ba220d6cd6
Verified the role against the real matrix-stack Helm chart (pulled 26.6.1) and fixed divergences found during review. Bugs: - Add MAS OIDC discovery router: /.well-known/openid-configuration must hit the MAS root listener (8082), not web (8080) — was 404, breaking OIDC login - Add Synapse ip_range_blacklist (full SSRF blocklist for all outbound federation/identity requests; previously only url-preview blacklist present) - Make federation_client_minimum_tls_version unconditional (chart sets it in shared-underrides; role only set it when federation was enabled) - Restart only rendered fed-reader replicas in the handler instead of the whole compose project (missing services: filter) Chart alignment (26.5.1 -> 26.6.1): - Bump chart version and all image tags (mas -> matrix-authentication-service -pro:1.18.0, postgres 17, synapse v1.154.0-pro.1, element-web v1.12.21, etc.) - redis maxmemory 256mb -> chart default 40mb (configurable) - Add element-web map_style_url (configurable) Hardening / hygiene: - Validate ess_rtc_external_ip is a real IP (regex, no extra collection dep) - Read admin password from the in-container secret file instead of passing it on the host process list during mas-cli register-user - apt cache_valid_time, postgres first-boot-only comment, haproxy failover note - Add meta/argument_specs.yml documenting all public variables - README: chart version, service count, OIDC discovery verification step Signed-off-by: Simon Bärlocher <simon@whatwedo.ch>
53 lines
1.8 KiB
YAML
53 lines
1.8 KiB
YAML
# SPDX-License-Identifier: MIT-0
|
|
---
|
|
- name: Validate required variables
|
|
ansible.builtin.assert:
|
|
that:
|
|
- ess_server_name | length > 0
|
|
- ess_registry_username | length > 0
|
|
- ess_registry_token | length > 0
|
|
- ess_rtc_external_ip | length > 0
|
|
fail_msg: >-
|
|
Required variables are missing. Provide ess_server_name,
|
|
ess_registry_username, ess_registry_token (OpenBao) and
|
|
ess_rtc_external_ip in group_vars/ess_servers.yml.
|
|
quiet: true
|
|
|
|
- name: Validate ess_rtc_external_ip looks like an IP address
|
|
ansible.builtin.assert:
|
|
that:
|
|
# IPv4 dotted-quad or IPv6 (contains a colon). Cheap sanity check that
|
|
# avoids pulling in the ansible.utils collection just for ipaddr.
|
|
- >-
|
|
ess_rtc_external_ip is match('^\d{1,3}(\.\d{1,3}){3}$')
|
|
or ':' in ess_rtc_external_ip
|
|
fail_msg: >-
|
|
ess_rtc_external_ip ({{ ess_rtc_external_ip }}) is not a valid IP
|
|
address. LiveKit advertises this verbatim in ICE candidates; a bad
|
|
value silently breaks Element Call.
|
|
quiet: true
|
|
|
|
- name: Validate OIDC variables when OIDC is enabled
|
|
ansible.builtin.assert:
|
|
that:
|
|
- ess_oidc_issuer | length > 0
|
|
- ess_oidc_client_secret | length > 0
|
|
fail_msg: OIDC enabled but issuer / client_secret missing.
|
|
quiet: true
|
|
when: ess_oidc_enabled | bool
|
|
|
|
- name: Prerequisites (docker, networks, dirs, registry login)
|
|
ansible.builtin.import_tasks: prereq.yml
|
|
|
|
- name: Generate / verify the ess-generated secret bundle
|
|
ansible.builtin.import_tasks: secrets.yml
|
|
|
|
- name: Render all component configuration files
|
|
ansible.builtin.import_tasks: config.yml
|
|
|
|
- name: Render compose project file and start the stack
|
|
ansible.builtin.import_tasks: deploy.yml
|
|
|
|
- name: Post-install (create admin user)
|
|
ansible.builtin.import_tasks: postinstall.yml
|
|
when: ess_create_admin_user | bool
|