Test matrix-synapse with Molecule

2026-09-16 21:00:09 +00:00 · 2026-08-29 12:53:30 +03:00
parent f6d33e25ea
commit 3f52a5fac7
7 changed files with 647 additions and 1 deletions
@@ -0,0 +1,114 @@
+# SPDX-FileCopyrightText: 2026 Slavi Pantaleev
+#
+# SPDX-License-Identifier: AGPL-3.0-or-later
+
+---
+dependency:
+  name: galaxy
+  options:
+    requirements-file: requirements.yml
+    force: true
+driver:
+  name: docker
+platforms:
+  - name: synapse-${MOLECULE_DISTRO:-ubuntu2604}-default
+    image: "geerlingguy/docker-${MOLECULE_DISTRO:-ubuntu2604}-ansible:latest"
+    command: ${MOLECULE_DOCKER_COMMAND:-""}
+    volumes:
+      - /sys/fs/cgroup:/sys/fs/cgroup:rw
+    cgroupns_mode: host
+    privileged: true
+    pre_build_image: true
+provisioner:
+  name: ansible
+  config_options:
+    defaults:
+      callback_result_format: yaml
+  inventory:
+    group_vars:
+      all:
+        # This first scenario deliberately exercises one main Synapse process. Workers and
+        # everything they bring with them belong in a separate topology-focused scenario.
+        matrix_synapse_workers_enabled: false
+        matrix_synapse_redis_enabled: false
+        matrix_synapse_reverse_proxy_companion_enabled: false
+
+        matrix_synapse_username: matrix
+        matrix_synapse_uid: 1234
+        matrix_synapse_gid: 1234
+        matrix_synapse_container_network: synapse-molecule
+
+        # The non-default listener is reached only over the container network. Override the
+        # upstream image's health command as well, because its default assumes port 8008.
+        matrix_synapse_container_client_api_port: 18008
+        matrix_synapse_container_client_api_host_bind_port: ''
+        matrix_synapse_container_master_extra_arguments:
+          - "--health-cmd='curl -fSs http://localhost:18008/health'"
+        matrix_synapse_container_labels_traefik_enabled: false
+        matrix_synapse_container_labels_traefik_hostname: matrix.molecule.local
+        matrix_synapse_systemd_service_post_start_delay_seconds: 0
+
+        # Postgres is the normal deployment path. Distinct database and user names make the
+        # resulting Synapse schema evidence that these exact connection settings were used.
+        matrix_synapse_database_host: matrix-postgres-molecule
+        matrix_synapse_database_port: 5432
+        matrix_synapse_database_user: molecule_synapse
+        matrix_synapse_database_password: molecule_synapse_pg_password_9b742d
+        matrix_synapse_database_database: molecule_synapse
+        matrix_synapse_database_cp_min: 2
+        matrix_synapse_database_cp_max: 4
+
+        # Local scenario secrets only. They never authenticate to an external service.
+        matrix_synapse_macaroon_secret_key: molecule_synapse_macaroon_4b3f891d
+        matrix_synapse_registration_shared_secret: molecule_synapse_registration_27ed51a8
+        matrix_synapse_form_secret: molecule_synapse_form_96a04c7b
+        matrix_synapse_password_config_pepper: molecule_synapse_pepper_c0f371e6
+
+        # These values differ from both role and upstream defaults and are safe to exercise
+        # without introducing any external dependency.
+        matrix_synapse_public_baseurl: http://matrix.molecule.local:18008/
+        matrix_synapse_presence_enabled: false
+        matrix_synapse_max_upload_size_mb: 37
+        matrix_synapse_url_preview_enabled: false
+        matrix_synapse_allow_public_rooms_over_federation: false
+        matrix_synapse_user_directory_search_all_users: true
+        matrix_synapse_user_directory_prefer_local_users: true
+        matrix_synapse_trusted_key_servers: []
+        matrix_synapse_suppress_key_server_warning: true
+
+        # Keep the scenario fully local and intentionally exclude optional integrations.
+        matrix_synapse_federation_enabled: false
+        matrix_synapse_federation_port_openid_resource_required: false
+        matrix_synapse_tls_federation_listener_enabled: false
+        matrix_synapse_metrics_enabled: false
+        matrix_synapse_email_enabled: false
+        matrix_synapse_matrix_authentication_service_enabled: false
+        matrix_authentication_service_migration_in_progress: false
+        matrix_synapse_ext_synapse_s3_storage_provider_enabled: false
+        matrix_s3_media_store_enabled: false
+        matrix_playbook_ssl_enabled: false
+
+        # verify.yml is a separate play, so pin paths that otherwise come from role defaults.
+        # The component version is deliberately loaded from defaults/main.yml instead.
+        matrix_synapse_base_path: /matrix/synapse
+        matrix_synapse_config_dir_path: /matrix/synapse/config
+        matrix_synapse_storage_path: /matrix/synapse/storage
+        matrix_synapse_media_store_path: /matrix/synapse/storage/media-store
+  env:
+    # Workaround for https://github.com/ansible/molecule/issues/4391
+    ANSIBLE_ROLES_PATH: ${MOLECULE_PROJECT_DIRECTORY}/../..:/.ansible/roles:/usr/share/ansible/roles:/etc/ansible/roles:${ANSIBLE_HOME:-~/.ansible}/roles
+scenario:
+  test_sequence:
+    - dependency
+    - cleanup
+    - destroy
+    - syntax
+    - create
+    - prepare
+    - converge
+    - idempotence
+    - verify
+    - cleanup
+    - destroy
+verifier:
+  name: ansible