The example only covered `matrix.example.com` and the federation stream,
so people who make the playbook serve the base domain were left without a
proxy host for it. Requests for the `/.well-known/matrix/*` files on the
base domain then never reach Traefik and Nginx Proxy Manager answers with
a 404 error of its own, breaking federation and client discovery.
The nginx example already covers this by listing `example.com` in its
`server_name` directive. Serving the base domain from the Matrix server
is optional though, so the new section says so and points people whose
base domain lives elsewhere to the server delegation documentation.
Also note that a `*.example.com` wildcard certificate does not cover the
base domain itself, which is easy to get wrong when setting this up.
Related to https://github.com/spantaleev/matrix-docker-ansible-deploy/issues/5465
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Logging in does not involve approving a session from the LINE mobile app.
The bridge shows a PIN code, which needs to be entered into the LINE
mobile app instead.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
The template was missing the public_media and direct_media sections, as
well as the bridge.phone_numbers_in_profile, bridge.relay.displayname_format
and backfill.threads.max_initial_messages settings.
Their absence made the bridge fall back to zero values instead of the
defaults that upstream ships (most notably disabling thread backfilling).
The template now matches the configuration that the bridge generates
itself, key for key.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Its upstream repository has been archived and has not seen a change
since March 2025. mautrix-linkedin now covers the same use case.
The bridge remains installable, but as with other deprecated and
unmaintained components, it is no longer listed in the README and has
been moved to the deprecated services section of the documentation.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Replaces the question-and-answer troubleshooting format (which no other
documentation page uses) with regular subsections, and clarifies why the
request needs to come from a Chrome-based browser.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
The variable was defined, but the configuration template hardcoded the
command prefix, so changing the variable had no effect.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
The variable was defined, but the configuration template hardcoded the
command prefix, so changing the variable had no effect.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
The variable was defined, but the configuration template hardcoded the
command prefix, so changing the variable had no effect.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
The playbook exposes service metrics under a single endpoint
(`https://matrix.example.com/metrics/*`), controlled by
`matrix_metrics_exposure_enabled` and friends. synapse-usage-exporter was
not wired into this at all, so its metrics could only be scraped by the
integrated Prometheus and were unreachable for an external one.
The role had no metrics router whatsoever. Its only Traefik router (for
the `/report-usage-stats/push` ingestion endpoint) was gated on
`matrix_synapse_usage_exporter_container_labels_traefik_enabled`, which
defaulted to `matrix_synapse_usage_exporter_proxying_enabled`. Adding a
metrics router under that same switch would have meant that exposing
metrics also publishes the ingestion endpoint, so the master switch now
defaults to `true` and each router carries its own conditional.
Despite its generic name, `matrix_synapse_usage_exporter_proxying_enabled`
only ever concerned the endpoint that Synapse pushes usage statistics
**to**, never the metrics endpoint that Prometheus reads **from**. The
documentation now says so explicitly.
Fixes https://github.com/spantaleev/matrix-docker-ansible-deploy/issues/5467
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Since Ansible 2.21, forked workers call `setsid()` and thus lose the
controlling terminal, so SSH can no longer ask about unknown host keys or
prompt for the passphrase of an SSH key.
Reported in https://github.com/spantaleev/matrix-docker-ansible-deploy/issues/5472
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
The new image restores the ability of SSH to ask about unknown host keys
and to prompt for the passphrase of an SSH key, which Ansible 2.21 broke
by having forked workers run session-isolated.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Until now, ntfy metrics could only be collected by an external Prometheus
server. Enabling the integrated Prometheus (`prometheus_enabled: true`)
now also has it scrape ntfy, like it does for the other services.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
The playbook exposes service metrics under a single endpoint
(`https://matrix.example.com/metrics/*`), controlled by
`matrix_metrics_exposure_enabled` and friends. ntfy was not wired into
this at all, so enabling metrics exposure did not expose ntfy's metrics
and enabling Basic Authentication did not protect them.
We have ntfy serve its metrics on a dedicated port, instead of on its
regular HTTP port. Serving them on the regular HTTP port also makes them
reachable at `https://ntfy.example.com/metrics`, where nothing protects
them, as ntfy does not apply its own access-control rules to the metrics
endpoint.
Fixes https://github.com/spantaleev/matrix-docker-ansible-deploy/issues/5468
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Since the introduction of the synapse-usage-exporter role (55f869254, #3442), group_vars/matrix_servers was overriding matrix_synapse_report_stats_endpoint with an empty string whenever synapse-usage-exporter was disabled, clobbering the role's matrix.org default.
For deployments that enable matrix_synapse_report_stats, Synapse would then try reporting statistics to an empty URL, failing with:
> synapse.app.homeserver - 210 - WARNING - phone_stats_home-0 - Error reporting stats: Invalid URI b''
The default endpoint URL now lives in a dedicated matrix_synapse_report_stats_endpoint_default variable, which group_vars/matrix_servers falls back to when synapse-usage-exporter is not enabled.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
None of these flags exist in current Synapse:
- msc3266_enabled: MSC3266 support was stabilized in Synapse v1.153.0 and the room summary API is now always enabled
- msc4140_enabled: this was never a Synapse configuration setting in any released version. Delayed events have always been controlled by the `max_event_delay_duration` setting, which the playbook was emitting alongside the flag. The toggle is now named `matrix_synapse_delayed_events_enabled`.
- msc4429_enabled: MSC4429 support has not landed in any released Synapse version, so this flag never had any effect
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
When no experimental features were enabled (e.g. Matrix RTC and Matrix Authentication Service both disabled), the generated homeserver.yaml contained `experimental_features: null`, which Synapse v1.157.0+ does not tolerate and crashes on startup.
The `experimental_features` configuration is now constructed via a dedicated `matrix_synapse_experimental_features` variable (split into `_default`, `_auto` and `_custom`, as is customary), which always yields a mapping (potentially an empty one).
Fixes https://github.com/spantaleev/matrix-docker-ansible-deploy/issues/5455
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Slavi Pantaleev
Suguru Hirahara
Aine
renovate[bot]
github-actions[bot]
Co van Leeuwen
Benjamin Blacher