6b4b7647e fixed this for synapse-usage-exporter only. A checkout owned by
a different user makes the git task fail from then on, either with a
permission error or with git's dubious-ownership protection, until
someone removes the directory on the host by hand. It gets into that
state when the matrix user's uid changes (a server migration or a restore
onto a differently numbered user), when an earlier clone ran as another
user, or when someone runs git as root inside the checkout.
Every other role cloning a repository onto the server was open to the
same failure, so ensure the checkout's ownership recursively before
updating it at the remaining 54 sites.
The three matrix-synapse ext clones also gain force=yes. They were the
only on-server clones without it, which left a checkout that an
interrupted run had half-written wedged, instead of repaired on the next
run.
matrix-matrixto used to clone as root into a directory that nothing ever
chowned, unlike every other role. It now becomes the matrix user too.
The Element Web and SchildiChat Web theme checkouts live on the Ansible
controller, where correcting ownership is not ours to do, so they merely
mark the checkout as a safe directory for git.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
The recursive chown in front of the git task already guarantees that git
operates on a checkout owned by the user it becomes, so marking the path
as a safe.directory on top of that protects against nothing. Drop the
environment variables and condense the comment to a single line.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
The example only covered `matrix.example.com` and the federation stream,
so people who make the playbook serve the base domain were left without a
proxy host for it. Requests for the `/.well-known/matrix/*` files on the
base domain then never reach Traefik and Nginx Proxy Manager answers with
a 404 error of its own, breaking federation and client discovery.
The nginx example already covers this by listing `example.com` in its
`server_name` directive. Serving the base domain from the Matrix server
is optional though, so the new section says so and points people whose
base domain lives elsewhere to the server delegation documentation.
Also note that a `*.example.com` wildcard certificate does not cover the
base domain itself, which is easy to get wrong when setting this up.
Related to https://github.com/spantaleev/matrix-docker-ansible-deploy/issues/5465
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Logging in does not involve approving a session from the LINE mobile app.
The bridge shows a PIN code, which needs to be entered into the LINE
mobile app instead.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
The template was missing the public_media and direct_media sections, as
well as the bridge.phone_numbers_in_profile, bridge.relay.displayname_format
and backfill.threads.max_initial_messages settings.
Their absence made the bridge fall back to zero values instead of the
defaults that upstream ships (most notably disabling thread backfilling).
The template now matches the configuration that the bridge generates
itself, key for key.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Its upstream repository has been archived and has not seen a change
since March 2025. mautrix-linkedin now covers the same use case.
The bridge remains installable, but as with other deprecated and
unmaintained components, it is no longer listed in the README and has
been moved to the deprecated services section of the documentation.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Replaces the question-and-answer troubleshooting format (which no other
documentation page uses) with regular subsections, and clarifies why the
request needs to come from a Chrome-based browser.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
The variable was defined, but the configuration template hardcoded the
command prefix, so changing the variable had no effect.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
The variable was defined, but the configuration template hardcoded the
command prefix, so changing the variable had no effect.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
The variable was defined, but the configuration template hardcoded the
command prefix, so changing the variable had no effect.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
The playbook exposes service metrics under a single endpoint
(`https://matrix.example.com/metrics/*`), controlled by
`matrix_metrics_exposure_enabled` and friends. synapse-usage-exporter was
not wired into this at all, so its metrics could only be scraped by the
integrated Prometheus and were unreachable for an external one.
The role had no metrics router whatsoever. Its only Traefik router (for
the `/report-usage-stats/push` ingestion endpoint) was gated on
`matrix_synapse_usage_exporter_container_labels_traefik_enabled`, which
defaulted to `matrix_synapse_usage_exporter_proxying_enabled`. Adding a
metrics router under that same switch would have meant that exposing
metrics also publishes the ingestion endpoint, so the master switch now
defaults to `true` and each router carries its own conditional.
Despite its generic name, `matrix_synapse_usage_exporter_proxying_enabled`
only ever concerned the endpoint that Synapse pushes usage statistics
**to**, never the metrics endpoint that Prometheus reads **from**. The
documentation now says so explicitly.
Fixes https://github.com/spantaleev/matrix-docker-ansible-deploy/issues/5467
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
The new image restores the ability of SSH to ask about unknown host keys
and to prompt for the passphrase of an SSH key, which Ansible 2.21 broke
by having forked workers run session-isolated.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Until now, ntfy metrics could only be collected by an external Prometheus
server. Enabling the integrated Prometheus (`prometheus_enabled: true`)
now also has it scrape ntfy, like it does for the other services.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
The playbook exposes service metrics under a single endpoint
(`https://matrix.example.com/metrics/*`), controlled by
`matrix_metrics_exposure_enabled` and friends. ntfy was not wired into
this at all, so enabling metrics exposure did not expose ntfy's metrics
and enabling Basic Authentication did not protect them.
We have ntfy serve its metrics on a dedicated port, instead of on its
regular HTTP port. Serving them on the regular HTTP port also makes them
reachable at `https://ntfy.example.com/metrics`, where nothing protects
them, as ntfy does not apply its own access-control rules to the metrics
endpoint.
Fixes https://github.com/spantaleev/matrix-docker-ansible-deploy/issues/5468
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Since the introduction of the synapse-usage-exporter role (55f869254, #3442), group_vars/matrix_servers was overriding matrix_synapse_report_stats_endpoint with an empty string whenever synapse-usage-exporter was disabled, clobbering the role's matrix.org default.
For deployments that enable matrix_synapse_report_stats, Synapse would then try reporting statistics to an empty URL, failing with:
> synapse.app.homeserver - 210 - WARNING - phone_stats_home-0 - Error reporting stats: Invalid URI b''
The default endpoint URL now lives in a dedicated matrix_synapse_report_stats_endpoint_default variable, which group_vars/matrix_servers falls back to when synapse-usage-exporter is not enabled.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
None of these flags exist in current Synapse:
- msc3266_enabled: MSC3266 support was stabilized in Synapse v1.153.0 and the room summary API is now always enabled
- msc4140_enabled: this was never a Synapse configuration setting in any released version. Delayed events have always been controlled by the `max_event_delay_duration` setting, which the playbook was emitting alongside the flag. The toggle is now named `matrix_synapse_delayed_events_enabled`.
- msc4429_enabled: MSC4429 support has not landed in any released Synapse version, so this flag never had any effect
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
When no experimental features were enabled (e.g. Matrix RTC and Matrix Authentication Service both disabled), the generated homeserver.yaml contained `experimental_features: null`, which Synapse v1.157.0+ does not tolerate and crashes on startup.
The `experimental_features` configuration is now constructed via a dedicated `matrix_synapse_experimental_features` variable (split into `_default`, `_auto` and `_custom`, as is customary), which always yields a mapping (potentially an empty one).
Fixes https://github.com/spantaleev/matrix-docker-ansible-deploy/issues/5455
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
LiveKit Server configuration validation now requires an explicit choice
between an RTC port range and a multiplexed UDP port, instead of
silently rendering the default udp_port alongside a user-defined port
range (which LiveKit ignores). See the CHANGELOG entry for details.
Related to https://github.com/spantaleev/matrix-docker-ansible-deploy/issues/5344
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Points AI coding agents at the new style guide and summarizes the
repository layout and the conventions that are easy to get wrong
(roles/galaxy being auto-managed, group_vars wiring boundaries,
variable deprecation).
Related to #3631
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Codifies the conventions the playbook and its documentation already follow:
language and Markdown style, placeholder values for examples, the structure
of component documentation pages, and the checklist for adding a new
component (including where a component should live: this playbook, an
external MASH role, or mash-playbook).
Fixes#3631
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The exporter's configuration used to ship a leftover "myprefix" placeholder
as the metric name prefix, so the bundled Grafana dashboard (which queries
unprefixed metric names) could never show any data.
Metric names are now unprefixed and the namespace label value changed from
matrix to nginx. See the CHANGELOG entry for details.
Fixes https://github.com/spantaleev/matrix-docker-ansible-deploy/issues/3380
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
A single prefix-level catch in matrix_playbook_migration covers all
renamed bridge variable prefixes at once. It always runs (unlike the
per-role validate_config tasks, which only run when a role is enabled),
so a stale old-style _enabled variable cannot silently disable a bridge.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Renames the matrix_mautrix_SERVICENAME_* placeholders in the common
mautrix bridges guide to matrix_bridge_mautrix_SERVICENAME_*, and fixes
prose in the matrix-bridge-steam role that referred to the old variable
prefix and to a misspelled (underscore-styled) systemd service name.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Part of adopting a uniform naming policy for bridge variables,
where the variable prefix matches the role directory name.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Part of adopting a uniform naming policy for bridge variables,
where the variable prefix matches the role directory name.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Part of adopting a uniform naming policy for bridge variables,
where the variable prefix matches the role directory name.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Part of adopting a uniform naming policy for bridge variables,
where the variable prefix matches the role directory name.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Part of adopting a uniform naming policy for bridge variables,
where the variable prefix matches the role directory name.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Part of adopting a uniform naming policy for bridge variables,
where the variable prefix matches the role directory name.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Part of adopting a uniform naming policy for bridge variables,
where the variable prefix matches the role directory name.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Part of adopting a uniform naming policy for bridge variables,
where the variable prefix matches the role directory name.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Part of adopting a uniform naming policy for bridge variables,
where the variable prefix matches the role directory name.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Part of adopting a uniform naming policy for bridge variables,
where the variable prefix matches the role directory name.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Part of adopting a uniform naming policy for bridge variables,
where the variable prefix matches the role directory name.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Part of adopting a uniform naming policy for bridge variables,
where the variable prefix matches the role directory name.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Part of adopting a uniform naming policy for bridge variables,
where the variable prefix matches the role directory name.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Part of adopting a uniform naming policy for bridge variables,
where the variable prefix matches the role directory name.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Part of adopting a uniform naming policy for bridge variables,
where the variable prefix matches the role directory name.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Part of adopting a uniform naming policy for bridge variables,
where the variable prefix matches the role directory name.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Part of adopting a uniform naming policy for bridge variables,
where the variable prefix matches the role directory name.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Part of adopting a uniform naming policy for bridge variables,
where the variable prefix matches the role directory name.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Part of adopting a uniform naming policy for bridge variables,
where the variable prefix matches the role directory name.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Part of adopting a uniform naming policy for bridge variables,
where the variable prefix matches the role directory name.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Part of adopting a uniform naming policy for bridge variables,
where the variable prefix matches the role directory name.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Part of adopting a uniform naming policy for bridge variables,
where the variable prefix matches the role directory name.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Part of adopting a uniform naming policy for bridge variables,
where the variable prefix matches the role directory name.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Part of adopting a uniform naming policy for bridge variables,
where the variable prefix matches the role directory name.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Part of adopting a uniform naming policy for bridge variables,
where the variable prefix matches the role directory name.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Part of adopting a uniform naming policy for bridge variables,
where the variable prefix matches the role directory name.
The companion appservice variables defined by this role are folded
under the role prefix as well: matrix_mautrix_androidsms_* becomes
matrix_bridge_mautrix_wsproxy_androidsms_* and matrix_mautrix_imessage_*
becomes matrix_bridge_mautrix_wsproxy_imessage_*.
matrix_mautrix_signal_wsproxy_syncproxy_connection_string becomes
matrix_bridge_mautrix_wsproxy_syncproxy_connection_string, aligning it
with the sibling matrix_bridge_mautrix_wsproxy_syncproxy_* variables.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The new role version splits backup_borg_location_exclude_patterns into
auto/custom components, following the existing split for
backup_borg_location_source_directories. The playbook now wires its
computed values into the _auto variables for both, so users can append
their own entries via the _custom variables instead of redefining the
whole lists and accidentally dropping playbook-provided values.
Previously, redefining backup_borg_location_exclude_patterns dropped
the postgres_data_path exclusion (making borg walk live Postgres data
and fail with warning exit codes), and the playbook's own
source_directories wiring made the role's _custom variable a no-op.
Related to #5092
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
With workers enabled, every Synapse process (the main one and each
worker) maintains its own database connection pool of up to
matrix_synapse_database_cp_max (default: 10) connections. The previous
fixed limit of 500 left little headroom on setups running many workers,
where exhausting it manifests as degraded performance and, reportedly,
E2EE misbehavior.
Size the limit as a 200-connection baseline (for everything else that
talks to Postgres) plus cp_max connections per Synapse process, never
going below the previous value of 500. The stock worker presets stay at
500; setups that raise worker counts (or cp_max) get a limit that grows
accordingly. The new matrix_synapse_workers_total_count variable
reflects what the matrix_synapse_workers_*_count variables ask for; it
does not reflect a manually populated
matrix_synapse_workers_enabled_list, and such setups should override
postgres_max_connections themselves.
Fixes#4442
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The new version supports defining a multiplexed UDP port pool (e.g.
'7882-7892') in livekit_server_config_rtc_udp_port. Previously, the
role's configuration template silently mangled such values into
udp_port: 0. It also gains early validation of the port value.
Related to #5344
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The CDN section of the federation documentation tells users to set
matrix_synapse_federation_port_enabled: false, which only works because
that recipe moves federation traffic to the client port. Followed
partially (keeping federation on the dedicated federation port behind a
fronting reverse proxy), the same line removes the federation route
entirely and breaks federation. Say so explicitly.
Fixes#4475
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The bridge could only be installed by self-building its source code,
and its upstream repository (on src.miscworks.net) has become
unreachable (the Internet Archive last saw it alive in May 2026),
making installation impossible. The bridge was also based on the
long-unmaintained node-kakao library and carried a warning that using
it may get KakaoTalk accounts banned.
The playbook catches leftover matrix_appservice_kakaotalk_* variables
and points users to the manual uninstallation instructions.
Related to #5068
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The new version adds livekit_server_config_rtc_ips_includes and
livekit_server_config_rtc_ips_excludes variables, controlling LiveKit's
rtc.ips.includes/excludes CIDR filters for RTC IP addresses.
Related to #4958
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Matrix Authentication Service supports CAPTCHA protection (ReCaptcha
v2, Cloudflare Turnstile, hCaptcha) for certain operations like
self-service password registration, but configuring it required going
through matrix_authentication_service_configuration_extension_yaml.
Expose it via dedicated variables
(matrix_authentication_service_config_captcha_service, _site_key and
_secret_key), validate the service value and key presence, and document
the setup in the captcha documentation page, which so far only covered
Synapse and Dendrite.
Related to #5344
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Enabling matrix_hookshot_encryption_enabled configures the bridge side
correctly (registration flags, Valkey cache), but hookshot's encryption
also needs the homeserver to support and enable MSC2409 and MSC3202,
which are typically experimental features disabled by default. Nothing
documented that, so the resulting setup silently did not work.
Reference the MSCs in the variable's comment, and show the exact Synapse
settings in the hookshot documentation page. The playbook deliberately
does not auto-enable them: they are experimental homeserver-wide
features, and flipping them from a bridge toggle would be surprising.
Fixes#3861
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
etherpad_base_url always ends with a trailing slash, and the playbook
passed it verbatim to jitsi_etherpad_base, which the Jitsi role appends
path segments to (e.g. /p/). The generated Jitsi configuration therefore
contained URLs like https://etherpad.example.com//p/, which can 404
depending on the web server. Strip trailing slashes when wiring.
Fixes#3471
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The new role release splits grafana_dashboard_download_urls into
default/auto/custom components. Wire the playbook's automatic dashboard
list via the auto component, so users can add their own dashboards
through grafana_dashboard_download_urls_custom without clobbering it.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The autotuning defaults are derived from total system RAM, but every
Synapse process (the main one and each worker) applies the configured
limits independently, so worker setups multiply the theoretical
aggregate cache memory usage.
Fixes#3336
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Add the two remaining hints from the official Synapse backup guide:
- never import a dump into a database that already has tables present
(at best it errors, at worst it causes subtle inconsistencies)
- when restoring a backup older than the server's current state,
truncate e2e_one_time_keys_json before starting Synapse, so used
one-time keys are not re-issued (which causes decryption errors);
our pg_dumpall-based backup commands include that table
Fixes#4004
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Element Web redesigned its welcome page into a built-in component
(element-hq/element-web#33211, first released in spring 2026) and no
longer falls back to loading welcome.html. The custom page the playbook
installed had therefore silently stopped having any effect, and it was a
fork of an upstream file that upstream has deleted (its button icon
assets are already missing from current Element Web builds).
Remove the welcome.html shipping and the variables that only applied to
it (matrix_client_element_welcome_headline, _welcome_text,
_welcome_logo_link, _page_template_welcome_path), rejecting them in
validate_config.yml with pointers to the alternatives. Logo and
background customization keep working through Element Web's branding
options, which the new welcome page still honors. A fully custom page
can be self-hosted and wired via embedded_pages.welcome_url.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Synapse only generates thumbnails of local media at upload time (unless
dynamic_thumbnails is enabled, which the playbook does not do) and no
tooling exists to regenerate them, so restoring a backup left all
previously uploaded local images without thumbnails permanently. The
official Synapse backup guide recommends backing this directory up.
Related to #4004.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The configuration template only rendered a datastore when its for_kinds
list was non-empty, even though the inline documentation (matching
upstream's) describes forKinds: [] as the way to make a datastore
readonly. That made the documented migration scenario impossible: moving
media between the file and s3 datastores while keeping the old one
readable.
Introduce matrix_media_repo_datastore_file_enabled and
matrix_media_repo_datastore_s3_enabled, which default to the previous
kinds-based behavior. A readonly datastore is now expressed by enabling
the datastore explicitly while assigning it no kinds.
Fixes#4303
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
synapse-usage-exporter is self-built by default (no upstream image is
published), so every user enabling it runs the git clone/update task. A
docker-src checkout whose files are owned by a different user (e.g. left
behind by an earlier clone) made that task fail: either with a
permission error, or with git's dubious-ownership protection, which
ignores the repository's own configuration and surfaces as a confusing
"'origin' does not appear to be a git repository" error.
Ensure the checkout's ownership recursively before updating it, and mark
the path as a safe.directory for the git invocation itself (via
GIT_CONFIG_* environment variables), so the ownership check cannot
misfire regardless of which user git effectively runs as.
Fixes#5065
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The docs claimed that reverse-proxying "or simply a 302 redirect" needs
no CORS headers. That is only true for reverse-proxying: browsers apply
CORS checks to every response in a redirect chain, so a redirect
response itself must also carry Access-Control-Allow-Origin, otherwise
web clients fail even though the final destination sets the header.
Fixes#4650
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The user-namespace regexes in the mautrix-meta-messenger and
mautrix-meta-instagram registration templates interpolated
the bridge username prefix without regex-escaping it, unlike the
neighboring homeserver domain and appservice username values. The
default prefixes are regex-safe, but a customized prefix containing
regex metacharacters would produce a wrong (too broad or invalid)
appservice user namespace.
Related to the registration regex discussion in #5096.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The playbook-shipped welcome.html hardcoded #2e2f32 for the headline and
welcome text, which is nearly invisible on the dark background Element
renders when the dark theme is active. Element Web's default
use_system_theme behavior keys the theme off the system color scheme, so
switch the text to Element's dark-theme text color (#ebeef2) under a
prefers-color-scheme: dark media query.
Fixes#4838
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Pulls in borgmatic 2.1.6, fixing the 2.1.4 JSON parsing regression
(borgmatic-collective/borgmatic#1294) where warnings on stderr, such as
OpenSSH post-quantum key exchange notices, broke parsing of borg's JSON
output and failed the backup run.
Fixes#5188
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The wildcard certificate examples attached tls.domains labels to a
router named matrix-synapse-federation-api, but the Synapse role
actually names it matrix-synapse-public-federation-api (see
templates/synapse/labels.j2), so the documented labels matched nothing
and the certificate configuration silently did not apply.
Fixes#3129
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
matrix_appservice_discord_container_image_self_build only switched the
image registry prefix to localhost/, but the role never had any build
tasks, so enabling it always ended in an image pull failure. Remove the
variable and reject it in validate_config.yml with a hint that the
prebuilt image is amd64-only and that mautrix-discord is the better
option on other architectures.
Fixes#2379
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The import-synapse-media-store task synchronizes the media store with
ansible.posix.synchronize delegated to the server itself, which requires
the rsync binary on the server. Nothing in the playbook installs it, so
the import failed on minimal systems with "Failed to find required
executable rsync". Document the prerequisite.
Fixes#2551
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Caddy evaluates directives according to its own fixed directive order,
not their order in the Caddyfile. redir runs before reverse_proxy, so a
redirect elsewhere in the same site block silently shadows the
/.well-known/matrix reverse-proxying. Add a note and a handle-block
example that enforces the intended priority.
Fixes#1080
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The exporter's wal collector (enabled by default) calls pg_ls_waldir(),
which Postgres restricts to superusers and members of the pg_monitor
role. The exporter user is created as a plain managed-database user, so
scraping logged "permission denied for function pg_ls_waldir" on every
run.
Grant pg_monitor via the managed database's additional_sql_queries,
which the Postgres role applies both on initial creation and on
subsequent runs, covering existing installations too.
Fixes#3039
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Pulls in the pgloader connection string handling fix, which keeps the
Postgres password out of the command line and Ansible error output.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
