Add matrix_synapse_ext_password_provider_ldap_tls_options_ca_certs_file
variable to allow specifying a custom CA certificate file for LDAP TLS
verification. Useful when Synapse is running in a container that does not
trust a private/internal CA by default.

Example usage:
matrix_synapse_ext_password_provider_ldap_tls_options_ca_certs_file: /etc/ssl/certs/my-ca.crt

OTW many empty dirs are kept

This was causing issues when it's parsed out by certain tools.

Regression since 28afbde971

The companion role was tightly coupled to Synapse through shared tags, worker routing, and lifecycle ordering. Keeping them separate added coordination overhead without practical benefits, especially for parallelized execution.

This merges the role into matrix-synapse while keeping companion logic organized under dedicated reverse_proxy_companion task/template subdirectories.

Compatibility is preserved:
- matrix_synapse_reverse_proxy_companion_* variable names remain unchanged
- install/setup companion-specific tags remain available

Cross-role/global wiring is now in group_vars (matrix-synapse section), while role defaults provide sensible standalone defaults and self-wiring for Synapse-owned values.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

These three roles have multiple variable prefixes each:
- kakaotalk: matrix_appservice_kakaotalk + matrix_appservice_kakaotalk_node
- telegram: matrix_mautrix_telegram + matrix_mautrix_telegram_lottieconverter
- synapse: matrix_synapse + matrix_synapse_customized + matrix_synapse_rust_synapse_compress_state

For each: renamed _docker_image* to _container_image* (and _docker_src*,
_docker_repo* where applicable), added deprecation entries in
validate_config.yml, updated group_vars references, and moved
deprecation tasks to the front of validate_config.yml.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* Remove `matrix_synapse_ext_synapse_auto_accept_invite_worker_to_run_on`

Signed-off-by: Suguru Hirahara <did🔑z6MkvVZk1A3KBApWJXv2Ju4H14ErDfRGxh8zxdXSZ4vACDg5>

* Remove `matrix_synapse_ext_synapse_auto_accept_invite_accept_invites_only_direct_messages`

Signed-off-by: Suguru Hirahara <did🔑z6MkvVZk1A3KBApWJXv2Ju4H14ErDfRGxh8zxdXSZ4vACDg5>

* Remove `matrix_synapse_ext_synapse_auto_accept_invite_enabled`

Signed-off-by: Suguru Hirahara <did🔑z6MkvVZk1A3KBApWJXv2Ju4H14ErDfRGxh8zxdXSZ4vACDg5>

* Remove `matrix_synapse_container_image_customizations_auto_accept_invite_installation_enabled`

Signed-off-by: Suguru Hirahara <did🔑z6MkvVZk1A3KBApWJXv2Ju4H14ErDfRGxh8zxdXSZ4vACDg5>

* Remove `matrix_synapse_ext_synapse_auto_accept_invite_version`

Signed-off-by: Suguru Hirahara <did🔑z6MkvVZk1A3KBApWJXv2Ju4H14ErDfRGxh8zxdXSZ4vACDg5>

* Remove `matrix_synapse_ext_synapse_auto_accept_invite_accept_invites_only_from_local_users`

Signed-off-by: Suguru Hirahara <did🔑z6MkvVZk1A3KBApWJXv2Ju4H14ErDfRGxh8zxdXSZ4vACDg5>

* Remove roles/custom/matrix-synapse/tasks/ext/synapse-auto-accept-invite

Signed-off-by: Suguru Hirahara <did🔑z6MkvVZk1A3KBApWJXv2Ju4H14ErDfRGxh8zxdXSZ4vACDg5>

* Update README.md

Signed-off-by: Suguru Hirahara <did🔑z6MkvVZk1A3KBApWJXv2Ju4H14ErDfRGxh8zxdXSZ4vACDg5>

* Update container-images.md

Signed-off-by: Suguru Hirahara <did🔑z6MkvVZk1A3KBApWJXv2Ju4H14ErDfRGxh8zxdXSZ4vACDg5>

* Update configuring-playbook.md

Signed-off-by: Suguru Hirahara <did🔑z6MkvVZk1A3KBApWJXv2Ju4H14ErDfRGxh8zxdXSZ4vACDg5>

* Update configuring-playbook-synapse-auto-accept-invite.md

Reuse bf744319e0/docs/configuring-playbook-sliding-sync-proxy.md

Signed-off-by: Suguru Hirahara <did🔑z6MkvVZk1A3KBApWJXv2Ju4H14ErDfRGxh8zxdXSZ4vACDg5>

* Update validate_config.yml

Signed-off-by: Suguru Hirahara <did🔑z6MkvVZk1A3KBApWJXv2Ju4H14ErDfRGxh8zxdXSZ4vACDg5>

* Update CHANGELOG.md

Signed-off-by: Suguru Hirahara <did🔑z6MkvVZk1A3KBApWJXv2Ju4H14ErDfRGxh8zxdXSZ4vACDg5>

---------

Signed-off-by: Suguru Hirahara <did🔑z6MkvVZk1A3KBApWJXv2Ju4H14ErDfRGxh8zxdXSZ4vACDg5>
Co-authored-by: Suguru Hirahara <did🔑z6MkvVZk1A3KBApWJXv2Ju4H14ErDfRGxh8zxdXSZ4vACDg5>

* Remove roles/custom/matrix-dimension

Signed-off-by: Suguru Hirahara <did🔑z6MkvVZk1A3KBApWJXv2Ju4H14ErDfRGxh8zxdXSZ4vACDg5>

* Remove mentions to Dimension

Signed-off-by: Suguru Hirahara <did🔑z6MkvVZk1A3KBApWJXv2Ju4H14ErDfRGxh8zxdXSZ4vACDg5>

* Update configuring-playbook-dimension.md

Reuse 0f5015a33c/docs/configuring-playbook-bridge-mx-puppet-twitter.md

Signed-off-by: Suguru Hirahara <did🔑z6MkvVZk1A3KBApWJXv2Ju4H14ErDfRGxh8zxdXSZ4vACDg5>

* Update validate_config.yml

Signed-off-by: Suguru Hirahara <did🔑z6MkvVZk1A3KBApWJXv2Ju4H14ErDfRGxh8zxdXSZ4vACDg5>

* Update CHANGELOG.md

Signed-off-by: Suguru Hirahara <did🔑z6MkvVZk1A3KBApWJXv2Ju4H14ErDfRGxh8zxdXSZ4vACDg5>

---------

Signed-off-by: Suguru Hirahara <did🔑z6MkvVZk1A3KBApWJXv2Ju4H14ErDfRGxh8zxdXSZ4vACDg5>
Co-authored-by: Suguru Hirahara <did🔑z6MkvVZk1A3KBApWJXv2Ju4H14ErDfRGxh8zxdXSZ4vACDg5>

matrix_synapse_systemd_service_post_start_delay_seconds is assigned a string value, and setup fails while creating the service file. It is impossible to compare str and int.

After Synapse's systemd health check passes, Traefik still needs
providers.providersThrottleDuration to register routes. Derive the
post-start delay from this setting (+1s for healthcheck polling gap)
instead of using a hardcoded value. Defaults to 0 when no Traefik
reverse proxy is used.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Switch the systemd ExecStartPost health check from docker exec + curl
to polling docker inspect for container health status. This piggybacks
on the container image's built-in HEALTHCHECK instead of duplicating it.

Also add a configurable container health interval (5s for Traefik setups,
15s otherwise) to speed up startup readiness detection without affecting
non-Traefik deployments.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Previously, we had a 10-second magical delay.

Now we first do a healthcheck to figure out when it really is up.
Then, we do the same 10-second magical delay to account for the time it
may take for a reverse-proxy (like Traefik) to pick up Synapse's routes.

The migrate service now declares Requires/After on matrix-synapse.service,
ensuring Synapse (and its transitive dependencies like Postgres and Docker)
are running before the migration triggers.

* Remove ma1sd

Reuse 6d1ec58a82/docs/configuring-playbook-bridge-mautrix-instagram.md

Signed-off-by: Suguru Hirahara <did🔑z6MkvVZk1A3KBApWJXv2Ju4H14ErDfRGxh8zxdXSZ4vACDg5>

* Update configuring-playbook-ma1sd.pot

Signed-off-by: Suguru Hirahara <did🔑z6MkvVZk1A3KBApWJXv2Ju4H14ErDfRGxh8zxdXSZ4vACDg5>

* Update changelog entry date for ma1sd removal

---------

Signed-off-by: Suguru Hirahara <did🔑z6MkvVZk1A3KBApWJXv2Ju4H14ErDfRGxh8zxdXSZ4vACDg5>
Co-authored-by: Suguru Hirahara <did🔑z6MkvVZk1A3KBApWJXv2Ju4H14ErDfRGxh8zxdXSZ4vACDg5>
Co-authored-by: Slavi Pantaleev <slavi@devture.com>

The /_matrix/client/unstable/org.matrix.simplified_msc3575/sync endpoint
can be handled by generic workers, but Synapse's workers.md documentation
doesn't mention it. The code confirms it's worker-compatible:

- SlidingSyncRestServlet is registered via sync.register_servlets:
  https://github.com/element-hq/synapse/blob/0dfcffab0f/synapse/rest/client/sync.py#L1128-L1131

- sync.register_servlets is NOT in the worker exclusion list:
  https://github.com/element-hq/synapse/blob/0dfcffab0f/synapse/rest/__init__.py#L180-L194

- GenericWorkerStore includes SlidingSyncStore:
  https://github.com/element-hq/synapse/blob/0dfcffab0f/synapse/app/generic_worker.py#L168

This adds the endpoint to both:
- matrix_synapse_workers_sync_worker_client_server_endpoints (for specialized sync workers with sticky routing)
- matrix_synapse_workers_generic_worker_endpoints (documenting generic worker capability)

Ref:
- https://github.com/spantaleev/matrix-docker-ansible-deploy/pull/4882
- https://github.com/element-hq/synapse/pull/19204
- https://element-hq.github.io/synapse/latest/usage/configuration/config_documentation.html#enable_local_media_storage

We default it to `true`, keeping up with upstream and the old behavior.

s3-storage-provider users may set `matrix_synapse_enable_local_media_storage` to `false`
to disable local file caching.
This likely comes at the expense of some performance.

For matrix-media-repo users, it likely doesn't matter what this is set to,
as for a matrix-media-repo setup, all media-related API endpoints are
captured and forwarded to matrix-media-repo (before reaching Synapse).

Provoked by https://github.com/element-hq/synapse/pull/19281
which landed in Synapse v1.145.0, but we pull in a few other routes
that I noticed to be missing.

Related to https://github.com/spantaleev/matrix-docker-ansible-deploy/pull/4776

Supersedes https://github.com/spantaleev/matrix-docker-ansible-deploy/pull/4777

This reverts commit c8c6a83ecc.

Synapse v1.142.0 is broken for Matrix Authentication Service deployments
that use a path-prefix (e.g. `/auth`) such as ours.

For such deployments, Synapse fails to contact MAS at the correct
introspection endpoint (it keeps hitting `/oauth2/introspect`, instead of `/auth/oauth2/introspect`)
and is not usable.

Related to 3595ff921f

Ref:
- https://github.com/element-hq/synapse/releases/tag/v1.141.0
- https://github.com/element-hq/synapse/pull/19064

> The Docker images are now based on Debian trixie and use Python 3.13.

Follow-up to e0e4032002

Fixes https://github.com/spantaleev/matrix-docker-ansible-deploy/issues/4637

We no longer need to boto workaround since s3-storage-provider got
upgraded to v1.6.0 in https://github.com/spantaleev/matrix-docker-ansible-deploy/pull/4635

* synapse - introduce matrix_synapse_url_preview_url_blacklist var

* Preserve original comments around `url_preview_url_blacklist`

---------

Co-authored-by: Aleksandrs Jansons <alex@peledu.casa>
Co-authored-by: Slavi Pantaleev <slavi@devture.com>