Part of adopting a uniform naming policy for bridge variables,
where the variable prefix matches the role directory name.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Add a generic mechanism for exposing bridges' HTTP API (the provisioning
API, etc.) publicly on the Matrix domain, so tools like mautrix-manager
(https://github.com/mautrix/manager) can drive bridge login.

- Introduce global matrix_bridges_exposure_* vars (on by default),
  exposing each supported bridge under `<matrix-fqn>/bridges/<bridge>`.
- mautrix-gmessages: make the provisioning shared secret configurable
  (auto-generated in group_vars) so the provisioning API is enabled,
  route the whole bridge HTTP port via Traefik, and populate
  appservice.public_address.

Requests are authenticated by the bridge itself (per-user Matrix access
token for the provisioning API, homeserver token for the appservice
endpoints), not by the reverse proxy.

This is the first bridge converted; the other mautrix bridges will follow.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Replaces `community.docker.docker_image` with the modern
`docker_image_pull` and `docker_image_build` split modules. Drops the
`ansible_version` compatibility ladder and the now-redundant
`_container_image_force_pull` variable (the new pull module handles
registry refresh natively via `pull: always`). Also registers
`_container_image_build_result` so that a self-build rebuild correctly
triggers a service restart.

Related to https://github.com/spantaleev/matrix-docker-ansible-deploy/issues/5191.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Reformat `{{ { ... }[engine] }}` dict-in-Jinja-expressions across
bot/bridge role defaults for consistent indentation (tabs -> spaces).
Also: fix a missing space in a Jinja `+` expression in matrix-static-files,
and fix indentation in the caddy2-in-container example.

The original PR also renamed `galaxy/<role>` role references to just
`<role>` in setup.yml and jitsi_jvb.yml; those were dropped here because
Ansible does not recurse into subdirectories of `roles/` by default and
no `roles_path` is configured in ansible.cfg, so the rename would break
role resolution.

Co-Authored-By: Slavi Pantaleev <slavi@devture.com>

Roles affected: appservice-discord, appservice-irc, beeper-linkedin,
heisenbridge, hookshot, mautrix-bluesky, mautrix-discord,
mautrix-gmessages, mautrix-googlechat, mautrix-signal, mautrix-slack,
mautrix-twitter, mautrix-whatsapp, mautrix-wsproxy, mx-puppet-groupme,
mx-puppet-steam, postmoogle, sms, steam, cactus-comments, element,
fluffychat, schildichat, conduit, corporal, dendrite,
ldap-registration-proxy, media-repo, pantalaimon,
prometheus-nginxlog-exporter, registration, sygnal, synapse-admin,
user-verification-service.

For each role: renamed _docker_image* variables to _container_image*
(and _docker_src_files_path to _container_src_files_path where
applicable), added deprecation entries in validate_config.yml, and
updated group_vars/docs references.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

For each of the 34 roles (3 clients, 9 bots, 22 bridges), this commit:
- Adds `_restart_necessary: false` default variable
- Adds `register:` directives to config/image/systemd tasks
- Computes `_restart_necessary` via set_fact (OR of all .changed results)
- Wires `(_restart_necessary | bool)` in group_vars/matrix_servers

This allows the systemd service manager to skip unnecessary restarts
when running install-* tags and nothing actually changed.

Service roles and complex multi-service roles will follow separately.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

This also moves msc4190 to the correct section for twitter

Related to https://github.com/spantaleev/matrix-docker-ansible-deploy/issues/4549

Ref:

- 33f3ccd6ae/CHANGELOG.md (L134-L136)
- 7165d3fa58/appservice/registration.go (L30)

Intentionally not removing the old configuration setting yet, as some bridges may/do not support
the new setting name. It's likely just bridgev2 mautrix bridges that have been updated and support both right now.

* Add matrix_bridges_msc4190_enabled flag for using msc4190 on supported mautrix bridges.

* Apply to_json to msc4190 in mautrix configs

* Add | to_json to mautrix bridge registration io.element.msc4190.

* require matrix_synapse_experimental_features_msc3202_device_masquerading_enabled for matrix_bridges_msc4190_enabled

* Also add msc4190 support for mautrix-telegram

Signed-off-by: Suguru Hirahara <acioustick@noreply.codeberg.org>

This:

- brings consistency - no more mixing `_name_prefix` and `_registry_prefix`
- adds extensibility - a future patch will allow reconfiguring all registry prefixes for all roles in the playbook

We still have `_docker_` vs `_container_` inconsistencies.
These may be worked on later.

Signed-off-by: Suguru Hirahara <acioustick@noreply.codeberg.org>

bridgev2 mautrix bridges use https://github.com/tulir/zeroconfig for
logging, which does support `trace` as a logging level.

Closes https://github.com/spantaleev/matrix-docker-ansible-deploy/issues/3538

See: https://github.com/spantaleev/matrix-docker-ansible-deploy/issues/3538#issuecomment-2405780285

We'be already been going against upstream defaults and have been
enabling backfilling for a few other bridges (Messenger, Instagram, Telegram, Twitter).

Now I'm enabling backfilling by default for the remaining ones, for
consistency.

Related to:
- https://github.com/mautrix/gmessages/releases/tag/v0.5.0
- https://mau.fi/blog/2024-09-mautrix-release/

It seems like the new version does not support a `/metrics` endpoint.
We skip keep the Ansible variables, but they're not doing anything.

Shared Secret Auth double puppeting still works for this bridge, but
is deprecated and will go away in the future.

Related to 0241c71a4c

Related to https://github.com/spantaleev/matrix-docker-ansible-deploy/pull/3270#issuecomment-2143782962

With this change, it should be possible for people to adjust the Docker
dependency from `docker.service` to something else (e.g. `pkg-ContainerManager-dockerd.service`),
or to completely eliminate it by setting `devture_systemd_docker_base_docker_service_name` to an empty string.

This makes it easier for people to use the playbook against a Synology DSM server.

Signed-off-by: gardar <gardar@users.noreply.github.com>