Fix Traefik support for matrix-user-verification-service

Related to: #2375 (comment)

group_vars/matrix_servers

@@ -4172,13 +4172,20 @@ matrix_user_verification_service_docker_image: "{{ matrix_user_verification_serv
 
 matrix_user_verification_service_enabled: false
 matrix_user_verification_service_systemd_required_services_list: |
-      {{
-        ['docker.service']
-        +
-        (['matrix-synapse.service'] if matrix_synapse_enabled else [])
-        +
-        ([devture_postgres_identifier ~ '.service'] if devture_postgres_enabled else [])
-      }}
+  {{
+    ['docker.service']
+    +
+    (['matrix-' + matrix_homeserver_implementation + '.service'])
+  }}
+
+matrix_user_verification_service_container_additional_networks: |
+  {{
+    (
+      ([matrix_playbook_reverse_proxyable_services_additional_network] if matrix_playbook_reverse_proxyable_services_additional_network else [])
+      +
+      ([matrix_homeserver_container_network] if matrix_homeserver_container_network != matrix_user_verification_service_container_network else [])
+    ) | unique
+  }}
 
 # If Jitsi is managed by this playbook we can use the docker network - no need to expose a port.
 # If Jitsi is not managed by this playbook, or you otherwise have a need for it, you can expose

roles/custom/matrix-user-verification-service/defaults/main.yml

@@ -18,6 +18,14 @@ matrix_user_verification_service_docker_image_name_prefix: "{{ matrix_container_
 matrix_user_verification_service_docker_image: "{{ matrix_user_verification_service_docker_image_name_prefix }}matrixdotorg/matrix-user-verification-service:{{ matrix_user_verification_service_version }}"
 matrix_user_verification_service_docker_image_force_pull: "{{ matrix_user_verification_service_docker_image.endswith(':latest') }}"
 
+# The base container network. It will be auto-created by this role if it doesn't exist already.
+matrix_user_verification_service_container_network: "{{ matrix_docker_network }}"
+
+# A list of additional container networks that the container would be connected to.
+# The role does not create these networks, so make sure they already exist.
+# Use this to expose this container to another reverse proxy, which runs in a different container network.
+matrix_user_verification_service_container_additional_networks: []
+
 matrix_user_verification_service_container_name: "matrix-user-verification-service"
 # This will be set in group vars
 matrix_user_verification_service_container_http_host_bind_port: ''

roles/custom/matrix-user-verification-service/tasks/setup_install.yml

@@ -30,6 +30,11 @@
     group: "{{ matrix_user_groupname }}"
     mode: 0644
 
+- name: Ensure matrix-user-verification-service container network is created
+  community.general.docker_network:
+    name: "{{ matrix_user_verification_service_container_network }}"
+    driver: bridge
+
 - name: Ensure matrix-user-verification-service.service installed
   ansible.builtin.template:
     src: "{{ role_path }}/templates/systemd/matrix-user-verification-service.service.j2"

roles/custom/matrix-user-verification-service/templates/systemd/matrix-user-verification-service.service.j2

@@ -17,12 +17,14 @@ ExecStartPre=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_s
 ExecStartPre=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} rm {{ matrix_user_verification_service_container_name }} 2>/dev/null'
 
 
-ExecStart={{ devture_systemd_docker_base_host_command_docker }} run --rm --name  {{ matrix_user_verification_service_container_name }}\
+ExecStart={{ devture_systemd_docker_base_host_command_docker }} run \
+			--rm \
+			--name={{ matrix_user_verification_service_container_name }}\
 			--log-driver=none \
 			--user={{ matrix_user_uid }}:{{ matrix_user_gid }} \
 			--cap-drop=ALL \
 			--read-only \
-			--network={{ matrix_docker_network }} \
+			--network={{ matrix_user_verification_service_container_network }} \
 			{% if matrix_user_verification_service_container_http_host_bind_port %}
 			-p {{ matrix_user_verification_service_container_http_host_bind_port }}:3000 \
 			{% endif %}
@@ -32,6 +34,10 @@ ExecStart={{ devture_systemd_docker_base_host_command_docker }} run --rm --name
 			{% endfor %}
 			{{ matrix_user_verification_service_docker_image }}
 
+{% for network in matrix_user_verification_service_container_additional_networks %}
+ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} network connect {{ network }} {{ matrix_user_verification_service_container_name }}
+{% endfor %}
+
 ExecStop=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} kill {{ matrix_user_verification_service_container_name }} 2>/dev/null'
 ExecStop=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} rm {{ matrix_user_verification_service_container_name }} 2>/dev/null'
 Restart=always