Mergefix.

Update Synapse from 1.50.1 to 1.50.2

CHANGELOG.md

@@ -1,3 +1,89 @@
+# 2022-01-07
+
+## Dendrite support
+
+**TLDR**: We now have optional experimental [Dendrite](https://github.com/matrix-org/dendrite) homeserver support for new installations. **Existing (Synapse) installations need to be updated**, because some internals changed. See [Adapting the configuration for existing Synapse installations](#adapting-the-configuration-for-existing-synapse-installations).
+
+[Jip J. Dekker](https://github.com/Dekker1) did the [initial work](https://github.com/spantaleev/matrix-docker-ansible-deploy/pull/818) of adding [Dendrite](https://github.com/matrix-org/dendrite) support to the playbook back in January 2021. Lots of work (and time) later, Dendrite support is finally ready for testing.
+
+We believe that 2022 will be the year of the non-Synapse Matrix server!
+
+The playbook was previously quite [Synapse](https://github.com/matrix-org/synapse)-centric, but can now accommodate multiple homeserver implementations. Only one homeserver implementation can be active (installed) at a given time.
+
+**Synapse is still the default homeserver implementation** installed by the playbook. A new variable (`matrix_homeserver_implementation`) controls which server implementation is enabled (`synapse` or `dendrite` at the given moment).
+
+### Adapting the configuration for existing Synapse installations
+
+Because the playbook is not so Synapse-centric anymore, a small configuration change is necessary for existing installations to bring them up to date.
+
+The `vars.yml` file for **existing installations will need to be updated** by adding this **additional configuration**:
+
+```yaml
+# All secrets keys are now derived from `matrix_homeserver_generic_secret_key`, not from `matrix_synapse_macaroon_secret_key`.
+# To keep them all the same, define `matrix_homeserver_generic_secret_key` in terms of `matrix_synapse_macaroon_secret_key`.
+# Using a new secret value for this configuration key is also possible and should not cause any problems.
+#
+# Fun fact: new installations (based on the new `examples/vars.yml` file) do this in reverse.
+# That is, the Synapse macaroon secret is derived from `matrix_homeserver_generic_secret_key`.
+matrix_homeserver_generic_secret_key: "{{ matrix_synapse_macaroon_secret_key }}"
+```
+
+### Trying out Dendrite
+
+Finally, **to try out Dendrite**, we recommend that you **use a new server** and the following addition to your `vars.yml` configuration:
+
+```yaml
+matrix_homeserver_implementation: dendrite
+```
+
+**The homeserver implementation of an existing server cannot be changed** (e.g. from Synapse to Dendrite) without data loss.
+
+We're excited to gain support for other homeserver implementations, like [Conduit](https://conduit.rs/), etc!
+
+
+## Honoroit bot support
+
+Thanks to [Aine](https://gitlab.com/etke.cc) of [etke.cc](https://etke.cc/), the playbook can now help you set up [Honoroit](https://gitlab.com/etke.cc/honoroit) - a helpdesk bot.
+
+See our [Setting up Honoroit](docs/configuring-playbook-bot-honoroit.md) documentation to get started.
+
+
+# 2022-01-06
+
+## Cinny support
+
+Thanks to [Aine](https://gitlab.com/etke.cc) of [etke.cc](https://etke.cc/), the playbook now supports [Cinny](https://cinny.in/) - a new simple, elegant and secure Matrix client.
+
+By default, we still install Element. Still, people who'd like to try Cinny out can now install it via the playbook.
+
+Additional details are available in [Setting up Cinny](docs/configuring-playbook-client-cinny.md).
+
+
+# 2021-12-22
+
+## Twitter bridging support via mautrix-twitter
+
+Thanks to [Matthew Cengia](https://github.com/mattcen) and [Shreyas Ajjarapu](https://github.com/shreyasajj), besides [mx-puppet-twitter](docs/configuring-playbook-bridge-mx-puppet-twitter.md), bridging to [Twitter](https://twitter.com/) can now also happen with [mautrix-twitter](docs/configuring-playbook-bridge-mautrix-twitter.md).
+
+
+# 2021-12-14
+
+## (Security) Users of the Signal bridge may wish to upgrade it to work around log4j vulnerability
+
+Recently, a security vulnerability affecting the Java logging package `log4j` [has been discovered](https://www.huntress.com/blog/rapid-response-critical-rce-vulnerability-is-affecting-java). Software that uses this Java package is potentially vulnerable.
+
+One such piece of software that is part of the playbook is the [mautrix-signal bridge](./docs/configuring-playbook-bridge-mautrix-signal.md), which [has been patched already](https://github.com/spantaleev/matrix-docker-ansible-deploy/pull/1452). If you're running this bridge, you may wish to [upgrade](./docs/maintenance-upgrading-services.md).
+
+
+# 2021-11-11
+
+## Dropped support for Postgres v9.6
+
+Postgres v9.6 reached its end of life today, so the playbook will refuse to run for you if you're still on that version.
+
+Synapse still supports v9.6 (for now), but we're retiring support for it early, to avoid having to maintain support for so many Postgres versions. Users that are still on Postgres v9.6 can easily [upgrade Postgres](docs/maintenance-postgres.md#upgrading-postgresql) via the playbook.
+
+
 # 2021-10-23
 
 ## Hangouts bridge no longer updated, superseded by a Googlechat bridge
@@ -244,6 +330,8 @@ The fact that we've renamed Synapse's database from `homeserver` to `synapse` (i
 
 ## (Breaking Change) The mautrix-facebook bridge now requires a Postgres database
 
+**Update from 2021-11-15**: SQLite support has been re-added to the mautrix-facebook bridge in [v0.3.2](https://github.com/mautrix/facebook/releases/tag/v0.3.2). You can ignore this changelog entry.
+
 A new version of the [mautrix-facebook](https://github.com/tulir/mautrix-facebook) bridge has been released. It's a full rewrite of its backend and the bridge now requires Postgres. New versions of the bridge can no longer run on SQLite.
 
 **TLDR**: if you're NOT using an [external Postgres server](docs/configuring-playbook-external-postgres.md) and have NOT forcefully kept the bridge on SQLite during [The big move to all-on-Postgres (potentially dangerous)](#the-big-move-to-all-on-postgres-potentially-dangerous), you will be automatically upgraded without manual intervention. All you need to do is send a `login` message to the Facebook bridge bot again.

README.md

@@ -19,6 +19,8 @@ Using this playbook, you can get the following services configured on your serve
 
 - (optional, default) a [Synapse](https://github.com/matrix-org/synapse) homeserver - storing your data and managing your presence in the [Matrix](http://matrix.org/) network
 
+- (optional) a [Dendrite](https://github.com/matrix-org/dendrite) homeserver - storing your data and managing your presence in the [Matrix](http://matrix.org/) network. Dendrite is a second-generation Matrix homeserver written in Go, an alternative to Synapse.
+
 - (optional) [Amazon S3](https://aws.amazon.com/s3/) storage for Synapse's content repository (`media_store`) files using [Goofys](https://github.com/kahing/goofys)
 
 - (optional, default) [PostgreSQL](https://www.postgresql.org/) database for Synapse. [Using an external PostgreSQL server](docs/configuring-playbook-external-postgres.md) is also possible.
@@ -51,6 +53,8 @@ Using this playbook, you can get the following services configured on your serve
 
 - (optional) the [mautrix-facebook](https://github.com/mautrix/facebook) bridge for bridging your Matrix server to [Facebook](https://facebook.com/)
 
+- (optional) the [mautrix-twitter](https://github.com/mautrix/twitter) bridge for bridging your Matrix server to [Twitter](https://twitter.com/)
+
 - (optional) the [mautrix-hangouts](https://github.com/mautrix/hangouts) bridge for bridging your Matrix server to [Google Hangouts](https://en.wikipedia.org/wiki/Google_Hangouts)
 
 - (optional) the [mautrix-googlechat](https://github.com/mautrix/googlechat) bridge for bridging your Matrix server to [Google Chat](https://en.wikipedia.org/wiki/Google_Chat)
@@ -97,6 +101,8 @@ Using this playbook, you can get the following services configured on your serve
 
 - (optional) [matrix-reminder-bot](https://github.com/anoadragon453/matrix-reminder-bot) for scheduling one-off & recurring reminders and alarms - see [docs/configuring-playbook-bot-matrix-reminder-bot.md](docs/configuring-playbook-bot-matrix-reminder-bot.md) for setup documentation
 
+- (optional) [honoroit](https://gitlab.com/etke.cc/honoroit) helpdesk bot - see [docs/configuring-playbook-bot-honoroit.md](docs/configuring-playbook-bot-honoroit.md) for setup documentation
+
 - (optional) [Go-NEB](https://github.com/matrix-org/go-neb) multi functional bot written in Go - see [docs/configuring-playbook-bot-go-neb.md](docs/configuring-playbook-bot-go-neb.md) for setup documentation
 
 - (optional) [Mjolnir](https://github.com/matrix-org/mjolnir), a moderation tool for Matrix - see [docs/configuring-playbook-bot-mjolnir.md](docs/configuring-playbook-bot-mjolnir.md) for setup documentation
@@ -111,6 +117,8 @@ Using this playbook, you can get the following services configured on your serve
 
 - (optional) the [Hydrogen](https://github.com/vector-im/hydrogen-web) web client - see [docs/configuring-playbook-client-hydrogen.md](docs/configuring-playbook-client-hydrogen.md) for setup documentation
 
+- (optional) the [Cinny](https://github.com/ajbura/cinny) web client - see [docs/configuring-playbook-client-cinny.md](docs/configuring-playbook-client-cinny.md) for setup documentation
+
 Basically, this playbook aims to get you up-and-running with all the necessities around Matrix, without you having to do anything else.
 
 **Note**: the list above is exhaustive. It includes optional or even some advanced components that you will most likely not need.

collections/requirements.yml

@@ -0,0 +1,4 @@
+---
+collections:
+  - name: community.general
+  - name: community.docker  

docs/alternative-architectures.md

@@ -21,6 +21,6 @@ matrix_architecture: "arm32"
 
 ## Implementation details
 
-For `amd64`, prebuilt container images (see the [container images we use](container-images.md)) are used everywhere, because all images are available for this architecture.
+For `amd64`, prebuilt container images (see the [container images we use](container-images.md)) are used for all components (except [Hydrogen](configuring-playbook-client-hydrogen.md), which goes through self-building).
 
 For other architectures, components which have a prebuilt image make use of it. If the component is not available for the specific architecture, [self-building](self-building.md) will be used. Not all components support self-building though, so your mileage may vary.

docs/ansible.md

@@ -51,7 +51,7 @@ docker run -it --rm \
 -v `pwd`:/work \
 -v $HOME/.ssh/id_rsa:/root/.ssh/id_rsa:ro \
 --entrypoint=/bin/sh \
-docker.io/devture/ansible:2.9.14-r0
+docker.io/devture/ansible:2.11.6-r1
 ```
 
 The above command tries to mount an SSH key (`$HOME/.ssh/id_rsa`) into the container (at `/root/.ssh/id_rsa`).

docs/configuring-awx-system.md

@@ -4,7 +4,7 @@ An AWX setup for managing multiple Matrix servers.
 
 This section is used in an AWX system that can create and manage multiple [Matrix](http://matrix.org/) servers. You can issue members an AWX login to their own 'organisation', which they can use to manage/configure 1 to N servers.
 
-Members can be assigned a server from Digitalocean, or they can connect their own on-premises server. This script is free to use in a commercial context with the 'MemberPress Plus' and 'WP Oauth Sever' addons. It can also be run in a non-commercial context.
+Members can be assigned a server from Digitalocean, or they can connect their own on-premises server. These playbooks are free to use in a commercial context with the 'MemberPress Plus' plugin. They can also be run in a non-commercial context.
 
 The AWX system is arranged into 'members' each with their own 'subscriptions'. After creating a subscription the user enters the 'provision stage' where they defined the URLs they will use, the servers location and whether or not there's already a website at the base domain. They then proceed onto the 'deploy stage' where they can configure their Matrix server.
 
@@ -21,12 +21,7 @@ The following repositories allow you to copy and use this setup:
 
 [Ansible Provision Server](https://gitlab.com/GoMatrixHosting/ansible-provision-server) - Used by AWX members to perform initial configuration of their DigitalOcean or On-Premises server.
 
-
-## Testing Fork For This Playbook
-
-Updates to this section are trailed here:
-
-[GoMatrixHosting Matrix Docker Ansible Deploy](https://gitlab.com/GoMatrixHosting/matrix-docker-ansible-deploy)
+[GMHosting External Tools](https://gitlab.com/GoMatrixHosting/gmhosting-external-tools) - Extra tools we run outside of AWX, some of which are experimental.
 
 
 ## Does I need an AWX setup to use this? How do I configure it? 
@@ -38,7 +33,6 @@ For simpler installation steps you can use to get started with this system, chec
 
 ## Does I need a front-end WordPress site? And a DigitalOcean account? 
 
-You do not need a front-end WordPress site or any of the mentioned WordPress plugins to use this setup. It can be run on it's own in a non-commercial context.
-
-You also don't need a DigitalOcean account, but this will limit you to only being able to connect 'On-Premises' servers.
+You do not need a front-end WordPress site or the MemberPress plugin to use this setup. It can be run on it's own in a non-commercial context.
 
+You also don't need a DigitalOcean account, although this will limit you to only being able to connect 'On-Premises' servers.

docs/configuring-dns.md

@@ -37,6 +37,7 @@ If you are using Cloudflare DNS, make sure to disable the proxy and set all reco
 | CNAME | `goneb`                      | -        | -      | -    | `matrix.<your-domain>` |
 | CNAME | `sygnal`                     | -        | -      | -    | `matrix.<your-domain>` |
 | CNAME | `hydrogen`                   | -        | -      | -    | `matrix.<your-domain>` |
+| CNAME | `cinny`                      | -        | -      | -    | `matrix.<your-domain>` |
 
 ## Subdomains setup
 
@@ -57,6 +58,7 @@ The `sygnal.<your-domain>` subdomain may be necessary, because this playbook cou
 
 The `hydrogen.<your-domain>` subdomain may be necessary, because this playbook could install the [Hydrogen](https://github.com/vector-im/hydrogen-web) web client. The installation of Hydrogen is disabled by default, it is not a core required component. To learn how to install it, see our [configuring Hydrogen guide](configuring-playbook-client-hydrogen.md). If you do not wish to set up Hydrogen, feel free to skip the `hydrogen.<your-domain>` DNS record.
 
+The `cinny.<your-domain>` subdomain may be necessary, because this playbook could install the [Cinny](https://github.com/ajbura/cinny) web client. The installation of cinny is disabled by default, it is not a core required component. To learn how to install it, see our [configuring cinny guide](configuring-playbook-client-cinny.md). If you do not wish to set up cinny, feel free to skip the `cinny.<your-domain>` DNS record.
 
 ## `_matrix-identity._tcp` SRV record setup
 

docs/configuring-playbook-bot-go-neb.md

@@ -198,8 +198,8 @@ matrix_bot_go_neb_services:
       # Each room will get the notification with the alert rendered with the given template
       rooms:
         "!someroomid:domain.tld":
-          text_template: "{{range .Alerts -}} [{{ .Status }}] {{index .Labels \"alertname\" }}: {{index .Annotations \"description\"}} {{ end -}}"
-          html_template: "{{range .Alerts -}}  {{ $severity := index .Labels \"severity\" }}    {{ if eq .Status \"firing\" }}      {{ if eq $severity \"critical\"}}        <font color='red'><b>[FIRING - CRITICAL]</b></font>      {{ else if eq $severity \"warning\"}}        <font color='orange'><b>[FIRING - WARNING]</b></font>      {{ else }}        <b>[FIRING - {{ $severity }}]</b>      {{ end }}    {{ else }}      <font color='green'><b>[RESOLVED]</b></font>    {{ end }}  {{ index .Labels \"alertname\"}} : {{ index .Annotations \"description\"}}   <a href=\"{{ .GeneratorURL }}\">source</a><br/>{{end -}}"
+          text_template: "{% raw %}{{range .Alerts -}} [{{ .Status }}] {{index .Labels \"alertname\" }}: {{index .Annotations \"description\"}} {{ end -}}{% endraw %}"
+          html_template: "{% raw %}{{range .Alerts -}}  {{ $severity := index .Labels \"severity\" }}    {{ if eq .Status \"firing\" }}      {{ if eq $severity \"critical\"}}        <font color='red'><b>[FIRING - CRITICAL]</b></font>      {{ else if eq $severity \"warning\"}}        <font color='orange'><b>[FIRING - WARNING]</b></font>      {{ else }}        <b>[FIRING - {{ $severity }}]</b>      {{ end }}    {{ else }}      <font color='green'><b>[RESOLVED]</b></font>    {{ end }}  {{ index .Labels \"alertname\"}} : {{ index .Annotations \"description\"}}   <a href=\"{{ .GeneratorURL }}\">source</a><br/>{{end -}}{% endraw %}"
           msg_type: "m.text"  # Must be either `m.text` or `m.notice`
 ```
 

docs/configuring-playbook-bot-honoroit.md

@@ -0,0 +1,55 @@
+# Setting up Honoroit (optional)
+
+The playbook can install and configure [Honoroit](https://gitlab.com/etke.cc/honoroit) for you.
+
+It's a bot you can use to setup **your own helpdesk on matrix**
+
+See the project's [documentation](https://gitlab.com/etke.cc/honoroit#how-it-looks-like) to learn what it does with screenshots and why it might be useful to you.
+
+
+## Registering the bot user
+
+By default, the playbook will set up the bot with a username like this: `@honoroit:DOMAIN`.
+
+(to use a different username, adjust the `matrix_bot_honoroit_login` variable).
+
+You **need to register the bot user manually** before setting up the bot. You can use the playbook to [register a new user](registering-users.md):
+
+```
+ansible-playbook -i inventory/hosts setup.yml --extra-vars='username=honoroit password=PASSWORD_FOR_THE_BOT admin=no' --tags=register-user
+```
+
+Choose a strong password for the bot. You can generate a good password with a command like this: `pwgen -s 64 1`.
+
+
+## Adjusting the playbook configuration
+
+Add the following configuration to your `inventory/host_vars/matrix.DOMAIN/vars.yml` file:
+
+```yaml
+matrix_bot_honoroit_enabled: true
+
+# Adjust this to whatever password you chose when registering the bot user
+matrix_bot_honoroit_password: PASSWORD_FOR_THE_BOT
+
+# Adjust this to your room ID
+matrix_bot_honoroit_roomid: "!yourRoomID:DOMAIN"
+```
+
+
+## Installing
+
+After configuring the playbook, run the [installation](installing.md) command again:
+
+```
+ansible-playbook -i inventory/hosts setup.yml --tags=setup-all,start
+```
+
+
+## Usage
+
+To use the bot, invite the `@honoroit:DOMAIN` to the room you specified in config, after that any matrix user can send a message to the `@honoroit:DOMAIN` to start a new thread in that room.
+
+Send `!ho help` to the room to see the bot's help menu for additional commands.
+
+You can also refer to the upstream [documentation](https://gitlab.com/etke.cc/honoroit#features).

docs/configuring-playbook-bridge-mautrix-twitter.md

@@ -0,0 +1,35 @@
+# Setting up Mautrix Twitter (optional)
+
+**Note**: bridging to [Twitter](https://twitter.com/) can also happen via the [mx-puppet-twitter](configuring-playbook-bridge-mx-puppet-twitter.md) bridge supported by the playbook.
+
+The playbook can install and configure [mautrix-twitter](https://github.com/mautrix/twitter) for you.
+
+See the project's [documentation](https://github.com/mautrix/twitter) to learn what it does and why it might be useful to you.
+
+```yaml
+matrix_mautrix_twitter_enabled: true
+```
+
+
+## Set up Double Puppeting
+
+If you'd like to use [Double Puppeting](https://docs.mau.fi/bridges/general/double-puppeting.html) (hint: you most likely do), you have 2 ways of going about it.
+
+### Method 1: automatically, by enabling Shared Secret Auth
+
+The bridge will automatically perform Double Puppeting if you enable [Shared Secret Auth](configuring-playbook-shared-secret-auth.md) for this playbook.
+
+This is the recommended way of setting up Double Puppeting, as it's easier to accomplish, works for all your users automatically, and has less of a chance of breaking in the future.
+
+### Method 2: manually, by asking each user to provide a working access token
+
+This method is currently not available for the Mautrix-Twitter bridge, but is on the [roadmap](https://github.com/mautrix/twitter/blob/master/ROADMAP.md) under Misc/Manual login with `login-matrix`
+
+## Usage
+
+1. You then need to start a chat with `@twitterbot:YOUR_DOMAIN` (where `YOUR_DOMAIN` is your base domain, not the `matrix.` domain).
+2. Send login-cookie to start the login. The bot should respond with instructions on how to proceed.
+
+You can learn more here about authentication from the bridge's [official documentation on Authentication](https://docs.mau.fi/bridges/python/twitter/authentication.html).
+
+After successfully enabling bridging, you may wish to [set up Double Puppeting](#set-up-double-puppeting), if you haven't already done so.

docs/configuring-playbook-bridge-mautrix-whatsapp.md

@@ -8,8 +8,25 @@ Use the following playbook configuration:
 
 ```yaml
 matrix_mautrix_whatsapp_enabled: true
-```
+``` 
+Whatsapp multidevice beta is required, now it is enough if Whatsapp is connected to the Internet every 2 weeks.
+
+## Enable backfilling history
+This requires a server with MSC2716 support, which is currently an experimental feature in synapse.
+Note that as of Synapse 1.46, there are still some bugs with the implementation, especially if using event persistence workers.
+Use the following playbook configuration:
 
+```yaml
+matrix_synapse_configuration_extension_yaml: |
+  experimental_features:
+    msc2716_enabled: true
+```
+```yaml
+matrix_mautrix_whatsapp_configuration_extension_yaml:
+  bridge:
+    history_sync:
+      backfill: true
+```
 
 ## Set up Double Puppeting
 

docs/configuring-playbook-bridge-mx-puppet-twitter.md

@@ -1,5 +1,7 @@
 # Setting up MX Puppet Twitter (optional)
 
+**Note**: bridging to [Twitter](https://twitter.com/) can also happen via the [mautrix-twitter](configuring-playbook-bridge-mautrix-twitter.md) bridge supported by the playbook.
+
 The playbook can install and configure
 [mx-puppet-twitter](https://github.com/Sorunome/mx-puppet-twitter) for you.
 

docs/configuring-playbook-client-cinny.md

@@ -0,0 +1,21 @@
+# Configuring Cinny (optional)
+
+This playbook can install the [cinny](https://github.com/ajbura/cinny) Matrix web client for you.
+cinny is a web client focusing primarily on simple, elegant and secure interface.
+cinny can be installed alongside or instead of Element.
+
+If you'd like cinny to be installed, add the following to your configuration file (`inventory/host_vars/matrix.<your-domain>/vars.yml`):
+
+```yaml
+matrix_client_cinny_enabled: true
+```
+
+You will also need to add a DNS record so that cinny can be accessed.
+By default cinny will use https://cinny.DOMAIN so you will need to create an CNAME record
+for `cinny`. See [Configuring DNS](configuring-dns.md).
+
+If you would like to use a different domain, add the following to your configuration file (changing it to use your preferred domain):
+
+```yaml
+ matrix_server_fqn_cinny: "app.{{ matrix_domain }}"
+```

docs/configuring-playbook-dimension.md

@@ -58,7 +58,7 @@ curl -X POST --header 'Content-Type: application/json' -d '{
     "type": "m.login.password"
 }' 'https://matrix.YOURDOMAIN/_matrix/client/r0/login'
 ```
-*Change the "YourDimensionUser/Pass" URL accordigly*
+*Change `YourDimensionUsername`, `YourDimensionPassword`, and `YOURDOMAIN` accordingly.*
 
 **Access tokens are sensitive information. Do not include them in any bug reports, messages, or logs. Do not share the access token with anyone.**
 

docs/configuring-playbook-etherpad.md

@@ -25,6 +25,23 @@ The Dimension administrator users can configure the default URL template. The Di
 If you wish to disable the Etherpad chat button, you can do it by appending `?showChat=false` to the end of the pad URL, or the template.
 Example: `https://dimension.<your-domain>/etherpad/p/$roomId_$padName?showChat=false`
 
+### Etherpad Admin access (optional)
+
+Etherpad comes with a admin web-UI which is disabled by default. You can enable it by setting a username and password in your configuration file (`inventory/host_vars/matrix.<your-domain>/vars.yml`):
+
+```yaml
+matrix_etherpad_admin_username: admin
+matrix_etherpad_admin_password: some-password
+```
+
+The admin web-UI should then be available on: `https://dimension.<your-domain>/etherpad/admin`
+
+### Managing / Deleting old pads
+
+If you want to manage and remove old unused pads from Etherpad, you will first need to able Admin access as described above.
+
+Then from the plugin manager page (`https://dimension.<your-domain>/etherpad/admin/plugins`), install the `adminpads2` plugin. Once installed, you should have a "Manage pads" section in the Admin web-UI.
+
 ## Known issues
 
 If your Etherpad widget fails to load, this might be due to Dimension generating a Pad name so long, the Etherpad app rejects it.

docs/configuring-playbook-jitsi.md

@@ -41,13 +41,23 @@ If you're fine with such an open Jitsi instance, please skip to [Apply changes](
 
 If you would like to control who is allowed to open meetings on your new Jitsi instance, then please follow this step to enable Jitsi's authentication and guests mode. With authentication enabled, all meeting rooms have to be opened by a registered user, after which guests are free to join. If a registered host is not yet present, guests are put on hold in individual waiting rooms.
 
-Add these two lines to your `inventory/host_vars/matrix.DOMAIN/vars.yml` configuration:
+Add these lines to your `inventory/host_vars/matrix.DOMAIN/vars.yml` configuration:
 
 ```yaml
 matrix_jitsi_enable_auth: true
 matrix_jitsi_enable_guests: true
+matrix_jitsi_prosody_auth_internal_accounts:
+  - username: "jitsi-moderator"
+    password: "secret-password"
+  - username: "another-user"
+    password: "another-password"
 ```
 
+**Caution:** Accounts added here and subsquently removed will not be automatically removed from the Prosody server until user account cleaning is integrated into the playbook.
+
+**If you get an error** like this: "Error: Account creation/modification not supported.", it's likely that you had previously installed Jitsi without auth/guest support. In such a case, you should look into [Rebuilding your Jitsi installation](#rebuilding-your-jitsi-installation).
+
+
 ### (Optional) LDAP authentication
 
 The default authentication mode of Jitsi is `internal`, however LDAP is also supported. An example LDAP configuration could be:
@@ -122,19 +132,6 @@ You may want to **limit the maximum video resolution**, to save up resources on
 
 Then re-run the playbook: `ansible-playbook -i inventory/hosts setup.yml --tags=setup-all,start`
 
-## Required if configuring Jitsi with internal authentication: register new users
-
-Until this gets integrated into the playbook, we need to register new users / meeting hosts for Jitsi manually.
-Please SSH into your matrix host machine and execute the following command targeting the `matrix-jitsi-prosody` container:
-
-```bash
-docker exec matrix-jitsi-prosody prosodyctl --config /config/prosody.cfg.lua register <USERNAME> meet.jitsi <PASSWORD>
-```
-
-Run this command for each user you would like to create, replacing `<USERNAME>` and `<PASSWORD>` accordingly. After you've finished, please exit the host.
-
-**If you get an error** like this: "Error: Account creation/modification not supported.", it's likely that you had previously installed Jitsi without auth/guest support. In such a case, you should look into [Rebuilding your Jitsi installation](#rebuilding-your-jitsi-installation).
-
 
 ## Usage
 

docs/configuring-playbook-matrix-corporal.md

@@ -37,6 +37,7 @@ matrix_synapse_ext_password_provider_rest_auth_endpoint: "http://matrix-corporal
 
 matrix_corporal_enabled: true
 
+# See below for an example of how to use a locally-stored static policy
 matrix_corporal_policy_provider_config: |
   {
     "Type": "http",
@@ -74,10 +75,48 @@ Matrix Corporal operates with a specific Matrix user on your server.
 By default, it's `matrix-corporal` (controllable by the `matrix_corporal_reconciliation_user_id_local_part` setting, see above).
 No matter what Matrix user id you configure to run it with, make sure that:
 
-- the Matrix Corporal user is created by [registering it](registering-users.md). Use a password you remember, as you'll need to log in from time to time to create or join rooms
+- the Matrix Corporal user is created by [registering it](registering-users.md) **with administrator privileges**. Use a password you remember, as you'll need to log in from time to time to create or join rooms
 
 - the Matrix Corporal user is joined and has Admin/Moderator-level access to any rooms you want it to manage
 
+### Using a locally-stored static policy
+
+If you'd like to use a [static policy file](https://github.com/devture/matrix-corporal/blob/master/docs/policy-providers.md#static-file-pull-style-policy-provider), you can use a configuration like this:
+
+```yaml
+matrix_corporal_policy_provider_config: |
+  {
+    "Type": "static_file",
+    "Path": "/etc/matrix-corporal/policy.json"
+  }
+
+# Modify the policy below as you see fit
+matrix_aux_file_definitions:
+  - dest: "{{ matrix_corporal_config_dir_path }}/policy.json"
+    content: |
+      {
+        "schemaVersion": 1,
+        "identificationStamp": "stamp-1",
+        "flags": {
+          "allowCustomUserDisplayNames": false,
+          "allowCustomUserAvatars": false,
+          "forbidRoomCreation": false,
+          "forbidEncryptedRoomCreation": true,
+          "forbidUnencryptedRoomCreation": false,
+          "allowCustomPassthroughUserPasswords": true,
+          "allowUnauthenticatedPasswordResets": false,
+          "allow3pidLogin": false
+        },
+        "managedCommunityIds": [],
+        "managedRoomIds": [],
+        "users": []
+      }
+```
+
+To learn more about what the policy configuration, see the matrix-corporal documentation on [policy](https://github.com/devture/matrix-corporal/blob/master/docs/policy.md).
+
+Each time you update the policy in your `vars.yml` file, you'd need to re-run the playbook and restart matrix-corporal (`--tags=setup-all,start` or `--tags=setup-aux-files,setup-corporal,start`).
+
 
 ## Matrix Corporal files
 

docs/configuring-playbook-own-webserver.md

@@ -64,14 +64,14 @@ Once you've followed the [Preparation](#preparation) guide above, you can take a
 
 ### Using your own external caddy webserver
 
-After following  the [Preparation](#preparation) guide above, you can take a look at the [examples/caddy](../examples/caddy) directory for a sample configuration.
+After following  the [Preparation](#preparation) guide above, you can take a look at the [examples/caddy](../examples/caddy) directory and [examples/caddy2](../examples/caddy2) directory for a sample configuration for Caddy v1 and v2, respectively.
 
 ### Using your own HAproxy reverse proxy
 After following  the [Preparation](#preparation) guide above, you can take a look at the [examples/haproxy](../examples/haproxy) directory for a sample configuration. In this case HAproxy is used as a reverse proxy and a simple Nginx container is used to serve statically `.well-known` files.
 
 ### Using another external webserver
 
-Feel free to look at the [examples/apache](../examples/apache) directory, or the [template files in the matrix-nginx-proxy role](../roles/matrix-nginx-proxy/templates/conf.d/).
+Feel free to look at the [examples/apache](../examples/apache) directory, or the [template files in the matrix-nginx-proxy role](../roles/matrix-nginx-proxy/templates/nginx/conf.d/).
 
 
 ## Method 2: Fronting the integrated nginx reverse-proxy webserver with another reverse-proxy
@@ -111,6 +111,9 @@ matrix_coturn_enabled: false
 
 # Trust the reverse proxy to send the correct `X-Forwarded-Proto` header as it is handling the SSL connection.
 matrix_nginx_proxy_trust_forwarded_proto: true
+
+# Trust and use the other reverse proxy's `X-Forwarded-For` header.
+matrix_nginx_proxy_x_forwarded_for: '$proxy_add_x_forwarded_for'
 ```
 
 With this, nginx would still be in use, but it would not bother with anything SSL related or with taking up public ports.
@@ -136,6 +139,12 @@ matrix_nginx_proxy_https_enabled: false
 matrix_nginx_proxy_container_http_host_bind_port: ''
 matrix_nginx_proxy_container_federation_host_bind_port: ''
 
+# Trust the reverse proxy to send the correct `X-Forwarded-Proto` header as it is handling the SSL connection.
+matrix_nginx_proxy_trust_forwarded_proto: true
+
+# Trust and use the other reverse proxy's `X-Forwarded-For` header.
+matrix_nginx_proxy_x_forwarded_for: '$proxy_add_x_forwarded_for'
+
 # Disable Coturn because it needs SSL certs
 # (Clients can, though exposing IP address, use Matrix.org TURN)
 matrix_coturn_enabled: false

docs/configuring-playbook-prometheus-grafana.md

@@ -55,9 +55,41 @@ Name | Description
 `matrix_synapse_metrics_enabled`|Set this to `true` to make Synapse expose metrics (locally, on the container network)
 `matrix_nginx_proxy_proxy_synapse_metrics`|Set this to `true` to make matrix-nginx-proxy expose the Synapse metrics at `https://matrix.DOMAIN/_synapse/metrics`
 `matrix_nginx_proxy_proxy_synapse_metrics_basic_auth_enabled`|Set this to `true` to password-protect (using HTTP Basic Auth) `https://matrix.DOMAIN/_synapse/metrics` (the username is always `prometheus`, the password is defined in `matrix_nginx_proxy_proxy_synapse_metrics_basic_auth_key`)
-`matrix_nginx_proxy_proxy_synapse_metrics_basic_auth_key`|Set this to a password to use for HTTP Basic Auth for protecting `https://matrix.DOMAIN/_synapse/metrics` (the username is always `prometheus` - it's not configurable)
+`matrix_nginx_proxy_proxy_synapse_metrics_basic_auth_key`|Set this to a password to use for HTTP Basic Auth for protecting `https://matrix.DOMAIN/_synapse/metrics` (the username is always `prometheus` - it's not configurable). Do not write the password in plain text. See `man 1 htpasswd` or use `htpasswd -c mypass.htpasswd prometheus` to generate the expected hash for nginx. 
 `matrix_server_fqn_grafana`|Use this variable to override the domain at which the Grafana web user-interface is at (defaults to `stats.DOMAIN`)
 
+### Collecting worker metrics to an external Prometheus server
+
+If you are using workers (`matrix_synapse_workers_enabled`) and have enabled `matrix_nginx_proxy_proxy_synapse_metrics` as described above, the playbook will also automatically proxy the all worker threads's metrics to `https://matrix.DOMAIN/_synapse-worker-TYPE-ID/metrics`, where `TYPE` corresponds to the type and `ID` to the instanceId of a worker as exemplified in `matrix_synapse_workers_enabled_list`.
+
+The playbook also generates an exemplary prometheus.yml config file (`matrix_base_data_path/external_prometheus.yml.template`) with all the correct paths which you can copy to your Prometheus server and adapt to your needs, especially edit the specified `password_file` path and contents and path to your `synapse-v2.rules`.
+It will look a bit like this:
+```yaml
+scrape_configs:
+  - job_name: 'synapse'
+    metrics_path: /_synapse/metrics
+    scheme: https
+    basic_auth:
+      username: prometheus
+      password_file: /etc/prometheus/password.pwd
+    static_configs:
+      - targets: ['matrix.DOMAIN:443']
+        labels:
+          job: "master"
+          index: 1
+  - job_name: 'synapse-generic_worker-1'
+    metrics_path: /_synapse-worker-generic_worker-18111/metrics
+    scheme: https
+    basic_auth:
+      username: prometheus
+      password_file: /etc/prometheus/password.pwd
+    static_configs:
+      - targets: ['matrix.DOMAIN:443']
+        labels:
+          job: "generic_worker"
+          index: 18111
+```
+
 ### Collecting system and Postgres metrics to an external Prometheus server (advanced)
 
 When you normally enable the Prometheus and Grafana via the playbook, it will also show general system (via node-exporter) and Postgres (via postgres-exporter) stats. If you are instead collecting your metrics to an external Prometheus server, you can follow this advanced configuration example to also export these stats.

docs/configuring-playbook.md

@@ -69,6 +69,7 @@ When you're done with all the configuration you'd like to do, continue with [Ins
 - [Adjusting email-sending settings](configuring-playbook-email.md) (optional)
 
 - [Setting up Hydrogen](configuring-playbook-client-hydrogen.md) - a new lightweight matrix client with legacy and mobile browser support (optional)
+- [Setting up Cinny](configuring-playbook-client-cinny.md) - a web client focusing primarily on simple, elegant and secure interface (optional)
 
 
 ### Authentication and user-related
@@ -102,6 +103,8 @@ When you're done with all the configuration you'd like to do, continue with [Ins
 
 - [Setting up Mautrix Instagram bridging](configuring-playbook-bridge-mautrix-instagram.md) (optional)
 
+- [Setting up Mautrix Twitter bridging](configuring-playbook-bridge-mautrix-twitter.md) (optional)
+
 - [Setting up Mautrix Signal bridging](configuring-playbook-bridge-mautrix-signal.md) (optional)
 
 - [Setting up Appservice IRC bridging](configuring-playbook-bridge-appservice-irc.md) (optional)
@@ -139,6 +142,8 @@ When you're done with all the configuration you'd like to do, continue with [Ins
 
 - [Setting up matrix-reminder-bot](configuring-playbook-bot-matrix-reminder-bot.md) - a bot to remind you about stuff (optional)
 
+- [Setting up honoroit](configuring-playbook-bot-honoroit.md) - a helpdesk bot (optional)
+
 - [Setting up Go-NEB](configuring-playbook-bot-go-neb.md) - an extensible multifunctional bot (optional)
 
 - [Setting up Mjolnir](configuring-playbook-bot-mjolnir.md) - a moderation tool/bot (optional)

docs/container-images.md

@@ -30,6 +30,8 @@ These services are enabled and used by default, but you can turn them off, if yo
 
 These services are not part of our default installation, but can be enabled by [configuring the playbook](configuring-playbook.md) (either before the initial installation or any time later):
 
+- [matrixdotorg/dendrite-monolith](https://hub.docker.com/r/matrixdotorg/dendrite-monolith/) - the official [Dendrite](https://github.com/matrix-org/dendrite) Matrix homeserver (optional)
+
 - [ewoutp/goofys](https://hub.docker.com/r/ewoutp/goofys/) - the [Goofys](https://github.com/kahing/goofys) Amazon [S3](https://aws.amazon.com/s3/) file-system-mounting program (optional)
 
 - [etherpad/etherpad](https://hub.docker.com/r/etherpad/etherpad/) - the [Etherpad](https://etherpad.org) realtime collaborative text editor that can be used in a Jitsi audio/video call or integrated as a widget into Matrix chat rooms via the Dimension integration manager (optional)
@@ -46,6 +48,8 @@ These services are not part of our default installation, but can be enabled by [
 
 - [mautrix/facebook](https://mau.dev/mautrix/facebook/container_registry) - the [mautrix-facebook](https://github.com/mautrix/facebook) bridge to [Facebook](https://facebook.com/) (optional)
 
+- [mautrix/twitter](https://mau.dev/mautrix/twitter/container_registry) - the [mautrix-twitter](https://github.com/mautrix/twitter) bridge to [Twitter](https://twitter.com/) (optional)
+
 - [mautrix/hangouts](https://mau.dev/mautrix/hangouts/container_registry) - the [mautrix-hangouts](https://github.com/mautrix/hangouts) bridge to [Google Hangouts](https://en.wikipedia.org/wiki/Google_Hangouts) (optional)
 
 - [mautrix/googlechat](https://mau.dev/mautrix/googlechat/container_registry) - the [mautrix-googlechat](https://github.com/mautrix/googlechat) bridge to [Google Chat](https://en.wikipedia.org/wiki/Google_Chat) (optional)
@@ -90,6 +94,8 @@ These services are not part of our default installation, but can be enabled by [
 
 - [anoa/matrix-reminder-bot](https://hub.docker.com/r/anoa/matrix-reminder-bot) - the [matrix-reminder-bot](https://github.com/anoadragon453/matrix-reminder-bot) bot for one-off & recurring reminders and alarms (optional)
 
+- [etke.cc/honoroit](https://gitlab.com/etke.cc/honoroit/container_registry) - the [honoroit](https://gitlab.com/etke.cc/honoroit) helpdesk bot (optional)
+
 - [matrixdotorg/go-neb](https://hub.docker.com/r/matrixdotorg/go-neb) - the [Go-NEB](https://github.com/matrix-org/go-neb) bot (optional)
 
 - [matrixdotorg/mjolnir](https://hub.docker.com/r/matrixdotorg/mjolnir) - the [mjolnir](https://github.com/matrix-org/mjolnir) moderation bot (optional)

docs/importing-postgres.md

@@ -12,7 +12,8 @@ If your database name differs, be sure to change `matrix_synapse_database_databa
 
 The playbook supports importing Postgres dump files in **text** (e.g. `pg_dump > dump.sql`) or **gzipped** formats (e.g. `pg_dump | gzip -c > dump.sql.gz`).
 
-Importing multiple databases (as dumped by `pg_dumpall`) is also supported.
+Importing multiple databases (as dumped by `pg_dumpall`) is also supported.  
+But the migration might be a good moment, to "reset" a not properly working bridge. Be aware, that it might affect all users (new link to bridge, new roomes, ...)
 
 Before doing the actual import, **you need to upload your Postgres dump file to the server** (any path is okay).
 
@@ -32,6 +33,7 @@ ansible-playbook -i inventory/hosts setup.yml \
 
 ## Troubleshooting
 
+### Table Ownership
 A table ownership issue can occur if you are importing from a Synapse installation which was both:
 
  - migrated from SQLite to Postgres, and
@@ -48,7 +50,7 @@ where `synapse_user` is the database username from the previous Synapse installa
 This can be verified by examining the dump for ALTER TABLE statements which set OWNER TO that username:
 
 ```Shell
-$ grep "ALTER TABLE" homeserver.sql"
+$ grep "ALTER TABLE" homeserver.sql
 ALTER TABLE public.access_tokens OWNER TO synapse_user;
 ALTER TABLE public.account_data OWNER TO synapse_user;
 ALTER TABLE public.account_data_max_stream_id OWNER TO synapse_user;
@@ -60,10 +62,10 @@ ALTER TABLE public.application_services_state OWNER TO synapse_user;
 It can be worked around by changing the username to `synapse`, for example by using `sed`:
 
 ```Shell
-$ sed -i "s/synapse_user/synapse/g" homeserver.sql
+$ sed -i "s/OWNER TO synapse_user;/OWNER TO synapse;/g" homeserver.sql
 ```
 
-This uses sed to perform an 'in-place' (`-i`) replacement globally (`/g`), searching for `synapse user` and replacing with `synapse` (`s/synapse_user/synapse`). If your database username was different, change `synapse_user` to that username instead.
+This uses sed to perform an 'in-place' (`-i`) replacement globally (`/g`), searching for `synapse_user` and replacing with `synapse` (`s/synapse_user/synapse`). If your database username was different, change `synapse_user` to that username instead. Expand search/replace statement as shown in example above, in case of old user name like `matrix` - replacing `matrix` only would... well - you can imagine.
 
 Note that if the previous import failed with an error it may have made changes which are incompatible with re-running the import task right away; if you do so it may fail with an error such as:
 
@@ -71,6 +73,8 @@ Note that if the previous import failed with an error it may have made changes w
 ERROR:  relation \"access_tokens\" already exists
 ```
 
+### Repeat import
+
 In this case you can use the command suggested in the import task to clear the database before retrying the import:
 
 ```Shell
@@ -79,4 +83,20 @@ In this case you can use the command suggested in the import task to clear the d
 # systemctl start matrix-postgres
 ```
 
-Once the database is clear and the ownership of the tables has been fixed in the SQL file, the import task should succeed.
+Now on your local machine run `ansible-playbook -i inventory/hosts setup.yml --tags=setup-postgres` to prepare the database roles etc.
+
+If not, you probably get this error. `synapse` is the correct table owner, but the role is missing in database.
+```
+"ERROR:  role synapse does not exist"
+```
+
+Once the database is clear and the ownership of the tables has been fixed in the SQL file, the import task should succeed.  
+Check, if `--dbname` is set to `synapse` (not `matrix`) and replace paths (or even better, copy this line from your terminal)
+
+```
+/usr/bin/env docker run --rm --name matrix-postgres-import --log-driver=none --user=998:1001 --cap-drop=ALL --network=matrix --env-file=/matrix/postgres/env-postgres-psql --mount type=bind,src=/migration/synapse_dump.sql,dst=/synapse_dump.sql,ro --entrypoint=/bin/sh docker.io/postgres:14.1-alpine -c "cat /synapse_dump.sql | grep -vE '^(CREATE|ALTER) ROLE (matrix)(;| WITH)' | grep -vE '^CREATE DATABASE (matrix)\s' | psql -v ON_ERROR_STOP=1 -h matrix-postgres --dbname=synapse"
+```
+
+### Hints
+
+To open psql terminal run `/usr/local/bin/matrix-postgres-cli`

docs/installing.md

@@ -1,25 +1,25 @@
 # Installing
 
+## 1. Installing the Matrix services
+
 If you've [configured your DNS](configuring-dns.md) and have [configured the playbook](configuring-playbook.md), you can start the installation procedure.
 
-Run this as-is to set up a server:
+Run this command to install the Matrix services:
 
 ```bash
 ansible-playbook -i inventory/hosts setup.yml --tags=setup-all
 ```
 
-**Note**: if you don't use SSH keys for authentication, but rather a regular password, you may need to add `--ask-pass` to the above (and all other) Ansible commands.
-
-**Note**: if you **do** use SSH keys for authentication, **and** use a non-root user to *become* root (sudo), you may need to add `-K` (`--ask-become-pass`) to the above (and all other) Ansible commands.
+The above command **doesn't start any services just yet** (another step does this later - below). Feel free to **re-run this setup command any time** you think something is off with the server configuration.
 
-The above command **doesn't start any services just yet** (another step does this later - below).
+**Notes**:
+- if you **don't** use SSH keys for authentication, but rather a regular password, you may need to add `--ask-pass` to the above (and all other) Ansible commands.
+- if you **do** use SSH keys for authentication, **and** use a non-root user to *become* root (sudo), you may need to add `-K` (`--ask-become-pass`) to the above (and all other) Ansible commands.
 
-Feel free to **re-run this setup command any time** you think something is off with the server configuration.
 
+## 2. Things you might want to do after installing
 
-## Things you might want to do after installing
-
-After installing, but before starting the services, you may want to do additional things like:
+**Before starting the services**, you may want to do additional things like:
 
 - [Importing an existing SQLite database (from another Synapse installation)](importing-synapse-sqlite.md) (optional)
 
@@ -28,20 +28,22 @@ After installing, but before starting the services, you may want to do additiona
 - [Importing `media_store` data files from an existing Synapse installation](importing-synapse-media-store.md) (optional)
 
 
-## Starting the services
+## 3. Starting the services
 
-When you're ready to start the Matrix services (and set them up to auto-start in the future):
+When you're ready to start the Matrix services (and set them up to auto-start in the future), run this command:
 
 ```bash
 ansible-playbook -i inventory/hosts setup.yml --tags=start
 ```
 
-Now that services are running, you need to **finalize the installation process** (required for federation to work!) by [Configuring Service Discovery via .well-known](configuring-well-known.md)
+## 4. Finalize the installation
+
+Now that services are running, you need to **finalize the installation process** (required for federation to work!) by [Configuring Service Discovery via .well-known](configuring-well-known.md).
 
 
-## Things to do next
+## 5. Things to do next
 
-If you have started services and **finalized the installation process** (required for federation to work!) by [Configuring Service Discovery via .well-known](configuring-well-known.md), you can:
+After you have started the services and **finalized the installation process** (required for federation to work!) by [Configuring Service Discovery via .well-known](configuring-well-known.md), you can:
 
 - [check if services work](maintenance-checking-services.md)
 - or [create your first Matrix user account](registering-users.md)

docs/self-building.md

@@ -15,14 +15,17 @@ List of roles where self-building the Docker image is currently possible:
 - `matrix-synapse-admin`
 - `matrix-client-element`
 - `matrix-client-hydrogen`
+- `matrix-client-cinny`
 - `matrix-registration`
 - `matrix-coturn`
 - `matrix-corporal`
+- `matrix-dimension`
 - `matrix-ma1sd`
 - `matrix-mailer`
 - `matrix-bridge-appservice-irc`
 - `matrix-bridge-appservice-slack`
 - `matrix-bridge-appservice-webhooks`
+- `matrix-bridge-beeper-linkedin`
 - `matrix-bridge-mautrix-facebook`
 - `matrix-bridge-mautrix-hangouts`
 - `matrix-bridge-mautrix-googlechat`
@@ -31,6 +34,7 @@ List of roles where self-building the Docker image is currently possible:
 - `matrix-bridge-mautrix-whatsapp`
 - `matrix-bridge-mx-puppet-skype`
 - `matrix-bot-mjolnir`
+- `matrix-bot-honoroit`
 - `matrix-bot-matrix-reminder-bot`
 - `matrix-email2matrix`
 

examples/caddy/matrix-synapse

@@ -5,7 +5,7 @@ https://matrix.DOMAIN {
 
 	root /matrix/static-files
 
-	header {
+	header / {
 		Access-Control-Allow-Origin *
 		Strict-Transport-Security "mag=age=31536000;"
 		X-Frame-Options "DENY"
@@ -13,10 +13,10 @@ https://matrix.DOMAIN {
 	}
 
 	# Identity server traffic
-	proxy /_matrix/identity matrix-msisd:8090 {
+	proxy /_matrix/identity matrix-ma1sd:8090 {
 		transparent
 	}
-	proxy /_matrix/client/r0/user_directory/search matrix-msisd:8090 {
+	proxy /_matrix/client/r0/user_directory/search matrix-ma1sd:8090 {
 		transparent
 	}
 

examples/caddy2/Caddyfile

@@ -27,6 +27,10 @@ matrix.DOMAIN.tld {
         not path /matrix/static-files/*
   }
 
+  @wellknown {
+        path /.well-known/matrix/*
+  }
+
   header {
         # Enable HTTP Strict Transport Security (HSTS) to force clients to always connect via HTTPS
         Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
@@ -69,6 +73,15 @@ matrix.DOMAIN.tld {
         }
   }
 
+  handle @wellknown {
+        encode zstd gzip
+        root * /matrix/static-files
+	header Cache-Control max-age=14400
+        header Content-Type application/json
+        header Access-Control-Allow-Origin *
+        file_server
+  }
+
   handle {
         encode zstd gzip
 
@@ -102,17 +115,17 @@ element.DOMAIN.tld {
       # tls your@email.com
 
       header {
-         	# Enable HTTP Strict Transport Security (HSTS) to force clients to always connect via HTTPS
-        	Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
-        	# Enable cross-site filter (XSS) and tell browser to block detected attacks
-        	X-XSS-Protection "1; mode=block"
-        	# Prevent some browsers from MIME-sniffing a response away from the declared Content-Type
-        	X-Content-Type-Options "nosniff"
-        	# Disallow the site to be rendered within a frame (clickjacking protection)
-        	X-Frame-Options "DENY"
-        	# X-Robots-Tag
-        	X-Robots-Tag "noindex, noarchive, nofollow"
-  	}
+                # Enable HTTP Strict Transport Security (HSTS) to force clients to always connect via HTTPS
+                Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
+                # Enable cross-site filter (XSS) and tell browser to block detected attacks
+                X-XSS-Protection "1; mode=block"
+                # Prevent some browsers from MIME-sniffing a response away from the declared Content-Type
+                X-Content-Type-Options "nosniff"
+                # Disallow the site to be rendered within a frame (clickjacking protection)
+                X-Frame-Options "DENY"
+                # X-Robots-Tag
+                X-Robots-Tag "noindex, noarchive, nofollow"
+        }
 
         handle {
               encode zstd gzip

examples/vars.yml

@@ -10,6 +10,14 @@
 # Example value: example.com
 matrix_domain: YOUR_BARE_DOMAIN_NAME_HERE
 
+# The Matrix homeserver software to install.
+# See `roles/matrix-base/defaults/main.yml` for valid options.
+matrix_homeserver_implementation: synapse
+
+# A secret used as a base, for generating various other secrets.
+# You can put any string here, but generating a strong one is preferred (e.g. `pwgen -s 64 1`).
+matrix_homeserver_generic_secret_key: ''
+
 # This is something which is provided to Let's Encrypt when retrieving SSL certificates for domains.
 #
 # In case SSL renewal fails at some point, you'll also get an email notification there.
@@ -20,14 +28,6 @@ matrix_domain: YOUR_BARE_DOMAIN_NAME_HERE
 # Example value: someone@example.com
 matrix_ssl_lets_encrypt_support_email: ''
 
-# A shared secret (between Coturn and Synapse) used for authentication.
-# You can put any string here, but generating a strong one is preferred (e.g. `pwgen -s 64 1`).
-matrix_coturn_turn_static_auth_secret: ''
-
-# A secret used to protect access keys issued by the server.
-# You can put any string here, but generating a strong one is preferred (e.g. `pwgen -s 64 1`).
-matrix_synapse_macaroon_secret_key: ''
-
 # A Postgres password to use for the superuser Postgres user (called `matrix` by default).
 #
 # The playbook creates additional Postgres users and databases (one for each enabled service)

roles/matrix-awx/defaults/main.yml

@@ -1 +1,6 @@
 matrix_awx_enabled: true
+
+# Defaults for 'Customise Website + Access Export' template
+awx_sftp_auth_method: 'Disabled'
+awx_sftp_password: ''
+awx_sftp_public_key: ''

roles/matrix-awx/scripts/matrix_build_room_list.py

@@ -5,10 +5,11 @@ import json
 
 janitor_token = sys.argv[1]
 synapse_container_ip = sys.argv[2]
+synapse_container_port = sys.argv[3]
 
 # collect total amount of rooms
 
-rooms_raw_url = 'http://' + synapse_container_ip + ':8008/_synapse/admin/v1/rooms'
+rooms_raw_url = 'http://' + synapse_container_ip + ':' + synapse_container_port + '/_synapse/admin/v1/rooms'
 rooms_raw_header = {'Authorization': 'Bearer ' + janitor_token}
 rooms_raw = requests.get(rooms_raw_url, headers=rooms_raw_header)
 rooms_raw_python = json.loads(rooms_raw.text)
@@ -19,7 +20,7 @@ total_rooms = rooms_raw_python["total_rooms"]
 room_list_file = open("/tmp/room_list_complete.json", "w")
 
 for i in range(0, total_rooms, 100):
-  rooms_inc_url = 'http://' + synapse_container_ip + ':8008/_synapse/admin/v1/rooms?from=' + str(i)
+  rooms_inc_url = 'http://' + synapse_container_ip + ':' + synapse_container_port + '/_synapse/admin/v1/rooms?from=' + str(i)
   rooms_inc = requests.get(rooms_inc_url, headers=rooms_raw_header)
   room_list_file.write(rooms_inc.text)
 

roles/matrix-awx/surveys/bridge_discord_appservice.json.j2

@@ -0,0 +1,66 @@
+{
+  "name": "Bridge Discord Appservice",
+  "description": "Enables a private bridge you can use to connect Matrix rooms to Discord.",
+  "spec": [
+    {
+      "question_name": "Enable Discord AppService Bridge",
+      "question_description": "Enables a private bridge you can use to connect Matrix rooms to Discord.",
+      "required": true,
+      "min": null,
+      "max": null,
+      "default": "{{ matrix_appservice_discord_enabled | string | lower }}",
+      "choices": "true\nfalse",
+      "new_question": true,
+      "variable": "matrix_appservice_discord_enabled",
+      "type": "multiplechoice"
+    },
+    {
+      "question_name": "Discord OAuth2 Client ID",
+      "question_description": "The OAuth2 'CLIENT ID' which can be found in the 'OAuth2' tab of your new discord application: https://discord.com/developers/applications",
+      "required": true,
+      "min": 0,
+      "max": 128,
+      "default": "{{ matrix_appservice_discord_client_id | trim }}",
+      "choices": "",
+      "new_question": true,
+      "variable": "matrix_appservice_discord_client_id",
+      "type": "text"
+    },
+    {
+      "question_name": "Discord Bot Token",
+      "question_description": "The Bot 'TOKEN' which can be found in the 'Bot' tab of your new discord application: https://discord.com/developers/applications",
+      "required": true,
+      "min": 0,
+      "max": 256,
+      "default": "{{ matrix_appservice_discord_bot_token | trim }}",
+      "choices": "",
+      "new_question": true,
+      "variable": "matrix_appservice_discord_bot_token",
+      "type": "password"
+    },
+    {
+      "question_name": "Auto-Admin Matrix User",
+      "question_description": "The username you would like to be automatically joined and promoted to administrator (PL100) in bridged rooms. Exclude the '@' and server name postfix. So to create @stevo:example.org just enter 'stevo'.",
+      "required": false,
+      "min": 0,
+      "max": 1024,
+      "default": "",
+      "choices": "",
+      "new_question": true,
+      "variable": "awx_appservice_discord_admin_user",
+      "type": "text"
+    },
+    {
+      "question_name": "Auto-Admin Rooms",
+      "question_description": "A list of rooms you want the user to be automatically joined and promoted to administrator (PL100) in. These should be the internal IDs (for example '!axfBUsKhfAjSMBdjKX:example.org') separated by newlines.",
+      "required": false,
+      "min": 0,
+      "max": 4096,
+      "default": "",
+      "choices": "",
+      "new_question": true,
+      "variable": "awx_appservice_discord_admin_rooms",
+      "type": "textarea"
+    }
+  ]
+}

roles/matrix-awx/surveys/configure_corporal.json.j2

@@ -66,10 +66,10 @@
       "required": false,
       "min": 0,
       "max": 256,
-      "default": "{{ awx_corporal_http_api_auth_token }}",
+      "default": "{{ matrix_corporal_http_api_auth_token }}",
       "choices": "",
       "new_question": true,
-      "variable": "awx_corporal_http_api_auth_token",
+      "variable": "matrix_corporal_http_api_auth_token",
       "type": "password"
     },
     {
@@ -81,7 +81,7 @@
       "default": "{{ awx_corporal_raise_ratelimits }}",
       "choices": "Normal\nRaised",
       "new_question": true,
-      "variable": "matrix_corporal_raise_ratelimits",
+      "variable": "awx_corporal_raise_ratelimits",
       "type": "multiplechoice"
     }
   ]

roles/matrix-awx/tasks/bridge_discord_appservice.yml

@@ -0,0 +1,57 @@
+
+- name: Record Bridge Discord AppService variables locally on AWX
+  delegate_to: 127.0.0.1
+  lineinfile:
+    path: '{{ awx_cached_matrix_vars }}'
+    regexp: "^#? *{{ item.key | regex_escape() }}:"
+    line: "{{ item.key }}: {{ item.value }}"
+    insertafter: '# Bridge Discord AppService Start'
+  with_dict:
+    'matrix_appservice_discord_enabled': '{{ matrix_appservice_discord_enabled }}'
+    'matrix_appservice_discord_client_id': '{{ matrix_appservice_discord_client_id }}'
+    'matrix_appservice_discord_bot_token': '{{ matrix_appservice_discord_bot_token }}'
+
+- name: If the raw inputs is not empty start constructing parsed awx_appservice_discord_admin_rooms list
+  set_fact:
+    awx_appservice_discord_admin_rooms_array: |-
+      {{ awx_appservice_discord_admin_rooms.splitlines() | to_json }}
+  when: awx_appservice_discord_admin_rooms | trim | length > 0
+
+- name: Promote user to administer (PL100) of each room
+  command: |
+    docker exec -i matrix-appservice-discord /bin/sh -c 'cp /cfg/registration.yaml /tmp/discord-registration.yaml && cd /tmp && node /build/tools/adminme.js -c /cfg/config.yaml -m "{{ item.1 }}" -u "@{{ awx_appservice_discord_admin_user }}:{{ matrix_domain }}" -p 100'
+  with_indexed_items:
+    - "{{ awx_appservice_discord_admin_rooms_array }}"
+  when: ( awx_appservice_discord_admin_rooms | trim | length > 0 ) and ( awx_appservice_discord_admin_user is defined )
+
+- name: Save new 'Bridge Discord Appservice' survey.json to the AWX tower, template
+  delegate_to: 127.0.0.1
+  template:
+    src: 'roles/matrix-awx/surveys/bridge_discord_appservice.json.j2'
+    dest: '/var/lib/awx/projects/clients/{{ member_id }}/{{ subscription_id }}//bridge_discord_appservice.json'
+
+- name: Copy new 'Bridge Discord Appservice' survey.json to target machine
+  copy:
+    src: '/var/lib/awx/projects/clients/{{ member_id }}/{{ subscription_id }}/bridge_discord_appservice.json'
+    dest:  '/matrix/awx/bridge_discord_appservice.json'
+    mode: '0660'
+
+- name: Recreate 'Bridge Discord Appservice' job template
+  delegate_to: 127.0.0.1
+  awx.awx.tower_job_template:
+    name: "{{ matrix_domain }} - 3 - Bridge Discord AppService"
+    description: "Enables a private bridge you can use to connect Matrix rooms to Discord."
+    extra_vars: "{{ lookup('file', '/var/lib/awx/projects/clients/{{ member_id }}/{{ subscription_id }}/extra_vars.json') }}"
+    job_type: run
+    job_tags: "start,setup-all,bridge-discord-appservice"
+    inventory: "{{ member_id }}"
+    project: "{{ member_id }} - Matrix Docker Ansible Deploy"
+    playbook: setup.yml
+    credential: "{{ member_id }} - AWX SSH Key"
+    survey_enabled: true
+    survey_spec: "{{ lookup('file', '/var/lib/awx/projects/clients/{{ member_id }}/{{ subscription_id }}/bridge_discord_appservice.json') }}"
+    state: present
+    verbosity: 1
+    tower_host: "https://{{ awx_host }}"
+    tower_oauthtoken: "{{ awx_session_token.ansible_facts.tower_token.token }}"
+    validate_certs: yes

roles/matrix-awx/tasks/main.yml

@@ -8,9 +8,9 @@
   tags:
     - always
 
-# Renames the variables if needed
+# Renames or updates the vars.yml if needed
 - include_tasks: 
-    file: "rename_variables.yml"
+    file: "update_variables.yml"
     apply:
       tags: always
   when: run_setup|bool and matrix_awx_enabled|bool
@@ -197,6 +197,15 @@
   tags:
     - setup-synapse-admin
 
+# Additional playbook to set the variable file during Discord Appservice Bridge configuration
+- include_tasks: 
+    file: "bridge_discord_appservice.yml"
+    apply:
+      tags: bridge-discord-appservice
+  when: run_setup|bool and matrix_awx_enabled|bool
+  tags:
+    - bridge-discord-appservice
+
 # Delete AWX session token
 - include_tasks: 
     file: "delete_session_token.yml"

roles/matrix-awx/tasks/purge_database_build_list.yml

@@ -1,11 +0,0 @@
----
-
-- name: Collect entire room list into stdout
-  shell: |
-    curl -X GET --header "Authorization: Bearer {{ janitors_token.stdout[1:-1] }}" '{{ synapse_container_ip.stdout }}:8008/_synapse/admin/v1/rooms?from={{ item }}'
-  register: awx_rooms_output
-  
-- name: Print stdout to file
-  delegate_to: 127.0.0.1
-  shell: |
-    echo '{{ awx_rooms_output.stdout }}' >> /tmp/{{ subscription_id }}_room_list_complete.json

roles/matrix-awx/tasks/purge_database_events.yml

@@ -2,11 +2,11 @@
 
 - name: Purge all rooms with more then N events
   shell: |
-    curl --header "Authorization: Bearer {{ awx_janitors_token.stdout[1:-1] }}" -X POST -H "Content-Type: application/json" -d '{ "delete_local_events": false, "purge_up_to_ts": {{ awx_purge_epoche_time.stdout }}000 }' "{{ awx_synapse_container_ip.stdout }}:8008/_synapse/admin/v1/purge_history/{{ item[1:-1] }}"
+    curl --header "Authorization: Bearer {{ awx_janitors_token.stdout[1:-1] }}" -X POST -H "Content-Type: application/json" -d '{ "delete_local_events": false, "purge_up_to_ts": {{ awx_purge_epoche_time.stdout }}000 }' "{{ awx_synapse_container_ip.stdout }}:{{ matrix_synapse_container_client_api_port }}/_synapse/admin/v1/purge_history/{{ item[1:-1] }}"
   register: awx_purge_command
 
 - name: Print output of purge command
-  debug: 
+  debug:
     msg: "{{ awx_purge_command.stdout }}"
 
 - name: Pause for 5 seconds to let Synapse breathe

roles/matrix-awx/tasks/purge_database_main.yml

@@ -29,9 +29,9 @@
   when: (awx_purge_mode.find("No local users [recommended]") != -1) or (awx_purge_mode.find("Number of users [slower]") != -1) or (awx_purge_mode.find("Number of events [slower]") != -1)
   register: awx_synapse_container_ip
 
-- name: Collect access token for janitor user
+- name: Collect access token for @admin-janitor user
   shell: |
-    curl -X POST -d '{"type":"m.login.password", "user":"janitor", "password":"{{ awx_janitor_user_password }}"}' "{{ awx_synapse_container_ip.stdout }}:8008/_matrix/client/r0/login" | jq '.access_token'
+    curl -X POST -d '{"type":"m.login.password", "user":"admin-janitor", "password":"{{ awx_janitor_user_password }}"}' "{{ awx_synapse_container_ip.stdout }}:{{ matrix_synapse_container_client_api_port }}/_matrix/client/r0/login" | jq '.access_token'
   when: (awx_purge_mode.find("No local users [recommended]") != -1) or (awx_purge_mode.find("Number of users [slower]") != -1) or (awx_purge_mode.find("Number of events [slower]") != -1)
   register: awx_janitors_token
   no_log: True
@@ -47,7 +47,7 @@
 
 - name: Run build_room_list.py script
   shell: |
-    runuser -u matrix -- python3 /usr/local/bin/matrix_build_room_list.py {{ awx_janitors_token.stdout[1:-1] }} {{ awx_synapse_container_ip.stdout }}
+    runuser -u matrix -- python3 /usr/local/bin/matrix_build_room_list.py {{ awx_janitors_token.stdout[1:-1] }} {{ awx_synapse_container_ip.stdout }} {{ matrix_synapse_container_client_api_port.stdout }}
   register: awx_rooms_total
   when: (awx_purge_mode.find("No local users [recommended]") != -1) or (awx_purge_mode.find("Number of users [slower]") != -1) or (awx_purge_mode.find("Number of events [slower]") != -1)
 
@@ -69,7 +69,7 @@
   shell: |
     jq 'try .rooms[] | select(.joined_local_members == 0) | .room_id' < /tmp/{{ subscription_id }}_room_list_complete.json > /tmp/{{ subscription_id }}_room_list_no_local_users.txt
   when: (awx_purge_mode.find("No local users [recommended]") != -1) or (awx_purge_mode.find("Number of users [slower]") != -1) or (awx_purge_mode.find("Number of events [slower]") != -1)
-  
+
 - name: Count number of rooms with no local users
   delegate_to: 127.0.0.1
   shell: |
@@ -84,7 +84,7 @@
   when: (awx_purge_mode.find("No local users [recommended]") != -1) or (awx_purge_mode.find("Number of users [slower]") != -1) or (awx_purge_mode.find("Number of events [slower]") != -1)
 
 - name: Purge all rooms with no local users
-  include_tasks: awx_purge_database_no_local.yml 
+  include_tasks: purge_database_no_local.yml
   loop: "{{ awx_room_list_no_local_users.splitlines() | flatten(levels=1) }}"
   when: (awx_purge_mode.find("No local users [recommended]") != -1) or (awx_purge_mode.find("Number of users [slower]") != -1) or (awx_purge_mode.find("Number of events [slower]") != -1)
 
@@ -116,7 +116,7 @@
   no_log: True
 
 - name: Purge all rooms with more then N users
-  include_tasks: awx_purge_database_users.yml 
+  include_tasks: purge_database_users.yml
   loop: "{{ awx_room_list_joined_members.splitlines() | flatten(levels=1) }}"
   when: awx_purge_mode.find("Number of users [slower]") != -1
 
@@ -141,7 +141,7 @@
   no_log: True
 
 - name: Purge all rooms with more then N events
-  include_tasks: awx_purge_database_events.yml 
+  include_tasks: purge_database_events.yml
   loop: "{{ awx_room_list_state_events.splitlines() | flatten(levels=1) }}"
   when: awx_purge_mode.find("Number of events [slower]") != -1
 
@@ -171,7 +171,7 @@
     wait: yes
     tower_host: "https://{{ awx_host }}"
     tower_oauthtoken: "{{ awx_session_token.ansible_facts.tower_token.token }}"
-    validate_certs: yes 
+    validate_certs: yes
   when: (awx_purge_mode.find("No local users [recommended]") != -1) or (awx_purge_mode.find("Number of users [slower]") != -1) or (awx_purge_mode.find("Number of events [slower]") != -1) or (awx_purge_mode.find("Skip purging rooms [faster]") != -1)
 
 - name: Revert 'Deploy/Update a Server' job template
@@ -237,7 +237,7 @@
     wait: yes
     tower_host: "https://{{ awx_host }}"
     tower_oauthtoken: "{{ awx_session_token.ansible_facts.tower_token.token }}"
-    validate_certs: yes 
+    validate_certs: yes
   when: (awx_purge_mode.find("Perform final shrink") != -1)
 
 - name: Revert 'Deploy/Update a Server' job template
@@ -272,7 +272,7 @@
   when: (awx_purge_mode.find("Perform final shrink") != -1)
   no_log: True
 
-- name: Print total number of rooms processed 
+- name: Print total number of rooms processed
   debug:
     msg: '{{ awx_rooms_total.stdout }}'
   when: (awx_purge_mode.find("No local users [recommended]") != -1) or (awx_purge_mode.find("Number of users [slower]") != -1) or (awx_purge_mode.find("Number of events [slower]") != -1)

roles/matrix-awx/tasks/purge_database_no_local.yml

@@ -2,11 +2,11 @@
 
 - name: Purge all rooms with no local users
   shell: |
-    curl --header "Authorization: Bearer {{ awx_janitors_token.stdout[1:-1] }}" -X POST -H "Content-Type: application/json" -d '{ "room_id": {{ item }} }' '{{ awx_synapse_container_ip.stdout }}:8008/_synapse/admin/v1/purge_room'
+    curl --header "Authorization: Bearer {{ awx_janitors_token.stdout[1:-1] }}" -X POST -H "Content-Type: application/json" -d '{ "room_id": {{ item }} }' '{{ awx_synapse_container_ip.stdout }}:{{ matrix_synapse_container_client_api_port }}/_synapse/admin/v1/purge_room'
   register: awx_purge_command
-  
+
 - name: Print output of purge command
-  debug: 
+  debug:
     msg: "{{ awx_purge_command.stdout }}"
 
 - name: Pause for 5 seconds to let Synapse breathe

roles/matrix-awx/tasks/purge_database_users.yml

@@ -2,11 +2,11 @@
 
 - name: Purge all rooms with more then N users
   shell: |
-    curl --header "Authorization: Bearer {{ awx_janitors_token.stdout[1:-1] }}" -X POST -H "Content-Type: application/json" -d '{ "delete_local_events": false, "purge_up_to_ts": {{ awx_purge_epoche_time.stdout }}000 }' "{{ awx_synapse_container_ip.stdout }}:8008/_synapse/admin/v1/purge_history/{{ item[1:-1] }}"
+    curl --header "Authorization: Bearer {{ awx_janitors_token.stdout[1:-1] }}" -X POST -H "Content-Type: application/json" -d '{ "delete_local_events": false, "purge_up_to_ts": {{ awx_purge_epoche_time.stdout }}000 }' "{{ awx_synapse_container_ip.stdout }}:{{ matrix_synapse_container_client_api_port }}/_synapse/admin/v1/purge_history/{{ item[1:-1] }}"
   register: awx_purge_command
-  
+
 - name: Print output of purge command
-  debug: 
+  debug:
     msg: "{{ awx_purge_command.stdout }}"
 
 - name: Pause for 5 seconds to let Synapse breathe

roles/matrix-awx/tasks/purge_media_local.yml

@@ -7,11 +7,11 @@
 
 - name: Purge local media to specific date
   shell: |
-    curl -X POST --header "Authorization: Bearer {{ awx_janitors_token.stdout[1:-1] }}" '{{ awx_synapse_container_ip.stdout }}:8008/_synapse/admin/v1/media/matrix.{{ matrix_domain }}/delete?before_ts={{ awx_epoche_time.stdout }}000'
+    curl -X POST --header "Authorization: Bearer {{ awx_janitors_token.stdout[1:-1] }}" '{{ awx_synapse_container_ip.stdout }}:{{ matrix_synapse_container_client_api_port }}/_synapse/admin/v1/media/matrix.{{ matrix_domain }}/delete?before_ts={{ awx_epoche_time.stdout }}000'
   register: awx_purge_command
-  
+
 - name: Print output of purge command
-  debug: 
+  debug:
     msg: "{{ awx_purge_command.stdout }}"
 
 - name: Pause for 5 seconds to let Synapse breathe

roles/matrix-awx/tasks/purge_media_main.yml

@@ -9,7 +9,7 @@
   include_vars:
     file: '/var/lib/awx/projects/clients/{{ member_id }}/{{ subscription_id }}/matrix_vars.yml'
   no_log: True
-  
+
 - name: Ensure curl and jq intalled on target machine
   apt:
     pkg:
@@ -21,21 +21,22 @@
   shell: "/usr/bin/docker inspect --format '{''{range.NetworkSettings.Networks}''}{''{.IPAddress}''}{''{end}''}' matrix-synapse"
   register: awx_synapse_container_ip
 
-- name: Collect access token for janitor user
+- name: Collect access token for @admin-janitor user
   shell: |
-    curl -XPOST -d '{"type":"m.login.password", "user":"janitor", "password":"{{ awx_janitor_user_password }}"}' "{{ awx_synapse_container_ip.stdout }}:8008/_matrix/client/r0/login" | jq '.access_token'
+    curl -XPOST -d '{"type":"m.login.password", "user":"admin-janitor", "password":"{{ awx_janitor_user_password }}"}' "{{ awx_synapse_container_ip.stdout }}:{{ matrix_synapse_container_client_api_port }}/_matrix/client/r0/login" | jq '.access_token'
   register: awx_janitors_token
   no_log: True
 
 - name: Generate list of dates to purge to
   delegate_to: 127.0.0.1
-  shell: "dateseq {{ matrix_purge_from_date }} {{ matrix_purge_to_date }}"
+  shell: "dateseq {{ awx_purge_from_date }} {{ awx_purge_to_date }}"
   register: awx_purge_dates
-    
+
 - name: Calculate initial size of local media repository
   shell: du -sh /matrix/synapse/storage/media-store/local*
   register: awx_local_media_size_before
   when: awx_purge_media_type == "Local Media"
+  async: 600
   ignore_errors: yes
   no_log: True
 
@@ -43,16 +44,17 @@
   shell: du -sh /matrix/synapse/storage/media-store/remote*
   register: awx_remote_media_size_before
   when: awx_purge_media_type == "Remote Media"
+  async: 600 
   ignore_errors: yes
   no_log: True
 
 - name: Purge local media with loop
-  include_tasks: purge_media_local.yml 
+  include_tasks: purge_media_local.yml
   loop: "{{ awx_purge_dates.stdout_lines | flatten(levels=1) }}"
   when: awx_purge_media_type == "Local Media"
 
 - name: Purge remote media with loop
-  include_tasks: purge_media_remote.yml 
+  include_tasks: purge_media_remote.yml
   loop: "{{ awx_purge_dates.stdout_lines | flatten(levels=1) }}"
   when: awx_purge_media_type == "Remote Media"
 

roles/matrix-awx/tasks/purge_media_remote.yml

@@ -7,11 +7,11 @@
 
 - name: Purge remote media to specific date
   shell: |
-    curl -X POST --header "Authorization: Bearer {{ awx_janitors_token.stdout[1:-1] }}" '{{ awx_synapse_container_ip.stdout }}:8008/_synapse/admin/v1/purge_media_cache?before_ts={{ awx_epoche_time.stdout }}000'
+    curl -X POST --header "Authorization: Bearer {{ awx_janitors_token.stdout[1:-1] }}" '{{ awx_synapse_container_ip.stdout }}:{{ matrix_synapse_container_client_api_port }}/_synapse/admin/v1/purge_media_cache?before_ts={{ awx_epoche_time.stdout }}000'
   register: awx_purge_command
-  
+
 - name: Print output of purge command
-  debug: 
+  debug:
     msg: "{{ awx_purge_command.stdout }}"
 
 - name: Pause for 5 seconds to let Synapse breathe

roles/matrix-awx/tasks/rename_variables.yml

@@ -1,8 +0,0 @@
----
-
-- name: Rename synapse presence variable
-  delegate_to: 127.0.0.1
-  replace:
-    path: "/var/lib/awx/projects/clients/{{ member_id }}/{{ subscription_id }}/matrix_vars.yml"
-    regexp: 'matrix_synapse_use_presence'
-    replace: 'matrix_synapse_presence_enabled'

roles/matrix-awx/tasks/self_check.yml

@@ -50,12 +50,14 @@
 - name: Calculate size of local media repository
   shell: du -sh /matrix/synapse/storage/media-store/local*
   register: awx_local_media_size_stat
+  async: 600
   ignore_errors: yes
   no_log: True
 
 - name: Calculate size of remote media repository
   shell: du -sh /matrix/synapse/storage/media-store/remote*
   register: awx_remote_media_size_stat
+  async: 600
   ignore_errors: yes
   no_log: True
 

roles/matrix-awx/tasks/set_variables_corporal.yml

@@ -84,14 +84,16 @@
     line: "{{ item.key }}: {{ item.value }}"
     insertafter: '# Corporal Settings Start'
   with_dict:
-    'awx_corporal_http_api_auth_token': '{{ awx_corporal_http_api_auth_token }}'
-  when: awx_corporal_http_api_auth_token|length > 0
+    'matrix_corporal_http_api_auth_token': '{{ matrix_corporal_http_api_auth_token }}'
+  when: ( matrix_corporal_http_api_auth_token|length > 0 ) and ( awx_corporal_policy_provider_mode != "Simple Static File" )
 
 - name: Record 'Simple Static File' configuration variables in matrix_vars.yml
   delegate_to: 127.0.0.1
   blockinfile:
     path: '{{ awx_cached_matrix_vars }}'
-    insertafter: "# Corporal Policy Provider Settings Start"
+    insertbefore: "# Corporal Policy Provider Settings End"
+    marker_begin: "Corporal"
+    marker_end: "Corporal"
     block: |
       matrix_corporal_policy_provider_config: |
         {

roles/matrix-awx/tasks/set_variables_dimension.yml

@@ -12,9 +12,9 @@
       - curl
     state: present
 
-- name: Collect access token of Dimension user
+- name: Collect access token of @admin-dimension user
   shell: |
-    curl -X POST --header 'Content-Type: application/json' -d '{ "identifier": { "type": "m.id.user","user": "dimension" }, "password": "{{ awx_dimension_user_password }}", "type": "m.login.password"}' 'https://matrix.{{ matrix_domain }}/_matrix/client/r0/login' | jq -c '. | {access_token}' | sed 's/.*\":\"//' | sed 's/\"}//'
+    curl -X POST --header 'Content-Type: application/json' -d '{ "identifier": { "type": "m.id.user","user": "admin-dimension" }, "password": "{{ awx_dimension_user_password }}", "type": "m.login.password"}' 'https://matrix.{{ matrix_domain }}/_matrix/client/r0/login' | jq -c '. | {access_token}' | sed 's/.*\":\"//' | sed 's/\"}//'
   register: awx_dimension_user_access_token
 
 - name: Record Synapse variables locally on AWX

roles/matrix-awx/tasks/set_variables_ma1sd.yml

@@ -30,7 +30,7 @@
     insertafter: '# Synapse Extension Start'
   with_dict:
     'matrix_synapse_awx_password_provider_rest_auth_enabled': 'true'
-    'matrix_synapse_awx_password_provider_rest_auth_endpoint': '"http://matrix-ma1sd:8090"'
+    'matrix_synapse_awx_password_provider_rest_auth_endpoint': '"http://matrix-ma1sd:{{ matrix_ma1sd_container_port }}"'
   when: awx_matrix_ma1sd_auth_store == 'LDAP/AD'
 
 - name: Remove entire ma1sd configuration extension

roles/matrix-awx/tasks/set_variables_synapse.yml

@@ -38,7 +38,7 @@
   set_fact:
     awx_synapse_auto_join_rooms_array: |-
       {{ awx_synapse_auto_join_rooms.splitlines() | to_json }}
-  when: awx_synapse_auto_join_rooms|length > 0
+  when: awx_synapse_auto_join_rooms | length > 0
 
 - name: Record Synapse variable 'matrix_synapse_auto_join_rooms' locally on AWX, if it's not blank
   delegate_to: 127.0.0.1
@@ -49,7 +49,7 @@
     insertafter: '# Synapse Settings Start'
   with_dict:
     "matrix_synapse_auto_join_rooms": "{{ awx_synapse_auto_join_rooms_array }}"
-  when: awx_synapse_auto_join_rooms|length > 0
+  when: awx_synapse_auto_join_rooms | length > 0
 
 - name: Record Synapse Shared Secret if it's defined
   delegate_to: 127.0.0.1

roles/matrix-awx/tasks/update_variables.yml

@@ -0,0 +1,26 @@
+---
+
+- name: Rename synapse presence variable
+  delegate_to: 127.0.0.1
+  replace:
+    path: "/var/lib/awx/projects/clients/{{ member_id }}/{{ subscription_id }}/matrix_vars.yml"
+    regexp: 'matrix_synapse_use_presence'
+    replace: 'matrix_synapse_presence_enabled'
+
+- name: Generate matrix_homeserver_generic_secret_key variable
+  delegate_to: 127.0.0.1
+  command: |
+      openssl rand -hex 16
+  register: generic_secret
+  no_log: True
+  when: ( matrix_homeserver_generic_secret_key is undefined ) or ( matrix_homeserver_generic_secret_key | length == 0 )
+
+- name: Add new matrix_homeserver_generic_secret_key variable
+  delegate_to: 127.0.0.1
+  lineinfile:
+    path: '/var/lib/awx/projects/clients/{{ member_id }}/{{ subscription_id }}/matrix_vars.yml'
+    line: "matrix_homeserver_generic_secret_key: {{ generic_secret.stdout }}"
+    insertbefore: '# Basic Settings End'
+    mode: '0600'
+    state: present    
+  when: ( matrix_homeserver_generic_secret_key is undefined ) or ( matrix_homeserver_generic_secret_key | length == 0 )

roles/matrix-base/defaults/main.yml

@@ -7,6 +7,18 @@
 # Example value: example.com
 matrix_domain: ~
 
+# This will contain the homeserver implementation that is in use.
+# Valid values: synapse, dendrite
+#
+# By default, we use Synapse, because it's the only full-featured Matrix server at the moment.
+#
+# This value automatically influences other variables (`matrix_synapse_enabled`, `matrix_dendrite_enabled`, etc.).
+# The homeserver implementation of an existing server cannot be changed without data loss.
+matrix_homeserver_implementation: synapse
+
+# This contains a secret, which is used for generating various other secrets later on.
+matrix_homeserver_generic_secret_key: ''
+
 # This is where your data lives and what we set up.
 # This and the Element FQN (see below) are expected to be on the same server.
 matrix_server_fqn_matrix: "matrix.{{ matrix_domain }}"
@@ -21,6 +33,9 @@ matrix_server_fqn_element: "element.{{ matrix_domain }}"
 # This is where you access the Hydrogen web client from (if enabled via matrix_client_hydrogen_enabled; disabled by default).
 matrix_server_fqn_hydrogen: "hydrogen.{{ matrix_domain }}"
 
+# This is where you access the Cinny web client from (if enabled via matrix_client_cinny_enabled; disabled by default).
+matrix_server_fqn_cinny: "cinny.{{ matrix_domain }}"
+
 # This is where you access the Dimension.
 matrix_server_fqn_dimension: "dimension.{{ matrix_domain }}"
 
@@ -83,15 +98,20 @@ matrix_host_command_openssl: "/usr/bin/env openssl"
 matrix_host_command_systemctl: "/usr/bin/env systemctl"
 matrix_host_command_sh: "/usr/bin/env sh"
 
-matrix_ntpd_package: "{{ 'systemd-timesyncd' if (ansible_distribution == 'CentOS' and ansible_distribution_major_version > '7') or (ansible_distribution == 'Ubuntu' and ansible_distribution_major_version > '18') else 'ntp' }}"
-matrix_ntpd_service: "{{ 'systemd-timesyncd' if (ansible_distribution == 'CentOS' and ansible_distribution_major_version > '7') or (ansible_distribution == 'Ubuntu' and ansible_distribution_major_version > '18') or ansible_distribution == 'Archlinux' else ('ntpd' if ansible_os_family == 'RedHat' else 'ntp') }}"
+matrix_ntpd_package: "{{ 'systemd-timesyncd' if (ansible_distribution == 'CentOS' and ansible_distribution_major_version > '7') or (ansible_distribution == 'Ubuntu' and ansible_distribution_major_version > '18')  else ( 'systemd' if ansible_os_family == 'Suse' else 'ntp' ) }}"
+matrix_ntpd_service: "{{ 'systemd-timesyncd' if (ansible_distribution == 'CentOS' and ansible_distribution_major_version > '7') or (ansible_distribution == 'Ubuntu' and ansible_distribution_major_version > '18') or ansible_distribution == 'Archlinux' or ansible_os_family == 'Suse' else ('ntpd' if ansible_os_family == 'RedHat' else 'ntp') }}"
 
 matrix_homeserver_url: "https://{{ matrix_server_fqn_matrix }}"
 
-# Specifies where the homeserver is on the container network.
-# Where this is depends on whether there's a reverse-proxy in front of it, etc.
+# Specifies where the homeserver's Client-Server API is on the container network.
+# Where this is depends on whether there's a reverse-proxy in front of the homeserver, which homeserver it is, etc.
+# This likely gets overriden elsewhere.
+matrix_homeserver_container_url: ""
+
+# Specifies where the homeserver's Federation API is on the container network.
+# Where this is depends on whether there's a reverse-proxy in front of the homeserver, which homeserver it is, etc.
 # This likely gets overriden elsewhere.
-matrix_homeserver_container_url: "http://matrix-synapse:8008"
+matrix_homeserver_container_federation_url: ""
 
 matrix_identity_server_url: ~
 
@@ -118,6 +138,72 @@ matrix_client_element_e2ee_secure_backup_required: false
 # See: https://github.com/vector-im/element-web/blob/develop/docs/e2ee.md
 matrix_client_element_e2ee_secure_backup_setup_methods: []
 
+# Default `/.well-known/matrix/client` configuration - it covers the generic use case.
+# You can customize it by controlling the various variables inside the template file that it references.
+#
+# For a more advanced customization, you can extend the default (see `matrix_well_known_matrix_client_configuration_extension_json`)
+# or completely replace this variable with your own template.
+#
+# The side-effect of this lookup is that Ansible would even parse the JSON for us, returning a dict.
+# This is unlike what it does when looking up YAML template files (no automatic parsing there).
+matrix_well_known_matrix_client_configuration_default: "{{ lookup('template', 'templates/static-files/well-known/matrix-client.j2') }}"
+
+# Your custom JSON configuration for `/.well-known/matrix/client` should go to `matrix_well_known_matrix_client_configuration_extension_json`.
+# This configuration extends the default starting configuration (`matrix_well_known_matrix_client_configuration_default`).
+#
+# You can override individual variables from the default configuration, or introduce new ones.
+#
+# If you need something more special, you can take full control by
+# completely redefining `matrix_well_known_matrix_client_configuration`.
+#
+# Example configuration extension follows:
+#
+# matrix_well_known_matrix_client_configuration_extension_json: |
+#   {
+#     "io.element.call_behaviour": {
+#       "widget_build_url": "https://dimension.example.com/api/v1/dimension/bigbluebutton/widget_state"
+#     }
+#   }
+matrix_well_known_matrix_client_configuration_extension_json: '{}'
+
+matrix_well_known_matrix_client_configuration_extension: "{{ matrix_well_known_matrix_client_configuration_extension_json|from_json if matrix_well_known_matrix_client_configuration_extension_json|from_json is mapping else {} }}"
+
+# Holds the final `/.well-known/matrix/client` configuration (a combination of the default and its extension).
+# You most likely don't need to touch this variable. Instead, see `matrix_well_known_matrix_client_configuration_default` and `matrix_well_known_matrix_client_configuration_extension_json`.
+matrix_well_known_matrix_client_configuration: "{{ matrix_well_known_matrix_client_configuration_default|combine(matrix_well_known_matrix_client_configuration_extension, recursive=True) }}"
+
+# Default `/.well-known/matrix/server` configuration - it covers the generic use case.
+# You can customize it by controlling the various variables inside the template file that it references.
+#
+# For a more advanced customization, you can extend the default (see `matrix_well_known_matrix_server_configuration_extension_json`)
+# or completely replace this variable with your own template.
+#
+# The side-effect of this lookup is that Ansible would even parse the JSON for us, returning a dict.
+# This is unlike what it does when looking up YAML template files (no automatic parsing there).
+matrix_well_known_matrix_server_configuration_default: "{{ lookup('template', 'templates/static-files/well-known/matrix-server.j2') }}"
+
+# Your custom JSON configuration for `/.well-known/matrix/server` should go to `matrix_well_known_matrix_server_configuration_extension_json`.
+# This configuration extends the default starting configuration (`matrix_well_known_matrix_server_configuration_default`).
+#
+# You can override individual variables from the default configuration, or introduce new ones.
+#
+# If you need something more special, you can take full control by
+# completely redefining `matrix_well_known_matrix_server_configuration`.
+#
+# Example configuration extension follows:
+#
+# matrix_well_known_matrix_server_configuration_extension_json: |
+#   {
+#     "something": "another"
+#   }
+matrix_well_known_matrix_server_configuration_extension_json: '{}'
+
+matrix_well_known_matrix_server_configuration_extension: "{{ matrix_well_known_matrix_server_configuration_extension_json|from_json if matrix_well_known_matrix_server_configuration_extension_json|from_json is mapping else {} }}"
+
+# Holds the final `/.well-known/matrix/server` configuration (a combination of the default and its extension).
+# You most likely don't need to touch this variable. Instead, see `matrix_well_known_matrix_server_configuration_default` and `matrix_well_known_matrix_server_configuration_extension_json`.
+matrix_well_known_matrix_server_configuration: "{{ matrix_well_known_matrix_server_configuration_default|combine(matrix_well_known_matrix_server_configuration_extension, recursive=True) }}"
+
 # The Docker network that all services would be put into
 matrix_docker_network: "matrix"
 
@@ -152,6 +238,7 @@ run_synapse_register_user: true
 run_synapse_update_user_password: true
 run_synapse_import_media_store: true
 run_synapse_rust_synapse_compress_state: true
+run_dendrite_register_user: true
 run_setup: true
 run_self_check: true
 run_start: true

roles/matrix-base/tasks/main.yml

@@ -31,4 +31,5 @@
     - setup-all
     - setup-ma1sd
     - setup-synapse
+    - setup-dendrite
     - setup-nginx-proxy

roles/matrix-base/tasks/sanity_check.yml

@@ -1,5 +1,10 @@
 ---
 
+- name: Fail if invalid homeserver implementation
+  fail:
+    msg: "You need to set a valid homeserver implementation in `matrix_homeserver_implementation`"
+  when: "matrix_homeserver_implementation not in ['synapse', 'dendrite']"
+
 # We generally support Ansible 2.7.1 and above.
 - name: Fail if running on Ansible < 2.7.1
   fail:
@@ -28,14 +33,29 @@
     - {'old': 'hostname_riot', 'new': 'matrix_server_fqn_element'}
     - {'old': 'matrix_server_fqn_riot', 'new': 'matrix_server_fqn_element'}
 
+# We have a dedicated check for this variable, because we'd like to have a custom (friendlier) message.
+- name: Fail if matrix_homeserver_generic_secret_key is undefined
+  fail:
+    msg: |
+      The `matrix_homeserver_generic_secret_key` variable must be defined and have a non-null and non-empty value.
+
+      If you're observing this error on a new installation, you should ensure that the `matrix_homeserver_generic_secret_key` is defined.
+
+      If you're observing this error on an existing homeserver installation, you can fix it easily and in a backward-compatible way by adding
+      `{% raw %}matrix_homeserver_generic_secret_key: "{{ matrix_synapse_macaroon_secret_key }}"{% endraw %}`
+      to your `vars.yml` file. Using another secret value for the new variable is also possible and shouldn't cause any trouble.
+  when: "matrix_homeserver_generic_secret_key is none or matrix_homeserver_generic_secret_key == ''"
+
 - name: Fail if required variables are undefined
   fail:
-    msg: "The `{{ item }}` variable must be defined and have a non-null value"
+    msg: "The `{{ item.var }}` variable must be defined and have a non-null and non-empty value"
   with_items:
-    - matrix_domain
-    - matrix_server_fqn_matrix
-    - matrix_server_fqn_element
-  when: "item not in vars or vars[item] is none"
+    - {'var': matrix_domain, 'value': "{{ matrix_domain|default('') }}"}
+    - {'var': matrix_server_fqn_matrix, 'value': "{{ matrix_server_fqn_matrix|default('') }}"}
+    - {'var': matrix_server_fqn_element, 'value': "{{ matrix_server_fqn_element|default('') }}"}
+    - {'var': matrix_homeserver_container_url, 'value': "{{ matrix_homeserver_container_url|default('') }}"}
+    - {'var': matrix_homeserver_container_federation_url, 'value': "{{ matrix_homeserver_container_federation_url|default('') }}"}
+  when: "item.value is none or item.value == ''"
 
 - name: Fail if uppercase domain used
   fail:

roles/matrix-base/tasks/server_base/setup_archlinux.yml

@@ -4,8 +4,6 @@
   pacman:
     name:
       - python-docker
-      # TODO This needs to be verified. Which version do we need?
-      - fuse3
       - python-dnspython
     state: latest
     update_cache: yes

roles/matrix-base/tasks/server_base/setup_centos.yml

@@ -21,7 +21,6 @@
   yum:
     name:
       - "{{ matrix_ntpd_package }}"
-      - fuse
     state: latest
     update_cache: yes
 

roles/matrix-base/tasks/server_base/setup_centos8.yml

@@ -28,7 +28,6 @@
   yum:
     name:
       - "{{ matrix_ntpd_package }}"
-      - fuse
     state: latest
     update_cache: yes
 
@@ -44,4 +43,4 @@
   pip:
     name: docker-py
     state: latest
-  when: matrix_docker_installation_enabled|bool
+  when: matrix_docker_installation_enabled|bool

roles/matrix-base/tasks/server_base/setup_debian.yml

@@ -29,7 +29,6 @@
   apt:
     name:
       - "{{ matrix_ntpd_package }}"
-      - fuse
     state: latest
     update_cache: yes
 

roles/matrix-base/tasks/server_base/setup_raspbian.yml

@@ -29,7 +29,6 @@
   apt:
     name:
       - "{{ matrix_ntpd_package }}"
-      - fuse
     state: latest
     update_cache: yes
 

roles/matrix-base/tasks/setup_well_known.yml

@@ -13,16 +13,16 @@
     - "{{ matrix_static_files_base_path }}/.well-known/matrix"
 
 - name: Ensure Matrix /.well-known/matrix/client file configured
-  template:
-    src: "{{ role_path }}/templates/static-files/well-known/matrix-client.j2"
+  copy:
+    content: "{{ matrix_well_known_matrix_client_configuration|to_nice_json }}"
     dest: "{{ matrix_static_files_base_path }}/.well-known/matrix/client"
     mode: 0644
     owner: "{{ matrix_user_username }}"
     group: "{{ matrix_user_groupname }}"
 
 - name: Ensure Matrix /.well-known/matrix/server file configured
-  template:
-    src: "{{ role_path }}/templates/static-files/well-known/matrix-server.j2"
+  copy:
+    content: "{{ matrix_well_known_matrix_server_configuration|to_nice_json }}"
     dest: "{{ matrix_static_files_base_path }}/.well-known/matrix/server"
     mode: 0644
     owner: "{{ matrix_user_username }}"

roles/matrix-base/tasks/util/ensure_fuse_installed.yml

@@ -0,0 +1,23 @@
+
+# This is for both CentOS 7 and 8
+- name: Ensure fuse installed (CentOS)
+  yum:
+    name:
+      - fuse
+    state: latest
+  when: ansible_distribution == 'CentOS'
+
+# This is for both Debian and Raspbian
+- name: Ensure fuse installed (Debian/Raspbian)
+  apt:
+    name:
+      - fuse
+    state: latest
+  when: ansible_os_family == 'Debian'
+
+- name: Ensure fuse installed (Archlinux)
+  pacman:
+    name:
+      - fuse3
+    state: latest
+  when: ansible_distribution == 'Archlinux'

roles/matrix-base/tasks/util/ensure_openssl_installed.yml

@@ -0,0 +1,23 @@
+
+# This is for both CentOS 7 and 8
+- name: Ensure openssl installed (CentOS)
+  yum:
+    name:
+      - openssl
+    state: latest
+  when: ansible_distribution == 'CentOS'
+
+# This is for both Debian and Raspbian
+- name: Ensure openssl installed (Debian/Raspbian)
+  apt:
+    name:
+      - openssl
+    state: latest
+  when: ansible_os_family == 'Debian'
+
+- name: Ensure openssl installed (Archlinux)
+  pacman:
+    name:
+      - openssl
+    state: latest
+  when: ansible_distribution == 'Archlinux'

roles/matrix-base/vars/main.yml

@@ -1,3 +1,3 @@
 # This will contain a list of enabled services that the playbook is managing.
 # Each component is expected to append its service name to this list.
-matrix_systemd_services_list: []
+matrix_systemd_services_list: []

roles/matrix-bot-go-neb/defaults/main.yml

@@ -203,8 +203,8 @@ matrix_bot_go_neb_services: []
 #      # Each room will get the notification with the alert rendered with the given template
 #      rooms:
 #        "!someroomid:domain.tld":
-#          text_template: "{{range .Alerts -}} [{{ .Status }}] {{index .Labels \"alertname\" }}: {{index .Annotations \"description\"}} {{ end -}}"
-#          html_template: "{{range .Alerts -}}  {{ $severity := index .Labels \"severity\" }}    {{ if eq .Status \"firing\" }}      {{ if eq $severity \"critical\"}}        <font color='red'><b>[FIRING - CRITICAL]</b></font>      {{ else if eq $severity \"warning\"}}        <font color='orange'><b>[FIRING - WARNING]</b></font>      {{ else }}        <b>[FIRING - {{ $severity }}]</b>      {{ end }}    {{ else }}      <font color='green'><b>[RESOLVED]</b></font>    {{ end }}  {{ index .Labels \"alertname\"}} : {{ index .Annotations \"description\"}}   <a href=\"{{ .GeneratorURL }}\">source</a><br/>{{end -}}"
+#          text_template: "{% raw %}{{range .Alerts -}} [{{ .Status }}] {{index .Labels \"alertname\" }}: {{index .Annotations \"description\"}} {{ end -}}{% endraw %}"
+#          html_template: "{% raw %}{{range .Alerts -}}  {{ $severity := index .Labels \"severity\" }}    {{ if eq .Status \"firing\" }}      {{ if eq $severity \"critical\"}}        <font color='red'><b>[FIRING - CRITICAL]</b></font>      {{ else if eq $severity \"warning\"}}        <font color='orange'><b>[FIRING - WARNING]</b></font>      {{ else }}        <b>[FIRING - {{ $severity }}]</b>      {{ end }}    {{ else }}      <font color='green'><b>[RESOLVED]</b></font>    {{ end }}  {{ index .Labels \"alertname\"}} : {{ index .Annotations \"description\"}}   <a href=\"{{ .GeneratorURL }}\">source</a><br/>{{end -}}{% endraw %}"
 #          msg_type: "m.text"  # Must be either `m.text` or `m.notice`
 
 # Default configuration template which covers the generic use case.

roles/matrix-bot-go-neb/tasks/setup_uninstall.yml

@@ -9,6 +9,7 @@
   service:
     name: matrix-bot-go-neb
     state: stopped
+    enabled: no
     daemon_reload: yes
   register: stopping_result
   when: "matrix_bot_go_neb_service_stat.stat.exists|bool"

roles/matrix-bot-go-neb/templates/systemd/matrix-bot-go-neb.service.j2

@@ -39,8 +39,8 @@ ExecStart={{ matrix_host_command_docker }} run --rm --name matrix-bot-go-neb \
 			{{ matrix_bot_go_neb_docker_image }} \
 			-c "go-neb /config/config.yaml"
 
-ExecStop=-{{ matrix_host_command_sh }} -c '{{ matrix_host_command_docker }} kill matrix-bot-go-neb 2>/dev/null'
-ExecStop=-{{ matrix_host_command_sh }} -c '{{ matrix_host_command_docker }} rm matrix-bot-go-neb 2>/dev/null'
+ExecStopPost=-{{ matrix_host_command_sh }} -c '{{ matrix_host_command_docker }} kill matrix-bot-go-neb 2>/dev/null'
+ExecStopPost=-{{ matrix_host_command_sh }} -c '{{ matrix_host_command_docker }} rm matrix-bot-go-neb 2>/dev/null'
 Restart=always
 RestartSec=30
 SyslogIdentifier=matrix-bot-go-neb

roles/matrix-bot-honoroit/defaults/main.yml

@@ -0,0 +1,109 @@
+# honoroit is a helpdesk bot
+# See: https://gitlab.com/etke.cc/honoroit
+
+matrix_bot_honoroit_enabled: true
+
+matrix_bot_honoroit_container_image_self_build: false
+matrix_bot_honoroit_docker_repo: "https://gitlab.com/etke.cc/honoroit.git"
+matrix_bot_honoroit_docker_src_files_path: "{{ matrix_base_data_path }}/honoroit/docker-src"
+
+matrix_bot_honoroit_version: v0.9.3
+matrix_bot_honoroit_docker_image: "{{ matrix_bot_honoroit_docker_image_name_prefix }}honoroit:{{ matrix_bot_honoroit_version }}"
+matrix_bot_honoroit_docker_image_name_prefix: "{{ 'localhost/' if matrix_bot_honoroit_container_image_self_build else 'registry.gitlab.com/etke.cc/' }}"
+matrix_bot_honoroit_docker_image_force_pull: "{{ matrix_bot_honoroit_docker_image.endswith(':latest') }}"
+
+matrix_bot_honoroit_base_path: "{{ matrix_base_data_path }}/honoroit"
+matrix_bot_honoroit_config_path: "{{ matrix_bot_honoroit_base_path }}/config"
+matrix_bot_honoroit_data_path: "{{ matrix_bot_honoroit_base_path }}/data"
+matrix_bot_honoroit_data_store_path: "{{ matrix_bot_honoroit_data_path }}/store"
+
+# A list of extra arguments to pass to the container
+matrix_bot_honoroit_container_extra_arguments: []
+
+# List of systemd services that matrix-bot-honoroit.service depends on
+matrix_bot_honoroit_systemd_required_services_list: ['docker.service']
+
+# List of systemd services that matrix-bot-honoroit.service wants
+matrix_bot_honoroit_systemd_wanted_services_list: []
+
+
+# Database-related configuration fields.
+#
+# To use SQLite, stick to these defaults.
+#
+# To use Postgres:
+# - change the engine (`matrix_bot_honoroit_database_engine: 'postgres'`)
+# - adjust your database credentials via the `matrix_bot_honoroit_database_*` variables
+matrix_bot_honoroit_database_engine: 'sqlite'
+
+matrix_bot_honoroit_sqlite_database_path_local: "{{ matrix_bot_honoroit_data_path }}/bot.db"
+matrix_bot_honoroit_sqlite_database_path_in_container: "/data/bot.db"
+
+matrix_bot_honoroit_database_username: 'honoroit'
+matrix_bot_honoroit_database_password: 'some-password'
+matrix_bot_honoroit_database_hostname: 'matrix-postgres'
+matrix_bot_honoroit_database_port: 5432
+matrix_bot_honoroit_database_name: 'honoroit'
+
+matrix_bot_honoroit_database_connection_string: 'postgres://{{ matrix_bot_honoroit_database_username }}:{{ matrix_bot_honoroit_database_password }}@{{ matrix_bot_honoroit_database_hostname }}:{{ matrix_bot_honoroit_database_port }}/{{ matrix_bot_honoroit_database_name }}?sslmode=disable'
+
+matrix_bot_honoroit_storage_database: "{{
+	{
+		'sqlite': matrix_bot_honoroit_sqlite_database_path_in_container,
+		'postgres': matrix_bot_honoroit_database_connection_string,
+	}[matrix_bot_honoroit_database_engine]
+}}"
+
+matrix_bot_honoroit_database_dialect: "{{
+  {
+    'sqlite': 'sqlite3',
+    'postgres': 'postgres',
+  }[matrix_bot_honoroit_database_engine]
+}}"
+
+
+# The bot's username. This user needs to be created manually beforehand.
+# Also see `matrix_bot_honoroit_password`.
+matrix_bot_honoroit_login: "honoroit"
+
+# The password that the bot uses to authenticate.
+matrix_bot_honoroit_password: ''
+
+matrix_bot_honoroit_homeserver: "{{ matrix_homeserver_container_url }}"
+
+# The room ID where bot will create threads
+matrix_bot_honoroit_roomid: ''
+
+# Command prefix
+matrix_bot_honoroit_prefix: ''
+
+# Sentry DSN
+matrix_bot_honoroit_sentry: ''
+
+# Log level
+matrix_bot_honoroit_loglevel: ''
+
+# Text prefix: open
+matrix_bot_honoroit_text_prefix_open: ''
+
+# Text prefix: done
+matrix_bot_honoroit_text_prefix_done: ''
+
+# Text: greetings
+matrix_bot_honoroit_text_greetings: ''
+
+# Text: error
+matrix_bot_honoroit_text_error: ''
+
+# Text: empty room
+matrix_bot_honoroit_text_emptyroom: ''
+
+# Text: done
+matrix_bot_honoroit_text_done: ''
+
+# Additional environment variables to pass to the Honoroit container
+#
+# Example:
+# matrix_bot_honoroit_environment_variables_extension: |
+#   HONOROIT_TEXT_DONE=Done
+matrix_bot_honoroit_environment_variables_extension: ''

roles/matrix-bot-honoroit/tasks/init.yml

@@ -0,0 +1,3 @@
+- set_fact:
+    matrix_systemd_services_list: "{{ matrix_systemd_services_list + ['matrix-bot-honoroit.service'] }}"
+  when: matrix_bot_honoroit_enabled|bool

roles/matrix-bot-honoroit/tasks/main.yml

@@ -0,0 +1,21 @@
+- import_tasks: "{{ role_path }}/tasks/init.yml"
+  tags:
+    - always
+
+- import_tasks: "{{ role_path }}/tasks/validate_config.yml"
+  when: "run_setup|bool and matrix_bot_honoroit_enabled|bool"
+  tags:
+    - setup-all
+    - setup-bot-honoroit
+
+- import_tasks: "{{ role_path }}/tasks/setup_install.yml"
+  when: "run_setup|bool and matrix_bot_honoroit_enabled|bool"
+  tags:
+    - setup-all
+    - setup-bot-honoroit
+
+- import_tasks: "{{ role_path }}/tasks/setup_uninstall.yml"
+  when: "run_setup|bool and not matrix_bot_honoroit_enabled|bool"
+  tags:
+    - setup-all
+    - setup-bot-honoroit

roles/matrix-bot-honoroit/tasks/setup_install.yml

@@ -0,0 +1,92 @@
+---
+- set_fact:
+    matrix_bot_honoroit_requires_restart: false
+
+- block:
+    - name: Check if an SQLite database already exists
+      stat:
+        path: "{{ matrix_bot_honoroit_sqlite_database_path_local }}"
+      register: matrix_bot_honoroit_sqlite_database_path_local_stat_result
+
+    - block:
+        - set_fact:
+            matrix_postgres_db_migration_request:
+              src: "{{ matrix_bot_honoroit_sqlite_database_path_local }}"
+              dst: "{{ matrix_bot_honoroit_database_connection_string }}"
+              caller: "{{ role_path|basename }}"
+              engine_variable_name: 'matrix_bot_honoroit_database_engine'
+              engine_old: 'sqlite'
+              systemd_services_to_stop: ['matrix-bot-honoroit.service']
+
+        - import_tasks: "{{ role_path }}/../matrix-postgres/tasks/util/migrate_db_to_postgres.yml"
+
+        - set_fact:
+            matrix_bot_honoroit_requires_restart: true
+      when: "matrix_bot_honoroit_sqlite_database_path_local_stat_result.stat.exists|bool"
+  when: "matrix_bot_honoroit_database_engine == 'postgres'"
+
+- name: Ensure honoroit paths exist
+  file:
+    path: "{{ item.path }}"
+    state: directory
+    mode: 0750
+    owner: "{{ matrix_user_username }}"
+    group: "{{ matrix_user_groupname }}"
+  with_items:
+    - { path: "{{ matrix_bot_honoroit_config_path }}", when: true }
+    - { path: "{{ matrix_bot_honoroit_data_path }}", when: true }
+    - { path: "{{ matrix_bot_honoroit_data_store_path }}", when: true }
+    - { path: "{{ matrix_bot_honoroit_docker_src_files_path }}", when: true}
+  when: "item.when|bool"
+
+- name: Ensure honoroit environment variables file created
+  template:
+    src: "{{ role_path }}/templates/env.j2"
+    dest: "{{ matrix_bot_honoroit_config_path }}/env"
+    mode: 0640
+
+- name: Ensure honoroit image is pulled
+  docker_image:
+    name: "{{ matrix_bot_honoroit_docker_image }}"
+    source: "{{ 'pull' if ansible_version.major > 2 or ansible_version.minor > 7 else omit }}"
+    force_source: "{{ matrix_bot_honoroit_docker_image_force_pull if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}"
+    force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else matrix_bot_honoroit_docker_image_force_pull }}"
+  when: "not matrix_bot_honoroit_container_image_self_build|bool"
+
+- name: Ensure honoroit repository is present on self-build
+  git:
+    repo: "{{ matrix_bot_honoroit_docker_repo }}"
+    dest: "{{ matrix_bot_honoroit_docker_src_files_path }}"
+    force: "yes"
+  register: matrix_bot_honoroit_git_pull_results
+  when: "matrix_bot_honoroit_container_image_self_build|bool"
+
+- name: Ensure honoroit image is built
+  docker_image:
+    name: "{{ matrix_bot_honoroit_docker_image }}"
+    source: build
+    force_source: "{{ matrix_bot_honoroit_git_pull_results.changed if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}"
+    force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else matrix_mailer_git_pull_results.changed }}"
+    build:
+      dockerfile: Dockerfile
+      path: "{{ matrix_bot_honoroit_docker_src_files_path }}"
+      pull: yes
+  when: "matrix_bot_honoroit_container_image_self_build|bool"
+
+- name: Ensure matrix-bot-honoroit.service installed
+  template:
+    src: "{{ role_path }}/templates/systemd/matrix-bot-honoroit.service.j2"
+    dest: "{{ matrix_systemd_path }}/matrix-bot-honoroit.service"
+    mode: 0644
+  register: matrix_bot_honoroit_systemd_service_result
+
+- name: Ensure systemd reloaded after matrix-bot-honoroit.service installation
+  service:
+    daemon_reload: yes
+  when: "matrix_bot_honoroit_systemd_service_result.changed|bool"
+
+- name: Ensure matrix-bot-honoroit.service restarted, if necessary
+  service:
+    name: "matrix-bot-honoroit.service"
+    state: restarted
+  when: "matrix_bot_honoroit_requires_restart|bool"

roles/matrix-bot-honoroit/tasks/setup_uninstall.yml

@@ -0,0 +1,36 @@
+---
+
+- name: Check existence of matrix-honoroit service
+  stat:
+    path: "{{ matrix_systemd_path }}/matrix-bot-honoroit.service"
+  register: matrix_bot_honoroit_service_stat
+
+- name: Ensure matrix-honoroit is stopped
+  service:
+    name: matrix-bot-honoroit
+    state: stopped
+    enabled: no
+    daemon_reload: yes
+  register: stopping_result
+  when: "matrix_bot_honoroit_service_stat.stat.exists|bool"
+
+- name: Ensure matrix-bot-honoroit.service doesn't exist
+  file:
+    path: "{{ matrix_systemd_path }}/matrix-bot-honoroit.service"
+    state: absent
+  when: "matrix_bot_honoroit_service_stat.stat.exists|bool"
+
+- name: Ensure systemd reloaded after matrix-bot-honoroit.service removal
+  service:
+    daemon_reload: yes
+  when: "matrix_bot_honoroit_service_stat.stat.exists|bool"
+
+- name: Ensure Matrix honoroit paths don't exist
+  file:
+    path: "{{ matrix_bot_honoroit_base_path }}"
+    state: absent
+
+- name: Ensure honoroit Docker image doesn't exist
+  docker_image:
+    name: "{{ matrix_bot_honoroit_docker_image }}"
+    state: absent

roles/matrix-bot-honoroit/tasks/validate_config.yml

@@ -0,0 +1,10 @@
+---
+
+- name: Fail if required settings not defined
+  fail:
+    msg: >-
+      You need to define a required configuration setting (`{{ item }}`).
+  when: "vars[item] == ''"
+  with_items:
+    - "matrix_bot_honoroit_password"
+    - "matrix_bot_honoroit_roomid"

roles/matrix-bot-honoroit/templates/env.j2

@@ -0,0 +1,17 @@
+HONOROIT_LOGIN={{ matrix_bot_honoroit_login }}
+HONOROIT_PASSWORD={{ matrix_bot_honoroit_password }}
+HONOROIT_HOMESERVER={{ matrix_bot_honoroit_homeserver }}
+HONOROIT_ROOMID={{ matrix_bot_honoroit_roomid }}
+HONOROIT_DB_DSN={{ matrix_bot_honoroit_database_connection_string }}
+HONOROIT_DB_DIALECT={{ matrix_bot_honoroit_database_dialect }}
+HONOROIT_PREFIX={{ matrix_bot_honoroit_prefix }}
+HONOROIT_SENTRY={{ matrix_bot_honoroit_sentry }}
+HONOROIT_LOGLEVEL={{ matrix_bot_honoroit_loglevel }}
+HONOROIT_TEXT_PREFIX_OPEN={{ matrix_bot_honoroit_text_prefix_open }}
+HONOROIT_TEXT_PREFIX_DONE={{ matrix_bot_honoroit_text_prefix_done }}
+HONOROIT_TEXT_GREETINGS={{ matrix_bot_honoroit_text_greetings }}
+HONOROIT_TEXT_ERROR={{ matrix_bot_honoroit_text_error }}
+HONOROIT_TEXT_EMPTYROOM={{ matrix_bot_honoroit_text_emptyroom }}
+HONOROIT_TEXT_DONE={{ matrix_bot_honoroit_text_done }}
+
+{{ matrix_bot_honoroit_environment_variables_extension }}

roles/matrix-bot-honoroit/templates/systemd/matrix-bot-honoroit.service.j2

@@ -0,0 +1,39 @@
+#jinja2: lstrip_blocks: "True"
+[Unit]
+Description=Matrix helpdesk bot
+{% for service in matrix_bot_honoroit_systemd_required_services_list %}
+Requires={{ service }}
+After={{ service }}
+{% endfor %}
+{% for service in matrix_bot_honoroit_systemd_wanted_services_list %}
+Wants={{ service }}
+{% endfor %}
+DefaultDependencies=no
+
+[Service]
+Type=simple
+Environment="HOME={{ matrix_systemd_unit_home_path }}"
+ExecStartPre=-{{ matrix_host_command_sh }} -c '{{ matrix_host_command_docker }} kill matrix-bot-honoroit 2>/dev/null'
+ExecStartPre=-{{ matrix_host_command_sh }} -c '{{ matrix_host_command_docker }} rm matrix-bot-honoroit 2>/dev/null'
+
+ExecStart={{ matrix_host_command_docker }} run --rm --name matrix-bot-honoroit \
+			--log-driver=none \
+			--user={{ matrix_user_uid }}:{{ matrix_user_gid }} \
+			--cap-drop=ALL \
+			--read-only \
+			--network={{ matrix_docker_network }} \
+			--env-file={{ matrix_bot_honoroit_config_path }}/env \
+			--mount type=bind,src={{ matrix_bot_honoroit_data_path }},dst=/data \
+			{% for arg in matrix_bot_honoroit_container_extra_arguments %}
+			{{ arg }} \
+			{% endfor %}
+			{{ matrix_bot_honoroit_docker_image }}
+
+ExecStopPost=-{{ matrix_host_command_sh }} -c '{{ matrix_host_command_docker }} kill matrix-bot-honoroit 2>/dev/null'
+ExecStopPost=-{{ matrix_host_command_sh }} -c '{{ matrix_host_command_docker }} rm matrix-bot-honoroit 2>/dev/null'
+Restart=always
+RestartSec=30
+SyslogIdentifier=matrix-bot-honoroit
+
+[Install]
+WantedBy=multi-user.target

roles/matrix-bot-matrix-reminder-bot/defaults/main.yml

@@ -3,7 +3,7 @@
 
 matrix_bot_matrix_reminder_bot_enabled: true
 
-matrix_bot_matrix_reminder_bot_container_self_build: false
+matrix_bot_matrix_reminder_bot_container_image_self_build: false
 matrix_bot_matrix_reminder_bot_docker_repo: "https://github.com/anoadragon453/matrix-reminder-bot.git"
 matrix_bot_matrix_reminder_bot_docker_src_files_path: "{{ matrix_base_data_path }}/matrix-reminder-bot/docker-src"
 

roles/matrix-bot-matrix-reminder-bot/tasks/setup_install.yml

@@ -46,7 +46,7 @@
     source: "{{ 'pull' if ansible_version.major > 2 or ansible_version.minor > 7 else omit }}"
     force_source: "{{ matrix_bot_matrix_reminder_bot_docker_image_force_pull if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}"
     force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else matrix_bot_matrix_reminder_bot_docker_image_force_pull }}"
-  when: "not matrix_bot_matrix_reminder_bot_container_self_build|bool"
+  when: "not matrix_bot_matrix_reminder_bot_container_image_self_build|bool"
 
 - name: Ensure matrix-reminder-bot repository is present on self-build
   git:
@@ -54,7 +54,7 @@
     dest: "{{ matrix_bot_matrix_reminder_bot_docker_src_files_path }}"
     force: "yes"
   register: matrix_bot_matrix_reminder_bot_git_pull_results
-  when: "matrix_bot_matrix_reminder_bot_container_self_build|bool"
+  when: "matrix_bot_matrix_reminder_bot_container_image_self_build|bool"
 
 - name: Ensure matrix-reminder-bot image is built
   docker_image:
@@ -66,7 +66,7 @@
       dockerfile: docker/Dockerfile
       path: "{{ matrix_bot_matrix_reminder_bot_docker_src_files_path }}"
       pull: yes
-  when: "matrix_bot_matrix_reminder_bot_container_self_build|bool"
+  when: "matrix_bot_matrix_reminder_bot_container_image_self_build|bool"
 
 - name: Ensure matrix-reminder-bot config installed
   copy:

roles/matrix-bot-matrix-reminder-bot/tasks/setup_uninstall.yml

@@ -9,6 +9,7 @@
   service:
     name: matrix-bot-matrix-reminder-bot
     state: stopped
+    enabled: no
     daemon_reload: yes
   register: stopping_result
   when: "matrix_bot_matrix_reminder_bot_service_stat.stat.exists|bool"

roles/matrix-bot-matrix-reminder-bot/tasks/validate_config.yml

@@ -8,3 +8,12 @@
   with_items:
     - "matrix_bot_matrix_reminder_bot_matrix_user_password"
     - "matrix_bot_matrix_reminder_bot_reminders_timezone"
+
+- name: (Deprecation) Catch and report renamed settings
+  fail:
+    msg: >-
+      Your configuration contains a variable, which now has a different name.
+      Please change your configuration to rename the variable (`{{ item.old }}` -> `{{ item.new }}`).
+  when: "item.old in vars"
+  with_items:
+    - {'old': 'matrix_bot_matrix_reminder_bot_container_self_build', 'new': 'matrix_bot_matrix_reminder_bot_container_image_self_build'}

roles/matrix-bot-matrix-reminder-bot/templates/systemd/matrix-bot-matrix-reminder-bot.service.j2

@@ -32,8 +32,8 @@ ExecStart={{ matrix_host_command_docker }} run --rm --name matrix-bot-matrix-rem
 			{{ matrix_bot_matrix_reminder_bot_docker_image }} \
 			-c "matrix-reminder-bot /config/config.yaml"
 
-ExecStop=-{{ matrix_host_command_sh }} -c '{{ matrix_host_command_docker }} kill matrix-bot-matrix-reminder-bot 2>/dev/null'
-ExecStop=-{{ matrix_host_command_sh }} -c '{{ matrix_host_command_docker }} rm matrix-bot-matrix-reminder-bot 2>/dev/null'
+ExecStopPost=-{{ matrix_host_command_sh }} -c '{{ matrix_host_command_docker }} kill matrix-bot-matrix-reminder-bot 2>/dev/null'
+ExecStopPost=-{{ matrix_host_command_sh }} -c '{{ matrix_host_command_docker }} rm matrix-bot-matrix-reminder-bot 2>/dev/null'
 Restart=always
 RestartSec=30
 SyslogIdentifier=matrix-bot-matrix-reminder-bot

roles/matrix-bot-mjolnir/defaults/main.yml

@@ -3,14 +3,13 @@
 
 matrix_bot_mjolnir_enabled: true
 
-matrix_bot_mjolnir_version: "v1.1.20"
+matrix_bot_mjolnir_version: "v1.2.1"
 
 matrix_bot_mjolnir_container_image_self_build: false
 matrix_bot_mjolnir_container_image_self_build_repo: "https://github.com/matrix-org/mjolnir.git"
 
 matrix_bot_mjolnir_docker_image: "{{ matrix_bot_mjolnir_docker_image_name_prefix }}matrixdotorg/mjolnir:{{ matrix_bot_mjolnir_version }}"
 matrix_bot_mjolnir_docker_image_name_prefix: "{{ 'localhost/' if matrix_bot_mjolnir_container_image_self_build else matrix_container_global_registry_prefix }}"
-
 matrix_bot_mjolnir_docker_image_force_pull: "{{ matrix_bot_mjolnir_docker_image.endswith(':latest') }}"
 
 matrix_bot_mjolnir_base_path: "{{ matrix_base_data_path }}/mjolnir"

roles/matrix-bot-mjolnir/tasks/setup_uninstall.yml

@@ -9,6 +9,7 @@
   service:
     name: matrix-bot-mjolnir
     state: stopped
+    enabled: no
     daemon_reload: yes
   register: stopping_result
   when: "matrix_bot_mjolnir_service_stat.stat.exists|bool"

roles/matrix-bot-mjolnir/templates/systemd/matrix-bot-mjolnir.service.j2

@@ -32,8 +32,8 @@ ExecStart={{ matrix_host_command_docker }} run --rm --name matrix-bot-mjolnir \
 			{% endfor %}
 			{{ matrix_bot_mjolnir_docker_image }}
 
-ExecStop=-{{ matrix_host_command_sh }} -c '{{ matrix_host_command_docker }} kill matrix-bot-mjolnir 2>/dev/null'
-ExecStop=-{{ matrix_host_command_sh }} -c '{{ matrix_host_command_docker }} rm matrix-bot-mjolnir 2>/dev/null'
+ExecStopPost=-{{ matrix_host_command_sh }} -c '{{ matrix_host_command_docker }} kill matrix-bot-mjolnir 2>/dev/null'
+ExecStopPost=-{{ matrix_host_command_sh }} -c '{{ matrix_host_command_docker }} rm matrix-bot-mjolnir 2>/dev/null'
 Restart=always
 RestartSec=30
 SyslogIdentifier=matrix-bot-mjolnir

roles/matrix-bridge-appservice-discord/defaults/main.yml

@@ -48,7 +48,7 @@ matrix_appservice_discord_bridge_enableSelfServiceBridging: false
 #
 # To use Postgres:
 # - change the engine (`matrix_appservice_discord_database_engine: 'postgres'`)
-# - adjust your database credentials via the `matrix_appservice_discord_postgres_*` variables
+# - adjust your database credentials via the `matrix_appservice_discord_database_*` variables
 matrix_appservice_discord_database_engine: 'sqlite'
 
 matrix_appservice_discord_sqlite_database_path_local: "{{ matrix_appservice_discord_data_path }}/discord.db"

roles/matrix-bridge-appservice-discord/tasks/setup_install.yml

@@ -54,6 +54,7 @@
   service:
     name: matrix-appservice-discord
     state: stopped
+    enabled: no
     daemon_reload: yes
   failed_when: false
   when: "matrix_appservice_discord_stat_db.stat.exists"

roles/matrix-bridge-appservice-discord/tasks/setup_uninstall.yml

@@ -9,6 +9,7 @@
   service:
     name: matrix-appservice-discord
     state: stopped
+    enabled: no
     daemon_reload: yes
   when: "matrix_appservice_discord_service_stat.stat.exists"
 

roles/matrix-bridge-appservice-discord/templates/systemd/matrix-appservice-discord.service.j2

@@ -35,8 +35,8 @@ ExecStart={{ matrix_host_command_docker }} run --rm --name matrix-appservice-dis
 			{{ matrix_appservice_discord_docker_image }} \
 			node /build/src/discordas.js -p 9005 -c /cfg/config.yaml -f /cfg/registration.yaml
 
-ExecStop=-{{ matrix_host_command_sh }} -c '{{ matrix_host_command_docker }} kill matrix-appservice-discord 2>/dev/null'
-ExecStop=-{{ matrix_host_command_sh }} -c '{{ matrix_host_command_docker }} rm matrix-appservice-discord 2>/dev/null'
+ExecStopPost=-{{ matrix_host_command_sh }} -c '{{ matrix_host_command_docker }} kill matrix-appservice-discord 2>/dev/null'
+ExecStopPost=-{{ matrix_host_command_sh }} -c '{{ matrix_host_command_docker }} rm matrix-appservice-discord 2>/dev/null'
 Restart=always
 RestartSec=30
 SyslogIdentifier=matrix-appservice-discord

roles/matrix-bridge-appservice-irc/defaults/main.yml

@@ -3,11 +3,11 @@
 
 matrix_appservice_irc_enabled: true
 
-matrix_appservice_irc_container_self_build: false
+matrix_appservice_irc_container_image_self_build: false
 matrix_appservice_irc_docker_repo: "https://github.com/matrix-org/matrix-appservice-irc.git"
 matrix_appservice_irc_docker_src_files_path: "{{ matrix_base_data_path }}/appservice-irc/docker-src"
 
-matrix_appservice_irc_version: release-0.31.0
+matrix_appservice_irc_version: release-0.32.1
 matrix_appservice_irc_docker_image: "{{ matrix_container_global_registry_prefix }}matrixdotorg/matrix-appservice-irc:{{ matrix_appservice_irc_version }}"
 matrix_appservice_irc_docker_image_force_pull: "{{ matrix_appservice_irc_docker_image.endswith(':latest') }}"
 

roles/matrix-bridge-appservice-irc/tasks/init.yml

@@ -3,7 +3,7 @@
 - name: Fail if trying to self-build on Ansible < 2.8
   fail:
     msg: "To self-build the Element image, you should use Ansible 2.8 or higher. See docs/ansible.md"
-  when: "ansible_version.major == 2 and ansible_version.minor < 8 and matrix_appservice_irc_container_self_build and matrix_appservice_irc_enabled"
+  when: "ansible_version.major == 2 and ansible_version.minor < 8 and matrix_appservice_irc_container_image_self_build and matrix_appservice_irc_enabled"
 
 # If the matrix-synapse role is not used, `matrix_synapse_role_executed` won't exist.
 # We don't want to fail in such cases.

roles/matrix-bridge-appservice-irc/tasks/setup_install.yml

@@ -1,5 +1,7 @@
 ---
 
+- import_tasks: "{{ role_path }}/../matrix-base/tasks/util/ensure_openssl_installed.yml"
+
 - name: Ensure Appservice IRC paths exist
   file:
     path: "{{ item.path }}"
@@ -11,7 +13,7 @@
     - { path: "{{ matrix_appservice_irc_base_path }}", when: true }
     - { path: "{{ matrix_appservice_irc_config_path }}", when: true }
     - { path: "{{ matrix_appservice_irc_data_path }}", when: true }
-    - { path: "{{ matrix_appservice_irc_docker_src_files_path }}", when: "{{ matrix_appservice_irc_container_self_build }}" }
+    - { path: "{{ matrix_appservice_irc_docker_src_files_path }}", when: "{{ matrix_appservice_irc_container_image_self_build }}" }
   when: item.when|bool
 
 - name: Check if an old passkey file already exists
@@ -61,7 +63,7 @@
     source: "{{ 'pull' if ansible_version.major > 2 or ansible_version.minor > 7 else omit }}"
     force_source: "{{ matrix_appservice_irc_docker_image_force_pull if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}"
     force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else matrix_appservice_irc_docker_image_force_pull }}"
-  when: "matrix_appservice_irc_enabled|bool and not matrix_appservice_irc_container_self_build|bool"
+  when: "matrix_appservice_irc_enabled|bool and not matrix_appservice_irc_container_image_self_build|bool"
 
 - name: Ensure matrix-appservice-irc repository is present when self-building
   git:
@@ -69,7 +71,7 @@
     dest: "{{ matrix_appservice_irc_docker_src_files_path }}"
     force: "yes"
   register: matrix_appservice_irc_git_pull_results
-  when: "matrix_appservice_irc_enabled|bool and matrix_appservice_irc_container_self_build|bool"
+  when: "matrix_appservice_irc_enabled|bool and matrix_appservice_irc_container_image_self_build|bool"
 
 - name: Ensure matrix-appservice-irc Docker image is built
   docker_image:
@@ -81,7 +83,7 @@
       dockerfile: Dockerfile
       path: "{{ matrix_appservice_irc_docker_src_files_path }}"
       pull: yes
-  when: "matrix_appservice_irc_enabled|bool and matrix_appservice_irc_container_self_build|bool and matrix_appservice_irc_git_pull_results.changed"
+  when: "matrix_appservice_irc_enabled|bool and matrix_appservice_irc_container_image_self_build|bool and matrix_appservice_irc_git_pull_results.changed"
 
 - name: Ensure Matrix Appservice IRC config installed
   copy:

roles/matrix-bridge-appservice-irc/tasks/setup_uninstall.yml

@@ -9,6 +9,7 @@
   service:
     name: matrix-appservice-irc
     state: stopped
+    enabled: no
     daemon_reload: yes
   when: "matrix_appservice_irc_service_stat.stat.exists"
 

roles/matrix-bridge-appservice-irc/tasks/validate_config.yml

@@ -33,3 +33,4 @@
   when: "item.old in vars"
   with_items:
     - {'old': 'matrix_appservice_irc_container_expose_client_server_api_port', 'new': '<superseded by matrix_appservice_irc_container_http_host_bind_port>'}
+    - {'old': 'matrix_appservice_irc_container_self_build', 'new': 'matrix_appservice_irc_container_image_self_build'}

roles/matrix-bridge-appservice-irc/templates/systemd/matrix-appservice-irc.service.j2

@@ -36,8 +36,8 @@ ExecStart={{ matrix_host_command_docker }} run --rm --name matrix-appservice-irc
 			{{ matrix_appservice_irc_docker_image }} \
 			-c 'node app.js -c /config/config.yaml -f /config/registration.yaml -p 9999'
 
-ExecStop=-{{ matrix_host_command_sh }} -c '{{ matrix_host_command_docker }} kill matrix-appservice-irc 2>/dev/null'
-ExecStop=-{{ matrix_host_command_sh }} -c '{{ matrix_host_command_docker }} rm matrix-appservice-irc 2>/dev/null'
+ExecStopPost=-{{ matrix_host_command_sh }} -c '{{ matrix_host_command_docker }} kill matrix-appservice-irc 2>/dev/null'
+ExecStopPost=-{{ matrix_host_command_sh }} -c '{{ matrix_host_command_docker }} rm matrix-appservice-irc 2>/dev/null'
 Restart=always
 RestartSec=30
 SyslogIdentifier=matrix-appservice-irc

roles/matrix-bridge-appservice-slack/defaults/main.yml

@@ -3,11 +3,11 @@
 
 matrix_appservice_slack_enabled: true
 
-matrix_appservice_slack_container_self_build: false
+matrix_appservice_slack_container_image_self_build: false
 matrix_appservice_slack_docker_repo: "https://github.com/matrix-org/matrix-appservice-slack.git"
 matrix_appservice_slack_docker_src_files_path: "{{ matrix_base_data_path }}/appservice-slack/docker-src"
 
-matrix_appservice_slack_version: release-1.8.0
+matrix_appservice_slack_version: release-1.10.0
 matrix_appservice_slack_docker_image: "{{ matrix_container_global_registry_prefix }}matrixdotorg/matrix-appservice-slack:{{ matrix_appservice_slack_version }}"
 matrix_appservice_slack_docker_image_force_pull: "{{ matrix_appservice_slack_docker_image.endswith(':latest') }}"
 
@@ -33,7 +33,7 @@ matrix_appservice_slack_slack_port: 9003
 matrix_appservice_slack_container_http_host_bind_port: ''
 
 matrix_appservice_slack_homeserver_media_url: "{{ matrix_server_fqn_matrix }}"
-matrix_appservice_slack_homeserver_url: "http://matrix-synapse:8008"
+matrix_appservice_slack_homeserver_url: ""
 matrix_appservice_slack_homeserver_domain: "{{ matrix_domain }}"
 matrix_appservice_slack_appservice_url: 'http://matrix-appservice-slack'
 
@@ -82,7 +82,7 @@ matrix_appservice_slack_configuration_extension_yaml: |
     # Optional
     #matrix_admin_room: "!aBcDeF:matrix.org"
     #homeserver:
-    #    url: http://localhost:8008
+    #    url: http://localhost:{{ matrix_synapse_container_client_api_port }}
     #    server_name: my.server
     # Optional
     #tls:

roles/matrix-bridge-appservice-slack/tasks/init.yml

@@ -3,7 +3,7 @@
 - name: Fail if trying to self-build on Ansible < 2.8
   fail:
     msg: "To self-build the Element image, you should use Ansible 2.8 or higher. See docs/ansible.md"
-  when: "ansible_version.major == 2 and ansible_version.minor < 8 and matrix_appservice_slack_container_self_build and matrix_appservice_slack_enabled"
+  when: "ansible_version.major == 2 and ansible_version.minor < 8 and matrix_appservice_slack_container_image_self_build and matrix_appservice_slack_enabled"
 
 # If the matrix-synapse role is not used, `matrix_synapse_role_executed` won't exist.
 # We don't want to fail in such cases.
@@ -44,7 +44,7 @@
       msg: >-
         Trying to append Slack Appservice's reverse-proxying configuration to matrix-nginx-proxy,
         but it's pointless since the matrix-nginx-proxy role had already executed.
-        To fix this, please change the order of roles in your plabook,
+        To fix this, please change the order of roles in your playbook,
         so that the matrix-nginx-proxy role would run after the matrix-bridge-appservice-slack role.
     when: matrix_nginx_proxy_role_executed|default(False)|bool
 

roles/matrix-bridge-appservice-slack/tasks/setup_install.yml

@@ -11,7 +11,7 @@
     - { path: "{{ matrix_appservice_slack_base_path }}", when: true }
     - { path: "{{ matrix_appservice_slack_config_path }}", when: true }
     - { path: "{{ matrix_appservice_slack_data_path }}", when: true }
-    - { path: "{{ matrix_appservice_slack_docker_src_files_path }}", when: "{{ matrix_appservice_slack_container_self_build }}" }
+    - { path: "{{ matrix_appservice_slack_docker_src_files_path }}", when: "{{ matrix_appservice_slack_container_image_self_build }}" }
   when: item.when|bool
 
 - set_fact:
@@ -37,7 +37,7 @@
     source: "{{ 'pull' if ansible_version.major > 2 or ansible_version.minor > 7 else omit }}"
     force_source: "{{ matrix_appservice_slack_docker_image_force_pull if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}"
     force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else matrix_appservice_slack_docker_image_force_pull }}"
-  when: "not matrix_appservice_slack_container_self_build|bool"
+  when: "not matrix_appservice_slack_container_image_self_build|bool"
 
 - name: Ensure matrix-appservice-slack repository is present when self-building
   git:
@@ -45,7 +45,7 @@
     dest: "{{ matrix_appservice_slack_docker_src_files_path }}"
     force: "yes"
   register: matrix_appservice_slack_git_pull_results
-  when: "matrix_appservice_slack_container_self_build|bool"
+  when: "matrix_appservice_slack_container_image_self_build|bool"
 
 - name: Ensure matrix-appservice-slack Docker image is built
   docker_image:
@@ -57,7 +57,7 @@
       dockerfile: Dockerfile
       path: "{{ matrix_appservice_slack_docker_src_files_path }}"
       pull: yes
-  when: "matrix_appservice_slack_container_self_build|bool and matrix_appservice_slack_git_pull_results.changed"
+  when: "matrix_appservice_slack_container_image_self_build|bool and matrix_appservice_slack_git_pull_results.changed"
 
 - name: Ensure Matrix Appservice Slack config installed
   copy:

roles/matrix-bridge-appservice-slack/tasks/setup_uninstall.yml

@@ -9,6 +9,7 @@
   service:
     name: matrix-appservice-slack
     state: stopped
+    enabled: no
     daemon_reload: yes
   when: "matrix_appservice_slack_service_stat.stat.exists"
 

roles/matrix-bridge-appservice-slack/tasks/validate_config.yml

@@ -8,5 +8,15 @@
   with_items:
     - "matrix_appservice_slack_control_room_id"
     - "matrix_appservice_slack_appservice_token"
+    - "matrix_appservice_slack_homeserver_url"
     - "matrix_appservice_slack_homeserver_token"
     - "matrix_appservice_slack_id_token"
+
+- name: (Deprecation) Catch and report renamed settings
+  fail:
+    msg: >-
+      Your configuration contains a variable, which now has a different name.
+      Please change your configuration to rename the variable (`{{ item.old }}` -> `{{ item.new }}`).
+  when: "item.old in vars"
+  with_items:
+    - {'old': 'matrix_appservice_slack_container_self_build', 'new': 'matrix_appservice_slack_container_image_self_build'}

roles/matrix-bridge-appservice-slack/templates/config.yaml.j2

@@ -5,9 +5,9 @@ bot_username: "{{ matrix_appservice_slack_bot_name }}"
 username_prefix: {{ matrix_appservice_slack_user_prefix }}
 
 homeserver:
-    media_url: "{{ matrix_appservice_slack_homeserver_media_url }}"
-    url: "{{ matrix_appservice_slack_homeserver_url }}"
     server_name: "{{ matrix_domain }}"
+    url: "{{ matrix_appservice_slack_homeserver_url }}"
+    media_url: "{{ matrix_appservice_slack_homeserver_media_url }}"
 
 {% if matrix_appservice_slack_database_engine == 'nedb' %}
 dbdir: "/data"

roles/matrix-bridge-appservice-slack/templates/systemd/matrix-appservice-slack.service.j2

@@ -35,8 +35,8 @@ ExecStart={{ matrix_host_command_docker }} run --rm --name matrix-appservice-sla
 			{{ matrix_appservice_slack_docker_image }} \
 			node app.js -p {{matrix_appservice_slack_matrix_port}} -c /config/config.yaml -f /config/slack-registration.yaml
 
-ExecStop=-{{ matrix_host_command_sh }} -c '{{ matrix_host_command_docker }} kill matrix-appservice-slack 2>/dev/null'
-ExecStop=-{{ matrix_host_command_sh }} -c '{{ matrix_host_command_docker }} rm matrix-appservice-slack 2>/dev/null'
+ExecStopPost=-{{ matrix_host_command_sh }} -c '{{ matrix_host_command_docker }} kill matrix-appservice-slack 2>/dev/null'
+ExecStopPost=-{{ matrix_host_command_sh }} -c '{{ matrix_host_command_docker }} rm matrix-appservice-slack 2>/dev/null'
 Restart=always
 RestartSec=30
 SyslogIdentifier=matrix-appservice-slack

roles/matrix-bridge-appservice-webhooks/defaults/main.yml

@@ -1,15 +1,15 @@
 # matrix-appservice-webhooks is a Matrix <-> webhook bridge
-# See: https://github.com/turt2live/matrix-appservice-webhooks
+# See: https://github.com/redoonetworks/matrix-appservice-webhooks
 
 matrix_appservice_webhooks_enabled: true
 
 matrix_appservice_webhooks_container_image_self_build: false
-matrix_appservice_webhooks_container_image_self_build_repo: "https://github.com/turt2live/matrix-appservice-webhooks"
+matrix_appservice_webhooks_container_image_self_build_repo: "https://github.com/redoonetworks/matrix-appservice-webhooks"
 matrix_appservice_webhooks_container_image_self_build_repo_version: "{{ 'master' if matrix_appservice_webhooks_version == 'latest' else matrix_appservice_webhooks_version }}"
 matrix_appservice_webhooks_container_image_self_build_repo_dockerfile_path: "Dockerfile"
 
-matrix_appservice_webhooks_version: latest
-matrix_appservice_webhooks_docker_image: "{{ matrix_appservice_webhooks_docker_image_name_prefix }}turt2live/matrix-appservice-webhooks:{{ matrix_appservice_webhooks_version }}"
+matrix_appservice_webhooks_version: v1.0.3-01
+matrix_appservice_webhooks_docker_image: "{{ matrix_appservice_webhooks_docker_image_name_prefix }}redoonetworks/matrix-appservice-webhooks:{{ matrix_appservice_webhooks_version }}"
 matrix_appservice_webhooks_docker_image_name_prefix: "{{ 'localhost/' if matrix_appservice_webhooks_container_image_self_build else matrix_container_global_registry_prefix }}"
 matrix_appservice_webhooks_docker_image_force_pull: "{{ matrix_appservice_webhooks_docker_image.endswith(':latest') }}"
 
@@ -22,8 +22,6 @@ matrix_appservice_webhooks_docker_src_files_path: "{{ matrix_appservice_webhooks
 matrix_appservice_webhooks_public_endpoint: /appservice-webhooks
 matrix_appservice_webhooks_inbound_uri_prefix: "{{ matrix_homeserver_url }}{{ matrix_appservice_webhooks_public_endpoint }}"
 
-# Once you make a control room in Matrix, you can get its ID by typing any message and checking its source
-matrix_appservice_webhooks_control_room_id: ''
 matrix_appservice_webhooks_bot_name: 'webhookbot'
 matrix_appservice_webhooks_user_prefix: '_webhook'
 
@@ -36,7 +34,7 @@ matrix_appservice_webhooks_matrix_port: 6789
 matrix_appservice_webhooks_container_http_host_bind_port: ''
 
 matrix_appservice_webhooks_homeserver_media_url: "{{ matrix_server_fqn_matrix }}"
-matrix_appservice_webhooks_homeserver_url: "http://matrix-synapse:8008"
+matrix_appservice_webhooks_homeserver_url: ""
 matrix_appservice_webhooks_homeserver_domain: "{{ matrix_domain }}"
 matrix_appservice_webhooks_appservice_url: 'http://matrix-appservice-webhooks'
 

roles/matrix-bridge-appservice-webhooks/tasks/init.yml

@@ -37,7 +37,7 @@
       msg: >-
         Trying to append webhooks Appservice's reverse-proxying configuration to matrix-nginx-proxy,
         but it's pointless since the matrix-nginx-proxy role had already executed.
-        To fix this, please change the order of roles in your plabook,
+        To fix this, please change the order of roles in your playbook,
         so that the matrix-nginx-proxy role would run after the matrix-bridge-appservice-webhooks role.
     when: matrix_nginx_proxy_role_executed|default(False)|bool
 

roles/matrix-bridge-appservice-webhooks/tasks/setup_uninstall.yml

@@ -9,6 +9,7 @@
   service:
     name: matrix-appservice-webhooks
     state: stopped
+    enabled: no
     daemon_reload: yes
   when: "matrix_appservice_webhooks_service_stat.stat.exists"