Files
matrix-docker-ansible-deploy/roles/custom/matrix-ketesa/tasks/setup_install.yml
T
Slavi Pantaleev e5b8de8c2b Heal git checkout ownership in all roles cloning repositories on the server
6b4b7647e fixed this for synapse-usage-exporter only. A checkout owned by
a different user makes the git task fail from then on, either with a
permission error or with git's dubious-ownership protection, until
someone removes the directory on the host by hand. It gets into that
state when the matrix user's uid changes (a server migration or a restore
onto a differently numbered user), when an earlier clone ran as another
user, or when someone runs git as root inside the checkout.

Every other role cloning a repository onto the server was open to the
same failure, so ensure the checkout's ownership recursively before
updating it at the remaining 54 sites.

The three matrix-synapse ext clones also gain force=yes. They were the
only on-server clones without it, which left a checkout that an
interrupted run had half-written wedged, instead of repaired on the next
run.

matrix-matrixto used to clone as root into a directory that nothing ever
chowned, unlike every other role. It now becomes the matrix user too.

The Element Web and SchildiChat Web theme checkouts live on the Ansible
controller, where correcting ownership is not ours to do, so they merely
mark the checkout as a safe directory for git.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-07-31 19:01:52 +03:00

139 lines
5.5 KiB
YAML

# SPDX-FileCopyrightText: 2020 - 2024 Slavi Pantaleev
# SPDX-FileCopyrightText: 2020 Dennis Ciba
# SPDX-FileCopyrightText: 2021 Aaron Raimist
# SPDX-FileCopyrightText: 2022 MDAD project contributors
# SPDX-FileCopyrightText: 2022 Marko Weltzer
# SPDX-FileCopyrightText: 2022 - 2026 Nikita Chernyi
# SPDX-FileCopyrightText: 2022 Sebastian Gumprich
# SPDX-FileCopyrightText: 2024 David Mehren
#
# SPDX-License-Identifier: AGPL-3.0-or-later
---
# Migrate from the old matrix-synapse-admin role.
# The service was renamed to matrix-ketesa. Stop and remove the old one.
- name: Check if matrix-synapse-admin.service exists
ansible.builtin.stat:
path: "{{ devture_systemd_docker_base_systemd_path }}/matrix-synapse-admin.service"
register: matrix_ketesa_legacy_synapse_admin_service_stat
- name: Stop and remove legacy matrix-synapse-admin systemd service
when: matrix_ketesa_legacy_synapse_admin_service_stat.stat.exists | bool
block:
- name: Ensure legacy matrix-synapse-admin service is stopped
ansible.builtin.service:
name: matrix-synapse-admin
state: stopped
enabled: false
failed_when: false
- name: Remove legacy matrix-synapse-admin service file
ansible.builtin.file:
path: "{{ devture_systemd_docker_base_systemd_path }}/matrix-synapse-admin.service"
state: absent
- name: Remove legacy matrix-synapse-admin data directory
ansible.builtin.file:
path: "{{ matrix_base_data_path }}/synapse-admin"
state: absent
- name: Ensure matrix-ketesa paths exists
ansible.builtin.file:
path: "{{ item.path }}"
state: directory
mode: '0750'
owner: "{{ matrix_user_name }}"
group: "{{ matrix_group_name }}"
with_items:
- {path: "{{ matrix_ketesa_base_path }}", when: true}
- {path: "{{ matrix_ketesa_config_path }}", when: true}
- {path: "{{ matrix_ketesa_container_src_files_path }}", when: "{{ matrix_ketesa_container_image_self_build }}"}
when: "item.when | bool"
- name: Ensure matrix-ketesa labels file is created
ansible.builtin.template:
src: "{{ role_path }}/templates/labels.j2"
dest: "{{ matrix_ketesa_base_path }}/labels"
owner: "{{ matrix_user_name }}"
group: "{{ matrix_group_name }}"
mode: '0640'
register: matrix_ketesa_support_files_result
- name: Ensure matrix-ketesa configuration installed
ansible.builtin.copy:
content: "{{ matrix_ketesa_configuration | to_nice_json }}"
dest: "{{ matrix_ketesa_config_path }}/config.json"
mode: '0644'
owner: "{{ matrix_user_name }}"
group: "{{ matrix_group_name }}"
register: matrix_ketesa_config_result
- name: Ensure matrix-ketesa image is pulled
community.docker.docker_image_pull:
name: "{{ matrix_ketesa_container_image }}"
pull: always
when: not matrix_ketesa_container_image_self_build | bool
register: matrix_ketesa_container_image_pull_result
retries: "{{ devture_playbook_help_container_retries_count }}"
delay: "{{ devture_playbook_help_container_retries_delay }}"
until: matrix_ketesa_container_image_pull_result is not failed
# A checkout owned by a different user (a uid change, an earlier clone by another user, etc.) would make the git task below fail on ownership or permissions.
- name: Ensure matrix-ketesa repository ownership is correct when self-building
ansible.builtin.file:
path: "{{ matrix_ketesa_container_src_files_path }}"
state: directory
owner: "{{ matrix_user_name }}"
group: "{{ matrix_group_name }}"
recurse: true
when: matrix_ketesa_container_image_self_build | bool
- name: Ensure matrix-ketesa repository is present when self-building
ansible.builtin.git:
repo: "{{ matrix_ketesa_container_image_self_build_repo }}"
dest: "{{ matrix_ketesa_container_src_files_path }}"
version: "{{ matrix_ketesa_container_image.split(':')[1] }}"
force: "yes"
become: true
become_user: "{{ matrix_user_name }}"
register: matrix_ketesa_git_pull_results
when: matrix_ketesa_container_image_self_build | bool
- name: Ensure matrix-ketesa Docker image is built
community.docker.docker_image_build:
name: "{{ matrix_ketesa_container_image }}"
dockerfile: Dockerfile
path: "{{ matrix_ketesa_container_src_files_path }}"
pull: true
rebuild: "{{ 'always' if matrix_ketesa_git_pull_results.changed | bool else 'never' }}"
when: matrix_ketesa_container_image_self_build | bool
register: matrix_ketesa_container_image_build_result
- name: Ensure matrix-ketesa container network is created
when: matrix_ketesa_container_network != 'host'
community.general.docker_network:
enable_ipv6: "{{ devture_systemd_docker_base_ipv6_enabled }}"
name: "{{ matrix_ketesa_container_network }}"
driver: bridge
driver_options: "{{ devture_systemd_docker_base_container_networks_driver_options }}"
- name: Ensure matrix-ketesa.service installed
ansible.builtin.template:
src: "{{ role_path }}/templates/systemd/matrix-ketesa.service.j2"
dest: "{{ devture_systemd_docker_base_systemd_path }}/matrix-ketesa.service"
mode: '0644'
register: matrix_ketesa_systemd_service_result
- name: Determine whether Ketesa needs a restart
ansible.builtin.set_fact:
matrix_ketesa_restart_necessary: >-
{{
matrix_ketesa_support_files_result.changed | default(false)
or matrix_ketesa_config_result.changed | default(false)
or matrix_ketesa_systemd_service_result.changed | default(false)
or matrix_ketesa_container_image_pull_result.changed | default(false)
or matrix_ketesa_container_image_build_result.changed | default(false)
}}