Project

General

Profile

The ungleich Matrix infrastructure » History » Version 18

Jin-Guk Kwon, 12/10/2020 10:18 AM

1 1 Timothée Floure
h1. The ungleich Matrix infrastructure
2
3 16 Jin-Guk Kwon
{{toc}}
4
5 14 Timothée Floure
*%{color:red}This document concerns the infrastructure side of our MaaS offer and is intended for ungleich staff. See [[Ungleich Matrix-as-a-Service (MaaS)]] page for end-user/customer documentation. Common operations can be found on: [[https://redmine.ungleich.ch/projects/open-infrastructure/wiki/Common_operations_on_X-as-a-Service]].%*
6 1 Timothée Floure
7
h2. Status
8
9 10 Timothée Floure
This document is *A DRAFT*. This service is not in production. Ask @fnux for details.
10 2 Timothée Floure
11 4 Timothée Floure
h2. Environment
12 2 Timothée Floure
13
Our Matrix deployments make use of the "Synapse (reference) Matrix homeserver":https://github.com/matrix-org/synapse/ and "Riot web client":https://about.riot.im/. We use Debian buster as base Operating system, leveraging the "matrix-synapse package from the buster-backports repository":https://packages.debian.org/buster-backports/matrix-synapse. The riot client (= static files) is directly fetched from "upstream releases on github":https://github.com/vector-im/riot-web/releases.
14
15 5 Timothée Floure
The matrix deployments run on ipv6only VMs, HTTP(S) traffic - including federation - being proxy by the [[How to use the IPv4-to-IPv6-Proxy|ungleich v4-to-v6 proxy]]. Federation is delegated using a @/.well-known/@ URI as described in [[Ungleich Matrix-as-a-Service (MaaS)|the customer FAQ]].
16 2 Timothée Floure
17 6 Timothée Floure
!maas.jpg!
18
19 2 Timothée Floure
h2. Tooling
20
21
The whole MaaS setup is defined in the *manifest/matrix-as-a-service* of *dot-cdist* file, which wraps the *__ungleich_matrix* type. This type leverages:
22
23
* *__matrix_synapse*
24
* *__matrix_riot*
25
* *__ungleich_nginx_static_type*
26
* *__postgres_role* and *__postgres_database* from upstream cdist.
27
28 8 Timothée Floure
The "matterbridge":https://github.com/42wim/matterbridge application service can be deployed with the *__matterbridge* type.
29
30 7 Timothée Floure
*Matrix Federation Tester: https://federationtester.matrix.org/*
31
32 12 Timothée Floure
h2. Synapse Admin UI
33
34
* Available on: https://admin.matrix.ungleich.cloud
35
* Leverages https://github.com/Awesome-Technologies/synapse-admin/
36
* Static deployment hence hosted on staticweb.
37
38
* Allows manual admin management of users and rooms.
39 13 Timothée Floure
* Use direct address of homeserver for login: @https://XXXX.matrix.ungleich.cloud@
40 12 Timothée Floure
41 4 Timothée Floure
h2. Monitoring
42 1 Timothée Floure
43 15 Timothée Floure
Autodiscovered from consul in monitoring LAN.
44 14 Timothée Floure
45 4 Timothée Floure
h2. Ungleich Deployments
46 2 Timothée Floure
47 4 Timothée Floure
We maintain our own deployments alongside the customer MaaS, both for our own usage and for testing.
48
49 2 Timothée Floure
h3. matrix-staging.ungleich.ch
50
51 4 Timothée Floure
Staging instance used to tests the deployment pipeline and Matrix updates.
52 2 Timothée Floure
53
h3. matrix.ungleich.ch
54
55 9 Timothée Floure
Production instance for ungleich. Some rooms are bridged to the "chat.ungleich.ch":https://chat.ungleich.ch mattermost instance. The bridge makes use of the @#matterbridge:ungleich.ch@ local matrix user (i.e. not from LDAP) and @matterbridge@ mattermost user (linked to matterbridge AT ungleich ch).
56 11 Timothée Floure
57
h2. Customer Deployments
58
59
That's too sensitive to be public: "this way":https://redmine.ungleich.ch/projects/datacenterlight/wiki/Matrix_customer_deployments !
60 10 Timothée Floure
  
61 1 Timothée Floure
h2. Shared TURN server
62 10 Timothée Floure
63 14 Timothée Floure
Coturn is running at matrix-turn.ungleich.ch. See @matrix-as-a-service@ manifest in dot-cdist for details.
64 16 Jin-Guk Kwon
65
h2. create mass users on matrix host
66
67
- info.txt
68
69
<pre>
70 17 Jin-Guk Kwon
FirstName LastName Email user_id1 pw1
71
FirstName LastName Email user_id2 pw2
72
FirstName LastName Email user_id3 pw3
73 16 Jin-Guk Kwon
</pre>
74
75
- creating user shall script
76 1 Timothée Floure
77
<pre>
78 17 Jin-Guk Kwon
while read A B C D E
79 1 Timothée Floure
do
80 17 Jin-Guk Kwon
  pw=$E
81
  name=$A" "$B
82
  ad=$C
83
  id="@"$D
84
  data='{"password":"'${pw}'", "displayname": "'${name}'", "threepids": [ { "medium": "email", "address": "'${ad}'" }], "admin": false, "deactivated": false, "avatar_url": null }'
85
  h='Authorization: Bearer <AccessToken>'
86
  curl -v -X PUT -H "$h" -d "$data" http://localhost:8008/_synapse/admin/v2/users/$id:politikergespraeche.germanzero.org
87
  sleep 2
88 16 Jin-Guk Kwon
done < info.txt
89
</pre>
90
91
h2. invite mass users on matrix host
92
93
- info.txt
94
95
<pre>
96 18 Jin-Guk Kwon
FirstName LastName Email user_id1 pw1
97
FirstName LastName Email user_id2 pw2
98
FirstName LastName Email user_id3 pw3
99 16 Jin-Guk Kwon
</pre>
100
101
- get user token
102
103 18 Jin-Guk Kwon
--> user : admin room user : to invite user, admin must be in room.
104 16 Jin-Guk Kwon
105
<pre>
106
curl -XPOST -d '{"type":"m.login.password", "user":"[user_id]", "password":"[user_password]"}' "http://localhost:8008/_matrix/client/r0/login"
107
</pre>
108
109
- inviting user script
110
111
<pre>
112
matrixserver="testbr.lab.ungleich.ch"
113
114
generate_post_data()
115
{
116
  cat <<EOF
117
{
118 18 Jin-Guk Kwon
  "user_id":"@$D:$matrixserver" 
119 1 Timothée Floure
}
120
EOF
121
}
122
123 18 Jin-Guk Kwon
roomID=( 'rooID1 wihtout !' 'rooID2 wihtout !'  )
124
errcode="M_LIMIT_EXCEEDED" 
125
for rm_id in ${roomID[*]}
126 1 Timothée Floure
do
127 18 Jin-Guk Kwon
   while read A B C D E
128
   do
129
      echo $rm_id
130
      res2="" 
131
      res=$(curl -XPOST -d "$(generate_post_data)" "http://localhost:8008/_matrix/client/r0/rooms/%21$rm_id%3Apolitikergespraeche.germanzero.org/invite?access_token=<ACCESS_TOKEN>")
132
      echo $res
133
      if [[ $res =~ $errcode ]];then
134
        sleep 5
135
        res2=$(curl -XPOST -d "$(generate_post_data)" "http://localhost:8008/_matrix/client/r0/rooms/%21$rm_id%3Apolitikergespraeche.germanzero.org/invite?access_token=<ACCESS_TOKEN>")
136
      fi
137
138
      if [[ $res2 =~ $errcode ]];then
139
        echo "===error===" 
140
        echo $res2
141
        exit 1
142
      fi
143
      sleep 1
144
    done < info.txt
145
done
146 1 Timothée Floure
</pre>