mirror of
https://github.com/spantaleev/matrix-docker-ansible-deploy.git
synced 2026-10-21 05:44:16 +00:00
Slavi PantaleevandClaude Opus 5.5
bff3f54d53
Containers are created with `--rm`, so Docker removes them asynchronously after they stop. The pre-start `docker rm` returns immediately while that removal is still in progress (its error is suppressed), and the following `docker create --name` can fail with "The container name ... is already in use". This is easy to hit since systemd_service_manager switched its default restart mode to `all-at-once`: many containers stop and start at the same time and Docker falls behind on removals. The playbook then fails at "Restart systemd services needing restart at once", even though the services recover on their own (`Restart=always`) a little later. The external roles (MASH, devture) were hardened against this in 2026-03 (see mother-of-all-self-hosting/ansible-role-valkey@0ba79c0), but the roles in `roles/custom` never were. This ports the same bounded cleanup loop to them: stop, force-remove, and wait until Docker releases the name, failing explicitly after a timeout. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
125 lines
7.4 KiB
YAML
125 lines
7.4 KiB
YAML
# SPDX-FileCopyrightText: 2023 - 2025 Slavi Pantaleev
|
|
# SPDX-FileCopyrightText: 2023 MDAD project contributors
|
|
# SPDX-FileCopyrightText: 2023 Samuel Meenzen
|
|
# SPDX-FileCopyrightText: 2024 Suguru Hirahara
|
|
#
|
|
# SPDX-License-Identifier: AGPL-3.0-or-later
|
|
|
|
---
|
|
|
|
# matrix-user-verification-service - Service to verify details of a user based on an Open ID token
|
|
# Project source code URL: https://github.com/matrix-org/matrix-user-verification-service
|
|
|
|
# Set this to the display name for ansible used in Output e.g. fail_msg
|
|
matrix_user_verification_service_ansible_name: "Matrix User Verification Service"
|
|
|
|
# Enable by default. This is overwritten in provided group vars.
|
|
matrix_user_verification_service_enabled: true
|
|
|
|
matrix_user_verification_service_container_image_self_build: "{{ matrix_architecture != 'amd64' }}"
|
|
matrix_user_verification_service_container_image_self_build_repo: "https://github.com/matrix-org/matrix-user-verification-service"
|
|
matrix_user_verification_service_container_image_self_build_branch: "{{ matrix_user_verification_service_version }}"
|
|
|
|
# renovate: datasource=docker depName=matrixdotorg/matrix-user-verification-service
|
|
matrix_user_verification_service_version: "v3.0.0"
|
|
|
|
# Paths
|
|
matrix_user_verification_service_base_path: "{{ matrix_base_data_path }}/user-verification-service"
|
|
matrix_user_verification_service_config_path: "{{ matrix_user_verification_service_base_path }}/config"
|
|
matrix_user_verification_service_config_env_file: "{{ matrix_user_verification_service_config_path }}/.env"
|
|
matrix_user_verification_service_container_src_files_path: "{{ matrix_user_verification_service_base_path }}/docker-src"
|
|
|
|
# Docker
|
|
matrix_user_verification_service_container_image: "{{ matrix_user_verification_service_container_image_registry_prefix }}matrixdotorg/matrix-user-verification-service:{{ matrix_user_verification_service_version }}"
|
|
matrix_user_verification_service_container_image_registry_prefix: "{{ 'localhost/' if matrix_user_verification_service_container_image_self_build else matrix_user_verification_service_container_image_registry_prefix_upstream }}"
|
|
matrix_user_verification_service_container_image_registry_prefix_upstream: "{{ matrix_user_verification_service_container_image_registry_prefix_upstream_default }}"
|
|
matrix_user_verification_service_container_image_registry_prefix_upstream_default: "docker.io/"
|
|
|
|
# The base container network. It will be auto-created by this role if it doesn't exist already.
|
|
matrix_user_verification_service_container_network: ""
|
|
|
|
# A list of additional container networks that the container would be connected to.
|
|
# The role does not create these networks, so make sure they already exist.
|
|
# Use this to expose this container to another reverse proxy, which runs in a different container network.
|
|
matrix_user_verification_service_container_additional_networks: []
|
|
|
|
matrix_user_verification_service_container_name: "matrix-user-verification-service"
|
|
# This will be set in group vars
|
|
matrix_user_verification_service_container_http_host_bind_port: ''
|
|
matrix_user_verification_service_container_extra_arguments: []
|
|
# Systemd
|
|
matrix_user_verification_service_systemd_required_services_list: []
|
|
matrix_user_verification_service_systemd_wanted_services_list: []
|
|
matrix_user_verification_service_systemd_service_basename: "matrix-user-verification-service"
|
|
matrix_user_verification_service_systemd_service_name: "{{ matrix_user_verification_service_systemd_service_basename }}.service"
|
|
|
|
# Controls how long the pre-start cleanup should wait for stale container-name release
|
|
# before failing startup explicitly.
|
|
matrix_user_verification_service_container_cleanup_timeout_seconds: "{{ devture_systemd_docker_base_container_cleanup_timeout_seconds }}"
|
|
|
|
# Controls the delay between pre-start cleanup retries.
|
|
matrix_user_verification_service_container_cleanup_retry_delay_seconds: "{{ devture_systemd_docker_base_container_cleanup_retry_delay_seconds }}"
|
|
|
|
# Shell command used in the systemd pre-start phase to deterministically remove a stale
|
|
# container and wait until Docker releases its name.
|
|
matrix_user_verification_service_container_cleanup_command: |
|
|
i=0;
|
|
while [ "$i" -lt {{ matrix_user_verification_service_container_cleanup_timeout_seconds }} ]; do
|
|
{{ devture_systemd_docker_base_host_command_docker }} stop -t {{ devture_systemd_docker_base_container_stop_grace_time_seconds }} {{ matrix_user_verification_service_container_name }} >/dev/null 2>&1 || true;
|
|
{{ devture_systemd_docker_base_host_command_docker }} rm -f {{ matrix_user_verification_service_container_name }} >/dev/null 2>&1 || true;
|
|
if {{ devture_systemd_docker_base_host_command_docker }} container inspect {{ matrix_user_verification_service_container_name }} >/dev/null 2>&1; then
|
|
i=$((i + 1));
|
|
sleep {{ matrix_user_verification_service_container_cleanup_retry_delay_seconds }};
|
|
continue;
|
|
fi;
|
|
if {{ devture_systemd_docker_base_host_command_docker }} info >/dev/null 2>&1; then
|
|
exit 0;
|
|
fi;
|
|
echo "Failed to query Docker daemon while cleaning up {{ matrix_user_verification_service_container_name }}" >&2;
|
|
exit 1;
|
|
done;
|
|
echo "Failed to remove stale container {{ matrix_user_verification_service_container_name }} after {{ matrix_user_verification_service_container_cleanup_timeout_seconds }} attempts" >&2;
|
|
exit 1
|
|
|
|
# Matrix User Verification Service Configuration
|
|
## REQUIRED
|
|
|
|
# Homeserver client API admin token (synapse only)- Required for the service to verify room membership
|
|
matrix_user_verification_service_uvs_access_token: ''
|
|
|
|
# homeserver client api url
|
|
matrix_user_verification_service_uvs_homeserver_url: ""
|
|
# disable check for non private ip range of homeserver. e.g. set to `true` if your homeserver domain resolves to a private ip.
|
|
matrix_user_verification_service_uvs_disable_ip_blacklist: false
|
|
|
|
## OPTIONAL
|
|
|
|
# Require an Auth-Token with API calls. If set to false, UVS will reply to any API call.
|
|
# The Auth-Token is defined via: matrix_user_verification_service_uvs_auth_token
|
|
matrix_user_verification_service_uvs_require_auth: true
|
|
# Auth token to protect the API
|
|
# If enabled any calls to the provided API endpoints need have the header "Authorization: Bearer TOKEN".
|
|
# A Token will be derived from matrix_homeserver_generic_secret_key in group_vars/matrix_servers
|
|
matrix_user_verification_service_uvs_auth_token: ''
|
|
|
|
# Pin UVS to only check openId Tokens for the matrix_server_name configured by this playbook.
|
|
matrix_user_verification_service_uvs_pin_openid_verify_server_name: true
|
|
# Matrix server name to verify OpenID tokens against.
|
|
# This is not the homeserverURL, but rather the domain in the Matrix "user ID"
|
|
# UVS can also be instructed to verify against the Matrix server name passed in the token, to enable set to ""
|
|
matrix_user_verification_service_uvs_openid_verify_server_name: "{{ matrix_domain }}"
|
|
|
|
# Log level
|
|
# See choices here: https://github.com/winstonjs/winston#logging-levels
|
|
matrix_user_verification_service_uvs_log_level: info
|
|
|
|
# matrix_user_verification_service_restart_necessary controls whether the service
|
|
# will be restarted (when true) or merely started (when false) by the
|
|
# systemd service manager role (when conditional restart is enabled).
|
|
#
|
|
# This value is automatically computed during installation based on whether
|
|
# any configuration files, the systemd service file, or the container image changed.
|
|
# The default of `false` means "no restart needed" — appropriate when the role's
|
|
# installation tasks haven't run (e.g., due to --tags skipping them).
|
|
matrix_user_verification_service_restart_necessary: false
|