adrien/automation
adrien/automation
1
1
Fork 0
Code Issues Pull requests Releases Wiki Activity

synapse starts, but can't connect to db on host - investigate postgres access rights

Browse source
This commit is contained in:
Adrien Luxey 2020-06-02 12:54:54 +02:00
parent dad77e6d3a
commit 0400006af1
12 changed files with 189 additions and 131 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
deployer/README.md
View file

@ -24,6 +24,7 @@ Python modules:
* docker * docker
* docker-compose * docker-compose
* pymysql * pymysql
* psycopg2
TODO: Ansible task to install that before the rest TODO: Ansible task to install that before the rest

55
deployer/group_vars/all/vars.yml
View file

@ -13,7 +13,7 @@ wordpress:
gitea: gitea:
version: 1.11.4 version: 1.11.4
synapse: synapse:
version: v1.13.0-py3 version: v1.14.0-py3
sites: sites:
# - slug: rdb # Shorthand name to use as directory/file name # - slug: rdb # Shorthand name to use as directory/file name
@ -107,27 +107,27 @@ sites:
# mysql_username: mts # mysql_username: mts
# mysql_password: "{{ vault_mts_mysql_password }}" # mysql_password: "{{ vault_mts_mysql_password }}"
- slug: gitea # Shorthand name to use as directory/file name # - slug: gitea # Shorthand name to use as directory/file name
# The site URL (without www) # # The site URL (without www)
url: git.deuxfleurs.fr # url: git.deuxfleurs.fr
# Ask nginx to redirect url to www # # Ask nginx to redirect url to www
# Else, we redirect www to url # # Else, we redirect www to url
redirect_to_www: no # redirect_to_www: no
# What kind of site is that? # # What kind of site is that?
type: gitea # type: gitea
# Subnet addresses # # Subnet addresses
subnet_cidr_address: 172.27.6.0/24 # subnet_cidr_address: 172.27.6.0/24
subnet_gateway_ip: 172.27.6.1 # subnet_gateway_ip: 172.27.6.1
subnet_site_ip: 172.27.6.2 # subnet_site_ip: 172.27.6.2
# User IDs # # User IDs
user_name: git # user_name: git
user_uid: 1007 # user_uid: 1007
user_group: git # user_group: git
user_gid: 1006 # user_gid: 1006
# MySQL # # MySQL
mysql_database: gitea # mysql_database: gitea
mysql_username: gitea # mysql_username: gitea
mysql_password: "{{ vault_gitea_mysql_password }}" # mysql_password: "{{ vault_gitea_mysql_password }}"
- slug: synapse_test # Shorthand name to use as directory/file name - slug: synapse_test # Shorthand name to use as directory/file name
# The site URL (without www) # The site URL (without www)
@ -137,6 +137,9 @@ sites:
custom_landing: /vault/www/riot custom_landing: /vault/www/riot
# What kind of site is that? # What kind of site is that?
type: synapse type: synapse
# User IDs
user_uid: 33 # www-data
user_gid: 33 # www-data
# Subnet addresses # Subnet addresses
subnet_cidr_address: 172.27.7.0/24 subnet_cidr_address: 172.27.7.0/24
subnet_gateway_ip: 172.27.7.1 subnet_gateway_ip: 172.27.7.1
@ -144,12 +147,14 @@ sites:
# PostgreSQL # PostgreSQL
postgres_database: synapse_test postgres_database: synapse_test
postgres_username: synapse_test postgres_username: synapse_test
postgres_password: "{{ vault_synapse_test_psql_password }}" postgres_password: "{{ vault_synapse_test_postgres_password }}"
# SMTP # SMTP
contact_email: contact@zinz.dev contact_email: contact@zinz.dev
smtp_host: mail.gandi.net smtp_host: mail.gandi.net
smtp_port: 465 # Clear: 25, SSL: 465, STARTTLS: 587 smtp_port: 587 # Clear: 25, SSL: 465, STARTTLS: 587
smtp_username: contact@zinz.dev smtp_username: contact@zinz.dev
smtp_password: "{{ vault_synapse_test_smtp_password }}" smtp_password: "{{ vault_smtp_contact_at_zinz_dev }}"
# Secrets # Secrets
registration_shared_secret: "{{ vault_synapse_test_registration_shared_secret }}" registration_shared_secret: "{{ vault_synapse_test_registration_shared_secret }}"
# Others
max_upload_size: 20M

106
deployer/group_vars/all/vault.yml
View file

@ -1,54 +1,54 @@
$ANSIBLE_VAULT;1.1;AES256 $ANSIBLE_VAULT;1.1;AES256
33316633336433356161393139393533626265633764643638636238323234333137333632623766 37633930663134356232643631336635303363303366623536366661313663376233316364343030
6263353834383237326364623263323330643666313364390a313836343538653035386463623930 6663366266383139613065613265343537613266373863640a393764653365363665316266366138
34313331366236346636653461383238336163346331643563643164663836326364616639653965 39653639316232323336303432316163346163313863353832323436393637306662306635613261
6139373138643236640a343661366461343530633866656261346631383061636264353765303738 3163343533333132330a636337343537393363353336656531633439313963376136666565653233
61363961356535656261303834626564336637613234353363396365636564333963313038333762 34663563373962303639653030396365396163343837613333303965393731356436373963636666
62366236376539373031613235656565383564326466386263393138383861306238326135326262 35643238616136636137393339386534303436396636303536323838636264643265356334393537
36326166303563383835623233373664646565636634393563663731346236336166653764393131 37366634313866343730346231636135636439623737653036313236336234663237343738313231
35336466626434376437373364313062333739663831636636373132363261636331393762383163 37663964623263663430616231336363396436353430353366626133363832303035623765636336
33393932393966326261383936623262643234366238323732346336633964373939613232353235 63346539616130326561626438383133316262626637653066613032343130393865663839353366
64363731656165326363353065393739653561343861346631636462333237646431653335626361 37653231336130326237326332366637356230623063333632303337333361643738336132393665
63326537333230383435646237663766383465393361646562313737303633393736386335373663 63383364623361333037343130336632343433353762353661653063336434633861303339333135
32313238313232303561383539363731663435363730363362656233663338626139343965653337 66303934323232613134343332363239656230656534356234366336346436653565316638303466
39303138356263623733363931353265626261323639356265663630663339393236383739343038 61303536626335656166303063343438343438383333386632303436646638663838613433393738
37346239343939633437613030613264353035316166303730336437613836646465356431613331 61313265626138613631666166613161336564303463623064393535333232353632383239666130
61396438356366626132613661336666653764626536373966386637343534326362323038363838 61376564613432616466313134306436646636353261653063613966663662356234336261303534
62616462663430303439303239333738363565373065373061346436626532646438316363663866 35363266643134646565333534656335646138623461366363326365386661323663633939623962
37393733366339303932623933656334626431633637623661336331633038336534633236336639 32616565363861383036666364306231316236613139323961393337633134306636356333626338
34353465626238666433326466313337363236656238353162643930343637623562656637623731 32363264366265643935613931613536383930623833306437323136353130666430656535653133
63613366646465356236306532303538636461653933383166633832363031633533646262666264 33396333616439643332396237366435363561333230386133323336353933366532336566333339
36646439323463313134303865623664636463366139336231616265313931653532393538323161 36663037666232343634326462333565383030623633663964396236386434613763666465383265
65393563346337326239353237366530356437666134626439613464356530633961656538326662 35323264663434616262356532316132636361303261303031643134303431663763336631303231
36323438366338366130653432326365663731353837383861313266643431373633383462663630 30336663323966653636383234653037363634623861353132623437643266396430366132366137
65646230633134613338303962643730303539633761386663626666353931663531663132663166 61646661383938623331323062363639353366306538353036373531306634393831626335313362
64376531313738656666373638646238366166643536393430383865373134343937376434323566 63623436343134336436626430396162636561343336663233656137653638333830643735663338
65393963636237363061623666636665613037613165323963343337343336303835303938636265 37366539663834396364313336626466373634643035393036373730643631366463383266343362
61373032663835623630653938366438346633333335666236646234383238336466373931363039 64656438376237383838363461366335623165343733353734613037663530633133336436663335
66353964666662366464363035643230643332373765323131333338393735626663343666323833 64323661363361626634646263663330646365326362323639656263663963383666363330656666
62343731383163376632303965623964356137373034323536666533363130633564633936616130 38353432616661623530626631646565646433353463383232373962373264646137336135393939
35333830303066316663393261356362376632316130303738323865373764613732616534613666 33356336656561653638373434373438616266393566643631376133663730363535396532343733
31346636366439373632363232306133383861383230326338616438353664663638656265643961 38323030343339356566356132323634316664373831373763383635623438613731356561643861
30633137633032666238323338313062356634303739346635333438316335653565353433356664 32626331303465663933303232633865666533613235663930633930623331363634373031356164
61356166316236633762623765646530643235326234646636353762393464326236333334313334 38363238396633303963383436353865656139393939633736336466626335303635366234393564
31383932613061613238303032396664333565346237373935313235653762306534326434333364 30643732363335386366333332653462396236633433373136633831356362303431663862363162
63336237666533623037313061323365613335656462306361623536353938326234353434353866 39396334623137633762326565613037336539343132636230623830633831393732303666363436
63636433633264653535386161323133653833626639666436613866363633396265316162383433 39656534396333396330333936363261613765313536396538333937303765313632336235326430
66623838313164623834616562623336393737353063336538373237316335386532633531353932 63613163376465323465376135313464623261313234636461333535623965323364373536393532
66303230363166343039313264633631626131306133646361643539323765663664353262633536 66623361343636336461643965363436353735353931333738646563373639356537626239616633
30623262623133633563623933373239643637326434336331626630353161326533653138356537 32356230383266303464346665326365376365353965306332653038626230616336376132343937
39646330666561333065613637663839313437363663313235366131656365373861323135353632 62343837626363623263383531623832333634376663346339626530366132633461353734666638
65343562663836633233396538356330306132643265373261343763363530643539306232636166 63393462386435313130353938373937303163346232623832643637373038353663643163353337
30646236313165623235616361626434326430396636623032393136626463356161306433343933 36333132653039303133616464396139336565343564356666653761616634646331393539326632
64333930613463333037366534396439616662383338636338353835363965306666376630626436 34643731333235316433636633653964383039626232343538656539313730656437656261666435
36336632363136366266313833383839366138653262643532316131663434643963656563623165 36356639616264363664666538306634666338373730666439643534313063363431343330616239
61303565343832626561366137626566333536383664353163323032373836656332326631366530 65383930326334316230633638373864666438313734336335623464366439653431396630316665
34323165636563323130376361356634656561623030333665313038306430396563353030326165 62653066323734393631633261386435306532643133613762363439623731633036343264316663
36363563366236633132623566306534356130656166616533666139373034383336383130343534 66306437626164373764346536393363633063366637313065653363663964353766353763373364
64666466663434356266333135333830303830386134376234333766646134636232363564663834 37393162373837626162623863343636326335633137356539306638386432383537326137386166
64613035366637656262343366643136346631646332393163313064616333353735316662386437 35353162306237633834306536343461326633653462666431656164636164643831353938323663
38396530343461303265366433366438343337646366313737663865333965353630653338326336 37343132333037653134633230613733363733633538643163663233363331363133303864383835
33356433386333393164396131653635346564363563633134633962333039396331336362393231 30633031356330323866333465643536636335393065643438333666333032633239343133623238
31386566633533323730643666303433333932356164393762316566376133663338636665643633 37363231376337396165633866646336643137363966373534326164376239643664313864356166
34653234356165613463356432643538633235636465393733316333396564393166373062303563 33323066326664383133306535633763343532323830636232626131346431653862613836396364
3565 3761

3
deployer/roles/build/tasks/backup.yml
View file

@ -62,6 +62,5 @@
when: site.mysql_database is defined when: site.mysql_database is defined
- name: "PostgreSQL Database backups" - name: "PostgreSQL Database backups"
block: debug: msg="TODO PUTAIN BOSSE LÀ"
debug: msg="TODO PUTAIN BOSSE LÀ"
when: site.postgres_database is defined when: site.postgres_database is defined

42
deployer/roles/build/tasks/postgres.yml
View file

@ -2,30 +2,20 @@
# Needs variables: # Needs variables:
# - site: dict describing the site install (cf group_vars/all/vars.yml) # - site: dict describing the site install (cf group_vars/all/vars.yml)
- name: "Create database {{ site.mysql_database }} if inexistent" - name: "Create database {{ site.postgres_database }} if inexistent"
# mysql_db: postgresql_db:
# name: "{{ site.mysql_database }}" name: "{{ site.postgres_database }}"
# state: present state: present
# # Credentials to log in MySQL become: yes
# login_host: localhost become_user: postgres
# login_user: root
# login_password: "{{ mysql_root_password }}"
- name: "Add database user {{ site.postgres_username }}@{{ site.subnet_site_ip }} and grant all privileges on {{ site.postgres_database }}"
# MySQL equivalent: postgresql_user:
# TODO: PostgreSQL? # Credentials of the new db user
# create user <user>@<ip> identified by <pass>; name: "{{ site.postgres_username }}"
# grant all on <db>.* to <user>@<ip>; password: "{{ site.postgres_password }}"
- name: "Add database user {{ site.mysql_username }}@{{ site.subnet_site_ip }} and grant all privileges on {{ site.mysql_database }}" db: "{{ site.postgres_database }}"
# mysql_user: priv: ALL
# # Credentials to log in MySQL # host: "{{ site.subnet_site_ip }}"
# login_host: localhost become: yes
# login_user: root become_user: postgres
# login_password: "{{ mysql_root_password }}"
# # Credentials of the new db user
# host: "{{ site.subnet_site_ip }}"
# name: "{{ site.mysql_username }}"
# password: "{{ site.mysql_password }}"
# # Grants
# priv: "{{ site.mysql_database }}.*:all"
# state: present

41
deployer/roles/build/tasks/synapse.yml
View file

@ -11,6 +11,47 @@
import_tasks: render.yml import_tasks: render.yml
tags: render tags: render
##########################
# Generate configuration #
##########################
- name: "Create folder {{ site_data_path }}"
file:
path: "{{ site_data_path }}"
state: directory
mode: "770"
group: "www-data"
tags: config
# - name: "Set {{ site_data_path }} permissions"
# file:
# path: "{{ site_data_path }}"
# mode: '770'
# group: "www-data"
# become: true
# tags: config
- name: "Copy homeserver.yaml to {{ site_data_path }}"
copy:
src: "{{ sites_path }}/{{ site.slug }}/homeserver.yaml"
dest: "{{ site_data_path }}/homeserver.yaml"
remote_src: yes
tags: config
- name: "Let synapse generate missing configuration files"
docker_container:
name: synapse_config_generator
image: "matrixdotorg/synapse:{{ synapse.version }}"
command: "generate"
volumes:
- "{{ site_data_path }}:/data"
env:
SYNAPSE_SERVER_NAME: "{{ site.url }}"
SYNAPSE_REPORT_STATS: "no"
UID: "{{ site.user_uid }}"
GID: "{{ site.user_gid }}"
tags: config
############################ ############################
# PostgreSQL configuration # # PostgreSQL configuration #
############################ ############################

21
deployer/roles/build/templates/synapse/docker-compose.yml.j2
View file

@ -6,32 +6,17 @@ version: '3'
services: services:
site: site:
# build: site image: matrixdotorg/synapse:{{ synapse.version }}
image: matrixdotorg/synapse:{{ gitea.version }}
restart: unless-stopped restart: unless-stopped
environment: environment:
- SYNAPSE_CONFIG_PATH=/data/homeserver.yaml - SYNAPSE_CONFIG_PATH=/data/homeserver.yaml
# APP_NAME: "Gitea: git with a cup of coffee" - UID={{ site.user_uid }}
# DOMAIN: "{{ site.url }}" - GID={{ site.user_gid }}
# SSH_DOMAIN: "{{ site.url }}"
# ROOL_URL: "https://{{ site.url }}/"
# USER_UID: "{{ site.user_uid }}"
# USER_GID: "{{ site.user_gid }}"
# DB_TYPE: mysql
# DB_HOST: "{{ site.subnet_gateway_ip }}"
# DB_USER: "{{ site.mysql_username }}"
# DB_PASSWD: "{{ site.mysql_password }}"
# DB_NAME: "{{ site.mysql_database }}"
volumes: volumes:
- "{{ site_data_path }}:/data" - "{{ site_data_path }}:/data"
# - "/home/git/.ssh:/data/git/.ssh"
# - "/etc/timezone:/etc/timezone:ro"
# - "/etc/localtime:/etc/localtime:ro"
networks: networks:
net: net:
ipv4_address: "{{ site.subnet_site_ip }}" ipv4_address: "{{ site.subnet_site_ip }}"
ports:
# - "127.0.0.1:2222:22" # SSH Passthrough
networks: networks:
net: net:

12
deployer/roles/build/templates/synapse/homeserver.yaml.j2
View file

@ -437,11 +437,11 @@ retention:
# instance, if using certbot, use `fullchain.pem` as your certificate, # instance, if using certbot, use `fullchain.pem` as your certificate,
# not `cert.pem`). # not `cert.pem`).
# #
#tls_certificate_path: "/data/test.zinz.dev.tls.crt" #tls_certificate_path: "/data/{{ site.url }}.tls.crt"
# PEM-encoded private key for TLS # PEM-encoded private key for TLS
# #
#tls_private_key_path: "/data/test.zinz.dev.tls.key" #tls_private_key_path: "/data/{{ site.url }}.tls.key"
# Whether to verify TLS server certificates for outbound federation requests. # Whether to verify TLS server certificates for outbound federation requests.
# #
@ -759,7 +759,7 @@ media_store_path: "/data/media_store"
# The largest allowed upload size in bytes # The largest allowed upload size in bytes
# #
#max_upload_size: 10M max_upload_size: {{ site.max_upload_size }}
# Maximum number of pixels that will be thumbnailed # Maximum number of pixels that will be thumbnailed
# #
@ -1241,7 +1241,7 @@ form_secret: "{{ lookup('password', '/dev/null length=50') }}"
# Path to the signing key to sign messages with # Path to the signing key to sign messages with
# #
signing_key_path: "/data/test.zinz.dev.signing.key" signing_key_path: "/data/{{ site.url }}.signing.key"
# The keys that the server used to sign messages with but won't use # The keys that the server used to sign messages with but won't use
# to sign new messages. # to sign new messages.
@ -1310,7 +1310,7 @@ trusted_key_servers:
# Uncomment the following to disable the warning that is emitted when the # Uncomment the following to disable the warning that is emitted when the
# trusted_key_servers include 'matrix.org'. See above. # trusted_key_servers include 'matrix.org'. See above.
# #
#suppress_key_server_warning: true suppress_key_server_warning: true
# The signing keys to use when acting as a trusted key server. If not specified # The signing keys to use when acting as a trusted key server. If not specified
# defaults to the server signing key. # defaults to the server signing key.
@ -1650,7 +1650,7 @@ email:
# Note that the placeholder must be written '%(app)s', including the # Note that the placeholder must be written '%(app)s', including the
# trailing 's'. # trailing 's'.
# #
#notif_from: "Your Friendly %(app)s homeserver <noreply@example.com>" notif_from: "Your Friendly %(app)s homeserver <noreply@{{ site.url }}>"
# app_name defines the default value for '%(app)s' in notif_from. It # app_name defines the default value for '%(app)s' in notif_from. It
# defaults to 'Matrix'. # defaults to 'Matrix'.

17
deployer/roles/build/templates/synapse/nginx.host.j2
View file

@ -38,7 +38,24 @@ server {
include snippets/header-params_server.conf; include snippets/header-params_server.conf;
location /_matrix { location /_matrix {
include snippets/header-params_location.conf; include snippets/header-params_location.conf;
client_max_body_size {{ site.max_upload_size }};
proxy_pass http://{{ site.subnet_site_ip }}:8008; proxy_pass http://{{ site.subnet_site_ip }}:8008;
} }
} }
server {
listen 8448 ssl;
listen [::]:8448 ssl;
server_name {{ site.url }};
include snippets/ssl-params.conf;
ssl_certificate /etc/letsencrypt/live/zinz.dev/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/zinz.dev/privkey.pem;
include snippets/header-params_server.conf;
location / {
include snippets/header-params_location.conf;
proxy_pass http://{{ site.subnet_site_ip }}:8008;
}
}

9
deployer/roles/deploy/tasks/main.yml
View file

@ -23,3 +23,12 @@
loop_var: site loop_var: site
when: site.type == "gitea" when: site.type == "gitea"
tags: gitea tags: gitea
- name: Deploy Synapse sites
include_tasks: synapse.yml
loop: "{{ sites }}"
loop_control:
loop_var: site
when: site.type == "synapse"
tags: synapse

11
deployer/roles/deploy/tasks/synapse.yml Normal file
View file

@ -0,0 +1,11 @@
---
# Needs variables:
# - site: dict describing the site install (cf group_vars/all/vars.yml)
- name: Include docker tasks
include_tasks: docker.yml
tags: docker
- name: Include nginx tasks
include_tasks: nginx.yml
tags: nginx