ba220d6cd6
Verified the role against the real matrix-stack Helm chart (pulled 26.6.1) and fixed divergences found during review. Bugs: - Add MAS OIDC discovery router: /.well-known/openid-configuration must hit the MAS root listener (8082), not web (8080) — was 404, breaking OIDC login - Add Synapse ip_range_blacklist (full SSRF blocklist for all outbound federation/identity requests; previously only url-preview blacklist present) - Make federation_client_minimum_tls_version unconditional (chart sets it in shared-underrides; role only set it when federation was enabled) - Restart only rendered fed-reader replicas in the handler instead of the whole compose project (missing services: filter) Chart alignment (26.5.1 -> 26.6.1): - Bump chart version and all image tags (mas -> matrix-authentication-service -pro:1.18.0, postgres 17, synapse v1.154.0-pro.1, element-web v1.12.21, etc.) - redis maxmemory 256mb -> chart default 40mb (configurable) - Add element-web map_style_url (configurable) Hardening / hygiene: - Validate ess_rtc_external_ip is a real IP (regex, no extra collection dep) - Read admin password from the in-container secret file instead of passing it on the host process list during mas-cli register-user - apt cache_valid_time, postgres first-boot-only comment, haproxy failover note - Add meta/argument_specs.yml documenting all public variables - README: chart version, service count, OIDC discovery verification step Signed-off-by: Simon Bärlocher <simon@whatwedo.ch>
47 lines
1.3 KiB
YAML
47 lines
1.3 KiB
YAML
# SPDX-License-Identifier: MIT-0
|
|
---
|
|
- name: Restart haproxy
|
|
community.docker.docker_compose_v2:
|
|
project_src: "{{ ess_compose_dir }}"
|
|
services: [haproxy]
|
|
state: restarted
|
|
|
|
- name: Restart synapse-main
|
|
community.docker.docker_compose_v2:
|
|
project_src: "{{ ess_compose_dir }}"
|
|
services: [synapse-main]
|
|
state: restarted
|
|
|
|
- name: Restart synapse-fed-reader
|
|
community.docker.docker_compose_v2:
|
|
project_src: "{{ ess_compose_dir }}"
|
|
# Restart only the rendered fed-reader replicas, not the whole project.
|
|
services: >-
|
|
{{ range(ess_synapse_fed_reader_replicas | int)
|
|
| map('regex_replace', '^(.*)$', 'synapse-fed-reader-\1')
|
|
| list }}
|
|
state: restarted
|
|
|
|
- name: Restart mas
|
|
community.docker.docker_compose_v2:
|
|
project_src: "{{ ess_compose_dir }}"
|
|
services: [mas]
|
|
state: restarted
|
|
|
|
- name: Restart matrix-rtc-sfu
|
|
community.docker.docker_compose_v2:
|
|
project_src: "{{ ess_compose_dir }}"
|
|
services: [matrix-rtc-sfu, matrix-rtc-authorisation]
|
|
state: restarted
|
|
|
|
- name: Restart element-web
|
|
community.docker.docker_compose_v2:
|
|
project_src: "{{ ess_compose_dir }}"
|
|
services: [element-web]
|
|
state: restarted
|
|
|
|
- name: Restart redis
|
|
community.docker.docker_compose_v2:
|
|
project_src: "{{ ess_compose_dir }}"
|
|
services: [redis]
|
|
state: restarted
|