Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

matrix-synapse: 0.34.1.1 -> 0.99.0 #55320

Merged
merged 7 commits into from Feb 7, 2019
Merged

matrix-synapse: 0.34.1.1 -> 0.99.0 #55320

merged 7 commits into from Feb 7, 2019

Conversation

@nyanloutre
Copy link
Member

@nyanloutre nyanloutre commented Feb 6, 2019

Motivation for this change

There is a new optional dependency to support automatic ACME certificate, maybe we should add this

Things done
  • Tested using sandboxing (nix.useSandbox on NixOS, or option sandbox in nix.conf on non-NixOS)
  • Built on platform(s)
    • NixOS
    • macOS
    • other Linux distributions
  • Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests)
  • Tested compilation of all pkgs that depend on this change using nix-shell -p nox --run "nox-review wip"
  • Tested execution of all binary files (usually in ./result/bin/)
  • Determined the impact on package closure size (by running nix path-info -S before and after)
  • Assured whether relevant documentation is up to date
  • Fits CONTRIBUTING.md.

@nyanloutre nyanloutre requested a review from FRidh as a code owner Feb 6, 2019
@Mic92
Copy link
Member

@Mic92 Mic92 commented Feb 6, 2019

Any details what is wrong with the tests at the moment?

@nyanloutre
Copy link
Member Author

@nyanloutre nyanloutre commented Feb 6, 2019

@Mic92 it seems /bin/homeserver no longer exists and python -m synapse.app.homeserver is used instead

@Mic92
Copy link
Member

@Mic92 Mic92 commented Feb 6, 2019

@nyanloutre ok. so our nixos service also needs to be adapted.
I mark this as WIP.

@Mic92 Mic92 changed the title matrix-synapse: 0.34.1.1 -> 0.99.0 [WIP] matrix-synapse: 0.34.1.1 -> 0.99.0 Feb 6, 2019
@nyanloutre nyanloutre requested a review from Infinisil as a code owner Feb 6, 2019
@nyanloutre
Copy link
Member Author

@nyanloutre nyanloutre commented Feb 6, 2019

I had to rewrote the test a bit because synapse will not generate self signed certificates anymore.
I did something similar to the etcd-cluster test where a CA and a rsa key are generated.

EDIT: the "removing the certificate generation from prestart" was a mistake, it is still generating useful keys

@nyanloutre nyanloutre changed the title [WIP] matrix-synapse: 0.34.1.1 -> 0.99.0 matrix-synapse: 0.34.1.1 -> 0.99.0 Feb 6, 2019
@nyanloutre
Copy link
Member Author

@nyanloutre nyanloutre commented Feb 6, 2019

@Mic92 my PR should be ready to merge, what do you think ?

@florianjacob
Copy link
Contributor

@florianjacob florianjacob commented Feb 6, 2019

While we are at updating the NixOS service, as synapse will require a valid certificate soon, might be a good idea to add the new certificate reloading via SIGHUP as ExecReload for the service for easy use with letsencrypt.

nixos/modules/services/misc/matrix-synapse.nix Outdated Show resolved Hide resolved
nixos/tests/matrix-synapse.nix Show resolved Hide resolved
nyanloutre added 2 commits Feb 6, 2019
launch synapse with the python executable because the startup script is
no longer available
This is used to load new certificates without restarting the service
@pstn
Copy link
Contributor

@pstn pstn commented Feb 6, 2019

I think this needs to be backported to stable. They announcde that they are going to break downwards compatiblity in one month. That's too soon to wait for nixos-19.03

@Ekleog Ekleog dismissed dotlambda’s stale review Feb 6, 2019

Points have been addressed

Ekleog
Ekleog approved these changes Feb 6, 2019
Copy link
Member

@Ekleog Ekleog left a comment

LGTM! I'll leave it here a bit for @Ralith to check.

However, I don't think we should backport this: it breaks backwards-compatibility in a way that will require manual intervention. Meaning that if we backport and the user does nothing the user no longer has any server, while if we don't backport and the user does nothing then the user has a server that just can't federate with too-up-to-date servers.

And the upgrade is not actually required to be done by 1 month. The only thing that is really required is to have a non-self-signed certificate. Which can perfectly well be done from 0.34.1.1, and which would have to be done manually anyway, as it's the steps for migrating to 0.99.0.

So overall I think we shouldn't backport such a heavily-backwards-compatibility-breaking update.

As an aside, I think the 1-month delay is stupid, but that is not my choice to make and I already voiced it upstream.

@Ekleog
Copy link
Member

@Ekleog Ekleog commented Feb 6, 2019

Oh, and…

@GrahamcOfBorg build matrix-synapse nixosTests.matrix-synapse

@pstn
Copy link
Contributor

@pstn pstn commented Feb 6, 2019

What about backporting it to a new package? Then users would have a choice of having the pain now or just waiting for 19.03.

Copy link
Contributor

@Ralith Ralith left a comment

Great cleanup, thanks!

@@ -687,7 +691,7 @@ in {
WorkingDirectory = cfg.dataDir;
PermissionsStartOnly = true;
ExecStart = ''
${cfg.package}/bin/homeserver \
${python.interpreter} -m synapse.app.homeserver \
Copy link
Contributor

@Ralith Ralith Feb 6, 2019

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This should probably be squashed into the commit that removed the script.

Copy link
Member Author

@nyanloutre nyanloutre Feb 7, 2019

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

what commit do you mean ?

@dotlambda
Copy link
Member

@dotlambda dotlambda commented Feb 6, 2019

What about backporting it to a new package? Then users would have a choice of having the pain now or just waiting for 19.03.

What's the advantage over simply using the package from the unstable channel on a stable system?

@7c6f434c
Copy link
Member

@7c6f434c 7c6f434c commented Feb 7, 2019

@nyanloutre
Copy link
Member Author

@nyanloutre nyanloutre commented Feb 7, 2019

@7c6f434c for automatic ACME to work it needs an optional library that is not yet packaged in nixpkgs

@florianjacob
Copy link
Contributor

@florianjacob florianjacob commented Feb 7, 2019

Note that 0.99 and 1.0 can still talk to 0.34.1 if 0.34.1 is equipped with a valid certificate, so while manual intervention is always required, the backport is not actually necessary to stay compatible, as you can use the usual nixos machinery for getting certificates.

This is roughly what I use with 0.34.1 to stay compatible with 0.99 and 1.0, without actually needing to update to 0.99 yet. While I'll personally updated to 0.99 by using the unstable package & module, this code is the same what you will need to do for 0.99 anyway, if you don't plan to use the integrated ACME support or want to use a tls terminating reverse proxy for port 8448.

services.matrix-synapse = {
    …
    tls_private_key_path = "${config.security.acme.directory}/${config.networking.hostName}.${config.networking.domain}/key.pem";                                                    
    tls_certificate_path = "${config.security.acme.directory}/${config.networking.hostName}.${config.networking.domain}/fullchain.pem";
};

# group used for permission to get and use the fqdn certificate (in contrast to subdomains of this host)
users.groups.domaincertificate = {};
users.users."matrix-synapse".extraGroups = [ "domaincertificate" ];
users.users."nginx".extraGroups = [ "domaincertificate" ];

services.nginx = {
  enable = true;
  virtualHosts = {
    "${config.networking.hostName}.${config.networking.domain}" = {
      default = true;
      enableACME = true;
  };
};
security.acme.certs."${config.networking.hostName}.${config.networking.domain}" = {
    group = "domaincertificate";
    allowKeysForGroup = true;
    # TODO: use reload: https://github.com/NixOS/nixpkgs/pull/55320#issuecomment-461056137
    postRun = "systemctl restart matrix-synapse.service";
};

EDIT: My current proposal is now at #57699

@Ekleog
Copy link
Member

@Ekleog Ekleog commented Feb 7, 2019

@florianjacob Could you consider submitting this code as a PR to the NixOS manual? It sounds like it'd be pretty useful for people :)

@nyanloutre Upon second review I think this is missing release notes (nixos/doc/manual/release-notes/rl-1903.xml). Could you consider adding a line there pointing to the need for a non-self-signed certificate? Then @florianjacob's PR, if he feels like it, would be able to add a link to this line pointing to the NixOS manual section for how to actually do it.

@nyanloutre
Copy link
Member Author

@nyanloutre nyanloutre commented Feb 7, 2019

@Ekleog done

@GrahamcOfBorg GrahamcOfBorg requested a review from Ekleog Feb 7, 2019
@Ekleog Ekleog merged commit e088eb3 into NixOS:master Feb 7, 2019
10 checks passed
@Ekleog
Copy link
Member

@Ekleog Ekleog commented Feb 7, 2019

@nyanloutre Thank you! Merged :)

@pstn Backporting to a separate package sounds against the spirit of release-18.09 to me, especially as there is no actual need to upgrade to keep federation working. However, feel free to add the updated package to your NUR for others to be able to use, if you really want to stay on 18.09 but upgrade without taking the package from unstable :)

@florianjacob If you decide to send your configuration excerpt as a PR to the manual and add a link to it from the release notes, feel free to ping me. :)

@nyanloutre nyanloutre deleted the matrix-update branch Feb 7, 2019
@Ralith
Copy link
Contributor

@Ralith Ralith commented Feb 7, 2019

@florianjacob You might be interested in the systemctl reload-or-restart action, which just does the right thing here.

@pacien
Copy link
Contributor

@pacien pacien commented Feb 9, 2019

I've attempted running this on NixOS 18.09 by importing the module and package from the unstable channel.

The service refuses to start with the following error due to a Python version mismatch (probably in a similar way as in matrix-org/synapse#4431):

Feb 09 06:37:50 matrix anw2ll0dqfkyql2gmfhsi4ccwc212nrp-unit-script-matrix-synapse-pre-start[451]: /nix/store/99p0nyqgayic2ipqx2x4lr4njl8f5nrz-python3-3.6.8/bin/python3.6m: Error while finding module specification for 'synapse.app.homeserver' (ModuleNotFoundError: No module named 'synapse')

Setting the version properly to python37 in the service configuration here allows the synapse python module to be found, but not its runtime dependencies:

Feb 09 06:43:33 matrix jk958mp32snk3rdx9xf8yjslk8prbxim-unit-script-matrix-synapse-pre-start[665]: Traceback (most recent call last):
Feb 09 06:43:33 matrix jk958mp32snk3rdx9xf8yjslk8prbxim-unit-script-matrix-synapse-pre-start[665]:   File "/nix/store/5jy6nkhccr8j2bycl6qi404zwnq0swak-python3-3.7.2-env/lib/python3.7/runpy.py", line 183, in _run_module_as_main
Feb 09 06:43:33 matrix jk958mp32snk3rdx9xf8yjslk8prbxim-unit-script-matrix-synapse-pre-start[665]:     mod_name, mod_spec, code = _get_module_details(mod_name, _Error)
Feb 09 06:43:33 matrix jk958mp32snk3rdx9xf8yjslk8prbxim-unit-script-matrix-synapse-pre-start[665]:   File "/nix/store/5jy6nkhccr8j2bycl6qi404zwnq0swak-python3-3.7.2-env/lib/python3.7/runpy.py", line 109, in _get_module_details
Feb 09 06:43:33 matrix jk958mp32snk3rdx9xf8yjslk8prbxim-unit-script-matrix-synapse-pre-start[665]:     __import__(pkg_name)
Feb 09 06:43:33 matrix jk958mp32snk3rdx9xf8yjslk8prbxim-unit-script-matrix-synapse-pre-start[665]:   File "/nix/store/5jy6nkhccr8j2bycl6qi404zwnq0swak-python3-3.7.2-env/lib/python3.7/site-packages/synapse/app/__init__.py", line 18, in <module>
Feb 09 06:43:33 matrix jk958mp32snk3rdx9xf8yjslk8prbxim-unit-script-matrix-synapse-pre-start[665]:     from synapse import python_dependencies  # noqa: E402
Feb 09 06:43:33 matrix jk958mp32snk3rdx9xf8yjslk8prbxim-unit-script-matrix-synapse-pre-start[665]:   File "/nix/store/5jy6nkhccr8j2bycl6qi404zwnq0swak-python3-3.7.2-env/lib/python3.7/site-packages/synapse/python_dependencies.py", line 19, in <module>
Feb 09 06:43:33 matrix jk958mp32snk3rdx9xf8yjslk8prbxim-unit-script-matrix-synapse-pre-start[665]:     from pkg_resources import DistributionNotFound, VersionConflict, get_distribution
Feb 09 06:43:33 matrix jk958mp32snk3rdx9xf8yjslk8prbxim-unit-script-matrix-synapse-pre-start[665]: ModuleNotFoundError: No module named 'pkg_resources'

@dotlambda
Copy link
Member

@dotlambda dotlambda commented Feb 9, 2019

@pacien Try this: https://github.com/dotlambda/nixpkgs/commits/matrix-synapse-correct-python. It might be a little overcomplicated but I think it's the correct way to do this.

@pacien
Copy link
Contributor

@pacien pacien commented Feb 9, 2019

@dotlambda This works great, thanks!
Though wouldn't it be simpler to re-create bin/homeserver as a wrapper in the synapse package to bind the right interpreter and environment to the application instead of exposing the internal interpreter?

@dotlambda
Copy link
Member

@dotlambda dotlambda commented Feb 9, 2019

Though wouldn't it be simpler to re-create bin/homeserver as a wrapper in the synapse package to bind the right interpreter and environment to the application instead of exposing the internal interpreter?

It would and I have no clue what hinders upstream from doing this.

rycee
Copy link
Member

rycee commented on d667c33 Feb 10, 2019

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I believe this must be ported to 18.09 due to the backwards compatibility issue.

Ekleog
Copy link
Member

Ekleog commented on d667c33 Feb 10, 2019

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@rycee See #55320 (review) : The only thing required to interact with 1.0 should be to have a non-self-signed certificate, which would require manual intervention even if this was backported (and the exact same manual intervention). Given that upgrading to 0.99 in addition requires adjusting the configuration, I think we shouldn't backport it.

@florianjacob
Copy link
Contributor

@florianjacob florianjacob commented Feb 22, 2019

@Ekleog working on a manual section, I actually now switched to a different, easier and more robust setup.

@dotlambda your changes seem very sensible to me, the nixos module shouldn't use whatever is in pkgs.python but the actual python from matrix-synapse.package, I started using them as well to test synapse from unstable on 18.09. Do you intend to upstream them?

@dotlambda
Copy link
Member

@dotlambda dotlambda commented Feb 23, 2019

@dotlambda your changes seem very sensible to me, the nixos module shouldn't use whatever is in pkgs.python but the actual python from matrix-synapse.package, I started using them as well to test synapse from unstable on 18.09. Do you intend to upstream them?

I leave that up to the module maintainers.

zip_safe=False,
long_description=long_description,
- scripts=["synctl"] + glob.glob("scripts/*"),
+ scripts=["synctl", "homeserver"] + glob.glob("scripts/*"),
Copy link
Contributor

@pacien pacien Feb 23, 2019

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@nyanloutre What was the reason for removing this?

Copy link
Member Author

@nyanloutre nyanloutre Feb 23, 2019

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is because there isn't any homeserver script anymore

Copy link
Contributor

@pacien pacien Feb 23, 2019

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The patch was actually creating this wrapper script.
I've opened a PR to restore it.

Copy link
Member Author

@nyanloutre nyanloutre Feb 24, 2019

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

But still, it's better if we can avoid a patch

Copy link
Member

@dotlambda dotlambda Feb 24, 2019

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is there a reason why this patch can't be upstreamed? I'd much prefer the patch to my (more complicated) solution.

Copy link
Member Author

@nyanloutre nyanloutre Feb 24, 2019

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@florianjacob
Copy link
Contributor

@florianjacob florianjacob commented Mar 15, 2019

@Ekleog Guide is finished: #57699

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment