feat: add sliding-sync-proxy support

group_vars/matrix_servers

@@ -344,6 +344,8 @@ devture_systemd_service_manager_services_list_auto: |
     +
     ([{'name': 'matrix-registration.service', 'priority': 4000, 'groups': ['matrix', 'registration']}] if matrix_registration_enabled else [])
     +
+    ([{'name': 'matrix-sliding-sync-proxy.service', 'priority': 4000, 'groups': ['matrix', 'sliding-sync-proxy']}] if matrix_sliding_sync_proxy_enabled else [])
+    +
     ([{'name': 'matrix-sygnal.service', 'priority': 800, 'groups': ['matrix', 'sygnal']}] if matrix_sygnal_enabled else [])
     +
     ([{'name': 'matrix-goofys.service', 'priority': 800, 'groups': ['matrix', 'goofys']}] if matrix_s3_media_store_enabled else [])
@@ -2383,6 +2385,7 @@ matrix_nginx_proxy_proxy_hydrogen_enabled: "{{ matrix_client_hydrogen_enabled an
 matrix_nginx_proxy_proxy_cinny_enabled: "{{ matrix_client_cinny_enabled and matrix_playbook_reverse_proxy_type in ['playbook-managed-nginx', 'other-nginx-non-container'] }}"
 matrix_nginx_proxy_proxy_buscarron_enabled: "{{ matrix_bot_buscarron_enabled }}"
 matrix_nginx_proxy_proxy_dimension_enabled: "{{ matrix_dimension_enabled }}"
+matrix_nginx_proxy_proxy_sliding_sync_proxy_enabled: "{{ matrix_sliding_sync_proxy_enabled }}"
 matrix_nginx_proxy_proxy_etherpad_enabled: "{{ matrix_etherpad_enabled and matrix_etherpad_mode == 'standalone' }}"
 matrix_nginx_proxy_proxy_bot_go_neb_enabled: "{{ matrix_bot_go_neb_enabled }}"
 
@@ -2400,6 +2403,7 @@ matrix_nginx_proxy_container_labels_traefik_entrypoints: "{{ devture_traefik_ent
 matrix_nginx_proxy_container_labels_traefik_proxy_matrix_enabled: true
 matrix_nginx_proxy_container_labels_traefik_proxy_buscarron_enabled: "{{ matrix_bot_buscarron_enabled }}"
 matrix_nginx_proxy_container_labels_traefik_proxy_dimension_enabled: "{{ matrix_dimension_enabled }}"
+matrix_nginx_proxy_container_labels_traefik_proxy_sliding_sync_proxy_enabled: "{{ matrix_sliding_sync_proxy_enabled }}"
 matrix_nginx_proxy_container_labels_traefik_proxy_etherpad_enabled: "{{ matrix_etherpad_enabled and matrix_etherpad_mode == 'standalone' }}"
 matrix_nginx_proxy_container_labels_traefik_proxy_bot_go_neb_enabled: "{{ matrix_bot_go_neb_enabled }}"
 matrix_nginx_proxy_container_labels_traefik_proxy_jitsi_enabled: "{{ matrix_jitsi_enabled }}"
@@ -2489,6 +2493,8 @@ matrix_nginx_proxy_systemd_wanted_services_list: |
     +
     (['matrix-jitsi.service'] if matrix_jitsi_enabled else [])
     +
+    (['matrix-sliding-sync-proxy.service'] if matrix_sliding_sync_proxy_enabled else [])
+    +
     (['matrix-bot-go-neb.service'] if matrix_bot_go_neb_enabled else [])
     +
     (['matrix-etherpad.service'] if matrix_etherpad_enabled else [])
@@ -2512,6 +2518,8 @@ matrix_ssl_domains_to_obtain_certificates_for: |
     +
     ([matrix_server_fqn_dimension] if matrix_dimension_enabled else [])
     +
+    ([matrix_server_fqn_sliding_sync_proxy] if matrix_sliding_sync_proxy_enabled else [])
+    +
     ([matrix_server_fqn_etherpad] if (matrix_etherpad_enabled and matrix_etherpad_mode == 'standalone') else [])
     +
     ([matrix_server_fqn_bot_go_neb] if matrix_bot_go_neb_enabled else [])
@@ -2620,6 +2628,12 @@ devture_postgres_managed_databases_auto: |
       'password': matrix_dendrite_database_password,
     }] if (matrix_dendrite_enabled and matrix_dendrite_database_hostname == devture_postgres_connection_hostname) else [])
     +
+    ([{
+      'name': matrix_sliding_sync_proxy_database_name,
+      'username': matrix_sliding_sync_proxy_database_username,
+      'password': matrix_sliding_sync_proxy_database_password,
+    }] if (matrix_sliding_sync_proxy_enabled) else [])
+    +
     ([{
       'name': matrix_ma1sd_database_name,
       'username': matrix_ma1sd_database_username,
@@ -3495,6 +3509,40 @@ matrix_registration_database_password: "{{ '%s' | format(matrix_homeserver_gener
 ######################################################################
 
 
+
+######################################################################
+#
+# matrix-sliding-sync-proxy
+#
+######################################################################
+
+# We don't enable the sliding sync proxy by default.
+matrix_sliding_sync_proxy_enabled: false
+
+matrix_sliding_sync_proxy_container_image_self_build: "{{ matrix_architecture not in ['amd64'] }}"
+
+matrix_sliding_sync_proxy_systemd_required_services_list: |
+  {{
+    ['docker.service']
+    +
+    ['matrix-' + matrix_homeserver_implementation + '.service']
+    +
+    ([devture_postgres_identifier ~ '.service'] if devture_postgres_enabled else [])
+    +
+    (['matrix-nginx-proxy.service'] if matrix_nginx_proxy_enabled else [])
+  }}
+
+matrix_sliding_sync_proxy_secret: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'ss.secret', rounds=655555) | to_uuid }}"
+matrix_sliding_sync_proxy_database_hostname: "{{devture_postgres_connection_hostname}}"
+matrix_sliding_sync_proxy_database_password: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'ss.db', rounds=655555) | to_uuid }}"
+
+######################################################################
+#
+# /matrix-sliding-sync-proxy
+#
+######################################################################
+
+
 ######################################################################
 #
 # matrix-dendrite

playbooks/matrix.yml

@@ -102,6 +102,7 @@
     - custom/matrix-ldap-registration-proxy
     - custom/matrix-ma1sd
     - custom/matrix-dimension
+    - custom/matrix-sliding-sync-proxy
     - custom/matrix-etherpad
     - custom/matrix-email2matrix
     - custom/matrix-sygnal

roles/custom/matrix-base/defaults/main.yml

@@ -81,6 +81,9 @@ matrix_server_fqn_bot_go_neb: "goneb.{{ matrix_domain }}"
 # This is where you access Jitsi.
 matrix_server_fqn_jitsi: "jitsi.{{ matrix_domain }}"
 
+# This is where you access the sliding sync proxy.
+matrix_server_fqn_sliding_sync_proxy: "sliding-sync.{{ matrix_domain }}"
+
 # This is where you access Grafana.
 matrix_server_fqn_grafana: "stats.{{ matrix_domain }}"
 

roles/custom/matrix-base/templates/static-files/well-known/matrix-client.j2

@@ -26,6 +26,11 @@
 		"preferredDomain": {{ matrix_client_element_jitsi_preferredDomain|to_json }}
 	}
 	{% endif %}
+	{% if matrix_sliding_sync_proxy_enabled %},
+	"org.matrix.msc3575.proxy": {
+		"url": "https://{{ matrix_server_fqn_sliding_sync_proxy }}/_matrix/client/unstable/org.matrix.msc3575/sync"
+	}
+	{% endif %}
 	{% if matrix_client_element_location_sharing_enabled %},
 	"m.tile_server": {
         "map_style_url": "https://{{ matrix_server_fqn_element }}/map_style.json"

roles/custom/matrix-nginx-proxy/defaults/main.yml

@@ -91,6 +91,11 @@ matrix_nginx_proxy_container_labels_traefik_proxy_sygnal_hostname: "{{ matrix_se
 matrix_nginx_proxy_container_labels_traefik_proxy_sygnal_tls: "{{ matrix_nginx_proxy_container_labels_traefik_entrypoints != 'web' }}"
 matrix_nginx_proxy_container_labels_traefik_proxy_sygnal_rule: "Host(`{{ matrix_nginx_proxy_container_labels_traefik_proxy_sygnal_hostname }}`)"
 
+matrix_nginx_proxy_container_labels_traefik_proxy_sliding_sync_proxy_enabled: false
+matrix_nginx_proxy_container_labels_traefik_proxy_sliding_sync_proxy_hostname: "{{ matrix_server_fqn_sliding_sync_proxy }}"
+matrix_nginx_proxy_container_labels_traefik_proxy_sliding_sync_proxy_tls: "{{ matrix_nginx_proxy_container_labels_traefik_entrypoints != 'web' }}"
+matrix_nginx_proxy_container_labels_traefik_proxy_sliding_sync_proxy_rule: "Host(`{{ matrix_nginx_proxy_container_labels_traefik_proxy_sliding_sync_proxy_hostname }}`)"
+
 # matrix_nginx_proxy_container_labels_additional_labels contains a multiline string with additional labels to add to the container label file.
 # See `../templates/labels.j2` for details.
 #
@@ -283,6 +288,10 @@ matrix_nginx_proxy_proxy_sygnal_hostname: "{{ matrix_server_fqn_sygnal }}"
 matrix_nginx_proxy_proxy_ntfy_enabled: false
 matrix_nginx_proxy_proxy_ntfy_hostname: "{{ matrix_server_fqn_ntfy }}"
 
+# Controls whether proxying the sliding sync proxy domain should be done.
+matrix_nginx_proxy_proxy_sliding_sync_proxy_enabled: false
+matrix_nginx_proxy_proxy_sliding_sync_proxy_hostname: "{{ matrix_server_fqn_sliding_sync_proxy }}"
+
 # Controls whether proxying for (Prometheus) metrics (`/metrics/*`) for the various services should be done (on the matrix domain)
 # If the internal Prometheus server (`matrix-prometheus` role) is used, proxying is not necessary, since Prometheus can access each container directly.
 # This is only useful when an external Prometheus will be collecting metrics.
@@ -462,6 +471,10 @@ matrix_nginx_proxy_proxy_sygnal_additional_server_configuration_blocks: []
 # A list of strings containing additional configuration blocks to add to ntfy's server configuration (matrix-ntfy.conf).
 matrix_nginx_proxy_proxy_ntfy_additional_server_configuration_blocks: []
 
+# A list of strings containing additional configuration blocks to add to sliding_sync_proxy's server configuration (matrix-sliding-sync-proxy.conf).
+matrix_nginx_proxy_proxy_sliding_sync_proxy_additional_server_configuration_blocks: []
+
+
 # A list of strings containing additional configuration blocks to add to the base domain server configuration (matrix-base-domain.conf).
 matrix_nginx_proxy_proxy_domain_additional_server_configuration_blocks: []
 

roles/custom/matrix-nginx-proxy/tasks/setup_nginx_proxy.yml

@@ -122,6 +122,14 @@
     mode: 0644
   when: matrix_nginx_proxy_proxy_buscarron_enabled | bool
 
+- name: Ensure Matrix nginx-proxy configuration for sliding-sync-proxy domain exists
+  ansible.builtin.template:
+    src: "{{ role_path }}/templates/nginx/conf.d/matrix-sliding-sync-proxy.conf.j2"
+    dest: "{{ matrix_nginx_proxy_confd_path }}/matrix-sliding-sync-proxy.conf"
+    mode: 0644
+  when: matrix_nginx_proxy_proxy_sliding_sync_proxy_enabled | bool
+
+
 - name: Ensure Matrix nginx-proxy configuration for dimension domain exists
   ansible.builtin.template:
     src: "{{ role_path }}/templates/nginx/conf.d/matrix-dimension.conf.j2"
@@ -285,6 +293,12 @@
     state: absent
   when: "not matrix_nginx_proxy_proxy_buscarron_enabled | bool"
 
+- name: Ensure Matrix nginx-proxy configuration for sliding-sync-proxy domain deleted
+  ansible.builtin.file:
+    path: "{{ matrix_nginx_proxy_confd_path }}/matrix-sliding-sync-proxy.conf"
+    state: absent
+  when: "not matrix_nginx_proxy_proxy_sliding_sync_proxy_enabled | bool"
+
 - name: Ensure Matrix nginx-proxy configuration for dimension domain deleted
   ansible.builtin.file:
     path: "{{ matrix_nginx_proxy_confd_path }}/matrix-dimension.conf"

roles/custom/matrix-nginx-proxy/templates/labels.j2

@@ -50,6 +50,18 @@ traefik.http.routers.matrix-nginx-proxy-buscarron.entrypoints={{ matrix_nginx_pr
 {% endif %}
 
 
+{% if matrix_nginx_proxy_container_labels_traefik_proxy_sliding_sync_proxy_enabled %}
+# Sliding Sync Proxy
+traefik.http.routers.matrix-nginx-proxy-sliding-sync-proxy.rule={{ matrix_nginx_proxy_container_labels_traefik_proxy_sliding_sync_proxy_rule }}
+traefik.http.routers.matrix-nginx-proxy-sliding-sync-proxy.service=matrix-nginx-proxy-web
+traefik.http.routers.matrix-nginx-proxy-sliding-sync-proxy.tls={{ matrix_nginx_proxy_container_labels_traefik_proxy_sliding_sync_proxy_tls | to_json }}
+{% if matrix_nginx_proxy_container_labels_traefik_proxy_sliding_sync_proxy_tls %}
+traefik.http.routers.matrix-nginx-proxy-sliding-sync-proxy.tls.certResolver={{ matrix_nginx_proxy_container_labels_traefik_tls_certResolver }}
+{% endif %}
+traefik.http.routers.matrix-nginx-proxy-sliding-sync-proxy.entrypoints={{ matrix_nginx_proxy_container_labels_traefik_entrypoints }}
+{% endif %}
+
+
 {% if matrix_nginx_proxy_container_labels_traefik_proxy_dimension_enabled %}
 # Dimension
 traefik.http.routers.matrix-nginx-proxy-dimension.rule={{ matrix_nginx_proxy_container_labels_traefik_proxy_dimension_rule }}

roles/custom/matrix-nginx-proxy/templates/nginx/conf.d/matrix-sliding-sync-proxy.conf.j2

@@ -0,0 +1,100 @@
+#jinja2: lstrip_blocks: "True"
+
+{% macro render_vhost_directives() %}
+	gzip on;
+	gzip_types text/plain application/json application/javascript text/css image/x-icon font/ttf image/gif;
+	{% if matrix_nginx_proxy_hsts_preload_enabled %}
+		add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
+	{% else %}
+		add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
+	{% endif %}
+	add_header X-XSS-Protection "{{ matrix_nginx_proxy_xss_protection }}";
+	add_header X-Content-Type-Options nosniff;
+	{% if matrix_nginx_proxy_floc_optout_enabled %}
+		add_header Permissions-Policy interest-cohort=() always;
+	{% endif %}
+
+{% for configuration_block in matrix_nginx_proxy_proxy_sliding_sync_proxy_additional_server_configuration_blocks %}
+	{{- configuration_block }}
+{% endfor %}
+
+	location / {
+		{% if matrix_nginx_proxy_enabled %}
+			{# Use the embedded DNS resolver in Docker containers to discover the service #}
+			resolver {{ matrix_nginx_proxy_http_level_resolver }} valid=5s;
+			set $backend "matrix-sliding-sync-proxy:8008";
+			proxy_pass http://$backend;
+		{% else %}
+			{# Generic configuration for use outside of our container setup #}
+			proxy_pass http://127.0.0.1:8008;
+		{% endif %}
+
+		proxy_set_header Host $host;
+		proxy_set_header X-Forwarded-For {{ matrix_nginx_proxy_x_forwarded_for }};
+	}
+{% endmacro %}
+
+server {
+	listen {{ 8080 if matrix_nginx_proxy_enabled else 80 }};
+	listen [::]:{{ 8080 if matrix_nginx_proxy_enabled else 80 }};
+
+	server_name {{ matrix_nginx_proxy_proxy_sliding_sync_proxy_hostname }};
+
+	server_tokens off;
+	root /dev/null;
+
+	{% if matrix_nginx_proxy_https_enabled %}
+		location /.well-known/acme-challenge {
+			{% if matrix_nginx_proxy_enabled %}
+				{# Use the embedded DNS resolver in Docker containers to discover the service #}
+				resolver {{ matrix_nginx_proxy_http_level_resolver }} valid=5s;
+				set $backend "matrix-certbot:8080";
+				proxy_pass http://$backend;
+			{% else %}
+				{# Generic configuration for use outside of our container setup #}
+				proxy_pass http://127.0.0.1:{{ matrix_ssl_lets_encrypt_certbot_standalone_http_port }};
+			{% endif %}
+		}
+
+		location / {
+			return 301 https://$http_host$request_uri;
+		}
+	{% else %}
+		{{ render_vhost_directives() }}
+	{% endif %}
+}
+
+{% if matrix_nginx_proxy_https_enabled %}
+server {
+	listen {{ 8443 if matrix_nginx_proxy_enabled else 443 }} ssl http2;
+	listen [::]:{{ 8443 if matrix_nginx_proxy_enabled else 443 }} ssl http2;
+
+	server_name {{ matrix_nginx_proxy_proxy_sliding_sync_proxy_hostname }};
+
+	server_tokens off;
+	root /dev/null;
+
+	ssl_certificate {{ matrix_ssl_config_dir_path }}/live/{{ matrix_nginx_proxy_proxy_sliding_sync_proxy_hostname }}/fullchain.pem;
+	ssl_certificate_key {{ matrix_ssl_config_dir_path }}/live/{{ matrix_nginx_proxy_proxy_sliding_sync_proxy_hostname }}/privkey.pem;
+
+	ssl_protocols {{ matrix_nginx_proxy_ssl_protocols }};
+	{% if matrix_nginx_proxy_ssl_ciphers != '' %}
+	ssl_ciphers {{ matrix_nginx_proxy_ssl_ciphers }};
+	{% endif %}
+	ssl_prefer_server_ciphers {{ matrix_nginx_proxy_ssl_prefer_server_ciphers }};
+
+	{% if matrix_nginx_proxy_ocsp_stapling_enabled %}
+		ssl_stapling on;
+		ssl_stapling_verify on;
+		ssl_trusted_certificate {{ matrix_ssl_config_dir_path }}/live/{{ matrix_nginx_proxy_proxy_sliding_sync_proxy_hostname }}/chain.pem;
+	{% endif %}
+
+	{% if matrix_nginx_proxy_ssl_session_tickets_off %}
+		ssl_session_tickets off;
+	{% endif %}
+	ssl_session_cache {{ matrix_nginx_proxy_ssl_session_cache }};
+	ssl_session_timeout {{ matrix_nginx_proxy_ssl_session_timeout }};
+
+	{{ render_vhost_directives() }}
+}
+{% endif %}

roles/custom/matrix-sliding-sync-proxy/defaults/main.yml

@@ -0,0 +1,40 @@
+---
+# Sliding Sync Proxy is an implementation of MSC3575 for the new sliding sync
+
+matrix_sliding_sync_proxy_enabled: false
+
+matrix_sliding_sync_proxy_container_image_self_build: false
+matrix_sliding_sync_proxy_docker_repo: "https://github.com/matrix-org/sliding_sync_proxy/"
+matrix_sliding_sync_proxy_docker_repo_version: "{{ 'main' if matrix_sliding_sync_proxy_version == 'main' else matrix_sliding_sync_proxy_version }}"
+matrix_sliding_sync_proxy_docker_src_files_path: "{{ matrix_base_data_path }}/Dockerfile"
+
+matrix_sliding_sync_proxy_version: "v0.99.1"
+matrix_sliding_sync_proxy_docker_image: "{{ matrix_sliding_sync_proxy_docker_image_name_prefix }}matrix-org/sliding-sync:{{ matrix_sliding_sync_proxy_version }}"
+matrix_sliding_sync_proxy_docker_image_name_prefix: "{{ 'localhost/' if matrix_sliding_sync_proxy_container_image_self_build else 'ghcr.io/' }}"
+matrix_sliding_sync_proxy_docker_image_force_pull: "{{ matrix_sliding_sync_proxy_docker_image.endswith(':main') }}"
+
+# A list of extra arguments to pass to the container
+matrix_sliding_sync_proxy_container_extra_arguments: []
+
+# List of systemd services that matrix-sliding-sync-proxy.service depends on
+matrix_sliding_sync_proxy_systemd_required_services_list: ["docker.service"]
+
+# List of systemd services that matrix-sliding-sync-proxy.service wants
+matrix_sliding_sync_proxy_systemd_wanted_services_list: []
+
+# these must be set for sliding sync to properly start
+
+# custom secret used in the proxy
+matrix_sliding_sync_proxy_secret: ''
+
+# Database-related configuration fields.
+# Only Postgres is supported.
+matrix_sliding_sync_proxy_database_engine: "postgres"
+
+matrix_sliding_sync_proxy_database_username: 'matrix_sliding_sync'
+matrix_sliding_sync_proxy_database_password: 'not-a-real-password'
+matrix_sliding_sync_proxy_database_hostname: ''
+matrix_sliding_sync_proxy_database_port: 5432
+matrix_sliding_sync_proxy_database_name: 'matrix_sliding_sync'
+
+matrix_sliding_sync_proxy_database_connection_string: 'user={{ matrix_sliding_sync_proxy_database_username }} password={{ matrix_sliding_sync_proxy_database_password }} host={{ matrix_sliding_sync_proxy_database_hostname }} port={{ matrix_sliding_sync_proxy_database_port }} dbname={{ matrix_sliding_sync_proxy_database_name }} sslmode=disable'

roles/custom/matrix-sliding-sync-proxy/tasks/main.yml

@@ -0,0 +1,19 @@
+---
+- block:
+    - when: matrix_sliding_sync_proxy_enabled | bool
+      ansible.builtin.include_tasks: "{{ role_path }}/tasks/validate_config.yml"
+
+    - when: matrix_sliding_sync_proxy_enabled | bool
+      ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_install.yml"
+  tags:
+    - setup-all
+    - setup-sliding_sync_proxy
+    - install-all
+    - install-sliding_sync_proxy
+
+- block:
+    - when: not matrix_sliding_sync_proxy_enabled | bool
+      ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_uninstall.yml"
+  tags:
+    - setup-all
+    - setup-sliding_sync_proxy

roles/custom/matrix-sliding-sync-proxy/tasks/setup_install.yml

@@ -0,0 +1,56 @@
+---
+- name: Ensure sliding_sync_proxy paths exist
+  ansible.builtin.file:
+    path: "{{ item.path }}"
+    state: directory
+    mode: 0750
+    owner: "{{ matrix_user_username }}"
+    group: "{{ matrix_user_groupname }}"
+  with_items:
+    - {
+        path: "{{ matrix_sliding_sync_proxy_docker_src_files_path }}",
+        when: matrix_sliding_sync_proxy_container_image_self_build,
+      }
+  when: "item.when | bool"
+
+- name: Ensure sliding_sync_proxy image is pulled
+  community.docker.docker_image:
+    name: "{{ matrix_sliding_sync_proxy_docker_image }}"
+    source: "{{ 'pull' if ansible_version.major > 2 or ansible_version.minor > 7 else omit }}"
+    force_source: "{{ matrix_sliding_sync_proxy_docker_image_force_pull if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}"
+    force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else matrix_sliding_sync_proxy_docker_image_force_pull }}"
+  when: "not matrix_sliding_sync_proxy_container_image_self_build | bool"
+  register: result
+  retries: "{{ devture_playbook_help_container_retries_count }}"
+  delay: "{{ devture_playbook_help_container_retries_delay }}"
+  until: result is not failed
+
+- name: Ensure sliding_sync_proxy repository is present on self-build
+  ansible.builtin.git:
+    repo: "{{ matrix_sliding_sync_proxy_docker_repo }}"
+    version: "{{ matrix_sliding_sync_proxy_docker_repo_version }}"
+    dest: "{{ matrix_sliding_sync_proxy_docker_src_files_path }}"
+    force: "yes"
+  become: true
+  become_user: "{{ matrix_user_username }}"
+  register: matrix_sliding_sync_proxy_git_pull_results
+  when: "matrix_sliding_sync_proxy_container_image_self_build | bool"
+
+- name: Ensure sliding_sync_proxy image is built
+  community.docker.docker_image:
+    name: "{{ matrix_sliding_sync_proxy_docker_image }}"
+    source: build
+    force_source: "{{ matrix_sliding_sync_proxy_git_pull_results.changed if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}"
+    force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else matrix_mailer_git_pull_results.changed }}"
+    build:
+      dockerfile: Dockerfile
+      path: "{{ matrix_sliding_sync_proxy_docker_src_files_path }}"
+      pull: true
+  when: "matrix_sliding_sync_proxy_container_image_self_build | bool"
+
+- name: Ensure matrix-sliding-sync-proxy.service installed
+  ansible.builtin.template:
+    src: "{{ role_path }}/templates/systemd/matrix-sliding-sync-proxy.service.j2"
+    dest: "{{ devture_systemd_docker_base_systemd_path }}/matrix-sliding-sync-proxy.service"
+    mode: 0644
+  register: matrix_sliding_sync_proxy_systemd_service_result

roles/custom/matrix-sliding-sync-proxy/tasks/setup_uninstall.yml

@@ -0,0 +1,24 @@
+---
+- name: Check existence of matrix-sliding-sync-proxy service
+  ansible.builtin.stat:
+    path: "{{ devture_systemd_docker_base_systemd_path }}/matrix-sliding-sync-proxy.service"
+  register: matrix_sliding_sync_proxy_service_stat
+
+- when: matrix_sliding_sync_proxy_service_stat.stat.exists | bool
+  block:
+    - name: Ensure matrix-sliding-sync-proxy is stopped
+      ansible.builtin.service:
+        name: matrix-sliding-sync-proxy
+        state: stopped
+        enabled: false
+        daemon_reload: true
+
+    - name: Ensure matrix-sliding-sync-proxy.service doesn't exist
+      ansible.builtin.file:
+        path: "{{ devture_systemd_docker_base_systemd_path }}/matrix-sliding-sync-proxy.service"
+        state: absent
+
+    - name: Ensure matrix-sliding-sync-proxy paths don't exist
+      ansible.builtin.file:
+        path: "{{ matrix_sliding_sync_proxy_base_path }}"
+        state: absent

roles/custom/matrix-sliding-sync-proxy/tasks/validate_config.yml

@@ -0,0 +1,9 @@
+---
+- name: Fail if required matrix-sliding-sync-proxy settings not defined
+  ansible.builtin.fail:
+    msg: >
+      You need to define a required configuration setting (`{{ item.name }}`).
+  when: "item.when | bool and vars[item.name] == ''"
+  with_items:
+    - {'name': 'matrix_sliding_sync_proxy_secret', when: true}
+    - {'name': 'matrix_sliding_sync_proxy_database_hostname', when: "{{ matrix_sliding_sync_proxy_database_engine == 'postgres' }}"}

roles/custom/matrix-sliding-sync-proxy/templates/systemd/matrix-sliding-sync-proxy.service.j2

@@ -0,0 +1,43 @@
+#jinja2: lstrip_blocks: "True"
+[Unit]
+Description=Matrix sliding_sync_proxy Service
+{% for service in matrix_sliding_sync_proxy_systemd_required_services_list %}
+Requires={{ service }}
+After={{ service }}
+{% endfor %}
+{% for service in matrix_sliding_sync_proxy_systemd_wanted_services_list %}
+Wants={{ service }}
+{% endfor %}
+DefaultDependencies=no
+
+[Service]
+Type=simple
+Environment="HOME={{ devture_systemd_docker_base_systemd_unit_home_path }}"
+ExecStartPre=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} kill matrix-sliding-sync-proxy 2>/dev/null || true'
+ExecStartPre=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} rm matrix-sliding-sync-proxy 2>/dev/null || true'
+
+ExecStart={{ devture_systemd_docker_base_host_command_docker }} run --rm --name matrix-sliding-sync-proxy \
+			--log-driver=none \
+			--user={{ matrix_user_uid }}:{{ matrix_user_gid }} \
+			--cap-drop=ALL \
+			--read-only \
+			--tmpfs /tmp \
+			-e "SYNCV3_SERVER={{matrix_homeserver_url}}" \
+			-e "SYNCV3_SECRET={{matrix_sliding_sync_proxy_secret}}" \
+			-e "SYNCV3_BINDADDR=:8008" \
+			-e "SYNCV3_DB={{matrix_sliding_sync_proxy_database_connection_string}}" \
+			--network={{ matrix_docker_network }} \
+			{% for arg in matrix_sliding_sync_proxy_container_extra_arguments %}
+			{{ arg }} \
+			{% endfor %}
+			{{ matrix_sliding_sync_proxy_docker_image }} \
+			--config /config/config.yml
+
+ExecStop=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} kill matrix-sliding-sync-proxy 2>/dev/null || true'
+ExecStop=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} rm matrix-sliding-sync-proxy 2>/dev/null || true'
+Restart=always
+RestartSec=30
+SyslogIdentifier=matrix-sliding-sync-proxy
+
+[Install]
+WantedBy=multi-user.target