matrix-docker-ansible-deploy/group_vars/matrix_servers

---

# This variables file wires together the various components (roles) used by the playbook.
#
# Roles used by playbook are pretty minimal and kept independent of one another as much as possible.
# To deliver a turnkey fully-featured Matrix server, this playbook needs
# to connect them all together. It does so by overriding role variables.
#
# You can also override ANY variable (seen here or in any given role),
# by re-defining it in your own configuration file (`inventory/host_vars/matrix.example.com`).

########################################################################
#                                                                      #
# Playbook                                                             #
#                                                                      #
########################################################################

# Controls whether to install Docker or not
# Also see `devture_docker_sdk_for_python_installation_enabled`.
matrix_playbook_docker_installation_enabled: true

matrix_playbook_docker_installation_daemon_options: "{{ matrix_playbook_docker_installation_daemon_options_auto | combine(matrix_playbook_docker_installation_daemon_options_custom, recursive=True) }}"

# Since Docker 27.0.1, Docker daemon options do not need to be changed to enable IPv6 support on the daemon side.
# See: https://docs.docker.com/engine/release-notes/27/#ipv6
# We only enable `ip6tables` and `experimental` for people who explicitly request it (perhaps due to running an old Docker version).
#
# Despite IPv6-enablement at the Docker level being a thing, for IPv6 to work for containers
# networks need to be created with IPv6 explicitly enabled.
# This is controlled by the `devture_systemd_docker_base_ipv6_enabled` variable and it's up to the various roles to
# respect this variable when creating their networks.
matrix_playbook_docker_installation_daemon_options_auto: |
  {{
    ({'experimental': true, 'ip6tables': true} if devture_systemd_docker_base_ipv6_daemon_options_changing_enabled else {})
  }}

matrix_playbook_docker_installation_daemon_options_custom: {}

matrix_playbook_docker_installation_daemon_options_file_path: /etc/docker/daemon.json

# Controls whether to attach Traefik labels to services.
# This is separate from `traefik_enabled`, because you may wish to disable Traefik installation by the playbook,
# yet still use Traefik installed in another way.
matrix_playbook_traefik_labels_enabled: "{{ matrix_playbook_reverse_proxy_type in ['playbook-managed-traefik', 'other-traefik-container'] }}"

matrix_playbook_reverse_proxy_container_network: "{{ traefik_container_network if traefik_enabled else 'traefik' if matrix_playbook_reverse_proxy_type in ['playbook-managed-traefik', 'other-traefik-container'] else '' }}"
matrix_playbook_reverse_proxy_hostname: "{{ traefik_identifier if traefik_enabled else 'traefik' }}"

matrix_playbook_reverse_proxy_traefik_middleware_compression_enabled: "{{ traefik_config_http_middlewares_compression_enabled if (traefik_enabled and traefik_config_http_middlewares_compression_enabled) else false }}"
matrix_playbook_reverse_proxy_traefik_middleware_compression_name: "{{ (traefik_config_http_middlewares_compression_middleware_name + '@file') if traefik_enabled else '' }}"

# A separate Matrix Federation entrypoint is always enabled, unless the federation port matches one of the ports for existing (default) entrypoints
matrix_playbook_public_matrix_federation_api_traefik_entrypoint_enabled: "{{ matrix_federation_public_port not in [traefik_config_entrypoint_web_port, traefik_config_entrypoint_web_secure_port] }}"

# We only enable HTTP/3 on the federation entrypoint if the main web-secure entrypoint has it enabled.
matrix_playbook_public_matrix_federation_api_traefik_entrypoint_config_http3_enabled: "{{ traefik_config_entrypoint_web_secure_http3_enabled }}"

# `traefik_config_entrypoint_web_secure_enabled` is the variable we currently follow to determine if SSL is enabled or not.
# `matrix_playbook_ssl_enabled` is merely an indicator if (when looked at it publicly), the server supports SSL or not,
# and affects how services configure their public URLs.
matrix_federation_traefik_entrypoint_tls: "{{ traefik_config_entrypoint_web_secure_enabled }}"

# The public URLs of all playbook-managed Matrix client (web) applications which are enabled,
# ordered by preference (that is: the same order that these clients are wired up in this file).
matrix_playbook_public_client_urls: |
  {{
    ([matrix_client_element_scheme + '://' + matrix_client_element_hostname + matrix_client_element_path_prefix] if matrix_client_element_enabled else [])
    +
    ([matrix_client_gomuks_scheme + '://' + matrix_client_gomuks_hostname + matrix_client_gomuks_path_prefix] if matrix_client_gomuks_enabled else [])
    +
    ([matrix_client_commet_scheme + '://' + matrix_client_commet_hostname + matrix_client_commet_path_prefix] if matrix_client_commet_enabled else [])
    +
    ([hydrogen_scheme + '://' + hydrogen_hostname + hydrogen_path_prefix] if hydrogen_enabled else [])
    +
    ([cinny_scheme + '://' + cinny_hostname + cinny_path_prefix] if cinny_enabled else [])
    +
    ([sable_scheme + '://' + sable_hostname + sable_path_prefix] if sable_enabled else [])
    +
    ([matrix_client_schildichat_scheme + '://' + matrix_client_schildichat_hostname + matrix_client_schildichat_path_prefix] if matrix_client_schildichat_enabled else [])
    +
    ([matrix_client_fluffychat_scheme + '://' + matrix_client_fluffychat_hostname + matrix_client_fluffychat_path_prefix] if matrix_client_fluffychat_enabled else [])
  }}

# The URL that requests hitting the homeserver's root path (`/`) are redirected to.
#
# It points to the most-preferred playbook-managed client (see `matrix_playbook_public_client_urls`),
# or is empty (no redirection) if no such client is enabled.
matrix_playbook_public_client_root_redirection_url: "{{ matrix_playbook_public_client_urls | first | default('', true) }}"

########################################################################
#                                                                      #
# /Playbook                                                            #
#                                                                      #
########################################################################


########################################################################
#                                                                      #
# aux                                                                  #
#                                                                      #
########################################################################

aux_directory_default_owner: "{{ matrix_user_name }}"
aux_directory_default_group: "{{ matrix_group_name }}"

aux_file_default_owner: "{{ matrix_user_name }}"
aux_file_default_group: "{{ matrix_group_name }}"

########################################################################
#                                                                      #
# /aux                                                                 #
#                                                                      #
########################################################################


########################################################################
#                                                                      #
# base                                                                 #
#                                                                      #
########################################################################

matrix_homeserver_container_extra_arguments_auto: |
  {{
    (['--mount type=bind,src=' + matrix_bridge_appservice_discord_config_path + '/registration.yaml,dst=/matrix-appservice-discord-registration.yaml,ro'] if matrix_bridge_appservice_discord_enabled else [])
    +
    (['--mount type=bind,src=' + matrix_appservice_draupnir_for_all_config_path + '/draupnir-for-all-registration.yaml,dst=/matrix-appservice-draupnir-for-all-registration.yaml,ro'] if matrix_appservice_draupnir_for_all_enabled else [])
    +
    (['--mount type=bind,src=' + matrix_bot_meowlnir_config_path + '/registration.yaml,dst=/matrix-bot-meowlnir-registration.yaml,ro'] if matrix_bot_meowlnir_enabled else [])
    +
    (['--mount type=bind,src=' + matrix_appservice_double_puppet_config_path + '/registration.yaml,dst=/matrix-appservice-double-puppet-registration.yaml,ro'] if matrix_appservice_double_puppet_enabled else [])
    +
    (['--mount type=bind,src=' + matrix_bridge_appservice_irc_config_path + '/registration.yaml,dst=/matrix-appservice-irc-registration.yaml,ro'] if matrix_bridge_appservice_irc_enabled else [])
    +
    (['--mount type=bind,src=' + matrix_bridge_beeper_linkedin_config_path + '/registration.yaml,dst=/matrix-beeper-linkedin-registration.yaml,ro'] if matrix_bridge_beeper_linkedin_enabled else [])
    +
    (['--mount type=bind,src=' + matrix_bridge_beeper_line_config_path + '/registration.yaml,dst=/matrix-beeper-line-registration.yaml,ro'] if matrix_bridge_beeper_line_enabled else [])
    +
    (['--mount type=bind,src=' + matrix_bridge_wechat_config_path + '/registration.yaml,dst=/matrix-wechat-registration.yaml,ro'] if matrix_bridge_wechat_enabled else [])
    +
    (['--mount type=bind,src=' + matrix_bridge_heisenbridge_base_path + '/registration.yaml,dst=/heisenbridge-registration.yaml,ro'] if matrix_bridge_heisenbridge_enabled else [])
    +
    (['--mount type=bind,src=' + matrix_bridge_hookshot_base_path + '/registration.yml,dst=/hookshot-registration.yml,ro'] if matrix_bridge_hookshot_enabled else [])
    +
    (['--mount type=bind,src=' + matrix_bridge_mautrix_bluesky_config_path + '/registration.yaml,dst=/matrix-mautrix-bluesky-registration.yaml,ro'] if matrix_bridge_mautrix_bluesky_enabled else [])
    +
    (['--mount type=bind,src=' + matrix_bridge_rustpush_config_path + '/registration.yaml,dst=/matrix-rustpush-bridge-registration.yaml,ro'] if matrix_bridge_rustpush_enabled else [])
    +
    (['--mount type=bind,src=' + matrix_bridge_mautrix_discord_config_path + '/registration.yaml,dst=/matrix-mautrix-discord-registration.yaml,ro'] if matrix_bridge_mautrix_discord_enabled else [])
    +
    (['--mount type=bind,src=' + matrix_bridge_mautrix_slack_config_path + '/registration.yaml,dst=/matrix-mautrix-slack-registration.yaml,ro'] if matrix_bridge_mautrix_slack_enabled else [])
    +
    (['--mount type=bind,src=' + matrix_bridge_mautrix_googlechat_config_path + '/registration.yaml,dst=/matrix-mautrix-googlechat-registration.yaml,ro'] if matrix_bridge_mautrix_googlechat_enabled else [])
    +
    (['--mount type=bind,src=' + matrix_bridge_mautrix_signal_config_path + '/registration.yaml,dst=/matrix-mautrix-signal-registration.yaml,ro'] if matrix_bridge_mautrix_signal_enabled else [])
    +
    (['--mount type=bind,src=' + matrix_bridge_mautrix_meta_messenger_config_path + '/registration.yaml,dst=/matrix-mautrix-meta-messenger-registration.yaml,ro'] if matrix_bridge_mautrix_meta_messenger_enabled else [])
    +
    (['--mount type=bind,src=' + matrix_bridge_mautrix_meta_instagram_config_path + '/registration.yaml,dst=/matrix-mautrix-meta-instagram-registration.yaml,ro'] if matrix_bridge_mautrix_meta_instagram_enabled else [])
    +
    (['--mount type=bind,src=' + matrix_bridge_mautrix_telegram_config_path + '/registration.yaml,dst=/matrix-mautrix-telegram-registration.yaml,ro'] if matrix_bridge_mautrix_telegram_enabled else [])
    +
    (['--mount type=bind,src=' + matrix_bridge_mautrix_twitter_config_path + '/registration.yaml,dst=/matrix-mautrix-twitter-registration.yaml,ro'] if matrix_bridge_mautrix_twitter_enabled else [])
    +
    (['--mount type=bind,src=' + matrix_bridge_mautrix_gmessages_config_path + '/registration.yaml,dst=/matrix-mautrix-gmessages-registration.yaml,ro'] if matrix_bridge_mautrix_gmessages_enabled else [])
    +
    (['--mount type=bind,src=' + matrix_bridge_mautrix_gvoice_config_path + '/registration.yaml,dst=/matrix-mautrix-gvoice-registration.yaml,ro'] if matrix_bridge_mautrix_gvoice_enabled else [])
    +
    (['--mount type=bind,src=' + matrix_bridge_mautrix_linkedin_config_path + '/registration.yaml,dst=/matrix-mautrix-linkedin-registration.yaml,ro'] if matrix_bridge_mautrix_linkedin_enabled else [])
    +
    (['--mount type=bind,src=' + matrix_bridge_mautrix_whatsapp_config_path + '/registration.yaml,dst=/matrix-mautrix-whatsapp-registration.yaml,ro'] if matrix_bridge_mautrix_whatsapp_enabled else [])
    +
    (['--mount type=bind,src=' + matrix_bridge_mautrix_wsproxy_config_path + '/androidsms-registration.yaml,dst=/matrix-mautrix-androidsms-registration.yaml,ro'] if matrix_bridge_mautrix_wsproxy_enabled else [])
    +
    (['--mount type=bind,src=' + matrix_bridge_mautrix_wsproxy_config_path + '/imessage-registration.yaml,dst=/matrix-mautrix-imessage-registration.yaml,ro'] if matrix_bridge_mautrix_wsproxy_enabled else [])
    +
    (['--mount type=bind,src=' + matrix_bridge_mx_puppet_groupme_config_path + '/registration.yaml,dst=/matrix-mx-puppet-groupme-registration.yaml,ro'] if matrix_bridge_mx_puppet_groupme_enabled else [])
    +
    (['--mount type=bind,src=' + matrix_bridge_mx_puppet_steam_config_path + '/registration.yaml,dst=/matrix-mx-puppet-steam-registration.yaml,ro'] if matrix_bridge_mx_puppet_steam_enabled else [])
    +
    (['--mount type=bind,src=' + matrix_bridge_sms_config_path + '/registration.yaml,dst=/matrix-sms-bridge-registration.yaml,ro'] if matrix_bridge_sms_enabled else [])
    +
    (['--mount type=bind,src=' + matrix_bridge_steam_config_path + '/registration.yaml,dst=/matrix-steam-bridge-registration.yaml,ro'] if matrix_bridge_steam_enabled else [])
    +
    (['--mount type=bind,src=' + matrix_cactus_comments_app_service_config_file + ',dst=/matrix-cactus-comments.yaml,ro'] if matrix_cactus_comments_enabled else [])
  }}

matrix_homeserver_app_service_config_files_auto: |
  {{
    (['/matrix-appservice-discord-registration.yaml'] if matrix_bridge_appservice_discord_enabled else [])
    +
    (['/matrix-appservice-draupnir-for-all-registration.yaml'] if matrix_appservice_draupnir_for_all_enabled else [])
    +
    (['/matrix-bot-meowlnir-registration.yaml'] if matrix_bot_meowlnir_enabled else [])
    +
    (['/matrix-appservice-double-puppet-registration.yaml'] if matrix_appservice_double_puppet_enabled else [])
    +
    (['/matrix-appservice-irc-registration.yaml'] if matrix_bridge_appservice_irc_enabled else [])
    +
    (['/matrix-beeper-linkedin-registration.yaml'] if matrix_bridge_beeper_linkedin_enabled else [])
    +
    (['/matrix-beeper-line-registration.yaml'] if matrix_bridge_beeper_line_enabled else [])
    +
    (['/matrix-wechat-registration.yaml'] if matrix_bridge_wechat_enabled else [])
    +
    (['/heisenbridge-registration.yaml'] if matrix_bridge_heisenbridge_enabled else [])
    +
    (['/hookshot-registration.yml'] if matrix_bridge_hookshot_enabled else [])
    +
    (['/matrix-mautrix-bluesky-registration.yaml'] if matrix_bridge_mautrix_bluesky_enabled else [])
    +
    (['/matrix-rustpush-bridge-registration.yaml'] if matrix_bridge_rustpush_enabled else [])
    +
    (['/matrix-mautrix-discord-registration.yaml'] if matrix_bridge_mautrix_discord_enabled else [])
    +
    (['/matrix-mautrix-slack-registration.yaml'] if matrix_bridge_mautrix_slack_enabled else [])
    +
    (['/matrix-mautrix-googlechat-registration.yaml'] if matrix_bridge_mautrix_googlechat_enabled else [])
    +
    (['/matrix-mautrix-signal-registration.yaml'] if matrix_bridge_mautrix_signal_enabled else [])
    +
    (['/matrix-mautrix-meta-messenger-registration.yaml'] if matrix_bridge_mautrix_meta_messenger_enabled else [])
    +
    (['/matrix-mautrix-meta-instagram-registration.yaml'] if matrix_bridge_mautrix_meta_instagram_enabled else [])
    +
    (['/matrix-mautrix-telegram-registration.yaml'] if matrix_bridge_mautrix_telegram_enabled else [])
    +
    (['/matrix-mautrix-twitter-registration.yaml'] if matrix_bridge_mautrix_twitter_enabled else [])
    +
    (['/matrix-mautrix-gmessages-registration.yaml'] if matrix_bridge_mautrix_gmessages_enabled else [])
    +
    (['/matrix-mautrix-gvoice-registration.yaml'] if matrix_bridge_mautrix_gvoice_enabled else [])
    +
    (['/matrix-mautrix-linkedin-registration.yaml'] if matrix_bridge_mautrix_linkedin_enabled else [])
    +
    (['/matrix-mautrix-whatsapp-registration.yaml'] if matrix_bridge_mautrix_whatsapp_enabled else [])
    +
    (['/matrix-mautrix-androidsms-registration.yaml'] if matrix_bridge_mautrix_wsproxy_enabled else [])
    +
    (['/matrix-mautrix-imessage-registration.yaml'] if matrix_bridge_mautrix_wsproxy_enabled else [])
    +
    (['/matrix-mx-puppet-groupme-registration.yaml'] if matrix_bridge_mx_puppet_groupme_enabled else [])
    +
    (['/matrix-mx-puppet-steam-registration.yaml'] if matrix_bridge_mx_puppet_steam_enabled else [])
    +
    (['/matrix-sms-bridge-registration.yaml'] if matrix_bridge_sms_enabled else [])
    +
    (['/matrix-cactus-comments.yaml'] if matrix_cactus_comments_enabled else [])
    +
    (['/matrix-steam-bridge-registration.yaml'] if matrix_bridge_steam_enabled else [])
  }}

matrix_addons_homeserver_container_network: "{{ matrix_playbook_reverse_proxy_container_network if matrix_playbook_internal_matrix_client_api_traefik_entrypoint_enabled else matrix_homeserver_container_network }}"
matrix_addons_homeserver_client_api_url: "{{ ('http://' + matrix_playbook_reverse_proxy_hostname + ':' + matrix_playbook_internal_matrix_client_api_traefik_entrypoint_port | string) if matrix_playbook_internal_matrix_client_api_traefik_entrypoint_enabled else matrix_homeserver_container_url }}"
matrix_addons_homeserver_systemd_services_list: |
  {{
    (
      matrix_homeserver_systemd_services_list
      +
      (
        [traefik_identifier + '.service']
        if matrix_playbook_reverse_proxy_type == 'playbook-managed-traefik'
        else []
      )
    )
    if matrix_playbook_internal_matrix_client_api_traefik_entrypoint_enabled
    else matrix_homeserver_systemd_services_list
  }}

########################################################################
#                                                                      #
# /base                                                                #
#                                                                      #
########################################################################


########################################################################
#                                                                      #
# com.devture.ansible.role.systemd_service_manager                     #
#                                                                      #
########################################################################

# This list is not exhaustive and final.
# Synapse workers are still injected into the list at runtime.
# Additional JVB workers (jitsi_jvb.yml — roles/galaxy/jitsi/tasks/init_additional_jvb.yml) override this variable at runtime as well.
#
# Priority levels are like this:
# - Traefik starts first with a level of 250, so that:
#   - it can get an early start on obtaining SSL certificates and routing to other services as soon as they start (later)
#   - so that addon services (starting later) can communicte with the homeserver via Traefik's internal entrypoint
#     (see `matrix_playbook_internal_matrix_client_api_traefik_entrypoint_enabled`)
# - core services (the homeserver) get a level of ~1000
# - services that the homeserver depends on (database, Redis, ntfy, etc.) get a lower level — between 500 and 1000
# - coturn gets a higher priority level (= starts later) in all cases, to intentionally delay it in relation to the homeserver, because:
#  - when starting services one by one, the service manager waits for each service to fully start before proceeding to the next one
#  - if coturn has a lower priority than the homeserver, it would be started before it
#  - if coturn is started before the homeserver, there'd be no container label (usually on the homeserver) telling Traefik to get a `matrix.example.com` certificate
#  - thus, coturn would spin and wait for a certificate until it fails. We'd get a playbook failure due to it, but service manager will proceed to start all other services anyway.
#  - only later, when the homeserver actually starts, would that certificate be fetched and dumped
#  - this is a problem for `one-by-one`, `clean-stop-start` (which behaves like one-by-one initially) and possibly other modes, except `all-at-once`
# - reverse-proxying services get level 3000
# - Matrix utility services (bridges, bots) get a level of 2000/2200, so that:
#   - they can start before the reverse-proxy
#   - so that, when the reverse-proxy is up (Matrix is up), all bots and bridges can be interacted with
# - monitoring services (Prometheus, Grafana, …) get a level of 4000 — they can start later than all-of-Matrix
# - services which aren't time-sensitive (various crons and timers) get a level of 5000 — they can start later than all-of-Matrix

# The systemd_service_manager role supports conditional restart — only restarting services
# whose configuration or container image actually changed, leaving unchanged services running.
# This is controlled by `devture_systemd_service_manager_conditional_restart_enabled` (default: true in the role).
#
# We override it here to automatically match the intent of the playbook tags being used:
# - install-* tags (regular upgrades): conditional restart ON — only changed services restart, reducing downtime
# - setup-* tags (full setup/reconfiguration): conditional restart OFF — all services restart unconditionally
#
# This ensures consistent behavior whether users invoke the playbook via `just` shortcuts
# or raw `ansible-playbook --tags=...` commands.
devture_systemd_service_manager_conditional_restart_enabled: "{{ ansible_run_tags | select('match', 'setup-') | list | length == 0 }}"

devture_systemd_service_manager_services_list_auto: |
  {{
    ([{
      'name': (backup_borg_identifier + '.timer'),
      'priority': 5000,
      'restart_necessary': (backup_borg_restart_necessary | bool),
      'groups': ['matrix', 'backup', 'borg'],
    }] if backup_borg_enabled else [])
    +
    ([{
      'name': 'matrix-alertmanager-receiver.service',
      'priority': 2200,
      'restart_necessary': (matrix_alertmanager_receiver_restart_necessary | bool),
      'groups': ['matrix', 'alertmanager-receiver'],
    }] if matrix_alertmanager_receiver_enabled else [])
    +
    ([{
      'name': 'matrix-authentication-service.service',
      'priority': 2200,
      'restart_necessary': (matrix_authentication_service_restart_necessary | bool),
      'groups': ['matrix', 'matrix-authentication-service'],
    }] if matrix_authentication_service_enabled else [])
    +
    ([{
      'name': 'matrix-bot-buscarron.service',
      'priority': 2200,
      'restart_necessary': (matrix_bot_buscarron_restart_necessary | bool),
      'groups': ['matrix', 'bots', 'buscarron', 'bot-buscarron'],
    }] if matrix_bot_buscarron_enabled else [])
    +
    ([{
      'name': 'matrix-bot-baibot.service',
      'priority': 2200,
      'restart_necessary': (matrix_bot_baibot_restart_necessary | bool),
      'groups': ['matrix', 'bots', 'baibot', 'bot-baibot'],
    }] if matrix_bot_baibot_enabled else [])
    +
    ([{
      'name': 'matrix-bot-honoroit.service',
      'priority': 2200,
      'restart_necessary': (matrix_bot_honoroit_restart_necessary | bool),
      'groups': ['matrix', 'bots', 'honoroit', 'bot-honoroit'],
    }] if matrix_bot_honoroit_enabled else [])
    +
    ([{
      'name': 'matrix-bot-matrix-reminder-bot.service',
      'priority': 2200,
      'restart_necessary': (matrix_bot_matrix_reminder_bot_restart_necessary | bool),
      'groups': ['matrix', 'bots', 'reminder-bot', 'bot-matrix-reminder-bot'],
    }] if matrix_bot_matrix_reminder_bot_enabled else [])
    +
    ([{
      'name': 'matrix-bot-maubot.service',
      'priority': 2200,
      'restart_necessary': (matrix_bot_maubot_restart_necessary | bool),
      'groups': ['matrix', 'bots', 'maubot', 'bot-maubot'],
    }] if matrix_bot_maubot_enabled else [])
    +
    ([{
      'name': 'matrix-bot-mjolnir.service',
      'priority': 4000,
      'restart_necessary': (matrix_bot_mjolnir_restart_necessary | bool),
      'groups': ['matrix', 'bots', 'mjolnir', 'bot-mjolnir'],
    }] if matrix_bot_mjolnir_enabled else [])
    +
    ([{
      'name': 'matrix-bot-draupnir.service',
      'priority': 4000,
      'restart_necessary': (matrix_bot_draupnir_restart_necessary | bool),
      'groups': ['matrix', 'bots', 'draupnir', 'bot-draupnir'],
    }] if matrix_bot_draupnir_enabled else [])
    +
    ([{
      'name': 'matrix-bot-meowlnir.service',
      'priority': 4000,
      'restart_necessary': (matrix_bot_meowlnir_restart_necessary | bool),
      'groups': ['matrix', 'bots', 'meowlnir', 'bot-meowlnir'],
    }] if matrix_bot_meowlnir_enabled else [])
    +
    ([{
      'name': 'matrix-appservice-discord.service',
      'priority': 2000,
      'restart_necessary': (matrix_bridge_appservice_discord_restart_necessary | bool),
      'groups': ['matrix', 'bridges', 'appservice-discord'],
    }] if matrix_bridge_appservice_discord_enabled else [])
    +
    ([{
      'name': 'matrix-appservice-draupnir-for-all.service',
      'priority': 4000,
      'restart_necessary': (matrix_appservice_draupnir_for_all_restart_necessary | bool),
      'groups': ['matrix', 'bridges', 'draupnir-for-all', 'appservice-draupnir-for-all'],
    }] if matrix_appservice_draupnir_for_all_enabled else [])
    +
    ([{
      'name': 'matrix-appservice-irc.service',
      'priority': 2000,
      'restart_necessary': (matrix_bridge_appservice_irc_restart_necessary | bool),
      'groups': ['matrix', 'bridges', 'appservice-irc'],
    }] if matrix_bridge_appservice_irc_enabled else [])
    +
    ([{
      'name': 'matrix-beeper-linkedin.service',
      'priority': 2000,
      'restart_necessary': (matrix_bridge_beeper_linkedin_restart_necessary | bool),
      'groups': ['matrix', 'bridges', 'beeper-linkedin'],
    }] if matrix_bridge_beeper_linkedin_enabled else [])
    +
    ([{
      'name': 'matrix-beeper-line.service',
      'priority': 2000,
      'restart_necessary': (matrix_bridge_beeper_line_restart_necessary | bool),
      'groups': ['matrix', 'bridges', 'beeper-line'],
    }] if matrix_bridge_beeper_line_enabled else [])
    +
    ([{
      'name': 'matrix-wechat.service',
      'priority': 2000,
      'restart_necessary': (matrix_bridge_wechat_restart_necessary | bool),
      'groups': ['matrix', 'bridges', 'wechat'],
    }] if matrix_bridge_wechat_enabled else [])
    +
    ([{
      'name': 'matrix-wechat-agent.service',
      'priority': 2000,
      'restart_necessary': (matrix_bridge_wechat_restart_necessary | bool),
      'groups': ['matrix', 'bridges', 'wechat'],
    }] if matrix_bridge_wechat_enabled else [])
    +
    ([{
      'name': 'matrix-heisenbridge.service',
      'priority': 2000,
      'restart_necessary': (matrix_bridge_heisenbridge_restart_necessary | bool),
      'groups': ['matrix', 'bridges', 'heisenbridge'],
    }] if matrix_bridge_heisenbridge_enabled else [])
    +
    ([{
      'name': 'matrix-hookshot.service',
      'priority': 2000,
      'restart_necessary': (matrix_bridge_hookshot_restart_necessary | bool),
      'groups': ['matrix', 'bridges', 'hookshot', 'bridge-hookshot'],
    }] if matrix_bridge_hookshot_enabled else [])
    +
    ([{
      'name': 'matrix-meshtastic-relay.service',
      'priority': 2000,
      'restart_necessary': (matrix_bridge_meshtastic_relay_restart_necessary | bool),
      'groups': ['matrix', 'bridges', 'meshtastic-relay'],
    }] if matrix_bridge_meshtastic_relay_enabled else [])
    +
    ([{
      'name': 'matrix-mautrix-bluesky.service',
      'priority': 2000,
      'restart_necessary': (matrix_bridge_mautrix_bluesky_restart_necessary | bool),
      'groups': ['matrix', 'bridges', 'mautrix-bluesky'],
    }] if matrix_bridge_mautrix_bluesky_enabled else [])
    +
    ([{
      'name': 'matrix-rustpush-bridge.service',
      'priority': 2000,
      'restart_necessary': (matrix_bridge_rustpush_restart_necessary | bool),
      'groups': ['matrix', 'bridges', 'matrix-rustpush-bridge'],
    }] if matrix_bridge_rustpush_enabled else [])
    +
    ([{
      'name': 'matrix-mautrix-discord.service',
      'priority': 2000,
      'restart_necessary': (matrix_bridge_mautrix_discord_restart_necessary | bool),
      'groups': ['matrix', 'bridges', 'mautrix-discord'],
    }] if matrix_bridge_mautrix_discord_enabled else [])
    +
    ([{
      'name': 'matrix-mautrix-slack.service',
      'priority': 2000,
      'restart_necessary': (matrix_bridge_mautrix_slack_restart_necessary | bool),
      'groups': ['matrix', 'bridges', 'mautrix-slack'],
    }] if matrix_bridge_mautrix_slack_enabled else [])
    +
    ([{
      'name': 'matrix-mautrix-googlechat.service',
      'priority': 2000,
      'restart_necessary': (matrix_bridge_mautrix_googlechat_restart_necessary | bool),
      'groups': ['matrix', 'bridges', 'mautrix-googlechat'],
    }] if matrix_bridge_mautrix_googlechat_enabled else [])
    +
    ([{
      'name': 'matrix-mautrix-signal.service',
      'priority': 2000,
      'restart_necessary': (matrix_bridge_mautrix_signal_restart_necessary | bool),
      'groups': ['matrix', 'bridges', 'mautrix-signal', 'mautrix-signal'],
    }] if matrix_bridge_mautrix_signal_enabled else [])
    +
    ([{
      'name': (matrix_bridge_mautrix_meta_messenger_identifier + '.service'),
      'priority': 2000,
      'restart_necessary': (matrix_bridge_mautrix_meta_messenger_restart_necessary | bool),
      'groups': ['matrix', 'bridges', 'mautrix-meta', 'mautrix-meta-messenger'],
    }] if matrix_bridge_mautrix_meta_messenger_enabled else [])
    +
    ([{
      'name': (matrix_bridge_mautrix_meta_instagram_identifier + '.service'),
      'priority': 2000,
      'restart_necessary': (matrix_bridge_mautrix_meta_instagram_restart_necessary | bool),
      'groups': ['matrix', 'bridges', 'mautrix-meta', 'mautrix-meta-instagram'],
    }] if matrix_bridge_mautrix_meta_instagram_enabled else [])
    +
    ([{
      'name': 'matrix-mautrix-telegram.service',
      'priority': 2000,
      'restart_necessary': (matrix_bridge_mautrix_telegram_restart_necessary | bool),
      'groups': ['matrix', 'bridges', 'mautrix-telegram'],
    }] if matrix_bridge_mautrix_telegram_enabled else [])
    +
    ([{
      'name': 'matrix-mautrix-twitter.service',
      'priority': 2000,
      'restart_necessary': (matrix_bridge_mautrix_twitter_restart_necessary | bool),
      'groups': ['matrix', 'bridges', 'mautrix-twitter'],
    }] if matrix_bridge_mautrix_twitter_enabled else [])
    +
    ([{
      'name': 'matrix-mautrix-gmessages.service',
      'priority': 2000,
      'restart_necessary': (matrix_bridge_mautrix_gmessages_restart_necessary | bool),
      'groups': ['matrix', 'bridges', 'mautrix-gmessages'],
    }] if matrix_bridge_mautrix_gmessages_enabled else [])
    +
    ([{
      'name': 'matrix-mautrix-gvoice.service',
      'priority': 2000,
      'restart_necessary': (matrix_bridge_mautrix_gvoice_restart_necessary | bool),
      'groups': ['matrix', 'bridges', 'mautrix-gvoice'],
    }] if matrix_bridge_mautrix_gvoice_enabled else [])
    +
    ([{
      'name': 'matrix-mautrix-linkedin.service',
      'priority': 2000,
      'restart_necessary': (matrix_bridge_mautrix_linkedin_restart_necessary | bool),
      'groups': ['matrix', 'bridges', 'mautrix-linkedin'],
    }] if matrix_bridge_mautrix_linkedin_enabled else [])
    +
    ([{
      'name': 'matrix-mautrix-whatsapp.service',
      'priority': 2000,
      'restart_necessary': (matrix_bridge_mautrix_whatsapp_restart_necessary | bool),
      'groups': ['matrix', 'bridges', 'mautrix-whatsapp'],
    }] if matrix_bridge_mautrix_whatsapp_enabled else [])
    +
    ([{
      'name': 'matrix-mautrix-wsproxy.service',
      'priority': 2000,
      'restart_necessary': (matrix_bridge_mautrix_wsproxy_restart_necessary | bool),
      'groups': ['matrix', 'bridges', 'mautrix-wsproxy'],
    }] if matrix_bridge_mautrix_wsproxy_enabled else [])
    +
    ([{
      'name': 'matrix-mautrix-wsproxy-syncproxy.service',
      'priority': 2000,
      'restart_necessary': (matrix_bridge_mautrix_wsproxy_syncproxy_restart_necessary | bool),
      'groups': ['matrix', 'bridges', 'mautrix-wsproxy-syncproxy'],
    }] if matrix_bridge_mautrix_wsproxy_enabled else [])
    +
    ([{
      'name': 'matrix-mx-puppet-groupme.service',
      'priority': 2000,
      'restart_necessary': (matrix_bridge_mx_puppet_groupme_restart_necessary | bool),
      'groups': ['matrix', 'bridges', 'mx-puppet-groupme'],
    }] if matrix_bridge_mx_puppet_groupme_enabled else [])
    +
    ([{
      'name': 'matrix-mx-puppet-steam.service',
      'priority': 2000,
      'restart_necessary': (matrix_bridge_mx_puppet_steam_restart_necessary | bool),
      'groups': ['matrix', 'bridges', 'mx-puppet-steam'],
    }] if matrix_bridge_mx_puppet_steam_enabled else [])
    +
    ([{
      'name': 'matrix-postmoogle.service',
      'priority': 2200,
      'restart_necessary': (matrix_bridge_postmoogle_restart_necessary | bool),
      'groups': ['matrix', 'bridges', 'postmoogle'],
    }] if matrix_bridge_postmoogle_enabled else [])
    +
    ([{
      'name': 'matrix-sms-bridge.service',
      'priority': 2000,
      'restart_necessary': (matrix_bridge_sms_restart_necessary | bool),
      'groups': ['matrix', 'bridges', 'sms'],
    }] if matrix_bridge_sms_enabled else [])
    +
    ([{
      'name': 'matrix-steam-bridge.service',
      'priority': 2000,
      'restart_necessary': (matrix_bridge_steam_restart_necessary | bool),
      'groups': ['matrix', 'bridges', 'matrix-steam-bridge'],
    }] if matrix_bridge_steam_enabled else [])
    +
    ([{
      'name': 'matrix-cactus-comments.service',
      'priority': 2000,
      'restart_necessary': (matrix_cactus_comments_restart_necessary | bool),
      'groups': ['matrix', 'cactus-comments'],
    }] if matrix_cactus_comments_enabled else [])
    +
    ([{
      'name': 'matrix-cactus-comments-client.service',
      'priority': 2000,
      'restart_necessary': (matrix_cactus_comments_client_restart_necessary | bool),
      'groups': ['matrix', 'cactus-comments-client'],
    }] if matrix_cactus_comments_client_enabled else [])
    +
    ([{
      'name': (cinny_identifier + '.service'),
      'priority': 2000,
      'restart_necessary': (cinny_restart_necessary | bool),
      'groups': ['matrix', 'clients', 'cinny', 'client-cinny'],
    }] if cinny_enabled else [])
    +
    ([{
      'name': (sable_identifier + '.service'),
      'priority': 2000,
      'restart_necessary': (sable_restart_necessary | bool),
      'groups': ['matrix', 'clients', 'sable', 'client-sable'],
    }] if sable_enabled else [])
    +
    ([{
      'name': 'matrix-client-element.service',
      'priority': 2000,
      'restart_necessary': (matrix_client_element_restart_necessary | bool),
      'groups': ['matrix', 'clients', 'element', 'client-element'],
    }] if matrix_client_element_enabled else [])
    +
    ([{
      'name': (hydrogen_identifier + '.service'),
      'priority': 2000,
      'restart_necessary': (hydrogen_restart_necessary | bool),
      'groups': ['matrix', 'clients', 'hydrogen', 'client-hydrogen'],
    }] if hydrogen_enabled else [])
    +
    ([{
      'name': 'matrix-client-schildichat.service',
      'priority': 2000,
      'restart_necessary': (matrix_client_schildichat_restart_necessary | bool),
      'groups': ['matrix', 'clients', 'schildichat', 'client-schildichat'],
    }] if matrix_client_schildichat_enabled else [])
    +
    ([{
      'name': 'matrix-client-commet.service',
      'priority': 2000,
      'restart_necessary': (matrix_client_commet_restart_necessary | bool),
      'groups': ['matrix', 'clients', 'commet', 'client-commet'],
    }] if matrix_client_commet_enabled else [])
    +
    ([{
      'name': 'matrix-client-gomuks.service',
      'priority': 2000,
      'restart_necessary': (matrix_client_gomuks_restart_necessary | bool),
      'groups': ['matrix', 'clients', 'gomuks', 'client-gomuks'],
    }] if matrix_client_gomuks_enabled else [])
    +
    ([{
      'name': 'matrix-client-fluffychat.service',
      'priority': 2000,
      'restart_necessary': (matrix_client_fluffychat_restart_necessary | bool),
      'groups': ['matrix', 'clients', 'fluffychat', 'client-fluffychat'],
    }] if matrix_client_fluffychat_enabled else [])
    +
    ([{
      'name': ('matrix-' + matrix_homeserver_implementation + '.service'),
      'priority': matrix_homeserver_systemd_service_manager_priority,
      'restart_necessary': (
        (matrix_conduit_restart_necessary | bool) if matrix_homeserver_implementation == 'conduit'
        else (matrix_continuwuity_restart_necessary | bool) if matrix_homeserver_implementation == 'continuwuity'
        else (matrix_tuwunel_restart_necessary | bool) if matrix_homeserver_implementation == 'tuwunel'
        else (matrix_dendrite_restart_necessary | bool) if matrix_homeserver_implementation == 'dendrite'
        else true
      ),
      'groups': ['matrix', 'homeservers', matrix_homeserver_implementation],
    }] if matrix_homeserver_enabled else [])
    +
    ([{
      'name': 'matrix-corporal.service',
      'priority': (matrix_homeserver_systemd_service_manager_priority + 500),
      'restart_necessary': (matrix_corporal_restart_necessary | bool),
      'groups': ['matrix', 'corporal'],
    }] if matrix_corporal_enabled else [])
    +
    ([{
      'name': 'matrix-matrixto.service',
      'priority': 4000,
      'restart_necessary': (matrix_matrixto_restart_necessary | bool),
      'groups': ['matrix', 'matrixto'],
    }] if matrix_matrixto_enabled else [])
    +
    ([{
      'name': 'matrix-rageshake.service',
      'priority': 4000,
      'restart_necessary': (matrix_rageshake_restart_necessary | bool),
      'groups': ['matrix', 'rageshake'],
    }] if matrix_rageshake_enabled else [])
    +
    ([{
      'name': (coturn_identifier + '.service'),
      'priority': (matrix_homeserver_systemd_service_manager_priority + 500),
      'restart_necessary': (coturn_restart_necessary | bool),
      'groups': ['matrix', 'coturn'],
    }] if coturn_enabled else [])
    +
    ([{
      'name': (coturn_identifier + '-reload.timer'),
      'priority': 5000,
      'restart_necessary': (coturn_restart_necessary | bool),
      'groups': ['matrix', 'coturn'],
    }] if (coturn_enabled and coturn_tls_enabled) else [])
    +
    ([{
      'name': (ddclient_identifier + '.service'),
      'priority': 5000,
      'restart_necessary': (ddclient_restart_necessary | bool),
      'groups': ['matrix', 'ddclient', 'dynamic-dns'],
    }] if ddclient_enabled else [])
    +
    ([{
      'name': (etherpad_identifier + '.service'),
      'priority': 4000,
      'restart_necessary': (etherpad_restart_necessary | bool),
      'groups': ['matrix', 'etherpad'],
    }] if etherpad_enabled else [])
    +
    ([{
      'name': (grafana_identifier + '.service'),
      'priority': 4000,
      'restart_necessary': (grafana_restart_necessary | bool),
      'groups': ['matrix', 'monitoring', 'grafana'],
    }] if grafana_enabled else [])
    +
    ([{
      'name': (jitsi_identifier + '-web.service'),
      'priority': 4200,
      'restart_necessary': (jitsi_web_restart_necessary | bool),
      'groups': ['matrix', 'jitsi', 'jitsi-web'],
    }] if jitsi_enabled else [])
    +
    ([{
      'name': (jitsi_identifier + '-prosody.service'),
      'priority': 4000,
      'restart_necessary': (jitsi_prosody_restart_necessary | bool),
      'groups': ['matrix', 'jitsi', 'jitsi-prosody'],
    }] if jitsi_enabled else [])
    +
    ([{
      'name': (jitsi_identifier + '-jicofo.service'),
      'priority': 4100,
      'restart_necessary': (jitsi_jicofo_restart_necessary | bool),
      'groups': ['matrix', 'jitsi', 'jitsi-jicofo'],
    }] if jitsi_enabled else [])
    +
    ([{
      'name': (jitsi_identifier + '-jvb.service'),
      'priority': 4100,
      'restart_necessary': (jitsi_jvb_restart_necessary | bool),
      'groups': ['matrix', 'jitsi', 'jitsi-jvb'],
    }] if jitsi_enabled else [])
    +
    ([{
      'name': (matrix_media_repo_identifier + '.service'),
      'priority': 4000,
      'restart_necessary': (matrix_media_repo_restart_necessary | bool),
      'groups': ['matrix', 'matrix-media-repo'],
    }] if matrix_media_repo_enabled else [])
    +
    ([{
      'name': (exim_relay_identifier ~ '.service'),
      'priority': 800,
      'restart_necessary': (exim_relay_restart_necessary | bool),
      'groups': ['matrix', 'mailer', 'exim-relay'],
    }] if exim_relay_enabled else [])
    +
    ([{
      'name': (ntfy_identifier + '.service'),
      'priority': 800,
      'restart_necessary': (ntfy_restart_necessary | bool),
      'groups': ['matrix', 'ntfy'],
    }] if ntfy_enabled else [])
    +
    ([{
      'name': (postgres_identifier + '.service'),
      'priority': 500,
      'restart_necessary': (postgres_restart_necessary | bool),
      'groups': ['matrix', 'postgres'],
    }] if postgres_enabled else [])
    +
    ([{
      'name': (postgres_backup_identifier + '.service'),
      'priority': 5000,
      'restart_necessary': (postgres_backup_restart_necessary | bool),
      'groups': ['matrix', 'backup', 'postgres-backup'],
    }] if postgres_backup_enabled else [])
    +
    ([{
      'name': (prometheus_identifier + '.service'),
      'priority': 4000,
      'restart_necessary': (prometheus_restart_necessary | bool),
      'groups': ['matrix', 'monitoring', 'prometheus'],
    }] if prometheus_enabled else [])
    +
    ([{
      'name': (prometheus_node_exporter_identifier + '.service'),
      'priority': 3900,
      'restart_necessary': (prometheus_node_exporter_restart_necessary | bool),
      'groups': ['matrix', 'monitoring', 'prometheus-exporters', 'prometheus-node-exporter'],
    }] if prometheus_node_exporter_enabled else [])
    +
    ([{
      'name': (prometheus_postgres_exporter_identifier + '.service'),
      'priority': 3900,
      'restart_necessary': (prometheus_postgres_exporter_restart_necessary | bool),
      'groups': ['matrix', 'monitoring', 'prometheus-exporters', 'prometheus-postgres-exporter'],
    }] if prometheus_postgres_exporter_enabled else [])
    +
    ([{
      'name': (prometheus_nginxlog_exporter_identifier + '.service'),
      'priority': 3900,
      'restart_necessary': (prometheus_nginxlog_exporter_restart_necessary | bool),
      'groups': ['matrix', 'monitoring', 'prometheus-exporters', 'prometheus-nginxlog-exporter'],
    }] if prometheus_nginxlog_exporter_enabled else [])
    +
    ([{
      'name': (valkey_identifier + '.service'),
      'priority': 750,
      'restart_necessary': (valkey_restart_necessary | bool),
      'groups': ['matrix', 'valkey'],
    }] if valkey_enabled else [])
    +
    ([{
      'name': 'matrix-pantalaimon.service',
      'priority': 4000,
      'restart_necessary': (matrix_pantalaimon_restart_necessary | bool),
      'groups': ['matrix', 'pantalaimon'],
    }] if matrix_pantalaimon_enabled else [])
    +
    ([{
      'name': 'matrix-element-admin.service',
      'priority': 4000,
      'restart_necessary': (matrix_element_admin_restart_necessary | bool),
      'groups': ['matrix', 'element-admin'],
    }] if matrix_element_admin_enabled else [])
    +
    ([{
      'name': 'matrix-element-call.service',
      'priority': 4000,
      'restart_necessary': (matrix_element_call_restart_necessary | bool),
      'groups': ['matrix', 'element-call'],
    }] if matrix_element_call_enabled else [])
    +
    ([{
      'name': 'matrix-livekit-jwt-service.service',
      'priority': 3500,
      'restart_necessary': (matrix_livekit_jwt_service_restart_necessary | bool),
      'groups': ['matrix', 'livekit-jwt-service'],
    }] if matrix_livekit_jwt_service_enabled else [])
    +
    ([{
      'name': (livekit_server_identifier + '.service'),
      'priority': 3000,
      'restart_necessary': (livekit_server_restart_necessary | bool),
      'groups': ['matrix', 'livekit-server'],
    }] if livekit_server_enabled else [])
    +
    ([{
      'name': 'matrix-sygnal.service',
      'priority': 800,
      'restart_necessary': (matrix_sygnal_restart_necessary | bool),
      'groups': ['matrix', 'sygnal'],
    }] if matrix_sygnal_enabled else [])
    +
    ([{
      'name': 'matrix-goofys.service',
      'priority': 800,
      'restart_necessary': (matrix_goofys_restart_necessary | bool),
      'groups': ['matrix', 'goofys'],
    }] if (matrix_synapse_enabled and matrix_s3_media_store_enabled) else [])
    +
    ([{
      'name': 'matrix-synapse-s3-storage-provider-migrate.timer',
      'priority': 5000,
      'restart_necessary': (matrix_synapse_s3_storage_provider_restart_necessary | bool),
      'groups': ['matrix'],
    }] if (matrix_synapse_enabled and matrix_synapse_ext_synapse_s3_storage_provider_enabled) else [])
    +
    ([{
      'name': 'matrix-synapse-auto-compressor.timer',
      'priority': 5000,
      'restart_necessary': (matrix_synapse_auto_compressor_restart_necessary | bool),
      'groups': ['matrix', 'synapse-auto-compressor'],
    }] if matrix_synapse_auto_compressor_enabled else [])
    +
    ([{
      'name': 'matrix-ketesa.service',
      'priority': 4000,
      'restart_necessary': (matrix_ketesa_restart_necessary | bool),
      'groups': ['matrix', 'ketesa'],
    }] if matrix_ketesa_enabled else [])
    +
    ([{
      'name': (matrix_synapse_usage_exporter_identifier + '.service'),
      'priority': 4000,
      'restart_necessary': (matrix_synapse_usage_exporter_restart_necessary | bool),
      'groups': ['matrix', 'synapse-usage-exporter'],
    }] if matrix_synapse_usage_exporter_enabled else [])
    +
    ([{
      'name': 'matrix-synapse-reverse-proxy-companion.service',
      'priority': 1500,
      'restart_necessary': (matrix_synapse_reverse_proxy_companion_restart_necessary | bool),
      'groups': ['matrix', 'homeservers', 'synapse', 'synapse-reverse-proxy-companion', 'reverse-proxies'],
    }] if matrix_synapse_reverse_proxy_companion_enabled else [])
    +
    ([{
      'name': 'matrix-user-verification-service.service',
      'priority': 800,
      'restart_necessary': (matrix_user_verification_service_restart_necessary | bool),
      'groups': ['matrix', 'matrix-user-verification-service'],
    }] if matrix_user_verification_service_enabled else [])
    +
    ([{
      'name': (matrix_static_files_identifier + '.service'),
      'priority': 4000,
      'restart_necessary': (matrix_static_files_restart_necessary | bool),
      'groups': ['matrix', 'matrix-static-files'],
    }] if matrix_static_files_enabled else [])
    +
    ([{
      'name': (container_socket_proxy_identifier + '.service'),
      'priority': 200,
      'restart_necessary': (container_socket_proxy_restart_necessary | bool),
      'groups': ['matrix', 'reverse-proxies', 'container-socket-proxy'],
    }] if container_socket_proxy_enabled else [])
    +
    ([{
      'name': (traefik_identifier + '.service'),
      'priority': 250,
      'restart_necessary': (traefik_restart_necessary | bool),
      'groups': ['matrix', 'traefik', 'reverse-proxies'],
    }] if traefik_enabled else [])
    +
    ([{
      'name': (traefik_certs_dumper_identifier + '.service'),
      'priority': 300,
      'restart_necessary': (traefik_certs_dumper_restart_necessary | bool),
      'groups': ['matrix', 'traefik-certs-dumper'],
    }] if traefik_certs_dumper_enabled else [])
  }}

########################################################################
#                                                                      #
# /com.devture.ansible.role.systemd_service_manager                    #
#                                                                      #
########################################################################


########################################################################
#                                                                      #
# com.devture.ansible.role.timesync                                    #
#                                                                      #
########################################################################

# To completely disable installing systemd-timesyncd/ntpd, use `devture_timesync_installation_enabled: false`.

########################################################################
#                                                                      #
# /com.devture.ansible.role.timesync                                   #
#                                                                      #
########################################################################


######################################################################
#
# com.devture.ansible.role.playbook_state_preserver
#
######################################################################

# To completely disable this feature, use `devture_playbook_state_preserver_enabled: false`.

devture_playbook_state_preserver_uid: "{{ matrix_user_uid }}"
devture_playbook_state_preserver_gid: "{{ matrix_user_gid }}"

devture_playbook_state_preserver_vars_preservation_dst: "{{ matrix_base_data_path }}/vars.yml"

devture_playbook_state_preserver_commit_hash_preservation_dst: "{{ matrix_base_data_path }}/git_hash.yml"

######################################################################
#
# /com.devture.ansible.role.playbook_state_preserver
#
######################################################################


########################################################################
#                                                                      #
# geerlingguy/ansible-role-docker                                      #
#                                                                      #
########################################################################

docker_daemon_options: "{{ matrix_playbook_docker_installation_daemon_options }}"

########################################################################
#                                                                      #
# /geerlingguy/ansible-role-docker                                     #
#                                                                      #
########################################################################


######################################################################
#
# matrix-base
#
######################################################################

matrix_homeserver_systemd_services_list: |-
  {{
    (
      ([('matrix-' + matrix_homeserver_implementation + '.service')] if matrix_homeserver_implementation != 'synapse' else [])
      +
      ([('matrix-' + matrix_homeserver_implementation + '.service')] if matrix_homeserver_implementation == 'synapse' and not matrix_synapse_reverse_proxy_companion_enabled else [])
      +
      (['matrix-synapse-reverse-proxy-companion.service'] if matrix_synapse_reverse_proxy_companion_enabled else [])
    ) | unique
  }}

matrix_homeserver_container_client_api_endpoint: |-
  {{
    {
      'synapse': ('matrix-synapse-reverse-proxy-companion:8008' if matrix_synapse_reverse_proxy_companion_enabled | default(false) else ('matrix-synapse:'+ matrix_synapse_container_client_api_port | default('8008') | string)),
      'dendrite': ('matrix-dendrite:' + matrix_dendrite_http_bind_port | default('8008') | string),
      'conduit': ('matrix-conduit:' + matrix_conduit_port_number | default('8008') | string),
      'continuwuity': ('matrix-continuwuity:' + matrix_continuwuity_config_port_number | default('8008') | string),
      'tuwunel': ('matrix-tuwunel:' + matrix_tuwunel_config_port_number | default('8008') | string),
    }[matrix_homeserver_implementation]
  }}

matrix_homeserver_container_federation_api_endpoint: |-
  {{
    {
      'synapse': ('matrix-synapse-reverse-proxy-companion:8048' if matrix_synapse_reverse_proxy_companion_enabled else ('matrix-synapse:'+ matrix_synapse_container_federation_api_plain_port | default('8008') | string)),
      'dendrite': ('matrix-dendrite:' + matrix_dendrite_http_bind_port | default('8008') | string),
      'conduit': ('matrix-conduit:' + matrix_conduit_port_number | default('8008') | string),
      'continuwuity': ('matrix-continuwuity:' + matrix_continuwuity_config_port_number | default('8008') | string),
      'tuwunel': ('matrix-tuwunel:' + matrix_tuwunel_config_port_number | default('8008') | string),
    }[matrix_homeserver_implementation]
  }}

matrix_integration_manager_rest_url: ""
matrix_integration_manager_ui_url: ""

######################################################################
#
# /matrix-base
#
######################################################################


######################################################################
#
# matrix-alertmanager-receiver
#
######################################################################

# We don't enable this by default.
matrix_alertmanager_receiver_enabled: false

matrix_alertmanager_receiver_container_image_registry_prefix_upstream: "{{ matrix_container_global_registry_prefix_override if matrix_container_global_registry_prefix_override else matrix_alertmanager_receiver_container_image_registry_prefix_upstream_default }}"

matrix_alertmanager_receiver_container_image_self_build: "{{ matrix_architecture != 'amd64' }}"

matrix_alertmanager_receiver_container_network: "{{ matrix_addons_container_network }}"

matrix_alertmanager_receiver_container_additional_networks_auto: |-
  {{
    (
      ([] if matrix_addons_homeserver_container_network == '' else [matrix_addons_homeserver_container_network])
      +
      ([matrix_playbook_reverse_proxyable_services_additional_network] if (matrix_playbook_reverse_proxyable_services_additional_network and matrix_alertmanager_receiver_container_labels_traefik_enabled) else [])
    ) | unique
  }}

matrix_alertmanager_receiver_container_labels_traefik_enabled: "{{ matrix_playbook_reverse_proxy_type in ['playbook-managed-traefik', 'other-traefik-container'] }}"
matrix_alertmanager_receiver_container_labels_traefik_docker_network: "{{ matrix_playbook_reverse_proxyable_services_additional_network }}"
matrix_alertmanager_receiver_container_labels_traefik_entrypoints: "{{ traefik_entrypoint_primary }}"
matrix_alertmanager_receiver_container_labels_traefik_tls_certResolver: "{{ traefik_certResolver_primary }}"

matrix_alertmanager_receiver_container_labels_metrics_middleware_basic_auth_enabled: "{{ matrix_metrics_exposure_http_basic_auth_enabled }}"
matrix_alertmanager_receiver_container_labels_metrics_middleware_basic_auth_users: "{{ matrix_metrics_exposure_http_basic_auth_users }}"

matrix_alertmanager_receiver_systemd_required_services_list_auto: "{{ matrix_addons_homeserver_systemd_services_list }}"

matrix_alertmanager_receiver_config_matrix_homeserver_url: "{{ matrix_addons_homeserver_client_api_url }}"

matrix_alertmanager_receiver_metrics_enabled: "{{ prometheus_enabled or matrix_metrics_exposure_enabled }}"

matrix_alertmanager_receiver_metrics_proxying_enabled: "{{ matrix_alertmanager_receiver_config_http_metrics_enabled and matrix_metrics_exposure_enabled }}"
matrix_alertmanager_receiver_metrics_proxying_hostname: "{{ matrix_metrics_exposure_hostname }}"
matrix_alertmanager_receiver_metrics_proxying_path: "{{ matrix_metrics_exposure_path_prefix }}/matrix-alertmanager-receiver"

######################################################################
#
# /matrix-alertmanager-receiver
#
######################################################################


######################################################################
#
# matrix-authentication-service
#
######################################################################

matrix_authentication_service_enabled: false

matrix_authentication_service_hostname: "{{ matrix_server_fqn_matrix }}"
matrix_authentication_service_path_prefix: /auth

matrix_playbook_matrix_authentication_service_uses_managed_postgres: "{{ postgres_enabled }}"

matrix_authentication_service_config_database_host: "{{ matrix_authentication_service_config_database_socket_path if matrix_authentication_service_config_database_socket_enabled else (postgres_connection_hostname if matrix_playbook_matrix_authentication_service_uses_managed_postgres else '') }}"
matrix_authentication_service_config_database_password: "{{ (matrix_homeserver_generic_secret_key + ':mas.db') | hash('sha512') | to_uuid }}"

# unix socket connection
matrix_authentication_service_config_database_socket_enabled: "{{ matrix_playbook_matrix_authentication_service_uses_managed_postgres and postgres_container_unix_socket_enabled }}"
# path to the Postgres socket's parent dir inside the MAS container
matrix_authentication_service_config_database_socket_path: "{{ '/run-postgres' if matrix_playbook_matrix_authentication_service_uses_managed_postgres else '' }}"
# path to the Postgres socket on the host
matrix_authentication_service_config_database_socket_path_host: "{{ postgres_run_path if matrix_playbook_matrix_authentication_service_uses_managed_postgres else '' }}"

matrix_authentication_service_config_matrix_homeserver: "{{ matrix_domain }}"
matrix_authentication_service_config_matrix_secret: "{{ (matrix_homeserver_generic_secret_key + ':mas.hs.secret') | hash('sha512') | to_uuid }}"
matrix_authentication_service_config_matrix_endpoint: "{{ matrix_homeserver_container_url }}"

# We're using a non-default configuration which:
# - allows passwords from Synapse (hashed with bcrypt) to be imported with scheme version 1 so existing users will be able to login
# - as soon as they do one login, the hash will be 'upgraded' to argon2id
matrix_authentication_service_config_passwords_schemes:
  - version: 1
    secret: "{{ matrix_synapse_password_config_pepper }}"
    algorithm: bcrypt
    unicode_normalization: true
  - version: 2
    algorithm: argon2id

matrix_authentication_service_config_email_transport: "{{ 'smtp' if exim_relay_enabled else 'blackhole' }}"
matrix_authentication_service_config_email_hostname: "{{ exim_relay_identifier if exim_relay_enabled else '' }}"
matrix_authentication_service_config_email_port: "{{ 8025 if exim_relay_enabled else 587 }}"
matrix_authentication_service_config_email_mode: "{{ 'plain' if exim_relay_enabled else 'starttls' }}"
matrix_authentication_service_config_email_from_address: "{{ exim_relay_sender_address }}"

matrix_authentication_service_admin_api_enabled: "{{ matrix_element_admin_enabled or matrix_ketesa_enabled }}"

matrix_authentication_service_container_image_registry_prefix_upstream: "{{ matrix_container_global_registry_prefix_override if matrix_container_global_registry_prefix_override else matrix_authentication_service_container_image_registry_prefix_upstream_default }}"

matrix_authentication_service_container_image_self_build: "{{ matrix_architecture not in ['amd64', 'arm64'] }}"

matrix_authentication_service_container_network: "{{ matrix_homeserver_container_network }}"

matrix_authentication_service_container_additional_networks_auto: |-
  {{
    (
      ([postgres_container_network] if (matrix_playbook_matrix_authentication_service_uses_managed_postgres and not matrix_authentication_service_config_database_socket_enabled) else [])
      +
      ([exim_relay_container_network] if (exim_relay_enabled and matrix_authentication_service_config_email_transport == 'smtp' and matrix_authentication_service_config_email_hostname == exim_relay_identifier and matrix_authentication_service_container_network != exim_relay_container_network) else [])
      +
      ([matrix_playbook_reverse_proxyable_services_additional_network] if matrix_playbook_reverse_proxyable_services_additional_network and matrix_authentication_service_container_labels_traefik_enabled else [])
    ) | unique
  }}

matrix_authentication_service_container_labels_traefik_enabled: "{{ matrix_playbook_reverse_proxy_type in ['playbook-managed-traefik', 'other-traefik-container'] }}"
matrix_authentication_service_container_labels_traefik_docker_network: "{{ matrix_playbook_reverse_proxyable_services_additional_network }}"
matrix_authentication_service_container_labels_traefik_entrypoints: "{{ traefik_entrypoint_primary }}"
matrix_authentication_service_container_labels_traefik_tls_certResolver: "{{ traefik_certResolver_primary }}"

matrix_authentication_service_container_labels_public_compatibility_layer_enabled: "{{ not matrix_authentication_service_migration_in_progress}}"
matrix_authentication_service_container_labels_public_compatibility_layer_hostname: "{{ matrix_server_fqn_matrix }}"

matrix_authentication_service_container_labels_internal_compatibility_layer_enabled: "{{ not matrix_authentication_service_migration_in_progress}}"
matrix_authentication_service_container_labels_internal_compatibility_layer_entrypoints: "{{ matrix_playbook_internal_matrix_client_api_traefik_entrypoint_name }}"

# MAS somewhat depends on the homeserver service, but the homeserver also depends on MAS.
# To avoid a circular dependency, we make MAS not depend on the homeserver here.
# The homeserver is more lost without MAS than MAS is without the homeserver, so we'll define the dependency on the homeserver side.
# We'll put our dependency on the homeserver as a "want", rather than a requirement.
matrix_authentication_service_systemd_required_services_list_auto: |
  {{
    ([postgres_identifier ~ '.service'] if matrix_playbook_matrix_authentication_service_uses_managed_postgres else [])
  }}

# See more information about this homeserver "want" in the comment for `matrix_authentication_service_systemd_required_services_list_auto` above.
matrix_authentication_service_systemd_wanted_services_list_auto: |
  {{
    ['matrix-' + matrix_homeserver_implementation + '.service']
    +
    ([exim_relay_identifier ~ '.service'] if (exim_relay_enabled and matrix_authentication_service_config_email_transport == 'smtp' and matrix_authentication_service_config_email_hostname == exim_relay_identifier and matrix_authentication_service_container_network != exim_relay_container_network) else [])
  }}

matrix_authentication_service_syn2mas_container_network: "{{ postgres_container_network if (matrix_playbook_matrix_authentication_service_uses_managed_postgres and not matrix_authentication_service_config_database_socket_enabled) else matrix_authentication_service_container_network }}"

matrix_authentication_service_syn2mas_synapse_homeserver_config_path: "{{ matrix_synapse_config_dir_path + '/homeserver.yaml' if matrix_synapse_enabled else '' }}"
matrix_authentication_service_syn2mas_synapse_database_socket_enabled: "{{ matrix_synapse_database_socket_enabled if matrix_synapse_enabled else false }}"
matrix_authentication_service_syn2mas_synapse_database_socket_path: "{{ matrix_synapse_database_socket_path if matrix_synapse_enabled else '' }}"
matrix_authentication_service_syn2mas_synapse_database_socket_path_host: "{{ matrix_synapse_database_socket_path_host if matrix_synapse_enabled else '' }}"

######################################################################
#
# /matrix-authentication-service
#
######################################################################




######################################################################
#
# matrix-bridge-appservice-discord
#
######################################################################

# We don't enable bridges by default.
matrix_bridge_appservice_discord_enabled: false

matrix_bridge_appservice_discord_systemd_required_services_list_auto: |
  {{
    matrix_addons_homeserver_systemd_services_list
    +
    ([postgres_identifier ~ '.service'] if (postgres_enabled and matrix_bridge_appservice_discord_database_hostname == postgres_connection_hostname) else [])
  }}

matrix_bridge_appservice_discord_container_image_registry_prefix_upstream: "{{ matrix_container_global_registry_prefix_override if matrix_container_global_registry_prefix_override else matrix_bridge_appservice_discord_container_image_registry_prefix_upstream_default }}"

matrix_bridge_appservice_discord_container_http_host_bind_port: "{{ (matrix_playbook_service_host_bind_interface_prefix ~ '9005') if matrix_playbook_service_host_bind_interface_prefix else '' }}"

matrix_bridge_appservice_discord_container_network: "{{ matrix_addons_container_network }}"

matrix_bridge_appservice_discord_container_additional_networks_auto: |-
  {{
    (
      ([] if matrix_addons_homeserver_container_network == '' else [matrix_addons_homeserver_container_network])
      +
      ([postgres_container_network] if (postgres_enabled and matrix_bridge_appservice_discord_database_hostname == postgres_connection_hostname and matrix_bridge_appservice_discord_container_network != postgres_container_network) else [])
    ) | unique
  }}

# If the homeserver disables presence, it's likely better (less wasteful) to also disable presence on the bridge side.
matrix_bridge_appservice_discord_bridge_disablePresence: "{{ (not matrix_synapse_presence_enabled) if matrix_homeserver_implementation == 'synapse' else false }}"

matrix_bridge_appservice_discord_appservice_token: "{{ (matrix_homeserver_generic_secret_key + ':discord.as.token') | hash('sha512') | to_uuid }}"

matrix_bridge_appservice_discord_homeserver_token: "{{ (matrix_homeserver_generic_secret_key + ':discord.hs.token') | hash('sha512') | to_uuid }}"

# We only make this use Postgres if our own Postgres server is enabled.
# It's only then (for now) that we can automatically create the necessary database and user for this service.
matrix_bridge_appservice_discord_database_engine: "{{ 'postgres' if postgres_enabled else 'sqlite' }}"
matrix_bridge_appservice_discord_database_hostname: "{{ postgres_connection_hostname if postgres_enabled else '' }}"
matrix_bridge_appservice_discord_database_password: "{{ (matrix_homeserver_generic_secret_key + ':as.discord.db') | hash('sha512') | to_uuid }}"

######################################################################
#
# /matrix-bridge-appservice-discord
#
######################################################################


######################################################################
#
# matrix-bridge-appservice-irc
#
######################################################################

# We don't enable bridges by default.
matrix_bridge_appservice_irc_enabled: false

matrix_bridge_appservice_irc_systemd_required_services_list_auto: |
  {{
    matrix_addons_homeserver_systemd_services_list
    +
    ([postgres_identifier ~ '.service'] if (postgres_enabled and matrix_bridge_appservice_irc_database_hostname == postgres_connection_hostname) else [])
  }}

matrix_bridge_appservice_irc_container_image_registry_prefix_upstream: "{{ matrix_container_global_registry_prefix_override if matrix_container_global_registry_prefix_override else matrix_bridge_appservice_irc_container_image_registry_prefix_upstream_default }}"

matrix_bridge_appservice_irc_container_image_self_build: "{{ matrix_architecture != 'amd64' }}"

matrix_bridge_appservice_irc_container_http_host_bind_port: "{{ (matrix_playbook_service_host_bind_interface_prefix ~ '9999') if matrix_playbook_service_host_bind_interface_prefix else '' }}"

matrix_bridge_appservice_irc_container_network: "{{ matrix_addons_container_network }}"

matrix_bridge_appservice_irc_container_additional_networks_auto: |-
  {{
    (
      ([] if matrix_addons_homeserver_container_network == '' else [matrix_addons_homeserver_container_network])
      +
      ([postgres_container_network] if (postgres_enabled and matrix_bridge_appservice_irc_database_hostname == postgres_connection_hostname and matrix_bridge_appservice_irc_container_network != postgres_container_network) else [])
      +
      [matrix_playbook_reverse_proxyable_services_additional_network] if (matrix_bridge_appservice_irc_container_labels_traefik_enabled and matrix_playbook_reverse_proxyable_services_additional_network) else []
    ) | unique
  }}

# The IRC bridge docs say that if homeserver presence is disabled, it's better to also disable
# IRC bridge presence, for performance reasons.
matrix_bridge_appservice_irc_homeserver_enablePresence: "{{ matrix_synapse_presence_enabled if matrix_homeserver_implementation == 'synapse' else true }}"

matrix_bridge_appservice_irc_appservice_token: "{{ (matrix_homeserver_generic_secret_key + ':irc.as.token') | hash('sha512') | to_uuid }}"

matrix_bridge_appservice_irc_homeserver_url: "{{ matrix_addons_homeserver_client_api_url }}"
matrix_bridge_appservice_irc_homeserver_token: "{{ (matrix_homeserver_generic_secret_key + ':irc.hs.token') | hash('sha512') | to_uuid }}"

matrix_bridge_appservice_irc_database_engine: "{{ 'postgres' if postgres_enabled else 'nedb' }}"
matrix_bridge_appservice_irc_database_hostname: "{{ postgres_connection_hostname if postgres_enabled else '' }}"
matrix_bridge_appservice_irc_database_password: "{{ (matrix_homeserver_generic_secret_key + ':as.irc.db') | hash('sha512') | to_uuid }}"
matrix_bridge_appservice_irc_database_container_network: "{{ postgres_container_network if postgres_enabled else '' }}"

matrix_bridge_appservice_irc_ircService_mediaProxy_publicUrl_scheme: "{{ 'https' if matrix_playbook_ssl_enabled else 'http' }}"  # noqa var-naming

matrix_bridge_appservice_irc_container_labels_traefik_enabled: "{{ matrix_playbook_reverse_proxy_type in ['playbook-managed-traefik', 'other-traefik-container'] }}"
matrix_bridge_appservice_irc_container_labels_traefik_docker_network: "{{ matrix_playbook_reverse_proxyable_services_additional_network }}"
matrix_bridge_appservice_irc_container_labels_traefik_entrypoints: "{{ traefik_entrypoint_primary }}"
matrix_bridge_appservice_irc_container_labels_traefik_tls_certResolver: "{{ traefik_certResolver_primary }}"  # noqa var-naming

######################################################################
#
# /matrix-bridge-appservice-irc
#
######################################################################


######################################################################
#
# matrix-bridge-beeper-linkedin
#
######################################################################

# We don't enable bridges by default.
matrix_bridge_beeper_linkedin_enabled: false

matrix_bridge_beeper_linkedin_systemd_required_services_list_auto: |
  {{
    matrix_addons_homeserver_systemd_services_list
    +
    ([postgres_identifier ~ '.service'] if (postgres_enabled and matrix_bridge_beeper_linkedin_database_hostname == postgres_connection_hostname) else [])
  }}

matrix_bridge_beeper_linkedin_container_image_registry_prefix_upstream: "{{ matrix_container_global_registry_prefix_override if matrix_container_global_registry_prefix_override else matrix_bridge_beeper_linkedin_container_image_registry_prefix_upstream_default }}"

matrix_bridge_beeper_linkedin_container_image_self_build: "{{ matrix_architecture not in ['amd64'] }}"

matrix_bridge_beeper_linkedin_container_network: "{{ matrix_addons_container_network }}"

matrix_bridge_beeper_linkedin_container_additional_networks_auto: |-
  {{
    (
      ([] if matrix_addons_homeserver_container_network == '' else [matrix_addons_homeserver_container_network])
      +
      ([postgres_container_network] if (postgres_enabled and matrix_bridge_beeper_linkedin_database_hostname == postgres_connection_hostname and matrix_bridge_beeper_linkedin_container_network != postgres_container_network) else [])
    ) | unique
  }}

matrix_bridge_beeper_linkedin_appservice_token: "{{ (matrix_homeserver_generic_secret_key + ':linked.as.token') | hash('sha512') | to_uuid }}"

matrix_bridge_beeper_linkedin_homeserver_address: "{{ matrix_addons_homeserver_client_api_url }}"
matrix_bridge_beeper_linkedin_homeserver_token: "{{ (matrix_homeserver_generic_secret_key + ':linked.hs.token') | hash('sha512') | to_uuid }}"

matrix_bridge_beeper_linkedin_homeserver_async_media: "{{ matrix_homeserver_implementation in ['synapse'] }}"

matrix_bridge_beeper_linkedin_bridge_login_shared_secret_map_auto: |-
  {{
    ({
      matrix_bridge_beeper_linkedin_homeserver_domain: ("as_token:" + matrix_appservice_double_puppet_registration_as_token)
    })
    if matrix_appservice_double_puppet_enabled
    else (
      {matrix_bridge_beeper_linkedin_homeserver_domain: matrix_synapse_ext_password_provider_shared_secret_auth_shared_secret}
      if matrix_synapse_ext_password_provider_shared_secret_auth_enabled
      else {}
    )
  }}

matrix_bridge_beeper_linkedin_bridge_presence: "{{ (matrix_synapse_presence_enabled if matrix_synapse_enabled else true) if matrix_homeserver_implementation == 'synapse' else true }}"

matrix_bridge_beeper_linkedin_database_hostname: "{{ postgres_connection_hostname if postgres_enabled else '' }}"
matrix_bridge_beeper_linkedin_database_password: "{{ (matrix_homeserver_generic_secret_key + ':maulinkedin.db') | hash('sha512') | to_uuid }}"

######################################################################
#
# /matrix-bridge-beeper-linkedin
#
######################################################################


######################################################################
#
# matrix-bridge-beeper-line
#
######################################################################

# We don't enable bridges by default.
matrix_bridge_beeper_line_enabled: false

matrix_bridge_beeper_line_systemd_required_services_list_auto: |
  {{
    matrix_addons_homeserver_systemd_services_list
    +
    ([postgres_identifier ~ '.service'] if (postgres_enabled and matrix_bridge_beeper_line_database_hostname == postgres_connection_hostname) else [])
  }}

matrix_bridge_beeper_line_container_image_registry_prefix_upstream: "{{ matrix_container_global_registry_prefix_override if matrix_container_global_registry_prefix_override else matrix_bridge_beeper_line_container_image_registry_prefix_upstream_default }}"

matrix_bridge_beeper_line_container_image_self_build: "{{ matrix_architecture not in ['amd64'] }}"

matrix_bridge_beeper_line_container_network: "{{ matrix_addons_container_network }}"

matrix_bridge_beeper_line_container_additional_networks_auto: |-
  {{
    (
      ([] if matrix_addons_homeserver_container_network == '' else [matrix_addons_homeserver_container_network])
      +
      ([postgres_container_network] if (postgres_enabled and matrix_bridge_beeper_line_database_hostname == postgres_connection_hostname and matrix_bridge_beeper_line_container_network != postgres_container_network) else [])
      +
      ([matrix_playbook_reverse_proxyable_services_additional_network] if (matrix_playbook_reverse_proxyable_services_additional_network and matrix_bridge_beeper_line_container_labels_traefik_enabled) else [])
    ) | unique
  }}

matrix_bridge_beeper_line_container_labels_traefik_enabled: "{{ matrix_playbook_reverse_proxy_type in ['playbook-managed-traefik', 'other-traefik-container'] }}"
matrix_bridge_beeper_line_container_labels_traefik_docker_network: "{{ matrix_playbook_reverse_proxyable_services_additional_network }}"
matrix_bridge_beeper_line_container_labels_traefik_entrypoints: "{{ traefik_entrypoint_primary }}"
matrix_bridge_beeper_line_container_labels_traefik_tls_certResolver: "{{ traefik_certResolver_primary }}"

matrix_bridge_beeper_line_appservice_token: "{{ (matrix_homeserver_generic_secret_key + ':line.as.token') | hash('sha512') | to_uuid }}"

matrix_bridge_beeper_line_homeserver_address: "{{ matrix_addons_homeserver_client_api_url }}"
matrix_bridge_beeper_line_homeserver_token: "{{ (matrix_homeserver_generic_secret_key + ':line.hs.token') | hash('sha512') | to_uuid }}"

matrix_bridge_beeper_line_homeserver_async_media: "{{ matrix_homeserver_implementation in ['synapse'] }}"

matrix_bridge_beeper_line_provisioning_shared_secret: "{{ (matrix_homeserver_generic_secret_key + ':line.prov') | hash('sha512') | to_uuid }}"

matrix_bridge_beeper_line_double_puppet_secrets_auto: |-
  {{
    ({
      matrix_bridge_beeper_line_homeserver_domain: ("as_token:" + matrix_appservice_double_puppet_registration_as_token)
    })
    if matrix_appservice_double_puppet_enabled
    else {}
  }}

matrix_bridge_beeper_line_scheme: "{{ 'https' if matrix_playbook_ssl_enabled else 'http' }}"
matrix_bridge_beeper_line_exposure_enabled: "{{ matrix_bridges_exposure_enabled }}"
matrix_bridge_beeper_line_exposure_hostname: "{{ matrix_bridges_exposure_hostname }}"
matrix_bridge_beeper_line_exposure_path_prefix: "{{ matrix_bridges_exposure_path_prefix }}/line"

matrix_bridge_beeper_line_database_engine: "{{ 'postgres' if postgres_enabled else 'sqlite' }}"
matrix_bridge_beeper_line_database_hostname: "{{ postgres_connection_hostname if postgres_enabled else '' }}"
matrix_bridge_beeper_line_database_password: "{{ (matrix_homeserver_generic_secret_key + ':line.db') | hash('sha512') | to_uuid }}"

######################################################################
#
# /matrix-bridge-beeper-line
#
######################################################################


######################################################################
#
# matrix-bridge-mautrix-bluesky
#
######################################################################

# We don't enable bridges by default.
matrix_bridge_mautrix_bluesky_enabled: false

matrix_bridge_mautrix_bluesky_systemd_required_services_list_auto: |
  {{
    matrix_addons_homeserver_systemd_services_list
    +
    ([postgres_identifier ~ '.service'] if (postgres_enabled and matrix_bridge_mautrix_bluesky_database_hostname == postgres_connection_hostname) else [])
  }}

matrix_bridge_mautrix_bluesky_container_image_registry_prefix_upstream: "{{ matrix_container_global_registry_prefix_override if matrix_container_global_registry_prefix_override else matrix_bridge_mautrix_bluesky_container_image_registry_prefix_upstream_default }}"

matrix_bridge_mautrix_bluesky_container_image_self_build: "{{ matrix_architecture not in ['amd64', 'arm64'] }}"

matrix_bridge_mautrix_bluesky_container_network: "{{ matrix_addons_container_network }}"

matrix_bridge_mautrix_bluesky_container_additional_networks_auto: |-
  {{
    (
      ([] if matrix_addons_homeserver_container_network == '' else [matrix_addons_homeserver_container_network])
      +
      ([postgres_container_network] if (postgres_enabled and matrix_bridge_mautrix_bluesky_database_hostname == postgres_connection_hostname and matrix_bridge_mautrix_bluesky_container_network != postgres_container_network) else [])
      +
      ([matrix_playbook_reverse_proxyable_services_additional_network] if matrix_playbook_reverse_proxyable_services_additional_network and matrix_bridge_mautrix_bluesky_container_labels_traefik_enabled else [])
    ) | unique
  }}

matrix_bridge_mautrix_bluesky_container_labels_traefik_enabled: "{{ matrix_playbook_reverse_proxy_type in ['playbook-managed-traefik', 'other-traefik-container'] }}"
matrix_bridge_mautrix_bluesky_container_labels_traefik_docker_network: "{{ matrix_playbook_reverse_proxyable_services_additional_network }}"
matrix_bridge_mautrix_bluesky_container_labels_traefik_entrypoints: "{{ traefik_entrypoint_primary }}"
matrix_bridge_mautrix_bluesky_container_labels_traefik_tls_certResolver: "{{ traefik_certResolver_primary }}"

matrix_bridge_mautrix_bluesky_appservice_token: "{{ (matrix_homeserver_generic_secret_key + ':bsky.as.token') | hash('sha512') | to_uuid }}"

matrix_bridge_mautrix_bluesky_homeserver_address: "{{ matrix_addons_homeserver_client_api_url }}"
matrix_bridge_mautrix_bluesky_homeserver_token: "{{ (matrix_homeserver_generic_secret_key + ':bsky.hs.token') | hash('sha512') | to_uuid }}"

matrix_bridge_mautrix_bluesky_homeserver_async_media: "{{ matrix_homeserver_implementation in ['synapse'] }}"

matrix_bridge_mautrix_bluesky_provisioning_shared_secret: "{{ (matrix_homeserver_generic_secret_key + ':mau.bsky.prov') | hash('sha512') | to_uuid }}"

matrix_bridge_mautrix_bluesky_double_puppet_secrets_auto: |-
  {{
    ({
      matrix_bridge_mautrix_bluesky_homeserver_domain: ("as_token:" + matrix_appservice_double_puppet_registration_as_token)
    })
    if matrix_appservice_double_puppet_enabled
    else {}
  }}

matrix_bridge_mautrix_bluesky_scheme: "{{ 'https' if matrix_playbook_ssl_enabled else 'http' }}"
matrix_bridge_mautrix_bluesky_exposure_enabled: "{{ matrix_bridges_exposure_enabled }}"
matrix_bridge_mautrix_bluesky_exposure_hostname: "{{ matrix_bridges_exposure_hostname }}"
matrix_bridge_mautrix_bluesky_exposure_path_prefix: "{{ matrix_bridges_exposure_path_prefix }}/bluesky"

matrix_bridge_mautrix_bluesky_database_hostname: "{{ postgres_connection_hostname if postgres_enabled else '' }}"
matrix_bridge_mautrix_bluesky_database_password: "{{ (matrix_homeserver_generic_secret_key + ':mau.twt.db') | hash('sha512') | to_uuid if postgres_enabled else '' }}"

######################################################################
#
# /matrix-bridge-mautrix-bluesky
#
######################################################################


######################################################################
#
# matrix-bridge-rustpush
#
######################################################################

# We don't enable bridges by default.
matrix_bridge_rustpush_enabled: false

matrix_bridge_rustpush_systemd_required_services_list_auto: |
  {{
    matrix_addons_homeserver_systemd_services_list
    +
    ([postgres_identifier ~ '.service'] if (postgres_enabled and matrix_bridge_rustpush_database_hostname == postgres_connection_hostname) else [])
  }}

matrix_bridge_rustpush_container_network: "{{ matrix_addons_container_network }}"

matrix_bridge_rustpush_container_additional_networks_auto: |-
  {{
    (
      ([] if matrix_addons_homeserver_container_network == '' else [matrix_addons_homeserver_container_network])
      +
      ([postgres_container_network] if (postgres_enabled and matrix_bridge_rustpush_database_hostname == postgres_connection_hostname and matrix_bridge_rustpush_container_network != postgres_container_network) else [])
      +
      ([matrix_playbook_reverse_proxyable_services_additional_network] if matrix_playbook_reverse_proxyable_services_additional_network and matrix_bridge_rustpush_container_labels_traefik_enabled else [])
    ) | unique
  }}

matrix_bridge_rustpush_container_labels_traefik_enabled: "{{ matrix_playbook_reverse_proxy_type in ['playbook-managed-traefik', 'other-traefik-container'] }}"
matrix_bridge_rustpush_container_labels_traefik_docker_network: "{{ matrix_playbook_reverse_proxyable_services_additional_network }}"
matrix_bridge_rustpush_container_labels_traefik_entrypoints: "{{ traefik_entrypoint_primary }}"
matrix_bridge_rustpush_container_labels_traefik_tls_certResolver: "{{ traefik_certResolver_primary }}"

matrix_bridge_rustpush_appservice_token: "{{ (matrix_homeserver_generic_secret_key + ':imsg.as.token') | hash('sha512') | to_uuid }}"

matrix_bridge_rustpush_homeserver_address: "{{ matrix_addons_homeserver_client_api_url }}"
matrix_bridge_rustpush_homeserver_token: "{{ (matrix_homeserver_generic_secret_key + ':imsg.hs.token') | hash('sha512') | to_uuid }}"

matrix_bridge_rustpush_homeserver_async_media: "{{ matrix_homeserver_implementation in ['synapse'] }}"

matrix_bridge_rustpush_provisioning_shared_secret: "{{ (matrix_homeserver_generic_secret_key + ':mau.imsg.prov') | hash('sha512') | to_uuid }}"

matrix_bridge_rustpush_exposure_enabled: "{{ matrix_bridges_exposure_enabled }}"
matrix_bridge_rustpush_exposure_hostname: "{{ matrix_bridges_exposure_hostname }}"
matrix_bridge_rustpush_exposure_path_prefix: "{{ matrix_bridges_exposure_path_prefix }}/imessage"

matrix_bridge_rustpush_double_puppet_secrets_auto: |-
  {{
    ({
      matrix_bridge_rustpush_homeserver_domain: ("as_token:" + matrix_appservice_double_puppet_registration_as_token)
    })
    if matrix_appservice_double_puppet_enabled
    else {}
  }}

matrix_bridge_rustpush_database_hostname: "{{ postgres_connection_hostname if postgres_enabled else '' }}"
matrix_bridge_rustpush_database_password: "{{ (matrix_homeserver_generic_secret_key + ':mau.imsg.db') | hash('sha512') | to_uuid if postgres_enabled else '' }}"

######################################################################
#
# /matrix-bridge-rustpush
#
######################################################################

######################################################################
#
# matrix-bridge-mautrix-discord
#
######################################################################

# We don't enable bridges by default.
matrix_bridge_mautrix_discord_enabled: false

matrix_bridge_mautrix_discord_container_image_registry_prefix_upstream: "{{ matrix_container_global_registry_prefix_override if matrix_container_global_registry_prefix_override else matrix_bridge_mautrix_discord_container_image_registry_prefix_upstream_default }}"

matrix_bridge_mautrix_discord_container_image_self_build: "{{ matrix_architecture not in ['arm64', 'amd64'] }}"

matrix_bridge_mautrix_discord_container_network: "{{ matrix_addons_container_network }}"

matrix_bridge_mautrix_discord_container_additional_networks_auto: |-
  {{
    (
      ([] if matrix_addons_homeserver_container_network == '' else [matrix_addons_homeserver_container_network])
      +
      ([postgres_container_network] if postgres_enabled and matrix_bridge_mautrix_discord_database_hostname == postgres_connection_hostname else [])
      +
      ([matrix_playbook_reverse_proxyable_services_additional_network] if (matrix_playbook_reverse_proxyable_services_additional_network and matrix_bridge_mautrix_discord_container_labels_traefik_enabled) else [])
    ) | unique
  }}

matrix_bridge_mautrix_discord_container_labels_traefik_enabled: "{{ matrix_playbook_reverse_proxy_type in ['playbook-managed-traefik', 'other-traefik-container'] }}"
matrix_bridge_mautrix_discord_container_labels_traefik_docker_network: "{{ matrix_playbook_reverse_proxyable_services_additional_network }}"
matrix_bridge_mautrix_discord_container_labels_traefik_entrypoints: "{{ traefik_entrypoint_primary }}"
matrix_bridge_mautrix_discord_container_labels_traefik_tls_certResolver: "{{ traefik_certResolver_primary }}"

matrix_bridge_mautrix_discord_systemd_required_services_list_auto: |
  {{
    matrix_addons_homeserver_systemd_services_list
    +
    ([postgres_identifier ~ '.service'] if (postgres_enabled and matrix_bridge_mautrix_discord_database_hostname == postgres_connection_hostname) else [])
  }}

matrix_bridge_mautrix_discord_appservice_token: "{{ (matrix_homeserver_generic_secret_key + ':maudisc.as.tok') | hash('sha512') | to_uuid }}"

matrix_bridge_mautrix_discord_homeserver_address: "{{ matrix_addons_homeserver_client_api_url }}"
matrix_bridge_mautrix_discord_homeserver_token: "{{ (matrix_homeserver_generic_secret_key + ':maudisc.hs.tok') | hash('sha512') | to_uuid }}"

matrix_bridge_mautrix_discord_homeserver_async_media: "{{ matrix_homeserver_implementation in ['synapse'] }}"

matrix_bridge_mautrix_discord_bridge_avatar_proxy_key: "{{ (matrix_homeserver_generic_secret_key + ':maudisc.avatar') | hash('sha512') | to_uuid }}"

matrix_bridge_mautrix_discord_hostname: "{{ matrix_server_fqn_matrix }}"
matrix_bridge_mautrix_discord_scheme: "{{ 'https' if matrix_playbook_ssl_enabled else 'http' }}"

matrix_bridge_mautrix_discord_bridge_login_shared_secret_map_auto: |-
  {{
    ({
      matrix_bridge_mautrix_discord_homeserver_domain: ("as_token:" + matrix_appservice_double_puppet_registration_as_token)
    })
    if matrix_appservice_double_puppet_enabled
    else (
      {matrix_bridge_mautrix_discord_homeserver_domain: matrix_synapse_ext_password_provider_shared_secret_auth_shared_secret}
      if matrix_synapse_ext_password_provider_shared_secret_auth_enabled
      else {}
    )
  }}

# Postgres is the default, except if not using internal Postgres server
matrix_bridge_mautrix_discord_database_engine: "{{ 'postgres' if postgres_enabled else 'sqlite' }}"
matrix_bridge_mautrix_discord_database_hostname: "{{ postgres_connection_hostname if postgres_enabled else '' }}"
matrix_bridge_mautrix_discord_database_password: "{{ (matrix_homeserver_generic_secret_key + ':maudiscord.db') | hash('sha512') | to_uuid }}"

######################################################################
#
# /matrix-bridge-mautrix-discord
#
######################################################################


######################################################################
#
# matrix-bridge-mautrix-slack
#
######################################################################

# We don't enable bridges by default.
matrix_bridge_mautrix_slack_enabled: false

matrix_bridge_mautrix_slack_systemd_required_services_list_auto: |
  {{
    matrix_addons_homeserver_systemd_services_list
    +
    ([postgres_identifier ~ '.service'] if (postgres_enabled and matrix_bridge_mautrix_slack_database_hostname == postgres_connection_hostname) else [])
  }}

matrix_bridge_mautrix_slack_container_image_registry_prefix_upstream: "{{ matrix_container_global_registry_prefix_override if matrix_container_global_registry_prefix_override else matrix_bridge_mautrix_slack_container_image_registry_prefix_upstream_default }}"

matrix_bridge_mautrix_slack_container_image_self_build: "{{ matrix_architecture not in ['arm64', 'amd64'] }}"

matrix_bridge_mautrix_slack_container_network: "{{ matrix_addons_container_network }}"

matrix_bridge_mautrix_slack_container_additional_networks_auto: |-
  {{
    (
      ([] if matrix_addons_homeserver_container_network == '' else [matrix_addons_homeserver_container_network])
      +
      ([postgres_container_network] if (postgres_enabled and matrix_bridge_mautrix_slack_database_hostname == postgres_connection_hostname and matrix_bridge_mautrix_slack_container_network != postgres_container_network) else [])
      +
      ([matrix_playbook_reverse_proxyable_services_additional_network] if matrix_playbook_reverse_proxyable_services_additional_network and matrix_bridge_mautrix_slack_container_labels_traefik_enabled else [])
    ) | unique
  }}

matrix_bridge_mautrix_slack_container_labels_traefik_enabled: "{{ matrix_playbook_reverse_proxy_type in ['playbook-managed-traefik', 'other-traefik-container'] }}"
matrix_bridge_mautrix_slack_container_labels_traefik_docker_network: "{{ matrix_playbook_reverse_proxyable_services_additional_network }}"
matrix_bridge_mautrix_slack_container_labels_traefik_entrypoints: "{{ traefik_entrypoint_primary }}"
matrix_bridge_mautrix_slack_container_labels_traefik_tls_certResolver: "{{ traefik_certResolver_primary }}"

matrix_bridge_mautrix_slack_appservice_token: "{{ (matrix_homeserver_generic_secret_key + ':mauslack.as.tok') | hash('sha512') | to_uuid }}"

matrix_bridge_mautrix_slack_homeserver_address: "{{ matrix_addons_homeserver_client_api_url }}"
matrix_bridge_mautrix_slack_homeserver_token: "{{ (matrix_homeserver_generic_secret_key + ':mauslack.hs.tok') | hash('sha512') | to_uuid }}"

matrix_bridge_mautrix_slack_homeserver_async_media: "{{ matrix_homeserver_implementation in ['synapse'] }}"

matrix_bridge_mautrix_slack_double_puppet_secrets_auto: |-
  {{
    {
      matrix_bridge_mautrix_slack_homeserver_domain: ("as_token:" + matrix_appservice_double_puppet_registration_as_token)
    }
    if matrix_appservice_double_puppet_enabled
    else {}
  }}

# Postgres is the default, except if not using internal Postgres server
matrix_bridge_mautrix_slack_database_engine: "{{ 'postgres' if postgres_enabled else 'sqlite' }}"
matrix_bridge_mautrix_slack_database_hostname: "{{ postgres_connection_hostname if postgres_enabled else '' }}"
matrix_bridge_mautrix_slack_database_password: "{{ (matrix_homeserver_generic_secret_key + ':mauslack.db') | hash('sha512') | to_uuid }}"

matrix_bridge_mautrix_slack_provisioning_shared_secret: "{{ (matrix_homeserver_generic_secret_key + ':mau.slack.prov') | hash('sha512') | to_uuid }}"
matrix_bridge_mautrix_slack_public_media_signing_key: "{{ (matrix_homeserver_generic_secret_key + ':mau.slack.pmed') | hash('sha512') | to_uuid }}"

matrix_bridge_mautrix_slack_scheme: "{{ 'https' if matrix_playbook_ssl_enabled else 'http' }}"
matrix_bridge_mautrix_slack_exposure_enabled: "{{ matrix_bridges_exposure_enabled }}"
matrix_bridge_mautrix_slack_exposure_hostname: "{{ matrix_bridges_exposure_hostname }}"
matrix_bridge_mautrix_slack_exposure_path_prefix: "{{ matrix_bridges_exposure_path_prefix }}/slack"

######################################################################
#
# /matrix-bridge-mautrix-slack
#
######################################################################

######################################################################
#
# matrix-bridge-mautrix-googlechat
#
######################################################################

# We don't enable bridges by default.
matrix_bridge_mautrix_googlechat_enabled: false

matrix_bridge_mautrix_googlechat_systemd_required_services_list_auto: |
  {{
    matrix_addons_homeserver_systemd_services_list
    +
    ([postgres_identifier ~ '.service'] if (postgres_enabled and matrix_bridge_mautrix_googlechat_database_hostname == postgres_connection_hostname) else [])
  }}

matrix_bridge_mautrix_googlechat_container_image_registry_prefix_upstream: "{{ matrix_container_global_registry_prefix_override if matrix_container_global_registry_prefix_override else matrix_bridge_mautrix_googlechat_container_image_registry_prefix_upstream_default }}"

matrix_bridge_mautrix_googlechat_container_image_self_build: "{{ matrix_architecture not in ['amd64', 'arm64'] }}"

matrix_bridge_mautrix_googlechat_container_http_host_bind_port: "{{ (matrix_playbook_service_host_bind_interface_prefix ~ '9007') if matrix_playbook_service_host_bind_interface_prefix else '' }}"

matrix_bridge_mautrix_googlechat_container_network: "{{ matrix_addons_container_network }}"

matrix_bridge_mautrix_googlechat_container_additional_networks_auto: |-
  {{
    (
      ([] if matrix_addons_homeserver_container_network == '' else [matrix_addons_homeserver_container_network])
      +
      ([postgres_container_network] if (postgres_enabled and matrix_bridge_mautrix_googlechat_database_hostname == postgres_connection_hostname and matrix_bridge_mautrix_googlechat_container_network != postgres_container_network) else [])
      +
      ([matrix_playbook_reverse_proxyable_services_additional_network] if (matrix_playbook_reverse_proxyable_services_additional_network and matrix_bridge_mautrix_gmessages_container_labels_traefik_enabled) else [])
    ) | unique
  }}

matrix_bridge_mautrix_googlechat_container_labels_traefik_enabled: "{{ matrix_playbook_reverse_proxy_type in ['playbook-managed-traefik', 'other-traefik-container'] }}"
matrix_bridge_mautrix_googlechat_container_labels_traefik_docker_network: "{{ matrix_playbook_reverse_proxyable_services_additional_network }}"
matrix_bridge_mautrix_googlechat_container_labels_traefik_entrypoints: "{{ traefik_entrypoint_primary }}"
matrix_bridge_mautrix_googlechat_container_labels_traefik_tls_certResolver: "{{ traefik_certResolver_primary }}"

matrix_bridge_mautrix_googlechat_container_labels_public_endpoint_hostname: "{{ matrix_server_fqn_matrix }}"

matrix_bridge_mautrix_googlechat_container_labels_metrics_middleware_basic_auth_enabled: "{{ matrix_metrics_exposure_http_basic_auth_enabled }}"
matrix_bridge_mautrix_googlechat_container_labels_metrics_middleware_basic_auth_users: "{{ matrix_metrics_exposure_http_basic_auth_users }}"

matrix_bridge_mautrix_googlechat_appservice_token: "{{ (matrix_homeserver_generic_secret_key + ':gc.as.token') | hash('sha512') | to_uuid }}"

matrix_bridge_mautrix_googlechat_homeserver_address: "{{ matrix_addons_homeserver_client_api_url }}"
matrix_bridge_mautrix_googlechat_homeserver_token: "{{ (matrix_homeserver_generic_secret_key + ':gc.hs.token') | hash('sha512') | to_uuid }}"

matrix_bridge_mautrix_googlechat_login_shared_secret: |-
  {{
    ("as_token:" + matrix_appservice_double_puppet_registration_as_token)
    if matrix_appservice_double_puppet_enabled
    else (
      matrix_synapse_ext_password_provider_shared_secret_auth_shared_secret if matrix_synapse_ext_password_provider_shared_secret_auth_enabled
      if matrix_synapse_ext_password_provider_shared_secret_auth_enabled
      else ""
    )
  }}

matrix_bridge_mautrix_googlechat_metrics_enabled: "{{ prometheus_enabled or matrix_metrics_exposure_enabled }}"

matrix_bridge_mautrix_googlechat_metrics_proxying_enabled: "{{ matrix_bridge_mautrix_googlechat_metrics_enabled and matrix_metrics_exposure_enabled }}"
matrix_bridge_mautrix_googlechat_metrics_proxying_hostname: "{{ matrix_metrics_exposure_hostname }}"
matrix_bridge_mautrix_googlechat_metrics_proxying_path_prefix: "{{ matrix_metrics_exposure_path_prefix }}/mautrix-googlechat"

# Postgres is the default, except if not using internal Postgres server
matrix_bridge_mautrix_googlechat_database_engine: "{{ 'postgres' if postgres_enabled else 'sqlite' }}"
matrix_bridge_mautrix_googlechat_database_hostname: "{{ postgres_connection_hostname if postgres_enabled else '' }}"
matrix_bridge_mautrix_googlechat_database_password: "{{ (matrix_homeserver_generic_secret_key + ':mau.gc.db') | hash('sha512') | to_uuid }}"

######################################################################
#
# /matrix-bridge-mautrix-googlechat
#
######################################################################

######################################################################
#
# matrix-bridge-mautrix-signal
#
######################################################################

# We don't enable bridges by default.
matrix_bridge_mautrix_signal_enabled: false

matrix_bridge_mautrix_signal_systemd_required_services_list_auto: |
  {{
    matrix_addons_homeserver_systemd_services_list
    +
    ([postgres_identifier ~ '.service'] if (postgres_enabled and matrix_bridge_mautrix_signal_database_hostname == postgres_connection_hostname) else [])
  }}

matrix_bridge_mautrix_signal_container_image_registry_prefix_upstream: "{{ matrix_container_global_registry_prefix_override if matrix_container_global_registry_prefix_override else matrix_bridge_mautrix_signal_container_image_registry_prefix_upstream_default }}"

matrix_bridge_mautrix_signal_container_image_self_build: "{{ matrix_architecture not in ['arm64', 'amd64'] }}"

matrix_bridge_mautrix_signal_container_network: "{{ matrix_addons_container_network }}"

matrix_bridge_mautrix_signal_container_additional_networks_auto: |-
  {{
    (
      ([] if matrix_addons_homeserver_container_network == '' else [matrix_addons_homeserver_container_network])
      +
      ([postgres_container_network] if (postgres_enabled and matrix_bridge_mautrix_signal_database_hostname == postgres_connection_hostname and matrix_bridge_mautrix_signal_container_network != postgres_container_network) else [])
      +
      ([matrix_playbook_reverse_proxyable_services_additional_network] if matrix_playbook_reverse_proxyable_services_additional_network and matrix_bridge_mautrix_signal_container_labels_traefik_enabled else [])
    ) | unique
  }}

matrix_bridge_mautrix_signal_container_labels_traefik_enabled: "{{ matrix_playbook_reverse_proxy_type in ['playbook-managed-traefik', 'other-traefik-container'] }}"
matrix_bridge_mautrix_signal_container_labels_traefik_docker_network: "{{ matrix_playbook_reverse_proxyable_services_additional_network }}"
matrix_bridge_mautrix_signal_container_labels_traefik_entrypoints: "{{ traefik_entrypoint_primary }}"
matrix_bridge_mautrix_signal_container_labels_traefik_tls_certResolver: "{{ traefik_certResolver_primary }}"

matrix_bridge_mautrix_signal_homeserver_domain: '{{ matrix_domain }}'
matrix_bridge_mautrix_signal_homeserver_address: "{{ matrix_addons_homeserver_client_api_url }}"
matrix_bridge_mautrix_signal_homeserver_token: "{{ (matrix_homeserver_generic_secret_key + ':si.hs.token') | hash('sha512') | to_uuid }}"

matrix_bridge_mautrix_signal_homeserver_async_media: "{{ matrix_homeserver_implementation in ['synapse'] }}"

matrix_bridge_mautrix_signal_appservice_token: "{{ (matrix_homeserver_generic_secret_key + ':si.as.token') | hash('sha512') | to_uuid }}"

matrix_bridge_mautrix_signal_double_puppet_secrets_auto: |-
  {{
    {
      matrix_bridge_mautrix_signal_homeserver_domain: ("as_token:" + matrix_appservice_double_puppet_registration_as_token)
    }
    if matrix_appservice_double_puppet_enabled
    else {}
  }}

matrix_bridge_mautrix_signal_scheme: "{{ 'https' if matrix_playbook_ssl_enabled else 'http' }}"
matrix_bridge_mautrix_signal_exposure_enabled: "{{ matrix_bridges_exposure_enabled }}"
matrix_bridge_mautrix_signal_exposure_hostname: "{{ matrix_bridges_exposure_hostname }}"
matrix_bridge_mautrix_signal_exposure_path_prefix: "{{ matrix_bridges_exposure_path_prefix }}/signal"

matrix_bridge_mautrix_signal_database_engine: "{{ 'postgres' if postgres_enabled else 'sqlite' }}"
matrix_bridge_mautrix_signal_database_hostname: "{{ postgres_connection_hostname if postgres_enabled else '' }}"
matrix_bridge_mautrix_signal_database_password: "{{ (matrix_homeserver_generic_secret_key + ':mau.signal.db') | hash('sha512') | to_uuid }}"

matrix_bridge_mautrix_signal_provisioning_shared_secret: "{{ (matrix_homeserver_generic_secret_key + ':mau.signal.prov') | hash('sha512') | to_uuid }}"
matrix_bridge_mautrix_signal_public_media_signing_key: "{{ (matrix_homeserver_generic_secret_key + ':mau.signal.pmed') | hash('sha512') | to_uuid }}"

######################################################################
#
# /matrix-bridge-mautrix-signal
#
######################################################################


######################################################################
#
# matrix-bridge-mautrix-meta-messenger
#
######################################################################

# We don't enable bridges by default.
matrix_bridge_mautrix_meta_messenger_enabled: false

matrix_bridge_mautrix_meta_messenger_systemd_required_services_list_auto: |
  {{
    matrix_addons_homeserver_systemd_services_list
    +
    ([postgres_identifier ~ '.service'] if (postgres_enabled and matrix_bridge_mautrix_meta_messenger_database_hostname == postgres_connection_hostname) else [])
  }}

matrix_bridge_mautrix_meta_messenger_container_image_registry_prefix_upstream: "{{ matrix_container_global_registry_prefix_override if matrix_container_global_registry_prefix_override else matrix_bridge_mautrix_meta_messenger_container_image_registry_prefix_upstream_default }}"

matrix_bridge_mautrix_meta_messenger_container_image_self_build: "{{ matrix_architecture not in ['amd64', 'arm64'] }}"

matrix_bridge_mautrix_meta_messenger_container_network: "{{ matrix_addons_container_network }}"

matrix_bridge_mautrix_meta_messenger_container_additional_networks_auto: |-
  {{
    (
      ([] if matrix_addons_homeserver_container_network == '' else [matrix_addons_homeserver_container_network])
      +
      ([postgres_container_network] if (postgres_enabled and matrix_bridge_mautrix_meta_messenger_database_hostname == postgres_connection_hostname and matrix_bridge_mautrix_meta_messenger_container_network != postgres_container_network) else [])
      +
      ([matrix_playbook_reverse_proxyable_services_additional_network] if (matrix_playbook_reverse_proxyable_services_additional_network and matrix_bridge_mautrix_meta_messenger_container_labels_traefik_enabled) else [])
    ) | unique
  }}

matrix_bridge_mautrix_meta_messenger_container_labels_traefik_enabled: "{{ matrix_playbook_reverse_proxy_type in ['playbook-managed-traefik', 'other-traefik-container'] }}"
matrix_bridge_mautrix_meta_messenger_container_labels_traefik_docker_network: "{{ matrix_playbook_reverse_proxyable_services_additional_network }}"
matrix_bridge_mautrix_meta_messenger_container_labels_traefik_entrypoints: "{{ traefik_entrypoint_primary }}"
matrix_bridge_mautrix_meta_messenger_container_labels_traefik_tls_certResolver: "{{ traefik_certResolver_primary }}"

matrix_bridge_mautrix_meta_messenger_appservice_token: "{{ (matrix_homeserver_generic_secret_key + ':mau.meta.fb.as') | hash('sha512') | to_uuid }}"

matrix_bridge_mautrix_meta_messenger_homeserver_address: "{{ matrix_addons_homeserver_client_api_url }}"

matrix_bridge_mautrix_meta_messenger_homeserver_token: "{{ (matrix_homeserver_generic_secret_key + ':mau.meta.fb.hs') | hash('sha512') | to_uuid }}"
matrix_bridge_mautrix_meta_messenger_provisioning_shared_secret: "{{ (matrix_homeserver_generic_secret_key + ':mau.meta.fb.prov') | hash('sha512') | to_uuid }}"

matrix_bridge_mautrix_meta_messenger_homeserver_async_media: "{{ matrix_homeserver_implementation in ['synapse'] }}"

matrix_bridge_mautrix_meta_messenger_double_puppet_secrets_auto: |-
  {{
    {
      matrix_bridge_mautrix_meta_messenger_homeserver_domain: ("as_token:" + matrix_appservice_double_puppet_registration_as_token)
    }
    if matrix_appservice_double_puppet_enabled
    else {}
  }}

matrix_bridge_mautrix_meta_messenger_scheme: "{{ 'https' if matrix_playbook_ssl_enabled else 'http' }}"
matrix_bridge_mautrix_meta_messenger_exposure_enabled: "{{ matrix_bridges_exposure_enabled }}"
matrix_bridge_mautrix_meta_messenger_exposure_hostname: "{{ matrix_bridges_exposure_hostname }}"
matrix_bridge_mautrix_meta_messenger_exposure_path_prefix: "{{ matrix_bridges_exposure_path_prefix }}/meta-messenger"

# We'd like to force-set people with external Postgres to SQLite, so the bridge role can complain
# and point them to a migration path.
matrix_bridge_mautrix_meta_messenger_database_engine: "{{ 'postgres' if postgres_enabled else 'sqlite3-fk-wal' }}"
matrix_bridge_mautrix_meta_messenger_database_hostname: "{{ postgres_connection_hostname if (postgres_enabled and matrix_bridge_mautrix_meta_messenger_database_engine == 'postgres') else '' }}"
matrix_bridge_mautrix_meta_messenger_database_password: "{{ ((matrix_homeserver_generic_secret_key + ':mau.fb.db') | hash('sha512') | to_uuid) if (postgres_enabled and matrix_bridge_mautrix_meta_messenger_database_engine == 'postgres') else '' }}"

######################################################################
#
# /matrix-bridge-mautrix-meta-messenger
#
######################################################################



######################################################################
#
# matrix-bridge-mautrix-meta-instagram
#
######################################################################

# We don't enable bridges by default.
matrix_bridge_mautrix_meta_instagram_enabled: false

matrix_bridge_mautrix_meta_instagram_systemd_required_services_list_auto: |
  {{
    matrix_addons_homeserver_systemd_services_list
    +
    ([postgres_identifier ~ '.service'] if (postgres_enabled and matrix_bridge_mautrix_meta_instagram_database_hostname == postgres_connection_hostname) else [])
  }}

matrix_bridge_mautrix_meta_instagram_container_image_registry_prefix_upstream: "{{ matrix_container_global_registry_prefix_override if matrix_container_global_registry_prefix_override else matrix_bridge_mautrix_meta_instagram_container_image_registry_prefix_upstream_default }}"

matrix_bridge_mautrix_meta_instagram_container_image_self_build: "{{ matrix_architecture not in ['amd64', 'arm64'] }}"

matrix_bridge_mautrix_meta_instagram_container_network: "{{ matrix_addons_container_network }}"

matrix_bridge_mautrix_meta_instagram_container_additional_networks_auto: |-
  {{
    (
      ([] if matrix_addons_homeserver_container_network == '' else [matrix_addons_homeserver_container_network])
      +
      ([postgres_container_network] if (postgres_enabled and matrix_bridge_mautrix_meta_instagram_database_hostname == postgres_connection_hostname and matrix_bridge_mautrix_meta_instagram_container_network != postgres_container_network) else [])
      +
      ([matrix_playbook_reverse_proxyable_services_additional_network] if (matrix_playbook_reverse_proxyable_services_additional_network and matrix_bridge_mautrix_meta_instagram_container_labels_traefik_enabled) else [])
    ) | unique
  }}

matrix_bridge_mautrix_meta_instagram_container_labels_traefik_enabled: "{{ matrix_playbook_reverse_proxy_type in ['playbook-managed-traefik', 'other-traefik-container'] }}"
matrix_bridge_mautrix_meta_instagram_container_labels_traefik_docker_network: "{{ matrix_playbook_reverse_proxyable_services_additional_network }}"
matrix_bridge_mautrix_meta_instagram_container_labels_traefik_entrypoints: "{{ traefik_entrypoint_primary }}"
matrix_bridge_mautrix_meta_instagram_container_labels_traefik_tls_certResolver: "{{ traefik_certResolver_primary }}"

matrix_bridge_mautrix_meta_instagram_appservice_token: "{{ (matrix_homeserver_generic_secret_key + ':mau.meta.ig.as') | hash('sha512') | to_uuid }}"

matrix_bridge_mautrix_meta_instagram_homeserver_address: "{{ matrix_addons_homeserver_client_api_url }}"

matrix_bridge_mautrix_meta_instagram_homeserver_token: "{{ (matrix_homeserver_generic_secret_key + ':mau.meta.ig.hs') | hash('sha512') | to_uuid }}"
matrix_bridge_mautrix_meta_instagram_provisioning_shared_secret: "{{ (matrix_homeserver_generic_secret_key + ':mau.meta.ig.prov') | hash('sha512') | to_uuid }}"

matrix_bridge_mautrix_meta_instagram_homeserver_async_media: "{{ matrix_homeserver_implementation in ['synapse'] }}"

matrix_bridge_mautrix_meta_instagram_double_puppet_secrets_auto: |-
  {{
    {
      matrix_bridge_mautrix_meta_instagram_homeserver_domain: ("as_token:" + matrix_appservice_double_puppet_registration_as_token)
    }
    if matrix_appservice_double_puppet_enabled
    else {}
  }}

matrix_bridge_mautrix_meta_instagram_scheme: "{{ 'https' if matrix_playbook_ssl_enabled else 'http' }}"
matrix_bridge_mautrix_meta_instagram_exposure_enabled: "{{ matrix_bridges_exposure_enabled }}"
matrix_bridge_mautrix_meta_instagram_exposure_hostname: "{{ matrix_bridges_exposure_hostname }}"
matrix_bridge_mautrix_meta_instagram_exposure_path_prefix: "{{ matrix_bridges_exposure_path_prefix }}/meta-instagram"

# We'd like to force-set people with external Postgres to SQLite, so the bridge role can complain
# and point them to a migration path.
matrix_bridge_mautrix_meta_instagram_database_engine: "{{ 'postgres' if postgres_enabled else 'sqlite3-fk-wal' }}"
matrix_bridge_mautrix_meta_instagram_database_hostname: "{{ postgres_connection_hostname if (postgres_enabled and matrix_bridge_mautrix_meta_instagram_database_engine == 'postgres') else '' }}"
matrix_bridge_mautrix_meta_instagram_database_password: "{{ ((matrix_homeserver_generic_secret_key + ':mau.fb.db') | hash('sha512') | to_uuid) if (postgres_enabled and matrix_bridge_mautrix_meta_instagram_database_engine == 'postgres') else '' }}"

######################################################################
#
# /matrix-bridge-mautrix-meta-instagram
#
######################################################################


######################################################################
#
# matrix-bridge-mautrix-telegram
#
######################################################################

# We don't enable bridges by default.
matrix_bridge_mautrix_telegram_enabled: false

matrix_bridge_mautrix_telegram_systemd_required_services_list_auto: |
  {{
    matrix_addons_homeserver_systemd_services_list
    +
    ([postgres_identifier ~ '.service'] if (postgres_enabled and matrix_bridge_mautrix_telegram_database_hostname == postgres_connection_hostname) else [])
  }}

matrix_bridge_mautrix_telegram_container_image_registry_prefix_upstream: "{{ matrix_container_global_registry_prefix_override if matrix_container_global_registry_prefix_override else matrix_bridge_mautrix_telegram_container_image_registry_prefix_upstream_default }}"

matrix_bridge_mautrix_telegram_container_image_self_build: "{{ matrix_architecture not in ['arm64', 'amd64'] }}"

matrix_bridge_mautrix_telegram_container_network: "{{ matrix_addons_container_network }}"

matrix_bridge_mautrix_telegram_container_additional_networks_auto: |-
  {{
    (
      ([] if matrix_addons_homeserver_container_network == '' else [matrix_addons_homeserver_container_network])
      +
      ([postgres_container_network] if (postgres_enabled and matrix_bridge_mautrix_telegram_database_hostname == postgres_connection_hostname and matrix_bridge_mautrix_telegram_container_network != postgres_container_network) else [])
      +
      ([matrix_playbook_reverse_proxyable_services_additional_network] if (matrix_playbook_reverse_proxyable_services_additional_network and matrix_bridge_mautrix_telegram_container_labels_traefik_enabled) else [])
    ) | unique
  }}

matrix_bridge_mautrix_telegram_container_labels_traefik_enabled: "{{ matrix_playbook_reverse_proxy_type in ['playbook-managed-traefik', 'other-traefik-container'] }}"
matrix_bridge_mautrix_telegram_container_labels_traefik_docker_network: "{{ matrix_playbook_reverse_proxyable_services_additional_network }}"
matrix_bridge_mautrix_telegram_container_labels_traefik_entrypoints: "{{ traefik_entrypoint_primary }}"
matrix_bridge_mautrix_telegram_container_labels_traefik_tls_certResolver: "{{ traefik_certResolver_primary }}"

matrix_bridge_mautrix_telegram_appservice_token: "{{ (matrix_homeserver_generic_secret_key + ':telegr.as.token') | hash('sha512') | to_uuid }}"

matrix_bridge_mautrix_telegram_homeserver_domain: "{{ matrix_domain }}"
matrix_bridge_mautrix_telegram_homeserver_address: "{{ matrix_addons_homeserver_client_api_url }}"
matrix_bridge_mautrix_telegram_homeserver_token: "{{ (matrix_homeserver_generic_secret_key + ':telegr.hs.token') | hash('sha512') | to_uuid }}"

matrix_bridge_mautrix_telegram_homeserver_async_media: "{{ matrix_homeserver_implementation in ['synapse'] }}"

matrix_bridge_mautrix_telegram_provisioning_shared_secret: "{{ (matrix_homeserver_generic_secret_key + ':mau.telegram.prov') | hash('sha512') | to_uuid }}"

matrix_bridge_mautrix_telegram_double_puppet_secrets_auto: |-
  {{
    {
      matrix_bridge_mautrix_telegram_homeserver_domain: ("as_token:" + matrix_appservice_double_puppet_registration_as_token)
    }
    if matrix_appservice_double_puppet_enabled
    else {}
  }}

matrix_bridge_mautrix_telegram_scheme: "{{ 'https' if matrix_playbook_ssl_enabled else 'http' }}"
matrix_bridge_mautrix_telegram_exposure_enabled: "{{ matrix_bridges_exposure_enabled }}"
matrix_bridge_mautrix_telegram_exposure_hostname: "{{ matrix_bridges_exposure_hostname }}"
matrix_bridge_mautrix_telegram_exposure_path_prefix: "{{ matrix_bridges_exposure_path_prefix }}/telegram"

# Postgres is the default, except if not using internal Postgres server
matrix_bridge_mautrix_telegram_database_engine: "{{ 'postgres' if postgres_enabled else 'sqlite' }}"
matrix_bridge_mautrix_telegram_database_hostname: "{{ postgres_connection_hostname if postgres_enabled else '' }}"
matrix_bridge_mautrix_telegram_database_password: "{{ (matrix_homeserver_generic_secret_key + ':mau.telegram.db') | hash('sha512') | to_uuid }}"

######################################################################
#
# /matrix-bridge-mautrix-telegram
#
######################################################################

######################################################################
#
# matrix-bridge-mautrix-twitter
#
######################################################################

# We don't enable bridges by default.
matrix_bridge_mautrix_twitter_enabled: false

matrix_bridge_mautrix_twitter_systemd_required_services_list_auto: |
  {{
    matrix_addons_homeserver_systemd_services_list
    +
    ([postgres_identifier ~ '.service'] if (postgres_enabled and matrix_bridge_mautrix_twitter_database_hostname == postgres_connection_hostname) else [])
  }}

matrix_bridge_mautrix_twitter_container_image_registry_prefix_upstream: "{{ matrix_container_global_registry_prefix_override if matrix_container_global_registry_prefix_override else matrix_bridge_mautrix_twitter_container_image_registry_prefix_upstream_default }}"

matrix_bridge_mautrix_twitter_container_image_self_build: "{{ matrix_architecture not in ['amd64', 'arm64'] }}"

matrix_bridge_mautrix_twitter_container_network: "{{ matrix_addons_container_network }}"

matrix_bridge_mautrix_twitter_container_additional_networks_auto: |-
  {{
    (
      ([] if matrix_addons_homeserver_container_network == '' else [matrix_addons_homeserver_container_network])
      +
      ([postgres_container_network] if (postgres_enabled and matrix_bridge_mautrix_twitter_database_hostname == postgres_connection_hostname and matrix_bridge_mautrix_twitter_container_network != postgres_container_network) else [])
      +
      ([matrix_playbook_reverse_proxyable_services_additional_network] if matrix_playbook_reverse_proxyable_services_additional_network and matrix_bridge_mautrix_twitter_container_labels_traefik_enabled else [])
    ) | unique
  }}

matrix_bridge_mautrix_twitter_container_labels_traefik_enabled: "{{ matrix_playbook_reverse_proxy_type in ['playbook-managed-traefik', 'other-traefik-container'] }}"
matrix_bridge_mautrix_twitter_container_labels_traefik_docker_network: "{{ matrix_playbook_reverse_proxyable_services_additional_network }}"
matrix_bridge_mautrix_twitter_container_labels_traefik_entrypoints: "{{ traefik_entrypoint_primary }}"
matrix_bridge_mautrix_twitter_container_labels_traefik_tls_certResolver: "{{ traefik_certResolver_primary }}"

matrix_bridge_mautrix_twitter_appservice_token: "{{ (matrix_homeserver_generic_secret_key + ':twt.as.token') | hash('sha512') | to_uuid }}"

matrix_bridge_mautrix_twitter_homeserver_address: "{{ matrix_addons_homeserver_client_api_url }}"
matrix_bridge_mautrix_twitter_homeserver_token: "{{ (matrix_homeserver_generic_secret_key + ':twt.hs.token') | hash('sha512') | to_uuid }}"

matrix_bridge_mautrix_twitter_homeserver_async_media: "{{ matrix_homeserver_implementation in ['synapse'] }}"

matrix_bridge_mautrix_twitter_provisioning_shared_secret: "{{ (matrix_homeserver_generic_secret_key + ':mau.twit.prov') | hash('sha512') | to_uuid }}"

matrix_bridge_mautrix_twitter_double_puppet_secrets_auto: |-
  {{
    ({
      matrix_bridge_mautrix_twitter_homeserver_domain: ("as_token:" + matrix_appservice_double_puppet_registration_as_token)
    })
    if matrix_appservice_double_puppet_enabled
    else {}
  }}

matrix_bridge_mautrix_twitter_scheme: "{{ 'https' if matrix_playbook_ssl_enabled else 'http' }}"
matrix_bridge_mautrix_twitter_exposure_enabled: "{{ matrix_bridges_exposure_enabled }}"
matrix_bridge_mautrix_twitter_exposure_hostname: "{{ matrix_bridges_exposure_hostname }}"
matrix_bridge_mautrix_twitter_exposure_path_prefix: "{{ matrix_bridges_exposure_path_prefix }}/twitter"

matrix_bridge_mautrix_twitter_database_hostname: "{{ postgres_connection_hostname if postgres_enabled else '' }}"
matrix_bridge_mautrix_twitter_database_password: "{{ (matrix_homeserver_generic_secret_key + ':mau.twt.db') | hash('sha512') | to_uuid if postgres_enabled else '' }}"

######################################################################
#
# /matrix-bridge-mautrix-twitter
#
######################################################################

######################################################################
#
# matrix-bridge-mautrix-gmessages
#
######################################################################

# We don't enable bridges by default.
matrix_bridge_mautrix_gmessages_enabled: false

matrix_bridge_mautrix_gmessages_systemd_required_services_list_auto: |
  {{
    matrix_addons_homeserver_systemd_services_list
    +
    ([postgres_identifier ~ '.service'] if (postgres_enabled and matrix_bridge_mautrix_gmessages_database_hostname == postgres_connection_hostname) else [])
  }}

matrix_bridge_mautrix_gmessages_container_image_registry_prefix_upstream: "{{ matrix_container_global_registry_prefix_override if matrix_container_global_registry_prefix_override else matrix_bridge_mautrix_gmessages_container_image_registry_prefix_upstream_default }}"

matrix_bridge_mautrix_gmessages_container_image_self_build: "{{ matrix_architecture not in ['arm64', 'amd64'] }}"

matrix_bridge_mautrix_gmessages_container_network: "{{ matrix_addons_container_network }}"

matrix_bridge_mautrix_gmessages_container_additional_networks_auto: |-
  {{
    (
      ([] if matrix_addons_homeserver_container_network == '' else [matrix_addons_homeserver_container_network])
      +
      ([postgres_container_network] if (postgres_enabled and matrix_bridge_mautrix_gmessages_database_hostname == postgres_connection_hostname and matrix_bridge_mautrix_gmessages_container_network != postgres_container_network) else [])
      +
      ([matrix_playbook_reverse_proxyable_services_additional_network] if (matrix_playbook_reverse_proxyable_services_additional_network and matrix_bridge_mautrix_gmessages_container_labels_traefik_enabled) else [])
    ) | unique
  }}

matrix_bridge_mautrix_gmessages_container_labels_traefik_enabled: "{{ matrix_playbook_reverse_proxy_type in ['playbook-managed-traefik', 'other-traefik-container'] }}"
matrix_bridge_mautrix_gmessages_container_labels_traefik_docker_network: "{{ matrix_playbook_reverse_proxyable_services_additional_network }}"
matrix_bridge_mautrix_gmessages_container_labels_traefik_entrypoints: "{{ traefik_entrypoint_primary }}"
matrix_bridge_mautrix_gmessages_container_labels_traefik_tls_certResolver: "{{ traefik_certResolver_primary }}"

matrix_bridge_mautrix_gmessages_appservice_token: "{{ (matrix_homeserver_generic_secret_key + ':gmessa.as.token') | hash('sha512') | to_uuid }}"

matrix_bridge_mautrix_gmessages_homeserver_address: "{{ matrix_addons_homeserver_client_api_url }}"
matrix_bridge_mautrix_gmessages_homeserver_token: "{{ (matrix_homeserver_generic_secret_key + ':gmessa.hs.token') | hash('sha512') | to_uuid }}"

matrix_bridge_mautrix_gmessages_provisioning_shared_secret: "{{ (matrix_homeserver_generic_secret_key + ':gmessa.prov') | hash('sha512') | to_uuid }}"

matrix_bridge_mautrix_gmessages_homeserver_async_media: "{{ matrix_homeserver_implementation in ['synapse'] }}"

matrix_bridge_mautrix_gmessages_double_puppet_secrets_auto: |-
  {{
    {
      matrix_bridge_mautrix_gmessages_homeserver_domain: ("as_token:" + matrix_appservice_double_puppet_registration_as_token)
    }
    if matrix_appservice_double_puppet_enabled
    else {}
  }}

matrix_bridge_mautrix_gmessages_scheme: "{{ 'https' if matrix_playbook_ssl_enabled else 'http' }}"
matrix_bridge_mautrix_gmessages_exposure_enabled: "{{ matrix_bridges_exposure_enabled }}"
matrix_bridge_mautrix_gmessages_exposure_hostname: "{{ matrix_bridges_exposure_hostname }}"
matrix_bridge_mautrix_gmessages_exposure_path_prefix: "{{ matrix_bridges_exposure_path_prefix }}/gmessages"

# Postgres is the default, except if not using internal Postgres server
matrix_bridge_mautrix_gmessages_database_engine: "{{ 'postgres' if postgres_enabled else 'sqlite' }}"
matrix_bridge_mautrix_gmessages_database_hostname: "{{ postgres_connection_hostname if postgres_enabled else '' }}"
matrix_bridge_mautrix_gmessages_database_password: "{{ (matrix_homeserver_generic_secret_key + ':maugmessages.db') | hash('sha512') | to_uuid }}"

######################################################################
#
# /matrix-bridge-mautrix-gmessages
#
######################################################################

######################################################################
#
# matrix-bridge-mautrix-gvoice
#
######################################################################

# We don't enable bridges by default.
matrix_bridge_mautrix_gvoice_enabled: false

matrix_bridge_mautrix_gvoice_systemd_required_services_list_auto: |
  {{
    matrix_addons_homeserver_systemd_services_list
    +
    ([postgres_identifier ~ '.service'] if (postgres_enabled and matrix_bridge_mautrix_gvoice_database_hostname == postgres_connection_hostname) else [])
  }}

matrix_bridge_mautrix_gvoice_container_image_registry_prefix_upstream: "{{ matrix_container_global_registry_prefix_override if matrix_container_global_registry_prefix_override else matrix_bridge_mautrix_gvoice_container_image_registry_prefix_upstream_default }}"

matrix_bridge_mautrix_gvoice_container_image_self_build: "{{ matrix_architecture not in ['arm64', 'amd64'] }}"

matrix_bridge_mautrix_gvoice_container_network: "{{ matrix_addons_container_network }}"

matrix_bridge_mautrix_gvoice_container_additional_networks_auto: |-
  {{
    (
      ([] if matrix_addons_homeserver_container_network == '' else [matrix_addons_homeserver_container_network])
      +
      ([postgres_container_network] if (postgres_enabled and matrix_bridge_mautrix_gvoice_database_hostname == postgres_connection_hostname and matrix_bridge_mautrix_gvoice_container_network != postgres_container_network) else [])
      +
      ([matrix_playbook_reverse_proxyable_services_additional_network] if (matrix_playbook_reverse_proxyable_services_additional_network and matrix_bridge_mautrix_gvoice_container_labels_traefik_enabled) else [])
    ) | unique
  }}

matrix_bridge_mautrix_gvoice_container_labels_traefik_enabled: "{{ matrix_playbook_reverse_proxy_type in ['playbook-managed-traefik', 'other-traefik-container'] }}"
matrix_bridge_mautrix_gvoice_container_labels_traefik_docker_network: "{{ matrix_playbook_reverse_proxyable_services_additional_network }}"
matrix_bridge_mautrix_gvoice_container_labels_traefik_entrypoints: "{{ traefik_entrypoint_primary }}"
matrix_bridge_mautrix_gvoice_container_labels_traefik_tls_certResolver: "{{ traefik_certResolver_primary }}"

matrix_bridge_mautrix_gvoice_appservice_token: "{{ (matrix_homeserver_generic_secret_key + ':gvoice.as.token') | hash('sha512') | to_uuid }}"

matrix_bridge_mautrix_gvoice_homeserver_address: "{{ matrix_addons_homeserver_client_api_url }}"
matrix_bridge_mautrix_gvoice_homeserver_token: "{{ (matrix_homeserver_generic_secret_key + ':gvoice.hs.token') | hash('sha512') | to_uuid }}"

matrix_bridge_mautrix_gvoice_provisioning_shared_secret: "{{ (matrix_homeserver_generic_secret_key + ':gvoice.prov') | hash('sha512') | to_uuid }}"

matrix_bridge_mautrix_gvoice_homeserver_async_media: "{{ matrix_homeserver_implementation in ['synapse'] }}"

matrix_bridge_mautrix_gvoice_double_puppet_secrets_auto: |-
  {{
    {
      matrix_bridge_mautrix_gvoice_homeserver_domain: ("as_token:" + matrix_appservice_double_puppet_registration_as_token)
    }
    if matrix_appservice_double_puppet_enabled
    else {}
  }}

matrix_bridge_mautrix_gvoice_scheme: "{{ 'https' if matrix_playbook_ssl_enabled else 'http' }}"
matrix_bridge_mautrix_gvoice_exposure_enabled: "{{ matrix_bridges_exposure_enabled }}"
matrix_bridge_mautrix_gvoice_exposure_hostname: "{{ matrix_bridges_exposure_hostname }}"
matrix_bridge_mautrix_gvoice_exposure_path_prefix: "{{ matrix_bridges_exposure_path_prefix }}/gvoice"

# Postgres is the default, except if not using internal Postgres server
matrix_bridge_mautrix_gvoice_database_engine: "{{ 'postgres' if postgres_enabled else 'sqlite' }}"
matrix_bridge_mautrix_gvoice_database_hostname: "{{ postgres_connection_hostname if postgres_enabled else '' }}"
matrix_bridge_mautrix_gvoice_database_password: "{{ (matrix_homeserver_generic_secret_key + ':maugvoice.db') | hash('sha512') | to_uuid }}"

######################################################################
#
# /matrix-bridge-mautrix-gvoice
#
######################################################################

######################################################################
#
# matrix-bridge-mautrix-linkedin
#
######################################################################

# We don't enable bridges by default.
matrix_bridge_mautrix_linkedin_enabled: false

matrix_bridge_mautrix_linkedin_systemd_required_services_list_auto: |
  {{
    matrix_addons_homeserver_systemd_services_list
    +
    ([postgres_identifier ~ '.service'] if (postgres_enabled and matrix_bridge_mautrix_linkedin_database_hostname == postgres_connection_hostname) else [])
  }}

matrix_bridge_mautrix_linkedin_container_image_registry_prefix_upstream: "{{ matrix_container_global_registry_prefix_override if matrix_container_global_registry_prefix_override else matrix_bridge_mautrix_linkedin_container_image_registry_prefix_upstream_default }}"

matrix_bridge_mautrix_linkedin_container_image_self_build: "{{ matrix_architecture not in ['arm64', 'amd64'] }}"

matrix_bridge_mautrix_linkedin_container_network: "{{ matrix_addons_container_network }}"

matrix_bridge_mautrix_linkedin_container_additional_networks_auto: |-
  {{
    (
      ([] if matrix_addons_homeserver_container_network == '' else [matrix_addons_homeserver_container_network])
      +
      ([postgres_container_network] if (postgres_enabled and matrix_bridge_mautrix_linkedin_database_hostname == postgres_connection_hostname and matrix_bridge_mautrix_linkedin_container_network != postgres_container_network) else [])
      +
      ([matrix_playbook_reverse_proxyable_services_additional_network] if (matrix_playbook_reverse_proxyable_services_additional_network and matrix_bridge_mautrix_linkedin_container_labels_traefik_enabled) else [])
    ) | unique
  }}

matrix_bridge_mautrix_linkedin_container_labels_traefik_enabled: "{{ matrix_playbook_reverse_proxy_type in ['playbook-managed-traefik', 'other-traefik-container'] }}"
matrix_bridge_mautrix_linkedin_container_labels_traefik_docker_network: "{{ matrix_playbook_reverse_proxyable_services_additional_network }}"
matrix_bridge_mautrix_linkedin_container_labels_traefik_entrypoints: "{{ traefik_entrypoint_primary }}"
matrix_bridge_mautrix_linkedin_container_labels_traefik_tls_certResolver: "{{ traefik_certResolver_primary }}"

matrix_bridge_mautrix_linkedin_appservice_token: "{{ (matrix_homeserver_generic_secret_key + ':linkedin.as.token') | hash('sha512') | to_uuid }}"

matrix_bridge_mautrix_linkedin_homeserver_address: "{{ matrix_addons_homeserver_client_api_url }}"
matrix_bridge_mautrix_linkedin_homeserver_token: "{{ (matrix_homeserver_generic_secret_key + ':linkedin.hs.token') | hash('sha512') | to_uuid }}"

matrix_bridge_mautrix_linkedin_provisioning_shared_secret: "{{ (matrix_homeserver_generic_secret_key + ':linkedin.prov') | hash('sha512') | to_uuid }}"

matrix_bridge_mautrix_linkedin_homeserver_async_media: "{{ matrix_homeserver_implementation in ['synapse'] }}"

matrix_bridge_mautrix_linkedin_double_puppet_secrets_auto: |-
  {{
    {
      matrix_bridge_mautrix_linkedin_homeserver_domain: ("as_token:" + matrix_appservice_double_puppet_registration_as_token)
    }
    if matrix_appservice_double_puppet_enabled
    else {}
  }}

matrix_bridge_mautrix_linkedin_scheme: "{{ 'https' if matrix_playbook_ssl_enabled else 'http' }}"
matrix_bridge_mautrix_linkedin_exposure_enabled: "{{ matrix_bridges_exposure_enabled }}"
matrix_bridge_mautrix_linkedin_exposure_hostname: "{{ matrix_bridges_exposure_hostname }}"
matrix_bridge_mautrix_linkedin_exposure_path_prefix: "{{ matrix_bridges_exposure_path_prefix }}/linkedin"

# Postgres is the default, except if not using internal Postgres server
matrix_bridge_mautrix_linkedin_database_engine: "{{ 'postgres' if postgres_enabled else 'sqlite' }}"
matrix_bridge_mautrix_linkedin_database_hostname: "{{ postgres_connection_hostname if postgres_enabled else '' }}"
matrix_bridge_mautrix_linkedin_database_password: "{{ (matrix_homeserver_generic_secret_key + ':mau.linkedin.db') | hash('sha512') | to_uuid }}"

######################################################################
#
# /matrix-bridge-mautrix-linkedin
#
######################################################################

######################################################################
#
# matrix-bridge-mautrix-wsproxy
#
######################################################################

# We don't enable bridges by default.
matrix_bridge_mautrix_wsproxy_enabled: false

matrix_bridge_mautrix_wsproxy_systemd_required_services_list_default: |
  {{
    matrix_addons_homeserver_systemd_services_list
    +
    ([postgres_identifier ~ '.service'] if (postgres_enabled and matrix_bridge_mautrix_wsproxy_syncproxy_database_hostname == postgres_connection_hostname) else [])
  }}

matrix_bridge_mautrix_wsproxy_homeserver_address: "{{ matrix_addons_homeserver_client_api_url }}"

matrix_bridge_mautrix_wsproxy_hostname: "wsproxy.{{ matrix_bridge_mautrix_wsproxy_homeserver_domain }}"

matrix_bridge_mautrix_wsproxy_syncproxy_homeserver_url: "{{ matrix_addons_homeserver_client_api_url }}"

matrix_bridge_mautrix_wsproxy_container_image_registry_prefix_upstream: "{{ matrix_container_global_registry_prefix_override if matrix_container_global_registry_prefix_override else matrix_bridge_mautrix_wsproxy_container_image_registry_prefix_upstream_default }}"

matrix_bridge_mautrix_wsproxy_container_network: "{{ matrix_addons_container_network }}"

matrix_bridge_mautrix_wsproxy_container_additional_networks: |
  {{
    (
      ([] if matrix_addons_homeserver_container_network == '' else [matrix_addons_homeserver_container_network])
      +
      ([matrix_playbook_reverse_proxyable_services_additional_network] if matrix_playbook_reverse_proxyable_services_additional_network else [])
      +
      ([postgres_container_network] if (postgres_enabled and matrix_bridge_mautrix_wsproxy_syncproxy_database_hostname == postgres_connection_hostname and postgres_container_network != matrix_bridge_mautrix_wsproxy_container_network) else [])
    ) | unique
  }}

matrix_bridge_mautrix_wsproxy_container_labels_traefik_enabled: "{{ matrix_playbook_reverse_proxy_type in ['playbook-managed-traefik', 'other-traefik-container'] }}"
matrix_bridge_mautrix_wsproxy_container_labels_traefik_docker_network: "{{ matrix_playbook_reverse_proxyable_services_additional_network }}"
matrix_bridge_mautrix_wsproxy_container_labels_traefik_entrypoints: "{{ traefik_entrypoint_primary }}"
matrix_bridge_mautrix_wsproxy_container_labels_traefik_tls_certResolver: "{{ traefik_certResolver_primary }}"

matrix_bridge_mautrix_wsproxy_syncproxy_database_hostname: "{{ postgres_connection_hostname if postgres_enabled else '' }}"
matrix_bridge_mautrix_wsproxy_syncproxy_database_password: "{{ (matrix_homeserver_generic_secret_key + ':wsproxy.db') | hash('sha512') | to_uuid }}"

######################################################################
#
# /matrix-bridge-mautrix-wsproxy
#
######################################################################

######################################################################
#
# matrix-bridge-wechat
#
######################################################################

# We don't enable bridges by default.
matrix_bridge_wechat_enabled: false

matrix_bridge_wechat_systemd_required_services_list_auto: |
  {{
    matrix_addons_homeserver_systemd_services_list
    +
    ([postgres_identifier ~ '.service'] if (postgres_enabled and matrix_bridge_wechat_database_hostname == postgres_connection_hostname) else [])
  }}

matrix_bridge_wechat_container_image_registry_prefix_upstream: "{{ matrix_container_global_registry_prefix_override if matrix_container_global_registry_prefix_override else matrix_bridge_wechat_container_image_registry_prefix_upstream_default }}"

matrix_bridge_wechat_agent_container_image_registry_prefix_upstream: "{{ matrix_container_global_registry_prefix_override if matrix_container_global_registry_prefix_override else matrix_bridge_wechat_agent_container_image_registry_prefix_upstream_default }}"

matrix_bridge_wechat_container_image_self_build: "{{ matrix_architecture not in ['amd64', 'arm64'] }}"

matrix_bridge_wechat_agent_container_image_self_build: "{{ matrix_architecture not in ['amd64'] }}"

matrix_bridge_wechat_container_network: "{{ matrix_addons_container_network }}"

matrix_bridge_wechat_container_additional_networks_auto: |-
  {{
    (
      ([] if matrix_addons_homeserver_container_network == '' else [matrix_addons_homeserver_container_network])
      +
      ([postgres_container_network] if (postgres_enabled and matrix_bridge_wechat_database_hostname == postgres_connection_hostname and matrix_bridge_wechat_container_network != postgres_container_network) else [])
    ) | unique
  }}

matrix_bridge_wechat_appservice_token: "{{ (matrix_homeserver_generic_secret_key + ':wechat.as.token') | hash('sha512') | to_uuid }}"

matrix_bridge_wechat_homeserver_address: "{{ matrix_addons_homeserver_client_api_url }}"
matrix_bridge_wechat_homeserver_token: "{{ (matrix_homeserver_generic_secret_key + ':wechat.hs.token') | hash('sha512') | to_uuid }}"

matrix_bridge_wechat_homeserver_async_media: "{{ matrix_homeserver_implementation in ['synapse'] }}"

matrix_bridge_wechat_login_shared_secret: "{{ matrix_synapse_ext_password_provider_shared_secret_auth_shared_secret if matrix_synapse_ext_password_provider_shared_secret_auth_enabled else '' }}"

matrix_bridge_wechat_bridge_listen_secret: "{{ (matrix_homeserver_generic_secret_key + ':wechat.lstn') | hash('sha512') | to_uuid }}"

# Postgres is the default, except if not using internal Postgres server
matrix_bridge_wechat_database_engine: "{{ 'postgres' if postgres_enabled else 'sqlite' }}"
matrix_bridge_wechat_database_hostname: "{{ postgres_connection_hostname if postgres_enabled else '' }}"
matrix_bridge_wechat_database_password: "{{ (matrix_homeserver_generic_secret_key + ':gowechat.db') | hash('sha512') | to_uuid }}"

######################################################################
#
# /matrix-bridge-wechat
#
######################################################################

######################################################################
#
# matrix-bridge-mautrix-whatsapp
#
######################################################################

# We don't enable bridges by default.
matrix_bridge_mautrix_whatsapp_enabled: false

matrix_bridge_mautrix_whatsapp_container_image_registry_prefix_upstream: "{{ matrix_container_global_registry_prefix_override if matrix_container_global_registry_prefix_override else matrix_bridge_mautrix_whatsapp_container_image_registry_prefix_upstream_default }}"

matrix_bridge_mautrix_whatsapp_container_image_self_build: "{{ matrix_architecture not in ['arm64', 'amd64'] }}"

matrix_bridge_mautrix_whatsapp_container_network: "{{ matrix_addons_container_network }}"

matrix_bridge_mautrix_whatsapp_container_additional_networks_auto: |-
  {{
    (
      ([] if matrix_addons_homeserver_container_network == '' else [matrix_addons_homeserver_container_network])
      +
      ([postgres_container_network] if postgres_enabled and matrix_bridge_mautrix_whatsapp_database_hostname == postgres_connection_hostname else [])
      +
      ([matrix_playbook_reverse_proxyable_services_additional_network] if matrix_playbook_reverse_proxyable_services_additional_network and matrix_bridge_mautrix_whatsapp_container_labels_traefik_enabled else [])
    ) | unique
  }}

matrix_bridge_mautrix_whatsapp_container_labels_traefik_enabled: "{{ matrix_playbook_reverse_proxy_type in ['playbook-managed-traefik', 'other-traefik-container'] }}"
matrix_bridge_mautrix_whatsapp_container_labels_traefik_docker_network: "{{ matrix_playbook_reverse_proxyable_services_additional_network }}"
matrix_bridge_mautrix_whatsapp_container_labels_traefik_entrypoints: "{{ traefik_entrypoint_primary }}"
matrix_bridge_mautrix_whatsapp_container_labels_traefik_tls_certResolver: "{{ traefik_certResolver_primary }}"

matrix_bridge_mautrix_whatsapp_systemd_required_services_list_auto: |
  {{
    matrix_addons_homeserver_systemd_services_list
    +
    ([postgres_identifier ~ '.service'] if postgres_enabled and matrix_bridge_mautrix_whatsapp_database_hostname == postgres_connection_hostname else [])
  }}

matrix_bridge_mautrix_whatsapp_appservice_token: "{{ (matrix_homeserver_generic_secret_key + ':wa.as.token') | hash('sha512') | to_uuid }}"

matrix_bridge_mautrix_whatsapp_homeserver_address: "{{ matrix_addons_homeserver_client_api_url }}"
matrix_bridge_mautrix_whatsapp_homeserver_token: "{{ (matrix_homeserver_generic_secret_key + ':wa.hs.token') | hash('sha512') | to_uuid }}"
matrix_bridge_mautrix_whatsapp_provisioning_shared_secret: "{{ (matrix_homeserver_generic_secret_key + ':wa.prov') | hash('sha512') | to_uuid }}"

matrix_bridge_mautrix_whatsapp_homeserver_async_media: "{{ matrix_homeserver_implementation in ['synapse'] }}"

matrix_bridge_mautrix_whatsapp_double_puppet_secrets_auto: |-
  {{
    {
      matrix_bridge_mautrix_whatsapp_homeserver_domain: ("as_token:" + matrix_appservice_double_puppet_registration_as_token)
    }
    if matrix_appservice_double_puppet_enabled
    else {}
  }}

matrix_bridge_mautrix_whatsapp_scheme: "{{ 'https' if matrix_playbook_ssl_enabled else 'http' }}"
matrix_bridge_mautrix_whatsapp_exposure_enabled: "{{ matrix_bridges_exposure_enabled }}"
matrix_bridge_mautrix_whatsapp_exposure_hostname: "{{ matrix_bridges_exposure_hostname }}"
matrix_bridge_mautrix_whatsapp_exposure_path_prefix: "{{ matrix_bridges_exposure_path_prefix }}/whatsapp"

# Postgres is the default, except if not using internal Postgres server
matrix_bridge_mautrix_whatsapp_database_engine: "{{ 'postgres' if postgres_enabled else 'sqlite' }}"
matrix_bridge_mautrix_whatsapp_database_hostname: "{{ postgres_connection_hostname if postgres_enabled else '' }}"
matrix_bridge_mautrix_whatsapp_database_password: "{{ (matrix_homeserver_generic_secret_key + ':mauwhatsapp.db') | hash('sha512') | to_uuid }}"

######################################################################
#
# /matrix-bridge-mautrix-whatsapp
#
######################################################################

######################################################################
#
# matrix-sms-bridge
#
######################################################################

# We don't enable bridges by default.
matrix_bridge_sms_enabled: false

matrix_bridge_sms_systemd_required_services_list_auto: |
  {{
    matrix_addons_homeserver_systemd_services_list
  }}

matrix_bridge_sms_container_image_registry_prefix_upstream: "{{ matrix_container_global_registry_prefix_override if matrix_container_global_registry_prefix_override else matrix_bridge_sms_container_image_registry_prefix_upstream_default }}"

matrix_bridge_sms_container_network: "{{ matrix_addons_container_network }}"

matrix_bridge_sms_container_additional_networks_auto: |-
  {{
    ([] if matrix_addons_homeserver_container_network == '' else [matrix_addons_homeserver_container_network])
  }}

matrix_bridge_sms_appservice_token: "{{ (matrix_homeserver_generic_secret_key + ':sms.as.token') | hash('sha512') | to_uuid }}"

matrix_bridge_sms_homeserver_hostname: "{{ (matrix_homeserver_container_client_api_endpoint | split(':'))[0] }}"
matrix_bridge_sms_homeserver_port: "{{ (matrix_homeserver_container_client_api_endpoint | split(':'))[1] }}"
matrix_bridge_sms_homeserver_token: "{{ (matrix_homeserver_generic_secret_key + ':sms.hs.token') | hash('sha512') | to_uuid }}"

######################################################################
#
# /matrix-sms-bridge
#
######################################################################

######################################################################
#
# matrix-bridge-heisenbridge
#
######################################################################

# We don't enable bridges by default.
matrix_bridge_heisenbridge_enabled: false

matrix_bridge_heisenbridge_scheme: "{{ 'https' if matrix_playbook_ssl_enabled else 'http' }}"

matrix_bridge_heisenbridge_systemd_required_services_list_auto: |
  {{
    matrix_addons_homeserver_systemd_services_list
  }}

matrix_bridge_heisenbridge_container_image_registry_prefix_upstream: "{{ matrix_container_global_registry_prefix_override if matrix_container_global_registry_prefix_override else matrix_bridge_heisenbridge_container_image_registry_prefix_upstream_default }}"

matrix_bridge_heisenbridge_container_network: "{{ matrix_addons_container_network }}"

matrix_bridge_heisenbridge_container_additional_networks_auto: |-
  {{
    (
      ([] if matrix_addons_homeserver_container_network == '' else [matrix_addons_homeserver_container_network])
      +
      [matrix_playbook_reverse_proxyable_services_additional_network] if (matrix_bridge_heisenbridge_container_labels_traefik_enabled and matrix_playbook_reverse_proxyable_services_additional_network) else []
    ) | unique
  }}

matrix_bridge_heisenbridge_container_labels_traefik_enabled: "{{ matrix_playbook_reverse_proxy_type in ['playbook-managed-traefik', 'other-traefik-container'] }}"
matrix_bridge_heisenbridge_container_labels_traefik_docker_network: "{{ matrix_playbook_reverse_proxyable_services_additional_network }}"
matrix_bridge_heisenbridge_container_labels_traefik_entrypoints: "{{ traefik_entrypoint_primary }}"
matrix_bridge_heisenbridge_container_labels_traefik_tls_certResolver: "{{ traefik_certResolver_primary }}"

matrix_bridge_heisenbridge_appservice_token: "{{ (matrix_homeserver_generic_secret_key + ':heisen.as.tok') | hash('sha512') | to_uuid }}"

matrix_bridge_heisenbridge_homeserver_token: "{{ (matrix_homeserver_generic_secret_key + ':heisen.hs.tok') | hash('sha512') | to_uuid }}"

matrix_bridge_heisenbridge_homeserver_url: "{{ matrix_addons_homeserver_client_api_url }}"

######################################################################
#
# /matrix-bridge-heisenbridge
#
######################################################################

######################################################################
#
# matrix-bridge-hookshot
#
######################################################################

# We don't enable bridges by default.
matrix_bridge_hookshot_enabled: false

matrix_bridge_hookshot_container_image_registry_prefix_upstream: "{{ matrix_container_global_registry_prefix_override if matrix_container_global_registry_prefix_override else matrix_bridge_hookshot_container_image_registry_prefix_upstream_default }}"

matrix_bridge_hookshot_container_image_self_build: "{{ matrix_architecture not in ['arm64', 'amd64'] }}"

matrix_bridge_hookshot_appservice_token: "{{ (matrix_homeserver_generic_secret_key + ':hookshot.as.tok') | hash('sha512') | to_uuid }}"

matrix_bridge_hookshot_homeserver_token: "{{ (matrix_homeserver_generic_secret_key + ':hookshot.hs.tok') | hash('sha512') | to_uuid }}"

matrix_bridge_hookshot_homeserver_address: "{{ matrix_addons_homeserver_client_api_url }}"

matrix_bridge_hookshot_systemd_wanted_services_list: |
  {{
    matrix_addons_homeserver_systemd_services_list
    +
    ([(valkey_identifier + '.service')] if valkey_enabled and matrix_bridge_hookshot_cache_redis_host == valkey_identifier else [])
  }}

# Hookshot's experimental encryption feature (and possibly others) may benefit from Redis, if available.
# We only connect to Redis if encryption is enabled (not for everyone who has Redis enabled),
# because connectivity is still potentially troublesome and is to be investigated.
matrix_bridge_hookshot_cache_redis_host: "{{ valkey_identifier if valkey_enabled else '' }}"

matrix_bridge_hookshot_container_network: "{{ matrix_addons_container_network }}"

matrix_bridge_hookshot_container_additional_networks_auto: |
  {{
    (
      ([] if matrix_addons_homeserver_container_network == '' else [matrix_addons_homeserver_container_network])
      +
      ([valkey_container_network] if valkey_enabled and matrix_bridge_hookshot_cache_redis_host == valkey_identifier else [])
      +
      ([matrix_playbook_reverse_proxyable_services_additional_network] if matrix_playbook_reverse_proxyable_services_additional_network and matrix_bridge_hookshot_container_labels_traefik_enabled else [])
    ) | unique
  }}

matrix_bridge_hookshot_container_http_host_bind_ports_defaultmapping:
  - "{{ matrix_playbook_service_host_bind_interface_prefix }}{{ matrix_bridge_hookshot_appservice_port }}:{{ matrix_bridge_hookshot_appservice_port }}"
  - "{{ matrix_playbook_service_host_bind_interface_prefix }}{{ matrix_bridge_hookshot_metrics_port }}:{{ matrix_bridge_hookshot_metrics_port }}"
  - "{{ matrix_playbook_service_host_bind_interface_prefix }}{{ matrix_bridge_hookshot_webhook_port }}:{{ matrix_bridge_hookshot_webhook_port }}"

matrix_bridge_hookshot_container_http_host_bind_ports: "{{ matrix_bridge_hookshot_container_http_host_bind_ports_defaultmapping if matrix_playbook_service_host_bind_interface_prefix else [] }}"

matrix_bridge_hookshot_container_labels_traefik_enabled: "{{ matrix_playbook_reverse_proxy_type in ['playbook-managed-traefik', 'other-traefik-container'] }}"
matrix_bridge_hookshot_container_labels_traefik_docker_network: "{{ matrix_playbook_reverse_proxyable_services_additional_network }}"
matrix_bridge_hookshot_container_labels_traefik_entrypoints: "{{ traefik_entrypoint_primary }}"
matrix_bridge_hookshot_container_labels_traefik_tls_certResolver: "{{ traefik_certResolver_primary }}"

matrix_bridge_hookshot_metrics_enabled: "{{ prometheus_enabled or matrix_metrics_exposure_enabled }}"

matrix_bridge_hookshot_metrics_proxying_enabled: "{{ matrix_bridge_hookshot_metrics_enabled and matrix_metrics_exposure_enabled }}"
matrix_bridge_hookshot_metrics_proxying_hostname: "{{ matrix_metrics_exposure_hostname }}"
matrix_bridge_hookshot_metrics_proxying_path_prefix: "{{ matrix_metrics_exposure_path_prefix }}/hookshot"
matrix_bridge_hookshot_container_labels_metrics_middleware_basic_auth_enabled: "{{ matrix_metrics_exposure_http_basic_auth_enabled }}"
matrix_bridge_hookshot_container_labels_metrics_middleware_basic_auth_users: "{{ matrix_metrics_exposure_http_basic_auth_users }}"

matrix_bridge_hookshot_public_scheme: "{{ 'https' if matrix_playbook_ssl_enabled else 'http' }}"

######################################################################
#
# /matrix-bridge-hookshot
#
######################################################################

######################################################################
#
# matrix-bridge-meshtastic-relay
#
######################################################################

# We don't enable bridges by default.
matrix_bridge_meshtastic_relay_enabled: false

matrix_bridge_meshtastic_relay_container_image_registry_prefix_upstream: "{{ matrix_container_global_registry_prefix_override if matrix_container_global_registry_prefix_override else matrix_bridge_meshtastic_relay_container_image_registry_prefix_upstream_default }}"

matrix_bridge_meshtastic_relay_matrix_host: "{{ matrix_domain }}"

matrix_bridge_meshtastic_relay_matrix_homeserver_url: "{{ matrix_addons_homeserver_client_api_url }}"

matrix_bridge_meshtastic_relay_container_network: "{{ matrix_addons_container_network }}"

matrix_bridge_meshtastic_relay_systemd_required_services_list_auto: |
  {{
    matrix_addons_homeserver_systemd_services_list
  }}

matrix_bridge_meshtastic_relay_container_additional_networks_auto: |
  {{
    ([] if matrix_addons_homeserver_container_network == '' or matrix_addons_homeserver_container_network == matrix_bridge_meshtastic_relay_container_network else [matrix_addons_homeserver_container_network])
  }}

######################################################################
#
# /matrix-bridge-meshtastic-relay
#
######################################################################

######################################################################
#
# matrix-bridge-mx-puppet-steam
#
######################################################################

# We don't enable bridges by default.
matrix_bridge_mx_puppet_steam_enabled: false

matrix_bridge_mx_puppet_steam_systemd_required_services_list_auto: |
  {{
    matrix_addons_homeserver_systemd_services_list
    +
    ([postgres_identifier ~ '.service'] if (postgres_enabled and matrix_bridge_mx_puppet_steam_database_hostname == postgres_connection_hostname) else [])
  }}

matrix_bridge_mx_puppet_steam_container_image_registry_prefix_upstream: "{{ matrix_container_global_registry_prefix_override if matrix_container_global_registry_prefix_override else matrix_bridge_mx_puppet_steam_container_image_registry_prefix_upstream_default }}"

matrix_bridge_mx_puppet_steam_container_image_self_build: "{{ matrix_architecture not in ['arm64', 'amd64'] }}"

matrix_bridge_mx_puppet_steam_container_network: "{{ matrix_addons_container_network }}"

matrix_bridge_mx_puppet_steam_container_additional_networks_auto: |-
  {{
    (
      ([] if matrix_addons_homeserver_container_network == '' else [matrix_addons_homeserver_container_network])
      +
      ([postgres_container_network] if (postgres_enabled and matrix_bridge_mx_puppet_steam_database_hostname == postgres_connection_hostname and matrix_bridge_mx_puppet_steam_container_network != postgres_container_network) else [])
    ) | unique
  }}

matrix_bridge_mx_puppet_steam_appservice_token: "{{ (matrix_homeserver_generic_secret_key + ':mxste.as.tok') | hash('sha512') | to_uuid }}"

matrix_bridge_mx_puppet_steam_homeserver_address: "{{ matrix_addons_homeserver_client_api_url }}"
matrix_bridge_mx_puppet_steam_homeserver_token: "{{ (matrix_homeserver_generic_secret_key + ':mxste.hs.tok') | hash('sha512') | to_uuid }}"

matrix_bridge_mx_puppet_steam_login_shared_secret: "{{ matrix_synapse_ext_password_provider_shared_secret_auth_shared_secret if matrix_synapse_ext_password_provider_shared_secret_auth_enabled else '' }}"

matrix_bridge_mx_puppet_steam_presence_enabled: "{{ matrix_homeserver_implementation != 'synapse' or matrix_synapse_presence_enabled }}"

# Postgres is the default, except if not using internal Postgres server
matrix_bridge_mx_puppet_steam_database_engine: "{{ 'postgres' if postgres_enabled else 'sqlite' }}"
matrix_bridge_mx_puppet_steam_database_hostname: "{{ postgres_connection_hostname if postgres_enabled else '' }}"
matrix_bridge_mx_puppet_steam_database_password: "{{ (matrix_homeserver_generic_secret_key + ':mxpup.steam.db') | hash('sha512') | to_uuid }}"

######################################################################
#
# /matrix-bridge-mx-puppet-steam
#
######################################################################


######################################################################
#
# matrix-bridge-mx-puppet-groupme
#
######################################################################

# We don't enable bridges by default.
matrix_bridge_mx_puppet_groupme_enabled: false

matrix_bridge_mx_puppet_groupme_systemd_required_services_list_auto: |
  {{
    matrix_addons_homeserver_systemd_services_list
    +
    ([postgres_identifier ~ '.service'] if (postgres_enabled and matrix_bridge_mx_puppet_groupme_database_hostname == postgres_connection_hostname) else [])
  }}

matrix_bridge_mx_puppet_groupme_container_image_registry_prefix_upstream: "{{ matrix_container_global_registry_prefix_override if matrix_container_global_registry_prefix_override else matrix_bridge_mx_puppet_groupme_container_image_registry_prefix_upstream_default }}"

matrix_bridge_mx_puppet_groupme_container_image_self_build: "{{ matrix_architecture != 'amd64' }}"

matrix_bridge_mx_puppet_groupme_container_network: "{{ matrix_addons_container_network }}"

matrix_bridge_mx_puppet_groupme_container_additional_networks_auto: |-
  {{
    (
      ([] if matrix_addons_homeserver_container_network == '' else [matrix_addons_homeserver_container_network])
      +
      ([postgres_container_network] if (postgres_enabled and matrix_bridge_mx_puppet_groupme_database_hostname == postgres_connection_hostname and matrix_bridge_mx_puppet_groupme_container_network != postgres_container_network) else [])
    ) | unique
  }}

matrix_bridge_mx_puppet_groupme_appservice_token: "{{ (matrix_homeserver_generic_secret_key + ':mxgro.as.tok') | hash('sha512') | to_uuid }}"

matrix_bridge_mx_puppet_groupme_homeserver_address: "{{ matrix_addons_homeserver_client_api_url }}"
matrix_bridge_mx_puppet_groupme_homeserver_token: "{{ (matrix_homeserver_generic_secret_key + ':mxgro.hs.tok') | hash('sha512') | to_uuid }}"

matrix_bridge_mx_puppet_groupme_login_shared_secret: "{{ matrix_synapse_ext_password_provider_shared_secret_auth_shared_secret if matrix_synapse_ext_password_provider_shared_secret_auth_enabled else '' }}"

matrix_bridge_mx_puppet_groupme_presence_enabled: "{{ matrix_homeserver_implementation != 'synapse' or matrix_synapse_presence_enabled }}"

# Postgres is the default, except if not using internal Postgres server
matrix_bridge_mx_puppet_groupme_database_engine: "{{ 'postgres' if postgres_enabled else 'sqlite' }}"
matrix_bridge_mx_puppet_groupme_database_hostname: "{{ postgres_connection_hostname if postgres_enabled else '' }}"
matrix_bridge_mx_puppet_groupme_database_password: "{{ (matrix_homeserver_generic_secret_key + ':mxpup.groupme.db') | hash('sha512') | to_uuid }}"

######################################################################
#
# /matrix-bridge-mx-puppet-groupme
#
######################################################################

######################################################################
#
# matrix-bridge-postmoogle
#
######################################################################

# We don't enable bridges by default.
matrix_bridge_postmoogle_enabled: false

matrix_bridge_postmoogle_container_image_registry_prefix_upstream: "{{ matrix_container_global_registry_prefix_override if matrix_container_global_registry_prefix_override else matrix_bridge_postmoogle_container_image_registry_prefix_upstream_default }}"

matrix_bridge_postmoogle_container_image_self_build: "{{ matrix_architecture not in ['amd64', 'arm64'] }}"

matrix_bridge_postmoogle_ssl_path: |-
  {{
    {
      'playbook-managed-traefik': (traefik_certs_dumper_dumped_certificates_path if traefik_certs_dumper_enabled else ''),
      'other-traefik-container': (traefik_certs_dumper_dumped_certificates_path if traefik_certs_dumper_enabled else ''),
      'none': '',
    }[matrix_playbook_reverse_proxy_type]
  }}

matrix_playbook_bridge_postmoogle_traefik_tls_cert: "{% for domain in matrix_bridge_postmoogle_domains %}/ssl/{{ domain }}/certificate.crt {% endfor %}"
matrix_playbook_bridge_postmoogle_traefik_key: "{% for domain in matrix_bridge_postmoogle_domains %}/ssl/{{ domain }}/privatekey.key {% endfor %}"

matrix_bridge_postmoogle_tls_cert: |-
  {{
    {
      'playbook-managed-traefik': (matrix_playbook_bridge_postmoogle_traefik_tls_cert if traefik_certs_dumper_enabled else ''),
      'other-traefik-container': (matrix_playbook_bridge_postmoogle_traefik_tls_cert if traefik_certs_dumper_enabled else ''),
      'none': '',
    }[matrix_playbook_reverse_proxy_type]
  }}

matrix_bridge_postmoogle_tls_key: |-
  {{
    {
      'playbook-managed-traefik': (matrix_playbook_bridge_postmoogle_traefik_key if traefik_certs_dumper_enabled else ''),
      'other-traefik-container': (matrix_playbook_bridge_postmoogle_traefik_key if traefik_certs_dumper_enabled else ''),
      'none': '',
    }[matrix_playbook_reverse_proxy_type]
  }}

matrix_playbook_bridge_postmoogle_traefik_certs_dumper_waiter_services: "{% for domain in matrix_bridge_postmoogle_domains %}{{ traefik_certs_dumper_identifier }}-wait-for-domain@{{ domain }}.service {% endfor %}"

matrix_bridge_postmoogle_systemd_required_services_list_auto: |
  {{
    matrix_addons_homeserver_systemd_services_list
    +
    ([postgres_identifier ~ '.service'] if postgres_enabled and matrix_bridge_postmoogle_database_hostname == matrix_bridge_postmoogle_database_hostname else [])
    +
    (matrix_playbook_bridge_postmoogle_traefik_certs_dumper_waiter_services | trim | split(' ') if matrix_playbook_reverse_proxy_type in ['playbook-managed-traefik', 'other-traefik-container'] and traefik_certs_dumper_enabled else [])
  }}

# Postgres is the default, except if not using internal Postgres server
matrix_bridge_postmoogle_database_engine: "{{ 'postgres' if postgres_enabled else 'sqlite' }}"
matrix_bridge_postmoogle_database_hostname: "{{ postgres_connection_hostname if postgres_enabled else '' }}"
matrix_bridge_postmoogle_database_password: "{{ (matrix_homeserver_generic_secret_key + ':postmoogle.db') | hash('sha512') | to_uuid }}"

matrix_bridge_postmoogle_homeserver: "{{ matrix_addons_homeserver_client_api_url }}"

matrix_bridge_postmoogle_container_network: "{{ matrix_addons_container_network }}"

matrix_bridge_postmoogle_container_additional_networks_auto: |-
  {{
    (
      ([] if matrix_addons_homeserver_container_network == '' else [matrix_addons_homeserver_container_network])
      +
      ([postgres_container_network] if postgres_enabled and matrix_bot_matrix_reminder_bot_database_hostname == postgres_connection_hostname else [])
    ) | unique
  }}

######################################################################
#
# /matrix-bridge-postmoogle
#
######################################################################

######################################################################
#
# matrix-bridge-steam
#
######################################################################

# We don't enable bridges by default.
matrix_bridge_steam_enabled: false

matrix_bridge_steam_systemd_required_services_list_auto: |
  {{
    matrix_addons_homeserver_systemd_services_list
    +
    ([postgres_identifier ~ '.service'] if (postgres_enabled and matrix_bridge_steam_database_hostname == postgres_connection_hostname) else [])
  }}

matrix_bridge_steam_container_image_registry_prefix_upstream: "{{ matrix_container_global_registry_prefix_override if matrix_container_global_registry_prefix_override else matrix_bridge_steam_container_image_registry_prefix_upstream_default }}"

matrix_bridge_steam_container_image_self_build: "{{ matrix_architecture not in ['amd64', 'arm64'] }}"

matrix_bridge_steam_container_network: "{{ matrix_addons_container_network }}"

matrix_bridge_steam_container_additional_networks_auto: |-
  {{
    (
      ([] if matrix_addons_homeserver_container_network == '' else [matrix_addons_homeserver_container_network])
      +
      ([postgres_container_network] if (postgres_enabled and matrix_bridge_steam_database_hostname == postgres_connection_hostname and matrix_bridge_steam_container_network != postgres_container_network) else [])
      +
      ([matrix_playbook_reverse_proxyable_services_additional_network] if matrix_playbook_reverse_proxyable_services_additional_network and matrix_bridge_steam_container_labels_traefik_enabled else [])
    ) | unique
  }}

matrix_bridge_steam_container_labels_traefik_enabled: "{{ matrix_playbook_reverse_proxy_type in ['playbook-managed-traefik', 'other-traefik-container'] }}"
matrix_bridge_steam_container_labels_traefik_docker_network: "{{ matrix_playbook_reverse_proxyable_services_additional_network }}"
matrix_bridge_steam_container_labels_traefik_entrypoints: "{{ traefik_entrypoint_primary }}"
matrix_bridge_steam_container_labels_traefik_tls_certResolver: "{{ traefik_certResolver_primary }}"

matrix_bridge_steam_appservice_token: "{{ (matrix_homeserver_generic_secret_key + ':steam.as.token') | hash('sha512') | to_uuid }}"

matrix_bridge_steam_homeserver_address: "{{ matrix_addons_homeserver_client_api_url }}"
matrix_bridge_steam_homeserver_token: "{{ (matrix_homeserver_generic_secret_key + ':steam.hs.token') | hash('sha512') | to_uuid }}"

matrix_bridge_steam_homeserver_async_media: "{{ matrix_homeserver_implementation in ['synapse'] }}"

matrix_bridge_steam_public_media_signing_key: "{{ ((matrix_homeserver_generic_secret_key + ':steam.pub.key') | hash('sha512') | to_uuid) if matrix_bridge_steam_public_media_enabled else '' }}"

matrix_bridge_steam_provisioning_shared_secret: "{{ (matrix_homeserver_generic_secret_key + ':steam.prov') | hash('sha512') | to_uuid }}"

matrix_bridge_steam_exposure_enabled: "{{ matrix_bridges_exposure_enabled }}"
matrix_bridge_steam_exposure_hostname: "{{ matrix_bridges_exposure_hostname }}"
matrix_bridge_steam_exposure_path_prefix: "{{ matrix_bridges_exposure_path_prefix }}/steam"

matrix_bridge_steam_double_puppet_secrets_auto: |-
  {{
    ({
      matrix_bridge_steam_homeserver_domain: ("as_token:" + matrix_appservice_double_puppet_registration_as_token)
    })
    if matrix_appservice_double_puppet_enabled
    else {}
  }}

matrix_bridge_steam_database_hostname: "{{ postgres_connection_hostname if postgres_enabled else '' }}"
matrix_bridge_steam_database_password: "{{ (matrix_homeserver_generic_secret_key + ':mau.twt.db') | hash('sha512') | to_uuid if postgres_enabled else '' }}"

######################################################################
#
# /matrix-bridge-steam
#
######################################################################

######################################################################
#
# matrix-bot-matrix-reminder-bot
#
######################################################################

# We don't enable bots by default.
matrix_bot_matrix_reminder_bot_enabled: false

matrix_bot_matrix_reminder_bot_systemd_required_services_list_auto: |
  {{
    matrix_addons_homeserver_systemd_services_list
    +
    ([postgres_identifier ~ '.service'] if postgres_enabled and matrix_bot_matrix_reminder_bot_database_hostname == postgres_connection_hostname else [])
  }}

matrix_bot_matrix_reminder_bot_container_image_registry_prefix_upstream: "{{ matrix_container_global_registry_prefix_override if matrix_container_global_registry_prefix_override else matrix_bot_matrix_reminder_bot_container_image_registry_prefix_upstream_default }}"

matrix_bot_matrix_reminder_bot_container_image_self_build: "{{ matrix_architecture not in ['amd64', 'arm64'] }}"

matrix_bot_matrix_reminder_bot_container_network: "{{ matrix_addons_container_network }}"

matrix_bot_matrix_reminder_bot_container_additional_networks_auto: |-
  {{
    (
      ([] if matrix_addons_homeserver_container_network == '' else [matrix_addons_homeserver_container_network])
      +
      ([postgres_container_network] if postgres_enabled and matrix_bot_matrix_reminder_bot_database_hostname == postgres_connection_hostname else [])
    ) | unique
  }}

matrix_bot_matrix_reminder_bot_matrix_homeserver_url: "{{ matrix_addons_homeserver_client_api_url }}"

# Postgres is the default, except if not using internal Postgres server
matrix_bot_matrix_reminder_bot_database_engine: "{{ 'postgres' if postgres_enabled else 'sqlite' }}"
matrix_bot_matrix_reminder_bot_database_hostname: "{{ postgres_connection_hostname if postgres_enabled else '' }}"
matrix_bot_matrix_reminder_bot_database_password: "{{ (matrix_homeserver_generic_secret_key + ':reminder.bot.db') | hash('sha512') | to_uuid }}"

matrix_bot_matrix_reminder_bot_allowlist_enabled: true
matrix_bot_matrix_reminder_bot_allowlist_regexes_auto:
  - "@[a-z0-9-_.]+:{{ matrix_domain }}"

######################################################################
#
# /matrix-bot-matrix-reminder-bot
#
######################################################################

######################################################################
#
# matrix-bot-maubot
#
######################################################################

# We don't enable bots by default.
matrix_bot_maubot_enabled: false

matrix_bot_maubot_systemd_required_services_list_auto: |
  {{
    matrix_addons_homeserver_systemd_services_list
    +
    ([postgres_identifier ~ '.service'] if (postgres_enabled and matrix_bot_maubot_database_hostname == postgres_connection_hostname) else [])
  }}

matrix_bot_maubot_hostname: "{{ matrix_server_fqn_matrix }}"

matrix_bot_maubot_homeserver_url: "{{ matrix_addons_homeserver_client_api_url }}"

matrix_bot_maubot_homeserver_secret: |-
  {{
    {
      'synapse': matrix_synapse_registration_shared_secret | default(''),
      'dendrite': matrix_dendrite_client_api_registration_shared_secret | default(''),
    }[matrix_homeserver_implementation] | default('')
  }}

matrix_bot_maubot_container_image_registry_prefix_upstream: "{{ matrix_container_global_registry_prefix_override if matrix_container_global_registry_prefix_override else matrix_bot_maubot_container_image_registry_prefix_upstream_default }}"

matrix_bot_maubot_container_image_self_build: "{{ matrix_architecture not in ['amd64'] }}"

matrix_bot_maubot_container_management_interface_http_bind_port: "{{ (matrix_playbook_service_host_bind_interface_prefix ~ '' ~ matrix_bot_maubot_server_port | string) if matrix_playbook_service_host_bind_interface_prefix else '' }}"

matrix_bot_maubot_container_network: "{{ matrix_addons_container_network }}"

matrix_bot_maubot_container_additional_networks_auto: |-
  {{
    (
      ([] if matrix_addons_homeserver_container_network == '' else [matrix_addons_homeserver_container_network])
      +
      ([postgres_container_network] if (postgres_enabled and matrix_bot_maubot_database_hostname == postgres_connection_hostname and matrix_bot_maubot_container_network != postgres_container_network) else [])
      +
      ([matrix_playbook_reverse_proxyable_services_additional_network] if matrix_playbook_reverse_proxyable_services_additional_network and matrix_bot_maubot_container_labels_traefik_enabled else [])
    ) | unique
  }}

matrix_bot_maubot_container_labels_traefik_enabled: "{{ matrix_playbook_reverse_proxy_type in ['playbook-managed-traefik', 'other-traefik-container'] }}"
matrix_bot_maubot_container_labels_traefik_docker_network: "{{ matrix_playbook_reverse_proxyable_services_additional_network }}"
matrix_bot_maubot_container_labels_traefik_entrypoints: "{{ traefik_entrypoint_primary }}"
matrix_bot_maubot_container_labels_traefik_tls_certResolver: "{{ traefik_certResolver_primary }}"

matrix_bot_maubot_container_labels_management_hostname: "{{ matrix_server_fqn_matrix }}"

# Postgres is the default, except if not using internal Postgres server
matrix_bot_maubot_database_engine: "{{ 'postgres' if postgres_enabled else 'sqlite' }}"
matrix_bot_maubot_database_hostname: "{{ postgres_connection_hostname if postgres_enabled else '' }}"
matrix_bot_maubot_database_password: "{{ (matrix_homeserver_generic_secret_key + ':mxpup.dsc.db') | hash('sha512') | to_uuid }}"

######################################################################
#
# /matrix-bot-maubot
#
######################################################################


######################################################################
#
# matrix-bot-honoroit
#
######################################################################

# We don't enable bots by default.
matrix_bot_honoroit_enabled: false

matrix_bot_honoroit_hostname: "{{ matrix_server_fqn_matrix }}"

matrix_bot_honoroit_path_prefix: /honoroit

matrix_bot_honoroit_systemd_required_services_list_auto: |
  {{
    matrix_addons_homeserver_systemd_services_list
    +
    ([postgres_identifier ~ '.service'] if postgres_enabled and matrix_bot_honoroit_database_hostname == postgres_connection_hostname else [])
  }}

matrix_bot_honoroit_container_image_registry_prefix_upstream: "{{ matrix_container_global_registry_prefix_override if matrix_container_global_registry_prefix_override else matrix_bot_honoroit_container_image_registry_prefix_upstream_default }}"

matrix_bot_honoroit_container_network: "{{ matrix_addons_container_network }}"

matrix_bot_honoroit_container_additional_networks: |
  {{
    (
      ([] if matrix_addons_homeserver_container_network == '' else [matrix_addons_homeserver_container_network])
      +
      ([postgres_container_network] if (postgres_enabled and matrix_bot_honoroit_database_hostname == postgres_connection_hostname and matrix_bot_honoroit_container_network != postgres_container_network) else [])
      +
      ([matrix_playbook_reverse_proxyable_services_additional_network] if matrix_playbook_reverse_proxyable_services_additional_network and matrix_bot_honoroit_container_labels_traefik_enabled else [])
    ) | unique
  }}

matrix_bot_honoroit_container_labels_traefik_enabled: "{{ matrix_playbook_traefik_labels_enabled }}"
matrix_bot_honoroit_container_labels_traefik_docker_network: "{{ matrix_playbook_reverse_proxyable_services_additional_network }}"
matrix_bot_honoroit_container_labels_traefik_entrypoints: "{{ traefik_entrypoint_primary }}"
matrix_bot_honoroit_container_labels_traefik_tls_certResolver: "{{ traefik_certResolver_primary }}"

# For consistency with other things hosted at the Matrix FQN, we adjust the metrics endpoint
# so that metrics would be served at something like `/metrics/SERVICE_NAME`, and not at the default path for the role (`PREFIX/metrics`).
matrix_bot_honoroit_container_labels_traefik_metrics_path: "{{ matrix_metrics_exposure_path_prefix }}/honoroit"

matrix_bot_honoroit_homeserver: "{{ matrix_addons_homeserver_client_api_url }}"

# Postgres is the default, except if not using internal Postgres server
matrix_bot_honoroit_database_engine: "{{ 'postgres' if postgres_enabled else 'sqlite' }}"
matrix_bot_honoroit_database_hostname: "{{ postgres_connection_hostname if postgres_enabled else '' }}"
matrix_bot_honoroit_database_password: "{{ (matrix_homeserver_generic_secret_key + ':honoroit.bot.db') | hash('sha512') | to_uuid }}"
matrix_bot_honoroit_container_image_self_build: "{{ matrix_architecture not in ['amd64', 'arm64'] }}"

######################################################################
#
# /matrix-bot-honoroit
#
######################################################################

######################################################################
#
# matrix-bot-buscarron
#
######################################################################

# We don't enable bots by default.
matrix_bot_buscarron_enabled: false

matrix_bot_buscarron_hostname: "{{ matrix_server_fqn_buscarron }}"

matrix_bot_buscarron_systemd_required_services_list_auto: |
  {{
    matrix_addons_homeserver_systemd_services_list
    +
    ([postgres_identifier ~ '.service'] if (postgres_enabled and matrix_bot_buscarron_database_hostname == postgres_connection_hostname) else [])
  }}

matrix_bot_buscarron_container_image_registry_prefix_upstream: "{{ matrix_container_global_registry_prefix_override if matrix_container_global_registry_prefix_override else matrix_bot_buscarron_container_image_registry_prefix_upstream_default }}"

matrix_bot_buscarron_container_image_self_build: "{{ matrix_architecture not in ['amd64', 'arm64'] }}"

matrix_bot_buscarron_container_network: "{{ matrix_addons_container_network }}"

matrix_bot_buscarron_container_additional_networks_auto: |-
  {{
    (
      ([] if matrix_addons_homeserver_container_network == '' else [matrix_addons_homeserver_container_network])
      +
      ([postgres_container_network] if (postgres_enabled and matrix_bot_buscarron_database_hostname == postgres_connection_hostname and matrix_bot_buscarron_container_network != postgres_container_network) else [])
      +
      ([matrix_playbook_reverse_proxyable_services_additional_network] if matrix_playbook_reverse_proxyable_services_additional_network and matrix_bot_buscarron_container_labels_traefik_enabled else [])
    ) | unique
  }}

matrix_bot_buscarron_container_labels_traefik_enabled: "{{ matrix_playbook_traefik_labels_enabled }}"
matrix_bot_buscarron_container_labels_traefik_docker_network: "{{ matrix_playbook_reverse_proxyable_services_additional_network }}"
matrix_bot_buscarron_container_labels_traefik_entrypoints: "{{ traefik_entrypoint_primary }}"
matrix_bot_buscarron_container_labels_traefik_tls_certResolver: "{{ traefik_certResolver_primary }}"

matrix_bot_buscarron_homeserver: "{{ matrix_addons_homeserver_client_api_url }}"

# Postgres is the default, except if not using internal Postgres server
matrix_bot_buscarron_database_engine: "{{ 'postgres' if postgres_enabled else 'sqlite' }}"
matrix_bot_buscarron_database_hostname: "{{ postgres_connection_hostname if postgres_enabled else '' }}"
matrix_bot_buscarron_database_password: "{{ (matrix_homeserver_generic_secret_key + ':buscarron.bot.db') | hash('sha512') | to_uuid }}"

######################################################################
#
# /matrix-bot-buscarron
#
######################################################################


######################################################################
#
# matrix-bot-baibot
#
######################################################################

# We don't enable bots by default.
matrix_bot_baibot_enabled: false

matrix_bot_baibot_container_image_registry_prefix_upstream: "{{ matrix_container_global_registry_prefix_override if matrix_container_global_registry_prefix_override else matrix_bot_baibot_container_image_registry_prefix_upstream_default }}"

matrix_bot_baibot_container_image_self_build: "{{ matrix_architecture not in ['amd64', 'arm64'] }}"

matrix_bot_baibot_systemd_required_services_list_auto: |
  {{
    matrix_addons_homeserver_systemd_services_list
  }}

matrix_bot_baibot_config_homeserver_url: "{{ matrix_addons_homeserver_client_api_url }}"

matrix_bot_baibot_container_network: "{{ matrix_addons_container_network }}"

matrix_bot_baibot_container_additional_networks_auto: |-
  {{
    (
      ([] if matrix_addons_homeserver_container_network == '' else [matrix_addons_homeserver_container_network])
    ) | unique
  }}

######################################################################
#
# /matrix-bot-baibot
#
######################################################################

######################################################################
#
# matrix-bot-mjolnir
#
######################################################################

# We don't enable bots by default.
matrix_bot_mjolnir_enabled: false

matrix_bot_mjolnir_systemd_required_services_list_auto: |
  {{
    matrix_addons_homeserver_systemd_services_list
    +
    (['matrix-pantalaimon.service'] if matrix_bot_mjolnir_pantalaimon_use else [])
  }}

matrix_bot_mjolnir_container_image_registry_prefix_upstream: "{{ matrix_container_global_registry_prefix_override if matrix_container_global_registry_prefix_override else matrix_bot_mjolnir_container_image_registry_prefix_upstream_default }}"

matrix_bot_mjolnir_container_image_self_build: "{{ matrix_architecture != 'amd64' }}"

matrix_bot_mjolnir_container_network: "{{ matrix_addons_container_network }}"

matrix_bot_mjolnir_container_additional_networks_auto: |-
  {{
    ([] if matrix_addons_homeserver_container_network == '' else [matrix_addons_homeserver_container_network])
  }}

matrix_bot_mjolnir_homeserver_url: "{{ 'http://matrix-pantalaimon:8009' if matrix_bot_mjolnir_pantalaimon_use else matrix_addons_homeserver_client_api_url }}"
matrix_bot_mjolnir_raw_homeserver_url: "{{ matrix_addons_homeserver_client_api_url }}"
######################################################################
#
# /matrix-bot-mjolnir
#
######################################################################


######################################################################
#
# matrix-bot-draupnir
#
######################################################################

# We don't enable bots by default.
matrix_bot_draupnir_enabled: false

matrix_bot_draupnir_container_http_host_bind_port: "{{ (matrix_playbook_service_host_bind_interface_prefix ~ '8769') if matrix_playbook_service_host_bind_interface_prefix else '' }}"

matrix_bot_draupnir_systemd_required_services_list_auto: |
  {{
    matrix_addons_homeserver_systemd_services_list
    +
    (['matrix-pantalaimon.service'] if matrix_bot_draupnir_pantalaimon_use else [])
  }}

matrix_bot_draupnir_container_image_registry_prefix_upstream: "{{ matrix_container_global_registry_prefix_override if matrix_container_global_registry_prefix_override else matrix_bot_draupnir_container_image_registry_prefix_upstream_default }}"

matrix_bot_draupnir_container_image_self_build: "{{ matrix_architecture not in ['amd64', 'arm64'] }}"

matrix_bot_draupnir_container_network: "{{ matrix_addons_container_network }}"

matrix_bot_draupnir_container_additional_networks_auto: |-
  {{
    (
      ([] if matrix_addons_homeserver_container_network == '' else
        [matrix_addons_homeserver_container_network])
      +
      ([matrix_playbook_reverse_proxyable_services_additional_network] if
        (matrix_playbook_reverse_proxyable_services_additional_network and matrix_bot_draupnir_container_labels_traefik_enabled) else [])
      +
      ([matrix_pantalaimon_container_network] if (matrix_bot_draupnir_pantalaimon_use and matrix_pantalaimon_container_network != matrix_bot_draupnir_container_network) else [])
    ) | unique
  }}

matrix_bot_draupnir_config_homeserverUrl: "{{ 'http://matrix-pantalaimon:8009' if matrix_bot_draupnir_pantalaimon_use else matrix_addons_homeserver_client_api_url }}"  # noqa var-naming
matrix_bot_draupnir_config_rawHomeserverUrl: "{{ matrix_addons_homeserver_client_api_url }}"  # noqa var-naming

matrix_bot_draupnir_container_labels_traefik_enabled: "{{ matrix_bot_draupnir_config_web_enabled and matrix_playbook_reverse_proxy_type in ['playbook-managed-traefik', 'other-traefik-container'] }}"
matrix_bot_draupnir_container_labels_traefik_docker_network: "{{ matrix_playbook_reverse_proxyable_services_additional_network }}"
matrix_bot_draupnir_container_labels_web_abuseReporting_traefik_entrypoints: "{{ traefik_entrypoint_primary }}"
matrix_bot_draupnir_container_labels_web_abuseReporting_traefik_tls_certResolver: "{{ traefik_certResolver_primary }}"

#The salt is size restricted here as a maximum salt size of 16 characters exists due to the functions used.
matrix_bot_draupnir_config_web_synapseHTTPAntispam_authorization: "{{ (matrix_homeserver_generic_secret_key + ':draupnir.httpmod') | hash('sha512') | to_uuid }}" # noqa var-naming

######################################################################
#
# /matrix-bot-draupnir
#
######################################################################


######################################################################
#
# matrix-bot-meowlnir
#
######################################################################

# We don't enable bots by default.
matrix_bot_meowlnir_enabled: false

matrix_bot_meowlnir_container_http_host_bind_port: "{{ (matrix_playbook_service_host_bind_interface_prefix ~ '8772') if matrix_playbook_service_host_bind_interface_prefix else '' }}"

matrix_bot_meowlnir_systemd_required_services_list_auto: |
  {{
    matrix_addons_homeserver_systemd_services_list
    +
    ([postgres_identifier ~ '.service'] if (postgres_enabled and matrix_bot_meowlnir_database_hostname == postgres_connection_hostname) else [])
  }}

matrix_bot_meowlnir_container_image_registry_prefix_upstream: "{{ matrix_container_global_registry_prefix_override if matrix_container_global_registry_prefix_override else matrix_bot_meowlnir_container_image_registry_prefix_upstream_default }}"

matrix_bot_meowlnir_container_image_self_build: "{{ matrix_architecture not in ['amd64', 'arm64'] }}"

matrix_bot_meowlnir_container_network: "{{ matrix_addons_container_network }}"

matrix_bot_meowlnir_container_additional_networks_auto: |-
  {{
    (
      ([] if matrix_addons_homeserver_container_network == '' else
        [matrix_addons_homeserver_container_network])
      +
      ([matrix_playbook_reverse_proxyable_services_additional_network] if
        (matrix_playbook_reverse_proxyable_services_additional_network and matrix_bot_meowlnir_container_labels_traefik_enabled) else [])
      +
      ([postgres_container_network] if (postgres_enabled and matrix_bot_meowlnir_database_hostname == postgres_connection_hostname and matrix_bot_meowlnir_container_network != postgres_container_network) else [])
    ) | unique
  }}

matrix_bot_meowlnir_config_homeserver_address: "{{ matrix_addons_homeserver_client_api_url }}"
matrix_bot_meowlnir_config_homeserver_domain: "{{ matrix_domain }}"

# Provisioning bots (`ensure-matrix-users-created`) requires the homeserver to accept Meowlnir's appservice registration, which it only reads on startup.
# On the run which first enables Meowlnir, the homeserver is still running without it, so the role restarts these services to load it.
# Restarting the main service suffices even with Synapse workers, because their units declare `Requires=matrix-synapse.service` and systemd propagates the restart to them.
# Left empty for homeserver implementations whose appservice registrations the playbook does not manage (Conduit and its forks), where registration is a manual step anyway.
matrix_bot_meowlnir_homeserver_restart_systemd_services_list: "{{ ['matrix-' ~ matrix_homeserver_implementation ~ '.service'] if matrix_homeserver_implementation in ['synapse', 'dendrite'] else [] }}"

# Only consulted by bots configured with `management_room_auto_create`, and only as the
# default for those which do not carry their own `initial_managers` list.
# May legitimately be empty, in which case such bots fail validation and ask to be told who
# their initial managers should be.
matrix_bot_meowlnir_initial_managers: "{{ [matrix_admin] if matrix_admin else [] }}"

matrix_bot_meowlnir_appservice_token: "{{ (matrix_homeserver_generic_secret_key + ':meowlnir.as.token') | hash('sha512') | to_uuid }}"
matrix_bot_meowlnir_homeserver_token: "{{ (matrix_homeserver_generic_secret_key + ':meowlnir.hs.token') | hash('sha512') | to_uuid }}"
matrix_bot_meowlnir_config_meowlnir_management_secret: "{{ (matrix_homeserver_generic_secret_key + ':meowlnir.management') | hash('sha512') | to_uuid }}"
matrix_bot_meowlnir_config_meowlnir_data_secret: "{{ (matrix_homeserver_generic_secret_key + ':meowlnir.data') | hash('sha512') | to_uuid }}"
matrix_bot_meowlnir_config_antispam_secret: "{{ (matrix_homeserver_generic_secret_key + ':meowlnir.antispam') | hash('sha512') | to_uuid }}"

# Meowlnir expects a Synapse-style ed25519 private key: `<algorithm> <key ID> <unpadded-base64 32-byte seed>`.
#
# Only the seed is stored in this format — Meowlnir derives the actual keypair from it
# via `ed25519.NewKeyFromSeed`, so no elliptic curve arithmetic happens here. The 32
# hexadecimal characters sliced out of the hash below serve as the seed's 32 bytes.
#
# The key ID is cosmetic: Meowlnir always signs with the hardcoded `ed25519:policy_server`
# (see `PolicyServerKeyID` upstream), so we use a matching name to avoid confusion.
#
# Note that slicing hex text gives the seed 128 bits of entropy, not a full 256.
# That matches ed25519's own security level, so it is not a practical weakness, but you can
# override this variable with an independently generated key if you would prefer one.
matrix_bot_meowlnir_config_policy_server_signing_key: "ed25519 policy_server {{ ((matrix_homeserver_generic_secret_key + ':meowlnir.policy_server.signing_key') | hash('sha512'))[:32] | b64encode | regex_replace('=+$', '') }}"

matrix_bot_meowlnir_database_hostname: "{{ postgres_connection_hostname if postgres_enabled else '' }}"
matrix_bot_meowlnir_database_password: "{{ (matrix_homeserver_generic_secret_key + ':bot.meowlnir.db') | hash('sha512') | to_uuid }}"

matrix_bot_meowlnir_synapse_database_uri: "{{ ('postgresql://' + matrix_synapse_database_user + ':' + matrix_synapse_database_password + '@' + matrix_synapse_database_host + ':' + (matrix_synapse_database_port | string) + '/' + matrix_synapse_database_database + '?sslmode=disable') if (matrix_bot_meowlnir_synapse_database_integration_enabled and matrix_synapse_enabled) else '' }}"

matrix_bot_meowlnir_container_labels_traefik_enabled: "{{ (matrix_bot_meowlnir_config_reporting_enabled or matrix_bot_meowlnir_policy_server_enabled) and matrix_playbook_reverse_proxy_type in ['playbook-managed-traefik', 'other-traefik-container'] }}"
matrix_bot_meowlnir_container_labels_traefik_docker_network: "{{ matrix_playbook_reverse_proxyable_services_additional_network }}"
matrix_bot_meowlnir_container_labels_reporting_traefik_entrypoints: "{{ traefik_entrypoint_primary }}"
matrix_bot_meowlnir_container_labels_reporting_traefik_tls_certResolver: "{{ traefik_certResolver_primary }}"  # noqa var-naming
matrix_bot_meowlnir_container_labels_policy_server_traefik_entrypoints: "{{ traefik_entrypoint_primary }}"
matrix_bot_meowlnir_container_labels_policy_server_traefik_tls_certResolver: "{{ traefik_certResolver_primary }}"  # noqa var-naming

######################################################################
#
# /matrix-bot-meowlnir
#
######################################################################


######################################################################
#
# matrix-appservice-draupnir-for-all
#
######################################################################

# We don't enable bots by default.
matrix_appservice_draupnir_for_all_enabled: false

matrix_appservice_draupnir_for_all_systemd_required_services_list_auto: |
  {{
    matrix_addons_homeserver_systemd_services_list
    +
    ([postgres_identifier ~ '.service'] if (postgres_enabled and matrix_appservice_draupnir_for_all_database_hostname == postgres_connection_hostname) else [])
  }}

matrix_appservice_draupnir_for_all_container_image_registry_prefix_upstream: "{{ matrix_container_global_registry_prefix_override if matrix_container_global_registry_prefix_override else matrix_appservice_draupnir_for_all_container_image_registry_prefix_upstream_default }}"

matrix_appservice_draupnir_for_all_container_image_self_build: "{{ matrix_architecture not in ['amd64', 'arm64'] }}"

matrix_appservice_draupnir_for_all_container_network: "{{ matrix_addons_container_network }}"

matrix_appservice_draupnir_for_all_container_additional_networks_auto: |-
  {{
    (
      ([] if matrix_addons_homeserver_container_network == '' else [matrix_addons_homeserver_container_network])
      +
      ([postgres_container_network] if (postgres_enabled and matrix_appservice_draupnir_for_all_database_hostname == postgres_connection_hostname and matrix_appservice_draupnir_for_all_container_network != postgres_container_network) else [])
    ) | unique
  }}

matrix_appservice_draupnir_for_all_appservice_token: "{{ (matrix_homeserver_generic_secret_key + ':d4a.as.token') | hash('sha512') | to_uuid }}"
matrix_appservice_draupnir_for_all_homeserver_token: "{{ (matrix_homeserver_generic_secret_key + ':d4a.hs.token') | hash('sha512') | to_uuid }}"

matrix_appservice_draupnir_for_all_database_hostname: "{{ postgres_connection_hostname if postgres_enabled else '' }}"
matrix_appservice_draupnir_for_all_database_password: "{{ (matrix_homeserver_generic_secret_key + ':as.d4a.db') | hash('sha512') | to_uuid }}"

######################################################################
#
# /matrix-appservice-draupnir-for-all
#
######################################################################


######################################################################
#
# matrix-appservice-double-puppet
#
######################################################################

matrix_appservice_double_puppet_enabled: false

matrix_appservice_double_puppet_registration_as_token: "{{ (matrix_homeserver_generic_secret_key + ':as.doub.pup') | hash('sha512') | to_uuid }}"
matrix_appservice_double_puppet_registration_hs_token: "{{ (matrix_homeserver_generic_secret_key + ':hs.doub.pup') | hash('sha512') | to_uuid }}"

######################################################################
#
# /matrix-appservice-double-puppet
#
######################################################################


######################################################################
#
# matrix-pantalaimon
#
######################################################################

matrix_pantalaimon_enabled: false

matrix_pantalaimon_systemd_required_services_list_auto: |
  {{
    matrix_addons_homeserver_systemd_services_list
  }}

matrix_pantalaimon_container_image_registry_prefix_upstream: "{{ matrix_container_global_registry_prefix_override if matrix_container_global_registry_prefix_override else matrix_pantalaimon_container_image_registry_prefix_upstream_default }}"

matrix_pantalaimon_container_network: "{{ matrix_homeserver_container_network }}"

matrix_pantalaimon_container_image_self_build: "{{ matrix_architecture not in ['amd64'] }}"

matrix_pantalaimon_homeserver_url: "{{ matrix_addons_homeserver_client_api_url }}"

######################################################################
#
# /matrix-pantalaimon
#
######################################################################


######################################################################
#
# etke/backup_borg
#
######################################################################

backup_borg_enabled: false
backup_borg_mariadb_enabled: false
backup_borg_mysql_enabled: false
backup_borg_mongodb_enabled: false

backup_borg_identifier: matrix-backup-borg
backup_borg_storage_archive_name_format: matrix-{now:%Y-%m-%d-%H%M%S}

backup_borg_base_path: "{{ matrix_base_data_path }}/backup-borg"

backup_borg_username: "{{ matrix_user_name }}"
backup_borg_uid: "{{ matrix_user_uid }}"
backup_borg_gid: "{{ matrix_user_gid }}"

backup_borg_container_image_registry_prefix_upstream: "{{ matrix_container_global_registry_prefix_override if matrix_container_global_registry_prefix_override else backup_borg_container_image_registry_prefix_upstream_default }}"

backup_borg_container_network: "{{ postgres_container_network if postgres_enabled else backup_borg_identifier }}"

backup_borg_postgresql_version_detection_postgres_role_name: "{{ 'galaxy/postgres' if postgres_enabled else '' }}"

backup_borg_container_image_self_build: "{{ matrix_architecture not in ['amd64', 'arm32', 'arm64'] }}"

backup_borg_postgresql_enabled: "{{ postgres_enabled }}"
backup_borg_postgresql_databases_hostname: "{{ postgres_connection_hostname if postgres_enabled else '' }}"
backup_borg_postgresql_databases_username: "{{ postgres_connection_username if postgres_enabled else '' }}"
backup_borg_postgresql_databases_password: "{{ postgres_connection_password if postgres_enabled else '' }}"
backup_borg_postgresql_databases_port: "{{ postgres_connection_port if postgres_enabled else 5432 }}"
backup_borg_postgresql_databases_auto: "{{ postgres_managed_databases | map(attribute='name') if postgres_enabled else [] }}"

backup_borg_location_source_directories_auto:
  - "{{ matrix_base_data_path }}"

# local_thumbnails is deliberately NOT excluded: with dynamic_thumbnails disabled (Synapse's default),
# nothing regenerates lost thumbnails, so the official Synapse backup guide recommends backing them up.
backup_borg_location_exclude_patterns_auto: |
  {{
    ([matrix_synapse_media_store_path + '/remote_content', matrix_synapse_media_store_path + '/remote_thumbnail', matrix_synapse_media_store_path + '/url_cache', matrix_synapse_media_store_path + '/url_cache_thumbnails'] if matrix_homeserver_implementation == 'synapse' else [])
    +
    ([postgres_data_path] if postgres_enabled else [])
  }}

backup_borg_systemd_required_services_list: |
  {{
    [devture_systemd_docker_base_docker_service_name]
    +
    ([postgres_identifier ~ '.service'] if postgres_enabled else [])
  }}

######################################################################
#
# /etke/backup_borg
#
######################################################################


######################################################################
#
# matrix-cactus-comments
#
######################################################################

matrix_cactus_comments_enabled: false

matrix_cactus_comments_systemd_required_services_list_auto: |
  {{
    matrix_addons_homeserver_systemd_services_list
  }}

matrix_cactus_comments_container_image_registry_prefix_upstream: "{{ matrix_container_global_registry_prefix_override if matrix_container_global_registry_prefix_override else matrix_cactus_comments_container_image_registry_prefix_upstream_default }}"

matrix_cactus_comments_container_image_self_build: "{{ matrix_architecture not in ['amd64'] }}"

matrix_cactus_comments_container_network: "{{ matrix_addons_container_network }}"

matrix_cactus_comments_container_additional_networks_auto: |-
  {{
    ([] if matrix_addons_homeserver_container_network == '' else [matrix_addons_homeserver_container_network])
  }}

matrix_cactus_comments_as_token: "{{ (matrix_homeserver_generic_secret_key + ':cactus.as.token') | hash('sha512') | to_uuid }}"
matrix_cactus_comments_hs_token: "{{ (matrix_homeserver_generic_secret_key + ':cactus.hs.token') | hash('sha512') | to_uuid }}"

matrix_cactus_comments_homeserver_url: "{{ matrix_addons_homeserver_client_api_url }}"

######################################################################
#
# /matrix-cactus-comments
#
######################################################################

######################################################################
#
# matrix-cactus-comments-client
#
######################################################################

matrix_cactus_comments_client_enabled: "{{ matrix_cactus_comments_enabled }}"

matrix_cactus_comments_client_hostname: "{{ matrix_server_fqn_matrix }}"

matrix_cactus_comments_client_container_image_registry_prefix_upstream: "{{ matrix_container_global_registry_prefix_override if matrix_container_global_registry_prefix_override else matrix_cactus_comments_client_container_image_registry_prefix_upstream_default }}"

matrix_cactus_comments_client_container_network: "{{ matrix_addons_container_network }}"

matrix_cactus_comments_client_container_additional_networks_auto: |-
  {{
    (
      ([matrix_playbook_reverse_proxyable_services_additional_network] if (matrix_playbook_reverse_proxyable_services_additional_network and matrix_cactus_comments_client_container_labels_traefik_enabled) else [])
    ) | unique
  }}

matrix_cactus_comments_client_container_labels_traefik_enabled: "{{ matrix_playbook_reverse_proxy_type in ['playbook-managed-traefik', 'other-traefik-container'] }}"
matrix_cactus_comments_client_container_labels_traefik_docker_network: "{{ matrix_playbook_reverse_proxyable_services_additional_network }}"
matrix_cactus_comments_client_container_labels_traefik_entrypoints: "{{ traefik_entrypoint_primary }}"
matrix_cactus_comments_client_container_labels_traefik_tls_certResolver: "{{ traefik_certResolver_primary }}"

######################################################################
#
# /matrix-cactus-comments-client
#
######################################################################

######################################################################
#
# matrix-corporal
#
######################################################################

matrix_corporal_enabled: false

matrix_corporal_systemd_required_services_list_auto: |
  {{
    (['matrix-' + matrix_homeserver_implementation + '.service'])
  }}

matrix_corporal_container_image_registry_prefix_upstream: "{{ matrix_container_global_registry_prefix_override if matrix_container_global_registry_prefix_override else matrix_corporal_container_image_registry_prefix_upstream_default }}"

matrix_corporal_container_image_self_build: "{{ matrix_architecture not in ['amd64', 'arm64'] }}"

matrix_corporal_container_http_gateway_host_bind_port: "{{ (matrix_playbook_service_host_bind_interface_prefix ~ '41080') if matrix_playbook_service_host_bind_interface_prefix else '' }}"
matrix_corporal_container_http_api_host_bind_port: "{{ (matrix_playbook_service_host_bind_interface_prefix ~ '41081') if matrix_playbook_service_host_bind_interface_prefix else '' }}"

matrix_corporal_container_network: matrix-corporal

matrix_corporal_container_additional_networks: |
  {{
    (
      ([matrix_playbook_reverse_proxyable_services_additional_network] if matrix_playbook_reverse_proxyable_services_additional_network else [])
      +
      ([matrix_homeserver_container_network] if matrix_corporal_container_network != matrix_homeserver_container_network else [])
    ) | unique
  }}

matrix_corporal_container_labels_traefik_enabled: "{{ matrix_playbook_reverse_proxy_type in ['playbook-managed-traefik', 'other-traefik-container'] }}"
matrix_corporal_container_labels_traefik_docker_network: "{{ matrix_playbook_reverse_proxyable_services_additional_network }}"
matrix_corporal_container_labels_traefik_entrypoints: "{{ traefik_entrypoint_primary }}"
matrix_corporal_container_labels_traefik_tls_certResolver: "{{ traefik_certResolver_primary }}"

matrix_corporal_matrix_homeserver_scheme: "{{ 'https' if matrix_playbook_ssl_enabled else 'http' }}"

matrix_corporal_matrix_homeserver_api_endpoint: "{{ matrix_homeserver_container_url }}"

matrix_corporal_matrix_auth_shared_secret: "{{ matrix_synapse_ext_password_provider_shared_secret_auth_shared_secret }}"

# This is only useful if there's REST auth provider to make use of it.
matrix_corporal_http_gateway_internal_rest_auth_enabled: "{{ matrix_synapse_ext_password_provider_rest_auth_enabled }}"

matrix_corporal_matrix_registration_shared_secret: "{{ matrix_synapse_registration_shared_secret }}"

######################################################################
#
# /matrix-corporal
#
######################################################################

######################################################################
#
# matrix-matrixto
#
######################################################################

# We don't enable matrixto by default.
matrix_matrixto_enabled: false

matrix_matrixto_base_path: "{{ matrix_base_data_path }}/matrixto"

# The container image is not provided at https://github.com/matrix-org/matrix.to
matrix_matrixto_container_image_self_build: true

matrix_matrixto_hostname: "{{ matrix_server_fqn_matrixto }}"

matrix_matrixto_container_network: matrix-matrixto

matrix_matrixto_container_additional_networks: "{{ [matrix_playbook_reverse_proxyable_services_additional_network] if matrix_playbook_reverse_proxyable_services_additional_network else [] }}"

matrix_matrixto_container_http_host_bind_port: "{{ (matrix_playbook_service_host_bind_interface_prefix ~ '5000') if matrix_playbook_service_host_bind_interface_prefix else '' }}"

matrix_matrixto_container_labels_traefik_enabled: "{{ matrix_playbook_traefik_labels_enabled }}"
matrix_matrixto_container_labels_traefik_docker_network: "{{ matrix_playbook_reverse_proxyable_services_additional_network }}"
matrix_matrixto_container_labels_traefik_entrypoints: "{{ traefik_entrypoint_primary }}"
matrix_matrixto_container_labels_traefik_tls_certResolver: "{{ traefik_certResolver_primary }}"

######################################################################
#
# /matrix-matrixto
#
######################################################################

######################################################################
#
# matrix-rageshake
#
######################################################################

# We don't enable rageshake by default.
matrix_rageshake_enabled: false

matrix_rageshake_container_image_self_build: "{{ matrix_architecture not in ['amd64'] }}"

matrix_rageshake_hostname: "{{ matrix_server_fqn_rageshake }}"

matrix_rageshake_container_image_registry_prefix_upstream: "{{ matrix_container_global_registry_prefix_override if matrix_container_global_registry_prefix_override else matrix_rageshake_container_image_registry_prefix_upstream_default }}"

matrix_rageshake_container_additional_networks: "{{ [matrix_playbook_reverse_proxyable_services_additional_network] if matrix_playbook_reverse_proxyable_services_additional_network else [] }}"

matrix_rageshake_container_http_host_bind_port: "{{ (matrix_playbook_service_host_bind_interface_prefix ~ '9110') if matrix_playbook_service_host_bind_interface_prefix else '' }}"

matrix_rageshake_container_labels_traefik_enabled: "{{ matrix_playbook_traefik_labels_enabled }}"
matrix_rageshake_container_labels_traefik_docker_network: "{{ matrix_playbook_reverse_proxyable_services_additional_network }}"
matrix_rageshake_container_labels_traefik_entrypoints: "{{ traefik_entrypoint_primary }}"
matrix_rageshake_container_labels_traefik_tls_certResolver: "{{ traefik_certResolver_primary }}"

######################################################################
#
# /matrix-rageshake
#
######################################################################

######################################################################
#
# coturn
#
######################################################################

# Coturn is enabled by default only when Jitsi is enabled because Jitsi still
# depends on legacy TURN integration for compatibility.
coturn_enabled: "{{ jitsi_enabled | bool }}"

coturn_identifier: matrix-coturn

coturn_base_path: "{{ matrix_base_data_path }}/coturn"

coturn_uid: "{{ matrix_user_uid }}"
coturn_gid: "{{ matrix_user_gid }}"

coturn_hostname: "{{ matrix_server_fqn_matrix }}"

coturn_container_image_registry_prefix: "{{ 'localhost/' if coturn_container_image_self_build else coturn_container_image_registry_prefix_upstream }}"
coturn_container_image_registry_prefix_upstream: "{{ matrix_container_global_registry_prefix_override if matrix_container_global_registry_prefix_override else coturn_container_image_registry_prefix_upstream_default }}"

coturn_container_image_self_build: "{{ matrix_architecture not in ['amd64', 'arm32', 'arm64'] }}"

# By default, we use the official public instance.
coturn_turn_external_ip_address_auto_detection_echoip_service_url: https://ifconfig.co/json

coturn_turn_static_auth_secret: "{{ ((matrix_homeserver_generic_secret_key + ':coturn.sas') | hash('sha512') | to_uuid) if coturn_authentication_method == 'auth-secret' else '' }}"

coturn_lt_cred_mech_username: "{{ ((matrix_homeserver_generic_secret_key + ':coturn.user') | hash('sha512') | to_uuid) if coturn_authentication_method == 'lt-cred-mech' else '' }}"
coturn_lt_cred_mech_password: "{{ ((matrix_homeserver_generic_secret_key + ':coturn.pass') | hash('sha512') | to_uuid) if coturn_authentication_method == 'lt-cred-mech' else '' }}"

coturn_tls_enabled: "{{ matrix_playbook_ssl_enabled }}"

coturn_tls_cert_path: |-
  {{
    {
      'playbook-managed-traefik': ('/certificate.crt' if traefik_certs_dumper_enabled else ''),
      'other-traefik-container': ('/certificate.crt' if traefik_certs_dumper_enabled else ''),
      'none': '',
    }[matrix_playbook_reverse_proxy_type]
  }}

coturn_tls_key_path: |-
  {{
    {
      'playbook-managed-traefik': ('/privatekey.key' if traefik_certs_dumper_enabled else ''),
      'other-traefik-container': ('/privatekey.key' if traefik_certs_dumper_enabled else ''),
      'none': '',
    }[matrix_playbook_reverse_proxy_type]
  }}

coturn_container_additional_volumes: |
  {{
    (
      [
       {
         'src': (traefik_certs_dumper_dumped_certificates_path +  '/' + coturn_hostname + '/certificate.crt'),
         'dst': '/certificate.crt',
         'options': 'ro',
       },
       {
         'src': (traefik_certs_dumper_dumped_certificates_path +  '/' + coturn_hostname + '/privatekey.key'),
         'dst': '/privatekey.key',
         'options': 'ro',
       },
      ] if (matrix_playbook_reverse_proxy_type in ['playbook-managed-traefik', 'other-traefik-container'] and traefik_certs_dumper_enabled and coturn_tls_enabled and (coturn_tls_cert_path and coturn_tls_key_path)) else []
    )
  }}

coturn_systemd_required_services_list_auto: |
  {{
    ([traefik_certs_dumper_identifier + '-wait-for-domain@' + coturn_hostname + '.service'] if matrix_playbook_reverse_proxy_type in ['playbook-managed-traefik', 'other-traefik-container'] and traefik_certs_dumper_enabled and coturn_tls_enabled else [])
  }}

######################################################################
#
# /coturn
#
######################################################################

######################################################################
#
# etherpad
#
######################################################################

etherpad_enabled: false

etherpad_identifier: matrix-etherpad

etherpad_scheme: "{{ 'https' if matrix_playbook_ssl_enabled else 'http' }}"

etherpad_base_path: "{{ matrix_base_data_path }}/etherpad"

etherpad_uid: "{{ matrix_user_uid }}"
etherpad_gid: "{{ matrix_user_gid }}"

etherpad_framing_enabled: "{{ jitsi_enabled }}"

etherpad_hostname: "{{ matrix_server_fqn_etherpad }}"

etherpad_container_image_registry_prefix_upstream: "{{ matrix_container_global_registry_prefix_override if matrix_container_global_registry_prefix_override else etherpad_container_image_registry_prefix_upstream_default }}"

etherpad_container_image_self_build: "{{ matrix_architecture not in ['amd64'] }}"

etherpad_container_http_host_bind_port: "{{ (matrix_playbook_service_host_bind_interface_prefix ~ '9001') if matrix_playbook_service_host_bind_interface_prefix else '' }}"

etherpad_container_network: "{{ matrix_addons_container_network }}"

etherpad_container_additional_networks_auto: |
  {{
    (
      ([matrix_playbook_reverse_proxyable_services_additional_network] if matrix_playbook_reverse_proxyable_services_additional_network else [])
      +
      ([postgres_container_network] if postgres_enabled and postgres_container_network != etherpad_container_network else [])
    ) | unique
  }}

etherpad_container_labels_traefik_enabled: "{{ matrix_playbook_reverse_proxy_type in ['playbook-managed-traefik', 'other-traefik-container'] }}"
etherpad_container_labels_traefik_docker_network: "{{ matrix_playbook_reverse_proxyable_services_additional_network }}"
etherpad_container_labels_traefik_entrypoints: "{{ traefik_entrypoint_primary }}"
etherpad_container_labels_traefik_tls_certResolver: "{{ traefik_certResolver_primary }}"

etherpad_systemd_required_services_list_auto: |
  {{
    ([postgres_identifier ~ '.service'] if postgres_enabled else [])
  }}

etherpad_database_postgres_hostname: "{{ postgres_connection_hostname if postgres_enabled else '' }}"
etherpad_database_name: matrix_etherpad
etherpad_database_postgres_username: matrix_etherpad
etherpad_database_postgres_password: "{{ (matrix_homeserver_generic_secret_key + ':etherpad.db') | hash('sha512') | to_uuid }}"

######################################################################
#
# /etherpad
#
######################################################################

######################################################################
#
# ddclient
#
######################################################################

ddclient_enabled: false

ddclient_identifier: matrix-dynamic-dns

ddclient_base_path: "{{ matrix_base_data_path }}/dynamic-dns"

ddclient_uid: "{{ matrix_user_uid }}"
ddclient_gid: "{{ matrix_user_gid }}"

ddclient_container_image_registry_prefix: "{{ 'localhost/' if ddclient_container_image_self_build else ddclient_container_image_registry_prefix_upstream }}"
ddclient_container_image_registry_prefix_upstream: "{{ matrix_container_global_registry_prefix_override if matrix_container_global_registry_prefix_override else ddclient_container_image_registry_prefix_upstream_default }}"

ddclient_web: "https://cloudflare.com/cdn-cgi/trace"

ddclient_web_skip: "ip="

######################################################################
#
# /ddclient
#
######################################################################

######################################################################
#
# jitsi
#
######################################################################

jitsi_enabled: false

jitsi_architecture: "{{ matrix_architecture }}"

jitsi_hostname: "{{ matrix_server_fqn_jitsi }}"

jitsi_identifier: matrix-jitsi

jitsi_base_path: "{{ matrix_base_data_path }}/jitsi"

jitsi_uid: "{{ matrix_user_uid }}"
jitsi_gid: "{{ matrix_user_gid }}"

jitsi_user_username: "{{ matrix_user_name }}"

jitsi_web_container_image_registry_prefix_upstream: "{{ matrix_container_global_registry_prefix_override if matrix_container_global_registry_prefix_override else jitsi_web_container_image_registry_prefix_upstream_default }}"

jitsi_web_container_http_host_bind_port: "{{ (matrix_playbook_service_host_bind_interface_prefix ~ '13080') if matrix_playbook_service_host_bind_interface_prefix else '' }}"

jitsi_web_container_additional_networks_auto: |
  {{
    ([matrix_playbook_reverse_proxyable_services_additional_network] if matrix_playbook_reverse_proxyable_services_additional_network else [])
  }}

jitsi_jvb_container_image_registry_prefix_upstream: "{{ matrix_container_global_registry_prefix_override if matrix_container_global_registry_prefix_override else jitsi_jvb_container_image_registry_prefix_upstream_default }}"

jitsi_jvb_container_additional_networks_auto: |
  {{
    ([matrix_playbook_reverse_proxyable_services_additional_network] if matrix_playbook_reverse_proxyable_services_additional_network else [])
  }}

jitsi_prosody_container_image_registry_prefix_upstream: "{{ matrix_container_global_registry_prefix_override if matrix_container_global_registry_prefix_override else jitsi_prosody_container_image_registry_prefix_upstream_default }}"

jitsi_prosody_container_http_host_bind_port: "{{ (matrix_playbook_service_host_bind_interface_prefix ~ '5280') if matrix_playbook_service_host_bind_interface_prefix else '' }}"

jitsi_prosody_container_additional_networks_auto: |
  {{
    ([matrix_playbook_reverse_proxyable_services_additional_network] if matrix_playbook_reverse_proxyable_services_additional_network else [])
  }}

jitsi_jicofo_container_image_registry_prefix_upstream: "{{ matrix_container_global_registry_prefix_override if matrix_container_global_registry_prefix_override else jitsi_jicofo_container_image_registry_prefix_upstream_default }}"

jitsi_container_labels_traefik_enabled: "{{ matrix_playbook_traefik_labels_enabled }}"
jitsi_container_labels_traefik_docker_network: "{{ matrix_playbook_reverse_proxyable_services_additional_network }}"
jitsi_container_labels_traefik_entrypoints: "{{ traefik_entrypoint_primary }}"
jitsi_container_labels_traefik_tls_certResolver: "{{ traefik_certResolver_primary }}"

jitsi_jibri_xmpp_password: "{{ (matrix_homeserver_generic_secret_key + ':jibri') | hash('sha512') | to_uuid }}"
jitsi_jicofo_auth_password: "{{ (matrix_homeserver_generic_secret_key + ':jicofo') | hash('sha512') | to_uuid }}"
jitsi_jvb_auth_password: "{{ (matrix_homeserver_generic_secret_key + ':jvb') | hash('sha512') | to_uuid }}"

jitsi_web_stun_servers: |
  {{
    [
      'stun:' + matrix_server_fqn_matrix + ':5349',
      'stun:' + matrix_server_fqn_matrix + ':3478',
    ]
    if coturn_enabled
    else [ 'stun:meet-jit-si-turnrelay.jitsi.net:443']
  }}

# The Jitsi instance installed by this playbook is meant for embedding into Matrix clients, so framing is allowed.
jitsi_web_framing_enabled: true

# Jitsi (Prosody) only seems to support authenticating with coturn using `auth-secret`, not `lt-cred-mech`.
# See: https://prosody.im/doc/coturn
jitsi_turn_credentials: "{{ coturn_turn_static_auth_secret if (coturn_enabled and coturn_authentication_method == 'auth-secret') else '' }}"
jitsi_turn_host: "{{ ('turn.' + matrix_server_fqn_matrix) if coturn_enabled else '' }}"
jitsi_turns_host: "{{ ('turn.' + matrix_server_fqn_matrix) if coturn_enabled else '' }}"
jitsi_turn_port: "{{ coturn_container_stun_plain_host_bind_port_tcp.split(':')[-1] if coturn_enabled else '' }}"
jitsi_turns_port: "{{ coturn_container_stun_tls_host_bind_port_tcp.split(':')[-1] if coturn_enabled else '' }}"

# If the self-hosted Etherpad instance is available, it will also show up in Jitsi conferences,
# unless explicitly disabled by setting `jitsi_etherpad_enabled` to false.
# Falls back to the scalar.vector.im etherpad in case someone sets `jitsi_etherpad_enabled` to true,
# while also setting `etherpad_enabled` to false.
jitsi_etherpad_enabled: "{{ etherpad_enabled }}"
# The trailing slash is stripped, because the Jitsi role appends path segments (e.g. `/p/`) itself
# and `etherpad_base_url` ends with a slash, which would otherwise produce double-slash URLs.
jitsi_etherpad_base: "{{ (etherpad_base_url | regex_replace('/+$', '')) if etherpad_enabled else 'https://scalar.vector.im/etherpad' }}"

# Allow verification using JWT and matrix-UVS
jitsi_prosody_auth_matrix_uvs_sync_power_levels: "{{ matrix_user_verification_service_enabled }}"
jitsi_prosody_auth_matrix_uvs_auth_token: "{{ matrix_user_verification_service_uvs_auth_token }}"
jitsi_prosody_auth_matrix_uvs_location: "{{ matrix_user_verification_service_container_url }}"

jitsi_self_check_validate_certificates: "{{ matrix_playbook_ssl_enabled }}"

# Gravatar is enabled by default upstream, but there's no need to leak data there needlessly
# when embedding Jitsi in Matrix rooms.
jitsi_disable_gravatar: true

######################################################################
#
# /jitsi
#
######################################################################

########################################################################
#                                                                      #
# exim-relay                                                           #
#                                                                      #
########################################################################

# We set up an Exim email relay by default.
# This is so that the homeserver and various other services can send emails through it.
# To completely disable this service, use: `exim_relay_enabled: false`

exim_relay_identifier: "matrix-exim-relay"

exim_relay_base_path: "{{ matrix_base_data_path }}/exim-relay"

exim_relay_uid: "{{ matrix_user_uid }}"
exim_relay_gid: "{{ matrix_user_gid }}"

exim_relay_hostname: "{{ matrix_server_fqn_matrix }}"

exim_relay_sender_address: "matrix@{{ exim_relay_hostname }}"

exim_relay_container_image_registry_prefix_upstream: "{{ matrix_container_global_registry_prefix_override if matrix_container_global_registry_prefix_override else exim_relay_container_image_registry_prefix_upstream_default }}"

exim_relay_container_image_self_build: "{{ matrix_architecture not in ['amd64', 'arm32', 'arm64'] }}"

########################################################################
#                                                                      #
# /exim-relay                                                          #
#                                                                      #
########################################################################

######################################################################
#
# matrix-media-repo
#
######################################################################

matrix_media_repo_enabled: false

matrix_media_repo_container_image_registry_prefix_upstream: "{{ matrix_container_global_registry_prefix_override if matrix_container_global_registry_prefix_override else matrix_media_repo_container_image_registry_prefix_upstream_default }}"

matrix_media_repo_container_network: "{{ matrix_homeserver_container_network }}"

matrix_media_repo_container_additional_networks: |
  {{
    (
      ([matrix_homeserver_container_network] if (matrix_media_repo_container_network != matrix_homeserver_container_network) else [])
      +
      ([postgres_container_network] if (postgres_enabled and matrix_media_repo_database_hostname == postgres_connection_hostname and postgres_container_network != matrix_media_repo_container_network) else [])
      +
      ([matrix_playbook_reverse_proxyable_services_additional_network] if (matrix_playbook_reverse_proxyable_services_additional_network and matrix_media_repo_container_labels_traefik_enabled) else [])
      +
      ([valkey_container_network] if valkey_enabled and matrix_media_repo_redis_enabled else [])
    ) | unique
  }}

matrix_media_repo_container_labels_traefik_enabled: "{{ matrix_playbook_traefik_labels_enabled }}"
matrix_media_repo_container_labels_traefik_docker_network: "{{ matrix_playbook_reverse_proxyable_services_additional_network }}"
matrix_media_repo_container_labels_traefik_entrypoints: "{{ traefik_entrypoint_primary }}"
matrix_media_repo_container_labels_traefik_tls_certResolver: "{{ traefik_certResolver_primary }}"

matrix_media_repo_container_labels_traefik_internal_media_enabled: "{{ matrix_playbook_internal_matrix_client_api_traefik_entrypoint_enabled }}"
matrix_media_repo_container_labels_traefik_internal_media_entrypoints: "{{ matrix_playbook_internal_matrix_client_api_traefik_entrypoint_name }}"

matrix_media_repo_container_labels_traefik_internal_matrix_client_media_enabled: "{{ matrix_playbook_internal_matrix_client_api_traefik_entrypoint_enabled }}"
matrix_media_repo_container_labels_traefik_internal_matrix_client_media_entrypoints: "{{ matrix_playbook_internal_matrix_client_api_traefik_entrypoint_name }}"

matrix_media_repo_metrics_proxying_enabled: "{{ matrix_media_repo_metrics_enabled and matrix_metrics_exposure_enabled }}"
matrix_media_repo_metrics_proxying_hostname: "{{ matrix_metrics_exposure_hostname }}"
matrix_media_repo_metrics_proxying_path: "{{ matrix_metrics_exposure_path_prefix }}/matrix-media-repo"
matrix_media_repo_container_labels_traefik_metrics_middleware_basic_auth_enabled: "{{ matrix_metrics_exposure_http_basic_auth_enabled }}"
matrix_media_repo_container_labels_traefik_metrics_middleware_basic_auth_users: "{{ matrix_metrics_exposure_http_basic_auth_users }}"

matrix_media_repo_database_hostname: "{{ postgres_connection_hostname if postgres_enabled else '' }}"
matrix_media_repo_database_username: matrix_media_repo
matrix_media_repo_database_password: "{{ (matrix_homeserver_generic_secret_key + ':mediarepo.db') | hash('sha512') | to_uuid }}"
matrix_media_repo_database_name: matrix_media_repo

matrix_media_repo_systemd_required_services_list_auto: |
  {{
    matrix_addons_homeserver_systemd_services_list
    +
    ([postgres_identifier ~ '.service'] if postgres_enabled and matrix_media_repo_database_hostname == postgres_connection_hostname else [])
  }}

matrix_media_repo_generate_signing_key: "{{ matrix_homeserver_implementation == 'synapse' or matrix_homeserver_implementation == 'dendrite'}}"
matrix_media_repo_homeserver_signing_key: "{{ matrix_media_repo_synapse_signing_key if matrix_homeserver_implementation == 'synapse' else (matrix_media_repo_dendrite_signing_key if matrix_homeserver_implementation == 'dendrite' else '') }}"
matrix_media_repo_synapse_signing_key: "{{ matrix_synapse_config_dir_path }}/{{ matrix_server_fqn_matrix }}.signing.key"
matrix_media_repo_dendrite_signing_key: "{{ matrix_dendrite_config_dir_path }}/{{ matrix_server_fqn_matrix }}.signing.pem"

# Auto configured server setup by the playbook
matrix_media_repo_homeservers_auto:
  -  # Keep the dash from this line.

    # This should match the server_name of your homeserver, and the Host header
    # provided to the media repo.
    name: "{{ matrix_domain }}"

    # The base URL to where the homeserver can actually be reached by MMR.
    csApi: "{{ matrix_homeserver_container_url }}"

    # The number of consecutive failures in calling this homeserver before the
    # media repository will start backing off. This defaults to 10 if not given.
    backoffAt: 10

    # The admin API interface supported by the homeserver. MMR uses a subset of the admin API
    # during certain operations, like attempting to purge media from a room or validating server
    # admin status. This should be set to one of "synapse", "dendrite", or "matrix". When set
    # to "matrix", most functionality requiring the admin API will not work.
    adminApiKind: "{{ 'synapse' if matrix_homeserver_implementation == 'synapse' else ('dendrite' if matrix_homeserver_implementation == 'dendrite' else 'matrix') }}"

    # The signing key to use for authorizing outbound federation requests. If not specified,
    # requests will not be authorized. See https://docs.t2bot.io/matrix-media-repo/v1.3.5/installation/signing-key/
    # for details.
    signingKeyPath: "{{ '/config/' + matrix_media_repo_identifier + '.signing.key' if matrix_media_repo_generate_signing_key else '' }}"

matrix_media_repo_homeserver_federation_enabled: "{{ matrix_homeserver_federation_enabled }}"

matrix_media_repo_redis_enabled: "{{ valkey_enabled }}"

# Use next redis index since Synapse is on 0. You can chose between index 0 and 15.
matrix_media_repo_redis_database_number: 1

matrix_media_repo_redis_shards: |
  {{
    ([{
          'name': 'valkey',
          'addr': (valkey_identifier + ':' + valkey_container_tcp_port | string),
    }])
    if valkey_enabled and matrix_media_repo_redis_enabled
    else []
  }}

######################################################################
#
# /matrix-media-repo
#
######################################################################


########################################################################
#                                                                      #
# postgres                                                             #
#                                                                      #
########################################################################

# To completely disable installing Postgres, use `postgres_enabled: false`.

postgres_identifier: matrix-postgres

postgres_architecture: "{{ matrix_architecture }}"

postgres_base_path: "{{ matrix_base_data_path }}/postgres"

postgres_uid: "{{ matrix_user_uid }}"
postgres_gid: "{{ matrix_user_gid }}"

postgres_allowed_versions_auto: "{{ backup_borg_supported_postgres_versions | map('int') if backup_borg_enabled | default(false) and backup_borg_postgresql_enabled | default(false) else [] }}"

postgres_connection_username: matrix
postgres_db_name: matrix

postgres_systemd_services_to_stop_for_maintenance_list_auto: "{{ devture_systemd_service_manager_services_list_auto | map(attribute='name') | reject('equalto', (postgres_identifier + '.service')) }}"

# When Synapse workers are enabled, connection demand grows with the number of Synapse processes:
# each process (the main one and every worker) maintains its own connection pool of up to `matrix_synapse_database_cp_max` connections.
# The formula below reserves a 200-connection baseline for everything else talking to Postgres and adds `cp_max` per Synapse process.
# It never goes below 500, the fixed value used previously, so existing worker setups are not downsized.
# Note: the worker count reflects the `matrix_synapse_workers_*_count` variables.
# If you populate `matrix_synapse_workers_enabled_list` manually, consider overriding `postgres_max_connections` yourself.
postgres_max_connections: "{{ [200 + (matrix_synapse_database_cp_max | int) * ((matrix_synapse_workers_total_count | int) + 1), 500] | max if matrix_synapse_workers_enabled else 200 }}"

postgres_container_image_registry_prefix_upstream: "{{ matrix_container_global_registry_prefix_override if matrix_container_global_registry_prefix_override else postgres_container_image_registry_prefix_upstream_default }}"

postgres_pgloader_container_image_registry_prefix_upstream: "{{ matrix_container_global_registry_prefix_override if matrix_container_global_registry_prefix_override else postgres_pgloader_container_image_registry_prefix_upstream_default }}"

postgres_managed_databases_auto: |
  {{
    ([{
      'name': matrix_synapse_database_database,
      'username': matrix_synapse_database_user,
      'password': matrix_synapse_database_password,
    }] if (matrix_synapse_enabled and matrix_playbook_synapse_uses_managed_postgres) else [])
    +
    ([{
      'name': matrix_dendrite_federation_api_database,
      'username': matrix_dendrite_database_user,
      'password': matrix_dendrite_database_password,
    },{
      'name': matrix_dendrite_key_server_database,
      'username': matrix_dendrite_database_user,
      'password': matrix_dendrite_database_password,
    },{
      'name': matrix_dendrite_media_api_database,
      'username': matrix_dendrite_database_user,
      'password': matrix_dendrite_database_password,
    },{
      'name': matrix_dendrite_room_database,
      'username': matrix_dendrite_database_user,
      'password': matrix_dendrite_database_password,
    },{
      'name': matrix_dendrite_sync_api_database,
      'username': matrix_dendrite_database_user,
      'password': matrix_dendrite_database_password,
    },{
      'name': matrix_dendrite_user_api_database,
      'username': matrix_dendrite_database_user,
      'password': matrix_dendrite_database_password,
    },{
      'name': matrix_dendrite_relay_api_database,
      'username': matrix_dendrite_database_user,
      'password': matrix_dendrite_database_password,
    },{
      'name': matrix_dendrite_push_server_database,
      'username': matrix_dendrite_database_user,
      'password': matrix_dendrite_database_password,
    },{
      'name': matrix_dendrite_mscs_database,
      'username': matrix_dendrite_database_user,
      'password': matrix_dendrite_database_password,
    }] if (matrix_dendrite_enabled and matrix_dendrite_database_hostname == postgres_connection_hostname) else [])
    +
    ([{
      'name': matrix_authentication_service_config_database_database,
      'username': matrix_authentication_service_config_database_username,
      'password': matrix_authentication_service_config_database_password,
    }] if (matrix_authentication_service_enabled and matrix_playbook_matrix_authentication_service_uses_managed_postgres) else [])
    +
    ([{
      'name': matrix_bot_matrix_reminder_bot_database_name,
      'username': matrix_bot_matrix_reminder_bot_database_username,
      'password': matrix_bot_matrix_reminder_bot_database_password,
    }] if (matrix_bot_matrix_reminder_bot_enabled and matrix_bot_matrix_reminder_bot_database_engine == 'postgres' and matrix_bot_matrix_reminder_bot_database_hostname == postgres_connection_hostname) else [])
    +
    ([{
      'name': matrix_bot_honoroit_database_name,
      'username': matrix_bot_honoroit_database_username,
      'password': matrix_bot_honoroit_database_password,
    }] if (matrix_bot_honoroit_enabled and matrix_bot_honoroit_database_engine == 'postgres' and matrix_bot_honoroit_database_hostname == postgres_connection_hostname) else [])
    +
    ([{
      'name': matrix_bridge_postmoogle_database_name,
      'username': matrix_bridge_postmoogle_database_username,
      'password': matrix_bridge_postmoogle_database_password,
    }] if (matrix_bridge_postmoogle_enabled and matrix_bridge_postmoogle_database_engine == 'postgres' and matrix_bridge_postmoogle_database_hostname == postgres_connection_hostname) else [])
    +
    ([{
      'name': matrix_bot_maubot_database_name,
      'username': matrix_bot_maubot_database_username,
      'password': matrix_bot_maubot_database_password,
    }] if (matrix_bot_maubot_enabled and matrix_bot_maubot_database_engine == 'postgres' and matrix_bot_maubot_database_hostname == postgres_connection_hostname) else [])
    +
    ([{
      'name': matrix_bot_buscarron_database_name,
      'username': matrix_bot_buscarron_database_username,
      'password': matrix_bot_buscarron_database_password,
    }] if (matrix_bot_buscarron_enabled and matrix_bot_buscarron_database_engine == 'postgres' and matrix_bot_buscarron_database_hostname == postgres_connection_hostname) else [])
    +
    ([{
      'name': matrix_bridge_appservice_discord_database_name,
      'username': matrix_bridge_appservice_discord_database_username,
      'password': matrix_bridge_appservice_discord_database_password,
    }] if (matrix_bridge_appservice_discord_enabled and matrix_bridge_appservice_discord_database_engine == 'postgres' and matrix_bridge_appservice_discord_database_hostname == postgres_connection_hostname) else [])
    +
    ([{
      'name': matrix_appservice_draupnir_for_all_database_name,
      'username': matrix_appservice_draupnir_for_all_database_username,
      'password': matrix_appservice_draupnir_for_all_database_password,
    }] if (matrix_appservice_draupnir_for_all_enabled and matrix_appservice_draupnir_for_all_database_hostname == postgres_connection_hostname) else [])
    +
    ([{
      'name': matrix_bot_meowlnir_database_name,
      'username': matrix_bot_meowlnir_database_username,
      'password': matrix_bot_meowlnir_database_password,
    }] if (matrix_bot_meowlnir_enabled and matrix_bot_meowlnir_database_engine == 'postgres' and matrix_bot_meowlnir_database_hostname == postgres_connection_hostname) else [])
    +
    ([{
      'name': matrix_bridge_appservice_irc_database_name,
      'username': matrix_bridge_appservice_irc_database_username,
      'password': matrix_bridge_appservice_irc_database_password,
    }] if (matrix_bridge_appservice_irc_enabled and matrix_bridge_appservice_irc_database_engine == 'postgres' and matrix_bridge_appservice_irc_database_hostname == postgres_connection_hostname) else [])
    +
    ([{
      'name': matrix_bridge_beeper_linkedin_database_name,
      'username': matrix_bridge_beeper_linkedin_database_username,
      'password': matrix_bridge_beeper_linkedin_database_password,
    }] if (matrix_bridge_beeper_linkedin_enabled and matrix_bridge_beeper_linkedin_database_engine == 'postgres' and matrix_bridge_beeper_linkedin_database_hostname == postgres_connection_hostname) else [])
    +
    ([{
      'name': matrix_bridge_beeper_line_database_name,
      'username': matrix_bridge_beeper_line_database_username,
      'password': matrix_bridge_beeper_line_database_password,
    }] if (matrix_bridge_beeper_line_enabled and matrix_bridge_beeper_line_database_engine == 'postgres' and matrix_bridge_beeper_line_database_hostname == postgres_connection_hostname) else [])
    +
    ([{
      'name': matrix_bridge_wechat_database_name,
      'username': matrix_bridge_wechat_database_username,
      'password': matrix_bridge_wechat_database_password,
    }] if (matrix_bridge_wechat_enabled and matrix_bridge_wechat_database_engine == 'postgres' and matrix_bridge_wechat_database_hostname == postgres_connection_hostname) else [])
    +
    ([{
      'name': matrix_bridge_mautrix_bluesky_database_name,
      'username': matrix_bridge_mautrix_bluesky_database_username,
      'password': matrix_bridge_mautrix_bluesky_database_password,
    }] if (matrix_bridge_mautrix_bluesky_enabled and matrix_bridge_mautrix_bluesky_database_engine == 'postgres' and matrix_bridge_mautrix_bluesky_database_hostname == postgres_connection_hostname) else [])
    +
    ([{
      'name': matrix_bridge_rustpush_database_name,
      'username': matrix_bridge_rustpush_database_username,
      'password': matrix_bridge_rustpush_database_password,
    }] if (matrix_bridge_rustpush_enabled and matrix_bridge_rustpush_database_engine == 'postgres' and matrix_bridge_rustpush_database_hostname == postgres_connection_hostname) else [])
    +
    ([{
      'name': matrix_bridge_mautrix_googlechat_database_name,
      'username': matrix_bridge_mautrix_googlechat_database_username,
      'password': matrix_bridge_mautrix_googlechat_database_password,
    }] if (matrix_bridge_mautrix_googlechat_enabled and matrix_bridge_mautrix_googlechat_database_engine == 'postgres' and matrix_bridge_mautrix_googlechat_database_hostname == postgres_connection_hostname) else [])
    +
    ([{
      'name': matrix_bridge_mautrix_signal_database_name,
      'username': matrix_bridge_mautrix_signal_database_username,
      'password': matrix_bridge_mautrix_signal_database_password,
    }] if (matrix_bridge_mautrix_signal_enabled and matrix_bridge_mautrix_signal_database_engine == 'postgres' and matrix_bridge_mautrix_signal_database_hostname == postgres_connection_hostname) else [])
    +
    ([{
      'name': matrix_bridge_mautrix_meta_messenger_database_name,
      'username': matrix_bridge_mautrix_meta_messenger_database_username,
      'password': matrix_bridge_mautrix_meta_messenger_database_password,
    }] if (matrix_bridge_mautrix_meta_messenger_enabled and matrix_bridge_mautrix_meta_messenger_database_engine == 'postgres' and matrix_bridge_mautrix_meta_messenger_database_hostname == postgres_connection_hostname) else [])
    +
    ([{
      'name': matrix_bridge_mautrix_meta_instagram_database_name,
      'username': matrix_bridge_mautrix_meta_instagram_database_username,
      'password': matrix_bridge_mautrix_meta_instagram_database_password,
    }] if (matrix_bridge_mautrix_meta_instagram_enabled and matrix_bridge_mautrix_meta_instagram_database_engine == 'postgres' and matrix_bridge_mautrix_meta_instagram_database_hostname == postgres_connection_hostname) else [])
    +
    ([{
      'name': matrix_bridge_mautrix_wsproxy_syncproxy_database_name,
      'username': matrix_bridge_mautrix_wsproxy_syncproxy_database_username,
      'password': matrix_bridge_mautrix_wsproxy_syncproxy_database_password,
    }] if (matrix_bridge_mautrix_wsproxy_enabled and matrix_bridge_mautrix_wsproxy_syncproxy_database_engine == 'postgres' and matrix_bridge_mautrix_wsproxy_syncproxy_database_hostname == 'matrix-postgres') else [])
    +
    ([{
      'name': matrix_bridge_mautrix_telegram_database_name,
      'username': matrix_bridge_mautrix_telegram_database_username,
      'password': matrix_bridge_mautrix_telegram_database_password,
    }] if (matrix_bridge_mautrix_telegram_enabled and matrix_bridge_mautrix_telegram_database_engine == 'postgres' and matrix_bridge_mautrix_telegram_database_hostname == postgres_connection_hostname) else [])
    +
    ([{
      'name': matrix_bridge_mautrix_twitter_database_name,
      'username': matrix_bridge_mautrix_twitter_database_username,
      'password': matrix_bridge_mautrix_twitter_database_password,
    }] if (matrix_bridge_mautrix_twitter_enabled and matrix_bridge_mautrix_twitter_database_engine == 'postgres' and matrix_bridge_mautrix_twitter_database_hostname == postgres_connection_hostname) else [])
    +
    ([{
      'name': matrix_bridge_mautrix_gmessages_database_name,
      'username': matrix_bridge_mautrix_gmessages_database_username,
      'password': matrix_bridge_mautrix_gmessages_database_password,
    }] if (matrix_bridge_mautrix_gmessages_enabled and matrix_bridge_mautrix_gmessages_database_engine == 'postgres' and matrix_bridge_mautrix_gmessages_database_hostname == postgres_connection_hostname) else [])
    +
    ([{
      'name': matrix_bridge_mautrix_gvoice_database_name,
      'username': matrix_bridge_mautrix_gvoice_database_username,
      'password': matrix_bridge_mautrix_gvoice_database_password,
    }] if (matrix_bridge_mautrix_gvoice_enabled and matrix_bridge_mautrix_gvoice_database_engine == 'postgres' and matrix_bridge_mautrix_gvoice_database_hostname == postgres_connection_hostname) else [])
    +
    ([{
      'name': matrix_bridge_mautrix_linkedin_database_name,
      'username': matrix_bridge_mautrix_linkedin_database_username,
      'password': matrix_bridge_mautrix_linkedin_database_password,
    }] if (matrix_bridge_mautrix_linkedin_enabled and matrix_bridge_mautrix_linkedin_database_engine == 'postgres' and matrix_bridge_mautrix_linkedin_database_hostname == postgres_connection_hostname) else [])
    +
    ([{
      'name': matrix_bridge_mautrix_whatsapp_database_name,
      'username': matrix_bridge_mautrix_whatsapp_database_username,
      'password': matrix_bridge_mautrix_whatsapp_database_password,
    }] if (matrix_bridge_mautrix_whatsapp_enabled and matrix_bridge_mautrix_whatsapp_database_engine == 'postgres' and matrix_bridge_mautrix_whatsapp_database_hostname == postgres_connection_hostname) else [])
    +
    ([{
      'name': matrix_bridge_mautrix_discord_database_name,
      'username': matrix_bridge_mautrix_discord_database_username,
      'password': matrix_bridge_mautrix_discord_database_password,
    }] if (matrix_bridge_mautrix_discord_enabled and matrix_bridge_mautrix_discord_database_engine == 'postgres' and matrix_bridge_mautrix_discord_database_hostname == postgres_connection_hostname) else [])
    +
    ([{
      'name': matrix_bridge_mautrix_slack_database_name,
      'username': matrix_bridge_mautrix_slack_database_username,
      'password': matrix_bridge_mautrix_slack_database_password,
    }] if (matrix_bridge_mautrix_slack_enabled and matrix_bridge_mautrix_slack_database_engine == 'postgres' and matrix_bridge_mautrix_slack_database_hostname == postgres_connection_hostname) else [])
    +
    ([{
      'name': matrix_bridge_mx_puppet_steam_database_name,
      'username': matrix_bridge_mx_puppet_steam_database_username,
      'password': matrix_bridge_mx_puppet_steam_database_password,
    }] if (matrix_bridge_mx_puppet_steam_enabled and matrix_bridge_mx_puppet_steam_database_engine == 'postgres' and matrix_bridge_mx_puppet_steam_database_hostname == postgres_connection_hostname) else [])
    +
    ([{
      'name': matrix_bridge_mx_puppet_groupme_database_name,
      'username': matrix_bridge_mx_puppet_groupme_database_username,
      'password': matrix_bridge_mx_puppet_groupme_database_password,
    }] if (matrix_bridge_mx_puppet_groupme_enabled and matrix_bridge_mx_puppet_groupme_database_engine == 'postgres' and matrix_bridge_mx_puppet_groupme_database_hostname == postgres_connection_hostname) else [])
    +
    ([{
      'name': matrix_bridge_steam_database_name,
      'username': matrix_bridge_steam_database_username,
      'password': matrix_bridge_steam_database_password,
    }] if (matrix_bridge_steam_enabled and matrix_bridge_steam_database_engine == 'postgres' and matrix_bridge_steam_database_hostname == postgres_connection_hostname) else [])
    +
    ([{
      'name': etherpad_database_name,
      'username': etherpad_database_postgres_username,
      'password': etherpad_database_postgres_password,
    }] if (etherpad_enabled and etherpad_database_type == 'postgres' and etherpad_database_postgres_hostname == postgres_connection_hostname) else [])
    +
    ([{
      'name': prometheus_postgres_exporter_database_name,
      'username': prometheus_postgres_exporter_database_username,
      'password': prometheus_postgres_exporter_database_password,
      'additional_sql_queries': ['GRANT pg_monitor TO "' + prometheus_postgres_exporter_database_username + '";'],
    }] if (prometheus_postgres_exporter_enabled and prometheus_postgres_exporter_database_hostname == postgres_connection_hostname) else [])
    +
    ([{
      'name': matrix_media_repo_database_name,
      'username': matrix_media_repo_database_username,
      'password': matrix_media_repo_database_password,
    }] if (matrix_media_repo_enabled and matrix_media_repo_database_hostname == postgres_connection_hostname) else [])

   }}

########################################################################
#                                                                      #
# /postgres                                                            #
#                                                                      #
########################################################################


########################################################################
#                                                                      #
# postgres_backup                                                      #
#                                                                      #
########################################################################

postgres_backup_enabled: false

postgres_backup_identifier: matrix-postgres-backup

postgres_backup_architecture: "{{ matrix_architecture }}"

postgres_backup_base_path: "{{ matrix_base_data_path }}/postgres-backup"

postgres_backup_systemd_required_services_list_auto: |
  {{
    ([(postgres_identifier + '.service')] if (postgres_enabled and postgres_backup_connection_hostname == postgres_connection_hostname) else [])
  }}

postgres_backup_container_image_registry_prefix_upstream: "{{ matrix_container_global_registry_prefix_override if matrix_container_global_registry_prefix_override else postgres_backup_container_image_registry_prefix_upstream_default }}"

postgres_backup_container_network: "{{ (postgres_container_network if (postgres_enabled and postgres_backup_connection_hostname == postgres_connection_hostname) else postgres_backup_identifier) }}"

postgres_backup_container_additional_networks_auto: |-
  {{
      ([postgres_container_network] if (postgres_enabled and postgres_backup_connection_hostname == postgres_connection_hostname and postgres_backup_container_network != postgres_container_network) else [])
  }}

postgres_backup_uid: "{{ matrix_user_uid }}"
postgres_backup_gid: "{{ matrix_user_gid }}"

postgres_backup_connection_hostname: "{{ postgres_connection_hostname if postgres_enabled else '' }}"
postgres_backup_connection_port: "{{ postgres_connection_port if postgres_enabled else 5432 }}"
postgres_backup_connection_username: "{{ postgres_connection_username if postgres_enabled else '' }}"
postgres_backup_connection_password: "{{ postgres_connection_password if postgres_enabled else '' }}"

postgres_backup_postgres_data_path: "{{ postgres_data_path if postgres_enabled else '' }}"
postgres_backup_postgres_role_include_name: galaxy/postgres

postgres_backup_databases_auto: "{{ postgres_managed_databases | map(attribute='name') if postgres_enabled else [] }}"

########################################################################
#                                                                      #
# /postgres_backup                                                     #
#                                                                      #
########################################################################


######################################################################
#
# matrix-sygnal
#
######################################################################

# Most people don't need their own push-server, because they also need their own app to utilize it from.
matrix_sygnal_enabled: false

matrix_sygnal_metrics_prometheus_enabled: "{{ prometheus_enabled or matrix_metrics_exposure_enabled }}"

matrix_sygnal_hostname: "{{ matrix_server_fqn_sygnal }}"

matrix_sygnal_container_image_registry_prefix_upstream: "{{ matrix_container_global_registry_prefix_override if matrix_container_global_registry_prefix_override else matrix_sygnal_container_image_registry_prefix_upstream_default }}"

matrix_sygnal_container_network: "{{ matrix_homeserver_container_network }}"

matrix_sygnal_container_additional_networks: "{{ [matrix_playbook_reverse_proxyable_services_additional_network] if matrix_playbook_reverse_proxyable_services_additional_network else [] }}"

matrix_sygnal_container_http_host_bind_port: "{{ (matrix_playbook_service_host_bind_interface_prefix ~ '6000') if matrix_playbook_service_host_bind_interface_prefix else '' }}"

matrix_sygnal_container_labels_traefik_enabled: "{{ matrix_playbook_traefik_labels_enabled }}"
matrix_sygnal_container_labels_traefik_docker_network: "{{ matrix_playbook_reverse_proxyable_services_additional_network }}"
matrix_sygnal_container_labels_traefik_entrypoints: "{{ traefik_entrypoint_primary }}"
matrix_sygnal_container_labels_traefik_tls_certResolver: "{{ traefik_certResolver_primary }}"

######################################################################
#
# /matrix-sygnal
#
######################################################################

######################################################################
#
# ntfy
#
######################################################################

ntfy_enabled: false

ntfy_identifier: matrix-ntfy

ntfy_base_path: "{{ matrix_base_data_path }}/ntfy"

ntfy_uid: "{{ matrix_user_uid }}"
ntfy_gid: "{{ matrix_user_gid }}"

ntfy_hostname: "{{ matrix_server_fqn_ntfy }}"

ntfy_container_image_registry_prefix_upstream: "{{ matrix_container_global_registry_prefix_override if matrix_container_global_registry_prefix_override else ntfy_container_image_registry_prefix_upstream_default }}"

ntfy_container_additional_networks_auto: "{{ [matrix_playbook_reverse_proxyable_services_additional_network] if matrix_playbook_reverse_proxyable_services_additional_network else [] }}"

ntfy_container_http_host_bind_port: "{{ (matrix_playbook_service_host_bind_interface_prefix ~ '2586') if matrix_playbook_service_host_bind_interface_prefix else '' }}"

ntfy_container_labels_traefik_enabled: "{{ matrix_playbook_traefik_labels_enabled }}"
ntfy_container_labels_traefik_docker_network: "{{ matrix_playbook_reverse_proxyable_services_additional_network }}"
ntfy_container_labels_traefik_entrypoints: "{{ traefik_entrypoint_primary }}"
ntfy_container_labels_traefik_tls_certResolver: "{{ traefik_certResolver_primary }}"

# We have ntfy serve its metrics endpoint on a dedicated port, instead of on the regular HTTP port.
# Were it served on the regular HTTP port, the endpoint would also become reachable at `https://ntfy.example.com/metrics`.
# Nothing protects it there, because ntfy does not apply its own access-control rules to the metrics endpoint.
ntfy_metrics_listen_http_port: "{{ 9090 if (prometheus_enabled or matrix_metrics_exposure_enabled) else '' }}"

ntfy_container_labels_traefik_metrics_enabled: "{{ matrix_metrics_exposure_enabled }}"

# For consistency with other things hosted at the Matrix FQN, we adjust the metrics endpoint
# so that metrics would be served at something like `/metrics/SERVICE_NAME`, and not at the default path for the role (`/metrics`).
ntfy_container_labels_traefik_metrics_hostname: "{{ matrix_server_fqn_matrix }}"
ntfy_container_labels_traefik_metrics_path_prefix: "{{ matrix_metrics_exposure_path_prefix }}/ntfy"

ntfy_container_labels_traefik_metrics_middleware_basic_auth_enabled: "{{ matrix_metrics_exposure_http_basic_auth_enabled }}"
ntfy_container_labels_traefik_metrics_middleware_basic_auth_users: "{{ matrix_metrics_exposure_http_basic_auth_users }}"

ntfy_visitor_request_limit_exempt_hosts_hostnames_auto: |
  {{
    [matrix_server_fqn_matrix]
  }}

######################################################################
#
# /ntfy
#
######################################################################


######################################################################
#
# valkey
#
######################################################################

valkey_enabled: "{{ matrix_synapse_workers_enabled or (matrix_bridge_hookshot_enabled and matrix_bridge_hookshot_encryption_enabled) }}"

valkey_identifier: matrix-valkey

valkey_uid: "{{ matrix_user_uid }}"
valkey_gid: "{{ matrix_user_gid }}"

valkey_base_path: "{{ matrix_base_data_path }}/valkey"

valkey_arch: "{{ matrix_architecture }}"

valkey_container_image_registry_prefix_upstream: "{{ matrix_container_global_registry_prefix_override if matrix_container_global_registry_prefix_override else valkey_container_image_registry_prefix_upstream_default }}"

######################################################################
#
# valkey
#
######################################################################


######################################################################
#
# matrix-client-element
#
######################################################################

# By default, this playbook installs the Element Web on the `matrix_server_fqn_element` domain.
# If you wish to connect to your Matrix server by other means, you may wish to disable this.
matrix_client_element_enabled: true

matrix_client_element_scheme: "{{ 'https' if matrix_playbook_ssl_enabled else 'http' }}"

matrix_client_element_container_image_registry_prefix_upstream: "{{ matrix_container_global_registry_prefix_override if matrix_container_global_registry_prefix_override else matrix_client_element_container_image_registry_prefix_upstream_default }}"

matrix_client_element_container_image_self_build: "{{ matrix_architecture not in ['arm64', 'amd64'] }}"

matrix_client_element_container_http_host_bind_port: "{{ (matrix_playbook_service_host_bind_interface_prefix ~ '8765') if matrix_playbook_service_host_bind_interface_prefix else '' }}"

matrix_client_element_container_network: "{{ matrix_addons_container_network }}"

matrix_client_element_container_additional_networks: "{{ [matrix_playbook_reverse_proxyable_services_additional_network] if (matrix_client_element_container_labels_traefik_enabled and matrix_playbook_reverse_proxyable_services_additional_network) else [] }}"

matrix_client_element_container_labels_traefik_enabled: "{{ matrix_playbook_reverse_proxy_type in ['playbook-managed-traefik', 'other-traefik-container'] }}"
matrix_client_element_container_labels_traefik_docker_network: "{{ matrix_playbook_reverse_proxyable_services_additional_network }}"

matrix_client_element_container_labels_traefik_entrypoints: "{{ traefik_entrypoint_primary }}"
matrix_client_element_container_labels_traefik_tls_certResolver: "{{ traefik_certResolver_primary }}"

matrix_client_element_container_labels_traefik_compression_middleware_enabled: "{{ matrix_playbook_reverse_proxy_traefik_middleware_compression_enabled }}"
matrix_client_element_container_labels_traefik_compression_middleware_name: "{{ matrix_playbook_reverse_proxy_traefik_middleware_compression_name if matrix_playbook_reverse_proxy_traefik_middleware_compression_enabled else '' }}"

matrix_client_element_default_hs_url: "{{ matrix_homeserver_url }}"
matrix_client_element_default_is_url: "{{ matrix_identity_server_url }}"

matrix_client_element_self_check_validate_certificates: "{{ matrix_playbook_ssl_enabled }}"

matrix_client_element_registration_enabled: "{{ matrix_synapse_enable_registration }}"

matrix_client_element_enable_presence_by_hs_url: |-
  {{
    none
    if matrix_synapse_presence_enabled
    else {matrix_client_element_default_hs_url: false}
  }}

matrix_client_element_jitsi_preferred_domain: "{{ matrix_server_fqn_jitsi if jitsi_enabled else '' }}"

matrix_client_element_features_feature_video_rooms: "{{ matrix_rtc_enabled }}"
matrix_client_element_features_feature_group_calls: "{{ matrix_rtc_enabled }}"
matrix_client_element_features_feature_element_call_video_rooms: "{{ matrix_rtc_enabled }}"
matrix_client_element_features_feature_oidc_native_flow: "{{ matrix_authentication_service_enabled }}"

matrix_client_element_element_call_enabled: "{{ matrix_element_call_enabled }}"
matrix_client_element_element_call_url: "{{ matrix_element_call_public_url if matrix_element_call_enabled else '' }}"

######################################################################
#
# /matrix-client-element
#
######################################################################

######################################################################
#
# matrix-client-commet
#
######################################################################

matrix_client_commet_enabled: false

matrix_client_commet_scheme: "{{ 'https' if matrix_playbook_ssl_enabled else 'http' }}"

matrix_client_commet_hostname: "commet.{{ matrix_domain }}"

matrix_client_commet_container_http_host_bind_port: "{{ (matrix_playbook_service_host_bind_interface_prefix ~ '8766') if matrix_playbook_service_host_bind_interface_prefix else '' }}"

matrix_client_commet_container_network: "{{ matrix_addons_container_network }}"

matrix_client_commet_container_additional_networks: "{{ [matrix_playbook_reverse_proxyable_services_additional_network] if (matrix_client_commet_container_labels_traefik_enabled and matrix_playbook_reverse_proxyable_services_additional_network) else [] }}"

matrix_client_commet_container_labels_traefik_enabled: "{{ matrix_playbook_reverse_proxy_type in ['playbook-managed-traefik', 'other-traefik-container'] }}"
matrix_client_commet_container_labels_traefik_docker_network: "{{ matrix_playbook_reverse_proxyable_services_additional_network }}"
matrix_client_commet_container_labels_traefik_entrypoints: "{{ traefik_entrypoint_primary }}"
matrix_client_commet_container_labels_traefik_tls_certResolver: "{{ traefik_certResolver_primary }}"

matrix_client_commet_container_labels_traefik_compression_middleware_enabled: "{{ matrix_playbook_reverse_proxy_traefik_middleware_compression_enabled }}"
matrix_client_commet_container_labels_traefik_compression_middleware_name: "{{ matrix_playbook_reverse_proxy_traefik_middleware_compression_name if matrix_playbook_reverse_proxy_traefik_middleware_compression_enabled else '' }}"

######################################################################
#
# /matrix-client-commet
#
######################################################################

######################################################################
#
# matrix-client-gomuks
#
######################################################################

matrix_client_gomuks_enabled: false

matrix_client_gomuks_scheme: "{{ 'https' if matrix_playbook_ssl_enabled else 'http' }}"

matrix_client_gomuks_hostname: "{{ matrix_server_fqn_gomuks }}"

matrix_client_gomuks_container_http_host_bind_port: "{{ (matrix_playbook_service_host_bind_interface_prefix ~ '29325') if matrix_playbook_service_host_bind_interface_prefix else '' }}"

matrix_client_gomuks_container_network: "{{ matrix_addons_container_network }}"

matrix_client_gomuks_container_additional_networks_auto: "{{ [matrix_playbook_reverse_proxyable_services_additional_network] if (matrix_client_gomuks_container_labels_traefik_enabled and matrix_playbook_reverse_proxyable_services_additional_network) else [] }}"

matrix_client_gomuks_container_labels_traefik_enabled: "{{ matrix_playbook_reverse_proxy_type in ['playbook-managed-traefik', 'other-traefik-container'] }}"
matrix_client_gomuks_container_labels_traefik_docker_network: "{{ matrix_playbook_reverse_proxyable_services_additional_network }}"
matrix_client_gomuks_container_labels_traefik_entrypoints: "{{ traefik_entrypoint_primary }}"
matrix_client_gomuks_container_labels_traefik_tls_certResolver: "{{ traefik_certResolver_primary }}"

matrix_client_gomuks_container_labels_traefik_compression_middleware_enabled: "{{ matrix_playbook_reverse_proxy_traefik_middleware_compression_enabled }}"
matrix_client_gomuks_container_labels_traefik_compression_middleware_name: "{{ matrix_playbook_reverse_proxy_traefik_middleware_compression_name if matrix_playbook_reverse_proxy_traefik_middleware_compression_enabled else '' }}"

matrix_client_gomuks_self_check_validate_certificates: "{{ matrix_playbook_ssl_enabled }}"

######################################################################
#
# /matrix-client-gomuks
#
######################################################################

######################################################################
#
# hydrogen
#
######################################################################

hydrogen_enabled: false

hydrogen_identifier: matrix-client-hydrogen

hydrogen_uid: "{{ matrix_user_uid }}"
hydrogen_gid: "{{ matrix_user_gid }}"

hydrogen_container_image_registry_prefix: "{{ 'localhost/' if hydrogen_container_image_self_build else hydrogen_container_image_registry_prefix_upstream }}"
hydrogen_container_image_registry_prefix_upstream: "{{ matrix_container_global_registry_prefix_override if matrix_container_global_registry_prefix_override else hydrogen_container_image_registry_prefix_upstream_default }}"

hydrogen_container_image_self_build: "{{ matrix_architecture not in ['arm64', 'amd64'] }}"

hydrogen_container_http_host_bind_port: "{{ (matrix_playbook_service_host_bind_interface_prefix ~ '8768') if matrix_playbook_service_host_bind_interface_prefix else '' }}"

hydrogen_container_network: "{{ matrix_addons_container_network }}"

hydrogen_container_additional_networks: "{{ [matrix_playbook_reverse_proxyable_services_additional_network] if (hydrogen_container_labels_traefik_enabled and matrix_playbook_reverse_proxyable_services_additional_network) else [] }}"

hydrogen_container_labels_traefik_enabled: "{{ matrix_playbook_reverse_proxy_type in ['playbook-managed-traefik', 'other-traefik-container'] }}"
hydrogen_container_labels_traefik_docker_network: "{{ matrix_playbook_reverse_proxyable_services_additional_network }}"
hydrogen_container_labels_traefik_entrypoints: "{{ traefik_entrypoint_primary }}"
hydrogen_container_labels_traefik_tls_certResolver: "{{ traefik_certResolver_primary }}"

hydrogen_container_labels_traefik_compression_middleware_enabled: "{{ matrix_playbook_reverse_proxy_traefik_middleware_compression_enabled }}"
hydrogen_container_labels_traefik_compression_middleware_name: "{{ matrix_playbook_reverse_proxy_traefik_middleware_compression_name if matrix_playbook_reverse_proxy_traefik_middleware_compression_enabled else '' }}"

hydrogen_scheme: "{{ 'https' if matrix_playbook_ssl_enabled else 'http' }}"

hydrogen_default_hs_url: "{{ matrix_homeserver_url }}"

hydrogen_self_check_validate_certificates: "{{ matrix_playbook_ssl_enabled }}"

hydrogen_base_path: "{{ matrix_base_data_path }}/client-hydrogen"

hydrogen_hostname: "{{ matrix_server_fqn_hydrogen }}"

######################################################################
#
# /hydrogen
#
######################################################################

######################################################################
#
# cinny
#
######################################################################

cinny_enabled: false

cinny_identifier: matrix-client-cinny

cinny_uid: "{{ matrix_user_uid }}"
cinny_gid: "{{ matrix_user_gid }}"

cinny_container_image_registry_prefix: "{{ 'localhost/' if cinny_container_image_self_build else cinny_container_image_registry_prefix_upstream }}"
cinny_container_image_registry_prefix_upstream: "{{ matrix_container_global_registry_prefix_override if matrix_container_global_registry_prefix_override else cinny_container_image_registry_prefix_upstream_default }}"

cinny_container_image_self_build: "{{ matrix_architecture not in ['arm64', 'amd64'] }}"

cinny_container_http_host_bind_port: "{{ (matrix_playbook_service_host_bind_interface_prefix ~ '8080') if matrix_playbook_service_host_bind_interface_prefix else '' }}"

cinny_container_network: "{{ matrix_addons_container_network }}"

cinny_container_additional_networks: "{{ [matrix_playbook_reverse_proxyable_services_additional_network] if (cinny_container_labels_traefik_enabled and matrix_playbook_reverse_proxyable_services_additional_network) else [] }}"

cinny_container_labels_traefik_enabled: "{{ matrix_playbook_reverse_proxy_type in ['playbook-managed-traefik', 'other-traefik-container'] }}"
cinny_container_labels_traefik_docker_network: "{{ matrix_playbook_reverse_proxyable_services_additional_network }}"
cinny_container_labels_traefik_entrypoints: "{{ traefik_entrypoint_primary }}"
cinny_container_labels_traefik_tls_certResolver: "{{ traefik_certResolver_primary }}"

cinny_container_labels_traefik_compression_middleware_enabled: "{{ matrix_playbook_reverse_proxy_traefik_middleware_compression_enabled }}"
cinny_container_labels_traefik_compression_middleware_name: "{{ matrix_playbook_reverse_proxy_traefik_middleware_compression_name if matrix_playbook_reverse_proxy_traefik_middleware_compression_enabled else '' }}"

cinny_scheme: "{{ 'https' if matrix_playbook_ssl_enabled else 'http' }}"

cinny_default_hs_url: "{{ matrix_homeserver_url }}"

cinny_self_check_validate_certificates: "{{ matrix_playbook_ssl_enabled }}"

cinny_base_path: "{{ matrix_base_data_path }}/client-cinny"

cinny_hostname: "{{ matrix_server_fqn_cinny }}"

######################################################################
#
# /cinny
#
######################################################################

######################################################################
#
# sable
#
######################################################################

sable_enabled: false

sable_identifier: matrix-client-sable

sable_uid: "{{ matrix_user_uid }}"
sable_gid: "{{ matrix_user_gid }}"

sable_container_image_registry_prefix: "{{ 'localhost/' if sable_container_image_self_build else sable_container_image_registry_prefix_upstream }}"
sable_container_image_registry_prefix_upstream: "{{ matrix_container_global_registry_prefix_override if matrix_container_global_registry_prefix_override else sable_container_image_registry_prefix_upstream_default }}"

sable_container_image_self_build: "{{ matrix_architecture not in ['arm64', 'amd64'] }}"

sable_container_http_host_bind_port: "{{ (matrix_playbook_service_host_bind_interface_prefix ~ '8771') if matrix_playbook_service_host_bind_interface_prefix else '' }}"

sable_container_network: "{{ matrix_addons_container_network }}"

sable_container_additional_networks: "{{ [matrix_playbook_reverse_proxyable_services_additional_network] if (sable_container_labels_traefik_enabled and matrix_playbook_reverse_proxyable_services_additional_network) else [] }}"

sable_container_labels_traefik_enabled: "{{ matrix_playbook_reverse_proxy_type in ['playbook-managed-traefik', 'other-traefik-container'] }}"
sable_container_labels_traefik_docker_network: "{{ matrix_playbook_reverse_proxyable_services_additional_network }}"
sable_container_labels_traefik_entrypoints: "{{ traefik_entrypoint_primary }}"
sable_container_labels_traefik_tls_certResolver: "{{ traefik_certResolver_primary }}"

sable_container_labels_traefik_compression_middleware_enabled: "{{ matrix_playbook_reverse_proxy_traefik_middleware_compression_enabled }}"
sable_container_labels_traefik_compression_middleware_name: "{{ matrix_playbook_reverse_proxy_traefik_middleware_compression_name if matrix_playbook_reverse_proxy_traefik_middleware_compression_enabled else '' }}"

sable_scheme: "{{ 'https' if matrix_playbook_ssl_enabled else 'http' }}"

sable_default_hs_url: "{{ matrix_homeserver_url }}"

sable_self_check_validate_certificates: "{{ matrix_playbook_ssl_enabled }}"

sable_base_path: "{{ matrix_base_data_path }}/client-sable"

sable_hostname: "{{ matrix_server_fqn_sable }}"

######################################################################
#
# /sable
#
######################################################################

######################################################################
#
# matrix-client-schildichat
#
######################################################################

matrix_client_schildichat_enabled: false

matrix_client_schildichat_scheme: "{{ 'https' if matrix_playbook_ssl_enabled else 'http' }}"

matrix_client_schildichat_container_image_registry_prefix_upstream: "{{ matrix_container_global_registry_prefix_override if matrix_container_global_registry_prefix_override else matrix_client_schildichat_container_image_registry_prefix_upstream_default }}"

matrix_client_schildichat_container_image_self_build: "{{ matrix_architecture not in ['arm64', 'amd64'] }}"

matrix_client_schildichat_container_http_host_bind_port: "{{ (matrix_playbook_service_host_bind_interface_prefix ~ '8765') if matrix_playbook_service_host_bind_interface_prefix else '' }}"

matrix_client_schildichat_container_network: "{{ matrix_addons_container_network }}"

matrix_client_schildichat_container_additional_networks: "{{ [matrix_playbook_reverse_proxyable_services_additional_network] if (matrix_client_schildichat_container_labels_traefik_enabled and matrix_playbook_reverse_proxyable_services_additional_network) else [] }}"

matrix_client_schildichat_container_labels_traefik_enabled: "{{ matrix_playbook_reverse_proxy_type in ['playbook-managed-traefik', 'other-traefik-container'] }}"
matrix_client_schildichat_container_labels_traefik_docker_network: "{{ matrix_playbook_reverse_proxyable_services_additional_network }}"
matrix_client_schildichat_container_labels_traefik_entrypoints: "{{ traefik_entrypoint_primary }}"
matrix_client_schildichat_container_labels_traefik_tls_certResolver: "{{ traefik_certResolver_primary }}"

matrix_client_schildichat_default_hs_url: "{{ matrix_homeserver_url }}"
matrix_client_schildichat_default_is_url: "{{ matrix_identity_server_url }}"

matrix_client_schildichat_self_check_validate_certificates: "{{ matrix_playbook_ssl_enabled }}"

matrix_client_schildichat_registration_enabled: "{{ matrix_synapse_enable_registration }}"

matrix_client_schildichat_enable_presence_by_hs_url: |-
  {{
    none
    if matrix_synapse_presence_enabled
    else {matrix_client_schildichat_default_hs_url: false}
  }}

matrix_client_schildichat_jitsi_preferred_domain: "{{ matrix_server_fqn_jitsi if jitsi_enabled else '' }}"

######################################################################
#
# /matrix-client-schildichat
#
######################################################################

######################################################################
#
# matrix-client-fluffychat
#
######################################################################

matrix_client_fluffychat_enabled: false

matrix_client_fluffychat_scheme: "{{ 'https' if matrix_playbook_ssl_enabled else 'http' }}"

matrix_client_fluffychat_container_image_registry_prefix_upstream: "{{ matrix_container_global_registry_prefix_override if matrix_container_global_registry_prefix_override else matrix_client_fluffychat_container_image_registry_prefix_upstream_default }}"

matrix_client_fluffychat_container_image_self_build: "{{ matrix_architecture not in ['arm64', 'amd64'] }}"

matrix_client_fluffychat_container_http_host_bind_port: "{{ (matrix_playbook_service_host_bind_interface_prefix ~ '8770') if matrix_playbook_service_host_bind_interface_prefix else '' }}"

matrix_client_fluffychat_container_network: "{{ matrix_addons_container_network }}"

matrix_client_fluffychat_container_additional_networks_auto: "{{ [matrix_playbook_reverse_proxyable_services_additional_network] if (matrix_client_fluffychat_container_labels_traefik_enabled and matrix_playbook_reverse_proxyable_services_additional_network) else [] }}"

matrix_client_fluffychat_container_labels_traefik_enabled: "{{ matrix_playbook_reverse_proxy_type in ['playbook-managed-traefik', 'other-traefik-container'] }}"
matrix_client_fluffychat_container_labels_traefik_docker_network: "{{ matrix_playbook_reverse_proxyable_services_additional_network }}"
matrix_client_fluffychat_container_labels_traefik_entrypoints: "{{ traefik_entrypoint_primary }}"
matrix_client_fluffychat_container_labels_traefik_tls_certResolver: "{{ traefik_certResolver_primary }}"

matrix_client_fluffychat_self_check_validate_certificates: "{{ matrix_playbook_ssl_enabled }}"

matrix_client_fluffychat_config_defaultHomeserver: "{{ matrix_domain }}"

######################################################################
#
# /matrix-client-fluffychat
#
######################################################################

######################################################################
#
# matrix-synapse
#
######################################################################

matrix_synapse_enabled: "{{ matrix_homeserver_implementation == 'synapse' }}"

matrix_synapse_username: "{{ matrix_user_name }}"
matrix_synapse_uid: "{{ matrix_user_uid }}"
matrix_synapse_gid: "{{ matrix_user_gid }}"

matrix_synapse_federation_enabled: "{{ matrix_homeserver_federation_enabled }}"

matrix_synapse_container_image_registry_prefix_upstream: "{{ matrix_container_global_registry_prefix_override if matrix_container_global_registry_prefix_override else matrix_synapse_container_image_registry_prefix_upstream_default }}"

matrix_s3_goofys_container_image_registry_prefix_upstream: "{{ matrix_container_global_registry_prefix_override if matrix_container_global_registry_prefix_override else matrix_s3_goofys_container_image_registry_prefix_upstream_default }}"

matrix_synapse_rust_synapse_compress_state_container_image_registry_prefix_upstream: "{{ matrix_container_global_registry_prefix_override if matrix_container_global_registry_prefix_override else matrix_synapse_rust_synapse_compress_state_container_image_registry_prefix_upstream_default }}"

matrix_synapse_container_image_self_build: "{{ matrix_architecture not in ['arm64', 'amd64'] }}"

# For exposing the Matrix Federation API's TLS port (HTTPS) to the internet on all network interfaces.
matrix_synapse_container_federation_api_tls_host_bind_port: "{{ matrix_federation_public_port if (matrix_synapse_federation_enabled and matrix_synapse_tls_federation_listener_enabled) else '' }}"
#
# For exposing the Synapse Metrics API's port (plain HTTP) to the local host.
matrix_synapse_container_metrics_api_host_bind_port: "{{ (matrix_playbook_service_host_bind_interface_prefix ~ '9100') if matrix_synapse_metrics_enabled and matrix_playbook_service_host_bind_interface_prefix else '' }}"
#
# For exposing the Synapse Manhole port (plain HTTP) to the local host.
matrix_synapse_container_manhole_api_host_bind_port: "{{ (matrix_playbook_service_host_bind_interface_prefix ~ '9000') if matrix_synapse_metrics_enabled and matrix_playbook_service_host_bind_interface_prefix else '' }}"

matrix_synapse_container_network: "{{ matrix_homeserver_container_network }}"

matrix_synapse_container_additional_networks_auto: |
  {{
    (
      ([matrix_playbook_reverse_proxyable_services_additional_network] if matrix_synapse_container_labels_traefik_enabled and matrix_playbook_reverse_proxyable_services_additional_network else [])
      +
      ([postgres_container_network] if (matrix_playbook_synapse_uses_managed_postgres and (not matrix_synapse_database_socket_enabled) and postgres_container_network != matrix_synapse_container_network) else [])
      +
      ([valkey_container_network] if (matrix_playbook_synapse_uses_managed_valkey and (not matrix_synapse_redis_path_enabled) and valkey_container_network != matrix_synapse_container_network) else [])
      +
      ([exim_relay_container_network] if (exim_relay_enabled and matrix_synapse_email_enabled and matrix_synapse_email_smtp_host == exim_relay_identifier and matrix_synapse_container_network != exim_relay_container_network) else [])
      +
      ([matrix_bot_draupnir_container_network] if (matrix_synapse_ext_synapse_http_antispam_enabled and matrix_synapse_ext_synapse_http_antispam_config_base_url == matrix_bot_draupnir_synapse_http_antispam_config_base_url and matrix_bot_draupnir_container_network != matrix_synapse_container_network) else [])
    ) | unique
  }}

matrix_synapse_container_labels_traefik_enabled: "{{ matrix_playbook_reverse_proxy_type in ['playbook-managed-traefik', 'other-traefik-container'] }}"
matrix_synapse_container_labels_traefik_docker_network: "{{ matrix_playbook_reverse_proxyable_services_additional_network }}"
matrix_synapse_container_labels_traefik_entrypoints: "{{ traefik_entrypoint_primary }}"
matrix_synapse_container_labels_traefik_tls_certResolver: "{{ traefik_certResolver_primary }}"
matrix_synapse_container_labels_traefik_hostname: "{{ matrix_server_fqn_matrix }}"

matrix_synapse_container_labels_traefik_compression_middleware_enabled: "{{ matrix_playbook_reverse_proxy_traefik_middleware_compression_enabled }}"
matrix_synapse_container_labels_traefik_compression_middleware_name: "{{ matrix_playbook_reverse_proxy_traefik_middleware_compression_name if matrix_playbook_reverse_proxy_traefik_middleware_compression_enabled else '' }}"

matrix_synapse_container_labels_matrix_labels_enabled: "{{ not matrix_synapse_workers_enabled }}"

matrix_synapse_container_labels_public_client_root_redirection_enabled: "{{ matrix_synapse_container_labels_public_client_root_redirection_url != '' }}"
matrix_synapse_container_labels_public_client_root_redirection_url: "{{ matrix_playbook_public_client_root_redirection_url }}"

matrix_synapse_container_labels_public_client_synapse_admin_api_enabled: "{{ matrix_ketesa_enabled or matrix_element_admin_enabled }}"
matrix_synapse_container_labels_internal_client_synapse_admin_api_enabled: "{{ (matrix_bot_draupnir_enabled and matrix_bot_draupnir_admin_api_enabled) }}"
matrix_synapse_container_labels_internal_client_synapse_admin_api_traefik_entrypoints: "{{ matrix_playbook_internal_matrix_client_api_traefik_entrypoint_name }}"

matrix_synapse_container_labels_public_federation_api_traefik_hostname: "{{ matrix_server_fqn_matrix_federation }}"
matrix_synapse_container_labels_public_federation_api_traefik_entrypoints: "{{ matrix_federation_traefik_entrypoint_name }}"
matrix_synapse_container_labels_public_federation_api_traefik_tls: "{{ matrix_federation_traefik_entrypoint_tls }}"

matrix_synapse_container_labels_public_metrics_middleware_basic_auth_enabled: "{{ matrix_metrics_exposure_http_basic_auth_enabled }}"
matrix_synapse_container_labels_public_metrics_middleware_basic_auth_users: "{{ matrix_metrics_exposure_http_basic_auth_users }}"

matrix_synapse_container_labels_internal_client_api_enabled: "{{ matrix_playbook_internal_matrix_client_api_traefik_entrypoint_enabled }}"
matrix_synapse_container_labels_internal_client_api_traefik_entrypoints: "{{ matrix_playbook_internal_matrix_client_api_traefik_entrypoint_name }}"

# Playbook-level Synapse topology wiring helpers.
matrix_playbook_synapse_uses_managed_postgres: "{{ postgres_enabled }}"
matrix_playbook_synapse_uses_managed_valkey: "{{ matrix_synapse_redis_enabled and valkey_enabled }}"
matrix_playbook_synapse_auto_compressor_uses_managed_postgres: "{{ matrix_playbook_synapse_uses_managed_postgres and matrix_synapse_auto_compressor_database_hostname == matrix_synapse_database_host }}"

# For exposing the Synapse worker (and metrics) ports to the local host.
matrix_synapse_workers_container_host_bind_address: "{{ matrix_playbook_service_host_bind_interface_prefix[0:-1] if (matrix_synapse_workers_enabled and matrix_playbook_service_host_bind_interface_prefix) else '' }}"

matrix_synapse_database_host: "{{ postgres_connection_hostname if matrix_playbook_synapse_uses_managed_postgres else '' }}"
matrix_synapse_database_password: "{{ (matrix_homeserver_generic_secret_key + ':synapse.db') | hash('sha512') | to_uuid }}"

# unix socket connection
matrix_synapse_database_socket_enabled: "{{ matrix_playbook_synapse_uses_managed_postgres and postgres_container_unix_socket_enabled }}"
# path to the Postgres socket's parent dir inside the Synapse container
matrix_synapse_database_socket_path: "{{ '/run-postgres' if matrix_playbook_synapse_uses_managed_postgres else '' }}"
# path to the Postgres socket on the host, using Postgres
matrix_synapse_database_socket_path_host: "{{ postgres_run_path if matrix_playbook_synapse_uses_managed_postgres else '' }}"

matrix_synapse_macaroon_secret_key: "{{ (matrix_homeserver_generic_secret_key + ':synapse.mac') | hash('sha512') | to_uuid }}"

# We do not enable TLS in Synapse by default, since it's handled by Traefik.
matrix_synapse_tls_federation_listener_enabled: false
matrix_synapse_tls_certificate_path: ~
matrix_synapse_tls_private_key_path: ~

matrix_synapse_federation_port_openid_resource_required: "{{ not matrix_synapse_federation_enabled and (matrix_user_verification_service_enabled or matrix_livekit_jwt_service_enabled) }}"

matrix_synapse_metrics_enabled: "{{ prometheus_enabled or matrix_metrics_exposure_enabled }}"

matrix_synapse_metrics_proxying_enabled: "{{ matrix_synapse_metrics_enabled and matrix_metrics_exposure_enabled }}"
matrix_synapse_metrics_proxying_hostname: "{{ matrix_metrics_exposure_hostname }}"
matrix_synapse_metrics_proxying_path_prefix: "{{ matrix_metrics_exposure_path_prefix }}/synapse"

matrix_synapse_email_enabled: "{{ exim_relay_enabled }}"
matrix_synapse_email_smtp_host: "{{ exim_relay_identifier }}"
matrix_synapse_email_smtp_port: 8025
matrix_synapse_email_notif_from: "Matrix <{{ exim_relay_sender_address }}>"

matrix_synapse_turn_uris: "{{ coturn_turn_uris if coturn_enabled else [] }}"
matrix_synapse_turn_shared_secret: "{{ coturn_turn_static_auth_secret if (coturn_enabled and coturn_authentication_method == 'auth-secret') else '' }}"
matrix_synapse_turn_username: "{{ coturn_lt_cred_mech_username if (coturn_enabled and coturn_authentication_method == 'lt-cred-mech') else '' }}"
matrix_synapse_turn_password: "{{ coturn_lt_cred_mech_password if (coturn_enabled and coturn_authentication_method == 'lt-cred-mech') else '' }}"

matrix_synapse_self_check_validate_certificates: "{{ matrix_playbook_ssl_enabled }}"

matrix_synapse_systemd_required_services_list_auto: |
  {{
    ([postgres_identifier ~ '.service'] if (matrix_playbook_synapse_uses_managed_postgres and postgres_container_network != matrix_synapse_container_network) else [])
    +
    ([valkey_identifier ~ '.service'] if matrix_playbook_synapse_uses_managed_valkey else [])
    +
    (['matrix-goofys.service'] if matrix_s3_media_store_enabled else [])
    +
    (['matrix-authentication-service.service'] if (matrix_synapse_matrix_authentication_service_enabled and matrix_synapse_matrix_authentication_service_endpoint == matrix_authentication_service_http_base_container_url) else [])
  }}

matrix_synapse_systemd_wanted_services_list_auto: |
  {{
    ([coturn_identifier ~ '.service'] if coturn_enabled else [])
    +
    ([exim_relay_identifier ~ '.service'] if exim_relay_enabled else [])
  }}

# Synapse workers (used for parallel load-scaling) need Redis for IPC.
matrix_synapse_redis_enabled: "{{ valkey_enabled }}"
matrix_synapse_redis_host: "{{ valkey_identifier if matrix_playbook_synapse_uses_managed_valkey else '' }}"
matrix_synapse_redis_password: "{{ valkey_connection_password if matrix_playbook_synapse_uses_managed_valkey else '' }}"

# unix socket connection
matrix_synapse_redis_path_enabled: "{{ matrix_playbook_synapse_uses_managed_valkey }}"
# path to the Redis socket's parent dir inside the Synapse container
matrix_synapse_redis_path: "{{ '/run-valkey' if matrix_playbook_synapse_uses_managed_valkey else '' }}"
# redis socket filename
matrix_synapse_redis_path_socket: "{{ '/valkey.sock' if matrix_playbook_synapse_uses_managed_valkey else '' }}"
# path to the Redis socket on the host, using Valkey
matrix_synapse_redis_path_host: "{{ valkey_run_path if matrix_playbook_synapse_uses_managed_valkey else '' }}"

matrix_synapse_container_extra_arguments_auto: "{{ matrix_homeserver_container_extra_arguments_auto }}"
matrix_synapse_app_service_config_files_auto: "{{ matrix_homeserver_app_service_config_files_auto }}"

# Disable creation of media repository Synapse worker when using media-repo
matrix_synapse_ext_media_repo_enabled: "{{ matrix_media_repo_enabled }}"

# The synapse-http-antispam module reports to a single consumer, so at most one of
# Draupnir and Meowlnir may claim it. Each role's validation fails the run if both do.
matrix_synapse_ext_synapse_http_antispam_enabled: "{{ matrix_bot_draupnir_config_web_synapseHTTPAntispam_enabled or matrix_bot_meowlnir_synapse_http_antispam_enabled }}"
matrix_synapse_ext_synapse_http_antispam_config_base_url: "{{ matrix_bot_draupnir_synapse_http_antispam_config_base_url if matrix_bot_draupnir_config_web_synapseHTTPAntispam_enabled else (matrix_bot_meowlnir_synapse_http_antispam_config_base_url if matrix_bot_meowlnir_synapse_http_antispam_enabled else '') }}"
matrix_synapse_ext_synapse_http_antispam_config_authorization: "{{ matrix_bot_draupnir_config_web_synapseHTTPAntispam_authorization if matrix_bot_draupnir_config_web_synapseHTTPAntispam_enabled else (matrix_bot_meowlnir_config_antispam_secret if matrix_bot_meowlnir_synapse_http_antispam_enabled else '') }}"
matrix_synapse_ext_synapse_http_antispam_config_enabled_callbacks: "{{ matrix_bot_draupnir_synapse_http_antispam_config_enabled_callbacks if matrix_bot_draupnir_config_web_synapseHTTPAntispam_enabled else (matrix_bot_meowlnir_synapse_http_antispam_config_enabled_callbacks if matrix_bot_meowlnir_synapse_http_antispam_enabled else []) }}"
matrix_synapse_ext_synapse_http_antispam_config_fail_open: "{{ matrix_bot_draupnir_synapse_http_antispam_config_fail_open if matrix_bot_draupnir_config_web_synapseHTTPAntispam_enabled else (matrix_bot_meowlnir_synapse_http_antispam_config_fail_open if matrix_bot_meowlnir_synapse_http_antispam_enabled else {}) }}"
matrix_synapse_ext_synapse_http_antispam_config_async: "{{ matrix_bot_draupnir_synapse_http_antispam_config_async if matrix_bot_draupnir_config_web_synapseHTTPAntispam_enabled else (matrix_bot_meowlnir_synapse_http_antispam_config_async if matrix_bot_meowlnir_synapse_http_antispam_enabled else {}) }}"

# Meowlnir's bots and Hookshot need these to support end-to-end encryption.
# Synapse only sends the extra data to appservices which ask for it in their registration file,
# so enabling these affects no other component.
matrix_synapse_experimental_features_msc2409_to_device_messages_enabled: |-
  {{
    (matrix_bot_meowlnir_enabled and matrix_bot_meowlnir_config_encryption_enable)
    or
    (matrix_bridge_hookshot_enabled and matrix_bridge_hookshot_encryption_enabled)
  }}
matrix_synapse_experimental_features_msc3202_transaction_extensions_enabled: |-
  {{
    (matrix_bot_meowlnir_enabled and matrix_bot_meowlnir_config_encryption_enable)
    or
    (matrix_bridge_hookshot_enabled and matrix_bridge_hookshot_encryption_enabled)
  }}

# Enable Synapse statistics reporting when using synapse-usage-exporter
matrix_synapse_report_stats: "{{ matrix_synapse_usage_exporter_enabled }}"
matrix_synapse_report_stats_endpoint: "{{ (('http://' + matrix_synapse_usage_exporter_identifier + ':' + matrix_synapse_usage_exporter_container_port | string + '/report-usage-stats/push') if matrix_synapse_usage_exporter_enabled else matrix_synapse_report_stats_endpoint_default) }}"

matrix_synapse_matrix_authentication_service_enabled: "{{ matrix_authentication_service_enabled }}"
matrix_synapse_matrix_authentication_service_endpoint: "{{ matrix_authentication_service_http_base_container_url if matrix_authentication_service_enabled else '' }}"
matrix_synapse_matrix_authentication_service_secret: "{{ matrix_authentication_service_config_matrix_secret if matrix_authentication_service_enabled else '' }}"

matrix_synapse_experimental_features_msc4108_enabled: "{{ matrix_authentication_service_enabled and not matrix_authentication_service_migration_in_progress }}"

matrix_synapse_delayed_events_enabled: "{{ matrix_rtc_enabled }}"

matrix_synapse_matrix_rtc_transports_livekit_url: "{{ matrix_livekit_jwt_service_public_url if matrix_livekit_jwt_service_enabled else '' }}"

matrix_synapse_experimental_features_msc4222_enabled: "{{ matrix_rtc_enabled }}"

matrix_synapse_experimental_features_msc4354_enabled: "{{ matrix_rtc_enabled }}"

# Disable password authentication when delegating authentication to Matrix Authentication Service.
# Unless this is done, Synapse fails on startup with:
# > Error in configuration at 'password_config.enabled':
# > Password auth cannot be enabled when OAuth delegation is enabled
matrix_synapse_password_config_enabled: "{{ not matrix_synapse_matrix_authentication_service_enabled }}"

matrix_synapse_register_user_script_matrix_authentication_service_path: "{{ matrix_authentication_service_bin_path }}/register-user"

# After Synapse's systemd health check passes, the reverse proxy still needs time to
# discover the container and register its routes. We derive this delay from Traefik's
# providers.providersThrottleDuration setting (+1s grace for our healthcheck polling interval),
# so it stays in sync automatically.
matrix_synapse_systemd_service_post_start_delay_seconds: "{{ (traefik_config_providers_providersThrottleDuration_seconds | int + 1) if matrix_playbook_reverse_proxy_type in ['playbook-managed-traefik', 'other-traefik-container'] else 0 }}"

matrix_synapse_reverse_proxy_companion_systemd_required_services_list_default: "{{ [devture_systemd_docker_base_docker_service_name] if devture_systemd_docker_base_docker_service_name else [] }}"
matrix_synapse_reverse_proxy_companion_container_image_registry_prefix_upstream: "{{ matrix_container_global_registry_prefix_override if matrix_container_global_registry_prefix_override else matrix_synapse_reverse_proxy_companion_container_image_registry_prefix_upstream_default }}"
matrix_synapse_reverse_proxy_companion_container_client_api_host_bind_port: "{{ (matrix_playbook_service_host_bind_interface_prefix ~ '8008') if matrix_playbook_service_host_bind_interface_prefix else '' }}"
matrix_synapse_reverse_proxy_companion_container_federation_api_host_bind_port: "{{ (matrix_playbook_service_host_bind_interface_prefix ~ '8048') if matrix_playbook_service_host_bind_interface_prefix else '' }}"
matrix_synapse_reverse_proxy_companion_container_labels_traefik_enabled: "{{ matrix_playbook_reverse_proxy_type in ['playbook-managed-traefik', 'other-traefik-container'] }}"
matrix_synapse_reverse_proxy_companion_container_labels_traefik_docker_network: "{{ matrix_playbook_reverse_proxyable_services_additional_network }}"
matrix_synapse_reverse_proxy_companion_container_labels_traefik_entrypoints: "{{ traefik_entrypoint_primary }}"
matrix_synapse_reverse_proxy_companion_container_labels_traefik_tls_certResolver: "{{ traefik_certResolver_primary }}"
matrix_synapse_reverse_proxy_companion_container_labels_traefik_hostname: "{{ matrix_server_fqn_matrix }}"
matrix_synapse_reverse_proxy_companion_container_labels_traefik_compression_middleware_enabled: "{{ matrix_playbook_reverse_proxy_traefik_middleware_compression_enabled }}"
matrix_synapse_reverse_proxy_companion_container_labels_traefik_compression_middleware_name: "{{ matrix_playbook_reverse_proxy_traefik_middleware_compression_name if matrix_playbook_reverse_proxy_traefik_middleware_compression_enabled else '' }}"
matrix_synapse_reverse_proxy_companion_container_labels_internal_client_synapse_admin_api_traefik_entrypoints: "{{ matrix_playbook_internal_matrix_client_api_traefik_entrypoint_name }}"
matrix_synapse_reverse_proxy_companion_access_log_syslog_integration_enabled: "{{ prometheus_nginxlog_exporter_enabled }}"
matrix_synapse_reverse_proxy_companion_access_log_syslog_integration_server_port: "{{ (prometheus_nginxlog_exporter_identifier | string +':'+ prometheus_nginxlog_exporter_container_syslog_port | string) | default('') }}"

matrix_synapse_reverse_proxy_companion_container_additional_networks_auto: |
  {{
    (
      ([matrix_playbook_reverse_proxyable_services_additional_network] if matrix_synapse_reverse_proxy_companion_container_labels_traefik_enabled and matrix_playbook_reverse_proxyable_services_additional_network else [])
      +
      ([prometheus_nginxlog_exporter_container_network] if (prometheus_nginxlog_exporter_enabled and prometheus_nginxlog_exporter_container_network != matrix_synapse_reverse_proxy_companion_container_network) else [])
      +
      ([] if matrix_homeserver_container_network in ['', matrix_synapse_reverse_proxy_companion_container_network] else [matrix_homeserver_container_network])
    ) | unique
  }}

######################################################################
#
# /matrix-synapse
#
######################################################################


######################################################################
#
# matrix-synapse-auto-compressor
#
######################################################################

# Not enabled by default, for now
matrix_synapse_auto_compressor_enabled: false

matrix_synapse_auto_compressor_uid: "{{ matrix_user_uid }}"
matrix_synapse_auto_compressor_gid: "{{ matrix_user_gid }}"

matrix_synapse_auto_compressor_postgres_image: "{{ postgres_container_image_to_use }}"

matrix_synapse_auto_compressor_container_image_registry_prefix_upstream: "{{ matrix_container_global_registry_prefix_override if matrix_container_global_registry_prefix_override else matrix_synapse_auto_compressor_container_image_registry_prefix_upstream_default }}"

matrix_synapse_auto_compressor_container_image_self_build: "{{ matrix_architecture not in ['arm64', 'amd64'] }}"

matrix_synapse_auto_compressor_container_network: "{{ (postgres_container_network if matrix_playbook_synapse_auto_compressor_uses_managed_postgres else 'matrix-synapse-auto-compressor') }}"

matrix_synapse_auto_compressor_database_username: "{{ matrix_synapse_database_user if matrix_synapse_enabled else '' }}"
matrix_synapse_auto_compressor_database_password: "{{ matrix_synapse_database_password if matrix_synapse_enabled else '' }}"
matrix_synapse_auto_compressor_database_hostname: "{{ matrix_synapse_database_host if matrix_synapse_enabled else '' }}"
matrix_synapse_auto_compressor_database_port: "{{ matrix_synapse_database_port if matrix_synapse_enabled else '5432' }}"
matrix_synapse_auto_compressor_database_name: "{{ matrix_synapse_database_database if matrix_synapse_enabled else '' }}"

matrix_synapse_auto_compressor_systemd_required_services_list_auto: |
  {{
    ([postgres_identifier ~ '.service'] if matrix_playbook_synapse_auto_compressor_uses_managed_postgres else [])
  }}

######################################################################
#
# /matrix-synapse-auto-compressor
#
######################################################################


######################################################################
#
# matrix-ketesa
#
######################################################################

matrix_ketesa_enabled: false

matrix_ketesa_container_image_registry_prefix_upstream: "{{ matrix_container_global_registry_prefix_override if matrix_container_global_registry_prefix_override else matrix_ketesa_container_image_registry_prefix_upstream_default }}"

matrix_ketesa_container_uid: "{{ matrix_user_uid }}"
matrix_ketesa_container_gid: "{{ matrix_user_gid }}"

matrix_ketesa_container_http_host_bind_port: "{{ (matrix_playbook_service_host_bind_interface_prefix ~ '8766') if matrix_playbook_service_host_bind_interface_prefix else '' }}"

matrix_ketesa_container_image_self_build: "{{ matrix_architecture not in ['arm64', 'amd64'] }}"

matrix_ketesa_container_network: "{{ matrix_addons_container_network }}"

matrix_ketesa_container_additional_networks: "{{ [matrix_playbook_reverse_proxyable_services_additional_network] if matrix_playbook_reverse_proxyable_services_additional_network else [] }}"

matrix_ketesa_container_labels_traefik_enabled: "{{ matrix_playbook_reverse_proxy_type in ['playbook-managed-traefik', 'other-traefik-container'] }}"
matrix_ketesa_container_labels_traefik_docker_network: "{{ matrix_playbook_reverse_proxyable_services_additional_network }}"
matrix_ketesa_container_labels_traefik_entrypoints: "{{ traefik_entrypoint_primary }}"
matrix_ketesa_container_labels_traefik_tls_certResolver: "{{ traefik_certResolver_primary }}"

matrix_ketesa_config_externalAuthProvider: "{{ matrix_authentication_service_enabled | default(false) or matrix_synapse_ext_password_provider_ldap_enabled | default(false) }}"

matrix_ketesa_config_asManagedUsers_auto: |
  {{
    ([
      '^@'+(matrix_alertmanager_receiver_config_matrix_user_id_localpart | default('') | regex_escape) +':'+(matrix_domain | regex_escape)+'$',
    ] if matrix_alertmanager_receiver_enabled else [])
    +
    ([
      '^@'+(matrix_appservice_draupnir_for_all_user_prefix | default('') | regex_escape) +'_[a-zA-Z0-9]+:'+(matrix_domain | regex_escape)+'$',
    ] if matrix_appservice_draupnir_for_all_enabled else [])
    +
    ([
      matrix_bot_meowlnir_user_regex,
      matrix_bot_meowlnir_appservice_sender_regex,
    ] if matrix_bot_meowlnir_enabled else [])
    +
    ([
      '^@'+(matrix_bot_baibot_config_user_mxid_localpart | default('') | regex_escape) +':'+(matrix_domain | regex_escape)+'$',
    ] if matrix_bot_baibot_enabled else [])
    +
    ([
      '^@'+(matrix_bot_buscarron_login | default('') | regex_escape) +':'+(matrix_domain | regex_escape)+'$',
    ] if matrix_bot_buscarron_enabled else [])
    +
    ([
      '^@'+(matrix_bot_draupnir_login | default('') | regex_escape) +':'+(matrix_domain | regex_escape)+'$',
    ] if matrix_bot_draupnir_enabled else [])
    +
    ([
      '^@'+(matrix_bot_honoroit_login | default('') | regex_escape) +':'+(matrix_domain | regex_escape)+'$',
    ] if matrix_bot_honoroit_enabled else [])
    +
    ([
      '^@'+(matrix_bot_matrix_reminder_bot_matrix_user_id_localpart | default('') | regex_escape) +':'+(matrix_domain | regex_escape)+'$',
    ] if matrix_bot_matrix_reminder_bot_enabled else [])
    +
    ([
      '^@'+(matrix_bot_maubot_login | default('') | regex_escape) +':'+(matrix_domain | regex_escape)+'$',
    ] if matrix_bot_maubot_enabled else [])
    +
    ([
      '^@'+(matrix_bridge_postmoogle_login | default('') | regex_escape) +':'+(matrix_domain | regex_escape)+'$',
    ] if matrix_bridge_postmoogle_enabled else [])
    +
    ([
      '^@_discord_[a-zA-Z0-9]+:'+(matrix_domain | regex_escape)+'$',
    ] if matrix_bridge_appservice_discord_enabled else [])
    +
    ([
      '^@'+(matrix_bridge_beeper_linkedin_appservice_bot_username | default('') | regex_escape)+':'+(matrix_domain | regex_escape)+'$',
      '^@linkedin_[a-zA-Z0-9]+:'+(matrix_domain | regex_escape)+'$',
    ] if matrix_bridge_beeper_linkedin_enabled else [])
    +
    ([
      '^@'+(matrix_bridge_beeper_line_appservice_bot_username | default('') | regex_escape)+':'+(matrix_domain | regex_escape)+'$',
      '^@line_[a-zA-Z0-9]+:'+(matrix_domain | regex_escape)+'$',
    ] if matrix_bridge_beeper_line_enabled else [])
    +
    ([
      '^@heisenbridge:'+(matrix_domain | regex_escape)+'$',
      '^@hbirc_[a-zA-Z0-9]+:'+(matrix_domain | regex_escape)+'$',
    ] if matrix_bridge_heisenbridge_enabled else [])
    +
    ([
      '^@hookshot:'+(matrix_domain | regex_escape)+'$',
      '^@_github_[a-zA-Z0-9]+:'+(matrix_domain | regex_escape)+'$',
      '^@_gitlab_[a-zA-Z0-9]+:'+(matrix_domain | regex_escape)+'$',
      '^@_jira_[a-zA-Z0-9]+:'+(matrix_domain | regex_escape)+'$',
      '^@'+(matrix_bridge_hookshot_generic_userIdPrefix | default('') | regex_escape)+'[a-zA-Z0-9]+:'+(matrix_domain | regex_escape)+'$',
    ] if matrix_bridge_hookshot_enabled else [])
    +
    ([
      '^@'+(matrix_bridge_mautrix_bluesky_appservice_bot_username | default('') | regex_escape)+':'+(matrix_domain | regex_escape)+'$',
      '^@bluesky_[a-zA-Z0-9]+:'+(matrix_domain | regex_escape)+'$',
    ] if matrix_bridge_mautrix_bluesky_enabled else [])
    +
    ([
      '^@'+(matrix_bridge_rustpush_appservice_bot_username | default('') | regex_escape)+':'+(matrix_domain | regex_escape)+'$',
      '^@rustpush_[a-zA-Z0-9_.+-]+:'+(matrix_domain | regex_escape)+'$',
    ] if matrix_bridge_rustpush_enabled else [])
    +
    ([
      '^@'+(matrix_bridge_mautrix_discord_appservice_bot_username | default('') | regex_escape)+':'+(matrix_domain | regex_escape)+'$',
      '^@discord_[0-9]+:'+(matrix_domain | regex_escape)+'$',
    ] if matrix_bridge_mautrix_discord_enabled else [])
    +
    ([
      '^@'+(matrix_bridge_mautrix_gmessages_appservice_bot_username | default('') | regex_escape)+':'+(matrix_domain | regex_escape)+'$',
      '^@gmessages_[a-zA-Z0-9]+:'+(matrix_domain | regex_escape)+'$',
    ] if matrix_bridge_mautrix_gmessages_enabled else [])
    +
    ([
      '^@'+(matrix_bridge_mautrix_gvoice_appservice_bot_username | default('') | regex_escape)+':'+(matrix_domain | regex_escape)+'$',
      '^@gvoice_[a-zA-Z0-9]+:'+(matrix_domain | regex_escape)+'$',
    ] if matrix_bridge_mautrix_gvoice_enabled else [])
    +
    ([
      '^@'+(matrix_bridge_mautrix_linkedin_appservice_bot_username | default('') | regex_escape)+':'+(matrix_domain | regex_escape)+'$',
      '^@linkedin_[a-zA-Z0-9]+:'+(matrix_domain | regex_escape)+'$',
    ] if matrix_bridge_mautrix_linkedin_enabled else [])
    +
    ([
      '^@'+(matrix_bridge_mautrix_googlechat_appservice_bot_username | default('') | regex_escape)+':'+(matrix_domain | regex_escape)+'$',
      '^@googlechat_[a-zA-Z0-9]+:'+(matrix_domain | regex_escape)+'$',
    ] if matrix_bridge_mautrix_googlechat_enabled else [])
    +
    ([
      '^@'+(matrix_bridge_mautrix_meta_instagram_appservice_username | default('') | regex_escape)+':'+(matrix_domain | regex_escape)+'$',
      '^@'+(matrix_bridge_mautrix_meta_instagram_bridge_username_prefix | default('') | regex_escape)+'[a-zA-Z0-9]+:'+(matrix_domain | regex_escape)+'$',
    ] if matrix_bridge_mautrix_meta_instagram_enabled else [])
    +
    ([
      '^@'+(matrix_bridge_mautrix_meta_messenger_appservice_username | default('') | regex_escape)+':'+(matrix_domain | regex_escape)+'$',
      '^@'+(matrix_bridge_mautrix_meta_messenger_bridge_username_prefix | default('') | regex_escape)+'[a-zA-Z0-9]+:'+(matrix_domain | regex_escape)+'$',
    ] if matrix_bridge_mautrix_meta_messenger_enabled else [])
    +
    ([
      '^@'+(matrix_bridge_mautrix_signal_appservice_bot_username | default('') | regex_escape)+':'+(matrix_domain | regex_escape)+'$',
      '^@signal_[a-zA-Z0-9]+:'+(matrix_domain | regex_escape)+'$',
    ] if matrix_bridge_mautrix_signal_enabled else [])
    +
    ([
      '^@'+(matrix_bridge_mautrix_slack_appservice_bot_username | default('') | regex_escape)+':'+(matrix_domain | regex_escape)+'$',
      '^@slack_[a-zA-Z0-9\-]+:'+(matrix_domain | regex_escape)+'$',
    ] if matrix_bridge_mautrix_slack_enabled else [])
    +
    ([
      '^@'+(matrix_bridge_mautrix_telegram_appservice_bot_username | default('') | regex_escape)+':'+(matrix_domain | regex_escape)+'$',
      '^@telegram_(channel-)?[0-9]+:'+(matrix_domain | regex_escape)+'$',
    ] if matrix_bridge_mautrix_telegram_enabled else [])
    +
    ([
      '^@'+(matrix_bridge_mautrix_twitter_appservice_bot_username | default('') | regex_escape)+':'+(matrix_domain | regex_escape)+'$',
      '^@twitter_[a-zA-Z0-9]+:'+(matrix_domain | regex_escape)+'$',
    ] if matrix_bridge_mautrix_twitter_enabled else [])
    +
    ([
      '^@'+(matrix_bridge_mautrix_whatsapp_appservice_bot_username | default('') | regex_escape)+':'+(matrix_domain | regex_escape)+'$',
      '^@whatsapp_[0-9]+:'+(matrix_domain | regex_escape)+'$',
    ] if matrix_bridge_mautrix_whatsapp_enabled else [])
    +
    ([
      '^@'+(matrix_bridge_mautrix_wsproxy_imessage_appservice_bot_username | default('') | regex_escape)+':'+(matrix_domain | regex_escape)+'$',
      '^@imessage_[a-zA-Z0-9]+:'+(matrix_domain | regex_escape)+'$',
    ] if matrix_bridge_mautrix_wsproxy_enabled else [])
    +
    ([
      '^@_groupmepuppet_[a-zA-Z0-9]+:'+(matrix_domain | regex_escape)+'$',
    ] if matrix_bridge_mx_puppet_groupme_enabled else [])
    +
    ([
      '^@_steampuppet_[a-zA-Z0-9]+:'+(matrix_domain | regex_escape)+'$',
    ] if matrix_bridge_mx_puppet_steam_enabled else [])
    +
    ([
      '^@smsbot:'+(matrix_domain | regex_escape)+'$',
      '^@sms_[a-zA-Z0-9]+:'+(matrix_domain | regex_escape)+'$',
    ] if matrix_bridge_sms_enabled else [])
    +
    ([
      '^@'+(matrix_bridge_wechat_appservice_bot_username | default('') | regex_escape)+':'+(matrix_domain | regex_escape)+'$',
      '^@_wechat_[a-zA-Z0-9]+:'+(matrix_domain | regex_escape)+'$',
    ] if matrix_bridge_wechat_enabled else [])
    +
    ([
      '^@'+(matrix_bridge_steam_appservice_bot_username | default('') | regex_escape)+':'+(matrix_domain | regex_escape)+'$',
      '^@steam_[a-zA-Z0-9]+:'+(matrix_domain | regex_escape)+'$',
    ] if matrix_bridge_steam_enabled else [])
  }}

######################################################################
#
# /matrix-ketesa
#
######################################################################

######################################################################
#
# matrix-synapse-usage-exporter
#
######################################################################

matrix_synapse_usage_exporter_enabled: false

matrix_synapse_usage_exporter_container_image_registry_prefix_upstream: "{{ matrix_container_global_registry_prefix_override if matrix_container_global_registry_prefix_override else matrix_synapse_usage_exporter_container_image_registry_prefix_upstream_default }}"

matrix_synapse_usage_exporter_container_network: "{{ matrix_monitoring_container_network }}"

matrix_synapse_usage_exporter_container_additional_networks: "{{ [matrix_playbook_reverse_proxyable_services_additional_network] if matrix_playbook_reverse_proxyable_services_additional_network else [] }}"

matrix_synapse_usage_exporter_container_labels_traefik_docker_network: "{{ matrix_playbook_reverse_proxyable_services_additional_network }}"
matrix_synapse_usage_exporter_container_labels_traefik_entrypoints: "{{ traefik_entrypoint_primary }}"
matrix_synapse_usage_exporter_container_labels_traefik_tls_certResolver: "{{ traefik_certResolver_primary }}"

matrix_synapse_usage_exporter_metrics_proxying_enabled: "{{ matrix_metrics_exposure_enabled }}"
matrix_synapse_usage_exporter_metrics_proxying_hostname: "{{ matrix_metrics_exposure_hostname }}"
matrix_synapse_usage_exporter_metrics_proxying_path: "{{ matrix_metrics_exposure_path_prefix }}/synapse-usage-exporter"

matrix_synapse_usage_exporter_container_labels_traefik_metrics_middleware_basic_auth_enabled: "{{ matrix_metrics_exposure_http_basic_auth_enabled }}"
matrix_synapse_usage_exporter_container_labels_traefik_metrics_middleware_basic_auth_users: "{{ matrix_metrics_exposure_http_basic_auth_users }}"

######################################################################
#
# /matrix-synapse-usage-exporter
#
######################################################################

######################################################################
#
# prometheus_node_exporter
#
######################################################################

prometheus_node_exporter_enabled: false

prometheus_node_exporter_identifier: matrix-prometheus-node-exporter

prometheus_node_exporter_base_path: "{{ matrix_base_data_path }}/prometheus-node-exporter"

prometheus_node_exporter_uid: "{{ matrix_user_uid }}"
prometheus_node_exporter_gid: "{{ matrix_user_gid }}"

prometheus_node_exporter_hostname: "{{ matrix_server_fqn_matrix }}"

prometheus_node_exporter_container_image_registry_prefix_upstream: "{{ matrix_container_global_registry_prefix_override if matrix_container_global_registry_prefix_override else prometheus_node_exporter_container_image_registry_prefix_upstream_default }}"

prometheus_node_exporter_container_network: "{{ matrix_monitoring_container_network }}"

prometheus_node_exporter_container_additional_networks_auto: "{{ [matrix_playbook_reverse_proxyable_services_additional_network] if matrix_playbook_reverse_proxyable_services_additional_network else [] }}"

prometheus_node_exporter_container_labels_metrics_enabled: "{{ matrix_metrics_exposure_enabled }}"
prometheus_node_exporter_container_labels_metrics_docker_network: "{{ matrix_playbook_reverse_proxyable_services_additional_network }}"
prometheus_node_exporter_container_labels_metrics_entrypoints: "{{ traefik_entrypoint_primary }}"
prometheus_node_exporter_container_labels_metrics_tls_certResolver: "{{ traefik_certResolver_primary }}"
prometheus_node_exporter_container_labels_metrics_middleware_basic_auth_enabled: "{{ matrix_metrics_exposure_http_basic_auth_enabled }}"
prometheus_node_exporter_container_labels_metrics_middleware_basic_auth_users: "{{ matrix_metrics_exposure_http_basic_auth_users }}"

######################################################################
#
# /prometheus_node_exporter
#
######################################################################


######################################################################
#
# prometheus_postgres_exporter
#
######################################################################

prometheus_postgres_exporter_enabled: false

prometheus_postgres_exporter_identifier: matrix-prometheus-postgres-exporter

prometheus_postgres_exporter_base_path: "{{ matrix_base_data_path }}/prometheus-postgres-exporter"

prometheus_postgres_exporter_uid: "{{ matrix_user_uid }}"
prometheus_postgres_exporter_gid: "{{ matrix_user_gid }}"

prometheus_postgres_exporter_hostname: "{{ matrix_server_fqn_matrix }}"

prometheus_postgres_exporter_container_image_registry_prefix_upstream: "{{ matrix_container_global_registry_prefix_override if matrix_container_global_registry_prefix_override else prometheus_postgres_exporter_container_image_registry_prefix_upstream_default }}"

prometheus_postgres_exporter_container_network: "{{ matrix_monitoring_container_network }}"

prometheus_postgres_exporter_container_additional_networks: |
  {{
    ([postgres_container_network] if (postgres_enabled and prometheus_postgres_exporter_database_hostname == postgres_connection_hostname and prometheus_postgres_exporter_container_network != postgres_container_network) else [])
    +
    ([matrix_playbook_reverse_proxyable_services_additional_network] if matrix_playbook_reverse_proxyable_services_additional_network and prometheus_postgres_exporter_container_labels_metrics_enabled else [])
  }}

prometheus_postgres_exporter_container_labels_metrics_enabled: "{{ matrix_metrics_exposure_enabled }}"
prometheus_postgres_exporter_container_labels_metrics_docker_network: "{{ matrix_playbook_reverse_proxyable_services_additional_network }}"
prometheus_postgres_exporter_container_labels_metrics_entrypoints: "{{ traefik_entrypoint_primary }}"
prometheus_postgres_exporter_container_labels_metrics_tls_certResolver: "{{ traefik_certResolver_primary }}"
prometheus_postgres_exporter_container_labels_metrics_middleware_basic_auth_enabled: "{{ matrix_metrics_exposure_http_basic_auth_enabled }}"
prometheus_postgres_exporter_container_labels_metrics_middleware_basic_auth_users: "{{ matrix_metrics_exposure_http_basic_auth_users }}"

prometheus_postgres_exporter_database_hostname: "{{ postgres_connection_hostname if postgres_enabled else '' }}"
prometheus_postgres_exporter_database_username: matrix_prometheus_postgres_exporter
prometheus_postgres_exporter_database_password: "{{ (matrix_homeserver_generic_secret_key + ':prometheus.pg.db') | hash('sha512') | to_uuid }}"
prometheus_postgres_exporter_database_name: matrix_prometheus_postgres_exporter

prometheus_postgres_exporter_systemd_required_services_list_auto: |
  {{
    ([postgres_identifier ~ '.service'] if (postgres_enabled and prometheus_postgres_exporter_database_hostname == postgres_connection_hostname) else [])
  }}

######################################################################
#
# /prometheus_postgres_exporter
#
######################################################################


######################################################################
#
# prometheus_nginxlog_exporter
#
######################################################################

prometheus_nginxlog_exporter_enabled: false

prometheus_nginxlog_exporter_identifier: matrix-prometheus-nginxlog-exporter
prometheus_nginxlog_exporter_base_path: "{{ matrix_base_data_path }}/prometheus-nginxlog-exporter"

prometheus_nginxlog_exporter_uid: "{{ matrix_user_uid }}"
prometheus_nginxlog_exporter_gid: "{{ matrix_user_gid }}"

prometheus_nginxlog_exporter_hostname: "{{ matrix_server_fqn_matrix }}"

prometheus_nginxlog_exporter_container_image_registry_prefix_upstream: "{{ matrix_container_global_registry_prefix_override if matrix_container_global_registry_prefix_override else prometheus_nginxlog_exporter_container_image_registry_prefix_upstream_default }}"

prometheus_nginxlog_exporter_container_network: "{{ matrix_monitoring_container_network }}"
prometheus_nginxlog_exporter_container_network_deletion_enabled: false

prometheus_nginxlog_exporter_container_additional_networks_auto: |-
  {{
    ([matrix_playbook_reverse_proxyable_services_additional_network] if (matrix_playbook_reverse_proxyable_services_additional_network and prometheus_nginxlog_exporter_container_labels_metrics_enabled) else [])
  }}

prometheus_nginxlog_exporter_container_labels_metrics_enabled: "{{ matrix_metrics_exposure_enabled }}"
prometheus_nginxlog_exporter_container_labels_metrics_docker_network: "{{ matrix_playbook_reverse_proxyable_services_additional_network }}"
prometheus_nginxlog_exporter_container_labels_metrics_entrypoints: "{{ traefik_entrypoint_primary }}"
prometheus_nginxlog_exporter_container_labels_metrics_tls_certResolver: "{{ traefik_certResolver_primary }}"
prometheus_nginxlog_exporter_container_labels_metrics_middleware_basic_auth_enabled: "{{ matrix_metrics_exposure_http_basic_auth_enabled }}"
prometheus_nginxlog_exporter_container_labels_metrics_middleware_basic_auth_users: "{{ matrix_metrics_exposure_http_basic_auth_users }}"

prometheus_nginxlog_exporter_config_namespaces_source_tags_auto: |
  {{
    ([matrix_synapse_reverse_proxy_companion_access_log_syslog_integration_tag] if matrix_synapse_reverse_proxy_companion_access_log_syslog_integration_enabled else [])
  }}

prometheus_nginxlog_exporter_architecture: "{{ matrix_architecture }}"

######################################################################
#
# /prometheus_nginxlog_exporter
#
######################################################################


######################################################################
#
# prometheus
#
######################################################################

prometheus_enabled: false

prometheus_identifier: matrix-prometheus

prometheus_base_path: "{{ matrix_base_data_path }}/prometheus"

prometheus_uid: "{{ matrix_user_uid }}"
prometheus_gid: "{{ matrix_user_gid }}"

prometheus_container_image_registry_prefix_upstream: "{{ matrix_container_global_registry_prefix_override if matrix_container_global_registry_prefix_override else prometheus_container_image_registry_prefix_upstream_default }}"

prometheus_container_network: "{{ matrix_monitoring_container_network }}"

prometheus_container_additional_networks_auto: |
  {{
    (
      ([prometheus_nginxlog_exporter_container_network] if matrix_prometheus_services_connect_scraper_nginxlog_enabled and prometheus_nginxlog_exporter_container_network != prometheus_container_network else [])
      +
      ([prometheus_node_exporter_container_network] if prometheus_self_node_scraper_enabled and prometheus_node_exporter_container_network != prometheus_container_network else [])
      +
      ([matrix_synapse_container_network] if matrix_prometheus_services_connect_scraper_synapse_enabled and matrix_synapse_container_network != prometheus_container_network else [])
      +
      ([prometheus_postgres_exporter_container_network] if matrix_prometheus_services_connect_scraper_postgres_enabled and prometheus_postgres_exporter_container_network != prometheus_container_network else [])
      +
      ([matrix_bridge_hookshot_container_network] if matrix_prometheus_services_connect_scraper_hookshot_enabled and matrix_bridge_hookshot_container_network != prometheus_container_network else [])
      +
      ([matrix_media_repo_container_network] if matrix_prometheus_services_connect_scraper_media_repo_enabled and matrix_media_repo_container_network != prometheus_container_network else [])
      +
      ([matrix_synapse_usage_exporter_container_network] if matrix_prometheus_services_connect_scraper_synapse_usage_exporter_enabled and matrix_synapse_usage_exporter_container_network != prometheus_container_network else [])
      +
      ([ntfy_container_network] if matrix_prometheus_services_connect_scraper_ntfy_enabled and ntfy_container_network != prometheus_container_network else [])
    ) | unique
  }}

prometheus_container_http_host_bind_port: "{{ (matrix_playbook_service_host_bind_interface_prefix ~ '9090') if matrix_playbook_service_host_bind_interface_prefix else '' }}"

prometheus_config_rule_files_auto: |
  {{
    (['synapse-v2.rules'] if matrix_prometheus_services_connect_synapse_rules_enabled else [])
  }}

prometheus_self_node_scraper_enabled: "{{ prometheus_node_exporter_enabled }}"
prometheus_self_node_scraper_static_configs_target: "{{ (prometheus_node_exporter_identifier + ':9100') if prometheus_node_exporter_enabled else '' }}"

prometheus_config_scrape_configs_auto: |
  {{
    (matrix_prometheus_services_connect_scraper_synapse_configs if matrix_prometheus_services_connect_scraper_synapse_enabled else [])
    +
    (matrix_prometheus_services_connect_scraper_postgres_scrape_configs if matrix_prometheus_services_connect_scraper_postgres_enabled else [])
    +
    (matrix_prometheus_services_connect_scraper_hookshot_scrape_configs if matrix_prometheus_services_connect_scraper_hookshot_enabled else [])
    +
    (matrix_prometheus_services_connect_scraper_nginxlog_scrape_configs if matrix_prometheus_services_connect_scraper_nginxlog_enabled else [])
    +
    (matrix_prometheus_services_connect_scraper_media_repo_scrape_configs if matrix_prometheus_services_connect_scraper_media_repo_enabled else [])
    +
    (matrix_prometheus_services_connect_scraper_synapse_usage_exporter_scrape_configs if matrix_prometheus_services_connect_scraper_synapse_usage_exporter_enabled else [])
    +
    (matrix_prometheus_services_connect_scraper_ntfy_scrape_configs if matrix_prometheus_services_connect_scraper_ntfy_enabled else [])
  }}

######################################################################
#
# /prometheus
#
######################################################################


######################################################################
#
# matrix-prometheus-services-connect
#
######################################################################

matrix_prometheus_services_connect_synapse_enabled: "{{ prometheus_enabled and matrix_synapse_enabled }}"

matrix_prometheus_services_connect_synapse_rules_download_synapse_tag: "{{ matrix_synapse_container_image_tag }}"
matrix_prometheus_services_connect_synapse_rules_download_dir_path: "{{ prometheus_config_path }}"
matrix_prometheus_services_connect_synapse_rules_download_owner: "{{ prometheus_uid }}"
matrix_prometheus_services_connect_synapse_rules_download_group: "{{ prometheus_gid }}"

matrix_prometheus_services_connect_scraper_synapse_enabled: "{{ matrix_synapse_enabled and matrix_synapse_metrics_enabled }}"
matrix_prometheus_services_connect_scraper_synapse_main_process_static_configs_target: "matrix-synapse:{{ matrix_synapse_metrics_port }}"
matrix_prometheus_services_connect_scraper_synapse_workers_enabled_list: "{{ matrix_synapse_workers_enabled_list }}"

matrix_prometheus_services_connect_scraper_postgres_enabled: "{{ prometheus_postgres_exporter_enabled }}"
matrix_prometheus_services_connect_scraper_postgres_static_configs_target: "{{ prometheus_postgres_exporter_identifier }}:{{ prometheus_postgres_exporter_container_http_port | string }}"

matrix_prometheus_services_connect_scraper_hookshot_enabled: "{{ matrix_bridge_hookshot_enabled and matrix_bridge_hookshot_metrics_enabled }}"
matrix_prometheus_services_connect_scraper_hookshot_static_configs_target: "{{ matrix_bridge_hookshot_container_url }}:{{ matrix_bridge_hookshot_metrics_port | string }}"

matrix_prometheus_services_connect_scraper_nginxlog_enabled: "{{ prometheus_nginxlog_exporter_enabled }}"
matrix_prometheus_services_connect_scraper_nginxlog_static_configs_target: "{{ prometheus_nginxlog_exporter_identifier }}:{{ prometheus_nginxlog_exporter_container_metrics_port | string }}"

matrix_prometheus_services_connect_scraper_media_repo_enabled: "{{ matrix_media_repo_enabled and matrix_media_repo_metrics_enabled }}"
matrix_prometheus_services_connect_scraper_media_repo_static_configs_target: "{{ matrix_media_repo_identifier }}:{{ matrix_media_repo_metrics_port }}"

matrix_prometheus_services_connect_scraper_synapse_usage_exporter_enabled: "{{ matrix_synapse_usage_exporter_enabled }}"
matrix_prometheus_services_connect_scraper_synapse_usage_exporter_static_configs_target: "{{ matrix_synapse_usage_exporter_identifier }}:{{ matrix_synapse_usage_exporter_container_port | string }}"

matrix_prometheus_services_connect_scraper_ntfy_enabled: "{{ ntfy_enabled and ntfy_metrics_listen_http_port | string | length > 0 }}"
matrix_prometheus_services_connect_scraper_ntfy_static_configs_target: "{{ ntfy_identifier }}:{{ ntfy_metrics_listen_http_port | string }}"

######################################################################
#
# /matrix-prometheus-services-connect
#
######################################################################


######################################################################
#
# grafana
#
######################################################################

grafana_enabled: false

grafana_identifier: matrix-grafana

grafana_uid: "{{ matrix_user_uid }}"
grafana_gid: "{{ matrix_user_gid }}"

grafana_hostname: "{{ matrix_server_fqn_grafana }}"

grafana_base_path: "{{ matrix_base_data_path }}/grafana"

grafana_container_image_registry_prefix_upstream: "{{ matrix_container_global_registry_prefix_override if matrix_container_global_registry_prefix_override else grafana_container_image_registry_prefix_upstream_default }}"

grafana_container_network: "{{ matrix_monitoring_container_network }}"

grafana_container_additional_networks_auto: |
  {{
    (
      ([matrix_playbook_reverse_proxyable_services_additional_network] if matrix_playbook_reverse_proxyable_services_additional_network and grafana_container_labels_traefik_enabled else [])
      +
      ([prometheus_container_network] if prometheus_enabled and prometheus_container_network != grafana_container_network else [])
    ) | unique
  }}

grafana_container_labels_traefik_enabled: "{{ matrix_playbook_traefik_labels_enabled }}"
grafana_container_labels_traefik_docker_network: "{{ matrix_playbook_reverse_proxyable_services_additional_network }}"
grafana_container_labels_traefik_entrypoints: "{{ traefik_entrypoint_primary }}"
grafana_container_labels_traefik_tls_certResolver: "{{ traefik_certResolver_primary }}"

grafana_container_http_host_bind_port: "{{ (matrix_playbook_service_host_bind_interface_prefix ~ '3000') if matrix_playbook_service_host_bind_interface_prefix else '' }}"

grafana_provisioning_datasources_datasources: |
  {{
    ([{
      'name': (matrix_server_fqn_matrix + ' - Prometheus'),
      'type': 'prometheus',
      'access': 'proxy',
      'url': ('http://' + prometheus_identifier + ':9090'),
      'jsonData': {
        'timeInterval': prometheus_config_global_scrape_interval,
      }
    }] if prometheus_enabled else [])
  }}

grafana_dashboard_download_urls_auto: |
  {{
    (matrix_synapse_grafana_dashboard_urls if matrix_homeserver_implementation == 'synapse' and matrix_synapse_metrics_enabled else [])
    +
    (prometheus_node_exporter_dashboard_urls if prometheus_node_exporter_enabled else [])
    +
    (prometheus_postgres_exporter_dashboard_urls if prometheus_postgres_exporter_enabled else [])
    +
    (prometheus_nginxlog_exporter_dashboard_urls if prometheus_nginxlog_exporter_enabled else [])
    +
    (matrix_media_repo_dashboard_urls if matrix_media_repo_metrics_enabled else [])
    +
    (matrix_synapse_usage_exporter_dashboard_urls if matrix_synapse_usage_exporter_enabled else [])
  }}

grafana_provisioning_dashboard_template_files: |
  {{
    ([{
        'path': 'roles/galaxy/prometheus_nginxlog_exporter/templates/grafana/nginx-proxy.json',
        'name': 'nginx-proxy.json',
    }] if prometheus_nginxlog_exporter_enabled else [])
  }}

grafana_default_home_dashboard_path: |-
  {{
    {
      'synapse': ('/etc/grafana/dashboards/synapse.json' if matrix_synapse_metrics_enabled and matrix_synapse_metrics_enabled else ('/etc/grafana/dashboards/node-exporter-full.json' if prometheus_node_exporter_enabled else '')),
      'dendrite': ('/etc/grafana/dashboards/node-exporter-full.json' if prometheus_node_exporter_enabled else ''),
      'conduit': ('/etc/grafana/dashboards/node-exporter-full.json' if prometheus_node_exporter_enabled else ''),
      'continuwuity': ('/etc/grafana/dashboards/node-exporter-full.json' if prometheus_node_exporter_enabled else ''),
      'tuwunel': ('/etc/grafana/dashboards/node-exporter-full.json' if prometheus_node_exporter_enabled else ''),
    }[matrix_homeserver_implementation]
  }}

######################################################################
#
# /grafana
#
######################################################################

######################################################################
#
# matrix-dendrite
#
######################################################################

matrix_dendrite_enabled: "{{ matrix_homeserver_implementation == 'dendrite' }}"

matrix_dendrite_hostname: "{{ matrix_server_fqn_matrix }}"

matrix_dendrite_federation_enabled: "{{ matrix_homeserver_federation_enabled }}"

matrix_dendrite_container_image_registry_prefix_upstream: "{{ matrix_container_global_registry_prefix_override if matrix_container_global_registry_prefix_override else matrix_dendrite_container_image_registry_prefix_upstream_default }}"

matrix_dendrite_container_network: "{{ matrix_homeserver_container_network }}"

matrix_dendrite_container_additional_networks_auto: |
  {{
    (
      ([matrix_playbook_reverse_proxyable_services_additional_network] if matrix_dendrite_container_labels_traefik_enabled and matrix_playbook_reverse_proxyable_services_additional_network else [])
      +
      ([postgres_container_network] if (postgres_enabled and matrix_dendrite_database_hostname == postgres_connection_hostname and postgres_container_network != matrix_dendrite_container_network) else [])
    ) | unique
  }}

matrix_dendrite_container_http_host_bind_address: "{{ (matrix_playbook_service_host_bind_interface_prefix ~ matrix_dendrite_http_bind_port | string) if matrix_playbook_service_host_bind_interface_prefix else '' }}"
matrix_dendrite_container_https_host_bind_address: "{{ '' if not matrix_dendrite_https_bind_port or not matrix_playbook_service_host_bind_interface_prefix else (matrix_playbook_service_host_bind_interface_prefix + matrix_dendrite_https_bind_port | string) }}"

matrix_dendrite_container_labels_traefik_enabled: "{{ matrix_playbook_reverse_proxy_type in ['playbook-managed-traefik', 'other-traefik-container'] and not matrix_synapse_workers_enabled }}"
matrix_dendrite_container_labels_traefik_docker_network: "{{ matrix_playbook_reverse_proxyable_services_additional_network }}"
matrix_dendrite_container_labels_traefik_entrypoints: "{{ traefik_entrypoint_primary }}"
matrix_dendrite_container_labels_traefik_tls_certResolver: "{{ traefik_certResolver_primary }}"

matrix_dendrite_container_labels_public_client_synapse_admin_api_enabled: "{{ matrix_ketesa_enabled }}"

matrix_dendrite_container_labels_public_client_root_redirection_enabled: "{{ matrix_dendrite_container_labels_public_client_root_redirection_url != '' }}"
matrix_dendrite_container_labels_public_client_root_redirection_url: "{{ matrix_playbook_public_client_root_redirection_url }}"

matrix_dendrite_container_labels_public_federation_api_traefik_hostname: "{{ matrix_server_fqn_matrix_federation }}"
matrix_dendrite_container_labels_public_federation_api_traefik_entrypoints: "{{ matrix_federation_traefik_entrypoint_name }}"
matrix_dendrite_container_labels_public_federation_api_traefik_tls: "{{ matrix_federation_traefik_entrypoint_tls }}"

matrix_dendrite_container_labels_public_metrics_middleware_basic_auth_enabled: "{{ matrix_metrics_exposure_http_basic_auth_enabled }}"
matrix_dendrite_container_labels_public_metrics_middleware_basic_auth_users: "{{ matrix_metrics_exposure_http_basic_auth_users }}"

matrix_dendrite_metrics_enabled: "{{ prometheus_enabled or matrix_metrics_exposure_enabled }}"

matrix_dendrite_metrics_proxying_enabled: "{{ matrix_dendrite_metrics_enabled and matrix_metrics_exposure_enabled }}"
matrix_dendrite_metrics_proxying_hostname: "{{ matrix_metrics_exposure_hostname }}"
matrix_dendrite_metrics_proxying_path_prefix: "{{ matrix_metrics_exposure_path_prefix }}/dendrite"

matrix_dendrite_client_api_registration_shared_secret: "{{ (matrix_homeserver_generic_secret_key + ':dendrite.rss') | hash('sha512') | to_uuid }}"

matrix_dendrite_database_hostname: "{{ postgres_connection_hostname if postgres_enabled else '' }}"

matrix_dendrite_database_password: "{{ (matrix_homeserver_generic_secret_key + ':dendrite.db') | hash('sha512') | to_uuid }}"

matrix_dendrite_client_api_turn_uris: "{{ coturn_turn_uris if coturn_enabled else [] }}"
matrix_dendrite_client_api_turn_shared_secret: "{{ coturn_turn_static_auth_secret if (coturn_enabled and coturn_authentication_method == 'auth-secret') else '' }}"
matrix_dendrite_client_api_turn_username: "{{ coturn_lt_cred_mech_username if (coturn_enabled and coturn_authentication_method == 'lt-cred-mech') else '' }}"
matrix_dendrite_client_api_turn_password: "{{ coturn_lt_cred_mech_password if (coturn_enabled and coturn_authentication_method == 'lt-cred-mech') else '' }}"

matrix_dendrite_disable_tls_validation: "{{ not matrix_playbook_ssl_enabled }}"

matrix_dendrite_self_check_validate_certificates: "{{ matrix_playbook_ssl_enabled }}"

matrix_dendrite_trusted_id_servers: "{{ ['matrix.org', 'vector.im'] }}"

matrix_dendrite_systemd_required_services_list_auto: |
  {{
    ([postgres_identifier ~ '.service'] if (postgres_enabled and matrix_dendrite_database_hostname == postgres_connection_hostname) else [])
    +
    (['matrix-goofys.service'] if matrix_s3_media_store_enabled else [])
  }}

matrix_dendrite_systemd_wanted_services_list_auto: |
  {{
    ([coturn_identifier ~ '.service'] if coturn_enabled else [])
  }}

matrix_dendrite_container_extra_arguments_auto: "{{ matrix_homeserver_container_extra_arguments_auto }}"
matrix_dendrite_app_service_config_files_auto: "{{ matrix_homeserver_app_service_config_files_auto }}"

######################################################################
#
# /matrix-dendrite
#
######################################################################


######################################################################
#
# matrix-conduit
#
######################################################################

matrix_conduit_enabled: "{{ matrix_homeserver_implementation == 'conduit' }}"

matrix_conduit_hostname: "{{ matrix_server_fqn_matrix }}"

matrix_conduit_allow_federation: "{{ matrix_homeserver_federation_enabled }}"

matrix_conduit_container_image_registry_prefix_upstream: "{{ matrix_container_global_registry_prefix_override if matrix_container_global_registry_prefix_override else matrix_conduit_container_image_registry_prefix_upstream_default }}"

matrix_conduit_container_network: "{{ matrix_homeserver_container_network }}"

matrix_conduit_container_additional_networks_auto: |
  {{
    (
      ([matrix_playbook_reverse_proxyable_services_additional_network] if matrix_conduit_container_labels_traefik_enabled and matrix_playbook_reverse_proxyable_services_additional_network else [])
    ) | unique
  }}

matrix_conduit_container_labels_traefik_enabled: "{{ matrix_playbook_reverse_proxy_type in ['playbook-managed-traefik', 'other-traefik-container'] and not matrix_synapse_workers_enabled }}"
matrix_conduit_container_labels_traefik_docker_network: "{{ matrix_playbook_reverse_proxyable_services_additional_network }}"
matrix_conduit_container_labels_traefik_entrypoints: "{{ traefik_entrypoint_primary }}"
matrix_conduit_container_labels_traefik_tls_certResolver: "{{ traefik_certResolver_primary }}"

matrix_conduit_container_labels_public_client_root_redirection_enabled: "{{ matrix_conduit_container_labels_public_client_root_redirection_url != '' }}"
matrix_conduit_container_labels_public_client_root_redirection_url: "{{ matrix_playbook_public_client_root_redirection_url }}"

matrix_conduit_container_labels_public_federation_api_traefik_hostname: "{{ matrix_server_fqn_matrix_federation }}"
matrix_conduit_container_labels_public_federation_api_traefik_entrypoints: "{{ matrix_federation_traefik_entrypoint_name }}"
matrix_conduit_container_labels_public_federation_api_traefik_tls: "{{ matrix_federation_traefik_entrypoint_tls }}"

matrix_conduit_container_labels_internal_client_api_enabled: "{{ matrix_playbook_internal_matrix_client_api_traefik_entrypoint_enabled }}"
matrix_conduit_container_labels_internal_client_api_traefik_entrypoints: "{{ matrix_playbook_internal_matrix_client_api_traefik_entrypoint_name }}"

matrix_conduit_turn_uris: "{{ coturn_turn_uris if coturn_enabled else [] }}"
matrix_conduit_turn_secret: "{{ coturn_turn_static_auth_secret if (coturn_enabled and coturn_authentication_method == 'auth-secret') else '' }}"
matrix_conduit_turn_username: "{{ coturn_lt_cred_mech_username if (coturn_enabled and coturn_authentication_method == 'lt-cred-mech') else '' }}"
matrix_conduit_turn_password: "{{ coturn_lt_cred_mech_password if (coturn_enabled and coturn_authentication_method == 'lt-cred-mech') else '' }}"

######################################################################
#
# /matrix-conduit
#
######################################################################


######################################################################
#
# matrix-continuwuity
#
######################################################################

matrix_continuwuity_enabled: "{{ matrix_homeserver_implementation == 'continuwuity' }}"

matrix_continuwuity_hostname: "{{ matrix_server_fqn_matrix }}"

matrix_continuwuity_config_allow_federation: "{{ matrix_homeserver_federation_enabled }}"

matrix_continuwuity_config_well_known_client: "{{ matrix_homeserver_url if matrix_playbook_ssl_enabled else '' }}"

matrix_continuwuity_config_smtp_enabled: "{{ exim_relay_enabled }}"
matrix_continuwuity_config_smtp_connection_uri: "{{ ('smtp://' ~ exim_relay_identifier ~ ':8025') if exim_relay_enabled else '' }}"
matrix_continuwuity_config_smtp_sender: "{{ exim_relay_sender_address if exim_relay_enabled else '' }}"

matrix_continuwuity_container_image_registry_prefix_upstream: "{{ matrix_container_global_registry_prefix_override if matrix_container_global_registry_prefix_override else matrix_continuwuity_container_image_registry_prefix_upstream_default }}"

matrix_continuwuity_container_network: "{{ matrix_homeserver_container_network }}"

matrix_continuwuity_container_additional_networks_auto: |
  {{
    (
      ([matrix_playbook_reverse_proxyable_services_additional_network] if matrix_continuwuity_container_labels_traefik_enabled and matrix_playbook_reverse_proxyable_services_additional_network else [])
      +
      ([exim_relay_container_network] if (exim_relay_enabled and matrix_continuwuity_config_smtp_enabled and matrix_continuwuity_config_smtp_connection_uri == ('smtp://' ~ exim_relay_identifier ~ ':8025') and matrix_continuwuity_container_network != exim_relay_container_network) else [])
    ) | unique
  }}

matrix_continuwuity_container_labels_traefik_enabled: "{{ matrix_playbook_reverse_proxy_type in ['playbook-managed-traefik', 'other-traefik-container'] and not matrix_synapse_workers_enabled }}"
matrix_continuwuity_container_labels_traefik_docker_network: "{{ matrix_playbook_reverse_proxyable_services_additional_network }}"
matrix_continuwuity_container_labels_traefik_entrypoints: "{{ traefik_entrypoint_primary }}"
matrix_continuwuity_container_labels_traefik_tls_certResolver: "{{ traefik_certResolver_primary }}"

matrix_continuwuity_container_labels_public_client_root_redirection_enabled: "{{ matrix_continuwuity_container_labels_public_client_root_redirection_url != '' }}"
matrix_continuwuity_container_labels_public_client_root_redirection_url: "{{ matrix_playbook_public_client_root_redirection_url }}"

matrix_continuwuity_container_labels_public_federation_api_traefik_hostname: "{{ matrix_server_fqn_matrix_federation }}"
matrix_continuwuity_container_labels_public_federation_api_traefik_entrypoints: "{{ matrix_federation_traefik_entrypoint_name }}"
matrix_continuwuity_container_labels_public_federation_api_traefik_tls: "{{ matrix_federation_traefik_entrypoint_tls }}"

matrix_continuwuity_container_labels_internal_client_api_enabled: "{{ matrix_playbook_internal_matrix_client_api_traefik_entrypoint_enabled }}"
matrix_continuwuity_container_labels_internal_client_api_traefik_entrypoints: "{{ matrix_playbook_internal_matrix_client_api_traefik_entrypoint_name }}"

matrix_continuwuity_config_rtc_foci_livekit_url: "{{ matrix_livekit_jwt_service_public_url if matrix_livekit_jwt_service_enabled else '' }}"

matrix_continuwuity_config_turn_uris: "{{ coturn_turn_uris if coturn_enabled else [] }}"
matrix_continuwuity_config_turn_secret: "{{ coturn_turn_static_auth_secret if (coturn_enabled and coturn_authentication_method == 'auth-secret') else '' }}"
matrix_continuwuity_config_turn_username: "{{ coturn_lt_cred_mech_username if (coturn_enabled and coturn_authentication_method == 'lt-cred-mech') else '' }}"
matrix_continuwuity_config_turn_password: "{{ coturn_lt_cred_mech_password if (coturn_enabled and coturn_authentication_method == 'lt-cred-mech') else '' }}"

matrix_continuwuity_self_check_validate_certificates: "{{ matrix_playbook_ssl_enabled }}"

matrix_continuwuity_systemd_wanted_services_list_auto: |
  {{
    ([exim_relay_identifier ~ '.service'] if (exim_relay_enabled and matrix_continuwuity_config_smtp_enabled and matrix_continuwuity_config_smtp_connection_uri == ('smtp://' ~ exim_relay_identifier ~ ':8025')) else [])
  }}

######################################################################
#
# /matrix-continuwuity
#
######################################################################


######################################################################
#
# matrix-tuwunel
#
######################################################################

matrix_tuwunel_enabled: "{{ matrix_homeserver_implementation == 'tuwunel' }}"

matrix_tuwunel_hostname: "{{ matrix_server_fqn_matrix }}"

matrix_tuwunel_config_allow_federation: "{{ matrix_homeserver_federation_enabled }}"

matrix_tuwunel_config_well_known_client: "{{ matrix_homeserver_url if matrix_playbook_ssl_enabled else '' }}"

matrix_tuwunel_container_image_registry_prefix_upstream: "{{ matrix_container_global_registry_prefix_override if matrix_container_global_registry_prefix_override else matrix_tuwunel_container_image_registry_prefix_upstream_default }}"

matrix_tuwunel_container_network: "{{ matrix_homeserver_container_network }}"

matrix_tuwunel_container_additional_networks_auto: |
  {{
    (
      ([matrix_playbook_reverse_proxyable_services_additional_network] if matrix_tuwunel_container_labels_traefik_enabled and matrix_playbook_reverse_proxyable_services_additional_network else [])
    ) | unique
  }}

matrix_tuwunel_container_labels_traefik_enabled: "{{ matrix_playbook_reverse_proxy_type in ['playbook-managed-traefik', 'other-traefik-container'] and not matrix_synapse_workers_enabled }}"
matrix_tuwunel_container_labels_traefik_docker_network: "{{ matrix_playbook_reverse_proxyable_services_additional_network }}"
matrix_tuwunel_container_labels_traefik_entrypoints: "{{ traefik_entrypoint_primary }}"
matrix_tuwunel_container_labels_traefik_tls_certResolver: "{{ traefik_certResolver_primary }}"

matrix_tuwunel_container_labels_public_client_root_redirection_enabled: "{{ matrix_tuwunel_container_labels_public_client_root_redirection_url != '' }}"
matrix_tuwunel_container_labels_public_client_root_redirection_url: "{{ matrix_playbook_public_client_root_redirection_url }}"

matrix_tuwunel_container_labels_public_client_synapse_admin_api_enabled: "{{ matrix_ketesa_enabled or matrix_element_admin_enabled }}"
matrix_tuwunel_container_labels_internal_client_synapse_admin_api_enabled: "{{ (matrix_bot_draupnir_enabled and matrix_bot_draupnir_admin_api_enabled) }}"
matrix_tuwunel_container_labels_internal_client_synapse_admin_api_traefik_entrypoints: "{{ matrix_playbook_internal_matrix_client_api_traefik_entrypoint_name }}"

matrix_tuwunel_container_labels_public_federation_api_traefik_hostname: "{{ matrix_server_fqn_matrix_federation }}"
matrix_tuwunel_container_labels_public_federation_api_traefik_entrypoints: "{{ matrix_federation_traefik_entrypoint_name }}"
matrix_tuwunel_container_labels_public_federation_api_traefik_tls: "{{ matrix_federation_traefik_entrypoint_tls }}"

matrix_tuwunel_container_labels_internal_client_api_enabled: "{{ matrix_playbook_internal_matrix_client_api_traefik_entrypoint_enabled }}"
matrix_tuwunel_container_labels_internal_client_api_traefik_entrypoints: "{{ matrix_playbook_internal_matrix_client_api_traefik_entrypoint_name }}"
matrix_tuwunel_container_labels_internal_tuwunel_api_traefik_entrypoints: "{{ matrix_playbook_internal_matrix_client_api_traefik_entrypoint_name }}"

matrix_tuwunel_config_well_known_livekit_url: "{{ matrix_livekit_jwt_service_public_url if matrix_livekit_jwt_service_enabled else '' }}"

matrix_tuwunel_config_turn_uris: "{{ coturn_turn_uris if coturn_enabled else [] }}"
matrix_tuwunel_config_turn_secret: "{{ coturn_turn_static_auth_secret if (coturn_enabled and coturn_authentication_method == 'auth-secret') else '' }}"
matrix_tuwunel_config_turn_username: "{{ coturn_lt_cred_mech_username if (coturn_enabled and coturn_authentication_method == 'lt-cred-mech') else '' }}"
matrix_tuwunel_config_turn_password: "{{ coturn_lt_cred_mech_password if (coturn_enabled and coturn_authentication_method == 'lt-cred-mech') else '' }}"

matrix_tuwunel_self_check_validate_certificates: "{{ matrix_playbook_ssl_enabled }}"

matrix_tuwunel_systemd_wanted_services_list_auto: |
  {{
    ([coturn_identifier ~ '.service'] if coturn_enabled else [])
  }}

######################################################################
#
# /matrix-tuwunel
#
######################################################################


######################################################################
#
# matrix-user-creator
#
######################################################################

matrix_user_creator_users_auto: |
  {{
    ([{
      'username': matrix_bot_baibot_config_user_mxid_localpart,
      'initial_password': matrix_bot_baibot_config_user_password,
      'initial_type': 'bot',
    }] if matrix_bot_baibot_enabled and ((matrix_bot_baibot_config_user_password | default('', true) | string | length) > 0) else [])
    +
    ([{
      'username': matrix_bot_matrix_reminder_bot_matrix_user_id_localpart,
      'initial_password': matrix_bot_matrix_reminder_bot_matrix_user_password,
      'initial_type': 'bot',
    }] if matrix_bot_matrix_reminder_bot_enabled else [])
    +
    ([{
      'username': matrix_bot_honoroit_login,
      'initial_password': matrix_bot_honoroit_password,
      'initial_type': 'bot',
    }] if matrix_bot_honoroit_enabled else [])
    +
    ([{
      'username': matrix_bridge_postmoogle_login,
      'initial_password': matrix_bridge_postmoogle_password,
      'initial_type': 'bot',
    }] if matrix_bridge_postmoogle_enabled else [])
    +
    ([{
      'username': matrix_bot_buscarron_login,
      'initial_password': matrix_bot_buscarron_password,
      'initial_type': 'bot',
    }] if matrix_bot_buscarron_enabled else [])
    +
    ([{
      'username': matrix_bot_maubot_login,
      'initial_password': matrix_bot_maubot_initial_password,
      'initial_type': 'bot',
    }] if matrix_bot_maubot_enabled else [])
        +
    ([{
      'username': matrix_bot_draupnir_login,
      'initial_password': matrix_bot_draupnir_password,
      'initial_type': ('admin' if matrix_bot_draupnir_admin_api_enabled else 'bot'),
    }] if matrix_bot_draupnir_enabled and matrix_bot_draupnir_password else [])
  }}

######################################################################
#
# /matrix-user-creator
#
######################################################################


######################################################################
#
# matrix-user-verification-service
#
######################################################################

matrix_user_verification_service_enabled: false

matrix_user_verification_service_systemd_required_services_list: |
  {{
    [devture_systemd_docker_base_docker_service_name]
    +
    (['matrix-' + matrix_homeserver_implementation + '.service'])
  }}

matrix_user_verification_service_container_image_registry_prefix_upstream: "{{ matrix_container_global_registry_prefix_override if matrix_container_global_registry_prefix_override else matrix_user_verification_service_container_image_registry_prefix_upstream_default }}"

matrix_user_verification_service_container_network: "{{ matrix_addons_container_network }}"

matrix_user_verification_service_container_additional_networks: |
  {{
    (
      ([matrix_playbook_reverse_proxyable_services_additional_network] if matrix_playbook_reverse_proxyable_services_additional_network else [])
      +
      ([matrix_homeserver_container_network] if matrix_homeserver_container_network != matrix_user_verification_service_container_network else [])
    ) | unique
  }}

# If Jitsi is managed by this playbook we can use the docker network — no need to expose a port.
# If Jitsi is not managed by this playbook, or you otherwise have a need for it, you can expose
# matrix-user-verfification-services's client-server port to port 3003.
# By default Matrix-User-Verification-Service binds to port 3000, which collides with grafana, therefore this uses port 3003.
matrix_user_verification_service_container_http_host_bind_port: "{{  '' if (jitsi_enabled | bool and jitsi_enable_auth | bool and jitsi_auth_type == 'matrix') else matrix_playbook_service_host_bind_interface_prefix ~ '3003' }}"

# URL exposed in the docker network
matrix_user_verification_service_container_url: "http://{{  matrix_user_verification_service_container_name }}:3000"

# Using `matrix_addons_homeserver_client_api_url` would not work here,
# because `matrix-traefik:8008` (matrix-internal-client-api) does not expose any `/_synapse` paths.
# UVS accesses `/_synapse/admin/v1/rooms` API to check room membership.
matrix_user_verification_service_uvs_homeserver_url: "{{ matrix_homeserver_container_url }}"

# We connect via the container network (private IPs), so we need to disable IP checks
matrix_user_verification_service_uvs_disable_ip_blacklist: "{{ matrix_synapse_enabled }}"

matrix_user_verification_service_uvs_auth_token: "{{ (matrix_homeserver_generic_secret_key + ':uvs.auth.token') | hash('sha512') | to_uuid }}"

######################################################################
#
# /matrix-user-verification-service
#
######################################################################


########################################################################
#                                                                      #
# matrix-static-files                                                  #
#                                                                      #
########################################################################

matrix_static_files_enabled: true

matrix_static_files_container_image_registry_prefix_upstream: "{{ matrix_container_global_registry_prefix_override if matrix_container_global_registry_prefix_override else matrix_static_files_container_image_registry_prefix_upstream_default }}"

matrix_static_files_container_network: "{{ (matrix_static_files_identifier if matrix_playbook_reverse_proxy_type == 'none' else matrix_playbook_reverse_proxy_container_network) }}"

matrix_static_files_container_labels_traefik_enabled: "{{ matrix_playbook_traefik_labels_enabled }}"
matrix_static_files_container_labels_traefik_docker_network: "{{ matrix_playbook_reverse_proxyable_services_additional_network }}"
matrix_static_files_container_labels_traefik_entrypoints: "{{ traefik_entrypoint_primary }}"
matrix_static_files_container_labels_traefik_tls_certResolver: "{{ traefik_certResolver_primary }}"

matrix_static_files_container_labels_well_known_matrix_endpoint_traefik_hostname: "{{ matrix_server_fqn_matrix }}"

# Base domain serving is not enabled by default (see `matrix_static_files_container_labels_base_domain_enabled`),
# but we pass the hostname, so that enabling it is easy.
matrix_static_files_container_labels_base_domain_traefik_hostname: "{{ matrix_domain }}"

# If we're not serving a static webpage, serve a redirect instead of a 404.
matrix_static_files_container_labels_base_domain_root_path_redirection_enabled: "{{ not matrix_static_files_file_index_html_enabled }}"
matrix_static_files_container_labels_base_domain_root_path_redirection_url: "{{ ('https://' if matrix_playbook_ssl_enabled else 'http://') + matrix_server_fqn_matrix }}/${1}"

matrix_static_files_file_matrix_client_property_io_element_jitsi_preferred_domain: "{{ matrix_server_fqn_jitsi if jitsi_enabled else '' }}"

matrix_static_files_file_matrix_client_property_org_matrix_msc2965_authentication_enabled: "{{ matrix_authentication_service_enabled }}"
matrix_static_files_file_matrix_client_property_org_matrix_msc2965_authentication_issuer: "{{ matrix_authentication_service_config_http_issuer if matrix_authentication_service_enabled else '' }}"
matrix_static_files_file_matrix_client_property_org_matrix_msc2965_authentication_account: "{{ matrix_authentication_service_account_management_url if matrix_authentication_service_enabled else '' }}"

matrix_static_files_file_matrix_client_property_m_tile_server_entries_enabled: "{{ matrix_client_element_location_sharing_enabled }}"
matrix_static_files_file_matrix_client_property_m_tile_server_map_style_url: "{{ ('https://' if matrix_playbook_ssl_enabled else 'http://') + matrix_server_fqn_element }}/map_style.json"

# We set this regardless of whether Ketesa is enabled, because people may wish to use a hosted (externally) Ketesa installation and still have it auto-configured.
matrix_static_files_file_matrix_client_property_cc_etke_ketesa_auto: "{{ matrix_ketesa_configuration if matrix_homeserver_implementation == 'synapse' else {} }}"

matrix_static_files_file_matrix_client_property_org_matrix_msc4143_rtc_foci_enabled: "{{ matrix_livekit_jwt_service_enabled }}"
matrix_static_files_file_matrix_client_property_org_matrix_msc4143_rtc_foci_auto: |-
  {{
    (
      [{'type': 'livekit', 'livekit_service_url': matrix_livekit_jwt_service_public_url}] if matrix_livekit_jwt_service_enabled else []
    )
  }}

# Advertise all enabled and exposed mautrix bridges for auto-discovery by tools like Mautrix Manager.
# A bridge's public address is only reachable when the playbook attaches its Traefik labels and emits the exposure router,
# so we gate on these in addition to the bridge being enabled.
matrix_static_files_file_matrix_mautrix_property_fi_mau_bridges_auto: |-
  {{
    [
      matrix_bridge_beeper_line_bridge_public_address if (matrix_bridge_beeper_line_enabled and matrix_bridge_beeper_line_container_labels_traefik_enabled and matrix_bridge_beeper_line_container_labels_exposure_enabled) else '',
      matrix_bridge_mautrix_bluesky_appservice_public_address if (matrix_bridge_mautrix_bluesky_enabled and matrix_bridge_mautrix_bluesky_container_labels_traefik_enabled and matrix_bridge_mautrix_bluesky_container_labels_exposure_enabled) else '',
      matrix_bridge_mautrix_gmessages_bridge_public_address if (matrix_bridge_mautrix_gmessages_enabled and matrix_bridge_mautrix_gmessages_container_labels_traefik_enabled and matrix_bridge_mautrix_gmessages_container_labels_exposure_enabled) else '',
      matrix_bridge_mautrix_gvoice_bridge_public_address if (matrix_bridge_mautrix_gvoice_enabled and matrix_bridge_mautrix_gvoice_container_labels_traefik_enabled and matrix_bridge_mautrix_gvoice_container_labels_exposure_enabled) else '',
      matrix_bridge_mautrix_linkedin_bridge_public_address if (matrix_bridge_mautrix_linkedin_enabled and matrix_bridge_mautrix_linkedin_container_labels_traefik_enabled and matrix_bridge_mautrix_linkedin_container_labels_exposure_enabled) else '',
      matrix_bridge_mautrix_meta_instagram_bridge_public_address if (matrix_bridge_mautrix_meta_instagram_enabled and matrix_bridge_mautrix_meta_instagram_container_labels_traefik_enabled and matrix_bridge_mautrix_meta_instagram_container_labels_exposure_enabled) else '',
      matrix_bridge_mautrix_meta_messenger_bridge_public_address if (matrix_bridge_mautrix_meta_messenger_enabled and matrix_bridge_mautrix_meta_messenger_container_labels_traefik_enabled and matrix_bridge_mautrix_meta_messenger_container_labels_exposure_enabled) else '',
      matrix_bridge_mautrix_signal_bridge_public_address if (matrix_bridge_mautrix_signal_enabled and matrix_bridge_mautrix_signal_container_labels_traefik_enabled and matrix_bridge_mautrix_signal_container_labels_exposure_enabled) else '',
      matrix_bridge_mautrix_slack_bridge_public_address if (matrix_bridge_mautrix_slack_enabled and matrix_bridge_mautrix_slack_container_labels_traefik_enabled and matrix_bridge_mautrix_slack_container_labels_exposure_enabled) else '',
      matrix_bridge_mautrix_telegram_bridge_public_address if (matrix_bridge_mautrix_telegram_enabled and matrix_bridge_mautrix_telegram_container_labels_traefik_enabled and matrix_bridge_mautrix_telegram_container_labels_exposure_enabled) else '',
      matrix_bridge_mautrix_twitter_appservice_public_address if (matrix_bridge_mautrix_twitter_enabled and matrix_bridge_mautrix_twitter_container_labels_traefik_enabled and matrix_bridge_mautrix_twitter_container_labels_exposure_enabled) else '',
      matrix_bridge_mautrix_whatsapp_bridge_public_address if (matrix_bridge_mautrix_whatsapp_enabled and matrix_bridge_mautrix_whatsapp_container_labels_traefik_enabled and matrix_bridge_mautrix_whatsapp_container_labels_exposure_enabled) else '',
    ] | select | list
  }}

matrix_static_files_file_matrix_server_property_m_server: "{{ matrix_server_fqn_matrix_federation }}:{{ matrix_federation_public_port }}"

matrix_static_files_scheme: "{{ 'https' if matrix_playbook_ssl_enabled else 'http' }}"

matrix_static_files_self_check_hostname_matrix: "{{ matrix_server_fqn_matrix }}"
matrix_static_files_self_check_hostname_identity: "{{ matrix_domain }}"

########################################################################
#                                                                      #
# /matrix-static-files                                                 #
#                                                                      #
########################################################################


########################################################################
#                                                                      #
# container-socket-proxy                                               #
#                                                                      #
########################################################################

container_socket_proxy_enabled: "{{ matrix_playbook_reverse_proxy_type == 'playbook-managed-traefik' }}"

container_socket_proxy_identifier: matrix-container-socket-proxy

container_socket_proxy_base_path: "{{ matrix_base_data_path }}/container-socket-proxy"

container_socket_proxy_uid: "{{ matrix_user_uid }}"
container_socket_proxy_gid: "{{ matrix_user_gid }}"

# Traefik requires read access to the containers APIs to do its job
container_socket_proxy_api_containers_enabled: true

container_socket_proxy_container_image_registry_prefix_upstream: "{{ matrix_container_global_registry_prefix_override if matrix_container_global_registry_prefix_override else container_socket_proxy_container_image_registry_prefix_upstream_default }}"

########################################################################
#                                                                      #
# /container-socket-proxy                                              #
#                                                                      #
########################################################################


########################################################################
#                                                                      #
# traefik                                                              #
#                                                                      #
########################################################################

traefik_enabled: "{{ matrix_playbook_reverse_proxy_type == 'playbook-managed-traefik' }}"

traefik_identifier: matrix-traefik

traefik_base_path: "{{ matrix_base_data_path }}/traefik"

traefik_uid: "{{ matrix_user_uid }}"
traefik_gid: "{{ matrix_user_gid }}"

# It's common for setups to deal with large file uploads which may take longer than the default readTimeout (60s).
# This override (for the `web` entrypoint) also cascades to overriding the `web-secure` entrypoint and the `matrix-federation` entrypoint.
traefik_config_entrypoint_web_transport_respondingTimeouts_readTimeout: 300s

traefik_additional_entrypoints_auto: |
  {{
    ([matrix_playbook_public_matrix_federation_api_traefik_entrypoint_definition] if matrix_playbook_public_matrix_federation_api_traefik_entrypoint_enabled else [])
    +
    ([matrix_playbook_internal_matrix_client_api_traefik_entrypoint_definition] if matrix_playbook_internal_matrix_client_api_traefik_entrypoint_enabled else [])
    +
    ([matrix_playbook_livekit_turn_traefik_entrypoint_definition] if matrix_playbook_livekit_turn_traefik_entrypoint_enabled else [])
  }}

traefik_config_providers_docker_endpoint: "{{ container_socket_proxy_endpoint if container_socket_proxy_enabled else 'unix:///var/run/docker.sock' }}"

traefik_container_image_registry_prefix_upstream: "{{ matrix_container_global_registry_prefix_override if matrix_container_global_registry_prefix_override else traefik_container_image_registry_prefix_upstream_default }}"

traefik_container_additional_networks_auto: |
  {{
    ([container_socket_proxy_container_network] if container_socket_proxy_enabled else [])
  }}

traefik_systemd_required_services_list: |
  {{
    ([devture_systemd_docker_base_docker_service_name])
    +
    ([container_socket_proxy_identifier + '.service'] if container_socket_proxy_enabled else [])
  }}

traefik_additional_domains_to_obtain_certificates_for_auto: |
  {{
    ([coturn_hostname] if (coturn_enabled and coturn_tls_enabled and coturn_hostname != matrix_server_fqn_matrix) else [])
  }}

########################################################################
#                                                                      #
# /traefik                                                             #
#                                                                      #
########################################################################


########################################################################
#                                                                      #
# traefik_certs_dumper                                                 #
#                                                                      #
########################################################################

traefik_certs_dumper_enabled: "{{ (matrix_playbook_reverse_proxy_type == 'playbook-managed-traefik' and traefik_config_entrypoint_web_secure_enabled and traefik_config_certificatesResolvers_acme_enabled) or matrix_playbook_reverse_proxy_type == 'other-traefik-container' }}"

traefik_certs_dumper_identifier: matrix-traefik-certs-dumper

traefik_certs_dumper_base_path: "{{ matrix_base_data_path }}/traefik-certs-dumper"

traefik_certs_dumper_uid: "{{ matrix_user_uid }}"
traefik_certs_dumper_gid: "{{ matrix_user_gid }}"

traefik_certs_dumper_ssl_path: "{{ traefik_ssl_dir_path if traefik_enabled else '' }}"

# We make the certs dumper require the Traefik service (not just docker.service),
# because when both restart simultaneously (e.g. in all-at-once mode), Traefik may
# momentarily truncate or reinitialize acme.json, causing the certs dumper to read
# an empty file and panic. By requiring Traefik, the certs dumper only starts after
# Traefik is fully ready and acme.json is stable.
traefik_certs_dumper_systemd_required_services_list_auto: |
  {{
    ([traefik_identifier + '.service'] if traefik_enabled else [])
  }}

traefik_certs_dumper_container_image_registry_prefix_upstream: "{{ matrix_container_global_registry_prefix_override if matrix_container_global_registry_prefix_override else traefik_certs_dumper_container_image_registry_prefix_upstream_default }}"

########################################################################
#                                                                      #
# /traefik_certs_dumper                                                #
#                                                                      #
########################################################################

########################################################################
#                                                                      #
# matrix-element-admin                                                 #
#                                                                      #
########################################################################

# We don't enable this by default.
matrix_element_admin_enabled: false

matrix_element_admin_scheme: "{{ 'https' if matrix_playbook_ssl_enabled else 'http' }}"

matrix_element_admin_container_image_registry_prefix_upstream: "{{ matrix_container_global_registry_prefix_override if matrix_container_global_registry_prefix_override else matrix_element_admin_container_image_registry_prefix_upstream_default }}"

matrix_element_admin_container_image_self_build: "{{ matrix_architecture not in ['amd64', 'arm64'] }}"

matrix_element_admin_container_network: "{{ matrix_addons_container_network }}"

matrix_element_admin_container_additional_networks_auto: |-
  {{
    (
      ([] if matrix_addons_homeserver_container_network == '' else [matrix_addons_homeserver_container_network])
      +
      ([matrix_playbook_reverse_proxyable_services_additional_network] if (matrix_playbook_reverse_proxyable_services_additional_network and matrix_element_admin_container_labels_traefik_enabled) else [])
    ) | unique
  }}

matrix_element_admin_container_labels_traefik_enabled: "{{ matrix_playbook_reverse_proxy_type in ['playbook-managed-traefik', 'other-traefik-container'] }}"
matrix_element_admin_container_labels_traefik_docker_network: "{{ matrix_playbook_reverse_proxyable_services_additional_network }}"
matrix_element_admin_container_labels_traefik_entrypoints: "{{ traefik_entrypoint_primary }}"
matrix_element_admin_container_labels_traefik_tls_certResolver: "{{ traefik_certResolver_primary }}"

matrix_element_admin_systemd_required_services_list_auto: "{{ matrix_addons_homeserver_systemd_services_list }}"

######################################################################
#                                                                     #
# /matrix-element-admin                                               #
#                                                                     #
######################################################################


########################################################################
#                                                                      #
# matrix-element-call                                                  #
#                                                                      #
########################################################################

matrix_element_call_enabled: false

matrix_element_call_scheme: "{{ 'https' if matrix_playbook_ssl_enabled else 'http' }}"

matrix_element_call_container_network: "{{ matrix_addons_container_network }}"

matrix_element_call_container_image_registry_prefix_upstream: "{{ matrix_container_global_registry_prefix_override if matrix_container_global_registry_prefix_override else matrix_element_call_container_image_registry_prefix_upstream_default }}"

matrix_element_call_container_additional_networks_auto: "{{ [matrix_playbook_reverse_proxyable_services_additional_network] if (matrix_element_call_container_labels_traefik_enabled and matrix_playbook_reverse_proxyable_services_additional_network) else [] }}"

matrix_element_call_container_labels_traefik_enabled: "{{ matrix_playbook_reverse_proxy_type in ['playbook-managed-traefik', 'other-traefik-container'] }}"
matrix_element_call_container_labels_traefik_docker_network: "{{ matrix_playbook_reverse_proxyable_services_additional_network }}"
matrix_element_call_container_labels_traefik_entrypoints: "{{ traefik_entrypoint_primary }}"
matrix_element_call_container_labels_traefik_tls_certResolver: "{{ traefik_certResolver_primary }}"

matrix_element_call_config_livekit_livekit_service_url: "{{ matrix_livekit_jwt_service_public_url if matrix_livekit_jwt_service_enabled else '' }}"

########################################################################
#                                                                      #
# /matrix-element-call                                                 #
#                                                                      #
########################################################################

########################################################################
#                                                                      #
# livekit-server                                                       #
#                                                                      #
########################################################################

livekit_server_enabled: "{{ matrix_rtc_enabled }}"

livekit_server_identifier: matrix-livekit-server

livekit_server_uid: "{{ matrix_user_uid }}"
livekit_server_gid: "{{ matrix_user_gid }}"

livekit_server_base_path: "{{ matrix_base_data_path }}/livekit-server"

livekit_server_hostname: "{{ matrix_server_fqn_matrix }}"
livekit_server_path_prefix: "/livekit-server"

livekit_server_container_image_self_build: "{{ matrix_architecture not in ['arm64', 'amd64'] }}"

livekit_server_container_image_registry_prefix_upstream: "{{ matrix_container_global_registry_prefix_override if matrix_container_global_registry_prefix_override else livekit_server_container_image_registry_prefix_upstream_default }}"

livekit_server_container_network: "{{ matrix_addons_container_network }}"
livekit_server_container_additional_networks_auto: "{{ [matrix_playbook_reverse_proxyable_services_additional_network] if (livekit_server_container_labels_traefik_enabled and matrix_playbook_reverse_proxyable_services_additional_network) else [] }}"

# We expose LiveKit TURN/TLS via Traefik on a dedicated TCP entrypoint.
matrix_playbook_livekit_turn_traefik_entrypoint_enabled: "{{ matrix_playbook_reverse_proxy_type == 'playbook-managed-traefik' and livekit_server_config_turn_enabled and livekit_server_config_turn_external_tls and livekit_server_container_labels_traefik_enabled }}"
matrix_playbook_livekit_turn_traefik_entrypoint_port: "{{ livekit_server_config_turn_tls_port }}"
matrix_playbook_livekit_turn_traefik_entrypoint_host_bind_port: "{{ (matrix_playbook_service_host_bind_interface_prefix ~ (matrix_playbook_livekit_turn_traefik_entrypoint_port | string)) if matrix_playbook_service_host_bind_interface_prefix else (matrix_playbook_livekit_turn_traefik_entrypoint_port | string) }}"

livekit_server_container_additional_volumes_auto: |
  {{
    (
      [
       {
         'src': (traefik_certs_dumper_dumped_certificates_path +  '/' + livekit_server_config_turn_domain + '/certificate.crt'),
         'dst': livekit_server_config_turn_cert_file,
         'options': 'ro',
       },
       {
         'src': (traefik_certs_dumper_dumped_certificates_path +  '/' + livekit_server_config_turn_domain + '/privatekey.key'),
         'dst': livekit_server_config_turn_key_file,
         'options': 'ro',
       },
      ] if (matrix_playbook_reverse_proxy_type in ['playbook-managed-traefik', 'other-traefik-container'] and traefik_certs_dumper_enabled and livekit_server_config_turn_enabled and not (livekit_server_config_turn_external_tls | bool) and (livekit_server_config_turn_cert_file and livekit_server_config_turn_key_file)) else []
    )
  }}

livekit_server_container_labels_traefik_enabled: "{{ matrix_playbook_reverse_proxy_type in ['playbook-managed-traefik', 'other-traefik-container'] }}"
livekit_server_container_labels_traefik_docker_network: "{{ matrix_playbook_reverse_proxyable_services_additional_network }}"
livekit_server_container_labels_traefik_entrypoints: "{{ traefik_entrypoint_primary }}"
livekit_server_container_labels_traefik_tls_certResolver: "{{ traefik_certResolver_primary }}"
livekit_server_container_labels_turn_traefik_enabled: "{{ matrix_playbook_livekit_turn_traefik_entrypoint_enabled }}"
livekit_server_container_labels_turn_traefik_entrypoints: "{{ matrix_playbook_livekit_turn_traefik_entrypoint_name }}"
livekit_server_container_labels_turn_traefik_tls_certResolver: "{{ traefik_certResolver_primary }}"

livekit_server_container_labels_public_metrics_middleware_basic_auth_enabled: "{{ matrix_metrics_exposure_http_basic_auth_enabled }}"
livekit_server_container_labels_public_metrics_middleware_basic_auth_users: "{{ matrix_metrics_exposure_http_basic_auth_users }}"

livekit_server_metrics_proxying_enabled: "{{ livekit_server_config_prometheus_enabled and matrix_metrics_exposure_enabled }}"
livekit_server_metrics_proxying_hostname: "{{ matrix_metrics_exposure_hostname }}"
livekit_server_metrics_proxying_path_prefix: "{{ matrix_metrics_exposure_path_prefix }}/livekit-server"

livekit_server_config_prometheus_enabled: "{{ prometheus_enabled or matrix_metrics_exposure_enabled }}"

livekit_server_config_keys_auto: |-
  {{
    {}
    | combine(
      {matrix_livekit_jwt_service_environment_variable_livekit_key: matrix_livekit_jwt_service_environment_variable_livekit_secret}
      if matrix_livekit_jwt_service_enabled else {}
    )
  }}

# We only wish for matrix-livekit-jwt-service to create rooms, only for users on trusted homeservers.
# See `matrix_livekit_jwt_service_environment_variable_livekit_full_access_homeservers`.
#
# Ref:
# - https://github.com/element-hq/lk-jwt-service/releases/tag/v0.3.0
# - https://github.com/livekit/livekit/blob/5e483e7554e5afbf254acf84e3ec0aa6e108e758/config-sample.yaml#L168-L170
# - https://github.com/mother-of-all-self-hosting/ansible-role-livekit-server/commit/2a1b04552634097bdd26d472502a8f5bf1b8528f
livekit_server_config_room_auto_create: false

# The playbook intentionally uses a non-standard port than the default used by the role (5349),
# because Coturn is already using that port.
# Note that TURN is not enabled by default. See `livekit_server_config_turn_enabled`.
livekit_server_config_turn_tls_port: 5350

# The playbook intentionally uses a non-standard port than the default used by the role (3478),
# because Coturn is already using that port.
# Note that TURN is not enabled by default. See `livekit_server_config_turn_enabled`.
livekit_server_config_turn_udp_port: 3479

# In this mode, Traefik terminates TURN/TLS and forwards plaintext TCP to LiveKit's `turn.tls_port`.
# We only enable it automatically when Traefik is managed by this playbook.
livekit_server_config_turn_external_tls: "{{ matrix_playbook_reverse_proxy_type == 'playbook-managed-traefik' and matrix_playbook_ssl_enabled }}"
# TURN stays enabled for either mode:
# - external TLS termination by playbook-managed Traefik
# - in-container TLS using certificates from Traefik Certs Dumper
livekit_server_config_turn_enabled: "{{ matrix_playbook_reverse_proxy_type in ['playbook-managed-traefik', 'other-traefik-container'] and (livekit_server_config_turn_external_tls or traefik_certs_dumper_enabled) }}"

livekit_server_config_turn_cert_file: |-
  {{
    {
      'playbook-managed-traefik': ('/certificate.crt' if traefik_certs_dumper_enabled and not (livekit_server_config_turn_external_tls | bool) else ''),
      'other-traefik-container': ('/certificate.crt' if traefik_certs_dumper_enabled and not (livekit_server_config_turn_external_tls | bool) else ''),
      'none': '',
    }[matrix_playbook_reverse_proxy_type]
  }}

livekit_server_config_turn_key_file: |-
  {{
    {
      'playbook-managed-traefik': ('/privatekey.key' if traefik_certs_dumper_enabled and not (livekit_server_config_turn_external_tls | bool) else ''),
      'other-traefik-container': ('/privatekey.key' if traefik_certs_dumper_enabled and not (livekit_server_config_turn_external_tls | bool) else ''),
      'none': '',
    }[matrix_playbook_reverse_proxy_type]
  }}

livekit_server_systemd_required_services_list_auto: |
  {{
    ([traefik_certs_dumper_identifier + '-wait-for-domain@' + livekit_server_config_turn_domain + '.service'] if matrix_playbook_reverse_proxy_type in ['playbook-managed-traefik', 'other-traefik-container'] and traefik_certs_dumper_enabled and livekit_server_config_turn_enabled and not (livekit_server_config_turn_external_tls | bool) else [])
  }}

########################################################################
#                                                                      #
# /livekit-server                                                      #
#                                                                      #
########################################################################


########################################################################
#                                                                      #
# matrix-livekit-jwt-service                                           #
#                                                                      #
########################################################################

matrix_livekit_jwt_service_enabled: "{{ matrix_rtc_enabled and livekit_server_enabled }}"

matrix_livekit_jwt_service_scheme: "{{ 'https' if matrix_playbook_ssl_enabled else 'http' }}"

matrix_livekit_jwt_service_hostname: "{{ matrix_server_fqn_matrix }}"

matrix_livekit_jwt_service_container_image_self_build: "{{ matrix_architecture not in ['amd64', 'arm64'] }}"

matrix_livekit_jwt_service_container_image_registry_prefix_upstream: "{{ matrix_container_global_registry_prefix_override if matrix_container_global_registry_prefix_override else matrix_livekit_jwt_service_container_image_registry_prefix_upstream_default }}"

matrix_livekit_jwt_service_container_network: "{{ matrix_addons_container_network }}"

matrix_livekit_jwt_service_container_additional_networks_auto: |
  {{
    ([] if matrix_addons_homeserver_container_network == '' else [matrix_addons_homeserver_container_network])
    +
    ([matrix_playbook_reverse_proxyable_services_additional_network] if (matrix_livekit_jwt_service_container_labels_traefik_enabled and matrix_playbook_reverse_proxyable_services_additional_network) else [])
  }}

matrix_livekit_jwt_service_container_labels_traefik_enabled: "{{ matrix_playbook_reverse_proxy_type in ['playbook-managed-traefik', 'other-traefik-container'] }}"
matrix_livekit_jwt_service_container_labels_traefik_docker_network: "{{ matrix_playbook_reverse_proxyable_services_additional_network }}"
matrix_livekit_jwt_service_container_labels_traefik_entrypoints: "{{ traefik_entrypoint_primary }}"
matrix_livekit_jwt_service_container_labels_traefik_tls_certResolver: "{{ traefik_certResolver_primary }}"

matrix_livekit_jwt_service_environment_variable_livekit_url: "{{ livekit_server_websocket_public_url }}"

# The service discovers where a homeserver's Client-Server API lives by fetching the `/.well-known/matrix/client`
# file of that homeserver's base domain over the public network.
# For our own homeserver, we already know the answer and can spare it the round trip, which would otherwise
# need to leave the server and come back to it.
# Other (federated) homeservers are still resolved via discovery.
matrix_livekit_jwt_service_environment_variable_livekit_cs_api_url_overrides_map_auto: "{{ {matrix_domain: matrix_addons_homeserver_client_api_url} }}"

matrix_livekit_jwt_service_environment_variable_livekit_key: "{{ (matrix_homeserver_generic_secret_key + ':lk.key') | hash('sha512') | to_uuid }}"

matrix_livekit_jwt_service_environment_variable_livekit_secret: "{{ (matrix_homeserver_generic_secret_key + ':lk.secret') | hash('sha512') | to_uuid }}"

########################################################################
#                                                                      #
# /matrix-livekit-jwt-service                                          #
#                                                                      #
########################################################################