104 lines
3.5 KiB
YAML
104 lines
3.5 KiB
YAML
# roles/matrix_bot/tasks/main.yml
|
|
#
|
|
# Deploy the morphit-matrix-bot sidecar. Assumes the `morphit`
|
|
# role has already cloned the repo to /opt/morphit and run
|
|
# `npm ci` (which builds better-sqlite3's native bindings).
|
|
#
|
|
# Variables (set in group_vars/vault.yml):
|
|
# matrix_bot_homeserver : e.g. "https://matrix.org"
|
|
# matrix_bot_access_token : bot-account access token (SECRET)
|
|
# matrix_bot_alert_mxid : comma-separated MXIDs (one per recipient)
|
|
# matrix_bot_digest_time : daily digest send time (default 09:00 UTC)
|
|
# matrix_bot_dry_run : default false (set true for staging)
|
|
# matrix_bot_extra_units : optional comma-separated extra
|
|
# journalctl units to tail (additive
|
|
# to the bot's built-in default list)
|
|
#
|
|
# References: docs/OPERATIONS.md §16 "Canonical Matrix routing".
|
|
|
|
---
|
|
- name: Assert required matrix-bot vars are set
|
|
ansible.builtin.assert:
|
|
that:
|
|
- matrix_bot_homeserver is defined
|
|
- matrix_bot_access_token is defined
|
|
- matrix_bot_alert_mxid is defined
|
|
fail_msg: >
|
|
enable_matrix_bot is true but one or more of
|
|
matrix_bot_homeserver / matrix_bot_access_token /
|
|
matrix_bot_alert_mxid is missing. Set them in
|
|
group_vars/vault.yml.
|
|
|
|
- name: Create morphit-matrix-bot system user
|
|
ansible.builtin.user:
|
|
name: morphit-matrix-bot
|
|
system: true
|
|
home: /var/lib/morphit-matrix-bot
|
|
create_home: false
|
|
shell: /usr/sbin/nologin
|
|
groups: systemd-journal
|
|
append: true
|
|
|
|
- name: Create matrix-bot state directory
|
|
ansible.builtin.file:
|
|
path: /var/lib/morphit-matrix-bot
|
|
state: directory
|
|
owner: morphit-matrix-bot
|
|
group: morphit-matrix-bot
|
|
mode: '0750'
|
|
|
|
- name: Write matrix-bot env file
|
|
ansible.builtin.template:
|
|
src: matrix-bot.env.j2
|
|
dest: /etc/morphit/matrix-bot.env
|
|
owner: root
|
|
group: morphit-matrix-bot
|
|
mode: '0640'
|
|
notify: Restart morphit-matrix-bot
|
|
|
|
- name: Install matrix-bot systemd unit
|
|
ansible.builtin.copy:
|
|
src: /opt/morphit/ops/systemd/morphit-matrix-bot.service
|
|
dest: /etc/systemd/system/morphit-matrix-bot.service
|
|
owner: root
|
|
group: root
|
|
mode: '0644'
|
|
remote_src: true
|
|
notify:
|
|
- Reload systemd
|
|
- Restart morphit-matrix-bot
|
|
|
|
- name: Verify better-sqlite3 native bindings built
|
|
# better-sqlite3 compiles at npm-install time. If the morphit
|
|
# role's `npm ci` ran while the deploy box couldn't reach
|
|
# nodejs.org, the build silently produces no .node binary and
|
|
# the bot crashes at startup.
|
|
ansible.builtin.stat:
|
|
path: /opt/morphit/node_modules/better-sqlite3/build/Release/better_sqlite3.node
|
|
register: matrix_bot_bs3_build
|
|
|
|
- name: Fail with clear hint if better-sqlite3 binding missing
|
|
ansible.builtin.fail:
|
|
msg: |
|
|
better-sqlite3 native bindings are not built at
|
|
/opt/morphit/node_modules/better-sqlite3/build/Release/.
|
|
The matrix-bot will crash on startup without them.
|
|
|
|
Fix on the target host:
|
|
cd /opt/morphit
|
|
sudo -u morphit npm rebuild better-sqlite3
|
|
|
|
Common causes:
|
|
- build-essential / python3 not installed
|
|
- outbound HTTPS to nodejs.org sealed off by firewall
|
|
- npm install previously ran with --ignore-scripts
|
|
|
|
See docs/OPERATIONS.md §16 "matrix-bot setup" for details.
|
|
when: not matrix_bot_bs3_build.stat.exists
|
|
|
|
- name: Enable + start morphit-matrix-bot
|
|
ansible.builtin.systemd:
|
|
name: morphit-matrix-bot
|
|
enabled: true
|
|
state: started
|
|
daemon_reload: true
|