Digitalboard/digitalboard.core
6
2
Fork 0
Code Pull requests 3 Releases Packages Activity Actions

feat(ess-pro/compose): deploy Element Server Suite Pro via Compose #10

Open
Tobias-Wuest wants to merge 2 commits from feature/ess-pro/compose into main
pull from: feature/ess-pro/compose
merge into: Digitalboard:main
Conversation 0 Commits 2 Files changed 34 +2191
Tobias-Wuest commented 2026-06-04 09:02:28 +00:00
Owner
Copy link

initial commit of the converted role from helm charts for qubernetis to compose ansible role

initial commit of the converted role from helm charts for qubernetis to compose ansible role
Tobias-Wuest self-assigned this 2026-06-04 09:02:28 +00:00
Tobias-Wuest added 1 commit 2026-06-04 09:02:29 +00:00 
initial commit of the converted role from helm charts for qubernetis to compose ansible role
Simon added 1 commit 2026-06-15 15:51:39 +00:00 
Verified the role against the real matrix-stack Helm chart (pulled 26.6.1)
and fixed divergences found during review.

Bugs:
- Add MAS OIDC discovery router: /.well-known/openid-configuration must hit
  the MAS root listener (8082), not web (8080) — was 404, breaking OIDC login
- Add Synapse ip_range_blacklist (full SSRF blocklist for all outbound
  federation/identity requests; previously only url-preview blacklist present)
- Make federation_client_minimum_tls_version unconditional (chart sets it in
  shared-underrides; role only set it when federation was enabled)
- Restart only rendered fed-reader replicas in the handler instead of the
  whole compose project (missing services: filter)

Chart alignment (26.5.1 -> 26.6.1):
- Bump chart version and all image tags (mas -> matrix-authentication-service
  -pro:1.18.0, postgres 17, synapse v1.154.0-pro.1, element-web v1.12.21, etc.)
- redis maxmemory 256mb -> chart default 40mb (configurable)
- Add element-web map_style_url (configurable)

Hardening / hygiene:
- Validate ess_rtc_external_ip is a real IP (regex, no extra collection dep)
- Read admin password from the in-container secret file instead of passing it
  on the host process list during mas-cli register-user
- apt cache_valid_time, postgres first-boot-only comment, haproxy failover note
- Add meta/argument_specs.yml documenting all public variables
- README: chart version, service count, OIDC discovery verification step

Signed-off-by: Simon Bärlocher <simon@whatwedo.ch>
This pull request can be merged automatically.
This branch is out-of-date with the base branch
You are not authorized to merge this pull request.
View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin feature/ess-pro/compose:feature/ess-pro/compose
git checkout feature/ess-pro/compose

Merge

Merge the changes and update on Forgejo.
git checkout main
git merge --no-ff feature/ess-pro/compose
git checkout feature/ess-pro/compose
git rebase main
git checkout main
git merge --ff-only feature/ess-pro/compose
git checkout feature/ess-pro/compose
git rebase main
git checkout main
git merge --no-ff feature/ess-pro/compose
git checkout main
git merge --squash feature/ess-pro/compose
git checkout main
git merge --ff-only feature/ess-pro/compose
git checkout main
git merge feature/ess-pro/compose
git push origin main
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
Tobias-Wuest
2 participants
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: Digitalboard/digitalboard.core#10
No description provided.
Delete branch "feature/ess-pro/compose"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?