ba220d6cd6
Verified the role against the real matrix-stack Helm chart (pulled 26.6.1) and fixed divergences found during review. Bugs: - Add MAS OIDC discovery router: /.well-known/openid-configuration must hit the MAS root listener (8082), not web (8080) — was 404, breaking OIDC login - Add Synapse ip_range_blacklist (full SSRF blocklist for all outbound federation/identity requests; previously only url-preview blacklist present) - Make federation_client_minimum_tls_version unconditional (chart sets it in shared-underrides; role only set it when federation was enabled) - Restart only rendered fed-reader replicas in the handler instead of the whole compose project (missing services: filter) Chart alignment (26.5.1 -> 26.6.1): - Bump chart version and all image tags (mas -> matrix-authentication-service -pro:1.18.0, postgres 17, synapse v1.154.0-pro.1, element-web v1.12.21, etc.) - redis maxmemory 256mb -> chart default 40mb (configurable) - Add element-web map_style_url (configurable) Hardening / hygiene: - Validate ess_rtc_external_ip is a real IP (regex, no extra collection dep) - Read admin password from the in-container secret file instead of passing it on the host process list during mas-cli register-user - apt cache_valid_time, postgres first-boot-only comment, haproxy failover note - Add meta/argument_specs.yml documenting all public variables - README: chart version, service count, OIDC discovery verification step Signed-off-by: Simon Bärlocher <simon@whatwedo.ch>
52 lines
1.9 KiB
YAML
52 lines
1.9 KiB
YAML
# SPDX-License-Identifier: MIT-0
|
|
---
|
|
# Create @localadmin via mas-cli, using the ADMIN_USER_PASSWORD generated
|
|
# by secrets.yml. Idempotent: mas-cli rejects duplicates, we ignore that.
|
|
|
|
- name: Check whether the admin user already exists
|
|
ansible.builtin.command:
|
|
cmd: >
|
|
docker compose -f {{ _ess_compose_file }}
|
|
exec -T mas
|
|
mas-cli --config /conf/mas-config.yaml
|
|
manage list-users --filter username={{ ess_admin_localpart }}
|
|
register: _ess_admin_check
|
|
changed_when: false
|
|
failed_when: false
|
|
|
|
# The password is read from the secrets file *inside* the mas container (it is
|
|
# already bind-mounted there read-only). Passing it as $(cat ...) inside the
|
|
# container shell keeps it off the host's process list — only the host root can
|
|
# read it anyway, but this avoids leaking it via `ps` during the exec.
|
|
- name: Register admin user (mas-cli)
|
|
ansible.builtin.command:
|
|
argv:
|
|
- docker
|
|
- compose
|
|
- -f
|
|
- "{{ _ess_compose_file }}"
|
|
- exec
|
|
- -T
|
|
- mas
|
|
- sh
|
|
- -c
|
|
- >-
|
|
mas-cli --config /conf/mas-config.yaml manage register-user --yes
|
|
--password "$(cat /secrets/ess-generated/ADMIN_USER_PASSWORD)"
|
|
--admin {{ ess_admin_localpart | quote }}
|
|
register: _ess_admin_create
|
|
changed_when: "'created' in (_ess_admin_create.stdout + _ess_admin_create.stderr) | lower"
|
|
failed_when:
|
|
- _ess_admin_create.rc != 0
|
|
- "'already exists' not in (_ess_admin_create.stdout + _ess_admin_create.stderr) | lower"
|
|
no_log: true
|
|
when: ess_admin_localpart not in _ess_admin_check.stdout
|
|
|
|
- name: Login hint
|
|
ansible.builtin.debug:
|
|
msg: |
|
|
Stack is up.
|
|
Admin user: @{{ ess_admin_localpart }}:{{ ess_server_name }}
|
|
Password is in {{ ess_compose_secrets_dir }}/ADMIN_USER_PASSWORD on this host.
|
|
Element Web: https://{{ ess_hostnames.element_web }}
|
|
Element Admin: https://{{ ess_hostnames.element_admin }}
|