Skip to content
This repository was archived by the owner on Apr 26, 2024. It is now read-only.

Commit 24fec63

Browse files
richvdhrichvdh
committed
Move complement setup stuff into the Synapse repo
1 parent ae01a7e commit 24fec63

File tree

11 files changed

+428
-29
lines changed

11 files changed

+428
-29
lines changed

‎.github/workflows/tests.yml

+1-17
Original file line numberDiff line numberDiff line change
@@ -361,27 +361,11 @@ jobs:
361361
(wget -O - "https://github.com/matrix-org/complement/archive/$BRANCH_NAME.tar.gz" | tar -xz --strip-components=1 -C complement) && break
362362
done
363363
364-
# Build initial Synapse image
365-
- run: docker build -t matrixdotorg/synapse:latest -f docker/Dockerfile .
366-
working-directory: synapse
367-
env:
368-
DOCKER_BUILDKIT: 1
369-
370-
# Build a ready-to-run Synapse image based on the initial image above.
371-
# This new image includes a config file, keys for signing and TLS, and
372-
# other settings to make it suitable for testing under Complement.
373-
- run: docker build -t complement-synapse -f Synapse.Dockerfile .
374-
working-directory: complement/dockerfiles
375-
376-
# Run Complement
377364
- run: |
378365
set -o pipefail
379-
go test -v -json -tags synapse_blacklist,msc2716,msc3030 ./tests/... 2>&1 | gotestfmt
366+
COMPLEMENT_DIR=`pwd`/complement synapse/scripts-dev/complement.sh -json 2>&1 | gotestfmt
380367
shell: bash
381368
name: Run Complement Tests
382-
env:
383-
COMPLEMENT_BASE_IMAGE: complement-synapse:latest
384-
working-directory: complement
385369
386370
# a job which marks all the other jobs as complete, thus allowing PRs to be merged.
387371
tests-done:

‎changelog.d/12404.misc

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
Add files used to build the Docker image used for complement testing into the Synapse repository.

‎docker/complement/Dockerfile

+22
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
# A dockerfile which builds an image suitable for testing Synapse under
2+
# complement.
3+
4+
ARG SYNAPSE_VERSION=latest
5+
6+
FROM matrixdotorg/synapse:${SYNAPSE_VERSION}
7+
8+
ENV SERVER_NAME=localhost
9+
10+
COPY conf/* /conf/
11+
12+
# generate a signing key
13+
RUN generate_signing_key -o /conf/server.signing.key
14+
15+
WORKDIR /data
16+
17+
EXPOSE 8008 8448
18+
19+
ENTRYPOINT ["/conf/start.sh"]
20+
21+
HEALTHCHECK --start-period=5s --interval=1s --timeout=1s \
22+
CMD curl -fSs http://localhost:8008/health || exit 1

‎docker/complement/README.md

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
Stuff for building the docker image used for testing under complement.

‎docker/complement/SynapseWorkers.Dockerfile

+73
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,73 @@
1+
# This dockerfile builds on top of 'docker/Dockerfile-worker' in matrix-org/synapse
2+
# by including a built-in postgres instance, as well as setting up the homeserver so
3+
# that it is ready for testing via Complement.
4+
#
5+
# Instructions for building this image from those it depends on is detailed in this guide:
6+
# https://github.com/matrix-org/synapse/blob/develop/docker/README-testing.md#testing-with-postgresql-and-single-or-multi-process-synapse
7+
FROM matrixdotorg/synapse-workers
8+
9+
# Download a caddy server to stand in front of nginx and terminate TLS using Complement's
10+
# custom CA.
11+
# We include this near the top of the file in order to cache the result.
12+
RUN curl -OL "https://github.com/caddyserver/caddy/releases/download/v2.3.0/caddy_2.3.0_linux_amd64.tar.gz" && \
13+
tar xzf caddy_2.3.0_linux_amd64.tar.gz && rm caddy_2.3.0_linux_amd64.tar.gz && mv caddy /root
14+
15+
# Install postgresql
16+
RUN apt-get update
17+
RUN apt-get install -y postgresql
18+
19+
# Configure a user and create a database for Synapse
20+
RUN pg_ctlcluster 13 main start && su postgres -c "echo \
21+
\"ALTER USER postgres PASSWORD 'somesecret'; \
22+
CREATE DATABASE synapse \
23+
ENCODING 'UTF8' \
24+
LC_COLLATE='C' \
25+
LC_CTYPE='C' \
26+
template=template0;\" | psql" && pg_ctlcluster 13 main stop
27+
28+
# Modify the shared homeserver config with postgres support, certificate setup
29+
# and the disabling of rate-limiting
30+
COPY conf-workers/workers-shared.yaml /conf/workers/shared.yaml
31+
32+
WORKDIR /data
33+
34+
# Copy the caddy config
35+
COPY conf-workers/caddy.complement.json /root/caddy.json
36+
37+
# Expose caddy's listener ports
38+
EXPOSE 8008 8448
39+
40+
ENTRYPOINT \
41+
# Replace the server name in the caddy config
42+
sed -i "s/{{ server_name }}/${SERVER_NAME}/g" /root/caddy.json && \
43+
# Start postgres
44+
pg_ctlcluster 13 main start 2>&1 && \
45+
# Start caddy
46+
/root/caddy start --config /root/caddy.json 2>&1 && \
47+
# Set the server name of the homeserver
48+
SYNAPSE_SERVER_NAME=${SERVER_NAME} \
49+
# No need to report stats here
50+
SYNAPSE_REPORT_STATS=no \
51+
# Set postgres authentication details which will be placed in the homeserver config file
52+
POSTGRES_PASSWORD=somesecret POSTGRES_USER=postgres POSTGRES_HOST=localhost \
53+
# Specify the workers to test with
54+
SYNAPSE_WORKER_TYPES="\
55+
event_persister, \
56+
event_persister, \
57+
background_worker, \
58+
frontend_proxy, \
59+
event_creator, \
60+
user_dir, \
61+
media_repository, \
62+
federation_inbound, \
63+
federation_reader, \
64+
federation_sender, \
65+
synchrotron, \
66+
appservice, \
67+
pusher" \
68+
# Run the script that writes the necessary config files and starts supervisord, which in turn
69+
# starts everything else
70+
/configure_workers_and_start.py
71+
72+
HEALTHCHECK --start-period=5s --interval=1s --timeout=1s \
73+
CMD /bin/sh /healthcheck.sh

‎docker/complement/conf-workers/caddy.complement.json

+72
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
{
2+
"apps": {
3+
"http": {
4+
"servers": {
5+
"srv0": {
6+
"listen": [
7+
":8448"
8+
],
9+
"routes": [
10+
{
11+
"match": [
12+
{
13+
"host": [
14+
"{{ server_name }}"
15+
]
16+
}
17+
],
18+
"handle": [
19+
{
20+
"handler": "subroute",
21+
"routes": [
22+
{
23+
"handle": [
24+
{
25+
"handler": "reverse_proxy",
26+
"upstreams": [
27+
{
28+
"dial": "localhost:8008"
29+
}
30+
]
31+
}
32+
]
33+
}
34+
]
35+
}
36+
],
37+
"terminal": true
38+
}
39+
]
40+
}
41+
}
42+
},
43+
"tls": {
44+
"automation": {
45+
"policies": [
46+
{
47+
"subjects": [
48+
"{{ server_name }}"
49+
],
50+
"issuers": [
51+
{
52+
"module": "internal"
53+
}
54+
],
55+
"on_demand": true
56+
}
57+
]
58+
}
59+
},
60+
"pki": {
61+
"certificate_authorities": {
62+
"local": {
63+
"name": "Complement CA",
64+
"root": {
65+
"certificate": "/complement/ca/ca.crt",
66+
"private_key": "/complement/ca/ca.key"
67+
}
68+
}
69+
}
70+
}
71+
}
72+
}

‎docker/complement/conf-workers/workers-shared.yaml

+77
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,77 @@
1+
## Server ##
2+
report_stats: False
3+
trusted_key_servers: []
4+
enable_registration: true
5+
enable_registration_without_verification: true
6+
bcrypt_rounds: 4
7+
8+
## Federation ##
9+
10+
# disable verification of federation certificates
11+
#
12+
# TODO: Figure out why this is still needed even though we are making use of the custom CA
13+
federation_verify_certificates: false
14+
15+
# trust certs signed by Complement's CA
16+
federation_custom_ca_list:
17+
- /complement/ca/ca.crt
18+
19+
# unblacklist RFC1918 addresses
20+
federation_ip_range_blacklist: []
21+
22+
# Disable server rate-limiting
23+
rc_federation:
24+
window_size: 1000
25+
sleep_limit: 10
26+
sleep_delay: 500
27+
reject_limit: 99999
28+
concurrent: 3
29+
30+
rc_message:
31+
per_second: 9999
32+
burst_count: 9999
33+
34+
rc_registration:
35+
per_second: 9999
36+
burst_count: 9999
37+
38+
rc_login:
39+
address:
40+
per_second: 9999
41+
burst_count: 9999
42+
account:
43+
per_second: 9999
44+
burst_count: 9999
45+
failed_attempts:
46+
per_second: 9999
47+
burst_count: 9999
48+
49+
rc_admin_redaction:
50+
per_second: 9999
51+
burst_count: 9999
52+
53+
rc_joins:
54+
local:
55+
per_second: 9999
56+
burst_count: 9999
57+
remote:
58+
per_second: 9999
59+
burst_count: 9999
60+
61+
federation_rr_transactions_per_room_per_second: 9999
62+
63+
## Experimental Features ##
64+
65+
experimental_features:
66+
# Enable history backfilling support
67+
msc2716_enabled: true
68+
# Enable spaces support
69+
spaces_enabled: true
70+
# Enable jump to date endpoint
71+
msc3030_enabled: true
72+
73+
server_notices:
74+
system_mxid_localpart: _server
75+
system_mxid_display_name: "Server Alert"
76+
system_mxid_avatar_url: ""
77+
room_name: "Server Alert"

0 commit comments

Comments
 (0)