From 08c3a475366b38ba3079614f703ce363914abaef Mon Sep 17 00:00:00 2001
From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com>
Date: Fri, 16 Feb 2024 15:28:04 +0000
Subject: [PATCH 01/18] Update frenck/action-yamllint action to v1.5.0

---
 .github/workflows/matrix.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/matrix.yml b/.github/workflows/matrix.yml
index 8e7df1185..de1455688 100644
--- a/.github/workflows/matrix.yml
+++ b/.github/workflows/matrix.yml
@@ -13,7 +13,7 @@ jobs:
       - name: Check out
         uses: actions/checkout@v4
       - name: Run yamllint
-        uses: frenck/action-yamllint@v1.4.2
+        uses: frenck/action-yamllint@v1.5.0
   ansible-lint:
     name: ansible-lint
     runs-on: ubuntu-latest

From d3c8fd8ad524b93cf2a1c5b34d6b902270d8255b Mon Sep 17 00:00:00 2001
From: Slavi Pantaleev <slavi@devture.com>
Date: Fri, 16 Feb 2024 18:50:53 +0200
Subject: [PATCH 02/18] Pin mautrix-signal to v0.5.0

Ref: https://github.com/mautrix/signal/releases/tag/v0.5.0
---
 roles/custom/matrix-bridge-mautrix-signal/defaults/main.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/roles/custom/matrix-bridge-mautrix-signal/defaults/main.yml b/roles/custom/matrix-bridge-mautrix-signal/defaults/main.yml
index 3a30d9d1c..8822bcd4f 100644
--- a/roles/custom/matrix-bridge-mautrix-signal/defaults/main.yml
+++ b/roles/custom/matrix-bridge-mautrix-signal/defaults/main.yml
@@ -9,7 +9,7 @@ matrix_mautrix_signal_container_image_self_build_repo: "https://mau.dev/mautrix/
 matrix_mautrix_signal_container_image_self_build_branch: "{{ 'main' if matrix_mautrix_signal_version == 'latest' else matrix_mautrix_signal_version }}"
 
 # renovate: datasource=docker depName=dock.mau.dev/mautrix/signal
-matrix_mautrix_signal_version: 103666990f30a692c63dd84a499b0dd390cef8a4
+matrix_mautrix_signal_version: v0.5.0
 
 # See: https://mau.dev/mautrix/signal/container_registry
 matrix_mautrix_signal_docker_image: "{{ matrix_mautrix_signal_docker_image_name_prefix }}mautrix/signal:{{ matrix_mautrix_signal_docker_image_tag }}"

From 63b945dc1acdf5d1f872bd9aadd0d416196db6e1 Mon Sep 17 00:00:00 2001
From: Slavi Pantaleev <slavi@devture.com>
Date: Sat, 17 Feb 2024 08:22:33 +0200
Subject: [PATCH 03/18] Fix incorrect image tag reference for mautrix-signal

Fixes https://github.com/spantaleev/matrix-docker-ansible-deploy/issues/3192
---
 roles/custom/matrix-bridge-mautrix-signal/defaults/main.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/roles/custom/matrix-bridge-mautrix-signal/defaults/main.yml b/roles/custom/matrix-bridge-mautrix-signal/defaults/main.yml
index 8822bcd4f..689510900 100644
--- a/roles/custom/matrix-bridge-mautrix-signal/defaults/main.yml
+++ b/roles/custom/matrix-bridge-mautrix-signal/defaults/main.yml
@@ -13,7 +13,7 @@ matrix_mautrix_signal_version: v0.5.0
 
 # See: https://mau.dev/mautrix/signal/container_registry
 matrix_mautrix_signal_docker_image: "{{ matrix_mautrix_signal_docker_image_name_prefix }}mautrix/signal:{{ matrix_mautrix_signal_docker_image_tag }}"
-matrix_mautrix_signal_docker_image_tag: "{{ 'latest' if matrix_mautrix_signal_version == 'latest' else matrix_mautrix_signal_version + '-' +  matrix_architecture }}"
+matrix_mautrix_signal_docker_image_tag: "{{ matrix_mautrix_signal_version }}"
 matrix_mautrix_signal_docker_image_name_prefix: "{{ 'localhost/' if matrix_mautrix_signal_container_image_self_build else 'dock.mau.dev/' }}"
 matrix_mautrix_signal_docker_image_force_pull: "{{ matrix_mautrix_signal_docker_image.endswith(':latest') }}"
 

From 2fa82b8bca4f18e4aa392c5fd3c5516d76e90b87 Mon Sep 17 00:00:00 2001
From: Slavi Pantaleev <slavi@devture.com>
Date: Sun, 18 Feb 2024 07:50:57 +0200
Subject: [PATCH 04/18] Disable media_patterns for mautrix-discord

Media didn't work before this patch, likely because this feature is broken:

> N.B. Discord now requires signed expiring download links, which means this solution no longer works. In the future, a more dynamic solution may be implemented where requests go to the bridge and the bridge and the bridge refetches the message if necessary.

Source: https://docs.mau.fi/bridges/go/discord/direct-media.html

Moreover, most users more likely don't want this behavior and would
prefer to keep a complete mirror of the media on Matrix, instead of
going through two 3rd party servers to fetch the media on demand.

The default config for the bridge
(https://github.com/mautrix/discord/blob/main/example-config.yaml)
actually does not enable it.

It seems like 4ed522e8fefff632523d68c7d2f2f9a6d86e3b1b
(https://github.com/spantaleev/matrix-docker-ansible-deploy/pull/3133)
lied to us as to what upstream does. Poor PR review lead to this
anti-feature making it into the playbook.
---
 .../matrix-bridge-mautrix-discord/templates/config.yaml.j2      | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/roles/custom/matrix-bridge-mautrix-discord/templates/config.yaml.j2 b/roles/custom/matrix-bridge-mautrix-discord/templates/config.yaml.j2
index 561a9c3c7..56c3bcfb8 100644
--- a/roles/custom/matrix-bridge-mautrix-discord/templates/config.yaml.j2
+++ b/roles/custom/matrix-bridge-mautrix-discord/templates/config.yaml.j2
@@ -149,7 +149,7 @@ bridge:
     # More details can be found at https://docs.mau.fi/bridges/go/discord/direct-media.html
     media_patterns:
         # Should custom mxc:// URIs be used instead of reuploading media?
-        enabled: true
+        enabled: false
         # Pattern for normal message attachments.
         attachments: {% raw %}mxc://discord-media.mau.dev/attachments|{{.ChannelID}}|{{.AttachmentID}}|{{.FileName}}{% endraw %}
         # Pattern for custom emojis.

From e1363c9b9ba46f60b255b3f0c4816c5e1825907a Mon Sep 17 00:00:00 2001
From: Slavi Pantaleev <slavi@devture.com>
Date: Sun, 18 Feb 2024 09:52:00 +0200
Subject: [PATCH 05/18] Add lt-cred-mech authentication mechanism to Coturn

All homeserver implementations have been updated to support this as
well.

It's just Jitsi that possibly doesn't work with anything other than `auth-secret`.

Fixes https://github.com/spantaleev/matrix-docker-ansible-deploy/issues/3191
---
 docs/configuring-playbook-turn.md             | 15 +++++++++++++
 group_vars/matrix_servers                     | 21 ++++++++++++++-----
 roles/custom/matrix-coturn/defaults/main.yml  | 18 +++++++++++++++-
 .../matrix-coturn/tasks/validate_config.yml   | 14 ++++++++++---
 .../templates/turnserver.conf.j2              | 12 ++++++++++-
 .../custom/matrix-dendrite/defaults/main.yml  |  2 ++
 .../templates/dendrite.yaml.j2                |  4 ++--
 roles/custom/matrix-synapse/defaults/main.yml |  2 ++
 .../templates/synapse/homeserver.yaml.j2      |  6 +++---
 9 files changed, 79 insertions(+), 15 deletions(-)

diff --git a/docs/configuring-playbook-turn.md b/docs/configuring-playbook-turn.md
index c7bf998fd..4e02dddb5 100644
--- a/docs/configuring-playbook-turn.md
+++ b/docs/configuring-playbook-turn.md
@@ -34,6 +34,21 @@ If your server has multiple external IP addresses, the Coturn role offers a diff
 matrix_coturn_turn_external_ip_addresses: ['1.2.3.4', '4.5.6.7']
 ```
 
+## Changing the authentication mechanism
+
+The playbook uses the [`auth-secret` authentication method](https://github.com/coturn/coturn/blob/873cabd6a2e5edd7e9cc5662cac3ffe47fe87a8e/README.turnserver#L186-L199) by default, but you may switch to the [`lt-cred-mech` method](https://github.com/coturn/coturn/blob/873cabd6a2e5edd7e9cc5662cac3ffe47fe87a8e/README.turnserver#L178) which [some report](https://github.com/spantaleev/matrix-docker-ansible-deploy/issues/3191) to be working better.
+
+To do so, add this override to your configuration:
+
+```yml
+matrix_coturn_authentication_method: lt-cred-mech
+```
+
+Regardless of the selected authentication method, the playbook generates secrets automatically and passes them to the homeserver and Coturn.
+
+If you're using [Jitsi](./configuring-playbook-jitsi.md), note that switching to `lt-cred-mech` will remove the integration between Jitsi and your own Coturn server, because Jitsi only seems to support the `auth-secret` authentication method.
+
+
 ## Using your own external Coturn server
 
 If you'd like to use another TURN server (be it Coturn or some other one), you can configure the playbook like this:
diff --git a/group_vars/matrix_servers b/group_vars/matrix_servers
index f735cd1da..2d2f7fdc7 100755
--- a/group_vars/matrix_servers
+++ b/group_vars/matrix_servers
@@ -2723,7 +2723,10 @@ matrix_coturn_container_image_self_build: "{{ matrix_architecture not in ['amd64
 # to allow auto-detection (via an EchoIP service) to happen at runtime.
 matrix_coturn_turn_external_ip_address: "{{ ansible_host }}"
 
-matrix_coturn_turn_static_auth_secret: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'coturn.sas', rounds=655555) | to_uuid }}"
+matrix_coturn_turn_static_auth_secret: "{{ ('%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'coturn.sas', rounds=655555) | to_uuid) if matrix_coturn_authentication_method == 'auth-secret' else '' }}"
+
+matrix_coturn_lt_cred_mech_username: "{{ ('%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'coturn.user', rounds=655555) | to_uuid) if matrix_coturn_authentication_method == 'lt-cred-mech' else '' }}"
+matrix_coturn_lt_cred_mech_password: "{{ ('%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'coturn.pass', rounds=655555) | to_uuid) if matrix_coturn_authentication_method == 'lt-cred-mech' else '' }}"
 
 matrix_coturn_tls_enabled: "{{ matrix_playbook_ssl_enabled }}"
 
@@ -3007,7 +3010,9 @@ jitsi_web_stun_servers: |
 # The Jitsi instance installed by this playbook is meant for embedding into Matrix clients, so framing is allowed.
 jitsi_web_framing_enabled: true
 
-jitsi_turn_credentials: "{{ matrix_coturn_turn_static_auth_secret if matrix_coturn_enabled else '' }}"
+# Jitsi (Prosody) only seems to support authenticating with Coturn using `auth-secret`, not `lt-cred-mech`.
+# See: https://prosody.im/doc/coturn
+jitsi_turn_credentials: "{{ matrix_coturn_turn_static_auth_secret if (matrix_coturn_enabled and matrix_coturn_authentication_method == 'auth-secret') else '' }}"
 jitsi_turn_host: "{{ ('turn.' + matrix_server_fqn_matrix) if matrix_coturn_enabled else '' }}"
 jitsi_turns_host: "{{ ('turn.' + matrix_server_fqn_matrix) if matrix_coturn_enabled else '' }}"
 jitsi_turn_port: "{{ matrix_coturn_container_stun_plain_host_bind_port if matrix_coturn_enabled else '' }}"
@@ -3972,7 +3977,9 @@ matrix_synapse_turn_uris: |
     ] if matrix_coturn_enabled else [])
   }}
 
-matrix_synapse_turn_shared_secret: "{{ matrix_coturn_turn_static_auth_secret if matrix_coturn_enabled else '' }}"
+matrix_synapse_turn_shared_secret: "{{ matrix_coturn_turn_static_auth_secret if (matrix_coturn_enabled and matrix_coturn_authentication_method == 'auth-secret') else '' }}"
+matrix_synapse_turn_username: "{{ matrix_coturn_lt_cred_mech_username if (matrix_coturn_enabled and matrix_coturn_authentication_method == 'lt-cred-mech') else '' }}"
+matrix_synapse_turn_password: "{{ matrix_coturn_lt_cred_mech_password if (matrix_coturn_enabled and matrix_coturn_authentication_method == 'lt-cred-mech') else '' }}"
 
 matrix_synapse_self_check_validate_certificates: "{{ matrix_playbook_ssl_enabled }}"
 
@@ -4639,7 +4646,9 @@ matrix_dendrite_client_api_turn_uris: |
     else []
   }}
 
-matrix_dendrite_client_api_turn_shared_secret: "{{ matrix_coturn_turn_static_auth_secret if matrix_coturn_enabled else '' }}"
+matrix_dendrite_client_api_turn_shared_secret: "{{ matrix_coturn_turn_static_auth_secret if (matrix_coturn_enabled and matrix_coturn_authentication_method == 'auth-secret') else '' }}"
+matrix_dendrite_client_api_turn_username: "{{ matrix_coturn_lt_cred_mech_username if (matrix_coturn_enabled and matrix_coturn_authentication_method == 'lt-cred-mech') else '' }}"
+matrix_dendrite_client_api_turn_password: "{{ matrix_coturn_lt_cred_mech_password if (matrix_coturn_enabled and matrix_coturn_authentication_method == 'lt-cred-mech') else '' }}"
 
 matrix_dendrite_disable_tls_validation: "{{ not matrix_playbook_ssl_enabled }}"
 
@@ -4717,7 +4726,9 @@ matrix_conduit_turn_uris: |
     ] if matrix_coturn_enabled else [])
   }}
 
-matrix_conduit_turn_secret: "{{ matrix_coturn_turn_static_auth_secret if matrix_coturn_enabled else '' }}"
+matrix_conduit_turn_secret: "{{ matrix_coturn_turn_static_auth_secret if (matrix_coturn_enabled and matrix_coturn_authentication_method == 'auth-secret') else '' }}"
+matrix_conduit_turn_username: "{{ matrix_coturn_lt_cred_mech_username if (matrix_coturn_enabled and matrix_coturn_authentication_method == 'lt-cred-mech') else '' }}"
+matrix_conduit_turn_password: "{{ matrix_coturn_lt_cred_mech_password if (matrix_coturn_enabled and matrix_coturn_authentication_method == 'lt-cred-mech') else '' }}"
 
 ######################################################################
 #
diff --git a/roles/custom/matrix-coturn/defaults/main.yml b/roles/custom/matrix-coturn/defaults/main.yml
index cb2425396..5c1ca5acf 100644
--- a/roles/custom/matrix-coturn/defaults/main.yml
+++ b/roles/custom/matrix-coturn/defaults/main.yml
@@ -73,10 +73,26 @@ matrix_coturn_container_turn_range_listen_interface: "{{ '' if matrix_coturn_con
 matrix_coturn_turn_udp_min_port: 49152
 matrix_coturn_turn_udp_max_port: 49172
 
-# A shared secret (between Synapse and Coturn) used for authentication.
+# Controls which authentication method to enable.
+#
+# lt-cred-mech likely provides better compatibility,
+# as described here: https://github.com/spantaleev/matrix-docker-ansible-deploy/issues/3191
+# but those claims are unverified.
+#
+# For now, we still default to `auth-secret` like we've always done.
+#
+# Known values: auth-secret, lt-cred-mech
+matrix_coturn_authentication_method: auth-secret
+
+# A shared secret used for authentication when `matrix_coturn_authentication_method` is `auth-secret`.
 # You can put any string here, but generating a strong one is preferred (e.g. `pwgen -s 64 1`).
 matrix_coturn_turn_static_auth_secret: ""
 
+# A username used authentication when `matrix_coturn_authentication_method` is `lt-cred-mech`.
+matrix_coturn_lt_cred_mech_username: ""
+# A password used authentication when `matrix_coturn_authentication_method` is `lt-cred-mech`.
+matrix_coturn_lt_cred_mech_password: ""
+
 # The external IP address of the machine where Coturn is.
 # If do not define an IP address here or in `matrix_coturn_turn_external_ip_addresses`, auto-detection via an EchoIP service will be done.
 # See `matrix_coturn_turn_external_ip_address_auto_detection_enabled`
diff --git a/roles/custom/matrix-coturn/tasks/validate_config.yml b/roles/custom/matrix-coturn/tasks/validate_config.yml
index 19ddb6e13..96205b0e0 100644
--- a/roles/custom/matrix-coturn/tasks/validate_config.yml
+++ b/roles/custom/matrix-coturn/tasks/validate_config.yml
@@ -9,10 +9,18 @@
   with_items:
     - {'old': 'matrix_coturn_docker_network', 'new': 'matrix_coturn_container_network'}
 
+- name: Fail if matrix_coturn_authentication_method is invalid
+  ansible.builtin.fail:
+    msg: >-
+      Invalid authentication method specified in `matrix_coturn_authentication_method`
+  when: "matrix_coturn_authentication_method not in ['auth-secret', 'lt-cred-mech']"
+
 - name: Fail if required Coturn settings not defined
   ansible.builtin.fail:
     msg: >-
-      You need to define a required configuration setting (`{{ item }}`) for using Coturn.
-  when: "vars[item] == ''"
+      You need to define a required configuration setting (`{{ item.name }}`).
+  when: "item.when | bool and vars[item.name] == ''"
   with_items:
-    - "matrix_coturn_turn_static_auth_secret"
+    - {'name': 'matrix_coturn_turn_static_auth_secret', when: "{{ matrix_coturn_authentication_method == 'auth-secret' }}"}
+    - {'name': 'matrix_coturn_lt_cred_mech_username', when: "{{ matrix_coturn_authentication_method == 'lt-cred-mech' }}"}
+    - {'name': 'matrix_coturn_lt_cred_mech_password', when: "{{ matrix_coturn_authentication_method == 'lt-cred-mech' }}"}
diff --git a/roles/custom/matrix-coturn/templates/turnserver.conf.j2 b/roles/custom/matrix-coturn/templates/turnserver.conf.j2
index b4688ff9e..8debab909 100644
--- a/roles/custom/matrix-coturn/templates/turnserver.conf.j2
+++ b/roles/custom/matrix-coturn/templates/turnserver.conf.j2
@@ -1,17 +1,27 @@
 #jinja2: lstrip_blocks: "True"
+
+{% if matrix_coturn_authentication_method == 'auth-secret' %}
 use-auth-secret
 static-auth-secret={{ matrix_coturn_turn_static_auth_secret }}
+userdb=/var/tmp/turnserver.db
+{% endif %}
+
+{% if matrix_coturn_authentication_method == 'lt-cred-mech' %}
+lt-cred-mech
+user={{ matrix_coturn_lt_cred_mech_username }}:{{ matrix_coturn_lt_cred_mech_password }}
+{% endif %}
+
 realm=turn.{{ matrix_server_fqn_matrix }}
 
 min-port={{ matrix_coturn_turn_udp_min_port }}
 max-port={{ matrix_coturn_turn_udp_max_port }}
+
 {% for ip in matrix_coturn_turn_external_ip_addresses %}
 external-ip={{ ip }}
 {% endfor %}
 
 log-file=stdout
 pidfile=/var/tmp/turnserver.pid
-userdb=/var/tmp/turnserver.db
 
 no-cli
 
diff --git a/roles/custom/matrix-dendrite/defaults/main.yml b/roles/custom/matrix-dendrite/defaults/main.yml
index 0e2c7223b..944d64858 100644
--- a/roles/custom/matrix-dendrite/defaults/main.yml
+++ b/roles/custom/matrix-dendrite/defaults/main.yml
@@ -283,6 +283,8 @@ matrix_dendrite_mscs_database: "dendrite_mscs"
 
 matrix_dendrite_client_api_turn_uris: []
 matrix_dendrite_client_api_turn_shared_secret: ""
+matrix_dendrite_client_api_turn_username: ""
+matrix_dendrite_client_api_turn_password: ""
 matrix_dendrite_client_api_turn_allow_guests: false
 
 matrix_dendrite_disable_tls_validation: false
diff --git a/roles/custom/matrix-dendrite/templates/dendrite.yaml.j2 b/roles/custom/matrix-dendrite/templates/dendrite.yaml.j2
index 2ca9b0628..02c08b9e7 100644
--- a/roles/custom/matrix-dendrite/templates/dendrite.yaml.j2
+++ b/roles/custom/matrix-dendrite/templates/dendrite.yaml.j2
@@ -202,8 +202,8 @@ client_api:
     turn_user_lifetime: ""
     turn_uris: {{ matrix_dendrite_client_api_turn_uris | to_json }}
     turn_shared_secret: {{ matrix_dendrite_client_api_turn_shared_secret | to_json }}
-    turn_username: ""
-    turn_password: ""
+    turn_username: {{ matrix_dendrite_client_api_turn_username | to_json }}
+    turn_password: {{ matrix_dendrite_client_api_turn_password | to_json }}
 
   # Settings for rate-limited endpoints. Rate limiting will kick in after the
   # threshold number of "slots" have been taken by requests from a specific
diff --git a/roles/custom/matrix-synapse/defaults/main.yml b/roles/custom/matrix-synapse/defaults/main.yml
index 9bdafe207..56d4162cf 100644
--- a/roles/custom/matrix-synapse/defaults/main.yml
+++ b/roles/custom/matrix-synapse/defaults/main.yml
@@ -1063,6 +1063,8 @@ matrix_synapse_database_database: "synapse"
 
 matrix_synapse_turn_uris: []
 matrix_synapse_turn_shared_secret: ""
+matrix_synapse_turn_username: ""
+matrix_synapse_turn_password: ""
 matrix_synapse_turn_allow_guests: false
 
 matrix_synapse_email_enabled: false
diff --git a/roles/custom/matrix-synapse/templates/synapse/homeserver.yaml.j2 b/roles/custom/matrix-synapse/templates/synapse/homeserver.yaml.j2
index bf2a359f5..b22178fcd 100644
--- a/roles/custom/matrix-synapse/templates/synapse/homeserver.yaml.j2
+++ b/roles/custom/matrix-synapse/templates/synapse/homeserver.yaml.j2
@@ -1263,13 +1263,13 @@ turn_uris: {{ matrix_synapse_turn_uris|to_json }}
 
 # The shared secret used to compute passwords for the TURN server
 #
-turn_shared_secret: {{ matrix_synapse_turn_shared_secret | string|to_json }}
+turn_shared_secret: {{ matrix_synapse_turn_shared_secret | string | to_json }}
 
 # The Username and password if the TURN server needs them and
 # does not use a token
 #
-#turn_username: "TURNSERVER_USERNAME"
-#turn_password: "TURNSERVER_PASSWORD"
+turn_username: {{ matrix_synapse_turn_username | string  | to_json }}
+turn_password: {{ matrix_synapse_turn_password | string  | to_json }}
 
 # How long generated TURN credentials last
 #

From 0f2f72f50f25782186ae9b66efebe8520813d06c Mon Sep 17 00:00:00 2001
From: Gouthaman Raveendran <31805744+gouthamravee@users.noreply.github.com>
Date: Sun, 18 Feb 2024 03:11:09 -0500
Subject: [PATCH 06/18] Update README.md (#3175)

---
 .../nginx-proxy-manager/README.md             | 31 +++++--------------
 1 file changed, 7 insertions(+), 24 deletions(-)

diff --git a/examples/reverse-proxies/nginx-proxy-manager/README.md b/examples/reverse-proxies/nginx-proxy-manager/README.md
index 38de85897..b4bce8846 100644
--- a/examples/reverse-proxies/nginx-proxy-manager/README.md
+++ b/examples/reverse-proxies/nginx-proxy-manager/README.md
@@ -26,23 +26,15 @@ Scheme: http
 Forward Hostname/IP: IP-ADDRESS-OF-YOUR-MATRIX
 Forward Port: 81
 
-# Custom locations
-# Add one custom location
-Define location: /
-Scheme: http
-Forward Hostname/IP: IP-ADDRESS-OF-YOUR-MATRIX
-Forward Port: 81
-Custom config:
-    proxy_set_header X-Forwarded-For $remote_addr;
-    proxy_set_header X-Forwarded-Proto $scheme;
-    proxy_set_header X-Real-IP $remote_addr;
-    client_max_body_size 50M;
-
 # SSL
 # Either 'Request a new certificate' or select an existing one
 SSL Certificate: matrix.DOMAIN or *.DOMAIN
 Force SSL: true
 HTTP/2 Support: true
+
+# Advanced
+Custom Nginx Configuration:
+	client_max_body_size 50M;
 ```
 
 Again, under the 'Proxy Hosts' page select `Add Proxy Host`, this time for your federation traffic. Apply the proxys configuration like this:
@@ -55,17 +47,6 @@ Scheme: http
 Forward Hostname/IP: IP-ADDRESS-OF-YOUR-MATRIX
 Forward Port: 8449
 
-# Custom locations
-# Add one custom location
-Define location: /
-Scheme: http
-Forward Hostname/IP: IP-ADDRESS-OF-YOUR-MATRIX
-Forward Port: 8449
-Custom config:
-    proxy_set_header X-Forwarded-For $remote_addr;
-    proxy_set_header X-Forwarded-Proto $scheme;
-    client_max_body_size 50M;
-
 # SSL
 # Either 'Request a new certificate' or select an existing one
 SSL Certificate: matrix.DOMAIN or *.DOMAIN
@@ -74,7 +55,9 @@ HTTP/2 Support: true
 
 # Advanced
 # Allows NPM to listen on the federation port
-Custom Nginx Configuration: listen 8448 ssl http2;
+Custom Nginx Configuration:
+	listen 8448 ssl http2;
+	client_max_body_size 50M;
 ```
 
 Also note, NPM would need to be configured for whatever other services you are using. For example, you would need to create additional proxy hosts for `element.DOMAIN` or `jitsi.DOMAIN`, which would use the forwarding port `81`.

From 367af472ea2e659f2cd19a0fe7e44bac6bc627da Mon Sep 17 00:00:00 2001
From: Slavi Pantaleev <slavi@devture.com>
Date: Mon, 19 Feb 2024 10:13:36 +0200
Subject: [PATCH 07/18] Add support for bridging to Facebook Messenger and
 Instagram via mautrix-meta

Related to: https://github.com/mautrix/facebook/issues/332

Fixes: https://github.com/spantaleev/matrix-docker-ansible-deploy/issues/3138
---
 CHANGELOG.md                                  |  17 +
 bin/rebuild-mautrix-meta-instagram.sh         |  39 +++
 ...guring-playbook-bridge-mautrix-facebook.md |   2 +
 ...uring-playbook-bridge-mautrix-instagram.md |   2 +
 ...-playbook-bridge-mautrix-meta-instagram.md |  90 +++++
 ...-playbook-bridge-mautrix-meta-messenger.md | 105 ++++++
 docs/configuring-playbook.md                  |   8 +-
 group_vars/matrix_servers                     | 158 +++++++++
 justfile                                      |   4 +
 .../README.md                                 |   5 +
 .../defaults/main.yml                         | 270 ++++++++++++++
 .../tasks/install.yml                         | 121 +++++++
 .../tasks/main.yml                            |  20 ++
 .../tasks/uninstall.yml                       |  20 ++
 .../tasks/validate_config.yml                 |  16 +
 .../templates/config.yaml.j2                  | 329 ++++++++++++++++++
 .../templates/labels.j2                       |  48 +++
 .../systemd/matrix-mautrix-meta.service.j2    |  51 +++
 .../defaults/main.yml                         | 270 ++++++++++++++
 .../tasks/install.yml                         | 121 +++++++
 .../tasks/main.yml                            |  20 ++
 .../tasks/uninstall.yml                       |  20 ++
 .../tasks/validate_config.yml                 |  16 +
 .../templates/config.yaml.j2                  | 329 ++++++++++++++++++
 .../templates/labels.j2                       |  48 +++
 .../systemd/matrix-mautrix-meta.service.j2    |  51 +++
 setup.yml                                     |   2 +
 27 files changed, 2180 insertions(+), 2 deletions(-)
 create mode 100644 bin/rebuild-mautrix-meta-instagram.sh
 create mode 100644 docs/configuring-playbook-bridge-mautrix-meta-instagram.md
 create mode 100644 docs/configuring-playbook-bridge-mautrix-meta-messenger.md
 create mode 100644 roles/custom/matrix-bridge-mautrix-meta-instagram/README.md
 create mode 100644 roles/custom/matrix-bridge-mautrix-meta-instagram/defaults/main.yml
 create mode 100644 roles/custom/matrix-bridge-mautrix-meta-instagram/tasks/install.yml
 create mode 100644 roles/custom/matrix-bridge-mautrix-meta-instagram/tasks/main.yml
 create mode 100644 roles/custom/matrix-bridge-mautrix-meta-instagram/tasks/uninstall.yml
 create mode 100644 roles/custom/matrix-bridge-mautrix-meta-instagram/tasks/validate_config.yml
 create mode 100644 roles/custom/matrix-bridge-mautrix-meta-instagram/templates/config.yaml.j2
 create mode 100644 roles/custom/matrix-bridge-mautrix-meta-instagram/templates/labels.j2
 create mode 100644 roles/custom/matrix-bridge-mautrix-meta-instagram/templates/systemd/matrix-mautrix-meta.service.j2
 create mode 100644 roles/custom/matrix-bridge-mautrix-meta-messenger/defaults/main.yml
 create mode 100644 roles/custom/matrix-bridge-mautrix-meta-messenger/tasks/install.yml
 create mode 100644 roles/custom/matrix-bridge-mautrix-meta-messenger/tasks/main.yml
 create mode 100644 roles/custom/matrix-bridge-mautrix-meta-messenger/tasks/uninstall.yml
 create mode 100644 roles/custom/matrix-bridge-mautrix-meta-messenger/tasks/validate_config.yml
 create mode 100644 roles/custom/matrix-bridge-mautrix-meta-messenger/templates/config.yaml.j2
 create mode 100644 roles/custom/matrix-bridge-mautrix-meta-messenger/templates/labels.j2
 create mode 100644 roles/custom/matrix-bridge-mautrix-meta-messenger/templates/systemd/matrix-mautrix-meta.service.j2

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 153be11fa..0f716c9a1 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,3 +1,20 @@
+# 2024-02-19
+
+## Support for bridging to Facebook/Messenger via the new mautrix-meta bridge
+
+The [mautrix-facebook](./docs/configuring-playbook-bridge-mautrix-facebook.md) and [mautrix-instagram](./docs/configuring-playbook-bridge-mautrix-instagram.md) bridges are being [superseded by a new bridge](https://github.com/mautrix/facebook/issues/332) - the [mautrix-meta](https://github.com/mautrix/meta) bridge.
+
+The playbook now supports the new mautrix-meta bridge - a single bridge, which can run in different modes and bridge to Messenger (via [Facebook](https://facebook.com/), Facebook over [Tor](https://www.torproject.org/) or via [Messenger](https://messenger.com/)) and [Instagram](https://instagram.com/). The playbook makes this bridge available via 2 separate Ansible roles, allowing you to easily run 2 instances of mautrix-meta, for bridging to both services at the same time.
+
+If you're using mautrix-facebook or mautrix-instagram right now, **you can still continue using the old bridges, but may wish to change to the new bridge implementations**. See:
+
+- [Setting up Instagram bridging via Mautrix Meta](docs/configuring-playbook-bridge-mautrix-meta-instagram.md)
+
+- [Setting up Messenger bridging via Mautrix Meta](docs/configuring-playbook-bridge-mautrix-meta-messenger.md)
+
+The documentation pages contain more information on how to migrate.
+
+
 # 2024-02-14
 
 ## Much larger Synapse caches and cache auto-tuning enabled by default
diff --git a/bin/rebuild-mautrix-meta-instagram.sh b/bin/rebuild-mautrix-meta-instagram.sh
new file mode 100644
index 000000000..d637168bd
--- /dev/null
+++ b/bin/rebuild-mautrix-meta-instagram.sh
@@ -0,0 +1,39 @@
+#!/bin/bash
+set -euxo pipefail
+
+# This script rebuilds the mautrix-meta-instagram Ansible role, using the mautrix-meta-messenger role as a source.
+
+if [ $# -eq 0 ]; then
+	echo "Error: No argument supplied. Please provide the path to the roles/custom directory."
+	exit 1
+fi
+
+roles_path=$1
+
+messenger_role_path=$roles_path/matrix-bridge-mautrix-meta-messenger
+instagram_role_path=$roles_path/matrix-bridge-mautrix-meta-instagram
+
+if [ ! -d $messenger_role_path ]; then
+	echo "Cannot find: $messenger_role_path"
+	exit 1
+fi
+
+if [ -d $instagram_role_path ]; then
+	rm -rf $instagram_role_path
+fi
+
+cp -ar $messenger_role_path $instagram_role_path
+
+find "$instagram_role_path" -type f | while read -r file; do
+	sed --in-place 's/matrix_mautrix_meta_messenger_/matrix_mautrix_meta_instagram_/g' "$file"
+	sed --in-place 's/mautrix-meta-messenger/mautrix-meta-instagram/g' "$file"
+done
+
+sed --in-place 's/matrix_mautrix_meta_instagram_meta_mode: \(.*\)/matrix_mautrix_meta_instagram_meta_mode: instagram/g' $instagram_role_path/defaults/main.yml
+sed --in-place 's/matrix_mautrix_meta_instagram_identifier: \(.*\)/matrix_mautrix_meta_instagram_identifier: matrix-mautrix-meta-instagram/g' $instagram_role_path/defaults/main.yml
+
+echo "# matrix-mautrix-meta-instagram" > $instagram_role_path/README.md
+echo "" >> $instagram_role_path/README.md
+echo "This bridge role is derived from the matrix-mautrix-meta-messenger Ansible role via automatic changes (see \`just rebuild-mautrix-meta-instagram\` or \`bin/rebuild-mautrix-meta-instagram.sh\`)." >> $instagram_role_path/README.md
+echo "" >> $instagram_role_path/README.md
+echo "If you'd like to make a change to this role, consider making it to the \`matrix-mautrix-meta-messenger\` role instead." >> $instagram_role_path/README.md
diff --git a/docs/configuring-playbook-bridge-mautrix-facebook.md b/docs/configuring-playbook-bridge-mautrix-facebook.md
index 82d51df32..ffb326beb 100644
--- a/docs/configuring-playbook-bridge-mautrix-facebook.md
+++ b/docs/configuring-playbook-bridge-mautrix-facebook.md
@@ -1,5 +1,7 @@
 # Setting up Mautrix Facebook (optional)
 
+**Note**: bridging to Facebook [Messenger](https://messenger.com) via this bridge is being [superseded by a new bridge - mautrix-meta](https://github.com/mautrix/facebook/issues/332). For now, the mautrix-facebook bridge continues to work, but the new [mautrix-meta-messenger bridge](./configuring-playbook-bridge-mautrix-meta-messenger.md) is better and more supported. Consider using that bridge instead of this one.
+
 The playbook can install and configure [mautrix-facebook](https://github.com/mautrix/facebook) for you.
 
 See the project's [documentation](https://github.com/mautrix/facebook/blob/master/ROADMAP.md) to learn what it does and why it might be useful to you.
diff --git a/docs/configuring-playbook-bridge-mautrix-instagram.md b/docs/configuring-playbook-bridge-mautrix-instagram.md
index c5b3feb7a..90458a028 100644
--- a/docs/configuring-playbook-bridge-mautrix-instagram.md
+++ b/docs/configuring-playbook-bridge-mautrix-instagram.md
@@ -1,5 +1,7 @@
 # Setting up Mautrix Instagram (optional)
 
+**Note**: bridging to Facebook [Instagram](https://instagram.com) via this bridge is being [superseded by a new bridge - mautrix-meta](https://github.com/mautrix/facebook/issues/332). For now, the mautrix-instagram bridge continues to work, but the new [mautrix-meta-instagram bridge](./configuring-playbook-bridge-mautrix-meta-instagram.md) is better and more supported. Consider using that bridge instead of this one.
+
 The playbook can install and configure [mautrix-instagram](https://github.com/mautrix/instagram) for you.
 
 See the project's [documentation](https://docs.mau.fi/bridges/python/instagram/index.html) to learn what it does and why it might be useful to you.
diff --git a/docs/configuring-playbook-bridge-mautrix-meta-instagram.md b/docs/configuring-playbook-bridge-mautrix-meta-instagram.md
new file mode 100644
index 000000000..0e30de56a
--- /dev/null
+++ b/docs/configuring-playbook-bridge-mautrix-meta-instagram.md
@@ -0,0 +1,90 @@
+# Setting up Instagram bridging via Mautrix Meta (optional)
+
+The playbook can install and configure the [mautrix-meta](https://github.com/mautrix/meta) Messenger/Instagram bridge for you.
+
+Since this bridge component can bridge to both [Messenger](https://messenger.com/) and [Instagram](https://instagram.com/) and you may wish to do both at the same time, the playbook makes it available via 2 different Ansible roles (`matrix-bridge-mautrix-meta-messenger` and `matrix-bridge-mautrix-meta-instagram`). The latter is a reconfigured copy of the first one (created by `just rebuild-mautrix-meta-instagram` and `bin/rebuild-mautrix-meta-instagram.sh`).
+
+This documentation page only deals with the bridge's ability to bridge to Instagram. For bridging to Facebook/Messenger, see [Setting up Messenger bridging via Mautrix Meta](configuring-playbook-bridge-mautrix-meta-messenger.md).
+
+
+## Migrating from the old mautrix-instagram bridge
+
+If you've been using the [mautrix-instagram](./configuring-playbook-bridge-mautrix-instagram.md) bridge, **you'd better get rid of it first** or the 2 bridges will be in conflict:
+
+- both trying to use `@instagrambot:YOUR_DOMAIN` as their username. This conflict may be resolved by adjusting `matrix_mautrix_instagram_appservice_bot_username` or `matrix_mautrix_meta_instagram_appservice_username`
+- both trying to bridge the same DMs
+
+To do so, send a `clean-rooms` command to the management room with the old bridge bot (`@instagrambot:YOUR_DOMAIN`).
+
+This would give you a list of portals and groups of portals you may purge. Proceed with sending commands like `clean recommended`, etc.
+
+Then, consider disabling the old bridge in your configuration, so it won't recreate the portals when you receive new messages.
+
+
+## Configuration
+
+Most simply, you can enable the bridge with the following playbook configuration:
+
+```yaml
+matrix_mautrix_meta_instagram_enabled: true
+```
+
+Before proceeding to [re-running the playbook](./installing.md), you may wish to adjust the configuration further. See below.
+
+### Bridge permissions
+
+By default, any user on your homeserver will be able to use the bridge.
+
+Different levels of permission can be granted to users:
+
+- `relay` - Allowed to be relayed through the bridge, no access to commands
+- `user` - Use the bridge with puppeting
+- `admin` - Use and administer the bridge
+
+The permissions are following the sequence: nothing < `relay` < `user` < `admin`.
+
+The default permissions are set via `matrix_mautrix_meta_instagram_bridge_permissions_default` and are somewhat like this:
+```yaml
+matrix_mautrix_meta_instagram_bridge_permissions_default:
+  '*': relay
+  YOUR_DOMAIN: user
+  '{{ matrix_admin }}': admin
+```
+
+If you don't define the `matrix_admin` in your configuration (e.g. `matrix_admin: @user:YOUR_DOMAIN`), then there's no admin by default.
+
+You may redefine `matrix_mautrix_meta_instagram_bridge_permissions_default` any way you see fit, or add extra permissions using `matrix_mautrix_meta_instagram_bridge_permissions_custom` like this:
+
+```yaml
+matrix_mautrix_meta_instagram_bridge_permissions_custom: |
+  '@YOUR_USERNAME:YOUR_DOMAIN': admin
+```
+
+You may wish to look at `roles/custom/matrix-bridge-mautrix-meta-instagram/templates/config.yaml.j2` to find more information on the permissions settings and other options you would like to configure.
+
+## Set up Double Puppeting
+
+If you'd like to use [Double Puppeting](https://docs.mau.fi/bridges/general/double-puppeting.html) (hint: you most likely do), you have 2 ways of going about it.
+
+### Method 1: automatically, by enabling Shared Secret Auth
+
+The bridge will automatically perform Double Puppeting if you enable [Shared Secret Auth](configuring-playbook-shared-secret-auth.md) for this playbook.
+
+This is the recommended way of setting up Double Puppeting, as it's easier to accomplish, works for all your users automatically, and has less of a chance of breaking in the future.
+
+### Method 2: manually, by asking each user to provide a working access token
+
+**Note**: This method for enabling Double Puppeting can be configured only after you've already set up bridging (see [Usage](#usage)).
+
+When using this method, **each user** that wishes to enable Double Puppeting needs to follow the following steps:
+
+- retrieve a Matrix access token for yourself. Refer to the documentation on [how to do that](obtaining-access-tokens.md).
+
+- send the access token to the bot. Example: `login-matrix MATRIX_ACCESS_TOKEN_HERE`
+
+- make sure you don't log out the session for which you obtained an access token some time in the future, as that would break the Double Puppeting feature
+
+
+## Usage
+
+You then need to start a chat with `@instagrambot:YOUR_DOMAIN` (where `YOUR_DOMAIN` is your base domain, not the `matrix.` domain).
diff --git a/docs/configuring-playbook-bridge-mautrix-meta-messenger.md b/docs/configuring-playbook-bridge-mautrix-meta-messenger.md
new file mode 100644
index 000000000..541f52112
--- /dev/null
+++ b/docs/configuring-playbook-bridge-mautrix-meta-messenger.md
@@ -0,0 +1,105 @@
+# Setting up Messenger bridging via Mautrix Meta (optional)
+
+The playbook can install and configure the [mautrix-meta](https://github.com/mautrix/meta) Messenger/Instagram bridge for you.
+
+Since this bridge component can bridge to both [Messenger](https://messenger.com/) and [Instagram](https://instagram.com/) and you may wish to do both at the same time, the playbook makes it available via 2 different Ansible roles (`matrix-bridge-mautrix-meta-messenger` and `matrix-bridge-mautrix-meta-instagram`). The latter is a reconfigured copy of the first one (created by `just rebuild-mautrix-meta-instagram` and `bin/rebuild-mautrix-meta-instagram.sh`).
+
+This documentation page only deals with the bridge's ability to bridge to Facebook Messenger. For bridging to Instagram, see [Setting up Instagram bridging via Mautrix Meta](configuring-playbook-bridge-mautrix-meta-instagram.md).
+
+
+## Migrating from the old mautrix-facebook bridge
+
+If you've been using the [mautrix-facebook](./configuring-playbook-bridge-mautrix-facebook.md) bridge, you may wish to get rid of it first.
+
+To do so, send a `clean-rooms` command to the management room with the old bridge bot (`@facebookbot:YOUR_DOMAIN`).
+
+This would give you a list of portals and groups of portals you may purge. Proceed with sending commands like `clean recommended`, etc.
+
+Then, consider disabling the old bridge in your configuration, so it won't recreate the portals when you receive new messages.
+
+
+## Configuration
+
+Most simply, you can enable the bridge with the following playbook configuration:
+
+```yaml
+matrix_mautrix_meta_messenger_enabled: true
+```
+
+Before proceeding to [re-running the playbook](./installing.md), you may wish to adjust the configuration further. See below.
+
+### Bridge mode
+
+As mentioned above, the [mautrix-meta](https://github.com/mautrix/meta) bridge supports multiple modes of operation.
+The bridge can pull your Messenger messages via 3 different methods:
+
+- (`facebook`) Facebook via `facebook.com`
+- (`facebook-tor`) Facebook via `facebookwkhpilnemxj7asaniu7vnjjbiltxjqhye3mhbshg7kx5tfyd.onion` ([Tor](https://www.torproject.org/)) - does not currently proxy media downloads
+- (default) (`messenger`) Messenger via `messenger.com` - usable even without a Facebook account
+
+You may switch the mode via the `matrix_mautrix_meta_messenger_meta_mode` variable. The playbook defaults to the `messenger` mode, because it's most universal (every Facebook user has a Messenger account, but the opposite is not true).
+
+Note that switching the mode (especially between `facebook*` and `messenger`) will intentionally make the bridge use another database (`matrix_mautrix_meta_facebook` or `matrix_mautrix_meta_messenger`) to isolate the 2 instances. Switching between Tor and non-Tor may be possible without dataloss, but your mileage may vary. Before switching to a new mode, you may wish to de-configure the old one (send `help` to the bridge bot and unbridge your portals, etc.).
+
+
+### Bridge permissions
+
+By default, any user on your homeserver will be able to use the bridge.
+
+Different levels of permission can be granted to users:
+
+- `relay` - Allowed to be relayed through the bridge, no access to commands
+- `user` - Use the bridge with puppeting
+- `admin` - Use and administer the bridge
+
+The permissions are following the sequence: nothing < `relay` < `user` < `admin`.
+
+The default permissions are set via `matrix_mautrix_meta_messenger_bridge_permissions_default` and are somewhat like this:
+```yaml
+matrix_mautrix_meta_messenger_bridge_permissions_default:
+  '*': relay
+  YOUR_DOMAIN: user
+  '{{ matrix_admin }}': admin
+```
+
+If you don't define the `matrix_admin` in your configuration (e.g. `matrix_admin: @user:YOUR_DOMAIN`), then there's no admin by default.
+
+You may redefine `matrix_mautrix_meta_messenger_bridge_permissions_default` any way you see fit, or add extra permissions using `matrix_mautrix_meta_messenger_bridge_permissions_custom` like this:
+
+```yaml
+matrix_mautrix_meta_messenger_bridge_permissions_custom: |
+  '@YOUR_USERNAME:YOUR_DOMAIN': admin
+```
+
+You may wish to look at `roles/custom/matrix-bridge-mautrix-meta-messenger/templates/config.yaml.j2` to find more information on the permissions settings and other options you would like to configure.
+
+## Set up Double Puppeting
+
+If you'd like to use [Double Puppeting](https://docs.mau.fi/bridges/general/double-puppeting.html) (hint: you most likely do), you have 2 ways of going about it.
+
+### Method 1: automatically, by enabling Shared Secret Auth
+
+The bridge will automatically perform Double Puppeting if you enable [Shared Secret Auth](configuring-playbook-shared-secret-auth.md) for this playbook.
+
+This is the recommended way of setting up Double Puppeting, as it's easier to accomplish, works for all your users automatically, and has less of a chance of breaking in the future.
+
+### Method 2: manually, by asking each user to provide a working access token
+
+**Note**: This method for enabling Double Puppeting can be configured only after you've already set up bridging (see [Usage](#usage)).
+
+When using this method, **each user** that wishes to enable Double Puppeting needs to follow the following steps:
+
+- retrieve a Matrix access token for yourself. Refer to the documentation on [how to do that](obtaining-access-tokens.md).
+
+- send the access token to the bot. Example: `login-matrix MATRIX_ACCESS_TOKEN_HERE`
+
+- make sure you don't log out the session for which you obtained an access token some time in the future, as that would break the Double Puppeting feature
+
+
+## Usage
+
+You then need to start a chat with `@messengerbot:YOUR_DOMAIN` (where `YOUR_DOMAIN` is your base domain, not the `matrix.` domain).
+
+You then need to send a `login` command and follow the bridge bot's instructions.
+
+Given that the bot is configured in `messenger` [bridge mode](#bridge-mode) by default, you will need to log in to [messenger.com](https://messenger.com/) (not `facebook.com`!) and obtain the cookies from there as per [the bridge's authentication instructions](https://docs.mau.fi/bridges/go/meta/authentication.html).
diff --git a/docs/configuring-playbook.md b/docs/configuring-playbook.md
index 413db7b8d..fb4597fc8 100644
--- a/docs/configuring-playbook.md
+++ b/docs/configuring-playbook.md
@@ -120,13 +120,17 @@ When you're done with all the configuration you'd like to do, continue with [Ins
 
 - [Setting up Mautrix Whatsapp bridging](configuring-playbook-bridge-mautrix-whatsapp.md) (optional)
 
-- [Setting up Mautrix Facebook bridging](configuring-playbook-bridge-mautrix-facebook.md) (optional)
+- [Setting up Instagram bridging via Mautrix Meta](configuring-playbook-bridge-mautrix-meta-instagram.md) (optional)
+
+- [Setting up Messenger bridging via Mautrix Meta](configuring-playbook-bridge-mautrix-meta-messenger.md) (optional)
+
+- ~~[Setting up Mautrix Facebook bridging](configuring-playbook-bridge-mautrix-facebook.md)~~ - consider bridging to Facebook/Messenger using the new [mautrix-meta-messenger](./configuring-playbook-bridge-mautrix-meta-messenger.md) bridge (optional)
 
 - [Setting up Mautrix Hangouts bridging](configuring-playbook-bridge-mautrix-hangouts.md) (optional)
 
 - [Setting up Mautrix Google Chat bridging](configuring-playbook-bridge-mautrix-googlechat.md) (optional)
 
-- [Setting up Mautrix Instagram bridging](configuring-playbook-bridge-mautrix-instagram.md) (optional)
+- ~~[Setting up Mautrix Instagram bridging](configuring-playbook-bridge-mautrix-instagram.md)~~ - consider bridging to Instagram using the new [mautrix-meta-instagram](./configuring-playbook-bridge-mautrix-meta-instagram.md) bridge (optional)
 
 - [Setting up Mautrix Twitter bridging](configuring-playbook-bridge-mautrix-twitter.md) (optional)
 
diff --git a/group_vars/matrix_servers b/group_vars/matrix_servers
index 2d2f7fdc7..a3ec55f06 100755
--- a/group_vars/matrix_servers
+++ b/group_vars/matrix_servers
@@ -101,6 +101,10 @@ matrix_homeserver_container_extra_arguments_auto: |
     +
     (['--mount type=bind,src=' + matrix_mautrix_signal_config_path + '/registration.yaml,dst=/matrix-mautrix-signal-registration.yaml,ro'] if matrix_mautrix_signal_enabled else [])
     +
+    (['--mount type=bind,src=' + matrix_mautrix_meta_messenger_config_path + '/registration.yaml,dst=/matrix-mautrix-meta-messenger-registration.yaml,ro'] if matrix_mautrix_meta_messenger_enabled else [])
+    +
+    (['--mount type=bind,src=' + matrix_mautrix_meta_instagram_config_path + '/registration.yaml,dst=/matrix-mautrix-meta-instagram-registration.yaml,ro'] if matrix_mautrix_meta_instagram_enabled else [])
+    +
     (['--mount type=bind,src=' + matrix_mautrix_telegram_config_path + '/registration.yaml,dst=/matrix-mautrix-telegram-registration.yaml,ro'] if matrix_mautrix_telegram_enabled else [])
     +
     (['--mount type=bind,src=' + matrix_mautrix_twitter_config_path + '/registration.yaml,dst=/matrix-mautrix-twitter-registration.yaml,ro'] if matrix_mautrix_twitter_enabled else [])
@@ -164,6 +168,10 @@ matrix_homeserver_app_service_config_files_auto: |
     +
     (['/matrix-mautrix-signal-registration.yaml'] if matrix_mautrix_signal_enabled else [])
     +
+    (['/matrix-mautrix-meta-messenger-registration.yaml'] if matrix_mautrix_meta_messenger_enabled else [])
+    +
+    (['/matrix-mautrix-meta-instagram-registration.yaml'] if matrix_mautrix_meta_instagram_enabled else [])
+    +
     (['/matrix-mautrix-telegram-registration.yaml'] if matrix_mautrix_telegram_enabled else [])
     +
     (['/matrix-mautrix-twitter-registration.yaml'] if matrix_mautrix_twitter_enabled else [])
@@ -294,6 +302,10 @@ devture_systemd_service_manager_services_list_auto: |
     +
     ([{'name': 'matrix-mautrix-signal.service', 'priority': 2000, 'groups': ['matrix', 'bridges', 'mautrix-signal', 'mautrix-signal']}] if matrix_mautrix_signal_enabled else [])
     +
+    ([{'name': (matrix_mautrix_meta_messenger_identifier + '.service'), 'priority': 2000, 'groups': ['matrix', 'bridges', 'mautrix-meta', 'mautrix-meta-messenger']}] if matrix_mautrix_meta_messenger_enabled else [])
+    +
+    ([{'name': (matrix_mautrix_meta_instagram_identifier + '.service'), 'priority': 2000, 'groups': ['matrix', 'bridges', 'mautrix-meta', 'mautrix-meta-instagram']}] if matrix_mautrix_meta_instagram_enabled else [])
+    +
     ([{'name': 'matrix-mautrix-telegram.service', 'priority': 2000, 'groups': ['matrix', 'bridges', 'mautrix-telegram']}] if matrix_mautrix_telegram_enabled else [])
     +
     ([{'name': 'matrix-mautrix-twitter.service', 'priority': 2000, 'groups': ['matrix', 'bridges', 'mautrix-twitter']}] if matrix_mautrix_twitter_enabled else [])
@@ -1288,6 +1300,140 @@ matrix_mautrix_signal_database_password: "{{ '%s' | format(matrix_homeserver_gen
 #
 ######################################################################
 
+
+######################################################################
+#
+# matrix-bridge-mautrix-meta-messenger
+#
+######################################################################
+
+# We don't enable bridges by default.
+matrix_mautrix_meta_messenger_enabled: false
+
+matrix_mautrix_meta_messenger_systemd_required_services_list_auto: |
+  {{
+    matrix_addons_homeserver_systemd_services_list
+    +
+    ([devture_postgres_identifier ~ '.service'] if (devture_postgres_enabled and matrix_mautrix_meta_messenger_database_hostname == devture_postgres_connection_hostname) else [])
+  }}
+
+matrix_mautrix_meta_messenger_container_image_self_build: "{{ matrix_architecture not in ['amd64', 'arm64'] }}"
+
+matrix_mautrix_meta_messenger_container_network: "{{ matrix_addons_container_network }}"
+
+matrix_mautrix_meta_messenger_container_additional_networks_auto: |-
+  {{
+    (
+      ([] if matrix_addons_homeserver_container_network == '' else [matrix_addons_homeserver_container_network])
+      +
+      ([devture_postgres_container_network] if (devture_postgres_enabled and matrix_mautrix_meta_messenger_database_hostname == devture_postgres_connection_hostname and matrix_mautrix_meta_messenger_container_network != devture_postgres_container_network) else [])
+      +
+      ([matrix_playbook_reverse_proxyable_services_additional_network] if (matrix_playbook_reverse_proxyable_services_additional_network and matrix_mautrix_meta_messenger_container_labels_traefik_enabled) else [])
+    ) | unique
+  }}
+
+matrix_mautrix_meta_messenger_container_labels_traefik_enabled: "{{ matrix_playbook_reverse_proxy_type in ['playbook-managed-traefik', 'other-traefik-container'] }}"
+matrix_mautrix_meta_messenger_container_labels_traefik_docker_network: "{{ matrix_playbook_reverse_proxyable_services_additional_network }}"
+matrix_mautrix_meta_messenger_container_labels_traefik_entrypoints: "{{ devture_traefik_entrypoint_primary }}"
+matrix_mautrix_meta_messenger_container_labels_traefik_tls_certResolver: "{{ devture_traefik_certResolver_primary }}"
+
+matrix_mautrix_meta_messenger_container_labels_metrics_middleware_basic_auth_enabled: "{{ matrix_metrics_exposure_http_basic_auth_enabled }}"
+matrix_mautrix_meta_messenger_container_labels_metrics_middleware_basic_auth_users: "{{ matrix_metrics_exposure_http_basic_auth_users }}"
+
+matrix_mautrix_meta_messenger_appservice_token: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'mau.meta.fb.as', rounds=655555) | to_uuid }}"
+
+matrix_mautrix_meta_messenger_homeserver_address: "{{ matrix_addons_homeserver_client_api_url }}"
+
+matrix_mautrix_meta_messenger_homeserver_token: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'mau.meta.fb.hs', rounds=655555) | to_uuid }}"
+
+matrix_mautrix_meta_messenger_bridge_login_shared_secret: "{{ matrix_synapse_ext_password_provider_shared_secret_auth_shared_secret if matrix_synapse_ext_password_provider_shared_secret_auth_enabled else '' }}"
+
+matrix_mautrix_meta_messenger_metrics_enabled: "{{ prometheus_enabled or matrix_metrics_exposure_enabled }}"
+
+matrix_mautrix_meta_messenger_metrics_proxying_enabled: "{{ matrix_mautrix_meta_messenger_metrics_enabled and matrix_metrics_exposure_enabled }}"
+matrix_mautrix_meta_messenger_metrics_proxying_hostname: "{{ matrix_metrics_exposure_hostname }}"
+matrix_mautrix_meta_messenger_metrics_proxying_path_prefix: "{{ matrix_metrics_exposure_path_prefix }}/mautrix-meta-messenger"
+
+# We'd like to force-set people with external Postgres to SQLite, so the bridge role can complain
+# and point them to a migration path.
+matrix_mautrix_meta_messenger_database_engine: "{{ 'postgres' if devture_postgres_enabled else 'sqlite3-fk-wal' }}"
+matrix_mautrix_meta_messenger_database_hostname: "{{ devture_postgres_connection_hostname if (devture_postgres_enabled and matrix_mautrix_meta_messenger_database_engine == 'postgres') else '' }}"
+matrix_mautrix_meta_messenger_database_password: "{{ ('%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'mau.fb.db', rounds=655555) | to_uuid) if (devture_postgres_enabled and matrix_mautrix_meta_messenger_database_engine == 'postgres') else '' }}"
+
+######################################################################
+#
+# /matrix-bridge-mautrix-meta-messenger
+#
+######################################################################
+
+
+
+######################################################################
+#
+# matrix-bridge-mautrix-meta-instagram
+#
+######################################################################
+
+# We don't enable bridges by default.
+matrix_mautrix_meta_instagram_enabled: false
+
+matrix_mautrix_meta_instagram_systemd_required_services_list_auto: |
+  {{
+    matrix_addons_homeserver_systemd_services_list
+    +
+    ([devture_postgres_identifier ~ '.service'] if (devture_postgres_enabled and matrix_mautrix_meta_instagram_database_hostname == devture_postgres_connection_hostname) else [])
+  }}
+
+matrix_mautrix_meta_instagram_container_image_self_build: "{{ matrix_architecture not in ['amd64', 'arm64'] }}"
+
+matrix_mautrix_meta_instagram_container_network: "{{ matrix_addons_container_network }}"
+
+matrix_mautrix_meta_instagram_container_additional_networks_auto: |-
+  {{
+    (
+      ([] if matrix_addons_homeserver_container_network == '' else [matrix_addons_homeserver_container_network])
+      +
+      ([devture_postgres_container_network] if (devture_postgres_enabled and matrix_mautrix_meta_instagram_database_hostname == devture_postgres_connection_hostname and matrix_mautrix_meta_instagram_container_network != devture_postgres_container_network) else [])
+      +
+      ([matrix_playbook_reverse_proxyable_services_additional_network] if (matrix_playbook_reverse_proxyable_services_additional_network and matrix_mautrix_meta_instagram_container_labels_traefik_enabled) else [])
+    ) | unique
+  }}
+
+matrix_mautrix_meta_instagram_container_labels_traefik_enabled: "{{ matrix_playbook_reverse_proxy_type in ['playbook-managed-traefik', 'other-traefik-container'] }}"
+matrix_mautrix_meta_instagram_container_labels_traefik_docker_network: "{{ matrix_playbook_reverse_proxyable_services_additional_network }}"
+matrix_mautrix_meta_instagram_container_labels_traefik_entrypoints: "{{ devture_traefik_entrypoint_primary }}"
+matrix_mautrix_meta_instagram_container_labels_traefik_tls_certResolver: "{{ devture_traefik_certResolver_primary }}"
+
+matrix_mautrix_meta_instagram_container_labels_metrics_middleware_basic_auth_enabled: "{{ matrix_metrics_exposure_http_basic_auth_enabled }}"
+matrix_mautrix_meta_instagram_container_labels_metrics_middleware_basic_auth_users: "{{ matrix_metrics_exposure_http_basic_auth_users }}"
+
+matrix_mautrix_meta_instagram_appservice_token: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'mau.meta.ig.as', rounds=655555) | to_uuid }}"
+
+matrix_mautrix_meta_instagram_homeserver_address: "{{ matrix_addons_homeserver_client_api_url }}"
+
+matrix_mautrix_meta_instagram_homeserver_token: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'mau.meta.ig.hs', rounds=655555) | to_uuid }}"
+
+matrix_mautrix_meta_instagram_bridge_login_shared_secret: "{{ matrix_synapse_ext_password_provider_shared_secret_auth_shared_secret if matrix_synapse_ext_password_provider_shared_secret_auth_enabled else '' }}"
+
+matrix_mautrix_meta_instagram_metrics_enabled: "{{ prometheus_enabled or matrix_metrics_exposure_enabled }}"
+
+matrix_mautrix_meta_instagram_metrics_proxying_enabled: "{{ matrix_mautrix_meta_instagram_metrics_enabled and matrix_metrics_exposure_enabled }}"
+matrix_mautrix_meta_instagram_metrics_proxying_hostname: "{{ matrix_metrics_exposure_hostname }}"
+matrix_mautrix_meta_instagram_metrics_proxying_path_prefix: "{{ matrix_metrics_exposure_path_prefix }}/mautrix-meta-instagram"
+
+# We'd like to force-set people with external Postgres to SQLite, so the bridge role can complain
+# and point them to a migration path.
+matrix_mautrix_meta_instagram_database_engine: "{{ 'postgres' if devture_postgres_enabled else 'sqlite3-fk-wal' }}"
+matrix_mautrix_meta_instagram_database_hostname: "{{ devture_postgres_connection_hostname if (devture_postgres_enabled and matrix_mautrix_meta_instagram_database_engine == 'postgres') else '' }}"
+matrix_mautrix_meta_instagram_database_password: "{{ ('%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'mau.fb.db', rounds=655555) | to_uuid) if (devture_postgres_enabled and matrix_mautrix_meta_instagram_database_engine == 'postgres') else '' }}"
+
+######################################################################
+#
+# /matrix-bridge-mautrix-meta-instagram
+#
+######################################################################
+
+
 ######################################################################
 #
 # matrix-bridge-mautrix-telegram
@@ -3455,6 +3601,18 @@ devture_postgres_managed_databases_auto: |
       'password': matrix_mautrix_signal_database_password,
     }] if (matrix_mautrix_signal_enabled and matrix_mautrix_signal_database_engine == 'postgres' and matrix_mautrix_signal_database_hostname == devture_postgres_connection_hostname) else [])
     +
+    ([{
+      'name': matrix_mautrix_meta_messenger_database_name,
+      'username': matrix_mautrix_meta_messenger_database_username,
+      'password': matrix_mautrix_meta_messenger_database_password,
+    }] if (matrix_mautrix_meta_messenger_enabled and matrix_mautrix_meta_messenger_database_engine == 'postgres' and matrix_mautrix_meta_messenger_database_hostname == devture_postgres_connection_hostname) else [])
+    +
+    ([{
+      'name': matrix_mautrix_meta_instagram_database_name,
+      'username': matrix_mautrix_meta_instagram_database_username,
+      'password': matrix_mautrix_meta_instagram_database_password,
+    }] if (matrix_mautrix_meta_instagram_enabled and matrix_mautrix_meta_instagram_database_engine == 'postgres' and matrix_mautrix_meta_instagram_database_hostname == devture_postgres_connection_hostname) else [])
+    +
     ([{
       'name': matrix_mautrix_wsproxy_syncproxy_database_name,
       'username': matrix_mautrix_wsproxy_syncproxy_database_username,
diff --git a/justfile b/justfile
index 46abd7bfb..b7ca7d2c4 100644
--- a/justfile
+++ b/justfile
@@ -58,3 +58,7 @@ stop-all *extra_args: (run-tags "stop-all" extra_args)
 # Stops a specific service group
 stop-group group *extra_args:
     @just --justfile {{ justfile() }} run-tags stop-group --extra-vars="group={{ group }}" {{ extra_args }}
+
+# Rebuilds the mautrix-meta-instagram Ansible role using the mautrix-meta-messenger role as a source
+rebuild-mautrix-meta-instagram:
+    /bin/bash {{ justfile_directory() }}/bin/rebuild-mautrix-meta-instagram.sh {{ justfile_directory() }}/roles/custom
diff --git a/roles/custom/matrix-bridge-mautrix-meta-instagram/README.md b/roles/custom/matrix-bridge-mautrix-meta-instagram/README.md
new file mode 100644
index 000000000..41e9d77d9
--- /dev/null
+++ b/roles/custom/matrix-bridge-mautrix-meta-instagram/README.md
@@ -0,0 +1,5 @@
+# matrix-mautrix-meta-instagram
+
+This bridge role is derived from the matrix-mautrix-meta-messenger Ansible role via automatic changes (see `just rebuild-mautrix-meta-instagram` or `bin/rebuild-mautrix-meta-instagram.sh`).
+
+If you'd like to make a change to this role, consider making it to the `matrix-mautrix-meta-messenger` role instead.
diff --git a/roles/custom/matrix-bridge-mautrix-meta-instagram/defaults/main.yml b/roles/custom/matrix-bridge-mautrix-meta-instagram/defaults/main.yml
new file mode 100644
index 000000000..da027a43b
--- /dev/null
+++ b/roles/custom/matrix-bridge-mautrix-meta-instagram/defaults/main.yml
@@ -0,0 +1,270 @@
+---
+
+# mautrix-meta is a Matrix <-> Facebook/Messenger/Instagram bridge
+# Project source code URL: https://github.com/mautrix/meta
+#
+# WARNING: this bridge role is used for both Messenger and Instagram.
+# This Messenger role acts as a source and auto-generates matrix-bridge-mautrix-meta-instagram
+# thanks to `just rebuild-mautrix-meta-instagram` (`bin/rebuild-mautrix-meta-instagram.sh`).
+# If you'd like to make changes to the Instagram role, consider making your changes to the Messenger role instead.
+
+matrix_mautrix_meta_instagram_enabled: true
+
+matrix_mautrix_meta_instagram_identifier: matrix-mautrix-meta-instagram
+
+# renovate: datasource=docker depName=dock.mau.dev/mautrix/meta
+matrix_mautrix_meta_instagram_version: v0.1.0
+
+matrix_mautrix_meta_instagram_base_path: "{{ matrix_base_data_path }}/mautrix-meta-instagram"
+matrix_mautrix_meta_instagram_config_path: "{{ matrix_mautrix_meta_instagram_base_path }}/config"
+matrix_mautrix_meta_instagram_data_path: "{{ matrix_mautrix_meta_instagram_base_path }}/data"
+matrix_mautrix_meta_instagram_container_src_files_path: "{{ matrix_mautrix_meta_instagram_base_path }}/container-src"
+
+matrix_mautrix_meta_instagram_container_image_self_build: false
+matrix_mautrix_meta_instagram_container_image_self_build_repo: "https://github.com/mautrix/meta.git"
+
+matrix_mautrix_meta_instagram_container_image: "{{ matrix_mautrix_meta_instagram_container_image_name_prefix }}mautrix/meta:{{ matrix_mautrix_meta_instagram_version }}"
+matrix_mautrix_meta_instagram_container_image_name_prefix: "{{ 'localhost/' if matrix_mautrix_meta_instagram_container_image_self_build else 'dock.mau.dev/' }}"
+matrix_mautrix_meta_instagram_container_image_force_pull: "{{ matrix_mautrix_meta_instagram_container_image.endswith(':latest') }}"
+
+matrix_mautrix_meta_instagram_container_network: ""
+
+matrix_mautrix_meta_instagram_container_additional_networks: "{{ matrix_mautrix_meta_instagram_container_additional_networks_auto + matrix_mautrix_meta_instagram_container_additional_networks_custom }}"
+matrix_mautrix_meta_instagram_container_additional_networks_auto: []
+matrix_mautrix_meta_instagram_container_additional_networks_custom: []
+
+# matrix_mautrix_meta_instagram_container_labels_traefik_enabled controls whether labels to assist a Traefik reverse-proxy will be attached to the container.
+# See `../templates/labels.j2` for details.
+#
+# To inject your own other container labels, see `matrix_mautrix_meta_instagram_container_labels_additional_labels`.
+matrix_mautrix_meta_instagram_container_labels_traefik_enabled: true
+matrix_mautrix_meta_instagram_container_labels_traefik_docker_network: "{{ matrix_mautrix_meta_instagram_container_network }}"
+matrix_mautrix_meta_instagram_container_labels_traefik_entrypoints: web-secure
+matrix_mautrix_meta_instagram_container_labels_traefik_tls_certResolver: default  # noqa var-naming
+
+# Controls whether labels will be added that expose the bridge's metrics
+matrix_mautrix_meta_instagram_container_labels_metrics_enabled: "{{ matrix_mautrix_meta_instagram_metrics_enabled and matrix_mautrix_meta_instagram_metrics_proxying_enabled }}"
+matrix_mautrix_meta_instagram_container_labels_metrics_traefik_rule: "Host(`{{ matrix_mautrix_meta_instagram_metrics_proxying_hostname }}`) && PathPrefix(`{{ matrix_mautrix_meta_instagram_metrics_proxying_path_prefix }}`)"
+matrix_mautrix_meta_instagram_container_labels_metrics_traefik_priority: 0
+matrix_mautrix_meta_instagram_container_labels_metrics_traefik_entrypoints: "{{ matrix_mautrix_meta_instagram_container_labels_traefik_entrypoints }}"
+matrix_mautrix_meta_instagram_container_labels_metrics_traefik_tls: "{{ matrix_mautrix_meta_instagram_container_labels_metrics_traefik_entrypoints != 'web' }}"
+matrix_mautrix_meta_instagram_container_labels_metrics_traefik_tls_certResolver: "{{ matrix_mautrix_meta_instagram_container_labels_traefik_tls_certResolver }}"  # noqa var-naming
+matrix_mautrix_meta_instagram_container_labels_metrics_middleware_basic_auth_enabled: false
+# See: https://doc.traefik.io/traefik/middlewares/http/basicauth/#users
+matrix_mautrix_meta_instagram_container_labels_metrics_middleware_basic_auth_users: ''
+
+# matrix_mautrix_meta_instagram_container_labels_additional_labels contains a multiline string with additional labels to add to the container label file.
+# See `../templates/labels.j2` for details.
+#
+# Example:
+# matrix_mautrix_meta_instagram_container_labels_additional_labels: |
+#   my.label=1
+#   another.label="here"
+matrix_mautrix_meta_instagram_container_labels_additional_labels: ''
+
+# A list of extra arguments to pass to the container
+matrix_mautrix_meta_instagram_container_extra_arguments: []
+
+# List of systemd services that the systemd service depends on.
+matrix_mautrix_meta_instagram_systemd_required_services_list: "{{ matrix_mautrix_meta_instagram_systemd_required_services_list_default + matrix_mautrix_meta_instagram_systemd_required_services_list_auto + matrix_mautrix_meta_instagram_systemd_required_services_list_custom }}"
+matrix_mautrix_meta_instagram_systemd_required_services_list_default: ['docker.service']
+matrix_mautrix_meta_instagram_systemd_required_services_list_auto: []
+matrix_mautrix_meta_instagram_systemd_required_services_list_custom: []
+
+# List of systemd services that the systemd service wants
+matrix_mautrix_meta_instagram_systemd_wanted_services_list: []
+
+# Controls whether the bridge container exposes its HTTP port.
+#
+# Takes an "<ip>:<port>" or "<port>" value (e.g. "127.0.0.1:29319"), or empty string to not expose.
+matrix_mautrix_meta_instagram_container_http_host_bind_port: ''
+
+# Database-related configuration fields
+matrix_mautrix_meta_instagram_database_engine: sqlite3-fk-wal
+
+matrix_mautrix_meta_instagram_sqlite_database_path_local: "{{ matrix_mautrix_meta_instagram_data_path }}/mautrix-meta.db"
+matrix_mautrix_meta_instagram_sqlite_database_path_in_container: "/data/mautrix-meta.db"
+
+matrix_mautrix_meta_instagram_database_suffix: |-
+  {{
+    ({
+      'facebook': '_facebook',
+      'facebook-tor': '_facebook',
+      'messenger': '_messenger',
+      'instagram': '_instagram',
+    })[matrix_mautrix_meta_instagram_meta_mode]
+  }}
+
+matrix_mautrix_meta_instagram_database_username: "matrix_mautrix_meta{{ matrix_mautrix_meta_instagram_database_suffix }}"
+matrix_mautrix_meta_instagram_database_password: ''
+matrix_mautrix_meta_instagram_database_hostname: ''
+matrix_mautrix_meta_instagram_database_port: 5432
+matrix_mautrix_meta_instagram_database_name: "matrix_mautrix_meta{{ matrix_mautrix_meta_instagram_database_suffix }}"
+matrix_mautrix_meta_instagram_database_sslmode: disable
+
+matrix_mautrix_meta_instagram_database_connection_string: 'postgres://{{ matrix_mautrix_meta_instagram_database_username }}:{{ matrix_mautrix_meta_instagram_database_password }}@{{ matrix_mautrix_meta_instagram_database_hostname }}:{{ matrix_mautrix_meta_instagram_database_port }}/{{ matrix_mautrix_meta_instagram_database_name }}?sslmode={{ matrix_mautrix_meta_instagram_database_sslmode }}'
+
+matrix_mautrix_meta_instagram_homeserver_address: ""
+matrix_mautrix_meta_instagram_homeserver_domain: '{{ matrix_domain }}'
+matrix_mautrix_meta_instagram_homeserver_token: ''
+
+matrix_mautrix_meta_instagram_appservice_address: "http://{{ matrix_mautrix_meta_instagram_identifier }}:29319"
+
+matrix_mautrix_meta_instagram_appservice_id: "{{ matrix_mautrix_meta_instagram_meta_mode }}"
+
+# For Facebook/Messenger, we use the same `@messengerbot:DOMAIN` username regardless of how bridging happens for multiple reasons:
+# - it's consistent - regardless of how bridging happens, the bridged service is actually Messenger
+# - it's easy for users - you may change the mode, but the bot is always at `@messengerbot:DOMAIN`
+# - it doesn't conflict with mautrix-facebook which uses `@facebookbot:DOMAIN`
+# - `matrix_mautrix_meta_instagram_appservice_avatar` only has icons for Messenger and Instagram, not Facebook
+matrix_mautrix_meta_instagram_appservice_username_prefix: |-
+  {{
+    ({
+      'facebook': 'messenger',
+      'facebook-tor': 'messenger',
+      'messenger': 'messenger',
+      'instagram': 'instagram',
+    })[matrix_mautrix_meta_instagram_meta_mode]
+  }}
+matrix_mautrix_meta_instagram_appservice_username: "{{ matrix_mautrix_meta_instagram_appservice_username_prefix }}bot"
+matrix_mautrix_meta_instagram_appservice_displayname: "{{ matrix_mautrix_meta_instagram_meta_mode | capitalize }} bridge bot"
+matrix_mautrix_meta_instagram_appservice_avatar: "{{ 'mxc://maunium.net/JxjlbZUlCPULEeHZSwleUXQv' if matrix_mautrix_meta_instagram_meta_mode == 'instagram' else 'mxc://maunium.net/ygtkteZsXnGJLJHRchUwYWak' }}"
+
+matrix_mautrix_meta_instagram_appservice_database_type: "{{ matrix_mautrix_meta_instagram_database_engine }}"
+
+matrix_mautrix_meta_instagram_appservice_database_uri: |-
+  {{
+    {
+      'sqlite3-fk-wal': ('sqlite:///' + matrix_mautrix_meta_instagram_sqlite_database_path_in_container),
+      'postgres': matrix_mautrix_meta_instagram_database_connection_string,
+    }[matrix_mautrix_meta_instagram_database_engine]
+  }}
+
+matrix_mautrix_meta_instagram_appservice_token: ''
+
+# Controls which service this bridge is for.
+# Valid options:
+# * facebook - connect to FB Messenger via facebook.com
+# * facebook-tor - connect to FB Messenger via facebookwkhpilnemxj7asaniu7vnjjbiltxjqhye3mhbshg7kx5tfyd.onion
+#                  (note: does not currently proxy media downloads)
+# * messenger - connect to FB Messenger via messenger.com (can be used with the facebook side deactivated)
+# * instagram - connect to Instagram DMs via instagram.com
+matrix_mautrix_meta_instagram_meta_mode: instagram
+
+# When in `instagram` mode (see `matrix_mautrix_meta_instagram_meta_mode`), should the bridge connect to WhatsApp servers for encrypted chats?
+matrix_mautrix_meta_instagram_meta_ig_e2ee: false
+
+# Whether or not metrics endpoint should be enabled.
+# Enabling them is usually enough for a local (in-container) Prometheus to consume them.
+# If metrics need to be consumed by another (external) Prometheus server, consider exposing them via `matrix_mautrix_meta_instagram_metrics_proxying_enabled`.
+matrix_mautrix_meta_instagram_metrics_enabled: false
+
+# Controls whether metrics should be exposed on a public URL.
+matrix_mautrix_meta_instagram_metrics_proxying_enabled: false
+matrix_mautrix_meta_instagram_metrics_proxying_hostname: ''
+matrix_mautrix_meta_instagram_metrics_proxying_path_prefix: ''
+
+matrix_mautrix_meta_instagram_bridge_username_prefix: |-
+  {{
+    ({
+      'facebook': 'facebook_',
+      'facebook-tor': 'facebook_',
+      'messenger': 'messenger_',
+      'instagram': 'instagram_',
+    })[matrix_mautrix_meta_instagram_meta_mode]
+  }}
+
+# Localpart template of MXIDs for FB/IG users.
+# {{.}} is replaced with the internal ID of the FB/IG user.
+# Changing this may require that you change the regex in the appservice.
+matrix_mautrix_meta_instagram_bridge_username_template: "{{ matrix_mautrix_meta_instagram_bridge_username_prefix + '{{.}}' }}"
+
+matrix_mautrix_meta_instagram_bridge_displayname_template: '{% raw %}{{or .DisplayName .Username "Unknown user"}}{% endraw %}'
+
+# The prefix for commands. Only required in non-management rooms.
+# If set to "default", will be determined based on meta -> mode (`matrix_mautrix_meta_instagram_meta_mode`):
+# - "!ig" for instagram
+# - "!fb" for facebook
+matrix_mautrix_meta_instagram_bridge_command_prefix: default
+
+# Whether or not created rooms should have federation enabled.
+# If false, created portal rooms will never be federated.
+matrix_mautrix_meta_instagram_bridge_federate_rooms: true
+
+# Enable End-to-bridge encryption
+matrix_mautrix_meta_instagram_bridge_encryption_allow: "{{ matrix_bridges_encryption_enabled }}"
+matrix_mautrix_meta_instagram_bridge_encryption_default: "{{ matrix_mautrix_meta_instagram_bridge_encryption_allow }}"
+matrix_mautrix_meta_instagram_bridge_encryption_allow_key_sharing: "{{ matrix_mautrix_meta_instagram_bridge_encryption_allow }}"
+matrix_mautrix_meta_instagram_bridge_encryption_appservice: false
+matrix_mautrix_meta_instagram_bridge_encryption_require: false
+
+# Can be set to enable automatic double-puppeting via Shared Secret Auth (https://github.com/devture/matrix-synapse-shared-secret-auth).
+matrix_mautrix_meta_instagram_bridge_login_shared_secret: ''
+
+matrix_mautrix_meta_instagram_bridge_login_shared_secret_map: "{{ {matrix_mautrix_meta_instagram_homeserver_domain: matrix_mautrix_meta_instagram_bridge_login_shared_secret} if matrix_mautrix_meta_instagram_bridge_login_shared_secret else {} }}"
+
+matrix_mautrix_meta_instagram_bridge_permissions: "{{ matrix_mautrix_meta_instagram_bridge_permissions_default | combine(matrix_mautrix_meta_instagram_bridge_permissions_custom) }}"
+
+matrix_mautrix_meta_instagram_bridge_permissions_default: |-
+  {{
+    {'*': 'relay', matrix_mautrix_meta_instagram_homeserver_domain: 'user'}
+    | combine({matrix_admin: 'admin'} if matrix_admin else {})
+  }}
+
+matrix_mautrix_meta_instagram_bridge_permissions_custom: {}
+
+# Enable bridge relay bot functionality
+matrix_mautrix_meta_instagram_bridge_relay_enabled: "{{ matrix_bridges_relay_enabled }}"
+matrix_mautrix_meta_instagram_bridge_relay_admin_only: true
+
+matrix_mautrix_meta_instagram_bridge_management_room_text_welcome: |-
+  {{
+    ({
+      'facebook': "Hello, I'm a Facebook bridge bot.",
+      'facebook-tor': "Hello, I'm a Facebook bridge bot which uses Tor.",
+      'messenger': "Hello, I'm a Messenger bridge bot.",
+      'instagram': "Hello, I'm an Instagram bridge bot.",
+    })[matrix_mautrix_meta_instagram_meta_mode]
+  }}
+
+# Specifies the default log level.
+# This bridge uses zerolog, so valid levels are: panic, fatal, error, warn, info, debug, trace
+matrix_mautrix_meta_instagram_logging_min_level: warn
+
+# Default configuration template which covers the generic use case.
+# You can customize it by controlling the various variables inside it.
+#
+# For a more advanced customization, you can extend the default (see `matrix_mautrix_meta_instagram_configuration_extension_yaml`)
+# or completely replace this variable with your own template.
+matrix_mautrix_meta_instagram_configuration_yaml: "{{ lookup('template', 'templates/config.yaml.j2') }}"
+
+matrix_mautrix_meta_instagram_configuration_extension_yaml: |
+  # Your custom YAML configuration goes here.
+  # This configuration extends the default starting configuration (`matrix_mautrix_meta_instagram_configuration_yaml`).
+  #
+  # You can override individual variables from the default configuration, or introduce new ones.
+  #
+  # If you need something more special, you can take full control by
+  # completely redefining `matrix_mautrix_meta_instagram_configuration_yaml`.
+
+matrix_mautrix_meta_instagram_configuration_extension: "{{ matrix_mautrix_meta_instagram_configuration_extension_yaml | from_yaml if matrix_mautrix_meta_instagram_configuration_extension_yaml | from_yaml is mapping else {} }}"
+
+# Holds the final configuration (a combination of the default and its extension).
+# You most likely don't need to touch this variable. Instead, see `matrix_mautrix_meta_instagram_configuration_yaml`.
+matrix_mautrix_meta_instagram_configuration: "{{ matrix_mautrix_meta_instagram_configuration_yaml | from_yaml | combine(matrix_mautrix_meta_instagram_configuration_extension, recursive=True) }}"
+
+matrix_mautrix_meta_instagram_registration_yaml: |
+  id: {{ matrix_mautrix_meta_instagram_appservice_id | to_json }}
+  as_token: {{ matrix_mautrix_meta_instagram_appservice_token | to_json }}
+  hs_token: {{ matrix_mautrix_meta_instagram_homeserver_token | to_json }}
+  namespaces:
+    users:
+    - exclusive: true
+      regex: '^@{{ matrix_mautrix_meta_instagram_bridge_username_prefix }}.+:{{ matrix_mautrix_meta_instagram_homeserver_domain | regex_escape }}$'
+    - exclusive: true
+      regex: '^@{{ matrix_mautrix_meta_instagram_appservice_username | regex_escape }}:{{ matrix_mautrix_meta_instagram_homeserver_domain | regex_escape }}$'
+  url: {{ matrix_mautrix_meta_instagram_appservice_address }}
+  sender_localpart: _bot_{{ matrix_mautrix_meta_instagram_appservice_username }}
+  rate_limited: false
+
+matrix_mautrix_meta_instagram_registration: "{{ matrix_mautrix_meta_instagram_registration_yaml | from_yaml }}"
diff --git a/roles/custom/matrix-bridge-mautrix-meta-instagram/tasks/install.yml b/roles/custom/matrix-bridge-mautrix-meta-instagram/tasks/install.yml
new file mode 100644
index 000000000..906e5040d
--- /dev/null
+++ b/roles/custom/matrix-bridge-mautrix-meta-instagram/tasks/install.yml
@@ -0,0 +1,121 @@
+---
+
+- ansible.builtin.set_fact:
+    matrix_mautrix_meta_instagram_requires_restart: false
+
+- when: "matrix_mautrix_meta_instagram_database_engine == 'postgres'"
+  block:
+    - name: Check if an SQLite database already exists
+      ansible.builtin.stat:
+        path: "{{ matrix_mautrix_meta_instagram_sqlite_database_path_local }}"
+      register: matrix_mautrix_meta_instagram_sqlite_database_path_local_stat_result
+
+    - when: "matrix_mautrix_meta_instagram_sqlite_database_path_local_stat_result.stat.exists | bool"
+      block:
+        - ansible.builtin.include_role:
+            name: galaxy/com.devture.ansible.role.postgres
+            tasks_from: migrate_db_to_postgres
+          vars:
+            devture_postgres_db_migration_request:
+              src: "{{ matrix_mautrix_meta_instagram_sqlite_database_path_local }}"
+              dst: "{{ matrix_mautrix_meta_instagram_database_connection_string }}"
+              caller: "{{ role_path | basename }}"
+              engine_variable_name: 'matrix_mautrix_meta_instagram_database_engine'
+              engine_old: 'sqlite'
+              systemd_services_to_stop: "{{ [matrix_mautrix_meta_instagram_identifier + '.service'] }}"
+
+        - ansible.builtin.set_fact:
+            matrix_mautrix_meta_instagram_requires_restart: true
+
+- name: Ensure mautrix-meta-instagram container image is pulled
+  community.docker.docker_image:
+    name: "{{ matrix_mautrix_meta_instagram_container_image }}"
+    source: "{{ 'pull' if ansible_version.major > 2 or ansible_version.minor > 7 else omit }}"
+    force_source: "{{ matrix_mautrix_meta_instagram_container_image_force_pull if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}"
+    force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else matrix_mautrix_meta_instagram_container_image_force_pull }}"
+  when: not matrix_mautrix_meta_instagram_container_image_self_build
+  register: result
+  retries: "{{ devture_playbook_help_container_retries_count }}"
+  delay: "{{ devture_playbook_help_container_retries_delay }}"
+  until: result is not failed
+
+- name: Ensure mautrix-meta-instagram paths exist
+  ansible.builtin.file:
+    path: "{{ item.path }}"
+    state: directory
+    mode: 0750
+    owner: "{{ matrix_user_username }}"
+    group: "{{ matrix_user_groupname }}"
+  with_items:
+    - {path: "{{ matrix_mautrix_meta_instagram_base_path }}", when: true}
+    - {path: "{{ matrix_mautrix_meta_instagram_config_path }}", when: true}
+    - {path: "{{ matrix_mautrix_meta_instagram_data_path }}", when: true}
+    - {path: "{{ matrix_mautrix_meta_instagram_container_src_files_path }}", when: "{{ matrix_mautrix_meta_instagram_container_image_self_build }}"}
+  when: item.when | bool
+
+- when: matrix_mautrix_meta_instagram_container_image_self_build | bool
+  block:
+    - name: Ensure mautrix-meta-instagram repository is present on self-build
+      ansible.builtin.git:
+        repo: "{{ matrix_mautrix_meta_instagram_container_image_self_build_repo }}"
+        dest: "{{ matrix_mautrix_meta_instagram_container_src_files_path }}"
+        version: "{{ matrix_mautrix_meta_instagram_container_image.split(':')[1] }}"
+        force: "yes"
+      become: true
+      become_user: "{{ matrix_user_username }}"
+      register: matrix_mautrix_meta_instagram_git_pull_results
+
+    - name: Ensure mautrix-meta-instagram container image is built
+      community.docker.docker_image:
+        name: "{{ matrix_mautrix_meta_instagram_container_image }}"
+        source: build
+        force_source: "{{ matrix_mautrix_meta_instagram_git_pull_results.changed if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}"
+        force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else matrix_mautrix_meta_instagram_git_pull_results.changed }}"
+        build:
+          dockerfile: Dockerfile
+          path: "{{ matrix_mautrix_meta_instagram_container_src_files_path }}"
+          pull: true
+
+- name: Ensure mautrix-meta-instagram config.yaml installed
+  ansible.builtin.copy:
+    content: "{{ matrix_mautrix_meta_instagram_configuration | to_nice_yaml(indent=2, width=999999) }}"
+    dest: "{{ matrix_mautrix_meta_instagram_config_path }}/config.yaml"
+    mode: 0644
+    owner: "{{ matrix_user_username }}"
+    group: "{{ matrix_user_groupname }}"
+
+- name: Ensure mautrix-meta-instagram registration.yaml installed
+  ansible.builtin.copy:
+    content: "{{ matrix_mautrix_meta_instagram_registration | to_nice_yaml(indent=2, width=999999) }}"
+    dest: "{{ matrix_mautrix_meta_instagram_config_path }}/registration.yaml"
+    mode: 0644
+    owner: "{{ matrix_user_username }}"
+    group: "{{ matrix_user_groupname }}"
+
+- name: Ensure mautrix-meta-instagram support files installed
+  ansible.builtin.template:
+    src: "{{ role_path }}/templates/{{ item }}.j2"
+    dest: "{{ matrix_mautrix_meta_instagram_base_path }}/{{ item }}"
+    mode: 0640
+    owner: "{{ matrix_user_username }}"
+    group: "{{ matrix_user_groupname }}"
+  with_items:
+    - labels
+
+- name: Ensure mautrix-meta-instagram container network is created
+  community.general.docker_network:
+    name: "{{ matrix_mautrix_meta_instagram_container_network }}"
+    driver: bridge
+
+- name: Ensure mautrix-meta-instagram.service installed
+  ansible.builtin.template:
+    src: "{{ role_path }}/templates/systemd/matrix-mautrix-meta.service.j2"
+    dest: "{{ devture_systemd_docker_base_systemd_path }}/{{ matrix_mautrix_meta_instagram_identifier }}.service"
+    mode: 0644
+
+- name: Ensure mautrix-meta-instagram.service restarted, if necessary
+  ansible.builtin.service:
+    name: "{{ matrix_mautrix_meta_instagram_identifier }}.service"
+    state: restarted
+    daemon_reload: true
+  when: "matrix_mautrix_meta_instagram_requires_restart | bool"
diff --git a/roles/custom/matrix-bridge-mautrix-meta-instagram/tasks/main.yml b/roles/custom/matrix-bridge-mautrix-meta-instagram/tasks/main.yml
new file mode 100644
index 000000000..0acc399f0
--- /dev/null
+++ b/roles/custom/matrix-bridge-mautrix-meta-instagram/tasks/main.yml
@@ -0,0 +1,20 @@
+---
+
+- tags:
+    - setup-all
+    - setup-mautrix-meta-instagram
+    - install-all
+    - install-mautrix-meta-instagram
+  block:
+    - when: matrix_mautrix_meta_instagram_enabled | bool
+      ansible.builtin.include_tasks: "{{ role_path }}/tasks/validate_config.yml"
+
+    - when: matrix_mautrix_meta_instagram_enabled | bool
+      ansible.builtin.include_tasks: "{{ role_path }}/tasks/install.yml"
+
+- tags:
+    - setup-all
+    - setup-mautrix-meta-instagram
+  block:
+    - when: not matrix_mautrix_meta_instagram_enabled | bool
+      ansible.builtin.include_tasks: "{{ role_path }}/tasks/uninstall.yml"
diff --git a/roles/custom/matrix-bridge-mautrix-meta-instagram/tasks/uninstall.yml b/roles/custom/matrix-bridge-mautrix-meta-instagram/tasks/uninstall.yml
new file mode 100644
index 000000000..991f47b40
--- /dev/null
+++ b/roles/custom/matrix-bridge-mautrix-meta-instagram/tasks/uninstall.yml
@@ -0,0 +1,20 @@
+---
+
+- name: Check existence of mautrix-meta-instagram service
+  ansible.builtin.stat:
+    path: "{{ devture_systemd_docker_base_systemd_path }}/{{ matrix_mautrix_meta_instagram_identifier }}.service"
+  register: matrix_mautrix_meta_instagram_service_stat
+
+- when: matrix_mautrix_meta_instagram_service_stat.stat.exists | bool
+  block:
+    - name: Ensure mautrix-meta-instagram is stopped
+      ansible.builtin.service:
+        name: "{{ matrix_mautrix_meta_instagram_identifier }}"
+        state: stopped
+        enabled: false
+        daemon_reload: true
+
+    - name: Ensure mautrix-meta-instagram.service doesn't exist
+      ansible.builtin.file:
+        path: "{{ devture_systemd_docker_base_systemd_path }}/{{ matrix_mautrix_meta_instagram_identifier }}.service"
+        state: absent
diff --git a/roles/custom/matrix-bridge-mautrix-meta-instagram/tasks/validate_config.yml b/roles/custom/matrix-bridge-mautrix-meta-instagram/tasks/validate_config.yml
new file mode 100644
index 000000000..e4d2c1596
--- /dev/null
+++ b/roles/custom/matrix-bridge-mautrix-meta-instagram/tasks/validate_config.yml
@@ -0,0 +1,16 @@
+---
+
+- name: Fail if required mautrix-meta-instagram settings not defined
+  ansible.builtin.fail:
+    msg: >-
+      You need to define a required configuration setting (`{{ item.name }}`).
+  when: "item.when | bool and vars[item.name] == ''"
+  with_items:
+    - {'name': 'matrix_mautrix_meta_instagram_metrics_proxying_hostname', when: "{{ matrix_mautrix_meta_instagram_metrics_proxying_enabled }}"}
+    - {'name': 'matrix_mautrix_meta_instagram_metrics_proxying_path_prefix', when: "{{ matrix_mautrix_meta_instagram_metrics_proxying_enabled }}"}
+    - {'name': 'matrix_mautrix_meta_instagram_appservice_token', when: true}
+    - {'name': 'matrix_mautrix_meta_instagram_homeserver_token', when: true}
+    - {'name': 'matrix_mautrix_meta_instagram_container_network', when: true}
+    - {'name': 'matrix_mautrix_meta_instagram_homeserver_address', when: true}
+    - {'name': 'matrix_mautrix_meta_instagram_database_hostname', when: "{{ matrix_mautrix_meta_instagram_database_engine == 'postgres' }}"}
+    - {'name': 'matrix_mautrix_meta_instagram_database_password', when: "{{ matrix_mautrix_meta_instagram_database_engine == 'postgres' }}"}
diff --git a/roles/custom/matrix-bridge-mautrix-meta-instagram/templates/config.yaml.j2 b/roles/custom/matrix-bridge-mautrix-meta-instagram/templates/config.yaml.j2
new file mode 100644
index 000000000..fe1287cc5
--- /dev/null
+++ b/roles/custom/matrix-bridge-mautrix-meta-instagram/templates/config.yaml.j2
@@ -0,0 +1,329 @@
+#jinja2: lstrip_blocks: "True"
+# Homeserver details.
+homeserver:
+    # The address that this appservice can use to connect to the homeserver.
+    address: {{ matrix_mautrix_meta_instagram_homeserver_address | to_json }}
+    # The domain of the homeserver (also known as server_name, used for MXIDs, etc).
+    domain: {{ matrix_mautrix_meta_instagram_homeserver_domain | to_json }}
+
+    # What software is the homeserver running?
+    # Standard Matrix homeservers like Synapse, Dendrite and Conduit should just use "standard" here.
+    software: standard
+    # The URL to push real-time bridge status to.
+    # If set, the bridge will make POST requests to this URL whenever a user's meta connection state changes.
+    # The bridge will use the appservice as_token to authorize requests.
+    status_endpoint: null
+    # Endpoint for reporting per-message status.
+    message_send_checkpoint_endpoint: null
+    # Does the homeserver support https://github.com/matrix-org/matrix-spec-proposals/pull/2246?
+    async_media: false
+
+    # Should the bridge use a websocket for connecting to the homeserver?
+    # The server side is currently not documented anywhere and is only implemented by mautrix-wsproxy,
+    # mautrix-asmux (deprecated), and hungryserv (proprietary).
+    websocket: false
+    # How often should the websocket be pinged? Pinging will be disabled if this is zero.
+    ping_interval_seconds: 0
+
+# Application service host/registration related details.
+# Changing these values requires regeneration of the registration.
+appservice:
+    # The address that the homeserver can use to connect to this appservice.
+    address: {{ matrix_mautrix_meta_instagram_appservice_address | to_json }}
+
+    # The hostname and port where this appservice should listen.
+    hostname: 0.0.0.0
+    port: 29319
+
+    # Database config.
+    database:
+        # The database type. "sqlite3-fk-wal" and "postgres" are supported.
+        type: {{ matrix_mautrix_meta_instagram_appservice_database_type | to_json }}
+        # The database URI.
+        #   SQLite: A raw file path is supported, but `file:<path>?_txlock=immediate` is recommended.
+        #           https://github.com/mattn/go-sqlite3#connection-string
+        #   Postgres: Connection string. For example, postgres://user:password@host/database?sslmode=disable
+        #             To connect via Unix socket, use something like postgres:///dbname?host=/var/run/postgresql
+        uri: {{ matrix_mautrix_meta_instagram_appservice_database_uri | to_json }}
+        # Maximum number of connections. Mostly relevant for Postgres.
+        max_open_conns: 20
+        max_idle_conns: 2
+        # Maximum connection idle time and lifetime before they're closed. Disabled if null.
+        # Parsed with https://pkg.go.dev/time#ParseDuration
+        max_conn_idle_time: null
+        max_conn_lifetime: null
+
+    # The unique ID of this appservice.
+    id: {{ matrix_mautrix_meta_instagram_appservice_id | to_json }}
+    # Appservice bot details.
+    bot:
+        # Username of the appservice bot.
+        username: {{ matrix_mautrix_meta_instagram_appservice_username | to_json }}
+        # Display name and avatar for bot. Set to "remove" to remove display name/avatar, leave empty
+        # to leave display name/avatar as-is.
+        displayname: {{ matrix_mautrix_meta_instagram_appservice_displayname | to_json }}
+        # You can use mxc://maunium.net/JxjlbZUlCPULEeHZSwleUXQv for an Instagram avatar,
+        # or mxc://maunium.net/ygtkteZsXnGJLJHRchUwYWak for Facebook Messenger
+        avatar: {{ matrix_mautrix_meta_instagram_appservice_avatar | to_json }}
+
+    # Whether or not to receive ephemeral events via appservice transactions.
+    # Requires MSC2409 support (i.e. Synapse 1.22+).
+    ephemeral_events: true
+    # Should incoming events be handled asynchronously?
+    # This may be necessary for large public instances with lots of messages going through.
+    # However, messages will not be guaranteed to be bridged in the same order they were sent in.
+    async_transactions: false
+
+    # Authentication tokens for AS <-> HS communication. Autogenerated; do not modify.
+    as_token: {{ matrix_mautrix_meta_instagram_appservice_token | to_json }}
+    hs_token: {{ matrix_mautrix_meta_instagram_homeserver_token | to_json }}
+
+# Prometheus config.
+metrics:
+    # Enable prometheus metrics?
+    enabled: {{ matrix_mautrix_meta_instagram_metrics_enabled | to_json }}
+    # IP and port where the metrics listener should be. The path is always /metrics
+    listen: "0.0.0.0.0:8000"
+
+meta:
+    # Which service is this bridge for? Available options:
+    # * facebook - connect to FB Messenger via facebook.com
+    # * facebook-tor - connect to FB Messenger via facebookwkhpilnemxj7asaniu7vnjjbiltxjqhye3mhbshg7kx5tfyd.onion
+    #                  (note: does not currently proxy media downloads)
+    # * messenger - connect to FB Messenger via messenger.com (can be used with the facebook side deactivated)
+    # * instagram - connect to Instagram DMs via instagram.com
+    #
+    # Remember to change the appservice id, bot profile info, bridge username_template and management_room_text too.
+    mode: {{ matrix_mautrix_meta_instagram_meta_mode | to_json }}
+    # When in Instagram mode, should the bridge connect to WhatsApp servers for encrypted chats?
+    # In FB/Messenger mode encryption is always enabled, this option only affects Instagram mode.
+    ig_e2ee: {{ matrix_mautrix_meta_instagram_meta_ig_e2ee | to_json }}
+    # Static proxy address (HTTP or SOCKS5) for connecting to Meta.
+    proxy:
+    # HTTP endpoint to request new proxy address from, for dynamically assigned proxies.
+    # The endpoint must return a JSON body with a string field called proxy_url.
+    get_proxy_from:
+
+# Bridge config
+bridge:
+    # Localpart template of MXIDs for FB/IG users.
+    # {% raw %}{{.}}{% endraw %} is replaced with the internal ID of the FB/IG user.
+    username_template: {{ matrix_mautrix_meta_instagram_bridge_username_template | to_json }}
+    # Displayname template for FB/IG users. This is also used as the room name in DMs if private_chat_portal_meta is enabled.
+    # {% raw %}{{.DisplayName}}{% endraw %} - The display name set by the user.
+    # {% raw %}{{.Username}}{% endraw %} - The username set by the user.
+    # {% raw %}{{.ID}}{% endraw %} - The internal user ID of the user.
+    displayname_template: {{ matrix_mautrix_meta_instagram_bridge_displayname_template | to_json }}
+    # Whether to explicitly set the avatar and room name for private chat portal rooms.
+    # If set to `default`, this will be enabled in encrypted rooms and disabled in unencrypted rooms.
+    # If set to `always`, all DM rooms will have explicit names and avatars set.
+    # If set to `never`, DM rooms will never have names and avatars set.
+    private_chat_portal_meta: default
+
+    portal_message_buffer: 128
+
+    # Should the bridge create a space for each logged-in user and add bridged rooms to it?
+    # Users who logged in before turning this on should run `!meta sync-space` to create and fill the space for the first time.
+    personal_filtering_spaces: false
+    # Should Matrix m.notice-type messages be bridged?
+    bridge_notices: true
+    # Should the bridge send a read receipt from the bridge bot when a message has been sent to FB/IG?
+    delivery_receipts: false
+    # Whether the bridge should send the message status as a custom com.beeper.message_send_status event.
+    message_status_events: false
+    # Whether the bridge should send error notices via m.notice events when a message fails to bridge.
+    message_error_notices: true
+    # Should the bridge never send alerts to the bridge management room?
+    # These are mostly things like the user being logged out.
+    disable_bridge_alerts: false
+    # Should the bridge update the m.direct account data event when double puppeting is enabled.
+    # Note that updating the m.direct event is not atomic and is therefore prone to race conditions.
+    sync_direct_chat_list: false
+    # Set this to true to tell the bridge to re-send m.bridge events to all rooms on the next run.
+    # This field will automatically be changed back to false after it, except if the config file is not writable.
+    resend_bridge_info: false
+    # Send captions in the same message as images. This will send data compatible with both MSC2530.
+    # This is currently not supported in most clients.
+    caption_in_message: false
+    # Whether or not created rooms should have federation enabled.
+    # If false, created portal rooms will never be federated.
+    federate_rooms: {{ matrix_mautrix_meta_instagram_bridge_federate_rooms | to_json }}
+    # Should mute status be bridged? Allowed options: always, on-create, never
+    mute_bridging: on-create
+    # Servers to always allow double puppeting from
+    double_puppet_server_map: {}
+    # Allow using double puppeting from any server with a valid client .well-known file.
+    double_puppet_allow_discovery: false
+    # Shared secrets for https://github.com/devture/matrix-synapse-shared-secret-auth
+    #
+    # If set, double puppeting will be enabled automatically for local users
+    # instead of users having to find an access token and run `login-matrix`
+    # manually.
+    login_shared_secret_map: {{ matrix_mautrix_meta_instagram_bridge_login_shared_secret_map | to_json }}
+
+    # The prefix for commands. Only required in non-management rooms.
+    # If set to "default", will be determined based on meta -> mode, "!ig" for instagram and "!fb" for facebook
+    command_prefix: {{ matrix_mautrix_meta_instagram_bridge_command_prefix | to_json }}
+
+    backfill:
+        # If disabled, old messages will never be bridged.
+        enabled: true
+        # By default, Meta sends info about approximately 20 recent threads. If this is set to something else than 0,
+        # the bridge will request more threads on first login, until it reaches the specified number of pages
+        # or the end of the inbox.
+        inbox_fetch_pages: 0
+        # By default, Meta only sends one old message per thread. If this is set to a something else than 0,
+        # the bridge will delay handling the one automatically received message and request more messages to backfill.
+        # One page usually contains 20 messages. This can technically be set to -1 to fetch all messages,
+        # but that will block bridging messages until the entire backfill is completed.
+        history_fetch_pages: 0
+        # Same as above, but for catchup backfills (i.e. when the bridge is restarted).
+        catchup_fetch_pages: 5
+        # Maximum age of chats to leave as unread when backfilling. 0 means all chats can be left as unread.
+        # If non-zero, chats that are older than this will be marked as read, even if they're still unread on Meta.
+        unread_hours_threshold: 0
+        # Backfill queue settings. Only relevant for Beeper, because standard Matrix servers
+        # don't support inserting messages into room history.
+        queue:
+            # How many pages of messages to request in one go (without sleeping between requests)?
+            pages_at_once: 5
+            # Maximum number of pages to fetch. -1 to fetch all pages until the start of the chat.
+            max_pages: -1
+            # How long to sleep after fetching a bunch of pages ("bunch" defined by pages_at_once).
+            sleep_between_tasks: 20s
+            # Disable fetching XMA media (reels, stories, etc) when backfilling.
+            dont_fetch_xma: true
+
+    # Messages sent upon joining a management room.
+    # Markdown is supported. The defaults are listed below.
+    management_room_text:
+        # Sent when joining a room.
+        welcome: {{ matrix_mautrix_meta_instagram_bridge_management_room_text_welcome | to_json }}
+        # Sent when joining a management room and the user is already logged in.
+        welcome_connected: "Use `help` for help."
+        # Sent when joining a management room and the user is not logged in.
+        welcome_unconnected: "Use `help` for help or `login` to log in."
+        # Optional extra text sent when joining a management room.
+        additional_help: ""
+
+    # End-to-bridge encryption support options.
+    #
+    # See https://docs.mau.fi/bridges/general/end-to-bridge-encryption.html for more info.
+    encryption:
+        # Allow encryption, work in group chat rooms with e2ee enabled
+        allow: {{ matrix_mautrix_meta_instagram_bridge_encryption_allow | to_json }}
+        # Default to encryption, force-enable encryption in all portals the bridge creates
+        # This will cause the bridge bot to be in private chats for the encryption to work properly.
+        default: {{ matrix_mautrix_meta_instagram_bridge_encryption_default | to_json }}
+        # Whether to use MSC2409/MSC3202 instead of /sync long polling for receiving encryption-related data.
+        appservice: {{ matrix_mautrix_meta_instagram_bridge_encryption_appservice | to_json }}
+        # Require encryption, drop any unencrypted messages.
+        require: {{ matrix_mautrix_meta_instagram_bridge_encryption_require | to_json }}
+        # Enable key sharing? If enabled, key requests for rooms where users are in will be fulfilled.
+        # You must use a client that supports requesting keys from other users to use this feature.
+        allow_key_sharing: {{ matrix_mautrix_meta_instagram_bridge_encryption_allow_key_sharing | to_json }}
+        # Options for deleting megolm sessions from the bridge.
+        delete_keys:
+            # Beeper-specific: delete outbound sessions when hungryserv confirms
+            # that the user has uploaded the key to key backup.
+            delete_outbound_on_ack: false
+            # Don't store outbound sessions in the inbound table.
+            dont_store_outbound: false
+            # Ratchet megolm sessions forward after decrypting messages.
+            ratchet_on_decrypt: false
+            # Delete fully used keys (index >= max_messages) after decrypting messages.
+            delete_fully_used_on_decrypt: false
+            # Delete previous megolm sessions from same device when receiving a new one.
+            delete_prev_on_new_session: false
+            # Delete megolm sessions received from a device when the device is deleted.
+            delete_on_device_delete: false
+            # Periodically delete megolm sessions when 2x max_age has passed since receiving the session.
+            periodically_delete_expired: false
+            # Delete inbound megolm sessions that don't have the received_at field used for
+            # automatic ratcheting and expired session deletion. This is meant as a migration
+            # to delete old keys prior to the bridge update.
+            delete_outdated_inbound: false
+        # What level of device verification should be required from users?
+        #
+        # Valid levels:
+        #   unverified - Send keys to all device in the room.
+        #   cross-signed-untrusted - Require valid cross-signing, but trust all cross-signing keys.
+        #   cross-signed-tofu - Require valid cross-signing, trust cross-signing keys on first use (and reject changes).
+        #   cross-signed-verified - Require valid cross-signing, plus a valid user signature from the bridge bot.
+        #                           Note that creating user signatures from the bridge bot is not currently possible.
+        #   verified - Require manual per-device verification
+        #              (currently only possible by modifying the `trust` column in the `crypto_device` database table).
+        verification_levels:
+            # Minimum level for which the bridge should send keys to when bridging messages from FB/IG to Matrix.
+            receive: unverified
+            # Minimum level that the bridge should accept for incoming Matrix messages.
+            send: unverified
+            # Minimum level that the bridge should require for accepting key requests.
+            share: cross-signed-tofu
+        # Options for Megolm room key rotation. These options allow you to
+        # configure the m.room.encryption event content. See:
+        # https://spec.matrix.org/v1.3/client-server-api/#mroomencryption for
+        # more information about that event.
+        rotation:
+            # Enable custom Megolm room key rotation settings. Note that these
+            # settings will only apply to rooms created after this option is
+            # set.
+            enable_custom: false
+            # The maximum number of milliseconds a session should be used
+            # before changing it. The Matrix spec recommends 604800000 (a week)
+            # as the default.
+            milliseconds: 604800000
+            # The maximum number of messages that should be sent with a given a
+            # session before changing it. The Matrix spec recommends 100 as the
+            # default.
+            messages: 100
+
+            # Disable rotating keys when a user's devices change?
+            # You should not enable this option unless you understand all the implications.
+            disable_device_change_key_rotation: false
+
+    # Settings for provisioning API
+    provisioning:
+        # Prefix for the provisioning API paths.
+        prefix: /_matrix/provision
+        # Shared secret for authentication. If set to "generate", a random secret will be generated,
+        # or if set to "disable", the provisioning API will be disabled.
+        shared_secret: disable
+        # Enable debug API at /debug with provisioning authentication.
+        debug_endpoints: false
+
+    # Permissions for using the bridge.
+    # Permitted values:
+    #    relay - Talk through the relaybot (if enabled), no access otherwise
+    #     user - Access to use the bridge to chat with a Meta account.
+    #    admin - User level and some additional administration tools
+    # Permitted keys:
+    #        * - All Matrix users
+    #   domain - All users on that homeserver
+    #     mxid - Specific user
+    permissions: {{ matrix_mautrix_meta_instagram_bridge_permissions | to_json }}
+
+    # Settings for relay mode
+    relay:
+        # Whether relay mode should be allowed. If allowed, `!wa set-relay` can be used to turn any
+        # authenticated user into a relaybot for that chat.
+        enabled: {{ matrix_mautrix_meta_instagram_bridge_relay_enabled | to_json }}
+        # Should only admins be allowed to set themselves as relay users?
+        admin_only: {{ matrix_mautrix_meta_instagram_bridge_relay_admin_only | to_json }}
+        # The formats to use when sending messages to Meta via the relaybot.
+        message_formats:
+            m.text: "{% raw %}{{ .Sender.Displayname }}: {{ .Message }}{% endraw %}"
+            m.notice: "{% raw %}{{ .Sender.Displayname }}: {{ .Message }}{% endraw %}"
+            m.emote: "{% raw %}* {{ .Sender.Displayname }} {{ .Message }}{% endraw %}"
+            m.file: "{% raw %}{{ .Sender.Displayname }} sent a file{% endraw %}"
+            m.image: "{% raw %}{{ .Sender.Displayname }} sent an image{% endraw %}"
+            m.audio: "{% raw %}{{ .Sender.Displayname }} sent an audio file{% endraw %}"
+            m.video: "{% raw %}{{ .Sender.Displayname }} sent a video{% endraw %}"
+            m.location: "{% raw %}{{ .Sender.Displayname }} sent a location{% endraw %}"
+
+# Logging config. See https://github.com/tulir/zeroconfig for details.
+logging:
+    min_level: {{ matrix_mautrix_meta_instagram_logging_min_level | to_json }}
+    writers:
+    - type: stdout
+      format: pretty
diff --git a/roles/custom/matrix-bridge-mautrix-meta-instagram/templates/labels.j2 b/roles/custom/matrix-bridge-mautrix-meta-instagram/templates/labels.j2
new file mode 100644
index 000000000..3648706cb
--- /dev/null
+++ b/roles/custom/matrix-bridge-mautrix-meta-instagram/templates/labels.j2
@@ -0,0 +1,48 @@
+{% if matrix_mautrix_meta_instagram_container_labels_traefik_enabled %}
+traefik.enable=true
+
+{% if matrix_mautrix_meta_instagram_container_labels_traefik_docker_network %}
+traefik.docker.network={{ matrix_mautrix_meta_instagram_container_labels_traefik_docker_network }}
+{% endif %}
+
+traefik.http.services.{{ matrix_mautrix_meta_instagram_identifier }}-appservice.loadbalancer.server.port=29319
+traefik.http.services.{{ matrix_mautrix_meta_instagram_identifier }}-metrics.loadbalancer.server.port=8000
+
+
+{% if matrix_mautrix_meta_instagram_container_labels_metrics_enabled %}
+############################################################
+#                                                          #
+# Metrics                                                  #
+#                                                          #
+############################################################
+
+{% if matrix_mautrix_meta_instagram_container_labels_metrics_middleware_basic_auth_enabled %}
+traefik.http.middlewares.{{ matrix_mautrix_meta_instagram_identifier }}-metrics-basic-auth.basicauth.users={{ matrix_mautrix_meta_instagram_container_labels_metrics_middleware_basic_auth_users }}
+traefik.http.routers.{{ matrix_mautrix_meta_instagram_identifier }}-metrics.middlewares={{ matrix_mautrix_meta_instagram_identifier }}-metrics-basic-auth
+{% endif %}
+
+traefik.http.routers.{{ matrix_mautrix_meta_instagram_identifier }}-metrics.rule={{ matrix_mautrix_meta_instagram_container_labels_metrics_traefik_rule }}
+
+{% if matrix_mautrix_meta_instagram_container_labels_metrics_traefik_priority | int > 0 %}
+traefik.http.routers.{{ matrix_mautrix_meta_instagram_identifier }}-metrics.priority={{ matrix_mautrix_meta_instagram_container_labels_metrics_traefik_priority }}
+{% endif %}
+
+traefik.http.routers.{{ matrix_mautrix_meta_instagram_identifier }}-metrics.service={{ matrix_mautrix_meta_instagram_identifier }}-metrics
+traefik.http.routers.{{ matrix_mautrix_meta_instagram_identifier }}-metrics.entrypoints={{ matrix_mautrix_meta_instagram_container_labels_metrics_traefik_entrypoints }}
+
+traefik.http.routers.{{ matrix_mautrix_meta_instagram_identifier }}-metrics.tls={{ matrix_mautrix_meta_instagram_container_labels_metrics_traefik_tls | to_json }}
+{% if matrix_mautrix_meta_instagram_container_labels_metrics_traefik_tls %}
+traefik.http.routers.{{ matrix_mautrix_meta_instagram_identifier }}-metrics.tls.certResolver={{ matrix_mautrix_meta_instagram_container_labels_metrics_traefik_tls_certResolver }}
+{% endif %}
+
+############################################################
+#                                                          #
+# /Metrics                                                 #
+#                                                          #
+############################################################
+{% endif %}
+
+
+{% endif %}
+
+{{ matrix_mautrix_meta_instagram_container_labels_additional_labels }}
diff --git a/roles/custom/matrix-bridge-mautrix-meta-instagram/templates/systemd/matrix-mautrix-meta.service.j2 b/roles/custom/matrix-bridge-mautrix-meta-instagram/templates/systemd/matrix-mautrix-meta.service.j2
new file mode 100644
index 000000000..a772b3eca
--- /dev/null
+++ b/roles/custom/matrix-bridge-mautrix-meta-instagram/templates/systemd/matrix-mautrix-meta.service.j2
@@ -0,0 +1,51 @@
+#jinja2: lstrip_blocks: "True"
+[Unit]
+Description=mautrix-meta bridge ({{ matrix_mautrix_meta_instagram_identifier }})
+{% for service in matrix_mautrix_meta_instagram_systemd_required_services_list %}
+Requires={{ service }}
+After={{ service }}
+{% endfor %}
+{% for service in matrix_mautrix_meta_instagram_systemd_wanted_services_list %}
+Wants={{ service }}
+{% endfor %}
+DefaultDependencies=no
+
+[Service]
+Type=simple
+Environment="HOME={{ devture_systemd_docker_base_systemd_unit_home_path }}"
+ExecStartPre=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} stop --time={{ devture_systemd_docker_base_container_stop_grace_time_seconds }} {{ matrix_mautrix_meta_instagram_identifier }} 2>/dev/null || true'
+ExecStartPre=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} rm {{ matrix_mautrix_meta_instagram_identifier }} 2>/dev/null || true'
+
+ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} create \
+			--rm \
+			--name={{ matrix_mautrix_meta_instagram_identifier }} \
+			--log-driver=none \
+			--user={{ matrix_user_uid }}:{{ matrix_user_gid }} \
+			--cap-drop=ALL \
+			--network={{ matrix_mautrix_meta_instagram_container_network }} \
+			{% if matrix_mautrix_meta_instagram_container_http_host_bind_port %}
+			-p {{ matrix_mautrix_meta_instagram_container_http_host_bind_port }}:29319 \
+			{% endif %}
+			--mount type=bind,src={{ matrix_mautrix_meta_instagram_config_path }},dst=/config,ro \
+			--mount type=bind,src={{ matrix_mautrix_meta_instagram_data_path }},dst=/data \
+			--label-file={{ matrix_mautrix_meta_instagram_base_path }}/labels \
+			{% for arg in matrix_mautrix_meta_instagram_container_extra_arguments %}
+			{{ arg }} \
+			{% endfor %}
+			{{ matrix_mautrix_meta_instagram_container_image }} \
+			/usr/bin/mautrix-meta -c /config/config.yaml -r /config/registration.yaml --no-update
+
+{% for network in matrix_mautrix_meta_instagram_container_additional_networks %}
+ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} network connect {{ network }} {{ matrix_mautrix_meta_instagram_identifier }}
+{% endfor %}
+
+ExecStart={{ devture_systemd_docker_base_host_command_docker }} start --attach {{ matrix_mautrix_meta_instagram_identifier }}
+
+ExecStop=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} stop --time={{ devture_systemd_docker_base_container_stop_grace_time_seconds }} {{ matrix_mautrix_meta_instagram_identifier }} 2>/dev/null || true'
+ExecStop=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} rm {{ matrix_mautrix_meta_instagram_identifier }} 2>/dev/null || true'
+Restart=always
+RestartSec=30
+SyslogIdentifier={{ matrix_mautrix_meta_instagram_identifier }}
+
+[Install]
+WantedBy=multi-user.target
diff --git a/roles/custom/matrix-bridge-mautrix-meta-messenger/defaults/main.yml b/roles/custom/matrix-bridge-mautrix-meta-messenger/defaults/main.yml
new file mode 100644
index 000000000..e7d6ed321
--- /dev/null
+++ b/roles/custom/matrix-bridge-mautrix-meta-messenger/defaults/main.yml
@@ -0,0 +1,270 @@
+---
+
+# mautrix-meta is a Matrix <-> Facebook/Messenger/Instagram bridge
+# Project source code URL: https://github.com/mautrix/meta
+#
+# WARNING: this bridge role is used for both Messenger and Instagram.
+# This Messenger role acts as a source and auto-generates matrix-bridge-mautrix-meta-instagram
+# thanks to `just rebuild-mautrix-meta-instagram` (`bin/rebuild-mautrix-meta-instagram.sh`).
+# If you'd like to make changes to the Instagram role, consider making your changes to the Messenger role instead.
+
+matrix_mautrix_meta_messenger_enabled: true
+
+matrix_mautrix_meta_messenger_identifier: matrix-mautrix-meta-messenger
+
+# renovate: datasource=docker depName=dock.mau.dev/mautrix/meta
+matrix_mautrix_meta_messenger_version: v0.1.0
+
+matrix_mautrix_meta_messenger_base_path: "{{ matrix_base_data_path }}/mautrix-meta-messenger"
+matrix_mautrix_meta_messenger_config_path: "{{ matrix_mautrix_meta_messenger_base_path }}/config"
+matrix_mautrix_meta_messenger_data_path: "{{ matrix_mautrix_meta_messenger_base_path }}/data"
+matrix_mautrix_meta_messenger_container_src_files_path: "{{ matrix_mautrix_meta_messenger_base_path }}/container-src"
+
+matrix_mautrix_meta_messenger_container_image_self_build: false
+matrix_mautrix_meta_messenger_container_image_self_build_repo: "https://github.com/mautrix/meta.git"
+
+matrix_mautrix_meta_messenger_container_image: "{{ matrix_mautrix_meta_messenger_container_image_name_prefix }}mautrix/meta:{{ matrix_mautrix_meta_messenger_version }}"
+matrix_mautrix_meta_messenger_container_image_name_prefix: "{{ 'localhost/' if matrix_mautrix_meta_messenger_container_image_self_build else 'dock.mau.dev/' }}"
+matrix_mautrix_meta_messenger_container_image_force_pull: "{{ matrix_mautrix_meta_messenger_container_image.endswith(':latest') }}"
+
+matrix_mautrix_meta_messenger_container_network: ""
+
+matrix_mautrix_meta_messenger_container_additional_networks: "{{ matrix_mautrix_meta_messenger_container_additional_networks_auto + matrix_mautrix_meta_messenger_container_additional_networks_custom }}"
+matrix_mautrix_meta_messenger_container_additional_networks_auto: []
+matrix_mautrix_meta_messenger_container_additional_networks_custom: []
+
+# matrix_mautrix_meta_messenger_container_labels_traefik_enabled controls whether labels to assist a Traefik reverse-proxy will be attached to the container.
+# See `../templates/labels.j2` for details.
+#
+# To inject your own other container labels, see `matrix_mautrix_meta_messenger_container_labels_additional_labels`.
+matrix_mautrix_meta_messenger_container_labels_traefik_enabled: true
+matrix_mautrix_meta_messenger_container_labels_traefik_docker_network: "{{ matrix_mautrix_meta_messenger_container_network }}"
+matrix_mautrix_meta_messenger_container_labels_traefik_entrypoints: web-secure
+matrix_mautrix_meta_messenger_container_labels_traefik_tls_certResolver: default  # noqa var-naming
+
+# Controls whether labels will be added that expose the bridge's metrics
+matrix_mautrix_meta_messenger_container_labels_metrics_enabled: "{{ matrix_mautrix_meta_messenger_metrics_enabled and matrix_mautrix_meta_messenger_metrics_proxying_enabled }}"
+matrix_mautrix_meta_messenger_container_labels_metrics_traefik_rule: "Host(`{{ matrix_mautrix_meta_messenger_metrics_proxying_hostname }}`) && PathPrefix(`{{ matrix_mautrix_meta_messenger_metrics_proxying_path_prefix }}`)"
+matrix_mautrix_meta_messenger_container_labels_metrics_traefik_priority: 0
+matrix_mautrix_meta_messenger_container_labels_metrics_traefik_entrypoints: "{{ matrix_mautrix_meta_messenger_container_labels_traefik_entrypoints }}"
+matrix_mautrix_meta_messenger_container_labels_metrics_traefik_tls: "{{ matrix_mautrix_meta_messenger_container_labels_metrics_traefik_entrypoints != 'web' }}"
+matrix_mautrix_meta_messenger_container_labels_metrics_traefik_tls_certResolver: "{{ matrix_mautrix_meta_messenger_container_labels_traefik_tls_certResolver }}"  # noqa var-naming
+matrix_mautrix_meta_messenger_container_labels_metrics_middleware_basic_auth_enabled: false
+# See: https://doc.traefik.io/traefik/middlewares/http/basicauth/#users
+matrix_mautrix_meta_messenger_container_labels_metrics_middleware_basic_auth_users: ''
+
+# matrix_mautrix_meta_messenger_container_labels_additional_labels contains a multiline string with additional labels to add to the container label file.
+# See `../templates/labels.j2` for details.
+#
+# Example:
+# matrix_mautrix_meta_messenger_container_labels_additional_labels: |
+#   my.label=1
+#   another.label="here"
+matrix_mautrix_meta_messenger_container_labels_additional_labels: ''
+
+# A list of extra arguments to pass to the container
+matrix_mautrix_meta_messenger_container_extra_arguments: []
+
+# List of systemd services that the systemd service depends on.
+matrix_mautrix_meta_messenger_systemd_required_services_list: "{{ matrix_mautrix_meta_messenger_systemd_required_services_list_default + matrix_mautrix_meta_messenger_systemd_required_services_list_auto + matrix_mautrix_meta_messenger_systemd_required_services_list_custom }}"
+matrix_mautrix_meta_messenger_systemd_required_services_list_default: ['docker.service']
+matrix_mautrix_meta_messenger_systemd_required_services_list_auto: []
+matrix_mautrix_meta_messenger_systemd_required_services_list_custom: []
+
+# List of systemd services that the systemd service wants
+matrix_mautrix_meta_messenger_systemd_wanted_services_list: []
+
+# Controls whether the bridge container exposes its HTTP port.
+#
+# Takes an "<ip>:<port>" or "<port>" value (e.g. "127.0.0.1:29319"), or empty string to not expose.
+matrix_mautrix_meta_messenger_container_http_host_bind_port: ''
+
+# Database-related configuration fields
+matrix_mautrix_meta_messenger_database_engine: sqlite3-fk-wal
+
+matrix_mautrix_meta_messenger_sqlite_database_path_local: "{{ matrix_mautrix_meta_messenger_data_path }}/mautrix-meta.db"
+matrix_mautrix_meta_messenger_sqlite_database_path_in_container: "/data/mautrix-meta.db"
+
+matrix_mautrix_meta_messenger_database_suffix: |-
+  {{
+    ({
+      'facebook': '_facebook',
+      'facebook-tor': '_facebook',
+      'messenger': '_messenger',
+      'instagram': '_instagram',
+    })[matrix_mautrix_meta_messenger_meta_mode]
+  }}
+
+matrix_mautrix_meta_messenger_database_username: "matrix_mautrix_meta{{ matrix_mautrix_meta_messenger_database_suffix }}"
+matrix_mautrix_meta_messenger_database_password: ''
+matrix_mautrix_meta_messenger_database_hostname: ''
+matrix_mautrix_meta_messenger_database_port: 5432
+matrix_mautrix_meta_messenger_database_name: "matrix_mautrix_meta{{ matrix_mautrix_meta_messenger_database_suffix }}"
+matrix_mautrix_meta_messenger_database_sslmode: disable
+
+matrix_mautrix_meta_messenger_database_connection_string: 'postgres://{{ matrix_mautrix_meta_messenger_database_username }}:{{ matrix_mautrix_meta_messenger_database_password }}@{{ matrix_mautrix_meta_messenger_database_hostname }}:{{ matrix_mautrix_meta_messenger_database_port }}/{{ matrix_mautrix_meta_messenger_database_name }}?sslmode={{ matrix_mautrix_meta_messenger_database_sslmode }}'
+
+matrix_mautrix_meta_messenger_homeserver_address: ""
+matrix_mautrix_meta_messenger_homeserver_domain: '{{ matrix_domain }}'
+matrix_mautrix_meta_messenger_homeserver_token: ''
+
+matrix_mautrix_meta_messenger_appservice_address: "http://{{ matrix_mautrix_meta_messenger_identifier }}:29319"
+
+matrix_mautrix_meta_messenger_appservice_id: "{{ matrix_mautrix_meta_messenger_meta_mode }}"
+
+# For Facebook/Messenger, we use the same `@messengerbot:DOMAIN` username regardless of how bridging happens for multiple reasons:
+# - it's consistent - regardless of how bridging happens, the bridged service is actually Messenger
+# - it's easy for users - you may change the mode, but the bot is always at `@messengerbot:DOMAIN`
+# - it doesn't conflict with mautrix-facebook which uses `@facebookbot:DOMAIN`
+# - `matrix_mautrix_meta_messenger_appservice_avatar` only has icons for Messenger and Instagram, not Facebook
+matrix_mautrix_meta_messenger_appservice_username_prefix: |-
+  {{
+    ({
+      'facebook': 'messenger',
+      'facebook-tor': 'messenger',
+      'messenger': 'messenger',
+      'instagram': 'instagram',
+    })[matrix_mautrix_meta_messenger_meta_mode]
+  }}
+matrix_mautrix_meta_messenger_appservice_username: "{{ matrix_mautrix_meta_messenger_appservice_username_prefix }}bot"
+matrix_mautrix_meta_messenger_appservice_displayname: "{{ matrix_mautrix_meta_messenger_meta_mode | capitalize }} bridge bot"
+matrix_mautrix_meta_messenger_appservice_avatar: "{{ 'mxc://maunium.net/JxjlbZUlCPULEeHZSwleUXQv' if matrix_mautrix_meta_messenger_meta_mode == 'instagram' else 'mxc://maunium.net/ygtkteZsXnGJLJHRchUwYWak' }}"
+
+matrix_mautrix_meta_messenger_appservice_database_type: "{{ matrix_mautrix_meta_messenger_database_engine }}"
+
+matrix_mautrix_meta_messenger_appservice_database_uri: |-
+  {{
+    {
+      'sqlite3-fk-wal': ('sqlite:///' + matrix_mautrix_meta_messenger_sqlite_database_path_in_container),
+      'postgres': matrix_mautrix_meta_messenger_database_connection_string,
+    }[matrix_mautrix_meta_messenger_database_engine]
+  }}
+
+matrix_mautrix_meta_messenger_appservice_token: ''
+
+# Controls which service this bridge is for.
+# Valid options:
+# * facebook - connect to FB Messenger via facebook.com
+# * facebook-tor - connect to FB Messenger via facebookwkhpilnemxj7asaniu7vnjjbiltxjqhye3mhbshg7kx5tfyd.onion
+#                  (note: does not currently proxy media downloads)
+# * messenger - connect to FB Messenger via messenger.com (can be used with the facebook side deactivated)
+# * instagram - connect to Instagram DMs via instagram.com
+matrix_mautrix_meta_messenger_meta_mode: messenger
+
+# When in `instagram` mode (see `matrix_mautrix_meta_messenger_meta_mode`), should the bridge connect to WhatsApp servers for encrypted chats?
+matrix_mautrix_meta_messenger_meta_ig_e2ee: false
+
+# Whether or not metrics endpoint should be enabled.
+# Enabling them is usually enough for a local (in-container) Prometheus to consume them.
+# If metrics need to be consumed by another (external) Prometheus server, consider exposing them via `matrix_mautrix_meta_messenger_metrics_proxying_enabled`.
+matrix_mautrix_meta_messenger_metrics_enabled: false
+
+# Controls whether metrics should be exposed on a public URL.
+matrix_mautrix_meta_messenger_metrics_proxying_enabled: false
+matrix_mautrix_meta_messenger_metrics_proxying_hostname: ''
+matrix_mautrix_meta_messenger_metrics_proxying_path_prefix: ''
+
+matrix_mautrix_meta_messenger_bridge_username_prefix: |-
+  {{
+    ({
+      'facebook': 'facebook_',
+      'facebook-tor': 'facebook_',
+      'messenger': 'messenger_',
+      'instagram': 'instagram_',
+    })[matrix_mautrix_meta_messenger_meta_mode]
+  }}
+
+# Localpart template of MXIDs for FB/IG users.
+# {{.}} is replaced with the internal ID of the FB/IG user.
+# Changing this may require that you change the regex in the appservice.
+matrix_mautrix_meta_messenger_bridge_username_template: "{{ matrix_mautrix_meta_messenger_bridge_username_prefix + '{{.}}' }}"
+
+matrix_mautrix_meta_messenger_bridge_displayname_template: '{% raw %}{{or .DisplayName .Username "Unknown user"}}{% endraw %}'
+
+# The prefix for commands. Only required in non-management rooms.
+# If set to "default", will be determined based on meta -> mode (`matrix_mautrix_meta_messenger_meta_mode`):
+# - "!ig" for instagram
+# - "!fb" for facebook
+matrix_mautrix_meta_messenger_bridge_command_prefix: default
+
+# Whether or not created rooms should have federation enabled.
+# If false, created portal rooms will never be federated.
+matrix_mautrix_meta_messenger_bridge_federate_rooms: true
+
+# Enable End-to-bridge encryption
+matrix_mautrix_meta_messenger_bridge_encryption_allow: "{{ matrix_bridges_encryption_enabled }}"
+matrix_mautrix_meta_messenger_bridge_encryption_default: "{{ matrix_mautrix_meta_messenger_bridge_encryption_allow }}"
+matrix_mautrix_meta_messenger_bridge_encryption_allow_key_sharing: "{{ matrix_mautrix_meta_messenger_bridge_encryption_allow }}"
+matrix_mautrix_meta_messenger_bridge_encryption_appservice: false
+matrix_mautrix_meta_messenger_bridge_encryption_require: false
+
+# Can be set to enable automatic double-puppeting via Shared Secret Auth (https://github.com/devture/matrix-synapse-shared-secret-auth).
+matrix_mautrix_meta_messenger_bridge_login_shared_secret: ''
+
+matrix_mautrix_meta_messenger_bridge_login_shared_secret_map: "{{ {matrix_mautrix_meta_messenger_homeserver_domain: matrix_mautrix_meta_messenger_bridge_login_shared_secret} if matrix_mautrix_meta_messenger_bridge_login_shared_secret else {} }}"
+
+matrix_mautrix_meta_messenger_bridge_permissions: "{{ matrix_mautrix_meta_messenger_bridge_permissions_default | combine(matrix_mautrix_meta_messenger_bridge_permissions_custom) }}"
+
+matrix_mautrix_meta_messenger_bridge_permissions_default: |-
+  {{
+    {'*': 'relay', matrix_mautrix_meta_messenger_homeserver_domain: 'user'}
+    | combine({matrix_admin: 'admin'} if matrix_admin else {})
+  }}
+
+matrix_mautrix_meta_messenger_bridge_permissions_custom: {}
+
+# Enable bridge relay bot functionality
+matrix_mautrix_meta_messenger_bridge_relay_enabled: "{{ matrix_bridges_relay_enabled }}"
+matrix_mautrix_meta_messenger_bridge_relay_admin_only: true
+
+matrix_mautrix_meta_messenger_bridge_management_room_text_welcome: |-
+  {{
+    ({
+      'facebook': "Hello, I'm a Facebook bridge bot.",
+      'facebook-tor': "Hello, I'm a Facebook bridge bot which uses Tor.",
+      'messenger': "Hello, I'm a Messenger bridge bot.",
+      'instagram': "Hello, I'm an Instagram bridge bot.",
+    })[matrix_mautrix_meta_messenger_meta_mode]
+  }}
+
+# Specifies the default log level.
+# This bridge uses zerolog, so valid levels are: panic, fatal, error, warn, info, debug, trace
+matrix_mautrix_meta_messenger_logging_min_level: warn
+
+# Default configuration template which covers the generic use case.
+# You can customize it by controlling the various variables inside it.
+#
+# For a more advanced customization, you can extend the default (see `matrix_mautrix_meta_messenger_configuration_extension_yaml`)
+# or completely replace this variable with your own template.
+matrix_mautrix_meta_messenger_configuration_yaml: "{{ lookup('template', 'templates/config.yaml.j2') }}"
+
+matrix_mautrix_meta_messenger_configuration_extension_yaml: |
+  # Your custom YAML configuration goes here.
+  # This configuration extends the default starting configuration (`matrix_mautrix_meta_messenger_configuration_yaml`).
+  #
+  # You can override individual variables from the default configuration, or introduce new ones.
+  #
+  # If you need something more special, you can take full control by
+  # completely redefining `matrix_mautrix_meta_messenger_configuration_yaml`.
+
+matrix_mautrix_meta_messenger_configuration_extension: "{{ matrix_mautrix_meta_messenger_configuration_extension_yaml | from_yaml if matrix_mautrix_meta_messenger_configuration_extension_yaml | from_yaml is mapping else {} }}"
+
+# Holds the final configuration (a combination of the default and its extension).
+# You most likely don't need to touch this variable. Instead, see `matrix_mautrix_meta_messenger_configuration_yaml`.
+matrix_mautrix_meta_messenger_configuration: "{{ matrix_mautrix_meta_messenger_configuration_yaml | from_yaml | combine(matrix_mautrix_meta_messenger_configuration_extension, recursive=True) }}"
+
+matrix_mautrix_meta_messenger_registration_yaml: |
+  id: {{ matrix_mautrix_meta_messenger_appservice_id | to_json }}
+  as_token: {{ matrix_mautrix_meta_messenger_appservice_token | to_json }}
+  hs_token: {{ matrix_mautrix_meta_messenger_homeserver_token | to_json }}
+  namespaces:
+    users:
+    - exclusive: true
+      regex: '^@{{ matrix_mautrix_meta_messenger_bridge_username_prefix }}.+:{{ matrix_mautrix_meta_messenger_homeserver_domain | regex_escape }}$'
+    - exclusive: true
+      regex: '^@{{ matrix_mautrix_meta_messenger_appservice_username | regex_escape }}:{{ matrix_mautrix_meta_messenger_homeserver_domain | regex_escape }}$'
+  url: {{ matrix_mautrix_meta_messenger_appservice_address }}
+  sender_localpart: _bot_{{ matrix_mautrix_meta_messenger_appservice_username }}
+  rate_limited: false
+
+matrix_mautrix_meta_messenger_registration: "{{ matrix_mautrix_meta_messenger_registration_yaml | from_yaml }}"
diff --git a/roles/custom/matrix-bridge-mautrix-meta-messenger/tasks/install.yml b/roles/custom/matrix-bridge-mautrix-meta-messenger/tasks/install.yml
new file mode 100644
index 000000000..d9f305be4
--- /dev/null
+++ b/roles/custom/matrix-bridge-mautrix-meta-messenger/tasks/install.yml
@@ -0,0 +1,121 @@
+---
+
+- ansible.builtin.set_fact:
+    matrix_mautrix_meta_messenger_requires_restart: false
+
+- when: "matrix_mautrix_meta_messenger_database_engine == 'postgres'"
+  block:
+    - name: Check if an SQLite database already exists
+      ansible.builtin.stat:
+        path: "{{ matrix_mautrix_meta_messenger_sqlite_database_path_local }}"
+      register: matrix_mautrix_meta_messenger_sqlite_database_path_local_stat_result
+
+    - when: "matrix_mautrix_meta_messenger_sqlite_database_path_local_stat_result.stat.exists | bool"
+      block:
+        - ansible.builtin.include_role:
+            name: galaxy/com.devture.ansible.role.postgres
+            tasks_from: migrate_db_to_postgres
+          vars:
+            devture_postgres_db_migration_request:
+              src: "{{ matrix_mautrix_meta_messenger_sqlite_database_path_local }}"
+              dst: "{{ matrix_mautrix_meta_messenger_database_connection_string }}"
+              caller: "{{ role_path | basename }}"
+              engine_variable_name: 'matrix_mautrix_meta_messenger_database_engine'
+              engine_old: 'sqlite'
+              systemd_services_to_stop: "{{ [matrix_mautrix_meta_messenger_identifier + '.service'] }}"
+
+        - ansible.builtin.set_fact:
+            matrix_mautrix_meta_messenger_requires_restart: true
+
+- name: Ensure mautrix-meta-messenger container image is pulled
+  community.docker.docker_image:
+    name: "{{ matrix_mautrix_meta_messenger_container_image }}"
+    source: "{{ 'pull' if ansible_version.major > 2 or ansible_version.minor > 7 else omit }}"
+    force_source: "{{ matrix_mautrix_meta_messenger_container_image_force_pull if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}"
+    force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else matrix_mautrix_meta_messenger_container_image_force_pull }}"
+  when: not matrix_mautrix_meta_messenger_container_image_self_build
+  register: result
+  retries: "{{ devture_playbook_help_container_retries_count }}"
+  delay: "{{ devture_playbook_help_container_retries_delay }}"
+  until: result is not failed
+
+- name: Ensure mautrix-meta-messenger paths exist
+  ansible.builtin.file:
+    path: "{{ item.path }}"
+    state: directory
+    mode: 0750
+    owner: "{{ matrix_user_username }}"
+    group: "{{ matrix_user_groupname }}"
+  with_items:
+    - {path: "{{ matrix_mautrix_meta_messenger_base_path }}", when: true}
+    - {path: "{{ matrix_mautrix_meta_messenger_config_path }}", when: true}
+    - {path: "{{ matrix_mautrix_meta_messenger_data_path }}", when: true}
+    - {path: "{{ matrix_mautrix_meta_messenger_container_src_files_path }}", when: "{{ matrix_mautrix_meta_messenger_container_image_self_build }}"}
+  when: item.when | bool
+
+- when: matrix_mautrix_meta_messenger_container_image_self_build | bool
+  block:
+    - name: Ensure mautrix-meta-messenger repository is present on self-build
+      ansible.builtin.git:
+        repo: "{{ matrix_mautrix_meta_messenger_container_image_self_build_repo }}"
+        dest: "{{ matrix_mautrix_meta_messenger_container_src_files_path }}"
+        version: "{{ matrix_mautrix_meta_messenger_container_image.split(':')[1] }}"
+        force: "yes"
+      become: true
+      become_user: "{{ matrix_user_username }}"
+      register: matrix_mautrix_meta_messenger_git_pull_results
+
+    - name: Ensure mautrix-meta-messenger container image is built
+      community.docker.docker_image:
+        name: "{{ matrix_mautrix_meta_messenger_container_image }}"
+        source: build
+        force_source: "{{ matrix_mautrix_meta_messenger_git_pull_results.changed if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}"
+        force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else matrix_mautrix_meta_messenger_git_pull_results.changed }}"
+        build:
+          dockerfile: Dockerfile
+          path: "{{ matrix_mautrix_meta_messenger_container_src_files_path }}"
+          pull: true
+
+- name: Ensure mautrix-meta-messenger config.yaml installed
+  ansible.builtin.copy:
+    content: "{{ matrix_mautrix_meta_messenger_configuration | to_nice_yaml(indent=2, width=999999) }}"
+    dest: "{{ matrix_mautrix_meta_messenger_config_path }}/config.yaml"
+    mode: 0644
+    owner: "{{ matrix_user_username }}"
+    group: "{{ matrix_user_groupname }}"
+
+- name: Ensure mautrix-meta-messenger registration.yaml installed
+  ansible.builtin.copy:
+    content: "{{ matrix_mautrix_meta_messenger_registration | to_nice_yaml(indent=2, width=999999) }}"
+    dest: "{{ matrix_mautrix_meta_messenger_config_path }}/registration.yaml"
+    mode: 0644
+    owner: "{{ matrix_user_username }}"
+    group: "{{ matrix_user_groupname }}"
+
+- name: Ensure mautrix-meta-messenger support files installed
+  ansible.builtin.template:
+    src: "{{ role_path }}/templates/{{ item }}.j2"
+    dest: "{{ matrix_mautrix_meta_messenger_base_path }}/{{ item }}"
+    mode: 0640
+    owner: "{{ matrix_user_username }}"
+    group: "{{ matrix_user_groupname }}"
+  with_items:
+    - labels
+
+- name: Ensure mautrix-meta-messenger container network is created
+  community.general.docker_network:
+    name: "{{ matrix_mautrix_meta_messenger_container_network }}"
+    driver: bridge
+
+- name: Ensure mautrix-meta-messenger.service installed
+  ansible.builtin.template:
+    src: "{{ role_path }}/templates/systemd/matrix-mautrix-meta.service.j2"
+    dest: "{{ devture_systemd_docker_base_systemd_path }}/{{ matrix_mautrix_meta_messenger_identifier }}.service"
+    mode: 0644
+
+- name: Ensure mautrix-meta-messenger.service restarted, if necessary
+  ansible.builtin.service:
+    name: "{{ matrix_mautrix_meta_messenger_identifier }}.service"
+    state: restarted
+    daemon_reload: true
+  when: "matrix_mautrix_meta_messenger_requires_restart | bool"
diff --git a/roles/custom/matrix-bridge-mautrix-meta-messenger/tasks/main.yml b/roles/custom/matrix-bridge-mautrix-meta-messenger/tasks/main.yml
new file mode 100644
index 000000000..5e5a7bebd
--- /dev/null
+++ b/roles/custom/matrix-bridge-mautrix-meta-messenger/tasks/main.yml
@@ -0,0 +1,20 @@
+---
+
+- tags:
+    - setup-all
+    - setup-mautrix-meta-messenger
+    - install-all
+    - install-mautrix-meta-messenger
+  block:
+    - when: matrix_mautrix_meta_messenger_enabled | bool
+      ansible.builtin.include_tasks: "{{ role_path }}/tasks/validate_config.yml"
+
+    - when: matrix_mautrix_meta_messenger_enabled | bool
+      ansible.builtin.include_tasks: "{{ role_path }}/tasks/install.yml"
+
+- tags:
+    - setup-all
+    - setup-mautrix-meta-messenger
+  block:
+    - when: not matrix_mautrix_meta_messenger_enabled | bool
+      ansible.builtin.include_tasks: "{{ role_path }}/tasks/uninstall.yml"
diff --git a/roles/custom/matrix-bridge-mautrix-meta-messenger/tasks/uninstall.yml b/roles/custom/matrix-bridge-mautrix-meta-messenger/tasks/uninstall.yml
new file mode 100644
index 000000000..22040c2df
--- /dev/null
+++ b/roles/custom/matrix-bridge-mautrix-meta-messenger/tasks/uninstall.yml
@@ -0,0 +1,20 @@
+---
+
+- name: Check existence of mautrix-meta-messenger service
+  ansible.builtin.stat:
+    path: "{{ devture_systemd_docker_base_systemd_path }}/{{ matrix_mautrix_meta_messenger_identifier }}.service"
+  register: matrix_mautrix_meta_messenger_service_stat
+
+- when: matrix_mautrix_meta_messenger_service_stat.stat.exists | bool
+  block:
+    - name: Ensure mautrix-meta-messenger is stopped
+      ansible.builtin.service:
+        name: "{{ matrix_mautrix_meta_messenger_identifier }}"
+        state: stopped
+        enabled: false
+        daemon_reload: true
+
+    - name: Ensure mautrix-meta-messenger.service doesn't exist
+      ansible.builtin.file:
+        path: "{{ devture_systemd_docker_base_systemd_path }}/{{ matrix_mautrix_meta_messenger_identifier }}.service"
+        state: absent
diff --git a/roles/custom/matrix-bridge-mautrix-meta-messenger/tasks/validate_config.yml b/roles/custom/matrix-bridge-mautrix-meta-messenger/tasks/validate_config.yml
new file mode 100644
index 000000000..3afa49314
--- /dev/null
+++ b/roles/custom/matrix-bridge-mautrix-meta-messenger/tasks/validate_config.yml
@@ -0,0 +1,16 @@
+---
+
+- name: Fail if required mautrix-meta-messenger settings not defined
+  ansible.builtin.fail:
+    msg: >-
+      You need to define a required configuration setting (`{{ item.name }}`).
+  when: "item.when | bool and vars[item.name] == ''"
+  with_items:
+    - {'name': 'matrix_mautrix_meta_messenger_metrics_proxying_hostname', when: "{{ matrix_mautrix_meta_messenger_metrics_proxying_enabled }}"}
+    - {'name': 'matrix_mautrix_meta_messenger_metrics_proxying_path_prefix', when: "{{ matrix_mautrix_meta_messenger_metrics_proxying_enabled }}"}
+    - {'name': 'matrix_mautrix_meta_messenger_appservice_token', when: true}
+    - {'name': 'matrix_mautrix_meta_messenger_homeserver_token', when: true}
+    - {'name': 'matrix_mautrix_meta_messenger_container_network', when: true}
+    - {'name': 'matrix_mautrix_meta_messenger_homeserver_address', when: true}
+    - {'name': 'matrix_mautrix_meta_messenger_database_hostname', when: "{{ matrix_mautrix_meta_messenger_database_engine == 'postgres' }}"}
+    - {'name': 'matrix_mautrix_meta_messenger_database_password', when: "{{ matrix_mautrix_meta_messenger_database_engine == 'postgres' }}"}
diff --git a/roles/custom/matrix-bridge-mautrix-meta-messenger/templates/config.yaml.j2 b/roles/custom/matrix-bridge-mautrix-meta-messenger/templates/config.yaml.j2
new file mode 100644
index 000000000..09bb0c424
--- /dev/null
+++ b/roles/custom/matrix-bridge-mautrix-meta-messenger/templates/config.yaml.j2
@@ -0,0 +1,329 @@
+#jinja2: lstrip_blocks: "True"
+# Homeserver details.
+homeserver:
+    # The address that this appservice can use to connect to the homeserver.
+    address: {{ matrix_mautrix_meta_messenger_homeserver_address | to_json }}
+    # The domain of the homeserver (also known as server_name, used for MXIDs, etc).
+    domain: {{ matrix_mautrix_meta_messenger_homeserver_domain | to_json }}
+
+    # What software is the homeserver running?
+    # Standard Matrix homeservers like Synapse, Dendrite and Conduit should just use "standard" here.
+    software: standard
+    # The URL to push real-time bridge status to.
+    # If set, the bridge will make POST requests to this URL whenever a user's meta connection state changes.
+    # The bridge will use the appservice as_token to authorize requests.
+    status_endpoint: null
+    # Endpoint for reporting per-message status.
+    message_send_checkpoint_endpoint: null
+    # Does the homeserver support https://github.com/matrix-org/matrix-spec-proposals/pull/2246?
+    async_media: false
+
+    # Should the bridge use a websocket for connecting to the homeserver?
+    # The server side is currently not documented anywhere and is only implemented by mautrix-wsproxy,
+    # mautrix-asmux (deprecated), and hungryserv (proprietary).
+    websocket: false
+    # How often should the websocket be pinged? Pinging will be disabled if this is zero.
+    ping_interval_seconds: 0
+
+# Application service host/registration related details.
+# Changing these values requires regeneration of the registration.
+appservice:
+    # The address that the homeserver can use to connect to this appservice.
+    address: {{ matrix_mautrix_meta_messenger_appservice_address | to_json }}
+
+    # The hostname and port where this appservice should listen.
+    hostname: 0.0.0.0
+    port: 29319
+
+    # Database config.
+    database:
+        # The database type. "sqlite3-fk-wal" and "postgres" are supported.
+        type: {{ matrix_mautrix_meta_messenger_appservice_database_type | to_json }}
+        # The database URI.
+        #   SQLite: A raw file path is supported, but `file:<path>?_txlock=immediate` is recommended.
+        #           https://github.com/mattn/go-sqlite3#connection-string
+        #   Postgres: Connection string. For example, postgres://user:password@host/database?sslmode=disable
+        #             To connect via Unix socket, use something like postgres:///dbname?host=/var/run/postgresql
+        uri: {{ matrix_mautrix_meta_messenger_appservice_database_uri | to_json }}
+        # Maximum number of connections. Mostly relevant for Postgres.
+        max_open_conns: 20
+        max_idle_conns: 2
+        # Maximum connection idle time and lifetime before they're closed. Disabled if null.
+        # Parsed with https://pkg.go.dev/time#ParseDuration
+        max_conn_idle_time: null
+        max_conn_lifetime: null
+
+    # The unique ID of this appservice.
+    id: {{ matrix_mautrix_meta_messenger_appservice_id | to_json }}
+    # Appservice bot details.
+    bot:
+        # Username of the appservice bot.
+        username: {{ matrix_mautrix_meta_messenger_appservice_username | to_json }}
+        # Display name and avatar for bot. Set to "remove" to remove display name/avatar, leave empty
+        # to leave display name/avatar as-is.
+        displayname: {{ matrix_mautrix_meta_messenger_appservice_displayname | to_json }}
+        # You can use mxc://maunium.net/JxjlbZUlCPULEeHZSwleUXQv for an Instagram avatar,
+        # or mxc://maunium.net/ygtkteZsXnGJLJHRchUwYWak for Facebook Messenger
+        avatar: {{ matrix_mautrix_meta_messenger_appservice_avatar | to_json }}
+
+    # Whether or not to receive ephemeral events via appservice transactions.
+    # Requires MSC2409 support (i.e. Synapse 1.22+).
+    ephemeral_events: true
+    # Should incoming events be handled asynchronously?
+    # This may be necessary for large public instances with lots of messages going through.
+    # However, messages will not be guaranteed to be bridged in the same order they were sent in.
+    async_transactions: false
+
+    # Authentication tokens for AS <-> HS communication. Autogenerated; do not modify.
+    as_token: {{ matrix_mautrix_meta_messenger_appservice_token | to_json }}
+    hs_token: {{ matrix_mautrix_meta_messenger_homeserver_token | to_json }}
+
+# Prometheus config.
+metrics:
+    # Enable prometheus metrics?
+    enabled: {{ matrix_mautrix_meta_messenger_metrics_enabled | to_json }}
+    # IP and port where the metrics listener should be. The path is always /metrics
+    listen: "0.0.0.0.0:8000"
+
+meta:
+    # Which service is this bridge for? Available options:
+    # * facebook - connect to FB Messenger via facebook.com
+    # * facebook-tor - connect to FB Messenger via facebookwkhpilnemxj7asaniu7vnjjbiltxjqhye3mhbshg7kx5tfyd.onion
+    #                  (note: does not currently proxy media downloads)
+    # * messenger - connect to FB Messenger via messenger.com (can be used with the facebook side deactivated)
+    # * instagram - connect to Instagram DMs via instagram.com
+    #
+    # Remember to change the appservice id, bot profile info, bridge username_template and management_room_text too.
+    mode: {{ matrix_mautrix_meta_messenger_meta_mode | to_json }}
+    # When in Instagram mode, should the bridge connect to WhatsApp servers for encrypted chats?
+    # In FB/Messenger mode encryption is always enabled, this option only affects Instagram mode.
+    ig_e2ee: {{ matrix_mautrix_meta_messenger_meta_ig_e2ee | to_json }}
+    # Static proxy address (HTTP or SOCKS5) for connecting to Meta.
+    proxy:
+    # HTTP endpoint to request new proxy address from, for dynamically assigned proxies.
+    # The endpoint must return a JSON body with a string field called proxy_url.
+    get_proxy_from:
+
+# Bridge config
+bridge:
+    # Localpart template of MXIDs for FB/IG users.
+    # {% raw %}{{.}}{% endraw %} is replaced with the internal ID of the FB/IG user.
+    username_template: {{ matrix_mautrix_meta_messenger_bridge_username_template | to_json }}
+    # Displayname template for FB/IG users. This is also used as the room name in DMs if private_chat_portal_meta is enabled.
+    # {% raw %}{{.DisplayName}}{% endraw %} - The display name set by the user.
+    # {% raw %}{{.Username}}{% endraw %} - The username set by the user.
+    # {% raw %}{{.ID}}{% endraw %} - The internal user ID of the user.
+    displayname_template: {{ matrix_mautrix_meta_messenger_bridge_displayname_template | to_json }}
+    # Whether to explicitly set the avatar and room name for private chat portal rooms.
+    # If set to `default`, this will be enabled in encrypted rooms and disabled in unencrypted rooms.
+    # If set to `always`, all DM rooms will have explicit names and avatars set.
+    # If set to `never`, DM rooms will never have names and avatars set.
+    private_chat_portal_meta: default
+
+    portal_message_buffer: 128
+
+    # Should the bridge create a space for each logged-in user and add bridged rooms to it?
+    # Users who logged in before turning this on should run `!meta sync-space` to create and fill the space for the first time.
+    personal_filtering_spaces: false
+    # Should Matrix m.notice-type messages be bridged?
+    bridge_notices: true
+    # Should the bridge send a read receipt from the bridge bot when a message has been sent to FB/IG?
+    delivery_receipts: false
+    # Whether the bridge should send the message status as a custom com.beeper.message_send_status event.
+    message_status_events: false
+    # Whether the bridge should send error notices via m.notice events when a message fails to bridge.
+    message_error_notices: true
+    # Should the bridge never send alerts to the bridge management room?
+    # These are mostly things like the user being logged out.
+    disable_bridge_alerts: false
+    # Should the bridge update the m.direct account data event when double puppeting is enabled.
+    # Note that updating the m.direct event is not atomic and is therefore prone to race conditions.
+    sync_direct_chat_list: false
+    # Set this to true to tell the bridge to re-send m.bridge events to all rooms on the next run.
+    # This field will automatically be changed back to false after it, except if the config file is not writable.
+    resend_bridge_info: false
+    # Send captions in the same message as images. This will send data compatible with both MSC2530.
+    # This is currently not supported in most clients.
+    caption_in_message: false
+    # Whether or not created rooms should have federation enabled.
+    # If false, created portal rooms will never be federated.
+    federate_rooms: {{ matrix_mautrix_meta_messenger_bridge_federate_rooms | to_json }}
+    # Should mute status be bridged? Allowed options: always, on-create, never
+    mute_bridging: on-create
+    # Servers to always allow double puppeting from
+    double_puppet_server_map: {}
+    # Allow using double puppeting from any server with a valid client .well-known file.
+    double_puppet_allow_discovery: false
+    # Shared secrets for https://github.com/devture/matrix-synapse-shared-secret-auth
+    #
+    # If set, double puppeting will be enabled automatically for local users
+    # instead of users having to find an access token and run `login-matrix`
+    # manually.
+    login_shared_secret_map: {{ matrix_mautrix_meta_messenger_bridge_login_shared_secret_map | to_json }}
+
+    # The prefix for commands. Only required in non-management rooms.
+    # If set to "default", will be determined based on meta -> mode, "!ig" for instagram and "!fb" for facebook
+    command_prefix: {{ matrix_mautrix_meta_messenger_bridge_command_prefix | to_json }}
+
+    backfill:
+        # If disabled, old messages will never be bridged.
+        enabled: true
+        # By default, Meta sends info about approximately 20 recent threads. If this is set to something else than 0,
+        # the bridge will request more threads on first login, until it reaches the specified number of pages
+        # or the end of the inbox.
+        inbox_fetch_pages: 0
+        # By default, Meta only sends one old message per thread. If this is set to a something else than 0,
+        # the bridge will delay handling the one automatically received message and request more messages to backfill.
+        # One page usually contains 20 messages. This can technically be set to -1 to fetch all messages,
+        # but that will block bridging messages until the entire backfill is completed.
+        history_fetch_pages: 0
+        # Same as above, but for catchup backfills (i.e. when the bridge is restarted).
+        catchup_fetch_pages: 5
+        # Maximum age of chats to leave as unread when backfilling. 0 means all chats can be left as unread.
+        # If non-zero, chats that are older than this will be marked as read, even if they're still unread on Meta.
+        unread_hours_threshold: 0
+        # Backfill queue settings. Only relevant for Beeper, because standard Matrix servers
+        # don't support inserting messages into room history.
+        queue:
+            # How many pages of messages to request in one go (without sleeping between requests)?
+            pages_at_once: 5
+            # Maximum number of pages to fetch. -1 to fetch all pages until the start of the chat.
+            max_pages: -1
+            # How long to sleep after fetching a bunch of pages ("bunch" defined by pages_at_once).
+            sleep_between_tasks: 20s
+            # Disable fetching XMA media (reels, stories, etc) when backfilling.
+            dont_fetch_xma: true
+
+    # Messages sent upon joining a management room.
+    # Markdown is supported. The defaults are listed below.
+    management_room_text:
+        # Sent when joining a room.
+        welcome: {{ matrix_mautrix_meta_messenger_bridge_management_room_text_welcome | to_json }}
+        # Sent when joining a management room and the user is already logged in.
+        welcome_connected: "Use `help` for help."
+        # Sent when joining a management room and the user is not logged in.
+        welcome_unconnected: "Use `help` for help or `login` to log in."
+        # Optional extra text sent when joining a management room.
+        additional_help: ""
+
+    # End-to-bridge encryption support options.
+    #
+    # See https://docs.mau.fi/bridges/general/end-to-bridge-encryption.html for more info.
+    encryption:
+        # Allow encryption, work in group chat rooms with e2ee enabled
+        allow: {{ matrix_mautrix_meta_messenger_bridge_encryption_allow | to_json }}
+        # Default to encryption, force-enable encryption in all portals the bridge creates
+        # This will cause the bridge bot to be in private chats for the encryption to work properly.
+        default: {{ matrix_mautrix_meta_messenger_bridge_encryption_default | to_json }}
+        # Whether to use MSC2409/MSC3202 instead of /sync long polling for receiving encryption-related data.
+        appservice: {{ matrix_mautrix_meta_messenger_bridge_encryption_appservice | to_json }}
+        # Require encryption, drop any unencrypted messages.
+        require: {{ matrix_mautrix_meta_messenger_bridge_encryption_require | to_json }}
+        # Enable key sharing? If enabled, key requests for rooms where users are in will be fulfilled.
+        # You must use a client that supports requesting keys from other users to use this feature.
+        allow_key_sharing: {{ matrix_mautrix_meta_messenger_bridge_encryption_allow_key_sharing | to_json }}
+        # Options for deleting megolm sessions from the bridge.
+        delete_keys:
+            # Beeper-specific: delete outbound sessions when hungryserv confirms
+            # that the user has uploaded the key to key backup.
+            delete_outbound_on_ack: false
+            # Don't store outbound sessions in the inbound table.
+            dont_store_outbound: false
+            # Ratchet megolm sessions forward after decrypting messages.
+            ratchet_on_decrypt: false
+            # Delete fully used keys (index >= max_messages) after decrypting messages.
+            delete_fully_used_on_decrypt: false
+            # Delete previous megolm sessions from same device when receiving a new one.
+            delete_prev_on_new_session: false
+            # Delete megolm sessions received from a device when the device is deleted.
+            delete_on_device_delete: false
+            # Periodically delete megolm sessions when 2x max_age has passed since receiving the session.
+            periodically_delete_expired: false
+            # Delete inbound megolm sessions that don't have the received_at field used for
+            # automatic ratcheting and expired session deletion. This is meant as a migration
+            # to delete old keys prior to the bridge update.
+            delete_outdated_inbound: false
+        # What level of device verification should be required from users?
+        #
+        # Valid levels:
+        #   unverified - Send keys to all device in the room.
+        #   cross-signed-untrusted - Require valid cross-signing, but trust all cross-signing keys.
+        #   cross-signed-tofu - Require valid cross-signing, trust cross-signing keys on first use (and reject changes).
+        #   cross-signed-verified - Require valid cross-signing, plus a valid user signature from the bridge bot.
+        #                           Note that creating user signatures from the bridge bot is not currently possible.
+        #   verified - Require manual per-device verification
+        #              (currently only possible by modifying the `trust` column in the `crypto_device` database table).
+        verification_levels:
+            # Minimum level for which the bridge should send keys to when bridging messages from FB/IG to Matrix.
+            receive: unverified
+            # Minimum level that the bridge should accept for incoming Matrix messages.
+            send: unverified
+            # Minimum level that the bridge should require for accepting key requests.
+            share: cross-signed-tofu
+        # Options for Megolm room key rotation. These options allow you to
+        # configure the m.room.encryption event content. See:
+        # https://spec.matrix.org/v1.3/client-server-api/#mroomencryption for
+        # more information about that event.
+        rotation:
+            # Enable custom Megolm room key rotation settings. Note that these
+            # settings will only apply to rooms created after this option is
+            # set.
+            enable_custom: false
+            # The maximum number of milliseconds a session should be used
+            # before changing it. The Matrix spec recommends 604800000 (a week)
+            # as the default.
+            milliseconds: 604800000
+            # The maximum number of messages that should be sent with a given a
+            # session before changing it. The Matrix spec recommends 100 as the
+            # default.
+            messages: 100
+
+            # Disable rotating keys when a user's devices change?
+            # You should not enable this option unless you understand all the implications.
+            disable_device_change_key_rotation: false
+
+    # Settings for provisioning API
+    provisioning:
+        # Prefix for the provisioning API paths.
+        prefix: /_matrix/provision
+        # Shared secret for authentication. If set to "generate", a random secret will be generated,
+        # or if set to "disable", the provisioning API will be disabled.
+        shared_secret: disable
+        # Enable debug API at /debug with provisioning authentication.
+        debug_endpoints: false
+
+    # Permissions for using the bridge.
+    # Permitted values:
+    #    relay - Talk through the relaybot (if enabled), no access otherwise
+    #     user - Access to use the bridge to chat with a Meta account.
+    #    admin - User level and some additional administration tools
+    # Permitted keys:
+    #        * - All Matrix users
+    #   domain - All users on that homeserver
+    #     mxid - Specific user
+    permissions: {{ matrix_mautrix_meta_messenger_bridge_permissions | to_json }}
+
+    # Settings for relay mode
+    relay:
+        # Whether relay mode should be allowed. If allowed, `!wa set-relay` can be used to turn any
+        # authenticated user into a relaybot for that chat.
+        enabled: {{ matrix_mautrix_meta_messenger_bridge_relay_enabled | to_json }}
+        # Should only admins be allowed to set themselves as relay users?
+        admin_only: {{ matrix_mautrix_meta_messenger_bridge_relay_admin_only | to_json }}
+        # The formats to use when sending messages to Meta via the relaybot.
+        message_formats:
+            m.text: "{% raw %}{{ .Sender.Displayname }}: {{ .Message }}{% endraw %}"
+            m.notice: "{% raw %}{{ .Sender.Displayname }}: {{ .Message }}{% endraw %}"
+            m.emote: "{% raw %}* {{ .Sender.Displayname }} {{ .Message }}{% endraw %}"
+            m.file: "{% raw %}{{ .Sender.Displayname }} sent a file{% endraw %}"
+            m.image: "{% raw %}{{ .Sender.Displayname }} sent an image{% endraw %}"
+            m.audio: "{% raw %}{{ .Sender.Displayname }} sent an audio file{% endraw %}"
+            m.video: "{% raw %}{{ .Sender.Displayname }} sent a video{% endraw %}"
+            m.location: "{% raw %}{{ .Sender.Displayname }} sent a location{% endraw %}"
+
+# Logging config. See https://github.com/tulir/zeroconfig for details.
+logging:
+    min_level: {{ matrix_mautrix_meta_messenger_logging_min_level | to_json }}
+    writers:
+    - type: stdout
+      format: pretty
diff --git a/roles/custom/matrix-bridge-mautrix-meta-messenger/templates/labels.j2 b/roles/custom/matrix-bridge-mautrix-meta-messenger/templates/labels.j2
new file mode 100644
index 000000000..79e1fc743
--- /dev/null
+++ b/roles/custom/matrix-bridge-mautrix-meta-messenger/templates/labels.j2
@@ -0,0 +1,48 @@
+{% if matrix_mautrix_meta_messenger_container_labels_traefik_enabled %}
+traefik.enable=true
+
+{% if matrix_mautrix_meta_messenger_container_labels_traefik_docker_network %}
+traefik.docker.network={{ matrix_mautrix_meta_messenger_container_labels_traefik_docker_network }}
+{% endif %}
+
+traefik.http.services.{{ matrix_mautrix_meta_messenger_identifier }}-appservice.loadbalancer.server.port=29319
+traefik.http.services.{{ matrix_mautrix_meta_messenger_identifier }}-metrics.loadbalancer.server.port=8000
+
+
+{% if matrix_mautrix_meta_messenger_container_labels_metrics_enabled %}
+############################################################
+#                                                          #
+# Metrics                                                  #
+#                                                          #
+############################################################
+
+{% if matrix_mautrix_meta_messenger_container_labels_metrics_middleware_basic_auth_enabled %}
+traefik.http.middlewares.{{ matrix_mautrix_meta_messenger_identifier }}-metrics-basic-auth.basicauth.users={{ matrix_mautrix_meta_messenger_container_labels_metrics_middleware_basic_auth_users }}
+traefik.http.routers.{{ matrix_mautrix_meta_messenger_identifier }}-metrics.middlewares={{ matrix_mautrix_meta_messenger_identifier }}-metrics-basic-auth
+{% endif %}
+
+traefik.http.routers.{{ matrix_mautrix_meta_messenger_identifier }}-metrics.rule={{ matrix_mautrix_meta_messenger_container_labels_metrics_traefik_rule }}
+
+{% if matrix_mautrix_meta_messenger_container_labels_metrics_traefik_priority | int > 0 %}
+traefik.http.routers.{{ matrix_mautrix_meta_messenger_identifier }}-metrics.priority={{ matrix_mautrix_meta_messenger_container_labels_metrics_traefik_priority }}
+{% endif %}
+
+traefik.http.routers.{{ matrix_mautrix_meta_messenger_identifier }}-metrics.service={{ matrix_mautrix_meta_messenger_identifier }}-metrics
+traefik.http.routers.{{ matrix_mautrix_meta_messenger_identifier }}-metrics.entrypoints={{ matrix_mautrix_meta_messenger_container_labels_metrics_traefik_entrypoints }}
+
+traefik.http.routers.{{ matrix_mautrix_meta_messenger_identifier }}-metrics.tls={{ matrix_mautrix_meta_messenger_container_labels_metrics_traefik_tls | to_json }}
+{% if matrix_mautrix_meta_messenger_container_labels_metrics_traefik_tls %}
+traefik.http.routers.{{ matrix_mautrix_meta_messenger_identifier }}-metrics.tls.certResolver={{ matrix_mautrix_meta_messenger_container_labels_metrics_traefik_tls_certResolver }}
+{% endif %}
+
+############################################################
+#                                                          #
+# /Metrics                                                 #
+#                                                          #
+############################################################
+{% endif %}
+
+
+{% endif %}
+
+{{ matrix_mautrix_meta_messenger_container_labels_additional_labels }}
diff --git a/roles/custom/matrix-bridge-mautrix-meta-messenger/templates/systemd/matrix-mautrix-meta.service.j2 b/roles/custom/matrix-bridge-mautrix-meta-messenger/templates/systemd/matrix-mautrix-meta.service.j2
new file mode 100644
index 000000000..0ca0263b1
--- /dev/null
+++ b/roles/custom/matrix-bridge-mautrix-meta-messenger/templates/systemd/matrix-mautrix-meta.service.j2
@@ -0,0 +1,51 @@
+#jinja2: lstrip_blocks: "True"
+[Unit]
+Description=mautrix-meta bridge ({{ matrix_mautrix_meta_messenger_identifier }})
+{% for service in matrix_mautrix_meta_messenger_systemd_required_services_list %}
+Requires={{ service }}
+After={{ service }}
+{% endfor %}
+{% for service in matrix_mautrix_meta_messenger_systemd_wanted_services_list %}
+Wants={{ service }}
+{% endfor %}
+DefaultDependencies=no
+
+[Service]
+Type=simple
+Environment="HOME={{ devture_systemd_docker_base_systemd_unit_home_path }}"
+ExecStartPre=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} stop --time={{ devture_systemd_docker_base_container_stop_grace_time_seconds }} {{ matrix_mautrix_meta_messenger_identifier }} 2>/dev/null || true'
+ExecStartPre=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} rm {{ matrix_mautrix_meta_messenger_identifier }} 2>/dev/null || true'
+
+ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} create \
+			--rm \
+			--name={{ matrix_mautrix_meta_messenger_identifier }} \
+			--log-driver=none \
+			--user={{ matrix_user_uid }}:{{ matrix_user_gid }} \
+			--cap-drop=ALL \
+			--network={{ matrix_mautrix_meta_messenger_container_network }} \
+			{% if matrix_mautrix_meta_messenger_container_http_host_bind_port %}
+			-p {{ matrix_mautrix_meta_messenger_container_http_host_bind_port }}:29319 \
+			{% endif %}
+			--mount type=bind,src={{ matrix_mautrix_meta_messenger_config_path }},dst=/config,ro \
+			--mount type=bind,src={{ matrix_mautrix_meta_messenger_data_path }},dst=/data \
+			--label-file={{ matrix_mautrix_meta_messenger_base_path }}/labels \
+			{% for arg in matrix_mautrix_meta_messenger_container_extra_arguments %}
+			{{ arg }} \
+			{% endfor %}
+			{{ matrix_mautrix_meta_messenger_container_image }} \
+			/usr/bin/mautrix-meta -c /config/config.yaml -r /config/registration.yaml --no-update
+
+{% for network in matrix_mautrix_meta_messenger_container_additional_networks %}
+ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} network connect {{ network }} {{ matrix_mautrix_meta_messenger_identifier }}
+{% endfor %}
+
+ExecStart={{ devture_systemd_docker_base_host_command_docker }} start --attach {{ matrix_mautrix_meta_messenger_identifier }}
+
+ExecStop=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} stop --time={{ devture_systemd_docker_base_container_stop_grace_time_seconds }} {{ matrix_mautrix_meta_messenger_identifier }} 2>/dev/null || true'
+ExecStop=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} rm {{ matrix_mautrix_meta_messenger_identifier }} 2>/dev/null || true'
+Restart=always
+RestartSec=30
+SyslogIdentifier={{ matrix_mautrix_meta_messenger_identifier }}
+
+[Install]
+WantedBy=multi-user.target
diff --git a/setup.yml b/setup.yml
index beb0b0a58..c1ba0f06b 100644
--- a/setup.yml
+++ b/setup.yml
@@ -61,6 +61,8 @@
     - custom/matrix-bridge-mautrix-hangouts
     - custom/matrix-bridge-mautrix-googlechat
     - custom/matrix-bridge-mautrix-instagram
+    - custom/matrix-bridge-mautrix-meta-messenger
+    - custom/matrix-bridge-mautrix-meta-instagram
     - custom/matrix-bridge-mautrix-telegram
     - custom/matrix-bridge-mautrix-signal
     - custom/matrix-bridge-mautrix-gmessages

From 4ae2e957724e1a13ffe70dc59e5bdcfc151db1e1 Mon Sep 17 00:00:00 2001
From: Slavi Pantaleev <slavi@devture.com>
Date: Mon, 19 Feb 2024 10:34:09 +0200
Subject: [PATCH 08/18] Add validation task for potential conflict between
 mautrix-instagram and mautrix-meta-instagram

Related to https://github.com/spantaleev/matrix-docker-ansible-deploy/issues/3138 and 367af472ea2e659f2cd
---
 roles/custom/matrix-base/tasks/validate_config.yml | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/roles/custom/matrix-base/tasks/validate_config.yml b/roles/custom/matrix-base/tasks/validate_config.yml
index d96fda890..3ca6061b4 100644
--- a/roles/custom/matrix-base/tasks/validate_config.yml
+++ b/roles/custom/matrix-base/tasks/validate_config.yml
@@ -85,3 +85,15 @@
       To clean up your server from mx-puppet-skype's presence, see this changelog entry: https://github.com/spantaleev/matrix-docker-ansible-deploy/blob/master/CHANGELOG.md#mx-puppet-skype-removal.
       If you still need bridging to Skype, consider switching to the go-skype bridge instead. See `docs/configuring-playbook-bridge-go-skype-bridge.md`.
   when: "'matrix_mx_puppet_skype_enabled' in vars"
+
+- name: Fail if mautrix-instagram and mautrix-meta-instagram are in conflict
+  ansible.builtin.fail:
+    msg: >-
+      Your configuration enables both the old mautrix-instagram bridge and the new mautrix-meta-instagram bridge.
+      By default, both bridges are configured to use the same bridge bot username (`@{{ matrix_mautrix_meta_instagram_appservice_username }}:{{ matrix_domain }}`) which is a conflict.
+      We recommend that you disable at least one of the bridges (preferrably the old mautrix-instagram bridge), or to resolve the conflict in another way.
+      To resolve the conflict without disabling a bridge, consider adjusting one of `matrix_mautrix_instagram_appservice_bot_username` or `matrix_mautrix_meta_instagram_appservice_username` - they both have a value of {{ matrix_mautrix_meta_instagram_appservice_username }} right now.
+  when:
+    - matrix_mautrix_instagram_enabled | bool
+    - matrix_mautrix_meta_instagram_enabled | bool
+    - matrix_mautrix_instagram_appservice_bot_username == matrix_mautrix_meta_instagram_appservice_username

From bb59e82bcadafba8d5262e976e11df7e89dd4885 Mon Sep 17 00:00:00 2001
From: Samuel Meenzen <samuel@meenzen.net>
Date: Mon, 19 Feb 2024 15:14:36 +0100
Subject: [PATCH 09/18] fix: actually allow overriding the conduit config
 template

---
 roles/custom/matrix-conduit/defaults/main.yml       | 2 +-
 roles/custom/matrix-conduit/tasks/setup_install.yml | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/roles/custom/matrix-conduit/defaults/main.yml b/roles/custom/matrix-conduit/defaults/main.yml
index 37d83fd10..3bccf1078 100644
--- a/roles/custom/matrix-conduit/defaults/main.yml
+++ b/roles/custom/matrix-conduit/defaults/main.yml
@@ -114,7 +114,7 @@ matrix_conduit_container_extra_arguments: []
 # If you'd like to have your own different configuration, feel free to copy and paste
 # the original files into your inventory (e.g. in `inventory/host_vars/<host>/`)
 # and then change the specific host's `vars.yaml` file like this:
-# matrix_conduit_template_conduit_config: "{{ playbook_dir }}/inventory/host_vars/<host>/conduit.yaml.j2"
+# matrix_conduit_template_conduit_config: "{{ playbook_dir }}/inventory/host_vars/<host>/conduit.toml.j2"
 matrix_conduit_template_conduit_config: "{{ role_path }}/templates/conduit/conduit.toml.j2"
 
 # Max size for uploads, in bytes
diff --git a/roles/custom/matrix-conduit/tasks/setup_install.yml b/roles/custom/matrix-conduit/tasks/setup_install.yml
index 409f2e80c..295b5c4f2 100644
--- a/roles/custom/matrix-conduit/tasks/setup_install.yml
+++ b/roles/custom/matrix-conduit/tasks/setup_install.yml
@@ -18,7 +18,7 @@
 
 - name: Ensure Conduit configuration installed
   ansible.builtin.template:
-    src: "{{ role_path }}/templates/conduit.toml.j2"
+    src: "{{ matrix_conduit_template_conduit_config }}"
     dest: "{{ matrix_conduit_config_path }}/conduit.toml"
     mode: 0644
     owner: "{{ matrix_user_username }}"

From 0990fe79cd1804223739a4e7b2d9c9a3a80c233c Mon Sep 17 00:00:00 2001
From: Slavi Pantaleev <slavi@devture.com>
Date: Tue, 20 Feb 2024 15:50:33 +0200
Subject: [PATCH 10/18] Add missing
 matrix_media_repo_container_labels_traefik_entrypoints variable and hook it
 to other matrix-media-repo entrypoint variables

---
 roles/custom/matrix-media-repo/defaults/main.yml | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/roles/custom/matrix-media-repo/defaults/main.yml b/roles/custom/matrix-media-repo/defaults/main.yml
index b931943c0..bab6155bb 100755
--- a/roles/custom/matrix-media-repo/defaults/main.yml
+++ b/roles/custom/matrix-media-repo/defaults/main.yml
@@ -63,11 +63,12 @@ matrix_media_repo_container_extra_arguments: []
 # To inject your own other container labels, see `matrix_media_repo_container_labels_additional_labels`.
 matrix_media_repo_container_labels_traefik_enabled: true
 matrix_media_repo_container_labels_traefik_docker_network: "{{ matrix_media_repo_container_network }}"
+matrix_media_repo_container_labels_traefik_entrypoints: web-secure
 
 matrix_media_repo_container_labels_traefik_media_path_prefix: "/_matrix/media"
 matrix_media_repo_container_labels_traefik_media_rule: "Host(`{{ matrix_server_fqn_matrix }}`) && PathPrefix(`{{ matrix_media_repo_container_labels_traefik_media_path_prefix | quote }}`)"
 matrix_media_repo_container_labels_traefik_media_priority: 0
-matrix_media_repo_container_labels_traefik_media_entrypoints: web-secure
+matrix_media_repo_container_labels_traefik_media_entrypoints: "{{ matrix_media_repo_container_labels_traefik_entrypoints }}"
 matrix_media_repo_container_labels_traefik_media_tls: "{{ matrix_media_repo_container_labels_traefik_media_entrypoints != 'web' }}"
 matrix_media_repo_container_labels_traefik_media_tls_certResolver: default  # noqa var-naming
 
@@ -83,7 +84,7 @@ matrix_media_repo_container_labels_traefik_internal_media_entrypoints: ""
 matrix_media_repo_container_labels_traefik_logout_path_prefix: "/_matrix/client/{version:(r0|v1|v3|unstable)}/{endpoint:(logout|logout/all)}"
 matrix_media_repo_container_labels_traefik_logout_rule: "Host(`{{ matrix_server_fqn_matrix }}`) && PathPrefix(`{{ matrix_media_repo_container_labels_traefik_logout_path_prefix }}`)"
 matrix_media_repo_container_labels_traefik_logout_priority: 0
-matrix_media_repo_container_labels_traefik_logout_entrypoints: web-secure
+matrix_media_repo_container_labels_traefik_logout_entrypoints: "{{ matrix_media_repo_container_labels_traefik_entrypoints }}"
 matrix_media_repo_container_labels_traefik_logout_tls: "{{ matrix_media_repo_container_labels_traefik_logout_entrypoints != 'web' }}"
 matrix_media_repo_container_labels_traefik_logout_tls_certResolver: default  # noqa var-naming
 
@@ -92,14 +93,14 @@ matrix_media_repo_container_labels_traefik_logout_tls_certResolver: default  # n
 matrix_media_repo_container_labels_traefik_admin_path_prefix: "/_matrix/client/{version:(r0|v1|v3|unstable)}/admin/{endpoint:(purge_media_cache|quarantine_media/.*)}"
 matrix_media_repo_container_labels_traefik_admin_rule: "Host(`{{ matrix_server_fqn_matrix }}`) && PathPrefix(`{{ matrix_media_repo_container_labels_traefik_admin_path_prefix }}`)"
 matrix_media_repo_container_labels_traefik_admin_priority: 0
-matrix_media_repo_container_labels_traefik_admin_entrypoints: web-secure
+matrix_media_repo_container_labels_traefik_admin_entrypoints: "{{ matrix_media_repo_container_labels_traefik_entrypoints }}"
 matrix_media_repo_container_labels_traefik_admin_tls: "{{ matrix_media_repo_container_labels_traefik_admin_entrypoints != 'web' }}"
 matrix_media_repo_container_labels_traefik_admin_tls_certResolver: default  # noqa var-naming
 
 matrix_media_repo_container_labels_traefik_t2bot_path_prefix: "/_matrix/client/unstable/io.t2bot.media"
 matrix_media_repo_container_labels_traefik_t2bot_rule: "Host(`{{ matrix_server_fqn_matrix }}`) && PathPrefix(`{{ matrix_media_repo_container_labels_traefik_t2bot_path_prefix | quote }}`)"
 matrix_media_repo_container_labels_traefik_t2bot_priority: 0
-matrix_media_repo_container_labels_traefik_t2bot_entrypoints: web-secure
+matrix_media_repo_container_labels_traefik_t2bot_entrypoints: "{{ matrix_media_repo_container_labels_traefik_entrypoints }}"
 matrix_media_repo_container_labels_traefik_t2bot_tls: "{{ matrix_media_repo_container_labels_traefik_t2bot_entrypoints != 'web' }}"
 matrix_media_repo_container_labels_traefik_t2bot_tls_certResolver: default  # noqa var-naming
 

From 11f6e2e81027667bd17447dcd4ea19fb1eda8fa9 Mon Sep 17 00:00:00 2001
From: Benjamin Kampmann <ben@acter.global>
Date: Tue, 20 Feb 2024 19:20:25 +0100
Subject: [PATCH 11/18] Fix documentation bug in
 configuring-playbook-bridge-mautrix-signal.md

With the `|` the yaml is interpreted and saved to the configuration as a string and mautrix-signal doesn't start.
---
 docs/configuring-playbook-bridge-mautrix-signal.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/configuring-playbook-bridge-mautrix-signal.md b/docs/configuring-playbook-bridge-mautrix-signal.md
index e2caf4714..86e0d0313 100644
--- a/docs/configuring-playbook-bridge-mautrix-signal.md
+++ b/docs/configuring-playbook-bridge-mautrix-signal.md
@@ -45,7 +45,7 @@ This will add the admin permission to the specific user, while keeping the defau
 
 In case you want to replace the default permissions settings **completely**, populate the following item within your `vars.yml` file:
 ```yaml
-matrix_mautrix_signal_bridge_permissions: |
+matrix_mautrix_signal_bridge_permissions:
   '@ADMIN:YOUR_DOMAIN': admin
   '@USER:YOUR_DOMAIN' : user
 ```

From 905bdfc551669b3bdf06b211077c577af58f384c Mon Sep 17 00:00:00 2001
From: xvsun <80697688+xvsun@users.noreply.github.com>
Date: Wed, 21 Feb 2024 17:04:14 +0100
Subject: [PATCH 12/18] Add Synapse module auto accept invite to rooms and
 direct messages (#3195)

* feat: auto-accept-invite module and docs

* fix: name typos and some forgot to adjust variables

* fix: accept only direct messages should work now and better wording

* changed: only_direct_messages variable naming

* feat: add logger, add synapse workers config

* Fix typo and add details about synapse-auto-acccept-invite

* Add newline at end of file

* Fix alignment

* Fix logger name for synapse_auto_accept_invite

The name of the logger needs to match the name of the Python module.

Ref: https://github.com/matrix-org/synapse-auto-accept-invite/blob/d673c6767862e0340e58f6e9947c7d90ec190201/synapse_auto_accept_invite/__init__.py#L20

* Add missing document start YAML annotation

* Remove trailing spaces

---------

Co-authored-by: Slavi Pantaleev <slavi@devture.com>
---
 README.md                                     |  1 +
 ...ing-playbook-synapse-auto-accept-invite.md | 24 +++++++++++++++++++
 roles/custom/matrix-synapse/defaults/main.yml | 17 +++++++++++++
 .../tasks/ext/setup_install.yml               | 10 ++++++++
 .../setup_install.yml                         | 23 ++++++++++++++++++
 .../synapse/customizations/Dockerfile.j2      |  4 ++++
 6 files changed, 79 insertions(+)
 create mode 100644 docs/configuring-playbook-synapse-auto-accept-invite.md
 create mode 100644 roles/custom/matrix-synapse/tasks/ext/synapse-auto-accept-invite/setup_install.yml

diff --git a/README.md b/README.md
index 847fe78e8..460399308 100644
--- a/README.md
+++ b/README.md
@@ -165,6 +165,7 @@ Various services that don't fit any other category.
 | Name | Default? | Description | Documentation |
 | ---- | -------- | ----------- | ------------- |
 | [sliding-sync](https://github.com/matrix-org/sliding-sync)| x | Sliding Sync support for clients which require it (e.g. Element X) | [Link](docs/configuring-playbook-sliding-sync-proxy.md) |
+| [synapse_auto_accept_invite](https://github.com/matrix-org/synapse-auto-accept-invite) | x | A Synapse module to automatically accept invites. | [Link](docs/configuring-playbook-synapse-auto-accept-invite.md) |
 | [synapse_auto_compressor](https://github.com/matrix-org/rust-synapse-compress-state/#automated-tool-synapse_auto_compressor) | x | A cli tool that automatically compresses `state_groups` database table in background. | [Link](docs/configuring-playbook-synapse-auto-compressor.md) |
 | [synapse-simple-antispam](https://github.com/t2bot/synapse-simple-antispam) (advanced) | x | A spam checker module | [Link](docs/configuring-playbook-synapse-simple-antispam.md) |
 | [Matrix Corporal](https://github.com/devture/matrix-corporal) (advanced) | x | Reconciliator and gateway for a managed Matrix server | [Link](docs/configuring-playbook-matrix-corporal.md) |
diff --git a/docs/configuring-playbook-synapse-auto-accept-invite.md b/docs/configuring-playbook-synapse-auto-accept-invite.md
new file mode 100644
index 000000000..ccc4b0c33
--- /dev/null
+++ b/docs/configuring-playbook-synapse-auto-accept-invite.md
@@ -0,0 +1,24 @@
+# Setting up Synapse Auto Invite Accept (optional)
+
+The playbook can install and configure [synapse-auto-invite-accept](https://github.com/matrix-org/synapse-auto-accept-invite) for you.
+
+See that project's [documentation](https://github.com/matrix-org/synapse-auto-accept-invite) to learn what it does and why it might be useful to you.
+In short, it automatically accepts room invites. You can specify that only 1:1 room invites are auto-accepted. Defaults to false if not specified.
+
+If you decide that you'd like to let this playbook install it for you, you need a configuration like this:
+
+```yaml
+matrix_synapse_ext_synapse_auto_accept_invite_enabled: true
+
+matrix_synapse_ext_synapse_auto_accept_invite_accept_invites_only_direct_messages: true
+```
+
+## Synapse worker deployments
+
+In a [workerized Synapse deployment](https://github.com/spantaleev/matrix-docker-ansible-deploy/blob/c9a842147e09647c355799ca024d65a5de66b099/docs/configuring-playbook-synapse.md#load-balancing-with-workers) it is possible to run this module on a worker to reduce the load on the main process (Default is 'null'). For example add this to your configuration:
+
+```yaml
+matrix_synapse_ext_synapse_auto_accept_invite_worker_to_run_on: 'matrix-synapse-worker-generic-0'
+```
+
+There might be an [issue with federation](https://github.com/matrix-org/synapse-auto-accept-invite/issues/18).
\ No newline at end of file
diff --git a/roles/custom/matrix-synapse/defaults/main.yml b/roles/custom/matrix-synapse/defaults/main.yml
index 56d4162cf..943d04032 100644
--- a/roles/custom/matrix-synapse/defaults/main.yml
+++ b/roles/custom/matrix-synapse/defaults/main.yml
@@ -40,12 +40,18 @@ matrix_synapse_container_image_customizations_enabled: |-
     matrix_synapse_container_image_customizations_s3_storage_provider_installation_enabled
     or
     matrix_synapse_container_image_customizations_templates_enabled
+    or
+    matrix_synapse_container_image_customizations_auto_accept_invite_installation_enabled
   }}
 
 # Controls whether custom build steps will be added to the Dockerfile for installing s3-storage-provider.
 # The version that will be installed is specified in `matrix_synapse_ext_synapse_s3_storage_provider_version`.
 matrix_synapse_container_image_customizations_s3_storage_provider_installation_enabled: "{{ matrix_synapse_ext_synapse_s3_storage_provider_enabled }}"
 
+# Controls whether custom build steps will be added to the Dockerfile for installing auto-accept-invite module.
+# The version that will be installed is specified in `matrix_synapse_ext_synapse_auto_accept_invite_version`.
+matrix_synapse_container_image_customizations_auto_accept_invite_installation_enabled: "{{ matrix_synapse_ext_synapse_auto_accept_invite_enabled }}"
+
 # Controls whether custom build steps will be added to the Dockerfile for customizing the email templates used by Synapse.
 #
 # Example usage:
@@ -1212,6 +1218,17 @@ matrix_synapse_ext_synapse_s3_storage_provider_update_db_day_count: 0
 # This is a systemd timer OnCalendar definition. Learn more here: https://man.archlinux.org/man/systemd.time.7#CALENDAR_EVENTS
 matrix_synapse_ext_synapse_s3_storage_provider_periodic_migration_schedule: '*-*-* 05:00:00'
 
+# Synapse module to automatically accept room invites.
+# See: https://github.com/matrix-org/synapse-auto-accept-invite
+# Installing it requires building a customized Docker image for Synapse (see `matrix_synapse_container_image_customizations_enabled`).
+# Enabling this will enable customizations and inject the appropriate Dockerfile clauses for installing synapse-auto-accept-invite.
+matrix_synapse_ext_synapse_auto_accept_invite_enabled: false
+matrix_synapse_ext_synapse_auto_accept_invite_version: 1.1.3
+# Specifies whether only direct messages (1:1 rooms) will be auto accepted.
+matrix_synapse_ext_synapse_auto_accept_invite_accept_invites_only_direct_messages: false
+# When Synapse workers enabled it is possible (but not required) to assign a worker to run this module on (null = main process).
+matrix_synapse_ext_synapse_auto_accept_invite_worker_to_run_on: null
+
 # Specifies whether an external media repository is enabled.
 # If it is, the Synapse media repo and media-repo workers will be disabled automatically.
 matrix_synapse_ext_media_repo_enabled: false
diff --git a/roles/custom/matrix-synapse/tasks/ext/setup_install.yml b/roles/custom/matrix-synapse/tasks/ext/setup_install.yml
index 4adb6566a..f7be477aa 100644
--- a/roles/custom/matrix-synapse/tasks/ext/setup_install.yml
+++ b/roles/custom/matrix-synapse/tasks/ext/setup_install.yml
@@ -72,3 +72,13 @@
 
     - when: matrix_synapse_ext_synapse_s3_storage_provider_enabled | bool
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/ext/s3-storage-provider/setup_install.yml"
+
+# synapse-auto-accept-invite
+- tags:
+    - setup-all
+    - setup-synapse
+    - install-all
+    - install-synapse
+  block:
+    - when: matrix_synapse_ext_synapse_auto_accept_invite_enabled | bool
+      ansible.builtin.include_tasks: "{{ role_path }}/tasks/ext/synapse-auto-accept-invite/setup_install.yml"
diff --git a/roles/custom/matrix-synapse/tasks/ext/synapse-auto-accept-invite/setup_install.yml b/roles/custom/matrix-synapse/tasks/ext/synapse-auto-accept-invite/setup_install.yml
new file mode 100644
index 000000000..06457e370
--- /dev/null
+++ b/roles/custom/matrix-synapse/tasks/ext/synapse-auto-accept-invite/setup_install.yml
@@ -0,0 +1,23 @@
+---
+
+- ansible.builtin.set_fact:
+    matrix_synapse_modules: |
+      {{
+        matrix_synapse_modules | default([])
+        +
+        [
+          {
+            "module": "synapse_auto_accept_invite.InviteAutoAccepter",
+            "config": {
+              "accept_invites_only_for_direct_messages": matrix_synapse_ext_synapse_auto_accept_invite_accept_invites_only_direct_messages,
+              "worker_to_run_on": matrix_synapse_ext_synapse_auto_accept_invite_worker_to_run_on,
+          },
+        }]
+      }}
+
+    matrix_synapse_additional_loggers_auto: >
+      {{
+        matrix_synapse_additional_loggers_auto
+        +
+        [{'name': 'synapse_auto_accept_invite', 'level': 'INFO'}]
+      }}
diff --git a/roles/custom/matrix-synapse/templates/synapse/customizations/Dockerfile.j2 b/roles/custom/matrix-synapse/templates/synapse/customizations/Dockerfile.j2
index 6257f1985..39367fe09 100644
--- a/roles/custom/matrix-synapse/templates/synapse/customizations/Dockerfile.j2
+++ b/roles/custom/matrix-synapse/templates/synapse/customizations/Dockerfile.j2
@@ -1,6 +1,10 @@
 #jinja2: lstrip_blocks: "True"
 FROM {{ matrix_synapse_docker_image }}
 
+{% if matrix_synapse_container_image_customizations_auto_accept_invite_installation_enabled %}
+RUN pip install synapse-auto-accept-invite=={{ matrix_synapse_ext_synapse_auto_accept_invite_version }}
+{% endif %}
+
 {% if matrix_synapse_container_image_customizations_s3_storage_provider_installation_enabled %}
 RUN pip install synapse-s3-storage-provider=={{ matrix_synapse_ext_synapse_s3_storage_provider_version }}
 {% endif %}

From 540810b968ecf3a304e53a884cb69074fb234c27 Mon Sep 17 00:00:00 2001
From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com>
Date: Wed, 21 Feb 2024 16:04:49 +0000
Subject: [PATCH 13/18] chore(deps): update
 ghcr.io/matrixgpt/matrix-chatgpt-bot docker tag to v3.1.5

---
 roles/custom/matrix-bot-chatgpt/defaults/main.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/roles/custom/matrix-bot-chatgpt/defaults/main.yml b/roles/custom/matrix-bot-chatgpt/defaults/main.yml
index 957501b01..7aa14e34b 100644
--- a/roles/custom/matrix-bot-chatgpt/defaults/main.yml
+++ b/roles/custom/matrix-bot-chatgpt/defaults/main.yml
@@ -5,7 +5,7 @@
 matrix_bot_chatgpt_enabled: true
 
 # renovate: datasource=docker depName=ghcr.io/matrixgpt/matrix-chatgpt-bot
-matrix_bot_chatgpt_version: 3.1.4
+matrix_bot_chatgpt_version: 3.1.5
 
 matrix_bot_chatgpt_container_image_self_build: false
 matrix_bot_chatgpt_container_image_self_build_repo: "https://github.com/matrixgpt/matrix-chatgpt-bot"

From c375d888e23e89b1130a95d820934c4b8c77f20b Mon Sep 17 00:00:00 2001
From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com>
Date: Wed, 21 Feb 2024 18:24:09 +0000
Subject: [PATCH 14/18] chore(deps): update halfshot/matrix-hookshot docker tag
 to v5.2.1

---
 roles/custom/matrix-bridge-hookshot/defaults/main.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/roles/custom/matrix-bridge-hookshot/defaults/main.yml b/roles/custom/matrix-bridge-hookshot/defaults/main.yml
index e7f46a7cc..507b7692e 100644
--- a/roles/custom/matrix-bridge-hookshot/defaults/main.yml
+++ b/roles/custom/matrix-bridge-hookshot/defaults/main.yml
@@ -17,7 +17,7 @@ matrix_hookshot_container_additional_networks_auto: []
 matrix_hookshot_container_additional_networks_custom: []
 
 # renovate: datasource=docker depName=halfshot/matrix-hookshot
-matrix_hookshot_version: 5.1.2
+matrix_hookshot_version: 5.2.1
 
 matrix_hookshot_docker_image: "{{ matrix_hookshot_docker_image_name_prefix }}halfshot/matrix-hookshot:{{ matrix_hookshot_version }}"
 matrix_hookshot_docker_image_name_prefix: "{{ 'localhost/' if matrix_hookshot_container_image_self_build else matrix_container_global_registry_prefix }}"

From ce893c1b221dfea2c1421a5f54dd8159f6fff601 Mon Sep 17 00:00:00 2001
From: Slavi Pantaleev <slavi@devture.com>
Date: Thu, 22 Feb 2024 15:41:11 +0200
Subject: [PATCH 15/18] Downgrade ChatGPT (3.1.5 -> 3.1.4)

The new version is very broken. It has at least 2 issues.

The first one is:

```
Error: maxPromptTokens + max_tokens (3097 + 1024 = 4121) must be less than or equal to maxContextTokens (4097)
    at ChatGPTClient.setOptions (file:///usr/src/app/node_modules/@waylaidwanderer/chatgpt-api/src/ChatGPTClient.js:72:19)
    at new ChatGPTClient (file:///usr/src/app/node_modules/@waylaidwanderer/chatgpt-api/src/ChatGPTClient.js:23:14)
    at main (file:///usr/src/app/dist/index.js:62:21)
    at file:///usr/src/app/dist/index.js:94:1
    at ModuleJob.run (node:internal/modules/esm/module_job:218:25)
    at async ModuleLoader.import (node:internal/modules/esm/loader:329:24)
    at async loadESM (node:internal/process/esm_loader:28:7)
    at async handleMainPromise (node:internal/modules/run_main:113:12)
```

Likely related to:

- https://github.com/matrixgpt/matrix-chatgpt-bot/issues/246
- https://github.com/matrixgpt/matrix-chatgpt-bot/pull/248

It can be tweaked around by overriding some default environment
variables (`roles/custom/matrix-bot-chatgpt/templates/env.j2`) in order to tweak them:

```
CHATGPT_MAX_CONTEXT_TOKENS=4097
CHATGPT_MAX_PROMPT_TOKENS=2500
```

This leads us to another issue:

```
node:internal/process/promises:289
            triggerUncaughtException(err, true /* fromPromise */);
            ^
[Error: Failed to deserialize or serialize a JSON value missing field `version` at line 1 column 6704] {
  code: 'GenericFailure'
}
Node.js v20.11.1
error Command failed with exit code 1.
```

... whatever that means.
---
 roles/custom/matrix-bot-chatgpt/defaults/main.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/roles/custom/matrix-bot-chatgpt/defaults/main.yml b/roles/custom/matrix-bot-chatgpt/defaults/main.yml
index 7aa14e34b..957501b01 100644
--- a/roles/custom/matrix-bot-chatgpt/defaults/main.yml
+++ b/roles/custom/matrix-bot-chatgpt/defaults/main.yml
@@ -5,7 +5,7 @@
 matrix_bot_chatgpt_enabled: true
 
 # renovate: datasource=docker depName=ghcr.io/matrixgpt/matrix-chatgpt-bot
-matrix_bot_chatgpt_version: 3.1.5
+matrix_bot_chatgpt_version: 3.1.4
 
 matrix_bot_chatgpt_container_image_self_build: false
 matrix_bot_chatgpt_container_image_self_build_repo: "https://github.com/matrixgpt/matrix-chatgpt-bot"

From 64037336518d74d1ef5a6dc11d7c3cbe622ea2e0 Mon Sep 17 00:00:00 2001
From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com>
Date: Thu, 22 Feb 2024 22:45:37 +0000
Subject: [PATCH 16/18] chore(deps): update dependency prometheus to v2.50.0-0

---
 requirements.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/requirements.yml b/requirements.yml
index 125d75f9d..2e6893a99 100644
--- a/requirements.yml
+++ b/requirements.yml
@@ -46,7 +46,7 @@
   version: 7eadc992ca952fc29bf3fab5aa6335fa82ff01e5
   name: postgres_backup
 - src: git+https://github.com/mother-of-all-self-hosting/ansible-role-prometheus.git
-  version: v2.49.1-2
+  version: v2.50.0-0
   name: prometheus
 - src: git+https://github.com/mother-of-all-self-hosting/ansible-role-prometheus-node-exporter.git
   version: v1.7.0-3

From b1413a56452214c542597a4d47c382f348eda5a2 Mon Sep 17 00:00:00 2001
From: Slavi Pantaleev <slavi@devture.com>
Date: Fri, 23 Feb 2024 08:47:54 +0200
Subject: [PATCH 17/18] Ensure matrix-ssl-lets-encrypt-certificates-renew
 systemd timer and service are gone

We may have had another migration task before, but I cannot find it now.

Some people have reported a leftover systemd timer and service,
so it's evident that not everyone has gone through that previous migration.
---
 .../tasks/uninstall_matrix_ssl.yml                        | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/roles/custom/matrix_playbook_migration/tasks/uninstall_matrix_ssl.yml b/roles/custom/matrix_playbook_migration/tasks/uninstall_matrix_ssl.yml
index ebb2c1049..c1c66409b 100644
--- a/roles/custom/matrix_playbook_migration/tasks/uninstall_matrix_ssl.yml
+++ b/roles/custom/matrix_playbook_migration/tasks/uninstall_matrix_ssl.yml
@@ -4,3 +4,11 @@
   ansible.builtin.file:
     path: "{{ matrix_base_data_path }}/ssl"
     state: absent
+
+- name: Ensure matrix-ssl-lets-encrypt-certificates-renew systemd timer and service are gone
+  ansible.builtin.file:
+    path: "{{ devture_systemd_docker_base_systemd_path }}/{{ item }}"
+    state: absent
+  with_items:
+    - matrix-ssl-lets-encrypt-certificates-renew.timer
+    - matrix-ssl-lets-encrypt-certificates-renew.service

From e2643a317c5a425884a795dac20372072344aea0 Mon Sep 17 00:00:00 2001
From: David Mehren <git@herrmehren.de>
Date: Fri, 23 Feb 2024 22:10:00 +0100
Subject: [PATCH 18/18] Ensure reports always land on the synapse main process

We noticed that the reporting function in Element is broken, at least when using the 'specialized-workers' preset.

This changes the `main_override_locations_regex` of the reverse proxy companion to ensure that requests to `/_matrix/client/v3/rooms/<roomid>/report/<message>` always land on the main process.
---
 .../matrix-synapse-reverse-proxy-companion/defaults/main.yml    | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/roles/custom/matrix-synapse-reverse-proxy-companion/defaults/main.yml b/roles/custom/matrix-synapse-reverse-proxy-companion/defaults/main.yml
index 463bb2eb5..08c425fa0 100644
--- a/roles/custom/matrix-synapse-reverse-proxy-companion/defaults/main.yml
+++ b/roles/custom/matrix-synapse-reverse-proxy-companion/defaults/main.yml
@@ -226,7 +226,7 @@ matrix_synapse_reverse_proxy_companion_synapse_stream_writer_receipts_stream_wor
 matrix_synapse_reverse_proxy_companion_synapse_stream_writer_presence_stream_worker_client_server_locations: []
 matrix_synapse_reverse_proxy_companion_synapse_media_repository_locations: []
 matrix_synapse_reverse_proxy_companion_synapse_user_dir_locations: []
-matrix_synapse_reverse_proxy_companion_client_server_main_override_locations_regex: ^/_matrix/client/(api/v1|r0|v3|unstable)/(account/3pid/|directory/list/room/|pushrules/|rooms/[^/]+/(forget|upgrade)|login/sso/redirect/|register)
+matrix_synapse_reverse_proxy_companion_client_server_main_override_locations_regex: ^/_matrix/client/(api/v1|r0|v3|unstable)/(account/3pid/|directory/list/room/|pushrules/|rooms/[^/]+/(forget|upgrade|report)|login/sso/redirect/|register)
 matrix_synapse_reverse_proxy_companion_client_server_sso_override_locations_regex: ^(/_matrix/client/(api/v1|r0|v3|unstable)/login/sso/redirect|/_synapse/client/(pick_username|(new_user_consent|oidc/callback|pick_idp|sso_register)$))
 matrix_synapse_reverse_proxy_companion_federation_override_locations_regex: ^/_matrix/federation/v1/openid/userinfo$