`matrix_synapse_workers_generic_worker_client_server_endpoints` and
`matrix_synapse_workers_generic_worker_federation_endpoints` dropped the
non-matching entries with `difference([none])`. ansible-core implements
`difference` as `list(set(a) - set(b))`, so the result follows Python's
per-process string hash seed and comes out in a different order on every
run.
The reverse-proxy companion renders these lists as nginx `location`
blocks, so its `conf.d/matrix-synapse-reverse-proxy-companion.conf`
changed, and the companion restarted, on every run, even with nothing
else to change.
`reject('none')` drops the same entries and keeps the order of
`matrix_synapse_workers_generic_worker_endpoints`. All these locations
point to the same upstream, so routing is unchanged.
With Synapse workers enabled, inject_worker.yml appends each worker's
service to devture_systemd_service_manager_services_list_auto with
set_fact. That templates the whole list, including every service's
restart_necessary value, when the matrix-synapse role initializes, and
the resulting fact outranks group_vars. Services whose restart flag is
set after that point are then only started, not restarted, on install-*
runs even when their configuration changed. That includes the
matrix-synapse role's own reverse-proxy companion, Goofys and S3 storage
provider timer, and the services of every later role that sets a restart
flag (Element, Grafana, Prometheus, Traefik and others).
Collect worker services in matrix_synapse_worker_systemd_services_list
and append it to the auto list in group_vars/matrix_servers, like the
other entries there, so the list stays lazy.
Include inject_worker.yml once and loop inside each task instead of
including it once per worker. With 19 workers this cuts the step from
26.2 s to 5.3 s on ansible-core 2.20.1 (controller-only, one run). Also
fix two stream-writer failure messages that referenced the undefined
`item`, and report all missing worker properties in one message.
Synapse v1.152 introduces a new `quarantined_media_changes` stream and
requires that any worker serving `/_synapse/admin/v1/quarantine_media/`
be declared as a writer for that stream. Otherwise quarantining media
fails on the worker.
Add `quarantined_media_changes` as a web-facing stream writer alongside
the other stream-backed APIs and route the admin endpoint via the same
explicit writer-or-main model used for `device_lists`, `thread_subscriptions`,
etc. The endpoint is removed from `matrix_synapse_workers_media_repository_endpoints`
so the old media-repository route does not shadow (or conflict with) the
new writer-or-main route. Without that move, the previously-shipping
default of routing `/quarantine_media` to the `media_repository` worker
would silently break after the v1.152.0 image bump.
Default count is 1 in the `one-of-each` and `specialized-workers` presets
(matching `device_lists`), and 0 in `little-federation-helper` (which
also has no media-repository worker, so falling back to main is fine).
Refs:
- https://github.com/element-hq/synapse/blob/develop/docs/upgrade.md#upgrading-to-v11520
- https://element-hq.github.io/synapse/latest/workers.html#the-quarantined_media_changes-stream
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
The client_reader route bucket had collapsed into one long alternation,
which made small worker-audit edits hard to review. Any endpoint change
rewrote the whole regex and obscured whether we were changing routing
policy or just maintaining the route list.
Refactor the variable into grouped regex entries with comments instead.
This keeps the current specialized-worker policy intact: nginx still
renders the client_reader locations in the same block, and the routes
still target the same upstream bucket. The goal here is to make future
doc/code audits, additions, and removals mechanical and reviewable.
This also matches MDAD's current worker model, where generic workers are
not mixed with the specialized room/sync/client/federation reader
routing buckets, so there is no need to derive this from the generic
worker map.
Refs:
- https://github.com/element-hq/synapse/blob/b99a58719b274fcbb327fd8d7649185792bfd12c/docs/workers.md#historical-apps
- https://github.com/element-hq/synapse/blob/b99a58719b274fcbb327fd8d7649185792bfd12c/docs/workers.md#synapseappgeneric_worker
Some client API endpoints (e.g. keys/upload) are backed by Synapse stream writers and
should not rely on broad worker regexes or route-order fallthrough for correctness.
When explicit per-stream routing is missing, requests may be captured by generic, room, or client_reader workers, instead of:
- going to the configured stream writer
- or to `main` when that stream writer is not enabled
This refactors synapse-reverse-proxy-companion's routing so that web-facing stream-backed endpoint families
are handled explicitly and early, with deterministic writer-or-main fallback.
Add first-class support for the missing `device_lists` stream writer,
generalize the same routing model to `push_rules`,
and remove stale broad-route ownership for device-list-sensitive endpoints.
Issues and Pull Requests were not migrated to the new
organization/repository, so `matrix-org/synapse/pull` and
`matrix-org/synapse/issues` references were kept as-is.
`matrix-org/synapse-s3-storage-provider` references were also kept,
as that module still continues living under the `matrix-org` organization.
This patch mainly aims to change documentation-related things, not actual
usage in full yet. For polish that, another more comprehensive patch is coming later.
This also updates validation tasks and documentation, pointing to
variables in the matrix-synapse role which don't currently exist yet
(e.g. `matrix_synapse_container_labels_client_synapse_admin_api_enabled`).
These variables will be added soon, as Traefik labels are added to the
`matrix-synapse` role. At that point, the `matrix-synapse-reverse-proxy-companion` role
will be updated to also use them.
This was useful when the order of these roles in relation to Synapse
mattered (when we were injecting stuff into Synapse variables during
runtime). This is no longer the case since 0ea7cb5d18, so all of
this can be removed.
QEDeDandSlavi Pantaleev
Bartosz BezakandSlavi Pantaleev
Suguru Hirahara
Charles WrightandGitHub
Charles Wright
Alexis Yushin
Aine