From b45973eb137848f4e7f9f08319e8170c7d1878d2 Mon Sep 17 00:00:00 2001 From: ArtiDezi Date: Thu, 17 Sep 2026 10:30:24 +0000 Subject: [PATCH] Update Continuwuity to v26.9.0 and validate retired registration setting --- docs/configuring-playbook-continuwuity.md | 2 ++ roles/custom/matrix-continuwuity/defaults/main.yml | 12 ++---------- .../matrix-continuwuity/tasks/validate_config.yml | 10 ++++++++++ .../templates/continuwuity.toml.j2 | 14 +++----------- 4 files changed, 17 insertions(+), 21 deletions(-) diff --git a/docs/configuring-playbook-continuwuity.md b/docs/configuring-playbook-continuwuity.md index bb4fe3e9b..f78cda62b 100644 --- a/docs/configuring-playbook-continuwuity.md +++ b/docs/configuring-playbook-continuwuity.md @@ -39,6 +39,8 @@ matrix_continuwuity_config_registration_token: '' There are some additional things you may wish to configure about the server. +Continuwuity disables legacy unauthenticated media endpoints by default. Older clients and direct media links using these endpoints will stop working; use clients that support authenticated media. + Take a look at: - `roles/custom/matrix-continuwuity/defaults/main.yml` for some variables that you can customize via your `vars.yml` file diff --git a/roles/custom/matrix-continuwuity/defaults/main.yml b/roles/custom/matrix-continuwuity/defaults/main.yml index 6385bf365..ad6ab4e62 100644 --- a/roles/custom/matrix-continuwuity/defaults/main.yml +++ b/roles/custom/matrix-continuwuity/defaults/main.yml @@ -14,7 +14,7 @@ matrix_continuwuity_enabled: true matrix_continuwuity_hostname: '' # renovate: datasource=docker depName=forgejo.ellis.link/continuwuation/continuwuity -matrix_continuwuity_version: v26.8.1 +matrix_continuwuity_version: v26.9.0 matrix_continuwuity_container_image: "{{ matrix_continuwuity_container_image_registry_prefix }}/continuwuation/continuwuity:{{ matrix_continuwuity_container_image_tag }}" matrix_continuwuity_container_image_tag: "{{ matrix_continuwuity_version }}" @@ -151,16 +151,8 @@ matrix_continuwuity_config_allow_registration: false # Controls if newly registered users are automatically suspended, requiring admin approval. matrix_continuwuity_config_suspend_on_register: false -# Controls the `yes_i_am_very_very_sure_i_want_an_open_registration_server_prone_to_abuse` setting. -# This is only used when `matrix_continuwuity_config_allow_registration` is set to true and no registration token is configured. -matrix_continuwuity_config_yes_i_am_very_very_sure_i_want_an_open_registration_server_prone_to_abuse: false - # Controls the `registration_token` setting. -# When registration is enabled (`matrix_continuwuity_config_allow_registration`) you: -# - either need to set a token to protect registration from abuse -# - or you need to enable the `yes_i_am_very_very_sure_i_want_an_open_registration_server_prone_to_abuse` setting -# (see `matrix_continuwuity_config_yes_i_am_very_very_sure_i_want_an_open_registration_server_prone_to_abuse`), -# to allow registration without any form of 2nd-step. +# When registration is enabled, protect it with a registration token, ReCAPTCHA, or required email verification. matrix_continuwuity_config_registration_token: '' # Controls the `new_user_displayname_suffix` setting. diff --git a/roles/custom/matrix-continuwuity/tasks/validate_config.yml b/roles/custom/matrix-continuwuity/tasks/validate_config.yml index 777f12387..931133627 100644 --- a/roles/custom/matrix-continuwuity/tasks/validate_config.yml +++ b/roles/custom/matrix-continuwuity/tasks/validate_config.yml @@ -38,6 +38,16 @@ - {'old': 'matrix_continuwuity_docker_image_registry_prefix_upstream_default', 'new': 'matrix_continuwuity_container_image_registry_prefix_upstream_default'} - {'old': 'matrix_continuwuity_container_image_force_pull', 'new': ' (the new community.docker.docker_image_pull module handles this natively)'} +- name: (Deprecation) Catch and report removed Continuwuity settings + ansible.builtin.fail: + msg: >- + Your configuration contains a removed variable (`{{ item }}`). Please remove it from your configuration file (vars.yml). + Official Continuwuity images no longer support registration without a challenge. + If registration is enabled, configure a registration token, ReCAPTCHA, or required email verification. + when: "lookup('ansible.builtin.varnames', ('^' + item + '$'), wantlist=True) | length > 0" + with_items: + - matrix_continuwuity_config_yes_i_am_very_very_sure_i_want_an_open_registration_server_prone_to_abuse + - name: Fail if Continuwuity ReCAPTCHA is only partially configured ansible.builtin.fail: msg: >- diff --git a/roles/custom/matrix-continuwuity/templates/continuwuity.toml.j2 b/roles/custom/matrix-continuwuity/templates/continuwuity.toml.j2 index 50f1df78e..32dd7b39e 100644 --- a/roles/custom/matrix-continuwuity/templates/continuwuity.toml.j2 +++ b/roles/custom/matrix-continuwuity/templates/continuwuity.toml.j2 @@ -458,9 +458,7 @@ max_request_size = {{ matrix_continuwuity_config_max_request_size }} # Enables registration. If set to false, no users can register on this # server. # -# If set to true without a token configured, users can register with no -# form of 2nd-step only if you set the following option to true: -# `yes_i_am_very_very_sure_i_want_an_open_registration_server_prone_to_abuse` +# Registration requires a token, ReCAPTCHA, or email verification. # # If you would like registration only via token reg, please configure # `registration_token`. @@ -483,11 +481,6 @@ allow_registration = {{ matrix_continuwuity_config_allow_registration | to_json # suspend_on_register = {{ matrix_continuwuity_config_suspend_on_register | to_json }} -# Enabling this setting opens registration to anyone without restrictions. -# This makes your server vulnerable to abuse -# -yes_i_am_very_very_sure_i_want_an_open_registration_server_prone_to_abuse = {{ matrix_continuwuity_config_yes_i_am_very_very_sure_i_want_an_open_registration_server_prone_to_abuse | to_json }} - # A static registration token that new users will have to provide when # creating an account. This token does not supersede tokens from other # sources, such as the `!admin token` command or the @@ -1327,10 +1320,9 @@ allow_outgoing_presence = {{ matrix_continuwuity_config_allow_outgoing_presence # # The authenticated equivalent endpoints are always enabled. # -# Defaults to true for now, but this is highly subject to change, likely -# in the next release. +# Defaults to false, as unauthenticated media has been sunsetted. # -#allow_legacy_media = true +#allow_legacy_media = false # This item is undocumented. Please contribute documentation for it. #