spantaleev/matrix-docker-ansible-deploy
1
0
Fork 0
mirror of https://github.com/spantaleev/matrix-docker-ansible-deploy.git synced 2026-07-22 02:43:27 +10:00
Code Issues Packages Projects Releases Wiki Activity

matrix-tuwunel: add labels to expose the Synapse-compatible admin API

Browse Source 
Tuwunel serves the Synapse administration API under /_synapse/admin,
but the role only routed /_matrix, so admin dashboards and moderation
bots could not reach it. Add public and internal Traefik label groups
mirroring the matrix-synapse role, and enable them automatically when
Ketesa, Element Admin, or Draupnir is installed.
This commit is contained in:
Jason Volk
2026-07-19 01:50:59 +00:00
committed by Slavi Pantaleev
parent 01949d8ad2
commit 1febc275f2
5 changed files with 93 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
roles/custom/matrix-tuwunel/defaults/main.yml
+19
View File
@@ -106,6 +106,25 @@ matrix_tuwunel_container_labels_public_federation_api_traefik_entrypoints: ''
matrix_tuwunel_container_labels_public_federation_api_traefik_tls: true
matrix_tuwunel_container_labels_public_federation_api_traefik_tls_certResolver: "{{ matrix_tuwunel_container_labels_traefik_tls_certResolver }}" # noqa var-naming
# Controls whether labels will be added that expose the Synapse-compatible Administration API (`/_synapse/admin`) on a public Traefik entrypoint.
# Tuwunel serves this API so that administration dashboards (synapse-admin, ketesa) and moderation bots (Draupnir, Meowlnir) work against it.
# Every endpoint requires an administrator access token. It is disabled by default; you may prefer to expose it only on the internal entrypoint below.
matrix_tuwunel_container_labels_public_client_synapse_admin_api_enabled: false
matrix_tuwunel_container_labels_public_client_synapse_admin_api_traefik_hostname: "{{ matrix_tuwunel_hostname }}"
matrix_tuwunel_container_labels_public_client_synapse_admin_api_traefik_path_prefix: /_synapse/admin
matrix_tuwunel_container_labels_public_client_synapse_admin_api_traefik_rule: "Host(`{{ matrix_tuwunel_container_labels_public_client_synapse_admin_api_traefik_hostname }}`) && PathPrefix(`{{ matrix_tuwunel_container_labels_public_client_synapse_admin_api_traefik_path_prefix }}`)"
matrix_tuwunel_container_labels_public_client_synapse_admin_api_traefik_priority: 0
matrix_tuwunel_container_labels_public_client_synapse_admin_api_traefik_entrypoints: "{{ matrix_tuwunel_container_labels_traefik_entrypoints }}"
matrix_tuwunel_container_labels_public_client_synapse_admin_api_traefik_tls: "{{ matrix_tuwunel_container_labels_public_client_synapse_admin_api_traefik_entrypoints != 'web' }}"
matrix_tuwunel_container_labels_public_client_synapse_admin_api_traefik_tls_certResolver: "{{ matrix_tuwunel_container_labels_traefik_tls_certResolver }}" # noqa var-naming
# Controls whether labels will be added that expose the Synapse-compatible Administration API (`/_synapse/admin`) on the internal Traefik entrypoint.
matrix_tuwunel_container_labels_internal_client_synapse_admin_api_enabled: false
matrix_tuwunel_container_labels_internal_client_synapse_admin_api_traefik_path_prefix: /_synapse/admin
matrix_tuwunel_container_labels_internal_client_synapse_admin_api_traefik_rule: "PathPrefix(`{{ matrix_tuwunel_container_labels_internal_client_synapse_admin_api_traefik_path_prefix }}`)"
matrix_tuwunel_container_labels_internal_client_synapse_admin_api_traefik_priority: 0
matrix_tuwunel_container_labels_internal_client_synapse_admin_api_traefik_entrypoints: ""
# Additional Docker container labels (multiline string) appended verbatim to the label file.
# See `../templates/labels.j2`.
matrix_tuwunel_container_labels_additional_labels: ''
roles/custom/matrix-tuwunel/templates/labels.j2
+53
View File
@@ -136,6 +136,59 @@ traefik.http.routers.matrix-tuwunel-public-federation-api.tls.certResolver={{ ma
{% endif %}
{% if matrix_tuwunel_container_labels_public_client_synapse_admin_api_enabled %}
############################################################
# #
# Public Synapse Admin API (/_synapse/admin) #
# #
############################################################
traefik.http.routers.matrix-tuwunel-public-client-synapse-admin-api.rule={{ matrix_tuwunel_container_labels_public_client_synapse_admin_api_traefik_rule }}
{% if matrix_tuwunel_container_labels_public_client_synapse_admin_api_traefik_priority | int > 0 %}
traefik.http.routers.matrix-tuwunel-public-client-synapse-admin-api.priority={{ matrix_tuwunel_container_labels_public_client_synapse_admin_api_traefik_priority }}
{% endif %}
traefik.http.routers.matrix-tuwunel-public-client-synapse-admin-api.service=matrix-tuwunel
traefik.http.routers.matrix-tuwunel-public-client-synapse-admin-api.entrypoints={{ matrix_tuwunel_container_labels_public_client_synapse_admin_api_traefik_entrypoints }}
traefik.http.routers.matrix-tuwunel-public-client-synapse-admin-api.tls={{ matrix_tuwunel_container_labels_public_client_synapse_admin_api_traefik_tls | to_json }}
{% if matrix_tuwunel_container_labels_public_client_synapse_admin_api_traefik_tls %}
traefik.http.routers.matrix-tuwunel-public-client-synapse-admin-api.tls.certResolver={{ matrix_tuwunel_container_labels_public_client_synapse_admin_api_traefik_tls_certResolver }}
{% endif %}
############################################################
# #
# /Public Synapse Admin API (/_synapse/admin) #
# #
############################################################
{% endif %}
{% if matrix_tuwunel_container_labels_internal_client_synapse_admin_api_enabled %}
############################################################
# #
# Internal Synapse Admin API (/_synapse/admin) #
# #
############################################################
traefik.http.routers.matrix-tuwunel-internal-client-synapse-admin-api.rule={{ matrix_tuwunel_container_labels_internal_client_synapse_admin_api_traefik_rule }}
{% if matrix_tuwunel_container_labels_internal_client_synapse_admin_api_traefik_priority | int > 0 %}
traefik.http.routers.matrix-tuwunel-internal-client-synapse-admin-api.priority={{ matrix_tuwunel_container_labels_internal_client_synapse_admin_api_traefik_priority }}
{% endif %}
traefik.http.routers.matrix-tuwunel-internal-client-synapse-admin-api.service=matrix-tuwunel
traefik.http.routers.matrix-tuwunel-internal-client-synapse-admin-api.entrypoints={{ matrix_tuwunel_container_labels_internal_client_synapse_admin_api_traefik_entrypoints }}
############################################################
# #
# /Internal Synapse Admin API (/_synapse/admin) #
# #
############################################################
{% endif %}
{% endif %}
{{ matrix_tuwunel_container_labels_additional_labels }}