Merge branch 'spantaleev:master' into polychat-appservice

CHANGELOG.md

@@ -1,3 +1,14 @@
+# 2024-01-31
+
+## (Backward-compatibility break) Minor changes necessary for some people serving a static website at the base domain
+
+This only affects people who are [Serving a static website at the base domain](./docs/configuring-playbook-base-domain-serving.md#serving-a-static-website-at-the-base-domain), but not managing its `index.html` through the playbook.
+
+That is, for people who have `matrix_static_files_file_index_html_enabled: false` in their `vars.yml` configuration, the playbook has a new default behavior. Since the playbook is not managing the `index.html` file, it will default to a more sensible way of handling the base domain  - redirecting `https://DOMAIN/` to `https://matrix.DOMAIN/`, instead of serving a 404 page.
+
+If you are managing your static website by yourself (by dropping files into `/matrix/static-files/public` somehow), then you probably don't wish for such redirection to happen. You can disable it by adding `matrix_static_files_container_labels_base_domain_root_path_redirection_enabled: false` to your `vars.yml` configuration file.
+
+
 # 2024-01-20
 
 ## Support for more efficient (specialized) Synapse workers

docs/configuring-playbook-base-domain-serving.md

@@ -42,6 +42,10 @@ matrix_static_files_container_labels_base_domain_enabled: true
 
 # Prevent the default index.html file from being installed
 matrix_static_files_file_index_html_enabled: false
+
+# Disable the automatic redirectin of `https://DOMAIN/` to `https://matrix.DOMAIN/`.
+# This gets automatically enabled when you disable `matrix_static_files_file_index_html_enabled`, as we're doing above.
+matrix_static_files_container_labels_base_domain_root_path_redirection_enabled: false
 ```
 
 With this configuration, Ansible will no longer mess around with the `/matrix/static-files/public/index.html` file.

docs/configuring-playbook-bot-matrix-registration-bot.md

@@ -3,8 +3,7 @@
 The playbook can install and configure [matrix-registration-bot](https://github.com/moan0s/matrix-registration-bot) for you.
 
 The bot allows you to easily **create and manage registration tokens** aka. invitation codes.
-It can be used for an invitation-based server,
-where you invite someone by sending them a registration token (loook like this: `rbalQ0zkaDSRQCOp`). They can register as normal but have to provide a valid registration token in a final step of the registration.
+It can be used for an invitation-based server, where you invite someone by sending them a registration token (tokens look like this: `rbalQ0zkaDSRQCOp`). They can register as per normal but have to provide a valid registration token in the final step of the registration process.
 
 See the project's [documentation](https://github.com/moan0s/matrix-registration-bot#supported-commands) to learn what it
 does and why it might be useful to you.

docs/configuring-playbook-bridge-mautrix-whatsapp.md

@@ -24,23 +24,6 @@ matrix_mautrix_whatsapp_bridge_relay_admin_only: false
 If you want to activate the relay bot in a room, use `!wa set-relay`.
 Use `!wa unset-relay` to deactivate.
 
-## Enable backfilling history
-This requires a server with MSC2716 support, which is currently an experimental feature in synapse.
-Note that as of Synapse 1.46, there are still some bugs with the implementation, especially if using event persistence workers.
-Use the following playbook configuration:
-
-```yaml
-matrix_synapse_configuration_extension_yaml: |
-  experimental_features:
-    msc2716_enabled: true
-```
-```yaml
-matrix_mautrix_whatsapp_configuration_extension_yaml:
-  bridge:
-    history_sync:
-      backfill: true
-```
-
 ## Set up Double Puppeting
 
 If you'd like to use [Double Puppeting](https://docs.mau.fi/bridges/general/double-puppeting.html) (hint: you most likely do), you have 2 ways of going about it.

docs/configuring-playbook-own-webserver.md

@@ -169,7 +169,7 @@ devture_traefik_config_entrypoint_web_forwardedHeaders_insecure: true
 # If your reverse-proxy runs on another machine, consider:
 # - using `0.0.0.0:8449`, just `8449` or `SOME_IP_ADDRESS_OF_THIS_MACHINE:8449` below
 # - adjusting `matrix_playbook_public_matrix_federation_api_traefik_entrypoint_config_custom` (below) - removing `insecure: true` and enabling/configuring `trustedIPs`
-matrix_playbook_public_matrix_federation_api_traefik_entrypoint_host_bind_port: 127.0.0.1:8449
+matrix_playbook_public_matrix_federation_api_traefik_entrypoint_host_bind_port: '127.0.0.1:8449'
 
 # Depending on the value of `matrix_playbook_public_matrix_federation_api_traefik_entrypoint_host_bind_port` above,
 # this may need to be reconfigured. See the comments above.

docs/configuring-playbook-traefik.md

@@ -137,3 +137,25 @@ Changing the `url` to one with an `http://` prefix would allow to connect to the
 With these changes, all TCP traffic will be reverse-proxied to the target system. 
 
 **WARNING**: This configuration might lead to problems or need additional steps when a [certbot](https://certbot.eff.org/) behind Traefik also tries to manage [Let's Encrypt](https://letsencrypt.org/) certificates, as Traefik captures all traffic to ```PathPrefix(`/.well-known/acme-challenge/`)```. 
+
+
+## Traefik behind a `proxy_protocol` reverse-proxy
+
+If you run a reverse-proxy which speaks `proxy_protocol`, add the following to your configuration file:
+
+```yaml
+devture_traefik_configuration_extension_yaml: |
+  entryPoints:
+    web-secure:
+      proxyProtocol:
+        trustedIPs:
+          - "127.0.0.1/32"
+          - "<proxy internal IPv4>/32"
+          - "<proxy IPv6>/128"
+    matrix-federation:
+        proxyProtocol:
+          trustedIPs:
+            - "127.0.0.1/32"
+            - "<proxy internal IPv4>/32"
+            - "<proxy IPv6>/128"
+```

docs/configuring-playbook.md

@@ -8,7 +8,7 @@ To configure the playbook, you need to have done the following things:
 
 You can then follow these steps inside the playbook directory:
 
-1. create a directory to hold your configuration (`mkdir inventory/host_vars/matrix.<your-domain>`)
+1. create a directory to hold your configuration (`mkdir -p inventory/host_vars/matrix.<your-domain>`)
 
 1. copy the sample configuration file (`cp examples/vars.yml inventory/host_vars/matrix.<your-domain>/vars.yml`)
 

group_vars/matrix_servers

@@ -3951,7 +3951,7 @@ matrix_synapse_container_manhole_api_host_bind_port: "{{ (matrix_playbook_servic
 
 matrix_synapse_container_network: "{{ matrix_homeserver_container_network }}"
 
-matrix_synapse_container_additional_networks: |
+matrix_synapse_container_additional_networks_auto: |
   {{
     (
       ([matrix_playbook_reverse_proxyable_services_additional_network] if matrix_synapse_container_labels_traefik_enabled and matrix_playbook_reverse_proxyable_services_additional_network else [])
@@ -3979,6 +3979,7 @@ matrix_synapse_container_labels_public_client_root_redirection_url: "{{ (('https
 
 matrix_synapse_container_labels_public_client_synapse_admin_api_enabled: "{{ matrix_synapse_admin_enabled }}"
 
+matrix_synapse_container_labels_public_federation_api_traefik_hostname: "{{ matrix_server_fqn_matrix_federation }}"
 matrix_synapse_container_labels_public_federation_api_traefik_entrypoints: "{{ matrix_federation_traefik_entrypoint_name }}"
 matrix_synapse_container_labels_public_federation_api_traefik_tls: "{{ matrix_federation_traefik_entrypoint_tls }}"
 matrix_synapse_container_labels_public_federation_api_traefik_tls_certResolver: "{{ matrix_synapse_container_labels_traefik_tls_certResolver }}"  # noqa var-naming
@@ -4018,17 +4019,15 @@ matrix_synapse_email_notif_from: "Matrix <{{ exim_relay_sender_address }}>"
 
 matrix_synapse_turn_uris: |
   {{
-    []
-    +
-    [
+    ([
       'turns:' + matrix_server_fqn_matrix + '?transport=udp',
       'turns:' + matrix_server_fqn_matrix + '?transport=tcp',
-    ] if matrix_coturn_enabled and matrix_coturn_tls_enabled else []
+    ] if matrix_coturn_enabled and matrix_coturn_tls_enabled else [])
     +
-    [
+    ([
       'turn:' + matrix_server_fqn_matrix + '?transport=udp',
       'turn:' + matrix_server_fqn_matrix + '?transport=tcp',
-    ] if matrix_coturn_enabled else []
+    ] if matrix_coturn_enabled else [])
   }}
 
 matrix_synapse_turn_shared_secret: "{{ matrix_coturn_turn_static_auth_secret if matrix_coturn_enabled else '' }}"
@@ -4110,7 +4109,7 @@ matrix_synapse_reverse_proxy_companion_enabled: "{{ matrix_synapse_enabled and m
 
 matrix_synapse_reverse_proxy_companion_container_network: "{{ matrix_synapse_container_network }}"
 
-matrix_synapse_reverse_proxy_companion_container_additional_networks: |
+matrix_synapse_reverse_proxy_companion_container_additional_networks_auto: |
   {{
     (
       ([matrix_playbook_reverse_proxyable_services_additional_network] if matrix_synapse_reverse_proxy_companion_container_labels_traefik_enabled and matrix_playbook_reverse_proxyable_services_additional_network else [])
@@ -4338,7 +4337,7 @@ prometheus_gid: "{{ matrix_user_gid }}"
 
 prometheus_container_network: "{{ matrix_monitoring_container_network }}"
 
-prometheus_container_additional_networks: |
+prometheus_container_additional_networks_auto: |
   {{
     (
       ([prometheus_node_exporter_container_network] if prometheus_self_node_scraper_enabled and prometheus_node_exporter_container_network != prometheus_container_network else [])
@@ -4440,10 +4439,10 @@ grafana_base_path: "{{ matrix_base_data_path }}/grafana"
 
 grafana_container_network: "{{ matrix_monitoring_container_network }}"
 
-grafana_container_additional_networks: |
+grafana_container_additional_networks_auto: |
   {{
     (
-      ([matrix_playbook_reverse_proxyable_services_additional_network] if matrix_playbook_reverse_proxyable_services_additional_network else [])
+      ([matrix_playbook_reverse_proxyable_services_additional_network] if matrix_playbook_reverse_proxyable_services_additional_network and grafana_container_labels_traefik_enabled else [])
       +
       ([prometheus_container_network] if prometheus_enabled and prometheus_container_network != grafana_container_network else [])
     ) | unique
@@ -4643,7 +4642,7 @@ matrix_dendrite_federation_enabled: "{{ matrix_homeserver_federation_enabled }}"
 
 matrix_dendrite_container_network: "{{ matrix_homeserver_container_network }}"
 
-matrix_dendrite_container_additional_networks: |
+matrix_dendrite_container_additional_networks_auto: |
   {{
     (
       ([matrix_playbook_reverse_proxyable_services_additional_network] if matrix_dendrite_container_labels_traefik_enabled and matrix_playbook_reverse_proxyable_services_additional_network else [])
@@ -4665,6 +4664,7 @@ matrix_dendrite_container_labels_public_client_synapse_admin_api_enabled: "{{ ma
 matrix_dendrite_container_labels_public_client_root_redirection_enabled: "{{ matrix_dendrite_container_labels_public_client_root_redirection_url != '' }}"
 matrix_dendrite_container_labels_public_client_root_redirection_url: "{{ (('https://' if matrix_playbook_ssl_enabled else 'http://') + matrix_server_fqn_element) if matrix_client_element_enabled else '' }}"
 
+matrix_dendrite_container_labels_public_federation_api_traefik_hostname: "{{ matrix_server_fqn_matrix_federation }}"
 matrix_dendrite_container_labels_public_federation_api_traefik_entrypoints: "{{ matrix_federation_traefik_entrypoint_name }}"
 matrix_dendrite_container_labels_public_federation_api_traefik_tls: "{{ matrix_federation_traefik_entrypoint_tls }}"
 
@@ -4755,6 +4755,7 @@ matrix_conduit_container_labels_traefik_tls_certResolver: "{{ devture_traefik_ce
 matrix_conduit_container_labels_public_client_root_redirection_enabled: "{{ matrix_conduit_container_labels_public_client_root_redirection_url != '' }}"
 matrix_conduit_container_labels_public_client_root_redirection_url: "{{ (('https://' if matrix_playbook_ssl_enabled else 'http://') + matrix_server_fqn_element) if matrix_client_element_enabled else '' }}"
 
+matrix_conduit_container_labels_public_federation_api_traefik_hostname: "{{ matrix_server_fqn_matrix_federation }}"
 matrix_conduit_container_labels_public_federation_api_traefik_entrypoints: "{{ matrix_federation_traefik_entrypoint_name }}"
 matrix_conduit_container_labels_public_federation_api_traefik_tls: "{{ matrix_federation_traefik_entrypoint_tls }}"
 
@@ -4763,17 +4764,15 @@ matrix_conduit_container_labels_internal_client_api_traefik_entrypoints: "{{ mat
 
 matrix_conduit_turn_uris: |
   {{
-    []
-    +
-    [
+    ([
       'turns:' + matrix_server_fqn_matrix + '?transport=udp',
       'turns:' + matrix_server_fqn_matrix + '?transport=tcp',
-    ] if matrix_coturn_enabled and matrix_coturn_tls_enabled else []
+    ] if matrix_coturn_enabled and matrix_coturn_tls_enabled else [])
     +
-    [
+    ([
       'turn:' + matrix_server_fqn_matrix + '?transport=udp',
       'turn:' + matrix_server_fqn_matrix + '?transport=tcp',
-    ] if matrix_coturn_enabled else []
+    ] if matrix_coturn_enabled else [])
   }}
 
 matrix_conduit_turn_secret: "{{ matrix_coturn_turn_static_auth_secret if matrix_coturn_enabled else '' }}"
@@ -4907,6 +4906,10 @@ matrix_static_files_container_labels_well_known_matrix_endpoint_traefik_hostname
 # but we pass the hostname, so that enabling it is easy.
 matrix_static_files_container_labels_base_domain_traefik_hostname: "{{ matrix_domain }}"
 
+# If we're not serving a static webpage, serve a redirect instead of a 404.
+matrix_static_files_container_labels_base_domain_root_path_redirection_enabled: "{{ not matrix_static_files_file_index_html_enabled }}"
+matrix_static_files_container_labels_base_domain_root_path_redirection_url: "https://{{ matrix_server_fqn_matrix }}"
+
 matrix_static_files_file_matrix_client_property_io_element_jitsi_preferred_domain: "{{ matrix_server_fqn_jitsi if jitsi_enabled else '' }}"
 
 matrix_static_files_file_matrix_client_property_org_matrix_msc3575_proxy_url: "{{ matrix_homeserver_sliding_sync_url }}"

requirements.yml

@@ -10,7 +10,7 @@
   version: v0.1.1-3
   name: container_socket_proxy
 - src: git+https://github.com/geerlingguy/ansible-role-docker
-  version: 7.0.2
+  version: 7.1.0
   name: docker
 - src: git+https://github.com/devture/com.devture.ansible.role.docker_sdk_for_python.git
   version: 129c8590e106b83e6f4c259649a613c6279e937a
@@ -22,10 +22,10 @@
   version: v4.97-r0-0-1
   name: exim_relay
 - src: git+https://gitlab.com/etke.cc/roles/grafana.git
-  version: v10.3.1-0
+  version: v10.3.1-2
   name: grafana
 - src: git+https://github.com/mother-of-all-self-hosting/ansible-role-jitsi.git
-  version: v9111-1
+  version: v9220-0
   name: jitsi
 - src: git+https://gitlab.com/etke.cc/roles/ntfy.git
   version: v2.8.0-1
@@ -40,13 +40,13 @@
   version: ff2fd42e1c1a9e28e3312bbd725395f9c2fc7f16
   name: playbook_state_preserver
 - src: git+https://github.com/devture/com.devture.ansible.role.postgres.git
-  version: v16.1-5
+  version: v16.1-6
   name: postgres
 - src: git+https://github.com/devture/com.devture.ansible.role.postgres_backup.git
   version: 7eadc992ca952fc29bf3fab5aa6335fa82ff01e5
   name: postgres_backup
 - src: git+https://github.com/mother-of-all-self-hosting/ansible-role-prometheus.git
-  version: v2.49.1-0
+  version: v2.49.1-2
   name: prometheus
 - src: git+https://github.com/mother-of-all-self-hosting/ansible-role-prometheus-node-exporter.git
   version: v1.7.0-3

roles/custom/matrix-bot-buscarron/defaults/main.yml

@@ -6,7 +6,7 @@
 matrix_bot_buscarron_enabled: true
 
 # renovate: datasource=docker depName=registry.gitlab.com/etke.cc/buscarron
-matrix_bot_buscarron_version: v1.3.1
+matrix_bot_buscarron_version: v1.4.0
 
 # The hostname at which Buscarron is served.
 matrix_bot_buscarron_hostname: ''
@@ -145,9 +145,6 @@ matrix_bot_buscarron_homeserver: ""
 # forms configuration
 matrix_bot_buscarron_forms: []
 
-# Disable encryption
-matrix_bot_buscarron_noencryption: false
-
 # Sentry DSN
 matrix_bot_buscarron_sentry: ''
 
@@ -157,18 +154,6 @@ matrix_bot_buscarron_loglevel: INFO
 # list of spammers with wildcards support, eg: *@spam.com spam@*, spam@spam.com
 matrix_bot_buscarron_spamlist: []
 
-# spam hosts/domains.
-# deprecated, use matrix_bot_buscarron_spamlist
-matrix_bot_buscarron_spam_hosts: []
-
-# spam email addresses
-# deprecated, use matrix_bot_buscarron_spamlist
-matrix_bot_buscarron_spam_emails: []
-
-# spam email localparts
-# deprecated, use matrix_bot_buscarron_spamlist
-matrix_bot_buscarron_spam_localparts: []
-
 # Banlist size
 matrix_bot_buscarron_ban_size: 10000
 

roles/custom/matrix-bot-buscarron/tasks/validate_config.yml

@@ -1,4 +1,15 @@
 ---
+- name: (Deprecation) Catch and report renamed Buscarron settings
+  ansible.builtin.fail:
+    msg: >-
+      Your configuration contains a variable, which now has a different name.
+      Please change your configuration to rename the variable (`{{ item.old }}` -> `{{ item.new }}`).
+  when: "item.old in vars"
+  with_items:
+    - {'old': 'matrix_bot_buscarron_noencryption', 'new': '<removed>'}
+    - {'old': 'matrix_bot_buscarron_spam_hosts', 'new': '<superseded by matrix_bot_buscarron_spamlist>'}
+    - {'old': 'matrix_bot_buscarron_spam_emails', 'new': '<superseded by matrix_bot_buscarron_spamlist>'}
+    - {'old': 'matrix_bot_buscarron_spam_localparts', 'new': '<superseded by matrix_bot_buscarron_spamlist>'}
 
 - name: Fail if required Buscarron settings not defined
   ansible.builtin.fail:

roles/custom/matrix-bot-buscarron/templates/env.j2

@@ -4,9 +4,6 @@ BUSCARRON_HOMESERVER={{ matrix_bot_buscarron_homeserver }}
 BUSCARRON_DB_DSN={{ matrix_bot_buscarron_database_connection_string }}
 BUSCARRON_DB_DIALECT={{ matrix_bot_buscarron_database_dialect }}
 BUSCARRON_SPAMLIST={{ matrix_bot_buscarron_spamlist|join(" ") }}
-BUSCARRON_SPAM_HOSTS={{ matrix_bot_buscarron_spam_hosts|join(" ") }}
-BUSCARRON_SPAM_EMAILS={{ matrix_bot_buscarron_spam_emails|join(" ") }}
-BUSCARRON_SPAM_LOCALPARTS={{ matrix_bot_buscarron_spam_localparts|join(" ") }}
 BUSCARRON_SENTRY={{ matrix_bot_buscarron_sentry }}
 BUSCARRON_LOGLEVEL={{ matrix_bot_buscarron_loglevel }}
 BUSCARRON_BAN_SIZE={{ matrix_bot_buscarron_ban_size }}
@@ -16,17 +13,19 @@ BUSCARRON_PM_FROM={{ matrix_bot_buscarron_pm_from }}
 BUSCARRON_PM_REPLYTO={{ matrix_bot_buscarron_pm_replyto }}
 BUSCARRON_SMTP_FROM={{ matrix_bot_buscarron_smtp_from }}
 BUSCARRON_SMTP_VALIDATION={{ matrix_bot_buscarron_smtp_validation }}
-BUSCARRON_NOENCRYPTION={{ matrix_bot_buscarron_noencryption }}
 BUSCARRON_METRICS_LOGIN={{ matrix_bot_buscarron_metrics_login }}
 BUSCARRON_METRICS_PASSWORD={{ matrix_bot_buscarron_metrics_password }}
 BUSCARRON_METRICS_IPS={{ matrix_bot_buscarron_metrics_ips|default([])|join(" ") }}
 {% set forms = [] %}
 {% for form in matrix_bot_buscarron_forms -%}{{- forms.append(form.name) -}}
 BUSCARRON_{{ form.name|upper }}_ROOM={{ form.room|default('') }}
+BUSCARRON_{{ form.name|upper }}_TEXT={{ form.text|default('') }}
 BUSCARRON_{{ form.name|upper }}_REDIRECT={{ form.redirect|default('') }}
+BUSCARRON_{{ form.name|upper }}_REDIRECT_REJECT={{ form.redirect_reject|default('') }}
 BUSCARRON_{{ form.name|upper }}_HASDOMAIN={{ form.hasdomain|default('') }}
 BUSCARRON_{{ form.name|upper }}_HASEMAIL={{ form.hasemail|default('') }}
 BUSCARRON_{{ form.name|upper }}_RATELIMIT={{ form.ratelimit|default('') }}
+BUSCARRON_{{ form.name|upper }}_RATELIMIT_SHARED={{ form.ratelimit_shared|default(false) }}
 BUSCARRON_{{ form.name|upper }}_EXTENSIONS={{ form.extensions|default('')|join(' ') }}
 BUSCARRON_{{ form.name|upper }}_CONFIRMATION_SUBJECT={{ form.confirmation_subject|default('') }}
 BUSCARRON_{{ form.name|upper }}_CONFIRMATION_BODY={{ form.confirmation_body|default('') }}

roles/custom/matrix-bot-draupnir/defaults/main.yml

@@ -5,7 +5,7 @@
 matrix_bot_draupnir_enabled: true
 
 # renovate: datasource=docker depName=gnuxie/draupnir
-matrix_bot_draupnir_version: "v1.86.0"
+matrix_bot_draupnir_version: "v1.86.1"
 
 matrix_bot_draupnir_container_image_self_build: false
 matrix_bot_draupnir_container_image_self_build_repo: "https://github.com/the-draupnir-project/Draupnir.git"

roles/custom/matrix-bot-honoroit/defaults/main.yml

@@ -21,7 +21,7 @@ matrix_bot_honoroit_docker_repo_version: "{{ matrix_bot_honoroit_version }}"
 matrix_bot_honoroit_docker_src_files_path: "{{ matrix_base_data_path }}/honoroit/docker-src"
 
 # renovate: datasource=docker depName=registry.gitlab.com/etke.cc/honoroit
-matrix_bot_honoroit_version: v0.9.19
+matrix_bot_honoroit_version: v0.9.20
 matrix_bot_honoroit_docker_image: "{{ matrix_bot_honoroit_docker_image_name_prefix }}etke.cc/honoroit:{{ matrix_bot_honoroit_version }}"
 matrix_bot_honoroit_docker_image_name_prefix: "{{ 'localhost/' if matrix_bot_honoroit_container_image_self_build else 'registry.gitlab.com/' }}"
 matrix_bot_honoroit_docker_image_force_pull: "{{ matrix_bot_honoroit_docker_image.endswith(':latest') }}"

roles/custom/matrix-bridge-mautrix-discord/templates/config.yaml.j2

@@ -72,11 +72,14 @@ bridge:
     # Displayname template for Discord users. This is also used as the room name in DMs if private_chat_portal_meta is enabled.
     # Available variables:
     #  {{ '{{.ID}}' }} - Internal user ID
-    #  {{ '{{.Username}}' }} - User's displayname on Discord
+    #  {{ '{{.Username}}' }} - Legacy display/username on Discord
+    #  {{ '{{.GlobalName}}' }} - New displayname on Discord
     #  {{ '{{.Discriminator}}' }} - The 4 numbers after the name on Discord
     #  {{ '{{.Bot}}' }} - Whether the user is a bot
     #  {{ '{{.System}}' }} - Whether the user is an official system user
-    displayname_template: "{{ '{{.Username}} {{if .Bot}} (bot){{end}}' }}"
+    #  {{ '{{.Webhook}}' }} - Whether the user is a webhook and is not an application
+    #  {{ '{{.Application}}' }} - Whether the user is an application
+    displayname_template: "{{ '{{or .GlobalName .Username}}{{if .Bot}} (bot){{end}}' }}"
     # Displayname template for Discord channels (bridged as rooms, or spaces when type=4).
     # Available variables:
     #  {{ '{{.Name}}' }} - Channel name, or user displayname (pre-formatted with displayname_template) in DMs.
@@ -91,7 +94,11 @@ bridge:
     guild_name_template: "{{ '{{.Name}}' }}"
     # Should the bridge explicitly set the avatar and room name for DM portal rooms?
     # This is implicitly enabled in encrypted rooms.
-    private_chat_portal_meta: false
+    # Whether to explicitly set the avatar and room name for private chat portal rooms.
+    # If set to `default`, this will be enabled in encrypted rooms and disabled in unencrypted rooms.
+    # If set to `always`, all DM rooms will have explicit names and avatars set.
+    # If set to `never`, DM rooms will never have names and avatars set.
+    private_chat_portal_meta: default
     portal_message_buffer: 128
     # Number of private channel portals to create on bridge startup.
     # Other portals will be created when receiving messages.
@@ -112,12 +119,59 @@ bridge:
     # Set this to true to tell the bridge to re-send m.bridge events to all rooms on the next run.
     # This field will automatically be changed back to false after it, except if the config file is not writable.
     resend_bridge_info: false
+    # Should incoming custom emoji reactions be bridged as mxc:// URIs?
+    # If set to false, custom emoji reactions will be bridged as the shortcode instead, and the image wont be available.
+    custom_emoji_reactions: true
     # Should the bridge attempt to completely delete portal rooms when a channel is deleted on Discord?
     # If true, the bridge will try to kick Matrix users from the room. Otherwise, the bridge only makes ghosts leave.
     delete_portal_on_channel_delete: false
+    # Should the bridge delete all portal rooms when you leave a guild on Discord?
+    # This only applies if the guild has no other Matrix users on this bridge instance.
+    delete_guild_on_leave: true
     # Whether or not created rooms should have federation enabled.
     # If false, created portal rooms will never be federated.
     federate_rooms: {{ matrix_mautrix_discord_federate_rooms|to_json }}
+    # Prefix messages from webhooks with the profile info? This can be used along with a custom displayname_template
+    # to better handle webhooks that change their name all the time (like ones used by bridges).
+    prefix_webhook_messages: false
+    # Bridge webhook avatars?
+    enable_webhook_avatars: true
+    # Should the bridge upload media to the Discord CDN directly before sending the message when using a user token,
+    # like the official client does? The other option is sending the media in the message send request as a form part
+    # (which is always used by bots and webhooks).
+    use_discord_cdn_upload: true
+    # Should mxc uris copied from Discord be cached?
+    # This can be `never` to never cache, `unencrypted` to only cache unencrypted mxc uris, or `always` to cache everything.
+    # If you have a media repo that generates non-unique mxc uris, you should set this to never.
+    cache_media: unencrypted
+    # Patterns for converting Discord media to custom mxc:// URIs instead of reuploading.
+    # Each of the patterns can be set to null to disable custom URIs for that type of media.
+    # More details can be found at https://docs.mau.fi/bridges/go/discord/direct-media.html
+    media_patterns:
+        # Should custom mxc:// URIs be used instead of reuploading media?
+        enabled: true
+        # Pattern for normal message attachments.
+        attachments: {% raw %}mxc://discord-media.mau.dev/attachments|{{.ChannelID}}|{{.AttachmentID}}|{{.FileName}}{% endraw %}
+        # Pattern for custom emojis.
+        emojis: {% raw %}mxc://discord-media.mau.dev/emojis|{{.ID}}.{{.Ext}}{% endraw %}
+        # Pattern for stickers. Note that animated lottie stickers will not be converted if this is enabled.
+        stickers: {% raw %}mxc://discord-media.mau.dev/stickers|{{.ID}}.{{.Ext}}{% endraw %}
+        # Pattern for static user avatars.
+        avatars: {% raw %}mxc://discord-media.mau.dev/avatars|{{.UserID}}|{{.AvatarID}}.{{.Ext}}{% endraw %}
+    # Settings for converting animated stickers.
+    animated_sticker:
+        # Format to which animated stickers should be converted.
+        # disable - No conversion, send as-is (lottie JSON)
+        # png - converts to non-animated png (fastest)
+        # gif - converts to animated gif
+        # webm - converts to webm video, requires ffmpeg executable with vp9 codec and webm container support
+        # webp - converts to animated webp, requires ffmpeg executable with webp codec/container support
+        target: webp
+        # Arguments for converter. All converters take width and height.
+        args:
+            width: 320
+            height: 320
+            fps: 25 # only for webm, webp and gif (2, 5, 10, 20 or 25 recommended)
     # Servers to always allow double puppeting from
     double_puppet_server_map:
         "{{ matrix_mautrix_discord_homeserver_domain }}": {{ matrix_mautrix_discord_homeserver_address }}
@@ -145,6 +199,30 @@ bridge:
         # Optional extra text sent when joining a management room.
         additional_help: ""
 
+    # Settings for backfilling messages.
+    backfill:
+        # Limits for forward backfilling.
+        forward_limits:
+            # Initial backfill (when creating portal). 0 means backfill is disabled.
+            # A special unlimited value is not supported, you must set a limit. Initial backfill will
+            # fetch all messages first before backfilling anything, so high limits can take a lot of time.
+            initial:
+                dm: 0
+                channel: 0
+                thread: 0
+            # Missed message backfill (on startup).
+            # 0 means backfill is disabled, -1 means fetch all messages since last bridged message.
+            # When using unlimited backfill (-1), messages are backfilled as they are fetched.
+            # With limits, all messages up to the limit are fetched first and backfilled afterwards.
+            missed:
+                dm: 0
+                channel: 0
+                thread: 0
+        # Maximum members in a guild to enable backfilling. Set to -1 to disable limit.
+        # This can be used as a rough heuristic to disable backfilling in channels that are too active.
+        # Currently only applies to missed message backfill.
+        max_guild_members: -1
+
     # End-to-bridge encryption support options.
     #
     # See https://docs.mau.fi/bridges/general/end-to-bridge-encryption.html for more info.

roles/custom/matrix-bridge-mautrix-signal/defaults/main.yml

@@ -9,7 +9,7 @@ matrix_mautrix_signal_container_image_self_build_repo: "https://mau.dev/mautrix/
 matrix_mautrix_signal_container_image_self_build_branch: "{{ 'main' if matrix_mautrix_signal_version == 'latest' else matrix_mautrix_signal_version }}"
 
 # renovate: datasource=docker depName=dock.mau.dev/mautrix/signal
-matrix_mautrix_signal_version: de8c8d97c23dc1982686a698162b45f1f112155b
+matrix_mautrix_signal_version: 103666990f30a692c63dd84a499b0dd390cef8a4
 
 # See: https://mau.dev/mautrix/signal/container_registry
 matrix_mautrix_signal_docker_image: "{{ matrix_mautrix_signal_docker_image_name_prefix }}mautrix/signal:{{ matrix_mautrix_signal_docker_image_tag }}"

roles/custom/matrix-bridge-mautrix-signal/templates/config.yaml.j2

@@ -101,7 +101,7 @@ bridge:
     # {{.UUID}} - The UUID of the Signal user.
     # {{.AboutEmoji}} - The emoji set by the user in their profile.
     # {% endraw %}
-    displayname_template: "{{ '{{.ProfileName}} (Signal)' }}"
+    displayname_template: "{{ '{{or .ProfileName .PhoneNumber "Unknown user"}} (Signal)' }}"
     # Whether to explicitly set the avatar and room name for private chat portal rooms.
     # If set to `default`, this will be enabled in encrypted rooms and disabled in unencrypted rooms.
     # If set to `always`, all DM rooms will have explicit names and avatars set.

roles/custom/matrix-bridge-mautrix-whatsapp/templates/config.yaml.j2

@@ -54,16 +54,17 @@ appservice:
 
     # Whether or not to receive ephemeral events via appservice transactions.
     # Requires MSC2409 support (i.e. Synapse 1.22+).
-    # You should disable bridge -> sync_with_custom_puppets when this is enabled.
-    ephemeral_events: false
+    ephemeral_events: true
+
+    # Should incoming events be handled asynchronously?
+    # This may be necessary for large public instances with lots of messages going through.
+    # However, messages will not be guaranteed to be bridged in the same order they were sent in.
+    async_transactions: false
 
     # Authentication tokens for AS <-> HS communication. Autogenerated; do not modify.
     as_token: "{{ matrix_mautrix_whatsapp_appservice_token }}"
     hs_token: "{{ matrix_mautrix_whatsapp_homeserver_token }}"
 
-# Segment API key to track some events, like provisioning API login and encryption errors.
-segment_key: null
-
 # Prometheus config.
 metrics:
     # Enable prometheus metrics?
@@ -92,7 +93,7 @@ bridge:
     # The following variables are also available, but will cause problems on multi-user instances:
     # {{ '{{.FullName}}' }}  - full name from contact list
     # {{ '{{.FirstName}}' }} - first name from contact list
-    displayname_template: "{{ '{{if .BusinessName}}{{.BusinessName}}{{else if .PushName}}{{.PushName}}{{else}}{{.JID}}{{end}} (WA)' }}"
+    displayname_template: "{{ '{{or .BusinessName .PushName .JID}} (WhatsApp)' }}"
     # Should the bridge create a space for each logged-in user and add bridged rooms to it?
     # Users who logged in before turning this on should run `!wa sync space` to create and fill the space for the first time.
     personal_filtering_spaces: {{ matrix_mautrix_whatsapp_bridge_personal_filtering_spaces | to_json }}
@@ -109,23 +110,38 @@ bridge:
     portal_message_buffer: 128
     # Settings for handling history sync payloads.
     history_sync:
-        # Should the bridge create portals for chats in the history sync payload?
-        create_portals: true
-        # Enable backfilling history sync payloads from WhatsApp using batch sending?
-        # This requires a server with MSC2716 support, which is currently an experimental feature in synapse.
-        # It can be enabled by setting experimental_features -> msc2716_enabled to true in homeserver.yaml.
-        # Note that prior to Synapse 1.49, there were some bugs with the implementation, especially if using event persistence workers.
-        # There are also still some issues in Synapse's federation implementation.
-        backfill: false
-        # Use double puppets for backfilling?
-        # In order to use this, the double puppets must be in the appservice's user ID namespace
-        # (because the bridge can't use the double puppet access token with batch sending).
-        # This only affects double puppets on the local server, double puppets on other servers will never be used.
-        # Doesn't work out of box with this playbook
-        double_puppet_backfill: false
+        # Enable backfilling history sync payloads from WhatsApp?
+        backfill: true
+        # The maximum number of initial conversations that should be synced.
+        # Other conversations will be backfilled on demand when receiving a message or when initiating a direct chat.
+        max_initial_conversations: -1
+        # Maximum number of messages to backfill in each conversation.
+        # Set to -1 to disable limit.
+        message_count: 50
         # Should the bridge request a full sync from the phone when logging in?
         # This bumps the size of history syncs from 3 months to 1 year.
         request_full_sync: false
+        # Configuration parameters that are sent to the phone along with the request full sync flag.
+        # By default (when the values are null or 0), the config isn't sent at all.
+        full_sync_config:
+            # Number of days of history to request.
+            # The limit seems to be around 3 years, but using higher values doesn't break.
+            days_limit: null
+            # This is presumably the maximum size of the transferred history sync blob, which may affect what the phone includes in the blob.
+            size_mb_limit: null
+            # This is presumably the local storage quota, which may affect what the phone includes in the history sync blob.
+            storage_quota_mb: null
+        # If this value is greater than 0, then if the conversation's last message was more than
+        # this number of hours ago, then the conversation will automatically be marked it as read.
+        # Conversations that have a last message that is less than this number of hours ago will
+        # have their unread status synced from WhatsApp.
+        unread_hours_threshold: 0
+
+        ###############################################################################
+        # The settings below are only applicable for backfilling using batch sending, #
+        # which is no longer supported in Synapse.                                    #
+        ###############################################################################
+
         # Settings for media requests. If the media expired, then it will not
         # be on the WA servers.
         # Media can always be requested by reacting with the ♻️ (recycle) emoji.
@@ -142,17 +158,6 @@ bridge:
             # If request_method is "local_time", what time should the requests
             # be sent (in minutes after midnight)?
             request_local_time: 120
-        # The maximum number of initial conversations that should be synced.
-        # Other conversations will be backfilled on demand when the start PM
-        # provisioning endpoint is used or when a message comes in from that
-        # chat.
-        max_initial_conversations: -1
-        # If this value is greater than 0, then if the conversation's last
-        # message was more than this number of hours ago, then the conversation
-        # will automatically be marked it as read.
-        # Conversations that have a last message that is less than this number
-        # of hours ago will have their unread status synced from WhatsApp.
-        unread_hours_threshold: 0
         # Settings for immediate backfills. These backfills should generally be
         # small and their main purpose is to populate each of the initial chats
         # (as configured by max_initial_conversations) with a few messages so
@@ -192,12 +197,11 @@ bridge:
             - start_days_ago: -1
               max_batch_events: 500
               batch_delay: 10
+              
     # Should puppet avatars be fetched from the server even if an avatar is already set?
     user_avatar_sync: true
     # Should Matrix users leaving groups be bridged to WhatsApp?
     bridge_matrix_leave: true
-    # Should the bridge sync with double puppeting to receive EDUs that aren't normally sent to appservices.
-    sync_with_custom_puppets: true
     # Should the bridge update the m.direct account data event when double puppeting is enabled.
     # Note that updating the m.direct event is not atomic (except with mautrix-asmux)
     # and is therefore prone to race conditions.
@@ -210,7 +214,6 @@ bridge:
     # When double puppeting is enabled, users can use `!wa toggle` to change whether
     # presence and read receipts are bridged. These settings set the default values.
     # Existing users won't be affected when these are changed.
-    default_bridge_receipts: true
     default_bridge_presence: true
     # Send the presence as "available" to whatsapp when users start typing on a portal.
     # This works as a workaround for homeservers that do not support presence, and allows
@@ -235,7 +238,7 @@ bridge:
     login_shared_secret_map: {{ matrix_mautrix_whatsapp_bridge_login_shared_secret_map|to_json }}
     # Should the bridge explicitly set the avatar and room name for private chat portal rooms?
     # This is implicitly enabled in encrypted rooms.
-    private_chat_portal_meta: false
+    private_chat_portal_meta: default
     # Should group members be synced in parallel? This makes member sync faster
     parallel_member_sync: false
     # Should Matrix m.notice-type messages be bridged?
@@ -273,10 +276,6 @@ bridge:
     # Whether or not created rooms should have federation enabled.
     # If false, created portal rooms will never be federated.
     federate_rooms: {{ matrix_mautrix_whatsapp_federate_rooms|to_json }}
-    # Whether to enable disappearing messages in groups. If enabled, then the expiration time of
-    # the messages will be determined by the first user to read the message, rather than individually.
-    # If the bridge only has a single user, this can be turned on safely.
-    disappearing_messages_in_groups: false
     # Should the bridge never send alerts to the bridge management room?
     # These are mostly things like the user being logged out.
     disable_bridge_alerts: false
@@ -290,11 +289,15 @@ bridge:
     # Send captions in the same message as images. This will send data compatible with both MSC2530 and MSC3552.
     # This is currently not supported in most clients.
     caption_in_message: false
+    # Send galleries as a single event? This is not an MSC (yet).
+    beeper_galleries: false
     # Should polls be sent using MSC3381 event types?
     extev_polls: false
-    # Should Matrix edits be bridged to WhatsApp edits?
-    # Official WhatsApp clients don't render edits yet, but once they do, the bridge should work with them right away.
-    send_whatsapp_edits: false
+    # Should cross-chat replies from WhatsApp be bridged? Most servers and clients don't support this.
+    cross_room_replies: false
+    # Disable generating reply fallbacks? Some extremely bad clients still rely on them,
+    # but they're being phased out and will be completely removed in the future.
+    disable_reply_fallbacks: false
     # Maximum time for handling Matrix events. Duration strings formatted for https://pkg.go.dev/time#ParseDuration
     # Null means there's no enforced timeout.
     message_handling_timeout:
@@ -338,7 +341,30 @@ bridge:
         # Enable key sharing? If enabled, key requests for rooms where users are in will be fulfilled.
         # You must use a client that supports requesting keys from other users to use this feature.
         allow_key_sharing: {{ matrix_mautrix_whatsapp_bridge_encryption_key_sharing_allow|to_json }}
-                # What level of device verification should be required from users?
+        # Should users mentions be in the event wire content to enable the server to send push notifications?
+        plaintext_mentions: false
+        # Options for deleting megolm sessions from the bridge.
+        delete_keys:
+            # Beeper-specific: delete outbound sessions when hungryserv confirms
+            # that the user has uploaded the key to key backup.
+            delete_outbound_on_ack: false
+            # Don't store outbound sessions in the inbound table.
+            dont_store_outbound: false
+            # Ratchet megolm sessions forward after decrypting messages.
+            ratchet_on_decrypt: false
+            # Delete fully used keys (index >= max_messages) after decrypting messages.
+            delete_fully_used_on_decrypt: false
+            # Delete previous megolm sessions from same device when receiving a new one.
+            delete_prev_on_new_session: false
+            # Delete megolm sessions received from a device when the device is deleted.
+            delete_on_device_delete: false
+            # Periodically delete megolm sessions when 2x max_age has passed since receiving the session.
+            periodically_delete_expired: false
+            # Delete inbound megolm sessions that don't have the received_at field used for
+            # automatic ratcheting and expired session deletion. This is meant as a migration
+            # to delete old keys prior to the bridge update.
+            delete_outdated_inbound: false                
+        # What level of device verification should be required from users?
         #
         # Valid levels:
         #   unverified - Send keys to all device in the room.
@@ -373,6 +399,10 @@ bridge:
             # default.
             messages: 100
 
+            # Disable rotating keys when a user's devices change?
+            # You should not enable this option unless you understand all the implications.
+            disable_device_change_key_rotation: false
+
     # Settings for provisioning API
     provisioning:
         # Prefix for the provisioning API paths.

roles/custom/matrix-client-element/defaults/main.yml

@@ -11,7 +11,7 @@ matrix_client_element_container_image_self_build_repo: "https://github.com/eleme
 matrix_client_element_container_image_self_build_low_memory_system_patch_enabled: "{{ ansible_memtotal_mb < 4096 }}"
 
 # renovate: datasource=docker depName=vectorim/element-web
-matrix_client_element_version: v1.11.55
+matrix_client_element_version: v1.11.57
 
 matrix_client_element_docker_image: "{{ matrix_client_element_docker_image_name_prefix }}vectorim/element-web:{{ matrix_client_element_version }}"
 matrix_client_element_docker_image_name_prefix: "{{ 'localhost/' if matrix_client_element_container_image_self_build else matrix_container_global_registry_prefix }}"

roles/custom/matrix-dendrite/defaults/main.yml

@@ -13,7 +13,7 @@ matrix_dendrite_docker_image_path: "matrixdotorg/dendrite-monolith"
 matrix_dendrite_docker_image: "{{ matrix_dendrite_docker_image_name_prefix }}{{ matrix_dendrite_docker_image_path }}:{{ matrix_dendrite_docker_image_tag }}"
 matrix_dendrite_docker_image_name_prefix: "{{ 'localhost/' if matrix_dendrite_container_image_self_build else matrix_container_global_registry_prefix }}"
 # renovate: datasource=docker depName=matrixdotorg/dendrite-monolith
-matrix_dendrite_docker_image_tag: "v0.13.5"
+matrix_dendrite_docker_image_tag: "v0.13.6"
 matrix_dendrite_docker_image_force_pull: "{{ matrix_dendrite_docker_image.endswith(':latest') }}"
 
 matrix_dendrite_base_path: "{{ matrix_base_data_path }}/dendrite"
@@ -48,7 +48,9 @@ matrix_dendrite_container_network: ""
 # A list of additional container networks that the container would be connected to.
 # The role does not create these networks, so make sure they already exist.
 # Use this to expose this container to another reverse proxy, which runs in a different container network.
-matrix_dendrite_container_additional_networks: []
+matrix_dendrite_container_additional_networks: "{{ matrix_dendrite_container_additional_networks_auto + matrix_dendrite_container_additional_networks_custom }}"
+matrix_dendrite_container_additional_networks_auto: []
+matrix_dendrite_container_additional_networks_custom: []
 
 # Controls whether the matrix-dendrite container exposes the HTTP port (tcp/{{ matrix_dendrite_http_bind_port }} in the container).
 #

roles/custom/matrix-static-files/defaults/main.yml

@@ -81,6 +81,9 @@ matrix_static_files_container_labels_base_domain_traefik_priority: 0
 matrix_static_files_container_labels_base_domain_traefik_entrypoints: "{{ matrix_static_files_container_labels_traefik_entrypoints }}"
 matrix_static_files_container_labels_base_domain_traefik_tls: "{{ matrix_static_files_container_labels_base_domain_traefik_entrypoints != 'web' }}"
 matrix_static_files_container_labels_base_domain_traefik_tls_certResolver: "{{ matrix_static_files_container_labels_traefik_tls_certResolver }}"  # noqa var-naming
+# Controls whether the root path (/) at the base domain would respond with a redirect to some URL.
+matrix_static_files_container_labels_base_domain_root_path_redirection_enabled: false
+matrix_static_files_container_labels_base_domain_root_path_redirection_url: ""
 
 # matrix_static_files_container_labels_additional_labels contains a multiline string with additional labels to add to the container label file.
 # See `../templates/labels.j2` for details.
@@ -343,6 +346,9 @@ matrix_static_files_file_matrix_support_configuration: "{{ matrix_static_files_f
 #
 # You can also use the auxiliary role (https://github.com/mother-of-all-self-hosting/ansible-role-aux) to create files in
 # the public directory (matrix_static_files_public_path) by yourself.
+# If you're disabling this but are preparing some HTML files by yourself,
+# consider explicitly disabling `matrix_static_files_container_labels_base_domain_root_path_redirection_enabled` as well.
+# The default behavior when this is disabled is to enable root-path-redirection.
 #
 # Because you may wish to manage these static files yourself, disabling this variable will intentionally not delete an already existing `index.html` file.
 matrix_static_files_file_index_html_enabled: "{{ matrix_static_files_container_labels_base_domain_enabled }}"

roles/custom/matrix-static-files/tasks/validate_config.yml

@@ -11,3 +11,5 @@
 
     - {'name': 'matrix_static_files_container_labels_base_domain_traefik_hostname', when: "{{ matrix_static_files_container_labels_base_domain_enabled }}"}
     - {'name': 'matrix_static_files_container_labels_base_domain_traefik_path_prefix', when: "{{ matrix_static_files_container_labels_base_domain_enabled }}"}
+
+    - {'name': 'matrix_static_files_container_labels_base_domain_root_path_redirection_url', when: "{{ matrix_static_files_container_labels_base_domain_enabled and matrix_static_files_container_labels_base_domain_root_path_redirection_enabled }}"}

roles/custom/matrix-static-files/templates/labels.j2

@@ -56,12 +56,24 @@ traefik.http.routers.{{ matrix_static_files_identifier }}-well-known.tls.certRes
 #                                                          #
 ############################################################
 
+{% set middlewares = [] %}
+
+{% if matrix_static_files_container_labels_base_domain_root_path_redirection_enabled %}
+traefik.http.middlewares.{{ matrix_static_files_identifier }}-root-path-redirect.redirectregex.regex=^https://{{ matrix_static_files_container_labels_base_domain_traefik_hostname }}{{ matrix_static_files_container_labels_base_domain_traefik_path_prefix }}$
+traefik.http.middlewares.{{ matrix_static_files_identifier }}-root-path-redirect.redirectregex.replacement={{ matrix_static_files_container_labels_base_domain_root_path_redirection_url }}
+{% set middlewares = middlewares + [matrix_static_files_identifier + '-root-path-redirect'] %}
+{% endif %}
+
 traefik.http.routers.{{ matrix_static_files_identifier }}-base-domain.rule={{ matrix_static_files_container_labels_base_domain_traefik_rule }}
 
 {% if matrix_static_files_container_labels_base_domain_traefik_priority | int > 0 %}
 traefik.http.routers.{{ matrix_static_files_identifier }}-base-domain.priority={{ matrix_static_files_container_labels_base_domain_traefik_priority }}
 {% endif %}
 
+{% if middlewares | length > 0 %}
+traefik.http.routers.{{ matrix_static_files_identifier }}-base-domain.middlewares={{ middlewares | join(',') }}
+{% endif %}
+
 traefik.http.routers.{{ matrix_static_files_identifier }}-base-domain.service={{ matrix_static_files_identifier }}
 traefik.http.routers.{{ matrix_static_files_identifier }}-base-domain.entrypoints={{ matrix_static_files_container_labels_base_domain_traefik_entrypoints }}
 traefik.http.routers.{{ matrix_static_files_identifier }}-base-domain.tls={{ matrix_static_files_container_labels_base_domain_traefik_tls | to_json }}

roles/custom/matrix-synapse-admin/defaults/main.yml

@@ -12,7 +12,7 @@ matrix_synapse_admin_container_image_self_build: false
 matrix_synapse_admin_container_image_self_build_repo: "https://github.com/Awesome-Technologies/synapse-admin.git"
 
 # renovate: datasource=docker depName=awesometechnologies/synapse-admin
-matrix_synapse_admin_version: 0.8.7
+matrix_synapse_admin_version: 0.9.1
 matrix_synapse_admin_docker_image: "{{ matrix_synapse_admin_docker_image_name_prefix }}awesometechnologies/synapse-admin:{{ matrix_synapse_admin_version }}"
 matrix_synapse_admin_docker_image_name_prefix: "{{ 'localhost/' if matrix_synapse_admin_container_image_self_build else matrix_container_global_registry_prefix }}"
 matrix_synapse_admin_docker_image_force_pull: "{{ matrix_synapse_admin_docker_image.endswith(':latest') }}"

roles/custom/matrix-synapse-reverse-proxy-companion/defaults/main.yml

@@ -35,7 +35,9 @@ matrix_synapse_reverse_proxy_companion_container_network: ""
 
 # A list of additional container networks that matrix-synapse-reverse-proxy-companion would be connected to.
 # The playbook does not create these networks, so make sure they already exist.
-matrix_synapse_reverse_proxy_companion_container_additional_networks: []
+matrix_synapse_reverse_proxy_companion_container_additional_networks: "{{ matrix_synapse_reverse_proxy_companion_container_additional_networks_auto + matrix_synapse_reverse_proxy_companion_container_additional_networks_custom }}"
+matrix_synapse_reverse_proxy_companion_container_additional_networks_auto: []
+matrix_synapse_reverse_proxy_companion_container_additional_networks_custom: []
 
 # Controls whether the matrix-synapse-reverse-proxy-companion container exposes its HTTP Client-Server API port (tcp/8008 in the container).
 #
@@ -116,6 +118,20 @@ matrix_synapse_reverse_proxy_companion_container_labels_public_federation_api_tr
 #   another.label="here"
 matrix_synapse_reverse_proxy_companion_container_labels_additional_labels: ''
 
+# A list of extra arguments to pass to the container
+# Also see `matrix_synapse_reverse_proxy_companion_container_arguments`
+matrix_synapse_reverse_proxy_companion_container_extra_arguments: []
+
+# matrix_synapse_reverse_proxy_companion_container_extra_arguments_auto is a list of extra arguments to pass to the container.
+# This list is managed by the playbook. You're not meant to override this variable.
+# If you'd like to inject your own arguments, see `matrix_synapse_reverse_proxy_companion_container_extra_arguments`.
+matrix_synapse_reverse_proxy_companion_container_extra_arguments_auto: []
+
+# matrix_synapse_reverse_proxy_companion_container_arguments holds the final list of extra arguments to pass to the container.
+# You're not meant to override this variable.
+# If you'd like to inject your own arguments, see `matrix_synapse_reverse_proxy_companion_container_extra_arguments`.
+matrix_synapse_reverse_proxy_companion_container_arguments: "{{ matrix_synapse_reverse_proxy_companion_container_extra_arguments + matrix_synapse_reverse_proxy_companion_container_extra_arguments_auto }}"
+
 # The amount of worker processes and connections
 # Consider increasing these when you are expecting high amounts of traffic
 # http://nginx.org/en/docs/ngx_core_module.html#worker_connections

roles/custom/matrix-synapse-reverse-proxy-companion/templates/systemd/matrix-synapse-reverse-proxy-companion.service.j2

@@ -37,6 +37,9 @@ ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} create \
 			--mount type=bind,src={{ matrix_synapse_reverse_proxy_companion_base_path }}/nginx.conf,dst=/etc/nginx/nginx.conf,ro \
 			--mount type=bind,src={{ matrix_synapse_reverse_proxy_companion_confd_path }},dst=/etc/nginx/conf.d,ro \
 			--label-file={{ matrix_synapse_reverse_proxy_companion_base_path }}/labels \
+			{% for arg in matrix_synapse_reverse_proxy_companion_container_arguments %}
+			{{ arg }} \
+			{% endfor %}
 			{{ matrix_synapse_reverse_proxy_companion_container_image }}
 
 {% for network in matrix_synapse_reverse_proxy_companion_container_additional_networks %}

roles/custom/matrix-synapse/defaults/main.yml

@@ -16,7 +16,7 @@ matrix_synapse_enabled: true
 matrix_synapse_github_org_and_repo: element-hq/synapse
 
 # renovate: datasource=docker depName=ghcr.io/element-hq/synapse
-matrix_synapse_version: v1.99.0
+matrix_synapse_version: v1.100.0
 
 matrix_synapse_username: ''
 matrix_synapse_uid: ''
@@ -132,7 +132,9 @@ matrix_synapse_container_network: ''
 # A list of additional container networks that the container would be connected to.
 # The role does not create these networks, so make sure they already exist.
 # Use this to expose this container to another reverse proxy, which runs in a different container network.
-matrix_synapse_container_additional_networks: []
+matrix_synapse_container_additional_networks: "{{ matrix_synapse_container_additional_networks_auto + matrix_synapse_container_additional_networks_custom }}"
+matrix_synapse_container_additional_networks_auto: []
+matrix_synapse_container_additional_networks_custom: []
 
 # Controls whether the matrix-synapse container exposes the Client/Server API port (tcp/{{ matrix_synapse_container_client_api_port }} in the container).
 #
@@ -251,7 +253,7 @@ matrix_synapse_container_labels_public_client_synapse_admin_api_traefik_tls_cert
 # Controls whether labels will be added that expose the Server-Server API (Federation API).
 # Regardless of whether this is enabled, it may or may not take effect due to the value of other variables.
 # See `matrix_synapse_container_labels_traefik_enabled` or `matrix_synapse_container_labels_matrix_related_labels_enabled`
-matrix_synapse_container_labels_public_federation_api_enabled: "{{ matrix_synapse_federation_enabled and matrix_synapse_federation_port_enabled and not matrix_synapse_workers_enabled }}"
+matrix_synapse_container_labels_public_federation_api_enabled: "{{ matrix_synapse_federation_port_enabled }}"
 matrix_synapse_container_labels_public_federation_api_traefik_hostname: "{{ matrix_synapse_container_labels_traefik_hostname }}"
 matrix_synapse_container_labels_public_federation_api_traefik_path_prefix: /_matrix
 matrix_synapse_container_labels_public_federation_api_traefik_rule: "Host(`{{ matrix_synapse_container_labels_public_federation_api_traefik_hostname }}`) && PathPrefix(`{{ matrix_synapse_container_labels_public_federation_api_traefik_path_prefix }}`)"
@@ -296,6 +298,10 @@ matrix_synapse_container_extra_arguments_auto: []
 # If you'd like to inject your own arguments, see `matrix_synapse_container_extra_arguments`.
 matrix_synapse_container_arguments: "{{ matrix_synapse_container_extra_arguments + matrix_synapse_container_extra_arguments_auto }}"
 
+# matrix_synapse_container_master_extra_arguments contains arguments specific to the master process whereas
+# matrix_synapse_container_arguments contains arguments the apply to all Synapse containers (master and worker).
+matrix_synapse_container_master_extra_arguments: []
+
 # List of systemd services that matrix-synapse.service depends on
 matrix_synapse_systemd_required_services_list: "{{ matrix_synapse_systemd_required_services_list_default + matrix_synapse_systemd_required_services_list_auto + matrix_synapse_systemd_required_services_list_custom }}"
 matrix_synapse_systemd_required_services_list_default: ['docker.service']
@@ -746,7 +752,7 @@ matrix_synapse_worker_container_labels_traefik_hostname: "{{ matrix_synapse_cont
 # Controls whether labels will be added that expose metrics (see `matrix_synapse_metrics_proxying_enabled`)
 matrix_synapse_worker_container_labels_public_metrics_enabled: "{{ matrix_synapse_metrics_enabled and matrix_synapse_metrics_proxying_enabled }}"
 # The `__WORKER_ID__` placeholder will be replaced with the actual worker id during label-file generation (see `../templates/worker-labels.j2`).
-matrix_synapse_worker_container_labels_public_metrics_traefik_path: "{{ matrix_synapse_metrics_proxying_path_prefix }}/__WORKER_ID__"
+matrix_synapse_worker_container_labels_public_metrics_traefik_path: "{{ matrix_synapse_metrics_proxying_path_prefix }}/worker/__WORKER_ID__"
 matrix_synapse_worker_container_labels_public_metrics_traefik_rule: "Host(`{{ matrix_synapse_metrics_proxying_hostname }}`) && Path(`{{ matrix_synapse_worker_container_labels_public_metrics_traefik_path }}`)"
 matrix_synapse_worker_container_labels_public_metrics_traefik_priority: 0
 matrix_synapse_worker_container_labels_public_metrics_traefik_entrypoints: "{{ matrix_synapse_container_labels_traefik_entrypoints }}"
@@ -769,26 +775,31 @@ matrix_synapse_worker_container_labels_additional_labels: ''
 matrix_synapse_workers_room_workers_count: "{{ matrix_synapse_workers_presets[matrix_synapse_workers_preset]['room_workers_count'] }}"
 matrix_synapse_workers_room_workers_port_range_start: 28111
 matrix_synapse_workers_room_workers_metrics_range_start: 29111
+matrix_synapse_workers_room_workers_container_arguments: []
 
 # Sync workers
 matrix_synapse_workers_sync_workers_count: "{{ matrix_synapse_workers_presets[matrix_synapse_workers_preset]['sync_workers_count'] }}"
 matrix_synapse_workers_sync_workers_port_range_start: 28211
 matrix_synapse_workers_sync_workers_metrics_range_start: 29211
+matrix_synapse_workers_sync_workers_container_arguments: []
 
 # Client reader workers
 matrix_synapse_workers_client_reader_workers_count: "{{ matrix_synapse_workers_presets[matrix_synapse_workers_preset]['client_reader_workers_count'] }}"
 matrix_synapse_workers_client_reader_workers_port_range_start: 28311
 matrix_synapse_workers_client_reader_workers_metrics_range_start: 29311
+matrix_synapse_workers_client_reader_workers_container_arguments: []
 
 # Federation reader workers
 matrix_synapse_workers_federation_reader_workers_count: "{{ matrix_synapse_workers_presets[matrix_synapse_workers_preset]['federation_reader_workers_count'] }}"
 matrix_synapse_workers_federation_reader_workers_port_range_start: 28411
 matrix_synapse_workers_federation_reader_workers_metrics_range_start: 29411
+matrix_synapse_workers_federation_reader_workers_container_arguments: []
 
 # Generic workers
 matrix_synapse_workers_generic_workers_count: "{{ matrix_synapse_workers_presets[matrix_synapse_workers_preset]['generic_workers_count'] }}"
 matrix_synapse_workers_generic_workers_port_range_start: 18111
 matrix_synapse_workers_generic_workers_metrics_range_start: 19111
+matrix_synapse_workers_generic_workers_container_arguments: []
 
 # matrix_synapse_workers_stream_writer_events_stream_workers_count controls how many stream writers that handle the `events` stream to spawn.
 # More than 1 worker is also supported of this type.
@@ -833,6 +844,8 @@ matrix_synapse_workers_stream_writers: |
     ([{'stream': 'presence'}] * matrix_synapse_workers_stream_writer_presence_stream_workers_count | int)
   }}
 
+matrix_synapse_workers_stream_writers_container_arguments: []
+
 # matrix_synapse_stream_writers populates the `stream_writers` Synapse configuration used when Synapse workers are in use (`matrix_synapse_workers_enabled`).
 # What you see below is an initial default value which will be adjusted at runtime based on the value of `matrix_synapse_workers_stream_writers`.
 # Adjusting this value manually is generally not necessary.
@@ -859,6 +872,7 @@ matrix_synapse_workers_stream_writer_workers_metrics_range_start: 19211
 # See https://matrix-org.github.io/synapse/latest/workers.html#synapseapppusher
 matrix_synapse_workers_pusher_workers_count: "{{ matrix_synapse_workers_presets[matrix_synapse_workers_preset]['pusher_workers_count'] }}"
 matrix_synapse_workers_pusher_workers_metrics_range_start: 19200
+matrix_synapse_workers_pusher_workers_container_arguments: []
 
 # matrix_synapse_federation_pusher_instances populates the `pusher_instances` Synapse configuration used when Synapse workers are in use (`matrix_synapse_workers_enabled`).
 # What you see below is an initial default value which will be adjusted at runtime based on the value of `matrix_synapse_workers_pusher_workers_count` or `matrix_synapse_workers_enabled_list`.
@@ -869,6 +883,7 @@ matrix_synapse_federation_pusher_instances: []
 # See https://matrix-org.github.io/synapse/latest/workers.html#synapseappfederation_sender
 matrix_synapse_workers_federation_sender_workers_count: "{{ matrix_synapse_workers_presets[matrix_synapse_workers_preset]['federation_sender_workers_count'] }}"
 matrix_synapse_workers_federation_sender_workers_metrics_range_start: 19400
+matrix_synapse_workers_federation_sender_workers_container_arguments: []
 
 # matrix_synapse_federation_sender_instances populates the `federation_sender_instances` Synapse configuration used when Synapse workers are in use (`matrix_synapse_workers_enabled`).
 # What you see below is an initial default value which will be adjusted at runtime based on the value of `matrix_synapse_workers_federation_sender_workers_count` or `matrix_synapse_workers_enabled_list`.
@@ -878,6 +893,7 @@ matrix_synapse_federation_sender_instances: []
 matrix_synapse_workers_media_repository_workers_count: "{{ matrix_synapse_workers_presets[matrix_synapse_workers_preset]['media_repository_workers_count'] if not matrix_synapse_ext_media_repo_enabled else 0 }}"
 matrix_synapse_workers_media_repository_workers_port_range_start: 18551
 matrix_synapse_workers_media_repository_workers_metrics_range_start: 19551
+matrix_synapse_workers_media_repository_workers_container_arguments: []
 
 # matrix_synapse_enable_media_repo controls if the main Synapse process should serve media repository endpoints or if it should be left to media_repository workers (see `matrix_synapse_workers_media_repository_workers_count`).
 # This is enabled if workers are disabled, or if they are enabled, but there are no media repository workers.
@@ -894,6 +910,7 @@ matrix_synapse_media_instance_running_background_jobs: "{{ (matrix_synapse_worke
 # Our implementation uses generic worker services and assigns them to perform appservice work using the `notify_appservices_from_worker` Synapse option.
 matrix_synapse_workers_appservice_workers_count: "{{ matrix_synapse_workers_presets[matrix_synapse_workers_preset]['appservice_workers_count'] }}"
 matrix_synapse_workers_appservice_workers_metrics_range_start: 19300
+matrix_synapse_workers_appservice_workers_container_arguments: []
 
 # matrix_synapse_notify_appservices_from_worker populates the `notify_appservices_from_worker` Synapse configuration used when Synapse workers are in use (`matrix_synapse_workers_enabled`).
 # `notify_appservices_from_worker` is meant to point to a worker, which is dedicated to sending output traffic to Application Services.
@@ -905,6 +922,7 @@ matrix_synapse_notify_appservices_from_worker: "{{ (matrix_synapse_workers_enabl
 matrix_synapse_workers_user_dir_workers_count: "{{ matrix_synapse_workers_presets[matrix_synapse_workers_preset]['user_dir_workers_count'] }}"
 matrix_synapse_workers_user_dir_workers_port_range_start: 18661
 matrix_synapse_workers_user_dir_workers_metrics_range_start: 19661
+matrix_synapse_workers_user_dir_workers_container_arguments: []
 
 # matrix_synapse_update_user_directory_from_worker populates the `update_user_directory_from_worker` Synapse configuration used when Synapse workers are in use (`matrix_synapse_workers_enabled`).
 # `update_user_directory_from_worker` is meant to point to a worker, which is dedicated to updating the user directory and servicing some user directory URL endpoints (`matrix_synapse_workers_user_dir_worker_client_server_endpoints`).
@@ -914,6 +932,7 @@ matrix_synapse_update_user_directory_from_worker: "{{ (matrix_synapse_workers_en
 # Our implementation uses a generic worker and assigns Synapse to perform background work on this worker using the `run_background_tasks_on` Synapse option.
 matrix_synapse_workers_background_workers_count: "{{ matrix_synapse_workers_presets[matrix_synapse_workers_preset]['background_workers_count'] }}"
 matrix_synapse_workers_background_workers_metrics_range_start: 19700
+matrix_synapse_workers_background_workers_container_arguments: []
 
 # matrix_synapse_run_background_tasks_on populates the `run_background_tasks_on` Synapse configuration used when Synapse workers are in use (`matrix_synapse_workers_enabled`).
 # `run_background_tasks_on` is meant to point to a worker, which is dedicated to processing background tasks.

roles/custom/matrix-synapse/tasks/rust-synapse-compress-state/compress_room.yml

@@ -9,7 +9,7 @@
       {{ devture_systemd_docker_base_host_command_docker }} run --rm --name matrix-rust-synapse-compress-state-compress-room
       --user={{ matrix_synapse_uid }}:{{ matrix_synapse_gid }}
       --cap-drop=ALL
-      --network={{ matrix_synapse_container_network }}
+      --network={{ devture_postgres_container_network }}
       --mount type=bind,src={{ matrix_synapse_rust_synapse_compress_state_base_path }},dst=/work
       {{ matrix_synapse_rust_synapse_compress_state_docker_image }}
       {{ matrix_synapse_rust_synapse_compress_state_synapse_compress_state_in_container_path }} -t -o /work/state-compressor.sql

roles/custom/matrix-synapse/tasks/synapse/workers/util/setup_files_for_worker.yml

@@ -3,6 +3,7 @@
 - ansible.builtin.set_fact:
     matrix_synapse_worker_systemd_service_name: "{{ matrix_synapse_worker_details.name }}"
     matrix_synapse_worker_container_name: "{{ matrix_synapse_worker_details.name }}"
+    matrix_synapse_worker_type: "{{ matrix_synapse_worker_details.type }}"
     matrix_synapse_worker_config_file_name: "worker.{{ matrix_synapse_worker_details.name }}.yaml"
     matrix_synapse_worker_labels_file_name: "worker.{{ matrix_synapse_worker_details.name }}.labels"
 

roles/custom/matrix-synapse/templates/synapse/ext/s3-storage-provider/bin/migrate.j2

@@ -1,7 +1,9 @@
 #jinja2: lstrip_blocks: "True"
 #!/bin/bash
+set -euo pipefail
 
-{{ devture_systemd_docker_base_host_command_docker }} run \
+container_id=$(\
+	{{ devture_systemd_docker_base_host_command_docker }} create \
 	--rm \
 	--env-file={{ matrix_synapse_ext_s3_storage_provider_base_path }}/env \
 	--mount type=bind,src={{ matrix_synapse_storage_path }},dst=/matrix-media-store-parent,bind-propagation=slave \
@@ -10,4 +12,12 @@
 	--network={{ matrix_synapse_container_network }} \
 	--entrypoint=/bin/bash \
 	{{ matrix_synapse_docker_image_final }} \
-	-c 's3_media_upload update-db $UPDATE_DB_DURATION && s3_media_upload --no-progress check-deleted $MEDIA_PATH && s3_media_upload --no-progress upload $MEDIA_PATH $BUCKET --delete --storage-class $STORAGE_CLASS --endpoint-url $ENDPOINT {% if matrix_synapse_ext_synapse_s3_storage_provider_config_sse_customer_enabled %}--sse-customer-algo $SSE_CUSTOMER_ALGO --sse-customer-key $SSE_CUSTOMER_KEY{% endif %}'
+	-c 's3_media_upload update-db $UPDATE_DB_DURATION && s3_media_upload --no-progress check-deleted $MEDIA_PATH && s3_media_upload --no-progress upload $MEDIA_PATH $BUCKET --delete --storage-class $STORAGE_CLASS --endpoint-url $ENDPOINT {% if matrix_synapse_ext_synapse_s3_storage_provider_config_sse_customer_enabled %}--sse-customer-algo $SSE_CUSTOMER_ALGO --sse-customer-key $SSE_CUSTOMER_KEY{% endif %}' \
+)
+
+{# We need to connect to the Postgres network, which should be in this list. #}
+{% for network in matrix_synapse_container_additional_networks %}
+{{ devture_systemd_docker_base_host_command_docker }} network connect {{ network }} $container_id
+{% endfor %}
+
+{{ devture_systemd_docker_base_host_command_docker }} start --attach $container_id

roles/custom/matrix-synapse/templates/synapse/ext/s3-storage-provider/bin/shell.j2

@@ -1,13 +1,24 @@
 #jinja2: lstrip_blocks: "True"
 #!/bin/bash
+set -euo pipefail
 
-{{ devture_systemd_docker_base_host_command_docker }} run \
+container_id=$(\
+	{{ devture_systemd_docker_base_host_command_docker }} create \
 	-it \
 	--rm \
+	--name=matrix-synapse-s3-storage-provider-shell \
 	--env-file={{ matrix_synapse_ext_s3_storage_provider_base_path }}/env \
 	--mount type=bind,src={{ matrix_synapse_storage_path }},dst=/matrix-media-store-parent,bind-propagation=slave \
 	--mount type=bind,src={{ matrix_synapse_ext_s3_storage_provider_data_path }},dst=/data \
 	--workdir=/data \
 	--network={{ matrix_synapse_container_network }} \
 	--entrypoint=/bin/bash \
-	{{ matrix_synapse_docker_image_final }}
+	{{ matrix_synapse_docker_image_final }} \
+)
+
+{# We need to connect to the Postgres network, which should be in this list. #}
+{% for network in matrix_synapse_container_additional_networks %}
+{{ devture_systemd_docker_base_host_command_docker }} network connect {{ network }} $container_id
+{% endfor %}
+
+{{ devture_systemd_docker_base_host_command_docker }} start --attach -i $container_id

roles/custom/matrix-synapse/templates/synapse/systemd/matrix-synapse-worker.service.j2

@@ -5,6 +5,34 @@ AssertPathExists={{ matrix_synapse_config_dir_path }}/{{ matrix_synapse_worker_c
 After=matrix-synapse.service
 Requires=matrix-synapse.service
 
+{% set matrix_synapse_container_worker_arguments = [] %}
+
+{% if matrix_synapse_worker_type == "room_worker" %}
+	{% set matrix_synapse_container_worker_arguments = matrix_synapse_workers_room_workers_container_arguments %}
+{% elif matrix_synapse_worker_type == "sync_worker" %}
+	{% set matrix_synapse_container_worker_arguments = matrix_synapse_workers_sync_workers_container_arguments %}
+{% elif matrix_synapse_worker_type == "client_reader" %}
+	{% set matrix_synapse_container_worker_arguments = matrix_synapse_workers_client_reader_workers_container_arguments %}
+{% elif matrix_synapse_worker_type == "federation_reader" %}
+	{% set matrix_synapse_container_worker_arguments = matrix_synapse_workers_federation_reader_workers_container_arguments %}
+{% elif matrix_synapse_worker_type == "generic_worker" %}
+	{% set matrix_synapse_container_worker_arguments = matrix_synapse_workers_generic_workers_container_arguments %}
+{% elif matrix_synapse_worker_type == "stream_writer" %}
+	{% set matrix_synapse_container_worker_arguments = matrix_synapse_workers_stream_writers_container_arguments %}
+{% elif matrix_synapse_worker_type == "federation_sender" %}
+	{% set matrix_synapse_container_worker_arguments = matrix_synapse_workers_federation_sender_workers_container_arguments %}
+{% elif matrix_synapse_worker_type == "pusher" %}
+	{% set matrix_synapse_container_worker_arguments = matrix_synapse_workers_pusher_workers_container_arguments %}
+{% elif matrix_synapse_worker_type == "appservice" %}
+	{% set matrix_synapse_container_worker_arguments = matrix_synapse_workers_appservice_workers_container_arguments %}
+{% elif matrix_synapse_worker_type == "user_dir" %}
+	{% set matrix_synapse_container_worker_arguments = matrix_synapse_workers_user_dir_workers_container_arguments %}
+{% elif matrix_synapse_worker_type == "background" %}
+	{% set matrix_synapse_container_worker_arguments = matrix_synapse_workers_background_workers_container_arguments %}
+{% elif matrix_synapse_worker_type == "media_repository" %}
+	{% set matrix_synapse_container_worker_arguments = matrix_synapse_workers_media_repository_workers_container_arguments %}
+{% endif %}
+
 [Service]
 Type=simple
 Environment="HOME={{ devture_systemd_docker_base_systemd_unit_home_path }}"
@@ -43,6 +71,9 @@ ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} create \
 			{% for arg in matrix_synapse_container_arguments %}
 			{{ arg }} \
 			{% endfor %}
+			{% for arg in matrix_synapse_container_worker_arguments %}
+			{{ arg }} \
+			{% endfor %}
 			{{ matrix_synapse_docker_image_final }} \
 			run -m synapse.app.{{ matrix_synapse_worker_details.app }} -c /data/homeserver.yaml -c /data/{{ matrix_synapse_worker_config_file_name }}
 

roles/custom/matrix-synapse/templates/synapse/systemd/matrix-synapse.service.j2

@@ -57,6 +57,9 @@ ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} create \
 			{% for arg in matrix_synapse_container_arguments %}
 			{{ arg }} \
 			{% endfor %}
+			{% for arg in matrix_synapse_container_master_extra_arguments %}
+			{{ arg }} \
+			{% endfor %}
 			{{ matrix_synapse_docker_image_final }} \
 			run -m synapse.app.homeserver -c /data/homeserver.yaml
 

roles/custom/matrix-synapse/templates/synapse/worker-labels.j2

@@ -8,7 +8,7 @@ traefik.docker.network={{ matrix_synapse_worker_container_labels_traefik_docker_
 traefik.http.services.{{ matrix_synapse_worker_container_name }}-metrics.loadbalancer.server.port={{ matrix_synapse_worker_details.metrics_port }}
 
 {#
-	Metrics (e.g. /metrics/synapse/__WORKER_ID__)
+	Metrics (e.g. /metrics/synapse/worker/__WORKER_ID__)
 #}
 {% if matrix_synapse_worker_container_labels_public_metrics_enabled %}
 
@@ -42,7 +42,7 @@ traefik.http.routers.{{ matrix_synapse_worker_container_name }}-metrics.tls.cert
 
 {% endif %}
 {#
-	/Metrics (e.g. /metrics/synapse/__WORKER_ID__)
+	/Metrics (e.g. /metrics/synapse/worker/__WORKER_ID__)
 #}
 
 

roles/custom/matrix_playbook_migration/tasks/validate_config.yml

@@ -301,6 +301,7 @@
         - {'old': 'matrix_nginx_proxy_proxy_synapse_additional_server_configuration_blocks', 'new': '<removed>'}
         - {'old': 'matrix_nginx_proxy_proxy_matrix_additional_server_configuration_blocks', 'new': '<removed>'}
         - {'old': 'matrix_nginx_proxy_access_log_enabled', 'new': 'devture_traefik_config_accessLog_enabled'}
+        - {'old': 'matrix_nginx_proxy_container_labels_traefik_proxy_matrix_federation_hostname', 'new': 'matrix_server_fqn_matrix_federation'}
         - {'old': 'etherpad_nginx_proxy_dimension_integration_enabled', 'new': '<removed>'}
         - {'old': 'etherpad_nginx_proxy_dimension_integration_path_prefix', 'new': '<removed>'}
         - {'old': 'matrix_prometheus_services_proxy_connect_prometheus_node_exporter_metrics_proxying_enabled', 'new': '<removed>'}