PC-Admin/ansible-synapse
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

initial version, gets a Synapse server setup with an Element web-client

Browse Source
This commit is contained in:
PC-Admin
2023-08-09 02:27:20 +08:00
parent f8a276aced
commit bb10c3a4b9
18 changed files with 545 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

48
roles/setup-synapse/templates/element.json.j2 Normal file
View File

@@ -0,0 +1,48 @@
{
"default_server_config": {
"m.homeserver": {
"base_url": "https://{{ server_name }}",
"server_name": "{{ server_name }}"
},
"m.identity_server": {
"base_url": "https://vector.im"
}
},
"disable_custom_urls": false,
"disable_guests": false,
"disable_login_language_selector": false,
"disable_3pid_login": false,
"brand": "Element",
"integrations_ui_url": "https://scalar.vector.im/",
"integrations_rest_url": "https://scalar.vector.im/api",
"integrations_widgets_urls": [
"https://scalar.vector.im/_matrix/integrations/v1",
"https://scalar.vector.im/api",
"https://scalar-staging.vector.im/_matrix/integrations/v1",
"https://scalar-staging.vector.im/api",
"https://scalar-staging.riot.im/scalar/api"
],
"default_country_code": "GB",
"show_labs_settings": false,
"features": {},
"default_federate": true,
"default_theme": "light",
"room_directory": {
"servers": ["{{ server_name }}"]
},
"enable_presence_by_hs_url": {
"https://{{ server_name }}": false
},
"setting_defaults": {
"breadcrumbs": true
},
"jitsi": {
"preferred_domain": "meet.element.io"
},
"element_call": {
"url": "https://call.element.io",
"participant_limit": 8,
"brand": "Element Call"
},
"map_style_url": "https://api.maptiler.com/maps/streets/style.json?key=fU3vlMsMn4Jb6dnEIFsx"
}

31
roles/setup-synapse/templates/homeserver.yaml.j2 Normal file
View File

@@ -0,0 +1,31 @@
server_name: "{{ server_name }}"
pid_file: "/var/run/matrix-synapse.pid"
listeners:
- port: 8008
tls: false
type: http
x_forwarded: true
bind_addresses: ['::1', '127.0.0.1']
resources:
- names: [client, federation]
compress: false
database:
name: psycopg2
args:
user: synapse
password: "{{ postgresql_password }}"
database: synapse
host: localhost
cp_min: 5
cp_max: 10
log_config: "/etc/matrix-synapse/log.yaml"
media_store_path: "/var/lib/matrix-synapse/media"
signing_key_path: "/etc/matrix-synapse/homeserver.signing.key"
trusted_key_servers:
- server_name: "matrix.org"
web_client_location: "https://element.{{ server_name }}/"
federation_client_minimum_tls_version: 1.2
allow_public_rooms_over_federation: true
enable_registration: false
admin_contact: "mailto:{{ matrix_admin_email }}"
registration_shared_secret: "{{ registration_shared_secret }}"

31
roles/setup-synapse/templates/nginx-element.conf.j2 Normal file
View File

@@ -0,0 +1,31 @@
server {
listen 80;
server_name element.{{ server_name }};
return 301 https://element.{{ server_name }}$request_uri;
}
server {
listen 443 ssl http2;
gzip off;
server_name element.{{ server_name }};
ssl_certificate /etc/letsencrypt/live/{{ server_name }}/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/{{ server_name }}/privkey.pem;
ssl_session_cache shared:NGX_SSL_CACHE:10m;
ssl_session_timeout 12h;
ssl_protocols TLSv1.3 TLSv1.2;
ssl_ciphers "TLS13-CHACHA20-POLY1305-SHA256:TLS13-AES-256-GCM-SHA384:TLS13-AES-128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES128-GCM-SHA256";
ssl_dhparam /etc/letsencrypt/live/{{ server_name }}/dhparam2048.pem;
ssl_ecdh_curve X25519:secp521r1:secp384r1:prime256v1;
add_header Strict-Transport-Security "max-age=31536000; includeSubdomains" always;
add_header X-Content-Type-Options "nosniff" always;
root /var/www/element.{{ server_name }};
index index.html;
location / {
try_files $uri $uri/ =404;
}
}

46
roles/setup-synapse/templates/nginx.conf.j2 Normal file
View File

@@ -0,0 +1,46 @@
server {
listen 80;
server_name {{ server_name }};
return 301 https://$server_name$request_uri;
}
server {
listen 443 ssl http2;
listen 8448 ssl http2; # for federation (skip if pointing SRV or .well-known to port 443)
gzip off;
server_name {{ server_name }};
ssl_certificate "/etc/letsencrypt/live/{{ server_name }}/fullchain.pem";
ssl_certificate_key "/etc/letsencrypt/live/{{ server_name }}/privkey.pem";
ssl_session_cache shared:NGX_SSL_CACHE:10m;
ssl_session_timeout 12h;
ssl_protocols TLSv1.3 TLSv1.2;
ssl_ciphers "TLS13-CHACHA20-POLY1305-SHA256:TLS13-AES-256-GCM-SHA384:TLS13-AES-128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES128-GCM-SHA256";
ssl_dhparam "/etc/letsencrypt/live/{{ server_name }}/dhparam2048.pem";
ssl_ecdh_curve X25519:secp521r1:secp384r1:prime256v1;
add_header Strict-Transport-Security "max-age=31536000; includeSubdomains" always;
add_header X-Content-Type-Options "nosniff" always;
location / {
return 301 https://element.{{ server_name }};
}
location /_matrix {
proxy_pass http://127.0.0.1:8008;
proxy_set_header X-Forwarded-For $remote_addr;
}
# This can be skipped if you're using port 8448 on {{ server_name }} for federation:
location /.well-known/matrix/server {
return 200 '{ "m.server": "{{ server_name }}:8448" }';
add_header content-type application/json;
}
location /.well-known/matrix/client {
return 200 '{ "m.homeserver": { "base_url": "https://{{ server_name }}" }, "im.vector.riot.jitsi": { "preferredDomain": "jitsi.riot.im" } }';
add_header access-control-allow-origin *;
add_header content-type application/json;
}
}