[fix] role:synapse:apt stuff

roles/authelia-for-dokuwiki/tasks/main.json

@@ -1,12 +1,4 @@
 [
-	{
-		"name": "configuration | compute client secret hash",
-		"become": true,
-		"ansible.builtin.shell": {
-			"cmd": "authelia crypto hash generate bcrypt --password {{var_authelia_for_dokuwiki_client_secret}} | cut --delimiter=' ' --fields='2-'"
-		},
-		"register": "temp_authelia_for_dokuwiki_client_secret_hashed"
-	},
 	{
 		"name": "configuration | emplace",
 		"become": true,

roles/authelia-for-dokuwiki/templates/authelia-client-conf.json.j2

@@ -1,6 +1,6 @@
 {
 	"client_id": "{{var_authelia_for_dokuwiki_client_id}}",
-	"client_secret": "{{temp_authelia_for_dokuwiki_client_secret_hashed.stdout}}",
+	"client_secret": "{{var_authelia_for_dokuwiki_client_secret}}",
 	"client_name": "DokuWiki",
 	"public": false,
 	"authorization_policy": "one_factor",

roles/authelia-for-forgejo/tasks/main.json

@@ -1,12 +1,4 @@
 [
-	{
-		"name": "configuration | compute client secret hash",
-		"become": true,
-		"ansible.builtin.shell": {
-			"cmd": "authelia crypto hash generate bcrypt --password {{var_authelia_for_forgejo_client_secret}} | cut --delimiter=' ' --fields='2-'"
-		},
-		"register": "temp_authelia_for_forgejo_client_secret_hashed"
-	},
 	{
 		"name": "configuration | emplace",
 		"become": true,

roles/authelia-for-forgejo/templates/authelia-client-conf.json.j2

@@ -1,6 +1,6 @@
 {
 	"client_id": "{{var_authelia_for_forgejo_client_id}}",
-	"client_secret": "{{temp_authelia_for_forgejo_client_secret_hashed.stdout}}",
+	"client_secret": "{{var_authelia_for_forgejo_client_secret}}",
 	"client_name": "Forgejo",
 	"public": false,
 	"authorization_policy": "one_factor",

roles/authelia-for-gitlab/tasks/main.json

@@ -1,12 +1,4 @@
 [
-	{
-		"name": "configuration | compute client secret hash",
-		"become": true,
-		"ansible.builtin.shell": {
-			"cmd": "authelia crypto hash generate bcrypt --password {{var_authelia_for_gitlab_client_secret}} | cut --delimiter=' ' --fields='2-'"
-		},
-		"register": "temp_authelia_for_gitlab_client_secret_hashed"
-	},
 	{
 		"name": "configuration | emplace",
 		"become": true,

roles/authelia-for-gitlab/templates/authelia-client-conf.json.j2

@@ -1,6 +1,6 @@
 {
 	"client_id": "{{var_authelia_for_gitlab_client_id}}",
-	"client_secret": "{{temp_authelia_for_gitlab_client_secret_hashed.stdout}}",
+	"client_secret": "{{var_authelia_for_gitlab_client_secret}}",
 	"client_name": "GitLab",
 	"public": false,
 	"authorization_policy": "one_factor",

roles/authelia-for-hedgedoc/tasks/main.json

@@ -1,12 +1,4 @@
 [
-	{
-		"name": "configuration | compute client secret hash",
-		"become": true,
-		"ansible.builtin.shell": {
-			"cmd": "authelia crypto hash generate bcrypt --password {{var_authelia_for_hedgedoc_client_secret}} | cut --delimiter=' ' --fields='2-'"
-		},
-		"register": "temp_authelia_for_hedgedoc_client_secret_hashed"
-	},
 	{
 		"name": "configuration | emplace",
 		"become": true,

roles/authelia-for-hedgedoc/templates/authelia-client-conf.json.j2

@@ -1,6 +1,6 @@
 {
 	"client_id": "{{var_authelia_for_hedgedoc_client_id}}",
-	"client_secret": "{{temp_authelia_for_hedgedoc_client_secret_hashed.stdout}}",
+	"client_secret": "{{var_authelia_for_hedgedoc_client_secret}}",
 	"client_name": "Hedgedoc",
 	"public": false,
 	"authorization_policy": "one_factor",
@@ -12,6 +12,10 @@
 	"redirect_uris": [
 		"{{var_authelia_for_hedgedoc_hedgedoc_url_base}}/auth/oauth2/callback"
 	],
+	"grant_types": [
+		"refresh_token",
+		"authorization_code"
+	],
 	"response_types": [
 		"code"
 	],

roles/authelia-for-mas/defaults/main.json

@@ -0,0 +1,6 @@
+{
+	"var_authelia_for_mas_mas_url_base": "https://mas.example.org",
+	"var_authelia_for_mas_id": "01JADRQ54Y0KCQS0AEJQ4YTY36",
+	"var_authelia_for_mas_client_id": "mas",
+	"var_authelia_for_mas_client_secret": "REPLACE_ME"
+}

roles/authelia-for-mas/info.md

@@ -0,0 +1,8 @@
+## Beschreibung
+
+Um [MAS](../mas) gegen [Authelia](../authelia) authentifizieren zu lassen
+
+
+## Verweise
+
+- [MAS-Dokumentation | Configure an upstream SSO provider](https://element-hq.github.io/matrix-authentication-service/setup/sso.html)

roles/authelia-for-mas/tasks/main.json

@@ -1,18 +1,10 @@
 [
-	{
-		"name": "configuration | compute client secret hash",
-		"become": true,
-		"ansible.builtin.shell": {
-			"cmd": "authelia crypto hash generate bcrypt --password {{var_authelia_for_tandoor_client_secret}} | cut --delimiter=' ' --fields='2-'"
-		},
-		"register": "temp_authelia_for_tandoor_client_secret_hashed"
-	},
 	{
 		"name": "configuration | emplace",
 		"become": true,
 		"ansible.builtin.template": {
 			"src": "authelia-client-conf.json.j2",
-			"dest": "/etc/authelia/conf.d/clients/tandoor.json"
+			"dest": "/etc/authelia/conf.d/clients/mas.json"
 		}
 	},
 	{

roles/authelia-for-mas/templates/authelia-client-conf.json.j2

@@ -0,0 +1,16 @@
+{
+	"client_id": "{{var_authelia_for_mas_client_id}}",
+	"client_secret": "{{var_authelia_for_mas_client_secret}}",
+	"client_name": "MAS",
+	"public": false,
+	"authorization_policy": "one_factor",
+	"redirect_uris": [
+		"{{var_authelia_for_mas_mas_url_base}}/upstream/callback/{{var_authelia_for_mas_id}}"
+	],
+	"scopes": [
+		"openid",
+		"email",
+		"profile"
+	],
+	"token_endpoint_auth_method": "client_secret_basic"
+}

roles/authelia-for-mas/vardef.json

@@ -0,0 +1,19 @@
+{
+	"mas_url_base": {
+		"type": "string",
+		"mandatory": false
+	},
+	"id": {
+		"type": "string",
+		"mandatory": false,
+		"description": "needs to be a ULID"
+	},
+	"client_id": {
+		"type": "string",
+		"mandatory": false
+	},
+	"client_secret": {
+		"type": "string",
+		"mandatory": false
+	}
+}

roles/authelia-for-owncloud/defaults/main.json

@@ -4,7 +4,5 @@
 	"var_authelia_for_owncloud_android_client_id": "owncloud_android",
 	"var_authelia_for_owncloud_android_client_secret": "REPLACE_ME",
 	"var_authelia_for_owncloud_ios_client_id": "owncloud_ios",
-	"var_authelia_for_owncloud_ios_client_secret": "REPLACE_ME",
-	"var_authelia_for_owncloud_desktop_client_id": "xdXOt13JKxym1B1QcEncf2XDkLAexMBFwiT9j6EfhhHFJhs2KM9jbjTmf8JBXE69",
-	"var_authelia_for_owncloud_desktop_client_secret": "UBntmLjC2yYCeHwsyj73Uwo9TAaecAetRwMw0xYcvNL9yRdLSUi0hUAHfvCHFeFh"
+	"var_authelia_for_owncloud_ios_client_secret": "REPLACE_ME"
 }

roles/authelia-for-owncloud/tasks/main.json

@@ -1,36 +1,4 @@
 [
-	{
-		"name": "configuration | compute client secret hash | web",
-		"become": true,
-		"ansible.builtin.shell": {
-			"cmd": "authelia crypto hash generate bcrypt --password {{var_authelia_for_owncloud_web_client_secret}} | cut --delimiter=' ' --fields='2-'"
-		},
-		"register": "temp_authelia_for_owncloud_web_client_secret_hashed"
-	},
-	{
-		"name": "configuration | compute client secret hash | android",
-		"become": true,
-		"ansible.builtin.shell": {
-			"cmd": "authelia crypto hash generate bcrypt --password {{var_authelia_for_owncloud_android_client_secret}} | cut --delimiter=' ' --fields='2-'"
-		},
-		"register": "temp_authelia_for_owncloud_android_client_secret_hashed"
-	},
-	{
-		"name": "configuration | compute client secret hash | ios",
-		"become": true,
-		"ansible.builtin.shell": {
-			"cmd": "authelia crypto hash generate bcrypt --password {{var_authelia_for_owncloud_ios_client_secret}} | cut --delimiter=' ' --fields='2-'"
-		},
-		"register": "temp_authelia_for_owncloud_ios_client_secret_hashed"
-	},
-	{
-		"name": "configuration | compute client secret hash | desktop",
-		"become": true,
-		"ansible.builtin.shell": {
-			"cmd": "authelia crypto hash generate bcrypt --password {{var_authelia_for_owncloud_desktop_client_secret}} | cut --delimiter=' ' --fields='2-'"
-		},
-		"register": "temp_authelia_for_owncloud_desktop_client_secret_hashed"
-	},
 	{
 		"name": "configuration | emplace",
 		"become": true,

roles/authelia-for-owncloud/templates/authelia-client-conf-android.json.j2

@@ -1,6 +1,6 @@
 {
 	"client_id": "{{var_authelia_for_owncloud_android_client_id}}",
-	"client_secret": "{{temp_authelia_for_owncloud_android_client_secret_hashed.stdout}}",
+	"client_secret": "{{var_authelia_for_owncloud_android_client_secret}}",
 	"client_name": "ownCloud | Android Client",
 	"authorization_policy": "one_factor",
 	"scopes": [
@@ -10,9 +10,6 @@
 		"email",
 		"offline_access"
 	],
-	"response_types": [
-		"code"
-	],
 	"redirect_uris": [
 		"oc://android.owncloud.com"
 	]

roles/authelia-for-owncloud/templates/authelia-client-conf-desktop.json.j2

@@ -1,6 +1,6 @@
 {
-	"client_id": "{{var_authelia_for_owncloud_desktop_client_id}}",
-	"client_secret": "{{temp_authelia_for_owncloud_desktop_client_secret_hashed.stdout}}",
+	"client_id": "xdXOt13JKxym1B1QcEncf2XDkLAexMBFwiT9j6EfhhHFJhs2KM9jbjTmf8JBXE69",
+	"client_secret": "UBntmLjC2yYCeHwsyj73Uwo9TAaecAetRwMw0xYcvNL9yRdLSUi0hUAHfvCHFeFh",
 	"client_name": "ownCloud | Desktop Client",
 	"authorization_policy": "one_factor",
 	"scopes": [
@@ -10,9 +10,6 @@
 		"email",
 		"offline_access"
 	],
-	"response_types": [
-		"code"
-	],
 	"redirect_uris": [
 		"http://127.0.0.1",
 		"http://localhost"

roles/authelia-for-owncloud/templates/authelia-client-conf-ios.json.j2

@@ -1,6 +1,6 @@
 {
 	"client_id": "{{var_authelia_for_owncloud_ios_client_id}}",
-	"client_secret": "{{temp_authelia_for_owncloud_ios_client_secret_hashed.stdout}}",
+	"client_secret": "{{var_authelia_for_owncloud_ios_client_secret}}",
 	"client_name": "ownCloud | iOS Client",
 	"authorization_policy": "one_factor",
 	"scopes": [
@@ -10,9 +10,6 @@
 		"email",
 		"offline_access"
 	],
-	"response_types": [
-		"code"
-	],
 	"redirect_uris": [
 		"oc://ios.owncloud.com",
 		"oc.ios://ios.owncloud.com"

roles/authelia-for-owncloud/vardef.json

@@ -13,21 +13,13 @@
 	},
 	"android_client_secret": {
 		"type": "string",
-		"mandatory": true
+		"mandatory": false
 	},
 	"ios_client_id": {
 		"type": "string",
 		"mandatory": false
 	},
 	"ios_client_secret": {
-		"type": "string",
-		"mandatory": true
-	},
-	"dektop_client_id": {
-		"type": "string",
-		"mandatory": false
-	},
-	"desktop_client_secret": {
 		"type": "string",
 		"mandatory": false
 	}

roles/authelia-for-synapse/tasks/main.json

@@ -1,12 +1,4 @@
 [
-	{
-		"name": "configuration | compute client secret hash",
-		"become": true,
-		"ansible.builtin.shell": {
-			"cmd": "authelia crypto hash generate bcrypt --password {{var_authelia_for_synapse_client_secret}} | cut --delimiter=' ' --fields='2-'"
-		},
-		"register": "temp_authelia_for_synapse_client_secret_hashed"
-	},
 	{
 		"name": "configuration | emplace",
 		"become": true,

roles/authelia-for-synapse/templates/authelia-client-conf.json.j2

@@ -1,6 +1,6 @@
 {
 	"client_id": "{{var_authelia_for_synapse_client_id}}",
-	"client_secret": "{{temp_authelia_for_synapse_client_secret_hashed.stdout}}",
+	"client_secret": "{{var_authelia_for_synapse_client_secret}}",
 	"client_name": "Synapse",
 	"public": false,
 	"authorization_policy": "one_factor",

roles/authelia-for-tandoor/defaults/main.json

@@ -1,5 +0,0 @@
-{
-	"var_authelia_for_tandoor_tandoor_url_base": "https://tandoor.example.org",
-	"var_authelia_for_tandoor_client_id": "tandoor",
-	"var_authelia_for_tandoor_client_secret": "REPLACE_ME"
-}

roles/authelia-for-tandoor/info.md

@@ -1,8 +0,0 @@
-## Beschreibung
-
-Um [Tandoor](../tandoor) gegen [Authelia](../authelia) authentifizieren zu lassen
-
-
-## Verweise
-
-- [allauth-Dokumentation | Authelia](https://django-allauth.readthedocs.io/en/latest/socialaccount/providers/authelia.html)

roles/authelia-for-tandoor/templates/authelia-client-conf.json.j2

@@ -1,17 +0,0 @@
-{
-	"client_id": "{{var_authelia_for_tandoor_client_id}}",
-	"client_secret": "{{temp_authelia_for_tandoor_client_secret_hashed.stdout}}",
-	"client_name": "Tandoor",
-	"public": false,
-	"authorization_policy": "one_factor",
-	"redirect_uris": [
-		"{{var_authelia_for_tandoor_tandoor_url_base}}/accounts/oidc/authelia/login/callback/"
-	],
-	"scopes": [
-		"openid",
-		"email",
-		"profile"
-	],
-	"userinfo_signed_response_alg": "none",
-	"token_endpoint_auth_method": "client_secret_basic"
-}

roles/authelia-for-vikunja/tasks/main.json

@@ -1,12 +1,4 @@
 [
-	{
-		"name": "configuration | compute client secret hash",
-		"become": true,
-		"ansible.builtin.shell": {
-			"cmd": "authelia crypto hash generate bcrypt --password {{var_authelia_for_vikunja_client_secret}} | cut --delimiter=' ' --fields='2-'"
-		},
-		"register": "temp_authelia_for_vikunja_client_secret_hashed"
-	},
 	{
 		"name": "configuration | emplace",
 		"become": true,

roles/authelia-for-vikunja/templates/authelia-client-conf.json.j2

@@ -1,6 +1,6 @@
 {
 	"client_id": "{{var_authelia_for_vikunja_client_id}}",
-	"client_secret": "{{temp_authelia_for_vikunja_client_secret_hashed.stdout}}",
+	"client_secret": "{{var_authelia_for_vikunja_client_secret}}",
 	"client_name": "Vikunja",
 	"public": false,
 	"authorization_policy": "one_factor",

roles/authelia-for-wiki_js/tasks/main.json

@@ -1,12 +1,4 @@
 [
-	{
-		"name": "configuration | compute client secret hash",
-		"become": true,
-		"ansible.builtin.shell": {
-			"cmd": "authelia crypto hash generate bcrypt --password {{var_authelia_for_wiki_js_client_secret}} | cut --delimiter=' ' --fields='2-'"
-		},
-		"register": "temp_authelia_for_wiki_js_client_secret_hashed"
-	},
 	{
 		"name": "configuration | emplace",
 		"become": true,

roles/authelia-for-wiki_js/templates/authelia-client-conf.json.j2

@@ -1,6 +1,6 @@
 {
 	"client_id": "{{var_authelia_for_wiki_js_client_id}}",
-	"client_secret": "{{temp_authelia_for_wiki_js_client_secret_hashed.stdout}}",
+	"client_secret": "{{var_authelia_for_wiki_js_client_secret}}",
 	"client_name": "Wiki.js",
 	"public": false,
 	"authorization_policy": "one_factor",

roles/authelia/templates/conf-main.json.j2

@@ -173,7 +173,8 @@
 {% endif %}
 {% if var_authelia_notification_mode == "smtp" %}
 		"smtp": {
-			"address": "{{var_authelia_notification_smtp_host}}:{{var_authelia_notification_smtp_port | string}}",
+			"host": "{{var_authelia_notification_smtp_host}}",
+			"port": {{var_authelia_notification_smtp_port | string}},
 			"username": "{{var_authelia_notification_smtp_username}}",
 			"password": "{{var_authelia_notification_smtp_password}}",
 			"sender": "{{var_authelia_notification_smtp_sender}}",
@@ -188,12 +189,7 @@
 	"identity_providers": {
 		"oidc": {
 			"hmac_secret": "{{var_authelia_oidc_hmac_secret}}",
-			"jwks": [
-				{
-					"algorithm": "RS256",
-					"key": "{{temp_tls_result.privatekey | replace('\n', '\\n')}}"
-				}
-			],
+			"issuer_private_key": "{{temp_tls_result.privatekey | replace('\n', '\\n')}}",
 			"lifespans": {
 				"access_token": "{{var_authelia_oidc_lifespan_access_token}}",
 				"refresh_token": "{{var_authelia_oidc_lifespan_refresh_token}}"

roles/mas-and-nginx/defaults/main.json

@@ -0,0 +1,5 @@
+{
+	"var_mas_and_nginx_server_port": 2839,
+	"var_mas_and_nginx_domain": "REPLACE_ME",
+	"var_mas_and_nginx_tls_mode": "force"
+}

roles/mas-and-nginx/info.md

@@ -0,0 +1,8 @@
+## Beschreibung
+
+- zur Einrichtung von [nginx](../nginx) als Reverse-Proxy für [MAS](../mas)
+
+
+## Verweise
+
+- [MAS-Dokumentation | Configuring a reverse proxy](https://element-hq.github.io/matrix-authentication-service/setup/reverse-proxy.html)

roles/mas-and-nginx/tasks/main.json

@@ -12,7 +12,7 @@
 		"become": true,
 		"ansible.builtin.template": {
 			"src": "conf.j2",
-			"dest": "/etc/nginx/sites-available/{{var_tandoor_and_nginx_domain}}"
+			"dest": "/etc/nginx/sites-available/{{var_mas_and_nginx_domain}}"
 		}
 	},
 	{
@@ -20,8 +20,8 @@
 		"become": true,
 		"ansible.builtin.file": {
 			"state": "link",
-			"src": "/etc/nginx/sites-available/{{var_tandoor_and_nginx_domain}}",
-			"dest": "/etc/nginx/sites-enabled/{{var_tandoor_and_nginx_domain}}"
+			"src": "/etc/nginx/sites-available/{{var_mas_and_nginx_domain}}",
+			"dest": "/etc/nginx/sites-enabled/{{var_mas_and_nginx_domain}}"
 		}
 	},
 	{

roles/mas-and-nginx/templates/conf.j2

@@ -0,0 +1,36 @@
+{% macro mas_common() %}
+	location / {
+		proxy_http_version 1.1;
+		proxy_pass http://localhost:{{var_mas_and_nginx_server_port | string}};
+		
+		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+	}
+{% endmacro %}
+
+server {
+	server_name {{var_mas_and_nginx_domain}};
+	
+	listen 80;
+	listen [::]:80;
+	
+{% if (var_mas_and_nginx_tls_mode == 'force') %}
+	return 301 https://$http_host$request_uri;
+{% else %}
+{{ mas_common() }}
+{% endif %}
+}
+
+{% if (var_mas_and_nginx_tls_mode != 'disable') %}
+server {
+	server_name {{var_mas_and_nginx_domain}};
+	
+	listen 443 ssl http2;
+	listen [::]:443 ssl http2;
+	
+	ssl_certificate_key /etc/ssl/private/{{var_mas_and_nginx_domain}}.pem;
+	ssl_certificate /etc/ssl/fullchains/{{var_mas_and_nginx_domain}}.pem;
+	include /etc/nginx/ssl-hardening.conf;
+	
+{{ mas_common() }}
+}
+{% endif %}

roles/mas-and-nginx/vardef.json

@@ -1,19 +1,19 @@
 {
-	"domain": {
-		"mandatory": false,
-		"type": "string"
-	},
 	"port": {
-		"mandatory": false,
-		"type": "integer"
+		"type": "integer",
+		"mandatory": false
+	},
+	"domain": {
+		"type": "string",
+		"mandatory": false
 	},
 	"tls_mode": {
-		"mandatory": false,
 		"type": "string",
 		"options": [
 			"disable",
 			"enable",
 			"force"
-		]
+		],
+		"mandatory": false
 	}
 }

roles/mas-for-synapse/defaults/main.json

@@ -0,0 +1,5 @@
+{
+	"var_mas_for_synapse_synapse_url_base": "https://synapse.example.org",
+	"var_mas_for_synapse_client_id": "01JAE3YFB91XFWEDQY0WFDW5VN",
+	"var_mas_for_synapse_client_secret": "REPLACE_ME"
+}

roles/mas-for-synapse/info.md

@@ -0,0 +1,9 @@
+## Beschreibung
+
+Um [Synapse](../synapse) gegen [MAS](../mas) authentifizieren zu lassen
+
+
+## Verweise
+
+- [Synapse-Dokumentation | OpenID Connect](https://matrix-org.github.io/synapse/latest/openid.html)
+- [MAS-Dokumentation | Homeserver configuration](https://element-hq.github.io/matrix-authentication-service/setup/homeserver.html)

roles/mas-for-synapse/tasks/main.json

@@ -0,0 +1,25 @@
+[
+	{
+		"name": "configuration | emplace",
+		"become": true,
+		"ansible.builtin.template": {
+			"src": "mas-client-conf.json.j2",
+			"dest": "/opt/mas/conf.d/clients/synapse.json"
+		}
+	},
+	{
+		"name": "configuration | apply",
+		"become": true,
+		"ansible.builtin.command": {
+			"cmd": "/usr/local/bin/mas-conf-compose"
+		}
+	},
+	{
+		"name": "restart service",
+		"become": true,
+		"ansible.builtin.systemd_service": {
+			"state": "restarted",
+			"name": "mas"
+		}
+	}
+]

roles/mas-for-synapse/templates/mas-client-conf.json.j2

@@ -0,0 +1,5 @@
+{
+	"client_id": "{{var_mas_for_synapse_client_id}}",
+	"client_secret": "{{var_mas_for_synapse_client_secret}}",
+	"client_auth_method": "client_secret_basic"
+}

roles/mas/defaults/main.json

@@ -0,0 +1,23 @@
+{
+	"var_mas_user": "mas",
+	"var_mas_directory": "/opt/mas",
+	"var_mas_server_server_address": "[::]",
+	"var_mas_server_server_port": 2839,
+	"var_mas_server_server_domain": "mas.example.org",
+	"var_mas_database_host": "postgresql.example.org",
+	"var_mas_database_port": 5432,
+	"var_mas_database_username": "mas_user",
+	"var_mas_database_password": "REPLACE_ME",
+	"var_mas_database_schema": "mas",
+	"var_mas_matrix_server": "synapse.example.org",
+	"var_mas_matrix_secret": "REPLACE_ME",
+	"var_mas_matrix_endpoint": "https://synapse.example.org/",
+	"var_mas_encryption_key": "REPLACE_ME",
+	"var_mas_authentication_upstream_kind": "none",
+	"var_mas_authentication_upstream_data_authelia_url_base": "https://authelia.example.org",
+	"var_mas_authentication_upstream_data_authelia_auth_method": "client_secret_basic",
+	"var_mas_authentication_upstream_data_authelia_scope": "openid profile email",
+	"var_mas_authentication_upstream_data_authelia_id": "01JADRQ54Y0KCQS0AEJQ4YTY36",
+	"var_mas_authentication_upstream_data_authelia_client_id": "mas",
+	"var_mas_authentication_upstream_data_authelia_client_secret": "REPLACE_ME"
+}

roles/mas/files/conf-compose.py

@@ -0,0 +1,160 @@
+#!/usr/bin/env python3
+
+import sys as _sys
+import os as _os
+import yaml as _yaml
+import json as _json
+import argparse as _argparse
+
+
+def file_read(path):
+	handle = open(path, "r")
+	content = handle.read()
+	handle.close()
+	return content
+	
+
+def file_write(path, content):
+	directory = _os.path.dirname(path)
+	if (not _os.path.exists(directory)):
+		_os.makedirs(directory, exist_ok = True)
+	else:
+		pass
+	handle = open(path, "w")
+	handle.write(content)
+	handle.close()
+	return content
+	
+
+def dict_merge(core, mantle, path = None):
+	if (path is None):
+		path = []
+	result = {}
+	for source in [core, mantle]:
+		for (key, value_new, ) in source.items():
+			path_ = (path + [key])
+			type_new = type(value_new)
+			if (not (key in result)):
+				result[key] = value_new
+			else:
+				value_old = result[key]
+				type_old = type(value_old)
+				if (value_old is None):
+					result[key] = value_new
+				else:
+					if (not (type_old == type_new)):
+						raise ValueError(
+							"type mismatch at path %s: %s vs. %s"
+							% (
+								".".join(path),
+								str(type_old),
+								str(type_new),
+							)
+						)
+					else:
+						if (type_old == dict):
+							result[key] = dict_merge(value_old, value_new, path_)
+						elif (type_old == list):
+							result[key] = (value_old + value_new)
+						else:
+							result[key] = value_new
+	return result
+	
+
+def main():
+	## args
+	argument_parser = _argparse.ArgumentParser()
+	argument_parser.add_argument(
+		"-s",
+		"--source-directory",
+		type = str,
+		dest = "source_directory",
+		default = "/opt/mas/conf.d",
+		metavar = "<source-directory>",
+	)
+	argument_parser.add_argument(
+		"-f",
+		"--output-format",
+		type = str,
+		choices = ["json", "yaml"],
+		dest = "output_format",
+		default = "yaml",
+		metavar = "<output-format>",
+	)
+	argument_parser.add_argument(
+		"-o",
+		"--output-path",
+		type = str,
+		dest = "output_path",
+		default = "/opt/mas/config.yaml",
+		metavar = "<output-path>",
+	)
+	args = argument_parser.parse_args()
+	
+	## exec
+	data = {}
+	### base
+	if True:
+		data_raw = _yaml.safe_load(file_read(_os.path.join(args.source_directory, "base.yaml")))
+		data = dict_merge(
+			data,
+			{
+				"secrets": data_raw["secrets"],
+				"passwords": data_raw["passwords"],
+			}
+		)
+	### database
+	if True:
+		data = dict_merge(
+			data,
+			_json.loads(file_read(_os.path.join(args.source_directory, "database.json")))
+		)
+	### http
+	if True:
+		data = dict_merge(
+			data,
+			_json.loads(file_read(_os.path.join(args.source_directory, "http.json")))
+		)
+	### matrix
+	if True:
+		data = dict_merge(
+			data,
+			_json.loads(file_read(_os.path.join(args.source_directory, "matrix.json")))
+		)
+	### upstream
+	if True:
+		data = dict_merge(
+			data,
+			_json.loads(file_read(_os.path.join(args.source_directory, "upstream.json")))
+		)
+	### email
+	if True:
+		data = dict_merge(
+			data,
+			_json.loads(file_read(_os.path.join(args.source_directory, "email.json")))
+		)
+	### clients
+	if True:
+		data = dict_merge(
+			data,
+			{
+				"clients": list(
+					map(
+						lambda name: _json.loads(file_read(_os.path.join(args.source_directory, "clients", name))),
+						_os.listdir(_os.path.join(args.source_directory, "clients"))
+					)
+				),
+			}
+		)
+	## output
+	if True:
+		if (args.output_format == "json"):
+			output_content = _json.dumps(data, indent = "\t")
+		elif (args.output_format == "yaml"):
+			output_content = _yaml.dump(data)
+		else:
+			raise ValueError("invalid output format")
+		file_write(args.output_path, output_content)
+	
+
+main()

roles/mas/info.md

@@ -0,0 +1,8 @@
+## Beschreibung
+
+für [Matrix Authentication Service](https://github.com/element-hq/matrix-authentication-service), was eine OIDC-Portal für [Synapse](../synapse) ist
+
+
+## Verweise
+
+- [Dokumentation](https://element-hq.github.io/matrix-authentication-service/index.html)

roles/mas/tasks/main.json

@@ -0,0 +1,123 @@
+[
+	{
+		"name": "user",
+		"become": true,
+		"ansible.builtin.user": {
+			"name": "{{var_mas_user}}",
+			"create_home": true,
+			"home": "{{var_mas_directory}}"
+		}
+	},
+	{
+		"name": "directories",
+		"become": true,
+		"loop": [
+			"{{var_mas_directory}}/conf.d",
+			"{{var_mas_directory}}/conf.d/clients",
+			"{{var_mas_directory}}/scripts"
+		],
+		"ansible.builtin.file": {
+			"state": "directory",
+			"owner": "{{var_mas_user}}",
+			"path": "{{item}}"
+		}
+	},
+	{
+		"name": "download",
+		"become": true,
+		"become_user": "{{var_mas_user}}",
+		"ansible.builtin.get_url": {
+			"url": "https://github.com/element-hq/matrix-authentication-service/releases/latest/download/mas-cli-x86_64-linux.tar.gz",
+			"dest": "/tmp/mas.tar.gz"
+		}
+	},
+	{
+		"name": "extract",
+		"become": true,
+		"become_user": "{{var_mas_user}}",
+		"ansible.builtin.unarchive": {
+			"remote_src": true,
+			"src": "/tmp/mas.tar.gz",
+			"dest": "{{var_mas_directory}}",
+			"owner": "{{var_mas_user}}"
+		}
+	},
+	{
+		"name": "configuration | compose script",
+		"become": true,
+		"ansible.builtin.copy": {
+			"src": "conf-compose.py",
+			"dest": "/usr/local/bin/mas-conf-compose",
+			"mode": "0555"
+		}
+	},
+	{
+		"name": "configuration | base",
+		"become": true,
+		"become_user": "{{var_mas_user}}",
+		"ansible.builtin.shell": {
+			"cmd": "./mas-cli config generate > {{var_mas_directory}}/conf.d/base.yaml",
+			"chdir": "{{var_mas_directory}}"
+		}
+	},
+	{
+		"name": "configuration | database",
+		"become": true,
+		"become_user": "{{var_mas_user}}",
+		"ansible.builtin.template": {
+			"src": "config-database.json.j2",
+			"dest": "{{var_mas_directory}}/conf.d/database.json"
+		}
+	},
+	{
+		"name": "configuration | http",
+		"become": true,
+		"become_user": "{{var_mas_user}}",
+		"ansible.builtin.template": {
+			"src": "config-http.json.j2",
+			"dest": "{{var_mas_directory}}/conf.d/http.json"
+		}
+	},
+	{
+		"name": "configuration | matrix",
+		"become": true,
+		"become_user": "{{var_mas_user}}",
+		"ansible.builtin.template": {
+			"src": "config-matrix.json.j2",
+			"dest": "{{var_mas_directory}}/conf.d/matrix.json"
+		}
+	},
+	{
+		"name": "configuration | upstream",
+		"become": true,
+		"become_user": "{{var_mas_user}}",
+		"ansible.builtin.template": {
+			"src": "config-upstream.json.j2",
+			"dest": "{{var_mas_directory}}/conf.d/upstream.json"
+		}
+	},
+	{
+		"name": "configuration | apply",
+		"become": true,
+		"ansible.builtin.command": {
+			"cmd": "/usr/local/bin/mas-conf-compose"
+		}
+	},
+	{
+		"name": "systemd unit",
+		"become": true,
+		"ansible.builtin.template": {
+			"src": "systemd_unit.j2",
+			"dest": "/etc/systemd/system/mas.service"
+		}
+	},
+	{
+		"name": "run",
+		"become": true,
+		"ansible.builtin.systemd_service": {
+			"name": "mas",
+			"enabled": true,
+			"state": "restarted"
+		}
+	}
+]

roles/mas/templates/config-database.json.j2

@@ -0,0 +1,9 @@
+{
+	"database": {
+		"host": "{{var_mas_database_host}}",
+		"port": {{var_mas_database_port | string}},
+		"username": "{{var_mas_database_username}}",
+		"password": "{{var_mas_database_password}}",
+		"database": "{{var_mas_database_schema}}"
+	}
+}

roles/mas/templates/config-email.json.j2

@@ -0,0 +1,7 @@
+{
+	"email": {
+		"from": "Authentication Service <root@localhost>",
+		"reply_to": "Authentication Service <root@localhost>",
+		"transport": "blackhole"
+	}
+}

roles/mas/templates/config-http.json.j2

@@ -0,0 +1,60 @@
+{
+	"http": {
+		"listeners": [
+			{
+				"name": "web",
+				"resources": [
+					{
+						"name": "discovery"
+					},
+					{
+						"name": "human"
+					},
+					{
+						"name": "oauth"
+					},
+					{
+						"name": "compat"
+					},
+					{
+						"name": "graphql"
+					},
+					{
+						"name": "assets"
+					}
+				],
+				"binds": [
+					{
+						"address": "{{var_mas_server_server_address}}:{{var_mas_server_server_port | string}}"
+					}
+				],
+				"proxy_protocol": false
+			},
+			{
+				"name": "internal",
+				"resources": [
+					{
+						"name": "health"
+					}
+				],
+				"binds": [
+					{
+						"host": "localhost",
+						"port": 8081
+					}
+				],
+				"proxy_protocol": false
+			}
+		],
+		"trusted_proxies": [
+			"192.168.0.0/16",
+			"172.16.0.0/12",
+			"10.0.0.0/10",
+			"127.0.0.1/8",
+			"fd00::/8",
+			"::1/128"
+		],
+		"public_base": "https://{{var_mas_server_server_domain}}/",
+		"issuer": "https://{{var_mas_server_server_domain}}/"
+	}
+}

roles/mas/templates/config-matrix.json.j2

@@ -0,0 +1,7 @@
+{
+	"matrix": {
+		"homeserver": "{{var_mas_matrix_server}}",
+		"secret": "{{var_mas_matrix_secret}}",
+		"endpoint": "{{var_mas_matrix_endpoint}}"
+	}
+}

roles/mas/templates/config-upstream.json.j2

@@ -0,0 +1,35 @@
+{
+{% if var_mas_authentication_upstream_kind == 'none' %}
+{% endif %}
+{% if var_mas_authentication_upstream_kind == 'authelia' %}
+	"upstream_oauth2": {
+		"providers": [
+			{
+				"id": "{{var_mas_authentication_upstream_data_authelia_id}}",
+				"issuer": "{{var_mas_authentication_upstream_data_authelia_url_base}}",
+				"authorization_endpoint": "{{var_mas_authentication_upstream_data_authelia_url_base}}/api/oidc/authorization",
+				"token_endpoint": "{{var_mas_authentication_upstream_data_authelia_url_base}}/api/oidc/token",
+				"token_endpoint_auth_method": "{{var_mas_authentication_upstream_data_authelia_auth_method}}",
+				"scope": "{{var_mas_authentication_upstream_data_authelia_scope}}",
+				"discovery_mode": "insecure",
+				"client_id": "{{var_mas_authentication_upstream_data_authelia_client_id}}",
+				"client_secret": "{{var_mas_authentication_upstream_data_authelia_client_secret}}",
+				"claims_imports": {
+					"localpart": {
+						"action": "require",
+						"template": "{{"{{"}} user.preferred_username {{"}}"}}"
+					},
+					"displayname": {
+						"action": "suggest",
+						"template": "{{"{{"}} user.name {{"}}"}}"
+					},
+					"email": {
+						"action": "suggest",
+						"template": "{{"{{"}} user.email {{"}}"}}",
+						"set_email_verification": "always"
+					}
+				}
+		]
+	}
+{% endif %}	
+}

roles/mas/templates/systemd_unit.j2

@@ -0,0 +1,15 @@
+[Unit]
+Description=MAS
+After=network.target
+
+[Service]
+WorkingDirectory={{var_mas_directory}}
+ExecStart={{var_mas_directory}}/mas-cli server
+Type=simple
+Restart=always
+User={{var_mas_user}}
+
+[Install]
+WantedBy=default.target
+RequiredBy=network.target
+

roles/mas/vardef.json

@@ -0,0 +1,91 @@
+{
+	"user": {
+		"type": "string",
+		"mandatory": false
+	},
+	"directory": {
+		"type": "string",
+		"mandatory": false
+	},
+	"server_address": {
+		"type": "string",
+		"mandatory": false
+	},
+	"server_port": {
+		"type": "string",
+		"mandatory": false
+	},
+	"domain": {
+		"type": "string",
+		"mandatory": false
+	},
+	"database_host": {
+		"type": "string",
+		"mandatory": false
+	},
+	"database_port": {
+		"type": "integer",
+		"mandatory": false
+	},
+	"database_username": {
+		"type": "string",
+		"mandatory": false
+	},
+	"database_password": {
+		"type": "string",
+		"mandatory": true
+	},
+	"database_schema": {
+		"type": "string",
+		"mandatory": false
+	},
+	"matrix_server": {
+		"type": "string",
+		"mandatory": false
+	},
+	"matrix_secret": {
+		"type": "string",
+		"mandatory": true
+	},
+	"matrix_endpoint": {
+		"type": "string",
+		"mandatory": false
+	},
+	"encryption_key": {
+		"type": "string",
+		"mandatory": true
+	},
+	"authentication_upstream_kind": {
+		"nullable": false,
+		"type": "string",
+		"options": [
+			"none",
+			"authelia"
+		]
+	},
+	"authentication_upstream_data_authelia_url_base": {
+		"type": "string",
+		"mandatory": false
+	},
+	"authentication_upstream_data_authelia_auth_method": {
+		"type": "string",
+		"mandatory": false
+	},
+	"authentication_upstream_data_authelia_scope": {
+		"type": "string",
+		"mandatory": false
+	},
+	"authentication_upstream_data_authelia_id": {
+		"type": "string",
+		"mandatory": false,
+		"description": "needs to be a ULID"
+	},
+	"authentication_upstream_data_authelia_client_id": {
+		"type": "string",
+		"mandatory": false
+	},
+	"authentication_upstream_data_authelia_client_secret": {
+		"type": "string",
+		"mandatory": false
+	}
+}

roles/postgresql-for-mas/defaults/main.json

@@ -0,0 +1,5 @@
+{
+	"var_postgresql_for_mas_username": "mas_user",
+	"var_postgresql_for_mas_password": "REPLACE_ME",
+	"var_postgresql_for_mas_schema": "mas"
+}

roles/postgresql-for-mas/tasks/main.json

@@ -6,8 +6,7 @@
 			"update_cache": true,
 			"pkg": [
 				"acl",
-				"python3-psycopg2",
-				"libpq-dev"
+				"python3-psycopg2"
 			]
 		}
 	},
@@ -17,8 +16,8 @@
 		"become_user": "postgres",
 		"community.postgresql.postgresql_user": {
 			"state": "present",
-			"name": "{{var_postgresql_for_tandoor_username}}",
-			"password": "{{var_postgresql_for_tandoor_password}}"
+			"name": "{{var_postgresql_for_mas_username}}",
+			"password": "{{var_postgresql_for_mas_password}}"
 		},
 		"environment": {
 			"PGOPTIONS": "-c password_encryption=scram-sha-256"
@@ -30,8 +29,8 @@
 		"become_user": "postgres",
 		"community.postgresql.postgresql_db": {
 			"state": "present",
-			"name": "{{var_postgresql_for_tandoor_schema}}",
-			"owner": "{{var_postgresql_for_tandoor_username}}"
+			"name": "{{var_postgresql_for_mas_schema}}",
+			"owner": "{{var_postgresql_for_mas_username}}"
 		}
 	},
 	{
@@ -40,9 +39,9 @@
 		"become_user": "postgres",
 		"community.postgresql.postgresql_privs": {
 			"state": "present",
-			"db": "{{var_postgresql_for_tandoor_schema}}",
+			"db": "{{var_postgresql_for_mas_schema}}",
 			"objs": "ALL_IN_SCHEMA",
-			"roles": "{{var_postgresql_for_tandoor_username}}",
+			"roles": "{{var_postgresql_for_mas_username}}",
 			"privs": "ALL",
 			"grant_option": true
 		}

roles/postgresql-for-tandoor/defaults/main.json

@@ -1,5 +0,0 @@
-{
-	"var_postgresql_for_tandoor_username": "tandoor_user",
-	"var_postgresql_for_tandoor_password": "REPLACE_ME",
-	"var_postgresql_for_tandoor_schema": "tandoor"
-}

roles/synapse-and-nginx/info.md

@@ -6,3 +6,9 @@
 ## Verweise
 
 - [Synapse-Dokumentation über die Nutzung von Reverse-Proxies](https://matrix-org.github.io/synapse/latest/reverse_proxy.html)
+
+
+## ToDo
+
+- MAS-Einbindung (siehe https://element-hq.github.io/matrix-authentication-service/setup/reverse-proxy.html)
+

roles/synapse-and-nginx/templates/conf.j2

@@ -1,5 +1,5 @@
 {% macro synapse_common() %}
-	location ~ ^(/_matrix|/_synapse/client) {
+	location ~ ^(/_matrix|/_synapse/client|/.well-known) {
 		proxy_pass http://localhost:8008;
 		proxy_set_header X-Forwarded-For $remote_addr;
 		proxy_set_header X-Forwarded-Proto $scheme;

roles/synapse/defaults/main.json

@@ -20,6 +20,12 @@
 	"var_synapse_authentication_data_authelia_client_id": "synapse",
 	"var_synapse_authentication_data_authelia_client_secret": "REPLACE_ME",
 	"var_synapse_authentication_data_authelia_url_base": "https://authelia.example.org",
+	"var_synapse_authentication_data_mas_url_base": "http://localhost:2839",
+	"var_synapse_authentication_data_mas_client_id": "01JAE3YFB91XFWEDQY0WFDW5VN",
+	"var_synapse_authentication_data_mas_client_secret": "REPLACE_ME",
+	"var_synapse_authentication_data_mas_admin_token": "REPLACE_ME",
+	"var_synapse_authentication_data_mas_provider_id": "mas",
+	"var_synapse_authentication_data_mas_provider_name": "MAS",
 	"var_synapse_smtp_host": "smtp.example.org",
 	"var_synapse_smtp_port": 587,
 	"var_synapse_smtp_username": "synapse@smtp.example.org",

roles/synapse/info.md

@@ -1,6 +1,6 @@
 ## Beschreibung
 
-Zur Einrichtung des [matrix.org](https://matrix.org/)-Servers [Synapse](https://github.com/element-hq/synapse)
+Zur Einrichtung des [matrix.org](https://matrix.org/)-Servers Synapse
 
 
 ## Verweise
@@ -9,3 +9,4 @@ Zur Einrichtung des [matrix.org](https://matrix.org/)-Servers [Synapse](https://
 - [GitHub-Repository](https://github.com/matrix-org/synapse)
 - [Configuration Manual](https://matrix-org.github.io/synapse/latest/usage/configuration/config_documentation.html)
 - [Dokumentation | PostgreSQL](https://matrix-org.github.io/synapse/latest/postgres.html#using-postgres)
+- [MAS-Dokumentation | Homeserver configuration](https://element-hq.github.io/matrix-authentication-service/setup/homeserver.html)

roles/synapse/templates/homeserver.yaml.j2

@@ -126,6 +126,21 @@ oidc_providers:
         email_template: "{{"{{"}} user.email {{"}}"}}"
 {% endif %}
 
+{% if var_synapse_authentication_kind == 'mas' %}
+enable_registration: false
+enable_registration_without_verification: false
+
+experimental_features:
+  msc3861:
+    enabled: true
+    issuer: "{{var_synapse_authentication_data_mas_url_base}}"
+    client_auth_method: client_secret_basic
+    client_id: "{{var_synapse_authentication_data_mas_client_id}}"
+    client_secret: "{{var_synapse_authentication_data_mas_client_secret}}"
+    admin_token: "{{var_synapse_authentication_data_mas_admin_token}}"
+    account_management_url: "{{var_synapse_authentication_data_mas_url_base}}/account"
+{% endif %}
+
 account_validity:
 
 bcrypt_rounds: 12

roles/synapse/vardef.json

@@ -71,7 +71,8 @@
 		"mandatory": false,
 		"options": [
 			"internal",
-			"authelia"
+			"authelia",
+			"mas"
 		]
 	},
 	"authentication_data_authelia_provider_id": {
@@ -94,6 +95,30 @@
 		"type": "string",
 		"mandatory": false
 	},
+	"authentication_data_mas_url_base": {
+		"type": "string",
+		"mandatory": false
+	},
+	"authentication_data_mas_client_id": {
+		"type": "string",
+		"mandatory": false
+	},
+	"authentication_data_mas_client_secret": {
+		"type": "string",
+		"mandatory": false
+	},
+	"authentication_data_mas_admin_token": {
+		"type": "string",
+		"mandatory": false
+	},
+	"authentication_data_mas_provider_id": {
+		"type": "string",
+		"mandatory": false
+	},
+	"authentication_data_mas_provider_name": {
+		"type": "string",
+		"mandatory": false
+	},
 	"smtp_host": {
 		"type": "string",
 		"mandatory": false

roles/tandoor-and-nginx/defaults/main.json

@@ -1,5 +0,0 @@
-{
-	"var_tandoor_and_nginx_domain": "tandoor.example.org",
-	"var_tandoor_and_nginx_tls_mode": "force",
-	"var_tandoor_and_nginx_directory": "/opt/tandoor"
-}

roles/tandoor-and-nginx/info.md

@@ -1,4 +0,0 @@
-## Verweise
-
-- [Tandoor-Dokumentation | nginx](https://docs.tandoor.dev/install/manual/#nginx)
-

roles/tandoor-and-nginx/templates/conf.j2

@@ -1,43 +0,0 @@
-{% macro tandoor_common() %}
-	location /static {
-		alias {{var_tandoor_and_nginx_directory}}/program/staticfiles;
-	}
-	
-	location /media {
-		alias {{var_tandoor_and_nginx_directory}}/program/mediafiles;
-	}
-	
-	location / {
-		proxy_set_header Host $http_host;
-		proxy_pass http://unix:{{var_tandoor_and_nginx_directory}}/program/recipes.sock;
-		proxy_set_header X-Forwarded-Proto $scheme;
-	}
-{% endmacro %}
-
-server {
-	listen 80;
-	listen [::]:80;
-	
-	server_name {{var_tandoor_and_nginx_domain}};
-	
-{% if var_tandoor_and_nginx_tls_mode == 'force' %}
-	return 301 https://$http_host$request_uri;
-{% else %}
-{{ tandoor_common() }}
-{% endif %}
-}
-
-{% if var_tandoor_and_nginx_tls_mode != 'disable' %}
-server {
-	listen 443 ssl;
-	listen [::]:443 ssl;
-	
-	server_name {{var_tandoor_and_nginx_domain}};
-	
-	ssl_certificate_key /etc/ssl/private/{{var_tandoor_and_nginx_domain}}.pem;
-	ssl_certificate /etc/ssl/fullchains/{{var_tandoor_and_nginx_domain}}.pem;
-	include /etc/nginx/ssl-hardening.conf;
-	
-{{ tandoor_common() }}
-}
-{% endif %}

roles/tandoor/defaults/main.json

@@ -1,27 +0,0 @@
-{
-	"var_tandoor_user": "tandoor",
-	"var_tandoor_directory": "/opt/tandoor",
-	"var_tandoor_repository_url": "https://github.com/vabene1111/recipes.git",
-	"var_tandoor_repository_reference": "master",
-	"var_tandoor_database_kind": "sqlite",
-	"var_tandoor_database_data_postgresql_host": "postgresql.example.org",
-	"var_tandoor_database_data_postgresql_port": 5432,
-	"var_tandoor_database_data_postgresql_username": "tandoor_user",
-	"var_tandoor_database_data_postgresql_password": "REPLACE_ME",
-	"var_tandoor_database_data_postgresql_schema": "tandoor",
-	"var_tandoor_authentication_kind": "internal",
-	"var_tandoor_authentication_data_authelia_client_id": "REPLACE_ME",
-	"var_tandoor_authentication_data_authelia_client_secret": "REPLACE_ME",
-	"var_tandoor_authentication_data_authelia_url_base": "https://authelia.example.org",
-	"var_tandoor_authentication_data_authelia_label": "Authelia",
-	"var_tandoor_smtp_host": "smtp.example.org",
-	"var_tandoor_smtp_port": 587,
-	"var_tandoor_smtp_username": "tandoor@smtp.example.org",
-	"var_tandoor_smtp_password": "REPLACE_ME",
-	"var_tandoor_notification_sender": "notification@tandoor.example.org",
-	"var_tandoor_secret_key": "REPLACE_ME",
-	"var_tandoor_admin_username": "admin",
-	"var_tandoor_admin_password": "REPLACE_ME",
-	"var_tandoor_admin_email": "admin@tandoor.example.org",
-	"var_tandoor_domain": "tandoor.exmaple.org"
-}

roles/tandoor/info.md

@@ -1,18 +0,0 @@
-## Beschreibung
-
-Für Rezepte-Sammlung [Tandoor](https://tandoor.dev/)
-
-
-## Verweise
-
-- [Tandoor-Dokumentation | Installation](https://docs.tandoor.dev/install/manual/)
-- [Tandoor-Dokumentation | Konfiguration](https://docs.tandoor.dev/system/configuration/)
-- [Tandoor-Dokumentation | Allauth](https://docs.tandoor.dev/features/authentication/#allauth)
-- [Django-Dokumentation | Variable `DJANGO_SUPERUSER_PASSWORD`](https://docs.djangoproject.com/en/5.1/ref/django-admin/#envvar-DJANGO_SUPERUSER_PASSWORD)
-- [allauth-Dokumentation | OpenID Connect](https://docs.allauth.org/en/latest/socialaccount/providers/openid_connect.html)
-- [allauth-Dokumentation | Authelia](https://docs.allauth.org/en/latest/socialaccount/providers/authelia.html)
-
-
-## ToDo
-
-- Idempotenz

roles/tandoor/tasks/main.json

@@ -1,136 +0,0 @@
-[
-	{
-		"name": "packages",
-		"become": true,
-		"ansible.builtin.apt": {
-			"update_cache": true,
-			"pkg": [
-				"git",
-				"gcc",
-				"libpq-dev",
-				"libldap2-dev",
-				"libsasl2-dev",
-				"python3-venv",
-				"python3-dev",
-				"nodejs",
-				"yarnpkg"
-			]
-		}
-	},
-	{
-		"name": "user and directory",
-		"become": true,
-		"ansible.builtin.user": {
-			"name": "{{var_tandoor_user}}",
-			"create_home": true,
-			"home": "{{var_tandoor_directory}}"
-		}
-	},
-	{
-		"name": "sources",
-		"become": true,
-		"become_user": "{{var_tandoor_user}}",
-		"ansible.builtin.git": {
-			"repo": "{{var_tandoor_repository_url}}",
-			"version": "{{var_tandoor_repository_reference}}",
-			"single_branch": true,
-			"dest": "{{var_tandoor_directory}}/program",
-			"force": true
-		}
-	},
-	{
-		"name": "venv",
-		"become": true,
-		"become_user": "{{var_tandoor_user}}",
-		"ansible.builtin.command": {
-			"chdir": "{{var_tandoor_directory}}",
-			"cmd": "python3 -m venv program"
-		}
-	},
-	{
-		"name": "python requirements",
-		"become": true,
-		"become_user": "{{var_tandoor_user}}",
-		"ansible.builtin.pip": {
-			"virtualenv": "{{var_tandoor_directory}}/program",
-			"virtualenv_python": "python3",
-			"requirements": "{{var_tandoor_directory}}/program/requirements.txt"
-		}
-	},
-	{
-		"name": "configuration",
-		"become": true,
-		"become_user": "{{var_tandoor_user}}",
-		"ansible.builtin.template": {
-			"src": "conf.j2",
-			"dest": "{{var_tandoor_directory}}/program/.env",
-			"mode": "644"
-		}
-	},
-	{
-		"name": "initialize",
-		"become": true,
-		"become_user": "{{var_tandoor_user}}",
-		"environment": {
-			"VIRTUAL_ENV": "{{var_tandoor_directory}}/program"
-		},
-		"loop": [
-			"migrate",
-			"collectstatic --no-input",
-			"collectstatic_js_reverse"
-		],
-		"ansible.builtin.shell": {
-			"chdir": "{{var_tandoor_directory}}/program",
-			"cmd": "bin/python3 manage.py {{item}}"
-		}
-	},
-	{
-		"name": "admin account",
-		"become": true,
-		"become_user": "{{var_tandoor_user}}",
-		"environment": {
-			"VIRTUAL_ENV": "{{var_tandoor_directory}}/program"
-		},
-		"ansible.builtin.shell": {
-			"chdir": "{{var_tandoor_directory}}/program",
-			"cmd": "DJANGO_SUPERUSER_PASSWORD={{var_tandoor_admin_password}} bin/python3 manage.py createsuperuser --no-input --username {{var_tandoor_admin_username}} --email {{var_tandoor_admin_email}}"
-		}
-	},
-
-	{
-		"name": "frontend stuff | core",
-		"become": true,
-		"become_user": "{{var_tandoor_user}}",
-		"ansible.builtin.shell": {
-			"chdir": "{{var_tandoor_directory}}/program/vue",
-			"cmd": "yarnpkg install && yarnpkg build"
-		}
-	},
-	{
-		"name": "frontend stuff | link",
-		"become": true,
-		"become_user": "{{var_tandoor_user}}",
-		"ansible.builtin.file": {
-			"type": "link",
-			"src": "{{var_tandoor_directory}}/program/cookbook/static/vue",
-			"dest": "{{var_tandoor_directory}}/program/staticfiles/vue",
-		}
-	},
-	{
-		"name": "systemd unit",
-		"become": true,
-		"ansible.builtin.template": {
-			"src": "systemd-unit.j2",
-			"dest": "/etc/systemd/system/tandoor.service"
-		}
-	},
-	{
-		"name": "start",
-		"become": true,
-		"ansible.builtin.systemd_service": {
-			"enabled": true,
-			"state": "started",
-			"name": "tandoor"
-		}
-	}
-]

roles/tandoor/templates/conf.j2

@@ -1,42 +0,0 @@
-{% if var_tandoor_database_kind == 'sqlite' %}
-DB_ENGINE=django.db.backends.sqlite3
-{% endif %}
-
-{% if var_tandoor_database_kind == 'postgresql' %}
-DB_ENGINE=django.db.backends.postgresql
-POSTGRES_HOST={{var_tandoor_database_data_postgresql_host}}
-POSTGRES_DB={{var_tandoor_database_data_postgresql_schema}}
-POSTGRES_PORT={{var_tandoor_database_data_postgresql_port | string}}
-POSTGRES_USER={{var_tandoor_database_data_postgresql_username}}
-POSTGRES_PASSWORD={{var_tandoor_database_data_postgresql_password}}
-{% endif %}
-
-{% if var_tandoor_authentication_kind == 'internal' %}
-ENABLE_SIGNUP=1
-REMOTE_USER_AUTH=0
-{% endif %}
-
-{% if var_tandoor_authentication_kind == 'authelia' %}
-ENABLE_SIGNUP=0
-REMOTE_USER_AUTH=1
-SOCIAL_PROVIDERS=allauth.socialaccount.providers.openid
-# SOCIALACCOUNT_PROVIDERS={"openid_connect": {"OAUTH_PKCE_ENABLED": false, "APPS": [{"provider_id": "authelia", "name": "{{var_tandoor_authentication_data_authelia_label}}", "client_id": "{{var_tandoor_authentication_data_authelia_client_id}}", "secret": "{{var_tandoor_authentication_data_authelia_client_secret}}", "settings": {"server_url":"{{var_tandoor_authentication_data_authelia_url_base}}", "token_auth_method": "client_secret_basic", "oauth_pkce_enabled": false}}]}}
-SOCIALACCOUNT_PROVIDERS={"openid_connect": {"APPS": [{"provider_id": "authelia", "name": "{{var_tandoor_authentication_data_authelia_label}}", "client_id": "{{var_tandoor_authentication_data_authelia_client_id}}", "secret": "{{var_tandoor_authentication_data_authelia_client_secret}}", "settings": {"server_url": "{{var_tandoor_authentication_data_authelia_url_base}}/.well-known/openid-configuration"}}]}}
-{% endif %}
-
-EMAIL_HOST={{var_tandoor_smtp_host}}
-EMAIL_PORT={{var_tandoor_smtp_port | string}}
-EMAIL_HOST_USER={{var_tandoor_smtp_username}}
-EMAIL_HOST_PASSWORD={{var_tandoor_smtp_password}}
-EMAIL_USE_TLS=1
-EMAIL_USE_SSL=0
-DEFAULT_FROM_EMAIL={{var_tandoor_notification_sender}}
-
-SECRET_KEY={{var_tandoor_secret_key}}
-
-ALLOWED_HOSTS={{var_tandoor_domain}}
-
-ENABLE_METRICS=0
-ENABLE_PDF_EXPORT=0
-
-DEBUG=0

roles/tandoor/templates/systemd-unit.j2

@@ -1,16 +0,0 @@
-[Unit]
-Description=Tandoor (gunicorn daemon)
-After=network.target
-
-[Service]
-Type=simple
-Restart=always
-RestartSec=3
-User={{var_tandoor_user}}
-Group=www-data
-WorkingDirectory={{var_tandoor_directory}}/program
-EnvironmentFile={{var_tandoor_directory}}/program/.env
-ExecStart={{var_tandoor_directory}}/program/bin/gunicorn --capture-output --bind unix:{{var_tandoor_directory}}/program/recipes.sock recipes.wsgi:application
-
-[Install]
-WantedBy=multi-user.target

roles/wiki_js/files/wiki-js-cli

@@ -288,7 +288,7 @@ var _wiki_js_cli;
          */
         async function call_finalize(admin_email, admin_password, site_url, telemetry) {
             const http_request = {
-                "target": (_url_base + "/finalize"),
+                "target": (_wiki_js_cli.conf.get().api.url_base + "/finalize"),
                 "method": "POST",
                 "headers": {
                     "Content-Type": "application/json",

roles/wiki_js/tasks/main.json

@@ -55,8 +55,7 @@
 		"ansible.builtin.copy": {
 			"src": "wiki-js-cli",
 			"dest": "/usr/local/bin/wiki-js-cli",
-			"owner": "{{var_wiki_js_user}}",
-			"mode": "0770"
+			"mode": "0700"
 		}
 	},
 	{
@@ -130,7 +129,7 @@
 		"become_user": "{{var_wiki_js_user}}",
 		"ansible.builtin.command": {
 			"chdir": "{{var_wiki_js_directory}}",
-			"cmd": "/usr/local/bin/wiki-js-cli -b http://127.0.0.1:{{var_wiki_js_port | string}} -u {{var_wiki_js_admin_email_address}} -p {{var_wiki_js_admin_password}} email-settings-set {{var_wiki_js_smtp_host}} {{var_wiki_js_smtp_port}} {{var_wiki_js_smtp_username}} {{var_wiki_js_smtp_password}} {{var_wiki_js_email_sending_sender_name}} {{var_wiki_js_email_sending_sender_email_address}}"
+			"cmd": "/usr/local/bin/wiki-js-cli -b http://127.0.0.1:{{var_wiki_js_port | string}} -u {{var_wiki_js_admin_email_address}} -p {{var_wiki_js_admin_password}} email-settings-set {{var_wiki_js_smtp_host}} {{var_wiki_js_smtp_port}} {{var_wiki_js_smtp_username}} {{var_wiki_js_smtp_password}} {{email_sending_sender_name}} {{email_sending_sender_email_address}}"
 		}
 	},
 	{