Rework Continuwuity ReCAPTCHA gating to use a derived internal flag

Move the enablement logic out of `defaults/main.yml` and into a derived
`matrix_continuwuity_recaptcha_enabled` flag in `vars/main.yml`, since it
is computed (not user-facing) state. Continuwuity has no native
enable-captcha toggle, so presence of both keys is what enables the flow.

Replace the partial-config validation with a single consistency check
that fails only when exactly one of the two keys is set, and keep both
keys empty by default so nothing is rendered when ReCAPTCHA is unused.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

roles/custom/matrix-continuwuity/defaults/main.yml

@@ -191,8 +191,9 @@ matrix_continuwuity_config_turn_password: ''
 # Controls whether the self-check feature should validate SSL certificates.
 matrix_continuwuity_self_check_validate_certificates: true
 
-# If set, registration will require Google ReCAPTCHA verification.
-matrix_continuwuity_recaptcha_enabled: "{{ matrix_continuwuity_config_recaptcha_site_key != '' and matrix_continuwuity_config_recaptcha_private_site_key != '' }}"
+# Configuring both of these settings makes registration require Google ReCAPTCHA verification.
+# Both must be set together (or both left empty). Setting only one of them is a configuration error.
+# When both are set, ReCAPTCHA gets enabled automatically (see `matrix_continuwuity_recaptcha_enabled` in `vars/main.yml`).
 matrix_continuwuity_config_recaptcha_site_key: ''
 matrix_continuwuity_config_recaptcha_private_site_key: ''
 

roles/custom/matrix-continuwuity/tasks/validate_config.yml

@@ -38,10 +38,10 @@
     - {'old': 'matrix_continuwuity_docker_image_registry_prefix_upstream_default', 'new': 'matrix_continuwuity_container_image_registry_prefix_upstream_default'}
     - {'old': 'matrix_continuwuity_container_image_force_pull', 'new': '<removed> (the new community.docker.docker_image_pull module handles this natively)'}
 
-- name: Fail if required Continuwuity variables are undefined
+- name: Fail if Continuwuity ReCAPTCHA is only partially configured
   ansible.builtin.fail:
-    msg: "The `{{ item.name }}` variable must be defined and have a non-null value."
-  with_items:
-    - {'name': 'matrix_continuwuity_config_recaptcha_site_key', when: "{{ matrix_continuwuity_config_recaptcha_private_site_key | string | length > 0 }}"}
-    - {'name': 'matrix_continuwuity_config_recaptcha_private_site_key', when: "{{ matrix_continuwuity_config_recaptcha_site_key | string | length > 0 }}"}
-  when: "item.when | bool and (lookup('vars', item.name, default='') == '' or lookup('vars', item.name, default='') is none)"
+    msg: >-
+      You have configured only one of `matrix_continuwuity_config_recaptcha_site_key` and
+      `matrix_continuwuity_config_recaptcha_private_site_key`. Configure both to enable ReCAPTCHA
+      registration, or leave both empty to disable it.
+  when: "(matrix_continuwuity_config_recaptcha_site_key | string | length > 0) != (matrix_continuwuity_config_recaptcha_private_site_key | string | length > 0)"

roles/custom/matrix-continuwuity/vars/main.yml

@@ -1,9 +1,15 @@
 # SPDX-FileCopyrightText: 2025 MDAD project contributors
 # SPDX-FileCopyrightText: 2025 Slavi Pantaleev
+# SPDX-FileCopyrightText: 2026 Catalan Lover <catalanlover@protonmail.com>
 #
 # SPDX-License-Identifier: AGPL-3.0-or-later
 
 ---
 
+# Continuwuity has no dedicated "enable ReCAPTCHA" setting. It enables ReCAPTCHA registration based on the
+# presence of a recaptcha private site key, so we only render the keys when both have been configured.
+# This avoids rendering empty keys, which would otherwise enable a broken ReCAPTCHA flow.
+matrix_continuwuity_recaptcha_enabled: "{{ matrix_continuwuity_config_recaptcha_site_key | string | length > 0 and matrix_continuwuity_config_recaptcha_private_site_key | string | length > 0 }}"
+
 matrix_continuwuity_client_api_url_endpoint_public: "{{ 'https' if matrix_playbook_ssl_enabled else 'http' }}://{{ matrix_continuwuity_hostname }}/_matrix/client/versions"
 matrix_continuwuity_federation_api_url_endpoint_public: "{{ 'https' if matrix_playbook_ssl_enabled else 'http' }}://{{ matrix_continuwuity_hostname }}:{{ matrix_federation_public_port }}/_matrix/federation/v1/version"