Add Traefik labels for handling authenticated media (MSC3916) in matrix-media-repo

Related to:

- #3409
- https://github.com/t2bot/matrix-media-repo/releases/tag/v1.3.5
- matrix-org/matrix-spec-proposals#3916

Support for authenticated media routes is enabled by default, but
variables are in place to disable it if necessary.

This change has not been tested.

Author: spantaleev

group_vars/matrix_servers

@@ -3604,6 +3604,9 @@ matrix_media_repo_container_labels_traefik_tls_certResolver: "{{ devture_traefik
 matrix_media_repo_container_labels_traefik_internal_media_enabled: "{{ matrix_playbook_internal_matrix_client_api_traefik_entrypoint_enabled }}"
 matrix_media_repo_container_labels_traefik_internal_media_entrypoints: "{{ matrix_playbook_internal_matrix_client_api_traefik_entrypoint_name }}"
 
+matrix_media_repo_container_labels_traefik_internal_matrix_client_media_enabled: "{{ matrix_playbook_internal_matrix_client_api_traefik_entrypoint_enabled }}"
+matrix_media_repo_container_labels_traefik_internal_matrix_client_media_entrypoints: "{{ matrix_playbook_internal_matrix_client_api_traefik_entrypoint_name }}"
+
 matrix_media_repo_database_hostname: "{{ devture_postgres_connection_hostname if devture_postgres_enabled else '' }}"
 matrix_media_repo_database_username: matrix_media_repo
 matrix_media_repo_database_password: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'mediarepo.db', rounds=655555) | to_uuid }}"

roles/custom/matrix-media-repo/defaults/main.yml

@@ -65,71 +65,112 @@ matrix_media_repo_container_labels_traefik_enabled: true
 matrix_media_repo_container_labels_traefik_docker_network: "{{ matrix_media_repo_container_network }}"
 matrix_media_repo_container_labels_traefik_entrypoints: web-secure
 
+# Traefik labels handling the old `/_matrix/media` endpoints on the Client-API (web-secure) entrypoint.
+# These are being superseded by `/_matrix/client/VERSION/media` endpoints - see `matrix_media_repo_container_labels_traefik_client_matrix_client_media_*`.
 matrix_media_repo_container_labels_traefik_media_path_prefix: "/_matrix/media"
 matrix_media_repo_container_labels_traefik_media_rule: "Host(`{{ matrix_server_fqn_matrix }}`) && PathPrefix(`{{ matrix_media_repo_container_labels_traefik_media_path_prefix | quote }}`)"
 matrix_media_repo_container_labels_traefik_media_priority: 0
 matrix_media_repo_container_labels_traefik_media_entrypoints: "{{ matrix_media_repo_container_labels_traefik_entrypoints }}"
 matrix_media_repo_container_labels_traefik_media_tls: "{{ matrix_media_repo_container_labels_traefik_media_entrypoints != 'web' }}"
 matrix_media_repo_container_labels_traefik_media_tls_certResolver: default  # noqa var-naming
 
+# Traefik labels handling the new `/_matrix/client/VERSION/media` endpoints on the Client-API (web-secure) entrypoint.
+# See: https://github.com/matrix-org/matrix-spec-proposals/pull/3916
+matrix_media_repo_container_labels_traefik_client_matrix_client_media_enabled: true
+matrix_media_repo_container_labels_traefik_client_matrix_client_media_path_regexp: "/_matrix/client/(?P<version>(v1))/media"
+matrix_media_repo_container_labels_traefik_client_matrix_client_media_rule: "Host(`{{ matrix_server_fqn_matrix }}`) && PathRegexp(`{{ matrix_media_repo_container_labels_traefik_client_matrix_client_media_path_regexp | quote }}`)"
+matrix_media_repo_container_labels_traefik_client_matrix_client_media_priority: 0
+matrix_media_repo_container_labels_traefik_client_matrix_client_media_entrypoints: "{{ matrix_media_repo_container_labels_traefik_entrypoints }}"
+matrix_media_repo_container_labels_traefik_client_matrix_client_media_tls: "{{ matrix_media_repo_container_labels_traefik_client_matrix_client_media_entrypoints != 'web' }}"
+matrix_media_repo_container_labels_traefik_client_matrix_client_media_tls_certResolver: default  # noqa var-naming
+
+# Traefik labels handling the old `/_matrix/media` endpoints on the internal entrypoint.
 # This is like `matrix_media_repo_container_labels_traefik_media_*`, but on an internal Traefik entrypoint.
+# These are being superseded by `/_matrix/client/VERSION/media` endpoints - see `matrix_media_repo_container_labels_traefik_internal_matrix_client_media_*`.
 matrix_media_repo_container_labels_traefik_internal_media_enabled: false
 matrix_media_repo_container_labels_traefik_internal_media_path_prefix: "{{ matrix_media_repo_container_labels_traefik_media_path_prefix }}"
 matrix_media_repo_container_labels_traefik_internal_media_rule: "PathPrefix(`{{ matrix_media_repo_container_labels_traefik_internal_media_path_prefix | quote }}`)"
 matrix_media_repo_container_labels_traefik_internal_media_priority: "{{ matrix_media_repo_container_labels_traefik_media_priority }}"
 matrix_media_repo_container_labels_traefik_internal_media_entrypoints: ""
 
-# /_matrix/client/r0/logout
-# /_matrix/client/r0/logout/all
+# Traefik labels handling the new `/_matrix/client/VERSION/media` endpoints on the internal entrypoint.
+# See: https://github.com/matrix-org/matrix-spec-proposals/pull/3916
+matrix_media_repo_container_labels_traefik_internal_matrix_client_media_enabled: false
+matrix_media_repo_container_labels_traefik_internal_matrix_client_media_path_regexp: "{{ matrix_media_repo_container_labels_traefik_client_matrix_client_media_path_regexp }}"
+matrix_media_repo_container_labels_traefik_internal_matrix_client_media_rule: "PathRegexp(`{{ matrix_media_repo_container_labels_traefik_internal_matrix_client_media_path_regexp | quote }}`)"
+matrix_media_repo_container_labels_traefik_internal_matrix_client_media_priority: "{{ matrix_media_repo_container_labels_traefik_client_matrix_client_media_priority }}"
+matrix_media_repo_container_labels_traefik_internal_matrix_client_media_entrypoints: ""
+
+# Traefik labels handling some additional routes on the Client-API (web-secure) entrypoint:
+# - /_matrix/client/r0/logout
+# - /_matrix/client/r0/logout/all
 matrix_media_repo_container_labels_traefik_logout_path_regexp: "^/_matrix/client/(?P<version>r0|v1|v3|unstable)/(?P<endpoint>logout|logout/all)"
 matrix_media_repo_container_labels_traefik_logout_rule: "Host(`{{ matrix_server_fqn_matrix }}`) && PathRegexp(`{{ matrix_media_repo_container_labels_traefik_logout_path_regexp }}`)"
 matrix_media_repo_container_labels_traefik_logout_priority: 0
 matrix_media_repo_container_labels_traefik_logout_entrypoints: "{{ matrix_media_repo_container_labels_traefik_entrypoints }}"
 matrix_media_repo_container_labels_traefik_logout_tls: "{{ matrix_media_repo_container_labels_traefik_logout_entrypoints != 'web' }}"
 matrix_media_repo_container_labels_traefik_logout_tls_certResolver: default  # noqa var-naming
 
-# /_matrix/client/r0/admin/purge_media_cache
-# /_matrix/client/r0/admin/quarantine_media/{roomId:[^/]+}
+# Traefik labels handling some additional routes on the Client-API (web-secure) entrypoint:
+# - /_matrix/client/r0/admin/purge_media_cache
+# - /_matrix/client/r0/admin/quarantine_media/{roomId:[^/]+}
 matrix_media_repo_container_labels_traefik_admin_path_regexp: "^/_matrix/client/(?P<version>(r0|v1|v3|unstable))/admin/(?P<endpoint>(purge_media_cache|quarantine_media/.*))"
 matrix_media_repo_container_labels_traefik_admin_rule: "Host(`{{ matrix_server_fqn_matrix }}`) && PathRegexp(`{{ matrix_media_repo_container_labels_traefik_admin_path_regexp }}`)"
 matrix_media_repo_container_labels_traefik_admin_priority: 0
 matrix_media_repo_container_labels_traefik_admin_entrypoints: "{{ matrix_media_repo_container_labels_traefik_entrypoints }}"
 matrix_media_repo_container_labels_traefik_admin_tls: "{{ matrix_media_repo_container_labels_traefik_admin_entrypoints != 'web' }}"
 matrix_media_repo_container_labels_traefik_admin_tls_certResolver: default  # noqa var-naming
 
+# Traefik labels handling some additional routes on the Client-API (web-secure) entrypoint:
+# - /_matrix/client/unstable/io.t2bot.media
 matrix_media_repo_container_labels_traefik_t2bot_path_prefix: "/_matrix/client/unstable/io.t2bot.media"
 matrix_media_repo_container_labels_traefik_t2bot_rule: "Host(`{{ matrix_server_fqn_matrix }}`) && PathPrefix(`{{ matrix_media_repo_container_labels_traefik_t2bot_path_prefix | quote }}`)"
 matrix_media_repo_container_labels_traefik_t2bot_priority: 0
 matrix_media_repo_container_labels_traefik_t2bot_entrypoints: "{{ matrix_media_repo_container_labels_traefik_entrypoints }}"
 matrix_media_repo_container_labels_traefik_t2bot_tls: "{{ matrix_media_repo_container_labels_traefik_t2bot_entrypoints != 'web' }}"
 matrix_media_repo_container_labels_traefik_t2bot_tls_certResolver: default  # noqa var-naming
 
-# Traefik federation labels
+# Traefik labels handling the old `/_matrix/media` endpoints on the federation entrypint.
+# These are being superseded by `/_matrix/federation/VERSION/media` endpoints - see `matrix_media_repo_container_labels_traefik_federation_matrix_federation_media_*`.
 matrix_media_repo_container_labels_traefik_media_federation_path_prefix: "/_matrix/media"
 matrix_media_repo_container_labels_traefik_media_federation_rule: "Host(`{{ matrix_server_fqn_matrix }}`) && PathPrefix(`{{ matrix_media_repo_container_labels_traefik_media_path_prefix | quote }}`)"
 matrix_media_repo_container_labels_traefik_media_federation_priority: 0
 matrix_media_repo_container_labels_traefik_media_federation_entrypoints: "{{ matrix_federation_traefik_entrypoint_name }}"
 matrix_media_repo_container_labels_traefik_media_federation_tls: "{{ matrix_media_repo_container_labels_traefik_media_entrypoints != 'web' }}"
 matrix_media_repo_container_labels_traefik_media_federation_tls_certResolver: default  # noqa var-naming
 
-# /_matrix/client/r0/logout
-# /_matrix/client/r0/logout/all
+# Traefik labels handling the new `/_matrix/federation/VERSION/media` endpoints on the federation entrypint.
+# See: https://github.com/matrix-org/matrix-spec-proposals/pull/3916
+matrix_media_repo_container_labels_traefik_federation_matrix_federation_media_enabled: true
+matrix_media_repo_container_labels_traefik_federation_matrix_federation_media_path_regexp: "/_matrix/federation/(?P<version>(v1))/media"
+matrix_media_repo_container_labels_traefik_federation_matrix_federation_media_rule: "Host(`{{ matrix_server_fqn_matrix }}`) && PathRegexp(`{{ matrix_media_repo_container_labels_traefik_federation_matrix_federation_media_path_regexp | quote }}`)"
+matrix_media_repo_container_labels_traefik_federation_matrix_federation_media_priority: 0
+matrix_media_repo_container_labels_traefik_federation_matrix_federation_media_entrypoints: "{{ matrix_federation_traefik_entrypoint_name }}"
+matrix_media_repo_container_labels_traefik_federation_matrix_federation_media_tls: "{{ matrix_media_repo_container_labels_traefik_federation_matrix_federation_media_entrypoints != 'web' }}"
+matrix_media_repo_container_labels_traefik_federation_matrix_federation_media_tls_certResolver: default  # noqa var-naming
+
+# Traefik labels handling some additional routes on the federation entrypoint:
+# - /_matrix/client/r0/logout
+# - /_matrix/client/r0/logout/all
 matrix_media_repo_container_labels_traefik_logout_federation_path_regexp: "{{ matrix_media_repo_container_labels_traefik_logout_path_regexp }}"
 matrix_media_repo_container_labels_traefik_logout_federation_rule: "Host(`{{ matrix_server_fqn_matrix }}`) && PathRegexp(`{{ matrix_media_repo_container_labels_traefik_logout_federation_path_regexp }}`)"
 matrix_media_repo_container_labels_traefik_logout_federation_priority: 0
 matrix_media_repo_container_labels_traefik_logout_federation_entrypoints: "{{ matrix_federation_traefik_entrypoint_name }}"
 matrix_media_repo_container_labels_traefik_logout_federation_tls: "{{ matrix_media_repo_container_labels_traefik_logout_entrypoints != 'web' }}"
 matrix_media_repo_container_labels_traefik_logout_federation_tls_certResolver: default  # noqa var-naming
 
-# /_matrix/client/r0/admin/purge_media_cache
-# /_matrix/client/r0/admin/quarantine_media/{roomId:[^/]+}
+# Traefik labels handling some additional routes on the federation entrypoint:
+# - /_matrix/client/r0/admin/purge_media_cache
+# - /_matrix/client/r0/admin/quarantine_media/{roomId:[^/]+}
 matrix_media_repo_container_labels_traefik_admin_federation_path_regexp: "{{ matrix_media_repo_container_labels_traefik_admin_path_regexp }}"
 matrix_media_repo_container_labels_traefik_admin_federation_rule: "Host(`{{ matrix_server_fqn_matrix }}`) && PathRegexp(`{{ matrix_media_repo_container_labels_traefik_admin_federation_path_regexp }}`)"
 matrix_media_repo_container_labels_traefik_admin_federation_priority: 0
 matrix_media_repo_container_labels_traefik_admin_federation_entrypoints: "{{ matrix_federation_traefik_entrypoint_name }}"
 matrix_media_repo_container_labels_traefik_admin_federation_tls: "{{ matrix_media_repo_container_labels_traefik_admin_entrypoints != 'web' }}"
 matrix_media_repo_container_labels_traefik_admin_federation_tls_certResolver: default  # noqa var-naming
 
+# Traefik labels handling some additional routes on the federation entrypoint:
+# - /_matrix/client/unstable/io.t2bot.media
 matrix_media_repo_container_labels_traefik_t2bot_federation_path_prefix: "/_matrix/client/unstable/io.t2bot.media"
 matrix_media_repo_container_labels_traefik_t2bot_federation_rule: "Host(`{{ matrix_server_fqn_matrix }}`) && PathPrefix(`{{ matrix_media_repo_container_labels_traefik_t2bot_path_prefix | quote }}`)"
 matrix_media_repo_container_labels_traefik_t2bot_federation_priority: 0

roles/custom/matrix-media-repo/tasks/validate_config.yml

@@ -8,6 +8,7 @@
   with_items:
     - {'name': 'matrix_media_repo_database_hostname', when: true}
     - {'name': 'matrix_media_repo_container_labels_traefik_internal_media_entrypoints', when: "{{ matrix_media_repo_container_labels_traefik_internal_media_enabled }}"}
+    - {'name': 'matrix_media_repo_container_labels_traefik_internal_matrix_client_media_entrypoints', when: "{{ matrix_media_repo_container_labels_traefik_internal_matrix_client_media_enabled }}"}
 
 - name: (Deprecation) Catch and report renamed matrix-media-repo settings
   ansible.builtin.fail: