mirror of
https://github.com/spantaleev/matrix-docker-ansible-deploy.git
synced 2026-10-24 15:24:14 +00:00
QEDeDandSlavi Pantaleev
7b44e13276
With conditional restart (install-* tags), the homeserver entry for Synapse fell through to `restart_necessary: true`, and the worker entries carried no flag at all, which systemd_service_manager also treats as "restart". Every install-all and install-service synapse therefore restarted Synapse and all of its workers, even when nothing had changed. Without workers, systemd also restarted most bridges and bots, whose units require matrix-synapse.service. Compute matrix_synapse_restart_necessary from the tasks that install what Synapse runs: homeserver.yaml, the initial config and signing key, the log config, labels and systemd service, the container image (pulled, self-built or customized), each worker's config, labels and systemd service, and the downloaded or cloned extension modules. Workers follow the same decision, as they read the same files. Synapse also mounts the appservice registration files written by other roles. Add matrix_homeserver_app_service_registration_changed in group_vars/matrix_servers, which checks the registered result of each task installing one of the files listed in matrix_homeserver_container_extra_arguments_auto, so that a changed registration still restarts Synapse and its workers. The double-puppet role did not register its result; it does now. The Synapse image pull and three extension downloads all registered their result as `result`. The downloads run first, so the pull's result overwrote theirs before the restart decision could read them; they now use role-prefixed names.
59 lines
2.4 KiB
YAML
59 lines
2.4 KiB
YAML
# SPDX-FileCopyrightText: 2019 - 2023 Slavi Pantaleev
|
|
# SPDX-FileCopyrightText: 2019 Michael Haak
|
|
# SPDX-FileCopyrightText: 2020 Chris van Dijk
|
|
# SPDX-FileCopyrightText: 2022 Nikita Chernyi
|
|
#
|
|
# SPDX-License-Identifier: AGPL-3.0-or-later
|
|
|
|
---
|
|
|
|
- name: Fail if Shared Secret Auth secret not set
|
|
ansible.builtin.fail:
|
|
msg: "Shared Secret Auth is enabled, but no secret has been set in matrix_synapse_ext_password_provider_shared_secret_auth_shared_secret"
|
|
when: "matrix_synapse_ext_password_provider_shared_secret_auth_shared_secret == ''"
|
|
|
|
- name: Fail if no Shared Secret Auth login types enabled
|
|
ansible.builtin.fail:
|
|
msg: "Shared Secret Auth is enabled, but none of the login types are"
|
|
when: "not (matrix_synapse_ext_password_provider_shared_secret_auth_m_login_password_support_enabled or matrix_synapse_ext_password_provider_shared_secret_auth_com_devture_shared_secret_auth_support_enabled)"
|
|
|
|
- name: Download matrix-synapse-shared-secret-auth
|
|
ansible.builtin.get_url:
|
|
url: "{{ matrix_synapse_ext_password_provider_shared_secret_auth_download_url }}"
|
|
dest: "{{ matrix_synapse_ext_path }}/shared_secret_authenticator.py"
|
|
force: true
|
|
mode: '0440'
|
|
owner: "{{ matrix_synapse_uid }}"
|
|
group: "{{ matrix_synapse_gid }}"
|
|
register: matrix_synapse_ext_password_provider_shared_secret_auth_download_result
|
|
retries: "{{ devture_playbook_help_geturl_retries_count }}"
|
|
delay: "{{ devture_playbook_help_geturl_retries_delay }}"
|
|
until: matrix_synapse_ext_password_provider_shared_secret_auth_download_result is not failed
|
|
|
|
- ansible.builtin.set_fact:
|
|
matrix_synapse_modules: |
|
|
{{
|
|
matrix_synapse_modules | default([])
|
|
+
|
|
[
|
|
{
|
|
"module": "shared_secret_authenticator.SharedSecretAuthProvider",
|
|
"config": matrix_synapse_ext_password_provider_shared_secret_config
|
|
}
|
|
]
|
|
}}
|
|
|
|
matrix_synapse_container_extra_arguments: >
|
|
{{
|
|
matrix_synapse_container_extra_arguments | default([])
|
|
+
|
|
["--mount type=bind,src=" + matrix_synapse_ext_path + "/shared_secret_authenticator.py,dst=" + matrix_synapse_in_container_python_packages_path + "/shared_secret_authenticator.py,ro"]
|
|
}}
|
|
|
|
matrix_synapse_additional_loggers_auto: >
|
|
{{
|
|
matrix_synapse_additional_loggers_auto
|
|
+
|
|
[{'name': 'shared_secret_authenticator', 'level': 'INFO'}]
|
|
}}
|