From c985e17f18d0c3eba97febc546902039d9617ef8 Mon Sep 17 00:00:00 2001
From: benkuly <12199167+benkuly@users.noreply.github.com>
Date: Fri, 13 Nov 2020 08:44:21 +0100
Subject: [PATCH 01/43] updated matrix-sms-bridge

---
 CHANGELOG.md                                  | 13 +++++++
 roles/matrix-bridge-sms/defaults/main.yml     | 36 +++++++++----------
 roles/matrix-bridge-sms/tasks/init.yml        |  2 +-
 .../matrix-bridge-sms/tasks/setup_install.yml | 20 ++---------
 .../tasks/setup_uninstall.yml                 | 25 +------------
 .../tasks/validate_config.yml                 |  3 +-
 6 files changed, 35 insertions(+), 64 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index aa378ae3..ae96ef36 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,3 +1,16 @@
+# 2020-11-13
+
+## Breaking change matrix-sms-bridge
+
+The new version of [matrix-sms-bridge](https://github.com/benkuly/matrix-sms-bridge) changed its database from neo4j to h2. You need to sync the bridge at the first start. Note that this only will sync rooms where the @smsbot:yourServer is member. For rooms without @smsbot:yourServer you need to kick and invite the telephone number **or** invite @smsbot:yourServer.
+
+1. Add the following to your `vars.yml` file: `matrix_sms_bridge_container_extra_arguments=['--env SPRING_PROFILES_ACTIVE=initialsync']`
+2. Login to your host shell and remove old systemd file from your host: `rm /etc/systemd/system/matrix-sms-bridge-database.service`
+2. Run `ansible-playbook -i inventory/hosts setup.yml --tags=setup-matrix-sms-bridge,start`
+3. Login to your host shell and check the logs with `journalctl -u matrix-sms-bridge` until the sync finished.
+4. Remove the var from the first step.
+5. Run `ansible-playbook -i inventory/hosts setup.yml --tags=setup-all,start`.
+
 # 2020-11-10
 
 ## Dynamic DNS support
diff --git a/roles/matrix-bridge-sms/defaults/main.yml b/roles/matrix-bridge-sms/defaults/main.yml
index 25d2208c..0801fe5b 100644
--- a/roles/matrix-bridge-sms/defaults/main.yml
+++ b/roles/matrix-bridge-sms/defaults/main.yml
@@ -3,9 +3,7 @@
 
 matrix_sms_bridge_enabled: true
 
-matrix_sms_bridge_docker_image: "folivonet/matrix-sms-bridge:0.3.2.RELEASE"
-matrix_sms_bridge_database_docker_image: "neo4j:latest"
-matrix_sms_bridge_database_docker_image_force_pull: "{{ matrix_sms_bridge_docker_image.endswith(':latest') }}"
+matrix_sms_bridge_docker_image: "folivonet/matrix-sms-bridge:0.4.1.RELEASE"
 
 matrix_sms_bridge_base_path: "{{ matrix_base_data_path }}/matrix-sms-bridge"
 matrix_sms_bridge_config_path: "{{ matrix_base_data_path }}/matrix-sms-bridge/config"
@@ -17,29 +15,22 @@ matrix_sms_bridge_data_spool_inbox_processed_path: "{{ matrix_base_data_path }}/
 matrix_sms_bridge_data_spool_outbox_path: "{{ matrix_base_data_path }}/matrix-sms-bridge/data/spool/outbox"
 matrix_sms_bridge_data_spool_sent_path: "{{ matrix_base_data_path }}/matrix-sms-bridge/data/spool/sent"
 matrix_sms_bridge_data_spool_error_path: "{{ matrix_base_data_path }}/matrix-sms-bridge/data/spool/error"
-matrix_sms_bridge_database_path: "{{ matrix_base_data_path }}/matrix-sms-bridge/database"
 
 matrix_sms_bridge_appservice_token: ''
 matrix_sms_bridge_homeserver_token: ''
 
-matrix_sms_bridge_database_username: 'neo4j'
-matrix_sms_bridge_database_password: ''
-
 matrix_sms_bridge_container_http_host_bind_port: ''
 
 # A list of extra arguments to pass to the container
 matrix_sms_bridge_container_extra_arguments: []
 
 # List of systemd services that service depends on.
-matrix_sms_bridge_systemd_required_services_list: ['docker.service','matrix-sms-bridge-database.service']
-matrix_sms_bridge_database_systemd_required_services_list: ['docker.service']
+matrix_sms_bridge_systemd_required_services_list: ['docker.service']
 
 # List of systemd services that service wants
 matrix_sms_bridge_systemd_wanted_services_list: []
-matrix_sms_bridge_database_systemd_wanted_services_list: []
 
 matrix_sms_bridge_appservice_url: 'http://matrix-sms-bridge:8080'
-matrix_sms_bridge_database_url: 'bolt://matrix-sms-bridge-database:7687'
 matrix_sms_bridge_homeserver_hostname: 'matrix-synapse'
 matrix_sms_bridge_homeserver_port: '8008'
 
@@ -47,25 +38,19 @@ matrix_sms_bridge_homserver_domain: "{{ matrix_domain }}"
 matrix_sms_bridge_default_room: ''
 matrix_sms_bridge_default_region: ''
 matrix_sms_bridge_default_timezone: ''
+matrix_sms_bridge_single_mode_enabled: false
 
 matrix_sms_bridge_gammu_modem: ''
 matrix_sms_bridge_modem_group: 'dialout'
 matrix_sms_bridge_gammu_reset_frequency: 0
 matrix_sms_bridge_gammu_hard_reset_frequency: 0
+matrix_sms_bridge_gammu_smsc: ''
 
 
 matrix_sms_bridge_configuration_yaml: |
   #jinja2: lstrip_blocks: "True"
 
   # Database connection
-  org:
-    neo4j:
-      driver:
-        uri: {{ matrix_sms_bridge_database_url }}
-        authentication:
-          username: {{ matrix_sms_bridge_database_username }}
-          password: {{ matrix_sms_bridge_database_password }}
-
   matrix:
     bridge:
       sms:
@@ -74,6 +59,7 @@ matrix_sms_bridge_configuration_yaml: |
         defaultRoomId: "{{ matrix_sms_bridge_default_room }}"
         defaultRegion: "{{ matrix_sms_bridge_default_region }}"
         defaultTimeZone: "{{ matrix_sms_bridge_default_timezone }}"
+        singleModeEnabled: "{{ matrix_sms_bridge_single_mode_enabled }}"
         provider:
           gammu:
             # (optional) default is disabled
@@ -85,6 +71,12 @@ matrix_sms_bridge_configuration_yaml: |
     bot:
       # The domain-part of matrix-ids. E. g. example.org when your userIds look like @unicorn:example.org
       serverName: {{ matrix_sms_bridge_homserver_domain }}
+      migration:
+        url: "jdbc:h2:file:/data/database/db"
+        username: sa
+      database:
+        url: "r2dbc:h2:file:////data/database/db"
+        username: sa
     client:
       homeServer:
         # The hostname of your Homeserver.
@@ -128,6 +120,9 @@ matrix_sms_bridge_gammu_configuration: |
   InboxFormat = detail
   OutboxFormat = detail
   TransmitFormat = auto
+  {% if matrix_sms_bridge_gammu_smsc is defined and matrix_sms_bridge_gammu_smsc|length %}
+  SMSC = {{ matrix_sms_bridge_gammu_smsc }}
+  {% endif %}
   ResetFrequency = {{ matrix_sms_bridge_gammu_reset_frequency }}
   HardResetFrequency = {{ matrix_sms_bridge_gammu_hard_reset_frequency }}
   debugLevel = 1
@@ -145,6 +140,9 @@ matrix_sms_bridge_registration_yaml: |
       users:
       - exclusive: true
         regex: '^@sms_.+:{{ matrix_sms_bridge_homserver_domain|regex_escape }}$'
+      aliases:
+      - exclusive: true
+        regex: '^#sms_.+:{{ matrix_sms_bridge_homserver_domain|regex_escape }}$'
   url: {{ matrix_sms_bridge_appservice_url }}
   sender_localpart: smsbot
   rate_limited: false
diff --git a/roles/matrix-bridge-sms/tasks/init.yml b/roles/matrix-bridge-sms/tasks/init.yml
index 7a49e4b2..cca4d4c5 100644
--- a/roles/matrix-bridge-sms/tasks/init.yml
+++ b/roles/matrix-bridge-sms/tasks/init.yml
@@ -7,7 +7,7 @@
   when: "matrix_sms_bridge_enabled and matrix_synapse_role_executed|default(False)"
 
 - set_fact:
-    matrix_systemd_services_list: "{{ matrix_systemd_services_list + ['matrix-sms-bridge','matrix-sms-bridge-database'] }}"
+    matrix_systemd_services_list: "{{ matrix_systemd_services_list + ['matrix-sms-bridge'] }}"
   when: matrix_sms_bridge_enabled|bool
 
 # If the matrix-synapse role is not used, these variables may not exist.
diff --git a/roles/matrix-bridge-sms/tasks/setup_install.yml b/roles/matrix-bridge-sms/tasks/setup_install.yml
index 254510a3..1d36ea8d 100644
--- a/roles/matrix-bridge-sms/tasks/setup_install.yml
+++ b/roles/matrix-bridge-sms/tasks/setup_install.yml
@@ -5,14 +5,6 @@
     name: "{{ matrix_sms_bridge_docker_image }}"
     source: "{{ 'pull' if ansible_version.major > 2 or ansible_version.minor > 7 else omit }}"
 
-- name: Ensure matrix-sms-bridge databse image is pulled
-  docker_image:
-    name: "{{ matrix_sms_bridge_database_docker_image }}"
-    source: "{{ 'pull' if ansible_version.major > 2 or ansible_version.minor > 7 else omit }}"
-    force_source: "{{ matrix_sms_bridge_database_docker_image_force_pull if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}"
-    force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else matrix_sms_bridge_database_docker_image_force_pull }}"
-
-
 - name: Ensure matrix-sms-bridge paths exist
   file:
     path: "{{ item }}"
@@ -31,7 +23,6 @@
     - "{{ matrix_sms_bridge_data_spool_outbox_path }}"
     - "{{ matrix_sms_bridge_data_spool_sent_path }}"
     - "{{ matrix_sms_bridge_data_spool_error_path }}"
-    - "{{ matrix_sms_bridge_database_path }}"
 
 - name: Ensure matrix-sms-bridge application.yml installed
   copy:
@@ -64,14 +55,7 @@
     mode: 0644
   register: matrix_sms_bridge_systemd_service_result
 
-- name: Ensure matrix-sms-bridge-database.service installed
-  template:
-    src: "{{ role_path }}/templates/systemd/matrix-sms-bridge-database.service.j2"
-    dest: "{{ matrix_systemd_path }}/matrix-sms-bridge-database.service"
-    mode: 0644
-  register: matrix_sms_bridge_database_systemd_service_result
-
-- name: Ensure systemd reloaded after matrix-sms-bridge.service or matrix-sms-bridge-database.service installation
+- name: Ensure systemd reloaded after matrix-sms-bridge.service installation
   service:
     daemon_reload: yes
-  when: matrix_sms_bridge_systemd_service_result.changed or matrix_sms_bridge_database_systemd_service_result.changed
+  when: matrix_sms_bridge_systemd_service_result.changed
\ No newline at end of file
diff --git a/roles/matrix-bridge-sms/tasks/setup_uninstall.yml b/roles/matrix-bridge-sms/tasks/setup_uninstall.yml
index 87436687..03ddaad0 100644
--- a/roles/matrix-bridge-sms/tasks/setup_uninstall.yml
+++ b/roles/matrix-bridge-sms/tasks/setup_uninstall.yml
@@ -5,11 +5,6 @@
     path: "{{ matrix_systemd_path }}/matrix-sms-bridge.service"
   register: matrix_sms_bridge_service_stat
 
-- name: Check existence of matrix-sms-bridge-database service
-  stat:
-    path: "{{ matrix_systemd_path }}/matrix-sms-bridge-database.service"
-  register: matrix_sms_bridge_database_service_stat
-
 - name: Ensure matrix-sms-bridge is stopped
   service:
     name: matrix-sms-bridge
@@ -17,26 +12,8 @@
     daemon_reload: yes
   when: "matrix_sms_bridge_service_stat.stat.exists"
 
-- name: Ensure matrix-sms-bridge-database is stopped
-  service:
-    name: matrix-sms-bridge-database
-    state: stopped
-    daemon_reload: yes
-  when: "matrix_sms_bridge_database_service_stat.stat.exists"
-
 - name: Ensure matrix-sms-bridge.service doesn't exist
   file:
     path: "{{ matrix_systemd_path }}/matrix-sms-bridge.service"
     state: absent
-  when: "matrix_sms_bridge_service_stat.stat.exists"
-
-- name: Ensure matrix-sms-bridge-database.service doesn't exist
-  file:
-    path: "{{ matrix_systemd_path }}/matrix-sms-bridge-database.service"
-    state: absent
-  when: "matrix_sms_bridge_database_service_stat.stat.exists"
-
-- name: Ensure systemd reloaded after matrix-sms-bridge.service or matrix-sms-bridge-database.service removal
-  service:
-    daemon_reload: yes
-  when: matrix_sms_bridge_service_stat.stat.exists or matrix_sms_bridge_database_service_stat.stat.exists
+  when: "matrix_sms_bridge_service_stat.stat.exists"
\ No newline at end of file
diff --git a/roles/matrix-bridge-sms/tasks/validate_config.yml b/roles/matrix-bridge-sms/tasks/validate_config.yml
index 0e40aefa..79f62fe1 100644
--- a/roles/matrix-bridge-sms/tasks/validate_config.yml
+++ b/roles/matrix-bridge-sms/tasks/validate_config.yml
@@ -8,7 +8,6 @@
   with_items:
     - "matrix_sms_bridge_appservice_token"
     - "matrix_sms_bridge_homeserver_token"
-    - "matrix_sms_bridge_database_password"
     - "matrix_sms_bridge_gammu_modem"
     - "matrix_sms_bridge_default_region"
-    - "matrix_sms_bridge_default_timezone"
+    - "matrix_sms_bridge_default_timezone"
\ No newline at end of file

From 078592454ca0272563525dddcadedb578c4d5a4e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jo=C3=A3o=20Marques?= <joao.marques@tecnativa.com>
Date: Fri, 13 Nov 2020 18:13:45 +0000
Subject: [PATCH 02/43] Update jitsi web to stable-5142

Changelog https://github.com/jitsi/jitsi-meet/releases/tag/stable%2Fjitsi-meet_5142
---
 roles/matrix-jitsi/defaults/main.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/roles/matrix-jitsi/defaults/main.yml b/roles/matrix-jitsi/defaults/main.yml
index 7486821d..d05d2c71 100644
--- a/roles/matrix-jitsi/defaults/main.yml
+++ b/roles/matrix-jitsi/defaults/main.yml
@@ -51,7 +51,7 @@ matrix_jitsi_jibri_recorder_password: ''
 
 matrix_jitsi_enable_lobby: false
 
-matrix_jitsi_container_image_tag: "stable-4857"
+matrix_jitsi_container_image_tag: "stable-5142"
 
 matrix_jitsi_web_docker_image: "jitsi/web:{{ matrix_jitsi_container_image_tag }}"
 matrix_jitsi_web_docker_image_force_pull: "{{ matrix_jitsi_web_docker_image.endswith(':latest') }}"

From 5eed874199e51be851995efcb980c260866aceca Mon Sep 17 00:00:00 2001
From: Slavi Pantaleev <slavi@devture.com>
Date: Sat, 14 Nov 2020 22:47:14 +0200
Subject: [PATCH 03/43] Improve self-building experience (avoid conflict with
 pullable images)

Fixes https://github.com/spantaleev/matrix-docker-ansible-deploy/issues/716

This patch makes us use more fully-qualified container image names
(either prefixed with docker.io/ or with localhost/).

The latter happens when self-building is enabled.

We've recently had issues where if an image was removed manually
and the service was restarted (making `docker run` fetch it from Docker Hub, etc.),
we'd end up with a pulled image, even though we're aiming for a self-built one.
Re-running the playbook would then not do a rebuild, because:
- the image with that name already exists (even though it's something
else)
- we sometimes had conditional logic where we'd build only if the git
repo changed

By explicitly changing the name of the images (prefixing with localhost/),
we avoid such confusion and the possibility that we'd automatically pul something
which is not what we expect.

Also, I've removed that condition where building would happen on git
changes only. We now always build (unless an image with that name
already exists). We just force-build when the git repo changes.
---
 roles/matrix-bridge-mautrix-facebook/defaults/main.yml      | 3 ++-
 .../matrix-bridge-mautrix-facebook/tasks/setup_install.yml  | 4 ++--
 roles/matrix-bridge-mautrix-hangouts/defaults/main.yml      | 3 ++-
 .../matrix-bridge-mautrix-hangouts/tasks/setup_install.yml  | 6 +++---
 roles/matrix-bridge-mx-puppet-discord/defaults/main.yml     | 3 ++-
 .../matrix-bridge-mx-puppet-discord/tasks/setup_install.yml | 4 +++-
 roles/matrix-bridge-mx-puppet-instagram/defaults/main.yml   | 3 ++-
 .../tasks/setup_install.yml                                 | 6 ++++--
 roles/matrix-bridge-mx-puppet-skype/defaults/main.yml       | 3 ++-
 roles/matrix-bridge-mx-puppet-skype/tasks/setup_install.yml | 6 +++---
 roles/matrix-bridge-mx-puppet-slack/defaults/main.yml       | 3 ++-
 roles/matrix-bridge-mx-puppet-slack/tasks/setup_install.yml | 2 ++
 roles/matrix-bridge-mx-puppet-steam/defaults/main.yml       | 3 ++-
 roles/matrix-bridge-mx-puppet-steam/tasks/setup_install.yml | 2 ++
 roles/matrix-bridge-mx-puppet-twitter/defaults/main.yml     | 3 ++-
 .../matrix-bridge-mx-puppet-twitter/tasks/setup_install.yml | 2 ++
 roles/matrix-client-element/defaults/main.yml               | 3 ++-
 roles/matrix-client-element/tasks/setup.yml                 | 6 ++++--
 roles/matrix-coturn/defaults/main.yml                       | 3 ++-
 roles/matrix-coturn/tasks/setup_coturn.yml                  | 4 +++-
 roles/matrix-dynamic-dns/defaults/main.yml                  | 4 +++-
 roles/matrix-dynamic-dns/tasks/install.yml                  | 6 ++++--
 roles/matrix-ma1sd/defaults/main.yml                        | 3 ++-
 roles/matrix-ma1sd/tasks/setup_ma1sd.yml                    | 6 +++++-
 roles/matrix-mailer/defaults/main.yml                       | 3 ++-
 roles/matrix-mailer/tasks/setup_mailer.yml                  | 4 +++-
 roles/matrix-registration/defaults/main.yml                 | 3 ++-
 roles/matrix-registration/tasks/setup.yml                   | 4 ++--
 roles/matrix-synapse-admin/defaults/main.yml                | 3 ++-
 roles/matrix-synapse-admin/tasks/setup.yml                  | 4 ++--
 roles/matrix-synapse/defaults/main.yml                      | 3 ++-
 roles/matrix-synapse/tasks/synapse/setup_install.yml        | 6 ++++--
 32 files changed, 81 insertions(+), 40 deletions(-)

diff --git a/roles/matrix-bridge-mautrix-facebook/defaults/main.yml b/roles/matrix-bridge-mautrix-facebook/defaults/main.yml
index 610bcc11..c34da88f 100644
--- a/roles/matrix-bridge-mautrix-facebook/defaults/main.yml
+++ b/roles/matrix-bridge-mautrix-facebook/defaults/main.yml
@@ -6,7 +6,8 @@ matrix_mautrix_facebook_enabled: true
 matrix_mautrix_facebook_container_image_self_build: false
 
 # See: https://mau.dev/tulir/mautrix-facebook/container_registry
-matrix_mautrix_facebook_docker_image: "dock.mau.dev/tulir/mautrix-facebook:latest"
+matrix_mautrix_facebook_docker_image: "{{ matrix_mautrix_facebook_docker_image_name_prefix }}tulir/mautrix-facebook:latest"
+matrix_mautrix_facebook_docker_image_name_prefix: "{{ 'localhost/' if matrix_mautrix_facebook_container_image_self_build else 'dock.mau.dev/' }}"
 matrix_mautrix_facebook_docker_image_force_pull: "{{ matrix_mautrix_facebook_docker_image.endswith(':latest') }}"
 
 matrix_mautrix_facebook_base_path: "{{ matrix_base_data_path }}/mautrix-facebook"
diff --git a/roles/matrix-bridge-mautrix-facebook/tasks/setup_install.yml b/roles/matrix-bridge-mautrix-facebook/tasks/setup_install.yml
index a1131d8e..75ea7a6b 100644
--- a/roles/matrix-bridge-mautrix-facebook/tasks/setup_install.yml
+++ b/roles/matrix-bridge-mautrix-facebook/tasks/setup_install.yml
@@ -43,12 +43,12 @@
   docker_image:
     name: "{{ matrix_mautrix_facebook_docker_image }}"
     source: build
-    force_source: yes
+    force_source: "{{ matrix_mautrix_facebook_git_pull_results.changed }}"
     build:
       dockerfile: Dockerfile
       path: "{{ matrix_mautrix_facebook_docker_src_files_path }}"
       pull: yes
-  when: "matrix_mautrix_facebook_enabled|bool and matrix_mautrix_facebook_container_image_self_build and matrix_mautrix_facebook_git_pull_results.changed"
+  when: "matrix_mautrix_facebook_enabled|bool and matrix_mautrix_facebook_container_image_self_build|bool"
 
 - name: Check if an old database file already exists
   stat:
diff --git a/roles/matrix-bridge-mautrix-hangouts/defaults/main.yml b/roles/matrix-bridge-mautrix-hangouts/defaults/main.yml
index 8430527a..13bc1a6c 100644
--- a/roles/matrix-bridge-mautrix-hangouts/defaults/main.yml
+++ b/roles/matrix-bridge-mautrix-hangouts/defaults/main.yml
@@ -6,7 +6,8 @@ matrix_mautrix_hangouts_enabled: true
 matrix_mautrix_hangouts_container_image_self_build: false
 
 # See: https://mau.dev/tulir/mautrix-hangouts/container_registry
-matrix_mautrix_hangouts_docker_image: "dock.mau.dev/tulir/mautrix-hangouts:latest"
+matrix_mautrix_hangouts_docker_image: "{{ matrix_mautrix_hangouts_docker_image_name_prefix }}tulir/mautrix-hangouts:latest"
+matrix_mautrix_hangouts_docker_image_name_prefix: "{{ 'localhost/' if matrix_mautrix_hangouts_container_image_self_build else 'dock.mau.dev/' }}"
 matrix_mautrix_hangouts_docker_image_force_pull: "{{ matrix_mautrix_hangouts_docker_image.endswith(':latest') }}"
 
 matrix_mautrix_hangouts_base_path: "{{ matrix_base_data_path }}/mautrix-hangouts"
diff --git a/roles/matrix-bridge-mautrix-hangouts/tasks/setup_install.yml b/roles/matrix-bridge-mautrix-hangouts/tasks/setup_install.yml
index 97893be7..5dc5f20a 100644
--- a/roles/matrix-bridge-mautrix-hangouts/tasks/setup_install.yml
+++ b/roles/matrix-bridge-mautrix-hangouts/tasks/setup_install.yml
@@ -36,18 +36,18 @@
     dest: "{{ matrix_mautrix_hangouts_docker_src_files_path }}"
     force: "yes"
   register: matrix_mautrix_hangouts_git_pull_results
-  when: "matrix_mautrix_hangouts_enabled|bool and matrix_mautrix_hangouts_container_image_self_build"
+  when: "matrix_mautrix_hangouts_enabled|bool and matrix_mautrix_hangouts_container_image_self_build|bool"
 
 - name: Ensure Mautrix Hangouts Docker image is built
   docker_image:
     name: "{{ matrix_mautrix_hangouts_docker_image }}"
     source: build
-    force_source: yes
+    force_source: "{{ matrix_mautrix_hangouts_git_pull_results.changed }}"
     build:
       dockerfile: Dockerfile
       path: "{{ matrix_mautrix_hangouts_docker_src_files_path }}"
       pull: yes
-  when: "matrix_mautrix_hangouts_enabled|bool and matrix_mautrix_hangouts_container_image_self_build and matrix_mautrix_hangouts_git_pull_results.changed"
+  when: "matrix_mautrix_hangouts_enabled|bool and matrix_mautrix_hangouts_container_image_self_build|bool"
 
 - name: Check if an old database file already exists
   stat:
diff --git a/roles/matrix-bridge-mx-puppet-discord/defaults/main.yml b/roles/matrix-bridge-mx-puppet-discord/defaults/main.yml
index 12c597d4..30732000 100644
--- a/roles/matrix-bridge-mx-puppet-discord/defaults/main.yml
+++ b/roles/matrix-bridge-mx-puppet-discord/defaults/main.yml
@@ -10,7 +10,8 @@ matrix_mx_puppet_discord_container_image_self_build: false
 # Takes an "<ip>:<port>" or "<port>" value (e.g. "127.0.0.1:8432"), or empty string to not expose.
 matrix_mx_puppet_discord_container_http_host_bind_port: ''
 
-matrix_mx_puppet_discord_docker_image: "sorunome/mx-puppet-discord:latest"
+matrix_mx_puppet_discord_docker_image: "{{ matrix_mx_puppet_discord_docker_image_name_prefix }}sorunome/mx-puppet-discord:latest"
+matrix_mx_puppet_discord_docker_image_name_prefix: "{{ 'localhost/' if matrix_mx_puppet_discord_container_image_self_build else 'docker.io/' }}"
 matrix_mx_puppet_discord_docker_image_force_pull: "{{ matrix_mx_puppet_discord_docker_image.endswith(':latest') }}"
 
 matrix_mx_puppet_discord_base_path: "{{ matrix_base_data_path }}/mx-puppet-discord"
diff --git a/roles/matrix-bridge-mx-puppet-discord/tasks/setup_install.yml b/roles/matrix-bridge-mx-puppet-discord/tasks/setup_install.yml
index e1aef147..e36950bd 100644
--- a/roles/matrix-bridge-mx-puppet-discord/tasks/setup_install.yml
+++ b/roles/matrix-bridge-mx-puppet-discord/tasks/setup_install.yml
@@ -35,17 +35,19 @@
     repo: https://github.com/matrix-discord/mx-puppet-discord.git
     dest: "{{ matrix_mx_puppet_discord_docker_src_files_path }}"
     force: "yes"
+  register: matrix_mx_puppet_discord_git_pull_results
   when: "matrix_mx_puppet_discord_enabled|bool and matrix_mx_puppet_discord_container_image_self_build"
 
 - name: Ensure MX Puppet Discord Docker image is built
   docker_image:
     name: "{{ matrix_mx_puppet_discord_docker_image }}"
     source: build
+    force_source: "{{ matrix_mx_puppet_discord_git_pull_results.changed }}"
     build:
       dockerfile: Dockerfile
       path: "{{ matrix_mx_puppet_discord_docker_src_files_path }}"
       pull: yes
-  when: "matrix_mx_puppet_discord_enabled|bool and matrix_mx_puppet_discord_container_image_self_build"
+  when: "matrix_mx_puppet_discord_enabled|bool and matrix_mx_puppet_discord_container_image_self_build|bool"
 
 - name: Check if an old database file already exists
   stat:
diff --git a/roles/matrix-bridge-mx-puppet-instagram/defaults/main.yml b/roles/matrix-bridge-mx-puppet-instagram/defaults/main.yml
index c7488cbb..108a0a34 100644
--- a/roles/matrix-bridge-mx-puppet-instagram/defaults/main.yml
+++ b/roles/matrix-bridge-mx-puppet-instagram/defaults/main.yml
@@ -5,7 +5,8 @@ matrix_mx_puppet_instagram_enabled: true
 
 matrix_mx_puppet_instagram_container_image_self_build: false
 
-matrix_mx_puppet_instagram_docker_image: "docker.io/sorunome/mx-puppet-instagram:latest"
+matrix_mx_puppet_instagram_docker_image: "{{ matrix_mx_puppet_instagram_docker_image_name_prefix }}sorunome/mx-puppet-instagram:latest"
+matrix_mx_puppet_instagram_docker_image_name_prefix: "{{ 'localhost/' if matrix_mx_puppet_instagram_container_image_self_build else 'docker.io/' }}"
 matrix_mx_puppet_instagram_docker_image_force_pull: "{{ matrix_mx_puppet_instagram_docker_image.endswith(':latest') }}"
 
 matrix_mx_puppet_instagram_base_path: "{{ matrix_base_data_path }}/mx-puppet-instagram"
diff --git a/roles/matrix-bridge-mx-puppet-instagram/tasks/setup_install.yml b/roles/matrix-bridge-mx-puppet-instagram/tasks/setup_install.yml
index d60fbaf2..6b638626 100644
--- a/roles/matrix-bridge-mx-puppet-instagram/tasks/setup_install.yml
+++ b/roles/matrix-bridge-mx-puppet-instagram/tasks/setup_install.yml
@@ -35,17 +35,19 @@
     repo: https://github.com/Sorunome/mx-puppet-instagram.git
     dest: "{{ matrix_mx_puppet_instagram_docker_src_files_path }}"
     force: "yes"
-  when: "matrix_mx_puppet_instagram_enabled|bool and matrix_mx_puppet_instagram_container_image_self_build"
+  register: matrix_mx_puppet_instagram_git_pull_results
+  when: "matrix_mx_puppet_instagram_enabled|bool and matrix_mx_puppet_instagram_container_image_self_build|bool"
 
 - name: Ensure mx-puppet-instagram Docker image is built
   docker_image:
     name: "{{ matrix_mx_puppet_instagram_docker_image }}"
     source: build
+    force_source: "{{ matrix_mx_puppet_instagram_git_pull_results.changed }}"
     build:
       dockerfile: Dockerfile
       path: "{{ matrix_mx_puppet_instagram_docker_src_files_path }}"
       pull: yes
-  when: "matrix_mx_puppet_instagram_enabled|bool and matrix_mx_puppet_instagram_container_image_self_build"
+  when: "matrix_mx_puppet_instagram_enabled|bool and matrix_mx_puppet_instagram_container_image_self_build|bool"
 
 - name: Ensure mx-puppet-instagram config.yaml installed
   copy:
diff --git a/roles/matrix-bridge-mx-puppet-skype/defaults/main.yml b/roles/matrix-bridge-mx-puppet-skype/defaults/main.yml
index 8b977acf..9e1c71bb 100644
--- a/roles/matrix-bridge-mx-puppet-skype/defaults/main.yml
+++ b/roles/matrix-bridge-mx-puppet-skype/defaults/main.yml
@@ -5,7 +5,8 @@ matrix_mx_puppet_skype_enabled: true
 
 matrix_mx_puppet_skype_container_image_self_build: false
 
-matrix_mx_puppet_skype_docker_image: "sorunome/mx-puppet-skype:latest"
+matrix_mx_puppet_skype_docker_image: "{{ matrix_mx_puppet_skype_docker_image_name_prefix }}sorunome/mx-puppet-skype:latest"
+matrix_mx_puppet_skype_docker_image_name_prefix: "{{ 'localhost/' if matrix_mx_puppet_skype_container_image_self_build else 'docker.io/' }}"
 matrix_mx_puppet_skype_docker_image_force_pull: "{{ matrix_mx_puppet_skype_docker_image.endswith(':latest') }}"
 
 matrix_mx_puppet_skype_base_path: "{{ matrix_base_data_path }}/mx-puppet-skype"
diff --git a/roles/matrix-bridge-mx-puppet-skype/tasks/setup_install.yml b/roles/matrix-bridge-mx-puppet-skype/tasks/setup_install.yml
index 1febca3e..9b04c290 100644
--- a/roles/matrix-bridge-mx-puppet-skype/tasks/setup_install.yml
+++ b/roles/matrix-bridge-mx-puppet-skype/tasks/setup_install.yml
@@ -36,18 +36,18 @@
     dest: "{{ matrix_mx_puppet_skype_docker_src_files_path }}"
     force: "yes"
   register: matrix_mx_puppet_skype_git_pull_results
-  when: "matrix_mx_puppet_skype_enabled|bool and matrix_mx_puppet_skype_container_image_self_build"
+  when: "matrix_mx_puppet_skype_enabled|bool and matrix_mx_puppet_skype_container_image_self_build|bool"
 
 - name: Ensure MX Puppet Skype Docker image is built
   docker_image:
     name: "{{ matrix_mx_puppet_skype_docker_image }}"
     source: build
-    force_source: yes
+    force_source: "{{ matrix_mx_puppet_skype_git_pull_results.changed }}"
     build:
       dockerfile: Dockerfile
       path: "{{ matrix_mx_puppet_skype_docker_src_files_path }}"
       pull: yes
-  when: "matrix_mx_puppet_skype_enabled|bool and matrix_mx_puppet_skype_container_image_self_build and matrix_mx_puppet_skype_git_pull_results.changed"
+  when: "matrix_mx_puppet_skype_enabled|bool and matrix_mx_puppet_skype_container_image_self_build|bool"
 
 - name: Check if an old database file already exists
   stat:
diff --git a/roles/matrix-bridge-mx-puppet-slack/defaults/main.yml b/roles/matrix-bridge-mx-puppet-slack/defaults/main.yml
index 6acfb714..94b37041 100644
--- a/roles/matrix-bridge-mx-puppet-slack/defaults/main.yml
+++ b/roles/matrix-bridge-mx-puppet-slack/defaults/main.yml
@@ -10,7 +10,8 @@ matrix_mx_puppet_slack_container_image_self_build: false
 # Takes an "<ip>:<port>" or "<port>" value (e.g. "127.0.0.1:8432"), or empty string to not expose.
 matrix_mx_puppet_slack_container_http_host_bind_port: ''
 
-matrix_mx_puppet_slack_docker_image: "sorunome/mx-puppet-slack:latest"
+matrix_mx_puppet_slack_docker_image: "{{ matrix_mx_puppet_slack_docker_image_name_prefix }}sorunome/mx-puppet-slack:latest"
+matrix_mx_puppet_slack_docker_image_name_prefix: "{{ 'localhost/' if matrix_mx_puppet_slack_container_image_self_build else 'docker.io/' }}"
 matrix_mx_puppet_slack_docker_image_force_pull: "{{ matrix_mx_puppet_slack_docker_image.endswith(':latest') }}"
 
 matrix_mx_puppet_slack_base_path: "{{ matrix_base_data_path }}/mx-puppet-slack"
diff --git a/roles/matrix-bridge-mx-puppet-slack/tasks/setup_install.yml b/roles/matrix-bridge-mx-puppet-slack/tasks/setup_install.yml
index ddaede72..b7cdc13c 100644
--- a/roles/matrix-bridge-mx-puppet-slack/tasks/setup_install.yml
+++ b/roles/matrix-bridge-mx-puppet-slack/tasks/setup_install.yml
@@ -35,12 +35,14 @@
     repo: https://github.com/Sorunome/mx-puppet-slack.git
     dest: "{{ matrix_mx_puppet_slack_docker_src_files_path }}"
     force: "yes"
+  register: matrix_mx_puppet_slack_git_pull_results
   when: "matrix_mx_puppet_slack_enabled|bool and matrix_mx_puppet_slack_container_image_self_build"
 
 - name: Ensure MX Puppet Slack Docker image is built
   docker_image:
     name: "{{ matrix_mx_puppet_slack_docker_image }}"
     source: build
+    force_source: "{{ matrix_mx_puppet_slack_git_pull_results.changed }}"
     build:
       dockerfile: Dockerfile
       path: "{{ matrix_mx_puppet_slack_docker_src_files_path }}"
diff --git a/roles/matrix-bridge-mx-puppet-steam/defaults/main.yml b/roles/matrix-bridge-mx-puppet-steam/defaults/main.yml
index bea26d39..cb06bf7d 100644
--- a/roles/matrix-bridge-mx-puppet-steam/defaults/main.yml
+++ b/roles/matrix-bridge-mx-puppet-steam/defaults/main.yml
@@ -10,7 +10,8 @@ matrix_mx_puppet_steam_container_image_self_build: false
 # Takes an "<ip>:<port>" or "<port>" value (e.g. "127.0.0.1:8432"), or empty string to not expose.
 matrix_mx_puppet_steam_container_http_host_bind_port: ''
 
-matrix_mx_puppet_steam_docker_image: "icewind1991/mx-puppet-steam:latest"
+matrix_mx_puppet_steam_docker_image: "{{ matrix_mx_puppet_steam_docker_image_name_prefix }}icewind1991/mx-puppet-steam:latest"
+matrix_mx_puppet_steam_docker_image_name_prefix: "{{ 'localhost/' if matrix_mx_puppet_steam_container_image_self_build else 'docker.io/' }}"
 matrix_mx_puppet_steam_docker_image_force_pull: "{{ matrix_mx_puppet_steam_docker_image.endswith(':latest') }}"
 
 matrix_mx_puppet_steam_base_path: "{{ matrix_base_data_path }}/mx-puppet-steam"
diff --git a/roles/matrix-bridge-mx-puppet-steam/tasks/setup_install.yml b/roles/matrix-bridge-mx-puppet-steam/tasks/setup_install.yml
index be41c645..d9679510 100644
--- a/roles/matrix-bridge-mx-puppet-steam/tasks/setup_install.yml
+++ b/roles/matrix-bridge-mx-puppet-steam/tasks/setup_install.yml
@@ -35,12 +35,14 @@
     repo: https://github.com/icewind1991/mx-puppet-steam.git
     dest: "{{ matrix_mx_puppet_steam_docker_src_files_path }}"
     force: "yes"
+  register: matrix_mx_puppet_steam_git_pull_results
   when: "matrix_mx_puppet_steam_enabled|bool and matrix_mx_puppet_steam_container_image_self_build"
 
 - name: Ensure MX Puppet Steam Docker image is built
   docker_image:
     name: "{{ matrix_mx_puppet_steam_docker_image }}"
     source: build
+    force_source: "{{ matrix_mx_puppet_steam_git_pull_results.changed }}"
     build:
       dockerfile: Dockerfile
       path: "{{ matrix_mx_puppet_steam_docker_src_files_path }}"
diff --git a/roles/matrix-bridge-mx-puppet-twitter/defaults/main.yml b/roles/matrix-bridge-mx-puppet-twitter/defaults/main.yml
index 8299fd81..18c39826 100644
--- a/roles/matrix-bridge-mx-puppet-twitter/defaults/main.yml
+++ b/roles/matrix-bridge-mx-puppet-twitter/defaults/main.yml
@@ -10,7 +10,8 @@ matrix_mx_puppet_twitter_container_image_self_build: false
 # Takes an "<ip>:<port>" or "<port>" value (e.g. "127.0.0.1:8432"), or empty string to not expose.
 matrix_mx_puppet_twitter_container_http_host_bind_port: ''
 
-matrix_mx_puppet_twitter_docker_image: "sorunome/mx-puppet-twitter:latest"
+matrix_mx_puppet_twitter_docker_image: "{{ matrix_mx_puppet_twitter_docker_image_name_prefix }}sorunome/mx-puppet-twitter:latest"
+matrix_mx_puppet_twitter_docker_image_name_prefix: "{{ 'localhost/' if matrix_mx_puppet_twitter_container_image_self_build else 'docker.io/' }}"
 matrix_mx_puppet_twitter_docker_image_force_pull: "{{ matrix_mx_puppet_twitter_docker_image.endswith(':latest') }}"
 
 matrix_mx_puppet_twitter_base_path: "{{ matrix_base_data_path }}/mx-puppet-twitter"
diff --git a/roles/matrix-bridge-mx-puppet-twitter/tasks/setup_install.yml b/roles/matrix-bridge-mx-puppet-twitter/tasks/setup_install.yml
index 4773055d..10e49572 100644
--- a/roles/matrix-bridge-mx-puppet-twitter/tasks/setup_install.yml
+++ b/roles/matrix-bridge-mx-puppet-twitter/tasks/setup_install.yml
@@ -35,12 +35,14 @@
     repo: https://github.com/Sorunome/mx-puppet-twitter.git
     dest: "{{ matrix_mx_puppet_twitter_docker_src_files_path }}"
     force: "yes"
+  register: matrix_mx_puppet_twitter_git_pull_results
   when: "matrix_mx_puppet_twitter_enabled|bool and matrix_mx_puppet_twitter_container_image_self_build"
 
 - name: Ensure MX Puppet Twitter Docker image is built
   docker_image:
     name: "{{ matrix_mx_puppet_twitter_docker_image }}"
     source: build
+    force_source: "{{ matrix_mx_puppet_twitter_git_pull_results.changed }}"
     build:
       dockerfile: Dockerfile
       path: "{{ matrix_mx_puppet_twitter_docker_src_files_path }}"
diff --git a/roles/matrix-client-element/defaults/main.yml b/roles/matrix-client-element/defaults/main.yml
index c591b025..f1504c5b 100644
--- a/roles/matrix-client-element/defaults/main.yml
+++ b/roles/matrix-client-element/defaults/main.yml
@@ -2,7 +2,8 @@ matrix_client_element_enabled: true
 
 matrix_client_element_container_image_self_build: false
 
-matrix_client_element_docker_image: "vectorim/element-web:v1.7.13"
+matrix_client_element_docker_image: "{{ matrix_client_element_docker_image_name_prefix }}vectorim/element-web:v1.7.13"
+matrix_client_element_docker_image_name_prefix: "{{ 'localhost/' if matrix_client_element_container_image_self_build else 'docker.io/' }}"
 matrix_client_element_docker_image_force_pull: "{{ matrix_client_element_docker_image.endswith(':latest') }}"
 
 matrix_client_element_data_path: "{{ matrix_base_data_path }}/client-element"
diff --git a/roles/matrix-client-element/tasks/setup.yml b/roles/matrix-client-element/tasks/setup.yml
index 2e8071ca..81f7842f 100644
--- a/roles/matrix-client-element/tasks/setup.yml
+++ b/roles/matrix-client-element/tasks/setup.yml
@@ -30,17 +30,19 @@
     dest: "{{ matrix_client_element_docker_src_files_path }}"
     version: "{{ matrix_client_element_docker_image.split(':')[1] }}"
     force: "yes"
-  when: "matrix_client_element_enabled|bool and matrix_client_element_container_image_self_build"
+  register: matrix_client_element_git_pull_results
+  when: "matrix_client_element_enabled|bool and matrix_client_element_container_image_self_build|bool"
 
 - name: Ensure Element Docker image is built
   docker_image:
     name: "{{ matrix_client_element_docker_image }}"
     source: build
+    force_source: "{{ matrix_client_element_git_pull_results.changed }}"
     build:
       dockerfile: Dockerfile
       path: "{{ matrix_client_element_docker_src_files_path }}"
       pull: yes
-  when: "matrix_client_element_enabled|bool and matrix_client_element_container_image_self_build"
+  when: "matrix_client_element_enabled|bool and matrix_client_element_container_image_self_build|bool"
 
 - name: Ensure Element configuration installed
   copy:
diff --git a/roles/matrix-coturn/defaults/main.yml b/roles/matrix-coturn/defaults/main.yml
index 104019a4..4aae3f06 100644
--- a/roles/matrix-coturn/defaults/main.yml
+++ b/roles/matrix-coturn/defaults/main.yml
@@ -2,7 +2,8 @@ matrix_coturn_enabled: true
 
 matrix_coturn_container_image_self_build: false
 
-matrix_coturn_docker_image: "instrumentisto/coturn:4.5.1.3"
+matrix_coturn_docker_image: "{{ matrix_coturn_docker_image_name_prefix }}instrumentisto/coturn:4.5.1.3"
+matrix_coturn_docker_image_name_prefix: "{{ 'localhost/' if matrix_coturn_container_image_self_build else 'docker.io/' }}"
 matrix_coturn_docker_image_force_pull: "{{ matrix_coturn_docker_image.endswith(':latest') }}"
 
 # The Docker network that Coturn would be put into.
diff --git a/roles/matrix-coturn/tasks/setup_coturn.yml b/roles/matrix-coturn/tasks/setup_coturn.yml
index 17b6137d..fa622caf 100644
--- a/roles/matrix-coturn/tasks/setup_coturn.yml
+++ b/roles/matrix-coturn/tasks/setup_coturn.yml
@@ -29,17 +29,19 @@
     dest: "{{ matrix_coturn_docker_src_files_path }}"
     version: "{{ matrix_coturn_docker_image.split(':')[1] }}"
     force: "yes"
+  register: matrix_coturn_git_pull_results
   when: "matrix_coturn_enabled|bool and matrix_coturn_container_image_self_build"
 
 - name: Ensure Coturn Docker image is built
   docker_image:
     name: "{{ matrix_coturn_docker_image }}"
     source: build
+    force_source: "{{ matrix_coturn_git_pull_results.changed }}"
     build:
       dockerfile: Dockerfile
       path: "{{ matrix_coturn_docker_src_files_path }}"
       pull: yes
-  when: "matrix_coturn_enabled|bool and matrix_coturn_container_image_self_build"
+  when: "matrix_coturn_enabled|bool and matrix_coturn_container_image_self_build|bool"
 
 - name: Ensure Coturn configuration path exists
   file:
diff --git a/roles/matrix-dynamic-dns/defaults/main.yml b/roles/matrix-dynamic-dns/defaults/main.yml
index 0d34ccea..17c57f2c 100644
--- a/roles/matrix-dynamic-dns/defaults/main.yml
+++ b/roles/matrix-dynamic-dns/defaults/main.yml
@@ -5,7 +5,9 @@ matrix_dynamic_dns_enabled: true
 matrix_dynamic_dns_daemon_interval: '300'
 
 # The docker container to use when in mode
-matrix_dynamic_dns_docker_image: 'linuxserver/ddclient:v3.9.1-ls45'
+matrix_dynamic_dns_docker_image: '{{ matrix_dynamic_dns_docker_image_name_prefix }}linuxserver/ddclient:v3.9.1-ls45'
+
+matrix_dynamic_dns_docker_image_name_prefix: "{{ 'localhost/' if matrix_dynamic_dns_container_image_self_build else 'docker.io/' }}"
 
 # The image to force pull
 matrix_dynamic_dns_docker_image_force_pull: "{{ matrix_dynamic_dns_docker_image.endswith(':latest') }}"
diff --git a/roles/matrix-dynamic-dns/tasks/install.yml b/roles/matrix-dynamic-dns/tasks/install.yml
index 225738bf..9ca1043f 100644
--- a/roles/matrix-dynamic-dns/tasks/install.yml
+++ b/roles/matrix-dynamic-dns/tasks/install.yml
@@ -26,17 +26,19 @@
     repo: https://github.com/linuxserver/docker-ddclient.git
     dest: "{{ matrix_dynamic_dns_docker_src_files_path }}"
     force: "yes"
-  when: "matrix_dynamic_dns_enabled|bool and matrix_dynamic_dns_container_image_self_build"
+  register: matrix_dynamic_dns_git_pull_results
+  when: "matrix_dynamic_dns_enabled|bool and matrix_dynamic_dns_container_image_self_build|bool"
 
 - name: Ensure Dynamic DNS Docker image is built
   docker_image:
     name: "{{ matrix_dynamic_dns_docker_image }}"
     source: build
+    force_source: "{{ matrix_dynamic_dns_git_pull_results.changed }}"
     build:
       dockerfile: Dockerfile
       path: "{{ matrix_dynamic_dns_docker_src_files_path }}"
       pull: yes
-  when: "matrix_dynamic_dns_enabled|bool and matrix_dynamic_dns_container_image_self_build"
+  when: "matrix_dynamic_dns_enabled|bool and matrix_dynamic_dns_container_image_self_build|bool"
 
 - name: Ensure Dynamic DNS ddclient.conf installed
   template:
diff --git a/roles/matrix-ma1sd/defaults/main.yml b/roles/matrix-ma1sd/defaults/main.yml
index 63bc5a59..b86f7ee0 100644
--- a/roles/matrix-ma1sd/defaults/main.yml
+++ b/roles/matrix-ma1sd/defaults/main.yml
@@ -7,7 +7,8 @@ matrix_ma1sd_container_image_self_build: false
 
 matrix_ma1sd_architecture: "amd64"
 
-matrix_ma1sd_docker_image: "ma1uta/ma1sd:2.4.0-{{ matrix_ma1sd_architecture }}"
+matrix_ma1sd_docker_image: "{{ matrix_ma1sd_docker_image_name_prefix }}ma1uta/ma1sd:2.4.0-{{ matrix_ma1sd_architecture }}"
+matrix_ma1sd_docker_image_name_prefix: "{{ 'localhost/' if matrix_ma1sd_container_image_self_build else 'docker.io/' }}"
 matrix_ma1sd_docker_image_force_pull: "{{ matrix_ma1sd_docker_image.endswith(':latest') }}"
 
 matrix_ma1sd_base_path: "{{ matrix_base_data_path }}/ma1sd"
diff --git a/roles/matrix-ma1sd/tasks/setup_ma1sd.yml b/roles/matrix-ma1sd/tasks/setup_ma1sd.yml
index 44fe6b19..8814e6b9 100644
--- a/roles/matrix-ma1sd/tasks/setup_ma1sd.yml
+++ b/roles/matrix-ma1sd/tasks/setup_ma1sd.yml
@@ -56,6 +56,7 @@
       dest: "{{ matrix_ma1sd_docker_src_files_path }}"
       version: "{{ matrix_ma1sd_docker_image.split(':')[1].split('-')[0] }}"
       force: "yes"
+    register: matrix_ma1sd_git_pull_results
 
   - name: Ensure ma1sd Docker image is built
     shell: "./gradlew dockerBuild"
@@ -64,7 +65,10 @@
 
   - name: Ensure ma1sd Docker image is tagged correctly
     docker_image:
-      name: "{{ matrix_ma1sd_docker_image.split('-')[0] }}"
+      # The build script always tags the image with something like `ma1uta/ma1sd:2.4.0`.
+      # Remove the `-{{ matrix_ma1sd_architecture }}` suffix and our `localhost/` prefix (applied when self-building)
+      # to get to what has actually been built, so we can retag it as `{{ matrix_ma1sd_docker_image }}`.
+      name: "{{ matrix_ma1sd_docker_image.split('-')[0].replace('localhost/', '') }}"
       repository: "{{ matrix_ma1sd_docker_image }}"
       force_tag: yes
       source: local
diff --git a/roles/matrix-mailer/defaults/main.yml b/roles/matrix-mailer/defaults/main.yml
index 0a8fd13c..f396d8ee 100644
--- a/roles/matrix-mailer/defaults/main.yml
+++ b/roles/matrix-mailer/defaults/main.yml
@@ -7,7 +7,8 @@ matrix_mailer_container_image_self_build_repository_url: "https://github.com/dev
 matrix_mailer_container_image_self_build_src_files_path: "{{ matrix_mailer_base_path }}/docker-src"
 matrix_mailer_container_image_self_build_version: "{{ matrix_mailer_docker_image.split(':')[1] }}"
 
-matrix_mailer_docker_image: "devture/exim-relay:4.93.1-r0"
+matrix_mailer_docker_image: "{{ matrix_mailer_docker_image_name_prefix }}devture/exim-relay:4.93.1-r0"
+matrix_mailer_docker_image_name_prefix: "{{ 'localhost/' if matrix_mailer_container_image_self_build else 'docker.io/' }}"
 matrix_mailer_docker_image_force_pull: "{{ matrix_mailer_docker_image.endswith(':latest') }}"
 
 # The user/group that the container runs with.
diff --git a/roles/matrix-mailer/tasks/setup_mailer.yml b/roles/matrix-mailer/tasks/setup_mailer.yml
index 99370638..cb979080 100644
--- a/roles/matrix-mailer/tasks/setup_mailer.yml
+++ b/roles/matrix-mailer/tasks/setup_mailer.yml
@@ -29,12 +29,14 @@
     dest: "{{ matrix_mailer_container_image_self_build_src_files_path }}"
     version: "{{ matrix_mailer_container_image_self_build_version }}"
     force: "yes"
-  when: "matrix_mailer_container_image_self_build|bool"
+  register: matrix_mailer_git_pull_results
+  when: "matrix_mailer_enabled|bool and matrix_mailer_container_image_self_build|bool"
 
 - name: Ensure exim-relay Docker image is built
   docker_image:
     name: "{{ matrix_mailer_docker_image }}"
     source: build
+    force_source: "{{ matrix_mailer_git_pull_results.changed }}"
     build:
       dockerfile: Dockerfile
       path: "{{ matrix_mailer_container_image_self_build_src_files_path }}"
diff --git a/roles/matrix-registration/defaults/main.yml b/roles/matrix-registration/defaults/main.yml
index 7eb9340e..c2150488 100644
--- a/roles/matrix-registration/defaults/main.yml
+++ b/roles/matrix-registration/defaults/main.yml
@@ -12,7 +12,8 @@ matrix_registration_docker_src_files_path: "{{ matrix_registration_base_path }}/
 
 matrix_registration_version: "v0.7.0"
 
-matrix_registration_docker_image: "devture/zeratax-matrix-registration:{{ matrix_registration_version }}"
+matrix_registration_docker_image: "{{ matrix_registration_docker_image_name_prefix }}devture/zeratax-matrix-registration:{{ matrix_registration_version }}"
+matrix_registration_docker_image_name_prefix: "{{ 'localhost/' if matrix_registration_container_image_self_build else 'docker.io/' }}"
 matrix_registration_docker_image_force_pull: "{{ matrix_registration_docker_image.endswith(':latest') }}"
 matrix_registration_docker_repo: "https://github.com/ZerataX/matrix-registration"
 
diff --git a/roles/matrix-registration/tasks/setup.yml b/roles/matrix-registration/tasks/setup.yml
index 29b2347b..253f7aea 100644
--- a/roles/matrix-registration/tasks/setup.yml
+++ b/roles/matrix-registration/tasks/setup.yml
@@ -39,12 +39,12 @@
   docker_image:
     name: "{{ matrix_registration_docker_image }}"
     source: build
-    force_source: yes
+    force_source: "{{ matrix_registration_git_pull_results.changed }}"
     build:
       dockerfile: Dockerfile
       path: "{{ matrix_registration_docker_src_files_path }}"
       pull: yes
-  when: "matrix_registration_enabled|bool and matrix_registration_container_image_self_build|bool and matrix_registration_git_pull_results.changed"
+  when: "matrix_registration_enabled|bool and matrix_registration_container_image_self_build|bool"
 
 - name: Ensure matrix-registration config installed
   copy:
diff --git a/roles/matrix-synapse-admin/defaults/main.yml b/roles/matrix-synapse-admin/defaults/main.yml
index 17de0636..6f1d219e 100644
--- a/roles/matrix-synapse-admin/defaults/main.yml
+++ b/roles/matrix-synapse-admin/defaults/main.yml
@@ -7,7 +7,8 @@ matrix_synapse_admin_container_self_build: false
 matrix_synapse_admin_docker_repo: "https://github.com/Awesome-Technologies/synapse-admin.git"
 matrix_synapse_admin_docker_src_files_path: "{{ matrix_base_data_path }}/synapse-admin/docker-src"
 
-matrix_synapse_admin_docker_image: "awesometechnologies/synapse-admin:0.5.0"
+matrix_synapse_admin_docker_image: "{{ matrix_synapse_admin_docker_image_name_prefix }}awesometechnologies/synapse-admin:0.5.0"
+matrix_synapse_admin_docker_image_name_prefix: "{{ 'localhost/' if matrix_synapse_admin_container_self_build else 'docker.io/' }}"
 matrix_synapse_admin_docker_image_force_pull: "{{ matrix_synapse_admin_docker_image.endswith(':latest') }}"
 
 # A list of extra arguments to pass to the container
diff --git a/roles/matrix-synapse-admin/tasks/setup.yml b/roles/matrix-synapse-admin/tasks/setup.yml
index 0ee5e8d2..6d2b8c20 100644
--- a/roles/matrix-synapse-admin/tasks/setup.yml
+++ b/roles/matrix-synapse-admin/tasks/setup.yml
@@ -24,12 +24,12 @@
   docker_image:
     name: "{{ matrix_synapse_admin_docker_image }}"
     source: build
-    force_source: yes
+    force_source: "{{ matrix_synapse_admin_git_pull_results }}"
     build:
       dockerfile: Dockerfile
       path: "{{ matrix_synapse_admin_docker_src_files_path }}"
       pull: yes
-  when: "matrix_synapse_admin_enabled|bool and matrix_synapse_admin_container_self_build|bool and matrix_synapse_admin_git_pull_results.changed"
+  when: "matrix_synapse_admin_enabled|bool and matrix_synapse_admin_container_self_build|bool"
 
 - name: Ensure matrix-synapse-admin.service installed
   template:
diff --git a/roles/matrix-synapse/defaults/main.yml b/roles/matrix-synapse/defaults/main.yml
index 5777e802..4cc819a6 100644
--- a/roles/matrix-synapse/defaults/main.yml
+++ b/roles/matrix-synapse/defaults/main.yml
@@ -5,7 +5,8 @@ matrix_synapse_enabled: true
 
 matrix_synapse_container_image_self_build: false
 
-matrix_synapse_docker_image: "matrixdotorg/synapse:v1.22.1"
+matrix_synapse_docker_image: "{{ matrix_synapse_docker_image_name_prefix }}matrixdotorg/synapse:v1.22.1"
+matrix_synapse_docker_image_name_prefix: "{{ 'localhost/' if matrix_synapse_container_image_self_build else 'docker.io/' }}"
 matrix_synapse_docker_image_force_pull: "{{ matrix_synapse_docker_image.endswith(':latest') }}"
 
 matrix_synapse_base_path: "{{ matrix_base_data_path }}/synapse"
diff --git a/roles/matrix-synapse/tasks/synapse/setup_install.yml b/roles/matrix-synapse/tasks/synapse/setup_install.yml
index 58f4d31d..51f846e3 100644
--- a/roles/matrix-synapse/tasks/synapse/setup_install.yml
+++ b/roles/matrix-synapse/tasks/synapse/setup_install.yml
@@ -24,17 +24,19 @@
     dest: "{{ matrix_synapse_docker_src_files_path }}"
     version: "{{ matrix_synapse_docker_image.split(':')[1] }}"
     force: "yes"
-  when: "matrix_synapse_container_image_self_build"
+  register: matrix_synapse_git_pull_results
+  when: "matrix_synapse_container_image_self_build|bool"
 
 - name: Ensure Synapse Docker image is built
   docker_image:
     name: "{{ matrix_synapse_docker_image }}"
     source: build
+    force_source: "{{ matrix_synapse_git_pull_results.changed }}"
     build:
       dockerfile: docker/Dockerfile
       path: "{{ matrix_synapse_docker_src_files_path }}"
       pull: yes
-  when: "matrix_synapse_container_image_self_build"
+  when: "matrix_synapse_container_image_self_build|bool"
 
 - name: Ensure Synapse Docker image is pulled
   docker_image:

From ccabc82d4cd46f586fac9fc63c4f54abe35cd49c Mon Sep 17 00:00:00 2001
From: Slavi Pantaleev <slavi@devture.com>
Date: Sat, 14 Nov 2020 22:53:23 +0200
Subject: [PATCH 04/43] Use more fully-qualified container images

This is both for consistency with 93cc71cb69976c
and for making things more obvious.
---
 roles/matrix-bot-matrix-reminder-bot/defaults/main.yml |  2 +-
 .../matrix-bridge-appservice-discord/defaults/main.yml |  2 +-
 roles/matrix-bridge-appservice-irc/defaults/main.yml   |  2 +-
 roles/matrix-bridge-appservice-slack/defaults/main.yml |  2 +-
 .../defaults/main.yml                                  |  2 +-
 roles/matrix-bridge-sms/defaults/main.yml              |  2 +-
 roles/matrix-corporal/defaults/main.yml                |  2 +-
 roles/matrix-dimension/defaults/main.yml               |  2 +-
 roles/matrix-email2matrix/defaults/main.yml            |  2 +-
 roles/matrix-jitsi/defaults/main.yml                   |  8 ++++----
 roles/matrix-nginx-proxy/defaults/main.yml             |  4 ++--
 roles/matrix-postgres/defaults/main.yml                | 10 +++++-----
 12 files changed, 20 insertions(+), 20 deletions(-)

diff --git a/roles/matrix-bot-matrix-reminder-bot/defaults/main.yml b/roles/matrix-bot-matrix-reminder-bot/defaults/main.yml
index 8f4a2c2f..33028147 100644
--- a/roles/matrix-bot-matrix-reminder-bot/defaults/main.yml
+++ b/roles/matrix-bot-matrix-reminder-bot/defaults/main.yml
@@ -3,7 +3,7 @@
 
 matrix_bot_matrix_reminder_bot_enabled: true
 
-matrix_bot_matrix_reminder_bot_docker_image: "anoa/matrix-reminder-bot:release-v0.2.0"
+matrix_bot_matrix_reminder_bot_docker_image: "docker.io/anoa/matrix-reminder-bot:release-v0.2.0"
 matrix_bot_matrix_reminder_bot_docker_image_force_pull: "{{ matrix_bot_matrix_reminder_bot_docker_image.endswith(':latest') }}"
 
 matrix_bot_matrix_reminder_bot_base_path: "{{ matrix_base_data_path }}/matrix-reminder-bot"
diff --git a/roles/matrix-bridge-appservice-discord/defaults/main.yml b/roles/matrix-bridge-appservice-discord/defaults/main.yml
index 97ad8e89..d03ebb92 100644
--- a/roles/matrix-bridge-appservice-discord/defaults/main.yml
+++ b/roles/matrix-bridge-appservice-discord/defaults/main.yml
@@ -3,7 +3,7 @@
 
 matrix_appservice_discord_enabled: true
 
-matrix_appservice_discord_docker_image: "halfshot/matrix-appservice-discord:latest"
+matrix_appservice_discord_docker_image: "docker.io/halfshot/matrix-appservice-discord:latest"
 matrix_appservice_discord_docker_image_force_pull: "{{ matrix_appservice_discord_docker_image.endswith(':latest') }}"
 
 matrix_appservice_discord_base_path: "{{ matrix_base_data_path }}/appservice-discord"
diff --git a/roles/matrix-bridge-appservice-irc/defaults/main.yml b/roles/matrix-bridge-appservice-irc/defaults/main.yml
index 2cbb3e5f..7ff2d46a 100644
--- a/roles/matrix-bridge-appservice-irc/defaults/main.yml
+++ b/roles/matrix-bridge-appservice-irc/defaults/main.yml
@@ -3,7 +3,7 @@
 
 matrix_appservice_irc_enabled: true
 
-matrix_appservice_irc_docker_image: "matrixdotorg/matrix-appservice-irc:release-0.17.1"
+matrix_appservice_irc_docker_image: "docker.io/matrixdotorg/matrix-appservice-irc:release-0.17.1"
 matrix_appservice_irc_docker_image_force_pull: "{{ matrix_appservice_irc_docker_image.endswith(':latest') }}"
 
 matrix_appservice_irc_base_path: "{{ matrix_base_data_path }}/appservice-irc"
diff --git a/roles/matrix-bridge-appservice-slack/defaults/main.yml b/roles/matrix-bridge-appservice-slack/defaults/main.yml
index eef7d070..f2cfd8f9 100644
--- a/roles/matrix-bridge-appservice-slack/defaults/main.yml
+++ b/roles/matrix-bridge-appservice-slack/defaults/main.yml
@@ -3,7 +3,7 @@
 
 matrix_appservice_slack_enabled: true
 
-matrix_appservice_slack_docker_image: "matrixdotorg/matrix-appservice-slack:release-1.5.0"
+matrix_appservice_slack_docker_image: "docker.io/matrixdotorg/matrix-appservice-slack:release-1.5.0"
 matrix_appservice_slack_docker_image_force_pull: "{{ matrix_appservice_slack_docker_image.endswith(':latest') }}"
 
 matrix_appservice_slack_base_path: "{{ matrix_base_data_path }}/appservice-slack"
diff --git a/roles/matrix-bridge-appservice-webhooks/defaults/main.yml b/roles/matrix-bridge-appservice-webhooks/defaults/main.yml
index 0fb5abbc..e668f918 100644
--- a/roles/matrix-bridge-appservice-webhooks/defaults/main.yml
+++ b/roles/matrix-bridge-appservice-webhooks/defaults/main.yml
@@ -3,7 +3,7 @@
 
 matrix_appservice_webhooks_enabled: true
 
-matrix_appservice_webhooks_docker_image: "turt2live/matrix-appservice-webhooks:latest"
+matrix_appservice_webhooks_docker_image: "docker.io/turt2live/matrix-appservice-webhooks:latest"
 matrix_appservice_webhooks_docker_image_force_pull: "{{ matrix_appservice_webhooks_docker_image.endswith(':latest') }}"
 
 matrix_appservice_webhooks_base_path: "{{ matrix_base_data_path }}/appservice-webhooks"
diff --git a/roles/matrix-bridge-sms/defaults/main.yml b/roles/matrix-bridge-sms/defaults/main.yml
index 0801fe5b..9f0f10f6 100644
--- a/roles/matrix-bridge-sms/defaults/main.yml
+++ b/roles/matrix-bridge-sms/defaults/main.yml
@@ -3,7 +3,7 @@
 
 matrix_sms_bridge_enabled: true
 
-matrix_sms_bridge_docker_image: "folivonet/matrix-sms-bridge:0.4.1.RELEASE"
+matrix_sms_bridge_docker_image: "docker.io/folivonet/matrix-sms-bridge:0.4.1.RELEASE"
 
 matrix_sms_bridge_base_path: "{{ matrix_base_data_path }}/matrix-sms-bridge"
 matrix_sms_bridge_config_path: "{{ matrix_base_data_path }}/matrix-sms-bridge/config"
diff --git a/roles/matrix-corporal/defaults/main.yml b/roles/matrix-corporal/defaults/main.yml
index 52681a30..def3fcc9 100644
--- a/roles/matrix-corporal/defaults/main.yml
+++ b/roles/matrix-corporal/defaults/main.yml
@@ -19,7 +19,7 @@ matrix_corporal_container_extra_arguments: []
 # List of systemd services that matrix-corporal.service depends on
 matrix_corporal_systemd_required_services_list: ['docker.service']
 
-matrix_corporal_docker_image: "devture/matrix-corporal:1.11.0"
+matrix_corporal_docker_image: "docker.io/devture/matrix-corporal:1.11.0"
 matrix_corporal_docker_image_force_pull: "{{ matrix_corporal_docker_image.endswith(':latest') }}"
 
 matrix_corporal_base_path: "{{ matrix_base_data_path }}/corporal"
diff --git a/roles/matrix-dimension/defaults/main.yml b/roles/matrix-dimension/defaults/main.yml
index 33e7212c..3b69227a 100644
--- a/roles/matrix-dimension/defaults/main.yml
+++ b/roles/matrix-dimension/defaults/main.yml
@@ -12,7 +12,7 @@ matrix_dimension_widgets_allow_self_signed_ssl_certificates: false
 
 matrix_dimension_base_path: "{{ matrix_base_data_path }}/dimension"
 
-matrix_dimension_docker_image: "turt2live/matrix-dimension:latest"
+matrix_dimension_docker_image: "docker.io/turt2live/matrix-dimension:latest"
 matrix_dimension_docker_image_force_pull: "{{ matrix_dimension_docker_image.endswith(':latest') }}"
 
 # The user and group id correspond to the node user in the `turt2live/matrix-dimension` image.
diff --git a/roles/matrix-email2matrix/defaults/main.yml b/roles/matrix-email2matrix/defaults/main.yml
index 68ff1990..7917decf 100644
--- a/roles/matrix-email2matrix/defaults/main.yml
+++ b/roles/matrix-email2matrix/defaults/main.yml
@@ -3,7 +3,7 @@ matrix_email2matrix_enabled: true
 matrix_email2matrix_base_path: "{{ matrix_base_data_path }}/email2matrix"
 matrix_email2matrix_config_dir_path: "{{ matrix_email2matrix_base_path }}/config"
 
-matrix_email2matrix_docker_image: "devture/email2matrix:1.0.1"
+matrix_email2matrix_docker_image: "docker.io/devture/email2matrix:1.0.1"
 matrix_email2matrix_docker_image_force_pull: "{{ matrix_email2matrix_docker_image.endswith(':latest') }}"
 
 # A list of extra arguments to pass to the container
diff --git a/roles/matrix-jitsi/defaults/main.yml b/roles/matrix-jitsi/defaults/main.yml
index d05d2c71..69e1ae54 100644
--- a/roles/matrix-jitsi/defaults/main.yml
+++ b/roles/matrix-jitsi/defaults/main.yml
@@ -53,7 +53,7 @@ matrix_jitsi_enable_lobby: false
 
 matrix_jitsi_container_image_tag: "stable-5142"
 
-matrix_jitsi_web_docker_image: "jitsi/web:{{ matrix_jitsi_container_image_tag }}"
+matrix_jitsi_web_docker_image: "docker.io/jitsi/web:{{ matrix_jitsi_container_image_tag }}"
 matrix_jitsi_web_docker_image_force_pull: "{{ matrix_jitsi_web_docker_image.endswith(':latest') }}"
 
 matrix_jitsi_web_base_path: "{{ matrix_base_data_path }}/jitsi/web"
@@ -114,7 +114,7 @@ matrix_jitsi_web_config_constraints_video_height_ideal: 720
 matrix_jitsi_web_config_constraints_video_height_max: 720
 matrix_jitsi_web_config_constraints_video_height_min: 240
 
-matrix_jitsi_prosody_docker_image: "jitsi/prosody:{{ matrix_jitsi_container_image_tag }}"
+matrix_jitsi_prosody_docker_image: "docker.io/jitsi/prosody:{{ matrix_jitsi_container_image_tag }}"
 matrix_jitsi_prosody_docker_image_force_pull: "{{ matrix_jitsi_prosody_docker_image.endswith(':latest') }}"
 
 matrix_jitsi_prosody_base_path: "{{ matrix_base_data_path }}/jitsi/prosody"
@@ -128,7 +128,7 @@ matrix_jitsi_prosody_container_extra_arguments: []
 matrix_jitsi_prosody_systemd_required_services_list: ['docker.service']
 
 
-matrix_jitsi_jicofo_docker_image: "jitsi/jicofo:{{ matrix_jitsi_container_image_tag }}"
+matrix_jitsi_jicofo_docker_image: "docker.io/jitsi/jicofo:{{ matrix_jitsi_container_image_tag }}"
 matrix_jitsi_jicofo_docker_image_force_pull: "{{ matrix_jitsi_jicofo_docker_image.endswith(':latest') }}"
 
 matrix_jitsi_jicofo_base_path: "{{ matrix_base_data_path }}/jitsi/jicofo"
@@ -145,7 +145,7 @@ matrix_jitsi_jicofo_auth_user: focus
 matrix_jitsi_jicofo_auth_password: ''
 
 
-matrix_jitsi_jvb_docker_image: "jitsi/jvb:{{ matrix_jitsi_container_image_tag }}"
+matrix_jitsi_jvb_docker_image: "docker.io/jitsi/jvb:{{ matrix_jitsi_container_image_tag }}"
 matrix_jitsi_jvb_docker_image_force_pull: "{{ matrix_jitsi_jvb_docker_image.endswith(':latest') }}"
 
 matrix_jitsi_jvb_base_path: "{{ matrix_base_data_path }}/jitsi/jvb"
diff --git a/roles/matrix-nginx-proxy/defaults/main.yml b/roles/matrix-nginx-proxy/defaults/main.yml
index 67b32d89..ceba9ab6 100644
--- a/roles/matrix-nginx-proxy/defaults/main.yml
+++ b/roles/matrix-nginx-proxy/defaults/main.yml
@@ -3,7 +3,7 @@ matrix_nginx_proxy_enabled: true
 # We use an official nginx image, which we fix-up to run unprivileged.
 # An alternative would be an `nginxinc/nginx-unprivileged` image, but
 # that is frequently out of date.
-matrix_nginx_proxy_docker_image: "nginx:1.19.4-alpine"
+matrix_nginx_proxy_docker_image: "docker.io/nginx:1.19.4-alpine"
 matrix_nginx_proxy_docker_image_force_pull: "{{ matrix_nginx_proxy_docker_image.endswith(':latest') }}"
 
 matrix_nginx_proxy_base_path: "{{ matrix_base_data_path }}/nginx-proxy"
@@ -259,7 +259,7 @@ matrix_ssl_domains_to_obtain_certificates_for: []
 
 # Controls whether to obtain production or staging certificates from Let's Encrypt.
 matrix_ssl_lets_encrypt_staging: false
-matrix_ssl_lets_encrypt_certbot_docker_image: "certbot/certbot:{{ matrix_ssl_architecture }}-v1.9.0"
+matrix_ssl_lets_encrypt_certbot_docker_image: "docker.io/certbot/certbot:{{ matrix_ssl_architecture }}-v1.9.0"
 matrix_ssl_lets_encrypt_certbot_docker_image_force_pull: "{{ matrix_ssl_lets_encrypt_certbot_docker_image.endswith(':latest') }}"
 matrix_ssl_lets_encrypt_certbot_standalone_http_port: 2402
 matrix_ssl_lets_encrypt_support_email: ~
diff --git a/roles/matrix-postgres/defaults/main.yml b/roles/matrix-postgres/defaults/main.yml
index f4fc180e..8717fdb6 100644
--- a/roles/matrix-postgres/defaults/main.yml
+++ b/roles/matrix-postgres/defaults/main.yml
@@ -8,11 +8,11 @@ matrix_postgres_db_name: ""
 matrix_postgres_base_path: "{{ matrix_base_data_path }}/postgres"
 matrix_postgres_data_path: "{{ matrix_postgres_base_path }}/data"
 
-matrix_postgres_docker_image_v9: "postgres:9.6.19-alpine"
-matrix_postgres_docker_image_v10: "postgres:10.14-alpine"
-matrix_postgres_docker_image_v11: "postgres:11.9-alpine"
-matrix_postgres_docker_image_v12: "postgres:12.4-alpine"
-matrix_postgres_docker_image_v13: "postgres:13.0-alpine"
+matrix_postgres_docker_image_v9: "docker.io/postgres:9.6.19-alpine"
+matrix_postgres_docker_image_v10: "docker.io/postgres:10.14-alpine"
+matrix_postgres_docker_image_v11: "docker.io/postgres:11.9-alpine"
+matrix_postgres_docker_image_v12: "docker.io/postgres:12.4-alpine"
+matrix_postgres_docker_image_v13: "docker.io/postgres:13.0-alpine"
 matrix_postgres_docker_image_latest: "{{ matrix_postgres_docker_image_v13 }}"
 
 # This variable is assigned at runtime. Overriding its value has no effect.

From 775b1ca7afdeddc91a04f37e2999696bc9cd2289 Mon Sep 17 00:00:00 2001
From: benkuly <12199167+benkuly@users.noreply.github.com>
Date: Sun, 15 Nov 2020 12:12:44 +0100
Subject: [PATCH 05/43] updated matrix-sms-bridge image version

---
 roles/matrix-bridge-sms/defaults/main.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/roles/matrix-bridge-sms/defaults/main.yml b/roles/matrix-bridge-sms/defaults/main.yml
index 9f0f10f6..ca431abf 100644
--- a/roles/matrix-bridge-sms/defaults/main.yml
+++ b/roles/matrix-bridge-sms/defaults/main.yml
@@ -3,7 +3,7 @@
 
 matrix_sms_bridge_enabled: true
 
-matrix_sms_bridge_docker_image: "docker.io/folivonet/matrix-sms-bridge:0.4.1.RELEASE"
+matrix_sms_bridge_docker_image: "docker.io/folivonet/matrix-sms-bridge:0.4.2.RELEASE"
 
 matrix_sms_bridge_base_path: "{{ matrix_base_data_path }}/matrix-sms-bridge"
 matrix_sms_bridge_config_path: "{{ matrix_base_data_path }}/matrix-sms-bridge/config"

From 787a9ef8ad2313b6623e8baf3a0dc2a6819eb448 Mon Sep 17 00:00:00 2001
From: benkuly <12199167+benkuly@users.noreply.github.com>
Date: Mon, 16 Nov 2020 11:51:11 +0100
Subject: [PATCH 06/43] updated matrix-sms-bridge image

---
 roles/matrix-bridge-sms/defaults/main.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/roles/matrix-bridge-sms/defaults/main.yml b/roles/matrix-bridge-sms/defaults/main.yml
index ca431abf..882f44d4 100644
--- a/roles/matrix-bridge-sms/defaults/main.yml
+++ b/roles/matrix-bridge-sms/defaults/main.yml
@@ -3,7 +3,7 @@
 
 matrix_sms_bridge_enabled: true
 
-matrix_sms_bridge_docker_image: "docker.io/folivonet/matrix-sms-bridge:0.4.2.RELEASE"
+matrix_sms_bridge_docker_image: "docker.io/folivonet/matrix-sms-bridge:0.4.3.RELEASE"
 
 matrix_sms_bridge_base_path: "{{ matrix_base_data_path }}/matrix-sms-bridge"
 matrix_sms_bridge_config_path: "{{ matrix_base_data_path }}/matrix-sms-bridge/config"

From 8153e25d2de5e3f33b3a49d64449fab81e108679 Mon Sep 17 00:00:00 2001
From: benkuly <12199167+benkuly@users.noreply.github.com>
Date: Mon, 16 Nov 2020 13:59:03 +0100
Subject: [PATCH 07/43] updated matrix-sms-bridge image

---
 roles/matrix-bridge-sms/defaults/main.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/roles/matrix-bridge-sms/defaults/main.yml b/roles/matrix-bridge-sms/defaults/main.yml
index 882f44d4..7ad449bb 100644
--- a/roles/matrix-bridge-sms/defaults/main.yml
+++ b/roles/matrix-bridge-sms/defaults/main.yml
@@ -3,7 +3,7 @@
 
 matrix_sms_bridge_enabled: true
 
-matrix_sms_bridge_docker_image: "docker.io/folivonet/matrix-sms-bridge:0.4.3.RELEASE"
+matrix_sms_bridge_docker_image: "docker.io/folivonet/matrix-sms-bridge:0.4.4.RELEASE"
 
 matrix_sms_bridge_base_path: "{{ matrix_base_data_path }}/matrix-sms-bridge"
 matrix_sms_bridge_config_path: "{{ matrix_base_data_path }}/matrix-sms-bridge/config"

From f7d7190bd0909f29005fab87ae636c284d14cdda Mon Sep 17 00:00:00 2001
From: transcaffeine <transcaffeine@finallycoffee.eu>
Date: Tue, 17 Nov 2020 21:20:12 +0100
Subject: [PATCH 08/43] update mautrix-telegram to 0.9.0

---
 roles/matrix-bridge-mautrix-telegram/defaults/main.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/roles/matrix-bridge-mautrix-telegram/defaults/main.yml b/roles/matrix-bridge-mautrix-telegram/defaults/main.yml
index d2ab9909..b6f4ef5b 100644
--- a/roles/matrix-bridge-mautrix-telegram/defaults/main.yml
+++ b/roles/matrix-bridge-mautrix-telegram/defaults/main.yml
@@ -4,7 +4,7 @@
 matrix_mautrix_telegram_enabled: true
 
 # See: https://mau.dev/tulir/mautrix-telegram/container_registry
-matrix_mautrix_telegram_docker_image: "dock.mau.dev/tulir/mautrix-telegram:v0.8.2"
+matrix_mautrix_telegram_docker_image: "dock.mau.dev/tulir/mautrix-telegram:v0.9.0"
 matrix_mautrix_telegram_docker_image_force_pull: "{{ matrix_mautrix_telegram_docker_image.endswith(':latest') }}"
 
 matrix_mautrix_telegram_base_path: "{{ matrix_base_data_path }}/mautrix-telegram"

From 41fa00edb412f31b264998df6b6750e1e479c15b Mon Sep 17 00:00:00 2001
From: Slavi Pantaleev <slavi@devture.com>
Date: Wed, 18 Nov 2020 12:53:58 +0200
Subject: [PATCH 09/43] Revert "Update jitsi web to stable-5142"

This reverts commit 078592454ca0272563525dddcadedb578c4d5a4e
due to reports of breakage both in the support chat room
and in here https://github.com/spantaleev/matrix-docker-ansible-deploy/pull/719
---
 roles/matrix-jitsi/defaults/main.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/roles/matrix-jitsi/defaults/main.yml b/roles/matrix-jitsi/defaults/main.yml
index 69e1ae54..865424ed 100644
--- a/roles/matrix-jitsi/defaults/main.yml
+++ b/roles/matrix-jitsi/defaults/main.yml
@@ -51,7 +51,7 @@ matrix_jitsi_jibri_recorder_password: ''
 
 matrix_jitsi_enable_lobby: false
 
-matrix_jitsi_container_image_tag: "stable-5142"
+matrix_jitsi_container_image_tag: "stable-4857"
 
 matrix_jitsi_web_docker_image: "docker.io/jitsi/web:{{ matrix_jitsi_container_image_tag }}"
 matrix_jitsi_web_docker_image_force_pull: "{{ matrix_jitsi_web_docker_image.endswith(':latest') }}"

From c58a7e03c72510bcdd30662a440775bc26226e1c Mon Sep 17 00:00:00 2001
From: transcaffeine <transcaffeine@finallycoffee.eu>
Date: Wed, 18 Nov 2020 14:16:46 +0100
Subject: [PATCH 10/43] synapse: update to 1.23.0

---
 roles/matrix-synapse/defaults/main.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/roles/matrix-synapse/defaults/main.yml b/roles/matrix-synapse/defaults/main.yml
index 4cc819a6..aadb47ee 100644
--- a/roles/matrix-synapse/defaults/main.yml
+++ b/roles/matrix-synapse/defaults/main.yml
@@ -5,7 +5,7 @@ matrix_synapse_enabled: true
 
 matrix_synapse_container_image_self_build: false
 
-matrix_synapse_docker_image: "{{ matrix_synapse_docker_image_name_prefix }}matrixdotorg/synapse:v1.22.1"
+matrix_synapse_docker_image: "{{ matrix_synapse_docker_image_name_prefix }}matrixdotorg/synapse:v1.23.0"
 matrix_synapse_docker_image_name_prefix: "{{ 'localhost/' if matrix_synapse_container_image_self_build else 'docker.io/' }}"
 matrix_synapse_docker_image_force_pull: "{{ matrix_synapse_docker_image.endswith(':latest') }}"
 
@@ -59,7 +59,7 @@ matrix_synapse_systemd_required_services_list: ['docker.service']
 # List of systemd services that matrix-synapse.service wants
 matrix_synapse_systemd_wanted_services_list: []
 
-matrix_synapse_in_container_python_packages_path: "/usr/local/lib/python3.7/site-packages"
+matrix_synapse_in_container_python_packages_path: "/usr/local/lib/python3.8/site-packages"
 
 # Specifies which template files to use when configuring Synapse.
 # If you'd like to have your own different configuration, feel free to copy and paste

From b627d93cdc78fc37191a0fcf5d0eeabcd37c5a35 Mon Sep 17 00:00:00 2001
From: Slavi Pantaleev <slavi@devture.com>
Date: Wed, 18 Nov 2020 16:57:50 +0200
Subject: [PATCH 11/43] Update homeserver.yaml to keep up with Synapse v1.23.0

Related to #724 (Github Pull Request)
---
 .../templates/synapse/homeserver.yaml.j2      | 187 ++++++++++--------
 1 file changed, 109 insertions(+), 78 deletions(-)

diff --git a/roles/matrix-synapse/templates/synapse/homeserver.yaml.j2 b/roles/matrix-synapse/templates/synapse/homeserver.yaml.j2
index f58f34f8..8c68189b 100644
--- a/roles/matrix-synapse/templates/synapse/homeserver.yaml.j2
+++ b/roles/matrix-synapse/templates/synapse/homeserver.yaml.j2
@@ -1482,10 +1482,8 @@ trusted_key_servers: {{ matrix_synapse_trusted_key_servers|to_json }}
 
 ## Single sign-on integration ##
 
-# Enable SAML2 for registration and login. Uses pysaml2.
-#
-# At least one of `sp_config` or `config_path` must be set in this section to
-# enable SAML login.
+# The following settings can be used to make Synapse use a single sign-on
+# provider for authentication, instead of its internal password database.
 #
 # You will probably also want to set the following options to `false` to
 # disable the regular login/registration flows:
@@ -1494,6 +1492,11 @@ trusted_key_servers: {{ matrix_synapse_trusted_key_servers|to_json }}
 #
 # You will also want to investigate the settings under the "sso" configuration
 # section below.
+
+# Enable SAML2 for registration and login. Uses pysaml2.
+#
+# At least one of `sp_config` or `config_path` must be set in this section to
+# enable SAML login.
 #
 # Once SAML support is enabled, a metadata file will be exposed at
 # https://<server>:<port>/_matrix/saml2/metadata.xml, which you may be able to
@@ -1509,40 +1512,64 @@ saml2_config:
   # so it is not normally necessary to specify them unless you need to
   # override them.
   #
-  #sp_config:
-  #  # point this to the IdP's metadata. You can use either a local file or
-  #  # (preferably) a URL.
-  #  metadata:
-  #    #local: ["saml2/idp.xml"]
-  #    remote:
-  #      - url: https://our_idp/metadata.xml
-  #
-  #  # By default, the user has to go to our login page first. If you'd like
-  #  # to allow IdP-initiated login, set 'allow_unsolicited: true' in a
-  #  # 'service.sp' section:
-  #  #
-  #  #service:
-  #  #  sp:
-  #  #    allow_unsolicited: true
-  #
-  #  # The examples below are just used to generate our metadata xml, and you
-  #  # may well not need them, depending on your setup. Alternatively you
-  #  # may need a whole lot more detail - see the pysaml2 docs!
-  #
-  #  description: ["My awesome SP", "en"]
-  #  name: ["Test SP", "en"]
-  #
-  #  organization:
-  #    name: Example com
-  #    display_name:
-  #      - ["Example co", "en"]
-  #    url: "http://example.com"
-  #
-  #  contact_person:
-  #    - given_name: Bob
-  #      sur_name: "the Sysadmin"
-  #      email_address": ["admin@example.com"]
-  #      contact_type": technical
+  sp_config:
+    # Point this to the IdP's metadata. You must provide either a local
+    # file via the `local` attribute or (preferably) a URL via the
+    # `remote` attribute.
+    #
+    #metadata:
+    #  local: ["saml2/idp.xml"]
+    #  remote:
+    #    - url: https://our_idp/metadata.xml
+
+    # By default, the user has to go to our login page first. If you'd like
+    # to allow IdP-initiated login, set 'allow_unsolicited: true' in a
+    # 'service.sp' section:
+    #
+    #service:
+    #  sp:
+    #    allow_unsolicited: true
+
+    # The examples below are just used to generate our metadata xml, and you
+    # may well not need them, depending on your setup. Alternatively you
+    # may need a whole lot more detail - see the pysaml2 docs!
+
+    #description: ["My awesome SP", "en"]
+    #name: ["Test SP", "en"]
+
+    #ui_info:
+    #  display_name:
+    #    - lang: en
+    #      text: "Display Name is the descriptive name of your service."
+    #  description:
+    #    - lang: en
+    #      text: "Description should be a short paragraph explaining the purpose of the service."
+    #  information_url:
+    #    - lang: en
+    #      text: "https://example.com/terms-of-service"
+    #  privacy_statement_url:
+    #    - lang: en
+    #      text: "https://example.com/privacy-policy"
+    #  keywords:
+    #    - lang: en
+    #      text: ["Matrix", "Element"]
+    #  logo:
+    #    - lang: en
+    #      text: "https://example.com/logo.svg"
+    #      width: "200"
+    #      height: "80"
+
+    #organization:
+    #  name: Example com
+    #  display_name:
+    #    - ["Example co", "en"]
+    #  url: "http://example.com"
+
+    #contact_person:
+    #  - given_name: Bob
+    #    sur_name: "the Sysadmin"
+    #    email_address": ["admin@example.com"]
+    #    contact_type": technical
 
   # Instead of putting the config inline as above, you can specify a
   # separate pysaml2 configuration file:
@@ -1617,37 +1644,11 @@ saml2_config:
   #  - attribute: department
   #    value: "sales"
 
-  # Directory in which Synapse will try to find the template files below.
-  # If not set, default templates from within the Synapse package will be used.
-  #
-  # DO NOT UNCOMMENT THIS SETTING unless you want to customise the templates.
-  # If you *do* uncomment it, you will need to make sure that all the templates
-  # below are in the directory.
-  #
-  # Synapse will look for the following templates in this directory:
-  #
-  # * HTML page to display to users if something goes wrong during the
-  #   authentication process: 'saml_error.html'.
-  #
-  #   When rendering, this template is given the following variables:
-  #     * code: an HTML error code corresponding to the error that is being
-  #       returned (typically 400 or 500)
-  #
-  #     * msg: a textual message describing the error.
-  #
-  #   The variables will automatically be HTML-escaped.
-  #
-  # You can see the default templates at:
-  # https://github.com/matrix-org/synapse/tree/master/synapse/res/templates
-  #
-  #template_dir: "res/templates"
 
-
-# OpenID Connect integration. The following settings can be used to make Synapse
-# use an OpenID Connect Provider for authentication, instead of its internal
-# password database.
+# Enable OpenID Connect (OIDC) / OAuth 2.0 for registration and login.
 #
-# See https://github.com/matrix-org/synapse/blob/master/docs/openid.md.
+# See https://github.com/matrix-org/synapse/blob/master/docs/openid.md
+# for some example configurations.
 #
 oidc_config:
   # Uncomment the following to enable authorization against an OpenID Connect
@@ -1770,17 +1771,47 @@ oidc_config:
       #
       #display_name_template: "{% raw %}{{ user.given_name }} {{ user.last_name }}{% endraw %}"
 
+      # Jinja2 templates for extra attributes to send back to the client during
+      # login.
+      #
+      # Note that these are non-standard and clients will ignore them without modifications.
+      #
+      #extra_attributes:
+        #birthdate: "{% raw %}{{ user.birthdate }}{% endraw %}"
 
 
-# Enable CAS for registration and login.
+
+# Enable Central Authentication Service (CAS) for registration and login.
 #
-#cas_config:
-#   enabled: true
-#   server_url: "https://cas-server.com"
-#   service_url: "https://homeserver.domain.com:8448"
-#   #displayname_attribute: name
-#   #required_attributes:
-#   #    name: value
+cas_config:
+  # Uncomment the following to enable authorization against a CAS server.
+  # Defaults to false.
+  #
+  #enabled: true
+
+  # The URL of the CAS authorization endpoint.
+  #
+  #server_url: "https://cas-server.com"
+
+  # The public URL of the homeserver.
+  #
+  #service_url: "https://homeserver.domain.com:8448"
+
+  # The attribute of the CAS response to use as the display name.
+  #
+  # If unset, no displayname will be set.
+  #
+  #displayname_attribute: name
+
+  # It is possible to configure Synapse to only allow logins if CAS attributes
+  # match particular values. All of the keys in the mapping below must exist
+  # and the values must match the given value. Alternately if the given value
+  # is None then any value is allowed (the attribute just must exist).
+  # All of the listed attributes must match for the login to be permitted.
+  #
+  #required_attributes:
+  #  userGroup: "staff"
+  #  department: None
 
 
 # Additional settings to use with single-sign on systems such as OpenID Connect,
@@ -1880,7 +1911,7 @@ sso:
 # and issued at ("iat") claims are validated if present.
 #
 # Note that this is a non-standard login type and client support is
-# expected to be non-existant.
+# expected to be non-existent.
 #
 # See https://github.com/matrix-org/synapse/blob/master/docs/jwt.md.
 #
@@ -2411,7 +2442,7 @@ alias_creation_rules: {{ matrix_synapse_alias_creation_rules|to_json }}
 #
 # Options for the rules include:
 #
-#   user_id: Matches agaisnt the creator of the alias
+#   user_id: Matches against the creator of the alias
 #   room_id: Matches against the room ID being published
 #   alias: Matches against any current local or canonical aliases
 #            associated with the room
@@ -2459,7 +2490,7 @@ opentracing:
     # This is a list of regexes which are matched against the server_name of the
     # homeserver.
     #
-    # By defult, it is empty, so no servers are matched.
+    # By default, it is empty, so no servers are matched.
     #
     #homeserver_whitelist:
     #  - ".*"

From 6c85b84c1e146bb100d18e01d0d123d1b299490d Mon Sep 17 00:00:00 2001
From: Slavi Pantaleev <slavi@devture.com>
Date: Wed, 18 Nov 2020 18:36:03 +0200
Subject: [PATCH 12/43] Fix self-building for synapse-admin

---
 roles/matrix-synapse-admin/tasks/setup.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/roles/matrix-synapse-admin/tasks/setup.yml b/roles/matrix-synapse-admin/tasks/setup.yml
index 6d2b8c20..d30657d3 100644
--- a/roles/matrix-synapse-admin/tasks/setup.yml
+++ b/roles/matrix-synapse-admin/tasks/setup.yml
@@ -24,7 +24,7 @@
   docker_image:
     name: "{{ matrix_synapse_admin_docker_image }}"
     source: build
-    force_source: "{{ matrix_synapse_admin_git_pull_results }}"
+    force_source: "{{ matrix_synapse_admin_git_pull_results.changed }}"
     build:
       dockerfile: Dockerfile
       path: "{{ matrix_synapse_admin_docker_src_files_path }}"

From 4713e5d5f7a061ff8441810e52c2effd92524ab4 Mon Sep 17 00:00:00 2001
From: benkuly <12199167+benkuly@users.noreply.github.com>
Date: Mon, 23 Nov 2020 12:30:39 +0100
Subject: [PATCH 13/43] updated matrix-sms-bridge to 0.5.0

---
 ...uring-playbook-bridge-matrix-bridge-sms.md | 30 +++++----
 roles/matrix-bridge-sms/defaults/main.yml     | 66 ++++++-------------
 .../matrix-bridge-sms/tasks/setup_install.yml | 14 ++--
 .../tasks/validate_config.yml                 |  6 +-
 .../matrix-sms-bridge-database.service.j2     | 36 ----------
 .../systemd/matrix-sms-bridge.service.j2      |  4 --
 6 files changed, 46 insertions(+), 110 deletions(-)
 delete mode 100644 roles/matrix-bridge-sms/templates/systemd/matrix-sms-bridge-database.service.j2

diff --git a/docs/configuring-playbook-bridge-matrix-bridge-sms.md b/docs/configuring-playbook-bridge-matrix-bridge-sms.md
index 99b4f6f0..59b21d61 100644
--- a/docs/configuring-playbook-bridge-matrix-bridge-sms.md
+++ b/docs/configuring-playbook-bridge-matrix-bridge-sms.md
@@ -1,11 +1,10 @@
 # Setting up matrix-sms-bridge (optional)
 
-The playbook can install and configure
-[matrix-sms-bridge](https://github.com/benkuly/matrix-sms-bridge) for you.
+The playbook can install and configure [matrix-sms-bridge](https://github.com/benkuly/matrix-sms-bridge) for you.
 
 See the project page to learn what it does and why it might be useful to you.
 
-First you need to ensure, that the bridge has unix read and write rights to your modem. On debian based distributions there is nothing to do. On others distributions you either add a group `dialout` to your host and assign it to your modem or you give the matrix user or group access to your modem.
+** The bridge uses [android-sms-gateway-server](https://github.com/RebekkaMa/android-sms-gateway-server). You need to configure it first. **
 
 To enable the bridge just use the following
 playbook configuration:
@@ -13,16 +12,23 @@ playbook configuration:
 
 ```yaml
 matrix_sms_bridge_enabled: true
-matrix_sms_bridge_gammu_modem: "/dev/serial/by-id/myDeviceId"
-# generate a secret passwort e.g. with pwgen -s 64 1
-matrix_sms_bridge_database_password: ""
-# (optional) a room id to a default room
+
+# (optional but recommended) a room id to a default room
 matrix_sms_bridge_default_room: "" 
-# (optional) gammu reset frequencies (see https://wammu.eu/docs/manual/smsd/config.html#option-ResetFrequency)
-matrix_sms_bridge_gammu_reset_frequency: 3600
-matrix_sms_bridge_gammu_hard_reset_frequency: 0
-# (optional) group with unix read and write rights to modem
-matrix_sms_bridge_modem_group: 'dialout'
+
+# (optional but recommended) configure your server location
+matrix_sms_bridge_default_region: DE
+matrix_sms_bridge_default_timezone: Europe/Berlin
+
+# Settings to connect to android-sms-gateway-server
+matrix_sms_bridge_provider_android_baseurl: https://192.168.24.24:9090
+matrix_sms_bridge_provider_android_username: admin
+matrix_sms_bridge_provider_android_password: supeSecretPassword
+
+# (optional) ff your android-sms-gateway-server uses a self signed vertificate, the bridge needs a "truststore". This can be the certificate itself. 
+matrix_sms_bridge_provider_android_truststore_local_path: android-sms-gateway-server.p12
+matrix_sms_bridge_provider_android_truststore_password: 123
+
 ```
 
 
diff --git a/roles/matrix-bridge-sms/defaults/main.yml b/roles/matrix-bridge-sms/defaults/main.yml
index 7ad449bb..74ec2ec7 100644
--- a/roles/matrix-bridge-sms/defaults/main.yml
+++ b/roles/matrix-bridge-sms/defaults/main.yml
@@ -3,18 +3,11 @@
 
 matrix_sms_bridge_enabled: true
 
-matrix_sms_bridge_docker_image: "docker.io/folivonet/matrix-sms-bridge:0.4.4.RELEASE"
+matrix_sms_bridge_docker_image: "docker.io/folivonet/matrix-sms-bridge:0.5.0"
 
 matrix_sms_bridge_base_path: "{{ matrix_base_data_path }}/matrix-sms-bridge"
 matrix_sms_bridge_config_path: "{{ matrix_base_data_path }}/matrix-sms-bridge/config"
 matrix_sms_bridge_data_path: "{{ matrix_base_data_path }}/matrix-sms-bridge/data"
-matrix_sms_bridge_data_log_path: "{{ matrix_base_data_path }}/matrix-sms-bridge/data/log"
-matrix_sms_bridge_data_spool_path: "{{ matrix_base_data_path }}/matrix-sms-bridge/data/spool"
-matrix_sms_bridge_data_spool_inbox_path: "{{ matrix_base_data_path }}/matrix-sms-bridge/data/spool/inbox"
-matrix_sms_bridge_data_spool_inbox_processed_path: "{{ matrix_base_data_path }}/matrix-sms-bridge/data/spool/inbox_processed"
-matrix_sms_bridge_data_spool_outbox_path: "{{ matrix_base_data_path }}/matrix-sms-bridge/data/spool/outbox"
-matrix_sms_bridge_data_spool_sent_path: "{{ matrix_base_data_path }}/matrix-sms-bridge/data/spool/sent"
-matrix_sms_bridge_data_spool_error_path: "{{ matrix_base_data_path }}/matrix-sms-bridge/data/spool/error"
 
 matrix_sms_bridge_appservice_token: ''
 matrix_sms_bridge_homeserver_token: ''
@@ -40,11 +33,11 @@ matrix_sms_bridge_default_region: ''
 matrix_sms_bridge_default_timezone: ''
 matrix_sms_bridge_single_mode_enabled: false
 
-matrix_sms_bridge_gammu_modem: ''
-matrix_sms_bridge_modem_group: 'dialout'
-matrix_sms_bridge_gammu_reset_frequency: 0
-matrix_sms_bridge_gammu_hard_reset_frequency: 0
-matrix_sms_bridge_gammu_smsc: ''
+matrix_sms_bridge_provider_android_baseurl: ''
+matrix_sms_bridge_provider_android_username: ''
+matrix_sms_bridge_provider_android_password: ''
+matrix_sms_bridge_provider_android_truststore_local_path: ''
+matrix_sms_bridge_provider_android_truststore_password: ''
 
 
 matrix_sms_bridge_configuration_yaml: |
@@ -61,13 +54,22 @@ matrix_sms_bridge_configuration_yaml: |
         defaultTimeZone: "{{ matrix_sms_bridge_default_timezone }}"
         singleModeEnabled: "{{ matrix_sms_bridge_single_mode_enabled }}"
         provider:
-          gammu:
+          android:
             # (optional) default is disabled
             enabled: true
-            # (optional) Path to the Gammu-Inbox directory.
-            inboxPath: /data/spool/inbox
-            # (optional) Path to the directory, where to put processed messages.
-            inboxProcessedPath: /data/spool/inbox_processed
+            # The url to the android-sms-gateway-server
+            baseUrl: {{ matrix_sms_bridge_provider_android_baseurl }}
+            # The username of the gateway
+            username: {{ matrix_sms_bridge_provider_android_username }}
+            # The password of the gateway
+            password: {{ matrix_sms_bridge_provider_android_password }}
+            # (optional) if you use a self signed certificate, you can add the public key here
+            {% if matrix_sms_bridge_provider_android_truststore_path %}
+            trustStore:
+              path: /data/config/matrix-sms-gateway-server.p12
+              password: {{ matrix_sms_bridge_provider_android_truststore_password }}
+              type: PKCS12
+            {% endif %}
     bot:
       # The domain-part of matrix-ids. E. g. example.org when your userIds look like @unicorn:example.org
       serverName: {{ matrix_sms_bridge_homserver_domain }}
@@ -104,34 +106,6 @@ matrix_sms_bridge_configuration_extension: "{{ matrix_sms_bridge_configuration_e
 
 matrix_sms_bridge_configuration: "{{ matrix_sms_bridge_configuration_yaml|from_yaml|combine(matrix_sms_bridge_configuration_extension, recursive=True) }}"
 
-matrix_sms_bridge_gammu_configuration: |
-  [gammu]
-  Device = {{ matrix_sms_bridge_gammu_modem }}
-  LogFile = /data/log/gammu.log
-  debugLevel = 1
-
-  [smsd]
-  Service = files
-  LoopSleep = 2
-  InboxPath = /data/spool/inbox/
-  OutboxPath = /data/spool/outbox/
-  SentSMSPath = /data/spool/sent/
-  ErrorSMSPath = /data/spool/error/
-  InboxFormat = detail
-  OutboxFormat = detail
-  TransmitFormat = auto
-  {% if matrix_sms_bridge_gammu_smsc is defined and matrix_sms_bridge_gammu_smsc|length %}
-  SMSC = {{ matrix_sms_bridge_gammu_smsc }}
-  {% endif %}
-  ResetFrequency = {{ matrix_sms_bridge_gammu_reset_frequency }}
-  HardResetFrequency = {{ matrix_sms_bridge_gammu_hard_reset_frequency }}
-  debugLevel = 1
-  LogFile = /data/log/smsd.log
-  DeliveryReport = no
-  HangupCalls = 1
-  CheckBattery = 0
-
-
 matrix_sms_bridge_registration_yaml: |
   id: sms
   as_token: "{{ matrix_sms_bridge_appservice_token }}"
diff --git a/roles/matrix-bridge-sms/tasks/setup_install.yml b/roles/matrix-bridge-sms/tasks/setup_install.yml
index 1d36ea8d..1e5f6137 100644
--- a/roles/matrix-bridge-sms/tasks/setup_install.yml
+++ b/roles/matrix-bridge-sms/tasks/setup_install.yml
@@ -16,13 +16,6 @@
     - "{{ matrix_sms_bridge_base_path }}"
     - "{{ matrix_sms_bridge_config_path }}"
     - "{{ matrix_sms_bridge_data_path }}"
-    - "{{ matrix_sms_bridge_data_log_path }}"
-    - "{{ matrix_sms_bridge_data_spool_path }}"
-    - "{{ matrix_sms_bridge_data_spool_inbox_path }}"
-    - "{{ matrix_sms_bridge_data_spool_inbox_processed_path }}"
-    - "{{ matrix_sms_bridge_data_spool_outbox_path }}"
-    - "{{ matrix_sms_bridge_data_spool_sent_path }}"
-    - "{{ matrix_sms_bridge_data_spool_error_path }}"
 
 - name: Ensure matrix-sms-bridge application.yml installed
   copy:
@@ -40,13 +33,14 @@
     owner: "{{ matrix_user_username }}"
     group: "{{ matrix_user_groupname }}"
 
-- name: Ensure matrix-sms-bridge gammu-smsdrc installed
+- name: Ensure android-sms-gateway-server cert installed
   copy:
-    content: "{{ matrix_sms_bridge_gammu_configuration }}"
-    dest: "{{ matrix_sms_bridge_config_path }}/gammu-smsdrc"
+    src: "{{ matrix_sms_bridge_provider_android_truststore_path }}"
+    dest: "{{ matrix_sms_bridge_config_path }}/matrix-sms-gateway-server.p12"
     mode: 0644
     owner: "{{ matrix_user_username }}"
     group: "{{ matrix_user_groupname }}"
+  when: matrix_sms_bridge_provider_android_truststore_path != ""
 
 - name: Ensure matrix-sms-bridge.service installed
   template:
diff --git a/roles/matrix-bridge-sms/tasks/validate_config.yml b/roles/matrix-bridge-sms/tasks/validate_config.yml
index 79f62fe1..6dc6ce9c 100644
--- a/roles/matrix-bridge-sms/tasks/validate_config.yml
+++ b/roles/matrix-bridge-sms/tasks/validate_config.yml
@@ -8,6 +8,8 @@
   with_items:
     - "matrix_sms_bridge_appservice_token"
     - "matrix_sms_bridge_homeserver_token"
-    - "matrix_sms_bridge_gammu_modem"
     - "matrix_sms_bridge_default_region"
-    - "matrix_sms_bridge_default_timezone"
\ No newline at end of file
+    - "matrix_sms_bridge_default_timezone"
+    - "matrix_sms_bridge_provider_android_baseurl"
+    - "matrix_sms_bridge_provider_android_username"
+    - "matrix_sms_bridge_provider_android_password"
\ No newline at end of file
diff --git a/roles/matrix-bridge-sms/templates/systemd/matrix-sms-bridge-database.service.j2 b/roles/matrix-bridge-sms/templates/systemd/matrix-sms-bridge-database.service.j2
deleted file mode 100644
index c9bb0343..00000000
--- a/roles/matrix-bridge-sms/templates/systemd/matrix-sms-bridge-database.service.j2
+++ /dev/null
@@ -1,36 +0,0 @@
-#jinja2: lstrip_blocks: "True"
-[Unit]
-Description=Matrix sms bridge database
-{% for service in matrix_sms_bridge_database_systemd_required_services_list %}
-Requires={{ service }}
-After={{ service }}
-{% endfor %}
-{% for service in matrix_sms_bridge_database_systemd_wanted_services_list %}
-Wants={{ service }}
-{% endfor %}
-
-[Service]
-Type=simple
-ExecStartPre=-/usr/bin/docker kill matrix-sms-bridge-database
-ExecStartPre=-/usr/bin/docker rm matrix-sms-bridge-database
-
-# Intentional delay, so that the homeserver (we likely depend on) can manage to start.
-ExecStartPre=/bin/sleep 5
-
-ExecStart=/usr/bin/docker run --rm --name matrix-sms-bridge-database \
-			--log-driver=none \
-			--user={{ matrix_user_uid }}:{{ matrix_user_gid }} \
-			--cap-drop=ALL \
-			--network={{ matrix_docker_network }} \
-			-v {{ matrix_sms_bridge_database_path }}:/data:z \
-			-e NEO4J_AUTH={{ matrix_sms_bridge_database_username }}/{{ matrix_sms_bridge_database_password }} \
-			{{ matrix_sms_bridge_database_docker_image }}
-
-ExecStop=-/usr/bin/docker kill matrix-sms-bridge-database
-ExecStop=-/usr/bin/docker rm matrix-sms-bridge-database
-Restart=always
-RestartSec=30
-SyslogIdentifier=matrix-sms-bridge
-
- [Install]
-WantedBy=multi-user.target
diff --git a/roles/matrix-bridge-sms/templates/systemd/matrix-sms-bridge.service.j2 b/roles/matrix-bridge-sms/templates/systemd/matrix-sms-bridge.service.j2
index 7cab3742..15464cc4 100644
--- a/roles/matrix-bridge-sms/templates/systemd/matrix-sms-bridge.service.j2
+++ b/roles/matrix-bridge-sms/templates/systemd/matrix-sms-bridge.service.j2
@@ -20,7 +20,6 @@ ExecStartPre=/bin/sleep 5
 ExecStart=/usr/bin/docker run --rm --name matrix-sms-bridge \
 			--log-driver=none \
 			--user={{ matrix_user_uid }}:{{ matrix_user_gid }} \
-			--group-add {{ matrix_sms_bridge_modem_group }} \
 			--cap-drop=ALL \
 			--network={{ matrix_docker_network }} \
 			{% if matrix_sms_bridge_container_http_host_bind_port %}
@@ -28,9 +27,6 @@ ExecStart=/usr/bin/docker run --rm --name matrix-sms-bridge \
 			{% endif %}
 			-v {{ matrix_sms_bridge_config_path }}:/config:z \
 			-v {{ matrix_sms_bridge_data_path }}:/data:z \
-			-v {{ matrix_sms_bridge_config_path }}/gammu-smsdrc:/etc/gammu-smsdrc:z \
-			--privileged \
-			-v /dev:/dev:slave \
 			{% for arg in matrix_sms_bridge_container_extra_arguments %}
 			{{ arg }} \
 			{% endfor %}

From 2fb42dd7f1c6956087da5071839b596ce14fc91d Mon Sep 17 00:00:00 2001
From: benkuly <12199167+benkuly@users.noreply.github.com>
Date: Mon, 23 Nov 2020 12:38:17 +0100
Subject: [PATCH 14/43] fixed typo in truststore path

---
 docs/configuring-playbook-bridge-matrix-bridge-sms.md | 2 +-
 roles/matrix-bridge-sms/defaults/main.yml             | 2 +-
 roles/matrix-bridge-sms/tasks/setup_install.yml       | 4 ++--
 3 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/docs/configuring-playbook-bridge-matrix-bridge-sms.md b/docs/configuring-playbook-bridge-matrix-bridge-sms.md
index 59b21d61..3dd7398b 100644
--- a/docs/configuring-playbook-bridge-matrix-bridge-sms.md
+++ b/docs/configuring-playbook-bridge-matrix-bridge-sms.md
@@ -25,7 +25,7 @@ matrix_sms_bridge_provider_android_baseurl: https://192.168.24.24:9090
 matrix_sms_bridge_provider_android_username: admin
 matrix_sms_bridge_provider_android_password: supeSecretPassword
 
-# (optional) ff your android-sms-gateway-server uses a self signed vertificate, the bridge needs a "truststore". This can be the certificate itself. 
+# (optional) if your android-sms-gateway-server uses a self signed vertificate, the bridge needs a "truststore". This can be the certificate itself.
 matrix_sms_bridge_provider_android_truststore_local_path: android-sms-gateway-server.p12
 matrix_sms_bridge_provider_android_truststore_password: 123
 
diff --git a/roles/matrix-bridge-sms/defaults/main.yml b/roles/matrix-bridge-sms/defaults/main.yml
index 74ec2ec7..b551b43a 100644
--- a/roles/matrix-bridge-sms/defaults/main.yml
+++ b/roles/matrix-bridge-sms/defaults/main.yml
@@ -64,7 +64,7 @@ matrix_sms_bridge_configuration_yaml: |
             # The password of the gateway
             password: {{ matrix_sms_bridge_provider_android_password }}
             # (optional) if you use a self signed certificate, you can add the public key here
-            {% if matrix_sms_bridge_provider_android_truststore_path %}
+            {% if matrix_sms_bridge_provider_android_truststore_local_path %}
             trustStore:
               path: /data/config/matrix-sms-gateway-server.p12
               password: {{ matrix_sms_bridge_provider_android_truststore_password }}
diff --git a/roles/matrix-bridge-sms/tasks/setup_install.yml b/roles/matrix-bridge-sms/tasks/setup_install.yml
index 1e5f6137..61de923f 100644
--- a/roles/matrix-bridge-sms/tasks/setup_install.yml
+++ b/roles/matrix-bridge-sms/tasks/setup_install.yml
@@ -35,12 +35,12 @@
 
 - name: Ensure android-sms-gateway-server cert installed
   copy:
-    src: "{{ matrix_sms_bridge_provider_android_truststore_path }}"
+    src: "{{ matrix_sms_bridge_provider_android_truststore_local_path }}"
     dest: "{{ matrix_sms_bridge_config_path }}/matrix-sms-gateway-server.p12"
     mode: 0644
     owner: "{{ matrix_user_username }}"
     group: "{{ matrix_user_groupname }}"
-  when: matrix_sms_bridge_provider_android_truststore_path != ""
+  when: matrix_sms_bridge_provider_android_truststore_local_path != ""
 
 - name: Ensure matrix-sms-bridge.service installed
   template:

From 76b0b9dc34d4cded3e30c29397d8a59b4d727875 Mon Sep 17 00:00:00 2001
From: benkuly <12199167+benkuly@users.noreply.github.com>
Date: Mon, 23 Nov 2020 12:48:08 +0100
Subject: [PATCH 15/43] fixed application.yml loading

---
 .../templates/systemd/matrix-sms-bridge.service.j2               | 1 +
 1 file changed, 1 insertion(+)

diff --git a/roles/matrix-bridge-sms/templates/systemd/matrix-sms-bridge.service.j2 b/roles/matrix-bridge-sms/templates/systemd/matrix-sms-bridge.service.j2
index 15464cc4..2c7e0105 100644
--- a/roles/matrix-bridge-sms/templates/systemd/matrix-sms-bridge.service.j2
+++ b/roles/matrix-bridge-sms/templates/systemd/matrix-sms-bridge.service.j2
@@ -27,6 +27,7 @@ ExecStart=/usr/bin/docker run --rm --name matrix-sms-bridge \
 			{% endif %}
 			-v {{ matrix_sms_bridge_config_path }}:/config:z \
 			-v {{ matrix_sms_bridge_data_path }}:/data:z \
+			--env SPRING_CONFIG_ADDITIONAL_LOCATION=/config/application.yml
 			{% for arg in matrix_sms_bridge_container_extra_arguments %}
 			{{ arg }} \
 			{% endfor %}

From ad1f0a01ce5ed11482046168ee7e6f1852bdc97a Mon Sep 17 00:00:00 2001
From: benkuly <12199167+benkuly@users.noreply.github.com>
Date: Mon, 23 Nov 2020 12:49:28 +0100
Subject: [PATCH 16/43] fixed systemd service typo

---
 .../templates/systemd/matrix-sms-bridge.service.j2              | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/roles/matrix-bridge-sms/templates/systemd/matrix-sms-bridge.service.j2 b/roles/matrix-bridge-sms/templates/systemd/matrix-sms-bridge.service.j2
index 2c7e0105..7c96f9f4 100644
--- a/roles/matrix-bridge-sms/templates/systemd/matrix-sms-bridge.service.j2
+++ b/roles/matrix-bridge-sms/templates/systemd/matrix-sms-bridge.service.j2
@@ -27,7 +27,7 @@ ExecStart=/usr/bin/docker run --rm --name matrix-sms-bridge \
 			{% endif %}
 			-v {{ matrix_sms_bridge_config_path }}:/config:z \
 			-v {{ matrix_sms_bridge_data_path }}:/data:z \
-			--env SPRING_CONFIG_ADDITIONAL_LOCATION=/config/application.yml
+			--env SPRING_CONFIG_ADDITIONAL_LOCATION=/config/application.yml \
 			{% for arg in matrix_sms_bridge_container_extra_arguments %}
 			{{ arg }} \
 			{% endfor %}

From f1ceb49ae20b010dc271a15fe644e3d3ee5c02ee Mon Sep 17 00:00:00 2001
From: benkuly <12199167+benkuly@users.noreply.github.com>
Date: Mon, 23 Nov 2020 12:52:16 +0100
Subject: [PATCH 17/43] fixed wrong path of truststore

---
 roles/matrix-bridge-sms/defaults/main.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/roles/matrix-bridge-sms/defaults/main.yml b/roles/matrix-bridge-sms/defaults/main.yml
index b551b43a..9df04de7 100644
--- a/roles/matrix-bridge-sms/defaults/main.yml
+++ b/roles/matrix-bridge-sms/defaults/main.yml
@@ -66,7 +66,7 @@ matrix_sms_bridge_configuration_yaml: |
             # (optional) if you use a self signed certificate, you can add the public key here
             {% if matrix_sms_bridge_provider_android_truststore_local_path %}
             trustStore:
-              path: /data/config/matrix-sms-gateway-server.p12
+              path: /config/matrix-sms-gateway-server.p12
               password: {{ matrix_sms_bridge_provider_android_truststore_password }}
               type: PKCS12
             {% endif %}

From 3a2e058f2e26c76c45fb287c2b80aa9d2dbb8185 Mon Sep 17 00:00:00 2001
From: benkuly <12199167+benkuly@users.noreply.github.com>
Date: Mon, 23 Nov 2020 13:07:08 +0100
Subject: [PATCH 18/43] updated version of matrix-sms-bridge

---
 roles/matrix-bridge-sms/defaults/main.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/roles/matrix-bridge-sms/defaults/main.yml b/roles/matrix-bridge-sms/defaults/main.yml
index 9df04de7..6477f176 100644
--- a/roles/matrix-bridge-sms/defaults/main.yml
+++ b/roles/matrix-bridge-sms/defaults/main.yml
@@ -3,7 +3,7 @@
 
 matrix_sms_bridge_enabled: true
 
-matrix_sms_bridge_docker_image: "docker.io/folivonet/matrix-sms-bridge:0.5.0"
+matrix_sms_bridge_docker_image: "docker.io/folivonet/matrix-sms-bridge:0.5.1"
 
 matrix_sms_bridge_base_path: "{{ matrix_base_data_path }}/matrix-sms-bridge"
 matrix_sms_bridge_config_path: "{{ matrix_base_data_path }}/matrix-sms-bridge/config"

From ff9a4e90c4f0cac1cb7d0471074d122123e9563b Mon Sep 17 00:00:00 2001
From: benkuly <12199167+benkuly@users.noreply.github.com>
Date: Mon, 23 Nov 2020 13:43:04 +0100
Subject: [PATCH 19/43] updated matrix-sms-bridge

---
 roles/matrix-bridge-sms/defaults/main.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/roles/matrix-bridge-sms/defaults/main.yml b/roles/matrix-bridge-sms/defaults/main.yml
index 6477f176..9f1c1d9c 100644
--- a/roles/matrix-bridge-sms/defaults/main.yml
+++ b/roles/matrix-bridge-sms/defaults/main.yml
@@ -3,7 +3,7 @@
 
 matrix_sms_bridge_enabled: true
 
-matrix_sms_bridge_docker_image: "docker.io/folivonet/matrix-sms-bridge:0.5.1"
+matrix_sms_bridge_docker_image: "docker.io/folivonet/matrix-sms-bridge:0.5.2"
 
 matrix_sms_bridge_base_path: "{{ matrix_base_data_path }}/matrix-sms-bridge"
 matrix_sms_bridge_config_path: "{{ matrix_base_data_path }}/matrix-sms-bridge/config"

From 8c8002f6396be4eea63f2895689725b528c09928 Mon Sep 17 00:00:00 2001
From: benkuly <12199167+benkuly@users.noreply.github.com>
Date: Mon, 23 Nov 2020 14:48:04 +0100
Subject: [PATCH 20/43] added changelog

---
 CHANGELOG.md | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index ae96ef36..c350d235 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,3 +1,11 @@
+# 2020-11-23
+
+## Breaking change matrix-sms-bridge
+
+Because of many problems using gammu as SMS provider, matrix-sms-bridge now uses (https://github.com/RebekkaMa/android-sms-gateway-server) by default. See (the docs)[./docs/configuring-playbook-bridge-matrix-bridge-sms.md] which new vars you need to add.
+
+If you are using this playbook to deploy matrix-sms-bridge and still really want to use gammu as SMS provider, we could possibly add support for both android-sms-gateway-server and gammu.
+
 # 2020-11-13
 
 ## Breaking change matrix-sms-bridge

From c9d2ef7981a54525c17c201b604efc764422c2c5 Mon Sep 17 00:00:00 2001
From: Aaron Raimist <aaron@raim.ist>
Date: Mon, 23 Nov 2020 23:05:54 -0600
Subject: [PATCH 21/43] Upgrade Element (1.7.13 -> 1.7.14)

---
 roles/matrix-client-element/defaults/main.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/roles/matrix-client-element/defaults/main.yml b/roles/matrix-client-element/defaults/main.yml
index f1504c5b..17a04465 100644
--- a/roles/matrix-client-element/defaults/main.yml
+++ b/roles/matrix-client-element/defaults/main.yml
@@ -2,7 +2,7 @@ matrix_client_element_enabled: true
 
 matrix_client_element_container_image_self_build: false
 
-matrix_client_element_docker_image: "{{ matrix_client_element_docker_image_name_prefix }}vectorim/element-web:v1.7.13"
+matrix_client_element_docker_image: "{{ matrix_client_element_docker_image_name_prefix }}vectorim/element-web:v1.7.14"
 matrix_client_element_docker_image_name_prefix: "{{ 'localhost/' if matrix_client_element_container_image_self_build else 'docker.io/' }}"
 matrix_client_element_docker_image_force_pull: "{{ matrix_client_element_docker_image.endswith(':latest') }}"
 

From 3e2355282bffe214a3ca5cf98ae56a160e763c8e Mon Sep 17 00:00:00 2001
From: Slavi Pantaleev <slavi@devture.com>
Date: Tue, 24 Nov 2020 09:06:16 +0200
Subject: [PATCH 22/43] Upgrade Postgres minor versions

Fixes https://github.com/spantaleev/matrix-docker-ansible-deploy/issues/727
---
 roles/matrix-postgres/defaults/main.yml | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/roles/matrix-postgres/defaults/main.yml b/roles/matrix-postgres/defaults/main.yml
index 8717fdb6..0d2f50e3 100644
--- a/roles/matrix-postgres/defaults/main.yml
+++ b/roles/matrix-postgres/defaults/main.yml
@@ -8,11 +8,11 @@ matrix_postgres_db_name: ""
 matrix_postgres_base_path: "{{ matrix_base_data_path }}/postgres"
 matrix_postgres_data_path: "{{ matrix_postgres_base_path }}/data"
 
-matrix_postgres_docker_image_v9: "docker.io/postgres:9.6.19-alpine"
-matrix_postgres_docker_image_v10: "docker.io/postgres:10.14-alpine"
-matrix_postgres_docker_image_v11: "docker.io/postgres:11.9-alpine"
-matrix_postgres_docker_image_v12: "docker.io/postgres:12.4-alpine"
-matrix_postgres_docker_image_v13: "docker.io/postgres:13.0-alpine"
+matrix_postgres_docker_image_v9: "docker.io/postgres:9.6.20-alpine"
+matrix_postgres_docker_image_v10: "docker.io/postgres:10.15-alpine"
+matrix_postgres_docker_image_v11: "docker.io/postgres:11.10-alpine"
+matrix_postgres_docker_image_v12: "docker.io/postgres:12.5-alpine"
+matrix_postgres_docker_image_v13: "docker.io/postgres:13.1-alpine"
 matrix_postgres_docker_image_latest: "{{ matrix_postgres_docker_image_v13 }}"
 
 # This variable is assigned at runtime. Overriding its value has no effect.

From 27c9014cb881fb5296af10b079fa67a39fcdc0f2 Mon Sep 17 00:00:00 2001
From: Slavi Pantaleev <slavi@devture.com>
Date: Tue, 24 Nov 2020 09:38:17 +0200
Subject: [PATCH 23/43] Improve uninstallation instructions

Also switches to using `docker system prune -a` for a less invasive
cleanup of Docker images and related resources.
---
 docs/uninstalling.md                          | 30 ++++++++++++++-----
 .../usr-local-bin/matrix-remove-all.j2        |  6 ++--
 2 files changed, 26 insertions(+), 10 deletions(-)

diff --git a/docs/uninstalling.md b/docs/uninstalling.md
index 7acb9bcc..cb55a7b5 100644
--- a/docs/uninstalling.md
+++ b/docs/uninstalling.md
@@ -1,24 +1,40 @@
 # Uninstalling
 
-**Note**: If you have some trouble with your installation configuration, you can just [re-run the playbook](installing.md) and it will try to set things up again. You don't need to uninstall and install fresh.
+**Warnings**:
 
-However, if you've installed this on some server where you have other stuff you wish to preserve, and now want get rid of Matrix, it's enough to do these:
+- If your server federates with others, make sure to **leave any federated rooms before nuking your Matrix server's data**. Otherwise, the next time you set up a Matrix server for this domain (regardless of the installation method you use), you'll encounter trouble federating.
 
-- ensure all Matrix services are stopped (`systemctl stop 'matrix*'`)
+- If you have some trouble with your installation, you can just [re-run the playbook](installing.md) and it will try to set things up again. **Uninstalling and then installing anew rarely solves anything**.
 
-- delete the Matrix-related systemd .service files (`rm -f /etc/systemd/system/matrix*`) and reload systemd (`systemctl daemon-reload`)
+
+-----------------
+
+
+## Uninstalling using a script
+
+Installing places a `/usr/local/bin/matrix-remove-all` script on the server.
+
+You can run it to to have it uninstall things for you automatically (see below). **Use with caution!**
+
+
+## Uninstalling manually
+
+If you prefer to uninstall manually, run these commands (most are meant to be executed on the Matrix server itself):
+
+- ensure all Matrix services are stopped: `ansible-playbook -i inventory/hosts setup.yml --tags=stop` (if you can't get Ansible working to run this command, you can run `systemctl stop 'matrix*'` manually on the server)
+
+- delete the Matrix-related systemd `.service` files (`rm -f /etc/systemd/system/matrix*.service`) and reload systemd (`systemctl daemon-reload`)
 
 - delete all Matrix-related cronjobs (`rm -f /etc/cron.d/matrix*`)
 
 - delete some helper scripts (`rm -f /usr/local/bin/matrix*`)
 
-- delete some cached Docker images (or just delete them all: `docker rmi $(docker images -aq)`)
+- delete some cached Docker images (`docker system prune -a`) or just delete them all (`docker rmi $(docker images -aq)`)
 
-- delete the Docker network: `docker network rm matrix`
+- delete the Docker network: `docker network rm matrix` (might have been deleted already if you ran the `docker system prune` command)
 
 - uninstall Docker itself, if necessary
 
 - delete the `/matrix` directory (`rm -rf /matrix`)
 
-The script `/usr/local/bin/matrix-remove-all` performs all these steps (**use with caution!**).
 
diff --git a/roles/matrix-base/templates/usr-local-bin/matrix-remove-all.j2 b/roles/matrix-base/templates/usr-local-bin/matrix-remove-all.j2
index 972919e3..2a2314a5 100644
--- a/roles/matrix-base/templates/usr-local-bin/matrix-remove-all.j2
+++ b/roles/matrix-base/templates/usr-local-bin/matrix-remove-all.j2
@@ -24,9 +24,9 @@ else
 	find /etc/cron.d/ -name "matrix-*" -delete
 	echo "Remove matrix scripts"
 	find {{ matrix_local_bin_path }}/ -name "matrix-*" -delete
-	echo "Remove every docker images"
-	docker rmi $(docker images -aq)
-	echo "Remove docker matrix network"
+	echo "Remove unused Docker images and resources"
+	docker system prune -af
+	echo "Remove Docker matrix network (should be gone already, but ..)"
 	docker network rm {{ matrix_docker_network }}
 	echo "Remove {{ matrix_base_data_path }} directory"
 	rm -fr "{{ matrix_base_data_path }}"

From 1fca917ad13103845eade92be3f5a25616b92988 Mon Sep 17 00:00:00 2001
From: Slavi Pantaleev <slavi@devture.com>
Date: Tue, 24 Nov 2020 10:15:12 +0200
Subject: [PATCH 24/43] Replace some -v instances with --mount

`-v` magically creates the source destination as a directory,
if it doesn't exist already. We'd like to avoid this magic
and the potential breakage that it might cause.

We'd rather fail while Docker tries to find things to `--mount`
than have it automatically create directories and fail anyway,
while having contaminated the filesystem.

There's a lot more `-v` instances remaining to be fixed later on.
This is just some start.

Things like `matrix_synapse_container_additional_volumes` and
`matrix_nginx_proxy_container_additional_volumes` were not changed to
use `--mount`, as options for each one are passed differently
(`ro` is `ro`, but `rw` doesn't exist and `slave` is `bind-propagation=slave`).
To avoid breaking people's custom volume mounts, we keep it as it is for now.

A deficiency with `--mount` is that it lacks the `z` option (SELinux
ownership changes), and some of our `-v` instances use that. I'm not
sure how supported SELinux is for us right now, but it might be,
and breaking that would not be a good idea.
---
 .../templates/systemd/matrix-client-element.service.j2 | 10 +++++-----
 .../templates/systemd/matrix-dimension.service.j2      |  2 +-
 .../templates/jicofo/matrix-jitsi-jicofo.service.j2    |  2 +-
 .../templates/jvb/matrix-jitsi-jvb.service.j2          |  2 +-
 .../templates/prosody/matrix-jitsi-prosody.service.j2  |  4 ++--
 .../templates/web/matrix-jitsi-web.service.j2          |  4 ++--
 .../templates/systemd/matrix-ma1sd.service.j2          |  4 ++--
 .../templates/systemd/matrix-nginx-proxy.service.j2    | 10 +++++-----
 .../templates/systemd/matrix-postgres.service.j2       |  4 ++--
 .../templates/systemd/matrix-registration.service.j2   |  4 ++--
 roles/matrix-synapse/tasks/synapse/setup_install.yml   |  2 +-
 .../templates/goofys/systemd/matrix-goofys.service.j2  |  6 +++---
 .../synapse/systemd/matrix-synapse.service.j2          |  4 ++--
 13 files changed, 29 insertions(+), 29 deletions(-)

diff --git a/roles/matrix-client-element/templates/systemd/matrix-client-element.service.j2 b/roles/matrix-client-element/templates/systemd/matrix-client-element.service.j2
index 49b2f198..39b7aa52 100644
--- a/roles/matrix-client-element/templates/systemd/matrix-client-element.service.j2
+++ b/roles/matrix-client-element/templates/systemd/matrix-client-element.service.j2
@@ -21,13 +21,13 @@ ExecStart={{ matrix_host_command_docker }} run --rm --name matrix-client-element
 			-p {{ matrix_client_element_container_http_host_bind_port }}:8080 \
 			{% endif %}
 			--tmpfs=/tmp:rw,noexec,nosuid,size=10m \
-			-v {{ matrix_client_element_data_path }}/nginx.conf:/etc/nginx/nginx.conf:ro \
-			-v {{ matrix_client_element_data_path }}/config.json:/app/config.json:ro \
-			-v {{ matrix_client_element_data_path }}/config.json:/app/config.{{ matrix_server_fqn_element }}.json:ro \
+			--mount type=bind,src={{ matrix_client_element_data_path }}/nginx.conf,dst=/etc/nginx/nginx.conf,ro \
+			--mount type=bind,src={{ matrix_client_element_data_path }}/config.json,dst=/app/config.json,ro \
+			--mount type=bind,src={{ matrix_client_element_data_path }}/config.json,dst=/app/config.{{ matrix_server_fqn_element }}.json,ro \
 			{% if matrix_client_element_embedded_pages_home_path is not none %}
-			-v {{ matrix_client_element_data_path }}/home.html:/app/home.html:ro \
+			--mount type=bind,src={{ matrix_client_element_data_path }}/home.html,dst=/app/home.html,ro \
 			{% endif %}
-			-v {{ matrix_client_element_data_path }}/welcome.html:/app/welcome.html:ro \
+			--mount type=bind,src={{ matrix_client_element_data_path }}/welcome.html,dst=/app/welcome.html,ro \
 			{% for arg in matrix_client_element_container_extra_arguments %}
 			{{ arg }} \
 			{% endfor %}
diff --git a/roles/matrix-dimension/templates/systemd/matrix-dimension.service.j2 b/roles/matrix-dimension/templates/systemd/matrix-dimension.service.j2
index db9d58a8..bad94f64 100644
--- a/roles/matrix-dimension/templates/systemd/matrix-dimension.service.j2
+++ b/roles/matrix-dimension/templates/systemd/matrix-dimension.service.j2
@@ -23,7 +23,7 @@ ExecStart={{ matrix_host_command_docker }} run --rm --name matrix-dimension \
 			{% if matrix_dimension_container_http_host_bind_port %}
 			-p {{ matrix_dimension_container_http_host_bind_port }}:8184 \
 			{% endif %}
-			-v {{ matrix_dimension_base_path }}:/data:rw \
+			--mount type=bind,src={{ matrix_dimension_base_path }},dst=/data \
 			{% for arg in matrix_dimension_container_extra_arguments %}
 			{{ arg }} \
 			{% endfor %}
diff --git a/roles/matrix-jitsi/templates/jicofo/matrix-jitsi-jicofo.service.j2 b/roles/matrix-jitsi/templates/jicofo/matrix-jitsi-jicofo.service.j2
index 3512b3af..f19d08ff 100644
--- a/roles/matrix-jitsi/templates/jicofo/matrix-jitsi-jicofo.service.j2
+++ b/roles/matrix-jitsi/templates/jicofo/matrix-jitsi-jicofo.service.j2
@@ -15,7 +15,7 @@ ExecStart={{ matrix_host_command_docker }} run --rm --name matrix-jitsi-jicofo \
 			--log-driver=none \
 			--network={{ matrix_docker_network }} \
 			--env-file={{ matrix_jitsi_jicofo_base_path }}/env \
-			-v {{ matrix_jitsi_jicofo_config_path }}:/config \
+			--mount type=bind,src={{ matrix_jitsi_jicofo_config_path }},dst=/config \
 			{% for arg in matrix_jitsi_jicofo_container_extra_arguments %}
 			{{ arg }} \
 			{% endfor %}
diff --git a/roles/matrix-jitsi/templates/jvb/matrix-jitsi-jvb.service.j2 b/roles/matrix-jitsi/templates/jvb/matrix-jitsi-jvb.service.j2
index a189df9c..6db6a850 100644
--- a/roles/matrix-jitsi/templates/jvb/matrix-jitsi-jvb.service.j2
+++ b/roles/matrix-jitsi/templates/jvb/matrix-jitsi-jvb.service.j2
@@ -21,7 +21,7 @@ ExecStart={{ matrix_host_command_docker }} run --rm --name matrix-jitsi-jvb \
 			{% if matrix_jitsi_jvb_container_rtp_tcp_host_bind_port %}
 			-p {{ matrix_jitsi_jvb_container_rtp_tcp_host_bind_port }}:{{ matrix_jitsi_jvb_rtp_tcp_port }} \
 			{% endif %}
-			-v {{ matrix_jitsi_jvb_config_path }}:/config \
+			--mount type=bind,src={{ matrix_jitsi_jvb_config_path }},dst=/config \
 			{% for arg in matrix_jitsi_jvb_container_extra_arguments %}
 			{{ arg }} \
 			{% endfor %}
diff --git a/roles/matrix-jitsi/templates/prosody/matrix-jitsi-prosody.service.j2 b/roles/matrix-jitsi/templates/prosody/matrix-jitsi-prosody.service.j2
index 30801d77..74b13df3 100644
--- a/roles/matrix-jitsi/templates/prosody/matrix-jitsi-prosody.service.j2
+++ b/roles/matrix-jitsi/templates/prosody/matrix-jitsi-prosody.service.j2
@@ -15,8 +15,8 @@ ExecStart={{ matrix_host_command_docker }} run --rm --name matrix-jitsi-prosody
 			--log-driver=none \
 			--network={{ matrix_docker_network }} \
 			--env-file={{ matrix_jitsi_prosody_base_path }}/env \
-			-v {{ matrix_jitsi_prosody_config_path }}:/config \
-			-v {{ matrix_jitsi_prosody_plugins_path }}:/prosody-plugins-custom \
+			--mount type=bind,src={{ matrix_jitsi_prosody_config_path }},dst=/config \
+			--mount type=bind,src={{ matrix_jitsi_prosody_plugins_path }},dst=/prosody-plugins-custom \
 			{% for arg in matrix_jitsi_prosody_container_extra_arguments %}
 			{{ arg }} \
 			{% endfor %}
diff --git a/roles/matrix-jitsi/templates/web/matrix-jitsi-web.service.j2 b/roles/matrix-jitsi/templates/web/matrix-jitsi-web.service.j2
index 1f8a890b..e13f9633 100644
--- a/roles/matrix-jitsi/templates/web/matrix-jitsi-web.service.j2
+++ b/roles/matrix-jitsi/templates/web/matrix-jitsi-web.service.j2
@@ -18,8 +18,8 @@ ExecStart={{ matrix_host_command_docker }} run --rm --name matrix-jitsi-web \
 			{% if matrix_jitsi_web_container_http_host_bind_port %}
 			-p {{ matrix_jitsi_web_container_http_host_bind_port }}:80 \
 			{% endif %}
-			-v {{ matrix_jitsi_web_config_path }}:/config \
-			-v {{ matrix_jitsi_web_transcripts_path }}:/usr/share/jitsi-meet/transcripts \
+			--mount type=bind,src={{ matrix_jitsi_web_config_path }},dst=/config \
+			--mount type=bind,src={{ matrix_jitsi_web_transcripts_path }},dst=/usr/share/jitsi-meet/transcripts \
 			{% for arg in matrix_jitsi_web_container_extra_arguments %}
 			{{ arg }} \
 			{% endfor %}
diff --git a/roles/matrix-ma1sd/templates/systemd/matrix-ma1sd.service.j2 b/roles/matrix-ma1sd/templates/systemd/matrix-ma1sd.service.j2
index 80370088..3c49ec75 100644
--- a/roles/matrix-ma1sd/templates/systemd/matrix-ma1sd.service.j2
+++ b/roles/matrix-ma1sd/templates/systemd/matrix-ma1sd.service.j2
@@ -29,8 +29,8 @@ ExecStart={{ matrix_host_command_docker }} run --rm --name matrix-ma1sd \
 			{% if matrix_ma1sd_verbose_logging %}
 			-e MA1SD_LOG_LEVEL=debug \
 			{% endif %}
-			-v {{ matrix_ma1sd_config_path }}:/etc/ma1sd:ro \
-			-v {{ matrix_ma1sd_data_path }}:/var/ma1sd:rw \
+			--mount type=bind,src={{ matrix_ma1sd_config_path }},dst=/etc/ma1sd,ro \
+			--mount type=bind,src={{ matrix_ma1sd_data_path }},dst=/var/ma1sd \
 			{% for arg in matrix_ma1sd_container_extra_arguments %}
 			{{ arg }} \
 			{% endfor %}
diff --git a/roles/matrix-nginx-proxy/templates/systemd/matrix-nginx-proxy.service.j2 b/roles/matrix-nginx-proxy/templates/systemd/matrix-nginx-proxy.service.j2
index 7a385a64..e2182d28 100644
--- a/roles/matrix-nginx-proxy/templates/systemd/matrix-nginx-proxy.service.j2
+++ b/roles/matrix-nginx-proxy/templates/systemd/matrix-nginx-proxy.service.j2
@@ -30,11 +30,11 @@ ExecStart={{ matrix_host_command_docker }} run --rm --name matrix-nginx-proxy \
 			{% if matrix_nginx_proxy_proxy_matrix_federation_api_enabled and matrix_nginx_proxy_container_federation_host_bind_port %}
 			-p {{ matrix_nginx_proxy_container_federation_host_bind_port }}:8448 \
 			{% endif %}
-			-v {{ matrix_nginx_proxy_base_path }}/nginx.conf:/etc/nginx/nginx.conf:ro \
-			-v {{ matrix_nginx_proxy_data_path }}:/nginx-data:ro \
-			-v {{ matrix_nginx_proxy_confd_path }}:/etc/nginx/conf.d:ro \
-			-v {{ matrix_ssl_config_dir_path }}:{{ matrix_ssl_config_dir_path }}:ro \
-			-v {{ matrix_static_files_base_path }}:{{ matrix_static_files_base_path }}:ro \
+			--mount type=bind,src={{ matrix_nginx_proxy_base_path }}/nginx.conf,dst=/etc/nginx/nginx.conf,ro \
+			--mount type=bind,src={{ matrix_nginx_proxy_data_path }},dst=/nginx-data,ro \
+			--mount type=bind,src={{ matrix_nginx_proxy_confd_path }},dst=/etc/nginx/conf.d,ro \
+			--mount type=bind,src={{ matrix_ssl_config_dir_path }},dst={{ matrix_ssl_config_dir_path }},ro \
+			--mount type=bind,src={{ matrix_static_files_base_path }},dst={{ matrix_static_files_base_path }},ro \
 			{% for volume in matrix_nginx_proxy_container_additional_volumes %}
 			-v {{ volume.src }}:{{ volume.dst }}:{{ volume.options }} \
 			{% endfor %}
diff --git a/roles/matrix-postgres/templates/systemd/matrix-postgres.service.j2 b/roles/matrix-postgres/templates/systemd/matrix-postgres.service.j2
index 8e6392c1..47f19e9b 100644
--- a/roles/matrix-postgres/templates/systemd/matrix-postgres.service.j2
+++ b/roles/matrix-postgres/templates/systemd/matrix-postgres.service.j2
@@ -21,8 +21,8 @@ ExecStart={{ matrix_host_command_docker }} run --rm --name matrix-postgres \
 			-p {{ matrix_postgres_container_postgres_bind_port }}:5432 \
 			{% endif %}
 			--env-file={{ matrix_postgres_base_path }}/env-postgres-server \
-			-v {{ matrix_postgres_data_path }}:/var/lib/postgresql/data:rw \
-			-v /etc/passwd:/etc/passwd:ro \
+			--mount type=bind,src={{ matrix_postgres_data_path }},dst=/var/lib/postgresql/data \
+			--mount type=bind,src=/etc/passwd,dst=/etc/passwd,ro \
 			{% for arg in matrix_postgres_container_extra_arguments %}
 			{{ arg }} \
 			{% endfor %}
diff --git a/roles/matrix-registration/templates/systemd/matrix-registration.service.j2 b/roles/matrix-registration/templates/systemd/matrix-registration.service.j2
index 38860729..052b7d95 100644
--- a/roles/matrix-registration/templates/systemd/matrix-registration.service.j2
+++ b/roles/matrix-registration/templates/systemd/matrix-registration.service.j2
@@ -22,8 +22,8 @@ ExecStart={{ matrix_host_command_docker }} run --rm --name matrix-registration \
 			{% if matrix_registration_container_http_host_bind_port %}
 			-p {{ matrix_registration_container_http_host_bind_port }}:5000 \
 			{% endif %}
-			-v {{ matrix_registration_config_path }}:/config:ro \
-			-v {{ matrix_registration_data_path }}:/data \
+			--mount type=bind,src={{ matrix_registration_config_path }},dst=/config,ro \
+			--mount type=bind,src={{ matrix_registration_data_path }},dst=/data \
 			{% for arg in matrix_registration_container_extra_arguments %}
 			{{ arg }} \
 			{% endfor %}
diff --git a/roles/matrix-synapse/tasks/synapse/setup_install.yml b/roles/matrix-synapse/tasks/synapse/setup_install.yml
index 51f846e3..3aa2c223 100644
--- a/roles/matrix-synapse/tasks/synapse/setup_install.yml
+++ b/roles/matrix-synapse/tasks/synapse/setup_install.yml
@@ -65,7 +65,7 @@
     --name=matrix-config
     --user={{ matrix_user_uid }}:{{ matrix_user_gid }}
     --cap-drop=ALL
-    -v {{ matrix_synapse_config_dir_path }}:/data
+    --mount type=bind,src={{ matrix_synapse_config_dir_path }},dst=/data
     -e UID={{ matrix_user_uid }}
     -e GID={{ matrix_user_gid }}
     -e SYNAPSE_CONFIG_PATH=/data/homeserver.yaml
diff --git a/roles/matrix-synapse/templates/goofys/systemd/matrix-goofys.service.j2 b/roles/matrix-synapse/templates/goofys/systemd/matrix-goofys.service.j2
index d9d752c2..c3ec9249 100644
--- a/roles/matrix-synapse/templates/goofys/systemd/matrix-goofys.service.j2
+++ b/roles/matrix-synapse/templates/goofys/systemd/matrix-goofys.service.j2
@@ -12,13 +12,13 @@ ExecStartPre=-{{ matrix_host_command_docker }} rm %n
 ExecStart={{ matrix_host_command_docker }} run --rm --name %n \
 			--log-driver=none \
 			--user={{ matrix_user_uid }}:{{ matrix_user_gid }} \
-			-v /etc/passwd:/etc/passwd:ro \
-			-v /etc/group:/etc/group:ro \
+			--mount type=bind,src=/etc/passwd,dst=/etc/passwd,ro \
+			--mount type=bind,src=/etc/group,dst=/etc/group,ro \
+			--mount type=bind,src={{ matrix_synapse_media_store_path }},dst=/s3,bind-propagation=shared \
 			--security-opt apparmor:unconfined \
 			--cap-add mknod \
 			--cap-add sys_admin \
 			--device=/dev/fuse \
-			-v {{ matrix_synapse_media_store_path }}:/s3:shared \
 			--env-file={{ matrix_synapse_config_dir_path }}/env-goofys \
 			--entrypoint /bin/sh \
 			{{ matrix_s3_goofys_docker_image }} \
diff --git a/roles/matrix-synapse/templates/synapse/systemd/matrix-synapse.service.j2 b/roles/matrix-synapse/templates/synapse/systemd/matrix-synapse.service.j2
index 47786eee..791d324e 100644
--- a/roles/matrix-synapse/templates/synapse/systemd/matrix-synapse.service.j2
+++ b/roles/matrix-synapse/templates/synapse/systemd/matrix-synapse.service.j2
@@ -43,8 +43,8 @@ ExecStart={{ matrix_host_command_docker }} run --rm --name matrix-synapse \
 			{% if matrix_synapse_manhole_enabled and matrix_synapse_container_manhole_api_host_bind_port %}
 			-p {{ matrix_synapse_container_manhole_api_host_bind_port }}:9000 \
 			{% endif %}
-			-v {{ matrix_synapse_config_dir_path }}:/data:ro \
-			-v {{ matrix_synapse_storage_path }}:/matrix-media-store-parent:slave \
+			--mount type=bind,src={{ matrix_synapse_config_dir_path }},dst=/data,ro \
+			--mount type=bind,src={{ matrix_synapse_storage_path }},dst=/matrix-media-store-parent,bind-propagation=slave \
 			{% for volume in matrix_synapse_container_additional_volumes %}
 			-v {{ volume.src }}:{{ volume.dst }}:{{ volume.options }} \
 			{% endfor %}

From 75f9fde7a48c11e62d83a543432e583c8d790077 Mon Sep 17 00:00:00 2001
From: Slavi Pantaleev <slavi@devture.com>
Date: Wed, 25 Nov 2020 10:49:59 +0200
Subject: [PATCH 25/43] Remove some more -v usage

Continuation of 1fca917ad13103.

Fixes https://github.com/spantaleev/matrix-docker-ansible-deploy/issues/722
---
 .../systemd/matrix-bot-matrix-reminder-bot.service.j2     | 4 ++--
 .../tasks/setup_install.yml                               | 2 +-
 .../systemd/matrix-appservice-discord.service.j2          | 4 ++--
 .../templates/systemd/matrix-corporal.service.j2          | 6 +++---
 .../templates/systemd/matrix-coturn.service.j2            | 2 +-
 .../ssl/setup_ssl_lets_encrypt_obtain_for_domain.yml      | 8 ++++----
 .../matrix-ssl-lets-encrypt-certificates-renew.j2         | 4 ++--
 roles/matrix-postgres/tasks/import_postgres.yml           | 2 +-
 roles/matrix-postgres/tasks/import_sqlite_db.yml          | 6 +++---
 roles/matrix-postgres/tasks/upgrade_postgres.yml          | 4 ++--
 .../tasks/rust-synapse-compress-state/compress_room.yml   | 4 ++--
 11 files changed, 23 insertions(+), 23 deletions(-)

diff --git a/roles/matrix-bot-matrix-reminder-bot/templates/systemd/matrix-bot-matrix-reminder-bot.service.j2 b/roles/matrix-bot-matrix-reminder-bot/templates/systemd/matrix-bot-matrix-reminder-bot.service.j2
index 0decac02..23493c54 100644
--- a/roles/matrix-bot-matrix-reminder-bot/templates/systemd/matrix-bot-matrix-reminder-bot.service.j2
+++ b/roles/matrix-bot-matrix-reminder-bot/templates/systemd/matrix-bot-matrix-reminder-bot.service.j2
@@ -21,8 +21,8 @@ ExecStart={{ matrix_host_command_docker }} run --rm --name matrix-bot-matrix-rem
 			--read-only \
 			--network={{ matrix_docker_network }} \
 			-e 'TZ={{ matrix_bot_matrix_reminder_bot_reminders_timezone }}' \
-			-v {{ matrix_bot_matrix_reminder_bot_config_path }}:/config:ro \
-			-v {{ matrix_bot_matrix_reminder_bot_data_path }}:/data:rw \
+			--mount type=bind,src={{ matrix_bot_matrix_reminder_bot_config_path }},dst=/config,ro \
+			--mount type=bind,src={{ matrix_bot_matrix_reminder_bot_data_path }},dst=/data \
 			--entrypoint=/bin/sh \
 			{% for arg in matrix_bot_matrix_reminder_bot_container_extra_arguments %}
 			{{ arg }} \
diff --git a/roles/matrix-bridge-appservice-discord/tasks/setup_install.yml b/roles/matrix-bridge-appservice-discord/tasks/setup_install.yml
index 3678b35b..935d07eb 100644
--- a/roles/matrix-bridge-appservice-discord/tasks/setup_install.yml
+++ b/roles/matrix-bridge-appservice-discord/tasks/setup_install.yml
@@ -63,7 +63,7 @@
     {{ matrix_host_command_docker }} run --rm --name matrix-appservice-discord-link-gen
     --user={{ matrix_user_uid }}:{{ matrix_user_gid }}
     --cap-drop=ALL
-    -v {{ matrix_appservice_discord_config_path }}:/cfg
+    --mount type=bind,src={{ matrix_appservice_discord_config_path }},dst=/cfg
     -w /cfg
     {{ matrix_appservice_discord_docker_image }}
     /bin/sh -c "node /build/tools/addbot.js > /cfg/invite_link"
diff --git a/roles/matrix-bridge-appservice-discord/templates/systemd/matrix-appservice-discord.service.j2 b/roles/matrix-bridge-appservice-discord/templates/systemd/matrix-appservice-discord.service.j2
index f2187ca3..6a44a3e6 100644
--- a/roles/matrix-bridge-appservice-discord/templates/systemd/matrix-appservice-discord.service.j2
+++ b/roles/matrix-bridge-appservice-discord/templates/systemd/matrix-appservice-discord.service.j2
@@ -25,8 +25,8 @@ ExecStart={{ matrix_host_command_docker }} run --rm --name matrix-appservice-dis
 			{% if matrix_appservice_discord_container_http_host_bind_port %}
 			-p {{ matrix_appservice_discord_container_http_host_bind_port }}:9005 \
 			{% endif %}
-			-v {{ matrix_appservice_discord_config_path }}:/cfg \
-			-v {{ matrix_appservice_discord_data_path }}:/data \
+			--mount type=bind,src={{ matrix_appservice_discord_config_path }},dst=/cfg \
+			--mount type=bind,src={{ matrix_appservice_discord_data_path }},dst=/data \
 			{% for arg in matrix_appservice_discord_container_extra_arguments %}
 			{{ arg }} \
 			{% endfor %}
diff --git a/roles/matrix-corporal/templates/systemd/matrix-corporal.service.j2 b/roles/matrix-corporal/templates/systemd/matrix-corporal.service.j2
index 533ece0a..97ec7d89 100644
--- a/roles/matrix-corporal/templates/systemd/matrix-corporal.service.j2
+++ b/roles/matrix-corporal/templates/systemd/matrix-corporal.service.j2
@@ -23,9 +23,9 @@ ExecStart={{ matrix_host_command_docker }} run --rm --name matrix-corporal \
 			{% if matrix_corporal_container_http_api_host_bind_port %}
 			-p {{ matrix_corporal_container_http_api_host_bind_port }}:41081 \
 			{% endif %}
-			-v {{ matrix_corporal_config_dir_path }}:/etc/matrix-corporal:ro \
-			-v {{ matrix_corporal_cache_dir_path }}:/var/cache/matrix-corporal:rw \
-			-v {{ matrix_corporal_var_dir_path }}:/var/matrix-corporal:rw \
+			--mount type=bind,src={{ matrix_corporal_config_dir_path }},dst=/etc/matrix-corporal,ro \
+			--mount type=bind,src={{ matrix_corporal_cache_dir_path }},dst=/var/cache/matrix-corporal \
+			--mount type=bind,src={{ matrix_corporal_var_dir_path }},dst=/var/matrix-corporal \
 			{% for arg in matrix_corporal_container_extra_arguments %}
 			{{ arg }} \
 			{% endfor %}
diff --git a/roles/matrix-coturn/templates/systemd/matrix-coturn.service.j2 b/roles/matrix-coturn/templates/systemd/matrix-coturn.service.j2
index a6d19705..e484b59b 100644
--- a/roles/matrix-coturn/templates/systemd/matrix-coturn.service.j2
+++ b/roles/matrix-coturn/templates/systemd/matrix-coturn.service.j2
@@ -30,7 +30,7 @@ ExecStart={{ matrix_host_command_docker }} run --rm --name matrix-coturn \
 			{% if matrix_coturn_container_turn_range_listen_interface is not none %}
 			-p {{ matrix_coturn_container_turn_range_listen_interface }}{{ ':' if matrix_coturn_container_turn_range_listen_interface else '' }}{{ matrix_coturn_turn_udp_min_port }}-{{ matrix_coturn_turn_udp_max_port }}:{{ matrix_coturn_turn_udp_min_port }}-{{ matrix_coturn_turn_udp_max_port }}/udp \
 			{% endif %}
-			-v {{ matrix_coturn_config_path }}:/turnserver.conf:ro \
+			--mount type=bind,src={{ matrix_coturn_config_path }},dst=/turnserver.conf,ro \
 			{% for volume in matrix_coturn_container_additional_volumes %}
 			-v {{ volume.src }}:{{ volume.dst }}:{{ volume.options }} \
 			{% endfor %}
diff --git a/roles/matrix-nginx-proxy/tasks/ssl/setup_ssl_lets_encrypt_obtain_for_domain.yml b/roles/matrix-nginx-proxy/tasks/ssl/setup_ssl_lets_encrypt_obtain_for_domain.yml
index 3dea71fb..4639f122 100644
--- a/roles/matrix-nginx-proxy/tasks/ssl/setup_ssl_lets_encrypt_obtain_for_domain.yml
+++ b/roles/matrix-nginx-proxy/tasks/ssl/setup_ssl_lets_encrypt_obtain_for_domain.yml
@@ -35,8 +35,8 @@
     --user={{ matrix_user_uid }}:{{ matrix_user_gid }}
     --cap-drop=ALL
     -p {{ matrix_ssl_lets_encrypt_container_standalone_http_host_bind_port }}:8080
-    -v {{ matrix_ssl_config_dir_path }}:/etc/letsencrypt
-    -v {{ matrix_ssl_log_dir_path }}:/var/log/letsencrypt
+    --mount type=bind,src={{ matrix_ssl_config_dir_path }},dst=/etc/letsencrypt
+    --mount type=bind,src={{ matrix_ssl_log_dir_path }},dst=/var/log/letsencrypt
     {{ matrix_ssl_lets_encrypt_certbot_docker_image }}
     certonly
     --non-interactive
@@ -63,8 +63,8 @@
     --cap-drop=ALL
     -p 127.0.0.1:{{ matrix_ssl_lets_encrypt_certbot_standalone_http_port }}:8080
     --network={{ matrix_docker_network }}
-    -v {{ matrix_ssl_config_dir_path }}:/etc/letsencrypt
-    -v {{ matrix_ssl_log_dir_path }}:/var/log/letsencrypt
+    --mount type=bind,src={{ matrix_ssl_config_dir_path }},dst=/etc/letsencrypt
+    --mount type=bind,src={{ matrix_ssl_log_dir_path }},dst=/var/log/letsencrypt
     {{ matrix_ssl_lets_encrypt_certbot_docker_image }}
     certonly
     --non-interactive
diff --git a/roles/matrix-nginx-proxy/templates/usr-local-bin/matrix-ssl-lets-encrypt-certificates-renew.j2 b/roles/matrix-nginx-proxy/templates/usr-local-bin/matrix-ssl-lets-encrypt-certificates-renew.j2
index f7c930c0..39366abf 100644
--- a/roles/matrix-nginx-proxy/templates/usr-local-bin/matrix-ssl-lets-encrypt-certificates-renew.j2
+++ b/roles/matrix-nginx-proxy/templates/usr-local-bin/matrix-ssl-lets-encrypt-certificates-renew.j2
@@ -14,8 +14,8 @@ docker run \
 	--cap-drop=ALL \
 	--network="{{ matrix_docker_network }}" \
 	-p 127.0.0.1:{{ matrix_ssl_lets_encrypt_certbot_standalone_http_port }}:8080 \
-	-v {{ matrix_ssl_config_dir_path }}:/etc/letsencrypt \
-	-v {{ matrix_ssl_log_dir_path }}:/var/log/letsencrypt \
+	--mount type=bind,src={{ matrix_ssl_config_dir_path }},dst=/etc/letsencrypt \
+	--mount type=bind,src={{ matrix_ssl_log_dir_path }},dst=/var/log/letsencrypt \
 	{{ matrix_ssl_lets_encrypt_certbot_docker_image }} \
 	renew \
 		--non-interactive \
diff --git a/roles/matrix-postgres/tasks/import_postgres.yml b/roles/matrix-postgres/tasks/import_postgres.yml
index 0753c292..33d98691 100644
--- a/roles/matrix-postgres/tasks/import_postgres.yml
+++ b/roles/matrix-postgres/tasks/import_postgres.yml
@@ -69,7 +69,7 @@
       --cap-drop=ALL
       --network={{ matrix_docker_network }}
       --env-file={{ matrix_postgres_base_path }}/env-postgres-psql
-      -v {{ server_path_postgres_dump }}:/{{ server_path_postgres_dump|basename }}:ro
+      --mount type=bind,src={{ server_path_postgres_dump }},dst=/{{ server_path_postgres_dump|basename }},ro
       --entrypoint=/bin/sh
       {{ matrix_postgres_docker_image_latest }}
       -c "cat /{{ server_path_postgres_dump|basename }} |
diff --git a/roles/matrix-postgres/tasks/import_sqlite_db.yml b/roles/matrix-postgres/tasks/import_sqlite_db.yml
index c877ead4..ea15c5a8 100644
--- a/roles/matrix-postgres/tasks/import_sqlite_db.yml
+++ b/roles/matrix-postgres/tasks/import_sqlite_db.yml
@@ -79,8 +79,8 @@
     --cap-drop=ALL
     --network={{ matrix_docker_network }}
     --entrypoint=python
-    -v {{ matrix_synapse_config_dir_path }}:/data
-    -v {{ matrix_synapse_config_dir_path }}:/matrix-media-store-parent/media-store
-    -v {{ server_path_homeserver_db }}:/{{ server_path_homeserver_db|basename }}
+    --mount type=bind,src={{ matrix_synapse_config_dir_path }},dst=/data
+    --mount type=bind,src={{ matrix_synapse_config_dir_path }},dst=/matrix-media-store-parent/media-store
+    --mount type=bind,src={{ server_path_homeserver_db }},dst=/{{ server_path_homeserver_db|basename }}
     {{ matrix_synapse_docker_image }}
     /usr/local/bin/synapse_port_db --sqlite-database /{{ server_path_homeserver_db|basename }} --postgres-config /data/homeserver.yaml
diff --git a/roles/matrix-postgres/tasks/upgrade_postgres.yml b/roles/matrix-postgres/tasks/upgrade_postgres.yml
index c1a01d3f..72f327b3 100644
--- a/roles/matrix-postgres/tasks/upgrade_postgres.yml
+++ b/roles/matrix-postgres/tasks/upgrade_postgres.yml
@@ -85,7 +85,7 @@
     --network={{ matrix_docker_network }}
     --env-file={{ matrix_postgres_base_path }}/env-postgres-psql
     --entrypoint=/bin/sh
-    -v {{ postgres_dump_dir }}:/out
+    --mount type=bind,src={{ postgres_dump_dir }},dst=/out
     {{ matrix_postgres_detected_version_corresponding_docker_image }}
     -c "pg_dumpall -h matrix-postgres
     {{ '| gzip -c ' if postgres_dump_name.endswith('.gz') else '' }}
@@ -131,7 +131,7 @@
       --network={{ matrix_docker_network }}
       --env-file={{ matrix_postgres_base_path }}/env-postgres-psql
       --entrypoint=/bin/sh
-      -v {{ postgres_dump_dir }}:/in:ro
+      --mount type=bind,src={{ postgres_dump_dir }},dst=/in,ro
       {{ matrix_postgres_docker_image_latest }}
       -c "cat /in/{{ postgres_dump_name }} |
       {{ 'gunzip |' if postgres_dump_name.endswith('.gz') else '' }}
diff --git a/roles/matrix-synapse/tasks/rust-synapse-compress-state/compress_room.yml b/roles/matrix-synapse/tasks/rust-synapse-compress-state/compress_room.yml
index ad7b91b4..8570411f 100644
--- a/roles/matrix-synapse/tasks/rust-synapse-compress-state/compress_room.yml
+++ b/roles/matrix-synapse/tasks/rust-synapse-compress-state/compress_room.yml
@@ -8,7 +8,7 @@
       --user={{ matrix_user_uid }}:{{ matrix_user_gid }}
       --cap-drop=ALL
       --network={{ matrix_docker_network }}
-      -v {{ matrix_synapse_rust_synapse_compress_state_base_path }}:/work
+      --mount type=bind,src={{ matrix_synapse_rust_synapse_compress_state_base_path }},dst=/work
       {{ matrix_synapse_rust_synapse_compress_state_docker_image }}
       /synapse-compress-state -t -o /work/state-compressor.sql
       -p "host={{ matrix_synapse_database_host }} user={{ matrix_synapse_database_user }} password={{ matrix_synapse_database_password }} dbname={{ matrix_synapse_database_database }}"
@@ -30,7 +30,7 @@
       --cap-drop=ALL
       --network={{ matrix_docker_network }}
       --env-file={{ matrix_postgres_base_path }}/env-postgres-psql
-      -v {{ matrix_synapse_rust_synapse_compress_state_base_path }}:/work:ro
+      --mount type=bind,src={{ matrix_synapse_rust_synapse_compress_state_base_path }},dst=/work,ro
       --entrypoint=/bin/sh
       {{ matrix_postgres_docker_image_latest }}
       -c "cat /work/state-compressor.sql |

From 58baa0ac30ebe4759bed23433f0c1aee9cbc57db Mon Sep 17 00:00:00 2001
From: benkuly <12199167+benkuly@users.noreply.github.com>
Date: Wed, 25 Nov 2020 15:39:14 +0100
Subject: [PATCH 26/43] Update configuring-playbook-bridge-matrix-bridge-sms.md

---
 docs/configuring-playbook-bridge-matrix-bridge-sms.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/configuring-playbook-bridge-matrix-bridge-sms.md b/docs/configuring-playbook-bridge-matrix-bridge-sms.md
index 3dd7398b..86a95ab2 100644
--- a/docs/configuring-playbook-bridge-matrix-bridge-sms.md
+++ b/docs/configuring-playbook-bridge-matrix-bridge-sms.md
@@ -4,7 +4,7 @@ The playbook can install and configure [matrix-sms-bridge](https://github.com/be
 
 See the project page to learn what it does and why it might be useful to you.
 
-** The bridge uses [android-sms-gateway-server](https://github.com/RebekkaMa/android-sms-gateway-server). You need to configure it first. **
+**The bridge uses [android-sms-gateway-server](https://github.com/RebekkaMa/android-sms-gateway-server). You need to configure it first.**
 
 To enable the bridge just use the following
 playbook configuration:

From 732f57cbd915aa486522829f432b4b60f37fe49f Mon Sep 17 00:00:00 2001
From: anonym <tobias@reittinger.de>
Date: Thu, 26 Nov 2020 01:24:43 +0100
Subject: [PATCH 27/43] Note about the max length of the postgres password

---
 group_vars/matrix_servers | 1 +
 1 file changed, 1 insertion(+)

diff --git a/group_vars/matrix_servers b/group_vars/matrix_servers
index 742391c3..c3d42d74 100755
--- a/group_vars/matrix_servers
+++ b/group_vars/matrix_servers
@@ -874,6 +874,7 @@ matrix_postgres_enabled: true
 
 matrix_postgres_connection_hostname: "matrix-postgres"
 matrix_postgres_connection_username: "synapse"
+# Please note that max length of the password is 99 characters
 matrix_postgres_connection_password: "synapse-password"
 matrix_postgres_db_name: "homeserver"
 

From d4ef751052380632f491570c182fd5829d48a483 Mon Sep 17 00:00:00 2001
From: anonym <tobias@reittinger.de>
Date: Thu, 26 Nov 2020 01:30:08 +0100
Subject: [PATCH 28/43] Update matrix_servers

---
 group_vars/matrix_servers | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/group_vars/matrix_servers b/group_vars/matrix_servers
index c3d42d74..cdd01153 100755
--- a/group_vars/matrix_servers
+++ b/group_vars/matrix_servers
@@ -874,7 +874,7 @@ matrix_postgres_enabled: true
 
 matrix_postgres_connection_hostname: "matrix-postgres"
 matrix_postgres_connection_username: "synapse"
-# Please note that max length of the password is 99 characters
+# Please note that the max length of the password is 99 characters
 matrix_postgres_connection_password: "synapse-password"
 matrix_postgres_db_name: "homeserver"
 

From 796c752b6028b0883011c757312f3e239fa3dd70 Mon Sep 17 00:00:00 2001
From: Slavi Pantaleev <slavi@devture.com>
Date: Thu, 26 Nov 2020 09:51:48 +0200
Subject: [PATCH 29/43] Ensure Postgres passwords are not longer than 99
 characters

Complements https://github.com/spantaleev/matrix-docker-ansible-deploy/pull/732
---
 roles/matrix-postgres/tasks/validate_config.yml | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/roles/matrix-postgres/tasks/validate_config.yml b/roles/matrix-postgres/tasks/validate_config.yml
index 4985a4c7..6ff5adb0 100644
--- a/roles/matrix-postgres/tasks/validate_config.yml
+++ b/roles/matrix-postgres/tasks/validate_config.yml
@@ -20,3 +20,8 @@
     - "matrix_postgres_connection_username"
     - "matrix_postgres_connection_password"
     - "matrix_postgres_db_name"
+
+- name: Fail if Postgres password length exceeded
+  fail:
+    msg: "The maximum `matrix_postgres_connection_password` length is 99 characters"
+  when: "matrix_postgres_connection_hostname|length > 99"

From 12867e9f18a3321217083bfbcdfc9a79de0de9ba Mon Sep 17 00:00:00 2001
From: Slavi Pantaleev <slavi@devture.com>
Date: Thu, 26 Nov 2020 09:55:26 +0200
Subject: [PATCH 30/43] Do not try to mount /matrix/ssl when
 matrix_ssl_retrieval_method is 'none'

Since the switch from `-v` to `--mount` (in 1fca917ad1310),
we've regressed when `matrix_ssl_retrieval_method == 'none'`.

In such a case, we don't create `/matrix/ssl` directories at all
and shouldn't be trying to mount them into the `matrix-nginx-proxy`
container.

Previously, with `-v`, Docker would auto-create them, effectively hiding
our mistake. Now that `--mount` doesn't do such auto-creation magic,
the `matrix-nginx-proxy` container was failing to start.

Fixes https://github.com/spantaleev/matrix-docker-ansible-deploy/issues/734
---
 .../templates/systemd/matrix-nginx-proxy.service.j2             | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/roles/matrix-nginx-proxy/templates/systemd/matrix-nginx-proxy.service.j2 b/roles/matrix-nginx-proxy/templates/systemd/matrix-nginx-proxy.service.j2
index e2182d28..6e8d31f4 100644
--- a/roles/matrix-nginx-proxy/templates/systemd/matrix-nginx-proxy.service.j2
+++ b/roles/matrix-nginx-proxy/templates/systemd/matrix-nginx-proxy.service.j2
@@ -33,8 +33,10 @@ ExecStart={{ matrix_host_command_docker }} run --rm --name matrix-nginx-proxy \
 			--mount type=bind,src={{ matrix_nginx_proxy_base_path }}/nginx.conf,dst=/etc/nginx/nginx.conf,ro \
 			--mount type=bind,src={{ matrix_nginx_proxy_data_path }},dst=/nginx-data,ro \
 			--mount type=bind,src={{ matrix_nginx_proxy_confd_path }},dst=/etc/nginx/conf.d,ro \
+			{% if matrix_ssl_retrieval_method != 'none' %}
 			--mount type=bind,src={{ matrix_ssl_config_dir_path }},dst={{ matrix_ssl_config_dir_path }},ro \
 			--mount type=bind,src={{ matrix_static_files_base_path }},dst={{ matrix_static_files_base_path }},ro \
+			{% endif %}
 			{% for volume in matrix_nginx_proxy_container_additional_volumes %}
 			-v {{ volume.src }}:{{ volume.dst }}:{{ volume.options }} \
 			{% endfor %}

From d2353355077891e299c25b08da71faf8e69fa872 Mon Sep 17 00:00:00 2001
From: Slavi Pantaleev <slavi@devture.com>
Date: Thu, 26 Nov 2020 10:08:52 +0200
Subject: [PATCH 31/43] Do not mount /matrix/ssl into matrix-coturn when
 matrix_ssl_retrieval_method is 'none'

Related to https://github.com/spantaleev/matrix-docker-ansible-deploy/issues/734

Similar to 12867e9f18a3321217083, but for `matrix-coturn` (not
`matrix-nginx-proxy`).
---
 group_vars/matrix_servers | 16 +++++++++++-----
 1 file changed, 11 insertions(+), 5 deletions(-)

diff --git a/group_vars/matrix_servers b/group_vars/matrix_servers
index cdd01153..464cff78 100755
--- a/group_vars/matrix_servers
+++ b/group_vars/matrix_servers
@@ -578,13 +578,19 @@ matrix_coturn_container_image_self_build: "{{ matrix_architecture != 'amd64'}}"
 
 matrix_coturn_turn_external_ip_address: "{{ ansible_host }}"
 
-matrix_coturn_tls_enabled: true
+matrix_coturn_tls_enabled: "{{ matrix_ssl_retrieval_method != 'none' }}"
 matrix_coturn_tls_cert_path: "{{ matrix_ssl_config_dir_path }}/live/{{ matrix_server_fqn_matrix }}/fullchain.pem"
 matrix_coturn_tls_key_path: "{{ matrix_ssl_config_dir_path }}/live/{{ matrix_server_fqn_matrix }}/privkey.pem"
-matrix_coturn_container_additional_volumes:
- - src: "{{ matrix_ssl_config_dir_path }}"
-   dst: "{{ matrix_ssl_config_dir_path }}"
-   options: ro
+matrix_coturn_container_additional_volumes: |
+  {{
+    ([] if matrix_ssl_retrieval_method == 'none' else [
+        {
+            'src': matrix_ssl_config_dir_path,
+            'dst': matrix_ssl_config_dir_path,
+            'options': 'ro',
+        }
+    ])
+  }}
 
 ######################################################################
 #

From d702e74079f917e1c017ac1476a13aaac6b3847e Mon Sep 17 00:00:00 2001
From: Slavi Pantaleev <slavi@devture.com>
Date: Thu, 26 Nov 2020 18:40:15 +0200
Subject: [PATCH 32/43] Fix matrix-nginx-proxy static files mounting when SSL
 retrieval is none

Fixup for 12867e9f18a33212.

This shouldn't have been caught in the `if`.

Related to https://github.com/spantaleev/matrix-docker-ansible-deploy/issues/734
---
 .../templates/systemd/matrix-nginx-proxy.service.j2             | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/roles/matrix-nginx-proxy/templates/systemd/matrix-nginx-proxy.service.j2 b/roles/matrix-nginx-proxy/templates/systemd/matrix-nginx-proxy.service.j2
index 6e8d31f4..0945c25e 100644
--- a/roles/matrix-nginx-proxy/templates/systemd/matrix-nginx-proxy.service.j2
+++ b/roles/matrix-nginx-proxy/templates/systemd/matrix-nginx-proxy.service.j2
@@ -35,8 +35,8 @@ ExecStart={{ matrix_host_command_docker }} run --rm --name matrix-nginx-proxy \
 			--mount type=bind,src={{ matrix_nginx_proxy_confd_path }},dst=/etc/nginx/conf.d,ro \
 			{% if matrix_ssl_retrieval_method != 'none' %}
 			--mount type=bind,src={{ matrix_ssl_config_dir_path }},dst={{ matrix_ssl_config_dir_path }},ro \
-			--mount type=bind,src={{ matrix_static_files_base_path }},dst={{ matrix_static_files_base_path }},ro \
 			{% endif %}
+			--mount type=bind,src={{ matrix_static_files_base_path }},dst={{ matrix_static_files_base_path }},ro \
 			{% for volume in matrix_nginx_proxy_container_additional_volumes %}
 			-v {{ volume.src }}:{{ volume.dst }}:{{ volume.options }} \
 			{% endfor %}

From 84c7c190682763e2e4994becbd9554bfda87da0a Mon Sep 17 00:00:00 2001
From: Slavi Pantaleev <slavi@devture.com>
Date: Fri, 27 Nov 2020 13:30:00 +0200
Subject: [PATCH 33/43] Add jitsi.DOMAIN to sample Traefik 2.0 config

Fixes https://github.com/spantaleev/matrix-docker-ansible-deploy/issues/735
---
 docs/configuring-playbook-own-webserver.md | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/docs/configuring-playbook-own-webserver.md b/docs/configuring-playbook-own-webserver.md
index dac78376..8c671df4 100644
--- a/docs/configuring-playbook-own-webserver.md
+++ b/docs/configuring-playbook-own-webserver.md
@@ -113,7 +113,7 @@ With this, nginx would still be in use, but it would not bother with anything SS
 All services would be served locally on `127.0.0.1:81` and `127.0.0.1:8449` (as per the example configuration above).
 
 You can then set up another reverse-proxy server on ports 80/443/8448 for all of the expected domains and make traffic go to these local ports.
-The expected domains vary depending on the services you have enabled (`matrix.DOMAIN` for sure; `element.DOMAIN` and `dimension.DOMAIN` are optional).
+The expected domains vary depending on the services you have enabled (`matrix.DOMAIN` for sure; `element.DOMAIN`, `dimension.DOMAIN` and `jitsi.DOMAIN` are optional).
 
 ### Sample configuration for running behind Traefik 2.0
 
@@ -144,7 +144,7 @@ matrix_nginx_proxy_container_extra_arguments:
   - '--label "traefik.enable=true"'
 
   # The Nginx proxy container will receive traffic from these subdomains
-  - '--label "traefik.http.routers.matrix-nginx-proxy.rule=Host(`{{ matrix_server_fqn_matrix }}`,`{{ matrix_server_fqn_element }}`,`{{ matrix_server_fqn_dimension }}`)"'
+  - '--label "traefik.http.routers.matrix-nginx-proxy.rule=Host(`{{ matrix_server_fqn_matrix }}`,`{{ matrix_server_fqn_element }}`,`{{ matrix_server_fqn_dimension }},`{{ matrix_server_fqn_jitsi }}`)"'
 
   # (The 'web-secure' entrypoint must bind to port 443 in Traefik config)
   - '--label "traefik.http.routers.matrix-nginx-proxy.entrypoints=web-secure"'
@@ -172,7 +172,7 @@ matrix_synapse_container_extra_arguments:
   - '--label "traefik.http.services.matrix-synapse.loadbalancer.server.port=8048"'
 ```
 
-This method uses labels attached to the Nginx and Synapse containers to provide the Traefik Docker provider with the information it needs to proxy `matrix.DOMAIN`, `element.DOMAIN`, and `dimension.DOMAIN`. Some [static configuration](https://docs.traefik.io/v2.0/reference/static-configuration/file/) is required in Traefik; namely, having endpoints on ports 443 and 8448 and having a certificate resolver.
+This method uses labels attached to the Nginx and Synapse containers to provide the Traefik Docker provider with the information it needs to proxy `matrix.DOMAIN`, `element.DOMAIN`, `dimension.DOMAIN` and `jitsi.DOMAIN`. Some [static configuration](https://docs.traefik.io/v2.0/reference/static-configuration/file/) is required in Traefik; namely, having endpoints on ports 443 and 8448 and having a certificate resolver.
 
 Note that this configuration on its own does **not** redirect traffic on port 80 (plain HTTP) to port 443 for HTTPS, which may cause some issues, since the built-in Nginx proxy usually does this. If you are not already doing this in Traefik, it can be added to Traefik in a [file provider](https://docs.traefik.io/v2.0/providers/file/) as follows:
 
@@ -205,7 +205,7 @@ services:
     image: "traefik:v2.3"
     restart: always
     container_name: "traefik"
-    networks: 
+    networks:
       - traefik
     command:
       - "--api.insecure=true"

From f93a4f6474ede88cf9aee7c35dc25ab527c9798d Mon Sep 17 00:00:00 2001
From: benkuly <12199167+benkuly@users.noreply.github.com>
Date: Fri, 27 Nov 2020 16:01:24 +0100
Subject: [PATCH 34/43] updated matrix-sms-bridge

---
 roles/matrix-bridge-sms/defaults/main.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/roles/matrix-bridge-sms/defaults/main.yml b/roles/matrix-bridge-sms/defaults/main.yml
index 9f1c1d9c..82f9b841 100644
--- a/roles/matrix-bridge-sms/defaults/main.yml
+++ b/roles/matrix-bridge-sms/defaults/main.yml
@@ -3,7 +3,7 @@
 
 matrix_sms_bridge_enabled: true
 
-matrix_sms_bridge_docker_image: "docker.io/folivonet/matrix-sms-bridge:0.5.2"
+matrix_sms_bridge_docker_image: "docker.io/folivonet/matrix-sms-bridge:0.5.4"
 
 matrix_sms_bridge_base_path: "{{ matrix_base_data_path }}/matrix-sms-bridge"
 matrix_sms_bridge_config_path: "{{ matrix_base_data_path }}/matrix-sms-bridge/config"

From fa76128fd84727f00fc6925afe70fb6f2d0fe97e Mon Sep 17 00:00:00 2001
From: Slavi Pantaleev <slavi@devture.com>
Date: Fri, 27 Nov 2020 17:28:24 +0200
Subject: [PATCH 35/43] Update Jitsi to build 5142

This supersedes/fixes-up this Pull Request:
https://github.com/spantaleev/matrix-docker-ansible-deploy/pull/719

The Jitsi Web and JVB containers now (in build 5142) always
start by bulding their own default configuration
(`config.js` and `sip-communicator.properties`, respectively).

The fact that we were generating these files ourselves was no longer of use,
because our configuration was thrown away in favor of the one created
by the containers on startup.

With this commit, we're completely redoing things. We no longer
generate these configuration files. We try to pass the proper
environment variables, so that Jitsi services can generate the
configuration files themselves.

Besides that, we try to use the "custom configuration" mechanism
provided by Jitsi Web and Jitsi JVB (`custom-config.js` and
`custom-sip-communicator.properties`, respectively), so that
we and our users can inject additional configuration.

Some configuration options we had are gone now. Others are no longer
controllable via variables and need to be injected using
the `_config_extension` variables that we provide.

The validation logic that is part of the role should take care
to inform people about how to upgrade (if they're using some custom
configuration, which needs special care now). Most users should not
have to do anything special though.
---
 docs/configuring-playbook-jitsi.md            |  51 +-
 roles/matrix-jitsi/defaults/main.yml          | 114 +++-
 roles/matrix-jitsi/tasks/setup_jitsi_jvb.yml  |   2 +-
 roles/matrix-jitsi/tasks/setup_jitsi_web.yml  |   2 +-
 roles/matrix-jitsi/tasks/validate_config.yml  |  21 +
 .../jvb/custom-sip-communicator.properties.j2 |   7 +
 roles/matrix-jitsi/templates/jvb/env.j2       |  19 +
 .../jvb/sip-communicator.properties.j2        |  19 -
 roles/matrix-jitsi/templates/web/config.js.j2 | 491 ------------------
 .../templates/web/custom-config.js.j2         |  15 +
 roles/matrix-jitsi/templates/web/env.j2       |  12 +
 .../templates/web/interface_config.js.j2      | 377 ++++++++------
 12 files changed, 408 insertions(+), 722 deletions(-)
 create mode 100644 roles/matrix-jitsi/templates/jvb/custom-sip-communicator.properties.j2
 delete mode 100644 roles/matrix-jitsi/templates/jvb/sip-communicator.properties.j2
 delete mode 100644 roles/matrix-jitsi/templates/web/config.js.j2
 create mode 100644 roles/matrix-jitsi/templates/web/custom-config.js.j2

diff --git a/docs/configuring-playbook-jitsi.md b/docs/configuring-playbook-jitsi.md
index 72402360..62edc578 100644
--- a/docs/configuring-playbook-jitsi.md
+++ b/docs/configuring-playbook-jitsi.md
@@ -91,44 +91,33 @@ matrix_jitsi_jvb_container_extra_arguments:
 
 ## (Optional) Fine tune Jitsi
 
-You may want to suspend unused video layers until they are requested again, to save up resources on both server and clients.
+Sample **additional** `inventory/host_vars/matrix.DOMAIN/vars.yml` configuration to save up resources (explained below):
+
+```yaml
+matrix_jitsi_web_custom_config_extension: |
+  config.enableLayerSuspension = true;
+
+  config.disableAudioLevels = true;
+
+  # Limit the number of video feeds forwarded to each client
+  config.channelLastN = 4;
+
+matrix_jitsi_web_config_resolution_width_ideal_and_max: 480
+matrix_jitsi_web_config_resolution_height_ideal_and_max: 240
+```
+
+You may want to **suspend unused video layers** until they are requested again, to save up resources on both server and clients.
 Read more on this feature [here](https://jitsi.org/blog/new-off-stage-layer-suppression-feature/)
 For this add this line to your `inventory/host_vars/matrix.DOMAIN/vars.yml` configuration:
 
-```yaml
-matrix_jitsi_web_config_enableLayerSuspension: true
-```
+You may wish to **disable audio levels** to avoid excessive refresh of the client-side page and decrease the CPU consumption involved.
 
-You may wish to disable audio levels to avoid excessive refresh of the client-side page and decrease the CPU consumption involved.
-For this add this line to your `inventory/host_vars/matrix.DOMAIN/vars.yml` configuration:
-
-```yaml
-matrix_jitsi_web_config_disableAudioLevels: true
-```
-
-You may want to limit the number of video feeds forwarded to each client, to save up resources on both server and clients. As clients’ bandwidth and CPU may not bear the load, use this setting to avoid lag and crashes.
+You may want to **limit the number of video feeds forwarded to each client**, to save up resources on both server and clients. As clients’ bandwidth and CPU may not bear the load, use this setting to avoid lag and crashes.
 This feature is found by default in other webconference applications such as Office 365 Teams (limit is set to 4).
-Read how it works [here](https://github.com/jitsi/jitsi-videobridge/blob/master/doc/last-n.md) and performance evaluation on this [study](https://jitsi.org/wp-content/uploads/2016/12/nossdav2015lastn.pdf)
-For this add this line to your `inventory/host_vars/matrix.DOMAIN/vars.yml` configuration:
+Read how it works [here](https://github.com/jitsi/jitsi-videobridge/blob/master/doc/last-n.md) and performance evaluation on this [study](https://jitsi.org/wp-content/uploads/2016/12/nossdav2015lastn.pdf).
 
-```yaml
-matrix_jitsi_web_config_channelLastN: 4
-```
+You may want to **limit the maximum video resolution**, to save up resources on both server and clients.
 
-To enable the variables that allow you to manage the video configuration you must add the following line to your `inventory/host_vars/matrix.DOMAIN/vars.yml` configuration:
-
-```yaml
-matrix_jitsi_web_config_constraints_enabled: true
-```
-
-You may want to limit the maximum video resolution, to save up resources on both server and clients.
-For example, to set resolution to 480.
-For this add this two lines to your `inventory/host_vars/matrix.DOMAIN/vars.yml` configuration:
-
-```yaml
-matrix_jitsi_web_config_constraints_video_height_ideal: 480
-matrix_jitsi_web_config_constraints_video_height_max: 480
-```
 
 ## Apply changes
 
diff --git a/roles/matrix-jitsi/defaults/main.yml b/roles/matrix-jitsi/defaults/main.yml
index 865424ed..c9c8745e 100644
--- a/roles/matrix-jitsi/defaults/main.yml
+++ b/roles/matrix-jitsi/defaults/main.yml
@@ -6,6 +6,7 @@ matrix_jitsi_enable_auth: false
 matrix_jitsi_enable_guests: false
 matrix_jitsi_enable_recording: true
 matrix_jitsi_enable_transcriptions: true
+matrix_jitsi_enable_p2p: true
 
 # Authentication type, must be one of internal, jwt or ldap. Currently only
 # internal and ldap are supported by this playbook.
@@ -51,7 +52,7 @@ matrix_jitsi_jibri_recorder_password: ''
 
 matrix_jitsi_enable_lobby: false
 
-matrix_jitsi_container_image_tag: "stable-4857"
+matrix_jitsi_container_image_tag: "stable-5142"
 
 matrix_jitsi_web_docker_image: "docker.io/jitsi/web:{{ matrix_jitsi_container_image_tag }}"
 matrix_jitsi_web_docker_image_force_pull: "{{ matrix_jitsi_web_docker_image.endswith(':latest') }}"
@@ -77,42 +78,86 @@ matrix_jitsi_web_container_extra_arguments: []
 # List of systemd services that matrix-jitsi-web.service depends on
 matrix_jitsi_web_systemd_required_services_list: ['docker.service']
 
-matrix_jitsi_web_config_defaultLanguage: 'en'
-matrix_jitsi_web_config_start_with_audio_muted: false
-matrix_jitsi_web_config_start_with_video_muted: false
-matrix_jitsi_web_config_testing_enableFirefoxSimulcast: false
-matrix_jitsi_web_config_testing_p2pTestMode: false
 
+# Some variables controlling the interface of Jitsi Web.
+# These get applied to `templates/web/interface_config.js.j2`.
+#
+# Besides this, you can also use `matrix_jitsi_web_custom_interface_config_extension`
+# to define any other configuration option.
 matrix_jitsi_web_interface_config_lang_detection: false
 matrix_jitsi_web_interface_config_show_jitsi_watermark: true
 matrix_jitsi_web_interface_config_jitsi_watermark_link: "https://jitsi.org"
 matrix_jitsi_web_interface_config_show_brand_watermark: false
 matrix_jitsi_web_interface_config_brand_watermark_link: ""
-matrix_jitsi_web_interface_config_show_watermark_for_guests: true
 matrix_jitsi_web_interface_config_generate_room_names_on_welcome_page: true
 matrix_jitsi_web_interface_config_display_welcome_page_content: true
 matrix_jitsi_web_interface_config_app_name: "Jitsi Meet"
 matrix_jitsi_web_interface_config_native_app_name: "Jitsi Meet"
 matrix_jitsi_web_interface_config_provider_name: "Jitsi"
-matrix_jitsi_web_interface_config_invitation_powered_by: true
 matrix_jitsi_web_interface_config_show_powered_by: false
 matrix_jitsi_web_interface_config_disable_transcription_subtitles: false
 matrix_jisti_web_interface_config_show_deep_linking_image: false
 
-# Jitsi_web Fine Tune default values.
-# Useful to manage bandwidth and CPU consumption in server and client side
-matrix_jitsi_web_config_disableAudioLevels: false
-matrix_jitsi_web_config_enableLayerSuspension: false
-matrix_jitsi_web_config_channelLastN: -1
-# If 'matrix_jitsi_web_config_constraints_enabled: false'
-# the video constraints will be disabled and will take the default values of jitsi
-matrix_jitsi_web_config_constraints_enabled: false
-# This settings work if matrix_jitsi_web_config_constraints_enabled: true
-# See their definitions in config.js.j2 (templates / web)
-matrix_jitsi_web_config_constraints_video_aspectRatio: 16 / 9
-matrix_jitsi_web_config_constraints_video_height_ideal: 720
-matrix_jitsi_web_config_constraints_video_height_max: 720
-matrix_jitsi_web_config_constraints_video_height_min: 240
+# Custom configuration to be injected into `interface_config.js`, passed to Jitsi Web.
+# This configuration gets appended to the final interface configuration that Jitsi Web uses.
+#
+# Note: not to be confused with `matrix_jitsi_web_custom_config_extension`.
+#
+# For interface configuration, the flow is like this:
+# - the contents of `templates/web/interface_config.js.j2` is generated (based on various `matrix_jitsi_web_interface_config_*` variables you see in this file)
+# - the contents of `matrix_jitsi_web_custom_interface_config_extension` is appended and can define new settings or override defaults.
+#
+# Example:
+# matrix_jitsi_web_custom_interface_config_extension: |
+#   interfaceConfig.CONNECTION_INDICATOR_AUTO_HIDE_ENABLED = false;
+#   interfaceConfig.DISABLE_VIDEO_BACKGROUND = true;
+matrix_jitsi_web_custom_interface_config_extension: ''
+
+
+# Controls after which participant audio will be muted. If not specified, defaults to Jitsi's default value (likely 10)
+matrix_jitsi_web_config_start_audio_muted_after_nth_participant: ~
+# Controls after which participant video will be muted. If not specified, defaults to Jitsi's default value (likely 10)
+matrix_jitsi_web_config_start_video_muted_after_nth_participant: ~
+
+matrix_jitsi_web_config_defaultLanguage: 'en'
+
+# Ideal and also maximum resolution width. If not specified, defaults to Jitsi's default value (likely 1280)
+matrix_jitsi_web_config_resolution_width_ideal_and_max: ~
+# Minimum resolution width. If not specified, defaults to Jitsi's default value (likely 320)
+matrix_jitsi_web_config_resolution_width_min: ~
+# Ideal and also maximum resolution height. If not specified, defaults to Jitsi's default value (likely 720)
+matrix_jitsi_web_config_resolution_height_ideal_and_max: ~
+# Minimum resolution height. If not specified, defaults to Jitsi's default value (likely 180)
+matrix_jitsi_web_config_resolution_height_min: ~
+
+# Custom configuration to be injected into `custom-config.js`, passed to Jitsi Web.
+# This configuration gets appended to the final configuration that Jitsi Web uses.
+#
+# Note: not to be confused with `matrix_jitsi_web_custom_interface_config_extension`.
+#
+# The flow is like this:
+# - some default configuration is automatically generated based on the environment variables passed to the Jitsi Web container
+# - the contents of `custom-config.js` is appended to it (see `templates/web/custom-config.js.j2`)
+# - said `custom-config.js` contains your custom contents specified in `matrix_jitsi_web_custom_config_extension`.
+#
+# Example:
+# matrix_jitsi_web_custom_config_extension: |
+#   if (!config.hasOwnProperty('testing')) config.testing = {};
+#   config.testing.p2pTestMode = true
+matrix_jitsi_web_custom_config_extension: ''
+
+# Additional environment variables to pass to the Jitsi Web container.
+# You can use this to further influence the default configuration generated by the Jitsi Web container on every startup.
+# Besides influencing the final configuration by passing environment variables, you can also inject custom configuration
+# by using `matrix_jitsi_web_custom_config_extension`.
+#
+# Example:
+# matrix_jitsi_web_environment_variables_extension: |
+#   ENABLE_FILE_RECORDING_SERVICE=1
+#   DROPBOX_APPKEY=something
+#   DROPBOX_REDIRECT_URI=something
+matrix_jitsi_web_environment_variables_extension: ''
+
 
 matrix_jitsi_prosody_docker_image: "docker.io/jitsi/prosody:{{ matrix_jitsi_container_image_tag }}"
 matrix_jitsi_prosody_docker_image_force_pull: "{{ matrix_jitsi_prosody_docker_image.endswith(':latest') }}"
@@ -168,6 +213,31 @@ matrix_jitsi_jvb_brewery_muc: jvbbrewery
 matrix_jitsi_jvb_rtp_udp_port: 10000
 matrix_jitsi_jvb_rtp_tcp_port: 4443
 
+# Custom configuration to be injected into `custom-sip-communicator.properties`, passed to Jitsi JVB.
+# This configuration gets appended to the final configuration that Jitsi JVB uses.
+#
+# The flow is like this:
+# - some default configuration is automatically generated based on the environment variables passed to the Jitsi JVB container
+# - the contents of `custom-sip-communicator.properties` is appended to it (see `templates/jvb/custom-sip-communicator.properties.j2`)
+# - said `custom-sip-communicator.properties` contains your custom contents specified in `matrix_jitsi_jvb_custom_config_extension`.
+#
+# Example:
+# matrix_jitsi_jvb_custom_config_extension: |
+#   org.jitsi.videobridge.xmpp.user.shard.DISABLE_CERTIFICATE_VERIFICATION=false
+#   org.jitsi.videobridge.ENABLE_STATISTICS=false
+matrix_jitsi_jvb_custom_config_extension: ''
+
+# Additional environment variables to pass to the Jitsi JVB container.
+# You can use this to further influence the default configuration generated by the Jitsi JVB container on every startup.
+# Besides influencing the final configuration by passing environment variables, you can also inject custom configuration
+# by using `matrix_jitsi_jvb_custom_config_extension`.
+#
+# Example:
+# matrix_jitsi_jvb_environment_variables_extension: |
+#   SOME_VARIABLE=1
+#   ANOTHER_VARIABLE=something
+matrix_jitsi_jvb_environment_variables_extension: ''
+
 # Controls whether the matrix-jitsi-jvb container exposes its RTP UDP port (udp/10000 in the container).
 #
 # Takes an "<ip>:<port>" or "<port>" value (e.g. "127.0.0.1:10000"), or empty string to not expose.
diff --git a/roles/matrix-jitsi/tasks/setup_jitsi_jvb.yml b/roles/matrix-jitsi/tasks/setup_jitsi_jvb.yml
index 09055b59..e4c7f277 100644
--- a/roles/matrix-jitsi/tasks/setup_jitsi_jvb.yml
+++ b/roles/matrix-jitsi/tasks/setup_jitsi_jvb.yml
@@ -30,7 +30,7 @@
     dest: "{{ matrix_jitsi_jvb_config_path }}/{{ item }}"
     mode: 0644
   with_items:
-    - sip-communicator.properties
+    - custom-sip-communicator.properties
     - logging.properties
   when: matrix_jitsi_enabled|bool
 
diff --git a/roles/matrix-jitsi/tasks/setup_jitsi_web.yml b/roles/matrix-jitsi/tasks/setup_jitsi_web.yml
index 6e5d20b0..3dd6f30c 100644
--- a/roles/matrix-jitsi/tasks/setup_jitsi_web.yml
+++ b/roles/matrix-jitsi/tasks/setup_jitsi_web.yml
@@ -38,7 +38,7 @@
     dest: "{{ matrix_jitsi_web_config_path }}/{{ item }}"
     mode: 0644
   with_items:
-    - config.js
+    - custom-config.js
     - interface_config.js
   when: matrix_jitsi_enabled|bool
 
diff --git a/roles/matrix-jitsi/tasks/validate_config.yml b/roles/matrix-jitsi/tasks/validate_config.yml
index ea92c914..bd939d3a 100644
--- a/roles/matrix-jitsi/tasks/validate_config.yml
+++ b/roles/matrix-jitsi/tasks/validate_config.yml
@@ -19,3 +19,24 @@
     - "matrix_jitsi_jicofo_component_secret"
     - "matrix_jitsi_jicofo_auth_password"
     - "matrix_jitsi_jvb_auth_password"
+
+- name: (Deprecation) Catch and report renamed settings
+  fail:
+    msg: >-
+      Your configuration contains a variable, which now has a different name.
+      Please change your configuration to rename the variable (`{{ item.old }}` -> `{{ item.new }}`).
+  when: "item.old in vars"
+  with_items:
+    - {'old': 'matrix_jitsi_web_config_constraints_enabled', 'new': '<Now unnecessary. Constraints are always applied automatically>'}
+    - {'old': 'matrix_jitsi_web_config_constraints_video_aspectRatio', 'new': '<Not applicable anymore>'}
+    - {'old': 'matrix_jitsi_web_config_constraints_video_height_ideal', 'new': 'matrix_jitsi_web_config_resolution_height_ideal_and_max'}
+    - {'old': 'matrix_jitsi_web_config_constraints_video_height_max', 'new': 'matrix_jitsi_web_config_resolution_height_ideal_and_max'}
+    - {'old': 'matrix_jitsi_web_config_constraints_video_height_min', 'new': 'matrix_jitsi_web_config_resolution_height_min'}
+    - {'old': 'matrix_jitsi_web_config_disableAudioLevels', 'new': '<Can be set by using matrix_jitsi_web_custom_config_extension. Example in docs/configuring-playbook-jitsi.md>'}
+    - {'old': 'matrix_jitsi_web_config_enableLayerSuspension', 'new': '<Can be set by using matrix_jitsi_web_custom_config_extension. Example in docs/configuring-playbook-jitsi.md>'}
+    - {'old': 'matrix_jitsi_web_config_channelLastN', 'new': '<Can be set by using matrix_jitsi_web_custom_config_extension. Example in docs/configuring-playbook-jitsi.md>'}
+    - {'old': 'matrix_jitsi_web_config_testing_p2pTestMode', 'new': '<Can be set by using matrix_jitsi_web_custom_config_extension>'}
+    - {'old': 'matrix_jitsi_web_config_start_with_audio_muted', 'new': '<Superseded by matrix_jitsi_web_config_start_audio_muted_after_nth_participant>'}
+    - {'old': 'matrix_jitsi_web_config_start_with_video_muted', 'new': '<Superseded by matrix_jitsi_web_config_start_video_muted_after_nth_participant>'}
+    - {'old': 'matrix_jitsi_web_interface_config_show_watermark_for_guests', 'new': '<Not applicable anymore>'}
+    - {'old': 'matrix_jitsi_web_interface_config_invitation_powered_by', 'new': '<Not applicable anymore>'}
diff --git a/roles/matrix-jitsi/templates/jvb/custom-sip-communicator.properties.j2 b/roles/matrix-jitsi/templates/jvb/custom-sip-communicator.properties.j2
new file mode 100644
index 00000000..44b6b8c2
--- /dev/null
+++ b/roles/matrix-jitsi/templates/jvb/custom-sip-communicator.properties.j2
@@ -0,0 +1,7 @@
+org.jitsi.videobridge.xmpp.user.shard.DISABLE_CERTIFICATE_VERIFICATION=true
+
+org.jitsi.videobridge.ENABLE_STATISTICS=true
+org.jitsi.videobridge.STATISTICS_TRANSPORT=muc
+org.jitsi.videobridge.STATISTICS_INTERVAL=5000
+
+{{ matrix_jitsi_jvb_custom_config_extension }}
diff --git a/roles/matrix-jitsi/templates/jvb/env.j2 b/roles/matrix-jitsi/templates/jvb/env.j2
index 423070db..f7dc9247 100644
--- a/roles/matrix-jitsi/templates/jvb/env.j2
+++ b/roles/matrix-jitsi/templates/jvb/env.j2
@@ -1 +1,20 @@
 JVB_AUTH_PASSWORD={{ matrix_jitsi_jvb_auth_password }}
+JVB_TCP_PORT={{ matrix_jitsi_jvb_rtp_tcp_port }}
+JVB_PORT={{ matrix_jitsi_jvb_rtp_udp_port }}
+JVB_AUTH_USER={{ matrix_jitsi_jvb_auth_user }}
+JVB_AUTH_PASSWORD={{ matrix_jitsi_jvb_auth_password }}
+JVB_BREWERY_MUC={{ matrix_jitsi_jvb_brewery_muc }}
+
+XMPP_SERVER={{ matrix_jitsi_xmpp_server }}
+XMPP_AUTH_DOMAIN={{ matrix_jitsi_xmpp_auth_domain }}
+XMPP_INTERNAL_MUC_DOMAIN={{ matrix_jitsi_xmpp_internal_muc_domain }}
+
+HOSTNAME=matrix-jitsi-jvb
+
+{% if matrix_jitsi_jvb_stun_servers|length > 0 %}
+JVB_STUN_SERVERS={{ matrix_jitsi_jvb_stun_servers|join(',') }}
+{% endif %}
+
+PUBLIC_URL={{ matrix_jitsi_web_public_url }}
+
+{{ matrix_jitsi_jvb_environment_variables_extension }}
diff --git a/roles/matrix-jitsi/templates/jvb/sip-communicator.properties.j2 b/roles/matrix-jitsi/templates/jvb/sip-communicator.properties.j2
deleted file mode 100644
index 173af0b6..00000000
--- a/roles/matrix-jitsi/templates/jvb/sip-communicator.properties.j2
+++ /dev/null
@@ -1,19 +0,0 @@
-org.jitsi.videobridge.SINGLE_PORT_HARVESTER_PORT={{ matrix_jitsi_jvb_rtp_udp_port }}
-org.jitsi.videobridge.DISABLE_TCP_HARVESTER=false
-org.jitsi.videobridge.TCP_HARVESTER_PORT={{ matrix_jitsi_jvb_rtp_tcp_port }}
-
-{% if matrix_jitsi_jvb_stun_servers|length > 0 %}
-org.ice4j.ice.harvest.STUN_MAPPING_HARVESTER_ADDRESSES={{ matrix_jitsi_jvb_stun_servers|join(',') }}
-{% endif %}
-
-org.jitsi.videobridge.xmpp.user.shard.HOSTNAME={{ matrix_jitsi_xmpp_server }}
-org.jitsi.videobridge.xmpp.user.shard.DOMAIN={{ matrix_jitsi_xmpp_auth_domain }}
-org.jitsi.videobridge.xmpp.user.shard.USERNAME={{ matrix_jitsi_jvb_auth_user }}
-org.jitsi.videobridge.xmpp.user.shard.PASSWORD={{ matrix_jitsi_jvb_auth_password }}
-org.jitsi.videobridge.xmpp.user.shard.MUC_JIDS={{ matrix_jitsi_jvb_brewery_muc }}@{{ matrix_jitsi_xmpp_internal_muc_domain }}
-org.jitsi.videobridge.xmpp.user.shard.MUC_NICKNAME=matrix-jitsi-jvb
-org.jitsi.videobridge.xmpp.user.shard.DISABLE_CERTIFICATE_VERIFICATION=true
-
-org.jitsi.videobridge.ENABLE_STATISTICS=true
-org.jitsi.videobridge.STATISTICS_TRANSPORT=muc
-org.jitsi.videobridge.STATISTICS_INTERVAL=5000
diff --git a/roles/matrix-jitsi/templates/web/config.js.j2 b/roles/matrix-jitsi/templates/web/config.js.j2
deleted file mode 100644
index ad0e5410..00000000
--- a/roles/matrix-jitsi/templates/web/config.js.j2
+++ /dev/null
@@ -1,491 +0,0 @@
-/* eslint-disable no-unused-vars, no-var */
-
-var config = {
-    // Configuration
-    //
-
-    // Alternative location for the configuration.
-    // configLocation: './config.json',
-
-    // Custom function which given the URL path should return a room name.
-    // getroomnode: function (path) { return 'someprefixpossiblybasedonpath'; },
-
-
-    // Connection
-    //
-
-    hosts: {
-        // XMPP domain.
-        domain: '{{ matrix_jitsi_xmpp_domain }}',
-
-        {% if matrix_jitsi_enable_auth %}
-        {% if matrix_jitsi_enable_guests %}
-        // When using authentication, domain for guest users.
-        anonymousdomain: '{{ matrix_jitsi_xmpp_guest_domain }}',
-        {% endif %}
-
-        // Domain for authenticated users. Defaults to <domain>.
-        authdomain: '{{ matrix_jitsi_xmpp_domain }}',
-        {% endif %}
-
-        // Jirecon recording component domain.
-        // jirecon: 'jirecon.{{ matrix_jitsi_xmpp_domain }}',
-
-        // Call control component (Jigasi).
-        // call_control: 'callcontrol.{{ matrix_jitsi_xmpp_domain }}',
-
-        // Focus component domain. Defaults to focus.<domain>.
-        // focus: 'focus.{{ matrix_jitsi_xmpp_domain }}',
-
-        // XMPP MUC domain. FIXME: use XEP-0030 to discover it.
-        muc: {{ matrix_jitsi_xmpp_muc_domain|to_json }},
-    },
-
-    // BOSH URL. FIXME: use XEP-0156 to discover it.
-    bosh: '/http-bind',
-
-    // The name of client node advertised in XEP-0115 'c' stanza
-    clientNode: 'http://jitsi.org/jitsimeet',
-
-    // The real JID of focus participant - can be overridden here
-    focusUserJid: {{ matrix_jitsi_jicofo_auth_user|to_json }} + '@' + {{ matrix_jitsi_xmpp_auth_domain|to_json }},
-
-
-    // Testing / experimental features.
-    //
-
-    testing: {
-        // Enables experimental simulcast support on Firefox.
-        enableFirefoxSimulcast: {{ matrix_jitsi_web_config_testing_enableFirefoxSimulcast|to_json }},
-
-        // P2P test mode disables automatic switching to P2P when there are 2
-        // participants in the conference.
-        p2pTestMode: {{ matrix_jitsi_web_config_testing_p2pTestMode|to_json }}
-
-        // Enables the test specific features consumed by jitsi-meet-torture
-        // testMode: false
-    },
-
-    // Disables ICE/UDP by filtering out local and remote UDP candidates in
-    // signalling.
-    // webrtcIceUdpDisable: false,
-
-    // Disables ICE/TCP by filtering out local and remote TCP candidates in
-    // signalling.
-    // webrtcIceTcpDisable: false,
-
-
-    // Media
-    //
-
-    // Audio
-
-    // Disable measuring of audio levels.
-    disableAudioLevels: {{ matrix_jitsi_web_config_disableAudioLevels|to_json }},
-
-    // Start the conference in audio only mode (no video is being received nor
-    // sent).
-    // startAudioOnly: false,
-
-    // Every participant after the Nth will start audio muted.
-    // startAudioMuted: 10,
-
-    // Start calls with audio muted. Unlike the option above, this one is only
-    // applied locally. FIXME: having these 2 options is confusing.
-    // startWithAudioMuted: false,
-    startWithAudioMuted: {{ matrix_jitsi_web_config_start_with_audio_muted|to_json }},
-
-    // Enabling it (with #params) will disable local audio output of remote
-    // participants and to enable it back a reload is needed.
-    // startSilent: false
-
-    // Video
-
-    // Sets the preferred resolution (height) for local video. Defaults to 720.
-    // resolution: 720,
-
-    // w3c spec-compliant video constraints to use for video capture. Currently
-    // used by browsers that return true from lib-jitsi-meet's
-    // util#browser#usesNewGumFlow. The constraints are independency from
-    // this config's resolution value. Defaults to requesting an ideal aspect
-    // ratio of 16:9 with an ideal resolution of 720.
-    {% if matrix_jitsi_web_config_constraints_enabled %}
-    constraints: {
-        video: {
-            aspectRatio: {{ matrix_jitsi_web_config_constraints_video_aspectRatio }},
-            height: {
-                ideal: {{ matrix_jitsi_web_config_constraints_video_height_ideal|to_json }},
-                max: {{ matrix_jitsi_web_config_constraints_video_height_max|to_json }},
-                min: {{ matrix_jitsi_web_config_constraints_video_height_min|to_json }}
-            }
-        }
-    },
-    {% endif %}
-    // Enable / disable simulcast support.
-    // disableSimulcast: false,
-
-    // Enable / disable layer suspension.  If enabled, endpoints whose HD
-    // layers are not in use will be suspended (no longer sent) until they
-    // are requested again.
-    enableLayerSuspension: {{ matrix_jitsi_web_config_enableLayerSuspension|to_json }},
-
-    // Suspend sending video if bandwidth estimation is too low. This may cause
-    // problems with audio playback. Disabled until these are fixed.
-    disableSuspendVideo: true,
-
-    // Every participant after the Nth will start video muted.
-    // startVideoMuted: 10,
-
-    // Start calls with video muted. Unlike the option above, this one is only
-    // applied locally. FIXME: having these 2 options is confusing.
-    // startWithVideoMuted: false,
-    startWithVideoMuted: {{ matrix_jitsi_web_config_start_with_video_muted|to_json }},
-
-    // If set to true, prefer to use the H.264 video codec (if supported).
-    // Note that it's not recommended to do this because simulcast is not
-    // supported when  using H.264. For 1-to-1 calls this setting is enabled by
-    // default and can be toggled in the p2p section.
-    // preferH264: true,
-
-    // If set to true, disable H.264 video codec by stripping it out of the
-    // SDP.
-    // disableH264: false,
-
-    // Desktop sharing
-
-    // The ID of the jidesha extension for Chrome.
-    desktopSharingChromeExtId: null,
-
-    // Whether desktop sharing should be disabled on Chrome.
-    // desktopSharingChromeDisabled: false,
-
-    // The media sources to use when using screen sharing with the Chrome
-    // extension.
-    desktopSharingChromeSources: [ 'screen', 'window', 'tab' ],
-
-    // Required version of Chrome extension
-    desktopSharingChromeMinExtVersion: '0.1',
-
-    // Whether desktop sharing should be disabled on Firefox.
-    // desktopSharingFirefoxDisabled: false,
-
-    // Optional desktop sharing frame rate options. Default value: min:5, max:5.
-    // desktopSharingFrameRate: {
-    //     min: 5,
-    //     max: 5
-    // },
-
-    // Try to start calls with screen-sharing instead of camera video.
-    // startScreenSharing: false,
-
-    // Recording
-hiddenDomain: {{ matrix_jitsi_recorder_domain|to_json }},
-
-    // Whether to enable file recording or not.
-    fileRecordingsEnabled: {{ matrix_jitsi_enable_recording|to_json }},
-    // Enable the dropbox integration.
-    // dropbox: {
-    //     appKey: '<APP_KEY>' // Specify your app key here.
-    //     // A URL to redirect the user to, after authenticating
-    //     // by default uses:
-    //     // 'https://{{ matrix_jitsi_xmpp_domain }}/static/oauth.html'
-    //     redirectURI:
-    //          'https://{{ matrix_jitsi_xmpp_domain }}/subfolder/static/oauth.html'
-    // },
-    // When integrations like dropbox are enabled only that will be shown,
-    // by enabling fileRecordingsServiceEnabled, we show both the integrations
-    // and the generic recording service (its configuration and storage type
-    // depends on jibri configuration)
-    // fileRecordingsServiceEnabled: false,
-    // Whether to show the possibility to share file recording with other people
-    // (e.g. meeting participants), based on the actual implementation
-    // on the backend.
-    // fileRecordingsServiceSharingEnabled: false,
-
-    // Whether to enable live streaming or not.
-    liveStreamingEnabled: {{ matrix_jitsi_enable_recording|to_json }},
-
-    // Transcription (in interface_config,
-    // subtitles and buttons can be configured)
-    transcribingEnabled: {{ matrix_jitsi_enable_transcriptions|to_json }},
-
-    // Misc
-
-    // Default value for the channel "last N" attribute. -1 for unlimited.
-    channelLastN: {{ matrix_jitsi_web_config_channelLastN|to_json }},
-
-    // Disables or enables RTX (RFC 4588) (defaults to false).
-    // disableRtx: false,
-
-    // Disables or enables TCC (the default is in Jicofo and set to true)
-    // (draft-holmer-rmcat-transport-wide-cc-extensions-01). This setting
-    // affects congestion control, it practically enables send-side bandwidth
-    // estimations.
-    // enableTcc: true,
-
-    // Disables or enables REMB (the default is in Jicofo and set to false)
-    // (draft-alvestrand-rmcat-remb-03). This setting affects congestion
-    // control, it practically enables recv-side bandwidth estimations. When
-    // both TCC and REMB are enabled, TCC takes precedence. When both are
-    // disabled, then bandwidth estimations are disabled.
-    // enableRemb: false,
-
-    // Defines the minimum number of participants to start a call (the default
-    // is set in Jicofo and set to 2).
-    // minParticipants: 2,
-
-    // Use XEP-0215 to fetch STUN and TURN servers.
-    // useStunTurn: true,
-
-    // Enable IPv6 support.
-    // useIPv6: true,
-
-    // Enables / disables a data communication channel with the Videobridge.
-    // Values can be 'datachannel', 'websocket', true (treat it as
-    // 'datachannel'), undefined (treat it as 'datachannel') and false (don't
-    // open any channel).
-    // openBridgeChannel: true,
-
-
-    // UI
-    //
-
-    // Use display name as XMPP nickname.
-    // useNicks: false,
-
-    // Require users to always specify a display name.
-    // requireDisplayName: true,
-
-    // Whether to use a welcome page or not. In case it's false a random room
-    // will be joined when no room is specified.
-    enableWelcomePage: true,
-
-    // Enabling the close page will ignore the welcome page redirection when
-    // a call is hangup.
-    // enableClosePage: false,
-
-    // Disable hiding of remote thumbnails when in a 1-on-1 conference call.
-    // disable1On1Mode: false,
-
-    // Default language for the user interface.
-    defaultLanguage: {{ matrix_jitsi_web_config_defaultLanguage|to_json }},
-
-    // If true all users without a token will be considered guests and all users
-    // with token will be considered non-guests. Only guests will be allowed to
-    // edit their profile.
-    enableUserRolesBasedOnToken: false,
-
-    // Whether or not some features are checked based on token.
-    // enableFeaturesBasedOnToken: false,
-
-    // Enable lock room for all moderators, even when userRolesBasedOnToken is enabled and participants are guests.
-    // lockRoomGuestEnabled: false,
-
-    // When enabled the password used for locking a room is restricted to up to the number of digits specified
-    // roomPasswordNumberOfDigits: 10,
-    // default: roomPasswordNumberOfDigits: false,
-
-    // Message to show the users. Example: 'The service will be down for
-    // maintenance at 01:00 AM GMT,
-    // noticeMessage: '',
-
-    // Enables calendar integration, depends on googleApiApplicationClientID
-    // and microsoftApiApplicationClientID
-    // enableCalendarIntegration: false,
-
-    // Stats
-    //
-
-    // Whether to enable stats collection or not in the TraceablePeerConnection.
-    // This can be useful for debugging purposes (post-processing/analysis of
-    // the webrtc stats) as it is done in the jitsi-meet-torture bandwidth
-    // estimation tests.
-    // gatherStats: false,
-
-    // To enable sending statistics to callstats.io you must provide the
-    // Application ID and Secret.
-    // callStatsID: '',
-    // callStatsSecret: '',
-
-    // enables callstatsUsername to be reported as statsId and used
-    // by callstats as repoted remote id
-    // enableStatsID: false
-
-    // enables sending participants display name to callstats
-    // enableDisplayNameInStats: false
-
-
-    // Privacy
-    //
-
-    // If third party requests are disabled, no other server will be contacted.
-    // This means avatars will be locally generated and callstats integration
-    // will not function.
-    // disableThirdPartyRequests: false,
-
-
-    // Peer-To-Peer mode: used (if enabled) when there are just 2 participants.
-    //
-
-    p2p: {
-        // Enables peer to peer mode. When enabled the system will try to
-        // establish a direct connection when there are exactly 2 participants
-        // in the room. If that succeeds the conference will stop sending data
-        // through the JVB and use the peer to peer connection instead. When a
-        // 3rd participant joins the conference will be moved back to the JVB
-        // connection.
-        enabled: true,
-
-        // Use XEP-0215 to fetch STUN and TURN servers.
-        // useStunTurn: true,
-
-        // The STUN servers that will be used in the peer to peer connections
-        {% if matrix_jitsi_web_stun_servers|length > 0 %}
-        stunServers: [
-            {% for url in matrix_jitsi_web_stun_servers %}
-                { urls: {{ url|to_json }} }{% if not loop.last %},{% endif %}
-            {% endfor %}
-        ],
-        {% endif %}
-
-        // Sets the ICE transport policy for the p2p connection. At the time
-        // of this writing the list of possible values are 'all' and 'relay',
-        // but that is subject to change in the future. The enum is defined in
-        // the WebRTC standard:
-        // https://www.w3.org/TR/webrtc/#rtcicetransportpolicy-enum.
-        // If not set, the effective value is 'all'.
-        // iceTransportPolicy: 'all',
-
-        // If set to true, it will prefer to use H.264 for P2P calls (if H.264
-        // is supported).
-        preferH264: true
-
-        // If set to true, disable H.264 video codec by stripping it out of the
-        // SDP.
-        // disableH264: false,
-
-        // How long we're going to wait, before going back to P2P after the 3rd
-        // participant has left the conference (to filter out page reload).
-        // backToP2PDelay: 5
-    },
-
-    analytics: {
-        // The Google Analytics Tracking ID:
-        // googleAnalyticsTrackingId: 'your-tracking-id-UA-123456-1'
-
-        // The Amplitude APP Key:
-        // amplitudeAPPKey: '<APP_KEY>'
-
-        // Array of script URLs to load as lib-jitsi-meet "analytics handlers".
-        // scriptURLs: [
-        //      "libs/analytics-ga.min.js", // google-analytics
-        //      "https://example.com/my-custom-analytics.js"
-        // ],
-    },
-
-    // Information about the jitsi-meet instance we are connecting to, including
-    // the user region as seen by the server.
-    deploymentInfo: {
-        // shard: "shard1",
-        // region: "europe",
-        // userRegion: "asia"
-    }
-
-    // Local Recording
-    //
-
-    // localRecording: {
-    // Enables local recording.
-    // Additionally, 'localrecording' (all lowercase) needs to be added to
-    // TOOLBAR_BUTTONS in interface_config.js for the Local Recording
-    // button to show up on the toolbar.
-    //
-    //     enabled: true,
-    //
-
-    // The recording format, can be one of 'ogg', 'flac' or 'wav'.
-    //     format: 'flac'
-    //
-
-    // }
-
-    // Options related to end-to-end (participant to participant) ping.
-    // e2eping: {
-    //   // The interval in milliseconds at which pings will be sent.
-    //   // Defaults to 10000, set to <= 0 to disable.
-    //   pingInterval: 10000,
-    //
-    //   // The interval in milliseconds at which analytics events
-    //   // with the measured RTT will be sent. Defaults to 60000, set
-    //   // to <= 0 to disable.
-    //   analyticsInterval: 60000,
-    //   }
-
-    // If set, will attempt to use the provided video input device label when
-    // triggering a screenshare, instead of proceeding through the normal flow
-    // for obtaining a desktop stream.
-    // NOTE: This option is experimental and is currently intended for internal
-    // use only.
-    // _desktopSharingSourceDevice: 'sample-id-or-label'
-
-    // If true, any checks to handoff to another application will be prevented
-    // and instead the app will continue to display in the current browser.
-    // disableDeepLinking: false
-
-    // A property to disable the right click context menu for localVideo
-    // the menu has option to flip the locally seen video for local presentations
-    // disableLocalVideoFlip: false
-
-    // List of undocumented settings used in jitsi-meet
-    /**
-     _immediateReloadThreshold
-     autoRecord
-     autoRecordToken
-     debug
-     debugAudioLevels
-     deploymentInfo
-     dialInConfCodeUrl
-     dialInNumbersUrl
-     dialOutAuthUrl
-     dialOutCodesUrl
-     disableRemoteControl
-     displayJids
-     etherpad_base
-     externalConnectUrl
-     firefox_fake_device
-     googleApiApplicationClientID
-     iAmRecorder
-     iAmSipGateway
-     microsoftApiApplicationClientID
-     peopleSearchQueryTypes
-     peopleSearchUrl
-     requireDisplayName
-     tokenAuthUrl
-     */
-
-    // List of undocumented settings used in lib-jitsi-meet
-    /**
-     _peerConnStatusOutOfLastNTimeout
-     _peerConnStatusRtcMuteTimeout
-     abTesting
-     avgRtpStatsN
-     callStatsConfIDNamespace
-     callStatsCustomScriptUrl
-     desktopSharingSources
-     disableAEC
-     disableAGC
-     disableAP
-     disableHPF
-     disableNS
-     enableLipSync
-     enableTalkWhileMuted
-     forceJVB121Ratio
-     hiddenDomain
-     ignoreStartMuted
-     nick
-     startBitrate
-     */
-
-};
-
-/* eslint-enable no-unused-vars, no-var */
diff --git a/roles/matrix-jitsi/templates/web/custom-config.js.j2 b/roles/matrix-jitsi/templates/web/custom-config.js.j2
new file mode 100644
index 00000000..02316ca0
--- /dev/null
+++ b/roles/matrix-jitsi/templates/web/custom-config.js.j2
@@ -0,0 +1,15 @@
+config.defaultLanguage = {{ matrix_jitsi_web_config_defaultLanguage|to_json }};
+
+
+if (!config.hasOwnProperty('p2p')) config.p2p = {% raw %}{}{% endraw %};
+
+{% if matrix_jitsi_web_stun_servers|length > 0 %}
+config.p2p.stunServers = [
+	{% for url in matrix_jitsi_web_stun_servers %}
+		{ urls: {{ url|to_json }} }{% if not loop.last %},{% endif %}
+	{% endfor %}
+];
+{% endif %}
+
+
+{{ matrix_jitsi_web_custom_config_extension }}
diff --git a/roles/matrix-jitsi/templates/web/env.j2 b/roles/matrix-jitsi/templates/web/env.j2
index b85e9af5..353a3d14 100644
--- a/roles/matrix-jitsi/templates/web/env.j2
+++ b/roles/matrix-jitsi/templates/web/env.j2
@@ -3,6 +3,8 @@ ENABLE_GUESTS={{ 1 if matrix_jitsi_enable_guests else 0 }}
 
 ENABLE_TRANSCRIPTIONS={{ 1 if matrix_jitsi_enable_transcriptions else 0 }}
 
+ENABLE_P2P={{ 1 if matrix_jitsi_enable_p2p else 0 }}
+
 DISABLE_HTTPS=1
 
 JICOFO_AUTH_USER={{ matrix_jitsi_jicofo_auth_user }}
@@ -26,3 +28,13 @@ JIBRI_RECORDER_USER={{ matrix_jitsi_jibri_recorder_user }}
 JIBRI_RECORDER_PASSWORD={{ matrix_jitsi_jibri_recorder_password }}
 
 ENABLE_RECORDING={{ 1 if matrix_jitsi_enable_recording else 0 }}
+
+RESOLUTION={{ matrix_jitsi_web_config_resolution_height_ideal_and_max }}
+RESOLUTION_MIN={{ matrix_jitsi_web_config_resolution_height_min }}
+RESOLUTION_WIDTH={{ matrix_jitsi_web_config_resolution_width_ideal_and_max }}
+RESOLUTION_WIDTH_MIN={{ matrix_jitsi_web_config_resolution_width_min }}
+
+START_AUDIO_MUTED={{ matrix_jitsi_web_config_start_audio_muted_after_nth_participant }}
+START_VIDEO_MUTED={{ matrix_jitsi_web_config_start_video_muted_after_nth_participant }}
+
+{{ matrix_jitsi_web_environment_variables_extension }}
diff --git a/roles/matrix-jitsi/templates/web/interface_config.js.j2 b/roles/matrix-jitsi/templates/web/interface_config.js.j2
index c56f8c8c..60fac4d5 100644
--- a/roles/matrix-jitsi/templates/web/interface_config.js.j2
+++ b/roles/matrix-jitsi/templates/web/interface_config.js.j2
@@ -1,137 +1,23 @@
 /* eslint-disable no-unused-vars, no-var, max-len */
+/* eslint sort-keys: ["error", "asc", {"caseSensitive": false}] */
 
 var interfaceConfig = {
-    // TO FIX: this needs to be handled from SASS variables. There are some
-    // methods allowing to use variables both in css and js.
-    DEFAULT_BACKGROUND: '#474747',
-
-    /**
-     * Whether or not the blurred video background for large video should be
-     * displayed on browsers that can support it.
-     */
-    DISABLE_VIDEO_BACKGROUND: false,
-
-    INITIAL_TOOLBAR_TIMEOUT: 20000,
-    TOOLBAR_TIMEOUT: 4000,
-    TOOLBAR_ALWAYS_VISIBLE: false,
-    DEFAULT_REMOTE_DISPLAY_NAME: 'Fellow Jitster',
-    DEFAULT_LOCAL_DISPLAY_NAME: 'me',
-    SHOW_JITSI_WATERMARK: {{ matrix_jitsi_web_interface_config_show_jitsi_watermark|to_json }},
-    JITSI_WATERMARK_LINK: {{ matrix_jitsi_web_interface_config_jitsi_watermark_link|to_json }},
-
-    // if watermark is disabled by default, it can be shown only for guests
-    SHOW_WATERMARK_FOR_GUESTS: {{ matrix_jitsi_web_interface_config_show_watermark_for_guests|to_json }},
-    SHOW_BRAND_WATERMARK: {{ matrix_jitsi_web_interface_config_show_brand_watermark|to_json }},
-    BRAND_WATERMARK_LINK: {{ matrix_jitsi_web_interface_config_brand_watermark_link|to_json }},
-    SHOW_POWERED_BY: {{ matrix_jitsi_web_interface_config_show_powered_by|to_json }},
-    SHOW_DEEP_LINKING_IMAGE: {{ matrix_jisti_web_interface_config_show_deep_linking_image|to_json }},
-    GENERATE_ROOMNAMES_ON_WELCOME_PAGE: {{ matrix_jitsi_web_interface_config_generate_room_names_on_welcome_page|to_json }},
-    DISPLAY_WELCOME_PAGE_CONTENT: {{ matrix_jitsi_web_interface_config_display_welcome_page_content|to_json }},
     APP_NAME: {{ matrix_jitsi_web_interface_config_app_name|to_json }},
-    NATIVE_APP_NAME: {{ matrix_jitsi_web_interface_config_native_app_name|to_json }},
-    PROVIDER_NAME: {{ matrix_jitsi_web_interface_config_provider_name|to_json }},
-    LANG_DETECTION: {{ matrix_jitsi_web_interface_config_lang_detection|to_json }}, // Allow i18n to detect the system language
-    INVITATION_POWERED_BY: {{ matrix_jitsi_web_interface_config_invitation_powered_by|to_json }},
-
-    /**
-     * If we should show authentication block in profile
-     */
-    AUTHENTICATION_ENABLE: true,
-
-    /**
-     * The name of the toolbar buttons to display in the toolbar. If present,
-     * the button will display. Exceptions are "livestreaming" and "recording"
-     * which also require being a moderator and some values in config.js to be
-     * enabled. Also, the "profile" button will not display for user's with a
-     * jwt.
-     */
-    TOOLBAR_BUTTONS: [
-		{% if matrix_jitsi_enable_transcriptions %}
-            'closedcaptions',
-		{% endif %}
-
-        'microphone', 'camera', 'desktop', 'fullscreen',
-        'fodeviceselection', 'hangup', 'profile', 'info', 'chat', 'recording',
-        'livestreaming', 'etherpad', 'sharedvideo', 'settings', 'raisehand',
-        'videoquality', 'filmstrip', 'invite', 'feedback', 'stats', 'shortcuts',
-        'tileview', 'videobackgroundblur'
-    ],
-
-    SETTINGS_SECTIONS: [ 'devices', 'language', 'moderator', 'profile', 'calendar' ],
-
-    // Determines how the video would fit the screen. 'both' would fit the whole
-    // screen, 'height' would fit the original video height to the height of the
-    // screen, 'width' would fit the original video width to the width of the
-    // screen respecting ratio.
-    VIDEO_LAYOUT_FIT: 'both',
-
-    /**
-     * Whether to only show the filmstrip (and hide the toolbar).
-     */
-    filmStripOnly: false,
-
-    /**
-     * Whether to show thumbnails in filmstrip as a column instead of as a row.
-     */
-    VERTICAL_FILMSTRIP: true,
-
-    // A html text to be shown to guests on the close page, false disables it
-    CLOSE_PAGE_GUEST_HINT: false,
-    RANDOM_AVATAR_URL_PREFIX: false,
-    RANDOM_AVATAR_URL_SUFFIX: false,
-    FILM_STRIP_MAX_HEIGHT: 120,
-
-    // Enables feedback star animation.
-    ENABLE_FEEDBACK_ANIMATION: false,
-    DISABLE_FOCUS_INDICATOR: false,
-    DISABLE_DOMINANT_SPEAKER_INDICATOR: false,
-
-    /**
-     * Whether the speech to text transcription subtitles panel is disabled.
-     * If {@code undefined}, defaults to {@code false}.
-     *
-     * @type {boolean}
-     */
-    DISABLE_TRANSCRIPTION_SUBTITLES: {{ matrix_jitsi_web_interface_config_disable_transcription_subtitles|to_json }},
-
-    /**
-     * Whether the ringing sound in the call/ring overlay is disabled. If
-     * {@code undefined}, defaults to {@code false}.
-     *
-     * @type {boolean}
-     */
-    DISABLE_RINGING: false,
     AUDIO_LEVEL_PRIMARY_COLOR: 'rgba(255,255,255,0.4)',
     AUDIO_LEVEL_SECONDARY_COLOR: 'rgba(255,255,255,0.2)',
-    POLICY_LOGO: null,
-    LOCAL_THUMBNAIL_RATIO: 16 / 9, // 16:9
-    REMOTE_THUMBNAIL_RATIO: 1, // 1:1
-    // Documentation reference for the live streaming feature.
-    LIVE_STREAMING_HELP_LINK: 'https://jitsi.org/live',
 
     /**
-     * Whether the mobile app Jitsi Meet is to be promoted to participants
-     * attempting to join a conference in a mobile Web browser. If
-     * {@code undefined}, defaults to {@code true}.
+     * A UX mode where the last screen share participant is automatically
+     * pinned. Valid values are the string "remote-only" so remote participants
+     * get pinned but not local, otherwise any truthy value for all participants,
+     * and any falsy value to disable the feature.
      *
-     * @type {boolean}
+     * Note: this mode is experimental and subject to breakage.
      */
-    MOBILE_APP_PROMO: true,
-
-    /**
-     * Maximum coeficient of the ratio of the large video to the visible area
-     * after the large video is scaled to fit the window.
-     *
-     * @type {number}
-     */
-    MAXIMUM_ZOOMING_COEFFICIENT: 1.3,
-
-    /*
-     * If indicated some of the error dialogs may point to the support URL for
-     * help.
-     */
-    SUPPORT_URL: 'https://github.com/jitsi/jitsi-meet/issues/new',
+    AUTO_PIN_LATEST_SCREEN_SHARE: 'remote-only',
+    BRAND_WATERMARK_LINK: {{ matrix_jitsi_web_interface_config_brand_watermark_link|to_json }},
 
+    CLOSE_PAGE_GUEST_HINT: false, // A html text to be shown to guests on the close page, false disables it
     /**
      * Whether the connection indicator icon should hide itself based on
      * connection strength. If true, the connection indicator will remain
@@ -158,6 +44,192 @@ var interfaceConfig = {
      */
     CONNECTION_INDICATOR_DISABLED: false,
 
+    DEFAULT_BACKGROUND: '#474747',
+    DEFAULT_LOCAL_DISPLAY_NAME: 'me',
+    DEFAULT_LOGO_URL: 'images/watermark.svg',
+    DEFAULT_REMOTE_DISPLAY_NAME: 'Fellow Jitster',
+    DEFAULT_WELCOME_PAGE_LOGO_URL: 'images/watermark.svg',
+
+    DISABLE_DOMINANT_SPEAKER_INDICATOR: false,
+
+    DISABLE_FOCUS_INDICATOR: false,
+
+    /**
+     * If true, notifications regarding joining/leaving are no longer displayed.
+     */
+    DISABLE_JOIN_LEAVE_NOTIFICATIONS: false,
+
+    /**
+     * If true, presence status: busy, calling, connected etc. is not displayed.
+     */
+    DISABLE_PRESENCE_STATUS: false,
+
+    /**
+     * Whether the ringing sound in the call/ring overlay is disabled. If
+     * {@code undefined}, defaults to {@code false}.
+     *
+     * @type {boolean}
+     */
+    DISABLE_RINGING: false,
+
+    /**
+     * Whether the speech to text transcription subtitles panel is disabled.
+     * If {@code undefined}, defaults to {@code false}.
+     *
+     * @type {boolean}
+     */
+    DISABLE_TRANSCRIPTION_SUBTITLES: {{ matrix_jitsi_web_interface_config_disable_transcription_subtitles|to_json }},
+
+    /**
+     * Whether or not the blurred video background for large video should be
+     * displayed on browsers that can support it.
+     */
+    DISABLE_VIDEO_BACKGROUND: false,
+
+    DISPLAY_WELCOME_FOOTER: true,
+    DISPLAY_WELCOME_PAGE_ADDITIONAL_CARD: false,
+    DISPLAY_WELCOME_PAGE_CONTENT: {{ matrix_jitsi_web_interface_config_display_welcome_page_content|to_json }},
+    DISPLAY_WELCOME_PAGE_TOOLBAR_ADDITIONAL_CONTENT: false,
+
+    ENABLE_DIAL_OUT: true,
+
+    ENABLE_FEEDBACK_ANIMATION: false, // Enables feedback star animation.
+
+    FILM_STRIP_MAX_HEIGHT: 120,
+
+    GENERATE_ROOMNAMES_ON_WELCOME_PAGE: {{ matrix_jitsi_web_interface_config_generate_room_names_on_welcome_page|to_json }},
+
+    /**
+     * Hide the logo on the deep linking pages.
+     */
+    HIDE_DEEP_LINKING_LOGO: false,
+
+    /**
+     * Hide the invite prompt in the header when alone in the meeting.
+     */
+    HIDE_INVITE_MORE_HEADER: false,
+
+    INITIAL_TOOLBAR_TIMEOUT: 20000,
+    JITSI_WATERMARK_LINK: {{ matrix_jitsi_web_interface_config_jitsi_watermark_link|to_json }},
+
+    LANG_DETECTION: {{ matrix_jitsi_web_interface_config_lang_detection|to_json }}, // Allow i18n to detect the system language
+    LIVE_STREAMING_HELP_LINK: 'https://jitsi.org/live', // Documentation reference for the live streaming feature.
+    LOCAL_THUMBNAIL_RATIO: 16 / 9, // 16:9
+
+    /**
+     * Maximum coefficient of the ratio of the large video to the visible area
+     * after the large video is scaled to fit the window.
+     *
+     * @type {number}
+     */
+    MAXIMUM_ZOOMING_COEFFICIENT: 1.3,
+
+    /**
+     * Whether the mobile app Jitsi Meet is to be promoted to participants
+     * attempting to join a conference in a mobile Web browser. If
+     * {@code undefined}, defaults to {@code true}.
+     *
+     * @type {boolean}
+     */
+    MOBILE_APP_PROMO: true,
+
+    /**
+     * Specify custom URL for downloading android mobile app.
+     */
+    MOBILE_DOWNLOAD_LINK_ANDROID: 'https://play.google.com/store/apps/details?id=org.jitsi.meet',
+
+    /**
+     * Specify custom URL for downloading f droid app.
+     */
+    MOBILE_DOWNLOAD_LINK_F_DROID: 'https://f-droid.org/en/packages/org.jitsi.meet/',
+
+    /**
+     * Specify URL for downloading ios mobile app.
+     */
+    MOBILE_DOWNLOAD_LINK_IOS: 'https://itunes.apple.com/us/app/jitsi-meet/id1165103905',
+
+    NATIVE_APP_NAME: {{ matrix_jitsi_web_interface_config_native_app_name|to_json }},
+
+    // Names of browsers which should show a warning stating the current browser
+    // has a suboptimal experience. Browsers which are not listed as optimal or
+    // unsupported are considered suboptimal. Valid values are:
+    // chrome, chromium, edge, electron, firefox, nwjs, opera, safari
+    OPTIMAL_BROWSERS: [ 'chrome', 'chromium', 'firefox', 'nwjs', 'electron', 'safari' ],
+
+    POLICY_LOGO: null,
+    PROVIDER_NAME: {{ matrix_jitsi_web_interface_config_provider_name|to_json }},
+
+    /**
+     * If true, will display recent list
+     *
+     * @type {boolean}
+     */
+    RECENT_LIST_ENABLED: true,
+    REMOTE_THUMBNAIL_RATIO: 1, // 1:1
+
+    SETTINGS_SECTIONS: [ 'devices', 'language', 'moderator', 'profile', 'calendar' ],
+    SHOW_BRAND_WATERMARK: {{ matrix_jitsi_web_interface_config_show_brand_watermark|to_json }},
+
+    /**
+    * Decides whether the chrome extension banner should be rendered on the landing page and during the meeting.
+    * If this is set to false, the banner will not be rendered at all. If set to true, the check for extension(s)
+    * being already installed is done before rendering.
+    */
+    SHOW_CHROME_EXTENSION_BANNER: false,
+
+    SHOW_DEEP_LINKING_IMAGE: {{ matrix_jisti_web_interface_config_show_deep_linking_image|to_json }},
+    SHOW_JITSI_WATERMARK: {{ matrix_jitsi_web_interface_config_show_jitsi_watermark|to_json }},
+    SHOW_POWERED_BY: {{ matrix_jitsi_web_interface_config_show_powered_by|to_json }},
+    SHOW_PROMOTIONAL_CLOSE_PAGE: false,
+
+    /*
+     * If indicated some of the error dialogs may point to the support URL for
+     * help.
+     */
+    SUPPORT_URL: 'https://community.jitsi.org/',
+
+    TOOLBAR_ALWAYS_VISIBLE: false,
+
+    /**
+     * The name of the toolbar buttons to display in the toolbar, including the
+     * "More actions" menu. If present, the button will display. Exceptions are
+     * "livestreaming" and "recording" which also require being a moderator and
+     * some values in config.js to be enabled. Also, the "profile" button will
+     * not display for users with a JWT.
+     * Notes:
+     * - it's impossible to choose which buttons go in the "More actions" menu
+     * - it's impossible to control the placement of buttons
+     * - 'desktop' controls the "Share your screen" button
+     */
+    TOOLBAR_BUTTONS: [
+		{% if matrix_jitsi_enable_transcriptions %}
+            'closedcaptions',
+		{% endif %}
+
+        'microphone', 'camera', 'desktop', 'embedmeeting', 'fullscreen',
+        'fodeviceselection', 'hangup', 'profile', 'chat', 'recording',
+        'livestreaming', 'etherpad', 'sharedvideo', 'settings', 'raisehand',
+        'videoquality', 'filmstrip', 'invite', 'feedback', 'stats', 'shortcuts',
+        'tileview', 'videobackgroundblur', 'download', 'help', 'mute-everyone', 'security'
+    ],
+
+    TOOLBAR_TIMEOUT: 4000,
+
+    // Browsers, in addition to those which do not fully support WebRTC, that
+    // are not supported and should show the unsupported browser page.
+    UNSUPPORTED_BROWSERS: [],
+
+    /**
+     * Whether to show thumbnails in filmstrip as a column instead of as a row.
+     */
+    VERTICAL_FILMSTRIP: true,
+
+    // Determines how the video would fit the screen. 'both' would fit the whole
+    // screen, 'height' would fit the original video height to the height of the
+    // screen, 'width' would fit the original video width to the width of the
+    // screen respecting ratio.
+    VIDEO_LAYOUT_FIT: 'both',
+
     /**
      * If true, hides the video quality label indicating the resolution status
      * of the current large video.
@@ -166,33 +238,6 @@ var interfaceConfig = {
      */
     VIDEO_QUALITY_LABEL_DISABLED: false,
 
-    /**
-     * If true, will display recent list
-     *
-     * @type {boolean}
-     */
-    RECENT_LIST_ENABLED: true,
-
-    // Names of browsers which should show a warning stating the current browser
-    // has a suboptimal experience. Browsers which are not listed as optimal or
-    // unsupported are considered suboptimal. Valid values are:
-    // chrome, chromium, edge, electron, firefox, nwjs, opera, safari
-    OPTIMAL_BROWSERS: [ 'chrome', 'chromium', 'firefox', 'nwjs', 'electron' ],
-
-    // Browsers, in addition to those which do not fully support WebRTC, that
-    // are not supported and should show the unsupported browser page.
-    UNSUPPORTED_BROWSERS: [],
-
-    /**
-     * A UX mode where the last screen share participant is automatically
-     * pinned. Valid values are the string "remote-only" so remote participants
-     * get pinned but not local, otherwise any truthy value for all participants,
-     * and any falsy value to disable the feature.
-     *
-     * Note: this mode is experimental and subject to breakage.
-     */
-    AUTO_PIN_LATEST_SCREEN_SHARE: 'remote-only'
-
     /**
      * How many columns the tile view can expand to. The respected range is
      * between 1 and 5.
@@ -200,14 +245,15 @@ var interfaceConfig = {
     // TILE_VIEW_MAX_COLUMNS: 5,
 
     /**
-     * Specify custom URL for downloading android mobile app.
+     * Specify Firebase dynamic link properties for the mobile apps.
      */
-    // MOBILE_DOWNLOAD_LINK_ANDROID: 'https://play.google.com/store/apps/details?id=org.jitsi.meet',
-
-    /**
-     * Specify URL for downloading ios mobile app.
-     */
-    // MOBILE_DOWNLOAD_LINK_IOS: 'https://itunes.apple.com/us/app/jitsi-meet/id1165103905',
+    // MOBILE_DYNAMIC_LINK: {
+    //    APN: 'org.jitsi.meet',
+    //    APP_CODE: 'w2atb',
+    //    CUSTOM_DOMAIN: undefined,
+    //    IBI: 'com.atlassian.JitsiMeet.ios',
+    //    ISI: '1165103905'
+    // },
 
     /**
      * Specify mobile app scheme for opening the app from the mobile browser.
@@ -225,6 +271,23 @@ var interfaceConfig = {
      * milliseconds, those notifications should remain displayed.
      */
     // ENFORCE_NOTIFICATION_AUTO_DISMISS_TIMEOUT: 15000,
+
+    // List of undocumented settings
+    /**
+     INDICATOR_FONT_SIZES
+     PHONE_NUMBER_REGEX
+    */
+
+    // Allow all above example options to include a trailing comma and
+    // prevent fear when commenting out the last value.
+    // eslint-disable-next-line sort-keys
+    makeJsonParserHappy: 'even if last key had a trailing comma'
+
+    // No configuration value should follow this line.
 };
 
+
+{{ matrix_jitsi_web_custom_interface_config_extension }}
+
+
 /* eslint-enable no-unused-vars, no-var, max-len */

From b354155d7cbca855dd979ae941668154f10afe18 Mon Sep 17 00:00:00 2001
From: Slavi Pantaleev <slavi@devture.com>
Date: Fri, 27 Nov 2020 17:57:07 +0200
Subject: [PATCH 36/43] Make JVB websockets reverse-proxying work

---
 group_vars/matrix_servers                     |  2 ++
 roles/matrix-jitsi/defaults/main.yml          |  5 +++++
 .../templates/jvb/matrix-jitsi-jvb.service.j2 |  3 +++
 .../nginx/conf.d/matrix-jitsi.conf.j2         | 21 +++++++++++++++++++
 4 files changed, 31 insertions(+)

diff --git a/group_vars/matrix_servers b/group_vars/matrix_servers
index 464cff78..07f9a88c 100755
--- a/group_vars/matrix_servers
+++ b/group_vars/matrix_servers
@@ -671,6 +671,8 @@ matrix_jitsi_enabled: false
 # the Jitsi HTTP port to the local host.
 matrix_jitsi_web_container_http_host_bind_port: "{{ '' if matrix_nginx_proxy_enabled else '127.0.0.1:12080' }}"
 
+matrix_jitsi_jvb_container_colibri_ws_host_bind_port: "{{ '' if matrix_nginx_proxy_enabled else '127.0.0.1:12090' }}"
+
 matrix_jitsi_jibri_xmpp_password: "{{ matrix_synapse_macaroon_secret_key | password_hash('sha512', 'jibri') | to_uuid }}"
 matrix_jitsi_jicofo_auth_password: "{{ matrix_synapse_macaroon_secret_key | password_hash('sha512', 'jicofo') | to_uuid }}"
 matrix_jitsi_jvb_auth_password: "{{ matrix_synapse_macaroon_secret_key | password_hash('sha512', 'jvb') | to_uuid }}"
diff --git a/roles/matrix-jitsi/defaults/main.yml b/roles/matrix-jitsi/defaults/main.yml
index c9c8745e..85123cf7 100644
--- a/roles/matrix-jitsi/defaults/main.yml
+++ b/roles/matrix-jitsi/defaults/main.yml
@@ -247,3 +247,8 @@ matrix_jitsi_jvb_container_rtp_udp_host_bind_port: "{{ matrix_jitsi_jvb_rtp_udp_
 #
 # Takes an "<ip>:<port>" or "<port>" value (e.g. "127.0.0.1:4443"), or empty string to not expose.
 matrix_jitsi_jvb_container_rtp_tcp_host_bind_port: "{{ matrix_jitsi_jvb_rtp_tcp_port }}"
+
+# Controls whether the matrix-jitsi-jvb container exposes its Colibri WebSocket port (tcp/9090 in the container).
+#
+# Takes an "<ip>:<port>" or "<port>" value (e.g. "127.0.0.1:12090"), or empty string to not expose.
+matrix_jitsi_jvb_container_colibri_ws_host_bind_port: ''
diff --git a/roles/matrix-jitsi/templates/jvb/matrix-jitsi-jvb.service.j2 b/roles/matrix-jitsi/templates/jvb/matrix-jitsi-jvb.service.j2
index 6db6a850..7fcfeec6 100644
--- a/roles/matrix-jitsi/templates/jvb/matrix-jitsi-jvb.service.j2
+++ b/roles/matrix-jitsi/templates/jvb/matrix-jitsi-jvb.service.j2
@@ -21,6 +21,9 @@ ExecStart={{ matrix_host_command_docker }} run --rm --name matrix-jitsi-jvb \
 			{% if matrix_jitsi_jvb_container_rtp_tcp_host_bind_port %}
 			-p {{ matrix_jitsi_jvb_container_rtp_tcp_host_bind_port }}:{{ matrix_jitsi_jvb_rtp_tcp_port }} \
 			{% endif %}
+			{% if matrix_jitsi_jvb_container_colibri_ws_host_bind_port %}
+			-p {{ matrix_jitsi_jvb_container_colibri_ws_host_bind_port }}:9090 \
+			{% endif %}
 			--mount type=bind,src={{ matrix_jitsi_jvb_config_path }},dst=/config \
 			{% for arg in matrix_jitsi_jvb_container_extra_arguments %}
 			{{ arg }} \
diff --git a/roles/matrix-nginx-proxy/templates/nginx/conf.d/matrix-jitsi.conf.j2 b/roles/matrix-nginx-proxy/templates/nginx/conf.d/matrix-jitsi.conf.j2
index 4cacf1f1..500f1943 100644
--- a/roles/matrix-nginx-proxy/templates/nginx/conf.d/matrix-jitsi.conf.j2
+++ b/roles/matrix-nginx-proxy/templates/nginx/conf.d/matrix-jitsi.conf.j2
@@ -23,6 +23,27 @@
 		proxy_set_header Host $host;
 		proxy_set_header X-Forwarded-For $remote_addr;
 	}
+
+	# colibri (JVB) websockets
+	location ~ ^/colibri-ws/([a-zA-Z0-9-\.]+)/(.*) {
+		{% if matrix_nginx_proxy_enabled %}
+			resolver 127.0.0.11 valid=5s;
+			set $backend "matrix-jitsi-jvb:9090";
+			proxy_pass http://$backend;
+		{% else %}
+			{# Generic configuration for use outside of our container setup #}
+			proxy_pass http://127.0.0.1:12090;
+		{% endif %}
+
+		proxy_set_header Host $host;
+		proxy_set_header X-Forwarded-For $remote_addr;
+		proxy_set_header Upgrade $http_upgrade;
+		proxy_set_header Connection "upgrade";
+
+		proxy_http_version 1.1;
+
+		tcp_nodelay on;
+	}
 {% endmacro %}
 
 server {

From be5263f397eba7c3cc554f952344d0d7d36ec02a Mon Sep 17 00:00:00 2001
From: Slavi Pantaleev <slavi@devture.com>
Date: Sat, 28 Nov 2020 21:34:14 +0200
Subject: [PATCH 37/43] Move self-building git repository URLs to variables
 (stop hardcoding)

---
 roles/matrix-bridge-mautrix-facebook/defaults/main.yml |  1 +
 .../tasks/setup_install.yml                            |  2 +-
 roles/matrix-bridge-mautrix-hangouts/defaults/main.yml |  1 +
 .../tasks/setup_install.yml                            |  2 +-
 .../matrix-bridge-mx-puppet-discord/defaults/main.yml  |  1 +
 .../tasks/setup_install.yml                            |  2 +-
 .../defaults/main.yml                                  |  1 +
 .../tasks/setup_install.yml                            |  2 +-
 roles/matrix-bridge-mx-puppet-skype/defaults/main.yml  |  1 +
 .../tasks/setup_install.yml                            |  2 +-
 roles/matrix-bridge-mx-puppet-slack/defaults/main.yml  |  1 +
 .../tasks/setup_install.yml                            |  2 +-
 roles/matrix-bridge-mx-puppet-steam/defaults/main.yml  |  1 +
 .../tasks/setup_install.yml                            |  2 +-
 .../matrix-bridge-mx-puppet-twitter/defaults/main.yml  |  1 +
 .../tasks/setup_install.yml                            |  2 +-
 roles/matrix-client-element/defaults/main.yml          |  1 +
 roles/matrix-client-element/tasks/setup.yml            |  2 +-
 roles/matrix-coturn/defaults/main.yml                  |  1 +
 roles/matrix-coturn/tasks/setup_coturn.yml             |  2 +-
 roles/matrix-dynamic-dns/defaults/main.yml             |  1 +
 roles/matrix-dynamic-dns/tasks/install.yml             |  2 +-
 roles/matrix-ma1sd/defaults/main.yml                   |  1 +
 roles/matrix-ma1sd/tasks/setup_ma1sd.yml               |  2 +-
 roles/matrix-registration/defaults/main.yml            |  2 +-
 roles/matrix-registration/tasks/setup.yml              |  2 +-
 roles/matrix-registration/tasks/validate_config.yml    |  9 +++++++++
 roles/matrix-synapse-admin/defaults/main.yml           |  3 ++-
 roles/matrix-synapse-admin/tasks/main.yml              |  6 ++++++
 roles/matrix-synapse-admin/tasks/setup.yml             |  2 +-
 roles/matrix-synapse-admin/tasks/validate_config.yml   | 10 ++++++++++
 roles/matrix-synapse/defaults/main.yml                 |  1 +
 roles/matrix-synapse/tasks/synapse/setup_install.yml   |  2 +-
 33 files changed, 56 insertions(+), 17 deletions(-)
 create mode 100644 roles/matrix-synapse-admin/tasks/validate_config.yml

diff --git a/roles/matrix-bridge-mautrix-facebook/defaults/main.yml b/roles/matrix-bridge-mautrix-facebook/defaults/main.yml
index c34da88f..c14a3ace 100644
--- a/roles/matrix-bridge-mautrix-facebook/defaults/main.yml
+++ b/roles/matrix-bridge-mautrix-facebook/defaults/main.yml
@@ -4,6 +4,7 @@
 matrix_mautrix_facebook_enabled: true
 
 matrix_mautrix_facebook_container_image_self_build: false
+matrix_mautrix_facebook_container_image_self_build_repo: "https://github.com/tulir/mautrix-facebook.git"
 
 # See: https://mau.dev/tulir/mautrix-facebook/container_registry
 matrix_mautrix_facebook_docker_image: "{{ matrix_mautrix_facebook_docker_image_name_prefix }}tulir/mautrix-facebook:latest"
diff --git a/roles/matrix-bridge-mautrix-facebook/tasks/setup_install.yml b/roles/matrix-bridge-mautrix-facebook/tasks/setup_install.yml
index 75ea7a6b..638854e2 100644
--- a/roles/matrix-bridge-mautrix-facebook/tasks/setup_install.yml
+++ b/roles/matrix-bridge-mautrix-facebook/tasks/setup_install.yml
@@ -32,7 +32,7 @@
 
 - name: Ensure Mautrix Facebook repository is present on self-build
   git:
-    repo: https://github.com/tulir/mautrix-facebook.git
+    repo: "{{ matrix_mautrix_facebook_container_image_self_build_repo }}"
     dest: "{{ matrix_mautrix_facebook_docker_src_files_path }}"
 #    version: "{{ matrix_coturn_docker_image.split(':')[1] }}"
     force: "yes"
diff --git a/roles/matrix-bridge-mautrix-hangouts/defaults/main.yml b/roles/matrix-bridge-mautrix-hangouts/defaults/main.yml
index 13bc1a6c..ab670052 100644
--- a/roles/matrix-bridge-mautrix-hangouts/defaults/main.yml
+++ b/roles/matrix-bridge-mautrix-hangouts/defaults/main.yml
@@ -4,6 +4,7 @@
 matrix_mautrix_hangouts_enabled: true
 
 matrix_mautrix_hangouts_container_image_self_build: false
+matrix_mautrix_hangouts_container_image_self_build_repo: "https://github.com/tulir/mautrix-hangouts.git"
 
 # See: https://mau.dev/tulir/mautrix-hangouts/container_registry
 matrix_mautrix_hangouts_docker_image: "{{ matrix_mautrix_hangouts_docker_image_name_prefix }}tulir/mautrix-hangouts:latest"
diff --git a/roles/matrix-bridge-mautrix-hangouts/tasks/setup_install.yml b/roles/matrix-bridge-mautrix-hangouts/tasks/setup_install.yml
index 5dc5f20a..eec5e006 100644
--- a/roles/matrix-bridge-mautrix-hangouts/tasks/setup_install.yml
+++ b/roles/matrix-bridge-mautrix-hangouts/tasks/setup_install.yml
@@ -32,7 +32,7 @@
 
 - name: Ensure Mautrix Hangots repository is present on self build
   git:
-    repo: https://github.com/tulir/mautrix-hangouts.git
+    repo: "{{ matrix_mautrix_hangouts_container_image_self_build_repo }}"
     dest: "{{ matrix_mautrix_hangouts_docker_src_files_path }}"
     force: "yes"
   register: matrix_mautrix_hangouts_git_pull_results
diff --git a/roles/matrix-bridge-mx-puppet-discord/defaults/main.yml b/roles/matrix-bridge-mx-puppet-discord/defaults/main.yml
index 30732000..268bbf8f 100644
--- a/roles/matrix-bridge-mx-puppet-discord/defaults/main.yml
+++ b/roles/matrix-bridge-mx-puppet-discord/defaults/main.yml
@@ -4,6 +4,7 @@
 matrix_mx_puppet_discord_enabled: true
 
 matrix_mx_puppet_discord_container_image_self_build: false
+matrix_mx_puppet_discord_container_image_self_build_repo: "https://github.com/matrix-discord/mx-puppet-discord.git"
 
 # Controls whether the mx-puppet-discord container exposes its HTTP port (tcp/8432 in the container).
 #
diff --git a/roles/matrix-bridge-mx-puppet-discord/tasks/setup_install.yml b/roles/matrix-bridge-mx-puppet-discord/tasks/setup_install.yml
index e36950bd..c3f2b01f 100644
--- a/roles/matrix-bridge-mx-puppet-discord/tasks/setup_install.yml
+++ b/roles/matrix-bridge-mx-puppet-discord/tasks/setup_install.yml
@@ -32,7 +32,7 @@
 
 - name: Ensure MX Puppet Discord repository is present on self build
   git:
-    repo: https://github.com/matrix-discord/mx-puppet-discord.git
+    repo: "{{ matrix_mx_puppet_discord_container_image_self_build_repo }}"
     dest: "{{ matrix_mx_puppet_discord_docker_src_files_path }}"
     force: "yes"
   register: matrix_mx_puppet_discord_git_pull_results
diff --git a/roles/matrix-bridge-mx-puppet-instagram/defaults/main.yml b/roles/matrix-bridge-mx-puppet-instagram/defaults/main.yml
index 108a0a34..21cde53f 100644
--- a/roles/matrix-bridge-mx-puppet-instagram/defaults/main.yml
+++ b/roles/matrix-bridge-mx-puppet-instagram/defaults/main.yml
@@ -4,6 +4,7 @@
 matrix_mx_puppet_instagram_enabled: true
 
 matrix_mx_puppet_instagram_container_image_self_build: false
+matrix_mx_puppet_instagram_container_image_self_build_repo: "https://github.com/Sorunome/mx-puppet-instagram.git"
 
 matrix_mx_puppet_instagram_docker_image: "{{ matrix_mx_puppet_instagram_docker_image_name_prefix }}sorunome/mx-puppet-instagram:latest"
 matrix_mx_puppet_instagram_docker_image_name_prefix: "{{ 'localhost/' if matrix_mx_puppet_instagram_container_image_self_build else 'docker.io/' }}"
diff --git a/roles/matrix-bridge-mx-puppet-instagram/tasks/setup_install.yml b/roles/matrix-bridge-mx-puppet-instagram/tasks/setup_install.yml
index 6b638626..78bd78c1 100644
--- a/roles/matrix-bridge-mx-puppet-instagram/tasks/setup_install.yml
+++ b/roles/matrix-bridge-mx-puppet-instagram/tasks/setup_install.yml
@@ -32,7 +32,7 @@
 
 - name: Ensure mx-puppet-instagram repository is present on self build
   git:
-    repo: https://github.com/Sorunome/mx-puppet-instagram.git
+    repo: "{{ matrix_mx_puppet_instagram_container_image_self_build_repo }}"
     dest: "{{ matrix_mx_puppet_instagram_docker_src_files_path }}"
     force: "yes"
   register: matrix_mx_puppet_instagram_git_pull_results
diff --git a/roles/matrix-bridge-mx-puppet-skype/defaults/main.yml b/roles/matrix-bridge-mx-puppet-skype/defaults/main.yml
index 9e1c71bb..0c16a8ba 100644
--- a/roles/matrix-bridge-mx-puppet-skype/defaults/main.yml
+++ b/roles/matrix-bridge-mx-puppet-skype/defaults/main.yml
@@ -4,6 +4,7 @@
 matrix_mx_puppet_skype_enabled: true
 
 matrix_mx_puppet_skype_container_image_self_build: false
+matrix_mx_puppet_skype_container_image_self_build_repo: "https://github.com/Sorunome/mx-puppet-skype.git"
 
 matrix_mx_puppet_skype_docker_image: "{{ matrix_mx_puppet_skype_docker_image_name_prefix }}sorunome/mx-puppet-skype:latest"
 matrix_mx_puppet_skype_docker_image_name_prefix: "{{ 'localhost/' if matrix_mx_puppet_skype_container_image_self_build else 'docker.io/' }}"
diff --git a/roles/matrix-bridge-mx-puppet-skype/tasks/setup_install.yml b/roles/matrix-bridge-mx-puppet-skype/tasks/setup_install.yml
index 9b04c290..fb5185ed 100644
--- a/roles/matrix-bridge-mx-puppet-skype/tasks/setup_install.yml
+++ b/roles/matrix-bridge-mx-puppet-skype/tasks/setup_install.yml
@@ -32,7 +32,7 @@
 
 - name: Ensure MX Puppet Skype repository is present on self build
   git:
-    repo: https://github.com/Sorunome/mx-puppet-skype.git
+    repo: "{{ matrix_mx_puppet_skype_container_image_self_build_repo }}"
     dest: "{{ matrix_mx_puppet_skype_docker_src_files_path }}"
     force: "yes"
   register: matrix_mx_puppet_skype_git_pull_results
diff --git a/roles/matrix-bridge-mx-puppet-slack/defaults/main.yml b/roles/matrix-bridge-mx-puppet-slack/defaults/main.yml
index 94b37041..96ab7833 100644
--- a/roles/matrix-bridge-mx-puppet-slack/defaults/main.yml
+++ b/roles/matrix-bridge-mx-puppet-slack/defaults/main.yml
@@ -4,6 +4,7 @@
 matrix_mx_puppet_slack_enabled: true
 
 matrix_mx_puppet_slack_container_image_self_build: false
+matrix_mx_puppet_slack_container_image_self_build_repo: "https://github.com/Sorunome/mx-puppet-slack.git"
 
 # Controls whether the mx-puppet-slack container exposes its HTTP port (tcp/8432 in the container).
 #
diff --git a/roles/matrix-bridge-mx-puppet-slack/tasks/setup_install.yml b/roles/matrix-bridge-mx-puppet-slack/tasks/setup_install.yml
index b7cdc13c..2e45ecf6 100644
--- a/roles/matrix-bridge-mx-puppet-slack/tasks/setup_install.yml
+++ b/roles/matrix-bridge-mx-puppet-slack/tasks/setup_install.yml
@@ -32,7 +32,7 @@
 
 - name: Ensure MX Puppet Slack repository is present on self build
   git:
-    repo: https://github.com/Sorunome/mx-puppet-slack.git
+    repo: "{{ matrix_mx_puppet_slack_container_image_self_build_repo }}"
     dest: "{{ matrix_mx_puppet_slack_docker_src_files_path }}"
     force: "yes"
   register: matrix_mx_puppet_slack_git_pull_results
diff --git a/roles/matrix-bridge-mx-puppet-steam/defaults/main.yml b/roles/matrix-bridge-mx-puppet-steam/defaults/main.yml
index cb06bf7d..b5eb8473 100644
--- a/roles/matrix-bridge-mx-puppet-steam/defaults/main.yml
+++ b/roles/matrix-bridge-mx-puppet-steam/defaults/main.yml
@@ -4,6 +4,7 @@
 matrix_mx_puppet_steam_enabled: true
 
 matrix_mx_puppet_steam_container_image_self_build: false
+matrix_mx_puppet_steam_container_image_self_build_repo: "https://github.com/icewind1991/mx-puppet-steam.git"
 
 # Controls whether the mx-puppet-steam container exposes its HTTP port (tcp/8432 in the container).
 #
diff --git a/roles/matrix-bridge-mx-puppet-steam/tasks/setup_install.yml b/roles/matrix-bridge-mx-puppet-steam/tasks/setup_install.yml
index d9679510..7b7f8211 100644
--- a/roles/matrix-bridge-mx-puppet-steam/tasks/setup_install.yml
+++ b/roles/matrix-bridge-mx-puppet-steam/tasks/setup_install.yml
@@ -32,7 +32,7 @@
 
 - name: Ensure MX Puppet Steam repository is present on self build
   git:
-    repo: https://github.com/icewind1991/mx-puppet-steam.git
+    repo: "{{ matrix_mx_puppet_steam_container_image_self_build_repo }}"
     dest: "{{ matrix_mx_puppet_steam_docker_src_files_path }}"
     force: "yes"
   register: matrix_mx_puppet_steam_git_pull_results
diff --git a/roles/matrix-bridge-mx-puppet-twitter/defaults/main.yml b/roles/matrix-bridge-mx-puppet-twitter/defaults/main.yml
index 18c39826..13438a21 100644
--- a/roles/matrix-bridge-mx-puppet-twitter/defaults/main.yml
+++ b/roles/matrix-bridge-mx-puppet-twitter/defaults/main.yml
@@ -4,6 +4,7 @@
 matrix_mx_puppet_twitter_enabled: true
 
 matrix_mx_puppet_twitter_container_image_self_build: false
+matrix_mx_puppet_twitter_container_image_self_build_repo: "https://github.com/Sorunome/mx-puppet-twitter.git"
 
 # Controls whether the mx-puppet-twitter container exposes its HTTP port (tcp/8432 in the container).
 #
diff --git a/roles/matrix-bridge-mx-puppet-twitter/tasks/setup_install.yml b/roles/matrix-bridge-mx-puppet-twitter/tasks/setup_install.yml
index 10e49572..663f822c 100644
--- a/roles/matrix-bridge-mx-puppet-twitter/tasks/setup_install.yml
+++ b/roles/matrix-bridge-mx-puppet-twitter/tasks/setup_install.yml
@@ -32,7 +32,7 @@
 
 - name: Ensure MX Puppet Twitter repository is present on self build
   git:
-    repo: https://github.com/Sorunome/mx-puppet-twitter.git
+    repo: "{{ matrix_mx_puppet_twitter_container_image_self_build_repo }}"
     dest: "{{ matrix_mx_puppet_twitter_docker_src_files_path }}"
     force: "yes"
   register: matrix_mx_puppet_twitter_git_pull_results
diff --git a/roles/matrix-client-element/defaults/main.yml b/roles/matrix-client-element/defaults/main.yml
index 17a04465..cbe70503 100644
--- a/roles/matrix-client-element/defaults/main.yml
+++ b/roles/matrix-client-element/defaults/main.yml
@@ -1,6 +1,7 @@
 matrix_client_element_enabled: true
 
 matrix_client_element_container_image_self_build: false
+matrix_client_element_container_image_self_build_repo: "https://github.com/vector-im/riot-web.git"
 
 matrix_client_element_docker_image: "{{ matrix_client_element_docker_image_name_prefix }}vectorim/element-web:v1.7.14"
 matrix_client_element_docker_image_name_prefix: "{{ 'localhost/' if matrix_client_element_container_image_self_build else 'docker.io/' }}"
diff --git a/roles/matrix-client-element/tasks/setup.yml b/roles/matrix-client-element/tasks/setup.yml
index 81f7842f..3b542b14 100644
--- a/roles/matrix-client-element/tasks/setup.yml
+++ b/roles/matrix-client-element/tasks/setup.yml
@@ -26,7 +26,7 @@
 
 - name: Ensure Element repository is present on self-build
   git:
-    repo: https://github.com/vector-im/riot-web.git
+    repo: "{{ matrix_client_element_container_image_self_build_repo }}"
     dest: "{{ matrix_client_element_docker_src_files_path }}"
     version: "{{ matrix_client_element_docker_image.split(':')[1] }}"
     force: "yes"
diff --git a/roles/matrix-coturn/defaults/main.yml b/roles/matrix-coturn/defaults/main.yml
index 4aae3f06..8cbb3e3f 100644
--- a/roles/matrix-coturn/defaults/main.yml
+++ b/roles/matrix-coturn/defaults/main.yml
@@ -1,6 +1,7 @@
 matrix_coturn_enabled: true
 
 matrix_coturn_container_image_self_build: false
+matrix_coturn_container_image_self_build_repo: "https://github.com/instrumentisto/coturn-docker-image.git"
 
 matrix_coturn_docker_image: "{{ matrix_coturn_docker_image_name_prefix }}instrumentisto/coturn:4.5.1.3"
 matrix_coturn_docker_image_name_prefix: "{{ 'localhost/' if matrix_coturn_container_image_self_build else 'docker.io/' }}"
diff --git a/roles/matrix-coturn/tasks/setup_coturn.yml b/roles/matrix-coturn/tasks/setup_coturn.yml
index fa622caf..1f13da03 100644
--- a/roles/matrix-coturn/tasks/setup_coturn.yml
+++ b/roles/matrix-coturn/tasks/setup_coturn.yml
@@ -25,7 +25,7 @@
 
 - name: Ensure Coturn repository is present on self-build
   git:
-    repo: https://github.com/instrumentisto/coturn-docker-image.git
+    repo: "{{ matrix_coturn_container_image_self_build_repo }}"
     dest: "{{ matrix_coturn_docker_src_files_path }}"
     version: "{{ matrix_coturn_docker_image.split(':')[1] }}"
     force: "yes"
diff --git a/roles/matrix-dynamic-dns/defaults/main.yml b/roles/matrix-dynamic-dns/defaults/main.yml
index 17c57f2c..b33961c1 100644
--- a/roles/matrix-dynamic-dns/defaults/main.yml
+++ b/roles/matrix-dynamic-dns/defaults/main.yml
@@ -23,6 +23,7 @@ matrix_dynamic_dns_systemd_required_services_list: ['docker.service']
 
 # Build the container from source when running in mode
 matrix_dynamic_dns_container_image_self_build: false
+matrix_dynamic_dns_container_image_self_build_repo: "https://github.com/linuxserver/docker-ddclient.git"
 
 # Config paths
 matrix_dynamic_dns_base_path: "{{ matrix_base_data_path }}/dynamic-dns"
diff --git a/roles/matrix-dynamic-dns/tasks/install.yml b/roles/matrix-dynamic-dns/tasks/install.yml
index 9ca1043f..e7b06d95 100644
--- a/roles/matrix-dynamic-dns/tasks/install.yml
+++ b/roles/matrix-dynamic-dns/tasks/install.yml
@@ -23,7 +23,7 @@
 
 - name: Ensure Dynamic DNS repository is present on self build
   git:
-    repo: https://github.com/linuxserver/docker-ddclient.git
+    repo: "{{ matrix_dynamic_dns_container_image_self_build_repo }}"
     dest: "{{ matrix_dynamic_dns_docker_src_files_path }}"
     force: "yes"
   register: matrix_dynamic_dns_git_pull_results
diff --git a/roles/matrix-ma1sd/defaults/main.yml b/roles/matrix-ma1sd/defaults/main.yml
index b86f7ee0..f7a0782d 100644
--- a/roles/matrix-ma1sd/defaults/main.yml
+++ b/roles/matrix-ma1sd/defaults/main.yml
@@ -4,6 +4,7 @@
 matrix_ma1sd_enabled: true
 
 matrix_ma1sd_container_image_self_build: false
+matrix_ma1sd_container_image_self_build_repo: "https://github.com/ma1uta/ma1sd.git"
 
 matrix_ma1sd_architecture: "amd64"
 
diff --git a/roles/matrix-ma1sd/tasks/setup_ma1sd.yml b/roles/matrix-ma1sd/tasks/setup_ma1sd.yml
index 8814e6b9..46acb428 100644
--- a/roles/matrix-ma1sd/tasks/setup_ma1sd.yml
+++ b/roles/matrix-ma1sd/tasks/setup_ma1sd.yml
@@ -52,7 +52,7 @@
 
   - name: Ensure ma1sd repository is present on self-build
     git:
-      repo: https://github.com/ma1uta/ma1sd.git
+      repo: "{{ matrix_ma1sd_container_image_self_build_repo }}"
       dest: "{{ matrix_ma1sd_docker_src_files_path }}"
       version: "{{ matrix_ma1sd_docker_image.split(':')[1].split('-')[0] }}"
       force: "yes"
diff --git a/roles/matrix-registration/defaults/main.yml b/roles/matrix-registration/defaults/main.yml
index c2150488..680e8bfe 100644
--- a/roles/matrix-registration/defaults/main.yml
+++ b/roles/matrix-registration/defaults/main.yml
@@ -4,6 +4,7 @@
 matrix_registration_enabled: true
 
 matrix_registration_container_image_self_build: false
+matrix_registration_container_image_self_build_repo: "https://github.com/ZerataX/matrix-registration"
 
 matrix_registration_base_path: "{{ matrix_base_data_path }}/matrix-registration"
 matrix_registration_config_path: "{{ matrix_registration_base_path }}/config"
@@ -15,7 +16,6 @@ matrix_registration_version: "v0.7.0"
 matrix_registration_docker_image: "{{ matrix_registration_docker_image_name_prefix }}devture/zeratax-matrix-registration:{{ matrix_registration_version }}"
 matrix_registration_docker_image_name_prefix: "{{ 'localhost/' if matrix_registration_container_image_self_build else 'docker.io/' }}"
 matrix_registration_docker_image_force_pull: "{{ matrix_registration_docker_image.endswith(':latest') }}"
-matrix_registration_docker_repo: "https://github.com/ZerataX/matrix-registration"
 
 # A list of extra arguments to pass to the container
 matrix_registration_container_extra_arguments: []
diff --git a/roles/matrix-registration/tasks/setup.yml b/roles/matrix-registration/tasks/setup.yml
index 253f7aea..8427d950 100644
--- a/roles/matrix-registration/tasks/setup.yml
+++ b/roles/matrix-registration/tasks/setup.yml
@@ -28,7 +28,7 @@
 
 - name: Ensure matrix-registration repository is present when self-building
   git:
-    repo: "{{ matrix_registration_docker_repo }}"
+    repo: "{{ matrix_registration_container_image_self_build_repo }}"
     dest: "{{ matrix_registration_docker_src_files_path }}"
     version: "{{ matrix_registration_version }}"
     force: "yes"
diff --git a/roles/matrix-registration/tasks/validate_config.yml b/roles/matrix-registration/tasks/validate_config.yml
index 6b2f0277..90466b46 100644
--- a/roles/matrix-registration/tasks/validate_config.yml
+++ b/roles/matrix-registration/tasks/validate_config.yml
@@ -9,3 +9,12 @@
     - "matrix_registration_shared_secret"
     - "matrix_registration_admin_secret"
     - "matrix_registration_server_location"
+
+- name: (Deprecation) Catch and report renamed settings
+  fail:
+    msg: >-
+      Your configuration contains a variable, which now has a different name.
+      Please change your configuration to rename the variable (`{{ item.old }}` -> `{{ item.new }}`).
+  when: "item.old in vars"
+  with_items:
+    - {'old': 'matrix_registration_docker_repo', 'new': 'matrix_registration_container_image_self_build_repo'}
diff --git a/roles/matrix-synapse-admin/defaults/main.yml b/roles/matrix-synapse-admin/defaults/main.yml
index 6f1d219e..ce149dfd 100644
--- a/roles/matrix-synapse-admin/defaults/main.yml
+++ b/roles/matrix-synapse-admin/defaults/main.yml
@@ -4,7 +4,8 @@
 matrix_synapse_admin_enabled: true
 
 matrix_synapse_admin_container_self_build: false
-matrix_synapse_admin_docker_repo: "https://github.com/Awesome-Technologies/synapse-admin.git"
+matrix_synapse_admin_container_self_build_repo: "https://github.com/Awesome-Technologies/synapse-admin.git"
+
 matrix_synapse_admin_docker_src_files_path: "{{ matrix_base_data_path }}/synapse-admin/docker-src"
 
 matrix_synapse_admin_docker_image: "{{ matrix_synapse_admin_docker_image_name_prefix }}awesometechnologies/synapse-admin:0.5.0"
diff --git a/roles/matrix-synapse-admin/tasks/main.yml b/roles/matrix-synapse-admin/tasks/main.yml
index 3763ba28..b5cb1689 100644
--- a/roles/matrix-synapse-admin/tasks/main.yml
+++ b/roles/matrix-synapse-admin/tasks/main.yml
@@ -2,6 +2,12 @@
   tags:
     - always
 
+- import_tasks: "{{ role_path }}/tasks/validate_config.yml"
+  when: run_setup|bool
+  tags:
+    - setup-all
+    - setup-synapse-admin
+
 - import_tasks: "{{ role_path }}/tasks/setup.yml"
   tags:
     - setup-all
diff --git a/roles/matrix-synapse-admin/tasks/setup.yml b/roles/matrix-synapse-admin/tasks/setup.yml
index d30657d3..a96ec10f 100644
--- a/roles/matrix-synapse-admin/tasks/setup.yml
+++ b/roles/matrix-synapse-admin/tasks/setup.yml
@@ -14,7 +14,7 @@
 
 - name: Ensure matrix-synapse-admin repository is present when self-building
   git:
-    repo: "{{ matrix_synapse_admin_docker_repo }}"
+    repo: "{{ matrix_synapse_admin_container_self_build_repo }}"
     dest: "{{ matrix_synapse_admin_docker_src_files_path }}"
     force: "yes"
   register: matrix_synapse_admin_git_pull_results
diff --git a/roles/matrix-synapse-admin/tasks/validate_config.yml b/roles/matrix-synapse-admin/tasks/validate_config.yml
new file mode 100644
index 00000000..e08680e0
--- /dev/null
+++ b/roles/matrix-synapse-admin/tasks/validate_config.yml
@@ -0,0 +1,10 @@
+---
+
+- name: (Deprecation) Catch and report renamed settings
+  fail:
+    msg: >-
+      Your configuration contains a variable, which now has a different name.
+      Please change your configuration to rename the variable (`{{ item.old }}` -> `{{ item.new }}`).
+  when: "item.old in vars"
+  with_items:
+    - {'old': 'matrix_synapse_admin_docker_repo', 'new': 'matrix_synapse_admin_container_self_build_repo'}
diff --git a/roles/matrix-synapse/defaults/main.yml b/roles/matrix-synapse/defaults/main.yml
index aadb47ee..f5c2c433 100644
--- a/roles/matrix-synapse/defaults/main.yml
+++ b/roles/matrix-synapse/defaults/main.yml
@@ -4,6 +4,7 @@
 matrix_synapse_enabled: true
 
 matrix_synapse_container_image_self_build: false
+matrix_synapse_container_image_self_build_repo: "https://github.com/matrix-org/synapse.git"
 
 matrix_synapse_docker_image: "{{ matrix_synapse_docker_image_name_prefix }}matrixdotorg/synapse:v1.23.0"
 matrix_synapse_docker_image_name_prefix: "{{ 'localhost/' if matrix_synapse_container_image_self_build else 'docker.io/' }}"
diff --git a/roles/matrix-synapse/tasks/synapse/setup_install.yml b/roles/matrix-synapse/tasks/synapse/setup_install.yml
index 3aa2c223..f1abcbcc 100644
--- a/roles/matrix-synapse/tasks/synapse/setup_install.yml
+++ b/roles/matrix-synapse/tasks/synapse/setup_install.yml
@@ -20,7 +20,7 @@
 
 - name: Ensure Synapse repository is present on self-build
   git:
-    repo: https://github.com/matrix-org/synapse.git
+    repo: "{{ matrix_synapse_container_image_self_build_repo }}"
     dest: "{{ matrix_synapse_docker_src_files_path }}"
     version: "{{ matrix_synapse_docker_image.split(':')[1] }}"
     force: "yes"

From e0d7d5f0cac47731ec86b4e60e8ae91d388c38ba Mon Sep 17 00:00:00 2001
From: Slavi Pantaleev <slavi@devture.com>
Date: Sat, 28 Nov 2020 22:11:35 +0200
Subject: [PATCH 38/43] Disable Jitsi recording/transcriptions by default

It's not like it worked anyway, because we don't have the necessary
services installed for transcription (Jigasi), nor recording (Jibri).

Disabling these, should hopefully disable their related elements
in the Jitsi Web UI.

Fixes https://github.com/spantaleev/matrix-docker-ansible-deploy/issues/726
---
 roles/matrix-jitsi/defaults/main.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/roles/matrix-jitsi/defaults/main.yml b/roles/matrix-jitsi/defaults/main.yml
index 85123cf7..924198b4 100644
--- a/roles/matrix-jitsi/defaults/main.yml
+++ b/roles/matrix-jitsi/defaults/main.yml
@@ -4,8 +4,8 @@ matrix_jitsi_base_path: "{{ matrix_base_data_path }}/jitsi"
 
 matrix_jitsi_enable_auth: false
 matrix_jitsi_enable_guests: false
-matrix_jitsi_enable_recording: true
-matrix_jitsi_enable_transcriptions: true
+matrix_jitsi_enable_recording: false
+matrix_jitsi_enable_transcriptions: false
 matrix_jitsi_enable_p2p: true
 
 # Authentication type, must be one of internal, jwt or ldap. Currently only

From d64ad91c25552e1263a73e5a18107c7ff6da1f16 Mon Sep 17 00:00:00 2001
From: Slavi Pantaleev <slavi@devture.com>
Date: Mon, 30 Nov 2020 13:11:15 +0200
Subject: [PATCH 39/43] Add some notes about recent Jitsi changes

A bit late, but still better than nothing.
---
 CHANGELOG.md | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index c350d235..27afb64e 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,3 +1,18 @@
+# 2020-11-27
+
+## Recent Jitsi updates may require configuration changes
+
+We've recently [updated from Jitsi build 4857 to build 5142](https://github.com/spantaleev/matrix-docker-ansible-deploy/pull/719), which brings a lot of configuration changes.
+
+**If you use our default Jitsi settings, you won't have to do anything.**
+
+People who have [fine-tuned Jitsi](docs/configuring-playbook-jitsi.md#optional-fine-tune-jitsi) may find that some options got renamed now, others are gone and yet others still need to be defined in another way.
+
+The next time you run the playbook [installation](docs/installing.md) command, our validation logic will tell you if you're using some variables like that and will recommend a migration path for each one.
+
+Additionally, we've recently disabled transcriptions (`matrix_jitsi_enable_transcriptions: false`) and recording (`matrix_jitsi_enable_recording: false`) by default. These features did not work anyway, because we don't install the required dependencies for them (Jigasi and Jibri, respectively). If you've been somehow pointing your Jitsi installation to some manually installed Jigasi/Jibri service, you may need to toggle these flags back to enabled to have transcriptions and recordings working.
+
+
 # 2020-11-23
 
 ## Breaking change matrix-sms-bridge

From 90078dd2966600c0fcaf8d3f6f415b69bc34f4ac Mon Sep 17 00:00:00 2001
From: Slavi Pantaleev <slavi@devture.com>
Date: Mon, 30 Nov 2020 20:58:21 +0200
Subject: [PATCH 40/43] Add matrix_services_autostart_enabled variable for
 preventing services autostart

Some people requested that `--tags=start` not set up service autostart.

One can now do `--tags=start --extra-vars="matrix_services_autostart_enabled=false"`
to just start services ones and not set up autostarting.
---
 roles/matrix-common-after/tasks/start.yml | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/roles/matrix-common-after/tasks/start.yml b/roles/matrix-common-after/tasks/start.yml
index 4bb59bfe..bad84d92 100644
--- a/roles/matrix-common-after/tasks/start.yml
+++ b/roles/matrix-common-after/tasks/start.yml
@@ -1,5 +1,9 @@
 ---
 
+- name: Deterimne whether we should make services autostart
+  set_fact:
+    matrix_services_autostart_enabled_bool: "{{ true if matrix_services_autostart_enabled|default('') == '' else matrix_services_autostart_enabled|bool }}"
+
 - name: Ensure systemd is reloaded
   service:
     daemon_reload: yes
@@ -14,7 +18,7 @@
 - name: Ensure Matrix services are started
   service:
     name: "{{ item }}"
-    enabled: yes
+    enabled: "{{ matrix_services_autostart_enabled_bool }}"
     state: started
   with_items: "{{ matrix_systemd_services_list }}"
   when: not ansible_check_mode

From 04da1bddf7c6e87af7c4cfa8fe1365008814e1a5 Mon Sep 17 00:00:00 2001
From: Slavi Pantaleev <slavi@devture.com>
Date: Tue, 1 Dec 2020 11:55:18 +0200
Subject: [PATCH 41/43] Update matrix-mautrix-facebook config a bit

This also disables presence if it's disabled for Synapse.
---
 group_vars/matrix_servers                     |  2 ++
 .../defaults/main.yml                         |  4 +++
 .../templates/config.yaml.j2                  | 25 +++++++++++++------
 3 files changed, 23 insertions(+), 8 deletions(-)

diff --git a/group_vars/matrix_servers b/group_vars/matrix_servers
index 07f9a88c..8e46a48f 100755
--- a/group_vars/matrix_servers
+++ b/group_vars/matrix_servers
@@ -201,6 +201,8 @@ matrix_mautrix_facebook_homeserver_token: "{{ matrix_synapse_macaroon_secret_key
 
 matrix_mautrix_facebook_login_shared_secret: "{{ matrix_synapse_ext_password_provider_shared_secret_auth_shared_secret if matrix_synapse_ext_password_provider_shared_secret_auth_enabled else '' }}"
 
+matrix_mautrix_facebook_bridge_presence: "{{ matrix_synapse_use_presence if matrix_synapse_enabled else true }}"
+
 ######################################################################
 #
 # /matrix-bridge-mautrix-facebook
diff --git a/roles/matrix-bridge-mautrix-facebook/defaults/main.yml b/roles/matrix-bridge-mautrix-facebook/defaults/main.yml
index c14a3ace..1547ad71 100644
--- a/roles/matrix-bridge-mautrix-facebook/defaults/main.yml
+++ b/roles/matrix-bridge-mautrix-facebook/defaults/main.yml
@@ -35,6 +35,10 @@ matrix_mautrix_facebook_homeserver_token: ''
 # Can be set to enable automatic double-puppeting via Shared Secret Auth (https://github.com/devture/matrix-synapse-shared-secret-auth).
 matrix_mautrix_facebook_login_shared_secret: ''
 
+matrix_mautrix_facebook_bridge_login_shared_secret_map: "{{ {matrix_mautrix_facebook_homeserver_domain: matrix_mautrix_facebook_login_shared_secret} if matrix_mautrix_facebook_login_shared_secret else {} }}"
+
+matrix_mautrix_facebook_bridge_presence: true
+
 # Default configuration template which covers the generic use case.
 # You can customize it by controlling the various variables inside it.
 #
diff --git a/roles/matrix-bridge-mautrix-facebook/templates/config.yaml.j2 b/roles/matrix-bridge-mautrix-facebook/templates/config.yaml.j2
index 7da7b588..9d8de2d5 100644
--- a/roles/matrix-bridge-mautrix-facebook/templates/config.yaml.j2
+++ b/roles/matrix-bridge-mautrix-facebook/templates/config.yaml.j2
@@ -81,23 +81,32 @@ bridge:
     command_prefix: "!fb"
 
     # Number of chats to sync (and create portals for) on startup/login.
-    # Maximum 20, set 0 to disable automatic syncing.
+    # Set 0 to disable automatic syncing.
     initial_chat_sync: 10
     # Whether or not the Facebook users of logged in Matrix users should be
     # invited to private chats when the user sends a message from another client.
     invite_own_puppet_to_pm: false
-    # Whether or not to use /sync to get presence, read receipts and typing notifications when using
-    # your own Matrix account as the Matrix puppet for your Facebook account.
+    # Whether or not to use /sync to get presence, read receipts and typing notifications
+    # when double puppeting is enabled
     sync_with_custom_puppets: true
-    # Shared secret for https://github.com/devture/matrix-synapse-shared-secret-auth
+    # Whether or not to update the m.direct account data event when double puppeting is enabled.
+    # Note that updating the m.direct event is not atomic (except with mautrix-asmux)
+    # and is therefore prone to race conditions.
+    sync_direct_chat_list: false
+    # Servers to always allow double puppeting from
+    double_puppet_server_map: {}
+    #    example.com: https://example.com
+    # Allow using double puppeting from any server with a valid client .well-known file.
+    double_puppet_allow_discovery: false
+    # Shared secrets for https://github.com/devture/matrix-synapse-shared-secret-auth
     #
     # If set, custom puppets will be enabled automatically for local users
     # instead of users having to find an access token and run `login-matrix`
     # manually.
-    login_shared_secret: {{ matrix_mautrix_facebook_login_shared_secret|to_json }}
-    # Whether or not to bridge presence in both directions. Facebook allows users not to broadcast
-    # presence, but then it won't send other users' presence to the client.
-    presence: true
+    # If using this for other servers than the bridge's server,
+    # you must also set the URL in the double_puppet_server_map.
+    login_shared_secret_map: {{ matrix_mautrix_facebook_bridge_login_shared_secret_map|to_json }}
+    presence: {{ matrix_mautrix_facebook_bridge_presence|to_json }}
     # Whether or not to update avatars when syncing all contacts at startup.
     update_avatar_initial_sync: true
     # End-to-bridge encryption support options. These require matrix-nio to be installed with pip

From 694e6fe1414d0a2c897d0ae4f0495f8832648b48 Mon Sep 17 00:00:00 2001
From: Slavi Pantaleev <slavi@devture.com>
Date: Tue, 1 Dec 2020 15:11:37 +0200
Subject: [PATCH 42/43] Create FUNDING.yml

---
 .github/FUNDING.yml | 4 ++++
 1 file changed, 4 insertions(+)
 create mode 100644 .github/FUNDING.yml

diff --git a/.github/FUNDING.yml b/.github/FUNDING.yml
new file mode 100644
index 00000000..bc3c8e75
--- /dev/null
+++ b/.github/FUNDING.yml
@@ -0,0 +1,4 @@
+# These are supported funding model platforms
+
+# https://liberapay.com/s.pantaleev/
+liberapay: s.pantaleev

From 06ade5e187aeb6931197bb061966ff8b30d9d055 Mon Sep 17 00:00:00 2001
From: Slavi Pantaleev <slavi@devture.com>
Date: Tue, 1 Dec 2020 15:24:07 +0200
Subject: [PATCH 43/43] Add donation and support room badges

---
 README.md | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/README.md b/README.md
index 1a207937..ac2b7ca9 100644
--- a/README.md
+++ b/README.md
@@ -1,3 +1,5 @@
+[![Support room on Matrix](https://img.shields.io/matrix/matrix-docker-ansible-deploy:devture.com.svg?label=%23matrix-docker-ansible-deploy%3Adevture.com&logo=matrix&style=for-the-badge&server_fqdn=matrix.devture.com)](https://matrix.to/#/#matrix-docker-ansible-deploy:devture.com) [![donate](https://liberapay.com/assets/widgets/donate.svg)](https://liberapay.com/s.pantaleev/donate)
+
 # Matrix (An open network for secure, decentralized communication) server setup using Ansible and Docker
 
 ## Purpose