initial version, gets a Synapse server setup with an Element web-client

roles/setup-synapse/tasks/certbot_setup.yml

@@ -0,0 +1,34 @@
+
+- name: Install Certbot
+  apt:
+    name: certbot
+    state: present
+
+- name: Install Certbot Nginx Plugin
+  apt:
+    name: python3-certbot-nginx
+    state: present
+
+- name: Create TLS certificate
+  become: yes
+  become_user: root
+  command: certbot certonly --rsa-key-size 2048 -d {{ server_name }} -d element.{{ server_name }} -d turn.{{ server_name }} --agree-tos --non-interactive --email {{ matrix_admin_email }} --nginx
+
+- name: Setup SSL Auto-renewal
+  become: yes
+  become_user: root
+  cron:
+    name: certbot renew
+    minute: 0
+    hour: 0
+    day: 1
+    month: '*'
+    weekday: '*'
+    job: certbot renew --rsa-key-size 2048 --quiet --post-hook "systemctl reload nginx"
+
+- name: Create Diffie-Hellman key
+  become: yes
+  become_user: root
+  command:
+    cmd: openssl dhparam -out /etc/letsencrypt/live/{{ server_name }}/dhparam2048.pem 2048
+    creates: /etc/letsencrypt/live/{{ server_name }}/dhparam2048.pem

roles/setup-synapse/tasks/config_nginx.yml

@@ -0,0 +1,18 @@
+
+- name: Install NGINX
+  apt:
+    name: nginx
+    state: present
+
+- name: Configure Nginx Config for Matrix Synapse
+  template:
+    src: nginx.conf.j2
+    dest: "/etc/nginx/sites-available/{{ server_name }}"
+    mode: '0644'
+  notify: Restart Nginx
+
+- name: Create a Symbolic Link for Nginx Config
+  file:
+    src: "/etc/nginx/sites-available/{{ server_name }}"
+    dest: "/etc/nginx/sites-enabled/{{ server_name }}"
+    state: link

roles/setup-synapse/tasks/config_synapse.yml

@@ -0,0 +1,37 @@
+---
+- name: Apply the homeserver.yaml template
+  template:
+    src: templates/homeserver.yaml.j2
+    dest: /etc/matrix-synapse/homeserver.yaml
+    owner: root
+    group: root
+    mode: '0644'
+
+- name: Apply the nginx.conf template
+  template:
+    src: templates/nginx.conf.j2
+    dest: /etc/nginx/sites-available/matrix
+    owner: root
+    group: root
+    mode: '0644'
+
+- name: Enable the nginx site
+  file:
+    src: /etc/nginx/sites-available/matrix
+    dest: /etc/nginx/sites-enabled/matrix
+    state: link
+
+- name: Remove the default nginx site
+  file:
+    path: /etc/nginx/sites-enabled/default
+    state: absent
+  notify: Restart Nginx
+
+- name: Set Synapse Cache Factor
+  lineinfile:
+    path: /etc/default/matrix-synapse
+    regexp: '^SYNAPSE_CACHE_FACTOR='
+    line: 'SYNAPSE_CACHE_FACTOR=2.0'
+    state: present
+    create: yes
+  notify: Restart Synapse

roles/setup-synapse/tasks/element_setup.yml

@@ -0,0 +1,112 @@
+---
+- name: Template NGINX config for Element
+  become: yes
+  template:
+    src: "{{ role_path }}/templates/nginx-element.conf.j2"
+    dest: "/etc/nginx/sites-available/element.{{ server_name}}.conf"
+    owner: root
+    group: root
+    mode: '0644'
+  notify: Restart Nginx
+
+- name: Create symbolic link for NGINX config
+  become: yes
+  file:
+    src: /etc/nginx/sites-available/element.{{ server_name}}.conf
+    dest: /etc/nginx/sites-enabled/element.{{ server_name}}.conf
+    state: link
+    force: yes
+
+- name: Create the /var/www/element.penholder.xyz/ directory
+  become: yes
+  file:
+    path: "/var/www/element.{{ server_name}}"
+    state: directory
+    owner: root
+    group: root
+    mode: '0755'
+
+- name: Download and install latest Element
+  become: yes
+  block:
+
+    - name: Install GPG
+      apt:
+        name: gnupg
+        state: present
+
+    - name: Copy Element release key to /tmp
+      copy:
+        src: "{{ playbook_dir }}/pubkey/element-release-key.gpg"
+        dest: /tmp/element-release-key.gpg
+        mode: '0644'
+
+    # need to install GPG key from https://packages.element.io/element-release-key.gpg
+
+    - name: Import Element release key
+      shell: gpg --import /tmp/element-release-key.gpg
+    
+    - name: Download Element archive
+      get_url:
+        url: "https://github.com/vector-im/element-web/releases/download/v1.11.38/element-v1.11.38.tar.gz"
+        dest: "/tmp/element-v1.11.38.tar.gz"
+
+    - name: Download Element archive signature
+      get_url:
+        url: "https://github.com/vector-im/element-web/releases/download/v1.11.38/element-v1.11.38.tar.gz.asc"
+        dest: "/tmp/element-v1.11.38.tar.gz.asc"
+
+    - name: Verify Element archive signature
+      shell: gpg --verify /tmp/element-v1.11.38.tar.gz.asc /tmp/element-v1.11.38.tar.gz
+      args:
+        chdir: "/tmp"
+    
+    - name: Extract Element archive
+      unarchive:
+        src: "/tmp/element-v1.11.38.tar.gz"
+        dest: "/tmp/"
+        remote_src: yes
+      args:
+        creates: "/var/www/element.{{ server_name}}/element-v1.11.38"
+
+# Copy
+# /tmp/element-v1.11.38/*
+# /var/www/element.penholder.xyz/
+
+    - name: Copy Element files to web directory
+      shell: cp -r /tmp/element-v1.11.38/* /var/www/element.{{ server_name}}
+      args:
+        creates: "/var/www/element.{{ server_name}}/welcome.html"
+
+    - name: Clean up downloaded files
+      file:
+        path: "/tmp/element-v*"
+        state: absent
+
+    - name: Template the Element Config file
+      template:
+        src: "{{ role_path }}/templates/element.json.j2"
+        dest: "/var/www/element.{{ server_name}}/config.json"
+        owner: root
+        group: root
+        mode: '0644'
+      notify: Restart Nginx
+
+# - name: Create and edit config.json for Element
+#   become: yes
+#   blockinfile:
+#     path: "/var/www/element.{{ server_name}}/config.json"
+#     create: yes
+#     content: |
+#       {
+#           "default_server_config": {
+#               "m.homeserver": {
+#                   "base_url": "https://{{ server_name}}",
+#                   "server_name": "{{ server_name}}"
+#               },
+#               "m.identity_server": {
+#                   "base_url": "https://vector.im"
+#               }
+#           },
+#           # ... (other config options)
+#       }

roles/setup-synapse/tasks/install_postgresql.yml

@@ -0,0 +1,39 @@
+---
+- name: Install Postgresql
+  apt:
+    name: "{{ item }}"
+    state: present
+  loop:
+    - postgresql
+    - postgresql-client
+
+- name: Ensure pip is installed
+  apt:
+    name: python3-pip
+    state: present
+
+- name: Install psycopg2 with pip
+  pip:
+    name: psycopg2-binary
+    state: present
+    extra_args: "{{ (ansible_distribution == 'Debian' and ansible_distribution_version is version('12', '>=')) | ternary('--break-system-packages', '') }}"
+
+- name: Create Synapse role in PostgreSQL
+  become: yes
+  become_user: postgres
+  postgresql_user:
+    name: synapse
+    password: "{{ postgresql_password }}"
+    role_attr_flags: NOSUPERUSER,NOCREATEDB,NOCREATEROLE
+    encrypted: yes
+
+- name: Create Database for Synapse
+  become: yes
+  become_user: postgres
+  postgresql_db:
+    name: synapse
+    encoding: UTF8
+    lc_collate: C
+    lc_ctype: C
+    template: template0
+    owner: synapse

roles/setup-synapse/tasks/install_synapse.yml

@@ -0,0 +1,83 @@
+---
+# sudo apt update
+
+- name: Update apt cache
+  apt:
+    update_cache: yes
+
+#sudo apt install -y lsb-release wget apt-transport-https
+
+- name: Install Prerequisite Packages 
+  apt:
+    name: "{{ item }}"
+    state: present
+  loop:
+    - lsb-release
+    - wget
+    - apt-transport-https
+
+#sudo wget -O /usr/share/keyrings/matrix-org-archive-keyring.gpg https://packages.matrix.org/debian/matrix-org-archive-keyring.gpg
+
+#echo "deb [signed-by=/usr/share/keyrings/matrix-org-archive-keyring.gpg] https://packages.matrix.org/debian/ $(lsb_release -cs) main" |
+#    sudo tee /etc/apt/sources.list.d/matrix-org.list
+
+- name: Download Matrix.org GPG keyring
+  get_url:
+    url: https://packages.matrix.org/debian/matrix-org-archive-keyring.gpg
+    dest: /usr/share/keyrings/matrix-org-archive-keyring.gpg
+    mode: '0644'
+
+- name: Add Matrix.org repository
+  apt_repository:
+    repo: deb [signed-by=/usr/share/keyrings/matrix-org-archive-keyring.gpg] https://packages.matrix.org/debian/ {{ ansible_distribution_release }} main
+    state: present
+
+#sudo apt update
+
+- name: Update apt cache
+  apt:
+    update_cache: yes
+
+#sudo apt install matrix-synapse-py3
+
+- name: Install Synapse
+  apt:
+    name: matrix-synapse-py3
+    state: present
+
+# sudo systemctl stop matrix-synapse
+
+- name: Stop Synapse
+  service:
+    name: matrix-synapse
+    state: stopped
+
+- name: Ensure /var/lib/matrix-synapse/media directory exists
+  file:
+    path: /var/lib/matrix-synapse/media
+    state: directory
+    owner: matrix-synapse
+    group: matrix-synapse
+    mode: '0755'
+
+- name: Add server_name to /etc/matrix-synapse/conf.d/server_name.yaml file
+  lineinfile:
+    path: /etc/matrix-synapse/conf.d/server_name.yaml
+    regexp: '^server_name:.*'
+    line: "server_name: {{ server_name }}"
+    create: yes
+    owner: root
+    group: root
+    mode: '0644'
+
+# Write "{{ registration_shared_secret }}" to /etc/matrix-synapse/conf.d/registration_shared_secret.yaml
+
+- name: Write registration_shared_secret to /etc/matrix-synapse/conf.d/registration_shared_secret.yaml
+  lineinfile:
+    path: /etc/matrix-synapse/conf.d/registration_shared_secret.yaml
+    regexp: '^registration_shared_secret:.*'
+    line: "registration_shared_secret: {{ registration_shared_secret }}"
+    create: yes
+    owner: root
+    group: root
+    mode: '0644'

roles/setup-synapse/tasks/main.yml

@@ -0,0 +1,19 @@
+
+# Install Synapse
+- import_tasks: "{{ role_path }}/tasks/install_synapse.yml"
+
+# Install Postgresql
+- import_tasks: "{{ role_path }}/tasks/install_postgresql.yml"
+
+# Certbot Setup
+- import_tasks: "{{ role_path }}/tasks/certbot_setup.yml"
+
+# Configure Nginx
+- import_tasks: "{{ role_path }}/tasks/config_nginx.yml"
+
+# Configure Synapse
+- import_tasks: "{{ role_path }}/tasks/config_synapse.yml"
+
+# Install Element Web
+- import_tasks: "{{ role_path }}/tasks/element_setup.yml"
+  tags: install-element