Signed-off-by: Suguru Hirahara <acioustick@noreply.codeberg.org>

Supersedes https://github.com/spantaleev/matrix-docker-ansible-deploy/pull/4284

This works around an issue with Matrix Authentication Service's `syn2mas` sub-command (at version v0.16.0),
which chokes with an error:

> Error: Failed to load Synapse configuration
> Caused by:
> invalid type: found unit, expected struct EnableableSection for key "default.cas_config" in homeserver.yaml YAML file

This issue is likely to be fixed in MAS v0.16.1 or v0.17.0.

This also reverts e5574a405e because:
- it was causing issues on some servers (not clear why)
- such workarounds are no longer necessary when doing multi-stage building.

This is a security patch for Synapse that fixes an actively exploited bug.

* Enable Internal Admin API Access separately from Public access.

* Add Config variable for Draupnir Hijack command

And also make the internal admin API be automatically  activated when this capability is used.

* Apply suggestions from code review

Co-authored-by: Slavi Pantaleev <slavi@devture.com>

* Further Refine Internal Admin API

* Add Non Worker Labels for Internal Admin API

* Variable Rename

* Add validation rules for Internal Synapse admin API

* Add Draupnir Admin API required config validation.

* Override `matrix_synapse_reverse_proxy_companion_container_labels_internal_client_synapse_admin_api_traefik_entrypoints` via group vars

* Wire `matrix_bot_draupnir_admin_api_enabled` to `matrix_bot_draupnir_config_admin_enableMakeRoomAdminCommand` in Draupnir's `defaults/main.yml`

* Remove unnecessary `matrix_bot_draupnir_admin_api_enabled` override from `group_vars/matrix_servers`

The same value is now (more appropriately) defined in Draupnir's `defaults/main.yml` file anyway.

* Add additional condition (`matrix_bot_draupnir_enabled`) for enabling `matrix_synapse_container_labels_internal_client_synapse_admin_api_enabled`

* Use a separate task for validating `matrix_bot_draupnir_admin_api_enabled` when `matrix_bot_draupnir_config_admin_enableMakeRoomAdminCommand`

The other task deals with checking for null and not-blank and can't handle booleans properly.

---------

Co-authored-by: Slavi Pantaleev <slavi@devture.com>

Ref:
- c4747dd177/docs/self-hosting.md (a-matrix-homeserver)
- e39fe3bc7f

* Add support for configuring Synapse's MSC4133 (Custom Profile Fields) experimental feature

* Reorder experimental_features in homeserver.yaml.j2 alphabetically

---------

Co-authored-by: Slavi Pantaleev <slavi@devture.com>

The new rate limits are more suitable for running Element Call.

Ref:

- 93ae2aed98/docs/self-hosting.md (a-matrix-homeserver)
- https://github.com/spantaleev/matrix-docker-ansible-deploy/pull/3562

Instead of trying to increase them conditionally only when Element Call
is enabled, it's simpler and good-enough to just increase them in all cases.

This is required by Element Call.

Ref:

- 93ae2aed98/docs/self-hosting.md (a-matrix-homeserver)
- https://github.com/spantaleev/matrix-docker-ansible-deploy/pull/3562

This is required by Element Call.

Ref:

- 93ae2aed98/docs/self-hosting.md (a-matrix-homeserver)
- https://github.com/spantaleev/matrix-docker-ansible-deploy/pull/3562

Signed-off-by: Suguru Hirahara <acioustick@noreply.codeberg.org>

Signed-off-by: Suguru Hirahara <acioustick@noreply.codeberg.org>

Signed-off-by: Suguru Hirahara <acioustick@noreply.codeberg.org>

Signed-off-by: Suguru Hirahara <acioustick@noreply.codeberg.org>

Signed-off-by: Suguru Hirahara <acioustick@noreply.codeberg.org>

Signed-off-by: Suguru Hirahara <acioustick@noreply.codeberg.org>

Signed-off-by: Suguru Hirahara <acioustick@noreply.codeberg.org>

Signed-off-by: Suguru Hirahara <acioustick@noreply.codeberg.org>

Signed-off-by: Suguru Hirahara <acioustick@noreply.codeberg.org>

Signed-off-by: Suguru Hirahara <acioustick@noreply.codeberg.org>

Fixes https://github.com/spantaleev/matrix-docker-ansible-deploy/issues/4113

This:

- brings consistency - no more mixing `_name_prefix` and `_registry_prefix`
- adds extensibility - a future patch will allow reconfiguring all registry prefixes for all roles in the playbook

We still have `_docker_` vs `_container_` inconsistencies.
These may be worked on later.

`-t` works on both old and new Docker versions, so it's best to use that.

It's useless and just makes the config longer.

Signed-off-by: Suguru Hirahara <acioustick@noreply.codeberg.org>

Fixes https://github.com/spantaleev/matrix-docker-ansible-deploy/issues/4011

Signed-off-by: Suguru Hirahara <acioustick@noreply.codeberg.org>

As we automatically forget rooms on leave in the playbook this option working at all is probably heavily desired.

Timing is copied from upstream example.

Credit goes to Anoa for making me even check this.