spantaleev/matrix-docker-ansible-deploy
1
0
Fork 0
mirror of https://github.com/spantaleev/matrix-docker-ansible-deploy.git synced 2026-07-22 10:51:23 +10:00
Code Issues Packages Projects Releases Wiki Activity

matrix-tuwunel: add labels to expose the /_tuwunel API path

Browse Source 
The /_tuwunel namespace carries Tuwunel's ad-hoc routes (server_version,
local_user_count) and its native OpenID Connect provider endpoints
(/_tuwunel/oidc/...), which a reverse proxy must route for OIDC login
to work. Add public (enabled by default, like the client API) and
internal Traefik label groups.
This commit is contained in:
Jason Volk
2026-07-19 01:57:56 +00:00
committed by Slavi Pantaleev
parent 1febc275f2
commit e1d40fd831
5 changed files with 96 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
roles/custom/matrix-tuwunel/defaults/main.yml
+20
View File
@@ -106,6 +106,26 @@ matrix_tuwunel_container_labels_public_federation_api_traefik_entrypoints: ''
matrix_tuwunel_container_labels_public_federation_api_traefik_tls: true
matrix_tuwunel_container_labels_public_federation_api_traefik_tls_certResolver: "{{ matrix_tuwunel_container_labels_traefik_tls_certResolver }}" # noqa var-naming
# Controls whether labels will be added that expose Tuwunel's first-party API (`/_tuwunel`) on a public Traefik entrypoint.
# This namespace carries ad-hoc routes such as `/_tuwunel/server_version` and `/_tuwunel/local_user_count`, as well as the
# native OpenID Connect provider endpoints (`/_tuwunel/oidc/...`) that clients use when Tuwunel performs OIDC login itself.
# It is enabled by default because the reverse proxy must route it for those features to work.
matrix_tuwunel_container_labels_public_tuwunel_api_enabled: true
matrix_tuwunel_container_labels_public_tuwunel_api_traefik_hostname: "{{ matrix_tuwunel_hostname }}"
matrix_tuwunel_container_labels_public_tuwunel_api_traefik_path_prefix: /_tuwunel
matrix_tuwunel_container_labels_public_tuwunel_api_traefik_rule: "Host(`{{ matrix_tuwunel_container_labels_public_tuwunel_api_traefik_hostname }}`) && PathPrefix(`{{ matrix_tuwunel_container_labels_public_tuwunel_api_traefik_path_prefix }}`)"
matrix_tuwunel_container_labels_public_tuwunel_api_traefik_priority: 0
matrix_tuwunel_container_labels_public_tuwunel_api_traefik_entrypoints: "{{ matrix_tuwunel_container_labels_traefik_entrypoints }}"
matrix_tuwunel_container_labels_public_tuwunel_api_traefik_tls: "{{ matrix_tuwunel_container_labels_public_tuwunel_api_traefik_entrypoints != 'web' }}"
matrix_tuwunel_container_labels_public_tuwunel_api_traefik_tls_certResolver: "{{ matrix_tuwunel_container_labels_traefik_tls_certResolver }}" # noqa var-naming
# Controls whether labels will be added that expose Tuwunel's first-party API (`/_tuwunel`) on the internal Traefik entrypoint.
matrix_tuwunel_container_labels_internal_tuwunel_api_enabled: false
matrix_tuwunel_container_labels_internal_tuwunel_api_traefik_path_prefix: /_tuwunel
matrix_tuwunel_container_labels_internal_tuwunel_api_traefik_rule: "PathPrefix(`{{ matrix_tuwunel_container_labels_internal_tuwunel_api_traefik_path_prefix }}`)"
matrix_tuwunel_container_labels_internal_tuwunel_api_traefik_priority: 0
matrix_tuwunel_container_labels_internal_tuwunel_api_traefik_entrypoints: ""
# Controls whether labels will be added that expose the Synapse-compatible Administration API (`/_synapse/admin`) on a public Traefik entrypoint.
# Tuwunel serves this API so that administration dashboards (synapse-admin, ketesa) and moderation bots (Draupnir, Meowlnir) work against it.
# Every endpoint requires an administrator access token. It is disabled by default; you may prefer to expose it only on the internal entrypoint below.
roles/custom/matrix-tuwunel/templates/labels.j2
+53
View File
@@ -136,6 +136,59 @@ traefik.http.routers.matrix-tuwunel-public-federation-api.tls.certResolver={{ ma
{% endif %}
{% if matrix_tuwunel_container_labels_public_tuwunel_api_enabled %}
############################################################
# #
# Public Tuwunel API (/_tuwunel) #
# #
############################################################
traefik.http.routers.matrix-tuwunel-public-tuwunel-api.rule={{ matrix_tuwunel_container_labels_public_tuwunel_api_traefik_rule }}
{% if matrix_tuwunel_container_labels_public_tuwunel_api_traefik_priority | int > 0 %}
traefik.http.routers.matrix-tuwunel-public-tuwunel-api.priority={{ matrix_tuwunel_container_labels_public_tuwunel_api_traefik_priority }}
{% endif %}
traefik.http.routers.matrix-tuwunel-public-tuwunel-api.service=matrix-tuwunel
traefik.http.routers.matrix-tuwunel-public-tuwunel-api.entrypoints={{ matrix_tuwunel_container_labels_public_tuwunel_api_traefik_entrypoints }}
traefik.http.routers.matrix-tuwunel-public-tuwunel-api.tls={{ matrix_tuwunel_container_labels_public_tuwunel_api_traefik_tls | to_json }}
{% if matrix_tuwunel_container_labels_public_tuwunel_api_traefik_tls %}
traefik.http.routers.matrix-tuwunel-public-tuwunel-api.tls.certResolver={{ matrix_tuwunel_container_labels_public_tuwunel_api_traefik_tls_certResolver }}
{% endif %}
############################################################
# #
# /Public Tuwunel API (/_tuwunel) #
# #
############################################################
{% endif %}
{% if matrix_tuwunel_container_labels_internal_tuwunel_api_enabled %}
############################################################
# #
# Internal Tuwunel API (/_tuwunel) #
# #
############################################################
traefik.http.routers.matrix-tuwunel-internal-tuwunel-api.rule={{ matrix_tuwunel_container_labels_internal_tuwunel_api_traefik_rule }}
{% if matrix_tuwunel_container_labels_internal_tuwunel_api_traefik_priority | int > 0 %}
traefik.http.routers.matrix-tuwunel-internal-tuwunel-api.priority={{ matrix_tuwunel_container_labels_internal_tuwunel_api_traefik_priority }}
{% endif %}
traefik.http.routers.matrix-tuwunel-internal-tuwunel-api.service=matrix-tuwunel
traefik.http.routers.matrix-tuwunel-internal-tuwunel-api.entrypoints={{ matrix_tuwunel_container_labels_internal_tuwunel_api_traefik_entrypoints }}
############################################################
# #
# /Internal Tuwunel API (/_tuwunel) #
# #
############################################################
{% endif %}
{% if matrix_tuwunel_container_labels_public_client_synapse_admin_api_enabled %}
############################################################
# #