mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 10:59:59 +00:00
kevinveenbirkenbachandClaude Opus 5.5
4a56b4c19c
Element v1.12.33 (automated bumpa8fba45d60, on main) ships element-web #35364, which turns force_verification on by default. From the second OIDC login of an account on, Element stops on "Confirm your digital identity" with no skip button, so the Matrix SSO specs that log the same account in twice (test-dm-admin-biber.js, test-design.js) never reach the signed-in UI: "administrator: authenticated Element UI (user menu / room list / welcome) must render" fails after 120 s (fork run 40625679270, Matrix#2 and the co-deployed Moodle#2). services.element.force_verification now carries the platform default, true as upstream, and both flavors render it (the compose element config and the MDAD element configuration extension). Only variants 0 and 2, the SSO rounds, set it to false. Production keeps forced verification. Cherry-picked frome042c9dbf9on feature/store-i18n. main has no Element branding block yet, so the MDAD flavor carries only the force_verification key in its configuration extension. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
135 lines
10 KiB
YAML
135 lines
10 KiB
YAML
---
|
|
application_id: "web-app-matrix"
|
|
|
|
compose_mode_force: "{{ 'compose' if lookup('config', application_id, 'services.matrix.flavor', 'ansible') == 'ansible' else '' }}"
|
|
|
|
location_upload: "~ ^/_matrix/media/v3/"
|
|
|
|
MATRIX_ONION_NODE: "{{ lookup('config', 'svc-net-tor', 'services.tor.node', '') }}"
|
|
MATRIX_SERVER_NAME: "{{ MATRIX_ONION_NODE if (MATRIX_ONION_NODE and lookup('domain', application_id) is search('\\.onion$')) else lookup('config', application_id,
|
|
'services.matrix.server_name') }}"
|
|
MATRIX_ADMINISTRATOR_USERNAME: "{{ lookup('users', 'administrator').username }}"
|
|
MATRIX_ADMINISTRATOR_PASSWORD: "{{ lookup('users', 'administrator').password }}"
|
|
MATRIX_WELL_KNOWN_DIRECTORY: "{{ [ lookup('nginx','directories.data.well_known'), MATRIX_SERVER_NAME, 'matrix' ] | path_join }}"
|
|
MATRIX_WELL_KNOWN_FILE: "{{ [ MATRIX_WELL_KNOWN_DIRECTORY, 'server' ] | path_join }}"
|
|
MATRIX_REGISTRATION_FILE_FOLDER: "/registrations/"
|
|
MATRIX_BRIDGE_SOURCE_DIR: "{{ [ lookup('container', application_id, 'directories.config'), 'mautrix' ] | path_join }}"
|
|
MATRIX_BRIDGE_CONFIG_TARGET: "/config/config.yaml"
|
|
MATRIX_REGISTRATION_SHARED_SECRET: "{{ lookup('config', application_id, 'secrets.credentials.registration_shared_secret') }}"
|
|
MATRIX_FEDERATION_PORT: "{{ lookup('config', 'web-app-matrix', 'services.synapse.ports.public.federation') }}"
|
|
MATRIX_OIDC_ENABLED: "{{ lookup('config', application_id, 'services.sso.enabled') }}"
|
|
MATRIX_OIDC_HOST: "{{ lookup('tls', 'web-app-keycloak', 'domain') }}"
|
|
MATRIX_OIDC_HOST_IS_ONION: "{{ MATRIX_OIDC_HOST is search('\\.onion$') }}"
|
|
MATRIX_BASE_URL: "{{ lookup('tls', application_id, 'protocols.web') }}://{{ DOMAIN_PRIMARY }}"
|
|
|
|
MATRIX_LITELLM_ENABLED: "{{ lookup('config', application_id, 'services.litellm.enabled') | bool }}"
|
|
MATRIX_CHATGPT_BRIDGE_ENDPOINT: "{{ (LITELLM_OPENAI_BASE_LOCAL_URL ~ '/chat/completions') if (MATRIX_LITELLM_ENABLED | bool) else 'https://api.openai.com/v1/chat/completions'
|
|
}}"
|
|
MATRIX_CHATGPT_BRIDGE_MODEL: "{{ LITELLM_CHAT_MODEL if (MATRIX_LITELLM_ENABLED | bool) else 'gpt-3.5-turbo' }}"
|
|
MATRIX_CHATGPT_BRIDGE_API_KEY: "{{ lookup('config', application_id, 'secrets.credentials.litellm_api_key') if (MATRIX_LITELLM_ENABLED | bool) else lookup('config',
|
|
application_id, 'secrets.credentials.chatgpt_bridge_openai_api_key') }}"
|
|
|
|
MATRIX_SYNAPSE_NAME: "{{ lookup('config', application_id, 'services.synapse.name') }}"
|
|
MATRIX_SYNAPSE_SERVICE: "{{ lookup('container_service', application_id, 'synapse') }}"
|
|
MATRIX_SYNAPSE_CONTAINER_ADDRESS: "{{ lookup('container_address', application_id, 'synapse') }}"
|
|
MATRIX_SYNAPSE_VOLUME: "{{ lookup('volume', application_id, 'synapse_data').name }}"
|
|
MATRIX_SYNAPSE_UID: 991
|
|
MATRIX_SYNAPSE_GID: 991
|
|
MATRIX_MDAD_SERVICE_KEY: "matrix"
|
|
MATRIX_MDAD_CONTAINER: "{{ application_id | get_entity_name }}"
|
|
MATRIX_MDAD_CONTAINER_ADDRESS: "{{ lookup('container_address', application_id, MATRIX_MDAD_SERVICE_KEY) }}"
|
|
MATRIX_SYNAPSE_DOMAIN: "{{ lookup('domains', application_id).synapse }}"
|
|
MATRIX_SYNAPSE_PORT: "{{ lookup('config', 'web-app-matrix', 'services.synapse.ports.local.http') }}"
|
|
MATRIX_SYNAPSE_CONTAINER_PORT: "{{ lookup('config', application_id, 'services.synapse.ports.internal.http') }}"
|
|
MATRIX_SYNAPSE_CONFIG_PATH_HOST: "{{ [ lookup('container', application_id, 'directories.config'), 'homeserver.yaml' ] | path_join }}"
|
|
MATRIX_SYNAPSE_CONFIG_PATH_CONTAINER: "{{ lookup('volume', 'web-app-matrix', 'synapse_config').target }}" # nocheck: container-var-name-lookup in-container path, not a container name
|
|
MATRIX_SYNAPSE_LOG_PATH_HOST: "{{ [ lookup('container', application_id, 'directories.config'), MATRIX_SYNAPSE_DOMAIN ~'.log.config' ] | path_join }}"
|
|
MATRIX_SYNAPSE_LOG_PATH_CONTAINER: "/data/{{ MATRIX_SYNAPSE_DOMAIN }}.log.config" # nocheck: container-var-name-lookup in-container path, not a container name
|
|
MATRIX_SYNAPSE_BIND_MOUNT_MODE: "0644"
|
|
MATRIX_SYNAPSE_URL: "{{ lookup('canonical_url', application_id, 'synapse') }}"
|
|
MATRIX_SYNAPSE_LOCAL_URL: "http://{{ MATRIX_SYNAPSE_SERVICE }}:{{ MATRIX_SYNAPSE_CONTAINER_PORT }}"
|
|
MATRIX_SYNAPSE_LOGIN_BURST: 30
|
|
MATRIX_CHATGPT_ACCESS_TOKEN: "{{ lookup('config', application_id, 'secrets.credentials.chatgpt_bridge_access_token', '') }}"
|
|
MATRIX_CHATGPT_ENCRYPTION: "false"
|
|
MATRIX_SYNAPSE_LISTEN_FLAGS: "{{ MATRIX_FEDERATION_PORT }} {{ 'ssl ' if (lookup('tls', application_id, 'enabled') | bool) else '' }} default_server"
|
|
|
|
MATRIX_ELEMENT_NAME: "{{ lookup('config', application_id, 'services.element.name') }}"
|
|
MATRIX_ELEMENT_DOMAIN: "{{ lookup('domains', application_id).element }}"
|
|
MATRIX_ELEMENT_PORT: "{{ lookup('config', 'web-app-matrix', 'services.element.ports.local.http') }}"
|
|
MATRIX_ELEMENT_CONTAINER_PORT: "{{ lookup('config', application_id, 'services.element.ports.internal.http') }}"
|
|
MATRIX_ELEMENT_CONFIG_PATH_HOST: "{{ [ lookup('container', application_id, 'directories.config'), 'element-config.json' ] | path_join }}"
|
|
MATRIX_ELEMENT_FORCE_VERIFICATION: "{{ lookup('config', application_id, 'services.element.force_verification') | bool }}"
|
|
|
|
MATRIX_MDAD_DIR: "{{ lookup('container', application_id, 'directories.instance') }}mdad"
|
|
MATRIX_MDAD_RUNNER_BUILD_DIR: "{{ [ lookup('container', application_id, 'directories.instance'), 'runner' ] | path_join }}"
|
|
MATRIX_MDAD_PLAYBOOK_TAGS: "{{ lookup('config', application_id, 'services.matrix.playbook_tags') }}"
|
|
MATRIX_MDAD_MIGRATION_VALIDATED_VERSION: "{{ lookup('config', application_id, 'services.matrix.upstream.migration_validated_version') }}"
|
|
MATRIX_MDAD_RUNNER_IMAGE: "{{ lookup('config', application_id, 'services.matrix.runner.image') }}"
|
|
MATRIX_MDAD_RUNNER_BASE_IMAGE: "{{ lookup('config', application_id, 'services.matrix.runner.base_image') }}"
|
|
MATRIX_MDAD_RUNNER_BASE_VERSION: "{{ lookup('config', application_id, 'services.matrix.runner.base_version') }}"
|
|
MATRIX_MDAD_RUNNER_DOCKER_CLI_IMAGE: "{{ lookup('config', application_id, 'services.matrix.runner.docker_cli_image') }}"
|
|
MATRIX_MDAD_RUNNER_DOCKER_CLI_VERSION: "{{ lookup('config', application_id, 'services.matrix.runner.docker_cli_version') }}"
|
|
MATRIX_MDAD_DAEMON_JSON:
|
|
bip: "{{ NETWORK_NESTED_DOCKER_BIP }}"
|
|
default-address-pools: "{{ NETWORK_NESTED_DOCKER_ADDRESS_POOLS }}"
|
|
exec-opts: ["native.cgroupdriver=systemd"]
|
|
iptables: true
|
|
log-driver: "json-file"
|
|
log-opts:
|
|
max-size: "10m"
|
|
max-file: "3"
|
|
MATRIX_MDAD_REGISTRY_PROXY: "{{ matrix_mdad_registry_proxy_probe.stdout | from_json }}"
|
|
MATRIX_MDAD_REGISTRY_PROXY_DROPIN: "{{ [ MATRIX_MDAD_RUNNER_BUILD_DIR, 'registry-cache-proxy.conf' ] | path_join }}"
|
|
MATRIX_MDAD_REGISTRY_CA_PATH: "/usr/local/share/ca-certificates/infinito-registry-cache.crt"
|
|
|
|
MATRIX_BRIDGE: "{{ lookup('config', application_id, 'services.matrix.plugins') }}"
|
|
|
|
MATRIX_ONION_PRIMARY: "{{ (MATRIX_ONION_NODE | length > 0) and (lookup('domain', application_id) is search('\\.onion$')) }}"
|
|
MATRIX_JITSI_ENABLED: "{{ lookup('config', application_id, 'services.jitsi.enabled') | bool and lookup('config', application_id, 'services.matrix.flavor') == 'ansible'
|
|
and not MATRIX_ONION_PRIMARY }}"
|
|
MATRIX_JITSI_SHARED: "{{ MATRIX_JITSI_ENABLED and lookup('config', application_id, 'services.jitsi.shared') | bool }}"
|
|
MATRIX_JITSI_INTERNAL: "{{ MATRIX_JITSI_ENABLED and not MATRIX_JITSI_SHARED }}"
|
|
MATRIX_JITSI_DOMAIN: "{{ lookup('domain', 'web-app-jitsi') if MATRIX_JITSI_SHARED else lookup('domains', application_id).jitsi }}"
|
|
MATRIX_JITSI_PORT: "{{ lookup('config', application_id, 'services.jitsi.ports.local.http') }}"
|
|
MATRIX_JITSI_CONTAINER_PORT: "{{ lookup('config', application_id, 'services.jitsi.ports.internal.http') }}"
|
|
MATRIX_JITSI_MEDIA_PORT: "{{ lookup('config', application_id, 'services.jitsi.ports.public.media') }}"
|
|
MATRIX_JITSI_COMPONENT_ACCOUNTS:
|
|
- user: focus
|
|
password: "{{ (lookup('config', application_id, 'secrets.credentials.macaroon_secret_key') ~ ':jicofo') | hash('sha256') }}"
|
|
- user: jvb
|
|
password: "{{ (lookup('config', application_id, 'secrets.credentials.macaroon_secret_key') ~ ':jvb') | hash('sha256') }}"
|
|
|
|
MATRIX_CONFERENCING_ELEMENT_CALL: "{{ lookup('config', application_id, 'services.matrix.conferencing.element_call') | bool and not MATRIX_ONION_PRIMARY }}"
|
|
MATRIX_LIVEKIT_PORT: "{{ lookup('config', application_id, 'services.livekit.ports.local.websocket') }}"
|
|
MATRIX_LIVEKIT_CONTAINER_PORT: "{{ lookup('config', application_id, 'services.livekit.ports.internal.websocket') }}"
|
|
MATRIX_LIVEKIT_MEDIA_PORT: "{{ lookup('config', application_id, 'services.livekit.ports.public.media') }}"
|
|
MATRIX_LIVEKIT_PATH: "/livekit-server"
|
|
MATRIX_LIVEKIT_JWT_PATH: "/livekit-jwt-service"
|
|
MATRIX_LIVEKIT_JWT_PORT: "{{ lookup('config', application_id, 'services.livekit_jwt.ports.local.http') }}"
|
|
MATRIX_LIVEKIT_JWT_CONTAINER_PORT: "{{ lookup('config', application_id, 'services.livekit_jwt.ports.internal.http') }}"
|
|
MATRIX_SYNAPSE_METRICS_PORT: "{{ lookup('config', application_id, 'services.prometheus.native_metrics.port') }}"
|
|
|
|
MATRIX_LDAP_ENABLED: "{{ lookup('config', application_id, 'services.ldap.enabled') | bool }}"
|
|
|
|
MATRIX_CA_INJECTED: "{{ lookup('ca_injected', application_id) | bool }}"
|
|
MATRIX_CA_MOUNT_PATH: "{{ CA_TRUST.cert_container }}"
|
|
|
|
MATRIX_POSTGRES_HOST: "{{ lookup('database', application_id, 'host') }}"
|
|
MATRIX_POSTGRES_PORT: "{{ lookup('database', application_id, 'port') }}"
|
|
MATRIX_POSTGRES_USER: "{{ lookup('database', application_id, 'username') }}"
|
|
MATRIX_POSTGRES_PASSWORD: "{{ lookup('database', application_id, 'password') }}"
|
|
MATRIX_POSTGRES_DATABASE: "{{ lookup('database', application_id, 'name') }}"
|
|
|
|
MATRIX_COTURN_SHARED: "{{ lookup('config', application_id, 'services.coturn.shared') | bool }}"
|
|
MATRIX_COTURN_HOST: "{{ lookup('domain', 'web-svc-coturn') if MATRIX_COTURN_SHARED else '' }}"
|
|
MATRIX_COTURN_STUN_TURN_PORT: "{{ lookup('config', 'web-svc-coturn', 'services.coturn.ports.public.stun_turn') if MATRIX_COTURN_SHARED else '' }}"
|
|
MATRIX_COTURN_STUN_TURN_TLS_PORT: "{{ lookup('config', 'web-svc-coturn', 'services.coturn.ports.public.stun_turn_tls') if MATRIX_COTURN_SHARED else '' }}"
|
|
MATRIX_COTURN_AUTH_SECRET: "{{ lookup('config', 'web-svc-coturn', 'secrets.credentials.auth_secret') if MATRIX_COTURN_SHARED else '' }}"
|
|
|
|
MATRIX_OUTBOUND_MAIL_ENABLED: "{{ lookup('config', application_id, 'services.email.enabled') | bool }}"
|
|
MATRIX_OUTBOUND_MAIL: "{{ lookup('email', application_id) if MATRIX_OUTBOUND_MAIL_ENABLED else {} }}"
|
|
MATRIX_OUTBOUND_MAIL_HOST: "{{ MATRIX_OUTBOUND_MAIL.host | default('') }}"
|
|
MATRIX_OUTBOUND_MAIL_PORT: "{{ MATRIX_OUTBOUND_MAIL.port | default(587) }}"
|
|
MATRIX_OUTBOUND_MAIL_USER: "{{ MATRIX_OUTBOUND_MAIL.username | default('') }}"
|
|
MATRIX_OUTBOUND_MAIL_PASS: "{{ MATRIX_OUTBOUND_MAIL.password | default('') }}"
|