Robert Kaussow
f44b8a163c
All checks were successful
continuous-integration/drone/push Build is passing
152 lines
4.7 KiB
YAML
152 lines
4.7 KiB
YAML
---
|
|
matrix_version: 0.34.1.1
|
|
|
|
matrix_user: matrix
|
|
matrix_user_home: "/home/{{ matrix_user }}"
|
|
# matrix_uid: # defaults to not set
|
|
matrix_group: "{{ matrix_user }}"
|
|
# matrix_gid: # defaults to not set
|
|
matrix_extra_groups: []
|
|
|
|
# Ensure EPEL repo is available at this server
|
|
matrix_dependencies:
|
|
- "@Development tools"
|
|
- libtiff-devel
|
|
- libjpeg-devel
|
|
- libzip-devel
|
|
- freetype-devel
|
|
- lcms2-devel
|
|
- libwebp-devel
|
|
- tcl-devel
|
|
- tk-devel
|
|
- redhat-rpm-config
|
|
- python-virtualenv
|
|
- python36-devel
|
|
- libffi-devel
|
|
- openssl-devel
|
|
|
|
# Create separate LVM storage for matrix
|
|
matrix_lvm_enabled: False
|
|
# This variables are only necessary if matrix_lvm_enabled is 'True'
|
|
# Set physical volumes to use in LVM
|
|
# matrix_lvm_pvs: # ['/dev/sdb', '/dev/sdc']
|
|
# matrix_lvm_vg: # "vg_matrix"
|
|
# matrix_lvm_lv: # "lv_matrix"
|
|
# matrix_lvm_fstype: # ext4
|
|
# matrix_lvm_size: # "50G"
|
|
|
|
matrix_base_dir: "/opt/matrix"
|
|
matrix_conf_dir: "{{ matrix_base_dir }}/config"
|
|
matrix_data_dir: "{{ matrix_base_dir }}/data"
|
|
matrix_log_dir: "{{ matrix_base_dir }}/logs"
|
|
|
|
matrix_server_url: example.com
|
|
matrix_client_url: https://matrix.example.com
|
|
|
|
matrix_http_bind_ips:
|
|
- '::'
|
|
- '0.0.0.0'
|
|
matrix_http_bind_port: 8008
|
|
|
|
matrix_https_bind_ips: "{{ matrix_http_bind_ips }}"
|
|
matrix_https_bind_port: 8448
|
|
|
|
matrix_ldap_auth_enabled: False
|
|
matrix_ldap_auth_server: ldaps://ldap.example.com:636
|
|
matrix_ldap_auth_use_starttls: "false"
|
|
matrix_ldap_auth_basedn: "ou=users,dc=example,dc=com"
|
|
matrix_ldap_auth_uid_attr: "uid"
|
|
matrix_ldap_auth_mail_attr: "email"
|
|
matrix_ldap_auth_name_attr: "cn"
|
|
# matrix_ldap_auth_binddn: uid=myuser,ou=users,dc=example,dc=com # defaults to not set
|
|
# matrix_ldap_auth_bind_password: # defaults to not set
|
|
# matrix_ldap_auth_filter: (objectClass=posixAccount) # defaults to not set
|
|
|
|
matrix_postgres_enabled: False
|
|
matrix_postgres_ssl_mode: disable
|
|
matrix_postgres_ssl_root_cert: /etc/pki/tls/certs/ca-bundle.trust.crt
|
|
matrix_postgres_server: postgres.example.com
|
|
matrix_postgres_port: 5432
|
|
matrix_postgres_superuser: postgres
|
|
matrix_postgres_password: secure
|
|
|
|
matrix_postgres_db:
|
|
name: matrix
|
|
lc_collate: en_US.UTF-8
|
|
lc_ctype: en_US.UTF-8'
|
|
encoding: UTF-8
|
|
template: template0
|
|
login_host: localhost
|
|
login_user: "{{ matrix_postgres_superuser }}"
|
|
login_password: "{{ matrix_postgres_password }}"
|
|
# login_unix_socket: # defaults to not set
|
|
port: "{{ matrix_postgres_port }}"
|
|
# owner: # defaults to not set
|
|
state: present
|
|
|
|
matrix_postgres_user:
|
|
name: pgmatrix
|
|
password: matrix
|
|
encrypted: 'yes'
|
|
# priv: # defaults to not set
|
|
# role_attr_flags: # defaults to not set
|
|
db: "{{ matrix_postgres_db.name }}"
|
|
login_host: localhost
|
|
login_user: "{{ matrix_postgres_superuser }}"
|
|
login_password: "{{ matrix_postgres_password }}"
|
|
# login_unix_socket: # defaults to not set
|
|
port: "{{ matrix_postgres_port }}"
|
|
state: present
|
|
|
|
matrix_iptables_enabled: False
|
|
matrix_open_ports:
|
|
- name: allow_matrix_web
|
|
rules: |
|
|
-A INPUT -m state --state NEW -p tcp --dport {{ matrix_http_bind_port }} -j ACCEPT
|
|
state: present
|
|
|
|
matrix_url_preview_enabled: False
|
|
|
|
# List of IP address CIDR ranges that the URL preview spider is denied
|
|
# from accessing. You should specify any internal services in your
|
|
# network that you do not want synapse to try to connect to, otherwise
|
|
# anyone in any Matrix room could cause your synapse to issue arbitrary
|
|
# GET requests to your internal services, causing serious security issues.
|
|
# matrix_url_preview_blacklist: # defaults to not set
|
|
# - '127.0.0.0/8'
|
|
# - '10.0.0.0/8'
|
|
# - '172.16.0.0/12'
|
|
# - '192.168.0.0/16'
|
|
# - '100.64.0.0/10'
|
|
# - '169.254.0.0/16'
|
|
# - '::1/128'
|
|
# - 'fe80::/64'
|
|
# - 'fc00::/7'
|
|
|
|
# Optional list of URL matches that the URL preview spider is
|
|
# denied from accessing.
|
|
# https://docs.python.org/2/library/urlparse.html#urlparse.urlsplit
|
|
# matrix_url_preview_url_blacklist:
|
|
# - netloc: '^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$'
|
|
# - netloc: '^([A-f0-9:]+:+)+[A-f0-9]+$'
|
|
matrix_url_preview_max_spider_size: 10M
|
|
|
|
matrix_tls_enabled: False
|
|
matrix_tls_dhparam_path: "{{ matrix_base_dir }}/tls/dhparam.pem"
|
|
matrix_tls_dhparam_size: 2048
|
|
matrix_tls_cert_path: "{{ matrix_base_dir }}/tls/certs/mycert.pem"
|
|
matrix_tls_key_path: "{{ matrix_base_dir }}/tls/private/mykey.pem"
|
|
matrix_tls_cert_source: mycert.pem
|
|
matrix_tls_key_source: mykey.pem
|
|
|
|
matrix_nginx_vhost_enabled: False
|
|
matrix_nginx_server: localhost
|
|
matrix_nginx_vhost_dir: /etc/nginx/sites-available
|
|
matrix_nginx_vhost_symlink: /etc/nginx/sites-enabled
|
|
matrix_nginx_iptables_enabled: False
|
|
matrix_nginx_tls_enabled: False
|
|
matrix_nginx_tls_cert_file: matrix-cert.pem
|
|
matrix_nginx_tls_key_file: matrix-key.pem
|
|
matrix_nginx_proxy_port: "{{ matrix_http_bind_port }}"
|
|
matrix_nginx_proxy_ip: "{{ matrix_http_bind_ips[0] }}"
|