From 4a6287c52878b6af9d044e042d3504946fdf1f24 Mon Sep 17 00:00:00 2001
From: Slavi Pantaleev <slavi@devture.com>
Date: Tue, 2 Jan 2024 15:56:56 +0200
Subject: [PATCH] Initial work on matrix-homeserver-proxy role and eliminating
 matrix-nginx-proxy

This is still very far from usable.

Various bridges and bots are still talking to
`matrix-nginx-proxy` instead of the new `matrix-homeserver-proxy` role.
These services need to be reworked. While reworking them,
various cleanups are being done as well as adding Traefik-labels to
those that need them.
---
 group_vars/matrix_servers                     | 249 ++++++++++++++----
 roles/custom/matrix-base/defaults/main.yml    |  53 +++-
 .../matrix-base/tasks/validate_config.yml     |   4 +-
 .../matrix-bot-chatgpt/defaults/main.yml      |  13 +-
 .../matrix-bot-chatgpt/tasks/install.yml      |   5 +
 .../tasks/validate_config.yml                 |   2 +
 .../systemd/matrix-bot-chatgpt.service.j2     |  10 +-
 .../defaults/main.yml                         |  14 +-
 .../tasks/validate_config.yml                 |   2 +
 .../matrix-bot-matrix-reminder-bot.service.j2 |  12 +-
 .../matrix-bot-postmoogle/defaults/main.yml   |  14 +-
 .../tasks/setup_install.yml                   |   5 +
 .../tasks/validate_config.yml                 |   2 +
 .../systemd/matrix-bot-postmoogle.service.j2  |  12 +-
 .../matrix-bridge-hookshot/defaults/main.yml  |   5 +-
 .../matrix-bridge-hookshot/tasks/main.yml     |   3 +
 .../defaults/main.yml                         |  67 ++++-
 .../tasks/inject_into_nginx_proxy.yml         |  69 -----
 .../tasks/main.yml                            |   9 -
 .../tasks/setup_install.yml                   |  10 +
 .../tasks/validate_config.yml                 |  17 +-
 .../templates/config.yaml.j2                  |   2 +-
 .../templates/labels.j2                       |  45 ++++
 .../matrix-mautrix-facebook.service.j2        |  17 +-
 .../matrix-homeserver-proxy/defaults/main.yml | 179 +++++++++++++
 .../matrix-homeserver-proxy/tasks/install.yml |  49 ++++
 .../matrix-homeserver-proxy/tasks/main.yml    |  20 ++
 .../tasks/uninstall.yml                       |  25 ++
 .../conf.d/matrix-homeserver-proxy.conf.j2    |  62 +++++
 .../templates/nginx/conf.d/nginx-http.conf.j2 |  13 +
 .../templates/nginx/nginx.conf.j2             |  77 ++++++
 .../matrix-homeserver-proxy.service.j2        |  52 ++++
 .../matrix-homeserver-proxy/vars/main.yml     |   4 +
 .../tasks/validate_config.yml                 |   5 +
 setup.yml                                     |   1 +
 35 files changed, 965 insertions(+), 163 deletions(-)
 delete mode 100644 roles/custom/matrix-bridge-mautrix-facebook/tasks/inject_into_nginx_proxy.yml
 create mode 100644 roles/custom/matrix-bridge-mautrix-facebook/templates/labels.j2
 create mode 100644 roles/custom/matrix-homeserver-proxy/defaults/main.yml
 create mode 100644 roles/custom/matrix-homeserver-proxy/tasks/install.yml
 create mode 100644 roles/custom/matrix-homeserver-proxy/tasks/main.yml
 create mode 100644 roles/custom/matrix-homeserver-proxy/tasks/uninstall.yml
 create mode 100644 roles/custom/matrix-homeserver-proxy/templates/nginx/conf.d/matrix-homeserver-proxy.conf.j2
 create mode 100644 roles/custom/matrix-homeserver-proxy/templates/nginx/conf.d/nginx-http.conf.j2
 create mode 100644 roles/custom/matrix-homeserver-proxy/templates/nginx/nginx.conf.j2
 create mode 100755 roles/custom/matrix-homeserver-proxy/templates/systemd/matrix-homeserver-proxy.service.j2
 create mode 100644 roles/custom/matrix-homeserver-proxy/vars/main.yml

diff --git a/group_vars/matrix_servers b/group_vars/matrix_servers
index efc2a94d4..678cfa0ee 100755
--- a/group_vars/matrix_servers
+++ b/group_vars/matrix_servers
@@ -189,6 +189,17 @@ matrix_homeserver_app_service_config_files_auto: |
     (['/matrix-cactus-comments.yaml'] if matrix_cactus_comments_enabled else [])
   }}
 
+matrix_bridges_homeserver_container_network: "{{ matrix_homeserver_proxy_container_network if matrix_homeserver_proxy_enabled else matrix_homeserver_container_network }}"
+matrix_bridges_homeserver_client_api_url: "{{ matrix_homeserver_proxy_client_api_url if matrix_homeserver_proxy_enabled else matrix_homeserver_container_url }}"
+matrix_bridges_homeserver_systemd_services_list: "{{ ([matrix_homeserver_proxy_ident + '.service']) if matrix_homeserver_proxy_enabled else matrix_homeserver_systemd_services_list }}"
+
+matrix_bots_homeserver_container_network: "{{ matrix_homeserver_proxy_container_network if matrix_homeserver_proxy_enabled else matrix_homeserver_container_network }}"
+matrix_bots_homeserver_client_api_url: "{{ matrix_homeserver_proxy_client_api_url if matrix_homeserver_proxy_enabled else matrix_homeserver_container_url }}"
+matrix_bots_homeserver_systemd_services_list: "{{ ([matrix_homeserver_proxy_ident + '.service']) if matrix_homeserver_proxy_enabled else matrix_homeserver_systemd_services_list }}"
+
+# Starting from version `0.6.0` conduit natively supports some sync v3 (sliding-sync) features.
+matrix_homeserver_sliding_sync_url: "{{ matrix_sliding_sync_base_url if matrix_sliding_sync_enabled else (matrix_homeserver_url if matrix_homeserver_implementation in ['conduit'] else '') }}"
+
 ########################################################################
 #                                                                      #
 # /base                                                                #
@@ -260,7 +271,7 @@ devture_systemd_service_manager_services_list_auto: |
     +
     ([{'name': 'matrix-heisenbridge.service', 'priority': 2000, 'groups': ['matrix', 'bridges', 'heisenbridge']}] if matrix_heisenbridge_enabled else [])
     +
-    ([{'name': 'matrix-hookshot.service', 'priority': 2000, 'groups': ['matrix', 'bridges', 'hookshot']}] if matrix_hookshot_enabled else [])
+    ([{'name': 'matrix-hookshot.service', 'priority': 2000, 'groups': ['matrix', 'bridges', 'hookshot', 'bridge-hookshot']}] if matrix_hookshot_enabled else [])
     +
     ([{'name': 'matrix-mautrix-discord.service', 'priority': 2000, 'groups': ['matrix', 'bridges', 'mautrix-discord']}] if matrix_mautrix_discord_enabled else [])
     +
@@ -352,6 +363,8 @@ devture_systemd_service_manager_services_list_auto: |
     +
     (matrix_ssl_renewal_systemd_units_list | selectattr('applicable') | selectattr('enableable') | list )
     +
+    ([{'name': (matrix_homeserver_proxy_ident + '.service'), 'priority': 3000, 'groups': ['matrix', 'reverse-proxies']}] if matrix_homeserver_proxy_enabled else [])
+    +
     ([{'name': (ntfy_identifier + '.service'), 'priority': 800, 'groups': ['matrix', 'ntfy']}] if ntfy_enabled else [])
     +
     ([{'name': (devture_postgres_identifier + '.service'), 'priority': 500, 'groups': ['matrix', 'postgres']}] if devture_postgres_enabled else [])
@@ -445,28 +458,39 @@ devture_playbook_state_preserver_commit_hash_preservation_dst: "{{ matrix_base_d
 
 matrix_identity_server_url: "{{ ('https://' + matrix_server_fqn_matrix) if matrix_ma1sd_enabled else None }}"
 
-matrix_homeserver_container_url: |-
+matrix_homeserver_systemd_services_list: |-
   {{
-    'http://matrix-nginx-proxy:12080' if matrix_nginx_proxy_enabled else {
-      'synapse': ('http://matrix-synapse-reverse-proxy-companion:8008' if matrix_synapse_reverse_proxy_companion_enabled else 'http://matrix-synapse:'+ matrix_synapse_container_client_api_port|string),
-      'dendrite': ('http://matrix-dendrite:' + matrix_dendrite_http_bind_port|string),
-      'conduit': ('http://matrix-conduit:' + matrix_conduit_port_number|string),
+    (
+      ([('matrix-' + matrix_homeserver_implementation + '.service')] if matrix_homeserver_implementation != 'synapse' else [])
+      +
+      ([('matrix-' + matrix_homeserver_implementation + '.service')] if matrix_homeserver_implementation == 'synapse' and not matrix_synapse_reverse_proxy_companion_enabled else [])
+      +
+      (['matrix-synapse-reverse-proxy-companion.service'] if matrix_synapse_reverse_proxy_companion_enabled else [])
+    ) | unique
+  }}
+
+matrix_homeserver_container_client_api_endpoint: |-
+  {{
+    {
+      'synapse': ('matrix-synapse-reverse-proxy-companion:8008' if matrix_synapse_reverse_proxy_companion_enabled else 'http://matrix-synapse:'+ matrix_synapse_container_client_api_port|string),
+      'dendrite': ('matrix-dendrite:' + matrix_dendrite_http_bind_port|string),
+      'conduit': ('matrix-conduit:' + matrix_conduit_port_number|string),
     }[matrix_homeserver_implementation]
   }}
 
-matrix_homeserver_container_federation_url: |-
+matrix_homeserver_container_federation_api_endpoint: |-
   {{
-    'http://matrix-nginx-proxy:12088' if matrix_nginx_proxy_enabled else {
-      'synapse': ('http://matrix-synapse-reverse-proxy-companion:8048' if matrix_synapse_reverse_proxy_companion_enabled else 'http://matrix-synapse:'+ matrix_synapse_container_federation_api_plain_port|string),
-      'dendrite': ('http://matrix-dendrite:' + matrix_dendrite_http_bind_port|string),
-      'conduit': ('http://matrix-conduit:' + matrix_conduit_port_number|string),
+    {
+      'synapse': ('matrix-synapse-reverse-proxy-companion:8048' if matrix_synapse_reverse_proxy_companion_enabled else 'http://matrix-synapse:'+ matrix_synapse_container_federation_api_plain_port|string),
+      'dendrite': ('matrix-dendrite:' + matrix_dendrite_http_bind_port|string),
+      'conduit': ('matrix-conduit:' + matrix_conduit_port_number|string),
     }[matrix_homeserver_implementation]
   }}
 
 matrix_homeserver_container_network: |-
   {{
-    matrix_nginx_proxy_container_network if matrix_nginx_proxy_enabled else {
-      'synapse': matrix_synapse_container_network,
+    {
+      'synapse': (matrix_synapse_reverse_proxy_companion_container_network if matrix_synapse_reverse_proxy_companion_enabled else matrix_synapse_container_network),
       'dendrite': matrix_dendrite_container_network,
       'conduit': matrix_conduit_container_network,
     }[matrix_homeserver_implementation]
@@ -862,22 +886,35 @@ matrix_mautrix_facebook_enabled: false
 
 matrix_mautrix_facebook_container_image_self_build: "{{ matrix_architecture not in ['amd64', 'arm64'] }}"
 
-matrix_mautrix_facebook_systemd_required_services_list: |
+matrix_mautrix_facebook_container_network: "{{ matrix_bridges_container_network }}"
+
+matrix_mautrix_facebook_container_additional_networks_auto: |-
   {{
-    ['docker.service']
-    +
-    ['matrix-' + matrix_homeserver_implementation + '.service']
-    +
-    ([devture_postgres_identifier ~ '.service'] if devture_postgres_enabled else [])
+    (
+      ([] if matrix_bridges_homeserver_container_network == '' else [matrix_bridges_homeserver_container_network])
+      +
+      ([devture_postgres_container_network] if devture_postgres_enabled and matrix_mautrix_facebook_database_hostname == devture_postgres_connection_hostname else [])
+      +
+      ([matrix_playbook_reverse_proxyable_services_additional_network] if matrix_playbook_reverse_proxyable_services_additional_network and matrix_mautrix_facebook_container_labels_traefik_enabled else [])
+    ) | unique
+  }}
+
+matrix_mautrix_facebook_systemd_required_services_list_auto: |
+  {{
+    matrix_bots_homeserver_systemd_services_list
     +
-    (['matrix-nginx-proxy.service'] if matrix_nginx_proxy_enabled else [])
+    ([devture_postgres_identifier ~ '.service'] if devture_postgres_enabled and matrix_mautrix_facebook_database_hostname == devture_postgres_connection_hostname else [])
   }}
 
 matrix_mautrix_facebook_appservice_token: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'fb.as.token', rounds=655555) | to_uuid }}"
 
+matrix_mautrix_facebook_homeserver_address: "{{ matrix_bridges_homeserver_client_api_url }}"
+
 matrix_mautrix_facebook_homeserver_token: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'fb.hs.token', rounds=655555) | to_uuid }}"
 
-matrix_mautrix_facebook_public_endpoint: "/{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'facebook', rounds=655555) | to_uuid }}"
+matrix_mautrix_facebook_appservice_public_enabled: true
+matrix_mautrix_facebook_appservice_public_hostname: "{{ matrix_server_fqn_matrix }}"
+matrix_mautrix_facebook_appservice_public_prefix: "/{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'facebook', rounds=655555) | to_uuid }}"
 
 matrix_mautrix_facebook_container_http_host_bind_port: "{{ (matrix_playbook_service_host_bind_interface_prefix ~ '9008') if matrix_playbook_service_host_bind_interface_prefix else '' }}"
 
@@ -885,18 +922,25 @@ matrix_mautrix_facebook_login_shared_secret: "{{ matrix_synapse_ext_password_pro
 
 matrix_mautrix_facebook_bridge_presence: "{{ matrix_synapse_presence_enabled if matrix_synapse_enabled else true }}"
 
-# People using an external Prometheus server will need to toggle all of these to be able to consume metrics remotely:
-# - `matrix_mautrix_facebook_metrics_enabled`
-# - `matrix_mautrix_facebook_proxying_metrics_enabled`
-# - `matrix_nginx_proxy_proxy_matrix_metrics_enabled`
 matrix_mautrix_facebook_metrics_enabled: "{{ prometheus_enabled }}"
 
+matrix_mautrix_facebook_metrics_proxying_enabled: "{{ matrix_mautrix_facebook_metrics_enabled and matrix_metrics_exposure_enabled }}"
+matrix_mautrix_facebook_metrics_proxying_hostname: "{{ matrix_metrics_exposure_hostname }}"
+matrix_mautrix_facebook_metrics_proxying_path_prefix: "{{ matrix_metrics_exposure_path_prefix }}/mautrix-facebook"
+matrix_mautrix_facebook_container_labels_metrics_middleware_basic_auth_enabled: "{{ matrix_metrics_exposure_http_basic_auth_enabled }}"
+matrix_mautrix_facebook_container_labels_metrics_middleware_basic_auth_users: "{{ matrix_metrics_exposure_http_basic_auth_users }}"
+
 # We'd like to force-set people with external Postgres to SQLite, so the bridge role can complain
 # and point them to a migration path.
 matrix_mautrix_facebook_database_engine: "{{ 'postgres' if devture_postgres_enabled else 'sqlite' }}"
 matrix_mautrix_facebook_database_hostname: "{{ devture_postgres_connection_hostname if devture_postgres_enabled else '' }}"
 matrix_mautrix_facebook_database_password: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'mau.fb.db', rounds=655555) | to_uuid }}"
 
+matrix_mautrix_facebook_container_labels_traefik_enabled: "{{ matrix_playbook_reverse_proxy_type in ['playbook-managed-traefik', 'other-traefik-container'] }}"
+matrix_mautrix_facebook_container_labels_traefik_docker_network: "{{ matrix_playbook_reverse_proxyable_services_additional_network }}"
+matrix_mautrix_facebook_container_labels_traefik_entrypoints: "{{ devture_traefik_entrypoint_primary }}"
+matrix_mautrix_facebook_container_labels_traefik_tls_certResolver: "{{ devture_traefik_certResolver_primary }}"
+
 ######################################################################
 #
 # /matrix-bridge-mautrix-facebook
@@ -1374,11 +1418,11 @@ matrix_hookshot_appservice_token: "{{ '%s' | format(matrix_homeserver_generic_se
 
 matrix_hookshot_homeserver_token: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'hookshot.hs.tok', rounds=655555) | to_uuid }}"
 
+matrix_hookshot_homeserver_address: "{{ matrix_bridges_homeserver_client_api_url }}"
+
 matrix_hookshot_systemd_wanted_services_list: |
   {{
-    (['matrix-' + matrix_homeserver_implementation + '.service'])
-    +
-    (['matrix-nginx-proxy.service'] if matrix_nginx_proxy_enabled else [])
+    matrix_bridges_homeserver_systemd_services_list
     +
     ([(redis_identifier + '.service')] if redis_enabled and matrix_hookshot_queue_host == redis_identifier else [])
   }}
@@ -1388,9 +1432,15 @@ matrix_hookshot_systemd_wanted_services_list: |
 # because connectivity is still potentially troublesome and is to be investigated.
 matrix_hookshot_queue_host: "{{ redis_identifier if redis_enabled and matrix_hookshot_experimental_encryption_enabled else '' }}"
 
+matrix_hookshot_container_network: "{{ matrix_bridges_container_network }}"
+
 matrix_hookshot_container_additional_networks_auto: |
   {{
-    ([redis_container_network] if redis_enabled and matrix_hookshot_queue_host == redis_identifier else [])
+    (
+      ([] if matrix_bridges_homeserver_container_network == '' else [matrix_bridges_homeserver_container_network])
+      +
+      ([redis_container_network] if redis_enabled and matrix_hookshot_queue_host == redis_identifier else [])
+    )
   }}
 
 matrix_hookshot_container_http_host_bind_ports_defaultmapping:
@@ -1411,6 +1461,13 @@ matrix_hookshot_provisioning_enabled: "{{ matrix_hookshot_provisioning_secret an
 # - `matrix_nginx_proxy_proxy_matrix_metrics_enabled`
 matrix_hookshot_metrics_enabled: "{{ prometheus_enabled }}"
 
+# TODO - implement
+# matrix_hookshot_metrics_metrics_proxying_enabled: "{{ matrix_hookshot_metrics_enabled and matrix_metrics_exposure_enabled }}"
+# matrix_hookshot_metrics_metrics_proxying_hostname: "{{ matrix_metrics_exposure_hostname }}"
+# matrix_hookshot_metrics_metrics_proxying_path_prefix: "{{ matrix_metrics_exposure_path_prefix }}/hookshot"
+# matrix_hookshot_metrics_container_labels_metrics_middleware_basic_auth_enabled: "{{ matrix_metrics_exposure_http_basic_auth_enabled }}"
+# matrix_hookshot_metrics_container_labels_metrics_middleware_basic_auth_users: "{{ matrix_metrics_exposure_http_basic_auth_users }}"
+
 matrix_hookshot_urlprefix_port_enabled: "{{ matrix_nginx_proxy_container_https_host_bind_port == 443 if matrix_nginx_proxy_https_enabled else matrix_nginx_proxy_container_https_host_bind_port == 80 }}"
 matrix_hookshot_urlprefix_port: ":{{ matrix_nginx_proxy_container_https_host_bind_port if matrix_nginx_proxy_https_enabled else matrix_nginx_proxy_container_http_host_bind_port }}"
 matrix_hookshot_urlprefix: "{{ 'https' if matrix_playbook_ssl_enabled else 'http' }}://{{ matrix_server_fqn_matrix }}{{ matrix_hookshot_urlprefix_port if matrix_hookshot_urlprefix_port_enabled else '' }}"
@@ -1668,15 +1725,11 @@ matrix_mx_puppet_groupme_database_password: "{{ '%s' | format(matrix_homeserver_
 # We don't enable bots by default.
 matrix_bot_matrix_reminder_bot_enabled: false
 
-matrix_bot_matrix_reminder_bot_systemd_required_services_list: |
+matrix_bot_matrix_reminder_bot_systemd_required_services_list_auto: |
   {{
-    ['docker.service']
-    +
-    ['matrix-' + matrix_homeserver_implementation + '.service']
+    matrix_bots_homeserver_systemd_services_list
     +
-    ([devture_postgres_identifier ~ '.service'] if devture_postgres_enabled else [])
-    +
-    (['matrix-nginx-proxy.service'] if matrix_nginx_proxy_enabled else [])
+    ([devture_postgres_identifier ~ '.service'] if devture_postgres_enabled and matrix_bot_matrix_reminder_bot_database_hostname == devture_postgres_connection_hostname else [])
   }}
 
 # Postgres is the default, except if not using internal Postgres server
@@ -1685,6 +1738,18 @@ matrix_bot_matrix_reminder_bot_database_hostname: "{{ devture_postgres_connectio
 matrix_bot_matrix_reminder_bot_database_password: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'reminder.bot.db', rounds=655555) | to_uuid }}"
 matrix_bot_matrix_reminder_bot_container_image_self_build: "{{ matrix_architecture != 'amd64' }}"
 
+matrix_bot_matrix_reminder_bot_container_network: "{{ matrix_bots_container_network }}"
+matrix_bot_matrix_reminder_bot_container_additional_networks_auto: |-
+  {{
+    (
+      ([] if matrix_bots_homeserver_container_network == '' else [matrix_bots_homeserver_container_network])
+      +
+      ([devture_postgres_container_network] if devture_postgres_enabled and matrix_bot_matrix_reminder_bot_database_hostname == devture_postgres_connection_hostname else [])
+    ) | unique
+  }}
+
+matrix_bot_matrix_reminder_bot_matrix_homeserver_url: "{{ matrix_bots_homeserver_client_api_url }}"
+
 ######################################################################
 #
 # /matrix-bot-matrix-reminder-bot
@@ -1938,13 +2003,11 @@ matrix_bot_postmoogle_tls_key: |-
 
 matrix_playbook_bot_postmoogle_traefik_certs_dumper_waiter_services: "{% for domain in matrix_bot_postmoogle_domains %}{{ devture_traefik_certs_dumper_identifier }}-wait-for-domain@{{ domain }}.service {% endfor %}"
 
-matrix_bot_postmoogle_systemd_required_services_list: |
+matrix_bot_postmoogle_systemd_required_services_list_auto: |
   {{
-    ['docker.service']
+    matrix_bots_homeserver_systemd_services_list
     +
-    ([devture_postgres_identifier ~ '.service'] if devture_postgres_enabled else [])
-    +
-    (['matrix-synapse.service'] if matrix_synapse_enabled else [])
+    ([devture_postgres_identifier ~ '.service'] if devture_postgres_enabled and matrix_bot_postmoogle_database_hostname == matrix_bot_postmoogle_database_hostname else [])
     +
     (matrix_playbook_bot_postmoogle_traefik_certs_dumper_waiter_services | trim | split(' ') if matrix_playbook_reverse_proxy_type in ['playbook-managed-traefik', 'other-traefik-container'] and devture_traefik_certs_dumper_enabled else [])
   }}
@@ -1954,6 +2017,19 @@ matrix_bot_postmoogle_database_engine: "{{ 'postgres' if devture_postgres_enable
 matrix_bot_postmoogle_database_hostname: "{{ devture_postgres_connection_hostname if devture_postgres_enabled else '' }}"
 matrix_bot_postmoogle_database_password: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'postmoogle.db', rounds=655555) | to_uuid }}"
 
+matrix_bot_postmoogle_homeserver: "{{ matrix_bots_homeserver_client_api_url }}"
+
+matrix_bot_postmoogle_container_network: "{{ matrix_bots_container_network }}"
+
+matrix_bot_postmoogle_container_additional_networks_auto: |-
+  {{
+    (
+      ([] if matrix_bots_homeserver_container_network == '' else [matrix_bots_homeserver_container_network])
+      +
+      ([devture_postgres_container_network] if devture_postgres_enabled and matrix_bot_matrix_reminder_bot_database_hostname == devture_postgres_connection_hostname else [])
+    ) | unique
+  }}
+
 ######################################################################
 #
 # /matrix-bot-postmoogle
@@ -1972,6 +2048,13 @@ matrix_bot_chatgpt_enabled: false
 
 matrix_bot_chatgpt_container_image_self_build: "{{ matrix_architecture not in ['amd64', 'arm64'] }}"
 
+matrix_bot_chatgpt_container_network: "{{ matrix_bots_container_network }}"
+matrix_bot_chatgpt_container_additional_networks_auto: "{{ [] if matrix_bots_homeserver_container_network == '' else [matrix_bots_homeserver_container_network] }}"
+
+matrix_bot_chatgpt_matrix_homeserver_url: "{{ matrix_bots_homeserver_client_api_url }}"
+
+matrix_bot_chatgpt_systemd_required_services_list_auto: "{{ matrix_bots_homeserver_systemd_services_list }}"
+
 ######################################################################
 #
 # /matrix-bot-chatgpt
@@ -2974,6 +3057,81 @@ matrix_nginx_proxy_access_log_syslog_integration_server_port: "{{ (matrix_promet
 ######################################################################
 
 
+######################################################################
+#                                                                    #
+# matrix-homeserver-proxy                                            #
+#                                                                    #
+######################################################################
+
+# The playbook always enables the homeserver proxy for now.
+# TODO - consider not enabling it if not necessary
+matrix_homeserver_proxy_enabled: true
+
+matrix_homeserver_proxy_access_log_syslog_integration_enabled: "{{ matrix_prometheus_nginxlog_exporter_enabled }}"
+matrix_homeserver_proxy_access_log_syslog_integration_server_port: "{{ (matrix_prometheus_nginxlog_exporter_container_hostname | string + ':' + matrix_prometheus_nginxlog_exporter_container_syslog_port | string) | default('') }}"
+
+matrix_homeserver_proxy_container_additional_networks: |
+  {{
+    (
+      ([matrix_playbook_reverse_proxyable_services_additional_network] if matrix_playbook_reverse_proxyable_services_additional_network else [])
+      +
+      ([
+        {
+          'synapse': matrix_synapse_container_network,
+          'dendrite': matrix_dendrite_container_network,
+          'conduit': matrix_conduit_container_network,
+        }[matrix_homeserver_implementation] | string
+      ])
+    ) | unique
+  }}
+
+matrix_homeserver_proxy_client_api_addr: "{{ 'matrix-corporal:41080' if matrix_corporal_enabled else matrix_homeserver_container_client_api_endpoint }}"
+matrix_homeserver_proxy_client_api_client_max_body_size_mb: |-
+  {{
+    {
+      'synapse': matrix_synapse_max_upload_size_mb,
+      'dendrite': (matrix_dendrite_max_file_size_bytes / 1024 / 1024) | round,
+      'conduit': (matrix_conduit_max_request_size / 1024 / 1024) | round,
+    }[matrix_homeserver_implementation]|int
+  }}
+
+matrix_homeserver_proxy_federation_api_addr: "{{ matrix_homeserver_container_federation_api_endpoint }}"
+
+# matrix_nginx_proxy_proxy_matrix_identity_api_enabled: "{{ matrix_ma1sd_enabled }}"
+# matrix_nginx_proxy_proxy_matrix_identity_api_addr_with_container: "matrix-ma1sd:{{ matrix_ma1sd_container_port }}"
+# matrix_nginx_proxy_proxy_matrix_identity_api_addr_sans_container: "127.0.0.1:{{ matrix_ma1sd_container_port }}"
+
+# # NOTE: we cannot disable this, even though matrix-media-repo is already natively exposed at the Traefik level.
+# # See: https://github.com/spantaleev/matrix-docker-ansible-deploy/pull/3045#issuecomment-1867327001
+# matrix_nginx_proxy_proxy_media_repo_enabled: "{{ matrix_media_repo_enabled }}"
+# matrix_nginx_proxy_proxy_media_repo_addr_with_container: "{{ matrix_media_repo_identifier }}:{{ matrix_media_repo_port }}"
+# matrix_nginx_proxy_proxy_media_repo_addr_sans_container: "127.0.0.1:{{ matrix_media_repo_port }}"
+
+# matrix_nginx_proxy_proxy_matrix_user_directory_search_enabled: "{{ matrix_ma1sd_enabled }}"
+# matrix_nginx_proxy_proxy_matrix_user_directory_search_addr_with_container: "{{ matrix_nginx_proxy_proxy_matrix_identity_api_addr_with_container }}"
+# matrix_nginx_proxy_proxy_matrix_user_directory_search_addr_sans_container: "{{ matrix_nginx_proxy_proxy_matrix_identity_api_addr_sans_container }}"
+
+matrix_homeserver_proxy_systemd_wanted_services_list_auto: |
+  {{
+    matrix_homeserver_systemd_services_list
+    +
+    (['matrix-corporal.service'] if matrix_corporal_enabled else [])
+    +
+    (['matrix-ma1sd.service'] if matrix_ma1sd_enabled else [])
+    +
+    ([(matrix_media_repo_identifier + '.service')] if matrix_media_repo_enabled else [])
+  }}
+
+# matrix_nginx_proxy_access_log_syslog_integration_enabled: "{{ matrix_prometheus_nginxlog_exporter_enabled }}"
+# matrix_nginx_proxy_access_log_syslog_integration_server_port: "{{ (matrix_prometheus_nginxlog_exporter_container_hostname | string +':'+ matrix_prometheus_nginxlog_exporter_container_syslog_port | string) | default('') }}"
+
+######################################################################
+#                                                                    #
+# /matrix-homeserver-proxy                                           #
+#                                                                    #
+######################################################################
+
+
 ########################################################################
 #                                                                      #
 # com.devture.ansible.role.postgres                                    #
@@ -4157,7 +4315,7 @@ matrix_sliding_sync_container_additional_networks: |
     (
       ([matrix_playbook_reverse_proxyable_services_additional_network] if matrix_playbook_reverse_proxyable_services_additional_network else [])
       +
-      ([matrix_nginx_proxy_container_network] if matrix_nginx_proxy_enabled and matrix_nginx_proxy_container_network != matrix_sliding_sync_container_network else [])
+      ([] if matrix_homeserver_container_network in ['', matrix_sliding_sync_container_network] else [matrix_homeserver_container_network])
       +
       ([devture_postgres_container_network] if devture_postgres_enabled and devture_postgres_container_network != matrix_sliding_sync_container_network else [])
     ) | unique
@@ -4172,11 +4330,9 @@ matrix_sliding_sync_systemd_required_services_list: |
   {{
     ['docker.service']
     +
-    ['matrix-' + matrix_homeserver_implementation + '.service']
+    matrix_homeserver_systemd_services_list
     +
     ([devture_postgres_identifier ~ '.service'] if devture_postgres_enabled else [])
-    +
-    (['matrix-nginx-proxy.service'] if matrix_nginx_proxy_enabled else [])
   }}
 
 matrix_sliding_sync_environment_variable_syncv3_secret: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'ss.secret', rounds=655555) | to_uuid }}"
@@ -4184,9 +4340,6 @@ matrix_sliding_sync_environment_variable_syncv3_secret: "{{ '%s' | format(matrix
 matrix_sliding_sync_database_hostname: "{{ devture_postgres_connection_hostname if devture_postgres_enabled else '' }}"
 matrix_sliding_sync_database_password: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'ss.db', rounds=655555) | to_uuid }}"
 
-# Starting from version `0.6.0` conduit natively supports some sync v3 (sliding-sync) features.
-matrix_homeserver_sliding_sync_url: "{{ matrix_sliding_sync_base_url if matrix_sliding_sync_enabled else matrix_homeserver_url if matrix_conduit_enabled else '' }}"
-
 ######################################################################
 #
 # /matrix-sliding-sync
diff --git a/roles/custom/matrix-base/defaults/main.yml b/roles/custom/matrix-base/defaults/main.yml
index 183f1db33..d1967ba51 100644
--- a/roles/custom/matrix-base/defaults/main.yml
+++ b/roles/custom/matrix-base/defaults/main.yml
@@ -19,6 +19,30 @@ matrix_bridges_encryption_enabled: false
 # Global var to enable/disable relay mode across all bridges with relay mode support
 matrix_bridges_relay_enabled: false
 
+# A container network where all bridges would live.
+matrix_bridges_container_network: matrix-bridges
+
+# The container network that the homeserver lives on and bridges should be connected to
+matrix_bridges_homeserver_container_network: "{{ matrix_homeserver_container_network }}"
+
+# The URL where bridges can reach the homeserver.
+matrix_bridges_homeserver_client_api_url: "{{ matrix_homeserver_container_url }}"
+
+# The systemd services (representing the homeserver) that bridges should depend on
+matrix_bridges_homeserver_systemd_services_list: "{{ matrix_homeserver_systemd_services_list }}"
+
+# A container network where all bots would live.
+matrix_bots_container_network: matrix-bots
+
+# The container network that the homeserver lives on and bots should be connected to
+matrix_bots_homeserver_container_network: "{{ matrix_homeserver_container_network }}"
+
+# The URL where bots can reach the homeserver.
+matrix_bots_homeserver_client_api_url: "{{ matrix_homeserver_container_url }}"
+
+# The systemd services (representing the homeserver) that bots should depend on
+matrix_bots_homeserver_systemd_services_list: "{{ matrix_homeserver_systemd_services_list }}"
+
 # matrix_homeserver_enabled controls whether to enable the homeserver systemd service, etc.
 #
 # Unless you're wrapping this playbook in another one
@@ -146,15 +170,27 @@ matrix_host_command_openssl: "/usr/bin/env openssl"
 
 matrix_homeserver_url: "https://{{ matrix_server_fqn_matrix }}"
 
-# Specifies where the homeserver's Client-Server API is on the container network.
+# Specifies on which container network the homeserver is.
+matrix_homeserver_container_network: ""
+
+# Specifies which systemd services are responsible for the homeserver
+matrix_homeserver_systemd_services_list: []
+
+# Specifies where the homeserver's Client-Server API is on the container network (matrix_homeserver_container_network).
+matrix_homeserver_container_url: "http://{{ matrix_homeserver_container_client_api_endpoint }}"
+
+# Specifies where the homeserver's Client-Server API is on the container network (matrix_homeserver_container_network).
 # Where this is depends on whether there's a reverse-proxy in front of the homeserver, which homeserver it is, etc.
 # This likely gets overriden elsewhere.
-matrix_homeserver_container_url: ""
+matrix_homeserver_container_client_api_endpoint: ""
+
+# Specifies where the homeserver's Federation API is on the container network (matrix_homeserver_container_network).
+matrix_homeserver_container_federation_url: "http://{{ matrix_homeserver_container_federation_api_endpoint }}"
 
-# Specifies where the homeserver's Federation API is on the container network.
+# Specifies where the homeserver's Federation API is on the container network (matrix_homeserver_container_network).
 # Where this is depends on whether there's a reverse-proxy in front of the homeserver, which homeserver it is, etc.
 # This likely gets overriden elsewhere.
-matrix_homeserver_container_federation_url: ""
+matrix_homeserver_container_federation_api_endpoint: ""
 
 # Specifies the public url of the Sync v3 (sliding-sync) API.
 # This will be used to set the `org.matrix.msc3575.proxy` property in `/.well-known/matrix/client`.
@@ -294,6 +330,15 @@ matrix_well_known_matrix_support_enabled: false
 matrix_homeserver_container_extra_arguments_auto: []
 matrix_homeserver_app_service_config_files_auto: []
 
+# Controls whether various services should expose metrics publicly.
+# If Prometheus is operating on the same machine, exposing metrics publicly is not necessary.
+matrix_metrics_exposure_enabled: false
+matrix_metrics_exposure_hostname: "{{ matrix_server_fqn_matrix }}"
+matrix_metrics_exposure_path_prefix: /metrics
+matrix_metrics_exposure_http_basic_auth_enabled: false
+# See https://doc.traefik.io/traefik/middlewares/http/basicauth/#users
+matrix_metrics_exposure_http_basic_auth_users: ''
+
 # Specifies the type of reverse-proxy used by the playbook.
 #
 # Changing this has an effect on whether a reverse-proxy is installed at all and what its type is,
diff --git a/roles/custom/matrix-base/tasks/validate_config.yml b/roles/custom/matrix-base/tasks/validate_config.yml
index c663ab2ee..740fc839a 100644
--- a/roles/custom/matrix-base/tasks/validate_config.yml
+++ b/roles/custom/matrix-base/tasks/validate_config.yml
@@ -44,8 +44,8 @@
     - {'var': matrix_domain, 'value': "{{ matrix_domain | default('') }}"}
     - {'var': matrix_server_fqn_matrix, 'value': "{{ matrix_server_fqn_matrix | default('') }}"}
     - {'var': matrix_server_fqn_element, 'value': "{{ matrix_server_fqn_element | default('') }}"}
-    - {'var': matrix_homeserver_container_url, 'value': "{{ matrix_homeserver_container_url | default('') }}"}
-    - {'var': matrix_homeserver_container_federation_url, 'value': "{{ matrix_homeserver_container_federation_url | default('') }}"}
+    - {'var': matrix_homeserver_container_client_api_endpoint, 'value': "{{ matrix_homeserver_container_client_api_endpoint | default('') }}"}
+    - {'var': matrix_homeserver_container_federation_api_endpoint, 'value': "{{ matrix_homeserver_container_federation_api_endpoint | default('') }}"}
     - {'var': matrix_architecture, 'value': "{{ matrix_architecture | default('') }}"}
   when: "item.value is none or item.value == ''"
 
diff --git a/roles/custom/matrix-bot-chatgpt/defaults/main.yml b/roles/custom/matrix-bot-chatgpt/defaults/main.yml
index 823452fc0..957501b01 100644
--- a/roles/custom/matrix-bot-chatgpt/defaults/main.yml
+++ b/roles/custom/matrix-bot-chatgpt/defaults/main.yml
@@ -26,11 +26,20 @@ matrix_bot_chatgpt_container_src_path: "{{ matrix_bot_chatgpt_base_path }}/conta
 # We use a small value here, because this container does not seem to handle the SIGTERM signal.
 matrix_bot_chatgpt_container_stop_grace_time_seconds: 1
 
+matrix_bot_chatgpt_container_network: ""
+
+matrix_bot_chatgpt_container_additional_networks: "{{ matrix_bot_chatgpt_container_additional_networks_auto + matrix_bot_chatgpt_container_additional_networks_custom }}"
+matrix_bot_chatgpt_container_additional_networks_auto: []
+matrix_bot_chatgpt_container_additional_networks_custom: []
+
 # A list of extra arguments to pass to the container
 matrix_bot_chatgpt_container_extra_arguments: []
 
 # List of systemd services that matrix-bot-chatgpt.service depends on
-matrix_bot_chatgpt_systemd_required_services_list: ['docker.service']
+matrix_bot_chatgpt_systemd_required_services_list: "{{ matrix_bot_chatgpt_systemd_required_services_list_default + matrix_bot_chatgpt_systemd_required_services_list_auto + matrix_bot_chatgpt_systemd_required_services_list_custom }}"
+matrix_bot_chatgpt_systemd_required_services_list_default: ['docker.service']
+matrix_bot_chatgpt_systemd_required_services_list_auto: []
+matrix_bot_chatgpt_systemd_required_services_list_custom: []
 
 # List of systemd services that matrix-bot-chatgpt.service wants
 matrix_bot_chatgpt_systemd_wanted_services_list: []
@@ -47,7 +56,7 @@ matrix_bot_chatgpt_keyv_bot_storage: true
 
 # Matrix Static Settings (required, see notes)
 # Defaults to "https://matrix.org"
-matrix_bot_chatgpt_matrix_homeserver_url: "{{ matrix_homeserver_container_url }}"  # MATRIX_HOMESERVER_URL=
+matrix_bot_chatgpt_matrix_homeserver_url: ""  # MATRIX_HOMESERVER_URL=
 # With the @ and :DOMAIN, ie @SOMETHING:DOMAIN, needs to be set, created manually beforehand.
 matrix_bot_chatgpt_matrix_bot_username_localpart: 'bot.chatgpt'
 matrix_bot_chatgpt_matrix_bot_username: "@{{ matrix_bot_chatgpt_matrix_bot_username_localpart }}:{{ matrix_domain }}"  # MATRIX_BOT_USERNAME=
diff --git a/roles/custom/matrix-bot-chatgpt/tasks/install.yml b/roles/custom/matrix-bot-chatgpt/tasks/install.yml
index ef31df066..c637e167c 100644
--- a/roles/custom/matrix-bot-chatgpt/tasks/install.yml
+++ b/roles/custom/matrix-bot-chatgpt/tasks/install.yml
@@ -56,6 +56,11 @@
           path: "{{ matrix_bot_chatgpt_container_src_path }}"
           pull: true
 
+- name: Ensure chatgpt container network is created
+  community.general.docker_network:
+    name: "{{ matrix_bot_chatgpt_container_network }}"
+    driver: bridge
+
 - name: Ensure matrix-bot-chatgpt.service installed
   ansible.builtin.template:
     src: "{{ role_path }}/templates/systemd/matrix-bot-chatgpt.service.j2"
diff --git a/roles/custom/matrix-bot-chatgpt/tasks/validate_config.yml b/roles/custom/matrix-bot-chatgpt/tasks/validate_config.yml
index c6771823e..44f103e01 100644
--- a/roles/custom/matrix-bot-chatgpt/tasks/validate_config.yml
+++ b/roles/custom/matrix-bot-chatgpt/tasks/validate_config.yml
@@ -8,6 +8,8 @@
   with_items:
     - {'name': 'matrix_bot_chatgpt_openai_api_key', when: true}
     - {'name': 'matrix_bot_chatgpt_matrix_bot_username', when: true}
+    - {'name': 'matrix_bot_chatgpt_container_network', when: true}
+    - {'name': 'matrix_bot_chatgpt_matrix_homeserver_url', when: true}
 
 - name: Fail if OpenAI configuration not up-to-date.
   ansible.builtin.fail:
diff --git a/roles/custom/matrix-bot-chatgpt/templates/systemd/matrix-bot-chatgpt.service.j2 b/roles/custom/matrix-bot-chatgpt/templates/systemd/matrix-bot-chatgpt.service.j2
index e27b018f5..01b0763a4 100644
--- a/roles/custom/matrix-bot-chatgpt/templates/systemd/matrix-bot-chatgpt.service.j2
+++ b/roles/custom/matrix-bot-chatgpt/templates/systemd/matrix-bot-chatgpt.service.j2
@@ -16,7 +16,7 @@ Environment="HOME={{ devture_systemd_docker_base_systemd_unit_home_path }}"
 ExecStartPre=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} stop --time={{ matrix_bot_chatgpt_container_stop_grace_time_seconds }} matrix-bot-chatgpt 2>/dev/null || true'
 ExecStartPre=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} rm matrix-bot-chatgpt 2>/dev/null || true'
 
-ExecStart={{ devture_systemd_docker_base_host_command_docker }} run \
+ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} create \
 			--rm \
 			--name=matrix-bot-chatgpt \
 			--log-driver=none \
@@ -24,7 +24,7 @@ ExecStart={{ devture_systemd_docker_base_host_command_docker }} run \
 			--cap-drop=ALL \
 			--read-only \
 			--tmpfs /tmp \
-			--network={{ matrix_docker_network }} \
+			--network={{ matrix_bot_chatgpt_container_network }} \
 			--env-file={{ matrix_bot_chatgpt_config_path }}/env \
 			--mount type=bind,src={{ matrix_bot_chatgpt_data_path }},dst=/data \
 			--env HOME=/data/home \
@@ -33,6 +33,12 @@ ExecStart={{ devture_systemd_docker_base_host_command_docker }} run \
 			{% endfor %}
 			{{ matrix_bot_chatgpt_container_image }}
 
+{% for network in matrix_bot_chatgpt_container_additional_networks %}
+ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} network connect {{ network }} matrix-bot-chatgpt
+{% endfor %}
+
+ExecStart={{ devture_systemd_docker_base_host_command_docker }} start --attach matrix-bot-chatgpt
+
 ExecStop=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} stop --time={{ matrix_bot_chatgpt_container_stop_grace_time_seconds }} matrix-bot-chatgpt 2>/dev/null || true'
 ExecStop=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} rm matrix-bot-chatgpt 2>/dev/null || true'
 Restart=always
diff --git a/roles/custom/matrix-bot-matrix-reminder-bot/defaults/main.yml b/roles/custom/matrix-bot-matrix-reminder-bot/defaults/main.yml
index 2f43024a3..21275a430 100644
--- a/roles/custom/matrix-bot-matrix-reminder-bot/defaults/main.yml
+++ b/roles/custom/matrix-bot-matrix-reminder-bot/defaults/main.yml
@@ -24,13 +24,21 @@ matrix_bot_matrix_reminder_bot_command_prefix: "!"
 # A list of extra arguments to pass to the container
 matrix_bot_matrix_reminder_bot_container_extra_arguments: []
 
+matrix_bot_matrix_reminder_bot_container_network: ""
+
+matrix_bot_matrix_reminder_bot_container_additional_networks: "{{ matrix_bot_matrix_reminder_bot_container_additional_networks_auto + matrix_bot_matrix_reminder_bot_container_additional_networks_custom }}"
+matrix_bot_matrix_reminder_bot_container_additional_networks_auto: []
+matrix_bot_matrix_reminder_bot_container_additional_networks_custom: []
+
 # List of systemd services that matrix-bot-matrix-reminder-bot.service depends on
-matrix_bot_matrix_reminder_bot_systemd_required_services_list: ['docker.service']
+matrix_bot_matrix_reminder_bot_systemd_required_services_list: "{{ matrix_bot_matrix_reminder_bot_systemd_required_services_list_default + matrix_bot_matrix_reminder_bot_systemd_required_services_list_auto + matrix_bot_matrix_reminder_bot_systemd_required_services_list_custom }}"
+matrix_bot_matrix_reminder_bot_systemd_required_services_list_default: ['docker.service']
+matrix_bot_matrix_reminder_bot_systemd_required_services_list_auto: []
+matrix_bot_matrix_reminder_bot_systemd_required_services_list_custom: []
 
 # List of systemd services that matrix-bot-matrix-reminder-bot.service wants
 matrix_bot_matrix_reminder_bot_systemd_wanted_services_list: []
 
-
 # Database-related configuration fields.
 #
 # To use SQLite, stick to these defaults.
@@ -68,7 +76,7 @@ matrix_bot_matrix_reminder_bot_matrix_user_id: '@{{ matrix_bot_matrix_reminder_b
 # The password that the bot uses to authenticate.
 matrix_bot_matrix_reminder_bot_matrix_user_password: ''
 
-matrix_bot_matrix_reminder_bot_matrix_homeserver_url: "{{ matrix_homeserver_container_url }}"
+matrix_bot_matrix_reminder_bot_matrix_homeserver_url: ""
 
 # The timezone to use when creating reminders.
 # Examples: 'Europe/London', 'Etc/UTC'
diff --git a/roles/custom/matrix-bot-matrix-reminder-bot/tasks/validate_config.yml b/roles/custom/matrix-bot-matrix-reminder-bot/tasks/validate_config.yml
index f6e7afdf6..072e392bd 100644
--- a/roles/custom/matrix-bot-matrix-reminder-bot/tasks/validate_config.yml
+++ b/roles/custom/matrix-bot-matrix-reminder-bot/tasks/validate_config.yml
@@ -8,6 +8,8 @@
   with_items:
     - {'name': 'matrix_bot_matrix_reminder_bot_matrix_user_password', when: true}
     - {'name': 'matrix_bot_matrix_reminder_bot_reminders_timezone', when: true}
+    - {'name': 'matrix_bot_matrix_reminder_bot_container_network', when: true}
+    - {'name': 'matrix_bot_matrix_reminder_bot_matrix_homeserver_url', when: true}
     - {'name': 'matrix_bot_matrix_reminder_bot_database_hostname', when: "{{ matrix_bot_matrix_reminder_bot_database_engine == 'postgres' }}"}
 
 - name: (Deprecation) Catch and report renamed matrix-reminder-bot settings
diff --git a/roles/custom/matrix-bot-matrix-reminder-bot/templates/systemd/matrix-bot-matrix-reminder-bot.service.j2 b/roles/custom/matrix-bot-matrix-reminder-bot/templates/systemd/matrix-bot-matrix-reminder-bot.service.j2
index 70c02224a..ecd59bd7b 100644
--- a/roles/custom/matrix-bot-matrix-reminder-bot/templates/systemd/matrix-bot-matrix-reminder-bot.service.j2
+++ b/roles/custom/matrix-bot-matrix-reminder-bot/templates/systemd/matrix-bot-matrix-reminder-bot.service.j2
@@ -16,12 +16,14 @@ Environment="HOME={{ devture_systemd_docker_base_systemd_unit_home_path }}"
 ExecStartPre=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} stop --time={{ devture_systemd_docker_base_container_stop_grace_time_seconds }} matrix-bot-matrix-reminder-bot 2>/dev/null || true'
 ExecStartPre=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} rm matrix-bot-matrix-reminder-bot 2>/dev/null || true'
 
-ExecStart={{ devture_systemd_docker_base_host_command_docker }} run --rm --name matrix-bot-matrix-reminder-bot \
+ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} create \
+			--rm \
+			--name=matrix-bot-matrix-reminder-bot \
 			--log-driver=none \
 			--user={{ matrix_user_uid }}:{{ matrix_user_gid }} \
 			--cap-drop=ALL \
 			--read-only \
-			--network={{ matrix_docker_network }} \
+			--network={{ matrix_bot_matrix_reminder_bot_container_network }} \
 			-e 'TZ={{ matrix_bot_matrix_reminder_bot_reminders_timezone }}' \
 			--mount type=bind,src={{ matrix_bot_matrix_reminder_bot_config_path }},dst=/config,ro \
 			--mount type=bind,src={{ matrix_bot_matrix_reminder_bot_data_path }},dst=/data \
@@ -32,6 +34,12 @@ ExecStart={{ devture_systemd_docker_base_host_command_docker }} run --rm --name
 			{{ matrix_bot_matrix_reminder_bot_docker_image }} \
 			-c "matrix-reminder-bot /config/config.yaml"
 
+{% for network in matrix_bot_matrix_reminder_bot_container_additional_networks %}
+ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} network connect {{ network }} matrix-bot-matrix-reminder-bot
+{% endfor %}
+
+ExecStart={{ devture_systemd_docker_base_host_command_docker }} start --attach matrix-bot-matrix-reminder-bot
+
 ExecStop=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} stop --time={{ devture_systemd_docker_base_container_stop_grace_time_seconds }} matrix-bot-matrix-reminder-bot 2>/dev/null || true'
 ExecStop=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} rm matrix-bot-matrix-reminder-bot 2>/dev/null || true'
 Restart=always
diff --git a/roles/custom/matrix-bot-postmoogle/defaults/main.yml b/roles/custom/matrix-bot-postmoogle/defaults/main.yml
index 580dcfed5..fc7d9749a 100644
--- a/roles/custom/matrix-bot-postmoogle/defaults/main.yml
+++ b/roles/custom/matrix-bot-postmoogle/defaults/main.yml
@@ -19,16 +19,24 @@ matrix_bot_postmoogle_base_path: "{{ matrix_base_data_path }}/postmoogle"
 matrix_bot_postmoogle_config_path: "{{ matrix_bot_postmoogle_base_path }}/config"
 matrix_bot_postmoogle_data_path: "{{ matrix_bot_postmoogle_base_path }}/data"
 
+matrix_bot_postmoogle_container_network: ""
+
+matrix_bot_postmoogle_container_additional_networks: "{{ matrix_bot_postmoogle_container_additional_networks_auto + matrix_bot_postmoogle_container_additional_networks_custom }}"
+matrix_bot_postmoogle_container_additional_networks_auto: []
+matrix_bot_postmoogle_container_additional_networks_custom: []
+
 # A list of extra arguments to pass to the container
 matrix_bot_postmoogle_container_extra_arguments: []
 
 # List of systemd services that matrix-bot-postmoogle.service depends on
-matrix_bot_postmoogle_systemd_required_services_list: ['docker.service']
+matrix_bot_postmoogle_systemd_required_services_list: "{{ matrix_bot_postmoogle_systemd_required_services_list_default + matrix_bot_postmoogle_systemd_required_services_list_auto + matrix_bot_postmoogle_systemd_required_services_list_custom }}"
+matrix_bot_postmoogle_systemd_required_services_list_default: ['docker.service']
+matrix_bot_postmoogle_systemd_required_services_list_auto: []
+matrix_bot_postmoogle_systemd_required_services_list_custom: []
 
 # List of systemd services that matrix-bot-postmoogle.service wants
 matrix_bot_postmoogle_systemd_wanted_services_list: []
 
-
 # Database-related configuration fields.
 #
 # To use SQLite, stick to these defaults.
@@ -75,7 +83,7 @@ matrix_bot_postmoogle_password: ''
 # Alternative to password - shared secret requires matrix_bot_postmoogle_login to be MXID
 matrix_bot_postmoogle_sharedsecret: ''
 
-matrix_bot_postmoogle_homeserver: "{{ matrix_homeserver_container_url }}"
+matrix_bot_postmoogle_homeserver: ""
 
 # Command prefix
 matrix_bot_postmoogle_prefix: '!pm'
diff --git a/roles/custom/matrix-bot-postmoogle/tasks/setup_install.yml b/roles/custom/matrix-bot-postmoogle/tasks/setup_install.yml
index ed2bcc9d6..265400d81 100644
--- a/roles/custom/matrix-bot-postmoogle/tasks/setup_install.yml
+++ b/roles/custom/matrix-bot-postmoogle/tasks/setup_install.yml
@@ -79,6 +79,11 @@
       pull: true
   when: "matrix_bot_postmoogle_container_image_self_build | bool"
 
+- name: Ensure postmoogle container network is created
+  community.general.docker_network:
+    name: "{{ matrix_bot_postmoogle_container_network }}"
+    driver: bridge
+
 - name: Ensure matrix-bot-postmoogle.service installed
   ansible.builtin.template:
     src: "{{ role_path }}/templates/systemd/matrix-bot-postmoogle.service.j2"
diff --git a/roles/custom/matrix-bot-postmoogle/tasks/validate_config.yml b/roles/custom/matrix-bot-postmoogle/tasks/validate_config.yml
index 1e31bd4f6..77f03356a 100644
--- a/roles/custom/matrix-bot-postmoogle/tasks/validate_config.yml
+++ b/roles/custom/matrix-bot-postmoogle/tasks/validate_config.yml
@@ -7,4 +7,6 @@
   when: "item.when | bool and vars[item.name] == ''"
   with_items:
     - {'name': 'matrix_bot_postmoogle_password', when: true}
+    - {'name': 'matrix_bot_postmoogle_container_network', when: true}
+    - {'name': 'matrix_bot_postmoogle_homeserver', when: true}
     - {'name': 'matrix_bot_postmoogle_database_hostname', when: "{{ matrix_bot_postmoogle_database_engine == 'postgres' }}"}
diff --git a/roles/custom/matrix-bot-postmoogle/templates/systemd/matrix-bot-postmoogle.service.j2 b/roles/custom/matrix-bot-postmoogle/templates/systemd/matrix-bot-postmoogle.service.j2
index 17ebece27..4f6d0ced2 100644
--- a/roles/custom/matrix-bot-postmoogle/templates/systemd/matrix-bot-postmoogle.service.j2
+++ b/roles/custom/matrix-bot-postmoogle/templates/systemd/matrix-bot-postmoogle.service.j2
@@ -16,12 +16,14 @@ Environment="HOME={{ devture_systemd_docker_base_systemd_unit_home_path }}"
 ExecStartPre=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} stop --time={{ devture_systemd_docker_base_container_stop_grace_time_seconds }} matrix-bot-postmoogle 2>/dev/null || true'
 ExecStartPre=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} rm matrix-bot-postmoogle 2>/dev/null || true'
 
-ExecStart={{ devture_systemd_docker_base_host_command_docker }} run --rm --name matrix-bot-postmoogle \
+ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} create \
+			--rm \
+			--name=matrix-bot-postmoogle \
 			--log-driver=none \
 			--user={{ matrix_user_uid }}:{{ matrix_user_gid }} \
 			--cap-drop=ALL \
 			--read-only \
-			--network={{ matrix_docker_network }} \
+			--network={{ matrix_bot_postmoogle_container_network }} \
 			--env-file={{ matrix_bot_postmoogle_config_path }}/env \
 			-p {{ matrix_bot_postmoogle_smtp_host_bind_port }}:{{ matrix_bot_postmoogle_port }} \
 			{% if matrix_bot_postmoogle_ssl_path %}
@@ -36,6 +38,12 @@ ExecStart={{ devture_systemd_docker_base_host_command_docker }} run --rm --name
 			{% endfor %}
 			{{ matrix_bot_postmoogle_docker_image }}
 
+{% for network in matrix_bot_postmoogle_container_additional_networks %}
+ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} network connect {{ network }} matrix-bot-postmoogle
+{% endfor %}
+
+ExecStart={{ devture_systemd_docker_base_host_command_docker }} start --attach matrix-bot-postmoogle
+
 ExecStop=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} stop --time={{ devture_systemd_docker_base_container_stop_grace_time_seconds }} matrix-bot-postmoogle 2>/dev/null || true'
 ExecStop=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} rm matrix-bot-postmoogle 2>/dev/null || true'
 Restart=always
diff --git a/roles/custom/matrix-bridge-hookshot/defaults/main.yml b/roles/custom/matrix-bridge-hookshot/defaults/main.yml
index 7d6c4e7df..378ca0a77 100644
--- a/roles/custom/matrix-bridge-hookshot/defaults/main.yml
+++ b/roles/custom/matrix-bridge-hookshot/defaults/main.yml
@@ -224,7 +224,10 @@ matrix_hookshot_container_network: "{{ matrix_docker_network }}"
 matrix_hookshot_container_extra_arguments: []
 
 # List of systemd services that service depends on.
-matrix_hookshot_systemd_required_services_list: ['docker.service']
+matrix_hookshot_systemd_required_services_list: "{{ matrix_hookshot_systemd_required_services_list_default + matrix_hookshot_systemd_required_services_list_auto + matrix_hookshot_systemd_required_services_list_custom }}"
+matrix_hookshot_systemd_required_services_list_default: ['docker.service']
+matrix_hookshot_systemd_required_services_list_auto: []
+matrix_hookshot_systemd_required_services_list_custom: []
 
 # List of systemd services that service wants
 matrix_hookshot_systemd_wanted_services_list: []
diff --git a/roles/custom/matrix-bridge-hookshot/tasks/main.yml b/roles/custom/matrix-bridge-hookshot/tasks/main.yml
index 44ad5229b..8a98ee999 100644
--- a/roles/custom/matrix-bridge-hookshot/tasks/main.yml
+++ b/roles/custom/matrix-bridge-hookshot/tasks/main.yml
@@ -18,8 +18,10 @@
 - tags:
     - setup-all
     - setup-hookshot
+    - setup-bridge-hookshot
     - install-all
     - install-hookshot
+    - install-bridge-hookshot
   block:
     - when: matrix_hookshot_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/validate_config.yml"
@@ -30,6 +32,7 @@
 - tags:
     - setup-all
     - setup-hookshot
+    - setup-bridge-hookshot
   block:
     - when: not matrix_hookshot_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_uninstall.yml"
diff --git a/roles/custom/matrix-bridge-mautrix-facebook/defaults/main.yml b/roles/custom/matrix-bridge-mautrix-facebook/defaults/main.yml
index 9d9439b38..ae6fe7dc5 100644
--- a/roles/custom/matrix-bridge-mautrix-facebook/defaults/main.yml
+++ b/roles/custom/matrix-bridge-mautrix-facebook/defaults/main.yml
@@ -20,22 +20,69 @@ matrix_mautrix_facebook_docker_src_files_path: "{{ matrix_mautrix_facebook_base_
 
 matrix_mautrix_facebook_command_prefix: "!fb"
 
-# Whether or not the public-facing endpoints should be enabled (web-based login)
-matrix_mautrix_facebook_appservice_public_enabled: true
+matrix_mautrix_facebook_homeserver_address: "{{ matrix_homeserver_container_url }}"
+matrix_mautrix_facebook_homeserver_domain: '{{ matrix_domain }}'
 
+# Whether or not the public-facing endpoints should be enabled (web-based login)
+matrix_mautrix_facebook_appservice_public_enabled: false
 # Mautrix Facebook public endpoint to log in to Facebook
-matrix_mautrix_facebook_public_endpoint: ''
+matrix_mautrix_facebook_appservice_public_prefix: ''
+matrix_mautrix_facebook_appservice_public_hostname: ''
+matrix_mautrix_facebook_appservice_public_external: "{{ ('https://' + matrix_mautrix_facebook_appservice_public_hostname + matrix_mautrix_facebook_appservice_public_prefix) if matrix_mautrix_facebook_appservice_public_enabled else '' }}"
 
-matrix_mautrix_facebook_homeserver_address: "{{ matrix_homeserver_container_url }}"
-matrix_mautrix_facebook_homeserver_domain: '{{ matrix_domain }}'
 matrix_mautrix_facebook_appservice_address: 'http://matrix-mautrix-facebook:29319'
-matrix_mautrix_facebook_appservice_public_external: 'https://{{ matrix_server_fqn_matrix }}{{ matrix_mautrix_facebook_public_endpoint }}'
+
+matrix_mautrix_facebook_container_network: ""
+
+matrix_mautrix_facebook_container_additional_networks: "{{ matrix_mautrix_facebook_container_additional_networks_auto + matrix_mautrix_facebook_container_additional_networks_custom }}"
+matrix_mautrix_facebook_container_additional_networks_auto: []
+matrix_mautrix_facebook_container_additional_networks_custom: []
 
 # A list of extra arguments to pass to the container
 matrix_mautrix_facebook_container_extra_arguments: []
 
+# matrix_mautrix_facebook_container_labels_traefik_enabled controls whether labels to assist a Traefik reverse-proxy will be attached to the container.
+# See `../templates/labels.j2` for details.
+#
+# To inject your own other container labels, see `matrix_mautrix_facebook_container_labels_additional_labels`.
+matrix_mautrix_facebook_container_labels_traefik_enabled: true
+matrix_mautrix_facebook_container_labels_traefik_docker_network: "{{ matrix_mautrix_facebook_container_network }}"
+matrix_mautrix_facebook_container_labels_traefik_entrypoints: web-secure
+matrix_mautrix_facebook_container_labels_traefik_tls_certResolver: default
+
+# Controls whether labels will be added that expose mautrix-facebook's public endpoint
+matrix_mautrix_facebook_container_labels_public_endpoint_enabled: "{{ matrix_mautrix_facebook_appservice_public_enabled }}"
+matrix_mautrix_facebook_container_labels_public_endpoint_traefik_rule: "Host(`{{ matrix_mautrix_facebook_appservice_public_hostname }}`) && PathPrefix(`{{ matrix_mautrix_facebook_appservice_public_prefix }}`)"
+matrix_mautrix_facebook_container_labels_public_endpoint_traefik_priority: 0
+matrix_mautrix_facebook_container_labels_public_endpoint_traefik_entrypoints: "{{ matrix_mautrix_facebook_container_labels_traefik_entrypoints }}"
+matrix_mautrix_facebook_container_labels_public_endpoint_traefik_tls: "{{ matrix_mautrix_facebook_container_labels_public_endpoint_traefik_entrypoints != 'web' }}"
+matrix_mautrix_facebook_container_labels_public_endpoint_traefik_tls_certResolver: "{{ matrix_mautrix_facebook_container_labels_traefik_tls_certResolver }}"  # noqa var-naming
+
+# Controls whether labels will be added that expose mautrix-facebook's metrics
+matrix_mautrix_facebook_container_labels_metrics_enabled: "{{ matrix_mautrix_facebook_metrics_enabled and matrix_mautrix_facebook_metrics_proxying_enabled }}"
+matrix_mautrix_facebook_container_labels_metrics_traefik_rule: "Host(`{{ matrix_mautrix_facebook_metrics_proxying_hostname }}`) && PathPrefix(`{{ matrix_mautrix_facebook_metrics_proxying_path_prefix }}`)"
+matrix_mautrix_facebook_container_labels_metrics_traefik_priority: 0
+matrix_mautrix_facebook_container_labels_metrics_traefik_entrypoints: "{{ matrix_mautrix_facebook_container_labels_traefik_entrypoints }}"
+matrix_mautrix_facebook_container_labels_metrics_traefik_tls: "{{ matrix_mautrix_facebook_container_labels_public_endpoint_traefik_entrypoints != 'web' }}"
+matrix_mautrix_facebook_container_labels_metrics_traefik_tls_certResolver: "{{ matrix_mautrix_facebook_container_labels_traefik_tls_certResolver }}"  # noqa var-naming
+matrix_mautrix_facebook_container_labels_metrics_middleware_basic_auth_enabled: false
+# See: https://doc.traefik.io/traefik/middlewares/http/basicauth/#users
+matrix_mautrix_facebook_container_labels_metrics_middleware_basic_auth_users: ''
+
+# matrix_mautrix_facebook_container_labels_additional_labels contains a multiline string with additional labels to add to the container label file.
+# See `../templates/labels.j2` for details.
+#
+# Example:
+# matrix_mautrix_facebook_container_labels_additional_labels: |
+#   my.label=1
+#   another.label="here"
+matrix_mautrix_facebook_container_labels_additional_labels: ''
+
 # List of systemd services that matrix-mautrix-facebook.service depends on.
-matrix_mautrix_facebook_systemd_required_services_list: ['docker.service']
+matrix_mautrix_facebook_systemd_required_services_list: "{{ matrix_mautrix_facebook_systemd_required_services_list_default + matrix_mautrix_facebook_systemd_required_services_list_auto + matrix_mautrix_facebook_systemd_required_services_list_custom }}"
+matrix_mautrix_facebook_systemd_required_services_list_default: ['docker.service']
+matrix_mautrix_facebook_systemd_required_services_list_auto: []
+matrix_mautrix_facebook_systemd_required_services_list_custom: []
 
 # List of systemd services that matrix-mautrix-facebook.service wants
 matrix_mautrix_facebook_systemd_wanted_services_list: []
@@ -52,10 +99,10 @@ matrix_mautrix_facebook_federate_rooms: true
 # If metrics need to be consumed by another (external) Prometheus server, consider exposing them via `matrix_mautrix_facebook_metrics_proxying_enabled`.
 matrix_mautrix_facebook_metrics_enabled: false
 
-# Controls whether metrics should be proxied (exposed) on `matrix.DOMAIN/metrics/mautrix-facebook`.
-# This will only work take effect if `matrix_nginx_proxy_proxy_matrix_metrics_enabled: true`.
-# See the `matrix-nginx-proxy` role for details about enabling `matrix_nginx_proxy_proxy_matrix_metrics_enabled`.
+# Controls whether metrics should be exposed on `matrix.DOMAIN/metrics/mautrix-facebook`.
 matrix_mautrix_facebook_metrics_proxying_enabled: false
+matrix_mautrix_facebook_metrics_proxying_hostname: ''
+matrix_mautrix_facebook_metrics_proxying_path_prefix: ''
 
 matrix_mautrix_facebook_bridge_permissions: |
   {{
diff --git a/roles/custom/matrix-bridge-mautrix-facebook/tasks/inject_into_nginx_proxy.yml b/roles/custom/matrix-bridge-mautrix-facebook/tasks/inject_into_nginx_proxy.yml
deleted file mode 100644
index 17e2b138d..000000000
--- a/roles/custom/matrix-bridge-mautrix-facebook/tasks/inject_into_nginx_proxy.yml
+++ /dev/null
@@ -1,69 +0,0 @@
----
-
-- name: Fail if matrix-nginx-proxy role already executed
-  ansible.builtin.fail:
-    msg: >-
-      Trying to append Mautrix Facebook's reverse-proxying configuration to matrix-nginx-proxy,
-      but it's pointless since the matrix-nginx-proxy role had already executed.
-      To fix this, please change the order of roles in your playbook,
-      so that the matrix-nginx-proxy role would run after the matrix-bridge-mautrix-facebook role.
-  when: matrix_nginx_proxy_role_executed | default(False) | bool
-
-- name: Generate Mautrix Facebook proxying configuration for matrix-nginx-proxy
-  ansible.builtin.set_fact:
-    matrix_mautrix_facebook_matrix_nginx_proxy_configuration: |
-      location {{ matrix_mautrix_facebook_public_endpoint }} {
-      {% if matrix_nginx_proxy_enabled | default(False) %}
-          {# Use the embedded DNS resolver in Docker containers to discover the service #}
-          resolver 127.0.0.11 valid=5s;
-          set $backend "matrix-mautrix-facebook:29319";
-          proxy_pass http://$backend;
-      {% else %}
-          {# Generic configuration for use outside of our container setup #}
-          proxy_pass http://127.0.0.1:9008;
-      {% endif %}
-      }
-
-- name: Register Mautrix Facebook proxying configuration with matrix-nginx-proxy
-  ansible.builtin.set_fact:
-    matrix_nginx_proxy_proxy_matrix_additional_server_configuration_blocks: |
-      {{
-        matrix_nginx_proxy_proxy_matrix_additional_server_configuration_blocks | default([])
-        +
-        [matrix_mautrix_facebook_matrix_nginx_proxy_configuration]
-      }}
-
-- name: Warn about reverse-proxying if matrix-nginx-proxy not used
-  ansible.builtin.debug:
-    msg: >-
-      NOTE: You've enabled the Mautrix Facebook bridge but are not using the matrix-nginx-proxy
-      reverse proxy.
-      Please make sure that you're proxying the `{{ matrix_mautrix_facebook_public_endpoint }}`
-      URL endpoint to the matrix-mautrix-facebook container.
-      You can expose the container's port using the `matrix_mautrix_facebook_container_http_host_bind_port` variable.
-  when: "not matrix_nginx_proxy_enabled | default(False) | bool"
-
-- when: matrix_mautrix_facebook_metrics_proxying_enabled | bool
-  block:
-    - name: Generate mautrix-facebook metrics proxying configuration for matrix-nginx-proxy (matrix.DOMAIN/metrics/mautrix-facebook)
-      ansible.builtin.set_fact:
-        matrix_mautrix_facebook_nginx_metrics_configuration_block: |
-          location /metrics/mautrix-facebook {
-            {% if matrix_nginx_proxy_enabled | default(False) %}
-              {# Use the embedded DNS resolver in Docker containers to discover the service #}
-              resolver 127.0.0.11 valid=5s;
-              set $backend "matrix-mautrix-facebook:8000";
-              proxy_pass http://$backend/metrics;
-            {% else %}
-              return 404 "matrix-nginx-proxy is disabled and no host port was bound to the container, so metrics are unavailable";
-            {% endif %}
-          }
-
-    - name: Register mautrix-facebook metrics proxying configuration with matrix-nginx-proxy (matrix.DOMAIN/metrics/mautrix-facebook)
-      ansible.builtin.set_fact:
-        matrix_nginx_proxy_proxy_matrix_metrics_additional_system_location_configuration_blocks: |
-          {{
-            matrix_nginx_proxy_proxy_matrix_metrics_additional_system_location_configuration_blocks | default([])
-            +
-            [matrix_mautrix_facebook_nginx_metrics_configuration_block]
-          }}
diff --git a/roles/custom/matrix-bridge-mautrix-facebook/tasks/main.yml b/roles/custom/matrix-bridge-mautrix-facebook/tasks/main.yml
index 110346682..d26ce1733 100644
--- a/roles/custom/matrix-bridge-mautrix-facebook/tasks/main.yml
+++ b/roles/custom/matrix-bridge-mautrix-facebook/tasks/main.yml
@@ -1,14 +1,5 @@
 ---
 
-- tags:
-    - setup-all
-    - setup-nginx-proxy
-    - install-all
-    - install-nginx-proxy
-  block:
-    - when: matrix_mautrix_facebook_enabled | bool and matrix_mautrix_facebook_appservice_public_enabled | bool
-      ansible.builtin.include_tasks: "{{ role_path }}/tasks/inject_into_nginx_proxy.yml"
-
 - tags:
     - setup-all
     - setup-mautrix-facebook
diff --git a/roles/custom/matrix-bridge-mautrix-facebook/tasks/setup_install.yml b/roles/custom/matrix-bridge-mautrix-facebook/tasks/setup_install.yml
index fac1d1d2b..36a643661 100644
--- a/roles/custom/matrix-bridge-mautrix-facebook/tasks/setup_install.yml
+++ b/roles/custom/matrix-bridge-mautrix-facebook/tasks/setup_install.yml
@@ -113,6 +113,16 @@
     owner: "{{ matrix_user_username }}"
     group: "{{ matrix_user_groupname }}"
 
+- name: Ensure mautrix-facebook support files installed
+  ansible.builtin.template:
+    src: "{{ role_path }}/templates/{{ item }}.j2"
+    dest: "{{ matrix_mautrix_facebook_base_path }}/{{ item }}"
+    mode: 0640
+    owner: "{{ matrix_user_username }}"
+    group: "{{ matrix_user_groupname }}"
+  with_items:
+    - labels
+
 - name: Ensure matrix-mautrix-facebook.service installed
   ansible.builtin.template:
     src: "{{ role_path }}/templates/systemd/matrix-mautrix-facebook.service.j2"
diff --git a/roles/custom/matrix-bridge-mautrix-facebook/tasks/validate_config.yml b/roles/custom/matrix-bridge-mautrix-facebook/tasks/validate_config.yml
index d61981a67..707979972 100644
--- a/roles/custom/matrix-bridge-mautrix-facebook/tasks/validate_config.yml
+++ b/roles/custom/matrix-bridge-mautrix-facebook/tasks/validate_config.yml
@@ -1,14 +1,28 @@
 ---
 
+- name: (Deprecation) Catch and report renamed mautrix-facebook settings
+  ansible.builtin.fail:
+    msg: >-
+      Your configuration contains a variable, which now has a different name.
+      Please change your configuration to rename the variable (`{{ item.old }}` -> `{{ item.new }}`).
+  when: "item.old in vars"
+  with_items:
+    - {'old': 'matrix_mautrix_facebook_public_endpoint', 'new': 'matrix_mautrix_facebook_appservice_public_prefix'}
+
 - name: Fail if required mautrix-facebook settings not defined
   ansible.builtin.fail:
     msg: >-
       You need to define a required configuration setting (`{{ item.name }}`).
   when: "item.when | bool and vars[item.name] == ''"
   with_items:
-    - {'name': 'matrix_mautrix_facebook_public_endpoint', when: true}
+    - {'name': 'matrix_mautrix_facebook_appservice_public_hostname', when: "{{ matrix_mautrix_facebook_appservice_public_enabled }}"}
+    - {'name': 'matrix_mautrix_facebook_appservice_public_prefix', when: "{{ matrix_mautrix_facebook_appservice_public_enabled }}"}
+    - {'name': 'matrix_mautrix_facebook_metrics_proxying_hostname', when: "{{ matrix_mautrix_facebook_metrics_enabled }}"}
+    - {'name': 'matrix_mautrix_facebook_metrics_proxying_path_prefix', when: "{{ matrix_mautrix_facebook_metrics_enabled }}"}
     - {'name': 'matrix_mautrix_facebook_appservice_token', when: true}
     - {'name': 'matrix_mautrix_facebook_homeserver_token', when: true}
+    - {'name': 'matrix_mautrix_facebook_container_network', when: true}
+    - {'name': 'matrix_mautrix_facebook_homeserver_address', when: true}
     - {'name': 'matrix_mautrix_facebook_database_hostname', when: "{{ matrix_mautrix_facebook_database_engine == 'postgres' }}"}
 
 - when: "matrix_mautrix_facebook_database_engine == 'sqlite' and matrix_mautrix_facebook_docker_image.endswith(':da1b4ec596e334325a1589e70829dea46e73064b')"
@@ -23,3 +37,4 @@
               "NOTE: Your mautrix-facebook bridge is still on SQLite and on the last version that supported it, before support was dropped. Support has been subsequently re-added in v0.3.2, so we advise you to upgrade (by removing your `matrix_mautrix_facebook_docker_image` definition from vars.yml)"
             ]
           }}
+
diff --git a/roles/custom/matrix-bridge-mautrix-facebook/templates/config.yaml.j2 b/roles/custom/matrix-bridge-mautrix-facebook/templates/config.yaml.j2
index 7ec9342a2..968cbe162 100644
--- a/roles/custom/matrix-bridge-mautrix-facebook/templates/config.yaml.j2
+++ b/roles/custom/matrix-bridge-mautrix-facebook/templates/config.yaml.j2
@@ -37,7 +37,7 @@ appservice:
         # Whether or not the public-facing endpoints should be enabled.
         enabled: {{ matrix_mautrix_facebook_appservice_public_enabled|to_json }}
         # The prefix to use in the public-facing endpoints.
-        prefix: {{ matrix_mautrix_facebook_public_endpoint|to_json }}
+        prefix: {{ matrix_mautrix_facebook_appservice_public_prefix|to_json }}
         # The base URL where the public-facing endpoints are available. The prefix is not added
         # implicitly.
         external: {{ matrix_mautrix_facebook_appservice_public_external|to_json }}
diff --git a/roles/custom/matrix-bridge-mautrix-facebook/templates/labels.j2 b/roles/custom/matrix-bridge-mautrix-facebook/templates/labels.j2
new file mode 100644
index 000000000..dbdd3eaef
--- /dev/null
+++ b/roles/custom/matrix-bridge-mautrix-facebook/templates/labels.j2
@@ -0,0 +1,45 @@
+{% if matrix_mautrix_facebook_container_labels_traefik_enabled %}
+traefik.enable=true
+
+{% if matrix_mautrix_facebook_container_labels_traefik_docker_network %}
+traefik.docker.network={{ matrix_mautrix_facebook_container_labels_traefik_docker_network }}
+{% endif %}
+
+{# Public endpoint #}
+{% if matrix_mautrix_facebook_container_labels_public_endpoint_enabled %}
+traefik.http.routers.matrix-mautrix-facebook-public-endpoint.rule={{ matrix_mautrix_facebook_container_labels_public_endpoint_traefik_rule }}
+{% if matrix_mautrix_facebook_container_labels_public_endpoint_traefik_priority | int > 0 %}
+traefik.http.routers.matrix-mautrix-facebook-public-endpoint.priority={{ matrix_mautrix_facebook_container_labels_public_endpoint_traefik_priority }}
+{% endif %}
+traefik.http.routers.matrix-mautrix-facebook-public-endpoint.service=matrix-mautrix-facebook-appservice
+traefik.http.routers.matrix-mautrix-facebook-public-endpoint.entrypoints={{ matrix_mautrix_facebook_container_labels_public_endpoint_traefik_entrypoints }}
+traefik.http.routers.matrix-mautrix-facebook-public-endpoint.tls={{ matrix_mautrix_facebook_container_labels_public_endpoint_traefik_tls | to_json }}
+{% if matrix_mautrix_facebook_container_labels_public_endpoint_traefik_tls %}
+traefik.http.routers.matrix-mautrix-facebook-public-endpoint.tls.certResolver={{ matrix_mautrix_facebook_container_labels_public_endpoint_traefik_tls_certResolver }}
+{% endif %}
+traefik.http.services.matrix-mautrix-facebook-appservice.loadbalancer.server.port=29319
+{% endif %}
+
+{# Metrics #}
+{% if matrix_mautrix_facebook_container_labels_metrics_enabled %}
+traefik.http.routers.matrix-mautrix-facebook-metrics.rule={{ matrix_mautrix_facebook_container_labels_metrics_traefik_rule }}
+{% if matrix_mautrix_facebook_container_labels_metrics_traefik_priority | int > 0 %}
+traefik.http.routers.matrix-mautrix-facebook-metrics.priority={{ matrix_mautrix_facebook_container_labels_metrics_traefik_priority }}
+{% endif %}
+traefik.http.routers.matrix-mautrix-facebook-metrics.service=matrix-mautrix-facebook-metrics
+traefik.http.routers.matrix-mautrix-facebook-metrics.entrypoints={{ matrix_mautrix_facebook_container_labels_metrics_traefik_entrypoints }}
+traefik.http.routers.matrix-mautrix-facebook-metrics.tls={{ matrix_mautrix_facebook_container_labels_metrics_traefik_tls | to_json }}
+{% if matrix_mautrix_facebook_container_labels_metrics_traefik_tls %}
+traefik.http.routers.matrix-mautrix-facebook-metrics.tls.certResolver={{ matrix_mautrix_facebook_container_labels_metrics_traefik_tls_certResolver }}
+{% endif %}
+{% if matrix_mautrix_facebook_container_labels_metrics_middleware_basic_auth_enabled %}
+traefik.http.routers.matrix-mautrix-facebook-metrics.middlewares=matrix-mautrix-facebook-metrics-basic-auth
+traefik.http.middlewares.matrix-mautrix-facebook-metrics-basic-auth.basicauth.users={{ matrix_mautrix_facebook_container_labels_metrics_middleware_basic_auth_users }}
+{% endif %}
+
+traefik.http.services.matrix-mautrix-facebook-metrics.loadbalancer.server.port=8000
+{% endif %}
+
+{% endif %}
+
+{{ matrix_mautrix_facebook_container_labels_additional_labels }}
diff --git a/roles/custom/matrix-bridge-mautrix-facebook/templates/systemd/matrix-mautrix-facebook.service.j2 b/roles/custom/matrix-bridge-mautrix-facebook/templates/systemd/matrix-mautrix-facebook.service.j2
index 2786a3f74..a99173598 100644
--- a/roles/custom/matrix-bridge-mautrix-facebook/templates/systemd/matrix-mautrix-facebook.service.j2
+++ b/roles/custom/matrix-bridge-mautrix-facebook/templates/systemd/matrix-mautrix-facebook.service.j2
@@ -19,22 +19,31 @@ ExecStartPre=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_s
 # Intentional delay, so that the homeserver (we likely depend on) can manage to start.
 ExecStartPre={{ matrix_host_command_sleep }} 5
 
-ExecStart={{ devture_systemd_docker_base_host_command_docker }} run --rm --name matrix-mautrix-facebook \
+ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} create \
+			--rm \
+			--name=matrix-mautrix-facebook \
 			--log-driver=none \
 			--user={{ matrix_user_uid }}:{{ matrix_user_gid }} \
 			--cap-drop=ALL \
-			--network={{ matrix_docker_network }} \
+			--network={{ matrix_mautrix_facebook_container_network }} \
 			{% if matrix_mautrix_facebook_appservice_public_enabled and matrix_mautrix_facebook_container_http_host_bind_port %}
 			-p {{ matrix_mautrix_facebook_container_http_host_bind_port }}:29319 \
 			{% endif %}
-			-v {{ matrix_mautrix_facebook_config_path }}:/config:z \
-			-v {{ matrix_mautrix_facebook_data_path }}:/data:z \
+			--mount type=bind,src={{ matrix_mautrix_facebook_config_path }},dst=/config \
+			--mount type=bind,src={{ matrix_mautrix_facebook_data_path }},dst=/data \
+			--label-file={{ matrix_mautrix_facebook_base_path }}/labels \
 			{% for arg in matrix_mautrix_facebook_container_extra_arguments %}
 			{{ arg }} \
 			{% endfor %}
 			{{ matrix_mautrix_facebook_docker_image }} \
 			python3 -m mautrix_facebook -c /config/config.yaml --no-update
 
+{% for network in matrix_mautrix_facebook_container_additional_networks %}
+ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} network connect {{ network }} matrix-mautrix-facebook
+{% endfor %}
+
+ExecStart={{ devture_systemd_docker_base_host_command_docker }} start --attach matrix-mautrix-facebook
+
 ExecStop=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} stop --time={{ devture_systemd_docker_base_container_stop_grace_time_seconds }} matrix-mautrix-facebook 2>/dev/null || true'
 ExecStop=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} rm matrix-mautrix-facebook 2>/dev/null || true'
 Restart=always
diff --git a/roles/custom/matrix-homeserver-proxy/defaults/main.yml b/roles/custom/matrix-homeserver-proxy/defaults/main.yml
new file mode 100644
index 000000000..7f974c2bb
--- /dev/null
+++ b/roles/custom/matrix-homeserver-proxy/defaults/main.yml
@@ -0,0 +1,179 @@
+---
+
+# matrix-homeserver-proxy is a role which brings up a containerized nginx webserver which helps with reverse-proxying to the Matrix homeserver (Synapse, etc.).
+#
+# Certain services (like matrix-media-repo, matrix-corporal, identity servers, etc.) may need to capture some requests destined for the homeserver
+# and handle them instead of it.
+#
+# This role helps other services (bots, bridges, etc.) reach the homeserver in a way that:
+# - is not very direct, so as to allow for some routes (media repo, etc.) to actually go elsewhere
+# - is not via the public network and/or via HTTPS, which introduces major performance penalties
+#
+# Performance-wise, benchmarks show that:
+# - each local (container) nginx hop adds about a 200 rps penalty
+# - SSL termination (on the Traefik side) adds a 350 rps penalty
+# - going over the public network adds another 70 rps penalty
+#
+# It's something like this for an existing flow (which will be gone soon):
+# 1. public network, Traefik + SSL: 70 rps
+# 2. `matrix-nginx-proxy:8008`: 600 rps
+# 3. `matrix-nginx-proxy:12080` 850 rps
+# 4. `matrix-synapse-reverse-proxy-companion:8008`: 1000 rps
+# 5. `matrix-synapse:8008`: 1200 rps
+#
+# Traefik was additionally benchmarked to see where the slowness comes from. Results are like this:
+# 1. public network, Traefik + SSL: 70 rps
+# 2. local (container) network, Traefik + SSL: 150 rps
+# 3. local (container) network, Traefik without SSL: 500 rps
+# 4. `matrix-nginx-proxy:8008`: 600 rps
+#
+# It's obvious that minimizing the number of hops helps a lot and that not using SSL and/or the public network is important.
+
+matrix_homeserver_proxy_enabled: true
+
+matrix_homeserver_proxy_ident: matrix-homeserver-proxy
+
+# renovate: datasource=docker depName=nginx
+matrix_homeserver_proxy_version: 1.25.3-alpine
+
+matrix_homeserver_proxy_base_path: "{{ matrix_base_data_path }}/homeserver-proxy"
+matrix_homeserver_proxy_confd_path: "{{ matrix_homeserver_proxy_base_path }}/conf.d"
+
+# List of systemd services that matrix-homeserver-proxy.service depends on
+matrix_homeserver_proxy_systemd_required_services_list: ['docker.service']
+
+# List of systemd services that matrix-homeserver-proxy.service wants
+matrix_homeserver_proxy_systemd_wanted_services_list: "{{ matrix_homeserver_proxy_systemd_wanted_services_list_auto + matrix_homeserver_proxy_systemd_wanted_services_list_custom }}"
+matrix_homeserver_proxy_systemd_wanted_services_list_auto: []
+matrix_homeserver_proxy_systemd_wanted_services_list_custom: []
+
+# We use an official nginx image, which we fix-up to run unprivileged.
+# An alternative would be an `nginxinc/nginx-unprivileged` image, but that is frequently out of date.
+matrix_homeserver_proxy_container_image: "{{ matrix_container_global_registry_prefix }}nginx:{{ matrix_homeserver_proxy_version }}"
+matrix_homeserver_proxy_container_image_force_pull: "{{ matrix_homeserver_proxy_container_image.endswith(':latest') }}"
+
+matrix_homeserver_proxy_container_network: matrix-homeserver-proxy
+
+# A list of additional container networks that matrix-homeserver-proxy would be connected to.
+# The playbook does not create these networks, so make sure they already exist.
+matrix_homeserver_proxy_container_additional_networks: []
+
+# Controls whether the matrix-homeserver-proxy container exposes its HTTP Client-Server API port (tcp/8008 in the container).
+#
+# Takes an "<ip>:<port>" or "<port>" value (e.g. "127.0.0.1:8008"), or empty string to not expose.
+matrix_homeserver_proxy_container_client_api_host_bind_port: ''
+
+# Controls whether the matrix-homeserver-proxy container exposes its HTTP Federation (Server-Server) API port (tcp/8048 in the container).
+#
+# Takes an "<ip>:<port>" or "<port>" value (e.g. "127.0.0.1:8048"), or empty string to not expose.
+matrix_homeserver_proxy_container_federation_api_host_bind_port: ''
+
+# Option to disable the access log
+matrix_homeserver_proxy_access_log_enabled: true
+
+# The tmpfs at /tmp needs to be large enough to handle multiple concurrent file uploads.
+matrix_homeserver_proxy_tmp_directory_size_mb: "{{ (matrix_homeserver_proxy_federation_api_client_max_body_size_mb | int) * 50 }}"
+matrix_homeserver_proxy_tmp_cache_directory_size_mb: "{{ (matrix_homeserver_proxy_cache_max_size_mb | int) * 2 }}"
+
+# A list of strings containing additional configuration blocks to add to the nginx server configuration (nginx.conf).
+# for big matrixservers to enlarge the number of open files to prevent timeouts
+# matrix_homeserver_proxy_additional_configuration_blocks:
+#  - 'worker_rlimit_nofile 30000;'
+matrix_homeserver_proxy_additional_configuration_blocks: []
+
+# A list of strings containing additional configuration blocks to add to the nginx event server configuration (nginx.conf).
+matrix_homeserver_proxy_event_additional_configuration_blocks: []
+
+# A list of strings containing additional configuration blocks to add to the nginx http's server configuration (nginx-http.conf).
+matrix_homeserver_proxy_http_additional_server_configuration_blocks: []
+
+# To increase request timeout in NGINX using proxy_read_timeout, proxy_connect_timeout, proxy_send_timeout, send_timeout directives
+# Nginx Default: proxy_connect_timeout 60s;   #Defines a timeout for establishing a connection with a proxied server
+# Nginx Default: proxy_send_timeout 60s;      #Sets a timeout for transmitting a request to the proxied server.
+# Nginx Default: proxy_read_timeout 60s;      #Defines a timeout for reading a response from the proxied server.
+# Nginx Default: send_timeout 60s;            #Sets a timeout for transmitting a response to the client.
+#
+# For more information visit:
+# http://nginx.org/en/docs/http/ngx_http_proxy_module.html
+# http://nginx.org/en/docs/http/ngx_http_core_module.html#send_timeout
+# https://www.nginx.com/resources/wiki/start/topics/examples/fullexample2/
+#
+# Here we are sticking with nginx default values change this value carefully.
+matrix_homeserver_proxy_proxy_connect_timeout: 60
+matrix_homeserver_proxy_proxy_send_timeout: 60
+matrix_homeserver_proxy_proxy_read_timeout: 60
+matrix_homeserver_proxy_send_timeout: 60
+
+# For OCSP purposes, we need to define a resolver at the `server{}` level or `http{}` level (we do the latter).
+#
+# Otherwise, we get warnings like this:
+# > [warn] 22#22: no resolver defined to resolve r3.o.lencr.org while requesting certificate status, responder: r3.o.lencr.org, certificate: "/matrix/ssl/config/live/.../fullchain.pem"
+#
+# We point it to the internal Docker resolver, which likely delegates to nameservers defined in `/etc/resolv.conf`.
+matrix_homeserver_proxy_http_level_resolver: 127.0.0.11
+
+matrix_homeserver_proxy_hostname: "{{ matrix_homeserver_proxy_ident }}"
+
+# matrix_homeserver_proxy_client_api_addr specifies the address where the Client-Server API is
+matrix_homeserver_proxy_client_api_addr: ''
+# This needs to be equal or higher than the maximum upload size accepted by the homeserver.
+matrix_homeserver_proxy_client_api_client_max_body_size_mb: 50
+
+# Tells whether `/_synapse/client` is forwarded to the Matrix Client API server.
+matrix_homeserver_proxy_client_api_forwarded_location_synapse_client_api_enabled: true
+
+# Tells whether `/_synapse/oidc` is forwarded to the Matrix Client API server.
+# Enable this if you need OpenID Connect authentication support.
+matrix_homeserver_proxy_client_api_forwarded_location_synapse_oidc_api_enabled: false
+
+# Tells whether `/_synapse/admin` is forwarded to the Matrix Client API server.
+# Following these recommendations (https://github.com/matrix-org/synapse/blob/master/docs/reverse_proxy.md), by default, we don't.
+matrix_homeserver_proxy_client_api_forwarded_location_synapse_admin_api_enabled: false
+
+# `matrix_homeserver_proxy_client_api_forwarded_location_prefix_regexes` holds
+# the location prefixes that get forwarded to the Matrix Client API server.
+# These locations get combined into a regex like this `^(/_matrix|/_synapse/client)`.
+matrix_homeserver_proxy_client_api_forwarded_location_prefix_regexes: |
+  {{
+    (['/_matrix'])
+    +
+    (['/_synapse/client'] if matrix_homeserver_proxy_client_api_forwarded_location_synapse_client_api_enabled else [])
+    +
+    (['/_synapse/oidc'] if matrix_homeserver_proxy_client_api_forwarded_location_synapse_oidc_api_enabled else [])
+    +
+    (['/_synapse/admin'] if matrix_homeserver_proxy_client_api_forwarded_location_synapse_admin_api_enabled else [])
+  }}
+
+# Specifies where requests for the root URI (`/`) on the `matrix.` domain should be redirected.
+# If this has an empty value, they're just passed to the homeserver, which serves a static page.
+# If you'd like to make `https://matrix.DOMAIN` redirect to `https://element.DOMAIN` (or something of that sort), specify the domain name here.
+# Example value: `element.DOMAIN` (or `{{ matrix_server_fqn_element }}`).
+matrix_homeserver_proxy_client_redirect_root_uri_to_domain: ""
+
+# A list of strings containing additional configuration blocks to add to the nginx vhost handling the Client-Server API
+matrix_homeserver_proxy_client_api_additional_server_configuration_blocks: "{{ matrix_homeserver_proxy_client_api_additional_server_configuration_blocks_auto + matrix_homeserver_proxy_client_api_additional_server_configuration_blocks_custom }}"
+matrix_homeserver_proxy_client_api_additional_server_configuration_blocks_auto: []
+matrix_homeserver_proxy_client_api_additional_server_configuration_blocks_custom: []
+
+# matrix_homeserver_proxy_federation_api_enabled specifies whether reverse proxying for the Federation (Server-Server) API should be done
+matrix_homeserver_proxy_federation_api_enabled: true
+# matrix_homeserver_proxy_federation_api_addr specifies the address where the Federation (Server-Server) API is
+matrix_homeserver_proxy_federation_api_addr: ''
+matrix_homeserver_proxy_federation_api_client_max_body_size_mb: "{{ (matrix_homeserver_proxy_client_api_client_max_body_size_mb | int) * 3 }}"
+
+# A list of strings containing additional configuration blocks to add to the nginx vhost handling the Federation (Server-Server) API
+matrix_homeserver_proxy_federation_api_additional_server_configuration_blocks: "{{ matrix_homeserver_proxy_federation_api_additional_server_configuration_blocks_auto + matrix_homeserver_proxy_federation_api_additional_server_configuration_blocks_custom }}"
+matrix_homeserver_proxy_federation_api_additional_server_configuration_blocks_auto: []
+matrix_homeserver_proxy_federation_api_additional_server_configuration_blocks_custom: []
+
+# Controls whether matrix-homeserver-proxy trusts an upstream server's X-Forwarded-Proto header.
+# The `matrix-homeserver-proxy` does not terminate SSL and always expects to be fronted by another reverse-proxy server.
+# As such, it trusts the protocol scheme forwarded by the upstream proxy.
+matrix_homeserver_proxy_trust_forwarded_proto: true
+matrix_homeserver_proxy_x_forwarded_proto_value: "{{ '$http_x_forwarded_proto' if matrix_homeserver_proxy_trust_forwarded_proto else '$scheme' }}"
+
+# The amount of worker processes and connections
+# Consider increasing these when you are expecting high amounts of traffic
+# http://nginx.org/en/docs/ngx_core_module.html#worker_connections
+matrix_homeserver_proxy_worker_processes: auto
+matrix_homeserver_proxy_worker_connections: 1024
diff --git a/roles/custom/matrix-homeserver-proxy/tasks/install.yml b/roles/custom/matrix-homeserver-proxy/tasks/install.yml
new file mode 100644
index 000000000..0171f888f
--- /dev/null
+++ b/roles/custom/matrix-homeserver-proxy/tasks/install.yml
@@ -0,0 +1,49 @@
+---
+
+- name: Ensure Matrix Homeserver Proxy paths exist
+  ansible.builtin.file:
+    path: "{{ item }}"
+    state: directory
+    mode: 0750
+    owner: "{{ matrix_user_username }}"
+    group: "{{ matrix_user_groupname }}"
+  with_items:
+    - "{{ matrix_homeserver_proxy_base_path }}"
+    - "{{ matrix_homeserver_proxy_confd_path }}"
+
+- name: Ensure Matrix Homeserver Proxy is configured
+  ansible.builtin.template:
+    src: "{{ item.src }}"
+    dest: "{{ item.dest }}"
+    owner: "{{ matrix_user_username }}"
+    group: "{{ matrix_user_groupname }}"
+    mode: 0644
+  with_items:
+    - src: "{{ role_path }}/templates/nginx/nginx.conf.j2"
+      dest: "{{ matrix_homeserver_proxy_base_path }}/nginx.conf"
+    - src: "{{ role_path }}/templates/nginx/conf.d/nginx-http.conf.j2"
+      dest: "{{ matrix_homeserver_proxy_confd_path }}/nginx-http.conf"
+    - src: "{{ role_path }}/templates/nginx/conf.d/matrix-homeserver-proxy.conf.j2"
+      dest: "{{ matrix_homeserver_proxy_confd_path }}/matrix-homeserver-proxy.conf"
+
+- name: Ensure Matrix Homeserver Proxy nginx container image is pulled
+  community.docker.docker_image:
+    name: "{{ matrix_homeserver_proxy_container_image }}"
+    source: "{{ 'pull' if ansible_version.major > 2 or ansible_version.minor > 7 else omit }}"
+    force_source: "{{ matrix_homeserver_proxy_container_image_force_pull if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}"
+    force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else matrix_homeserver_proxy_container_image_force_pull }}"
+  register: result
+  retries: "{{ devture_playbook_help_container_retries_count }}"
+  delay: "{{ devture_playbook_help_container_retries_delay }}"
+  until: result is not failed
+
+- name: Ensure Matrix Homeserver Proxy container network is created
+  community.general.docker_network:
+    name: "{{ matrix_homeserver_proxy_container_network }}"
+    driver: bridge
+
+- name: Ensure Matrix Homeserver Proxy systemd service is installed
+  ansible.builtin.template:
+    src: "{{ role_path }}/templates/systemd/matrix-homeserver-proxy.service.j2"
+    dest: "{{ devture_systemd_docker_base_systemd_path }}/{{ matrix_homeserver_proxy_ident }}.service"
+    mode: 0644
diff --git a/roles/custom/matrix-homeserver-proxy/tasks/main.yml b/roles/custom/matrix-homeserver-proxy/tasks/main.yml
new file mode 100644
index 000000000..ac6086f3a
--- /dev/null
+++ b/roles/custom/matrix-homeserver-proxy/tasks/main.yml
@@ -0,0 +1,20 @@
+---
+
+- tags:
+    - setup-all
+    - setup-homeserver-proxy
+    - setup-synapse
+    - install-all
+    - install-homeserver-proxy
+    - install-synapse
+  block:
+    - when: matrix_homeserver_proxy_enabled | bool
+      ansible.builtin.include_tasks: "{{ role_path }}/tasks/install.yml"
+
+- tags:
+    - setup-all
+    - setup-homeserver-proxy
+    - setup-synapse
+  block:
+    - when: not matrix_homeserver_proxy_enabled | bool
+      ansible.builtin.include_tasks: "{{ role_path }}/tasks/uninstall.yml"
diff --git a/roles/custom/matrix-homeserver-proxy/tasks/uninstall.yml b/roles/custom/matrix-homeserver-proxy/tasks/uninstall.yml
new file mode 100644
index 000000000..01425f2c1
--- /dev/null
+++ b/roles/custom/matrix-homeserver-proxy/tasks/uninstall.yml
@@ -0,0 +1,25 @@
+---
+
+- name: Check existence of Matrix Homeserver Proxy systemd service
+  ansible.builtin.stat:
+    path: "{{ devture_systemd_docker_base_systemd_path }}/{{ matrix_homeserver_proxy_ident }}.service"
+  register: matrix_homeserver_proxy_service_stat
+
+- when: matrix_homeserver_proxy_service_stat.stat.exists | bool
+  block:
+    - name: Ensure Matrix Homeserver Proxy systemd service is stopped
+      ansible.builtin.service:
+        name: "{{ matrix_homeserver_proxy_ident }}"
+        state: stopped
+        enabled: false
+        daemon_reload: true
+
+    - name: Ensure Matrix Homeserver Proxy systemd service doesn't exist
+      ansible.builtin.file:
+        path: "{{ devture_systemd_docker_base_systemd_path }}/{{ matrix_homeserver_proxy_ident }}.service"
+        state: absent
+
+    - name: Ensure Matrix Homeserver Proxy directory is deleted
+      ansible.builtin.file:
+        path: "{{ matrix_homeserver_proxy_base_path }}"
+        state: absent
diff --git a/roles/custom/matrix-homeserver-proxy/templates/nginx/conf.d/matrix-homeserver-proxy.conf.j2 b/roles/custom/matrix-homeserver-proxy/templates/nginx/conf.d/matrix-homeserver-proxy.conf.j2
new file mode 100644
index 000000000..437be76fd
--- /dev/null
+++ b/roles/custom/matrix-homeserver-proxy/templates/nginx/conf.d/matrix-homeserver-proxy.conf.j2
@@ -0,0 +1,62 @@
+#jinja2: lstrip_blocks: "True"
+
+server {
+	listen 8008;
+	server_name {{ matrix_homeserver_proxy_hostname }};
+
+	server_tokens off;
+	root /dev/null;
+
+	gzip on;
+	gzip_types text/plain application/json;
+
+	{% for configuration_block in matrix_homeserver_proxy_client_api_additional_server_configuration_blocks %}
+		{{- configuration_block }}
+	{% endfor %}
+
+	{# Everything else just goes to the API server ##}
+	location / {
+		{# Use the embedded DNS resolver in Docker containers to discover the service #}
+		resolver {{ matrix_homeserver_proxy_http_level_resolver }} valid=5s;
+		set $backend "{{ matrix_homeserver_proxy_client_api_addr }}";
+		proxy_pass http://$backend;
+
+		proxy_set_header Host $host;
+
+		client_body_buffer_size 25M;
+		client_max_body_size {{ matrix_homeserver_proxy_client_api_client_max_body_size_mb }}M;
+		proxy_max_temp_file_size 0;
+	}
+}
+
+{% if matrix_homeserver_proxy_federation_api_enabled %}
+server {
+	listen 8048;
+	server_name {{ matrix_homeserver_proxy_hostname }};
+
+	server_tokens off;
+
+	root /dev/null;
+
+	gzip on;
+	gzip_types text/plain application/json;
+
+	{% for configuration_block in matrix_homeserver_proxy_federation_api_additional_server_configuration_blocks %}
+		{{- configuration_block }}
+	{% endfor %}
+
+	{# Everything else just goes to the API server ##}
+	location / {
+		{# Use the embedded DNS resolver in Docker containers to discover the service #}
+		resolver {{ matrix_homeserver_proxy_http_level_resolver }} valid=5s;
+		set $backend "{{ matrix_homeserver_proxy_federation_api_addr }}";
+		proxy_pass http://$backend;
+
+		proxy_set_header Host $host;
+
+		client_body_buffer_size 25M;
+		client_max_body_size {{ matrix_homeserver_proxy_federation_api_client_max_body_size_mb }}M;
+		proxy_max_temp_file_size 0;
+	}
+}
+{% endif %}
diff --git a/roles/custom/matrix-homeserver-proxy/templates/nginx/conf.d/nginx-http.conf.j2 b/roles/custom/matrix-homeserver-proxy/templates/nginx/conf.d/nginx-http.conf.j2
new file mode 100644
index 000000000..d14c755e2
--- /dev/null
+++ b/roles/custom/matrix-homeserver-proxy/templates/nginx/conf.d/nginx-http.conf.j2
@@ -0,0 +1,13 @@
+#jinja2: lstrip_blocks: "True"
+# The default is aligned to the CPU's cache size,
+# which can sometimes be too low.
+# Thus, we ensure a larger bucket size value is used.
+server_names_hash_bucket_size 64;
+
+{% if matrix_homeserver_proxy_http_level_resolver %}
+resolver {{ matrix_homeserver_proxy_http_level_resolver }};
+{% endif %}
+
+{% for configuration_block in matrix_homeserver_proxy_http_additional_server_configuration_blocks %}
+	{{- configuration_block }}
+{% endfor %}
diff --git a/roles/custom/matrix-homeserver-proxy/templates/nginx/nginx.conf.j2 b/roles/custom/matrix-homeserver-proxy/templates/nginx/nginx.conf.j2
new file mode 100644
index 000000000..28272b564
--- /dev/null
+++ b/roles/custom/matrix-homeserver-proxy/templates/nginx/nginx.conf.j2
@@ -0,0 +1,77 @@
+#jinja2: lstrip_blocks: "True"
+# This is a custom nginx configuration file that we use in the container (instead of the default one),
+# because it allows us to run nginx with a non-root user.
+#
+# For this to work, the default vhost file (`/etc/nginx/conf.d/default.conf`) also needs to be removed.
+#
+# The following changes have been done compared to a default nginx configuration file:
+# - various temp paths are changed to `/tmp`, so that a non-root user can write to them
+# - the `user` directive was removed, as we don't want nginx to switch users
+
+worker_processes {{ matrix_homeserver_proxy_worker_processes }};
+error_log /var/log/nginx/error.log warn;
+pid /tmp/nginx.pid;
+{% for configuration_block in matrix_homeserver_proxy_additional_configuration_blocks %}
+	{{- configuration_block }}
+{% endfor %}
+
+events {
+	worker_connections {{ matrix_homeserver_proxy_worker_connections }};
+{% for configuration_block in matrix_homeserver_proxy_event_additional_configuration_blocks %}
+	{{- configuration_block }}
+{% endfor %}
+}
+
+
+http {
+	proxy_temp_path /tmp/proxy_temp;
+	client_body_temp_path /tmp/client_temp;
+	fastcgi_temp_path /tmp/fastcgi_temp;
+	uwsgi_temp_path /tmp/uwsgi_temp;
+	scgi_temp_path /tmp/scgi_temp;
+
+	include /etc/nginx/mime.types;
+	default_type application/octet-stream;
+
+	log_format main '$remote_addr - $remote_user [$time_local] "$request" '
+					'$status $body_bytes_sent "$http_referer" '
+					'"$http_user_agent" "$http_x_forwarded_for"';
+
+	{% if matrix_homeserver_proxy_access_log_enabled %}
+	access_log /var/log/nginx/access.log main;
+	{% endif %}
+
+	{% if matrix_homeserver_proxy_access_log_syslog_integration_enabled %}
+	log_format prometheus_fmt 'matrix-homeserver-proxy $server_name - $upstream_addr - $remote_addr - $remote_user [$time_local] '
+								'$host "$request" '
+								'$status "$http_referer" '
+								'"$http_user_agent" "$http_x_forwarded_for"';
+
+	access_log syslog:server={{ matrix_homeserver_proxy_access_log_syslog_integration_server_port }},tag=matrix_nginx_proxy_companion prometheus_fmt;
+	{% endif %}
+
+	{% if not matrix_homeserver_proxy_access_log_enabled and not matrix_homeserver_proxy_access_log_syslog_integration_enabled %}
+	access_log off;
+	{% endif %}
+
+	proxy_connect_timeout       {{ matrix_homeserver_proxy_proxy_connect_timeout }};
+	proxy_send_timeout          {{ matrix_homeserver_proxy_proxy_send_timeout }};
+	proxy_read_timeout          {{ matrix_homeserver_proxy_proxy_read_timeout }};
+	send_timeout                {{ matrix_homeserver_proxy_send_timeout }};
+
+	sendfile on;
+	#tcp_nopush on;
+
+	keepalive_timeout 65;
+
+	server_tokens off;
+
+	#gzip on;
+	{# Map directive needed for proxied WebSocket upgrades #}
+	map $http_upgrade $connection_upgrade {
+		default upgrade;
+		''      close;
+	}
+
+	include /etc/nginx/conf.d/*.conf;
+}
diff --git a/roles/custom/matrix-homeserver-proxy/templates/systemd/matrix-homeserver-proxy.service.j2 b/roles/custom/matrix-homeserver-proxy/templates/systemd/matrix-homeserver-proxy.service.j2
new file mode 100755
index 000000000..4f7aa02c6
--- /dev/null
+++ b/roles/custom/matrix-homeserver-proxy/templates/systemd/matrix-homeserver-proxy.service.j2
@@ -0,0 +1,52 @@
+#jinja2: lstrip_blocks: "True"
+[Unit]
+Description=Matrix Homeserver Proxy
+{% for service in matrix_homeserver_proxy_systemd_required_services_list %}
+Requires={{ service }}
+After={{ service }}
+{% endfor %}
+{% for service in matrix_homeserver_proxy_systemd_wanted_services_list %}
+Wants={{ service }}
+{% endfor %}
+DefaultDependencies=no
+
+[Service]
+Type=simple
+Environment="HOME={{ devture_systemd_docker_base_systemd_unit_home_path }}"
+ExecStartPre=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} stop --time={{ devture_systemd_docker_base_container_stop_grace_time_seconds }} matrix-homeserver-proxy 2>/dev/null || true'
+ExecStartPre=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} rm matrix-homeserver-proxy 2>/dev/null || true'
+
+ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} create \
+			--rm \
+			--name=matrix-homeserver-proxy \
+			--log-driver=none \
+			--user={{ matrix_user_uid }}:{{ matrix_user_gid }} \
+			--cap-drop=ALL \
+			--read-only \
+			--tmpfs=/tmp:rw,noexec,nosuid,size={{ matrix_homeserver_proxy_tmp_directory_size_mb }}m \
+			--network={{ matrix_homeserver_proxy_container_network }} \
+			{% if matrix_homeserver_proxy_container_client_api_host_bind_port %}
+			-p {{ matrix_homeserver_proxy_container_client_api_host_bind_port }}:8008 \
+			{% endif %}
+			{% if matrix_homeserver_proxy_container_federation_api_host_bind_port %}
+			-p {{ matrix_homeserver_proxy_container_federation_api_host_bind_port }}:8048 \
+			{% endif %}
+			--mount type=bind,src={{ matrix_homeserver_proxy_base_path }}/nginx.conf,dst=/etc/nginx/nginx.conf,ro \
+			--mount type=bind,src={{ matrix_homeserver_proxy_confd_path }},dst=/etc/nginx/conf.d,ro \
+			{{ matrix_homeserver_proxy_container_image }}
+
+{% for network in matrix_homeserver_proxy_container_additional_networks %}
+ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} network connect {{ network }} matrix-homeserver-proxy
+{% endfor %}
+
+ExecStart={{ devture_systemd_docker_base_host_command_docker }} start --attach matrix-homeserver-proxy
+
+ExecStop=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} stop --time={{ devture_systemd_docker_base_container_stop_grace_time_seconds }} matrix-homeserver-proxy 2>/dev/null || true'
+ExecStop=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} rm matrix-homeserver-proxy 2>/dev/null || true'
+ExecReload={{ devture_systemd_docker_base_host_command_docker }} exec matrix-homeserver-proxy /usr/sbin/nginx -s reload
+Restart=always
+RestartSec=30
+SyslogIdentifier=matrix-homeserver-proxy
+
+[Install]
+WantedBy=multi-user.target
diff --git a/roles/custom/matrix-homeserver-proxy/vars/main.yml b/roles/custom/matrix-homeserver-proxy/vars/main.yml
new file mode 100644
index 000000000..71e652c1f
--- /dev/null
+++ b/roles/custom/matrix-homeserver-proxy/vars/main.yml
@@ -0,0 +1,4 @@
+---
+matrix_homeserver_proxy_client_api_url: "http://{{ matrix_homeserver_proxy_ident }}:8008"
+
+matrix_homeserver_proxy_federation_api_url: "http://{{ matrix_homeserver_proxy_ident }}:8048"
diff --git a/roles/custom/matrix_playbook_migration/tasks/validate_config.yml b/roles/custom/matrix_playbook_migration/tasks/validate_config.yml
index c61a51957..a506e1cf9 100644
--- a/roles/custom/matrix_playbook_migration/tasks/validate_config.yml
+++ b/roles/custom/matrix_playbook_migration/tasks/validate_config.yml
@@ -60,6 +60,11 @@
     - {'old': 'jitsi_require_well_known', 'new': 'jitsi_web_well_known_element_jitsi_enabled'}
     - {'old': 'jitsi_wellknown_element_jitsi_json', 'new': 'jitsi_web_well_known_element_jitsi_json'}
 
+    - {'old': 'matrix_nginx_proxy_proxy_matrix_metrics_enabled', 'new': 'matrix_metrics_exposure_enabled'}
+    - {'old': 'matrix_nginx_proxy_proxy_matrix_metrics_basic_auth_enabled', 'new': 'matrix_metrics_exposure_http_basic_auth_enabled'}
+    - {'old': 'matrix_nginx_proxy_proxy_matrix_metrics_basic_auth_username', 'new': '<superseded by matrix_metrics_exposure_http_basic_auth_users>'}
+    - {'old': 'matrix_nginx_proxy_proxy_matrix_metrics_basic_auth_password', 'new': '<superseded by matrix_metrics_exposure_http_basic_auth_users>'}
+
 - name: (Deprecation) Catch and report matrix_postgres variables
   ansible.builtin.fail:
     msg: |-
diff --git a/setup.yml b/setup.yml
index 708c53f82..074b44a1e 100644
--- a/setup.yml
+++ b/setup.yml
@@ -116,6 +116,7 @@
     - custom/matrix-sygnal
     - galaxy/ntfy
     - custom/matrix-nginx-proxy
+    - custom/matrix-homeserver-proxy
     - custom/matrix-coturn
     - custom/matrix-media-repo