Add Matrix.to (#4750)

CHANGELOG.md

@@ -1,3 +1,11 @@
+# 2025-11-23
+
+## Matrix.to support
+
+The playbook now supports [Matrix.to](https://github.com/matrix-org/matrix.to) — a simple URL redirection service which powers [matrix.to](https://matrix.to).
+
+To learn more, see our [Setting up Matrix.to](docs/configuring-playbook-matrixto.md) documentation page.
+
 # 2025-11-09
 
 ## matrix-appservice-webhooks has been removed from the playbook

README.md

@@ -179,6 +179,7 @@ Various services that don't fit any other categories.
 | [synapse_auto_accept_invite](https://github.com/matrix-org/synapse-auto-accept-invite) | ❌ | Synapse module to automatically accept invites | [Link](docs/configuring-playbook-synapse-auto-accept-invite.md) |
 | [synapse_auto_compressor](https://github.com/matrix-org/rust-synapse-compress-state/#automated-tool-synapse_auto_compressor) | ❌ | Cli tool that automatically compresses `state_groups` database table in background | [Link](docs/configuring-playbook-synapse-auto-compressor.md) |
 | [Matrix Corporal](https://github.com/devture/matrix-corporal) (advanced) | ❌ | Reconciliator and gateway for a managed Matrix server | [Link](docs/configuring-playbook-matrix-corporal.md) |
+| [Matrix.to](https://github.com/matrix-org/matrix.to) | ❌ | Simple URL redirection service for the Matrix ecosystem | [Link](docs/configuring-playbook-matrixto.md) |
 | [Etherpad](https://etherpad.org) | ❌ | Open source collaborative text editor | [Link](docs/configuring-playbook-etherpad.md) |
 | [Jitsi](https://jitsi.org/) | ❌ | Open source video-conferencing platform | [Link](docs/configuring-playbook-jitsi.md) |
 | [Cactus Comments](https://cactus.chat) | ❌ | Federated comment system built on Matrix | [Link](docs/configuring-playbook-cactus-comments.md) |

docs/configuring-playbook-matrixto.md

@@ -0,0 +1,68 @@
+<!--
+SPDX-FileCopyrightText: 2023 - 2024 Slavi Pantaleev
+SPDX-FileCopyrightText: 2024 - 2025 Suguru Hirahara
+
+SPDX-License-Identifier: AGPL-3.0-or-later
+-->
+
+# Setting up Matrix.to (optional)
+
+The playbook can install and configure the [Matrix.to](https://github.com/matrix-org/matrix.to) URL redirection service for you.
+
+See the project's [documentation](https://github.com/matrix-org/matrix.to/blob/main/README.md) to learn what it does and why it might be useful to you.
+
+## Adjusting DNS records
+
+By default, this playbook installs Matrix.to on the `mt.` subdomain (`mt.example.com`) and requires you to create a CNAME record for `mt`, which targets `matrix.example.com`.
+
+When setting, replace `example.com` with your own.
+
+## Adjusting the playbook configuration
+
+To enable Matrix.to, add the following configuration to your `inventory/host_vars/matrix.example.com/vars.yml` file:
+
+```yaml
+matrix_matrixto_enabled: true
+```
+
+### Adjusting the Matrix.to URL (optional)
+
+By tweaking the `matrix_matrixto_hostname` variable, you can easily make the service available at a **different hostname** than the default one.
+
+Example additional configuration for your `vars.yml` file:
+
+```yaml
+# Change the default hostname
+matrix_matrixto_hostname: t.example.com
+```
+
+After changing the domain, **you may need to adjust your DNS** records to point the Matrix.to domain to the Matrix server.
+
+### Extending the configuration
+
+There are some additional things you may wish to configure about the server.
+
+Take a look at:
+
+- `roles/custom/matrix-matrixto/defaults/main.yml` for some variables that you can customize via your `vars.yml` file
+
+## Installing
+
+After configuring the playbook and potentially [adjusting your DNS records](#adjusting-dns-records), run the playbook with [playbook tags](playbook-tags.md) as below:
+
+<!-- NOTE: let this conservative command run (instead of install-all) to make it clear that failure of the command means something is clearly broken. -->
+```sh
+ansible-playbook -i inventory/hosts setup.yml --tags=setup-all,start
+```
+
+The shortcut commands with the [`just` program](just.md) are also available: `just install-all` or `just setup-all`
+
+`just install-all` is useful for maintaining your setup quickly ([2x-5x faster](../CHANGELOG.md#2x-5x-performance-improvements-in-playbook-runtime) than `just setup-all`) when its components remain unchanged. If you adjust your `vars.yml` to remove other components, you'd need to run `just setup-all`, or these components will still remain installed. Note these shortcuts run the `ensure-matrix-users-created` tag too.
+
+## Usage
+
+Refer to the project's [documentation](https://github.com/matrix-org/matrix.to/blob/main/README.md) for available parameters, etc.
+
+## Troubleshooting
+
+As with all other services, you can find the logs in [systemd-journald](https://www.freedesktop.org/software/systemd/man/systemd-journald.service.html) by logging in to the server with SSH and running `journalctl -fu matrix-matrixto`.

docs/configuring-playbook.md

@@ -247,6 +247,8 @@ Various services that don't fit any other categories.
 
 - [Setting up Matrix Corporal](configuring-playbook-matrix-corporal.md) (advanced)
 
+- [Setting up Matrix.to](configuring-playbook-matrixto.md)
+
 - [Setting up Etherpad](configuring-playbook-etherpad.md)
 
 - [Setting up the Jitsi video-conferencing platform](configuring-playbook-jitsi.md)

group_vars/matrix_servers

@@ -363,6 +363,8 @@ devture_systemd_service_manager_services_list_auto: |
     +
     ([{'name': 'matrix-coturn.service', 'priority': (900 if devture_systemd_service_manager_service_restart_mode == 'clean-stop-start' else 1500), 'groups': ['matrix', 'coturn']}] if matrix_coturn_enabled else [])
     +
+    ([{'name': 'matrix-matrixto.service', 'priority': 4000, 'groups': ['matrix', 'matrixto']}] if matrix_matrixto_enabled else [])
+    +
     ([{'name': 'matrix-rageshake.service', 'priority': 4000, 'groups': ['matrix', 'rageshake']}] if matrix_rageshake_enabled else [])
     +
     ([{'name': 'matrix-coturn-reload.timer', 'priority': 5000, 'groups': ['matrix', 'coturn']}] if (matrix_coturn_enabled and matrix_coturn_tls_enabled) else [])
@@ -3077,6 +3079,36 @@ matrix_corporal_matrix_registration_shared_secret: "{{ matrix_synapse_registrati
 #
 ######################################################################
 
+######################################################################
+#
+# matrix-matrixto
+#
+######################################################################
+
+# We don't enable matrixto by default.
+matrix_matrixto_enabled: false
+
+# The container image is not provided at https://github.com/matrix-org/matrix.to
+matrix_matrixto_container_image_self_build: true
+
+matrix_matrixto_hostname: "{{ matrix_server_fqn_matrixto }}"
+
+matrix_matrixto_container_network: matrix-matrixto
+
+matrix_matrixto_container_additional_networks: "{{ [matrix_playbook_reverse_proxyable_services_additional_network] if matrix_playbook_reverse_proxyable_services_additional_network else [] }}"
+
+matrix_matrixto_container_http_host_bind_port: "{{ (matrix_playbook_service_host_bind_interface_prefix ~ '5000') if matrix_playbook_service_host_bind_interface_prefix else '' }}"
+
+matrix_matrixto_container_labels_traefik_enabled: "{{ matrix_playbook_traefik_labels_enabled }}"
+matrix_matrixto_container_labels_traefik_docker_network: "{{ matrix_playbook_reverse_proxyable_services_additional_network }}"
+matrix_matrixto_container_labels_traefik_entrypoints: "{{ traefik_entrypoint_primary }}"
+matrix_matrixto_container_labels_traefik_tls_certResolver: "{{ traefik_certResolver_primary }}"
+
+######################################################################
+#
+# /matrix-matrixto
+#
+######################################################################
 
 ######################################################################
 #

roles/custom/matrix-base/defaults/main.yml

@@ -148,6 +148,9 @@ matrix_server_fqn_ntfy: "ntfy.{{ matrix_domain }}"
 # This is where you access rageshake.
 matrix_server_fqn_rageshake: "rageshake.{{ matrix_domain }}"
 
+# This is where you access Matrix.to.
+matrix_server_fqn_matrixto: "mt.{{ matrix_domain }}"
+
 matrix_federation_public_port: 8448
 
 # The name of the Traefik entrypoint for handling Matrix Federation

roles/custom/matrix-matrixto/defaults/main.yml

@@ -0,0 +1,178 @@
+# SPDX-FileCopyrightText: 2023 - 2024 Nikita Chernyi
+# SPDX-FileCopyrightText: 2023 - 2025 Slavi Pantaleev
+# SPDX-FileCopyrightText: 2024 Sergio Durigan Junior
+# SPDX-FileCopyrightText: 2025 MASH project contributors
+# SPDX-FileCopyrightText: 2025 Suguru Hirahara
+#
+# SPDX-License-Identifier: AGPL-3.0-or-later
+
+---
+# Project source code URL: https://app.radicle.xyz/nodes/seed.radicle.garden/rad%3Az3Re1EQbd186vUQDwHByYiLadsVWY
+
+matrix_matrixto_enabled: true
+
+matrix_matrixto_identifier: matrix-matrixto
+matrix_matrixto_base_path: "/{{ matrix_matrixto_identifier }}"
+
+matrix_matrixto_version: 1.2.17-1
+
+matrix_matrixto_scheme: https
+
+# The hostname at which Matrix.to is served.
+matrix_matrixto_hostname: ""
+
+# The path at which Matrix.to is exposed.
+# This value must either be `/` or not end with a slash (e.g. `/matrixto`).
+#
+# Hosting Matrix.to under a subpath does not seem to be possible due to Matrix.to's
+# technical limitations.
+matrix_matrixto_path_prefix: /
+
+matrix_matrixto_container_image: "{{ matrix_matrixto_container_image_registry_prefix }}shirahara/matrixto:{{ matrix_matrixto_container_image_tag }}"
+matrix_matrixto_container_image_tag: "{{ matrix_matrixto_version }}"
+matrix_matrixto_container_image_registry_prefix: "{{ matrix_matrixto_container_image_registry_prefix_upstream }}"
+matrix_matrixto_container_image_registry_prefix_upstream: "{{ matrix_matrixto_container_image_registry_prefix_upstream_default }}"
+matrix_matrixto_container_image_registry_prefix_upstream_default: ""
+matrix_matrixto_container_image_force_pull: "{{ matrix_matrixto_container_image.endswith(':latest') }}"
+
+matrix_matrixto_container_image_self_build: true
+matrix_matrixto_container_image_self_build_name: "shirahara/matrixto:{{ matrix_matrixto_container_image_self_build_repo_version }}"
+matrix_matrixto_container_image_self_build_repo: "https://seed.radicle.garden/z3Re1EQbd186vUQDwHByYiLadsVWY.git"
+matrix_matrixto_container_image_self_build_repo_version: "{{ matrix_matrixto_version if matrix_matrixto_version != 'latest' else 'main' }}"
+matrix_matrixto_container_image_self_build_src_files_path: "{{ matrix_matrixto_base_path }}/docker-src"
+
+# Controls whether the container exposes its HTTP port (tcp/8080 in the container).
+#
+# Takes an "<ip>:<port>" or "<port>" value (e.g. "127.0.0.1:2586"), or empty string to not expose.
+matrix_matrixto_container_http_host_bind_port: ""
+
+# The base container network. It will be auto-created by this role if it doesn't exist already.
+matrix_matrixto_container_network: "{{ matrix_matrixto_identifier }}"
+
+# The port number in the container
+matrix_matrixto_container_http_port: 5000
+
+# A list of additional container networks that the container would be connected to.
+# The role does not create these networks, so make sure they already exist.
+# Use this to expose this container to another reverse proxy, which runs in a different container network.
+matrix_matrixto_container_additional_networks: "{{ matrix_matrixto_container_additional_networks_auto + matrix_matrixto_container_additional_networks_custom }}"
+matrix_matrixto_container_additional_networks_auto: []
+matrix_matrixto_container_additional_networks_custom: []
+
+# A list of additional "volumes" to mount in the container.
+# This list gets populated dynamically at runtime. You can provide a different default value,
+# if you wish to mount your own files into the container.
+# Contains definition objects like this: `{"type": "bind", "src": "/outside", "dst": "/inside", "options": "readonly"}.
+# See the `--mount` documentation for the `docker run` command.
+matrix_matrixto_container_additional_volumes: "{{ matrix_matrixto_container_additional_volumes_auto + matrix_matrixto_container_additional_volumes_custom }}"
+matrix_matrixto_container_additional_volumes_auto: []
+matrix_matrixto_container_additional_volumes_custom: []
+
+# matrix_matrixto_container_labels_traefik_enabled controls whether labels to assist a Traefik reverse-proxy will be attached to the container.
+# See `../templates/labels.j2` for details.
+#
+# To inject your own other container labels, see `matrix_matrixto_container_labels_additional_labels`.
+matrix_matrixto_container_labels_traefik_enabled: true
+matrix_matrixto_container_labels_traefik_docker_network: "{{ matrix_matrixto_container_network }}"
+matrix_matrixto_container_labels_traefik_hostname: "{{ matrix_matrixto_hostname }}"
+# The path prefix must either be `/` or not end with a slash (e.g. `/matrixto`).
+matrix_matrixto_container_labels_traefik_path_prefix: "{{ matrix_matrixto_path_prefix }}"
+matrix_matrixto_container_labels_traefik_rule: "Host(`{{ matrix_matrixto_container_labels_traefik_hostname }}`){% if matrix_matrixto_container_labels_traefik_path_prefix != '/' %} && PathPrefix(`{{ matrix_matrixto_container_labels_traefik_path_prefix }}`){% endif %}"
+matrix_matrixto_container_labels_traefik_priority: 0
+matrix_matrixto_container_labels_traefik_entrypoints: web-secure
+matrix_matrixto_container_labels_traefik_tls: "{{ matrix_matrixto_container_labels_traefik_entrypoints != 'web' }}"
+matrix_matrixto_container_labels_traefik_tls_certResolver: default  # noqa var-naming
+
+# Controls which additional headers to attach to all HTTP requests.
+# To add your own custom request headers, use `matrix_matrixto_container_labels_traefik_additional_request_headers_custom`
+matrix_matrixto_container_labels_traefik_additional_request_headers: "{{ matrix_matrixto_container_labels_traefik_additional_request_headers_auto | combine(matrix_matrixto_container_labels_traefik_additional_request_headers_custom) }}"
+matrix_matrixto_container_labels_traefik_additional_request_headers_auto: {}
+matrix_matrixto_container_labels_traefik_additional_request_headers_custom: {}
+
+# Controls which additional headers to attach to all HTTP responses.
+# To add your own custom response headers, use `matrix_matrixto_container_labels_traefik_additional_response_headers_custom`
+matrix_matrixto_container_labels_traefik_additional_response_headers: "{{ matrix_matrixto_container_labels_traefik_additional_response_headers_auto | combine(matrix_matrixto_container_labels_traefik_additional_response_headers_custom) }}"
+matrix_matrixto_container_labels_traefik_additional_response_headers_auto: |
+  {{
+    {}
+    | combine ({'X-XSS-Protection': matrix_matrixto_http_header_xss_protection} if matrix_matrixto_http_header_xss_protection else {})
+    | combine ({'X-Content-Type-Options': matrix_matrixto_http_header_content_type_options} if matrix_matrixto_http_header_content_type_options else {})
+    | combine ({'Content-Security-Policy': matrix_matrixto_http_header_content_security_policy} if matrix_matrixto_http_header_content_security_policy else {})
+    | combine ({'Permissions-Policy': matrix_matrixto_http_header_permissions_policy} if matrix_matrixto_http_header_permissions_policy else {})
+    | combine ({'Strict-Transport-Security': matrix_matrixto_http_header_strict_transport_security} if matrix_matrixto_http_header_strict_transport_security and matrix_matrixto_container_labels_traefik_tls else {})
+  }}
+matrix_matrixto_container_labels_traefik_additional_response_headers_custom: {}
+
+# matrix_matrixto_container_labels_additional_labels contains a multiline string with additional labels to add to the container label file.
+# See `../templates/labels.j2` for details.
+#
+# Example:
+# matrix_matrixto_container_labels_additional_labels: |
+#   my.label=1
+#   another.label="here"
+matrix_matrixto_container_labels_additional_labels: ""
+
+# A list of extra arguments to pass to the container (`docker run` command)
+matrix_matrixto_container_extra_arguments: []
+
+# Specifies the value of the `X-XSS-Protection` header
+# Stops pages from loading when they detect reflected cross-site scripting (XSS) attacks.
+#
+# Learn more about it is here:
+# - https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-XSS-Protection
+# - https://portswigger.net/web-security/cross-site-scripting/reflected
+matrix_matrixto_http_header_xss_protection: "1; mode=block"
+
+# Specifies the value of the `X-Content-Type-Options` header.
+# See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Content-Type-Options
+matrix_matrixto_http_header_content_type_options: nosniff
+
+# Specifies the value of the `Content-Security-Policy` header.
+# See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy
+matrix_matrixto_http_header_content_security_policy: frame-ancestors 'self'
+
+# Specifies the value of the `Permissions-Policy` header.
+# See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Permissions-Policy
+matrix_matrixto_http_header_permissions_policy: "{{ 'interest-cohort=()' if matrix_matrixto_floc_optout_enabled else '' }}"
+
+# Specifies the value of the `Strict-Transport-Security` header.
+# See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security
+matrix_matrixto_http_header_strict_transport_security: "max-age=31536000; includeSubDomains{{ '; preload' if matrix_matrixto_hsts_preload_enabled else '' }}"
+
+# Controls whether to send a "Permissions-Policy interest-cohort=();" header along with all responses
+#
+# Learn more about what it is here:
+# - https://www.eff.org/deeplinks/2021/03/googles-floc-terrible-idea
+# - https://paramdeo.com/blog/opting-your-website-out-of-googles-floc-network
+# - https://amifloced.org/
+#
+# Of course, a better solution is to just stop using browsers (like Chrome), which participate in such tracking practices.
+# See: `matrix_matrixto_http_header_permissions_policy`
+matrix_matrixto_floc_optout_enabled: true
+
+# Controls if HSTS preloading is enabled
+#
+# In its strongest and recommended form, the [HSTS policy](https://www.chromium.org/hsts) includes all subdomains, and
+# indicates a willingness to be "preloaded" into browsers:
+# `Strict-Transport-Security: max-age=31536000; includeSubDomains; preload`
+# For more information visit:
+# - https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security
+# - https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security
+# - https://hstspreload.org/#opt-in
+# See: `matrix_matrixto_http_header_strict_transport_security`
+matrix_matrixto_hsts_preload_enabled: false
+
+# List of systemd services that the Matrix.to systemd service depends on
+matrix_matrixto_systemd_required_services_list: "{{ matrix_matrixto_systemd_required_services_list_default + matrix_matrixto_systemd_required_services_list_auto + matrix_matrixto_systemd_required_services_list_custom }}"
+matrix_matrixto_systemd_required_services_list_default: "{{ [devture_systemd_docker_base_docker_service_name] if devture_systemd_docker_base_docker_service_name else [] }}"
+matrix_matrixto_systemd_required_services_list_auto: []
+matrix_matrixto_systemd_required_services_list_custom: []
+
+# List of systemd services that the Matrix.to systemd service wants
+matrix_matrixto_systemd_wanted_services_list: "{{ matrix_matrixto_systemd_wanted_services_list_default + matrix_matrixto_systemd_wanted_services_list_auto + matrix_matrixto_systemd_wanted_services_list_custom }}"
+matrix_matrixto_systemd_wanted_services_list_default: []
+matrix_matrixto_systemd_wanted_services_list_auto: []
+matrix_matrixto_systemd_wanted_services_list_custom: []
+
+# Additional environment variables.
+matrix_matrixto_environment_variables_additional_variables: ""

roles/custom/matrix-matrixto/tasks/install.yml

@@ -0,0 +1,100 @@
+# SPDX-FileCopyrightText: 2023 - 2025 Slavi Pantaleev
+# SPDX-FileCopyrightText: 2025 Suguru Hirahara
+#
+# SPDX-License-Identifier: AGPL-3.0-or-later
+
+---
+- name: Ensure Matrix.to path exists
+  ansible.builtin.file:
+    path: "{{ item }}"
+    state: directory
+    mode: "0750"
+    owner: "{{ matrix_user_name }}"
+    group: "{{ matrix_group_name }}"
+  with_items:
+    - "{{ matrix_matrixto_base_path }}"
+
+- name: Ensure Matrix.to support files installed
+  ansible.builtin.template:
+    src: "{{ role_path }}/templates/{{ item }}.j2"
+    dest: "{{ matrix_matrixto_base_path }}/{{ item }}"
+    mode: "0640"
+    owner: "{{ matrix_user_name }}"
+    group: "{{ matrix_group_name }}"
+  with_items:
+    - env
+    - labels
+
+- name: Run if self-building of Matrix.to container image is not enabled
+  when: "not matrix_matrixto_container_image_self_build | bool"
+  block:
+    - name: Ensure Matrix.to container image is pulled via community.docker.docker_image
+      when: devture_systemd_docker_base_container_image_pull_method == 'ansible-module'
+      community.docker.docker_image:
+        name: "{{ matrix_matrixto_container_image }}"
+        source: "{{ 'pull' if ansible_version.major > 2 or ansible_version.minor > 7 else omit }}"
+        force_source: "{{ matrix_matrixto_container_image_force_pull if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}"
+        force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else matrix_matrixto_container_image_force_pull }}"
+      register: result
+      retries: "{{ devture_playbook_help_container_retries_count }}"
+      delay: "{{ devture_playbook_help_container_retries_delay }}"
+      until: result is not failed
+
+    - name: Ensure Matrix.to container image is pulled via ansible.builtin.command
+      when: devture_systemd_docker_base_container_image_pull_method == 'command'
+      ansible.builtin.command:
+        cmd: "{{ devture_systemd_docker_base_host_command_docker }} pull {{ matrix_matrixto_container_image }}"
+      register: result
+      retries: "{{ devture_playbook_help_container_retries_count }}"
+      delay: "{{ devture_playbook_help_container_retries_delay }}"
+      until: result is not failed
+      changed_when: "'Downloaded newer image' in result.stdout"
+
+- name: Run if self-building of Matrix.to container image is enabled
+  when: "matrix_matrixto_container_image_self_build | bool"
+  block:
+    - name: Ensure Matrix.to repository is present on self-build
+      ansible.builtin.git:
+        repo: "{{ matrix_matrixto_container_image_self_build_repo }}"
+        version: "{{ matrix_matrixto_container_image_self_build_repo_version }}"
+        dest: "{{ matrix_matrixto_container_image_self_build_src_files_path }}"
+        force: "yes"
+      register: matrix_matrixto_git_pull_results
+
+    - name: Ensure Matrix.to container image is built
+      community.docker.docker_image:
+        name: "{{ matrix_matrixto_container_image_self_build_name }}"
+        source: build
+        force_source: "{{ matrix_matrixto_git_pull_results.changed if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}"
+        force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else matrix_matrixto_git_pull_results.changed }}"
+        build:
+          dockerfile: Dockerfile
+          path: "{{ matrix_matrixto_container_image_self_build_src_files_path }}"
+          pull: true
+          args:
+
+- name: Ensure Matrix.to container network is created via community.docker.docker_network
+  when: devture_systemd_docker_base_container_network_creation_method == 'ansible-module'
+  community.docker.docker_network:
+    enable_ipv6: "{{ devture_systemd_docker_base_ipv6_enabled }}"
+    name: "{{ matrix_matrixto_container_network }}"
+    driver: bridge
+    driver_options: "{{ devture_systemd_docker_base_container_networks_driver_options }}"
+
+- name: Ensure Matrix.to container network is created via ansible.builtin.command
+  when: devture_systemd_docker_base_container_network_creation_method == 'command'
+  ansible.builtin.command:
+    cmd: >-
+      {{ devture_systemd_docker_base_host_command_docker }} network create
+      {% if devture_systemd_docker_base_ipv6_enabled %}--ipv6{% endif %}
+      {{ devture_systemd_docker_base_container_networks_driver_options_string }}
+      {{ matrix_matrixto_container_network }}
+  register: network_creation_result
+  changed_when: network_creation_result.rc == 0
+  failed_when: network_creation_result.rc != 0 and 'already exists' not in network_creation_result.stderr
+
+- name: Ensure Matrix.to systemd service is present
+  ansible.builtin.template:
+    src: "{{ role_path }}/templates/systemd/matrix-matrixto.service.j2"
+    dest: "{{ devture_systemd_docker_base_systemd_path }}/{{ matrix_matrixto_identifier }}.service"
+    mode: "0644"

roles/custom/matrix-matrixto/tasks/main.yml

@@ -0,0 +1,27 @@
+# SPDX-FileCopyrightText: 2023 Slavi Pantaleev
+# SPDX-FileCopyrightText: 2025 Suguru Hirahara
+#
+# SPDX-License-Identifier: AGPL-3.0-or-later
+
+---
+- name: Perform Matrix.to installation tasks
+  when: matrix_matrixto_enabled | bool
+  tags:
+    - setup-all
+    - setup-matrixto
+    - install-all
+    - install-matrixto
+  block:
+    - name: Validate Matrix.to configuration
+      ansible.builtin.include_tasks: "{{ role_path }}/tasks/validate_config.yml"
+    - name: Install Matrix.to
+      ansible.builtin.include_tasks: "{{ role_path }}/tasks/install.yml"
+
+- name: Perform Matrix.to uninstallation tasks
+  when: not matrix_matrixto_enabled | bool
+  tags:
+    - setup-all
+    - setup-matrixto
+  block:
+    - name: Uninstall Matrix.to
+      ansible.builtin.include_tasks: "{{ role_path }}/tasks/uninstall.yml"

roles/custom/matrix-matrixto/tasks/uninstall.yml

@@ -0,0 +1,45 @@
+# SPDX-FileCopyrightText: 2023 Slavi Pantaleev
+# SPDX-FileCopyrightText: 2025 Suguru Hirahara
+#
+# SPDX-License-Identifier: AGPL-3.0-or-later
+
+---
+- name: Check existence of Matrix.to systemd service
+  ansible.builtin.stat:
+    path: "{{ devture_systemd_docker_base_systemd_path }}/{{ matrix_matrixto_identifier }}.service"
+  register: matrix_matrixto_service_stat
+
+- name: Uninstall Matrix.to systemd services and files
+  when: matrix_matrixto_service_stat.stat.exists | bool
+  block:
+    - name: Ensure Matrix.to systemd service is stopped
+      ansible.builtin.service:
+        name: "{{ matrix_matrixto_identifier }}"
+        state: stopped
+        enabled: false
+        daemon_reload: true
+
+    - name: Ensure Matrix.to systemd service does not exist
+      ansible.builtin.file:
+        path: "{{ devture_systemd_docker_base_systemd_path }}/{{ matrix_matrixto_identifier }}.service"
+        state: absent
+
+    - name: Ensure Matrix.to container network does not exist via community.docker.docker_network
+      when: devture_systemd_docker_base_container_network_creation_method == 'ansible-module'
+      community.docker.docker_network:
+        name: "{{ matrix_matrixto_container_network }}"
+        state: absent
+
+    - name: Ensure Matrix.to container network does not exist via ansible.builtin.command
+      when: devture_systemd_docker_base_container_network_creation_method == 'command'
+      ansible.builtin.command:
+        cmd: >-
+          {{ devture_systemd_docker_base_host_command_docker }} network rm
+          {{ matrix_matrixto_container_network }}
+      register: network_deletion_result
+      changed_when: matrix_matrixto_container_network in network_deletion_result.stdout
+
+    - name: Ensure Matrix.to path does not exist
+      ansible.builtin.file:
+        path: "{{ matrix_matrixto_base_path }}"
+        state: absent

roles/custom/matrix-matrixto/tasks/validate_config.yml

@@ -0,0 +1,43 @@
+# SPDX-FileCopyrightText: 2023 Slavi Pantaleev
+# SPDX-FileCopyrightText: 2025 Suguru Hirahara
+#
+# SPDX-License-Identifier: AGPL-3.0-or-later
+
+---
+- name: Fail if required Matrix.to settings not defined
+  ansible.builtin.fail:
+    msg: >-
+      You need to define a required configuration setting (`{{ item }}`).
+  when: "lookup('vars', item, default='') | string | length == 0"
+  with_items:
+    - matrix_matrixto_hostname
+    - matrix_matrixto_path_prefix
+    - matrix_matrixto_container_network
+
+- name: Run if Traefik is enabled
+  when: matrix_matrixto_container_labels_traefik_enabled | bool
+  block:
+    - name: Fail if Traefik settings required for Matrix.to are not defined
+      ansible.builtin.fail:
+        msg: >-
+          You need to define a required configuration setting (`{{ item }}`).
+      when: "lookup('vars', item, default='') | string | length == 0"
+      with_items:
+        - matrix_matrixto_container_labels_traefik_hostname
+        - matrix_matrixto_container_labels_traefik_path_prefix
+
+    - name: Fail if matrix_matrixto_container_labels_traefik_path_prefix is different than /
+      ansible.builtin.fail:
+        msg: >-
+          matrix_matrixto_container_labels_traefik_path_prefix (`{{ matrix_matrixto_container_labels_traefik_path_prefix }}`) must be `/`.
+          Matrix.to does not support hosting under a subpath yet.
+      when: "matrix_matrixto_container_labels_traefik_path_prefix != '/'"
+
+    # We ensure it doesn't end with a slash, because we handle both (slash and no-slash).
+    # Knowing that `matrix_matrixto_container_labels_traefik_path_prefix` does not end with a slash
+    # ensures we know how to set these routes up without having to do "does it end with a slash" checks elsewhere.
+    - name: Fail if matrix_matrixto_container_labels_traefik_path_prefix ends with a slash
+      ansible.builtin.fail:
+        msg: >-
+          matrix_matrixto_container_labels_traefik_path_prefix (`{{ matrix_matrixto_container_labels_traefik_path_prefix }}`) must either be `/` or not end with a slash (e.g. `/matrixto`).
+      when: "matrix_matrixto_container_labels_traefik_path_prefix != '/' and matrix_matrixto_container_labels_traefik_path_prefix[-1] == '/'"

roles/custom/matrix-matrixto/templates/env.j2

@@ -0,0 +1,7 @@
+{#
+SPDX-FileCopyrightText: 2025 Suguru Hirahara
+
+SPDX-License-Identifier: AGPL-3.0-or-later
+#}
+
+{{ matrix_matrixto_environment_variables_additional_variables }}

roles/custom/matrix-matrixto/templates/labels.j2

@@ -0,0 +1,59 @@
+{#
+SPDX-FileCopyrightText: 2023 Slavi Pantaleev
+SPDX-FileCopyrightText: 2025 Suguru Hirahara
+
+SPDX-License-Identifier: AGPL-3.0-or-later
+#}
+
+{% if matrix_matrixto_container_labels_traefik_enabled %}
+traefik.enable=true
+
+{% if matrix_matrixto_container_labels_traefik_docker_network %}
+traefik.docker.network={{ matrix_matrixto_container_labels_traefik_docker_network }}
+{% endif %}
+
+{% set middlewares = [] %}
+
+{% if matrix_matrixto_container_labels_traefik_path_prefix != '/' %}
+traefik.http.middlewares.{{ matrix_matrixto_identifier }}-slashless-redirect.redirectregex.regex=^({{ matrix_matrixto_container_labels_traefik_path_prefix | quote }})$
+traefik.http.middlewares.{{ matrix_matrixto_identifier }}-slashless-redirect.redirectregex.replacement=${1}/
+{% set middlewares = middlewares + [matrix_matrixto_identifier + '-slashless-redirect'] %}
+{% endif %}
+
+{% if matrix_matrixto_container_labels_traefik_path_prefix != '/' %}
+traefik.http.middlewares.{{ matrix_matrixto_identifier }}-strip-prefix.stripprefix.prefixes={{ matrix_matrixto_container_labels_traefik_path_prefix }}
+{% set middlewares = middlewares + [matrix_matrixto_identifier + '-strip-prefix'] %}
+{% endif %}
+
+{% if matrix_matrixto_container_labels_traefik_additional_request_headers.keys() | length > 0 %}
+{% for name, value in matrix_matrixto_container_labels_traefik_additional_request_headers.items() %}
+traefik.http.middlewares.{{ matrix_matrixto_identifier }}-add-request-headers.headers.customrequestheaders.{{ name }}={{ value }}
+{% endfor %}
+{% set middlewares = middlewares + [matrix_matrixto_identifier + '-add-request-headers'] %}
+{% endif %}
+
+{% if matrix_matrixto_container_labels_traefik_additional_response_headers.keys() | length > 0 %}
+{% for name, value in matrix_matrixto_container_labels_traefik_additional_response_headers.items() %}
+traefik.http.middlewares.{{ matrix_matrixto_identifier }}-add-response-headers.headers.customresponseheaders.{{ name }}={{ value }}
+{% endfor %}
+{% set middlewares = middlewares + [matrix_matrixto_identifier + '-add-response-headers'] %}
+{% endif %}
+
+traefik.http.routers.{{ matrix_matrixto_identifier }}.rule={{ matrix_matrixto_container_labels_traefik_rule }}
+{% if matrix_matrixto_container_labels_traefik_priority | int > 0 %}
+traefik.http.routers.{{ matrix_matrixto_identifier }}.priority={{ matrix_matrixto_container_labels_traefik_priority }}
+{% endif %}
+traefik.http.routers.{{ matrix_matrixto_identifier }}.service={{ matrix_matrixto_identifier }}
+{% if middlewares | length > 0 %}
+traefik.http.routers.{{ matrix_matrixto_identifier }}.middlewares={{ middlewares | join(',') }}
+{% endif %}
+traefik.http.routers.{{ matrix_matrixto_identifier }}.entrypoints={{ matrix_matrixto_container_labels_traefik_entrypoints }}
+traefik.http.routers.{{ matrix_matrixto_identifier }}.tls={{ matrix_matrixto_container_labels_traefik_tls | to_json }}
+{% if matrix_matrixto_container_labels_traefik_tls %}
+traefik.http.routers.{{ matrix_matrixto_identifier }}.tls.certResolver={{ matrix_matrixto_container_labels_traefik_tls_certResolver }}
+{% endif %}
+
+traefik.http.services.{{ matrix_matrixto_identifier }}.loadbalancer.server.port={{ matrix_matrixto_container_http_port }}
+{% endif %}
+
+{{ matrix_matrixto_container_labels_additional_labels }}

roles/custom/matrix-matrixto/templates/systemd/matrix-matrixto.service.j2

@@ -0,0 +1,59 @@
+{#
+SPDX-FileCopyrightText: 2023 Slavi Pantaleev
+SPDX-FileCopyrightText: 2024 Nikita Chernyi
+SPDX-FileCopyrightText: 2025 Suguru Hirahara
+
+SPDX-License-Identifier: AGPL-3.0-or-later
+#}
+
+[Unit]
+Description=Matrix.to ({{ matrix_matrixto_identifier }})
+{% for service in matrix_matrixto_systemd_required_services_list %}
+Requires={{ service }}
+After={{ service }}
+{% endfor %}
+{% for service in matrix_matrixto_systemd_wanted_services_list %}
+Wants={{ service }}
+{% endfor %}
+DefaultDependencies=no
+
+[Service]
+Type=simple
+Environment="HOME={{ devture_systemd_docker_base_systemd_unit_home_path }}"
+ExecStartPre=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} stop -t {{ devture_systemd_docker_base_container_stop_grace_time_seconds }} {{ matrix_matrixto_identifier }} 2>/dev/null || true'
+ExecStartPre=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} rm {{ matrix_matrixto_identifier }} 2>/dev/null || true'
+
+ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} create \
+      --rm \
+      --name={{ matrix_matrixto_identifier }} \
+      --log-driver=none \
+      --user={{ matrix_user_uid }}:{{ matrix_user_gid }} \
+      --cap-drop=ALL \
+      --read-only \
+      --network={{ matrix_matrixto_container_network }} \
+      {% if matrix_matrixto_container_http_host_bind_port %}
+      -p {{ matrix_matrixto_container_http_host_bind_port }}:{{ matrix_matrixto_container_http_port }} \
+      {% endif %}
+      --env-file={{ matrix_matrixto_base_path }}/env \
+      --label-file={{ matrix_matrixto_base_path }}/labels \
+      --tmpfs=/tmp:rw,noexec,nosuid,size=128m \
+      {% for arg in matrix_matrixto_container_extra_arguments %}
+      {{ arg }} \
+      {% endfor %}
+      {{ matrix_matrixto_container_image_self_build_name if matrix_matrixto_container_image_self_build else matrix_matrixto_container_image }}
+
+{% for network in matrix_matrixto_container_additional_networks %}
+ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} network connect {{ network }} {{ matrix_matrixto_identifier }}
+{% endfor %}
+
+ExecStart={{ devture_systemd_docker_base_host_command_docker }} start --attach {{ matrix_matrixto_identifier }}
+
+ExecStop=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} stop -t {{ devture_systemd_docker_base_container_stop_grace_time_seconds }} {{ matrix_matrixto_identifier }} 2>/dev/null || true'
+ExecStop=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} rm {{ matrix_matrixto_identifier }} 2>/dev/null || true'
+
+Restart=always
+RestartSec=30
+SyslogIdentifier={{ matrix_matrixto_identifier }}
+
+[Install]
+WantedBy=multi-user.target

setup.yml

@@ -91,6 +91,7 @@
     - custom/matrix-bot-draupnir
     - custom/matrix-cactus-comments
     - custom/matrix-cactus-comments-client
+    - custom/matrix-matrixto
     - custom/matrix-rageshake
     - custom/matrix-synapse
     - custom/matrix-synapse-auto-compressor