Add support for exposing metrics for Synapse workers

group_vars/matrix_servers

@@ -4174,7 +4174,7 @@ matrix_synapse_container_additional_networks: |
     ) | unique
   }}
 
-matrix_synapse_container_labels_traefik_enabled: "{{ matrix_playbook_reverse_proxy_type in ['playbook-managed-traefik', 'other-traefik-container'] and not matrix_synapse_workers_enabled }}"
+matrix_synapse_container_labels_traefik_enabled: "{{ matrix_playbook_reverse_proxy_type in ['playbook-managed-traefik', 'other-traefik-container'] }}"
 matrix_synapse_container_labels_traefik_docker_network: "{{ matrix_playbook_reverse_proxyable_services_additional_network }}"
 matrix_synapse_container_labels_traefik_entrypoints: "{{ devture_traefik_entrypoint_primary }}"
 matrix_synapse_container_labels_traefik_tls_certResolver: "{{ devture_traefik_certResolver_primary }}"
@@ -4183,6 +4183,8 @@ matrix_synapse_container_labels_traefik_hostname: "{{ matrix_server_fqn_matrix }
 matrix_synapse_container_labels_client_root_redirection_enabled: "{{ matrix_synapse_container_labels_client_root_redirection_url != '' }}"
 matrix_synapse_container_labels_client_root_redirection_url: "{{ (('https://' if matrix_playbook_ssl_enabled else 'http://') + matrix_server_fqn_element) if matrix_client_element_enabled else '' }}"
 
+matrix_synapse_container_labels_matrix_labels_enabled: "{{ not matrix_synapse_workers_enabled }}"
+
 matrix_synapse_container_labels_client_synapse_admin_api_enabled: "{{ matrix_synapse_admin_enabled }}"
 
 matrix_synapse_container_labels_federation_api_traefik_entrypoints: "{{ matrix_federation_traefik_entrypoint }}"
@@ -4343,8 +4345,6 @@ matrix_synapse_reverse_proxy_companion_container_labels_traefik_entrypoints: "{{
 matrix_synapse_reverse_proxy_companion_container_labels_traefik_tls_certResolver: "{{ devture_traefik_certResolver_primary }}"
 matrix_synapse_reverse_proxy_companion_container_labels_traefik_hostname: "{{ matrix_server_fqn_matrix }}"
 
-matrix_synapse_reverse_proxy_companion_container_labels_client_root_redirection_enabled: "{{ matrix_synapse_container_labels_client_root_redirection_enabled != '' }}"
-matrix_synapse_reverse_proxy_companion_container_labels_client_root_redirection_url: "{{ matrix_synapse_container_labels_client_root_redirection_url }}"
 matrix_synapse_reverse_proxy_companion_container_labels_client_synapse_client_api_enabled: "{{ matrix_synapse_container_labels_client_synapse_client_api_enabled }}"
 matrix_synapse_reverse_proxy_companion_container_labels_client_synapse_oidc_api_enabled: "{{ matrix_synapse_container_labels_client_synapse_oidc_api_enabled }}"
 matrix_synapse_reverse_proxy_companion_container_labels_client_synapse_admin_api_enabled: "{{ matrix_synapse_container_labels_client_synapse_admin_api_enabled }}"

roles/custom/matrix-synapse-reverse-proxy-companion/defaults/main.yml

@@ -61,17 +61,6 @@ matrix_synapse_reverse_proxy_companion_container_labels_traefik_entrypoints: web
 matrix_synapse_reverse_proxy_companion_container_labels_traefik_tls_certResolver: default  # noqa var-naming
 matrix_synapse_reverse_proxy_companion_container_labels_traefik_hostname: ''
 
-# Controls whether labels will be added for handling the root (/) path
-matrix_synapse_reverse_proxy_companion_container_labels_client_root_enabled: true
-matrix_synapse_reverse_proxy_companion_container_labels_client_root_traefik_hostname: "{{ matrix_synapse_reverse_proxy_companion_container_labels_traefik_hostname }}"
-matrix_synapse_reverse_proxy_companion_container_labels_client_root_traefik_rule: "Host(`{{ matrix_synapse_reverse_proxy_companion_container_labels_client_root_traefik_hostname }}`) && Path(`/`)"
-matrix_synapse_reverse_proxy_companion_container_labels_client_root_traefik_priority: 0
-matrix_synapse_reverse_proxy_companion_container_labels_client_root_traefik_entrypoints: "{{ matrix_synapse_reverse_proxy_companion_container_labels_traefik_entrypoints }}"
-matrix_synapse_reverse_proxy_companion_container_labels_client_root_traefik_tls: "{{ matrix_synapse_reverse_proxy_companion_container_labels_client_root_traefik_entrypoints != 'web' }}"
-matrix_synapse_reverse_proxy_companion_container_labels_client_root_traefik_tls_certResolver: "{{ matrix_synapse_reverse_proxy_companion_container_labels_traefik_tls_certResolver }}"  # noqa var-naming
-matrix_synapse_reverse_proxy_companion_container_labels_client_root_redirection_enabled: false
-matrix_synapse_reverse_proxy_companion_container_labels_client_root_redirection_url: ""
-
 # Controls whether labels will be added that expose the Client-Server API.
 matrix_synapse_reverse_proxy_companion_container_labels_client_api_enabled: true
 matrix_synapse_reverse_proxy_companion_container_labels_client_api_traefik_hostname: "{{ matrix_synapse_reverse_proxy_companion_container_labels_traefik_hostname }}"

roles/custom/matrix-synapse-reverse-proxy-companion/tasks/validate_config.yml

@@ -8,9 +8,6 @@
   with_items:
     - {'name': 'matrix_synapse_reverse_proxy_companion_container_network', when: true}
 
-    - {'name': 'matrix_synapse_reverse_proxy_companion_container_labels_client_root_traefik_hostname', when: "{{ matrix_synapse_reverse_proxy_companion_container_labels_client_root_enabled }}"}
-    - {'name': 'matrix_synapse_reverse_proxy_companion_container_labels_client_root_redirection_url', when: "{{ matrix_synapse_reverse_proxy_companion_container_labels_client_root_redirection_enabled }}"}
-
     - {'name': 'matrix_synapse_reverse_proxy_companion_container_labels_client_api_traefik_hostname', when: "{{ matrix_synapse_reverse_proxy_companion_container_labels_client_api_enabled }}"}
 
     - {'name': 'matrix_synapse_reverse_proxy_companion_container_labels_client_synapse_client_api_traefik_hostname', when: "{{ matrix_synapse_reverse_proxy_companion_container_labels_client_synapse_client_api_enabled }}"}

roles/custom/matrix-synapse-reverse-proxy-companion/templates/labels.j2

@@ -9,44 +9,6 @@ traefik.http.services.matrix-synapse-reverse-proxy-companion-client-api.loadbala
 traefik.http.services.matrix-synapse-reverse-proxy-companion-federation-api.loadbalancer.server.port=8048
 
 
-{#
-	Root path (/)
-#}
-{% if matrix_synapse_reverse_proxy_companion_container_labels_client_root_enabled %}
-
-{% set client_root_middlewares = [] %}
-
-{% if matrix_synapse_reverse_proxy_companion_container_labels_client_root_redirection_enabled %}
-{% set client_root_middlewares = client_root_middlewares + ['matrix-synapse-reverse-proxy-companion-client-root-redirect'] %}
-traefik.http.middlewares.matrix-synapse-reverse-proxy-companion-client-root-redirect.redirectregex.regex=(.*)
-traefik.http.middlewares.matrix-synapse-reverse-proxy-companion-client-root-redirect.redirectregex.replacement={{ matrix_synapse_reverse_proxy_companion_container_labels_client_root_redirection_url }}
-{% else %}
-{% set client_root_middlewares = client_root_middlewares + ['matrix-synapse-reverse-proxy-companion-client-root-replacepath'] %}
-traefik.http.middlewares.matrix-synapse-reverse-proxy-companion-client-root-replacepath.replacepath.path=/_matrix/static/
-{% endif %}
-
-traefik.http.routers.matrix-synapse-reverse-proxy-companion-client-root.rule={{ matrix_synapse_reverse_proxy_companion_container_labels_client_root_traefik_rule }}
-
-traefik.http.routers.matrix-synapse-reverse-proxy-companion-client-root.middlewares={{ client_root_middlewares | join(',') }}
-
-{% if matrix_synapse_reverse_proxy_companion_container_labels_client_root_traefik_priority | int > 0 %}
-traefik.http.routers.matrix-synapse-reverse-proxy-companion-client-root.priority={{ matrix_synapse_reverse_proxy_companion_container_labels_client_root_traefik_priority }}
-{% endif %}
-
-traefik.http.routers.matrix-synapse-reverse-proxy-companion-client-root.service=matrix-synapse-reverse-proxy-companion-client-api
-traefik.http.routers.matrix-synapse-reverse-proxy-companion-client-root.entrypoints={{ matrix_synapse_reverse_proxy_companion_container_labels_client_root_traefik_entrypoints }}
-traefik.http.routers.matrix-synapse-reverse-proxy-companion-client-root.tls={{ matrix_synapse_reverse_proxy_companion_container_labels_client_root_traefik_tls | to_json }}
-
-{% if matrix_synapse_reverse_proxy_companion_container_labels_client_root_traefik_tls %}
-traefik.http.routers.matrix-synapse-reverse-proxy-companion-client-root.tls.certResolver={{ matrix_synapse_reverse_proxy_companion_container_labels_client_root_traefik_tls_certResolver }}
-{% endif %}
-
-{% endif %}
-{#
-	/Root path (/)
-#}
-
-
 {#
 	Client-API (/_matrix)
 #}

roles/custom/matrix-synapse/defaults/main.yml

@@ -156,7 +156,7 @@ matrix_synapse_container_metrics_api_host_bind_port: ''
 # Takes an "<ip>:<port>" or "<port>" value (e.g. "127.0.0.1:9100"), or empty string to not expose.
 matrix_synapse_container_manhole_api_host_bind_port: ''
 
-# matrix_synapse_container_labels_traefik_enabled controls whether labels to assist a Traefik reverse-proxy will be attached to the container.
+# matrix_synapse_container_labels_traefik_enabled controls whether labels to assist a Traefik reverse-proxy will be attached to the main Synapse worker.
 # See `../templates/labels.j2` for details.
 #
 # To inject your own other container labels, see `matrix_synapse_container_labels_additional_labels`.
@@ -166,7 +166,19 @@ matrix_synapse_container_labels_traefik_entrypoints: web-secure
 matrix_synapse_container_labels_traefik_tls_certResolver: default  # noqa var-naming
 matrix_synapse_container_labels_traefik_hostname: ''
 
-# Controls whether labels will be added for handling the root (/) path
+# Controls whether Matrix-related labels will be added.
+#
+# When set to false, variables like the following take no effect:
+# - `matrix_synapse_container_labels_client_api_enabled`
+# - `matrix_synapse_container_labels_client_synapse_client_api_enabled`
+# - `matrix_synapse_container_labels_client_synapse_oidc_api_enabled`
+# - `matrix_synapse_container_labels_client_synapse_admin_api_enabled`
+# - `matrix_synapse_container_labels_federation_api_enabled`
+#
+# When workers are enabled, we do not capture these requests, because we can't route them appropriately.
+matrix_synapse_container_labels_matrix_related_labels_enabled: "{{ not matrix_synapse_workers_enabled }}"
+
+# Controls whether labels will be added for handling the root (/) path.
 matrix_synapse_container_labels_client_root_enabled: true
 matrix_synapse_container_labels_client_root_traefik_hostname: "{{ matrix_synapse_container_labels_traefik_hostname }}"
 matrix_synapse_container_labels_client_root_traefik_rule: "Host(`{{ matrix_synapse_container_labels_client_root_traefik_hostname }}`) && Path(`/`)"
@@ -178,6 +190,8 @@ matrix_synapse_container_labels_client_root_redirection_enabled: false
 matrix_synapse_container_labels_client_root_redirection_url: ""
 
 # Controls whether labels will be added that expose the Client-Server API.
+# Regardless of whether this is enabled, it may or may not take effect due to the value of other variables.
+# See `matrix_synapse_container_labels_traefik_enabled` or `matrix_synapse_container_labels_matrix_related_labels_enabled`
 matrix_synapse_container_labels_client_api_enabled: true
 matrix_synapse_container_labels_client_api_traefik_hostname: "{{ matrix_synapse_container_labels_traefik_hostname }}"
 matrix_synapse_container_labels_client_api_traefik_path_prefix: /_matrix
@@ -188,6 +202,9 @@ matrix_synapse_container_labels_client_api_traefik_tls: "{{ matrix_synapse_conta
 matrix_synapse_container_labels_client_api_traefik_tls_certResolver: "{{ matrix_synapse_container_labels_traefik_tls_certResolver }}"  # noqa var-naming
 
 # Controls whether labels will be added that expose the /_synapse/client paths
+# When workers are enabled, we do not capture these requests, because they may be load-balanaced to some specific worker.
+# Regardless of whether this is enabled, it may or may not take effect due to the value of other variables.
+# See `matrix_synapse_container_labels_traefik_enabled` or `matrix_synapse_container_labels_matrix_related_labels_enabled`
 matrix_synapse_container_labels_client_synapse_client_api_enabled: true
 matrix_synapse_container_labels_client_synapse_client_api_traefik_hostname: "{{ matrix_synapse_container_labels_traefik_hostname }}"
 matrix_synapse_container_labels_client_synapse_client_api_traefik_path_prefix: /_synapse/client
@@ -199,6 +216,8 @@ matrix_synapse_container_labels_client_synapse_client_api_traefik_tls_certResolv
 
 # Controls whether labels will be added that expose the /_synapse/oidc paths
 # Enable this if you need OpenID Connect authentication support.
+# Regardless of whether this is enabled, it may or may not take effect due to the value of other variables.
+# See `matrix_synapse_container_labels_traefik_enabled` or `matrix_synapse_container_labels_matrix_related_labels_enabled`
 matrix_synapse_container_labels_client_synapse_oidc_api_enabled: false
 matrix_synapse_container_labels_client_synapse_oidc_api_traefik_hostname: "{{ matrix_synapse_container_labels_traefik_hostname }}"
 matrix_synapse_container_labels_client_synapse_oidc_api_traefik_path_prefix: /_synapse/oidc
@@ -210,6 +229,8 @@ matrix_synapse_container_labels_client_synapse_oidc_api_traefik_tls_certResolver
 
 # Controls whether labels will be added that expose the /_synapse/admin paths
 # Following these recommendations (https://github.com/matrix-org/synapse/blob/master/docs/reverse_proxy.md), by default, we don't.
+# Regardless of whether this is enabled, it may or may not take effect due to the value of other variables.
+# See `matrix_synapse_container_labels_traefik_enabled` or `matrix_synapse_container_labels_matrix_related_labels_enabled`
 matrix_synapse_container_labels_client_synapse_admin_api_enabled: false
 matrix_synapse_container_labels_client_synapse_admin_api_traefik_hostname: "{{ matrix_synapse_container_labels_traefik_hostname }}"
 matrix_synapse_container_labels_client_synapse_admin_api_traefik_path_prefix: /_synapse/admin
@@ -220,7 +241,9 @@ matrix_synapse_container_labels_client_synapse_admin_api_traefik_tls: "{{ matrix
 matrix_synapse_container_labels_client_synapse_admin_api_traefik_tls_certResolver: "{{ matrix_synapse_container_labels_traefik_tls_certResolver }}"  # noqa var-naming
 
 # Controls whether labels will be added that expose the Server-Server API (Federation API).
-matrix_synapse_container_labels_federation_api_enabled: "{{ matrix_synapse_federation_enabled }}"
+# Regardless of whether this is enabled, it may or may not take effect due to the value of other variables.
+# See `matrix_synapse_container_labels_traefik_enabled` or `matrix_synapse_container_labels_matrix_related_labels_enabled`
+matrix_synapse_container_labels_federation_api_enabled: "{{ matrix_synapse_federation_enabled and not matrix_synapse_workers_enabled }}"
 matrix_synapse_container_labels_federation_api_traefik_hostname: "{{ matrix_synapse_container_labels_traefik_hostname }}"
 matrix_synapse_container_labels_federation_api_traefik_path_prefix: /_matrix
 matrix_synapse_container_labels_federation_api_traefik_rule: "Host(`{{ matrix_synapse_container_labels_federation_api_traefik_hostname }}`) && PathPrefix(`{{ matrix_synapse_container_labels_federation_api_traefik_path_prefix }}`)"
@@ -229,7 +252,7 @@ matrix_synapse_container_labels_federation_api_traefik_entrypoints: ''
 matrix_synapse_container_labels_federation_api_traefik_tls: "{{ matrix_synapse_container_labels_federation_api_traefik_entrypoints != 'web' }}"
 matrix_synapse_container_labels_federation_api_traefik_tls_certResolver: "{{ matrix_synapse_container_labels_traefik_tls_certResolver }}"  # noqa var-naming
 
-# Controls whether labels will be added that expose metrics (see `matrix_synapse_metrics_proxying_enabled`)
+# Controls whether labels will be added that expose metrics (see `matrix_synapse_metrics_proxying_enabled`) for the main Synapse process
 matrix_synapse_container_labels_metrics_enabled: "{{ matrix_synapse_metrics_enabled and matrix_synapse_metrics_proxying_enabled }}"
 matrix_synapse_container_labels_metrics_traefik_path: "{{ matrix_synapse_metrics_proxying_path_prefix }}/main-process"
 matrix_synapse_container_labels_metrics_traefik_rule: "Host(`{{ matrix_synapse_metrics_proxying_hostname }}`) && Path(`{{ matrix_synapse_container_labels_metrics_traefik_path }}`)"
@@ -667,6 +690,38 @@ matrix_synapse_workers_presets:
 # It takes "*" to signify "bind on all interfaces" ("0.0.0.0" is IPv4-only).
 matrix_synapse_workers_container_host_bind_address: ''
 
+# matrix_synapse_worker_container_labels_traefik_enabled controls whether labels to assist a Traefik reverse-proxy will be attached to Synapse worker containers.
+# See `../templates/worker-labels.j2` for details.
+#
+# To inject your own other container labels, see `matrix_synapse_worker_container_labels_additional_labels`.
+matrix_synapse_worker_container_labels_traefik_enabled: true
+matrix_synapse_worker_container_labels_traefik_docker_network: "{{ matrix_synapse_container_labels_traefik_docker_network }}"
+matrix_synapse_worker_container_labels_traefik_entrypoints: "{{ matrix_synapse_container_labels_traefik_entrypoints }}"
+matrix_synapse_worker_container_labels_traefik_tls_certResolver: "{{ matrix_synapse_container_labels_traefik_tls_certResolver }}"  # noqa var-naming
+matrix_synapse_worker_container_labels_traefik_hostname: "{{ matrix_synapse_container_labels_traefik_hostname }}"
+
+# Controls whether labels will be added that expose metrics (see `matrix_synapse_metrics_proxying_enabled`)
+matrix_synapse_worker_container_labels_metrics_enabled: "{{ matrix_synapse_metrics_enabled and matrix_synapse_metrics_proxying_enabled }}"
+# The `__WORKER_ID__` placeholder will be replaced with the actual worker id during label-file generation (see `../templates/worker-labels.j2`).
+matrix_synapse_worker_container_labels_metrics_traefik_path: "{{ matrix_synapse_metrics_proxying_path_prefix }}/__WORKER_ID__"
+matrix_synapse_worker_container_labels_metrics_traefik_rule: "Host(`{{ matrix_synapse_metrics_proxying_hostname }}`) && Path(`{{ matrix_synapse_worker_container_labels_metrics_traefik_path }}`)"
+matrix_synapse_worker_container_labels_metrics_traefik_priority: 0
+matrix_synapse_worker_container_labels_metrics_traefik_entrypoints: "{{ matrix_synapse_container_labels_traefik_entrypoints }}"
+matrix_synapse_worker_container_labels_metrics_traefik_tls: "{{ matrix_synapse_container_labels_metrics_traefik_entrypoints != 'web' }}"
+matrix_synapse_worker_container_labels_metrics_traefik_tls_certResolver: "{{ matrix_synapse_container_labels_traefik_tls_certResolver }}"  # noqa var-naming
+matrix_synapse_worker_container_labels_metrics_middleware_basic_auth_enabled: "{{ matrix_synapse_container_labels_metrics_middleware_basic_auth_enabled }}"
+# See: https://doc.traefik.io/traefik/middlewares/http/basicauth/#users
+matrix_synapse_worker_container_labels_metrics_middleware_basic_auth_users: "{{ matrix_synapse_container_labels_metrics_middleware_basic_auth_users }}"
+
+# matrix_synapse_worker_container_labels_additional_labels contains a multiline string with additional labels to add to the label files for Synapse worker containers.
+# See `../templates/labels.j2` for details.
+#
+# Example:
+# matrix_synapse_worker_container_labels_additional_labels: |
+#   my.label=1
+#   another.label="here"
+matrix_synapse_worker_container_labels_additional_labels: ''
+
 matrix_synapse_workers_generic_workers_count: "{{ matrix_synapse_workers_presets[matrix_synapse_workers_preset]['generic_workers_count'] }}"
 matrix_synapse_workers_generic_workers_port_range_start: 18111
 matrix_synapse_workers_generic_workers_metrics_range_start: 19111

roles/custom/matrix-synapse/tasks/synapse/workers/setup_install.yml

@@ -40,6 +40,20 @@
   with_items: "{{ matrix_synapse_workers_current_systemd_services.files }}"
   when: "not ansible_check_mode and (item.path | basename | replace('.service', '')) not in matrix_synapse_enabled_worker_names"
 
+- name: Determine current worker label files
+  ansible.builtin.find:
+    path: "{{ matrix_synapse_base_path }}"
+    patterns: "worker.*.labels"
+    use_regex: true
+  register: matrix_synapse_workers_current_label_files
+
+- name: Ensure unnecessary worker labels are cleaned
+  ansible.builtin.file:
+    path: "{{ item.path }}"
+    state: absent
+  with_items: "{{ matrix_synapse_workers_current_label_files.files }}"
+  when: "not ansible_check_mode and (item.path | basename | replace ('worker.', '') | replace('.labels', '')) not in matrix_synapse_enabled_worker_names"
+
 - name: Ensure creation of worker systemd service files and configuration files
   ansible.builtin.include_tasks: "{{ role_path }}/tasks/synapse/workers/util/setup_files_for_worker.yml"
   with_items: "{{ matrix_synapse_workers_enabled_list }}"

roles/custom/matrix-synapse/tasks/synapse/workers/util/setup_files_for_worker.yml

@@ -4,6 +4,7 @@
     matrix_synapse_worker_systemd_service_name: "{{ matrix_synapse_worker_details.name }}"
     matrix_synapse_worker_container_name: "{{ matrix_synapse_worker_details.name }}"
     matrix_synapse_worker_config_file_name: "worker.{{ matrix_synapse_worker_details.name }}.yaml"
+    matrix_synapse_worker_labels_file_name: "worker.{{ matrix_synapse_worker_details.name }}.labels"
 
 - name: Ensure configuration exists for {{ matrix_synapse_worker_systemd_service_name }}
   ansible.builtin.template:
@@ -13,6 +14,14 @@
     owner: "{{ matrix_synapse_uid }}"
     group: "{{ matrix_synapse_gid }}"
 
+- name: Ensure labels exists for {{ matrix_synapse_worker_systemd_service_name }}
+  ansible.builtin.template:
+    src: "{{ role_path }}/templates/synapse/worker-labels.j2"
+    dest: "{{ matrix_synapse_base_path }}/{{ matrix_synapse_worker_labels_file_name }}"
+    mode: 0644
+    owner: "{{ matrix_synapse_uid }}"
+    group: "{{ matrix_synapse_gid }}"
+
 - name: Ensure systemd service exists for {{ matrix_synapse_worker_systemd_service_name }}
   ansible.builtin.template:
     src: "{{ role_path }}/templates/synapse/systemd/matrix-synapse-worker.service.j2"

roles/custom/matrix-synapse/templates/synapse/labels.j2

@@ -48,6 +48,16 @@ traefik.http.routers.matrix-synapse-client-root.tls.certResolver={{ matrix_synap
 #}
 
 
+{#
+#########################################################################
+#                                                                       #
+# Matrix-related labels                                                 #
+# See: `matrix_synapse_container_labels_matrix_related_labels_enabled`  #
+#                                                                       #
+#########################################################################
+#}
+{% if matrix_synapse_container_labels_matrix_related_labels_enabled %}
+
 {#
 	Client-API (/_matrix)
 #}
@@ -172,6 +182,17 @@ traefik.http.routers.matrix-synapse-federation-api.tls.certResolver={{ matrix_sy
 	/Federation-API (/_matrix)
 #}
 
+{#
+#########################################################################
+#                                                                       #
+# /Matrix-related labels                                                #
+# See: `matrix_synapse_container_labels_matrix_related_labels_enabled`  #
+#                                                                       #
+#########################################################################
+#}
+{% endif %}
+
+
 {#
 	Metrics (e.g. /metrics/synapse/main-process)
 #}
@@ -205,11 +226,6 @@ traefik.http.routers.matrix-synapse-metrics.tls={{ matrix_synapse_container_labe
 traefik.http.routers.matrix-synapse-metrics.tls.certResolver={{ matrix_synapse_container_labels_metrics_traefik_tls_certResolver }}
 {% endif %}
 
-{% if matrix_synapse_container_labels_metrics_middleware_basic_auth_enabled %}
-traefik.http.routers.matrix-synapse-metrics.middlewares=matrix-synapse-metrics-basic-auth
-traefik.http.middlewares.matrix-synapse-metrics-basic-auth.basicauth.users={{ matrix_synapse_container_labels_metrics_middleware_basic_auth_users }}
-{% endif %}
-
 {% endif %}
 {#
 	/Metrics (e.g. /metrics/synapse/main-process)

roles/custom/matrix-synapse/templates/synapse/systemd/matrix-synapse-worker.service.j2

@@ -42,6 +42,7 @@ ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} create \
 			{% for volume in matrix_synapse_container_additional_volumes %}
 			--mount type={{ volume.type | default('bind' if '/' in volume.src else 'volume') }},src={{ volume.src }},dst={{ volume.dst }}{{ (',' + volume.options) if volume.options else '' }} \
 			{% endfor %}
+			--label-file={{ matrix_synapse_base_path }}/{{ matrix_synapse_worker_labels_file_name }} \
 			{% for arg in matrix_synapse_container_arguments %}
 			{{ arg }} \
 			{% endfor %}

roles/custom/matrix-synapse/templates/synapse/worker-labels.j2

@@ -0,0 +1,51 @@
+{% if matrix_synapse_worker_container_labels_traefik_enabled %}
+traefik.enable=true
+
+{% if matrix_synapse_worker_container_labels_traefik_docker_network %}
+traefik.docker.network={{ matrix_synapse_worker_container_labels_traefik_docker_network }}
+{% endif %}
+
+traefik.http.services.{{ matrix_synapse_worker_container_name }}-metrics.loadbalancer.server.port={{ matrix_synapse_worker_details.metrics_port }}
+
+{#
+	Metrics (e.g. /metrics/synapse/__WORKER_ID__)
+#}
+{% if matrix_synapse_worker_container_labels_metrics_enabled %}
+
+{% set metrics_middlewares = [] %}
+
+{% if matrix_synapse_worker_container_labels_metrics_middleware_basic_auth_enabled %}
+{% set metrics_middlewares = metrics_middlewares + [matrix_synapse_worker_container_name + '-metrics-basic-auth'] %}
+traefik.http.middlewares.{{ matrix_synapse_worker_container_name }}-metrics-basic-auth.basicauth.users={{ matrix_synapse_worker_container_labels_metrics_middleware_basic_auth_users }}
+{% endif %}
+
+{% set metrics_middlewares = metrics_middlewares + [matrix_synapse_worker_container_name + '-metrics-replacepath'] %}
+traefik.http.middlewares.{{ matrix_synapse_worker_container_name }}-metrics-replacepath.replacepath.path=/_synapse/metrics
+
+traefik.http.routers.{{ matrix_synapse_worker_container_name }}-metrics.rule={{ matrix_synapse_worker_container_labels_metrics_traefik_rule | replace('__WORKER_ID__', matrix_synapse_worker_details.id) }}
+
+{% if metrics_middlewares | length > 0 %}
+traefik.http.routers.{{ matrix_synapse_worker_container_name }}-metrics.middlewares={{ metrics_middlewares | join(',') }}
+{% endif %}
+
+{% if matrix_synapse_worker_container_labels_metrics_traefik_priority | int > 0 %}
+traefik.http.routers.{{ matrix_synapse_worker_container_name }}-metrics.priority={{ matrix_synapse_worker_container_labels_metrics_traefik_priority }}
+{% endif %}
+
+traefik.http.routers.{{ matrix_synapse_worker_container_name }}-metrics.service={{ matrix_synapse_worker_container_name }}-metrics
+traefik.http.routers.{{ matrix_synapse_worker_container_name }}-metrics.entrypoints={{ matrix_synapse_worker_container_labels_metrics_traefik_entrypoints }}
+
+traefik.http.routers.{{ matrix_synapse_worker_container_name }}-metrics.tls={{ matrix_synapse_worker_container_labels_metrics_traefik_tls | to_json }}
+{% if matrix_synapse_worker_container_labels_metrics_traefik_tls %}
+traefik.http.routers.{{ matrix_synapse_worker_container_name }}-metrics.tls.certResolver={{ matrix_synapse_worker_container_labels_metrics_traefik_tls_certResolver }}
+{% endif %}
+
+{% endif %}
+{#
+	/Metrics (e.g. /metrics/synapse/__WORKER_ID__)
+#}
+
+
+{% endif %}
+
+{{ matrix_synapse_worker_container_labels_additional_labels }}

roles/custom/matrix_playbook_migration/tasks/validate_config.yml

@@ -90,7 +90,7 @@
     - {'old': 'matrix_nginx_proxy_base_domain_create_directory', 'new': '<no longer necessary; see matrix_static_files_file_index_html_enabled>'}
     - {'old': 'matrix_nginx_proxy_proxy_riot_compat_redirect_enabled', 'new': '<redirecting the riot domain to an element domain is no longer supported - you can implement it yourself using matrix_client_element_container_labels_additional_labels>'}
     - {'old': 'matrix_nginx_proxy_proxy_riot_compat_redirect_hostname', 'new': '<redirecting the riot domain to an element domain is no longer supported - you can implement it yourself using matrix_client_element_container_labels_additional_labels>'}
-    - {'old': 'matrix_nginx_proxy_proxy_matrix_client_redirect_root_uri_to_domain', 'new': '<superseded by matrix_synapse_container_labels_client_root_redirection_* or matrix_synapse_reverse_proxy_companion_container_labels_client_root_redirection_* or other equivalent variables based on the homeserver implementation you use>'}
+    - {'old': 'matrix_nginx_proxy_proxy_matrix_client_redirect_root_uri_to_domain', 'new': '<superseded by matrix_synapse_container_labels_client_root_redirection_* or other equivalent variables based on the homeserver implementation you use>'}
     - {'old': 'matrix_nginx_proxy_proxy_matrix_client_api_forwarded_location_synapse_client_api_enabled', 'new': 'matrix_synapse_container_labels_client_synapse_client_api_enabled'}
     - {'old': 'matrix_nginx_proxy_proxy_matrix_client_api_forwarded_location_synapse_oidc_api_enabled', 'new': 'matrix_synapse_container_labels_client_synapse_oidc_api_enabled'}
     - {'old': 'matrix_nginx_proxy_proxy_matrix_client_api_forwarded_location_synapse_admin_api_enabled', 'new': 'matrix_synapse_container_labels_client_synapse_admin_api_enabled'}