cdist-ungleich/type/__ungleich_matrix/manifest

#!/bin/sh -e
#
# $CURSE spaces - I can't munch indentation in heredocs with them. Let's force
# tabs here! -- Timothée
# vi: noexpandtab
#
# 2020-2021 Timothée Floure (timothee.floure@ungleich.ch)
os=$(cat "$__global/explorer/os")
if [ "$os" != "debian" ]; then
	echo "This type expects to run on Debian" >&2
	exit 1
fi

###
# Type-level flags. Feel free to change them.

# Nginx and synapse maximum size for uploaded files.
MAX_UPLOAD_SIZE=100M

# Default domain for Jitsi
JITSI_DOMAIN=talk.ungleich.ch

# (Source) address used by prometheus to fetch synapse metrics.
PROMETHEUS_SOURCE_ADDRESS=2a0a:e5c0:2:12:0:f0ff:fea9:c461

# ungleich's privacy policy - displayed in element web client.
PRIVACY_POLICY_URL=https://redmine.ungleich.ch/projects/open-infrastructure/wiki/Security_and_Privacy_Policy

# SMTP server used to send Synapse's notifications.
SMTP_SERVER="smtp.ungleich.ch"
SMTP_SERVER_PORT="587"

###
# Type-parameters and generic configuration. You should not have to touch them.

# Type parameters.
matrix_domain=$(cat "$__object/parameter/matrix-domain")
synapse_domain=$(cat "$__object/parameter/synapse-domain")

if [ -f "$__object/parameter/element-domain" ]; then
	element_domain=$(cat "$__object/parameter/element-domain")
	deploy_element=1
fi
if [ -f "$__object/parameter/element-version" ]; then
	element_version=$(cat "$__object/parameter/element-version")
fi

synapse_smtp_user=$(cat "$__object/parameter/synapse-smtp-user")
synapse_smtp_password=$(cat "$__object/parameter/synapse-smtp-password")

if [ -f "$__object/parameter/synapse-extra-parameters" ]; then
	synapse_extra_parameters=$(cat "$__object/parameter/synapse-extra-parameters")
fi
if [ -f "$__object/parameter/element-extra-parameters" ]; then
	element_extra_parameters=$(cat "$__object/parameter/element-extra-parameters")
fi

# Generic configuration - shared with all ungleich Matrix deployments.
synapse_base_url="https://$synapse_domain"

postgres_user='matrix-synapse'
postgres_database='matrix-synapse'

# Required by the __ungleich_nginx_static_site type.
www_directory_owner=root
nginx_basedir='/var/www/static'

##
# Check for invalid parameter combinations.

if [ -n "$element_domain" ] && [ -z "$element_version" ]; then
	echo "--element-version is required if --element-domain is set." >&2
	exit 1
fi
if [ -z "$element_domain" ] && [ -n "$element_version" ]; then
	echo "--element-domain is required if --element-version is set." >&2
	exit 1
fi

##
# Deployment logic.

# Install & configure PGSQL database.
__package postgresql
require="__package/postgresql" __postgres_role $postgres_user --login
require="__postgres_role/$postgres_user" __postgres_database $postgres_user \
	--owner $postgres_user \
	--encoding UTF8 \
	--lc-collate C \
	--lc-ctype C \
	--template template0

# Install & configure Synapse (matrix homeserver).
# shellcheck disable=SC2086
__matrix_synapse \
	--server-name "$matrix_domain" \
	--base-url "$synapse_base_url" \
	--max-upload-size "$MAX_UPLOAD_SIZE" \
	--expose-metrics \
	--database-engine 'psycopg2' \
	--database-name "$postgres_database" \
	--database-user "$postgres_user" \
	--database-host '/var/run/postgresql' \
	--enable-notifications \
	--notification-from "Matrix <$synapse_smtp_user>" \
	--smtp-host "$SMTP_SERVER" \
	--smtp-port "$SMTP_SERVER_PORT" \
	--smtp-use-starttls \
	--smtp-user "$synapse_smtp_user" \
	--smtp-pass "$synapse_smtp_password" \
	$synapse_extra_parameters

# Install and configure NGINX web server/proxy.
__package nginx

synapse_nginx_config="$(cat << EOF
# Deny access to root.
deny all;

location ~ /_matrix|/_synapse {
    # Allow anyone to reach synapse.
    allow all;

    # Allow uploading large files.
    client_max_body_size ${MAX_UPLOAD_SIZE:?};

    # Proxy configuration.
    proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto \$scheme;
    proxy_set_header Host \$http_host;
    proxy_set_header X-Real-IP \$remote_addr;
    proxy_pass http://localhost:8008;

    location ~ /_synapse/metrics {
        # service-monitoring.p6 (monitoring LAN).
        allow $PROMETHEUS_SOURCE_ADDRESS;
        deny all;

        proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto \$scheme;
        proxy_set_header Host \$http_host;
        proxy_set_header X-Real-IP \$remote_addr;
        proxy_pass http://localhost:8008;
      }
  }
EOF
)"

require="__matrix_synapse __package/nginx" \
	__ungleich_nginx_static_site "$synapse_domain" \
	--owner "$www_directory_owner" \
	--listen '443 [::]:443' \
	--base_directory "$nginx_basedir" \
	--locationopt "$synapse_nginx_config"

# Delegate Matrix federation to port 443 & configure server discovery from
# clients if matrix_domain is element_domain (= both are handled by this
# type).
element_nginx_config=
if [ "$element_domain" = "${matrix_domain:?}" ]; then
	element_nginx_config="$(cat <<- EOF
	location = /.well-known/matrix/server {
		default_type application/json;
		return 200 '{"m.server": "${synapse_domain:?}:443"}';
	}

	location = /.well-known/matrix/client {
		add_header 'Access-Control-Allow-Origin' '*';
		default_type application/json;
		return 200 '{
			"m.homeserver": {
				"base_url": "${synapse_base_url:?}"
			},
			"im.vector.riot.jitsi": {
				"preferredDomain": "${JITSI_DOMAIN:?}"
			}
		}';
	}
	EOF
	)"
fi

if [ -n "$deploy_element" ]; then
	# Install & configure Element (matrix web client).
	# shellcheck disable=SC2086
	__matrix_element ungleich \
		--install_dir "$nginx_basedir/$www_directory_owner/$element_domain/www" \
		--default_server_url "$synapse_base_url" \
		--default_server_name "$matrix_domain" \
		--owner "$www_directory_owner" \
		--version "$element_version" \
		--jitsi_domain "$JITSI_DOMAIN" \
		--privacy_policy_url "$PRIVACY_POLICY_URL" \
		--disable_custom_urls \
		--branding_auth_footer_links [] \
		$element_extra_parameters

	require="__package/nginx" \
		__ungleich_nginx_static_site "$element_domain" \
		--owner "$www_directory_owner" \
		--listen '443 [::]:443' \
		--base_directory "$nginx_basedir" \
		--locationopt "$element_nginx_config"
fi