Merge remote-tracking branch 'origin' into multi-jvb

.gitignore

@@ -2,6 +2,10 @@
 !/inventory/.gitkeep
 !/inventory/host_vars/.gitkeep
 !/inventory/scripts
-/roles/*/files/scratchpad
+/roles/**/files/scratchpad
 .DS_Store
 .python-version
+
+# ignore roles pulled by ansible-galaxy
+/roles/galaxy/*
+!/roles/galaxy/.gitkeep

.yamllint

@@ -2,7 +2,7 @@
 extends: default
 
 ignore: |
-  roles/matrix-synapse/vars/workers.yml
+  roles/custom/matrix-synapse/vars/workers.yml
 
 rules:
   line-length: disable

CHANGELOG.md

@@ -130,7 +130,7 @@ Below we'll discuss **potential backward incompatibilities**.
 
 - **Metric endpoints have also changed** (`/metrics/synapse/worker/generic_worker-18111` -> `/metrics/synapse/worker/generic-worker-0`). If you're [collecting metrics to an external Prometheus server](docs/configuring-playbook-prometheus-grafana.md#collecting-metrics-to-an-external-prometheus-server), consider revisiting our [Collecting Synapse worker metrics to an external Prometheus server](docs/configuring-playbook-prometheus-grafana.md#collecting-synapse-worker-metrics-to-an-external-prometheus-server) docs and updating your Prometheus configuration. **If you're collecting metrics to the integrated Prometheus server** (not enabled by default), **your Prometheus configuration will be updated automatically**. Old data (from before this change) may stick around though.
 
-- **the format of `matrix_synapse_workers_enabled_list` has changed**. You were never advised to use this variable for directly creating workers (we advise people to control workers using `matrix_synapse_workers_preset` or by tweaking `matrix_synapse_workers_*_workers_count` variables only), but some people may have started using the `matrix_synapse_workers_enabled_list` variable to gain more control over workers. If you're one of them, you'll need to adjust its value. See `roles/matrix-synapse/defaults/main.yml` for more information on the new format. The playbook will also do basic validation and complain if you got something wrong.
+- **the format of `matrix_synapse_workers_enabled_list` has changed**. You were never advised to use this variable for directly creating workers (we advise people to control workers using `matrix_synapse_workers_preset` or by tweaking `matrix_synapse_workers_*_workers_count` variables only), but some people may have started using the `matrix_synapse_workers_enabled_list` variable to gain more control over workers. If you're one of them, you'll need to adjust its value. See `roles/custom/matrix-synapse/defaults/main.yml` for more information on the new format. The playbook will also do basic validation and complain if you got something wrong.
 
 
 # 2022-09-09
@@ -412,7 +412,7 @@ matrix_ma1sd_enabled: true
 
 We now support installing the [matrix_encryption_disabler](https://github.com/digitalentity/matrix_encryption_disabler) Synapse module, which lets you prevent End-to-End-Encryption from being enabled by users on your homeserver. The popular opinion is that this is dangerous and shouldn't be done, but there are valid use cases for disabling encryption discussed [here](https://github.com/matrix-org/synapse/issues/4401).
 
-To enable this module (and prevent encryption from being used on your homserver), add `matrix_synapse_ext_encryption_disabler_enabled: true` to your configuration. This module provides further customization. Check its other configuration settings (and defaults) in `roles/matrix-synapse/defaults/main.yml`.
+To enable this module (and prevent encryption from being used on your homserver), add `matrix_synapse_ext_encryption_disabler_enabled: true` to your configuration. This module provides further customization. Check its other configuration settings (and defaults) in `roles/custom/matrix-synapse/defaults/main.yml`.
 
 
 # 2022-02-01
@@ -799,7 +799,7 @@ You have 3 ways to proceed:
   - stop the bridge (`systemctl stop matrix-mautrix-facebook`)
   - create a new `matrix_mautrix_facebook` Postgres database for it
   - run [pgloader](https://pgloader.io/) manually (we import this bridge's data using default settings and it works well)
-  - define `matrix_mautrix_facebook_database_*` variables in your `vars.yml` file (credentials, etc.) - you can find their defaults in `roles/matrix-mautrix-facebook/defaults/main.yml`
+  - define `matrix_mautrix_facebook_database_*` variables in your `vars.yml` file (credentials, etc.) - you can find their defaults in `roles/custom/matrix-mautrix-facebook/defaults/main.yml`
   - switch the bridge to Postgres (`matrix_mautrix_facebook_database_engine: 'postgres'` in your `vars.yml` file)
   - re-run the playbook (`--tags=setup-all,start`) and ensure the bridge works (`systemctl status matrix-mautrix-facebook` and `journalctl -fu matrix-mautrix-facebook`)
   - send a `login` message to the Facebook bridge bot again
@@ -1677,7 +1677,7 @@ Having Synapse not be a required component potentially opens the door for instal
 ## Bridges are now separate from the Synapse role
 
 Bridges are no longer part of the `matrix-synapse` role.
-Each bridge now lives in its own separate role (`roles/matrix-bridge-*`).
+Each bridge now lives in its own separate role (`roles/custom/matrix-bridge-*`).
 
 These bridge roles are independent of the `matrix-synapse` role, so it should be possible to use them with a Synapse instance installed another way (not through the playbook).
 
@@ -1971,7 +1971,7 @@ The following variables are no longer supported by this playbook:
 - `matrix_mxisd_template_config`
 
 You are encouraged to use the `matrix_mxisd_configuration_extension_yaml` variable to define your own mxisd configuration additions and overrides.
-Refer to the [default variables file](roles/matrix-mxisd/defaults/main.yml) for more information.
+Refer to the [default variables file](roles/custom/matrix-mxisd/defaults/main.yml) for more information.
 
 This new way of configuring mxisd is beneficial because:
 
@@ -2033,14 +2033,14 @@ Based on feedback from others, running Synapse on Python 3 is supposed to decrea
 ## Riot homepage customization
 
 You can now customize some parts of the Riot homepage (or even completely replace it with your own custom page).
-See the `matrix_riot_web_homepage_` variables in `roles/matrix-riot-web/defaults/main.yml`.
+See the `matrix_riot_web_homepage_` variables in `roles/custom/matrix-riot-web/defaults/main.yml`.
 
 
 # 2018-12-04
 
 ## mxisd extensibility
 
-The [LDAP identity store for mxisd](https://github.com/kamax-matrix/mxisd/blob/master/docs/stores/ldap.md) can now be configured easily using playbook variables (see the `matrix_mxisd_ldap_` variables in `roles/matrix-server/defaults/main.yml`).
+The [LDAP identity store for mxisd](https://github.com/kamax-matrix/mxisd/blob/master/docs/stores/ldap.md) can now be configured easily using playbook variables (see the `matrix_mxisd_ldap_` variables in `roles/custom/matrix-server/defaults/main.yml`).
 
 
 # 2018-11-28

Makefile

@@ -1,7 +1,10 @@
-.PHONY: lint
+.PHONY: roles lint
 
 help: ## Show this help.
-	@fgrep -h "##" $(MAKEFILE_LIST) | fgrep -v fgrep | sed -e 's/\\$$//' | sed -e 's/##//'
+	@grep -F -h "##" $(MAKEFILE_LIST) | grep -v grep | sed -e 's/\\$$//' | sed -e 's/##//'
+
+roles: ## Pull roles
+	ansible-galaxy install -r requirements.yml -p roles/galaxy/ --force
 
 lint: ## Runs ansible-lint against all roles in the playbook
 	ansible-lint

docs/configuring-dns.md

@@ -26,6 +26,8 @@ Be mindful as to how long it will take for the DNS records to propagate.
 
 If you are using Cloudflare DNS, make sure to disable the proxy and set all records to `DNS only`. Otherwise, fetching certificates will fail.
 
+When you're done configuring DNS, proceed to [Configuring the playbook](configuring-playbook.md).
+
 ## DNS settings for optional services/features
 
 | Used by component                                                                                                       | Type  | Host                           | Priority | Weight | Port | Target                      |
@@ -45,6 +47,8 @@ If you are using Cloudflare DNS, make sure to disable the proxy and set all reco
 | [Postmoogle](configuring-playbook-bot-postmoogle.md) email bridge                                                       | TXT   | `_dmarc.matrix`                | -        | -      | -    | `v=DMARC1; p=quarantine;`   |
 | [Postmoogle](configuring-playbook-bot-postmoogle.md) email bridge                                                       | TXT   | `postmoogle._domainkey.matrix` | -        | -      | -    | get it from `!pm dkim`      |
 
+When setting up a SRV record, if you are asked for a service and protocol instead of a hostname split the host value from the table where the period is. For example use service as `_matrix-identity` and protocol as `_tcp`.
+
 ## Subdomains setup
 
 As the table above illustrates, you need to create 2 subdomains (`matrix.<your-domain>` and `element.<your-domain>`) and point both of them to your new server's IP address (DNS `A` record or `CNAME` record is fine).

docs/configuring-playbook-backup-borg.md

@@ -56,7 +56,7 @@ where:
 
 * USER - SSH user of a provider/server
 * HOST - SSH host of a provider/server
-* REPO - borg repository name, it will be initialized on backup start, eg: `matrix`
+* REPO - borg repository name, it will be initialized on backup start, eg: `matrix`, regarding Syntax see [Remote repositories](https://borgbackup.readthedocs.io/en/stable/usage/general.html#repository-urls)
 * PASSPHRASE - passphrase used for encrypting backups, you may generate it with `pwgen -s 64 1` or use any password manager
 * PRIVATE KEY - the content of the **private** part of the SSH key you created before. The whole key (all of its belonging lines) under `matrix_backup_borg_ssh_key_private` needs to be indented with 2 spaces
 
@@ -64,7 +64,7 @@ To backup without encryption, add `matrix_backup_borg_encryption: 'none'` to you
 
 `matrix_backup_borg_location_source_directories` defines the list of directories to back up: it's set to `{{ matrix_base_data_path }}` by default, which is the base directory for every service's data, such as Synapse, Postgres and the bridges. You might want to exclude certain directories or file patterns from the backup using the `matrix_backup_borg_location_exclude_patterns` variable.
 
-Check the `roles/matrix-backup-borg/defaults/main.yml` file for the full list of available options.
+Check the `roles/custom/matrix-backup-borg/defaults/main.yml` file for the full list of available options.
 
 ## Installing
 
@@ -73,3 +73,9 @@ After configuring the playbook, run the [installation](installing.md) command ag
 ```
 ansible-playbook -i inventory/hosts setup.yml --tags=setup-all,start
 ```
+
+## Manually start a backup
+
+For testing your setup it can be helpful to not wait until 4am. If you want to run the backup immediately, log onto the server
+and run `systemctl start matrix-backup-borg`. This will not return until the backup is done, so possibly a long time.
+Consider using [tmux](https://en.wikipedia.org/wiki/Tmux) if your SSH connection is unstable.

docs/configuring-playbook-bot-buscarron.md

@@ -5,20 +5,6 @@ The playbook can install and configure [buscarron](https://gitlab.com/etke.cc/bu
 It's a bot you can use to setup **your own helpdesk on matrix**
 It's a bot you can use to send any form (HTTP POST, HTML) to a (encrypted) matrix room
 
-## Registering the bot user
-
-By default, the playbook will set up the bot with a username like this: `@bot.buscarron:DOMAIN`.
-
-(to use a different username, adjust the `matrix_bot_buscarron_login` variable).
-
-You **need to register the bot user manually** before setting up the bot. You can use the playbook to [register a new user](registering-users.md):
-
-```
-ansible-playbook -i inventory/hosts setup.yml --extra-vars='username=bot.buscarron password=PASSWORD_FOR_THE_BOT admin=no' --tags=register-user
-```
-
-Choose a strong password for the bot. You can generate a good password with a command like this: `pwgen -s 64 1`.
-
 
 ## Adjusting the playbook configuration
 
@@ -27,7 +13,10 @@ Add the following configuration to your `inventory/host_vars/matrix.DOMAIN/vars.
 ```yaml
 matrix_bot_buscarron_enabled: true
 
-# Adjust this to whatever password you chose when registering the bot user
+# Uncomment and adjust this part if you'd like to use a username different than the default
+# matrix_bot_buscarron_login: bot.buscarron
+
+# Generate a strong password here. Consider generating it with `pwgen -s 64 1`
 matrix_bot_buscarron_password: PASSWORD_FOR_THE_BOT
 
 # Adjust accepted forms
@@ -36,10 +25,10 @@ matrix_bot_buscarron_forms:
     room: "!yourRoomID:DOMAIN" # (mandatory) Room ID where form submission will be posted
     redirect: https://DOMAIN # (mandatory) To what page user will be redirected after the form submission
     ratelimit: 1r/m # (optional) rate limit of the form, format: <max requests>r/<interval:s,m>, eg: 1r/s or 54r/m
+    hasemail: 1 # (optional) form has "email" field that should be validated
     extensions: [] # (optional) list of form extensions (not used yet)
 
-matrix_bot_buscarron_spam_hosts: [] # (optional) list of email domains/hosts that should be rejected automatically
-matrix_bot_buscarron_spam_emails: [] # (optional) list of email addresses that should be rejected automatically
+matrix_bot_buscarron_spamlist: [] # (optional) list of emails/domains/hosts (with wildcards support) that should be rejected automatically
 ```
 
 You will also need to add a DNS record so that buscarron can be accessed.
@@ -57,9 +46,15 @@ matrix_server_fqn_buscarron: "form.{{ matrix_domain }}"
 
 After configuring the playbook, run the [installation](installing.md) command again:
 
+```sh
+ansible-playbook -i inventory/hosts setup.yml --tags=setup-all,ensure-matrix-users-created,start
 ```
-ansible-playbook -i inventory/hosts setup.yml --tags=setup-all,start
-```
+
+**Notes**:
+
+- the `ensure-matrix-users-created` playbook tag makes the playbook automatically create the bot's user account
+
+- if you change the bot password (`matrix_bot_buscarron_password` in your `vars.yml` file) subsequently, the bot user's credentials on the homeserver won't be updated automatically. If you'd like to change the bot user's password, use a tool like [synapse-admin](configuring-playbook-synapse-admin.md) to change it, and then update `matrix_bot_buscarron_password` to let the bot know its new password
 
 
 ## Usage

docs/configuring-playbook-bot-honoroit.md

@@ -7,21 +7,6 @@ It's a bot you can use to setup **your own helpdesk on matrix**
 See the project's [documentation](https://gitlab.com/etke.cc/honoroit#how-it-looks-like) to learn what it does with screenshots and why it might be useful to you.
 
 
-## Registering the bot user
-
-By default, the playbook will set up the bot with a username like this: `@honoroit:DOMAIN`.
-
-(to use a different username, adjust the `matrix_bot_honoroit_login` variable).
-
-You **need to register the bot user manually** before setting up the bot. You can use the playbook to [register a new user](registering-users.md):
-
-```
-ansible-playbook -i inventory/hosts setup.yml --extra-vars='username=honoroit password=PASSWORD_FOR_THE_BOT admin=no' --tags=register-user
-```
-
-Choose a strong password for the bot. You can generate a good password with a command like this: `pwgen -s 64 1`.
-
-
 ## Adjusting the playbook configuration
 
 Add the following configuration to your `inventory/host_vars/matrix.DOMAIN/vars.yml` file:
@@ -29,7 +14,10 @@ Add the following configuration to your `inventory/host_vars/matrix.DOMAIN/vars.
 ```yaml
 matrix_bot_honoroit_enabled: true
 
-# Adjust this to whatever password you chose when registering the bot user
+# Uncomment and adjust this part if you'd like to use a username different than the default
+# matrix_bot_honoroit_login: honoroit
+
+# Generate a strong password here. Consider generating it with `pwgen -s 64 1`
 matrix_bot_honoroit_password: PASSWORD_FOR_THE_BOT
 
 # Adjust this to your room ID
@@ -41,9 +29,15 @@ matrix_bot_honoroit_roomid: "!yourRoomID:DOMAIN"
 
 After configuring the playbook, run the [installation](installing.md) command again:
 
+```sh
+ansible-playbook -i inventory/hosts setup.yml --tags=setup-all,ensure-matrix-users-created,start
 ```
-ansible-playbook -i inventory/hosts setup.yml --tags=setup-all,start
-```
+
+**Notes**:
+
+- the `ensure-matrix-users-created` playbook tag makes the playbook automatically create the bot's user account
+
+- if you change the bot password (`matrix_bot_honoroit_password` in your `vars.yml` file) subsequently, the bot user's credentials on the homeserver won't be updated automatically. If you'd like to change the bot user's password, use a tool like [synapse-admin](configuring-playbook-synapse-admin.md) to change it, and then update `matrix_bot_honoroit_password` to let the bot know its new password
 
 
 ## Usage

docs/configuring-playbook-bot-matrix-registration-bot.md

@@ -16,7 +16,7 @@ By default, the playbook will set use the bot with a username like this: `@bot.m
 
 (to use a different username, adjust the `matrix_bot_matrix_registration_bot_matrix_user_id_localpart` variable).
 
-You **need to register the bot user manually** before setting up the bot. You can use the playbook to [register a new user](registering-users.md):
+For [other bots supported by the playbook](configuring-playbook.md#bots), Matrix bot user accounts are created and put to use automatically. For `matrix-registration-bot`, however, this is not the case - you **need to register the bot user manually** before setting up the bot. You can use the playbook to [register a new user](registering-users.md):
 
 ```
 ansible-playbook -i inventory/hosts setup.yml --extra-vars='username=bot.matrix-registration-bot password=PASSWORD_FOR_THE_BOT admin=yes' --tags=register-user

docs/configuring-playbook-bot-matrix-reminder-bot.md

@@ -7,21 +7,6 @@ It's a bot you can use to **schedule one-off & recurring reminders and alarms**.
 See the project's [documentation](https://github.com/anoadragon453/matrix-reminder-bot#usage) to learn what it does and why it might be useful to you.
 
 
-## Registering the bot user
-
-By default, the playbook will set up the bot with a username like this: `@bot.matrix-reminder-bot:DOMAIN`.
-
-(to use a different username, adjust the `matrix_bot_matrix_reminder_bot_matrix_user_id_localpart` variable).
-
-You **need to register the bot user manually** before setting up the bot. You can use the playbook to [register a new user](registering-users.md):
-
-```
-ansible-playbook -i inventory/hosts setup.yml --extra-vars='username=bot.matrix-reminder-bot password=PASSWORD_FOR_THE_BOT admin=no' --tags=register-user
-```
-
-Choose a strong password for the bot. You can generate a good password with a command like this: `pwgen -s 64 1`.
-
-
 ## Adjusting the playbook configuration
 
 Add the following configuration to your `inventory/host_vars/matrix.DOMAIN/vars.yml` file:
@@ -29,7 +14,10 @@ Add the following configuration to your `inventory/host_vars/matrix.DOMAIN/vars.
 ```yaml
 matrix_bot_matrix_reminder_bot_enabled: true
 
-# Adjust this to whatever password you chose when registering the bot user
+# Uncomment and adjust this part if you'd like to use a username different than the default
+# matrix_bot_matrix_reminder_bot_matrix_user_id_localpart: bot.matrix-reminder-bot
+
+# Generate a strong password here. Consider generating it with `pwgen -s 64 1`
 matrix_bot_matrix_reminder_bot_matrix_user_password: PASSWORD_FOR_THE_BOT
 
 # Adjust this to your timezone
@@ -41,9 +29,15 @@ matrix_bot_matrix_reminder_bot_reminders_timezone: Europe/London
 
 After configuring the playbook, run the [installation](installing.md) command again:
 
+```sh
+ansible-playbook -i inventory/hosts setup.yml --tags=setup-all,ensure-matrix-users-created,start
 ```
-ansible-playbook -i inventory/hosts setup.yml --tags=setup-all,start
-```
+
+**Notes**:
+
+- the `ensure-matrix-users-created` playbook tag makes the playbook automatically create the bot's user account
+
+- if you change the bot password (`matrix_bot_matrix_reminder_bot_matrix_user_password` in your `vars.yml` file) subsequently, the bot user's credentials on the homeserver won't be updated automatically. If you'd like to change the bot user's password, use a tool like [synapse-admin](configuring-playbook-synapse-admin.md) to change it, and then update `matrix_bot_matrix_reminder_bot_matrix_user_password` to let the bot know its new password
 
 
 ## Usage

docs/configuring-playbook-bot-postmoogle.md

@@ -9,21 +9,6 @@ It's a bot/bridge you can use to forward emails to Matrix rooms
 See the project's [documentation](https://gitlab.com/etke.cc/postmoogle) to learn what it does and why it might be useful to you.
 
 
-## Registering the bot user
-
-By default, the playbook will set up the bot with a username like this: `@postmoogle:DOMAIN`.
-
-(to use a different username, adjust the `matrix_bot_postmoogle_login` variable).
-
-You **need to register the bot user manually** before setting up the bot. You can use the playbook to [register a new user](registering-users.md):
-
-```
-ansible-playbook -i inventory/hosts setup.yml --extra-vars='username=postmoogle password=PASSWORD_FOR_THE_BOT admin=no' --tags=register-user
-```
-
-Choose a strong password for the bot. You can generate a good password with a command like this: `pwgen -s 64 1`.
-
-
 ## Adjusting the playbook configuration
 
 Add the following configuration to your `inventory/host_vars/matrix.DOMAIN/vars.yml` file:
@@ -31,7 +16,10 @@ Add the following configuration to your `inventory/host_vars/matrix.DOMAIN/vars.
 ```yaml
 matrix_bot_postmoogle_enabled: true
 
-# Adjust this to whatever password you chose when registering the bot user
+# Uncomment and adjust this part if you'd like to use a username different than the default
+# matrix_bot_postmoogle_login: postmoogle
+
+# Generate a strong password here. Consider generating it with `pwgen -s 64 1`
 matrix_bot_postmoogle_password: PASSWORD_FOR_THE_BOT
 ```
 
@@ -43,9 +31,15 @@ See [Configuring DNS](configuring-dns.md).
 
 After configuring the playbook, run the [installation](installing.md) command again:
 
+```sh
+ansible-playbook -i inventory/hosts setup.yml --tags=setup-all,ensure-matrix-users-created,start
 ```
-ansible-playbook -i inventory/hosts setup.yml --tags=setup-all,start
-```
+
+**Notes**:
+
+- the `ensure-matrix-users-created` playbook tag makes the playbook automatically create the bot's user account
+
+- if you change the bot password (`matrix_bot_postmoogle_password` in your `vars.yml` file) subsequently, the bot user's credentials on the homeserver won't be updated automatically. If you'd like to change the bot user's password, use a tool like [synapse-admin](configuring-playbook-synapse-admin.md) to change it, and then update `matrix_bot_postmoogle_password` to let the bot know its new password
 
 
 ## Usage

docs/configuring-playbook-bridge-appservice-kakaotalk.md

@@ -28,8 +28,8 @@ There are some additional things you may wish to configure about the bridge.
 
 Take a look at:
 
-- `roles/matrix-bridge-appservice-kakaotalk/defaults/main.yml` for some variables that you can customize via your `vars.yml` file
-- `roles/matrix-bridge-appservice-kakaotalk/templates/config.yaml.j2` for the bridge's default configuration. You can override settings (even those that don't have dedicated playbook variables) using the `matrix_appservice_kakaotalk_configuration_extension_yaml` variable
+- `roles/custom/matrix-bridge-appservice-kakaotalk/defaults/main.yml` for some variables that you can customize via your `vars.yml` file
+- `roles/custom/matrix-bridge-appservice-kakaotalk/templates/config.yaml.j2` for the bridge's default configuration. You can override settings (even those that don't have dedicated playbook variables) using the `matrix_appservice_kakaotalk_configuration_extension_yaml` variable
 
 
 ### Set up Double Puppeting

docs/configuring-playbook-bridge-beeper-linkedin.md

@@ -27,7 +27,7 @@ matrix_beeper_linkedin_configuration_extension_yaml: |
       '@YOUR_USERNAME:YOUR_DOMAIN': admin
 ```
 
-You may wish to look at `roles/matrix-bridge-beeper-linkedin/templates/config.yaml.j2` to find other things you would like to configure.
+You may wish to look at `roles/custom/matrix-bridge-beeper-linkedin/templates/config.yaml.j2` to find other things you would like to configure.
 
 
 ## Set up Double Puppeting

docs/configuring-playbook-bridge-heisenbridge.md

@@ -8,7 +8,7 @@ See the project's [README](https://github.com/hifi/heisenbridge/blob/master/READ
 
 ## Configuration
 
-Below are the common configuration options that you may want to set, exhaustive list is in [the bridge's defaults var file](../roles/matrix-bridge-heisenbridge/defaults/main.yml).
+Below are the common configuration options that you may want to set, exhaustive list is in [the bridge's defaults var file](../roles/custom/matrix-bridge-heisenbridge/defaults/main.yml).
 
 At a minimum, you only need to enable the bridge to get it up and running (`inventory/host_vars/matrix.DOMAIN/vars.yml`):
 

docs/configuring-playbook-bridge-hookshot.md

@@ -13,12 +13,15 @@ Note: the playbook also supports [matrix-appservice-webhooks](configuring-playbo
 
 Refer to the [official instructions](https://matrix-org.github.io/matrix-hookshot/latest/setup.html) to learn what the individual options do.
 
-1. For each of the services (GitHub, GitLab, Jira, Figma, generic webhooks) fill in the respective variables `matrix_hookshot_service_*` listed in [main.yml](/roles/matrix-bridge-hookshot/defaults/main.yml) as required.
-2. Take special note of the `matrix_hookshot_*_enabled` variables. Services that need no further configuration are enabled by default (GitLab, Generic), while you must first add the required configuration and enable the others (GitHub, Jira, Figma).
-3. If you're setting up the GitHub bridge, you'll need to generate and download a private key file after you created your GitHub app. Copy the contents of that file to the variable `matrix_hookshot_github_private_key` so the playbook can install it for you, or use one of the [other methods](#manage-github-private-key-with-matrix-aux-role) explained below.
-4. If you've already installed Matrix services using the playbook before, you'll need to re-run it (`--tags=setup-all,start`). If not, proceed with [configuring other playbook services](configuring-playbook.md) and then with [Installing](installing.md). Get back to this guide once ready. Hookshot can be set up individually using the tag `setup-hookshot`.
+1. Enable the bridge by adding `matrix_hookshot_enabled: true` to your `vars.yml` file
+2. For each of the services (GitHub, GitLab, Jira, Figma, generic webhooks) fill in the respective variables `matrix_hookshot_service_*` listed in [main.yml](/roles/custom/matrix-bridge-hookshot/defaults/main.yml) as required.
+3. Take special note of the `matrix_hookshot_*_enabled` variables. Services that need no further configuration are enabled by default (GitLab, Generic), while you must first add the required configuration and enable the others (GitHub, Jira, Figma).
+4. If you're setting up the GitHub bridge, you'll need to generate and download a private key file after you created your GitHub app. Copy the contents of that file to the variable `matrix_hookshot_github_private_key` so the playbook can install it for you, or use one of the [other methods](#manage-github-private-key-with-matrix-aux-role) explained below.
+5. If you've already installed Matrix services using the playbook before, you'll need to re-run it (`--tags=setup-all,start`). If not, proceed with [configuring other playbook services](configuring-playbook.md) and then with [Installing](installing.md). Get back to this guide once ready. Hookshot can be set up individually using the tag `setup-hookshot`.
 
-Other configuration options are available via the `matrix_hookshot_configuration_extension_yaml` and `matrix_hookshot_registration_extension_yaml` variables, see the comments in [main.yml](/roles/matrix-bridge-hookshot/defaults/main.yml) for how to use them.
+Other configuration options are available via the `matrix_hookshot_configuration_extension_yaml` and `matrix_hookshot_registration_extension_yaml` variables, see the comments in [main.yml](/roles/custom/matrix-bridge-hookshot/defaults/main.yml) for how to use them.
+
+Finally, run the playbook (see [installing](installing.md)).
 
 
 ## Usage
@@ -51,14 +54,14 @@ Unless indicated otherwise, the following endpoints are reachable on your `matri
 | widgets | `/hookshot/widgetapi/` | `matrix_hookshot_widgets_endpoint` | Widgets |
 | metrics | `/metrics/hookshot` | `matrix_hookshot_metrics_enabled` and `matrix_hookshot_metrics_proxying_enabled`. Requires `/metrics/*` endpoints to also be enabled via `matrix_nginx_proxy_proxy_matrix_metrics_enabled` (see the `matrix-nginx-proxy` role). Read more in the [Metrics section](#metrics) below. | Prometheus |
 
-See also `matrix_hookshot_matrix_nginx_proxy_configuration` in [init.yml](/roles/matrix-bridge-hookshot/tasks/init.yml).
+See also `matrix_hookshot_matrix_nginx_proxy_configuration` in [init.yml](/roles/custom/matrix-bridge-hookshot/tasks/init.yml).
 
-The different listeners are also reachable *internally* in the docker-network via the container's name (configured by `matrix_hookshot_container_url`) and on different ports (e.g. `matrix_hookshot_appservice_port`). Read [main.yml](/roles/matrix-bridge-hookshot/defaults/main.yml) in detail for more info.
+The different listeners are also reachable *internally* in the docker-network via the container's name (configured by `matrix_hookshot_container_url`) and on different ports (e.g. `matrix_hookshot_appservice_port`). Read [main.yml](/roles/custom/matrix-bridge-hookshot/defaults/main.yml) in detail for more info.
 
 ### Manage GitHub Private Key with matrix-aux role
 
 The GitHub bridge requires you to install a private key file. This can be done in multiple ways:
-- copy the *contents* of the downloaded file and set the variable `matrix_hookshot_github_private_key` to the contents (see example in [main.yml](/roles/matrix-bridge-hookshot/defaults/main.yml)).
+- copy the *contents* of the downloaded file and set the variable `matrix_hookshot_github_private_key` to the contents (see example in [main.yml](/roles/custom/matrix-bridge-hookshot/defaults/main.yml)).
 - somehow copy the file to the path `{{ matrix_hookshot_base_path }}/{{ matrix_hookshot_github_private_key_file }}` (default: `/matrix/hookshot/private-key.pem`) on the server manually.
 - use the `matrix-aux` role to copy the file from an arbitrary path on your ansible client to the correct path on the server.
 
@@ -71,7 +74,7 @@ matrix_aux_file_definitions:
     owner: "{{ matrix_user_username }}"
     group: "{{ matrix_user_groupname }}"
 ```
-For more info see the documentation in the [matrix-aux base configuration file](/roles/matrix-aux/defaults/main.yml).
+For more info see the documentation in the [matrix-aux base configuration file](/roles/custom/matrix-aux/defaults/main.yml).
 
 ### Provisioning API
 

docs/configuring-playbook-bridge-mautrix-discord.md

@@ -1,7 +1,7 @@
 # Setting up Mautrix Discord (optional)
 
-**Note**: bridging to [Discord](https://discordapp.com/) can also happen via the [mx-puppet-discord](configuring-playbook-bridge-mx-puppet-discord.md) and [matrix-appservice-discord](configuring-playbook-bridge-appservice-discord.md) bridges supported by the playbook.  
-- For using as a Bot we recommend the [Appservice Discord](configuring-playbook-bridge-appservice-discord.md), because it supports plumbing.  
+**Note**: bridging to [Discord](https://discordapp.com/) can also happen via the [mx-puppet-discord](configuring-playbook-bridge-mx-puppet-discord.md) and [matrix-appservice-discord](configuring-playbook-bridge-appservice-discord.md) bridges supported by the playbook.
+- For using as a Bot we recommend the [Appservice Discord](configuring-playbook-bridge-appservice-discord.md), because it supports plumbing.
 - For personal use with a discord account we recommend the `mautrix-discord` bridge (the one being discussed here), because it is the most fully-featured and stable of the 3 Discord bridges supported by the playbook.
 The `mautrix-discord` bridge (the one being discussed here) is the most fully-featured and stable of the 3 Discord bridges supported by the playbook, so it's the one we recommend.
 
@@ -12,7 +12,7 @@ See the project's [documentation](https://docs.mau.fi/bridges/go/discord/index.h
 
 ## Prerequisites
 
-For using this bridge, you would **need to authenticate by scanning a QR code with the Discord app on your phone**.
+For using this bridge, you would need to authenticate by **scanning a QR code** with the Discord app on your phone **or** by using **discord account token**.
 
 You can delete the Discord app after the authentication process.
 
@@ -40,8 +40,8 @@ There are some additional things you may wish to configure about the bridge.
 
 Take a look at:
 
-- `roles/matrix-bridge-mautrix-discord/defaults/main.yml` for some variables that you can customize via your `vars.yml` file
-- `roles/matrix-bridge-mautrix-discord/templates/config.yaml.j2` for the bridge's default configuration. You can override settings (even those that don't have dedicated playbook variables) using the `matrix_mautrix_discord_configuration_extension_yaml` variable
+- `roles/custom/matrix-bridge-mautrix-discord/defaults/main.yml` for some variables that you can customize via your `vars.yml` file
+- `roles/custom/matrix-bridge-mautrix-discord/templates/config.yaml.j2` for the bridge's default configuration. You can override settings (even those that don't have dedicated playbook variables) using the `matrix_mautrix_discord_configuration_extension_yaml` variable
 
 
 ### Set up Double Puppeting
@@ -70,7 +70,7 @@ When using this method, **each user** that wishes to enable Double Puppeting nee
 ## Usage
 
 1. Start a chat with `@discordbot:YOUR_DOMAIN` (where `YOUR_DOMAIN` is your base domain, not the `matrix.` domain).
-2. Send a `login` command
+2. If you would like to login to Discord using a token, send `login-token` command, otherwise, send `login-qr` command.
 3. You'll see a QR code which you need to scan with the Discord app on your phone. You can scan it with the camera app too, which will open Discord, which will then instruct you to scan it a 2nd time in the Discord app.
 4. After confirming (in the Discord app) that you'd like to allow this login, the bot should respond with "Succcessfully authenticated as ..."
 5. Now that you're logged in, you can send a `help` command to the bot again, to see additional commands you have access to

docs/configuring-playbook-bridge-mautrix-facebook.md

@@ -39,7 +39,7 @@ matrix_mautrix_facebook_configuration_extension_yaml: |
       default: true
 ```
 
-You may wish to look at `roles/matrix-bridge-mautrix-facebook/templates/config.yaml.j2` and `roles/matrix-bridge-mautrix-facebook/defaults/main.yml` to find other things you would like to configure.
+You may wish to look at `roles/custom/matrix-bridge-mautrix-facebook/templates/config.yaml.j2` and `roles/custom/matrix-bridge-mautrix-facebook/defaults/main.yml` to find other things you would like to configure.
 
 
 ## Set up Double Puppeting

docs/configuring-playbook-bridge-mautrix-instagram.md

@@ -31,7 +31,7 @@ matrix_mautrix_instagram_configuration_extension_yaml: |
       '@YOUR_USERNAME:YOUR_DOMAIN': admin
 ```
 
-You may wish to look at `roles/matrix-bridge-mautrix-instagram/templates/config.yaml.j2` and `roles/matrix-bridge-mautrix-instagram/defaults/main.yml` to find other things you would like to configure.
+You may wish to look at `roles/custom/matrix-bridge-mautrix-instagram/templates/config.yaml.j2` and `roles/custom/matrix-bridge-mautrix-instagram/defaults/main.yml` to find other things you would like to configure.
 
 
 ## Usage

docs/configuring-playbook-bridge-mautrix-signal.md

@@ -55,7 +55,7 @@ matrix_mautrix_signal_bridge_permissions: |
   '@USER:YOUR_DOMAIN' : user
 ```
 
-You may wish to look at `roles/matrix-bridge-mautrix-signal/templates/config.yaml.j2` to find more information on the permissions settings and other options you would like to configure.
+You may wish to look at `roles/custom/matrix-bridge-mautrix-signal/templates/config.yaml.j2` to find more information on the permissions settings and other options you would like to configure.
 
 ## Set up Double Puppeting
 

docs/configuring-playbook-client-element.md

@@ -17,7 +17,7 @@ matrix_client_element_enabled: false
 
 The playbook provides some customization variables you could use to change Element's settings.
 
-Their defaults are defined in [`roles/matrix-client-element/defaults/main.yml`](../roles/matrix-client-element/defaults/main.yml) and they ultimately end up in the generated `/matrix/element/config.json` file (on the server). This file is generated from the [`roles/matrix-client-element/templates/config.json.j2`](../roles/matrix-client-element/templates/config.json.j2) template.
+Their defaults are defined in [`roles/custom/matrix-client-element/defaults/main.yml`](../roles/custom/matrix-client-element/defaults/main.yml) and they ultimately end up in the generated `/matrix/element/config.json` file (on the server). This file is generated from the [`roles/custom/matrix-client-element/templates/config.json.j2`](../roles/custom/matrix-client-element/templates/config.json.j2) template.
 
 **If there's an existing variable** which controls a setting you wish to change, you can simply define that variable in your configuration file (`inventory/host_vars/matrix.<your-domain>/vars.yml`) and [re-run the playbook](installing.md) to apply the changes.
 
@@ -25,9 +25,9 @@ Alternatively, **if there is no pre-defined variable** for an Element setting yo
 
 - you can either **request a variable to be created** (or you can submit such a contribution yourself). Keep in mind that it's **probably not a good idea** to create variables for each one of Element's various settings that rarely get used.
 
-- or, you can **extend and override the default configuration** ([`config.json.j2`](../roles/matrix-client-element/templates/config.json.j2)) by making use of the `matrix_client_element_configuration_extension_json_` variable. You can find information about this in [`roles/matrix-client-element/defaults/main.yml`](../roles/matrix-client-element/defaults/main.yml).
+- or, you can **extend and override the default configuration** ([`config.json.j2`](../roles/custom/matrix-client-element/templates/config.json.j2)) by making use of the `matrix_client_element_configuration_extension_json_` variable. You can find information about this in [`roles/custom/matrix-client-element/defaults/main.yml`](../roles/custom/matrix-client-element/defaults/main.yml).
 
-- or, if extending the configuration is still not powerful enough for your needs, you can **override the configuration completely** using `matrix_client_element_configuration_default` (or `matrix_client_element_configuration`). You can find information about this in [`roles/matrix-client-element/defaults/main.yml`](../roles/matrix-client-element/defaults/main.yml).
+- or, if extending the configuration is still not powerful enough for your needs, you can **override the configuration completely** using `matrix_client_element_configuration_default` (or `matrix_client_element_configuration`). You can find information about this in [`roles/custom/matrix-client-element/defaults/main.yml`](../roles/custom/matrix-client-element/defaults/main.yml).
 
 
 ## Themes

docs/configuring-playbook-conduit.md

@@ -0,0 +1,58 @@
+# Configuring Conduit (optional)
+
+By default, this playbook configures the [Synapse](https://github.com/matrix-org/synapse) Matrix server, but you can also use [Conduit](https://conduit.rs).
+
+**NOTES**:
+
+- **You can't switch an existing Matrix server's implementation** (e.g. Synapse -> Conduit). Proceed below only if you're OK with losing data or you're dealing with a server on a new domain name, which hasn't participated in the Matrix federation yet.
+
+- **homeserver implementations other than Synapse may not be fully functional**. The playbook may also not assist you in an optimal way (like it does with Synapse). Make yourself familiar with the downsides before proceeding
+
+
+## Installation
+
+To use Conduit, you **generally** need the following additional `vars.yml` configuration:
+
+```yaml
+matrix_homeserver_implementation: conduit
+```
+
+However, since Conduit is difficult (see [famedly/conduit#276](https://gitlab.com/famedly/conduit/-/issues/276) and [famedly/conduit#354](https://gitlab.com/famedly/conduit/-/merge_requests/354)) when it comes to creating the first user account and does not support [registering users](registering-users.md) (via the command line or via the playbook) like Synapse and Dendrite do, we recommend the following flow:
+
+1. Add `matrix_conduit_allow_registration: true` to your `vars.yml` the first time around, temporarily
+2. Run the playbook (`ansible-playbook -i inventory/hosts setup.yml --tags=setup-all,start` - see [Installing](installing.md))
+3. Create your first user via Element or any other client which supports creating users
+4. Get rid of `matrix_conduit_allow_registration: true` from your `vars.yml`
+5. Run the playbook again (`ansible-playbook -i inventory/hosts setup.yml --tags=setup-conduit,start` would be enough this time)
+6. You can now use your server safely. Additional users can be created by messaging the internal Conduit bot
+
+
+## Configuring bridges / appservices
+
+Automatic appservice setup is currently unsupported when using conduit. After setting up the service as usual you may notice that it is unable to start.
+
+You will have to manually register appservices using the the [register-appservice](https://gitlab.com/famedly/conduit/-/blob/next/APPSERVICES.md) command.
+
+Find the `registration.yaml` in the `/matrix` directory, for example `/matrix/mautrix-signal/bridge/registration.yaml`, then pass the content to conduit:
+
+
+    @conduit:your.server.name: register-appservice
+    ```
+    as_token: <token>
+    de.sorunome.msc2409.push_ephemeral: true
+    hs_token: <token>
+    id: signal
+    namespaces:
+      aliases:
+      - exclusive: true
+        regex: ^#signal_.+:example\.org$
+      users:
+      - exclusive: true
+        regex: ^@signal_.+:example\.org$
+      - exclusive: true
+        regex: ^@signalbot:example\.org$
+    rate_limited: false
+    sender_localpart: _bot_signalbot
+    url: http://matrix-mautrix-signal:29328
+    ```
+

docs/configuring-playbook-dimension.md

@@ -22,7 +22,7 @@ matrix_dimension_enabled: true
 
 ## Define admin users
 
-These users can modify the integrations this Dimension supports. 
+These users can modify the integrations this Dimension supports.
 Add this to your configuration file (`inventory/host_vars/matrix.<your-domain>/vars.yml`):
 
 ```yaml
@@ -73,6 +73,6 @@ In the interim until the above limitation is resolved, an admin user needs to co
 ## Additional features
 
 To use a more custom configuration, you can define a `matrix_dimension_configuration_extension_yaml` string variable and put your configuration in it.
-To learn more about how to do this, refer to the information about `matrix_dimension_configuration_extension_yaml` in the [default variables file](../roles/matrix-dimension/defaults/main.yml) of the Dimension component.
+To learn more about how to do this, refer to the information about `matrix_dimension_configuration_extension_yaml` in the [default variables file](../roles/custom/matrix-dimension/defaults/main.yml) of the Dimension component.
 
 You can find all configuration options on [GitHub page of Dimension project](https://github.com/turt2live/matrix-dimension/blob/master/config/default.yaml).

docs/configuring-playbook-external-postgres.md

@@ -20,7 +20,7 @@ matrix_synapse_database_database: "your-postgres-server-database-name"
 
 # Rewire any other service (each `matrix-*` role) you may wish to use to use your external Postgres server.
 # Each service expects to have its own dedicated database on the Postgres server
-# and uses its own variable names (see `roles/matrix-*/defaults/main.yml) for configuring Postgres connectivity.
+# and uses its own variable names (see `roles/custom/matrix-*/defaults/main.yml) for configuring Postgres connectivity.
 ```
 
 The database (as specified in `matrix_synapse_database_database`) must exist and be accessible with the given credentials.

docs/configuring-playbook-jitsi.md

@@ -14,7 +14,7 @@ Before installing Jitsi, make sure you've created the `jitsi.DOMAIN` DNS record.
 You may also need to open the following ports to your server:
 
 - `4443/tcp` - RTP media fallback over TCP
-- `10000/udp` - RTP media over UDP. Depending on your firewall/NAT setup, incoming RTP packets on port `10000` may have the external IP of your firewall as destination address, due to the usage of STUN in JVB (see [`matrix_jitsi_jvb_stun_servers`](../roles/matrix-jitsi/defaults/main.yml)).
+- `10000/udp` - RTP media over UDP. Depending on your firewall/NAT setup, incoming RTP packets on port `10000` may have the external IP of your firewall as destination address, due to the usage of STUN in JVB (see [`matrix_jitsi_jvb_stun_servers`](../roles/custom/matrix-jitsi/defaults/main.yml)).
 
 
 ## Installation

docs/configuring-playbook-ma1sd.md

@@ -33,7 +33,7 @@ matrix_ma1sd_matrixorg_forwarding_enabled: true
 ## Customizing email templates
 
 If you'd like to change the default email templates used by ma1sd, take a look at the `matrix_ma1sd_threepid_medium_email_custom_` variables
-(in the `roles/matrix-ma1sd/defaults/main.yml` file.
+(in the `roles/custom/matrix-ma1sd/defaults/main.yml` file.
 
 
 ## ma1sd-controlled Registration
@@ -86,7 +86,7 @@ You can refer to the [ma1sd website](https://github.com/ma1uta/ma1sd) for more d
 
 To use a more custom configuration, you can define a `matrix_ma1sd_configuration_extension_yaml` string variable
 and put your configuration in it.
-To learn more about how to do this, refer to the information about `matrix_ma1sd_configuration_extension_yaml` in the [default variables file](../roles/matrix-ma1sd/defaults/main.yml) of the ma1sd component.
+To learn more about how to do this, refer to the information about `matrix_ma1sd_configuration_extension_yaml` in the [default variables file](../roles/custom/matrix-ma1sd/defaults/main.yml) of the ma1sd component.
 
 ## Example: SMS verification
 

docs/configuring-playbook-mautrix-bridges.md

@@ -64,7 +64,7 @@ Can be used to set the username for the bridge.
 
 ## Discovering additional configuration options
 
-You may wish to look at `roles/matrix-bridge-mautrix-SERVICENAME/templates/config.yaml.j2` and `roles/matrix-bridge-mautrix-SERVICENAME/defaults/main.yml` to find other things you would like to configure.
+You may wish to look at `roles/custom/matrix-bridge-mautrix-SERVICENAME/templates/config.yaml.j2` and `roles/custom/matrix-bridge-mautrix-SERVICENAME/defaults/main.yml` to find other things you would like to configure.
 
 
 ## Set up Double Puppeting
@@ -97,7 +97,7 @@ If you have issues with a service, and are requesting support, the higher levels
 
 ## Usage
 
-You then need to start a chat with `@SERVICENAMEbot:YOUR_DOMAIN` (where `YOUR_DOMAIN` is your base domain, not the `matrix.` domain). 
+You then need to start a chat with `@SERVICENAMEbot:YOUR_DOMAIN` (where `YOUR_DOMAIN` is your base domain, not the `matrix.` domain).
 
 Send `login ` to the bridge bot to get started You can learn more here about authentication from the bridge's official documentation on Authentication https://docs.mau.fi/bridges/python/SERVICENAME/authentication.html  .
 

docs/configuring-playbook-nginx.md

@@ -42,7 +42,7 @@ Besides changing the preset (`matrix_nginx_proxy_ssl_preset`), you can also dire
 - `matrix_nginx_proxy_ssl_prefer_server_ciphers`: for specifying if the server or the client choice when negotiating the cipher. It can set to `on` or `off`.
 - `matrix_nginx_proxy_ssl_ciphers`: for specifying the SSL Cipher suites used by nginx.
 
-For more information about these variables, check the `roles/matrix-nginx-proxy/defaults/main.yml` file.
+For more information about these variables, check the `roles/custom/matrix-nginx-proxy/defaults/main.yml` file.
 
 ## Synapse + OpenID Connect for Single-Sign-On
 
@@ -80,5 +80,5 @@ matrix_nginx_proxy_proxy_http_additional_server_configuration_blocks:
     # These lines will be included in the nginx configuration.
     # This is at the top level of the file, so you will need to define all of the `server { ... }` blocks.
   - |
-    # For advanced use, have a look at the template files in `roles/matrix-nginx-proxy/templates/nginx/conf.d`
+    # For advanced use, have a look at the template files in `roles/custom/matrix-nginx-proxy/templates/nginx/conf.d`
 ```

docs/configuring-playbook-ntfy.md

@@ -23,7 +23,7 @@ matrix_ntfy_configuration_extension_yaml: |
   log_level: DEBUG
 ```
 
-For a more complete list of variables that you could override, see `roles/matrix-ntfy/defaults/main.yml`.
+For a more complete list of variables that you could override, see `roles/custom/matrix-ntfy/defaults/main.yml`.
 
 For a complete list of ntfy config options that you could put in `matrix_ntfy_configuration_extension_yaml`, see the [ntfy config documentation](https://ntfy.sh/docs/config/#config-options).
 

docs/configuring-playbook-own-webserver.md

@@ -34,7 +34,7 @@ No matter which external webserver you decide to go with, you'll need to:
         matrix_nginx_proxy_enabled: false
         ```
     - if using an external server on another host, add the `<service>_http_host_bind_port` or `<service>_http_bind_port` variables for the services that will be exposed by the external server on the other host. The actual name of the variable is listed in the `roles/<service>/defaults/vars.yml` file for each service. Most variables follow the `<service>_http_host_bind_port` format.
-       
+
       These variables will make Docker expose the ports on all network interfaces instead of localhost only.
       [Keep in mind that there are some security concerns if you simply proxy everything.](https://github.com/matrix-org/synapse/blob/master/docs/reverse_proxy.md#synapse-administration-endpoints)
 
@@ -84,7 +84,7 @@ After following  the [Preparation](#preparation) guide above, you can take a loo
 
 ### Using another external webserver
 
-Feel free to look at the [examples/apache](../examples/apache) directory, or the [template files in the matrix-nginx-proxy role](../roles/matrix-nginx-proxy/templates/nginx/conf.d/).
+Feel free to look at the [examples/apache](../examples/apache) directory, or the [template files in the matrix-nginx-proxy role](../roles/custom/matrix-nginx-proxy/templates/nginx/conf.d/).
 
 
 ## Method 2: Fronting the integrated nginx reverse-proxy webserver with another reverse-proxy

docs/configuring-playbook-ssl-certificates.md

@@ -99,7 +99,7 @@ The certificate files would be made available in `/matrix/ssl/config/live/<your-
 
 For automated certificate renewal to work, each port `80` vhost for each domain you are obtaining certificates for needs to forward requests for `/.well-known/acme-challenge` to the certbot container we use for renewal.
 
-See how this is configured for the `matrix.` subdomain in `/matrix/nginx-proxy/conf.d/matrix-synapse.conf`
+See how this is configured for the `matrix.` subdomain in `/matrix/nginx-proxy/conf.d/matrix-domain.conf`
 Don't be alarmed if the above configuration file says port `8080`, instead of port `80`. It's due to port mapping due to our use of containers.
 
 

docs/configuring-playbook-sygnal.md

@@ -41,14 +41,14 @@ matrix_aux_file_definitions:
     group: "{{ matrix_user_groupname }}"
 ```
 
-For a more complete example of available fields and values they can take, see `roles/matrix-sygnal/templates/sygnal.yaml.j2` (or the [upstream `sygnal.yaml.sample` configuration file](https://github.com/matrix-org/sygnal/blob/master/sygnal.yaml.sample)).
+For a more complete example of available fields and values they can take, see `roles/custom/matrix-sygnal/templates/sygnal.yaml.j2` (or the [upstream `sygnal.yaml.sample` configuration file](https://github.com/matrix-org/sygnal/blob/master/sygnal.yaml.sample)).
 
 Configuring [GCM/FCM](https://firebase.google.com/docs/cloud-messaging/) is easier, as it only requires that you provide some config values.
 
 To configure [APNS](https://developer.apple.com/notifications/) (Apple Push Notification Service), you'd need to provide one or more certificate files.
 To do that, the above example configuration:
 
-- makes use of the `matrix-aux` role (and its `matrix_aux_file_definitions` variable) to make the playbook install files into `/matrix/sygnal/data` (the `matrix_sygnal_data_path` variable). See `roles/matrix-aux/defaults/main.yml` for usage examples. It also makes sure the files are owned by `matrix:matrix`, so that Sygnal can read them. Of course, you can also install these files manually yourself, if you'd rather not use `matrix-aux`.
+- makes use of the `matrix-aux` role (and its `matrix_aux_file_definitions` variable) to make the playbook install files into `/matrix/sygnal/data` (the `matrix_sygnal_data_path` variable). See `roles/custom/matrix-aux/defaults/main.yml` for usage examples. It also makes sure the files are owned by `matrix:matrix`, so that Sygnal can read them. Of course, you can also install these files manually yourself, if you'd rather not use `matrix-aux`.
 
 - references these files in the Sygnal configuration (`matrix_sygnal_apps`) using a path like `/data/..` (the `/matrix/sygnal/data` directory on the host system is mounted into the `/data` directory inside the container)
 

docs/configuring-playbook-synapse-s3-storage-provider.md

@@ -39,7 +39,7 @@ matrix_synapse_ext_synapse_s3_storage_provider_config_access_key_id: access-key-
 matrix_synapse_ext_synapse_s3_storage_provider_config_secret_access_key: secret-key-goes-here
 matrix_synapse_ext_synapse_s3_storage_provider_config_storage_class: STANDARD # or STANDARD_IA, etc.
 
-# For additional advanced settings, take a look at `roles/matrix-synapse/defaults/main.yml`
+# For additional advanced settings, take a look at `roles/custom/matrix-synapse/defaults/main.yml`
 ```
 
 If you have existing files in Synapse's media repository (`/matrix/synapse/media-store/..`):

docs/configuring-playbook-synapse.md

@@ -5,7 +5,7 @@ If that's enough for you, you can skip this document.
 
 The playbook provides lots of customization variables you could use to change Synapse's settings.
 
-Their defaults are defined in [`roles/matrix-synapse/defaults/main.yml`](../roles/matrix-synapse/defaults/main.yml) and they ultimately end up in the generated `/matrix/synapse/config/homeserver.yaml` file (on the server). This file is generated from the [`roles/matrix-synapse/templates/synapse/homeserver.yaml.j2`](../roles/matrix-synapse/templates/synapse/homeserver.yaml.j2) template.
+Their defaults are defined in [`roles/custom/matrix-synapse/defaults/main.yml`](../roles/custom/matrix-synapse/defaults/main.yml) and they ultimately end up in the generated `/matrix/synapse/config/homeserver.yaml` file (on the server). This file is generated from the [`roles/custom/matrix-synapse/templates/synapse/homeserver.yaml.j2`](../roles/custom/matrix-synapse/templates/synapse/homeserver.yaml.j2) template.
 
 **If there's an existing variable** which controls a setting you wish to change, you can simply define that variable in your configuration file (`inventory/host_vars/matrix.<your-domain>/vars.yml`) and [re-run the playbook](installing.md) to apply the changes.
 
@@ -13,9 +13,9 @@ Alternatively, **if there is no pre-defined variable** for a Synapse setting you
 
 - you can either **request a variable to be created** (or you can submit such a contribution yourself). Keep in mind that it's **probably not a good idea** to create variables for each one of Synapse's various settings that rarely get used.
 
-- or, you can **extend and override the default configuration** ([`homeserver.yaml.j2`](../roles/matrix-synapse/templates/synapse/homeserver.yaml.j2)) by making use of the `matrix_synapse_configuration_extension_yaml` variable. You can find information about this in [`roles/matrix-synapse/defaults/main.yml`](../roles/matrix-synapse/defaults/main.yml).
+- or, you can **extend and override the default configuration** ([`homeserver.yaml.j2`](../roles/custom/matrix-synapse/templates/synapse/homeserver.yaml.j2)) by making use of the `matrix_synapse_configuration_extension_yaml` variable. You can find information about this in [`roles/custom/matrix-synapse/defaults/main.yml`](../roles/custom/matrix-synapse/defaults/main.yml).
 
-- or, if extending the configuration is still not powerful enough for your needs, you can **override the configuration completely** using `matrix_synapse_configuration` (or `matrix_synapse_configuration_yaml`). You can find information about this in [`roles/matrix-synapse/defaults/main.yml`](../roles/matrix-synapse/defaults/main.yml).
+- or, if extending the configuration is still not powerful enough for your needs, you can **override the configuration completely** using `matrix_synapse_configuration` (or `matrix_synapse_configuration_yaml`). You can find information about this in [`roles/custom/matrix-synapse/defaults/main.yml`](../roles/custom/matrix-synapse/defaults/main.yml).
 
 
 ## Load balancing with workers

docs/configuring-playbook.md

@@ -42,7 +42,10 @@ When you're done with all the configuration you'd like to do, continue with [Ins
 
 ### Core service adjustments
 
-- [Configuring Synapse](configuring-playbook-synapse.md) (optional)
+- Homeserver configuration:
+  - [Configuring Synapse](configuring-playbook-synapse.md), if you're going with the default/recommended homeserver implementation (optional)
+
+  - [Configuring Conduit](configuring-playbook-conduit.md), if you've switched to the [Conduit](https://conduit.rs) homeserver implementation (optional)
 
 - [Configuring Element](configuring-playbook-client-element.md) (optional)
 

docs/configuring-well-known.md

@@ -192,7 +192,7 @@ Make sure to:
 
 ## Confirming it works
 
-No matter which method you've used to set up the well-known files, if you've done it correctly you should be able to see a JSON file at both of these URLs:
+No matter which method you've used to set up the well-known files, if you've done it correctly you should be able to see a JSON file at these URLs:
 
 - `https://<domain>/.well-known/matrix/server`
 - `https://<domain>/.well-known/matrix/client`

docs/installing.md

@@ -1,25 +1,64 @@
 # Installing
 
-## 1. Installing the Matrix services
-
 If you've [configured your DNS](configuring-dns.md) and have [configured the playbook](configuring-playbook.md), you can start the installation procedure.
 
-Run this command to install the Matrix services:
+## Playbook tags introduction
 
-```bash
-ansible-playbook -i inventory/hosts setup.yml --tags=setup-all
+The Ansible playbook's tasks are tagged, so that certain parts of the Ansible playbook can be run without running all other tasks.
+
+The general command syntax is: `ansible-playbook -i inventory/hosts setup.yml --tags=COMMA_SEPARATED_TAGS_GO_HERE`
+
+Here are some playbook tags that you should be familiar with:
+
+- `setup-all` - runs all setup tasks for all components, but does not start/restart services
+
+- `setup-SERVICE` (e.g. `setup-bot-postmoogle`) - runs the setup tasks only for a given role, but does not start/restart services. You can discover these additional tags in each role (`roles/*/main.yml`). Running per-component setup tasks is **not recommended**, as components sometimes depend on each other and running just the setup tasks for a given component may not be enough. For example, setting up the [mautrix-telegram bridge](configuring-playbook-bridge-mautrix-telegram.md), in addition to the `setup-mautrix-telegram` tag, requires database changes (the `setup-postgres` tag) as well as reverse-proxy changes (the `setup-nginx-proxy` tag).
+
+- `start` - starts all systemd services and makes them start automatically in the future
+
+- `stop` - stops all systemd services
+
+- `ensure-matrix-users-created` - a special tag which ensures that all special users needed by the playbook (for bots, etc.) are created
+
+`setup-*` tags **do not start services** automatically, because you may wish to do things before starting services, such as importing a database dump, restoring data from another server, etc.
+
+
+## 1. Installing Matrix
+
+If you **don't** use SSH keys for authentication, but rather a regular password, you may need to add `--ask-pass` to the all Ansible commands
+
+If you **do** use SSH keys for authentication, **and** use a non-root user to *become* root (sudo), you may need to add `-K` (`--ask-become-pass`) to all Ansible commands
+
+There 2 ways to start the installation process - depending on whether you're [Installing a brand new server (without importing data)](#installing-a-brand-new-server-without-importing-data) or [Installing a server into which you'll import old data](#installing-a-server-into-which-youll-import-old-data).
+
+
+### Installing a brand new server (without importing data)
+
+If this is **a brand new** Matrix server and you **won't be importing old data into it**, run all these tags:
+
+```sh
+ansible-playbook -i inventory/hosts setup.yml --tags=setup-all,ensure-matrix-users-created,start
 ```
 
-The above command **doesn't start any services just yet** (another step does this later - below). Feel free to **re-run this setup command any time** you think something is off with the server configuration.
+This will do a full installation and start all Matrix services.
+
+Proceed to [Maintaining your setup in the future](#2-maintaining-your-setup-in-the-future) and [Finalize the installation](#3-finalize-the-installation)
 
-**Notes**:
-- if you **don't** use SSH keys for authentication, but rather a regular password, you may need to add `--ask-pass` to the above (and all other) Ansible commands.
-- if you **do** use SSH keys for authentication, **and** use a non-root user to *become* root (sudo), you may need to add `-K` (`--ask-become-pass`) to the above (and all other) Ansible commands.
 
+### Installing a server into which you'll import old data
+
+If you will be importing data into your newly created Matrix server, install it, but **do not** start its services just yet.
+Starting its services or messing with its database now will affect your data import later on.
+
+To do the installation **without** starting services, run only the `setup-all` tag:
+
+```sh
+ansible-playbook -i inventory/hosts setup.yml --tags=setup-all
+```
 
-## 2. Things you might want to do after installing
+When this command completes, services won't be running yet.
 
-**Before starting the services**, you may want to do additional things like:
+You can now:
 
 - [Importing an existing SQLite database (from another Synapse installation)](importing-synapse-sqlite.md) (optional)
 
@@ -27,21 +66,26 @@ The above command **doesn't start any services just yet** (another step does thi
 
 - [Importing `media_store` data files from an existing Synapse installation](importing-synapse-media-store.md) (optional)
 
+.. and then proceed to starting all services:
 
-## 3. Starting the services
-
-When you're ready to start the Matrix services (and set them up to auto-start in the future), run this command:
-
-```bash
+```sh
 ansible-playbook -i inventory/hosts setup.yml --tags=start
 ```
 
-## 4. Finalize the installation
+Proceed to [Maintaining your setup in the future](#2-maintaining-your-setup-in-the-future) and [Finalize the installation](#3-finalize-the-installation)
+
+
+## 2. Maintaining your setup in the future
+
+Feel free to **re-run the setup command any time** you think something is off with the server configuration. Ansible will take your configuration and update your server to match.
+
+
+## 3. Finalize the installation
 
 Now that services are running, you need to **finalize the installation process** (required for federation to work!) by [Configuring Service Discovery via .well-known](configuring-well-known.md).
 
 
-## 5. Things to do next
+## 4. Things to do next
 
 After you have started the services and **finalized the installation process** (required for federation to work!) by [Configuring Service Discovery via .well-known](configuring-well-known.md), you can:
 

docs/prerequisites.md

@@ -26,7 +26,7 @@ If your distro runs within an [LXC container](https://linuxcontainers.org/), you
 
 - Properly configured DNS records for `<your-domain>` (details in [Configuring DNS](configuring-dns.md)).
 
-- Some TCP/UDP ports open. This playbook configures the server's internal firewall for you. In most cases, you don't need to do anything special. But **if your server is running behind another firewall**, you'd need to open these ports:
+- Some TCP/UDP ports open. This playbook (actually [Docker itself](https://docs.docker.com/network/iptables/)) configures the server's internal firewall for you. In most cases, you don't need to do anything special. But **if your server is running behind another firewall**, you'd need to open these ports:
 
   - `80/tcp`: HTTP webserver
   - `443/tcp`: HTTPS webserver

examples/vars.yml

@@ -12,7 +12,9 @@
 matrix_domain: YOUR_BARE_DOMAIN_NAME_HERE
 
 # The Matrix homeserver software to install.
-# See `roles/matrix-base/defaults/main.yml` for valid options.
+# See:
+#  - `roles/custom/matrix-base/defaults/main.yml` for valid options
+# - the `docs/configuring-playbook-IMPLEMENTATION_NAME.md` documentation page, if one is available for your implementation choice
 matrix_homeserver_implementation: synapse
 
 # A secret used as a base, for generating various other secrets.

group_vars/matrix_servers

@@ -695,6 +695,10 @@ matrix_mautrix_discord_login_shared_secret: "{{ matrix_synapse_ext_password_prov
 matrix_mautrix_discord_database_engine: "{{ 'postgres' if matrix_postgres_enabled else 'sqlite' }}"
 matrix_mautrix_discord_database_password: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'maudiscord.db') | to_uuid }}"
 
+# Enabling bridge.restricted_rooms for this bridge does not work well with Conduit, so we disable it by default.
+# This will be fixed in the upcoming `0.5.0` release of conduit.
+matrix_mautrix_discord_bridge_restricted_rooms: "{{ false if matrix_homeserver_implementation == 'conduit' else true }}"
+
 ######################################################################
 #
 # /matrix-bridge-mautrix-discord
@@ -765,7 +769,7 @@ matrix_heisenbridge_systemd_wanted_services_list: |
 # We don't enable bridges by default.
 matrix_hookshot_enabled: false
 
-matrix_hookshot_container_image_self_build: "{{ matrix_architecture not in ['amd64'] }}"
+matrix_hookshot_container_image_self_build: "{{ matrix_architecture not in ['arm64', 'amd64'] }}"
 
 matrix_hookshot_appservice_token: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'hookshot.as.tok') | to_uuid }}"
 
@@ -1163,7 +1167,7 @@ matrix_bot_honoroit_systemd_required_services_list: |
 # Postgres is the default, except if not using `matrix_postgres` (internal postgres)
 matrix_bot_honoroit_database_engine: "{{ 'postgres' if matrix_postgres_enabled else 'sqlite' }}"
 matrix_bot_honoroit_database_password: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'honoroit.bot.db') | to_uuid }}"
-matrix_bot_honoroit_container_image_self_build: "{{ matrix_architecture not in ['amd64', 'arm32', 'arm64'] }}"
+matrix_bot_honoroit_container_image_self_build: "{{ matrix_architecture not in ['amd64', 'arm64'] }}"
 
 ######################################################################
 #
@@ -1194,7 +1198,7 @@ matrix_bot_buscarron_systemd_required_services_list: |
 # Postgres is the default, except if not using `matrix_postgres` (internal postgres)
 matrix_bot_buscarron_database_engine: "{{ 'postgres' if matrix_postgres_enabled else 'sqlite' }}"
 matrix_bot_buscarron_database_password: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'buscarron.bot.db') | to_uuid }}"
-matrix_bot_buscarron_container_image_self_build: "{{ matrix_architecture not in ['amd64', 'arm32', 'arm64'] }}"
+matrix_bot_buscarron_container_image_self_build: "{{ matrix_architecture not in ['amd64', 'arm64'] }}"
 
 ######################################################################
 #
@@ -1227,7 +1231,7 @@ matrix_bot_postmoogle_systemd_required_services_list: |
 matrix_bot_postmoogle_database_engine: "{{ 'postgres' if matrix_postgres_enabled else 'sqlite' }}"
 matrix_bot_postmoogle_database_password: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'postmoogle.db') | to_uuid }}"
 
-matrix_bot_postmoogle_container_image_self_build: "{{ matrix_architecture not in ['amd64', 'arm32', 'arm64'] }}"
+matrix_bot_postmoogle_container_image_self_build: "{{ matrix_architecture not in ['amd64', 'arm64'] }}"
 
 ######################################################################
 #
@@ -2112,18 +2116,9 @@ matrix_postgres_additional_databases: |
 
    }}
 
-matrix_postgres_import_roles_to_ignore: |
-  {{
-    [matrix_postgres_connection_username]
-    +
-    matrix_postgres_additional_databases|map(attribute='username') | list
-  }}
-
-matrix_postgres_import_databases_to_ignore: |
+matrix_postgres_systemd_services_to_stop_for_maintenance_list: |
   {{
-    [matrix_postgres_db_name]
-    +
-    matrix_postgres_additional_databases|map(attribute='name') | list
+    ['matrix-' + matrix_homeserver_implementation + '.service']
   }}
 
 ######################################################################
@@ -2686,3 +2681,43 @@ matrix_conduit_systemd_required_services_list: |
 # /matrix-conduit
 #
 ######################################################################
+
+
+######################################################################
+#
+# matrix-user-creator
+#
+######################################################################
+
+matrix_user_creator_users_auto: |
+  {{
+    [{
+      'username': matrix_bot_matrix_reminder_bot_matrix_user_id_localpart,
+      'initial_password': matrix_bot_matrix_reminder_bot_matrix_user_password,
+      'initial_type': 'bot',
+    }] if matrix_bot_matrix_reminder_bot_enabled else []
+    +
+    [{
+      'username': matrix_bot_honoroit_login,
+      'initial_password': matrix_bot_honoroit_password,
+      'initial_type': 'bot',
+    }] if matrix_bot_honoroit_enabled else []
+    +
+    [{
+      'username': matrix_bot_postmoogle_login,
+      'initial_password': matrix_bot_postmoogle_password,
+      'initial_type': 'bot',
+    }] if matrix_bot_postmoogle_enabled else []
+    +
+    [{
+      'username': matrix_bot_buscarron_login,
+      'initial_password': matrix_bot_buscarron_password,
+      'initial_type': 'bot',
+    }] if matrix_bot_buscarron_enabled else []
+  }}
+
+######################################################################
+#
+# /matrix-user-creator
+#
+######################################################################

roles/matrix-aux/defaults/main.yml → roles/custom/matrix-aux/defaults/main.yml

@@ -50,6 +50,9 @@ matrix_aux_file_default_mode: '0640'
 # then you likely need to add `/matrix/some/path` to `matrix_aux_directory_definitions` as well.
 # You don't need to do this for directories that the playbook already creates for you.
 #
+# Use a `content` key for text content and `src` with a location to a file for binary content.
+# The `content` key does not support binary content (see https://github.com/ansible/ansible/issues/11594).
+#
 # Example:
 #
 # matrix_aux_file_definitions:
@@ -69,4 +72,10 @@ matrix_aux_file_default_mode: '0640'
 #     mode: '0600'
 #     owner: 'some-user'
 #     group: 'some-group'
+#
+#   - dest: /matrix/aux/binary-file.dat
+#     src: "/path/to/binary.dat"
+#     mode: '0600'
+#     owner: 'some-user'
+#     group: 'some-group'
 matrix_aux_file_definitions: []

roles/matrix-aux/tasks/setup.yml → roles/custom/matrix-aux/tasks/setup.yml

@@ -11,8 +11,9 @@
 
 - name: Ensure AUX files are created
   ansible.builtin.copy:
+    src: "{{ item.src if 'src' in item else omit }}"
+    content: "{{ item.content if 'content' in item else omit }}"
     dest: "{{ item.dest }}"
-    content: "{{ item.content }}"
     owner: "{{ item.owner | default(matrix_user_username) }}"
     group: "{{ item.group | default(matrix_user_groupname) }}"
     mode: "{{ item.mode | default(matrix_aux_file_default_mode) }}"

roles/matrix-backup-borg/tasks/setup_install.yml → roles/custom/matrix-backup-borg/tasks/setup_install.yml

@@ -10,7 +10,7 @@
     when: not matrix_postgres_enabled
 
   - ansible.builtin.import_role:
-      name: matrix-postgres
+      name: custom/matrix-postgres
       tasks_from: detect_existing_postgres_version
 
   - name: Fail if detected Postgres version is unsupported
@@ -59,7 +59,7 @@
     mode: 0600
 
 - name: Ensure borg image is pulled
-  docker_image:
+  community.docker.docker_image:
     name: "{{ matrix_backup_borg_docker_image }}"
     source: "{{ 'pull' if ansible_version.major > 2 or ansible_version.minor > 7 else omit }}"
     force_source: "{{ matrix_backup_borg_docker_image_force_pull if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}"
@@ -82,7 +82,7 @@
   when: "matrix_backup_borg_container_image_self_build | bool"
 
 - name: Ensure borg image is built
-  docker_image:
+  community.docker.docker_image:
     name: "{{ matrix_backup_borg_docker_image }}"
     source: build
     force_source: "{{ matrix_backup_borg_git_pull_results.changed if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}"

roles/matrix-backup-borg/tasks/setup_uninstall.yml → roles/custom/matrix-backup-borg/tasks/setup_uninstall.yml

@@ -36,6 +36,6 @@
     state: absent
 
 - name: Ensure borg Docker image doesn't exist
-  docker_image:
+  community.docker.docker_image:
     name: "{{ matrix_backup_borg_docker_image }}"
     state: absent

roles/matrix-base/defaults/main.yml → roles/custom/matrix-base/defaults/main.yml

@@ -284,6 +284,11 @@ matrix_docker_installation_enabled: true
 # Possible values are "docker-ce" (default) and "docker.io" (Debian).
 matrix_docker_package_name: docker-ce
 
+# Controls whether the current playbook's commit hash is saved in `git_hash.yml` on the target
+# Set this to false if GIT is not installed on the local system (the system where the ansible command is run on)
+# to suppress the warning message.
+matrix_playbook_commit_hash_preservation_enabled: true
+
 # Variables to Control which parts of our roles run.
 run_postgres_import: true
 run_postgres_upgrade: true

roles/matrix-base/tasks/server_base/setup.yml → roles/custom/matrix-base/tasks/server_base/setup.yml

@@ -21,7 +21,8 @@
     register: lsb_release_installation_result
 
   - name: Reread ansible_lsb facts if lsb-release got installed
-    ansible.builtin.setup: filter=ansible_lsb*
+    ansible.builtin.setup:
+      filter: ansible_lsb*
     when: lsb_release_installation_result.changed
 
   - ansible.builtin.include_tasks: "{{ role_path }}/tasks/server_base/setup_debian.yml"

roles/matrix-base/tasks/server_base/setup_archlinux.yml → roles/custom/matrix-base/tasks/server_base/setup_archlinux.yml

@@ -1,7 +1,7 @@
 ---
 
 - name: Install host dependencies
-  pacman:
+  community.general.pacman:
     name:
       - python-docker
       - python-dnspython
@@ -9,7 +9,7 @@
     update_cache: true
 
 - name: Ensure Docker is installed
-  pacman:
+  community.general.pacman:
     name:
       - docker
     state: present

roles/custom/matrix-base/tasks/setup_matrix_base.yml

@@ -0,0 +1,77 @@
+---
+
+- name: Ensure Matrix base path exists
+  ansible.builtin.file:
+    path: "{{ item }}"
+    state: directory
+    mode: "{{ matrix_base_data_path_mode }}"
+    owner: "{{ matrix_user_username }}"
+    group: "{{ matrix_user_groupname }}"
+  with_items:
+    - "{{ matrix_base_data_path }}"
+
+- name: Preserve vars.yml on the server for easily restoring if it gets lost later on
+  ansible.builtin.copy:
+    src: "{{ matrix_vars_yml_snapshotting_src }}"
+    dest: "{{ matrix_base_data_path }}/vars.yml"
+    owner: "{{ matrix_user_username }}"
+    group: "{{ matrix_user_groupname }}"
+    mode: '0660'
+  when: "matrix_vars_yml_snapshotting_enabled | bool"
+
+- name: Save current git-repo status on the target to aid with restoring in case of problems
+  when: "matrix_playbook_commit_hash_preservation_enabled|bool"
+  block:
+    - name: Get local git hash  # noqa command-instead-of-module
+      delegate_to: 127.0.0.1
+      become: false
+      register: git_describe
+      changed_when: false
+      ansible.builtin.shell:
+        git describe
+            --always
+            --tags
+            --dirty
+            --long
+            --all
+
+    - ansible.builtin.set_fact:
+        git_hash: "{{ git_describe.stdout }}"
+
+    - name: Git hash
+      ansible.builtin.debug:
+        msg: "Git hash: {{ git_hash }}"
+
+    - name: Save git_hash.yml on target
+      ansible.builtin.copy:
+        content: "{{ git_hash }}"
+        dest: "{{ matrix_base_data_path }}/git_hash.yml"
+        owner: "{{ matrix_user_username }}"
+        group: "{{ matrix_user_groupname }}"
+        mode: '0660'
+
+  rescue:
+    - name: GIT not found error
+      ansible.builtin.debug:
+        msg: >-
+          Couldn't find GIT on the local machine. Continuing without saving the GIT hash.
+          You can disable saving the GIT hash by setting 'matrix_playbook_commit_hash_preservation_enabled: false' in vars.yml
+      when: "git_describe.stderr.find('git: not found') != -1"
+
+    - name: Get GIT hash error
+      ansible.builtin.fail:
+        msg: >-
+          Error when trying to get the GIT hash. Please consult the error message above.
+          You can disable saving the GIT hash by setting 'matrix_playbook_commit_hash_preservation_enabled: false' in vars.yml
+      when: "git_describe.stderr.find('git: not found') == -1"
+
+- name: Ensure Matrix network is created in Docker
+  community.docker.docker_network:
+    name: "{{ matrix_docker_network }}"
+    driver: bridge
+
+- name: Ensure matrix-remove-all script created
+  ansible.builtin.template:
+    src: "{{ role_path }}/templates/usr-local-bin/matrix-remove-all.j2"
+    dest: "{{ matrix_local_bin_path }}/matrix-remove-all"
+    mode: 0750

roles/matrix-base/tasks/util/ensure_fuse_installed.yml → roles/custom/matrix-base/tasks/util/ensure_fuse_installed.yml

@@ -16,7 +16,7 @@
   when: ansible_os_family == 'Debian'
 
 - name: Ensure fuse installed (Archlinux)
-  pacman:
+  community.general.pacman:
     name:
       - fuse3
     state: present

roles/matrix-base/tasks/util/ensure_openssl_installed.yml → roles/custom/matrix-base/tasks/util/ensure_openssl_installed.yml

@@ -16,7 +16,7 @@
   when: ansible_os_family == 'Debian'
 
 - name: Ensure openssl installed (Archlinux)
-  pacman:
+  community.general.pacman:
     name:
       - openssl
     state: present

roles/matrix-bot-buscarron/defaults/main.yml → roles/custom/matrix-bot-buscarron/defaults/main.yml

@@ -9,7 +9,7 @@ matrix_bot_buscarron_docker_repo: "https://gitlab.com/etke.cc/buscarron.git"
 matrix_bot_buscarron_docker_repo_version: "{{ matrix_bot_buscarron_version }}"
 matrix_bot_buscarron_docker_src_files_path: "{{ matrix_base_data_path }}/buscarron/docker-src"
 
-matrix_bot_buscarron_version: v1.2.1
+matrix_bot_buscarron_version: v1.3.0
 matrix_bot_buscarron_docker_image: "{{ matrix_bot_buscarron_docker_image_name_prefix }}buscarron:{{ matrix_bot_buscarron_version }}"
 matrix_bot_buscarron_docker_image_name_prefix: "{{ 'localhost/' if matrix_bot_buscarron_container_image_self_build else 'registry.gitlab.com/etke.cc/' }}"
 matrix_bot_buscarron_docker_image_force_pull: "{{ matrix_bot_buscarron_docker_image.endswith(':latest') }}"
@@ -78,37 +78,49 @@ matrix_bot_buscarron_homeserver: "{{ matrix_homeserver_container_url }}"
 matrix_bot_buscarron_forms: []
 
 # Disable encryption
-matrix_bot_buscarron_noencryption:
+matrix_bot_buscarron_noencryption: false
 
 # Sentry DSN
-matrix_bot_buscarron_sentry:
+matrix_bot_buscarron_sentry: ''
 
 # Log level
 matrix_bot_buscarron_loglevel: INFO
 
-# spam hosts/domains
+# list of spammers with wildcards support, eg: *@spam.com spam@*, spam@spam.com
+matrix_bot_buscarron_spamlist: []
+
+# spam hosts/domains.
+# deprecated, use matrix_bot_buscarron_spamlist
 matrix_bot_buscarron_spam_hosts: []
 
 # spam email addresses
+# deprecated, use matrix_bot_buscarron_spamlist
 matrix_bot_buscarron_spam_emails: []
 
 # spam email localparts
+# deprecated, use matrix_bot_buscarron_spamlist
 matrix_bot_buscarron_spam_localparts: []
 
-# Ban duration in hours
-matrix_bot_buscarron_ban_duration: 24
-
 # Banlist size
 matrix_bot_buscarron_ban_size: 10000
 
+# Permanent banlist
+matrix_bot_buscarron_ban_list: []
+
 # Postmark token (confirmation emails)
-matrix_bot_buscarron_pm_token:
+matrix_bot_buscarron_pm_token: ''
 
 # Postmark sender signature
-matrix_bot_buscarron_pm_from:
+matrix_bot_buscarron_pm_from: ''
 
 # Postmark confirmation email's reply-to
-matrix_bot_buscarron_pm_replyto:
+matrix_bot_buscarron_pm_replyto: ''
+
+# email address (from) for SMTP validation. Must be valid email on valid SMTP server, otherwise it will be rejected by other servers
+matrix_bot_buscarron_smtp_from: ''
+
+# enforce SMTP validation
+matrix_bot_buscarron_smtp_validation: false
 
 # Additional environment variables to pass to the buscarron container
 #

roles/matrix-bot-buscarron/tasks/setup_install.yml → roles/custom/matrix-bot-buscarron/tasks/setup_install.yml

@@ -21,7 +21,7 @@
               systemd_services_to_stop: ['matrix-bot-buscarron.service']
 
         - ansible.builtin.import_role:
-            name: matrix-postgres
+            name: custom/matrix-postgres
             tasks_from: migrate_db_to_postgres
 
         - ansible.builtin.set_fact:
@@ -50,7 +50,7 @@
     mode: 0640
 
 - name: Ensure buscarron image is pulled
-  docker_image:
+  community.docker.docker_image:
     name: "{{ matrix_bot_buscarron_docker_image }}"
     source: "{{ 'pull' if ansible_version.major > 2 or ansible_version.minor > 7 else omit }}"
     force_source: "{{ matrix_bot_buscarron_docker_image_force_pull if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}"
@@ -73,7 +73,7 @@
   when: "matrix_bot_buscarron_container_image_self_build | bool"
 
 - name: Ensure buscarron image is built
-  docker_image:
+  community.docker.docker_image:
     name: "{{ matrix_bot_buscarron_docker_image }}"
     source: build
     force_source: "{{ matrix_bot_buscarron_git_pull_results.changed if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}"

roles/matrix-bot-buscarron/tasks/setup_uninstall.yml → roles/custom/matrix-bot-buscarron/tasks/setup_uninstall.yml

@@ -31,6 +31,6 @@
     state: absent
 
 - name: Ensure buscarron Docker image doesn't exist
-  docker_image:
+  community.docker.docker_image:
     name: "{{ matrix_bot_buscarron_docker_image }}"
     state: absent

roles/matrix-bot-buscarron/templates/env.j2 → roles/custom/matrix-bot-buscarron/templates/env.j2

@@ -3,22 +3,26 @@ BUSCARRON_PASSWORD={{ matrix_bot_buscarron_password }}
 BUSCARRON_HOMESERVER={{ matrix_bot_buscarron_homeserver }}
 BUSCARRON_DB_DSN={{ matrix_bot_buscarron_database_connection_string }}
 BUSCARRON_DB_DIALECT={{ matrix_bot_buscarron_database_dialect }}
+BUSCARRON_SPAMLIST={{ matrix_bot_buscarron_spamlist|join(" ") }}
 BUSCARRON_SPAM_HOSTS={{ matrix_bot_buscarron_spam_hosts|join(" ") }}
 BUSCARRON_SPAM_EMAILS={{ matrix_bot_buscarron_spam_emails|join(" ") }}
 BUSCARRON_SPAM_LOCALPARTS={{ matrix_bot_buscarron_spam_localparts|join(" ") }}
 BUSCARRON_SENTRY={{ matrix_bot_buscarron_sentry }}
 BUSCARRON_LOGLEVEL={{ matrix_bot_buscarron_loglevel }}
-BUSCARRON_BAN_DURATION={{ matrix_bot_buscarron_ban_duration }}
 BUSCARRON_BAN_SIZE={{ matrix_bot_buscarron_ban_size }}
+BUSCARRON_BAN_LIST={{ matrix_bot_buscarron_ban_list|default('')|join(' ') }}
 BUSCARRON_PM_TOKEN={{ matrix_bot_buscarron_pm_token }}
 BUSCARRON_PM_FROM={{ matrix_bot_buscarron_pm_from }}
 BUSCARRON_PM_REPLYTO={{ matrix_bot_buscarron_pm_replyto }}
+BUSCARRON_SMTP_FROM={{ matrix_bot_buscarron_smtp_from }}
+BUSCARRON_SMTP_VALIDATION={{ matrix_bot_buscarron_smtp_validation }}
 BUSCARRON_NOENCRYPTION={{ matrix_bot_buscarron_noencryption }}
 {% set forms = [] %}
 {% for form in matrix_bot_buscarron_forms -%}{{- forms.append(form.name) -}}
 BUSCARRON_{{ form.name|upper }}_ROOM={{ form.room|default('') }}
 BUSCARRON_{{ form.name|upper }}_REDIRECT={{ form.redirect|default('') }}
 BUSCARRON_{{ form.name|upper }}_HASDOMAIN={{ form.hasdomain|default('') }}
+BUSCARRON_{{ form.name|upper }}_HASEMAIL={{ form.hasemail|default('') }}
 BUSCARRON_{{ form.name|upper }}_RATELIMIT={{ form.ratelimit|default('') }}
 BUSCARRON_{{ form.name|upper }}_EXTENSIONS={{ form.extensions|default('')|join(' ') }}
 BUSCARRON_{{ form.name|upper }}_CONFIRMATION_SUBJECT={{ form.confirmation_subject|default('') }}

roles/matrix-bot-go-neb/tasks/setup_install.yml → roles/custom/matrix-bot-go-neb/tasks/setup_install.yml

@@ -17,7 +17,7 @@
   when: "item.when | bool"
 
 - name: Ensure go-neb image is pulled
-  docker_image:
+  community.docker.docker_image:
     name: "{{ matrix_bot_go_neb_docker_image }}"
     source: "{{ 'pull' if ansible_version.major > 2 or ansible_version.minor > 7 else omit }}"
     force_source: "{{ matrix_bot_go_neb_docker_image_force_pull if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}"

roles/matrix-bot-go-neb/tasks/setup_uninstall.yml → roles/custom/matrix-bot-go-neb/tasks/setup_uninstall.yml

@@ -31,6 +31,6 @@
     state: absent
 
 - name: Ensure go-neb Docker image doesn't exist
-  docker_image:
+  community.docker.docker_image:
     name: "{{ matrix_bot_go_neb_docker_image }}"
     state: absent

roles/matrix-bot-honoroit/defaults/main.yml → roles/custom/matrix-bot-honoroit/defaults/main.yml

@@ -9,7 +9,7 @@ matrix_bot_honoroit_docker_repo: "https://gitlab.com/etke.cc/honoroit.git"
 matrix_bot_honoroit_docker_repo_version: "{{ matrix_bot_honoroit_version }}"
 matrix_bot_honoroit_docker_src_files_path: "{{ matrix_base_data_path }}/honoroit/docker-src"
 
-matrix_bot_honoroit_version: v0.9.15
+matrix_bot_honoroit_version: v0.9.16
 matrix_bot_honoroit_docker_image: "{{ matrix_bot_honoroit_docker_image_name_prefix }}honoroit:{{ matrix_bot_honoroit_version }}"
 matrix_bot_honoroit_docker_image_name_prefix: "{{ 'localhost/' if matrix_bot_honoroit_container_image_self_build else 'registry.gitlab.com/etke.cc/' }}"
 matrix_bot_honoroit_docker_image_force_pull: "{{ matrix_bot_honoroit_docker_image.endswith(':latest') }}"

roles/matrix-bot-honoroit/tasks/setup_install.yml → roles/custom/matrix-bot-honoroit/tasks/setup_install.yml

@@ -21,7 +21,7 @@
               systemd_services_to_stop: ['matrix-bot-honoroit.service']
 
         - ansible.builtin.import_role:
-            name: matrix-postgres
+            name: custom/matrix-postgres
             tasks_from: migrate_db_to_postgres
 
         - ansible.builtin.set_fact:
@@ -50,7 +50,7 @@
     mode: 0640
 
 - name: Ensure honoroit image is pulled
-  docker_image:
+  community.docker.docker_image:
     name: "{{ matrix_bot_honoroit_docker_image }}"
     source: "{{ 'pull' if ansible_version.major > 2 or ansible_version.minor > 7 else omit }}"
     force_source: "{{ matrix_bot_honoroit_docker_image_force_pull if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}"
@@ -73,7 +73,7 @@
   when: "matrix_bot_honoroit_container_image_self_build | bool"
 
 - name: Ensure honoroit image is built
-  docker_image:
+  community.docker.docker_image:
     name: "{{ matrix_bot_honoroit_docker_image }}"
     source: build
     force_source: "{{ matrix_bot_honoroit_git_pull_results.changed if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}"

roles/matrix-bot-honoroit/tasks/setup_uninstall.yml → roles/custom/matrix-bot-honoroit/tasks/setup_uninstall.yml

@@ -31,6 +31,6 @@
     state: absent
 
 - name: Ensure honoroit Docker image doesn't exist
-  docker_image:
+  community.docker.docker_image:
     name: "{{ matrix_bot_honoroit_docker_image }}"
     state: absent