mirror of
https://github.com/spantaleev/matrix-docker-ansible-deploy.git
synced 2026-10-20 21:34:15 +00:00
Slavi PantaleevandClaude Opus 5.5
bff3f54d53
Containers are created with `--rm`, so Docker removes them asynchronously after they stop. The pre-start `docker rm` returns immediately while that removal is still in progress (its error is suppressed), and the following `docker create --name` can fail with "The container name ... is already in use". This is easy to hit since systemd_service_manager switched its default restart mode to `all-at-once`: many containers stop and start at the same time and Docker falls behind on removals. The playbook then fails at "Restart systemd services needing restart at once", even though the services recover on their own (`Restart=always`) a little later. The external roles (MASH, devture) were hardened against this in 2026-03 (see mother-of-all-self-hosting/ansible-role-valkey@0ba79c0), but the roles in `roles/custom` never were. This ports the same bounded cleanup loop to them: stop, force-remove, and wait until Docker releases the name, failing explicitly after a timeout. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
187 lines
12 KiB
YAML
187 lines
12 KiB
YAML
# SPDX-FileCopyrightText: 2022 MDAD project contributors
|
|
# SPDX-FileCopyrightText: 2024 wjbeckett
|
|
# SPDX-FileCopyrightText: 2024 - 2026 Slavi Pantaleev
|
|
#
|
|
# SPDX-License-Identifier: AGPL-3.0-or-later
|
|
|
|
---
|
|
|
|
# Project source code URL: https://github.com/element-hq/lk-jwt-service
|
|
|
|
matrix_livekit_jwt_service_enabled: false
|
|
|
|
matrix_livekit_jwt_service_scheme: https
|
|
matrix_livekit_jwt_service_hostname: ""
|
|
matrix_livekit_jwt_service_path_prefix: "/livekit-jwt-service"
|
|
|
|
matrix_livekit_jwt_service_base_path: "{{ matrix_base_data_path }}/livekit-jwt-service"
|
|
|
|
matrix_livekit_jwt_service_container_network: ''
|
|
|
|
matrix_livekit_jwt_service_container_http_host_bind_port: ''
|
|
|
|
matrix_livekit_jwt_service_container_additional_networks: "{{ (matrix_livekit_jwt_service_container_additional_networks_auto + matrix_livekit_jwt_service_container_additional_networks_custom) | unique }}"
|
|
matrix_livekit_jwt_service_container_additional_networks_auto: []
|
|
matrix_livekit_jwt_service_container_additional_networks_custom: []
|
|
|
|
# renovate: datasource=docker depName=ghcr.io/element-hq/lk-jwt-service
|
|
matrix_livekit_jwt_service_version: 0.9.0
|
|
|
|
matrix_livekit_jwt_service_container_image_self_build: false
|
|
matrix_livekit_jwt_service_container_repo: "https://github.com/element-hq/lk-jwt-service.git"
|
|
matrix_livekit_jwt_service_container_repo_version: "{{ 'main' if matrix_livekit_jwt_service_version == 'latest' else ('v' + matrix_livekit_jwt_service_version) }}"
|
|
matrix_livekit_jwt_service_container_src_files_path: "{{ matrix_livekit_jwt_service_base_path }}/container-src"
|
|
|
|
matrix_livekit_jwt_service_container_image: "{{ matrix_livekit_jwt_service_container_image_registry_prefix }}element-hq/lk-jwt-service:{{ matrix_livekit_jwt_service_container_image_tag }}"
|
|
matrix_livekit_jwt_service_container_image_registry_prefix: "{{ 'localhost/' if matrix_livekit_jwt_service_container_image_self_build else matrix_livekit_jwt_service_container_image_registry_prefix_upstream }}"
|
|
matrix_livekit_jwt_service_container_image_registry_prefix_upstream: "{{ matrix_livekit_jwt_service_container_image_registry_prefix_upstream_default }}"
|
|
matrix_livekit_jwt_service_container_image_registry_prefix_upstream_default: ghcr.io/
|
|
matrix_livekit_jwt_service_container_image_tag: "{{ matrix_livekit_jwt_service_version }}"
|
|
|
|
matrix_livekit_jwt_service_container_labels_traefik_enabled: true
|
|
matrix_livekit_jwt_service_container_labels_traefik_docker_network: "{{ matrix_livekit_jwt_service_container_network }}"
|
|
matrix_livekit_jwt_service_container_labels_traefik_hostname: "{{ matrix_livekit_jwt_service_hostname }}"
|
|
# The path prefix must either be `/` or not end with a slash (e.g. `/livekit-jwt-service`).
|
|
matrix_livekit_jwt_service_container_labels_traefik_path_prefix: "{{ matrix_livekit_jwt_service_path_prefix }}"
|
|
matrix_livekit_jwt_service_container_labels_traefik_rule: "Host(`{{ matrix_livekit_jwt_service_container_labels_traefik_hostname }}`){% if matrix_livekit_jwt_service_container_labels_traefik_path_prefix != '/' %} && PathPrefix(`{{ matrix_livekit_jwt_service_container_labels_traefik_path_prefix }}`){% endif %}"
|
|
matrix_livekit_jwt_service_container_labels_traefik_priority: 0
|
|
matrix_livekit_jwt_service_container_labels_traefik_entrypoints: web-secure
|
|
matrix_livekit_jwt_service_container_labels_traefik_tls: "{{ matrix_livekit_jwt_service_container_labels_traefik_entrypoints != 'web' }}"
|
|
matrix_livekit_jwt_service_container_labels_traefik_tls_certResolver: default # noqa var-naming
|
|
|
|
# Controls which additional headers to attach to all HTTP responses.
|
|
# To add your own headers, use `matrix_livekit_jwt_service_container_labels_traefik_additional_response_headers_custom`
|
|
matrix_livekit_jwt_service_container_labels_traefik_additional_response_headers: "{{ matrix_livekit_jwt_service_container_labels_traefik_additional_response_headers_auto | combine(matrix_livekit_jwt_service_container_labels_traefik_additional_response_headers_custom) }}"
|
|
matrix_livekit_jwt_service_container_labels_traefik_additional_response_headers_auto: {}
|
|
matrix_livekit_jwt_service_container_labels_traefik_additional_response_headers_custom: {}
|
|
|
|
# matrix_livekit_jwt_service_container_labels_additional_labels contains a multiline string with additional labels to add to the container label file.
|
|
# See `../templates/labels.j2` for details.
|
|
#
|
|
# Example:
|
|
# matrix_livekit_jwt_service_container_labels_additional_labels: |
|
|
# my.label=1
|
|
# another.label="here"
|
|
matrix_livekit_jwt_service_container_labels_additional_labels: ''
|
|
|
|
# A list of extra arguments to pass to the container
|
|
matrix_livekit_jwt_service_container_extra_arguments: []
|
|
|
|
# Controls how long the pre-start cleanup should wait for stale container-name release
|
|
# before failing startup explicitly.
|
|
matrix_livekit_jwt_service_container_cleanup_timeout_seconds: "{{ devture_systemd_docker_base_container_cleanup_timeout_seconds }}"
|
|
|
|
# Controls the delay between pre-start cleanup retries.
|
|
matrix_livekit_jwt_service_container_cleanup_retry_delay_seconds: "{{ devture_systemd_docker_base_container_cleanup_retry_delay_seconds }}"
|
|
|
|
# Shell command used in the systemd pre-start phase to deterministically remove a stale
|
|
# container and wait until Docker releases its name.
|
|
matrix_livekit_jwt_service_container_cleanup_command: |
|
|
i=0;
|
|
while [ "$i" -lt {{ matrix_livekit_jwt_service_container_cleanup_timeout_seconds }} ]; do
|
|
{{ devture_systemd_docker_base_host_command_docker }} stop -t {{ devture_systemd_docker_base_container_stop_grace_time_seconds }} matrix-livekit-jwt-service >/dev/null 2>&1 || true;
|
|
{{ devture_systemd_docker_base_host_command_docker }} rm -f matrix-livekit-jwt-service >/dev/null 2>&1 || true;
|
|
if {{ devture_systemd_docker_base_host_command_docker }} container inspect matrix-livekit-jwt-service >/dev/null 2>&1; then
|
|
i=$((i + 1));
|
|
sleep {{ matrix_livekit_jwt_service_container_cleanup_retry_delay_seconds }};
|
|
continue;
|
|
fi;
|
|
if {{ devture_systemd_docker_base_host_command_docker }} info >/dev/null 2>&1; then
|
|
exit 0;
|
|
fi;
|
|
echo "Failed to query Docker daemon while cleaning up matrix-livekit-jwt-service" >&2;
|
|
exit 1;
|
|
done;
|
|
echo "Failed to remove stale container matrix-livekit-jwt-service after {{ matrix_livekit_jwt_service_container_cleanup_timeout_seconds }} attempts" >&2;
|
|
exit 1
|
|
|
|
# Controls whether the container's built-in healthcheck is left enabled.
|
|
#
|
|
# The bind-address handling was fixed in v0.7.0. If you pin v0.6.0, disable
|
|
# its broken healthcheck so Traefik does not exclude the container.
|
|
# See: https://github.com/element-hq/lk-jwt-service/pull/215
|
|
matrix_livekit_jwt_service_container_healthcheck_enabled: true
|
|
|
|
# Controls the port that the service listens on internally in the container.
|
|
# This is still used for Traefik configuration and container port binding.
|
|
matrix_livekit_jwt_service_container_port: 8080
|
|
|
|
# Controls the LIVEKIT_JWT_BIND environment variable.
|
|
# This is the preferred method in v0.4.0+, replacing the deprecated LIVEKIT_JWT_PORT.
|
|
# Format: "host:port" or ":port" (to bind to all interfaces).
|
|
# The default ":8080" binds to all interfaces on port 8080.
|
|
matrix_livekit_jwt_service_environment_variable_livekit_jwt_bind: ":{{ matrix_livekit_jwt_service_container_port }}"
|
|
|
|
# Controls the LIVEKIT_KEY environment variable
|
|
matrix_livekit_jwt_service_environment_variable_livekit_key: ""
|
|
|
|
# Controls the LIVEKIT_URL environment variable
|
|
matrix_livekit_jwt_service_environment_variable_livekit_url: ""
|
|
|
|
# Controls the LIVEKIT_SECRET environment variable
|
|
matrix_livekit_jwt_service_environment_variable_livekit_secret: ""
|
|
|
|
# Controls the LIVEKIT_FULL_ACCESS_HOMESERVERS environment variable.
|
|
# Comma-separated list of Matrix homeservers whose users may publish media and
|
|
# trigger room creation on this SFU. Other homeservers' users can only subscribe
|
|
# to media here; they publish on their own SFU using a client with multi-SFU support.
|
|
#
|
|
# This is a required setting and the service refuses to start without it.
|
|
# Setting it to `*` grants full access to any federated Matrix user, but listing only the homeserver(s)
|
|
# you intend to serve is strongly recommended.
|
|
#
|
|
# To add additional homeservers, use `matrix_livekit_jwt_service_environment_variable_livekit_full_access_homeservers_list_custom`.
|
|
matrix_livekit_jwt_service_environment_variable_livekit_full_access_homeservers: "{{ matrix_livekit_jwt_service_environment_variable_livekit_full_access_homeservers_list | join(',') }}"
|
|
matrix_livekit_jwt_service_environment_variable_livekit_full_access_homeservers_list: "{{ matrix_livekit_jwt_service_environment_variable_livekit_full_access_homeservers_list_default + matrix_livekit_jwt_service_environment_variable_livekit_full_access_homeservers_list_auto + matrix_livekit_jwt_service_environment_variable_livekit_full_access_homeservers_list_custom }}"
|
|
matrix_livekit_jwt_service_environment_variable_livekit_full_access_homeservers_list_default: ["{{ matrix_domain }}"]
|
|
matrix_livekit_jwt_service_environment_variable_livekit_full_access_homeservers_list_auto: []
|
|
matrix_livekit_jwt_service_environment_variable_livekit_full_access_homeservers_list_custom: []
|
|
|
|
# Controls the LIVEKIT_CS_API_URL_OVERRIDES environment variable.
|
|
#
|
|
# To learn where a user's homeserver serves its Client-Server API, the service performs `.well-known` discovery.
|
|
# That is, it requests `https://<server-name>/.well-known/matrix/client` over the network and reads `m.homeserver.base_url` out of it.
|
|
# Entries listed here are consulted first, so that the server names they cover are resolved without discovery.
|
|
#
|
|
# Keys are Matrix server names and values are Client-Server API base URLs (including the scheme).
|
|
# A playbook may inject an entry for the homeserver it manages, pointing the service at it directly.
|
|
#
|
|
# To add your own entries, use `matrix_livekit_jwt_service_environment_variable_livekit_cs_api_url_overrides_map_custom`.
|
|
matrix_livekit_jwt_service_environment_variable_livekit_cs_api_url_overrides: "{{ matrix_livekit_jwt_service_environment_variable_livekit_cs_api_url_overrides_map.items() | map('join', '=') | join(',') }}"
|
|
matrix_livekit_jwt_service_environment_variable_livekit_cs_api_url_overrides_map: "{{ matrix_livekit_jwt_service_environment_variable_livekit_cs_api_url_overrides_map_auto | combine(matrix_livekit_jwt_service_environment_variable_livekit_cs_api_url_overrides_map_custom) }}"
|
|
matrix_livekit_jwt_service_environment_variable_livekit_cs_api_url_overrides_map_auto: {}
|
|
matrix_livekit_jwt_service_environment_variable_livekit_cs_api_url_overrides_map_custom: {}
|
|
|
|
# Additional environment variables to pass to the container.
|
|
#
|
|
# Environment variables take priority over settings in the configuration file.
|
|
#
|
|
# Example:
|
|
# matrix_livekit_jwt_service_environment_variables_extension: |
|
|
# KEY=value
|
|
matrix_livekit_jwt_service_environment_variables_extension: ''
|
|
|
|
# List of systemd services that LiveKit JWT Service service depends on
|
|
matrix_livekit_jwt_service_systemd_required_services_list: "{{ matrix_livekit_jwt_service_systemd_required_services_list_default + matrix_livekit_jwt_service_systemd_required_services_list_auto + matrix_livekit_jwt_service_systemd_required_services_list_custom }}"
|
|
matrix_livekit_jwt_service_systemd_required_services_list_default: "{{ [devture_systemd_docker_base_docker_service_name] if devture_systemd_docker_base_docker_service_name else [] }}"
|
|
matrix_livekit_jwt_service_systemd_required_services_list_auto: []
|
|
matrix_livekit_jwt_service_systemd_required_services_list_custom: []
|
|
|
|
# matrix_livekit_jwt_service_restart_necessary controls whether the service
|
|
# will be restarted (when true) or merely started (when false) by the
|
|
# systemd service manager role (when conditional restart is enabled).
|
|
#
|
|
# This value is automatically computed during installation based on whether
|
|
# any configuration files, the systemd service file, or the container image changed.
|
|
# The default of `false` means "no restart needed" — appropriate when the role's
|
|
# installation tasks haven't run (e.g., due to --tags skipping them).
|
|
matrix_livekit_jwt_service_restart_necessary: false
|
|
|
|
# A list of additional "volumes" to mount in the container.
|
|
# Contains definition objects like this: `{"type": "bind", "src": "/outside", "dst": "/inside", "options": "readonly"}.
|
|
# See the `--mount` documentation for the `docker run` command.
|
|
# Note: internally, this uses the `--mount` flag for mounting the specified volumes.
|
|
matrix_livekit_jwt_service_container_additional_volumes: "{{ matrix_livekit_jwt_service_container_additional_volumes_auto + matrix_livekit_jwt_service_container_additional_volumes_custom }}"
|
|
matrix_livekit_jwt_service_container_additional_volumes_auto: []
|
|
matrix_livekit_jwt_service_container_additional_volumes_custom: []
|