sync with previous repo

roles/matrix-synapse/tasks/ext/ldap-auth/setup.yml

@@ -0,0 +1,8 @@
+- set_fact:
+    matrix_synapse_password_providers_enabled: true
+
+    matrix_synapse_additional_loggers: >
+      {{ matrix_synapse_additional_loggers }}
+      +
+      {{ [{'name': 'ldap_auth_provider', 'level': 'INFO'}] }}
+  when: matrix_synapse_ext_password_provider_ldap_enabled|bool

roles/matrix-synapse/tasks/ext/mjolnir-antispam/setup.yml

@@ -0,0 +1,7 @@
+---
+
+- import_tasks: "{{ role_path }}/tasks/ext/mjolnir-antispam/setup_install.yml"
+  when: matrix_synapse_ext_spam_checker_mjolnir_antispam_enabled|bool
+
+- import_tasks: "{{ role_path }}/tasks/ext/mjolnir-antispam/setup_uninstall.yml"
+  when: "not matrix_synapse_ext_spam_checker_mjolnir_antispam_enabled|bool"

roles/matrix-synapse/tasks/ext/mjolnir-antispam/setup_install.yml

@@ -0,0 +1,52 @@
+---
+
+- name: Ensure git installed (RedHat)
+  yum:
+    name:
+      - git
+    state: present
+    update_cache: no
+  when: "ansible_os_family == 'RedHat'"
+
+- name: Ensure git installed (Debian)
+  apt:
+    name:
+      - git
+    state: present
+    update_cache: no
+  when: "ansible_os_family == 'Debian'"
+
+- name: Ensure git installed (Archlinux)
+  pacman:
+    name:
+      - git
+    state: present
+    update_cache: no
+  when: "ansible_distribution == 'Archlinux'"
+
+- name: Clone mjolnir-antispam git repository
+  git:
+    repo: "{{ matrix_synapse_ext_spam_checker_mjolnir_antispam_git_repository_url }}"
+    version: "{{ matrix_synapse_ext_spam_checker_mjolnir_antispam_git_version }}"
+    dest: "{{ matrix_synapse_ext_path }}/mjolnir"
+  become: true
+  become_user: "{{ matrix_user_username }}"
+
+- set_fact:
+    matrix_synapse_spam_checker: >
+      {{ matrix_synapse_spam_checker }}
+      +
+      [{
+        "module": "mjolnir.AntiSpam",
+        "config": {
+          "block_invites": {{ matrix_synapse_ext_spam_checker_mjolnir_antispam_config_block_invites }},
+          "block_messages": {{ matrix_synapse_ext_spam_checker_mjolnir_antispam_config_block_messages }},
+          "block_usernames": {{ matrix_synapse_ext_spam_checker_mjolnir_antispam_config_block_usernames }},
+          "ban_lists": {{ matrix_synapse_ext_spam_checker_mjolnir_antispam_config_ban_lists }}
+        }
+      }]
+
+    matrix_synapse_container_extra_arguments: >
+      {{ matrix_synapse_container_extra_arguments|default([]) }}
+      +
+      ["--mount type=bind,src={{ matrix_synapse_ext_path }}/mjolnir/synapse_antispam/mjolnir,dst={{ matrix_synapse_in_container_python_packages_path }}/mjolnir,ro"]

roles/matrix-synapse/tasks/ext/mjolnir-antispam/setup_uninstall.yml

@@ -0,0 +1,6 @@
+---
+
+- name: Ensure mjolnir-antispam doesn't exist
+  file:
+    path: "{{ matrix_synapse_ext_path }}/mjolnir"
+    state: absent

roles/matrix-synapse/tasks/ext/rest-auth/setup.yml

@@ -0,0 +1,7 @@
+---
+
+- import_tasks: "{{ role_path }}/tasks/ext/rest-auth/setup_install.yml"
+  when: matrix_synapse_ext_password_provider_rest_auth_enabled|bool
+
+- import_tasks: "{{ role_path }}/tasks/ext/rest-auth/setup_uninstall.yml"
+  when: "not matrix_synapse_ext_password_provider_rest_auth_enabled|bool"

roles/matrix-synapse/tasks/ext/rest-auth/setup_install.yml

@@ -0,0 +1,28 @@
+---
+
+- name: Fail if REST Auth endpoint not configured
+  fail:
+    msg: "You have enabled the REST Auth password provider, but have not configured its endpoint in the `matrix_synapse_ext_password_provider_rest_auth_endpoint` variable. Consult the documentation."
+  when: "matrix_synapse_ext_password_provider_rest_auth_endpoint == ''"
+
+- name: Download matrix-synapse-rest-auth
+  get_url:
+    url: "{{ matrix_synapse_ext_password_provider_rest_auth_download_url }}"
+    dest: "{{ matrix_synapse_ext_path }}/rest_auth_provider.py"
+    force: true
+    mode: 0440
+    owner: "{{ matrix_user_username }}"
+    group: "{{ matrix_user_groupname }}"
+
+- set_fact:
+    matrix_synapse_password_providers_enabled: true
+
+    matrix_synapse_container_extra_arguments: >
+      {{ matrix_synapse_container_extra_arguments|default([]) }}
+      +
+      ["--mount type=bind,src={{ matrix_synapse_ext_path }}/rest_auth_provider.py,dst={{ matrix_synapse_in_container_python_packages_path }}/rest_auth_provider.py,ro"]
+
+    matrix_synapse_additional_loggers: >
+      {{ matrix_synapse_additional_loggers }}
+      +
+      {{ [{'name': 'rest_auth_provider', 'level': 'INFO'}] }}

roles/matrix-synapse/tasks/ext/rest-auth/setup_uninstall.yml

@@ -0,0 +1,6 @@
+---
+
+- name: Ensure matrix-synapse-rest-auth doesn't exist
+  file:
+    path: "{{ matrix_synapse_ext_path }}/rest_auth_provider.py"
+    state: absent

roles/matrix-synapse/tasks/ext/setup.yml

@@ -0,0 +1,11 @@
+---
+
+- import_tasks: "{{ role_path }}/tasks/ext/rest-auth/setup.yml"
+
+- import_tasks: "{{ role_path }}/tasks/ext/shared-secret-auth/setup.yml"
+
+- import_tasks: "{{ role_path }}/tasks/ext/ldap-auth/setup.yml"
+
+- import_tasks: "{{ role_path }}/tasks/ext/synapse-simple-antispam/setup.yml"
+
+- import_tasks: "{{ role_path }}/tasks/ext/mjolnir-antispam/setup.yml"

roles/matrix-synapse/tasks/ext/shared-secret-auth/setup.yml

@@ -0,0 +1,7 @@
+---
+
+- import_tasks: "{{ role_path }}/tasks/ext/shared-secret-auth/setup_install.yml"
+  when: matrix_synapse_ext_password_provider_shared_secret_auth_enabled|bool
+
+- import_tasks: "{{ role_path }}/tasks/ext/shared-secret-auth/setup_uninstall.yml"
+  when: "not matrix_synapse_ext_password_provider_shared_secret_auth_enabled|bool"

roles/matrix-synapse/tasks/ext/shared-secret-auth/setup_install.yml

@@ -0,0 +1,28 @@
+---
+
+- name: Fail if Shared Secret Auth secret not set
+  fail:
+    msg: "Shared Secret Auth is enabled, but no secret has been set in matrix_synapse_ext_password_provider_shared_secret_auth_shared_secret"
+  when: "matrix_synapse_ext_password_provider_shared_secret_auth_shared_secret == ''"
+
+- name: Download matrix-synapse-shared-secret-auth
+  get_url:
+    url: "{{ matrix_synapse_ext_password_provider_shared_secret_auth_download_url }}"
+    dest: "{{ matrix_synapse_ext_path }}/shared_secret_authenticator.py"
+    force: true
+    mode: 0440
+    owner: "{{ matrix_user_username }}"
+    group: "{{ matrix_user_groupname }}"
+
+- set_fact:
+    matrix_synapse_password_providers_enabled: true
+
+    matrix_synapse_container_extra_arguments: >
+      {{ matrix_synapse_container_extra_arguments|default([]) }}
+      +
+      ["--mount type=bind,src={{ matrix_synapse_ext_path }}/shared_secret_authenticator.py,dst={{ matrix_synapse_in_container_python_packages_path }}/shared_secret_authenticator.py,ro"]
+
+    matrix_synapse_additional_loggers: >
+      {{ matrix_synapse_additional_loggers }}
+      +
+      {{ [{'name': 'shared_secret_authenticator', 'level': 'INFO'}] }}

roles/matrix-synapse/tasks/ext/shared-secret-auth/setup_uninstall.yml

@@ -0,0 +1,6 @@
+---
+
+- name: Ensure matrix-synapse-shared-secret-auth doesn't exist
+  file:
+    path: "{{ matrix_synapse_ext_path }}/shared_secret_authenticator.py"
+    state: absent

roles/matrix-synapse/tasks/ext/synapse-simple-antispam/setup.yml

@@ -0,0 +1,7 @@
+---
+
+- import_tasks: "{{ role_path }}/tasks/ext/synapse-simple-antispam/setup_install.yml"
+  when: matrix_synapse_ext_spam_checker_synapse_simple_antispam_enabled|bool
+
+- import_tasks: "{{ role_path }}/tasks/ext/synapse-simple-antispam/setup_uninstall.yml"
+  when: "not matrix_synapse_ext_spam_checker_synapse_simple_antispam_enabled|bool"

roles/matrix-synapse/tasks/ext/synapse-simple-antispam/setup_install.yml

@@ -0,0 +1,54 @@
+---
+
+- name: Fail if Synapse Simple Antispam blocked homeservers is not set
+  fail:
+    msg: "Synapse Simple Antispam is enabled, but no blocked homeservers have been set in matrix_synapse_ext_spam_checker_synapse_simple_antispam_config_blocked_homeservers"
+  when: "matrix_synapse_ext_spam_checker_synapse_simple_antispam_config_blocked_homeservers|length == 0"
+
+- name: Ensure git installed (RedHat)
+  yum:
+    name:
+      - git
+    state: present
+    update_cache: no
+  when: "ansible_os_family == 'RedHat'"
+
+- name: Ensure git installed (Debian)
+  apt:
+    name:
+      - git
+    state: present
+    update_cache: no
+  when: "ansible_os_family == 'Debian'"
+
+- name: Ensure git installed (Archlinux)
+  pacman:
+    name:
+      - git
+    state: present
+    update_cache: no
+  when: "ansible_distribution == 'Archlinux'"
+
+- name: Clone synapse-simple-antispam git repository
+  git:
+    repo: "{{ matrix_synapse_ext_spam_checker_synapse_simple_antispam_git_repository_url }}"
+    version: "{{ matrix_synapse_ext_spam_checker_synapse_simple_antispam_git_version }}"
+    dest: "{{ matrix_synapse_ext_path }}/synapse-simple-antispam"
+  become: true
+  become_user: "{{ matrix_user_username }}"
+
+- set_fact:
+    matrix_synapse_spam_checker: >
+      {{ matrix_synapse_spam_checker }}
+      +
+      [{
+        "module": "synapse_simple_antispam.AntiSpamInvites",
+        "config": {
+          "blocked_homeservers": {{ matrix_synapse_ext_spam_checker_synapse_simple_antispam_config_blocked_homeservers }}
+        }
+      }]
+
+    matrix_synapse_container_extra_arguments: >
+      {{ matrix_synapse_container_extra_arguments|default([]) }}
+      +
+      ["--mount type=bind,src={{ matrix_synapse_ext_path }}/synapse-simple-antispam/synapse_simple_antispam,dst={{ matrix_synapse_in_container_python_packages_path }}/synapse_simple_antispam,ro"]

roles/matrix-synapse/tasks/ext/synapse-simple-antispam/setup_uninstall.yml

@@ -0,0 +1,6 @@
+---
+
+- name: Ensure synapse-simple-antispam doesn't exist
+  file:
+    path: "{{ matrix_synapse_ext_path }}/synapse-simple-antispam"
+    state: absent

roles/matrix-synapse/tasks/goofys/setup.yml

@@ -0,0 +1,7 @@
+---
+
+- import_tasks: "{{ role_path }}/tasks/goofys/setup_install.yml"
+  when: matrix_s3_media_store_enabled|bool
+
+- import_tasks: "{{ role_path }}/tasks/goofys/setup_uninstall.yml"
+  when: "not matrix_s3_media_store_enabled|bool"

roles/matrix-synapse/tasks/goofys/setup_install.yml

@@ -0,0 +1,41 @@
+- name: Ensure Goofys Docker image is pulled
+  docker_image:
+    name: "{{ matrix_s3_goofys_docker_image }}"
+    source: "{{ 'pull' if ansible_version.major > 2 or ansible_version.minor > 7 else omit }}"
+    force_source: "{{ matrix_s3_goofys_docker_image_force_pull if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}"
+    force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else matrix_s3_goofys_docker_image_force_pull }}"
+
+# This will throw a Permission Denied error if already mounted
+- name: Check Matrix Goofys external storage mountpoint path
+  stat:
+    path: "{{ matrix_s3_media_store_path }}"
+  register: local_path_matrix_s3_media_store_path_stat
+  ignore_errors: yes
+
+- name: Ensure Matrix Goofys external storage mountpoint exists
+  file:
+    path: "{{ matrix_s3_media_store_path }}"
+    state: directory
+    mode: 0750
+    owner: "{{ matrix_user_username }}"
+    group: "{{ matrix_user_groupname }}"
+  when: "not local_path_matrix_s3_media_store_path_stat.failed and not local_path_matrix_s3_media_store_path_stat.stat.exists"
+
+- name: Ensure goofys environment variables file created
+  template:
+    src: "{{ role_path }}/templates/goofys/env-goofys.j2"
+    dest: "{{ matrix_synapse_config_dir_path }}/env-goofys"
+    owner: root
+    mode: 0600
+
+- name: Ensure matrix-goofys.service installed
+  template:
+    src: "{{ role_path }}/templates/goofys/systemd/matrix-goofys.service.j2"
+    dest: "{{ matrix_systemd_path }}/matrix-goofys.service"
+    mode: 0644
+  register: matrix_goofys_systemd_service_result
+
+- name: Ensure systemd reloaded after matrix-goofys.service installation
+  service:
+    daemon_reload: yes
+  when: "matrix_goofys_systemd_service_result.changed"

roles/matrix-synapse/tasks/goofys/setup_uninstall.yml

@@ -0,0 +1,33 @@
+- name: Check existence of matrix-goofys service
+  stat:
+    path: "{{ matrix_systemd_path }}/matrix-goofys.service"
+  register: matrix_goofys_service_stat
+
+- name: Ensure matrix-goofys is stopped
+  service:
+    name: matrix-goofys
+    state: stopped
+    daemon_reload: yes
+  register: stopping_result
+  when: "matrix_goofys_service_stat.stat.exists"
+
+- name: Ensure matrix-goofys.service doesn't exist
+  file:
+    path: "{{ matrix_systemd_path }}/matrix-goofys.service"
+    state: absent
+  when: "matrix_goofys_service_stat.stat.exists"
+
+- name: Ensure systemd reloaded after matrix-goofys.service removal
+  service:
+    daemon_reload: yes
+  when: "matrix_goofys_service_stat.stat.exists"
+
+- name: Ensure goofys environment variables file doesn't exist
+  file:
+    path: "{{ matrix_synapse_config_dir_path }}/env-goofys"
+    state: absent
+
+- name: Ensure Goofys Docker image doesn't exist
+  docker_image:
+    name: "{{ matrix_s3_goofys_docker_image }}"
+    state: absent

roles/matrix-synapse/tasks/import_media_store.yml

@@ -0,0 +1,83 @@
+---
+
+# Pre-checks
+
+- name: Fail if playbook called incorrectly
+  fail:
+    msg: "The `server_path_media_store` variable needs to be provided to this playbook, via --extra-vars"
+  when: "server_path_media_store is not defined or server_path_media_store.startswith('<')"
+
+- name: Fail if media store is on Amazon S3
+  fail:
+    msg: "Your media store is on Amazon S3. Due to technical limitations, restoring is not supported."
+  when: matrix_s3_media_store_enabled|bool
+
+- name: Check if the provided media store directory exists
+  stat:
+    path: "{{ server_path_media_store }}"
+  register: server_path_media_store_stat
+
+- name: Fail if provided media store directory doesn't exist on the server
+  fail:
+    msg: "{{ server_path_media_store }} cannot be found on the server"
+  when: "not server_path_media_store_stat.stat.exists or not server_path_media_store_stat.stat.isdir"
+
+- name: Check if media store contains local_content
+  stat:
+    path: "{{ server_path_media_store }}/local_content"
+  register: server_path_media_store_local_content_stat
+
+- name: Check if media store contains remote_content
+  stat:
+    path: "{{ server_path_media_store }}/remote_content"
+  register: server_path_media_store_remote_content_stat
+
+- name: Fail if media store directory doesn't look okay (lacking remote and local content)
+  fail:
+    msg: "{{ server_path_media_store }} contains neither local_content nor remote_content directories. It's most likely a mistake and is not a media store directory."
+  when: "not server_path_media_store_local_content_stat.stat.exists and not server_path_media_store_remote_content_stat.stat.exists"
+
+
+# Actual import work
+
+- name: Ensure matrix-synapse is stopped
+  service:
+    name: matrix-synapse
+    state: stopped
+    daemon_reload: yes
+  register: stopping_result
+
+# This can only work with local files, not if the media store is on Amazon S3,
+# as it won't be accessible in such a case.
+- name: Ensure provided media store directory is synchronized
+  synchronize:
+    src: "{{ server_path_media_store }}/"
+    dest: "{{ matrix_synapse_media_store_path }}"
+    delete: yes
+    # It's wasteful to preserve owner/group now. We chown below anyway.
+    owner: no
+    group: no
+    times: yes
+  delegate_to: "{{ inventory_hostname }}"
+
+# This is for the generic case and fails in other cases (remote file systems),
+# because in such cases the base path (matrix_synapse_media_store_path) is a mount point.
+- name: Ensure media store permissions are correct (generic case)
+  file:
+    path: "{{ matrix_synapse_media_store_path }}"
+    owner: "{{ matrix_user_username }}"
+    group: "{{ matrix_user_groupname }}"
+    recurse: yes
+  when: "not matrix_s3_media_store_enabled|bool"
+
+# We don't chown for Goofys, because due to the way it's mounted,
+# all files become owned by whoever needs to own them.
+
+- name: Ensure Synapse is started (if it previously was)
+  service:
+    name: "{{ item }}"
+    state: started
+    daemon_reload: yes
+  when: "stopping_result.changed"
+  with_items:
+    - matrix-synapse

roles/matrix-synapse/tasks/init.yml

@@ -0,0 +1,26 @@
+# See https://github.com/spantaleev/matrix-docker-ansible-deploy/issues/1070
+# and https://github.com/spantaleev/matrix-docker-ansible-deploy/commit/1ab507349c752042d26def3e95884f6df8886b74#commitcomment-51108407
+- name: Fail if trying to self-build on Ansible < 2.8
+  fail:
+    msg: "To self-build the Element image, you should use Ansible 2.8 or higher. See docs/ansible.md"
+  when: "ansible_version.major == 2 and ansible_version.minor < 8 and matrix_synapse_container_image_self_build and matrix_synapse_enabled"
+
+# Unless `matrix_synapse_workers_enabled_list` is explicitly defined,
+# we'll generate it dynamically.
+- import_tasks: "{{ role_path }}/tasks/synapse/workers/init.yml"
+  when: "matrix_synapse_enabled and matrix_synapse_workers_enabled and matrix_synapse_workers_enabled_list|length == 0"
+
+- set_fact:
+    matrix_systemd_services_list: "{{ matrix_systemd_services_list + ['matrix-synapse.service'] }}"
+  when: matrix_synapse_enabled|bool
+
+- name: Ensure systemd services for workers are injected
+  include_tasks: "{{ role_path }}/tasks/synapse/workers/util/inject_systemd_services_for_worker.yml"
+  with_items: "{{ matrix_synapse_workers_enabled_list }}"
+  loop_control:
+    loop_var: matrix_synapse_worker_details
+  when: matrix_synapse_enabled|bool and matrix_synapse_workers_enabled|bool
+
+- set_fact:
+    matrix_systemd_services_list: "{{ matrix_systemd_services_list + ['matrix-goofys.service'] }}"
+  when: matrix_s3_media_store_enabled|bool

roles/matrix-synapse/tasks/main.yml

@@ -0,0 +1,55 @@
+- import_tasks: "{{ role_path }}/tasks/init.yml"
+  tags:
+    - always
+
+- import_tasks: "{{ role_path }}/tasks/validate_config.yml"
+  when: run_setup|bool and matrix_synapse_enabled|bool
+  tags:
+    - setup-all
+    - setup-synapse
+
+- import_tasks: "{{ role_path }}/tasks/setup_synapse.yml"
+  when: run_setup|bool
+  tags:
+    - setup-all
+    - setup-synapse
+
+- import_tasks: "{{ role_path }}/tasks/import_media_store.yml"
+  when: run_synapse_import_media_store|bool
+  tags:
+    - import-synapse-media-store
+
+- import_tasks: "{{ role_path }}/tasks/register_user.yml"
+  when: run_synapse_register_user|bool
+  tags:
+    - register-user
+
+- import_tasks: "{{ role_path }}/tasks/self_check_client_api.yml"
+  delegate_to: 127.0.0.1
+  become: false
+  when: run_self_check|bool
+  tags:
+    - self-check
+
+- import_tasks: "{{ role_path }}/tasks/self_check_federation_api.yml"
+  delegate_to: 127.0.0.1
+  become: false
+  when: run_self_check|bool
+  tags:
+    - self-check
+
+- import_tasks: "{{ role_path }}/tasks/update_user_password.yml"
+  when: run_synapse_update_user_password|bool
+  tags:
+    - update-user-password
+
+- import_tasks: "{{ role_path }}/tasks/rust-synapse-compress-state/main.yml"
+  when: run_synapse_rust_synapse_compress_state|bool
+  tags:
+    - rust-synapse-compress-state
+
+- name: Mark matrix-synapse role as executed
+  set_fact:
+    matrix_synapse_role_executed: true
+  tags:
+   - always

roles/matrix-synapse/tasks/register_user.yml

@@ -0,0 +1,31 @@
+---
+
+- name: Fail if playbook called incorrectly
+  fail:
+    msg: "The `username` variable needs to be provided to this playbook, via --extra-vars"
+  when: "username is not defined or username == '<your-username>'"
+
+- name: Fail if playbook called incorrectly
+  fail:
+    msg: "The `password` variable needs to be provided to this playbook, via --extra-vars"
+  when: "password is not defined or password == '<your-password>'"
+
+- name: Fail if playbook called incorrectly
+  fail:
+    msg: "The `admin` variable needs to be provided to this playbook, via --extra-vars"
+  when: "admin is not defined or admin not in ['yes', 'no']"
+
+- name: Ensure matrix-synapse is started
+  service:
+    name: matrix-synapse
+    state: started
+    daemon_reload: yes
+  register: start_result
+
+- name: Wait a while, so that Synapse can manage to start
+  pause:
+    seconds: 7
+  when: "start_result.changed"
+
+- name: Register user
+  command: "{{ matrix_local_bin_path }}/matrix-synapse-register-user {{ username|quote }} {{ password|quote }} {{ '1' if admin == 'yes' else '0' }}"

roles/matrix-synapse/tasks/rust-synapse-compress-state/compress_room.yml

@@ -0,0 +1,48 @@
+- debug:
+    msg: "Compressing room `{{ room_details.room_id }}` having {{ room_details.count }} state group rows"
+
+- name: Generate rust-synapse-compress-state room compression command
+  set_fact:
+    matrix_synapse_rust_synapse_compress_state_compress_room_command: >-
+      {{ matrix_host_command_docker }} run --rm --name matrix-rust-synapse-compress-state-compress-room
+      --user={{ matrix_user_uid }}:{{ matrix_user_gid }}
+      --cap-drop=ALL
+      --network={{ matrix_docker_network }}
+      --mount type=bind,src={{ matrix_synapse_rust_synapse_compress_state_base_path }},dst=/work
+      {{ matrix_synapse_rust_synapse_compress_state_docker_image }}
+      /synapse-compress-state -t -o /work/state-compressor.sql
+      -p "host={{ matrix_synapse_database_host }} user={{ matrix_synapse_database_user }} password={{ matrix_synapse_database_password }} dbname={{ matrix_synapse_database_database }}"
+      -r '{{ room_details.room_id }}'
+
+- name: Run rust-synapse-compress-state room compression command (SQL generation)
+  command: "{{ matrix_synapse_rust_synapse_compress_state_compress_room_command }}"
+  async: "{{ matrix_synapse_rust_synapse_compress_state_compress_room_time }}"
+  poll: 10
+  register: matrix_synapse_rust_synapse_compress_state_compress_room_command_result
+
+- debug: var="matrix_synapse_rust_synapse_compress_state_compress_room_command_result"
+
+- name: Generate Postgres compression SQL import command
+  set_fact:
+    matrix_synapse_rust_synapse_compress_state_psql_import_command: >-
+      {{ matrix_host_command_docker }} run --rm --name matrix-rust-synapse-compress-state-psql-import
+      --user={{ matrix_user_uid }}:{{ matrix_user_gid }}
+      --cap-drop=ALL
+      --network={{ matrix_docker_network }}
+      --env-file={{ matrix_postgres_base_path }}/env-postgres-psql
+      --mount type=bind,src={{ matrix_synapse_rust_synapse_compress_state_base_path }},dst=/work,ro
+      --entrypoint=/bin/sh
+      {{ matrix_postgres_docker_image_latest }}
+      -c "cat /work/state-compressor.sql |
+      psql -v ON_ERROR_STOP=1 -h matrix-postgres -d {{ matrix_synapse_database_database }}"
+
+- name: Import compression SQL into Postgres
+  command: "{{ matrix_synapse_rust_synapse_compress_state_psql_import_command }}"
+  async: "{{ matrix_synapse_rust_synapse_compress_state_psql_import_time }}"
+  poll: 10
+  register: matrix_synapse_rust_synapse_compress_state_psql_import_command_result
+
+- name: Clean up
+  file:
+    path: "{{ matrix_synapse_rust_synapse_compress_state_base_path }}/state-compressor.sql"
+    state: absent

roles/matrix-synapse/tasks/rust-synapse-compress-state/main.yml

@@ -0,0 +1,118 @@
+# Pre-checks
+
+- name: Fail if Postgres not enabled
+  fail:
+    msg: "Postgres via the matrix-postgres role is not enabled (`matrix_postgres_enabled`). Cannot use rust-synapse-compress-state."
+  when: "not matrix_postgres_enabled|bool"
+
+
+# Defaults
+
+- name: Set matrix_synapse_rust_synapse_compress_state_find_rooms_command_wait_time, if not provided
+  set_fact:
+    matrix_synapse_rust_synapse_compress_state_find_rooms_command_wait_time: 300
+  when: "matrix_synapse_rust_synapse_compress_state_find_rooms_command_wait_time|default('') == ''"
+
+- name: Set matrix_synapse_rust_synapse_compress_state_compress_room_time, if not provided
+  set_fact:
+    matrix_synapse_rust_synapse_compress_state_compress_room_time: 1800
+  when: "matrix_synapse_rust_synapse_compress_state_compress_room_time|default('') == ''"
+
+- name: Set matrix_synapse_rust_synapse_compress_state_psql_import_time, if not provided
+  set_fact:
+    matrix_synapse_rust_synapse_compress_state_psql_import_time: 1800
+  when: "matrix_synapse_rust_synapse_compress_state_psql_import_time|default('') == ''"
+
+- name: Set matrix_synapse_rust_synapse_compress_state_min_state_groups_required, if not provided
+  set_fact:
+    # The minimum number of state groups we're looking for before we consider a room eligible for compression.
+    # Rooms with a smaller state groups count will not be compressed.
+    matrix_synapse_rust_synapse_compress_state_min_state_groups_required: 100000
+  when: "matrix_synapse_rust_synapse_compress_state_min_state_groups_required|default('') == ''"
+
+
+# Actual compression work
+
+- name: Ensure rust-synapse-compress-state paths exist
+  file:
+    path: "{{ matrix_synapse_rust_synapse_compress_state_base_path }}"
+    state: directory
+    mode: 0750
+    owner: "{{ matrix_user_username }}"
+    group: "{{ matrix_user_groupname }}"
+
+- name: Ensure rust-synapse-compress-state image is pulled
+  docker_image:
+    name: "{{ matrix_synapse_rust_synapse_compress_state_docker_image }}"
+    source: "{{ 'pull' if ansible_version.major > 2 or ansible_version.minor > 7 else omit }}"
+    force_source: "{{ matrix_synapse_rust_synapse_compress_state_docker_image_force_pull if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}"
+    force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else matrix_synapse_rust_synapse_compress_state_docker_image_force_pull }}"
+
+- name: Generate rust-synapse-compress-state room find command
+  set_fact:
+    matrix_synapse_rust_synapse_compress_state_find_rooms_command: >-
+      {{ matrix_host_command_docker }} run --rm --name matrix-rust-synapse-compress-state-find-rooms
+      --user={{ matrix_user_uid }}:{{ matrix_user_gid }}
+      --cap-drop=ALL
+      --network={{ matrix_docker_network }}
+      --env-file={{ matrix_postgres_base_path }}/env-postgres-psql
+      {{ matrix_postgres_docker_image_latest }}
+      psql -v ON_ERROR_STOP=1 -h matrix-postgres {{ matrix_synapse_database_database }} -c
+      'SELECT array_to_json(array_agg(row_to_json (r))) FROM (SELECT room_id, count(*) AS count FROM state_groups_state GROUP BY room_id HAVING count(*) > {{ matrix_synapse_rust_synapse_compress_state_min_state_groups_required }} ORDER BY count DESC) r;'
+
+- name: Find rooms eligible for compression with rust-synapse-compress-state
+  command: "{{ matrix_synapse_rust_synapse_compress_state_find_rooms_command }}"
+  async: "{{ matrix_synapse_rust_synapse_compress_state_find_rooms_command_wait_time }}"
+  poll: 10
+  register: matrix_synapse_rust_synapse_compress_state_find_rooms_command_result
+
+# We expect the output to be like this:
+#
+# "stdout_lines": [
+#     "                                                       array_to_json                                                        ",
+#     "----------------------------------------------------------------------------------------------------------------------------",
+#     " [{\"room_id\":\"!some-id\",\"count\":2461329},{\"room_id\":\"!another-id\",\"count\":512017}]",
+#     "(1 row)"
+# ]
+#
+# Row 3 (out of 4) contains the actual result.
+#
+# Row 3 contains a space when there's no result.
+
+- block:
+  - debug: var="matrix_synapse_rust_synapse_compress_state_find_rooms_command_result"
+
+  - name: Fail if room find result is not what we expect
+    fail:
+      msg: >-
+        Expecting 4 lines in the "find rooms" result.
+  when: "matrix_synapse_rust_synapse_compress_state_find_rooms_command_result.failed or matrix_synapse_rust_synapse_compress_state_find_rooms_command_result.stdout_lines|length != 4"
+
+- block:
+    # matrix_synapse_rust_synapse_compress_state_eligible_rooms is a list
+    # of dictionaries like this: {'room_id': '!some-id', 'count': 2461329}
+    - set_fact:
+        matrix_synapse_rust_synapse_compress_state_eligible_rooms: "{{ matrix_synapse_rust_synapse_compress_state_find_rooms_command_result.stdout_lines[2] | from_json }}"
+
+    - name: Display rooms that will be compressed
+      debug:
+        msg: >-
+          The following rooms contain more than {{ matrix_synapse_rust_synapse_compress_state_min_state_groups_required }} state group rows
+          (configurable via `matrix_synapse_rust_synapse_compress_state_min_state_groups_required`)
+          and will be compressed:
+          {{ matrix_synapse_rust_synapse_compress_state_eligible_rooms }}
+
+    - name: Compress room state
+      include_tasks: "{{ role_path }}/tasks/rust-synapse-compress-state/compress_room.yml"
+      with_items: "{{ matrix_synapse_rust_synapse_compress_state_eligible_rooms }}"
+      loop_control:
+        loop_var: room_details
+  when: "matrix_synapse_rust_synapse_compress_state_find_rooms_command_result.stdout_lines[2] != ' '"
+
+- name: Show notice about lack of rooms to compress
+  debug:
+    msg: >-
+      No rooms were found to contain more than {{ matrix_synapse_rust_synapse_compress_state_min_state_groups_required }} state group rows
+      (configurable via `matrix_synapse_rust_synapse_compress_state_min_state_groups_required`),
+      so there's nothing to compress.
+  when: "matrix_synapse_rust_synapse_compress_state_find_rooms_command_result.stdout_lines[2] == ' '"

roles/matrix-synapse/tasks/self_check_client_api.yml

@@ -0,0 +1,21 @@
+---
+
+- name: Check Matrix Client API
+  uri:
+    url: "{{ matrix_synapse_client_api_url_endpoint_public }}"
+    follow_redirects: none
+    validate_certs: "{{ matrix_synapse_self_check_validate_certificates }}"
+  register: result_matrix_synapse_client_api
+  ignore_errors: true
+  check_mode: no
+  when: matrix_synapse_enabled|bool
+
+- name: Fail if Matrix Client API not working
+  fail:
+    msg: "Failed checking Matrix Client API is up at `{{ matrix_server_fqn_matrix }}` (checked endpoint: `{{ matrix_synapse_client_api_url_endpoint_public }}`). Is Synapse running? Is port 443 open in your firewall? Full error: {{ result_matrix_synapse_client_api }}"
+  when: "matrix_synapse_enabled|bool and (result_matrix_synapse_client_api.failed or 'json' not in result_matrix_synapse_client_api)"
+
+- name: Report working Matrix Client API
+  debug:
+    msg: "The Matrix Client API at `{{ matrix_server_fqn_matrix }}` (checked endpoint: `{{ matrix_synapse_client_api_url_endpoint_public }}`) is working"
+  when: matrix_synapse_enabled|bool

roles/matrix-synapse/tasks/self_check_federation_api.yml

@@ -0,0 +1,26 @@
+---
+
+- name: Check Matrix Federation API
+  uri:
+    url: "{{ matrix_synapse_federation_api_url_endpoint_public }}"
+    follow_redirects: none
+    validate_certs: "{{ matrix_synapse_self_check_validate_certificates }}"
+  register: result_matrix_synapse_federation_api
+  ignore_errors: true
+  check_mode: no
+  when: matrix_synapse_enabled|bool
+
+- name: Fail if Matrix Federation API not working
+  fail:
+    msg: "Failed checking Matrix Federation API is up at `{{ matrix_server_fqn_matrix }}` (checked endpoint: `{{ matrix_synapse_federation_api_url_endpoint_public }}`). Is Synapse running? Is port {{ matrix_federation_public_port }} open in your firewall? Full error: {{ result_matrix_synapse_federation_api }}"
+  when: "matrix_synapse_enabled|bool and matrix_synapse_federation_enabled|bool and (result_matrix_synapse_federation_api.failed or 'json' not in result_matrix_synapse_federation_api)"
+
+- name: Fail if Matrix Federation API unexpectedly enabled
+  fail:
+      msg: "Matrix Federation API is up at `{{ matrix_server_fqn_matrix }}` (checked endpoint: `{{ matrix_synapse_federation_api_url_endpoint_public }}`) despite being disabled."
+  when: "matrix_synapse_enabled|bool and not matrix_synapse_federation_enabled|bool and not result_matrix_synapse_federation_api.failed"
+
+- name: Report working Matrix Federation API
+  debug:
+    msg: "The Matrix Federation API at `{{ matrix_server_fqn_matrix }}` (checked endpoint: `{{ matrix_synapse_federation_api_url_endpoint_public }}`) is working"
+  when: "matrix_synapse_enabled|bool and matrix_synapse_federation_enabled|bool"

roles/matrix-synapse/tasks/setup_synapse.yml

@@ -0,0 +1,25 @@
+---
+
+- name: Ensure Synapse paths exist
+  file:
+    path: "{{ item.path }}"
+    state: directory
+    mode: 0750
+    owner: "{{ matrix_user_username }}"
+    group: "{{ matrix_user_groupname }}"
+  with_items:
+    - { path: "{{ matrix_synapse_config_dir_path }}", when: true }
+    - { path: "{{ matrix_synapse_ext_path }}", when: true }
+    - { path: "{{ matrix_synapse_docker_src_files_path }}", when: "{{ matrix_synapse_container_image_self_build }}" }
+    # We handle matrix_synapse_media_store_path elsewhere (in ./synapse/setup_install.yml),
+    # because if it's using Goofys and it's already mounted (from before),
+    # trying to chown/chmod it here will cause trouble.
+  when: "(matrix_synapse_enabled|bool or matrix_s3_media_store_enabled|bool) and item.when"
+
+- import_tasks: "{{ role_path }}/tasks/ext/setup.yml"
+
+- import_tasks: "{{ role_path }}/tasks/synapse/workers/setup.yml"
+
+- import_tasks: "{{ role_path }}/tasks/synapse/setup.yml"
+
+- import_tasks: "{{ role_path }}/tasks/goofys/setup.yml"

roles/matrix-synapse/tasks/synapse/setup.yml

@@ -0,0 +1,7 @@
+---
+
+- import_tasks: "{{ role_path }}/tasks/synapse/setup_install.yml"
+  when: matrix_synapse_enabled|bool
+
+- import_tasks: "{{ role_path }}/tasks/synapse/setup_uninstall.yml"
+  when: "not matrix_synapse_enabled|bool"

roles/matrix-synapse/tasks/synapse/setup_install.yml

@@ -0,0 +1,109 @@
+---
+
+# This will throw a Permission Denied error if already mounted using fuse
+- name: Check Synapse media store path
+  stat:
+    path: "{{ matrix_synapse_media_store_path }}"
+  register: local_path_media_store_stat
+  ignore_errors: yes
+
+# This is separate and conditional, to ensure we don't execute it
+# if the path already exists or we failed to check, because it's mounted using fuse.
+- name: Ensure Synapse media store path exists
+  file:
+    path: "{{ matrix_synapse_media_store_path }}"
+    state: directory
+    mode: 0750
+    owner: "{{ matrix_user_username }}"
+    group: "{{ matrix_user_groupname }}"
+  when: "not local_path_media_store_stat.failed and not local_path_media_store_stat.stat.exists"
+
+- name: Ensure Synapse repository is present on self-build
+  git:
+    repo: "{{ matrix_synapse_container_image_self_build_repo }}"
+    dest: "{{ matrix_synapse_docker_src_files_path }}"
+    version: "{{ matrix_synapse_docker_image.split(':')[1] }}"
+    force: "yes"
+  register: matrix_synapse_git_pull_results
+  when: "matrix_synapse_container_image_self_build|bool"
+
+- name: Ensure Synapse Docker image is built
+  docker_image:
+    name: "{{ matrix_synapse_docker_image }}"
+    source: build
+    force_source: "{{ matrix_synapse_git_pull_results.changed if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}"
+    force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else matrix_synapse_git_pull_results.changed }}"
+    build:
+      dockerfile: docker/Dockerfile
+      path: "{{ matrix_synapse_docker_src_files_path }}"
+      pull: yes
+  when: "matrix_synapse_container_image_self_build|bool"
+
+- name: Ensure Synapse Docker image is pulled
+  docker_image:
+    name: "{{ matrix_synapse_docker_image }}"
+    source: "{{ 'pull' if ansible_version.major > 2 or ansible_version.minor > 7 else omit }}"
+    force_source: "{{ matrix_synapse_docker_image_force_pull if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}"
+    force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else matrix_synapse_docker_image_force_pull }}"
+  when: "not matrix_synapse_container_image_self_build"
+
+- name: Check if a Synapse signing key exists
+  stat:
+    path: "{{ matrix_synapse_config_dir_path }}/{{ matrix_server_fqn_matrix }}.signing.key"
+  register: matrix_synapse_signing_key_stat
+
+# We do this so that the signing key would get generated.
+#
+# This will also generate a default homeserver.yaml configuration file and a log configuration file.
+# We don't care about those configuraiton files, as we replace them with our own anyway (see below).
+#
+# We don't use the `docker_container` module, because using it with `cap_drop` requires
+# a very recent version, which is not available for a lot of people yet.
+- name: Generate initial Synapse config and signing key
+  command: |
+    docker run
+    --rm
+    --name=matrix-config
+    --user={{ matrix_user_uid }}:{{ matrix_user_gid }}
+    --cap-drop=ALL
+    --mount type=bind,src={{ matrix_synapse_config_dir_path }},dst=/data
+    -e UID={{ matrix_user_uid }}
+    -e GID={{ matrix_user_gid }}
+    -e SYNAPSE_CONFIG_PATH=/data/homeserver.yaml
+    -e SYNAPSE_SERVER_NAME={{ matrix_server_fqn_matrix }}
+    -e SYNAPSE_REPORT_STATS=no
+    {{ matrix_synapse_docker_image }}
+    generate
+  when: "not matrix_synapse_signing_key_stat.stat.exists"
+
+- name: Ensure Synapse homeserver config installed
+  copy:
+    content: "{{ matrix_synapse_configuration|to_nice_yaml }}"
+    dest: "{{ matrix_synapse_config_dir_path }}/homeserver.yaml"
+    mode: 0644
+    owner: "{{ matrix_user_username }}"
+    group: "{{ matrix_user_groupname }}"
+
+- name: Ensure Synapse log config installed
+  template:
+    src: "{{ matrix_synapse_template_synapse_log }}"
+    dest: "{{ matrix_synapse_config_dir_path }}/{{ matrix_server_fqn_matrix }}.log.config"
+    mode: 0644
+
+- name: Ensure matrix-synapse.service installed
+  template:
+    src: "{{ role_path }}/templates/synapse/systemd/matrix-synapse.service.j2"
+    dest: "{{ matrix_systemd_path }}/matrix-synapse.service"
+    mode: 0644
+  register: matrix_synapse_systemd_service_result
+
+- name: Ensure systemd reloaded after matrix-synapse.service installation
+  service:
+    daemon_reload: yes
+  when: "matrix_synapse_systemd_service_result.changed"
+
+- name: Ensure matrix-synapse-register-user script created
+  template:
+    src: "{{ role_path }}/templates/synapse/usr-local-bin/matrix-synapse-register-user.j2"
+    dest: "{{ matrix_local_bin_path }}/matrix-synapse-register-user"
+    mode: 0755

roles/matrix-synapse/tasks/synapse/setup_uninstall.yml

@@ -0,0 +1,28 @@
+- name: Check existence of matrix-synapse service
+  stat:
+    path: "{{ matrix_systemd_path }}/matrix-synapse.service"
+  register: matrix_synapse_service_stat
+
+- name: Ensure matrix-synapse is stopped
+  service:
+    name: matrix-synapse
+    state: stopped
+    daemon_reload: yes
+  register: stopping_result
+  when: "matrix_synapse_service_stat.stat.exists"
+
+- name: Ensure matrix-synapse.service doesn't exist
+  file:
+    path: "{{ matrix_systemd_path }}/matrix-synapse.service"
+    state: absent
+  when: "matrix_synapse_service_stat.stat.exists"
+
+- name: Ensure systemd reloaded after matrix-synapse.service removal
+  service:
+    daemon_reload: yes
+  when: "matrix_synapse_service_stat.stat.exists"
+
+- name: Ensure Synapse Docker image doesn't exist
+  docker_image:
+    name: "{{ matrix_synapse_docker_image }}"
+    state: absent

roles/matrix-synapse/tasks/synapse/workers/init.yml

@@ -0,0 +1,86 @@
+# Below is a huge hack for dynamically building a list of workers and finally assigning it to `matrix_synapse_workers_enabled_list`.
+#
+# set_fact within a loop does not work reliably in Ansible (it only executes on the first iteration for some reason),
+# so we're forced to do something much uglier.
+
+- name: Build generic workers
+  set_fact:
+    worker:
+      type: 'generic_worker'
+      instanceId: "{{ matrix_synapse_workers_generic_workers_port_range_start + item }}"
+      port: "{{ matrix_synapse_workers_generic_workers_port_range_start + item }}"
+      metrics_port: "{{ matrix_synapse_workers_generic_workers_metrics_range_start + item }}"
+  register: "matrix_synapse_workers_list_results_generic_workers"
+  loop: "{{ range(0, matrix_synapse_workers_generic_workers_count|int)|list }}"
+
+- name: Build federation sender workers
+  set_fact:
+    worker:
+      type: 'federation_sender'
+      instanceId: "{{ item }}"
+      port: 0
+      metrics_port: "{{ matrix_synapse_workers_federation_sender_workers_metrics_range_start + item }}"
+  register: "matrix_synapse_workers_list_results_federation_sender_workers"
+  loop: "{{ range(0, matrix_synapse_workers_federation_sender_workers_count|int)|list }}"
+
+# This type of worker can only have a count of 1, at most
+- name: Build pusher workers
+  set_fact:
+    worker:
+      type: 'pusher'
+      instanceId: "{{ item }}"
+      port: 0
+      metrics_port: "{{ matrix_synapse_workers_pusher_workers_metrics_range_start + item }}"
+  register: "matrix_synapse_workers_list_results_pusher_workers"
+  loop: "{{ range(0, matrix_synapse_workers_pusher_workers_count|int)|list }}"
+
+# This type of worker can only have a count of 1, at most
+- name: Build appservice workers
+  set_fact:
+    worker:
+      type: 'appservice'
+      instanceId: "{{ item }}"
+      port: 0
+      metrics_port: "{{ matrix_synapse_workers_appservice_workers_metrics_range_start + item }}"
+  register: "matrix_synapse_workers_list_results_appservice_workers"
+  loop: "{{ range(0, matrix_synapse_workers_appservice_workers_count|int)|list }}"
+
+- name: Build media_repository workers
+  set_fact:
+    worker:
+      type: 'media_repository'
+      instanceId: "{{ matrix_synapse_workers_media_repository_workers_port_range_start + item }}"
+      port: "{{ matrix_synapse_workers_media_repository_workers_port_range_start + item }}"
+      metrics_port: "{{ matrix_synapse_workers_media_repository_workers_metrics_range_start + item }}"
+  register: "matrix_synapse_workers_list_results_media_repository_workers"
+  loop: "{{ range(0, matrix_synapse_workers_media_repository_workers_count|int)|list }}"
+
+- name: Build frontend_proxy workers
+  set_fact:
+    worker:
+      type: 'frontend_proxy'
+      instanceId: "{{ matrix_synapse_workers_frontend_proxy_workers_port_range_start + item }}"
+      port: "{{ matrix_synapse_workers_frontend_proxy_workers_port_range_start + item }}"
+      metrics_port: "{{ matrix_synapse_workers_frontend_proxy_workers_metrics_range_start + item }}"
+  register: "matrix_synapse_workers_list_results_frontend_proxy_workers"
+  loop: "{{ range(0, matrix_synapse_workers_frontend_proxy_workers_count|int)|list }}"
+
+- set_fact:
+    matrix_synapse_dynamic_workers_list: "{{ matrix_synapse_dynamic_workers_list|default([]) + [item.ansible_facts.worker] }}"
+  with_items: |
+    {{
+      matrix_synapse_workers_list_results_generic_workers.results
+      +
+      matrix_synapse_workers_list_results_federation_sender_workers.results
+      +
+      matrix_synapse_workers_list_results_pusher_workers.results
+      +
+      matrix_synapse_workers_list_results_appservice_workers.results
+      +
+      matrix_synapse_workers_list_results_media_repository_workers.results
+      +
+      matrix_synapse_workers_list_results_frontend_proxy_workers.results
+    }}
+
+- set_fact:
+    matrix_synapse_workers_enabled_list: "{{ matrix_synapse_dynamic_workers_list }}"

roles/matrix-synapse/tasks/synapse/workers/setup.yml

@@ -0,0 +1,21 @@
+---
+
+# A previous version of the worker setup used this.
+# This is a temporary cleanup for people who ran that version.
+- name: Ensure old matrix-synapse.service.wants directory is gone
+  file:
+    path: "{{ matrix_systemd_path }}/matrix-synapse.service.wants"
+    state: absent
+
+# Same. This was part of a previous version of the worker setup.
+# No longer necessary.
+- name: Ensure matrix-synapse-worker-write-pid script is removed
+  file:
+    path: "{{ matrix_local_bin_path }}/matrix-synapse-worker-write-pid"
+    state: absent
+
+- include_tasks: "{{ role_path }}/tasks/synapse/workers/setup_install.yml"
+  when: "matrix_synapse_enabled|bool and matrix_synapse_workers_enabled|bool"
+
+- include_tasks: "{{ role_path }}/tasks/synapse/workers/setup_uninstall.yml"
+  when: "not matrix_synapse_workers_enabled|bool"

roles/matrix-synapse/tasks/synapse/workers/setup_install.yml

@@ -0,0 +1,42 @@
+---
+
+- name: Determine current worker configs
+  find:
+    path: "{{ matrix_synapse_config_dir_path }}"
+    patterns: "worker.*.yaml"
+    use_regex: true
+  register: matrix_synapse_workers_current_config_files
+
+# This also deletes some things which we need. They will be recreated below.
+- name: Ensure previous worker configs are cleaned
+  file:
+    path: "{{ item.path }}"
+    state: absent
+  with_items: "{{ matrix_synapse_workers_current_config_files.files }}"
+
+- name: Determine current worker systemd services
+  find:
+    path: "{{ matrix_systemd_path }}"
+    patterns: "matrix-synapse-worker.*.service"
+    use_regex: true
+  register: matrix_synapse_workers_current_systemd_services
+
+- name: Ensure unnecessary worker systemd services are stopped and disabled
+  service:
+    name: "{{ item.path|basename }}"
+    state: stopped
+    enabled: false
+  with_items: "{{ matrix_synapse_workers_current_systemd_services.files }}"
+  when: "not ansible_check_mode and item.path|basename not in matrix_systemd_services_list"
+
+- name: Ensure unnecessary worker systemd services are cleaned
+  file:
+    path: "{{ item.path }}"
+    state: absent
+  with_items: "{{ matrix_synapse_workers_current_systemd_services.files }}"
+
+- name: Ensure creation of worker systemd service files and configuration files
+  include_tasks: "{{ role_path }}/tasks/synapse/workers/util/setup_files_for_worker.yml"
+  with_items: "{{ matrix_synapse_workers_enabled_list }}"
+  loop_control:
+    loop_var: matrix_synapse_worker_details

roles/matrix-synapse/tasks/synapse/workers/setup_uninstall.yml

@@ -0,0 +1,36 @@
+---
+
+- name: Populate service facts
+  service_facts:
+
+- name: Ensure any worker services are stopped
+  service:
+    name: "{{ item.key }}"
+    state: stopped
+  with_dict: "{{ ansible_facts.services|default({})|dict2items|selectattr('key', 'match', 'matrix-synapse-worker-.+\\.service')|list|items2dict }}"
+
+- name: Find worker configs to be cleaned
+  find:
+    path: "{{ matrix_synapse_config_dir_path }}"
+    patterns: "worker.*.yaml"
+    use_regex: true
+  register: matrix_synapse_workers_current_config_files
+
+- name: Ensure previous worker configs are cleaned
+  file:
+    path: "{{ item.path }}"
+    state: absent
+  with_items: "{{ matrix_synapse_workers_current_config_files.files }}"
+
+- name: Find worker systemd services to be cleaned
+  find:
+    path: "{{ matrix_systemd_path }}"
+    patterns: "matrix-synapse-worker.*.service"
+    use_regex: true
+  register: matrix_synapse_workers_current_systemd_services
+
+- name: Ensure previous worker systemd services are cleaned
+  file:
+    path: "{{ item.path }}"
+    state: absent
+  with_items: "{{ matrix_synapse_workers_current_systemd_services.files }}"

roles/matrix-synapse/tasks/synapse/workers/util/inject_systemd_services_for_worker.yml

@@ -0,0 +1,18 @@
+# The tasks below run before `validate_config.yml`.
+# To avoid failing with a cryptic error message, we'll do validation here.
+#
+# This check is mostly relevant to people who explicitly define `matrix_synapse_workers_enabled_list`
+# (Synapse Workers users from the earlier days of this PR - https://github.com/spantaleev/matrix-docker-ansible-deploy/pull/456).
+#
+# In the future, it should be possible to remove this check.
+# Our own code which dynamically builds `matrix_synapse_workers_enabled_list` does things right.
+- name: Fail if instanceId not defined for worker
+  fail:
+    msg: "Synapse workers (like {{ matrix_synapse_worker_details|to_json }}) need to define an instanceId property (type + instanceId must be unique)"
+  when: "'instanceId' not in matrix_synapse_worker_details"
+
+- set_fact:
+    matrix_synapse_worker_systemd_service_name: "matrix-synapse-worker-{{ matrix_synapse_worker_details.type }}-{{ matrix_synapse_worker_details.instanceId }}.service"
+
+- set_fact:
+    matrix_systemd_services_list: "{{ matrix_systemd_services_list + [matrix_synapse_worker_systemd_service_name] }}"

roles/matrix-synapse/tasks/synapse/workers/util/setup_files_for_worker.yml

@@ -0,0 +1,19 @@
+- set_fact:
+    matrix_synapse_worker_systemd_service_name: "matrix-synapse-worker-{{ matrix_synapse_worker_details.type }}-{{ matrix_synapse_worker_details.instanceId }}"
+
+- set_fact:
+    matrix_synapse_worker_container_name: "{{ matrix_synapse_worker_systemd_service_name }}"
+
+- set_fact:
+    matrix_synapse_worker_config_file_name: "worker.{{ matrix_synapse_worker_details.type }}_{{ matrix_synapse_worker_details.instanceId }}.yaml"
+
+- name: Ensure configuration exists for {{ matrix_synapse_worker_systemd_service_name }}
+  template:
+    src: "{{ role_path }}/templates/synapse/worker.yaml.j2"
+    dest: "{{ matrix_synapse_config_dir_path }}/{{ matrix_synapse_worker_config_file_name }}"
+
+- name: Ensure systemd service exists for {{ matrix_synapse_worker_systemd_service_name }}
+  template:
+    src: "{{ role_path }}/templates/synapse/systemd/matrix-synapse-worker.service.j2"
+    dest: "{{ matrix_systemd_path }}/{{ matrix_synapse_worker_systemd_service_name }}.service"
+    mode: 0644

roles/matrix-synapse/tasks/update_user_password.yml

@@ -0,0 +1,43 @@
+---
+
+- name: Fail if playbook called incorrectly
+  fail:
+    msg: "The `username` variable needs to be provided to this playbook, via --extra-vars"
+  when: "username is not defined or username == '<your-username>'"
+
+- name: Fail if playbook called incorrectly
+  fail:
+    msg: "The `password` variable needs to be provided to this playbook, via --extra-vars"
+  when: "password is not defined or password == '<your-password>'"
+
+- name: Fail if not using matrix-postgres container
+  fail:
+    msg: "This command is working only when matrix-postgres container is being used"
+  when: "not matrix_postgres_enabled|bool"
+
+- name: Ensure matrix-synapse is started
+  service:
+    name: matrix-synapse
+    state: started
+    daemon_reload: yes
+  register: start_result
+
+- name: Ensure matrix-postgres is started
+  service:
+    name: matrix-postgres
+    state: started
+    daemon_reload: yes
+  register: postgres_start_result
+
+
+- name: Wait a while, so that Matrix Synapse can manage to start
+  pause:
+    seconds: 7
+  when: "start_result.changed or postgres_start_result.changed"
+
+- name: Generate password hash
+  shell: "{{ matrix_host_command_docker }} exec matrix-synapse /usr/local/bin/hash_password -c /data/homeserver.yaml -p {{ password|quote }}"
+  register: password_hash
+
+- name: Update user password hash
+  command: "{{ matrix_local_bin_path }}/matrix-postgres-update-user-password-hash {{ username|quote }} {{ password_hash.stdout|quote }}"

roles/matrix-synapse/tasks/validate_config.yml

@@ -0,0 +1,59 @@
+---
+
+- name: Fail if required Synapse settings not defined
+  fail:
+    msg: >-
+      You need to define a required configuration setting (`{{ item }}`) for using Synapse.
+  when: "vars[item] == ''"
+  with_items:
+    - "matrix_synapse_macaroon_secret_key"
+    - "matrix_synapse_database_host"
+    - "matrix_synapse_database_user"
+    - "matrix_synapse_database_password"
+    - "matrix_synapse_database_database"
+
+- name: Fail if asking for more than 1 instance of single-instance workers
+  fail:
+    msg: >-
+      `{{ item }}` cannot be more than 1. This is a single-instance worker.
+  when: "vars[item]|int > 1"
+  with_items:
+    - "matrix_synapse_workers_appservice_workers_count"
+    - "matrix_synapse_workers_pusher_workers_count"
+    - "matrix_synapse_workers_federation_sender_workers_count"
+
+- name: (Deprecation) Catch and report renamed settings
+  fail:
+    msg: >-
+      Your configuration contains a variable, which now has a different name.
+      Please change your configuration to rename the variable (`{{ item.old }}` -> `{{ item.new }}`).
+  when: "item.old in vars"
+  with_items:
+    - {'old': 'matrix_synapse_email_riot_base_url', 'new': '<superseded by client_base_url>'}
+    - {'old': 'matrix_synapse_container_expose_api_port', 'new': '<superseded by matrix_synapse_container_federation_api_plain_host_bind_port>'}
+    - {'old': 'matrix_synapse_no_tls', 'new': '<removed>'}
+    - {'old': 'matrix_enable_room_list_search', 'new': 'matrix_synapse_enable_room_list_search'}
+    - {'old': 'matrix_alias_creation_rules', 'new': 'matrix_synapse_alias_creation_rules'}
+    - {'old': 'matrix_room_list_publication_rules', 'new': 'matrix_synapse_room_list_publication_rules'}
+    - {'old': 'matrix_synapse_rc_messages_per_second', 'new': '<per_second subkey of matrix_synapse_rc_message>'}
+    - {'old': 'matrix_synapse_rc_message_burst_count', 'new': '<burst_count subkey of matrix_synapse_rc_message>'}
+    - {'old': 'matrix_synapse_federation_rc_window_size', 'new': '<window_size subkey of matrix_synapse_rc_federation>'}
+    - {'old': 'matrix_synapse_federation_rc_sleep_limit', 'new': '<sleep_limit subkey of matrix_synapse_rc_federation>'}
+    - {'old': 'matrix_synapse_federation_rc_sleep_delay', 'new': '<sleep_delay subkey of matrix_synapse_rc_federation>'}
+    - {'old': 'matrix_synapse_federation_rc_reject_limit', 'new': '<reject_limit subkey of matrix_synapse_rc_federation>'}
+    - {'old': 'matrix_synapse_federation_rc_concurrent', 'new': '<concurrent subkey of matrix_synapse_rc_federation>'}
+    - {'old': 'matrix_synapse_container_expose_client_api_port', 'new': '<superseded by matrix_synapse_container_client_api_host_bind_port>'}
+    - {'old': 'matrix_synapse_container_expose_federation_api_port', 'new': '<superseded by matrix_synapse_container_federation_api_plain_host_bind_port>'}
+    - {'old': 'matrix_synapse_container_expose_metrics_port', 'new': '<superseded by matrix_synapse_container_metrics_api_host_bind_port>'}
+    - {'old': 'matrix_synapse_cache_factor', 'new': 'matrix_synapse_caches_global_factor'}
+    - {'old': 'matrix_synapse_trusted_third_party_id_servers', 'new': '<deprecated in Synapse v0.99.4 and removed in Synapse v1.19.0>'}
+    - {'old': 'matrix_synapse_use_presence', 'new': 'matrix_synapse_presence_enabled'}
+
+- name: (Deprecation) Catch and report renamed settings in matrix_synapse_configuration_extension_yaml
+  fail:
+    msg: >-
+      Your matrix_synapse_configuration_extension_yaml configuration contains a variable, which now has a different name.
+      Please change your configuration to rename the variable (`{{ item.old }}` -> `{{ item.new }}`).
+  when: "item.old in matrix_synapse_configuration_extension"
+  with_items:
+    - {'old': 'federation_ip_range_blacklist', 'new': 'ip_range_blacklist'}