65167463f9
Installing rocketchat failed with
invalid IPv4 address: ParseAddr("IP_DATA_2"): unable to parse IP
ipUpdateComposeTags allocates one IP per SERVICE_TAG_N annotation and fills
IP_TAG_i only where SERVICE_TAG_i exists. The four new apps tagged only their
primary service, so every sidecar — matrix's postgres, mattermost's postgres,
rocketchat's mongo, and fifteen of stoat's sixteen — kept a literal IP_DATA_n
in the deployed compose and docker refused to create the container.
Tag every service that carries an ipv4_address, index-aligned with its IP_TAG.
For stoat that also meant moving caddy from SERVICE_TAG_1 to _6 so the indices
line up with the IPs rather than the reading order.
mastodon had the same latent break (IP_TAG_2 and _3 untagged) and is fixed the
same way — it would have failed on first install for the same reason.
SERVICE_TAG carries the compose *key*, not container_name: 'libreportal app
restart <app> <service>' passes it to 'docker compose restart', which only
understands keys.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
102 lines
6.0 KiB
Plaintext
102 lines
6.0 KiB
Plaintext
#
|
|
# =============================================================================
|
|
# GENERAL CONFIGURATION
|
|
# =============================================================================
|
|
# APP_NAME = name of application for use in scripts
|
|
# REQUIRES = comma-separated install prerequisites (see scripts/checks/requirements/check_app_install.sh)
|
|
# COMPOSE_FILE = default for no app_name in docker-compose file name, app if there is
|
|
# BACKUP = if true, include this application in backup operations
|
|
# UPDATE_TYPE = auto: new image builds are applied automatically (a recovery snapshot is taken first), manual: only when you press Update
|
|
# HEALTHCHECK = if true, default docker health checks for that container will be enabled
|
|
# AUTHELIA = if true, use Authelia authentication, if false turned off.
|
|
# HEADSCALE = options : false, local, remote (see general config). e.g false or local,remote
|
|
# ENABLE_REGISTRATION = if true, anyone who can reach the homeserver can create an account on it
|
|
# ADMIN_USERNAME = localpart of the first admin account created at install (the full ID becomes @<name>:<server_name>)
|
|
# ADMIN_PASSWORD = password for that first admin account
|
|
# MONITORING = if true, export this app's metrics to Prometheus + Grafana (needs both apps installed)
|
|
#
|
|
CFG_MATRIX_APP_NAME=matrix
|
|
# A domain and Traefik are hard requirements, not conveniences. Synapse bakes
|
|
# server_name into every event and user ID it has ever signed, and it CANNOT be
|
|
# changed afterwards without throwing the database away — so the homeserver must
|
|
# know its real public name at install time, over real TLS.
|
|
CFG_MATRIX_REQUIRES="domain,traefik"
|
|
CFG_MATRIX_BACKUP=true
|
|
CFG_MATRIX_BACKUP_STRATEGY=auto
|
|
CFG_MATRIX_UPDATE_TYPE=auto
|
|
CFG_MATRIX_COMPOSE_FILE=default
|
|
CFG_MATRIX_HEALTHCHECK=true
|
|
# Must stay false. Authelia's forward-auth would sit in front of /_matrix, which
|
|
# is the API every Matrix client and every federating server speaks — they
|
|
# authenticate with Matrix access tokens and cannot follow an Authelia redirect,
|
|
# so turning this on breaks all clients and federation at once. Synapse can do
|
|
# real SSO against Authelia instead, via the OIDC block in
|
|
# resources/homeserver.yaml.
|
|
CFG_MATRIX_AUTHELIA=false
|
|
CFG_MATRIX_HEADSCALE=false
|
|
CFG_MATRIX_ENABLE_REGISTRATION=false
|
|
CFG_MATRIX_ADMIN_USERNAME=admin
|
|
CFG_MATRIX_ADMIN_PASSWORD_1=RANDOMIZEDPASSWORD1
|
|
CFG_MATRIX_MONITORING=false
|
|
# Postgres password for the `synapse` role, fed to the compose via
|
|
# #LIBREPORTAL|MATRIX_DB_PASSWORD_1_TAG| and written into homeserver.yaml by the
|
|
# install hook. Generated on first install and preserved across reinstalls —
|
|
# initdb sets it once when the volume is created, so a regenerated value would
|
|
# leave Synapse unable to open its own database.
|
|
CFG_MATRIX_DB_PASSWORD_1=RANDOMIZEDPASSWORD2
|
|
#
|
|
# =============================================================================
|
|
# METADATA
|
|
# =============================================================================
|
|
# CATEGORY = application category for grouping
|
|
# TITLE = display name for the application
|
|
# DESCRIPTION = short description of the application
|
|
# LONG_DESCRIPTION = detailed description of the application
|
|
# URL = source repository or documentation URL
|
|
# ACTIONS = available actions for this application
|
|
# REQUIRES_SERVICE = name of another LibrePortal app that must be installed before this one can be configured
|
|
#
|
|
CFG_MATRIX_CATEGORY="communication"
|
|
CFG_MATRIX_TITLE="Matrix"
|
|
CFG_MATRIX_DESCRIPTION="Federated Chat"
|
|
CFG_MATRIX_LONG_DESCRIPTION="Matrix is the open federated chat protocol — Spaces and rooms cover what Discord servers and channels do, with end-to-end encryption and bridges to Discord, IRC and Slack. This installs the Synapse homeserver on Postgres plus the Element web client, on their own subdomains. Because it federates, accounts on this server can talk to every other Matrix server without either side giving up control"
|
|
CFG_MATRIX_URL="https://github.com/element-hq/synapse"
|
|
CFG_MATRIX_ACTIONS="configure|install|restart|shutdown|uninstall"
|
|
CFG_MATRIX_REQUIRES_SERVICE=traefik
|
|
#
|
|
# =============================================================================
|
|
# NETWORK CONFIGURATION
|
|
# =============================================================================
|
|
# DOMAIN = number of domain from the general config, useful when using multiple domains
|
|
# WHITELIST = if true only allow whitelisted ips (see general config), if false allow all
|
|
#
|
|
CFG_MATRIX_DOMAIN=1
|
|
CFG_MATRIX_WHITELIST=false
|
|
CFG_MATRIX_NETWORK=default
|
|
#
|
|
# =============================================================================
|
|
# PORT CONFIGURATION
|
|
# =============================================================================
|
|
# PORT_ = port configuration: app|name|external:internal|access|protocol|login|traefik|webui|description
|
|
# - app: application name
|
|
# - name: service identifier (webui, dns, ssh, etc.)
|
|
# - external:internal: port mapping (external can be 'random' for auto-allocation)
|
|
# - access: 'public' (internet accessible), 'private' (local network only), 'disabled' (not running)
|
|
# - protocol: 'tcp' or 'udp'
|
|
# - login: if true, this port requires basic-auth via Traefik (only meaningful when traefik=true)
|
|
# - traefik: if true, Traefik handles this port (reverse proxy)
|
|
# - webui: if true, this port serves the main web interface
|
|
# - description: human-readable description of the service
|
|
#
|
|
# Two hosts, on purpose. Port 1 is the homeserver API on matrix.<domain>, which
|
|
# becomes server_name — so user IDs read @alice:matrix.<domain>. Port 2 is the
|
|
# Element web client on element.<domain>. Keeping them apart means Synapse can
|
|
# answer /.well-known/matrix/server for itself and federation needs no
|
|
# delegation from the apex domain, which this app has no way to configure.
|
|
#
|
|
# Port 1 must NOT be marked login=true: /_matrix is the client and federation
|
|
# API and basic-auth in front of it locks out every client and every peer.
|
|
#
|
|
CFG_MATRIX_PORT_1="matrix-synapse|homeserver|random:8008|public|tcp|false|true|false|Matrix Homeserver (client + federation API)||matrix"
|
|
CFG_MATRIX_PORT_2="matrix-element|webui|random:80|public|tcp|false|true|true|Element Web Interface||element"
|