Matrix Server mit LDAP Anbindung

common/nginx/includes/matrix.warpzone.ms

+
+    # Urls for mxisd Server 
+
+    location /_matrix/client/r0/login {
+        proxy_pass http://127.0.0.1:18090;
+        proxy_set_header Host $host;
+        proxy_set_header X-Forwarded-For $remote_addr;
+    }
+    
+    location /_matrix/identity {
+        proxy_pass http://127.0.0.1:18090/_matrix/identity;
+        proxy_set_header Host $host;
+        proxy_set_header X-Forwarded-For $remote_addr;
+    }
+    
+
+	# Urls for Matrix Server
+
+	location /  {
+
+        	proxy_set_header        Host $host;
+        	proxy_set_header        X-Real-IP $remote_addr;
+	        proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
+        	proxy_set_header        X-Forwarded-Proto $scheme;
+            
+	        proxy_pass      http://127.0.0.1:18008/;
+        	proxy_redirect  off;
+
+    }
+

common/nginx/tasks/main.yml

@@ -51,6 +51,10 @@
     - "{{ webserver_domains }}"
  
 
+- name: Konfig-Datei matrix erstellen
+  template: src=nginx-matrix dest=/etc/nginx/sites-enabled/matrix
+  notify: restart nginx
+
 - name: Konfig-Datei status erstellen
   template: src=nginx-status dest=/etc/nginx/sites-enabled/status
   notify: restart nginx

common/nginx/templates/nginx-matrix

+
+server {
+    listen 8448 ssl default_server;
+    listen [::]:8448 ssl default_server;
+    server_name matrix.warpzone.ms;
+
+    location / {
+        proxy_pass http://127.0.0.1:18008;
+        proxy_set_header X-Forwarded-For $remote_addr;
+    }
+}

host_vars/webserver

@@ -37,6 +37,7 @@ webserver_domains:
   - "gitlab.warpzone.ms"
   - "infra.warpzone.ms"
   - "jabber.warpzone.ms"
+  - "matrix.warpzone.ms"
   - "muc.jabber.warpzone.ms"
   - "proxy.jabber.warpzone.ms"
   - "jabber-test.warpzone.ms"

webserver/docker_matrix/tasks/main.yml

+---
+
+- include_tasks: ../functions/get_secret.yml
+  with_items:
+   - { path: /srv/shared/noreply_email_pass, length: -1 }
+   - { path: /srv/ldap/secret/ldap_readonly_pass, length: -1 }
+   - { path: /srv/matrix/postgres_user_pass,  length: 24 }
+
+
+- name: create folder struct for matrix
+  file: 
+    path: "{{ item }}"
+    state: "directory"
+    owner: www-data
+    group: www-data
+  with_items:
+    - "/srv/matrix/"
+    - "/srv/matrix/db/"
+    - "/srv/matrix/mxisd-config/"
+    - "/srv/matrix/mxisd-data/"
+    - "/srv/matrix/synapse-data/"
+
+
+
+- name: Konfig-Dateien erstellen 
+  template: src={{ item }} dest=/srv/matrix/{{ item }}
+  with_items: 
+    - Dockerfile
+    - docker-compose.yml
+    - mxisd-config/mxisd.yaml
+    - synapse-data/homeserver.log.config
+    - synapse-data/homeserver.yaml
+  register: configs
+
+
+- name: stop matrix docker
+  docker_service:
+    project_src: /srv/matrix/
+    state: absent
+  when: configs.changed
+
+- name: start matrix docker
+  docker_service:
+    project_src: /srv/matrix/
+    state: present

webserver/docker_matrix/templates/Dockerfile

+FROM matrixdotorg/synapse:v0.99.3-py3 
+
+RUN apk add curl 
+RUN curl https://raw.githubusercontent.com/kamax-matrix/matrix-synapse-rest-auth/master/rest_auth_provider.py -o /usr/local/lib/python3.6/site-packages/rest_auth_provider.py

webserver/docker_matrix/templates/docker-compose.yml

+version: "3"
+
+services:
+
+  db:
+
+    image: postgres
+    restart: always
+    volumes:
+      - /srv/matrix/db:/var/lib/postgresql/data
+    environment:
+      POSTGRES_DB: synapse
+      POSTGRES_USER: synapse
+      POSTGRES_PASSWORD: {{ postgres_user_pass }} 
+
+  synapse:
+
+    build: .
+    restart: always
+    depends_on:
+      - db
+      - mxisd
+    ports:
+      - 127.0.0.1:18008:8008
+      - 127.0.0.1:18448:8448
+    volumes:
+      - /srv/matrix/synapse-data/:/data      
+    environment:
+      SYNAPSE_CONFIG_PATH: "/data/homeserver.yaml" 
+
+  mxisd:
+
+    image: kamax/mxisd:1.4.0-alpha.1
+    restart: always
+    ports:
+      - 127.0.0.1:18090:8090
+    volumes:
+      - /srv/matrix/mxisd-config/:/etc/mxisd 
+      - /srv/matrix/mxisd-data/:/var/mxisd 
+

webserver/docker_matrix/templates/mxisd-config/mxisd.yaml

+
+#######################
+# Matrix config items #
+#######################
+# Matrix domain, same as the domain configure in your Homeserver configuration.
+# NOTE: in Synapse Homeserver, the Matrix domain is defined as 'server_name' in configuration file.
+#
+# This is used to build the various identifiers in all the features.
+#
+# If the hostname of the public URL used to reach your Matrix services is different from your Matrix domain,
+# per example matrix.domain.tld vs domain.tld, then use the server.name configuration option.
+# See the "Configure" section of the Getting Started guide for more info.
+#
+matrix:
+  domain: 'matrix.warpzone.ms'
+
+
+################
+# Signing keys #
+################
+# Absolute path for the Identity Server signing keys database.
+# /!\ THIS MUST **NOT** BE YOUR HOMESERVER KEYS FILE /!\
+# If this path does not exist, it will be auto-generated.
+#
+# During testing, /var/tmp/mxisd/keys is a possible value
+# For production, recommended location shall be one of the following:
+#   - /var/lib/mxisd/keys
+#   - /var/opt/mxisd/keys
+#   - /var/local/mxisd/keys
+#
+key:
+  path: '/var/mxisd/keys'
+
+
+# Path to the SQLite DB file for mxisd internal storage
+# /!\ THIS MUST **NOT** BE YOUR HOMESERVER DATABASE /!\
+#
+# Examples:
+#  - /var/opt/mxisd/store.db
+#  - /var/local/mxisd/store.db
+#  - /var/lib/mxisd/store.db
+#
+storage:
+  provider:
+    sqlite:
+      database: '/var/mxisd/store.db'
+
+
+###################
+# Identity Stores #
+###################
+# If you are using synapse standalone and do not have an Identity store,
+# see https://github.com/kamax-matrix/mxisd/blob/master/docs/stores/synapse.md#synapse-identity-store
+#
+# If you would like to integrate with your AD/Samba/LDAP server,
+# see https://github.com/kamax-matrix/mxisd/blob/master/docs/stores/ldap.md
+#
+# For any other Identity store, or to simply discover them,
+# see https://github.com/kamax-matrix/mxisd/blob/master/docs/stores/README.md
+
+ldap:
+  enabled: true
+  connection:
+    host: '{{ ldap_ip_ext }}'
+    port: 389
+    bindDn: '{{ ldap_readonly_bind_dn }}'
+    bindPassword: '{{ ldap_readonly_pass }}'
+    baseDNs:
+      - '{{ ldap_base_dn }}'
+  filter: '(&(objectClass=inetOrgPerson)(memberof=CN=matrix-user,OU=infrastructure,DC=warpzone,DC=ms))'
+  attribute:
+    uid: 
+      type: 'uid'
+      value: 'uid'
+    name: 'cn'
+    threepid:
+      email:
+        - 'mail'
+      msisdn:
+        - 'phone'
+
+#################################################
+# Notifications for invites/addition to profile #
+#################################################
+# This is mandatory to deal with anything e-mail related.
+#
+# For an introduction to sessions, invites and 3PIDs in general,
+# see https://github.com/kamax-matrix/mxisd/blob/master/docs/threepids/session/session.md#3pid-sessions
+#
+# If you would like to change the content of the notifications,
+# see https://github.com/kamax-matrix/mxisd/blob/master/docs/threepids/notification/template-generator.md
+#
+#### E-mail connector
+threepid:
+  medium:
+    email:
+      identity:
+        # The e-mail to send as.
+        from: "matrix-identity@warpzone.ms"
+
+      connectors:
+        smtp:
+          # SMTP host
+          host: "{{ smtp_host }}"
+
+          # SMTP port
+          port: {{ smtp_port }}
+
+          # STARTLS mode for the connection.
+          # SSL/TLS is currently not supported. See https://github.com/kamax-matrix/mxisd/issues/125
+          #
+          # Possible values:
+          #  0    Disable any kind of TLS entirely
+          #  1    Enable STARTLS if supported by server (default)
+          #  2    Force STARTLS and fail if not available
+          #
+          tls: 1
+
+          # Login for SMTP
+          login: "{{ noreply_email_user }}"
+
+          # Password for the account
+          password: "{{ noreply_email_pass }}"
+
+dns:
+  overwrite:
+    homeserver:
+      client:
+        - name: 'matrix.warpzone.ms'
+          value: 'http://synapse:8008'
+
+session:
+  policy:
+    validation:
+      enabled: false

webserver/docker_matrix/templates/synapse-data/homeserver.log.config

+version: 1
+
+formatters:
+  precise:
+   format: '%(asctime)s - %(name)s - %(lineno)d - %(levelname)s - %(request)s- %(message)s'
+
+filters:
+  context:
+    (): synapse.util.logcontext.LoggingContextFilter
+    request: ""
+
+handlers:
+  console:
+    class: logging.StreamHandler
+    formatter: precise
+    filters: [context]
+
+loggers:
+    synapse:
+        level: "WARNING"
+
+    synapse.storage.SQL:
+        # beware: increasing this to DEBUG will make synapse log sensitive
+        # information such as access tokens.
+        level: "WARNING" 
+
+root:
+    level: "WARNING" 
+    handlers: [console]

webserver/main.yml

@@ -17,6 +17,7 @@
     - { role: docker_jabber, tags: jabber }
     - { role: docker_keycloak, tags: keycloak }
     - { role: docker_matterbridge, tags: matterbridge }
+    - { role: docker_matrix, tags: matrix }
     - { role: docker_warpapi, tags: warpapi }
     - { role: docker_warpinfra, tags: warpinfra }
     - { role: docker_wordpress, tags: wordpress }