From 8767f50d4672c2e443dd78a0e7453fc26b551e9e Mon Sep 17 00:00:00 2001
From: jasonlaguidice <19523621+jasonlaguidice@users.noreply.github.com>
Date: Sun, 8 Feb 2026 17:33:34 -0800
Subject: [PATCH] Add iMessage RustPush bridge
 (matrix-bridge-imessage-rustpush)

New role for bridging Matrix <-> iMessage using RustPush (lrhodin/imessage).
---
 ...uring-playbook-bridge-imessage-rustpush.md |  93 ++++++++
 ...aybook-bridge-imessage-rustpush.md.license |   3 +
 group_vars/matrix_servers                     |  93 ++++++++
 .../defaults/main.yml                         | 222 ++++++++++++++++++
 .../tasks/main.yml                            |  24 ++
 .../tasks/setup_install.yml                   | 115 +++++++++
 .../tasks/setup_uninstall.yml                 |  23 ++
 .../tasks/validate_config.yml                 |  19 ++
 .../templates/Dockerfile.j2                   |  45 ++++
 .../templates/Dockerfile.j2.license           |   3 +
 .../templates/config.yaml.j2                  | 190 +++++++++++++++
 .../templates/config.yaml.j2.license          |   3 +
 .../templates/labels.j2                       |  52 ++++
 .../templates/labels.j2.license               |   3 +
 .../matrix-imessage-rustpush.service.j2       |  48 ++++
 ...atrix-imessage-rustpush.service.j2.license |   3 +
 setup.yml                                     |   1 +
 17 files changed, 940 insertions(+)
 create mode 100644 docs/configuring-playbook-bridge-imessage-rustpush.md
 create mode 100644 docs/configuring-playbook-bridge-imessage-rustpush.md.license
 create mode 100644 roles/custom/matrix-bridge-imessage-rustpush/defaults/main.yml
 create mode 100644 roles/custom/matrix-bridge-imessage-rustpush/tasks/main.yml
 create mode 100644 roles/custom/matrix-bridge-imessage-rustpush/tasks/setup_install.yml
 create mode 100644 roles/custom/matrix-bridge-imessage-rustpush/tasks/setup_uninstall.yml
 create mode 100644 roles/custom/matrix-bridge-imessage-rustpush/tasks/validate_config.yml
 create mode 100644 roles/custom/matrix-bridge-imessage-rustpush/templates/Dockerfile.j2
 create mode 100644 roles/custom/matrix-bridge-imessage-rustpush/templates/Dockerfile.j2.license
 create mode 100644 roles/custom/matrix-bridge-imessage-rustpush/templates/config.yaml.j2
 create mode 100644 roles/custom/matrix-bridge-imessage-rustpush/templates/config.yaml.j2.license
 create mode 100644 roles/custom/matrix-bridge-imessage-rustpush/templates/labels.j2
 create mode 100644 roles/custom/matrix-bridge-imessage-rustpush/templates/labels.j2.license
 create mode 100644 roles/custom/matrix-bridge-imessage-rustpush/templates/systemd/matrix-imessage-rustpush.service.j2
 create mode 100644 roles/custom/matrix-bridge-imessage-rustpush/templates/systemd/matrix-imessage-rustpush.service.j2.license

diff --git a/docs/configuring-playbook-bridge-imessage-rustpush.md b/docs/configuring-playbook-bridge-imessage-rustpush.md
new file mode 100644
index 000000000..3db2e5250
--- /dev/null
+++ b/docs/configuring-playbook-bridge-imessage-rustpush.md
@@ -0,0 +1,93 @@
+<!--
+SPDX-FileCopyrightText: 2025 MDAD project contributors
+
+SPDX-License-Identifier: AGPL-3.0-or-later
+-->
+
+# Setting up iMessage RustPush bridging (optional)
+
+<sup>Refer the common guide for configuring mautrix bridges: [Setting up a Generic Mautrix Bridge](configuring-playbook-bridge-mautrix-bridges.md)</sup>
+
+The playbook can install and configure [mautrix-imessage with RustPush](https://github.com/lrhodin/imessage) for you, which provides a bridge to [iMessage](https://support.apple.com/messages) using Apple's push notification service (no Mac needed at runtime).
+
+See the project's [documentation](https://github.com/lrhodin/imessage/blob/main/README.md) to learn what it does and why it might be useful to you.
+
+**Note**: This bridge is built from source (no pre-built Docker image exists). The build process requires Rust, Go, and C toolchains, which means the initial build will take significant time and resources.
+
+## Prerequisites
+
+### Hardware Key Extraction
+
+To use this bridge on Linux (Docker), you need a **hardware key** extracted from a real Mac. This key contains hardware identifiers needed for iMessage registration.
+
+The key is entered interactively through the bridge bot's login flow (not configured via Ansible variables). See the upstream [README](https://github.com/lrhodin/imessage/blob/main/README.md) for instructions on extracting the key.
+
+### Enable Appservice Double Puppet (optional)
+
+If you want to set up [Double Puppeting](https://docs.mau.fi/bridges/general/double-puppeting.html) (hint: you most likely do) for this bridge automatically, you need to have enabled [Appservice Double Puppet](configuring-playbook-appservice-double-puppet.md) service for this playbook.
+
+See [this section](configuring-playbook-bridge-mautrix-bridges.md#set-up-double-puppeting-optional) on the [common guide for configuring mautrix bridges](configuring-playbook-bridge-mautrix-bridges.md) for details about setting up Double Puppeting.
+
+## Adjusting the playbook configuration
+
+To enable the bridge, add the following configuration to your `inventory/host_vars/matrix.example.com/vars.yml` file:
+
+```yaml
+matrix_imessage_rustpush_enabled: true
+```
+
+### Backfill (optional)
+
+Backfill is disabled by default because Linux Docker cannot access the macOS `chat.db` file. If you are running on macOS with Full Disk Access, you can enable it:
+
+```yaml
+matrix_imessage_rustpush_backfill_enabled: true
+matrix_imessage_rustpush_initial_sync_days: 365
+```
+
+### Extending the configuration
+
+There are some additional things you may wish to configure about the bridge.
+
+See [this section](configuring-playbook-bridge-mautrix-bridges.md#extending-the-configuration) on the [common guide for configuring mautrix bridges](configuring-playbook-bridge-mautrix-bridges.md) for details about variables that you can customize and the bridge's default configuration, including [bridge permissions](configuring-playbook-bridge-mautrix-bridges.md#configure-bridge-permissions-optional), [encryption support](configuring-playbook-bridge-mautrix-bridges.md#enable-encryption-optional), [bot's username](configuring-playbook-bridge-mautrix-bridges.md#set-the-bots-username-optional), etc.
+
+## Installing
+
+After configuring the playbook, run it with [playbook tags](playbook-tags.md) as below:
+
+<!-- NOTE: let this conservative command run (instead of install-all) to make it clear that failure of the command means something is clearly broken. -->
+```sh
+ansible-playbook -i inventory/hosts setup.yml --tags=setup-all,start
+```
+
+**Notes**:
+
+- The shortcut commands with the [`just` program](just.md) are also available: `just install-all` or `just setup-all`
+
+  `just install-all` is useful for maintaining your setup quickly ([2x-5x faster](../CHANGELOG.md#2x-5x-performance-improvements-in-playbook-runtime) than `just setup-all`) when its components remain unchanged. If you adjust your `vars.yml` to remove other components, you'd need to run `just setup-all`, or these components will still remain installed.
+
+- The first run will take longer than usual because the Docker image is built from source (Rust + Go compilation).
+
+## Usage
+
+To use the bridge, you need to start a chat with `@imessagebot:example.com` (where `example.com` is your base domain, not the `matrix.` domain).
+
+The bridge supports two login flows:
+
+1. **External Key Login** (Linux/Docker): Enter your hardware key (base64), then Apple ID credentials and 2FA code.
+2. **Apple ID Login** (macOS only): Enter Apple ID credentials and 2FA code directly.
+
+After logging in, the bridge will start receiving iMessages and creating portal rooms.
+
+## Troubleshooting
+
+As with all other services, you can find the logs in [systemd-journald](https://www.freedesktop.org/software/systemd/man/systemd-journald.service.html) by logging in to the server with SSH and running `journalctl -fu matrix-imessage-rustpush`.
+
+### Increase logging verbosity
+
+The default logging level for this component is `warn`. If you want to increase the verbosity, add the following configuration to your `vars.yml` file and re-run the playbook:
+
+```yaml
+# Valid values: fatal, error, warn, info, debug, trace
+matrix_imessage_rustpush_logging_level: 'debug'
+```
diff --git a/docs/configuring-playbook-bridge-imessage-rustpush.md.license b/docs/configuring-playbook-bridge-imessage-rustpush.md.license
new file mode 100644
index 000000000..826be4a75
--- /dev/null
+++ b/docs/configuring-playbook-bridge-imessage-rustpush.md.license
@@ -0,0 +1,3 @@
+SPDX-FileCopyrightText: 2025 MDAD project contributors
+
+SPDX-License-Identifier: AGPL-3.0-or-later
diff --git a/group_vars/matrix_servers b/group_vars/matrix_servers
index b46f0bfc4..9269b15f4 100755
--- a/group_vars/matrix_servers
+++ b/group_vars/matrix_servers
@@ -114,6 +114,8 @@ matrix_homeserver_container_extra_arguments_auto: |
     +
     (['--mount type=bind,src=' + matrix_mautrix_bluesky_config_path + '/registration.yaml,dst=/matrix-mautrix-bluesky-registration.yaml,ro'] if matrix_mautrix_bluesky_enabled else [])
     +
+    (['--mount type=bind,src=' + matrix_imessage_rustpush_config_path + '/registration.yaml,dst=/matrix-imessage-rustpush-registration.yaml,ro'] if matrix_imessage_rustpush_enabled else [])
+    +
     (['--mount type=bind,src=' + matrix_mautrix_discord_config_path + '/registration.yaml,dst=/matrix-mautrix-discord-registration.yaml,ro'] if matrix_mautrix_discord_enabled else [])
     +
     (['--mount type=bind,src=' + matrix_mautrix_slack_config_path + '/registration.yaml,dst=/matrix-mautrix-slack-registration.yaml,ro'] if matrix_mautrix_slack_enabled else [])
@@ -171,6 +173,8 @@ matrix_homeserver_app_service_config_files_auto: |
     +
     (['/matrix-mautrix-bluesky-registration.yaml'] if matrix_mautrix_bluesky_enabled else [])
     +
+    (['/matrix-imessage-rustpush-registration.yaml'] if matrix_imessage_rustpush_enabled else [])
+    +
     (['/matrix-mautrix-discord-registration.yaml'] if matrix_mautrix_discord_enabled else [])
     +
     (['/matrix-mautrix-slack-registration.yaml'] if matrix_mautrix_slack_enabled else [])
@@ -436,6 +440,13 @@ devture_systemd_service_manager_services_list_auto: |
       'groups': ['matrix', 'bridges', 'mautrix-bluesky'],
     }] if matrix_mautrix_bluesky_enabled else [])
     +
+    ([{
+      'name': 'matrix-imessage-rustpush.service',
+      'priority': 2000,
+      'restart_necessary': (matrix_imessage_rustpush_restart_necessary | bool),
+      'groups': ['matrix', 'bridges', 'imessage-rustpush'],
+    }] if matrix_imessage_rustpush_enabled else [])
+    +
     ([{
       'name': 'matrix-mautrix-discord.service',
       'priority': 2000,
@@ -1469,6 +1480,77 @@ matrix_mautrix_bluesky_database_password: "{{ (matrix_homeserver_generic_secret_
 #
 ######################################################################
 
+
+######################################################################
+#
+# matrix-bridge-imessage-rustpush
+#
+######################################################################
+
+# We don't enable bridges by default.
+matrix_imessage_rustpush_enabled: false
+
+matrix_imessage_rustpush_systemd_required_services_list_auto: |
+  {{
+    matrix_addons_homeserver_systemd_services_list
+    +
+    ([postgres_identifier ~ '.service'] if (postgres_enabled and matrix_imessage_rustpush_database_hostname == postgres_connection_hostname) else [])
+  }}
+
+matrix_imessage_rustpush_container_network: "{{ matrix_addons_container_network }}"
+
+matrix_imessage_rustpush_container_additional_networks_auto: |-
+  {{
+    (
+      ([] if matrix_addons_homeserver_container_network == '' else [matrix_addons_homeserver_container_network])
+      +
+      ([postgres_container_network] if (postgres_enabled and matrix_imessage_rustpush_database_hostname == postgres_connection_hostname and matrix_imessage_rustpush_container_network != postgres_container_network) else [])
+      +
+      ([matrix_playbook_reverse_proxyable_services_additional_network] if matrix_playbook_reverse_proxyable_services_additional_network and matrix_imessage_rustpush_container_labels_traefik_enabled else [])
+    ) | unique
+  }}
+
+matrix_imessage_rustpush_container_labels_traefik_enabled: "{{ matrix_playbook_reverse_proxy_type in ['playbook-managed-traefik', 'other-traefik-container'] }}"
+matrix_imessage_rustpush_container_labels_traefik_docker_network: "{{ matrix_playbook_reverse_proxyable_services_additional_network }}"
+matrix_imessage_rustpush_container_labels_traefik_entrypoints: "{{ traefik_entrypoint_primary }}"
+matrix_imessage_rustpush_container_labels_traefik_tls_certResolver: "{{ traefik_certResolver_primary }}"
+
+matrix_imessage_rustpush_container_labels_metrics_middleware_basic_auth_enabled: "{{ matrix_metrics_exposure_http_basic_auth_enabled }}"
+matrix_imessage_rustpush_container_labels_metrics_middleware_basic_auth_users: "{{ matrix_metrics_exposure_http_basic_auth_users }}"
+
+matrix_imessage_rustpush_appservice_token: "{{ (matrix_homeserver_generic_secret_key + ':imsg.as.token') | hash('sha512') | to_uuid }}"
+
+matrix_imessage_rustpush_homeserver_address: "{{ matrix_addons_homeserver_client_api_url }}"
+matrix_imessage_rustpush_homeserver_token: "{{ (matrix_homeserver_generic_secret_key + ':imsg.hs.token') | hash('sha512') | to_uuid }}"
+
+matrix_imessage_rustpush_homeserver_async_media: "{{ matrix_homeserver_implementation in ['synapse'] }}"
+
+matrix_imessage_rustpush_provisioning_shared_secret: "{{ (matrix_homeserver_generic_secret_key + ':mau.imsg.prov') | hash('sha512') | to_uuid }}"
+
+matrix_imessage_rustpush_double_puppet_secrets_auto: |-
+  {{
+    ({
+      matrix_imessage_rustpush_homeserver_domain: ("as_token:" + matrix_appservice_double_puppet_registration_as_token)
+    })
+    if matrix_appservice_double_puppet_enabled
+    else {}
+  }}
+
+matrix_imessage_rustpush_metrics_enabled: "{{ prometheus_enabled or matrix_metrics_exposure_enabled }}"
+
+matrix_imessage_rustpush_metrics_proxying_enabled: "{{ matrix_imessage_rustpush_metrics_enabled and matrix_metrics_exposure_enabled }}"
+matrix_imessage_rustpush_metrics_proxying_hostname: "{{ matrix_metrics_exposure_hostname }}"
+matrix_imessage_rustpush_metrics_proxying_path_prefix: "{{ matrix_metrics_exposure_path_prefix }}/imessage-rustpush"
+
+matrix_imessage_rustpush_database_hostname: "{{ postgres_connection_hostname if postgres_enabled else '' }}"
+matrix_imessage_rustpush_database_password: "{{ (matrix_homeserver_generic_secret_key + ':mau.imsg.db') | hash('sha512') | to_uuid if postgres_enabled else '' }}"
+
+######################################################################
+#
+# /matrix-bridge-imessage-rustpush
+#
+######################################################################
+
 ######################################################################
 #
 # matrix-bridge-mautrix-discord
@@ -4052,6 +4134,12 @@ postgres_managed_databases_auto: |
       'password': matrix_mautrix_bluesky_database_password,
     }] if (matrix_mautrix_bluesky_enabled and matrix_mautrix_bluesky_database_engine == 'postgres' and matrix_mautrix_bluesky_database_hostname == postgres_connection_hostname) else [])
     +
+    ([{
+      'name': matrix_imessage_rustpush_database_name,
+      'username': matrix_imessage_rustpush_database_username,
+      'password': matrix_imessage_rustpush_database_password,
+    }] if (matrix_imessage_rustpush_enabled and matrix_imessage_rustpush_database_engine == 'postgres' and matrix_imessage_rustpush_database_hostname == postgres_connection_hostname) else [])
+    +
     ([{
       'name': matrix_mautrix_googlechat_database_name,
       'username': matrix_mautrix_googlechat_database_username,
@@ -4992,6 +5080,11 @@ matrix_ketesa_config_asManagedUsers_auto: |
       '^@bluesky_[a-zA-Z0-9]+:'+(matrix_domain | regex_escape)+'$',
     ] if matrix_mautrix_bluesky_enabled else [])
     +
+    ([
+      '^@'+(matrix_imessage_rustpush_appservice_bot_username | default('') | regex_escape)+':'+(matrix_domain | regex_escape)+'$',
+      '^@imessage_[a-zA-Z0-9_.+-]+:'+(matrix_domain | regex_escape)+'$',
+    ] if matrix_imessage_rustpush_enabled else [])
+    +
     ([
       '^@'+(matrix_mautrix_discord_appservice_bot_username | default('') | regex_escape)+':'+(matrix_domain | regex_escape)+'$',
       '^@discord_[0-9]+:'+(matrix_domain | regex_escape)+'$',
diff --git a/roles/custom/matrix-bridge-imessage-rustpush/defaults/main.yml b/roles/custom/matrix-bridge-imessage-rustpush/defaults/main.yml
new file mode 100644
index 000000000..c0ae1cb31
--- /dev/null
+++ b/roles/custom/matrix-bridge-imessage-rustpush/defaults/main.yml
@@ -0,0 +1,222 @@
+# SPDX-FileCopyrightText: 2025 MDAD project contributors
+#
+# SPDX-License-Identifier: AGPL-3.0-or-later
+
+---
+# matrix-bridge-imessage-rustpush is a Matrix <-> iMessage bridge using RustPush
+# Project source code URL: https://github.com/lrhodin/imessage
+
+matrix_imessage_rustpush_enabled: true
+
+# No upstream Docker image exists; self-build is always required.
+matrix_imessage_rustpush_container_image_self_build: true
+matrix_imessage_rustpush_container_image_self_build_repo: "https://github.com/lrhodin/imessage.git"
+matrix_imessage_rustpush_container_image_self_build_repo_version: "{{ 'main' if matrix_imessage_rustpush_version == 'latest' else matrix_imessage_rustpush_version }}"
+
+matrix_imessage_rustpush_version: latest
+matrix_imessage_rustpush_docker_image: "{{ matrix_imessage_rustpush_docker_image_registry_prefix }}lrhodin/imessage:{{ matrix_imessage_rustpush_version }}"
+matrix_imessage_rustpush_docker_image_registry_prefix: "localhost/"
+matrix_imessage_rustpush_docker_image_force_pull: "{{ matrix_imessage_rustpush_docker_image.endswith(':latest') }}"
+
+matrix_imessage_rustpush_base_path: "{{ matrix_base_data_path }}/imessage-rustpush"
+matrix_imessage_rustpush_config_path: "{{ matrix_imessage_rustpush_base_path }}/config"
+matrix_imessage_rustpush_data_path: "{{ matrix_imessage_rustpush_base_path }}/data"
+matrix_imessage_rustpush_docker_src_files_path: "{{ matrix_imessage_rustpush_base_path }}/docker-src"
+
+matrix_imessage_rustpush_homeserver_address: ""
+# Whether asynchronous uploads via MSC2246 should be enabled for media.
+matrix_imessage_rustpush_homeserver_async_media: false
+matrix_imessage_rustpush_homeserver_domain: '{{ matrix_domain }}'
+matrix_imessage_rustpush_appservice_address: 'http://matrix-imessage-rustpush:8081'
+
+matrix_imessage_rustpush_msc4190_enabled: "{{ matrix_bridges_msc4190_enabled }}"
+matrix_imessage_rustpush_self_sign_enabled: "{{ matrix_bridges_self_sign_enabled }}"
+
+# A public address that external services can use to reach this appservice.
+matrix_imessage_rustpush_appservice_public_address: ''
+
+# Displayname template for iMessage contacts.
+# Available variables: {{.FirstName}}, {{.LastName}}, {{.Nickname}},
+# {{.Phone}}, {{.Email}}, {{.ID}}
+matrix_imessage_rustpush_network_displayname_template: "{% raw %}{{if .FirstName}}{{.FirstName}}{{if .LastName}} {{.LastName}}{{end}}{{else if .Nickname}}{{.Nickname}}{{else if .Phone}}{{.Phone}}{{else if .Email}}{{.Email}}{{else}}{{.ID}}{{end}}{% endraw %}"
+
+matrix_imessage_rustpush_bridge_command_prefix: "!imessage"
+
+matrix_imessage_rustpush_bridge_permissions: |
+  {{
+    {matrix_imessage_rustpush_homeserver_domain: 'user'}
+    | combine({matrix_admin: 'admin'} if matrix_admin else {})
+  }}
+
+matrix_imessage_rustpush_container_network: ""
+
+matrix_imessage_rustpush_container_additional_networks: "{{ matrix_imessage_rustpush_container_additional_networks_auto + matrix_imessage_rustpush_container_additional_networks_custom }}"
+matrix_imessage_rustpush_container_additional_networks_auto: []
+matrix_imessage_rustpush_container_additional_networks_custom: []
+
+# matrix_imessage_rustpush_container_labels_traefik_enabled controls whether labels to assist a Traefik reverse-proxy will be attached to the container.
+# See `../templates/labels.j2` for details.
+#
+# To inject your own other container labels, see `matrix_imessage_rustpush_container_labels_additional_labels`.
+matrix_imessage_rustpush_container_labels_traefik_enabled: true
+matrix_imessage_rustpush_container_labels_traefik_docker_network: "{{ matrix_imessage_rustpush_container_network }}"
+matrix_imessage_rustpush_container_labels_traefik_entrypoints: web-secure
+matrix_imessage_rustpush_container_labels_traefik_tls_certResolver: default  # noqa var-naming
+
+# Controls whether labels will be added that expose metrics
+matrix_imessage_rustpush_container_labels_metrics_enabled: "{{ matrix_imessage_rustpush_metrics_enabled and matrix_imessage_rustpush_metrics_proxying_enabled }}"
+matrix_imessage_rustpush_container_labels_metrics_traefik_rule: "Host(`{{ matrix_imessage_rustpush_metrics_proxying_hostname }}`) && PathPrefix(`{{ matrix_imessage_rustpush_metrics_proxying_path_prefix }}`)"
+matrix_imessage_rustpush_container_labels_metrics_traefik_priority: 0
+matrix_imessage_rustpush_container_labels_metrics_traefik_entrypoints: "{{ matrix_imessage_rustpush_container_labels_traefik_entrypoints }}"
+matrix_imessage_rustpush_container_labels_metrics_traefik_tls: "{{ matrix_imessage_rustpush_container_labels_metrics_traefik_entrypoints != 'web' }}"
+matrix_imessage_rustpush_container_labels_metrics_traefik_tls_certResolver: "{{ matrix_imessage_rustpush_container_labels_traefik_tls_certResolver }}"  # noqa var-naming
+matrix_imessage_rustpush_container_labels_metrics_middleware_basic_auth_enabled: false
+# See: https://doc.traefik.io/traefik/middlewares/http/basicauth/#users
+matrix_imessage_rustpush_container_labels_metrics_middleware_basic_auth_users: ''
+
+# matrix_imessage_rustpush_container_labels_additional_labels contains a multiline string with additional labels to add to the container label file.
+# See `../templates/labels.j2` for details.
+#
+# Example:
+# matrix_imessage_rustpush_container_labels_additional_labels: |
+#   my.label=1
+#   another.label="here"
+matrix_imessage_rustpush_container_labels_additional_labels: ''
+
+# A list of extra arguments to pass to the container
+matrix_imessage_rustpush_container_extra_arguments: []
+
+# List of systemd services that matrix-imessage-rustpush.service depends on.
+matrix_imessage_rustpush_systemd_required_services_list: "{{ matrix_imessage_rustpush_systemd_required_services_list_default + matrix_imessage_rustpush_systemd_required_services_list_auto + matrix_imessage_rustpush_systemd_required_services_list_custom }}"
+matrix_imessage_rustpush_systemd_required_services_list_default: "{{ [devture_systemd_docker_base_docker_service_name] if devture_systemd_docker_base_docker_service_name else [] }}"
+matrix_imessage_rustpush_systemd_required_services_list_auto: []
+matrix_imessage_rustpush_systemd_required_services_list_custom: []
+
+# List of systemd services that matrix-imessage-rustpush.service wants
+matrix_imessage_rustpush_systemd_wanted_services_list: []
+
+matrix_imessage_rustpush_appservice_token: ''
+matrix_imessage_rustpush_homeserver_token: ''
+
+# Whether or not created rooms should have federation enabled.
+# If false, created portal rooms will never be federated.
+matrix_imessage_rustpush_matrix_federate_rooms: true
+
+# Database-related configuration fields.
+#
+# To use Postgres:
+# - adjust your database credentials via the `matrix_imessage_rustpush_postgres_*` variables
+matrix_imessage_rustpush_database_engine: 'postgres'
+
+matrix_imessage_rustpush_database_username: 'matrix_imessage_rustpush'
+matrix_imessage_rustpush_database_password: 'some-password'
+matrix_imessage_rustpush_database_hostname: ''
+matrix_imessage_rustpush_database_port: 5432
+matrix_imessage_rustpush_database_name: 'matrix_imessage_rustpush'
+matrix_imessage_rustpush_database_sslmode: disable
+
+matrix_imessage_rustpush_database_connection_string: 'postgres://{{ matrix_imessage_rustpush_database_username }}:{{ matrix_imessage_rustpush_database_password }}@{{ matrix_imessage_rustpush_database_hostname }}:{{ matrix_imessage_rustpush_database_port }}/{{ matrix_imessage_rustpush_database_name }}?sslmode={{ matrix_imessage_rustpush_database_sslmode }}'
+
+matrix_imessage_rustpush_database_uri: "{{
+	{
+		'postgres': matrix_imessage_rustpush_database_connection_string,
+	}[matrix_imessage_rustpush_database_engine]
+}}"
+
+matrix_imessage_rustpush_double_puppet_secrets: "{{ matrix_imessage_rustpush_double_puppet_secrets_auto | combine(matrix_imessage_rustpush_double_puppet_secrets_custom) }}"
+matrix_imessage_rustpush_double_puppet_secrets_auto: {}
+matrix_imessage_rustpush_double_puppet_secrets_custom: {}
+
+matrix_imessage_rustpush_appservice_bot_username: imessagebot
+matrix_imessage_rustpush_appservice_bot_displayname: iMessage bridge bot
+matrix_imessage_rustpush_appservice_bot_avatar: ''
+
+# Backfill is disabled by default because Linux Docker cannot access chat.db.
+# On macOS with Full Disk Access, this can be set to true.
+matrix_imessage_rustpush_backfill_enabled: false
+# Maximum number of messages to backfill in empty rooms
+matrix_imessage_rustpush_backfill_max_initial_messages: 50
+
+# Maximum number of missed messages to backfill after bridge restarts
+matrix_imessage_rustpush_backfill_max_catchup_messages: 500
+
+# How many days back to look for chats during initial sync.
+# Default in upstream is 365 (1 year). Set to 0 to disable.
+matrix_imessage_rustpush_initial_sync_days: 0
+
+# Shared secret for authentication of provisioning API requests.
+# If set to "disable", the provisioning API will be disabled.
+matrix_imessage_rustpush_provisioning_shared_secret: disable
+
+# Minimum severity of journal log messages.
+# Valid values: fatal, error, warn, info, debug, trace
+matrix_imessage_rustpush_logging_level: 'warn'
+
+# Whether or not metrics endpoint should be enabled.
+# Enabling them is usually enough for a local (in-container) Prometheus to consume them.
+# If metrics need to be consumed by another (external) Prometheus server, consider exposing them via `matrix_imessage_rustpush_metrics_proxying_enabled`.
+matrix_imessage_rustpush_metrics_enabled: false
+
+# Controls whether metrics should be exposed on a public URL.
+matrix_imessage_rustpush_metrics_proxying_enabled: false
+matrix_imessage_rustpush_metrics_proxying_hostname: ''
+matrix_imessage_rustpush_metrics_proxying_path_prefix: ''
+
+# Default configuration template which covers the generic use case.
+# You can customize it by controlling the various variables inside it.
+#
+# For a more advanced customization, you can extend the default (see `matrix_imessage_rustpush_configuration_extension_yaml`)
+# or completely replace this variable with your own template.
+matrix_imessage_rustpush_configuration_yaml: "{{ lookup('template', 'templates/config.yaml.j2') }}"
+
+matrix_imessage_rustpush_configuration_extension_yaml: |
+  # Your custom YAML configuration goes here.
+  # This configuration extends the default starting configuration (`matrix_imessage_rustpush_configuration_yaml`).
+  #
+  # You can override individual variables from the default configuration, or introduce new ones.
+  #
+  # If you need something more special, you can take full control by
+  # completely redefining `matrix_imessage_rustpush_configuration_yaml`.
+
+matrix_imessage_rustpush_configuration_extension: "{{ matrix_imessage_rustpush_configuration_extension_yaml | from_yaml if matrix_imessage_rustpush_configuration_extension_yaml | from_yaml is mapping else {} }}"
+
+# Holds the final configuration (a combination of the default and its extension).
+# You most likely don't need to touch this variable. Instead, see `matrix_imessage_rustpush_configuration_yaml`.
+matrix_imessage_rustpush_configuration: "{{ matrix_imessage_rustpush_configuration_yaml | from_yaml | combine(matrix_imessage_rustpush_configuration_extension, recursive=True) }}"
+
+matrix_imessage_rustpush_registration_yaml: |
+  id: imessage-rustpush
+  as_token: "{{ matrix_imessage_rustpush_appservice_token }}"
+  hs_token: "{{ matrix_imessage_rustpush_homeserver_token }}"
+  namespaces:
+    users:
+    - exclusive: true
+      regex: '^@imessage_.+:{{ matrix_imessage_rustpush_homeserver_domain | regex_escape }}$'
+    - exclusive: true
+      regex: '^@{{ matrix_imessage_rustpush_appservice_bot_username | regex_escape }}:{{ matrix_imessage_rustpush_homeserver_domain | regex_escape }}$'
+  url: {{ matrix_imessage_rustpush_appservice_address }}
+  sender_localpart: _bot_{{ matrix_imessage_rustpush_appservice_bot_username }}
+  rate_limited: false
+  de.sorunome.msc2409.push_ephemeral: true
+  receive_ephemeral: true
+  io.element.msc4190: {{ matrix_imessage_rustpush_msc4190_enabled | to_json }}
+
+matrix_imessage_rustpush_registration: "{{ matrix_imessage_rustpush_registration_yaml | from_yaml }}"
+
+# Enable End-to-bridge encryption
+matrix_imessage_rustpush_bridge_encryption_allow: "{{ matrix_bridges_encryption_enabled }}"
+matrix_imessage_rustpush_bridge_encryption_default: "{{ matrix_bridges_encryption_default }}"
+matrix_imessage_rustpush_bridge_encryption_require: false
+matrix_imessage_rustpush_bridge_encryption_appservice: false
+matrix_imessage_rustpush_bridge_encryption_key_sharing_allow: "{{ matrix_imessage_rustpush_bridge_encryption_allow }}"
+matrix_imessage_rustpush_bridge_encryption_pickle_key: mautrix.bridge.e2ee
+
+# matrix_imessage_rustpush_restart_necessary controls whether the service
+# will be restarted (when true) or merely started (when false) by the
+# systemd service manager role (when conditional restart is enabled).
+#
+# This value is automatically computed during installation based on whether
+# any configuration files, the systemd service file, or the container image changed.
+# The default of `false` means "no restart needed" — appropriate when the role's
+# installation tasks haven't run (e.g., due to --tags skipping them).
+matrix_imessage_rustpush_restart_necessary: false
diff --git a/roles/custom/matrix-bridge-imessage-rustpush/tasks/main.yml b/roles/custom/matrix-bridge-imessage-rustpush/tasks/main.yml
new file mode 100644
index 000000000..a6cd72ef0
--- /dev/null
+++ b/roles/custom/matrix-bridge-imessage-rustpush/tasks/main.yml
@@ -0,0 +1,24 @@
+# SPDX-FileCopyrightText: 2025 MDAD project contributors
+#
+# SPDX-License-Identifier: AGPL-3.0-or-later
+
+---
+
+- tags:
+    - setup-all
+    - setup-imessage-rustpush
+    - install-all
+    - install-imessage-rustpush
+  block:
+    - when: matrix_imessage_rustpush_enabled | bool
+      ansible.builtin.include_tasks: "{{ role_path }}/tasks/validate_config.yml"
+
+    - when: matrix_imessage_rustpush_enabled | bool
+      ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_install.yml"
+
+- tags:
+    - setup-all
+    - setup-imessage-rustpush
+  block:
+    - when: not matrix_imessage_rustpush_enabled | bool
+      ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_uninstall.yml"
diff --git a/roles/custom/matrix-bridge-imessage-rustpush/tasks/setup_install.yml b/roles/custom/matrix-bridge-imessage-rustpush/tasks/setup_install.yml
new file mode 100644
index 000000000..0fe6e7285
--- /dev/null
+++ b/roles/custom/matrix-bridge-imessage-rustpush/tasks/setup_install.yml
@@ -0,0 +1,115 @@
+# SPDX-FileCopyrightText: 2025 MDAD project contributors
+#
+# SPDX-License-Identifier: AGPL-3.0-or-later
+
+---
+
+- name: Ensure iMessage RustPush paths exist
+  ansible.builtin.file:
+    path: "{{ item.path }}"
+    state: directory
+    mode: 0750
+    owner: "{{ matrix_user_name }}"
+    group: "{{ matrix_group_name }}"
+  with_items:
+    - {path: "{{ matrix_imessage_rustpush_base_path }}", when: true}
+    - {path: "{{ matrix_imessage_rustpush_config_path }}", when: true}
+    - {path: "{{ matrix_imessage_rustpush_data_path }}", when: true}
+    - {path: "{{ matrix_imessage_rustpush_docker_src_files_path }}", when: "{{ matrix_imessage_rustpush_container_image_self_build }}"}
+  when: item.when | bool
+
+- name: Ensure iMessage RustPush repository is present on self-build
+  ansible.builtin.git:
+    repo: "{{ matrix_imessage_rustpush_container_image_self_build_repo }}"
+    version: "{{ matrix_imessage_rustpush_container_image_self_build_repo_version }}"
+    dest: "{{ matrix_imessage_rustpush_docker_src_files_path }}"
+    force: "yes"
+  become: true
+  become_user: "{{ matrix_user_name }}"
+  register: matrix_imessage_rustpush_git_pull_results
+  when: "matrix_imessage_rustpush_enabled | bool and matrix_imessage_rustpush_container_image_self_build"
+
+- name: Ensure iMessage RustPush Dockerfile is installed
+  ansible.builtin.template:
+    src: "{{ role_path }}/templates/Dockerfile.j2"
+    dest: "{{ matrix_imessage_rustpush_docker_src_files_path }}/Dockerfile"
+    mode: 0640
+    owner: "{{ matrix_user_name }}"
+    group: "{{ matrix_group_name }}"
+  when: "matrix_imessage_rustpush_enabled | bool and matrix_imessage_rustpush_container_image_self_build | bool"
+
+- name: Ensure iMessage RustPush Docker image is built
+  community.docker.docker_image:
+    name: "{{ matrix_imessage_rustpush_docker_image }}"
+    source: build
+    force_source: "{{ matrix_imessage_rustpush_git_pull_results.changed if matrix_imessage_rustpush_git_pull_results is defined else true }}"
+    build:
+      dockerfile: Dockerfile
+      path: "{{ matrix_imessage_rustpush_docker_src_files_path }}"
+      pull: true
+  register: matrix_imessage_rustpush_container_image_build_result
+  when: "matrix_imessage_rustpush_enabled | bool and matrix_imessage_rustpush_container_image_self_build | bool"
+
+- name: Ensure iMessage RustPush container image is pulled
+  community.docker.docker_image:
+    name: "{{ matrix_imessage_rustpush_docker_image }}"
+    source: pull
+    force_source: "{{ matrix_imessage_rustpush_container_image_force_pull if matrix_imessage_rustpush_container_image_force_pull is defined else true }}"
+  register: matrix_imessage_rustpush_container_image_pull_result
+  when: "matrix_imessage_rustpush_enabled | bool and not matrix_imessage_rustpush_container_image_self_build | bool"
+  ignore_errors: "{{ ansible_check_mode }}"
+
+- name: Ensure imessage-rustpush config.yaml installed
+  ansible.builtin.copy:
+    content: "{{ matrix_imessage_rustpush_configuration | to_nice_yaml(indent=2, width=999999) }}"
+    dest: "{{ matrix_imessage_rustpush_config_path }}/config.yaml"
+    mode: 0644
+    owner: "{{ matrix_user_name }}"
+    group: "{{ matrix_group_name }}"
+  register: matrix_imessage_rustpush_config_result
+
+- name: Ensure imessage-rustpush registration.yaml installed
+  ansible.builtin.copy:
+    content: "{{ matrix_imessage_rustpush_registration | to_nice_yaml(indent=2, width=999999) }}"
+    dest: "{{ matrix_imessage_rustpush_config_path }}/registration.yaml"
+    mode: 0644
+    owner: "{{ matrix_user_name }}"
+    group: "{{ matrix_group_name }}"
+  register: matrix_imessage_rustpush_registration_result
+
+- name: Ensure imessage-rustpush support files installed
+  ansible.builtin.template:
+    src: "{{ role_path }}/templates/{{ item }}.j2"
+    dest: "{{ matrix_imessage_rustpush_base_path }}/{{ item }}"
+    mode: 0640
+    owner: "{{ matrix_user_name }}"
+    group: "{{ matrix_group_name }}"
+  with_items:
+    - labels
+  register: matrix_imessage_rustpush_support_files_result
+
+- name: Ensure matrix-imessage-rustpush container network is created
+  community.general.docker_network:
+    enable_ipv6: "{{ devture_systemd_docker_base_ipv6_enabled }}"
+    name: "{{ matrix_imessage_rustpush_container_network }}"
+    driver: bridge
+    driver_options: "{{ devture_systemd_docker_base_container_networks_driver_options }}"
+
+- name: Ensure matrix-imessage-rustpush.service installed
+  ansible.builtin.template:
+    src: "{{ role_path }}/templates/systemd/matrix-imessage-rustpush.service.j2"
+    dest: "{{ devture_systemd_docker_base_systemd_path }}/matrix-imessage-rustpush.service"
+    mode: 0644
+  register: matrix_imessage_rustpush_systemd_service_result
+
+- name: Determine whether matrix-imessage-rustpush needs a restart
+  ansible.builtin.set_fact:
+    matrix_imessage_rustpush_restart_necessary: >-
+      {{
+        matrix_imessage_rustpush_config_result.changed | default(false)
+        or matrix_imessage_rustpush_registration_result.changed | default(false)
+        or matrix_imessage_rustpush_support_files_result.changed | default(false)
+        or matrix_imessage_rustpush_systemd_service_result.changed | default(false)
+        or matrix_imessage_rustpush_container_image_pull_result.changed | default(false)
+        or matrix_imessage_rustpush_container_image_build_result.changed | default(false)
+      }}
diff --git a/roles/custom/matrix-bridge-imessage-rustpush/tasks/setup_uninstall.yml b/roles/custom/matrix-bridge-imessage-rustpush/tasks/setup_uninstall.yml
new file mode 100644
index 000000000..7ac351bbf
--- /dev/null
+++ b/roles/custom/matrix-bridge-imessage-rustpush/tasks/setup_uninstall.yml
@@ -0,0 +1,23 @@
+# SPDX-FileCopyrightText: 2025 MDAD project contributors
+#
+# SPDX-License-Identifier: AGPL-3.0-or-later
+
+---
+
+- name: Check existence of matrix-imessage-rustpush service
+  ansible.builtin.stat:
+    path: "{{ devture_systemd_docker_base_systemd_path }}/matrix-imessage-rustpush.service"
+  register: matrix_imessage_rustpush_service_stat
+
+- when: matrix_imessage_rustpush_service_stat.stat.exists | bool
+  block:
+    - name: Ensure matrix-imessage-rustpush is stopped
+      ansible.builtin.service:
+        name: matrix-imessage-rustpush
+        state: stopped
+        daemon_reload: true
+
+    - name: Ensure matrix-imessage-rustpush.service doesn't exist
+      ansible.builtin.file:
+        path: "{{ devture_systemd_docker_base_systemd_path }}/matrix-imessage-rustpush.service"
+        state: absent
diff --git a/roles/custom/matrix-bridge-imessage-rustpush/tasks/validate_config.yml b/roles/custom/matrix-bridge-imessage-rustpush/tasks/validate_config.yml
new file mode 100644
index 000000000..d2c846c14
--- /dev/null
+++ b/roles/custom/matrix-bridge-imessage-rustpush/tasks/validate_config.yml
@@ -0,0 +1,19 @@
+# SPDX-FileCopyrightText: 2025 MDAD project contributors
+#
+# SPDX-License-Identifier: AGPL-3.0-or-later
+
+---
+
+- name: Fail if required iMessage RustPush settings not defined
+  ansible.builtin.fail:
+    msg: >-
+      You need to define a required configuration setting (`{{ item.name }}`).
+  when: "item.when | bool and lookup('vars', item.name, default='') | string | length == 0"
+  with_items:
+    - {'name': 'matrix_imessage_rustpush_appservice_token', when: true}
+    - {'name': 'matrix_imessage_rustpush_homeserver_address', when: true}
+    - {'name': 'matrix_imessage_rustpush_homeserver_token', when: true}
+    - {'name': 'matrix_imessage_rustpush_database_hostname', when: "{{ matrix_imessage_rustpush_database_engine == 'postgres' }}"}
+    - {'name': 'matrix_imessage_rustpush_container_network', when: true}
+    - {'name': 'matrix_imessage_rustpush_metrics_proxying_hostname', when: "{{ matrix_imessage_rustpush_metrics_proxying_enabled }}"}
+    - {'name': 'matrix_imessage_rustpush_metrics_proxying_path_prefix', when: "{{ matrix_imessage_rustpush_metrics_proxying_enabled }}"}
diff --git a/roles/custom/matrix-bridge-imessage-rustpush/templates/Dockerfile.j2 b/roles/custom/matrix-bridge-imessage-rustpush/templates/Dockerfile.j2
new file mode 100644
index 000000000..58baef06b
--- /dev/null
+++ b/roles/custom/matrix-bridge-imessage-rustpush/templates/Dockerfile.j2
@@ -0,0 +1,45 @@
+{#
+SPDX-FileCopyrightText: 2025 MDAD project contributors
+
+SPDX-License-Identifier: AGPL-3.0-or-later
+#}
+
+# Multi-stage build for mautrix-imessage with RustPush support
+# Stage 1: Rust + Go builder
+FROM docker.io/golang:1.24-bookworm AS builder
+
+# Install Rust toolchain
+RUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y
+ENV PATH="/root/.cargo/bin:${PATH}"
+
+# Install build dependencies
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    build-essential \
+    clang \
+    libclang-dev \
+    protobuf-compiler \
+    git \
+    ca-certificates \
+    && rm -rf /var/lib/apt/lists/*
+
+WORKDIR /build
+
+# Copy the source code
+COPY . /build/
+
+# Build the Go binary with CGO enabled (required for Rust FFI)
+RUN cd /build && make build
+
+# Stage 2: Runtime
+FROM docker.io/debian:bookworm-slim
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    ca-certificates \
+    && rm -rf /var/lib/apt/lists/*
+
+COPY --from=builder /build/mautrix-imessage-v2 /usr/bin/mautrix-imessage-v2
+
+VOLUME /data
+VOLUME /config
+
+CMD ["/usr/bin/mautrix-imessage-v2", "-c", "/config/config.yaml", "-r", "/config/registration.yaml", "--no-update"]
diff --git a/roles/custom/matrix-bridge-imessage-rustpush/templates/Dockerfile.j2.license b/roles/custom/matrix-bridge-imessage-rustpush/templates/Dockerfile.j2.license
new file mode 100644
index 000000000..826be4a75
--- /dev/null
+++ b/roles/custom/matrix-bridge-imessage-rustpush/templates/Dockerfile.j2.license
@@ -0,0 +1,3 @@
+SPDX-FileCopyrightText: 2025 MDAD project contributors
+
+SPDX-License-Identifier: AGPL-3.0-or-later
diff --git a/roles/custom/matrix-bridge-imessage-rustpush/templates/config.yaml.j2 b/roles/custom/matrix-bridge-imessage-rustpush/templates/config.yaml.j2
new file mode 100644
index 000000000..ed99483f6
--- /dev/null
+++ b/roles/custom/matrix-bridge-imessage-rustpush/templates/config.yaml.j2
@@ -0,0 +1,190 @@
+#jinja2: lstrip_blocks: True
+# Network-specific config options (iMessage via RustPush)
+network:
+    # Displayname template for iMessage contacts.
+    # Available variables: {{.FirstName}}, {{.LastName}}, {{.Nickname}},
+    # {{.Phone}}, {{.Email}}, {{.ID}}
+    displayname_template: {{ matrix_imessage_rustpush_network_displayname_template | to_json }}
+
+    # How many days back to look for chats during initial sync.
+    # Default is 365 (1 year). Set to 0 to use the default.
+    initial_sync_days: {{ matrix_imessage_rustpush_initial_sync_days | to_json }}
+
+# Config options that affect the central bridge module.
+bridge:
+    # The prefix for commands. Only required in non-management rooms.
+    command_prefix: {{ matrix_imessage_rustpush_bridge_command_prefix | to_json }}
+    # Should the bridge create a space for each login containing the rooms that account is in?
+    personal_filtering_spaces: true
+    # Whether the bridge should set names and avatars explicitly for DM portals.
+    private_chat_portal_meta: true
+    # Should events be handled asynchronously within portal rooms?
+    async_events: false
+    # Should every user have their own portals rather than sharing them?
+    split_portals: false
+    # Should the bridge resend `m.bridge` events to all portals on startup?
+    resend_bridge_info: false
+
+    # Should leaving Matrix rooms be bridged as leaving groups on the remote network?
+    bridge_matrix_leave: false
+    # Should room tags only be synced when creating the portal?
+    tag_only_on_create: true
+    # List of tags to allow bridging.
+    only_bridge_tags: [m.favourite, m.lowpriority]
+    # Should room mute status only be synced when creating the portal?
+    mute_only_on_create: true
+
+    # What should be done to portal rooms when a user logs out or is logged out?
+    cleanup_on_logout:
+        enabled: false
+        manual:
+            private: nothing
+            relayed: nothing
+            shared_no_users: nothing
+            shared_has_users: nothing
+        bad_credentials:
+            private: nothing
+            relayed: nothing
+            shared_no_users: nothing
+            shared_has_users: nothing
+
+    # Settings for relay mode
+    relay:
+        enabled: false
+        admin_only: true
+        default_relays: []
+        message_formats:
+            m.text: "{% raw %}<b>{{ .Sender.DisambiguatedName }}</b>: {{ .Message }}{% endraw %}"
+            m.notice: "{% raw %}<b>{{ .Sender.DisambiguatedName }}</b>: {{ .Message }}{% endraw %}"
+            m.emote: "{% raw %}* <b>{{ .Sender.DisambiguatedName }}</b> {{ .Message }}{% endraw %}"
+            m.file: "{% raw %}<b>{{ .Sender.DisambiguatedName }}</b> sent a file{{ if .Caption }}: {{ .Caption }}{{ end }}{% endraw %}"
+            m.image: "{% raw %}<b>{{ .Sender.DisambiguatedName }}</b> sent an image{{ if .Caption }}: {{ .Caption }}{{ end }}{% endraw %}"
+            m.audio: "{% raw %}<b>{{ .Sender.DisambiguatedName }}</b> sent an audio file{{ if .Caption }}: {{ .Caption }}{{ end }}{% endraw %}"
+            m.video: "{% raw %}<b>{{ .Sender.DisambiguatedName }}</b> sent a video{{ if .Caption }}: {{ .Caption }}{{ end }}{% endraw %}"
+            m.location: "{% raw %}<b>{{ .Sender.DisambiguatedName }}</b> sent a location{{ if .Caption }}: {{ .Caption }}{{ end }}{% endraw %}"
+        displayname_format: "{% raw %}{{ .DisambiguatedName }}{% endraw %}"
+
+    # Permissions for using the bridge.
+    permissions: {{ matrix_imessage_rustpush_bridge_permissions | to_json }}
+
+# Config for the bridge's database.
+database:
+    type: postgres
+    uri: {{ matrix_imessage_rustpush_database_uri | to_json }}
+    max_open_conns: 5
+    max_idle_conns: 1
+    max_conn_idle_time: null
+    max_conn_lifetime: null
+
+# Homeserver details.
+homeserver:
+    address: {{ matrix_imessage_rustpush_homeserver_address | to_json }}
+    domain: {{ matrix_imessage_rustpush_homeserver_domain | to_json }}
+    software: standard
+    status_endpoint:
+    message_send_checkpoint_endpoint:
+    async_media: {{ matrix_imessage_rustpush_homeserver_async_media | to_json }}
+    websocket: false
+    ping_interval_seconds: 0
+
+# Application service host/registration related details.
+appservice:
+    address: {{ matrix_imessage_rustpush_appservice_address | to_json }}
+    public_address: {{ matrix_imessage_rustpush_appservice_public_address | to_json }}
+
+    hostname: 0.0.0.0
+    port: 8081
+
+    id: imessage-rustpush
+    bot:
+        username: {{ matrix_imessage_rustpush_appservice_bot_username | to_json }}
+        displayname: {{ matrix_imessage_rustpush_appservice_bot_displayname | to_json(ensure_ascii=False) }}
+        avatar: {{ matrix_imessage_rustpush_appservice_bot_avatar | to_json }}
+
+    ephemeral_events: true
+    async_transactions: false
+
+    as_token: {{ matrix_imessage_rustpush_appservice_token | to_json }}
+    hs_token: {{ matrix_imessage_rustpush_homeserver_token | to_json }}
+
+    # Localpart template of MXIDs for remote users.
+    username_template: "{% raw %}imessage_{{.}}{% endraw %}"
+
+# Config options that affect the Matrix connector of the bridge.
+matrix:
+    message_status_events: false
+    delivery_receipts: false
+    message_error_notices: true
+    sync_direct_chat_list: true
+    federate_rooms: {{ matrix_imessage_rustpush_matrix_federate_rooms | to_json }}
+    upload_file_threshold: 5242880
+
+# Segment-compatible analytics endpoint for tracking some events.
+analytics:
+    token: null
+    url: https://api.segment.io/v1/track
+    user_id: null
+
+# Settings for provisioning API
+provisioning:
+    prefix: /_matrix/provision
+    shared_secret: {{ matrix_imessage_rustpush_provisioning_shared_secret | to_json }}
+    allow_matrix_auth: true
+    debug_endpoints: false
+
+# Settings for backfilling messages.
+backfill:
+    enabled: {{ matrix_imessage_rustpush_backfill_enabled | to_json }}
+    max_initial_messages: {{ matrix_imessage_rustpush_backfill_max_initial_messages | to_json }}
+    max_catchup_messages: {{ matrix_imessage_rustpush_backfill_max_catchup_messages | to_json }}
+    unread_hours_threshold: 720
+    threads:
+        max_initial_messages: 50
+    queue:
+        enabled: false
+        batch_size: 100
+        batch_delay: 20
+        max_batches: -1
+        max_batches_override: {}
+
+# Settings for enabling double puppeting
+double_puppet:
+    servers: {}
+    allow_discovery: false
+    secrets: {{ matrix_imessage_rustpush_double_puppet_secrets | to_json }}
+
+# End-to-bridge encryption support options.
+encryption:
+    allow: {{ matrix_imessage_rustpush_bridge_encryption_allow | to_json }}
+    default: {{ matrix_imessage_rustpush_bridge_encryption_default | to_json }}
+    require: {{ matrix_imessage_rustpush_bridge_encryption_require | to_json }}
+    appservice: {{ matrix_imessage_rustpush_bridge_encryption_appservice | to_json }}
+    msc4190: {{ matrix_imessage_rustpush_msc4190_enabled | to_json }}
+    self_sign: {{ matrix_imessage_rustpush_self_sign_enabled | to_json }}
+    allow_key_sharing: {{ matrix_imessage_rustpush_bridge_encryption_key_sharing_allow | to_json }}
+    pickle_key: {{ matrix_imessage_rustpush_bridge_encryption_pickle_key | to_json }}
+    delete_keys:
+        delete_outbound_on_ack: false
+        dont_store_outbound: false
+        ratchet_on_decrypt: false
+        delete_fully_used_on_decrypt: false
+        delete_prev_on_new_session: false
+        delete_on_device_delete: false
+        periodically_delete_expired: false
+        delete_outdated_inbound: false
+    verification_levels:
+        receive: unverified
+        send: unverified
+        share: cross-signed-tofu
+    rotation:
+        enable_custom: false
+        milliseconds: 604800000
+        messages: 100
+        disable_device_change_key_rotation: false
+
+# Logging config.
+logging:
+    min_level: {{ matrix_imessage_rustpush_logging_level | to_json }}
+    writers:
+        - type: stdout
+          format: pretty-colored
diff --git a/roles/custom/matrix-bridge-imessage-rustpush/templates/config.yaml.j2.license b/roles/custom/matrix-bridge-imessage-rustpush/templates/config.yaml.j2.license
new file mode 100644
index 000000000..826be4a75
--- /dev/null
+++ b/roles/custom/matrix-bridge-imessage-rustpush/templates/config.yaml.j2.license
@@ -0,0 +1,3 @@
+SPDX-FileCopyrightText: 2025 MDAD project contributors
+
+SPDX-License-Identifier: AGPL-3.0-or-later
diff --git a/roles/custom/matrix-bridge-imessage-rustpush/templates/labels.j2 b/roles/custom/matrix-bridge-imessage-rustpush/templates/labels.j2
new file mode 100644
index 000000000..4021967dd
--- /dev/null
+++ b/roles/custom/matrix-bridge-imessage-rustpush/templates/labels.j2
@@ -0,0 +1,52 @@
+{#
+SPDX-FileCopyrightText: 2025 MDAD project contributors
+
+SPDX-License-Identifier: AGPL-3.0-or-later
+#}
+
+{% if matrix_imessage_rustpush_container_labels_traefik_enabled %}
+traefik.enable=true
+
+{% if matrix_imessage_rustpush_container_labels_traefik_docker_network %}
+traefik.docker.network={{ matrix_imessage_rustpush_container_labels_traefik_docker_network }}
+{% endif %}
+
+traefik.http.services.matrix-imessage-rustpush-metrics.loadbalancer.server.port=8000
+
+{% if matrix_imessage_rustpush_container_labels_metrics_enabled %}
+############################################################
+#                                                          #
+# Metrics                                                  #
+#                                                          #
+############################################################
+
+{% if matrix_imessage_rustpush_container_labels_metrics_middleware_basic_auth_enabled %}
+traefik.http.middlewares.matrix-imessage-rustpush-metrics-basic-auth.basicauth.users={{ matrix_imessage_rustpush_container_labels_metrics_middleware_basic_auth_users }}
+traefik.http.routers.matrix-imessage-rustpush-metrics.middlewares=matrix-imessage-rustpush-metrics-basic-auth
+{% endif %}
+
+traefik.http.routers.matrix-imessage-rustpush-metrics.rule={{ matrix_imessage_rustpush_container_labels_metrics_traefik_rule }}
+
+{% if matrix_imessage_rustpush_container_labels_metrics_traefik_priority | int > 0 %}
+traefik.http.routers.matrix-imessage-rustpush-metrics.priority={{ matrix_imessage_rustpush_container_labels_metrics_traefik_priority }}
+{% endif %}
+
+traefik.http.routers.matrix-imessage-rustpush-metrics.service=matrix-imessage-rustpush-metrics
+traefik.http.routers.matrix-imessage-rustpush-metrics.entrypoints={{ matrix_imessage_rustpush_container_labels_metrics_traefik_entrypoints }}
+
+traefik.http.routers.matrix-imessage-rustpush-metrics.tls={{ matrix_imessage_rustpush_container_labels_metrics_traefik_tls | to_json }}
+{% if matrix_imessage_rustpush_container_labels_metrics_traefik_tls %}
+traefik.http.routers.matrix-imessage-rustpush-metrics.tls.certResolver={{ matrix_imessage_rustpush_container_labels_metrics_traefik_tls_certResolver }}
+{% endif %}
+
+############################################################
+#                                                          #
+# /Metrics                                                 #
+#                                                          #
+############################################################
+{% endif %}
+
+
+{% endif %}
+
+{{ matrix_imessage_rustpush_container_labels_additional_labels }}
diff --git a/roles/custom/matrix-bridge-imessage-rustpush/templates/labels.j2.license b/roles/custom/matrix-bridge-imessage-rustpush/templates/labels.j2.license
new file mode 100644
index 000000000..826be4a75
--- /dev/null
+++ b/roles/custom/matrix-bridge-imessage-rustpush/templates/labels.j2.license
@@ -0,0 +1,3 @@
+SPDX-FileCopyrightText: 2025 MDAD project contributors
+
+SPDX-License-Identifier: AGPL-3.0-or-later
diff --git a/roles/custom/matrix-bridge-imessage-rustpush/templates/systemd/matrix-imessage-rustpush.service.j2 b/roles/custom/matrix-bridge-imessage-rustpush/templates/systemd/matrix-imessage-rustpush.service.j2
new file mode 100644
index 000000000..3c40267a2
--- /dev/null
+++ b/roles/custom/matrix-bridge-imessage-rustpush/templates/systemd/matrix-imessage-rustpush.service.j2
@@ -0,0 +1,48 @@
+#jinja2: lstrip_blocks: True
+[Unit]
+Description=Matrix iMessage RustPush bridge
+{% for service in matrix_imessage_rustpush_systemd_required_services_list %}
+Requires={{ service }}
+After={{ service }}
+{% endfor %}
+{% for service in matrix_imessage_rustpush_systemd_wanted_services_list %}
+Wants={{ service }}
+{% endfor %}
+DefaultDependencies=no
+
+[Service]
+Type=simple
+Environment="HOME={{ devture_systemd_docker_base_systemd_unit_home_path }}"
+ExecStartPre=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} stop -t {{ devture_systemd_docker_base_container_stop_grace_time_seconds }} matrix-imessage-rustpush 2>/dev/null || true'
+ExecStartPre=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} rm matrix-imessage-rustpush 2>/dev/null || true'
+
+ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} create \
+			--rm \
+			--name=matrix-imessage-rustpush \
+			--log-driver=none \
+			--user={{ matrix_user_uid }}:{{ matrix_user_gid }} \
+			--cap-drop=ALL \
+			--network={{ matrix_imessage_rustpush_container_network }} \
+			--mount type=bind,src={{ matrix_imessage_rustpush_config_path }},dst=/config,ro \
+			--mount type=bind,src={{ matrix_imessage_rustpush_data_path }},dst=/data \
+			--label-file={{ matrix_imessage_rustpush_base_path }}/labels \
+			{% for arg in matrix_imessage_rustpush_container_extra_arguments %}
+			{{ arg }} \
+			{% endfor %}
+			{{ matrix_imessage_rustpush_docker_image }} \
+			/usr/bin/mautrix-imessage-v2 -c /config/config.yaml -r /config/registration.yaml --no-update
+
+{% for network in matrix_imessage_rustpush_container_additional_networks %}
+ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} network connect {{ network }} matrix-imessage-rustpush
+{% endfor %}
+
+ExecStart={{ devture_systemd_docker_base_host_command_docker }} start --attach matrix-imessage-rustpush
+
+ExecStop=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} stop -t {{ devture_systemd_docker_base_container_stop_grace_time_seconds }} matrix-imessage-rustpush 2>/dev/null || true'
+ExecStop=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} rm matrix-imessage-rustpush 2>/dev/null || true'
+Restart=always
+RestartSec=30
+SyslogIdentifier=matrix-imessage-rustpush
+
+[Install]
+WantedBy=multi-user.target
diff --git a/roles/custom/matrix-bridge-imessage-rustpush/templates/systemd/matrix-imessage-rustpush.service.j2.license b/roles/custom/matrix-bridge-imessage-rustpush/templates/systemd/matrix-imessage-rustpush.service.j2.license
new file mode 100644
index 000000000..826be4a75
--- /dev/null
+++ b/roles/custom/matrix-bridge-imessage-rustpush/templates/systemd/matrix-imessage-rustpush.service.j2.license
@@ -0,0 +1,3 @@
+SPDX-FileCopyrightText: 2025 MDAD project contributors
+
+SPDX-License-Identifier: AGPL-3.0-or-later
diff --git a/setup.yml b/setup.yml
index fa136203a..4369a83fe 100644
--- a/setup.yml
+++ b/setup.yml
@@ -71,6 +71,7 @@
     - custom/matrix-bridge-mautrix-discord
     - custom/matrix-bridge-mautrix-slack
     - custom/matrix-bridge-mautrix-bluesky
+    - custom/matrix-bridge-imessage-rustpush
     - custom/matrix-bridge-mx-puppet-groupme
     - custom/matrix-bridge-mx-puppet-steam
     - custom/matrix-bridge-postmoogle