Merge pull request #4915 from luixxiul/hydrogen

Relocate Hydrogen to MASH organization

CHANGELOG.md

@@ -1,5 +1,68 @@
+# 2026-02-12
+
+## (BC Break) Hydrogen role has been relocated and variable names need adjustments
+
+The role for Hydrogen has been relocated to the [mother-of-all-self-hosting](https://github.com/mother-of-all-self-hosting) organization.
+
+Along with the relocation, the `matrix_client_hydrogen_` prefix was dropped from its variable names, so you need to adjust your `vars.yml` configuration.
+
+You need to do the following replacement:
+
+- `matrix_client_hydrogen_` -> `hydrogen_`
+
+As always, the playbook would let you know about this and point out any variables you may have missed.
+
+# 2026-02-11
+
+## (BC Break) coturn role has been relocated and variable names need adjustments
+
+The role for coturn has been relocated to the [mother-of-all-self-hosting](https://github.com/mother-of-all-self-hosting) organization.
+
+Along with the relocation, the `matrix_coturn_` prefix on its variable names has been renamed to `coturn_`, so you need to adjust your `vars.yml` configuration.
+
+As always, the playbook would let you know about this and point out any variables you may have missed.
+
+## conduwuit has been removed from the playbook
+
+[conduwuit](./docs/configuring-playbook-conduwuit.md) has been removed from the playbook, as it has been abandoned.
+
+The playbook will let you know if you're using any `matrix_conduwuit_*` variables. You'll need to remove them from `vars.yml` and potentially [uninstall the service manually](./docs/configuring-playbook-conduwuit.md#uninstalling-the-service-manually).
+
+Since [Continuwuity](configuring-playbook-continuwuity.md) is a drop-in replacement for conduwuit, migration is possible. Please refer to [this section](./configuring-playbook-continuwuity.md#migrating-from-conduwuit) for details.
+
+# 2026-02-09
+
+## (BC Break) matrix-media-repo datastore IDs are now required in `vars.yml`
+
+**Affects**: users with [matrix-media-repo](docs/configuring-playbook-matrix-media-repo.md) enabled (`matrix_media_repo_enabled: true`)
+
+The `matrix_media_repo_datastore_file_id` and `matrix_media_repo_datastore_s3_id` variables are no longer auto-configured with values. They must now be explicitly defined in your `vars.yml` file. The playbook will fail with a helpful error if they are not set (when needed).
+
+These were never meant to be auto-configured. They were derived from `matrix_homeserver_generic_secret_key`, which is intended for secrets that are OK to change subsequently (and Ansible would assist in propagating these changes). matrix-media-repo datastore IDs are not secrets — they are static identifiers linking media to storage backends, and **must not change** after first use.
+
+**For existing installations**, retrieve your current values from the server:
+
+```sh
+grep 'id:' /matrix/media-repo/config/media-repo.yaml
+```
+
+Then add to your `vars.yml`:
+
+```yaml
+matrix_media_repo_datastore_file_id: "YOUR_FILE_DATASTORE_ID_HERE"
+
+# Only if you use S3 storage:
+# matrix_media_repo_datastore_s3_id: "YOUR_S3_DATASTORE_ID_HERE"
+```
+
+**Why do this?**: This change allows us to **remove the [passlib](https://passlib.readthedocs.io/en/stable/index.html) Python library** from the [prerequisites](docs/prerequisites.md), as it was the last component that depended on it.
+
 # 2026-02-08
 
+## Zulip bridge has been removed from the playbook
+
+Zulip bridge has been removed from the playbook, as it doesn't work, and the maintainer seems to have abandoned it. See [this issue](https://github.com/GearKite/MatrixZulipBridge/issues/23) for more context.
+
 ## Switched to faster secret derivation for service passwords
 
 We've switched the method used for deriving service passwords (database passwords, appservice tokens, etc.) from the `matrix_homeserver_generic_secret_key` variable.
@@ -283,7 +346,7 @@ In light of this new information, you have 2 options:
 - Consider closing the STUN/UDP port with the following configuration:
 
   ```yaml
-  matrix_coturn_container_stun_plain_host_bind_port_udp: ""
+  coturn_container_stun_plain_host_bind_port_udp: ""
   ```
 
 - Consider keeping `3478/udp` blocked in your external firewall (if you have one)
@@ -344,11 +407,11 @@ The playbook now **only exposes the Coturn STUN port (`3478`) over TCP by defaul
 If you'd like the Coturn STUN port to be exposed over UDP like before, you can revert to the previous behavior by using the following configuration in your `vars.yml` file:
 
 ```yaml
-matrix_coturn_container_stun_plain_host_bind_port_udp: "3478"
+coturn_container_stun_plain_host_bind_port_udp: "3478"
 ```
 
 > [!WARNING]
-> People running Coturn directly on the `host` network (using `matrix_coturn_container_network: host`) will still have the STUN port exposed over UDP, as port exposure is done directly via Coturn and not via Docker. In such cases, the playbook cannot prevent `3478/udp` port exposure and you'd need to do it in another way (separate firewall rule, etc).
+> People running Coturn directly on the `host` network (using `coturn_container_network: host`) will still have the STUN port exposed over UDP, as port exposure is done directly via Coturn and not via Docker. In such cases, the playbook cannot prevent `3478/udp` port exposure and you'd need to do it in another way (separate firewall rule, etc).
 
 
 # 2025-02-17
@@ -1691,12 +1754,12 @@ Other roles which aren't strictly related to Matrix are likely to follow this fa
 
 ## coturn can now use host-networking
 
-Large coturn deployments (with a huge range of ports specified via `matrix_coturn_turn_udp_min_port` and `matrix_coturn_turn_udp_max_port`) experience a huge slowdown with how Docker publishes all these ports (setting up firewall forwarding rules), which leads to a very slow coturn service startup and shutdown.
+Large coturn deployments (with a huge range of ports specified via `coturn_turn_udp_min_port` and `coturn_turn_udp_max_port`) experience a huge slowdown with how Docker publishes all these ports (setting up firewall forwarding rules), which leads to a very slow coturn service startup and shutdown.
 
 Such deployments don't need to run coturn within a private container network anymore. coturn can now run with host-networking by using configuration like this:
 
 ```yaml
-matrix_coturn_container_network: host
+coturn_container_network: host
 ```
 
 With such a configuration, **Docker no longer needs to configure thousands of firewall forwarding rules** each time coturn starts and stops. This, however, means that **you will need to ensure these ports are open** in your firewall yourself.
@@ -1705,11 +1768,11 @@ Thanks to us [tightening coturn security](#backward-compatibility-tightening-cot
 
 ## (Backward Compatibility) Tightening coturn security can lead to connectivity issues
 
-**TLDR**: users who run and access their Matrix server on a private network (likely a small minority of users) may experience connectivity issues with our new default coturn blocklists. They may need to override `matrix_coturn_denied_peer_ips` and remove some IP ranges from it.
+**TLDR**: users who run and access their Matrix server on a private network (likely a small minority of users) may experience connectivity issues with our new default coturn blocklists. They may need to override `coturn_denied_peer_ips` and remove some IP ranges from it.
 
 Inspired by [this security article](https://www.rtcsec.com/article/cve-2020-26262-bypass-of-coturns-access-control-protection/), we've decided to make use of coturn's `denied-peer-ip` functionality to prevent relaying network traffic to certain private IP subnets. This ensures that your coturn server won't accidentally try to forward traffic to certain services running on your local networks. We run coturn in a container and in a private container network by default, which should prevent such access anyway, but having additional block layers in place is better.
 
-If you access your Matrix server from a local network and need coturn to relay to private IP addresses, you may observe that relaying is now blocked due to our new default `denied-peer-ip` lists (specified in `matrix_coturn_denied_peer_ips`). If you experience such connectivity problems, consider overriding this setting in your `vars.yml` file and removing certain networks from it.
+If you access your Matrix server from a local network and need coturn to relay to private IP addresses, you may observe that relaying is now blocked due to our new default `denied-peer-ip` lists (specified in `coturn_denied_peer_ips`). If you experience such connectivity problems, consider overriding this setting in your `vars.yml` file and removing certain networks from it.
 
 We've also added `no-multicast-peers` to the default coturn configuration, but we don't expect this to cause trouble for most people.
 
@@ -2495,8 +2558,8 @@ To improve security, we've [removed TLSv1 and TLSv1.1 support](https://github.co
 If you need to support old clients, you can re-enable both (or whichever one you need) with the following configuration:
 
 ```yaml
-matrix_coturn_tls_v1_enabled: true
-matrix_coturn_tls_v1_1_enabled: true
+coturn_tls_v1_enabled: true
+coturn_tls_v1_1_enabled: true
 ```
 
 
@@ -3775,7 +3838,7 @@ Because people like using the playbook's components independently (outside of th
 With the new changes, **all roles are now only dependent on the minimal `matrix-base` role**. They are no longer dependent among themselves.
 
 In addition, the following components can now be completely disabled (for those who want/need to):
-- `matrix-coturn` by using `matrix_coturn_enabled: false`
+- `matrix-coturn` by using `coturn_enabled: false`
 - `matrix-mailer` by using `matrix_mailer_enabled: false`
 - `matrix-postgres` by using `matrix_postgres_enabled: false`
 
@@ -3995,7 +4058,7 @@ The following playbook variables were renamed:
 - from `matrix_docker_image_mautrix_telegram` to `matrix_mautrix_telegram_docker_image`
 - from `matrix_docker_image_mautrix_whatsapp` to `matrix_mautrix_whatsapp_docker_image`
 - from `matrix_docker_image_mailer` to `matrix_mailer_docker_image`
-- from `matrix_docker_image_coturn` to `matrix_coturn_docker_image`
+- from `matrix_docker_image_coturn` to `coturn_container_image`
 - from `matrix_docker_image_goofys` to `matrix_s3_goofys_docker_image`
 - from `matrix_docker_image_riot` to `matrix_riot_web_docker_image`
 - from `matrix_docker_image_nginx` to `matrix_nginx_proxy_docker_image`

README.md

@@ -52,8 +52,7 @@ The homeserver is the backbone of your Matrix system. Choose one from the follow
 | ---- | -------- | ----------- | ------------- |
 | [Synapse](https://github.com/element-hq/synapse) | ✅ | Storing your data and managing your presence in the [Matrix](http://matrix.org/) network | [Link](docs/configuring-playbook-synapse.md) |
 | [Conduit](https://conduit.rs) | ❌ | Storing your data and managing your presence in the [Matrix](http://matrix.org/) network. Conduit is a lightweight open-source server implementation of the Matrix Specification with a focus on easy setup and low system requirements | [Link](docs/configuring-playbook-conduit.md) |
-| [conduwuit](https://conduwuit.puppyirl.gay/) | ❌ | Storing your data and managing your presence in the [Matrix](http://matrix.org/) network. conduwuit is a fork of Conduit. | [Link](docs/configuring-playbook-conduwuit.md) |
-| [continuwuity](https://continuwuity.org) | ❌ | Storing your data and managing your presence in the [Matrix](http://matrix.org/) network. continuwuity is a continuation of conduwuit. | [Link](docs/configuring-playbook-continuwuity.md) |
+| [continuwuity](https://continuwuity.org) | ❌ | Storing your data and managing your presence in the [Matrix](http://matrix.org/) network. | [Link](docs/configuring-playbook-continuwuity.md) |
 | [Dendrite](https://github.com/element-hq/dendrite) | ❌ | Storing your data and managing your presence in the [Matrix](http://matrix.org/) network. Dendrite is a second-generation Matrix homeserver written in Go, an alternative to Synapse. | [Link](docs/configuring-playbook-dendrite.md) |
 
 ### Clients
@@ -133,7 +132,6 @@ Bridges can be used to connect your Matrix installation with third-party communi
 | [matrix-sms-bridge](https://github.com/benkuly/matrix-sms-bridge) | ❌ | Bridge to SMS | [Link](docs/configuring-playbook-bridge-matrix-bridge-sms.md) |
 | [matrix-steam-bridge](https://github.com/jasonlaguidice/matrix-steam-bridge) | ❌ | Bridge to [Steam](https://steampowered.com/) | [Link](docs/configuring-playbook-bridge-steam.md) |
 | [matrix-wechat](https://github.com/duo/matrix-wechat) | ❌ | Bridge to [WeChat](https://www.wechat.com/) | [Link](docs/configuring-playbook-bridge-wechat.md) |
-| [MatrixZulipBridge](https://github.com/GearKite/MatrixZulipBridge) | ❌ | Puppeting appservice bridge for [Zulip](https://zulip.com/) | [Link](docs/configuring-playbook-bridge-zulip.md) |
 | [Heisenbridge](https://github.com/hifi/heisenbridge) | ❌ | Bouncer-style bridge to [IRC](https://wikipedia.org/wiki/Internet_Relay_Chat) | [Link](docs/configuring-playbook-bridge-heisenbridge.md) |
 | [mx-puppet-groupme](https://gitlab.com/xangelix-pub/matrix/mx-puppet-groupme) | ❌ | Bridge to [GroupMe](https://groupme.com/) | [Link](docs/configuring-playbook-bridge-mx-puppet-groupme.md) |
 | [mx-puppet-steam](https://codeberg.org/icewind/mx-puppet-steam) | ❌ | Bridge to [Steam](https://steamapp.com/) | [Link](docs/configuring-playbook-bridge-mx-puppet-steam.md) |

docs/configuring-playbook-bridge-zulip.md

@@ -1,83 +0,0 @@
-<!--
-SPDX-FileCopyrightText: 2021 - 2024 Slavi Pantaleev
-SPDX-FileCopyrightText: 2021 Toni Spets
-SPDX-FileCopyrightText: 2024 - 2025 Suguru Hirahara
-
-SPDX-License-Identifier: AGPL-3.0-or-later
--->
-
-# Setting up a Zulip bridge (optional)
-
-The playbook can install and configure [MatrixZulipBridge](https://github.com/GearKite/MatrixZulipBridge) for you.
-
-See the project's [documentation](https://github.com/GearKite/MatrixZulipBridge/blob/main/README.md) to learn what it does and why it might be useful to you.
-
-## Adjusting DNS records (optional)
-
-By default, this playbook installs the Zulip bridge on the `matrix.` subdomain, at the `/zulip` path (https://matrix.example.com/zulip). This makes it easy to install it, because it **doesn't require additional DNS records to be set up**. If that's okay, you can skip this section.
-
-If you wish to adjust it, see the section [below](#adjusting-the-zulip-bridge-url-optional) for details about DNS configuration.
-
-## Adjusting the playbook configuration
-
-To enable the Zulip bridge, add the following configuration to your `inventory/host_vars/matrix.example.com/vars.yml` file:
-
-```yaml
-matrix_zulip_bridge_enabled: true
-
-# Uncomment to add one or more admins to this bridge:
-#
-# matrix_zulip_bridge_owner:
-#  - '@yourAdminAccount:{{ matrix_domain }}'
-#
-# … unless you've made yourself an admin of all bots/bridges like this:
-#
-# matrix_admin: '@yourAdminAccount:{{ matrix_domain }}'
-```
-
-### Adjusting the Zulip bridge URL (optional)
-
-By tweaking the `matrix_zulip_bridge_hostname` and `matrix_zulip_bridge_path_prefix` variables, you can easily make the service available at a **different hostname and/or path** than the default one.
-
-Example additional configuration for your `vars.yml` file:
-
-```yaml
-# Change the default hostname and path prefix
-matrix_zulip_bridge_hostname: zulip.example.com
-matrix_zulip_bridge_path_prefix: /
-```
-
-If you've changed the default hostname, you may need to create a CNAME record for the Zulip bridge domain (`zulip.example.com`), which targets `matrix.example.com`.
-
-When setting, replace `example.com` with your own.
-
-### Extending the configuration
-
-There are some additional things you may wish to configure about the bridge.
-
-Take a look at:
-
-- `roles/custom/matrix-bridge-zulip/defaults/main.yml` for some variables that you can customize via your `vars.yml` file
-
-## Installing
-
-After configuring the playbook and potentially [adjusting your DNS records](#adjusting-dns-records), run the playbook with [playbook tags](playbook-tags.md) as below:
-
-<!-- NOTE: let this conservative command run (instead of install-all) to make it clear that failure of the command means something is clearly broken. -->
-```sh
-ansible-playbook -i inventory/hosts setup.yml --tags=setup-all,start
-```
-
-The shortcut commands with the [`just` program](just.md) are also available: `just install-all` or `just setup-all`
-
-`just install-all` is useful for maintaining your setup quickly ([2x-5x faster](../CHANGELOG.md#2x-5x-performance-improvements-in-playbook-runtime) than `just setup-all`) when its components remain unchanged. If you adjust your `vars.yml` to remove other components, you'd need to run `just setup-all`, or these components will still remain installed. Note these shortcuts run the `ensure-matrix-users-created` tag too.
-
-## Usage
-
-To use the bridge, you need to start a chat with `@zulipbot:example.com` (where `example.com` is your base domain, not the `matrix.` domain). If the bridge ignores you and a DM is not accepted then the owner setting may be wrong.
-
-If you encounter issues or feel lost you can join the project room at [#matrixzulipbridge:shema.lv](https://matrix.to/#/#matrixzulipbridge:shema.lv) for help.
-
-## Troubleshooting
-
-As with all other services, you can find the logs in [systemd-journald](https://www.freedesktop.org/software/systemd/man/systemd-journald.service.html) by logging in to the server with SSH and running `journalctl -fu matrix-bridge-zulip`.

docs/configuring-playbook-client-hydrogen.md

@@ -24,22 +24,22 @@ When setting, replace `example.com` with your own.
 To enable Hydrogen, add the following configuration to your `inventory/host_vars/matrix.example.com/vars.yml` file:
 
 ```yaml
-matrix_client_hydrogen_enabled: true
+hydrogen_enabled: true
 ```
 
 ### Adjusting the Hydrogen URL (optional)
 
-By tweaking the `matrix_client_hydrogen_hostname` and `matrix_client_hydrogen_path_prefix` variables, you can easily make the service available at a **different hostname and/or path** than the default one.
+By tweaking the `hydrogen_hostname` and `hydrogen_path_prefix` variables, you can easily make the service available at a **different hostname and/or path** than the default one.
 
 Example additional configuration for your `vars.yml` file:
 
 ```yaml
 # Switch to the domain used for Matrix services (`matrix.example.com`),
 # so we won't need to add additional DNS records for Hydrogen.
-matrix_client_hydrogen_hostname: "{{ matrix_server_fqn_matrix }}"
+hydrogen_hostname: "{{ matrix_server_fqn_matrix }}"
 
 # Expose under the /hydrogen subpath
-matrix_client_hydrogen_path_prefix: /hydrogen
+hydrogen_path_prefix: /hydrogen
 ```
 
 After changing the domain, **you may need to adjust your DNS** records to point the Hydrogen domain to the Matrix server.
@@ -52,8 +52,8 @@ There are some additional things you may wish to configure about the client.
 
 Take a look at:
 
-- `roles/custom/matrix-client-hydrogen/defaults/main.yml` for some variables that you can customize via your `vars.yml` file
-- `roles/custom/matrix-client-hydrogen/templates/config.json.j2` for the client's default configuration. You can override settings (even those that don't have dedicated playbook variables) using the `matrix_client_hydrogen_configuration_extension_json` variable
+- `roles/galaxy/hydrogen/defaults/main.yml` for some variables that you can customize via your `vars.yml` file
+- `roles/galaxy/hydrogen/templates/config.json.j2` for the client's default configuration. You can override settings (even those that don't have dedicated playbook variables) using the `hydrogen_configuration_extension_json` variable
 
 ## Installing
 

docs/configuring-playbook-conduit.md

@@ -13,8 +13,6 @@ See the project's [documentation](https://docs.conduit.rs/) to learn what it doe
 
 By default, the playbook installs [Synapse](https://github.com/element-hq/synapse) as it's the only full-featured Matrix server at the moment. If that's okay, you can skip this document.
 
-💡 **Note**: The playbook also supports installing a (currently) faster-moving Conduit fork called [conduwuit](./configuring-playbook-conduwuit.md).
-
 > [!WARNING]
 > - **You can't switch an existing Matrix server's implementation** (e.g. Synapse -> Conduit). Proceed below only if you're OK with losing data or you're dealing with a server on a new domain name, which hasn't participated in the Matrix federation yet.
 > - **Homeserver implementations other than Synapse may not be fully functional**. The playbook may also not assist you in an optimal way (like it does with Synapse). Make yourself familiar with the downsides before proceeding

docs/configuring-playbook-conduwuit.md

@@ -1,106 +1,45 @@
 <!--
-SPDX-FileCopyrightText: 2025 Slavi Pantaleev
-SPDX-FileCopyrightText: 2025 Suguru Hirahara
+SPDX-FileCopyrightText: 2019 Eduardo Beltrame
+SPDX-FileCopyrightText: 2019-2025 Slavi Pantaleev
+SPDX-FileCopyrightText: 2020 Tulir Asokan
+SPDX-FileCopyrightText: 2021, 2024 MDAD project contributors
+SPDX-FileCopyrightText: 2022 Dennis Ciba
+SPDX-FileCopyrightText: 2022 Vladimir Panteleev
+SPDX-FileCopyrightText: 2023 Justin Croonenberghs
+SPDX-FileCopyrightText: 2023 Kuba Orlik
+SPDX-FileCopyrightText: 2023 Pierre 'McFly' Marty
+SPDX-FileCopyrightText: 2023 Samuel Meenzen
+SPDX-FileCopyrightText: 2024 Fabio Bonelli
+SPDX-FileCopyrightText: 2024-2026 Suguru Hirahara
 
 SPDX-License-Identifier: AGPL-3.0-or-later
 -->
 
-# Configuring conduwuit (optional)
+# Configuring conduwuit (optional, removed)
 
-The playbook can install and configure the [conduwuit](https://conduwuit.puppyirl.gay/) Matrix server for you.
+🪦 The playbook used to be able to install and configure the [conduwuit](https://conduwuit.puppyirl.gay/) Matrix server, but no longer includes this component, as it's been abandoned and unmaintained.
 
-See the project's [documentation](https://conduwuit.puppyirl.gay/) to learn what it does and why it might be useful to you.
+## Uninstalling the service manually
 
-By default, the playbook installs [Synapse](https://github.com/element-hq/synapse) as it's the only full-featured Matrix server at the moment. If that's okay, you can skip this document.
+If you still have conduwuit installed on your Matrix server, the playbook can no longer help you uninstall it and you will need to do it manually.
 
-💡 **Note**: conduwuit is a fork of [Conduit](./configuring-playbook-conduit.md), which the playbook also supports. See [Differences from upstream Conduit](https://conduwuit.puppyirl.gay/differences.html).
+To uninstall the service, run the command below on the server:
 
-> [!WARNING]
-> - **You can't switch an existing Matrix server's implementation** (e.g. Synapse -> conduwuit). Proceed below only if you're OK with losing data or you're dealing with a server on a new domain name, which hasn't participated in the Matrix federation yet.
-> - **Homeserver implementations other than Synapse may not be fully functional**. The playbook may also not assist you in an optimal way (like it does with Synapse). Make yourself familiar with the downsides before proceeding
-> - **the Conduwuit project appears to have been abandoned**. You may wish to install [Conduit](./configuring-playbook-conduit.md), or one of the Conduwuit successors (like [Continuwuity](configuring-playbook-continuwuity.md))
-
-## Adjusting the playbook configuration
-
-To use conduwuit, you **generally** need to adjust the `matrix_homeserver_implementation: synapse` configuration on your `inventory/host_vars/matrix.example.com/vars.yml` file as below:
-
-```yaml
-matrix_homeserver_implementation: conduwuit
-
-# Registering users can only happen via the API,
-# so it makes sense to enable it, at least initially.
-matrix_conduwuit_config_allow_registration: true
-
-# Generate a strong registration token to protect the registration endpoint from abuse.
-# You can create one with a command like `pwgen -s 64 1`.
-matrix_conduwuit_config_registration_token: ''
+```sh
+systemctl disable --now matrix-conduwuit.service
 ```
 
-### Extending the configuration
+## Migrating to Continuwuity
 
-There are some additional things you may wish to configure about the server.
+Since [Continuwuity](configuring-playbook-continuwuity.md) is a drop-in replacement for conduwuit, migration is possible. Please refer to [this section](./configuring-playbook-continuwuity.md#migrating-from-conduwuit) for details.
 
-Take a look at:
+## Removing data manually
 
-- `roles/custom/matrix-conduwuit/defaults/main.yml` for some variables that you can customize via your `vars.yml` file
-- `roles/custom/matrix-conduwuit/templates/conduwuit.toml.j2` for the server's default configuration
+If you are not going to migrate to [Continuwuity](configuring-playbook-continuwuity.md), you can remove data by running the command on the server:
 
-There are various Ansible variables that control settings in the `conduwuit.toml` file.
-
-If a specific setting you'd like to change does not have a dedicated Ansible variable, you can either submit a PR to us to add it, or you can [override the setting using an environment variable](https://conduwuit.puppyirl.gay/configuration.html#environment-variables) using `matrix_conduwuit_environment_variables_extension`. For example:
-
-```yaml
-matrix_conduwuit_environment_variables_extension: |
-  CONDUWUIT_MAX_REQUEST_SIZE=50000000
-  CONDUWUIT_REQUEST_TIMEOUT=60
+```sh
+rm -rf /matrix/conduwuit
 ```
 
-## Creating the first user account
-
-Unlike other homeserver implementations (like Synapse and Dendrite), conduwuit does not support creating users via the command line or via the playbook.
-
-If you followed the instructions above (see [Adjusting the playbook configuration](#adjusting-the-playbook-configuration)), you should have registration enabled and protected by a registration token.
-
-This should allow you to create the first user account via any client (like [Element Web](./configuring-playbook-client-element-web.md)) which supports creating users.
-
-The **first user account that you create will be marked as an admin** and **will be automatically invited to an admin room**.
-
-
-## Configuring bridges / appservices
-
-For other homeserver implementations (like Synapse and Dendrite), the playbook automatically registers appservices (for bridges, bots, etc.) with the homeserver.
-
-For conduwuit, you will have to manually register appservices using the [`!admin appservices register` command](https://conduwuit.puppyirl.gay/appservices.html#set-up-the-appservice---general-instructions) sent to the server bot account.
-
-The server's bot account has a Matrix ID of `@conduit:example.com` (not `@conduwuit:example.com`!) due to conduwuit's historical legacy.
-Your first user account would already have been invited to an admin room with this bot.
-
-Find the appservice file you'd like to register. This can be any `registration.yaml` file found in the `/matrix` directory, for example `/matrix/mautrix-signal/bridge/registration.yaml`.
-
-Then, send its content to the existing admin room:
-
-    !admin appservices register
-
-    ```
-    as_token: <token>
-    de.sorunome.msc2409.push_ephemeral: true
-    receive_ephemeral: true
-    hs_token: <token>
-    id: signal
-    namespaces:
-      aliases:
-      - exclusive: true
-        regex: ^#signal_.+:example\.org$
-      users:
-      - exclusive: true
-        regex: ^@signal_.+:example\.org$
-      - exclusive: true
-        regex: ^@signalbot:example\.org$
-    rate_limited: false
-    sender_localpart: _bot_signalbot
-    url: http://matrix-mautrix-signal:29328
-    ```
-
-## Troubleshooting
-
-As with all other services, you can find the logs in [systemd-journald](https://www.freedesktop.org/software/systemd/man/systemd-journald.service.html) by logging in to the server with SSH and running `journalctl -fu matrix-conduwuit`.
+>[!WARNING]
+> Once you removing the path, there is no going back. Your data on the homeserver (including chat history, rooms, etc.) will be deleted and not be possible to restore them. Please be certain.

docs/configuring-playbook-continuwuity.md

@@ -13,7 +13,7 @@ See the project's [documentation](https://continuwuity.org) to learn what it doe
 
 By default, the playbook installs [Synapse](https://github.com/element-hq/synapse) as it's the only full-featured Matrix server at the moment. If that's okay, you can skip this document.
 
-💡 **Note**: continuwuity is a fork of [conduwuit](./configuring-playbook-conduwuit.md), which the playbook also supports.
+💡 **Note**: continuwuity is a fork of [conduwuit](./configuring-playbook-conduwuit.md), which the playbook has supported.
 
 > [!WARNING]
 > - **You can't switch an existing Matrix server's implementation** (e.g. Synapse -> Continuwuity). Proceed below only if you're OK with losing data or you're dealing with a server on a new domain name, which hasn't participated in the Matrix federation yet.

docs/configuring-playbook-matrix-media-repo.md

@@ -24,8 +24,21 @@ To enable matrix-media-repo, add the following configuration to your `inventory/
 
 ```yaml
 matrix_media_repo_enabled: true
+
+# Any unique alphanumeric string. Cannot be changed after first use.
+# For new installations, generate one with: pwgen -s 64 1
+# For existing installations, see below.
+matrix_media_repo_datastore_file_id: "CHANGE_ME_TO_A_UNIQUE_VALUE"
 ```
 
+**For existing installations**: retrieve the current datastore ID from the server's config file before proceeding:
+
+```sh
+grep 'id:' /matrix/media-repo/config/media-repo.yaml
+```
+
+Then use that value for `matrix_media_repo_datastore_file_id`. This is not a secret — it is a plain identifier used by matrix-media-repo to link media files to their storage backend.
+
 By default, the media-repo will use the local filesystem for data storage. You can alternatively use a `s3` cloud backend as well. Access token caching is also enabled by default since the logout endpoints are proxied through the media repo.
 
 ### Enable metrics
@@ -109,6 +122,11 @@ matrix_media_repo_admins: []
 matrix_media_repo_datastore_file_for_kinds: ["thumbnails", "remote_media", "local_media", "archives"]
 matrix_media_repo_datastore_s3_for_kinds: []
 
+# Required when S3 storage is enabled (matrix_media_repo_datastore_s3_for_kinds is non-empty).
+# Any unique alphanumeric string. Cannot be changed after first use.
+# For new installations, generate one with: pwgen -s 64 1
+# matrix_media_repo_datastore_s3_id: ""
+
 # The s3 uploader needs a temporary location to buffer files to reduce memory usage on
 # small file uploads. If the file size is unknown, the file is written to this location
 # before being uploaded to s3 (then the file is deleted). If you aren't concerned about

docs/configuring-playbook-ssl-certificates.md

@@ -17,7 +17,7 @@ By default, the playbook retrieves and automatically renews free SSL certificate
 - This guide is intended to be referred for configuring the integrated Traefik server with regard to SSL certificates retrieval. If you're using [your own webserver](configuring-playbook-own-webserver.md), consult its documentation about how to configure it.
 - Let's Encrypt ends the expiration notification email service on June 4, 2025 (see: [the official announcement](https://letsencrypt.org/2025/01/22/ending-expiration-emails/)), and it recommends using a third party service for those who want to receive expiration notifications. If you are looking for a self-hosting service, you may be interested in a monitoring tool such as [Update Kuma](https://github.com/louislam/uptime-kuma/).
 
-  The [Mother-of-All-Self-Hosting (MASH)](https://github.com/mother-of-all-self-hosting/mash-playbook) Ansible playbook can be used to install and manage an Uptime Kuma instance. See [this page](https://github.com/mother-of-all-self-hosting/mash-playbook/blob/main/docs/services/uptime-kuma.md) for the instruction to install it with the MASH playbook. If you are wondering how to use the MASH playbook for your Matrix server, refer [this page](https://github.com/mother-of-all-self-hosting/mash-playbook/blob/main/docs/setting-up-services-on-mdad-server.md).
+  The [Mother-of-All-Self-Hosting (MASH)](https://github.com/mother-of-all-self-hosting/mash-playbook) Ansible playbook can be used to install and manage an Uptime Kuma instance. See [this page](https://github.com/mother-of-all-self-hosting/mash-playbook/blob/main/docs/services/uptime-kuma.md) for the instruction to install it with the playbook. If you are wondering how to use it for your Matrix server, refer to [this page](https://github.com/mother-of-all-self-hosting/mash-playbook/blob/main/docs/setting-up-services-on-mdad-server.md) for the overview.
 
 ## Use staging Let's Encrypt certificates
 

docs/configuring-playbook-turn.md

@@ -1,9 +1,12 @@
 <!--
-SPDX-FileCopyrightText: 2019 - 2024 Slavi Pantaleev
+SPDX-FileCopyrightText: 2018-2024 Slavi Pantaleev
+SPDX-FileCopyrightText: 2020 Aaron Raimist
 SPDX-FileCopyrightText: 2020 Christian Wolf
-SPDX-FileCopyrightText: 2020 MDAD project contributors
 SPDX-FileCopyrightText: 2020 Marcel Partap
-SPDX-FileCopyrightText: 2024 - 2025 Suguru Hirahara
+SPDX-FileCopyrightText: 2020-2024 MDAD project contributors
+SPDX-FileCopyrightText: 2022 Alejo Diaz
+SPDX-FileCopyrightText: 2022 Julian Foad
+SPDX-FileCopyrightText: 2024-2026 Suguru Hirahara
 
 SPDX-License-Identifier: AGPL-3.0-or-later
 -->
@@ -23,16 +26,19 @@ In the `hosts` file we explicitly ask for your server's external IP address when
 If you'd rather use a local IP for `ansible_host`, add the following configuration to your `vars.yml` file. Make sure to replace `YOUR_PUBLIC_IP` with the pubic IP used by the server.
 
 ```yaml
-matrix_coturn_turn_external_ip_address: "YOUR_PUBLIC_IP"
+coturn_turn_external_ip_address: "YOUR_PUBLIC_IP"
 ```
 
-If you'd like to rely on external IP address auto-detection (not recommended unless you need it), set an empty value to the variable. The playbook will automatically contact an [EchoIP](https://github.com/mpolden/echoip)-compatible service (`https://ifconfig.co/json` by default) to determine your server's IP address. This API endpoint is configurable via the `matrix_coturn_turn_external_ip_address_auto_detection_echoip_service_url` variable.
+If you'd like to rely on external IP address auto-detection (not recommended unless you need it), set an empty value to the variable. The playbook will automatically contact an [echoip](https://github.com/mpolden/echoip)-compatible service (`https://ifconfig.co/json` by default) to determine your server's IP address. This API endpoint is configurable via the `coturn_turn_external_ip_address_auto_detection_echoip_service_url` variable.
+
+>[!NOTE]
+> You can self-host the echoip service by using the [Mother-of-All-Self-Hosting (MASH)](https://github.com/mother-of-all-self-hosting/mash-playbook) Ansible playbook. See [this page](https://github.com/mother-of-all-self-hosting/mash-playbook/blob/main/docs/services/echoip.md) for the instruction to install it with the playbook. If you are wondering how to use it for your Matrix server, refer to [this page](https://github.com/mother-of-all-self-hosting/mash-playbook/blob/main/docs/setting-up-services-on-mdad-server.md) for the overview.
 
 If your server has multiple external IP addresses, the coturn role offers a different variable for specifying them:
 
 ```yaml
-# Note: matrix_coturn_turn_external_ip_addresses is different than matrix_coturn_turn_external_ip_address
-matrix_coturn_turn_external_ip_addresses: ['1.2.3.4', '4.5.6.7']
+# Note: coturn_turn_external_ip_addresses is different than coturn_turn_external_ip_address
+coturn_turn_external_ip_addresses: ['1.2.3.4', '4.5.6.7']
 ```
 
 ### Change the authentication mechanism (optional)
@@ -42,7 +48,7 @@ The playbook uses the [`auth-secret` authentication method](https://github.com/c
 To do so, add the following configuration to your `vars.yml` file:
 
 ```yaml
-matrix_coturn_authentication_method: lt-cred-mech
+coturn_authentication_method: lt-cred-mech
 ```
 
 Regardless of the selected authentication method, the playbook generates secrets automatically and passes them to the homeserver and coturn.
@@ -56,7 +62,7 @@ By default, Coturn uses the same hostname as your Matrix homeserver (the value o
 If you'd like to use a custom subdomain for Coturn (e.g., `turn.example.com` or `t.matrix.example.com`), add the following configuration to your `vars.yml` file:
 
 ```yaml
-matrix_coturn_hostname: turn.example.com
+coturn_hostname: turn.example.com
 ```
 
 The playbook will automatically:
@@ -72,7 +78,7 @@ If you'd like to use another TURN server (be it coturn or some other one), add t
 
 ```yaml
 # Disable integrated coturn server
-matrix_coturn_enabled: false
+coturn_enabled: false
 
 # Point Synapse to your other coturn server
 matrix_synapse_turn_uris:
@@ -93,15 +99,15 @@ You can put multiple host/port combinations if you'd like to.
 
 ### Edit the reloading schedule (optional)
 
-By default the service is reloaded on 6:30 a.m. every day based on the `matrix_coturn_reload_schedule` variable so that new SSL certificates can kick in. It is defined in the format of systemd timer calendar.
+By default the service is reloaded on 6:30 a.m. every day based on the `coturn_reload_schedule` variable so that new SSL certificates can kick in. It is defined in the format of systemd timer calendar.
 
 To edit the schedule, add the following configuration to your `vars.yml` file (adapt to your needs):
 
 ```yaml
-matrix_coturn_reload_schedule: "*-*-* 06:30:00"
+coturn_reload_schedule: "*-*-* 06:30:00"
 ```
 
-**Note**: the actual job may run with a delay. See `matrix_coturn_reload_schedule_randomized_delay_sec` for its default value.
+**Note**: the actual job may run with a delay. See `coturn_reload_schedule_randomized_delay_sec` for its default value.
 
 ### Extending the configuration
 
@@ -109,14 +115,14 @@ There are some additional things you may wish to configure about the TURN server
 
 Take a look at:
 
-- `roles/custom/matrix-coturn/defaults/main.yml` for some variables that you can customize via your `vars.yml` file
+- `roles/galaxy/coturn/defaults/main.yml` for some variables that you can customize via your `vars.yml` file
 
 ## Disabling coturn
 
 If, for some reason, you'd like for the playbook to not install coturn (or to uninstall it if it was previously installed), add the following configuration to your `vars.yml` file:
 
 ```yaml
-matrix_coturn_enabled: false
+coturn_enabled: false
 ```
 
 In that case, Synapse would not point to any coturn servers and audio/video call functionality may fail.

docs/configuring-playbook.md

@@ -51,8 +51,6 @@ For a more custom setup, see the [Other configuration options](#other-configurat
 
   - [Configuring Conduit](configuring-playbook-conduit.md), if you've switched to the [Conduit](https://conduit.rs) homeserver implementation
 
-  - [Configuring conduwuit](configuring-playbook-conduwuit.md), if you've switched to the [conduwuit](https://conduwuit.puppyirl.gay/) homeserver implementation
-
   - [Configuring continuwuity](configuring-playbook-continuwuity.md), if you've switched to the [continuwuity](https://continuwuity.org) homeserver implementation
 
   - [Configuring Dendrite](configuring-playbook-dendrite.md), if you've switched to the [Dendrite](https://matrix-org.github.io/dendrite) homeserver implementation
@@ -186,8 +184,6 @@ Bridges can be used to connect your Matrix installation with third-party communi
 
 - [Setting up WeChat bridging](configuring-playbook-bridge-wechat.md)
 
-- [Setting up Zulip bridging](configuring-playbook-bridge-zulip.md)
-
 ### Bots
 
 Bots provide various additional functionality to your installation.
@@ -263,6 +259,8 @@ Various services that don't fit any other categories.
 
 **Note**: since a deprecated or unmaintained service will not be updated, its bug or vulnerability will be unlikely to get patched. It is recommended to migrate from the service to an alternative if any, and make sure to do your own research before you decide to keep it running nonetheless.
 
+- [Configuring conduwuit](configuring-playbook-conduwuit.md) (removed; this component has been abandoned and unmaintained)
+
 - [Setting up the Sliding Sync proxy](configuring-playbook-sliding-sync-proxy.md) for clients which require Sliding Sync support (like old Element X versions, before it got switched to Simplified Sliding Sync)
 
 - [Setting up Appservice Webhooks bridging](configuring-playbook-bridge-appservice-webhooks.md) (deprecated; the bridge's author suggests taking a look at [matrix-hookshot](https://github.com/matrix-org/matrix-hookshot) as a replacement, which can also be [installed using this playbook](configuring-playbook-bridge-hookshot.md))

docs/container-images.md

@@ -27,7 +27,6 @@ We try to stick to official images (provided by their respective projects) as mu
 | ------- | --------------- | -------- | ----------- |
 | [Synapse](configuring-playbook-synapse.md) | [element-hq/synapse](https://ghcr.io/element-hq/synapse) | ✅ | Storing your data and managing your presence in the [Matrix](http://matrix.org/) network |
 | [Conduit](configuring-playbook-conduit.md) | [matrixconduit/matrix-conduit](https://hub.docker.com/r/matrixconduit/matrix-conduit) | ❌ | Storing your data and managing your presence in the [Matrix](http://matrix.org/) network. Conduit is a lightweight open-source server implementation of the Matrix Specification with a focus on easy setup and low system requirements |
-| [conduwuit](configuring-playbook-conduwuit.md) | [girlbossceo/conduwuit](https://ghcr.io/girlbossceo/conduwuit) | ❌ | Storing your data and managing your presence in the [Matrix](http://matrix.org/) network. conduwuit is a fork of Conduit. |
 | [continuwuity](configuring-playbook-continuwuity.md) | [continuwuation/continuwuity](https://forgejo.ellis.link/continuwuation/continuwuity) | ❌ | Storing your data and managing your presence in the [Matrix](http://matrix.org/) network. continuwuity is a continuation of conduwuit. |
 | [Dendrite](configuring-playbook-dendrite.md) | [matrixdotorg/dendrite-monolith](https://hub.docker.com/r/matrixdotorg/dendrite-monolith/) | ❌ | Storing your data and managing your presence in the [Matrix](http://matrix.org/) network. Dendrite is a second-generation Matrix homeserver written in Go, an alternative to Synapse. |
 
@@ -106,7 +105,6 @@ Bridges can be used to connect your Matrix installation with third-party communi
 | [matrix-hookshot](configuring-playbook-bridge-hookshot.md) | [halfshot/matrix-hookshot](https://hub.docker.com/r/halfshot/matrix-hookshot) | ❌ | Bridge for generic webhooks and multiple project management services, such as GitHub, GitLab, Figma, and Jira in particular |
 | [matrix-sms-bridge](configuring-playbook-bridge-matrix-bridge-sms.md) | [folivonet/matrix-sms-bridge](https://hub.docker.com/repository/docker/folivonet/matrix-sms-bridge) | ❌ | Bridge to SMS |
 | [matrix-wechat](configuring-playbook-bridge-wechat.md) | [lxduo/matrix-wechat](https://hub.docker.com/r/lxduo/matrix-wechat) | ❌ | Bridge to [WeChat](https://www.wechat.com/) |
-| [MatrixZulipBridge](configuring-playbook-bridge-zulip.md) | [GearKite/MatrixZulipBridge](https://ghcr.io/gearkite/matrixzulipbridge) | ❌ | Puppeting appservice bridge for [Zulip](https://zulip.com/) |
 | [Heisenbridge](configuring-playbook-bridge-heisenbridge.md) | [hif1/heisenbridge](https://hub.docker.com/r/hif1/heisenbridge) | ❌ | Bouncer-style bridge to [IRC](https://wikipedia.org/wiki/Internet_Relay_Chat) |
 | [mx-puppet-groupme](configuring-playbook-bridge-mx-puppet-groupme.md) | [xangelix/mx-puppet-groupme](https://hub.docker.com/r/xangelix/mx-puppet-groupme) | ❌ | Bridge to [GroupMe](https://groupme.com/) |
 | [matrix-steam-bridge](configuring-playbook-bridge-steam.md) | [jasonlaguidice/matrix-steam-bridge](https://github.com/jasonlaguidice/matrix-steam-bridge/pkgs/container/matrix-steam-bridge) | ❌ | Bridge to [Steam](https://steampowered.com/) |
@@ -173,6 +171,7 @@ The list of the deprecated or unmaintained services is available [here](configur
 
 | Service | Container image | Default? | Description |
 | ------- | --------------- | -------- | ----------- |
+| [conduwuit](configuring-playbook-conduwuit.md) | [girlbossceo/conduwuit](https://ghcr.io/girlbossceo/conduwuit) | ❌ | Storing your data and managing your presence in the [Matrix](http://matrix.org/) network. conduwuit was a fork of Conduit. |
 | [Dimension](configuring-playbook-dimension.md) | [turt2live/matrix-dimension](https://hub.docker.com/r/turt2live/matrix-dimension) | ❌ | Open source integration manager for Matrix clients |
 | [Email2Matrix](configuring-playbook-email2matrix.md) | [devture/email2matrix](https://hub.docker.com/r/devture/email2matrix/) | ❌ | Bridge for relaying emails to Matrix rooms |
 | [Go-NEB](configuring-playbook-bot-go-neb.md) | [matrixdotorg/go-neb](https://hub.docker.com/r/matrixdotorg/go-neb) | ❌ | Multi functional bot written in Go |

docs/faq.md

@@ -313,7 +313,7 @@ exim_relay_enabled: false
 
 # You can also disable this to save more RAM,
 # at the expense of audio/video calls being unreliable.
-matrix_coturn_enabled: false
+coturn_enabled: false
 
 # This makes Synapse not keep track of who is online/offline.
 #

docs/howto-srv-server-delegation.md

@@ -26,7 +26,7 @@ The up-to-date list can be accessed on [traefik's documentation](https://doc.tra
 
 **Note**: the changes below instruct you how to do this for a basic Synapse installation. You will need to adapt the variable name and the content of the labels:
 
-- if you're using another homeserver implementation (e.g. [Conduit](./configuring-playbook-conduit.md), [conduwuit](./configuring-playbook-conduwuit.md), [continuwuity](./configuring-playbook-continuwuity.md) or [Dendrite](./configuring-playbook-dendrite.md))
+- if you're using another homeserver implementation (e.g. [Conduit](./configuring-playbook-conduit.md), [continuwuity](./configuring-playbook-continuwuity.md) or [Dendrite](./configuring-playbook-dendrite.md))
 - if you're using [Synapse with workers enabled](./configuring-playbook-synapse.md#load-balancing-with-workers) (`matrix_synapse_workers_enabled: true`). In that case, it's actually the `matrix-synapse-reverse-proxy-companion` service which has Traefik labels attached
 
 Also, all instructions below are from an older version of the playbook and may not work anymore.
@@ -104,10 +104,10 @@ This should not happen again afterwards as Traefik will renew certificates well
 
 ```yaml
 # Only depend on docker.service, this removes the dependency on the certificate exporter, might imply the need to manually restart coturn on the first installation once the certificates are obtained, afterwards, the reload service should handle things
-matrix_coturn_systemd_required_services_list: ['docker.service']
+coturn_systemd_required_services_list: ['docker.service']
 
 # This changes the path of the loaded certificate, while maintaining the original functionality, we're now loading the wildcard certificate.
-matrix_coturn_container_additional_volumes: |
+coturn_container_additional_volumes: |
   {{
     (
       [
@@ -121,7 +121,7 @@ matrix_coturn_container_additional_volumes: |
          'dst': '/privatekey.key',
          'options': 'ro',
        },
-      ] if matrix_playbook_reverse_proxy_type in ['playbook-managed-traefik', 'other-traefik-container'] and traefik_certs_dumper_enabled and matrix_coturn_tls_enabled else []
+      ] if matrix_playbook_reverse_proxy_type in ['playbook-managed-traefik', 'other-traefik-container'] and traefik_certs_dumper_enabled and coturn_tls_enabled else []
     )
   }}
 ```
@@ -165,10 +165,10 @@ traefik_environment_variables: |
   LEGO_DISABLE_CNAME_SUPPORT=true
 
 # Only depend on docker.service, this removes the dependency on the certificate exporter, might imply the need to manually restart coturn on the first installation once the certificates are obtained, afterwards, the reload service should handle things
-matrix_coturn_systemd_required_services_list: ['docker.service']
+coturn_systemd_required_services_list: ['docker.service']
 
 # This changes the path of the loaded certificate, while maintaining the original functionality, we're now loading the wildcard certificate.
-matrix_coturn_container_additional_volumes: |
+coturn_container_additional_volumes: |
   {{
     (
       [
@@ -182,7 +182,7 @@ matrix_coturn_container_additional_volumes: |
          'dst': '/privatekey.key',
          'options': 'ro',
        },
-      ] if matrix_playbook_reverse_proxy_type in ['playbook-managed-traefik', 'other-traefik-container'] and traefik_certs_dumper_enabled and matrix_coturn_tls_enabled else []
+      ] if matrix_playbook_reverse_proxy_type in ['playbook-managed-traefik', 'other-traefik-container'] and traefik_certs_dumper_enabled and coturn_tls_enabled else []
     )
   }}
 ```

docs/prerequisites.md

@@ -23,8 +23,6 @@ We will be using `example.com` as the domain in the following instruction. Pleas
 
 - [Ansible](http://ansible.com/) program. It's used to run this playbook and configures your server for you. Take a look at [our guide about Ansible](ansible.md) for more information, as well as [version requirements](ansible.md#supported-ansible-versions) and alternative ways to run Ansible.
 
-- [passlib](https://passlib.readthedocs.io/en/stable/index.html) Python library. See [this official documentation](https://passlib.readthedocs.io/en/stable/install.html#installation-instructions) for an instruction to install it. On most distros, you need to install some `python-passlib` or `py3-passlib` package, etc.
-
 - [`git`](https://git-scm.com/) as the recommended way to download the playbook. `git` may also be required on the server if you will be [self-building](self-building.md) components.
 
 - [`just`](https://github.com/casey/just) for running `just roles`, `just update`, etc. (see [`justfile`](../justfile)), although you can also run these commands manually. Take a look at this documentation for more information: [Running `just` commands](just.md).

docs/self-building.md

@@ -28,10 +28,10 @@ Possibly outdated list of roles where self-building the Docker image is currentl
 - `matrix-synapse`
 - `matrix-synapse-admin`
 - `matrix-client-element`
-- `matrix-client-hydrogen`
+- `hydrogen`
 - `cinny`
 - `matrix-registration`
-- `matrix-coturn`
+- `coturn`
 - `matrix-corporal`
 - `matrix-dimension`
 - `exim-relay`

examples/hosts

@@ -1,5 +1,5 @@
 # We explicitly ask for your server's external IP address, because the same value is used for configuring coturn.
-# If you'd rather use a local IP here, make sure to set up `matrix_coturn_turn_external_ip_address`.
+# If you'd rather use a local IP here, make sure to set up `coturn_turn_external_ip_address`.
 #
 # To connect using a non-root user (and elevate to root with sudo later),
 # replace `ansible_ssh_user=root` with something like this: `ansible_ssh_user=username ansible_become=true ansible_become_user=root`.

examples/vars.yml

@@ -61,10 +61,10 @@ postgres_connection_password: ''
 # 2. Uncomment and adjust the line below to specify an IP address manually
 #
 # By default, auto-detection will be attempted using the `https://ifconfig.co/json` API.
-# Default values for this are specified in `matrix_coturn_turn_external_ip_address_auto_detection_*` variables in the coturn role
-# (see `roles/custom/matrix-coturn/defaults/main.yml`).
+# Default values for this are specified in `coturn_turn_external_ip_address_auto_detection_*` variables in the coturn role
+# (see `roles/galaxy/coturn/defaults/main.yml`).
 #
 # If your server has multiple IP addresses, you may define them in another variable which allows a list of addresses.
-# Example: `matrix_coturn_turn_external_ip_addresses: ['1.2.3.4', '4.5.6.7']`
+# Example: `coturn_turn_external_ip_addresses: ['1.2.3.4', '4.5.6.7']`
 #
-# matrix_coturn_turn_external_ip_address: ''
+# coturn_turn_external_ip_address: ''

group_vars/matrix_servers

@@ -114,8 +114,6 @@ matrix_homeserver_container_extra_arguments_auto: |
     +
     (['--mount type=bind,src=' + matrix_hookshot_base_path + '/registration.yml,dst=/hookshot-registration.yml,ro'] if matrix_hookshot_enabled else [])
     +
-    (['--mount type=bind,src=' + matrix_zulip_bridge_base_path + '/registration.yaml,dst=/matrixzulipbridge-registration.yaml,ro'] if matrix_zulip_bridge_enabled else [])
-    +
     (['--mount type=bind,src=' + matrix_mautrix_bluesky_config_path + '/registration.yaml,dst=/matrix-mautrix-bluesky-registration.yaml,ro'] if matrix_mautrix_bluesky_enabled else [])
     +
     (['--mount type=bind,src=' + matrix_mautrix_discord_config_path + '/registration.yaml,dst=/matrix-mautrix-discord-registration.yaml,ro'] if matrix_mautrix_discord_enabled else [])
@@ -175,8 +173,6 @@ matrix_homeserver_app_service_config_files_auto: |
     +
     (['/hookshot-registration.yml'] if matrix_hookshot_enabled else [])
     +
-    (['/matrixzulipbridge-registration.yaml'] if matrix_zulip_bridge_enabled else [])
-    +
     (['/matrix-mautrix-bluesky-registration.yaml'] if matrix_mautrix_bluesky_enabled else [])
     +
     (['/matrix-mautrix-discord-registration.yaml'] if matrix_mautrix_discord_enabled else [])
@@ -216,7 +212,20 @@ matrix_homeserver_app_service_config_files_auto: |
 
 matrix_addons_homeserver_container_network: "{{ matrix_playbook_reverse_proxy_container_network if matrix_playbook_internal_matrix_client_api_traefik_entrypoint_enabled else matrix_homeserver_container_network }}"
 matrix_addons_homeserver_client_api_url: "{{ ('http://' + matrix_playbook_reverse_proxy_hostname + ':' + matrix_playbook_internal_matrix_client_api_traefik_entrypoint_port | string) if matrix_playbook_internal_matrix_client_api_traefik_entrypoint_enabled else matrix_homeserver_container_url }}"
-matrix_addons_homeserver_systemd_services_list: "{{ ([traefik_identifier + '.service'] if matrix_playbook_reverse_proxy_type == 'playbook-managed-traefik' else []) if matrix_playbook_internal_matrix_client_api_traefik_entrypoint_enabled else matrix_homeserver_systemd_services_list }}"
+matrix_addons_homeserver_systemd_services_list: |
+  {{
+    (
+      matrix_homeserver_systemd_services_list
+      +
+      (
+        [traefik_identifier + '.service']
+        if matrix_playbook_reverse_proxy_type == 'playbook-managed-traefik'
+        else []
+      )
+    )
+    if matrix_playbook_internal_matrix_client_api_traefik_entrypoint_enabled
+    else matrix_homeserver_systemd_services_list
+  }}
 
 ########################################################################
 #                                                                      #
@@ -242,12 +251,14 @@ matrix_addons_homeserver_systemd_services_list: "{{ ([traefik_identifier + '.ser
 #     (see `matrix_playbook_internal_matrix_client_api_traefik_entrypoint_enabled`)
 # - core services (the homeserver) get a level of ~1000
 # - services that the homeserver depends on (database, Redis, ntfy, coturn, etc.) get a lower level — between 500 and 1000
-# - coturn gets a higher level if `devture_systemd_service_manager_service_restart_mode == 'one-by-one'` to intentionally delay it, because:
+# - coturn gets a higher priority level (= starts later) if `devture_systemd_service_manager_service_restart_mode == 'one-by-one'` to intentionally delay it, because:
 #  - starting services one by one means that the service manager role waits for each service to fully start before proceeding to the next one
 #  - if coturn has a lower priority than the homeserver, it would be started before it
 #  - since coturn is started before the homeserver, there's no container label telling Traefik to get a `matrix.example.com` certificate
 #  - thus, coturn would spin and wait for a certificate until it fails. We'd get a playbook failure due to it, but service manager will proceed to start all other services anyway.
 #  - only later, when the homeserver actually starts, would that certificate be fetched and dumped
+#  - this is not a problem with `all-at-once` (default) or `priority-batched` (services start concurrently),
+#    or with `clean-stop-start` (everything stops first, then starts in priority order — coturn at 900 is fine)
 # - reverse-proxying services get level 3000
 # - Matrix utility services (bridges, bots) get a level of 2000/2200, so that:
 #   - they can start before the reverse-proxy
@@ -302,8 +313,6 @@ devture_systemd_service_manager_services_list_auto: |
     +
     ([{'name': 'matrix-hookshot.service', 'priority': 2000, 'groups': ['matrix', 'bridges', 'hookshot', 'bridge-hookshot']}] if matrix_hookshot_enabled else [])
     +
-    ([{'name': 'matrix-zulip-bridge.service', 'priority': 2000, 'groups': ['matrix', 'bridges', 'zulip']}] if matrix_zulip_bridge_enabled else [])
-    +
     ([{'name': 'matrix-mautrix-bluesky.service', 'priority': 2000, 'groups': ['matrix', 'bridges', 'mautrix-bluesky']}] if matrix_mautrix_bluesky_enabled else [])
     +
     ([{'name': 'matrix-mautrix-discord.service', 'priority': 2000, 'groups': ['matrix', 'bridges', 'mautrix-discord']}] if matrix_mautrix_discord_enabled else [])
@@ -348,7 +357,7 @@ devture_systemd_service_manager_services_list_auto: |
     +
     ([{'name': 'matrix-client-element.service', 'priority': 2000, 'groups': ['matrix', 'clients', 'element', 'client-element']}] if matrix_client_element_enabled else [])
     +
-    ([{'name': 'matrix-client-hydrogen.service', 'priority': 2000, 'groups': ['matrix', 'clients', 'hydrogen', 'client-hydrogen']}] if matrix_client_hydrogen_enabled else [])
+    ([{'name': (hydrogen_identifier + '.service'), 'priority': 2000, 'groups': ['matrix', 'clients', 'hydrogen', 'client-hydrogen']}] if hydrogen_enabled else [])
     +
     ([{'name': 'matrix-client-schildichat.service', 'priority': 2000, 'groups': ['matrix', 'clients', 'schildichat', 'client-schildichat']}] if matrix_client_schildichat_enabled else [])
     +
@@ -358,13 +367,13 @@ devture_systemd_service_manager_services_list_auto: |
     +
     ([{'name': 'matrix-corporal.service', 'priority': 1500, 'groups': ['matrix', 'corporal']}] if matrix_corporal_enabled else [])
     +
-    ([{'name': 'matrix-coturn.service', 'priority': (900 if devture_systemd_service_manager_service_restart_mode == 'clean-stop-start' else 1500), 'groups': ['matrix', 'coturn']}] if matrix_coturn_enabled else [])
+    ([{'name': (coturn_identifier + '.service'), 'priority': (1500 if devture_systemd_service_manager_service_restart_mode == 'one-by-one' else 900), 'groups': ['matrix', 'coturn']}] if coturn_enabled else [])
     +
     ([{'name': 'matrix-matrixto.service', 'priority': 4000, 'groups': ['matrix', 'matrixto']}] if matrix_matrixto_enabled else [])
     +
     ([{'name': 'matrix-rageshake.service', 'priority': 4000, 'groups': ['matrix', 'rageshake']}] if matrix_rageshake_enabled else [])
     +
-    ([{'name': 'matrix-coturn-reload.timer', 'priority': 5000, 'groups': ['matrix', 'coturn']}] if (matrix_coturn_enabled and matrix_coturn_tls_enabled) else [])
+    ([{'name': (coturn_identifier + '-reload.timer'), 'priority': 5000, 'groups': ['matrix', 'coturn']}] if (coturn_enabled and coturn_tls_enabled) else [])
     +
     ([{'name': 'matrix-dimension.service', 'priority': 4000, 'groups': ['matrix', 'integration-managers', 'dimension']}] if matrix_dimension_enabled else [])
     +
@@ -523,7 +532,6 @@ matrix_homeserver_container_client_api_endpoint: |-
       'synapse': ('matrix-synapse-reverse-proxy-companion:8008' if matrix_synapse_reverse_proxy_companion_enabled | default(false) else ('matrix-synapse:'+ matrix_synapse_container_client_api_port | default('8008') | string)),
       'dendrite': ('matrix-dendrite:' + matrix_dendrite_http_bind_port | default('8008') | string),
       'conduit': ('matrix-conduit:' + matrix_conduit_port_number | default('8008') | string),
-      'conduwuit': ('matrix-conduwuit:' + matrix_conduwuit_config_port_number | default('8008') | string),
       'continuwuity': ('matrix-continuwuity:' + matrix_continuwuity_config_port_number | default('8008') | string),
     }[matrix_homeserver_implementation]
   }}
@@ -534,7 +542,6 @@ matrix_homeserver_container_federation_api_endpoint: |-
       'synapse': ('matrix-synapse-reverse-proxy-companion:8048' if matrix_synapse_reverse_proxy_companion_enabled else ('matrix-synapse:'+ matrix_synapse_container_federation_api_plain_port | default('8008') | string)),
       'dendrite': ('matrix-dendrite:' + matrix_dendrite_http_bind_port | default('8008') | string),
       'conduit': ('matrix-conduit:' + matrix_conduit_port_number | default('8008') | string),
-      'conduwuit': ('matrix-conduwuit:' + matrix_conduwuit_config_port_number | default('8008') | string),
       'continuwuity': ('matrix-continuwuity:' + matrix_continuwuity_config_port_number | default('8008') | string),
     }[matrix_homeserver_implementation]
   }}
@@ -2074,55 +2081,6 @@ matrix_hookshot_public_hostname: "{{ matrix_server_fqn_matrix }}"
 #
 ######################################################################
 
-######################################################################
-#
-# matrix-bridge-zulip
-#
-######################################################################
-
-# We don't enable bridges by default.
-matrix_zulip_bridge_enabled: false
-
-matrix_zulip_bridge_scheme: "{{ 'https' if matrix_playbook_ssl_enabled else 'http' }}"
-
-# Set this to your Matrix ID if you want to enforce the owner, otherwise first _local_ user becomes one
-matrix_zulip_bridge_owner: "{{ matrix_admin if matrix_admin else '' }}"
-
-matrix_zulip_bridge_systemd_required_services_list_auto: |
-  {{
-    matrix_addons_homeserver_systemd_services_list
-  }}
-
-matrix_zulip_bridge_docker_image_registry_prefix_upstream: "{{ matrix_container_global_registry_prefix_override if matrix_container_global_registry_prefix_override else matrix_zulip_bridge_docker_image_registry_prefix_upstream_default }}"
-
-matrix_zulip_bridge_container_network: "{{ matrix_addons_container_network }}"
-
-matrix_zulip_bridge_container_additional_networks_auto: |-
-  {{
-    (
-      ([] if matrix_addons_homeserver_container_network == '' else [matrix_addons_homeserver_container_network])
-      +
-      [matrix_playbook_reverse_proxyable_services_additional_network] if (matrix_zulip_bridge_container_labels_traefik_enabled and matrix_playbook_reverse_proxyable_services_additional_network) else []
-    ) | unique
-  }}
-
-matrix_zulip_bridge_container_labels_traefik_enabled: "{{ matrix_playbook_reverse_proxy_type in ['playbook-managed-traefik', 'other-traefik-container'] }}"
-matrix_zulip_bridge_container_labels_traefik_docker_network: "{{ matrix_playbook_reverse_proxyable_services_additional_network }}"
-matrix_zulip_bridge_container_labels_traefik_entrypoints: "{{ traefik_entrypoint_primary }}"
-matrix_zulip_bridge_container_labels_traefik_tls_certResolver: "{{ traefik_certResolver_primary }}"
-
-matrix_zulip_bridge_appservice_token: "{{ (matrix_homeserver_generic_secret_key + ':zulip.as.tok') | hash('sha512') | to_uuid }}"
-
-matrix_zulip_bridge_homeserver_token: "{{ (matrix_homeserver_generic_secret_key + ':zulip.hs.tok') | hash('sha512') | to_uuid }}"
-
-matrix_zulip_bridge_homeserver_url: "{{ matrix_addons_homeserver_client_api_url }}"
-
-######################################################################
-#
-# /matrix-bridge-zulip
-#
-######################################################################
-
 ######################################################################
 #
 # matrix-bridge-mx-puppet-steam
@@ -3146,31 +3104,42 @@ matrix_rageshake_container_labels_traefik_tls_certResolver: "{{ traefik_certReso
 
 ######################################################################
 #
-# matrix-coturn
+# coturn
 #
 ######################################################################
 
-matrix_coturn_enabled: true
+coturn_enabled: true
 
-matrix_coturn_hostname: "{{ matrix_server_fqn_matrix }}"
+coturn_identifier: matrix-coturn
 
-matrix_coturn_docker_image_registry_prefix_upstream: "{{ matrix_container_global_registry_prefix_override if matrix_container_global_registry_prefix_override else matrix_coturn_docker_image_registry_prefix_upstream_default }}"
+coturn_base_path: "{{ matrix_base_data_path }}/coturn"
 
-matrix_coturn_container_image_self_build: "{{ matrix_architecture not in ['amd64', 'arm32', 'arm64'] }}"
+coturn_uid: "{{ matrix_user_uid }}"
+coturn_gid: "{{ matrix_user_gid }}"
+
+coturn_hostname: "{{ matrix_server_fqn_matrix }}"
+
+coturn_container_image_registry_prefix: "{{ 'localhost/' if coturn_container_image_self_build else coturn_container_image_registry_prefix_upstream }}"
+coturn_container_image_registry_prefix_upstream: "{{ matrix_container_global_registry_prefix_override if matrix_container_global_registry_prefix_override else coturn_container_image_registry_prefix_upstream_default }}"
+
+coturn_container_image_self_build: "{{ matrix_architecture not in ['amd64', 'arm32', 'arm64'] }}"
 
 # We make the assumption that `ansible_host` points to an external IP address, which may not always be the case.
-# Users are free to set `matrix_coturn_turn_external_ip_address` to an empty string
-# to allow auto-detection (via an EchoIP service) to happen at runtime.
-matrix_coturn_turn_external_ip_address: "{{ ansible_host }}"
+# Users are free to set `coturn_turn_external_ip_address` to an empty string
+# to allow auto-detection (via an echoip service) to happen at runtime.
+coturn_turn_external_ip_address: "{{ ansible_host }}"
 
-matrix_coturn_turn_static_auth_secret: "{{ ((matrix_homeserver_generic_secret_key + ':coturn.sas') | hash('sha512') | to_uuid) if matrix_coturn_authentication_method == 'auth-secret' else '' }}"
+# By default, we use the official public instance.
+coturn_turn_external_ip_address_auto_detection_echoip_service_url: https://ifconfig.co/json
 
-matrix_coturn_lt_cred_mech_username: "{{ ((matrix_homeserver_generic_secret_key + ':coturn.user') | hash('sha512') | to_uuid) if matrix_coturn_authentication_method == 'lt-cred-mech' else '' }}"
-matrix_coturn_lt_cred_mech_password: "{{ ((matrix_homeserver_generic_secret_key + ':coturn.pass') | hash('sha512') | to_uuid) if matrix_coturn_authentication_method == 'lt-cred-mech' else '' }}"
+coturn_turn_static_auth_secret: "{{ ((matrix_homeserver_generic_secret_key + ':coturn.sas') | hash('sha512') | to_uuid) if coturn_authentication_method == 'auth-secret' else '' }}"
 
-matrix_coturn_tls_enabled: "{{ matrix_playbook_ssl_enabled }}"
+coturn_lt_cred_mech_username: "{{ ((matrix_homeserver_generic_secret_key + ':coturn.user') | hash('sha512') | to_uuid) if coturn_authentication_method == 'lt-cred-mech' else '' }}"
+coturn_lt_cred_mech_password: "{{ ((matrix_homeserver_generic_secret_key + ':coturn.pass') | hash('sha512') | to_uuid) if coturn_authentication_method == 'lt-cred-mech' else '' }}"
 
-matrix_coturn_tls_cert_path: |-
+coturn_tls_enabled: "{{ matrix_playbook_ssl_enabled }}"
+
+coturn_tls_cert_path: |-
   {{
     {
       'playbook-managed-traefik': ('/certificate.crt' if traefik_certs_dumper_enabled else ''),
@@ -3179,7 +3148,7 @@ matrix_coturn_tls_cert_path: |-
     }[matrix_playbook_reverse_proxy_type]
   }}
 
-matrix_coturn_tls_key_path: |-
+coturn_tls_key_path: |-
   {{
     {
       'playbook-managed-traefik': ('/privatekey.key' if traefik_certs_dumper_enabled else ''),
@@ -3188,32 +3157,32 @@ matrix_coturn_tls_key_path: |-
     }[matrix_playbook_reverse_proxy_type]
   }}
 
-matrix_coturn_container_additional_volumes: |
+coturn_container_additional_volumes: |
   {{
     (
       [
        {
-         'src': (traefik_certs_dumper_dumped_certificates_path +  '/' + matrix_coturn_hostname + '/certificate.crt'),
+         'src': (traefik_certs_dumper_dumped_certificates_path +  '/' + coturn_hostname + '/certificate.crt'),
          'dst': '/certificate.crt',
          'options': 'ro',
        },
        {
-         'src': (traefik_certs_dumper_dumped_certificates_path +  '/' + matrix_coturn_hostname + '/privatekey.key'),
+         'src': (traefik_certs_dumper_dumped_certificates_path +  '/' + coturn_hostname + '/privatekey.key'),
          'dst': '/privatekey.key',
          'options': 'ro',
        },
-      ] if (matrix_playbook_reverse_proxy_type in ['playbook-managed-traefik', 'other-traefik-container'] and traefik_certs_dumper_enabled and matrix_coturn_tls_enabled and (matrix_coturn_tls_cert_path and matrix_coturn_tls_key_path)) else []
+      ] if (matrix_playbook_reverse_proxy_type in ['playbook-managed-traefik', 'other-traefik-container'] and traefik_certs_dumper_enabled and coturn_tls_enabled and (coturn_tls_cert_path and coturn_tls_key_path)) else []
     )
   }}
 
-matrix_coturn_systemd_required_services_list_auto: |
+coturn_systemd_required_services_list_auto: |
   {{
-    ([traefik_certs_dumper_identifier + '-wait-for-domain@' + matrix_coturn_hostname + '.service'] if matrix_playbook_reverse_proxy_type in ['playbook-managed-traefik', 'other-traefik-container'] and traefik_certs_dumper_enabled and matrix_coturn_tls_enabled else [])
+    ([traefik_certs_dumper_identifier + '-wait-for-domain@' + coturn_hostname + '.service'] if matrix_playbook_reverse_proxy_type in ['playbook-managed-traefik', 'other-traefik-container'] and traefik_certs_dumper_enabled and coturn_tls_enabled else [])
   }}
 
 ######################################################################
 #
-# /matrix-coturn
+# /coturn
 #
 ######################################################################
 
@@ -3354,6 +3323,9 @@ ddclient_identifier: matrix-dynamic-dns
 
 ddclient_base_path: "{{ matrix_base_data_path }}/dynamic-dns"
 
+ddclient_uid: "{{ matrix_user_uid }}"
+ddclient_gid: "{{ matrix_user_gid }}"
+
 ddclient_container_image_registry_prefix: "{{ 'localhost/' if ddclient_container_image_self_build else ddclient_container_image_registry_prefix_upstream }}"
 ddclient_container_image_registry_prefix_upstream: "{{ matrix_container_global_registry_prefix_override if matrix_container_global_registry_prefix_override else ddclient_docker_image_registry_prefix_upstream_default }}"
 
@@ -3432,7 +3404,7 @@ jitsi_web_stun_servers: |
       'stun:' + matrix_server_fqn_matrix + ':5349',
       'stun:' + matrix_server_fqn_matrix + ':3478',
     ]
-    if matrix_coturn_enabled
+    if coturn_enabled
     else [ 'stun:meet-jit-si-turnrelay.jitsi.net:443']
   }}
 
@@ -3441,11 +3413,11 @@ jitsi_web_framing_enabled: true
 
 # Jitsi (Prosody) only seems to support authenticating with coturn using `auth-secret`, not `lt-cred-mech`.
 # See: https://prosody.im/doc/coturn
-jitsi_turn_credentials: "{{ matrix_coturn_turn_static_auth_secret if (matrix_coturn_enabled and matrix_coturn_authentication_method == 'auth-secret') else '' }}"
-jitsi_turn_host: "{{ ('turn.' + matrix_server_fqn_matrix) if matrix_coturn_enabled else '' }}"
-jitsi_turns_host: "{{ ('turn.' + matrix_server_fqn_matrix) if matrix_coturn_enabled else '' }}"
-jitsi_turn_port: "{{ matrix_coturn_container_stun_plain_host_bind_port_tcp.split(':')[-1] if matrix_coturn_enabled else '' }}"
-jitsi_turns_port: "{{ matrix_coturn_container_stun_tls_host_bind_port_tcp.split(':')[-1] if matrix_coturn_enabled else '' }}"
+jitsi_turn_credentials: "{{ coturn_turn_static_auth_secret if (coturn_enabled and coturn_authentication_method == 'auth-secret') else '' }}"
+jitsi_turn_host: "{{ ('turn.' + matrix_server_fqn_matrix) if coturn_enabled else '' }}"
+jitsi_turns_host: "{{ ('turn.' + matrix_server_fqn_matrix) if coturn_enabled else '' }}"
+jitsi_turn_port: "{{ coturn_container_stun_plain_host_bind_port_tcp.split(':')[-1] if coturn_enabled else '' }}"
+jitsi_turns_port: "{{ coturn_container_stun_tls_host_bind_port_tcp.split(':')[-1] if coturn_enabled else '' }}"
 
 # If the self-hosted Etherpad instance is available, it will also show up in Jitsi conferences,
 # unless explicitly disabled by setting `jitsi_etherpad_enabled` to false.
@@ -4152,39 +4124,49 @@ matrix_client_element_element_call_url: "{{ matrix_element_call_public_url if ma
 
 ######################################################################
 #
-# matrix-client-hydrogen
+# hydrogen
 #
 ######################################################################
 
-matrix_client_hydrogen_enabled: false
+hydrogen_enabled: false
 
-matrix_client_hydrogen_docker_image_registry_prefix_upstream: "{{ matrix_container_global_registry_prefix_override if matrix_container_global_registry_prefix_override else matrix_client_hydrogen_docker_image_registry_prefix_upstream_default }}"
+hydrogen_identifier: matrix-client-hydrogen
 
-matrix_client_hydrogen_container_image_self_build: "{{ matrix_architecture not in ['arm64', 'amd64'] }}"
+hydrogen_uid: "{{ matrix_user_uid }}"
+hydrogen_gid: "{{ matrix_user_gid }}"
 
-matrix_client_hydrogen_container_http_host_bind_port: "{{ (matrix_playbook_service_host_bind_interface_prefix ~ '8768') if matrix_playbook_service_host_bind_interface_prefix else '' }}"
+hydrogen_container_image_registry_prefix: "{{ 'localhost/' if hydrogen_container_image_self_build else hydrogen_container_image_registry_prefix_upstream }}"
+hydrogen_container_image_registry_prefix_upstream: "{{ matrix_container_global_registry_prefix_override if matrix_container_global_registry_prefix_override else hydrogen_container_image_registry_prefix_upstream_default }}"
 
-matrix_client_hydrogen_container_network: "{{ matrix_addons_container_network }}"
+hydrogen_container_image_self_build: "{{ matrix_architecture not in ['arm64', 'amd64'] }}"
 
-matrix_client_hydrogen_container_additional_networks: "{{ [matrix_playbook_reverse_proxyable_services_additional_network] if (matrix_client_hydrogen_container_labels_traefik_enabled and matrix_playbook_reverse_proxyable_services_additional_network) else [] }}"
+hydrogen_container_http_host_bind_port: "{{ (matrix_playbook_service_host_bind_interface_prefix ~ '8768') if matrix_playbook_service_host_bind_interface_prefix else '' }}"
 
-matrix_client_hydrogen_container_labels_traefik_enabled: "{{ matrix_playbook_reverse_proxy_type in ['playbook-managed-traefik', 'other-traefik-container'] }}"
-matrix_client_hydrogen_container_labels_traefik_docker_network: "{{ matrix_playbook_reverse_proxyable_services_additional_network }}"
-matrix_client_hydrogen_container_labels_traefik_entrypoints: "{{ traefik_entrypoint_primary }}"
-matrix_client_hydrogen_container_labels_traefik_tls_certResolver: "{{ traefik_certResolver_primary }}"
+hydrogen_container_network: "{{ matrix_addons_container_network }}"
 
-matrix_client_hydrogen_container_labels_traefik_compression_middleware_enabled: "{{ matrix_playbook_reverse_proxy_traefik_middleware_compression_enabled }}"
-matrix_client_hydrogen_container_labels_traefik_compression_middleware_name: "{{ matrix_playbook_reverse_proxy_traefik_middleware_compression_name if matrix_playbook_reverse_proxy_traefik_middleware_compression_enabled else '' }}"
+hydrogen_container_additional_networks: "{{ [matrix_playbook_reverse_proxyable_services_additional_network] if (hydrogen_container_labels_traefik_enabled and matrix_playbook_reverse_proxyable_services_additional_network) else [] }}"
 
-matrix_client_hydrogen_scheme: "{{ 'https' if matrix_playbook_ssl_enabled else 'http' }}"
+hydrogen_container_labels_traefik_enabled: "{{ matrix_playbook_reverse_proxy_type in ['playbook-managed-traefik', 'other-traefik-container'] }}"
+hydrogen_container_labels_traefik_docker_network: "{{ matrix_playbook_reverse_proxyable_services_additional_network }}"
+hydrogen_container_labels_traefik_entrypoints: "{{ traefik_entrypoint_primary }}"
+hydrogen_container_labels_traefik_tls_certResolver: "{{ traefik_certResolver_primary }}"
 
-matrix_client_hydrogen_default_hs_url: "{{ matrix_homeserver_url }}"
+hydrogen_container_labels_traefik_compression_middleware_enabled: "{{ matrix_playbook_reverse_proxy_traefik_middleware_compression_enabled }}"
+hydrogen_container_labels_traefik_compression_middleware_name: "{{ matrix_playbook_reverse_proxy_traefik_middleware_compression_name if matrix_playbook_reverse_proxy_traefik_middleware_compression_enabled else '' }}"
 
-matrix_client_hydrogen_self_check_validate_certificates: "{{ matrix_playbook_ssl_enabled }}"
+hydrogen_scheme: "{{ 'https' if matrix_playbook_ssl_enabled else 'http' }}"
+
+hydrogen_default_hs_url: "{{ matrix_homeserver_url }}"
+
+hydrogen_self_check_validate_certificates: "{{ matrix_playbook_ssl_enabled }}"
+
+hydrogen_base_path: "{{ matrix_base_data_path }}/client-hydrogen"
+
+hydrogen_hostname: "{{ matrix_server_fqn_hydrogen }}"
 
 ######################################################################
 #
-# /matrix-client-hydrogen
+# /hydrogen
 #
 ######################################################################
 
@@ -4426,10 +4408,10 @@ matrix_synapse_email_smtp_port: 8025
 matrix_synapse_email_smtp_require_transport_security: false
 matrix_synapse_email_notif_from: "Matrix <{{ exim_relay_sender_address }}>"
 
-matrix_synapse_turn_uris: "{{ matrix_coturn_turn_uris if matrix_coturn_enabled else [] }}"
-matrix_synapse_turn_shared_secret: "{{ matrix_coturn_turn_static_auth_secret if (matrix_coturn_enabled and matrix_coturn_authentication_method == 'auth-secret') else '' }}"
-matrix_synapse_turn_username: "{{ matrix_coturn_lt_cred_mech_username if (matrix_coturn_enabled and matrix_coturn_authentication_method == 'lt-cred-mech') else '' }}"
-matrix_synapse_turn_password: "{{ matrix_coturn_lt_cred_mech_password if (matrix_coturn_enabled and matrix_coturn_authentication_method == 'lt-cred-mech') else '' }}"
+matrix_synapse_turn_uris: "{{ coturn_turn_uris if coturn_enabled else [] }}"
+matrix_synapse_turn_shared_secret: "{{ coturn_turn_static_auth_secret if (coturn_enabled and coturn_authentication_method == 'auth-secret') else '' }}"
+matrix_synapse_turn_username: "{{ coturn_lt_cred_mech_username if (coturn_enabled and coturn_authentication_method == 'lt-cred-mech') else '' }}"
+matrix_synapse_turn_password: "{{ coturn_lt_cred_mech_password if (coturn_enabled and coturn_authentication_method == 'lt-cred-mech') else '' }}"
 
 matrix_synapse_self_check_validate_certificates: "{{ matrix_playbook_ssl_enabled }}"
 
@@ -4446,7 +4428,7 @@ matrix_synapse_systemd_required_services_list_auto: |
 
 matrix_synapse_systemd_wanted_services_list_auto: |
   {{
-    (['matrix-coturn.service'] if matrix_coturn_enabled else [])
+    ([coturn_identifier ~ '.service'] if coturn_enabled else [])
     +
     ([exim_relay_identifier ~ '.service'] if exim_relay_enabled else [])
   }}
@@ -4493,6 +4475,12 @@ matrix_synapse_password_config_enabled: "{{ not matrix_synapse_matrix_authentica
 
 matrix_synapse_register_user_script_matrix_authentication_service_path: "{{ matrix_authentication_service_bin_path }}/register-user"
 
+# After Synapse's systemd health check passes, the reverse proxy still needs time to
+# discover the container and register its routes. We derive this delay from Traefik's
+# providers.providersThrottleDuration setting (+1s grace for our healthcheck polling interval),
+# so it stays in sync automatically.
+matrix_synapse_systemd_service_post_start_delay_seconds: "{{ (traefik_config_providers_providersThrottleDuration_seconds | int + 1) if matrix_playbook_reverse_proxy_type in ['playbook-managed-traefik', 'other-traefik-container'] else 0 }}"
+
 ######################################################################
 #
 # /matrix-synapse
@@ -4702,11 +4690,6 @@ matrix_synapse_admin_config_asManagedUsers_auto: |
       '^@hbirc_[a-zA-Z0-9]+:'+(matrix_domain | regex_escape)+'$',
     ] if matrix_heisenbridge_enabled else [])
     +
-    ([
-      '^@zulipbot:'+(matrix_domain | regex_escape)+'$',
-      '^@zulip_[a-zA-Z0-9]+:'+(matrix_domain | regex_escape)+'$',
-    ] if matrix_zulip_bridge_enabled else [])
-    +
     ([
       '^@hookshot:'+(matrix_domain | regex_escape)+'$',
       '^@_github_[a-zA-Z0-9]+:'+(matrix_domain | regex_escape)+'$',
@@ -5150,7 +5133,6 @@ grafana_default_home_dashboard_path: |-
       'synapse': ('/etc/grafana/dashboards/synapse.json' if matrix_synapse_metrics_enabled and matrix_synapse_metrics_enabled else ('/etc/grafana/dashboards/node-exporter-full.json' if prometheus_node_exporter_enabled else '')),
       'dendrite': ('/etc/grafana/dashboards/node-exporter-full.json' if prometheus_node_exporter_enabled else ''),
       'conduit': ('/etc/grafana/dashboards/node-exporter-full.json' if prometheus_node_exporter_enabled else ''),
-      'conduwuit': ('/etc/grafana/dashboards/node-exporter-full.json' if prometheus_node_exporter_enabled else ''),
       'continuwuity': ('/etc/grafana/dashboards/node-exporter-full.json' if prometheus_node_exporter_enabled else ''),
     }[matrix_homeserver_implementation]
   }}
@@ -5211,7 +5193,6 @@ matrix_registration_shared_secret: |-
       'synapse': matrix_synapse_registration_shared_secret | default (''),
       'dendrite': matrix_dendrite_client_api_registration_shared_secret | default (''),
       'conduit': '',
-      'conduwuit': '',
       'continuwuity': '',
     }[matrix_homeserver_implementation]
   }}
@@ -5288,10 +5269,10 @@ matrix_dendrite_database_hostname: "{{ postgres_connection_hostname if postgres_
 
 matrix_dendrite_database_password: "{{ (matrix_homeserver_generic_secret_key + ':dendrite.db') | hash('sha512') | to_uuid }}"
 
-matrix_dendrite_client_api_turn_uris: "{{ matrix_coturn_turn_uris if matrix_coturn_enabled else [] }}"
-matrix_dendrite_client_api_turn_shared_secret: "{{ matrix_coturn_turn_static_auth_secret if (matrix_coturn_enabled and matrix_coturn_authentication_method == 'auth-secret') else '' }}"
-matrix_dendrite_client_api_turn_username: "{{ matrix_coturn_lt_cred_mech_username if (matrix_coturn_enabled and matrix_coturn_authentication_method == 'lt-cred-mech') else '' }}"
-matrix_dendrite_client_api_turn_password: "{{ matrix_coturn_lt_cred_mech_password if (matrix_coturn_enabled and matrix_coturn_authentication_method == 'lt-cred-mech') else '' }}"
+matrix_dendrite_client_api_turn_uris: "{{ coturn_turn_uris if coturn_enabled else [] }}"
+matrix_dendrite_client_api_turn_shared_secret: "{{ coturn_turn_static_auth_secret if (coturn_enabled and coturn_authentication_method == 'auth-secret') else '' }}"
+matrix_dendrite_client_api_turn_username: "{{ coturn_lt_cred_mech_username if (coturn_enabled and coturn_authentication_method == 'lt-cred-mech') else '' }}"
+matrix_dendrite_client_api_turn_password: "{{ coturn_lt_cred_mech_password if (coturn_enabled and coturn_authentication_method == 'lt-cred-mech') else '' }}"
 
 matrix_dendrite_disable_tls_validation: "{{ not matrix_playbook_ssl_enabled }}"
 
@@ -5308,7 +5289,7 @@ matrix_dendrite_systemd_required_services_list_auto: |
 
 matrix_dendrite_systemd_wanted_services_list_auto: |
   {{
-    (['matrix-coturn.service'] if matrix_coturn_enabled else [])
+    ([coturn_identifier ~ '.service'] if coturn_enabled else [])
   }}
 
 matrix_dendrite_container_extra_arguments_auto: "{{ matrix_homeserver_container_extra_arguments_auto }}"
@@ -5359,10 +5340,10 @@ matrix_conduit_container_labels_public_federation_api_traefik_tls: "{{ matrix_fe
 matrix_conduit_container_labels_internal_client_api_enabled: "{{ matrix_playbook_internal_matrix_client_api_traefik_entrypoint_enabled }}"
 matrix_conduit_container_labels_internal_client_api_traefik_entrypoints: "{{ matrix_playbook_internal_matrix_client_api_traefik_entrypoint_name }}"
 
-matrix_conduit_turn_uris: "{{ matrix_coturn_turn_uris if matrix_coturn_enabled else [] }}"
-matrix_conduit_turn_secret: "{{ matrix_coturn_turn_static_auth_secret if (matrix_coturn_enabled and matrix_coturn_authentication_method == 'auth-secret') else '' }}"
-matrix_conduit_turn_username: "{{ matrix_coturn_lt_cred_mech_username if (matrix_coturn_enabled and matrix_coturn_authentication_method == 'lt-cred-mech') else '' }}"
-matrix_conduit_turn_password: "{{ matrix_coturn_lt_cred_mech_password if (matrix_coturn_enabled and matrix_coturn_authentication_method == 'lt-cred-mech') else '' }}"
+matrix_conduit_turn_uris: "{{ coturn_turn_uris if coturn_enabled else [] }}"
+matrix_conduit_turn_secret: "{{ coturn_turn_static_auth_secret if (coturn_enabled and coturn_authentication_method == 'auth-secret') else '' }}"
+matrix_conduit_turn_username: "{{ coturn_lt_cred_mech_username if (coturn_enabled and coturn_authentication_method == 'lt-cred-mech') else '' }}"
+matrix_conduit_turn_password: "{{ coturn_lt_cred_mech_password if (coturn_enabled and coturn_authentication_method == 'lt-cred-mech') else '' }}"
 
 ######################################################################
 #
@@ -5371,58 +5352,6 @@ matrix_conduit_turn_password: "{{ matrix_coturn_lt_cred_mech_password if (matrix
 ######################################################################
 
 
-######################################################################
-#
-# matrix-conduwuit
-#
-######################################################################
-
-matrix_conduwuit_enabled: "{{ matrix_homeserver_implementation == 'conduwuit' }}"
-
-matrix_conduwuit_hostname: "{{ matrix_server_fqn_matrix }}"
-
-matrix_conduwuit_config_allow_federation: "{{ matrix_homeserver_federation_enabled }}"
-
-matrix_conduwuit_docker_image_registry_prefix_upstream: "{{ matrix_container_global_registry_prefix_override if matrix_container_global_registry_prefix_override else matrix_conduwuit_docker_image_registry_prefix_upstream_default }}"
-
-matrix_conduwuit_container_network: "{{ matrix_homeserver_container_network }}"
-
-matrix_conduwuit_container_additional_networks_auto: |
-  {{
-    (
-      ([matrix_playbook_reverse_proxyable_services_additional_network] if matrix_conduwuit_container_labels_traefik_enabled and matrix_playbook_reverse_proxyable_services_additional_network else [])
-    ) | unique
-  }}
-
-matrix_conduwuit_container_labels_traefik_enabled: "{{ matrix_playbook_reverse_proxy_type in ['playbook-managed-traefik', 'other-traefik-container'] and not matrix_synapse_workers_enabled }}"
-matrix_conduwuit_container_labels_traefik_docker_network: "{{ matrix_playbook_reverse_proxyable_services_additional_network }}"
-matrix_conduwuit_container_labels_traefik_entrypoints: "{{ traefik_entrypoint_primary }}"
-matrix_conduwuit_container_labels_traefik_tls_certResolver: "{{ traefik_certResolver_primary }}"
-
-matrix_conduwuit_container_labels_public_client_root_redirection_enabled: "{{ matrix_conduwuit_container_labels_public_client_root_redirection_url != '' }}"
-matrix_conduwuit_container_labels_public_client_root_redirection_url: "{{ (('https://' if matrix_playbook_ssl_enabled else 'http://') + matrix_server_fqn_element) if matrix_client_element_enabled else '' }}"
-
-matrix_conduwuit_container_labels_public_federation_api_traefik_hostname: "{{ matrix_server_fqn_matrix_federation }}"
-matrix_conduwuit_container_labels_public_federation_api_traefik_entrypoints: "{{ matrix_federation_traefik_entrypoint_name }}"
-matrix_conduwuit_container_labels_public_federation_api_traefik_tls: "{{ matrix_federation_traefik_entrypoint_tls }}"
-
-matrix_conduwuit_container_labels_internal_client_api_enabled: "{{ matrix_playbook_internal_matrix_client_api_traefik_entrypoint_enabled }}"
-matrix_conduwuit_container_labels_internal_client_api_traefik_entrypoints: "{{ matrix_playbook_internal_matrix_client_api_traefik_entrypoint_name }}"
-
-matrix_conduwuit_config_turn_uris: "{{ matrix_coturn_turn_uris if matrix_coturn_enabled else [] }}"
-matrix_conduwuit_config_turn_secret: "{{ matrix_coturn_turn_static_auth_secret if (matrix_coturn_enabled and matrix_coturn_authentication_method == 'auth-secret') else '' }}"
-matrix_conduwuit_config_turn_username: "{{ matrix_coturn_lt_cred_mech_username if (matrix_coturn_enabled and matrix_coturn_authentication_method == 'lt-cred-mech') else '' }}"
-matrix_conduwuit_config_turn_password: "{{ matrix_coturn_lt_cred_mech_password if (matrix_coturn_enabled and matrix_coturn_authentication_method == 'lt-cred-mech') else '' }}"
-
-matrix_conduwuit_self_check_validate_certificates: "{{ matrix_playbook_ssl_enabled }}"
-
-######################################################################
-#
-# /matrix-conduwuit
-#
-######################################################################
-
-
 ######################################################################
 #
 # matrix-continuwuity
@@ -5461,10 +5390,10 @@ matrix_continuwuity_container_labels_public_federation_api_traefik_tls: "{{ matr
 matrix_continuwuity_container_labels_internal_client_api_enabled: "{{ matrix_playbook_internal_matrix_client_api_traefik_entrypoint_enabled }}"
 matrix_continuwuity_container_labels_internal_client_api_traefik_entrypoints: "{{ matrix_playbook_internal_matrix_client_api_traefik_entrypoint_name }}"
 
-matrix_continuwuity_config_turn_uris: "{{ matrix_coturn_turn_uris if matrix_coturn_enabled else [] }}"
-matrix_continuwuity_config_turn_secret: "{{ matrix_coturn_turn_static_auth_secret if (matrix_coturn_enabled and matrix_coturn_authentication_method == 'auth-secret') else '' }}"
-matrix_continuwuity_config_turn_username: "{{ matrix_coturn_lt_cred_mech_username if (matrix_coturn_enabled and matrix_coturn_authentication_method == 'lt-cred-mech') else '' }}"
-matrix_continuwuity_config_turn_password: "{{ matrix_coturn_lt_cred_mech_password if (matrix_coturn_enabled and matrix_coturn_authentication_method == 'lt-cred-mech') else '' }}"
+matrix_continuwuity_config_turn_uris: "{{ coturn_turn_uris if coturn_enabled else [] }}"
+matrix_continuwuity_config_turn_secret: "{{ coturn_turn_static_auth_secret if (coturn_enabled and coturn_authentication_method == 'auth-secret') else '' }}"
+matrix_continuwuity_config_turn_username: "{{ coturn_lt_cred_mech_username if (coturn_enabled and coturn_authentication_method == 'lt-cred-mech') else '' }}"
+matrix_continuwuity_config_turn_password: "{{ coturn_lt_cred_mech_password if (coturn_enabled and coturn_authentication_method == 'lt-cred-mech') else '' }}"
 
 matrix_continuwuity_self_check_validate_certificates: "{{ matrix_playbook_ssl_enabled }}"
 
@@ -5723,7 +5652,7 @@ traefik_systemd_required_services_list: |
 
 traefik_additional_domains_to_obtain_certificates_for_auto: |
   {{
-    ([matrix_coturn_hostname] if (matrix_coturn_enabled and matrix_coturn_tls_enabled and matrix_coturn_hostname != matrix_server_fqn_matrix) else [])
+    ([coturn_hostname] if (coturn_enabled and coturn_tls_enabled and coturn_hostname != matrix_server_fqn_matrix) else [])
   }}
 
 ########################################################################
@@ -5750,6 +5679,16 @@ traefik_certs_dumper_gid: "{{ matrix_user_gid }}"
 
 traefik_certs_dumper_ssl_path: "{{ traefik_ssl_dir_path if traefik_enabled else '' }}"
 
+# We make the certs dumper require the Traefik service (not just docker.service),
+# because when both restart simultaneously (e.g. in all-at-once mode), Traefik may
+# momentarily truncate or reinitialize acme.json, causing the certs dumper to read
+# an empty file and panic. By requiring Traefik, the certs dumper only starts after
+# Traefik is fully ready and acme.json is stable.
+traefik_certs_dumper_systemd_required_services_list_auto: |
+  {{
+    ([traefik_identifier + '.service'] if traefik_enabled else [])
+  }}
+
 traefik_certs_dumper_container_image_registry_prefix_upstream: "{{ matrix_container_global_registry_prefix_override if matrix_container_global_registry_prefix_override else traefik_certs_dumper_container_image_registry_prefix_upstream_default }}"
 
 ########################################################################

justfile

@@ -50,8 +50,7 @@ install-all *extra_args: (run-tags "install-all,ensure-matrix-users-created,star
 install-service service *extra_args:
     {{ just_executable() }} --justfile "{{ justfile() }}" run \
     --tags=install-{{ service }},start-group \
-    --extra-vars=group={{ service }} \
-    --extra-vars=devture_systemd_service_manager_service_restart_mode=one-by-one {{ extra_args }}
+    --extra-vars=group={{ service }} {{ extra_args }}
 
 # Runs the playbook with --tags=setup-all,ensure-matrix-users-created,start and optional arguments
 setup-all *extra_args: (run-tags "setup-all,ensure-matrix-users-created,start" extra_args)

requirements.yml

@@ -12,6 +12,10 @@
 - src: git+https://github.com/mother-of-all-self-hosting/ansible-role-container-socket-proxy.git
   version: v0.4.2-1
   name: container_socket_proxy
+- src: git+https://github.com/mother-of-all-self-hosting/ansible-role-coturn.git
+  version: v4.8.0-1
+  name: coturn
+  activation_prefix: coturn_
 - src: git+https://github.com/mother-of-all-self-hosting/ansible-role-ddclient.git
   version: v4.0.0-0
   name: ddclient
@@ -31,6 +35,9 @@
 - src: git+https://github.com/mother-of-all-self-hosting/ansible-role-grafana.git
   version: v11.6.5-6
   name: grafana
+- src: git+https://github.com/mother-of-all-self-hosting/ansible-role-hydrogen.git
+  version: v0.5.1-0
+  name: hydrogen
 - src: git+https://github.com/mother-of-all-self-hosting/ansible-role-jitsi.git
   version: v10741-0
   name: jitsi
@@ -38,7 +45,7 @@
   version: v1.9.11-0
   name: livekit_server
 - src: git+https://github.com/mother-of-all-self-hosting/ansible-role-ntfy.git
-  version: v2.16.0-1
+  version: v2.17.0-0
   name: ntfy
 - src: git+https://github.com/devture/com.devture.ansible.role.playbook_help.git
   version: 8630e4f1749bcb659c412820f754473f09055052
@@ -50,7 +57,7 @@
   version: dd6e15246b7a9a2d921e0b3f9cd8a4a917a1bb2f
   name: playbook_state_preserver
 - src: git+https://github.com/mother-of-all-self-hosting/ansible-role-postgres.git
-  version: v18.1-4
+  version: v18.1-5
   name: postgres
 - src: git+https://github.com/mother-of-all-self-hosting/ansible-role-postgres-backup.git
   version: v18-0
@@ -68,13 +75,13 @@
   version: v1.4.1-0
   name: systemd_docker_base
 - src: git+https://github.com/devture/com.devture.ansible.role.systemd_service_manager.git
-  version: v1.1.0-0
+  version: v2.0.0-2
   name: systemd_service_manager
 - src: git+https://github.com/devture/com.devture.ansible.role.timesync.git
   version: v1.1.0-1
   name: timesync
 - src: git+https://github.com/mother-of-all-self-hosting/ansible-role-traefik.git
-  version: v3.6.7-1
+  version: v3.6.8-2
   name: traefik
 - src: git+https://github.com/mother-of-all-self-hosting/ansible-role-traefik-certs-dumper.git
   version: v2.10.0-4

roles/custom/matrix-alertmanager-receiver/defaults/main.yml

@@ -11,7 +11,7 @@
 matrix_alertmanager_receiver_enabled: true
 
 # renovate: datasource=docker depName=docker.io/metio/matrix-alertmanager-receiver
-matrix_alertmanager_receiver_version: 2026.2.4
+matrix_alertmanager_receiver_version: 2026.2.11
 
 matrix_alertmanager_receiver_scheme: https
 

roles/custom/matrix-authentication-service/defaults/main.yml

@@ -22,7 +22,7 @@ matrix_authentication_service_container_repo_version: "{{ 'main' if matrix_authe
 matrix_authentication_service_container_src_files_path: "{{ matrix_base_data_path }}/matrix-authentication-service/container-src"
 
 # renovate: datasource=docker depName=ghcr.io/element-hq/matrix-authentication-service
-matrix_authentication_service_version: 1.10.0
+matrix_authentication_service_version: 1.11.0
 matrix_authentication_service_container_image_registry_prefix: "{{ 'localhost/' if matrix_authentication_service_container_image_self_build else matrix_authentication_service_container_image_registry_prefix_upstream }}"
 matrix_authentication_service_container_image_registry_prefix_upstream: "{{ matrix_authentication_service_container_image_registry_prefix_upstream_default }}"
 matrix_authentication_service_container_image_registry_prefix_upstream_default: "ghcr.io/"

roles/custom/matrix-base/defaults/main.yml

@@ -84,7 +84,7 @@ matrix_monitoring_container_network: matrix-monitoring
 matrix_homeserver_enabled: true
 
 # This will contain the homeserver implementation that is in use.
-# Valid values: synapse, dendrite, conduit, conduwuit, continuwuity
+# Valid values: synapse, dendrite, conduit, continuwuity
 #
 # By default, we use Synapse, because it's the only full-featured Matrix server at the moment.
 #
@@ -106,7 +106,7 @@ matrix_server_fqn_matrix_federation: '{{ matrix_server_fqn_matrix }}'
 # This and the Matrix FQN (see above) are expected to be on the same server.
 matrix_server_fqn_element: "element.{{ matrix_domain }}"
 
-# This is where you access the Hydrogen web client from (if enabled via matrix_client_hydrogen_enabled; disabled by default).
+# This is where you access the Hydrogen web client from (if enabled via hydrogen_enabled; disabled by default).
 matrix_server_fqn_hydrogen: "hydrogen.{{ matrix_domain }}"
 
 # This is where you access the Cinny web client from (if enabled via cinny_enabled; disabled by default).

roles/custom/matrix-base/tasks/validate_config.yml

@@ -13,7 +13,7 @@
 - name: Fail if invalid homeserver implementation
   ansible.builtin.fail:
     msg: "You need to set a valid homeserver implementation in `matrix_homeserver_implementation`"
-  when: "matrix_homeserver_implementation not in ['synapse', 'dendrite', 'conduit', 'conduwuit', 'continuwuity']"
+  when: "matrix_homeserver_implementation not in ['synapse', 'dendrite', 'conduit', 'continuwuity']"
 
 - name: (Deprecation) Catch and report renamed settings
   ansible.builtin.fail:

roles/custom/matrix-bot-baibot/defaults/main.yml

@@ -17,7 +17,7 @@ matrix_bot_baibot_container_repo_version: "{{ 'main' if matrix_bot_baibot_versio
 matrix_bot_baibot_container_src_files_path: "{{ matrix_base_data_path }}/baibot/container-src"
 
 # renovate: datasource=docker depName=ghcr.io/etkecc/baibot
-matrix_bot_baibot_version: v1.14.0
+matrix_bot_baibot_version: v1.14.1
 matrix_bot_baibot_container_image: "{{ matrix_bot_baibot_container_image_registry_prefix }}etkecc/baibot:{{ matrix_bot_baibot_version }}"
 matrix_bot_baibot_container_image_registry_prefix: "{{ 'localhost/' if matrix_bot_baibot_container_image_self_build else matrix_bot_baibot_container_image_registry_prefix_upstream }}"
 matrix_bot_baibot_container_image_registry_prefix_upstream: "{{ matrix_bot_baibot_container_image_registry_prefix_upstream_default }}"

roles/custom/matrix-bot-draupnir/templates/systemd/matrix-bot-draupnir.service.j2

@@ -1,11 +1,11 @@
 #jinja2: lstrip_blocks: True
 [Unit]
 Description=Matrix Draupnir bot
-{% for service in matrix_bot_draupnir_systemd_wanted_services_list %}
+{% for service in matrix_bot_draupnir_systemd_required_services_list %}
 Requires={{ service }}
 After={{ service }}
 {% endfor %}
-{% for service in matrix_bot_draupnir_systemd_required_services_list %}
+{% for service in matrix_bot_draupnir_systemd_wanted_services_list %}
 Wants={{ service }}
 {% endfor %}
 DefaultDependencies=no

roles/custom/matrix-bot-mjolnir/templates/systemd/matrix-bot-mjolnir.service.j2

@@ -1,11 +1,11 @@
 #jinja2: lstrip_blocks: True
 [Unit]
 Description=Matrix Mjolnir bot
-{% for service in matrix_bot_mjolnir_systemd_wanted_services_list %}
+{% for service in matrix_bot_mjolnir_systemd_required_services_list %}
 Requires={{ service }}
 After={{ service }}
 {% endfor %}
-{% for service in matrix_bot_mjolnir_systemd_required_services_list %}
+{% for service in matrix_bot_mjolnir_systemd_wanted_services_list %}
 Wants={{ service }}
 {% endfor %}
 DefaultDependencies=no

roles/custom/matrix-bridge-zulip/defaults/main.yml

@@ -1,122 +0,0 @@
-# SPDX-FileCopyrightText: 2021 - 2022 Toni Spets
-# SPDX-FileCopyrightText: 2022 - 2023 Nikita Chernyi
-# SPDX-FileCopyrightText: 2022 - 2025 Slavi Pantaleev
-# SPDX-FileCopyrightText: 2022 MDAD project contributors
-# SPDX-FileCopyrightText: 2022 Marko Weltzer
-# SPDX-FileCopyrightText: 2023 Samuel Meenzen
-# SPDX-FileCopyrightText: 2024 - 2025 Suguru Hirahara
-#
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
----
-# MatrixZulipBridge is a puppeting appservice bridge for Zulip
-# Project source code URL: https://github.com/GearKite/MatrixZulipBridge
-
-matrix_zulip_bridge_enabled: true
-
-matrix_zulip_bridge_scheme: https
-matrix_zulip_bridge_hostname: "{{ matrix_server_fqn_matrix }}"
-matrix_zulip_bridge_path_prefix: "/zulip"
-
-# renovate: datasource=docker depName=ghcr.io/gearkite/matrixzulipbridge
-matrix_zulip_bridge_version: v0.4.1
-matrix_zulip_bridge_docker_image: "{{ matrix_zulip_bridge_docker_image_registry_prefix }}gearkite/matrixzulipbridge:{{ matrix_zulip_bridge_version }}"
-matrix_zulip_bridge_docker_image_registry_prefix: "{{ matrix_zulip_bridge_docker_image_registry_prefix_upstream }}"
-matrix_zulip_bridge_docker_image_registry_prefix_upstream: "{{ matrix_zulip_bridge_docker_image_registry_prefix_upstream_default }}"
-matrix_zulip_bridge_docker_image_registry_prefix_upstream_default: ghcr.io/
-matrix_zulip_bridge_docker_image_force_pull: "{{ matrix_zulip_bridge_docker_image.endswith(':latest') }}"
-
-matrix_zulip_bridge_base_path: "{{ matrix_base_data_path }}/zulip"
-
-matrix_zulip_bridge_container_network: ""
-
-# The port number in the container
-matrix_zulip_bridge_container_http_port: 9898
-
-matrix_zulip_bridge_container_additional_networks: "{{ matrix_zulip_bridge_container_additional_networks_auto + matrix_zulip_bridge_container_additional_networks_custom }}"
-matrix_zulip_bridge_container_additional_networks_auto: []
-matrix_zulip_bridge_container_additional_networks_custom: []
-
-# Controls how long to wait for the container to stop gracefully before killing it.
-# We use a small value here, because this container does not seem to handle the SIGTERM signal.
-matrix_zulip_bridge_container_stop_grace_time_seconds: 1
-
-# matrix_zulip_bridge_container_labels_traefik_enabled controls whether labels to assist a Traefik reverse-proxy will be attached to the container.
-# See `../templates/labels.j2` for details.
-#
-# To inject your own other container labels, see `matrix_zulip_bridge_container_labels_additional_labels`.
-matrix_zulip_bridge_container_labels_traefik_enabled: true
-matrix_zulip_bridge_container_labels_traefik_docker_network: "{{ matrix_zulip_bridge_container_network }}"
-matrix_zulip_bridge_container_labels_traefik_hostname: "{{ matrix_zulip_bridge_hostname }}"
-matrix_zulip_bridge_container_labels_traefik_path_prefix: "{{ matrix_zulip_bridge_path_prefix }}"
-matrix_zulip_bridge_container_labels_traefik_entrypoints: web-secure
-matrix_zulip_bridge_container_labels_traefik_tls_certResolver: default  # noqa var-naming
-
-# Controls if the media router is enabled
-matrix_zulip_bridge_container_labels_traefik_media_enabled: true
-matrix_zulip_bridge_container_labels_traefik_media_hostname: "{{ matrix_zulip_bridge_container_labels_traefik_hostname }}"
-# The path prefix must either be `/` or not end with a slash (e.g. `/zulip`).
-matrix_zulip_bridge_container_labels_traefik_media_path_prefix: "{{ '' if matrix_zulip_bridge_container_labels_traefik_path_prefix == '/' else (matrix_zulip_bridge_container_labels_traefik_path_prefix) }}/_bridge_zulip/media"
-matrix_zulip_bridge_container_labels_traefik_media_rule: "Host(`{{ matrix_zulip_bridge_container_labels_traefik_media_hostname }}`){% if matrix_zulip_bridge_container_labels_traefik_media_path_prefix != '/' %} && PathPrefix(`{{ matrix_zulip_bridge_container_labels_traefik_media_path_prefix }}`){% endif %}"
-matrix_zulip_bridge_container_labels_traefik_media_priority: 0
-matrix_zulip_bridge_container_labels_traefik_media_entrypoints: "{{ matrix_zulip_bridge_container_labels_traefik_entrypoints }}"
-matrix_zulip_bridge_container_labels_traefik_media_tls: "{{ matrix_zulip_bridge_container_labels_traefik_media_entrypoints != 'web' }}"
-matrix_zulip_bridge_container_labels_traefik_media_tls_certResolver: "{{ matrix_zulip_bridge_container_labels_traefik_tls_certResolver }}"  # noqa var-naming
-
-# matrix_zulip_bridge_container_labels_additional_labels contains a multiline string with additional labels to add to the container label file.
-# See `../templates/labels.j2` for details.
-#
-# Example:
-# matrix_zulip_bridge_container_labels_additional_labels: |
-#   my.label=1
-#   another.label="here"
-matrix_zulip_bridge_container_labels_additional_labels: ''
-
-# A list of extra arguments to pass to the container
-matrix_zulip_bridge_container_extra_arguments: []
-
-# List of systemd services that service depends on.
-matrix_zulip_bridge_systemd_required_services_list: "{{ matrix_zulip_bridge_systemd_required_services_list_default + matrix_zulip_bridge_systemd_required_services_list_auto + matrix_zulip_bridge_systemd_required_services_list_custom }}"
-matrix_zulip_bridge_systemd_required_services_list_default: "{{ [devture_systemd_docker_base_docker_service_name] if devture_systemd_docker_base_docker_service_name else [] }}"
-matrix_zulip_bridge_systemd_required_services_list_auto: []
-matrix_zulip_bridge_systemd_required_services_list_custom: []
-
-# List of systemd services that service wants
-matrix_zulip_bridge_systemd_wanted_services_list: []
-
-matrix_zulip_bridge_homeserver_url: ""
-
-matrix_zulip_bridge_appservice_token: ''
-matrix_zulip_bridge_homeserver_token: ''
-
-matrix_zulip_bridge_config_media_url: "{{ matrix_zulip_bridge_scheme }}://{{ matrix_zulip_bridge_hostname }}"
-# This matches the hardcoded `DEFAULT_MEDIA_PATH` in MatrixZulipBridge, but uses `matrix_zulip_bridge_path_prefix` as the path prefix.
-# See: https://github.com/GearKite/MatrixZulipBridge/blob/2ba51f3da2ad8bd33460c953ef91a9cfc585a2d4/matrixzulipbridge/__main__.py#L87
-matrix_zulip_bridge_config_media_path: "{{ matrix_zulip_bridge_container_labels_traefik_media_path_prefix }}/v3/download/{netloc}{path}{filename}"
-matrix_zulip_bridge_config_media_key: "{{ matrix_zulip_bridge_homeserver_token }}"
-matrix_zulip_bridge_config_displayname: "Zulip bridge bot"
-
-matrix_zulip_bridge_registration_yaml_bridge_zulip:
-  media_url: "{{ matrix_zulip_bridge_config_media_url }}"
-  media_path: "{{ matrix_zulip_bridge_config_media_path }}"
-  media_key: "{{ matrix_zulip_bridge_config_media_key }}"
-  displayname: "{{ matrix_zulip_bridge_config_displayname }}"
-
-# Default registration file consumed by both the homeserver and MatrixZulipBridge.
-# Besides registration information, it contains configuration (see the Zulip bridge key).
-matrix_zulip_bridge_registration_yaml:
-  id: zulip
-  url: http://matrix-zulip-bridge:{{ matrix_zulip_bridge_container_http_port }}
-  as_token: "{{ matrix_zulip_bridge_appservice_token }}"
-  hs_token: "{{ matrix_zulip_bridge_homeserver_token }}"
-  rate_limited: false
-  sender_localpart: zulipbot
-  namespaces:
-    users:
-      - regex: '@zulip_.*'
-        exclusive: true
-    aliases: []
-    rooms: []
-  zulipbridge: "{{ matrix_zulip_bridge_registration_yaml_bridge_zulip }}"
-
-matrix_zulip_bridge_registration: "{{ matrix_zulip_bridge_registration_yaml | from_yaml }}"

roles/custom/matrix-bridge-zulip/tasks/main.yml

@@ -1,29 +0,0 @@
-# SPDX-FileCopyrightText: 2021 Toni Spets
-# SPDX-FileCopyrightText: 2022 - 2024 Slavi Pantaleev
-# SPDX-FileCopyrightText: 2022 Marko Weltzer
-# SPDX-FileCopyrightText: 2025 Suguru Hirahara
-#
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
----
-- name: Perform the Zulip bridge installation tasks
-  when: matrix_zulip_bridge_enabled | bool
-  tags:
-    - setup-all
-    - setup-bridge-zulip
-    - install-all
-    - install-bridge-zulip
-  block:
-    - name: Validate the Zulip bridge configuration
-      ansible.builtin.include_tasks: "{{ role_path }}/tasks/validate_config.yml"
-    - name: Install the Zulip bridge
-      ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_install.yml"
-
-- name: Perform the Zulip bridge uninstallation tasks
-  when: not matrix_zulip_bridge_enabled | bool
-  tags:
-    - setup-all
-    - setup-bridge-zulip
-  block:
-    - name: Uninstall the Zulip bridge
-      ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_uninstall.yml"

roles/custom/matrix-bridge-zulip/tasks/setup_install.yml

@@ -1,62 +0,0 @@
-# SPDX-FileCopyrightText: 2021 Toni Spets
-# SPDX-FileCopyrightText: 2022 - 2024 Slavi Pantaleev
-# SPDX-FileCopyrightText: 2022 Jim Myhrberg
-# SPDX-FileCopyrightText: 2022 Marko Weltzer
-# SPDX-FileCopyrightText: 2022 Nikita Chernyi
-# SPDX-FileCopyrightText: 2022 Sebastian Gumprich
-# SPDX-FileCopyrightText: 2024 David Mehren
-#
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
----
-- name: Ensure the Zulip bridge image is pulled
-  community.docker.docker_image:
-    name: "{{ matrix_zulip_bridge_docker_image }}"
-    source: "{{ 'pull' if ansible_version.major > 2 or ansible_version.minor > 7 else omit }}"
-    force_source: "{{ matrix_zulip_bridge_docker_image_force_pull if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}"
-    force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else matrix_zulip_bridge_docker_image_force_pull }}"
-  register: result
-  retries: "{{ devture_playbook_help_container_retries_count }}"
-  delay: "{{ devture_playbook_help_container_retries_delay }}"
-  until: result is not failed
-
-- name: Ensure the Zulip bridge paths exist
-  ansible.builtin.file:
-    path: "{{ item }}"
-    state: directory
-    mode: "0750"
-    owner: "{{ matrix_user_name }}"
-    group: "{{ matrix_group_name }}"
-  with_items:
-    - "{{ matrix_zulip_bridge_base_path }}"
-
-- name: Ensure the Zulip bridge registration.yaml installed if provided
-  ansible.builtin.copy:
-    content: "{{ matrix_zulip_bridge_registration | to_nice_yaml(indent=2, width=999999) }}"
-    dest: "{{ matrix_zulip_bridge_base_path }}/registration.yaml"
-    mode: "0644"
-    owner: "{{ matrix_user_name }}"
-    group: "{{ matrix_group_name }}"
-
-- name: Ensure the Zulip bridge support files installed
-  ansible.builtin.template:
-    src: "{{ role_path }}/templates/{{ item }}.j2"
-    dest: "{{ matrix_zulip_bridge_base_path }}/{{ item }}"
-    mode: "0640"
-    owner: "{{ matrix_user_name }}"
-    group: "{{ matrix_group_name }}"
-  with_items:
-    - labels
-
-- name: Ensure the Zulip bridge container network is created
-  community.general.docker_network:
-    enable_ipv6: "{{ devture_systemd_docker_base_ipv6_enabled }}"
-    name: "{{ matrix_zulip_bridge_container_network }}"
-    driver: bridge
-    driver_options: "{{ devture_systemd_docker_base_container_networks_driver_options }}"
-
-- name: Ensure matrix-zulip-bridge.service installed
-  ansible.builtin.template:
-    src: "{{ role_path }}/templates/systemd/matrix-zulip-bridge.service.j2"
-    dest: "{{ devture_systemd_docker_base_systemd_path }}/matrix-zulip-bridge.service"
-    mode: "0644"

roles/custom/matrix-bridge-zulip/tasks/setup_uninstall.yml

@@ -1,26 +0,0 @@
-# SPDX-FileCopyrightText: 2021 - 2022 Slavi Pantaleev
-# SPDX-FileCopyrightText: 2021 Michael Sasser
-# SPDX-FileCopyrightText: 2021 Toni Spets
-# SPDX-FileCopyrightText: 2022 Marko Weltzer
-#
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
----
-- name: Check existence of matrix-bridge-zulip service
-  ansible.builtin.stat:
-    path: "{{ devture_systemd_docker_base_systemd_path }}/matrix-zulip-bridge.service"
-  register: matrix_zulip_bridge_service_stat
-
-- when: matrix_zulip_bridge_service_stat.stat.exists | bool
-  block:
-    - name: Ensure matrix-bridge-zulip is stopped
-      ansible.builtin.service:
-        name: matrix-zulip-bridge
-        state: stopped
-        enabled: false
-        daemon_reload: true
-
-    - name: Ensure matrix-zulip-bridge.service doesn't exist
-      ansible.builtin.file:
-        path: "{{ devture_systemd_docker_base_systemd_path }}/matrix-zulip-bridge.service"
-        state: absent

roles/custom/matrix-bridge-zulip/tasks/validate_config.yml

@@ -1,14 +0,0 @@
-# SPDX-FileCopyrightText: 2024 Slavi Pantaleev
-# SPDX-FileCopyrightText: 2024 Suguru Hirahara
-#
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
----
-- name: Fail if required the Zulip bridge settings not defined
-  ansible.builtin.fail:
-    msg: >-
-      You need to define a required configuration setting (`{{ item.name }}`).
-  when: "item.when | bool and lookup('vars', item.name, default='') | string | length == 0"
-  with_items:
-    - {"name": "matrix_zulip_bridge_container_network", when: true}
-    - {"name": "matrix_zulip_bridge_homeserver_url", when: true}

roles/custom/matrix-bridge-zulip/templates/labels.j2

@@ -1,58 +0,0 @@
-{#
-SPDX-FileCopyrightText: 2024 Slavi Pantaleev
-
-SPDX-License-Identifier: AGPL-3.0-or-later
-#}
-
-{% if matrix_zulip_bridge_container_labels_traefik_enabled %}
-traefik.enable=true
-
-{% if matrix_zulip_bridge_container_labels_traefik_docker_network %}
-traefik.docker.network={{ matrix_zulip_bridge_container_labels_traefik_docker_network }}
-{% endif %}
-
-traefik.http.services.matrix-zulip-bridge.loadbalancer.server.port={{ matrix_zulip_bridge_container_http_port }}
-
-{% set middlewares = [] %}
-
-{% if matrix_zulip_bridge_container_labels_traefik_path_prefix != '/' %}
-traefik.http.middlewares.matrix-bridge-zulip-strip-prefix.stripprefix.prefixes={{ matrix_zulip_bridge_container_labels_traefik_path_prefix }}
-{% set middlewares = middlewares + ['matrix-bridge-zulip-strip-prefix'] %}
-{% endif %}
-
-{% if matrix_zulip_bridge_container_labels_traefik_media_enabled %}
-##########################################################################
-#                                                                        #
-# Media                                                                  #
-#                                                                        #
-##########################################################################
-
-traefik.http.routers.matrix-bridge-zulip-media.rule={{ matrix_zulip_bridge_container_labels_traefik_media_rule }}
-
-{% if matrix_zulip_bridge_container_labels_traefik_media_priority | int > 0 %}
-traefik.http.routers.matrix-bridge-zulip-media.priority={{ matrix_zulip_bridge_container_labels_traefik_media_priority }}
-{% endif %}
-
-{% if middlewares | length > 0 %}
-traefik.http.routers.matrix-bridge-zulip-media.middlewares={{ middlewares | join(',') }}
-{% endif %}
-
-traefik.http.routers.matrix-bridge-zulip-media.service=matrix-bridge-zulip
-traefik.http.routers.matrix-bridge-zulip-media.entrypoints={{ matrix_zulip_bridge_container_labels_traefik_entrypoints }}
-
-traefik.http.routers.matrix-bridge-zulip-media.tls={{ matrix_zulip_bridge_container_labels_traefik_media_tls | to_json }}
-{% if matrix_zulip_bridge_container_labels_traefik_media_entrypoints %}
-traefik.http.routers.matrix-bridge-zulip-media.tls.certResolver={{ matrix_zulip_bridge_container_labels_traefik_media_tls_certResolver }}
-{% endif %}
-
-##########################################################################
-#                                                                        #
-# /Media                                                                 #
-#                                                                        #
-##########################################################################
-{% endif %}
-
-
-{% endif %}
-
-{{ matrix_zulip_bridge_container_labels_additional_labels }}

roles/custom/matrix-bridge-zulip/templates/systemd/matrix-zulip-bridge.service.j2

@@ -1,60 +0,0 @@
-{#
-SPDX-FileCopyrightText: 2021 Toni Spets
-SPDX-FileCopyrightText: 2022 - 2025 Slavi Pantaleev
-SPDX-FileCopyrightText: 2025 Suguru Hirahara
-
-SPDX-License-Identifier: AGPL-3.0-or-later
-#}
-
-[Unit]
-Description=a puppeting appservice bridge for Zulip
-{% for service in matrix_zulip_bridge_systemd_required_services_list %}
-Requires={{ service }}
-After={{ service }}
-{% endfor %}
-{% for service in matrix_zulip_bridge_systemd_wanted_services_list %}
-Wants={{ service }}
-{% endfor %}
-DefaultDependencies=no
-
-[Service]
-Type=simple
-Environment="HOME={{ devture_systemd_docker_base_systemd_unit_home_path }}"
-ExecStartPre=-{{ devture_systemd_docker_base_host_command_docker }} stop -t {{ matrix_zulip_bridge_container_stop_grace_time_seconds }} matrix-bridge-zulip
-ExecStartPre=-{{ devture_systemd_docker_base_host_command_docker }} rm matrix-bridge-zulip
-
-ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} create \
-			--rm \
-			--name=matrix-bridge-zulip \
-			--log-driver=none \
-			--user={{ matrix_user_uid }}:{{ matrix_user_gid }} \
-			--cap-drop=ALL \
-			--network={{ matrix_zulip_bridge_container_network }} \
-			--mount type=bind,src={{ matrix_zulip_bridge_base_path }},dst=/config \
-			--label-file={{ matrix_zulip_bridge_base_path }}/labels \
-			{% for arg in matrix_zulip_bridge_container_extra_arguments %}
-			{{ arg }} \
-			{% endfor %}
-			{{ matrix_zulip_bridge_docker_image }} \
-			{% if matrix_zulip_bridge_owner %}
-			-o {{ matrix_zulip_bridge_owner }} \
-			{% endif %}
-			--config /config/registration.yaml \
-			--listen-address 0.0.0.0 \
-			--listen-port {{ matrix_zulip_bridge_container_http_port }} \
-			{{ matrix_zulip_bridge_homeserver_url }}
-
-{% for network in matrix_zulip_bridge_container_additional_networks %}
-ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} network connect {{ network }} matrix-bridge-zulip
-{% endfor %}
-
-ExecStart={{ devture_systemd_docker_base_host_command_docker }} start --attach matrix-bridge-zulip
-
-ExecStop=-{{ devture_systemd_docker_base_host_command_docker }} stop -t {{ matrix_zulip_bridge_container_stop_grace_time_seconds }} matrix-bridge-zulip
-ExecStop=-{{ devture_systemd_docker_base_host_command_docker }} rm matrix-bridge-zulip
-Restart=always
-RestartSec=30
-SyslogIdentifier=matrix-bridge-zulip
-
-[Install]
-WantedBy=multi-user.target

roles/custom/matrix-client-element/defaults/main.yml

@@ -29,7 +29,7 @@ matrix_client_element_container_image_self_build_repo: "https://github.com/eleme
 matrix_client_element_container_image_self_build_low_memory_system_patch_enabled: "{{ ansible_facts['memtotal_mb'] < 4096 }}"
 
 # renovate: datasource=docker depName=ghcr.io/element-hq/element-web
-matrix_client_element_version: v1.12.9
+matrix_client_element_version: v1.12.10
 
 matrix_client_element_docker_image: "{{ matrix_client_element_docker_image_registry_prefix }}element-hq/element-web:{{ matrix_client_element_version }}"
 matrix_client_element_docker_image_registry_prefix: "{{ 'localhost/' if matrix_client_element_container_image_self_build else matrix_client_element_docker_image_registry_prefix_upstream }}"

roles/custom/matrix-client-hydrogen/defaults/main.yml

@@ -1,198 +0,0 @@
-# SPDX-FileCopyrightText: 2021 - 2022 Aaron Raimist
-# SPDX-FileCopyrightText: 2021 - 2022 MDAD project contributors
-# SPDX-FileCopyrightText: 2021 - 2025 Slavi Pantaleev
-# SPDX-FileCopyrightText: 2022 - 2023 Nikita Chernyi
-# SPDX-FileCopyrightText: 2022 Marko Weltzer
-# SPDX-FileCopyrightText: 2022 Matthew Cengia
-# SPDX-FileCopyrightText: 2023 Pierre 'McFly' Marty
-# SPDX-FileCopyrightText: 2023 Samuel Meenzen
-#
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
----
-# Project source code URL: https://github.com/element-hq/hydrogen-web
-
-matrix_client_hydrogen_enabled: true
-
-matrix_client_hydrogen_container_image_self_build: false
-matrix_client_hydrogen_container_image_self_build_repo: "https://github.com/element-hq/hydrogen-web.git"
-
-# renovate: datasource=docker depName=ghcr.io/element-hq/hydrogen-web
-matrix_client_hydrogen_version: v0.5.1
-matrix_client_hydrogen_docker_image: "{{ matrix_client_hydrogen_docker_image_registry_prefix }}element-hq/hydrogen-web:{{ matrix_client_hydrogen_version }}"
-matrix_client_hydrogen_docker_image_registry_prefix: "{{ 'localhost/' if matrix_client_hydrogen_container_image_self_build else matrix_client_hydrogen_docker_image_registry_prefix_upstream }}"
-matrix_client_hydrogen_docker_image_registry_prefix_upstream: "{{ matrix_client_hydrogen_docker_image_registry_prefix_upstream_default }}"
-matrix_client_hydrogen_docker_image_registry_prefix_upstream_default: ghcr.io/
-matrix_client_hydrogen_docker_image_force_pull: "{{ matrix_client_hydrogen_docker_image.endswith(':latest') }}"
-
-matrix_client_hydrogen_data_path: "{{ matrix_base_data_path }}/client-hydrogen"
-matrix_client_hydrogen_docker_src_files_path: "{{ matrix_client_hydrogen_data_path }}/docker-src"
-
-# The base container network
-matrix_client_hydrogen_container_network: ''
-
-# A list of additional container networks that the container would be connected to.
-# The role does not create these networks, so make sure they already exist.
-# Use this to expose this container to a reverse proxy, which runs in a different container network.
-matrix_client_hydrogen_container_additional_networks: []
-
-# Controls whether the container exposes its HTTP port (tcp/8080 in the container).
-#
-# Takes an "<ip>:<port>" or "<port>" value (e.g. "127.0.0.1:8768"), or empty string to not expose.
-matrix_client_hydrogen_container_http_host_bind_port: ''
-
-# matrix_client_hydrogen_container_labels_traefik_enabled controls whether labels to assist a Traefik reverse-proxy will be attached to the container.
-# See `../templates/labels.j2` for details.
-#
-# To inject your own other container labels, see `matrix_client_hydrogen_container_labels_additional_labels`.
-matrix_client_hydrogen_container_labels_traefik_enabled: true
-matrix_client_hydrogen_container_labels_traefik_docker_network: "{{ matrix_client_hydrogen_container_network }}"
-matrix_client_hydrogen_container_labels_traefik_hostname: "{{ matrix_client_hydrogen_hostname }}"
-# The path prefix must either be `/` or not end with a slash (e.g. `/hydrogen`).
-matrix_client_hydrogen_container_labels_traefik_path_prefix: "{{ matrix_client_hydrogen_path_prefix }}"
-matrix_client_hydrogen_container_labels_traefik_rule: "Host(`{{ matrix_client_hydrogen_container_labels_traefik_hostname }}`){% if matrix_client_hydrogen_container_labels_traefik_path_prefix != '/' %} && PathPrefix(`{{ matrix_client_hydrogen_container_labels_traefik_path_prefix }}`){% endif %}"
-matrix_client_hydrogen_container_labels_traefik_priority: 0
-matrix_client_hydrogen_container_labels_traefik_entrypoints: web-secure
-matrix_client_hydrogen_container_labels_traefik_tls: "{{ matrix_client_hydrogen_container_labels_traefik_entrypoints != 'web' }}"
-matrix_client_hydrogen_container_labels_traefik_tls_certResolver: default  # noqa var-naming
-
-# Controls whether a compression middleware will be injected into the middlewares list.
-# This compression middleware is supposed to be defined elsewhere (using labels or a File provider, etc.) and is merely referenced by this router.
-matrix_client_hydrogen_container_labels_traefik_compression_middleware_enabled: false
-matrix_client_hydrogen_container_labels_traefik_compression_middleware_name: ""
-
-# Controls which additional headers to attach to all HTTP responses.
-# To add your own headers, use `matrix_client_hydrogen_container_labels_traefik_additional_response_headers_custom`
-matrix_client_hydrogen_container_labels_traefik_additional_response_headers: "{{ matrix_client_hydrogen_container_labels_traefik_additional_response_headers_auto | combine(matrix_client_hydrogen_container_labels_traefik_additional_response_headers_custom) }}"
-matrix_client_hydrogen_container_labels_traefik_additional_response_headers_auto: |
-  {{
-    {}
-    | combine ({'X-XSS-Protection': matrix_client_hydrogen_http_header_xss_protection} if matrix_client_hydrogen_http_header_xss_protection else {})
-    | combine ({'X-Content-Type-Options': matrix_client_hydrogen_http_header_content_type_options} if matrix_client_hydrogen_http_header_content_type_options else {})
-    | combine ({'Content-Security-Policy': matrix_client_hydrogen_http_header_content_security_policy} if matrix_client_hydrogen_http_header_content_security_policy else {})
-    | combine ({'Permission-Policy': matrix_client_hydrogen_http_header_content_permission_policy} if matrix_client_hydrogen_http_header_content_permission_policy else {})
-    | combine ({'Strict-Transport-Security': matrix_client_hydrogen_http_header_strict_transport_security} if matrix_client_hydrogen_http_header_strict_transport_security and matrix_client_hydrogen_container_labels_traefik_tls else {})
-  }}
-matrix_client_hydrogen_container_labels_traefik_additional_response_headers_custom: {}
-
-# matrix_client_hydrogen_container_labels_additional_labels contains a multiline string with additional labels to add to the container label file.
-# See `../templates/labels.j2` for details.
-#
-# Example:
-# matrix_client_hydrogen_container_labels_additional_labels: |
-#   my.label=1
-#   another.label="here"
-matrix_client_hydrogen_container_labels_additional_labels: ''
-
-# A list of extra arguments to pass to the container
-matrix_client_hydrogen_container_extra_arguments: []
-
-# List of systemd services that matrix-client-hydrogen.service depends on
-matrix_client_hydrogen_systemd_required_services_list: "{{ [devture_systemd_docker_base_docker_service_name] if devture_systemd_docker_base_docker_service_name else [] }}"
-
-# Specifies the value of the `X-XSS-Protection` header
-# Stops pages from loading when they detect reflected cross-site scripting (XSS) attacks.
-#
-# Learn more about it is here:
-# - https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-XSS-Protection
-# - https://portswigger.net/web-security/cross-site-scripting/reflected
-matrix_client_hydrogen_http_header_xss_protection: "1; mode=block"
-
-# Specifies the value of the `X-Content-Type-Options` header.
-# See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Content-Type-Options
-matrix_client_hydrogen_http_header_content_type_options: nosniff
-
-# Specifies the value of the `Content-Security-Policy` header.
-# See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy
-matrix_client_hydrogen_http_header_content_security_policy: frame-ancestors 'self'
-
-# Specifies the value of the `Permission-Policy` header.
-# See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Permission-Policy
-matrix_client_hydrogen_http_header_content_permission_policy: "{{ 'interest-cohort=()' if matrix_client_hydrogen_floc_optout_enabled else '' }}"
-
-# Specifies the value of the `Strict-Transport-Security` header.
-# See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security
-matrix_client_hydrogen_http_header_strict_transport_security: "max-age=31536000; includeSubDomains{{ '; preload' if matrix_client_hydrogen_hsts_preload_enabled else '' }}"
-
-# Controls whether to send a "Permissions-Policy interest-cohort=();" header along with all responses
-#
-# Learn more about what it is here:
-# - https://www.eff.org/deeplinks/2021/03/googles-floc-terrible-idea
-# - https://paramdeo.com/blog/opting-your-website-out-of-googles-floc-network
-# - https://amifloced.org/
-#
-# Of course, a better solution is to just stop using browsers (like Chrome), which participate in such tracking practices.
-# See: `matrix_client_hydrogen_content_permission_policy`
-matrix_client_hydrogen_floc_optout_enabled: true
-
-# Controls if HSTS preloading is enabled
-#
-# In its strongest and recommended form, the [HSTS policy](https://www.chromium.org/hsts) includes all subdomains, and
-# indicates a willingness to be "preloaded" into browsers:
-# `Strict-Transport-Security: max-age=31536000; includeSubDomains; preload`
-# For more information visit:
-# - https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security
-# - https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security
-# - https://hstspreload.org/#opt-in
-# See: `matrix_client_hydrogen_http_header_strict_transport_security`
-matrix_client_hydrogen_hsts_preload_enabled: false
-
-matrix_client_hydrogen_scheme: https
-
-# The hostname at which Hydrogen is served.
-matrix_client_hydrogen_hostname: "{{ matrix_server_fqn_hydrogen }}"
-
-# The path at which Hydrogen is exposed.
-# This value must either be `/` or not end with a slash (e.g. `/hydrogen`).
-matrix_client_hydrogen_path_prefix: /
-
-# Controls whether the self-check feature should validate SSL certificates.
-matrix_client_hydrogen_self_check_validate_certificates: true
-
-# Controls whether the access log is enabled.
-matrix_client_hydrogen_access_log_enabled: true
-
-# config.json
-matrix_client_hydrogen_push:
-  appId: io.element.hydrogen.web
-  gatewayUrl: https://matrix.org
-  applicationServerKey: "BC-gpSdVHEXhvHSHS0AzzWrQoukv2BE7KzpoPO_FfPacqOo3l1pdqz7rSgmB04pZCWaHPz7XRe6fjLaC-WPDopM"
-matrix_client_hydrogen_default_hs_url: ""
-matrix_client_hydrogen_bugReportEndpointUrl: "https://element.io/bugreports/submit"  # noqa var-naming
-
-# Default Hydrogen configuration template which covers the generic use case.
-# You can customize it by controlling the various variables inside it.
-#
-# For a more advanced customization, you can extend the default (see `matrix_client_hydrogen_configuration_extension_json`)
-# or completely replace this variable with your own template.
-#
-# The side-effect of this lookup is that Ansible would even parse the JSON for us, returning a dict.
-# This is unlike what it does when looking up YAML template files (no automatic parsing there).
-matrix_client_hydrogen_configuration_default: "{{ lookup('template', 'templates/config.json.j2', convert_data=False) | from_json }}"
-
-# Your custom JSON configuration for Hydrogen should go to `matrix_client_hydrogen_configuration_extension_json`.
-# This configuration extends the default starting configuration (`matrix_client_hydrogen_configuration_default`).
-#
-# You can override individual variables from the default configuration, or introduce new ones.
-#
-# If you need something more special, you can take full control by
-# completely redefining `matrix_client_hydrogen_configuration_default`.
-#
-# Example configuration extension follows:
-#
-# matrix_client_hydrogen_configuration_extension_json: |
-#  {
-#    "push": {
-#      "appId": "io.element.hydrogen.web",
-#      "gatewayUrl": "https://matrix.org",
-#      "applicationServerKey": "BC-gpSdVHEXhvHSHS0AzzWrQoukv2BE7KzpoPO_FfPacqOo3l1pdqz7rSgmB04pZCWaHPz7XRe6fjLaC-WPDopM"
-#    },
-#    "defaultHomeServer": "matrix.org"
-#  }
-matrix_client_hydrogen_configuration_extension_json: '{}'
-
-matrix_client_hydrogen_configuration_extension: "{{ matrix_client_hydrogen_configuration_extension_json | from_json if matrix_client_hydrogen_configuration_extension_json | from_json is mapping else {} }}"
-
-# Holds the final Hydrogen configuration (a combination of the default and its extension).
-# You most likely don't need to touch this variable. Instead, see `matrix_client_hydrogen_configuration_default`.
-matrix_client_hydrogen_configuration: "{{ matrix_client_hydrogen_configuration_default | combine(matrix_client_hydrogen_configuration_extension, recursive=True) }}"

roles/custom/matrix-client-hydrogen/tasks/main.yml

@@ -1,32 +0,0 @@
-# SPDX-FileCopyrightText: 2021 - 2023 Slavi Pantaleev
-# SPDX-FileCopyrightText: 2021 Aaron Raimist
-# SPDX-FileCopyrightText: 2022 Marko Weltzer
-#
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
----
-
-- tags:
-    - setup-all
-    - setup-client-hydrogen
-    - install-all
-    - install-client-hydrogen
-  block:
-    - when: matrix_client_hydrogen_enabled | bool
-      ansible.builtin.include_tasks: "{{ role_path }}/tasks/validate_config.yml"
-
-    - when: matrix_client_hydrogen_enabled | bool
-      ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_install.yml"
-
-- tags:
-    - setup-all
-    - setup-client-hydrogen
-  block:
-    - when: not matrix_client_hydrogen_enabled | bool
-      ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_uninstall.yml"
-
-- tags:
-    - self-check
-  block:
-    - when: matrix_client_hydrogen_enabled | bool
-      ansible.builtin.include_tasks: "{{ role_path }}/tasks/self_check.yml"

roles/custom/matrix-client-hydrogen/tasks/self_check.yml

@@ -1,30 +0,0 @@
-# SPDX-FileCopyrightText: 2021 - 2022 Aaron Raimist
-# SPDX-FileCopyrightText: 2022 - 2024 Slavi Pantaleev
-# SPDX-FileCopyrightText: 2022 Marko Weltzer
-#
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
----
-
-- ansible.builtin.set_fact:
-    matrix_client_hydrogen_url_endpoint_public: "{{ matrix_client_hydrogen_scheme }}://{{ matrix_client_hydrogen_hostname }}{{ matrix_client_hydrogen_path_prefix }}/config.json"
-
-- name: Check Hydrogen
-  ansible.builtin.uri:
-    url: "{{ matrix_client_hydrogen_url_endpoint_public }}"
-    follow_redirects: none
-    validate_certs: "{{ matrix_client_hydrogen_self_check_validate_certificates }}"
-  register: matrix_client_hydrogen_self_check_result
-  check_mode: false
-  ignore_errors: true
-  delegate_to: 127.0.0.1
-  become: false
-
-- name: Fail if Hydrogen not working
-  ansible.builtin.fail:
-    msg: "Failed checking Hydrogen is up at `{{ matrix_client_hydrogen_hostname }}` (checked endpoint: `{{ matrix_client_hydrogen_url_endpoint_public }}`). Is Hydrogen running? Is port 443 open in your firewall? Full error: {{ matrix_client_hydrogen_self_check_result }}"
-  when: "matrix_client_hydrogen_self_check_result.failed or 'json' not in matrix_client_hydrogen_self_check_result"
-
-- name: Report working Hydrogen
-  ansible.builtin.debug:
-    msg: "Hydrogen at `{{ matrix_client_hydrogen_hostname }}` is working (checked endpoint: `{{ matrix_client_hydrogen_url_endpoint_public }}`)"

roles/custom/matrix-client-hydrogen/tasks/setup_install.yml

@@ -1,101 +0,0 @@
-# SPDX-FileCopyrightText: 2021 - 2022 Aaron Raimist
-# SPDX-FileCopyrightText: 2021 - 2024 Slavi Pantaleev
-# SPDX-FileCopyrightText: 2022 Marko Weltzer
-# SPDX-FileCopyrightText: 2022 Matthew Cengia
-# SPDX-FileCopyrightText: 2022 Nikita Chernyi
-# SPDX-FileCopyrightText: 2022 Sebastian Gumprich
-# SPDX-FileCopyrightText: 2023 Julian Foad
-# SPDX-FileCopyrightText: 2024 David Mehren
-#
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
----
-
-- name: Ensure Hydrogen paths exists
-  ansible.builtin.file:
-    path: "{{ item.path }}"
-    state: directory
-    mode: 0750
-    owner: "{{ matrix_user_name }}"
-    group: "{{ matrix_group_name }}"
-  with_items:
-    - {path: "{{ matrix_client_hydrogen_data_path }}", when: true}
-    - {path: "{{ matrix_client_hydrogen_docker_src_files_path }}", when: "{{ matrix_client_hydrogen_container_image_self_build }}"}
-  when: "item.when | bool"
-
-- when: "matrix_client_hydrogen_container_image_self_build | bool"
-  block:
-    - name: Ensure Hydrogen repository is present on self-build
-      ansible.builtin.git:
-        repo: "{{ matrix_client_hydrogen_container_image_self_build_repo }}"
-        dest: "{{ matrix_client_hydrogen_docker_src_files_path }}"
-        version: "{{ matrix_client_hydrogen_docker_image.split(':')[1] }}"
-        force: "yes"
-      become: true
-      become_user: "{{ matrix_user_name }}"
-      register: matrix_client_hydrogen_git_pull_results
-
-    - name: Check if Hydrogen Docker image exists
-      ansible.builtin.command: "{{ devture_systemd_docker_base_host_command_docker }} images --quiet --filter 'reference={{ matrix_client_hydrogen_docker_image }}'"
-      register: matrix_client_hydrogen_docker_image_check_result
-      changed_when: false
-
-    # Invoking the `docker build` command here, instead of calling the `docker_image` Ansible module,
-    # because the latter does not support BuildKit.
-    # See: https://github.com/ansible-collections/community.general/issues/514
-    - name: Ensure Hydrogen Docker image is built
-      ansible.builtin.shell:
-        chdir: "{{ matrix_client_hydrogen_docker_src_files_path }}"
-        cmd: |
-          {{ devture_systemd_docker_base_host_command_docker }} build \
-          -t "{{ matrix_client_hydrogen_docker_image }}" \
-          -f Dockerfile \
-          .
-      environment:
-        DOCKER_BUILDKIT: 1
-      changed_when: true
-      when: "matrix_client_hydrogen_git_pull_results.changed | bool or matrix_client_hydrogen_docker_image_check_result.stdout == ''"
-
-- name: Ensure Hydrogen Docker image is pulled
-  community.docker.docker_image:
-    name: "{{ matrix_client_hydrogen_docker_image }}"
-    source: "{{ 'pull' if ansible_version.major > 2 or ansible_version.minor > 7 else omit }}"
-    force_source: "{{ matrix_client_hydrogen_docker_image_force_pull if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}"
-    force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else matrix_client_hydrogen_docker_image_force_pull }}"
-  when: "not matrix_client_hydrogen_container_image_self_build | bool"
-  register: result
-  retries: "{{ devture_playbook_help_container_retries_count }}"
-  delay: "{{ devture_playbook_help_container_retries_delay }}"
-  until: result is not failed
-
-- name: Ensure Hydrogen configuration installed
-  ansible.builtin.copy:
-    content: "{{ matrix_client_hydrogen_configuration | to_nice_json }}"
-    dest: "{{ matrix_client_hydrogen_data_path }}/config.json"
-    mode: 0644
-    owner: "{{ matrix_user_name }}"
-    group: "{{ matrix_group_name }}"
-
-- name: Ensure Hydrogen additional config files installed
-  ansible.builtin.template:
-    src: "{{ item.src }}"
-    dest: "{{ matrix_client_hydrogen_data_path }}/{{ item.name }}"
-    mode: 0644
-    owner: "{{ matrix_user_name }}"
-    group: "{{ matrix_group_name }}"
-  with_items:
-    - {src: "{{ role_path }}/templates/nginx.conf.j2", name: "nginx.conf"}
-    - {src: "{{ role_path }}/templates/labels.j2", name: "labels"}
-
-- name: Ensure Hydrogen container network is created
-  community.general.docker_network:
-    enable_ipv6: "{{ devture_systemd_docker_base_ipv6_enabled }}"
-    name: "{{ matrix_client_hydrogen_container_network }}"
-    driver: bridge
-    driver_options: "{{ devture_systemd_docker_base_container_networks_driver_options }}"
-
-- name: Ensure matrix-client-hydrogen.service installed
-  ansible.builtin.template:
-    src: "{{ role_path }}/templates/systemd/matrix-client-hydrogen.service.j2"
-    dest: "{{ devture_systemd_docker_base_systemd_path }}/matrix-client-hydrogen.service"
-    mode: 0644

roles/custom/matrix-client-hydrogen/tasks/setup_uninstall.yml

@@ -1,31 +0,0 @@
-# SPDX-FileCopyrightText: 2021 - 2022 Slavi Pantaleev
-# SPDX-FileCopyrightText: 2022 Marko Weltzer
-# SPDX-FileCopyrightText: 2022 Sebastian Gumprich
-#
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
----
-
-- name: Check existence of matrix-client-hydrogen.service
-  ansible.builtin.stat:
-    path: "{{ devture_systemd_docker_base_systemd_path }}/matrix-client-hydrogen.service"
-  register: matrix_client_hydrogen_service_stat
-
-- when: matrix_client_hydrogen_service_stat.stat.exists | bool
-  block:
-    - name: Ensure matrix-client-hydrogen is stopped
-      ansible.builtin.service:
-        name: matrix-client-hydrogen
-        state: stopped
-        enabled: false
-        daemon_reload: true
-
-    - name: Ensure matrix-client-hydrogen.service doesn't exist
-      ansible.builtin.file:
-        path: "{{ devture_systemd_docker_base_systemd_path }}/matrix-client-hydrogen.service"
-        state: absent
-
-    - name: Ensure Hydrogen paths doesn't exist
-      ansible.builtin.file:
-        path: "{{ matrix_client_hydrogen_data_path }}"
-        state: absent

roles/custom/matrix-client-hydrogen/tasks/validate_config.yml

@@ -1,45 +0,0 @@
-# SPDX-FileCopyrightText: 2021 Aaron Raimist
-# SPDX-FileCopyrightText: 2022 - 2025 Slavi Pantaleev
-# SPDX-FileCopyrightText: 2024 Suguru Hirahara
-#
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
----
-
-- name: Fail if required Hydrogen settings not defined
-  ansible.builtin.fail:
-    msg: >
-      You need to define a required configuration setting (`{{ item }}`) to use Hydrogen.
-  when: "item.when | bool and lookup('vars', item.name, default='') | string | length == 0"
-  with_items:
-    - {'name': 'matrix_client_hydrogen_default_hs_url', when: "{{ matrix_client_hydrogen_container_image_self_build }}"}
-    - {'name': 'matrix_client_hydrogen_container_network', when: true}
-    - {'name': 'matrix_client_hydrogen_container_labels_traefik_compression_middleware_name', when: "{{ matrix_client_hydrogen_container_labels_traefik_compression_middleware_enabled }}"}
-
-- name: (Deprecation) Catch and report renamed Hydrogen variables
-  ansible.builtin.fail:
-    msg: >-
-      The variable `{{ item.old }}` is deprecated. Please use `{{ item.new }}` instead.
-  when: "lookup('ansible.builtin.varnames', ('^' + item.old + '$'), wantlist=True) | length > 0"
-  with_items:
-    - {'old': 'matrix_client_hydrogen_container_image_name_prefix', 'new': 'matrix_client_hydrogen_container_image_registry_prefix'}
-
-- when: matrix_client_hydrogen_container_labels_traefik_enabled | bool
-  block:
-    - name: Fail if required matrix-client-hydrogen Traefik settings not defined
-      ansible.builtin.fail:
-        msg: >-
-          You need to define a required configuration setting (`{{ item }}`).
-      when: "lookup('vars', item, default='') == ''"
-      with_items:
-        - matrix_client_hydrogen_container_labels_traefik_hostname
-        - matrix_client_hydrogen_container_labels_traefik_path_prefix
-
-    # We ensure it doesn't end with a slash, because we handle both (slash and no-slash).
-    # Knowing that `matrix_client_hydrogen_container_labels_traefik_path_prefix` does not end with a slash
-    # ensures we know how to set these routes up without having to do "does it end with a slash" checks elsewhere.
-    - name: Fail if matrix_client_hydrogen_container_labels_traefik_path_prefix ends with a slash
-      ansible.builtin.fail:
-        msg: >-
-          matrix_client_hydrogen_container_labels_traefik_path_prefix (`{{ matrix_client_hydrogen_container_labels_traefik_path_prefix }}`) must either be `/` or not end with a slash (e.g. `/hydrogen`).
-      when: "matrix_client_hydrogen_container_labels_traefik_path_prefix != '/' and matrix_client_hydrogen_container_labels_traefik_path_prefix[-1] == '/'"

roles/custom/matrix-client-hydrogen/templates/config.json.j2

@@ -1,12 +0,0 @@
-{
-	"push": {{ matrix_client_hydrogen_push | to_json }},
-	"defaultHomeServer": {{ matrix_client_hydrogen_default_hs_url | string | to_json }},
-	"bugReportEndpointUrl": {{ matrix_client_hydrogen_bugReportEndpointUrl | to_json }},
-	"themeManifests": [
-		"{{ '' if matrix_client_hydrogen_path_prefix == '/' else matrix_client_hydrogen_path_prefix }}/assets/theme-element.json"
-	],
-	"defaultTheme": {
-		"light": "element-light",
-		"dark": "element-dark"
-	}
-}

roles/custom/matrix-client-hydrogen/templates/config.json.j2.license

@@ -1,7 +0,0 @@
-SPDX-FileCopyrightText: 2021 - 2022 Aaron Raimist
-SPDX-FileCopyrightText: 2022 - 2023 Slavi Pantaleev
-SPDX-FileCopyrightText: 2022 Matthew Cengia
-SPDX-FileCopyrightText: 2022 Nikita Chernyi
-SPDX-FileCopyrightText: 2023 Sergio Durigan Junior
-
-SPDX-License-Identifier: AGPL-3.0-or-later

roles/custom/matrix-client-hydrogen/templates/labels.j2

@@ -1,56 +0,0 @@
-{#
-SPDX-FileCopyrightText: 2023 - 2024 Slavi Pantaleev
-
-SPDX-License-Identifier: AGPL-3.0-or-later
-#}
-
-{% if matrix_client_hydrogen_container_labels_traefik_enabled %}
-traefik.enable=true
-
-{% if matrix_client_hydrogen_container_labels_traefik_docker_network %}
-traefik.docker.network={{ matrix_client_hydrogen_container_labels_traefik_docker_network }}
-{% endif %}
-
-traefik.http.services.matrix-client-hydrogen.loadbalancer.server.port=8080
-
-{% set middlewares = [] %}
-
-{% if matrix_client_hydrogen_container_labels_traefik_compression_middleware_enabled %}
-{% set middlewares = middlewares + [matrix_client_hydrogen_container_labels_traefik_compression_middleware_name] %}
-{% endif %}
-
-{% if matrix_client_hydrogen_container_labels_traefik_path_prefix != '/' %}
-traefik.http.middlewares.matrix-client-hydrogen-slashless-redirect.redirectregex.regex=({{ matrix_client_hydrogen_container_labels_traefik_path_prefix | quote }})$
-traefik.http.middlewares.matrix-client-hydrogen-slashless-redirect.redirectregex.replacement=${1}/
-{% set middlewares = middlewares + ['matrix-client-hydrogen-slashless-redirect'] %}
-{% endif %}
-
-{% if matrix_client_hydrogen_container_labels_traefik_path_prefix != '/' %}
-traefik.http.middlewares.matrix-client-hydrogen-strip-prefix.stripprefix.prefixes={{ matrix_client_hydrogen_container_labels_traefik_path_prefix }}
-{% set middlewares = middlewares + ['matrix-client-hydrogen-strip-prefix'] %}
-{% endif %}
-
-{% if matrix_client_hydrogen_container_labels_traefik_additional_response_headers.keys() | length > 0 %}
-{% for name, value in matrix_client_hydrogen_container_labels_traefik_additional_response_headers.items() %}
-traefik.http.middlewares.matrix-client-hydrogen-add-headers.headers.customresponseheaders.{{ name }}={{ value }}
-{% endfor %}
-{% set middlewares = middlewares + ['matrix-client-hydrogen-add-headers'] %}
-{% endif %}
-
-traefik.http.routers.matrix-client-hydrogen.rule={{ matrix_client_hydrogen_container_labels_traefik_rule }}
-{% if matrix_client_hydrogen_container_labels_traefik_priority | int > 0 %}
-traefik.http.routers.matrix-client-hydrogen.priority={{ matrix_client_hydrogen_container_labels_traefik_priority }}
-{% endif %}
-traefik.http.routers.matrix-client-hydrogen.service=matrix-client-hydrogen
-{% if middlewares | length > 0 %}
-traefik.http.routers.matrix-client-hydrogen.middlewares={{ middlewares | join(',') }}
-{% endif %}
-traefik.http.routers.matrix-client-hydrogen.entrypoints={{ matrix_client_hydrogen_container_labels_traefik_entrypoints }}
-traefik.http.routers.matrix-client-hydrogen.tls={{ matrix_client_hydrogen_container_labels_traefik_tls | to_json }}
-{% if matrix_client_hydrogen_container_labels_traefik_tls %}
-traefik.http.routers.matrix-client-hydrogen.tls.certResolver={{ matrix_client_hydrogen_container_labels_traefik_tls_certResolver }}
-{% endif %}
-
-{% endif %}
-
-{{ matrix_client_hydrogen_container_labels_additional_labels }}

roles/custom/matrix-client-hydrogen/templates/nginx.conf.j2

@@ -1,70 +0,0 @@
-#jinja2: lstrip_blocks: True
-# This is a custom nginx configuration file that we use in the container (instead of the default one),
-# because it allows us to run nginx with a non-root user.
-#
-# For this to work, the default vhost file (`/etc/nginx/conf.d/default.conf`) also needs to be removed.
-# (mounting `/dev/null` over `/etc/nginx/conf.d/default.conf` works well)
-#
-# The following changes have been done compared to a default nginx configuration file:
-# - default server port is changed (80 -> 8080), so that a non-root user can bind it
-# - various temp paths are changed to `/tmp`, so that a non-root user can write to them
-# - the `user` directive was removed, as we don't want nginx to switch users
-
-worker_processes 1;
-
-error_log /var/log/nginx/error.log warn;
-pid /tmp/nginx.pid;
-
-
-events {
-	worker_connections 1024;
-}
-
-
-http {
-	proxy_temp_path /tmp/proxy_temp;
-	client_body_temp_path /tmp/client_temp;
-	fastcgi_temp_path /tmp/fastcgi_temp;
-	uwsgi_temp_path /tmp/uwsgi_temp;
-	scgi_temp_path /tmp/scgi_temp;
-
-	include /etc/nginx/mime.types;
-	default_type application/octet-stream;
-
-	log_format main '$remote_addr - $remote_user [$time_local] "$request" '
-		'$status $body_bytes_sent "$http_referer" '
-		'"$http_user_agent" "$http_x_forwarded_for"';
-
-	{% if matrix_client_hydrogen_access_log_enabled %}
-	access_log /var/log/nginx/access.log main;
-	{% else %}
-	access_log off;
-	{% endif %}
-
-	sendfile on;
-	#tcp_nopush on;
-
-	keepalive_timeout 65;
-
-	#gzip on;
-
-	server {
-		listen 8080;
-		server_name localhost;
-
-		root /usr/share/nginx/html;
-
-		location / {
-			index index.html index.htm;
-		}
-
-		location ~* ^/(config(.+)?\.json$|(.+)\.html$|i18n) {
-			expires -1;
-		}
-
-		error_page 500 502 503 504 /50x.html;
-		location = /50x.html {
-			root /usr/share/nginx/html;
-		}
-	}
-}

roles/custom/matrix-client-hydrogen/templates/nginx.conf.j2.license

@@ -1,4 +0,0 @@
-SPDX-FileCopyrightText: 2021 Aaron Raimist
-SPDX-FileCopyrightText: 2022 Slavi Pantaleev
-
-SPDX-License-Identifier: AGPL-3.0-or-later

roles/custom/matrix-client-hydrogen/templates/systemd/matrix-client-hydrogen.service.j2

@@ -1,50 +0,0 @@
-#jinja2: lstrip_blocks: True
-[Unit]
-Description=Matrix Hydrogen Client
-{% for service in matrix_client_hydrogen_systemd_required_services_list %}
-Requires={{ service }}
-After={{ service }}
-{% endfor %}
-DefaultDependencies=no
-
-[Service]
-Type=simple
-Environment="HOME={{ devture_systemd_docker_base_systemd_unit_home_path }}"
-ExecStartPre=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} stop -t {{ devture_systemd_docker_base_container_stop_grace_time_seconds }} matrix-client-hydrogen 2>/dev/null || true'
-ExecStartPre=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} rm matrix-client-hydrogen 2>/dev/null || true'
-
-ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} create \
-			--rm \
-			--name=matrix-client-hydrogen \
-			--log-driver=none \
-			--user={{ matrix_user_uid }}:{{ matrix_user_gid }} \
-			--cap-drop=ALL \
-			--read-only \
-			--network={{ matrix_client_hydrogen_container_network }} \
-			{% if matrix_client_hydrogen_container_http_host_bind_port %}
-			-p {{ matrix_client_hydrogen_container_http_host_bind_port }}:8080 \
-			{% endif %}
-			--label-file={{ matrix_client_hydrogen_data_path }}/labels \
-			--tmpfs=/tmp:rw,noexec,nosuid,size=10m \
-			--mount type=bind,src={{ matrix_client_hydrogen_data_path }}/nginx.conf,dst=/etc/nginx/nginx.conf,ro \
-			--mount type=bind,src={{ matrix_client_hydrogen_data_path }}/config.json,dst=/config.json.bundled,ro \
-			{% for arg in matrix_client_hydrogen_container_extra_arguments %}
-			{{ arg }} \
-			{% endfor %}
-			{{ matrix_client_hydrogen_docker_image }}
-
-{% for network in matrix_client_hydrogen_container_additional_networks %}
-ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} network connect {{ network }} matrix-client-hydrogen
-{% endfor %}
-
-ExecStart={{ devture_systemd_docker_base_host_command_docker }} start --attach matrix-client-hydrogen
-
-ExecStop=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} stop -t {{ devture_systemd_docker_base_container_stop_grace_time_seconds }} matrix-client-hydrogen 2>/dev/null || true'
-ExecStop=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} rm matrix-client-hydrogen 2>/dev/null || true'
-
-Restart=always
-RestartSec=30
-SyslogIdentifier=matrix-client-hydrogen
-
-[Install]
-WantedBy=multi-user.target

roles/custom/matrix-client-hydrogen/templates/systemd/matrix-client-hydrogen.service.j2.license

@@ -1,5 +0,0 @@
-SPDX-FileCopyrightText: 2021 - 2025 Slavi Pantaleev
-SPDX-FileCopyrightText: 2021 Aaron Raimist
-SPDX-FileCopyrightText: 2022 Matthew Cengia
-
-SPDX-License-Identifier: AGPL-3.0-or-later

roles/custom/matrix-conduwuit/defaults/main.yml

@@ -1,194 +0,0 @@
-# SPDX-FileCopyrightText: 2025 MDAD project contributors
-# SPDX-FileCopyrightText: 2025 Slavi Pantaleev
-#
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
----
-# conduwuit is a very cool, featureful fork of conduit (https://gitlab.com/famedly/conduit).
-# Project source code URL: https://github.com/girlbossceo/conduwuit
-# See: https://conduwuit.puppyirl.gay/
-
-matrix_conduwuit_enabled: true
-
-matrix_conduwuit_hostname: ''
-
-matrix_conduwuit_docker_image: "{{ matrix_conduwuit_docker_image_registry_prefix }}girlbossceo/conduwuit:{{ matrix_conduwuit_docker_image_tag }}"
-matrix_conduwuit_docker_image_tag: v0.4.6-8f7ade4c22533a3177bfd8f175e178573ba6c1d4
-matrix_conduwuit_docker_image_force_pull: "{{ matrix_conduwuit_docker_image.endswith(':latest') }}"
-matrix_conduwuit_docker_image_registry_prefix: "{{ matrix_conduwuit_docker_image_registry_prefix_upstream }}"
-matrix_conduwuit_docker_image_registry_prefix_upstream: "{{ matrix_conduwuit_docker_image_registry_prefix_upstream_default }}"
-matrix_conduwuit_docker_image_registry_prefix_upstream_default: ghcr.io/
-
-matrix_conduwuit_base_path: "{{ matrix_base_data_path }}/conduwuit"
-matrix_conduwuit_config_path: "{{ matrix_conduwuit_base_path }}/config"
-matrix_conduwuit_data_path: "{{ matrix_conduwuit_base_path }}/data"
-
-matrix_conduwuit_config_port_number: 6167
-
-matrix_conduwuit_tmp_directory_size_mb: 500
-
-# List of systemd services that matrix-conduwuit.service depends on
-matrix_conduwuit_systemd_required_services_list: "{{ matrix_conduwuit_systemd_required_services_list_default + matrix_conduwuit_systemd_required_services_list_auto + matrix_conduwuit_systemd_required_services_list_custom }}"
-matrix_conduwuit_systemd_required_services_list_default: "{{ [devture_systemd_docker_base_docker_service_name] if devture_systemd_docker_base_docker_service_name else [] }}"
-matrix_conduwuit_systemd_required_services_list_auto: []
-matrix_conduwuit_systemd_required_services_list_custom: []
-
-# List of systemd services that matrix-conduwuit.service wants
-matrix_conduwuit_systemd_wanted_services_list: []
-
-# Controls how long to sleep for after starting the matrix-synapse container.
-#
-# Delaying, so that the homeserver can manage to fully start and various services
-# that depend on it (`matrix_conduwuit_systemd_required_services_list` and `matrix_conduwuit_systemd_wanted_services_list`)
-# may only start after the homeserver is up and running.
-#
-# This can be set to 0 to remove the delay.
-matrix_conduwuit_systemd_service_post_start_delay_seconds: 3
-
-# The base container network. It will be auto-created by this role if it doesn't exist already.
-matrix_conduwuit_container_network: ""
-
-# A list of additional container networks that the container would be connected to.
-# The role does not create these networks, so make sure they already exist.
-# Use this to expose this container to another reverse proxy, which runs in a different container network.
-matrix_conduwuit_container_additional_networks: "{{ matrix_conduwuit_container_additional_networks_auto + matrix_conduwuit_container_additional_networks_custom }}"
-matrix_conduwuit_container_additional_networks_auto: []
-matrix_conduwuit_container_additional_networks_custom: []
-
-# matrix_conduwuit_container_labels_traefik_enabled controls whether labels to assist a Traefik reverse-proxy will be attached to the container.
-# See `../templates/labels.j2` for details.
-#
-# To inject your own other container labels, see `matrix_conduwuit_container_labels_additional_labels`.
-matrix_conduwuit_container_labels_traefik_enabled: true
-matrix_conduwuit_container_labels_traefik_docker_network: "{{ matrix_conduwuit_container_network }}"
-matrix_conduwuit_container_labels_traefik_entrypoints: web-secure
-matrix_conduwuit_container_labels_traefik_tls_certResolver: default  # noqa var-naming
-
-# Controls whether labels will be added for handling the root (/) path on a public Traefik entrypoint.
-matrix_conduwuit_container_labels_public_client_root_enabled: true
-matrix_conduwuit_container_labels_public_client_root_traefik_hostname: "{{ matrix_conduwuit_hostname }}"
-matrix_conduwuit_container_labels_public_client_root_traefik_rule: "Host(`{{ matrix_conduwuit_container_labels_public_client_root_traefik_hostname }}`) && Path(`/`)"
-matrix_conduwuit_container_labels_public_client_root_traefik_priority: 0
-matrix_conduwuit_container_labels_public_client_root_traefik_entrypoints: "{{ matrix_conduwuit_container_labels_traefik_entrypoints }}"
-matrix_conduwuit_container_labels_public_client_root_traefik_tls: "{{ matrix_conduwuit_container_labels_public_client_root_traefik_entrypoints != 'web' }}"
-matrix_conduwuit_container_labels_public_client_root_traefik_tls_certResolver: "{{ matrix_conduwuit_container_labels_traefik_tls_certResolver }}"  # noqa var-naming
-matrix_conduwuit_container_labels_public_client_root_redirection_enabled: false
-matrix_conduwuit_container_labels_public_client_root_redirection_url: ""
-
-# Controls whether labels will be added that expose the Client-Server API on a public Traefik entrypoint.
-matrix_conduwuit_container_labels_public_client_api_enabled: true
-matrix_conduwuit_container_labels_public_client_api_traefik_hostname: "{{ matrix_conduwuit_hostname }}"
-matrix_conduwuit_container_labels_public_client_api_traefik_path_prefix: /_matrix
-matrix_conduwuit_container_labels_public_client_api_traefik_rule: "Host(`{{ matrix_conduwuit_container_labels_public_client_api_traefik_hostname }}`) && PathPrefix(`{{ matrix_conduwuit_container_labels_public_client_api_traefik_path_prefix }}`)"
-matrix_conduwuit_container_labels_public_client_api_traefik_priority: 0
-matrix_conduwuit_container_labels_public_client_api_traefik_entrypoints: "{{ matrix_conduwuit_container_labels_traefik_entrypoints }}"
-matrix_conduwuit_container_labels_public_client_api_traefik_tls: "{{ matrix_conduwuit_container_labels_public_client_api_traefik_entrypoints != 'web' }}"
-matrix_conduwuit_container_labels_public_client_api_traefik_tls_certResolver: "{{ matrix_conduwuit_container_labels_traefik_tls_certResolver }}"  # noqa var-naming
-
-# Controls whether labels will be added that expose the Client-Server API on the internal Traefik entrypoint.
-# This is similar to `matrix_conduwuit_container_labels_public_client_api_enabled`, but the entrypoint and intent is different.
-matrix_conduwuit_container_labels_internal_client_api_enabled: false
-matrix_conduwuit_container_labels_internal_client_api_traefik_path_prefix: "{{ matrix_conduwuit_container_labels_public_client_api_traefik_path_prefix }}"
-matrix_conduwuit_container_labels_internal_client_api_traefik_rule: "PathPrefix(`{{ matrix_conduwuit_container_labels_internal_client_api_traefik_path_prefix }}`)"
-matrix_conduwuit_container_labels_internal_client_api_traefik_priority: "{{ matrix_conduwuit_container_labels_public_client_api_traefik_priority }}"
-matrix_conduwuit_container_labels_internal_client_api_traefik_entrypoints: ""
-
-# Controls whether labels will be added that expose the Server-Server API (Federation API) on a public Traefik entrypoint.
-matrix_conduwuit_container_labels_public_federation_api_enabled: "{{ matrix_conduwuit_config_allow_federation }}"
-matrix_conduwuit_container_labels_public_federation_api_traefik_hostname: "{{ matrix_conduwuit_hostname }}"
-matrix_conduwuit_container_labels_public_federation_api_traefik_path_prefix: /_matrix
-matrix_conduwuit_container_labels_public_federation_api_traefik_rule: "Host(`{{ matrix_conduwuit_container_labels_public_federation_api_traefik_hostname }}`) && PathPrefix(`{{ matrix_conduwuit_container_labels_public_federation_api_traefik_path_prefix }}`)"
-matrix_conduwuit_container_labels_public_federation_api_traefik_priority: 0
-matrix_conduwuit_container_labels_public_federation_api_traefik_entrypoints: ''
-# TLS is force-enabled here, because the spec (https://spec.matrix.org/v1.9/server-server-api/#tls) says that the federation API must use HTTPS.
-matrix_conduwuit_container_labels_public_federation_api_traefik_tls: true
-matrix_conduwuit_container_labels_public_federation_api_traefik_tls_certResolver: "{{ matrix_conduwuit_container_labels_traefik_tls_certResolver }}"  # noqa var-naming
-
-# Controls whether labels will be added that expose the `/_conduwuit` path prefix on a public Traefik entrypoint.
-matrix_conduwuit_container_labels_public_conduwuit_api_enabled: true
-matrix_conduwuit_container_labels_public_conduwuit_api_traefik_hostname: "{{ matrix_conduwuit_hostname }}"
-matrix_conduwuit_container_labels_public_conduwuit_api_traefik_path_prefix: /_conduwuit
-matrix_conduwuit_container_labels_public_conduwuit_api_traefik_rule: "Host(`{{ matrix_conduwuit_container_labels_public_conduwuit_api_traefik_hostname }}`) && PathPrefix(`{{ matrix_conduwuit_container_labels_public_conduwuit_api_traefik_path_prefix }}`)"
-matrix_conduwuit_container_labels_public_conduwuit_api_traefik_priority: 0
-matrix_conduwuit_container_labels_public_conduwuit_api_traefik_entrypoints: "{{ matrix_conduwuit_container_labels_traefik_entrypoints }}"
-matrix_conduwuit_container_labels_public_conduwuit_api_traefik_tls: "{{ matrix_conduwuit_container_labels_public_conduwuit_api_traefik_entrypoints != 'web' }}"
-matrix_conduwuit_container_labels_public_conduwuit_api_traefik_tls_certResolver: "{{ matrix_conduwuit_container_labels_traefik_tls_certResolver }}"  # noqa var-naming
-
-# matrix_conduwuit_container_labels_additional_labels contains a multiline string with additional labels to add to the container label file.
-# See `../templates/labels.j2` for details.
-#
-# Example:
-# matrix_conduwuit_container_labels_additional_labels: |
-#   my.label=1
-#   another.label="here"
-matrix_conduwuit_container_labels_additional_labels: ''
-
-# Extra arguments for the Docker container
-matrix_conduwuit_container_extra_arguments: []
-
-# Specifies which template files to use when configuring conduwuit.
-# If you'd like to have your own different configuration, feel free to copy and paste
-# the original files into your inventory (e.g. in `inventory/host_vars/matrix.example.com/`)
-# and then change the specific host's `vars.yml` file like this:
-# matrix_conduwuit_template_conduwuit_config: "{{ playbook_dir }}/inventory/host_vars/matrix.example.com/conduwuit.toml.j2"
-matrix_conduwuit_template_conduwuit_config: "{{ role_path }}/templates/conduwuit.toml.j2"
-
-# Max size for uploads, in bytes
-matrix_conduwuit_config_server_name: "{{ matrix_domain }}"
-
-# Max size for uploads, in bytes
-matrix_conduwuit_config_max_request_size: 20_000_000
-
-# Enables registration. If set to false, no users can register on this server.
-matrix_conduwuit_config_allow_registration: false
-
-# Controls the `yes_i_am_very_very_sure_i_want_an_open_registration_server_prone_to_abuse` setting.
-# This is only used when `matrix_conduwuit_config_allow_registration` is set to true and no registration token is configured.
-matrix_conduwuit_config_yes_i_am_very_very_sure_i_want_an_open_registration_server_prone_to_abuse: false
-
-# Controls the `registration_token` setting.
-# When registration is enabled (`matrix_conduwuit_config_allow_registration`) you:
-# - either need to set a token to protect registration from abuse
-# - or you need to enable the `yes_i_am_very_very_sure_i_want_an_open_registration_server_prone_to_abuse` setting
-#   (see `matrix_conduwuit_config_yes_i_am_very_very_sure_i_want_an_open_registration_server_prone_to_abuse`),
-#   to allow registration without any form of 2nd-step.
-matrix_conduwuit_config_registration_token: ''
-
-# Controls the `new_user_displayname_suffix` setting.
-# This is the suffix that will be added to the displayname of new users.
-# Upstream defaults this to "🏳️‍⚧️", but we keep this consistent across all homeserver implementations and do not enable a suffix.
-matrix_conduwuit_config_new_user_displayname_suffix: ""
-
-# Controls the `allow_check_for_updates` setting.
-matrix_conduwuit_config_allow_check_for_updates: false
-
-# Controls the `emergency_password` setting.
-matrix_conduwuit_config_emergency_password: ''
-
-# Controls the `allow_federation` setting.
-matrix_conduwuit_config_allow_federation: true
-
-matrix_conduwuit_trusted_servers:
- - "matrix.org"
-
-matrix_conduwuit_config_log: "info,state_res=warn,rocket=off,_=off,sled=off"
-
-# TURN integration.
-# See: https://conduwuit.puppyirl.gay/turn.html
-matrix_conduwuit_config_turn_uris: []
-matrix_conduwuit_config_turn_secret: ''
-matrix_conduwuit_config_turn_username: ''
-matrix_conduwuit_config_turn_password: ''
-
-# Controls whether the self-check feature should validate SSL certificates.
-matrix_conduwuit_self_check_validate_certificates: true
-
-# Additional environment variables to pass to the container.
-#
-# Environment variables take priority over settings in the configuration file.
-#
-# Example:
-# matrix_conduwuit_environment_variables_extension: |
-#   CONDUWUIT_MAX_REQUEST_SIZE=50000000
-#   CONDUWUIT_REQUEST_TIMEOUT=60
-matrix_conduwuit_environment_variables_extension: ''

roles/custom/matrix-conduwuit/tasks/install.yml

@@ -1,64 +0,0 @@
-# SPDX-FileCopyrightText: 2025 Slavi Pantaleev
-#
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
----
-
-- name: Ensure conduwuit config path exists
-  ansible.builtin.file:
-    path: "{{ matrix_conduwuit_config_path }}"
-    state: directory
-    mode: 0750
-    owner: "{{ matrix_user_name }}"
-    group: "{{ matrix_group_name }}"
-
-- name: Ensure conduwuit data path exists
-  ansible.builtin.file:
-    path: "{{ matrix_conduwuit_data_path }}"
-    state: directory
-    mode: 0770
-    owner: "{{ matrix_user_name }}"
-    group: "{{ matrix_group_name }}"
-
-- name: Ensure conduwuit configuration installed
-  ansible.builtin.template:
-    src: "{{ matrix_conduwuit_template_conduwuit_config }}"
-    dest: "{{ matrix_conduwuit_config_path }}/conduwuit.toml"
-    mode: 0644
-    owner: "{{ matrix_user_name }}"
-    group: "{{ matrix_group_name }}"
-
-- name: Ensure conduwuit support files installed
-  ansible.builtin.template:
-    src: "{{ role_path }}/templates/{{ item }}.j2"
-    dest: "{{ matrix_conduwuit_base_path }}/{{ item }}"
-    mode: 0640
-    owner: "{{ matrix_user_name }}"
-    group: "{{ matrix_group_name }}"
-  with_items:
-    - labels
-    - env
-
-- name: Ensure conduwuit container network is created
-  community.general.docker_network:
-    enable_ipv6: "{{ devture_systemd_docker_base_ipv6_enabled }}"
-    name: "{{ matrix_conduwuit_container_network }}"
-    driver: bridge
-    driver_options: "{{ devture_systemd_docker_base_container_networks_driver_options }}"
-
-- name: Ensure conduwuit container image is pulled
-  community.docker.docker_image:
-    name: "{{ matrix_conduwuit_docker_image }}"
-    source: "{{ 'pull' if ansible_version.major > 2 or ansible_version.minor > 7 else omit }}"
-    force_source: "{{ matrix_conduwuit_docker_image_force_pull if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}"
-    force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else matrix_conduwuit_docker_image_force_pull }}"
-  register: result
-  retries: "{{ devture_playbook_help_container_retries_count }}"
-  delay: "{{ devture_playbook_help_container_retries_delay }}"
-  until: result is not failed
-
-- name: Ensure matrix-conduwuit.service installed
-  ansible.builtin.template:
-    src: "{{ role_path }}/templates/systemd/matrix-conduwuit.service.j2"
-    dest: "{{ devture_systemd_docker_base_systemd_path }}/matrix-conduwuit.service"
-    mode: 0644

roles/custom/matrix-conduwuit/tasks/main.yml

@@ -1,34 +0,0 @@
-# SPDX-FileCopyrightText: 2025 MDAD project contributors
-# SPDX-FileCopyrightText: 2025 Slavi Pantaleev
-#
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
----
-
-- tags:
-    - setup-all
-    - setup-conduwuit
-    - install-all
-    - install-conduwuit
-  block:
-    - when: matrix_conduwuit_enabled | bool
-      ansible.builtin.include_tasks: "{{ role_path }}/tasks/validate_config.yml"
-
-    - when: matrix_conduwuit_enabled | bool
-      ansible.builtin.include_tasks: "{{ role_path }}/tasks/install.yml"
-
-- tags:
-    - setup-all
-    - setup-conduwuit
-  block:
-    - when: not matrix_conduwuit_enabled | bool
-      ansible.builtin.include_tasks: "{{ role_path }}/tasks/uninstall.yml"
-
-- tags:
-    - self-check
-  block:
-    - when: matrix_conduwuit_enabled | bool
-      ansible.builtin.include_tasks: "{{ role_path }}/tasks/self_check_client_api.yml"
-
-    - when: matrix_conduwuit_enabled | bool
-      ansible.builtin.include_tasks: "{{ role_path }}/tasks/self_check_federation_api.yml"

roles/custom/matrix-conduwuit/tasks/self_check_client_api.yml

@@ -1,28 +0,0 @@
-# SPDX-FileCopyrightText: 2025 Slavi Pantaleev
-# SPDX-FileCopyrightText: 2025 Suguru Hirahara
-#
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
----
-
-- name: Check Matrix Client API
-  ansible.builtin.uri:
-    url: "{{ matrix_conduwuit_client_api_url_endpoint_public }}"
-    follow_redirects: none
-    validate_certs: "{{ matrix_conduwuit_self_check_validate_certificates }}"
-  register: result_matrix_conduwuit_client_api
-  ignore_errors: true
-  check_mode: false
-  when: matrix_conduwuit_enabled | bool
-  delegate_to: 127.0.0.1
-  become: false
-
-- name: Fail if Matrix Client API not working
-  ansible.builtin.fail:
-    msg: "Failed checking Matrix Client API is up at `{{ matrix_server_fqn_matrix }}` (checked endpoint: `{{ matrix_conduwuit_client_api_url_endpoint_public }}`). Is conduwuit running? Is port 443 open in your firewall? Full error: {{ result_matrix_conduwuit_client_api }}"
-  when: "matrix_conduwuit_enabled | bool and (result_matrix_conduwuit_client_api.failed or 'json' not in result_matrix_conduwuit_client_api)"
-
-- name: Report working Matrix Client API
-  ansible.builtin.debug:
-    msg: "The Matrix Client API at `{{ matrix_server_fqn_matrix }}` (checked endpoint: `{{ matrix_conduwuit_client_api_url_endpoint_public }}`) is working"
-  when: matrix_conduwuit_enabled | bool

roles/custom/matrix-conduwuit/tasks/self_check_federation_api.yml

@@ -1,32 +0,0 @@
-# SPDX-FileCopyrightText: 2025 Slavi Pantaleev
-#
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
----
-
-- name: Check Matrix Federation API
-  ansible.builtin.uri:
-    url: "{{ matrix_synapse_federation_api_url_endpoint_public }}"
-    follow_redirects: none
-    validate_certs: "{{ matrix_synapse_self_check_validate_certificates }}"
-  register: result_matrix_synapse_federation_api
-  ignore_errors: true
-  check_mode: false
-  when: matrix_synapse_enabled | bool
-  delegate_to: 127.0.0.1
-  become: false
-
-- name: Fail if Matrix Federation API not working
-  ansible.builtin.fail:
-    msg: "Failed checking Matrix Federation API is up at `{{ matrix_server_fqn_matrix }}` (checked endpoint: `{{ matrix_synapse_federation_api_url_endpoint_public }}`). Is Synapse running? Is port {{ matrix_federation_public_port }} open in your firewall? Full error: {{ result_matrix_synapse_federation_api }}"
-  when: "matrix_synapse_enabled | bool and matrix_synapse_federation_enabled | bool and (result_matrix_synapse_federation_api.failed or 'json' not in result_matrix_synapse_federation_api)"
-
-- name: Fail if Matrix Federation API unexpectedly enabled
-  ansible.builtin.fail:
-    msg: "Matrix Federation API is up at `{{ matrix_server_fqn_matrix }}` (checked endpoint: `{{ matrix_synapse_federation_api_url_endpoint_public }}`) despite being disabled."
-  when: "matrix_synapse_enabled | bool and not matrix_synapse_federation_enabled | bool and not result_matrix_synapse_federation_api.failed"
-
-- name: Report working Matrix Federation API
-  ansible.builtin.debug:
-    msg: "The Matrix Federation API at `{{ matrix_server_fqn_matrix }}` (checked endpoint: `{{ matrix_synapse_federation_api_url_endpoint_public }}`) is working"
-  when: "matrix_synapse_enabled | bool and matrix_synapse_federation_enabled | bool"

roles/custom/matrix-conduwuit/tasks/setup_install.yml

@@ -1,63 +0,0 @@
-# SPDX-FileCopyrightText: 2025 MDAD project contributors
-#
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
----
-
-- name: Ensure conduwuit config path exists
-  ansible.builtin.file:
-    path: "{{ matrix_conduwuit_config_path }}"
-    state: directory
-    mode: 0750
-    owner: "{{ matrix_user_name }}"
-    group: "{{ matrix_group_name }}"
-
-- name: Ensure conduwuit data path exists
-  ansible.builtin.file:
-    path: "{{ matrix_conduwuit_data_path }}"
-    state: directory
-    mode: 0770
-    owner: "{{ matrix_user_name }}"
-    group: "{{ matrix_group_name }}"
-
-- name: Ensure conduwuit configuration installed
-  ansible.builtin.template:
-    src: "{{ matrix_conduwuit_template_conduwuit_config }}"
-    dest: "{{ matrix_conduwuit_config_path }}/conduwuit.toml"
-    mode: 0644
-    owner: "{{ matrix_user_name }}"
-    group: "{{ matrix_group_name }}"
-
-- name: Ensure conduwuit support files installed
-  ansible.builtin.template:
-    src: "{{ role_path }}/templates/{{ item }}.j2"
-    dest: "{{ matrix_conduwuit_base_path }}/{{ item }}"
-    mode: 0640
-    owner: "{{ matrix_user_name }}"
-    group: "{{ matrix_group_name }}"
-  with_items:
-    - labels
-
-- name: Ensure conduwuit container network is created
-  community.general.docker_network:
-    enable_ipv6: "{{ devture_systemd_docker_base_ipv6_enabled }}"
-    name: "{{ matrix_conduwuit_container_network }}"
-    driver: bridge
-    driver_options: "{{ devture_systemd_docker_base_container_networks_driver_options }}"
-
-- name: Ensure conduwuit container image is pulled
-  community.docker.docker_image:
-    name: "{{ matrix_conduwuit_docker_image }}"
-    source: "{{ 'pull' if ansible_version.major > 2 or ansible_version.minor > 7 else omit }}"
-    force_source: "{{ matrix_conduwuit_docker_image_force_pull if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}"
-    force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else matrix_conduwuit_docker_image_force_pull }}"
-  register: result
-  retries: "{{ devture_playbook_help_container_retries_count }}"
-  delay: "{{ devture_playbook_help_container_retries_delay }}"
-  until: result is not failed
-
-- name: Ensure matrix-conduwuit.service installed
-  ansible.builtin.template:
-    src: "{{ role_path }}/templates/systemd/matrix-conduwuit.service.j2"
-    dest: "{{ devture_systemd_docker_base_systemd_path }}/matrix-conduwuit.service"
-    mode: 0644

roles/custom/matrix-conduwuit/tasks/setup_uninstall.yml

@@ -1,23 +0,0 @@
-# SPDX-FileCopyrightText: 2025 MDAD project contributors
-#
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
----
-
-- name: Check existence of matrix-conduwuit service
-  ansible.builtin.stat:
-    path: "{{ devture_systemd_docker_base_systemd_path }}/matrix-conduwuit.service"
-  register: matrix_conduwuit_service_stat
-
-- when: matrix_conduwuit_service_stat.stat.exists | bool
-  block:
-    - name: Ensure matrix-conduwuit is stopped
-      ansible.builtin.systemd:
-        name: matrix-conduwuit
-        state: stopped
-        daemon_reload: true
-
-    - name: Ensure matrix-conduwuit.service doesn't exist
-      ansible.builtin.file:
-        path: "{{ devture_systemd_docker_base_systemd_path }}/matrix-conduwuit.service"
-        state: absent

roles/custom/matrix-conduwuit/tasks/uninstall.yml

@@ -1,23 +0,0 @@
-# SPDX-FileCopyrightText: 2025 Slavi Pantaleev
-#
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
----
-
-- name: Check existence of matrix-conduwuit service
-  ansible.builtin.stat:
-    path: "{{ devture_systemd_docker_base_systemd_path }}/matrix-conduwuit.service"
-  register: matrix_conduwuit_service_stat
-
-- when: matrix_conduwuit_service_stat.stat.exists | bool
-  block:
-    - name: Ensure matrix-conduwuit is stopped
-      ansible.builtin.systemd:
-        name: matrix-conduwuit
-        state: stopped
-        daemon_reload: true
-
-    - name: Ensure matrix-conduwuit.service doesn't exist
-      ansible.builtin.file:
-        path: "{{ devture_systemd_docker_base_systemd_path }}/matrix-conduwuit.service"
-        state: absent

roles/custom/matrix-conduwuit/tasks/validate_config.yml

@@ -1,15 +0,0 @@
-# SPDX-FileCopyrightText: 2025 MDAD project contributors
-#
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
----
-
-- name: Fail if required conduwuit settings not defined
-  ansible.builtin.fail:
-    msg: >-
-      You need to define a required configuration setting (`{{ item.name }}`).
-  when: "item.when | bool and lookup('vars', item.name, default='') | string | length == 0"
-  with_items:
-    - {'name': 'matrix_conduwuit_hostname', when: true}
-    - {'name': 'matrix_conduwuit_container_network', when: true}
-    - {'name': 'matrix_conduwuit_container_labels_internal_client_api_traefik_entrypoints', when: "{{ matrix_conduwuit_container_labels_internal_client_api_enabled }}"}

roles/custom/matrix-conduwuit/templates/env.j2

@@ -1 +0,0 @@
-{{ matrix_conduwuit_environment_variables_extension }}

roles/custom/matrix-conduwuit/templates/env.j2.license

@@ -1,3 +0,0 @@
-SPDX-FileCopyrightText: 2025 Slavi Pantaleev
-
-SPDX-License-Identifier: AGPL-3.0-or-later

roles/custom/matrix-conduwuit/templates/labels.j2

@@ -1,173 +0,0 @@
-{#
-SPDX-FileCopyrightText: 2025 MDAD project contributors
-SPDX-FileCopyrightText: 2025 Slavi Pantaleev
-SPDX-FileCopyrightText: 2025 Suguru Hirahara
-
-SPDX-License-Identifier: AGPL-3.0-or-later
-#}
-
-{% if matrix_conduwuit_container_labels_traefik_enabled %}
-traefik.enable=true
-
-{% if matrix_conduwuit_container_labels_traefik_docker_network %}
-traefik.docker.network={{ matrix_conduwuit_container_labels_traefik_docker_network }}
-{% endif %}
-
-traefik.http.services.matrix-conduwuit.loadbalancer.server.port={{ matrix_conduwuit_config_port_number }}
-
-
-{% if matrix_conduwuit_container_labels_public_client_root_enabled %}
-############################################################
-#                                                          #
-# Public Root path (/)                                     #
-#                                                          #
-############################################################
-
-{% set client_root_middlewares = [] %}
-
-{% if matrix_conduwuit_container_labels_public_client_root_redirection_enabled %}
-{% set client_root_middlewares = client_root_middlewares + ['matrix-conduwuit-client-root-redirect'] %}
-traefik.http.middlewares.matrix-conduwuit-client-root-redirect.redirectregex.regex=(.*)
-traefik.http.middlewares.matrix-conduwuit-client-root-redirect.redirectregex.replacement={{ matrix_conduwuit_container_labels_public_client_root_redirection_url }}
-{% endif %}
-
-traefik.http.routers.matrix-conduwuit-public-client-root.rule={{ matrix_conduwuit_container_labels_public_client_root_traefik_rule }}
-
-traefik.http.routers.matrix-conduwuit-public-client-root.middlewares={{ client_root_middlewares | join(',') }}
-
-{% if matrix_conduwuit_container_labels_public_client_root_traefik_priority | int > 0 %}
-traefik.http.routers.matrix-conduwuit-public-client-root.priority={{ matrix_conduwuit_container_labels_public_client_root_traefik_priority }}
-{% endif %}
-
-traefik.http.routers.matrix-conduwuit-public-client-root.service=matrix-conduwuit
-traefik.http.routers.matrix-conduwuit-public-client-root.entrypoints={{ matrix_conduwuit_container_labels_public_client_root_traefik_entrypoints }}
-traefik.http.routers.matrix-conduwuit-public-client-root.tls={{ matrix_conduwuit_container_labels_public_client_root_traefik_tls | to_json }}
-
-{% if matrix_conduwuit_container_labels_public_client_root_traefik_tls %}
-traefik.http.routers.matrix-conduwuit-public-client-root.tls.certResolver={{ matrix_conduwuit_container_labels_public_client_root_traefik_tls_certResolver }}
-{% endif %}
-
-############################################################
-#                                                          #
-# /Public Root path (/)                                    #
-#                                                          #
-############################################################
-{% endif %}
-
-
-{% if matrix_conduwuit_container_labels_public_client_api_enabled %}
-############################################################
-#                                                          #
-# Public Client-API (/_matrix)                             #
-#                                                          #
-############################################################
-
-traefik.http.routers.matrix-conduwuit-public-client-api.rule={{ matrix_conduwuit_container_labels_public_client_api_traefik_rule }}
-
-{% if matrix_conduwuit_container_labels_public_client_api_traefik_priority | int > 0 %}
-traefik.http.routers.matrix-conduwuit-public-client-api.priority={{ matrix_conduwuit_container_labels_public_client_api_traefik_priority }}
-{% endif %}
-
-traefik.http.routers.matrix-conduwuit-public-client-api.service=matrix-conduwuit
-traefik.http.routers.matrix-conduwuit-public-client-api.entrypoints={{ matrix_conduwuit_container_labels_public_client_api_traefik_entrypoints }}
-
-traefik.http.routers.matrix-conduwuit-public-client-api.tls={{ matrix_conduwuit_container_labels_public_client_api_traefik_tls | to_json }}
-{% if matrix_conduwuit_container_labels_public_client_api_traefik_tls %}
-traefik.http.routers.matrix-conduwuit-public-client-api.tls.certResolver={{ matrix_conduwuit_container_labels_public_client_api_traefik_tls_certResolver }}
-{% endif %}
-
-############################################################
-#                                                          #
-# /Public Client-API (/_matrix)                            #
-#                                                          #
-############################################################
-{% endif %}
-
-
-{% if matrix_conduwuit_container_labels_internal_client_api_enabled %}
-############################################################
-#                                                          #
-# Internal Client-API (/_matrix)                           #
-#                                                          #
-############################################################
-
-traefik.http.routers.matrix-conduwuit-internal-client-api.rule={{ matrix_conduwuit_container_labels_internal_client_api_traefik_rule }}
-
-{% if matrix_conduwuit_container_labels_internal_client_api_traefik_priority | int > 0 %}
-traefik.http.routers.matrix-conduwuit-internal-client-api.priority={{ matrix_conduwuit_container_labels_internal_client_api_traefik_priority }}
-{% endif %}
-
-traefik.http.routers.matrix-conduwuit-internal-client-api.service=matrix-conduwuit
-traefik.http.routers.matrix-conduwuit-internal-client-api.entrypoints={{ matrix_conduwuit_container_labels_internal_client_api_traefik_entrypoints }}
-
-############################################################
-#                                                          #
-# /Internal Client-API (/_matrix)                          #
-#                                                          #
-############################################################
-{% endif %}
-
-
-{% if matrix_conduwuit_container_labels_public_federation_api_enabled %}
-############################################################
-#                                                          #
-# Public Federation-API (/_matrix)                         #
-#                                                          #
-############################################################
-
-traefik.http.routers.matrix-conduwuit-public-federation-api.rule={{ matrix_conduwuit_container_labels_public_federation_api_traefik_rule }}
-
-{% if matrix_conduwuit_container_labels_public_federation_api_traefik_priority | int > 0 %}
-traefik.http.routers.matrix-conduwuit-public-federation-api.priority={{ matrix_conduwuit_container_labels_public_federation_api_traefik_priority }}
-{% endif %}
-
-traefik.http.routers.matrix-conduwuit-public-federation-api.service=matrix-conduwuit
-traefik.http.routers.matrix-conduwuit-public-federation-api.entrypoints={{ matrix_conduwuit_container_labels_public_federation_api_traefik_entrypoints }}
-
-traefik.http.routers.matrix-conduwuit-public-federation-api.tls={{ matrix_conduwuit_container_labels_public_federation_api_traefik_tls | to_json }}
-{% if matrix_conduwuit_container_labels_public_federation_api_traefik_tls %}
-traefik.http.routers.matrix-conduwuit-public-federation-api.tls.certResolver={{ matrix_conduwuit_container_labels_public_federation_api_traefik_tls_certResolver }}
-{% endif %}
-
-############################################################
-#                                                          #
-# /Public Federation-API (/_matrix)                        #
-#                                                          #
-############################################################
-{% endif %}
-
-
-
-
-{% if matrix_conduwuit_container_labels_public_conduwuit_api_enabled %}
-############################################################
-#                                                          #
-# Public conduwuit-API (/_conduwuit)                       #
-#                                                          #
-############################################################
-
-traefik.http.routers.matrix-conduwuit-public-conduwuit-api.rule={{ matrix_conduwuit_container_labels_public_conduwuit_api_traefik_rule }}
-
-{% if matrix_conduwuit_container_labels_public_conduwuit_api_traefik_priority | int > 0 %}
-traefik.http.routers.matrix-conduwuit-public-conduwuit-api.priority={{ matrix_conduwuit_container_labels_public_conduwuit_api_traefik_priority }}
-{% endif %}
-
-traefik.http.routers.matrix-conduwuit-public-conduwuit-api.service=matrix-conduwuit
-traefik.http.routers.matrix-conduwuit-public-conduwuit-api.entrypoints={{ matrix_conduwuit_container_labels_public_conduwuit_api_traefik_entrypoints }}
-
-traefik.http.routers.matrix-conduwuit-public-conduwuit-api.tls={{ matrix_conduwuit_container_labels_public_conduwuit_api_traefik_tls | to_json }}
-{% if matrix_conduwuit_container_labels_public_conduwuit_api_traefik_tls %}
-traefik.http.routers.matrix-conduwuit-public-conduwuit-api.tls.certResolver={{ matrix_conduwuit_container_labels_public_conduwuit_api_traefik_tls_certResolver }}
-{% endif %}
-
-############################################################
-#                                                          #
-# /Public conduwuit-API (/_conduwuit)                      #
-#                                                          #
-############################################################
-{% endif %}
-
-
-{% endif %}
-
-{{ matrix_conduwuit_container_labels_additional_labels }}

roles/custom/matrix-conduwuit/templates/systemd/matrix-conduwuit.service.j2

@@ -1,51 +0,0 @@
-#jinja2: lstrip_blocks: True
-[Unit]
-Description=conduwuit Matrix homeserver
-{% for service in matrix_conduwuit_systemd_required_services_list %}
-Requires={{ service }}
-After={{ service }}
-{% endfor %}
-
-[Service]
-Type=simple
-Environment="HOME={{ devture_systemd_docker_base_systemd_unit_home_path }}"
-ExecStartPre=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} stop -t {{ devture_systemd_docker_base_container_stop_grace_time_seconds }} matrix-conduwuit 2>/dev/null || true'
-ExecStartPre=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} rm matrix-conduwuit 2>/dev/null || true'
-
-ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} create \
-			--rm \
-			--name=matrix-conduwuit \
-			--log-driver=none \
-			--user={{ matrix_user_uid }}:{{ matrix_user_gid }} \
-			--cap-drop=ALL \
-			--read-only \
-			--tmpfs=/tmp:rw,noexec,nosuid,size={{ matrix_conduwuit_tmp_directory_size_mb }}m \
-			--network={{ matrix_conduwuit_container_network }} \
-			--env CONDUWUIT_CONFIG=/etc/conduwuit/conduwuit.toml \
-			--label-file={{ matrix_conduwuit_base_path }}/labels \
-			--mount type=bind,src={{ matrix_conduwuit_data_path }},dst=/var/lib/conduwuit \
-			--mount type=bind,src={{ matrix_conduwuit_config_path }},dst=/etc/conduwuit,ro \
-			{% for arg in matrix_conduwuit_container_extra_arguments %}
-			{{ arg }} \
-			{% endfor %}
-			{{ matrix_conduwuit_docker_image }}
-
-{% for network in matrix_conduwuit_container_additional_networks %}
-ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} network connect {{ network }} matrix-conduwuit
-{% endfor %}
-
-ExecStart={{ devture_systemd_docker_base_host_command_docker }} start --attach matrix-conduwuit
-
-{% if matrix_conduwuit_systemd_service_post_start_delay_seconds != 0 %}
-ExecStartPost=-{{ matrix_host_command_sleep }} {{ matrix_conduwuit_systemd_service_post_start_delay_seconds }}
-{% endif %}
-
-ExecStop=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} stop -t {{ devture_systemd_docker_base_container_stop_grace_time_seconds }} matrix-conduwuit 2>/dev/null || true'
-ExecStop=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} rm matrix-conduwuit 2>/dev/null || true'
-ExecReload={{ devture_systemd_docker_base_host_command_docker }} exec matrix-conduwuit /bin/sh -c 'kill -HUP 1'
-Restart=always
-RestartSec=30
-SyslogIdentifier=matrix-conduwuit
-
-[Install]
-WantedBy=multi-user.target

roles/custom/matrix-conduwuit/templates/systemd/matrix-conduwuit.service.j2.license

@@ -1,4 +0,0 @@
-SPDX-FileCopyrightText: 2025 MDAD project contributors
-SPDX-FileCopyrightText: 2025 Slavi Pantaleev
-
-SPDX-License-Identifier: AGPL-3.0-or-later

roles/custom/matrix-conduwuit/vars/main.yml

@@ -1,9 +0,0 @@
-# SPDX-FileCopyrightText: 2025 MDAD project contributors
-# SPDX-FileCopyrightText: 2025 Slavi Pantaleev
-#
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
----
-
-matrix_conduwuit_client_api_url_endpoint_public: "{{ 'https' if matrix_playbook_ssl_enabled else 'http' }}://{{ matrix_conduwuit_hostname }}/_matrix/client/versions"
-matrix_conduwuit_federation_api_url_endpoint_public: "{{ 'https' if matrix_playbook_ssl_enabled else 'http' }}://{{ matrix_conduwuit_hostname }}:{{ matrix_federation_public_port }}/_matrix/federation/v1/version"

roles/custom/matrix-continuwuity/tasks/migrate_from_conduwuit.yml

@@ -13,7 +13,7 @@
 - name: Check existence of conduwuit directory
   ansible.builtin.stat:
     path: "{{ matrix_base_data_path }}/conduwuit"
-  register: matrix_conduwuit_directory_stat
+  register: matrix_removed_conduwuit_directory_stat
 
 - name: Check existence of continuwuity directory
   ansible.builtin.stat:
@@ -21,7 +21,7 @@
   register: matrix_continuwuity_directory_stat
 
 - when: >
-        matrix_conduwuit_directory_stat.stat.exists | bool and
+        matrix_removed_conduwuit_directory_stat.stat.exists | bool and
         matrix_continuwuity_directory_stat.stat.exists | bool
   block:
     - name: Ensure matrix-continuwuity.service systemd service is stopped

roles/custom/matrix-coturn/defaults/main.yml

@@ -1,237 +0,0 @@
-# SPDX-FileCopyrightText: 2019 - 2025 Slavi Pantaleev
-# SPDX-FileCopyrightText: 2019 Stuart Mumford
-# SPDX-FileCopyrightText: 2019 Sylvia van Os
-# SPDX-FileCopyrightText: 2020 - 2021 Dan Arnfield
-# SPDX-FileCopyrightText: 2020 Horvath Gergely
-# SPDX-FileCopyrightText: 2021 - 2022 MDAD project contributors
-# SPDX-FileCopyrightText: 2021 Ahmad Haghighi
-# SPDX-FileCopyrightText: 2022 - 2023 Nikita Chernyi
-# SPDX-FileCopyrightText: 2022 Hefty Zauk
-# SPDX-FileCopyrightText: 2022 Marko Weltzer
-# SPDX-FileCopyrightText: 2023 Samuel Meenzen
-# SPDX-FileCopyrightText: 2025 Suguru Hirahara
-#
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
----
-# Project source code URL: https://github.com/coturn/coturn
-
-matrix_coturn_enabled: true
-
-matrix_coturn_hostname: ""
-
-matrix_coturn_container_image_self_build: false
-matrix_coturn_container_image_self_build_repo: "https://github.com/coturn/coturn"
-matrix_coturn_container_image_self_build_repo_version: "docker/{{ matrix_coturn_version }}"
-matrix_coturn_container_image_self_build_repo_dockerfile_path: "docker/coturn/alpine/Dockerfile"
-
-# renovate: datasource=docker depName=coturn/coturn versioning=loose
-matrix_coturn_version: 4.8.0
-matrix_coturn_docker_image: "{{ matrix_coturn_docker_image_registry_prefix }}coturn/coturn:{{ matrix_coturn_version }}-alpine"
-matrix_coturn_docker_image_registry_prefix: "{{ 'localhost/' if matrix_coturn_container_image_self_build else matrix_coturn_docker_image_registry_prefix_upstream }}"
-matrix_coturn_docker_image_registry_prefix_upstream: "{{ matrix_coturn_docker_image_registry_prefix_upstream_default }}"
-matrix_coturn_docker_image_registry_prefix_upstream_default: docker.io/
-matrix_coturn_docker_image_force_pull: "{{ matrix_coturn_docker_image.endswith(':latest') }}"
-
-# The Docker network that coturn would be put into.
-#
-# Because coturn relays traffic to unvalidated IP addresses,
-# using a dedicated network, isolated from other Docker (and local) services is preferable.
-#
-# Setting up deny/allow rules with `matrix_coturn_allowed_peer_ips`/`matrix_coturn_denied_peer_ips` is also
-# possible for achieving such isolation, but is more complicated due to the dynamic nature of Docker networking.
-#
-# Setting `matrix_coturn_container_network` to 'host' will run the container with host networking,
-# which will drastically improve performance when thousands of ports are opened due to Docker not having to set up forwarding rules for each port.
-# Running with host networking can be dangerous, as it potentially exposes your local network and its services to coturn peers.
-# Regardless of the networking mode, we apply a deny list which via `matrix_coturn_denied_peer_ips`,
-# which hopefully prevents access to such private network ranges.
-# When running in host-networking mode, you need to adjust the firewall yourself, so that ports are opened.
-matrix_coturn_container_network: "matrix-coturn"
-
-matrix_coturn_container_additional_networks: "{{ matrix_coturn_container_additional_networks_auto + matrix_coturn_container_additional_networks_custom }}"
-matrix_coturn_container_additional_networks_auto: []
-matrix_coturn_container_additional_networks_custom: []
-
-matrix_coturn_base_path: "{{ matrix_base_data_path }}/coturn"
-matrix_coturn_docker_src_files_path: "{{ matrix_coturn_base_path }}/docker-src"
-matrix_coturn_config_path: "{{ matrix_coturn_base_path }}/turnserver.conf"
-
-# List of systemd services that matrix-coturn.service depends on
-matrix_coturn_systemd_required_services_list: "{{ matrix_coturn_systemd_required_services_list_default + matrix_coturn_systemd_required_services_list_auto + matrix_coturn_systemd_required_services_list_custom }}"
-matrix_coturn_systemd_required_services_list_default: "{{ [devture_systemd_docker_base_docker_service_name] if devture_systemd_docker_base_docker_service_name else [] }}"
-matrix_coturn_systemd_required_services_list_auto: []
-matrix_coturn_systemd_required_services_list_custom: []
-
-# A list of additional "volumes" to mount in the container.
-# This list gets populated dynamically at runtime. You can provide a different default value,
-# if you wish to mount your own files into the container.
-# Contains definition objects like this: `{"type": "bind", "src": "/outside", "dst": "/inside", "options": "readonly"}.
-# See the `--mount` documentation for the `docker run` command.
-matrix_coturn_container_additional_volumes: []
-
-# A list of extra arguments to pass to the container
-matrix_coturn_container_extra_arguments: []
-
-# Controls whether the coturn container exposes its plain STUN port (tcp/3478 in the container) over TCP.
-#
-# Takes an "<ip>:<port>" or "<port>" value (e.g. "127.0.0.1:3478"), or empty string to not expose.
-matrix_coturn_container_stun_plain_host_bind_port_tcp: "{{ '3478' if matrix_coturn_container_network != 'host' else '' }}"
-
-# Controls whether the coturn container exposes its plain STUN port (udp/3478 in the container) over UDP.
-#
-# Takes an "<ip>:<port>" or "<port>" value (e.g. "127.0.0.1:3478"), or empty string to not expose.
-#
-# Ideally, we'd like to set this to "" to avoid exposing this port and decrease the risk of DDoS amplification attacks.
-# See: https://stormwall.network/resources/blog/protect-against-ddos-based-on-stun-exploit
-# In practice, old Element clients only support talking to the STUN port over UDP, not TCP, so we need to keep this enabled for now.
-matrix_coturn_container_stun_plain_host_bind_port_udp: "{{ '3478' if matrix_coturn_container_network != 'host' else '' }}"
-
-# Controls whether the coturn container exposes its TLS STUN port (tcp/5349 in the container) over TCP.
-#
-# Takes an "<ip>:<port>" or "<port>" value (e.g. "127.0.0.1:5349"), or empty string to not expose.
-matrix_coturn_container_stun_tls_host_bind_port_tcp: "{{ '5349' if matrix_coturn_container_network != 'host' else '' }}"
-
-# Controls whether the coturn container exposes its TLS STUN port (udp/5349 in the container) over UDP.
-#
-# Takes an "<ip>:<port>" or "<port>" value (e.g. "127.0.0.1:5349"), or empty string to not expose.
-#
-# This is enabled by default, unlike `matrix_coturn_container_stun_plain_host_bind_port_udp`,
-# because the risk of DDoS amplification attacks is lower for TLS
-# due to the handshake requiring two-way authentication and being generally more expensive.
-matrix_coturn_container_stun_tls_host_bind_port_udp: "{{ '5349' if matrix_coturn_container_network != 'host' else '' }}"
-
-# Controls whether the coturn container exposes its TURN UDP port range and which interface to do it on.
-#
-# Takes an interface "<ip address>" (e.g. "127.0.0.1"), or empty string to listen on all interfaces.
-# Takes a null/none value (`~`) or 'none' (as a string) to prevent listening.
-#
-# The UDP port-range itself is specified using `matrix_coturn_turn_udp_min_port` and `matrix_coturn_turn_udp_max_port`.
-matrix_coturn_container_turn_range_listen_interface: "{{ '' if matrix_coturn_container_network != 'host' else 'none' }}"
-
-# UDP port-range to use for TURN
-matrix_coturn_turn_udp_min_port: 49152
-matrix_coturn_turn_udp_max_port: 49172
-
-# Controls the `realm` configuration option
-matrix_coturn_realm: "turn.{{ matrix_coturn_hostname }}"
-
-# Controls which authentication method to enable.
-#
-# lt-cred-mech likely provides better compatibility,
-# as described here: https://github.com/spantaleev/matrix-docker-ansible-deploy/issues/3191
-# but those claims are unverified.
-#
-# For now, we still default to `auth-secret` like we've always done.
-#
-# Known values: auth-secret, lt-cred-mech
-matrix_coturn_authentication_method: auth-secret
-
-# A shared secret used for authentication when `matrix_coturn_authentication_method` is `auth-secret`.
-# You can put any string here, but generating a strong one is preferred. You can create one with a command like `pwgen -s 64 1`.
-matrix_coturn_turn_static_auth_secret: ""
-
-# A username used authentication when `matrix_coturn_authentication_method` is `lt-cred-mech`.
-matrix_coturn_lt_cred_mech_username: ""
-# A password used authentication when `matrix_coturn_authentication_method` is `lt-cred-mech`.
-matrix_coturn_lt_cred_mech_password: ""
-
-# The external IP address of the machine where coturn is.
-# If do not define an IP address here or in `matrix_coturn_turn_external_ip_addresses`, auto-detection via an EchoIP service will be done.
-# See `matrix_coturn_turn_external_ip_address_auto_detection_enabled`
-matrix_coturn_turn_external_ip_address: ""
-matrix_coturn_turn_external_ip_addresses: "{{ [matrix_coturn_turn_external_ip_address] if matrix_coturn_turn_external_ip_address != '' else [] }}"
-
-# Controls whether external IP address auto-detection should be attempted.
-# We try to do this if there is no external IP address explicitly configured and if an EchoIP service URL is specified.
-# See matrix_coturn_turn_external_ip_address_auto_detection_echoip_service_url
-matrix_coturn_turn_external_ip_address_auto_detection_enabled: "{{ matrix_coturn_turn_external_ip_addresses | length == 0 and matrix_coturn_turn_external_ip_address_auto_detection_echoip_service_url != '' }}"
-
-# Specifies the address of the EchoIP service (https://github.com/mpolden/echoip) to use for detecting the external IP address.
-# By default, we use the official public instance.
-matrix_coturn_turn_external_ip_address_auto_detection_echoip_service_url: https://ifconfig.co/json
-
-# Controls whether SSL certificates will be validated when contacting the EchoIP service (matrix_coturn_turn_external_ip_address_auto_detection_echoip_service_url)
-matrix_coturn_turn_external_ip_address_auto_detection_echoip_validate_certs: true
-
-matrix_coturn_turn_external_ip_address_auto_detection_echoip_service_retries_count: "{{ devture_playbook_help_geturl_retries_count }}"
-matrix_coturn_turn_external_ip_address_auto_detection_echoip_service_retries_delay: "{{ devture_playbook_help_geturl_retries_delay }}"
-
-matrix_coturn_allowed_peer_ips: []
-
-# We block loopback interfaces and private networks by default to prevent private resources from being accessible.
-# This is especially important when coturn does not run within a container network (e.g. `matrix_coturn_container_network: host`).
-#
-# Learn more: https://www.rtcsec.com/article/cve-2020-26262-bypass-of-coturns-access-control-protection/
-#
-# If you're running coturn for local network peers, you may wish to override these rules.
-matrix_coturn_denied_peer_ips:
-  - 0.0.0.0-0.255.255.255
-  - 10.0.0.0-10.255.255.255
-  - 100.64.0.0-100.127.255.255
-  - 127.0.0.0-127.255.255.255
-  - 169.254.0.0-169.254.255.255
-  - 172.16.0.0-172.31.255.255
-  - 192.0.0.0-192.0.0.255
-  - 192.0.2.0-192.0.2.255
-  - 192.88.99.0-192.88.99.255
-  - 192.168.0.0-192.168.255.255
-  - 198.18.0.0-198.19.255.255
-  - 198.51.100.0-198.51.100.255
-  - 203.0.113.0-203.0.113.255
-  - 240.0.0.0-255.255.255.255
-  - ::1
-  - 64:ff9b::-64:ff9b::ffff:ffff
-  - ::ffff:0.0.0.0-::ffff:255.255.255.255
-  - 100::-100::ffff:ffff:ffff:ffff
-  - 2001::-2001:1ff:ffff:ffff:ffff:ffff:ffff:ffff
-  - 2002::-2002:ffff:ffff:ffff:ffff:ffff:ffff:ffff
-  - fc00::-fdff:ffff:ffff:ffff:ffff:ffff:ffff:ffff
-  - fe80::-febf:ffff:ffff:ffff:ffff:ffff:ffff:ffff
-
-matrix_coturn_user_quota: null
-matrix_coturn_total_quota: null
-
-# Controls whether `no-tcp-relay` is added to the configuration
-# Learn more here: https://github.com/coturn/coturn/blob/242eb78227f66442ba1573c00ec4552faae23eed/examples/etc/turnserver.conf#L419-L422
-matrix_coturn_no_tcp_relay_enabled: true
-
-# Controls whether `no-multicast-peers` is added to the configuration
-# Learn more here: https://github.com/coturn/coturn/blob/242eb78227f66442ba1573c00ec4552faae23eed/examples/etc/turnserver.conf#L629-L632
-matrix_coturn_no_multicast_peers_enabled: true
-
-# Controls whether `no-rfc5780` is added to the configuration
-# Learn more here: https://github.com/coturn/coturn/blob/242eb78227f66442ba1573c00ec4552faae23eed/examples/etc/turnserver.conf#L770-L781
-matrix_coturn_no_rfc5780_enabled: true
-
-# Controls whether `no-stun-backward-compatibility` is added to the configuration
-# Learn more here: https://github.com/coturn/coturn/blob/242eb78227f66442ba1573c00ec4552faae23eed/examples/etc/turnserver.conf#L783-L789
-matrix_coturn_no_stun_backward_compatibility_enabled: true
-
-# Controls whether `response-origin-only-with-rfc5780` is added to the configuration
-# Learn more here: https://github.com/coturn/coturn/blob/242eb78227f66442ba1573c00ec4552faae23eed/examples/etc/turnserver.conf#L791-L796
-matrix_coturn_response_origin_only_with_rfc5780_enabled: true
-
-# Additional configuration to be passed to turnserver.conf
-# Example:
-# matrix_coturn_additional_configuration: |
-#   simple-log
-#   aux-server=1.2.3.4
-#   relay-ip=4.3.2.1
-matrix_coturn_additional_configuration: ""
-
-# To enable TLS, you need to provide paths to certificates.
-# Paths defined in `matrix_coturn_tls_cert_path` and `matrix_coturn_tls_key_path` are in-container paths.
-# Files on the host can be mounted into the container using `matrix_coturn_container_additional_volumes`.
-matrix_coturn_tls_enabled: false
-matrix_coturn_tls_cert_path: ~
-matrix_coturn_tls_key_path: ~
-
-matrix_coturn_tls_v1_enabled: false
-matrix_coturn_tls_v1_1_enabled: false
-
-# systemd calendar configuration for the reload job
-# the actual job may run with a delay (see matrix_coturn_reload_schedule_randomized_delay_sec)
-matrix_coturn_reload_schedule: "*-*-* 06:30:00"
-# the delay with which the systemd timer may run in relation to the `matrix_coturn_reload_schedule` schedule
-matrix_coturn_reload_schedule_randomized_delay_sec: 1h

roles/custom/matrix-coturn/tasks/main.yml

@@ -1,26 +0,0 @@
-# SPDX-FileCopyrightText: 2019 - 2023 Slavi Pantaleev
-# SPDX-FileCopyrightText: 2019 Dan Arnfield
-# SPDX-FileCopyrightText: 2022 Marko Weltzer
-#
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
----
-
-- tags:
-    - setup-all
-    - setup-coturn
-    - install-all
-    - install-coturn
-  block:
-    - when: matrix_coturn_enabled | bool
-      ansible.builtin.include_tasks: "{{ role_path }}/tasks/validate_config.yml"
-
-    - when: matrix_coturn_enabled | bool
-      ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_install.yml"
-
-- tags:
-    - setup-all
-    - setup-coturn
-  block:
-    - when: not matrix_coturn_enabled | bool
-      ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_uninstall.yml"

roles/custom/matrix-coturn/tasks/setup_install.yml

@@ -1,146 +0,0 @@
-# SPDX-FileCopyrightText: 2018 - 2025 Slavi Pantaleev
-# SPDX-FileCopyrightText: 2019 - 2020 MDAD project contributors
-# SPDX-FileCopyrightText: 2019 Dan Arnfield
-# SPDX-FileCopyrightText: 2020 Béla Becker
-# SPDX-FileCopyrightText: 2020 Chris van Dijk
-# SPDX-FileCopyrightText: 2020 Horvath Gergely
-# SPDX-FileCopyrightText: 2022 Marko Weltzer
-# SPDX-FileCopyrightText: 2022 Nikita Chernyi
-# SPDX-FileCopyrightText: 2022 Sebastian Gumprich
-# SPDX-FileCopyrightText: 2024 - 2025 Suguru Hirahara
-# SPDX-FileCopyrightText: 2024 David Mehren
-#
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
----
-
-- when: matrix_coturn_turn_external_ip_address_auto_detection_enabled | bool
-  block:
-    - name: Fail if enabled, but EchoIP service URL unset
-      when: matrix_coturn_turn_external_ip_address_auto_detection_echoip_service_url == ''
-      ansible.builtin.fail:
-        msg: "To use the external IP address auto-detection feature, you need to set matrix_coturn_turn_external_ip_address_auto_detection_echoip_service_url"
-
-    # Note:
-    # `ansible.builtin.uri` does not provide a way to configure whether IPv4 or IPv6 is used.
-    # Luckily, the default instance we use does not define AAAA records for now, so it's always IPv4.
-    - name: Fetch IP address information from EchoIP service
-      ansible.builtin.uri:
-        url: "{{ matrix_coturn_turn_external_ip_address_auto_detection_echoip_service_url }}"
-        headers:
-          Content-Type: application/json
-        follow_redirects: none
-        validate_certs: "{{ matrix_coturn_turn_external_ip_address_auto_detection_echoip_validate_certs }}"
-      register: result_matrix_coturn_turn_external_ip_address_auto_detection_echoip_response
-      ignore_errors: true
-      check_mode: false
-      retries: "{{ matrix_coturn_turn_external_ip_address_auto_detection_echoip_service_retries_count }}"
-      delay: "{{ matrix_coturn_turn_external_ip_address_auto_detection_echoip_service_retries_delay }}"
-      until: not result_matrix_coturn_turn_external_ip_address_auto_detection_echoip_response.failed
-
-    - name: Fail if EchoIP service failed
-      when: "(result_matrix_coturn_turn_external_ip_address_auto_detection_echoip_response.failed or 'json' not in result_matrix_coturn_turn_external_ip_address_auto_detection_echoip_response)"
-      ansible.builtin.fail:
-        msg: "Failed contacting EchoIP service API at `{{ matrix_coturn_turn_external_ip_address_auto_detection_echoip_service_url }}` (controlled by `matrix_coturn_turn_external_ip_address_auto_detection_echoip_service_url`). Full error: {{ result_matrix_coturn_turn_external_ip_address_auto_detection_echoip_response }}"
-
-    - ansible.builtin.set_fact:
-        matrix_coturn_turn_external_ip_address: "{{ result_matrix_coturn_turn_external_ip_address_auto_detection_echoip_response.json.ip }}"
-
-- name: Ensure Matrix coturn path exists
-  ansible.builtin.file:
-    path: "{{ item.path }}"
-    state: directory
-    mode: 0750
-    owner: "{{ matrix_user_name }}"
-    group: "{{ matrix_group_name }}"
-  with_items:
-    - {path: "{{ matrix_coturn_docker_src_files_path }}", when: "{{ matrix_coturn_container_image_self_build }}"}
-  when: "item.when | bool"
-
-- name: Ensure coturn image is pulled
-  community.docker.docker_image:
-    name: "{{ matrix_coturn_docker_image }}"
-    source: "{{ 'pull' if ansible_version.major > 2 or ansible_version.minor > 7 else omit }}"
-    force_source: "{{ matrix_coturn_docker_image_force_pull if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}"
-    force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else matrix_coturn_docker_image_force_pull }}"
-  when: "not matrix_coturn_container_image_self_build | bool"
-  register: result
-  retries: "{{ devture_playbook_help_container_retries_count }}"
-  delay: "{{ devture_playbook_help_container_retries_delay }}"
-  until: result is not failed
-
-- when: "matrix_coturn_container_image_self_build | bool"
-  block:
-    - name: Ensure coturn repository is present on self-build
-      ansible.builtin.git:
-        repo: "{{ matrix_coturn_container_image_self_build_repo }}"
-        dest: "{{ matrix_coturn_docker_src_files_path }}"
-        version: "{{ matrix_coturn_container_image_self_build_repo_version }}"
-        force: "yes"
-      become: true
-      become_user: "{{ matrix_user_name }}"
-      register: matrix_coturn_git_pull_results
-
-    - name: Ensure coturn Docker image is built
-      community.docker.docker_image:
-        name: "{{ matrix_coturn_docker_image }}"
-        source: build
-        force_source: "{{ matrix_coturn_git_pull_results.changed if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}"
-        force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else matrix_coturn_git_pull_results.changed }}"
-        build:
-          dockerfile: "{{ matrix_coturn_container_image_self_build_repo_dockerfile_path }}"
-          path: "{{ matrix_coturn_docker_src_files_path }}"
-          pull: true
-
-- name: Ensure coturn configuration path exists
-  ansible.builtin.file:
-    path: "{{ matrix_coturn_base_path }}"
-    state: directory
-    mode: 0750
-    owner: "{{ matrix_user_name }}"
-    group: "{{ matrix_group_name }}"
-
-- name: Ensure turnserver.conf installed
-  ansible.builtin.template:
-    src: "{{ role_path }}/templates/turnserver.conf.j2"
-    dest: "{{ matrix_coturn_config_path }}"
-    mode: 0644
-    owner: "{{ matrix_user_name }}"
-    group: "{{ matrix_group_name }}"
-
-- name: Ensure coturn network is created in Docker
-  when: matrix_coturn_container_network not in ['', 'host']
-  community.docker.docker_network:
-    enable_ipv6: "{{ devture_systemd_docker_base_ipv6_enabled }}"
-    name: "{{ matrix_coturn_container_network }}"
-    driver: bridge
-    driver_options: "{{ devture_systemd_docker_base_container_networks_driver_options }}"
-
-- name: Ensure matrix-coturn.service installed
-  ansible.builtin.template:
-    src: "{{ role_path }}/templates/systemd/matrix-coturn.service.j2"
-    dest: "{{ devture_systemd_docker_base_systemd_path }}/matrix-coturn.service"
-    mode: 0644
-
-# This may be unnecessary when more long-lived certificates are used.
-# We optimize for the common use-case though (short-lived Let's Encrypt certificates).
-# Reloading doesn't hurt anyway, so there's no need to make this more flexible.
-- name: Ensure reloading systemd units installed, if necessary
-  ansible.builtin.template:
-    src: "{{ role_path }}/templates/systemd/{{ item }}.j2"
-    dest: "{{ devture_systemd_docker_base_systemd_path }}/{{ item }}"
-    mode: 0644
-  when: "matrix_coturn_tls_enabled | bool"
-  with_items:
-    - matrix-coturn-reload.service
-    - matrix-coturn-reload.timer
-
-# A similar task exists in `setup_uninstall.yml`
-- name: Ensure reloading systemd units uninstalled, if unnecessary
-  ansible.builtin.file:
-    path: "{{ item }}"
-    state: absent
-  when: "not matrix_coturn_tls_enabled | bool"
-  with_items:
-    - matrix-coturn-reload.service
-    - matrix-coturn-reload.timer

roles/custom/matrix-coturn/tasks/setup_uninstall.yml

@@ -1,43 +0,0 @@
-# SPDX-FileCopyrightText: 2021 - 2022 Slavi Pantaleev
-# SPDX-FileCopyrightText: 2022 Marko Weltzer
-#
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
----
-
-- name: Check existence of matrix-coturn service
-  ansible.builtin.stat:
-    path: "{{ devture_systemd_docker_base_systemd_path }}/matrix-coturn.service"
-  register: matrix_coturn_service_stat
-  when: "not matrix_coturn_enabled | bool"
-
-- when: matrix_coturn_service_stat.stat.exists | bool
-  block:
-    - name: Ensure matrix-coturn is stopped
-      ansible.builtin.service:
-        name: matrix-coturn
-        state: stopped
-        enabled: false
-        daemon_reload: true
-
-    - name: Ensure matrix-coturn-reload.timer is stopped
-      ansible.builtin.service:
-        name: matrix-coturn
-        state: stopped
-        enabled: false
-        daemon_reload: true
-      failed_when: false
-
-    - name: Ensure systemd units don't exist
-      ansible.builtin.file:
-        path: "{{ devture_systemd_docker_base_systemd_path }}/{{ item }}"
-        state: absent
-      with_items:
-        - matrix-coturn.service
-        - matrix-coturn-reload.service
-        - matrix-coturn-reload.timer
-
-    - name: Ensure Matrix coturn paths don't exist
-      ansible.builtin.file:
-        path: "{{ matrix_coturn_base_path }}"
-        state: absent

roles/custom/matrix-coturn/tasks/validate_config.yml

@@ -1,35 +0,0 @@
-# SPDX-FileCopyrightText: 2019 - 2025 Slavi Pantaleev
-# SPDX-FileCopyrightText: 2024 - 2025 Suguru Hirahara
-#
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
----
-
-- name: (Deprecation) Catch and report renamed coturn settings
-  ansible.builtin.fail:
-    msg: >-
-      Your configuration contains a variable, which now has a different name.
-      Please rename the variable (`{{ item.old }}` -> `{{ item.new }}`) on your configuration file (vars.yml).
-  when: "lookup('ansible.builtin.varnames', ('^' + item.old + '$'), wantlist=True) | length > 0"
-  with_items:
-    - {'old': 'matrix_coturn_docker_network', 'new': 'matrix_coturn_container_network'}
-    - {'old': 'matrix_coturn_container_stun_plain_host_bind_port', 'new': 'superseded by matrix_coturn_container_stun_plain_host_bind_port_tcp and matrix_coturn_container_stun_plain_host_bind_port_udp'}
-    - {'old': 'matrix_coturn_container_stun_tls_host_bind_port', 'new': 'superseded by matrix_coturn_container_stun_tls_host_bind_port_tcp and matrix_coturn_container_stun_tls_host_bind_port_udp'}
-    - {'old': 'matrix_coturn_container_image_name_prefix', 'new': 'matrix_coturn_docker_image_registry_prefix'}
-
-- name: Fail if matrix_coturn_authentication_method is invalid
-  ansible.builtin.fail:
-    msg: >-
-      Invalid authentication method specified in `matrix_coturn_authentication_method`
-  when: "matrix_coturn_authentication_method not in ['auth-secret', 'lt-cred-mech']"
-
-- name: Fail if required coturn settings not defined
-  ansible.builtin.fail:
-    msg: >-
-      You need to define a required configuration setting (`{{ item.name }}`).
-  when: "item.when | bool and lookup('vars', item.name, default='') | string | length == 0"
-  with_items:
-    - {'name': 'matrix_coturn_hostname', when: true}
-    - {'name': 'matrix_coturn_turn_static_auth_secret', when: "{{ matrix_coturn_authentication_method == 'auth-secret' }}"}
-    - {'name': 'matrix_coturn_lt_cred_mech_username', when: "{{ matrix_coturn_authentication_method == 'lt-cred-mech' }}"}
-    - {'name': 'matrix_coturn_lt_cred_mech_password', when: "{{ matrix_coturn_authentication_method == 'lt-cred-mech' }}"}

roles/custom/matrix-coturn/templates/systemd/matrix-coturn-reload.service.j2

@@ -1,12 +0,0 @@
-{#
-SPDX-FileCopyrightText: 2021 - 2022 Slavi Pantaleev
-
-SPDX-License-Identifier: AGPL-3.0-or-later
-#}
-
-[Unit]
-Description=Reloads matrix-coturn so that new SSL certificates can kick in
-
-[Service]
-Type=oneshot
-ExecStart={{ devture_systemd_docker_base_host_command_systemctl }} reload matrix-coturn.service

roles/custom/matrix-coturn/templates/systemd/matrix-coturn-reload.timer.j2

@@ -1,18 +0,0 @@
-{#
-SPDX-FileCopyrightText: 2021 - 2022 Slavi Pantaleev
-SPDX-FileCopyrightText: 2021 Hardy Erlinger
-SPDX-FileCopyrightText: 2025 Suguru Hirahara
-
-SPDX-License-Identifier: AGPL-3.0-or-later
-#}
-
-[Unit]
-Description=Reloads matrix-coturn periodically so that new SSL certificates can kick in
-
-[Timer]
-Unit=matrix-coturn-reload.service
-OnCalendar={{ matrix_coturn_reload_schedule }}
-RandomizedDelaySec={{ matrix_coturn_reload_schedule_randomized_delay_sec }}
-
-[Install]
-WantedBy=timers.target

roles/custom/matrix-coturn/templates/systemd/matrix-coturn.service.j2

@@ -1,70 +0,0 @@
-#jinja2: lstrip_blocks: True
-[Unit]
-Description=Matrix coturn server
-{% for service in matrix_coturn_systemd_required_services_list %}
-Requires={{ service }}
-After={{ service }}
-{% endfor %}
-DefaultDependencies=no
-
-[Service]
-Type=simple
-Environment="HOME={{ devture_systemd_docker_base_systemd_unit_home_path }}"
-ExecStartPre=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} stop -t {{ devture_systemd_docker_base_container_stop_grace_time_seconds }} matrix-coturn 2>/dev/null || true'
-ExecStartPre=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} rm matrix-coturn 2>/dev/null || true'
-
-ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} create \
-			--rm \
-			--name=matrix-coturn \
-			--log-driver=none \
-			--user={{ matrix_user_uid }}:{{ matrix_user_gid }} \
-			--cap-drop=ALL \
-			--cap-add=NET_BIND_SERVICE \
-			--entrypoint=turnserver \
-			--read-only \
-			--tmpfs=/var/tmp:rw,noexec,nosuid,size=100m \
-			--network={{ matrix_coturn_container_network }} \
-			{% if matrix_coturn_container_stun_plain_host_bind_port_tcp != '' %}
-			-p {{ matrix_coturn_container_stun_plain_host_bind_port_tcp }}:3478 \
-			{% endif %}
-			{% if matrix_coturn_container_stun_plain_host_bind_port_udp != '' %}
-			-p {{ matrix_coturn_container_stun_plain_host_bind_port_udp }}:3478/udp \
-			{% endif %}
-			{% if matrix_coturn_container_stun_tls_host_bind_port_tcp != '' %}
-			-p {{ matrix_coturn_container_stun_tls_host_bind_port_tcp }}:5349 \
-			{% endif %}
-			{% if matrix_coturn_container_stun_tls_host_bind_port_udp != '' %}
-			-p {{ matrix_coturn_container_stun_tls_host_bind_port_udp }}:5349/udp \
-			{% endif %}
-			{% if matrix_coturn_container_turn_range_listen_interface is not in [none, 'none'] %}
-			-p {{ matrix_coturn_container_turn_range_listen_interface }}{{ ':' if matrix_coturn_container_turn_range_listen_interface else '' }}{{ matrix_coturn_turn_udp_min_port }}-{{ matrix_coturn_turn_udp_max_port }}:{{ matrix_coturn_turn_udp_min_port }}-{{ matrix_coturn_turn_udp_max_port }}/udp \
-			{% endif %}
-			--mount type=bind,src={{ matrix_coturn_config_path }},dst=/turnserver.conf,ro \
-			{% for volume in matrix_coturn_container_additional_volumes %}
-			--mount type={{ volume.type | default('bind' if '/' in volume.src else 'volume') }},src={{ volume.src }},dst={{ volume.dst }}{{ (',' + volume.options) if volume.options else '' }} \
-			{% endfor %}
-			{% for arg in matrix_coturn_container_extra_arguments %}
-			{{ arg }} \
-			{% endfor %}
-			{{ matrix_coturn_docker_image }} \
-			-c /turnserver.conf
-
-{% for network in matrix_coturn_container_additional_networks %}
-ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} network connect {{ network }} matrix-coturn
-{% endfor %}
-
-ExecStart={{ devture_systemd_docker_base_host_command_docker }} start --attach matrix-coturn
-
-ExecStop=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} stop -t {{ devture_systemd_docker_base_container_stop_grace_time_seconds }} matrix-coturn 2>/dev/null || true'
-ExecStop=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} rm matrix-coturn 2>/dev/null || true'
-
-# This only reloads certificates (not other configuration).
-# See: https://github.com/coturn/coturn/pull/236
-ExecReload={{ devture_systemd_docker_base_host_command_docker }} exec matrix-coturn kill -USR2 1
-
-Restart=always
-RestartSec=30
-SyslogIdentifier=matrix-coturn
-
-[Install]
-WantedBy=multi-user.target

roles/custom/matrix-coturn/templates/systemd/matrix-coturn.service.j2.license

@@ -1,8 +0,0 @@
-SPDX-FileCopyrightText: 2018 - 2025 Slavi Pantaleev
-SPDX-FileCopyrightText: 2019 Hugues De Keyzer
-SPDX-FileCopyrightText: 2019 Sylvia van Os
-SPDX-FileCopyrightText: 2020 Chris van Dijk
-SPDX-FileCopyrightText: 2021 Dan Arnfield
-SPDX-FileCopyrightText: 2024 Suguru Hirahara
-
-SPDX-License-Identifier: AGPL-3.0-or-later

roles/custom/matrix-coturn/templates/turnserver.conf.j2

@@ -1,78 +0,0 @@
-#jinja2: lstrip_blocks: True
-
-{% if matrix_coturn_authentication_method == 'auth-secret' %}
-use-auth-secret
-static-auth-secret={{ matrix_coturn_turn_static_auth_secret }}
-userdb=/var/tmp/turnserver.db
-{% endif %}
-
-{% if matrix_coturn_authentication_method == 'lt-cred-mech' %}
-lt-cred-mech
-user={{ matrix_coturn_lt_cred_mech_username }}:{{ matrix_coturn_lt_cred_mech_password }}
-{% endif %}
-
-realm={{ matrix_coturn_realm }}
-
-min-port={{ matrix_coturn_turn_udp_min_port }}
-max-port={{ matrix_coturn_turn_udp_max_port }}
-
-{% for ip in matrix_coturn_turn_external_ip_addresses %}
-external-ip={{ ip }}
-{% endfor %}
-
-log-file=stdout
-pidfile=/var/tmp/turnserver.pid
-
-no-cli
-
-{% if matrix_coturn_tls_enabled %}
-cert={{ matrix_coturn_tls_cert_path }}
-pkey={{ matrix_coturn_tls_key_path }}
-{% if not matrix_coturn_tls_v1_enabled %}
-no-tlsv1
-{% endif %}
-{% if not matrix_coturn_tls_v1_1_enabled %}
-no-tlsv1_1
-{% endif %}
-{% else %}
-no-tls
-no-dtls
-{% endif %}
-
-prod
-
-{% if matrix_coturn_no_tcp_relay_enabled %}
-no-tcp-relay
-{% endif %}
-
-{% if matrix_coturn_no_rfc5780_enabled %}
-no-rfc5780
-{% endif %}
-
-{% if matrix_coturn_no_stun_backward_compatibility_enabled %}
-no-stun-backward-compatibility
-{% endif %}
-
-{% if matrix_coturn_response_origin_only_with_rfc5780_enabled %}
-response-origin-only-with-rfc5780
-{% endif %}
-
-{% if matrix_coturn_user_quota != None %}
-user-quota={{ matrix_coturn_user_quota }}
-{% endif %}
-{% if matrix_coturn_total_quota != None %}
-total-quota={{ matrix_coturn_total_quota }}
-{% endif %}
-
-{% if matrix_coturn_no_multicast_peers_enabled %}
-no-multicast-peers
-{% endif %}
-
-{% for ip_range in matrix_coturn_denied_peer_ips %}
-denied-peer-ip={{ ip_range }}
-{% endfor %}
-{% for ip_range in matrix_coturn_allowed_peer_ips %}
-allowed-peer-ip={{ ip_range }}
-{% endfor %}
-
-{{ matrix_coturn_additional_configuration }}

roles/custom/matrix-coturn/templates/turnserver.conf.j2.license

@@ -1,6 +0,0 @@
-SPDX-FileCopyrightText: 2018 - 2024 Slavi Pantaleev
-SPDX-FileCopyrightText: 2019 Hugues De Keyzer
-SPDX-FileCopyrightText: 2019 Stuart Mumford
-SPDX-FileCopyrightText: 2021 - 2022 MDAD project contributors
-
-SPDX-License-Identifier: AGPL-3.0-or-later

roles/custom/matrix-coturn/vars/main.yml

@@ -1,21 +0,0 @@
-# SPDX-FileCopyrightText: 2025 Slavi Pantaleev
-#
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
----
-
-matrix_coturn_turn_uris: |-
-  {{
-    ([
-      'turns:' + matrix_coturn_hostname + '?transport=udp',
-      'turns:' + matrix_coturn_hostname + '?transport=tcp',
-    ] if matrix_coturn_tls_enabled else [])
-    +
-    ([
-      'turn:' + matrix_coturn_hostname + '?transport=udp',
-    ] if (matrix_coturn_container_stun_plain_host_bind_port_udp != '' or matrix_coturn_container_network == 'host')  else [])
-    +
-    ([
-      'turn:' + matrix_coturn_hostname + '?transport=tcp',
-    ] if (matrix_coturn_container_stun_plain_host_bind_port_tcp != '' or matrix_coturn_container_network == 'host')  else [])
-  }}

roles/custom/matrix-media-repo/defaults/main.yml

@@ -414,8 +414,9 @@ matrix_media_repo_shared_secret_auth_token: "PutSomeRandomSecureValueHere"
 # thumbnails and other misc data is also stored in these places. The media repo, when looking
 # for a datastore to use, will always use the smallest datastore first.
 
-# ID for the file datastore (cannot change). Alphanumeric recommended.
-matrix_media_repo_datastore_file_id: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'filestore.db', rounds=655555) | to_uuid }}"
+# ID for the file datastore. Any unique alphanumeric string (e.g. generated via `pwgen -s 64 1`).
+# This value CANNOT be changed after media has been stored — matrix-media-repo ties media to this ID.
+matrix_media_repo_datastore_file_id: ""
 
 # Datastores can be split into many areas when handling uploads. Media is still de-duplicated
 # across all datastores (local content which duplicates remote content will re-use the remote
@@ -434,8 +435,9 @@ matrix_media_repo_datastore_file_for_kinds: ["thumbnails", "remote_media", "loca
 # Path to datastore, relative to matrix-media-repo directory root
 matrix_media_repo_datastore_opts_path: "/data/media"
 
-# ID for the s3 datastore (cannot change). Alphanumeric recommended.
-matrix_media_repo_datastore_s3_id: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 's3store.db', rounds=655555) | to_uuid }}"
+# ID for the S3 datastore. Any unique alphanumeric string (e.g. generated via `pwgen -s 64 1`).
+# This value CANNOT be changed after media has been stored — matrix-media-repo ties media to this ID.
+matrix_media_repo_datastore_s3_id: ""
 
 # Datastores can be split into many areas when handling uploads. Media is still de-duplicated
 # across all datastores (local content which duplicates remote content will re-use the remote

roles/custom/matrix-media-repo/tasks/validate_config.yml

@@ -15,6 +15,8 @@
     - {'name': 'matrix_media_repo_database_hostname', when: true}
     - {'name': 'matrix_media_repo_container_labels_traefik_internal_media_entrypoints', when: "{{ matrix_media_repo_container_labels_traefik_internal_media_enabled }}"}
     - {'name': 'matrix_media_repo_container_labels_traefik_internal_matrix_client_media_entrypoints', when: "{{ matrix_media_repo_container_labels_traefik_internal_matrix_client_media_enabled }}"}
+    - {'name': 'matrix_media_repo_datastore_file_id', when: "{{ (matrix_media_repo_datastore_file_for_kinds | length) > 0 }}"}
+    - {'name': 'matrix_media_repo_datastore_s3_id', when: "{{ (matrix_media_repo_datastore_s3_for_kinds | length) > 0 }}"}
 
 - name: (Deprecation) Catch and report renamed matrix-media-repo settings
   ansible.builtin.fail:

roles/custom/matrix-synapse/defaults/main.yml

@@ -16,7 +16,7 @@ matrix_synapse_enabled: true
 matrix_synapse_github_org_and_repo: element-hq/synapse
 
 # renovate: datasource=docker depName=ghcr.io/element-hq/synapse
-matrix_synapse_version: v1.146.0
+matrix_synapse_version: v1.147.0
 
 matrix_synapse_username: ''
 matrix_synapse_uid: ''
@@ -322,6 +322,22 @@ matrix_synapse_container_labels_public_metrics_middleware_basic_auth_users: ''
 #   another.label="here"
 matrix_synapse_container_labels_additional_labels: ''
 
+# Specifies how often the container health check will run.
+#
+# The Synapse container image ships with a default HEALTHCHECK (curl to /health)
+# with an interval of 15s, timeout of 5s, and start period of 5s.
+#
+# For Traefik-based setups, it's important that the interval is short,
+# because the interval value also specifies the "initial wait time".
+# This is a Docker (moby) bug: https://github.com/moby/moby/issues/33410
+# Without a successful healthcheck, Traefik will not register the service for reverse-proxying.
+# A shorter interval also lets our systemd ExecStartPost health check
+# (see matrix_synapse_systemd_healthcheck_enabled) detect readiness faster at startup.
+#
+# For non-Traefik setups, we use the default healthcheck interval (15s) to decrease overhead.
+matrix_synapse_container_health_interval_seconds: "{{ 5 if matrix_synapse_container_labels_traefik_enabled else 15 }}"
+matrix_synapse_container_health_interval: "{{ matrix_synapse_container_health_interval_seconds }}s"
+
 # A list of extra arguments to pass to the container
 # Also see `matrix_synapse_container_arguments`
 matrix_synapse_container_extra_arguments: []
@@ -358,14 +374,37 @@ matrix_synapse_goofys_systemd_required_services_list_default: "{{ [devture_syste
 matrix_synapse_goofys_systemd_required_services_list_auto: []
 matrix_synapse_goofys_systemd_required_services_list_custom: []
 
-# Controls how long to sleep for after starting the matrix-synapse container.
-#
-# Delaying, so that the homeserver can manage to fully start and various services
-# that depend on it (`matrix_synapse_systemd_required_services_list` and `matrix_synapse_systemd_wanted_services_list`)
-# may only start after the homeserver is up and running.
-#
-# This can be set to 0 to remove the delay.
-matrix_synapse_systemd_service_post_start_delay_seconds: 10
+# Controls the post-start health check in the systemd service.
+# When enabled, ExecStartPost polls Docker's container health status via `docker inspect`,
+# keeping the service in "activating (start-post)" state until Synapse is ready.
+# Services with After=matrix-synapse.service will properly wait.
+# This relies on the container image's built-in HEALTHCHECK (curl to /health),
+# with the interval controlled by matrix_synapse_container_health_interval.
+matrix_synapse_systemd_healthcheck_enabled: true
+matrix_synapse_systemd_healthcheck_max_retries: 60
+matrix_synapse_systemd_healthcheck_interval_seconds: 1
+
+# The command used for the health check in ExecStartPost.
+# Polls `docker inspect` for the container's health status until it reports "healthy".
+matrix_synapse_systemd_healthcheck_command: >-
+  {{ devture_systemd_docker_base_host_command_sh }} -c
+  'for i in $(seq 1 {{ matrix_synapse_systemd_healthcheck_max_retries }}); do
+  echo "[Attempt $i/{{ matrix_synapse_systemd_healthcheck_max_retries }}] Synapse systemd health check: checking container health status..";
+  status=$( {{ devture_systemd_docker_base_host_command_docker }} inspect --format={{ '"{{' }}.State.Health.Status{{ '}}"' }} matrix-synapse 2>/dev/null);
+  if [ "$status" = "healthy" ]; then echo "[Attempt $i/{{ matrix_synapse_systemd_healthcheck_max_retries }}] Synapse systemd health check: passed" && exit 0; fi;
+  echo "[Attempt $i/{{ matrix_synapse_systemd_healthcheck_max_retries }}] Synapse systemd health check: not ready yet (status: $status), retrying in {{ matrix_synapse_systemd_healthcheck_interval_seconds }}s..";
+  sleep {{ matrix_synapse_systemd_healthcheck_interval_seconds }};
+  done; echo "[Attempt $i/{{ matrix_synapse_systemd_healthcheck_max_retries }}] Synapse systemd health check: failed after {{ matrix_synapse_systemd_healthcheck_max_retries }} attempts"; exit 1'
+
+# Controls how long to sleep for after the systemd health check passes.
+# Even after Synapse is healthy, the reverse proxy (e.g. Traefik) needs time to discover
+# the container and register its routes. Traefik waits `providers.providersThrottleDuration`
+# (see https://doc.traefik.io/traefik/v3.3/providers/overview/#providersprovidersthrottleduration)
+# before applying new configuration from Docker events.
+# Without this delay, services depending on Synapse may encounter 404 errors
+# when connecting through the reverse proxy.
+# This value is meant to be wired to the Traefik throttle duration by the playbook's group vars.
+matrix_synapse_systemd_service_post_start_delay_seconds: 0
 
 matrix_synapse_in_container_python_packages_path: "/usr/local/lib/python3.13/site-packages"
 
@@ -1503,6 +1542,14 @@ matrix_synapse_ext_synapse_s3_storage_provider_update_db_day_count: 0
 # This is a systemd timer OnCalendar definition. Learn more here: https://man.archlinux.org/man/systemd.time.7#CALENDAR_EVENTS
 matrix_synapse_ext_synapse_s3_storage_provider_periodic_migration_schedule: '*-*-* 05:00:00'
 
+# List of systemd services that matrix-synapse-s3-storage-provider-migrate.service requires.
+# We only depend on matrix-synapse.service here, because its own dependencies (Postgres, Docker, etc.)
+# are transitively resolved by systemd.
+matrix_synapse_ext_synapse_s3_storage_provider_migrate_systemd_required_services_list: ['matrix-synapse.service']
+
+# List of systemd services that matrix-synapse-s3-storage-provider-migrate.service wants
+matrix_synapse_ext_synapse_s3_storage_provider_migrate_systemd_wanted_services_list: []
+
 # Synapse module to automatically accept room invites.
 #
 # Since Synapse v1.109.0 (https://github.com/element-hq/synapse/pull/17147),

roles/custom/matrix-synapse/templates/synapse/ext/s3-storage-provider/systemd/matrix-synapse-s3-storage-provider-migrate.service.j2

@@ -1,5 +1,14 @@
+#jinja2: lstrip_blocks: True
 [Unit]
 Description=Migrates locally-stored Synapse media store files to S3
+{% for service in matrix_synapse_ext_synapse_s3_storage_provider_migrate_systemd_required_services_list %}
+Requires={{ service }}
+After={{ service }}
+{% endfor %}
+{% for service in matrix_synapse_ext_synapse_s3_storage_provider_migrate_systemd_wanted_services_list %}
+Wants={{ service }}
+{% endfor %}
+DefaultDependencies=no
 
 [Service]
 Type=oneshot

roles/custom/matrix-synapse/templates/synapse/systemd/matrix-synapse.service.j2

@@ -33,6 +33,7 @@ ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} create \
 			--read-only \
 			--tmpfs=/tmp:rw,noexec,nosuid,size={{ matrix_synapse_tmp_directory_size_mb }}m \
 			--network={{ matrix_synapse_container_network }} \
+			--health-interval={{ matrix_synapse_container_health_interval }} \
 			{% if matrix_synapse_container_client_api_host_bind_port %}
 			-p {{ matrix_synapse_container_client_api_host_bind_port }}:{{ matrix_synapse_container_client_api_port }} \
 			{% endif %}
@@ -69,8 +70,12 @@ ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} network conne
 
 ExecStart={{ devture_systemd_docker_base_host_command_docker }} start --attach matrix-synapse
 
-{% if matrix_synapse_systemd_service_post_start_delay_seconds > 0 %}
-ExecStartPost=-{{ matrix_host_command_sleep }} {{ matrix_synapse_systemd_service_post_start_delay_seconds }}
+{% if matrix_synapse_systemd_healthcheck_enabled %}
+ExecStartPost={{ matrix_synapse_systemd_healthcheck_command }}
+{% endif %}
+
+{% if matrix_synapse_systemd_service_post_start_delay_seconds | int > 0 %}
+ExecStartPost=-{{ matrix_host_command_sleep }} {{ matrix_synapse_systemd_service_post_start_delay_seconds }}
 {% endif %}
 
 ExecStop=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} stop -t {{ devture_systemd_docker_base_container_stop_grace_time_seconds }} matrix-synapse 2>/dev/null || true'

roles/custom/matrix-user-creator/tasks/util/ensure_user_registered_conduwuit.yml

@@ -1,10 +0,0 @@
-# SPDX-FileCopyrightText: 2025 Slavi Pantaleev
-# SPDX-FileCopyrightText: 2025 Suguru Hirahara
-#
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
----
-
-- name: Ensure conduwuit user registered - {{ user.username | quote }}
-  ansible.builtin.debug:
-    msg: "Not registering user. To register conduwuit users, message the conduwuit bot"

roles/custom/matrix-user-creator/tasks/util/ensure_user_registered_synapse.yml

@@ -4,9 +4,9 @@
 
 ---
 
-- name: Ensure Synapse user registered - {{ user.username | quote }}
-  ansible.builtin.command:
-    cmd: |-
+- name: Build Synapse user registration command - {{ user.username | quote }}
+  ansible.builtin.set_fact:
+    matrix_synapse_register_user_command: |-
       {{ devture_systemd_docker_base_host_command_docker }} exec matrix-synapse
       register_new_matrix_user
       -u  {{ user.username | quote }}
@@ -21,6 +21,34 @@
         {% endif %}
       {% endif %}
       http://localhost:{{ matrix_synapse_container_client_api_port }}
+
+- name: Ensure Synapse user registered - {{ user.username | quote }}
+  ansible.builtin.command:
+    cmd: "{{ matrix_synapse_register_user_command }}"
   register: matrix_synapse_register_user_result
   changed_when: matrix_synapse_register_user_result.rc == 0 and 'User ID already taken' not in matrix_synapse_register_user_result.stdout
-  failed_when: matrix_synapse_register_user_result.rc != 0 and 'User ID already taken' not in matrix_synapse_register_user_result.stdout
+  failed_when: >-
+    matrix_synapse_register_user_result.rc != 0
+    and 'User ID already taken' not in matrix_synapse_register_user_result.stdout
+    and 'HMAC incorrect' not in matrix_synapse_register_user_result.stdout
+    and 'Connection refused' not in matrix_synapse_register_user_result.stderr | default('')
+
+- when: >-
+    'HMAC incorrect' in matrix_synapse_register_user_result.stdout | default('')
+    or 'Connection refused' in matrix_synapse_register_user_result.stderr | default('')
+  block:
+    - name: Restart Synapse due to registration failure (likely a registration_shared_secret or DB credentials change)
+      ansible.builtin.service:
+        name: "matrix-synapse.service"
+        state: restarted
+
+    - name: Wait for Synapse to start after restart
+      ansible.builtin.pause:
+        seconds: "{{ matrix_user_creator_homeserver_start_wait_time_seconds }}"
+
+    - name: Retry Synapse user registration - {{ user.username | quote }}
+      ansible.builtin.command:
+        cmd: "{{ matrix_synapse_register_user_command }}"
+      register: matrix_synapse_register_user_result
+      changed_when: matrix_synapse_register_user_result.rc == 0 and 'User ID already taken' not in matrix_synapse_register_user_result.stdout
+      failed_when: matrix_synapse_register_user_result.rc != 0 and 'User ID already taken' not in matrix_synapse_register_user_result.stdout

roles/custom/matrix_playbook_migration/tasks/validate_config.yml

@@ -80,11 +80,21 @@
     - {'old': 'cinny_docker_image_registry_prefix_upstream', 'new': 'cinny_container_image_registry_prefix_upstream'}
     - {'old': 'cinny_docker_image_registry_prefix_upstream_default', 'new': 'cinny_container_image_registry_prefix_upstream_default'}
 
+    - {'old': 'coturn_docker_image', 'new': 'coturn_container_image'}
+    - {'old': 'coturn_docker_image_registry_prefix', 'new': 'coturn_container_image_registry_prefix'}
+    - {'old': 'coturn_docker_image_registry_prefix_upstream', 'new': 'coturn_container_image_registry_prefix_upstream'}
+    - {'old': 'coturn_docker_image_registry_prefix_upstream_default', 'new': 'coturn_container_image_registry_prefix_upstream_default'}
+
     - {'old': 'ddclient_docker_image', 'new': 'ddclient_container_image'}
     - {'old': 'ddclient_docker_image_registry_prefix', 'new': 'ddclient_container_image_registry_prefix'}
     - {'old': 'ddclient_docker_image_registry_prefix_upstream', 'new': 'ddclient_container_image_registry_prefix_upstream'}
     - {'old': 'ddclient_docker_image_registry_prefix_upstream_default', 'new': 'ddclient_container_image_registry_prefix_upstream_default'}
 
+    - {'old': 'hydrogen_docker_image', 'new': 'hydrogen_container_image'}
+    - {'old': 'hydrogen_docker_image_registry_prefix', 'new': 'hydrogen_container_image_registry_prefix'}
+    - {'old': 'hydrogen_docker_image_registry_prefix_upstream', 'new': 'hydrogen_container_image_registry_prefix_upstream'}
+    - {'old': 'hydrogen_docker_image_registry_prefix_upstream_default', 'new': 'hydrogen_container_image_registry_prefix_upstream_default'}
+
 - name: (Deprecation) Catch and report matrix_postgres variables
   ansible.builtin.fail:
     msg: |-
@@ -595,6 +605,44 @@
       The following variables in your configuration need to be renamed: {{ lookup('ansible.builtin.varnames', '^matrix_client_cinny_.+', wantlist=True) | join(', ') }}
   when: "lookup('ansible.builtin.varnames', '^matrix_client_cinny_.+', wantlist=True) | length > 0"
 
+- name: (Deprecation) Catch and report matrix-client-hydrogen variables
+  ansible.builtin.fail:
+    msg: |-
+      The matrix-client-hydrogen role in the playbook now lives under the MASH organization (https://github.com/mother-of-all-self-hosting/ansible-role-hydrogen).
+      The new role is pretty much the same, but uses differently named variables.
+
+      Please rename all `matrix_client_hydrogen_`-prefixed variables (`matrix_client_hydrogen_*` -> `hydrogen_*`) on your configuration file (vars.yml).
+
+      After renaming them, please do not forget to fetch the Ansible role. See docs/maintenance-upgrading-services.md for details about how to do so.
+
+      The following variables in your configuration need to be renamed: {{ lookup('ansible.builtin.varnames', '^matrix_client_hydrogen_.+', wantlist=True) | join(', ') }}
+  when: "lookup('ansible.builtin.varnames', '^matrix_client_hydrogen_.+', wantlist=True) | length > 0"
+
+- name: (Deprecation) Catch and report matrix-coturn variables
+  ansible.builtin.fail:
+    msg: |-
+      The matrix-coturn role in the playbook now lives under the MASH organization (https://github.com/mother-of-all-self-hosting/ansible-role-coturn).
+      The new role is pretty much the same, but uses differently named variables.
+
+      Please rename all `matrix_coturn_`-prefixed variables (`matrix_coturn_*` -> `coturn_*`) on your configuration file (vars.yml).
+
+      After renaming them, please do not forget to fetch the Ansible role. See docs/maintenance-upgrading-services.md for details about how to do so.
+
+      The following variables in your configuration need to be renamed: {{ lookup('ansible.builtin.varnames', '^matrix_coturn_.+', wantlist=True) | join(', ') }}
+  when: "lookup('ansible.builtin.varnames', '^matrix_coturn_.+', wantlist=True) | length > 0"
+
+- name: (Deprecation) Catch and report matrix-conduwuit variables
+  ansible.builtin.fail:
+    msg: |-
+      matrix-conduwuit was completely removed from the playbook in February 2026.
+
+      Please remove all `matrix_conduwuit*` variables from your configuration file (vars.yml).
+
+      You may wish to migrate to Continuwuity, a drop-in replacement for conduwuit. See `docs/configuring-playbook-continuwuity.md` for more information.
+
+      The following variables in your configuration need to be removed: {{ lookup('ansible.builtin.varnames', '^matrix_conduwuit.+', wantlist=True) | join(', ') }}
+  when: "lookup('ansible.builtin.varnames', '^matrix_conduwuit.+', wantlist=True) | length > 0"
+
 - name: (Deprecation) Catch and report matrix-dynamic-dns variables
   ansible.builtin.fail:
     msg: |-

setup.yml

@@ -79,7 +79,6 @@
     - custom/matrix-bridge-steam
     - custom/matrix-bridge-heisenbridge
     - custom/matrix-bridge-hookshot
-    - custom/matrix-bridge-zulip
     - custom/matrix-bot-matrix-reminder-bot
     - custom/matrix-bot-matrix-registration-bot
     - custom/matrix-bot-maubot
@@ -98,7 +97,6 @@
     - custom/matrix-synapse-reverse-proxy-companion
     - custom/matrix-dendrite
     - custom/matrix-conduit
-    - custom/matrix-conduwuit
     - custom/matrix-continuwuity
     - custom/matrix-synapse-admin
     - custom/matrix-synapse-usage-exporter
@@ -110,7 +108,7 @@
     - custom/matrix-prometheus-services-connect
     - custom/matrix-registration
     - custom/matrix-client-element
-    - custom/matrix-client-hydrogen
+    - galaxy/hydrogen
     - galaxy/cinny
     - custom/matrix-client-schildichat
     - custom/matrix-client-fluffychat
@@ -122,7 +120,7 @@
     - custom/matrix-sygnal
     - galaxy/ntfy
     - custom/matrix-static-files
-    - custom/matrix-coturn
+    - galaxy/coturn
     - custom/matrix-media-repo
     - custom/matrix-pantalaimon