add podman matrix
This commit is contained in:
3
active/podman_matrix/compose/README.md
Normal file
3
active/podman_matrix/compose/README.md
Normal file
@@ -0,0 +1,3 @@
|
||||
# Compose
|
||||
|
||||
Put your compose.yaml here.
|
||||
28
active/podman_matrix/compose/compose.yaml
Normal file
28
active/podman_matrix/compose/compose.yaml
Normal file
@@ -0,0 +1,28 @@
|
||||
# tuwunel
|
||||
|
||||
services:
|
||||
matrix:
|
||||
image: ghcr.io/matrix-construct/tuwunel:latest
|
||||
restart: unless-stopped
|
||||
ports:
|
||||
- 8448:6167
|
||||
volumes:
|
||||
- /home/matrix/tuwunel-db:/var/lib/tuwunel
|
||||
#- ./tuwunel.toml:/etc/tuwunel.toml
|
||||
security_opt:
|
||||
- "label=disable"
|
||||
userns_mode: keep-id
|
||||
environment:
|
||||
TUWUNEL_SERVER_NAME: matrix.reeseapps.com # EDIT THIS
|
||||
TUWUNEL_DATABASE_PATH: /var/lib/tuwunel
|
||||
TUWUNEL_PORT: 6167
|
||||
TUWUNEL_MAX_REQUEST_SIZE: 200000000 # in bytes, ~200 MB
|
||||
TUWUNEL_ALLOW_REGISTRATION: 'false'
|
||||
# TUWUNEL_REGISTRATION_TOKEN: 'YOUR_TOKEN' # A registration token is required when registration is allowed.
|
||||
#TUWUNEL_YES_I_AM_VERY_VERY_SURE_I_WANT_AN_OPEN_REGISTRATION_SERVER_PRONE_TO_ABUSE: 'true'
|
||||
TUWUNEL_ALLOW_FEDERATION: 'true'
|
||||
TUWUNEL_ALLOW_CHECK_FOR_UPDATES: 'true'
|
||||
TUWUNEL_TRUSTED_SERVERS: '["matrix.org"]'
|
||||
#TUWUNEL_LOG: warn,state_res=warn
|
||||
TUWUNEL_ADDRESS: 0.0.0.0
|
||||
#TUWUNEL_CONFIG: '/etc/tuwunel.toml' # Uncomment if you mapped config toml above
|
||||
145
active/podman_matrix/matrix.md
Normal file
145
active/podman_matrix/matrix.md
Normal file
@@ -0,0 +1,145 @@
|
||||
# Podman matrix
|
||||
|
||||
- [Podman matrix](#podman-matrix)
|
||||
- [Setup matrix Project](#setup-matrix-project)
|
||||
- [Install matrix](#install-matrix)
|
||||
- [Create the matrix user](#create-the-matrix-user)
|
||||
- [Write the matrix compose spec](#write-the-matrix-compose-spec)
|
||||
- [A Note on Volumes](#a-note-on-volumes)
|
||||
- [Convert matrix compose spec to quadlets](#convert-matrix-compose-spec-to-quadlets)
|
||||
- [Setup matrix users](#setup-matrix-users)
|
||||
- [Expose matrix](#expose-matrix)
|
||||
- [firewalld](#firewalld)
|
||||
- [Backup matrix](#backup-matrix)
|
||||
- [Upgrade matrix](#upgrade-matrix)
|
||||
- [Upgrade Quadlets](#upgrade-quadlets)
|
||||
- [Notes](#notes)
|
||||
- [SELinux](#selinux)
|
||||
|
||||
## Setup matrix Project
|
||||
|
||||
- [x] Copy and rename this folder to active/podman_matrix
|
||||
- [x] Find and replace matrix with the name of the service.
|
||||
- [x] Create the rootless user to run the podman containers
|
||||
- [x] Write the compose.yaml spec for your service
|
||||
- [x] Convert the compose.yaml spec to a quadlet
|
||||
- [x] Install the quadlet on the podman server
|
||||
- [ ] Expose the quadlet service
|
||||
- [ ] Install a backup service and timer
|
||||
|
||||
## Install matrix
|
||||
|
||||
### Create the matrix user
|
||||
|
||||
```bash
|
||||
# SSH into your podman server as root
|
||||
useradd matrix
|
||||
loginctl enable-linger $(id -u matrix)
|
||||
systemctl --user --machine=matrix@.host enable podman-restart
|
||||
systemctl --user --machine=matrix@.host enable --now podman.socket
|
||||
mkdir -p /home/matrix/.config/containers/systemd
|
||||
```
|
||||
|
||||
### Write the matrix compose spec
|
||||
|
||||
Edit the compose.yaml at active/matrix/compose/compose.yaml
|
||||
|
||||
#### A Note on Volumes
|
||||
|
||||
Named volumes are stored at `~/.local/share/containers/storage/volumes/`.
|
||||
|
||||
### Convert matrix compose spec to quadlets
|
||||
|
||||
On your local machine:
|
||||
|
||||
```bash
|
||||
# Generate the systemd service
|
||||
podman run \
|
||||
--security-opt label=disable \
|
||||
--rm \
|
||||
-v $(pwd)/active/podman_matrix/compose:/compose \
|
||||
-v $(pwd)/active/podman_matrix/quadlets:/quadlets \
|
||||
quay.io/k9withabone/podlet \
|
||||
-f /quadlets \
|
||||
-i \
|
||||
--overwrite \
|
||||
compose /compose/compose.yaml
|
||||
|
||||
# Copy the files to the server
|
||||
scp -r active/podman_matrix/quadlets/. matrix:~/.config/containers/systemd/
|
||||
|
||||
# Copy the compose files to the server
|
||||
scp -r active/podman_matrix/compose/. matrix:~/.config//
|
||||
```
|
||||
|
||||
```bash
|
||||
ssh matrix systemctl --user daemon-reload
|
||||
ssh matrix systemctl --user restart matrix
|
||||
# Enables auto-update service which will pull new container images automatically every day
|
||||
ssh matrix systemctl --user enable --now podman-auto-update.timer
|
||||
```
|
||||
|
||||
### Setup matrix users
|
||||
|
||||
```bash
|
||||
podman run \
|
||||
-v /home/matrix/tuwunel-db:/var/lib/tuwunel:Z \
|
||||
-e TUWUNEL_SERVER_NAME=matrix.reeseapps.com \
|
||||
-e TUWUNEL_DATABASE_PATH=/var/lib/tuwunel \
|
||||
--userns=keep-id \
|
||||
--
|
||||
-it \
|
||||
--rm \
|
||||
ghcr.io/matrix-construct/tuwunel:latest \
|
||||
--execute "users create_user ducoterra"
|
||||
```
|
||||
|
||||
### Expose matrix
|
||||
|
||||
1. If you need a domain, follow the [DDNS instructions](/active/podman_ddns/ddns.md#install-a-new-ddns-service)
|
||||
2. For a web service, follow the [Caddy instructions](/active/podman_caddy/caddy.md#adding-a-new-caddy-record)
|
||||
3. Finally, follow your OS's guide for opening ports via its firewall service.
|
||||
|
||||
#### firewalld
|
||||
|
||||
```bash
|
||||
# command to get current active zone and default zone
|
||||
firewall-cmd --get-active-zones
|
||||
firewall-cmd --get-default-zone
|
||||
|
||||
# command to open 443 on tcp
|
||||
firewall-cmd --permanent --zone=<zone> --add-port=443/tcp
|
||||
|
||||
# command to open 80 and 443 on tcp and udp
|
||||
firewall-cmd --permanent --zone=<zone> --add-port={80,443}/{tcp,udp}
|
||||
|
||||
# command to list available services and then open http and https
|
||||
firewall-cmd --get-services
|
||||
firewall-cmd --permanent --zone=<zone> --add-service={http,https}
|
||||
```
|
||||
|
||||
## Backup matrix
|
||||
|
||||
Follow the [Borg Backup instructions](/active/systemd_borg/borg.md#set-up-a-client-for-backup)
|
||||
|
||||
## Upgrade matrix
|
||||
|
||||
### Upgrade Quadlets
|
||||
|
||||
Upgrades should be a repeat of [writing the compose spec](#convert-compose-to-quadlet) and [installing the quadlets](#convert-compose-to-quadlet)
|
||||
|
||||
```bash
|
||||
scp -r quadlets/. matrix:~/.config/containers/systemd/
|
||||
ssh matrix systemctl --user daemon-reload
|
||||
ssh matrix systemctl --user restart matrix
|
||||
```
|
||||
|
||||
## Notes
|
||||
|
||||
### SELinux
|
||||
|
||||
<https://blog.christophersmart.com/2021/01/31/podman-volumes-and-selinux/>
|
||||
|
||||
:z allows a container to share a mounted volume with all other containers.
|
||||
|
||||
:Z allows a container to reserve a mounted volume and prevents any other container from accessing.
|
||||
3
active/podman_matrix/quadlets/README.md
Normal file
3
active/podman_matrix/quadlets/README.md
Normal file
@@ -0,0 +1,3 @@
|
||||
# Quadlets
|
||||
|
||||
Put your quadlets here.
|
||||
13
active/podman_matrix/quadlets/matrix.container
Normal file
13
active/podman_matrix/quadlets/matrix.container
Normal file
@@ -0,0 +1,13 @@
|
||||
[Container]
|
||||
Environment=TUWUNEL_SERVER_NAME=matrix.reeseapps.com TUWUNEL_DATABASE_PATH=/var/lib/tuwunel TUWUNEL_PORT=6167 TUWUNEL_MAX_REQUEST_SIZE=200000000 TUWUNEL_ALLOW_REGISTRATION=false TUWUNEL_ALLOW_FEDERATION=true TUWUNEL_ALLOW_CHECK_FOR_UPDATES=true TUWUNEL_TRUSTED_SERVERS=["matrix.org"] TUWUNEL_ADDRESS=0.0.0.0
|
||||
Image=ghcr.io/matrix-construct/tuwunel:latest
|
||||
PublishPort=8448:6167
|
||||
SecurityLabelDisable=true
|
||||
UserNS=keep-id
|
||||
Volume=/home/matrix/tuwunel-db:/var/lib/tuwunel
|
||||
|
||||
[Service]
|
||||
Restart=always
|
||||
|
||||
[Install]
|
||||
WantedBy=default.target
|
||||
Reference in New Issue
Block a user