host_vars/ogg

@@ -31,8 +31,16 @@ webserver_ssl: false
 
 # Liste der gehosteten Domänen
 webserver_domains:
-  - "esphome.warpzone"
-  - "unifi.warpzone"
+  - "warpsrvint.warpzone"
+  - "esphome.warpzone.lan"
+  - "fridgeserver.warpzone.lan"
+  - "grafana.warpzone.lan"
+  - "services.warpzone.lan"
+  - "ha-.warpzone.lan"
+  - "omada.warpzone.lan"
+  - "pihole.warpzone.lan"
+  - "tasmoadmin.warpzone.lan"
+  - "zigbee2mqtt.warpzone.lan"
 
 administratorenteam:
   - "void"
@@ -66,6 +74,7 @@ alert:
     - { name: "mqtt-tgfloat-1" } 
     - { name: "nodered-app-1" }
     - { name: "omada-app-1" }
+    - { name: "pihole-app-1" }
     - { name: "tasmoadmin-app-1" }
     - { name: "traefik-app-1" }
     - { name: "watchtower-app-1" }

intern/docker_homeassistant/templates/config/configuration.yaml

@@ -821,6 +821,23 @@ automation ansible:
           area_id: schnackcenter
     mode: single
 
+  - alias: ANSIBLE_ZONE_NoAutoOn_aus
+    description: ""
+    triggers: []
+    conditions: []
+    actions:
+      - action: light.turn_off
+        metadata: {}
+        data: {}
+        target:
+          area_id: NoAutoOn
+      - action: switch.turn_off
+        metadata: {}
+        data: {}
+        target:
+          area_id: NoAutoOn
+    mode: single
+
   - alias: ANSIBLE_ZONE_backcenter_an
     description: ""
     triggers: []

intern/docker_omada/templates/docker-compose.yml

@@ -5,15 +5,18 @@ services:
     image: mbentley/omada-controller:latest
     restart: always
     ports:
-      - {{ omada_port_http }}:8088
-      - {{ omada_port_https }}:8043
-      - {{ omada_portal_https }}:8843 
+      - "{{ omada_port_http }}:{{ omada_port_http }}"
+      - "{{ omada_port_https }}:{{ omada_port_https }}"
+      - "{{ omada_portal_https }}:{{ omada_portal_https }}"
       - 27001:27001/udp 
+      - 27002:27002 
       - 29810:29810/udp 
       - 29811:29811 
       - 29812:29812 
       - 29813:29813 
       - 29814:29814 
+      - 29815:29815 
+      - 29816:29816 
     sysctls:
       - net.ipv4.ip_unprivileged_port_start=0
     volumes:
@@ -34,6 +37,8 @@ services:
       PORT_DISCOVERY: 29810
       PORT_MANAGER_V1: 29811
       PORT_MANAGER_V2: 29814
+      PORT_TRANSFER_V2: 29815
+      PORT_RTTY: 29816
       PORT_UPGRADE_V1: 29813
       SHOW_SERVER_LOGS: "true"
       SHOW_MONGODB_LOGS: "false"

intern/docker_pihole/tasks/main.yml

+       
+- include_tasks: ../functions/get_secret.yml
+  with_items:
+    - { path: "{{ basedir }}/secrets/admin_password",  type: create, length: 24 }
+
+- name: "create folder struct for {{ servicename }}"
+  file:
+    path: "{{ item }}"
+    state: "directory"
+  with_items:
+    - "{{ basedir }}"
+    - "{{ basedir }}/secrets"
+    - "{{ basedir }}/etc"
+    - "{{ basedir }}/dnsmasq"
+
+- name: "create config files for {{ servicename }}"
+  template:
+    src: "{{ item }}"
+    dest: "{{ basedir }}/{{ item }}"
+  with_items:
+    - docker-compose.yml
+    - dnsmasq/09-localnet.conf
+  register: config
+
+- name: "stop {{ servicename}} docker"
+  community.docker.docker_compose_v2:
+    project_src: "{{ basedir }}"
+    state: absent
+  when: config.changed
+
+- name: "start {{ servicename}} docker"
+  community.docker.docker_compose_v2:
+    project_src: "{{ basedir }}"
+    state: present
\ No newline at end of file

intern/docker_pihole/templates/dnsmasq/09-localnet.conf

+
+# DNS Entries in the Format:
+# address=/double-click.net/127.0.0.1
+{% for domain in webserver_domains %}
+address=/{{domain}}/192.168.0.201
+{% endfor %}
\ No newline at end of file

intern/docker_pihole/templates/docker-compose.yml

+services:
+  app:
+    image: pihole/pihole:latest
+    restart: always
+    ports:
+      - "53:53/tcp"
+      - "53:53/udp"
+    volumes:
+      - "{{ basedir }}/etc:/etc/pihole"
+      - "{{ basedir }}/dnsmasq:/etc/dnsmasq.d"
+      - "/dev/null:/var/log/pihole.log"
+      - "/dev/null:/var/log/pihole-FTL.log"
+    hostname: pihole
+    environment:
+      TZ: 'Europe/Berlin'
+      TAIL_FTL_LOG: 0
+      FTLCONF_LOCAL_IPV4: '{{ int_ip4 }}'
+      WEBPASSWORD: '{{ admin_password }}'
+    labels:
+      - traefik.enable=true
+      - traefik.http.routers.{{ servicename }}.entrypoints=websecure
+      - traefik.http.routers.{{ servicename }}.rule=Host(`{{ domain }}`)
+      - traefik.http.services.{{ servicename }}.loadBalancer.server.port=80
+    networks:
+      - default
+      - web
+
+networks:
+  web:
+    external: true
\ No newline at end of file

site.yml

@@ -76,6 +76,12 @@
         basedir: "/srv/{{ servicename }}",
         domain: "md.test-warpzone.de"
       }
+    - { 
+        role: testserver/docker_matrix, tags: [ test_matrix, docker_services ],
+        servicename: "matrix",
+        basedir: "/srv/{{ servicename }}",
+        domain: "matrix.test-warpzone.de"
+      }
     - { 
         role: testserver/docker_nextcloud, tags: [ test_nextcloud, docker_services ],
         servicename: "nextcloud",
@@ -225,6 +231,12 @@
         omada_port_https: 8043,
         omada_portal_https: 8843
       }
+    - { 
+        role: intern/docker_pihole, tags: pihole,
+        servicename: pihole,
+        basedir: /srv/pihole,
+        domain: "pihole.warpzone.lan"
+      }
     - { 
         role: intern/docker_tasmoadmin, tags: [ tasmoadmin, docker_services ],
         servicename: tasmoadmin,

testserver/docker_dokuwiki/tasks/main.yml

@@ -12,6 +12,10 @@
     - "{{ basedir }}"
     - "{{ basedir }}/data"
     - "{{ basedir }}/pdftemplate"
+    - "{{ basedir }}/data/lib"
+    - "{{ basedir }}/data/lib/plugins"
+    - "{{ basedir }}/data/lib/plugins/oauth"
+    - "{{ basedir }}/data/lib/plugins/oauthgeneric"
 
 - name: Docker Compose Konfig-Datei erstellen
   template:
@@ -20,9 +24,36 @@
   with_items:
     - docker-compose.yml
     - Dockerfile
-    - authuffd_vars.php
   register: config
 
+- name: oauth plugin clonen
+  ansible.builtin.git:
+    repo: https://github.com/cosmocode/dokuwiki-plugin-oauth.git
+    dest: "{{ basedir }}/data/lib/plugins/oauth"
+    force: true
+
+- name: config für oauth kopieren
+  ansible.builtin.template:
+    src: oauth_vars.php
+    dest: "{{ basedir }}/data/lib/plugins/oauth/conf/default.php"
+
+- name: oauthgeneric plugin clonen
+  ansible.builtin.git:
+    repo: https://github.com/cosmocode/dokuwiki-plugin-oauthgeneric.git
+    dest: "{{ basedir }}/data/lib/plugins/oauthgeneric"
+    force: true
+
+- name: config für oauthgeneric kopieren
+  ansible.builtin.template:
+    src: oauthgeneric_vars.php
+    dest: "{{ basedir }}/data/lib/plugins/oauthgeneric/conf/default.php"
+
+- name: oauth provider aktivieren
+  ansible.builtin.lineinfile:
+    path: "{{ basedir }}/data/conf/local.php"
+    regexp: "^$conf['authtype'] = "
+    line: "$conf['authtype'] = 'oauth';"
+
 - name: "stop {{ servicename}} docker"
   community.docker.docker_compose_v2:
     project_src: "{{ basedir }}"

testserver/docker_dokuwiki/templates/Dockerfile

@@ -25,16 +25,6 @@ RUN apt-get update && apt-get install -y wget unzip git \
     && tar -xvzf dokuwiki-stable.tgz -C /var/www/html --strip-components=1 \
     && rm dokuwiki-stable.tgz
 
-# Plugin-Verzeichnis erstellen und das Authentifizierungs-Plugin hinzufügen
-RUN mkdir -p /var/www/html/lib/plugins/authuffd \
-    && git clone https://git.cccv.de/uffd/dokuwiki-plugin-authuffd.git /var/www/html/lib/plugins/authuffd
-
-# Konfigurationsdatei für das Plugin anpassen
-COPY authuffd_vars.php /var/www/html/lib/plugins/authuffd/conf/default.php
-
-# DokuWiki Konfiguration anpassen
-RUN echo "\$conf['authtype'] = 'authuffd';" >> /var/www/html/conf/local.php
-
 # Setzen der richtigen Berechtigungen
 RUN chown -R www-data:www-data /var/www/html
 

testserver/docker_dokuwiki/templates/authuffd_vars.php

-<?php
-
-$conf['name'] = 'uffd';
-$conf['baseurl'] = '{{ oidc_global.provider_url }}';
-$conf['oauth2_client_id'] = '{{ servicename }}';
-$conf['oauth2_client_secret'] = '{{ oauth_secret }}';
-$conf['oauth2_redirect_uri'] = '{{ domain }}/dokuwiki/doku.php?id=authredirect';
-#$conf['api_username'] = '';
-#$conf['api_password'] = '';

testserver/docker_dokuwiki/templates/oauth_vars.php

+<?php
+
+/**
+ * Default settings for the oauth plugin
+ *
+ * @author Andreas Gohr <andi@splitbrain.org>
+ */
+
+$conf['info'] = '';
+$conf['custom-redirectURI']  = '';
+$conf['mailRestriction']     = '';
+$conf['singleService']       = '';
+$conf['register-on-auth']    = 1;
+$conf['overwrite-groups']    = 0;
\ No newline at end of file

testserver/docker_dokuwiki/templates/oauthgeneric_vars.php

+<?php
+/**
+ * Default settings for the oauthgeneric plugin
+ */
+
+$conf['key'] = 'dokuwiki';
+$conf['secret'] = '{{ oauth_secret }}';
+
+$conf['authurl'] = '{{ oauth_global.authorize_url }}';
+$conf['tokenurl'] = '{{ oauth_global.token_url }}';
+$conf['userurl'] = '{{ oauth_global.userinfo_url }}';
+$conf['authmethod'] = '1';
+$conf['scopes'] = 'email, openid, profile, groups';
+$conf['needs-state'] = 0;
+
+$conf['json-user'] = 'prefered_username';
+$conf['json-name'] = 'name';
+$conf['json-mail'] = 'email';
+$conf['json-grps'] = 'groups';
+
+$conf['label'] = 'uffd';
+$conf['color'] = '#ff3d00';
\ No newline at end of file

testserver/docker_matrix/tasks/main.yml

@@ -3,7 +3,10 @@
 - include_tasks: ../functions/get_secret.yml
   with_items:
    - { path: /srv/shared/noreply_email_pass, length: -1 }
-   - { path: /srv/ldap/secret/ldap_readonly_pass, length: -1 }
+   - { path: /srv/matrix/matrix_macaroon_secret_key, length: 32 }
+   - { path: /srv/matrix/matrix_registration_shared_secret, length: 32 }
+   - { path: /srv/matrix/matrix_form_secret, length: 32 }
+   - { path: /srv/matrix/matrix_oidc_secret, length: 32 }
    - { path: /srv/matrix/postgres_user_pass,  length: 24 }
    - { path: /srv/matrix/admin_access_token,  length: -1 } # Get in Element fo an Admin User: Settings > Help > Advanced 
 
@@ -16,8 +19,6 @@
     group: www-data
   with_items:
     - "/srv/matrix/"
-    - "/srv/matrix/ma1sd-config/"
-    - "/srv/matrix/ma1sd-data/"
     - "/srv/matrix/synapse-data/"
 
 
@@ -37,8 +38,6 @@
     dest: "/srv/matrix/{{ item }}"
   with_items:
     - docker-compose.yml
-    - rest_auth_provider.py
-    - ma1sd-config/ma1sd.yaml
     - synapse-data/homeserver.log.config
     - synapse-data/homeserver.yaml
   register: configs

testserver/docker_matrix/templates/README

-the rest-auth_provider is from https://githubcom/ma1uta/matrix-synapse-rest-password-provider/
+
+Funktionierende oidc-Konfiguration mit authentik
+  - https://www.youtube.com/watch?v=MwOh4NvPdtQ
+  - https://github.com/matrix-org/tutorial-oidc-playground
+

testserver/docker_matrix/templates/docker-compose.yml

@@ -23,6 +23,7 @@ services:
     networks:
       - default
 
+
   synapse:
 
     image: matrixdotorg/synapse:latest
@@ -31,11 +32,8 @@ services:
     cpuset: "0"
     depends_on:
       - db
-      - ma1sd
     volumes:
       - /srv/matrix/synapse-data/:/data
-      # Python version can be found in the dockerfile: https://github.com/matrix-org/synapse/blob/develop/docker/Dockerfile check for tag to get the correct version
-      - /srv/matrix/rest_auth_provider.py:/usr/local/lib/python3.11/site-packages/rest_auth_provider.py
     environment:
       SYNAPSE_CONFIG_PATH: "/data/homeserver.yaml"
       TZ: "Europe/Berlin"
@@ -53,23 +51,6 @@ services:
       - default
       - web
 
-  ma1sd:
-
-    image: ma1uta/ma1sd:2.5.0
-    restart: always
-    volumes:
-      - /srv/matrix/ma1sd-config/:/etc/ma1sd
-      - /srv/matrix/ma1sd-data/:/var/ma1sd
-    labels:
-      - com.centurylinklabs.watchtower.enable=false
-      - traefik.enable=true
-      - traefik.http.routers.{{ servicename }}-ma1sd.rule=((Host(`{{ domain }}`) && PathPrefix(`/_matrix/client/r0/login`)) || (Host(`{{ domain }}`) && PathPrefix(`/_matrix/identity`)))
-      - traefik.http.routers.{{ servicename }}-ma1sd.entrypoints=websecure
-      - traefik.http.services.{{ servicename }}-ma1sd.loadbalancer.server.port=8090
-    networks:
-      - default
-      - web
-
 
   purgemediacache:
     

testserver/docker_matrix/templates/ma1sd-config/ma1sd.yaml

-
-#######################
-# Matrix config items #
-#######################
-# Matrix domain, same as the domain configure in your Homeserver configuration.
-# NOTE: in Synapse Homeserver, the Matrix domain is defined as 'server_name' in configuration file.
-#
-# This is used to build the various identifiers in all the features.
-#
-# If the hostname of the public URL used to reach your Matrix services is different from your Matrix domain,
-# per example matrix.domain.tld vs domain.tld, then use the server.name configuration option.
-# See the "Configure" section of the Getting Started guide for more info.
-#
-matrix:
-  domain: 'matrix.warpzone.ms'
-  v1: true   # deprecated
-  v2: true   # MSC2140 API v2. Riot require enabled V2 API.
-
-
-################
-# Signing keys #
-################
-# Absolute path for the Identity Server signing keys database.
-# /!\ THIS MUST **NOT** BE YOUR HOMESERVER KEYS FILE /!\
-# If this path does not exist, it will be auto-generated.
-#
-# During testing, /var/tmp/ma1sd/keys is a possible value
-# For production, recommended location shall be one of the following:
-#   - /var/lib/ma1sd/keys
-#   - /var/opt/ma1sd/keys
-#   - /var/local/ma1sd/keys
-#
-key:
-  path: '/var/ma1sd/keys'
-
-
-# Path to the SQLite DB file for ma1sd internal storage
-# /!\ THIS MUST **NOT** BE YOUR HOMESERVER DATABASE /!\
-#
-# Examples:
-#  - /var/opt/ma1sd/store.db
-#  - /var/local/ma1sd/store.db
-#  - /var/lib/ma1sd/store.db
-#
-storage:
-# backend: sqlite # or postgresql
-  provider:
-    sqlite:
-      database: '/var/ma1sd/store.db'
-#    postgresql:
-#      # Wrap all string values with quotes to avoid yaml parsing mistakes
-#      database: '//localhost/ma1sd' # or full variant //192.168.1.100:5432/ma1sd_database
-#      username: 'ma1sd_user'
-#      password: 'ma1sd_password'
-#
-#      # Pool configuration for postgresql backend.
-#      #######
-#      # Enable or disable pooling
-#      pool: false
-#
-#      #######
-#      # Check database connection before get from pool
-#      testBeforeGetFromPool: false # or true
-#
-#      #######
-#      # There is an internal thread which checks each of the database connections as a keep-alive mechanism. This set the
-#      # number of milliseconds it sleeps between checks -- default is 30000. To disable the checking thread, set this to
-#      # 0 before you start using the connection source.
-#      checkConnectionsEveryMillis: 30000
-#
-#      #######
-#      # Set the number of connections that can be unused in the available list.
-#      maxConnectionsFree: 5
-#
-#      #######
-#      # Set the number of milliseconds that a connection can stay open before being closed. Set to 9223372036854775807 to have
-#      # the connections never expire.
-#      maxConnectionAgeMillis: 3600000
-
-###################
-# Identity Stores #
-###################
-# If you are using synapse standalone and do not have an Identity store,
-# see https://github.com/ma1uta/ma1sd/blob/master/docs/stores/synapse.md#synapse-identity-store
-#
-# If you would like to integrate with your AD/Samba/LDAP server,
-# see https://github.com/ma1uta/ma1sd/blob/master/docs/stores/ldap.md
-#
-# For any other Identity store, or to simply discover them,
-# see https://github.com/ma1uta/ma1sd/blob/master/docs/stores/README.md
-
-ldap:
-  enabled: true
-  connection:
-    host: '{{ ldap_ip_ext }}'
-    port: 389
-    bindDn: '{{ ldap_readonly_bind_dn }}'
-    bindPassword: '{{ ldap_readonly_pass }}'
-    baseDNs:
-      - '{{ ldap_base_dn }}'
-  filter: '(&(objectClass=inetOrgPerson)(memberof=CN=active,OU=groups,DC=warpzone,DC=ms))'
-  attribute:
-    uid:
-      type: 'uid'
-      value: 'uid'
-    name: 'uid'
-    threepid:
-      email:
-        - 'mail'
-      msisdn:
-        - 'phone'
-
-#################################################
-# Notifications for invites/addition to profile #
-#################################################
-# This is mandatory to deal with anything e-mail related.
-#
-# For an introduction to sessions, invites and 3PIDs in general,
-# see https://github.com/ma1uta/ma1sd/blob/master/docs/threepids/session/session.md#3pid-sessions
-#
-# If you would like to change the content of the notifications,
-# see https://github.com/ma1uta/ma1sd/blob/master/docs/threepids/notification/template-generator.md
-#
-#### E-mail connector
-threepid:
-  medium:
-    email:
-      identity:
-        # The e-mail to send as.
-        from: "matrix-identity@warpzone.ms"
-
-      connectors:
-        smtp:
-          # SMTP host
-          host: "{{ smtp_host }}"
-
-          # TLS mode for the connection
-          # Possible values:
-          #  0    Disable any kind of TLS entirely
-          #  1    Enable STARTLS if supported by server (default)
-          #  2    Force STARTLS and fail if not available
-          #  3    Use full TLS/SSL instead of STARTLS
-          #
-          tls: 1
-
-          # SMTP port
-          # Be sure to adapt depending on your TLS choice, if changed from default
-          port: "{{ smtp_port }}"
-
-          # Login for SMTP
-          login: "{{ noreply_email_user }}"
-
-          # Password for the account
-          password:  "{{ noreply_email_pass }}"
-
-
-#### MSC2134 (hash lookup)
-
-#hashing:
-#  enabled: false # enable or disable the hash lookup MSC2140 (default is false)
-#  pepperLength: 20 # length of the pepper value (default is 20)
-#  rotationPolicy: per_requests # or `per_seconds` how often the hashes will be updating
-#  hashStorageType: sql # or `in_memory` where the hashes will be stored
-#  algorithms:
-#    - none   # the same as v1 bulk lookup
-#    - sha256 # hash the 3PID and pepper.
-#  delay: 2m # how often hashes will be updated if rotation policy = per_seconds (default is 10s)
-#  requests: 10 # how many lookup requests will be performed before updating hashes if rotation policy = per_requests (default is 10)
-
-### hash lookup for synapseSql provider.
-# synapseSql:
-#   lookup:
-#     query: 'select user_id as mxid, medium, address from user_threepid_id_server' # query for retrive 3PIDs for hashes.
-#   legacyRoomNames: false  # use the old query to get room names.
-
-### hash lookup for ldap provider (with example of the ldap configuration)
-# ldap:
-#   enabled: true
-#   lookup: true # hash lookup
-#   activeDirectory: false
-#   defaultDomain: ''
-#   connection:
-#     host: 'ldap.domain.tld'
-#     port: 389
-#     bindDn: 'cn=admin,dc=domain,dc=tld'
-#     bindPassword: 'Secret'
-#     baseDNs:
-#       - 'dc=domain,dc=tld'
-#   attribute:
-#     uid:
-#       type: 'uid' # or mxid
-#       value: 'cn'
-#     name: 'displayName'
-#   identity:
-#     filter: '(objectClass=inetOrgPerson)'
-
-#### MSC2140 (Terms)
-#policy:
-#  policies:
-#    term_name: # term name
-#      version: 1.0 # version
-#      terms:
-#        en:  # lang
-#          name: term name en  # localized name
-#          url: https://ma1sd.host.tld/term_en.html  # localized url
-#        fe:  # lang
-#          name: term name fr  # localized name
-#          url: https://ma1sd.host.tld/term_fr.html  # localized url
-#      regexp:
-#        - '/_matrix/identity/v2/account.*'
-#        - '/_matrix/identity/v2/hash_details'
-#        - '/_matrix/identity/v2/lookup'
-#
-
-# logging:
-#   root: error     # default level for all loggers (apps and thirdparty libraries)
-#   app: info       # log level only for the ma1sd
-#   requests: false # or true to dump full requests and responses
-
-dns:
-  overwrite:
-    homeserver:
-      client:
-        - name: 'matrix.warpzone.ms'
-          value: 'http://synapse:8008'
-
-
-session:
-  policy:
-    validation:
-      enabled: false

testserver/docker_matrix/templates/rest_auth_provider.py

-# -*- coding: utf-8 -*-
-#
-# REST endpoint Authentication module for Matrix synapse
-# Copyright (C) 2017 Kamax Sarl
-#
-# https://www.kamax.io/
-#
-# This program is free software: you can redistribute it and/or modify
-# it under the terms of the GNU Affero General Public License as
-# published by the Free Software Foundation, either version 3 of the
-# License, or (at your option) any later version.
-#
-# This program is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU Affero General Public License for more details.
-#
-# You should have received a copy of the GNU Affero General Public License
-# along with this program.  If not, see <http://www.gnu.org/licenses/>.
-#
-
-import logging
-from twisted.internet import defer
-import requests
-import json
-import time
-
-logger = logging.getLogger(__name__)
-
-
-class RestAuthProvider(object):
-
-    def __init__(self, config, account_handler):
-        self.account_handler = account_handler
-
-        if not config.endpoint:
-            raise RuntimeError('Missing endpoint config')
-
-        self.endpoint = config.endpoint
-        self.regLower = config.regLower
-        self.config = config
-
-        logger.info('Endpoint: %s', self.endpoint)
-        logger.info('Enforce lowercase username during registration: %s', self.regLower)
-
-    @defer.inlineCallbacks
-    def check_password(self, user_id, password):
-        logger.info("Got password check for " + user_id)
-        data = {'user': {'id': user_id, 'password': password}}
-        r = requests.post(self.endpoint + '/_matrix-internal/identity/v1/check_credentials', json=data)
-        r.raise_for_status()
-        r = r.json()
-        if not r["auth"]:
-            reason = "Invalid JSON data returned from REST endpoint"
-            logger.warning(reason)
-            raise RuntimeError(reason)
-
-        auth = r["auth"]
-        if not auth["success"]:
-            logger.info("User not authenticated")
-            defer.returnValue(False)
-
-        localpart = user_id.split(":", 1)[0][1:]
-        logger.info("User %s authenticated", user_id)
-
-        registration = False
-        if not (yield self.account_handler.check_user_exists(user_id)):
-            logger.info("User %s does not exist yet, creating...", user_id)
-
-            if localpart != localpart.lower() and self.regLower:
-                logger.info('User %s was cannot be created due to username lowercase policy', localpart)
-                defer.returnValue(False)
-
-            user_id, access_token = (yield self.account_handler.register(localpart=localpart))
-            registration = True
-            logger.info("Registration based on REST data was successful for %s", user_id)
-        else:
-            logger.info("User %s already exists, registration skipped", user_id)
-
-        if auth["profile"]:
-            logger.info("Handling profile data")
-            profile = auth["profile"]
-
-            # fixme: temporary fix
-            try:
-                store = yield self.account_handler._hs.get_profile_handler().store  # for synapse >= 1.9.0
-            except AttributeError:
-                store = yield self.account_handler.hs.get_profile_handler().store   # for synapse < 1.9.0
-
-            if "display_name" in profile and ((registration and self.config.setNameOnRegister) or (self.config.setNameOnLogin)):
-                display_name = profile["display_name"]
-                logger.info("Setting display name to '%s' based on profile data", display_name)
-                yield store.set_profile_displayname(localpart, display_name)
-            else:
-                logger.info("Display name was not set because it was not given or policy restricted it")
-
-            if (self.config.updateThreepid):
-                if "three_pids" in profile:
-                    logger.info("Handling 3PIDs")
-
-                    external_3pids = []
-                    for threepid in profile["three_pids"]:
-                        medium = threepid["medium"].lower()
-                        address = threepid["address"].lower()
-                        external_3pids.append({"medium": medium, "address": address})
-                        logger.info("Looking for 3PID %s:%s in user profile", medium, address)
-
-                        validated_at = time_msec()
-                        if not (yield store.get_user_id_by_threepid(medium, address)):
-                            logger.info("3PID is not present, adding")
-                            yield store.user_add_threepid(
-                                user_id,
-                                medium,
-                                address,
-                                validated_at,
-                                validated_at
-                            )
-                        else:
-                            logger.info("3PID is present, skipping")
-
-                    if (self.config.replaceThreepid):
-                        for threepid in (yield store.user_get_threepids(user_id)):
-                            medium = threepid["medium"].lower()
-                            address = threepid["address"].lower()
-                            if {"medium": medium, "address": address} not in external_3pids:
-                                logger.info("3PID is not present in external datastore, deleting")
-                                yield store.user_delete_threepid(
-                                    user_id,
-                                    medium,
-                                    address
-                                )
-
-            else:
-                logger.info("3PIDs were not updated due to policy")
-        else:
-            logger.info("No profile data")
-
-        defer.returnValue(True)
-
-    @staticmethod
-    def parse_config(config):
-        # verify config sanity
-        _require_keys(config, ["endpoint"])
-
-        class _RestConfig(object):
-            endpoint = ''
-            regLower = True
-            setNameOnRegister = True
-            setNameOnLogin = False
-            updateThreepid = True
-            replaceThreepid = False
-
-        rest_config = _RestConfig()
-        rest_config.endpoint = config["endpoint"]
-
-        try:
-            rest_config.regLower = config['policy']['registration']['username']['enforceLowercase']
-        except TypeError:
-            # we don't care
-            pass
-        except KeyError:
-            # we don't care
-            pass
-
-        try:
-            rest_config.setNameOnRegister = config['policy']['registration']['profile']['name']
-        except TypeError:
-            # we don't care
-            pass
-        except KeyError:
-            # we don't care
-            pass
-
-        try:
-            rest_config.setNameOnLogin = config['policy']['login']['profile']['name']
-        except TypeError:
-            # we don't care
-            pass
-        except KeyError:
-            # we don't care
-            pass
-
-        try:
-            rest_config.updateThreepid = config['policy']['all']['threepid']['update']
-        except TypeError:
-            # we don't care
-            pass
-        except KeyError:
-            # we don't care
-            pass
-
-        try:
-            rest_config.replaceThreepid = config['policy']['all']['threepid']['replace']
-        except TypeError:
-            # we don't care
-            pass
-        except KeyError:
-            # we don't care
-            pass
-
-        return rest_config
-
-
-def _require_keys(config, required):
-    missing = [key for key in required if key not in config]
-    if missing:
-        raise Exception(
-            "REST Auth enabled but missing required config values: {}".format(
-                ", ".join(missing)
-            )
-        )
-
-
-def time_msec():
-    """Get the current timestamp in milliseconds
-    """
-    return int(time.time() * 1000)

testserver/docker_matrix/templates/synapse-data/homeserver.yaml

@@ -5,6 +5,9 @@ use_presence: false
 allow_public_rooms_without_auth: false
 allow_public_rooms_over_federation: true
 forget_rooms_on_leave: true
+macaroon_secret_key: "{{ matrix_macaroon_secret_key }}"
+registration_shared_secret: "{{ matrix_registration_shared_secret }}"
+form_secret: "{{ matrix_form_secret}}"
 
 listeners:
   - port: 8448
@@ -62,26 +65,50 @@ thumbnail_sizes:
 
 url_preview_enabled: true
 url_preview_ip_range_blacklist:
- - '127.0.0.0/8'
- - '10.0.0.0/8'
- - '172.16.0.0/12'
- - '192.168.0.0/16'
- - '100.64.0.0/10'
- - '192.0.0.0/24'
- - '169.254.0.0/16'
- - '198.18.0.0/15'
- - '192.0.2.0/24'
- - '198.51.100.0/24'
- - '203.0.113.0/24'
- - '224.0.0.0/4'
- - '::1/128'
- - 'fe80::/10'
- - 'fc00::/7'
+  - '127.0.0.0/8'
+  - '10.0.0.0/8'
+  - '172.16.0.0/12'
+  - '192.168.0.0/16'
+  - '100.64.0.0/10'
+  - '192.0.0.0/24'
+  - '169.254.0.0/16'
+  - '198.18.0.0/15'
+  - '192.0.2.0/24'
+  - '198.51.100.0/24'
+  - '203.0.113.0/24'
+  - '224.0.0.0/4'
+  - '::1/128'
+  - 'fe80::/10'
+  - 'fc00::/7'
 
 max_spider_size: 10M
 
 enable_registration: false
-default_identity_server: "{{ matrix.identity_server }}"
+
+password_config:
+  enabled: false
+
+oidc_providers:
+  - idp_id: uffd
+    idp_name: uffd
+    discover: true
+    enable_registration: true
+    allow_existing_users: true
+    issuer: "{{ oidc_global.provider_url }}"
+    client_id: "matrix" # TO BE FILLED
+    client_secret: "{{ matrix_oidc_secret }}" # TO BE FILLED
+    scopes: 
+      - "openid"
+      - "profile"
+      - "email"
+    user_mapping_provider:
+      config:
+        subject_claim: "preferred_username"
+        subject_template: "{% raw %}{{ user.preferred_username }}{% endraw %}"
+        localpart_template: "{% raw %}{{ user.preferred_username }}{% endraw %}"
+        display_name_template: "{% raw %}{{ user.name }}{% endraw %}"
+        email_template: "{% raw %}{{ user.email }}{% endraw %}"
+
 
 auto_join_rooms:
   - "#warpzone:{{ matrix.domain }}"
@@ -104,11 +131,6 @@ email:
   enable_notifs: true
   notif_for_new_users: False
 
-password_providers:
-  - module: "rest_auth_provider.RestAuthProvider"
-    config:
-      endpoint: "http://ma1sd:8090"
-
 encryption_enabled_by_default_for_room_type: invite
 enable_group_creation: false
 

webserver/docker_dokuwiki/templates/sendmail_plenum.py

@@ -3,8 +3,21 @@ import datetime
 from email.message import EmailMessage
 from email.utils import formatdate
 import requests
+import time
+import os
 
-def do_work():
+def wait_until_unlocked():
+    # Wait for locks to be released
+    # If you don't do this and edit DokuWiki pages, others may overwrite what you do
+    locked = True
+    while locked:
+        locked = os.path.isfile("/srv/dokuwiki/data/data/locks/e0bc4d991c71e981423bfefd6d257985.lock")
+
+        # Avoid busy loop
+        if locked:
+            time.sleep(5)
+
+def get_topics():
     with open("/srv/dokuwiki/data/data/pages/intern/diskussionsthemen.txt") as fp:
         raw = fp.read().split('\n')
 
@@ -13,12 +26,12 @@ def do_work():
         lastline = 0
         for index, line in enumerate(raw):
             # Start marker
-            if "====== 1." in line:
+            if "====== 1." in line and not "1.5" in line:
                 firstline = index + 1
                 continue
             
             # End marker
-            if "====== 2." in line:
+            if "====== 2." in line or "====== 1.5" in line:
                 lastline = index
                 break
         
@@ -27,51 +40,84 @@ def do_work():
         for extracted in raw[firstline:lastline]:
             if extracted != '':
                 topics.append(extracted)
+    return topics
 
-        # There are no topics - just exit
-        if (len(topics) == 0):
-            return True
+def send_mail(topics, date):
+    # mail template 
+    mail = f"""
+Liebe Zonies,
+    
+es gibt wieder Themen die im Plenum besprochen werden sollen. Der nächste
+Reguläre Termin ist am nächsten Dienstag ({str(date)}) um 20:00.
+Im Wiki (https://wiki.warpzone.ms/intern:diskussionsthemen#diskussionsthemen_naechstes_plenum_automatische_einladung)
+stehen folgende Themen:
 
-        # calculate date of next tuesday
-        d = datetime.date.today()
-        while d.strftime('%a') != 'Tue':
-            d += datetime.timedelta(1)
+{chr(10).join(topics)}
 
-        # mail template 
-        mail = f"""
-    Liebe Zonies,
-        
-    es gibt wieder Themen die im Plenum besprochen werden sollen. Der nächste
-    Reguläre Termin ist am nächsten Dienstag ({str(d)}) um 20:00.
-    Im Wiki (https://wiki.warpzone.ms/intern:diskussionsthemen#diskussionsthemen_naechstes_plenum_automatische_einladung)
-    stehen folgende Themen:
+Die Teilnahme ist natürlich auch remote möglich unter
+https://jitsi.dorf-post.de/warpzone-plenum möglich.
 
-    {chr(10).join(topics)}
+Viele Grüße und bis Dienstag,
 
-    Die Teilnahme ist natürlich auch remote möglich unter
-    https://jitsi.dorf-post.de/warpzone-plenum möglich.
+sendmail_plenum.py
+"""
 
-    Viele Grüße und bis Dienstag,
+    msg = EmailMessage()
+    msg['Subject'] = f'Aktuelle Plenumsthemen für Dienstag ({str(date)} 20:00)'
+    msg['From'] = '{{noreply_email_user}}'
+    msg['To'] = 'intern@warpzone.ms'
+    msg['Date'] = formatdate(localtime=True)
+    msg.set_content(mail)
+    
+    server = smtplib.SMTP('{{smtp_host}}', {{smtp_port}})
+    server.starttls()
+    server.login("{{noreply_email_user}}", "{{noreply_email_pass}}")
+    server.send_message(msg)
+    server.quit()
+    return True
 
-    sendmail_plenum.py
-    """
+def update_page(label):
+    with open("/srv/dokuwiki/data/data/pages/intern/diskussionsthemen.txt") as fp:
+        raw = fp.read().split('\n')
+    
+    new_content = []
+    topic_replaced = False
+    for old_line in raw:
+        new_content.append(old_line)
 
-        msg = EmailMessage()
-        msg['Subject'] = f'Aktuelle Plenumsthemen für Dienstag ({str(d)} 20:00)'
-        msg['From'] = '{{noreply_email_user}}'
-        msg['To'] = 'intern@warpzone.ms'
-        msg['Date'] = formatdate(localtime=True)
-        msg.set_content(mail)
-        
-        server = smtplib.SMTP('{{smtp_host}}', {{smtp_port}})
-        server.starttls()
-        server.login("{{noreply_email_user}}", "{{noreply_email_pass}}")
-        server.send_message(msg)
-        server.quit()
-    return True
+        if not topic_replaced and "====== 1." in old_line:
+            new_content.append(f"====== 1.5 {label} ======")
+            topic_replaced = True
+    
+    with open("/srv/dokuwiki/data/data/pages/intern/diskussionsthemen.txt", "w") as fp:
+        fp.write("\n".join(new_content))
 
 success = False
 try:
-    success = do_work()
+    wait_until_unlocked()
+
+    topics = get_topics()
+    
+    if (len(topics) != 0):
+        # calculate date of next tuesday
+        date = datetime.date.today()
+        while date.strftime('%a') != 'Tue':
+            date += datetime.timedelta(1)
+        
+        success = send_mail(topics, date)
+    
+        label = f"Diskussionsthemen für {date}"
+        if success:
+            label += f" (bereits eingeladen)"
+        else:
+            label += f" (Einladung fehlgeschlagen)"
+        success = update_page(label)
+    else:
+        success = True
+
+except:
+    success = False
+    raise
+
 finally:
     requests.get("{{ healthchecks_url }}" if success else "{{ healthchecks_url }}" + "/fail")