Merge branch 'master' into pub.solar

CHANGELOG.md

@@ -1,3 +1,74 @@
+# 2023-02-26
+
+## Traefik is the default reverse-proxy now
+
+**TLDR**: new installations will now default to Traefik as their reverse-proxy. Existing users need to explicitly choose their reverse-proxy type. [Switching to Traefik](#how-do-i-switch-my-existing-setup-to-traefik) is strongly encouraged. `matrix-nginx-proxy` may break over time and will ultimately be removed.
+
+As mentioned 2 weeks ago in [(Backward Compatibility) Reverse-proxy configuration changes and initial Traefik support](#backward-compatibility-reverse-proxy-configuration-changes-and-initial-traefik-support), the playbook is moving to Traefik as its default SSL-terminating reverse-proxy.
+
+Until now, we've been doing the migration gradually and keeping full backward compatibility. New installations were defaulting to `matrix-nginx-proxy` (just like before), while existing installations were allowed to remain on `matrix-nginx-proxy` as well. This makes things very difficult for us, because we need to maintain and think about lots of different setups:
+
+- Traefik managed by the playbook
+- Traefik managed by the user in another way
+- another reverse-proxy on the same host (`127.0.0.1` port exposure)
+- another reverse-proxy on another host (`0.0.0.0` port exposure)
+- `matrix-nginx-proxy` - an `nginx` container managed by the playbook
+- `nginx` webserver operated by the user, running without a container on the same server
+
+Each change we do and each new feature that comes in needs to support all these different ways of reverse-proxying. Because `matrix-nginx-proxy` was the default and pretty much everyone was (and still is) using it, means that new PRs also come with `matrix-nginx-proxy` as their main focus and Traefik as an afterthought, which means we need to spend hours fixing up Traefik support.
+
+We can't spend all this time maintaining so many different configurations anymore. Traefik support has been an option for 2 weeks and lots of people have  already migrated their server and have tested things out. Traefik is what we use and preferentially test for.
+
+It's time for the **next step in our migration process** to Traefik and elimination of `matrix-nginx-proxy`:
+
+- Traefik is now the default reverse-proxy for new installations
+- All existing users need to explicitly choose their reverse-proxy type by defining the `matrix_playbook_reverse_proxy_type` variable in their `vars.yml` configuration file. We strongly encourage existing users to [switch the Traefik](#how-to-switch-an-existing-setup-to-traefik), as the nginx setup is bound to become more and more broken over time until it's ultimately removed
+
+### How do I switch my existing setup to Traefik?
+
+**For users who are on `matrix-nginx-proxy`** (the default reverse-proxy provided by the playbook), switching to Traefik can happen with a simple configuration change. Follow this section from 2 weeks ago: [How do I explicitly switch to Traefik right now?](#how-do-i-explicitly-switch-to-traefik-right-now).
+
+If you experience trouble:
+
+1. Follow [How do I remain on matrix-nginx-proxy?](#how-do-i-remain-on-matrix-nginx-proxy) to bring your server back online using the old reverse-proxy
+2. Ask for help in our [support channels](README.md#support)
+3. Try switching to Traefik again later
+
+**For users with a more special reverse-proxying setup** (another nginx server, Apache, Caddy, etc.), the migration may not be so smooth. Follow the [Using your own webserver](docs/configuring-playbook-own-webserver.md) guide. Ideally, your custom reverse-proxy will be configured in such a way that it **fronts the Traefik reverse-proxy** provided by the playbook. Other means of reverse-proxying are more fragile and may be deprecated in the future.
+
+### I already use my own Traefik server. How do I plug that in?
+
+See the [Traefik managed by the playbook](docs/configuring-playbook-own-webserver.md#traefik-managed-by-the-playbook) section.
+
+### Why is matrix-nginx-proxy used even after switching to Traefik?
+
+This playbook manages many different services. All these services were initially integrated with `matrix-nginx-proxy`.
+
+While we migrate all these components to have native Traefik support, some still go through nginx internally (Traefik -> local `matrix-nginx-proxy` -> component).
+As time goes on, internal reliance on `matrix-nginx-proxy` will gradually decrease until it's completely removed.
+
+### How do I remain on matrix-nginx-proxy?
+
+Most new work and testing targets Traefik, so remaining on nginx is **not** "the good old stable" option, but rather the "still available, but largely untested and likely to be broken very soon" option.
+
+To proceed regardless of this warning, add `matrix_playbook_reverse_proxy_type: playbook-managed-nginx` to your configuration.
+
+At some point in the **near** future (days, or even weeks at most), we hope to completely get rid of `matrix-nginx-proxy` (or break it enough to make it unusable), so you **will soon be forced to migrate** anyway. Plan your migration accordingly.
+
+### How do I keep using my own other reverse-proxy?
+
+We recommend that you follow the guide for [Fronting the integraed reverse-proxy webserver with another reverse-proxy](docs/configuring-playbook-own-webserver.md#fronting-the-integrated-reverse-proxy-webserver-with-another-reverse-proxy).
+
+
+# 2023-02-25
+
+## Rageshake support
+
+Thanks to [Benjamin Kampmann](https://github.com/gnunicorn), the playbook can now install and configure the [Rageshake](https://github.com/matrix-org/rageshake) bug report server.
+
+Additional details are available in [Setting up Rageshake](docs/configuring-playbook-rageshake.md).
+
+
 # 2023-02-17
 
 ## Synapse templates customization support

README.md

@@ -13,6 +13,15 @@ We run all services in [Docker](https://www.docker.com/) containers (see [the co
 [Installation](docs/README.md) (upgrades) and some maintenance tasks are automated using [Ansible](https://www.ansible.com/) (see [our Ansible guide](docs/ansible.md)).
 
 
+## Self-hosting or SaaS
+
+This Ansible playbook tries to make self-hosting and maintaining a Matrix server fairly easy. Still, running any service smoothly requires knowledge, time and effort.
+
+If you like the [FOSS](https://en.wikipedia.org/wiki/Free_and_open-source_software) spirit of this Ansible playbook, but prefer to put the responsibility on someone else, you can also [get a managed Matrix server from etke.cc](https://etke.cc/) - a service built on top of this Ansible playbook, which can help you run a Matrix server with ease.
+
+If you like learning and experimentation, but would rather reduce future maintenance effort, you can even go for a hybrid approach - self-hosting manually using this Ansible playbook at first and then transferring server maintenance to etke.cc at a later time.
+
+
 ## Supported services
 
 Using this playbook, you can get the following list of services configured on your server. Basically, this playbook aims to get you up-and-running with all the necessities around Matrix, without you having to do anything else.
@@ -52,8 +61,9 @@ Services that run on the server to make the various parts of your installation w
 | ---- | -------- | ----------- | ------------- |
 | [PostgreSQL](https://www.postgresql.org/)| ✓ | Database for Synapse. [Using an external PostgreSQL server](docs/configuring-playbook-external-postgres.md) is also possible. | [Link](docs/configuring-playbook-external-postgres.md) |
 | [Coturn](https://github.com/coturn/coturn) | ✓ | STUN/TURN server for WebRTC audio/video calls | [Link](docs/configuring-playbook-turn.md) |
-| [nginx](http://nginx.org/) | ✓ | Web server, listening on ports 80 and 443 - standing in front of all the other services. Using your own webserver [is possible](docs/configuring-playbook-own-webserver.md) | [Link](docs/configuring-playbook-nginx.md) |
+| [Traefik](https://doc.traefik.io/traefik/) | ✓ | Web server, listening on ports 80, 443 and 8448 - standing in front of all the other services. Using your own webserver [is possible](docs/configuring-playbook-own-webserver.md) | [Link](docs/configuring-playbook-traefik.md) |
-| [Let's Encrypt](https://letsencrypt.org/) | ✓ | Free  SSL certificate, which secures the connection to the Synapse server and the Element web UI | [Link](docs/configuring-playbook-ssl-certificates.md) |
+| [nginx](http://nginx.org/) | x | (Deprecated) Web server, listening on ports 80, 443 and 8448 - standing in front of all the other services. Deprecated in favor of Traefik | [Link](docs/configuring-playbook-nginx.md) |
+| [Let's Encrypt](https://letsencrypt.org/) | ✓ | Free SSL certificate, which secures the connection to all components | [Link](docs/configuring-playbook-ssl-certificates.md) |
 | [ma1sd](https://github.com/ma1uta/ma1sd) | x | Matrix Identity Server | [Link](docs/configuring-playbook-ma1sd.md)
 | [Exim](https://www.exim.org/) | ✓ | Mail server, through which all Matrix services send outgoing email (can be configured to relay through another SMTP server) | [Link](docs/configuring-playbook-email.md) |
 | [Dimension](https://github.com/turt2live/matrix-dimension) | x | An open source integrations manager for matrix clients | [Link](docs/configuring-playbook-dimension.md) |
@@ -144,6 +154,7 @@ Services that help you in administrating and monitoring your matrix installation
 | [synapse-admin](https://github.com/Awesome-Technologies/synapse-admin) | x | A web UI tool for administrating users and rooms on your Matrix server | [Link](docs/configuring-playbook-synapse-admin.md) |
 | Metrics and Graphs | x | Consists of the [Prometheus](https://prometheus.io) time-series database server, the Prometheus [node-exporter](https://prometheus.io/docs/guides/node-exporter/) host metrics exporter, and the [Grafana](https://grafana.com/) web UI | [Link](docs/configuring-playbook-prometheus-grafana.md) |
 | [Borg](https://borgbackup.org) | x | Backups | [Link](docs/configuring-playbook-backup-borg.md) |
+| [Rageshake](https://github.com/matrix-org/rageshake) | x | Bug report server | [Link](docs/configuring-playbook-rageshake.md) |
 
 ### Misc
 
@@ -179,6 +190,16 @@ When updating the playbook, refer to [the changelog](CHANGELOG.md) to catch up w
 - GitHub issues: [spantaleev/matrix-docker-ansible-deploy/issues](https://github.com/spantaleev/matrix-docker-ansible-deploy/issues)
 
 
-## Services by the community
+## Related
 
-- [etke.cc](https://etke.cc) - matrix-docker-ansible-deploy and system stuff "as a service". That service will create your matrix homeserver on your domain and server (doesn't matter if it's cloud provider or on an old laptop in the corner of your room), (optional) maintains it (server's system updates, cleanup, security adjustments, tuning, etc.; matrix homeserver updates & maintenance) and (optional) provide full-featured email service for your domain
+You may also be interested in these other Ansible playbooks:
+
+- [gitea-docker-ansible-deploy](https://github.com/spantaleev/gitea-docker-ansible-deploy) - for deploying a [Gitea](https://gitea.io/) git version-control server
+
+- [nextcloud-docker-ansible-deploy](https://github.com/spantaleev/nextcloud-docker-ansible-deploy) - for deploying a [Nextcloud](https://nextcloud.com/) server
+
+- [peertube-docker-ansible-deploy](https://github.com/spantaleev/peertube-docker-ansible-deploy) - for deploying a [PeerTube](https://joinpeertube.org/) video-platform server
+
+- [vaultwarden-docker-ansible-deploy](https://github.com/spantaleev/vaultwarden-docker-ansible-deploy) - for deploying a [Vaultwarden](https://github.com/dani-garcia/vaultwarden) password manager server (unofficial [Bitwarden](https://bitwarden.com/) compatible server)
+
+They're all making use of Traefik as their reverse-proxy, so it should be easy to host all these services on the same server. Follow the `docs/configuring-playbook-interoperability.md` documentation in each playbook.

docs/configuring-playbook-bot-buscarron.md

@@ -2,8 +2,32 @@
 
 The playbook can install and configure [buscarron](https://gitlab.com/etke.cc/buscarron) for you.
 
-It's a bot you can use to setup **your own helpdesk on matrix**
+Buscarron is bot that receives HTTP POST submissions of web forms and forwards them to a Matrix room.
-It's a bot you can use to send any form (HTTP POST, HTML) to a (encrypted) matrix room
+
+
+## Decide on a domain and path
+
+By default, Buscarron is configured to use its own dedicated domain (`buscarron.DOMAIN`) and requires you to [adjust your DNS records](#adjusting-dns-records).
+
+You can override the domain and path like this:
+
+```yaml
+# Switch to the domain used for Matrix services (`matrix.DOMAIN`),
+# so we won't need to add additional DNS records for Buscarron.
+matrix_bot_buscarron_hostname: "{{ matrix_server_fqn_matrix }}"
+
+# Expose under the /buscarron subpath
+matrix_bot_buscarron_path_prefix: /buscarron
+```
+
+**NOTE**: When using `matrix-nginx-proxy` instead of Traefik, you won't be able to override the path prefix. You can only override the domain, but that needs to happen using another variable: `matrix_server_fqn_buscarron` (e.g. `matrix_server_fqn_buscarron: "form.{{ matrix_domain }}"`).
+
+
+## Adjusting DNS records
+
+Once you've decided on the domain and path, **you may need to adjust your DNS** records to point the Buscarron domain to the Matrix server.
+
+If you've decided to reuse the `matrix.` domain, you won't need to do any extra DNS configuration.
 
 
 ## Adjusting the playbook configuration
@@ -31,16 +55,6 @@ matrix_bot_buscarron_forms:
 matrix_bot_buscarron_spamlist: [] # (optional) list of emails/domains/hosts (with wildcards support) that should be rejected automatically
 ```
 
-You will also need to add a DNS record so that buscarron can be accessed.
-By default buscarron will use https://buscarron.DOMAIN so you will need to create an CNAME record for `buscarron`.
-See [Configuring DNS](configuring-dns.md).
-
-If you would like to use a different domain, add the following to your configuration file (changing it to use your preferred domain):
-
-```yaml
-matrix_server_fqn_buscarron: "form.{{ matrix_domain }}"
-```
-
 
 ## Installing
 
@@ -67,4 +81,12 @@ To use the bot, invite the `@bot.buscarron:DOMAIN` to the room you specified in
 </form>
 ```
 
+**NOTE**: to fight against spam, Buscarron is **very aggressive when it comes to banning** and will ban you if:
+
+- if you hit the homepage (HTTP `GET` request to `/`)
+- if you submit a form to the wrong URL (`POST` request to `/non-existing-form`)
+- if `hasemail` is enabled for the form (like in the example above) and you don't submit an `email` field
+
+If you get banned, you'd need to restart the process by running the playbook with `--tags=start` or running `systemctl restart matrix-bot-buscarron` on the server.
+
 You can also refer to the upstream [documentation](https://gitlab.com/etke.cc/buscarron).

docs/configuring-playbook-nginx.md

@@ -1,7 +1,6 @@
 # Configure Nginx (optional, advanced)
 
-By default, this playbook installs its own nginx webserver (in a Docker container) which listens on ports 80 and 443.
+**Note**: the playbook is [in the process of moving to Traefik](../CHANGELOG.md#reverse-proxy-configuration-changes-and-initial-traefik-support). Traefik is already the default reverse-proxy for new installations and existing users are also strongly encouraged to switch to Traefik. As such, this **nginx documentation below may be incomplete or misleading**.
-If that's alright, you can skip this.
 
 
 ## Using Nginx status

docs/configuring-playbook-own-webserver.md

@@ -1,4 +1,4 @@
-# Using your own webserver, instead of this playbook's nginx proxy (optional, advanced)
+# Using your own webserver, instead of this playbook's Traefik reverse-proxy (optional, advanced)
 
 **Note**: the playbook is [in the process of moving to Traefik](../CHANGELOG.md#reverse-proxy-configuration-changes-and-initial-traefik-support). The **documentation below may be incomplete or misleading**.
 
@@ -33,6 +33,8 @@ This will install Traefik in the place of `matrix-nginx-proxy`. Traefik will man
 matrix_playbook_reverse_proxy_type: other-traefik-container
 
 matrix_playbook_reverse_proxyable_services_additional_network: your-traefik-network
+
+devture_traefik_certs_dumper_ssl_dir_path: "/path/to/your/traefiks/acme.json/directory"
 ```
 
 In this mode all roles will still have Traefik labels attached. You will, however, need to configure your Traefik instance and its entrypoints.
@@ -115,17 +117,39 @@ There are 2 ways to go about it:
 
 This method is about leaving the integrated reverse-proxy webserver be, but making it not get in the way (using up important ports, trying to retrieve SSL certificates, etc.).
 
-If you wish to use another webserver, the integrated nginx reverse-proxy webserver usually gets in the way because it attempts to fetch SSL certificates and binds to ports 80, 443 and 8448 (if Matrix Federation is enabled).
+If you wish to use another webserver, the integrated reverse-proxy webserver usually gets in the way because it attempts to fetch SSL certificates and binds to ports 80, 443 and 8448 (if Matrix Federation is enabled).
 
 You can disable such behavior and make the integrated reverse-proxy webserver only serve traffic locally (or over a local network).
 
 This is the recommended way for using another reverse-proxy, because the integrated one would act as a black box and wire all Matrix services correctly. You would only need to reverse-proxy a few individual domains and ports over to it.
 
-**For `matrix-nginx-proxy`** fronted by another reverse-proxy, you would need some configuration like this:
+**For Traefik** fronted by another reverse-proxy, you would need some configuration like this:
 
 ```yaml
-# playbook-managed-proxy is the default right now, so we can keep this commented out.
+matrix_playbook_reverse_proxy_type: playbook-managed-traefik
-# matrix_playbook_reverse_proxy_type: playbook-managed-nginx
+
+# Ensure that public urls use https
+matrix_playbook_ssl_enabled: true
+
+# Disable the web-secure (port 443) endpoint, which also disables SSL certificate retrieval
+devture_traefik_config_entrypoint_web_secure_enabled: false
+
+devture_traefik_container_web_host_bind_port: '127.0.0.1:81'
+
+devture_traefik_additional_entrypoints_auto:
+  - name: matrix-federation
+    port: "{{ matrix_federation_public_port }}"
+    host_bind_port: "127.0.0.1:{{ matrix_federation_public_port }}"
+    config: {}
+```
+
+(Deprecated) **For `matrix-nginx-proxy`** fronted by another reverse-proxy, you would need some configuration like this:
+
+```yaml
+matrix_playbook_reverse_proxy_type: playbook-managed-nginx
+
+# Ensure that public urls use https
+matrix_playbook_ssl_enabled: true
 
 # Disable SSL certificate retrieval
 matrix_ssl_retrieval_method: none
@@ -145,25 +169,9 @@ matrix_nginx_proxy_container_http_host_bind_port: '127.0.0.1:81'
 matrix_nginx_proxy_container_federation_host_bind_port: '127.0.0.1:8449'
 ```
 
-**For Traefik** fronted by another reverse-proxy, you would need some configuration like this:
-
-```yaml
-matrix_playbook_reverse_proxy_type: playbook-managed-traefik
-
-# Disable the web-secure (port 443) endpoint, which also disables SSL certificate retrieval
-devture_traefik_config_entrypoint_web_secure_enabled: false
-
-devture_traefik_container_web_host_bind_port: '127.0.0.1:81'
-
-devture_traefik_additional_entrypoints_auto:
-  - name: matrix-federation
-    port: "{{ matrix_federation_public_port }}"
-    host_bind_port: "127.0.0.1:{{ matrix_federation_public_port }}"
-    config: {}
-```
-
 If you'll be fronting with a reverse-proxy that lives on another machine (not on the same one as Matrix), you need to replace `127.0.0.1` in the above configurations with `0.0.0.0` or another network interface.
 
+
 ### Using no reverse-proxy on the Matrix side at all
 
 Instead of [Fronting the integrated reverse-proxy webserver with another reverse-proxy](#fronting-the-integrated-reverse-proxy-webserver-with-another-reverse-proxy), you can also go another way -- completely disabling the playbook-managed reverse-proxy. You would then need to reverse-proxy from your own webserver directly to Matrix services.
@@ -174,11 +182,16 @@ If your webserver is on the same machine, sure your web server user (something l
 
 #### Using your own nginx reverse-proxy running on the same machine
 
+**WARNING**: this type of setup is not maintained and will be removed in the future. We recommend that you go for [Fronting the integrated reverse-proxy webserver with another reverse-proxy](#fronting-the-integrated-reverse-proxy-webserver-with-another-reverse-proxy) instead.
+
 If you'll be using `nginx` running on the same machine (not in a container), you can make the playbook help you generate configuration for `nginx` with this configuration:
 
 ```yaml
 matrix_playbook_reverse_proxy_type: other-nginx-non-container
 
+# If you want https configured in /matrix/nginx-proxy/conf.d/
+matrix_nginx_proxy_https_enabled: true
+
 # If you will manage SSL certificates yourself, uncomment the line below
 # matrix_ssl_retrieval_method: none
 
@@ -191,6 +204,8 @@ You can most likely directly use the config files installed by this playbook at:
 
 #### Using your own reverse-proxy running on the same machine or elsewhere
 
+**WARNING**: this is difficult to set up, likely not very well supported and will be removed in the future. We recommend that you go for [Fronting the integrated reverse-proxy webserver with another reverse-proxy](#fronting-the-integrated-reverse-proxy-webserver-with-another-reverse-proxy) instead.
+
 To reverse-proxy manually for each service, use configuration like this:
 
 ```yaml

docs/configuring-playbook-rageshake.md

@@ -0,0 +1,65 @@
+# Setting up Rageshake (optional)
+
+The playbook can install and configure the [rageshake](https://github.com/matrix-org/rageshake) bug report server for you.
+
+This is useful if you're developing your own applications and would like to collect bug reports for them.
+
+
+## Decide on a domain and path
+
+By default, Rageshake is configured to use its own dedicated domain (`rageshake.DOMAIN`) and requires you to [adjust your DNS records](#adjusting-dns-records).
+
+You can override the domain and path like this:
+
+```yaml
+# Switch to the domain used for Matrix services (`matrix.DOMAIN`),
+# so we won't need to add additional DNS records for Rageshake.
+matrix_rageshake_hostname: "{{ matrix_server_fqn_matrix }}"
+
+# Expose under the /rageshake subpath
+matrix_rageshake_path_prefix: /rageshake
+```
+
+**NOTE**: When using `matrix-nginx-proxy` instead of Traefik, you won't be able to override the path prefix. You can only override the domain, but that needs to happen using another variable: `matrix_server_fqn_rageshake` (e.g. `matrix_server_fqn_rageshake: "some-domain.{{ matrix_domain }}"`).
+
+
+## Adjusting DNS records
+
+Once you've decided on the domain and path, **you may need to adjust your DNS** records to point the Rageshake domain to the Matrix server.
+
+If you've decided to reuse the `matrix.` domain, you won't need to do any extra DNS configuration.
+
+
+## Enabling the Rageshake service
+
+Add the following configuration to your `inventory/host_vars/matrix.DOMAIN/vars.yml` file (adapt to your needs):
+
+```yaml
+matrix_rageshake_enabled: true
+```
+
+Rageshake has various options which don't have dedicated Ansible variables. You can see the full list of options in the [`rageshake.sample.yaml` file](https://github.com/matrix-org/rageshake/blob/master/rageshake.sample.yaml).
+
+To set these, you can make use of the  `matrix_rageshake_configuration_extension_yaml` variable like this:
+
+```yaml
+matrix_rageshake_configuration_extension_yaml: |
+  github_token: secrettoken
+
+  github_project_mappings:
+     my-app: octocat/HelloWorld
+```
+
+
+## Installing
+
+After configuring the playbook, run the [installation](installing.md) command again:
+
+```
+ansible-playbook -i inventory/hosts setup.yml --tags=setup-all,start
+```
+
+
+## Usage
+
+Refer to the [rageshake documentation](https://github.com/matrix-org/rageshake) for available APIs, etc.

docs/configuring-playbook-ssl-certificates.md

@@ -1,112 +1,34 @@
 # Adjusting SSL certificate retrieval (optional, advanced)
 
-By default, this playbook retrieves and auto-renews free SSL certificates from [Let's Encrypt](https://letsencrypt.org/) for the domains it needs (`matrix.<your-domain>` and possibly `element.<your-domain>`)
+By default, this playbook retrieves and auto-renews free SSL certificates from [Let's Encrypt](https://letsencrypt.org/) for the domains it needs (e.g. `matrix.<your-domain>` and others)
 
-Those certificates are used when configuring the nginx reverse proxy installed by this playbook.
+This guide is about using the integrated Traefik server and doesn't apply if you're using [your own webserver](configuring-playbook-own-webserver.md).
-They can also be used for configuring [your own webserver](configuring-playbook-own-webserver.md), in case you're not using the integrated nginx server provided by the playbook.
 
-If you need to retrieve certificates for other domains (e.g. your base domain) or more control over certificate retrieval, read below.
 
-Things discussed in this document:
+## Using staging Let's Encrypt certificates instead of real ones
 
-- [Using self-signed SSL certificates](#using-self-signed-ssl-certificates), if you can't use Let's Encrypt or just need a test setup
+For testing purposes, you may wish to use staging certificates provide by Let's Encrypt.
 
-- [Using your own SSL certificates](#using-your-own-ssl-certificates), if you don't want to or can't use Let's Encrypt certificates, but are still interested in using the integrated nginx reverse proxy server
+You can do this with the following configuration:
 
-- [Not bothering with SSL certificates](#not-bothering-with-ssl-certificates), if you're using [your own webserver](configuring-playbook-own-webserver.md) and would rather this playbook leaves SSL certificate management to you
+```yaml
+devture_traefik_config_certificatesResolvers_acme_use_staging: true
+```
 
-- [Obtaining SSL certificates for additional domains](#obtaining-ssl-certificates-for-additional-domains), if you'd like to host additional domains on the Matrix server and would like the playbook to help you obtain and renew certificates for those domains automatically
+
+## Disabling SSL termination
+
+For testing or other purposes, you may wish to install services without SSL termination and have services exposed to `http://` instead of `https://`.
+
+You can do this with the following configuration:
+
+```yaml
+devture_traefik_config_entrypoint_web_secure_enabled: false
+```
 
 
 ## Using self-signed SSL certificates
 
-For private deployments (not publicly accessible from the internet), you may not be able to use Let's Encrypt certificates.
+Using self-signed certificates with Traefik is a somewhat involved processes, where you need to manually mount the files into the container and adjust the "static" configuration to refer to them.
 
-If self-signed certificates are alright with you, you can ask the playbook to generate such for you with the following configuration:
+Feel free to research this approach on your own and improve this guide!
-
-```yaml
-matrix_ssl_retrieval_method: self-signed
-```
-
-If you get a `Cannot reach homeserver` error in Element, you will have to visit `https://matrix.<your-domain>` in your browser and agree to the certificate exception before you can login.
-
-
-## Using your own SSL certificates
-
-If you'd like to manage SSL certificates by yourself and have the playbook use your certificate files, you can use the following configuration:
-
-```yaml
-matrix_ssl_retrieval_method: manually-managed
-```
-
-With such a configuration, the playbook would expect you to drop the SSL certificate files in the directory specified by `matrix_ssl_config_dir_path` (`/matrix/ssl/config` by default) obeying the following hierarchy:
-
-- `<matrix_ssl_config_dir_path>/live/<domain>/fullchain.pem`
-- `<matrix_ssl_config_dir_path>/live/<domain>/privkey.pem`
-- `<matrix_ssl_config_dir_path>/live/<domain>/chain.pem`
-
-where `<domain>` refers to the domains that you need (usually `matrix.<your-domain>` and `element.<your-domain>`).
-
-
-## Not bothering with SSL certificates
-
-If you're [using an external web server](configuring-playbook-own-webserver.md) which is not nginx, or you would otherwise want to manage its certificates without this playbook getting in the way, you can completely disable SSL certificate management with the following configuration:
-
-```yaml
-matrix_ssl_retrieval_method: none
-```
-
-With such a configuration, no certificates will be retrieved at all. You're free to manage them however you want.
-
-
-## Obtaining SSL certificates for additional domains
-
-The playbook tries to be smart about the certificates it will obtain for you.
-
-By default, it obtains certificates for:
-- `matrix.<your-domain>` (`matrix_server_fqn_matrix`)
-- possibly for `element.<your-domain>`, unless you have disabled the [Element client component](configuring-playbook-client-element.md) using `matrix_client_element_enabled: false`
-- possibly for `riot.<your-domain>`, if you have explicitly enabled Riot to Element redirection (for background compatibility) using `matrix_nginx_proxy_proxy_riot_compat_redirect_enabled: true`
-- possibly for `hydrogen.<your-domain>`, if you have explicitly [set up Hydrogen client](configuring-playbook-client-hydrogen.md).
-- possibly for `cinny.<your-domain>`, if you have explicitly [set up Cinny client](configuring-playbook-client-cinny.md).
-- possibly for `dimension.<your-domain>`, if you have explicitly [set up Dimension](configuring-playbook-dimension.md).
-- possibly for `goneb.<your-domain>`, if you have explicitly [set up Go-NEB bot](configuring-playbook-bot-go-neb.md).
-- possibly for `jitsi.<your-domain>`, if you have explicitly [set up Jitsi](configuring-playbook-jitsi.md).
-- possibly for `stats.<your-domain>`, if you have explicitly [set up Grafana](configuring-playbook-prometheus-grafana.md).
-- possibly for `sygnal.<your-domain>`, if you have explicitly [set up Sygnal](configuring-playbook-sygnal.md).
-- possibly for `ntfy.<your-domain>`, if you have explicitly [set up ntfy](configuring-playbook-ntfy.md).
-- possibly for your base domain (`<your-domain>`), if you have explicitly configured [Serving the base domain](configuring-playbook-base-domain-serving.md)
-
-If you are hosting other domains on the Matrix machine, you can make the playbook obtain and renew certificates for those other domains too.
-To do that, simply define your own custom configuration like this:
-
-```yaml
-# In this example, we retrieve 2 extra certificates,
-# one for the base domain (in the `matrix_domain` variable) and one for a hardcoded domain.
-# Adding any other additional domains (hosted on the same machine) is possible.
-matrix_ssl_additional_domains_to_obtain_certificates_for:
-  - '{{ matrix_domain }}'
-  - 'another.domain.example.com'
-```
-
-After redefining `matrix_ssl_domains_to_obtain_certificates_for`, to actually obtain certificates you should:
-
-- make sure the web server occupying port 80 is stopped. If you are using matrix-nginx-proxy server (which is the default for this playbook), you need to stop it temporarily by running `systemctl stop matrix-nginx-proxy` on the server.
-
-- re-run the SSL part of the playbook and restart all services: `ansible-playbook -i inventory/hosts setup.yml --tags=setup-ssl,start`
-
-The certificate files would be made available in `/matrix/ssl/config/live/<your-other-domain>/...`.
-
-For automated certificate renewal to work, each port `80` vhost for each domain you are obtaining certificates for needs to forward requests for `/.well-known/acme-challenge` to the certbot container we use for renewal.
-
-See how this is configured for the `matrix.` subdomain in `/matrix/nginx-proxy/conf.d/matrix-domain.conf`
-Don't be alarmed if the above configuration file says port `8080`, instead of port `80`. It's due to port mapping due to our use of containers.
-
-
-## Specify the SSL private key algorithm
-
-If you'd like to [specify the private key type](https://eff-certbot.readthedocs.io/en/stable/using.html#using-ecdsa-keys) used with Let's Encrypt, define your own custom configuration like this:
-
-```yaml
-matrix_ssl_lets_encrypt_key_type: ecdsa
-```

docs/configuring-playbook-sygnal.md

@@ -11,6 +11,31 @@ See the project's [documentation](https://github.com/matrix-org/sygnal) to learn
 This optional playbook component is only useful to people who develop/build their own Matrix client applications themselves.
 
 
+## Decide on a domain and path
+
+By default, Sygnal is configured to use its own dedicated domain (`sygnal.DOMAIN`) and requires you to [adjust your DNS records](#adjusting-dns-records).
+
+You can override the domain and path like this:
+
+```yaml
+# Switch to the domain used for Matrix services (`matrix.DOMAIN`),
+# so we won't need to add additional DNS records for Sygnal.
+matrix_sygnal_hostname: "{{ matrix_server_fqn_matrix }}"
+
+# Expose under the /sygnal subpath
+matrix_sygnal_path_prefix: /sygnal
+```
+
+**NOTE**: When using `matrix-nginx-proxy` instead of Traefik, you won't be able to override the path prefix. You can only override the domain, but that needs to happen using another variable: `matrix_server_fqn_sygnal` (e.g. `matrix_server_fqn_sygnal: "push.{{ matrix_domain }}"`).
+
+
+## Adjusting DNS records
+
+Once you've decided on the domain and path, **you may need to adjust your DNS** records to point the Sygnal domain to the Matrix server.
+
+If you've decided to reuse the `matrix.` domain, you won't need to do any extra DNS configuration.
+
+
 ## Adjusting the playbook configuration
 
 Add the following configuration to your `inventory/host_vars/matrix.DOMAIN/vars.yml` file (adapt to your needs):
@@ -55,9 +80,7 @@ To do that, the above example configuration:
 
 ## Installing
 
-Don't forget to add `sygnal.<your-domain>` to DNS as described in [Configuring DNS](configuring-dns.md) before running the playbook.
+After configuring the playbook and potentially [adjusting your DNS records](#adjusting-dns-records), run the [installation](installing.md) command:
-
-After configuring the playbook, run the [installation](installing.md) command again:
 
 ```
 ansible-playbook -i inventory/hosts setup.yml --tags=setup-all,start
@@ -66,6 +89,6 @@ ansible-playbook -i inventory/hosts setup.yml --tags=setup-all,start
 
 ## Usage
 
-To make use of your Sygnal installation, you'd need to build your own Matrix client application, which uses the same API keys (for [GCM/FCM](https://firebase.google.com/docs/cloud-messaging/)) and certificates (for [APNS](https://developer.apple.com/notifications/)) and is also pointed to `https://sygnal.DOMAIN` as the configured push server.
+To make use of your Sygnal installation, you'd need to build your own Matrix client application, which uses the same API keys (for [GCM/FCM](https://firebase.google.com/docs/cloud-messaging/)) and certificates (for [APNS](https://developer.apple.com/notifications/)) and is to your Sygnal URL endpoint (e.g. `https://sygnal.DOMAIN`).
 
 Refer to Sygnal's [Notes for application developers](https://github.com/matrix-org/sygnal/blob/master/docs/applications.md) document.

docs/configuring-playbook-traefik.md

@@ -0,0 +1,48 @@
+# Configure Traefik (optional, advanced)
+
+By default, this playbook installs and manages a [Traefik](https://doc.traefik.io/traefik/) reverse-proxy server, powered by the [com.devture.ansible.role.traefik](https://github.com/devture/com.devture.ansible.role.traefik) Ansible role.
+
+This Ansible role support various configuration options. Feel free to consult its `default/main.yml` variables file.
+
+
+## Adjusting SSL certificate retrieval
+
+See the dedicated [Adjusting SSL certificate retrieval](configuring-playbook-ssl-certificates.md) documentation page.
+
+## Increase logging verbosity
+
+```yaml
+devture_traefik_config_log_level: DEBUG
+```
+
+## Disable access logs
+
+This will disable access logging.
+
+```yaml
+devture_traefik_config_accessLog_enabled: false
+```
+
+## Enable Traefik Dashboard
+
+This will enable a Traefik [Dashboard](https://doc.traefik.io/traefik/operations/dashboard/) UI at `https://matrix.DOMAIN/dashboard/` (note the trailing `/`).
+
+```yaml
+devture_traefik_dashboard_enabled: true
+devture_traefik_dashboard_hostname: "{{ matrix_server_fqn_matrix }}"
+devture_traefik_dashboard_basicauth_enabled: true
+devture_traefik_dashboard_basicauth_user: YOUR_USERNAME_HERE
+devture_traefik_dashboard_basicauth_password: YOUR_PASSWORD_HERE
+```
+
+## Additional configuration
+
+Use the `devture_traefik_configuration_extension_yaml` variable provided by the Traefik Ansible role to override or inject additional settings, even when no dedicated variable exists.
+
+```yaml
+# This is a contrived example.
+# You can enable and secure the Dashboard using dedicated variables. See above.
+devture_traefik_configuration_extension_yaml: |
+  api:
+    dashboard: true
+```

docs/configuring-playbook.md

@@ -59,9 +59,11 @@ When you're done with all the configuration you'd like to do, continue with [Ins
 
 - [Serving your base domain using this playbook's nginx server](configuring-playbook-base-domain-serving.md) (optional)
 
-- [Configure Nginx](configuring-playbook-nginx.md) (optional, advanced)
+- [Configure the Traefik reverse-proxy](configuring-playbook-traefik.md) (optional, advanced)
 
-- [Using your own webserver, instead of this playbook's nginx proxy](configuring-playbook-own-webserver.md) (optional, advanced)
+- (Deprecated) [Configure the Nginx reverse-proxy](configuring-playbook-nginx.md) (optional, advanced)
+
+- [Using your own webserver, instead of this playbook's default reverse-proxy](configuring-playbook-own-webserver.md) (optional, advanced)
 
 - [Adjusting TURN server configuration](configuring-playbook-turn.md) (optional, advanced)
 
@@ -198,3 +200,5 @@ When you're done with all the configuration you'd like to do, continue with [Ins
 - [Setting up the ntfy push notifications server](configuring-playbook-ntfy.md) (optional)
 
 - [Setting up a Cactus Comments server](configuring-playbook-cactus-comments.md) - a federated comment system built on Matrix (optional)
+
+- [Setting up the Rageshake bug report server](configuring-playbook-rageshake.md) (optional)

examples/vars.yml

@@ -21,6 +21,11 @@ matrix_homeserver_implementation: synapse
 # You can put any string here, but generating a strong one is preferred (e.g. `pwgen -s 64 1`).
 matrix_homeserver_generic_secret_key: ''
 
+# By default, the playbook manages its own Traefik (https://doc.traefik.io/traefik/) reverse-proxy server.
+# It will retrieve SSL certificates for you on-demand and forward requests to all other components.
+# For alternatives, see `docs/configuring-playbook-own-webserver.md`.
+matrix_playbook_reverse_proxy_type: playbook-managed-traefik
+
 # This is something which is provided to Let's Encrypt when retrieving SSL certificates for domains.
 #
 # In case SSL renewal fails at some point, you'll also get an email notification there.
@@ -29,7 +34,7 @@ matrix_homeserver_generic_secret_key: ''
 # you won't be required to define this variable (see `docs/configuring-playbook-ssl-certificates.md`).
 #
 # Example value: someone@example.com
-matrix_ssl_lets_encrypt_support_email: ''
+devture_traefik_config_certificatesResolvers_acme_email: ''
 
 # A Postgres password to use for the superuser Postgres user (called `matrix` by default).
 #

group_vars/matrix_servers

@@ -296,6 +296,8 @@ devture_systemd_service_manager_services_list_auto: |
     +
     ([{'name': 'matrix-coturn.service', 'priority': 4000, 'groups': ['matrix', 'coturn']}] if matrix_coturn_enabled else [])
     +
+    ([{'name': 'matrix-rageshake.service', 'priority': 4000, 'groups': ['matrix', 'rageshake']}] if matrix_rageshake_enabled else [])
+    +
     ([{'name': 'matrix-coturn-reload.timer', 'priority': 5000, 'groups': ['matrix', 'coturn']}] if (matrix_coturn_enabled and matrix_coturn_tls_enabled) else [])
     +
     ([{'name': 'matrix-dimension.service', 'priority': 4000, 'groups': ['matrix', 'integration-managers', 'dimension']}] if matrix_dimension_enabled else [])
@@ -1683,6 +1685,26 @@ matrix_bot_buscarron_database_engine: "{{ 'postgres' if devture_postgres_enabled
 matrix_bot_buscarron_database_hostname: "{{ devture_postgres_connection_hostname if devture_postgres_enabled else '' }}"
 matrix_bot_buscarron_database_password: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'buscarron.bot.db', rounds=655555) | to_uuid }}"
 
+matrix_bot_buscarron_hostname: "{{ matrix_server_fqn_buscarron }}"
+
+matrix_bot_buscarron_container_network: "{{ matrix_docker_network if matrix_playbook_reverse_proxy_type == 'playbook-managed-nginx' else 'matrix-bot-buscarron' }}"
+
+# For now, we attach this to the matrix-nginx-proxy network (unless that's the same network as the main one for us),
+# because that's where the homeserver is expected to be accessed from.
+# In the future, this will need to be redone.
+matrix_bot_buscarron_container_additional_networks: |
+  {{
+    (
+      ([matrix_playbook_reverse_proxyable_services_additional_network] if matrix_playbook_reverse_proxyable_services_additional_network else [])
+      +
+      ([matrix_nginx_proxy_container_network] if matrix_nginx_proxy_enabled and matrix_bot_buscarron_container_network != matrix_nginx_proxy_container_network else [])
+    ) | unique
+  }}
+
+matrix_bot_buscarron_container_labels_traefik_enabled: "{{ matrix_playbook_traefik_labels_enabled }}"
+matrix_bot_buscarron_container_labels_traefik_docker_network: "{{ matrix_playbook_reverse_proxyable_services_additional_network }}"
+matrix_bot_buscarron_container_labels_traefik_entrypoints: "{{ devture_traefik_entrypoint_primary }}"
+
 ######################################################################
 #
 # /matrix-bot-buscarron
@@ -1995,6 +2017,36 @@ matrix_corporal_matrix_registration_shared_secret: "{{ matrix_synapse_registrati
 #
 ######################################################################
 
+
+######################################################################
+#
+# matrix-rageshake
+#
+######################################################################
+
+# We don't enable rageshake by default.
+matrix_rageshake_enabled: false
+
+matrix_rageshake_container_image_self_build: "{{ matrix_architecture not in ['amd64'] }}"
+
+matrix_rageshake_hostname: "{{ matrix_server_fqn_rageshake }}"
+
+matrix_rageshake_container_network: "{{ matrix_docker_network if matrix_playbook_reverse_proxy_type == 'playbook-managed-nginx' else 'matrix-rageshake' }}"
+
+matrix_rageshake_container_additional_networks: "{{ [matrix_playbook_reverse_proxyable_services_additional_network] if matrix_playbook_reverse_proxyable_services_additional_network else [] }}"
+
+matrix_rageshake_container_http_host_bind_port: "{{ (matrix_playbook_service_host_bind_interface_prefix ~ '9110') if matrix_playbook_service_host_bind_interface_prefix else '' }}"
+
+matrix_rageshake_container_labels_traefik_enabled: "{{ matrix_playbook_traefik_labels_enabled }}"
+matrix_rageshake_container_labels_traefik_docker_network: "{{ matrix_playbook_reverse_proxyable_services_additional_network }}"
+matrix_rageshake_container_labels_traefik_entrypoints: "{{ devture_traefik_entrypoint_primary }}"
+
+######################################################################
+#
+# /matrix-rageshake
+#
+######################################################################
+
 ######################################################################
 #
 # matrix-coturn
@@ -2381,8 +2433,9 @@ matrix_nginx_proxy_proxy_matrix_enabled: true
 matrix_nginx_proxy_proxy_element_enabled: "{{ matrix_client_element_enabled and matrix_playbook_reverse_proxy_type in ['playbook-managed-nginx', 'other-nginx-non-container'] }}"
 matrix_nginx_proxy_proxy_hydrogen_enabled: "{{ matrix_client_hydrogen_enabled and matrix_playbook_reverse_proxy_type in ['playbook-managed-nginx', 'other-nginx-non-container'] }}"
 matrix_nginx_proxy_proxy_cinny_enabled: "{{ matrix_client_cinny_enabled and matrix_playbook_reverse_proxy_type in ['playbook-managed-nginx', 'other-nginx-non-container'] }}"
-matrix_nginx_proxy_proxy_buscarron_enabled: "{{ matrix_bot_buscarron_enabled }}"
+matrix_nginx_proxy_proxy_buscarron_enabled: "{{ matrix_bot_buscarron_enabled and matrix_playbook_reverse_proxy_type in ['playbook-managed-nginx', 'other-nginx-non-container'] }}"
 matrix_nginx_proxy_proxy_dimension_enabled: "{{ matrix_dimension_enabled }}"
+matrix_nginx_proxy_proxy_rageshake_enabled: "{{ matrix_rageshake_enabled and matrix_playbook_reverse_proxy_type in ['playbook-managed-nginx', 'other-nginx-non-container'] }}"
 matrix_nginx_proxy_proxy_etherpad_enabled: "{{ matrix_etherpad_enabled and matrix_etherpad_mode == 'standalone' }}"
 matrix_nginx_proxy_proxy_bot_go_neb_enabled: "{{ matrix_bot_go_neb_enabled }}"
 
@@ -2390,7 +2443,7 @@ matrix_nginx_proxy_proxy_jitsi_enabled: "{{ matrix_jitsi_enabled }}"
 matrix_nginx_proxy_proxy_jitsi_manage_wellknown: "{{ matrix_jitsi_require_well_known }}"
 
 matrix_nginx_proxy_proxy_grafana_enabled: "{{ grafana_enabled and matrix_playbook_reverse_proxy_type in ['playbook-managed-nginx', 'other-nginx-non-container'] }}"
-matrix_nginx_proxy_proxy_sygnal_enabled: "{{ matrix_sygnal_enabled }}"
+matrix_nginx_proxy_proxy_sygnal_enabled: "{{ matrix_sygnal_enabled and matrix_playbook_reverse_proxy_type in ['playbook-managed-nginx', 'other-nginx-non-container'] }}"
 matrix_nginx_proxy_proxy_ntfy_enabled: "{{ ntfy_enabled and matrix_playbook_reverse_proxy_type in ['playbook-managed-nginx', 'other-nginx-non-container'] }}"
 
 matrix_nginx_proxy_container_labels_traefik_enabled: "{{ matrix_playbook_traefik_labels_enabled }}"
@@ -2398,12 +2451,10 @@ matrix_nginx_proxy_container_labels_traefik_docker_network: "{{ matrix_playbook_
 matrix_nginx_proxy_container_labels_traefik_entrypoints: "{{ devture_traefik_entrypoint_primary }}"
 
 matrix_nginx_proxy_container_labels_traefik_proxy_matrix_enabled: true
-matrix_nginx_proxy_container_labels_traefik_proxy_buscarron_enabled: "{{ matrix_bot_buscarron_enabled }}"
 matrix_nginx_proxy_container_labels_traefik_proxy_dimension_enabled: "{{ matrix_dimension_enabled }}"
 matrix_nginx_proxy_container_labels_traefik_proxy_etherpad_enabled: "{{ matrix_etherpad_enabled and matrix_etherpad_mode == 'standalone' }}"
 matrix_nginx_proxy_container_labels_traefik_proxy_bot_go_neb_enabled: "{{ matrix_bot_go_neb_enabled }}"
 matrix_nginx_proxy_container_labels_traefik_proxy_jitsi_enabled: "{{ matrix_jitsi_enabled }}"
-matrix_nginx_proxy_container_labels_traefik_proxy_sygnal_enabled: "{{ matrix_sygnal_enabled }}"
 
 matrix_nginx_proxy_proxy_matrix_corporal_api_enabled: "{{ matrix_corporal_enabled and matrix_corporal_http_api_enabled }}"
 matrix_nginx_proxy_proxy_matrix_corporal_api_addr_with_container: "matrix-corporal:41081"
@@ -2483,6 +2534,8 @@ matrix_nginx_proxy_systemd_wanted_services_list: |
     +
     (['matrix-dimension.service'] if matrix_dimension_enabled else [])
     +
+    (['matrix-rageshake.service'] if matrix_rageshake_enabled else [])
+    +
     (['matrix-sygnal.service'] if matrix_sygnal_enabled else [])
     +
     ([(ntfy_identifier + '.service')] if ntfy_enabled else [])
@@ -2524,6 +2577,8 @@ matrix_ssl_domains_to_obtain_certificates_for: |
     +
     ([ntfy_hostname] if ntfy_enabled else [])
     +
+    ([matrix_server_fqn_rageshake] if matrix_rageshake_enabled else [])
+    +
     (matrix_bot_postmoogle_domains if matrix_bot_postmoogle_enabled else [])
     +
     ([matrix_domain] if matrix_nginx_proxy_base_domain_serving_enabled else [])
@@ -2875,8 +2930,18 @@ matrix_sygnal_enabled: false
 # If someone instals Prometheus via the playbook, they most likely wish to monitor Sygnal.
 matrix_sygnal_metrics_prometheus_enabled: "{{ matrix_prometheus_enabled }}"
 
+matrix_sygnal_hostname: "{{ matrix_server_fqn_sygnal }}"
+
+matrix_sygnal_container_network: "{{ matrix_nginx_proxy_container_network if matrix_playbook_reverse_proxy_type == 'playbook-managed-nginx' else 'matrix-sygnal' }}"
+
+matrix_sygnal_container_additional_networks: "{{ [matrix_playbook_reverse_proxyable_services_additional_network] if matrix_playbook_reverse_proxyable_services_additional_network else [] }}"
+
 matrix_sygnal_container_http_host_bind_port: "{{ (matrix_playbook_service_host_bind_interface_prefix ~ '6000') if matrix_playbook_service_host_bind_interface_prefix else '' }}"
 
+matrix_sygnal_container_labels_traefik_enabled: "{{ matrix_playbook_traefik_labels_enabled }}"
+matrix_sygnal_container_labels_traefik_docker_network: "{{ matrix_playbook_reverse_proxyable_services_additional_network }}"
+matrix_sygnal_container_labels_traefik_entrypoints: "{{ devture_traefik_entrypoint_primary }}"
+
 ######################################################################
 #
 # /matrix-sygnal

playbooks/matrix.yml

@@ -82,6 +82,7 @@
     - custom/matrix-bot-draupnir
     - custom/matrix-bot-chatgpt
     - custom/matrix-cactus-comments
+    - custom/matrix-rageshake
     - custom/matrix-synapse
     - custom/matrix-synapse-reverse-proxy-companion
     - custom/matrix-dendrite

requirements.yml

@@ -4,7 +4,7 @@
   version: 6.1.0
 
 - src: git+https://github.com/devture/com.devture.ansible.role.docker_sdk_for_python.git
-  version: 6ba3be490b6f4c6f35ea109aeb8e533fa231b3a5
+  version: 54d6d1831f063e4a99b66c722f49053d59f8ee60
 
 - src: git+https://github.com/devture/com.devture.ansible.role.playbook_help.git
   version: c1f40e82b4d6b072b6f0e885239322bdaaaf554f
@@ -37,19 +37,19 @@
   version: v0.11.1-2
 
 - src: git+https://gitlab.com/etke.cc/roles/backup_borg.git
-  version: v1.2.3-1.7.6-0
+  version: v1.2.3-1.7.7-1
 
 - src: git+https://gitlab.com/etke.cc/roles/grafana.git
-  version: v9.3.6-1
+  version: v9.3.6-2
 
 - src: git+https://gitlab.com/etke.cc/roles/ntfy.git
-  version: v2.0.1-0
+  version: v2.1.0-0
 
 - src: git+https://gitlab.com/etke.cc/roles/redis.git
   version: v7.0.7-0
 
 - src: git+https://github.com/devture/com.devture.ansible.role.traefik.git
-  version: da90b6cdbbb9374ca72c1b530867add2fd8f024e
+  version: 5e3248cd4d17db9ff3ba90904e7330150dab599e
 
 - src: git+https://github.com/devture/com.devture.ansible.role.traefik_certs_dumper.git
   version: e7563caa814e634d2f8deec4a41e970caa1c0ae4

roles/custom/matrix-base/defaults/main.yml

@@ -90,6 +90,9 @@ matrix_server_fqn_sygnal: "sygnal.{{ matrix_domain }}"
 # This is where you access the ntfy push notification service.
 matrix_server_fqn_ntfy: "ntfy.{{ matrix_domain }}"
 
+# This is where you access rageshake.
+matrix_server_fqn_rageshake: "rageshake.{{ matrix_domain }}"
+
 matrix_federation_public_port: 8448
 
 # The name of the Traefik entrypoint for handling Matrix Federation
@@ -316,7 +319,7 @@ matrix_homeserver_app_service_config_files_auto: []
 #     - no nginx configuration will be dumped in /matrix/nginx/conf.d
 #     - no port exposure will be done for any of the container services
 #     - it's up to you to expose the ports you want, etc.
-matrix_playbook_reverse_proxy_type: playbook-managed-nginx
+matrix_playbook_reverse_proxy_type: ''
 
 matrix_playbook_service_host_bind_interface_prefix: "{{ '' if matrix_playbook_reverse_proxy_type not in ['other-nginx-non-container', 'other-on-same-host', 'other-on-another-host'] else ('0.0.0.0:' if matrix_playbook_reverse_proxy_type == 'other-on-another-host' else '127.0.0.1:') }}"
 

roles/custom/matrix-base/tasks/validate_config.yml

@@ -54,6 +54,14 @@
     msg: "Detected that variable matrix_architecture {{ matrix_architecture }} appears to be set incorrectly. See docs/alternative-architectures.md. Server appears to be {{ ansible_architecture }}."
   when: matrix_architecture not in ['amd64', 'arm32', 'arm64']
 
+- name: Fail if matrix_playbook_reverse_proxy_type is set incorrectly
+  ansible.builtin.fail:
+    msg: |
+      You have not explicitly specified the type of reverse-proxy you'd like to use (with a `matrix_playbook_reverse_proxy_type` variable in your configuration).
+      The playbook used to default to nginx (matrix-nginx-proxy), but things are changing with Traefik being the new default reverse-proxy.
+      Learn more here: https://github.com/spantaleev/matrix-docker-ansible-deploy/blob/master/CHANGELOG.md#traefik-is-the-default-reverse-proxy-now
+  when: matrix_playbook_reverse_proxy_type == ''
+
 - name: Fail if matrix_playbook_reverse_proxy_type is set incorrectly
   ansible.builtin.fail:
     msg: "Detected that variable matrix_playbook_reverse_proxy_type (current value: `{{ matrix_playbook_reverse_proxy_type }}`) appears to be set incorrectly. See roles/custom/matrix-base/defaults/main.yml for valid choices."

roles/custom/matrix-bot-buscarron/defaults/main.yml

@@ -1,23 +1,70 @@
 ---
-# buscarron is a helpdesk bot
+
+# buscarron is a Web forms (HTTP POST) to Matrix service.
 # Project source code URL: https://gitlab.com/etke.cc/buscarron
 
 matrix_bot_buscarron_enabled: true
 
+matrix_bot_buscarron_version: v1.3.1
+
+# The hostname at which Buscarron is served.
+matrix_bot_buscarron_hostname: ''
+
+# The path at which Buscarron is exposed.
+# This value must either be `/` or not end with a slash (e.g. `/buscarron`).
+matrix_bot_buscarron_path_prefix: /
+
+matrix_bot_buscarron_base_path: "{{ matrix_base_data_path }}/buscarron"
+matrix_bot_buscarron_config_path: "{{ matrix_bot_buscarron_base_path }}/config"
+matrix_bot_buscarron_data_path: "{{ matrix_bot_buscarron_base_path }}/data"
+matrix_bot_buscarron_data_store_path: "{{ matrix_bot_buscarron_data_path }}/store"
+
 matrix_bot_buscarron_container_image_self_build: false
 matrix_bot_buscarron_docker_repo: "https://gitlab.com/etke.cc/buscarron.git"
 matrix_bot_buscarron_docker_repo_version: "{{ matrix_bot_buscarron_version }}"
 matrix_bot_buscarron_docker_src_files_path: "{{ matrix_base_data_path }}/buscarron/docker-src"
 
-matrix_bot_buscarron_version: v1.3.1
 matrix_bot_buscarron_docker_image: "{{ matrix_bot_buscarron_docker_image_name_prefix }}etke.cc/buscarron:{{ matrix_bot_buscarron_version }}"
 matrix_bot_buscarron_docker_image_name_prefix: "{{ 'localhost/' if matrix_bot_buscarron_container_image_self_build else 'registry.gitlab.com/' }}"
 matrix_bot_buscarron_docker_image_force_pull: "{{ matrix_bot_buscarron_docker_image.endswith(':latest') }}"
 
-matrix_bot_buscarron_base_path: "{{ matrix_base_data_path }}/buscarron"
+# The base container network. It will be auto-created by this role if it doesn't exist already.
-matrix_bot_buscarron_config_path: "{{ matrix_bot_buscarron_base_path }}/config"
+matrix_bot_buscarron_container_network: matrix-bot-buscarron
-matrix_bot_buscarron_data_path: "{{ matrix_bot_buscarron_base_path }}/data"
+
-matrix_bot_buscarron_data_store_path: "{{ matrix_bot_buscarron_data_path }}/store"
+# A list of additional container networks that the container would be connected to.
+# The role does not create these networks, so make sure they already exist.
+# Use this to expose this container to another reverse proxy, which runs in a different container network.
+matrix_bot_buscarron_container_additional_networks: []
+
+# matrix_bot_buscarron_container_labels_traefik_enabled controls whether labels to assist a Traefik reverse-proxy will be attached to the container.
+# See `../templates/labels.j2` for details.
+#
+# To inject your own other container labels, see `matrix_bot_buscarron_container_labels_additional_labels`.
+matrix_bot_buscarron_container_labels_traefik_enabled: true
+matrix_bot_buscarron_container_labels_traefik_docker_network: "{{ matrix_bot_buscarron_container_network }}"
+matrix_bot_buscarron_container_labels_traefik_hostname: "{{ matrix_bot_buscarron_hostname }}"
+# The path prefix must either be `/` or not end with a slash (e.g. `/buscarron`).
+matrix_bot_buscarron_container_labels_traefik_path_prefix: "{{ matrix_bot_buscarron_path_prefix }}"
+matrix_bot_buscarron_container_labels_traefik_rule: "Host(`{{ matrix_bot_buscarron_container_labels_traefik_hostname }}`){% if matrix_bot_buscarron_container_labels_traefik_path_prefix != '/' %} && PathPrefix(`{{ matrix_bot_buscarron_container_labels_traefik_path_prefix }}`){% endif %}"
+matrix_bot_buscarron_container_labels_traefik_priority: 0
+matrix_bot_buscarron_container_labels_traefik_entrypoints: web-secure
+matrix_bot_buscarron_container_labels_traefik_tls: "{{ matrix_bot_buscarron_container_labels_traefik_entrypoints != 'web' }}"
+matrix_bot_buscarron_container_labels_traefik_tls_certResolver: default  # noqa var-naming
+
+# Controls which additional headers to attach to all HTTP responses.
+# To add your own headers, use `matrix_bot_buscarron_container_labels_traefik_additional_response_headers_custom`
+matrix_bot_buscarron_container_labels_traefik_additional_response_headers: "{{ matrix_bot_buscarron_container_labels_traefik_additional_response_headers_auto | combine(matrix_bot_buscarron_container_labels_traefik_additional_response_headers_custom) }}"
+matrix_bot_buscarron_container_labels_traefik_additional_response_headers_auto: {}
+matrix_bot_buscarron_container_labels_traefik_additional_response_headers_custom: {}
+
+# matrix_bot_buscarron_container_labels_additional_labels contains a multiline string with additional labels to add to the container label file.
+# See `../templates/labels.j2` for details.
+#
+# Example:
+# matrix_bot_buscarron_container_labels_additional_labels: |
+#   my.label=1
+#   another.label="here"
+matrix_bot_buscarron_container_labels_additional_labels: ''
 
 # A list of extra arguments to pass to the container
 matrix_bot_buscarron_container_extra_arguments: []

roles/custom/matrix-bot-buscarron/tasks/setup_install.yml

@@ -40,13 +40,16 @@
     - {path: "{{ matrix_bot_buscarron_docker_src_files_path }}", when: true}
   when: "item.when | bool"
 
-- name: Ensure buscarron environment variables file created
+- name: Ensure buscarron support files installed
   ansible.builtin.template:
-    src: "{{ role_path }}/templates/env.j2"
+    src: "{{ role_path }}/templates/{{ item }}.j2"
-    dest: "{{ matrix_bot_buscarron_config_path }}/env"
+    dest: "{{ matrix_bot_buscarron_config_path }}/{{ item }}"
     owner: "{{ matrix_user_username }}"
     group: "{{ matrix_user_groupname }}"
     mode: 0640
+  with_items:
+    - env
+    - labels
 
 - name: Ensure buscarron image is pulled
   community.docker.docker_image:
@@ -89,6 +92,11 @@
     dest: "{{ devture_systemd_docker_base_systemd_path }}/matrix-bot-buscarron.service"
     mode: 0644
 
+- name: Ensure buscarron container network is created
+  community.general.docker_network:
+    name: "{{ matrix_bot_buscarron_container_network }}"
+    driver: bridge
+
 - name: Ensure matrix-bot-buscarron.service restarted, if necessary
   ansible.builtin.service:
     name: "matrix-bot-buscarron.service"

roles/custom/matrix-bot-buscarron/tasks/validate_config.yml

@@ -7,4 +7,5 @@
   when: "item.when | bool and vars[item.name] == ''"
   with_items:
     - {'name': 'matrix_bot_buscarron_password', when: true}
+    - {'name': 'matrix_bot_buscarron_hostname', when: true}
     - {'name': 'matrix_bot_buscarron_database_hostname', when: "{{ matrix_bot_buscarron_database_engine == 'postgres' }}"}

roles/custom/matrix-bot-buscarron/templates/labels.j2

@@ -0,0 +1,45 @@
+{% if matrix_bot_buscarron_container_labels_traefik_enabled %}
+traefik.enable=true
+
+{% if matrix_bot_buscarron_container_labels_traefik_docker_network %}
+traefik.docker.network={{ matrix_bot_buscarron_container_labels_traefik_docker_network }}
+{% endif %}
+
+{% set middlewares = [] %}
+
+{% if matrix_bot_buscarron_container_labels_traefik_path_prefix != '/' %}
+traefik.http.middlewares.matrix-bot-buscarron-slashless-redirect.redirectregex.regex=({{ matrix_bot_buscarron_container_labels_traefik_path_prefix | quote }})$
+traefik.http.middlewares.matrix-bot-buscarron-slashless-redirect.redirectregex.replacement=${1}/
+{% set middlewares = middlewares + ['matrix-bot-buscarron-slashless-redirect'] %}
+{% endif %}
+
+{% if matrix_bot_buscarron_container_labels_traefik_path_prefix != '/' %}
+traefik.http.middlewares.matrix-bot-buscarron-strip-prefix.stripprefix.prefixes={{ matrix_bot_buscarron_container_labels_traefik_path_prefix }}
+{% set middlewares = middlewares + ['matrix-bot-buscarron-strip-prefix'] %}
+{% endif %}
+
+{% if matrix_bot_buscarron_container_labels_traefik_additional_response_headers.keys() | length > 0 %}
+{% for name, value in matrix_bot_buscarron_container_labels_traefik_additional_response_headers.items() %}
+traefik.http.middlewares.matrix-bot-buscarron-add-headers.headers.customresponseheaders.{{ name }}={{ value }}
+{% endfor %}
+{% set middlewares = middlewares + ['matrix-bot-buscarron-add-headers'] %}
+{% endif %}
+
+traefik.http.routers.matrix-bot-buscarron.rule={{ matrix_bot_buscarron_container_labels_traefik_rule }}
+{% if matrix_bot_buscarron_container_labels_traefik_priority | int > 0 %}
+traefik.http.routers.matrix-bot-buscarron.priority={{ matrix_bot_buscarron_container_labels_traefik_priority }}
+{% endif %}
+traefik.http.routers.matrix-bot-buscarron.service=matrix-bot-buscarron
+{% if middlewares | length > 0 %}
+traefik.http.routers.matrix-bot-buscarron.middlewares={{ middlewares | join(',') }}
+{% endif %}
+traefik.http.routers.matrix-bot-buscarron.entrypoints={{ matrix_bot_buscarron_container_labels_traefik_entrypoints }}
+traefik.http.routers.matrix-bot-buscarron.tls={{ matrix_bot_buscarron_container_labels_traefik_tls | to_json }}
+{% if matrix_bot_buscarron_container_labels_traefik_tls %}
+traefik.http.routers.matrix-bot-buscarron.tls.certResolver={{ matrix_bot_buscarron_container_labels_traefik_tls_certResolver }}
+{% endif %}
+
+traefik.http.services.matrix-bot-buscarron.loadbalancer.server.port=8080
+{% endif %}
+
+{{ matrix_bot_buscarron_container_labels_additional_labels }}

roles/custom/matrix-bot-buscarron/templates/systemd/matrix-bot-buscarron.service.j2

@@ -16,21 +16,31 @@ Environment="HOME={{ devture_systemd_docker_base_systemd_unit_home_path }}"
 ExecStartPre=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} kill matrix-bot-buscarron 2>/dev/null || true'
 ExecStartPre=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} rm matrix-bot-buscarron 2>/dev/null || true'
 
-ExecStart={{ devture_systemd_docker_base_host_command_docker }} run --rm --name matrix-bot-buscarron \
+ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} create \
+			--rm \
+			--name=matrix-bot-buscarron \
 			--log-driver=none \
 			--user={{ matrix_user_uid }}:{{ matrix_user_gid }} \
 			--cap-drop=ALL \
 			--read-only \
-			--network={{ matrix_docker_network }} \
+			--network={{ matrix_bot_buscarron_container_network }} \
 			--env-file={{ matrix_bot_buscarron_config_path }}/env \
+			--label-file={{ matrix_bot_buscarron_config_path }}/labels \
 			--mount type=bind,src={{ matrix_bot_buscarron_data_path }},dst=/data \
 			{% for arg in matrix_bot_buscarron_container_extra_arguments %}
 			{{ arg }} \
 			{% endfor %}
 			{{ matrix_bot_buscarron_docker_image }}
 
+{% for network in matrix_bot_buscarron_container_additional_networks %}
+ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} network connect {{ network }} matrix-bot-buscarron
+{% endfor %}
+
+ExecStart={{ devture_systemd_docker_base_host_command_docker }} start --attach matrix-bot-buscarron
+
 ExecStop=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} kill matrix-bot-buscarron 2>/dev/null || true'
 ExecStop=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} rm matrix-bot-buscarron 2>/dev/null || true'
+
 Restart=always
 RestartSec=30
 SyslogIdentifier=matrix-bot-buscarron

roles/custom/matrix-bot-draupnir/defaults/main.yml

@@ -4,7 +4,7 @@
 
 matrix_bot_draupnir_enabled: true
 
-matrix_bot_draupnir_version: "v1.80.0"
+matrix_bot_draupnir_version: "v1.80.1"
 
 matrix_bot_draupnir_container_image_self_build: false
 matrix_bot_draupnir_container_image_self_build_repo: "https://github.com/Gnuxie/Draupnir.git"

roles/custom/matrix-bot-draupnir/templates/production.yaml.j2

@@ -1,79 +1,79 @@
-# Endpoint URL that draupnir uses to interact with the matrix homeserver (client-server API),
+# Endpoint URL that Draupnir uses to interact with the matrix homeserver (client-server API),
 # set this to the pantalaimon URL if you're using that.
 homeserverUrl: "{{ matrix_homeserver_url }}"
 
-# Endpoint URL that draupnir could use to fetch events related to reports (client-server API and /_synapse/),
+# Endpoint URL that Draupnir could use to fetch events related to reports (client-server API and /_synapse/),
 # only set this to the public-internet homeserver client API URL, do NOT set this to the pantalaimon URL.
 rawHomeserverUrl: "{{ matrix_homeserver_url }}"
 
-# Matrix Access Token to use, draupnir will only use this if pantalaimon.use is false.
+# Matrix Access Token to use, Draupnir will only use this if pantalaimon.use is false.
 accessToken: "{{ matrix_bot_draupnir_access_token }}"
 
 # Options related to Pantalaimon (https://github.com/matrix-org/pantalaimon)
 #pantalaimon:
-#  # Whether or not draupnir will use pantalaimon to access the matrix homeserver,
+#  # Whether or not Draupnir will use pantalaimon to access the matrix homeserver,
 #  # set to `true` if you're using pantalaimon.
 #  #
 #  # Be sure to point homeserverUrl to the pantalaimon instance.
 #  #
-#  # draupnir will log in using the given username and password once,
+#  # Draupnir will log in using the given username and password once,
 #  # then store the resulting access token in a file under dataPath.
 #  use: false
 #
 #  # The username to login with.
 #  username: draupnir
 #
-#  # The password draupnir will login with.
+#  # The password Draupnir will login with.
 #  #
 #  # After successfully logging in once, this will be ignored, so this value can be blanked after first startup.
 #  password: your_password
 
-# The path draupnir will store its state/data in, leave default ("/data/storage") when using containers.
+# The path Draupnir will store its state/data in, leave default ("/data/storage") when using containers.
 dataPath: "/data"
 
-# If true (the default), draupnir will only accept invites from users present in managementRoom.
+# If true (the default), Draupnir will only accept invites from users present in managementRoom.
 autojoinOnlyIfManager: true
 
 # If `autojoinOnlyIfManager` is false, only the members in this space can invite
 # the bot to new rooms.
-#acceptInvitesFromSpace: "!example:example.org"
+acceptInvitesFromSpace: "!example:example.org"
 
-# Whether draupnir should report ignored invites to the management room (if autojoinOnlyIfManager is true).
+# Whether Draupnir should report ignored invites to the management room (if autojoinOnlyIfManager is true).
 recordIgnoredInvites: false
 
-# The room ID (or room alias) of the management room, anyone in this room can issue commands to draupnir.
+# The room ID (or room alias) of the management room, anyone in this room can issue commands to Draupnir.
 #
-# draupnir has no more granular access controls other than this, be sure you trust everyone in this room - secure it!
+# Draupnir has no more granular access controls other than this, be sure you trust everyone in this room - secure it!
 #
 # This should be a room alias or room ID - not a matrix.to URL.
 #
-# Note: By default, draupnir is fairly verbose - expect a lot of messages in this room.
+# Note: By default, Draupnir is fairly verbose - expect a lot of messages in this room.
 # (see verboseLogging to adjust this a bit.)
-managementRoom: "{{ matrix_bot_draupnir_management_room }}"
+managementRoom: "#moderators:example.org"
 
-# Whether draupnir should log a lot more messages in the room,
+# Whether Draupnir should log a lot more messages in the room,
-# mainly involves "all-OK" messages, and debugging messages for when draupnir checks bans in a room.
+# mainly involves "all-OK" messages, and debugging messages for when Draupnir checks bans in a room.
-verboseLogging: false
+verboseLogging: true
 
 # The log level of terminal (or container) output,
 # can be one of DEBUG, INFO, WARN and ERROR, in increasing order of importance and severity.
 #
-# This should be at INFO or DEBUG in order to get support for draupnir problems.
+# This should be at INFO or DEBUG in order to get support for Draupnir problems.
 logLevel: "INFO"
 
-# Whether or not draupnir should synchronize policy lists immediately after startup.
+# Whether or not Draupnir should synchronize policy lists immediately after startup.
 # Equivalent to running '!draupnir sync'.
 syncOnStartup: true
 
-# Whether or not draupnir should check moderation permissions in all protected rooms on startup.
+# Whether or not Draupnir should check moderation permissions in all protected rooms on startup.
 # Equivalent to running `!draupnir verify`.
 verifyPermissionsOnStartup: true
 
-# Whether or not draupnir should actually apply bans and policy lists,
+# Whether or not Draupnir should actually apply bans and policy lists,
 # turn on to trial some untrusted configuration or lists.
 noop: false
 
-# Whether draupnir should check member lists quicker (by using a different endpoint),
+# Whether Draupnir should check member lists quicker (by using a different endpoint),
 # keep in mind that enabling this will miss invited (but not joined) users.
 #
 # Turn on if your bot is in (very) large rooms, or in large amounts of rooms.
@@ -94,7 +94,7 @@ automaticallyRedactForReasons:
   - "spam"
   - "advertising"
 
-# A list of rooms to protect. draupnir will add this to the list it knows from its account data.
+# A list of rooms to protect. Draupnir will add this to the list it knows from its account data.
 #
 # It won't, however, add it to the account data.
 # Manually add the room via '!draupnir rooms add' to have it stay protected regardless if this config value changes.
@@ -116,21 +116,21 @@ automaticallyRedactForReasons:
 # Explicitly add these rooms as a protected room list if you want them protected.
 protectAllJoinedRooms: false
 
-# Increase this delay to have Mjölnir wait longer between two consecutive backgrounded
+# Increase this delay to have Draupnir wait longer between two consecutive backgrounded
 # operations. The total duration of operations will be longer, but the homeserver won't
-# be affected as much. Conversely, decrease this delay to have Mjölnir chain operations
+# be affected as much. Conversely, decrease this delay to have Draupnir chain operations
 # faster. The total duration of operations will generally be shorter, but the performance
 # of the homeserver may be more impacted.
 backgroundDelayMS: 500
 
-# Server administration commands, these commands will only work if draupnir is
+# Server administration commands, these commands will only work if Draupnir is
 # a global server administrator, and the bot's server is a Synapse instance.
-#admin:
+admin:
-#  # Whether or not draupnir can temporarily take control of any eligible account from the local homeserver who's in the room
+  # Whether or not Draupnir can temporarily take control of any eligible account from the local homeserver who's in the room
-#  # (with enough permissions) to "make" a user an admin.
+  # (with enough permissions) to "make" a user an admin.
-#  #
+  #
-#  # This only works if a local user with enough admin permissions is present in the room.
+  # This only works if a local user with enough admin permissions is present in the room.
-#  enableMakeRoomAdminCommand: false
+  enableMakeRoomAdminCommand: true
 
 # Misc options for command handling and commands
 commands:
@@ -138,20 +138,28 @@ commands:
   #
   # If `true`, will allow commands like `!ban`, `!help`, etc.
   #
-  # Note: draupnir can also be pinged by display name instead of having to use
+  # Note: Draupnir can also be pinged by display name instead of having to use
   # the !draupnir prefix. For example, "my_moderator_bot: ban @spammer:example.org"
   # will address only my_moderator_bot.
   allowNoPrefix: false
 
-  # Any additional bot prefixes that draupnir will listen to. i.e. adding `mod` will allow `!mod help`.
+  # Any additional bot prefixes that Draupnir will listen to. i.e. adding `mod` will allow `!mod help`.
   additionalPrefixes:
-    - "draupnir_bot"
+    - "draupnir-bot"
     - "draupnir"
 
   # Whether or not commands with a wildcard (*) will require an additional `--force` argument
   # in the command to be able to be submitted.
   confirmWildcardBan: true
 
+  # The default reasons to be prompted with if the reason is missing from a ban command.
+  ban:
+    defaultReasons: 
+      - "spam"
+      - "brigading"
+      - "harassment"
+      - "disagreement"
+
 # Configuration specific to certain toggle-able protections
 #protections:
 #  # Configuration for the wordlist plugin, which can ban users based if they say certain

roles/custom/matrix-client-cinny/defaults/main.yml

@@ -95,11 +95,11 @@ matrix_client_cinny_http_header_content_security_policy: frame-ancestors 'self'
 
 # Specifies the value of the `Permission-Policy` header.
 # See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Permission-Policy
-matrix_client_cinny_http_header_content_permission_policy: "{{ 'interest-cohort=() always' if matrix_client_cinny_floc_optout_enabled else '' }}"
+matrix_client_cinny_http_header_content_permission_policy: "{{ 'interest-cohort=()' if matrix_client_cinny_floc_optout_enabled else '' }}"
 
 # Specifies the value of the `Strict-Transport-Security` header.
 # See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security
-matrix_client_cinny_http_header_strict_transport_security: "{{ '\"max-age=31536000; includeSubDomains; preload\" always' if matrix_client_cinny_hsts_preload_enabled else '\"max-age=31536000; includeSubDomains\" always' }}"
+matrix_client_cinny_http_header_strict_transport_security: "max-age=31536000; includeSubDomains{{ '; preload' if matrix_client_cinny_hsts_preload_enabled else '' }}"
 
 # Controls whether to send a "Permissions-Policy interest-cohort=();" header along with all responses
 #

roles/custom/matrix-client-element/defaults/main.yml

@@ -98,11 +98,11 @@ matrix_client_element_http_header_content_security_policy: frame-ancestors 'self
 
 # Specifies the value of the `Permission-Policy` header.
 # See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Permission-Policy
-matrix_client_element_http_header_content_permission_policy: "{{ 'interest-cohort=() always' if matrix_client_element_floc_optout_enabled else '' }}"
+matrix_client_element_http_header_content_permission_policy: "{{ 'interest-cohort=()' if matrix_client_element_floc_optout_enabled else '' }}"
 
 # Specifies the value of the `Strict-Transport-Security` header.
 # See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security
-matrix_client_element_http_header_strict_transport_security: "{{ '\"max-age=31536000; includeSubDomains; preload\" always' if matrix_client_element_hsts_preload_enabled else '\"max-age=31536000; includeSubDomains\" always' }}"
+matrix_client_element_http_header_strict_transport_security: "max-age=31536000; includeSubDomains{{ '; preload' if matrix_client_element_hsts_preload_enabled else '' }}"
 
 # Controls whether to send a "Permissions-Policy interest-cohort=();" header along with all responses
 #
@@ -191,6 +191,9 @@ matrix_client_element_self_check_validate_certificates: true
 # don't show the registration button on welcome page
 matrix_client_element_registration_enabled: false
 
+# Default country code on welcome page when login by phone number
+matrix_client_element_default_country_code: "GB"
+
 # Controls whether presence will be enabled
 matrix_client_element_enable_presence_by_hs_url: ~
 

roles/custom/matrix-client-element/templates/config.json.j2

@@ -12,6 +12,7 @@
 		"custom_themes": {{ matrix_client_element_settingDefaults_custom_themes | to_json }}
 	},
 	"default_theme": {{ matrix_client_element_default_theme | string | to_json }},
+	"default_country_code": {{ matrix_client_element_default_country_code | string | to_json }},
 	"permalinkPrefix": {{ matrix_client_element_permalinkPrefix | string | to_json }},
 	"disable_custom_urls": {{ matrix_client_element_disable_custom_urls | to_json }},
 	"disable_guests": {{ matrix_client_element_disable_guests | to_json }},

roles/custom/matrix-client-hydrogen/defaults/main.yml

@@ -94,11 +94,11 @@ matrix_client_hydrogen_http_header_content_security_policy: frame-ancestors 'sel
 
 # Specifies the value of the `Permission-Policy` header.
 # See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Permission-Policy
-matrix_client_hydrogen_http_header_content_permission_policy: "{{ 'interest-cohort=() always' if matrix_client_hydrogen_floc_optout_enabled else '' }}"
+matrix_client_hydrogen_http_header_content_permission_policy: "{{ 'interest-cohort=()' if matrix_client_hydrogen_floc_optout_enabled else '' }}"
 
 # Specifies the value of the `Strict-Transport-Security` header.
 # See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security
-matrix_client_hydrogen_http_header_strict_transport_security: "{{ '\"max-age=31536000; includeSubDomains; preload\" always' if matrix_client_hydrogen_hsts_preload_enabled else '\"max-age=31536000; includeSubDomains\" always' }}"
+matrix_client_hydrogen_http_header_strict_transport_security: "max-age=31536000; includeSubDomains{{ '; preload' if matrix_client_hydrogen_hsts_preload_enabled else '' }}"
 
 # Controls whether to send a "Permissions-Policy interest-cohort=();" header along with all responses
 #

roles/custom/matrix-dynamic-dns/defaults/main.yml

@@ -7,7 +7,7 @@ matrix_dynamic_dns_enabled: true
 # The dynamic dns daemon interval
 matrix_dynamic_dns_daemon_interval: '300'
 
-matrix_dynamic_dns_version: v3.10.0-ls106
+matrix_dynamic_dns_version: v3.10.0-ls110
 
 # The docker container to use when in mode
 matrix_dynamic_dns_docker_image: "{{ matrix_dynamic_dns_docker_image_name_prefix }}linuxserver/ddclient:{{ matrix_dynamic_dns_version }}"

roles/custom/matrix-nginx-proxy/defaults/main.yml

@@ -61,11 +61,6 @@ matrix_nginx_proxy_container_labels_traefik_proxy_matrix_rule: "Host(`{{ matrix_
 matrix_nginx_proxy_container_labels_traefik_proxy_matrix_federation_entrypoint: "{{ matrix_federation_traefik_entrypoint }}"
 matrix_nginx_proxy_container_labels_traefik_proxy_matrix_federation_entrypoints: "{{ matrix_nginx_proxy_container_labels_traefik_proxy_matrix_federation_entrypoint }}"
 
-matrix_nginx_proxy_container_labels_traefik_proxy_buscarron_enabled: false
-matrix_nginx_proxy_container_labels_traefik_proxy_buscarron_hostname: "{{ matrix_server_fqn_buscarron }}"
-matrix_nginx_proxy_container_labels_traefik_proxy_buscarron_tls: "{{ matrix_nginx_proxy_container_labels_traefik_entrypoints != 'web' }}"
-matrix_nginx_proxy_container_labels_traefik_proxy_buscarron_rule: "Host(`{{ matrix_nginx_proxy_container_labels_traefik_proxy_buscarron_hostname }}`)"
-
 matrix_nginx_proxy_container_labels_traefik_proxy_dimension_enabled: false
 matrix_nginx_proxy_container_labels_traefik_proxy_dimension_hostname: "{{ matrix_server_fqn_dimension }}"
 matrix_nginx_proxy_container_labels_traefik_proxy_dimension_tls: "{{ matrix_nginx_proxy_container_labels_traefik_entrypoints != 'web' }}"
@@ -86,11 +81,6 @@ matrix_nginx_proxy_container_labels_traefik_proxy_jitsi_hostname: "{{ matrix_ser
 matrix_nginx_proxy_container_labels_traefik_proxy_jitsi_tls: "{{ matrix_nginx_proxy_container_labels_traefik_entrypoints != 'web' }}"
 matrix_nginx_proxy_container_labels_traefik_proxy_jitsi_rule: "Host(`{{ matrix_nginx_proxy_container_labels_traefik_proxy_jitsi_hostname }}`)"
 
-matrix_nginx_proxy_container_labels_traefik_proxy_sygnal_enabled: false
-matrix_nginx_proxy_container_labels_traefik_proxy_sygnal_hostname: "{{ matrix_server_fqn_sygnal }}"
-matrix_nginx_proxy_container_labels_traefik_proxy_sygnal_tls: "{{ matrix_nginx_proxy_container_labels_traefik_entrypoints != 'web' }}"
-matrix_nginx_proxy_container_labels_traefik_proxy_sygnal_rule: "Host(`{{ matrix_nginx_proxy_container_labels_traefik_proxy_sygnal_hostname }}`)"
-
 # matrix_nginx_proxy_container_labels_additional_labels contains a multiline string with additional labels to add to the container label file.
 # See `../templates/labels.j2` for details.
 #
@@ -257,6 +247,10 @@ matrix_nginx_proxy_proxy_matrix_federation_port: 8448
 matrix_nginx_proxy_proxy_dimension_enabled: false
 matrix_nginx_proxy_proxy_dimension_hostname: "{{ matrix_server_fqn_dimension }}"
 
+# Controls whether proxying the rageshake domain should be done.
+matrix_nginx_proxy_proxy_rageshake_enabled: false
+matrix_nginx_proxy_proxy_rageshake_hostname: "{{ matrix_server_fqn_rageshake }}"
+
 # Controls whether proxying the etherpad domain should be done.
 matrix_nginx_proxy_proxy_etherpad_enabled: false
 matrix_nginx_proxy_proxy_etherpad_hostname: "{{ matrix_server_fqn_etherpad }}"
@@ -444,6 +438,9 @@ matrix_nginx_proxy_proxy_buscarron_additional_server_configuration_blocks: []
 # A list of strings containing additional configuration blocks to add to Dimension's server configuration (matrix-dimension.conf).
 matrix_nginx_proxy_proxy_dimension_additional_server_configuration_blocks: []
 
+# A list of strings containing additional configuration blocks to add to Rageshake's server configuration (matrix-rageshake.conf).
+matrix_nginx_proxy_proxy_rageshake_additional_server_configuration_blocks: []
+
 # A list of strings containing additional configuration blocks to add to etherpad's server configuration (matrix-etherpad.conf).
 matrix_nginx_proxy_proxy_etherpad_additional_server_configuration_blocks: []
 

roles/custom/matrix-nginx-proxy/tasks/setup_nginx_proxy.yml

@@ -129,6 +129,13 @@
     mode: 0644
   when: matrix_nginx_proxy_proxy_dimension_enabled | bool
 
+- name: Ensure Matrix nginx-proxy configuration for rageshake domain exists
+  ansible.builtin.template:
+    src: "{{ role_path }}/templates/nginx/conf.d/matrix-rageshake.conf.j2"
+    dest: "{{ matrix_nginx_proxy_confd_path }}/matrix-rageshake.conf"
+    mode: 0644
+  when: matrix_nginx_proxy_proxy_rageshake_enabled | bool
+
 - name: Ensure Matrix nginx-proxy configuration for etherpad domain exists
   ansible.builtin.template:
     src: "{{ role_path }}/templates/nginx/conf.d/matrix-etherpad.conf.j2"
@@ -291,6 +298,12 @@
     state: absent
   when: "not matrix_nginx_proxy_proxy_dimension_enabled | bool"
 
+- name: Ensure Matrix nginx-proxy configuration for rageshake domain deleted
+  ansible.builtin.file:
+    path: "{{ matrix_nginx_proxy_confd_path }}/matrix-rageshake.conf"
+    state: absent
+  when: "not matrix_nginx_proxy_proxy_rageshake_enabled | bool"
+
 - name: Ensure Matrix nginx-proxy configuration for goneb domain deleted
   ansible.builtin.file:
     path: "{{ matrix_nginx_proxy_confd_path }}/matrix-bot-go-neb.conf"

roles/custom/matrix-nginx-proxy/templates/labels.j2

@@ -38,17 +38,6 @@ traefik.http.routers.matrix-nginx-proxy-matrix-federation.tls.certResolver={{ ma
 traefik.http.routers.matrix-nginx-proxy-matrix-federation.entrypoints={{ matrix_nginx_proxy_container_labels_traefik_proxy_matrix_federation_entrypoints }}
 {% endif %}
 
-{% if matrix_nginx_proxy_container_labels_traefik_proxy_buscarron_enabled %}
-# Buscarron
-traefik.http.routers.matrix-nginx-proxy-buscarron.rule={{ matrix_nginx_proxy_container_labels_traefik_proxy_buscarron_rule }}
-traefik.http.routers.matrix-nginx-proxy-buscarron.service=matrix-nginx-proxy-web
-traefik.http.routers.matrix-nginx-proxy-buscarron.tls={{ matrix_nginx_proxy_container_labels_traefik_proxy_buscarron_tls | to_json }}
-{% if matrix_nginx_proxy_container_labels_traefik_proxy_buscarron_tls %}
-traefik.http.routers.matrix-nginx-proxy-buscarron.tls.certResolver={{ matrix_nginx_proxy_container_labels_traefik_tls_certResolver }}
-{% endif %}
-traefik.http.routers.matrix-nginx-proxy-buscarron.entrypoints={{ matrix_nginx_proxy_container_labels_traefik_entrypoints }}
-{% endif %}
-
 
 {% if matrix_nginx_proxy_container_labels_traefik_proxy_dimension_enabled %}
 # Dimension
@@ -97,17 +86,6 @@ traefik.http.routers.matrix-nginx-proxy-jitsi.tls.certResolver={{ matrix_nginx_p
 traefik.http.routers.matrix-nginx-proxy-jitsi.entrypoints={{ matrix_nginx_proxy_container_labels_traefik_entrypoints }}
 {% endif %}
 
-{% if matrix_nginx_proxy_container_labels_traefik_proxy_sygnal_enabled %}
-# Sygnal
-traefik.http.routers.matrix-nginx-proxy-sygnal.rule={{ matrix_nginx_proxy_container_labels_traefik_proxy_sygnal_rule }}
-traefik.http.routers.matrix-nginx-proxy-sygnal.service=matrix-nginx-proxy-web
-traefik.http.routers.matrix-nginx-proxy-sygnal.tls={{ matrix_nginx_proxy_container_labels_traefik_proxy_sygnal_tls | to_json }}
-{% if matrix_nginx_proxy_container_labels_traefik_proxy_sygnal_tls %}
-traefik.http.routers.matrix-nginx-proxy-sygnal.tls.certResolver={{ matrix_nginx_proxy_container_labels_traefik_tls_certResolver }}
-{% endif %}
-traefik.http.routers.matrix-nginx-proxy-sygnal.entrypoints={{ matrix_nginx_proxy_container_labels_traefik_entrypoints }}
-{% endif %}
-
 
 traefik.http.services.matrix-nginx-proxy-web.loadbalancer.server.port=8080
 

roles/custom/matrix-nginx-proxy/templates/nginx/conf.d/matrix-rageshake.conf.j2

@@ -0,0 +1,100 @@
+#jinja2: lstrip_blocks: "True"
+
+{% macro render_vhost_directives() %}
+	gzip on;
+	gzip_types text/plain application/json application/javascript text/css image/x-icon font/ttf image/gif;
+	{% if matrix_nginx_proxy_hsts_preload_enabled %}
+		add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
+	{% else %}
+		add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
+	{% endif %}
+	add_header X-XSS-Protection "{{ matrix_nginx_proxy_xss_protection }}";
+	add_header X-Content-Type-Options nosniff;
+	{% if matrix_nginx_proxy_floc_optout_enabled %}
+		add_header Permissions-Policy interest-cohort=() always;
+	{% endif %}
+
+{% for configuration_block in matrix_nginx_proxy_proxy_rageshake_additional_server_configuration_blocks %}
+	{{- configuration_block }}
+{% endfor %}
+
+	location / {
+		{% if matrix_nginx_proxy_enabled %}
+			{# Use the embedded DNS resolver in Docker containers to discover the service #}
+			resolver {{ matrix_nginx_proxy_http_level_resolver }} valid=5s;
+			set $backend "matrix-rageshake:9110";
+			proxy_pass http://$backend;
+		{% else %}
+			{# Generic configuration for use outside of our container setup #}
+			proxy_pass http://127.0.0.1:9110;
+		{% endif %}
+
+		proxy_set_header Host $host;
+		proxy_set_header X-Forwarded-For {{ matrix_nginx_proxy_x_forwarded_for }};
+	}
+{% endmacro %}
+
+server {
+	listen {{ 8080 if matrix_nginx_proxy_enabled else 80 }};
+	listen [::]:{{ 8080 if matrix_nginx_proxy_enabled else 80 }};
+
+	server_name {{ matrix_nginx_proxy_proxy_rageshake_hostname }};
+
+	server_tokens off;
+	root /dev/null;
+
+	{% if matrix_nginx_proxy_https_enabled %}
+		location /.well-known/acme-challenge {
+			{% if matrix_nginx_proxy_enabled %}
+				{# Use the embedded DNS resolver in Docker containers to discover the service #}
+				resolver {{ matrix_nginx_proxy_http_level_resolver }} valid=5s;
+				set $backend "matrix-certbot:8080";
+				proxy_pass http://$backend;
+			{% else %}
+				{# Generic configuration for use outside of our container setup #}
+				proxy_pass http://127.0.0.1:{{ matrix_ssl_lets_encrypt_certbot_standalone_http_port }};
+			{% endif %}
+		}
+
+		location / {
+			return 301 https://$http_host$request_uri;
+		}
+	{% else %}
+		{{ render_vhost_directives() }}
+	{% endif %}
+}
+
+{% if matrix_nginx_proxy_https_enabled %}
+server {
+	listen {{ 8443 if matrix_nginx_proxy_enabled else 443 }} ssl http2;
+	listen [::]:{{ 8443 if matrix_nginx_proxy_enabled else 443 }} ssl http2;
+
+	server_name {{ matrix_nginx_proxy_proxy_rageshake_hostname }};
+
+	server_tokens off;
+	root /dev/null;
+
+	ssl_certificate {{ matrix_ssl_config_dir_path }}/live/{{ matrix_nginx_proxy_proxy_rageshake_hostname }}/fullchain.pem;
+	ssl_certificate_key {{ matrix_ssl_config_dir_path }}/live/{{ matrix_nginx_proxy_proxy_rageshake_hostname }}/privkey.pem;
+
+	ssl_protocols {{ matrix_nginx_proxy_ssl_protocols }};
+	{% if matrix_nginx_proxy_ssl_ciphers != '' %}
+	ssl_ciphers {{ matrix_nginx_proxy_ssl_ciphers }};
+	{% endif %}
+	ssl_prefer_server_ciphers {{ matrix_nginx_proxy_ssl_prefer_server_ciphers }};
+
+	{% if matrix_nginx_proxy_ocsp_stapling_enabled %}
+		ssl_stapling on;
+		ssl_stapling_verify on;
+		ssl_trusted_certificate {{ matrix_ssl_config_dir_path }}/live/{{ matrix_nginx_proxy_proxy_rageshake_hostname }}/chain.pem;
+	{% endif %}
+
+	{% if matrix_nginx_proxy_ssl_session_tickets_off %}
+		ssl_session_tickets off;
+	{% endif %}
+	ssl_session_cache {{ matrix_nginx_proxy_ssl_session_cache }};
+	ssl_session_timeout {{ matrix_nginx_proxy_ssl_session_timeout }};
+
+	{{ render_vhost_directives() }}
+}
+{% endif %}

roles/custom/matrix-rageshake/defaults/main.yml

@@ -0,0 +1,115 @@
+---
+
+# rageshake is a bug report collection service
+# Project source code URL: https://github.com/matrix-org/rageshake
+
+matrix_rageshake_enabled: true
+
+matrix_rageshake_scheme: https
+
+# The hostname at which rageshake is served.
+matrix_rageshake_hostname: ''
+
+# The path at which rageshake is exposed.
+# This value must either be `/` or not end with a slash (e.g. `/rageshake`).
+matrix_rageshake_path_prefix: /
+
+# There are no stable container image tags yet.
+# See: https://github.com/matrix-org/rageshake/issues/69
+matrix_rageshake_version: "master"
+
+matrix_rageshake_base_path: "{{ matrix_base_data_path }}/rageshake"
+matrix_rageshake_config_path: "{{ matrix_rageshake_base_path }}/config"
+matrix_rageshake_data_path: "{{ matrix_rageshake_base_path }}/data"
+matrix_rageshake_container_src_files_path: "{{ matrix_rageshake_base_path }}/container-src"
+
+matrix_rageshake_container_image: "{{ matrix_rageshake_container_image_name_prefix }}matrix-org/rageshake:{{ matrix_rageshake_container_image_tag }}"
+matrix_rageshake_container_image_name_prefix: "{{ 'localhost/' if matrix_rageshake_container_image_self_build else matrix_rageshake_container_registry_prefix }}"
+matrix_rageshake_container_image_force_pull: "{{ matrix_rageshake_container_image.endswith(':master') }}"
+matrix_rageshake_container_image_tag: "{{ matrix_rageshake_version }}"
+matrix_rageshake_container_registry_prefix: ghcr.io/
+
+matrix_rageshake_container_image_self_build: false
+matrix_rageshake_container_image_self_build_repo: "https://github.com/matrix-org/rageshake/"
+matrix_rageshake_container_image_self_build_repo_version: "{{ matrix_rageshake_version }}"
+
+# Controls whether the container exposes its HTTP port (tcp/9110 in the container).
+#
+# Takes an "<ip>:<port>" or "<port>" value (e.g. "127.0.0.1:9110"), or empty string to not expose.
+matrix_rageshake_container_http_host_bind_port: ''
+
+# The base container network. It will be auto-created by this role if it doesn't exist already.
+matrix_rageshake_container_network: matrix-rageshake
+
+# A list of additional container networks that the container would be connected to.
+# The role does not create these networks, so make sure they already exist.
+# Use this to expose this container to another reverse proxy, which runs in a different container network.
+matrix_rageshake_container_additional_networks: []
+
+# matrix_rageshake_container_labels_traefik_enabled controls whether labels to assist a Traefik reverse-proxy will be attached to the container.
+# See `../templates/labels.j2` for details.
+#
+# To inject your own other container labels, see `matrix_rageshake_container_labels_additional_labels`.
+matrix_rageshake_container_labels_traefik_enabled: true
+matrix_rageshake_container_labels_traefik_docker_network: "{{ matrix_rageshake_container_network }}"
+matrix_rageshake_container_labels_traefik_hostname: "{{ matrix_rageshake_hostname }}"
+# The path prefix must either be `/` or not end with a slash (e.g. `/rageshake`).
+matrix_rageshake_container_labels_traefik_path_prefix: "{{ matrix_rageshake_path_prefix }}"
+matrix_rageshake_container_labels_traefik_rule: "Host(`{{ matrix_rageshake_container_labels_traefik_hostname }}`){% if matrix_rageshake_container_labels_traefik_path_prefix != '/' %} && PathPrefix(`{{ matrix_rageshake_container_labels_traefik_path_prefix }}`){% endif %}"
+matrix_rageshake_container_labels_traefik_priority: 0
+matrix_rageshake_container_labels_traefik_entrypoints: web-secure
+matrix_rageshake_container_labels_traefik_tls: "{{ matrix_rageshake_container_labels_traefik_entrypoints != 'web' }}"
+matrix_rageshake_container_labels_traefik_tls_certResolver: default  # noqa var-naming
+
+# Controls which additional headers to attach to all HTTP responses.
+# To add your own headers, use `matrix_rageshake_container_labels_traefik_additional_response_headers_custom`
+matrix_rageshake_container_labels_traefik_additional_response_headers: "{{ matrix_rageshake_container_labels_traefik_additional_response_headers_auto | combine(matrix_rageshake_container_labels_traefik_additional_response_headers_custom) }}"
+matrix_rageshake_container_labels_traefik_additional_response_headers_auto: {}
+matrix_rageshake_container_labels_traefik_additional_response_headers_custom: {}
+
+# matrix_rageshake_container_labels_additional_labels contains a multiline string with additional labels to add to the container label file.
+# See `../templates/labels.j2` for details.
+#
+# Example:
+# matrix_rageshake_container_labels_additional_labels: |
+#   my.label=1
+#   another.label="here"
+matrix_rageshake_container_labels_additional_labels: ''
+
+# A list of extra arguments to pass to the container
+matrix_rageshake_container_extra_arguments: []
+
+# List of systemd services that matrix-rageshake.service depends on
+matrix_rageshake_systemd_required_services_list: ["docker.service"]
+
+# List of systemd services that matrix-rageshake.service wants
+matrix_rageshake_systemd_wanted_services_list: []
+
+matrix_rageshake_config_api_prefix: "{{ matrix_rageshake_scheme }}://{{ matrix_rageshake_hostname }}{{ matrix_rageshake_path_prefix }}{{ '' if matrix_rageshake_path_prefix == '/' else '/' }}api/"
+
+# Default Rageshake configuration template which covers the generic use case.
+# You can customize it by controlling the various variables inside it.
+#
+# For a more advanced customization, you can extend the default (see `matrix_rageshake_configuration_extension_yaml`)
+# or completely replace this variable with your own template.
+matrix_rageshake_configuration_yaml: "{{ lookup('template', 'templates/config.yml.j2') }}"
+
+matrix_rageshake_configuration_extension_yaml: |
+  # Your custom YAML configuration for Synapse goes here.
+  # This configuration extends the default starting configuration (`matrix_rageshake_configuration_yaml`).
+  #
+  # You can override individual variables from the default configuration, or introduce new ones.
+  #
+  # If you need something more special, you can take full control by
+  # completely redefining `matrix_rageshake_configuration_yaml`.
+  #
+  # Example configuration extension follows:
+  #
+  # github_project_mappings:
+  #   my-app: octocat/HelloWorld
+
+matrix_rageshake_configuration_extension: "{{ matrix_rageshake_configuration_extension_yaml | from_yaml if matrix_rageshake_configuration_extension_yaml | from_yaml is mapping else {} }}"
+
+# Holds the final Synapse configuration (a combination of the default and its extension).
+# You most likely don't need to touch this variable. Instead, see `matrix_rageshake_configuration_yaml`.
+matrix_rageshake_configuration: "{{ matrix_rageshake_configuration_yaml | from_yaml | combine(matrix_rageshake_configuration_extension, recursive=True) }}"

roles/custom/matrix-rageshake/tasks/install.yml

@@ -0,0 +1,76 @@
+---
+
+- name: Ensure rageshake paths exist
+  ansible.builtin.file:
+    path: "{{ item.path }}"
+    state: directory
+    mode: 0750
+    owner: "{{ matrix_user_username }}"
+    group: "{{ matrix_user_groupname }}"
+  with_items:
+    - path: "{{ matrix_rageshake_config_path }}"
+      when: true
+    - path: "{{ matrix_rageshake_data_path }}"
+      when: true
+    - path: "{{ matrix_rageshake_container_src_files_path }}"
+      when: matrix_rageshake_container_image_self_build | bool
+  when: "item.when | bool"
+
+- name: Ensure rageshake config file created
+  ansible.builtin.copy:
+    content: "{{ matrix_rageshake_configuration | to_nice_yaml(indent=2, width=999999) }}"
+    dest: "{{ matrix_rageshake_config_path }}/config.yml"
+    owner: "{{ matrix_user_username }}"
+    group: "{{ matrix_user_groupname }}"
+    mode: 0640
+
+- name: Ensure rageshake labels installed
+  ansible.builtin.template:
+    src: "{{ role_path }}/templates/labels.j2"
+    dest: "{{ matrix_rageshake_base_path }}/labels"
+    mode: 0640
+    owner: "{{ matrix_user_username }}"
+    group: "{{ matrix_user_groupname }}"
+
+- name: Ensure rageshake image is pulled
+  community.docker.docker_image:
+    name: "{{ matrix_rageshake_container_image }}"
+    source: "{{ 'pull' if ansible_version.major > 2 or ansible_version.minor > 7 else omit }}"
+    force_source: "{{ matrix_rageshake_container_image_force_pull if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}"
+    force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else matrix_rageshake_container_image_force_pull }}"
+  when: "not matrix_rageshake_container_image_self_build | bool"
+  register: result
+  retries: "{{ devture_playbook_help_container_retries_count }}"
+  delay: "{{ devture_playbook_help_container_retries_delay }}"
+  until: result is not failed
+
+- name: Ensure rageshake repository is present on self-build
+  ansible.builtin.git:
+    repo: "{{ matrix_rageshake_container_image_self_build_repo }}"
+    version: "{{ matrix_rageshake_container_image_self_build_version }}"
+    dest: "{{ matrix_rageshake_container_src_files_path }}"
+    force: "yes"
+  become: true
+  become_user: "{{ matrix_user_username }}"
+  register: matrix_rageshake_git_pull_results
+  when: "matrix_rageshake_container_image_self_build | bool"
+
+- name: Ensure rageshake container image is built
+  ansible.builtin.command:
+    cmd: |-
+      {{ devture_systemd_docker_base_host_command_docker }} buildx build
+      --tag={{ matrix_rageshake_container_image }}
+      --file={{ matrix_rageshake_container_src_files_path }}/Dockerfile
+      {{ matrix_rageshake_container_src_files_path }}
+  when: matrix_rageshake_container_image_self_build | bool
+
+- name: Ensure rageshake container network is created
+  community.general.docker_network:
+    name: "{{ matrix_rageshake_container_network }}"
+    driver: bridge
+
+- name: Ensure matrix-rageshake.service installed
+  ansible.builtin.template:
+    src: "{{ role_path }}/templates/systemd/matrix-rageshake.service.j2"
+    dest: "{{ devture_systemd_docker_base_systemd_path }}/matrix-rageshake.service"
+    mode: 0644

roles/custom/matrix-rageshake/tasks/main.yml

@@ -0,0 +1,19 @@
+---
+- block:
+    - when: matrix_rageshake_enabled | bool
+      ansible.builtin.include_tasks: "{{ role_path }}/tasks/validate_config.yml"
+
+    - when: matrix_rageshake_enabled | bool
+      ansible.builtin.include_tasks: "{{ role_path }}/tasks/install.yml"
+  tags:
+    - setup-all
+    - setup-rageshake
+    - install-all
+    - install-rageshake
+
+- block:
+    - when: not matrix_rageshake_enabled | bool
+      ansible.builtin.include_tasks: "{{ role_path }}/tasks/uninstall.yml"
+  tags:
+    - setup-all
+    - setup-rageshake

roles/custom/matrix-rageshake/tasks/uninstall.yml

@@ -0,0 +1,25 @@
+---
+
+- name: Check existence of matrix-rageshake service
+  ansible.builtin.stat:
+    path: "{{ devture_systemd_docker_base_systemd_path }}/matrix-rageshake.service"
+  register: matrix_rageshake_service_stat
+
+- when: matrix_rageshake_service_stat.stat.exists | bool
+  block:
+    - name: Ensure matrix-rageshake is stopped
+      ansible.builtin.service:
+        name: matrix-rageshake
+        state: stopped
+        enabled: false
+        daemon_reload: true
+
+    - name: Ensure matrix-rageshake.service doesn't exist
+      ansible.builtin.file:
+        path: "{{ devture_systemd_docker_base_systemd_path }}/matrix-rageshake.service"
+        state: absent
+
+    - name: Ensure rageshake paths don't exist
+      ansible.builtin.file:
+        path: "{{ matrix_rageshake_base_path }}"
+        state: absent

roles/custom/matrix-rageshake/tasks/validate_config.yml

@@ -0,0 +1,31 @@
+---
+
+- name: Fail if required rageshake settings not defined
+  ansible.builtin.fail:
+    msg: >
+      You need to define a required configuration setting (`{{ item }}`).
+  when: "vars[item] == ''"
+  with_items:
+    - matrix_rageshake_hostname
+    - matrix_rageshake_path_prefix
+    - matrix_rageshake_container_network
+
+- when: matrix_rageshake_container_labels_traefik_enabled | bool
+  block:
+    - name: Fail if required rageshake Traefik settings not defined
+      ansible.builtin.fail:
+        msg: >-
+          You need to define a required configuration setting (`{{ item }}`).
+      when: "vars[item] == ''"
+      with_items:
+        - matrix_rageshake_container_labels_traefik_hostname
+        - matrix_rageshake_container_labels_traefik_path_prefix
+
+    # We ensure it doesn't end with a slash, because we handle both (slash and no-slash).
+    # Knowing that `matrix_rageshake_container_labels_traefik_path_prefix` does not end with a slash
+    # ensures we know how to set these routes up without having to do "does it end with a slash" checks elsewhere.
+    - name: Fail if matrix_rageshake_container_labels_traefik_path_prefix ends with a slash
+      ansible.builtin.fail:
+        msg: >-
+          matrix_rageshake_container_labels_traefik_path_prefix (`{{ matrix_rageshake_container_labels_traefik_path_prefix }}`) must either be `/` or not end with a slash (e.g. `/rageshake`).
+      when: "matrix_rageshake_container_labels_traefik_path_prefix != '/' and matrix_rageshake_container_labels_traefik_path_prefix[-1] == '/'"

roles/custom/matrix-rageshake/templates/config.yml.j2

@@ -0,0 +1,4 @@
+# Default configuration for Rageshake.
+# To extend it, use `matrix_rageshake_configuration_extension_yaml`.
+
+api_prefix: {{ matrix_rageshake_config_api_prefix | to_json }}

roles/custom/matrix-rageshake/templates/labels.j2

@@ -0,0 +1,45 @@
+{% if matrix_rageshake_container_labels_traefik_enabled %}
+traefik.enable=true
+
+{% if matrix_rageshake_container_labels_traefik_docker_network %}
+traefik.docker.network={{ matrix_rageshake_container_labels_traefik_docker_network }}
+{% endif %}
+
+{% set middlewares = [] %}
+
+{% if matrix_rageshake_container_labels_traefik_path_prefix != '/' %}
+traefik.http.middlewares.matrix-rageshake-slashless-redirect.redirectregex.regex=({{ matrix_rageshake_container_labels_traefik_path_prefix | quote }})$
+traefik.http.middlewares.matrix-rageshake-slashless-redirect.redirectregex.replacement=${1}/
+{% set middlewares = middlewares + ['matrix-rageshake-slashless-redirect'] %}
+{% endif %}
+
+{% if matrix_rageshake_container_labels_traefik_path_prefix != '/' %}
+traefik.http.middlewares.matrix-rageshake-strip-prefix.stripprefix.prefixes={{ matrix_rageshake_container_labels_traefik_path_prefix }}
+{% set middlewares = middlewares + ['matrix-rageshake-strip-prefix'] %}
+{% endif %}
+
+{% if matrix_rageshake_container_labels_traefik_additional_response_headers.keys() | length > 0 %}
+{% for name, value in matrix_rageshake_container_labels_traefik_additional_response_headers.items() %}
+traefik.http.middlewares.matrix-rageshake-add-headers.headers.customresponseheaders.{{ name }}={{ value }}
+{% endfor %}
+{% set middlewares = middlewares + ['matrix-rageshake-add-headers'] %}
+{% endif %}
+
+traefik.http.routers.matrix-rageshake.rule={{ matrix_rageshake_container_labels_traefik_rule }}
+{% if matrix_rageshake_container_labels_traefik_priority | int > 0 %}
+traefik.http.routers.matrix-rageshake.priority={{ matrix_rageshake_container_labels_traefik_priority }}
+{% endif %}
+traefik.http.routers.matrix-rageshake.service=matrix-rageshake
+{% if middlewares | length > 0 %}
+traefik.http.routers.matrix-rageshake.middlewares={{ middlewares | join(',') }}
+{% endif %}
+traefik.http.routers.matrix-rageshake.entrypoints={{ matrix_rageshake_container_labels_traefik_entrypoints }}
+traefik.http.routers.matrix-rageshake.tls={{ matrix_rageshake_container_labels_traefik_tls | to_json }}
+{% if matrix_rageshake_container_labels_traefik_tls %}
+traefik.http.routers.matrix-rageshake.tls.certResolver={{ matrix_rageshake_container_labels_traefik_tls_certResolver }}
+{% endif %}
+
+traefik.http.services.matrix-rageshake.loadbalancer.server.port=9110
+{% endif %}
+
+{{ matrix_rageshake_container_labels_additional_labels }}

roles/custom/matrix-rageshake/templates/systemd/matrix-rageshake.service.j2

@@ -0,0 +1,51 @@
+#jinja2: lstrip_blocks: "True"
+[Unit]
+Description=Matrix Rageshake Service
+{% for service in matrix_rageshake_systemd_required_services_list %}
+Requires={{ service }}
+After={{ service }}
+{% endfor %}
+{% for service in matrix_rageshake_systemd_wanted_services_list %}
+Wants={{ service }}
+{% endfor %}
+DefaultDependencies=no
+
+[Service]
+Type=simple
+Environment="HOME={{ devture_systemd_docker_base_systemd_unit_home_path }}"
+ExecStartPre=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} kill matrix-rageshake 2>/dev/null || true'
+ExecStartPre=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} rm matrix-rageshake 2>/dev/null || true'
+
+ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} create \
+			--rm \
+			--name=matrix-rageshake \
+			--log-driver=none \
+			--user={{ matrix_user_uid }}:{{ matrix_user_gid }} \
+			--cap-drop=ALL \
+			--read-only \
+			--tmpfs /tmp \
+			--network={{ matrix_rageshake_container_network }} \
+			--mount type=bind,src={{ matrix_rageshake_config_path }},dst=/config \
+			--mount type=bind,src={{ matrix_rageshake_data_path }},dst=/bugs \
+			--label-file={{ matrix_rageshake_base_path }}/labels \
+			{% for arg in matrix_rageshake_container_extra_arguments %}
+			{{ arg }} \
+			{% endfor %}
+			{{ matrix_rageshake_container_image }} \
+			--config /config/config.yml
+
+{% for network in matrix_rageshake_container_additional_networks %}
+ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} network connect {{ network }} matrix-rageshake
+{% endfor %}
+
+ExecStart={{ devture_systemd_docker_base_host_command_docker }} start --attach matrix-rageshake
+
+ExecStop=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} kill matrix-rageshake 2>/dev/null || true'
+ExecStop=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} rm matrix-rageshake 2>/dev/null || true'
+
+Restart=always
+RestartSec=30
+SyslogIdentifier=matrix-rageshake
+
+[Install]
+WantedBy=multi-user.target

roles/custom/matrix-sygnal/defaults/main.yml

@@ -1,28 +1,77 @@
 ---
+
 # Sygnal is a reference Push Gateway for Matrix.
 # To make use of it for delivering push notificatins, you'll need to develop/build your own Matrix app.
 # Project source code URL: https://github.com/matrix-org/sygnal
-matrix_sygnal_enabled: false
+matrix_sygnal_enabled: true
+
+# The hostname at which Sygnal is served.
+matrix_sygnal_hostname: ''
+
+# The path at which Sygnal is exposed.
+# This value must either be `/` or not end with a slash (e.g. `/sygnal`).
+matrix_sygnal_path_prefix: /
+
+matrix_sygnal_version: v0.12.0
 
 matrix_sygnal_base_path: "{{ matrix_base_data_path }}/sygnal"
 matrix_sygnal_config_path: "{{ matrix_sygnal_base_path }}/config"
 matrix_sygnal_data_path: "{{ matrix_sygnal_base_path }}/data"
 
-matrix_sygnal_version: v0.12.0
-matrix_sygnal_docker_image: "{{ matrix_container_global_registry_prefix }}matrixdotorg/sygnal:{{ matrix_sygnal_version }}"
-matrix_sygnal_docker_image_force_pull: "{{ matrix_sygnal_docker_image.endswith(':latest') }}"
-
 # List of systemd services that matrix-sygnal.service depends on.
 matrix_sygnal_systemd_required_services_list: ['docker.service']
 
 # List of systemd services that matrix-sygnal.service wants
 matrix_sygnal_systemd_wanted_services_list: []
 
+matrix_sygnal_docker_image: "{{ matrix_sygnal_docker_image_registry_prefix }}matrixdotorg/sygnal:{{ matrix_sygnal_docker_image_tag }}"
+matrix_sygnal_docker_image_tag: "{{ matrix_sygnal_version }}"
+matrix_sygnal_docker_image_registry_prefix: "{{ matrix_container_global_registry_prefix }}"
+matrix_sygnal_docker_image_force_pull: "{{ matrix_sygnal_docker_image.endswith(':latest') }}"
+
+# The base container network. It will be auto-created by this role if it doesn't exist already.
+matrix_sygnal_container_network: "{{ matrix_sygnal_identifier }}"
+
+# A list of additional container networks that the container would be connected to.
+# The role does not create these networks, so make sure they already exist.
+# Use this to expose this container to another reverse proxy, which runs in a different container network.
+matrix_sygnal_container_additional_networks: []
+
 # Controls whether the matrix-sygnal container exposes its HTTP port (tcp/6000 in the container).
 #
 # Takes an "<ip>:<port>" or "<port>" value (e.g. "127.0.0.1:6000"), or empty string to not expose.
 matrix_sygnal_container_http_host_bind_port: ''
 
+# matrix_sygnal_container_labels_traefik_enabled controls whether labels to assist a Traefik reverse-proxy will be attached to the container.
+# See `../templates/labels.j2` for details.
+#
+# To inject your own other container labels, see `matrix_sygnal_container_labels_additional_labels`.
+matrix_sygnal_container_labels_traefik_enabled: true
+matrix_sygnal_container_labels_traefik_docker_network: "{{ matrix_sygnal_container_network }}"
+matrix_sygnal_container_labels_traefik_hostname: "{{ matrix_sygnal_hostname }}"
+# The path prefix must either be `/` or not end with a slash (e.g. `/sygnal`).
+matrix_sygnal_container_labels_traefik_path_prefix: "{{ matrix_sygnal_path_prefix }}"
+matrix_sygnal_container_labels_traefik_rule: "Host(`{{ matrix_sygnal_container_labels_traefik_hostname }}`){% if matrix_sygnal_container_labels_traefik_path_prefix != '/' %} && PathPrefix(`{{ matrix_sygnal_container_labels_traefik_path_prefix }}`){% endif %}"
+matrix_sygnal_container_labels_traefik_priority: 0
+matrix_sygnal_container_labels_traefik_entrypoints: web-secure
+matrix_sygnal_container_labels_traefik_tls: "{{ matrix_sygnal_container_labels_traefik_entrypoints != 'web' }}"
+matrix_sygnal_container_labels_traefik_tls_certResolver: default  # noqa var-naming
+
+# Controls which additional headers to attach to all HTTP responses.
+# To add your own headers, use `matrix_sygnal_container_labels_traefik_additional_response_headers_custom`
+matrix_sygnal_container_labels_traefik_additional_response_headers: "{{ matrix_sygnal_container_labels_traefik_additional_response_headers_auto | combine(matrix_sygnal_container_labels_traefik_additional_response_headers_custom) }}"
+matrix_sygnal_container_labels_traefik_additional_response_headers_auto: {}
+matrix_sygnal_container_labels_traefik_additional_response_headers_custom: {}
+
+# matrix_sygnal_container_labels_additional_labels contains a multiline string with additional labels to add to the container label file.
+# See `../templates/labels.j2` for details.
+#
+# Example:
+# matrix_sygnal_container_labels_additional_labels: |
+#   my.label=1
+#   another.label="here"
+matrix_sygnal_container_labels_additional_labels: ''
+
 # A list of extra arguments to pass to the container
 matrix_sygnal_container_extra_arguments: []
 

roles/custom/matrix-sygnal/tasks/install.yml

@@ -1,16 +1,5 @@
 ---
 
-- name: Ensure Sygnal image is pulled
-  community.docker.docker_image:
-    name: "{{ matrix_sygnal_docker_image }}"
-    source: "{{ 'pull' if ansible_version.major > 2 or ansible_version.minor > 7 else omit }}"
-    force_source: "{{ matrix_sygnal_docker_image_force_pull if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}"
-    force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else matrix_sygnal_docker_image_force_pull }}"
-  register: result
-  retries: "{{ devture_playbook_help_container_retries_count }}"
-  delay: "{{ devture_playbook_help_container_retries_delay }}"
-  until: result is not failed
-
 - name: Ensure Sygnal paths exists
   ansible.builtin.file:
     path: "{{ item }}"
@@ -31,6 +20,30 @@
     owner: "{{ matrix_user_username }}"
     group: "{{ matrix_user_groupname }}"
 
+- name: Ensure Sygnal labels installed
+  ansible.builtin.template:
+    src: "{{ role_path }}/templates/labels.j2"
+    dest: "{{ matrix_sygnal_base_path }}/labels"
+    mode: 0640
+    owner: "{{ matrix_user_username }}"
+    group: "{{ matrix_user_groupname }}"
+
+- name: Ensure Sygnal image is pulled
+  community.docker.docker_image:
+    name: "{{ matrix_sygnal_docker_image }}"
+    source: "{{ 'pull' if ansible_version.major > 2 or ansible_version.minor > 7 else omit }}"
+    force_source: "{{ matrix_sygnal_docker_image_force_pull if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}"
+    force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else matrix_sygnal_docker_image_force_pull }}"
+  register: result
+  retries: "{{ devture_playbook_help_container_retries_count }}"
+  delay: "{{ devture_playbook_help_container_retries_delay }}"
+  until: result is not failed
+
+- name: Ensure Sygnal container network is created
+  community.general.docker_network:
+    name: "{{ matrix_sygnal_container_network }}"
+    driver: bridge
+
 - name: Ensure matrix-sygnal.service installed
   ansible.builtin.template:
     src: "{{ role_path }}/templates/systemd/matrix-sygnal.service.j2"

roles/custom/matrix-sygnal/tasks/main.yml

@@ -5,7 +5,7 @@
       ansible.builtin.include_tasks: "{{ role_path }}/tasks/validate_config.yml"
 
     - when: matrix_sygnal_enabled | bool
-      ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_install.yml"
+      ansible.builtin.include_tasks: "{{ role_path }}/tasks/install.yml"
   tags:
     - setup-all
     - setup-sygnal
@@ -14,7 +14,7 @@
 
 - block:
     - when: not matrix_sygnal_enabled | bool
-      ansible.builtin.include_tasks: "{{ role_path }}/tasks/setup_uninstall.yml"
+      ansible.builtin.include_tasks: "{{ role_path }}/tasks/uninstall.yml"
   tags:
     - setup-all
     - setup-sygnal

roles/custom/matrix-sygnal/tasks/validate_config.yml

@@ -1,7 +1,37 @@
 ---
 
+- name: Fail if required Sygnal settings not defined
+  ansible.builtin.fail:
+    msg: >
+      You need to define a required configuration setting (`{{ item }}`).
+  when: "vars[item] == ''"
+  with_items:
+    - matrix_sygnal_hostname
+    - matrix_sygnal_path_prefix
+    - matrix_sygnal_container_network
+
+- when: matrix_sygnal_container_labels_traefik_enabled | bool
+  block:
+    - name: Fail if required Sygnal Traefik settings not defined
+      ansible.builtin.fail:
+        msg: >-
+          You need to define a required configuration setting (`{{ item }}`).
+      when: "vars[item] == ''"
+      with_items:
+        - matrix_sygnal_container_labels_traefik_hostname
+        - matrix_sygnal_container_labels_traefik_path_prefix
+
+    # We ensure it doesn't end with a slash, because we handle both (slash and no-slash).
+    # Knowing that `matrix_sygnal_container_labels_traefik_path_prefix` does not end with a slash
+    # ensures we know how to set these routes up without having to do "does it end with a slash" checks elsewhere.
+    - name: Fail if matrix_sygnal_container_labels_traefik_path_prefix ends with a slash
+      ansible.builtin.fail:
+        msg: >-
+          matrix_sygnal_container_labels_traefik_path_prefix (`{{ matrix_sygnal_container_labels_traefik_path_prefix }}`) must either be `/` or not end with a slash (e.g. `/sygnal`).
+      when: "matrix_sygnal_container_labels_traefik_path_prefix != '/' and matrix_sygnal_container_labels_traefik_path_prefix[-1] == '/'"
+
 - name: Fail if no Sygnal apps defined
   ansible.builtin.fail:
     msg: >-
       Enabling Sygnal requires that you specify at least one app in `matrix_sygnal_apps`
-  when: "matrix_sygnal_enabled and matrix_sygnal_apps | length == 0"
+  when: "matrix_sygnal_apps | length == 0"

roles/custom/matrix-sygnal/templates/labels.j2

@@ -0,0 +1,45 @@
+{% if matrix_sygnal_container_labels_traefik_enabled %}
+traefik.enable=true
+
+{% if matrix_sygnal_container_labels_traefik_docker_network %}
+traefik.docker.network={{ matrix_sygnal_container_labels_traefik_docker_network }}
+{% endif %}
+
+{% set middlewares = [] %}
+
+{% if matrix_sygnal_container_labels_traefik_path_prefix != '/' %}
+traefik.http.middlewares.matrix-sygnal-slashless-redirect.redirectregex.regex=({{ matrix_sygnal_container_labels_traefik_path_prefix | quote }})$
+traefik.http.middlewares.matrix-sygnal-slashless-redirect.redirectregex.replacement=${1}/
+{% set middlewares = middlewares + ['matrix-sygnal-slashless-redirect'] %}
+{% endif %}
+
+{% if matrix_sygnal_container_labels_traefik_path_prefix != '/' %}
+traefik.http.middlewares.matrix-sygnal-strip-prefix.stripprefix.prefixes={{ matrix_sygnal_container_labels_traefik_path_prefix }}
+{% set middlewares = middlewares + ['matrix-sygnal-strip-prefix'] %}
+{% endif %}
+
+{% if matrix_sygnal_container_labels_traefik_additional_response_headers.keys() | length > 0 %}
+{% for name, value in matrix_sygnal_container_labels_traefik_additional_response_headers.items() %}
+traefik.http.middlewares.matrix-sygnal-add-headers.headers.customresponseheaders.{{ name }}={{ value }}
+{% endfor %}
+{% set middlewares = middlewares + ['matrix-sygnal-add-headers'] %}
+{% endif %}
+
+traefik.http.routers.matrix-sygnal.rule={{ matrix_sygnal_container_labels_traefik_rule }}
+{% if matrix_sygnal_container_labels_traefik_priority | int > 0 %}
+traefik.http.routers.matrix-sygnal.priority={{ matrix_sygnal_container_labels_traefik_priority }}
+{% endif %}
+traefik.http.routers.matrix-sygnal.service=matrix-sygnal
+{% if middlewares | length > 0 %}
+traefik.http.routers.matrix-sygnal.middlewares={{ middlewares | join(',') }}
+{% endif %}
+traefik.http.routers.matrix-sygnal.entrypoints={{ matrix_sygnal_container_labels_traefik_entrypoints }}
+traefik.http.routers.matrix-sygnal.tls={{ matrix_sygnal_container_labels_traefik_tls | to_json }}
+{% if matrix_sygnal_container_labels_traefik_tls %}
+traefik.http.routers.matrix-sygnal.tls.certResolver={{ matrix_sygnal_container_labels_traefik_tls_certResolver }}
+{% endif %}
+
+traefik.http.services.matrix-sygnal.loadbalancer.server.port=6000
+{% endif %}
+
+{{ matrix_sygnal_container_labels_additional_labels }}

roles/custom/matrix-sygnal/templates/systemd/matrix-sygnal.service.j2

@@ -16,15 +16,18 @@ Environment="HOME={{ devture_systemd_docker_base_systemd_unit_home_path }}"
 ExecStartPre=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} kill matrix-sygnal 2>/dev/null || true'
 ExecStartPre=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} rm matrix-sygnal 2>/dev/null || true'
 
-ExecStart={{ devture_systemd_docker_base_host_command_docker }} run --rm --name matrix-sygnal \
+ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} create \
+			--rm \
+			--name=matrix-sygnal \
 			--log-driver=none \
 			--user={{ matrix_user_uid }}:{{ matrix_user_gid }} \
 			--cap-drop=ALL \
 			--env=SYGNAL_CONF=/config/sygnal.yaml \
-			--network={{ matrix_docker_network }} \
+			--network={{ matrix_sygnal_container_network }} \
 			{% if matrix_sygnal_container_http_host_bind_port %}
 			-p {{ matrix_sygnal_container_http_host_bind_port }}:6000 \
 			{% endif %}
+			--label-file={{ matrix_sygnal_base_path }}/labels \
 			--mount type=bind,src={{ matrix_sygnal_config_path }},dst=/config \
 			--mount type=bind,src={{ matrix_sygnal_data_path }},dst=/data \
 			{% for arg in matrix_sygnal_container_extra_arguments %}
@@ -32,8 +35,15 @@ ExecStart={{ devture_systemd_docker_base_host_command_docker }} run --rm --name
 			{% endfor %}
 			{{ matrix_sygnal_docker_image }}
 
+{% for network in matrix_sygnal_container_additional_networks %}
+ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} network connect {{ network }} matrix-sygnal
+{% endfor %}
+
+ExecStart={{ devture_systemd_docker_base_host_command_docker }} start --attach matrix-sygnal
+
 ExecStop=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} kill matrix-sygnal 2>/dev/null || true'
 ExecStop=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} rm matrix-sygnal 2>/dev/null || true'
+
 Restart=always
 RestartSec=30
 SyslogIdentifier=matrix-sygnal

roles/custom/matrix-synapse-admin/defaults/main.yml

@@ -102,11 +102,11 @@ matrix_synapse_admin_http_header_content_security_policy: frame-ancestors 'self'
 
 # Specifies the value of the `Permission-Policy` header.
 # See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Permission-Policy
-matrix_synapse_admin_http_header_content_permission_policy: "{{ 'interest-cohort=() always' if matrix_synapse_admin_floc_optout_enabled else '' }}"
+matrix_synapse_admin_http_header_content_permission_policy: "{{ 'interest-cohort=()' if matrix_synapse_admin_floc_optout_enabled else '' }}"
 
 # Specifies the value of the `Strict-Transport-Security` header.
 # See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security
-matrix_synapse_admin_http_header_strict_transport_security: "{{ '\"max-age=31536000; includeSubDomains; preload\" always' if matrix_synapse_admin_hsts_preload_enabled else '\"max-age=31536000; includeSubDomains\" always' }}"
+matrix_synapse_admin_http_header_strict_transport_security: "max-age=31536000; includeSubDomains{{ '; preload' if matrix_synapse_admin_hsts_preload_enabled else '' }}"
 
 # Controls whether to send a "Permissions-Policy interest-cohort=();" header along with all responses
 #

roles/custom/matrix-synapse/defaults/main.yml

@@ -874,6 +874,9 @@ matrix_synapse_ext_synapse_s3_storage_provider_config_threadpool_size: 40
 # It specifies how old files need to have been inactive to be eligible for migration from the local filesystem to the S3 data store.
 # By default, we use `0` which says "all files are eligible for migration".
 matrix_synapse_ext_synapse_s3_storage_provider_update_db_day_count: 0
+# Specifies how often periodic migration (`matrix-synapse-s3-storage-provider-migrate.timer`) will run.
+# This is a systemd timer OnCalendar definition. Learn more here: https://man.archlinux.org/man/systemd.time.7#CALENDAR_EVENTS
+matrix_synapse_ext_synapse_s3_storage_provider_periodic_migration_schedule: '*-*-* 05:00:00'
 
 matrix_s3_media_store_enabled: false
 matrix_s3_media_store_custom_endpoint_enabled: false

roles/custom/matrix-synapse/templates/synapse/ext/s3-storage-provider/systemd/matrix-synapse-s3-storage-provider-migrate.timer.j2

@@ -3,7 +3,7 @@ Description=Migrates locally-stored Synapse media store files to S3
 
 [Timer]
 Unit=matrix-synapse-s3-storage-provider-migrate.service
-OnCalendar=*-*-* 05:00:00
+OnCalendar={{ matrix_synapse_ext_synapse_s3_storage_provider_periodic_migration_schedule }}
 
 [Install]
 WantedBy=timers.target

roles/custom/matrix-user-creator/defaults/main.yml

@@ -20,3 +20,6 @@ matrix_user_creator_users_auto: []
 # Add your own users here to have them end up in `matrix_user_creator_users` (see `vars/main.yml`) and get automatically created.
 # For example syntax for this variable, see the documentation for `matrix_user_creator_users` in `vars/main.yml`.
 matrix_user_creator_users_additional: []
+
+# matrix_user_creator_homeserver_start_wait_time_seconds specifies how long to wait after starting the homeserver service and before doing our work.
+matrix_user_creator_homeserver_start_wait_time_seconds: 10

roles/custom/matrix-user-creator/tasks/setup.yml

@@ -8,10 +8,6 @@
   # Suppress logging to avoid dumping the credentials to the shell
   no_log: true
 
-- name: Ensure systemd is reloaded before starting the homeserver
-  ansible.builtin.service:
-    daemon_reload: true
-
 - name: Ensure homeserver is started before creating Matrix users
   ansible.builtin.service:
     name: "matrix-{{ matrix_homeserver_implementation }}.service"
@@ -21,7 +17,7 @@
 
 - name: Wait a while, so that the homeserver can manage to start before creating Matrix users
   ansible.builtin.pause:
-    seconds: 7
+    seconds: "{{ matrix_user_creator_homeserver_start_wait_time_seconds }}"
   when: matrix_user_registrator_homeserver_start_result.changed | bool
 
 - name: Ensure Matrix users are created