ba220d6cd6
Verified the role against the real matrix-stack Helm chart (pulled 26.6.1) and fixed divergences found during review. Bugs: - Add MAS OIDC discovery router: /.well-known/openid-configuration must hit the MAS root listener (8082), not web (8080) — was 404, breaking OIDC login - Add Synapse ip_range_blacklist (full SSRF blocklist for all outbound federation/identity requests; previously only url-preview blacklist present) - Make federation_client_minimum_tls_version unconditional (chart sets it in shared-underrides; role only set it when federation was enabled) - Restart only rendered fed-reader replicas in the handler instead of the whole compose project (missing services: filter) Chart alignment (26.5.1 -> 26.6.1): - Bump chart version and all image tags (mas -> matrix-authentication-service -pro:1.18.0, postgres 17, synapse v1.154.0-pro.1, element-web v1.12.21, etc.) - redis maxmemory 256mb -> chart default 40mb (configurable) - Add element-web map_style_url (configurable) Hardening / hygiene: - Validate ess_rtc_external_ip is a real IP (regex, no extra collection dep) - Read admin password from the in-container secret file instead of passing it on the host process list during mas-cli register-user - apt cache_valid_time, postgres first-boot-only comment, haproxy failover note - Add meta/argument_specs.yml documenting all public variables - README: chart version, service count, OIDC discovery verification step Signed-off-by: Simon Bärlocher <simon@whatwedo.ch>
46 lines
1.2 KiB
YAML
46 lines
1.2 KiB
YAML
# SPDX-License-Identifier: MIT-0
|
|
---
|
|
- name: Ensure prerequisite packages on the control target
|
|
ansible.builtin.apt:
|
|
name:
|
|
- ca-certificates
|
|
- python3-docker
|
|
- python3-cryptography
|
|
state: present
|
|
update_cache: true
|
|
cache_valid_time: 3600
|
|
|
|
- name: Verify docker compose plugin is available
|
|
ansible.builtin.command: docker compose version
|
|
register: ess_compose_check
|
|
changed_when: false
|
|
failed_when: ess_compose_check.rc != 0
|
|
|
|
- name: Create project directory tree
|
|
ansible.builtin.file:
|
|
path: "{{ item }}"
|
|
state: directory
|
|
mode: "0750"
|
|
owner: root
|
|
group: root
|
|
loop: "{{ _ess_dirs }}"
|
|
|
|
- name: Tighten secrets directory permissions
|
|
ansible.builtin.file:
|
|
path: "{{ ess_compose_secrets_dir }}"
|
|
state: directory
|
|
mode: "0700"
|
|
owner: root
|
|
group: root
|
|
|
|
- name: Ensure the external Traefik proxy network exists
|
|
community.docker.docker_network:
|
|
name: "{{ ess_compose_traefik_network }}"
|
|
state: present
|
|
|
|
- name: Authenticate against the Element container registry
|
|
community.docker.docker_login:
|
|
registry_url: "{{ ess_registry_url }}"
|
|
username: "{{ ess_registry_username }}"
|
|
password: "{{ ess_registry_token }}"
|
|
no_log: true
|