We do this to match Synapse's new default "max_upload_size" (50MB).

This `matrix_nginx_proxy_proxy_matrix_client_api_client_max_body_size_mb`
default value only affects standalone usage of the `matrix-nginx-proxy`
role. When the role is used in the context of the playbook,
the value is dynamically assigned from `group_vars/matrix_servers`.

Somewhat related to #692 (Github Issue).

The regex introduced in 63a49bb2dc seems to take precedence
over the bare location blocks, causing a regression.

> It is important to understand that, by default, Nginx will serve regular expression matches in preference to prefix matches.
> However, it evaluates prefix locations first, allowing for the administer to override this tendency by specifying locations using the = and ^~ modifiers.

Source: https://www.digitalocean.com/community/tutorials/understanding-nginx-server-and-location-block-selection-algorithms

(yes, a bit awkward and brittle… xD)

Regression since 63a49bb2dc.

Related to #685 (Github Issue).

We now automatically expose the APIs when Synapse Admin is enabled.

While v1.22.0 supposedly has multi-arch Docker images
(thanks to https://github.com/matrix-org/synapse/pull/7921),
I can't them on Docker Hub yet, so I'm backing out of this change
for now and letting people fall back to self-building there.

Fix docker mount instruction in documentation

Fixes #685 (Github Issue).

The SSL certificates should be accessible to the nginx proxy container, not the synapse container.

also, worker.yaml.j2:
  - hone worker_name
  - remove worker_pid_file entry (would only be used if worker_daemonize
    set to true; also, synapse only knows about the container namespace
    and thus can not provide the required host-view PID)

add variables for secure_backup_required and secure_backup_setup_methods

Discussed in #669 (Github Issue).

Upgrade Element (1.7.8 -> 1.7.9)

Update nginx (1.19.2 -> 1.19.3)

Shameless refactor of all systemd descriptions for bridges

Upgrade Synapse (v1.20.1 -> v1.21.0)

Add docker prune

& restrict federation listener; frontend_proxy / user_dir don't need it

.. alphabetically and put those not documented as multi-instance
capable on ports ending on zero.

Is the PID magic gonna work? or will it need an ExecStartPost hack..

- cherry-pick "Ensure worker config exists in systemd service (#7528)"
  from synapse d74cdc1a42e8b487d74c214b1d0ca575429d546a:
  "check that the worker config file exists instead of silently failing."