Files
matrix-docker-ansible-deploy/roles/custom/matrix-bridge-mautrix-telegram/tasks/setup_install.yml
T
Slavi Pantaleev e5b8de8c2b Heal git checkout ownership in all roles cloning repositories on the server
6b4b7647e fixed this for synapse-usage-exporter only. A checkout owned by
a different user makes the git task fail from then on, either with a
permission error or with git's dubious-ownership protection, until
someone removes the directory on the host by hand. It gets into that
state when the matrix user's uid changes (a server migration or a restore
onto a differently numbered user), when an earlier clone ran as another
user, or when someone runs git as root inside the checkout.

Every other role cloning a repository onto the server was open to the
same failure, so ensure the checkout's ownership recursively before
updating it at the remaining 54 sites.

The three matrix-synapse ext clones also gain force=yes. They were the
only on-server clones without it, which left a checkout that an
interrupted run had half-written wedged, instead of repaired on the next
run.

matrix-matrixto used to clone as root into a directory that nothing ever
chowned, unlike every other role. It now becomes the matrix user too.

The Element Web and SchildiChat Web theme checkouts live on the Ansible
controller, where correcting ownership is not ours to do, so they merely
mark the checkout as a safe directory for git.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-07-31 19:01:52 +03:00

200 lines
9.4 KiB
YAML

# SPDX-FileCopyrightText: 2018 - 2026 Slavi Pantaleev
# SPDX-FileCopyrightText: 2018 Hugues Morisset
# SPDX-FileCopyrightText: 2019 Aaron Raimist
# SPDX-FileCopyrightText: 2019 Dan Arnfield
# SPDX-FileCopyrightText: 2019 Jan Christian Grünhage
# SPDX-FileCopyrightText: 2020 - 2022 MDAD project contributors
# SPDX-FileCopyrightText: 2020 Chris van Dijk
# SPDX-FileCopyrightText: 2020 Stuart Mumford
# SPDX-FileCopyrightText: 2021 Panagiotis Georgiadis
# SPDX-FileCopyrightText: 2022 Jim Myhrberg
# SPDX-FileCopyrightText: 2022 Marko Weltzer
# SPDX-FileCopyrightText: 2022 Nikita Chernyi
# SPDX-FileCopyrightText: 2022 Sebastian Gumprich
# SPDX-FileCopyrightText: 2024 David Mehren
#
# SPDX-License-Identifier: AGPL-3.0-or-later
---
- ansible.builtin.set_fact:
matrix_bridge_mautrix_telegram_migration_requires_restart: false
# The legacy Python bridge stored its SQLite DB at `{base_path}/mautrix-telegram.db` (the role's
# root). Later, we started relocating it to `{base_path}/data/mautrix-telegram.db`. The sqlite→
# postgres migration below only knows about the new path, so if the DB is still at the legacy
# location, move it to the new location first — otherwise users who follow the changelog and
# switch to Postgres wouldn't actually get their data imported before the service starts.
- name: Check if a legacy-location SQLite database exists
ansible.builtin.stat:
path: "{{ matrix_bridge_mautrix_telegram_base_path }}/mautrix-telegram.db"
register: matrix_bridge_mautrix_telegram_stat_database_legacy_location
- when: matrix_bridge_mautrix_telegram_stat_database_legacy_location.stat.exists | bool
block:
- name: Ensure matrix-mautrix-telegram.service is stopped before relocating legacy SQLite DB
ansible.builtin.service:
name: matrix-mautrix-telegram
state: stopped
enabled: false
daemon_reload: true
failed_when: false
- name: Ensure data directory exists for legacy SQLite DB relocation
ansible.builtin.file:
path: "{{ matrix_bridge_mautrix_telegram_data_path }}"
state: directory
mode: '0750'
owner: "{{ matrix_user_name }}"
group: "{{ matrix_group_name }}"
- name: (Data relocation) Move mautrix-telegram SQLite DB from legacy location to data directory
ansible.builtin.command:
cmd: "mv {{ matrix_bridge_mautrix_telegram_base_path }}/mautrix-telegram.db {{ matrix_bridge_mautrix_telegram_data_path }}/mautrix-telegram.db"
creates: "{{ matrix_bridge_mautrix_telegram_data_path }}/mautrix-telegram.db"
removes: "{{ matrix_bridge_mautrix_telegram_base_path }}/mautrix-telegram.db"
- when: "matrix_bridge_mautrix_telegram_database_engine == 'postgres'"
block:
- name: Check if an SQLite database already exists
ansible.builtin.stat:
path: "{{ matrix_bridge_mautrix_telegram_sqlite_database_path_local }}"
register: matrix_bridge_mautrix_telegram_sqlite_database_path_local_stat_result
- when: "matrix_bridge_mautrix_telegram_sqlite_database_path_local_stat_result.stat.exists | bool"
block:
- ansible.builtin.include_role:
name: galaxy/postgres
tasks_from: migrate_db_to_postgres
vars:
postgres_db_migration_request:
src: "{{ matrix_bridge_mautrix_telegram_sqlite_database_path_local }}"
dst: "{{ matrix_bridge_mautrix_telegram_database_connection_string }}"
caller: "{{ role_path | basename }}"
engine_variable_name: 'matrix_bridge_mautrix_telegram_database_engine'
engine_old: 'sqlite'
systemd_services_to_stop: ['matrix-mautrix-telegram.service']
pgloader_options: ['--with "quote identifiers"']
- ansible.builtin.set_fact:
matrix_bridge_mautrix_telegram_migration_requires_restart: true
- name: Ensure Mautrix Telegram paths exist
ansible.builtin.file:
path: "{{ item.path }}"
state: directory
mode: '0750'
owner: "{{ matrix_user_name }}"
group: "{{ matrix_group_name }}"
with_items:
- {path: "{{ matrix_bridge_mautrix_telegram_base_path }}", when: true}
- {path: "{{ matrix_bridge_mautrix_telegram_config_path }}", when: true}
- {path: "{{ matrix_bridge_mautrix_telegram_data_path }}", when: true}
- {path: "{{ matrix_bridge_mautrix_telegram_container_src_files_path }}", when: "{{ matrix_bridge_mautrix_telegram_container_image_self_build }}"}
when: item.when | bool
- name: Ensure Mautrix Telegram image is pulled
community.docker.docker_image_pull:
name: "{{ matrix_bridge_mautrix_telegram_container_image }}"
pull: always
when: "not matrix_bridge_mautrix_telegram_container_image_self_build | bool"
register: matrix_bridge_mautrix_telegram_container_image_pull_result
retries: "{{ devture_playbook_help_container_retries_count }}"
delay: "{{ devture_playbook_help_container_retries_delay }}"
until: matrix_bridge_mautrix_telegram_container_image_pull_result is not failed
# A checkout owned by a different user (a uid change, an earlier clone by another user, etc.) would make the git task below fail on ownership or permissions.
- name: Ensure Mautrix Telegram repository ownership is correct on self-build
ansible.builtin.file:
path: "{{ matrix_bridge_mautrix_telegram_container_src_files_path }}"
state: directory
owner: "{{ matrix_user_name }}"
group: "{{ matrix_group_name }}"
recurse: true
when: "matrix_bridge_mautrix_telegram_container_image_self_build | bool"
- name: Ensure Mautrix Telegram repository is present on self-build
ansible.builtin.git:
repo: "{{ matrix_bridge_mautrix_telegram_container_image_self_build_repo }}"
dest: "{{ matrix_bridge_mautrix_telegram_container_src_files_path }}"
version: "{{ matrix_bridge_mautrix_telegram_container_image_self_build_branch }}"
force: "yes"
become: true
become_user: "{{ matrix_user_name }}"
register: matrix_bridge_mautrix_telegram_git_pull_results
when: "matrix_bridge_mautrix_telegram_container_image_self_build | bool"
- name: Ensure Mautrix Telegram Docker image is built
community.docker.docker_image_build:
name: "{{ matrix_bridge_mautrix_telegram_container_image }}"
dockerfile: Dockerfile
path: "{{ matrix_bridge_mautrix_telegram_container_src_files_path }}"
pull: true
rebuild: "{{ 'always' if matrix_bridge_mautrix_telegram_git_pull_results.changed | bool else 'never' }}"
when: "matrix_bridge_mautrix_telegram_container_image_self_build | bool"
register: matrix_bridge_mautrix_telegram_container_image_build_result
- name: Ensure mautrix-telegram config.yaml installed
ansible.builtin.copy:
content: "{{ matrix_bridge_mautrix_telegram_configuration | to_nice_yaml(indent=2, width=999999) }}"
dest: "{{ matrix_bridge_mautrix_telegram_config_path }}/config.yaml"
mode: '0644'
owner: "{{ matrix_user_name }}"
group: "{{ matrix_group_name }}"
register: matrix_bridge_mautrix_telegram_config_result
- name: Ensure mautrix-telegram registration.yaml installed
ansible.builtin.copy:
content: "{{ matrix_bridge_mautrix_telegram_registration | to_nice_yaml(indent=2, width=999999) }}"
dest: "{{ matrix_bridge_mautrix_telegram_config_path }}/registration.yaml"
mode: '0644'
owner: "{{ matrix_user_name }}"
group: "{{ matrix_group_name }}"
register: matrix_bridge_mautrix_telegram_registration_result
- name: Ensure mautrix-telegram support files installed
ansible.builtin.template:
src: "{{ role_path }}/templates/{{ item }}.j2"
dest: "{{ matrix_bridge_mautrix_telegram_base_path }}/{{ item }}"
mode: '0640'
owner: "{{ matrix_user_name }}"
group: "{{ matrix_group_name }}"
with_items:
- labels
register: matrix_bridge_mautrix_telegram_support_files_result
- name: Ensure matrix-mautrix-telegram container network is created
when: matrix_bridge_mautrix_telegram_container_network != 'host'
community.general.docker_network:
enable_ipv6: "{{ devture_systemd_docker_base_ipv6_enabled }}"
name: "{{ matrix_bridge_mautrix_telegram_container_network }}"
driver: bridge
driver_options: "{{ devture_systemd_docker_base_container_networks_driver_options }}"
- name: Ensure matrix-mautrix-telegram.service installed
ansible.builtin.template:
src: "{{ role_path }}/templates/systemd/matrix-mautrix-telegram.service.j2"
dest: "{{ devture_systemd_docker_base_systemd_path }}/matrix-mautrix-telegram.service"
mode: '0644'
register: matrix_bridge_mautrix_telegram_systemd_service_result
- name: Determine whether matrix-mautrix-telegram needs a restart
ansible.builtin.set_fact:
matrix_bridge_mautrix_telegram_restart_necessary: >-
{{
matrix_bridge_mautrix_telegram_migration_requires_restart | default(false)
or matrix_bridge_mautrix_telegram_config_result.changed | default(false)
or matrix_bridge_mautrix_telegram_registration_result.changed | default(false)
or matrix_bridge_mautrix_telegram_support_files_result.changed | default(false)
or matrix_bridge_mautrix_telegram_systemd_service_result.changed | default(false)
or matrix_bridge_mautrix_telegram_container_image_pull_result.changed | default(false)
or matrix_bridge_mautrix_telegram_container_image_build_result.changed | default(false)
}}
- name: Ensure matrix-mautrix-telegram.service restarted, if necessary
ansible.builtin.service:
name: "matrix-mautrix-telegram.service"
state: restarted
daemon_reload: true
when: "matrix_bridge_mautrix_telegram_migration_requires_restart | bool"