Merge branch 'master' into pub.solar

2021-08-17 14:07:17 +02:00 · 2021-08-17 14:07:17 +02:00 · bdac31e10b
parent 9af287513d c2f91dba1b
commit bdac31e10b
29 changed files with 239 additions and 247 deletions
--- a/docs/howto-server-delegation.md
+++ b/docs/howto-server-delegation.md
@ -82,8 +82,8 @@ Based on your setup, you have different ways to go about it:
 #
 # NOTE: these are in-container paths. `/matrix/ssl` on the host is mounted into the container
 # at the same path (`/matrix/ssl`) by default, so if that's the path you need, it would be seamless.
-matrix_nginx_proxy_proxy_matrix_federation_api_ssl_certificate: /matrix/ssl/config/live/matrix.<your-domain>/fullchain.pem
-matrix_nginx_proxy_proxy_matrix_federation_api_ssl_certificate_key: /matrix/ssl/config/live/matrix.<your-domain>/privkey.pem
+matrix_nginx_proxy_proxy_matrix_federation_api_ssl_certificate: /matrix/ssl/config/live/<your-domain>/fullchain.pem
+matrix_nginx_proxy_proxy_matrix_federation_api_ssl_certificate_key: /matrix/ssl/config/live/<your-domain>/privkey.pem
 ```

 If your files are not in `/matrix/ssl` but in some other location, you would need to mount them into the container:
--- a/docs/importing-postgres.md
+++ b/docs/importing-postgres.md
@ -23,7 +23,7 @@ To import, run this command (make sure to replace `<server-path-to-postgres-dump

 ```sh
 ansible-playbook -i inventory/hosts setup.yml \
--extra-vars='postgres_default_import_database=synapse server_path_postgres_dump=<server-path-to-postgres-dump.sql>' \
+--extra-vars='server_path_postgres_dump=<server-path-to-postgres-dump.sql>' \
 --tags=import-postgres
 ```

--- a/docs/self-building.md
+++ b/docs/self-building.md
@ -29,6 +29,7 @@ List of roles where self-building the Docker image is currently possible:
 - `matrix-bridge-mx-puppet-skype`
 - `matrix-bot-mjolnir`
 - `matrix-bot-matrix-reminder-bot`
+- `matrix-email2matrix`

 Adding self-building support to other roles is welcome. Feel free to contribute!

--- a/group_vars/matrix_servers
+++ b/group_vars/matrix_servers
@ -41,6 +41,8 @@ matrix_awx_enabled: false

 matrix_nginx_proxy_data_path: "{{ '/chroot/website' if (matrix_awx_enabled and not matrix_nginx_proxy_base_domain_homepage_enabled) else (matrix_nginx_proxy_base_path + '/data') }}"
 matrix_nginx_proxy_data_path_in_container: "{{ '/nginx-data/matrix-domain' if (matrix_awx_enabled and not matrix_nginx_proxy_base_domain_homepage_enabled) else '/nginx-data' }}"
+matrix_nginx_proxy_data_path_extension: "{{ '' if (matrix_awx_enabled and not matrix_nginx_proxy_base_domain_homepage_enabled) else '/matrix-domain' }}"
+matrix_nginx_proxy_base_domain_create_directory: "{{ not matrix_awx_enabled }}"

 ######################################################################
 #
@ -1037,6 +1039,8 @@ matrix_dynamic_dns_enabled: false

 matrix_email2matrix_enabled: false

+matrix_email2matrix_container_image_self_build: "{{ matrix_architecture != 'amd64' }}"
+
 ######################################################################
 #
 # /matrix-email2matrix
--- a/roles/matrix-awx/tasks/customise_website_access_export.yml
+++ b/roles/matrix-awx/tasks/customise_website_access_export.yml
@ -176,7 +176,7 @@
    state: directory
    owner: matrix
    group: matrix
-    mode: '0574'
+    mode: '0770'
  when: customise_base_domain_website is defined

 - name: Ensure /chroot/export location exists
--- a/roles/matrix-base/tasks/server_base/setup_debian.yml
+++ b/roles/matrix-base/tasks/server_base/setup_debian.yml
@ -23,14 +23,7 @@
    repo: "deb [arch={{ matrix_debian_arch }}] https://download.docker.com/linux/{{ ansible_distribution|lower }} {{ ansible_distribution_release }} stable"
    state: present
    update_cache: yes
-  when: matrix_docker_installation_enabled|bool and matrix_docker_package_name == 'docker-ce' and not ansible_distribution_release == 'bullseye'
-
- name: Ensure Docker repository is enabled (using Debian Buster on Debian Bullseye, for which there is no Docker yet)
-  apt_repository:
-    repo: "deb [arch={{ matrix_debian_arch }}] https://download.docker.com/linux/{{ ansible_distribution|lower }} buster stable"
-    state: present
-    update_cache: yes
-  when: matrix_docker_installation_enabled|bool and matrix_docker_package_name == 'docker-ce' and ansible_distribution_release == 'bullseye'
+  when: matrix_docker_installation_enabled|bool and matrix_docker_package_name == 'docker-ce'

 - name: Ensure APT packages are installed
  apt:
--- a/roles/matrix-bridge-appservice-irc/defaults/main.yml
+++ b/roles/matrix-bridge-appservice-irc/defaults/main.yml
@ -7,7 +7,7 @@ matrix_appservice_irc_container_self_build: false
 matrix_appservice_irc_docker_repo: "https://github.com/matrix-org/matrix-appservice-irc.git"
 matrix_appservice_irc_docker_src_files_path: "{{ matrix_base_data_path }}/appservice-irc/docker-src"

-matrix_appservice_irc_version: release-0.27.0
+matrix_appservice_irc_version: release-v0.29.0
 matrix_appservice_irc_docker_image: "{{ matrix_container_global_registry_prefix }}matrixdotorg/matrix-appservice-irc:{{ matrix_appservice_irc_version }}"
 matrix_appservice_irc_docker_image_force_pull: "{{ matrix_appservice_irc_docker_image.endswith(':latest') }}"

--- a/roles/matrix-bridge-heisenbridge/defaults/main.yml
+++ b/roles/matrix-bridge-heisenbridge/defaults/main.yml
@ -3,7 +3,7 @@

 matrix_heisenbridge_enabled: true

-matrix_heisenbridge_version: latest
+matrix_heisenbridge_version: 1.0.0
 matrix_heisenbridge_docker_image: "{{ matrix_container_global_registry_prefix }}hif1/heisenbridge:{{ matrix_heisenbridge_version }}"
 matrix_heisenbridge_docker_image_force_pull: "{{ matrix_heisenbridge_docker_image.endswith(':latest') }}"

--- a/roles/matrix-bridge-mautrix-facebook/defaults/main.yml
+++ b/roles/matrix-bridge-mautrix-facebook/defaults/main.yml
@ -4,11 +4,10 @@
 matrix_mautrix_facebook_enabled: true

 matrix_mautrix_facebook_container_image_self_build: false
-matrix_mautrix_facebook_container_image_self_build_repo: "https://github.com/tulir/mautrix-facebook.git"
+matrix_mautrix_facebook_container_image_self_build_repo: "https://mau.dev/mautrix/facebook.git"

-matrix_mautrix_facebook_version: latest
-# See: https://mau.dev/tulir/mautrix-facebook/container_registry
-matrix_mautrix_facebook_docker_image: "{{ matrix_mautrix_facebook_docker_image_name_prefix }}tulir/mautrix-facebook:{{ matrix_mautrix_facebook_version }}"
+matrix_mautrix_facebook_version: v0.3.1
+matrix_mautrix_facebook_docker_image: "{{ matrix_mautrix_facebook_docker_image_name_prefix }}mautrix/facebook:{{ matrix_mautrix_facebook_version }}"
 matrix_mautrix_facebook_docker_image_name_prefix: "{{ 'localhost/' if matrix_mautrix_facebook_container_image_self_build else 'dock.mau.dev/' }}"
 matrix_mautrix_facebook_docker_image_force_pull: "{{ matrix_mautrix_facebook_docker_image.endswith(':latest') }}"

--- a/roles/matrix-bridge-mautrix-facebook/tasks/setup_install.yml
+++ b/roles/matrix-bridge-mautrix-facebook/tasks/setup_install.yml
@ -40,7 +40,7 @@
    source: "{{ 'pull' if ansible_version.major > 2 or ansible_version.minor > 7 else omit }}"
    force_source: "{{ matrix_mautrix_facebook_docker_image_force_pull if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}"
    force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else matrix_mautrix_facebook_docker_image_force_pull }}"
-  when: matrix_mautrix_facebook_enabled|bool and not matrix_mautrix_facebook_container_image_self_build
+  when: not matrix_mautrix_facebook_container_image_self_build

 - name: Ensure Mautrix Facebook paths exist
  file:
@ -63,7 +63,7 @@
 #    version: "{{ matrix_coturn_docker_image.split(':')[1] }}"
    force: "yes"
  register: matrix_mautrix_facebook_git_pull_results
-  when: "matrix_mautrix_facebook_enabled|bool and matrix_mautrix_facebook_container_image_self_build"
+  when: "matrix_mautrix_facebook_container_image_self_build|bool"

 - name: Ensure Mautrix Facebook Docker image is built
  docker_image:
@ -75,7 +75,7 @@
      dockerfile: Dockerfile
      path: "{{ matrix_mautrix_facebook_docker_src_files_path }}"
      pull: yes
-  when: "matrix_mautrix_facebook_enabled|bool and matrix_mautrix_facebook_container_image_self_build|bool"
+  when: "matrix_mautrix_facebook_container_image_self_build|bool"

 - name: Check if an old database file already exists
  stat:
--- a/roles/matrix-bridge-mautrix-hangouts/tasks/setup_install.yml
+++ b/roles/matrix-bridge-mautrix-hangouts/tasks/setup_install.yml
@ -40,7 +40,7 @@
    source: "{{ 'pull' if ansible_version.major > 2 or ansible_version.minor > 7 else omit }}"
    force_source: "{{ matrix_mautrix_hangouts_docker_image_force_pull if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}"
    force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else matrix_mautrix_hangouts_docker_image_force_pull }}"
-  when: matrix_mautrix_hangouts_enabled|bool and not matrix_mautrix_hangouts_container_image_self_build
+  when: not matrix_mautrix_hangouts_container_image_self_build

 - name: Ensure Mautrix Hangouts paths exist
  file:
@ -54,7 +54,7 @@
    - { path: "{{ matrix_mautrix_hangouts_config_path }}", when: true }
    - { path: "{{ matrix_mautrix_hangouts_data_path }}", when: true }
    - { path: "{{ matrix_mautrix_hangouts_docker_src_files_path }}", when: "{{ matrix_mautrix_hangouts_container_image_self_build }}" }
-  when: matrix_mautrix_hangouts_enabled|bool and item.when|bool
+  when: "item.when|bool"

 - name: Ensure Mautrix Hangots repository is present on self build
  git:
@ -62,7 +62,7 @@
    dest: "{{ matrix_mautrix_hangouts_docker_src_files_path }}"
    force: "yes"
  register: matrix_mautrix_hangouts_git_pull_results
-  when: "matrix_mautrix_hangouts_enabled|bool and matrix_mautrix_hangouts_container_image_self_build|bool"
+  when: "matrix_mautrix_hangouts_container_image_self_build|bool"

 - name: Ensure Mautrix Hangouts Docker image is built
  docker_image:
@ -74,7 +74,7 @@
      dockerfile: Dockerfile
      path: "{{ matrix_mautrix_hangouts_docker_src_files_path }}"
      pull: yes
-  when: "matrix_mautrix_hangouts_enabled|bool and matrix_mautrix_hangouts_container_image_self_build|bool"
+  when: "matrix_mautrix_hangouts_container_image_self_build|bool"

 - name: Check if an old database file already exists
  stat:
--- a/roles/matrix-bridge-mautrix-instagram/tasks/setup_install.yml
+++ b/roles/matrix-bridge-mautrix-instagram/tasks/setup_install.yml
@ -13,7 +13,7 @@
    source: "{{ 'pull' if ansible_version.major > 2 or ansible_version.minor > 7 else omit }}"
    force_source: "{{ matrix_mautrix_instagram_docker_image_force_pull if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}"
    force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else matrix_mautrix_instagram_docker_image_force_pull }}"
-  when: matrix_mautrix_instagram_enabled|bool and not matrix_mautrix_instagram_container_image_self_build
+  when: not matrix_mautrix_instagram_container_image_self_build

 - name: Ensure Mautrix instagram paths exist
  file:
@ -38,7 +38,7 @@
    dest: "{{ matrix_mautrix_instagram_docker_src_files_path }}"
    force: "yes"
  register: matrix_mautrix_instagram_git_pull_results
-  when: "matrix_mautrix_instagram_enabled|bool and matrix_mautrix_instagram_container_image_self_build"
+  when: "matrix_mautrix_instagram_container_image_self_build|bool"

 - name: Ensure Mautrix instagram Docker image is built
  docker_image:
@ -50,7 +50,7 @@
      dockerfile: Dockerfile
      path: "{{ matrix_mautrix_instagram_docker_src_files_path }}"
      pull: yes
-  when: "matrix_mautrix_instagram_enabled|bool and matrix_mautrix_instagram_container_image_self_build|bool"
+  when: "matrix_mautrix_instagram_container_image_self_build|bool"

 - name: Ensure mautrix-instagram config.yaml installed
  copy:
--- a/roles/matrix-bridge-mautrix-signal/defaults/main.yml
+++ b/roles/matrix-bridge-mautrix-signal/defaults/main.yml
@ -1,16 +1,16 @@
 # mautrix-signal is a Matrix <-> Signal bridge
-# See: https://github.com/tulir/mautrix-signal
+# See: https://github.com/mautrix/signal

 matrix_mautrix_signal_enabled: true

 matrix_mautrix_signal_container_self_build: false
-matrix_mautrix_signal_docker_repo: "https://mau.dev/tulir/mautrix-signal.git"
+matrix_mautrix_signal_docker_repo: "https://mau.dev/mautrix/signal.git"
 matrix_mautrix_signal_docker_src_files_path: "{{ matrix_base_data_path }}/mautrix-signal/docker-src"

 matrix_mautrix_signal_version: latest
 matrix_mautrix_signal_daemon_version: latest
-# See: https://mau.dev/tulir/mautrix-signal/container_registry
-matrix_mautrix_signal_docker_image: "dock.mau.dev/tulir/mautrix-signal:{{ matrix_mautrix_signal_version }}"
+# See: https://mau.dev/mautrix/signal/container_registry
+matrix_mautrix_signal_docker_image: "dock.mau.dev/mautrix/signal:{{ matrix_mautrix_signal_version }}"
 matrix_mautrix_signal_docker_image_force_pull: "{{ matrix_mautrix_signal_docker_image.endswith(':latest') }}"

 matrix_mautrix_signal_daemon_container_self_build: false
--- a/roles/matrix-bridge-mautrix-signal/tasks/setup_install.yml
+++ b/roles/matrix-bridge-mautrix-signal/tasks/setup_install.yml
@ -14,7 +14,7 @@
    source: "{{ 'pull' if ansible_version.major > 2 or ansible_version.minor > 7 else omit }}"
    force_source: "{{ matrix_mautrix_signal_docker_image_force_pull if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}"
    force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else matrix_mautrix_signal_docker_image_force_pull }}"
-  when: "matrix_mautrix_signal_enabled|bool and not matrix_mautrix_signal_container_self_build|bool"
+  when: "not matrix_mautrix_signal_container_self_build|bool"


 - name: Ensure Mautrix Signal repository is present on self-build
@ -23,7 +23,7 @@
    dest: "{{ matrix_mautrix_signal_docker_src_files_path }}"
    force: "yes"
  register: matrix_mautrix_signal_git_pull_results
-  when: "matrix_mautrix_signal_enabled|bool and matrix_mautrix_signal_container_self_build|bool"
+  when: "matrix_mautrix_signal_container_self_build|bool"

 - name: Ensure Mautrix Signal image is built
  docker_image:
@ -35,8 +35,8 @@
      dockerfile: Dockerfile
      path: "{{ matrix_mautrix_signal_docker_src_files_path }}"
      pull: yes
-  when: "matrix_mautrix_signal_enabled|bool and matrix_mautrix_signal_container_self_build|bool"
-  
+  when: "matrix_mautrix_signal_container_self_build|bool"
+

 - name: Ensure Mautrix Signal Daemon image is pulled
  docker_image:
@ -53,7 +53,7 @@
    dest: "{{ matrix_mautrix_signal_daemon_docker_src_files_path }}"
    force: "yes"
  register: matrix_mautrix_signal_daemon_git_pull_results
-  when: "matrix_mautrix_signal_enabled|bool and matrix_mautrix_signal_daemon_container_self_build|bool"
+  when: "matrix_mautrix_signal_daemon_container_self_build|bool"

 - name: Ensure Mautrix Signal Daemon image is built
  docker_image:
@ -65,7 +65,7 @@
      dockerfile: Dockerfile
      path: "{{ matrix_mautrix_signal_daemon_docker_src_files_path }}"
      pull: yes
-  when: "matrix_mautrix_signal_enabled|bool and matrix_mautrix_signal_daemon_container_self_build|bool"
+  when: "matrix_mautrix_signal_daemon_container_self_build|bool"

 - name: Ensure Mautrix Signal paths exist
  file:
--- a/roles/matrix-bridge-mautrix-signal/templates/config.yaml.j2
+++ b/roles/matrix-bridge-mautrix-signal/templates/config.yaml.j2
@ -9,6 +9,12 @@ homeserver:
    # Only applies if address starts with https://
    verify_ssl: true
    asmux: false
+    # Number of retries for all HTTP requests if the homeserver isn't reachable.
+    http_retry_count: 4
+    # The URL to push real-time bridge status to.
+    # If set, the bridge will make POST requests to this URL whenever a user's Signal connection state changes.
+    # The bridge will use the appservice as_token to authorize requests.
+    status_endpoint: null

 # Application service host/registration related details
 # Changing these values requires regeneration of the registration.
@ -80,6 +86,9 @@ signal:
    avatar_dir: /signald/avatars
    # Directory where signald stores auth data. Used to delete data when logging out.
    data_dir: /signald/data
+    # Whether or not unknown signald accounts should be deleted when the bridge is started.
+    # When this is enabled, any UserInUse errors should be resolved by restarting the bridge.
+    delete_unknown_accounts_on_start: false
    # Whether or not message attachments should be removed from disk after they're bridged.
    remove_file_after_handling: true

@ -164,12 +173,15 @@ bridge:
    # This field will automatically be changed back to false after it,
    # except if the config file is not writable.
    resend_bridge_info: false
+    # Interval at which to resync contacts.
+    periodic_sync: 0

    # The prefix for commands. Only required in non-management rooms.
    command_prefix: "!signal"

    # Permissions for using the bridge.
    # Permitted values:
+    #      relay - Allowed to be relayed through the bridge, no access to commands.
    #       user - Use the bridge with puppeting.
    #      admin - Use and administrate the bridge.
    # Permitted keys:
@ -177,8 +189,30 @@ bridge:
    #   domain - All users on that homeserver
    #     mxid - Specific user
    permissions:
+      '{{ matrix_mautrix_signal_homeserver_domain }}': relay
      '{{ matrix_mautrix_signal_homeserver_domain }}': user

+    relay:
+        # Whether or not relay mode should be allowed. If allowed, `!signal set-relay` can be used to turn any
+        # authenticated user into a relaybot for that chat.
+        enabled: true
+        # The formats to use when sending messages to Signal via a relay user.
+        #
+        # Available variables:
+        #   $sender_displayname - The display name of the sender (e.g. Example User)
+        #   $sender_username    - The username (Matrix ID localpart) of the sender (e.g. exampleuser)
+        #   $sender_mxid        - The Matrix ID of the sender (e.g. @exampleuser:example.com)
+        #   $message            - The message content
+        message_formats:
+            m.text: '$sender_displayname: $message'
+            m.notice: '$sender_displayname: $message'
+            m.emote: '* $sender_displayname $message'
+            m.file: '$sender_displayname sent a file'
+            m.image: '$sender_displayname  sent an image'
+            m.audio: '$sender_displayname  sent an audio file'
+            m.video: '$sender_displayname  sent a video'
+            m.location: '$sender_displayname  sent a location'
+

 # Python logging configuration.
 #
--- a/roles/matrix-bridge-mautrix-whatsapp/defaults/main.yml
+++ b/roles/matrix-bridge-mautrix-whatsapp/defaults/main.yml
@ -5,7 +5,7 @@ matrix_mautrix_whatsapp_enabled: true

 matrix_mautrix_whatsapp_version: latest
 # See: https://mau.dev/tulir/mautrix-whatsapp/container_registry
-matrix_mautrix_whatsapp_docker_image: "dock.mau.dev/tulir/mautrix-whatsapp:{{ matrix_mautrix_whatsapp_version }}"
+matrix_mautrix_whatsapp_docker_image: "dock.mau.dev/mautrix/whatsapp:{{ matrix_mautrix_whatsapp_version }}"
 matrix_mautrix_whatsapp_docker_image_force_pull: "{{ matrix_mautrix_whatsapp_docker_image.endswith(':latest') }}"

 matrix_mautrix_whatsapp_base_path: "{{ matrix_base_data_path }}/mautrix-whatsapp"
--- a/roles/matrix-client-element/defaults/main.yml
+++ b/roles/matrix-client-element/defaults/main.yml
@ -3,7 +3,7 @@ matrix_client_element_enabled: true
 matrix_client_element_container_image_self_build: false
 matrix_client_element_container_image_self_build_repo: "https://github.com/vector-im/riot-web.git"

-matrix_client_element_version: v1.7.33
+matrix_client_element_version: v1.8.0
 matrix_client_element_docker_image: "{{ matrix_client_element_docker_image_name_prefix }}vectorim/element-web:{{ matrix_client_element_version }}"
 matrix_client_element_docker_image_name_prefix: "{{ 'localhost/' if matrix_client_element_container_image_self_build else matrix_container_global_registry_prefix }}"
 matrix_client_element_docker_image_force_pull: "{{ matrix_client_element_docker_image.endswith(':latest') }}"
--- a/roles/matrix-client-hydrogen/defaults/main.yml
+++ b/roles/matrix-client-hydrogen/defaults/main.yml
@ -5,7 +5,7 @@ matrix_client_hydrogen_enabled: true
 matrix_client_hydrogen_container_image_self_build: true
 matrix_client_hydrogen_container_image_self_build_repo: "https://github.com/vector-im/hydrogen-web.git"

-matrix_client_hydrogen_version: v0.2.3
+matrix_client_hydrogen_version: v0.2.5
 matrix_client_hydrogen_docker_image: "{{ matrix_client_hydrogen_docker_image_name_prefix }}vectorim/hydrogen-web:{{ matrix_client_hydrogen_version }}"
 matrix_client_hydrogen_docker_image_name_prefix: "{{ 'localhost/' if matrix_client_hydrogen_container_image_self_build }}"
 matrix_client_hydrogen_docker_image_force_pull: "{{ matrix_client_hydrogen_docker_image.endswith(':latest') }}"
--- a/roles/matrix-common-after/tasks/awx_post.yml
+++ b/roles/matrix-common-after/tasks/awx_post.yml
@ -60,11 +60,5 @@
    state: directory
    owner: matrix
    group: matrix
-    mode: '0574'
-  when: customise_base_domain_website is defined
-
- name: Ensure erroneous /chroot/website/matrix-domain location doesn't exist
-  file:
-    path: /chroot/website/matrix-domain
-    state: absent
+    mode: '0770'
  when: customise_base_domain_website is defined
--- a/roles/matrix-email2matrix/defaults/main.yml
+++ b/roles/matrix-email2matrix/defaults/main.yml
@ -2,9 +2,15 @@ matrix_email2matrix_enabled: true

 matrix_email2matrix_base_path: "{{ matrix_base_data_path }}/email2matrix"
 matrix_email2matrix_config_dir_path: "{{ matrix_email2matrix_base_path }}/config"
+matrix_email2matrix_docker_src_files_path: "{{ matrix_email2matrix_base_path }}/docker-src"
+
+matrix_email2matrix_container_image_self_build: false
+matrix_email2matrix_container_image_self_build_repo: "https://github.com/devture/email2matrix.git"
+matrix_email2matrix_container_image_self_build_branch: "{{ matrix_email2matrix_version }}"

 matrix_email2matrix_version: 1.0.1
-matrix_email2matrix_docker_image: "{{ matrix_container_global_registry_prefix }}devture/email2matrix:{{ matrix_email2matrix_version }}"
+matrix_email2matrix_docker_image_prefix: "{{ 'localhost/' if matrix_email2matrix_container_image_self_build else matrix_container_global_registry_prefix }}"
+matrix_email2matrix_docker_image: "{{ matrix_email2matrix_docker_image_prefix }}devture/email2matrix:{{ matrix_email2matrix_version }}"
 matrix_email2matrix_docker_image_force_pull: "{{ matrix_email2matrix_docker_image.endswith(':latest') }}"

 # A list of extra arguments to pass to the container
--- a/roles/matrix-email2matrix/tasks/main.yml
+++ b/roles/matrix-email2matrix/tasks/main.yml
@ -8,8 +8,14 @@
    - setup-all
    - setup-email2matrix

- import_tasks: "{{ role_path }}/tasks/setup_email2matrix.yml"
-  when: run_setup|bool
+- import_tasks: "{{ role_path }}/tasks/setup_install.yml"
+  when: "run_setup|bool and matrix_email2matrix_enabled|bool"
+  tags:
+    - setup-all
+    - setup-email2matrix
+
+- import_tasks: "{{ role_path }}/tasks/setup_uninstall.yml"
+  when: "run_setup|bool and not matrix_email2matrix_enabled|bool"
  tags:
    - setup-all
    - setup-email2matrix
--- a/roles/matrix-email2matrix/tasks/setup_email2matrix.yml
+++ b/roles/matrix-email2matrix/tasks/setup_email2matrix.yml
@ -1,88 +0,0 @@
---
-
-#
-# Tasks related to setting up Email2Matrix
-#
-
- name: Ensure Email2Matrix paths exist
-  file:
-    path: "{{ item }}"
-    state: directory
-    mode: 0750
-    owner: "{{ matrix_user_username }}"
-    group: "{{ matrix_user_groupname }}"
-  with_items:
-    - "{{ matrix_email2matrix_base_path }}"
-    - "{{ matrix_email2matrix_config_dir_path }}"
-  when: matrix_email2matrix_enabled|bool
-
- name: Ensure Email2Matrix configuration file created
-  template:
-    src: "{{ role_path }}/templates/config.json.j2"
-    dest: "{{ matrix_email2matrix_config_dir_path }}/config.json"
-    owner: "{{ matrix_user_username }}"
-    group: "{{ matrix_user_groupname }}"
-    mode: 0640
-  when: matrix_email2matrix_enabled|bool
-
- name: Ensure Email2Matrix image is pulled
-  docker_image:
-    name: "{{ matrix_email2matrix_docker_image }}"
-    source: "{{ 'pull' if ansible_version.major > 2 or ansible_version.minor > 7 else omit }}"
-    force_source: "{{ matrix_email2matrix_docker_image_force_pull if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}"
-    force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else matrix_email2matrix_docker_image_force_pull }}"
-  when: matrix_email2matrix_enabled|bool
-
- name: Ensure matrix-email2matrix.service installed
-  template:
-    src: "{{ role_path }}/templates/systemd/matrix-email2matrix.service.j2"
-    dest: "{{ matrix_systemd_path }}/matrix-email2matrix.service"
-    mode: 0644
-  register: matrix_email2matrix_systemd_service_result
-  when: matrix_email2matrix_enabled|bool
-
- name: Ensure systemd reloaded after matrix-email2matrix.service installation
-  service:
-    daemon_reload: yes
-  when: "matrix_email2matrix_enabled|bool and matrix_email2matrix_systemd_service_result.changed"
-
-#
-# Tasks related to getting rid of the Email2Matrix (if it was previously enabled)
-#
-
- name: Check existence of matrix-email2matrix service
-  stat:
-    path: "{{ matrix_systemd_path }}/matrix-email2matrix.service"
-  register: matrix_email2matrix_service_stat
-  when: "not matrix_email2matrix_enabled|bool"
-
- name: Ensure matrix-email2matrix is stopped
-  service:
-    name: matrix-email2matrix
-    state: stopped
-    daemon_reload: yes
-  register: stopping_result
-  when: "not matrix_email2matrix_enabled|bool and matrix_email2matrix_service_stat.stat.exists"
-
- name: Ensure matrix-email2matrix.service doesn't exist
-  file:
-    path: "{{ matrix_systemd_path }}/matrix-email2matrix.service"
-    state: absent
-  when: "not matrix_email2matrix_enabled|bool and matrix_email2matrix_service_stat.stat.exists"
-
- name: Ensure systemd reloaded after matrix-email2matrix.service removal
-  service:
-    daemon_reload: yes
-  when: "not matrix_email2matrix_enabled|bool and matrix_email2matrix_service_stat.stat.exists"
-
- name: Ensure Email2Matrix data path doesn't exist
-  file:
-    path: "{{ matrix_email2matrix_base_path }}"
-    state: absent
-  when: "not matrix_email2matrix_enabled|bool"
-
- name: Ensure Email2Matrix Docker image doesn't exist
-  docker_image:
-    name: "{{ matrix_email2matrix_docker_image }}"
-    state: absent
-  when: "not matrix_email2matrix_enabled|bool"
--- a/roles/matrix-email2matrix/tasks/setup_install.yml
+++ b/roles/matrix-email2matrix/tasks/setup_install.yml
@ -0,0 +1,63 @@
+---
+
+- name: Ensure Email2Matrix paths exist
+  file:
+    path: "{{ item.path }}"
+    state: directory
+    mode: 0750
+    owner: "{{ matrix_user_username }}"
+    group: "{{ matrix_user_groupname }}"
+  with_items:
+    - { path: "{{ matrix_email2matrix_base_path }}", when: true }
+    - { path: "{{ matrix_email2matrix_config_dir_path }}", when: true }
+    - { path: "{{ matrix_email2matrix_docker_src_files_path }}", when: "{{ matrix_email2matrix_container_image_self_build }}"}
+  when: "item.when|bool"
+
+- name: Ensure Email2Matrix configuration file created
+  template:
+    src: "{{ role_path }}/templates/config.json.j2"
+    dest: "{{ matrix_email2matrix_config_dir_path }}/config.json"
+    owner: "{{ matrix_user_username }}"
+    group: "{{ matrix_user_groupname }}"
+    mode: 0640
+
+- name: Ensure Email2Matrix image is pulled
+  docker_image:
+    name: "{{ matrix_email2matrix_docker_image }}"
+    source: "{{ 'pull' if ansible_version.major > 2 or ansible_version.minor > 7 else omit }}"
+    force_source: "{{ matrix_email2matrix_docker_image_force_pull if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}"
+    force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else matrix_email2matrix_docker_image_force_pull }}"
+  when: "not matrix_email2matrix_container_image_self_build|bool"
+
+- name: Ensure Email2Matrix repository is present on self-build
+  git:
+    repo: "{{ matrix_email2matrix_container_image_self_build_repo }}"
+    dest: "{{ matrix_email2matrix_docker_src_files_path }}"
+    version: "{{ matrix_email2matrix_container_image_self_build_branch }}"
+    force: "yes"
+  register: matrix_email2matrix_git_pull_results
+  when: "matrix_email2matrix_container_image_self_build|bool"
+
+- name: Ensure Email2Matrix Docker image is built
+  docker_image:
+    name: "{{ matrix_email2matrix_docker_image }}"
+    source: build
+    force_source: "{{ matrix_email2matrix_git_pull_results.changed if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}"
+    force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else matrix_email2matrix_git_pull_results.changed }}"
+    build:
+      dockerfile: etc/docker/Dockerfile
+      path: "{{ matrix_email2matrix_docker_src_files_path }}"
+      pull: yes
+  when: "matrix_email2matrix_container_image_self_build|bool"
+
+- name: Ensure matrix-email2matrix.service installed
+  template:
+    src: "{{ role_path }}/templates/systemd/matrix-email2matrix.service.j2"
+    dest: "{{ matrix_systemd_path }}/matrix-email2matrix.service"
+    mode: 0644
+  register: matrix_email2matrix_systemd_service_result
+
+- name: Ensure systemd reloaded after matrix-email2matrix.service installation
+  service:
+    daemon_reload: yes
+  when: "matrix_email2matrix_systemd_service_result.changed|bool"
--- a/roles/matrix-email2matrix/tasks/setup_uninstall.yml
+++ b/roles/matrix-email2matrix/tasks/setup_uninstall.yml
@ -0,0 +1,35 @@
+---
+
+- name: Check existence of matrix-email2matrix service
+  stat:
+    path: "{{ matrix_systemd_path }}/matrix-email2matrix.service"
+  register: matrix_email2matrix_service_stat
+
+- name: Ensure matrix-email2matrix is stopped
+  service:
+    name: matrix-email2matrix
+    state: stopped
+    daemon_reload: yes
+  register: stopping_result
+  when: "matrix_email2matrix_service_stat.stat.exists|bool"
+
+- name: Ensure matrix-email2matrix.service doesn't exist
+  file:
+    path: "{{ matrix_systemd_path }}/matrix-email2matrix.service"
+    state: absent
+  when: "matrix_email2matrix_service_stat.stat.exists|bool"
+
+- name: Ensure systemd reloaded after matrix-email2matrix.service removal
+  service:
+    daemon_reload: yes
+  when: "matrix_email2matrix_service_stat.stat.exists|bool"
+
+- name: Ensure Email2Matrix data path doesn't exist
+  file:
+    path: "{{ matrix_email2matrix_base_path }}"
+    state: absent
+
+- name: Ensure Email2Matrix Docker image doesn't exist
+  docker_image:
+    name: "{{ matrix_email2matrix_docker_image }}"
+    state: absent
--- a/roles/matrix-nginx-proxy/defaults/main.yml
+++ b/roles/matrix-nginx-proxy/defaults/main.yml
@ -10,6 +10,7 @@ matrix_nginx_proxy_docker_image_force_pull: "{{ matrix_nginx_proxy_docker_image.
 matrix_nginx_proxy_base_path: "{{ matrix_base_data_path }}/nginx-proxy"
 matrix_nginx_proxy_data_path: "{{ matrix_nginx_proxy_base_path }}/data"
 matrix_nginx_proxy_data_path_in_container: "/nginx-data"
+matrix_nginx_proxy_data_path_extension: "/matrix_domain"
 matrix_nginx_proxy_confd_path: "{{ matrix_nginx_proxy_base_path }}/conf.d"

 # List of systemd services that matrix-nginx-proxy.service depends on
@ -75,6 +76,9 @@ matrix_nginx_proxy_container_federation_host_bind_port: '8448'
 # in the `{{ matrix_nginx_proxy_data_path }}/matrix-domain` (`/matrix/nginx-proxy/data/matrix-domain`) directory.
 matrix_nginx_proxy_base_domain_serving_enabled: false

+# Controls whether the base domain directory and default index.html file are created.
+matrix_nginx_proxy_base_domain_create_directory: true
+
 matrix_nginx_proxy_base_domain_hostname: "{{ matrix_domain }}"

 # Controls whether `matrix_nginx_proxy_base_domain_homepage_template` would be dumped to an `index.html` file
--- a/roles/matrix-nginx-proxy/tasks/setup_nginx_proxy.yml
+++ b/roles/matrix-nginx-proxy/tasks/setup_nginx_proxy.yml
@ -127,7 +127,7 @@
    mode: 0750
    owner: "{{ matrix_user_username }}"
    group: "{{ matrix_user_groupname }}"
-  when: matrix_nginx_proxy_base_domain_serving_enabled|bool
+  when: matrix_nginx_proxy_base_domain_serving_enabled|bool and matrix_nginx_proxy_base_domain_create_directory|bool

 - name: Ensure Matrix nginx-proxy homepage for base domain exists
  copy:
@ -136,7 +136,7 @@
    mode: 0644
    owner: "{{ matrix_user_username }}"
    group: "{{ matrix_user_groupname }}"
-  when: matrix_nginx_proxy_base_domain_serving_enabled|bool and matrix_nginx_proxy_base_domain_homepage_enabled|bool
+  when: matrix_nginx_proxy_base_domain_serving_enabled|bool and matrix_nginx_proxy_base_domain_homepage_enabled|bool and matrix_nginx_proxy_base_domain_create_directory|bool

 - name: Ensure Matrix nginx-proxy configuration for base domain exists
  template:
--- a/roles/matrix-nginx-proxy/templates/nginx/conf.d/matrix-base-domain.conf.j2
+++ b/roles/matrix-nginx-proxy/templates/nginx/conf.d/matrix-base-domain.conf.j2
@ -1,7 +1,7 @@
 #jinja2: lstrip_blocks: "True"

 {% macro render_vhost_directives() %}
-	root {{ matrix_nginx_proxy_data_path_in_container if matrix_nginx_proxy_enabled else matrix_nginx_proxy_data_path }}/matrix-domain;
+	root {{ matrix_nginx_proxy_data_path_in_container if matrix_nginx_proxy_enabled else matrix_nginx_proxy_data_path }}{{ matrix_nginx_proxy_data_path_extension }};

 	gzip on;
 	gzip_types text/plain application/json;
--- a/roles/matrix-synapse/defaults/main.yml
+++ b/roles/matrix-synapse/defaults/main.yml
@ -15,8 +15,8 @@ matrix_synapse_docker_image_name_prefix: "{{ 'localhost/' if matrix_synapse_cont
 # amd64 gets released first.
 # arm32 relies on self-building, so the same version can be built immediately.
 # arm64 users need to wait for a prebuilt image to become available.
-matrix_synapse_version: v1.38.1
-matrix_synapse_version_arm64: v1.38.1
+matrix_synapse_version: v1.40.0
+matrix_synapse_version_arm64: v1.40.0
 matrix_synapse_docker_image_tag: "{{ matrix_synapse_version if matrix_architecture in ['arm32', 'amd64'] else matrix_synapse_version_arm64 }}"
 matrix_synapse_docker_image_force_pull: "{{ matrix_synapse_docker_image.endswith(':latest') }}"

@ -453,6 +453,7 @@ matrix_synapse_replication_http_port: 9093
 matrix_synapse_sentry_dsn: ""

 # Postgres database information
+matrix_synapse_database_txn_limit: 0
 matrix_synapse_database_host: "matrix-postgres"
 matrix_synapse_database_port: 5432
 matrix_synapse_database_user: "synapse"
--- a/roles/matrix-synapse/templates/synapse/homeserver.yaml.j2
+++ b/roles/matrix-synapse/templates/synapse/homeserver.yaml.j2
@ -732,9 +732,52 @@ caches:

 ## Database ##

+# The 'database' setting defines the database that synapse uses to store all of
+# its data.
+#
+# 'name' gives the database engine to use: either 'sqlite3' (for SQLite) or
+# 'psycopg2' (for PostgreSQL).
+#
+# 'txn_limit' gives the maximum number of transactions to run per connection
+# before reconnecting. Defaults to 0, which means no limit.
+#
+# 'args' gives options which are passed through to the database engine,
+# except for options starting 'cp_', which are used to configure the Twisted
+# connection pool. For a reference to valid arguments, see:
+#   * for sqlite: https://docs.python.org/3/library/sqlite3.html#sqlite3.connect
+#   * for postgres: https://www.postgresql.org/docs/current/libpq-connect.html#LIBPQ-PARAMKEYWORDS
+#   * for the connection pool: https://twistedmatrix.com/documents/current/api/twisted.enterprise.adbapi.ConnectionPool.html#__init__
+#
+#
+# Example SQLite configuration:
+#
+#database:
+#  name: sqlite3
+#  args:
+#    database: /path/to/homeserver.db
+#
+#
+# Example Postgres configuration:
+#
+#database:
+#  name: psycopg2
+#  txn_limit: 10000
+#  args:
+#    user: synapse_user
+#    password: secretpassword
+#    database: synapse
+#    host: localhost
+#    port: 5432
+#    cp_min: 5
+#    cp_max: 10
+#
+# For more information on using Synapse with Postgres,
+# see https://matrix-org.github.io/synapse/latest/postgres.html.
+#
 database:
  # The database engine name
  name: "psycopg2"
+  txn_limit: {{ matrix_synapse_database_txn_limit }}
  args:
    user: {{ matrix_synapse_database_user|string|to_json }}
    password: {{ matrix_synapse_database_password|string|to_json }}
@ -1314,91 +1357,6 @@ autocreate_auto_join_rooms: {{ matrix_synapse_autocreate_auto_join_rooms|to_json
 #auto_join_rooms_for_guests: false


-## Account Validity ##
-
-# Optional account validity configuration. This allows for accounts to be denied
-# any request after a given period.
-#
-# Once this feature is enabled, Synapse will look for registered users without an
-# expiration date at startup and will add one to every account it found using the
-# current settings at that time.
-# This means that, if a validity period is set, and Synapse is restarted (it will
-# then derive an expiration date from the current validity period), and some time
-# after that the validity period changes and Synapse is restarted, the users'
-# expiration dates won't be updated unless their account is manually renewed. This
-# date will be randomly selected within a range [now + period - d ; now + period],
-# where d is equal to 10% of the validity period.
-#
-account_validity:
-  # The account validity feature is disabled by default. Uncomment the
-  # following line to enable it.
-  #
-  #enabled: true
-
-  # The period after which an account is valid after its registration. When
-  # renewing the account, its validity period will be extended by this amount
-  # of time. This parameter is required when using the account validity
-  # feature.
-  #
-  #period: 6w
-
-  # The amount of time before an account's expiry date at which Synapse will
-  # send an email to the account's email address with a renewal link. By
-  # default, no such emails are sent.
-  #
-  # If you enable this setting, you will also need to fill out the 'email' and
-  # 'public_baseurl' configuration sections.
-  #
-  #renew_at: 1w
-
-  # The subject of the email sent out with the renewal link. '%(app)s' can be
-  # used as a placeholder for the 'app_name' parameter from the 'email'
-  # section.
-  #
-  # Note that the placeholder must be written '%(app)s', including the
-  # trailing 's'.
-  #
-  # If this is not set, a default value is used.
-  #
-  #renew_email_subject: "Renew your %(app)s account"
-
-  # Directory in which Synapse will try to find templates for the HTML files to
-  # serve to the user when trying to renew an account. If not set, default
-  # templates from within the Synapse package will be used.
-  #
-  # The currently available templates are:
-  #
-  # * account_renewed.html: Displayed to the user after they have successfully
-  #       renewed their account.
-  #
-  # * account_previously_renewed.html: Displayed to the user if they attempt to
-  #       renew their account with a token that is valid, but that has already
-  #       been used. In this case the account is not renewed again.
-  #
-  # * invalid_token.html: Displayed to the user when they try to renew an account
-  #       with an unknown or invalid renewal token.
-  #
-  # See https://github.com/matrix-org/synapse/tree/master/synapse/res/templates for
-  # default template contents.
-  #
-  # The file name of some of these templates can be configured below for legacy
-  # reasons.
-  #
-  #template_dir: "res/templates"
-
-  # A custom file name for the 'account_renewed.html' template.
-  #
-  # If not set, the file is assumed to be named "account_renewed.html".
-  #
-  #account_renewed_html_path: "account_renewed.html"
-
-  # A custom file name for the 'invalid_token.html' template.
-  #
-  # If not set, the file is assumed to be named "invalid_token.html".
-  #
-  #invalid_token_html_path: "invalid_token.html"
-
-
 ## Metrics ###

 # Enable collection and rendering of performance metrics
@ -2710,11 +2668,6 @@ stats:
  #
  #enabled: false

-  # The size of each timeslice in the room_stats_historical and
-  # user_stats_historical tables, as a time period. Defaults to "1d".
-  #
-  #bucket_size: 1h
-

 # Server Notices room configuration
 #
@ -2807,19 +2760,6 @@ alias_creation_rules: {{ matrix_synapse_alias_creation_rules|to_json }}
 room_list_publication_rules: {{ matrix_synapse_room_list_publication_rules|to_json }}


-# Server admins can define a Python module that implements extra rules for
-# allowing or denying incoming events. In order to work, this module needs to
-# override the methods defined in synapse/events/third_party_rules.py.
-#
-# This feature is designed to be used in closed federations only, where each
-# participating server enforces the same rules.
-#
-#third_party_event_rules:
-#  module: "my_custom_project.SuperRulesSet"
-#  config:
-#    example_option: 'things'
-
-
 ## Opentracing ##

 # These settings enable opentracing, which implements distributed tracing.