Initial release: ghost_protocol privacy toolkit
This commit is contained in:
ghost
@@ -0,0 +1,38 @@
|
||||
---
|
||||
# Matrix (Synapse) + Element Web deployment
|
||||
# Installs Synapse homeserver with optional Element Web frontend
|
||||
|
||||
- name: Deploy Matrix Homeserver
|
||||
hosts: all
|
||||
become: true
|
||||
vars:
|
||||
matrix_domain: "{{ domain }}"
|
||||
matrix_server_name: "{{ matrix_server_name | default(domain) }}"
|
||||
matrix_admin: "{{ matrix_admin_user | default('admin') }}"
|
||||
matrix_admin_pass: "{{ matrix_admin_password }}"
|
||||
matrix_registration_enabled: "{{ matrix_registration | default(false) }}"
|
||||
element_enabled: "{{ matrix_element_web | default(true) }}"
|
||||
matrix_signing_key: "{{ matrix_signing_key }}"
|
||||
target_host: "{{ target_host | default('localhost') }}"
|
||||
|
||||
tasks:
|
||||
- name: Include Synapse installation tasks
|
||||
include_tasks: tasks/synapse.yml
|
||||
|
||||
- name: Include Element Web tasks
|
||||
include_tasks: tasks/element.yml
|
||||
when: element_enabled | bool
|
||||
|
||||
- name: Include nginx reverse proxy tasks
|
||||
include_tasks: tasks/nginx.yml
|
||||
|
||||
handlers:
|
||||
- name: restart synapse
|
||||
service:
|
||||
name: matrix-synapse
|
||||
state: restarted
|
||||
|
||||
- name: reload nginx
|
||||
service:
|
||||
name: nginx
|
||||
state: reloaded
|
||||
@@ -0,0 +1,44 @@
|
||||
---
|
||||
# Element Web frontend installation
|
||||
|
||||
- name: Install nginx (if not already)
|
||||
apt:
|
||||
name: nginx
|
||||
state: present
|
||||
|
||||
- name: Create Element Web directory
|
||||
file:
|
||||
path: /var/www/element
|
||||
state: directory
|
||||
owner: www-data
|
||||
group: www-data
|
||||
mode: "0755"
|
||||
|
||||
- name: Download latest Element Web release
|
||||
shell: |
|
||||
LATEST=$(curl -s https://api.github.com/repos/element-hq/element-web/releases/latest | grep -oP '"tag_name": "\K[^"]+')
|
||||
curl -sL "https://github.com/element-hq/element-web/releases/download/${LATEST}/element-${LATEST}.tar.gz" | tar xz -C /var/www/element --strip-components=1
|
||||
args:
|
||||
creates: /var/www/element/index.html
|
||||
|
||||
- name: Deploy Element Web config
|
||||
copy:
|
||||
dest: /var/www/element/config.json
|
||||
content: |
|
||||
{
|
||||
"default_server_config": {
|
||||
"m.homeserver": {
|
||||
"base_url": "https://{{ matrix_domain }}",
|
||||
"server_name": "{{ matrix_server_name }}"
|
||||
}
|
||||
},
|
||||
"brand": "Element",
|
||||
"integrations_ui_url": "",
|
||||
"integrations_rest_url": "",
|
||||
"disable_guests": true,
|
||||
"disable_3pid_login": false,
|
||||
"default_theme": "dark"
|
||||
}
|
||||
owner: www-data
|
||||
group: www-data
|
||||
mode: "0644"
|
||||
@@ -0,0 +1,115 @@
|
||||
---
|
||||
# Nginx reverse proxy for Matrix + Element
|
||||
# Two-phase: HTTP-only first for certbot, then full SSL config
|
||||
|
||||
- name: Create certbot webroot
|
||||
file:
|
||||
path: /var/www/certbot
|
||||
state: directory
|
||||
owner: www-data
|
||||
group: www-data
|
||||
mode: "0755"
|
||||
|
||||
- name: Deploy HTTP-only nginx config (for certbot)
|
||||
copy:
|
||||
dest: /etc/nginx/sites-available/matrix
|
||||
content: |
|
||||
server {
|
||||
listen 80;
|
||||
server_name {{ matrix_domain }};
|
||||
|
||||
location /.well-known/acme-challenge/ {
|
||||
root /var/www/certbot;
|
||||
}
|
||||
|
||||
location / {
|
||||
return 200 'phantom setup in progress';
|
||||
add_header Content-Type text/plain;
|
||||
}
|
||||
}
|
||||
mode: "0644"
|
||||
notify: reload nginx
|
||||
|
||||
- name: Enable Matrix nginx site
|
||||
file:
|
||||
src: /etc/nginx/sites-available/matrix
|
||||
dest: /etc/nginx/sites-enabled/matrix
|
||||
state: link
|
||||
notify: reload nginx
|
||||
|
||||
- name: Flush handlers to apply HTTP config
|
||||
meta: flush_handlers
|
||||
|
||||
- name: Obtain TLS certificate
|
||||
command: >
|
||||
certbot certonly --webroot -w /var/www/certbot
|
||||
-d {{ matrix_domain }}
|
||||
--non-interactive
|
||||
--agree-tos
|
||||
{% if certbot_email is defined and certbot_email %}
|
||||
--email {{ certbot_email }}
|
||||
{% else %}
|
||||
--register-unsafely-without-email
|
||||
{% endif %}
|
||||
args:
|
||||
creates: "/etc/letsencrypt/live/{{ matrix_domain }}/fullchain.pem"
|
||||
|
||||
- name: Deploy full SSL nginx config
|
||||
copy:
|
||||
dest: /etc/nginx/sites-available/matrix
|
||||
content: |
|
||||
server {
|
||||
listen 80;
|
||||
server_name {{ matrix_domain }};
|
||||
|
||||
location /.well-known/acme-challenge/ {
|
||||
root /var/www/certbot;
|
||||
}
|
||||
|
||||
location / {
|
||||
return 301 https://$host$request_uri;
|
||||
}
|
||||
}
|
||||
|
||||
server {
|
||||
listen 443 ssl http2;
|
||||
listen 8448 ssl http2;
|
||||
server_name {{ matrix_domain }};
|
||||
|
||||
ssl_certificate /etc/letsencrypt/live/{{ matrix_domain }}/fullchain.pem;
|
||||
ssl_certificate_key /etc/letsencrypt/live/{{ matrix_domain }}/privkey.pem;
|
||||
|
||||
ssl_protocols TLSv1.2 TLSv1.3;
|
||||
ssl_ciphers HIGH:!aNULL:!MD5;
|
||||
ssl_prefer_server_ciphers on;
|
||||
|
||||
client_max_body_size 50m;
|
||||
|
||||
# Synapse
|
||||
location ~* ^(\/_matrix|\/_synapse\/client) {
|
||||
proxy_pass http://127.0.0.1:8008;
|
||||
proxy_set_header X-Forwarded-For $remote_addr;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
proxy_set_header Host $host;
|
||||
}
|
||||
|
||||
# .well-known delegation
|
||||
location /.well-known/matrix/server {
|
||||
return 200 '{"m.server": "{{ matrix_domain }}:443"}';
|
||||
add_header Content-Type application/json;
|
||||
}
|
||||
|
||||
location /.well-known/matrix/client {
|
||||
return 200 '{"m.homeserver": {"base_url": "https://{{ matrix_domain }}"}}';
|
||||
add_header Content-Type application/json;
|
||||
add_header Access-Control-Allow-Origin *;
|
||||
}
|
||||
|
||||
# Element Web (if enabled)
|
||||
location / {
|
||||
root /var/www/element;
|
||||
try_files $uri $uri/ /index.html;
|
||||
}
|
||||
}
|
||||
mode: "0644"
|
||||
notify: reload nginx
|
||||
@@ -0,0 +1,99 @@
|
||||
---
|
||||
# Synapse homeserver installation and configuration
|
||||
|
||||
- name: Install dependencies
|
||||
apt:
|
||||
name:
|
||||
- python3
|
||||
- python3-pip
|
||||
- python3-venv
|
||||
- libpq-dev
|
||||
- postgresql
|
||||
- postgresql-contrib
|
||||
- nginx
|
||||
- certbot
|
||||
- python3-certbot-nginx
|
||||
state: present
|
||||
|
||||
- name: Add Matrix Synapse apt repository key
|
||||
apt_key:
|
||||
url: https://packages.matrix.org/debian/matrix-org-archive-keyring.gpg
|
||||
state: present
|
||||
|
||||
- name: Add Matrix Synapse apt repository
|
||||
apt_repository:
|
||||
repo: "deb https://packages.matrix.org/debian/ {{ ansible_distribution_release }} main"
|
||||
state: present
|
||||
filename: matrix-org
|
||||
|
||||
- name: Install Synapse
|
||||
apt:
|
||||
name: matrix-synapse-py3
|
||||
state: present
|
||||
environment:
|
||||
DEBIAN_FRONTEND: noninteractive
|
||||
|
||||
- name: Create PostgreSQL database
|
||||
become_user: postgres
|
||||
postgresql_db:
|
||||
name: synapse
|
||||
encoding: UTF-8
|
||||
lc_collate: C
|
||||
lc_ctype: C
|
||||
template: template0
|
||||
|
||||
- name: Create PostgreSQL user
|
||||
become_user: postgres
|
||||
postgresql_user:
|
||||
name: synapse
|
||||
password: "{{ matrix_signing_key[:32] }}"
|
||||
db: synapse
|
||||
priv: ALL
|
||||
|
||||
- name: Deploy Synapse homeserver config
|
||||
template:
|
||||
src: ../templates/homeserver.yaml.j2
|
||||
dest: /etc/matrix-synapse/homeserver.yaml
|
||||
owner: matrix-synapse
|
||||
group: matrix-synapse
|
||||
mode: "0640"
|
||||
notify: restart synapse
|
||||
|
||||
- name: Allow Matrix federation port through UFW
|
||||
ufw:
|
||||
rule: allow
|
||||
port: "8448"
|
||||
proto: tcp
|
||||
|
||||
- name: Allow HTTP/HTTPS through UFW
|
||||
ufw:
|
||||
rule: allow
|
||||
port: "{{ item }}"
|
||||
proto: tcp
|
||||
loop:
|
||||
- "80"
|
||||
- "443"
|
||||
|
||||
- name: Enable and start Synapse
|
||||
service:
|
||||
name: matrix-synapse
|
||||
state: started
|
||||
enabled: true
|
||||
|
||||
- name: Wait for Synapse to be ready
|
||||
wait_for:
|
||||
port: 8008
|
||||
host: 127.0.0.1
|
||||
timeout: 30
|
||||
|
||||
- name: Create admin user
|
||||
command: >
|
||||
register_new_matrix_user
|
||||
-u {{ matrix_admin }}
|
||||
-p {{ matrix_admin_pass }}
|
||||
-a
|
||||
-c /etc/matrix-synapse/homeserver.yaml
|
||||
http://localhost:8008
|
||||
register: admin_create
|
||||
failed_when: false
|
||||
changed_when: admin_create.rc == 0
|
||||
@@ -0,0 +1,53 @@
|
||||
## Synapse Homeserver Configuration
|
||||
## Generated by phantom
|
||||
|
||||
server_name: "{{ matrix_server_name }}"
|
||||
pid_file: /run/matrix-synapse.pid
|
||||
|
||||
listeners:
|
||||
- port: 8008
|
||||
tls: false
|
||||
type: http
|
||||
x_forwarded: true
|
||||
resources:
|
||||
- names: [client, federation]
|
||||
compress: false
|
||||
|
||||
database:
|
||||
name: psycopg2
|
||||
args:
|
||||
user: synapse
|
||||
password: "{{ matrix_signing_key[:32] }}"
|
||||
database: synapse
|
||||
host: localhost
|
||||
cp_min: 5
|
||||
cp_max: 10
|
||||
|
||||
log_config: "/etc/matrix-synapse/log.yaml"
|
||||
media_store_path: /var/lib/matrix-synapse/media
|
||||
signing_key_path: "/etc/matrix-synapse/{{ matrix_server_name }}.signing.key"
|
||||
|
||||
enable_registration: {{ matrix_registration_enabled | lower }}
|
||||
{% if not matrix_registration_enabled %}
|
||||
enable_registration_without_verification: false
|
||||
{% endif %}
|
||||
|
||||
suppress_key_server_warning: true
|
||||
|
||||
trusted_key_servers:
|
||||
- server_name: "matrix.org"
|
||||
|
||||
max_upload_size: 50M
|
||||
|
||||
url_preview_enabled: true
|
||||
url_preview_ip_range_blacklist:
|
||||
- '127.0.0.0/8'
|
||||
- '10.0.0.0/8'
|
||||
- '172.16.0.0/12'
|
||||
- '192.168.0.0/16'
|
||||
- '100.64.0.0/10'
|
||||
- '192.0.0.0/24'
|
||||
- '169.254.0.0/16'
|
||||
- '::1/128'
|
||||
- 'fe80::/10'
|
||||
- 'fc00::/7'
|
||||
Reference in New Issue
Block a user