The newly extracted role also has native Traefik support,
so we no longer need to rely on `matrix-nginx-proxy` for
reverse-proxying to Ntfy.

The new role uses port `80` inside the container (not `8080`, like
before), because that's the default assumption of the officially
published container image. Using a custom port (like `8080`), means the
default healthcheck command (which hardcodes port `80`) doesn't work.
Instead of fiddling to override the healthcheck command, we've decided
to stick to the default port instead. This only affects the
inside-the-container port, not any external ports.

The new role also supports adding the network ranges of the container's
multiple additional networks as "exempt hosts". Previously, only one
network's address range was added to "exempt hosts".

Update ntfy 1.31.0 -> 2.0.0

Update mautrix-whatsapp 0.8.1 -> 0.8.2

Update mautrix-discord 0.1.0 -> 0.1.1

This also updates `docs/configuring-playbook-own-webserver.md`,
trying to make it up-to-date with all recent changes.

Update mautrix slack docs

Update ntfy 1.30.1 -> 1.31.0

Wiring happens via `group_vars/matrix_servers` now.

It's the same result as b6d45304b4b19, but it's done in a cleaner way.

Related to https://github.com/spantaleev/matrix-docker-ansible-deploy/issues/2480

.. and try to auto-switch between `bind` and `volume` depending on
whether there's a slash in the `src` path.

Fixes https://github.com/spantaleev/matrix-docker-ansible-deploy/issues/2482

Added link to exim/email documentation

update postmoogle 0.9.13 -> 0.9.14

Related to 6a52be7987 and 28e7ef9c71f02

* make banlist consistent
* proper multi-error message
* ignore "." MX hosts
* try recipient domain directly, even when MX records found, but failed

Update synapse 1.76.0 -> 1.77.0

Update hydrogen 0.3.7 -> 0.3.8

Bump element version

Signed-off-by: Julian-Samuel Gebühr <julian-samuel@gebuehr.net>

Previously, it had to go through matrix-nginx-proxy.
It's exposed to Traefik directly via container labels now

Previously, it had to go through matrix-nginx-proxy.
It's exposed to Traefik directly via container labels now

Serving at a path other than `/` doesn't work well yet.

We were mounting our own configuration to
`/usr/share/nginx/html/config.json`, which is a symlink to
`/tmp/config.json`. So we effectively mount our file to
`/tmp/config.json`.

When starting:

- if Hydrogen sees a `CONFIG_OVERRIDE` environment variable,
  it will try to save it into our read-only config file and fail.

- if Hydrogen doesn't see a `CONFIG_OVERRIDE` environment variable (the
  path we go through, because we don't pass such a variable),
  it will try to copy its bundled configuration (`/config.json.bundled`)
  to `/tmp/config.json`. Because our configuration is mounted as read-only, it will
  fail.

In both cases, it will fail with:

> cp: can't create '/tmp/config.json': File exists

Source: 3720de36bb/docker/dynamic-config.sh

We work around this by mounting our configuration on top of the bundled
one (`/config.json.bundled`). We then let Hydrogen's startup script copy
it to `/tmp/config.json` (a tmpfs we've mounted into the container) and use it from there.

This may proof useful to someone in the future.

We've had it on `matrix-nginx-proxy` before, but
our initial support for Traefik did not include any of these security
headers.

Previously, we had to run it at a subpath, like `/synapse-admin`.

We can now dedicate a whole domain and the `/` path to it, should we
wish to do so.

Previously, it had to go through matrix-nginx-proxy.
It's exposed to Traefik directly via container labels now