matrix-docker-ansible-deploy/roles/custom/matrix-bot-meowlnir/defaults/main.yml

# SPDX-FileCopyrightText: 2026 Slavi Pantaleev
#
# SPDX-License-Identifier: AGPL-3.0-or-later

---
# An opinionated Matrix moderation bot
# Project source code URL: https://github.com/maunium/meowlnir

matrix_bot_meowlnir_enabled: true

# renovate: datasource=docker depName=dock.mau.dev/maunium/meowlnir
matrix_bot_meowlnir_version: v0.2608.0

matrix_bot_meowlnir_container_image_self_build: false
matrix_bot_meowlnir_container_image_self_build_repo: "https://github.com/maunium/meowlnir.git"

matrix_bot_meowlnir_container_image: "{{ matrix_bot_meowlnir_container_image_registry_prefix }}{{ matrix_bot_meowlnir_container_image_registry_namespace_identifier }}:{{ matrix_bot_meowlnir_version }}"
matrix_bot_meowlnir_container_image_registry_namespace_identifier: "maunium/meowlnir"
matrix_bot_meowlnir_container_image_registry_prefix: "{{ 'localhost/' if matrix_bot_meowlnir_container_image_self_build else matrix_bot_meowlnir_container_image_registry_prefix_upstream }}"
matrix_bot_meowlnir_container_image_registry_prefix_upstream: "{{ matrix_bot_meowlnir_container_image_registry_prefix_upstream_default }}"
matrix_bot_meowlnir_container_image_registry_prefix_upstream_default: "dock.mau.dev/"

matrix_bot_meowlnir_base_path: "{{ matrix_base_data_path }}/meowlnir"
matrix_bot_meowlnir_config_path: "{{ matrix_bot_meowlnir_base_path }}/config"
matrix_bot_meowlnir_data_path: "{{ matrix_bot_meowlnir_base_path }}/data"
matrix_bot_meowlnir_bin_path: "{{ matrix_bot_meowlnir_base_path }}/bin"
matrix_bot_meowlnir_container_src_files_path: "{{ matrix_bot_meowlnir_base_path }}/docker-src"

matrix_bot_meowlnir_container_network: ""

matrix_bot_meowlnir_container_additional_networks: "{{ matrix_bot_meowlnir_container_additional_networks_auto + matrix_bot_meowlnir_container_additional_networks_custom }}"
matrix_bot_meowlnir_container_additional_networks_auto: []
matrix_bot_meowlnir_container_additional_networks_custom: []

# Controls whether the matrix-bot-meowlnir container exposes its HTTP port.
#
# Takes an "<ip>:<port>" or "<port>" value (e.g.
# "127.0.0.1:29339"), or empty string to not expose.
matrix_bot_meowlnir_container_http_host_bind_port: ''

# A list of extra arguments to pass to the container
matrix_bot_meowlnir_container_extra_arguments: []

# List of systemd services that matrix-bot-meowlnir.service depends on
matrix_bot_meowlnir_systemd_required_services_list: "{{ matrix_bot_meowlnir_systemd_required_services_list_default + matrix_bot_meowlnir_systemd_required_services_list_auto + matrix_bot_meowlnir_systemd_required_services_list_custom }}"
matrix_bot_meowlnir_systemd_required_services_list_default: "{{ [devture_systemd_docker_base_docker_service_name] if devture_systemd_docker_base_docker_service_name else [] }}"
matrix_bot_meowlnir_systemd_required_services_list_auto: []
matrix_bot_meowlnir_systemd_required_services_list_custom: []

# List of systemd services that matrix-bot-meowlnir.service wants
matrix_bot_meowlnir_systemd_wanted_services_list: []


########################################################################
#                                                                      #
# Appservice registration                                              #
#                                                                      #
########################################################################

# Meowlnir runs as an appservice.
# Unlike Draupnir in bot mode, it does not log in with an access token — the homeserver is told about it via a registration file.
#
# Bots themselves are created at runtime through Meowlnir's management API, within the user namespace declared below.
# See the role's documentation page for details.

matrix_bot_meowlnir_appservice_id: meowlnir

# The localpart of the appservice's own user.
# This user does not act as a moderation bot; it is the appservice's sender.
# Individual bots get their own users.
matrix_bot_meowlnir_appservice_sender_localpart: meowlnir

# The prefix for bot users created via the management API.
# Must line up with `matrix_bot_meowlnir_config_meowlnir4all_localpart_template`.
matrix_bot_meowlnir_user_prefix: "meowlnir_"


########################################################################
#                                                                      #
# Managed bots                                                         #
#                                                                      #
########################################################################

# Meowlnir hosts multiple bots, each with one or more management rooms, and creates them at runtime through its management API, not from its configuration file.
#
# The bots listed here are created (and kept up to date) by the playbook when running with the `ensure-matrix-users-created` tag, so that you do not need to call that API yourself.
#
# The fields below are required on every entry, so that each bot's setup can be understood without having to know what the playbook defaults to.
#
#   - `username`: the localpart of the bot user. Must begin with `matrix_bot_meowlnir_user_prefix`, or the homeserver will not let Meowlnir operate it. Pick it carefully — it becomes the bot's Matrix user ID and is awkward to change later.
#   - `displayname`: the name shown in rooms. Safe to change at any time.
#   - `avatar_url`: an `mxc://` URI, or an empty string for no avatar.
#   - `management_room_auto_create`: whether the playbook creates a management room for this bot. Mutually exclusive with `management_rooms` — see below.
#   - `management_rooms`: the rooms you send commands to. A list, because Meowlnir supports several per bot. Each entry needs an `id` (a room ID, not an alias) and an `encrypted` flag saying whether that room is encrypted.
#
# `management_room_auto_create` and `management_rooms` are mutually exclusive:
#
#   - `management_room_auto_create: false` requires at least one entry in `management_rooms`. You create the room yourself, and invite the bot after the first run.
#   - `management_room_auto_create: true` requires `management_rooms` to be empty. The playbook creates the room, invites the bot's initial managers and gives them the power level needed to command the bot. The room's encryption follows `matrix_bot_meowlnir_config_encryption_enable`.
#
# One optional field is also recognized:
#
#   - `initial_managers`: the users invited to a management room the playbook creates for this bot. Omit it to use `matrix_bot_meowlnir_initial_managers`. An explicitly empty list means nobody, which is an error for a bot relying on `management_room_auto_create`.
#
# Example:
# matrix_bot_meowlnir_bots_custom:
#   - username: meowlnir_bot
#     displayname: Meowlnir
#     avatar_url: ""
#     management_room_auto_create: false
#     management_rooms:
#       - id: "!qporfwt:example.com"
#         encrypted: false
matrix_bot_meowlnir_bots: "{{ matrix_bot_meowlnir_bots_auto + matrix_bot_meowlnir_bots_custom }}"
matrix_bot_meowlnir_bots_auto: []
matrix_bot_meowlnir_bots_custom: []

# The users invited to management rooms that the playbook creates, and given the power level required to command the bot there.
# Full Matrix user IDs (`@alice:example.com`).
#
# Only consulted by bots with `management_room_auto_create: true`, and only as the default for those which do not carry their own `initial_managers` list.
# The playbook points this at `matrix_admin` by default.
matrix_bot_meowlnir_initial_managers: []

# Controls whether the bot list above is authoritative for this Meowlnir instance.
#
# When enabled, bots and management rooms which are registered with Meowlnir but no longer declared are removed, so that the list describes the whole installation, not merely additions to it.
#
# Note that removing a bot only makes Meowlnir forget it.
# The bot's Matrix user is not deactivated and stays in the rooms it had joined, so clean that up separately if you want it gone for good.
matrix_bot_meowlnir_bots_pruning_enabled: true

# Controls whether pruning also happens when no bots are declared at all.
#
# Disabled by default, because an empty list is far more often a mistake (a commented-out block, an unset variable) than a genuine instruction to remove every bot.
# With this off, the playbook refuses that particular run.
#
# Only relevant when `matrix_bot_meowlnir_bots_pruning_enabled` is enabled.
matrix_bot_meowlnir_bots_pruning_on_empty_roster_enabled: false

# How long to wait after starting the Meowlnir service and before creating bots.
# Only waited on when the service was not already running.
matrix_bot_meowlnir_bots_start_wait_time_seconds: 15

# The name and topic given to management rooms that the playbook creates.
# Only used by bots with `management_room_auto_create` enabled.
matrix_bot_meowlnir_management_room_name: Meowlnir management room
matrix_bot_meowlnir_management_room_topic: >-
  Moderation commands for this Meowlnir bot are sent here.

# Regular expressions matching the users this appservice owns.
#
# Defined here, because they are used both in the appservice registration file below and when telling other components (Ketesa, for one) which users are appservice-managed.
# Writing them twice invites the two from drifting apart.
#
# The character class covers what the Matrix specification allows in a user ID localpart.
matrix_bot_meowlnir_user_regex: "^@{{ matrix_bot_meowlnir_user_prefix | regex_escape }}[a-zA-Z0-9._=/+-]+:{{ matrix_bot_meowlnir_config_homeserver_domain | regex_escape }}$"
matrix_bot_meowlnir_appservice_sender_regex: "^@{{ matrix_bot_meowlnir_appservice_sender_localpart | regex_escape }}:{{ matrix_bot_meowlnir_config_homeserver_domain | regex_escape }}$"

# Tokens shared between Meowlnir and the homeserver.
# Set these to strong, unique values.
# The playbook derives them from `matrix_homeserver_generic_secret_key` by default.
matrix_bot_meowlnir_appservice_token: ''
matrix_bot_meowlnir_homeserver_token: ''

matrix_bot_meowlnir_registration_yaml: |
  id: {{ matrix_bot_meowlnir_appservice_id | to_json }}
  as_token: {{ matrix_bot_meowlnir_appservice_token | to_json }}
  hs_token: {{ matrix_bot_meowlnir_homeserver_token | to_json }}
  url: {{ matrix_bot_meowlnir_appservice_url | to_json }}
  sender_localpart: {{ matrix_bot_meowlnir_appservice_sender_localpart | to_json }}
  rate_limited: false
  namespaces:
    users:
    - exclusive: true
      regex: {{ matrix_bot_meowlnir_user_regex | to_json }}
    - exclusive: true
      regex: {{ matrix_bot_meowlnir_appservice_sender_regex | to_json }}
  {% if matrix_bot_meowlnir_config_encryption_enable %}
  de.sorunome.msc2409.push_ephemeral: true
  push_ephemeral: true
  receive_ephemeral: true
  org.matrix.msc3202: true
  io.element.msc4190: true
  {% endif %}

matrix_bot_meowlnir_registration: "{{ matrix_bot_meowlnir_registration_yaml | from_yaml }}"


########################################################################
#                                                                      #
# Configuration: homeserver                                            #
#                                                                      #
########################################################################

# The address that Meowlnir can use to connect to the homeserver (client-server API).
matrix_bot_meowlnir_config_homeserver_address: ''

# The server name (base domain) of the homeserver.
matrix_bot_meowlnir_config_homeserver_domain: ''


########################################################################
#                                                                      #
# Configuration: meowlnir                                              #
#                                                                      #
########################################################################

# The hostname and port that Meowlnir listens on, inside the container.
matrix_bot_meowlnir_config_meowlnir_hostname: 0.0.0.0
matrix_bot_meowlnir_config_meowlnir_port: 29339

# The address that the homeserver can use to connect to Meowlnir.
matrix_bot_meowlnir_appservice_url: "http://matrix-bot-meowlnir:{{ matrix_bot_meowlnir_config_meowlnir_port }}"

# Secret for the management API (`/_meowlnir/v1/...`), which is how bots and management rooms get created.
# Set to `disable` to turn the API off entirely.
# The playbook derives a value from `matrix_homeserver_generic_secret_key` by default.
matrix_bot_meowlnir_config_meowlnir_management_secret: ''

# Secret for the `/_meowlnir/data` API.
# The playbook derives a value from `matrix_homeserver_generic_secret_key` by default.
matrix_bot_meowlnir_config_meowlnir_data_secret: ''

# Whether the `/_meowlnir/mxauth` APIs are enabled, which allow querying certain data using any Matrix account.
# Needed by the (not yet released) management web interface.
matrix_bot_meowlnir_config_meowlnir_federation_auth: false

# When enabled, Meowlnir does everything except take actual moderation actions.
# Useful for trialling Meowlnir alongside an existing moderation bot.
matrix_bot_meowlnir_config_meowlnir_dry_run: false

# Whether all bots should be considered untrusted, which enables additional checks (e.g. preventing subscription to a policy list without being in the room).
matrix_bot_meowlnir_config_meowlnir_untrusted: false

# The ID of the management room that handles requests to the Matrix report API.
# Requires `matrix_bot_meowlnir_config_reporting_enabled` to be enabled to be of use.
matrix_bot_meowlnir_config_meowlnir_report_room: ''

# The ID of the management room in charge of deleting rooms from the server.
# Room bans are not processed in other management rooms.
matrix_bot_meowlnir_config_meowlnir_room_ban_room: ''

# Whether Meowlnir should load all room IDs from the Synapse database on startup.
# Requires `matrix_bot_meowlnir_synapse_database_uri` to be set.
matrix_bot_meowlnir_config_meowlnir_load_all_room_hashes: "{{ matrix_bot_meowlnir_synapse_database_uri != '' }}"

# Entities (user IDs or server names) whose policies are ignored entirely.
# A blunt safety net against overly-wide policies from subscribed lists.
#
# Meowlnir always ignores policies matching its own homeserver domain, so there is no need to list it here.
matrix_bot_meowlnir_config_meowlnir_hacky_rule_filter: "{{ matrix_bot_meowlnir_config_meowlnir_hacky_rule_filter_auto + matrix_bot_meowlnir_config_meowlnir_hacky_rule_filter_custom }}"
matrix_bot_meowlnir_config_meowlnir_hacky_rule_filter_auto: []
matrix_bot_meowlnir_config_meowlnir_hacky_rule_filter_custom: []

# Glob patterns matched against policy reasons.
# When a policy matches, all messages from the banned target are redacted automatically.
# The reason `spam` is implicit.
matrix_bot_meowlnir_config_meowlnir_hacky_redact_patterns: "{{ matrix_bot_meowlnir_config_meowlnir_hacky_redact_patterns_default + matrix_bot_meowlnir_config_meowlnir_hacky_redact_patterns_auto + matrix_bot_meowlnir_config_meowlnir_hacky_redact_patterns_custom }}"
matrix_bot_meowlnir_config_meowlnir_hacky_redact_patterns_default:
  - spam
matrix_bot_meowlnir_config_meowlnir_hacky_redact_patterns_auto: []
matrix_bot_meowlnir_config_meowlnir_hacky_redact_patterns_custom: []

# Custom Synapse admin access tokens, per bot user ID.
#
# A few features (suspending or deactivating users, deleting rooms during a takedown) call Synapse's admin API, which requires the caller to be a server admin.
# Bots are not server admins, so those calls fail with `M_FORBIDDEN` until a token is supplied here. Nothing else is affected.
#
# When left empty, each bot falls back to the appservice token. That is fine for the client-server API, but carries no admin rights.
#
# The key is the bot the token is used for; the token itself belongs to an administrator account.
# Under Matrix Authentication Service it has to be issued by MAS, since Synapse no longer decides who is an admin. See the role's documentation page.
#
# Example:
# matrix_bot_meowlnir_config_meowlnir_admin_tokens:
#   "@meowlnir_bot:example.com": "ADMIN_TOKEN_HERE"
matrix_bot_meowlnir_config_meowlnir_admin_tokens: {}


########################################################################
#                                                                      #
# Configuration: meowlnir4all (provisioning bots for other people)     #
#                                                                      #
########################################################################

# None of this is relevant unless you offer moderation bots to other users.

# The management room ID that is allowed to use the `!provision` command.
matrix_bot_meowlnir_config_meowlnir4all_admin_room: ''

# The user ID template for newly provisioned bots.
matrix_bot_meowlnir_config_meowlnir4all_localpart_template: "{{ matrix_bot_meowlnir_user_prefix }}{{ '{{ uuidgen }}' }}"

matrix_bot_meowlnir_config_meowlnir4all_displayname: Administrator
matrix_bot_meowlnir_config_meowlnir4all_avatar_url: ''
matrix_bot_meowlnir_config_meowlnir4all_room_name: Meowlnir Management Room

# The policy lists that newly provisioned bots subscribe to by default.
#
# Note that the order of this list is meaningful: when several lists carry a policy for the same entity, the first match wins.
# Put your own list first if you want to be able to override policies from community lists with `!add-unban`.
matrix_bot_meowlnir_config_meowlnir4all_default_watched_lists: "{{ matrix_bot_meowlnir_config_meowlnir4all_default_watched_lists_auto + matrix_bot_meowlnir_config_meowlnir4all_default_watched_lists_custom }}"
matrix_bot_meowlnir_config_meowlnir4all_default_watched_lists_auto: []
matrix_bot_meowlnir_config_meowlnir4all_default_watched_lists_custom: []


########################################################################
#                                                                      #
# Configuration: antispam (synapse-http-antispam integration)          #
#                                                                      #
########################################################################

# Certain Meowlnir features (blocking invites and joins before they happen) require the synapse-http-antispam module: https://github.com/maunium/synapse-http-antispam
#
# The module has a single consumer, so this cannot be enabled at the same time as `matrix_bot_draupnir_config_web_synapseHTTPAntispam_enabled`.
matrix_bot_meowlnir_synapse_http_antispam_enabled: false

# Secret shared between Meowlnir and the synapse-http-antispam module.
# The playbook derives a value from `matrix_homeserver_generic_secret_key` by default.
matrix_bot_meowlnir_config_antispam_secret: ''

# Whether Meowlnir should check local invites for spam too.
matrix_bot_meowlnir_config_antispam_filter_local_invites: false

# When set, Meowlnir uses this token to reject pending invites from users who get banned.
# This should be an appservice token with access to all local users — the double-puppeting appservice token works well here.
matrix_bot_meowlnir_config_antispam_auto_reject_invites_token: ''

# Whether the management room receives a notice about blocked invites.
matrix_bot_meowlnir_config_antispam_notify_management_room: false

# Inviting any of the users listed here is blocked by default, unless separately allowed with the `!allow-invite` command.
matrix_bot_meowlnir_config_antispam_block_invites_to: "{{ matrix_bot_meowlnir_config_antispam_block_invites_to_auto + matrix_bot_meowlnir_config_antispam_block_invites_to_custom }}"
matrix_bot_meowlnir_config_antispam_block_invites_to_auto: []
matrix_bot_meowlnir_config_antispam_block_invites_to_custom: []

# The ID of the management room whose policies the synapse-http-antispam module consults.
#
# Meowlnir can host several bots, each with its own management room, so the module needs to be told which one to ask.
# Required when `matrix_bot_meowlnir_synapse_http_antispam_enabled` is on.
matrix_bot_meowlnir_synapse_http_antispam_management_room_id: ''

# The URL that the synapse-http-antispam module targets in Meowlnir.
#
# Meowlnir serves the antispam API at `/_meowlnir/antispam/<management room ID>/<callback>`; the module appends the callback name to this base URL.
matrix_bot_meowlnir_synapse_http_antispam_config_base_url: "{{ matrix_bot_meowlnir_appservice_url }}/_meowlnir/antispam/{{ matrix_bot_meowlnir_synapse_http_antispam_management_room_id }}"

matrix_bot_meowlnir_synapse_http_antispam_config_enabled_callbacks:
  - user_may_invite
  - user_may_join_room

matrix_bot_meowlnir_synapse_http_antispam_config_fail_open:
  user_may_invite: true
  user_may_join_room: true

matrix_bot_meowlnir_synapse_http_antispam_config_async: {}


########################################################################
#                                                                      #
# Configuration: policy server (MSC4284)                               #
#                                                                      #
########################################################################

# Whether Meowlnir acts as a policy server, letting rooms ask it to vet events before they are accepted.
# Rooms opt in by pointing at this server.
#
# Enabling this exposes `/_matrix/policy/` on the Matrix federation endpoint, so that other servers in the room can reach it.
matrix_bot_meowlnir_policy_server_enabled: false

# Whether to always issue redactions for events blocked by the policy server.
matrix_bot_meowlnir_config_policy_server_always_redact: true

# The Synapse-style private signing key used by the policy server.
#
# Must NOT be left as the literal `generate`:
# Meowlnir re-runs its config upgrader on every start, so `generate` would mint a fresh key on each restart.
# The playbook derives a stable key from `matrix_homeserver_generic_secret_key` by default.
matrix_bot_meowlnir_config_policy_server_signing_key: ''


########################################################################
#                                                                      #
# Configuration: reporting                                             #
#                                                                      #
########################################################################

# Meowlnir can intercept the report API endpoints of the client-server API, so that abuse reports land in a management room.
# This requires integration with the reverse proxy in front of the homeserver, which the playbook sets up for you when using Traefik.
#
# Also set `matrix_bot_meowlnir_config_meowlnir_report_room` to the management room that should receive the reports.
matrix_bot_meowlnir_config_reporting_enabled: false


########################################################################
#                                                                      #
# Configuration: encryption                                            #
#                                                                      #
########################################################################

# Whether Meowlnir bots support end-to-end encryption.
#
# This requires MSC3202, MSC4190 and MSC4203 support on the homeserver, plus `experimental_features.msc2409_to_device_messages_enabled`.
# On Synapse, the playbook turns these on for you when this is enabled.
matrix_bot_meowlnir_config_encryption_enable: false

# Pickle key used for encrypting encryption keys in the crypto store.
#
# A fixed constant, like the mautrix bridge roles use, and for the same reason: the crypto store can't be read with a different key than it was written with, so a value that may change would cost the bots their encryption sessions.
#
# When migrating a Meowlnir installation that this playbook did not set up, set this to the `pickle_key` from its old configuration file.
matrix_bot_meowlnir_config_encryption_pickle_key: go.mau.fi/meowlnir


########################################################################
#                                                                      #
# Configuration: databases                                             #
#                                                                      #
########################################################################

matrix_bot_meowlnir_database_engine: postgres

matrix_bot_meowlnir_database_username: matrix_bot_meowlnir
matrix_bot_meowlnir_database_password: ''
matrix_bot_meowlnir_database_hostname: ''
matrix_bot_meowlnir_database_port: 5432
matrix_bot_meowlnir_database_name: matrix_bot_meowlnir
matrix_bot_meowlnir_database_sslmode: disable

matrix_bot_meowlnir_database_connection_string: "postgresql://{{ matrix_bot_meowlnir_database_username }}:{{ matrix_bot_meowlnir_database_password }}@{{ matrix_bot_meowlnir_database_hostname }}:{{ matrix_bot_meowlnir_database_port }}/{{ matrix_bot_meowlnir_database_name }}?sslmode={{ matrix_bot_meowlnir_database_sslmode }}"

matrix_bot_meowlnir_config_database_max_open_conns: 20
matrix_bot_meowlnir_config_database_max_idle_conns: 2
matrix_bot_meowlnir_config_database_max_conn_idle_time: ''
matrix_bot_meowlnir_config_database_max_conn_lifetime: ''

# Access to the Synapse database.
# Optional: it powers room-hash lookups used by the room takedown features.
# Leave disabled to run without it.
#
# Upstream expects a user with read-only (SELECT) permissions.
# The playbook does not create one, so enabling the integration below hands Meowlnir the same credentials Synapse itself uses — which grant write access too.
# Enable it only if you are comfortable with that; otherwise set `matrix_bot_meowlnir_synapse_database_uri` yourself, pointing at a read-only user you have created.
matrix_bot_meowlnir_synapse_database_integration_enabled: false

# Only Postgres is supported.
# Example:
# matrix_bot_meowlnir_synapse_database_uri: postgresql://user:password@matrix-postgres:5432/synapse?sslmode=disable
matrix_bot_meowlnir_synapse_database_uri: ''

matrix_bot_meowlnir_config_synapse_db_max_open_conns: 2
matrix_bot_meowlnir_config_synapse_db_max_idle_conns: 1
matrix_bot_meowlnir_config_synapse_db_max_conn_idle_time: ''
matrix_bot_meowlnir_config_synapse_db_max_conn_lifetime: ''


########################################################################
#                                                                      #
# Configuration: logging                                               #
#                                                                      #
########################################################################

matrix_bot_meowlnir_config_logging_min_level: info

matrix_bot_meowlnir_config_logging_writers:
  - type: stdout
    format: pretty-colored


########################################################################
#                                                                      #
# Traefik labels                                                       #
#                                                                      #
########################################################################

# Controls whether labels will be added that route certain paths to Meowlnir.
# Regardless of whether this is enabled, it may or may not take effect due to the value of other variables.
# See `matrix_synapse_container_labels_traefik_enabled` or `matrix_synapse_container_labels_matrix_related_labels_enabled`.
matrix_bot_meowlnir_container_labels_traefik_enabled: "{{ matrix_bot_meowlnir_config_reporting_enabled or matrix_bot_meowlnir_policy_server_enabled }}"
matrix_bot_meowlnir_container_labels_traefik_docker_network: "{{ matrix_bot_meowlnir_container_network }}"

# Reports (/_matrix/client/../rooms/../report and /_matrix/client/../users/../report)
#
# Only `v3` is matched on purpose:
# Meowlnir does not serve the legacy `r0` paths, so routing those here would break reporting for old clients.
matrix_bot_meowlnir_container_labels_reporting_traefik_hostname: "{{ matrix_synapse_container_labels_traefik_hostname }}"
matrix_bot_meowlnir_container_labels_reporting_traefik_path_regexp: "^/_matrix/client/v3/(rooms|users)/[^/]+/report(/.*)?$"
matrix_bot_meowlnir_container_labels_reporting_traefik_rule: "Host(`{{ matrix_bot_meowlnir_container_labels_reporting_traefik_hostname }}`) && PathRegexp(`{{ matrix_bot_meowlnir_container_labels_reporting_traefik_path_regexp }}`)"
matrix_bot_meowlnir_container_labels_reporting_traefik_priority: 0
matrix_bot_meowlnir_container_labels_reporting_traefik_entrypoints: "{{ matrix_synapse_container_labels_traefik_entrypoints }}"
matrix_bot_meowlnir_container_labels_reporting_traefik_tls: "{{ matrix_bot_meowlnir_container_labels_reporting_traefik_entrypoints != 'web' }}"
matrix_bot_meowlnir_container_labels_reporting_traefik_tls_certResolver: "{{ matrix_synapse_container_labels_traefik_tls_certResolver }}"  # noqa var-naming

# Policy server (/_matrix/policy), served on the federation endpoint
matrix_bot_meowlnir_container_labels_policy_server_traefik_hostname: "{{ matrix_synapse_container_labels_public_federation_api_traefik_hostname }}"
matrix_bot_meowlnir_container_labels_policy_server_traefik_path_prefix: /_matrix/policy
matrix_bot_meowlnir_container_labels_policy_server_traefik_rule: "Host(`{{ matrix_bot_meowlnir_container_labels_policy_server_traefik_hostname }}`) && PathPrefix(`{{ matrix_bot_meowlnir_container_labels_policy_server_traefik_path_prefix }}`)"
matrix_bot_meowlnir_container_labels_policy_server_traefik_priority: 0
matrix_bot_meowlnir_container_labels_policy_server_traefik_entrypoints: "{{ matrix_synapse_container_labels_public_federation_api_traefik_entrypoints }}"
matrix_bot_meowlnir_container_labels_policy_server_traefik_tls: "{{ matrix_bot_meowlnir_container_labels_policy_server_traefik_entrypoints != 'web' }}"
matrix_bot_meowlnir_container_labels_policy_server_traefik_tls_certResolver: "{{ matrix_synapse_container_labels_traefik_tls_certResolver }}"  # noqa var-naming

# matrix_bot_meowlnir_container_labels_traefik_labels_additional_labels contains a multiline string with additional labels to add to the container label file.
# See `../templates/labels.j2` for details.
#
# Example:
# matrix_bot_meowlnir_container_labels_traefik_labels_additional_labels: |
#   my.label=1
#   another.label="here"
matrix_bot_meowlnir_container_labels_traefik_labels_additional_labels: ''


########################################################################
#                                                                      #
# Configuration assembly                                               #
#                                                                      #
########################################################################

# Default configuration template which covers the generic use case.
# You can customize it by controlling the various variables inside it.
#
# For a more advanced customization, you can extend the default (see `matrix_bot_meowlnir_configuration_extension_yaml`) or completely replace this variable with your own template.
matrix_bot_meowlnir_configuration_yaml: "{{ lookup('template', 'templates/config.yaml.j2') }}"

matrix_bot_meowlnir_configuration_extension_yaml: |
  # Your custom YAML configuration goes here.
  # This configuration extends the default starting configuration (`matrix_bot_meowlnir_configuration_yaml`).
  #
  # You can override individual variables from the default configuration, or introduce new ones.
  #
  # If you need something more special, you can take full control by completely redefining `matrix_bot_meowlnir_configuration_yaml`.

matrix_bot_meowlnir_configuration_extension: "{{ matrix_bot_meowlnir_configuration_extension_yaml | from_yaml if matrix_bot_meowlnir_configuration_extension_yaml | from_yaml is mapping else {} }}"

# Holds the final configuration (a combination of the default and its extension).
# You most likely don't need to touch this variable.
# Instead, see `matrix_bot_meowlnir_configuration_yaml`.
matrix_bot_meowlnir_configuration: "{{ matrix_bot_meowlnir_configuration_yaml | from_yaml | combine(matrix_bot_meowlnir_configuration_extension, recursive=True) }}"

# matrix_bot_meowlnir_restart_necessary controls whether the service will be restarted (when true) or merely started (when false) by the systemd service manager role (when conditional restart is enabled).
#
# This value is automatically computed during installation based on whether any configuration files, the systemd service file, or the container image changed.
# The default of `false` means "no restart needed" — appropriate when the role's installation tasks haven't run (e.g., due to --tags skipping them).
matrix_bot_meowlnir_restart_necessary: false