matrix-docker-ansible-deploy/roles/custom/matrix-authentication-service/tasks/validate_config.yml

# SPDX-FileCopyrightText: 2024 - 2025 Slavi Pantaleev
# SPDX-FileCopyrightText: 2025 Suguru Hirahara
#
# SPDX-License-Identifier: AGPL-3.0-or-later

---

- name: Fail if required matrix-authentication-service settings not defined
  ansible.builtin.fail:
    msg: >-
      You need to define a required configuration setting (`{{ item.name }}`).
  when: "item.when | bool and lookup('vars', item.name, default='') | string | length == 0"
  with_items:
    - {'name': 'matrix_authentication_service_hostname', when: true}
    - {'name': 'matrix_authentication_service_config_database_username', when: true}
    - {'name': 'matrix_authentication_service_config_database_password', when: true}
    - {'name': 'matrix_authentication_service_config_database_host', when: "{{ not matrix_authentication_service_config_database_socket_enabled }}"}
    - {'name': 'matrix_authentication_service_config_database_socket_path_host', when: "{{ matrix_authentication_service_config_database_socket_enabled }}"}
    - {'name': 'matrix_authentication_service_config_database_database', when: true}
    - {'name': 'matrix_authentication_service_config_secrets_encryption', when: true}
    - {'name': 'matrix_authentication_service_config_matrix_homeserver', when: true}
    - {'name': 'matrix_authentication_service_config_matrix_secret', when: true}
    - {'name': 'matrix_authentication_service_config_matrix_endpoint', when: true}
    - {'name': 'matrix_authentication_service_container_labels_public_main_hostname', when: "{{ matrix_authentication_service_container_labels_traefik_enabled }}"}
    - {'name': 'matrix_authentication_service_container_labels_public_compatibility_layer_hostname', when: "{{ matrix_authentication_service_container_labels_public_compatibility_layer_enabled }}"}
    - {'name': 'matrix_authentication_service_container_labels_internal_compatibility_layer_entrypoints', when: "{{ matrix_authentication_service_container_labels_internal_compatibility_layer_enabled }}"}
    - {'name': 'matrix_authentication_service_config_email_hostname', when: "{{ matrix_authentication_service_config_email_transport == 'smtp' }}"}
    - {'name': 'matrix_authentication_service_config_captcha_site_key', when: "{{ matrix_authentication_service_config_captcha_service != '' }}"}
    - {'name': 'matrix_authentication_service_config_captcha_secret_key', when: "{{ matrix_authentication_service_config_captcha_service != '' }}"}

- name: Fail if matrix_authentication_service_config_secrets_encryption is not 64 characters long
  ansible.builtin.fail:
    msg: "matrix_authentication_service_config_secrets_encryption must be exactly 64 characters long (preferably generated via `openssl rand -hex 32`)"
  when: "matrix_authentication_service_config_secrets_encryption | length != 64"

- name: Fail if matrix_authentication_service_config_email_transport is invalid
  ansible.builtin.fail:
    msg: "matrix_authentication_service_config_email_transport must be one of: blackhole, smtp, or aws_ses"
  when: "matrix_authentication_service_config_email_transport not in ['blackhole', 'smtp', 'aws_ses']"

- name: Fail if matrix_authentication_service_config_captcha_service is invalid
  ansible.builtin.fail:
    msg: "matrix_authentication_service_config_captcha_service must be one of: recaptcha_v2, cloudflare_turnstile, or hcaptcha (or empty, to disable CAPTCHA protection)"
  when: "matrix_authentication_service_config_captcha_service not in ['', 'recaptcha_v2', 'cloudflare_turnstile', 'hcaptcha']"

- name: (Deprecation) Catch and report renamed matrix-authentication-service settings
  ansible.builtin.fail:
    msg: >-
      Your configuration contains a variable, which now has a different name.
      Please rename the variable (`{{ item.old }}` -> `{{ item.new }}`) on your configuration file (vars.yml).
  when: "lookup('ansible.builtin.varnames', ('^' + item.old + '$'), wantlist=True) | length > 0"
  with_items:
    - {'old': 'matrix_authentication_service_container_image_name_prefix', 'new': 'matrix_authentication_service_container_image_registry_prefix'}
    - {'old': 'matrix_authentication_service_syn2mas_container_image_name_prefix', 'new': 'matrix_authentication_service_syn2mas_container_image_registry_prefix'}
    - {'old': 'matrix_authentication_service_syn2mas_container_image', 'new': '<removed>'}
    - {'old': 'matrix_authentication_service_syn2mas_container_image_registry_prefix', 'new': '<removed>'}
    - {'old': 'matrix_authentication_service_syn2mas_container_image_registry_prefix_upstream', 'new': '<removed>'}
    - {'old': 'matrix_authentication_service_syn2mas_container_image_registry_prefix_upstream_default', 'new': '<removed>'}
    - {'old': 'matrix_authentication_service_syn2mas_container_image_force_pull', 'new': '<removed>'}
    - {'old': 'matrix_authentication_service_syn2mas_container_image_self_build', 'new': '<removed>'}
    - {'old': 'matrix_authentication_service_syn2mas_process_extra_arguments', 'new': 'matrix_authentication_service_syn2mas_command_extra_options or matrix_authentication_service_syn2mas_subcommand_extra_options'}
    - {'old': 'matrix_authentication_service_syn2mas_dry_run', 'new': 'matrix_authentication_service_syn2mas_migrate_dry_run'}
    - {'old': 'matrix_authentication_service_container_image_force_pull', 'new': '<removed> (the new community.docker.docker_image_pull module handles this natively)'}