With Synapse workers enabled, inject_worker.yml appends each worker's
service to devture_systemd_service_manager_services_list_auto with
set_fact. That templates the whole list, including every service's
restart_necessary value, when the matrix-synapse role initializes, and
the resulting fact outranks group_vars. Services whose restart flag is
set after that point are then only started, not restarted, on install-*
runs even when their configuration changed. That includes the
matrix-synapse role's own reverse-proxy companion, Goofys and S3 storage
provider timer, and the services of every later role that sets a restart
flag (Element, Grafana, Prometheus, Traefik and others).
Collect worker services in matrix_synapse_worker_systemd_services_list
and append it to the auto list in group_vars/matrix_servers, like the
other entries there, so the list stays lazy.
Include inject_worker.yml once and loop inside each task instead of
including it once per worker. With 19 workers this cuts the step from
26.2 s to 5.3 s on ansible-core 2.20.1 (controller-only, one run). Also
fix two stream-writer failure messages that referenced the undefined
`item`, and report all missing worker properties in one message.
Containers are created with `--rm`, so Docker removes them asynchronously after they stop.
The pre-start `docker rm` returns immediately while that removal is still in progress
(its error is suppressed), and the following `docker create --name` can fail with
"The container name ... is already in use".
This is easy to hit since systemd_service_manager switched its default restart mode to `all-at-once`:
many containers stop and start at the same time and Docker falls behind on removals.
The playbook then fails at "Restart systemd services needing restart at once",
even though the services recover on their own (`Restart=always`) a little later.
The external roles (MASH, devture) were hardened against this in 2026-03
(see mother-of-all-self-hosting/ansible-role-valkey@0ba79c0), but the roles in `roles/custom` never were.
This ports the same bounded cleanup loop to them: stop, force-remove,
and wait until Docker releases the name, failing explicitly after a timeout.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
The role replaced the `jitsi_web_framing_ancestors*` variables with `jitsi_web_http_header_content_security_policy_frame_ancestors*`.
Embedding is still allowed from anywhere, now via `jitsi_web_http_header_content_security_policy_frame_ancestors_enabled: false`.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
