Add support for bridging to Facebook Messenger and Instagram via mautrix-meta

Related to: https://github.com/mautrix/facebook/issues/332 Fixes: https://github.com/spantaleev/matrix-docker-ansible-deploy/issues/3138
2024-02-19 10:13:36 +02:00 · 2024-02-19 10:13:36 +02:00 · 367af472ea
commit 367af472ea
parent 0f2f72f50f
27 changed files with 2180 additions and 2 deletions
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@ -1,3 +1,20 @@
+# 2024-02-19
+
+## Support for bridging to Facebook/Messenger via the new mautrix-meta bridge
+
+The [mautrix-facebook](./docs/configuring-playbook-bridge-mautrix-facebook.md) and [mautrix-instagram](./docs/configuring-playbook-bridge-mautrix-instagram.md) bridges are being [superseded by a new bridge](https://github.com/mautrix/facebook/issues/332) - the [mautrix-meta](https://github.com/mautrix/meta) bridge.
+
+The playbook now supports the new mautrix-meta bridge - a single bridge, which can run in different modes and bridge to Messenger (via [Facebook](https://facebook.com/), Facebook over [Tor](https://www.torproject.org/) or via [Messenger](https://messenger.com/)) and [Instagram](https://instagram.com/). The playbook makes this bridge available via 2 separate Ansible roles, allowing you to easily run 2 instances of mautrix-meta, for bridging to both services at the same time.
+
+If you're using mautrix-facebook or mautrix-instagram right now, **you can still continue using the old bridges, but may wish to change to the new bridge implementations**. See:
+
+- [Setting up Instagram bridging via Mautrix Meta](docs/configuring-playbook-bridge-mautrix-meta-instagram.md)
+
+- [Setting up Messenger bridging via Mautrix Meta](docs/configuring-playbook-bridge-mautrix-meta-messenger.md)
+
+The documentation pages contain more information on how to migrate.
+
+
 # 2024-02-14

 ## Much larger Synapse caches and cache auto-tuning enabled by default
--- a/bin/rebuild-mautrix-meta-instagram.sh
+++ b/bin/rebuild-mautrix-meta-instagram.sh
@ -0,0 +1,39 @@
+#!/bin/bash
+set -euxo pipefail
+
+# This script rebuilds the mautrix-meta-instagram Ansible role, using the mautrix-meta-messenger role as a source.
+
+if [ $# -eq 0 ]; then
+	echo "Error: No argument supplied. Please provide the path to the roles/custom directory."
+	exit 1
+fi
+
+roles_path=$1
+
+messenger_role_path=$roles_path/matrix-bridge-mautrix-meta-messenger
+instagram_role_path=$roles_path/matrix-bridge-mautrix-meta-instagram
+
+if [ ! -d $messenger_role_path ]; then
+	echo "Cannot find: $messenger_role_path"
+	exit 1
+fi
+
+if [ -d $instagram_role_path ]; then
+	rm -rf $instagram_role_path
+fi
+
+cp -ar $messenger_role_path $instagram_role_path
+
+find "$instagram_role_path" -type f | while read -r file; do
+	sed --in-place 's/matrix_mautrix_meta_messenger_/matrix_mautrix_meta_instagram_/g' "$file"
+	sed --in-place 's/mautrix-meta-messenger/mautrix-meta-instagram/g' "$file"
+done
+
+sed --in-place 's/matrix_mautrix_meta_instagram_meta_mode: \(.*\)/matrix_mautrix_meta_instagram_meta_mode: instagram/g' $instagram_role_path/defaults/main.yml
+sed --in-place 's/matrix_mautrix_meta_instagram_identifier: \(.*\)/matrix_mautrix_meta_instagram_identifier: matrix-mautrix-meta-instagram/g' $instagram_role_path/defaults/main.yml
+
+echo "# matrix-mautrix-meta-instagram" > $instagram_role_path/README.md
+echo "" >> $instagram_role_path/README.md
+echo "This bridge role is derived from the matrix-mautrix-meta-messenger Ansible role via automatic changes (see \`just rebuild-mautrix-meta-instagram\` or \`bin/rebuild-mautrix-meta-instagram.sh\`)." >> $instagram_role_path/README.md
+echo "" >> $instagram_role_path/README.md
+echo "If you'd like to make a change to this role, consider making it to the \`matrix-mautrix-meta-messenger\` role instead." >> $instagram_role_path/README.md
--- a/docs/configuring-playbook-bridge-mautrix-facebook.md
+++ b/docs/configuring-playbook-bridge-mautrix-facebook.md
@ -1,5 +1,7 @@
 # Setting up Mautrix Facebook (optional)

+**Note**: bridging to Facebook [Messenger](https://messenger.com) via this bridge is being [superseded by a new bridge - mautrix-meta](https://github.com/mautrix/facebook/issues/332). For now, the mautrix-facebook bridge continues to work, but the new [mautrix-meta-messenger bridge](./configuring-playbook-bridge-mautrix-meta-messenger.md) is better and more supported. Consider using that bridge instead of this one.
+
 The playbook can install and configure [mautrix-facebook](https://github.com/mautrix/facebook) for you.

 See the project's [documentation](https://github.com/mautrix/facebook/blob/master/ROADMAP.md) to learn what it does and why it might be useful to you.
--- a/docs/configuring-playbook-bridge-mautrix-instagram.md
+++ b/docs/configuring-playbook-bridge-mautrix-instagram.md
@ -1,5 +1,7 @@
 # Setting up Mautrix Instagram (optional)

+**Note**: bridging to Facebook [Instagram](https://instagram.com) via this bridge is being [superseded by a new bridge - mautrix-meta](https://github.com/mautrix/facebook/issues/332). For now, the mautrix-instagram bridge continues to work, but the new [mautrix-meta-instagram bridge](./configuring-playbook-bridge-mautrix-meta-instagram.md) is better and more supported. Consider using that bridge instead of this one.
+
 The playbook can install and configure [mautrix-instagram](https://github.com/mautrix/instagram) for you.

 See the project's [documentation](https://docs.mau.fi/bridges/python/instagram/index.html) to learn what it does and why it might be useful to you.
--- a/docs/configuring-playbook-bridge-mautrix-meta-instagram.md
+++ b/docs/configuring-playbook-bridge-mautrix-meta-instagram.md
@ -0,0 +1,90 @@
+# Setting up Instagram bridging via Mautrix Meta (optional)
+
+The playbook can install and configure the [mautrix-meta](https://github.com/mautrix/meta) Messenger/Instagram bridge for you.
+
+Since this bridge component can bridge to both [Messenger](https://messenger.com/) and [Instagram](https://instagram.com/) and you may wish to do both at the same time, the playbook makes it available via 2 different Ansible roles (`matrix-bridge-mautrix-meta-messenger` and `matrix-bridge-mautrix-meta-instagram`). The latter is a reconfigured copy of the first one (created by `just rebuild-mautrix-meta-instagram` and `bin/rebuild-mautrix-meta-instagram.sh`).
+
+This documentation page only deals with the bridge's ability to bridge to Instagram. For bridging to Facebook/Messenger, see [Setting up Messenger bridging via Mautrix Meta](configuring-playbook-bridge-mautrix-meta-messenger.md).
+
+
+## Migrating from the old mautrix-instagram bridge
+
+If you've been using the [mautrix-instagram](./configuring-playbook-bridge-mautrix-instagram.md) bridge, **you'd better get rid of it first** or the 2 bridges will be in conflict:
+
+- both trying to use `@instagrambot:YOUR_DOMAIN` as their username. This conflict may be resolved by adjusting `matrix_mautrix_instagram_appservice_bot_username` or `matrix_mautrix_meta_instagram_appservice_username`
+- both trying to bridge the same DMs
+
+To do so, send a `clean-rooms` command to the management room with the old bridge bot (`@instagrambot:YOUR_DOMAIN`).
+
+This would give you a list of portals and groups of portals you may purge. Proceed with sending commands like `clean recommended`, etc.
+
+Then, consider disabling the old bridge in your configuration, so it won't recreate the portals when you receive new messages.
+
+
+## Configuration
+
+Most simply, you can enable the bridge with the following playbook configuration:
+
+```yaml
+matrix_mautrix_meta_instagram_enabled: true
+```
+
+Before proceeding to [re-running the playbook](./installing.md), you may wish to adjust the configuration further. See below.
+
+### Bridge permissions
+
+By default, any user on your homeserver will be able to use the bridge.
+
+Different levels of permission can be granted to users:
+
+- `relay` - Allowed to be relayed through the bridge, no access to commands
+- `user` - Use the bridge with puppeting
+- `admin` - Use and administer the bridge
+
+The permissions are following the sequence: nothing < `relay` < `user` < `admin`.
+
+The default permissions are set via `matrix_mautrix_meta_instagram_bridge_permissions_default` and are somewhat like this:
+```yaml
+matrix_mautrix_meta_instagram_bridge_permissions_default:
+  '*': relay
+  YOUR_DOMAIN: user
+  '{{ matrix_admin }}': admin
+```
+
+If you don't define the `matrix_admin` in your configuration (e.g. `matrix_admin: @user:YOUR_DOMAIN`), then there's no admin by default.
+
+You may redefine `matrix_mautrix_meta_instagram_bridge_permissions_default` any way you see fit, or add extra permissions using `matrix_mautrix_meta_instagram_bridge_permissions_custom` like this:
+
+```yaml
+matrix_mautrix_meta_instagram_bridge_permissions_custom: |
+  '@YOUR_USERNAME:YOUR_DOMAIN': admin
+```
+
+You may wish to look at `roles/custom/matrix-bridge-mautrix-meta-instagram/templates/config.yaml.j2` to find more information on the permissions settings and other options you would like to configure.
+
+## Set up Double Puppeting
+
+If you'd like to use [Double Puppeting](https://docs.mau.fi/bridges/general/double-puppeting.html) (hint: you most likely do), you have 2 ways of going about it.
+
+### Method 1: automatically, by enabling Shared Secret Auth
+
+The bridge will automatically perform Double Puppeting if you enable [Shared Secret Auth](configuring-playbook-shared-secret-auth.md) for this playbook.
+
+This is the recommended way of setting up Double Puppeting, as it's easier to accomplish, works for all your users automatically, and has less of a chance of breaking in the future.
+
+### Method 2: manually, by asking each user to provide a working access token
+
+**Note**: This method for enabling Double Puppeting can be configured only after you've already set up bridging (see [Usage](#usage)).
+
+When using this method, **each user** that wishes to enable Double Puppeting needs to follow the following steps:
+
+- retrieve a Matrix access token for yourself. Refer to the documentation on [how to do that](obtaining-access-tokens.md).
+
+- send the access token to the bot. Example: `login-matrix MATRIX_ACCESS_TOKEN_HERE`
+
+- make sure you don't log out the session for which you obtained an access token some time in the future, as that would break the Double Puppeting feature
+
+
+## Usage
+
+You then need to start a chat with `@instagrambot:YOUR_DOMAIN` (where `YOUR_DOMAIN` is your base domain, not the `matrix.` domain).
--- a/docs/configuring-playbook-bridge-mautrix-meta-messenger.md
+++ b/docs/configuring-playbook-bridge-mautrix-meta-messenger.md
@ -0,0 +1,105 @@
+# Setting up Messenger bridging via Mautrix Meta (optional)
+
+The playbook can install and configure the [mautrix-meta](https://github.com/mautrix/meta) Messenger/Instagram bridge for you.
+
+Since this bridge component can bridge to both [Messenger](https://messenger.com/) and [Instagram](https://instagram.com/) and you may wish to do both at the same time, the playbook makes it available via 2 different Ansible roles (`matrix-bridge-mautrix-meta-messenger` and `matrix-bridge-mautrix-meta-instagram`). The latter is a reconfigured copy of the first one (created by `just rebuild-mautrix-meta-instagram` and `bin/rebuild-mautrix-meta-instagram.sh`).
+
+This documentation page only deals with the bridge's ability to bridge to Facebook Messenger. For bridging to Instagram, see [Setting up Instagram bridging via Mautrix Meta](configuring-playbook-bridge-mautrix-meta-instagram.md).
+
+
+## Migrating from the old mautrix-facebook bridge
+
+If you've been using the [mautrix-facebook](./configuring-playbook-bridge-mautrix-facebook.md) bridge, you may wish to get rid of it first.
+
+To do so, send a `clean-rooms` command to the management room with the old bridge bot (`@facebookbot:YOUR_DOMAIN`).
+
+This would give you a list of portals and groups of portals you may purge. Proceed with sending commands like `clean recommended`, etc.
+
+Then, consider disabling the old bridge in your configuration, so it won't recreate the portals when you receive new messages.
+
+
+## Configuration
+
+Most simply, you can enable the bridge with the following playbook configuration:
+
+```yaml
+matrix_mautrix_meta_messenger_enabled: true
+```
+
+Before proceeding to [re-running the playbook](./installing.md), you may wish to adjust the configuration further. See below.
+
+### Bridge mode
+
+As mentioned above, the [mautrix-meta](https://github.com/mautrix/meta) bridge supports multiple modes of operation.
+The bridge can pull your Messenger messages via 3 different methods:
+
+- (`facebook`) Facebook via `facebook.com`
+- (`facebook-tor`) Facebook via `facebookwkhpilnemxj7asaniu7vnjjbiltxjqhye3mhbshg7kx5tfyd.onion` ([Tor](https://www.torproject.org/)) - does not currently proxy media downloads
+- (default) (`messenger`) Messenger via `messenger.com` - usable even without a Facebook account
+
+You may switch the mode via the `matrix_mautrix_meta_messenger_meta_mode` variable. The playbook defaults to the `messenger` mode, because it's most universal (every Facebook user has a Messenger account, but the opposite is not true).
+
+Note that switching the mode (especially between `facebook*` and `messenger`) will intentionally make the bridge use another database (`matrix_mautrix_meta_facebook` or `matrix_mautrix_meta_messenger`) to isolate the 2 instances. Switching between Tor and non-Tor may be possible without dataloss, but your mileage may vary. Before switching to a new mode, you may wish to de-configure the old one (send `help` to the bridge bot and unbridge your portals, etc.).
+
+
+### Bridge permissions
+
+By default, any user on your homeserver will be able to use the bridge.
+
+Different levels of permission can be granted to users:
+
+- `relay` - Allowed to be relayed through the bridge, no access to commands
+- `user` - Use the bridge with puppeting
+- `admin` - Use and administer the bridge
+
+The permissions are following the sequence: nothing < `relay` < `user` < `admin`.
+
+The default permissions are set via `matrix_mautrix_meta_messenger_bridge_permissions_default` and are somewhat like this:
+```yaml
+matrix_mautrix_meta_messenger_bridge_permissions_default:
+  '*': relay
+  YOUR_DOMAIN: user
+  '{{ matrix_admin }}': admin
+```
+
+If you don't define the `matrix_admin` in your configuration (e.g. `matrix_admin: @user:YOUR_DOMAIN`), then there's no admin by default.
+
+You may redefine `matrix_mautrix_meta_messenger_bridge_permissions_default` any way you see fit, or add extra permissions using `matrix_mautrix_meta_messenger_bridge_permissions_custom` like this:
+
+```yaml
+matrix_mautrix_meta_messenger_bridge_permissions_custom: |
+  '@YOUR_USERNAME:YOUR_DOMAIN': admin
+```
+
+You may wish to look at `roles/custom/matrix-bridge-mautrix-meta-messenger/templates/config.yaml.j2` to find more information on the permissions settings and other options you would like to configure.
+
+## Set up Double Puppeting
+
+If you'd like to use [Double Puppeting](https://docs.mau.fi/bridges/general/double-puppeting.html) (hint: you most likely do), you have 2 ways of going about it.
+
+### Method 1: automatically, by enabling Shared Secret Auth
+
+The bridge will automatically perform Double Puppeting if you enable [Shared Secret Auth](configuring-playbook-shared-secret-auth.md) for this playbook.
+
+This is the recommended way of setting up Double Puppeting, as it's easier to accomplish, works for all your users automatically, and has less of a chance of breaking in the future.
+
+### Method 2: manually, by asking each user to provide a working access token
+
+**Note**: This method for enabling Double Puppeting can be configured only after you've already set up bridging (see [Usage](#usage)).
+
+When using this method, **each user** that wishes to enable Double Puppeting needs to follow the following steps:
+
+- retrieve a Matrix access token for yourself. Refer to the documentation on [how to do that](obtaining-access-tokens.md).
+
+- send the access token to the bot. Example: `login-matrix MATRIX_ACCESS_TOKEN_HERE`
+
+- make sure you don't log out the session for which you obtained an access token some time in the future, as that would break the Double Puppeting feature
+
+
+## Usage
+
+You then need to start a chat with `@messengerbot:YOUR_DOMAIN` (where `YOUR_DOMAIN` is your base domain, not the `matrix.` domain).
+
+You then need to send a `login` command and follow the bridge bot's instructions.
+
+Given that the bot is configured in `messenger` [bridge mode](#bridge-mode) by default, you will need to log in to [messenger.com](https://messenger.com/) (not `facebook.com`!) and obtain the cookies from there as per [the bridge's authentication instructions](https://docs.mau.fi/bridges/go/meta/authentication.html).
--- a/docs/configuring-playbook.md
+++ b/docs/configuring-playbook.md
@ -120,13 +120,17 @@ When you're done with all the configuration you'd like to do, continue with [Ins

 - [Setting up Mautrix Whatsapp bridging](configuring-playbook-bridge-mautrix-whatsapp.md) (optional)

- [Setting up Mautrix Facebook bridging](configuring-playbook-bridge-mautrix-facebook.md) (optional)
+- [Setting up Instagram bridging via Mautrix Meta](configuring-playbook-bridge-mautrix-meta-instagram.md) (optional)
+
+- [Setting up Messenger bridging via Mautrix Meta](configuring-playbook-bridge-mautrix-meta-messenger.md) (optional)
+
+- ~~[Setting up Mautrix Facebook bridging](configuring-playbook-bridge-mautrix-facebook.md)~~ - consider bridging to Facebook/Messenger using the new [mautrix-meta-messenger](./configuring-playbook-bridge-mautrix-meta-messenger.md) bridge (optional)

 - [Setting up Mautrix Hangouts bridging](configuring-playbook-bridge-mautrix-hangouts.md) (optional)

 - [Setting up Mautrix Google Chat bridging](configuring-playbook-bridge-mautrix-googlechat.md) (optional)

- [Setting up Mautrix Instagram bridging](configuring-playbook-bridge-mautrix-instagram.md) (optional)
+- ~~[Setting up Mautrix Instagram bridging](configuring-playbook-bridge-mautrix-instagram.md)~~ - consider bridging to Instagram using the new [mautrix-meta-instagram](./configuring-playbook-bridge-mautrix-meta-instagram.md) bridge (optional)

 - [Setting up Mautrix Twitter bridging](configuring-playbook-bridge-mautrix-twitter.md) (optional)

--- a/group_vars/matrix_servers
+++ b/group_vars/matrix_servers
@ -101,6 +101,10 @@ matrix_homeserver_container_extra_arguments_auto: |
    +
    (['--mount type=bind,src=' + matrix_mautrix_signal_config_path + '/registration.yaml,dst=/matrix-mautrix-signal-registration.yaml,ro'] if matrix_mautrix_signal_enabled else [])
    +
+    (['--mount type=bind,src=' + matrix_mautrix_meta_messenger_config_path + '/registration.yaml,dst=/matrix-mautrix-meta-messenger-registration.yaml,ro'] if matrix_mautrix_meta_messenger_enabled else [])
+    +
+    (['--mount type=bind,src=' + matrix_mautrix_meta_instagram_config_path + '/registration.yaml,dst=/matrix-mautrix-meta-instagram-registration.yaml,ro'] if matrix_mautrix_meta_instagram_enabled else [])
+    +
    (['--mount type=bind,src=' + matrix_mautrix_telegram_config_path + '/registration.yaml,dst=/matrix-mautrix-telegram-registration.yaml,ro'] if matrix_mautrix_telegram_enabled else [])
    +
    (['--mount type=bind,src=' + matrix_mautrix_twitter_config_path + '/registration.yaml,dst=/matrix-mautrix-twitter-registration.yaml,ro'] if matrix_mautrix_twitter_enabled else [])
@ -164,6 +168,10 @@ matrix_homeserver_app_service_config_files_auto: |
    +
    (['/matrix-mautrix-signal-registration.yaml'] if matrix_mautrix_signal_enabled else [])
    +
+    (['/matrix-mautrix-meta-messenger-registration.yaml'] if matrix_mautrix_meta_messenger_enabled else [])
+    +
+    (['/matrix-mautrix-meta-instagram-registration.yaml'] if matrix_mautrix_meta_instagram_enabled else [])
+    +
    (['/matrix-mautrix-telegram-registration.yaml'] if matrix_mautrix_telegram_enabled else [])
    +
    (['/matrix-mautrix-twitter-registration.yaml'] if matrix_mautrix_twitter_enabled else [])
@ -294,6 +302,10 @@ devture_systemd_service_manager_services_list_auto: |
    +
    ([{'name': 'matrix-mautrix-signal.service', 'priority': 2000, 'groups': ['matrix', 'bridges', 'mautrix-signal', 'mautrix-signal']}] if matrix_mautrix_signal_enabled else [])
    +
+    ([{'name': (matrix_mautrix_meta_messenger_identifier + '.service'), 'priority': 2000, 'groups': ['matrix', 'bridges', 'mautrix-meta', 'mautrix-meta-messenger']}] if matrix_mautrix_meta_messenger_enabled else [])
+    +
+    ([{'name': (matrix_mautrix_meta_instagram_identifier + '.service'), 'priority': 2000, 'groups': ['matrix', 'bridges', 'mautrix-meta', 'mautrix-meta-instagram']}] if matrix_mautrix_meta_instagram_enabled else [])
+    +
    ([{'name': 'matrix-mautrix-telegram.service', 'priority': 2000, 'groups': ['matrix', 'bridges', 'mautrix-telegram']}] if matrix_mautrix_telegram_enabled else [])
    +
    ([{'name': 'matrix-mautrix-twitter.service', 'priority': 2000, 'groups': ['matrix', 'bridges', 'mautrix-twitter']}] if matrix_mautrix_twitter_enabled else [])
@ -1288,6 +1300,140 @@ matrix_mautrix_signal_database_password: "{{ '%s' | format(matrix_homeserver_gen
 #
 ######################################################################

+
+######################################################################
+#
+# matrix-bridge-mautrix-meta-messenger
+#
+######################################################################
+
+# We don't enable bridges by default.
+matrix_mautrix_meta_messenger_enabled: false
+
+matrix_mautrix_meta_messenger_systemd_required_services_list_auto: |
+  {{
+    matrix_addons_homeserver_systemd_services_list
+    +
+    ([devture_postgres_identifier ~ '.service'] if (devture_postgres_enabled and matrix_mautrix_meta_messenger_database_hostname == devture_postgres_connection_hostname) else [])
+  }}
+
+matrix_mautrix_meta_messenger_container_image_self_build: "{{ matrix_architecture not in ['amd64', 'arm64'] }}"
+
+matrix_mautrix_meta_messenger_container_network: "{{ matrix_addons_container_network }}"
+
+matrix_mautrix_meta_messenger_container_additional_networks_auto: |-
+  {{
+    (
+      ([] if matrix_addons_homeserver_container_network == '' else [matrix_addons_homeserver_container_network])
+      +
+      ([devture_postgres_container_network] if (devture_postgres_enabled and matrix_mautrix_meta_messenger_database_hostname == devture_postgres_connection_hostname and matrix_mautrix_meta_messenger_container_network != devture_postgres_container_network) else [])
+      +
+      ([matrix_playbook_reverse_proxyable_services_additional_network] if (matrix_playbook_reverse_proxyable_services_additional_network and matrix_mautrix_meta_messenger_container_labels_traefik_enabled) else [])
+    ) | unique
+  }}
+
+matrix_mautrix_meta_messenger_container_labels_traefik_enabled: "{{ matrix_playbook_reverse_proxy_type in ['playbook-managed-traefik', 'other-traefik-container'] }}"
+matrix_mautrix_meta_messenger_container_labels_traefik_docker_network: "{{ matrix_playbook_reverse_proxyable_services_additional_network }}"
+matrix_mautrix_meta_messenger_container_labels_traefik_entrypoints: "{{ devture_traefik_entrypoint_primary }}"
+matrix_mautrix_meta_messenger_container_labels_traefik_tls_certResolver: "{{ devture_traefik_certResolver_primary }}"
+
+matrix_mautrix_meta_messenger_container_labels_metrics_middleware_basic_auth_enabled: "{{ matrix_metrics_exposure_http_basic_auth_enabled }}"
+matrix_mautrix_meta_messenger_container_labels_metrics_middleware_basic_auth_users: "{{ matrix_metrics_exposure_http_basic_auth_users }}"
+
+matrix_mautrix_meta_messenger_appservice_token: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'mau.meta.fb.as', rounds=655555) | to_uuid }}"
+
+matrix_mautrix_meta_messenger_homeserver_address: "{{ matrix_addons_homeserver_client_api_url }}"
+
+matrix_mautrix_meta_messenger_homeserver_token: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'mau.meta.fb.hs', rounds=655555) | to_uuid }}"
+
+matrix_mautrix_meta_messenger_bridge_login_shared_secret: "{{ matrix_synapse_ext_password_provider_shared_secret_auth_shared_secret if matrix_synapse_ext_password_provider_shared_secret_auth_enabled else '' }}"
+
+matrix_mautrix_meta_messenger_metrics_enabled: "{{ prometheus_enabled or matrix_metrics_exposure_enabled }}"
+
+matrix_mautrix_meta_messenger_metrics_proxying_enabled: "{{ matrix_mautrix_meta_messenger_metrics_enabled and matrix_metrics_exposure_enabled }}"
+matrix_mautrix_meta_messenger_metrics_proxying_hostname: "{{ matrix_metrics_exposure_hostname }}"
+matrix_mautrix_meta_messenger_metrics_proxying_path_prefix: "{{ matrix_metrics_exposure_path_prefix }}/mautrix-meta-messenger"
+
+# We'd like to force-set people with external Postgres to SQLite, so the bridge role can complain
+# and point them to a migration path.
+matrix_mautrix_meta_messenger_database_engine: "{{ 'postgres' if devture_postgres_enabled else 'sqlite3-fk-wal' }}"
+matrix_mautrix_meta_messenger_database_hostname: "{{ devture_postgres_connection_hostname if (devture_postgres_enabled and matrix_mautrix_meta_messenger_database_engine == 'postgres') else '' }}"
+matrix_mautrix_meta_messenger_database_password: "{{ ('%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'mau.fb.db', rounds=655555) | to_uuid) if (devture_postgres_enabled and matrix_mautrix_meta_messenger_database_engine == 'postgres') else '' }}"
+
+######################################################################
+#
+# /matrix-bridge-mautrix-meta-messenger
+#
+######################################################################
+
+
+
+######################################################################
+#
+# matrix-bridge-mautrix-meta-instagram
+#
+######################################################################
+
+# We don't enable bridges by default.
+matrix_mautrix_meta_instagram_enabled: false
+
+matrix_mautrix_meta_instagram_systemd_required_services_list_auto: |
+  {{
+    matrix_addons_homeserver_systemd_services_list
+    +
+    ([devture_postgres_identifier ~ '.service'] if (devture_postgres_enabled and matrix_mautrix_meta_instagram_database_hostname == devture_postgres_connection_hostname) else [])
+  }}
+
+matrix_mautrix_meta_instagram_container_image_self_build: "{{ matrix_architecture not in ['amd64', 'arm64'] }}"
+
+matrix_mautrix_meta_instagram_container_network: "{{ matrix_addons_container_network }}"
+
+matrix_mautrix_meta_instagram_container_additional_networks_auto: |-
+  {{
+    (
+      ([] if matrix_addons_homeserver_container_network == '' else [matrix_addons_homeserver_container_network])
+      +
+      ([devture_postgres_container_network] if (devture_postgres_enabled and matrix_mautrix_meta_instagram_database_hostname == devture_postgres_connection_hostname and matrix_mautrix_meta_instagram_container_network != devture_postgres_container_network) else [])
+      +
+      ([matrix_playbook_reverse_proxyable_services_additional_network] if (matrix_playbook_reverse_proxyable_services_additional_network and matrix_mautrix_meta_instagram_container_labels_traefik_enabled) else [])
+    ) | unique
+  }}
+
+matrix_mautrix_meta_instagram_container_labels_traefik_enabled: "{{ matrix_playbook_reverse_proxy_type in ['playbook-managed-traefik', 'other-traefik-container'] }}"
+matrix_mautrix_meta_instagram_container_labels_traefik_docker_network: "{{ matrix_playbook_reverse_proxyable_services_additional_network }}"
+matrix_mautrix_meta_instagram_container_labels_traefik_entrypoints: "{{ devture_traefik_entrypoint_primary }}"
+matrix_mautrix_meta_instagram_container_labels_traefik_tls_certResolver: "{{ devture_traefik_certResolver_primary }}"
+
+matrix_mautrix_meta_instagram_container_labels_metrics_middleware_basic_auth_enabled: "{{ matrix_metrics_exposure_http_basic_auth_enabled }}"
+matrix_mautrix_meta_instagram_container_labels_metrics_middleware_basic_auth_users: "{{ matrix_metrics_exposure_http_basic_auth_users }}"
+
+matrix_mautrix_meta_instagram_appservice_token: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'mau.meta.ig.as', rounds=655555) | to_uuid }}"
+
+matrix_mautrix_meta_instagram_homeserver_address: "{{ matrix_addons_homeserver_client_api_url }}"
+
+matrix_mautrix_meta_instagram_homeserver_token: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'mau.meta.ig.hs', rounds=655555) | to_uuid }}"
+
+matrix_mautrix_meta_instagram_bridge_login_shared_secret: "{{ matrix_synapse_ext_password_provider_shared_secret_auth_shared_secret if matrix_synapse_ext_password_provider_shared_secret_auth_enabled else '' }}"
+
+matrix_mautrix_meta_instagram_metrics_enabled: "{{ prometheus_enabled or matrix_metrics_exposure_enabled }}"
+
+matrix_mautrix_meta_instagram_metrics_proxying_enabled: "{{ matrix_mautrix_meta_instagram_metrics_enabled and matrix_metrics_exposure_enabled }}"
+matrix_mautrix_meta_instagram_metrics_proxying_hostname: "{{ matrix_metrics_exposure_hostname }}"
+matrix_mautrix_meta_instagram_metrics_proxying_path_prefix: "{{ matrix_metrics_exposure_path_prefix }}/mautrix-meta-instagram"
+
+# We'd like to force-set people with external Postgres to SQLite, so the bridge role can complain
+# and point them to a migration path.
+matrix_mautrix_meta_instagram_database_engine: "{{ 'postgres' if devture_postgres_enabled else 'sqlite3-fk-wal' }}"
+matrix_mautrix_meta_instagram_database_hostname: "{{ devture_postgres_connection_hostname if (devture_postgres_enabled and matrix_mautrix_meta_instagram_database_engine == 'postgres') else '' }}"
+matrix_mautrix_meta_instagram_database_password: "{{ ('%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'mau.fb.db', rounds=655555) | to_uuid) if (devture_postgres_enabled and matrix_mautrix_meta_instagram_database_engine == 'postgres') else '' }}"
+
+######################################################################
+#
+# /matrix-bridge-mautrix-meta-instagram
+#
+######################################################################
+
+
 ######################################################################
 #
 # matrix-bridge-mautrix-telegram
@ -3455,6 +3601,18 @@ devture_postgres_managed_databases_auto: |
      'password': matrix_mautrix_signal_database_password,
    }] if (matrix_mautrix_signal_enabled and matrix_mautrix_signal_database_engine == 'postgres' and matrix_mautrix_signal_database_hostname == devture_postgres_connection_hostname) else [])
    +
+    ([{
+      'name': matrix_mautrix_meta_messenger_database_name,
+      'username': matrix_mautrix_meta_messenger_database_username,
+      'password': matrix_mautrix_meta_messenger_database_password,
+    }] if (matrix_mautrix_meta_messenger_enabled and matrix_mautrix_meta_messenger_database_engine == 'postgres' and matrix_mautrix_meta_messenger_database_hostname == devture_postgres_connection_hostname) else [])
+    +
+    ([{
+      'name': matrix_mautrix_meta_instagram_database_name,
+      'username': matrix_mautrix_meta_instagram_database_username,
+      'password': matrix_mautrix_meta_instagram_database_password,
+    }] if (matrix_mautrix_meta_instagram_enabled and matrix_mautrix_meta_instagram_database_engine == 'postgres' and matrix_mautrix_meta_instagram_database_hostname == devture_postgres_connection_hostname) else [])
+    +
    ([{
      'name': matrix_mautrix_wsproxy_syncproxy_database_name,
      'username': matrix_mautrix_wsproxy_syncproxy_database_username,
--- a/4
+++ b/4
@ -58,3 +58,7 @@ stop-all *extra_args: (run-tags "stop-all" extra_args)
 # Stops a specific service group
 stop-group group *extra_args:
    @just --justfile {{ justfile() }} run-tags stop-group --extra-vars="group={{ group }}" {{ extra_args }}
+
+# Rebuilds the mautrix-meta-instagram Ansible role using the mautrix-meta-messenger role as a source
+rebuild-mautrix-meta-instagram:
+    /bin/bash {{ justfile_directory() }}/bin/rebuild-mautrix-meta-instagram.sh {{ justfile_directory() }}/roles/custom
--- a/roles/custom/matrix-bridge-mautrix-meta-instagram/README.md
+++ b/roles/custom/matrix-bridge-mautrix-meta-instagram/README.md
@ -0,0 +1,5 @@
+# matrix-mautrix-meta-instagram
+
+This bridge role is derived from the matrix-mautrix-meta-messenger Ansible role via automatic changes (see `just rebuild-mautrix-meta-instagram` or `bin/rebuild-mautrix-meta-instagram.sh`).
+
+If you'd like to make a change to this role, consider making it to the `matrix-mautrix-meta-messenger` role instead.
--- a/roles/custom/matrix-bridge-mautrix-meta-instagram/defaults/main.yml
+++ b/roles/custom/matrix-bridge-mautrix-meta-instagram/defaults/main.yml
@ -0,0 +1,270 @@
+---
+
+# mautrix-meta is a Matrix <-> Facebook/Messenger/Instagram bridge
+# Project source code URL: https://github.com/mautrix/meta
+#
+# WARNING: this bridge role is used for both Messenger and Instagram.
+# This Messenger role acts as a source and auto-generates matrix-bridge-mautrix-meta-instagram
+# thanks to `just rebuild-mautrix-meta-instagram` (`bin/rebuild-mautrix-meta-instagram.sh`).
+# If you'd like to make changes to the Instagram role, consider making your changes to the Messenger role instead.
+
+matrix_mautrix_meta_instagram_enabled: true
+
+matrix_mautrix_meta_instagram_identifier: matrix-mautrix-meta-instagram
+
+# renovate: datasource=docker depName=dock.mau.dev/mautrix/meta
+matrix_mautrix_meta_instagram_version: v0.1.0
+
+matrix_mautrix_meta_instagram_base_path: "{{ matrix_base_data_path }}/mautrix-meta-instagram"
+matrix_mautrix_meta_instagram_config_path: "{{ matrix_mautrix_meta_instagram_base_path }}/config"
+matrix_mautrix_meta_instagram_data_path: "{{ matrix_mautrix_meta_instagram_base_path }}/data"
+matrix_mautrix_meta_instagram_container_src_files_path: "{{ matrix_mautrix_meta_instagram_base_path }}/container-src"
+
+matrix_mautrix_meta_instagram_container_image_self_build: false
+matrix_mautrix_meta_instagram_container_image_self_build_repo: "https://github.com/mautrix/meta.git"
+
+matrix_mautrix_meta_instagram_container_image: "{{ matrix_mautrix_meta_instagram_container_image_name_prefix }}mautrix/meta:{{ matrix_mautrix_meta_instagram_version }}"
+matrix_mautrix_meta_instagram_container_image_name_prefix: "{{ 'localhost/' if matrix_mautrix_meta_instagram_container_image_self_build else 'dock.mau.dev/' }}"
+matrix_mautrix_meta_instagram_container_image_force_pull: "{{ matrix_mautrix_meta_instagram_container_image.endswith(':latest') }}"
+
+matrix_mautrix_meta_instagram_container_network: ""
+
+matrix_mautrix_meta_instagram_container_additional_networks: "{{ matrix_mautrix_meta_instagram_container_additional_networks_auto + matrix_mautrix_meta_instagram_container_additional_networks_custom }}"
+matrix_mautrix_meta_instagram_container_additional_networks_auto: []
+matrix_mautrix_meta_instagram_container_additional_networks_custom: []
+
+# matrix_mautrix_meta_instagram_container_labels_traefik_enabled controls whether labels to assist a Traefik reverse-proxy will be attached to the container.
+# See `../templates/labels.j2` for details.
+#
+# To inject your own other container labels, see `matrix_mautrix_meta_instagram_container_labels_additional_labels`.
+matrix_mautrix_meta_instagram_container_labels_traefik_enabled: true
+matrix_mautrix_meta_instagram_container_labels_traefik_docker_network: "{{ matrix_mautrix_meta_instagram_container_network }}"
+matrix_mautrix_meta_instagram_container_labels_traefik_entrypoints: web-secure
+matrix_mautrix_meta_instagram_container_labels_traefik_tls_certResolver: default  # noqa var-naming
+
+# Controls whether labels will be added that expose the bridge's metrics
+matrix_mautrix_meta_instagram_container_labels_metrics_enabled: "{{ matrix_mautrix_meta_instagram_metrics_enabled and matrix_mautrix_meta_instagram_metrics_proxying_enabled }}"
+matrix_mautrix_meta_instagram_container_labels_metrics_traefik_rule: "Host(`{{ matrix_mautrix_meta_instagram_metrics_proxying_hostname }}`) && PathPrefix(`{{ matrix_mautrix_meta_instagram_metrics_proxying_path_prefix }}`)"
+matrix_mautrix_meta_instagram_container_labels_metrics_traefik_priority: 0
+matrix_mautrix_meta_instagram_container_labels_metrics_traefik_entrypoints: "{{ matrix_mautrix_meta_instagram_container_labels_traefik_entrypoints }}"
+matrix_mautrix_meta_instagram_container_labels_metrics_traefik_tls: "{{ matrix_mautrix_meta_instagram_container_labels_metrics_traefik_entrypoints != 'web' }}"
+matrix_mautrix_meta_instagram_container_labels_metrics_traefik_tls_certResolver: "{{ matrix_mautrix_meta_instagram_container_labels_traefik_tls_certResolver }}"  # noqa var-naming
+matrix_mautrix_meta_instagram_container_labels_metrics_middleware_basic_auth_enabled: false
+# See: https://doc.traefik.io/traefik/middlewares/http/basicauth/#users
+matrix_mautrix_meta_instagram_container_labels_metrics_middleware_basic_auth_users: ''
+
+# matrix_mautrix_meta_instagram_container_labels_additional_labels contains a multiline string with additional labels to add to the container label file.
+# See `../templates/labels.j2` for details.
+#
+# Example:
+# matrix_mautrix_meta_instagram_container_labels_additional_labels: |
+#   my.label=1
+#   another.label="here"
+matrix_mautrix_meta_instagram_container_labels_additional_labels: ''
+
+# A list of extra arguments to pass to the container
+matrix_mautrix_meta_instagram_container_extra_arguments: []
+
+# List of systemd services that the systemd service depends on.
+matrix_mautrix_meta_instagram_systemd_required_services_list: "{{ matrix_mautrix_meta_instagram_systemd_required_services_list_default + matrix_mautrix_meta_instagram_systemd_required_services_list_auto + matrix_mautrix_meta_instagram_systemd_required_services_list_custom }}"
+matrix_mautrix_meta_instagram_systemd_required_services_list_default: ['docker.service']
+matrix_mautrix_meta_instagram_systemd_required_services_list_auto: []
+matrix_mautrix_meta_instagram_systemd_required_services_list_custom: []
+
+# List of systemd services that the systemd service wants
+matrix_mautrix_meta_instagram_systemd_wanted_services_list: []
+
+# Controls whether the bridge container exposes its HTTP port.
+#
+# Takes an "<ip>:<port>" or "<port>" value (e.g. "127.0.0.1:29319"), or empty string to not expose.
+matrix_mautrix_meta_instagram_container_http_host_bind_port: ''
+
+# Database-related configuration fields
+matrix_mautrix_meta_instagram_database_engine: sqlite3-fk-wal
+
+matrix_mautrix_meta_instagram_sqlite_database_path_local: "{{ matrix_mautrix_meta_instagram_data_path }}/mautrix-meta.db"
+matrix_mautrix_meta_instagram_sqlite_database_path_in_container: "/data/mautrix-meta.db"
+
+matrix_mautrix_meta_instagram_database_suffix: |-
+  {{
+    ({
+      'facebook': '_facebook',
+      'facebook-tor': '_facebook',
+      'messenger': '_messenger',
+      'instagram': '_instagram',
+    })[matrix_mautrix_meta_instagram_meta_mode]
+  }}
+
+matrix_mautrix_meta_instagram_database_username: "matrix_mautrix_meta{{ matrix_mautrix_meta_instagram_database_suffix }}"
+matrix_mautrix_meta_instagram_database_password: ''
+matrix_mautrix_meta_instagram_database_hostname: ''
+matrix_mautrix_meta_instagram_database_port: 5432
+matrix_mautrix_meta_instagram_database_name: "matrix_mautrix_meta{{ matrix_mautrix_meta_instagram_database_suffix }}"
+matrix_mautrix_meta_instagram_database_sslmode: disable
+
+matrix_mautrix_meta_instagram_database_connection_string: 'postgres://{{ matrix_mautrix_meta_instagram_database_username }}:{{ matrix_mautrix_meta_instagram_database_password }}@{{ matrix_mautrix_meta_instagram_database_hostname }}:{{ matrix_mautrix_meta_instagram_database_port }}/{{ matrix_mautrix_meta_instagram_database_name }}?sslmode={{ matrix_mautrix_meta_instagram_database_sslmode }}'
+
+matrix_mautrix_meta_instagram_homeserver_address: ""
+matrix_mautrix_meta_instagram_homeserver_domain: '{{ matrix_domain }}'
+matrix_mautrix_meta_instagram_homeserver_token: ''
+
+matrix_mautrix_meta_instagram_appservice_address: "http://{{ matrix_mautrix_meta_instagram_identifier }}:29319"
+
+matrix_mautrix_meta_instagram_appservice_id: "{{ matrix_mautrix_meta_instagram_meta_mode }}"
+
+# For Facebook/Messenger, we use the same `@messengerbot:DOMAIN` username regardless of how bridging happens for multiple reasons:
+# - it's consistent - regardless of how bridging happens, the bridged service is actually Messenger
+# - it's easy for users - you may change the mode, but the bot is always at `@messengerbot:DOMAIN`
+# - it doesn't conflict with mautrix-facebook which uses `@facebookbot:DOMAIN`
+# - `matrix_mautrix_meta_instagram_appservice_avatar` only has icons for Messenger and Instagram, not Facebook
+matrix_mautrix_meta_instagram_appservice_username_prefix: |-
+  {{
+    ({
+      'facebook': 'messenger',
+      'facebook-tor': 'messenger',
+      'messenger': 'messenger',
+      'instagram': 'instagram',
+    })[matrix_mautrix_meta_instagram_meta_mode]
+  }}
+matrix_mautrix_meta_instagram_appservice_username: "{{ matrix_mautrix_meta_instagram_appservice_username_prefix }}bot"
+matrix_mautrix_meta_instagram_appservice_displayname: "{{ matrix_mautrix_meta_instagram_meta_mode | capitalize }} bridge bot"
+matrix_mautrix_meta_instagram_appservice_avatar: "{{ 'mxc://maunium.net/JxjlbZUlCPULEeHZSwleUXQv' if matrix_mautrix_meta_instagram_meta_mode == 'instagram' else 'mxc://maunium.net/ygtkteZsXnGJLJHRchUwYWak' }}"
+
+matrix_mautrix_meta_instagram_appservice_database_type: "{{ matrix_mautrix_meta_instagram_database_engine }}"
+
+matrix_mautrix_meta_instagram_appservice_database_uri: |-
+  {{
+    {
+      'sqlite3-fk-wal': ('sqlite:///' + matrix_mautrix_meta_instagram_sqlite_database_path_in_container),
+      'postgres': matrix_mautrix_meta_instagram_database_connection_string,
+    }[matrix_mautrix_meta_instagram_database_engine]
+  }}
+
+matrix_mautrix_meta_instagram_appservice_token: ''
+
+# Controls which service this bridge is for.
+# Valid options:
+# * facebook - connect to FB Messenger via facebook.com
+# * facebook-tor - connect to FB Messenger via facebookwkhpilnemxj7asaniu7vnjjbiltxjqhye3mhbshg7kx5tfyd.onion
+#                  (note: does not currently proxy media downloads)
+# * messenger - connect to FB Messenger via messenger.com (can be used with the facebook side deactivated)
+# * instagram - connect to Instagram DMs via instagram.com
+matrix_mautrix_meta_instagram_meta_mode: instagram
+
+# When in `instagram` mode (see `matrix_mautrix_meta_instagram_meta_mode`), should the bridge connect to WhatsApp servers for encrypted chats?
+matrix_mautrix_meta_instagram_meta_ig_e2ee: false
+
+# Whether or not metrics endpoint should be enabled.
+# Enabling them is usually enough for a local (in-container) Prometheus to consume them.
+# If metrics need to be consumed by another (external) Prometheus server, consider exposing them via `matrix_mautrix_meta_instagram_metrics_proxying_enabled`.
+matrix_mautrix_meta_instagram_metrics_enabled: false
+
+# Controls whether metrics should be exposed on a public URL.
+matrix_mautrix_meta_instagram_metrics_proxying_enabled: false
+matrix_mautrix_meta_instagram_metrics_proxying_hostname: ''
+matrix_mautrix_meta_instagram_metrics_proxying_path_prefix: ''
+
+matrix_mautrix_meta_instagram_bridge_username_prefix: |-
+  {{
+    ({
+      'facebook': 'facebook_',
+      'facebook-tor': 'facebook_',
+      'messenger': 'messenger_',
+      'instagram': 'instagram_',
+    })[matrix_mautrix_meta_instagram_meta_mode]
+  }}
+
+# Localpart template of MXIDs for FB/IG users.
+# {{.}} is replaced with the internal ID of the FB/IG user.
+# Changing this may require that you change the regex in the appservice.
+matrix_mautrix_meta_instagram_bridge_username_template: "{{ matrix_mautrix_meta_instagram_bridge_username_prefix + '{{.}}' }}"
+
+matrix_mautrix_meta_instagram_bridge_displayname_template: '{% raw %}{{or .DisplayName .Username "Unknown user"}}{% endraw %}'
+
+# The prefix for commands. Only required in non-management rooms.
+# If set to "default", will be determined based on meta -> mode (`matrix_mautrix_meta_instagram_meta_mode`):
+# - "!ig" for instagram
+# - "!fb" for facebook
+matrix_mautrix_meta_instagram_bridge_command_prefix: default
+
+# Whether or not created rooms should have federation enabled.
+# If false, created portal rooms will never be federated.
+matrix_mautrix_meta_instagram_bridge_federate_rooms: true
+
+# Enable End-to-bridge encryption
+matrix_mautrix_meta_instagram_bridge_encryption_allow: "{{ matrix_bridges_encryption_enabled }}"
+matrix_mautrix_meta_instagram_bridge_encryption_default: "{{ matrix_mautrix_meta_instagram_bridge_encryption_allow }}"
+matrix_mautrix_meta_instagram_bridge_encryption_allow_key_sharing: "{{ matrix_mautrix_meta_instagram_bridge_encryption_allow }}"
+matrix_mautrix_meta_instagram_bridge_encryption_appservice: false
+matrix_mautrix_meta_instagram_bridge_encryption_require: false
+
+# Can be set to enable automatic double-puppeting via Shared Secret Auth (https://github.com/devture/matrix-synapse-shared-secret-auth).
+matrix_mautrix_meta_instagram_bridge_login_shared_secret: ''
+
+matrix_mautrix_meta_instagram_bridge_login_shared_secret_map: "{{ {matrix_mautrix_meta_instagram_homeserver_domain: matrix_mautrix_meta_instagram_bridge_login_shared_secret} if matrix_mautrix_meta_instagram_bridge_login_shared_secret else {} }}"
+
+matrix_mautrix_meta_instagram_bridge_permissions: "{{ matrix_mautrix_meta_instagram_bridge_permissions_default | combine(matrix_mautrix_meta_instagram_bridge_permissions_custom) }}"
+
+matrix_mautrix_meta_instagram_bridge_permissions_default: |-
+  {{
+    {'*': 'relay', matrix_mautrix_meta_instagram_homeserver_domain: 'user'}
+    | combine({matrix_admin: 'admin'} if matrix_admin else {})
+  }}
+
+matrix_mautrix_meta_instagram_bridge_permissions_custom: {}
+
+# Enable bridge relay bot functionality
+matrix_mautrix_meta_instagram_bridge_relay_enabled: "{{ matrix_bridges_relay_enabled }}"
+matrix_mautrix_meta_instagram_bridge_relay_admin_only: true
+
+matrix_mautrix_meta_instagram_bridge_management_room_text_welcome: |-
+  {{
+    ({
+      'facebook': "Hello, I'm a Facebook bridge bot.",
+      'facebook-tor': "Hello, I'm a Facebook bridge bot which uses Tor.",
+      'messenger': "Hello, I'm a Messenger bridge bot.",
+      'instagram': "Hello, I'm an Instagram bridge bot.",
+    })[matrix_mautrix_meta_instagram_meta_mode]
+  }}
+
+# Specifies the default log level.
+# This bridge uses zerolog, so valid levels are: panic, fatal, error, warn, info, debug, trace
+matrix_mautrix_meta_instagram_logging_min_level: warn
+
+# Default configuration template which covers the generic use case.
+# You can customize it by controlling the various variables inside it.
+#
+# For a more advanced customization, you can extend the default (see `matrix_mautrix_meta_instagram_configuration_extension_yaml`)
+# or completely replace this variable with your own template.
+matrix_mautrix_meta_instagram_configuration_yaml: "{{ lookup('template', 'templates/config.yaml.j2') }}"
+
+matrix_mautrix_meta_instagram_configuration_extension_yaml: |
+  # Your custom YAML configuration goes here.
+  # This configuration extends the default starting configuration (`matrix_mautrix_meta_instagram_configuration_yaml`).
+  #
+  # You can override individual variables from the default configuration, or introduce new ones.
+  #
+  # If you need something more special, you can take full control by
+  # completely redefining `matrix_mautrix_meta_instagram_configuration_yaml`.
+
+matrix_mautrix_meta_instagram_configuration_extension: "{{ matrix_mautrix_meta_instagram_configuration_extension_yaml | from_yaml if matrix_mautrix_meta_instagram_configuration_extension_yaml | from_yaml is mapping else {} }}"
+
+# Holds the final configuration (a combination of the default and its extension).
+# You most likely don't need to touch this variable. Instead, see `matrix_mautrix_meta_instagram_configuration_yaml`.
+matrix_mautrix_meta_instagram_configuration: "{{ matrix_mautrix_meta_instagram_configuration_yaml | from_yaml | combine(matrix_mautrix_meta_instagram_configuration_extension, recursive=True) }}"
+
+matrix_mautrix_meta_instagram_registration_yaml: |
+  id: {{ matrix_mautrix_meta_instagram_appservice_id | to_json }}
+  as_token: {{ matrix_mautrix_meta_instagram_appservice_token | to_json }}
+  hs_token: {{ matrix_mautrix_meta_instagram_homeserver_token | to_json }}
+  namespaces:
+    users:
+    - exclusive: true
+      regex: '^@{{ matrix_mautrix_meta_instagram_bridge_username_prefix }}.+:{{ matrix_mautrix_meta_instagram_homeserver_domain | regex_escape }}$'
+    - exclusive: true
+      regex: '^@{{ matrix_mautrix_meta_instagram_appservice_username | regex_escape }}:{{ matrix_mautrix_meta_instagram_homeserver_domain | regex_escape }}$'
+  url: {{ matrix_mautrix_meta_instagram_appservice_address }}
+  sender_localpart: _bot_{{ matrix_mautrix_meta_instagram_appservice_username }}
+  rate_limited: false
+
+matrix_mautrix_meta_instagram_registration: "{{ matrix_mautrix_meta_instagram_registration_yaml | from_yaml }}"
--- a/roles/custom/matrix-bridge-mautrix-meta-instagram/tasks/install.yml
+++ b/roles/custom/matrix-bridge-mautrix-meta-instagram/tasks/install.yml
@ -0,0 +1,121 @@
+---
+
+- ansible.builtin.set_fact:
+    matrix_mautrix_meta_instagram_requires_restart: false
+
+- when: "matrix_mautrix_meta_instagram_database_engine == 'postgres'"
+  block:
+    - name: Check if an SQLite database already exists
+      ansible.builtin.stat:
+        path: "{{ matrix_mautrix_meta_instagram_sqlite_database_path_local }}"
+      register: matrix_mautrix_meta_instagram_sqlite_database_path_local_stat_result
+
+    - when: "matrix_mautrix_meta_instagram_sqlite_database_path_local_stat_result.stat.exists | bool"
+      block:
+        - ansible.builtin.include_role:
+            name: galaxy/com.devture.ansible.role.postgres
+            tasks_from: migrate_db_to_postgres
+          vars:
+            devture_postgres_db_migration_request:
+              src: "{{ matrix_mautrix_meta_instagram_sqlite_database_path_local }}"
+              dst: "{{ matrix_mautrix_meta_instagram_database_connection_string }}"
+              caller: "{{ role_path | basename }}"
+              engine_variable_name: 'matrix_mautrix_meta_instagram_database_engine'
+              engine_old: 'sqlite'
+              systemd_services_to_stop: "{{ [matrix_mautrix_meta_instagram_identifier + '.service'] }}"
+
+        - ansible.builtin.set_fact:
+            matrix_mautrix_meta_instagram_requires_restart: true
+
+- name: Ensure mautrix-meta-instagram container image is pulled
+  community.docker.docker_image:
+    name: "{{ matrix_mautrix_meta_instagram_container_image }}"
+    source: "{{ 'pull' if ansible_version.major > 2 or ansible_version.minor > 7 else omit }}"
+    force_source: "{{ matrix_mautrix_meta_instagram_container_image_force_pull if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}"
+    force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else matrix_mautrix_meta_instagram_container_image_force_pull }}"
+  when: not matrix_mautrix_meta_instagram_container_image_self_build
+  register: result
+  retries: "{{ devture_playbook_help_container_retries_count }}"
+  delay: "{{ devture_playbook_help_container_retries_delay }}"
+  until: result is not failed
+
+- name: Ensure mautrix-meta-instagram paths exist
+  ansible.builtin.file:
+    path: "{{ item.path }}"
+    state: directory
+    mode: 0750
+    owner: "{{ matrix_user_username }}"
+    group: "{{ matrix_user_groupname }}"
+  with_items:
+    - {path: "{{ matrix_mautrix_meta_instagram_base_path }}", when: true}
+    - {path: "{{ matrix_mautrix_meta_instagram_config_path }}", when: true}
+    - {path: "{{ matrix_mautrix_meta_instagram_data_path }}", when: true}
+    - {path: "{{ matrix_mautrix_meta_instagram_container_src_files_path }}", when: "{{ matrix_mautrix_meta_instagram_container_image_self_build }}"}
+  when: item.when | bool
+
+- when: matrix_mautrix_meta_instagram_container_image_self_build | bool
+  block:
+    - name: Ensure mautrix-meta-instagram repository is present on self-build
+      ansible.builtin.git:
+        repo: "{{ matrix_mautrix_meta_instagram_container_image_self_build_repo }}"
+        dest: "{{ matrix_mautrix_meta_instagram_container_src_files_path }}"
+        version: "{{ matrix_mautrix_meta_instagram_container_image.split(':')[1] }}"
+        force: "yes"
+      become: true
+      become_user: "{{ matrix_user_username }}"
+      register: matrix_mautrix_meta_instagram_git_pull_results
+
+    - name: Ensure mautrix-meta-instagram container image is built
+      community.docker.docker_image:
+        name: "{{ matrix_mautrix_meta_instagram_container_image }}"
+        source: build
+        force_source: "{{ matrix_mautrix_meta_instagram_git_pull_results.changed if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}"
+        force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else matrix_mautrix_meta_instagram_git_pull_results.changed }}"
+        build:
+          dockerfile: Dockerfile
+          path: "{{ matrix_mautrix_meta_instagram_container_src_files_path }}"
+          pull: true
+
+- name: Ensure mautrix-meta-instagram config.yaml installed
+  ansible.builtin.copy:
+    content: "{{ matrix_mautrix_meta_instagram_configuration | to_nice_yaml(indent=2, width=999999) }}"
+    dest: "{{ matrix_mautrix_meta_instagram_config_path }}/config.yaml"
+    mode: 0644
+    owner: "{{ matrix_user_username }}"
+    group: "{{ matrix_user_groupname }}"
+
+- name: Ensure mautrix-meta-instagram registration.yaml installed
+  ansible.builtin.copy:
+    content: "{{ matrix_mautrix_meta_instagram_registration | to_nice_yaml(indent=2, width=999999) }}"
+    dest: "{{ matrix_mautrix_meta_instagram_config_path }}/registration.yaml"
+    mode: 0644
+    owner: "{{ matrix_user_username }}"
+    group: "{{ matrix_user_groupname }}"
+
+- name: Ensure mautrix-meta-instagram support files installed
+  ansible.builtin.template:
+    src: "{{ role_path }}/templates/{{ item }}.j2"
+    dest: "{{ matrix_mautrix_meta_instagram_base_path }}/{{ item }}"
+    mode: 0640
+    owner: "{{ matrix_user_username }}"
+    group: "{{ matrix_user_groupname }}"
+  with_items:
+    - labels
+
+- name: Ensure mautrix-meta-instagram container network is created
+  community.general.docker_network:
+    name: "{{ matrix_mautrix_meta_instagram_container_network }}"
+    driver: bridge
+
+- name: Ensure mautrix-meta-instagram.service installed
+  ansible.builtin.template:
+    src: "{{ role_path }}/templates/systemd/matrix-mautrix-meta.service.j2"
+    dest: "{{ devture_systemd_docker_base_systemd_path }}/{{ matrix_mautrix_meta_instagram_identifier }}.service"
+    mode: 0644
+
+- name: Ensure mautrix-meta-instagram.service restarted, if necessary
+  ansible.builtin.service:
+    name: "{{ matrix_mautrix_meta_instagram_identifier }}.service"
+    state: restarted
+    daemon_reload: true
+  when: "matrix_mautrix_meta_instagram_requires_restart | bool"
--- a/roles/custom/matrix-bridge-mautrix-meta-instagram/tasks/main.yml
+++ b/roles/custom/matrix-bridge-mautrix-meta-instagram/tasks/main.yml
@ -0,0 +1,20 @@
+---
+
+- tags:
+    - setup-all
+    - setup-mautrix-meta-instagram
+    - install-all
+    - install-mautrix-meta-instagram
+  block:
+    - when: matrix_mautrix_meta_instagram_enabled | bool
+      ansible.builtin.include_tasks: "{{ role_path }}/tasks/validate_config.yml"
+
+    - when: matrix_mautrix_meta_instagram_enabled | bool
+      ansible.builtin.include_tasks: "{{ role_path }}/tasks/install.yml"
+
+- tags:
+    - setup-all
+    - setup-mautrix-meta-instagram
+  block:
+    - when: not matrix_mautrix_meta_instagram_enabled | bool
+      ansible.builtin.include_tasks: "{{ role_path }}/tasks/uninstall.yml"
--- a/roles/custom/matrix-bridge-mautrix-meta-instagram/tasks/uninstall.yml
+++ b/roles/custom/matrix-bridge-mautrix-meta-instagram/tasks/uninstall.yml
@ -0,0 +1,20 @@
+---
+
+- name: Check existence of mautrix-meta-instagram service
+  ansible.builtin.stat:
+    path: "{{ devture_systemd_docker_base_systemd_path }}/{{ matrix_mautrix_meta_instagram_identifier }}.service"
+  register: matrix_mautrix_meta_instagram_service_stat
+
+- when: matrix_mautrix_meta_instagram_service_stat.stat.exists | bool
+  block:
+    - name: Ensure mautrix-meta-instagram is stopped
+      ansible.builtin.service:
+        name: "{{ matrix_mautrix_meta_instagram_identifier }}"
+        state: stopped
+        enabled: false
+        daemon_reload: true
+
+    - name: Ensure mautrix-meta-instagram.service doesn't exist
+      ansible.builtin.file:
+        path: "{{ devture_systemd_docker_base_systemd_path }}/{{ matrix_mautrix_meta_instagram_identifier }}.service"
+        state: absent
--- a/roles/custom/matrix-bridge-mautrix-meta-instagram/tasks/validate_config.yml
+++ b/roles/custom/matrix-bridge-mautrix-meta-instagram/tasks/validate_config.yml
@ -0,0 +1,16 @@
+---
+
+- name: Fail if required mautrix-meta-instagram settings not defined
+  ansible.builtin.fail:
+    msg: >-
+      You need to define a required configuration setting (`{{ item.name }}`).
+  when: "item.when | bool and vars[item.name] == ''"
+  with_items:
+    - {'name': 'matrix_mautrix_meta_instagram_metrics_proxying_hostname', when: "{{ matrix_mautrix_meta_instagram_metrics_proxying_enabled }}"}
+    - {'name': 'matrix_mautrix_meta_instagram_metrics_proxying_path_prefix', when: "{{ matrix_mautrix_meta_instagram_metrics_proxying_enabled }}"}
+    - {'name': 'matrix_mautrix_meta_instagram_appservice_token', when: true}
+    - {'name': 'matrix_mautrix_meta_instagram_homeserver_token', when: true}
+    - {'name': 'matrix_mautrix_meta_instagram_container_network', when: true}
+    - {'name': 'matrix_mautrix_meta_instagram_homeserver_address', when: true}
+    - {'name': 'matrix_mautrix_meta_instagram_database_hostname', when: "{{ matrix_mautrix_meta_instagram_database_engine == 'postgres' }}"}
+    - {'name': 'matrix_mautrix_meta_instagram_database_password', when: "{{ matrix_mautrix_meta_instagram_database_engine == 'postgres' }}"}
--- a/roles/custom/matrix-bridge-mautrix-meta-instagram/templates/config.yaml.j2
+++ b/roles/custom/matrix-bridge-mautrix-meta-instagram/templates/config.yaml.j2
@ -0,0 +1,329 @@
+#jinja2: lstrip_blocks: "True"
+# Homeserver details.
+homeserver:
+    # The address that this appservice can use to connect to the homeserver.
+    address: {{ matrix_mautrix_meta_instagram_homeserver_address | to_json }}
+    # The domain of the homeserver (also known as server_name, used for MXIDs, etc).
+    domain: {{ matrix_mautrix_meta_instagram_homeserver_domain | to_json }}
+
+    # What software is the homeserver running?
+    # Standard Matrix homeservers like Synapse, Dendrite and Conduit should just use "standard" here.
+    software: standard
+    # The URL to push real-time bridge status to.
+    # If set, the bridge will make POST requests to this URL whenever a user's meta connection state changes.
+    # The bridge will use the appservice as_token to authorize requests.
+    status_endpoint: null
+    # Endpoint for reporting per-message status.
+    message_send_checkpoint_endpoint: null
+    # Does the homeserver support https://github.com/matrix-org/matrix-spec-proposals/pull/2246?
+    async_media: false
+
+    # Should the bridge use a websocket for connecting to the homeserver?
+    # The server side is currently not documented anywhere and is only implemented by mautrix-wsproxy,
+    # mautrix-asmux (deprecated), and hungryserv (proprietary).
+    websocket: false
+    # How often should the websocket be pinged? Pinging will be disabled if this is zero.
+    ping_interval_seconds: 0
+
+# Application service host/registration related details.
+# Changing these values requires regeneration of the registration.
+appservice:
+    # The address that the homeserver can use to connect to this appservice.
+    address: {{ matrix_mautrix_meta_instagram_appservice_address | to_json }}
+
+    # The hostname and port where this appservice should listen.
+    hostname: 0.0.0.0
+    port: 29319
+
+    # Database config.
+    database:
+        # The database type. "sqlite3-fk-wal" and "postgres" are supported.
+        type: {{ matrix_mautrix_meta_instagram_appservice_database_type | to_json }}
+        # The database URI.
+        #   SQLite: A raw file path is supported, but `file:<path>?_txlock=immediate` is recommended.
+        #           https://github.com/mattn/go-sqlite3#connection-string
+        #   Postgres: Connection string. For example, postgres://user:password@host/database?sslmode=disable
+        #             To connect via Unix socket, use something like postgres:///dbname?host=/var/run/postgresql
+        uri: {{ matrix_mautrix_meta_instagram_appservice_database_uri | to_json }}
+        # Maximum number of connections. Mostly relevant for Postgres.
+        max_open_conns: 20
+        max_idle_conns: 2
+        # Maximum connection idle time and lifetime before they're closed. Disabled if null.
+        # Parsed with https://pkg.go.dev/time#ParseDuration
+        max_conn_idle_time: null
+        max_conn_lifetime: null
+
+    # The unique ID of this appservice.
+    id: {{ matrix_mautrix_meta_instagram_appservice_id | to_json }}
+    # Appservice bot details.
+    bot:
+        # Username of the appservice bot.
+        username: {{ matrix_mautrix_meta_instagram_appservice_username | to_json }}
+        # Display name and avatar for bot. Set to "remove" to remove display name/avatar, leave empty
+        # to leave display name/avatar as-is.
+        displayname: {{ matrix_mautrix_meta_instagram_appservice_displayname | to_json }}
+        # You can use mxc://maunium.net/JxjlbZUlCPULEeHZSwleUXQv for an Instagram avatar,
+        # or mxc://maunium.net/ygtkteZsXnGJLJHRchUwYWak for Facebook Messenger
+        avatar: {{ matrix_mautrix_meta_instagram_appservice_avatar | to_json }}
+
+    # Whether or not to receive ephemeral events via appservice transactions.
+    # Requires MSC2409 support (i.e. Synapse 1.22+).
+    ephemeral_events: true
+    # Should incoming events be handled asynchronously?
+    # This may be necessary for large public instances with lots of messages going through.
+    # However, messages will not be guaranteed to be bridged in the same order they were sent in.
+    async_transactions: false
+
+    # Authentication tokens for AS <-> HS communication. Autogenerated; do not modify.
+    as_token: {{ matrix_mautrix_meta_instagram_appservice_token | to_json }}
+    hs_token: {{ matrix_mautrix_meta_instagram_homeserver_token | to_json }}
+
+# Prometheus config.
+metrics:
+    # Enable prometheus metrics?
+    enabled: {{ matrix_mautrix_meta_instagram_metrics_enabled | to_json }}
+    # IP and port where the metrics listener should be. The path is always /metrics
+    listen: "0.0.0.0.0:8000"
+
+meta:
+    # Which service is this bridge for? Available options:
+    # * facebook - connect to FB Messenger via facebook.com
+    # * facebook-tor - connect to FB Messenger via facebookwkhpilnemxj7asaniu7vnjjbiltxjqhye3mhbshg7kx5tfyd.onion
+    #                  (note: does not currently proxy media downloads)
+    # * messenger - connect to FB Messenger via messenger.com (can be used with the facebook side deactivated)
+    # * instagram - connect to Instagram DMs via instagram.com
+    #
+    # Remember to change the appservice id, bot profile info, bridge username_template and management_room_text too.
+    mode: {{ matrix_mautrix_meta_instagram_meta_mode | to_json }}
+    # When in Instagram mode, should the bridge connect to WhatsApp servers for encrypted chats?
+    # In FB/Messenger mode encryption is always enabled, this option only affects Instagram mode.
+    ig_e2ee: {{ matrix_mautrix_meta_instagram_meta_ig_e2ee | to_json }}
+    # Static proxy address (HTTP or SOCKS5) for connecting to Meta.
+    proxy:
+    # HTTP endpoint to request new proxy address from, for dynamically assigned proxies.
+    # The endpoint must return a JSON body with a string field called proxy_url.
+    get_proxy_from:
+
+# Bridge config
+bridge:
+    # Localpart template of MXIDs for FB/IG users.
+    # {% raw %}{{.}}{% endraw %} is replaced with the internal ID of the FB/IG user.
+    username_template: {{ matrix_mautrix_meta_instagram_bridge_username_template | to_json }}
+    # Displayname template for FB/IG users. This is also used as the room name in DMs if private_chat_portal_meta is enabled.
+    # {% raw %}{{.DisplayName}}{% endraw %} - The display name set by the user.
+    # {% raw %}{{.Username}}{% endraw %} - The username set by the user.
+    # {% raw %}{{.ID}}{% endraw %} - The internal user ID of the user.
+    displayname_template: {{ matrix_mautrix_meta_instagram_bridge_displayname_template | to_json }}
+    # Whether to explicitly set the avatar and room name for private chat portal rooms.
+    # If set to `default`, this will be enabled in encrypted rooms and disabled in unencrypted rooms.
+    # If set to `always`, all DM rooms will have explicit names and avatars set.
+    # If set to `never`, DM rooms will never have names and avatars set.
+    private_chat_portal_meta: default
+
+    portal_message_buffer: 128
+
+    # Should the bridge create a space for each logged-in user and add bridged rooms to it?
+    # Users who logged in before turning this on should run `!meta sync-space` to create and fill the space for the first time.
+    personal_filtering_spaces: false
+    # Should Matrix m.notice-type messages be bridged?
+    bridge_notices: true
+    # Should the bridge send a read receipt from the bridge bot when a message has been sent to FB/IG?
+    delivery_receipts: false
+    # Whether the bridge should send the message status as a custom com.beeper.message_send_status event.
+    message_status_events: false
+    # Whether the bridge should send error notices via m.notice events when a message fails to bridge.
+    message_error_notices: true
+    # Should the bridge never send alerts to the bridge management room?
+    # These are mostly things like the user being logged out.
+    disable_bridge_alerts: false
+    # Should the bridge update the m.direct account data event when double puppeting is enabled.
+    # Note that updating the m.direct event is not atomic and is therefore prone to race conditions.
+    sync_direct_chat_list: false
+    # Set this to true to tell the bridge to re-send m.bridge events to all rooms on the next run.
+    # This field will automatically be changed back to false after it, except if the config file is not writable.
+    resend_bridge_info: false
+    # Send captions in the same message as images. This will send data compatible with both MSC2530.
+    # This is currently not supported in most clients.
+    caption_in_message: false
+    # Whether or not created rooms should have federation enabled.
+    # If false, created portal rooms will never be federated.
+    federate_rooms: {{ matrix_mautrix_meta_instagram_bridge_federate_rooms | to_json }}
+    # Should mute status be bridged? Allowed options: always, on-create, never
+    mute_bridging: on-create
+    # Servers to always allow double puppeting from
+    double_puppet_server_map: {}
+    # Allow using double puppeting from any server with a valid client .well-known file.
+    double_puppet_allow_discovery: false
+    # Shared secrets for https://github.com/devture/matrix-synapse-shared-secret-auth
+    #
+    # If set, double puppeting will be enabled automatically for local users
+    # instead of users having to find an access token and run `login-matrix`
+    # manually.
+    login_shared_secret_map: {{ matrix_mautrix_meta_instagram_bridge_login_shared_secret_map | to_json }}
+
+    # The prefix for commands. Only required in non-management rooms.
+    # If set to "default", will be determined based on meta -> mode, "!ig" for instagram and "!fb" for facebook
+    command_prefix: {{ matrix_mautrix_meta_instagram_bridge_command_prefix | to_json }}
+
+    backfill:
+        # If disabled, old messages will never be bridged.
+        enabled: true
+        # By default, Meta sends info about approximately 20 recent threads. If this is set to something else than 0,
+        # the bridge will request more threads on first login, until it reaches the specified number of pages
+        # or the end of the inbox.
+        inbox_fetch_pages: 0
+        # By default, Meta only sends one old message per thread. If this is set to a something else than 0,
+        # the bridge will delay handling the one automatically received message and request more messages to backfill.
+        # One page usually contains 20 messages. This can technically be set to -1 to fetch all messages,
+        # but that will block bridging messages until the entire backfill is completed.
+        history_fetch_pages: 0
+        # Same as above, but for catchup backfills (i.e. when the bridge is restarted).
+        catchup_fetch_pages: 5
+        # Maximum age of chats to leave as unread when backfilling. 0 means all chats can be left as unread.
+        # If non-zero, chats that are older than this will be marked as read, even if they're still unread on Meta.
+        unread_hours_threshold: 0
+        # Backfill queue settings. Only relevant for Beeper, because standard Matrix servers
+        # don't support inserting messages into room history.
+        queue:
+            # How many pages of messages to request in one go (without sleeping between requests)?
+            pages_at_once: 5
+            # Maximum number of pages to fetch. -1 to fetch all pages until the start of the chat.
+            max_pages: -1
+            # How long to sleep after fetching a bunch of pages ("bunch" defined by pages_at_once).
+            sleep_between_tasks: 20s
+            # Disable fetching XMA media (reels, stories, etc) when backfilling.
+            dont_fetch_xma: true
+
+    # Messages sent upon joining a management room.
+    # Markdown is supported. The defaults are listed below.
+    management_room_text:
+        # Sent when joining a room.
+        welcome: {{ matrix_mautrix_meta_instagram_bridge_management_room_text_welcome | to_json }}
+        # Sent when joining a management room and the user is already logged in.
+        welcome_connected: "Use `help` for help."
+        # Sent when joining a management room and the user is not logged in.
+        welcome_unconnected: "Use `help` for help or `login` to log in."
+        # Optional extra text sent when joining a management room.
+        additional_help: ""
+
+    # End-to-bridge encryption support options.
+    #
+    # See https://docs.mau.fi/bridges/general/end-to-bridge-encryption.html for more info.
+    encryption:
+        # Allow encryption, work in group chat rooms with e2ee enabled
+        allow: {{ matrix_mautrix_meta_instagram_bridge_encryption_allow | to_json }}
+        # Default to encryption, force-enable encryption in all portals the bridge creates
+        # This will cause the bridge bot to be in private chats for the encryption to work properly.
+        default: {{ matrix_mautrix_meta_instagram_bridge_encryption_default | to_json }}
+        # Whether to use MSC2409/MSC3202 instead of /sync long polling for receiving encryption-related data.
+        appservice: {{ matrix_mautrix_meta_instagram_bridge_encryption_appservice | to_json }}
+        # Require encryption, drop any unencrypted messages.
+        require: {{ matrix_mautrix_meta_instagram_bridge_encryption_require | to_json }}
+        # Enable key sharing? If enabled, key requests for rooms where users are in will be fulfilled.
+        # You must use a client that supports requesting keys from other users to use this feature.
+        allow_key_sharing: {{ matrix_mautrix_meta_instagram_bridge_encryption_allow_key_sharing | to_json }}
+        # Options for deleting megolm sessions from the bridge.
+        delete_keys:
+            # Beeper-specific: delete outbound sessions when hungryserv confirms
+            # that the user has uploaded the key to key backup.
+            delete_outbound_on_ack: false
+            # Don't store outbound sessions in the inbound table.
+            dont_store_outbound: false
+            # Ratchet megolm sessions forward after decrypting messages.
+            ratchet_on_decrypt: false
+            # Delete fully used keys (index >= max_messages) after decrypting messages.
+            delete_fully_used_on_decrypt: false
+            # Delete previous megolm sessions from same device when receiving a new one.
+            delete_prev_on_new_session: false
+            # Delete megolm sessions received from a device when the device is deleted.
+            delete_on_device_delete: false
+            # Periodically delete megolm sessions when 2x max_age has passed since receiving the session.
+            periodically_delete_expired: false
+            # Delete inbound megolm sessions that don't have the received_at field used for
+            # automatic ratcheting and expired session deletion. This is meant as a migration
+            # to delete old keys prior to the bridge update.
+            delete_outdated_inbound: false
+        # What level of device verification should be required from users?
+        #
+        # Valid levels:
+        #   unverified - Send keys to all device in the room.
+        #   cross-signed-untrusted - Require valid cross-signing, but trust all cross-signing keys.
+        #   cross-signed-tofu - Require valid cross-signing, trust cross-signing keys on first use (and reject changes).
+        #   cross-signed-verified - Require valid cross-signing, plus a valid user signature from the bridge bot.
+        #                           Note that creating user signatures from the bridge bot is not currently possible.
+        #   verified - Require manual per-device verification
+        #              (currently only possible by modifying the `trust` column in the `crypto_device` database table).
+        verification_levels:
+            # Minimum level for which the bridge should send keys to when bridging messages from FB/IG to Matrix.
+            receive: unverified
+            # Minimum level that the bridge should accept for incoming Matrix messages.
+            send: unverified
+            # Minimum level that the bridge should require for accepting key requests.
+            share: cross-signed-tofu
+        # Options for Megolm room key rotation. These options allow you to
+        # configure the m.room.encryption event content. See:
+        # https://spec.matrix.org/v1.3/client-server-api/#mroomencryption for
+        # more information about that event.
+        rotation:
+            # Enable custom Megolm room key rotation settings. Note that these
+            # settings will only apply to rooms created after this option is
+            # set.
+            enable_custom: false
+            # The maximum number of milliseconds a session should be used
+            # before changing it. The Matrix spec recommends 604800000 (a week)
+            # as the default.
+            milliseconds: 604800000
+            # The maximum number of messages that should be sent with a given a
+            # session before changing it. The Matrix spec recommends 100 as the
+            # default.
+            messages: 100
+
+            # Disable rotating keys when a user's devices change?
+            # You should not enable this option unless you understand all the implications.
+            disable_device_change_key_rotation: false
+
+    # Settings for provisioning API
+    provisioning:
+        # Prefix for the provisioning API paths.
+        prefix: /_matrix/provision
+        # Shared secret for authentication. If set to "generate", a random secret will be generated,
+        # or if set to "disable", the provisioning API will be disabled.
+        shared_secret: disable
+        # Enable debug API at /debug with provisioning authentication.
+        debug_endpoints: false
+
+    # Permissions for using the bridge.
+    # Permitted values:
+    #    relay - Talk through the relaybot (if enabled), no access otherwise
+    #     user - Access to use the bridge to chat with a Meta account.
+    #    admin - User level and some additional administration tools
+    # Permitted keys:
+    #        * - All Matrix users
+    #   domain - All users on that homeserver
+    #     mxid - Specific user
+    permissions: {{ matrix_mautrix_meta_instagram_bridge_permissions | to_json }}
+
+    # Settings for relay mode
+    relay:
+        # Whether relay mode should be allowed. If allowed, `!wa set-relay` can be used to turn any
+        # authenticated user into a relaybot for that chat.
+        enabled: {{ matrix_mautrix_meta_instagram_bridge_relay_enabled | to_json }}
+        # Should only admins be allowed to set themselves as relay users?
+        admin_only: {{ matrix_mautrix_meta_instagram_bridge_relay_admin_only | to_json }}
+        # The formats to use when sending messages to Meta via the relaybot.
+        message_formats:
+            m.text: "{% raw %}{{ .Sender.Displayname }}: {{ .Message }}{% endraw %}"
+            m.notice: "{% raw %}{{ .Sender.Displayname }}: {{ .Message }}{% endraw %}"
+            m.emote: "{% raw %}* {{ .Sender.Displayname }} {{ .Message }}{% endraw %}"
+            m.file: "{% raw %}{{ .Sender.Displayname }} sent a file{% endraw %}"
+            m.image: "{% raw %}{{ .Sender.Displayname }} sent an image{% endraw %}"
+            m.audio: "{% raw %}{{ .Sender.Displayname }} sent an audio file{% endraw %}"
+            m.video: "{% raw %}{{ .Sender.Displayname }} sent a video{% endraw %}"
+            m.location: "{% raw %}{{ .Sender.Displayname }} sent a location{% endraw %}"
+
+# Logging config. See https://github.com/tulir/zeroconfig for details.
+logging:
+    min_level: {{ matrix_mautrix_meta_instagram_logging_min_level | to_json }}
+    writers:
+    - type: stdout
+      format: pretty
--- a/roles/custom/matrix-bridge-mautrix-meta-instagram/templates/labels.j2
+++ b/roles/custom/matrix-bridge-mautrix-meta-instagram/templates/labels.j2
@ -0,0 +1,48 @@
+{% if matrix_mautrix_meta_instagram_container_labels_traefik_enabled %}
+traefik.enable=true
+
+{% if matrix_mautrix_meta_instagram_container_labels_traefik_docker_network %}
+traefik.docker.network={{ matrix_mautrix_meta_instagram_container_labels_traefik_docker_network }}
+{% endif %}
+
+traefik.http.services.{{ matrix_mautrix_meta_instagram_identifier }}-appservice.loadbalancer.server.port=29319
+traefik.http.services.{{ matrix_mautrix_meta_instagram_identifier }}-metrics.loadbalancer.server.port=8000
+
+
+{% if matrix_mautrix_meta_instagram_container_labels_metrics_enabled %}
+############################################################
+#                                                          #
+# Metrics                                                  #
+#                                                          #
+############################################################
+
+{% if matrix_mautrix_meta_instagram_container_labels_metrics_middleware_basic_auth_enabled %}
+traefik.http.middlewares.{{ matrix_mautrix_meta_instagram_identifier }}-metrics-basic-auth.basicauth.users={{ matrix_mautrix_meta_instagram_container_labels_metrics_middleware_basic_auth_users }}
+traefik.http.routers.{{ matrix_mautrix_meta_instagram_identifier }}-metrics.middlewares={{ matrix_mautrix_meta_instagram_identifier }}-metrics-basic-auth
+{% endif %}
+
+traefik.http.routers.{{ matrix_mautrix_meta_instagram_identifier }}-metrics.rule={{ matrix_mautrix_meta_instagram_container_labels_metrics_traefik_rule }}
+
+{% if matrix_mautrix_meta_instagram_container_labels_metrics_traefik_priority | int > 0 %}
+traefik.http.routers.{{ matrix_mautrix_meta_instagram_identifier }}-metrics.priority={{ matrix_mautrix_meta_instagram_container_labels_metrics_traefik_priority }}
+{% endif %}
+
+traefik.http.routers.{{ matrix_mautrix_meta_instagram_identifier }}-metrics.service={{ matrix_mautrix_meta_instagram_identifier }}-metrics
+traefik.http.routers.{{ matrix_mautrix_meta_instagram_identifier }}-metrics.entrypoints={{ matrix_mautrix_meta_instagram_container_labels_metrics_traefik_entrypoints }}
+
+traefik.http.routers.{{ matrix_mautrix_meta_instagram_identifier }}-metrics.tls={{ matrix_mautrix_meta_instagram_container_labels_metrics_traefik_tls | to_json }}
+{% if matrix_mautrix_meta_instagram_container_labels_metrics_traefik_tls %}
+traefik.http.routers.{{ matrix_mautrix_meta_instagram_identifier }}-metrics.tls.certResolver={{ matrix_mautrix_meta_instagram_container_labels_metrics_traefik_tls_certResolver }}
+{% endif %}
+
+############################################################
+#                                                          #
+# /Metrics                                                 #
+#                                                          #
+############################################################
+{% endif %}
+
+
+{% endif %}
+
+{{ matrix_mautrix_meta_instagram_container_labels_additional_labels }}
--- a/roles/custom/matrix-bridge-mautrix-meta-instagram/templates/systemd/matrix-mautrix-meta.service.j2
+++ b/roles/custom/matrix-bridge-mautrix-meta-instagram/templates/systemd/matrix-mautrix-meta.service.j2
@ -0,0 +1,51 @@
+#jinja2: lstrip_blocks: "True"
+[Unit]
+Description=mautrix-meta bridge ({{ matrix_mautrix_meta_instagram_identifier }})
+{% for service in matrix_mautrix_meta_instagram_systemd_required_services_list %}
+Requires={{ service }}
+After={{ service }}
+{% endfor %}
+{% for service in matrix_mautrix_meta_instagram_systemd_wanted_services_list %}
+Wants={{ service }}
+{% endfor %}
+DefaultDependencies=no
+
+[Service]
+Type=simple
+Environment="HOME={{ devture_systemd_docker_base_systemd_unit_home_path }}"
+ExecStartPre=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} stop --time={{ devture_systemd_docker_base_container_stop_grace_time_seconds }} {{ matrix_mautrix_meta_instagram_identifier }} 2>/dev/null || true'
+ExecStartPre=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} rm {{ matrix_mautrix_meta_instagram_identifier }} 2>/dev/null || true'
+
+ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} create \
+			--rm \
+			--name={{ matrix_mautrix_meta_instagram_identifier }} \
+			--log-driver=none \
+			--user={{ matrix_user_uid }}:{{ matrix_user_gid }} \
+			--cap-drop=ALL \
+			--network={{ matrix_mautrix_meta_instagram_container_network }} \
+			{% if matrix_mautrix_meta_instagram_container_http_host_bind_port %}
+			-p {{ matrix_mautrix_meta_instagram_container_http_host_bind_port }}:29319 \
+			{% endif %}
+			--mount type=bind,src={{ matrix_mautrix_meta_instagram_config_path }},dst=/config,ro \
+			--mount type=bind,src={{ matrix_mautrix_meta_instagram_data_path }},dst=/data \
+			--label-file={{ matrix_mautrix_meta_instagram_base_path }}/labels \
+			{% for arg in matrix_mautrix_meta_instagram_container_extra_arguments %}
+			{{ arg }} \
+			{% endfor %}
+			{{ matrix_mautrix_meta_instagram_container_image }} \
+			/usr/bin/mautrix-meta -c /config/config.yaml -r /config/registration.yaml --no-update
+
+{% for network in matrix_mautrix_meta_instagram_container_additional_networks %}
+ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} network connect {{ network }} {{ matrix_mautrix_meta_instagram_identifier }}
+{% endfor %}
+
+ExecStart={{ devture_systemd_docker_base_host_command_docker }} start --attach {{ matrix_mautrix_meta_instagram_identifier }}
+
+ExecStop=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} stop --time={{ devture_systemd_docker_base_container_stop_grace_time_seconds }} {{ matrix_mautrix_meta_instagram_identifier }} 2>/dev/null || true'
+ExecStop=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} rm {{ matrix_mautrix_meta_instagram_identifier }} 2>/dev/null || true'
+Restart=always
+RestartSec=30
+SyslogIdentifier={{ matrix_mautrix_meta_instagram_identifier }}
+
+[Install]
+WantedBy=multi-user.target
--- a/roles/custom/matrix-bridge-mautrix-meta-messenger/defaults/main.yml
+++ b/roles/custom/matrix-bridge-mautrix-meta-messenger/defaults/main.yml
@ -0,0 +1,270 @@
+---
+
+# mautrix-meta is a Matrix <-> Facebook/Messenger/Instagram bridge
+# Project source code URL: https://github.com/mautrix/meta
+#
+# WARNING: this bridge role is used for both Messenger and Instagram.
+# This Messenger role acts as a source and auto-generates matrix-bridge-mautrix-meta-instagram
+# thanks to `just rebuild-mautrix-meta-instagram` (`bin/rebuild-mautrix-meta-instagram.sh`).
+# If you'd like to make changes to the Instagram role, consider making your changes to the Messenger role instead.
+
+matrix_mautrix_meta_messenger_enabled: true
+
+matrix_mautrix_meta_messenger_identifier: matrix-mautrix-meta-messenger
+
+# renovate: datasource=docker depName=dock.mau.dev/mautrix/meta
+matrix_mautrix_meta_messenger_version: v0.1.0
+
+matrix_mautrix_meta_messenger_base_path: "{{ matrix_base_data_path }}/mautrix-meta-messenger"
+matrix_mautrix_meta_messenger_config_path: "{{ matrix_mautrix_meta_messenger_base_path }}/config"
+matrix_mautrix_meta_messenger_data_path: "{{ matrix_mautrix_meta_messenger_base_path }}/data"
+matrix_mautrix_meta_messenger_container_src_files_path: "{{ matrix_mautrix_meta_messenger_base_path }}/container-src"
+
+matrix_mautrix_meta_messenger_container_image_self_build: false
+matrix_mautrix_meta_messenger_container_image_self_build_repo: "https://github.com/mautrix/meta.git"
+
+matrix_mautrix_meta_messenger_container_image: "{{ matrix_mautrix_meta_messenger_container_image_name_prefix }}mautrix/meta:{{ matrix_mautrix_meta_messenger_version }}"
+matrix_mautrix_meta_messenger_container_image_name_prefix: "{{ 'localhost/' if matrix_mautrix_meta_messenger_container_image_self_build else 'dock.mau.dev/' }}"
+matrix_mautrix_meta_messenger_container_image_force_pull: "{{ matrix_mautrix_meta_messenger_container_image.endswith(':latest') }}"
+
+matrix_mautrix_meta_messenger_container_network: ""
+
+matrix_mautrix_meta_messenger_container_additional_networks: "{{ matrix_mautrix_meta_messenger_container_additional_networks_auto + matrix_mautrix_meta_messenger_container_additional_networks_custom }}"
+matrix_mautrix_meta_messenger_container_additional_networks_auto: []
+matrix_mautrix_meta_messenger_container_additional_networks_custom: []
+
+# matrix_mautrix_meta_messenger_container_labels_traefik_enabled controls whether labels to assist a Traefik reverse-proxy will be attached to the container.
+# See `../templates/labels.j2` for details.
+#
+# To inject your own other container labels, see `matrix_mautrix_meta_messenger_container_labels_additional_labels`.
+matrix_mautrix_meta_messenger_container_labels_traefik_enabled: true
+matrix_mautrix_meta_messenger_container_labels_traefik_docker_network: "{{ matrix_mautrix_meta_messenger_container_network }}"
+matrix_mautrix_meta_messenger_container_labels_traefik_entrypoints: web-secure
+matrix_mautrix_meta_messenger_container_labels_traefik_tls_certResolver: default  # noqa var-naming
+
+# Controls whether labels will be added that expose the bridge's metrics
+matrix_mautrix_meta_messenger_container_labels_metrics_enabled: "{{ matrix_mautrix_meta_messenger_metrics_enabled and matrix_mautrix_meta_messenger_metrics_proxying_enabled }}"
+matrix_mautrix_meta_messenger_container_labels_metrics_traefik_rule: "Host(`{{ matrix_mautrix_meta_messenger_metrics_proxying_hostname }}`) && PathPrefix(`{{ matrix_mautrix_meta_messenger_metrics_proxying_path_prefix }}`)"
+matrix_mautrix_meta_messenger_container_labels_metrics_traefik_priority: 0
+matrix_mautrix_meta_messenger_container_labels_metrics_traefik_entrypoints: "{{ matrix_mautrix_meta_messenger_container_labels_traefik_entrypoints }}"
+matrix_mautrix_meta_messenger_container_labels_metrics_traefik_tls: "{{ matrix_mautrix_meta_messenger_container_labels_metrics_traefik_entrypoints != 'web' }}"
+matrix_mautrix_meta_messenger_container_labels_metrics_traefik_tls_certResolver: "{{ matrix_mautrix_meta_messenger_container_labels_traefik_tls_certResolver }}"  # noqa var-naming
+matrix_mautrix_meta_messenger_container_labels_metrics_middleware_basic_auth_enabled: false
+# See: https://doc.traefik.io/traefik/middlewares/http/basicauth/#users
+matrix_mautrix_meta_messenger_container_labels_metrics_middleware_basic_auth_users: ''
+
+# matrix_mautrix_meta_messenger_container_labels_additional_labels contains a multiline string with additional labels to add to the container label file.
+# See `../templates/labels.j2` for details.
+#
+# Example:
+# matrix_mautrix_meta_messenger_container_labels_additional_labels: |
+#   my.label=1
+#   another.label="here"
+matrix_mautrix_meta_messenger_container_labels_additional_labels: ''
+
+# A list of extra arguments to pass to the container
+matrix_mautrix_meta_messenger_container_extra_arguments: []
+
+# List of systemd services that the systemd service depends on.
+matrix_mautrix_meta_messenger_systemd_required_services_list: "{{ matrix_mautrix_meta_messenger_systemd_required_services_list_default + matrix_mautrix_meta_messenger_systemd_required_services_list_auto + matrix_mautrix_meta_messenger_systemd_required_services_list_custom }}"
+matrix_mautrix_meta_messenger_systemd_required_services_list_default: ['docker.service']
+matrix_mautrix_meta_messenger_systemd_required_services_list_auto: []
+matrix_mautrix_meta_messenger_systemd_required_services_list_custom: []
+
+# List of systemd services that the systemd service wants
+matrix_mautrix_meta_messenger_systemd_wanted_services_list: []
+
+# Controls whether the bridge container exposes its HTTP port.
+#
+# Takes an "<ip>:<port>" or "<port>" value (e.g. "127.0.0.1:29319"), or empty string to not expose.
+matrix_mautrix_meta_messenger_container_http_host_bind_port: ''
+
+# Database-related configuration fields
+matrix_mautrix_meta_messenger_database_engine: sqlite3-fk-wal
+
+matrix_mautrix_meta_messenger_sqlite_database_path_local: "{{ matrix_mautrix_meta_messenger_data_path }}/mautrix-meta.db"
+matrix_mautrix_meta_messenger_sqlite_database_path_in_container: "/data/mautrix-meta.db"
+
+matrix_mautrix_meta_messenger_database_suffix: |-
+  {{
+    ({
+      'facebook': '_facebook',
+      'facebook-tor': '_facebook',
+      'messenger': '_messenger',
+      'instagram': '_instagram',
+    })[matrix_mautrix_meta_messenger_meta_mode]
+  }}
+
+matrix_mautrix_meta_messenger_database_username: "matrix_mautrix_meta{{ matrix_mautrix_meta_messenger_database_suffix }}"
+matrix_mautrix_meta_messenger_database_password: ''
+matrix_mautrix_meta_messenger_database_hostname: ''
+matrix_mautrix_meta_messenger_database_port: 5432
+matrix_mautrix_meta_messenger_database_name: "matrix_mautrix_meta{{ matrix_mautrix_meta_messenger_database_suffix }}"
+matrix_mautrix_meta_messenger_database_sslmode: disable
+
+matrix_mautrix_meta_messenger_database_connection_string: 'postgres://{{ matrix_mautrix_meta_messenger_database_username }}:{{ matrix_mautrix_meta_messenger_database_password }}@{{ matrix_mautrix_meta_messenger_database_hostname }}:{{ matrix_mautrix_meta_messenger_database_port }}/{{ matrix_mautrix_meta_messenger_database_name }}?sslmode={{ matrix_mautrix_meta_messenger_database_sslmode }}'
+
+matrix_mautrix_meta_messenger_homeserver_address: ""
+matrix_mautrix_meta_messenger_homeserver_domain: '{{ matrix_domain }}'
+matrix_mautrix_meta_messenger_homeserver_token: ''
+
+matrix_mautrix_meta_messenger_appservice_address: "http://{{ matrix_mautrix_meta_messenger_identifier }}:29319"
+
+matrix_mautrix_meta_messenger_appservice_id: "{{ matrix_mautrix_meta_messenger_meta_mode }}"
+
+# For Facebook/Messenger, we use the same `@messengerbot:DOMAIN` username regardless of how bridging happens for multiple reasons:
+# - it's consistent - regardless of how bridging happens, the bridged service is actually Messenger
+# - it's easy for users - you may change the mode, but the bot is always at `@messengerbot:DOMAIN`
+# - it doesn't conflict with mautrix-facebook which uses `@facebookbot:DOMAIN`
+# - `matrix_mautrix_meta_messenger_appservice_avatar` only has icons for Messenger and Instagram, not Facebook
+matrix_mautrix_meta_messenger_appservice_username_prefix: |-
+  {{
+    ({
+      'facebook': 'messenger',
+      'facebook-tor': 'messenger',
+      'messenger': 'messenger',
+      'instagram': 'instagram',
+    })[matrix_mautrix_meta_messenger_meta_mode]
+  }}
+matrix_mautrix_meta_messenger_appservice_username: "{{ matrix_mautrix_meta_messenger_appservice_username_prefix }}bot"
+matrix_mautrix_meta_messenger_appservice_displayname: "{{ matrix_mautrix_meta_messenger_meta_mode | capitalize }} bridge bot"
+matrix_mautrix_meta_messenger_appservice_avatar: "{{ 'mxc://maunium.net/JxjlbZUlCPULEeHZSwleUXQv' if matrix_mautrix_meta_messenger_meta_mode == 'instagram' else 'mxc://maunium.net/ygtkteZsXnGJLJHRchUwYWak' }}"
+
+matrix_mautrix_meta_messenger_appservice_database_type: "{{ matrix_mautrix_meta_messenger_database_engine }}"
+
+matrix_mautrix_meta_messenger_appservice_database_uri: |-
+  {{
+    {
+      'sqlite3-fk-wal': ('sqlite:///' + matrix_mautrix_meta_messenger_sqlite_database_path_in_container),
+      'postgres': matrix_mautrix_meta_messenger_database_connection_string,
+    }[matrix_mautrix_meta_messenger_database_engine]
+  }}
+
+matrix_mautrix_meta_messenger_appservice_token: ''
+
+# Controls which service this bridge is for.
+# Valid options:
+# * facebook - connect to FB Messenger via facebook.com
+# * facebook-tor - connect to FB Messenger via facebookwkhpilnemxj7asaniu7vnjjbiltxjqhye3mhbshg7kx5tfyd.onion
+#                  (note: does not currently proxy media downloads)
+# * messenger - connect to FB Messenger via messenger.com (can be used with the facebook side deactivated)
+# * instagram - connect to Instagram DMs via instagram.com
+matrix_mautrix_meta_messenger_meta_mode: messenger
+
+# When in `instagram` mode (see `matrix_mautrix_meta_messenger_meta_mode`), should the bridge connect to WhatsApp servers for encrypted chats?
+matrix_mautrix_meta_messenger_meta_ig_e2ee: false
+
+# Whether or not metrics endpoint should be enabled.
+# Enabling them is usually enough for a local (in-container) Prometheus to consume them.
+# If metrics need to be consumed by another (external) Prometheus server, consider exposing them via `matrix_mautrix_meta_messenger_metrics_proxying_enabled`.
+matrix_mautrix_meta_messenger_metrics_enabled: false
+
+# Controls whether metrics should be exposed on a public URL.
+matrix_mautrix_meta_messenger_metrics_proxying_enabled: false
+matrix_mautrix_meta_messenger_metrics_proxying_hostname: ''
+matrix_mautrix_meta_messenger_metrics_proxying_path_prefix: ''
+
+matrix_mautrix_meta_messenger_bridge_username_prefix: |-
+  {{
+    ({
+      'facebook': 'facebook_',
+      'facebook-tor': 'facebook_',
+      'messenger': 'messenger_',
+      'instagram': 'instagram_',
+    })[matrix_mautrix_meta_messenger_meta_mode]
+  }}
+
+# Localpart template of MXIDs for FB/IG users.
+# {{.}} is replaced with the internal ID of the FB/IG user.
+# Changing this may require that you change the regex in the appservice.
+matrix_mautrix_meta_messenger_bridge_username_template: "{{ matrix_mautrix_meta_messenger_bridge_username_prefix + '{{.}}' }}"
+
+matrix_mautrix_meta_messenger_bridge_displayname_template: '{% raw %}{{or .DisplayName .Username "Unknown user"}}{% endraw %}'
+
+# The prefix for commands. Only required in non-management rooms.
+# If set to "default", will be determined based on meta -> mode (`matrix_mautrix_meta_messenger_meta_mode`):
+# - "!ig" for instagram
+# - "!fb" for facebook
+matrix_mautrix_meta_messenger_bridge_command_prefix: default
+
+# Whether or not created rooms should have federation enabled.
+# If false, created portal rooms will never be federated.
+matrix_mautrix_meta_messenger_bridge_federate_rooms: true
+
+# Enable End-to-bridge encryption
+matrix_mautrix_meta_messenger_bridge_encryption_allow: "{{ matrix_bridges_encryption_enabled }}"
+matrix_mautrix_meta_messenger_bridge_encryption_default: "{{ matrix_mautrix_meta_messenger_bridge_encryption_allow }}"
+matrix_mautrix_meta_messenger_bridge_encryption_allow_key_sharing: "{{ matrix_mautrix_meta_messenger_bridge_encryption_allow }}"
+matrix_mautrix_meta_messenger_bridge_encryption_appservice: false
+matrix_mautrix_meta_messenger_bridge_encryption_require: false
+
+# Can be set to enable automatic double-puppeting via Shared Secret Auth (https://github.com/devture/matrix-synapse-shared-secret-auth).
+matrix_mautrix_meta_messenger_bridge_login_shared_secret: ''
+
+matrix_mautrix_meta_messenger_bridge_login_shared_secret_map: "{{ {matrix_mautrix_meta_messenger_homeserver_domain: matrix_mautrix_meta_messenger_bridge_login_shared_secret} if matrix_mautrix_meta_messenger_bridge_login_shared_secret else {} }}"
+
+matrix_mautrix_meta_messenger_bridge_permissions: "{{ matrix_mautrix_meta_messenger_bridge_permissions_default | combine(matrix_mautrix_meta_messenger_bridge_permissions_custom) }}"
+
+matrix_mautrix_meta_messenger_bridge_permissions_default: |-
+  {{
+    {'*': 'relay', matrix_mautrix_meta_messenger_homeserver_domain: 'user'}
+    | combine({matrix_admin: 'admin'} if matrix_admin else {})
+  }}
+
+matrix_mautrix_meta_messenger_bridge_permissions_custom: {}
+
+# Enable bridge relay bot functionality
+matrix_mautrix_meta_messenger_bridge_relay_enabled: "{{ matrix_bridges_relay_enabled }}"
+matrix_mautrix_meta_messenger_bridge_relay_admin_only: true
+
+matrix_mautrix_meta_messenger_bridge_management_room_text_welcome: |-
+  {{
+    ({
+      'facebook': "Hello, I'm a Facebook bridge bot.",
+      'facebook-tor': "Hello, I'm a Facebook bridge bot which uses Tor.",
+      'messenger': "Hello, I'm a Messenger bridge bot.",
+      'instagram': "Hello, I'm an Instagram bridge bot.",
+    })[matrix_mautrix_meta_messenger_meta_mode]
+  }}
+
+# Specifies the default log level.
+# This bridge uses zerolog, so valid levels are: panic, fatal, error, warn, info, debug, trace
+matrix_mautrix_meta_messenger_logging_min_level: warn
+
+# Default configuration template which covers the generic use case.
+# You can customize it by controlling the various variables inside it.
+#
+# For a more advanced customization, you can extend the default (see `matrix_mautrix_meta_messenger_configuration_extension_yaml`)
+# or completely replace this variable with your own template.
+matrix_mautrix_meta_messenger_configuration_yaml: "{{ lookup('template', 'templates/config.yaml.j2') }}"
+
+matrix_mautrix_meta_messenger_configuration_extension_yaml: |
+  # Your custom YAML configuration goes here.
+  # This configuration extends the default starting configuration (`matrix_mautrix_meta_messenger_configuration_yaml`).
+  #
+  # You can override individual variables from the default configuration, or introduce new ones.
+  #
+  # If you need something more special, you can take full control by
+  # completely redefining `matrix_mautrix_meta_messenger_configuration_yaml`.
+
+matrix_mautrix_meta_messenger_configuration_extension: "{{ matrix_mautrix_meta_messenger_configuration_extension_yaml | from_yaml if matrix_mautrix_meta_messenger_configuration_extension_yaml | from_yaml is mapping else {} }}"
+
+# Holds the final configuration (a combination of the default and its extension).
+# You most likely don't need to touch this variable. Instead, see `matrix_mautrix_meta_messenger_configuration_yaml`.
+matrix_mautrix_meta_messenger_configuration: "{{ matrix_mautrix_meta_messenger_configuration_yaml | from_yaml | combine(matrix_mautrix_meta_messenger_configuration_extension, recursive=True) }}"
+
+matrix_mautrix_meta_messenger_registration_yaml: |
+  id: {{ matrix_mautrix_meta_messenger_appservice_id | to_json }}
+  as_token: {{ matrix_mautrix_meta_messenger_appservice_token | to_json }}
+  hs_token: {{ matrix_mautrix_meta_messenger_homeserver_token | to_json }}
+  namespaces:
+    users:
+    - exclusive: true
+      regex: '^@{{ matrix_mautrix_meta_messenger_bridge_username_prefix }}.+:{{ matrix_mautrix_meta_messenger_homeserver_domain | regex_escape }}$'
+    - exclusive: true
+      regex: '^@{{ matrix_mautrix_meta_messenger_appservice_username | regex_escape }}:{{ matrix_mautrix_meta_messenger_homeserver_domain | regex_escape }}$'
+  url: {{ matrix_mautrix_meta_messenger_appservice_address }}
+  sender_localpart: _bot_{{ matrix_mautrix_meta_messenger_appservice_username }}
+  rate_limited: false
+
+matrix_mautrix_meta_messenger_registration: "{{ matrix_mautrix_meta_messenger_registration_yaml | from_yaml }}"
--- a/roles/custom/matrix-bridge-mautrix-meta-messenger/tasks/install.yml
+++ b/roles/custom/matrix-bridge-mautrix-meta-messenger/tasks/install.yml
@ -0,0 +1,121 @@
+---
+
+- ansible.builtin.set_fact:
+    matrix_mautrix_meta_messenger_requires_restart: false
+
+- when: "matrix_mautrix_meta_messenger_database_engine == 'postgres'"
+  block:
+    - name: Check if an SQLite database already exists
+      ansible.builtin.stat:
+        path: "{{ matrix_mautrix_meta_messenger_sqlite_database_path_local }}"
+      register: matrix_mautrix_meta_messenger_sqlite_database_path_local_stat_result
+
+    - when: "matrix_mautrix_meta_messenger_sqlite_database_path_local_stat_result.stat.exists | bool"
+      block:
+        - ansible.builtin.include_role:
+            name: galaxy/com.devture.ansible.role.postgres
+            tasks_from: migrate_db_to_postgres
+          vars:
+            devture_postgres_db_migration_request:
+              src: "{{ matrix_mautrix_meta_messenger_sqlite_database_path_local }}"
+              dst: "{{ matrix_mautrix_meta_messenger_database_connection_string }}"
+              caller: "{{ role_path | basename }}"
+              engine_variable_name: 'matrix_mautrix_meta_messenger_database_engine'
+              engine_old: 'sqlite'
+              systemd_services_to_stop: "{{ [matrix_mautrix_meta_messenger_identifier + '.service'] }}"
+
+        - ansible.builtin.set_fact:
+            matrix_mautrix_meta_messenger_requires_restart: true
+
+- name: Ensure mautrix-meta-messenger container image is pulled
+  community.docker.docker_image:
+    name: "{{ matrix_mautrix_meta_messenger_container_image }}"
+    source: "{{ 'pull' if ansible_version.major > 2 or ansible_version.minor > 7 else omit }}"
+    force_source: "{{ matrix_mautrix_meta_messenger_container_image_force_pull if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}"
+    force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else matrix_mautrix_meta_messenger_container_image_force_pull }}"
+  when: not matrix_mautrix_meta_messenger_container_image_self_build
+  register: result
+  retries: "{{ devture_playbook_help_container_retries_count }}"
+  delay: "{{ devture_playbook_help_container_retries_delay }}"
+  until: result is not failed
+
+- name: Ensure mautrix-meta-messenger paths exist
+  ansible.builtin.file:
+    path: "{{ item.path }}"
+    state: directory
+    mode: 0750
+    owner: "{{ matrix_user_username }}"
+    group: "{{ matrix_user_groupname }}"
+  with_items:
+    - {path: "{{ matrix_mautrix_meta_messenger_base_path }}", when: true}
+    - {path: "{{ matrix_mautrix_meta_messenger_config_path }}", when: true}
+    - {path: "{{ matrix_mautrix_meta_messenger_data_path }}", when: true}
+    - {path: "{{ matrix_mautrix_meta_messenger_container_src_files_path }}", when: "{{ matrix_mautrix_meta_messenger_container_image_self_build }}"}
+  when: item.when | bool
+
+- when: matrix_mautrix_meta_messenger_container_image_self_build | bool
+  block:
+    - name: Ensure mautrix-meta-messenger repository is present on self-build
+      ansible.builtin.git:
+        repo: "{{ matrix_mautrix_meta_messenger_container_image_self_build_repo }}"
+        dest: "{{ matrix_mautrix_meta_messenger_container_src_files_path }}"
+        version: "{{ matrix_mautrix_meta_messenger_container_image.split(':')[1] }}"
+        force: "yes"
+      become: true
+      become_user: "{{ matrix_user_username }}"
+      register: matrix_mautrix_meta_messenger_git_pull_results
+
+    - name: Ensure mautrix-meta-messenger container image is built
+      community.docker.docker_image:
+        name: "{{ matrix_mautrix_meta_messenger_container_image }}"
+        source: build
+        force_source: "{{ matrix_mautrix_meta_messenger_git_pull_results.changed if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}"
+        force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else matrix_mautrix_meta_messenger_git_pull_results.changed }}"
+        build:
+          dockerfile: Dockerfile
+          path: "{{ matrix_mautrix_meta_messenger_container_src_files_path }}"
+          pull: true
+
+- name: Ensure mautrix-meta-messenger config.yaml installed
+  ansible.builtin.copy:
+    content: "{{ matrix_mautrix_meta_messenger_configuration | to_nice_yaml(indent=2, width=999999) }}"
+    dest: "{{ matrix_mautrix_meta_messenger_config_path }}/config.yaml"
+    mode: 0644
+    owner: "{{ matrix_user_username }}"
+    group: "{{ matrix_user_groupname }}"
+
+- name: Ensure mautrix-meta-messenger registration.yaml installed
+  ansible.builtin.copy:
+    content: "{{ matrix_mautrix_meta_messenger_registration | to_nice_yaml(indent=2, width=999999) }}"
+    dest: "{{ matrix_mautrix_meta_messenger_config_path }}/registration.yaml"
+    mode: 0644
+    owner: "{{ matrix_user_username }}"
+    group: "{{ matrix_user_groupname }}"
+
+- name: Ensure mautrix-meta-messenger support files installed
+  ansible.builtin.template:
+    src: "{{ role_path }}/templates/{{ item }}.j2"
+    dest: "{{ matrix_mautrix_meta_messenger_base_path }}/{{ item }}"
+    mode: 0640
+    owner: "{{ matrix_user_username }}"
+    group: "{{ matrix_user_groupname }}"
+  with_items:
+    - labels
+
+- name: Ensure mautrix-meta-messenger container network is created
+  community.general.docker_network:
+    name: "{{ matrix_mautrix_meta_messenger_container_network }}"
+    driver: bridge
+
+- name: Ensure mautrix-meta-messenger.service installed
+  ansible.builtin.template:
+    src: "{{ role_path }}/templates/systemd/matrix-mautrix-meta.service.j2"
+    dest: "{{ devture_systemd_docker_base_systemd_path }}/{{ matrix_mautrix_meta_messenger_identifier }}.service"
+    mode: 0644
+
+- name: Ensure mautrix-meta-messenger.service restarted, if necessary
+  ansible.builtin.service:
+    name: "{{ matrix_mautrix_meta_messenger_identifier }}.service"
+    state: restarted
+    daemon_reload: true
+  when: "matrix_mautrix_meta_messenger_requires_restart | bool"
--- a/roles/custom/matrix-bridge-mautrix-meta-messenger/tasks/main.yml
+++ b/roles/custom/matrix-bridge-mautrix-meta-messenger/tasks/main.yml
@ -0,0 +1,20 @@
+---
+
+- tags:
+    - setup-all
+    - setup-mautrix-meta-messenger
+    - install-all
+    - install-mautrix-meta-messenger
+  block:
+    - when: matrix_mautrix_meta_messenger_enabled | bool
+      ansible.builtin.include_tasks: "{{ role_path }}/tasks/validate_config.yml"
+
+    - when: matrix_mautrix_meta_messenger_enabled | bool
+      ansible.builtin.include_tasks: "{{ role_path }}/tasks/install.yml"
+
+- tags:
+    - setup-all
+    - setup-mautrix-meta-messenger
+  block:
+    - when: not matrix_mautrix_meta_messenger_enabled | bool
+      ansible.builtin.include_tasks: "{{ role_path }}/tasks/uninstall.yml"
--- a/roles/custom/matrix-bridge-mautrix-meta-messenger/tasks/uninstall.yml
+++ b/roles/custom/matrix-bridge-mautrix-meta-messenger/tasks/uninstall.yml
@ -0,0 +1,20 @@
+---
+
+- name: Check existence of mautrix-meta-messenger service
+  ansible.builtin.stat:
+    path: "{{ devture_systemd_docker_base_systemd_path }}/{{ matrix_mautrix_meta_messenger_identifier }}.service"
+  register: matrix_mautrix_meta_messenger_service_stat
+
+- when: matrix_mautrix_meta_messenger_service_stat.stat.exists | bool
+  block:
+    - name: Ensure mautrix-meta-messenger is stopped
+      ansible.builtin.service:
+        name: "{{ matrix_mautrix_meta_messenger_identifier }}"
+        state: stopped
+        enabled: false
+        daemon_reload: true
+
+    - name: Ensure mautrix-meta-messenger.service doesn't exist
+      ansible.builtin.file:
+        path: "{{ devture_systemd_docker_base_systemd_path }}/{{ matrix_mautrix_meta_messenger_identifier }}.service"
+        state: absent
--- a/roles/custom/matrix-bridge-mautrix-meta-messenger/tasks/validate_config.yml
+++ b/roles/custom/matrix-bridge-mautrix-meta-messenger/tasks/validate_config.yml
@ -0,0 +1,16 @@
+---
+
+- name: Fail if required mautrix-meta-messenger settings not defined
+  ansible.builtin.fail:
+    msg: >-
+      You need to define a required configuration setting (`{{ item.name }}`).
+  when: "item.when | bool and vars[item.name] == ''"
+  with_items:
+    - {'name': 'matrix_mautrix_meta_messenger_metrics_proxying_hostname', when: "{{ matrix_mautrix_meta_messenger_metrics_proxying_enabled }}"}
+    - {'name': 'matrix_mautrix_meta_messenger_metrics_proxying_path_prefix', when: "{{ matrix_mautrix_meta_messenger_metrics_proxying_enabled }}"}
+    - {'name': 'matrix_mautrix_meta_messenger_appservice_token', when: true}
+    - {'name': 'matrix_mautrix_meta_messenger_homeserver_token', when: true}
+    - {'name': 'matrix_mautrix_meta_messenger_container_network', when: true}
+    - {'name': 'matrix_mautrix_meta_messenger_homeserver_address', when: true}
+    - {'name': 'matrix_mautrix_meta_messenger_database_hostname', when: "{{ matrix_mautrix_meta_messenger_database_engine == 'postgres' }}"}
+    - {'name': 'matrix_mautrix_meta_messenger_database_password', when: "{{ matrix_mautrix_meta_messenger_database_engine == 'postgres' }}"}
--- a/roles/custom/matrix-bridge-mautrix-meta-messenger/templates/config.yaml.j2
+++ b/roles/custom/matrix-bridge-mautrix-meta-messenger/templates/config.yaml.j2
@ -0,0 +1,329 @@
+#jinja2: lstrip_blocks: "True"
+# Homeserver details.
+homeserver:
+    # The address that this appservice can use to connect to the homeserver.
+    address: {{ matrix_mautrix_meta_messenger_homeserver_address | to_json }}
+    # The domain of the homeserver (also known as server_name, used for MXIDs, etc).
+    domain: {{ matrix_mautrix_meta_messenger_homeserver_domain | to_json }}
+
+    # What software is the homeserver running?
+    # Standard Matrix homeservers like Synapse, Dendrite and Conduit should just use "standard" here.
+    software: standard
+    # The URL to push real-time bridge status to.
+    # If set, the bridge will make POST requests to this URL whenever a user's meta connection state changes.
+    # The bridge will use the appservice as_token to authorize requests.
+    status_endpoint: null
+    # Endpoint for reporting per-message status.
+    message_send_checkpoint_endpoint: null
+    # Does the homeserver support https://github.com/matrix-org/matrix-spec-proposals/pull/2246?
+    async_media: false
+
+    # Should the bridge use a websocket for connecting to the homeserver?
+    # The server side is currently not documented anywhere and is only implemented by mautrix-wsproxy,
+    # mautrix-asmux (deprecated), and hungryserv (proprietary).
+    websocket: false
+    # How often should the websocket be pinged? Pinging will be disabled if this is zero.
+    ping_interval_seconds: 0
+
+# Application service host/registration related details.
+# Changing these values requires regeneration of the registration.
+appservice:
+    # The address that the homeserver can use to connect to this appservice.
+    address: {{ matrix_mautrix_meta_messenger_appservice_address | to_json }}
+
+    # The hostname and port where this appservice should listen.
+    hostname: 0.0.0.0
+    port: 29319
+
+    # Database config.
+    database:
+        # The database type. "sqlite3-fk-wal" and "postgres" are supported.
+        type: {{ matrix_mautrix_meta_messenger_appservice_database_type | to_json }}
+        # The database URI.
+        #   SQLite: A raw file path is supported, but `file:<path>?_txlock=immediate` is recommended.
+        #           https://github.com/mattn/go-sqlite3#connection-string
+        #   Postgres: Connection string. For example, postgres://user:password@host/database?sslmode=disable
+        #             To connect via Unix socket, use something like postgres:///dbname?host=/var/run/postgresql
+        uri: {{ matrix_mautrix_meta_messenger_appservice_database_uri | to_json }}
+        # Maximum number of connections. Mostly relevant for Postgres.
+        max_open_conns: 20
+        max_idle_conns: 2
+        # Maximum connection idle time and lifetime before they're closed. Disabled if null.
+        # Parsed with https://pkg.go.dev/time#ParseDuration
+        max_conn_idle_time: null
+        max_conn_lifetime: null
+
+    # The unique ID of this appservice.
+    id: {{ matrix_mautrix_meta_messenger_appservice_id | to_json }}
+    # Appservice bot details.
+    bot:
+        # Username of the appservice bot.
+        username: {{ matrix_mautrix_meta_messenger_appservice_username | to_json }}
+        # Display name and avatar for bot. Set to "remove" to remove display name/avatar, leave empty
+        # to leave display name/avatar as-is.
+        displayname: {{ matrix_mautrix_meta_messenger_appservice_displayname | to_json }}
+        # You can use mxc://maunium.net/JxjlbZUlCPULEeHZSwleUXQv for an Instagram avatar,
+        # or mxc://maunium.net/ygtkteZsXnGJLJHRchUwYWak for Facebook Messenger
+        avatar: {{ matrix_mautrix_meta_messenger_appservice_avatar | to_json }}
+
+    # Whether or not to receive ephemeral events via appservice transactions.
+    # Requires MSC2409 support (i.e. Synapse 1.22+).
+    ephemeral_events: true
+    # Should incoming events be handled asynchronously?
+    # This may be necessary for large public instances with lots of messages going through.
+    # However, messages will not be guaranteed to be bridged in the same order they were sent in.
+    async_transactions: false
+
+    # Authentication tokens for AS <-> HS communication. Autogenerated; do not modify.
+    as_token: {{ matrix_mautrix_meta_messenger_appservice_token | to_json }}
+    hs_token: {{ matrix_mautrix_meta_messenger_homeserver_token | to_json }}
+
+# Prometheus config.
+metrics:
+    # Enable prometheus metrics?
+    enabled: {{ matrix_mautrix_meta_messenger_metrics_enabled | to_json }}
+    # IP and port where the metrics listener should be. The path is always /metrics
+    listen: "0.0.0.0.0:8000"
+
+meta:
+    # Which service is this bridge for? Available options:
+    # * facebook - connect to FB Messenger via facebook.com
+    # * facebook-tor - connect to FB Messenger via facebookwkhpilnemxj7asaniu7vnjjbiltxjqhye3mhbshg7kx5tfyd.onion
+    #                  (note: does not currently proxy media downloads)
+    # * messenger - connect to FB Messenger via messenger.com (can be used with the facebook side deactivated)
+    # * instagram - connect to Instagram DMs via instagram.com
+    #
+    # Remember to change the appservice id, bot profile info, bridge username_template and management_room_text too.
+    mode: {{ matrix_mautrix_meta_messenger_meta_mode | to_json }}
+    # When in Instagram mode, should the bridge connect to WhatsApp servers for encrypted chats?
+    # In FB/Messenger mode encryption is always enabled, this option only affects Instagram mode.
+    ig_e2ee: {{ matrix_mautrix_meta_messenger_meta_ig_e2ee | to_json }}
+    # Static proxy address (HTTP or SOCKS5) for connecting to Meta.
+    proxy:
+    # HTTP endpoint to request new proxy address from, for dynamically assigned proxies.
+    # The endpoint must return a JSON body with a string field called proxy_url.
+    get_proxy_from:
+
+# Bridge config
+bridge:
+    # Localpart template of MXIDs for FB/IG users.
+    # {% raw %}{{.}}{% endraw %} is replaced with the internal ID of the FB/IG user.
+    username_template: {{ matrix_mautrix_meta_messenger_bridge_username_template | to_json }}
+    # Displayname template for FB/IG users. This is also used as the room name in DMs if private_chat_portal_meta is enabled.
+    # {% raw %}{{.DisplayName}}{% endraw %} - The display name set by the user.
+    # {% raw %}{{.Username}}{% endraw %} - The username set by the user.
+    # {% raw %}{{.ID}}{% endraw %} - The internal user ID of the user.
+    displayname_template: {{ matrix_mautrix_meta_messenger_bridge_displayname_template | to_json }}
+    # Whether to explicitly set the avatar and room name for private chat portal rooms.
+    # If set to `default`, this will be enabled in encrypted rooms and disabled in unencrypted rooms.
+    # If set to `always`, all DM rooms will have explicit names and avatars set.
+    # If set to `never`, DM rooms will never have names and avatars set.
+    private_chat_portal_meta: default
+
+    portal_message_buffer: 128
+
+    # Should the bridge create a space for each logged-in user and add bridged rooms to it?
+    # Users who logged in before turning this on should run `!meta sync-space` to create and fill the space for the first time.
+    personal_filtering_spaces: false
+    # Should Matrix m.notice-type messages be bridged?
+    bridge_notices: true
+    # Should the bridge send a read receipt from the bridge bot when a message has been sent to FB/IG?
+    delivery_receipts: false
+    # Whether the bridge should send the message status as a custom com.beeper.message_send_status event.
+    message_status_events: false
+    # Whether the bridge should send error notices via m.notice events when a message fails to bridge.
+    message_error_notices: true
+    # Should the bridge never send alerts to the bridge management room?
+    # These are mostly things like the user being logged out.
+    disable_bridge_alerts: false
+    # Should the bridge update the m.direct account data event when double puppeting is enabled.
+    # Note that updating the m.direct event is not atomic and is therefore prone to race conditions.
+    sync_direct_chat_list: false
+    # Set this to true to tell the bridge to re-send m.bridge events to all rooms on the next run.
+    # This field will automatically be changed back to false after it, except if the config file is not writable.
+    resend_bridge_info: false
+    # Send captions in the same message as images. This will send data compatible with both MSC2530.
+    # This is currently not supported in most clients.
+    caption_in_message: false
+    # Whether or not created rooms should have federation enabled.
+    # If false, created portal rooms will never be federated.
+    federate_rooms: {{ matrix_mautrix_meta_messenger_bridge_federate_rooms | to_json }}
+    # Should mute status be bridged? Allowed options: always, on-create, never
+    mute_bridging: on-create
+    # Servers to always allow double puppeting from
+    double_puppet_server_map: {}
+    # Allow using double puppeting from any server with a valid client .well-known file.
+    double_puppet_allow_discovery: false
+    # Shared secrets for https://github.com/devture/matrix-synapse-shared-secret-auth
+    #
+    # If set, double puppeting will be enabled automatically for local users
+    # instead of users having to find an access token and run `login-matrix`
+    # manually.
+    login_shared_secret_map: {{ matrix_mautrix_meta_messenger_bridge_login_shared_secret_map | to_json }}
+
+    # The prefix for commands. Only required in non-management rooms.
+    # If set to "default", will be determined based on meta -> mode, "!ig" for instagram and "!fb" for facebook
+    command_prefix: {{ matrix_mautrix_meta_messenger_bridge_command_prefix | to_json }}
+
+    backfill:
+        # If disabled, old messages will never be bridged.
+        enabled: true
+        # By default, Meta sends info about approximately 20 recent threads. If this is set to something else than 0,
+        # the bridge will request more threads on first login, until it reaches the specified number of pages
+        # or the end of the inbox.
+        inbox_fetch_pages: 0
+        # By default, Meta only sends one old message per thread. If this is set to a something else than 0,
+        # the bridge will delay handling the one automatically received message and request more messages to backfill.
+        # One page usually contains 20 messages. This can technically be set to -1 to fetch all messages,
+        # but that will block bridging messages until the entire backfill is completed.
+        history_fetch_pages: 0
+        # Same as above, but for catchup backfills (i.e. when the bridge is restarted).
+        catchup_fetch_pages: 5
+        # Maximum age of chats to leave as unread when backfilling. 0 means all chats can be left as unread.
+        # If non-zero, chats that are older than this will be marked as read, even if they're still unread on Meta.
+        unread_hours_threshold: 0
+        # Backfill queue settings. Only relevant for Beeper, because standard Matrix servers
+        # don't support inserting messages into room history.
+        queue:
+            # How many pages of messages to request in one go (without sleeping between requests)?
+            pages_at_once: 5
+            # Maximum number of pages to fetch. -1 to fetch all pages until the start of the chat.
+            max_pages: -1
+            # How long to sleep after fetching a bunch of pages ("bunch" defined by pages_at_once).
+            sleep_between_tasks: 20s
+            # Disable fetching XMA media (reels, stories, etc) when backfilling.
+            dont_fetch_xma: true
+
+    # Messages sent upon joining a management room.
+    # Markdown is supported. The defaults are listed below.
+    management_room_text:
+        # Sent when joining a room.
+        welcome: {{ matrix_mautrix_meta_messenger_bridge_management_room_text_welcome | to_json }}
+        # Sent when joining a management room and the user is already logged in.
+        welcome_connected: "Use `help` for help."
+        # Sent when joining a management room and the user is not logged in.
+        welcome_unconnected: "Use `help` for help or `login` to log in."
+        # Optional extra text sent when joining a management room.
+        additional_help: ""
+
+    # End-to-bridge encryption support options.
+    #
+    # See https://docs.mau.fi/bridges/general/end-to-bridge-encryption.html for more info.
+    encryption:
+        # Allow encryption, work in group chat rooms with e2ee enabled
+        allow: {{ matrix_mautrix_meta_messenger_bridge_encryption_allow | to_json }}
+        # Default to encryption, force-enable encryption in all portals the bridge creates
+        # This will cause the bridge bot to be in private chats for the encryption to work properly.
+        default: {{ matrix_mautrix_meta_messenger_bridge_encryption_default | to_json }}
+        # Whether to use MSC2409/MSC3202 instead of /sync long polling for receiving encryption-related data.
+        appservice: {{ matrix_mautrix_meta_messenger_bridge_encryption_appservice | to_json }}
+        # Require encryption, drop any unencrypted messages.
+        require: {{ matrix_mautrix_meta_messenger_bridge_encryption_require | to_json }}
+        # Enable key sharing? If enabled, key requests for rooms where users are in will be fulfilled.
+        # You must use a client that supports requesting keys from other users to use this feature.
+        allow_key_sharing: {{ matrix_mautrix_meta_messenger_bridge_encryption_allow_key_sharing | to_json }}
+        # Options for deleting megolm sessions from the bridge.
+        delete_keys:
+            # Beeper-specific: delete outbound sessions when hungryserv confirms
+            # that the user has uploaded the key to key backup.
+            delete_outbound_on_ack: false
+            # Don't store outbound sessions in the inbound table.
+            dont_store_outbound: false
+            # Ratchet megolm sessions forward after decrypting messages.
+            ratchet_on_decrypt: false
+            # Delete fully used keys (index >= max_messages) after decrypting messages.
+            delete_fully_used_on_decrypt: false
+            # Delete previous megolm sessions from same device when receiving a new one.
+            delete_prev_on_new_session: false
+            # Delete megolm sessions received from a device when the device is deleted.
+            delete_on_device_delete: false
+            # Periodically delete megolm sessions when 2x max_age has passed since receiving the session.
+            periodically_delete_expired: false
+            # Delete inbound megolm sessions that don't have the received_at field used for
+            # automatic ratcheting and expired session deletion. This is meant as a migration
+            # to delete old keys prior to the bridge update.
+            delete_outdated_inbound: false
+        # What level of device verification should be required from users?
+        #
+        # Valid levels:
+        #   unverified - Send keys to all device in the room.
+        #   cross-signed-untrusted - Require valid cross-signing, but trust all cross-signing keys.
+        #   cross-signed-tofu - Require valid cross-signing, trust cross-signing keys on first use (and reject changes).
+        #   cross-signed-verified - Require valid cross-signing, plus a valid user signature from the bridge bot.
+        #                           Note that creating user signatures from the bridge bot is not currently possible.
+        #   verified - Require manual per-device verification
+        #              (currently only possible by modifying the `trust` column in the `crypto_device` database table).
+        verification_levels:
+            # Minimum level for which the bridge should send keys to when bridging messages from FB/IG to Matrix.
+            receive: unverified
+            # Minimum level that the bridge should accept for incoming Matrix messages.
+            send: unverified
+            # Minimum level that the bridge should require for accepting key requests.
+            share: cross-signed-tofu
+        # Options for Megolm room key rotation. These options allow you to
+        # configure the m.room.encryption event content. See:
+        # https://spec.matrix.org/v1.3/client-server-api/#mroomencryption for
+        # more information about that event.
+        rotation:
+            # Enable custom Megolm room key rotation settings. Note that these
+            # settings will only apply to rooms created after this option is
+            # set.
+            enable_custom: false
+            # The maximum number of milliseconds a session should be used
+            # before changing it. The Matrix spec recommends 604800000 (a week)
+            # as the default.
+            milliseconds: 604800000
+            # The maximum number of messages that should be sent with a given a
+            # session before changing it. The Matrix spec recommends 100 as the
+            # default.
+            messages: 100
+
+            # Disable rotating keys when a user's devices change?
+            # You should not enable this option unless you understand all the implications.
+            disable_device_change_key_rotation: false
+
+    # Settings for provisioning API
+    provisioning:
+        # Prefix for the provisioning API paths.
+        prefix: /_matrix/provision
+        # Shared secret for authentication. If set to "generate", a random secret will be generated,
+        # or if set to "disable", the provisioning API will be disabled.
+        shared_secret: disable
+        # Enable debug API at /debug with provisioning authentication.
+        debug_endpoints: false
+
+    # Permissions for using the bridge.
+    # Permitted values:
+    #    relay - Talk through the relaybot (if enabled), no access otherwise
+    #     user - Access to use the bridge to chat with a Meta account.
+    #    admin - User level and some additional administration tools
+    # Permitted keys:
+    #        * - All Matrix users
+    #   domain - All users on that homeserver
+    #     mxid - Specific user
+    permissions: {{ matrix_mautrix_meta_messenger_bridge_permissions | to_json }}
+
+    # Settings for relay mode
+    relay:
+        # Whether relay mode should be allowed. If allowed, `!wa set-relay` can be used to turn any
+        # authenticated user into a relaybot for that chat.
+        enabled: {{ matrix_mautrix_meta_messenger_bridge_relay_enabled | to_json }}
+        # Should only admins be allowed to set themselves as relay users?
+        admin_only: {{ matrix_mautrix_meta_messenger_bridge_relay_admin_only | to_json }}
+        # The formats to use when sending messages to Meta via the relaybot.
+        message_formats:
+            m.text: "{% raw %}{{ .Sender.Displayname }}: {{ .Message }}{% endraw %}"
+            m.notice: "{% raw %}{{ .Sender.Displayname }}: {{ .Message }}{% endraw %}"
+            m.emote: "{% raw %}* {{ .Sender.Displayname }} {{ .Message }}{% endraw %}"
+            m.file: "{% raw %}{{ .Sender.Displayname }} sent a file{% endraw %}"
+            m.image: "{% raw %}{{ .Sender.Displayname }} sent an image{% endraw %}"
+            m.audio: "{% raw %}{{ .Sender.Displayname }} sent an audio file{% endraw %}"
+            m.video: "{% raw %}{{ .Sender.Displayname }} sent a video{% endraw %}"
+            m.location: "{% raw %}{{ .Sender.Displayname }} sent a location{% endraw %}"
+
+# Logging config. See https://github.com/tulir/zeroconfig for details.
+logging:
+    min_level: {{ matrix_mautrix_meta_messenger_logging_min_level | to_json }}
+    writers:
+    - type: stdout
+      format: pretty
--- a/roles/custom/matrix-bridge-mautrix-meta-messenger/templates/labels.j2
+++ b/roles/custom/matrix-bridge-mautrix-meta-messenger/templates/labels.j2
@ -0,0 +1,48 @@
+{% if matrix_mautrix_meta_messenger_container_labels_traefik_enabled %}
+traefik.enable=true
+
+{% if matrix_mautrix_meta_messenger_container_labels_traefik_docker_network %}
+traefik.docker.network={{ matrix_mautrix_meta_messenger_container_labels_traefik_docker_network }}
+{% endif %}
+
+traefik.http.services.{{ matrix_mautrix_meta_messenger_identifier }}-appservice.loadbalancer.server.port=29319
+traefik.http.services.{{ matrix_mautrix_meta_messenger_identifier }}-metrics.loadbalancer.server.port=8000
+
+
+{% if matrix_mautrix_meta_messenger_container_labels_metrics_enabled %}
+############################################################
+#                                                          #
+# Metrics                                                  #
+#                                                          #
+############################################################
+
+{% if matrix_mautrix_meta_messenger_container_labels_metrics_middleware_basic_auth_enabled %}
+traefik.http.middlewares.{{ matrix_mautrix_meta_messenger_identifier }}-metrics-basic-auth.basicauth.users={{ matrix_mautrix_meta_messenger_container_labels_metrics_middleware_basic_auth_users }}
+traefik.http.routers.{{ matrix_mautrix_meta_messenger_identifier }}-metrics.middlewares={{ matrix_mautrix_meta_messenger_identifier }}-metrics-basic-auth
+{% endif %}
+
+traefik.http.routers.{{ matrix_mautrix_meta_messenger_identifier }}-metrics.rule={{ matrix_mautrix_meta_messenger_container_labels_metrics_traefik_rule }}
+
+{% if matrix_mautrix_meta_messenger_container_labels_metrics_traefik_priority | int > 0 %}
+traefik.http.routers.{{ matrix_mautrix_meta_messenger_identifier }}-metrics.priority={{ matrix_mautrix_meta_messenger_container_labels_metrics_traefik_priority }}
+{% endif %}
+
+traefik.http.routers.{{ matrix_mautrix_meta_messenger_identifier }}-metrics.service={{ matrix_mautrix_meta_messenger_identifier }}-metrics
+traefik.http.routers.{{ matrix_mautrix_meta_messenger_identifier }}-metrics.entrypoints={{ matrix_mautrix_meta_messenger_container_labels_metrics_traefik_entrypoints }}
+
+traefik.http.routers.{{ matrix_mautrix_meta_messenger_identifier }}-metrics.tls={{ matrix_mautrix_meta_messenger_container_labels_metrics_traefik_tls | to_json }}
+{% if matrix_mautrix_meta_messenger_container_labels_metrics_traefik_tls %}
+traefik.http.routers.{{ matrix_mautrix_meta_messenger_identifier }}-metrics.tls.certResolver={{ matrix_mautrix_meta_messenger_container_labels_metrics_traefik_tls_certResolver }}
+{% endif %}
+
+############################################################
+#                                                          #
+# /Metrics                                                 #
+#                                                          #
+############################################################
+{% endif %}
+
+
+{% endif %}
+
+{{ matrix_mautrix_meta_messenger_container_labels_additional_labels }}
--- a/roles/custom/matrix-bridge-mautrix-meta-messenger/templates/systemd/matrix-mautrix-meta.service.j2
+++ b/roles/custom/matrix-bridge-mautrix-meta-messenger/templates/systemd/matrix-mautrix-meta.service.j2
@ -0,0 +1,51 @@
+#jinja2: lstrip_blocks: "True"
+[Unit]
+Description=mautrix-meta bridge ({{ matrix_mautrix_meta_messenger_identifier }})
+{% for service in matrix_mautrix_meta_messenger_systemd_required_services_list %}
+Requires={{ service }}
+After={{ service }}
+{% endfor %}
+{% for service in matrix_mautrix_meta_messenger_systemd_wanted_services_list %}
+Wants={{ service }}
+{% endfor %}
+DefaultDependencies=no
+
+[Service]
+Type=simple
+Environment="HOME={{ devture_systemd_docker_base_systemd_unit_home_path }}"
+ExecStartPre=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} stop --time={{ devture_systemd_docker_base_container_stop_grace_time_seconds }} {{ matrix_mautrix_meta_messenger_identifier }} 2>/dev/null || true'
+ExecStartPre=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} rm {{ matrix_mautrix_meta_messenger_identifier }} 2>/dev/null || true'
+
+ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} create \
+			--rm \
+			--name={{ matrix_mautrix_meta_messenger_identifier }} \
+			--log-driver=none \
+			--user={{ matrix_user_uid }}:{{ matrix_user_gid }} \
+			--cap-drop=ALL \
+			--network={{ matrix_mautrix_meta_messenger_container_network }} \
+			{% if matrix_mautrix_meta_messenger_container_http_host_bind_port %}
+			-p {{ matrix_mautrix_meta_messenger_container_http_host_bind_port }}:29319 \
+			{% endif %}
+			--mount type=bind,src={{ matrix_mautrix_meta_messenger_config_path }},dst=/config,ro \
+			--mount type=bind,src={{ matrix_mautrix_meta_messenger_data_path }},dst=/data \
+			--label-file={{ matrix_mautrix_meta_messenger_base_path }}/labels \
+			{% for arg in matrix_mautrix_meta_messenger_container_extra_arguments %}
+			{{ arg }} \
+			{% endfor %}
+			{{ matrix_mautrix_meta_messenger_container_image }} \
+			/usr/bin/mautrix-meta -c /config/config.yaml -r /config/registration.yaml --no-update
+
+{% for network in matrix_mautrix_meta_messenger_container_additional_networks %}
+ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} network connect {{ network }} {{ matrix_mautrix_meta_messenger_identifier }}
+{% endfor %}
+
+ExecStart={{ devture_systemd_docker_base_host_command_docker }} start --attach {{ matrix_mautrix_meta_messenger_identifier }}
+
+ExecStop=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} stop --time={{ devture_systemd_docker_base_container_stop_grace_time_seconds }} {{ matrix_mautrix_meta_messenger_identifier }} 2>/dev/null || true'
+ExecStop=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} rm {{ matrix_mautrix_meta_messenger_identifier }} 2>/dev/null || true'
+Restart=always
+RestartSec=30
+SyslogIdentifier={{ matrix_mautrix_meta_messenger_identifier }}
+
+[Install]
+WantedBy=multi-user.target
--- a/setup.yml
+++ b/setup.yml
@ -61,6 +61,8 @@
    - custom/matrix-bridge-mautrix-hangouts
    - custom/matrix-bridge-mautrix-googlechat
    - custom/matrix-bridge-mautrix-instagram
+    - custom/matrix-bridge-mautrix-meta-messenger
+    - custom/matrix-bridge-mautrix-meta-instagram
    - custom/matrix-bridge-mautrix-telegram
    - custom/matrix-bridge-mautrix-signal
    - custom/matrix-bridge-mautrix-gmessages