Initial release: ghost_protocol privacy toolkit
This commit is contained in:
ghost
@@ -0,0 +1,44 @@
|
||||
---
|
||||
# Element Web frontend installation
|
||||
|
||||
- name: Install nginx (if not already)
|
||||
apt:
|
||||
name: nginx
|
||||
state: present
|
||||
|
||||
- name: Create Element Web directory
|
||||
file:
|
||||
path: /var/www/element
|
||||
state: directory
|
||||
owner: www-data
|
||||
group: www-data
|
||||
mode: "0755"
|
||||
|
||||
- name: Download latest Element Web release
|
||||
shell: |
|
||||
LATEST=$(curl -s https://api.github.com/repos/element-hq/element-web/releases/latest | grep -oP '"tag_name": "\K[^"]+')
|
||||
curl -sL "https://github.com/element-hq/element-web/releases/download/${LATEST}/element-${LATEST}.tar.gz" | tar xz -C /var/www/element --strip-components=1
|
||||
args:
|
||||
creates: /var/www/element/index.html
|
||||
|
||||
- name: Deploy Element Web config
|
||||
copy:
|
||||
dest: /var/www/element/config.json
|
||||
content: |
|
||||
{
|
||||
"default_server_config": {
|
||||
"m.homeserver": {
|
||||
"base_url": "https://{{ matrix_domain }}",
|
||||
"server_name": "{{ matrix_server_name }}"
|
||||
}
|
||||
},
|
||||
"brand": "Element",
|
||||
"integrations_ui_url": "",
|
||||
"integrations_rest_url": "",
|
||||
"disable_guests": true,
|
||||
"disable_3pid_login": false,
|
||||
"default_theme": "dark"
|
||||
}
|
||||
owner: www-data
|
||||
group: www-data
|
||||
mode: "0644"
|
||||
@@ -0,0 +1,115 @@
|
||||
---
|
||||
# Nginx reverse proxy for Matrix + Element
|
||||
# Two-phase: HTTP-only first for certbot, then full SSL config
|
||||
|
||||
- name: Create certbot webroot
|
||||
file:
|
||||
path: /var/www/certbot
|
||||
state: directory
|
||||
owner: www-data
|
||||
group: www-data
|
||||
mode: "0755"
|
||||
|
||||
- name: Deploy HTTP-only nginx config (for certbot)
|
||||
copy:
|
||||
dest: /etc/nginx/sites-available/matrix
|
||||
content: |
|
||||
server {
|
||||
listen 80;
|
||||
server_name {{ matrix_domain }};
|
||||
|
||||
location /.well-known/acme-challenge/ {
|
||||
root /var/www/certbot;
|
||||
}
|
||||
|
||||
location / {
|
||||
return 200 'phantom setup in progress';
|
||||
add_header Content-Type text/plain;
|
||||
}
|
||||
}
|
||||
mode: "0644"
|
||||
notify: reload nginx
|
||||
|
||||
- name: Enable Matrix nginx site
|
||||
file:
|
||||
src: /etc/nginx/sites-available/matrix
|
||||
dest: /etc/nginx/sites-enabled/matrix
|
||||
state: link
|
||||
notify: reload nginx
|
||||
|
||||
- name: Flush handlers to apply HTTP config
|
||||
meta: flush_handlers
|
||||
|
||||
- name: Obtain TLS certificate
|
||||
command: >
|
||||
certbot certonly --webroot -w /var/www/certbot
|
||||
-d {{ matrix_domain }}
|
||||
--non-interactive
|
||||
--agree-tos
|
||||
{% if certbot_email is defined and certbot_email %}
|
||||
--email {{ certbot_email }}
|
||||
{% else %}
|
||||
--register-unsafely-without-email
|
||||
{% endif %}
|
||||
args:
|
||||
creates: "/etc/letsencrypt/live/{{ matrix_domain }}/fullchain.pem"
|
||||
|
||||
- name: Deploy full SSL nginx config
|
||||
copy:
|
||||
dest: /etc/nginx/sites-available/matrix
|
||||
content: |
|
||||
server {
|
||||
listen 80;
|
||||
server_name {{ matrix_domain }};
|
||||
|
||||
location /.well-known/acme-challenge/ {
|
||||
root /var/www/certbot;
|
||||
}
|
||||
|
||||
location / {
|
||||
return 301 https://$host$request_uri;
|
||||
}
|
||||
}
|
||||
|
||||
server {
|
||||
listen 443 ssl http2;
|
||||
listen 8448 ssl http2;
|
||||
server_name {{ matrix_domain }};
|
||||
|
||||
ssl_certificate /etc/letsencrypt/live/{{ matrix_domain }}/fullchain.pem;
|
||||
ssl_certificate_key /etc/letsencrypt/live/{{ matrix_domain }}/privkey.pem;
|
||||
|
||||
ssl_protocols TLSv1.2 TLSv1.3;
|
||||
ssl_ciphers HIGH:!aNULL:!MD5;
|
||||
ssl_prefer_server_ciphers on;
|
||||
|
||||
client_max_body_size 50m;
|
||||
|
||||
# Synapse
|
||||
location ~* ^(\/_matrix|\/_synapse\/client) {
|
||||
proxy_pass http://127.0.0.1:8008;
|
||||
proxy_set_header X-Forwarded-For $remote_addr;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
proxy_set_header Host $host;
|
||||
}
|
||||
|
||||
# .well-known delegation
|
||||
location /.well-known/matrix/server {
|
||||
return 200 '{"m.server": "{{ matrix_domain }}:443"}';
|
||||
add_header Content-Type application/json;
|
||||
}
|
||||
|
||||
location /.well-known/matrix/client {
|
||||
return 200 '{"m.homeserver": {"base_url": "https://{{ matrix_domain }}"}}';
|
||||
add_header Content-Type application/json;
|
||||
add_header Access-Control-Allow-Origin *;
|
||||
}
|
||||
|
||||
# Element Web (if enabled)
|
||||
location / {
|
||||
root /var/www/element;
|
||||
try_files $uri $uri/ /index.html;
|
||||
}
|
||||
}
|
||||
mode: "0644"
|
||||
notify: reload nginx
|
||||
@@ -0,0 +1,99 @@
|
||||
---
|
||||
# Synapse homeserver installation and configuration
|
||||
|
||||
- name: Install dependencies
|
||||
apt:
|
||||
name:
|
||||
- python3
|
||||
- python3-pip
|
||||
- python3-venv
|
||||
- libpq-dev
|
||||
- postgresql
|
||||
- postgresql-contrib
|
||||
- nginx
|
||||
- certbot
|
||||
- python3-certbot-nginx
|
||||
state: present
|
||||
|
||||
- name: Add Matrix Synapse apt repository key
|
||||
apt_key:
|
||||
url: https://packages.matrix.org/debian/matrix-org-archive-keyring.gpg
|
||||
state: present
|
||||
|
||||
- name: Add Matrix Synapse apt repository
|
||||
apt_repository:
|
||||
repo: "deb https://packages.matrix.org/debian/ {{ ansible_distribution_release }} main"
|
||||
state: present
|
||||
filename: matrix-org
|
||||
|
||||
- name: Install Synapse
|
||||
apt:
|
||||
name: matrix-synapse-py3
|
||||
state: present
|
||||
environment:
|
||||
DEBIAN_FRONTEND: noninteractive
|
||||
|
||||
- name: Create PostgreSQL database
|
||||
become_user: postgres
|
||||
postgresql_db:
|
||||
name: synapse
|
||||
encoding: UTF-8
|
||||
lc_collate: C
|
||||
lc_ctype: C
|
||||
template: template0
|
||||
|
||||
- name: Create PostgreSQL user
|
||||
become_user: postgres
|
||||
postgresql_user:
|
||||
name: synapse
|
||||
password: "{{ matrix_signing_key[:32] }}"
|
||||
db: synapse
|
||||
priv: ALL
|
||||
|
||||
- name: Deploy Synapse homeserver config
|
||||
template:
|
||||
src: ../templates/homeserver.yaml.j2
|
||||
dest: /etc/matrix-synapse/homeserver.yaml
|
||||
owner: matrix-synapse
|
||||
group: matrix-synapse
|
||||
mode: "0640"
|
||||
notify: restart synapse
|
||||
|
||||
- name: Allow Matrix federation port through UFW
|
||||
ufw:
|
||||
rule: allow
|
||||
port: "8448"
|
||||
proto: tcp
|
||||
|
||||
- name: Allow HTTP/HTTPS through UFW
|
||||
ufw:
|
||||
rule: allow
|
||||
port: "{{ item }}"
|
||||
proto: tcp
|
||||
loop:
|
||||
- "80"
|
||||
- "443"
|
||||
|
||||
- name: Enable and start Synapse
|
||||
service:
|
||||
name: matrix-synapse
|
||||
state: started
|
||||
enabled: true
|
||||
|
||||
- name: Wait for Synapse to be ready
|
||||
wait_for:
|
||||
port: 8008
|
||||
host: 127.0.0.1
|
||||
timeout: 30
|
||||
|
||||
- name: Create admin user
|
||||
command: >
|
||||
register_new_matrix_user
|
||||
-u {{ matrix_admin }}
|
||||
-p {{ matrix_admin_pass }}
|
||||
-a
|
||||
-c /etc/matrix-synapse/homeserver.yaml
|
||||
http://localhost:8008
|
||||
register: admin_create
|
||||
failed_when: false
|
||||
changed_when: admin_create.rc == 0
|
||||
Reference in New Issue
Block a user