Failing to update the apt cache now reports why, instead of reporting that
the result of the apt module has no cache_updated attribute.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Jitsi migrated image publishing from Docker Hub to the GitHub Container
Registry, and the new registry carries no tag history, so this also moves
Jitsi to stable-11146-1. That release makes the containers rootless and runs
them with a read-only root filesystem.

`jitsi_jvb_container_colibri_ws_host_bind_port` goes away with it. Colibri
WebSocket support was removed upstream in favour of SCTP data channels, so
the Jitsi Video Bridge no longer serves HTTP at all and needs no
reverse-proxy routing.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

LiveKit Server configuration validation now requires an explicit choice
between an RTC port range and a multiplexed UDP port, instead of
silently rendering the default udp_port alongside a user-defined port
range (which LiveKit ignores). See the CHANGELOG entry for details.

Related to https://github.com/spantaleev/matrix-docker-ansible-deploy/issues/5344

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

The exporter's configuration used to ship a leftover "myprefix" placeholder
as the metric name prefix, so the bundled Grafana dashboard (which queries
unprefixed metric names) could never show any data.

Metric names are now unprefixed and the namespace label value changed from
matrix to nginx. See the CHANGELOG entry for details.

Fixes https://github.com/spantaleev/matrix-docker-ansible-deploy/issues/3380

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

The new role version splits backup_borg_location_exclude_patterns into
auto/custom components, following the existing split for
backup_borg_location_source_directories. The playbook now wires its
computed values into the _auto variables for both, so users can append
their own entries via the _custom variables instead of redefining the
whole lists and accidentally dropping playbook-provided values.
Previously, redefining backup_borg_location_exclude_patterns dropped
the postgres_data_path exclusion (making borg walk live Postgres data
and fail with warning exit codes), and the playbook's own
source_directories wiring made the role's _custom variable a no-op.

Related to #5092

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

The new version supports defining a multiplexed UDP port pool (e.g.
'7882-7892') in livekit_server_config_rtc_udp_port. Previously, the
role's configuration template silently mangled such values into
udp_port: 0. It also gains early validation of the port value.

Related to #5344

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

The new version adds livekit_server_config_rtc_ips_includes and
livekit_server_config_rtc_ips_excludes variables, controlling LiveKit's
rtc.ips.includes/excludes CIDR filters for RTC IP addresses.

Related to #4958

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

The new role release splits grafana_dashboard_download_urls into
default/auto/custom components. Wire the playbook's automatic dashboard
list via the auto component, so users can add their own dashboards
through grafana_dashboard_download_urls_custom without clobbering it.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Pulls in borgmatic 2.1.6, fixing the 2.1.4 JSON parsing regression
(borgmatic-collective/borgmatic#1294) where warnings on stderr, such as
OpenSSH post-quantum key exchange notices, broke parsing of borg's JSON
output and failed the backup run.

Fixes #5188

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Pulls in the pgloader connection string handling fix, which keeps the
Postgres password out of the command line and Ansible error output.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>