matrix-docker-ansible-deploy/roles/custom/matrix-bot-draupnir/defaults/main.yml

# SPDX-FileCopyrightText: 2023 - 2024 MDAD project contributors
# SPDX-FileCopyrightText: 2023 - 2026 Catalan Lover <catalanlover@protonmail.com>
# SPDX-FileCopyrightText: 2023 Samuel Meenzen
# SPDX-FileCopyrightText: 2024 - 2025 Slavi Pantaleev
#
# SPDX-License-Identifier: AGPL-3.0-or-later

---
# A moderation tool for Matrix
# Project source code URL: https://github.com/the-draupnir-project/Draupnir

matrix_bot_draupnir_enabled: true

# renovate: datasource=docker depName=ghcr.io/the-draupnir-project/draupnir
matrix_bot_draupnir_version: "v3.2.0"

matrix_bot_draupnir_container_image_self_build: false
matrix_bot_draupnir_container_image_self_build_repo: "https://github.com/the-draupnir-project/Draupnir.git"

matrix_bot_draupnir_container_image: "{{ matrix_bot_draupnir_container_image_registry_prefix }}{{ matrix_bot_draupnir_container_image_registry_namespace_identifier }}:{{ matrix_bot_draupnir_version }}"
matrix_bot_draupnir_container_image_registry_namespace_identifier: "the-draupnir-project/draupnir"
matrix_bot_draupnir_container_image_registry_prefix: "{{ 'localhost/' if matrix_bot_draupnir_container_image_self_build else matrix_bot_draupnir_container_image_registry_prefix_upstream }}"
matrix_bot_draupnir_container_image_registry_prefix_upstream: "{{ matrix_bot_draupnir_container_image_registry_prefix_upstream_default }}"
matrix_bot_draupnir_container_image_registry_prefix_upstream_default: "ghcr.io/"

matrix_bot_draupnir_base_path: "{{ matrix_base_data_path }}/draupnir"
matrix_bot_draupnir_config_path: "{{ matrix_bot_draupnir_base_path }}/config"
matrix_bot_draupnir_data_path: "{{ matrix_bot_draupnir_base_path }}/data"
matrix_bot_draupnir_container_src_files_path: "{{ matrix_bot_draupnir_base_path }}/docker-src"

# Rolling tag: true if version doesn't match semver shape (vX.Y.Z with optional prerelease/build), false otherwise.
matrix_bot_draupnir_rolling_tag: "{{ not (matrix_bot_draupnir_version is match('^v[0-9]+\\.[0-9]+\\.[0-9]+(?:-[0-9A-Za-z.-]+)?(?:\\+[0-9A-Za-z.-]+)?$')) }}"

# Force restart the service on all runs only when both roles are enabled, both roles
# are using the same version string, and that version is a classified as a moving tag.
matrix_bot_draupnir_force_restart: "{{
  matrix_bot_draupnir_enabled | bool and
  matrix_appservice_draupnir_for_all_enabled | bool and
  matrix_bot_draupnir_version == matrix_appservice_draupnir_for_all_version and
  matrix_bot_draupnir_rolling_tag | bool
}}"

matrix_bot_draupnir_config_web_enabled: "{{ matrix_bot_draupnir_config_web_abuseReporting or matrix_bot_draupnir_config_web_synapseHTTPAntispam_enabled }}"  # noqa var-naming

matrix_bot_draupnir_config_web_abuseReporting: false  # noqa var-naming

matrix_bot_draupnir_config_web_port: 8080

# These variables are used for turning on the integration between the synapseHTTPAntispam module and Draupnir.
# Authorisation is a shared secret between Draupnir and the module just like is used by Appservices and the homeserver
# therefore the same creation mechanism is used here too.
matrix_bot_draupnir_config_web_synapseHTTPAntispam_enabled: false  # noqa var-naming
matrix_bot_draupnir_config_web_synapseHTTPAntispam_authorization: ''  # noqa var-naming

matrix_bot_draupnir_config_displayReports: "{{ matrix_bot_draupnir_config_web_abuseReporting }}"  # noqa var-naming

matrix_bot_draupnir_container_network: ""

matrix_bot_draupnir_container_additional_networks: "{{ matrix_bot_draupnir_container_additional_networks_auto + matrix_bot_draupnir_container_additional_networks_custom }}"
matrix_bot_draupnir_container_additional_networks_auto: []
matrix_bot_draupnir_container_additional_networks_custom: []

# Controls whether the matrix-bot-draupnir container exposes its HTTP port (tcp/80 in the container).
#
# Takes an "<ip>:<port>" or "<port>" value (e.g. "127.0.0.1:8766"), or empty string to not expose.
matrix_bot_draupnir_container_http_host_bind_port: ''

# A list of extra arguments to pass to the container
matrix_bot_draupnir_container_extra_arguments: []

# Controls how long the pre-start cleanup should wait for stale container-name release
# before failing startup explicitly.
matrix_bot_draupnir_container_cleanup_timeout_seconds: "{{ devture_systemd_docker_base_container_cleanup_timeout_seconds }}"

# Controls the delay between pre-start cleanup retries.
matrix_bot_draupnir_container_cleanup_retry_delay_seconds: "{{ devture_systemd_docker_base_container_cleanup_retry_delay_seconds }}"

# Shell command used in the systemd pre-start phase to deterministically remove a stale
# container and wait until Docker releases its name.
matrix_bot_draupnir_container_cleanup_command: |
  i=0;
  while [ "$i" -lt {{ matrix_bot_draupnir_container_cleanup_timeout_seconds }} ]; do
  {{ devture_systemd_docker_base_host_command_docker }} stop -t {{ devture_systemd_docker_base_container_stop_grace_time_seconds }} matrix-bot-draupnir >/dev/null 2>&1 || true;
  {{ devture_systemd_docker_base_host_command_docker }} rm -f matrix-bot-draupnir >/dev/null 2>&1 || true;
  if {{ devture_systemd_docker_base_host_command_docker }} container inspect matrix-bot-draupnir >/dev/null 2>&1; then
  i=$((i + 1));
  sleep {{ matrix_bot_draupnir_container_cleanup_retry_delay_seconds }};
  continue;
  fi;
  if {{ devture_systemd_docker_base_host_command_docker }} info >/dev/null 2>&1; then
  exit 0;
  fi;
  echo "Failed to query Docker daemon while cleaning up matrix-bot-draupnir" >&2;
  exit 1;
  done;
  echo "Failed to remove stale container matrix-bot-draupnir after {{ matrix_bot_draupnir_container_cleanup_timeout_seconds }} attempts" >&2;
  exit 1

# List of systemd services that matrix-bot-draupnir.service depends on
matrix_bot_draupnir_systemd_required_services_list: "{{ matrix_bot_draupnir_systemd_required_services_list_default + matrix_bot_draupnir_systemd_required_services_list_auto + matrix_bot_draupnir_systemd_required_services_list_custom }}"
matrix_bot_draupnir_systemd_required_services_list_default: "{{ [devture_systemd_docker_base_docker_service_name] if devture_systemd_docker_base_docker_service_name else [] }}"
matrix_bot_draupnir_systemd_required_services_list_auto: []
matrix_bot_draupnir_systemd_required_services_list_custom: []

# List of systemd services that matrix-bot-draupnir.service wants
matrix_bot_draupnir_systemd_wanted_services_list: []

# Whether Draupnir should talk to the homeserver through Pantalaimon
# If true, then other variables must be provided including pointing
# `matrix_bot_draupnir_config_homeserverUrl` to the Pantalaimon URL.
#
# The upstream project discourages enabling this option, because it is
# known that running Draupnir along with Pantalaimon breaks all workflows that involve
# answering prompts with reactions. (Hint: a lot of workflows rely on them.)
matrix_bot_draupnir_pantalaimon_use: false

# If you choose to accept the risks of using Pantalaimon in your installation
# against the upstream advice, you can enable this to disable the warning about using it.
matrix_bot_draupnir_pantalaimon_breakage_ignore: false

# Tells the bot if it should use its native E2EE support in the form of experimental Rust Crypto in the bot SDK.
# This option is mutually exclusive with `matrix_bot_draupnir_pantalaimon_use`.
# Rust Crypto requires a clean access token that has not touched E2EE so curl is recommended as a method to obtain it.
matrix_bot_draupnir_config_experimentalRustCrypto: false  # noqa var-naming

# The access token for the bot user. Required if Pantalaimon is NOT used.
# (Otherwise provide `matrix_bot_draupnir_pantalaimon_username` and `matrix_bot_draupnir_pantalaimon_password` instead.)
matrix_bot_draupnir_config_accessToken: ""  # noqa var-naming

# Username and password for the bot. Required if Pantalaimon is used.
# (Otherwise provide `matrix_bot_draupnir_config_accessToken` instead.)
matrix_bot_draupnir_pantalaimon_username: ""
matrix_bot_draupnir_pantalaimon_password: ""

# Username and password the bot uses for logging in directly. If Pantalaimon is used,
# these values become the values of `matrix_bot_draupnir_pantalaimon_username` and `matrix_bot_draupnir_pantalaimon_password`
# These config options do not follow the common naming schema as to not cause user confusion over them being called Pantalaimon when using native login.
matrix_bot_draupnir_login: "{{ matrix_bot_draupnir_pantalaimon_username if matrix_bot_draupnir_pantalaimon_use == 'true' else 'bot.draupnir' }}"
matrix_bot_draupnir_password: "{{ matrix_bot_draupnir_pantalaimon_password }}"

# Controls if we activate the config block for Pantalaimon for now. Its name will
# probably be changed for our usecase due to Draupnir's push to scrub Pantalaimon from the codebase.
# This configuration option does not follow the common naming schema as its not controlling a config key directly.
matrix_bot_draupnir_login_native: false

# This controls whether Zero Touch Deployment is enabled.
# When enabled, the playbook validates the settings and only
# renders the configuration values Draupnir expects.
# This prevents invalid manual combinations from being passed through, since
# Draupnir requires `matrix_bot_draupnir_config_managementRoom` to be unset and
# `matrix_bot_draupnir_config_initialManager` to be a valid MXID.
# Zero Touch Deployment is recommended for all new deployments.
# Deployments that are exempt from this recommendation are assumed to be
# advanced setups with specific needs for non-zero-touch mode.
# Note that enabling this on an existing deployment will cause the bot to
# recreate the management room.
# Recreating the management room will cause all protections to reset their settings to defaults
# and cause the recreation of secondary rooms like notification rooms. All bot memory will also be wiped.
matrix_bot_draupnir_zero_touch_deploy: false

# The management room used for administration when Zero Touch
# Deployment is disabled.
# The bot has no access controls, so anyone in this room can use it - secure
# your room!
# This should be a room alias or room ID - not a matrix.to URL.
# Note: Draupnir is fairly verbose - expect a lot of messages from it.
matrix_bot_draupnir_config_managementRoom: ""  # noqa var-naming

# The MXID invited as the initial manager when Zero Touch Deployment creates the
# management room.
# This value is mutually exclusive with
# `matrix_bot_draupnir_config_managementRoom`, and the bot will crash if you
# attempt to set both at the same time.
matrix_bot_draupnir_config_initialManager: ""  # noqa var-naming

# Endpoint URL that Draupnir uses to interact with the Matrix homeserver (client-server API).
# Set this to the Pantalaimon URL if you're using that.
matrix_bot_draupnir_config_homeserverUrl: ""  # noqa var-naming

# Endpoint URL that Draupnir could use to fetch events related to reports (client-server API and /_synapse/).
# Only set this to the public-internet homeserver client API URL. Do NOT set this to the Pantalaimon URL.
matrix_bot_draupnir_config_rawHomeserverUrl: ""  # noqa var-naming

# Disable Server ACL is used if you do not want to give the bot the right to apply Server ACLs in rooms without complaints from the bot.
# This setting is described the following way in the configuration.
#
# Whether or not Draupnir should apply `m.room.server_acl` events.
# DO NOT change this to `true` unless you are very confident that you know what you are doing.
# It is recommended to consult with people from the upstream project beforehand.
#
# It is exposed here because it is common enough to be valid to expose.
matrix_bot_draupnir_config_disableServerACL: false  # noqa var-naming

# Control if Draupnir wants for the Synapse Admin API to be exposed internally to containers, therefore giving Draupnir Access.
matrix_bot_draupnir_admin_api_enabled: "{{ matrix_bot_draupnir_config_admin_enableMakeRoomAdminCommand }}"

# Controls if the Draupnir room hijack command is activated or not.
# Also see `matrix_bot_draupnir_admin_api_enabled`.
matrix_bot_draupnir_config_admin_enableMakeRoomAdminCommand: false  # noqa var-naming

# Controls if the room state backing store is activated.
# Room state backing store makes restarts of the bot lightning fast as the bot does not suffer from amnesia.
# This config option has diminished improvements for bots on extremely fast homeservers or very very small bots on fast homeservers.
matrix_bot_draupnir_config_roomStateBackingStore_enabled: true  # noqa var-naming

matrix_bot_draupnir_web_url: 'http://matrix-bot-draupnir'

# This controls the URL that the module targets in Draupnir.
matrix_bot_draupnir_synapse_http_antispam_config_base_url: "{{ matrix_bot_draupnir_web_url }}:{{ matrix_bot_draupnir_config_web_port }}/api/1/spam_check"

# These variables control the configuration of the Synapse module as the configuration is highly consumer dependent.
# Therefore the module is configured from Draupnir because the consumer of the module determines what settings are relevant.

matrix_bot_draupnir_synapse_http_antispam_config_enabled_callbacks:
  - user_may_invite
  - user_may_join_room

matrix_bot_draupnir_synapse_http_antispam_config_fail_open:
  user_may_invite: true
  user_may_join_room: true

matrix_bot_draupnir_synapse_http_antispam_config_async: {}

# Default configuration template which covers the generic use case.
# You can customize it by controlling the various variables inside it.
#
# For a more advanced customization, you can extend the default (see `matrix_bot_draupnir_configuration_extension_yaml`)
# or completely replace this variable with your own template.
matrix_bot_draupnir_configuration_yaml: "{{ lookup('template', 'templates/production.yaml.j2') }}"

matrix_bot_draupnir_configuration_extension_yaml: |
  # Your custom YAML configuration goes here.
  # This configuration extends the default starting configuration (`matrix_bot_draupnir_configuration_yaml`).
  #
  # You can override individual variables from the default configuration, or introduce new ones.
  #
  # If you need something more special, you can take full control by
  # completely redefining `matrix_bot_draupnir_configuration_yaml`.

matrix_bot_draupnir_configuration_extension: "{{ matrix_bot_draupnir_configuration_extension_yaml | from_yaml if matrix_bot_draupnir_configuration_extension_yaml | from_yaml is mapping else {} }}"

# Holds the final configuration (a combination of the default and its extension).
# You most likely don't need to touch this variable. Instead, see `matrix_bot_draupnir_configuration_yaml`.
matrix_bot_draupnir_configuration: "{{ matrix_bot_draupnir_configuration_yaml | from_yaml | combine(matrix_bot_draupnir_configuration_extension, recursive=True) }}"

# Controls whether labels will be added that redirect the /_matrix/client/../rooms/../report paths to Draupnir
# Following these recommendations (https://github.com/element-hq/synapse/blob/master/docs/reverse_proxy.md), by default, we don't.
# Regardless of whether this is enabled, it may or may not take effect due to the value of other variables.
# See `matrix_synapse_container_labels_traefik_enabled` or `matrix_synapse_container_labels_matrix_related_labels_enabled`
matrix_bot_draupnir_container_labels_traefik_enabled: false
matrix_bot_draupnir_container_labels_traefik_docker_network: "{{ matrix_bot_draupnir_container_network }}"
matrix_bot_draupnir_container_labels_web_abuseReporting_traefik_hostname: "{{ matrix_synapse_container_labels_traefik_hostname }}"  # noqa var-naming
matrix_bot_draupnir_container_labels_web_abuseReporting_traefik_path_regexp: "^/_matrix/client/(r0|v3)/rooms/([^/]*)/report/(.*)$"  # noqa var-naming
matrix_bot_draupnir_container_labels_web_abuseReporting_traefik_rule: "Host(`{{ matrix_bot_draupnir_container_labels_web_abuseReporting_traefik_hostname }}`) && PathRegexp(`{{ matrix_bot_draupnir_container_labels_web_abuseReporting_traefik_path_regexp }}`)"  # noqa var-naming
matrix_bot_draupnir_container_labels_web_abuseReporting_traefik_priority: 0  # noqa var-naming
matrix_bot_draupnir_container_labels_web_abuseReporting_traefik_entrypoints: "{{ matrix_synapse_container_labels_traefik_entrypoints }}"  # noqa var-naming
matrix_bot_draupnir_container_labels_web_abuseReporting_traefik_tls: "{{ matrix_bot_draupnir_container_labels_web_abuseReporting_traefik_entrypoints != 'web' }}"  # noqa var-naming
matrix_bot_draupnir_container_labels_web_abuseReporting_traefik_tls_certResolver: "{{ matrix_synapse_container_labels_traefik_tls_certResolver }}"  # noqa var-naming
# matrix_bot_draupnir_container_labels_traefik_labels_additional_labels contains a multiline string with additional labels to add to the container label file.
# See `../templates/labels.j2` for details.
#
# Example:
# matrix_bot_draupnir_container_labels_traefik_labels_additional_labels: |
#   my.label=1
#   another.label="here"
matrix_bot_draupnir_container_labels_traefik_labels_additional_labels: ''

# matrix_bot_draupnir_restart_necessary controls whether the service
# will be restarted (when true) or merely started (when false) by the
# systemd service manager role (when conditional restart is enabled).
#
# This value is automatically computed during installation based on whether
# any configuration files, the systemd service file, or the container image changed.
# The default of `false` means "no restart needed" — appropriate when the role's
# installation tasks haven't run (e.g., due to --tags skipping them).
matrix_bot_draupnir_restart_necessary: false