Update Continuwuity to v26.9.0 and validate retired registration setting

docs/configuring-playbook-continuwuity.md

@@ -39,6 +39,8 @@ matrix_continuwuity_config_registration_token: ''
 
 There are some additional things you may wish to configure about the server.
 
+Continuwuity disables legacy unauthenticated media endpoints by default. Older clients and direct media links using these endpoints will stop working; use clients that support authenticated media.
+
 Take a look at:
 
 - `roles/custom/matrix-continuwuity/defaults/main.yml` for some variables that you can customize via your `vars.yml` file

roles/custom/matrix-continuwuity/defaults/main.yml

@@ -14,7 +14,7 @@ matrix_continuwuity_enabled: true
 matrix_continuwuity_hostname: ''
 
 # renovate: datasource=docker depName=forgejo.ellis.link/continuwuation/continuwuity
-matrix_continuwuity_version: v26.8.1
+matrix_continuwuity_version: v26.9.0
 
 matrix_continuwuity_container_image: "{{ matrix_continuwuity_container_image_registry_prefix }}/continuwuation/continuwuity:{{ matrix_continuwuity_container_image_tag }}"
 matrix_continuwuity_container_image_tag: "{{ matrix_continuwuity_version }}"
@@ -151,16 +151,8 @@ matrix_continuwuity_config_allow_registration: false
 # Controls if newly registered users are automatically suspended, requiring admin approval.
 matrix_continuwuity_config_suspend_on_register: false
 
-# Controls the `yes_i_am_very_very_sure_i_want_an_open_registration_server_prone_to_abuse` setting.
-# This is only used when `matrix_continuwuity_config_allow_registration` is set to true and no registration token is configured.
-matrix_continuwuity_config_yes_i_am_very_very_sure_i_want_an_open_registration_server_prone_to_abuse: false
-
 # Controls the `registration_token` setting.
-# When registration is enabled (`matrix_continuwuity_config_allow_registration`) you:
-# - either need to set a token to protect registration from abuse
-# - or you need to enable the `yes_i_am_very_very_sure_i_want_an_open_registration_server_prone_to_abuse` setting
-#   (see `matrix_continuwuity_config_yes_i_am_very_very_sure_i_want_an_open_registration_server_prone_to_abuse`),
-#   to allow registration without any form of 2nd-step.
+# When registration is enabled, protect it with a registration token, ReCAPTCHA, or required email verification.
 matrix_continuwuity_config_registration_token: ''
 
 # Controls the `new_user_displayname_suffix` setting.

roles/custom/matrix-continuwuity/tasks/validate_config.yml

@@ -38,6 +38,16 @@
     - {'old': 'matrix_continuwuity_docker_image_registry_prefix_upstream_default', 'new': 'matrix_continuwuity_container_image_registry_prefix_upstream_default'}
     - {'old': 'matrix_continuwuity_container_image_force_pull', 'new': '<removed> (the new community.docker.docker_image_pull module handles this natively)'}
 
+- name: (Deprecation) Catch and report removed Continuwuity settings
+  ansible.builtin.fail:
+    msg: >-
+      Your configuration contains a removed variable (`{{ item }}`). Please remove it from your configuration file (vars.yml).
+      Official Continuwuity images no longer support registration without a challenge.
+      If registration is enabled, configure a registration token, ReCAPTCHA, or required email verification.
+  when: "lookup('ansible.builtin.varnames', ('^' + item + '$'), wantlist=True) | length > 0"
+  with_items:
+    - matrix_continuwuity_config_yes_i_am_very_very_sure_i_want_an_open_registration_server_prone_to_abuse
+
 - name: Fail if Continuwuity ReCAPTCHA is only partially configured
   ansible.builtin.fail:
     msg: >-

roles/custom/matrix-continuwuity/templates/continuwuity.toml.j2

@@ -458,9 +458,7 @@ max_request_size = {{ matrix_continuwuity_config_max_request_size }}
 # Enables registration. If set to false, no users can register on this
 # server.
 #
-# If set to true without a token configured, users can register with no
-# form of 2nd-step only if you set the following option to true:
-# `yes_i_am_very_very_sure_i_want_an_open_registration_server_prone_to_abuse`
+# Registration requires a token, ReCAPTCHA, or email verification.
 #
 # If you would like registration only via token reg, please configure
 # `registration_token`.
@@ -483,11 +481,6 @@ allow_registration = {{ matrix_continuwuity_config_allow_registration | to_json
 #
 suspend_on_register = {{ matrix_continuwuity_config_suspend_on_register | to_json }}
 
-# Enabling this setting opens registration to anyone without restrictions.
-# This makes your server vulnerable to abuse
-#
-yes_i_am_very_very_sure_i_want_an_open_registration_server_prone_to_abuse = {{ matrix_continuwuity_config_yes_i_am_very_very_sure_i_want_an_open_registration_server_prone_to_abuse | to_json }}
-
 # A static registration token that new users will have to provide when
 # creating an account. This token does not supersede tokens from other
 # sources, such as the `!admin token` command or the
@@ -1327,10 +1320,9 @@ allow_outgoing_presence = {{ matrix_continuwuity_config_allow_outgoing_presence
 #
 # The authenticated equivalent endpoints are always enabled.
 #
-# Defaults to true for now, but this is highly subject to change, likely
-# in the next release.
+# Defaults to false, as unauthenticated media has been sunsetted.
 #
-#allow_legacy_media = true
+#allow_legacy_media = false
 
 # This item is undocumented. Please contribute documentation for it.
 #