Add synapse role

For all the hipster kids.

roles/synapse/templates/homeserver.yaml.j2

@@ -0,0 +1,60 @@
+server_name: "{{ password.server_name }}"
+public_baseurl: "https://{{ dns_name }}"
+report_stats: false
+
+log_config: "/etc/synapse/{{ password.server_name }}.log.config"
+signing_key_path: "/etc/synapse/{{ password.server_name }}.signing.key"
+media_store_path: /var/lib/synapse/media_store
+pid_file: /var/lib/synapse/homeserver.pid
+
+listeners:
+  - path: /var/lib/synapse/socket/main.sock
+    type: http
+    x_forwarded: true
+    resources:
+      - names: [client, federation]
+        compress: false
+
+database:
+  name: psycopg2
+  args:
+    #user: <user>
+    #password: <pass>
+    #dbname: <db>
+    host: localhost
+    cp_min: 5
+    cp_max: 10
+
+presence:
+  enabled: false
+
+#trusted_key_servers:
+#  - server_name: "matrix.org"
+
+oidc_providers:
+  - idp_id: microsoft
+    idp_name: {{ password.oidc_name }}
+    issuer: "{{ password.oidc_url }}/v2.0"
+    client_id: "{{ password.oidc_client_id }}"
+    client_secret: "{{ password.oidc_client_secret }}"
+    scopes: ["openid", "profile"]
+    authorization_endpoint: "{{ password.oidc_url }}/oauth2/v2.0/authorize"
+    token_endpoint: "{{ password.oidc_url }}/oauth2/v2.0/token"
+    userinfo_endpoint: "{{ password.oidc_userinfo_endpoint }}"
+
+    user_mapping_provider:
+      config:
+{% raw %}
+        localpart_template: "{{ user.preferred_username.split('@')[0] }}"
+        display_name_template: "{{ user.name }}"
+{% endraw %}
+
+{% for secret in ["form_secret", "macaroon_secret_key", "registration_shared_secret"] %}
+{{ secret }}: "
+{%- if secret in config -%}
+{{ config[secret] }}
+{%- else -%}
+{{ lookup("password", "/dev/null", length=64, chars=["ascii_letters", "digits"]) }}
+{%- endif -%}
+"
+{% endfor %}

roles/synapse/templates/log.config.j2

@@ -0,0 +1,37 @@
+# [2]: https://matrix-org.github.io/synapse/latest/structured_logging.html
+
+version: 1
+formatters:
+    precise:
+        format: '%(asctime)s - %(name)s - %(lineno)d - %(levelname)s - %(request)s - %(message)s'
+
+handlers:
+    file:
+        class: logging.handlers.TimedRotatingFileHandler
+        formatter: precise
+        filename: /var/lib/synapse/{{ password.server_name }}.log
+        when: midnight
+        backupCount: 3  # Does not include the current log file.
+        encoding: utf8
+
+    buffer:
+        class: synapse.logging.handlers.PeriodicallyFlushingMemoryHandler
+        target: file
+
+        capacity: 10
+        flushLevel: 30  # Flush immediately for WARNING logs and higher
+        period: 5
+
+    console:
+        class: logging.StreamHandler
+        formatter: precise
+
+loggers:
+    synapse.storage.SQL:
+        level: INFO
+
+root:
+    level: INFO
+    handlers: [buffer]
+
+disable_existing_loggers: false

roles/synapse/templates/nginx.conf.j2

@@ -0,0 +1,20 @@
+server {
+    server_name {{ dns_name }};
+
+    listen [::]:443 ssl ipv6only=off;
+    ssl_certificate /etc/letsencrypt/live/{{ dns_name }}/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/{{ dns_name }}/privkey.pem;
+
+    location ~ ^(/_matrix|/_synapse/client) {
+        proxy_pass http://unix:/var/lib/synapse/socket/main.sock;
+        proxy_set_header X-Forwarded-For $remote_addr;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header Host $host;
+
+        # match max_upload_size defined in homeserver.yaml
+        client_max_body_size 50M;
+
+        # Synapse responses may be chunked, which is an HTTP/1.1 feature.
+        proxy_http_version 1.1;
+    }
+}