Move roles/matrix* to roles/custom/matrix*

This paves the way for installing other roles into `roles/galaxy` using `ansible-galaxy`,
similar to how it's done in:

- https://github.com/spantaleev/gitea-docker-ansible-deploy
- https://github.com/spantaleev/nextcloud-docker-ansible-deploy

In the near future, we'll be removing a lot of the shared role code from here
and using upstream roles for it. Some of the core `matrix-*` roles have
already been extracted out into other reusable roles:

- https://github.com/devture/com.devture.ansible.role.postgres
- https://github.com/devture/com.devture.ansible.role.systemd_docker_base
- https://github.com/devture/com.devture.ansible.role.timesync
- https://github.com/devture/com.devture.ansible.role.vars_preserver
- https://github.com/devture/com.devture.ansible.role.playbook_runtime_messages
- https://github.com/devture/com.devture.ansible.role.playbook_help

We just need to migrate to those.

roles/custom/matrix-ma1sd/defaults/main.yml

@@ -0,0 +1,163 @@
+---
+# ma1sd is a Federated Matrix Identity Server
+# Project source code URL: https://github.com/ma1uta/ma1sd
+
+matrix_ma1sd_enabled: true
+
+matrix_ma1sd_container_image_self_build: false
+matrix_ma1sd_container_image_self_build_repo: "https://github.com/ma1uta/ma1sd.git"
+matrix_ma1sd_container_image_self_build_branch: "{{ matrix_ma1sd_version }}"
+
+matrix_ma1sd_version: "2.5.0"
+
+matrix_ma1sd_docker_image: "{{ matrix_ma1sd_docker_image_name_prefix }}ma1uta/ma1sd:{{ matrix_ma1sd_version }}"
+matrix_ma1sd_docker_image_name_prefix: "{{ 'localhost/' if matrix_ma1sd_container_image_self_build else matrix_container_global_registry_prefix }}"
+matrix_ma1sd_docker_image_force_pull: "{{ matrix_ma1sd_docker_image.endswith(':latest') }}"
+
+matrix_ma1sd_base_path: "{{ matrix_base_data_path }}/ma1sd"
+# We need the docker src directory to be named ma1sd. See: https://github.com/spantaleev/matrix-docker-ansible-deploy/pull/588
+matrix_ma1sd_docker_src_files_path: "{{ matrix_ma1sd_base_path }}/docker-src/ma1sd"
+matrix_ma1sd_config_path: "{{ matrix_ma1sd_base_path }}/config"
+matrix_ma1sd_data_path: "{{ matrix_ma1sd_base_path }}/data"
+
+matrix_ma1sd_container_port: 8090
+# Controls whether the matrix-ma1sd container exposes its HTTP port (tcp/{{ matrix_ma1sd_container_port }} in the container).
+#
+# Takes an "<ip>:<port>" or "<port>" value (e.g. "127.0.0.1:8090"), or empty string to not expose.
+matrix_ma1sd_container_http_host_bind_port: ''
+
+# A list of extra arguments to pass to the container
+matrix_ma1sd_container_extra_arguments: []
+
+# List of systemd services that matrix-ma1sd.service depends on
+matrix_ma1sd_systemd_required_services_list: ['docker.service']
+
+# List of systemd services that matrix-ma1sd.service wants
+matrix_ma1sd_systemd_wanted_services_list: []
+
+# Your identity server is private by default.
+# To ensure maximum discovery, you can make your identity server
+# also forward lookups to the central matrix.org Identity server
+# (at the cost of potentially leaking all your contacts information).
+# Enabling this is discouraged. Learn more here: https://github.com/ma1uta/ma1sd/blob/master/docs/features/identity.md#lookups
+matrix_ma1sd_matrixorg_forwarding_enabled: false
+
+
+# Database-related configuration fields.
+#
+# To use SQLite, stick to these defaults.
+#
+# To use Postgres:
+# - change the engine (`matrix_ma1sd_database_engine: 'postgres'`)
+# - adjust your database credentials via the `matrix_ma1sd_database_*` variables
+matrix_ma1sd_database_engine: 'sqlite'
+
+matrix_ma1sd_sqlite_database_path_local: "{{ matrix_ma1sd_data_path }}/ma1sd.db"
+matrix_ma1sd_sqlite_database_path_in_container: "/var/ma1sd/ma1sd.db"
+
+matrix_ma1sd_database_username: 'matrix_ma1sd'
+matrix_ma1sd_database_password: 'some-password'
+matrix_ma1sd_database_hostname: 'matrix-postgres'
+matrix_ma1sd_database_port: 5432
+matrix_ma1sd_database_name: 'matrix_ma1sd'
+
+matrix_ma1sd_database_connection_string: 'postgresql://{{ matrix_ma1sd_database_username }}:{{ matrix_ma1sd_database_password }}@{{ matrix_ma1sd_database_hostname }}:{{ matrix_ma1sd_database_port }}/{{ matrix_ma1sd_database_name }}'
+
+
+# ma1sd has serveral supported identity stores.
+# One of them is storing identities directly in Synapse's database.
+# Learn more here: https://github.com/ma1uta/ma1sd/blob/master/docs/stores/synapse.md
+matrix_ma1sd_synapsesql_enabled: false
+matrix_ma1sd_synapsesql_type: ""
+matrix_ma1sd_synapsesql_connection: ""
+
+# Setting up email-sending settings is required for using ma1sd.
+matrix_ma1sd_threepid_medium_email_identity_from: "matrix@{{ matrix_domain }}"
+matrix_ma1sd_threepid_medium_email_connectors_smtp_host: ""
+matrix_ma1sd_threepid_medium_email_connectors_smtp_port: 587
+matrix_ma1sd_threepid_medium_email_connectors_smtp_tls: 1
+matrix_ma1sd_threepid_medium_email_connectors_smtp_login: ""
+matrix_ma1sd_threepid_medium_email_connectors_smtp_password: ""
+
+# DNS overwrites are useful for telling ma1sd how it can reach the homeserver directly.
+# Useful when reverse-proxying certain URLs (e.g. `/_matrix/client/r0/user_directory/search`) to ma1sd,
+# so that ma1sd can rewrite the original URL to one that would reach the homeserver.
+matrix_ma1sd_dns_overwrite_enabled: false
+matrix_ma1sd_dns_overwrite_homeserver_client_name: "{{ matrix_server_fqn_matrix }}"
+matrix_ma1sd_dns_overwrite_homeserver_client_value: ""
+
+# Override the default session templates
+# To use this, fill in the template variables with the full desired template as a multi-line YAML variable
+#
+# More info:
+# https://github.com/ma1uta/ma1sd/blob/master/docs/threepids/session/session-views.md
+matrix_ma1sd_view_session_custom_templates_enabled: false
+# Defaults to: https://github.com/ma1uta/ma1sd/blob/master/src/main/resources/templates/session/tokenSubmitSuccess.html
+matrix_ma1sd_view_session_custom_onTokenSubmit_success_template: ""  # noqa var-naming
+# Defaults to: https://github.com/ma1uta/ma1sd/blob/master/src/main/resources/templates/session/tokenSubmitFailure.html
+matrix_ma1sd_view_session_custom_onTokenSubmit_failure_template: ""  # noqa var-naming
+
+# Override the default email templates
+# To use this, fill in the template variables with the full desired template as a multi-line YAML variable
+#
+# More info:
+# https://github.com/ma1uta/ma1sd/blob/master/docs/threepids/notification/template-generator.md
+# https://github.com/ma1uta/ma1sd/tree/master/src/main/resources/threepids/email
+matrix_ma1sd_threepid_medium_email_custom_templates_enabled: false
+# Defaults to: https://github.com/ma1uta/ma1sd/blob/master/src/main/resources/threepids/email/invite-template.eml
+matrix_ma1sd_threepid_medium_email_custom_invite_template: ""
+# Defaults to: https://github.com/ma1uta/ma1sd/blob/master/src/main/resources/threepids/email/validate-template.eml
+matrix_ma1sd_threepid_medium_email_custom_session_validation_template: ""
+# Defaults to: https://github.com/ma1uta/ma1sd/blob/master/src/main/resources/threepids/email/unbind-notification.eml
+matrix_ma1sd_threepid_medium_email_custom_session_unbind_notification_template: ""
+# Defaults to: https://github.com/ma1uta/ma1sd/blob/master/src/main/resources/threepids/email/mxid-template.eml
+matrix_ma1sd_threepid_medium_email_custom_matrixid_template: ""
+
+# Controls whether the self-check feature should validate SSL certificates.
+matrix_ma1sd_self_check_validate_certificates: true
+
+# Controls ma1sd logging verbosity for troubleshooting.
+#
+# According to: https://github.com/ma1uta/ma1sd/blob/master/docs/troubleshooting.md#increase-verbosity
+matrix_ma1sd_verbose_logging: false
+
+# Setting up support for API prefixes
+matrix_ma1sd_v1_enabled: true
+matrix_ma1sd_v2_enabled: true
+
+# Fix for missing 3PIDS bug
+matrix_ma1sd_hashing_enabled: true
+
+# Default ma1sd configuration template which covers the generic use case.
+# You can customize it by controlling the various variables inside it.
+#
+# For a more advanced customization, you can extend the default (see `matrix_ma1sd_configuration_extension_yaml`)
+# or completely replace this variable with your own template.
+matrix_ma1sd_configuration_yaml: "{{ lookup('template', 'templates/ma1sd.yaml.j2') }}"
+
+matrix_ma1sd_configuration_extension_yaml: |
+  # Your custom YAML configuration for ma1sd goes here.
+  # This configuration extends the default starting configuration (`matrix_ma1sd_configuration_yaml`).
+  #
+  # You can override individual variables from the default configuration, or introduce new ones.
+  #
+  # If you need something more special, you can take full control by
+  # completely redefining `matrix_ma1sd_configuration_yaml`.
+  #
+  # Example configuration extension follows:
+  #
+  # ldap:
+  #   enabled: true
+  #   connection:
+  #     host: ldapHostnameOrIp
+  #     tls: false
+  #     port: 389
+  #     baseDNs: ['OU=Users,DC=example,DC=org']
+  #     bindDn: CN=My Ma1sd User,OU=Users,DC=example,DC=org
+  #     bindPassword: TheUserPassword
+
+matrix_ma1sd_configuration_extension: "{{ matrix_ma1sd_configuration_extension_yaml | from_yaml if matrix_ma1sd_configuration_extension_yaml | from_yaml is mapping else {} }}"
+
+# Holds the final ma1sd configuration (a combination of the default and its extension).
+# You most likely don't need to touch this variable. Instead, see `matrix_ma1sd_configuration_yaml`.
+matrix_ma1sd_configuration: "{{ matrix_ma1sd_configuration_yaml | from_yaml | combine(matrix_ma1sd_configuration_extension, recursive=True) }}"

roles/custom/matrix-ma1sd/tasks/init.yml

@@ -0,0 +1,11 @@
+---
+# See https://github.com/spantaleev/matrix-docker-ansible-deploy/issues/1070
+# and https://github.com/spantaleev/matrix-docker-ansible-deploy/commit/1ab507349c752042d26def3e95884f6df8886b74#commitcomment-51108407
+- name: Fail if trying to self-build on Ansible < 2.8
+  ansible.builtin.fail:
+    msg: "To self-build the ma1sd image, you should use Ansible 2.8 or higher. See docs/ansible.md"
+  when: "ansible_version.major == 2 and ansible_version.minor < 8 and matrix_ma1sd_container_image_self_build and matrix_ma1sd_enabled | bool"
+
+- ansible.builtin.set_fact:
+    matrix_systemd_services_list: "{{ matrix_systemd_services_list + ['matrix-ma1sd.service'] }}"
+  when: matrix_ma1sd_enabled | bool

roles/custom/matrix-ma1sd/tasks/main.yml

@@ -0,0 +1,30 @@
+---
+
+- ansible.builtin.import_tasks: "{{ role_path }}/tasks/init.yml"
+  tags:
+    - always
+
+- ansible.builtin.import_tasks: "{{ role_path }}/tasks/validate_config.yml"
+  when: "run_setup | bool and matrix_ma1sd_enabled | bool"
+  tags:
+    - setup-all
+    - setup-ma1sd
+
+- ansible.builtin.import_tasks: "{{ role_path }}/tasks/setup_install.yml"
+  when: "run_setup | bool and matrix_ma1sd_enabled | bool"
+  tags:
+    - setup-all
+    - setup-ma1sd
+
+- ansible.builtin.import_tasks: "{{ role_path }}/tasks/setup_uninstall.yml"
+  when: "run_setup | bool and not matrix_ma1sd_enabled | bool"
+  tags:
+    - setup-all
+    - setup-ma1sd
+
+- ansible.builtin.import_tasks: "{{ role_path }}/tasks/self_check_ma1sd.yml"
+  delegate_to: 127.0.0.1
+  become: false
+  when: "run_self_check | bool and matrix_ma1sd_enabled | bool"
+  tags:
+    - self-check

roles/custom/matrix-ma1sd/tasks/migrate_mxisd.yml

@@ -0,0 +1,80 @@
+---
+
+# This task is for migrating existing mxisd data when transitioning to the ma1sd fork.
+
+- name: Check for existent mxisd data
+  ansible.builtin.stat:
+    path: "{{ matrix_base_data_path }}/mxisd/data"
+  register: ma1sd_migrate_mxisd_data_dir_stat
+
+- name: Warn if mxisd data detected
+  ansible.builtin.debug:
+    msg: >
+      You seem to have an existing mxisd folder in `{{ matrix_base_data_path }}/mxisd`.
+      We are going to migrate it to ma1sd and rename the folder to mxisd.migrated.
+  when: "ma1sd_migrate_mxisd_data_dir_stat.stat.exists"
+
+- name: Check existence of old matrix-mxisd service
+  ansible.builtin.stat:
+    path: "{{ matrix_systemd_path }}/matrix-mxisd.service"
+  register: matrix_mxisd_service_stat
+
+- name: Ensure matrix-mxisd is stopped
+  ansible.builtin.service:
+    name: matrix-mxisd
+    state: stopped
+    enabled: false
+    daemon_reload: true
+  when: "matrix_mxisd_service_stat.stat.exists"
+
+- name: Check existence of matrix-ma1sd service
+  ansible.builtin.stat:
+    path: "{{ matrix_systemd_path }}/matrix-ma1sd.service"
+  register: matrix_ma1sd_service_stat
+  when: "ma1sd_migrate_mxisd_data_dir_stat.stat.exists"
+
+- name: Ensure matrix-ma1sd is stopped
+  ansible.builtin.service:
+    name: matrix-ma1sd
+    state: stopped
+    daemon_reload: true
+  when: "ma1sd_migrate_mxisd_data_dir_stat.stat.exists and matrix_ma1sd_service_stat.stat.exists"
+
+# We use shell commands for the migration, because the Ansible copy module cannot
+# recursively copy remote directories (like `/matrix/mxisd/data/sign.key`) in older versions of Ansible.
+- when: "ma1sd_migrate_mxisd_data_dir_stat.stat.exists"
+  block:
+    - name: Copy mxisd data files to ma1sd folder
+      ansible.builtin.command:
+        cmd: "cp -ar {{ matrix_base_data_path }}/mxisd/data {{ matrix_ma1sd_base_path }}"
+      register: matrix_ma1sd_migrate_mxisd_data_files_copying_result
+      changed_when: matrix_ma1sd_migrate_mxisd_data_files_copying_result.rc == 0
+
+    - name: Check existence of mxisd.db file
+      ansible.builtin.stat:
+        path: "{{ matrix_ma1sd_data_path }}/mxisd.db"
+      register: matrix_ma1sd_mxisd_db_stat
+
+    - name: Rename database (mxisd.db -> ma1sd.db)
+      ansible.builtin.command:
+        cmd: "mv {{ matrix_ma1sd_data_path }}/mxisd.db {{ matrix_ma1sd_data_path }}/ma1sd.db"
+      register: matrix_ma1sd_migrate_mxisd_move_db_result
+      changed_when: matrix_ma1sd_migrate_mxisd_move_db_result.rc == 0
+      when: "matrix_ma1sd_mxisd_db_stat.stat.exists"
+
+    - name: Rename mxisd folder
+      ansible.builtin.command:
+        cmd: "mv {{ matrix_base_data_path }}/mxisd {{ matrix_base_data_path }}/mxisd.migrated"
+      register: matrix_ma1sd_migrate_mxisd_move_directory_result
+      changed_when: matrix_ma1sd_migrate_mxisd_move_directory_result.rc == 0
+
+- name: Ensure outdated matrix-mxisd.service doesn't exist
+  ansible.builtin.file:
+    path: "{{ matrix_systemd_path }}/matrix-mxisd.service"
+    state: absent
+  when: "matrix_mxisd_service_stat.stat.exists"
+
+- name: Ensure systemd reloaded after removing outdated matrix-mxisd.service
+  ansible.builtin.service:
+    daemon_reload: true
+  when: "matrix_mxisd_service_stat.stat.exists"

roles/custom/matrix-ma1sd/tasks/self_check_ma1sd.yml

@@ -0,0 +1,22 @@
+---
+
+- ansible.builtin.set_fact:
+    ma1sd_url_endpoint_public: "https://{{ matrix_server_fqn_matrix }}/_matrix/identity/api/v1"
+
+- name: Check ma1sd Identity Service
+  ansible.builtin.uri:
+    url: "{{ ma1sd_url_endpoint_public }}"
+    follow_redirects: none
+    validate_certs: "{{ matrix_ma1sd_self_check_validate_certificates }}"
+  check_mode: false
+  register: result_ma1sd
+  ignore_errors: true
+
+- name: Fail if ma1sd Identity Service not working
+  ansible.builtin.fail:
+    msg: "Failed checking ma1sd is up at `{{ matrix_server_fqn_matrix }}` (checked endpoint: `{{ ma1sd_url_endpoint_public }}`). Is ma1sd running? Is port 443 open in your firewall? Full error: {{ result_ma1sd }}"
+  when: "result_ma1sd.failed or 'json' not in result_ma1sd"
+
+- name: Report working ma1sd Identity Service
+  ansible.builtin.debug:
+    msg: "ma1sd at `{{ matrix_server_fqn_matrix }}` is working (checked endpoint: `{{ ma1sd_url_endpoint_public }}`)"

roles/custom/matrix-ma1sd/tasks/setup_install.yml

@@ -0,0 +1,178 @@
+---
+
+- name: Ensure ma1sd paths exist
+  ansible.builtin.file:
+    path: "{{ item.path }}"
+    state: directory
+    mode: 0750
+    owner: "{{ matrix_user_username }}"
+    group: "{{ matrix_user_groupname }}"
+  with_items:
+    - {path: "{{ matrix_ma1sd_config_path }}", when: true}
+    - {path: "{{ matrix_ma1sd_data_path }}", when: true}
+    - {path: "{{ matrix_ma1sd_docker_src_files_path }}", when: "{{ matrix_ma1sd_container_image_self_build }}"}
+  when: "item.when | bool"
+
+- ansible.builtin.import_tasks: "{{ role_path }}/tasks/migrate_mxisd.yml"
+
+
+# These (SQLite -> Postgres) migration tasks are usually at the top,
+# but we'd like to run them after `migrate_mxisd.yml`, which requires the ma1sd paths to exist.
+- ansible.builtin.set_fact:
+    matrix_ma1sd_requires_restart: false
+
+- when: "matrix_ma1sd_database_engine == 'postgres'"
+  block:
+    - name: Check if an SQLite database already exists
+      ansible.builtin.stat:
+        path: "{{ matrix_ma1sd_sqlite_database_path_local }}"
+      register: matrix_ma1sd_sqlite_database_path_local_stat_result
+
+    - when: "matrix_ma1sd_sqlite_database_path_local_stat_result.stat.exists | bool"
+      block:
+        - ansible.builtin.set_fact:
+            matrix_postgres_db_migration_request:
+              src: "{{ matrix_ma1sd_sqlite_database_path_local }}"
+              dst: "{{ matrix_ma1sd_database_connection_string }}"
+              caller: "{{ role_path | basename }}"
+              engine_variable_name: 'matrix_ma1sd_database_engine'
+              engine_old: 'sqlite'
+              systemd_services_to_stop: ['matrix-ma1sd.service']
+              pgloader_options: ['--with "quote identifiers"']
+
+        - ansible.builtin.import_role:
+            name: custom/matrix-postgres
+            tasks_from: migrate_db_to_postgres
+
+        - ansible.builtin.set_fact:
+            matrix_ma1sd_requires_restart: true
+
+- name: Ensure ma1sd image is pulled
+  community.docker.docker_image:
+    name: "{{ matrix_ma1sd_docker_image }}"
+    source: "{{ 'pull' if ansible_version.major > 2 or ansible_version.minor > 7 else omit }}"
+    force_source: "{{ matrix_ma1sd_docker_image_force_pull if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}"
+    force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else matrix_ma1sd_docker_image_force_pull }}"
+  when: "not matrix_ma1sd_container_image_self_build | bool"
+  register: result
+  retries: "{{ matrix_container_retries_count }}"
+  delay: "{{ matrix_container_retries_delay }}"
+  until: result is not failed
+
+- when: "matrix_ma1sd_container_image_self_build | bool"
+  block:
+    - name: Ensure gradle is installed for self-building (Debian)
+      ansible.builtin.apt:
+        name:
+          - gradle
+        state: present
+        update_cache: true
+      when: (ansible_os_family == 'Debian')
+
+    - name: Ensure gradle is installed for self-building (RedHat)
+      ansible.builtin.fail:
+        msg: "Installing gradle on RedHat ({{ ansible_distribution }}) is currently not supported, so self-building ma1sd cannot happen at this time"
+      when: ansible_os_family == 'RedHat'
+
+    - name: Ensure gradle is installed for self-building (Archlinux)
+      community.general.pacman:
+        name:
+          - gradle
+        state: present
+        update_cache: true
+      when: ansible_distribution == 'Archlinux'
+
+    - name: Ensure ma1sd repository is present on self-build
+      ansible.builtin.git:
+        repo: "{{ matrix_ma1sd_container_image_self_build_repo }}"
+        dest: "{{ matrix_ma1sd_docker_src_files_path }}"
+        version: "{{ matrix_ma1sd_container_image_self_build_branch }}"
+        force: "yes"
+      become: true
+      become_user: "{{ matrix_user_username }}"
+      register: matrix_ma1sd_git_pull_results
+
+    - name: Ensure ma1sd Docker image is built
+      ansible.builtin.command:
+        cmd: ./gradlew dockerBuild
+        chdir: "{{ matrix_ma1sd_docker_src_files_path }}"
+      environment:
+        DOCKER_BUILDKIT: 1
+      when: matrix_ma1sd_git_pull_results.changed
+
+    - name: Ensure ma1sd Docker image is tagged correctly
+      community.docker.docker_image:
+        # The build script always tags the image with 2 tags:
+        # - based on the branch/version: e.g. `ma1uta/ma1sd:2.4.0` (when on `2.4.0`)
+        #   or `ma1uta/ma1sd:2.4.0-19-ga71d32b` (when on a given commit for a pre-release)
+        # - generic one: `ma1uta/ma1sd:latest-dev`
+        #
+        # It's hard to predict the first one, so we'll use the latter.
+        name: "ma1uta/ma1sd:latest-dev"
+        repository: "{{ matrix_ma1sd_docker_image }}"
+        force_tag: true
+        source: local
+
+- name: Ensure ma1sd config installed
+  ansible.builtin.copy:
+    content: "{{ matrix_ma1sd_configuration | to_nice_yaml(indent=2, width=999999) }}"
+    dest: "{{ matrix_ma1sd_config_path }}/ma1sd.yaml"
+    mode: 0644
+    owner: "{{ matrix_user_username }}"
+    group: "{{ matrix_user_groupname }}"
+
+- name: Ensure custom view templates are installed, if any
+  ansible.builtin.copy:
+    content: "{{ item.value }}"
+    dest: "{{ matrix_ma1sd_config_path }}/{{ item.location }}"
+    mode: 0644
+    owner: "{{ matrix_user_username }}"
+    group: "{{ matrix_user_groupname }}"
+  with_items:
+    - {value: "{{ matrix_ma1sd_view_session_custom_onTokenSubmit_success_template }}", location: 'tokenSubmitSuccess.html'}
+    - {value: "{{ matrix_ma1sd_view_session_custom_onTokenSubmit_failure_template }}", location: 'tokenSubmitFailure.html'}
+  when: "matrix_ma1sd_view_session_custom_templates_enabled | bool and item.value"
+
+- name: Ensure custom email templates are installed, if any
+  ansible.builtin.copy:
+    content: "{{ item.value }}"
+    dest: "{{ matrix_ma1sd_config_path }}/{{ item.location }}"
+    mode: 0644
+    owner: "{{ matrix_user_username }}"
+    group: "{{ matrix_user_groupname }}"
+  with_items:
+    - {value: "{{ matrix_ma1sd_threepid_medium_email_custom_invite_template }}", location: 'invite-template.eml'}
+    - {value: "{{ matrix_ma1sd_threepid_medium_email_custom_session_validation_template }}", location: 'validate-template.eml'}
+    - {value: "{{ matrix_ma1sd_threepid_medium_email_custom_session_unbind_notification_template }}", location: 'unbind-notification.eml'}
+    - {value: "{{ matrix_ma1sd_threepid_medium_email_custom_matrixid_template }}", location: 'mxid-template.eml'}
+  when: "matrix_ma1sd_threepid_medium_email_custom_templates_enabled | bool and item.value"
+
+# Only cleaning up for people who define the respective templates
+- name: (Cleanup) Ensure custom email templates are not in data/ anymore (we've put them in config/)
+  ansible.builtin.file:
+    path: "{{ matrix_ma1sd_data_path }}/{{ item.location }}"
+    state: absent
+  with_items:
+    - {value: "{{ matrix_ma1sd_threepid_medium_email_custom_invite_template }}", location: 'invite-template.eml'}
+    - {value: "{{ matrix_ma1sd_threepid_medium_email_custom_session_validation_template }}", location: 'validate-template.eml'}
+    - {value: "{{ matrix_ma1sd_threepid_medium_email_custom_session_unbind_notification_template }}", location: 'unbind-notification.eml'}
+    - {value: "{{ matrix_ma1sd_threepid_medium_email_custom_matrixid_template }}", location: 'mxid-template.eml'}
+  when: "matrix_ma1sd_threepid_medium_email_custom_templates_enabled | bool and item.value"
+
+- name: Ensure matrix-ma1sd.service installed
+  ansible.builtin.template:
+    src: "{{ role_path }}/templates/systemd/matrix-ma1sd.service.j2"
+    dest: "{{ matrix_systemd_path }}/matrix-ma1sd.service"
+    mode: 0644
+  register: matrix_ma1sd_systemd_service_result
+
+- name: Ensure systemd reloaded after matrix-ma1sd.service installation
+  ansible.builtin.service:
+    daemon_reload: true
+  when: "matrix_ma1sd_systemd_service_result.changed | bool"
+
+- name: Ensure matrix-ma1sd.service restarted, if necessary
+  ansible.builtin.service:
+    name: "matrix-ma1sd.service"
+    state: restarted
+  when: "matrix_ma1sd_requires_restart | bool"

roles/custom/matrix-ma1sd/tasks/setup_uninstall.yml

@@ -0,0 +1,36 @@
+---
+
+- name: Check existence of matrix-ma1sd service
+  ansible.builtin.stat:
+    path: "{{ matrix_systemd_path }}/matrix-ma1sd.service"
+  register: matrix_ma1sd_service_stat
+
+- name: Ensure matrix-ma1sd is stopped
+  ansible.builtin.service:
+    name: matrix-ma1sd
+    state: stopped
+    enabled: false
+    daemon_reload: true
+  register: stopping_result
+  when: "matrix_ma1sd_service_stat.stat.exists | bool"
+
+- name: Ensure matrix-ma1sd.service doesn't exist
+  ansible.builtin.file:
+    path: "{{ matrix_systemd_path }}/matrix-ma1sd.service"
+    state: absent
+  when: "matrix_ma1sd_service_stat.stat.exists | bool"
+
+- name: Ensure systemd reloaded after matrix-ma1sd.service removal
+  ansible.builtin.service:
+    daemon_reload: true
+  when: "matrix_ma1sd_service_stat.stat.exists | bool"
+
+- name: Ensure Matrix ma1sd paths don't exist
+  ansible.builtin.file:
+    path: "{{ matrix_ma1sd_base_path }}"
+    state: absent
+
+- name: Ensure ma1sd Docker image doesn't exist
+  community.docker.docker_image:
+    name: "{{ matrix_ma1sd_docker_image }}"
+    state: absent

roles/custom/matrix-ma1sd/tasks/validate_config.yml

@@ -0,0 +1,70 @@
+---
+
+- name: (Deprecation) Warn about ma1sd variables that are not used anymore
+  ansible.builtin.fail:
+    msg: >
+      The `{{ item }}` variable defined in your configuration is not used by this playbook anymore!
+      You'll need to adapt to the new way of extending ma1sd configuration.
+      See the CHANGELOG and the `matrix_ma1sd_configuration_extension_yaml` variable for more information and examples.
+  when: "item in vars"
+  with_items:
+    - 'matrix_ma1sd_ldap_enabled'
+    - 'matrix_ma1sd_ldap_connection_host'
+    - 'matrix_ma1sd_ldap_connection_tls'
+    - 'matrix_ma1sd_ldap_connection_port'
+    - 'matrix_ma1sd_ldap_connection_baseDn'
+    - 'matrix_ma1sd_ldap_connection_baseDns'
+    - 'matrix_ma1sd_ldap_connection_bindDn'
+    - 'matrix_ma1sd_ldap_connection_bindPassword'
+    - 'matrix_ma1sd_ldap_filter'
+    - 'matrix_ma1sd_ldap_attribute_uid_type'
+    - 'matrix_ma1sd_ldap_attribute_uid_value'
+    - 'matrix_ma1sd_ldap_connection_bindPassword'
+    - 'matrix_ma1sd_ldap_attribute_name'
+    - 'matrix_ma1sd_ldap_attribute_threepid_email'
+    - 'matrix_ma1sd_ldap_attribute_threepid_msisdn'
+    - 'matrix_ma1sd_ldap_identity_filter'
+    - 'matrix_ma1sd_ldap_identity_medium'
+    - 'matrix_ma1sd_ldap_auth_filter'
+    - 'matrix_ma1sd_ldap_directory_filter'
+    - 'matrix_ma1sd_template_config'
+    - 'matrix_ma1sd_architecture'
+
+- name: Ensure ma1sd configuration does not contain any dot-notation keys
+  ansible.builtin.fail:
+    msg: >
+      Since version 1.3.0, ma1sd will not accept property-style configuration keys.
+      You have defined a key (`{{ item.key }}`) which contains a dot.
+      Instead, use nesting. See: https://github.com/ma1uta/ma1sd/wiki/Upgrade-Notes#v130
+  when: "'.' in item.key"
+  with_dict: "{{ matrix_ma1sd_configuration }}"
+
+- name: Fail if required ma1sd settings not defined
+  ansible.builtin.fail:
+    msg: >
+      You need to define a required configuration setting (`{{ item }}`) for using ma1sd.
+  when: "vars[item] == ''"
+  with_items:
+    - "matrix_ma1sd_threepid_medium_email_connectors_smtp_host"
+    - "matrix_ma1sd_dns_overwrite_homeserver_client_value"
+
+- name: (Deprecation) Catch and report renamed ma1sd variables
+  ansible.builtin.fail:
+    msg: >-
+      Your configuration contains a variable, which now has a different name.
+      Please change your configuration to rename the variable (`{{ item.old }}` -> `{{ item.new }}`).
+  when: "vars | dict2items | selectattr('key', 'match', item.old) | list | items2dict"
+  with_items:
+    - {'old': 'matrix_ma1sd_container_expose_port', 'new': '<superseded by matrix_ma1sd_container_http_host_bind_port>'}
+    - {'old': 'matrix_ma1sd_threepid_medium_email_custom_unbind_fraudulent_template', 'new': 'matrix_ma1sd_threepid_medium_email_custom_session_unbind_notification_template'}
+    - {'old': 'matrix_ma1sd_default_port', 'new': 'matrix_ma1sd_container_port'}
+
+- name: (Deprecation) Catch and report mxisd variables
+  ansible.builtin.fail:
+    msg: >-
+      mxisd is deprecated and has been replaced with ma1sd (https://github.com/ma1uta/ma1sd), a compatible fork.
+      The playbook will migrate your existing mxisd configuration and data automatically, but you need to adjust variable names.
+      Please change your configuration (vars.yml) to rename all mxisd variables (`{{ item.old }}` -> `{{ item.new }}`).
+  when: "vars | dict2items | selectattr('key', 'match', item.old) | list | items2dict"
+  with_items:
+    - {'old': 'matrix_mxisd_.*', 'new': 'matrix_ma1sd_.*'}

roles/custom/matrix-ma1sd/templates/ma1sd.yaml.j2

@@ -0,0 +1,104 @@
+#jinja2: lstrip_blocks: True
+matrix:
+  domain: {{ matrix_domain }}
+  v1: {{ matrix_ma1sd_v1_enabled|to_json }}
+  v2: {{ matrix_ma1sd_v2_enabled|to_json }}
+
+server:
+  name: {{ matrix_server_fqn_matrix }}
+
+key:
+  path: /var/ma1sd/sign.key
+
+storage:
+  {% if matrix_ma1sd_database_engine == 'sqlite' %}
+    backend: sqlite
+    provider:
+      sqlite:
+        database: {{ matrix_ma1sd_sqlite_database_path_in_container|to_json }}
+  {% elif matrix_ma1sd_database_engine == 'postgres' %}
+    backend: postgresql
+    provider:
+      postgresql:
+        database: //{{ matrix_ma1sd_database_hostname }}:{{ matrix_ma1sd_database_port }}/{{ matrix_ma1sd_database_name }}
+        username: {{ matrix_ma1sd_database_username|to_json }}
+        password: {{ matrix_ma1sd_database_password|to_json }}
+  {% endif %}
+
+{% if matrix_ma1sd_dns_overwrite_enabled %}
+dns:
+  overwrite:
+    homeserver:
+      client:
+        - name: {{ matrix_ma1sd_dns_overwrite_homeserver_client_name }}
+          value: {{ matrix_ma1sd_dns_overwrite_homeserver_client_value }}
+{% endif %}
+
+{% if matrix_ma1sd_matrixorg_forwarding_enabled %}
+forward:
+  servers: ['matrix-org']
+{% endif %}
+
+threepid:
+  medium:
+    email:
+      identity:
+        from: {{ matrix_ma1sd_threepid_medium_email_identity_from }}
+      connectors:
+        smtp:
+          host: {{ matrix_ma1sd_threepid_medium_email_connectors_smtp_host }}
+          port: {{ matrix_ma1sd_threepid_medium_email_connectors_smtp_port }}
+          tls: {{ matrix_ma1sd_threepid_medium_email_connectors_smtp_tls }}
+          login: {{ matrix_ma1sd_threepid_medium_email_connectors_smtp_login }}
+          password: {{ matrix_ma1sd_threepid_medium_email_connectors_smtp_password }}
+{% if matrix_ma1sd_threepid_medium_email_custom_templates_enabled %}
+      generators:
+        template:
+          {% if matrix_ma1sd_threepid_medium_email_custom_invite_template %}
+          invite: '/etc/ma1sd/invite-template.eml'
+          {% endif %}
+          {% if matrix_ma1sd_threepid_medium_email_custom_session_validation_template or matrix_ma1sd_threepid_medium_email_custom_session_unbind_notification_template %}
+          session:
+            {% if matrix_ma1sd_threepid_medium_email_custom_session_validation_template %}
+            validation: '/etc/ma1sd/validate-template.eml'
+            {% endif %}
+            {% if matrix_ma1sd_threepid_medium_email_custom_session_unbind_notification_template %}
+            unbind:
+              notification: '/etc/ma1sd/unbind-notification.eml'
+            {% endif %}
+          {% endif %}
+          {% if matrix_ma1sd_threepid_medium_email_custom_matrixid_template %}
+          generic:
+            matrixId: '/etc/ma1sd/mxid-template.eml'
+          {% endif %}
+{% endif %}
+
+{% if matrix_ma1sd_view_session_custom_templates_enabled %}
+view:
+  session:
+    onTokenSubmit:
+      {% if matrix_ma1sd_view_session_custom_onTokenSubmit_success_template %}
+      success: '/etc/ma1sd/tokenSubmitSuccess.html'
+      {% endif %}
+      {% if matrix_ma1sd_view_session_custom_onTokenSubmit_failure_template %}
+      failure: '/etc/ma1sd/tokenSubmitFailure.html'
+      {% endif %}
+{% endif %}
+
+{% if matrix_ma1sd_hashing_enabled %}
+hashing:
+  enabled: true # enable or disable the hash lookup MSC2140 (default is false)
+  pepperLength: 20 # length of the pepper value (default is 20)
+  rotationPolicy: per_requests # or `per_seconds` how often the hashes will be updating
+  hashStorageType: sql # or `in_memory` where the hashes will be stored
+  algorithms:
+    - none   # the same as v1 bulk lookup
+    - sha256 # hash the 3PID and pepper.
+  delay: 2m # how often hashes will be updated if rotation policy = per_seconds (default is 10s)
+  requests: 10
+{% endif %}
+
+synapseSql:
+  enabled: {{ matrix_ma1sd_synapsesql_enabled|to_json }}
+  type: {{ matrix_ma1sd_synapsesql_type|to_json }}
+  connection: {{ matrix_ma1sd_synapsesql_connection|to_json }}

roles/custom/matrix-ma1sd/templates/systemd/matrix-ma1sd.service.j2

@@ -0,0 +1,48 @@
+#jinja2: lstrip_blocks: "True"
+[Unit]
+Description=Matrix ma1sd Identity server
+{% for service in matrix_ma1sd_systemd_required_services_list %}
+Requires={{ service }}
+After={{ service }}
+{% endfor %}
+{% for service in matrix_ma1sd_systemd_wanted_services_list %}
+Wants={{ service }}
+{% endfor %}
+DefaultDependencies=no
+
+[Service]
+Type=simple
+Environment="HOME={{ matrix_systemd_unit_home_path }}"
+ExecStartPre=-{{ matrix_host_command_sh }} -c '{{ matrix_host_command_docker }} kill matrix-ma1sd 2>/dev/null || true'
+ExecStartPre=-{{ matrix_host_command_sh }} -c '{{ matrix_host_command_docker }} rm matrix-ma1sd 2>/dev/null || true'
+
+# ma1sd writes an SQLite shared library (libsqlitejdbc.so) to /tmp and executes it from there,
+# so /tmp needs to be mounted with an exec option.
+ExecStart={{ matrix_host_command_docker }} run --rm --name matrix-ma1sd \
+			--log-driver=none \
+			--user={{ matrix_user_uid }}:{{ matrix_user_gid }} \
+			--cap-drop=ALL \
+			--read-only \
+			--tmpfs=/tmp:rw,exec,nosuid,size=10m \
+			--network={{ matrix_docker_network }} \
+			{% if matrix_ma1sd_container_http_host_bind_port %}
+			-p {{ matrix_ma1sd_container_http_host_bind_port }}:{{ matrix_ma1sd_container_port }} \
+			{% endif %}
+			{% if matrix_ma1sd_verbose_logging %}
+			-e MA1SD_LOG_LEVEL=debug \
+			{% endif %}
+			--mount type=bind,src={{ matrix_ma1sd_config_path }},dst=/etc/ma1sd,ro \
+			--mount type=bind,src={{ matrix_ma1sd_data_path }},dst=/var/ma1sd \
+			{% for arg in matrix_ma1sd_container_extra_arguments %}
+			{{ arg }} \
+			{% endfor %}
+			{{ matrix_ma1sd_docker_image }}
+
+ExecStop=-{{ matrix_host_command_sh }} -c '{{ matrix_host_command_docker }} kill matrix-ma1sd 2>/dev/null || true'
+ExecStop=-{{ matrix_host_command_sh }} -c '{{ matrix_host_command_docker }} rm matrix-ma1sd 2>/dev/null || true'
+Restart=always
+RestartSec=30
+SyslogIdentifier=matrix-ma1sd
+
+[Install]
+WantedBy=multi-user.target

roles/custom/matrix-ma1sd/vars/main.yml

@@ -0,0 +1,5 @@
+---
+
+# Doing `|from_yaml` when the extension contains nothing yields an empty string ("").
+# We need to ensure it's a dictionary or `|combine` (when building `matrix_ma1sd_configuration`) will fail later.
+matrix_ma1sd_configuration_extension: "{{ matrix_ma1sd_configuration_extension_yaml | from_yaml if matrix_ma1sd_configuration_extension_yaml | from_yaml else {} }}"