Enable the appservice encryption MSCs on Synapse for Hookshot too

Hookshot's end-to-bridge encryption needs MSC2409 and MSC3202 enabled
on the homeserver, but the playbook only turned them on for Meowlnir.
Hookshot's encryption defaults to the playbook-wide
`matrix_bridges_encryption_enabled` toggle, so turning that on gave
Hookshot encryption against a Synapse which was not set up for it, and
Hookshot then struggled in encrypted rooms.

The playbook already wires up Hookshot's other encryption prerequisite
(Valkey) and fails the run when the Redis settings are missing, so
being only half-automatic here was the odd one out.

Synapse sends the extra data only to appservices which ask for it in
their registration file, so turning these on affects no other
component.

The documentation told Hookshot users to set the two Synapse variables
by hand, and argued they should be enabled deliberately. That
contradicted what we already do for Meowlnir, so it is gone; the note
now matches the Meowlnir one and points out that other homeserver
implementations still need arranging by hand.

Closes https://github.com/spantaleev/matrix-docker-ansible-deploy/issues/5506

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

docs/configuring-playbook-bridge-hookshot.md

@@ -41,14 +41,7 @@ matrix_bridge_hookshot_enabled: true
 ```
 
 > [!NOTE]
-> End-to-bridge encryption also requires the homeserver to support (and have enabled) [MSC2409](https://github.com/matrix-org/matrix-spec-proposals/pull/2409) and [MSC3202](https://github.com/matrix-org/matrix-spec-proposals/pull/3202). If you are using Synapse, enable them by also adding this to your `vars.yml` file:
->
-> ```yaml
-> matrix_synapse_experimental_features_msc2409_to_device_messages_enabled: true
-> matrix_synapse_experimental_features_msc3202_transaction_extensions_enabled: true
-> ```
->
-> These are experimental homeserver-wide features (as is Hookshot's encryption support itself), so enable them deliberately.
+> End-to-bridge encryption requires the homeserver to support (and have enabled) [MSC2409](https://github.com/matrix-org/matrix-spec-proposals/pull/2409) and [MSC3202](https://github.com/matrix-org/matrix-spec-proposals/pull/3202). When using Synapse, the playbook turns on the experimental features this depends on (`msc2409_to_device_messages_enabled` and `msc3202_transaction_extensions`) for you. On other homeserver implementations, you need to arrange for this yourself.
 
 For each of the services (GitHub, GitLab, Jira, Figma, and generic webhooks) fill in the respective variables `matrix_bridge_hookshot_service_*` listed in [main.yml](../roles/custom/matrix-bridge-hookshot/defaults/main.yml) as required.
 

group_vars/matrix_servers

@@ -5161,9 +5161,21 @@ matrix_synapse_ext_synapse_http_antispam_config_enabled_callbacks: "{{ matrix_bo
 matrix_synapse_ext_synapse_http_antispam_config_fail_open: "{{ matrix_bot_draupnir_synapse_http_antispam_config_fail_open if matrix_bot_draupnir_config_web_synapseHTTPAntispam_enabled else (matrix_bot_meowlnir_synapse_http_antispam_config_fail_open if matrix_bot_meowlnir_synapse_http_antispam_enabled else {}) }}"
 matrix_synapse_ext_synapse_http_antispam_config_async: "{{ matrix_bot_draupnir_synapse_http_antispam_config_async if matrix_bot_draupnir_config_web_synapseHTTPAntispam_enabled else (matrix_bot_meowlnir_synapse_http_antispam_config_async if matrix_bot_meowlnir_synapse_http_antispam_enabled else {}) }}"
 
-# Meowlnir's bots need these to support end-to-end encryption.
-matrix_synapse_experimental_features_msc2409_to_device_messages_enabled: "{{ matrix_bot_meowlnir_enabled and matrix_bot_meowlnir_config_encryption_enable }}"
-matrix_synapse_experimental_features_msc3202_transaction_extensions_enabled: "{{ matrix_bot_meowlnir_enabled and matrix_bot_meowlnir_config_encryption_enable }}"
+# Meowlnir's bots and Hookshot need these to support end-to-end encryption.
+# Synapse only sends the extra data to appservices which ask for it in their registration file,
+# so enabling these affects no other component.
+matrix_synapse_experimental_features_msc2409_to_device_messages_enabled: |-
+  {{
+    (matrix_bot_meowlnir_enabled and matrix_bot_meowlnir_config_encryption_enable)
+    or
+    (matrix_bridge_hookshot_enabled and matrix_bridge_hookshot_encryption_enabled)
+  }}
+matrix_synapse_experimental_features_msc3202_transaction_extensions_enabled: |-
+  {{
+    (matrix_bot_meowlnir_enabled and matrix_bot_meowlnir_config_encryption_enable)
+    or
+    (matrix_bridge_hookshot_enabled and matrix_bridge_hookshot_encryption_enabled)
+  }}
 
 # Enable Synapse statistics reporting when using synapse-usage-exporter
 matrix_synapse_report_stats: "{{ matrix_synapse_usage_exporter_enabled }}"

roles/custom/matrix-bridge-hookshot/defaults/main.yml

@@ -71,7 +71,7 @@ matrix_bridge_hookshot_cache_redisUri: "{{ ('redis://' + matrix_bridge_hookshot_
 # Controls whether the end-to-bridge encryption support is enabled.
 # This requires that:
 # - the homeserver to support MSC2409 (to-device messages for appservices) and MSC3202 (encryption-related appservice transaction extensions), and to have them enabled.
-#   These are typically experimental homeserver features which are disabled by default, so they usually need to be enabled explicitly via homeserver-specific configuration.
+#   These are typically experimental homeserver features which are disabled by default. Note that this is configured automatically by the playbook when encryption is enabled and the homeserver is Synapse.
 # - Hookshot to be pointed at a Redis instance via the `matrix_bridge_hookshot_cache_redis*` variables. Note that this is configured automatically by the playbook when encryption is enabled.
 # See: https://matrix-org.github.io/matrix-hookshot/latest/advanced/encryption.html
 # NOTE: Encryption is not currently (2025-12-30) supported when using MAS (https://github.com/matrix-org/matrix-hookshot/issues/1084)