* feat: support container_network=host across all roles + systemd templates

Mirror the pattern Slavi introduced for matrix-coturn (aafa8f0) across the
fork: every 'Ensure X container network is created' task gets a
'when: <var> not in ["", "host"]' guard so MDAD does not try to
docker_network create a network literally named 'host' (returns 403,
since host is a pre-defined Docker network).

Mirror the same guard in every systemd unit template that does
'ExecStartPre=docker network connect <addnet> <container>' loops over
matrix_<role>_container_additional_networks: skip the connects when the
container is on host networking (where additional --network attaches
are invalid).

Unblocks DiD setups where MDAD-managed containers share their host's
network namespace (matrix-mdad outer compose service joined to central
postgres/openldap networks) to reach external services on the outer
Docker daemon.

* Simplify container network guards (!= 'host') and fix duplicate when

Guarding on the empty string ('') as well was misleading: systemd unit
templates still render an unconditional --network= flag, so an empty
network value produces a broken docker create command. Only 'host' is
actually supported, so only guard on that. This also matches the
existing convention in the Traefik role
(when: traefik_container_network != 'host').

Also fix a duplicate when key in the meshtastic-relay role, where the
network-creation task already had a when condition - the two are now
combined into a list.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------

Co-authored-by: Slavi Pantaleev <slavi@devture.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

Roles affected: appservice-discord, appservice-irc, beeper-linkedin,
heisenbridge, hookshot, mautrix-bluesky, mautrix-discord,
mautrix-gmessages, mautrix-googlechat, mautrix-signal, mautrix-slack,
mautrix-twitter, mautrix-whatsapp, mautrix-wsproxy, mx-puppet-groupme,
mx-puppet-steam, postmoogle, sms, steam, cactus-comments, element,
fluffychat, schildichat, conduit, corporal, dendrite,
ldap-registration-proxy, media-repo, pantalaimon,
prometheus-nginxlog-exporter, registration, sygnal, synapse-admin,
user-verification-service.

For each role: renamed _docker_image* variables to _container_image*
(and _docker_src_files_path to _container_src_files_path where
applicable), added deprecation entries in validate_config.yml, and
updated group_vars/docs references.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Related to https://github.com/spantaleev/matrix-docker-ansible-deploy/issues/4445

`-t` works on both old and new Docker versions, so it's best to use that.

Looks like these variables were originally named this way in
https://github.com/spantaleev/matrix-docker-ansible-deploy/pull/2089

This paves the way for installing other roles into `roles/galaxy` using `ansible-galaxy`,
similar to how it's done in:

- https://github.com/spantaleev/gitea-docker-ansible-deploy
- https://github.com/spantaleev/nextcloud-docker-ansible-deploy

In the near future, we'll be removing a lot of the shared role code from here
and using upstream roles for it. Some of the core `matrix-*` roles have
already been extracted out into other reusable roles:

- https://github.com/devture/com.devture.ansible.role.postgres
- https://github.com/devture/com.devture.ansible.role.systemd_docker_base
- https://github.com/devture/com.devture.ansible.role.timesync
- https://github.com/devture/com.devture.ansible.role.vars_preserver
- https://github.com/devture/com.devture.ansible.role.playbook_runtime_messages
- https://github.com/devture/com.devture.ansible.role.playbook_help

We just need to migrate to those.

* Add construct for cactus comments role

* Adjust config files

* Add docker self build to defaults

* Adjust tasks

* Fix smaller syntax errors

* Fix env argument

* Add tmp path to allow container writing there

Background why I did this: https://docs.gunicorn.org/en/stable/settings.html#worker-tmp-dir

* Change port back to 5000 as not configurable in container

* Try to add appservice config file for synapse to use

* Inject appservice file

* Correct copied variable name

* Comment out unused app service file injection

would need mounting the appservice file to the synapse container i guess

* Move role before synapse to be able to inject during runtime

* Remove unused parts

* Change default user id to mirror official docs

* Add docs

* Update roles/matrix-cactus-comments/tasks/setup_install.yml

Co-authored-by: Slavi Pantaleev <slavi@devture.com>

* Update roles/matrix-cactus-comments/templates/cactus_appservice.yaml.j2

Co-authored-by: Slavi Pantaleev <slavi@devture.com>

* Generate secrets if necessary, adjust docs

* Rename cactusbot userid

* Shorten salt strings

Co-authored-by: Slavi Pantaleev <slavi@devture.com>

* Use tmpfs instead of persistent mount

* Remove proxy option as it is nonsense

* Add download and serving of cc-client files

* Add documentation on client

* Clarify docs a bit

* Add nginx proxy to required services

Signed-off-by: Julian-Samuel Gebühr <julian-samuel@gebuehr.net>

* Use container address

Signed-off-by: Julian-Samuel Gebühr <julian-samuel@gebuehr.net>

* Correct comment of user id

Signed-off-by: Julian-Samuel Gebühr <julian-samuel@gebuehr.net>

* Use releases or local distributed client

Signed-off-by: Julian-Samuel Gebühr <julian-samuel@gebuehr.net>

* Move homeserver url to defaults

Signed-off-by: Julian-Samuel Gebühr <julian-samuel@gebuehr.net>

* Correct truth value

Signed-off-by: Julian-Samuel Gebühr <julian-samuel@gebuehr.net>

* Add documentation of variables

Co-authored-by: Slavi Pantaleev <slavi@devture.com>

* Tabs vs. spaces

Co-authored-by: Slavi Pantaleev <slavi@devture.com>

* Make nginx root configurable

Signed-off-by: Julian-Samuel Gebühr <julian-samuel@gebuehr.net>

* Complete ake nginx root configurable

Signed-off-by: Julian-Samuel Gebühr <julian-samuel@gebuehr.net>

* Fix file permission

Signed-off-by: Julian-Samuel Gebühr <julian-samuel@gebuehr.net>

* Fix lint errors

Signed-off-by: Julian-Samuel Gebühr <julian-samuel@gebuehr.net>

Signed-off-by: Julian-Samuel Gebühr <julian-samuel@gebuehr.net>
Co-authored-by: Slavi Pantaleev <slavi@devture.com>

People often report and ask about these "failures".
More-so previously, when the `docker kill/rm` output was collected,
but it still happens now when people do `systemctl status
matrix-something` and notice that it says "FAILURE".

Suppressing to avoid further time being wasted on saying "this is
expected".

Reverts b1b4ba501fdfaa, 90c9801c560b6, a3c84f78ca9c65a, ..

I haven't really traced it (yet), but on some servers, I'm observing
`ansible-playbook ... --tags=start` completing very slowly, waiting
to stop services. I can't reproduce this on all Matrix servers I manage.
I suspect that either the systemd version is to blame or that some
specific service is not responding well to some `docker kill/rm` command.

`ExecStop` seems to work great in all cases and it's what we've been
using for a very long time, so I'm reverting to that.