and_nginx.maximum_upload_size}};
|
client_max_body_size {{var_owncloud_and_nginx_maximum_upload_size}};
|
||||||
}
|
}
|
||||||
{% endmacro %}
|
{% endmacro %}
|
||||||
|
|
||||||
|
|
@ -9,24 +9,24 @@ server {
|
||||||
listen 80;
|
listen 80;
|
||||||
listen [::]:80;
|
listen [::]:80;
|
||||||
|
|
||||||
server_name {{cfg_owncloud_and_nginx.domain}};
|
server_name {{var_owncloud_and_nginx_domain}};
|
||||||
|
|
||||||
{% if cfg_owncloud_and_nginx.tls_mode == 'force' %}
|
{% if var_owncloud_and_nginx_tls_mode == 'force' %}
|
||||||
return 301 https://$http_host$request_uri;
|
return 301 https://$http_host$request_uri;
|
||||||
{% else %}
|
{% else %}
|
||||||
{{ owncloud_common() }}
|
{{ owncloud_common() }}
|
||||||
{% endif %}
|
{% endif %}
|
||||||
}
|
}
|
||||||
|
|
||||||
{% if cfg_owncloud_and_nginx.tls_mode != 'disable' %}
|
{% if var_owncloud_and_nginx_tls_mode != 'disable' %}
|
||||||
server {
|
server {
|
||||||
listen 443 ssl;
|
listen 443 ssl;
|
||||||
listen [::]:443 ssl;
|
listen [::]:443 ssl;
|
||||||
|
|
||||||
server_name {{cfg_owncloud_and_nginx.domain}};
|
server_name {{var_owncloud_and_nginx_domain}};
|
||||||
|
|
||||||
ssl_certificate_key /etc/ssl/private/{{cfg_owncloud_and_nginx.domain}}.pem;
|
ssl_certificate_key /etc/ssl/private/{{var_owncloud_and_nginx_domain}}.pem;
|
||||||
ssl_certificate /etc/ssl/fullchains/{{cfg_owncloud_and_nginx.domain}}.pem;
|
ssl_certificate /etc/ssl/fullchains/{{var_owncloud_and_nginx_domain}}.pem;
|
||||||
include /etc/nginx/ssl-hardening.conf;
|
include /etc/nginx/ssl-hardening.conf;
|
||||||
|
|
||||||
{{ owncloud_common() }}
|
{{ owncloud_common() }}
|
||||||
|
|
|
||||||
20
roles/owncloud-and-nginx/vardef.json
Normal file
20
roles/owncloud-and-nginx/vardef.json
Normal file
|
|
@ -0,0 +1,20 @@
|
||||||
|
|
||||||
|
{
|
||||||
|
"domain": {
|
||||||
|
"type": "string",
|
||||||
|
"mandatory": false
|
||||||
|
},
|
||||||
|
"tls_mode": {
|
||||||
|
"type": "string",
|
||||||
|
"options": [
|
||||||
|
"disable",
|
||||||
|
"enable",
|
||||||
|
"force"
|
||||||
|
],
|
||||||
|
"mandatory": false
|
||||||
|
},
|
||||||
|
"maximum_upload_size": {
|
||||||
|
"type": "string",
|
||||||
|
"mandatory": false
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
@ -24,7 +24,8 @@
|
||||||
},
|
},
|
||||||
"domain": {
|
"domain": {
|
||||||
"nullable": false,
|
"nullable": false,
|
||||||
"type": "string"
|
"type": "string",
|
||||||
|
"default": "owncloud.example.org"
|
||||||
},
|
},
|
||||||
"admin_password": {
|
"admin_password": {
|
||||||
"nullable": false,
|
"nullable": false,
|
||||||
|
|
@ -38,8 +39,7 @@
|
||||||
"properties": {
|
"properties": {
|
||||||
"kind": {
|
"kind": {
|
||||||
"type": "string",
|
"type": "string",
|
||||||
"enum": ["internal"],
|
"enum": ["internal"]
|
||||||
"default": "internal"
|
|
||||||
},
|
},
|
||||||
"data": {
|
"data": {
|
||||||
"nullable": false,
|
"nullable": false,
|
||||||
|
|
@ -55,8 +55,7 @@
|
||||||
},
|
},
|
||||||
"additionalProperties": false,
|
"additionalProperties": false,
|
||||||
"required": [
|
"required": [
|
||||||
"kind",
|
"kind"
|
||||||
"data"
|
|
||||||
]
|
]
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
|
|
@ -65,8 +64,7 @@
|
||||||
"properties": {
|
"properties": {
|
||||||
"kind": {
|
"kind": {
|
||||||
"type": "string",
|
"type": "string",
|
||||||
"enum": ["authelia"],
|
"enum": ["authelia"]
|
||||||
"default": "authelia"
|
|
||||||
},
|
},
|
||||||
"data": {
|
"data": {
|
||||||
"nullable": false,
|
"nullable": false,
|
||||||
|
|
@ -88,7 +86,6 @@
|
||||||
},
|
},
|
||||||
"additionalProperties": false,
|
"additionalProperties": false,
|
||||||
"required": [
|
"required": [
|
||||||
"client_id"
|
|
||||||
],
|
],
|
||||||
"default": {
|
"default": {
|
||||||
}
|
}
|
||||||
|
|
@ -96,8 +93,7 @@
|
||||||
},
|
},
|
||||||
"additionalProperties": false,
|
"additionalProperties": false,
|
||||||
"required": [
|
"required": [
|
||||||
"url_base",
|
"url_base"
|
||||||
"web"
|
|
||||||
]
|
]
|
||||||
}
|
}
|
||||||
},
|
},
|
||||||
|
|
@ -131,8 +127,6 @@
|
||||||
},
|
},
|
||||||
"additionalProperties": false,
|
"additionalProperties": false,
|
||||||
"required": [
|
"required": [
|
||||||
"password_necessity",
|
|
||||||
"password_policy_active"
|
|
||||||
],
|
],
|
||||||
"default": {
|
"default": {
|
||||||
}
|
}
|
||||||
|
|
@ -140,13 +134,6 @@
|
||||||
},
|
},
|
||||||
"additionalProperties": false,
|
"additionalProperties": false,
|
||||||
"required": [
|
"required": [
|
||||||
"user",
|
"admin_password"
|
||||||
"directory",
|
|
||||||
"version",
|
|
||||||
"platform",
|
|
||||||
"domain",
|
|
||||||
"admin_password",
|
|
||||||
"authentication",
|
|
||||||
"public_share"
|
|
||||||
]
|
]
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -1,16 +1,18 @@
|
||||||
{
|
{
|
||||||
"cfg_owncloud_defaults": {
|
"var_owncloud_user": "owncloud",
|
||||||
"user": "owncloud",
|
"var_owncloud_directory": "/opt/owncloud",
|
||||||
"directory": "/opt/owncloud",
|
"var_owncloud_version": "5.0.0",
|
||||||
"version": "7.2.0",
|
"var_owncloud_platform": "linux-amd64",
|
||||||
"platform": "linux-amd64",
|
"var_owncloud_domain": "owncloud.example.org",
|
||||||
"domain": "owncloud.example.org",
|
"var_owncloud_admin_password": "REPLACE_ME",
|
||||||
"authentication": {
|
"var_owncloud_authentication_kind": "internal",
|
||||||
"kind": "internal"
|
"var_owncloud_authentication_data_authelia_url_base": "https://authelia.example.org",
|
||||||
},
|
"var_owncloud_authentication_data_authelia_web_client_id": "owncloud_web",
|
||||||
"public_share": {
|
"var_owncloud_authentication_data_authelia_web_client_secret": "REPLACE_ME",
|
||||||
"password_necessity": "writable",
|
"var_owncloud_authentication_data_authelia_android_client_id": "owncloud_android",
|
||||||
"password_policy_active": true
|
"var_owncloud_authentication_data_authelia_android_client_secret": "REPLACE_ME",
|
||||||
}
|
"var_owncloud_authentication_data_authelia_ios_client_id": "owncloud_ios",
|
||||||
}
|
"var_owncloud_authentication_data_authelia_ios_client_secret": "REPLACE_ME",
|
||||||
|
"var_owncloud_public_share_password_necessity": "writable",
|
||||||
|
"var_owncloud_public_share_password_policy_active": true
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -7,26 +7,13 @@ Cloud-Plattform [ownCloud](https://owncloud.com/) (the rewrite in Go named "Infi
|
||||||
|
|
||||||
- [ownCloud-Dokumentation | How to install ownCloud Infinite Scale Tech Preview in three easy steps](https://owncloud.com/news/howto-install-owncloud-infinite-scale-tech-preview/)
|
- [ownCloud-Dokumentation | How to install ownCloud Infinite Scale Tech Preview in three easy steps](https://owncloud.com/news/howto-install-owncloud-infinite-scale-tech-preview/)
|
||||||
- [ownCloud-Dokumentation | oCIS](https://owncloud.dev/ocis/)
|
- [ownCloud-Dokumentation | oCIS](https://owncloud.dev/ocis/)
|
||||||
- [ownCloud-Dokumentation | Upgrading](https://doc.owncloud.com/ocis/next/migration/upgrading-ocis.html)
|
|
||||||
- [ownCloud-Dokumentation | env var types](https://doc.owncloud.com/ocis/next/deployment/services/envvar-types-description.html)
|
|
||||||
- [ownCloud-Dokumentation | Service | Web](https://doc.owncloud.com/ocis/next/deployment/services/s-list/web.html)
|
|
||||||
- [ownCloud-Dokumentation | Service | Proxy](https://doc.owncloud.com/ocis/next/deployment/services/s-list/proxy.html)
|
- [ownCloud-Dokumentation | Service | Proxy](https://doc.owncloud.com/ocis/next/deployment/services/s-list/proxy.html)
|
||||||
|
- [ownCloud-Dokumentation | Service | Web](https://doc.owncloud.com/ocis/next/deployment/services/s-list/web.html)
|
||||||
- [ownCloud-Dokumentation | Service | Sharing](https://doc.owncloud.com/ocis/next/deployment/services/s-list/sharing.html)
|
- [ownCloud-Dokumentation | Service | Sharing](https://doc.owncloud.com/ocis/next/deployment/services/s-list/sharing.html)
|
||||||
- [GitHub | ocis](https://github.com/owncloud/ocis/)
|
- [GitHub | ocis](https://github.com/owncloud/ocis/)
|
||||||
- [ownCloud-Foren | OCIS + Authelia](https://central.owncloud.org/t/ocis-authelia/44222)
|
- [ownCloud-Foren | OCIS + Authelia](https://central.owncloud.org/t/ocis-authelia/44222)
|
||||||
|
|
||||||
|
|
||||||
## Bemerkungen
|
|
||||||
|
|
||||||
- die `.ocis/config/ocis.yaml` wird erzeugt auf Grundlage der `.env`
|
|
||||||
- `.ocis/config/ocis.yaml` sollte niemals einfach neu erstellt werden, da man sich sonst nicht mehr einloggen kann
|
|
||||||
- wenn man sich plötzlich nicht mehr über OIDC anmelden kann, kann das daran lieget, dass `.ocis/idm/ldap.crt` abgelaufen ist — siehe dazu [diesen Thread](https://central.owncloud.org/t/certificate-error-after-upgrade-to-5-0-0-from-4-0-6/47824/7); man könnte auch `OCIS_LDAP_INSECURE` auf `true` setzen, aber naja…
|
|
||||||
|
|
||||||
|
|
||||||
## ToDo
|
## ToDo
|
||||||
|
|
||||||
- Download prüfen
|
- Download prüfen
|
||||||
- `csp.yaml` einsetzen
|
|
||||||
- prüfen ob folgende `.env`-Variablen gebraucht werden:
|
|
||||||
- `PROXY_OIDC_ISSUER`
|
|
||||||
- `PROXY_OIDC_SKIP_USER_INFO`
|
|
||||||
|
|
|
||||||
|
|
@ -1,70 +1,39 @@
|
||||||
[
|
[
|
||||||
{
|
|
||||||
"name": "show vars",
|
|
||||||
"when": "switch_show_vars",
|
|
||||||
"ansible.builtin.debug": {
|
|
||||||
"var": "vars.cfg_owncloud"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
{
|
{
|
||||||
"name": "user",
|
"name": "user",
|
||||||
"become": true,
|
"become": true,
|
||||||
"ansible.builtin.user": {
|
"ansible.builtin.user": {
|
||||||
"name": "{{cfg_owncloud.user}}",
|
"name": "{{var_owncloud_user}}",
|
||||||
"create_home": true,
|
"create_home": true,
|
||||||
"home": "{{cfg_owncloud.directory}}"
|
"home": "{{var_owncloud_directory}}"
|
||||||
}
|
}
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"name": "download",
|
"name": "download",
|
||||||
"become": true,
|
"become": true,
|
||||||
"become_user": "{{cfg_owncloud.user}}",
|
"become_user": "{{var_owncloud_user}}",
|
||||||
"ansible.builtin.get_url": {
|
"ansible.builtin.get_url": {
|
||||||
"url": "https://download.owncloud.com/ocis/ocis/stable/{{cfg_owncloud.version}}/ocis-{{cfg_owncloud.version}}-{{cfg_owncloud.platform}}",
|
"url": "https://download.owncloud.com/ocis/ocis/stable/{{var_owncloud_version}}/ocis-{{var_owncloud_version}}-{{var_owncloud_platform}}",
|
||||||
"dest": "{{cfg_owncloud.directory}}/ocis",
|
"dest": "{{var_owncloud_directory}}/ocis",
|
||||||
"mode": "u+rx"
|
"mode": "u+rx"
|
||||||
}
|
}
|
||||||
},
|
},
|
||||||
{
|
|
||||||
"name": "directories",
|
|
||||||
"become": true,
|
|
||||||
"become_user": "{{cfg_owncloud.user}}",
|
|
||||||
"loop": [
|
|
||||||
"log"
|
|
||||||
],
|
|
||||||
"ansible.builtin.file": {
|
|
||||||
"state": "directory",
|
|
||||||
"recurse": true,
|
|
||||||
"path": "{{cfg_owncloud.directory}}/{{item}}"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"name": "csp",
|
|
||||||
"become": true,
|
|
||||||
"become_user": "{{cfg_owncloud.user}}",
|
|
||||||
"ansible.builtin.template": {
|
|
||||||
"src": "csp.yaml.j2",
|
|
||||||
"mode": "644",
|
|
||||||
"dest": "{{cfg_owncloud.directory}}/csp.yaml"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"name": "env",
|
|
||||||
"become": true,
|
|
||||||
"become_user": "{{cfg_owncloud.user}}",
|
|
||||||
"ansible.builtin.template": {
|
|
||||||
"src": "env.j2",
|
|
||||||
"mode": "644",
|
|
||||||
"dest": "{{cfg_owncloud.directory}}/.env"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
{
|
{
|
||||||
"name": "setup",
|
"name": "setup",
|
||||||
"become": true,
|
"become": true,
|
||||||
"become_user": "{{cfg_owncloud.user}}",
|
"become_user": "{{var_owncloud_user}}",
|
||||||
"ansible.builtin.shell": {
|
"ansible.builtin.shell": {
|
||||||
"chdir": "{{cfg_owncloud.directory}}",
|
"chdir": "{{var_owncloud_directory}}",
|
||||||
"cmd": "./ocis init --insecure no --admin-password={{cfg_owncloud.admin_password}}"
|
"cmd": "rm -f {{var_owncloud_directory}}/.ocis/config/ocis.yaml && ./ocis init --insecure no --admin-password={{var_owncloud_admin_password}}"
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"name": "configuration",
|
||||||
|
"become": true,
|
||||||
|
"become_user": "{{var_owncloud_user}}",
|
||||||
|
"ansible.builtin.template": {
|
||||||
|
"src": "env.j2",
|
||||||
|
"dest": "{{var_owncloud_directory}}/.env"
|
||||||
}
|
}
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
|
|
|
||||||
|
|
@ -1,7 +1,6 @@
|
||||||
directives:
|
directives:
|
||||||
connect-src:
|
connect-src:
|
||||||
- '''self'''
|
- '''self'''
|
||||||
- 'https://{{cfg_owncloud.domain}}'
|
|
||||||
{% if cfg_owncloud.authentication.kind == 'authelia' %}
|
{% if cfg_owncloud.authentication.kind == 'authelia' %}
|
||||||
- '{{cfg_owncloud.authentication.data.url_base}}'
|
- '{{cfg_owncloud.authentication.data.url_base}}'
|
||||||
{% endif %}
|
{% endif %}
|
||||||
|
|
|
||||||
|
|
@ -1,62 +1,44 @@
|
||||||
## web client
|
OCIS_URL="https://{{var_owncloud_domain}}"
|
||||||
WEB_LOG_LEVEL=info
|
OCIS_INSECURE="false"
|
||||||
WEB_LOG_FILE={{cfg_owncloud.directory}}/log/web
|
|
||||||
WEB_LOG_PRETTY=true
|
PROXY_TLS="false"
|
||||||
WEB_LOG_COLOR=true
|
|
||||||
{% if cfg_owncloud.authentication.kind == 'internal' %}
|
{% if var_owncloud_authentication_kind == 'internal' %}
|
||||||
{% endif %}
|
PROXY_AUTOPROVISION_ACCOUNTS="false"
|
||||||
{% if cfg_owncloud.authentication.kind == 'authelia' %}
|
|
||||||
WEB_OIDC_AUTHORITY={{cfg_owncloud.authentication.data.url_base}}
|
|
||||||
WEB_OIDC_CLIENT_ID={{cfg_owncloud.authentication.data.web.client_id}}
|
|
||||||
WEB_OIDC_RESPONSE_TYPE=code
|
|
||||||
WEB_OIDC_SCOPE=openid profile email groups
|
|
||||||
WEB_OPTION_LOGIN_URL={{cfg_owncloud.authentication.data.url_base}}
|
|
||||||
WEB_OPTION_LOGOUT_URL={{cfg_owncloud.authentication.data.url_base}}
|
|
||||||
WEB_UI_THEME_SERVER=https://{{cfg_owncloud.domain}}
|
|
||||||
WEB_UI_CONFIG_SERVER=https://{{cfg_owncloud.domain}}
|
|
||||||
{% endif %}
|
{% endif %}
|
||||||
|
|
||||||
## other clients
|
{% if var_owncloud_authentication_kind == 'authelia' %}
|
||||||
PROXY_LOG_LEVEL=info
|
OCIS_OIDC_CLIENT_ID="{{var_owncloud_authentication_data_authelia_web_client_id}}"
|
||||||
PROXY_LOG_FILE={{cfg_owncloud.directory}}/log/proxy
|
OCIS_OIDC_ISSUER="{{var_owncloud_authentication_data_authelia_url_base}}"
|
||||||
PROXY_LOG_PRETTY=true
|
|
||||||
PROXY_LOG_COLOR=true
|
PROXY_AUTOPROVISION_ACCOUNTS="true"
|
||||||
PROXY_CSP_CONFIG_FILE_LOCATION={{cfg_owncloud.directory}}/csp.yaml
|
PROXY_OIDC_REWRITE_WELLKNOWN="true"
|
||||||
PROXY_TLS=false
|
PROXY_OIDC_ACCESS_TOKEN_VERIFY_METHOD="none"
|
||||||
{% if cfg_owncloud.authentication.kind == 'internal' %}
|
PROXY_OIDC_INSECURE="false"
|
||||||
PROXY_AUTOPROVISION_ACCOUNTS=false
|
PROXY_USER_OIDC_CLAIM="name"
|
||||||
{% endif %}
|
PROXY_USER_CS3_CLAIM="username"
|
||||||
{% if cfg_owncloud.authentication.kind == 'authelia' %}
|
|
||||||
OCIS_URL=https://{{cfg_owncloud.domain}}
|
WEB_OIDC_AUTHORITY="{{var_owncloud_authentication_data_authelia_url_base}}"
|
||||||
PROXY_OIDC_ISSUER={{cfg_owncloud.authentication.data.url_base}}
|
WEB_OIDC_METADATA_URL="{{var_owncloud_authentication_data_authelia_url_base}}/.well-known/openid-configuration"
|
||||||
PROXY_OIDC_REWRITE_WELLKNOWN=true
|
WEB_OIDC_CLIENT_ID="{{var_owncloud_authentication_data_authelia_web_client_id}}"
|
||||||
PROXY_OIDC_ACCESS_TOKEN_VERIFY_METHOD=none
|
WEB_OIDC_SCOPE="openid profile email groups"
|
||||||
PROXY_OIDC_SKIP_USER_INFO=false
|
|
||||||
PROXY_AUTOPROVISION_ACCOUNTS=true
|
|
||||||
PROXY_AUTOPROVISION_CLAIM_USERNAME=preferred_username
|
|
||||||
PROXY_AUTOPROVISION_CLAIM_EMAIL=email
|
|
||||||
PROXY_AUTOPROVISION_CLAIM_DISPLAYNAME=name
|
|
||||||
PROXY_AUTOPROVISION_CLAIM_GROUPS=groups
|
|
||||||
PROXY_USER_OIDC_CLAIM=preferred_username
|
|
||||||
PROXY_USER_CS3_CLAIM=username
|
|
||||||
{% endif %}
|
{% endif %}
|
||||||
|
|
||||||
## sharing
|
{% if var_owncloud_public_share_password_necessity == 'nothing' %}
|
||||||
{% if cfg_owncloud.public_share.password_necessity == 'nothing' %}
|
OCIS_SHARING_PUBLIC_SHARE_MUST_HAVE_PASSWORD="false"
|
||||||
OCIS_SHARING_PUBLIC_SHARE_MUST_HAVE_PASSWORD=false
|
OCIS_SHARING_PUBLIC_WRITEABLE_SHARE_MUST_HAVE_PASSWORD="false"
|
||||||
OCIS_SHARING_PUBLIC_WRITEABLE_SHARE_MUST_HAVE_PASSWORD=false
|
|
||||||
{% endif %}
|
{% endif %}
|
||||||
{% if cfg_owncloud.public_share.password_necessity == 'writable' %}
|
{% if var_owncloud_public_share_password_necessity == 'writable' %}
|
||||||
OCIS_SHARING_PUBLIC_SHARE_MUST_HAVE_PASSWORD=false
|
OCIS_SHARING_PUBLIC_SHARE_MUST_HAVE_PASSWORD="false"
|
||||||
OCIS_SHARING_PUBLIC_WRITEABLE_SHARE_MUST_HAVE_PASSWORD=true
|
OCIS_SHARING_PUBLIC_WRITEABLE_SHARE_MUST_HAVE_PASSWORD="true"
|
||||||
{% endif %}
|
{% endif %}
|
||||||
{% if cfg_owncloud.public_share.password_necessity == 'all' %}
|
{% if var_owncloud_public_share_password_necessity == 'all' %}
|
||||||
OCIS_SHARING_PUBLIC_SHARE_MUST_HAVE_PASSWORD=true
|
OCIS_SHARING_PUBLIC_SHARE_MUST_HAVE_PASSWORD="true"
|
||||||
OCIS_SHARING_PUBLIC_WRITEABLE_SHARE_MUST_HAVE_PASSWORD=true
|
OCIS_SHARING_PUBLIC_WRITEABLE_SHARE_MUST_HAVE_PASSWORD="true"
|
||||||
{% endif %}
|
{% endif %}
|
||||||
{% if cfg_owncloud.public_share.password_policy_active %}
|
|
||||||
OCIS_SHARING_PASSWORD_POLICY_DISABLED=false
|
{% if var_owncloud_public_share_password_policy_active %}
|
||||||
|
OCIS_SHARING_PASSWORD_POLICY_DISABLED="false"
|
||||||
{% else %}
|
{% else %}
|
||||||
OCIS_SHARING_PASSWORD_POLICY_DISABLED=true
|
OCIS_SHARING_PASSWORD_POLICY_DISABLED="true"
|
||||||
{% endif %}
|
{% endif %}
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -3,12 +3,12 @@ Description=ownCloud
|
||||||
After=network.target
|
After=network.target
|
||||||
|
|
||||||
[Service]
|
[Service]
|
||||||
WorkingDirectory={{cfg_owncloud.directory}}
|
WorkingDirectory={{var_owncloud_directory}}
|
||||||
EnvironmentFile={{cfg_owncloud.directory}}/.env
|
EnvironmentFile={{var_owncloud_directory}}/.env
|
||||||
ExecStart={{cfg_owncloud.directory}}/ocis server
|
ExecStart={{var_owncloud_directory}}/ocis server
|
||||||
Type=simple
|
Type=simple
|
||||||
Restart=always
|
Restart=always
|
||||||
User={{cfg_owncloud.user}}
|
User={{var_owncloud_user}}
|
||||||
|
|
||||||
[Install]
|
[Install]
|
||||||
WantedBy=default.target
|
WantedBy=default.target
|
||||||
|
|
|
||||||
75
roles/owncloud/vardef.json
Normal file
75
roles/owncloud/vardef.json
Normal file
|
|
@ -0,0 +1,75 @@
|
||||||
|
{
|
||||||
|
"user": {
|
||||||
|
"type": "string",
|
||||||
|
"mandatory": false
|
||||||
|
},
|
||||||
|
"directory": {
|
||||||
|
"type": "string",
|
||||||
|
"mandatory": false
|
||||||
|
},
|
||||||
|
"version": {
|
||||||
|
"type": "string",
|
||||||
|
"mandatory": false
|
||||||
|
},
|
||||||
|
"platform": {
|
||||||
|
"type": "string",
|
||||||
|
"mandatory": false
|
||||||
|
},
|
||||||
|
"domain": {
|
||||||
|
"type": "string",
|
||||||
|
"mandatory": false
|
||||||
|
},
|
||||||
|
"admin_password": {
|
||||||
|
"type": "string",
|
||||||
|
"mandatory": true
|
||||||
|
},
|
||||||
|
"authentication_kind": {
|
||||||
|
"type": "string",
|
||||||
|
"mandatory": false,
|
||||||
|
"options": [
|
||||||
|
"internal",
|
||||||
|
"authelia"
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"authentication_data_authelia_url_base": {
|
||||||
|
"type": "string",
|
||||||
|
"mandatory": false
|
||||||
|
},
|
||||||
|
"authentication_data_authelia_web_client_id": {
|
||||||
|
"type": "string",
|
||||||
|
"mandatory": false
|
||||||
|
},
|
||||||
|
"authentication_data_authelia_web_client_secret": {
|
||||||
|
"type": "string",
|
||||||
|
"mandatory": false
|
||||||
|
},
|
||||||
|
"authentication_data_authelia_android_client_id": {
|
||||||
|
"type": "string",
|
||||||
|
"mandatory": false
|
||||||
|
},
|
||||||
|
"authentication_data_authelia_android_client_secret": {
|
||||||
|
"type": "string",
|
||||||
|
"mandatory": false
|
||||||
|
},
|
||||||
|
"authentication_data_authelia_ios_client_id": {
|
||||||
|
"type": "string",
|
||||||
|
"mandatory": false
|
||||||
|
},
|
||||||
|
"authentication_data_authelia_ios_client_secret": {
|
||||||
|
"type": "string",
|
||||||
|
"mandatory": false
|
||||||
|
},
|
||||||
|
"public_share_password_necessity": {
|
||||||
|
"type": "string",
|
||||||
|
"mandatory": false,
|
||||||
|
"options": [
|
||||||
|
"nothing",
|
||||||
|
"writable",
|
||||||
|
"all"
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"public_share_password_policy_active": {
|
||||||
|
"type": "boolean",
|
||||||
|
"mandatory": false
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
@ -39,7 +39,7 @@
|
||||||
"become_user": "postgres",
|
"become_user": "postgres",
|
||||||
"community.postgresql.postgresql_privs": {
|
"community.postgresql.postgresql_privs": {
|
||||||
"state": "present",
|
"state": "present",
|
||||||
"login_db": "{{var_postgresql_for_authelia_schema}}",
|
"db": "{{var_postgresql_for_authelia_schema}}",
|
||||||
"objs": "ALL_IN_SCHEMA",
|
"objs": "ALL_IN_SCHEMA",
|
||||||
"roles": "{{var_postgresql_for_authelia_username}}",
|
"roles": "{{var_postgresql_for_authelia_username}}",
|
||||||
"privs": "ALL",
|
"privs": "ALL",
|
||||||
|
|
|
||||||
|
|
@ -39,7 +39,7 @@
|
||||||
"become_user": "postgres",
|
"become_user": "postgres",
|
||||||
"community.postgresql.postgresql_privs": {
|
"community.postgresql.postgresql_privs": {
|
||||||
"state": "present",
|
"state": "present",
|
||||||
"login_db": "{{var_postgresql_for_forgejo_schema}}",
|
"db": "{{var_postgresql_for_forgejo_schema}}",
|
||||||
"objs": "ALL_IN_SCHEMA",
|
"objs": "ALL_IN_SCHEMA",
|
||||||
"roles": "{{var_postgresql_for_forgejo_username}}",
|
"roles": "{{var_postgresql_for_forgejo_username}}",
|
||||||
"privs": "ALL",
|
"privs": "ALL",
|
||||||
|
|
|
||||||
|
|
@ -39,7 +39,7 @@
|
||||||
"become_user": "postgres",
|
"become_user": "postgres",
|
||||||
"community.postgresql.postgresql_privs": {
|
"community.postgresql.postgresql_privs": {
|
||||||
"state": "present",
|
"state": "present",
|
||||||
"login_db": "{{var_postgresql_for_gitlab_schema}}",
|
"db": "{{var_postgresql_for_gitlab_schema}}",
|
||||||
"objs": "ALL_IN_SCHEMA",
|
"objs": "ALL_IN_SCHEMA",
|
||||||
"roles": "{{var_postgresql_for_gitlab_username}}",
|
"roles": "{{var_postgresql_for_gitlab_username}}",
|
||||||
"privs": "ALL",
|
"privs": "ALL",
|
||||||
|
|
@ -57,7 +57,7 @@
|
||||||
],
|
],
|
||||||
"community.postgresql.postgresql_ext": {
|
"community.postgresql.postgresql_ext": {
|
||||||
"state": "present",
|
"state": "present",
|
||||||
"login_db": "{{var_postgresql_for_gitlab_schema}}",
|
"db": "{{var_postgresql_for_gitlab_schema}}",
|
||||||
"name": "{{item}}"
|
"name": "{{item}}"
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -39,7 +39,7 @@
|
||||||
"become_user": "postgres",
|
"become_user": "postgres",
|
||||||
"community.postgresql.postgresql_privs": {
|
"community.postgresql.postgresql_privs": {
|
||||||
"state": "present",
|
"state": "present",
|
||||||
"login_db": "{{var_postgresql_for_hedgedoc_schema}}",
|
"db": "{{var_postgresql_for_hedgedoc_schema}}",
|
||||||
"objs": "ALL_IN_SCHEMA",
|
"objs": "ALL_IN_SCHEMA",
|
||||||
"roles": "{{var_postgresql_for_hedgedoc_username}}",
|
"roles": "{{var_postgresql_for_hedgedoc_username}}",
|
||||||
"privs": "ALL",
|
"privs": "ALL",
|
||||||
|
|
|
||||||
|
|
@ -1,24 +0,0 @@
|
||||||
{
|
|
||||||
"nullable": false,
|
|
||||||
"type": "object",
|
|
||||||
"properties": {
|
|
||||||
"username": {
|
|
||||||
"nullable": false,
|
|
||||||
"type": "string",
|
|
||||||
"default": "mautrix_signal_user"
|
|
||||||
},
|
|
||||||
"password": {
|
|
||||||
"nullable": false,
|
|
||||||
"type": "string"
|
|
||||||
},
|
|
||||||
"schema": {
|
|
||||||
"nullable": false,
|
|
||||||
"type": "string",
|
|
||||||
"default": "mautrix_signal"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"additionalProperties": false,
|
|
||||||
"required": [
|
|
||||||
"password"
|
|
||||||
]
|
|
||||||
}
|
|
||||||
|
|
@ -1,6 +0,0 @@
|
||||||
{
|
|
||||||
"cfg_postgresql_for_mautrix_signal_defaults": {
|
|
||||||
"username": "mautrix_signal_user",
|
|
||||||
"schema": "mautrix_signal"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
@ -1,49 +0,0 @@
|
||||||
[
|
|
||||||
{
|
|
||||||
"name": "packages",
|
|
||||||
"become": true,
|
|
||||||
"ansible.builtin.apt": {
|
|
||||||
"update_cache": true,
|
|
||||||
"pkg": [
|
|
||||||
"acl",
|
|
||||||
"python3-psycopg2"
|
|
||||||
]
|
|
||||||
}
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"name": "user",
|
|
||||||
"become": true,
|
|
||||||
"become_user": "postgres",
|
|
||||||
"community.postgresql.postgresql_user": {
|
|
||||||
"state": "present",
|
|
||||||
"name": "{{cfg_postgresql_for_mautrix_signal.username}}",
|
|
||||||
"password": "{{cfg_postgresql_for_mautrix_signal.password}}"
|
|
||||||
},
|
|
||||||
"environment": {
|
|
||||||
"PGOPTIONS": "-c password_encryption=scram-sha-256"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"name": "schema",
|
|
||||||
"become": true,
|
|
||||||
"become_user": "postgres",
|
|
||||||
"community.postgresql.postgresql_db": {
|
|
||||||
"state": "present",
|
|
||||||
"name": "{{cfg_postgresql_for_mautrix_signal.schema}}",
|
|
||||||
"owner": "{{cfg_postgresql_for_mautrix_signal.username}}"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"name": "rights",
|
|
||||||
"become": true,
|
|
||||||
"become_user": "postgres",
|
|
||||||
"community.postgresql.postgresql_privs": {
|
|
||||||
"state": "present",
|
|
||||||
"login_db": "{{cfg_postgresql_for_mautrix_signal.schema}}",
|
|
||||||
"objs": "ALL_IN_SCHEMA",
|
|
||||||
"roles": "{{cfg_postgresql_for_mautrix_signal.username}}",
|
|
||||||
"privs": "ALL",
|
|
||||||
"grant_option": true
|
|
||||||
}
|
|
||||||
}
|
|
||||||
]
|
|
||||||
|
|
@ -43,7 +43,7 @@
|
||||||
"become_user": "postgres",
|
"become_user": "postgres",
|
||||||
"community.postgresql.postgresql_privs": {
|
"community.postgresql.postgresql_privs": {
|
||||||
"state": "present",
|
"state": "present",
|
||||||
"login_db": "{{var_postgresql_for_synapse_schema}}",
|
"db": "{{var_postgresql_for_synapse_schema}}",
|
||||||
"objs": "ALL_IN_SCHEMA",
|
"objs": "ALL_IN_SCHEMA",
|
||||||
"roles": "{{var_postgresql_for_synapse_username}}",
|
"roles": "{{var_postgresql_for_synapse_username}}",
|
||||||
"privs": "ALL",
|
"privs": "ALL",
|
||||||
|
|
|
||||||
|
|
@ -40,7 +40,7 @@
|
||||||
"become_user": "postgres",
|
"become_user": "postgres",
|
||||||
"community.postgresql.postgresql_privs": {
|
"community.postgresql.postgresql_privs": {
|
||||||
"state": "present",
|
"state": "present",
|
||||||
"login_db": "{{var_postgresql_for_tandoor_schema}}",
|
"db": "{{var_postgresql_for_tandoor_schema}}",
|
||||||
"objs": "ALL_IN_SCHEMA",
|
"objs": "ALL_IN_SCHEMA",
|
||||||
"roles": "{{var_postgresql_for_tandoor_username}}",
|
"roles": "{{var_postgresql_for_tandoor_username}}",
|
||||||
"privs": "ALL",
|
"privs": "ALL",
|
||||||
|
|
|
||||||
|
|
@ -39,7 +39,7 @@
|
||||||
"become_user": "postgres",
|
"become_user": "postgres",
|
||||||
"community.postgresql.postgresql_privs": {
|
"community.postgresql.postgresql_privs": {
|
||||||
"state": "present",
|
"state": "present",
|
||||||
"login_db": "{{var_postgresql_for_vikunja_schema}}",
|
"db": "{{var_postgresql_for_vikunja_schema}}",
|
||||||
"objs": "ALL_IN_SCHEMA",
|
"objs": "ALL_IN_SCHEMA",
|
||||||
"roles": "{{var_postgresql_for_vikunja_username}}",
|
"roles": "{{var_postgresql_for_vikunja_username}}",
|
||||||
"privs": "ALL",
|
"privs": "ALL",
|
||||||
|
|
|
||||||
|
|
@ -39,7 +39,7 @@
|
||||||
"become_user": "postgres",
|
"become_user": "postgres",
|
||||||
"community.postgresql.postgresql_privs": {
|
"community.postgresql.postgresql_privs": {
|
||||||
"state": "present",
|
"state": "present",
|
||||||
"login_db": "{{var_postgresql_for_wiki_js_schema}}",
|
"db": "{{var_postgresql_for_wiki_js_schema}}",
|
||||||
"objs": "ALL_IN_SCHEMA",
|
"objs": "ALL_IN_SCHEMA",
|
||||||
"roles": "{{var_postgresql_for_wiki_js_username}}",
|
"roles": "{{var_postgresql_for_wiki_js_username}}",
|
||||||
"privs": "ALL",
|
"privs": "ALL",
|
||||||
|
|
|
||||||
4
roles/sqlite-for-hedgedoc/defaults/main.json
Normal file
4
roles/sqlite-for-hedgedoc/defaults/main.json
Normal file
|
|
@ -0,0 +1,4 @@
|
||||||
|
{
|
||||||
|
"var_sqlite_for_hedgedoc_path": "/var/hedgedoc/data.sqlite",
|
||||||
|
"var_sqlite_for_hedgedoc_user_name": "hedgedoc"
|
||||||
|
}
|
||||||
20
roles/sqlite-for-hedgedoc/tasks/main.json
Normal file
20
roles/sqlite-for-hedgedoc/tasks/main.json
Normal file
|
|
@ -0,0 +1,20 @@
|
||||||
|
[
|
||||||
|
{
|
||||||
|
"name": "directory",
|
||||||
|
"become": true,
|
||||||
|
"ansible.builtin.file": {
|
||||||
|
"state": "directory",
|
||||||
|
"path": "{{var_sqlite_for_hedgedoc_path | dirname}}",
|
||||||
|
"owner": "{{var_hedgedoc_user_name}}"
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"name": "file",
|
||||||
|
"become": true,
|
||||||
|
"ansible.builtin.file": {
|
||||||
|
"state": "touch",
|
||||||
|
"path": "{{var_sqlite_for_hedgedoc_path}}",
|
||||||
|
"owner": "{{var_sqlite_for_hedgedoc_user_name}}"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
]
|
||||||
10
roles/sqlite-for-hedgedoc/vardef.json
Normal file
10
roles/sqlite-for-hedgedoc/vardef.json
Normal file
|
|
@ -0,0 +1,10 @@
|
||||||
|
{
|
||||||
|
"path": {
|
||||||
|
"type": "string",
|
||||||
|
"mandatory": false
|
||||||
|
},
|
||||||
|
"user_name": {
|
||||||
|
"type": "string",
|
||||||
|
"mandatory": false
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
@ -124,7 +124,6 @@ oidc_providers:
|
||||||
localpart_template: "{{"{{"}} user.preferred_username {{"}}"}}"
|
localpart_template: "{{"{{"}} user.preferred_username {{"}}"}}"
|
||||||
display_name_template: "{{"{{"}} user.name {{"}}"}}"
|
display_name_template: "{{"{{"}} user.name {{"}}"}}"
|
||||||
email_template: "{{"{{"}} user.email {{"}}"}}"
|
email_template: "{{"{{"}} user.email {{"}}"}}"
|
||||||
user_profile_method: "userinfo_endpoint"
|
|
||||||
{% endif %}
|
{% endif %}
|
||||||
|
|
||||||
account_validity:
|
account_validity:
|
||||||
|
|
|
||||||
|
|
@ -397,7 +397,7 @@ def api_macro_save(
|
||||||
}
|
}
|
||||||
)
|
)
|
||||||
id_ = result["id"]
|
id_ = result["id"]
|
||||||
log("created record %s" % id_)
|
log("created record %u" % id_)
|
||||||
elif (count == 1):
|
elif (count == 1):
|
||||||
id_ = matching[0]["id"]
|
id_ = matching[0]["id"]
|
||||||
result = api_call(
|
result = api_call(
|
||||||
|
|
@ -410,7 +410,7 @@ def api_macro_save(
|
||||||
"content": content,
|
"content": content,
|
||||||
}
|
}
|
||||||
)
|
)
|
||||||
log("updated record %s" % id_)
|
log("updated record %u" % id_)
|
||||||
else:
|
else:
|
||||||
log("found multiple records with this name and type")
|
log("found multiple records with this name and type")
|
||||||
api_macro_logout(environment, accesstoken)
|
api_macro_logout(environment, accesstoken)
|
||||||
|
|
|
||||||
|
|
@ -1,14 +0,0 @@
|
||||||
{
|
|
||||||
"nullable": false,
|
|
||||||
"type": "object",
|
|
||||||
"properties": {
|
|
||||||
"domain": {
|
|
||||||
"nullable": false,
|
|
||||||
"type": "string"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"additionalProperties": false,
|
|
||||||
"required": [
|
|
||||||
"domain"
|
|
||||||
]
|
|
||||||
}
|
|
||||||
|
|
@ -1,4 +1,3 @@
|
||||||
{
|
{
|
||||||
"cfg_tlscert_selfsigned_defaults": {
|
"var_tlscert_selfsigned_domain": "foo.example.org"
|
||||||
}
|
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -1,11 +1,4 @@
|
||||||
[
|
[
|
||||||
{
|
|
||||||
"name": "show vars",
|
|
||||||
"when": "switch_show_vars",
|
|
||||||
"ansible.builtin.debug": {
|
|
||||||
"var": "vars.cfg_tlscert_selfsigned"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
{
|
{
|
||||||
"name": "install packages",
|
"name": "install packages",
|
||||||
"become": true,
|
"become": true,
|
||||||
|
|
@ -35,19 +28,19 @@
|
||||||
"name": "csr | generate private key",
|
"name": "csr | generate private key",
|
||||||
"become": true,
|
"become": true,
|
||||||
"community.crypto.openssl_privatekey": {
|
"community.crypto.openssl_privatekey": {
|
||||||
"path": "/etc/ssl/private/{{cfg_tlscert_selfsigned.domain}}.pem"
|
"path": "/etc/ssl/private/{{var_tlscert_selfsigned_domain}}.pem"
|
||||||
}
|
}
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"name": "csr | execute",
|
"name": "csr | execute",
|
||||||
"become": true,
|
"become": true,
|
||||||
"community.crypto.openssl_csr": {
|
"community.crypto.openssl_csr": {
|
||||||
"privatekey_path": "/etc/ssl/private/{{cfg_tlscert_selfsigned.domain}}.pem",
|
"privatekey_path": "/etc/ssl/private/{{var_tlscert_selfsigned_domain}}.pem",
|
||||||
"common_name": "{{cfg_tlscert_selfsigned.domain}}",
|
"common_name": "{{var_tlscert_selfsigned_domain}}",
|
||||||
"subject_alt_name": [
|
"subject_alt_name": [
|
||||||
"DNS:{{cfg_tlscert_selfsigned.domain}}"
|
"DNS:{{var_tlscert_selfsigned_domain}}"
|
||||||
],
|
],
|
||||||
"path": "/etc/ssl/csr/{{cfg_tlscert_selfsigned.domain}}.pem"
|
"path": "/etc/ssl/csr/{{var_tlscert_selfsigned_domain}}.pem"
|
||||||
},
|
},
|
||||||
"register": "temp_csr"
|
"register": "temp_csr"
|
||||||
},
|
},
|
||||||
|
|
@ -55,17 +48,17 @@
|
||||||
"name": "generate certificate",
|
"name": "generate certificate",
|
||||||
"become": true,
|
"become": true,
|
||||||
"community.crypto.x509_certificate": {
|
"community.crypto.x509_certificate": {
|
||||||
"privatekey_path": "/etc/ssl/private/{{cfg_tlscert_selfsigned.domain}}.pem",
|
"privatekey_path": "/etc/ssl/private/{{var_tlscert_selfsigned_domain}}.pem",
|
||||||
"csr_path": "/etc/ssl/csr/{{cfg_tlscert_selfsigned.domain}}.pem",
|
"csr_path": "/etc/ssl/csr/{{var_tlscert_selfsigned_domain}}.pem",
|
||||||
"provider": "selfsigned",
|
"provider": "selfsigned",
|
||||||
"path": "/etc/ssl/certs/{{cfg_tlscert_selfsigned.domain}}.pem"
|
"path": "/etc/ssl/certs/{{var_tlscert_selfsigned_domain}}.pem"
|
||||||
}
|
}
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"name": "compose fullchain",
|
"name": "compose fullchain",
|
||||||
"become": true,
|
"become": true,
|
||||||
"ansible.builtin.shell": {
|
"ansible.builtin.shell": {
|
||||||
"cmd": "cat /etc/ssl/certs/{{cfg_tlscert_selfsigned.domain}}.pem > /etc/ssl/fullchains/{{cfg_tlscert_selfsigned.domain}}.pem"
|
"cmd": "cat /etc/ssl/certs/{{var_tlscert_selfsigned_domain}}.pem > /etc/ssl/fullchains/{{var_tlscert_selfsigned_domain}}.pem"
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
]
|
]
|
||||||
|
|
|
||||||
179
tools/cfg-man
179
tools/cfg-man
|
|
@ -1,179 +0,0 @@
|
||||||
#!/usr/bin/env python3
|
|
||||||
|
|
||||||
import os as _os
|
|
||||||
import sys as _sys
|
|
||||||
import json as _json
|
|
||||||
import argparse as _argparse
|
|
||||||
|
|
||||||
|
|
||||||
def convey(
|
|
||||||
x,
|
|
||||||
fs
|
|
||||||
):
|
|
||||||
y = x
|
|
||||||
for f in fs:
|
|
||||||
y = f(y)
|
|
||||||
return y
|
|
||||||
|
|
||||||
|
|
||||||
def file_read(
|
|
||||||
path
|
|
||||||
):
|
|
||||||
handle = open(path, "r")
|
|
||||||
content = handle.read()
|
|
||||||
handle.close()
|
|
||||||
return content
|
|
||||||
|
|
||||||
|
|
||||||
class interface_option(object):
|
|
||||||
def is_filled(self):
|
|
||||||
raise NotImplementedError()
|
|
||||||
def cull(self):
|
|
||||||
raise NotImplementedError()
|
|
||||||
def propagate(self, function):
|
|
||||||
raise NotImplementedError()
|
|
||||||
|
|
||||||
|
|
||||||
class class_option_empty(interface_option):
|
|
||||||
def __init__(self):
|
|
||||||
pass
|
|
||||||
def is_filled(self):
|
|
||||||
return False
|
|
||||||
def cull(self):
|
|
||||||
raise ValueError("cull from empty")
|
|
||||||
def propagate(self, function):
|
|
||||||
return class_option_empty()
|
|
||||||
|
|
||||||
|
|
||||||
class class_option_filled(interface_option):
|
|
||||||
def __init__(self, value):
|
|
||||||
self.value = value
|
|
||||||
def is_filled(self):
|
|
||||||
return True
|
|
||||||
def cull(self):
|
|
||||||
return self.value
|
|
||||||
def propagate(self, function):
|
|
||||||
return function(self.value)
|
|
||||||
|
|
||||||
|
|
||||||
def generate_defaults(
|
|
||||||
schema_node
|
|
||||||
):
|
|
||||||
if ("anyOf" in schema_node):
|
|
||||||
## todo: o'rly?
|
|
||||||
return generate_defaults(schema_node["anyOf"][0])
|
|
||||||
else:
|
|
||||||
if (not ("type" in schema_node)):
|
|
||||||
raise ValueError(":?")
|
|
||||||
else:
|
|
||||||
if (not (schema_node["type"] == "object")):
|
|
||||||
if (not ("default" in schema_node)):
|
|
||||||
return class_option_empty()
|
|
||||||
else:
|
|
||||||
return class_option_filled(schema_node["default"])
|
|
||||||
else:
|
|
||||||
result = {}
|
|
||||||
for (key, value, ) in schema_node["properties"].items():
|
|
||||||
sub_result = generate_defaults(value)
|
|
||||||
if (not sub_result.is_filled()):
|
|
||||||
pass
|
|
||||||
else:
|
|
||||||
result[key] = sub_result.cull()
|
|
||||||
return class_option_filled(result)
|
|
||||||
|
|
||||||
|
|
||||||
def generate_overrides(
|
|
||||||
schema_node
|
|
||||||
):
|
|
||||||
if ("anyOf" in schema_node):
|
|
||||||
## todo: o'rly?
|
|
||||||
return generate_overrides(schema_node["anyOf"][0])
|
|
||||||
else:
|
|
||||||
if (not ("type" in schema_node)):
|
|
||||||
raise ValueError(":?")
|
|
||||||
else:
|
|
||||||
if (not (schema_node["type"] == "object")):
|
|
||||||
if ("default" in schema_node):
|
|
||||||
return class_option_empty()
|
|
||||||
else:
|
|
||||||
if ("enum" in schema_node):
|
|
||||||
return class_option_filled(schema_node["enum"][0])
|
|
||||||
else:
|
|
||||||
if (schema_node.get("nullable", False)):
|
|
||||||
return class_option_filled(None)
|
|
||||||
else:
|
|
||||||
if (schema_node["type"] == "boolean"):
|
|
||||||
return class_option_filled(False)
|
|
||||||
elif (schema_node["type"] == "integer"):
|
|
||||||
return class_option_filled(0)
|
|
||||||
elif (schema_node["type"] == "number"):
|
|
||||||
return class_option_filled(0)
|
|
||||||
elif (schema_node["type"] == "string"):
|
|
||||||
return class_option_filled("")
|
|
||||||
else:
|
|
||||||
raise ValueError("unhandled type: %s" % schema_node["type"])
|
|
||||||
else:
|
|
||||||
result = {}
|
|
||||||
for (key, value, ) in schema_node["properties"].items():
|
|
||||||
sub_result = generate_overrides(value)
|
|
||||||
if (not sub_result.is_filled()):
|
|
||||||
pass
|
|
||||||
else:
|
|
||||||
result[key] = sub_result.cull()
|
|
||||||
return (
|
|
||||||
class_option_empty()
|
|
||||||
if (len(result) <= 0) else
|
|
||||||
class_option_filled(result)
|
|
||||||
)
|
|
||||||
|
|
||||||
|
|
||||||
def role_name_derive(
|
|
||||||
role_name
|
|
||||||
):
|
|
||||||
return role_name.replace("-", "_")
|
|
||||||
|
|
||||||
|
|
||||||
def main(
|
|
||||||
):
|
|
||||||
## args
|
|
||||||
argument_parser = _argparse.ArgumentParser()
|
|
||||||
argument_parser.add_argument(
|
|
||||||
"action",
|
|
||||||
type = str,
|
|
||||||
choices = [
|
|
||||||
"defaults",
|
|
||||||
"overrides",
|
|
||||||
],
|
|
||||||
metavar = "<action>",
|
|
||||||
)
|
|
||||||
argument_parser.add_argument(
|
|
||||||
"role",
|
|
||||||
type = str,
|
|
||||||
metavar = "<role>",
|
|
||||||
)
|
|
||||||
args = argument_parser.parse_args()
|
|
||||||
|
|
||||||
## exec
|
|
||||||
cfg_schema = convey(
|
|
||||||
args.role,
|
|
||||||
[
|
|
||||||
lambda x: _os.path.join("roles", x, "cfg.schema.json"),
|
|
||||||
file_read,
|
|
||||||
_json.loads,
|
|
||||||
]
|
|
||||||
)
|
|
||||||
if args.action == "defaults":
|
|
||||||
raw = generate_defaults(cfg_schema)
|
|
||||||
key = ("cfg_%s_defaults" % (role_name_derive(args.role)))
|
|
||||||
result = {key: (raw.cull() if raw.is_filled() else {})}
|
|
||||||
_sys.stdout.write(_json.dumps(result, indent = "\t") + "\n")
|
|
||||||
elif args.action == "overrides":
|
|
||||||
raw = generate_overrides(cfg_schema)
|
|
||||||
key = ("cfg_%s_overrides" % (role_name_derive(args.role)))
|
|
||||||
result = {key: (raw.cull() if raw.is_filled() else {})}
|
|
||||||
_sys.stdout.write(_json.dumps(result, indent = "\t") + "\n")
|
|
||||||
else:
|
|
||||||
raise ValueError("invalid action: %s" % args.action)
|
|
||||||
|
|
||||||
|
|
||||||
main()
|
|
||||||
Loading…
Reference in a new issue