From 77b0ef479969bcaaa54c3204db7e7631c67a1227 Mon Sep 17 00:00:00 2001
From: Slavi Pantaleev <slavi@devture.com>
Date: Tue, 2 Jan 2024 17:10:26 +0200
Subject: [PATCH] Add Traefik support to Hookshot

---
 group_vars/matrix_servers                     |  30 ++---
 .../matrix-bridge-hookshot/defaults/main.yml  |  78 +++++++++++-
 .../tasks/inject_into_nginx_proxy.yml         | 111 ------------------
 .../matrix-bridge-hookshot/tasks/main.yml     |   9 --
 .../tasks/setup_install.yml                   |  10 ++
 .../templates/labels.j2                       | 100 ++++++++++++++++
 .../systemd/matrix-hookshot.service.j2        |   1 +
 .../defaults/main.yml                         |   2 +-
 8 files changed, 200 insertions(+), 141 deletions(-)
 delete mode 100644 roles/custom/matrix-bridge-hookshot/tasks/inject_into_nginx_proxy.yml
 create mode 100644 roles/custom/matrix-bridge-hookshot/templates/labels.j2

diff --git a/group_vars/matrix_servers b/group_vars/matrix_servers
index 678cfa0ee..1f0cf0f83 100755
--- a/group_vars/matrix_servers
+++ b/group_vars/matrix_servers
@@ -1440,7 +1440,9 @@ matrix_hookshot_container_additional_networks_auto: |
       ([] if matrix_bridges_homeserver_container_network == '' else [matrix_bridges_homeserver_container_network])
       +
       ([redis_container_network] if redis_enabled and matrix_hookshot_queue_host == redis_identifier else [])
-    )
+      +
+      ([matrix_playbook_reverse_proxyable_services_additional_network] if matrix_playbook_reverse_proxyable_services_additional_network and matrix_hookshot_container_labels_traefik_enabled else [])
+    ) | unique
   }}
 
 matrix_hookshot_container_http_host_bind_ports_defaultmapping:
@@ -1451,26 +1453,24 @@ matrix_hookshot_container_http_host_bind_ports_defaultmapping:
 
 matrix_hookshot_container_http_host_bind_ports: "{{ matrix_hookshot_container_http_host_bind_ports_defaultmapping if matrix_playbook_service_host_bind_interface_prefix else [] }}"
 
+matrix_hookshot_container_labels_traefik_enabled: "{{ matrix_playbook_reverse_proxy_type in ['playbook-managed-traefik', 'other-traefik-container'] }}"
+matrix_hookshot_container_labels_traefik_docker_network: "{{ matrix_playbook_reverse_proxyable_services_additional_network }}"
+matrix_hookshot_container_labels_traefik_entrypoints: "{{ devture_traefik_entrypoint_primary }}"
+matrix_hookshot_container_labels_traefik_tls_certResolver: "{{ devture_traefik_certResolver_primary }}"
+
 matrix_hookshot_provisioning_enabled: "{{ matrix_hookshot_provisioning_secret and matrix_dimension_enabled }}"
 
 # We only enable metrics (locally, in the container network) for the bridge if Prometheus is enabled.
-#
-# People using an external Prometheus server will need to toggle all of these to be able to consume metrics remotely:
-# - `matrix_hookshot_metrics_enabled`
-# - `matrix_hookshot_metrics_proxying_enabled`
-# - `matrix_nginx_proxy_proxy_matrix_metrics_enabled`
 matrix_hookshot_metrics_enabled: "{{ prometheus_enabled }}"
 
-# TODO - implement
-# matrix_hookshot_metrics_metrics_proxying_enabled: "{{ matrix_hookshot_metrics_enabled and matrix_metrics_exposure_enabled }}"
-# matrix_hookshot_metrics_metrics_proxying_hostname: "{{ matrix_metrics_exposure_hostname }}"
-# matrix_hookshot_metrics_metrics_proxying_path_prefix: "{{ matrix_metrics_exposure_path_prefix }}/hookshot"
-# matrix_hookshot_metrics_container_labels_metrics_middleware_basic_auth_enabled: "{{ matrix_metrics_exposure_http_basic_auth_enabled }}"
-# matrix_hookshot_metrics_container_labels_metrics_middleware_basic_auth_users: "{{ matrix_metrics_exposure_http_basic_auth_users }}"
+matrix_hookshot_metrics_proxying_enabled: "{{ matrix_hookshot_metrics_enabled and matrix_metrics_exposure_enabled }}"
+matrix_hookshot_metrics_proxying_hostname: "{{ matrix_metrics_exposure_hostname }}"
+matrix_hookshot_metrics_proxying_path_prefix: "{{ matrix_metrics_exposure_path_prefix }}/hookshot"
+matrix_hookshot_container_labels_metrics_middleware_basic_auth_enabled: "{{ matrix_metrics_exposure_http_basic_auth_enabled }}"
+matrix_hookshot_container_labels_metrics_middleware_basic_auth_users: "{{ matrix_metrics_exposure_http_basic_auth_users }}"
 
-matrix_hookshot_urlprefix_port_enabled: "{{ matrix_nginx_proxy_container_https_host_bind_port == 443 if matrix_nginx_proxy_https_enabled else matrix_nginx_proxy_container_https_host_bind_port == 80 }}"
-matrix_hookshot_urlprefix_port: ":{{ matrix_nginx_proxy_container_https_host_bind_port if matrix_nginx_proxy_https_enabled else matrix_nginx_proxy_container_http_host_bind_port }}"
-matrix_hookshot_urlprefix: "{{ 'https' if matrix_playbook_ssl_enabled else 'http' }}://{{ matrix_server_fqn_matrix }}{{ matrix_hookshot_urlprefix_port if matrix_hookshot_urlprefix_port_enabled else '' }}"
+matrix_hookshot_public_hostname: "{{ matrix_server_fqn_matrix }}"
+matrix_hookshot_urlprefix: "{{ 'https' if matrix_playbook_ssl_enabled else 'http' }}://{{ matrix_server_fqn_matrix }}"
 
 ######################################################################
 #
diff --git a/roles/custom/matrix-bridge-hookshot/defaults/main.yml b/roles/custom/matrix-bridge-hookshot/defaults/main.yml
index 378ca0a77..63a6d4c9c 100644
--- a/roles/custom/matrix-bridge-hookshot/defaults/main.yml
+++ b/roles/custom/matrix-bridge-hookshot/defaults/main.yml
@@ -30,10 +30,14 @@ matrix_hookshot_docker_src_files_path: "{{ matrix_hookshot_base_path }}/docker-s
 matrix_hookshot_homeserver_address: "{{ matrix_homeserver_container_url }}"
 matrix_hookshot_container_url: 'matrix-hookshot'
 
+matrix_hookshot_public_hostname: "{{ matrix_server_fqn_matrix }}"
 matrix_hookshot_public_endpoint: /hookshot
 
+matrix_hookshot_urlprefix: "https://{{ matrix_hookshot_public_hostname }}{{ matrix_hookshot_public_endpoint }}"
+
 # There is no need to edit ports. use matrix_hookshot_container_http_host_bind_ports below to expose ports instead.
 matrix_hookshot_appservice_port: 9993
+matrix_hookshot_appservice_hostname: "{{ matrix_hookshot_public_hostname }}"
 matrix_hookshot_appservice_endpoint: "{{ matrix_hookshot_public_endpoint }}/_matrix/app"
 
 # The variables below control the queue parameters and may optionally be pointed to a Redis instance.
@@ -52,10 +56,10 @@ matrix_hookshot_experimental_encryption_enabled: false
 # If metrics need to be consumed by another (external) Prometheus server, consider exposing them via `matrix_hookshot_metrics_proxying_enabled`.
 matrix_hookshot_metrics_enabled: false
 
-# Controls whether Hookshot metrics should be proxied (exposed) on `matrix.DOMAIN/metrics/hookshot`.
-# This will only work take effect if `matrix_nginx_proxy_proxy_matrix_metrics_enabled: true`.
-# See the `matrix-nginx-proxy` role for details about enabling `matrix_nginx_proxy_proxy_matrix_metrics_enabled`.
+# Controls whether Hookshot metrics should be proxied (exposed) on a public URL.
 matrix_hookshot_metrics_proxying_enabled: false
+matrix_hookshot_metrics_proxying_hostname: ''
+matrix_hookshot_metrics_proxying_path_prefix: ''
 
 # There is no need to edit ports.
 # Read the documentation to learn about using Hookshot metrics with external Prometheus
@@ -64,6 +68,7 @@ matrix_hookshot_metrics_port: 9001
 
 # There is no need to edit ports. use matrix_hookshot_container_http_host_bind_ports below to expose ports instead.
 matrix_hookshot_webhook_port: 9000
+matrix_hookshot_webhook_hostname: "{{ matrix_hookshot_public_hostname }}"
 matrix_hookshot_webhook_endpoint: "{{ matrix_hookshot_public_endpoint }}/webhooks"
 
 
@@ -86,7 +91,7 @@ matrix_hookshot_github_oauth_client_id: ''  # "Client ID" on the GitHub App page
 matrix_hookshot_github_oauth_client_secret: ''  # "Client Secret" on the GitHub App page
 # Default value of matrix_hookshot_github_oauth_endpoint: "/hookshot/webhooks/oauth"
 matrix_hookshot_github_oauth_endpoint: "{{ matrix_hookshot_webhook_endpoint }}/oauth"
-matrix_hookshot_github_oauth_redirect_uri: "{{ matrix_hookshot_urlprefix }}{{ matrix_hookshot_github_oauth_endpoint }}"
+matrix_hookshot_github_oauth_redirect_uri: "https://{{ matrix_hookshot_urlprefix }}{{ matrix_hookshot_github_oauth_endpoint }}"
 
 # These are the default settings mentioned here and don't need to be modified: https://matrix-org.github.io/matrix-hookshot/usage/room_configuration/github_repo.html#configuration
 matrix_hookshot_github_defaultOptions_ignoreHooks: {}  # noqa var-naming
@@ -156,12 +161,13 @@ matrix_hookshot_feeds_pollIntervalSeconds: 600  # noqa var-naming
 matrix_hookshot_feeds_pollTimeoutSeconds: 30  # noqa var-naming
 
 
+matrix_hookshot_provisioning_enabled: false
 # There is no need to edit ports. use matrix_hookshot_container_http_host_bind_ports below to expose ports instead.
 matrix_hookshot_provisioning_port: 9002
 matrix_hookshot_provisioning_secret: ''
 # Provisioning will be automatically enabled if dimension is enabled and you have provided a provisioning secret, unless you override it
-matrix_hookshot_provisioning_enabled: false
 matrix_hookshot_provisioning_internal: "/v1"
+matrix_hookshot_provisioning_hostname: "{{ matrix_hookshot_public_hostname }}"
 matrix_hookshot_provisioning_endpoint: "{{ matrix_hookshot_public_endpoint }}{{ matrix_hookshot_provisioning_internal }}"
 
 # Valid logging levels are: debug, info, warn, error
@@ -196,6 +202,7 @@ matrix_hookshot_widgets_roomSetupWidget_addOnInvite: false   # noqa var-naming
 matrix_hookshot_widgets_disallowedIpRanges: ''   # noqa var-naming
 matrix_hookshot_widgets_internal: "/widgetapi"
 # Default value of matrix_hookshot_widgets_endpoint: "/hookshot/widgetapi"
+matrix_hookshot_widgets_hostname: "{{ matrix_hookshot_public_hostname }}"
 matrix_hookshot_widgets_endpoint: "{{ matrix_hookshot_public_endpoint }}{{ matrix_hookshot_widgets_internal }}"
 matrix_hookshot_widgets_publicUrl: "{{ matrix_hookshot_urlprefix }}{{ matrix_hookshot_widgets_endpoint }}/v1/static"   # noqa var-naming
 matrix_hookshot_widgets_branding_widgetTitle: "Hookshot Configuration"   # noqa var-naming
@@ -223,6 +230,67 @@ matrix_hookshot_container_network: "{{ matrix_docker_network }}"
 # A list of extra arguments to pass to the container
 matrix_hookshot_container_extra_arguments: []
 
+# matrix_hookshot_container_labels_traefik_enabled controls whether labels to assist a Traefik reverse-proxy will be attached to the container.
+# See `../templates/labels.j2` for details.
+#
+# To inject your own other container labels, see `matrix_hookshot_container_labels_additional_labels`.
+matrix_hookshot_container_labels_traefik_enabled: true
+matrix_hookshot_container_labels_traefik_docker_network: "{{ matrix_hookshot_container_network }}"
+matrix_hookshot_container_labels_traefik_entrypoints: web-secure
+matrix_hookshot_container_labels_traefik_tls_certResolver: default
+
+# Controls whether labels will be added that expose Hookshot's webhooks endpoint
+matrix_hookshot_container_labels_webhooks_enabled: true
+matrix_hookshot_container_labels_webhooks_traefik_rule: "Host(`{{ matrix_hookshot_webhook_hostname }}`) && PathPrefix(`{{ matrix_hookshot_webhook_endpoint }}`)"
+matrix_hookshot_container_labels_webhooks_traefik_priority: 0
+matrix_hookshot_container_labels_webhooks_traefik_entrypoints: "{{ matrix_hookshot_container_labels_traefik_entrypoints }}"
+matrix_hookshot_container_labels_webhooks_traefik_tls: "{{ matrix_hookshot_container_labels_webhooks_traefik_entrypoints != 'web' }}"
+matrix_hookshot_container_labels_webhooks_traefik_tls_certResolver: "{{ matrix_hookshot_container_labels_traefik_tls_certResolver }}"  # noqa var-naming
+
+# Controls whether labels will be added that expose Hookshot's generic endpoint
+matrix_hookshot_container_labels_appservice_enabled: true
+matrix_hookshot_container_labels_appservice_traefik_rule: "Host(`{{ matrix_hookshot_appservice_hostname }}`) && PathPrefix(`{{ matrix_hookshot_appservice_endpoint }}`)"
+matrix_hookshot_container_labels_appservice_traefik_priority: 0
+matrix_hookshot_container_labels_appservice_traefik_entrypoints: "{{ matrix_hookshot_container_labels_traefik_entrypoints }}"
+matrix_hookshot_container_labels_appservice_traefik_tls: "{{ matrix_hookshot_container_labels_appservice_traefik_entrypoints != 'web' }}"
+matrix_hookshot_container_labels_appservice_traefik_tls_certResolver: "{{ matrix_hookshot_container_labels_traefik_tls_certResolver }}"  # noqa var-naming
+
+# Controls whether labels will be added that expose Hookshot's widgets endpoint
+matrix_hookshot_container_labels_widgets_enabled: "{{ matrix_hookshot_widgets_enabled }}"
+matrix_hookshot_container_labels_widgets_traefik_rule: "Host(`{{ matrix_hookshot_widgets_hostname }}`) && PathPrefix(`{{ matrix_hookshot_widgets_endpoint }}`)"
+matrix_hookshot_container_labels_widgets_traefik_priority: 0
+matrix_hookshot_container_labels_widgets_traefik_entrypoints: "{{ matrix_hookshot_container_labels_traefik_entrypoints }}"
+matrix_hookshot_container_labels_widgets_traefik_tls: "{{ matrix_hookshot_container_labels_widgets_traefik_entrypoints != 'web' }}"
+matrix_hookshot_container_labels_widgets_traefik_tls_certResolver: "{{ matrix_hookshot_container_labels_traefik_tls_certResolver }}"  # noqa var-naming
+
+# Controls whether labels will be added that expose Hookshot's provisioning endpoint
+matrix_hookshot_container_labels_provisioning_enabled: "{{ matrix_hookshot_provisioning_enabled }}"
+matrix_hookshot_container_labels_provisioning_traefik_rule: "Host(`{{ matrix_hookshot_provisioning_hostname }}`) && PathPrefix(`{{ matrix_hookshot_provisioning_endpoint }}`)"
+matrix_hookshot_container_labels_provisioning_traefik_priority: 0
+matrix_hookshot_container_labels_provisioning_traefik_entrypoints: "{{ matrix_hookshot_container_labels_traefik_entrypoints }}"
+matrix_hookshot_container_labels_provisioning_traefik_tls: "{{ matrix_hookshot_container_labels_provisioning_traefik_entrypoints != 'web' }}"
+matrix_hookshot_container_labels_provisioning_traefik_tls_certResolver: "{{ matrix_hookshot_container_labels_traefik_tls_certResolver }}"  # noqa var-naming
+
+# Controls whether labels will be added that expose Hookshot's provisioning endpoint
+matrix_hookshot_container_labels_metrics_enabled: "{{ matrix_hookshot_metrics_enabled and matrix_hookshot_metrics_proxying_enabled }}"
+matrix_hookshot_container_labels_metrics_traefik_rule: "Host(`{{ matrix_hookshot_metrics_proxying_hostname }}`) && PathPrefix(`{{ matrix_hookshot_metrics_proxying_path_prefix }}`)"
+matrix_hookshot_container_labels_metrics_traefik_priority: 0
+matrix_hookshot_container_labels_metrics_traefik_entrypoints: "{{ matrix_hookshot_container_labels_traefik_entrypoints }}"
+matrix_hookshot_container_labels_metrics_traefik_tls: "{{ matrix_hookshot_container_labels_metrics_traefik_entrypoints != 'web' }}"
+matrix_hookshot_container_labels_metrics_traefik_tls_certResolver: "{{ matrix_hookshot_container_labels_traefik_tls_certResolver }}"  # noqa var-naming
+matrix_hookshot_container_labels_metrics_middleware_basic_auth_enabled: false
+# See: https://doc.traefik.io/traefik/middlewares/http/basicauth/#users
+matrix_hookshot_container_labels_metrics_middleware_basic_auth_users: ''
+
+# matrix_hookshot_container_labels_additional_labels contains a multiline string with additional labels to add to the container label file.
+# See `../templates/labels.j2` for details.
+#
+# Example:
+# matrix_hookshot_container_labels_additional_labels: |
+#   my.label=1
+#   another.label="here"
+matrix_hookshot_container_labels_additional_labels: ''
+
 # List of systemd services that service depends on.
 matrix_hookshot_systemd_required_services_list: "{{ matrix_hookshot_systemd_required_services_list_default + matrix_hookshot_systemd_required_services_list_auto + matrix_hookshot_systemd_required_services_list_custom }}"
 matrix_hookshot_systemd_required_services_list_default: ['docker.service']
diff --git a/roles/custom/matrix-bridge-hookshot/tasks/inject_into_nginx_proxy.yml b/roles/custom/matrix-bridge-hookshot/tasks/inject_into_nginx_proxy.yml
deleted file mode 100644
index 5712489c3..000000000
--- a/roles/custom/matrix-bridge-hookshot/tasks/inject_into_nginx_proxy.yml
+++ /dev/null
@@ -1,111 +0,0 @@
----
-
-- name: Fail if matrix-nginx-proxy role already executed
-  ansible.builtin.fail:
-    msg: >-
-      Trying to append hookshot's reverse-proxying configuration to matrix-nginx-proxy,
-      but it's pointless since the matrix-nginx-proxy role had already executed.
-      To fix this, please change the order of roles in your playbook,
-      so that the matrix-nginx-proxy role would run after the matrix-bridge-hookshot role.
-  when: matrix_nginx_proxy_role_executed | default(False) | bool
-
-- name: Generate Matrix hookshot proxying configuration for matrix-nginx-proxy
-  ansible.builtin.set_fact:
-    matrix_hookshot_matrix_nginx_proxy_configuration: |
-      location ~ ^{{ matrix_hookshot_appservice_endpoint }}/(.*)$ {
-        {% if matrix_nginx_proxy_enabled | default(False) %}
-          {# Use the embedded DNS resolver in Docker containers to discover the service #}
-          resolver 127.0.0.11 valid=5s;
-          set $backend "{{ matrix_hookshot_container_url }}:{{ matrix_hookshot_appservice_port }}";
-          proxy_pass http://$backend/$1;
-        {% else %}
-          {# Generic configuration for use outside of our container setup #}
-          proxy_pass http://127.0.0.1:{{ matrix_hookshot_appservice_port }}/$1;
-        {% endif %}
-        proxy_set_header Host $host;
-      }
-      {% if matrix_hookshot_provisioning_enabled %}
-      location ~ ^{{ matrix_hookshot_provisioning_endpoint }}/(.*)$ {
-        {% if matrix_nginx_proxy_enabled | default(False) %}
-          {# Use the embedded DNS resolver in Docker containers to discover the service #}
-          resolver 127.0.0.11 valid=5s;
-          set $backend "{{ matrix_hookshot_container_url }}:{{ matrix_hookshot_provisioning_port }}";
-          proxy_pass http://$backend{{ matrix_hookshot_provisioning_internal }}/$1$is_args$args;
-        {% else %}
-          {# Generic configuration for use outside of our container setup #}
-          proxy_pass http://127.0.0.1:{{ matrix_hookshot_provisioning_port }}{{ matrix_hookshot_provisioning_internal }}/$1$is_args$args;
-        {% endif %}
-        proxy_set_header Host $host;
-      }
-      {% endif %}
-      {% if matrix_hookshot_widgets_enabled %}
-      location ~ ^{{ matrix_hookshot_widgets_endpoint }}/(.*)$ {
-        {% if matrix_nginx_proxy_enabled | default(False) %}
-          {# Use the embedded DNS resolver in Docker containers to discover the service #}
-          resolver 127.0.0.11 valid=5s;
-          set $backend "{{ matrix_hookshot_container_url }}:{{ matrix_hookshot_widgets_port }}";
-          proxy_pass http://$backend{{ matrix_hookshot_widgets_internal }}/$1$is_args$args;
-        {% else %}
-          {# Generic configuration for use outside of our container setup #}
-          proxy_pass http://127.0.0.1:{{ matrix_hookshot_widgets_port }}{{ matrix_hookshot_widgets_internal }}/$1$is_args$args;
-        {% endif %}
-        proxy_set_header Host $host;
-      }
-      {% endif %}
-      location ~ ^{{ matrix_hookshot_webhook_endpoint }}/(.*)$ {
-        {% if matrix_nginx_proxy_enabled | default(False) %}
-          {# Use the embedded DNS resolver in Docker containers to discover the service #}
-          resolver 127.0.0.11 valid=5s;
-          set $backend "{{ matrix_hookshot_container_url }}:{{ matrix_hookshot_webhook_port }}";
-          proxy_pass http://$backend/$1$is_args$args;
-        {% else %}
-          {# Generic configuration for use outside of our container setup #}
-          proxy_pass http://127.0.0.1:{{ matrix_hookshot_webhook_port }}/$1$is_args$args;
-        {% endif %}
-        proxy_set_header Host $host;
-      }
-
-- name: Register hookshot proxying configuration with matrix-nginx-proxy
-  ansible.builtin.set_fact:
-    matrix_nginx_proxy_proxy_matrix_additional_server_configuration_blocks: |
-      {{
-        matrix_nginx_proxy_proxy_matrix_additional_server_configuration_blocks | default([])
-        +
-        [matrix_hookshot_matrix_nginx_proxy_configuration]
-      }}
-
-- name: Generate hookshot metrics proxying configuration for matrix-nginx-proxy (matrix.DOMAIN/metrics/hookshot)
-  ansible.builtin.set_fact:
-    matrix_hookshot_matrix_nginx_proxy_metrics_configuration_matrix_domain: |
-      location /metrics/hookshot {
-        {% if matrix_nginx_proxy_enabled | default(False) %}
-          {# Use the embedded DNS resolver in Docker containers to discover the service #}
-          resolver 127.0.0.11 valid=5s;
-          set $backend "{{ matrix_hookshot_container_url }}:{{ matrix_hookshot_metrics_port }}";
-          proxy_pass http://$backend/metrics;
-        {% else %}
-          {# Generic configuration for use outside of our container setup #}
-          proxy_pass http://127.0.0.1:{{ matrix_hookshot_metrics_port }}/metrics;
-        {% endif %}
-      }
-  when: matrix_hookshot_metrics_enabled | bool and matrix_hookshot_metrics_proxying_enabled | bool
-
-- name: Register hookshot metrics proxying configuration with matrix-nginx-proxy (matrix.DOMAIN/metrics/hookshot)
-  ansible.builtin.set_fact:
-    matrix_nginx_proxy_proxy_matrix_metrics_additional_system_location_configuration_blocks: |
-      {{
-        matrix_nginx_proxy_proxy_matrix_metrics_additional_system_location_configuration_blocks | default([])
-        +
-        [matrix_hookshot_matrix_nginx_proxy_metrics_configuration_matrix_domain]
-      }}
-  when: matrix_hookshot_metrics_enabled | bool and matrix_hookshot_metrics_proxying_enabled | bool
-
-- name: Warn about reverse-proxying if matrix-nginx-proxy not used
-  ansible.builtin.debug:
-    msg: >-
-      NOTE: You've enabled the hookshot bridge but are not using the matrix-nginx-proxy
-      reverse proxy.
-      Please make sure that you're proxying the `{{ matrix_hookshot_public_endpoint }}`
-      URL endpoint to the matrix-hookshot container.
-      You can expose the container's ports using the `matrix_hookshot_container_http_host_bind_ports` variable.
-  when: "not matrix_nginx_proxy_enabled | default(False) | bool"
diff --git a/roles/custom/matrix-bridge-hookshot/tasks/main.yml b/roles/custom/matrix-bridge-hookshot/tasks/main.yml
index 8a98ee999..89f110dd4 100644
--- a/roles/custom/matrix-bridge-hookshot/tasks/main.yml
+++ b/roles/custom/matrix-bridge-hookshot/tasks/main.yml
@@ -1,14 +1,5 @@
 ---
 
-- tags:
-    - setup-all
-    - setup-nginx-proxy
-    - install-all
-    - install-nginx-proxy
-  block:
-    - when: matrix_hookshot_enabled | bool
-      ansible.builtin.include_tasks: "{{ role_path }}/tasks/inject_into_nginx_proxy.yml"
-
 - tags:
     - reset-hookshot-encryption
   block:
diff --git a/roles/custom/matrix-bridge-hookshot/tasks/setup_install.yml b/roles/custom/matrix-bridge-hookshot/tasks/setup_install.yml
index 05e5cb856..9eee83edf 100644
--- a/roles/custom/matrix-bridge-hookshot/tasks/setup_install.yml
+++ b/roles/custom/matrix-bridge-hookshot/tasks/setup_install.yml
@@ -112,6 +112,16 @@
     name: "{{ matrix_hookshot_container_network }}"
     driver: bridge
 
+- name: Ensure mautrix-hookshot support files installed
+  ansible.builtin.template:
+    src: "{{ role_path }}/templates/{{ item }}.j2"
+    dest: "{{ matrix_hookshot_base_path }}/{{ item }}"
+    mode: 0640
+    owner: "{{ matrix_user_username }}"
+    group: "{{ matrix_user_groupname }}"
+  with_items:
+    - labels
+
 - name: Ensure matrix-hookshot.service installed
   ansible.builtin.template:
     src: "{{ role_path }}/templates/systemd/matrix-hookshot.service.j2"
diff --git a/roles/custom/matrix-bridge-hookshot/templates/labels.j2 b/roles/custom/matrix-bridge-hookshot/templates/labels.j2
new file mode 100644
index 000000000..4df8017f4
--- /dev/null
+++ b/roles/custom/matrix-bridge-hookshot/templates/labels.j2
@@ -0,0 +1,100 @@
+{% if matrix_hookshot_container_labels_traefik_enabled %}
+traefik.enable=true
+
+{% if matrix_hookshot_container_labels_traefik_docker_network %}
+traefik.docker.network={{ matrix_hookshot_container_labels_traefik_docker_network }}
+{% endif %}
+
+{# Webhooks #}
+{% if matrix_hookshot_container_labels_webhooks_enabled %}
+traefik.http.routers.matrix-hookshot-webhooks.rule={{ matrix_hookshot_container_labels_webhooks_traefik_rule }}
+traefik.http.routers.matrix-hookshot-webhooks.middlewares=matrix-hookshot-webhooks-strip-prefix
+{% if matrix_hookshot_container_labels_webhooks_traefik_priority | int > 0 %}
+traefik.http.routers.matrix-hookshot-webhooks.priority={{ matrix_hookshot_container_labels_webhooks_traefik_priority }}
+{% endif %}
+traefik.http.routers.matrix-hookshot-webhooks.service=matrix-hookshot-webhooks
+traefik.http.routers.matrix-hookshot-webhooks.entrypoints={{ matrix_hookshot_container_labels_webhooks_traefik_entrypoints }}
+traefik.http.routers.matrix-hookshot-webhooks.tls={{ matrix_hookshot_container_labels_webhooks_traefik_tls | to_json }}
+{% if matrix_hookshot_container_labels_webhooks_traefik_tls %}
+traefik.http.routers.matrix-hookshot-webhooks.tls.certResolver={{ matrix_hookshot_container_labels_webhooks_traefik_tls_certResolver }}
+{% endif %}
+traefik.http.middlewares.matrix-hookshot-webhooks-strip-prefix.stripprefix.prefixes={{ matrix_hookshot_webhook_endpoint }}
+traefik.http.services.matrix-hookshot-webhooks.loadbalancer.server.port={{ matrix_hookshot_webhook_port }}
+{% endif %}
+
+{# Appservice #}
+{% if matrix_hookshot_container_labels_appservice_enabled %}
+traefik.http.routers.matrix-hookshot-appservice.rule={{ matrix_hookshot_container_labels_appservice_traefik_rule }}
+traefik.http.routers.matrix-hookshot-appservice.middlewares=matrix-hookshot-appservice-strip-prefix
+{% if matrix_hookshot_container_labels_appservice_traefik_priority | int > 0 %}
+traefik.http.routers.matrix-hookshot-appservice.priority={{ matrix_hookshot_container_labels_appservice_traefik_priority }}
+{% endif %}
+traefik.http.routers.matrix-hookshot-appservice.service=matrix-hookshot-appservice
+traefik.http.routers.matrix-hookshot-appservice.entrypoints={{ matrix_hookshot_container_labels_appservice_traefik_entrypoints }}
+traefik.http.routers.matrix-hookshot-appservice.tls={{ matrix_hookshot_container_labels_appservice_traefik_tls | to_json }}
+{% if matrix_hookshot_container_labels_appservice_traefik_tls %}
+traefik.http.routers.matrix-hookshot-appservice.tls.certResolver={{ matrix_hookshot_container_labels_appservice_traefik_tls_certResolver }}
+{% endif %}
+traefik.http.middlewares.matrix-hookshot-appservice-strip-prefix.stripprefix.prefixes={{ matrix_hookshot_appservice_endpoint }}
+traefik.http.services.matrix-hookshot-appservice.loadbalancer.server.port={{ matrix_hookshot_appservice_port }}
+{% endif %}
+
+{# Widgets #}
+{% if matrix_hookshot_container_labels_widgets_enabled %}
+traefik.http.routers.matrix-hookshot-widgets.rule={{ matrix_hookshot_container_labels_widgets_traefik_rule }}
+traefik.http.routers.matrix-hookshot-widgets.middlewares=matrix-hookshot-widgets-strip-prefix
+{% if matrix_hookshot_container_labels_widgets_traefik_priority | int > 0 %}
+traefik.http.routers.matrix-hookshot-widgets.priority={{ matrix_hookshot_container_labels_widgets_traefik_priority }}
+{% endif %}
+traefik.http.routers.matrix-hookshot-widgets.service=matrix-hookshot-widgets
+traefik.http.routers.matrix-hookshot-widgets.entrypoints={{ matrix_hookshot_container_labels_widgets_traefik_entrypoints }}
+traefik.http.routers.matrix-hookshot-widgets.tls={{ matrix_hookshot_container_labels_widgets_traefik_tls | to_json }}
+{% if matrix_hookshot_container_labels_widgets_traefik_tls %}
+traefik.http.routers.matrix-hookshot-widgets.tls.certResolver={{ matrix_hookshot_container_labels_widgets_traefik_tls_certResolver }}
+{% endif %}
+traefik.http.middlewares.matrix-hookshot-widgets-strip-prefix.stripprefix.prefixes={{ matrix_hookshot_widgets_endpoint }}
+traefik.http.services.matrix-hookshot-widgets.loadbalancer.server.port={{ matrix_hookshot_widgets_port }}
+{% endif %}
+
+{# Widgets #}
+{% if matrix_hookshot_container_labels_provisioning_enabled %}
+traefik.http.routers.matrix-hookshot-provisioning.rule={{ matrix_hookshot_container_labels_provisioning_traefik_rule }}
+traefik.http.routers.matrix-hookshot-provisioning.middlewares=matrix-hookshot-provisioning-strip-prefix
+{% if matrix_hookshot_container_labels_provisioning_traefik_priority | int > 0 %}
+traefik.http.routers.matrix-hookshot-provisioning.priority={{ matrix_hookshot_container_labels_provisioning_traefik_priority }}
+{% endif %}
+traefik.http.routers.matrix-hookshot-provisioning.service=matrix-hookshot-provisioning
+traefik.http.routers.matrix-hookshot-provisioning.entrypoints={{ matrix_hookshot_container_labels_provisioning_traefik_entrypoints }}
+traefik.http.routers.matrix-hookshot-provisioning.tls={{ matrix_hookshot_container_labels_provisioning_traefik_tls | to_json }}
+{% if matrix_hookshot_container_labels_provisioning_traefik_tls %}
+traefik.http.routers.matrix-hookshot-provisioning.tls.certResolver={{ matrix_hookshot_container_labels_provisioning_traefik_tls_certResolver }}
+{% endif %}
+traefik.http.middlewares.matrix-hookshot-provisioning-strip-prefix.stripprefix.prefixes={{ matrix_hookshot_provisioning_endpoint }}
+traefik.http.services.matrix-hookshot-provisioning.loadbalancer.server.port={{ matrix_hookshot_provisioning_port }}
+{% endif %}
+
+{# Metrics #}
+{% set metricsMiddlewares = ['matrix-hookshot-metrics-replace-path'] %}
+traefik.http.middlewares.matrix-hookshot-metrics-replace-path.replacepath.path=/metrics
+{% if matrix_hookshot_container_labels_metrics_middleware_basic_auth_enabled %}
+{% set metricsMiddlewares = metricsMiddlewares + ['matrix-hookshot-metrics-basic-auth'] %}
+traefik.http.middlewares.matrix-hookshot-metrics-basic-auth.basicauth.users={{ matrix_hookshot_container_labels_metrics_middleware_basic_auth_users }}
+{% endif %}
+{% if matrix_hookshot_container_labels_metrics_enabled %}
+traefik.http.routers.matrix-hookshot-metrics.rule={{ matrix_hookshot_container_labels_metrics_traefik_rule }}
+traefik.http.routers.matrix-hookshot-metrics.middlewares={{ metricsMiddlewares | join(',') }}
+{% if matrix_hookshot_container_labels_metrics_traefik_priority | int > 0 %}
+traefik.http.routers.matrix-hookshot-metrics.priority={{ matrix_hookshot_container_labels_metrics_traefik_priority }}
+{% endif %}
+traefik.http.routers.matrix-hookshot-metrics.service=matrix-hookshot-metrics
+traefik.http.routers.matrix-hookshot-metrics.entrypoints={{ matrix_hookshot_container_labels_metrics_traefik_entrypoints }}
+traefik.http.routers.matrix-hookshot-metrics.tls={{ matrix_hookshot_container_labels_metrics_traefik_tls | to_json }}
+{% if matrix_hookshot_container_labels_metrics_traefik_tls %}
+traefik.http.routers.matrix-hookshot-metrics.tls.certResolver={{ matrix_hookshot_container_labels_metrics_traefik_tls_certResolver }}
+{% endif %}
+traefik.http.services.matrix-hookshot-metrics.loadbalancer.server.port={{ matrix_hookshot_metrics_port }}
+{% endif %}
+
+{% endif %}
+
+{{ matrix_hookshot_container_labels_additional_labels }}
diff --git a/roles/custom/matrix-bridge-hookshot/templates/systemd/matrix-hookshot.service.j2 b/roles/custom/matrix-bridge-hookshot/templates/systemd/matrix-hookshot.service.j2
index 84d8b7922..6e62e264c 100644
--- a/roles/custom/matrix-bridge-hookshot/templates/systemd/matrix-hookshot.service.j2
+++ b/roles/custom/matrix-bridge-hookshot/templates/systemd/matrix-hookshot.service.j2
@@ -21,6 +21,7 @@ ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} create --rm -
           --cap-drop=ALL \
           --network={{ matrix_hookshot_container_network }} \
           --mount type=bind,src={{ matrix_hookshot_base_path }},dst=/data \
+          --label-file={{ matrix_hookshot_base_path }}/labels \
           {% for port in matrix_hookshot_container_http_host_bind_ports %}
           -p {{ port }} \
           {% endfor %}
diff --git a/roles/custom/matrix-bridge-mautrix-facebook/defaults/main.yml b/roles/custom/matrix-bridge-mautrix-facebook/defaults/main.yml
index ae6fe7dc5..102729d7a 100644
--- a/roles/custom/matrix-bridge-mautrix-facebook/defaults/main.yml
+++ b/roles/custom/matrix-bridge-mautrix-facebook/defaults/main.yml
@@ -99,7 +99,7 @@ matrix_mautrix_facebook_federate_rooms: true
 # If metrics need to be consumed by another (external) Prometheus server, consider exposing them via `matrix_mautrix_facebook_metrics_proxying_enabled`.
 matrix_mautrix_facebook_metrics_enabled: false
 
-# Controls whether metrics should be exposed on `matrix.DOMAIN/metrics/mautrix-facebook`.
+# Controls whether metrics should be exposed on a public URL.
 matrix_mautrix_facebook_metrics_proxying_enabled: false
 matrix_mautrix_facebook_metrics_proxying_hostname: ''
 matrix_mautrix_facebook_metrics_proxying_path_prefix: ''