From 251ce17c233ad10e96926dee4dbca4e5fec2a05f Mon Sep 17 00:00:00 2001 From: Kevin Veen-Birkenbach Date: Sat, 6 Jun 2026 01:10:13 +0200 Subject: [PATCH] feat(web-app-matrix): central coturn + DiD-host-network via MDAD fork MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Switch the ansible flavor over to a forked github.com/kevinveenbirkenbach/matrix-docker-ansible-deploy that supports container_network='host'. Inside the matrix-mdad DiD container, every homeserver-stack service (synapse, element, coturn) runs with --network=host so it shares matrix-mdad's network namespace, which is attached to the outer compose's `postgres` and `openldap` networks. Synapse/bridges therefore resolve `database`, `openldap` via outer Docker DNS — no inner postgres or LDAP needed. meta/services.yml: - upstream.repo -> the fork; ref kept at `master` (the host-network patches live there). The pinned-commit story comes once the fork push lands. - postgres.enabled stays `true` (matrix always needs a DB); postgres.shared becomes `'svc-db-postgres' in group_names` again — central when the DB role is up, dedicated per-app when it isn't. Both paths reach matrix-mdad's NS via the outer Docker daemon's DNS now that we run Synapse on --network=host. - coturn becomes a first-class shared-service toggle: enabled+shared follow `'web-svc-coturn' in group_names`. When the central role is present, MDAD's bundled coturn stays off and Synapse's TURN URIs point at the central coturn (`turn:HOST:STUN_PORT` + tls variant) with the shared static_auth_secret pulled from web-svc-coturn credentials. meta/variants.yml: - V1 (ansible all-on): postgres.shared=true, coturn.shared=true. - V2 (ansible no-auth): postgres.shared=false (dedicated path), coturn off — exercises both polarities for the variant-coverage lint and the dedicated DB code path. - V3 (compose all-on): postgres.shared=true, coturn.shared=true. vars/main.yml: - MATRIX_COTURN_SHARED + MATRIX_COTURN_{HOST,STUN_TURN_PORT,STUN_TURN_TLS_PORT,AUTH_SECRET} lookups (gated on shared so dedicated runs don't try to read credentials that are not in scope). templates/flavor/ansible/vars.yml.j2: - matrix_homeserver_container_network / matrix_synapse_container_network / matrix_client_element_container_network / matrix_coturn_docker_network all pinned to `host`. Hits the fork's `when: var not in ['', 'host']` task guards (no 403 on docker_network create) and the `{% if var not in ['', 'host'] %}` systemd-template guards (no ExecStartPre=docker network connect against an additional bridge, which is invalid on host networking). - When central coturn is shared: matrix_coturn_enabled=false + matrix_synapse_turn_uris (udp/tcp + turns udp/tcp) + matrix_synapse_turn_shared_secret wired to MATRIX_COTURN_AUTH_SECRET. Tests: 186/186 green. Co-Authored-By: Claude Opus 4.7 --- roles/web-app-matrix/meta/services.yml | 12 ++++++++---- roles/web-app-matrix/meta/variants.yml | 15 +++++++++++++++ .../templates/flavor/ansible/vars.yml.j2 | 14 ++++++++++++++ roles/web-app-matrix/vars/main.yml | 6 ++++++ 4 files changed, 43 insertions(+), 4 deletions(-) diff --git a/roles/web-app-matrix/meta/services.yml b/roles/web-app-matrix/meta/services.yml index 99fa5b916a..78277d71ba 100644 --- a/roles/web-app-matrix/meta/services.yml +++ b/roles/web-app-matrix/meta/services.yml @@ -18,10 +18,14 @@ matomo: email: enabled: "{{ 'web-app-mailu' in group_names }}" shared: "{{ 'web-app-mailu' in group_names }}" +# nocheck: playwright-service-flag — TURN/STUN server, no Playwright surface (provider: web-svc-coturn) +coturn: + enabled: "{{ 'web-svc-coturn' in group_names }}" + shared: "{{ 'web-svc-coturn' in group_names }}" # nocheck: playwright-service-flag — DB engine, covered by role-local integration tests postgres: - enabled: true # nocheck: dynamic-flag - shared: true # nocheck: dynamic-flag — matrix requires central postgres for both flavors + enabled: true # nocheck: dynamic-flag — matrix always needs a database + shared: "{{ 'svc-db-postgres' in group_names }}" synapse: version: latest image: matrixdotorg/synapse @@ -76,8 +80,8 @@ prometheus: matrix: flavor: ansible upstream: - repo: https://github.com/spantaleev/matrix-docker-ansible-deploy - ref: 9634cc3f7956e312eaf04647d85cbab46173f2e9 + repo: https://github.com/kevinveenbirkenbach/matrix-docker-ansible-deploy + ref: master migration_validated_version: v2026.05.18.0 runner: image: infinito/web-app-matrix-mdad-runner:1 diff --git a/roles/web-app-matrix/meta/variants.yml b/roles/web-app-matrix/meta/variants.yml index 1427c22fd8..421828475d 100644 --- a/roles/web-app-matrix/meta/variants.yml +++ b/roles/web-app-matrix/meta/variants.yml @@ -2,6 +2,9 @@ - services: matrix: flavor: ansible + coturn: + enabled: true + shared: true css: enabled: true shared: true @@ -20,6 +23,8 @@ matomo: enabled: true shared: true + postgres: + shared: true sso: enabled: true shared: true @@ -30,6 +35,9 @@ - services: matrix: flavor: ansible + coturn: + enabled: false + shared: false css: enabled: false shared: false @@ -48,6 +56,8 @@ matomo: enabled: false shared: false + postgres: + shared: false sso: enabled: false shared: false @@ -58,6 +68,9 @@ - services: matrix: flavor: compose + coturn: + enabled: true + shared: true css: enabled: true shared: true @@ -76,6 +89,8 @@ matomo: enabled: true shared: true + postgres: + shared: true sso: enabled: true shared: true diff --git a/roles/web-app-matrix/templates/flavor/ansible/vars.yml.j2 b/roles/web-app-matrix/templates/flavor/ansible/vars.yml.j2 index 4af87d21a0..3d73c33ac5 100644 --- a/roles/web-app-matrix/templates/flavor/ansible/vars.yml.j2 +++ b/roles/web-app-matrix/templates/flavor/ansible/vars.yml.j2 @@ -22,7 +22,21 @@ matrix_synapse_database_user: "{{ MATRIX_POSTGRES_USER }}" matrix_synapse_database_password: "{{ MATRIX_POSTGRES_PASSWORD }}" matrix_synapse_database_database: "{{ MATRIX_POSTGRES_DATABASE }}" +matrix_homeserver_container_network: host matrix_synapse_container_network: host +matrix_client_element_container_network: host +matrix_coturn_docker_network: host + +{% if MATRIX_COTURN_SHARED %} +matrix_coturn_enabled: false +matrix_synapse_turn_uris: + - "turn:{{ MATRIX_COTURN_HOST }}:{{ MATRIX_COTURN_STUN_TURN_PORT }}?transport=udp" + - "turn:{{ MATRIX_COTURN_HOST }}:{{ MATRIX_COTURN_STUN_TURN_PORT }}?transport=tcp" + - "turns:{{ MATRIX_COTURN_HOST }}:{{ MATRIX_COTURN_STUN_TURN_TLS_PORT }}?transport=udp" + - "turns:{{ MATRIX_COTURN_HOST }}:{{ MATRIX_COTURN_STUN_TURN_TLS_PORT }}?transport=tcp" +matrix_synapse_turn_shared_secret: "{{ MATRIX_COTURN_AUTH_SECRET }}" +{% endif %} + matrix_synapse_container_client_api_host_bind_port: "0.0.0.0:{{ MATRIX_SYNAPSE_PORT }}" matrix_synapse_container_federation_api_plain_host_bind_port: "0.0.0.0:{{ MATRIX_FEDERATION_PORT }}" matrix_client_element_container_http_host_bind_port: "0.0.0.0:{{ MATRIX_ELEMENT_PORT }}" diff --git a/roles/web-app-matrix/vars/main.yml b/roles/web-app-matrix/vars/main.yml index 18db30f3e3..b9ef6187d7 100644 --- a/roles/web-app-matrix/vars/main.yml +++ b/roles/web-app-matrix/vars/main.yml @@ -61,6 +61,12 @@ MATRIX_POSTGRES_USER: "{{ lookup('database', application_id, 'username') }}" MATRIX_POSTGRES_PASSWORD: "{{ lookup('database', application_id, 'password') }}" MATRIX_POSTGRES_DATABASE: "{{ lookup('database', application_id, 'name') }}" +MATRIX_COTURN_SHARED: "{{ lookup('config', application_id, 'services.coturn.shared') | bool }}" +MATRIX_COTURN_HOST: "{{ lookup('domain', 'web-svc-coturn') if MATRIX_COTURN_SHARED else '' }}" +MATRIX_COTURN_STUN_TURN_PORT: "{{ lookup('config', 'web-svc-coturn', 'services.coturn.ports.public.stun_turn') if MATRIX_COTURN_SHARED else '' }}" +MATRIX_COTURN_STUN_TURN_TLS_PORT: "{{ lookup('config', 'web-svc-coturn', 'services.coturn.ports.public.stun_turn_tls') if MATRIX_COTURN_SHARED else '' }}" +MATRIX_COTURN_AUTH_SECRET: "{{ lookup('config', 'web-svc-coturn', 'credentials.auth_secret') if MATRIX_COTURN_SHARED else '' }}" + MATRIX_OUTBOUND_MAIL_ENABLED: "{{ lookup('config', application_id, 'services.email.enabled') | bool }}" MATRIX_OUTBOUND_MAIL: "{{ lookup('email', application_id) if MATRIX_OUTBOUND_MAIL_ENABLED else {} }}" MATRIX_OUTBOUND_MAIL_HOST: "{{ MATRIX_OUTBOUND_MAIL.host | default('') }}"