main.yml

---
application_id: "web-app-matrix"

compose_mode_force: "{{ 'compose' if lookup('config', application_id, 'services.matrix.flavor', 'ansible') == 'ansible' else '' }}"

location_upload: "~ ^/_matrix/media/v3/"

MATRIX_ONION_NODE: "{{ lookup('config', 'svc-net-tor', 'services.tor.node', '') }}"
MATRIX_ONION_PRIMARY: "{{ (MATRIX_ONION_NODE | length > 0) and (lookup('domain', application_id) is search('\\.onion$')) }}"
MATRIX_SERVER_NAME: "{{ lookup('matrix_server_name') }}"
MATRIX_ADMINISTRATOR_USERNAME: "{{ lookup('users', 'platform_administrator').username }}"
MATRIX_ADMINISTRATOR_PASSWORD: "{{ lookup('users', 'platform_administrator').password }}"
MATRIX_WELL_KNOWN_DIRECTORY: "{{ [ lookup('nginx','directories.data.well_known'), MATRIX_SERVER_NAME, 'matrix' ] | path_join }}"
MATRIX_WELL_KNOWN_FILE: "{{ [ MATRIX_WELL_KNOWN_DIRECTORY, 'server' ] | path_join }}"
MATRIX_REGISTRATION_FILE_FOLDER: "/registrations/"
MATRIX_BRIDGE_SOURCE_DIR: "{{ [ lookup('container', application_id, 'directories.config'), 'mautrix' ] | path_join }}"
MATRIX_BRIDGE_CONFIG_TARGET: "/config/config.yaml"
MATRIX_REGISTRATION_SHARED_SECRET: "{{ lookup('config', application_id, 'secrets.credentials.registration_shared_secret') }}"
MATRIX_FEDERATION_PORT: "{{ lookup('config', 'web-app-matrix', 'services.synapse.ports.public.federation') }}"
MATRIX_OIDC_ENABLED: "{{ lookup('config', application_id, 'services.sso.enabled') }}"
MATRIX_OIDC_HOST: "{{ lookup('tls', 'web-app-keycloak', 'domain') }}"
MATRIX_OIDC_HOST_IS_ONION: "{{ (MATRIX_OIDC_HOST | network_of) == 'tor' }}"
MATRIX_BASE_URL: "{{ lookup('tls', application_id, 'protocols.web') }}://{{ DOMAIN_PRIMARY }}"

MATRIX_LITELLM_ENABLED: "{{ lookup('config', application_id, 'services.litellm.enabled') | bool }}"
MATRIX_CHATGPT_BRIDGE_ENDPOINT: "{{ (LITELLM_OPENAI_BASE_LOCAL_URL ~ '/chat/completions') if (MATRIX_LITELLM_ENABLED | bool) else 'https://api.openai.com/v1/chat/completions'
  }}"
MATRIX_CHATGPT_BRIDGE_MODEL: "{{ LITELLM_CHAT_MODEL if (MATRIX_LITELLM_ENABLED | bool) else 'gpt-3.5-turbo' }}"
MATRIX_CHATGPT_BRIDGE_API_KEY: "{{ lookup('config', application_id, 'secrets.credentials.litellm_api_key') if (MATRIX_LITELLM_ENABLED | bool) else lookup('config',
  application_id, 'secrets.credentials.chatgpt_bridge_openai_api_key') }}"

MATRIX_SYNAPSE_NAME: "{{ lookup('config', application_id, 'services.synapse.name') }}"
MATRIX_SYNAPSE_IMAGE: "{{ lookup('config', application_id, 'services.synapse.image') }}:{{ lookup('config', application_id, 'services.synapse.version') }}"
MATRIX_SYNAPSE_SERVICE: "{{ lookup('container_service', application_id, 'synapse') }}"
MATRIX_SYNAPSE_CONTAINER_ADDRESS: "{{ lookup('container_address', application_id, 'synapse') }}"
MATRIX_SYNAPSE_VOLUME: "{{ lookup('volume', application_id, 'synapse_data').name }}"
MATRIX_SYNAPSE_UID: 991
MATRIX_SYNAPSE_GID: 991
MATRIX_MDAD_SERVICE_KEY: "matrix"
MATRIX_MDAD_CONTAINER: "{{ application_id | entity_name }}"
MATRIX_MDAD_CONTAINER_ADDRESS: "{{ lookup('container_address', application_id, MATRIX_MDAD_SERVICE_KEY) }}"
MATRIX_SYNAPSE_DOMAIN: "{{ lookup('domains', application_id).synapse }}"
MATRIX_SYNAPSE_PORT: "{{ lookup('config', 'web-app-matrix', 'services.synapse.ports.local.http') }}"
MATRIX_SYNAPSE_CONTAINER_PORT: "{{ lookup('config', application_id, 'services.synapse.ports.internal.http') }}"
MATRIX_SYNAPSE_CONFIG_PATH_HOST: "{{ [ lookup('container', application_id, 'directories.config'), 'homeserver.yaml' ] | path_join }}"
MATRIX_SYNAPSE_CONFIG_PATH_CONTAINER: "{{ lookup('volume', 'web-app-matrix', 'synapse_config').target }}" # nocheck: container-var-name-lookup in-container path, not a container name
MATRIX_SYNAPSE_LOG_PATH_HOST: "{{ [ lookup('container', application_id, 'directories.config'), MATRIX_SYNAPSE_DOMAIN ~'.log.config' ] | path_join }}"
MATRIX_SYNAPSE_LOG_PATH_CONTAINER: "/data/{{ MATRIX_SYNAPSE_DOMAIN }}.log.config" # nocheck: container-var-name-lookup in-container path, not a container name
MATRIX_SYNAPSE_BIND_MOUNT_MODE: "0644"
MATRIX_SYNAPSE_URL: "{{ lookup('canonical_url', application_id, 'synapse') }}"
MATRIX_SYNAPSE_LOCAL_URL: "http://{{ MATRIX_SYNAPSE_SERVICE }}:{{ MATRIX_SYNAPSE_CONTAINER_PORT }}"
MATRIX_SYNAPSE_LOGIN_BURST: 30
MATRIX_CHATGPT_ACCESS_TOKEN: "{{ lookup('config', application_id, 'secrets.credentials.chatgpt_bridge_access_token', '') }}"
MATRIX_CHATGPT_ENCRYPTION: "false"
MATRIX_SYNAPSE_LISTEN_FLAGS: "{{ MATRIX_FEDERATION_PORT }} {{ 'ssl ' if (lookup('tls', application_id, 'enabled') | bool) else '' }} default_server"

MATRIX_ELEMENT_NAME: "{{ lookup('config', application_id, 'services.element.name') }}"
MATRIX_ELEMENT_DOMAIN: "{{ lookup('domains', application_id).element }}"
MATRIX_ELEMENT_PORT: "{{ lookup('config', 'web-app-matrix', 'services.element.ports.local.http') }}"
MATRIX_ELEMENT_CONTAINER_PORT: "{{ lookup('config', application_id, 'services.element.ports.internal.http') }}"
MATRIX_ELEMENT_CONFIG_PATH_HOST: "{{ [ lookup('container', application_id, 'directories.config'), 'element-config.json' ] | path_join }}"
MATRIX_ELEMENT_FORCE_VERIFICATION: "{{ lookup('config', application_id, 'services.element.force_verification') | bool }}"

MATRIX_DESIGN_ENABLED: "{{ lookup('config', application_id, 'services.design.enabled') | bool }}"
MATRIX_DESIGN_TITLE: "{{ (lookup('design', application_id).title or '') if MATRIX_DESIGN_ENABLED | bool else '' }}"
MATRIX_DESIGN_LOGO_URL: "{{ lookup('design', application_id).urls.logo.svg if (MATRIX_DESIGN_ENABLED | bool and lookup('design', application_id).logo is string) else
  '' }}"

MATRIX_MDAD_DIR: "{{ lookup('container', application_id, 'directories.instance') }}mdad"
MATRIX_MDAD_RUNNER_BUILD_DIR: "{{ [ lookup('container', application_id, 'directories.instance'), 'runner' ] | path_join }}"
MATRIX_MDAD_REGISTRY_PROXY: "{{ matrix_mdad_registry_proxy_probe.stdout | from_json }}"
MATRIX_MDAD_REGISTRY_PROXY_DROPIN: "{{ [ MATRIX_MDAD_RUNNER_BUILD_DIR, 'registry-cache-proxy.conf' ] | path_join }}"
MATRIX_MDAD_REGISTRY_CA_PATH: "/usr/local/share/ca-certificates/infinito-registry-cache.crt"
MATRIX_MDAD_PLAYBOOK_TAGS: "{{ lookup('config', application_id, 'services.matrix.playbook_tags') }}"
MATRIX_MDAD_MIGRATION_VALIDATED_VERSION: "{{ lookup('config', application_id, 'services.matrix.upstream.migration_validated_version') }}"
MATRIX_MDAD_RUNNER_IMAGE: "{{ lookup('config', application_id, 'services.matrix.runner.image') }}"
MATRIX_MDAD_RUNNER_BASE_IMAGE: "{{ lookup('config', application_id, 'services.matrix.runner.base_image') }}"
MATRIX_MDAD_RUNNER_BASE_VERSION: "{{ lookup('config', application_id, 'services.matrix.runner.base_version') }}"
MATRIX_MDAD_RUNNER_DOCKER_CLI_IMAGE: "{{ lookup('config', application_id, 'services.matrix.runner.docker_cli_image') }}"
MATRIX_MDAD_RUNNER_DOCKER_CLI_VERSION: "{{ lookup('config', application_id, 'services.matrix.runner.docker_cli_version') }}"
MATRIX_MDAD_DAEMON_JSON:
  bip: "{{ NETWORK_NESTED_DOCKER_BIP }}"
  default-address-pools: "{{ NETWORK_NESTED_DOCKER_ADDRESS_POOLS }}"
  exec-opts: ["native.cgroupdriver=systemd"]
  iptables: true
  log-driver: "json-file"
  log-opts:
    max-size: "10m"
    max-file: "3"
  default-ulimits:
    nofile:
      Name: nofile
      Soft: 1048576
      Hard: 1048576

MATRIX_TELEGRAM_USABLE: >-
  {{ (lookup('config', application_id, 'secrets.credentials.mautrix_telgegram_bridge_api_id', '') | string | trim | length > 0)
     and (lookup('config', application_id, 'secrets.credentials.mautrix_telgegram_bridge_api_pin', '') | string | trim | length > 0) }}

MATRIX_BRIDGE_ADDONS_DECLARED: "{{ lookup('config', application_id, 'addons') | dict2items | selectattr('value.mechanism', 'equalto', 'bridge') | selectattr('value.config.bridge_name',
  'defined') | list }}"

MATRIX_BRIDGE_ADDONS: >-
  {{ MATRIX_BRIDGE_ADDONS_DECLARED if MATRIX_TELEGRAM_USABLE | bool
     else (MATRIX_BRIDGE_ADDONS_DECLARED | rejectattr('value.config.bridge_name', 'equalto', 'telegram') | list) }}
MATRIX_BRIDGE: "{{ lookup('config', application_id, 'services.matrix.plugins') | combine(dict(MATRIX_BRIDGE_ADDONS | map(attribute='value.config.bridge_name') | map('regex_replace',
  '^', 'mautrix_') | zip(MATRIX_BRIDGE_ADDONS | map(attribute='value.enabled')))) }}"

MATRIX_JITSI_ENABLED: "{{ lookup('config', application_id, 'services.jitsi.enabled') | bool and lookup('config', application_id, 'services.matrix.flavor') == 'ansible'
  and not MATRIX_ONION_PRIMARY }}"
MATRIX_JITSI_SHARED: "{{ MATRIX_JITSI_ENABLED and lookup('config', application_id, 'services.jitsi.shared') | bool }}"
MATRIX_JITSI_INTERNAL: "{{ MATRIX_JITSI_ENABLED and not MATRIX_JITSI_SHARED }}"
MATRIX_JITSI_DOMAIN: "{{ lookup('domain', 'web-app-jitsi') if MATRIX_JITSI_SHARED else lookup('domains', application_id).jitsi }}"
MATRIX_JITSI_PORT: "{{ lookup('config', application_id, 'services.jitsi.ports.local.http') }}"
MATRIX_JITSI_CONTAINER_PORT: "{{ lookup('config', application_id, 'services.jitsi.ports.internal.http') }}"
MATRIX_JITSI_MEDIA_PORT: "{{ lookup('config', application_id, 'services.jitsi.ports.public.media') }}"
MATRIX_JITSI_COMPONENT_ACCOUNTS:
  - user: focus
    password: "{{ (lookup('config', application_id, 'secrets.credentials.macaroon_secret_key') ~ ':jicofo') | hash('sha256') }}"
  - user: jvb
    password: "{{ (lookup('config', application_id, 'secrets.credentials.macaroon_secret_key') ~ ':jvb') | hash('sha256') }}"

MATRIX_CONFERENCING_ELEMENT_CALL: "{{ lookup('config', application_id, 'services.matrix.conferencing.element_call') | bool and not MATRIX_ONION_PRIMARY }}"
MATRIX_LIVEKIT_PORT: "{{ lookup('config', application_id, 'services.livekit.ports.local.websocket') }}"
MATRIX_LIVEKIT_CONTAINER_PORT: "{{ lookup('config', application_id, 'services.livekit.ports.internal.websocket') }}"
MATRIX_LIVEKIT_MEDIA_PORT: "{{ lookup('config', application_id, 'services.livekit.ports.public.media') }}"
MATRIX_LIVEKIT_PATH: "/livekit-server"
MATRIX_LIVEKIT_JWT_PATH: "/livekit-jwt-service"
MATRIX_LIVEKIT_JWT_PORT: "{{ lookup('config', application_id, 'services.livekit_jwt.ports.local.http') }}"
MATRIX_LIVEKIT_JWT_CONTAINER_PORT: "{{ lookup('config', application_id, 'services.livekit_jwt.ports.internal.http') }}"
MATRIX_SYNAPSE_METRICS_PORT: "{{ lookup('config', application_id, 'services.prometheus.native_metrics.port') }}"

MATRIX_ADDON_BAIBOT_ENABLED: "{{ lookup('config', application_id, 'addons.baibot.enabled') | bool }}"
MATRIX_ADDON_BAIBOT_LOCALPART: "{{ lookup('config', application_id, 'addons.baibot.config.user_localpart') }}"
MATRIX_ADDON_BAIBOT_PASSWORD: "{{ lookup('config', application_id, 'addons.baibot.config.user_password') }}"
MATRIX_ADDON_BAIBOT_AGENT_ID: "{{ lookup('config', application_id, 'addons.baibot.config.agent_id') }}"
MATRIX_ADDON_SYNAPSE_USAGE_EXPORTER_ENABLED: "{{ (lookup('config', application_id, 'addons.synapse-usage-exporter.enabled') | bool) and (HOST_ARCHITECTURE_BY_KERNEL[hostvars[STACK_HOST].ansible_facts['architecture']]
  in lookup('config', application_id, 'addons.synapse-usage-exporter.architectures')) }}"
MATRIX_ADDON_SYNAPSE_USAGE_EXPORTER_NOFILE: "{{ lookup('config', application_id, 'addons.synapse-usage-exporter.config.nofile') }}"

MATRIX_ADDON_HOOKSHOT_GITLAB_ENABLED: "{{ lookup('config', application_id, 'addons.hookshot-gitlab.enabled') | bool }}"
MATRIX_ADDON_HOOKSHOT_JIRA_ENABLED: "{{ lookup('config', application_id, 'addons.hookshot-jira.enabled') | bool }}"
MATRIX_ADDON_HOOKSHOT_WEBHOOKS_ENABLED: "{{ lookup('config', application_id, 'addons.hookshot-webhooks.enabled') | bool }}"
MATRIX_ADDON_HOOKSHOT_FEEDS_ENABLED: "{{ lookup('config', application_id, 'addons.hookshot-feeds.enabled') | bool }}"
MATRIX_ADDON_JITSI_ENABLED: "{{ lookup('config', application_id, 'addons.jitsi.enabled') | bool }}"
MATRIX_ADDON_JITSI_PREFERRED_DOMAIN: "{{ lookup('config', application_id, 'addons.jitsi.config.preferred_domain') }}"

MATRIX_LDAP_ENABLED: "{{ lookup('config', application_id, 'services.ldap.enabled') | bool }}"

MATRIX_CA_INJECTED: "{{ lookup('ca_injected', application_id) | bool }}"
MATRIX_CA_MOUNT_PATH: "{{ CA_TRUST.cert_container }}"

MATRIX_POSTGRES_HOST: "{{ lookup('database', application_id, 'host') }}"
MATRIX_POSTGRES_PORT: "{{ lookup('database', application_id, 'port') }}"
MATRIX_POSTGRES_USER: "{{ lookup('database', application_id, 'username') }}"
MATRIX_POSTGRES_PASSWORD: "{{ lookup('database', application_id, 'password') }}"
MATRIX_POSTGRES_DATABASE: "{{ lookup('database', application_id, 'name') }}"

MATRIX_COTURN_SHARED: "{{ lookup('config', application_id, 'services.coturn.shared') | bool }}"
MATRIX_COTURN_HOST: "{{ lookup('domain', 'web-svc-coturn') if MATRIX_COTURN_SHARED else '' }}"
MATRIX_COTURN_STUN_TURN_PORT: "{{ lookup('config', 'web-svc-coturn', 'services.coturn.ports.public.stun_turn') if MATRIX_COTURN_SHARED else '' }}"
MATRIX_COTURN_STUN_TURN_TLS_PORT: "{{ lookup('config', 'web-svc-coturn', 'services.coturn.ports.public.stun_turn_tls') if MATRIX_COTURN_SHARED else '' }}"
MATRIX_COTURN_AUTH_SECRET: "{{ lookup('config', 'web-svc-coturn', 'secrets.credentials.auth_secret') if MATRIX_COTURN_SHARED else '' }}"

MATRIX_OUTBOUND_MAIL_ENABLED: "{{ lookup('config', application_id, 'services.email.enabled') | bool }}"
MATRIX_OUTBOUND_MAIL: "{{ lookup('email', application_id) if MATRIX_OUTBOUND_MAIL_ENABLED else {} }}"
MATRIX_OUTBOUND_MAIL_HOST: "{{ MATRIX_OUTBOUND_MAIL.host | default('') }}"
MATRIX_OUTBOUND_MAIL_PORT: "{{ MATRIX_OUTBOUND_MAIL.port | default(587) }}"
MATRIX_OUTBOUND_MAIL_USER: "{{ MATRIX_OUTBOUND_MAIL.username | default('') }}"
MATRIX_OUTBOUND_MAIL_PASS: "{{ MATRIX_OUTBOUND_MAIL.password | default('') }}"