Remove shell configuration for better compatibility

Fixes https://github.com/spantaleev/matrix-docker-ansible-deploy/issues/2604

.editorconfig

@@ -19,6 +19,10 @@ trim_trailing_whitespace = true
 indent_style = space
 indent_size = 2
 
+[group_vars/matrix_servers]
+indent_style = space
+indent_size = 2
+
 # Markdown Files
 #
 # Two spaces at the end of a line in Markdown mean "new line",

CHANGELOG.md

@@ -1,11 +1,214 @@
+# 2023-03-22
+
+## ntfy Web App is disabled by default
+
+ntfy provides a web app, which is now disabled by default, because it may be unknown to and unused by most users of this playbook. You can enable it by setting `ntfy_web_root: "app"` (see [ntfy documentation](docs/configuring-playbook-ntfy.md)).
+
+This change was already applied a while before this entry, but as some users were reporting the missing web app, this entry was added (see [#2529](https://github.com/spantaleev/matrix-docker-ansible-deploy/issues/2529)).
+
+
+# 2023-03-21
+
+## The matrix-prometheus role lives independently now
+
+**TLDR**: the `matrix-prometheus` role is now included from the [ansible-role-prometheus](https://github.com/mother-of-all-self-hosting/ansible-role-prometheus) repository, part of the [MASH playbook](https://github.com/mother-of-all-self-hosting/mash-playbook). Some variables have been renamed. All functionality remains intact.
+
+The `matrix-prometheus` role has been relocated in its own repository, part of the [MASH playbook](https://github.com/mother-of-all-self-hosting/mash-playbook) project - an Ansible playbook for self-hosting [a growing list of FOSS software](https://github.com/mother-of-all-self-hosting/mash-playbook/blob/main/docs/supported-services.md). If hosting a Prometheus stack on the Matrix server itself did not stand right with you or you always wanted to host most stuff, you can now use this new playbook to do so.
+
+Extracting the Prometheus role out of this Matrix playbook required huge internal refactoring to the way the Prometheus configuration (scraping jobs) is generated. If you notice any breakage after upgrading, let us know.
+
+You need to **update you roles** (`just roles` or `make roles`) regardless of whether you're using Prometheus or not.
+
+If you're making use of Prometheus via this playbook, you will need to update variable references in your `vars.yml` file:
+
+  - `matrix_prometheus_docker_image_` -> `matrix_prometheus_container_image_`
+  - `matrix_prometheus_` -> `prometheus_`
+  - some other internal variables have changed, but the playbook will tell you about them
+
+
+# 2023-03-12
+
+## synapse-auto-compressor support
+
+Thanks to [Aine](https://gitlab.com/etke.cc) of [etke.cc](https://etke.cc/), the playbook can now set up [rust-synapse-compress-state](https://github.com/matrix-org/rust-synapse-compress-state)'s `synapse_auto_compressor` tool to run periodically.
+
+If enabled, `synapse_auto_compressor` runs on a schedule and compresses your Synapse database's `state_groups` table. It was possible to run `rust-synapse-compress-state` manually via the playbook even before - see [Compressing state with rust-synapse-compress-state](docs/maintenance-synapse.md#compressing-state-with-rust-synapse-compress-state). However, using `synapse_auto_compressor` is better, because:
+
+- it runs on a more up-to-date version of `rust-synapse-compress-state`
+- it's a set-it-and-forget-it tool that you can enable and never have to deal with manual compression anymore
+
+This tool needs to be enabled manually, for now. In the future, we're considering enabling it by default for all Synapse installations.
+
+See our [Setting up synapse-auto-compressor](docs/configuring-playbook-synapse-auto-compressor.md) documentation to get started.
+
+
+# 2023-03-07
+
+## Sliding Sync Proxy (Element X) support
+
+Thanks to [Benjamin Kampmann](https://github.com/gnunicorn) for [getting it started](https://github.com/spantaleev/matrix-docker-ansible-deploy/pull/2515), [FSG-Cat](https://github.com/FSG-Cat) for fixing it up and me ([Slavi](https://github.com/spantaleev)) for polishing it up, the playbook can now install and configure the [sliding-sync proxy](https://github.com/matrix-org/sliding-sync).
+
+The upcoming Element X clients ([Element X iOS](https://github.com/vector-im/element-x-ios) and [Element X Android](https://github.com/vector-im/element-x-android)) require the `sliding-sync` proxy to do their job. **These clients are still in beta** (especially Element X Android, which requires manual compilation to get it working with a non-`matrix.org` homeseserver). Playbook users can now easily give these clients a try and help test them thanks to us having `sliding-sync` support.
+
+To get started, see our [Setting up Sliding Sync Proxy](docs/configuring-playbook-sliding-sync-proxy.md) documentation page.
+
+
+# 2023-03-02
+
+## The matrix-etherpad role lives independently now
+
+**TLDR**: the `matrix-etherpad` role is now included from [another repository](https://gitlab.com/etke.cc/roles/etherpad). Some variables have been renamed. All functionality remains intact.
+
+You need to **update you roles** (`just roles` or `make roles`) regardless of whether you're using Etherpad or not.
+
+If you're making use of Etherpad via this playbook, you will need to update variable references in your `vars.yml` file:
+
+- Rename `matrix_etherpad_public_endpoint` to `etherpad_path_prefix`
+
+- Replace `matrix_etherpad_mode: dimension` with:
+  - for `matrix-nginx-proxy` users:
+    - `etherpad_nginx_proxy_dimension_integration_enabled: true`
+    - `etherpad_hostname: "{{ matrix_server_fqn_dimension }}"`
+  - for Traefik users:
+    - define your own `etherpad_hostname` and `etherpad_path_prefix` as you see fit
+
+- Rename all other variables:
+  - `matrix_etherpad_docker_image_` -> `matrix_etherpad_container_image_`
+  - `matrix_etherpad_` -> `etherpad_`
+
+Along with this relocation, the new role also:
+
+- supports [self-building](docs/self-building.md), so it should work on `arm32` and `arm64` architectures
+- has native Traefik reverse-proxy support (Etherpad requests no longer go through `matrix-nginx-proxy` when using Traefik)
+
+
+# 2023-02-26
+
+## Traefik is the default reverse-proxy now
+
+**TLDR**: new installations will now default to Traefik as their reverse-proxy. Existing users need to explicitly choose their reverse-proxy type. [Switching to Traefik](#how-do-i-switch-my-existing-setup-to-traefik) is strongly encouraged. `matrix-nginx-proxy` may break over time and will ultimately be removed.
+
+As mentioned 2 weeks ago in [(Backward Compatibility) Reverse-proxy configuration changes and initial Traefik support](#backward-compatibility-reverse-proxy-configuration-changes-and-initial-traefik-support), the playbook is moving to Traefik as its default SSL-terminating reverse-proxy.
+
+Until now, we've been doing the migration gradually and keeping full backward compatibility. New installations were defaulting to `matrix-nginx-proxy` (just like before), while existing installations were allowed to remain on `matrix-nginx-proxy` as well. This makes things very difficult for us, because we need to maintain and think about lots of different setups:
+
+- Traefik managed by the playbook
+- Traefik managed by the user in another way
+- another reverse-proxy on the same host (`127.0.0.1` port exposure)
+- another reverse-proxy on another host (`0.0.0.0` port exposure)
+- `matrix-nginx-proxy` - an `nginx` container managed by the playbook
+- `nginx` webserver operated by the user, running without a container on the same server
+
+Each change we do and each new feature that comes in needs to support all these different ways of reverse-proxying. Because `matrix-nginx-proxy` was the default and pretty much everyone was (and still is) using it, means that new PRs also come with `matrix-nginx-proxy` as their main focus and Traefik as an afterthought, which means we need to spend hours fixing up Traefik support.
+
+We can't spend all this time maintaining so many different configurations anymore. Traefik support has been an option for 2 weeks and lots of people have  already migrated their server and have tested things out. Traefik is what we use and preferentially test for.
+
+It's time for the **next step in our migration process** to Traefik and elimination of `matrix-nginx-proxy`:
+
+- Traefik is now the default reverse-proxy for new installations
+- All existing users need to explicitly choose their reverse-proxy type by defining the `matrix_playbook_reverse_proxy_type` variable in their `vars.yml` configuration file. We strongly encourage existing users to [switch the Traefik](#how-to-switch-an-existing-setup-to-traefik), as the nginx setup is bound to become more and more broken over time until it's ultimately removed
+
+### How do I switch my existing setup to Traefik?
+
+**For users who are on `matrix-nginx-proxy`** (the default reverse-proxy provided by the playbook), switching to Traefik can happen with a simple configuration change. Follow this section from 2 weeks ago: [How do I explicitly switch to Traefik right now?](#how-do-i-explicitly-switch-to-traefik-right-now).
+
+If you experience trouble:
+
+1. Follow [How do I remain on matrix-nginx-proxy?](#how-do-i-remain-on-matrix-nginx-proxy) to bring your server back online using the old reverse-proxy
+2. Ask for help in our [support channels](README.md#support)
+3. Try switching to Traefik again later
+
+**For users with a more special reverse-proxying setup** (another nginx server, Apache, Caddy, etc.), the migration may not be so smooth. Follow the [Using your own webserver](docs/configuring-playbook-own-webserver.md) guide. Ideally, your custom reverse-proxy will be configured in such a way that it **fronts the Traefik reverse-proxy** provided by the playbook. Other means of reverse-proxying are more fragile and may be deprecated in the future.
+
+### I already use my own Traefik server. How do I plug that in?
+
+See the [Traefik managed by the playbook](docs/configuring-playbook-own-webserver.md#traefik-managed-by-the-playbook) section.
+
+### Why is matrix-nginx-proxy used even after switching to Traefik?
+
+This playbook manages many different services. All these services were initially integrated with `matrix-nginx-proxy`.
+
+While we migrate all these components to have native Traefik support, some still go through nginx internally (Traefik -> local `matrix-nginx-proxy` -> component).
+As time goes on, internal reliance on `matrix-nginx-proxy` will gradually decrease until it's completely removed.
+
+### How do I remain on matrix-nginx-proxy?
+
+Most new work and testing targets Traefik, so remaining on nginx is **not** "the good old stable" option, but rather the "still available, but largely untested and likely to be broken very soon" option.
+
+To proceed regardless of this warning, add `matrix_playbook_reverse_proxy_type: playbook-managed-nginx` to your configuration.
+
+At some point in the **near** future (days, or even weeks at most), we hope to completely get rid of `matrix-nginx-proxy` (or break it enough to make it unusable), so you **will soon be forced to migrate** anyway. Plan your migration accordingly.
+
+### How do I keep using my own other reverse-proxy?
+
+We recommend that you follow the guide for [Fronting the integrated reverse-proxy webserver with another reverse-proxy](docs/configuring-playbook-own-webserver.md#fronting-the-integrated-reverse-proxy-webserver-with-another-reverse-proxy).
+
+
+# 2023-02-25
+
+## Rageshake support
+
+Thanks to [Benjamin Kampmann](https://github.com/gnunicorn), the playbook can now install and configure the [Rageshake](https://github.com/matrix-org/rageshake) bug report server.
+
+Additional details are available in [Setting up Rageshake](docs/configuring-playbook-rageshake.md).
+
+
+# 2023-02-17
+
+## Synapse templates customization support
+
+The playbook can now help you customize Synapse's templates.
+
+Additional details are available in the [Customizing templates](docs/configuring-playbook-synapse.md#customizing-templates) section of our Synapse documentation.
+
+## The matrix-redis role lives independently now
+
+**TLDR**: the `matrix-redis` role is now included from another repository. Some variables have been renamed. All functionality remains intact.
+
+The `matrix-redis` role (which configures [Redis](https://redis.io/)) has been extracted from the playbook and now lives in its [own repository](https://gitlab.com/etke.cc/roles/redis). This makes it possible to easily use it in other Ansible playbooks.
+
+You need to **update you roles** (`just roles` or `make roles`) regardless of whether you're enabling Ntfy or not. If you're making use of Ntfy via this playbook, you will need to update variable references in your `vars.yml` file (`matrix_redis_` -> `redis_`).
+
+## The matrix-ntfy role lives independently now
+
+**TLDR**: the `matrix-ntfy` role is now included from another repository. Some variables have been renamed. All functionality remains intact.
+
+The `matrix-ntfy` role (which configures [Ntfy](https://ntfy.sh/)) has been extracted from the playbook and now lives in its [own repository](https://gitlab.com/etke.cc/roles/ntfy). This makes it possible to easily use it in other Ansible playbooks.
+
+You need to **update you roles** (`just roles` or `make roles`) regardless of whether you're enabling Ntfy or not. If you're making use of Ntfy via this playbook, you will need to update variable references in your `vars.yml` file (`matrix_ntfy_` -> `ntfy_`).
+
+
+# 2023-02-15
+
+## The matrix-grafana role lives independently now
+
+**TLDR**: the `matrix-grafana` role is now included from another repository. Some variables have been renamed. All functionality remains intact.
+
+The `matrix-grafana` role (which configures [Grafana](docs/configuring-playbook-prometheus-grafana.md)) has been extracted from the playbook and now lives in its [own repository](https://gitlab.com/etke.cc/roles/grafana). This makes it possible to easily use it in other Ansible playbooks.
+
+You need to **update you roles** (`just roles` or `make roles`) regardless of whether you're enabling Grafana or not. If you're making use of Grafana via this playbook, you will need to update variable references in your `vars.yml` file (`matrix_grafana_` -> `grafana_`).
+
+
+# 2023-02-13
+
+## The matrix-backup-borg role lives independently now
+
+**TLDR**: the `matrix-backup-borg` role is now included from another repository. Some variables have been renamed. All functionality remains intact.
+
+Thanks to [moan0s](https://github.com/moan0s), the `matrix-backup-borg` role (which configures [Borg backups](docs/configuring-playbook-backup-borg.md)) has been extracted from the playbook and now lives in its [own repository](https://gitlab.com/etke.cc/roles/backup_borg). This makes it possible to easily use it in other Ansible playbooks and will become part of [nextcloud-docker-ansible-deploy](https://github.com/spantaleev/nextcloud-docker-ansible-deploy) soon.
+
+You need to **update you roles** (`just roles` or `make roles`) regardless of whether you're enabling Borg backup functionality or not. If you're making use of Borg backups via this playbook, you will need to update variable references in your `vars.yml` file (`matrix_backup_borg_` -> `backup_borg_`).
+
+
 # 2023-02-12
 
-## Reverse-proxy configuration changes and initial Traefik support
+## (Backward Compatibility) Reverse-proxy configuration changes and initial Traefik support
 
 **TLDR**:
 
 - there's a new `matrix_playbook_reverse_proxy_type` variable (see [roles/custom/matrix-base/defaults/main.yml](roles/custom/matrix-base/defaults/main.yml)), which lets you tell the playbook what reverse-proxy setup you'd like to have. This makes it easier for people who want to do reverse-proxying in other ways.
-- the default reverse-proxy (`matrix_playbook_reverse_proxy_type`) is still `playbook-managed-nginx` (via `matrix-nginx-proxy`), for now. **Existing users should not observe any changes** and can stay on this for now.
+- the default reverse-proxy (`matrix_playbook_reverse_proxy_type`) is still `playbook-managed-nginx` (via `matrix-nginx-proxy`), for now. **Existing `matrix-nginx-proxy` users should not observe any changes** and can stay on this for now.
+- **Users who use their [own other webserver](docs/configuring-playbook-own-webserver.md) (e.g. Apache, etc.) need to change** `matrix_playbook_reverse_proxy_type` to something like `other-on-same-host`, `other-on-another-host` or `other-nginx-non-container`
 - we now have **optional [Traefik](https://traefik.io/) support**, so you could easily host Matrix and other Traefik-native services in containers on the same server. Traefik support is still experimental (albeit, good enough) and will improve over time. It does work, but certain esoteric features may not be there yet.
 - **Traefik will become the default reverse-proxy in the near future**. `matrix-nginx-proxy` will either remain as an option, or be completely removed to simplify the playbook
 
@@ -59,21 +262,25 @@ Traefik does not lock important functionality we'd like to use into [plus packag
 
 `matrix_playbook_reverse_proxy_type` still defaults to a value of `playbook-managed-nginx`.
 
-Unless we have some regression, **existing users should be able to update their Matrix server and not observe any changes**. Their setup should still remain on nginx and everything should still work as expected.
+Unless we have some regression, **existing `matrix-nginx-proxy` users should be able to update their Matrix server and not observe any changes**. Their setup should still remain on nginx and everything should still work as expected.
+
+**Users using [their own webservers](docs/configuring-playbook-own-webserver.md) will need to change `matrix_playbook_reverse_proxy_type`** to something like `other-on-same-host`, `other-on-another-host` or `other-nginx-non-container`. Previously, they could toggle `matrix_nginx_proxy_enabled` to `false`, and that made the playbook automatically expose services locally. Currently, we only do this if you change the reverse-proxy type to `other-on-same-host`, `other-on-another-host` or `other-nginx-non-container`.
 
 #### How do I explicitly switch to Traefik right now?
 
-**Users who want to migrate to Traefik** today, can do so by using configuration like this:
+**Users who wish to migrate to Traefik** today, can do so by **adding** this to their configuration:
 
 ```yaml
 matrix_playbook_reverse_proxy_type: playbook-managed-traefik
 
-devture_traefik_ssl_email_address: YOUR_EMAIL_ADDRESS
+devture_traefik_config_certificatesResolvers_acme_email: YOUR_EMAIL_ADDRESS
 ```
 
-Switching to Traefik will obtain new SSL certificates from Let's Encrypt (stored in `/devture-traefik/ssl/acme.json`). **The switch is reversible**. You can always go back to `playbook-managed-nginx` if Traefik is causing you trouble.
+You may still need to keep certain old `matrix_nginx_proxy_*` variables (like `matrix_nginx_proxy_base_domain_serving_enabled`), even when using Traefik. For now, we recommend keeping all `matrix_nginx_proxy_*` variables just in case. In the future, reliance on `matrix-nginx-proxy` will be removed.
 
-**Note**: toggling `matrix_playbook_reverse_proxy_type` between Traefik and nginx will uninstall the Traefik role and all of its data (under `/devture-traefik`), so you may run into a Let's Encrypt rate limit if you do it often.
+Switching to Traefik will obtain new SSL certificates from Let's Encrypt (stored in `/matrix/traefik/ssl/acme.json`). **The switch is reversible**. You can always go back to `playbook-managed-nginx` if Traefik is causing you trouble.
+
+**Note**: toggling `matrix_playbook_reverse_proxy_type` between Traefik and nginx will uninstall the Traefik role and all of its data (under `/matrix/traefik`), so you may run into a Let's Encrypt rate limit if you do it often.
 
 Treafik directly reverse-proxies to **some** services right now, but for most other services it goes through `matrix-nginx-proxy` (e.g. Traefik -> `matrix-nginx-proxy` -> [Ntfy](docs/configuring-playbook-ntfy.md)). So, even if you opt into Traefik, you'll still see `matrix-nginx-proxy` being installed in local-only mode. This will improve with time.
 
@@ -128,7 +335,7 @@ Additional details are available in [Setting up Draupnir](docs/configuring-playb
 
 **TLDR**: the `matrix-prometheus-postgres-exporter` role is now included from another repository. Some variables have been renamed. All functionality remains intact.
 
-The `matrix-prometheus-postgres-exporter` role (which configures [Prometheus Postgres Exporter](https://github.com/prometheus-community/postgres_exporter)) has been extracted from the playbook and now lives in its own repository at https://gitlab.com/etke.cc/roles/prometheus_postgres_exporter.
+The `matrix-prometheus-postgres-exporter` role (which configures [Prometheus Postgres Exporter](https://github.com/prometheus-community/postgres_exporter)) has been extracted from the playbook and now lives in its own repository at https://gitlab.com/etke.cc/roles/prometheus_postgres_exporter
 
 It's still part of the playbook, but is now installed via `ansible-galaxy` (by running `just roles` / `make roles`). Some variables have been renamed (`matrix_prometheus_postgres_exporter_` -> `prometheus_postgres_exporter_`, etc.). The playbook will report all variables that you need to rename to get upgraded. All functionality remains intact.
 
@@ -172,7 +379,7 @@ We've also added `no-multicast-peers` to the default Coturn configuration, but w
 
 **TLDR**: the `matrix-prometheus-node-exporter` role is now included from another repository. Some variables have been renamed. All functionality remains intact.
 
-The `matrix-prometheus-node-exporter` role (which configures [Prometheus node exporter](https://github.com/prometheus/node_exporter)) has been extracted from the playbook and now lives in its own repository at https://gitlab.com/etke.cc/roles/prometheus_node_exporter.
+The `matrix-prometheus-node-exporter` role (which configures [Prometheus node exporter](https://github.com/prometheus/node_exporter)) has been extracted from the playbook and now lives in its own repository at https://gitlab.com/etke.cc/roles/prometheus_node_exporter
 
 It's still part of the playbook, but is now installed via `ansible-galaxy` (by running `just roles` / `make roles`). Some variables have been renamed (`matrix_prometheus_node_exporter_` -> `prometheus_node_exporter_`, etc.). The playbook will report all variables that you need to rename to get upgraded. All functionality remains intact.
 
@@ -360,11 +567,11 @@ Various services (like Dimension, etc.) still talk to Synapse via `matrix-nginx-
 
 Until now, [Etherpad](https://etherpad.org/) (which [the playbook could install for you](docs/configuring-playbook-etherpad.md)) required the [Dimension integration manager](docs/configuring-playbook-dimension.md) to also be installed, because Etherpad was hosted on the Dimension domain (at `dimension.DOMAIN/etherpad`).
 
-From now on, Etherpad can be installed in `standalone` mode on `etherpad.DOMAIN` and used even without Dimension. This is much more versatile, so the playbook now defaults to this new mode (`matrix_etherpad_mode: standalone`).
+From now on, Etherpad can be installed in `standalone` mode on `etherpad.DOMAIN` and used even without Dimension. This is much more versatile, so the playbook now defaults to this new mode (`etherpad_mode: standalone`).
 
 If you've already got both Etherpad and Dimension in use you could:
 
-- **either** keep hosting Etherpad under the Dimension domain by adding `matrix_etherpad_mode: dimension` to your `vars.yml` file. All your existing room widgets will continue working at the same URLs and no other changes will be necessary.
+- **either** keep hosting Etherpad under the Dimension domain by adding `etherpad_mode: dimension` to your `vars.yml` file. All your existing room widgets will continue working at the same URLs and no other changes will be necessary.
 
 - **or**, you could change to hosting Etherpad separately on `etherpad.DOMAIN`. You will need to [configure a DNS record](docs/configuring-dns.md) for this new domain. You will also need to reconfigure Dimension to use the new pad URLs (`https://etherpad.DOMAIN/...`) going forward (refer to our [configuring Etherpad documentation](docs/configuring-playbook-etherpad.md)). All your existing room widgets (which still use `https://dimension.DOMAIN/etherpad/...`) will break as Etherpad is not hosted there anymore. You will need to re-add them or to consider not using `standalone` mode
 
@@ -651,7 +858,7 @@ See our [Setting up the ntfy push notifications server](docs/configuring-playboo
 
 **If you are using the [Hookshot bridge](docs/configuring-playbook-bridge-hookshot.md)**, you may find that:
 1. **Metrics may not be enabled by default anymore**:
-  - If Prometheus is enabled (`matrix_prometheus_enabled: true`), then Hookshot metrics will be enabled automatically (`matrix_hookshot_metrics_enabled: true`). These metrics will be collected from the local (in-container) Prometheus over the container network.
+  - If Prometheus is enabled (`prometheus_enabled: true`), then Hookshot metrics will be enabled automatically (`matrix_hookshot_metrics_enabled: true`). These metrics will be collected from the local (in-container) Prometheus over the container network.
   - **If Prometheus is not enabled** (you are either not using Prometheus or are using an external one), **Hookshot metrics will not be enabled by default anymore**. Feel free to enable them by setting `matrix_hookshot_metrics_enabled: true`. Also, see below.
 2. When metrics are meant to be **consumed by an external Prometheus server**, `matrix_hookshot_metrics_proxying_enabled` needs to be set to `true`, so that metrics would be exposed (proxied) "publicly" on `https://matrix.DOMAIN/metrics/hookshot`. To make use of this, you'll also need to enable the new `https://matrix.DOMAIN/metrics/*` endpoints mentioned above, using `matrix_nginx_proxy_proxy_matrix_metrics_enabled`. Learn more in our [Collecting metrics to an external Prometheus server](docs/configuring-playbook-prometheus-grafana.md#collecting-metrics-to-an-external-prometheus-server) documentation.
 3. **We've changed the URL we're exposing Hookshot metrics at** for external Prometheus servers. Until now, you were advised to consume Hookshot metrics from `https://stats.DOMAIN/hookshot/metrics` (working in conjunction with `matrix_nginx_proxy_proxy_synapse_metrics`). From now on, **this no longer works**. As described above, you need to start consuming metrics from `https://matrix.DOMAIN/metrics/hookshot`.

README.md

@@ -13,6 +13,15 @@ We run all services in [Docker](https://www.docker.com/) containers (see [the co
 [Installation](docs/README.md) (upgrades) and some maintenance tasks are automated using [Ansible](https://www.ansible.com/) (see [our Ansible guide](docs/ansible.md)).
 
 
+## Self-hosting or SaaS
+
+This Ansible playbook tries to make self-hosting and maintaining a Matrix server fairly easy. Still, running any service smoothly requires knowledge, time and effort.
+
+If you like the [FOSS](https://en.wikipedia.org/wiki/Free_and_open-source_software) spirit of this Ansible playbook, but prefer to put the responsibility on someone else, you can also [get a managed Matrix server from etke.cc](https://etke.cc/) - a service built on top of this Ansible playbook, which can help you run a Matrix server with ease.
+
+If you like learning and experimentation, but would rather reduce future maintenance effort, you can even go for a hybrid approach - self-hosting manually using this Ansible playbook at first and then transferring server maintenance to etke.cc at a later time.
+
+
 ## Supported services
 
 Using this playbook, you can get the following list of services configured on your server. Basically, this playbook aims to get you up-and-running with all the necessities around Matrix, without you having to do anything else.
@@ -27,7 +36,7 @@ You can always re-run the playbook later to add or remove components.
 The homeserver is the backbone of your matrix system. Choose one from the following list.
 
 | Name | Default? | Description | Documentation |
-| ---- | -------- | ----------- | ------------- | 
+| ---- | -------- | ----------- | ------------- |
 | [Synapse](https://github.com/matrix-org/synapse) | ✓ | Storing your data and managing your presence in the [Matrix](http://matrix.org/) network | [Link](docs/configuring-playbook-synapse.md) |
 | [Conduit](https://conduit.rs) | x | Storing your data and managing your presence in the [Matrix](http://matrix.org/) network. Conduit is a lightweight open-source server implementation of the Matrix Specification with a focus on easy setup and low system requirements | [Link](docs/configuring-playbook-conduit.md) |
 | [Dendrite](https://github.com/matrix-org/dendrite) | x | Storing your data and managing your presence in the [Matrix](http://matrix.org/) network. Dendrite is a second-generation Matrix homeserver written in Go, an alternative to Synapse. | [Link](docs/configuring-playbook-dendrite.md) |
@@ -52,10 +61,11 @@ Services that run on the server to make the various parts of your installation w
 | ---- | -------- | ----------- | ------------- |
 | [PostgreSQL](https://www.postgresql.org/)| ✓ | Database for Synapse. [Using an external PostgreSQL server](docs/configuring-playbook-external-postgres.md) is also possible. | [Link](docs/configuring-playbook-external-postgres.md) |
 | [Coturn](https://github.com/coturn/coturn) | ✓ | STUN/TURN server for WebRTC audio/video calls | [Link](docs/configuring-playbook-turn.md) |
-| [nginx](http://nginx.org/) | ✓ | Web server, listening on ports 80 and 443 - standing in front of all the other services. Using your own webserver [is possible](docs/configuring-playbook-own-webserver.md) | [Link](docs/configuring-playbook-nginx.md) |
+| [Traefik](https://doc.traefik.io/traefik/) | ✓ | Web server, listening on ports 80, 443 and 8448 - standing in front of all the other services. Using your own webserver [is possible](docs/configuring-playbook-own-webserver.md) | [Link](docs/configuring-playbook-traefik.md) |
-| [Let's Encrypt](https://letsencrypt.org/) | ✓ | Free  SSL certificate, which secures the connection to the Synapse server and the Element web UI | [Link](docs/configuring-playbook-ssl-certificates.md) |
+| [nginx](http://nginx.org/) | x | (Deprecated) Web server, listening on ports 80, 443 and 8448 - standing in front of all the other services. Deprecated in favor of Traefik | [Link](docs/configuring-playbook-nginx.md) |
+| [Let's Encrypt](https://letsencrypt.org/) | ✓ | Free SSL certificate, which secures the connection to all components | [Link](docs/configuring-playbook-ssl-certificates.md) |
 | [ma1sd](https://github.com/ma1uta/ma1sd) | x | Matrix Identity Server | [Link](docs/configuring-playbook-ma1sd.md)
-| [Exim](https://www.exim.org/) | ✓ | Mail server, through which all Matrix services send outgoing email (can be configured to relay through another SMTP server) | - |
+| [Exim](https://www.exim.org/) | ✓ | Mail server, through which all Matrix services send outgoing email (can be configured to relay through another SMTP server) | [Link](docs/configuring-playbook-email.md) |
 | [Dimension](https://github.com/turt2live/matrix-dimension) | x | An open source integrations manager for matrix clients | [Link](docs/configuring-playbook-dimension.md) |
 | [Sygnal](https://github.com/matrix-org/sygnal) | x | Push gateway | [Link](docs/configuring-playbook-sygnal.md) |
 | [ntfy](https://ntfy.sh) | x | Push notifications server | [Link](docs/configuring-playbook-ntfy.md) |
@@ -66,7 +76,7 @@ Services that run on the server to make the various parts of your installation w
 Extend and modify how users are authenticated on your homeserver.
 
 | Name | Default? | Description | Documentation |
-| ---- | -------- | ----------- | ------------- | 
+| ---- | -------- | ----------- | ------------- |
 | [matrix-synapse-rest-auth](https://github.com/ma1uta/matrix-synapse-rest-password-provider) (advanced) | x | REST authentication password provider module | [Link](docs/configuring-playbook-rest-auth.md) |
 |[matrix-synapse-shared-secret-auth](https://github.com/devture/matrix-synapse-shared-secret-auth) (advanced) | x | Password provider module | [Link](docs/configuring-playbook-shared-secret-auth.md) |
 | [matrix-synapse-ldap3](https://github.com/matrix-org/matrix-synapse-ldap3) (advanced) | x | LDAP Auth password provider module | [Link](configuring-playbook-ldap-auth.md) |
@@ -130,6 +140,7 @@ Bots provide various additional functionality to your installation.
 | [Postmoogle](https://gitlab.com/etke.cc/postmoogle) | x | Email to matrix bot | [Link](docs/configuring-playbook-bot-postmoogle.md) |
 | [Go-NEB](https://github.com/matrix-org/go-neb) | x | A multi functional bot written in Go | [Link](docs/configuring-playbook-bot-go-neb.md) |
 | [Mjolnir](https://github.com/matrix-org/mjolnir) | x | A moderation tool for Matrix | [Link](docs/configuring-playbook-bot-mjolnir.md) |
+| [Draupnir](https://github.com/Gnuxie/Draupnir) | x | A moderation tool for Matrix (Fork of Mjolnir) | [Link](docs/configuring-playbook-bot-draupnir.md) |
 | [Buscarron](https://gitlab.com/etke.cc/buscarron) | x | Web forms (HTTP POST) to matrix | [Link](docs/configuring-playbook-bot-buscarron.md) |
 | [matrix-chatgpt-bot](https://github.com/matrixgpt/matrix-chatgpt-bot) | x | ChatGPT from matrix | [Link](docs/configuring-playbook-bot-chatgpt.md) |
 
@@ -143,6 +154,7 @@ Services that help you in administrating and monitoring your matrix installation
 | [synapse-admin](https://github.com/Awesome-Technologies/synapse-admin) | x | A web UI tool for administrating users and rooms on your Matrix server | [Link](docs/configuring-playbook-synapse-admin.md) |
 | Metrics and Graphs | x | Consists of the [Prometheus](https://prometheus.io) time-series database server, the Prometheus [node-exporter](https://prometheus.io/docs/guides/node-exporter/) host metrics exporter, and the [Grafana](https://grafana.com/) web UI | [Link](docs/configuring-playbook-prometheus-grafana.md) |
 | [Borg](https://borgbackup.org) | x | Backups | [Link](docs/configuring-playbook-backup-borg.md) |
+| [Rageshake](https://github.com/matrix-org/rageshake) | x | Bug report server | [Link](docs/configuring-playbook-rageshake.md) |
 
 ### Misc
 
@@ -150,6 +162,8 @@ Various services that don't fit any other category.
 
 | Name | Default? | Description | Documentation |
 | ---- | -------- | ----------- | ------------- |
+| [sliding-sync](https://github.com/matrix-org/sliding-sync)| x | Sliding Sync support for clients which require it (e.g. Element X) | [Link](docs/configuring-playbook-sliding-sync-proxy.md) |
+| [synapse_auto_compressor](https://github.com/matrix-org/rust-synapse-compress-state/#automated-tool-synapse_auto_compressor) | x | A cli tool that automatically compresses `state_groups` database table in background. | [Link](docs/configuring-playbook-synapse-auto-compressor.md) |
 | [synapse-simple-antispam](https://github.com/t2bot/synapse-simple-antispam) (advanced) | x | A spam checker module | [Link](docs/configuring-playbook-synapse-simple-antispam.md) |
 | [Matrix Corporal](https://github.com/devture/matrix-corporal) (advanced) | x | Reconciliator and gateway for a managed Matrix server | [Link](docs/configuring-playbook-matrix-corporal.md) |
 | [Etherpad](https://etherpad.org) | x | An open source collaborative text editor | [Link](docs/configuring-playbook-etherpad.md) |
@@ -178,6 +192,16 @@ When updating the playbook, refer to [the changelog](CHANGELOG.md) to catch up w
 - GitHub issues: [spantaleev/matrix-docker-ansible-deploy/issues](https://github.com/spantaleev/matrix-docker-ansible-deploy/issues)
 
 
-## Services by the community
+## Related
 
-- [etke.cc](https://etke.cc) - matrix-docker-ansible-deploy and system stuff "as a service". That service will create your matrix homeserver on your domain and server (doesn't matter if it's cloud provider or on an old laptop in the corner of your room), (optional) maintains it (server's system updates, cleanup, security adjustments, tuning, etc.; matrix homeserver updates & maintenance) and (optional) provide full-featured email service for your domain
+You may also be interested in these other Ansible playbooks:
+
+- [gitea-docker-ansible-deploy](https://github.com/spantaleev/gitea-docker-ansible-deploy) - for deploying a [Gitea](https://gitea.io/) git version-control server
+
+- [nextcloud-docker-ansible-deploy](https://github.com/spantaleev/nextcloud-docker-ansible-deploy) - for deploying a [Nextcloud](https://nextcloud.com/) server
+
+- [peertube-docker-ansible-deploy](https://github.com/spantaleev/peertube-docker-ansible-deploy) - for deploying a [PeerTube](https://joinpeertube.org/) video-platform server
+
+- [vaultwarden-docker-ansible-deploy](https://github.com/spantaleev/vaultwarden-docker-ansible-deploy) - for deploying a [Vaultwarden](https://github.com/dani-garcia/vaultwarden) password manager server (unofficial [Bitwarden](https://bitwarden.com/) compatible server)
+
+They're all making use of Traefik as their reverse-proxy, so it should be easy to host all these services on the same server. Follow the `docs/configuring-playbook-interoperability.md` documentation in each playbook.

docs/ansible.md

@@ -65,7 +65,7 @@ docker run -it --rm \
 -w /work \
 -v `pwd`:/work \
 --entrypoint=/bin/sh \
-docker.io/devture/ansible:2.13.6-r0-1
+docker.io/devture/ansible:2.13.6-r0-3
 ```
 
 Once you execute the above command, you'll be dropped into a `/work` directory inside a Docker container.
@@ -86,7 +86,7 @@ docker run -it --rm \
 -v `pwd`:/work \
 -v $HOME/.ssh/id_rsa:/root/.ssh/id_rsa:ro \
 --entrypoint=/bin/sh \
-docker.io/devture/ansible:2.13.6-r0
+docker.io/devture/ansible:2.13.6-r0-3
 ```
 
 The above command tries to mount an SSH key (`$HOME/.ssh/id_rsa`) into the container (at `/root/.ssh/id_rsa`).

docs/configuring-playbook-backup-borg.md

@@ -6,9 +6,9 @@ That means your daily incremental backups can be stored in a fraction of the spa
 
 You will need a remote server where borg will store the backups. There are hosted, borg compatible solutions available, such as [BorgBase](https://www.borgbase.com).
 
-The backup will run based on `matrix_backup_borg_schedule` var (systemd timer calendar), default: 4am every day.
+The backup will run based on `backup_borg_schedule` var (systemd timer calendar), default: 4am every day.
 
-By default, if you're using the integrated Postgres database server (as opposed to [an external Postgres server](configuring-playbook-external-postgres.md)), Borg backups will also include dumps of your Postgres database. An alternative solution for backing up the Postgres database is [postgres backup](configuring-playbook-postgres-backup.md). If you decide to go with another solution, you can disable Postgres-backup support for Borg using the `matrix_backup_borg_postgresql_enabled` variable.
+By default, if you're using the integrated Postgres database server (as opposed to [an external Postgres server](configuring-playbook-external-postgres.md)), Borg backups will also include dumps of your Postgres database. An alternative solution for backing up the Postgres database is [postgres backup](configuring-playbook-postgres-backup.md). If you decide to go with another solution, you can disable Postgres-backup support for Borg using the `backup_borg_postgresql_enabled` variable.
 
 
 ## Prerequisites
@@ -38,11 +38,11 @@ cat PUBKEY | ssh USER@HOST 'dd of=.ssh/authorized_keys oflag=append conv=notrunc
 Minimal working configuration (`inventory/host_vars/matrix.DOMAIN/vars.yml`) to enable borg backup:
 
 ```yaml
-matrix_backup_borg_enabled: true
+backup_borg_enabled: true
-matrix_backup_borg_location_repositories:
+backup_borg_location_repositories:
  - ssh://USER@HOST/./REPO
-matrix_backup_borg_storage_encryption_passphrase: "PASSPHRASE"
+backup_borg_storage_encryption_passphrase: "PASSPHRASE"
-matrix_backup_borg_ssh_key_private: |
+backup_borg_ssh_key_private: |
   -----BEGIN OPENSSH PRIVATE KEY-----
   TG9yZW0gaXBzdW0gZG9sb3Igc2l0IGFtZXQsIGNvbnNlY3RldHVyIGFkaXBpc2NpbmcgZW
   xpdCwgc2VkIGRvIGVpdXNtb2QgdGVtcG9yIGluY2lkaWR1bnQgdXQgbGFib3JlIGV0IGRv
@@ -58,13 +58,13 @@ where:
 * HOST - SSH host of a provider/server
 * REPO - borg repository name, it will be initialized on backup start, eg: `matrix`, regarding Syntax see [Remote repositories](https://borgbackup.readthedocs.io/en/stable/usage/general.html#repository-urls)
 * PASSPHRASE - passphrase used for encrypting backups, you may generate it with `pwgen -s 64 1` or use any password manager
-* PRIVATE KEY - the content of the **private** part of the SSH key you created before. The whole key (all of its belonging lines) under `matrix_backup_borg_ssh_key_private` needs to be indented with 2 spaces
+* PRIVATE KEY - the content of the **private** part of the SSH key you created before. The whole key (all of its belonging lines) under `backup_borg_ssh_key_private` needs to be indented with 2 spaces
 
-To backup without encryption, add `matrix_backup_borg_encryption: 'none'` to your vars. This will also enable the `matrix_backup_borg_unknown_unencrypted_repo_access_is_ok` variable.
+To backup without encryption, add `backup_borg_encryption: 'none'` to your vars. This will also enable the `backup_borg_unknown_unencrypted_repo_access_is_ok` variable.
 
-`matrix_backup_borg_location_source_directories` defines the list of directories to back up: it's set to `{{ matrix_base_data_path }}` by default, which is the base directory for every service's data, such as Synapse, Postgres and the bridges. You might want to exclude certain directories or file patterns from the backup using the `matrix_backup_borg_location_exclude_patterns` variable.
+`backup_borg_location_source_directories` defines the list of directories to back up: it's set to `{{ matrix_base_data_path }}` by default, which is the base directory for every service's data, such as Synapse, Postgres and the bridges. You might want to exclude certain directories or file patterns from the backup using the `backup_borg_location_exclude_patterns` variable.
 
-Check the `roles/custom/matrix-backup-borg/defaults/main.yml` file for the full list of available options.
+Check the [backup_borg role](https://gitlab.com/etke.cc/roles/backup_borg)'s [defaults/main.yml](https://gitlab.com/etke.cc/roles/backup_borg/-/blob/main/defaults/main.yml) file for the full list of available options.
 
 ## Installing
 

docs/configuring-playbook-bot-buscarron.md

@@ -2,8 +2,32 @@
 
 The playbook can install and configure [buscarron](https://gitlab.com/etke.cc/buscarron) for you.
 
-It's a bot you can use to setup **your own helpdesk on matrix**
+Buscarron is bot that receives HTTP POST submissions of web forms and forwards them to a Matrix room.
-It's a bot you can use to send any form (HTTP POST, HTML) to a (encrypted) matrix room
+
+
+## Decide on a domain and path
+
+By default, Buscarron is configured to use its own dedicated domain (`buscarron.DOMAIN`) and requires you to [adjust your DNS records](#adjusting-dns-records).
+
+You can override the domain and path like this:
+
+```yaml
+# Switch to the domain used for Matrix services (`matrix.DOMAIN`),
+# so we won't need to add additional DNS records for Buscarron.
+matrix_bot_buscarron_hostname: "{{ matrix_server_fqn_matrix }}"
+
+# Expose under the /buscarron subpath
+matrix_bot_buscarron_path_prefix: /buscarron
+```
+
+**NOTE**: When using `matrix-nginx-proxy` instead of Traefik, you won't be able to override the path prefix. You can only override the domain, but that needs to happen using another variable: `matrix_server_fqn_buscarron` (e.g. `matrix_server_fqn_buscarron: "form.{{ matrix_domain }}"`).
+
+
+## Adjusting DNS records
+
+Once you've decided on the domain and path, **you may need to adjust your DNS** records to point the Buscarron domain to the Matrix server.
+
+If you've decided to reuse the `matrix.` domain, you won't need to do any extra DNS configuration.
 
 
 ## Adjusting the playbook configuration
@@ -31,16 +55,6 @@ matrix_bot_buscarron_forms:
 matrix_bot_buscarron_spamlist: [] # (optional) list of emails/domains/hosts (with wildcards support) that should be rejected automatically
 ```
 
-You will also need to add a DNS record so that buscarron can be accessed.
-By default buscarron will use https://buscarron.DOMAIN so you will need to create an CNAME record for `buscarron`.
-See [Configuring DNS](configuring-dns.md).
-
-If you would like to use a different domain, add the following to your configuration file (changing it to use your preferred domain):
-
-```yaml
-matrix_server_fqn_buscarron: "form.{{ matrix_domain }}"
-```
-
 
 ## Installing
 
@@ -67,4 +81,12 @@ To use the bot, invite the `@bot.buscarron:DOMAIN` to the room you specified in
 </form>
 ```
 
+**NOTE**: to fight against spam, Buscarron is **very aggressive when it comes to banning** and will ban you if:
+
+- if you hit the homepage (HTTP `GET` request to `/`)
+- if you submit a form to the wrong URL (`POST` request to `/non-existing-form`)
+- if `hasemail` is enabled for the form (like in the example above) and you don't submit an `email` field
+
+If you get banned, you'd need to restart the process by running the playbook with `--tags=start` or running `systemctl restart matrix-bot-buscarron` on the server.
+
 You can also refer to the upstream [documentation](https://gitlab.com/etke.cc/buscarron).

docs/configuring-playbook-bot-go-neb.md

@@ -24,6 +24,31 @@ ansible-playbook -i inventory/hosts setup.yml --extra-vars='username=bot.go-neb
 Once the user is created you can [obtain an access token](obtaining-access-tokens.md).
 
 
+## Decide on a domain and path
+
+By default, Go-NEB is configured to use its own dedicated domain (`goneb.DOMAIN`) and requires you to [adjust your DNS records](#adjusting-dns-records).
+
+You can override the domain and path like this:
+
+```yaml
+# Switch to the domain used for Matrix services (`matrix.DOMAIN`),
+# so we won't need to add additional DNS records for Go-NEB.
+matrix_bot_go_neb_hostname: "{{ matrix_server_fqn_matrix }}"
+
+# Expose under the /go-neb subpath
+matrix_bot_go_neb_path_prefix: /go-neb
+```
+
+**NOTE**: When using `matrix-nginx-proxy` instead of Traefik, you won't be able to override the path prefix. You can only override the domain, but that needs to happen using another variable: `matrix_server_fqn_go_neb` (e.g. `matrix_server_fqn_go_neb: "mybot.{{ matrix_domain }}"`).
+
+
+## Adjusting DNS records
+
+Once you've decided on the domain and path, **you may need to adjust your DNS** records to point the Go-NEB domain to the Matrix server.
+
+If you've decided to reuse the `matrix.` domain, you won't need to do any extra DNS configuration.
+
+
 ## Adjusting the playbook configuration
 
 Add the following configuration to your `inventory/host_vars/matrix.DOMAIN/vars.yml` file (adapt to your needs):
@@ -193,9 +218,7 @@ matrix_bot_go_neb_services:
 
 ## Installing
 
-Don't forget to add `goneb.<your-domain>` to DNS as described in [Configuring DNS](configuring-dns.md) before running the playbook.
+After potentially [adjusting DNS records](#adjusting-dns-records) and configuring the playbook, run the [installation](installing.md) command again:
-
-After configuring the playbook, run the [installation](installing.md) command again:
 
 ```
 ansible-playbook -i inventory/hosts setup.yml --tags=setup-all,start

docs/configuring-playbook-bridge-mautrix-slack.md

@@ -8,8 +8,6 @@ The playbook can install and configure [mautrix-slack](https://github.com/mautri
 
 See the project's [documentation](https://docs.mau.fi/bridges/go/slack/index.html) to learn what it does and why it might be useful to you.
 
-Note that as of Oct 2022, support for multiple Matrix users using the bot is incomplete. Different users do not yet share the bridged channels. Everyone gets their own copy.
-
 See the [features and roadmap](https://github.com/mautrix/slack/blob/main/ROADMAP.md) for more information.
 
 

docs/configuring-playbook-cactus-comments.md

@@ -24,7 +24,7 @@ matrix_cactus_comments_enabled: true
 # To do this you need to uncomment one of the following lines (depending if you are using synapse or dentrite as a homeserver)
 # If you don't know which one you use: The default is synapse ;)
 # matrix_synapse_allow_guest_access: true
-# matrix_dentrite_allow_guest_access
+# matrix_dentrite_allow_guest_access: true
 ```
 
 ## Installing

docs/configuring-playbook-dimension.md

@@ -6,14 +6,29 @@ If you're just installing Matrix services for the first time, please continue wi
 **Note**: This playbook now supports running [Dimension](https://dimension.t2bot.io) in both a federated and [unfederated](https://github.com/turt2live/matrix-dimension/blob/master/docs/unfederated.md) environments. This is handled automatically based on the value of `matrix_synapse_federation_enabled`. Enabling Dimension, means that the `openid` API endpoints will be exposed on the Matrix Federation port (usually `8448`), even if [federation](configuring-playbook-federation.md) is disabled. It's something to be aware of, especially in terms of firewall whitelisting (make sure port `8448` is accessible).
 
 
-## Prerequisites
+## Decide on a domain and path
 
-The `dimension.<your-domain>` DNS record must be created. See [Configuring your DNS server](configuring-dns.md) on how to set up DNS record correctly.
+By default, Dimension is configured to use its own dedicated domain (`dimension.DOMAIN`) and requires you to [adjust your DNS records](#adjusting-dns-records).
+
+You can override the domain and path like this:
+
+```yaml
+# Switch to another hostname compared to the default (`dimension.{{ matrix_domain }}`)
+matrix_dimension_hostname: "integrations.{{ matrix_domain }}"
+
+```
+
+While there is a `matrix_dimension_path_prefix` variable for changing the path where Dimension is served, overriding it is not possible right now due to [this Dimension issue](https://github.com/turt2live/matrix-dimension/issues/510). You must serve Dimension at a dedicated subdomain until this issue is solved.
+
+
+## Adjusting DNS records
+
+Once you've decided on the domain and path, **you may need to adjust your DNS** records to point the Dimension domain to the Matrix server.
 
 
 ## Enable
 
-[Dimension integrations manager](https://dimension.t2bot.io) installation is disabled by default. You can enable it in your configuration file (`inventory/host_vars/matrix.<your-domain>/vars.yml`):
+To enable Dimension, add this to your configuration file (`inventory/host_vars/matrix.<your-domain>/vars.yml`):
 
 ```yaml
 matrix_dimension_enabled: true
@@ -54,7 +69,7 @@ For more information on how to acquire an access token, visit [https://t2bot.io/
 
 ## Installation
 
-After these variables have been set, please run the following command to re-run setup and to restart Dimension:
+After these variables have been set and you have potentially [adjusted your DNS records](#adjusting-dns-records), please run the following command to re-run setup and to restart Dimension:
 
 ```
 ansible-playbook -i inventory/hosts setup.yml --tags=setup-all,start

docs/configuring-playbook-etherpad.md

@@ -1,19 +1,41 @@
 # Setting up Etherpad (optional)
 
-[Etherpad](https://etherpad.org) is is an open source collaborative text editor that can be embedded in a Matrix chat room using the [Dimension integrations manager](https://dimension.t2bot.io) or used as standalone web app.
+[Etherpad](https://etherpad.org) is an open source collaborative text editor that can be embedded in a Matrix chat room using the [Dimension integrations manager](https://dimension.t2bot.io) or used as standalone web app.
 
 When enabled together with the Jitsi audio/video conferencing system (see [our docs on Jitsi](configuring-playbook-jitsi.md)), it will be made available as an option during the conferences.
 
 
-## Prerequisites
+## Decide on a domain and path
 
-Etherpad can be installed in 2 modes:
+By default, Etherpad is configured to use its own dedicated domain (`etherpad.DOMAIN`) and requires you to [adjust your DNS records](#adjusting-dns-records).
 
-- (default) `standalone` mode (`matrix_etherpad_mode: standalone`) - Etherpad will be hosted on `etherpad.<your-domain>` (`matrix_server_fqn_etherpad`), so the DNS record for this domian must be created. See [Configuring your DNS server](configuring-dns.md) on how to set up the `etherpad` DNS record correctly
+You can override the domain and path like this:
 
-- `dimension` mode (`matrix_etherpad_mode: dimension`) - Etherpad will be hosted on `dimension.<your-domain>/etherpad` (`matrix_server_fqn_dimension`). This requires that you **first** configure the **Dimension integrations manager** as described in [the playbook documentation](configuring-playbook-dimension.md)
+```yaml
+# Switch to the domain used for Matrix services (`matrix.DOMAIN`),
+# so we won't need to add additional DNS records for Etherpad.
+etherpad_hostname: "{{ matrix_server_fqn_matrix }}"
 
-We recomend that you go with the default (`standalone`) mode, which makes Etherpad independent and allows it to be used with or without Dimension.
+# Expose under the /etherpad subpath
+etherpad_path_prefix: /etherpad
+```
+
+**NOTE**: When using the old `matrix-nginx-proxy` reverse-proxy instead of Traefik, you have only 2 choices:
+
+- serving Etherpad at its own dedicated domain:
+  - you need to set the domain using the `matrix_server_fqn_etherpad` variable (not `etherpad_hostname`)
+  - you must use `etherpad_path_prefix: /`
+- serving Etherpad at the [Dimension](configuring-playbook-dimension.md) integration manager's domain (`matrix_server_fqn_dimension`)
+  - you need to have Dimension enabled
+  - you need to add `etherpad_path_prefix: /etherpad` or another prefix (different than `/`)
+  - you need to add `etherpad_nginx_proxy_dimension_integration_enabled: true` to enable this integration
+
+
+## Adjusting DNS records
+
+Once you've decided on the domain and path, **you may need to adjust your DNS** records to point the Etherpad domain to the Matrix server.
+
+If you've decided to reuse the `matrix.` domain, you won't need to do any extra DNS configuration.
 
 
 ## Installing
@@ -21,48 +43,51 @@ We recomend that you go with the default (`standalone`) mode, which makes Etherp
 [Etherpad](https://etherpad.org) installation is disabled by default. You can enable it in your configuration file (`inventory/host_vars/matrix.<your-domain>/vars.yml`):
 
 ```yaml
-matrix_etherpad_enabled: true
+etherpad_enabled: true
-
-# Uncomment below if you'd like to install Etherpad on the Dimension domain (not recommended)
-# matrix_etherpad_mode: dimension
 
 # Uncomment below to enable the admin web UI
-# matrix_etherpad_admin_username: admin
+# etherpad_admin_username: admin
-# matrix_etherpad_admin_password: some-password
+# etherpad_admin_password: some-password
 ```
 
-If enabled, the admin web-UI should then be available on `https://etherpad.<your-domain>/admin` (or `https://dimension.<your-domain>/etherpad/admin`, if `matrix_etherpad_mode: dimension`)
+Then, [run the installation process](installing.md) again (e.g. `just install-all`).
 
 
-## Managing / Deleting old pads
+## Usage
+
+The Etherpad UI should be available at `https://etherpad.<your-domain>`, while the admin UI (if enabled) should then be available at `https://etherpad.<your-domain>/admin`.
+
+If you've [decided on another hostname or path-prefix](#decide-on-a-domain-and-path) (e.g. `https://matrix.DOMAIN/etherpad`), adjust these URLs accordingly before usage.
+
+
+### Managing / Deleting old pads
 
 If you want to manage and remove old unused pads from Etherpad, you will first need to able Admin access as described above.
 
-Then from the plugin manager page (`https://etherpad.<your-domain>/admin/plugins` or `https://dimension.<your-domain>/etherpad/admin/plugins`), install the `adminpads2` plugin. Once installed, you should have a "Manage pads" section in the Admin web-UI.
+Then from the plugin manager page (`https://etherpad.<your-domain>/admin/plugins`, install the `adminpads2` plugin. Once installed, you should have a "Manage pads" section in the Admin web-UI.
 
 
-## How to use Etherpad widgets without an Integration Manager (like Dimension)
+### How to use Etherpad widgets without an Integration Manager (like Dimension)
 
 This is how it works in Element, it might work quite similar with other clients:
 
 To integrate a standalone etherpad in a room, create your pad by visiting `https://etherpad.DOMAIN`. When the pad opens, copy the URL and send a command like this to the room: `/addwidget URL`. You will then find your integrated Etherpad within the right sidebar in the `Widgets` section.
 
 
-## Set Dimension default to the self-hosted Etherpad (optional)
+### Set Dimension default to the self-hosted Etherpad (optional)
 
 If you decided to install [Dimension integration manager](configuring-playbook-dimension.md) alongside Etherpad, the Dimension administrator users can configure the default URL template.
 The Dimension configuration menu can be accessed with the sprocket icon as you begin to add a widget to a room in Element. There you will find the Etherpad Widget Configuration action beneath the _Widgets_ tab.
 
 
-### Removing the integrated Etherpad chat
+#### Removing the integrated Etherpad chat
 
-If you wish to disable the Etherpad chat button, you can do it by appending `?showChat=false` to the end of the pad URL, or the template. Examples:
+If you wish to disable the Etherpad chat button, you can do it by appending `?showChat=false` to the end of the pad URL, or the template.
-- `https://etherpad.<your-domain>/p/$roomId_$padName?showChat=false` (for the default - `matrix_etherpad_mode: standalone`)
 
-- `https://dimension.<your-domain>/etherpad/p/$roomId_$padName?showChat=false` (for `matrix_etherpad_mode: dimension`)
+Example: `https://etherpad.<your-domain>/p/$roomId_$padName?showChat=false`
 
 
-### Known issues
+## Known issues
 
 If your Etherpad widget fails to load, this might be due to Dimension generating a Pad name so long, the Etherpad app rejects it.
 `$roomId_$padName` can end up being longer than 50 characters. You can avoid having this problem by altering the template so it only contains the three word random identifier `$padName`.

docs/configuring-playbook-nginx.md

@@ -1,7 +1,6 @@
 # Configure Nginx (optional, advanced)
 
-By default, this playbook installs its own nginx webserver (in a Docker container) which listens on ports 80 and 443.
+**Note**: the playbook is [in the process of moving to Traefik](../CHANGELOG.md#reverse-proxy-configuration-changes-and-initial-traefik-support). Traefik is already the default reverse-proxy for new installations and existing users are also strongly encouraged to switch to Traefik. As such, this **nginx documentation below may be incomplete or misleading**.
-If that's alright, you can skip this.
 
 
 ## Using Nginx status

docs/configuring-playbook-ntfy.md

@@ -15,17 +15,23 @@ Add the following configuration to your `inventory/host_vars/matrix.DOMAIN/vars.
 
 ```yaml
 # Enabling it is the only required setting
-matrix_ntfy_enabled: true
+ntfy_enabled: true
 
-# Some other options
+# This is the default hostname.
-matrix_server_fqn_ntfy: "ntfy.{{ matrix_domain }}"
+# Uncomment the line below and change it, if you'd like.
-matrix_ntfy_configuration_extension_yaml: |
+# matrix_server_fqn_ntfy: "ntfy.{{ matrix_domain }}"
-  log_level: DEBUG
+
+# Uncomment to enable the ntfy web app (disabled by default)
+# ntfy_web_root: app  # defaults to "disable"
+
+# Uncomment and change to inject additional configuration options.
+# ntfy_configuration_extension_yaml: |
+#   log_level: DEBUG
 ```
 
-For a more complete list of variables that you could override, see `roles/custom/matrix-ntfy/defaults/main.yml`.
+For a more complete list of variables that you could override, see the [`defaults/main.yml` file](https://gitlab.com/etke.cc/roles/ntfy/-/blob/main/defaults/main.yml) of the ntfy Ansible role.
 
-For a complete list of ntfy config options that you could put in `matrix_ntfy_configuration_extension_yaml`, see the [ntfy config documentation](https://ntfy.sh/docs/config/#config-options).
+For a complete list of ntfy config options that you could put in `ntfy_configuration_extension_yaml`, see the [ntfy config documentation](https://ntfy.sh/docs/config/#config-options).
 
 
 ## Installing
@@ -78,6 +84,12 @@ If the matrix app asks, "Choose a distributor: FCM Fallback or ntfy", then choos
 
 If the matrix app doesn't seem to pick it up, try restarting it and try the Troubleshooting section below.
 
+### Web App
+
+ntfy also has a web app to subscribe to and push to topics from the browser. This may be helpful to further troubleshoot UnifiedPush problems or to use ntfy for other purposes. The web app only runs in the browser locally (after downloading the JavaScript).
+
+The web app is disabled in this playbook by default as the expectation is that most users won't use it. You can either use the [official hosted one](https://ntfy.sh/app) (it supports using other public reachable ntfy instances) or host it yourself by setting `ntfy_web_root: "app"` and re-running Ansible.
+
 
 ## Troubleshooting
 

docs/configuring-playbook-own-webserver.md

@@ -1,167 +1,49 @@
-# Using your own webserver, instead of this playbook's nginx proxy (optional, advanced)
+# Using your own webserver, instead of this playbook's Traefik reverse-proxy (optional, advanced)
 
-**Note**: the playbook is [in the process of moving to Traefik](../CHANGELOG.md#reverse-proxy-configuration-changes-and-initial-traefik-support). The documentation below should be correct, but things will change soon.
+**Note**: the playbook is [in the process of moving to Traefik](../CHANGELOG.md#reverse-proxy-configuration-changes-and-initial-traefik-support). The **documentation below may be incomplete or misleading**.
 
 By default, this playbook installs its own nginx webserver (called `matrix-nginx-proxy`, in a Docker container) which listens on ports 80 and 443.
 If that's alright, you can skip this.
 
-If you don't want this playbook's nginx webserver to take over your server's 80/443 ports like that,
+Soon, this default will change and the playbook will install its own [Traefik](https://traefik.io/) reverse-proxy instead.
-and you'd like to use your own webserver (be it nginx, Apache, Varnish Cache, etc.), you can.
 
-There are **2 ways you can go about it**, if you'd like to use your own webserver:
+## Traefik
 
-- [Method 1: Disabling the integrated nginx reverse-proxy webserver](#method-1-disabling-the-integrated-nginx-reverse-proxy-webserver)
+[Traefik](https://traefik.io/) will be the default reverse-proxy for the playbook in the near future.
 
-- [Method 2: Fronting the integrated nginx reverse-proxy webserver with another reverse-proxy](#method-2-fronting-the-integrated-nginx-reverse-proxy-webserver-with-another-reverse-proxy)
+There are 2 ways to use Traefik with this playbook, as described below.
 
+### Traefik managed by the playbook
 
-## Method 1: Disabling the integrated nginx reverse-proxy webserver
+To switch to Traefik now, use configuration like this:
-
-This method is about completely disabling the integrated nginx reverse-proxy webserver and replicating its behavior using another webserver.
-
-If that other webserver is `nginx`, you'd be able to include configuration files generated by the playbook into your `nginx` webserver.
-
-If you'd like to use another webserver (not `nginx`), you'd need to do things manually. We have examples for other webservers below.
-
-For an alternative (which keeps `matrix-nginx-proxy` around and connects your other reverse-proxy with it), make sure to check Method #2.
-
-### Preparation
-
-No matter which external webserver you decide to go with, you'll need to:
-
-1) Make sure your web server user (something like `http`, `apache`, `www-data`, `nginx`) is part of the `matrix` group. You should run something like this: `usermod -a -G matrix nginx`. This allows your webserver user to access files owned by the `matrix` group. When using an external nginx webserver, this allows it to read configuration files from `/matrix/nginx-proxy/conf.d`. When using another server, it would make other files, such as `/matrix/static-files/.well-known`, accessible to it.
-
-2) Edit your configuration file (`inventory/host_vars/matrix.<your-domain>/vars.yml`)
-   - to disable the integrated nginx server:
-
-        ```yaml
-        matrix_nginx_proxy_enabled: false
-        ```
-    - if using an external server on another host, add the `<service>_http_host_bind_port` or `<service>_http_bind_port` variables for the services that will be exposed by the external server on the other host. The actual name of the variable is listed in the `roles/<service>/defaults/vars.yml` file for each service. Most variables follow the `<service>_http_host_bind_port` format.
-
-      These variables will make Docker expose the ports on all network interfaces instead of localhost only.
-      [Keep in mind that there are some security concerns if you simply proxy everything.](https://github.com/matrix-org/synapse/blob/master/docs/reverse_proxy.md#synapse-administration-endpoints)
-
-      Here are the variables required for the default configuration (Synapse and Element)
-       ```
-		matrix_synapse_reverse_proxy_companion_container_client_api_host_bind_port: '0.0.0.0:8008'
-		matrix_synapse_reverse_proxy_companion_container_federation_api_host_bind_port: '0.0.0.0:8048'
-        matrix_client_element_container_http_host_bind_port: "0.0.0.0:8765"
-       ```
-
-3) **If you'll manage SSL certificates by yourself**, edit your configuration file (`inventory/host_vars/matrix.<your-domain>/vars.yml`) to disable SSL certificate retrieval:
-
-```yaml
-matrix_ssl_retrieval_method: none
-```
-
-**Note**: During [installation](installing.md), unless you've disabled SSL certificate management (`matrix_ssl_retrieval_method: none`), the playbook would need 80 to be available, in order to retrieve SSL certificates. **Please manually stop your other webserver while installing**. You can start it back up afterwards.
-
-### Using your own external nginx webserver
-
-Once you've followed the [Preparation](#preparation) guide above, it's time to set up your external nginx server.
-
-Even with `matrix_nginx_proxy_enabled: false`, the playbook still generates some helpful files for you in `/matrix/nginx-proxy/conf.d`.
-Those configuration files are adapted for use with an external web server (one not running in the container network).
-
-You can most likely directly use the config files installed by this playbook at: `/matrix/nginx-proxy/conf.d`. Just include them in your own `nginx.conf` like this: `include /matrix/nginx-proxy/conf.d/*.conf;`
-
-Note that if your nginx version is old, it might not like our default choice of SSL protocols (particularly the fact that the brand new `TLSv1.3` protocol is enabled). You can override the protocol list by redefining the `matrix_nginx_proxy_ssl_protocols` variable. Example:
-
-```yaml
-# Custom protocol list (removing `TLSv1.3`) to suit your nginx version.
-matrix_nginx_proxy_ssl_protocols: "TLSv1.2"
-```
-
-If you are experiencing issues, try updating to a newer version of Nginx. As a data point in May 2021 a user reported that Nginx 1.14.2 was not working for them. They were getting errors about socket leaks. Updating to Nginx 1.19 fixed their issue.
-
-### Using your own external Apache webserver
-
-Once you've followed the [Preparation](#preparation) guide above, you can take a look at the [examples/apache](../examples/apache) directory for a sample configuration.
-
-### Using your own external caddy webserver
-
-After following  the [Preparation](#preparation) guide above, you can take a look at the [examples/caddy](../examples/caddy) directory and [examples/caddy2](../examples/caddy2) directory for a sample configuration for Caddy v1 and v2, respectively.
-
-### Using your own HAproxy reverse proxy
-After following  the [Preparation](#preparation) guide above, you can take a look at the [examples/haproxy](../examples/haproxy) directory for a sample configuration. In this case HAproxy is used as a reverse proxy and a simple Nginx container is used to serve statically `.well-known` files.
-
-### Using another external webserver
-
-Feel free to look at the [examples/apache](../examples/apache) directory, or the [template files in the matrix-nginx-proxy role](../roles/custom/matrix-nginx-proxy/templates/nginx/conf.d/).
-
-
-## Method 2: Fronting the integrated nginx reverse-proxy webserver with another reverse-proxy
-
-This method is about leaving the integrated nginx reverse-proxy webserver be, but making it not get in the way (using up important ports, trying to retrieve SSL certificates, etc.).
-
-If you wish to use another webserver, the integrated nginx reverse-proxy webserver usually gets in the way because it attempts to fetch SSL certificates and binds to ports 80, 443 and 8448 (if Matrix Federation is enabled).
-
-You can disable such behavior and make the integrated nginx reverse-proxy webserver only serve traffic locally (or over a local network).
-
-You would need some configuration like this:
-
-```yaml
-matrix_playbook_reverse_proxy_type: other-on-same-host
-
-# Do not listen for HTTP on port 80 globally (default), listen on the loopback interface.
-# If you'd like, you can make it use the local network as well and reverse-proxy from another local machine.
-matrix_nginx_proxy_container_http_host_bind_port: '127.0.0.1:81'
-
-# Likewise, expose the Matrix Federation port on the loopback interface.
-# Since `matrix_nginx_proxy_https_enabled` is set to `false`, this federation port will serve HTTP traffic.
-# If you'd like, you can make it use the local network as well and reverse-proxy from another local machine.
-#
-# You'd most likely need to expose it publicly on port 8448 (8449 was chosen for the local port to prevent overlap).
-matrix_nginx_proxy_container_federation_host_bind_port: '127.0.0.1:8449'
-
-# Coturn relies on SSL certificates that have already been obtained.
-# Since we don't obtain any certificates in this `other-on-same-host` mode, it won't work by default.
-# An alternative is to tweak some of: `matrix_coturn_tls_enabled`, `matrix_coturn_tls_cert_path` and `matrix_coturn_tls_key_path`.
-matrix_coturn_enabled: false
-```
-
-With this, nginx would still be in use, but it would not bother with anything SSL related or with taking up public ports.
-
-All services would be served locally on `127.0.0.1:81` and `127.0.0.1:8449` (as per the example configuration above).
-
-You can then set up another reverse-proxy server on ports 80/443/8448 for all of the expected domains and make traffic go to these local ports.
-The expected domains vary depending on the services you have enabled (`matrix.DOMAIN` for sure; `element.DOMAIN`, `dimension.DOMAIN` and `jitsi.DOMAIN` are optional).
-
-### Sample configuration for running behind Traefik 2.0
-
-To run behind Traefik, you can:
-
-- use a [Playbook-managed Traefik installation](#playbook-managed-traefik-installation)
-- or, use [Your own Traefik server (not managed by the playbook)](#your-own-traefik-server-not-managed-by-the-playbook)
-
-#### Playbook-managed Traefik installation
-
-The playbook can install and manage Traefik for you using the [com.devture.ansible.role.traefik](https://github.com/devture/com.devture.ansible.role.traefik) role.
-
-It's simplest if you go with this method. You will need the following configuration:
 
 ```yaml
 matrix_playbook_reverse_proxy_type: playbook-managed-traefik
 
-devture_traefik_ssl_email_address: YOUR_EMAIL_ADDRESS
+devture_traefik_config_certificatesResolvers_acme_email: YOUR_EMAIL_ADDRESS
 ```
 
-#### Your own Traefik server (not managed by the playbook)
+This will install Traefik in the place of `matrix-nginx-proxy`. Traefik will manage SSL certificates for all services seamlessly.
 
-If you'd like to run Traefik yourself, you can use configuration like this:
+**Note**: during the transition period, `matrix-nginx-proxy` will still be installed in local-only mode. Do not be alarmed to see `matrix-nginx-proxy` running even when you've chosen Traefik as your reverse-proxy. In the future, we'll be able to run without nginx, but we're not there yet.
+
+### Traefik managed by you
 
 ```yaml
 matrix_playbook_reverse_proxy_type: other-traefik-container
 
 matrix_playbook_reverse_proxyable_services_additional_network: your-traefik-network
+
+devture_traefik_certs_dumper_ssl_dir_path: "/path/to/your/traefiks/acme.json/directory"
 ```
 
 In this mode all roles will still have Traefik labels attached. You will, however, need to configure your Traefik instance and its entrypoints.
 
 By default, the playbook congiures services use a `web-secure` (443) and `matrix-federation` (8448) entrypoints, as well as a `default` certificate resolver.
 
-Below is some configuration for running Traefik yourself (although we recommend using a [playbook-managed Traefik installation](#playbook-managed-traefik-installation)).
+You need to configure 3 entrypoints for your Traefik server: `web` (TCP port `80`), `web-secure` (TCP port `443`) and `matrix-federation` (TCP port `8448`).
+
+Below is some configuration for running Traefik yourself, although we recommend using [Traefik managed by the playbook](#traefik-managed-by-the-playbook).
 
 Note that this configuration on its own does **not** redirect traffic on port 80 (plain HTTP) to port 443 for HTTPS, which may cause some issues, since the built-in Nginx proxy usually does this. If you are not already doing this in Traefik, it can be added to Traefik in a [file provider](https://docs.traefik.io/v2.0/providers/file/) as follows:
 
@@ -217,3 +99,128 @@ networks:
   traefik:
     external: true
 ```
+
+## Another webserver
+
+If you don't wish to use Traefik or `matrix-nginx-proxy`, you can also use your own webserver.
+
+Doing this is possible, but requires manual work.
+
+There are 2 ways to go about it:
+
+- (recommended) [Fronting the integrated reverse-proxy webserver with another reverse-proxy](#fronting-the-integrated-reverse-proxy-webserver-with-another-reverse-proxy) - using a playbook-managed reverse-proxy (either `matrix-nginx-proxy` or Traefik), disabling SSL termination for it, exposing this reverse-proxy on a few local ports (e.g. `127.0.0.1:81`, etc.) and forwarding traffic from your own webserver to those few ports
+
+- (difficult) [Using no reverse-proxy on the Matrix side at all](#using-no-reverse-proxy-on-the-matrix-side-at-all) disabling all playbook-managed reverse-proxies (no `matrix-nginx-proxy`, no Traefik)
+
+
+### Fronting the integrated reverse-proxy webserver with another reverse-proxy
+
+This method is about leaving the integrated reverse-proxy webserver be, but making it not get in the way (using up important ports, trying to retrieve SSL certificates, etc.).
+
+If you wish to use another webserver, the integrated reverse-proxy webserver usually gets in the way because it attempts to fetch SSL certificates and binds to ports 80, 443 and 8448 (if Matrix Federation is enabled).
+
+You can disable such behavior and make the integrated reverse-proxy webserver only serve traffic locally (or over a local network).
+
+This is the recommended way for using another reverse-proxy, because the integrated one would act as a black box and wire all Matrix services correctly. You would only need to reverse-proxy a few individual domains and ports over to it.
+
+To front Traefik with another reverse-proxy, you would need some configuration like this:
+
+```yaml
+matrix_playbook_reverse_proxy_type: playbook-managed-traefik
+
+# Ensure that public urls use https
+matrix_playbook_ssl_enabled: true
+
+# Disable the web-secure (port 443) endpoint, which also disables SSL certificate retrieval
+devture_traefik_config_entrypoint_web_secure_enabled: false
+
+# If your reverse-proxy runs on another machine, consider using `0.0.0.0:81`, just `81` or `SOME_IP_ADDRESS_OF_THIS_MACHINE:81`
+devture_traefik_container_web_host_bind_port: '127.0.0.1:81'
+
+# We bind to `127.0.0.1` by default (see above), so trusting `X-Forwarded-*` headers from
+# a reverse-proxy running on the local machine is safe enough.
+devture_traefik_config_entrypoint_web_forwardedHeaders_insecure: true
+
+# Or, if you're publishing the port (`devture_traefik_container_web_host_bind_port` above) to a public network interfaces:
+# - remove the `devture_traefik_config_entrypoint_web_forwardedHeaders_insecure` variable definition above
+# - uncomment and adjust the line below
+# devture_traefik_config_entrypoint_web_forwardedHeaders_trustedIPs: ['IP-ADDRESS-OF-YOUR-REVERSE-PROXY']
+
+# Likewise (to `devture_traefik_container_web_host_bind_port` above),
+# if your reverse-proxy runs on another machine, consider changing the `host_bind_port` setting below.
+devture_traefik_additional_entrypoints_auto:
+  - name: matrix-federation
+    port: 8449
+    host_bind_port: '127.0.0.1:8449'
+    config: {}
+	# If your reverse-proxy runs on another machine, remove the config above and use this config instead:
+	# config:
+	#   forwardedHeaders:
+	#     insecure: true
+	#     # trustedIPs: ['IP-ADDRESS-OF-YOUR-REVERSE-PROXY']
+```
+
+For an example where the playbook's Traefik reverse-proxy is fronted by [Nginx](https://nginx.org/) running on the same server, see [Nginx reverse-proxy fronting the playbook's Traefik](../examples/nginx/README.md).
+
+
+### Using no reverse-proxy on the Matrix side at all
+
+Instead of [Fronting the integrated reverse-proxy webserver with another reverse-proxy](#fronting-the-integrated-reverse-proxy-webserver-with-another-reverse-proxy), you can also go another way -- completely disabling the playbook-managed reverse-proxy. You would then need to reverse-proxy from your own webserver directly to Matrix services.
+
+This is more difficult, as you would need to handle the configuration for each service manually. Enabling additional services would come with extra manual work you need to do.
+
+If your webserver is on the same machine, sure your web server user (something like `http`, `apache`, `www-data`, `nginx`) is part of the `matrix` group. You should run something like this: `usermod -a -G matrix nginx`. This allows your webserver user to access files owned by the `matrix` group. When using an external nginx webserver, this allows it to read configuration files from `/matrix/nginx-proxy/conf.d`. When using another server, it would make other files, such as `/matrix/static-files/.well-known`, accessible to it.
+
+#### Using your own nginx reverse-proxy running on the same machine
+
+**WARNING**: this type of setup is not maintained and will be removed in the future. We recommend that you go for [Fronting the integrated reverse-proxy webserver with another reverse-proxy](#fronting-the-integrated-reverse-proxy-webserver-with-another-reverse-proxy) instead.
+
+If you'll be using `nginx` running on the same machine (not in a container), you can make the playbook help you generate configuration for `nginx` with this configuration:
+
+```yaml
+matrix_playbook_reverse_proxy_type: other-nginx-non-container
+
+# If you want https configured in /matrix/nginx-proxy/conf.d/
+matrix_nginx_proxy_https_enabled: true
+
+# If you will manage SSL certificates yourself, uncomment the line below
+# matrix_ssl_retrieval_method: none
+
+# If you're using an old nginx version, consider using a custom protocol list
+# (removing `TLSv1.3` that is enabled by default) to suit your nginx version.
+# matrix_nginx_proxy_ssl_protocols: "TLSv1.2"
+```
+
+You can most likely directly use the config files installed by this playbook at: `/matrix/nginx-proxy/conf.d`. Just include them in your own `nginx.conf` like this: `include /matrix/nginx-proxy/conf.d/*.conf;`
+
+#### Using your own reverse-proxy running on the same machine or elsewhere
+
+**WARNING**: this is difficult to set up, likely not very well supported and will be removed in the future. We recommend that you go for [Fronting the integrated reverse-proxy webserver with another reverse-proxy](#fronting-the-integrated-reverse-proxy-webserver-with-another-reverse-proxy) instead.
+
+To reverse-proxy manually for each service, use configuration like this:
+
+```yaml
+# If your reverse-proxy runs on the same machine:
+matrix_playbook_reverse_proxy_type: other-on-same-host
+
+# Or, if it runs on another machine:
+# matrix_playbook_reverse_proxy_type: other-on-another-host
+
+# Or, optionally customize the network interface prefix (note the trailing `:` character).
+# For other-on-same-host, the interface defaults to `127.0.0.1:`.
+# For other-on-another-host, the interface defaults to `0.0.0.0:`.
+# matrix_playbook_service_host_bind_interface_prefix: '192.168.30.4:'
+```
+
+With this configuration, each service will be exposed on a custom port. Example:
+
+- Synapse will be exposed on port `8008`
+- [Grafana](configuring-playbook-prometheus-grafana.md) will be exposed on port `3000`
+- [synapse-admin](configuring-playbook-synapse-admin.md) will be exposed on port `8766`
+
+You can capture traffic for these services and forward it to their port.
+Some of these services are configured with certain default expecations with regard to hostname, path, etc., so it's not completely arbitrary where you can host them (unless you change the defaults).
+
+For each new playbook service that you enable, you'll need special handling.
+
+The [`examples/`](../examples/) directory contains examples for various servers: Caddy, Apache, HAproxy, Nginx, etc.

docs/configuring-playbook-postgres-backup.md

@@ -23,8 +23,8 @@ Refer to the table below for additional configuration variables and their defaul
 |`devture_postgres_backup_keep_days`|`7`|Number of daily backups to keep|
 |`devture_postgres_backup_keep_weeks`|`4`|Number of weekly backups to keep|
 |`devture_postgres_backup_keep_months`|`12`|Number of monthly backups to keep|
-|`devture_postgres_base_path` | `"{{ matrix_base_data_path }}/postgres-backup"` | Base path for postgres-backup. Also see `devture_postgres_data_path` |
+|`devture_postgres_backup_base_path` | `"{{ matrix_base_data_path }}/postgres-backup"` | Base path for postgres-backup. Also see `devture_postgres_backup_data_path` |
-|`devture_postgres_data_path` | `"{{ devture_postgres_base_path }}/data"` | Storage path for postgres-backup database backups |
+|`devture_postgres_backup_data_path` | `"{{ devture_postgres_backup_base_path }}/data"` | Storage path for postgres-backup database backups |
 
 
 ## Installing

docs/configuring-playbook-prometheus-grafana.md

@@ -7,7 +7,7 @@ You can enable this with the following settings in your configuration file (`inv
 Remember to add `stats.<your-domain>` to DNS as described in [Configuring DNS](configuring-dns.md) before running the playbook.
 
 ```yaml
-matrix_prometheus_enabled: true
+prometheus_enabled: true
 
 # You can remove this, if unnecessary.
 prometheus_node_exporter_enabled: true
@@ -18,16 +18,16 @@ prometheus_postgres_exporter_enabled: true
 # You can remove this, if unnecessary.
 matrix_prometheus_nginxlog_exporter_enabled: true
 
-matrix_grafana_enabled: true
+grafana_enabled: true
 
-matrix_grafana_anonymous_access: false
+grafana_anonymous_access: false
 
 # This has no relation to your Matrix user id. It can be any username you'd like.
 # Changing the username subsequently won't work.
-matrix_grafana_default_admin_user: "some_username_chosen_by_you"
+grafana_default_admin_user: "some_username_chosen_by_you"
 
 # Changing the password subsequently won't work.
-matrix_grafana_default_admin_password: "some_strong_password_chosen_by_you"
+grafana_default_admin_password: "some_strong_password_chosen_by_you"
 ```
 
 By default, a [Grafana](https://grafana.com/) web user-interface will be available at `https://stats.<your-domain>`.
@@ -39,13 +39,13 @@ The retention policy of Prometheus metrics is [15 days by default](https://prome
 
 Name | Description
 -----|----------
-`matrix_prometheus_enabled`|[Prometheus](https://prometheus.io) is a time series database. It holds all the data we're going to talk about.
+`prometheus_enabled`|[Prometheus](https://prometheus.io) is a time series database. It holds all the data we're going to talk about.
 `prometheus_node_exporter_enabled`|[Node Exporter](https://prometheus.io/docs/guides/node-exporter/) is an addon of sorts to Prometheus that collects generic system information such as CPU, memory, filesystem, and even system temperatures
 `prometheus_postgres_exporter_enabled`|[Postgres Exporter](configuring-playbook-prometheus-postgres.md) is an addon of sorts to expose Postgres database metrics to Prometheus.
 `matrix_prometheus_nginxlog_exporter_enabled`|[NGINX Log Exporter](configuring-playbook-prometheus-nginxlog.md) is an addon of sorts to expose NGINX logs to Prometheus.
-`matrix_grafana_enabled`|[Grafana](https://grafana.com/) is the visual component. It shows (on the `stats.<your-domain>` subdomain) the dashboards with the graphs that we're interested in
+`grafana_enabled`|[Grafana](https://grafana.com/) is the visual component. It shows (on the `stats.<your-domain>` subdomain) the dashboards with the graphs that we're interested in
-`matrix_grafana_anonymous_access`|By default you need to log in to see graphs. If you want to publicly share your graphs (e.g. when asking for help in [`#synapse:matrix.org`](https://matrix.to/#/#synapse:matrix.org?via=matrix.org&via=privacytools.io&via=mozilla.org)) you'll want to enable this option.
+`grafana_anonymous_access`|By default you need to log in to see graphs. If you want to publicly share your graphs (e.g. when asking for help in [`#synapse:matrix.org`](https://matrix.to/#/#synapse:matrix.org?via=matrix.org&via=privacytools.io&via=mozilla.org)) you'll want to enable this option.
-`matrix_grafana_default_admin_user`<br>`matrix_grafana_default_admin_password`|By default Grafana creates a user with `admin` as the username and password. If you feel this is insecure and you want to change it beforehand, you can do that here
+`grafana_default_admin_user`<br>`grafana_default_admin_password`|By default Grafana creates a user with `admin` as the username and password. If you feel this is insecure and you want to change it beforehand, you can do that here
 
 
 ## Security and privacy
@@ -57,7 +57,7 @@ Most of our docker containers run with limited system access, but the `prometheu
 
 ## Collecting metrics to an external Prometheus server
 
-**If the integrated Prometheus server is enabled** (`matrix_prometheus_enabled: true`), metrics are collected by it from each service via communication that happens over the container network. Each service does not need to expose its metrics "publicly".
+**If the integrated Prometheus server is enabled** (`prometheus_enabled: true`), metrics are collected by it from each service via communication that happens over the container network. Each service does not need to expose its metrics "publicly".
 
 When you'd like **to collect metrics from an external Prometheus server**, you need to expose service metrics outside of the container network.
 

docs/configuring-playbook-prometheus-nginxlog.md

@@ -12,16 +12,16 @@ You can enable this role by adding the following settings in your configuration
 matrix_prometheus_nginxlog_exporter_enabled: true
 
 # required depency
-matrix_prometheus_enabled: true
+prometheus_enabled: true
 
 # optional for visualization
-matrix_grafana_enabled: true
+grafana_enabled: true
 ```
 
 x | Prerequisites | Variable | Description
 |:--:|:--:|:--:|:--|
-**REQUIRED** | `matrix-prometheus`| `matrix_prometheus_enabled`|[Prometheus](https://prometheus.io) is a time series database. It holds all the data we're going to talk about.
+**REQUIRED** | `matrix-prometheus`| `prometheus_enabled`|[Prometheus](https://prometheus.io) is a time series database. It holds all the data we're going to talk about.
-_Optional_ | [`matrix-grafana`](configuring-playbook-prometheus-grafana.md) | [`matrix_grafana_enabled`](configuring-playbook-prometheus-grafana.md)|[Grafana](https://grafana.com) is the visual component. It shows (on the `stats.<your-domain>` subdomain) graphs that we're interested in. When enabled the `NGINX PROXY` dashboard is automatically added.
+_Optional_ | [`matrix-grafana`](configuring-playbook-prometheus-grafana.md) | [`grafana_enabled`](configuring-playbook-prometheus-grafana.md)|[Grafana](https://grafana.com) is the visual component. It shows (on the `stats.<your-domain>` subdomain) graphs that we're interested in. When enabled the `NGINX PROXY` dashboard is automatically added.
 
 ## Docker Image Compatibility
 
@@ -56,4 +56,4 @@ The following variables may be of interest:
 
 Name | Description
 -----|----------
-`matrix_nginx_proxy_proxy_matrix_metrics_enabled`|Set this to `true` to enable metrics exposure for various services on `https://matrix.DOMAIN/metrics/*`. Refer to the individual `matrix_SERVICE_metrics_proxying_enabled` variables below for exposing metrics for each individual service.
+`matrix_nginx_proxy_proxy_matrix_metrics_enabled`|Set this to `true` to enable metrics exposure for various services on `https://matrix.DOMAIN/metrics/*`. Refer to the individual `matrix_SERVICE_metrics_proxying_enabled` variables below for exposing metrics for each individual service.

docs/configuring-playbook-rageshake.md

@@ -0,0 +1,65 @@
+# Setting up Rageshake (optional)
+
+The playbook can install and configure the [rageshake](https://github.com/matrix-org/rageshake) bug report server for you.
+
+This is useful if you're developing your own applications and would like to collect bug reports for them.
+
+
+## Decide on a domain and path
+
+By default, Rageshake is configured to use its own dedicated domain (`rageshake.DOMAIN`) and requires you to [adjust your DNS records](#adjusting-dns-records).
+
+You can override the domain and path like this:
+
+```yaml
+# Switch to the domain used for Matrix services (`matrix.DOMAIN`),
+# so we won't need to add additional DNS records for Rageshake.
+matrix_rageshake_hostname: "{{ matrix_server_fqn_matrix }}"
+
+# Expose under the /rageshake subpath
+matrix_rageshake_path_prefix: /rageshake
+```
+
+**NOTE**: When using `matrix-nginx-proxy` instead of Traefik, you won't be able to override the path prefix. You can only override the domain, but that needs to happen using another variable: `matrix_server_fqn_rageshake` (e.g. `matrix_server_fqn_rageshake: "some-domain.{{ matrix_domain }}"`).
+
+
+## Adjusting DNS records
+
+Once you've decided on the domain and path, **you may need to adjust your DNS** records to point the Rageshake domain to the Matrix server.
+
+If you've decided to reuse the `matrix.` domain, you won't need to do any extra DNS configuration.
+
+
+## Enabling the Rageshake service
+
+Add the following configuration to your `inventory/host_vars/matrix.DOMAIN/vars.yml` file (adapt to your needs):
+
+```yaml
+matrix_rageshake_enabled: true
+```
+
+Rageshake has various options which don't have dedicated Ansible variables. You can see the full list of options in the [`rageshake.sample.yaml` file](https://github.com/matrix-org/rageshake/blob/master/rageshake.sample.yaml).
+
+To set these, you can make use of the  `matrix_rageshake_configuration_extension_yaml` variable like this:
+
+```yaml
+matrix_rageshake_configuration_extension_yaml: |
+  github_token: secrettoken
+
+  github_project_mappings:
+     my-app: octocat/HelloWorld
+```
+
+
+## Installing
+
+After configuring the playbook, run the [installation](installing.md) command again:
+
+```
+ansible-playbook -i inventory/hosts setup.yml --tags=setup-all,start
+```
+
+
+## Usage
+
+Refer to the [rageshake documentation](https://github.com/matrix-org/rageshake) for available APIs, etc.

docs/configuring-playbook-sliding-sync-proxy.md

@@ -0,0 +1,62 @@
+# Setting up Sliding Sync Proxy (optional)
+
+The playbook can install and configure [sliding-sync](https://github.com/matrix-org/sliding-sync) proxy for you.
+
+Sliding Sync is an implementation of [MSC3575](https://github.com/matrix-org/matrix-spec-proposals/blob/kegan/sync-v3/proposals/3575-sync.md) and a prerequisite for running the new (**still beta**) Element X clients ([Element X iOS](https://github.com/vector-im/element-x-ios) and [Element X Android](https://github.com/vector-im/element-x-android)).
+
+See the project's [documentation](https://github.com/matrix-org/sliding-sync) to learn more.
+
+Element X iOS is [available on TestFlight](https://testflight.apple.com/join/uZbeZCOi).
+
+Element X Android requires manual compilation to get it working with a non-`matrix.org` homeseserver. It's also less feature-complete than the iOS version.
+
+**NOTE**: The Sliding Sync proxy **only works with the Traefik reverse-proxy**. If you have an old server installation (from the time `matrix-nginx-proxy` was our default reverse-proxy - `matrix_playbook_reverse_proxy_type: playbook-managed-nginx`), you won't be able to use Sliding Sync.
+
+
+## Decide on a domain and path
+
+By default, the Sliding Sync proxy is configured to be served on the Matrix domain (`matrix.DOMAIN`, controlled by `matrix_server_fqn_matrix`), under the `/sliding-sync` path.
+
+This makes it easy to set it up, **without** having to [adjust your DNS records](#adjusting-dns-records).
+
+If you'd like to run the Sliding Sync proxy on another hostname or path, use the `matrix_sliding_sync_hostname` and `matrix_sliding_sync_path_prefix` variables.
+
+
+## Adjusting DNS records
+
+If you've changed the default hostame, **you may need to adjust your DNS** records.
+
+
+## Adjusting the playbook configuration
+
+Add the following configuration to your `inventory/host_vars/matrix.DOMAIN/vars.yml` file:
+
+```yaml
+matrix_sliding_sync_enabled: true
+```
+
+
+## Installing
+
+After potentially [adjusting DNS records](#adjusting-dns-records) and configuring the playbook, run the [installation](installing.md) command again: `just install-all`.
+
+### External databases
+
+Please note that, if your setup utilizes an external database, you must also establish configuration for the sliding sync proxy. Alter the defaults below to suit your configuration:
+
+```yaml
+matrix_sliding_sync_database_username: 'matrix_sliding_sync'
+matrix_sliding_sync_database_password: ''
+matrix_sliding_sync_database_hostname: ''
+matrix_sliding_sync_database_port: 5432
+matrix_sliding_sync_database_name: 'matrix_sliding_sync'
+```
+
+## Usage
+
+You **don't need to do anything special** to make use of the Sliding Sync Proxy.
+Simply open your client which supports Sliding Sync (like Element X) and log in.
+
+When the Sliding Sync proxy is [installed](#installing), your `/.well-known/matrix/client` file is also updated. A new `org.matrix.msc3575.proxy` section and `url` property are added there and made to point to your Sliding Sync proxy's base URL (e.g. `https://matrix.DOMAIN/sliding-sync`).
+
+This allows clients which support Sliding Sync to detect the Sliding Sync Proxy's URL and make use of it.

docs/configuring-playbook-ssl-certificates.md

@@ -1,112 +1,100 @@
 # Adjusting SSL certificate retrieval (optional, advanced)
 
-By default, this playbook retrieves and auto-renews free SSL certificates from [Let's Encrypt](https://letsencrypt.org/) for the domains it needs (`matrix.<your-domain>` and possibly `element.<your-domain>`)
+By default, this playbook retrieves and auto-renews free SSL certificates from [Let's Encrypt](https://letsencrypt.org/) for the domains it needs (e.g. `matrix.<your-domain>` and others)
 
-Those certificates are used when configuring the nginx reverse proxy installed by this playbook.
+This guide is about using the integrated Traefik server and doesn't apply if you're using [your own webserver](configuring-playbook-own-webserver.md).
-They can also be used for configuring [your own webserver](configuring-playbook-own-webserver.md), in case you're not using the integrated nginx server provided by the playbook.
 
-If you need to retrieve certificates for other domains (e.g. your base domain) or more control over certificate retrieval, read below.
 
-Things discussed in this document:
+## Using staging Let's Encrypt certificates instead of real ones
 
-- [Using self-signed SSL certificates](#using-self-signed-ssl-certificates), if you can't use Let's Encrypt or just need a test setup
+For testing purposes, you may wish to use staging certificates provide by Let's Encrypt.
 
-- [Using your own SSL certificates](#using-your-own-ssl-certificates), if you don't want to or can't use Let's Encrypt certificates, but are still interested in using the integrated nginx reverse proxy server
+You can do this with the following configuration:
 
-- [Not bothering with SSL certificates](#not-bothering-with-ssl-certificates), if you're using [your own webserver](configuring-playbook-own-webserver.md) and would rather this playbook leaves SSL certificate management to you
+```yaml
+devture_traefik_config_certificatesResolvers_acme_use_staging: true
+```
 
-- [Obtaining SSL certificates for additional domains](#obtaining-ssl-certificates-for-additional-domains), if you'd like to host additional domains on the Matrix server and would like the playbook to help you obtain and renew certificates for those domains automatically
+
+## Disabling SSL termination
+
+For testing or other purposes, you may wish to install services without SSL termination and have services exposed to `http://` instead of `https://`.
+
+You can do this with the following configuration:
+
+```yaml
+devture_traefik_config_entrypoint_web_secure_enabled: false
+```
 
 
 ## Using self-signed SSL certificates
 
-For private deployments (not publicly accessible from the internet), you may not be able to use Let's Encrypt certificates.
+If you'd like to use your own SSL certificates, instead of the default (SSL certificates obtained automatically via [ACME](https://en.wikipedia.org/wiki/Automatic_Certificate_Management_Environment) from [Let's Encrypt](https://letsencrypt.org/)):
 
-If self-signed certificates are alright with you, you can ask the playbook to generate such for you with the following configuration:
+- generate your self-signed certificate files
-
+- follow the [Using your own SSL certificates](#using-your-own-ssl-certificates) documentation below
-```yaml
-matrix_ssl_retrieval_method: self-signed
-```
-
-If you get a `Cannot reach homeserver` error in Element, you will have to visit `https://matrix.<your-domain>` in your browser and agree to the certificate exception before you can login.
 
 
 ## Using your own SSL certificates
 
-If you'd like to manage SSL certificates by yourself and have the playbook use your certificate files, you can use the following configuration:
+To use your own SSL certificates with Traefik, you need to:
+
+- disable [ACME](https://en.wikipedia.org/wiki/Automatic_Certificate_Management_Environment) / [Let's Encrypt](https://letsencrypt.org/) support
+- put a custom Traefik configuration file on the server, with the help of this Ansible playbook (via the `matrix-aux` role) or manually
+- register your custom configuration file with Traefik, by adding an extra provider of type [file](https://doc.traefik.io/traefik/providers/file/)
+- put the SSL files on the server, with the help of this Ansible playbook (via the `matrix-aux` role) or manually
 
 ```yaml
-matrix_ssl_retrieval_method: manually-managed
+# Disable ACME / Let's Encrypt support.
-```
+devture_traefik_config_certificatesResolvers_acme_enabled: false
-
+
-With such a configuration, the playbook would expect you to drop the SSL certificate files in the directory specified by `matrix_ssl_config_dir_path` (`/matrix/ssl/config` by default) obeying the following hierarchy:
+# Disabling ACME support (above) automatically disables the creation of the SSL directory.
-
+# Force-enable it here, because we'll add our certificate files there.
-- `<matrix_ssl_config_dir_path>/live/<domain>/fullchain.pem`
+devture_traefik_ssl_dir_enabled: true
-- `<matrix_ssl_config_dir_path>/live/<domain>/privkey.pem`
+
-- `<matrix_ssl_config_dir_path>/live/<domain>/chain.pem`
+# Tell Traefik to load our custom configuration file (certificates.yml).
-
+# The file is created below, in `matrix_aux_file_definitions`.
-where `<domain>` refers to the domains that you need (usually `matrix.<your-domain>` and `element.<your-domain>`).
+# The `/config/..` path is an in-container path, not a path on the host (like `/matrix/traefik/config`). Do not change it!
-
+devture_traefik_configuration_extension_yaml: |
-
+  providers:
-## Not bothering with SSL certificates
+    file:
-
+      filename: /config/certificates.yml
-If you're [using an external web server](configuring-playbook-own-webserver.md) which is not nginx, or you would otherwise want to manage its certificates without this playbook getting in the way, you can completely disable SSL certificate management with the following configuration:
+      watch: true
-
+
-```yaml
+# Use the matrix-aux role to create our custom files on the server.
-matrix_ssl_retrieval_method: none
+# If you'd like to do this manually, you remove this `matrix_aux_file_definitions` variable.
-```
+matrix_aux_file_definitions:
-
+  # Create the privkey.pem file on the server by
-With such a configuration, no certificates will be retrieved at all. You're free to manage them however you want.
+  # uploading a file from the computer where Ansible is running.
-
+  - dest: "{{ devture_traefik_ssl_dir_path }}/privkey.pem"
-
+    src: /path/on/your/Ansible/computer/to/privkey.pem
-## Obtaining SSL certificates for additional domains
+	# Alternatively, comment out `src` above and uncomment the lines below to provide the certificate content inline.
-
+	# Note the indentation level.
-The playbook tries to be smart about the certificates it will obtain for you.
+	# content: |
-
+	#   FILE CONTENT
-By default, it obtains certificates for:
+	#   HERE
-- `matrix.<your-domain>` (`matrix_server_fqn_matrix`)
+
-- possibly for `element.<your-domain>`, unless you have disabled the [Element client component](configuring-playbook-client-element.md) using `matrix_client_element_enabled: false`
+  # Create the cert.pem file on the server
-- possibly for `riot.<your-domain>`, if you have explicitly enabled Riot to Element redirection (for background compatibility) using `matrix_nginx_proxy_proxy_riot_compat_redirect_enabled: true`
+  # uploading a file from the computer where Ansible is running.
-- possibly for `hydrogen.<your-domain>`, if you have explicitly [set up Hydrogen client](configuring-playbook-client-hydrogen.md).
+  - dest: "{{ devture_traefik_ssl_dir_path }}/cert.pem"
-- possibly for `cinny.<your-domain>`, if you have explicitly [set up Cinny client](configuring-playbook-client-cinny.md).
+    src: /path/on/your/Ansible/computer/to/cert.pem
-- possibly for `dimension.<your-domain>`, if you have explicitly [set up Dimension](configuring-playbook-dimension.md).
+	# Alternatively, comment out `src` above and uncomment the lines below to provide the certificate content inline.
-- possibly for `goneb.<your-domain>`, if you have explicitly [set up Go-NEB bot](configuring-playbook-bot-go-neb.md).
+	# Note the indentation level.
-- possibly for `jitsi.<your-domain>`, if you have explicitly [set up Jitsi](configuring-playbook-jitsi.md).
+	# content: |
-- possibly for `stats.<your-domain>`, if you have explicitly [set up Grafana](configuring-playbook-prometheus-grafana.md).
+	#   FILE CONTENT
-- possibly for `sygnal.<your-domain>`, if you have explicitly [set up Sygnal](configuring-playbook-sygnal.md).
+	#   HERE
-- possibly for `ntfy.<your-domain>`, if you have explicitly [set up ntfy](configuring-playbook-ntfy.md).
+
-- possibly for your base domain (`<your-domain>`), if you have explicitly configured [Serving the base domain](configuring-playbook-base-domain-serving.md)
+  # Create the custom Traefik configuration.
-
+  # The `/ssl/..` paths below are in-container paths, not paths on the host (/`matrix/traefik/ssl/..`). Do not change them!
-If you are hosting other domains on the Matrix machine, you can make the playbook obtain and renew certificates for those other domains too.
+  - dest: "{{ devture_traefik_config_dir_path }}/certificates.yml"
-To do that, simply define your own custom configuration like this:
+    content: |
-
+      tls:
-```yaml
+        certificates:
-# In this example, we retrieve 2 extra certificates,
+          - certFile: /ssl/cert.pem
-# one for the base domain (in the `matrix_domain` variable) and one for a hardcoded domain.
+            keyFile: /ssl/privkey.pem
-# Adding any other additional domains (hosted on the same machine) is possible.
+        stores:
-matrix_ssl_additional_domains_to_obtain_certificates_for:
+          default:
-  - '{{ matrix_domain }}'
+            defaultCertificate:
-  - 'another.domain.example.com'
+              certFile: /ssl/cert.pem
-```
+              keyFile: /ssl/privkey.pem
-
-After redefining `matrix_ssl_domains_to_obtain_certificates_for`, to actually obtain certificates you should:
-
-- make sure the web server occupying port 80 is stopped. If you are using matrix-nginx-proxy server (which is the default for this playbook), you need to stop it temporarily by running `systemctl stop matrix-nginx-proxy` on the server.
-
-- re-run the SSL part of the playbook and restart all services: `ansible-playbook -i inventory/hosts setup.yml --tags=setup-ssl,start`
-
-The certificate files would be made available in `/matrix/ssl/config/live/<your-other-domain>/...`.
-
-For automated certificate renewal to work, each port `80` vhost for each domain you are obtaining certificates for needs to forward requests for `/.well-known/acme-challenge` to the certbot container we use for renewal.
-
-See how this is configured for the `matrix.` subdomain in `/matrix/nginx-proxy/conf.d/matrix-domain.conf`
-Don't be alarmed if the above configuration file says port `8080`, instead of port `80`. It's due to port mapping due to our use of containers.
-
-
-## Specify the SSL private key algorithm
-
-If you'd like to [specify the private key type](https://eff-certbot.readthedocs.io/en/stable/using.html#using-ecdsa-keys) used with Let's Encrypt, define your own custom configuration like this:
-
-```yaml
-matrix_ssl_lets_encrypt_key_type: ecdsa
 ```

docs/configuring-playbook-sygnal.md

@@ -11,6 +11,31 @@ See the project's [documentation](https://github.com/matrix-org/sygnal) to learn
 This optional playbook component is only useful to people who develop/build their own Matrix client applications themselves.
 
 
+## Decide on a domain and path
+
+By default, Sygnal is configured to use its own dedicated domain (`sygnal.DOMAIN`) and requires you to [adjust your DNS records](#adjusting-dns-records).
+
+You can override the domain and path like this:
+
+```yaml
+# Switch to the domain used for Matrix services (`matrix.DOMAIN`),
+# so we won't need to add additional DNS records for Sygnal.
+matrix_sygnal_hostname: "{{ matrix_server_fqn_matrix }}"
+
+# Expose under the /sygnal subpath
+matrix_sygnal_path_prefix: /sygnal
+```
+
+**NOTE**: When using `matrix-nginx-proxy` instead of Traefik, you won't be able to override the path prefix. You can only override the domain, but that needs to happen using another variable: `matrix_server_fqn_sygnal` (e.g. `matrix_server_fqn_sygnal: "push.{{ matrix_domain }}"`).
+
+
+## Adjusting DNS records
+
+Once you've decided on the domain and path, **you may need to adjust your DNS** records to point the Sygnal domain to the Matrix server.
+
+If you've decided to reuse the `matrix.` domain, you won't need to do any extra DNS configuration.
+
+
 ## Adjusting the playbook configuration
 
 Add the following configuration to your `inventory/host_vars/matrix.DOMAIN/vars.yml` file (adapt to your needs):
@@ -55,9 +80,7 @@ To do that, the above example configuration:
 
 ## Installing
 
-Don't forget to add `sygnal.<your-domain>` to DNS as described in [Configuring DNS](configuring-dns.md) before running the playbook.
+After configuring the playbook and potentially [adjusting your DNS records](#adjusting-dns-records), run the [installation](installing.md) command:
-
-After configuring the playbook, run the [installation](installing.md) command again:
 
 ```
 ansible-playbook -i inventory/hosts setup.yml --tags=setup-all,start
@@ -66,6 +89,6 @@ ansible-playbook -i inventory/hosts setup.yml --tags=setup-all,start
 
 ## Usage
 
-To make use of your Sygnal installation, you'd need to build your own Matrix client application, which uses the same API keys (for [GCM/FCM](https://firebase.google.com/docs/cloud-messaging/)) and certificates (for [APNS](https://developer.apple.com/notifications/)) and is also pointed to `https://sygnal.DOMAIN` as the configured push server.
+To make use of your Sygnal installation, you'd need to build your own Matrix client application, which uses the same API keys (for [GCM/FCM](https://firebase.google.com/docs/cloud-messaging/)) and certificates (for [APNS](https://developer.apple.com/notifications/)) and is to your Sygnal URL endpoint (e.g. `https://sygnal.DOMAIN`).
 
 Refer to Sygnal's [Notes for application developers](https://github.com/matrix-org/sygnal/blob/master/docs/applications.md) document.

docs/configuring-playbook-synapse-admin.md

@@ -35,34 +35,6 @@ To use Synapse Admin, you need to have [registered at least one administrator ac
 
 The Homeserver URL to use on Synapse Admin's login page is: `https://matrix.DOMAIN`
 
-### Sample configuration for running behind Traefik 2.0
-
-Below is a sample configuration for using this playbook with a [Traefik](https://traefik.io/) 2.0 reverse proxy.
-
-This an extension to Traefik config sample in [own-webserver-documentation](./configuring-playbook-own-webserver.md).
-
-```yaml
-# Don't bind any HTTP or federation port to the host
-# (Traefik will proxy directly into the containers)
-matrix_synapse_admin_container_http_host_bind_port: ""
-
-matrix_synapse_admin_container_extra_arguments:
-    # May be unnecessary depending on Traefik config, but can't hurt
-    - '--label "traefik.enable=true"'
-
-    # The Synapse Admin container will only receive traffic from this subdomain and path
-    - '--label "traefik.http.routers.matrix-synapse-admin.rule=(Host(`{{ matrix_server_fqn_matrix }}`) && Path(`{{matrix_synapse_admin_public_endpoint}}`))"'
-
-    # (Define your entrypoint)
-    - '--label "traefik.http.routers.matrix-synapse-admin.entrypoints=web-secure"'
-
-    # (The 'default' certificate resolver must be defined in Traefik config)
-    - '--label "traefik.http.routers.matrix-synapse-admin.tls.certResolver=default"'
-
-    # The Synapse Admin container uses port 80 by default
-    - '--label "traefik.http.services.matrix-synapse-admin.loadbalancer.server.port=80"'
-```
-
 ### Sample configuration for running behind Caddy v2
 
 Below is a sample configuration for using this playbook with a [Caddy](https://caddyserver.com/v2) 2.0 reverse proxy (non-default configuration where `matrix-nginx-proxy` is disabled - `matrix_nginx_proxy_enabled: false`).

docs/configuring-playbook-synapse-auto-compressor.md

@@ -0,0 +1,36 @@
+# Setting up synapse_auto_compressor
+
+The playbook can install and configure [synapse_auto_compressor](https://github.com/matrix-org/rust-synapse-compress-state/#automated-tool-synapse_auto_compressor) for you.
+
+It's a CLI tool that automatically compresses Synapse's `state_groups` database table in the background.
+
+See the project's [documentation](https://github.com/matrix-org/rust-synapse-compress-state/#automated-tool-synapse_auto_compressor) to learn what it does and why it might be useful to you.
+
+
+## Adjusting the playbook configuration
+
+Add the following configuration to your `inventory/host_vars/matrix.DOMAIN/vars.yml` file:
+
+```yaml
+matrix_synapse_auto_compressor_enabled: true
+```
+
+
+## Installing
+
+After configuring the playbook, run the [installation](installing.md) command again:
+
+```
+ansible-playbook -i inventory/hosts setup.yml --tags=setup-all,start
+```
+
+
+## Usage
+
+After installation, `synapse_auto_compressor` will run automatically every day at `00:00:00` (as defined in `matrix_synapse_auto_compressor_calendar` by default).
+
+## Manually start the tool
+
+For testing your setup it can be helpful to not wait until 00:00. If you want to run the tool immediately, log onto the server
+and run `systemctl start matrix-synapse-auto-compressor`. Running this command will not return control to your terminal until the compression run is done, which may take a long time.
+Consider using [tmux](https://en.wikipedia.org/wiki/Tmux) if your SSH connection is unstable.

docs/configuring-playbook-synapse.md

@@ -80,3 +80,42 @@ matrix_synapse_configuration_extension_yaml: |
       backchannel_logout_enabled: true # Optional
 ```
 
+
+## Customizing templates
+
+[Templates](https://github.com/matrix-org/synapse/blob/develop/docs/templates.md) are used by Synapse for showing **certain web pages** handled by the server, as well as for **email notifications**.
+
+This playbook allows you to customize the default templates (see the [`synapse/res/templates` directory](https://github.com/matrix-org/synapse/tree/develop/synapse/res/templates)).
+
+If template customization is enabled, the playbook will build a custom container image based on the official one.
+
+Your custom templates need to live in a public or private git repository. This repository will be cloned during Synapse image customization (during the playbook run).
+
+To enable template customizations, use a configuration (`inventory/host_vars/matrix.DOMAIN/vars.yml`) like this:
+
+```yaml
+# If you'd like to ensure that the customized image is built each time the playbook runs, enable this.
+# Otherwise, the customized image will only be rebuilt whenever the Synapse version changes (once every ~2 weeks).
+# matrix_synapse_docker_image_customized_build_nocache: true
+
+matrix_synapse_container_image_customizations_templates_enabled: true
+
+# Our templates live in a templates/ directory within the repository.
+# If they're at the root path, delete this line.
+matrix_synapse_container_image_customizations_templates_in_container_template_files_relative_path: templates
+
+matrix_synapse_container_image_customizations_templates_git_repository_url: git@github.com:organization/repository.git
+matrix_synapse_container_image_customizations_templates_git_repository_branch: main
+
+matrix_synapse_container_image_customizations_templates_git_repository_keyscan_enabled: true
+matrix_synapse_container_image_customizations_templates_git_repository_keyscan_hostname: github.com
+
+# If your git repository is public, do not define the private key (remove the variable).
+matrix_synapse_container_image_customizations_templates_git_repository_ssh_private_key: |
+  -----BEGIN OPENSSH PRIVATE KEY-----
+  ....
+  -----END OPENSSH PRIVATE KEY-----
+```
+
+As mentioned in Synapse's Templates documentation, Synapse will fall back to its own templates if a template is not found in that directory.
+Due to this, it's recommended to only store and maintain template files in your repository if you need to make custom changes. Other files (which you don't need to change), should not be duplicated, so that you don't need to worry about getting out-of-sync with the original Synapse templates.

docs/configuring-playbook-traefik.md

@@ -0,0 +1,50 @@
+# Configure Traefik (optional, advanced)
+
+By default, this playbook installs and manages a [Traefik](https://doc.traefik.io/traefik/) reverse-proxy server, powered by the [com.devture.ansible.role.traefik](https://github.com/devture/com.devture.ansible.role.traefik) Ansible role.
+
+This Ansible role support various configuration options. Feel free to consult its `default/main.yml` variables file.
+
+
+## Adjusting SSL certificate retrieval
+
+See the dedicated [Adjusting SSL certificate retrieval](configuring-playbook-ssl-certificates.md) documentation page.
+
+## Increase logging verbosity
+
+```yaml
+devture_traefik_config_log_level: DEBUG
+```
+
+## Disable access logs
+
+This will disable access logging.
+
+```yaml
+devture_traefik_config_accessLog_enabled: false
+```
+
+## Enable Traefik Dashboard
+
+This will enable a Traefik [Dashboard](https://doc.traefik.io/traefik/operations/dashboard/) UI at `https://matrix.DOMAIN/dashboard/` (note the trailing `/`).
+
+```yaml
+devture_traefik_dashboard_enabled: true
+devture_traefik_dashboard_hostname: "{{ matrix_server_fqn_matrix }}"
+devture_traefik_dashboard_basicauth_enabled: true
+devture_traefik_dashboard_basicauth_user: YOUR_USERNAME_HERE
+devture_traefik_dashboard_basicauth_password: YOUR_PASSWORD_HERE
+```
+
+**WARNING**: enabling the dashboard on a hostname you use for something else (like `matrix_server_fqn_matrix` in the configuration above) may cause conflicts. Enabling the Traefik Dashboard makes Traefik capture all `/dashboard` and `/api` requests and forward them to itself. If any of the services hosted on the same hostname requires any of these 2 URL prefixes, you will experience problems. So far, we're not aware of any playbook services which occupy these endpoints and are likely to cause conflicts.
+
+## Additional configuration
+
+Use the `devture_traefik_configuration_extension_yaml` variable provided by the Traefik Ansible role to override or inject additional settings, even when no dedicated variable exists.
+
+```yaml
+# This is a contrived example.
+# You can enable and secure the Dashboard using dedicated variables. See above.
+devture_traefik_configuration_extension_yaml: |
+  api:
+    dashboard: true
+```

docs/configuring-playbook.md

@@ -59,9 +59,11 @@ When you're done with all the configuration you'd like to do, continue with [Ins
 
 - [Serving your base domain using this playbook's nginx server](configuring-playbook-base-domain-serving.md) (optional)
 
-- [Configure Nginx](configuring-playbook-nginx.md) (optional, advanced)
+- [Configure the Traefik reverse-proxy](configuring-playbook-traefik.md) (optional, advanced)
 
-- [Using your own webserver, instead of this playbook's nginx proxy](configuring-playbook-own-webserver.md) (optional, advanced)
+- (Deprecated) [Configure the Nginx reverse-proxy](configuring-playbook-nginx.md) (optional, advanced)
+
+- [Using your own webserver, instead of this playbook's default reverse-proxy](configuring-playbook-own-webserver.md) (optional, advanced)
 
 - [Adjusting TURN server configuration](configuring-playbook-turn.md) (optional, advanced)
 
@@ -193,8 +195,14 @@ When you're done with all the configuration you'd like to do, continue with [Ins
 
 ### Other specialized services
 
+- [Setting up synapse-auto-compressor](configuring-playbook-synapse-auto-compressor.md) for compressing the database on Synapse homeservers (optional)
+
+- [Setting up the Sliding Sync Proxy](configuring-playbook-sliding-sync-proxy.md) for clients which require Sliding Sync support (like Element X) (optional)
+
 - [Setting up the Sygnal push gateway](configuring-playbook-sygnal.md) (optional)
 
 - [Setting up the ntfy push notifications server](configuring-playbook-ntfy.md) (optional)
 
 - [Setting up a Cactus Comments server](configuring-playbook-cactus-comments.md) - a federated comment system built on Matrix (optional)
+
+- [Setting up the Rageshake bug report server](configuring-playbook-rageshake.md) (optional)

docs/faq.md

@@ -125,7 +125,7 @@ This is similar to the [EMnify/matrix-synapse-auto-deploy](https://github.com/EM
 
 - this one installs everything in a single directory (`/matrix` by default) and **doesn't "contaminate" your server** with files all over the place
 
-- this one **doesn't necessarily take over** ports 80 and 443. By default, it sets up nginx for you there, but you can also [use your own webserver](configuring-playbook-own-webserver.md)
+- this one **doesn't necessarily take over** ports 80 and 443. By default, it sets up [Traefik](https://doc.traefik.io/traefik/) for you there, but you can also [use your own webserver](configuring-playbook-own-webserver.md)
 
 - this one **runs everything in Docker containers**, so it's likely more predictable and less fragile (see [Docker images used by this playbook](container-images.md))
 
@@ -322,7 +322,7 @@ matrix_playbook_docker_installation_enabled: false
 
 ### I run another webserver on the same server where I wish to install Matrix. What now?
 
-By default, we install a webserver for you (nginx), but you can also use [your own webserver](configuring-playbook-own-webserver.md).
+By default, we install a webserver for you ([Traefik](https://doc.traefik.io/traefik/)), but you can also use [your own webserver](configuring-playbook-own-webserver.md).
 
 ### How is the effective configuration determined?
 
@@ -336,12 +336,14 @@ Configuration variables are defined in multiple places in this playbook and are
 
 ### What configuration variables are available?
 
-You can discover the variables you can override in each role (`role/matrix*/defaults/main.yml`).
+You can discover the variables you can override in each role (`roles/*/*/defaults/main.yml`).
 
 As described in [How is the effective configuration determined?](#how-is-the-effective-configuration-determined), these role-defaults may be overriden by values defined in `group_vars/matrix_servers`.
 
 Refer to both of these for inspiration. Still, as mentioned in [Configuring the playbook](configuring-playbook.md), you're only ever supposed to edit your own `inventory/host_vars/matrix.DOMAIN/vars.yml` file and nothing else inside the playbook (unless you're meaning to contribute new features).
 
+**Note**: some of the roles (`roles/galaxy/*`) live in separate repositories and are only installed after your run `just roles` (or `make roles`).
+
 ### I'd like to adjust some configuration which doesn't have a corresponding variable. How do I do it?
 
 The playbook doesn't aim to expose all configuration settings for all services using variables.
@@ -352,7 +354,9 @@ See [What configuration variables are available?](#what-configuration-variables-
 
 Besides that, each role (component) aims to provide a `matrix_SOME_COMPONENT_configuration_extension_yaml` (or `matrix_SOME_COMPONENT_configuration_extension_json`) variable, which can be used to override the configuration.
 
-Check each role's `role/matrix*/defaults/main.yml` for the corresponding variable and an example for how use it.
+Check each role's `roles/*/*/defaults/main.yml` for the corresponding variable and an example for how use it.
+
+**Note**: some of the roles (`roles/galaxy/*`) live in separate repositories and are only installed after your run `just roles` (or `make roles`).
 
 
 ## Installation
@@ -461,15 +465,8 @@ After verifying that everything still works after the Postgres upgrade, you can
 
 ### How do I debug or force SSL certificate renewal?
 
-SSL certificate renewal normally happens automatically via [systemd timers](https://wiki.archlinux.org/index.php/Systemd/Timers).
+SSL certificates are managed automatically by the [Traefik](https://doc.traefik.io/traefik/) reverse-proxy server.
 
-If you're having trouble with SSL certificate renewal, you can inspect the renewal logs using:
+If you're having trouble with SSL certificate renewal, check the Traefik logs (`journalctl -fu matrix-traefik`).
 
-- `journalctl -fu matrix-ssl-lets-encrypt-certificates-renew.service`
+If you're [using your own webserver](configuring-playbook-own-webserver.md) instead of the integrated one (Traefik), you should investigate in another way.
-- *or* by looking at the log files in `/matrix/ssl/log/`
-
-To trigger renewal, run: `systemctl start matrix-ssl-lets-encrypt-certificates-renew.service`. You can then take a look at the logs again.
-
-If you're using the integrated webserver (`matrix-nginx-proxy`), you can reload it manually like this: `systemctl reload matrix-nginx-proxy`. Reloading also happens periodically via a systemd timer.
-
-If you're [using your own webserver](configuring-playbook-own-webserver.md) instead of the integrated one (`matrix-nginx-proxy`) you may also need to reload/restart it, to make it pick up the renewed SSL certificate files.

docs/importing-postgres.md

@@ -20,17 +20,17 @@ Before doing the actual import, **you need to upload your Postgres dump file to
 
 ## Importing
 
-To import, run this command (make sure to replace `<server-path-to-postgres-dump.sql>` with a file path on your server):
+To import, run this command (make sure to replace `SERVER_PATH_TO_POSTGRES_DUMP_FILE` with a file path on your server):
 
 ```sh
-ansible-playbook -i inventory/hosts setup.yml \
+just run-tags import-postgres \
---extra-vars='server_path_postgres_dump=<server-path-to-postgres-dump.sql> postgres_default_import_database=matrix' \
+--extra-vars=server_path_postgres_dump=SERVER_PATH_TO_POSTGRES_DUMP_FILE \
---tags=import-postgres
+--extra-vars=postgres_default_import_database=matrix
 ```
 
 **Notes**:
 
-- `<server-path-to-postgres-dump.sql>` must be a file path to a Postgres dump file on the server (not on your local machine!)
+- `SERVER_PATH_TO_POSTGRES_DUMP_FILE` must be a file path to a Postgres dump file on the server (not on your local machine!)
 - `postgres_default_import_database` defaults to `matrix`, which is useful for importing multiple databases (for dumps made with `pg_dumpall`). If you're importing a single database (e.g. `synapse`), consider changing `postgres_default_import_database` accordingly
 
 
@@ -86,7 +86,7 @@ In this case you can use the command suggested in the import task to clear the d
 # systemctl start matrix-postgres
 ```
 
-Now on your local machine run `ansible-playbook -i inventory/hosts setup.yml --tags=setup-postgres` to prepare the database roles etc.
+Now on your local machine run `just run-tags setup-postgres` to prepare the database roles etc.
 
 If not, you probably get this error. `synapse` is the correct table owner, but the role is missing in database.
 ```

docs/installing.md

@@ -17,7 +17,7 @@ Here are some playbook tags that you should be familiar with:
 
 - `install-all` - like `setup-all`, but skips uninstallation tasks. Useful for maintaining your setup quickly when its components remain unchanged. If you adjust your `vars.yml` to remove components, you'd need to run `setup-all` though, or these components will still remain installed
 
-- `setup-SERVICE` (e.g. `setup-bot-postmoogle`) - runs the setup tasks only for a given role, but does not start/restart services. You can discover these additional tags in each role (`roles/*/main.yml`). Running per-component setup tasks is **not recommended**, as components sometimes depend on each other and running just the setup tasks for a given component may not be enough. For example, setting up the [mautrix-telegram bridge](configuring-playbook-bridge-mautrix-telegram.md), in addition to the `setup-mautrix-telegram` tag, requires database changes (the `setup-postgres` tag) as well as reverse-proxy changes (the `setup-nginx-proxy` tag).
+- `setup-SERVICE` (e.g. `setup-bot-postmoogle`) - runs the setup tasks only for a given role, but does not start/restart services. You can discover these additional tags in each role (`roles/**/tasks/main.yml`). Running per-component setup tasks is **not recommended**, as components sometimes depend on each other and running just the setup tasks for a given component may not be enough. For example, setting up the [mautrix-telegram bridge](configuring-playbook-bridge-mautrix-telegram.md), in addition to the `setup-mautrix-telegram` tag, requires database changes (the `setup-postgres` tag) as well as reverse-proxy changes (the `setup-nginx-proxy` tag).
 
 - `install-SERVICE` (e.g. `install-bot-postmoogle`) - like `setup-SERVICE`, but skips uninstallation tasks. See `install-all` above for additional information.
 

docs/maintenance-postgres.md

@@ -41,7 +41,7 @@ To perform a `FULL` Postgres [VACUUM](https://www.postgresql.org/docs/current/sq
 Example:
 
 ```bash
-ansible-playbook -i inventory/hosts setup.yml --tags=run-postgres-vacuum,start
+just run-tags run-postgres-vacuum,start
 ```
 
 **Note**: this will automatically stop Synapse temporarily and restart it later. You'll also need plenty of available disk space in your Postgres data directory (usually `/matrix/postgres/data`).
@@ -78,7 +78,9 @@ Upgrades must be performed manually.
 
 This playbook can upgrade your existing Postgres setup with the following command:
 
-	ansible-playbook -i inventory/hosts setup.yml --tags=upgrade-postgres
+```sh
+just run-tags upgrade-postgres
+```
 
 **Warning: If you're using Borg Backup keep in mind that there is no official Postgres 15 support yet.**
 

docs/maintenance-synapse.md

@@ -29,7 +29,9 @@ After deleting data, you may wish to run a [`FULL` Postgres `VACUUM`](./maintena
 
 [rust-synapse-compress-state](https://github.com/matrix-org/rust-synapse-compress-state) can be used to optimize some `_state` tables used by Synapse. If your server participates in large rooms this is the most effective way to reduce the size of your database.
 
-This tool should be safe to use (even when Synapse is running), but it's always a good idea to [make Postgres backups](./maintenance-postgres.md#backing-up-postgresql) first.
+**Note**: besides running the `rust-synapse-compress-state` tool manually, you can also enable its `synapse-auto-compressor` tool by [Setting up synapse-auto-compressor](configuring-playbook-synapse-auto-compressor.md). The automatic tool will run on a schedule every day and you won't have to compress state manually ever again.
+
+`rust-synapse-compress-state` should be safe to use (even when Synapse is running), but it's always a good idea to [make Postgres backups](./maintenance-postgres.md#backing-up-postgresql) first.
 
 To ask the playbook to run rust-synapse-compress-state, execute:
 

docs/prerequisites.md

@@ -20,6 +20,8 @@ If your distro runs within an [LXC container](https://linuxcontainers.org/), you
 
 - The [Ansible](http://ansible.com/) program being installed on your own computer. It's used to run this playbook and configures your server for you. Take a look at [our guide about Ansible](ansible.md) for more information, as well as [version requirements](ansible.md#supported-ansible-versions) and alternative ways to run Ansible.
 
+- the [passlib](https://passlib.readthedocs.io/en/stable/index.html) Python library installed on the computer you run Ansible. On most distros, you need to install some `python-passlib` or `py3-passlib` package, etc.
+
 - [`git`](https://git-scm.com/) is the recommended way to download the playbook to your computer. `git` may also be required on the server if you will be [self-building](self-building.md) components.
 
 - [`just`](https://github.com/casey/just) for running `just roles`, etc. (see [`justfile`](../justfile)), although you can also run these commands manually

examples/nginx/README.md

@@ -0,0 +1,17 @@
+# Nginx reverse-proxy fronting the playbook's integrated Traefik reverse-proxy
+
+This directory contains a sample config that shows you how use the [nginx](https://nginx.org/) webserver to front the integrated [Traefik](https://traefik.io/) reverse-proxy webserver with another reverse-proxy.
+
+
+## Prerequisite configuration
+
+To get started, first follow the [front the integrated reverse-proxy webserver with another reverse-proxy](../../docs/configuring-playbook-own-webserver.md#fronting-the-integrated-reverse-proxy-webserver-with-another-reverse-proxy) instructions and update your playbook's configuration (`inventory/host_vars/matrix.<your-domain>/vars.yml`).
+
+
+## Using the nginx configuration
+
+Copy the [matrix.conf](matrix.conf) file to your nginx server's filesystem, modify it to your needs and include it your nginx configuration (e.g. `include /path/to/matrix.conf;`).
+
+This configuration **disables SSL certificate retrieval**, so you will **need to obtain SSL certificates manually** (e.g. by using [certbot](https://certbot.eff.org/)) and set the appropriate path in `matrix.conf`. In the example nginx configuration, a single certificate is used for all subdomains (`matrix.DOMAIN`, `element.DOMAIN`, etc.). For your setup, may wish to change this and use separate `server` blocks and separate certificate files for each host.
+
+Also note that your copy of the `matrix.conf` file has to be adapted to whatever services you are using. For example, remove `element.domain.com` from the `server_name` list if you don't use [Element](../../docs/configuring-playbook-client-element.md) web client or add `dimension.domain.com` to it if you do use the [Dimension](../../docs/configuring-playbook-dimension.md) integration manager.

examples/nginx/matrix.conf

@@ -0,0 +1,96 @@
+server {
+    listen 443 ssl http2;
+    listen [::]:443 ssl http2;
+
+    # TODO: add/remove services and their subdomains if you use/don't use them
+    # this example is using hosting something on the base domain and an element web client, so example.com and element.example.com are listed in addition to matrix.example.com
+    # if you don't use those, you can remove them
+    # if you use e.g. dimension on dimension.example.com, add dimension.example.com to the server_name list
+    server_name example.com matrix.example.com element.example.com;
+
+    location / {
+        # note: do not add a path (even a single /) after the port in `proxy_pass`,
+        # otherwise, nginx will canonicalise the URI and cause signature verification
+        # errors.
+        proxy_pass http://localhost:81;
+        proxy_set_header X-Forwarded-For $remote_addr;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+
+        access_log /var/log/nginx/matrix.access.log;
+        error_log /var/log/nginx/matrix.error.log;
+
+        # Nginx by default only allows file uploads up to 1M in size
+        # Increase client_max_body_size to match max_upload_size defined in homeserver.yaml
+        client_max_body_size 50M;
+    }
+
+    # TODO: adapt the path to your ssl certificate for the domains listed on server_name
+    ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem; # managed by Certbot
+    # TODO: adapt the path to your ssl certificate for the domains listed on server_name
+    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem; # managed by Certbot
+    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
+    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
+}
+
+# settings for matrix federation
+server {
+    # For the federation port
+    listen 8448 ssl http2 default_server;
+    listen [::]:8448 ssl http2 default_server;
+
+    server_name matrix.example.com;
+
+    location / {
+        proxy_pass http://localhost:8449;
+        proxy_set_header X-Forwarded-For $remote_addr;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header Host $host;
+
+        access_log /var/log/nginx/matrix.access.log;
+        error_log /var/log/nginx/matrix.error.log;
+
+        # Nginx by default only allows file uploads up to 1M in size
+        # Increase client_max_body_size to match max_upload_size defined in homeserver.yaml
+        client_max_body_size 50M;
+    }
+    # TODO: adapt the path to your ssl certificate for the domains listed on server_name
+    ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem; # managed by Certbot
+    # TODO: adapt the path to your ssl certificate for the domains listed on server_name
+    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem; # managed by Certbot
+    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
+    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
+}
+
+# ensure using https
+# TODO: remove server blocks that you don't use / add server blocks for domains you do use
+server {
+    if ($host = example.com) {
+        return 301 https://$host$request_uri;
+    } # managed by Certbot
+
+    server_name example.com;
+    listen 80;
+    return 404; # managed by Certbot
+}
+
+server {
+    if ($host = matrix.example.com) {
+        return 301 https://$host$request_uri;
+    } # managed by Certbot
+
+    server_name matrix.example.com;
+    listen 80;
+    return 404; # managed by Certbot
+}
+
+server {
+    if ($host = element.example.com) {
+        return 301 https://$host$request_uri;
+    } # managed by Certbot
+
+    server_name element.example.com;
+    listen 80;
+    return 404; # managed by Certbot
+}

examples/vars.yml

@@ -21,6 +21,11 @@ matrix_homeserver_implementation: synapse
 # You can put any string here, but generating a strong one is preferred (e.g. `pwgen -s 64 1`).
 matrix_homeserver_generic_secret_key: ''
 
+# By default, the playbook manages its own Traefik (https://doc.traefik.io/traefik/) reverse-proxy server.
+# It will retrieve SSL certificates for you on-demand and forward requests to all other components.
+# For alternatives, see `docs/configuring-playbook-own-webserver.md`.
+matrix_playbook_reverse_proxy_type: playbook-managed-traefik
+
 # This is something which is provided to Let's Encrypt when retrieving SSL certificates for domains.
 #
 # In case SSL renewal fails at some point, you'll also get an email notification there.
@@ -29,7 +34,7 @@ matrix_homeserver_generic_secret_key: ''
 # you won't be required to define this variable (see `docs/configuring-playbook-ssl-certificates.md`).
 #
 # Example value: someone@example.com
-matrix_ssl_lets_encrypt_support_email: ''
+devture_traefik_config_certificatesResolvers_acme_email: ''
 
 # A Postgres password to use for the superuser Postgres user (called `matrix` by default).
 #

justfile

@@ -1,44 +1,57 @@
 # Shows help
 default:
-	@just --list --justfile {{ justfile() }}
+    @just --list --justfile {{ justfile() }}
 
 # Pulls external Ansible roles
 roles:
-	rm -rf roles/galaxy
+    #!/usr/bin/env sh
-	ansible-galaxy install -r requirements.yml -p roles/galaxy/ --force
+    if [ -x "$(command -v agru)" ]; then
+    	agru
+    else
+    	rm -rf roles/galaxy
+    	ansible-galaxy install -r requirements.yml -p roles/galaxy/ --force
+    fi
+
+# Updates requirements.yml if there are any new tags available. Requires agru
+update:
+    @agru -u
 
 # Runs ansible-lint against all roles in the playbook
 lint:
-	ansible-lint
+    ansible-lint
 
 # Runs the playbook with --tags=install-all,ensure-matrix-users-created,start and optional arguments
 install-all *extra_args: (run-tags "install-all,ensure-matrix-users-created,start" extra_args)
 
+# Runs installation tasks for a single service
+install-service service *extra_args:
+    just --justfile {{ justfile() }} run --tags=install-{{ service }},start-group --extra-vars=group={{ service }} {{ extra_args }}
+
 # Runs the playbook with --tags=setup-all,ensure-matrix-users-created,start and optional arguments
 setup-all *extra_args: (run-tags "setup-all,ensure-matrix-users-created,start" extra_args)
 
 # Runs the playbook with the given list of arguments
 run +extra_args:
-	time ansible-playbook -i inventory/hosts setup.yml {{ extra_args }}
+    time ansible-playbook -i inventory/hosts setup.yml {{ extra_args }}
 
 # Runs the playbook with the given list of comma-separated tags and optional arguments
 run-tags tags *extra_args:
-	just --justfile {{ justfile() }} run --tags={{ tags }} {{ extra_args }}
+    just --justfile {{ justfile() }} run --tags={{ tags }} {{ extra_args }}
 
 # Runs the playbook in user-registration mode
 register-user username password admin_yes_or_no *extra_args:
-	time ansible-playbook -i inventory/hosts setup.yml --tags=register-user --extra-vars="username={{ username }} password={{ password }} admin={{ admin_yes_or_no }}" {{ extra_args }}
+    time ansible-playbook -i inventory/hosts setup.yml --tags=register-user --extra-vars="username={{ username }} password={{ password }} admin={{ admin_yes_or_no }}" {{ extra_args }}
 
 # Starts all services
 start-all *extra_args: (run-tags "start-all" extra_args)
 
 # Starts a specific service group
 start-group group *extra_args:
-	@just --justfile {{ justfile() }} run-tags start-group --extra-vars="group={{ group }}" {{ extra_args }}
+    @just --justfile {{ justfile() }} run-tags start-group --extra-vars="group={{ group }}" {{ extra_args }}
 
 # Stops all services
 stop-all *extra_args: (run-tags "stop-all" extra_args)
 
 # Stops a specific service group
 stop-group group *extra_args:
-	@just --justfile {{ justfile() }} run-tags stop-group --extra-vars="group={{ group }}" {{ extra_args }}
+    @just --justfile {{ justfile() }} run-tags stop-group --extra-vars="group={{ group }}" {{ extra_args }}

playbooks/matrix.yml

@@ -43,7 +43,7 @@
 
     - role: galaxy/com.devture.ansible.role.postgres
 
-    - custom/matrix-redis
+    - galaxy/redis
     - custom/matrix-corporal
     - custom/matrix-bridge-appservice-discord
     - custom/matrix-bridge-appservice-slack
@@ -82,7 +82,9 @@
     - custom/matrix-bot-draupnir
     - custom/matrix-bot-chatgpt
     - custom/matrix-cactus-comments
+    - custom/matrix-rageshake
     - custom/matrix-synapse
+    - custom/matrix-synapse-auto-compressor
     - custom/matrix-synapse-reverse-proxy-companion
     - custom/matrix-dendrite
     - custom/matrix-conduit
@@ -90,8 +92,9 @@
     - galaxy/prometheus_node_exporter
     - galaxy/prometheus_postgres_exporter
     - custom/matrix-prometheus-nginxlog-exporter
-    - custom/matrix-prometheus
+    - galaxy/prometheus
-    - custom/matrix-grafana
+    - galaxy/grafana
+    - custom/matrix-prometheus-services-connect
     - custom/matrix-prometheus-services-proxy-connect
     - custom/matrix-registration
     - custom/matrix-client-element
@@ -102,26 +105,29 @@
     - custom/matrix-ldap-registration-proxy
     - custom/matrix-ma1sd
     - custom/matrix-dimension
-    - custom/matrix-etherpad
+    - galaxy/etherpad
+    - custom/etherpad-proxy-connect
+    - custom/matrix-sliding-sync
     - custom/matrix-email2matrix
     - custom/matrix-sygnal
-    - custom/matrix-ntfy
+    - galaxy/ntfy
     - custom/matrix-nginx-proxy
     - custom/matrix-coturn
-    - custom/matrix-aux
+
+    - role: galaxy/aux
 
     - role: galaxy/com.devture.ansible.role.postgres_backup
 
-    - custom/matrix-backup-borg
+    - role: galaxy/backup_borg
 
     - custom/matrix-user-creator
     - custom/matrix-common-after
 
-    - when: matrix_playbook_traefik_role_enabled | bool
+    - role: galaxy/com.devture.ansible.role.container_socket_proxy
-      role: galaxy/com.devture.ansible.role.traefik
 
-    - when: matrix_playbook_traefik_certs_dumper_role_enabled | bool
+    - role: galaxy/com.devture.ansible.role.traefik
-      role: galaxy/com.devture.ansible.role.traefik_certs_dumper
+
+    - role: galaxy/com.devture.ansible.role.traefik_certs_dumper
 
     - when: devture_systemd_service_manager_enabled | bool
       role: galaxy/com.devture.ansible.role.systemd_service_manager

requirements.yml

@@ -1,43 +1,47 @@
----
+- src: git+https://github.com/geerlingguy/ansible-role-docker
-
+  version: 6.1.0
-- src: geerlingguy.docker
+  name: geerlingguy.docker
-  version: 6.0.4
-
 - src: git+https://github.com/devture/com.devture.ansible.role.docker_sdk_for_python.git
-  version: 6ba3be490b6f4c6f35ea109aeb8e533fa231b3a5
+  version: 129c8590e106b83e6f4c259649a613c6279e937a
-
 - src: git+https://github.com/devture/com.devture.ansible.role.playbook_help.git
   version: c1f40e82b4d6b072b6f0e885239322bdaaaf554f
-
 - src: git+https://github.com/devture/com.devture.ansible.role.systemd_docker_base.git
   version: 327d2e17f5189ac2480d6012f58cf64a2b46efba
-
 - src: git+https://github.com/devture/com.devture.ansible.role.timesync.git
   version: 3d5bb2976815958cdce3f368fa34fb51554f899b
-
 - src: git+https://github.com/devture/com.devture.ansible.role.playbook_state_preserver.git
   version: ff2fd42e1c1a9e28e3312bbd725395f9c2fc7f16
-
 - src: git+https://github.com/devture/com.devture.ansible.role.postgres.git
-  version: a1bb78d194434b38005f3a9e623bfa4b2c06c7bc
+  version: 38764398bf82b06a1736c3bfedc71dfd229e4b52
-
 - src: git+https://github.com/devture/com.devture.ansible.role.postgres_backup.git
-  version: 77b1f9ae1aafa31c9078178c1036bf744c99d08b
+  version: 8e9ec48a09284c84704d7a2dce17da35f181574d
-
 - src: git+https://github.com/devture/com.devture.ansible.role.systemd_service_manager.git
   version: 6ccb88ac5fc27e1e70afcd48278ade4b564a9096
-
 - src: git+https://github.com/devture/com.devture.ansible.role.playbook_runtime_messages.git
   version: 9b4b088c62b528b73a9a7c93d3109b091dd42ec6
-
 - src: git+https://gitlab.com/etke.cc/roles/prometheus_node_exporter.git
-  version: v1.5.0-2
+  version: v1.5.0-7
-
 - src: git+https://gitlab.com/etke.cc/roles/prometheus_postgres_exporter.git
-  version: v0.11.1-2
+  version: v0.12.0-0
-
+- src: git+https://gitlab.com/etke.cc/roles/backup_borg.git
+  version: v1.2.4-1.7.9-0
+- src: git+https://gitlab.com/etke.cc/roles/grafana.git
+  version: v9.4.7-0
+- src: git+https://gitlab.com/etke.cc/roles/ntfy.git
+  version: v2.2.0-0
+- src: git+https://gitlab.com/etke.cc/roles/redis.git
+  version: v7.0.10-0
+- src: git+https://gitlab.com/etke.cc/roles/etherpad.git
+  version: v1.8.18-2
+- src: git+https://github.com/devture/com.devture.ansible.role.container_socket_proxy.git
+  version: v0.1.1-1
 - src: git+https://github.com/devture/com.devture.ansible.role.traefik.git
-  version: fb09fd26f877372417d5586f1e79e83f983f0bd6
+  version: v2.9.9-0
-
 - src: git+https://github.com/devture/com.devture.ansible.role.traefik_certs_dumper.git
-  version: e7563caa814e634d2f8deec4a41e970caa1c0ae4
+  version: v2.8.1-0
+- src: git+https://github.com/mother-of-all-self-hosting/ansible-role-aux.git
+  version: v1.0.0-0
+  name: aux
+- src: git+https://github.com/mother-of-all-self-hosting/ansible-role-prometheus.git
+  version: v2.43.0-0
+  name: prometheus

roles/custom/etherpad-proxy-connect/defaults/main.yml

@@ -0,0 +1,11 @@
+---
+
+# etherpad-proxy-connect is a compatibility role connecting the new Etherpad role with matrix-nginx-proxy.
+# It adds back support for serving Etherpad under the Dimension domain (`matrix_server_fqn_dimension`).
+
+# Controls whether Etherpad will be hosted under the Dimension domain when matrix-nginx-proxy is used (depending on matrix_playbook_reverse_proxy_type).
+# If you're not using matrix-nginx-proxy, then this value has no effect.
+etherpad_nginx_proxy_dimension_integration_enabled: false
+
+# Controls the path at which Etherpad will be exposed on the Dimension domain.
+etherpad_nginx_proxy_dimension_integration_path_prefix: "{{ etherpad_path_prefix }}"

roles/custom/etherpad-proxy-connect/tasks/inject_into_nginx_proxy.yml

@@ -11,14 +11,14 @@
 
 - name: Generate Etherpad proxying configuration for matrix-nginx-proxy
   ansible.builtin.set_fact:
-    matrix_etherpad_matrix_nginx_proxy_configuration: |
+    etherpad_matrix_nginx_proxy_configuration: |
-      rewrite ^{{ matrix_etherpad_public_endpoint }}$ {{ matrix_nginx_proxy_x_forwarded_proto_value }}://$server_name{{ matrix_etherpad_public_endpoint }}/ permanent;
+      rewrite ^{{ etherpad_nginx_proxy_dimension_integration_path_prefix }}$ {{ matrix_nginx_proxy_x_forwarded_proto_value }}://$server_name{{ etherpad_nginx_proxy_dimension_integration_path_prefix }}/ permanent;
 
-      location {{ matrix_etherpad_public_endpoint }}/ {
+      location {{ etherpad_nginx_proxy_dimension_integration_path_prefix }}/ {
       {% if matrix_nginx_proxy_enabled | default(False) %}
         {# Use the embedded DNS resolver in Docker containers to discover the service #}
         resolver 127.0.0.11 valid=5s;
-        proxy_pass http://matrix-etherpad:9001/;
+        proxy_pass http://{{ etherpad_identifier }}:9001/;
         {# These are proxy directives needed specifically by Etherpad #}
         proxy_buffering off;
         proxy_http_version 1.1;  # recommended with keepalive connections
@@ -42,5 +42,5 @@
       {{
         matrix_nginx_proxy_proxy_dimension_additional_server_configuration_blocks | default([])
         +
-        [matrix_etherpad_matrix_nginx_proxy_configuration]
+        [etherpad_matrix_nginx_proxy_configuration]
       }}

roles/custom/etherpad-proxy-connect/tasks/main.yml

@@ -0,0 +1,12 @@
+---
+
+- when: etherpad_enabled | bool and etherpad_nginx_proxy_dimension_integration_enabled | bool
+  tags:
+    - install-all
+    - setup-all
+    - install-nginx-proxy
+    - setup-nginx-proxy
+  block:
+    - ansible.builtin.include_tasks: "{{ role_path }}/tasks/validate_config.yml"
+
+    - ansible.builtin.include_tasks: "{{ role_path }}/tasks/inject_into_nginx_proxy.yml"

roles/custom/etherpad-proxy-connect/tasks/validate_config.yml

@@ -0,0 +1,32 @@
+---
+
+- name: Fail if reverse-proxy is not nginx
+  when: matrix_playbook_reverse_proxy_type not in ['playbook-managed-nginx', 'other-nginx-non-container']
+  ansible.builtin.fail:
+    msg: >
+      Etherpad's integration into matrix-nginx-proxy's Dimension server only makes sense if you're using matrix-nginx-proxy.
+      `matrix_playbook_reverse_proxy_type` ({{ matrix_playbook_reverse_proxy_type }}) indicates that you're using another reverse-proxy.
+      If you're using Traefik, you should configure `etherpad_hostname` and `etherpad_path_prefix` instead.
+
+- name: Fail if Dimension not enabled
+  when: not matrix_dimension_enabled
+  ansible.builtin.fail:
+    msg: >
+      Etherpad's integration into matrix-nginx-proxy's Dimension server only makes sense if you're using Dimension.
+      Looks like Dimension is not enabled in your configuration (judging by `matrix_dimension_enabled`).
+      Consider configuring `etherpad_hostname` and `etherpad_path_prefix` instead.
+
+- name: Fail if Etherpad hostname does not match Dimension hostname
+  when: etherpad_hostname != matrix_server_fqn_dimension
+  ansible.builtin.fail:
+    msg: >
+      Etherpad's integration into matrix-nginx-proxy's Dimension server requires that you set `etherpad_hostname` to `matrix_server_fqn_dimension`.
+      Consider adding this to your configuration: `{% raw %}etherpad_hostname: "{{ matrix_server_fqn_dimension }}"{% endraw %}`
+
+- name: Fail if / path prefix used for Etherpad
+  when: etherpad_nginx_proxy_dimension_integration_path_prefix == '/'
+  ansible.builtin.fail:
+    msg: >
+      Etherpad's integration into matrix-nginx-proxy's Dimension server only makes sense if you're using a non-`/` path for Etherpad.
+      You've chosen a path prefix of `/` in `etherpad_nginx_proxy_dimension_integration_path_prefix`.
+      The `/` path must go to Dimension itself, so you need to pick a different prefix (e.g. `/etherpad`).

roles/custom/matrix-aux/defaults/main.yml

@@ -1,81 +0,0 @@
----
-
-# matrix-aux is a role that manages auxiliary files and directories on your Matrix server.
-#
-# Certain components (like matrix-synapse, etc.) may sometimes require additional templates (email templates, privacy policies, etc.).
-# This role allows such files to be managed by the playbook.
-#
-# Note that files and directories created via this role are not automatically made available for containers to use.
-# If you use this role to put files in a directory that's already mounted into a container,
-# you can access the files without additional work.
-# Otherwise, you'd need to mount the file/directory to the container that needs it.
-# Roles usually provide a `matrix_*_additional_volumes` or `matrix_*_container_extra_arguments` variable
-# that you can use to mount an additional volume.
-
-# The default permission mode when creating directories using `matrix_aux_directory_definitions`
-matrix_aux_directory_default_mode: '0750'
-
-# Holds a list of directories to create on the server.
-#
-# By default, directories are:
-# - created with permissions as specified in `matrix_aux_directory_default_mode`
-# - owned by the `matrix_user_username` user and `matrix_user_groupname` group (usually `matrix:matrix`)
-#
-# Example:
-#
-# matrix_aux_directory_definitions:
-#   - dest: /matrix/aux
-#
-#   - dest: /matrix/another
-#     mode: '0700'
-#     owner: 'some-user'
-#     group: 'some-group'
-matrix_aux_directory_definitions: []
-
-# The default permission mode when creating directories using `matrix_aux_directory_definitions`
-matrix_aux_file_default_mode: '0640'
-
-# Holds a list of files to create on the server.
-#
-# By default, files are:
-# - created with permissions as specified in `matrix_aux_file_default_mode`
-# - owned by the `matrix_user_username` user and `matrix_user_groupname` group (usually `matrix:matrix`)
-#
-# You can define the file content inline (in your `vars.yml` file) or as an external file (see the example below).
-# Defining the content inline in `vars.yml` has the benefit of not splitting your configuration into multiple files,
-# but rather keeping everything inside `vars.yml` (which also gets backed up on the server in `/matrix/vars.yml`).
-#
-# Note: parent paths for files must exist.
-# If you've defined a file with a destination of `/matrix/some/path/file.txt`,
-# then you likely need to add `/matrix/some/path` to `matrix_aux_directory_definitions` as well.
-# You don't need to do this for directories that the playbook already creates for you.
-#
-# Use a `content` key for text content and `src` with a location to a file for binary content.
-# The `content` key does not support binary content (see https://github.com/ansible/ansible/issues/11594).
-#
-# Example:
-#
-# matrix_aux_file_definitions:
-#   - dest: "{{ matrix_synapse_config_dir_path }}/something.html"
-#     content: |
-#       <!doctype html>
-#       <html><body>Something</body></html>
-#
-#   - dest: /matrix/aux/some-other-file.txt
-#     content: "Something"
-#     mode: '0600'
-#     owner: 'some-user'
-#     group: 'some-group'
-#
-#   - dest: /matrix/aux/yet-another-file.txt
-#     content: "{{ lookup('template', '/path/to/file.txt.j2') }}"
-#     mode: '0600'
-#     owner: 'some-user'
-#     group: 'some-group'
-#
-#   - dest: /matrix/aux/binary-file.dat
-#     src: "/path/to/binary.dat"
-#     mode: '0600'
-#     owner: 'some-user'
-#     group: 'some-group'
-matrix_aux_file_definitions: []

roles/custom/matrix-aux/tasks/main.yml

@@ -1,9 +0,0 @@
----
-
-- block:
-    - ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup.yml"
-  tags:
-    - setup-all
-    - setup-aux-files
-    - install-all
-    - install-aux-files

roles/custom/matrix-aux/tasks/setup.yml

@@ -1,20 +0,0 @@
----
-
-- name: Ensure AUX directories are created
-  ansible.builtin.file:
-    dest: "{{ item.dest }}"
-    state: directory
-    owner: "{{ item.owner | default(matrix_user_username) }}"
-    group: "{{ item.group | default(matrix_user_groupname) }}"
-    mode: "{{ item.mode | default(matrix_aux_directory_default_mode) }}"
-  with_items: "{{ matrix_aux_directory_definitions }}"
-
-- name: Ensure AUX files are created
-  ansible.builtin.copy:
-    src: "{{ item.src if 'src' in item else omit }}"
-    content: "{{ item.content if 'content' in item else omit }}"
-    dest: "{{ item.dest }}"
-    owner: "{{ item.owner | default(matrix_user_username) }}"
-    group: "{{ item.group | default(matrix_user_groupname) }}"
-    mode: "{{ item.mode | default(matrix_aux_file_default_mode) }}"
-  with_items: "{{ matrix_aux_file_definitions }}"

roles/custom/matrix-backup-borg/defaults/main.yml

@@ -1,107 +0,0 @@
----
-# Project source code URL: https://gitlab.com/etke.cc/borgmatic
-
-matrix_backup_borg_enabled: true
-
-matrix_backup_borg_base_path: "{{ matrix_base_data_path }}/backup-borg"
-matrix_backup_borg_config_path: "{{ matrix_backup_borg_base_path }}/config"
-
-matrix_backup_borg_container_image_self_build: false
-matrix_backup_borg_docker_repo: "https://gitlab.com/etke.cc/borgmatic"
-matrix_backup_borg_docker_repo_version: main
-matrix_backup_borg_docker_src_files_path: "{{ matrix_backup_borg_base_path }}/docker-src"
-
-# image and postgres version determined automatically, based on detected postgres server version (if enabled), otherwise latest is used
-matrix_backup_borg_version: ""
-matrix_backup_borg_postgres_version: ""
-matrix_backup_borg_borg_version: 1.2.3
-matrix_backup_borg_borgmatic_version: 1.7.6
-matrix_backup_borg_docker_image: "{{ matrix_backup_borg_docker_image_name_prefix }}etke.cc/borgmatic:{{ matrix_backup_borg_version }}"
-matrix_backup_borg_docker_image_name_prefix: "{{ 'localhost/' if matrix_backup_borg_container_image_self_build else 'registry.gitlab.com/' }}"
-matrix_backup_borg_docker_image_force_pull: "{{ matrix_backup_borg_docker_image.endswith(':latest') or matrix_backup_borg_version | default('') == '' }}"
-
-# A list of extra arguments to pass to the container
-matrix_backup_borg_container_extra_arguments: []
-
-# List of systemd services that matrix-backup-borg.service depends on
-matrix_backup_borg_systemd_required_services_list: ['docker.service']
-
-# List of systemd services that matrix-backup-borg.service wants
-matrix_backup_borg_systemd_wanted_services_list: []
-
-# systemd calendar configuration for the backup job
-# the actual job may run with a delay (see matrix_backup_borg_schedule_randomized_delay_sec)
-matrix_backup_borg_schedule: "*-*-* 04:00:00"
-# the delay with which the systemd timer may run in relation to the `matrix_backup_borg_schedule` schedule
-matrix_backup_borg_schedule_randomized_delay_sec: 2h
-
-# what directories should be added to backup
-matrix_backup_borg_location_source_directories: []
-
-# postgres db backup
-matrix_backup_borg_postgresql_enabled: true
-matrix_backup_borg_supported_postgres_versions: ['12', '13', '14', '15']
-matrix_backup_borg_postgresql_databases: []
-matrix_backup_borg_postgresql_databases_hostname: ''
-matrix_backup_borg_postgresql_databases_username: "matrix"
-matrix_backup_borg_postgresql_databases_password: ""
-matrix_backup_borg_postgresql_databases_port: 5432
-
-# target repositories
-matrix_backup_borg_location_repositories: []
-
-# exclude following paths:
-matrix_backup_borg_location_exclude_patterns: []
-
-# borg encryption mode, only "repokey-*" and "none" are supported
-matrix_backup_borg_encryption: repokey-blake2
-
-# private ssh key used to connect to the borg repo
-matrix_backup_borg_ssh_key_private: ""
-
-# allow unencrypted repo access
-matrix_backup_borg_unknown_unencrypted_repo_access_is_ok: "{{ matrix_backup_borg_encryption == 'none' }}"
-
-# borg ssh command with ssh key
-matrix_backup_borg_storage_ssh_command: ssh -o "StrictHostKeyChecking accept-new" -i /etc/borgmatic.d/sshkey
-
-# compression algorithm
-matrix_backup_borg_storage_compression: lz4
-
-# archive name format
-matrix_backup_borg_storage_archive_name_format: matrix-{now:%Y-%m-%d-%H%M%S}
-
-# repository passphrase
-matrix_backup_borg_storage_encryption_passphrase: ""
-
-# retention configuration
-matrix_backup_borg_retention_keep_hourly: 0
-matrix_backup_borg_retention_keep_daily: 7
-matrix_backup_borg_retention_keep_weekly: 4
-matrix_backup_borg_retention_keep_monthly: 12
-matrix_backup_borg_retention_keep_yearly: 2
-
-# retention prefix
-matrix_backup_borg_retention_prefix: matrix-
-
-# Default borgmatic configuration template which covers the generic use case.
-# You can customize it by controlling the various variables inside it.
-#
-# For a more advanced customization, you can extend the default (see `matrix_backup_borg_configuration_extension_yaml`)
-# or completely replace this variable with your own template.
-matrix_backup_borg_configuration_yaml: "{{ lookup('template', 'templates/config.yaml.j2') }}"
-
-matrix_backup_borg_configuration_extension_yaml: |
-  # Your custom YAML configuration for borgmatic goes here.
-  # This configuration extends the default starting configuration (`matrix_borg_configuration_yaml`).
-  #
-  # You can override individual variables from the default configuration, or introduce new ones.
-  #
-  # If you need something more special, you can take full control by
-  # completely redefining `matrix_backup_borg_configuration_yaml`.
-
-matrix_backup_borg_configuration_extension: "{{ matrix_backup_borg_configuration_extension_yaml | from_yaml if matrix_backup_borg_configuration_extension_yaml | from_yaml is mapping else {} }}"
-
-# Holds the final borgmatic configuration (a combination of the default and its extension).
-# You most likely don't need to touch this variable. Instead, see `matrix_backup_borg_configuration_yaml`.
-matrix_backup_borg_configuration: "{{ matrix_backup_borg_configuration_yaml | from_yaml | combine(matrix_backup_borg_configuration_extension, recursive=True) }}"

roles/custom/matrix-backup-borg/tasks/main.yml

@@ -1,20 +0,0 @@
----
-
-- block:
-    - ansible.builtin.include_tasks: "{{ role_path }}/tasks/validate_config.yml"
-      when: "run_setup | bool and matrix_backup_borg_enabled | bool"
-
-    - ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_install.yml"
-      when: "run_setup | bool and matrix_backup_borg_enabled | bool"
-  tags:
-    - setup-all
-    - setup-backup-borg
-    - install-all
-    - install-backup-borg
-
-- block:
-    - ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_uninstall.yml"
-      when: "run_setup | bool and not matrix_backup_borg_enabled | bool"
-  tags:
-    - setup-all
-    - setup-backup-borg

roles/custom/matrix-backup-borg/tasks/setup_install.yml

@@ -1,107 +0,0 @@
----
-
-- when: matrix_backup_borg_postgresql_enabled | bool and matrix_backup_borg_version == ''
-  block:
-    - name: Fail with matrix_backup_borg_version advice if Postgres not enabled
-      ansible.builtin.fail:
-        msg: >-
-          You are not running a built-in Postgres server (`devture_postgres_enabled: false`), so auto-detecting its version and setting `matrix_backup_borg_version` automatically based on that cannot happen.
-          Consider setting `matrix_backup_borg_version` to your Postgres version manually.
-      when: not devture_postgres_enabled
-
-    - ansible.builtin.include_role:
-        name: galaxy/com.devture.ansible.role.postgres
-        tasks_from: detect_existing_postgres_version
-
-    - name: Fail if detected Postgres version is unsupported
-      ansible.builtin.fail:
-        msg: "You cannot use borg backup with such an old version ({{ devture_postgres_detected_version }}) of Postgres. Consider upgrading - link to docs for upgrading Postgres: docs/maintenance-postgres.md#upgrading-postgresql"
-      when: "devture_postgres_detected_version not in matrix_backup_borg_supported_postgres_versions"
-
-    - name: Set the correct borg backup version to use
-      ansible.builtin.set_fact:
-        matrix_backup_borg_version: "{{ devture_postgres_detected_version }}-{{ matrix_backup_borg_borg_version }}-{{ matrix_backup_borg_borgmatic_version }}"
-
-- name: Ensure borg paths exist
-  ansible.builtin.file:
-    path: "{{ item.path }}"
-    state: directory
-    mode: 0750
-    owner: "{{ matrix_user_username }}"
-    group: "{{ matrix_user_groupname }}"
-  with_items:
-    - {path: "{{ matrix_backup_borg_config_path }}", when: true}
-    - {path: "{{ matrix_backup_borg_docker_src_files_path }}", when: true}
-  when: "item.when | bool"
-
-- name: Ensure borgmatic config is created
-  ansible.builtin.copy:
-    content: "{{ matrix_backup_borg_configuration | to_nice_yaml(indent=2, width=999999) }}"
-    dest: "{{ matrix_backup_borg_config_path }}/config.yaml"
-    owner: "{{ matrix_user_username }}"
-    group: "{{ matrix_user_groupname }}"
-    mode: 0640
-
-- name: Ensure borg passwd is created
-  ansible.builtin.template:
-    src: "{{ role_path }}/templates/passwd.j2"
-    dest: "{{ matrix_backup_borg_config_path }}/passwd"
-    owner: "{{ matrix_user_username }}"
-    group: "{{ matrix_user_groupname }}"
-    mode: 0640
-
-- name: Ensure borg ssh key is created
-  ansible.builtin.template:
-    src: "{{ role_path }}/templates/sshkey.j2"
-    dest: "{{ matrix_backup_borg_config_path }}/sshkey"
-    owner: "{{ matrix_user_username }}"
-    group: "{{ matrix_user_groupname }}"
-    mode: 0600
-
-- name: Ensure borg image is pulled
-  community.docker.docker_image:
-    name: "{{ matrix_backup_borg_docker_image }}"
-    source: "{{ 'pull' if ansible_version.major > 2 or ansible_version.minor > 7 else omit }}"
-    force_source: "{{ matrix_backup_borg_docker_image_force_pull if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}"
-    force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else matrix_backup_borg_docker_image_force_pull }}"
-  when: "not matrix_backup_borg_container_image_self_build | bool"
-  register: result
-  retries: "{{ devture_playbook_help_container_retries_count }}"
-  delay: "{{ devture_playbook_help_container_retries_delay }}"
-  until: result is not failed
-
-- name: Ensure borg repository is present on self-build
-  ansible.builtin.git:
-    repo: "{{ matrix_backup_borg_docker_repo }}"
-    version: "{{ matrix_backup_borg_docker_repo_version }}"
-    dest: "{{ matrix_backup_borg_docker_src_files_path }}"
-    force: "yes"
-  become: true
-  become_user: "{{ matrix_user_username }}"
-  register: matrix_backup_borg_git_pull_results
-  when: "matrix_backup_borg_container_image_self_build | bool"
-
-- name: Ensure borg image is built
-  community.docker.docker_image:
-    name: "{{ matrix_backup_borg_docker_image }}"
-    source: build
-    force_source: "{{ matrix_backup_borg_git_pull_results.changed if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}"
-    force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else matrix_mailer_git_pull_results.changed }}"
-    build:
-      dockerfile: Dockerfile
-      path: "{{ matrix_backup_borg_docker_src_files_path }}"
-      pull: true
-  when: "matrix_backup_borg_container_image_self_build | bool"
-
-- name: Ensure matrix-backup-borg.service installed
-  ansible.builtin.template:
-    src: "{{ role_path }}/templates/systemd/matrix-backup-borg.service.j2"
-    dest: "{{ devture_systemd_docker_base_systemd_path }}/matrix-backup-borg.service"
-    mode: 0644
-  register: matrix_backup_borg_systemd_service_result
-
-- name: Ensure matrix-backup-borg.timer installed
-  ansible.builtin.template:
-    src: "{{ role_path }}/templates/systemd/matrix-backup-borg.timer.j2"
-    dest: "{{ devture_systemd_docker_base_systemd_path }}/matrix-backup-borg.timer"
-    mode: 0644

roles/custom/matrix-backup-borg/tasks/setup_uninstall.yml

@@ -1,25 +0,0 @@
----
-
-- name: Check existence of matrix-backup-borg service
-  ansible.builtin.stat:
-    path: "{{ devture_systemd_docker_base_systemd_path }}/matrix-backup-borg.service"
-  register: matrix_backup_borg_service_stat
-
-- when: matrix_backup_borg_service_stat.stat.exists | bool
-  block:
-    - name: Ensure matrix-backup-borg is stopped
-      ansible.builtin.service:
-        name: matrix-backup-borg
-        state: stopped
-        enabled: false
-        daemon_reload: true
-
-    - name: Ensure matrix-backup-borg.service doesn't exist
-      ansible.builtin.file:
-        path: "{{ devture_systemd_docker_base_systemd_path }}/matrix-backup-borg.service"
-        state: absent
-
-    - name: Ensure matrix-backup-borg.timer doesn't exist
-      ansible.builtin.file:
-        path: "{{ devture_systemd_docker_base_systemd_path }}/matrix-backup-borg.timer"
-        state: absent

roles/custom/matrix-backup-borg/tasks/validate_config.yml

@@ -1,16 +0,0 @@
----
-- name: Fail if required backup-borg settings not defined
-  ansible.builtin.fail:
-    msg: >-
-      You need to define a required configuration setting (`{{ item.name }}`).
-  when: "item.when | bool and vars[item.name] == ''"
-  with_items:
-    - {'name': 'matrix_backup_borg_ssh_key_private', when: true}
-    - {'name': 'matrix_backup_borg_location_repositories', when: true}
-    - {'name': 'matrix_backup_borg_postgresql_databases_hostname', when: "{{ matrix_backup_borg_postgresql_enabled }}"}
-
-- name: Fail if encryption passphrase is undefined unless repository is unencrypted
-  ansible.builtin.fail:
-    msg: >-
-      You need to define a required passphrase using the `matrix_backup_borg_storage_encryption_passphrase` variable.
-  when: "matrix_backup_borg_storage_encryption_passphrase == '' and matrix_backup_borg_encryption != 'none'"

roles/custom/matrix-backup-borg/templates/config.yaml.j2

@@ -1,43 +0,0 @@
-#jinja2: lstrip_blocks: "True", trim_blocks: "True"
-
-location:
-  source_directories: {{ matrix_backup_borg_location_source_directories|to_json }}
-  repositories: {{ matrix_backup_borg_location_repositories|to_json }}
-  one_file_system: true
-  exclude_patterns: {{ matrix_backup_borg_location_exclude_patterns|to_json }}
-
-storage:
-  compression: {{ matrix_backup_borg_storage_compression|to_json }}
-  ssh_command: {{ matrix_backup_borg_storage_ssh_command|to_json }}
-  archive_name_format: {{ matrix_backup_borg_storage_archive_name_format|to_json }}
-  encryption_passphrase: {{ matrix_backup_borg_storage_encryption_passphrase|to_json }}
-  unknown_unencrypted_repo_access_is_ok: {{ matrix_backup_borg_unknown_unencrypted_repo_access_is_ok|to_json }}
-
-retention:
-  keep_hourly: {{ matrix_backup_borg_retention_keep_hourly|to_json }}
-  keep_daily: {{ matrix_backup_borg_retention_keep_daily|to_json }}
-  keep_weekly: {{ matrix_backup_borg_retention_keep_weekly|to_json }}
-  keep_monthly: {{ matrix_backup_borg_retention_keep_monthly|to_json }}
-  keep_yearly: {{ matrix_backup_borg_retention_keep_yearly|to_json }}
-  prefix: {{ matrix_backup_borg_retention_prefix|to_json }}
-
-consistency:
-  checks:
-    - repository
-    - archives
-
-hooks:
-{% if matrix_backup_borg_postgresql_enabled and matrix_backup_borg_postgresql_databases|length > 0 %}
-  postgresql_databases:
-  {% for database in matrix_backup_borg_postgresql_databases %}
-  - name: {{ database|to_json }}
-    hostname: {{ matrix_backup_borg_postgresql_databases_hostname|to_json }}
-    username: {{ matrix_backup_borg_postgresql_databases_username|to_json }}
-    password: {{ matrix_backup_borg_postgresql_databases_password|to_json }}
-    port: {{ matrix_backup_borg_postgresql_databases_port | int | to_json }}
-  {% endfor %}
-{% endif %}
-  after_backup:
-    - echo "Backup created."
-  on_error:
-    - echo "Error while creating a backup."

roles/custom/matrix-backup-borg/templates/passwd.j2

@@ -1,29 +0,0 @@
-{# the passwd file with correct username, UID and GID is mandatory to work with borg over ssh, otherwise ssh connections will fail #}
-root:x:0:0:root:/root:/bin/ash
-bin:x:1:1:bin:/bin:/sbin/nologin
-daemon:x:2:2:daemon:/sbin:/sbin/nologin
-adm:x:3:4:adm:/var/adm:/sbin/nologin
-lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
-sync:x:5:0:sync:/sbin:/bin/sync
-shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
-halt:x:7:0:halt:/sbin:/sbin/halt
-mail:x:8:12:mail:/var/mail:/sbin/nologin
-news:x:9:13:news:/usr/lib/news:/sbin/nologin
-uucp:x:10:14:uucp:/var/spool/uucppublic:/sbin/nologin
-operator:x:11:0:operator:/root:/sbin/nologin
-man:x:13:15:man:/usr/man:/sbin/nologin
-postmaster:x:14:12:postmaster:/var/mail:/sbin/nologin
-cron:x:16:16:cron:/var/spool/cron:/sbin/nologin
-ftp:x:21:21::/var/lib/ftp:/sbin/nologin
-sshd:x:22:22:sshd:/dev/null:/sbin/nologin
-at:x:25:25:at:/var/spool/cron/atjobs:/sbin/nologin
-squid:x:31:31:Squid:/var/cache/squid:/sbin/nologin
-xfs:x:33:33:X Font Server:/etc/X11/fs:/sbin/nologin
-games:x:35:35:games:/usr/games:/sbin/nologin
-cyrus:x:85:12::/usr/cyrus:/sbin/nologin
-vpopmail:x:89:89::/var/vpopmail:/sbin/nologin
-ntp:x:123:123:NTP:/var/empty:/sbin/nologin
-smmsp:x:209:209:smmsp:/var/spool/mqueue:/sbin/nologin
-guest:x:405:100:guest:/dev/null:/sbin/nologin
-{{ matrix_user_username }}:x:{{ matrix_user_uid }}:{{ matrix_user_gid }}:Matrix:/tmp:/bin/ash
-nobody:x:65534:65534:nobody:/:/sbin/nologin

roles/custom/matrix-backup-borg/templates/sshkey.j2

@@ -1 +0,0 @@
-{{ matrix_backup_borg_ssh_key_private }}

roles/custom/matrix-backup-borg/templates/systemd/matrix-backup-borg.service.j2

@@ -1,65 +0,0 @@
-#jinja2: lstrip_blocks: "True"
-[Unit]
-Description=Matrix Borg Backup
-{% for service in matrix_backup_borg_systemd_required_services_list %}
-Requires={{ service }}
-After={{ service }}
-{% endfor %}
-{% for service in matrix_backup_borg_systemd_wanted_services_list %}
-Wants={{ service }}
-{% endfor %}
-DefaultDependencies=no
-
-[Service]
-Type=oneshot
-Environment="HOME={{ devture_systemd_docker_base_systemd_unit_home_path }}"
-ExecStartPre=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} kill matrix-backup-borg 2>/dev/null || true'
-ExecStartPre=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} rm matrix-backup-borg 2>/dev/null || true'
-ExecStartPre=-{{ devture_systemd_docker_base_host_command_docker }} run --rm --name matrix-backup-borg \
-			--log-driver=none \
-			--cap-drop=ALL \
-			--read-only \
-			--user={{ matrix_user_uid }}:{{ matrix_user_gid }} \
-			--network={{ matrix_docker_network }} \
-			--tmpfs=/tmp:rw,noexec,nosuid,size=100m \
-			--mount type=bind,src={{ matrix_backup_borg_config_path }}/passwd,dst=/etc/passwd,ro \
-			--mount type=bind,src={{ matrix_backup_borg_config_path }},dst=/etc/borgmatic.d,ro \
-			{% for source in matrix_backup_borg_location_source_directories %}
-			--mount type=bind,src={{ source }},dst={{ source }},ro \
-			{% endfor %}
-			{% for arg in matrix_backup_borg_container_extra_arguments %}
-			{{ arg }} \
-			{% endfor %}
-			{{ matrix_backup_borg_docker_image }} \
-			sh -c "borgmatic rcreate --encryption {{ matrix_backup_borg_encryption }}"
-
-# The `CAP_DAC_OVERRIDE` capability is required, so that `root` in the container
-# can read the `/etc/borgmatic.d/config.yaml` (`{{ matrix_backup_borg_config_path }}/config.yaml`) file,
-# owned by `matrix:matrix` on the filesystem.
-#
-# `/root` is mountes as temporary filesystem, because we're using `--read-only` and because
-# Borgmatic tries to write to at least a few paths under `/root` (`.config`, `.ssh`, `.borgmatic`).
-ExecStart={{ devture_systemd_docker_base_host_command_docker }} run --rm --name matrix-backup-borg \
-			--log-driver=none \
-			--cap-drop=ALL \
-			--cap-add=CAP_DAC_OVERRIDE \
-			--read-only \
-			--network={{ matrix_docker_network }} \
-			--tmpfs=/root:rw,noexec,nosuid,size=100m \
-			--tmpfs=/tmp:rw,noexec,nosuid,size=100m \
-			--mount type=bind,src={{ matrix_backup_borg_config_path }}/passwd,dst=/etc/passwd,ro \
-			--mount type=bind,src={{ matrix_backup_borg_config_path }},dst=/etc/borgmatic.d,ro \
-			{% for source in matrix_backup_borg_location_source_directories %}
-			--mount type=bind,src={{ source }},dst={{ source }},ro \
-			{% endfor %}
-			{% for arg in matrix_backup_borg_container_extra_arguments %}
-			{{ arg }} \
-			{% endfor %}
-			{{ matrix_backup_borg_docker_image }}
-
-ExecStop=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} kill matrix-backup-borg 2>/dev/null || true'
-ExecStop=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} rm matrix-backup-borg 2>/dev/null || true'
-SyslogIdentifier=matrix-backup-borg
-
-[Install]
-WantedBy=multi-user.target

roles/custom/matrix-backup-borg/templates/systemd/matrix-backup-borg.timer.j2

@@ -1,10 +0,0 @@
-[Unit]
-Description=Matrix Borg Backup timer
-
-[Timer]
-Unit=matrix-backup-borg.service
-OnCalendar={{ matrix_backup_borg_schedule }}
-RandomizedDelaySec={{ matrix_backup_borg_schedule_randomized_delay_sec }}
-
-[Install]
-WantedBy=timers.target

roles/custom/matrix-base/defaults/main.yml

@@ -72,7 +72,7 @@ matrix_server_fqn_buscarron: "buscarron.{{ matrix_domain }}"
 # This is where you access the Dimension.
 matrix_server_fqn_dimension: "dimension.{{ matrix_domain }}"
 
-# This is where you access the etherpad (if enabled via matrix_etherpad_enabled; disabled by default).
+# This is where you access the etherpad (if enabled via etherpad_enabled; disabled by default).
 matrix_server_fqn_etherpad: "etherpad.{{ matrix_domain }}"
 
 # For use with Go-NEB! (github callback url for example)
@@ -90,6 +90,9 @@ matrix_server_fqn_sygnal: "sygnal.{{ matrix_domain }}"
 # This is where you access the ntfy push notification service.
 matrix_server_fqn_ntfy: "ntfy.{{ matrix_domain }}"
 
+# This is where you access rageshake.
+matrix_server_fqn_rageshake: "rageshake.{{ matrix_domain }}"
+
 matrix_federation_public_port: 8448
 
 # The name of the Traefik entrypoint for handling Matrix Federation
@@ -154,17 +157,25 @@ matrix_client_element_jitsi_preferredDomain: ''  # noqa var-naming
 # Controls whether Element should use End-to-End Encryption by default.
 # Setting this to false will update `/.well-known/matrix/client` and tell Element clients to avoid E2EE.
 # See: https://github.com/vector-im/element-web/blob/develop/docs/e2ee.md
-matrix_client_element_e2ee_default: true
+matrix_well_known_matrix_client_io_element_e2ee_default: true
 
 # Controls whether Element should require a secure backup set up before Element can be used.
 # Setting this to true will update `/.well-known/matrix/client` and tell Element require a secure backup.
 # See: https://github.com/vector-im/element-web/blob/develop/docs/e2ee.md
-matrix_client_element_e2ee_secure_backup_required: false
+matrix_well_known_matrix_client_io_element_e2ee_secure_backup_required: false
 
 # Controls which backup methods from ["key", "passphrase"] should be used, both is the default.
 # Setting this to other then empty will update `/.well-known/matrix/client` and tell Element which method to use
 # See: https://github.com/vector-im/element-web/blob/develop/docs/e2ee.md
-matrix_client_element_e2ee_secure_backup_setup_methods: []
+matrix_well_known_matrix_client_io_element_e2ee_secure_backup_setup_methods: []
+
+# Controls whether element related entries should be added to the client well-known. Override this to false to hide
+# element related well-known entries.
+# By default if any of the following change from their default this is set to true:
+# `matrix_well_known_matrix_client_io_element_e2ee_default`
+# `matrix_well_known_matrix_client_io_element_e2ee_secure_backup_required`
+# `matrix_well_known_matrix_client_io_element_e2ee_secure_backup_setup_methods`
+matrix_well_known_matrix_client_io_element_e2ee_entries_enabled: "{{ not matrix_well_known_matrix_client_io_element_e2ee_default or matrix_well_known_matrix_client_io_element_e2ee_secure_backup_required or matrix_well_known_matrix_client_io_element_e2ee_secure_backup_setup_methods | length > 0 }}"
 
 # Default `/.well-known/matrix/client` configuration - it covers the generic use case.
 # You can customize it by controlling the various variables inside the template file that it references.
@@ -273,9 +284,9 @@ matrix_homeserver_app_service_config_files_auto: []
 # Valid options and a description of their behavior:
 #
 # - `playbook-managed-traefik`
-#     - the playbook will install devture-traefik
+#     - the playbook will run a managed Traefik instance (matrix-traefik)
 #     - Traefik will do SSL termination, unless you disable it (e.g. `devture_traefik_config_entrypoint_web_secure_enabled: false`)
-#     - if SSL termination is enabled (as it is by default), you need to populate: `devture_traefik_ssl_email_address`
+#     - if SSL termination is enabled (as it is by default), you need to populate: `devture_traefik_config_certificatesResolvers_acme_email`
 #     - it will also install matrix-nginx-proxy in local-only mode, while we migrate the rest of the services to a Traefik-native mode of working
 #
 # - `playbook-managed-nginx`
@@ -308,7 +319,7 @@ matrix_homeserver_app_service_config_files_auto: []
 #     - no nginx configuration will be dumped in /matrix/nginx/conf.d
 #     - no port exposure will be done for any of the container services
 #     - it's up to you to expose the ports you want, etc.
-matrix_playbook_reverse_proxy_type: playbook-managed-nginx
+matrix_playbook_reverse_proxy_type: ''
 
 matrix_playbook_service_host_bind_interface_prefix: "{{ '' if matrix_playbook_reverse_proxy_type not in ['other-nginx-non-container', 'other-on-same-host', 'other-on-another-host'] else ('0.0.0.0:' if matrix_playbook_reverse_proxy_type == 'other-on-another-host' else '127.0.0.1:') }}"
 

roles/custom/matrix-base/tasks/main.yml

@@ -1,30 +1,28 @@
 ---
 
-- block:
+- tags:
-    - ansible.builtin.include_tasks: "{{ role_path }}/tasks/validate_config.yml"
-  tags:
     - setup-all
     - install-all
+  block:
+    - ansible.builtin.include_tasks: "{{ role_path }}/tasks/validate_config.yml"
 
 # This needs to always run, because it populates `matrix_user_uid` and `matrix_user_gid`,
 # which are required by many other roles.
-- block:
+- tags:
-    - ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_matrix_user.yml"
-  tags:
     - always
     - setup-system-user
     - common
+  block:
+    - ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_matrix_user.yml"
 
-- block:
+- tags:
-    - ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_matrix_base.yml"
-  tags:
     - setup-all
     - install-all
     - common
+  block:
+    - ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_matrix_base.yml"
 
-- block:
+- tags:
-    - ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_well_known.yml"
-  tags:
     - setup-all
     - setup-ma1sd
     - setup-synapse
@@ -37,3 +35,5 @@
     - install-dendrite
     - install-conduit
     - install-nginx-proxy
+  block:
+    - ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_well_known.yml"

roles/custom/matrix-base/tasks/validate_config.yml

@@ -18,6 +18,9 @@
     - {'old': 'hostname_riot', 'new': 'matrix_server_fqn_element'}
     - {'old': 'matrix_server_fqn_riot', 'new': 'matrix_server_fqn_element'}
     - {'old': 'matrix_local_bin_path', 'new': '<there is no global bin path anymore - each role has its own>'}
+    - {'old': 'matrix_client_element_e2ee_default', 'new': 'matrix_well_known_matrix_client_io_element_e2ee_default'}
+    - {'old': 'matrix_client_element_e2ee_secure_backup_required', 'new': 'matrix_well_known_matrix_client_io_element_e2ee_secure_backup_required'}
+    - {'old': 'matrix_client_element_e2ee_secure_backup_setup_methods', 'new': 'matrix_well_known_matrix_client_io_element_e2ee_secure_backup_setup_methods'}
 
 # We have a dedicated check for this variable, because we'd like to have a custom (friendlier) message.
 - name: Fail if matrix_homeserver_generic_secret_key is undefined
@@ -51,6 +54,14 @@
     msg: "Detected that variable matrix_architecture {{ matrix_architecture }} appears to be set incorrectly. See docs/alternative-architectures.md. Server appears to be {{ ansible_architecture }}."
   when: matrix_architecture not in ['amd64', 'arm32', 'arm64']
 
+- name: Fail if matrix_playbook_reverse_proxy_type is set incorrectly
+  ansible.builtin.fail:
+    msg: |
+      You have not explicitly specified the type of reverse-proxy you'd like to use (with a `matrix_playbook_reverse_proxy_type` variable in your configuration).
+      The playbook used to default to nginx (matrix-nginx-proxy), but things are changing with Traefik being the new default reverse-proxy.
+      Learn more here: https://github.com/spantaleev/matrix-docker-ansible-deploy/blob/master/CHANGELOG.md#traefik-is-the-default-reverse-proxy-now
+  when: matrix_playbook_reverse_proxy_type == ''
+
 - name: Fail if matrix_playbook_reverse_proxy_type is set incorrectly
   ansible.builtin.fail:
     msg: "Detected that variable matrix_playbook_reverse_proxy_type (current value: `{{ matrix_playbook_reverse_proxy_type }}`) appears to be set incorrectly. See roles/custom/matrix-base/defaults/main.yml for valid choices."

roles/custom/matrix-base/templates/bin/remove-all.j2

@@ -25,8 +25,12 @@ else
 
 	echo "Remove unused Docker images and resources"
 	docker system prune -af
+
 	echo "Remove Docker matrix network (should be gone already, but ..)"
 	docker network rm {{ matrix_docker_network }}
+
+	echo "This playbook creates a lot of matrix-* networks. Consider removing them manually ('docker network ls', followed by 'docker network rm NETWORK_NAME')"
+
 	echo "Remove {{ matrix_base_data_path }} directory"
 	rm -fr "{{ matrix_base_data_path }}"
 	exit 0

roles/custom/matrix-base/templates/static-files/well-known/matrix-client.j2

@@ -26,18 +26,26 @@
 		"preferredDomain": {{ matrix_client_element_jitsi_preferredDomain|to_json }}
 	}
 	{% endif %}
+	{% if matrix_sliding_sync_enabled %},
+	"org.matrix.msc3575.proxy": {
+		"url": "{{ matrix_sliding_sync_base_url }}"
+	}
+	{% endif %}
 	{% if matrix_client_element_location_sharing_enabled %},
 	"m.tile_server": {
         "map_style_url": "https://{{ matrix_server_fqn_element }}/map_style.json"
     }
 	{% endif %}
-	,
+	{% if matrix_well_known_matrix_client_io_element_e2ee_entries_enabled %},
 	"io.element.e2ee": {
-		"default": {{ matrix_client_element_e2ee_default|to_json }},
+		"default": {{ matrix_well_known_matrix_client_io_element_e2ee_default|to_json }},
-		"secure_backup_required": {{ matrix_client_element_e2ee_secure_backup_required|to_json }},
+		"secure_backup_required": {{ matrix_well_known_matrix_client_io_element_e2ee_secure_backup_required|to_json }},
-		"secure_backup_setup_methods": {{ matrix_client_element_e2ee_secure_backup_setup_methods|to_json }}
+		"secure_backup_setup_methods": {{ matrix_well_known_matrix_client_io_element_e2ee_secure_backup_setup_methods|to_json }}
-	},
-	"im.vector.riot.e2ee": {
-		"default": {{ matrix_client_element_e2ee_default|to_json }}
 	}
+	{% endif %}
+	{% if matrix_well_known_matrix_client_io_element_e2ee_entries_enabled %},
+	"im.vector.riot.e2ee": {
+		"default": {{ matrix_well_known_matrix_client_io_element_e2ee_default|to_json }}
+	}
+	{% endif %}
 }

roles/custom/matrix-bot-buscarron/defaults/main.yml

@@ -1,23 +1,70 @@
 ---
-# buscarron is a helpdesk bot
+
+# buscarron is a Web forms (HTTP POST) to Matrix service.
 # Project source code URL: https://gitlab.com/etke.cc/buscarron
 
 matrix_bot_buscarron_enabled: true
 
+matrix_bot_buscarron_version: v1.3.1
+
+# The hostname at which Buscarron is served.
+matrix_bot_buscarron_hostname: ''
+
+# The path at which Buscarron is exposed.
+# This value must either be `/` or not end with a slash (e.g. `/buscarron`).
+matrix_bot_buscarron_path_prefix: /
+
+matrix_bot_buscarron_base_path: "{{ matrix_base_data_path }}/buscarron"
+matrix_bot_buscarron_config_path: "{{ matrix_bot_buscarron_base_path }}/config"
+matrix_bot_buscarron_data_path: "{{ matrix_bot_buscarron_base_path }}/data"
+matrix_bot_buscarron_data_store_path: "{{ matrix_bot_buscarron_data_path }}/store"
+
 matrix_bot_buscarron_container_image_self_build: false
 matrix_bot_buscarron_docker_repo: "https://gitlab.com/etke.cc/buscarron.git"
 matrix_bot_buscarron_docker_repo_version: "{{ matrix_bot_buscarron_version }}"
 matrix_bot_buscarron_docker_src_files_path: "{{ matrix_base_data_path }}/buscarron/docker-src"
 
-matrix_bot_buscarron_version: v1.3.1
 matrix_bot_buscarron_docker_image: "{{ matrix_bot_buscarron_docker_image_name_prefix }}etke.cc/buscarron:{{ matrix_bot_buscarron_version }}"
 matrix_bot_buscarron_docker_image_name_prefix: "{{ 'localhost/' if matrix_bot_buscarron_container_image_self_build else 'registry.gitlab.com/' }}"
 matrix_bot_buscarron_docker_image_force_pull: "{{ matrix_bot_buscarron_docker_image.endswith(':latest') }}"
 
-matrix_bot_buscarron_base_path: "{{ matrix_base_data_path }}/buscarron"
+# The base container network. It will be auto-created by this role if it doesn't exist already.
-matrix_bot_buscarron_config_path: "{{ matrix_bot_buscarron_base_path }}/config"
+matrix_bot_buscarron_container_network: matrix-bot-buscarron
-matrix_bot_buscarron_data_path: "{{ matrix_bot_buscarron_base_path }}/data"
+
-matrix_bot_buscarron_data_store_path: "{{ matrix_bot_buscarron_data_path }}/store"
+# A list of additional container networks that the container would be connected to.
+# The role does not create these networks, so make sure they already exist.
+# Use this to expose this container to another reverse proxy, which runs in a different container network.
+matrix_bot_buscarron_container_additional_networks: []
+
+# matrix_bot_buscarron_container_labels_traefik_enabled controls whether labels to assist a Traefik reverse-proxy will be attached to the container.
+# See `../templates/labels.j2` for details.
+#
+# To inject your own other container labels, see `matrix_bot_buscarron_container_labels_additional_labels`.
+matrix_bot_buscarron_container_labels_traefik_enabled: true
+matrix_bot_buscarron_container_labels_traefik_docker_network: "{{ matrix_bot_buscarron_container_network }}"
+matrix_bot_buscarron_container_labels_traefik_hostname: "{{ matrix_bot_buscarron_hostname }}"
+# The path prefix must either be `/` or not end with a slash (e.g. `/buscarron`).
+matrix_bot_buscarron_container_labels_traefik_path_prefix: "{{ matrix_bot_buscarron_path_prefix }}"
+matrix_bot_buscarron_container_labels_traefik_rule: "Host(`{{ matrix_bot_buscarron_container_labels_traefik_hostname }}`){% if matrix_bot_buscarron_container_labels_traefik_path_prefix != '/' %} && PathPrefix(`{{ matrix_bot_buscarron_container_labels_traefik_path_prefix }}`){% endif %}"
+matrix_bot_buscarron_container_labels_traefik_priority: 0
+matrix_bot_buscarron_container_labels_traefik_entrypoints: web-secure
+matrix_bot_buscarron_container_labels_traefik_tls: "{{ matrix_bot_buscarron_container_labels_traefik_entrypoints != 'web' }}"
+matrix_bot_buscarron_container_labels_traefik_tls_certResolver: default  # noqa var-naming
+
+# Controls which additional headers to attach to all HTTP responses.
+# To add your own headers, use `matrix_bot_buscarron_container_labels_traefik_additional_response_headers_custom`
+matrix_bot_buscarron_container_labels_traefik_additional_response_headers: "{{ matrix_bot_buscarron_container_labels_traefik_additional_response_headers_auto | combine(matrix_bot_buscarron_container_labels_traefik_additional_response_headers_custom) }}"
+matrix_bot_buscarron_container_labels_traefik_additional_response_headers_auto: {}
+matrix_bot_buscarron_container_labels_traefik_additional_response_headers_custom: {}
+
+# matrix_bot_buscarron_container_labels_additional_labels contains a multiline string with additional labels to add to the container label file.
+# See `../templates/labels.j2` for details.
+#
+# Example:
+# matrix_bot_buscarron_container_labels_additional_labels: |
+#   my.label=1
+#   another.label="here"
+matrix_bot_buscarron_container_labels_additional_labels: ''
 
 # A list of extra arguments to pass to the container
 matrix_bot_buscarron_container_extra_arguments: []

roles/custom/matrix-bot-buscarron/tasks/main.yml

@@ -1,20 +1,20 @@
 ---
 
-- block:
+- tags:
+    - setup-all
+    - setup-bot-buscarron
+    - install-all
+    - install-bot-buscarron
+  block:
     - ansible.builtin.include_tasks: "{{ role_path }}/tasks/validate_config.yml"
       when: "run_setup | bool and matrix_bot_buscarron_enabled | bool"
 
     - ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_install.yml"
       when: "run_setup | bool and matrix_bot_buscarron_enabled | bool"
-  tags:
+
+- tags:
     - setup-all
     - setup-bot-buscarron
-    - install-all
+  block:
-    - install-bot-buscarron
-
-- block:
     - ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_uninstall.yml"
       when: "run_setup | bool and not matrix_bot_buscarron_enabled | bool"
-  tags:
-    - setup-all
-    - setup-bot-buscarron

roles/custom/matrix-bot-buscarron/tasks/setup_install.yml

@@ -40,13 +40,16 @@
     - {path: "{{ matrix_bot_buscarron_docker_src_files_path }}", when: true}
   when: "item.when | bool"
 
-- name: Ensure buscarron environment variables file created
+- name: Ensure buscarron support files installed
   ansible.builtin.template:
-    src: "{{ role_path }}/templates/env.j2"
+    src: "{{ role_path }}/templates/{{ item }}.j2"
-    dest: "{{ matrix_bot_buscarron_config_path }}/env"
+    dest: "{{ matrix_bot_buscarron_config_path }}/{{ item }}"
     owner: "{{ matrix_user_username }}"
     group: "{{ matrix_user_groupname }}"
     mode: 0640
+  with_items:
+    - env
+    - labels
 
 - name: Ensure buscarron image is pulled
   community.docker.docker_image:
@@ -89,6 +92,11 @@
     dest: "{{ devture_systemd_docker_base_systemd_path }}/matrix-bot-buscarron.service"
     mode: 0644
 
+- name: Ensure buscarron container network is created
+  community.general.docker_network:
+    name: "{{ matrix_bot_buscarron_container_network }}"
+    driver: bridge
+
 - name: Ensure matrix-bot-buscarron.service restarted, if necessary
   ansible.builtin.service:
     name: "matrix-bot-buscarron.service"

roles/custom/matrix-bot-buscarron/tasks/validate_config.yml

@@ -7,4 +7,5 @@
   when: "item.when | bool and vars[item.name] == ''"
   with_items:
     - {'name': 'matrix_bot_buscarron_password', when: true}
+    - {'name': 'matrix_bot_buscarron_hostname', when: true}
     - {'name': 'matrix_bot_buscarron_database_hostname', when: "{{ matrix_bot_buscarron_database_engine == 'postgres' }}"}

roles/custom/matrix-bot-buscarron/templates/labels.j2

@@ -0,0 +1,45 @@
+{% if matrix_bot_buscarron_container_labels_traefik_enabled %}
+traefik.enable=true
+
+{% if matrix_bot_buscarron_container_labels_traefik_docker_network %}
+traefik.docker.network={{ matrix_bot_buscarron_container_labels_traefik_docker_network }}
+{% endif %}
+
+{% set middlewares = [] %}
+
+{% if matrix_bot_buscarron_container_labels_traefik_path_prefix != '/' %}
+traefik.http.middlewares.matrix-bot-buscarron-slashless-redirect.redirectregex.regex=({{ matrix_bot_buscarron_container_labels_traefik_path_prefix | quote }})$
+traefik.http.middlewares.matrix-bot-buscarron-slashless-redirect.redirectregex.replacement=${1}/
+{% set middlewares = middlewares + ['matrix-bot-buscarron-slashless-redirect'] %}
+{% endif %}
+
+{% if matrix_bot_buscarron_container_labels_traefik_path_prefix != '/' %}
+traefik.http.middlewares.matrix-bot-buscarron-strip-prefix.stripprefix.prefixes={{ matrix_bot_buscarron_container_labels_traefik_path_prefix }}
+{% set middlewares = middlewares + ['matrix-bot-buscarron-strip-prefix'] %}
+{% endif %}
+
+{% if matrix_bot_buscarron_container_labels_traefik_additional_response_headers.keys() | length > 0 %}
+{% for name, value in matrix_bot_buscarron_container_labels_traefik_additional_response_headers.items() %}
+traefik.http.middlewares.matrix-bot-buscarron-add-headers.headers.customresponseheaders.{{ name }}={{ value }}
+{% endfor %}
+{% set middlewares = middlewares + ['matrix-bot-buscarron-add-headers'] %}
+{% endif %}
+
+traefik.http.routers.matrix-bot-buscarron.rule={{ matrix_bot_buscarron_container_labels_traefik_rule }}
+{% if matrix_bot_buscarron_container_labels_traefik_priority | int > 0 %}
+traefik.http.routers.matrix-bot-buscarron.priority={{ matrix_bot_buscarron_container_labels_traefik_priority }}
+{% endif %}
+traefik.http.routers.matrix-bot-buscarron.service=matrix-bot-buscarron
+{% if middlewares | length > 0 %}
+traefik.http.routers.matrix-bot-buscarron.middlewares={{ middlewares | join(',') }}
+{% endif %}
+traefik.http.routers.matrix-bot-buscarron.entrypoints={{ matrix_bot_buscarron_container_labels_traefik_entrypoints }}
+traefik.http.routers.matrix-bot-buscarron.tls={{ matrix_bot_buscarron_container_labels_traefik_tls | to_json }}
+{% if matrix_bot_buscarron_container_labels_traefik_tls %}
+traefik.http.routers.matrix-bot-buscarron.tls.certResolver={{ matrix_bot_buscarron_container_labels_traefik_tls_certResolver }}
+{% endif %}
+
+traefik.http.services.matrix-bot-buscarron.loadbalancer.server.port=8080
+{% endif %}
+
+{{ matrix_bot_buscarron_container_labels_additional_labels }}

roles/custom/matrix-bot-buscarron/templates/systemd/matrix-bot-buscarron.service.j2

@@ -16,21 +16,31 @@ Environment="HOME={{ devture_systemd_docker_base_systemd_unit_home_path }}"
 ExecStartPre=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} kill matrix-bot-buscarron 2>/dev/null || true'
 ExecStartPre=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} rm matrix-bot-buscarron 2>/dev/null || true'
 
-ExecStart={{ devture_systemd_docker_base_host_command_docker }} run --rm --name matrix-bot-buscarron \
+ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} create \
+			--rm \
+			--name=matrix-bot-buscarron \
 			--log-driver=none \
 			--user={{ matrix_user_uid }}:{{ matrix_user_gid }} \
 			--cap-drop=ALL \
 			--read-only \
-			--network={{ matrix_docker_network }} \
+			--network={{ matrix_bot_buscarron_container_network }} \
 			--env-file={{ matrix_bot_buscarron_config_path }}/env \
+			--label-file={{ matrix_bot_buscarron_config_path }}/labels \
 			--mount type=bind,src={{ matrix_bot_buscarron_data_path }},dst=/data \
 			{% for arg in matrix_bot_buscarron_container_extra_arguments %}
 			{{ arg }} \
 			{% endfor %}
 			{{ matrix_bot_buscarron_docker_image }}
 
+{% for network in matrix_bot_buscarron_container_additional_networks %}
+ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} network connect {{ network }} matrix-bot-buscarron
+{% endfor %}
+
+ExecStart={{ devture_systemd_docker_base_host_command_docker }} start --attach matrix-bot-buscarron
+
 ExecStop=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} kill matrix-bot-buscarron 2>/dev/null || true'
 ExecStop=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} rm matrix-bot-buscarron 2>/dev/null || true'
+
 Restart=always
 RestartSec=30
 SyslogIdentifier=matrix-bot-buscarron

roles/custom/matrix-bot-chatgpt/defaults/main.yml

@@ -4,19 +4,22 @@
 
 matrix_bot_chatgpt_enabled: true
 
-matrix_bot_chatgpt_container_image_self_build: false
+matrix_bot_chatgpt_version: 3.0.0
-matrix_bot_chatgpt_docker_repo: "https://github.com/matrixgpt/matrix-chatgpt-bot"
-matrix_bot_chatgpt_docker_repo_version: "{{ 'latest' if matrix_bot_chatgpt_version == 'latest' else matrix_bot_chatgpt_version }}"
-matrix_bot_chatgpt_docker_src_files_path: "{{ matrix_base_data_path }}/chatgpt/docker-src"
 
-matrix_bot_chatgpt_version: 2.2.1
+matrix_bot_chatgpt_container_image_self_build: false
-matrix_bot_chatgpt_docker_image: "{{ matrix_bot_chatgpt_docker_image_name_prefix }}matrixgpt/matrix-chatgpt-bot:{{ matrix_bot_chatgpt_version }}"
+matrix_bot_chatgpt_container_image_self_build_repo: "https://github.com/matrixgpt/matrix-chatgpt-bot"
-matrix_bot_chatgpt_docker_image_name_prefix: "{{ 'localhost/' if matrix_bot_chatgpt_container_image_self_build else 'ghcr.io/' }}"
+matrix_bot_chatgpt_container_image_self_build_repo_version: "{{ 'main' if matrix_bot_chatgpt_version == 'latest' else matrix_bot_chatgpt_version }}"
-matrix_bot_chatgpt_docker_image_force_pull: "{{ matrix_bot_chatgpt_docker_image.endswith(':latest') }}"
+
+matrix_bot_chatgpt_container_image: "{{ matrix_bot_chatgpt_container_image_name_prefix }}matrixgpt/matrix-chatgpt-bot:{{ matrix_bot_chatgpt_container_image_tag }}"
+matrix_bot_chatgpt_container_image_name_prefix: "{{ 'localhost/' if matrix_bot_chatgpt_container_image_self_build else matrix_bot_chatgpt_container_image_registry_prefix }}"
+matrix_bot_chatgpt_container_image_tag: "{{ matrix_bot_chatgpt_version }}"
+matrix_bot_chatgpt_container_image_force_pull: "{{ matrix_bot_chatgpt_container_image.endswith(':latest') }}"
+matrix_bot_chatgpt_container_image_registry_prefix: ghcr.io/
 
 matrix_bot_chatgpt_base_path: "{{ matrix_base_data_path }}/chatgpt"
 matrix_bot_chatgpt_config_path: "{{ matrix_bot_chatgpt_base_path }}/config"
 matrix_bot_chatgpt_data_path: "{{ matrix_bot_chatgpt_base_path }}/data"
+matrix_bot_chatgpt_container_src_path: "{{ matrix_bot_chatgpt_base_path }}/container-src"
 
 # A list of extra arguments to pass to the container
 matrix_bot_chatgpt_container_extra_arguments: []
@@ -29,6 +32,7 @@ matrix_bot_chatgpt_systemd_wanted_services_list: []
 
 # ChatGPT Settings
 matrix_bot_chatgpt_openai_api_key: ''
+matrix_bot_chatgpt_api_model: 'gpt-3.5-turbo'
 matrix_bot_chatgpt_context: 'thread'  # CHATGPT_CONTEXT="thread"
 
 matrix_bot_chatgpt_keyv_backend: 'file'
@@ -53,6 +57,9 @@ matrix_bot_chatgpt_matrix_default_prefix: "!chatgpt "  # MATRIX_DEFAULT_PREFIX=
 matrix_bot_chatgpt_matrix_default_prefix_reply: false  # MATRIX_DEFAULT_PREFIX_REPLY=
 
 # Matrix Access Control (optional)
+#
+# Lists of space-separated entries. Example:
+# matrix_bot_chatgpt_matrix_whitelist: ":{{ matrix_domain }} :second-domain.com :third-domain.com"
 matrix_bot_chatgpt_matrix_blacklist: ''
 matrix_bot_chatgpt_matrix_whitelist: ':{{ matrix_domain }}'
 
@@ -72,11 +79,11 @@ matrix_bot_chatgpt_matrix_rich_text: true  # MATRIX_RICH_TEXT=true
 # - @*:another.com
 # matrix_bot_chatgpt_admins: "{{ [matrix_admin] if matrix_admin else [] }}"
 
-# Log level
-# matrix_bot_chatgpt_loglevel: 'INFO'
-
 # Additional environment variables to pass to the chatgpt container
 #
+# You can discover additional environment variables from:
+# https://github.com/matrixgpt/matrix-chatgpt-bot/blob/main/src/env.ts
+#
 # Example:
 # matrix_bot_chatgpt_environment_variables_extension: |
 #   chatgpt_TEXT_DONE=Done

roles/custom/matrix-bot-chatgpt/tasks/install.yml

@@ -0,0 +1,63 @@
+---
+
+- name: Ensure chatgpt paths exist
+  ansible.builtin.file:
+    path: "{{ item.path }}"
+    state: directory
+    mode: 0750
+    owner: "{{ matrix_user_username }}"
+    group: "{{ matrix_user_groupname }}"
+  with_items:
+    - {path: "{{ matrix_bot_chatgpt_config_path }}", when: true}
+    - {path: "{{ matrix_bot_chatgpt_data_path }}", when: true}
+    - {path: "{{ matrix_bot_chatgpt_container_src_path }}", when: matrix_bot_chatgpt_container_image_self_build}
+  when: "item.when | bool"
+
+- name: Ensure chatgpt environment variables file created
+  ansible.builtin.template:
+    src: "{{ role_path }}/templates/env.j2"
+    dest: "{{ matrix_bot_chatgpt_config_path }}/env"
+    owner: "{{ matrix_user_username }}"
+    group: "{{ matrix_user_groupname }}"
+    mode: 0640
+
+- name: Ensure chatgpt container image is pulled
+  community.docker.docker_image:
+    name: "{{ matrix_bot_chatgpt_container_image }}"
+    source: "{{ 'pull' if ansible_version.major > 2 or ansible_version.minor > 7 else omit }}"
+    force_source: "{{ matrix_bot_chatgpt_container_image_force_pull if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}"
+    force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else matrix_bot_chatgpt_container_image_force_pull }}"
+  when: "not matrix_bot_chatgpt_container_image_self_build | bool"
+  register: result
+  retries: "{{ devture_playbook_help_container_retries_count }}"
+  delay: "{{ devture_playbook_help_container_retries_delay }}"
+  until: result is not failed
+
+- when: matrix_bot_chatgpt_container_image_self_build | bool
+  block:
+    - name: Ensure chatgpt repository is present on self-build
+      ansible.builtin.git:
+        repo: "{{ matrix_bot_chatgpt_container_image_self_build_repo }}"
+        version: "{{ matrix_bot_chatgpt_container_image_self_build_repo_version }}"
+        dest: "{{ matrix_bot_chatgpt_container_src_path }}"
+        force: "yes"
+      become: true
+      become_user: "{{ matrix_user_username }}"
+      register: matrix_bot_chatgpt_git_pull_results
+
+    - name: Ensure chatgpt container image is built
+      community.docker.docker_image:
+        name: "{{ matrix_bot_chatgpt_container_image }}"
+        source: build
+        force_source: "{{ matrix_bot_chatgpt_git_pull_results.changed if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}"
+        force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else matrix_mailer_git_pull_results.changed }}"
+        build:
+          dockerfile: Dockerfile
+          path: "{{ matrix_bot_chatgpt_container_src_path }}"
+          pull: true
+
+- name: Ensure matrix-bot-chatgpt.service installed
+  ansible.builtin.template:
+    src: "{{ role_path }}/templates/systemd/matrix-bot-chatgpt.service.j2"
+    dest: "{{ devture_systemd_docker_base_systemd_path }}/matrix-bot-chatgpt.service"
+    mode: 0644

roles/custom/matrix-bot-chatgpt/tasks/main.yml

@@ -1,20 +1,21 @@
 ---
 
-- block:
+-
-    - when: matrix_bot_chatgpt_enabled | bool
-      ansible.builtin.include_tasks: "{{ role_path }}/tasks/validate_config.yml"
-
-    - when: matrix_bot_chatgpt_enabled | bool
-      ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_install.yml"
   tags:
     - setup-all
     - setup-bot-chatgpt
     - install-all
     - install-bot-chatgpt
+  block:
+    - when: matrix_bot_chatgpt_enabled | bool
+      ansible.builtin.include_tasks: "{{ role_path }}/tasks/validate_config.yml"
 
-- block:
+    - when: matrix_bot_chatgpt_enabled | bool
-    - when: not matrix_bot_chatgpt_enabled | bool
+      ansible.builtin.include_tasks: "{{ role_path }}/tasks/install.yml"
-      ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_uninstall.yml"
+
-  tags:
+- tags:
     - setup-all
     - setup-bot-chatgpt
+  block:
+    - when: not matrix_bot_chatgpt_enabled | bool
+      ansible.builtin.include_tasks: "{{ role_path }}/tasks/uninstall.yml"

roles/custom/matrix-bot-chatgpt/tasks/setup_install.yml

@@ -1,63 +0,0 @@
----
-- name: Ensure chatgpt paths exist
-  ansible.builtin.file:
-    path: "{{ item.path }}"
-    state: directory
-    mode: 0750
-    owner: "{{ matrix_user_username }}"
-    group: "{{ matrix_user_groupname }}"
-  with_items:
-    - {path: "{{ matrix_bot_chatgpt_config_path }}", when: true}
-    - {path: "{{ matrix_bot_chatgpt_data_path }}", when: true}
-    - {path: "{{ matrix_bot_chatgpt_docker_src_files_path }}", when: matrix_bot_chatgpt_container_image_self_build}
-  when: "item.when | bool"
-
-- name: Ensure chatgpt environment variables file created
-  ansible.builtin.template:
-    src: "{{ role_path }}/templates/env.j2"
-    dest: "{{ matrix_bot_chatgpt_config_path }}/env"
-    owner: "{{ matrix_user_username }}"
-    group: "{{ matrix_user_groupname }}"
-    mode: 0640
-
-- name: Ensure chatgpt image is pulled
-  community.docker.docker_image:
-    name: "{{ matrix_bot_chatgpt_docker_image }}"
-    source: "{{ 'pull' if ansible_version.major > 2 or ansible_version.minor > 7 else omit }}"
-    force_source: "{{ matrix_bot_chatgpt_docker_image_force_pull if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}"
-    force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else matrix_bot_chatgpt_docker_image_force_pull }}"
-  when: "not matrix_bot_chatgpt_container_image_self_build | bool"
-  register: result
-  retries: "{{ devture_playbook_help_container_retries_count }}"
-  delay: "{{ devture_playbook_help_container_retries_delay }}"
-  until: result is not failed
-
-- name: Ensure chatgpt repository is present on self-build
-  ansible.builtin.git:
-    repo: "{{ matrix_bot_chatgpt_docker_repo }}"
-    version: "{{ matrix_bot_chatgpt_docker_repo_version }}"
-    dest: "{{ matrix_bot_chatgpt_docker_src_files_path }}"
-    force: "yes"
-  become: true
-  become_user: "{{ matrix_user_username }}"
-  register: matrix_bot_chatgpt_git_pull_results
-  when: "matrix_bot_chatgpt_container_image_self_build | bool"
-
-- name: Ensure chatgpt image is built
-  community.docker.docker_image:
-    name: "{{ matrix_bot_chatgpt_docker_image }}"
-    source: build
-    force_source: "{{ matrix_bot_chatgpt_git_pull_results.changed if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}"
-    force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else matrix_mailer_git_pull_results.changed }}"
-    build:
-      dockerfile: Dockerfile
-      path: "{{ matrix_bot_chatgpt_docker_src_files_path }}"
-      pull: true
-  when: "matrix_bot_chatgpt_container_image_self_build | bool"
-
-- name: Ensure matrix-bot-chatgpt.service installed
-  ansible.builtin.template:
-    src: "{{ role_path }}/templates/systemd/matrix-bot-chatgpt.service.j2"
-    dest: "{{ devture_systemd_docker_base_systemd_path }}/matrix-bot-chatgpt.service"
-    mode: 0644
-  register: matrix_bot_chatgpt_systemd_service_result

roles/custom/matrix-bot-chatgpt/tasks/validate_config.yml

@@ -9,7 +9,6 @@
     - {'name': 'matrix_bot_chatgpt_openai_api_key', when: true}
     - {'name': 'matrix_bot_chatgpt_matrix_bot_username', when: true}
 
-
 - name: Fail if OpenAI configuration not up-to-date.
   ansible.builtin.fail:
     msg: >-
@@ -20,3 +19,17 @@
     - {'name': 'matrix_bot_chatgpt_openai_email'}
     - {'name': 'matrix_bot_chatgpt_openai_password'}
     - {'name': 'matrix_bot_chatgpt_openai_login_type'}
+
+- name: (Deprecation) Catch and report renamed ChatGPT settings
+  ansible.builtin.fail:
+    msg: >-
+      Your configuration contains a variable, which now has a different name.
+      Please change your configuration to rename the variable (`{{ item.old }}` -> `{{ item.new }}`).
+  when: "item.old in vars"
+  with_items:
+    - {'old': 'matrix_bot_chatgpt_docker_image', 'new': 'matrix_bot_chatgpt_container_image'}
+    - {'old': 'matrix_bot_chatgpt_docker_image_name_prefix', 'new': 'matrix_bot_chatgpt_container_image_name_prefix'}
+    - {'old': 'matrix_bot_chatgpt_docker_image_force_pull', 'new': 'matrix_bot_chatgpt_container_image_force_pull'}
+    - {'old': 'matrix_bot_chatgpt_docker_repo', 'new': 'matrix_bot_chatgpt_container_image_self_build_repo'}
+    - {'old': 'matrix_bot_chatgpt_docker_repo_version', 'new': 'matrix_bot_chatgpt_container_image_self_build_repo_version'}
+    - {'old': 'matrix_bot_chatgpt_docker_src_files_path', 'new': 'matrix_bot_chatgpt_container_src_path'}

roles/custom/matrix-bot-chatgpt/templates/env.j2

@@ -3,6 +3,7 @@ MATRIX_ACCESS_TOKEN={{ matrix_bot_chatgpt_matrix_access_token }}
 
 OPENAI_API_KEY={{ matrix_bot_chatgpt_openai_api_key }}
 CHATGPT_CONTEXT={{ matrix_bot_chatgpt_context }}
+CHATGPT_API_MODEL={{ matrix_bot_chatgpt_api_model }}
 
 KEYV_BACKEND={{ matrix_bot_chatgpt_keyv_backend }}
 KEYV_URL={{ matrix_bot_chatgpt_keyv_url }}

roles/custom/matrix-bot-chatgpt/templates/systemd/matrix-bot-chatgpt.service.j2

@@ -16,7 +16,9 @@ Environment="HOME={{ devture_systemd_docker_base_systemd_unit_home_path }}"
 ExecStartPre=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} kill matrix-bot-chatgpt 2>/dev/null || true'
 ExecStartPre=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} rm matrix-bot-chatgpt 2>/dev/null || true'
 
-ExecStart={{ devture_systemd_docker_base_host_command_docker }} run --rm --name matrix-bot-chatgpt \
+ExecStart={{ devture_systemd_docker_base_host_command_docker }} run \
+			--rm \
+			--name=matrix-bot-chatgpt \
 			--log-driver=none \
 			--user={{ matrix_user_uid }}:{{ matrix_user_gid }} \
 			--cap-drop=ALL \
@@ -29,7 +31,7 @@ ExecStart={{ devture_systemd_docker_base_host_command_docker }} run --rm --name
 			{% for arg in matrix_bot_chatgpt_container_extra_arguments %}
 			{{ arg }} \
 			{% endfor %}
-			{{ matrix_bot_chatgpt_docker_image }}
+			{{ matrix_bot_chatgpt_container_image }}
 
 ExecStop=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} kill matrix-bot-chatgpt 2>/dev/null || true'
 ExecStop=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} rm matrix-bot-chatgpt 2>/dev/null || true'

roles/custom/matrix-bot-draupnir/defaults/main.yml

@@ -4,7 +4,7 @@
 
 matrix_bot_draupnir_enabled: true
 
-matrix_bot_draupnir_version: "v1.80.0-beta.0"
+matrix_bot_draupnir_version: "v1.80.1"
 
 matrix_bot_draupnir_container_image_self_build: false
 matrix_bot_draupnir_container_image_self_build_repo: "https://github.com/Gnuxie/Draupnir.git"

roles/custom/matrix-bot-draupnir/tasks/main.yml

@@ -1,20 +1,20 @@
 ---
 
-- block:
+- tags:
+    - setup-all
+    - setup-bot-draupnir
+    - install-all
+    - install-bot-draupnir
+  block:
     - when: matrix_bot_draupnir_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/validate_config.yml"
 
     - when: matrix_bot_draupnir_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_install.yml"
-  tags:
+
+- tags:
     - setup-all
     - setup-bot-draupnir
-    - install-all
+  block:
-    - install-bot-draupnir
-
-- block:
     - when: not matrix_bot_draupnir_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_uninstall.yml"
-  tags:
-    - setup-all
-    - setup-bot-draupnir

roles/custom/matrix-bot-draupnir/templates/production.yaml.j2

@@ -1,79 +1,79 @@
-# Endpoint URL that draupnir uses to interact with the matrix homeserver (client-server API),
+# Endpoint URL that Draupnir uses to interact with the matrix homeserver (client-server API),
 # set this to the pantalaimon URL if you're using that.
 homeserverUrl: "{{ matrix_homeserver_url }}"
 
-# Endpoint URL that draupnir could use to fetch events related to reports (client-server API and /_synapse/),
+# Endpoint URL that Draupnir could use to fetch events related to reports (client-server API and /_synapse/),
 # only set this to the public-internet homeserver client API URL, do NOT set this to the pantalaimon URL.
 rawHomeserverUrl: "{{ matrix_homeserver_url }}"
 
-# Matrix Access Token to use, draupnir will only use this if pantalaimon.use is false.
+# Matrix Access Token to use, Draupnir will only use this if pantalaimon.use is false.
 accessToken: "{{ matrix_bot_draupnir_access_token }}"
 
 # Options related to Pantalaimon (https://github.com/matrix-org/pantalaimon)
 #pantalaimon:
-#  # Whether or not draupnir will use pantalaimon to access the matrix homeserver,
+#  # Whether or not Draupnir will use pantalaimon to access the matrix homeserver,
 #  # set to `true` if you're using pantalaimon.
 #  #
 #  # Be sure to point homeserverUrl to the pantalaimon instance.
 #  #
-#  # draupnir will log in using the given username and password once,
+#  # Draupnir will log in using the given username and password once,
 #  # then store the resulting access token in a file under dataPath.
 #  use: false
 #
 #  # The username to login with.
 #  username: draupnir
 #
-#  # The password draupnir will login with.
+#  # The password Draupnir will login with.
 #  #
 #  # After successfully logging in once, this will be ignored, so this value can be blanked after first startup.
 #  password: your_password
 
-# The path draupnir will store its state/data in, leave default ("/data/storage") when using containers.
+# The path Draupnir will store its state/data in, leave default ("/data/storage") when using containers.
 dataPath: "/data"
 
-# If true (the default), draupnir will only accept invites from users present in managementRoom.
+# If true (the default), Draupnir will only accept invites from users present in managementRoom.
 autojoinOnlyIfManager: true
 
 # If `autojoinOnlyIfManager` is false, only the members in this space can invite
 # the bot to new rooms.
 #acceptInvitesFromSpace: "!example:example.org"
 
-# Whether draupnir should report ignored invites to the management room (if autojoinOnlyIfManager is true).
+# Whether Draupnir should report ignored invites to the management room (if autojoinOnlyIfManager is true).
 recordIgnoredInvites: false
 
-# The room ID (or room alias) of the management room, anyone in this room can issue commands to draupnir.
+# The room ID (or room alias) of the management room, anyone in this room can issue commands to Draupnir.
 #
-# draupnir has no more granular access controls other than this, be sure you trust everyone in this room - secure it!
+# Draupnir has no more granular access controls other than this, be sure you trust everyone in this room - secure it!
 #
 # This should be a room alias or room ID - not a matrix.to URL.
 #
-# Note: By default, draupnir is fairly verbose - expect a lot of messages in this room.
+# Note: By default, Draupnir is fairly verbose - expect a lot of messages in this room.
 # (see verboseLogging to adjust this a bit.)
 managementRoom: "{{ matrix_bot_draupnir_management_room }}"
 
-# Whether draupnir should log a lot more messages in the room,
+# Whether Draupnir should log a lot more messages in the room,
-# mainly involves "all-OK" messages, and debugging messages for when draupnir checks bans in a room.
+# mainly involves "all-OK" messages, and debugging messages for when Draupnir checks bans in a room.
 verboseLogging: false
 
 # The log level of terminal (or container) output,
 # can be one of DEBUG, INFO, WARN and ERROR, in increasing order of importance and severity.
 #
-# This should be at INFO or DEBUG in order to get support for draupnir problems.
+# This should be at INFO or DEBUG in order to get support for Draupnir problems.
 logLevel: "INFO"
 
-# Whether or not draupnir should synchronize policy lists immediately after startup.
+# Whether or not Draupnir should synchronize policy lists immediately after startup.
 # Equivalent to running '!draupnir sync'.
 syncOnStartup: true
 
-# Whether or not draupnir should check moderation permissions in all protected rooms on startup.
+# Whether or not Draupnir should check moderation permissions in all protected rooms on startup.
 # Equivalent to running `!draupnir verify`.
 verifyPermissionsOnStartup: true
 
-# Whether or not draupnir should actually apply bans and policy lists,
+# Whether or not Draupnir should actually apply bans and policy lists,
 # turn on to trial some untrusted configuration or lists.
 noop: false
 
-# Whether draupnir should check member lists quicker (by using a different endpoint),
+# Whether Draupnir should check member lists quicker (by using a different endpoint),
 # keep in mind that enabling this will miss invited (but not joined) users.
 #
 # Turn on if your bot is in (very) large rooms, or in large amounts of rooms.
@@ -94,7 +94,7 @@ automaticallyRedactForReasons:
   - "spam"
   - "advertising"
 
-# A list of rooms to protect. draupnir will add this to the list it knows from its account data.
+# A list of rooms to protect. Draupnir will add this to the list it knows from its account data.
 #
 # It won't, however, add it to the account data.
 # Manually add the room via '!draupnir rooms add' to have it stay protected regardless if this config value changes.
@@ -116,21 +116,21 @@ automaticallyRedactForReasons:
 # Explicitly add these rooms as a protected room list if you want them protected.
 protectAllJoinedRooms: false
 
-# Increase this delay to have Mjölnir wait longer between two consecutive backgrounded
+# Increase this delay to have Draupnir wait longer between two consecutive backgrounded
 # operations. The total duration of operations will be longer, but the homeserver won't
-# be affected as much. Conversely, decrease this delay to have Mjölnir chain operations
+# be affected as much. Conversely, decrease this delay to have Draupnir chain operations
 # faster. The total duration of operations will generally be shorter, but the performance
 # of the homeserver may be more impacted.
 backgroundDelayMS: 500
 
-# Server administration commands, these commands will only work if draupnir is
+# Server administration commands, these commands will only work if Draupnir is
 # a global server administrator, and the bot's server is a Synapse instance.
-#admin:
+admin:
-#  # Whether or not draupnir can temporarily take control of any eligible account from the local homeserver who's in the room
+  # Whether or not Draupnir can temporarily take control of any eligible account from the local homeserver who's in the room
-#  # (with enough permissions) to "make" a user an admin.
+  # (with enough permissions) to "make" a user an admin.
-#  #
+  #
-#  # This only works if a local user with enough admin permissions is present in the room.
+  # This only works if a local user with enough admin permissions is present in the room.
-#  enableMakeRoomAdminCommand: false
+  enableMakeRoomAdminCommand: false
 
 # Misc options for command handling and commands
 commands:
@@ -138,13 +138,14 @@ commands:
   #
   # If `true`, will allow commands like `!ban`, `!help`, etc.
   #
-  # Note: draupnir can also be pinged by display name instead of having to use
+  # Note: Draupnir can also be pinged by display name instead of having to use
   # the !draupnir prefix. For example, "my_moderator_bot: ban @spammer:example.org"
   # will address only my_moderator_bot.
   allowNoPrefix: false
 
-  # Any additional bot prefixes that draupnir will listen to. i.e. adding `mod` will allow `!mod help`.
+  # Any additional bot prefixes that Draupnir will listen to. i.e. adding `mod` will allow `!mod help`.
   additionalPrefixes:
+    - "draupnir-bot"
     - "draupnir_bot"
     - "draupnir"
 
@@ -152,6 +153,14 @@ commands:
   # in the command to be able to be submitted.
   confirmWildcardBan: true
 
+  # The default reasons to be prompted with if the reason is missing from a ban command.
+  ban:
+    defaultReasons: 
+      - "spam"
+      - "brigading"
+      - "harassment"
+      - "disagreement"
+
 # Configuration specific to certain toggle-able protections
 #protections:
 #  # Configuration for the wordlist plugin, which can ban users based if they say certain

roles/custom/matrix-bot-go-neb/defaults/main.yml

@@ -1,11 +1,22 @@
 ---
+
 # Go-NEB is a Matrix bot written in Go. It is the successor to Matrix-NEB, the original Matrix bot written in Python.
 # Project source code URL: https://github.com/matrix-org/go-neb
 
 matrix_bot_go_neb_enabled: true
+
 matrix_bot_go_neb_version: latest
-matrix_bot_go_neb_docker_image: "matrixdotorg/go-neb:{{ matrix_bot_go_neb_version }}"
+
-matrix_bot_go_neb_docker_image_force_pull: "{{ matrix_bot_go_neb_docker_image.endswith(':latest') }}"
+matrix_bot_go_neb_scheme: https
+
+# The hostname at which Go-NEB is served.
+matrix_bot_go_neb_hostname: ''
+
+# The path at which Go-NEB is exposed.
+# This value must either be `/` or not end with a slash (e.g. `/go-neb`).
+matrix_bot_go_neb_path_prefix: /
+
+matrix_bot_go_neb_base_url: "{{ matrix_bot_go_neb_scheme }}://{{ matrix_bot_go_neb_hostname }}{{ matrix_bot_go_neb_path_prefix }}{{ '' if matrix_bot_go_neb_path_prefix == '/' else '/' }}"
 
 matrix_bot_go_neb_base_path: "{{ matrix_base_data_path }}/go-neb"
 matrix_bot_go_neb_config_path: "{{ matrix_bot_go_neb_base_path }}/config"
@@ -13,11 +24,63 @@ matrix_bot_go_neb_config_path_in_container: "/config/config.yaml"
 matrix_bot_go_neb_data_path: "{{ matrix_bot_go_neb_base_path }}/data"
 matrix_bot_go_neb_data_store_path: "{{ matrix_bot_go_neb_data_path }}/store"
 
+matrix_bot_go_neb_container_image: "{{ matrix_bot_go_neb_container_image_registry_prefix }}matrixdotorg/go-neb:{{ matrix_bot_go_neb_container_image_tag }}"
+matrix_bot_go_neb_container_image_tag: "{{ matrix_bot_go_neb_version }}"
+matrix_bot_go_neb_container_image_force_pull: "{{ matrix_bot_go_neb_container_image.endswith(':latest') }}"
+matrix_bot_go_neb_container_image_registry_prefix: docker.io/
+
+# The base container network. It will be auto-created by this role if it doesn't exist already.
+matrix_bot_go_neb_container_network: matrix-bot-go-neb
+
+# A list of additional container networks that the container would be connected to.
+# The role does not create these networks, so make sure they already exist.
+# Use this to expose this container to another reverse proxy, which runs in a different container network.
+matrix_bot_go_neb_container_additional_networks: []
+
 # Controls whether the matrix-bot-go-neb container exposes its HTTP port (tcp/4050 in the container).
 #
 # Takes an "<ip>:<port>" or "<port>" value (e.g. "127.0.0.1:4050"), or empty string to not expose.
 matrix_bot_go_neb_container_http_host_bind_port: ''
 
+# matrix_bot_go_neb_container_labels_traefik_enabled controls whether labels to assist a Traefik reverse-proxy will be attached to the container.
+# See `../templates/labels.j2` for details.
+#
+# To inject your own other container labels, see `matrix_bot_go_neb_container_labels_additional_labels`.
+matrix_bot_go_neb_container_labels_traefik_enabled: true
+matrix_bot_go_neb_container_labels_traefik_docker_network: "{{ matrix_bot_go_neb_container_network }}"
+matrix_bot_go_neb_container_labels_traefik_hostname: "{{ matrix_bot_go_neb_hostname }}"
+# The path prefix must either be `/` or not end with a slash (e.g. `/go-neb`).
+matrix_bot_go_neb_container_labels_traefik_path_prefix: "{{ matrix_bot_go_neb_path_prefix }}"
+matrix_bot_go_neb_container_labels_traefik_rule: "Host(`{{ matrix_bot_go_neb_container_labels_traefik_hostname }}`){% if matrix_bot_go_neb_container_labels_traefik_path_prefix != '/' %} && PathPrefix(`{{ matrix_bot_go_neb_container_labels_traefik_path_prefix }}`){% endif %}"
+matrix_bot_go_neb_container_labels_traefik_priority: 0
+matrix_bot_go_neb_container_labels_traefik_entrypoints: web-secure
+matrix_bot_go_neb_container_labels_traefik_tls: "{{ matrix_bot_go_neb_container_labels_traefik_entrypoints != 'web' }}"
+matrix_bot_go_neb_container_labels_traefik_tls_certResolver: default  # noqa var-naming
+
+# Controls which additional headers to attach to all HTTP responses.
+# To add your own headers, use `matrix_bot_go_neb_container_labels_traefik_additional_response_headers_custom`
+matrix_bot_go_neb_container_labels_traefik_additional_response_headers: "{{ matrix_bot_go_neb_container_labels_traefik_additional_response_headers_auto | combine(matrix_bot_go_neb_container_labels_traefik_additional_response_headers_custom) }}"
+matrix_bot_go_neb_container_labels_traefik_additional_response_headers_auto: |
+  {{
+    {}
+    | combine ({'X-XSS-Protection': matrix_bot_go_neb_http_header_xss_protection} if matrix_bot_go_neb_http_header_xss_protection else {})
+    | combine ({'X-Frame-Options': matrix_bot_go_neb_http_header_frame_options} if matrix_bot_go_neb_http_header_frame_options else {})
+    | combine ({'X-Content-Type-Options': matrix_bot_go_neb_http_header_content_type_options} if matrix_bot_go_neb_http_header_content_type_options else {})
+    | combine ({'Content-Security-Policy': matrix_bot_go_neb_http_header_content_security_policy} if matrix_bot_go_neb_http_header_content_security_policy else {})
+    | combine ({'Permission-Policy': matrix_bot_go_neb_http_header_content_permission_policy} if matrix_bot_go_neb_http_header_content_permission_policy else {})
+    | combine ({'Strict-Transport-Security': matrix_bot_go_neb_http_header_strict_transport_security} if matrix_bot_go_neb_http_header_strict_transport_security and matrix_bot_go_neb_container_labels_traefik_tls else {})
+  }}
+matrix_bot_go_neb_container_labels_traefik_additional_response_headers_custom: {}
+
+# matrix_bot_go_neb_container_labels_additional_labels contains a multiline string with additional labels to add to the container label file.
+# See `../templates/labels.j2` for details.
+#
+# Example:
+# matrix_bot_go_neb_container_labels_additional_labels: |
+#   my.label=1
+#   another.label="here"
+matrix_bot_go_neb_container_labels_additional_labels: ''
+
 # A list of extra arguments to pass to the container
 matrix_bot_go_neb_container_extra_arguments: []
 
@@ -27,6 +90,57 @@ matrix_bot_go_neb_systemd_required_services_list: ['docker.service']
 # List of systemd services that matrix-bot-go-neb.service wants
 matrix_bot_go_neb_systemd_wanted_services_list: []
 
+# Specifies the value of the `X-XSS-Protection` header
+# Stops pages from loading when they detect reflected cross-site scripting (XSS) attacks.
+#
+# Learn more about it is here:
+# - https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-XSS-Protection
+# - https://portswigger.net/web-security/cross-site-scripting/reflected
+matrix_bot_go_neb_http_header_xss_protection: "1; mode=block"
+
+# Specifies the value of the `X-Frame-Options` header which controls whether framing can happen.
+# See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options
+matrix_bot_go_neb_http_header_frame_options: SAMEORIGIN
+
+# Specifies the value of the `X-Content-Type-Options` header.
+# See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Content-Type-Options
+matrix_bot_go_neb_http_header_content_type_options: nosniff
+
+# Specifies the value of the `Content-Security-Policy` header.
+# See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy
+matrix_bot_go_neb_http_header_content_security_policy: frame-ancestors 'self'
+
+# Specifies the value of the `Permission-Policy` header.
+# See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Permission-Policy
+matrix_bot_go_neb_http_header_content_permission_policy: "{{ 'interest-cohort=()' if matrix_bot_go_neb_floc_optout_enabled else '' }}"
+
+# Specifies the value of the `Strict-Transport-Security` header.
+# See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security
+matrix_bot_go_neb_http_header_strict_transport_security: "max-age=31536000; includeSubDomains{{ '; preload' if matrix_bot_go_neb_hsts_preload_enabled else '' }}"
+
+# Controls whether to send a "Permissions-Policy interest-cohort=();" header along with all responses
+#
+# Learn more about what it is here:
+# - https://www.eff.org/deeplinks/2021/03/googles-floc-terrible-idea
+# - https://paramdeo.com/blog/opting-your-website-out-of-googles-floc-network
+# - https://amifloced.org/
+#
+# Of course, a better solution is to just stop using browsers (like Chrome), which participate in such tracking practices.
+# See: `matrix_bot_go_neb_content_permission_policy`
+matrix_bot_go_neb_floc_optout_enabled: true
+
+# Controls if HSTS preloading is enabled
+#
+# In its strongest and recommended form, the [HSTS policy](https://www.chromium.org/hsts) includes all subdomains, and
+# indicates a willingness to be "preloaded" into browsers:
+# `Strict-Transport-Security: max-age=31536000; includeSubDomains; preload`
+# For more information visit:
+# - https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security
+# - https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security
+# - https://hstspreload.org/#opt-in
+# See: `matrix_bot_go_neb_http_header_strict_transport_security`
+matrix_bot_go_neb_hsts_preload_enabled: false
+
 # Database-related configuration fields.
 #
 # MUST be "sqlite3". No other type is supported.

roles/custom/matrix-bot-go-neb/tasks/install.yml

@@ -1,8 +1,5 @@
 ---
 
-- ansible.builtin.set_fact:
-    matrix_bot_go_neb_requires_restart: false
-
 - name: Ensure go-neb paths exist
   ansible.builtin.file:
     path: "{{ item.path }}"
@@ -16,17 +13,6 @@
     - {path: "{{ matrix_bot_go_neb_data_store_path }}", when: true}
   when: "item.when | bool"
 
-- name: Ensure go-neb image is pulled
-  community.docker.docker_image:
-    name: "{{ matrix_bot_go_neb_docker_image }}"
-    source: "{{ 'pull' if ansible_version.major > 2 or ansible_version.minor > 7 else omit }}"
-    force_source: "{{ matrix_bot_go_neb_docker_image_force_pull if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}"
-    force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else matrix_bot_go_neb_docker_image_force_pull }}"
-  register: result
-  retries: "{{ devture_playbook_help_container_retries_count }}"
-  delay: "{{ devture_playbook_help_container_retries_delay }}"
-  until: result is not failed
-
 - name: Ensure go-neb config installed
   ansible.builtin.copy:
     content: "{{ matrix_bot_go_neb_configuration | to_nice_yaml(indent=2, width=999999) }}"
@@ -35,16 +21,35 @@
     owner: "{{ matrix_user_username }}"
     group: "{{ matrix_user_groupname }}"
 
+- name: Ensure go-neb support files installed
+  ansible.builtin.template:
+    src: "{{ role_path }}/templates/{{ item }}.j2"
+    dest: "{{ matrix_bot_go_neb_base_path }}/{{ item }}"
+    mode: 0640
+    owner: "{{ matrix_user_username }}"
+    group: "{{ matrix_user_groupname }}"
+  with_items:
+    - env
+    - labels
+
+- name: Ensure go-neb container network is created
+  community.general.docker_network:
+    name: "{{ matrix_bot_go_neb_container_network }}"
+    driver: bridge
+
+- name: Ensure go-neb container image is pulled
+  community.docker.docker_image:
+    name: "{{ matrix_bot_go_neb_container_image }}"
+    source: "{{ 'pull' if ansible_version.major > 2 or ansible_version.minor > 7 else omit }}"
+    force_source: "{{ matrix_bot_go_neb_container_image_force_pull if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}"
+    force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else matrix_bot_go_neb_container_image_force_pull }}"
+  register: result
+  retries: "{{ devture_playbook_help_container_retries_count }}"
+  delay: "{{ devture_playbook_help_container_retries_delay }}"
+  until: result is not failed
+
 - name: Ensure matrix-bot-go-neb.service installed
   ansible.builtin.template:
     src: "{{ role_path }}/templates/systemd/matrix-bot-go-neb.service.j2"
     dest: "{{ devture_systemd_docker_base_systemd_path }}/matrix-bot-go-neb.service"
     mode: 0644
-  register: matrix_bot_go_neb_systemd_service_result
-
-- name: Ensure matrix-bot-go-neb.service restarted, if necessary
-  ansible.builtin.service:
-    name: "matrix-bot-go-neb.service"
-    state: restarted
-    daemon_reload: true
-  when: "matrix_bot_go_neb_requires_restart | bool"

roles/custom/matrix-bot-go-neb/tasks/main.yml

@@ -1,20 +1,20 @@
 ---
 
-- block:
+- tags:
-    - ansible.builtin.include_tasks: "{{ role_path }}/tasks/validate_config.yml"
-      when: "run_setup | bool and matrix_bot_go_neb_enabled | bool"
-
-    - ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_install.yml"
-      when: "run_setup | bool and matrix_bot_go_neb_enabled | bool"
-  tags:
     - setup-all
     - setup-bot-go-neb
     - install-all
     - install-bot-go-neb
+  block:
+    - ansible.builtin.include_tasks: "{{ role_path }}/tasks/validate_config.yml"
+      when: "run_setup | bool and matrix_bot_go_neb_enabled | bool"
 
-- block:
+    - ansible.builtin.include_tasks: "{{ role_path }}/tasks/install.yml"
-    - ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_uninstall.yml"
+      when: "run_setup | bool and matrix_bot_go_neb_enabled | bool"
-      when: "run_setup | bool and not matrix_bot_go_neb_enabled | bool"
+
-  tags:
+- tags:
     - setup-all
     - setup-bot-go-neb
+  block:
+    - ansible.builtin.include_tasks: "{{ role_path }}/tasks/uninstall.yml"
+      when: "run_setup | bool and not matrix_bot_go_neb_enabled | bool"

roles/custom/matrix-bot-go-neb/templates/env.j2

@@ -0,0 +1,8 @@
+BIND_ADDRESS=:4050
+
+DATABASE_TYPE={{ matrix_bot_go_neb_database_engine }}
+DATABASE_URL={{ matrix_bot_go_neb_storage_database }}
+
+BASE_URL={{ matrix_bot_go_neb_base_url }}
+
+CONFIG_FILE={{ matrix_bot_go_neb_config_path_in_container }}

roles/custom/matrix-bot-go-neb/templates/labels.j2

@@ -0,0 +1,45 @@
+{% if matrix_bot_go_neb_container_labels_traefik_enabled %}
+traefik.enable=true
+
+{% if matrix_bot_go_neb_container_labels_traefik_docker_network %}
+traefik.docker.network={{ matrix_bot_go_neb_container_labels_traefik_docker_network }}
+{% endif %}
+
+{% set middlewares = [] %}
+
+{% if matrix_bot_go_neb_container_labels_traefik_path_prefix != '/' %}
+traefik.http.middlewares.matrix-bot-go-neb-slashless-redirect.redirectregex.regex=({{ matrix_bot_go_neb_container_labels_traefik_path_prefix | quote }})$
+traefik.http.middlewares.matrix-bot-go-neb-slashless-redirect.redirectregex.replacement=${1}/
+{% set middlewares = middlewares + ['matrix-bot-go-neb-slashless-redirect'] %}
+{% endif %}
+
+{% if matrix_bot_go_neb_container_labels_traefik_path_prefix != '/' %}
+traefik.http.middlewares.matrix-bot-go-neb-strip-prefix.stripprefix.prefixes={{ matrix_bot_go_neb_container_labels_traefik_path_prefix }}
+{% set middlewares = middlewares + ['matrix-bot-go-neb-strip-prefix'] %}
+{% endif %}
+
+{% if matrix_bot_go_neb_container_labels_traefik_additional_response_headers.keys() | length > 0 %}
+{% for name, value in matrix_bot_go_neb_container_labels_traefik_additional_response_headers.items() %}
+traefik.http.middlewares.matrix-bot-go-neb-add-headers.headers.customresponseheaders.{{ name }}={{ value }}
+{% endfor %}
+{% set middlewares = middlewares + ['matrix-bot-go-neb-add-headers'] %}
+{% endif %}
+
+traefik.http.routers.matrix-bot-go-neb.rule={{ matrix_bot_go_neb_container_labels_traefik_rule }}
+{% if matrix_bot_go_neb_container_labels_traefik_priority | int > 0 %}
+traefik.http.routers.matrix-bot-go-neb.priority={{ matrix_bot_go_neb_container_labels_traefik_priority }}
+{% endif %}
+traefik.http.routers.matrix-bot-go-neb.service=matrix-bot-go-neb
+{% if middlewares | length > 0 %}
+traefik.http.routers.matrix-bot-go-neb.middlewares={{ middlewares | join(',') }}
+{% endif %}
+traefik.http.routers.matrix-bot-go-neb.entrypoints={{ matrix_bot_go_neb_container_labels_traefik_entrypoints }}
+traefik.http.routers.matrix-bot-go-neb.tls={{ matrix_bot_go_neb_container_labels_traefik_tls | to_json }}
+{% if matrix_bot_go_neb_container_labels_traefik_tls %}
+traefik.http.routers.matrix-bot-go-neb.tls.certResolver={{ matrix_bot_go_neb_container_labels_traefik_tls_certResolver }}
+{% endif %}
+
+traefik.http.services.matrix-bot-go-neb.loadbalancer.server.port=4050
+{% endif %}
+
+{{ matrix_bot_go_neb_container_labels_additional_labels }}

roles/custom/matrix-bot-go-neb/templates/systemd/matrix-bot-go-neb.service.j2

@@ -16,31 +16,37 @@ Environment="HOME={{ devture_systemd_docker_base_systemd_unit_home_path }}"
 ExecStartPre=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} kill matrix-bot-go-neb 2>/dev/null || true'
 ExecStartPre=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} rm matrix-bot-go-neb 2>/dev/null || true'
 
-ExecStart={{ devture_systemd_docker_base_host_command_docker }} run --rm --name matrix-bot-go-neb \
+ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} create \
+			--rm \
+			--name=matrix-bot-go-neb \
 			--log-driver=none \
 			--user={{ matrix_user_uid }}:{{ matrix_user_gid }} \
 			--cap-drop=ALL \
 			--read-only \
-			--network={{ matrix_docker_network }} \
+			--network={{ matrix_bot_go_neb_container_network }} \
 			{% if matrix_bot_go_neb_container_http_host_bind_port %}
 			-p {{ matrix_bot_go_neb_container_http_host_bind_port }}:4050 \
 			{% endif %}
-			-e 'BIND_ADDRESS=:4050' \
+			--env-file={{ matrix_bot_go_neb_base_path }}/env \
-			-e 'DATABASE_TYPE={{ matrix_bot_go_neb_database_engine }}' \
+			--label-file={{ matrix_bot_go_neb_base_path }}/labels \
-			-e 'BASE_URL=https://{{ matrix_server_fqn_bot_go_neb }}' \
-			-e 'CONFIG_FILE={{ matrix_bot_go_neb_config_path_in_container }}' \
-			-e 'DATABASE_URL={{ matrix_bot_go_neb_storage_database }}' \
 			--mount type=bind,src={{ matrix_bot_go_neb_config_path }},dst=/config,ro \
 			--mount type=bind,src={{ matrix_bot_go_neb_data_path }},dst=/data \
 			--entrypoint=/bin/sh \
 			{% for arg in matrix_bot_go_neb_container_extra_arguments %}
 			{{ arg }} \
 			{% endfor %}
-			{{ matrix_bot_go_neb_docker_image }} \
+			{{ matrix_bot_go_neb_container_image }} \
 			-c "go-neb /config/config.yaml"
 
+{% for network in matrix_bot_go_neb_container_additional_networks %}
+ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} network connect {{ network }} matrix-bot-go-neb
+{% endfor %}
+
+ExecStart={{ devture_systemd_docker_base_host_command_docker }} start --attach matrix-bot-go-neb
+
 ExecStop=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} kill matrix-bot-go-neb 2>/dev/null || true'
 ExecStop=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} rm matrix-bot-go-neb 2>/dev/null || true'
+
 Restart=always
 RestartSec=30
 SyslogIdentifier=matrix-bot-go-neb

roles/custom/matrix-bot-honoroit/defaults/main.yml

@@ -4,12 +4,19 @@
 
 matrix_bot_honoroit_enabled: true
 
+# The hostname at which honoroit is served.
+matrix_bot_honoroit_hostname: ''
+
+# The path at which honoroit is exposed.
+# This value must either be `/` or not end with a slash (e.g. `/honoroit`).
+matrix_bot_honoroit_path_prefix: /
+
 matrix_bot_honoroit_container_image_self_build: false
 matrix_bot_honoroit_docker_repo: "https://gitlab.com/etke.cc/honoroit.git"
 matrix_bot_honoroit_docker_repo_version: "{{ matrix_bot_honoroit_version }}"
 matrix_bot_honoroit_docker_src_files_path: "{{ matrix_base_data_path }}/honoroit/docker-src"
 
-matrix_bot_honoroit_version: v0.9.16
+matrix_bot_honoroit_version: v0.9.17
 matrix_bot_honoroit_docker_image: "{{ matrix_bot_honoroit_docker_image_name_prefix }}etke.cc/honoroit:{{ matrix_bot_honoroit_version }}"
 matrix_bot_honoroit_docker_image_name_prefix: "{{ 'localhost/' if matrix_bot_honoroit_container_image_self_build else 'registry.gitlab.com/' }}"
 matrix_bot_honoroit_docker_image_force_pull: "{{ matrix_bot_honoroit_docker_image.endswith(':latest') }}"
@@ -19,6 +26,44 @@ matrix_bot_honoroit_config_path: "{{ matrix_bot_honoroit_base_path }}/config"
 matrix_bot_honoroit_data_path: "{{ matrix_bot_honoroit_base_path }}/data"
 matrix_bot_honoroit_data_store_path: "{{ matrix_bot_honoroit_data_path }}/store"
 
+# The base container network. It will be auto-created by this role if it doesn't exist already.
+matrix_bot_honoroit_container_network: matrix-bot-honoroit
+
+# A list of additional container networks that the container would be connected to.
+# The role does not create these networks, so make sure they already exist.
+# Use this to expose this container to another reverse proxy, which runs in a different container network.
+matrix_bot_honoroit_container_additional_networks: []
+
+# matrix_bot_honoroit_container_labels_traefik_enabled controls whether labels to assist a Traefik reverse-proxy will be attached to the container.
+# See `../templates/labels.j2` for details.
+#
+# To inject your own other container labels, see `matrix_bot_honoroit_container_labels_additional_labels`.
+matrix_bot_honoroit_container_labels_traefik_enabled: true
+matrix_bot_honoroit_container_labels_traefik_docker_network: "{{ matrix_bot_honoroit_container_network }}"
+matrix_bot_honoroit_container_labels_traefik_hostname: "{{ matrix_bot_honoroit_hostname }}"
+# The path prefix must either be `/` or not end with a slash (e.g. `/honoroit`).
+matrix_bot_honoroit_container_labels_traefik_path_prefix: "{{ matrix_bot_honoroit_path_prefix }}"
+matrix_bot_honoroit_container_labels_traefik_rule: "Host(`{{ matrix_bot_honoroit_container_labels_traefik_hostname }}`){% if matrix_bot_honoroit_container_labels_traefik_path_prefix != '/' %} && PathPrefix(`{{ matrix_bot_honoroit_container_labels_traefik_path_prefix }}`){% endif %}"
+matrix_bot_honoroit_container_labels_traefik_priority: 0
+matrix_bot_honoroit_container_labels_traefik_entrypoints: web-secure
+matrix_bot_honoroit_container_labels_traefik_tls: "{{ matrix_bot_honoroit_container_labels_traefik_entrypoints != 'web' }}"
+matrix_bot_honoroit_container_labels_traefik_tls_certResolver: default  # noqa var-naming
+
+# Controls which additional headers to attach to all HTTP responses.
+# To add your own headers, use `matrix_bot_honoroit_container_labels_traefik_additional_response_headers_custom`
+matrix_bot_honoroit_container_labels_traefik_additional_response_headers: "{{ matrix_bot_honoroit_container_labels_traefik_additional_response_headers_auto | combine(matrix_bot_honoroit_container_labels_traefik_additional_response_headers_custom) }}"
+matrix_bot_honoroit_container_labels_traefik_additional_response_headers_auto: {}
+matrix_bot_honoroit_container_labels_traefik_additional_response_headers_custom: {}
+
+# matrix_bot_honoroit_container_labels_additional_labels contains a multiline string with additional labels to add to the container label file.
+# See `../templates/labels.j2` for details.
+#
+# Example:
+# matrix_bot_honoroit_container_labels_additional_labels: |
+#   my.label=1
+#   another.label="here"
+matrix_bot_honoroit_container_labels_additional_labels: ''
+
 # A list of extra arguments to pass to the container
 matrix_bot_honoroit_container_extra_arguments: []
 

roles/custom/matrix-bot-honoroit/tasks/main.yml

@@ -1,20 +1,20 @@
 ---
 
-- block:
+- tags:
+    - setup-all
+    - setup-bot-honoroit
+    - install-all
+    - install-bot-honoroit
+  block:
     - ansible.builtin.include_tasks: "{{ role_path }}/tasks/validate_config.yml"
       when: "run_setup | bool and matrix_bot_honoroit_enabled | bool"
 
     - ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_install.yml"
       when: "run_setup | bool and matrix_bot_honoroit_enabled | bool"
-  tags:
+
+- tags:
     - setup-all
     - setup-bot-honoroit
-    - install-all
+  block:
-    - install-bot-honoroit
-
-- block:
     - ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_uninstall.yml"
       when: "run_setup | bool and not matrix_bot_honoroit_enabled | bool"
-  tags:
-    - setup-all
-    - setup-bot-honoroit

roles/custom/matrix-bot-honoroit/tasks/setup_install.yml

@@ -40,13 +40,16 @@
     - {path: "{{ matrix_bot_honoroit_docker_src_files_path }}", when: true}
   when: "item.when | bool"
 
-- name: Ensure honoroit environment variables file created
+- name: Ensure honoroit support files installed
   ansible.builtin.template:
-    src: "{{ role_path }}/templates/env.j2"
+    src: "{{ role_path }}/templates/{{ item }}.j2"
-    dest: "{{ matrix_bot_honoroit_config_path }}/env"
+    dest: "{{ matrix_bot_honoroit_config_path }}/{{ item }}"
     owner: "{{ matrix_user_username }}"
     group: "{{ matrix_user_groupname }}"
     mode: 0640
+  with_items:
+    - env
+    - labels
 
 - name: Ensure honoroit image is pulled
   community.docker.docker_image:

roles/custom/matrix-bot-honoroit/templates/labels.j2

@@ -0,0 +1,45 @@
+{% if matrix_bot_honoroit_container_labels_traefik_enabled %}
+traefik.enable=true
+
+{% if matrix_bot_honoroit_container_labels_traefik_docker_network %}
+traefik.docker.network={{ matrix_bot_honoroit_container_labels_traefik_docker_network }}
+{% endif %}
+
+{% set middlewares = [] %}
+
+{% if matrix_bot_honoroit_container_labels_traefik_path_prefix != '/' %}
+traefik.http.middlewares.matrix-bot-honoroit-slashless-redirect.redirectregex.regex=({{ matrix_bot_honoroit_container_labels_traefik_path_prefix | quote }})$
+traefik.http.middlewares.matrix-bot-honoroit-slashless-redirect.redirectregex.replacement=${1}/
+{% set middlewares = middlewares + ['matrix-bot-honoroit-slashless-redirect'] %}
+{% endif %}
+
+{% if matrix_bot_honoroit_container_labels_traefik_path_prefix != '/' %}
+traefik.http.middlewares.matrix-bot-honoroit-strip-prefix.stripprefix.prefixes={{ matrix_bot_honoroit_container_labels_traefik_path_prefix }}
+{% set middlewares = middlewares + ['matrix-bot-honoroit-strip-prefix'] %}
+{% endif %}
+
+{% if matrix_bot_honoroit_container_labels_traefik_additional_response_headers.keys() | length > 0 %}
+{% for name, value in matrix_bot_honoroit_container_labels_traefik_additional_response_headers.items() %}
+traefik.http.middlewares.matrix-bot-honoroit-add-headers.headers.customresponseheaders.{{ name }}={{ value }}
+{% endfor %}
+{% set middlewares = middlewares + ['matrix-bot-honoroit-add-headers'] %}
+{% endif %}
+
+traefik.http.routers.matrix-bot-honoroit.rule={{ matrix_bot_honoroit_container_labels_traefik_rule }}
+{% if matrix_bot_honoroit_container_labels_traefik_priority | int > 0 %}
+traefik.http.routers.matrix-bot-honoroit.priority={{ matrix_bot_honoroit_container_labels_traefik_priority }}
+{% endif %}
+traefik.http.routers.matrix-bot-honoroit.service=matrix-bot-honoroit
+{% if middlewares | length > 0 %}
+traefik.http.routers.matrix-bot-honoroit.middlewares={{ middlewares | join(',') }}
+{% endif %}
+traefik.http.routers.matrix-bot-honoroit.entrypoints={{ matrix_bot_honoroit_container_labels_traefik_entrypoints }}
+traefik.http.routers.matrix-bot-honoroit.tls={{ matrix_bot_honoroit_container_labels_traefik_tls | to_json }}
+{% if matrix_bot_honoroit_container_labels_traefik_tls %}
+traefik.http.routers.matrix-bot-honoroit.tls.certResolver={{ matrix_bot_honoroit_container_labels_traefik_tls_certResolver }}
+{% endif %}
+
+traefik.http.services.matrix-bot-honoroit.loadbalancer.server.port=8080
+{% endif %}
+
+{{ matrix_bot_honoroit_container_labels_additional_labels }}

roles/custom/matrix-bot-honoroit/templates/systemd/matrix-bot-honoroit.service.j2

@@ -16,19 +16,28 @@ Environment="HOME={{ devture_systemd_docker_base_systemd_unit_home_path }}"
 ExecStartPre=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} kill matrix-bot-honoroit 2>/dev/null || true'
 ExecStartPre=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} rm matrix-bot-honoroit 2>/dev/null || true'
 
-ExecStart={{ devture_systemd_docker_base_host_command_docker }} run --rm --name matrix-bot-honoroit \
+ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} create \
+			--rm \
+			--name=matrix-bot-honoroit \
 			--log-driver=none \
 			--user={{ matrix_user_uid }}:{{ matrix_user_gid }} \
 			--cap-drop=ALL \
 			--read-only \
-			--network={{ matrix_docker_network }} \
+			--network={{ matrix_bot_honoroit_container_network }} \
 			--env-file={{ matrix_bot_honoroit_config_path }}/env \
+			--label-file={{ matrix_bot_honoroit_config_path }}/labels \
 			--mount type=bind,src={{ matrix_bot_honoroit_data_path }},dst=/data \
 			{% for arg in matrix_bot_honoroit_container_extra_arguments %}
 			{{ arg }} \
 			{% endfor %}
 			{{ matrix_bot_honoroit_docker_image }}
 
+{% for network in matrix_bot_honoroit_container_additional_networks %}
+ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} network connect {{ network }} matrix-bot-honoroit
+{% endfor %}
+
+ExecStart={{ devture_systemd_docker_base_host_command_docker }} start --attach matrix-bot-honoroit
+
 ExecStop=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} kill matrix-bot-honoroit 2>/dev/null || true'
 ExecStop=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} rm matrix-bot-honoroit 2>/dev/null || true'
 Restart=always

roles/custom/matrix-bot-matrix-registration-bot/tasks/main.yml

@@ -1,20 +1,20 @@
 ---
 
-- block:
+- tags:
+    - setup-all
+    - setup-bot-matrix-registration-bot
+    - install-all
+    - install-bot-matrix-registration-bot
+  block:
     - when: matrix_bot_matrix_registration_bot_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/validate_config.yml"
 
     - when: matrix_bot_matrix_registration_bot_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_install.yml"
-  tags:
+
+- tags:
     - setup-all
     - setup-bot-matrix-registration-bot
-    - install-all
+  block:
-    - install-bot-matrix-registration-bot
-
-- block:
     - when: not matrix_bot_matrix_registration_bot_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_uninstall.yml"
-  tags:
-    - setup-all
-    - setup-bot-matrix-registration-bot

roles/custom/matrix-bot-matrix-reminder-bot/tasks/main.yml

@@ -1,20 +1,20 @@
 ---
 
-- block:
+- tags:
+    - setup-all
+    - setup-bot-matrix-reminder-bot
+    - install-all
+    - install-bot-matrix-reminder-bot
+  block:
     - when: matrix_bot_matrix_reminder_bot_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/validate_config.yml"
 
     - when: matrix_bot_matrix_reminder_bot_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_install.yml"
-  tags:
+
+- tags:
     - setup-all
     - setup-bot-matrix-reminder-bot
-    - install-all
+  block:
-    - install-bot-matrix-reminder-bot
-
-- block:
     - when: not matrix_bot_matrix_reminder_bot_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_uninstall.yml"
-  tags:
-    - setup-all
-    - setup-bot-matrix-reminder-bot

roles/custom/matrix-bot-maubot/tasks/main.yml

@@ -1,29 +1,29 @@
 ---
 
-- block:
+- tags:
-    - when: matrix_bot_maubot_enabled | bool
-      ansible.builtin.include_tasks: "{{ role_path }}/tasks/inject_into_nginx_proxy.yml"
-  tags:
     - setup-all
     - setup-nginx-proxy
     - install-all
     - install-nginx-proxy
+  block:
+    - when: matrix_bot_maubot_enabled | bool
+      ansible.builtin.include_tasks: "{{ role_path }}/tasks/inject_into_nginx_proxy.yml"
 
-- block:
+- tags:
+    - setup-all
+    - setup-bot-maubot
+    - install-all
+    - install-bot-maubot
+  block:
     - when: matrix_bot_maubot_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/validate_config.yml"
 
     - when: matrix_bot_maubot_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_install.yml"
-  tags:
+
+- tags:
     - setup-all
     - setup-bot-maubot
-    - install-all
+  block:
-    - install-bot-maubot
-
-- block:
     - when: not matrix_bot_maubot_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_uninstall.yml"
-  tags:
-    - setup-all
-    - setup-bot-maubot

roles/custom/matrix-bot-maubot/tasks/setup_install.yml

@@ -53,7 +53,7 @@
     name: "{{ matrix_bot_maubot_docker_image }}"
     source: build
     force_source: "{{ matrix_bot_maubot_git_pull_results.changed if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}"
-    force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else matrix_mailer_git_pull_results.changed }}"
+    force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else matrix_bot_maubot_git_pull_results.changed }}"
     build:
       dockerfile: Dockerfile
       path: "{{ matrix_bot_maubot_docker_src_files_path }}"

roles/custom/matrix-bot-mjolnir/tasks/main.yml

@@ -1,20 +1,20 @@
 ---
 
-- block:
+- tags:
+    - setup-all
+    - setup-bot-mjolnir
+    - install-all
+    - install-bot-mjolnir
+  block:
     - when: matrix_bot_mjolnir_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/validate_config.yml"
 
     - when: matrix_bot_mjolnir_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_install.yml"
-  tags:
+
+- tags:
     - setup-all
     - setup-bot-mjolnir
-    - install-all
+  block:
-    - install-bot-mjolnir
-
-- block:
     - when: not matrix_bot_mjolnir_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_uninstall.yml"
-  tags:
-    - setup-all
-    - setup-bot-mjolnir

roles/custom/matrix-bot-postmoogle/defaults/main.yml

@@ -9,7 +9,7 @@ matrix_bot_postmoogle_docker_repo: "https://gitlab.com/etke.cc/postmoogle.git"
 matrix_bot_postmoogle_docker_repo_version: "{{ 'main' if matrix_bot_postmoogle_version == 'latest' else matrix_bot_postmoogle_version }}"
 matrix_bot_postmoogle_docker_src_files_path: "{{ matrix_base_data_path }}/postmoogle/docker-src"
 
-matrix_bot_postmoogle_version: v0.9.12
+matrix_bot_postmoogle_version: v0.9.14
 matrix_bot_postmoogle_docker_image: "{{ matrix_bot_postmoogle_docker_image_name_prefix }}etke.cc/postmoogle:{{ matrix_bot_postmoogle_version }}"
 matrix_bot_postmoogle_docker_image_name_prefix: "{{ 'localhost/' if matrix_bot_postmoogle_container_image_self_build else 'registry.gitlab.com/' }}"
 matrix_bot_postmoogle_docker_image_force_pull: "{{ matrix_bot_postmoogle_docker_image.endswith(':latest') }}"

roles/custom/matrix-bot-postmoogle/tasks/main.yml

@@ -1,20 +1,20 @@
 ---
 
-- block:
+- tags:
+    - setup-all
+    - setup-bot-postmoogle
+    - install-all
+    - install-bot-postmoogle
+  block:
     - when: matrix_bot_postmoogle_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/validate_config.yml"
 
     - when: matrix_bot_postmoogle_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_install.yml"
-  tags:
+
+- tags:
     - setup-all
     - setup-bot-postmoogle
-    - install-all
+  block:
-    - install-bot-postmoogle
-
-- block:
     - when: not matrix_bot_postmoogle_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_uninstall.yml"
-  tags:
-    - setup-all
-    - setup-bot-postmoogle

roles/custom/matrix-bridge-appservice-discord/tasks/main.yml

@@ -1,20 +1,20 @@
 ---
 
-- block:
+- tags:
+    - setup-all
+    - setup-appservice-discord
+    - install-all
+    - install-appservice-discord
+  block:
     - when: matrix_appservice_discord_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/validate_config.yml"
 
     - when: matrix_appservice_discord_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_install.yml"
-  tags:
+
+- tags:
     - setup-all
     - setup-appservice-discord
-    - install-all
+  block:
-    - install-appservice-discord
-
-- block:
     - when: not matrix_appservice_discord_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_uninstall.yml"
-  tags:
-    - setup-all
-    - setup-appservice-discord

roles/custom/matrix-bridge-appservice-discord/tasks/setup_install.yml

@@ -65,7 +65,10 @@
   when: "matrix_appservice_discord_stat_db.stat.exists"
 
 - name: (Data relocation) Move AppService Discord discord.db file to ./data directory
-  ansible.builtin.command: "mv {{ matrix_appservice_discord_base_path }}/{{ item }} {{ matrix_appservice_discord_data_path }}/{{ item }}"
+  ansible.builtin.command:
+    cmd: "mv {{ matrix_appservice_discord_base_path }}/{{ item }} {{ matrix_appservice_discord_data_path }}/{{ item }}"
+    creates: "{{ matrix_appservice_discord_data_path }}/{{ item }}"
+    removes: "{{ matrix_appservice_discord_base_path }}/{{ item }}"
   with_items:
     - discord.db
     - user-store.db

roles/custom/matrix-bridge-appservice-irc/defaults/main.yml

@@ -11,7 +11,7 @@ matrix_appservice_irc_docker_src_files_path: "{{ matrix_base_data_path }}/appser
 
 # matrix_appservice_irc_version used to contain the full Docker image tag (e.g. `release-X.X.X`).
 # It's a bare version number now. We try to somewhat retain compatibility below.
-matrix_appservice_irc_version: 0.36.0
+matrix_appservice_irc_version: 0.37.0
 matrix_appservice_irc_docker_image: "{{ matrix_container_global_registry_prefix }}matrixdotorg/matrix-appservice-irc:{{ matrix_appservice_irc_docker_image_tag }}"
 matrix_appservice_irc_docker_image_tag: "{{ 'latest' if matrix_appservice_irc_version == 'latest' else ('release-' + matrix_appservice_irc_version) }}"
 matrix_appservice_irc_docker_image_force_pull: "{{ matrix_appservice_irc_docker_image.endswith(':latest') }}"