cqrenet/matrix-docker-ansible-deploy
3
0
Fork 0
mirror of https://github.com/spantaleev/matrix-docker-ansible-deploy.git synced 2026-03-25 22:17:25 +00:00
Code Issues Wiki Activity

matrix-authentication-service: add UNIX socket support for playbook-managed Postgres

Browse Source 
MAS now connects to the playbook-managed Postgres via a UNIX socket by
default (when available), matching the approach already used by Synapse.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This commit is contained in:
Slavi Pantaleev
2026-03-19 01:05:10 +02:00
parent f0a5393d48
commit 12af6da9d0
7 changed files with 55 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
roles/custom/matrix-authentication-service/defaults/main.yml
View File

@@ -300,6 +300,15 @@ matrix_authentication_service_config_database_idle_timeout: 600
# Controls the `database.max_lifetime` configuration setting.
matrix_authentication_service_config_database_max_lifetime: 1800
# Controls whether the database connection is made via a UNIX socket.
matrix_authentication_service_config_database_socket_enabled: false
# The path to the Postgres socket's parent directory inside the MAS container.
matrix_authentication_service_config_database_socket_path: "/run-postgres"
# The path to the Postgres socket directory on the host (bind-mount source).
matrix_authentication_service_config_database_socket_path_host: ""
########################################################################################
# #
# /Database configuration #

5
roles/custom/matrix-authentication-service/tasks/mas_cli_syn2mas.yml
View File

@@ -71,7 +71,10 @@
--mount type=bind,src={{ matrix_authentication_service_config_path }}/config.yaml,dst=/config.yaml,ro
--mount type=bind,src={{ matrix_authentication_service_data_keys_path }},dst=/keys,ro
--mount type=bind,src={{ matrix_authentication_service_syn2mas_synapse_homeserver_config_path }},dst=/homeserver.yaml,ro
{% if matrix_authentication_service_syn2mas_synapse_database_socket_enabled %}
{% if matrix_authentication_service_config_database_socket_enabled %}
--mount type=bind,src={{ matrix_authentication_service_config_database_socket_path_host }},dst={{ matrix_authentication_service_config_database_socket_path }}
{% endif %}
{% if matrix_authentication_service_syn2mas_synapse_database_socket_enabled and (not matrix_authentication_service_config_database_socket_enabled or matrix_authentication_service_syn2mas_synapse_database_socket_path != matrix_authentication_service_config_database_socket_path) %}
--mount type=bind,src={{ matrix_authentication_service_syn2mas_synapse_database_socket_path_host }},dst={{ matrix_authentication_service_syn2mas_synapse_database_socket_path }}
{% endif %}
{{ matrix_authentication_service_container_image }}

3
roles/custom/matrix-authentication-service/tasks/validate_config.yml
View File

@@ -14,7 +14,8 @@
- {'name': 'matrix_authentication_service_hostname', when: true}
- {'name': 'matrix_authentication_service_config_database_username', when: true}
- {'name': 'matrix_authentication_service_config_database_password', when: true}
- {'name': 'matrix_authentication_service_config_database_host', when: true}
- {'name': 'matrix_authentication_service_config_database_host', when: "{{ not matrix_authentication_service_config_database_socket_enabled }}"}
- {'name': 'matrix_authentication_service_config_database_socket_path_host', when: "{{ matrix_authentication_service_config_database_socket_enabled }}"}
- {'name': 'matrix_authentication_service_config_database_database', when: true}
- {'name': 'matrix_authentication_service_config_secrets_encryption', when: true}
- {'name': 'matrix_authentication_service_config_matrix_homeserver', when: true}

3
roles/custom/matrix-authentication-service/templates/systemd/matrix-authentication-service.service.j2
View File

@@ -28,6 +28,9 @@ ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} create \
--label-file={{ matrix_authentication_service_config_path }}/labels \
--mount type=bind,src={{ matrix_authentication_service_config_path }}/config.yaml,dst=/config.yaml,ro \
--mount type=bind,src={{ matrix_authentication_service_data_keys_path }},dst=/keys,ro \
{% if matrix_authentication_service_config_database_socket_enabled %}
--mount type=bind,src={{ matrix_authentication_service_config_database_socket_path_host }},dst={{ matrix_authentication_service_config_database_socket_path }} \
{% endif %}
{% for arg in matrix_authentication_service_container_extra_arguments %}
{{ arg }} \
{% endfor %}

7
roles/custom/matrix-base/defaults/main.yml
View File

@@ -254,6 +254,13 @@ matrix_playbook_synapse_uses_managed_postgres: false
matrix_playbook_synapse_uses_managed_valkey: false
matrix_playbook_synapse_auto_compressor_uses_managed_postgres: false
# This playbook-level helper describes whether Matrix Authentication Service should be wired
# to the playbook-managed Postgres instance.
# It is meant for orchestration concerns like container networking, systemd ordering, and database creation,
# while `matrix_authentication_service_*` variables stay focused on actual connection parameters.
# This likely gets overridden elsewhere.
matrix_playbook_matrix_authentication_service_uses_managed_postgres: false
# Controls whether various services should expose metrics publicly.
# If Prometheus is operating on the same machine, exposing metrics publicly is not necessary.
matrix_metrics_exposure_enabled: false