Jitsi migrated image publishing from Docker Hub to the GitHub Container
Registry, and the new registry carries no tag history, so this also moves
Jitsi to stable-11146-1. That release makes the containers rootless and runs
them with a read-only root filesystem.
`jitsi_jvb_container_colibri_ws_host_bind_port` goes away with it. Colibri
WebSocket support was removed upstream in favour of SCTP data channels, so
the Jitsi Video Bridge no longer serves HTTP at all and needs no
reverse-proxy routing.
The `matrix_redis_` -> `redis_` check and the `redis_` -> `valkey_`
check both stored their matches in
`matrix_playbook_migration_redis_migration_vars`.
Facts persist for the whole play, so the second check was silently
overwriting the first one's value. Nothing reads these facts outside the
block that sets them, so this was harmless in practice, but it breaks as
soon as anyone reorders the checks, reads a fact later on, or disables
one of the two checks and expects the other's value to still be around.
Name the second one after its own check, like every other check here
does.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Four checks carried the task name of the check they were copy-pasted
from, so the redis -> valkey and keydb -> valkey checks both announced
themselves as matrix_redis ones, and both synapse OIDC label checks
announced themselves as matrix_ssl ones.
The matrix_nginx_proxy and matrix_ssl leftover messages also asked
people to rename variables, while the sentence right above them
(correctly) asks for these to be removed. The roles are gone, so there
is nothing to rename them to.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
The variables holding matched deprecated variable names used to be
dictionaries (built via `vars | dict2items | ... | items2dict`), so
calling `.keys()` on them was correct.
Since a1f6ee4dc9b92fdb520627ec22265b800f73a6f8, they are lists produced
by the `ansible.builtin.varnames` lookup, but 15 of the messages
consuming them were left calling `.keys()`.
The failing tasks are gated behind a `| length > 0` condition, so only
people who actually still carry one of these deprecated variables would
hit this. Such people were greeted by a cryptic templating error instead
of the message telling them what to rename or remove.
Fixes https://github.com/spantaleev/matrix-docker-ansible-deploy/issues/5491
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
The metrics endpoint was the only thing this bridge ever routed through
Traefik. With it gone, the container was still labeled `traefik.enable=true`
without defining any router, which makes Traefik fall back to its default
rule and produce a router pointing at nothing. It was also joining the
reverse-proxy network for no reason.
Related to https://github.com/spantaleev/matrix-docker-ansible-deploy/issues/5487
6b4b7647e fixed this for synapse-usage-exporter only. A checkout owned by
a different user makes the git task fail from then on, either with a
permission error or with git's dubious-ownership protection, until
someone removes the directory on the host by hand. It gets into that
state when the matrix user's uid changes (a server migration or a restore
onto a differently numbered user), when an earlier clone ran as another
user, or when someone runs git as root inside the checkout.
Every other role cloning a repository onto the server was open to the
same failure, so ensure the checkout's ownership recursively before
updating it at the remaining 54 sites.
The three matrix-synapse ext clones also gain force=yes. They were the
only on-server clones without it, which left a checkout that an
interrupted run had half-written wedged, instead of repaired on the next
run.
matrix-matrixto used to clone as root into a directory that nothing ever
chowned, unlike every other role. It now becomes the matrix user too.
The Element Web and SchildiChat Web theme checkouts live on the Ansible
controller, where correcting ownership is not ours to do, so they merely
mark the checkout as a safe directory for git.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
The recursive chown in front of the git task already guarantees that git
operates on a checkout owned by the user it becomes, so marking the path
as a safe.directory on top of that protects against nothing. Drop the
environment variables and condense the comment to a single line.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
The example only covered `matrix.example.com` and the federation stream,
so people who make the playbook serve the base domain were left without a
proxy host for it. Requests for the `/.well-known/matrix/*` files on the
base domain then never reach Traefik and Nginx Proxy Manager answers with
a 404 error of its own, breaking federation and client discovery.
The nginx example already covers this by listing `example.com` in its
`server_name` directive. Serving the base domain from the Matrix server
is optional though, so the new section says so and points people whose
base domain lives elsewhere to the server delegation documentation.
Also note that a `*.example.com` wildcard certificate does not cover the
base domain itself, which is easy to get wrong when setting this up.
Related to https://github.com/spantaleev/matrix-docker-ansible-deploy/issues/5465
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Logging in does not involve approving a session from the LINE mobile app.
The bridge shows a PIN code, which needs to be entered into the LINE
mobile app instead.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
The template was missing the public_media and direct_media sections, as
well as the bridge.phone_numbers_in_profile, bridge.relay.displayname_format
and backfill.threads.max_initial_messages settings.
Their absence made the bridge fall back to zero values instead of the
defaults that upstream ships (most notably disabling thread backfilling).
The template now matches the configuration that the bridge generates
itself, key for key.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Its upstream repository has been archived and has not seen a change
since March 2025. mautrix-linkedin now covers the same use case.
The bridge remains installable, but as with other deprecated and
unmaintained components, it is no longer listed in the README and has
been moved to the deprecated services section of the documentation.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
github-actions[bot]
Slavi Pantaleev
renovate[bot]
svierne