Update to 2021-12-01 19:13

roles/matrix_synapse/defaults/main.yml

@@ -0,0 +1,131 @@
+---
+
+# Synapse version to deploy
+synapse_version: 1.48.0
+
+# Should ansible handle Synapse upgrades ? If false, only initial install will be done
+synapse_manage_upgrade: True
+
+# Synapse install dir
+synapse_root_dir: /opt/matrix/synapse
+
+# User account which run the daemon
+synapse_user: synapse
+
+# Max amount of memory the daemon is allowed (in MB)
+synapse_max_mem: 4096
+
+# PostgreSQL
+synapse_pg_create_db: True
+synapse_pg_db_server: "{{ pg_server | default('localhost') }}"
+synapse_pg_db_port: 5432
+synapse_pg_db_name: synapse
+synapse_pg_db_user: synapse
+# synapse_pg_db_pass: secret
+
+# Server name. Mandatory
+# synapse_server_name: 
+# synapse_public_baseurl: https://matrix.example.com
+
+# Should synapse handle TLS
+synapse_tls: False
+
+# Limit of events for get and sync. -1 for no limit
+synapse_timeline_limit: -1
+
+# Ports and bind addresses
+synapse_tls_port: 8448
+synapse_tls_listen_ip:
+  - 0.0.0.0
+synapse_port: 8008
+synapse_listen_ip: 
+  - 0.0.0.0
+# List of IP able to access the ports
+synapse_tls_src_ip:
+  - 0.0.0.0/0
+synapse_src_ip:
+  - 0.0.0.0/0
+
+# You can restrict federation with a list of servers. * means everything
+# Empty list means no federation is allowed
+synapse_federation_domain_whitelist:
+  - '*'
+
+synapse_federation_ip_blacklist:
+  - 127.0.0.0/8
+  - 100.64.0.0/10
+  - 169.254.0.0/16
+
+# Limits
+synapse_upload_max_size: 20M
+
+# Limit number of messages and login
+synapse_rc_message_per_sec: 3
+synapse_rc_message_burst: 50
+synapse_rc_login_per_sec: 3
+synapse_rc_login_burst: 10
+
+# Registration settings
+synapse_enable_registration: False
+synapse_allow_guest_access: False
+# If set, allow registration if you know this key. Even if registration is otherwise disabled
+# synapse_registration_shared_secret:
+
+# URL Preview
+synapse_url_preview: True
+synapse_url_preview_ip_range_blacklist:
+  - '127.0.0.0/8'
+  - '10.0.0.0/8'
+  - '172.16.0.0/12'
+  - '192.168.0.0/16'
+  - '100.64.0.0/10'
+  - '169.254.0.0/16'
+synapse_url_preview_ip_range_whitelist: []
+synapse_url_preview_url_blacklist: []
+# synapse_url_preview_url_blacklist:
+#   - username: '*'
+#   - netloc: '*.example.org'
+#     path: /admin
+#   - scheme: http
+#   - netloc: '^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$'
+synapse_max_spider_size: 10M
+
+# Turn configuration, for VoIP/Video using WebRTC
+# synapse_turn_uris: 
+#   - turns:turn.example.com
+#   - turns:turn.example.com?transport=tcp
+# synapse_turn_shared_secret:
+# Set this to true if you want guests to do VoIP/Video calls too
+synapse_turn_allow_guests: True
+
+synapse_email_notifs: True
+synapse_smtp_from: "Your Friendly %(app)s Home Server <noreply@{{ ansible_domain }}>"
+synapse_app_name: Matrix
+#synapse_element_base_url: https://messenger.example.com
+
+# Log level
+synapse_log_level: ERROR
+
+# Can be internal, ldap, rest or oidc (several choices can be made)
+synapse_auth:
+  - internal
+
+# If auth is ldap
+synapse_ldap_uri: "{{ ldap_uri | default('ldap://ldap.example.com:389') }}"
+synapse_ldap_start_tls: True
+synapse_ldap_user_base: "{{ ad_ldap_user_search_base | default(ad_auth | default(False) | ternary('DC=' + ad_realm | default(samba_realm) | default(ansible_domain) | regex_replace('\\.',',DC='), 'dc=example,dc=org')) }}"
+synapse_ldap_attr_uid: "{{ ad_auth | default(False) | ternary('sAMAccountName', 'uid') }}"
+synapse_ldap_attr_email: mail
+synapse_ldap_attr_name: cn
+synapse_ldap_filter: "{{ ad_auth | default(False) | ternary('(&(objectCategory=person)(objectClass=user)(primaryGroupId=513))', '(objectClass=inetOrgPerson)') }}"
+
+# if auth is rest
+synapse_auth_rest_uri: http://localhost:8083
+
+# if auth is oidc
+synapse_oidc_server: https://sso.domain.com
+synapse_oidc_client: matrix
+synapse_oidc_secret: XXXXX
+# Jinja2 template to for the local part of the MXID.
+synapse_oidc_localpart: "{{ '{{ user.sub }}' }}"
+synapse_oidc_display_name: "{{ '{{ user.name }}' }}"

roles/matrix_synapse/handlers/main.yml

@@ -0,0 +1,5 @@
+---
+
+- name: restart synapse
+  service: name=matrix-synapse state=restarted
+  when: not synapse_started.changed

roles/matrix_synapse/meta/main.yml

@@ -0,0 +1 @@
+---

roles/matrix_synapse/tasks/archive_post.yml

@@ -0,0 +1,10 @@
+---
+
+- name: Compress previous version
+  command: tar cf {{ synapse_root_dir }}/archives/{{ synapse_current_version }}.tar.zst --use-compress-program=zstd ./
+  args:
+    chdir: "{{ synapse_root_dir }}/archives/{{ synapse_current_version }}"
+    warn: False
+  environment:
+    ZSTD_CLEVEL: 10
+  tags: matrix

roles/matrix_synapse/tasks/archive_pre.yml

@@ -0,0 +1,31 @@
+---
+
+- name: Create archive dir
+  file: path={{ synapse_root_dir }}/archives/{{ synapse_current_version }} state=directory
+  tags: matrix
+
+- name: Archive previous version
+  synchronize:
+    src: "{{ synapse_root_dir }}/{{ item }}"
+    dest: "{{ synapse_root_dir }}/archives/{{ synapse_current_version }}/"
+    delete: True
+    compress: False
+  loop:
+    - etc
+    - res
+    - venv
+  delegate_to: "{{ inventory_hostname }}"
+  tags: matrix
+
+- name: Archive a database dump
+  shell: >
+    /usr/pgsql-14/bin/pg_dump
+    --clean
+    --create
+    --host={{ synapse_pg_db_server }}
+    --port={{ synapse_pg_db_port }}
+    --username=sqladmin {{ synapse_pg_db_name }} |
+    zstd -T0 -10 -c > {{ synapse_root_dir }}/archives/{{ synapse_current_version }}/{{ synapse_pg_db_name }}.sql.zst
+  environment:
+    - PGPASSWORD: "{{ pg_admin_pass }}"
+  tags: matrix

roles/matrix_synapse/tasks/cleanup.yml

@@ -0,0 +1,16 @@
+---
+
+- name: Remove unused and tmp files
+  file: path={{ item }} state=absent
+  loop:
+    - "{{ synapse_root_dir }}/lib"
+    - "{{ synapse_root_dir }}/lib64"
+    - "{{ synapse_root_dir }}/include"
+    - "{{ synapse_root_dir }}/bin"
+    - "{{ synapse_root_dir }}/db_dumps"
+    - "{{ synapse_root_dir }}/res/synapse_janitor.sql"
+    - "{{ synapse_root_dir }}/venv/bin/synapse_janitor.sh"
+    - /etc/cron.d/matrix_synapse
+    - "{{ synapse_root_dir }}/archives/{{ synapse_current_version }}"
+  tags: matrix
+

roles/matrix_synapse/tasks/conf.yml

@@ -0,0 +1,31 @@
+---
+- name: Deploy main config file
+  template: src=homeserver.yaml.j2 dest={{ synapse_root_dir }}/etc/homeserver.yaml group={{ synapse_user }} mode=640
+  notify: restart synapse
+  tags: matrix
+
+- name: Deploy logging config file
+  template: src=logging.conf.j2 dest={{ synapse_root_dir }}/etc/logging.conf
+  notify: restart synapse
+  tags: matrix
+
+- name: Generate certificates
+  command: "{{ synapse_root_dir }}/venv/bin/python3 -m synapse.app.homeserver --generate-keys -c {{ synapse_root_dir }}/etc/homeserver.yaml"
+  args:
+    creates: "{{ synapse_root_dir }}/etc/{{ synapse_server_name }}.signing.key"
+  tags: matrix
+
+- name: List sensitive files
+  stat: path={{ synapse_root_dir }}/etc/{{ item }}
+  register: synapse_sensitive_files
+  with_items:
+    - "{{ synapse_server_name }}.tls.key"
+    - "{{ synapse_server_name }}.signing.key"
+  tags: matrix
+
+- name: Restrict permissions on sensitive files
+  file: path={{ synapse_root_dir }}/etc/{{ item.item }} mode=640 group={{ synapse_user }}
+  with_items: "{{ synapse_sensitive_files.results }}"
+  when: item.stat.exists
+  tags: matrix
+

roles/matrix_synapse/tasks/directories.yml

@@ -0,0 +1,24 @@
+---
+
+- name: Create needed directories
+  file:
+    state: directory
+    path: "{{ synapse_root_dir }}/{{ item.dir }}"
+    mode: "{{ item.mode | default(omit) }}"
+    group: "{{ synapse_user }}"
+  with_items:
+    - dir: meta
+      mode: 700
+    - dir: media_store
+      mode: 770
+    - dir: uploads
+      mode: 770
+    - dir: tmp
+      mode: 770
+    - dir: etc
+      mode: 750
+    - dir: res/templates
+    - dir: backup
+      mode: 700
+    - dir: venv
+  tags: matrix

roles/matrix_synapse/tasks/facts.yml

@@ -0,0 +1,46 @@
+---
+
+- include_vars: "{{ item }}"
+  with_first_found:
+    - vars/{{ ansible_distribution }}-{{ ansible_distribution_major_version }}.yml
+    - vars/{{ ansible_os_family }}-{{ ansible_distribution_major_version }}.yml
+    - vars/{{ ansible_distribution }}.yml
+    - vars/{{ ansible_os_family }}.yml
+  tags: matrix
+
+# Detect installed version (if any)
+- block:
+    - import_tasks: ../includes/webapps_set_install_mode.yml
+      vars:
+        - root_dir: "{{ synapse_root_dir }}"
+        - version: "{{ synapse_version }}"
+    - set_fact: synapse_install_mode={{ (install_mode == 'upgrade' and not synapse_manage_upgrade) | ternary('none',install_mode) }}
+    - set_fact: synapse_current_version={{ current_version | default('') }}
+  tags: matrix
+
+- when: synapse_pg_db_pass is not defined
+  block:
+    - import_tasks: ../includes/get_rand_pass.yml
+      vars:
+        - pass_file: "{{ synapse_root_dir }}/meta/ansible_dbpass"
+    - set_fact: synapse_pg_db_pass={{ rand_pass }}
+  tags: matrix
+
+- block:
+    - import_tasks: ../includes/get_rand_pass.yml
+      vars:
+        - pass_file: "{{ synapse_root_dir }}/meta/ansible_macaroon_key"
+    - set_fact: synapse_macaroon_key={{ rand_pass }}
+  tags: matrix
+
+- block:
+    - import_tasks: ../includes/get_rand_pass.yml
+      vars:
+        - pass_file: "{{ synapse_root_dir }}/meta/ansible_form_secret"
+    - set_fact: synapse_form_secret={{ rand_pass }}
+  tags: matrix
+
+- name: Check if the old venv is present
+  stat: path={{ synapse_root_dir }}/lib
+  register: synapse_old_venv
+  tags: matrix

roles/matrix_synapse/tasks/install.yml

@@ -0,0 +1,113 @@
+---
+
+- name: Install system dependencies
+  yum: name={{ synapse_packages }}
+  tags: matrix
+
+- name: Check if pg_config is available
+  stat: path=/bin/pg_config
+  register: synapse_pg_config
+  tags: matrix
+
+- name: Setup pg_config
+  alternatives:
+    name: psql-pg_config
+    link: /bin/pg_config
+    path: /usr/pgsql-14/bin/pg_config
+  when: not synapse_pg_config.stat.exists
+  tags: matrix
+
+- name: Wipe pip cache
+  file: path=/root/.cache/pip state=absent
+  when: synapse_old_venv.stat.exists
+  tags: matrix
+
+- name: Wipe the venv during upgrades
+  file: path={{ synapse_root_dir }}/venv state=absent
+  when: synapse_install_mode == 'upgrade'
+  tags: matrix
+
+- name: Install or update dependencies in the virtual env
+  pip:
+    state: "{{ (synapse_install_mode == 'upgrade') | ternary('latest','present') }}"
+    virtualenv: "{{ synapse_root_dir }}/venv"
+    virtualenv_command: /usr/bin/virtualenv-3
+    virtualenv_python: /usr/bin/python3
+    name:
+      - bleach
+      - matrix-synapse-ldap3
+      - psycopg2
+      - txacme
+      - Jinja2
+      - lxml
+      - pysaml2
+      - mock
+      - six
+      - authlib
+      - twisted
+  notify: restart synapse
+  tags: matrix
+
+- name: Install or update synapse in a virtualenv
+  pip:
+    virtualenv: "{{ synapse_root_dir }}/venv"
+    virtualenv_command: /usr/bin/virtualenv-3
+    virtualenv_python: /usr/bin/python3
+    name:
+      - matrix-synapse
+    version: "{{ synapse_version }}"
+  notify: restart synapse
+  tags: matrix
+
+- name: Install the service unit file
+  template: src=matrix-synapse.service.j2 dest=/etc/systemd/system/matrix-synapse.service
+  register: synapse_service_unit
+  notify: restart synapse
+  tags: matrix
+
+- name: Reload systemd
+  systemd: daemon_reload=True
+  when: synapse_service_unit.changed
+  tags: matrix
+
+- name: Install REST auth module
+  get_url:
+    url: https://raw.githubusercontent.com/ma1uta/matrix-synapse-rest-password-provider/master/rest_auth_provider.py
+    dest: "{{ synapse_root_dir }}/venv/lib/python3.6/site-packages/"
+  tags: matrix
+
+- name: Create the PostgreSQL role
+  postgresql_user:
+    db: postgres
+    name: "{{ synapse_pg_db_user }}"
+    password: "{{ synapse_pg_db_pass }}"
+    login_host: "{{ synapse_pg_db_server }}"
+    login_user: sqladmin
+    login_password: "{{ pg_admin_pass }}"
+  tags: matrix
+
+- name: Create the PostgreSQL database
+  postgresql_db:
+    name: "{{ synapse_pg_db_name }}"
+    encoding: UTF-8
+    lc_collate: C
+    lc_ctype: C
+    template: template0
+    owner: "{{ synapse_pg_db_user }}"
+    login_host: "{{ synapse_pg_db_server }}"
+    login_user: sqladmin
+    login_password: "{{ pg_admin_pass }}"
+  tags: matrix
+
+- name: Deploy backup scripts
+  template: src={{ item }}-backup.sh.j2 dest=/etc/backup/{{ item }}.d/matrix_synapse.sh mode=750
+  loop:
+    - pre
+    - post
+  tags: matrix
+
+- name: Reset SELinux contexts
+  command: restorecon -R {{ synapse_root_dir }}
+  changed_when: False
+  when: ansible_selinux.status == 'enabled'
+  tags: matrix

roles/matrix_synapse/tasks/iptables.yml

@@ -0,0 +1,16 @@
+---
+
+- name: Handle Synapse TLS port
+  iptables_raw:
+    name: synapse_tls_port
+    state: "{{ (synapse_tls_src_ip | length > 0) | ternary('present', 'absent') }}"
+    rules: "-A INPUT -m state --state NEW -p tcp --dport {{ synapse_tls_port }} -s {{ synapse_tls_src_ip | join(',') }} -j ACCEPT"
+  tags: matrix,firewall
+
+- name: Handle Synapse port
+  iptables_raw:
+    name: synapse_port
+    state: "{{ (synapse_src_ip | length > 0) | ternary('present', 'absent') }}"
+    rules: "-A INPUT -m state --state NEW -p tcp --dport {{ synapse_port }} -s {{ synapse_src_ip | join(',') }} -j ACCEPT"
+  tags: matrix,firewall
+

roles/matrix_synapse/tasks/main.yml

@@ -0,0 +1,17 @@
+---
+
+- include: user.yml
+- include: directories.yml
+- include: facts.yml
+- include: archive_pre.yml
+  when: synapse_install_mode == 'upgrade'
+- include: install.yml
+- include: conf.yml
+- include: iptables.yml
+  when: iptables_manage | default(True)
+- include: service.yml
+- include: write_version.yml
+- include: archive_post.yml
+  when: synapse_install_mode == 'upgrade'
+- include: cleanup.yml
+

roles/matrix_synapse/tasks/service.yml

@@ -0,0 +1,6 @@
+---
+
+- name: Start and enable the service
+  service: name=matrix-synapse state=started enabled=True
+  register: synapse_started
+  tags: matrix

roles/matrix_synapse/tasks/user.yml

@@ -0,0 +1,6 @@
+---
+
+- name: Create synapse user account
+  user: name={{ synapse_user }} home={{ synapse_root_dir }} shell=/bin/bash state=present
+  tags: matrix
+

roles/matrix_synapse/tasks/write_version.yml

@@ -0,0 +1,5 @@
+---
+
+- name: Write current version
+  copy: content={{ synapse_version }} dest={{ synapse_root_dir }}/meta/ansible_version
+  tags: matrix

roles/matrix_synapse/templates/homeserver.yaml.j2

@@ -0,0 +1,214 @@
+---
+
+{% if synapse_tls %}
+tls_certificate_path: "{{ synapse_root_dir }}/etc/{{ synapse_server_name }}.crt"
+tls_private_key_path: "{{ synapse_root_dir }}/etc/{{ synapse_server_name }}.tls.key"
+tls_dh_params_path: "{{ synapse_root_dir }}/etc/{{ synapse_server_name }}.tls.dh"
+{% endif %}
+
+server_name: '{{ synapse_server_name }}'
+public_baseurl: '{{ synapse_public_baseurl | default('https://matrix.' + synapse_server_name) }}'
+
+pid_file: {{ synapse_root_dir }}/tmp/homeserver.pid
+
+web_client: False
+
+soft_file_limit: 0
+filter_timeline_limit: {{ synapse_timeline_limit }}
+
+listeners:
+{% if synapse_tls %}
+  - port: {{ synapse_tls_port }}
+    bind_addresses: [ {{ synapse_tls_listen_ip | join(',') }} ]
+    type: http
+    tls: true
+    x_forwarded: {{ ('0.0.0.0/0' in synapse_tls_src_ip) | ternary('False','True') }}
+    resources:
+      - names: [ client, federation ]
+        compress: False
+{% endif %}
+  - port: {{ synapse_port }}
+    bind_addresses: [ {{ synapse_listen_ip | join(',') }} ]
+    type: http
+    tls: False
+    x_forwarded: {{ ('0.0.0.0/0' in synapse_src_ip) | ternary('False','True') }}
+    resources:
+      - names: [ client, federation ]
+        compress: False
+
+database:
+  name: psycopg2
+  args:
+    database: '{{ synapse_pg_db_name }}'
+    host: '{{ synapse_pg_db_server }}'
+    user: '{{ synapse_pg_db_user }}'
+    password: '{{ synapse_pg_db_pass }}'
+    cp_min: 5
+    cp_max: 10
+
+event_cache_size: '10K'
+
+verbose: 0
+log_config: '{{ synapse_root_dir }}/etc/logging.conf'
+
+{% if '*' not in synapse_federation_domain_whitelist %}
+{% if synapse_federation_domain_whitelist | length > 0 %}
+federation_domain_whitelist:
+{% for domain in synapse_federation_domain_whitelist %}
+  - '{{ domain }}'
+{% endfor %}
+{% else %}
+federation_domain_whitelist: []
+{% endif %}
+{% endif %}
+
+{% if synapse_federation_ip_blacklist | length > 0 %}
+federation_ip_range_blacklist:
+{% for ip in synapse_federation_ip_blacklist %}
+  - '{{ ip }}'
+{% endfor %}
+{% else %}
+federation_ip_range_blacklist: []
+{% endif %}
+
+media_store_path: '{{ synapse_root_dir }}/media_store'
+uploads_path: '{{ synapse_root_dir }}/uploads'
+max_upload_size: '{{ synapse_upload_max_size }}'
+
+{% if synapse_turn_uris is defined and synapse_turn_uris | length > 0 %}
+turn_uris:
+{% for uri in synapse_turn_uris %}
+  - '{{ uri }}'
+{% endfor %}
+turn_shared_secret: '{{ synapse_turn_shared_secret | default(turnserver_auth_secret) }}'
+turn_user_lifetime: '1h'
+turn_allow_guests: {{ synapse_turn_allow_guests | ternary('True', 'False') }}
+{% endif %}
+
+enable_registration: {{ synapse_enable_registration | ternary('True', 'False') }}
+{% if synapse_registration_shared_secret is defined %}
+registration_shared_secret: '{{ synapse_registration_shared_secret }}'
+{% endif %}
+bcrypt_rounds: 12
+allow_guest_access: {{ synapse_allow_guest_access | ternary('True', 'False') }}
+
+rc_message:
+  per_second: {{ synapse_rc_message_per_sec }}
+  burst_count: {{ synapse_rc_message_burst }}
+rc_login:
+  address:
+    per_second: {{ synapse_rc_login_per_sec }}
+    burst_count: {{ synapse_rc_login_burst }}
+  account:
+    per_second: {{ synapse_rc_login_per_sec }}
+    burst_count: {{ synapse_rc_login_burst }}
+  failed_attempts:
+    per_second: {{ synapse_rc_login_per_sec }}
+    burst_count: {{ synapse_rc_login_burst }}
+
+enable_metrics: False
+report_stats: False
+
+default_identity_server: '{{ synapse_public_baseurl | default('https://matrix.' + synapse_server_name) }}'
+
+macaroon_secret_key: '{{ synapse_macaroon_key }}'
+
+expire_access_token: False
+
+{% if synapse_url_preview %}
+url_preview_enabled: True
+{% if synapse_url_preview_ip_range_blacklist is defined and synapse_url_preview_ip_range_blacklist | length > 0 %}
+url_preview_ip_range_blacklist:
+{% for ip in synapse_url_preview_ip_range_blacklist %}
+  - '{{ ip }}'
+{% endfor %}
+{% endif %}
+{% if synapse_url_preview_ip_range_whitelist is defined  and synapse_url_preview_ip_range_whitelist | length > 0 %}
+url_preview_ip_range_whitelist:
+{% for ip in synapse_url_preview_ip_range_whitelist %}
+  - '{{ ip }}'
+{% endfor %}
+{% endif %}
+{% if synapse_url_preview_url_blacklist is defined and synapse_url_preview_url_blacklist | length > 0 %}
+url_preview_url_blacklist:
+{{ synapse_url_preview_url_blacklist | to_nice_yaml(indent=2, width=1000) }}
+{% endif %}
+max_spider_size: {{ synapse_max_spider_size }}
+{% endif %}
+
+form_secret: '{{ synapse_form_secret }}'
+
+signing_key_path: '{{ synapse_root_dir }}/etc/{{ synapse_server_name }}.signing.key'
+
+trusted_key_servers:
+  - server_name: 'matrix.org'
+suppress_key_server_warning: True
+
+email:
+  enable_notifs: True
+  smtp_host: 'localhost'
+  smtp_port: 25
+  require_transport_security: False
+  notif_from: '{{ synapse_smtp_from }}'
+  app_name: '{{ synapse_app_name }}'
+  notif_for_new_users: True
+{% if synapse_client_url is defined %}
+  client_base_url: '{{ synapse_client_base_url }}'
+{% endif %}
+
+{% if 'ldap' in synapse_auth or 'rest' in synapse_auth  or synapse_auth in ['ldap','rest'] %}
+password_providers:
+{% endif %}
+{% if synapse_auth == 'ldap' or 'ldap' in synapse_auth %}
+  - module: 'ldap_auth_provider.LdapAuthProvider'
+    config:
+      enabled: True
+      uri: '{{ synapse_ldap_uri }}'
+      start_tls: {{ synapse_ldap_start_tls | ternary('True', 'False') }}
+      base: '{{ synapse_ldap_user_base }}'
+      attributes:
+        uid: '{{ synapse_ldap_attr_uid }}'
+        mail: '{{ synapse_ldap_attr_email }}'
+        name: '{{ synapse_ldap_attr_name }}'
+{% if synapse_ldap_bind_dn is defined and synapse_ldap_bind_pass is defined %}
+      bind_dn: '{{ synapse_ldap_bind_dn }}'
+      bind_password: '{{ synapse_ldap_bind_pass }}'
+{% endif %}
+      filter: '{{ synapse_ldap_filter }}'
+{% endif %}
+{% if synapse_auth == 'rest' or 'rest' in synapse_auth %}
+  - module: 'rest_auth_provider.RestAuthProvider'
+    config:
+      endpoint: '{{ synapse_auth_rest_uri }}'
+{% endif %}
+{% if synapse_auth == 'oidc' or 'oidc' in synapse_auth %}
+oidc_config:
+  enabled: True
+  issuer: '{{ synapse_oidc_server }}'
+  client_id: '{{ synapse_oidc_client }}'
+  client_secret: '{{ synapse_oidc_secret }}'
+  user_mapping_provider:
+    config:
+      localpart_template: '{{ synapse_oidc_localpart }}'
+{% if synapse_oidc_display_name is defined %}
+      display_name_template: '{{ synapse_oidc_display_name }}'
+{% endif %}
+
+sso:
+  client_whitelist:
+    - {{ synapse_public_baseurl | default('https://matrix.' + synapse_server_name + '/') }}
+  update_profile_information: True
+{% endif %}
+
+password_config:
+  enabled: {{ ('internal' in synapse_auth or 'ldap' in synapse_auth or 'rest' in synapse_auth) | ternary('True', 'False') }}
+
+alias_creation_rules:
+    - user_id: '*'
+      alias: '*'
+      action: allow
+
+server_notices:
+   system_mxid_localpart: server
+   system_mxid_display_name: "Notification bot"
+...

roles/matrix_synapse/templates/logging.conf.j2

@@ -0,0 +1,31 @@
+
+version: 1
+
+formatters:
+  precise:
+   format: '%(name)s - %(lineno)d - %(levelname)s - %(request)s- %(message)s'
+
+filters:
+  context:
+    (): synapse.util.logcontext.LoggingContextFilter
+    request: ""
+
+handlers:
+  console:
+    class: logging.StreamHandler
+    formatter: precise
+    filters: [context]
+
+loggers:
+    synapse:
+        level: {{ synapse_log_level }}
+
+    synapse.storage.SQL:
+        # beware: increasing this to DEBUG will make synapse log sensitive
+        # information such as access tokens.
+        level: {{ synapse_log_level }}
+
+root:
+    level: {{ synapse_log_level }}
+    handlers: [console]
+

roles/matrix_synapse/templates/matrix-synapse.service.j2

@@ -0,0 +1,29 @@
+[Unit]
+Description=Synapse Matrix homeserver
+
+[Service]
+Type=simple
+User={{ synapse_user }}
+Group={{ synapse_user }}
+Environment=LD_PRELOAD={{ synapse_jemalloc }}
+{% if system_proxy is defined and system_proxy != '' %}
+{% for env in ['http_proxy', 'https_proxy', 'HTTP_PROXY', 'HTTPS_PROXY'] %}
+Environment={{ env }}={{ system_proxy | urlsplit('hostname') }}:{{ system_proxy | urlsplit('port') }}
+{% endfor %}
+{% endif %}
+PermissionsStartOnly=yes
+ExecStart={{ synapse_root_dir }}/venv/bin/python3 -m synapse.app.homeserver -c {{ synapse_root_dir }}/etc/homeserver.yaml -n
+ExecReload=/bin/kill -HUP $MAINPID
+PrivateTmp=yes
+PrivateDevices=yes
+ProtectSystem=full
+ProtectHome=yes
+NoNewPrivileges=yes
+MemoryLimit={{ synapse_max_mem }}M
+SyslogIdentifier=matrix-synapse
+Restart=on-failure
+StartLimitInterval=0
+RestartSec=30
+
+[Install]
+WantedBy=multi-user.target

roles/matrix_synapse/templates/post-backup.sh.j2

@@ -0,0 +1,3 @@
+#!/bin/bash -e
+
+rm -f {{ synapse_root_dir }}/backup/*

roles/matrix_synapse/templates/pre-backup.sh.j2

@@ -0,0 +1,10 @@
+#!/bin/sh
+
+set -eo pipefail
+
+PGPASSWORD='{{ synapse_pg_db_pass }}' /usr/pgsql-14/bin/pg_dump \
+  --clean \
+  --create \
+  --username={{ synapse_pg_db_user }} \
+  --host={{ synapse_pg_db_server }} \
+  {{ synapse_pg_db_name }} | zstd -T0 -c > {{ synapse_root_dir }}/backup/{{ synapse_pg_db_name }}.sql.zst

roles/matrix_synapse/templates/synapse_janitor.sh.j2

@@ -0,0 +1,7 @@
+#!/bin/sh
+
+PGPASSWORD={{ synapse_pg_db_pass }} /usr/bin/psql \
+  --user={{ synapse_pg_db_user }} \
+  --host={{ synapse_pg_db_server }} \
+  --port={{ synapse_pg_db_port }} \
+  {{ synapse_pg_db_name }} < {{ synapse_root_dir }}/res/synapse_janitor.sql

roles/matrix_synapse/vars/RedHat-7.yml

@@ -0,0 +1,29 @@
+---
+
+synapse_packages:
+  - libtiff-devel
+  - libjpeg-devel
+  - libzip-devel
+  - freetype-devel
+  - lcms2-devel
+  - libwebp-devel
+  - tcl-devel
+  - tk-devel
+  - libffi-devel
+  - openssl-devel
+  - libxslt-devel
+  - gcc
+  - gcc-c++
+  - libtool
+  - autoconf
+  - automake
+  - postgresql14
+  - postgresql-devel
+  - libpqxx-devel
+  - jemalloc
+  - python3-virtualenv
+  - python3-pip
+  - python-psycopg2
+  - python-setuptools
+
+synapse_jemalloc: /usr/lib64/libjemalloc.so.1

roles/matrix_synapse/vars/RedHat-8.yml

@@ -0,0 +1,28 @@
+---
+
+synapse_packages:
+  - libtiff-devel
+  - libjpeg-devel
+  - libzip-devel
+  - freetype-devel
+  - lcms2-devel
+  - libwebp-devel
+  - tcl-devel
+  - tk-devel
+  - libffi-devel
+  - openssl-devel
+  - libxslt-devel
+  - gcc
+  - gcc-c++
+  - libtool
+  - autoconf
+  - automake
+  - postgresql14
+  - postgresql-devel
+  - jemalloc
+  - python3-virtualenv
+  - python3-pip
+  - python3-psycopg2
+  - python3-setuptools
+
+synapse_jemalloc: /usr/lib64/libjemalloc.so.2