Update Synapse to v1.163.0 and validate profile privacy settings

roles/custom/matrix-synapse/defaults/main.yml

@@ -16,7 +16,7 @@ matrix_synapse_enabled: true
 matrix_synapse_github_org_and_repo: element-hq/synapse
 
 # renovate: datasource=docker depName=ghcr.io/element-hq/synapse
-matrix_synapse_version: v1.162.0
+matrix_synapse_version: v1.163.0
 
 matrix_synapse_username: ''
 matrix_synapse_uid: ''
@@ -623,6 +623,7 @@ matrix_synapse_require_auth_for_profile_requests: false
 # to retrieve their profile information. Only checked on Client-Server
 # requests. Profile requests from other servers should be checked by the
 # requesting server. Defaults to 'false'.
+# Requires matrix_synapse_require_auth_for_profile_requests to be enabled.
 matrix_synapse_limit_profile_requests_to_users_who_share_rooms: false
 
 # Set to false to prevent a user's profile data from being retrieved and

roles/custom/matrix-synapse/tasks/validate_config.yml

@@ -167,6 +167,16 @@
       {{ matrix_synapse_reverse_proxy_companion_access_log_format_presets.keys() | sort | join(', ') }}
   when: "matrix_synapse_reverse_proxy_companion_access_log_format not in matrix_synapse_reverse_proxy_companion_access_log_format_presets"
 
+- name: Fail if shared-room profile restrictions are enabled without profile authentication
+  ansible.builtin.fail:
+    msg: >-
+      `matrix_synapse_limit_profile_requests_to_users_who_share_rooms: true` requires
+      `matrix_synapse_require_auth_for_profile_requests: true`. Synapse 1.163 and newer refuse
+      to start with this combination. Enable profile authentication to enforce the shared-room
+      restriction, or disable the shared-room restriction to preserve the previous unrestricted
+      profile lookup behavior.
+  when: matrix_synapse_limit_profile_requests_to_users_who_share_rooms | bool and not matrix_synapse_require_auth_for_profile_requests | bool
+
 - name: Fail when mixing generic workers with new specialized workers
   ansible.builtin.fail:
     msg: >-