feat: add automatic creation of reverse-proxy routing

Fixes https://github.com/spantaleev/matrix-docker-ansible-deploy/issues/1749

.github/ISSUE_TEMPLATE/bug_report.md

@@ -0,0 +1,57 @@
+---
+name: Bug report
+about: Create a report to help us improve
+title: ''
+labels: ''
+assignees: ''
+
+---
+
+**Describe the bug**
+A clear and concise description of what the bug is.
+
+<!--
+NOTE: This Ansible playbook installs tens of separate services. If you're having a problem with a specific service, it is likely that the problem is not with our deployment method, but with the service itself. You may wish to report that problem at the source, upstream, and not to us
+-->
+
+**To Reproduce**
+My `vars.yml` file looks like this:
+
+```yaml
+Paste your vars.yml file here.
+Make sure to remove any secret values before posting your vars.yml file publicly.
+```
+
+<!-- Below this line, tell us what you're doing to reproduce the problem. -->
+
+
+**Expected behavior**
+A clear and concise description of what you expected to happen.
+
+**Matrix Server:**
+ - OS: [e.g. Ubuntu 21.04]
+ - Architecture [e.g. amd64, arm32, arm64]
+
+**Ansible:**
+If your problem appears to be with Ansible, tell us:
+- where you run Ansible -- e.g. on the Matrix server itself; on another computer (which OS? distro? standard installation or containerized Ansible?)
+- what version of Ansible you're running (see `ansible --version`)
+
+<!--
+The above is only applicable if you're hitting a problem with Ansible itself.
+We don't need this information in most cases. Delete this section if not applicable.
+-->
+
+**Client:**
+ - Device: [e.g. iPhone6]
+ - OS: [e.g. iOS8.1]
+ - Browser [e.g. stock browser, safari]
+ - Version [e.g. 22]
+
+<!--
+The above is only applicable if you're hitting a problem with a specific device, but not with others.
+We don't need this information in most cases. Delete this section if not applicable.
+-->
+
+**Additional context**
+Add any other context about the problem here.

.github/ISSUE_TEMPLATE/feature_request.md

@@ -0,0 +1,28 @@
+---
+name: Feature request
+about: Suggest an idea for this project
+title: ''
+labels: ''
+assignees: ''
+
+---
+
+**Is your feature request related to a problem? Please describe.**
+A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]
+
+<!--
+NOTE: When submitting feature requests, be aware that:
+
+- This Ansible playbook installs tens of separate services. If you're having a problem with a specific service or you'd like some functionality added to it, it is likely that the problem is not with our deployment method, but with the service itself. You may wish to report that problem at the source, upstream, and not to us.
+
+- This is a community project with no financial backing. The easiest way to get a feature into this project is to just develop it yourself.
+-->
+
+**Describe the solution you'd like**
+A clear and concise description of what you want to happen.
+
+**Describe alternatives you've considered**
+A clear and concise description of any alternative solutions or features you've considered.
+
+**Additional context**
+Add any other context or screenshots about the feature request here.

.github/ISSUE_TEMPLATE/i-need-help.md

@@ -0,0 +1,49 @@
+---
+name: I need help
+about: Get support from our community
+title: ''
+labels: ''
+assignees: ''
+
+---
+
+<!--
+NOTE: you can usually get more timely support and from more people by joining our Matrix room (also bridged to IRC). See the [Support section of our README](https://github.com/spantaleev/matrix-docker-ansible-deploy#support)
+-->
+
+**Playbook Configuration**:
+
+My `vars.yml` file looks like this:
+
+```yaml
+Paste your vars.yml file here.
+Make sure to remove any secret values before posting your vars.yml file publicly.
+```
+
+**Matrix Server:**
+ - OS: [e.g. Ubuntu 21.04]
+ - Architecture [e.g. amd64, arm32, arm64]
+
+**Ansible:**
+If your problem appears to be with Ansible, tell us:
+- where you run Ansible -- e.g. on the Matrix server itself; on another computer (which OS? distro? standard installation or containerized Ansible?)
+- what version of Ansible you're running (see `ansible --version`)
+
+**Problem description**:
+
+Describe what you're doing, what you expect to happen and what happens instead here.
+Tell us what you've tried and what you're aiming to achieve.
+
+**Client (please complete the following information):**
+ - Device: [e.g. iPhone6]
+ - OS: [e.g. iOS8.1]
+ - Browser [e.g. stock browser, safari]
+ - Version [e.g. 22]
+
+<!--
+The above is only applicable if you're hitting a problem with a specific device, but not with others.
+We don't need this information in most cases. Delete this section if not applicable.
+-->
+
+**Additional context**
+Add any other context about the problem here.

.github/workflows/matrix.yml

@@ -11,6 +11,6 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: ⤵️ Check out configuration from GitHub
-        uses: actions/checkout@v2.4.0
+        uses: actions/checkout@v3
       - name: 🚀 Run yamllint
         uses: frenck/action-yamllint@v1.1.2

.gitignore

@@ -1,7 +1,3 @@
-/inventory/*
-!/inventory/.gitkeep
-!/inventory/host_vars/.gitkeep
-!/inventory/scripts
 /roles/*/files/scratchpad
 .DS_Store
 .python-version

CHANGELOG.md

@@ -1,3 +1,33 @@
+# 2022-04-14
+
+## (Compatibility Break) Changes to `docker-src` permissions necessitating manual action
+
+Users who build container images from source will need to manually correct file permissions of some directories on the server.
+
+When self-building, the playbook used to `git clone` repositories (into `/matrix/SERVICE/docker-src`) using the `root` user, but now uses `matrix` instead to work around [the following issue with git 2.35.2](https://github.com/spantaleev/matrix-docker-ansible-deploy/issues/1749).
+
+If you're on a non-`amd64` architecture (that is, you're overriding `matrix_architecture` in your `vars.yml` file) or you have enabled self-building for some service (e.g. `matrix_*_self_build: true`), you're certainly building some container images from source and have `docker-src` directories with mixed permissions lying around in various `/matrix/SERVICE` directories.
+
+The playbook *could* correct these permissions automatically, but that requires additional Ansible tasks in some ~45 different places - something that takes considerable effort. So we ask users observing errors related to `docker-src` directories to correct the problem manually by **running this command on the Matrix server** (which deletes all `/matrix/*/docker-src` directories): `find /matrix -maxdepth 2 -name 'docker-src' | xargs rm -rf`
+
+
+# 2022-03-17
+
+## (Compatibility Break) ma1sd identity server no longer installed by default
+
+The playbook no longer installs the [ma1sd](https://github.com/ma1uta/ma1sd) identity server by default. The next time you run the playbook, ma1sd will be uninstalled from your server, unless you explicitly enable the ma1sd service (see how below).
+
+The main reason we used to install ma1sd by default in the past was to prevent Element from talking to the `matrix.org` / `vector.im` identity servers, by forcing it to talk to our own self-hosted (but otherwise useless) identity server instead, thus preventing contact list leaks.
+
+Since Element no longer defaults to using a public identity server if another one is not provided, we can stop installing ma1sd.
+
+If you need to install the ma1sd identity server for some reason, you can explicitly enable it by adding this to your `vars.yml` file:
+
+```yaml
+matrix_ma1sd_enabled: true
+```
+
+
 # 2022-02-12
 
 ## matrix_encryption_disabler support

README.md

@@ -31,7 +31,7 @@ Using this playbook, you can get the following services configured on your serve
 
 - (optional, default) an [Element](https://app.element.io/) ([formerly Riot](https://element.io/previously-riot)) web UI, which is configured to connect to your own Synapse server by default
 
-- (optional, default) a [ma1sd](https://github.com/ma1uta/ma1sd) Matrix Identity server
+- (optional) a [ma1sd](https://github.com/ma1uta/ma1sd) Matrix Identity server
 
 - (optional, default) an [Exim](https://www.exim.org/) mail server, through which all Matrix services send outgoing email (can be configured to relay through another SMTP server)
 
@@ -121,6 +121,8 @@ Using this playbook, you can get the following services configured on your serve
 
 - (optional) the [Cinny](https://github.com/ajbura/cinny) web client - see [docs/configuring-playbook-client-cinny.md](docs/configuring-playbook-client-cinny.md) for setup documentation
 
+- (optional) the [Borg](https://borgbackup.org) backup - see [docs/configuring-playbook-backup-borg.md](docs/configuring-playbook-backup-borg.md) for setup documentation
+
 Basically, this playbook aims to get you up-and-running with all the necessities around Matrix, without you having to do anything else.
 
 **Note**: the list above is exhaustive. It includes optional or even some advanced components that you will most likely not need.
@@ -152,5 +154,3 @@ When updating the playbook, refer to [the changelog](CHANGELOG.md) to catch up w
 ## Services by the community
 
 - [etke.cc](https://etke.cc) - matrix-docker-ansible-deploy and system stuff "as a service". That service will create your matrix homeserver on your domain and server (doesn't matter if it's cloud provider or on an old laptop in the corner of your room), (optional) maintains it (server's system updates, cleanup, security adjustments, tuning, etc.; matrix homeserver updates & maintenance) and (optional) provide full-featured email service for your domain
-
-- [GoMatrixHosting](https://gomatrixhosting.com) - matrix-docker-ansible-deploy "as a service" with [Ansible AWX](https://github.com/ansible/awx). Members can be assigned a server from DigitalOcean, or they can connect their on-premises server. This AWX system can manage the updates, configuration, import and export, backups, and monitoring on its own. For more information [see our GitLab group](https://gitlab.com/GoMatrixHosting) or come [visit us on Matrix](https://matrix.to/#/#general:gomatrixhosting.com).

ansible.cfg

@@ -1,6 +1,11 @@
 [defaults]
+
+vault_password_file = gpg/open_vault.sh
+
 retry_files_enabled = False
 stdout_callback = yaml
 
+inventory = inventory/hosts
+
 [connection]
 pipelining = True

docs/configuring-awx-system.md

@@ -1,38 +0,0 @@
-# Configuring AWX System (optional)
-
-An AWX setup for managing multiple Matrix servers.
-
-This section is used in an AWX system that can create and manage multiple [Matrix](http://matrix.org/) servers. You can issue members an AWX login to their own 'organisation', which they can use to manage/configure 1 to N servers.
-
-Members can be assigned a server from Digitalocean, or they can connect their own on-premises server. These playbooks are free to use in a commercial context with the 'MemberPress Plus' plugin. They can also be run in a non-commercial context.
-
-The AWX system is arranged into 'members' each with their own 'subscriptions'. After creating a subscription the user enters the 'provision stage' where they defined the URLs they will use, the servers location and whether or not there's already a website at the base domain. They then proceed onto the 'deploy stage' where they can configure their Matrix server.
-
-This system can manage the updates, configuration, import and export, backups and monitoring on its own. It is an extension of the popular deploy script [spantaleev/matrix-docker-ansible-deploy](https://github.com/spantaleev/matrix-docker-ansible-deploy).
-
-
-## Other Required Playbooks
-
-The following repositories allow you to copy and use this setup:
-
-[Create AWX System](https://gitlab.com/GoMatrixHosting/create-awx-system) - Creates and configures the AWX system for you.
-
-[Ansible Create Delete Subscription Membership](https://gitlab.com/GoMatrixHosting/ansible-create-delete-subscription-membership) - Used by the AWX system to create memberships and subscriptions. Also includes other administrative playbooks for updates, backups and restoring servers.
-
-[Ansible Provision Server](https://gitlab.com/GoMatrixHosting/ansible-provision-server) - Used by AWX members to perform initial configuration of their DigitalOcean or On-Premises server.
-
-[GMHosting External Tools](https://gitlab.com/GoMatrixHosting/gmhosting-external-tools) - Extra tools we run outside of AWX, some of which are experimental.
-
-
-## Does I need an AWX setup to use this? How do I configure it? 
-
-Yes, you'll need to configure an AWX instance, the [Create AWX System](https://gitlab.com/GoMatrixHosting/create-awx-system) repository makes it easy to do. Just follow the steps listed in ['/docs/Installation_AWX.md' of that repository](https://gitlab.com/GoMatrixHosting/create-awx-system/-/blob/master/docs/Installation_AWX.md). 
-
-For simpler installation steps you can use to get started with this system, check out our minimal installation guide at ['/doc/Installation_Minimal_AWX.md of that repository'](https://gitlab.com/GoMatrixHosting/create-awx-system/-/blob/master/docs/Installation_Minimal_AWX.md).
-
-
-## Does I need a front-end WordPress site? And a DigitalOcean account? 
-
-You do not need a front-end WordPress site or the MemberPress plugin to use this setup. It can be run on it's own in a non-commercial context.
-
-You also don't need a DigitalOcean account, although this will limit you to only being able to connect 'On-Premises' servers.

docs/configuring-dns.md

@@ -62,11 +62,11 @@ The `cinny.<your-domain>` subdomain may be necessary, because this playbook coul
 
 ## `_matrix-identity._tcp` SRV record setup
 
-To make the [ma1sd](https://github.com/ma1uta/ma1sd) Identity Server (which this playbook installs for you) enable its federation features, set up an SRV record that looks like this:
+To make the [ma1sd](https://github.com/ma1uta/ma1sd) Identity Server (which this playbook may optionally install for you) enable its federation features, set up an SRV record that looks like this:
 - Name: `_matrix-identity._tcp` (use this text as-is)
 - Content: `10 0 443 matrix.<your-domain>` (replace `<your-domain>` with your own)
 
-This is an optional feature. See [ma1sd's documentation](https://github.com/ma1uta/ma1sd/wiki/mxisd-and-your-privacy#choices-are-never-easy) for information on the privacy implications of setting up this SRV record.
+This is an optional feature for the optionally-installed [ma1sd service](configuring-playbook-ma1sd.md). See [ma1sd's documentation](https://github.com/ma1uta/ma1sd/wiki/mxisd-and-your-privacy#choices-are-never-easy) for information on the privacy implications of setting up this SRV record.
 
 Note: This `_matrix-identity._tcp` SRV record for the identity server is different from the `_matrix._tcp` that can be used for Synapse delegation. See [howto-server-delegation.md](howto-server-delegation.md) for more information about delegation.
 

docs/configuring-playbook-backup-borg.md

@@ -0,0 +1,64 @@
+# Setting up borg backup (optional)
+
+The playbook can install and configure [borgbackup](https://www.borgbackup.org/) with [borgmatic](https://torsion.org/borgmatic/) for you.
+BorgBackup is a deduplicating backup program with optional compression and encryption.
+That means your daily incremental backups can be stored in a fraction of the space and is safe whether you store it at home or on a cloud service.
+
+You will need a remote server where borg will store the backups. There are hosted, borg compatible solutions available, such as [BorgBase](https://www.borgbase.com).
+
+The backup will run based on `matrix_backup_borg_schedule` var (systemd timer calendar), default: 4am every day.
+
+## Prerequisites
+
+1. Create a new SSH key:
+
+```bash
+ssh-keygen -t ed25519 -N '' -f matrix-borg-backup -C matrix
+```
+
+This can be done on any machine and you don't need to place the key in the `.ssh` folder. It will be added to the Ansible config later.
+
+2. Add the **public** part of this SSH key (the `matrix-borg-backup.pub` file) to your borg provider/server:
+
+If you plan to use a hosted solution, follow their instructions. If you have your own server, copy the key over:
+
+```bash
+# example to append the new PUBKEY contents, where:
+# PUBKEY is path to the public key,
+# USER is a ssh user on a provider / server
+# HOST is a ssh host of a provider / server
+cat PUBKEY | ssh USER@HOST 'dd of=.ssh/authorized_keys oflag=append conv=notrunc'
+```
+
+## Adjusting the playbook configuration
+
+Minimal working configuration (`inventory/host_vars/matrix.DOMAIN/vars.yml`) to enable borg backup:
+
+```yaml
+matrix_backup_borg_enabled: true
+matrix_backup_borg_location_repositories:
+ - USER@HOST:REPO
+matrix_backup_borg_storage_encryption_passphrase: "PASSPHRASE"
+matrix_backup_borg_ssh_key_private: |
+	PRIVATE KEY
+```
+
+where:
+
+* USER - SSH user of a provider/server
+* HOST - SSH host of a provider/server
+* REPO - borg repository name, it will be initialized on backup start, eg: `matrix`
+* PASSPHRASE - passphrase used for encrypting backups, you may generate it with `pwgen -s 64 1` or use any password manager
+* PRIVATE KEY - the content of the **private** part of the SSH key you created before
+
+`matrix_backup_borg_location_source_directories` defines the list of directories to back up: it's set to `{{ matrix_base_data_path }}` by default, which is the base directory for every service's data, such as Synapse, Postgres and the bridges. You might want to exclude certain directories or file patterns from the backup using the `matrix_backup_borg_location_exclude_patterns` variable.
+
+Check the `roles/matrix-backup-borg/defaults/main.yml` file for the full list of available options.
+
+## Installing
+
+After configuring the playbook, run the [installation](installing.md) command again:
+
+```
+ansible-playbook -i inventory/hosts setup.yml --tags=setup-all,start
+```

docs/configuring-playbook-bridge-appservice-discord.md

@@ -23,18 +23,51 @@ matrix_appservice_discord_bot_token: "YOUR DISCORD APP BOT TOKEN"
 ```
 
 5. If you've already installed Matrix services using the playbook before, you'll need to re-run it (`--tags=setup-all,start`). If not, proceed with [configuring other playbook services](configuring-playbook.md) and then with [Installing](installing.md). Get back to this guide once ready.
-6. Retrieve Discord invite link from the `{{ matrix_appservice_discord_config_path }}/invite_link` file on the server (this defaults to `/matrix/appservice-discord/config/invite_link`). You need to peek at the file on the server via SSH, etc., because it's not available via HTTP(S).
-7. Invite the Bot to Discord servers you wish to bridge. Administrator permission is recommended.
-8. Room addresses follow this syntax: `#_discord_guildid_channelid`. You can easily find the guild and channel ids by logging into Discord in a browser and opening the desired channel. The URL will have this format: `discordapp.com/channels/guild_id/channel_id`. Once you have figured out the appropriate room addrss, you can join by doing `/join #_discord_guildid_channelid` in your Matrix client.
 
 Other configuration options are available via the `matrix_appservice_discord_configuration_extension_yaml` variable.
 
+## Self-Service Bridging (Manual)
 
-## Getting Administrator access in a room
+Self-service bridging allows you to bridge specific and existing Matrix rooms to specific Discord rooms. This is disabled by default, so it must be enabled by adding this to your `vars.yml`:
+
+```yaml
+matrix_appservice_discord_bridge_enableSelfServiceBridging: true
+```
+
+_Note: If self-service bridging is not enabled, `!discord help` commands will return no results._
+
+Once self-service is enabled:
+
+1. Start a chat with `@_discord_bot:<YOUR_DOMAIN>` and say `!discord help bridge`.
+2. Follow the instructions in the help output message. If the bot is not already in the Discord server, follow the provided invite link. This may require you to be a administrator of the Discord server.
+
+_Note: Encrypted Matrix rooms are not supported as of writing._
+
+On the Discord side, you can say `!matrix help` to get a list of available commands to manage the bridge and Matrix users.
+
+## Portal Bridging (Automatic)
+
+Through portal bridging, Matrix rooms will automatically be created by the bot and bridged to the relevant Discord room. This is done by simply joining a room with a specific name pattern (`#_discord_<guildID>_<channlID>`).
+
+All Matrix rooms created this way are **listed publicly** by default, and you will not have admin permissions to change this. To get more control, [make yourself a room Administrator](#getting-administrator-access-in-a-portal-bridged-room). You can then unlist the room from the directory and change the join rules.
+
+If you want to disable portal bridging, set the following in `vars.yml`:
+
+```yaml
+matrix_appservice_discord_bridge_disablePortalBridging: true
+```
+
+To get started with Portal Bridging:
+
+1. To invite the bot to Discord, retrieve the invite link from the `{{ matrix_appservice_discord_config_path }}/invite_link` file on the server (this defaults to `/matrix/appservice-discord/config/invite_link`). You need to peek at the file on the server via SSH, etc., because it's not available via HTTP(S).
+2. Room addresses follow this syntax: `#_discord_<guildID>_<channelID>`. You can easily find the guild and channel IDs by logging into Discord in a browser and opening the desired channel. The URL will have this format: `discord.com/channels/<guildID>/<channelID>`.
+3. Once you have figured out the appropriate room address, you can join by doing `/join #_discord_<guildID>_<channelID>` in your Matrix client. 
+
+## Getting Administrator access in a portal bridged room
 
 By default, you won't have Administrator access in rooms created by the bridge.
 
-To [adjust room access privileges](#adjusting-room-access-privileges) or do various other things (change the room name subsequently, etc.), you'd wish to become an Administrator.
+To adjust room access privileges or do various other things (change the room name subsequently, etc.), you'd wish to become an Administrator.
 
 There's the Discord bridge's guide for [setting privileges on bridge managed rooms](https://github.com/Half-Shot/matrix-appservice-discord/blob/master/docs/howto.md#set-privileges-on-bridge-managed-rooms). To do the same with our container setup, run the following command on the server:
 
@@ -42,12 +75,3 @@ There's the Discord bridge's guide for [setting privileges on bridge managed roo
 docker exec -it matrix-appservice-discord \
 /bin/sh -c 'cp /cfg/registration.yaml /tmp/discord-registration.yaml && cd /tmp && node /build/tools/adminme.js -c /cfg/config.yaml -m "!ROOM_ID:SERVER" -u "@USER:SERVER" -p 100'
 ```
-
-
-## Adjusting room access privileges
-
-All rooms created by the bridge are **listed publicly** in your server's directory and **joinable by everyone** by default.
-
-To get more control of them, [make yourself a room Administrator](#getting-administrator-access-in-a-room) first.
-
-You can then unlist the room from the directory and change the join rules.

docs/configuring-playbook-bridge-appservice-slack.md

@@ -11,7 +11,7 @@ See the project's [documentation](https://github.com/matrix-org/matrix-appservic
 loosely based on [this](https://github.com/matrix-org/matrix-appservice-slack#Setup)
 
 1. Create a new Matrix room to act as the administration control room. Note its internal room ID. This can
-be done in Riot by making a message, opening the options for that message and choosing "view source". The
+be done in Element by making a message, opening the options for that message and choosing "view source". The
 room ID will be displayed near the top.
 2. Enable the bridge with the following configuration in your `vars.yml` file:
 

docs/configuring-playbook-bridge-hookshot.md

@@ -1,25 +1,44 @@
 # Setting up Hookshot (optional)
 
-The playbook can install and configure [matrix-hookshot](https://github.com/Half-Shot/matrix-hookshot) for you.
+The playbook can install and configure [matrix-hookshot](https://github.com/matrix-org/matrix-hookshot) for you.
 
 Hookshot can bridge [Webhooks](https://en.wikipedia.org/wiki/Webhook) from software project management services such as GitHub, GitLab, JIRA, and Figma, as well as generic webhooks.
 
-See the project's [documentation](https://half-shot.github.io/matrix-hookshot/hookshot.html) to learn what it does in detail and why it might be useful to you.
+See the project's [documentation](https://matrix-org.github.io/matrix-hookshot/hookshot.html) to learn what it does in detail and why it might be useful to you.
 
 Note: the playbook also supports [matrix-appservice-webhooks](configuring-playbook-bridge-appservice-webhooks.md), which however is soon to be archived by its author and to be replaced by hookshot.
 
 ## Setup Instructions
 
-Refer to the [official instructions](https://half-shot.github.io/matrix-hookshot/setup.html) to learn what the individual options do.
+Refer to the [official instructions](https://matrix-org.github.io/matrix-hookshot/setup.html) to learn what the individual options do.
 
 1. For each of the services (GitHub, GitLab, Jira, Figma, generic webhooks) fill in the respective variables `matrix_hookshot_service_*` listed in [main.yml](/roles/matrix-bridge-hookshot/defaults/main.yml) as required.
 2. Take special note of the `matrix_hookshot_*_enabled` variables. Services that need no further configuration are enabled by default (GitLab, Generic), while you must first add the required configuration and enable the others (GitHub, Jira, Figma).
 3. If you're setting up the GitHub bridge, you'll need to generate and download a private key file after you created your GitHub app. Copy the contents of that file to the variable `matrix_hookshot_github_private_key` so the playbook can install it for you, or use one of the [other methods](#manage-github-private-key-with-matrix-aux-role) explained below. 
 4. If you've already installed Matrix services using the playbook before, you'll need to re-run it (`--tags=setup-all,start`). If not, proceed with [configuring other playbook services](configuring-playbook.md) and then with [Installing](installing.md). Get back to this guide once ready. Hookshot can be set up individually using the tag `setup-hookshot`.
-5. Refer to [Hookshot's official instructions](https://half-shot.github.io/matrix-hookshot/usage.html) to start using the bridge. Note that the different listeners are bound to certain paths (see `matrix_hookshot_matrix_nginx_proxy_configuration` in [init.yml](/roles/matrix-bridge-hookshot/tasks/init.yml)): by default webhooks root is `/hookshot/webhooks/`.
+5. Refer to [Hookshot's official instructions](https://matrix-org.github.io/matrix-hookshot/usage.html) to start using the bridge. **Important:** Note that the different listeners are bound to certain paths which might differe from those assumed by the hookshot documentation, see [URLs for bridges setup](urls-for-bridges-setup) below.
 
 Other configuration options are available via the `matrix_hookshot_configuration_extension_yaml` and `matrix_hookshot_registration_extension_yaml` variables, see the comments in [main.yml](/roles/matrix-bridge-hookshot/defaults/main.yml) for how to use them.
 
+### URLs for bridges setup
+
+Unless indicated otherwise, the following endpoints are reachable on your `matrix.` subdomain (if the feature is enabled).
+
+| listener | default path | variable | used as |
+|---|---|---|---|
+| webhooks | `/hookshot/webhooks/` | `matrix_hookshot_webhook_endpoint` | generics, GitHub "Webhook URL", etc. |
+| github oauth | `/hookshot/webhooks/oauth` | `matrix_hookshot_github_oauth_endpoint` | GitHub "Callback URL" |
+| jira oauth | `/hookshot/webhooks/jira/oauth` | `matrix_hookshot_jira_oauth_endpoint` | JIRA OAuth |
+| figma endpoint | `/hookshot/webhooks/figma/webhook` | `matrix_hookshot_figma_endpoint` | Figma |
+| provisioning | `/hookshot/v1/` | `matrix_hookshot_provisioning_endpoint` | Dimension [provisioning](#provisioning-api) |
+| appservice | `/hookshot/_matrix/app/` | `matrix_hookshot_appservice_endpoint` | Matrix server |
+| widgets | `/hookshot/widgetapi/` | `/matrix_hookshot_widgets_endpoint` | Widgets |
+| metrics | `/hookshot/metrics/` (on `stats.` subdomain) | `matrix_hookshot_metrics_endpoint` | Prometheus |
+
+See also `matrix_hookshot_matrix_nginx_proxy_configuration` in [init.yml](/roles/matrix-bridge-hookshot/tasks/init.yml).
+
+The different listeners are also reachable *internally* in the docker-network via the container's name (configured by `matrix_hookshot_container_url`) and on different ports (e.g. `matrix_hookshot_appservice_port`). Read [main.yml](/roles/matrix-bridge-hookshot/defaults/main.yml) in detail for more info.
+
 ### Manage GitHub Private Key with matrix-aux role
 
 The GitHub bridge requires you to install a private key file. This can be done in multiple ways:
@@ -45,3 +64,7 @@ The provisioning API will be enabled automatically if you set `matrix_dimension_
 ### Metrics
 
 If metrics are enabled, they will be automatically available in the builtin Prometheus and Grafana, but you need to set up your own Dashboard for now. If additionally metrics proxying for use with external Prometheus is enabled (`matrix_nginx_proxy_proxy_synapse_metrics`), hookshot metrics will also be available (at `matrix_hookshot_metrics_endpoint`, default `/hookshot/metrics`, on the stats subdomain) and with the same password. See also [the Prometheus and Grafana docs](../configuring-playbook-prometheus-grafana.md).
+
+### Collision with matrix-appservice-webhooks
+
+If you are also running [matrix-appservice-webhooks](configuring-playbook-bridge-appservice-webhooks.md), it reserves its namespace by the default setting `matrix_appservice_webhooks_user_prefix: '_webhook_'`. You should take care if you modify its or hookshot's prefix that they do not collide with each other's namespace (default `matrix_hookshot_generic_user_id_prefix: '_webhooks_'`).

docs/configuring-playbook-bridge-mautrix-facebook.md

@@ -70,31 +70,6 @@ If you run into trouble, check the [Troubleshooting](#troubleshooting) section b
 After successfully enabling bridging, you may wish to [set up Double Puppeting](#set-up-double-puppeting), if you haven't already done so.
 
 
-## Set up community-grouping
-
-This is an **optional feature** that you may wish to enable.
-
-The Facebook bridge can create a Matrix community for you, which would contain all your chats and contacts.
-
-For this to work, the bridge's bot needs to have permissions to create communities (also referred to as groups).
-Since the bot is a non-admin user, you need to enable such group-creation for non-privileged users in [Synapse's settings](configuring-playbook-synapse.md).
-
-Here's an example configuration:
-
-```yaml
-matrix_synapse_configuration_extension_yaml: |
-  enable_group_creation: true
-  group_creation_prefix: "unofficial/"
-
-matrix_mautrix_facebook_configuration_extension_yaml: |
-  bridge:
-    community_template: "unofficial/facebook_{localpart}={server}"
-```
-
-Once the bridge is restarted, it would create a community and invite you to it. You need to accept the community invitation manually.
-If you don't see all your contacts, you may wish to send a `sync` message to the bot.
-
-
 ## Troubleshooting
 
 ### Facebook rejecting login attempts and forcing you to change password

docs/configuring-playbook-bridge-mautrix-telegram.md

@@ -49,4 +49,19 @@ If you want to use the relay-bot feature ([relay bot documentation](https://docs
 
 ```yaml
 matrix_mautrix_telegram_bot_token: YOUR_TELEGRAM_BOT_TOKEN
+matrix_mautrix_telegram_configuration_extension_yaml: |
+  bridge:
+    permissions:
+      '*': relaybot
 ```
+
+You might also want to give permissions to administrate the bot:
+```yaml
+matrix_mautrix_telegram_configuration_extension_yaml: |
+  bridge:
+    permissions:
+      '@user:DOMAIN': admin
+```
+
+More details about permissions in this example:
+https://github.com/mautrix/telegram/blob/master/mautrix_telegram/example-config.yaml#L410

docs/configuring-playbook-bridge-mx-puppet-discord.md

@@ -7,6 +7,8 @@ The playbook can install and configure
 
 See the project page to learn what it does and why it might be useful to you.
 
+**Note**: we actually use the [Beeper](https://www.beeper.com/)-maintained [fork of mx-puppet-discord](https://gitlab.com/beeper/mx-puppet-monorepo), because `matrix-discord/mx-puppet-discord` is a low-quality and poorly maintained project.
+
 To enable the [Discord](https://discordapp.com/) bridge just use the following
 playbook configuration:
 

docs/configuring-playbook-bridge-mx-puppet-slack.md

@@ -4,8 +4,8 @@
 [matrix-appservice-slack](configuring-playbook-bridge-appservice-slack.md)
 bridge supported by the playbook.
 
-The playbook can install and configure
+The playbook can install and configure [Beeper](https://www.beeper.com/)-maintained fork of
-[mx-puppet-slack](https://github.com/Sorunome/mx-puppet-slack) for you.
+[mx-puppet-slack](https://gitlab.com/beeper/mx-puppet-monorepo) for you.
 
 See the project page to learn what it does and why it might be useful to you.
 

docs/configuring-playbook-dimension.md

@@ -22,7 +22,7 @@ matrix_dimension_enabled: true
 
 ## Define admin users
 
-These users can modify the integrations this Dimension supports. Admin interface is accessible at `https://dimension.<your-domain>/riot-app/admin` after logging in to element.
+These users can modify the integrations this Dimension supports. 
 Add this to your configuration file (`inventory/host_vars/matrix.<your-domain>/vars.yml`):
 
 ```yaml
@@ -31,6 +31,7 @@ matrix_dimension_admins:
   - "@user2:{{ matrix_domain }}"
 ```
 
+The admin interface is accessible within Element by accessing it in any room and clicking the cog wheel/settings icon in the top right. Currently, Dimension can be opened in Element by the "Add widgets, bridges, & bots" link in the room information.
 
 ## Access token
 

docs/configuring-playbook-external-postgres.md

@@ -5,7 +5,9 @@ If that's alright, you can skip this.
 
 If you'd like to use an external PostgreSQL server that you manage, you can edit your configuration file  (`inventory/host_vars/matrix.<your-domain>/vars.yml`).
 
-It should be something like this:
+**NOTE**: using **an external Postgres server is currently [not very seamless](https://github.com/spantaleev/matrix-docker-ansible-deploy/issues/1682#issuecomment-1061461683) when it comes to enabling various other playbook services** - you will need to create a new database/credentials for each service and to point each service to its corresponding database using custom `vars.yml` configuration. **For the best experience with the playbook, stick to using the integrated Postgres server**.
+
+If you'd like to use an external Postgres server, use a custom `vars.yml` configuration like this:
 
 ```yaml
 matrix_postgres_enabled: false
@@ -15,6 +17,10 @@ matrix_synapse_database_host: "your-postgres-server-hostname"
 matrix_synapse_database_user: "your-postgres-server-username"
 matrix_synapse_database_password: "your-postgres-server-password"
 matrix_synapse_database_database: "your-postgres-server-database-name"
+
+# Rewire any other service (each `matrix-*` role) you may wish to use to use your external Postgres server.
+# Each service expects to have its own dedicated database on the Postgres server
+# and uses its own variable names (see `roles/matrix-*/defaults/main.yml) for configuring Postgres connectivity.
 ```
 
 The database (as specified in `matrix_synapse_database_database`) must exist and be accessible with the given credentials.

docs/configuring-playbook-ma1sd.md

@@ -1,24 +1,22 @@
 # Adjusting ma1sd Identity Server configuration (optional)
 
-By default, this playbook configures an [ma1sd](https://github.com/ma1uta/ma1sd) Identity Server for you.
+The playbook can configure the [ma1sd](https://github.com/ma1uta/ma1sd) Identity Server for you.
+
+ma1sd, being an Identity Server, is not strictly needed. It is only used for 3PIDs (3rd party identifiers like E-mail and phone numbers) and some [enhanced features](https://github.com/ma1uta/ma1sd/#features).
 
 This server is private by default, potentially at the expense of user discoverability.
 
 *ma1sd is a fork of [mxisd](https://github.com/kamax-io/mxisd) which was pronounced end of life 2019-06-21.*
 
-**Note**: enabling ma1sd (which is also the default), means that the `openid` API endpoints will be exposed on the Matrix Federation port (usually `8448`), even if [federation](configuring-playbook-federation.md) is disabled. It's something to be aware of, especially in terms of firewall whitelisting (make sure port `8448` is accessible).
+**Note**: enabling ma1sd, means that the `openid` API endpoints will be exposed on the Matrix Federation port (usually `8448`), even if [federation](configuring-playbook-federation.md) is disabled. It's something to be aware of, especially in terms of firewall whitelisting (make sure port `8448` is accessible).
 
-
+To enable ma1sd, use the following additional configuration in your `vars.yml` file:
-## Disabling ma1sd
-
-ma1sd, being an Identity Server, is not strictly needed. It is only used for 3PIDs (3rd party identifiers like E-mail and phone numbers) and some [enhanced features](https://github.com/ma1uta/ma1sd/#features).
-
-If you'd like for the playbook to not install ma1sd (or to uninstall it if it was previously installed), you can disable it in your configuration file (`inventory/host_vars/matrix.<your-domain>/vars.yml`):
 
 ```yaml
-matrix_ma1sd_enabled: false
+matrix_ma1sd_enabled: true
 ```
 
+
 ## Matrix.org lookup forwarding
 
 To ensure maximum discovery, you can make your identity server also forward lookups to the central matrix.org Identity server (at the cost of potentially leaking all your contacts information).

docs/configuring-playbook-prometheus-grafana.md

@@ -25,6 +25,8 @@ matrix_grafana_default_admin_password: "some_strong_password_chosen_by_you"
 
 By default, a [Grafana](https://grafana.com/) web user-interface will be available at `https://stats.<your-domain>`.
 
+The retention policy of Prometheus metrics is [15 days by default](https://prometheus.io/docs/prometheus/latest/storage/#operational-aspects). Older data gets deleted automatically.
+
 
 ## What does it do?
 

docs/configuring-playbook-ssl-certificates.md

@@ -100,3 +100,12 @@ For automated certificate renewal to work, each port `80` vhost for each domain
 
 See how this is configured for the `matrix.` subdomain in `/matrix/nginx-proxy/conf.d/matrix-synapse.conf`
 Don't be alarmed if the above configuration file says port `8080`, instead of port `80`. It's due to port mapping due to our use of containers.
+
+
+## Specify the SSL private key algorithm
+
+If you'd like to [specify the private key type](https://eff-certbot.readthedocs.io/en/stable/using.html#using-ecdsa-keys) used with Let's Encrypt, define your own custom configuration like this:
+
+```yaml
+matrix_ssl_lets_encrypt_key_type: ecdsa
+```

docs/configuring-playbook.md

@@ -47,8 +47,6 @@ When you're done with all the configuration you'd like to do, continue with [Ins
 
 - [Using an external PostgreSQL server](configuring-playbook-external-postgres.md) (optional)
 
-- [Adjusting ma1sd Identity Server configuration](configuring-playbook-ma1sd.md) (optional)
-
 - [Adjusting SSL certificate retrieval](configuring-playbook-ssl-certificates.md) (optional, advanced)
 
 - [Serving your base domain using this playbook's nginx server](configuring-playbook-base-domain-serving.md) (optional)
@@ -69,11 +67,14 @@ When you're done with all the configuration you'd like to do, continue with [Ins
 - [Adjusting email-sending settings](configuring-playbook-email.md) (optional)
 
 - [Setting up Hydrogen](configuring-playbook-client-hydrogen.md) - a new lightweight matrix client with legacy and mobile browser support (optional)
+
 - [Setting up Cinny](configuring-playbook-client-cinny.md) - a web client focusing primarily on simple, elegant and secure interface (optional)
 
 
 ### Authentication and user-related
 
+- [Setting up an ma1sd Identity Server](configuring-playbook-ma1sd.md) (optional)
+
 - [Setting up Synapse Admin](configuring-playbook-synapse-admin.md) (optional)
 
 - [Setting up matrix-registration](configuring-playbook-matrix-registration.md) (optional)

docs/container-images.md

@@ -15,8 +15,6 @@ These services are enabled and used by default, but you can turn them off, if yo
 
 - [vectorim/element-web](https://hub.docker.com/r/vectorim/element-web/) - the [Element](https://element.io/) web client (optional)
 
-- [ma1uta/ma1sd](https://hub.docker.com/r/ma1uta/ma1sd/) - the [ma1sd](https://github.com/ma1uta/ma1sd) Matrix Identity server (optional)
-
 - [postgres](https://hub.docker.com/_/postgres/) - the [Postgres](https://www.postgresql.org/) database server (optional)
 
 - [devture/exim-relay](https://hub.docker.com/r/devture/exim-relay/) - the [Exim](https://www.exim.org/) email server (optional)
@@ -30,6 +28,8 @@ These services are enabled and used by default, but you can turn them off, if yo
 
 These services are not part of our default installation, but can be enabled by [configuring the playbook](configuring-playbook.md) (either before the initial installation or any time later):
 
+- [ma1uta/ma1sd](https://hub.docker.com/r/ma1uta/ma1sd/) - the [ma1sd](https://github.com/ma1uta/ma1sd) Matrix Identity server (optional)
+
 - [matrixdotorg/dendrite-monolith](https://hub.docker.com/r/matrixdotorg/dendrite-monolith/) - the official [Dendrite](https://github.com/matrix-org/dendrite) Matrix homeserver (optional)
 
 - [ewoutp/goofys](https://hub.docker.com/r/ewoutp/goofys/) - the [Goofys](https://github.com/kahing/goofys) Amazon [S3](https://aws.amazon.com/s3/) file-system-mounting program (optional)

docs/self-building.md

@@ -22,6 +22,7 @@ List of roles where self-building the Docker image is currently possible:
 - `matrix-dimension`
 - `matrix-ma1sd`
 - `matrix-mailer`
+- `matrix-bridge-hookshot`
 - `matrix-bridge-appservice-irc`
 - `matrix-bridge-appservice-slack`
 - `matrix-bridge-appservice-webhooks`
@@ -33,6 +34,7 @@ List of roles where self-building the Docker image is currently possible:
 - `matrix-bridge-mautrix-signal`
 - `matrix-bridge-mautrix-whatsapp`
 - `matrix-bridge-mx-puppet-skype`
+- `matrix-bridge-mx-puppet-steam`
 - `matrix-bot-mjolnir`
 - `matrix-bot-honoroit`
 - `matrix-bot-matrix-reminder-bot`

gpg/open_vault.sh

@@ -0,0 +1,5 @@
+#!/bin/bash
+
+set -e -u
+
+gpg2 --batch --use-agent --decrypt $(dirname $0)/vault_passphrase.gpg 2>/dev/null

gpg/vault_passphrase.gpg

@@ -0,0 +1,18 @@
+-----BEGIN PGP MESSAGE-----
+
+hQIMAxEs7W/4x4lxARAAssinIzR2rGs+Qkm0Q2tRdSXSXRx3OhH+2T5p0Rz3YkqU
+iyiUtyT/Ll7RMUAlAEDZITvirXe4ZZImDcxQegEzFgO7BowQYJDRdhaRmLKZpiuQ
+foRnJAAR12sf49arjJjaBQb91ViOp5MkxAtXiiqWyXwSSII+cV88flMq143cFmfC
+C5OdIQd3SqrbFhGRTjUzoIMqnJH8xksjwph9GS811dY14rQv5X1Ybt5zehMJ7/m/
+luLNg2zgQgYOUxcovddCVMI54ThXyDubDox/5xLvVjyVOFHgwC/VLn+QXHuPY/r5
++rVzz/30eq0uOLKD3LnDBQskCWRVWGC2ulKaZtlylBq6KRzIM6c6+VPSHCjoFyES
+RRpRHeIXGLs31eLkr8dc+VNbPKpMsjm/E/4ZVE2JBpy7S/kh1XYVQxT6ahDKT1tD
+4YN9O0JyNXzjiyNaTTLwNGh5+ICEd3ZCfa4O/og2LySGPOw6mX8ukgP029LHVp6+
+0tRwSWiIM3US/NIVGA+o9e9I/I5Bp/cnzJgd7faUIlzcVPP+euCbo4GsYWpX3Nca
+eRcr7AVY3wwuZtl7/s8KbQKk0ulLxS4Lo2XmdpQl8CPGwASdbMf/H8B256+xiUQ3
+ml400ZaCC7Loeduwl1ez1H/dFFzmpUziaxxtWW4aFtOUYhGeSCTu6ZIgxVq3eBnS
+jAGv8bt+0Xnrpih3mZWM92cw2VKfzYD9WG+dCB4DtZMKhl1ub2bkeTC/B9F+QuP6
+anlonYHs2wmPXzjcx8ajonbYrYXanoNRHDId6OqVAbjYqbua6TG6H9LUFweIj1RV
+yhUPejzhA8xEB0nUcKJZKLvuqvwPbr06GODnAKY5TQ4yILMAnBx0pNzfQNzo
+=Cecg
+-----END PGP MESSAGE-----

group_vars/matrix_servers

@@ -9,8 +9,6 @@
 # You can also override ANY variable (seen here or in any given role),
 # by re-defining it in your own configuration file (`inventory/host_vars/matrix.<your-domain>`).
 
-matrix_container_global_registry_prefix: "docker.io/"
-
 ######################################################################
 #
 # matrix-base
@@ -47,27 +45,6 @@ matrix_integration_manager_ui_url: "{{ matrix_dimension_integrations_ui_url if m
 ######################################################################
 
 
-######################################################################
-#
-# matrix-awx
-#
-######################################################################
-
-# We don't enable AWX support by default.
-matrix_awx_enabled: false
-
-matrix_nginx_proxy_data_path: "{{ '/chroot/website' if (matrix_awx_enabled and not matrix_nginx_proxy_base_domain_homepage_enabled) else (matrix_nginx_proxy_base_path + '/data') }}"
-matrix_nginx_proxy_data_path_in_container: "{{ '/nginx-data/matrix-domain' if (matrix_awx_enabled and not matrix_nginx_proxy_base_domain_homepage_enabled) else '/nginx-data' }}"
-matrix_nginx_proxy_data_path_extension: "{{ '' if (matrix_awx_enabled and not matrix_nginx_proxy_base_domain_homepage_enabled) else '/matrix-domain' }}"
-matrix_nginx_proxy_base_domain_create_directory: "{{ not matrix_awx_enabled }}"
-
-######################################################################
-#
-# /matrix-awx
-#
-######################################################################
-
-
 ######################################################################
 #
 # matrix-bridge-appservice-discord
@@ -301,6 +278,10 @@ matrix_mautrix_facebook_appservice_token: "{{ '%s' | format(matrix_homeserver_ge
 
 matrix_mautrix_facebook_homeserver_token: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'fb.hs.token') | to_uuid }}"
 
+matrix_mautrix_facebook_public_endpoint: "/{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'facebook') | to_uuid }}"
+
+matrix_mautrix_facebook_container_http_host_bind_port: "{{ '' if matrix_nginx_proxy_enabled else '127.0.0.1:9008' }}"
+
 matrix_mautrix_facebook_login_shared_secret: "{{ matrix_synapse_ext_password_provider_shared_secret_auth_shared_secret if matrix_synapse_ext_password_provider_shared_secret_auth_enabled else '' }}"
 
 matrix_mautrix_facebook_bridge_presence: "{{ matrix_synapse_presence_enabled if matrix_synapse_enabled else true }}"
@@ -558,10 +539,8 @@ matrix_mautrix_twitter_homeserver_token: "{{ matrix_homeserver_generic_secret_ke
 
 matrix_mautrix_twitter_login_shared_secret: "{{ matrix_synapse_ext_password_provider_shared_secret_auth_shared_secret if matrix_synapse_ext_password_provider_shared_secret_auth_enabled else '' }}"
 
-# We'd like to force-set people with external Postgres to SQLite, so the bridge role can complain
+matrix_mautrix_twitter_database_hostname: "{{ 'matrix-postgres' if matrix_postgres_enabled else '' }}"
-# and point them to a migration path.
+matrix_mautrix_twitter_database_password: "{{ matrix_homeserver_generic_secret_key | password_hash('sha512', 'mau.twt.db') | to_uuid if matrix_postgres_enabled else '' }}"
-matrix_mautrix_twitter_database_engine: "{{ 'postgres' if matrix_postgres_enabled else '' }}"
-matrix_mautrix_twitter_database_password: "{{ matrix_homeserver_generic_secret_key | password_hash('sha512', 'mau.twt.db') | to_uuid }}"
 
 ######################################################################
 #
@@ -671,6 +650,8 @@ matrix_heisenbridge_systemd_wanted_services_list: |
 # We don't enable bridges by default.
 matrix_hookshot_enabled: false
 
+matrix_hookshot_container_image_self_build: "{{ matrix_architecture not in ['amd64'] }}"
+
 matrix_hookshot_appservice_token: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'hookshot.as.tok') | to_uuid }}"
 
 matrix_hookshot_homeserver_token: "{{ '%s' | format(matrix_homeserver_generic_secret_key) | password_hash('sha512', 'hookshot.hs.tok') | to_uuid }}"
@@ -695,6 +676,10 @@ matrix_hookshot_provisioning_enabled: "{{ matrix_hookshot_provisioning_secret an
 matrix_hookshot_proxy_metrics: "{{ matrix_nginx_proxy_proxy_synapse_metrics }}"
 matrix_hookshot_proxy_metrics_basic_auth_enabled: "{{ matrix_nginx_proxy_proxy_synapse_metrics_basic_auth_enabled }}"
 
+matrix_hookshot_urlprefix_port_enabled: "{{ matrix_nginx_proxy_container_https_host_bind_port == 443 if matrix_nginx_proxy_https_enabled else matrix_nginx_proxy_container_https_host_bind_port == 80 }}"
+matrix_hookshot_urlprefix_port: ":{{ matrix_nginx_proxy_container_https_host_bind_port if matrix_nginx_proxy_https_enabled else matrix_nginx_proxy_container_http_host_bind_port }}"
+matrix_hookshot_urlprefix: "http{{ 's' if matrix_nginx_proxy_https_enabled else '' }}://{{ matrix_server_fqn_matrix }}{{ matrix_hookshot_urlprefix_port if matrix_hookshot_urlprefix_port_enabled else '' }}"
+
 ######################################################################
 #
 # /matrix-bridge-hookshot
@@ -904,7 +889,7 @@ matrix_mx_puppet_discord_database_password: "{{ '%s' | format(matrix_homeserver_
 # We don't enable bridges by default.
 matrix_mx_puppet_steam_enabled: false
 
-matrix_mx_puppet_steam_container_image_self_build: "{{ matrix_architecture != 'amd64'}}"
+matrix_mx_puppet_steam_container_image_self_build: "{{ matrix_architecture not in ['arm64', 'amd64'] }}"
 
 matrix_mx_puppet_steam_systemd_required_services_list: |
   {{
@@ -1089,6 +1074,27 @@ matrix_bot_mjolnir_systemd_required_services_list: |
 #
 ######################################################################
 
+######################################################################
+#
+# matrix-backup-borg
+#
+######################################################################
+
+matrix_backup_borg_enabled: false
+matrix_backup_borg_location_source_directories:
+  - "{{ matrix_base_data_path }}"
+matrix_backup_borg_location_exclude_patterns: |
+  {{
+    {
+      'synapse': ["{{ matrix_synapse_media_store_path }}/local_thumbnails", "{{ matrix_synapse_media_store_path }}/remote_thumbnail", "{{ matrix_synapse_media_store_path }}/url_cache", "{{ matrix_synapse_media_store_path }}/url_cache_thumbnails"],
+    }[matrix_homeserver_implementation]
+  }}
+
+######################################################################
+#
+# /matrix-backup-borg
+#
+######################################################################
 
 ######################################################################
 #
@@ -1324,9 +1330,16 @@ matrix_mailer_container_image_self_build: "{{ matrix_architecture not in ['amd64
 #
 ######################################################################
 
-# By default, this playbook installs the ma1sd identity server on the same domain as Synapse (`matrix_server_fqn_matrix`).
+# We no longer install the ma1sd identity server by default.
-# If you wish to use the public identity servers (matrix.org, vector.im) instead of your own you may wish to disable this.
+#
-matrix_ma1sd_enabled: true
+# The main reason we used to install ma1sd by default in the past was to
+# prevent Element from talking to the `matrix.org` / `vector.im` identity servers,
+# by forcing it to talk to our own self-hosted (but otherwise useless) identity server instead,
+# thus preventing contact list leaks.
+#
+# Since Element no longer defaults to using a public identity server if another one is not provided,
+# we can stop installing ma1sd.
+matrix_ma1sd_enabled: false
 
 matrix_ma1sd_container_image_self_build: "{{ matrix_architecture != 'amd64' }}"
 
@@ -1581,15 +1594,11 @@ matrix_postgres_additional_databases: |
     }] if (matrix_synapse_enabled and matrix_synapse_database_database != matrix_postgres_db_name and matrix_synapse_database_host == 'matrix-postgres') else [])
     +
     ([{
-      'name': matrix_dendrite_naffka_database,
-      'username': matrix_dendrite_database_user,
-      'password': matrix_dendrite_database_password,
-    },{
       'name': matrix_dendrite_appservice_database,
       'username': matrix_dendrite_database_user,
       'password': matrix_dendrite_database_password,
     },{
-      'name': matrix_dendrite_federationsender_database,
+      'name': matrix_dendrite_federationapi_database,
       'username': matrix_dendrite_database_user,
       'password': matrix_dendrite_database_password,
     },{
@@ -1604,20 +1613,16 @@ matrix_postgres_additional_databases: |
       'name': matrix_dendrite_room_database,
       'username': matrix_dendrite_database_user,
       'password': matrix_dendrite_database_password,
-    },{
-      'name': matrix_dendrite_singingkeyserver_database,
-      'username': matrix_dendrite_database_user,
-      'password': matrix_dendrite_database_password,
     },{
       'name': matrix_dendrite_syncapi_database,
       'username': matrix_dendrite_database_user,
       'password': matrix_dendrite_database_password,
     },{
-      'name': matrix_dendrite_account_database,
+      'name': matrix_dendrite_userapi_database,
       'username': matrix_dendrite_database_user,
       'password': matrix_dendrite_database_password,
     },{
-      'name': matrix_dendrite_device_database,
+      'name': matrix_dendrite_pushserver_database,
       'username': matrix_dendrite_database_user,
       'password': matrix_dendrite_database_password,
     },{
@@ -2102,7 +2107,7 @@ matrix_prometheus_scraper_node_targets: "{{ ['matrix-prometheus-node-exporter:91
 matrix_prometheus_scraper_postgres_enabled: "{{ matrix_prometheus_postgres_exporter_enabled }}"
 matrix_prometheus_scraper_postgres_targets: "{{ ['matrix-prometheus-postgres-exporter:'+ matrix_prometheus_postgres_exporter_port|string] if matrix_prometheus_scraper_postgres_enabled else [] }}"
 
-matrix_prometheus_scraper_hookshot_enabled: "{{ matrix_hookshot_metrics_enabled }}"
+matrix_prometheus_scraper_hookshot_enabled: "{{ matrix_hookshot_metrics_enabled|default(false) }}"
 matrix_prometheus_scraper_hookshot_targets: "{{ [matrix_hookshot_container_url|string +':'+ matrix_hookshot_metrics_port|string] if matrix_hookshot_metrics_enabled else [] }}"
 
 ######################################################################

inventory/host_vars/matrix.finallycoffee.eu/vars.yml

@@ -0,0 +1,339 @@
+#
+# General config
+# Domain of the matrix server and SSL config
+#
+matrix_domain: finallycoffee.eu
+matrix_ssl_retrieval_method: none
+matrix_nginx_proxy_enabled: false
+matrix_base_data_path: "{{ vault_matrix_base_data_path }}"
+matrix_server_fqn_element: "chat.{{ matrix_domain }}"
+
+web_user: "web"
+revproxy_autoload_dir: "/vault/services/web/sites.d"
+
+#matrix_client_element_version: v1.8.4
+#matrix_synapse_docker_image: "{{ matrix_synapse_docker_image_name_prefix }}matrixdotorg/synapse:v1.37.1"
+#matrix_mautrix_telegram_version: v0.10.0
+
+#
+# General Synapse config
+#
+matrix_postgres_connection_password: "{{ vault_matrix_postgres_connection_password }}"
+# A secret used to protect access keys issued by the server.
+matrix_homeserver_generic_secret_key: "{{ vault_homeserver_generic_secret_key }}"
+# Make synapse accept larger media aswell
+matrix_synapse_max_upload_size_mb: 100
+# Enable metrics at (default) :9100/_synapse/metrics
+matrix_synapse_metrics_enabled: true
+matrix_synapse_enable_group_creation: true
+matrix_synapse_turn_shared_secret: "{{ vault_matrix_coturn_turn_static_auth_secret }}"
+matrix_synapse_turn_uris:
+  - "turns:voip.matrix.finallycoffee.eu?transport=udp"
+  - "turns:voip.matrix.finallycoffee.eu?transport=tcp"
+# Auto-join all users into those rooms
+matrix_synapse_auto_join_rooms:
+  - "#welcome:finallycoffee.eu"
+  - "#announcements:finallycoffee.eu"
+
+## Synapse rate limits
+matrix_synapse_rc_federation:
+  window_size: 1000
+  sleep_limit: 25
+  sleep_delay: 500
+  reject_limit: 50
+  concurrent: 5
+matrix_synapse_rc_message:
+  per_second: 0.5
+  burst_count: 25
+
+## Synapse cache tuning
+matrix_synapse_caches_global_factor: 0.7
+matrix_synapse_event_cache_size: "200K"
+
+## Synapse workers
+matrix_synapse_workers_enabled: true
+matrix_synapse_workers_preset: "little-federation-helper"
+matrix_synapse_workers_generic_worker_client_server_count: 0
+matrix_synapse_workers_media_repository_workers_count: 0
+matrix_synapse_workers_federation_sender_workers_count: 1
+matrix_synapse_workers_pusher_workers_count: 0
+matrix_synapse_workers_appservice_workers_count: 1
+
+# Static secret auth for matrix-synapse-shared-secret-auth
+matrix_synapse_ext_password_provider_shared_secret_auth_enabled: true
+matrix_synapse_ext_password_provider_shared_secret_auth_shared_secret: "{{ vault_matrix_synapse_ext_password_provider_shared_secret_auth_shared_secret }}"
+matrix_synapse_ext_password_provider_rest_auth_enabled: true
+matrix_synapse_ext_password_provider_rest_auth_endpoint: "http://matrix-ma1sd:8090"
+matrix_synapse_ext_password_provider_rest_auth_registration_enforce_lowercase: false
+matrix_synapse_ext_password_provider_rest_auth_registration_profile_name_autofill: true
+matrix_synapse_ext_password_provider_rest_auth_login_profile_name_autofill: false
+
+# Enable experimental spaces support
+matrix_synapse_configuration_extension_yaml: |
+  experimental_features:
+    spaces_enabled: true
+
+#
+# synapse-admin tool
+#
+matrix_synapse_admin_enabled: true
+matrix_synapse_admin_container_http_host_bind_port: 8985
+
+
+#
+# VoIP / CoTURN config
+#
+# A shared secret (between Synapse and Coturn) used for authentication.
+matrix_coturn_turn_static_auth_secret: "{{ vault_matrix_coturn_turn_static_auth_secret }}"
+# Disable coturn, as we use own instance
+matrix_coturn_enabled: false
+
+
+#
+# dimension (integration manager) config
+#
+matrix_dimension_enabled: true
+matrix_dimension_admins: "{{ vault_matrix_dimension_admins }}"
+matrix_server_fqn_dimension: "dimension.matrix.{{ matrix_domain }}"
+matrix_dimension_access_token: "{{ vault_matrix_dimension_access_token }}"
+matrix_dimension_configuration_extension_yaml: |
+    telegram:
+        botToken: "{{ vault_matrix_dimension_configuration_telegram_bot_token }}"
+
+
+#
+# mautrix-whatsapp config
+#
+matrix_mautrix_whatsapp_enabled: true
+matrix_mautrix_whatsapp_container_http_monitoring_host_bind_port: 9402
+matrix_mautrix_whatsapp_container_extra_arguments:
+  - "-p 127.0.0.1:{{ matrix_mautrix_whatsapp_container_http_monitoring_host_bind_port }}:{{ matrix_mautrix_whatsapp_container_http_monitoring_host_bind_port }}"
+matrix_mautrix_whatsapp_configuration_extension_yaml: |
+    bridge:
+        displayname_template: "{% raw %}{{.Name}} ({{if .Notify}}{{.Notify}}{{else}}{{.Jid}}{{end}}) (via WhatsApp){% endraw %}"
+        max_connection_attempts: 5
+        connection_timeout: 30
+        contact_wait_delay: 5
+        private_chat_portal_meta: true
+        login_shared_secret: "{{ matrix_synapse_ext_password_provider_shared_secret_auth_shared_secret }}"
+    logging:
+        print_level: info
+    metrics:
+        enabled: true
+        listen: 0.0.0.0:{{ matrix_mautrix_whatsapp_container_http_monitoring_host_bind_port }}
+    whatsapp:
+        os_name: Linux mautrix-whatsapp
+        browser_name: Chrome
+
+
+#
+# mautrix-telegram config
+#
+matrix_mautrix_telegram_enabled: true
+matrix_mautrix_telegram_api_id: "{{ vault_matrix_mautrix_telegram_api_id }}"
+matrix_mautrix_telegram_api_hash: "{{ vault_matrix_mautrix_telegram_api_hash }}"
+matrix_mautrix_telegram_public_endpoint: '/bridge/telegram'
+matrix_mautrix_telegram_container_http_monitoring_host_bind_port: 9401
+matrix_mautrix_telegram_container_http_host_bind_port_public: 8980
+matrix_mautrix_telegram_container_extra_arguments:
+  - "-p 127.0.0.1:{{ matrix_mautrix_telegram_container_http_monitoring_host_bind_port }}:{{ matrix_mautrix_telegram_container_http_monitoring_host_bind_port }}"
+  - "-p 127.0.0.1:{{ matrix_mautrix_telegram_container_http_host_bind_port_public }}:80"
+matrix_mautrix_telegram_configuration_extension_yaml: |
+    bridge:
+        displayname_template: "{displayname} (via Telegram)"
+        parallel_file_transfer: false
+        inline_images: false
+        image_as_file_size: 20
+        delivery_receipts: true
+        login_shared_secret: "{{ matrix_synapse_ext_password_provider_shared_secret_auth_shared_secret }}"
+        animated_sticker:
+            target: webm
+        encryption:
+            allow: true
+            default: true
+        permissions:
+            "@transcaffeine:finallycoffee.eu": "admin"
+            "gruenhage.xyz": "full"
+    logging:
+        root:
+            level: INFO
+    metrics:
+        enabled: true
+        listen_port: {{ matrix_mautrix_telegram_container_http_monitoring_host_bind_port }}
+#        permissions: "{{ vault_matrix_mautrix_telegram_permission_map | from_yaml }}"
+
+
+#
+# mautrix-signal config
+#
+matrix_mautrix_signal_enabled: true
+matrix_mautrix_signal_container_http_monitoring_host_bind_port: 9408
+matrix_mautrix_signal_container_extra_arguments:
+    - "-p 127.0.0.1:{{ matrix_mautrix_signal_container_http_monitoring_host_bind_port }}:{{ matrix_mautrix_signal_container_http_monitoring_host_bind_port }}"
+matrix_mautrix_signal_configuration_extension_yaml: |
+    bridge:
+        displayname_template: "{displayname} (via Signal)"
+        community_id: "+signal:finallycoffee.eu"
+        encryption:
+            allow: true
+            default: true
+            key_sharing:
+                allow: true
+                require_verification: false
+        delivery_receipts: true
+    logging:
+        root:
+            level: INFO
+    metrics:
+        enabled: true
+        listen_port: {{ matrix_mautrix_signal_container_http_monitoring_host_bind_port }}
+
+
+#
+# mx-puppet-instagram configuration
+#
+matrix_mx_puppet_instagram_enabled: true
+matrix_mx_puppet_instagram_container_http_monitoring_host_bind_port: 9403
+matrix_mx_puppet_instagram_container_extra_arguments:
+  - "-p 127.0.0.1:{{ matrix_mx_puppet_instagram_container_http_monitoring_host_bind_port }}:{{ matrix_mx_puppet_instagram_container_http_monitoring_host_bind_port }}"
+matrix_mx_puppet_instagram_configuration_extension_yaml: |
+    bridge:
+        enableGroupSync: true
+        avatarUrl: mxc://finallycoffee.eu/acmiSAinuHDOULofFFeolTvr
+    metrics:
+        enabled: true
+        port: {{ matrix_mx_puppet_instagram_container_http_monitoring_host_bind_port }}
+        path: /metrics
+    presence:
+        enabled: true
+        interval: 3000
+
+
+#
+# mx-puppet-skype configuration
+#
+matrix_mx_puppet_skype_enabled: true
+matrix_mx_puppet_skype_container_http_monitoring_host_bind_port: 9405
+matrix_mx_puppet_skype_container_extra_arguments:
+  - "-p 127.0.0.1:{{ matrix_mx_puppet_skype_container_http_monitoring_host_bind_port }}:{{ matrix_mx_puppet_skype_container_http_monitoring_host_bind_port }}"
+matrix_mx_puppet_skype_configuration_extension_yaml: |
+    bridge:
+        enableGroupSync: true
+        avatarUrl: mxc://finallycoffee.eu/jjXDuFqtpFOBOnywoHgzTuYt
+    metrics:
+        enabled: true
+        port: {{ matrix_mx_puppet_skype_container_http_monitoring_host_bind_port }}
+        path: /metrics
+
+
+#
+# mx-puppet-discord configuration
+#
+matrix_mx_puppet_discord_enabled: true
+matrix_mx_puppet_discord_client_id: "{{ vault_matrix_mx_puppet_discord_client_id }}"
+matrix_mx_puppet_discord_client_secret: "{{ vault_matrix_mx_puppet_discord_client_secret }}"
+matrix_mx_puppet_discord_container_http_monitoring_host_bind_port: 9404
+matrix_mx_puppet_discord_container_extra_arguments:
+  - "-p 127.0.0.1:{{ matrix_mx_puppet_discord_container_http_monitoring_host_bind_port }}:{{ matrix_mx_puppet_discord_container_http_monitoring_host_bind_port }}"
+matrix_mx_puppet_discord_configuration_extension_yaml: |
+    bridge:
+        enableGroupSync: true
+        avatarUrl: mxc://finallycoffee.eu/BxcAAhjXmglMbtthStEHtCzd
+    metrics:
+        enabled: true
+        port: {{ matrix_mx_puppet_discord_container_http_monitoring_host_bind_port }}
+        path: /metrics
+    limits:
+        maxAutojoinUsers: 500
+        roomUserAutojoinDelay: 50
+    presence:
+        enabled: true
+        interval: 3000
+
+
+#
+# mx-puppet-slack configuration
+#
+matrix_mx_puppet_slack_enabled: true
+matrix_mx_puppet_slack_client_id: "{{ vault_matrix_mx_puppet_slack_client_id }}"
+matrix_mx_puppet_slack_client_secret: "{{ vault_matrix_mx_puppet_slack_client_secret }}"
+matrix_mx_puppet_slack_redirect_path: '/bridge/slack/oauth'
+matrix_mx_puppet_slack_container_http_auth_host_bind_port: 8981
+matrix_mx_puppet_slack_container_http_monitoring_host_bind_port: 9406
+matrix_mx_puppet_slack_container_extra_arguments:
+  - "-p 127.0.0.1:{{ matrix_mx_puppet_slack_container_http_monitoring_host_bind_port }}:{{ matrix_mx_puppet_slack_container_http_monitoring_host_bind_port }}"
+  - "-p 127.0.0.1:{{ matrix_mx_puppet_slack_container_http_auth_host_bind_port }}:8008"
+matrix_mx_puppet_slack_configuration_extension_yaml: |
+    bridge:
+        enableGroupSync: true
+    metrics:
+        enabled: true
+        port: {{ matrix_mx_puppet_slack_container_http_monitoring_host_bind_port }}
+        path: /metrics
+    limits:
+        maxAutojoinUsers: 500
+        roomUserAutojoinDelay: 50
+    presence:
+        enabled: true
+        interval: 3000
+
+
+#
+# Element web configuration
+#
+# Branding config
+matrix_client_element_brand: "Chat"
+matrix_client_element_default_theme: "dark"
+matrix_client_element_themes_enabled: true
+matrix_client_element_welcome_headline: "Welcome to chat.finallycoffee.eu"
+matrix_client_element_welcome_text: |
+    Decentralised, encrypted chat &amp; collaboration,<br />
+    hosted on finallycoffee.eu, powered by element.io &amp;
+    <a href="https://matrix.org" target="_blank" rel="noreferrer noopener">
+      <img width="79" height="34" alt="[matrix]" style="padding-left: 1px;vertical-align: middle" src="welcome/images/matrix.svg" />
+    </a>
+matrix_client_element_welcome_logo: "welcome/images/logo.png"
+matrix_client_element_welcome_logo_link: "https://{{ matrix_domain }}"
+matrix_client_element_branding_authHeaderLogoUrl: "welcome/images/logo.png"
+matrix_client_element_branding_welcomeBackgroundUrl: "welcome/images/background.jpg"
+matrix_client_element_container_extra_arguments:
+  - "-v {{ matrix_client_element_data_path }}/background.jpg:/app/{{ matrix_client_element_branding_welcomeBackgroundUrl }}:ro"
+  - "-v {{ matrix_client_element_data_path }}/logo.png:/app/{{ matrix_client_element_branding_authHeaderLogoUrl }}:ro"
+# Integration and capabilites config
+matrix_client_element_integrations_ui_url: "https://{{ matrix_server_fqn_dimension }}/element"
+matrix_client_element_integrations_rest_url: "https://{{ matrix_server_fqn_dimension }}/api/v1/scalar"
+matrix_client_element_integrations_widgets_urls:
+  - "https://{{ matrix_server_fqn_dimension }}/widgets"
+  - "https://scalar.vector.im/api"
+matrix_client_element_integrations_jitsi_widget_url: "https://{{ matrix_server_fqn_dimension }}/widgets/jitsi"
+matrix_client_element_disable_custom_urls: false
+matrix_client_element_roomdir_servers:
+  - "matrix.org"
+  - "finallycoffee.eu"
+  - "entropia.de"
+matrix_client_element_enable_presence_by_hs_url:
+  https://matrix.org: false
+
+
+# Matrix ma1sd extended configuration
+matrix_ma1sd_configuration_extension_yaml: |
+    hashing:
+      enabled: true
+      pepperLength: 20
+      rotationPolicy: per_requests
+      requests: 10
+      hashStorageType: sql
+      algorithms:
+          - none
+          - sha256
+
+
+# Matrix mail notification relay setup
+matrix_mailer_enabled: true
+matrix_mailer_sender_address: "Matrix on finallycoffee.eu <system-matrix@{{ matrix_domain }}>"
+matrix_mailer_relay_use: true
+matrix_mailer_relay_host_name: "{{ vault_matrix_mailer_relay_host_name }}"
+matrix_mailer_relay_host_port: 587
+matrix_mailer_relay_auth: true
+matrix_mailer_relay_auth_username: "{{ vault_matrix_mailer_relay_auth_username }}"
+matrix_mailer_relay_auth_password: "{{ vault_matrix_mailer_relay_auth_password }}"

inventory/host_vars/matrix.finallycoffee.eu/vault.yml

@@ -0,0 +1,100 @@
+$ANSIBLE_VAULT;1.1;AES256
+39366364363633336238333130353832663162393038633665396333343732353964333363666539
+6562346632343235623835643735386434316666393234360a383634616537393134613631383836
+61333835363666623033306166376232303930306433343366373463653234623736643633383734
+3330333665383539650a383132353032386230393031626361343764323034386230363066306331
+34646236336262623435633566363033613737373064616266336237343233663066396163373034
+62303765353066653737366539626461636531636438323932333134363136363134646164646531
+63656638666233313437663261396665653736373164323433306435323336633938313164646264
+33653661633965363833393031616463633761356234633630643562306366653133366637346166
+38636433343736343461613731623538633361363934343764326466313261353633646230353065
+37366134303164356433333961346663313963626165323966656536313532376162326565383539
+65363333633964323838663461373666353665643236623839646664653661613838353239613137
+39353061323131306365656261343630313665356165623064616436653566373663343733316237
+34393666383465323463313838393465643830373632373938633763666636346539666233303265
+38353337633833373331356663633936326334366337393135653030333531613565643666633038
+64393862303765366632393137313432376563353335353231323464633637343334346634306534
+35613330373336633031376263306466306437656635396133613335386130346163663438386136
+61646437343938663431343736363564376238316666373531616231366132643864346538363866
+35396433366137356162313963666134383134306462313336613735386639363936326131383939
+66623833643433663039623837623133303336666233623935313438366136353332313165333936
+31386632336535383533646639636164313331346630633366383739623261366465656632393062
+63373332623738303364623437666531396331646666336230353333366261653438363861656466
+39333762633037383336393164616563396564383232636533363864636230616664303330323932
+66666234633362346132303932643464366466323535303835363430333737666661373534333934
+61393362616438626636383564613335363634626231663234616438343464383461303632363033
+39336362396339316661323662393665383031643931626333646335643335353661653939363538
+38666561313539613566386132336630643237333432656236356132616230663561343665353938
+33366663353834356434366335373265373439363430636533303933656264366338623232613435
+35356662383232386137313064313363303861326635333435393737643663336534363234623430
+32376432353330613666396337303935376366613564353039396164383361616337656535346166
+34396635356266326461613135303639643935363261396363636338636564643838313262326266
+31663139343336376233303637373864363835313839326433656235616332333134306139623239
+37636639356263646437373362333931613262363363313462666534643765313139386461623731
+33376635653133353033333733613464396632636634313063326363313030376632643863336237
+61636638353237313764313435626463633964643665313536326235343639663137373436303564
+30636232626137376339303238653664346538356430306238633037366332316263623666373062
+63646533646131303466653637346463613237323161313265613834383634626237323563653733
+38656435303264346663663465333966376631666530333833353233376263336436613065366362
+36366263343438393132326661623031316663663231663464383732343064383234616636306530
+66613634626362316533303034393063666632343262613431613635663866636433623535363238
+30643933613731363236346234336662613633323831633437613435326465383530653765616262
+63373538396364316563343365303134373466663639386137663564356532353531343636613135
+63316463353264316164306566326462333732316431643939626161346530636638636662303037
+34346461313961613063336332333934383363373335616636363661396362613661383762663866
+64303834636264376461396266663763336665356561376161333136336638646363313133353161
+31643061623833623239373432633537663664636334623534326639616633616361333834366131
+30376361656238353332656666316637643133623433333861653265636266376639666135383638
+37363337326231656530363536393737383565666266306532626361633633353539363866376534
+61303737326632303762626666306134343837376566343035386663613336626332383035383035
+37633462373066373062313862323766316362393832666466396637363562353865303366323062
+39346332383966313437646138623364656234663066663639663138626163656433363038323166
+65613862386665643438323061323763306635666162303366323131363436633335356332393366
+63373966383132303434633835333438333337303664346335643066623839343835643364306561
+34643336346564363462396330643263653931376664386335313433376332653832323437376135
+35383231386133363236653334393433306638303131323064343931623538323130343666653061
+36353536383632333964343730346265626433303131346531303133663832363036333261386237
+30363361356265356139323761623563396565336137333733656431636531333234323061343862
+33623935346663333735613661363234646234356331323636386637343661373363363261646231
+33643233343235323230393933616664623166666266333862323631653835666135303233653635
+63373061656163353762636531613632366638383366303864343132376162643963366564363563
+61336338613935613532636165383463633866633036393533313433643562313737383431353163
+37623165373933376236393931363939633963666636303136373065376635623761346537643530
+35363464313630376233633863306238616138666464316534363332333937343362343233346431
+34643032323934353939666364323239653932363735373061633434653062326336353239633261
+38306237336266663038656534393664646138343038323335633064616431386666613739326630
+34383963666534313530376331366238343836303036306336343533666332386163643033643138
+33336333333338353733383165306139623964303035653439623131633566356136386431613135
+63616462386639303230343866346631346532353531373132613433363239646330653666633532
+65393766333238383531313132633537633833363335303630376239396565373730646331313633
+30383861303739343265623934643635633361623262356433323035393062353630346430646262
+63303434353038646361353661616339313937323336303566303536366163623362356332383862
+37326333393761633732653264646333653439363039323238383361336233323232613336303464
+34393635633131313135313665363161306466643364393734346264633030373234306466653862
+32336163666435636162343465386633653863363533616339636531306130383331376563393533
+65366136626662343065383164646665613035393636373565346235656439303933343563366339
+36643838393033353033396535613331303031646162316361613564323163633434633861356135
+62343461616335323565636633383962316531316362396165366533346166336163623232366261
+39376230376562626135346333326437373733373266393236383435343562653034313133376236
+61666138346562613330633630373837653465393233613261353937336666646231366666393335
+35393463333936323664323831396639333462626238613164616435363664643438653763623431
+32663237363134353061373563396535653565636431366565386337653863316333343738343432
+62303132636338303462313439376535363063333833363632613832303436353834376561333330
+66633632383135646263626333643230343630326539663762633934316261633062663732373932
+30306438386263626335373838343236643562326135663366353638353163346365396261313133
+36333634306133353235316237343738623263333732343063356238333162323931346664346539
+66323733643061386334306130633537353630663336313966663538373963313435666564316539
+63613030366332363432303036396232306537663765653938353736376135316539613135623632
+66356639623635663365323635646635383638346539323438336261393332373935383536333831
+61306639343061333639336162366536366438356166396266666132303932333037613632623666
+63616662343830303664353931306632323630316162643432653835313962633735626163366332
+34373637633066333432383533316363613031393963373963386161663430623533383165653561
+38343439633066366663643138326264653539336530393932386236366533663935353664343966
+39323161646231353234633961633732613065323039663062313661386565366534623430356632
+64343732336238393262363338363734643639353830646163343361653761633134303163616562
+35633436393832393137383534613031303963613339333566343065336530623964636662353065
+32366630353538383339346465376661323666333234373665613164633866363364613066643034
+37616630366232353166366535633936366536626462353831643335306337353564316461653564
+66663133373466333431336366346435623436656230376232613665633466333463636263373464
+30386434336538303061666566383033616563303564666362346432663130306531613063363537
+646635613236636563666161666630653836

inventory/hosts

@@ -0,0 +1,22 @@
+$ANSIBLE_VAULT;1.1;AES256
+31336566376336626265653165306635633033376662656164383037383834653239656136333734
+3833666339393037323035343565343235396163636166370a643933333933386133366564396465
+30393637613164356564393337633361653432333232383664303739363736633435363764343530
+3532313739363963660a343434356534316230623133636366386334323465376139363162616238
+39396638366262313531653635326361616537396338363533303961623165343931373939306239
+31336632643166633662653765333231393461643933306464303165633037343061323636313034
+34376631656563646665373566633431366638383863666130323264316337663237343135306236
+66323536346164663239343139623430303230333466633437643337343930363530653964626163
+38336363633730393136333637383631636266396636646533356262376630646139303636666538
+32366437353163663865623234643061313639646162643965393535353938313133326237313265
+66646163333535396539646461356334633532313530653834623263386265383765356130333466
+30373531306137393935363030313739666536363138363962646565306439393239303030643162
+33333166663430393866666439653532623034396130313066383035396535646633366237303264
+36356665366461323664373038366364623937386233313039323837666333653764616462333365
+31326264633236373937313537633961633164323138356135633765663639323537656263633766
+38653836323263386333376131333330326237393666363064326463663961633839393039323835
+61306265333232623037356465393133323733363634646364336261326333366239346565366338
+61646132333033373866623739343830336164316461646366666237313565626639323537623732
+38323830656136323137323530343764666433633432366136643538323832653130376363653135
+64376261386635636533353961613335663962306337353866616464613636303735336230623962
+3336

roles/matrix-awx/defaults/main.yml

@@ -1,8 +0,0 @@
----
-
-matrix_awx_enabled: true
-
-# Defaults for 'Customise Website + Access Export' template
-awx_sftp_auth_method: 'Disabled'
-awx_sftp_password: ''
-awx_sftp_public_key: ''

roles/matrix-awx/scripts/matrix_build_room_list.py

@@ -1,29 +0,0 @@
-
-import sys
-import requests
-import json
-
-janitor_token = sys.argv[1]
-synapse_container_ip = sys.argv[2]
-synapse_container_port = sys.argv[3]
-
-# collect total amount of rooms
-
-rooms_raw_url = 'http://' + synapse_container_ip + ':' + synapse_container_port + '/_synapse/admin/v1/rooms'
-rooms_raw_header = {'Authorization': 'Bearer ' + janitor_token}
-rooms_raw = requests.get(rooms_raw_url, headers=rooms_raw_header)
-rooms_raw_python = json.loads(rooms_raw.text)
-total_rooms = rooms_raw_python["total_rooms"]
-
-# build complete room list file
-
-room_list_file = open("/tmp/room_list_complete.json", "w")
-
-for i in range(0, total_rooms, 100):
-  rooms_inc_url = 'http://' + synapse_container_ip + ':' + synapse_container_port + '/_synapse/admin/v1/rooms?from=' + str(i)
-  rooms_inc = requests.get(rooms_inc_url, headers=rooms_raw_header)
-  room_list_file.write(rooms_inc.text)
-
-room_list_file.close()
-
-print(total_rooms)

roles/matrix-awx/surveys/access_export.json.j2

@@ -1,42 +0,0 @@
-{
-  "name": "Access Export",
-  "description": "Access the services export.",
-  "spec": [
-    {
-      "question_name": "SFTP Authorisation Method",
-      "question_description": "Set whether you want to disable SFTP, use a password to connect to SFTP or connect with a more secure SSH key.",
-      "required": true,
-      "min": null,
-      "max": null,
-      "default": "{{ awx_sftp_auth_method | string }}",
-      "choices": "Disabled\nPassword\nSSH Key",
-      "new_question": true,
-      "variable": "awx_sftp_auth_method",
-      "type": "multiplechoice"
-    },
-    {
-      "question_name": "SFTP Password",
-      "question_description": "Sets the password of the 'sftp' account, which allows you to upload a multi-file static website by SFTP, as well as export the latest copy of your Matrix service. Must be defined if 'Password' method is selected. WARNING: You must set a strong and unique password here.",
-      "required": false,
-      "min": 0,
-      "max": 64,
-      "default": "{{ awx_sftp_password }}",
-      "choices": "",
-      "new_question": true,
-      "variable": "awx_sftp_password",
-      "type": "password"
-    },
-    {
-      "question_name": "SFTP Public SSH Key (More Secure)",
-      "question_description": "Sets the public SSH key used to access the 'sftp' account, which allows you to upload a multi-file static website by SFTP, as well as export the latest copy of your Matrix service. Must be defined if 'SSH Key' method is selected.",
-      "required": false,
-      "min": 0,
-      "max": 16384,
-      "default": "{{ awx_sftp_public_key }}",
-      "choices": "",
-      "new_question": true,
-      "variable": "awx_sftp_public_key",
-      "type": "text"
-    }
-  ]
-}

roles/matrix-awx/surveys/backup_server.json.j2

@@ -1,18 +0,0 @@
-{
-  "name": "Backup Server",
-  "description": "Performs a backup of the entire service to a remote location.",
-  "spec": [
-    {
-      "question_name": "Enable Backup",
-      "question_description": "Set if remote backup is enabled or not. If enabled a daily backup of your server will be sent to the backup server located in {{ backup_server_location }}.",
-      "required": false,
-      "min": null,
-      "max": null,
-      "default": "{{ awx_backup_enabled | string | lower }}",
-      "choices": "true\nfalse",
-      "new_question": true,
-      "variable": "awx_backup_enabled",
-      "type": "multiplechoice"
-    }
-  ]
-}

roles/matrix-awx/surveys/bridge_discord_appservice.json.j2

@@ -1,66 +0,0 @@
-{
-  "name": "Bridge Discord Appservice",
-  "description": "Enables a private bridge you can use to connect Matrix rooms to Discord.",
-  "spec": [
-    {
-      "question_name": "Enable Discord AppService Bridge",
-      "question_description": "Enables a private bridge you can use to connect Matrix rooms to Discord.",
-      "required": true,
-      "min": null,
-      "max": null,
-      "default": "{{ matrix_appservice_discord_enabled | string | lower }}",
-      "choices": "true\nfalse",
-      "new_question": true,
-      "variable": "matrix_appservice_discord_enabled",
-      "type": "multiplechoice"
-    },
-    {
-      "question_name": "Discord OAuth2 Client ID",
-      "question_description": "The OAuth2 'CLIENT ID' which can be found in the 'OAuth2' tab of your new discord application: https://discord.com/developers/applications",
-      "required": true,
-      "min": 0,
-      "max": 128,
-      "default": "{{ matrix_appservice_discord_client_id | trim }}",
-      "choices": "",
-      "new_question": true,
-      "variable": "matrix_appservice_discord_client_id",
-      "type": "text"
-    },
-    {
-      "question_name": "Discord Bot Token",
-      "question_description": "The Bot 'TOKEN' which can be found in the 'Bot' tab of your new discord application: https://discord.com/developers/applications",
-      "required": true,
-      "min": 0,
-      "max": 256,
-      "default": "{{ matrix_appservice_discord_bot_token | trim }}",
-      "choices": "",
-      "new_question": true,
-      "variable": "matrix_appservice_discord_bot_token",
-      "type": "password"
-    },
-    {
-      "question_name": "Auto-Admin Matrix User",
-      "question_description": "The username you would like to be automatically joined and promoted to administrator (PL100) in bridged rooms. Exclude the '@' and server name postfix. So to create @stevo:example.org just enter 'stevo'.",
-      "required": false,
-      "min": 0,
-      "max": 1024,
-      "default": "",
-      "choices": "",
-      "new_question": true,
-      "variable": "awx_appservice_discord_admin_user",
-      "type": "text"
-    },
-    {
-      "question_name": "Auto-Admin Rooms",
-      "question_description": "A list of rooms you want the user to be automatically joined and promoted to administrator (PL100) in. These should be the internal IDs (for example '!axfBUsKhfAjSMBdjKX:example.org') separated by newlines.",
-      "required": false,
-      "min": 0,
-      "max": 4096,
-      "default": "",
-      "choices": "",
-      "new_question": true,
-      "variable": "awx_appservice_discord_admin_rooms",
-      "type": "textarea"
-    }
-  ]
-}

roles/matrix-awx/surveys/configure_corporal.json.j2

@@ -1,88 +0,0 @@
-{
-  "name": "Configure Matrix Corporal",
-  "description": "Configure Matrix Corporal, a tool that manages your Matrix server according to a configuration policy.",
-  "spec": [
-    {
-      "question_name": "Enable Corporal",
-      "question_description": "Controls if Matrix Corporal is enabled at all. If you're unsure if you need Matrix Corporal or not, you most likely don't.",
-      "required": true,
-      "min": null,
-      "max": null,
-      "default": "{{ matrix_corporal_enabled|string|lower }}",
-      "choices": "true\nfalse",
-      "new_question": true,
-      "variable": "matrix_corporal_enabled",
-      "type": "multiplechoice"
-    },
-    {
-      "question_name": "Corporal Policy Provider",
-      "question_description": "Controls what provider policy is used with Matrix Corporal.",
-      "required": true,
-      "min": null,
-      "max": null,
-      "default": "{{ awx_corporal_policy_provider_mode }}",
-      "choices": "Simple Static File\nHTTP Pull Mode (API Enabled)\nHTTP Push Mode (API Enabled)",
-      "new_question": true,
-      "variable": "awx_corporal_policy_provider_mode",
-      "type": "multiplechoice"
-    },
-    {
-      "question_name": "Simple Static File Configuration",
-      "question_description": "The configuration file for Matrix Corporal, only needed if 'Simple Static File' provider is selected, any configuration entered here will be saved and applied.",
-      "required": false,
-      "min": 0,
-      "max": 65536,
-      "default": "",
-      "new_question": true,
-      "variable": "awx_corporal_simple_static_config",
-      "type": "textarea"
-    },
-    {
-      "question_name": "HTTP Pull Mode URI",
-      "question_description": "The network address to remotely fetch the configuration from. Only needed if 'HTTP Pull Mode (API Enabled)' provider is selected.",
-      "required": false,
-      "min": 0,
-      "max": 4096,
-      "default": "{{ awx_corporal_pull_mode_uri }}",
-      "new_question": true,
-      "variable": "awx_corporal_pull_mode_uri",
-      "type": "text"
-    },
-    {
-      "question_name": "HTTP Pull Mode Authentication Token",
-      "question_description": "An authentication token for pulling the Corporal configuration from a network location. Only needed if 'HTTP Pull Mode (API Enabled)' provider is selected. WARNING: You must set a strong and unique password here.",
-      "required": false,
-      "min": 0,
-      "max": 256,
-      "default": "{{ awx_corporal_pull_mode_token }}",
-      "choices": "",
-      "new_question": true,
-      "variable": "awx_corporal_pull_mode_token",
-      "type": "password"
-    },
-    {
-      "question_name": "Corporal API Authentication Token",
-      "question_description": "An authentication token for interfacing with Corporals API. Only needed to be set if 'HTTP Pull Mode (API Enabled)' or 'HTTP Push Mode (API Enabled)' provider is selected. WARNING: You must set a strong and unique password here.",
-      "required": false,
-      "min": 0,
-      "max": 256,
-      "default": "{{ matrix_corporal_http_api_auth_token }}",
-      "choices": "",
-      "new_question": true,
-      "variable": "matrix_corporal_http_api_auth_token",
-      "type": "password"
-    },
-    {
-      "question_name": "Raise Synapse Ratelimits",
-      "question_description": "For Matrix Corporal to work you will need to temporarily raise the rate limits for logins, please return this value to 'Normal' after you're done using Corporal.",
-      "required": false,
-      "min": null,
-      "max": null,
-      "default": "{{ awx_corporal_raise_ratelimits }}",
-      "choices": "Normal\nRaised",
-      "new_question": true,
-      "variable": "awx_corporal_raise_ratelimits",
-      "type": "multiplechoice"
-    }
-  ]
-}

roles/matrix-awx/surveys/configure_dimension.json.j2

@@ -1,30 +0,0 @@
-{
-  "name": "Configure Dimension",
-  "description": "Configure Dimension, the self-hosted integrations server.",
-  "spec": [
-    {
-      "question_name": "Enable Dimension",
-      "question_description": "Enables the Dimension integration server, before doing this you need to create a CNAME record for 'dimension.{{ matrix_domain }}' that points to 'matrix.{{ matrix_domain }}'.",
-      "required": false,
-      "min": null,
-      "max": null,
-      "default": "{{ matrix_dimension_enabled | string | lower }}",
-      "choices": "true\nfalse",
-      "new_question": true,
-      "variable": "matrix_dimension_enabled",
-      "type": "multiplechoice"
-    },
-    {
-      "question_name": "Dimension Users",
-      "question_description": "Here you can list the user accounts that will be able to configure Dimension. Entries must be seperated with newlines and must be a complete Matrix ID. For example: '@dimension:{{ matrix_domain }}'",
-      "required": false,
-      "min": 0,
-      "max": 65536,
-      "default": {{ awx_dimension_users_final | to_json }},
-      "choices": "",
-      "new_question": true,
-      "variable": "awx_dimension_users",
-      "type": "textarea"
-    }
-  ]
-}

roles/matrix-awx/surveys/configure_element.json.j2

@@ -1,114 +0,0 @@
-{
-  "name": "Configure Element",
-  "description": "Configure Element web client, Element is the most developed Matrix client software.",
-  "spec": [
-    {
-      "question_name": "Enable Element-Web",
-      "question_description": "Set if Element web client is enabled or not.",
-      "required": true,
-      "min": null,
-      "max": null,
-      "default": "{{ matrix_client_element_enabled }}",
-      "choices": "true\nfalse",
-      "new_question": true,
-      "variable": "matrix_client_element_enabled",
-      "type": "multiplechoice"
-    },
-    {
-      "question_name": "Set Theme for Web Client",
-      "question_description": "Sets the default theme for the web client, can be changed later by individual users.",
-      "required": false,
-      "min": null,
-      "max": null,
-      "default": "{{ matrix_client_element_default_theme }}",
-      "choices": "light\ndark",
-      "new_question": true,
-      "variable": "matrix_client_element_default_theme",
-      "type": "multiplechoice"
-    },
-    {
-      "question_name": "Set Branding for Web Client",
-      "question_description": "Sets the 'branding' seen in the tab and on the welcome page to a custom value.Leaving this field blank will cause the default branding will be used: 'Element'",
-      "required": false,
-      "min": 0,
-      "max": 256,
-      "default": "{{ matrix_client_element_brand | trim }}",
-      "choices": "",
-      "new_question": true,
-      "variable": "matrix_client_element_brand",
-      "type": "text"
-    },
-    {
-      "question_name": "Set Welcome Page Background",
-      "question_description": "Sets the background image on the welcome page, you should enter a URL to the image you want to use. Must be a 'https' link, otherwise it won't be set. Leaving this field blank will cause the default background to be used.",
-      "required": false,
-      "min": 0,
-      "max": 1024,
-      "default": "{{ matrix_client_element_branding_welcomeBackgroundUrl | trim }}",
-      "choices": "",
-      "new_question": true,
-      "variable": "matrix_client_element_branding_welcomeBackgroundUrl",
-      "type": "text"
-    },
-    {
-      "question_name": "Set Welcome Page Logo",
-      "question_description": "Sets the logo found on the welcome and login page, must be a valid https link to your logo, the logo itself should be a square vector image (SVG). Leaving this field blank will cause the default Element logo to be used.",
-      "required": false,
-      "min": 0,
-      "max": 1024,
-      "default": "{{ matrix_client_element_welcome_logo | trim }}",
-      "choices": "",
-      "new_question": true,
-      "variable": "matrix_client_element_welcome_logo",
-      "type": "text"
-    },
-    {
-      "question_name": "Set Welcome Page Logo URL",
-      "question_description": "Sets the URL link the welcome page logo leads to, must be a valid https link. Leaving this field blank will cause this default link to be used: 'https://element.io'",
-      "required": false,
-      "min": 0,
-      "max": 1024,
-      "default": "{{ matrix_client_element_welcome_logo_link | trim }}",
-      "choices": "",
-      "new_question": true,
-      "variable": "matrix_client_element_welcome_logo_link",
-      "type": "text"
-    },
-    {
-      "question_name": "Set Welcome Page Headline",
-      "question_description": "Sets the headline seen on the welcome page. Leaving this field blank will cause this default headline to be used: 'Welcome to Element!'",
-      "required": false,
-      "min": 0,
-      "max": 512,
-      "default": "{{ awx_matrix_client_element_welcome_headline | trim }}",
-      "choices": "",
-      "new_question": true,
-      "variable": "awx_matrix_client_element_welcome_headline",
-      "type": "text"
-    },
-    {
-      "question_name": "Set Welcome Page Text",
-      "question_description": "Sets the text seen on the welcome page. Leaving this field blank will cause this default headline to be used: 'Decentralised, encrypted chat & collaboration powered by [Matrix]'",
-      "required": false,
-      "min": 0,
-      "max": 2048,
-      "default": "{{ awx_matrix_client_element_welcome_text | trim }}",
-      "choices": "",
-      "new_question": true,
-      "variable": "awx_matrix_client_element_welcome_text",
-      "type": "text"
-    },
-    {
-      "question_name": "Show Registration Button",
-      "question_description": "If you show the registration button on the welcome page.",
-      "required": false,
-      "min": null,
-      "max": null,
-      "default": "{{ matrix_client_element_registration_enabled }}",
-      "choices": "true\nfalse",
-      "new_question": true,
-      "variable": "matrix_client_element_registration_enabled",
-      "type": "multiplechoice"
-    }
-  ]
-}

roles/matrix-awx/surveys/configure_element_subdomain.json.j2

@@ -1,18 +0,0 @@
-{
-  "name": "Configure Element Subdomain",
-  "description": "Configure Element clients subdomain location. (Eg: 'element' for element.example.org)",
-  "spec": [
-    {
-      "question_name": "Set Element Subdomain",
-      "question_description": "Sets the subdomain of the Element web-client, you should only specify the subdomain, not the base domain you've already set. (Eg: 'element' for element.example.org) Note that if you change this value you'll need to reconfigure your DNS.",
-      "required": false,
-      "min": 0,
-      "max": 2048,
-      "default": "{{ awx_element_subdomain }}",
-      "choices": "",
-      "new_question": true,
-      "variable": "awx_element_subdomain",
-      "type": "text"
-    }
-  ]
-}

roles/matrix-awx/surveys/configure_email_relay.json.j2

@@ -1,19 +0,0 @@
-{
-  "name": "Configure Email Relay",
-  "description": "Enable MailGun relay to increase verification email reliability.",
-  "spec": [
-    {
-      "question_name": "Enable Email Relay",
-      "question_description": "Enables the MailGun email relay server, enabling this will increase the reliability of your email verification.",
-      "required": false,
-      "min": null,
-      "max": null,
-      "default": "{{ matrix_mailer_relay_use | string | lower }}",
-      "choices": "true\nfalse",
-      "new_question": true,
-      "variable": "matrix_mailer_relay_use",
-      "type": "multiplechoice"
-    }
-  ]
-}
-

roles/matrix-awx/surveys/configure_jitsi.json.j2

@@ -1,31 +0,0 @@
-{
-  "name": "Configure Jitsi",
-  "description": "Configure Jitsi conferencing settings.",
-  "spec": [
-    {
-      "question_name": "Enable Jitsi",
-      "question_description": "Set if Jitsi is enabled or not. If disabled your server will use the https://jitsi.riot.im server. If you're on a smaller server disabling this might increase the performance of your Matrix service.",
-      "required": false,
-      "min": null,
-      "max": null,
-      "default": "{{ matrix_jitsi_enabled }}",
-      "choices": "true\nfalse",
-      "new_question": true,
-      "variable": "matrix_jitsi_enabled",
-      "type": "multiplechoice"
-    },
-    {
-      "question_name": "Set Default Language",
-      "question_description": "2 digit 639-1 language code to adjust the language of the web client. For a list of possible codes see: https://en.wikipedia.org/wiki/List_of_ISO_639-1_codes",
-      "required": false,
-      "min": 0,
-      "max": 2,
-      "default": "{{ matrix_jitsi_web_config_defaultLanguage }}",
-      "choices": "",
-      "new_question": true,
-      "variable": "matrix_jitsi_web_config_defaultLanguage",
-      "type": "text"
-    }
-  ]
-}
-

roles/matrix-awx/surveys/configure_ma1sd.json.j2

@@ -1,41 +0,0 @@
-{
-  "name": "Configure ma1sd",
-  "description": "Configure ma1sd settings, ma1sd is a self-hosted identity server for Matrix.",
-  "spec": [
-    {
-      "question_name": "Enable ma1sd",
-      "question_description": "Set if ma1sd is enabled or not. If disabled your server will loose identity functionality (not recommended).",
-      "required": false,
-      "min": null,
-      "max": null,
-      "default": "{{ matrix_ma1sd_enabled | string | lower }}",
-      "choices": "true\nfalse",
-      "new_question": true,
-      "variable": "matrix_ma1sd_enabled",
-      "type": "multiplechoice"
-    },
-    {
-      "question_name": "ma1sd Authentication Mode",
-      "question_description": "Set the source of user account authentication credentials with the ma1sd.",
-      "required": false,
-      "min": null,
-      "max": null,
-      "default": "{{ awx_matrix_ma1sd_auth_store }}",
-      "choices": "Synapse Internal\nLDAP/AD",
-      "new_question": true,
-      "variable": "awx_matrix_ma1sd_auth_store",
-      "type": "multiplechoice"
-    },
-    {
-      "question_name": "LDAP/AD Configuration",
-      "question_description": "Settings for connecting LDAP/AD to the ma1sd service. (ignored if using Synapse Internal, see https://github.com/ma1uta/ma1sd/blob/master/docs/stores/README.md )",
-      "required": false,
-      "min": 0,
-      "max": 65536,
-      "default": {{ awx_matrix_ma1sd_configuration_extension_yaml | to_json }},
-      "new_question": true,
-      "variable": "awx_matrix_ma1sd_configuration_extension_yaml",
-      "type": "textarea"
-    }
-  ]
-}

roles/matrix-awx/surveys/configure_synapse.json.j2

@@ -1,198 +0,0 @@
-{
-  "name": "Configure Synapse",
-  "description": "Configure Synapse settings. Synapse is the homeserver software that powers your Matrix instance.",
-  "spec": [
-    {
-      "question_name": "Enable Public Registration",
-      "question_description": "Controls whether people with access to the homeserver can register by themselves.",
-      "required": false,
-      "min": null,
-      "max": null,
-      "default": "{{ matrix_synapse_enable_registration | string | lower }}",
-      "choices": "true\nfalse",
-      "new_question": true,
-      "variable": "matrix_synapse_enable_registration",
-      "type": "multiplechoice"
-    },
-    {
-      "question_name": "Enable Federation",
-      "question_description": "Controls whether Synapse will federate at all. Disable this to completely isolate your server from the rest of the Matrix network.",
-      "required": false,
-      "min": null,
-      "max": null,
-      "default": "{{ matrix_synapse_federation_enabled | string | lower }}",
-      "choices": "true\nfalse",
-      "new_question": true,
-      "variable": "matrix_synapse_federation_enabled",
-      "type": "multiplechoice"
-    },
-    {
-      "question_name": "Allow Public Rooms Over Federation",
-      "question_description": "Controls whether remote servers can fetch this server's public rooms directory via federation. For private servers, you'll most likely want to forbid this.",
-      "required": false,
-      "min": null,
-      "max": null,
-      "default": "{{ matrix_synapse_allow_public_rooms_over_federation | string | lower }}",
-      "choices": "true\nfalse",
-      "new_question": true,
-      "variable": "matrix_synapse_allow_public_rooms_over_federation",
-      "type": "multiplechoice"
-    },
-    {
-      "question_name": "Enable Community Creation",
-      "question_description": "Allows regular users (who aren't server admins) to create 'communities', which are basically groups of rooms.",
-      "required": false,
-      "min": null,
-      "max": null,
-      "default": "{{ matrix_synapse_enable_group_creation | string | lower }}",
-      "choices": "true\nfalse",
-      "new_question": true,
-      "variable": "matrix_synapse_enable_group_creation",
-      "type": "multiplechoice"
-    },
-    {
-      "question_name": "Enable Synapse Presence",
-      "question_description": "Controls whether presence is enabled. This shows who's online and reading your posts. Disabling it will increase both performance and user privacy.",
-      "required": false,
-      "min": null,
-      "max": null,
-      "default": "{{ matrix_synapse_presence_enabled | string | lower }}",
-      "choices": "true\nfalse",
-      "new_question": true,
-      "variable": "matrix_synapse_presence_enabled",
-      "type": "multiplechoice"
-    },
-    {
-      "question_name": "Enable URL Previews",
-      "question_description": "Controls whether URL previews should be generated. This will cause a request from Synapse to URLs shared by users.",
-      "required": false,
-      "min": null,
-      "max": null,
-      "default": "{{ matrix_synapse_url_preview_enabled | string | lower }}",
-      "choices": "true\nfalse",
-      "new_question": true,
-      "variable": "matrix_synapse_url_preview_enabled",
-      "type": "multiplechoice"
-    },
-    {
-      "question_name": "Enable Guest Access",
-      "question_description": "Controls whether 'guest accounts' can access rooms without registering. Guest users do not count towards your servers user limit.",
-      "required": false,
-      "min": null,
-      "max": null,
-      "default": "{{ matrix_synapse_allow_guest_access | string | lower }}",
-      "choices": "true\nfalse",
-      "new_question": true,
-      "variable": "matrix_synapse_allow_guest_access",
-      "type": "multiplechoice"
-    },
-    {
-      "question_name": "Registration Requires Email",
-      "question_description": "Controls whether an email address is required to register on the server.",
-      "required": false,
-      "min": null,
-      "max": null,
-      "default": "{{ awx_registrations_require_3pid | string | lower }}",
-      "choices": "true\nfalse",
-      "new_question": true,
-      "variable": "awx_registrations_require_3pid",
-      "type": "multiplechoice"
-    },
-    {
-      "question_name": "Registration Shared Secret",
-      "question_description": "A secret that allows registration of standard or admin accounts by anyone who has the shared secret, even if registration is otherwise disabled. WARNING: You must set a strong and unique password here.",
-      "required": false,
-      "min": 0,
-      "max": 256,
-      "default": "",
-      "choices": "",
-      "new_question": true,
-      "variable": "awx_matrix_synapse_registration_shared_secret",
-      "type": "password"
-    },
-    {
-      "question_name": "Synapse Max Upload Size",
-      "question_description": "Sets the maximum size for uploaded files in MB.",
-      "required": false,
-      "min": 0,
-      "max": 3,
-      "default": "{{ matrix_synapse_max_upload_size_mb }}",
-      "choices": "",
-      "new_question": true,
-      "variable": "awx_synapse_max_upload_size_mb",
-      "type": "text"
-    },
-    {
-      "question_name": "URL Preview Languages",
-      "question_description": "Sets the languages that URL previews will be generated in. Entries are a 2-3 letter IETF language tag, they must be seperated with newlines. For example: 'fr' https://en.wikipedia.org/wiki/IETF_language_tag",
-      "required": false,
-      "min": 0,
-      "max": 65536,
-      "default": {{ awx_url_preview_accept_language_default | to_json }},
-      "choices": "",
-      "new_question": true,
-      "variable": "awx_url_preview_accept_language",
-      "type": "textarea"
-    },  
-    {
-      "question_name": "Federation Whitelist",
-      "question_description": "Here you can list the URLs of other Matrix homeservers and Synapse will only federate with those homeservers. Entries must be seperated with newlines and must not have a 'https://' prefix. For example: 'matrix.example.org'",
-      "required": false,
-      "min": 0,
-      "max": 65536,
-      "default": {{ awx_federation_whitelist | to_json }},
-      "choices": "",
-      "new_question": true,
-      "variable": "awx_federation_whitelist",
-      "type": "textarea"
-    },  
-    {
-      "question_name": "Synapse Auto-Join Rooms",
-      "question_description": "Sets the 'auto-join' rooms, where new users will be automatically invited to, these rooms must already exist. Entries must be room addresses that are separated with newlines. For example: '#announcements:example.org'",
-      "required": false,
-      "min": 0,
-      "max": 65536,
-      "default": {{ awx_synapse_auto_join_rooms | to_json }},
-      "choices": "",
-      "new_question": true,
-      "variable": "awx_synapse_auto_join_rooms",
-      "type": "textarea"
-    },
-    {
-      "question_name": "Enable ReCaptcha on Registration",
-      "question_description": "Enables Googles ReCaptcha verification for registering an account, recommended for public servers.",
-      "required": false,
-      "min": null,
-      "max": null,
-      "default": "{{ awx_enable_registration_captcha | string | lower }}",
-      "choices": "true\nfalse",
-      "new_question": true,
-      "variable": "awx_enable_registration_captcha",
-      "type": "multiplechoice"
-    },
-    {
-      "question_name": "Recaptcha Public Key",
-      "question_description": "Sets the Google ReCaptcha public key for this website.",
-      "required": false,
-      "min": 0,
-      "max": 40,
-      "default": "{{ awx_recaptcha_public_key }}",
-      "choices": "",
-      "new_question": true,
-      "variable": "awx_recaptcha_public_key",
-      "type": "text"
-    },
-    {
-      "question_name": "Recaptcha Private Key",
-      "question_description": "Sets the Google ReCaptcha private key for this website.",
-      "required": false,
-      "min": 0,
-      "max": 40,
-      "default": "{{ awx_recaptcha_private_key }}",
-      "choices": "",
-      "new_question": true,
-      "variable": "awx_recaptcha_private_key",
-      "type": "text"
-    }
-  ]
-}

roles/matrix-awx/surveys/configure_synapse_admin.json.j2

@@ -1,18 +0,0 @@
-{
-  "name": "Configure Synapse Admin",
-  "description": "Configure 'Synapse Admin', a moderation tool to help you manage your server.",
-  "spec": [
-    {
-      "question_name": "Enable Synapse Admin",
-      "question_description": "Set if Synapse Admin is enabled or not. If enabled you can access it at https://{{ matrix_server_fqn_matrix }}/synapse-admin.",
-      "required": false,
-      "min": null,
-      "max": null,
-      "default": "{{ matrix_synapse_admin_enabled | string | lower }}",
-      "choices": "true\nfalse",
-      "new_question": true,
-      "variable": "matrix_synapse_admin_enabled",
-      "type": "multiplechoice"
-    }
-  ]
-}

roles/matrix-awx/surveys/configure_website_access_export.json.j2

@@ -1,54 +0,0 @@
-{
-  "name": "Configure Website Access Backup",
-  "description": "Configure base domain website settings and access the services backup.",
-  "spec": [
-    {
-      "question_name": "Customise Base Domain Website",
-      "question_description": "Set if you want to adjust the base domain website using SFTP.",
-      "required": true,
-      "min": null,
-      "max": null,
-      "default": "{{ awx_customise_base_domain_website | string | lower }}",
-      "choices": "true\nfalse",
-      "new_question": true,
-      "variable": "awx_customise_base_domain_website",
-      "type": "multiplechoice"
-    },
-    {
-      "question_name": "SFTP Authorisation Method",
-      "question_description": "Set whether you want to disable SFTP, use a password to connect to SFTP or connect with a more secure SSH key.",
-      "required": true,
-      "min": null,
-      "max": null,
-      "default": "{{ awx_sftp_auth_method | string }}",
-      "choices": "Disabled\nPassword\nSSH Key",
-      "new_question": true,
-      "variable": "awx_sftp_auth_method",
-      "type": "multiplechoice"
-    },
-    {
-      "question_name": "SFTP Password",
-      "question_description": "Sets the password of the 'sftp' account, which allows you to upload a multi-file static website by SFTP, as well as export the latest copy of your Matrix service. Must be defined if 'Password' method is selected. WARNING: You must set a strong and unique password here.",
-      "required": false,
-      "min": 0,
-      "max": 64,
-      "default": "{{ awx_sftp_password }}",
-      "choices": "",
-      "new_question": true,
-      "variable": "awx_sftp_password",
-      "type": "password"
-    },
-    {
-      "question_name": "SFTP Public SSH Key (More Secure)",
-      "question_description": "Sets the public SSH key used to access the 'sftp' account, which allows you to upload a multi-file static website by SFTP, as well as export the latest copy of your Matrix service. Must be defined if 'SSH Key' method is selected.",
-      "required": false,
-      "min": 0,
-      "max": 16384,
-      "default": "{{ awx_sftp_public_key }}",
-      "choices": "",
-      "new_question": true,
-      "variable": "awx_sftp_public_key",
-      "type": "text"
-    }
-  ]
-}

roles/matrix-awx/tasks/backup_server.yml

@@ -1,101 +0,0 @@
----
-
-- name: Record Backup Server variables locally on AWX
-  delegate_to: 127.0.0.1
-  lineinfile:
-    path: '/var/lib/awx/projects/clients/{{ member_id }}/{{ subscription_id }}/matrix_vars.yml'
-    regexp: "^#? *{{ item.key | regex_escape() }}:"
-    line: "{{ item.key }}: {{ item.value }}"
-    insertafter: '# AWX Settings Start'
-  with_dict:
-    'awx_backup_enabled': '{{ awx_backup_enabled }}'
-  tags: use-survey
-
-- name: Save new 'Backup Server' survey.json to the AWX tower, template
-  delegate_to: 127.0.0.1
-  template:
-    src: 'roles/matrix-awx/surveys/backup_server.json.j2'
-    dest: '/var/lib/awx/projects/clients/{{ member_id }}/{{ subscription_id }}/backup_server.json'
-  tags: use-survey
-
-- name: Copy new 'Backup Server' survey.json to target machine
-  copy:
-    src: '/var/lib/awx/projects/clients/{{ member_id }}/{{ subscription_id }}/backup_server.json'
-    dest: '/matrix/awx/backup_server.json'
-    mode: '0660'
-  tags: use-survey
-
-- name: Recreate 'Backup Server' job template
-  delegate_to: 127.0.0.1
-  awx.awx.tower_job_template:
-    name: "{{ matrix_domain }} - 0 - Backup Server"
-    description: "Performs a backup of the entire service to a remote location."
-    extra_vars: "{{ lookup('file', '/var/lib/awx/projects/clients/{{ member_id }}/{{ subscription_id }}/extra_vars.json') }}"
-    job_type: run
-    job_tags: "backup-server,use-survey"
-    inventory: "{{ member_id }}"
-    project: "{{ member_id }} - Matrix Docker Ansible Deploy"
-    playbook: setup.yml
-    credential: "{{ member_id }} - AWX SSH Key"
-    survey_enabled: true
-    survey_spec: "{{ lookup('file', '/var/lib/awx/projects/clients/{{ member_id }}/{{ subscription_id }}/backup_server.json') }}"
-    become_enabled: true
-    state: present
-    verbosity: 1
-    tower_host: "https://{{ awx_host }}"
-    tower_oauthtoken: "{{ awx_session_token.ansible_facts.tower_token.token }}"
-    validate_certs: true
-  tags: use-survey
-
-- name: Include vars in matrix_vars.yml
-  include_vars:
-    file: '/var/lib/awx/projects/clients/{{ member_id }}/{{ subscription_id }}/matrix_vars.yml'
-  no_log: true
-
-- name: Copy new 'matrix_vars.yml' to target machine
-  copy:
-    src: '/var/lib/awx/projects/clients/{{ member_id }}/{{ subscription_id }}/matrix_vars.yml'
-    dest: '/matrix/awx/matrix_vars.yml'
-    mode: '0660'
-  tags: use-survey
-
-- name: Run initial backup of /matrix/ and snapshot the database simultaneously
-  command: "{{ item }}"
-  with_items:
-    - borgmatic -c /root/.config/borgmatic/config_1.yaml
-    - /bin/sh /usr/local/bin/awx-export-service.sh 1 0
-  register: _create_instances
-  async: 3600  # Maximum runtime in seconds.
-  poll: 0  # Fire and continue (never poll)
-  when: awx_backup_enabled|bool
-
-- name: Wait for both of these jobs to finish
-  async_status:
-    jid: "{{ item.ansible_job_id }}"
-  register: _jobs
-  until: _jobs.finished
-  delay: 5  # Check every 5 seconds.
-  retries: 720  # Retry for a full hour.
-  with_items: "{{ _create_instances.results }}"
-  when: awx_backup_enabled|bool
-
-- name: Perform borg backup of postgres dump
-  command: borgmatic -c /root/.config/borgmatic/config_2.yaml
-  when: awx_backup_enabled|bool
-
-- name: Delete the AWX session token for executing modules
-  awx.awx.tower_token:
-    description: 'AWX Session Token'
-    scope: "write"
-    state: absent
-    existing_token_id: "{{ awx_session_token.ansible_facts.tower_token.id }}"
-    tower_host: "https://{{ awx_host }}"
-    tower_oauthtoken: "{{ awx_session_token.ansible_facts.tower_token.token }}"
-
-- name: Set boolean value to exit playbook
-  set_fact:
-    awx_end_playbook: true
-
-- name: End playbook if this task list is called.
-  meta: end_play
-  when: awx_end_playbook is defined and awx_end_playbook|bool

roles/matrix-awx/tasks/bridge_discord_appservice.yml

@@ -1,58 +0,0 @@
----
-
-- name: Record Bridge Discord AppService variables locally on AWX
-  delegate_to: 127.0.0.1
-  lineinfile:
-    path: '{{ awx_cached_matrix_vars }}'
-    regexp: "^#? *{{ item.key | regex_escape() }}:"
-    line: "{{ item.key }}: {{ item.value }}"
-    insertafter: '# Bridge Discord AppService Start'
-  with_dict:
-    'matrix_appservice_discord_enabled': '{{ matrix_appservice_discord_enabled }}'
-    'matrix_appservice_discord_client_id': '{{ matrix_appservice_discord_client_id }}'
-    'matrix_appservice_discord_bot_token': '{{ matrix_appservice_discord_bot_token }}'
-
-- name: If the raw inputs is not empty start constructing parsed awx_appservice_discord_admin_rooms list
-  set_fact:
-    awx_appservice_discord_admin_rooms_array: |-
-      {{ awx_appservice_discord_admin_rooms.splitlines() | to_json }}
-  when: awx_appservice_discord_admin_rooms | trim | length > 0
-
-- name: Promote user to administer (PL100) of each room
-  command: |
-    docker exec -i matrix-appservice-discord /bin/sh -c 'cp /cfg/registration.yaml /tmp/discord-registration.yaml && cd /tmp && node /build/tools/adminme.js -c /cfg/config.yaml -m "{{ item.1 }}" -u "@{{ awx_appservice_discord_admin_user }}:{{ matrix_domain }}" -p 100'
-  with_indexed_items:
-    - "{{ awx_appservice_discord_admin_rooms_array }}"
-  when: ( awx_appservice_discord_admin_rooms | trim | length > 0 ) and ( awx_appservice_discord_admin_user is defined )
-
-- name: Save new 'Bridge Discord Appservice' survey.json to the AWX tower, template
-  delegate_to: 127.0.0.1
-  template:
-    src: 'roles/matrix-awx/surveys/bridge_discord_appservice.json.j2'
-    dest: '/var/lib/awx/projects/clients/{{ member_id }}/{{ subscription_id }}//bridge_discord_appservice.json'
-
-- name: Copy new 'Bridge Discord Appservice' survey.json to target machine
-  copy:
-    src: '/var/lib/awx/projects/clients/{{ member_id }}/{{ subscription_id }}/bridge_discord_appservice.json'
-    dest: '/matrix/awx/bridge_discord_appservice.json'
-    mode: '0660'
-
-- name: Recreate 'Bridge Discord Appservice' job template
-  delegate_to: 127.0.0.1
-  awx.awx.tower_job_template:
-    name: "{{ matrix_domain }} - 3 - Bridge Discord AppService"
-    description: "Enables a private bridge you can use to connect Matrix rooms to Discord."
-    extra_vars: "{{ lookup('file', '/var/lib/awx/projects/clients/{{ member_id }}/{{ subscription_id }}/extra_vars.json') }}"
-    job_type: run
-    job_tags: "start,setup-all,bridge-discord-appservice"
-    inventory: "{{ member_id }}"
-    project: "{{ member_id }} - Matrix Docker Ansible Deploy"
-    playbook: setup.yml
-    credential: "{{ member_id }} - AWX SSH Key"
-    survey_enabled: true
-    survey_spec: "{{ lookup('file', '/var/lib/awx/projects/clients/{{ member_id }}/{{ subscription_id }}/bridge_discord_appservice.json') }}"
-    state: present
-    verbosity: 1
-    tower_host: "https://{{ awx_host }}"
-    tower_oauthtoken: "{{ awx_session_token.ansible_facts.tower_token.token }}"
-    validate_certs: true

roles/matrix-awx/tasks/cache_matrix_variables.yml

@@ -1,13 +0,0 @@
----
-
-- name: Collect current datetime
-  set_fact:
-    awx_datetime: "{{ lookup('pipe', 'date +%Y-%m-%d_%H:%M') }}"
-
-- name: Create cached matrix_vars.yml file location
-  set_fact:
-    awx_cached_matrix_vars: '/var/lib/awx/projects/clients/{{ member_id }}/{{ subscription_id }}/matrix_vars_{{ awx_datetime }}.yml'
-
-- name: Create cached matrix_vars.yml
-  delegate_to: 127.0.0.1
-  shell: "cp /var/lib/awx/projects/clients/{{ member_id }}/{{ subscription_id }}/matrix_vars.yml {{ awx_cached_matrix_vars }}"

roles/matrix-awx/tasks/create_session_token.yml

@@ -1,11 +0,0 @@
----
-
-- name: Create a AWX session token for executing modules
-  awx.awx.tower_token:
-    description: 'AWX Session Token'
-    scope: "write"
-    state: present
-    tower_host: "https://{{ awx_host }}"
-    tower_oauthtoken: "{{ awx_master_token }}"
-  register: awx_session_token
-  no_log: true

roles/matrix-awx/tasks/create_user.yml

@@ -1,41 +0,0 @@
----
-#
-# Create user and define if they are admin
-#
-# /usr/local/bin/matrix-synapse-register-user <your_username> <your_password> <admin access: 0 or 1>
-#
-
-- name: Set admin bool to zero
-  set_fact:
-    awx_admin_bool: 0
-  when: awx_admin_access == 'false'
-
-- name: Examine if server admin set
-  set_fact:
-    awx_admin_bool: 1
-  when: awx_admin_access == 'true'
-
-- name: Create user account
-  command: |
-    /usr/local/bin/matrix-synapse-register-user {{ awx_new_username | quote }} {{ awx_new_password | quote }} {{ awx_admin_bool }}
-  register: awx_cmd_output
-
-- name: Delete the AWX session token for executing modules
-  awx.awx.tower_token:
-    description: 'AWX Session Token'
-    scope: "write"
-    state: absent
-    existing_token_id: "{{ awx_session_token.ansible_facts.tower_token.id }}"
-    tower_host: "https://{{ awx_host }}"
-    tower_oauthtoken: "{{ awx_session_token.ansible_facts.tower_token.token }}"
-
-- name: Set boolean value to exit playbook
-  set_fact:
-    awx_end_playbook: true
-
-- name: Result
-  debug: msg="{{ awx_cmd_output.stdout }}"
-
-- name: End playbook if this task list is called.
-  meta: end_play
-  when: awx_end_playbook is defined and awx_end_playbook|bool

roles/matrix-awx/tasks/customise_website_access_export.yml

@@ -1,267 +0,0 @@
----
-
-- name: Enable index.html creation if user doesn't wish to customise base domain
-  delegate_to: 127.0.0.1
-  lineinfile:
-    path: '{{ awx_cached_matrix_vars }}'
-    regexp: "^#? *{{ item.key | regex_escape() }}:"
-    line: "{{ item.key }}: {{ item.value }}"
-    insertafter: '# Base Domain Settings Start'
-  with_dict:
-    'matrix_nginx_proxy_base_domain_homepage_enabled': 'true'
-  when: (awx_customise_base_domain_website is defined) and not awx_customise_base_domain_website|bool
-
-- name: Disable index.html creation to allow multi-file site if user does wish to customise base domain
-  delegate_to: 127.0.0.1
-  lineinfile:
-    path: '{{ awx_cached_matrix_vars }}'
-    regexp: "^#? *{{ item.key | regex_escape() }}:"
-    line: "{{ item.key }}: {{ item.value }}"
-    insertafter: '# Base Domain Settings Start'
-  with_dict:
-    'matrix_nginx_proxy_base_domain_homepage_enabled': 'false'
-  when: (awx_customise_base_domain_website is defined) and awx_customise_base_domain_website|bool
-
-- name: Record custom 'Customise Website + Access Export' variables locally on AWX
-  delegate_to: 127.0.0.1
-  lineinfile:
-    path: '{{ awx_cached_matrix_vars }}'
-    regexp: "^#? *{{ item.key | regex_escape() }}:"
-    line: "{{ item.key }}: {{ item.value }}"
-    insertafter: '# Custom Settings Start'
-  with_dict:
-    'awx_sftp_auth_method': '"{{ awx_sftp_auth_method }}"'
-    'awx_sftp_password': '"{{ awx_sftp_password }}"'
-    'awx_sftp_public_key': '"{{ awx_sftp_public_key }}"'
-
-- name: Record custom 'Customise Website + Access Export' variables locally on AWX
-  delegate_to: 127.0.0.1
-  lineinfile:
-    path: '{{ awx_cached_matrix_vars }}'
-    regexp: "^#? *{{ item.key | regex_escape() }}:"
-    line: "{{ item.key }}: {{ item.value }}"
-    insertafter: '# Custom Settings Start'
-  with_dict:
-    'awx_customise_base_domain_website': '{{ awx_customise_base_domain_website }}'
-  when: awx_customise_base_domain_website is defined
-
-- name: Reload vars in matrix_vars.yml
-  include_vars:
-    file: '{{ awx_cached_matrix_vars }}'
-  no_log: true
-
-- name: Save new 'Customise Website + Access Export' survey.json to the AWX tower, template
-  delegate_to: 127.0.0.1
-  template:
-    src: './roles/matrix-awx/surveys/configure_website_access_export.json.j2'
-    dest: '/var/lib/awx/projects/clients/{{ member_id }}/{{ subscription_id }}/configure_website_access_export.json'
-  when: awx_customise_base_domain_website is defined
-
-- name: Copy new 'Customise Website + Access Export' survey.json to target machine
-  copy:
-    src: '/var/lib/awx/projects/clients/{{ member_id }}/{{ subscription_id }}/configure_website_access_export.json'
-    dest: '/matrix/awx/configure_website_access_export.json'
-    mode: '0660'
-  when: awx_customise_base_domain_website is defined
-
-- name: Save new 'Customise Website + Access Export' survey.json to the AWX tower, template
-  delegate_to: 127.0.0.1
-  template:
-    src: './roles/matrix-awx/surveys/access_export.json.j2'
-    dest: '/var/lib/awx/projects/clients/{{ member_id }}/{{ subscription_id }}/access_export.json'
-  when: awx_customise_base_domain_website is undefined
-
-- name: Copy new 'Customise Website + Access Export' survey.json to target machine
-  copy:
-    src: '/var/lib/awx/projects/clients/{{ member_id }}/{{ subscription_id }}/access_export.json'
-    dest: '/matrix/awx/access_export.json'
-    mode: '0660'
-  when: awx_customise_base_domain_website is undefined
-
-- name: Recreate 'Configure Website + Access Export' job template
-  delegate_to: 127.0.0.1
-  awx.awx.tower_job_template:
-    name: "{{ matrix_domain }} - 1 - Configure Website + Access Export"
-    description: "Configure base domain website settings and access the servers export."
-    extra_vars: "{{ lookup('file', '/var/lib/awx/projects/clients/{{ member_id }}/{{ subscription_id }}/extra_vars.json') }}"
-    job_type: run
-    job_tags: "start,setup-nginx-proxy"
-    inventory: "{{ member_id }}"
-    project: "{{ member_id }} - Matrix Docker Ansible Deploy"
-    playbook: setup.yml
-    credential: "{{ member_id }} - AWX SSH Key"
-    survey_enabled: true
-    survey_spec: "{{ lookup('file', '/var/lib/awx/projects/clients/{{ member_id }}/{{ subscription_id }}/configure_website_access_export.json') }}"
-    become_enabled: true
-    state: present
-    verbosity: 1
-    tower_host: "https://{{ awx_host }}"
-    tower_oauthtoken: "{{ awx_session_token.ansible_facts.tower_token.token }}"
-    validate_certs: true
-  when: awx_customise_base_domain_website is defined
-
-- name: Recreate 'Access Export' job template
-  delegate_to: 127.0.0.1
-  awx.awx.tower_job_template:
-    name: "{{ matrix_domain }} - 1 - Access Export"
-    description: "Access the services export."
-    extra_vars: "{{ lookup('file', '/var/lib/awx/projects/clients/{{ member_id }}/{{ subscription_id }}/extra_vars.json') }}"
-    job_type: run
-    job_tags: "start,setup-nginx-proxy"
-    inventory: "{{ member_id }}"
-    project: "{{ member_id }} - Matrix Docker Ansible Deploy"
-    playbook: setup.yml
-    credential: "{{ member_id }} - AWX SSH Key"
-    survey_enabled: true
-    survey_spec: "{{ lookup('file', '/var/lib/awx/projects/clients/{{ member_id }}/{{ subscription_id }}/access_export.json') }}"
-    become_enabled: true
-    state: present
-    verbosity: 1
-    tower_host: "https://{{ awx_host }}"
-    tower_oauthtoken: "{{ awx_session_token.ansible_facts.tower_token.token }}"
-    validate_certs: true
-  when: awx_customise_base_domain_website is undefined
-
-- name: If user doesn't define a awx_sftp_password, create a disabled 'sftp' account
-  user:
-    name: sftp
-    comment: SFTP user to set custom web files and access servers export
-    shell: /bin/false
-    home: /home/sftp
-    group: matrix
-    password: '*'
-    update_password: always
-  when: awx_sftp_password|length == 0
-
-- name: If user defines awx_sftp_password, enable account and set password on 'stfp' account
-  user:
-    name: sftp
-    comment: SFTP user to set custom web files and access servers export
-    shell: /bin/false
-    home: /home/sftp
-    group: matrix
-    password: "{{ awx_sftp_password | password_hash('sha512') }}"
-    update_password: always
-  when: awx_sftp_password|length > 0
-
-- name: Ensure group "sftp" exists
-  group:
-    name: sftp
-    state: present
-
-- name: adding existing user 'sftp' to group matrix
-  user:
-    name: sftp
-    groups: sftp
-    append: true
-  when: awx_customise_base_domain_website is defined
-
-- name: Create the ro /chroot directory with sticky bit if it doesn't exist. (/chroot/website has matrix:matrix permissions and is mounted to nginx container)
-  file:
-    path: /chroot
-    state: directory
-    owner: root
-    group: root
-    mode: '1755'
-
-- name: Ensure /chroot/website location exists.
-  file:
-    path: /chroot/website
-    state: directory
-    owner: matrix
-    group: matrix
-    mode: '0770'
-  when: awx_customise_base_domain_website is defined
-
-- name: Ensure /chroot/export location exists
-  file:
-    path: /chroot/export
-    state: directory
-    owner: sftp
-    group: sftp
-    mode: '0700'
-
-- name: Ensure /home/sftp/.ssh location exists
-  file:
-    path: /home/sftp/.ssh
-    state: directory
-    owner: sftp
-    group: sftp
-    mode: '0700'
-
-- name: Ensure /home/sftp/authorized_keys exists
-  file:
-    path: /home/sftp/.ssh/authorized_keys
-    state: touch
-    owner: sftp
-    group: sftp
-    mode: '0644'
-
-- name: Clear authorized_keys file
-  shell: echo "" > /home/sftp/.ssh/authorized_keys
-
-- name: Insert public SSH key into authorized_keys file
-  lineinfile:
-    path: /home/sftp/.ssh/authorized_keys
-    line: "{{ awx_sftp_public_key }}"
-    owner: sftp
-    group: sftp
-    mode: '0644'
-  when: (awx_sftp_public_key | length > 0) and (awx_sftp_auth_method == "SSH Key")
-
-- name: Remove any existing Subsystem lines
-  lineinfile:
-    path: /etc/ssh/sshd_config
-    state: absent
-    regexp: '^Subsystem'
-
-- name: Set SSH Subsystem State
-  lineinfile:
-    path: /etc/ssh/sshd_config
-    insertafter: "^# override default of no subsystems"
-    line: "Subsystem sftp internal-sftp"
-
-- name: Add SSH Match User section for disabled auth
-  blockinfile:
-    path: /etc/ssh/sshd_config
-    state: absent
-    block: |
-      Match User sftp
-          ChrootDirectory /chroot
-          PermitTunnel no
-          X11Forwarding no
-          AllowTcpForwarding no
-          PasswordAuthentication yes
-          AuthorizedKeysFile /home/sftp/.ssh/authorized_keys
-  when: awx_sftp_auth_method == "Disabled"
-
-- name: Add SSH Match User section for password auth
-  blockinfile:
-    path: /etc/ssh/sshd_config
-    state: present
-    block: |
-      Match User sftp
-          ChrootDirectory /chroot
-          PermitTunnel no
-          X11Forwarding no
-          AllowTcpForwarding no
-          PasswordAuthentication yes
-  when: awx_sftp_auth_method == "Password"
-
-- name: Add SSH Match User section for publickey auth
-  blockinfile:
-    path: /etc/ssh/sshd_config
-    state: present
-    block: |
-      Match User sftp
-          ChrootDirectory /chroot
-          PermitTunnel no
-          X11Forwarding no
-          AllowTcpForwarding no
-          AuthorizedKeysFile /home/sftp/.ssh/authorized_keys
-  when: awx_sftp_auth_method == "SSH Key"
-
-- name: Restart service ssh.service
-  service:
-    name: ssh.service
-    state: restarted

roles/matrix-awx/tasks/delete_session_token.yml

@@ -1,10 +0,0 @@
----
-
-- name: Delete the AWX session token for executing modules
-  awx.awx.tower_token:
-    description: 'AWX Session Token'
-    scope: "write"
-    state: absent
-    existing_token_id: "{{ awx_session_token.ansible_facts.tower_token.id }}"
-    tower_host: "https://{{ awx_host }}"
-    tower_oauthtoken: "{{ awx_session_token.ansible_facts.tower_token.token }}"

roles/matrix-awx/tasks/export_server.yml

@@ -1,43 +0,0 @@
----
-
-- name: Run export of /matrix/ and snapshot the database simultaneously
-  command: "{{ item }}"
-  with_items:
-    - /bin/sh /usr/local/bin/awx-export-service.sh 1 0
-    - /bin/sh /usr/local/bin/awx-export-service.sh 0 1
-  register: awx_create_instances
-  async: 3600  # Maximum runtime in seconds.
-  poll: 0  # Fire and continue (never poll)
-
-- name: Wait for both of these jobs to finish
-  async_status:
-    jid: "{{ item.ansible_job_id }}"
-  register: awx_jobs
-  until: awx_jobs.finished
-  delay: 5  # Check every 5 seconds.
-  retries: 720  # Retry for a full hour.
-  with_items: "{{ awx_create_instances.results }}"
-
-- name: Schedule deletion of the export in 24 hours
-  at:
-    command: rm /chroot/export/matrix*
-    count: 1
-    units: days
-    unique: true
-
-- name: Delete the AWX session token for executing modules
-  awx.awx.tower_token:
-    description: 'AWX Session Token'
-    scope: "write"
-    state: absent
-    existing_token_id: "{{ awx_session_token.ansible_facts.tower_token.id }}"
-    tower_host: "https://{{ awx_host }}"
-    tower_oauthtoken: "{{ awx_session_token.ansible_facts.tower_token.token }}"
-
-- name: Set boolean value to exit playbook
-  set_fact:
-    awx_end_playbook: true
-
-- name: End playbook if this task list is called.
-  meta: end_play
-  when: awx_end_playbook is defined and awx_end_playbook|bool

roles/matrix-awx/tasks/import_awx.yml

@@ -1,7 +0,0 @@
----
-
-- name: Ensure correct ownership of /matrix/awx
-  shell: chown -R matrix:matrix /matrix/awx
-
-- name: Ensure correct ownership of /matrix/synapse
-  shell: chown -R matrix:matrix /matrix/synapse

roles/matrix-awx/tasks/load_hosting_and_org_variables.yml

@@ -1,16 +0,0 @@
----
-
-- name: Include vars in organisation.yml
-  include_vars:
-    file: '/var/lib/awx/projects/clients/{{ member_id }}/organisation.yml'
-  no_log: true
-
-- name: Include vars in hosting_vars.yml
-  include_vars:
-    file: '/var/lib/awx/projects/hosting/hosting_vars.yml'
-  no_log: true
-
-- name: Include AWX master token from awx_tokens.yml
-  include_vars:
-    file: /var/lib/awx/projects/hosting/awx_tokens.yml
-  no_log: true

roles/matrix-awx/tasks/load_matrix_variables.yml

@@ -1,16 +0,0 @@
----
-
-- name: Include new vars in matrix_vars.yml
-  include_vars:
-    file: '{{ awx_cached_matrix_vars }}'
-  no_log: true
-
-- name: If include_vars succeeds overwrite the old matrix_vars.yml
-  delegate_to: 127.0.0.1
-  shell: "cp {{ awx_cached_matrix_vars }} /var/lib/awx/projects/clients/{{ member_id }}/{{ subscription_id }}/matrix_vars.yml && rm {{ awx_cached_matrix_vars }}"
-
-- name: Copy new 'matrix_vars.yml' to target machine
-  copy:
-    src: '/var/lib/awx/projects/clients/{{ member_id }}/{{ subscription_id }}/matrix_vars.yml'
-    dest: '/matrix/awx/matrix_vars.yml'
-    mode: '0660'

roles/matrix-awx/tasks/main.yml

@@ -1,225 +0,0 @@
----
-# Load initial hosting and organisation variables from AWX volume
-- include_tasks:
-    file: "load_hosting_and_org_variables.yml"
-    apply:
-      tags: always
-  when: run_setup|bool and matrix_awx_enabled|bool
-  tags:
-    - always
-
-# Renames or updates the vars.yml if needed
-- include_tasks:
-    file: "update_variables.yml"
-    apply:
-      tags: always
-  when: run_setup|bool and matrix_awx_enabled|bool
-  tags:
-    - always
-
-# Create AWX session token
-- include_tasks:
-    file: "create_session_token.yml"
-    apply:
-      tags: always
-  when: run_setup|bool and matrix_awx_enabled|bool
-  tags:
-    - always
-
-# Perform a backup of the server
-- include_tasks:
-    file: "backup_server.yml"
-    apply:
-      tags: backup-server
-  when: run_setup|bool and matrix_awx_enabled|bool
-  tags:
-    - backup-server
-
-# Perform a export of the server
-- include_tasks:
-    file: "export_server.yml"
-    apply:
-      tags: export-server
-  when: run_setup|bool and matrix_awx_enabled|bool
-  tags:
-    - export-server
-
-# Create a user account if called
-- include_tasks:
-    file: "create_user.yml"
-    apply:
-      tags: create-user
-  when: run_setup|bool and matrix_awx_enabled|bool
-  tags:
-    - create-user
-
-# Purge local/remote media if called
-- include_tasks:
-    file: "purge_media_main.yml"
-    apply:
-      tags: purge-media
-  when: run_setup|bool and matrix_awx_enabled|bool
-  tags:
-    - purge-media
-
-# Purge Synapse database if called
-- include_tasks:
-    file: "purge_database_main.yml"
-    apply:
-      tags: purge-database
-  when: run_setup|bool and matrix_awx_enabled|bool
-  tags:
-    - purge-database
-
-# Rotate SSH key if called
-- include_tasks:
-    file: "rotate_ssh.yml"
-    apply:
-      tags: rotate-ssh
-  when: run_setup|bool and matrix_awx_enabled|bool
-  tags:
-    - rotate-ssh
-
-# Import configs, media repo from /chroot/backup import
-- include_tasks:
-    file: "import_awx.yml"
-    apply:
-      tags: import-awx
-  when: run_setup|bool and matrix_awx_enabled|bool
-  tags:
-    - import-awx
-
-# Perform extra self-check functions
-- include_tasks:
-    file: "self_check.yml"
-    apply:
-      tags: self-check
-  when: run_setup|bool and matrix_awx_enabled|bool
-  tags:
-    - self-check
-
-# Create cached matrix_vars.yml file
-- include_tasks:
-    file: "cache_matrix_variables.yml"
-    apply:
-      tags: always
-  when: run_setup|bool and matrix_awx_enabled|bool
-  tags:
-    - always
-
-# Configure SFTP so user can upload a static website or access the servers export
-- include_tasks:
-    file: "customise_website_access_export.yml"
-    apply:
-      tags: setup-nginx-proxy
-  when: run_setup|bool and matrix_awx_enabled|bool
-  tags:
-    - setup-nginx-proxy
-
-# Additional playbook to set the variable file during Element configuration
-- include_tasks:
-    file: "set_variables_element.yml"
-    apply:
-      tags: setup-client-element
-  when: run_setup|bool and matrix_awx_enabled|bool
-  tags:
-    - setup-client-element
-
-# Additional playbook to set the variable file during Mailer configuration
-- include_tasks:
-    file: "set_variables_mailer.yml"
-    apply:
-      tags: setup-mailer
-  when: run_setup|bool and matrix_awx_enabled|bool
-  tags:
-    - setup-mailer
-
-# Additional playbook to set the variable file during Element configuration
-- include_tasks:
-    file: "set_variables_element_subdomain.yml"
-    apply:
-      tags: setup-client-element-subdomain
-  when: run_setup|bool and matrix_awx_enabled|bool
-  tags:
-    - setup-client-element-subdomain
-
-# Additional playbook to set the variable file during Synapse configuration
-- include_tasks:
-    file: "set_variables_synapse.yml"
-    apply:
-      tags: setup-synapse
-  when: run_setup|bool and matrix_awx_enabled|bool
-  tags:
-    - setup-synapse
-
-# Additional playbook to set the variable file during Jitsi configuration
-- include_tasks:
-    file: "set_variables_jitsi.yml"
-    apply:
-      tags: setup-jitsi
-  when: run_setup|bool and matrix_awx_enabled|bool
-  tags:
-    - setup-jitsi
-
-# Additional playbook to set the variable file during Ma1sd configuration
-- include_tasks:
-    file: "set_variables_ma1sd.yml"
-    apply:
-      tags: setup-ma1sd
-  when: run_setup|bool and matrix_awx_enabled|bool
-  tags:
-    - setup-ma1sd
-
-# Additional playbook to set the variable file during Corporal configuration
-- include_tasks:
-    file: "set_variables_corporal.yml"
-    apply:
-      tags: setup-corporal
-  when: run_setup|bool and matrix_awx_enabled|bool
-  tags:
-    - setup-corporal
-
-# Additional playbook to set the variable file during Dimension configuration
-- include_tasks:
-    file: "set_variables_dimension.yml"
-    apply:
-      tags: setup-dimension
-  when: run_setup|bool and matrix_awx_enabled|bool
-  tags:
-    - setup-dimension
-
-# Additional playbook to set the variable file during Synapse Admin configuration
-- include_tasks:
-    file: "set_variables_synapse_admin.yml"
-    apply:
-      tags: setup-synapse-admin
-  when: run_setup|bool and matrix_awx_enabled|bool
-  tags:
-    - setup-synapse-admin
-
-# Additional playbook to set the variable file during Discord Appservice Bridge configuration
-- include_tasks:
-    file: "bridge_discord_appservice.yml"
-    apply:
-      tags: bridge-discord-appservice
-  when: run_setup|bool and matrix_awx_enabled|bool
-  tags:
-    - bridge-discord-appservice
-
-# Delete AWX session token
-- include_tasks:
-    file: "delete_session_token.yml"
-    apply:
-      tags: always
-  when: run_setup|bool and matrix_awx_enabled|bool
-  tags:
-    - always
-
-# Load newly formed matrix variables from AWX volume
-- include_tasks:
-    file: "load_matrix_variables.yml"
-    apply:
-      tags: always
-  when: run_setup|bool and matrix_awx_enabled|bool
-  tags:
-    - always

roles/matrix-awx/tasks/purge_database_events.yml

@@ -1,14 +0,0 @@
----
-
-- name: Purge all rooms with more then N events
-  shell: |
-    curl --header "Authorization: Bearer {{ awx_janitors_token.stdout[1:-1] }}" -X POST -H "Content-Type: application/json" -d '{ "delete_local_events": false, "purge_up_to_ts": {{ awx_purge_epoche_time.stdout }}000 }' "{{ awx_synapse_container_ip.stdout }}:{{ matrix_synapse_container_client_api_port }}/_synapse/admin/v1/purge_history/{{ item[1:-1] }}"
-  register: awx_purge_command
-
-- name: Print output of purge command
-  debug:
-    msg: "{{ awx_purge_command.stdout }}"
-
-- name: Pause for 5 seconds to let Synapse breathe
-  pause:
-    seconds: 5

roles/matrix-awx/tasks/purge_database_main.yml

@@ -1,320 +0,0 @@
----
-
-- name: Ensure dateutils and curl is installed in AWX
-  delegate_to: 127.0.0.1
-  yum:
-    name: dateutils
-    state: latest
-
-- name: Include vars in matrix_vars.yml
-  include_vars:
-    file: '/var/lib/awx/projects/clients/{{ member_id }}/{{ subscription_id }}/matrix_vars.yml'
-  no_log: true
-
-- name: Ensure curl and jq intalled on target machine
-  apt:
-    pkg:
-      - curl
-      - jq
-    state: present
-
-- name: Collect before shrink size of Synapse database
-  shell: du -sh /matrix/postgres/data
-  register: awx_db_size_before_stat
-  when: (awx_purge_mode.find("Perform final shrink") != -1)
-  no_log: true
-
-- name: Collect the internal IP of the matrix-synapse container
-  shell: "/usr/bin/docker inspect --format '{''{range.NetworkSettings.Networks}''}{''{.IPAddress}''}{''{end}''}' matrix-synapse"
-  when: (awx_purge_mode.find("No local users [recommended]") != -1) or (awx_purge_mode.find("Number of users [slower]") != -1) or (awx_purge_mode.find("Number of events [slower]") != -1)
-  register: awx_synapse_container_ip
-
-- name: Collect access token for @admin-janitor user
-  shell: |
-    curl -X POST -d '{"type":"m.login.password", "user":"admin-janitor", "password":"{{ awx_janitor_user_password }}"}' "{{ awx_synapse_container_ip.stdout }}:{{ matrix_synapse_container_client_api_port }}/_matrix/client/r0/login" | jq '.access_token'
-  when: (awx_purge_mode.find("No local users [recommended]") != -1) or (awx_purge_mode.find("Number of users [slower]") != -1) or (awx_purge_mode.find("Number of events [slower]") != -1)
-  register: awx_janitors_token
-  no_log: true
-
-- name: Copy build_room_list.py script to target machine
-  copy:
-    src: ./roles/matrix-awx/scripts/matrix_build_room_list.py
-    dest: /usr/local/bin/matrix_build_room_list.py
-    owner: matrix
-    group: matrix
-    mode: '0755'
-  when: (awx_purge_mode.find("No local users [recommended]") != -1) or (awx_purge_mode.find("Number of users [slower]") != -1) or (awx_purge_mode.find("Number of events [slower]") != -1)
-
-- name: Run build_room_list.py script
-  shell: |
-    runuser -u matrix -- python3 /usr/local/bin/matrix_build_room_list.py {{ awx_janitors_token.stdout[1:-1] }} {{ awx_synapse_container_ip.stdout }} {{ matrix_synapse_container_client_api_port.stdout }}
-  register: awx_rooms_total
-  when: (awx_purge_mode.find("No local users [recommended]") != -1) or (awx_purge_mode.find("Number of users [slower]") != -1) or (awx_purge_mode.find("Number of events [slower]") != -1)
-
-- name: Fetch complete room list from target machine
-  fetch:
-    src: /tmp/room_list_complete.json
-    dest: "/tmp/{{ subscription_id }}_room_list_complete.json"
-    flat: true
-  when: (awx_purge_mode.find("No local users [recommended]") != -1) or (awx_purge_mode.find("Number of users [slower]") != -1) or (awx_purge_mode.find("Number of events [slower]") != -1)
-
-- name: Remove complete room list from target machine
-  file:
-    path: /tmp/room_list_complete.json
-    state: absent
-  when: (awx_purge_mode.find("No local users [recommended]") != -1) or (awx_purge_mode.find("Number of users [slower]") != -1) or (awx_purge_mode.find("Number of events [slower]") != -1)
-
-- name: Generate list of rooms with no local users
-  delegate_to: 127.0.0.1
-  shell: |
-    jq 'try .rooms[] | select(.joined_local_members == 0) | .room_id' < /tmp/{{ subscription_id }}_room_list_complete.json > /tmp/{{ subscription_id }}_room_list_no_local_users.txt
-  when: (awx_purge_mode.find("No local users [recommended]") != -1) or (awx_purge_mode.find("Number of users [slower]") != -1) or (awx_purge_mode.find("Number of events [slower]") != -1)
-
-- name: Count number of rooms with no local users
-  delegate_to: 127.0.0.1
-  shell: |
-    wc -l /tmp/{{ subscription_id }}_room_list_no_local_users.txt | awk '{ print $1 }'
-  register: awx_rooms_no_local_total
-  when: (awx_purge_mode.find("No local users [recommended]") != -1) or (awx_purge_mode.find("Number of users [slower]") != -1) or (awx_purge_mode.find("Number of events [slower]") != -1)
-
-- name: Setting host fact awx_room_list_no_local_users
-  set_fact:
-    awx_room_list_no_local_users: "{{ lookup('file', '/tmp/{{ subscription_id }}_room_list_no_local_users.txt') }}"
-  no_log: true
-  when: (awx_purge_mode.find("No local users [recommended]") != -1) or (awx_purge_mode.find("Number of users [slower]") != -1) or (awx_purge_mode.find("Number of events [slower]") != -1)
-
-- name: Purge all rooms with no local users
-  include_tasks: purge_database_no_local.yml
-  loop: "{{ awx_room_list_no_local_users.splitlines() | flatten(levels=1) }}"
-  when: (awx_purge_mode.find("No local users [recommended]") != -1) or (awx_purge_mode.find("Number of users [slower]") != -1) or (awx_purge_mode.find("Number of events [slower]") != -1)
-
-- name: Collect epoche time from date
-  delegate_to: 127.0.0.1
-  shell: |
-    date -d '{{ awx_purge_date }}' +"%s"
-  when: (awx_purge_mode.find("Number of users [slower]") != -1) or (awx_purge_mode.find("Number of events [slower]") != -1)
-  register: awx_purge_epoche_time
-
-- name: Generate list of rooms with more then N users
-  delegate_to: 127.0.0.1
-  shell: |
-    jq 'try .rooms[] | select(.joined_members > {{ awx_purge_metric_value }}) | .room_id' < /tmp/{{ subscription_id }}_room_list_complete.json > /tmp/{{ subscription_id }}_room_list_joined_members.txt
-  when: awx_purge_mode.find("Number of users [slower]") != -1
-
-- name: Count number of rooms with more then N users
-  delegate_to: 127.0.0.1
-  shell: |
-    wc -l /tmp/{{ subscription_id }}_room_list_joined_members.txt | awk '{ print $1 }'
-  register: awx_rooms_join_members_total
-  when: awx_purge_mode.find("Number of users [slower]") != -1
-
-- name: Setting host fact awx_room_list_joined_members
-  delegate_to: 127.0.0.1
-  set_fact:
-    awx_room_list_joined_members: "{{ lookup('file', '/tmp/{{ subscription_id }}_room_list_joined_members.txt') }}"
-  when: awx_purge_mode.find("Number of users [slower]") != -1
-  no_log: true
-
-- name: Purge all rooms with more then N users
-  include_tasks: purge_database_users.yml
-  loop: "{{ awx_room_list_joined_members.splitlines() | flatten(levels=1) }}"
-  when: awx_purge_mode.find("Number of users [slower]") != -1
-
-- name: Generate list of rooms with more then N events
-  delegate_to: 127.0.0.1
-  shell: |
-    jq 'try .rooms[] | select(.state_events > {{ awx_purge_metric_value }}) | .room_id' < /tmp/{{ subscription_id }}_room_list_complete.json > /tmp/{{ subscription_id }}_room_list_state_events.txt
-  when: awx_purge_mode.find("Number of events [slower]") != -1
-
-- name: Count number of rooms with more then N events
-  delegate_to: 127.0.0.1
-  shell: |
-    wc -l /tmp/{{ subscription_id }}_room_list_state_events.txt | awk '{ print $1 }'
-  register: awx_rooms_state_events_total
-  when: awx_purge_mode.find("Number of events [slower]") != -1
-
-- name: Setting host fact awx_room_list_state_events
-  delegate_to: 127.0.0.1
-  set_fact:
-    awx_room_list_state_events: "{{ lookup('file', '/tmp/{{ subscription_id }}_room_list_state_events.txt') }}"
-  when: awx_purge_mode.find("Number of events [slower]") != -1
-  no_log: true
-
-- name: Purge all rooms with more then N events
-  include_tasks: purge_database_events.yml
-  loop: "{{ awx_room_list_state_events.splitlines() | flatten(levels=1) }}"
-  when: awx_purge_mode.find("Number of events [slower]") != -1
-
-- name: Adjust 'Deploy/Update a Server' job template
-  delegate_to: 127.0.0.1
-  awx.awx.tower_job_template:
-    name: "{{ matrix_domain }} - 0 - Deploy/Update a Server"
-    description: "Creates a new matrix service with Spantaleev's playbooks"
-    extra_vars: "{{ lookup('file', '/var/lib/awx/projects/clients/{{ member_id }}/{{ subscription_id }}/extra_vars.json') }}"
-    job_type: run
-    job_tags: "rust-synapse-compress-state"
-    inventory: "{{ member_id }}"
-    project: "{{ member_id }} - Matrix Docker Ansible Deploy"
-    playbook: setup.yml
-    credential: "{{ member_id }} - AWX SSH Key"
-    state: present
-    verbosity: 1
-    tower_host: "https://{{ awx_host }}"
-    tower_oauthtoken: "{{ awx_session_token.ansible_facts.tower_token.token }}"
-    validate_certs: true
-  when: (awx_purge_mode.find("No local users [recommended]") != -1) or (awx_purge_mode.find("Number of users [slower]") != -1) or (awx_purge_mode.find("Number of events [slower]") != -1) or (awx_purge_mode.find("Skip purging rooms [faster]") != -1)
-
-- name: Execute rust-synapse-compress-state job template
-  delegate_to: 127.0.0.1
-  awx.awx.tower_job_launch:
-    job_template: "{{ matrix_domain }} - 0 - Deploy/Update a Server"
-    wait: true
-    tower_host: "https://{{ awx_host }}"
-    tower_oauthtoken: "{{ awx_session_token.ansible_facts.tower_token.token }}"
-    validate_certs: true
-  when: (awx_purge_mode.find("No local users [recommended]") != -1) or (awx_purge_mode.find("Number of users [slower]") != -1) or (awx_purge_mode.find("Number of events [slower]") != -1) or (awx_purge_mode.find("Skip purging rooms [faster]") != -1)
-
-- name: Revert 'Deploy/Update a Server' job template
-  delegate_to: 127.0.0.1
-  awx.awx.tower_job_template:
-    name: "{{ matrix_domain }} - 0 - Deploy/Update a Server"
-    description: "Creates a new matrix service with Spantaleev's playbooks"
-    extra_vars: "{{ lookup('file', '/var/lib/awx/projects/clients/{{ member_id }}/{{ subscription_id }}/extra_vars.json') }}"
-    job_type: run
-    job_tags: "setup-all,start"
-    inventory: "{{ member_id }}"
-    project: "{{ member_id }} - Matrix Docker Ansible Deploy"
-    playbook: setup.yml
-    credential: "{{ member_id }} - AWX SSH Key"
-    state: present
-    verbosity: 1
-    tower_host: "https://{{ awx_host }}"
-    tower_oauthtoken: "{{ awx_session_token.ansible_facts.tower_token.token }}"
-    validate_certs: true
-  when: (awx_purge_mode.find("No local users [recommended]") != -1) or (awx_purge_mode.find("Number of users [slower]") != -1) or (awx_purge_mode.find("Number of events [slower]") != -1) or (awx_purge_mode.find("Skip purging rooms [faster]") != -1)
-
-- name: Ensure matrix-synapse is stopped
-  service:
-    name: matrix-synapse
-    state: stopped
-    daemon_reload: true
-  when: (awx_purge_mode.find("Perform final shrink") != -1)
-
-- name: Re-index Synapse database
-  shell: docker exec -i matrix-postgres psql "host=127.0.0.1 port=5432 dbname=synapse user=synapse password={{ matrix_synapse_connection_password }}" -c 'REINDEX (VERBOSE) DATABASE synapse'
-  when: (awx_purge_mode.find("Perform final shrink") != -1)
-
-- name: Ensure matrix-synapse is started
-  service:
-    name: matrix-synapse
-    state: started
-    daemon_reload: true
-  when: (awx_purge_mode.find("Perform final shrink") != -1)
-
-- name: Adjust 'Deploy/Update a Server' job template
-  delegate_to: 127.0.0.1
-  awx.awx.tower_job_template:
-    name: "{{ matrix_domain }} - 0 - Deploy/Update a Server"
-    description: "Creates a new matrix service with Spantaleev's playbooks"
-    extra_vars: "{{ lookup('file', '/var/lib/awx/projects/clients/{{ member_id }}/{{ subscription_id }}/extra_vars.json') }}"
-    job_type: run
-    job_tags: "run-postgres-vacuum,start"
-    inventory: "{{ member_id }}"
-    project: "{{ member_id }} - Matrix Docker Ansible Deploy"
-    playbook: setup.yml
-    credential: "{{ member_id }} - AWX SSH Key"
-    state: present
-    verbosity: 1
-    tower_host: "https://{{ awx_host }}"
-    tower_oauthtoken: "{{ awx_session_token.ansible_facts.tower_token.token }}"
-    validate_certs: true
-  when: (awx_purge_mode.find("Perform final shrink") != -1)
-
-- name: Execute run-postgres-vacuum job template
-  delegate_to: 127.0.0.1
-  awx.awx.tower_job_launch:
-    job_template: "{{ matrix_domain }} - 0 - Deploy/Update a Server"
-    wait: true
-    tower_host: "https://{{ awx_host }}"
-    tower_oauthtoken: "{{ awx_session_token.ansible_facts.tower_token.token }}"
-    validate_certs: true
-  when: (awx_purge_mode.find("Perform final shrink") != -1)
-
-- name: Revert 'Deploy/Update a Server' job template
-  delegate_to: 127.0.0.1
-  awx.awx.tower_job_template:
-    name: "{{ matrix_domain }} - 0 - Deploy/Update a Server"
-    description: "Creates a new matrix service with Spantaleev's playbooks"
-    extra_vars: "{{ lookup('file', '/var/lib/awx/projects/clients/{{ member_id }}/{{ subscription_id }}/extra_vars.json') }}"
-    job_type: run
-    job_tags: "setup-all,start"
-    inventory: "{{ member_id }}"
-    project: "{{ member_id }} - Matrix Docker Ansible Deploy"
-    playbook: setup.yml
-    credential: "{{ member_id }} - AWX SSH Key"
-    state: present
-    verbosity: 1
-    tower_host: "https://{{ awx_host }}"
-    tower_oauthtoken: "{{ awx_session_token.ansible_facts.tower_token.token }}"
-    validate_certs: true
-  when: (awx_purge_mode.find("Perform final shrink") != -1)
-
-- name: Cleanup room_list files
-  delegate_to: 127.0.0.1
-  shell: |
-    rm /tmp/{{ subscription_id }}_room_list*
-  when: (awx_purge_mode.find("No local users [recommended]") != -1) or (awx_purge_mode.find("Number of users [slower]") != -1) or (awx_purge_mode.find("Number of events [slower]") != -1)
-  ignore_errors: true
-
-- name: Collect after shrink size of Synapse database
-  shell: du -sh /matrix/postgres/data
-  register: awx_db_size_after_stat
-  when: (awx_purge_mode.find("Perform final shrink") != -1)
-  no_log: true
-
-- name: Print total number of rooms processed
-  debug:
-    msg: '{{ awx_rooms_total.stdout }}'
-  when: (awx_purge_mode.find("No local users [recommended]") != -1) or (awx_purge_mode.find("Number of users [slower]") != -1) or (awx_purge_mode.find("Number of events [slower]") != -1)
-
-- name: Print the number of rooms purged with no local users
-  debug:
-    msg: '{{ awx_rooms_no_local_total.stdout }}'
-  when: (awx_purge_mode.find("No local users [recommended]") != -1) or (awx_purge_mode.find("Number of users [slower]") != -1) or (awx_purge_mode.find("Number of events [slower]") != -1)
-
-- name: Print the number of rooms purged with more then N users
-  debug:
-    msg: '{{ awx_rooms_join_members_total.stdout }}'
-  when: awx_purge_mode.find("Number of users") != -1
-
-- name: Print the number of rooms purged with more then N events
-  debug:
-    msg: '{{ awx_rooms_state_events_total.stdout }}'
-  when: awx_purge_mode.find("Number of events") != -1
-
-- name: Print before purge size of Synapse database
-  debug:
-    msg: "{{ awx_db_size_before_stat.stdout.split('\n') }}"
-  when: ( awx_db_size_before_stat is defined ) and ( awx_purge_mode.find("Perform final shrink" ) != -1 )
-
-- name: Print after purge size of Synapse database
-  debug:
-    msg: "{{ awx_db_size_after_stat.stdout.split('\n') }}"
-  when: (awx_db_size_after_stat is defined) and (awx_purge_mode.find("Perform final shrink") != -1)
-
-- name: Delete the AWX session token for executing modules
-  awx.awx.tower_token:
-    description: 'AWX Session Token'
-    scope: "write"
-    state: absent
-    existing_token_id: "{{ awx_session_token.ansible_facts.tower_token.id }}"
-    tower_host: "https://{{ awx_host }}"
-    tower_oauthtoken: "{{ awx_session_token.ansible_facts.tower_token.token }}"
-
-- name: Set boolean value to exit playbook
-  set_fact:
-    awx_end_playbook: true
-
-- name: End playbook early if this task is called.
-  meta: end_play
-  when: awx_end_playbook is defined and awx_end_playbook|bool

roles/matrix-awx/tasks/purge_database_no_local.yml

@@ -1,14 +0,0 @@
----
-
-- name: Purge all rooms with no local users
-  shell: |
-    curl --header "Authorization: Bearer {{ awx_janitors_token.stdout[1:-1] }}" -X POST -H "Content-Type: application/json" -d '{ "room_id": {{ item }} }' '{{ awx_synapse_container_ip.stdout }}:{{ matrix_synapse_container_client_api_port }}/_synapse/admin/v1/purge_room'
-  register: awx_purge_command
-
-- name: Print output of purge command
-  debug:
-    msg: "{{ awx_purge_command.stdout }}"
-
-- name: Pause for 5 seconds to let Synapse breathe
-  pause:
-    seconds: 5

roles/matrix-awx/tasks/purge_database_users.yml

@@ -1,14 +0,0 @@
----
-
-- name: Purge all rooms with more then N users
-  shell: |
-    curl --header "Authorization: Bearer {{ awx_janitors_token.stdout[1:-1] }}" -X POST -H "Content-Type: application/json" -d '{ "delete_local_events": false, "purge_up_to_ts": {{ awx_purge_epoche_time.stdout }}000 }' "{{ awx_synapse_container_ip.stdout }}:{{ matrix_synapse_container_client_api_port }}/_synapse/admin/v1/purge_history/{{ item[1:-1] }}"
-  register: awx_purge_command
-
-- name: Print output of purge command
-  debug:
-    msg: "{{ awx_purge_command.stdout }}"
-
-- name: Pause for 5 seconds to let Synapse breathe
-  pause:
-    seconds: 5

roles/matrix-awx/tasks/purge_media_local.yml

@@ -1,19 +0,0 @@
----
-
-- name: Collect epoche time from date
-  shell: |
-    date -d '{{ item }}' +"%s"
-  register: awx_epoche_time
-
-- name: Purge local media to specific date
-  shell: |
-    curl -X POST --header "Authorization: Bearer {{ awx_janitors_token.stdout[1:-1] }}" '{{ awx_synapse_container_ip.stdout }}:{{ matrix_synapse_container_client_api_port }}/_synapse/admin/v1/media/matrix.{{ matrix_domain }}/delete?before_ts={{ awx_epoche_time.stdout }}000'
-  register: awx_purge_command
-
-- name: Print output of purge command
-  debug:
-    msg: "{{ awx_purge_command.stdout }}"
-
-- name: Pause for 5 seconds to let Synapse breathe
-  pause:
-    seconds: 5

roles/matrix-awx/tasks/purge_media_main.yml

@@ -1,111 +0,0 @@
----
-
-- name: Ensure dateutils is installed in AWX
-  delegate_to: 127.0.0.1
-  yum:
-    name: dateutils
-    state: latest
-
-- name: Include vars in matrix_vars.yml
-  include_vars:
-    file: '/var/lib/awx/projects/clients/{{ member_id }}/{{ subscription_id }}/matrix_vars.yml'
-  no_log: true
-
-- name: Ensure curl and jq intalled on target machine
-  apt:
-    pkg:
-      - curl
-      - jq
-    state: present
-
-- name: Collect the internal IP of the matrix-synapse container
-  shell: "/usr/bin/docker inspect --format '{''{range.NetworkSettings.Networks}''}{''{.IPAddress}''}{''{end}''}' matrix-synapse"
-  register: awx_synapse_container_ip
-
-- name: Collect access token for @admin-janitor user
-  shell: |
-    curl -XPOST -d '{"type":"m.login.password", "user":"admin-janitor", "password":"{{ awx_janitor_user_password }}"}' "{{ awx_synapse_container_ip.stdout }}:{{ matrix_synapse_container_client_api_port }}/_matrix/client/r0/login" | jq '.access_token'
-  register: awx_janitors_token
-  no_log: true
-
-- name: Generate list of dates to purge to
-  delegate_to: 127.0.0.1
-  shell: "dateseq {{ awx_purge_from_date }} {{ awx_purge_to_date }}"
-  register: awx_purge_dates
-
-- name: Calculate initial size of local media repository
-  shell: du -sh /matrix/synapse/storage/media-store/local*
-  register: awx_local_media_size_before
-  when: awx_purge_media_type == "Local Media"
-  async: 600
-  ignore_errors: true
-  no_log: true
-
-- name: Calculate initial size of remote media repository
-  shell: du -sh /matrix/synapse/storage/media-store/remote*
-  register: awx_remote_media_size_before
-  when: awx_purge_media_type == "Remote Media"
-  async: 600
-  ignore_errors: true
-  no_log: true
-
-- name: Purge local media with loop
-  include_tasks: purge_media_local.yml
-  loop: "{{ awx_purge_dates.stdout_lines | flatten(levels=1) }}"
-  when: awx_purge_media_type == "Local Media"
-
-- name: Purge remote media with loop
-  include_tasks: purge_media_remote.yml
-  loop: "{{ awx_purge_dates.stdout_lines | flatten(levels=1) }}"
-  when: awx_purge_media_type == "Remote Media"
-
-- name: Calculate final size of local media repository
-  shell: du -sh /matrix/synapse/storage/media-store/local*
-  register: awx_local_media_size_after
-  when: awx_purge_media_type == "Local Media"
-  ignore_errors: true
-  no_log: true
-
-- name: Calculate final size of remote media repository
-  shell: du -sh /matrix/synapse/storage/media-store/remote*
-  register: awx_remote_media_size_after
-  when: awx_purge_media_type == "Remote Media"
-  ignore_errors: true
-  no_log: true
-
-- name: Print size of local media repository before purge
-  debug:
-    msg: "{{ awx_local_media_size_before.stdout.split('\n') }}"
-  when: awx_purge_media_type == "Local Media"
-
-- name: Print size of local media repository after purge
-  debug:
-    msg: "{{ awx_local_media_size_after.stdout.split('\n') }}"
-  when: awx_purge_media_type == "Local Media"
-
-- name: Print size of remote media repository before purge
-  debug:
-    msg: "{{ awx_remote_media_size_before.stdout.split('\n') }}"
-  when: awx_purge_media_type == "Remote Media"
-
-- name: Print size of remote media repository after purge
-  debug:
-    msg: "{{ awx_remote_media_size_after.stdout.split('\n') }}"
-  when: awx_purge_media_type == "Remote Media"
-
-- name: Delete the AWX session token for executing modules
-  awx.awx.tower_token:
-    description: 'AWX Session Token'
-    scope: "write"
-    state: absent
-    existing_token_id: "{{ awx_session_token.ansible_facts.tower_token.id }}"
-    tower_host: "https://{{ awx_host }}"
-    tower_oauthtoken: "{{ awx_session_token.ansible_facts.tower_token.token }}"
-
-- name: Set boolean value to exit playbook
-  set_fact:
-    awx_end_playbook: true
-
-- name: End playbook early if this task is called.
-  meta: end_play
-  when: awx_end_playbook is defined and awx_end_playbook|bool

roles/matrix-awx/tasks/purge_media_remote.yml

@@ -1,19 +0,0 @@
----
-
-- name: Collect epoche time from date
-  shell: |
-    date -d '{{ item }}' +"%s"
-  register: awx_epoche_time
-
-- name: Purge remote media to specific date
-  shell: |
-    curl -X POST --header "Authorization: Bearer {{ awx_janitors_token.stdout[1:-1] }}" '{{ awx_synapse_container_ip.stdout }}:{{ matrix_synapse_container_client_api_port }}/_synapse/admin/v1/purge_media_cache?before_ts={{ awx_epoche_time.stdout }}000'
-  register: awx_purge_command
-
-- name: Print output of purge command
-  debug:
-    msg: "{{ awx_purge_command.stdout }}"
-
-- name: Pause for 5 seconds to let Synapse breathe
-  pause:
-    seconds: 5

roles/matrix-awx/tasks/rotate_ssh.yml

@@ -1,25 +0,0 @@
----
-
-- name: Set the new authorized key taken from file
-  authorized_key:
-    user: root
-    state: present
-    exclusive: true
-    key: "{{ lookup('file', '/var/lib/awx/projects/hosting/client_public.key') }}"
-
-- name: Delete the AWX session token for executing modules
-  awx.awx.tower_token:
-    description: 'AWX Session Token'
-    scope: "write"
-    state: absent
-    existing_token_id: "{{ awx_session_token.ansible_facts.tower_token.id }}"
-    tower_host: "https://{{ awx_host }}"
-    tower_oauthtoken: "{{ awx_session_token.ansible_facts.tower_token.token }}"
-
-- name: Set boolean value to exit playbook
-  set_fact:
-    end_playbook: true
-
-- name: End playbook if this task list is called.
-  meta: end_play
-  when: end_playbook is defined and end_playbook|bool

roles/matrix-awx/tasks/self_check.yml

@@ -1,108 +0,0 @@
----
-
-- name: Install prerequisite apt packages on target
-  apt:
-    name:
-      - sysstat
-      - curl
-    state: present
-
-- name: Install prerequisite yum packages on AWX
-  delegate_to: 127.0.0.1
-  yum:
-    name:
-      - bind-utils
-    state: present
-
-- name: Install prerequisite pip packages on AWX
-  delegate_to: 127.0.0.1
-  pip:
-    name:
-      - dnspython
-    state: present
-
-- name: Calculate MAU value
-  shell: |
-    curl -s localhost:9000 | grep "^synapse_admin_mau_current "
-  register: awx_mau_stat
-  no_log: true
-
-- name: Calculate CPU usage statistics
-  shell: iostat -c
-  register: awx_cpu_usage_stat
-  no_log: true
-
-- name: Calculate RAM usage statistics
-  shell: free -mh
-  register: awx_ram_usage_stat
-  no_log: true
-
-- name: Calculate free disk space
-  shell: df -h
-  register: awx_disk_space_stat
-  no_log: true
-
-- name: Calculate size of Synapse database
-  shell: du -sh /matrix/postgres/data
-  register: awx_db_size_stat
-  no_log: true
-
-- name: Calculate size of local media repository
-  shell: du -sh /matrix/synapse/storage/media-store/local*
-  register: awx_local_media_size_stat
-  async: 600
-  ignore_errors: true
-  no_log: true
-
-- name: Calculate size of remote media repository
-  shell: du -sh /matrix/synapse/storage/media-store/remote*
-  register: awx_remote_media_size_stat
-  async: 600
-  ignore_errors: true
-  no_log: true
-
-- name: Calculate docker container statistics
-  shell: docker stats --all --no-stream
-  register: awx_docker_stats
-  ignore_errors: true
-  no_log: true
-
-- name: Print size of remote media repository
-  debug:
-    msg: "{{ awx_remote_media_size_stat.stdout.split('\n') }}"
-  when: awx_remote_media_size_stat is defined
-
-- name: Print size of local media repository
-  debug:
-    msg: "{{ awx_local_media_size_stat.stdout.split('\n') }}"
-  when: awx_local_media_size_stat is defined
-
-- name: Print size of Synapse database
-  debug:
-    msg: "{{ awx_db_size_stat.stdout.split('\n') }}"
-  when: awx_db_size_stat is defined
-
-- name: Print free disk space
-  debug:
-    msg: "{{ awx_disk_space_stat.stdout.split('\n') }}"
-  when: awx_disk_space_stat is defined
-
-- name: Print RAM usage statistics
-  debug:
-    msg: "{{ awx_ram_usage_stat.stdout.split('\n') }}"
-  when: awx_ram_usage_stat is defined
-
-- name: Print CPU usage statistics
-  debug:
-    msg: "{{ awx_cpu_usage_stat.stdout.split('\n') }}"
-  when: awx_cpu_usage_stat is defined
-
-- name: Print MAU value
-  debug:
-    msg: "{{ awx_mau_stat.stdout.split('\n') }}"
-  when: awx_mau_stat is defined
-
-- name: Print docker container statistics
-  debug:
-    msg: "{{ awx_docker_stats.stdout.split('\n') }}"
-  when: awx_docker_stats is defined

roles/matrix-awx/tasks/set_variables_corporal.yml

@@ -1,243 +0,0 @@
----
-
-- name: Record Corporal Enabled/Disabled variable
-  delegate_to: 127.0.0.1
-  lineinfile:
-    path: '{{ awx_cached_matrix_vars }}'
-    regexp: "^#? *{{ item.key | regex_escape() }}:"
-    line: "{{ item.key }}: {{ item.value }}"
-    insertafter: '# Corporal Settings Start'
-  with_dict:
-    'matrix_corporal_enabled': '{{ matrix_corporal_enabled }}'
-
-- name: Enable Shared Secret Auth if Corporal enabled
-  delegate_to: 127.0.0.1
-  lineinfile:
-    path: '{{ awx_cached_matrix_vars }}'
-    regexp: "^#? *{{ item.key | regex_escape() }}:"
-    line: "{{ item.key }}: {{ item.value }}"
-    insertafter: '# Shared Secret Auth Settings Start'
-  with_dict:
-    'matrix_synapse_ext_password_provider_shared_secret_auth_enabled': 'true'
-  when: matrix_corporal_enabled|bool
-
-- name: Disable Shared Secret Auth if Corporal disabled
-  delegate_to: 127.0.0.1
-  lineinfile:
-    path: '{{ awx_cached_matrix_vars }}'
-    regexp: "^#? *{{ item.key | regex_escape() }}:"
-    line: "{{ item.key }}: {{ item.value }}"
-    insertafter: '# Shared Secret Auth Settings Start'
-  with_dict:
-    'matrix_synapse_ext_password_provider_shared_secret_auth_enabled': 'false'
-  when: not matrix_corporal_enabled|bool
-
-- name: Enable Rest Auth Endpoint if Corporal enabled
-  delegate_to: 127.0.0.1
-  lineinfile:
-    path: '{{ awx_cached_matrix_vars }}'
-    regexp: "^#? *{{ item.key | regex_escape() }}:"
-    line: "{{ item.key }}: {{ item.value }}"
-    insertafter: '# Synapse Extension Start'
-  with_dict:
-    'matrix_synapse_ext_password_provider_rest_auth_enabled': 'true'
-  when: matrix_corporal_enabled|bool
-
-- name: Disable Rest Auth Endpoint if Corporal disabled
-  delegate_to: 127.0.0.1
-  lineinfile:
-    path: '{{ awx_cached_matrix_vars }}'
-    regexp: "^#? *{{ item.key | regex_escape() }}:"
-    line: "{{ item.key }}: {{ item.value }}"
-    insertafter: '# Synapse Extension Start'
-  with_dict:
-    'matrix_synapse_ext_password_provider_rest_auth_enabled': 'false'
-  when: not matrix_corporal_enabled|bool
-
-- name: Disable Corporal API if Simple Static File mode selected
-  delegate_to: 127.0.0.1
-  lineinfile:
-    path: '{{ awx_cached_matrix_vars }}'
-    regexp: "^#? *{{ item.key | regex_escape() }}:"
-    line: "{{ item.key }}: {{ item.value }}"
-    insertafter: '# Corporal Settings Start'
-  with_dict:
-    'matrix_corporal_http_api_enabled': 'false'
-  when: (awx_corporal_policy_provider_mode == "Simple Static File") or (not matrix_corporal_enabled|bool)
-
-- name: Enable Corporal API if Push/Pull mode delected
-  delegate_to: 127.0.0.1
-  lineinfile:
-    path: '{{ awx_cached_matrix_vars }}'
-    regexp: "^#? *{{ item.key | regex_escape() }}:"
-    line: "{{ item.key }}: {{ item.value }}"
-    insertafter: '# Corporal Settings Start'
-  with_dict:
-    'matrix_corporal_http_api_enabled': 'true'
-  when: (awx_corporal_policy_provider_mode != "Simple Static File") and (matrix_corporal_enabled|bool)
-
-- name: Record Corporal API Access Token if it's defined
-  delegate_to: 127.0.0.1
-  lineinfile:
-    path: '{{ awx_cached_matrix_vars }}'
-    regexp: "^#? *{{ item.key | regex_escape() }}:"
-    line: "{{ item.key }}: {{ item.value }}"
-    insertafter: '# Corporal Settings Start'
-  with_dict:
-    'matrix_corporal_http_api_auth_token': '{{ matrix_corporal_http_api_auth_token }}'
-  when: ( matrix_corporal_http_api_auth_token|length > 0 ) and ( awx_corporal_policy_provider_mode != "Simple Static File" )
-
-- name: Record 'Simple Static File' configuration variables in matrix_vars.yml
-  delegate_to: 127.0.0.1
-  blockinfile:
-    path: '{{ awx_cached_matrix_vars }}'
-    insertbefore: "# Corporal Policy Provider Settings End"
-    marker_begin: "Corporal"
-    marker_end: "Corporal"
-    block: |
-      matrix_corporal_policy_provider_config: |
-        {
-          "Type": "static_file",
-          "Path": "/etc/matrix-corporal/corporal-policy.json"
-        }
-  when: awx_corporal_policy_provider_mode == "Simple Static File"
-
-- name: Touch the /matrix/corporal/ directory
-  file:
-    path: "/matrix/corporal/"
-    state: directory
-    owner: matrix
-    group: matrix
-    mode: '750'
-
-- name: Touch the /matrix/corporal/config/ directory
-  file:
-    path: "/matrix/corporal/config/"
-    state: directory
-    owner: matrix
-    group: matrix
-    mode: '750'
-
-- name: Touch the /matrix/corporal/cache/ directory
-  file:
-    path: "/matrix/corporal/cache/"
-    state: directory
-    owner: matrix
-    group: matrix
-    mode: '750'
-
-- name: Touch the corporal-policy.json file to ensure it exists
-  file:
-    path: "/matrix/corporal/config/corporal-policy.json"
-    state: touch
-    owner: matrix
-    group: matrix
-    mode: '660'
-
-- name: Touch the last-policy.json file to ensure it exists
-  file:
-    path: "/matrix/corporal/config/last-policy.json"
-    state: touch
-    owner: matrix
-    group: matrix
-    mode: '660'
-
-- name: Record 'Simple Static File' configuration content in corporal-policy.json
-  copy:
-    content: "{{ awx_corporal_simple_static_config | string  }}"
-    dest: "/matrix/corporal/config/corporal-policy.json"
-    owner: matrix
-    group: matrix
-    mode: '660'
-  when: (awx_corporal_policy_provider_mode == "Simple Static File") and (awx_corporal_simple_static_config|length > 0)
-
-- name: Record 'HTTP Pull Mode' configuration variables in matrix_vars.yml
-  delegate_to: 127.0.0.1
-  blockinfile:
-    path: '{{ awx_cached_matrix_vars }}'
-    insertafter: "# Corporal Policy Provider Settings Start"
-    block: |
-      matrix_corporal_policy_provider_config: |
-        {
-          "Type": "http",
-          "Uri": "{{ awx_corporal_pull_mode_uri }}",
-          "AuthorizationBearerToken": "{{ awx_corporal_pull_mode_token }}",
-          "CachePath": "/var/cache/matrix-corporal/last-policy.json",
-          "ReloadIntervalSeconds": 1800,
-          "TimeoutMilliseconds": 30000
-        }
-  when: (awx_corporal_policy_provider_mode == "HTTP Pull Mode (API Enabled)") and (matrix_corporal_pull_mode_uri|length > 0) and (awx_corporal_pull_mode_token|length > 0)
-
-- name: Record 'HTTP Push Mode' configuration variables in matrix_vars.yml
-  delegate_to: 127.0.0.1
-  blockinfile:
-    path: '{{ awx_cached_matrix_vars }}'
-    insertafter: "# Corporal Policy Provider Settings Start"
-    block: |
-      matrix_corporal_policy_provider_config: |
-        {
-          "Type": "last_seen_store_policy",
-          "CachePath": "/var/cache/matrix-corporal/last-policy.json"
-        }
-  when: (awx_corporal_policy_provider_mode == "HTTP Push Mode (API Enabled)")
-
-- name: Lower RateLimit if set to 'Normal'
-  delegate_to: 127.0.0.1
-  replace:
-    path: '{{ awx_cached_matrix_vars }}'
-    regexp: '    address:\n        per_second: 50\n        burst_count: 300\n    account:\n        per_second: 0.17\n        burst_count: 300'
-    replace: '    address:\n        per_second: 0.17\n        burst_count: 3\n    account:\n        per_second: 0.17\n        burst_count: 3'
-  when: awx_corporal_raise_ratelimits == "Normal"
-
-- name: Raise RateLimit if set to 'Raised'
-  delegate_to: 127.0.0.1
-  replace:
-    path: '{{ awx_cached_matrix_vars }}'
-    regexp: '    address:\n        per_second: 0.17\n        burst_count: 3\n    account:\n        per_second: 0.17\n        burst_count: 3'
-    replace: '    address:\n        per_second: 50\n        burst_count: 300\n    account:\n        per_second: 0.17\n        burst_count: 300'
-  when: awx_corporal_raise_ratelimits == "Raised"
-
-- name: Save new 'Configure Corporal' survey.json to the AWX tower
-  delegate_to: 127.0.0.1
-  template:
-    src: 'roles/matrix-awx/surveys/configure_corporal.json.j2'
-    dest: '/var/lib/awx/projects/clients/{{ member_id }}/{{ subscription_id }}/configure_corporal.json'
-
-- name: Copy new 'Configure Corporal' survey.json to target machine
-  copy:
-    src: '/var/lib/awx/projects/clients/{{ member_id }}/{{ subscription_id }}/configure_corporal.json'
-    dest: '/matrix/awx/configure_corporal.json'
-    mode: '0660'
-
-- debug:
-    msg: "matrix_corporal_matrix_homeserver_api_endpoint: {{ matrix_corporal_matrix_homeserver_api_endpoint }}"
-
-- debug:
-    msg: "matrix_corporal_matrix_auth_shared_secret: {{ matrix_corporal_matrix_auth_shared_secret }}"
-
-- debug:
-    msg: "matrix_corporal_http_gateway_internal_rest_auth_enabled: {{ matrix_corporal_http_gateway_internal_rest_auth_enabled }}"
-
-- debug:
-    msg: "matrix_corporal_matrix_registration_shared_secret: {{ matrix_corporal_matrix_registration_shared_secret }}"
-
-- name: Recreate 'Configure Corporal (Advanced)' job template
-  delegate_to: 127.0.0.1
-  awx.awx.tower_job_template:
-    name: "{{ matrix_domain }} - 1 - Configure Corporal (Advanced)"
-    description: "Configure Matrix Corporal, a tool that manages your Matrix server according to a configuration policy."
-    extra_vars: "{{ lookup('file', '/var/lib/awx/projects/clients/{{ member_id }}/{{ subscription_id }}/extra_vars.json') }}"
-    job_type: run
-    job_tags: "start,setup-corporal"
-    inventory: "{{ member_id }}"
-    project: "{{ member_id }} - Matrix Docker Ansible Deploy"
-    playbook: setup.yml
-    credential: "{{ member_id }} - AWX SSH Key"
-    survey_enabled: true
-    survey_spec: "{{ lookup('file', '/var/lib/awx/projects/clients/{{ member_id }}/{{ subscription_id }}/configure_corporal.json') }}"
-    become_enabled: true
-    state: present
-    verbosity: 1
-    tower_host: "https://{{ awx_host }}"
-    tower_oauthtoken: "{{ awx_session_token.ansible_facts.tower_token.token }}"
-    validate_certs: true

roles/matrix-awx/tasks/set_variables_dimension.yml

@@ -1,105 +0,0 @@
----
-
-- name: Include vars in matrix_vars.yml
-  include_vars:
-    file: '{{ awx_cached_matrix_vars }}'
-  no_log: true
-
-- name: Install jq and curl on remote machine
-  apt:
-    name:
-      - jq
-      - curl
-    state: present
-
-- name: Collect access token of @admin-dimension user
-  shell: |
-    curl -X POST --header 'Content-Type: application/json' -d '{"identifier": {"type": "m.id.user","user": "admin-dimension"}, "password": "{{ awx_dimension_user_password }}", "type": "m.login.password"}' 'https://matrix.{{ matrix_domain }}/_matrix/client/r0/login' | jq -c '. | {access_token}' | sed 's/.*\":\"//' | sed 's/\"}//'
-  register: awx_dimension_user_access_token
-
-- name: Record Synapse variables locally on AWX
-  delegate_to: 127.0.0.1
-  lineinfile:
-    path: '{{ awx_cached_matrix_vars }}'
-    regexp: "^#? *{{ item.key | regex_escape() }}:"
-    line: "{{ item.key }}: {{ item.value }}"
-    insertafter: '# Dimension Settings Start'
-  with_dict:
-    'matrix_dimension_enabled': '{{ matrix_dimension_enabled }}'
-    'matrix_dimension_access_token': '"{{ awx_dimension_user_access_token.stdout }}"'
-
-- name: Set final users list if users are defined
-  set_fact:
-    awx_dimension_users_final: "{{ awx_dimension_users }}"
-  when: awx_dimension_users | length > 0
-
-- name: Set final users list if no users are defined
-  set_fact:
-    awx_dimension_users_final: '@dimension:{{ matrix_domain }}'
-  when: awx_dimension_users | length == 0
-
-- name: Remove Dimension Users
-  delegate_to: 127.0.0.1
-  replace:
-    path: '{{ awx_cached_matrix_vars }}'
-    regexp: '^  - .*\n'
-    after: 'matrix_dimension_admins:'
-    before: '# Dimension Settings End'
-
-- name: Set Dimension Users Header
-  delegate_to: 127.0.0.1
-  lineinfile:
-    path: '{{ awx_cached_matrix_vars }}'
-    insertbefore: '# Dimension Settings End'
-    line: "matrix_dimension_admins:"
-
-- name: Set Dimension Users
-  delegate_to: 127.0.0.1
-  lineinfile:
-    path: '{{ awx_cached_matrix_vars }}'
-    insertafter: '^matrix_dimension_admins:'
-    line: '  - "{{ item }}"'
-  with_items: "{{ awx_dimension_users_final.splitlines() }}"
-
-- name: Record Dimension Custom variables locally on AWX
-  delegate_to: 127.0.0.1
-  lineinfile:
-    path: '{{ awx_cached_matrix_vars }}'
-    regexp: "^#? *{{ item.key | regex_escape() }}:"
-    line: "{{ item.key }}: {{ item.value }}"
-    insertbefore: '# Dimension Settings End'
-  with_dict:
-    'awx_dimension_users': '{{ awx_dimension_users.splitlines() | to_json }}'
-
-- name: Save new 'Configure Dimension' survey.json to the AWX tower, template
-  delegate_to: 127.0.0.1
-  template:
-    src: 'roles/matrix-awx/surveys/configure_dimension.json.j2'
-    dest: '/var/lib/awx/projects/clients/{{ member_id }}/{{ subscription_id }}//configure_dimension.json'
-
-- name: Copy new 'Configure Dimension' survey.json to target machine
-  copy:
-    src: '/var/lib/awx/projects/clients/{{ member_id }}/{{ subscription_id }}/configure_dimension.json'
-    dest: '/matrix/awx/configure_dimension.json'
-    mode: '0660'
-
-- name: Recreate 'Configure Dimension' job template
-  delegate_to: 127.0.0.1
-  awx.awx.tower_job_template:
-    name: "{{ matrix_domain }} - 1 - Configure Dimension"
-    description: "Configure Dimension, the self-hosted integrations server."
-    extra_vars: "{{ lookup('file', '/var/lib/awx/projects/clients/{{ member_id }}/{{ subscription_id }}/extra_vars.json') }}"
-    job_type: run
-    job_tags: "start,setup-all,setup-dimension"
-    inventory: "{{ member_id }}"
-    project: "{{ member_id }} - Matrix Docker Ansible Deploy"
-    playbook: setup.yml
-    credential: "{{ member_id }} - AWX SSH Key"
-    survey_enabled: true
-    survey_spec: "{{ lookup('file', '/var/lib/awx/projects/clients/{{ member_id }}/{{ subscription_id }}/configure_dimension.json') }}"
-    become_enabled: true
-    state: present
-    verbosity: 1
-    tower_host: "https://{{ awx_host }}"
-    tower_oauthtoken: "{{ awx_session_token.ansible_facts.tower_token.token }}"
-    validate_certs: true

roles/matrix-awx/tasks/set_variables_element.yml

@@ -1,180 +0,0 @@
----
-
-- name: Record Element-Web variables locally on AWX
-  delegate_to: 127.0.0.1
-  lineinfile:
-    path: '{{ awx_cached_matrix_vars }}'
-    regexp: "^#? *{{ item.key | regex_escape() }}:"
-    line: "{{ item.key }}: {{ item.value }}"
-    insertafter: '# Element Settings Start'
-  with_dict:
-    'matrix_client_element_enabled': '{{ matrix_client_element_enabled }}'
-    'matrix_client_element_jitsi_preferredDomain': 'jitsi.{{ matrix_domain }}'
-    'matrix_client_element_default_theme': '{{ matrix_client_element_default_theme }}'
-    'matrix_client_element_registration_enabled': '{{ matrix_client_element_registration_enabled }}'
-    'matrix_client_element_brand': '{{ matrix_client_element_brand | trim }}'
-    'matrix_client_element_branding_welcomeBackgroundUrl': '{{ matrix_client_element_branding_welcomeBackgroundUrl | trim }}'
-    'matrix_client_element_welcome_logo': '{{ matrix_client_element_welcome_logo | trim }}'
-    'matrix_client_element_welcome_logo_link': '{{ matrix_client_element_welcome_logo_link | trim }}'
-
-- name: Record Element-Web custom variables locally on AWX
-  delegate_to: 127.0.0.1
-  lineinfile:
-    path: '{{ awx_cached_matrix_vars }}'
-    regexp: "^#? *{{ item.key | regex_escape() }}:"
-    line: "{{ item.key }}: '{{ item.value }}'"
-    insertbefore: '# Element Settings End'
-  with_dict:
-    'awx_matrix_client_element_welcome_headline': '{{ awx_matrix_client_element_welcome_headline | trim }}'
-    'awx_matrix_client_element_welcome_text': '{{ awx_matrix_client_element_welcome_text | trim }}'
-
-- name: Set Element-Web custom branding locally on AWX
-  delegate_to: 127.0.0.1
-  lineinfile:
-    path: '{{ awx_cached_matrix_vars }}'
-    regexp: "^#? *{{ item.key | regex_escape() }}:"
-    line: "{{ item.key }}: '{{ item.value }}'"
-    insertafter: '# Element Settings Start'
-  with_dict:
-    'matrix_client_element_brand': "{{ matrix_client_element_brand }}"
-  when: matrix_client_element_brand | trim | length > 0
-
-- name: Remove Element-Web custom branding locally on AWX if not defined
-  delegate_to: 127.0.0.1
-  lineinfile:
-    path: '{{ awx_cached_matrix_vars }}'
-    regexp: "^matrix_client_element_brand: "
-    state: absent
-  when: matrix_client_element_brand | trim | length == 0
-
-- name: Set fact for 'https' string
-  set_fact:
-    awx_https_string: "https"
-
-- name: Set Element-Web custom logo locally on AWX if defined
-  delegate_to: 127.0.0.1
-  lineinfile:
-    path: '{{ awx_cached_matrix_vars }}'
-    regexp: "^#? *{{ item.key | regex_escape() }}:"
-    line: "{{ item.key }}: '{{ item.value }}'"
-    insertafter: '# Element Settings Start'
-  with_dict:
-    'matrix_client_element_welcome_logo': '{{ matrix_client_element_welcome_logo }}'
-  when: ( awx_https_string in matrix_client_element_welcome_logo ) and ( matrix_client_element_welcome_logo | trim | length > 0 )
-
-- name: Remove Element-Web custom logo locally on AWX if not defined
-  delegate_to: 127.0.0.1
-  lineinfile:
-    path: '{{ awx_cached_matrix_vars }}'
-    regexp: "^matrix_client_element_welcome_logo: "
-    state: absent
-  when: matrix_client_element_welcome_logo | trim | length == 0
-
-- name: Set Element-Web custom logo link locally on AWX if defined
-  delegate_to: 127.0.0.1
-  lineinfile:
-    path: '{{ awx_cached_matrix_vars }}'
-    regexp: "^#? *{{ item.key | regex_escape() }}:"
-    line: "{{ item.key }}: '{{ item.value }}'"
-    insertafter: '# Element Settings Start'
-  with_dict:
-    'matrix_client_element_welcome_logo_link': '{{ matrix_client_element_welcome_logo_link }}'
-  when: ( awx_https_string in matrix_client_element_welcome_logo_link ) and ( matrix_client_element_welcome_logo_link | trim | length > 0 )
-
-- name: Remove Element-Web custom logo link locally on AWX if not defined
-  delegate_to: 127.0.0.1
-  lineinfile:
-    path: '{{ awx_cached_matrix_vars }}'
-    regexp: "^matrix_client_element_welcome_logo_link: "
-    state: absent
-  when: matrix_client_element_welcome_logo_link | trim | length == 0
-
-- name: Set Element-Web custom headline locally on AWX if defined
-  delegate_to: 127.0.0.1
-  lineinfile:
-    path: '{{ awx_cached_matrix_vars }}'
-    regexp: "^#? *{{ item.key | regex_escape() }}:"
-    line: "{{ item.key }}: '{{ item.value }}'"
-    insertafter: '# Element Settings Start'
-  with_dict:
-    'matrix_client_element_welcome_headline': '{{ awx_matrix_client_element_welcome_headline }}'
-  when: awx_matrix_client_element_welcome_headline | trim | length > 0
-
-- name: Remove Element-Web custom headline locally on AWX if not defined
-  delegate_to: 127.0.0.1
-  lineinfile:
-    path: '{{ awx_cached_matrix_vars }}'
-    regexp: "^matrix_client_element_welcome_headline: "
-    state: absent
-  when: awx_matrix_client_element_welcome_headline | trim | length == 0
-
-- name: Set Element-Web custom text locally on AWX if defined
-  delegate_to: 127.0.0.1
-  lineinfile:
-    path: '{{ awx_cached_matrix_vars }}'
-    regexp: "^#? *{{ item.key | regex_escape() }}:"
-    line: "{{ item.key }}: '{{ item.value }}'"
-    insertafter: '# Element Settings Start'
-  with_dict:
-    'matrix_client_element_welcome_text': '{{ awx_matrix_client_element_welcome_text }}'
-  when: awx_matrix_client_element_welcome_text | trim | length > 0
-
-- name: Remove Element-Web custom text locally on AWX if not defined
-  delegate_to: 127.0.0.1
-  lineinfile:
-    path: '{{ awx_cached_matrix_vars }}'
-    regexp: "^matrix_client_element_welcome_text: "
-    state: absent
-  when: awx_matrix_client_element_welcome_text | trim | length == 0
-
-- name: Set Element-Web background locally on AWX if defined
-  delegate_to: 127.0.0.1
-  lineinfile:
-    path: '{{ awx_cached_matrix_vars }}'
-    regexp: "^#? *{{ item.key | regex_escape() }}:"
-    line: "{{ item.key }}: '{{ item.value }}'"
-    insertafter: '# Element Settings Start'
-  with_dict:
-    'matrix_client_element_branding_welcomeBackgroundUrl': '{{ matrix_client_element_branding_welcomeBackgroundUrl }}'
-  when: matrix_client_element_branding_welcomeBackgroundUrl | trim | length > 0
-
-- name: Remove Element-Web background locally on AWX if not defined
-  delegate_to: 127.0.0.1
-  lineinfile:
-    path: '{{ awx_cached_matrix_vars }}'
-    regexp: "^matrix_client_element_branding_welcomeBackgroundUrl: "
-    state: absent
-  when: matrix_client_element_branding_welcomeBackgroundUrl | trim | length == 0
-
-- name: Save new 'Configure Element' survey.json to the AWX tower, template
-  delegate_to: 127.0.0.1
-  template:
-    src: 'roles/matrix-awx/surveys/configure_element.json.j2'
-    dest: '/var/lib/awx/projects/clients/{{ member_id }}/{{ subscription_id }}/configure_element.json'
-
-- name: Copy new 'Configure Element' survey.json to target machine
-  copy:
-    src: '/var/lib/awx/projects/clients/{{ member_id }}/{{ subscription_id }}/configure_element.json'
-    dest: '/matrix/awx/configure_element.json'
-    mode: '0660'
-
-- name: Recreate 'Configure Element' job template
-  delegate_to: 127.0.0.1
-  awx.awx.tower_job_template:
-    name: "{{ matrix_domain }} - 1 - Configure Element"
-    description: "Configure Element client via survey."
-    extra_vars: "{{ lookup('file', '/var/lib/awx/projects/clients/{{ member_id }}/{{ subscription_id }}/extra_vars.json') }}"
-    job_type: run
-    job_tags: "start,setup-client-element"
-    inventory: "{{ member_id }}"
-    project: "{{ member_id }} - Matrix Docker Ansible Deploy"
-    playbook: setup.yml
-    credential: "{{ member_id }} - AWX SSH Key"
-    survey_enabled: true
-    survey_spec: "{{ lookup('file', '/var/lib/awx/projects/clients/{{ member_id }}/{{ subscription_id }}/configure_element.json') }}"
-    become_enabled: true
-    state: present
-    verbosity: 1
-    tower_host: "https://{{ awx_host }}"
-    tower_oauthtoken: "{{ awx_session_token.ansible_facts.tower_token.token }}"
-    validate_certs: true

roles/matrix-awx/tasks/set_variables_element_subdomain.yml

@@ -1,43 +0,0 @@
----
-
-- name: Record Element-Web variables locally on AWX
-  delegate_to: 127.0.0.1
-  lineinfile:
-    path: '{{ awx_cached_matrix_vars }}'
-    regexp: "^#? *{{ item.key | regex_escape() }}:"
-    line: "{{ item.key }}: {{ item.value }}"
-    insertafter: '# Element Settings Start'
-  with_dict:
-    'matrix_server_fqn_element': "{{ awx_element_subdomain | trim }}.{{ matrix_domain }}"
-
-- name: Save new 'Configure Element Subdomain' survey.json to the AWX tower, template
-  delegate_to: 127.0.0.1
-  template:
-    src: 'roles/matrix-awx/surveys/configure_element_subdomain.json.j2'
-    dest: '/var/lib/awx/projects/clients/{{ member_id }}/{{ subscription_id }}/configure_element_subdomain.json'
-
-- name: Copy new 'Configure Element Subdomain' survey.json to target machine
-  copy:
-    src: '/var/lib/awx/projects/clients/{{ member_id }}/{{ subscription_id }}/configure_element_subdomain.json'
-    dest: '/matrix/awx/configure_element_subdomain.json'
-    mode: '0660'
-
-- name: Recreate 'Configure Element Subdomain' job template
-  delegate_to: 127.0.0.1
-  awx.awx.tower_job_template:
-    name: "{{ matrix_domain }} - 1 - Configure Element Subdomain"
-    description: "Configure Element clients subdomain location. (Eg: 'element' for element.example.org)"
-    extra_vars: "{{ lookup('file', '/var/lib/awx/projects/clients/{{ member_id }}/{{ subscription_id }}/extra_vars.json') }}"
-    job_type: run
-    job_tags: "start,setup-all,setup-client-element-subdomain"
-    inventory: "{{ member_id }}"
-    project: "{{ member_id }} - Matrix Docker Ansible Deploy"
-    playbook: setup.yml
-    credential: "{{ member_id }} - AWX SSH Key"
-    survey_enabled: true
-    survey_spec: "{{ lookup('file', '/var/lib/awx/projects/clients/{{ member_id }}/{{ subscription_id }}/configure_element_subdomain.json') }}"
-    state: present
-    verbosity: 1
-    tower_host: "https://{{ awx_host }}"
-    tower_oauthtoken: "{{ awx_session_token.ansible_facts.tower_token.token }}"
-    validate_certs: true

roles/matrix-awx/tasks/set_variables_jitsi.yml

@@ -1,45 +0,0 @@
----
-
-- name: Record Jitsi variables locally on AWX
-  delegate_to: 127.0.0.1
-  lineinfile:
-    path: '{{ awx_cached_matrix_vars }}'
-    regexp: "^#? *{{ item.key | regex_escape() }}:"
-    line: "{{ item.key }}: {{ item.value }}"
-    insertafter: '# Jitsi Settings Start'
-  with_dict:
-    'matrix_jitsi_enabled': '{{ matrix_jitsi_enabled }}'
-    'matrix_jitsi_web_config_defaultLanguage': '{{ matrix_jitsi_web_config_defaultLanguage | trim }}'
-
-- name: Save new 'Configure Jitsi' survey.json to the AWX tower, template
-  delegate_to: 127.0.0.1
-  template:
-    src: 'roles/matrix-awx/surveys/configure_jitsi.json.j2'
-    dest: '/var/lib/awx/projects/clients/{{ member_id }}/{{ subscription_id }}/configure_jitsi.json'
-
-- name: Copy new 'Configure Jitsi' survey.json to target machine
-  copy:
-    src: '/var/lib/awx/projects/clients/{{ member_id }}/{{ subscription_id }}/configure_jitsi.json'
-    dest: '/matrix/awx/configure_jitsi.json'
-    mode: '0660'
-
-- name: Recreate 'Configure Jitsi' job template
-  delegate_to: 127.0.0.1
-  awx.awx.tower_job_template:
-    name: "{{ matrix_domain }} - 1 - Configure Jitsi"
-    description: "Configure Jitsi conferencing settings."
-    extra_vars: "{{ lookup('file', '/var/lib/awx/projects/clients/{{ member_id }}/{{ subscription_id }}/extra_vars.json') }}"
-    job_type: run
-    job_tags: "start,setup-jitsi"
-    inventory: "{{ member_id }}"
-    project: "{{ member_id }} - Matrix Docker Ansible Deploy"
-    playbook: setup.yml
-    credential: "{{ member_id }} - AWX SSH Key"
-    survey_enabled: true
-    survey_spec: "{{ lookup('file', '/var/lib/awx/projects/clients/{{ member_id }}/{{ subscription_id }}/configure_jitsi.json') }}"
-    become_enabled: true
-    state: present
-    verbosity: 1
-    tower_host: "https://{{ awx_host }}"
-    tower_oauthtoken: "{{ awx_session_token.ansible_facts.tower_token.token }}"
-    validate_certs: true

roles/matrix-awx/tasks/set_variables_ma1sd.yml

@@ -1,102 +0,0 @@
----
-
-- name: Record ma1sd variables locally on AWX
-  delegate_to: 127.0.0.1
-  lineinfile:
-    path: '{{ awx_cached_matrix_vars }}'
-    regexp: "^#? *{{ item.key | regex_escape() }}:"
-    line: "{{ item.key }}: {{ item.value }}"
-    insertafter: '# ma1sd Settings Start'
-  with_dict:
-    'matrix_ma1sd_enabled': '{{ matrix_ma1sd_enabled }}'
-
-- name: Disable REST auth (matrix-corporal/ma1sd) if using internal auth
-  delegate_to: 127.0.0.1
-  lineinfile:
-    path: '{{ awx_cached_matrix_vars }}'
-    regexp: "^#? *{{ item.key | regex_escape() }}:"
-    line: "{{ item.key }}: {{ item.value }}"
-    insertafter: '# Synapse Extension Start'
-  with_dict:
-    'matrix_synapse_awx_password_provider_rest_auth_enabled': 'false'
-  when: awx_matrix_ma1sd_auth_store == 'Synapse Internal'
-
-- name: Enable REST auth if using external LDAP/AD with ma1sd
-  delegate_to: 127.0.0.1
-  lineinfile:
-    path: '{{ awx_cached_matrix_vars }}'
-    regexp: "^#? *{{ item.key | regex_escape() }}:"
-    line: "{{ item.key }}: {{ item.value }}"
-    insertafter: '# Synapse Extension Start'
-  with_dict:
-    'matrix_synapse_awx_password_provider_rest_auth_enabled': 'true'
-    'matrix_synapse_awx_password_provider_rest_auth_endpoint': '"http://matrix-ma1sd:{{ matrix_ma1sd_container_port }}"'
-  when: awx_matrix_ma1sd_auth_store == 'LDAP/AD'
-
-- name: Remove entire ma1sd configuration extension
-  delegate_to: 127.0.0.1
-  replace:
-    path: '{{ awx_cached_matrix_vars }}'
-    regexp: '^.*\n'
-    after: '# Start ma1sd Extension'
-    before: '# End ma1sd Extension'
-
-- name: Replace conjoined ma1sd configuration extension limiters
-  delegate_to: 127.0.0.1
-  replace:
-    path: '{{ awx_cached_matrix_vars }}'
-    regexp: '^# Start ma1sd Extension# End ma1sd Extension'
-    replace: '# Start ma1sd Extension\n# End ma1sd Extension'
-
-- name: Insert/Update ma1sd configuration extension variables
-  delegate_to: 127.0.0.1
-  blockinfile:
-    path: '{{ awx_cached_matrix_vars }}'
-    marker: "# {mark} ma1sd ANSIBLE MANAGED BLOCK"
-    insertafter: '# Start ma1sd Extension'
-    block: '{{ awx_matrix_ma1sd_configuration_extension_yaml }}'
-
-- name: Record ma1sd Custom variables locally on AWX
-  delegate_to: 127.0.0.1
-  lineinfile:
-    path: '{{ awx_cached_matrix_vars }}'
-    regexp: "^#? *{{ item.key | regex_escape() }}:"
-    line: "{{ item.key }}: {{ item.value }}"
-    insertbefore: '# ma1sd Settings End'
-  with_dict:
-    'awx_matrix_ma1sd_auth_store': '{{ awx_matrix_ma1sd_auth_store }}'
-    'awx_matrix_ma1sd_configuration_extension_yaml': '{{ awx_matrix_ma1sd_configuration_extension_yaml.splitlines() | to_json }}'
-  no_log: true
-
-- name: Save new 'Configure ma1sd' survey.json to the AWX tower, template
-  delegate_to: 127.0.0.1
-  template:
-    src: 'roles/matrix-awx/surveys/configure_ma1sd.json.j2'
-    dest: '/var/lib/awx/projects/clients/{{ member_id }}/{{ subscription_id }}/configure_ma1sd.json'
-
-- name: Copy new 'Configure ma1sd' survey.json to target machine
-  copy:
-    src: '/var/lib/awx/projects/clients/{{ member_id }}/{{ subscription_id }}/configure_ma1sd.json'
-    dest: '/matrix/awx/configure_ma1sd.json'
-    mode: '0660'
-
-- name: Recreate 'Configure ma1sd (Advanced)' job template
-  delegate_to: 127.0.0.1
-  awx.awx.tower_job_template:
-    name: "{{ matrix_domain }} - 1 - Configure ma1sd (Advanced)"
-    description: "Configure Jitsi conferencing settings."
-    extra_vars: "{{ lookup('file', '/var/lib/awx/projects/clients/{{ member_id }}/{{ subscription_id }}/extra_vars.json') }}"
-    job_type: run
-    job_tags: "start,setup-ma1sd"
-    inventory: "{{ member_id }}"
-    project: "{{ member_id }} - Matrix Docker Ansible Deploy"
-    playbook: setup.yml
-    credential: "{{ member_id }} - AWX SSH Key"
-    survey_enabled: true
-    survey_spec: "{{ lookup('file', '/var/lib/awx/projects/clients/{{ member_id }}/{{ subscription_id }}/configure_ma1sd.json') }}"
-    become_enabled: true
-    state: present
-    verbosity: 1
-    tower_host: "https://{{ awx_host }}"
-    tower_oauthtoken: "{{ awx_session_token.ansible_facts.tower_token.token }}"
-    validate_certs: true

roles/matrix-awx/tasks/set_variables_mailer.yml

@@ -1,44 +0,0 @@
----
-
-- name: Record Mailer variables locally on AWX
-  delegate_to: 127.0.0.1
-  lineinfile:
-    path: '{{ awx_cached_matrix_vars }}'
-    regexp: "^#? *{{ item.key | regex_escape() }}:"
-    line: "{{ item.key }}: {{ item.value }}"
-    insertafter: '# Email Settings Start'
-  with_dict:
-    'matrix_mailer_relay_use': '{{ matrix_mailer_relay_use }}'
-
-- name: Save new 'Configure Email Relay' survey.json to the AWX tower, template
-  delegate_to: 127.0.0.1
-  template:
-    src: 'roles/matrix-awx/surveys/configure_email_relay.json.j2'
-    dest: '/var/lib/awx/projects/clients/{{ member_id }}/{{ subscription_id }}/configure_email_relay.json'
-
-- name: Copy new 'Configure Email Relay' survey.json to target machine
-  copy:
-    src: '/var/lib/awx/projects/clients/{{ member_id }}/{{ subscription_id }}/configure_email_relay.json'
-    dest: '/matrix/awx/configure_email_relay.json'
-    mode: '0660'
-
-- name: Recreate 'Configure Email Relay' job template
-  delegate_to: 127.0.0.1
-  awx.awx.tower_job_template:
-    name: "{{ matrix_domain }} - 1 - Configure Email Relay"
-    description: "Enable MailGun relay to increase verification email reliability."
-    extra_vars: "{{ lookup('file', '/var/lib/awx/projects/clients/{{ member_id }}/{{ subscription_id }}/extra_vars.json') }}"
-    job_type: run
-    job_tags: "start,setup-mailer"
-    inventory: "{{ member_id }}"
-    project: "{{ member_id }} - Matrix Docker Ansible Deploy"
-    playbook: setup.yml
-    credential: "{{ member_id }} - AWX SSH Key"
-    survey_enabled: true
-    survey_spec: "{{ lookup('file', '/var/lib/awx/projects/clients/{{ member_id }}/{{ subscription_id }}/configure_email_relay.json') }}"
-    become_enabled: true
-    state: present
-    verbosity: 1
-    tower_host: "https://{{ awx_host }}"
-    tower_oauthtoken: "{{ awx_session_token.ansible_facts.tower_token.token }}"
-    validate_certs: true

roles/matrix-awx/tasks/set_variables_synapse.yml

@@ -1,223 +0,0 @@
----
-
-- name: Limit max upload size to 200MB part 1
-  set_fact:
-    matrix_synapse_max_upload_size_mb: "200"
-  when: awx_synapse_max_upload_size_mb | int >= 200
-
-- name: Limit max upload size to 200MB part 2
-  set_fact:
-    matrix_synapse_max_upload_size_mb: "{{ awx_synapse_max_upload_size_mb }}"
-  when: awx_synapse_max_upload_size_mb | int < 200
-
-- name: Record Synapse variables locally on AWX
-  delegate_to: 127.0.0.1
-  lineinfile:
-    path: '{{ awx_cached_matrix_vars }}'
-    regexp: "^#? *{{ item.key | regex_escape() }}:"
-    line: "{{ item.key }}: {{ item.value }}"
-    insertafter: '# Synapse Settings Start'
-  with_dict:
-    'matrix_synapse_allow_public_rooms_over_federation': '{{ matrix_synapse_allow_public_rooms_over_federation }}'
-    'matrix_synapse_enable_registration': '{{ matrix_synapse_enable_registration }}'
-    'matrix_synapse_federation_enabled': '{{ matrix_synapse_federation_enabled }}'
-    'matrix_synapse_enable_group_creation': '{{ matrix_synapse_enable_group_creation }}'
-    'matrix_synapse_presence_enabled': '{{ matrix_synapse_presence_enabled }}'
-    'matrix_synapse_max_upload_size_mb': '{{ matrix_synapse_max_upload_size_mb }}'
-    'matrix_synapse_url_preview_enabled': '{{ matrix_synapse_url_preview_enabled }}'
-    'matrix_synapse_allow_guest_access': '{{ matrix_synapse_allow_guest_access }}'
-
-- name: Empty Synapse variable 'matrix_synapse_auto_join_rooms' locally on AWX, if raw inputs empty
-  delegate_to: 127.0.0.1
-  replace:
-    path: '{{ awx_cached_matrix_vars }}'
-    regexp: "^matrix_synapse_auto_join_rooms: .*$"
-    replace: "matrix_synapse_auto_join_rooms: []"
-  when: awx_synapse_auto_join_rooms | length == 0
-
-- name: If the raw inputs is not empty start constructing parsed auto_join_rooms list
-  set_fact:
-    awx_synapse_auto_join_rooms_array: |-
-      {{ awx_synapse_auto_join_rooms.splitlines() | to_json }}
-  when: awx_synapse_auto_join_rooms | length > 0
-
-- name: Record Synapse variable 'matrix_synapse_auto_join_rooms' locally on AWX, if it's not blank
-  delegate_to: 127.0.0.1
-  lineinfile:
-    path: '{{ awx_cached_matrix_vars }}'
-    regexp: "^#? *{{ item.key | regex_escape() }}:"
-    line: "{{ item.key }}: {{ item.value }}"
-    insertafter: '# Synapse Settings Start'
-  with_dict:
-    "matrix_synapse_auto_join_rooms": "{{ awx_synapse_auto_join_rooms_array }}"
-  when: awx_synapse_auto_join_rooms | length > 0
-
-- name: Record Synapse Shared Secret if it's defined
-  delegate_to: 127.0.0.1
-  lineinfile:
-    path: '{{ awx_cached_matrix_vars }}'
-    regexp: "^#? *{{ item.key | regex_escape() }}:"
-    line: "{{ item.key }}: {{ item.value }}"
-    insertafter: '# Synapse Settings Start'
-  with_dict:
-    'matrix_synapse_registration_shared_secret': '{{ awx_matrix_synapse_registration_shared_secret }}'
-  when: awx_matrix_synapse_registration_shared_secret | length > 0
-
-- name: Record registations_require_3pid extra variable if true
-  delegate_to: 127.0.0.1
-  lineinfile:
-    path: '{{ awx_cached_matrix_vars }}'
-    regexp: "{{ item }}"
-    line: "{{ item }}"
-    insertbefore: '# Synapse Extension End'
-  with_items:
-    - "  registrations_require_3pid:"
-    - "    - email"
-  when: awx_registrations_require_3pid | bool
-
-- name: Remove registrations_require_3pid extra variable if false
-  delegate_to: 127.0.0.1
-  lineinfile:
-    path: '{{ awx_cached_matrix_vars }}'
-    regexp: "{{ item }}"
-    line: "{{ item }}"
-    insertbefore: '# Synapse Extension End'
-    state: absent
-  with_items:
-    - "  registrations_require_3pid:"
-    - "    - email"
-  when: not awx_registrations_require_3pid | bool
-
-- name: Remove URL Languages
-  delegate_to: 127.0.0.1
-  replace:
-    path: '{{ awx_cached_matrix_vars }}'
-    regexp: '^(?!.*\bemail\b)    - [a-zA-Z\-]{2,5}\n'
-    after: '  url_preview_accept_language:'
-    before: '# Synapse Extension End'
-
-- name: Set URL languages default if raw inputs empty
-  set_fact:
-    awx_url_preview_accept_language_default: 'en'
-  when: awx_url_preview_accept_language | length == 0
-
-- name: Set URL languages default if raw inputs not empty
-  set_fact:
-    awx_url_preview_accept_language_default: "{{ awx_url_preview_accept_language }}"
-  when: awx_url_preview_accept_language|length > 0
-
-- name: Set URL languages if raw inputs empty
-  delegate_to: 127.0.0.1
-  lineinfile:
-    path: '{{ awx_cached_matrix_vars }}'
-    insertafter: '^  url_preview_accept_language:'
-    line: "    - {{ awx_url_preview_accept_language_default }}"
-  when: awx_url_preview_accept_language|length == 0
-
-- name: Set URL languages if raw inputs not empty
-  delegate_to: 127.0.0.1
-  lineinfile:
-    path: '{{ awx_cached_matrix_vars }}'
-    insertafter: '^  url_preview_accept_language:'
-    line: "    - {{ item }}"
-  with_items: "{{ awx_url_preview_accept_language.splitlines() }}"
-  when: awx_url_preview_accept_language | length > 0
-
-- name: Remove Federation Whitelisting 1
-  delegate_to: 127.0.0.1
-  replace:
-    path: '{{ awx_cached_matrix_vars }}'
-    regexp: '^    - [a-z0-9]+\.[a-z0-9.]+\n'
-    after: '  federation_domain_whitelist:'
-    before: '# Synapse Extension End'
-
-- name: Remove Federation Whitelisting 2
-  delegate_to: 127.0.0.1
-  lineinfile:
-    path: '{{ awx_cached_matrix_vars }}'
-    line: "  federation_domain_whitelist:"
-    state: absent
-
-- name: Set Federation Whitelisting 1
-  delegate_to: 127.0.0.1
-  lineinfile:
-    path: '{{ awx_cached_matrix_vars }}'
-    insertafter: '^matrix_synapse_configuration_extension_yaml: \|'
-    line: "  federation_domain_whitelist:"
-  when: awx_federation_whitelist | length > 0
-
-- name: Set Federation Whitelisting 2
-  delegate_to: 127.0.0.1
-  lineinfile:
-    path: '{{ awx_cached_matrix_vars }}'
-    insertafter: '^  federation_domain_whitelist:'
-    line: "    - {{ item }}"
-  with_items: "{{ awx_federation_whitelist.splitlines() }}"
-  when: awx_federation_whitelist | length > 0
-
-- name: Set awx_recaptcha_public_key to a 'public-key' if undefined
-  set_fact: awx_recaptcha_public_key="public-key"
-  when: (awx_recaptcha_public_key is not defined) or (awx_recaptcha_public_key|length == 0)
-
-- name: Set awx_recaptcha_private_key to a 'private-key' if undefined
-  set_fact: awx_recaptcha_private_key="private-key"
-  when: (awx_recaptcha_private_key is not defined) or (awx_recaptcha_private_key|length == 0)
-
-- name: Record Synapse Extension variables locally on AWX
-  delegate_to: 127.0.0.1
-  lineinfile:
-    path: '{{ awx_cached_matrix_vars }}'
-    regexp: "^#? *{{ item.key | regex_escape() }}:"
-    line: "{{ item.key }}: {{ item.value }}"
-    insertbefore: '# Synapse Extension End'
-  with_dict:
-    '  enable_registration_captcha': '{{ awx_enable_registration_captcha }}'
-    '  recaptcha_public_key': '{{ awx_recaptcha_public_key }}'
-    '  recaptcha_private_key': '{{ awx_recaptcha_private_key }}'
-
-- name: Record Synapse Custom variables locally on AWX
-  delegate_to: 127.0.0.1
-  lineinfile:
-    path: '{{ awx_cached_matrix_vars }}'
-    regexp: "^#? *{{ item.key | regex_escape() }}:"
-    line: "{{ item.key }}: {{ item.value }}"
-    insertbefore: '# Synapse Settings End'
-  with_dict:
-    'awx_federation_whitelist': '{{ awx_federation_whitelist.splitlines() | to_json }}'
-    'awx_url_preview_accept_language_default': '{{ awx_url_preview_accept_language_default.splitlines() | to_json }}'
-    'awx_enable_registration_captcha': '{{ awx_enable_registration_captcha }}'
-    'awx_recaptcha_public_key': '"{{ awx_recaptcha_public_key }}"'
-    'awx_recaptcha_private_key': '"{{ awx_recaptcha_private_key }}"'
-
-- name: Save new 'Configure Synapse' survey.json to the AWX tower, template
-  delegate_to: 127.0.0.1
-  template:
-    src: 'roles/matrix-awx/surveys/configure_synapse.json.j2'
-    dest: '/var/lib/awx/projects/clients/{{ member_id }}/{{ subscription_id }}//configure_synapse.json'
-
-- name: Copy new 'Configure Synapse' survey.json to target machine
-  copy:
-    src: '/var/lib/awx/projects/clients/{{ member_id }}/{{ subscription_id }}/configure_synapse.json'
-    dest: '/matrix/awx/configure_synapse.json'
-    mode: '0660'
-
-- name: Recreate 'Configure Synapse' job template
-  delegate_to: 127.0.0.1
-  awx.awx.tower_job_template:
-    name: "{{ matrix_domain }} - 1 - Configure Synapse"
-    description: "Configure Synapse (homeserver) settings."
-    extra_vars: "{{ lookup('file', '/var/lib/awx/projects/clients/{{ member_id }}/{{ subscription_id }}/extra_vars.json') }}"
-    job_type: run
-    job_tags: "start,setup-synapse"
-    inventory: "{{ member_id }}"
-    project: "{{ member_id }} - Matrix Docker Ansible Deploy"
-    playbook: setup.yml
-    credential: "{{ member_id }} - AWX SSH Key"
-    survey_enabled: true
-    survey_spec: "{{ lookup('file', '/var/lib/awx/projects/clients/{{ member_id }}/{{ subscription_id }}/configure_synapse.json') }}"
-    become_enabled: true
-    state: present
-    verbosity: 1
-    tower_host: "https://{{ awx_host }}"
-    tower_oauthtoken: "{{ awx_session_token.ansible_facts.tower_token.token }}"
-    validate_certs: true

roles/matrix-awx/tasks/set_variables_synapse_admin.yml

@@ -1,44 +0,0 @@
----
-
-- name: Record Synapse Admin variables locally on AWX
-  delegate_to: 127.0.0.1
-  lineinfile:
-    path: '{{ awx_cached_matrix_vars }}'
-    regexp: "^#? *{{ item.key | regex_escape() }}:"
-    line: "{{ item.key }}: {{ item.value }}"
-    insertafter: '# Synapse Admin Settings Start'
-  with_dict:
-    'matrix_synapse_admin_enabled': '{{ matrix_synapse_admin_enabled }}'
-
-- name: Save new 'Configure Synapse Admin' survey.json to the AWX tower, template
-  delegate_to: 127.0.0.1
-  template:
-    src: 'roles/matrix-awx/surveys/configure_synapse_admin.json.j2'
-    dest: '/var/lib/awx/projects/clients/{{ member_id }}/{{ subscription_id }}/configure_synapse_admin.json'
-
-- name: Copy new 'Configure Synapse Admin' survey.json to target machine
-  copy:
-    src: '/var/lib/awx/projects/clients/{{ member_id }}/{{ subscription_id }}/configure_synapse_admin.json'
-    dest: '/matrix/awx/configure_synapse_admin.json'
-    mode: '0660'
-
-- name: Recreate 'Configure Synapse Admin' job template
-  delegate_to: 127.0.0.1
-  awx.awx.tower_job_template:
-    name: "{{ matrix_domain }} - 1 - Configure Synapse Admin"
-    description: "Configure 'Synapse Admin', a moderation tool to help you manage your server."
-    extra_vars: "{{ lookup('file', '/var/lib/awx/projects/clients/{{ member_id }}/{{ subscription_id }}/extra_vars.json') }}"
-    job_type: run
-    job_tags: "start,setup-all"
-    inventory: "{{ member_id }}"
-    project: "{{ member_id }} - Matrix Docker Ansible Deploy"
-    playbook: setup.yml
-    credential: "{{ member_id }} - AWX SSH Key"
-    survey_enabled: true
-    survey_spec: "{{ lookup('file', '/var/lib/awx/projects/clients/{{ member_id }}/{{ subscription_id }}/configure_synapse_admin.json') }}"
-    become_enabled: true
-    state: present
-    verbosity: 1
-    tower_host: "https://{{ awx_host }}"
-    tower_oauthtoken: "{{ awx_session_token.ansible_facts.tower_token.token }}"
-    validate_certs: true

roles/matrix-awx/tasks/update_variables.yml

@@ -1,32 +0,0 @@
----
-
-- name: Rename synapse presence variable
-  delegate_to: 127.0.0.1
-  replace:
-    path: "/var/lib/awx/projects/clients/{{ member_id }}/{{ subscription_id }}/matrix_vars.yml"
-    regexp: 'matrix_synapse_use_presence'
-    replace: 'matrix_synapse_presence_enabled'
-
-- name: Search for matrix_homeserver_generic_secret_key variable in matrix_vars.yml
-  delegate_to: 127.0.0.1
-  register: presence
-  shell: "grep -i 'matrix_homeserver_generic_secret_key' /var/lib/awx/projects/clients/{{ member_id }}/{{ subscription_id }}/matrix_vars.yml"
-  no_log: true
-
-- name: Generate matrix_homeserver_generic_secret_key variable if not present
-  delegate_to: 127.0.0.1
-  command: |
-      openssl rand -hex 16
-  register: generic_secret
-  no_log: true
-  when: presence is not changed
-
-- name: Add new matrix_homeserver_generic_secret_key variable if not present
-  delegate_to: 127.0.0.1
-  lineinfile:
-    path: '/var/lib/awx/projects/clients/{{ member_id }}/{{ subscription_id }}/matrix_vars.yml'
-    line: "matrix_homeserver_generic_secret_key: {{ generic_secret.stdout }}"
-    insertbefore: '# Basic Settings End'
-    mode: '0600'
-    state: present
-  when: presence is not changed

roles/matrix-backup-borg/defaults/main.yml

@@ -0,0 +1,63 @@
+---
+matrix_backup_borg_enabled: true
+
+matrix_backup_borg_container_image_self_build: false
+matrix_backup_borg_docker_repo: "https://github.com/borgmatic-collective/docker-borgmatic"
+matrix_backup_borg_docker_src_files_path: "{{ matrix_base_data_path }}/borg/docker-src"
+
+matrix_backup_borg_version: latest
+matrix_backup_borg_docker_image: "{{ matrix_backup_borg_docker_image_name_prefix }}etke.cc/borgmatic:{{ matrix_backup_borg_version }}"
+matrix_backup_borg_docker_image_name_prefix: "{{ 'localhost/' if matrix_backup_borg_container_image_self_build else 'registry.gitlab.com/' }}"
+matrix_backup_borg_docker_image_force_pull: "{{ matrix_backup_borg_docker_image.endswith(':latest') }}"
+
+matrix_backup_borg_base_path: "{{ matrix_base_data_path }}/backup-borg"
+matrix_backup_borg_config_path: "{{ matrix_backup_borg_base_path }}/config"
+
+# A list of extra arguments to pass to the container
+matrix_backup_borg_container_extra_arguments: []
+
+# List of systemd services that matrix-backup-borg.service depends on
+matrix_backup_borg_systemd_required_services_list: ['docker.service']
+
+# List of systemd services that matrix-backup-borg.service wants
+matrix_backup_borg_systemd_wanted_services_list: []
+
+# systemd calendar configuration for backup job
+matrix_backup_borg_schedule: "*-*-* 04:00:00"
+
+# what directories should be added to backup
+matrix_backup_borg_location_source_directories: []
+
+# target repositories
+matrix_backup_borg_location_repositories: []
+
+# exclude following paths:
+matrix_backup_borg_location_exclude_patterns: []
+
+# borg encryption mode, only repokey-* is supported
+matrix_backup_borg_encryption: repokey-blake2
+
+# private ssh key used to connect to the borg repo
+matrix_backup_borg_ssh_key_private: ""
+
+# borg ssh command with ssh key
+matrix_backup_borg_storage_ssh_command: ssh -o "StrictHostKeyChecking accept-new" -i /etc/borgmatic.d/sshkey
+
+# compression algorithm
+matrix_backup_borg_storage_compression: lz4
+
+# archive name format
+matrix_backup_borg_storage_archive_name_format: "matrix-{now:%Y-%m-%d-%H%M%S}"
+
+# repository passphrase
+matrix_backup_borg_storage_encryption_passphrase: ""
+
+# retention configuration
+matrix_backup_borg_retention_keep_hourly: 0
+matrix_backup_borg_retention_keep_daily: 7
+matrix_backup_borg_retention_keep_weekly: 4
+matrix_backup_borg_retention_keep_monthly: 12
+matrix_backup_borg_retention_keep_yearly: 2
+
+# retention prefix
+matrix_backup_borg_retention_prefix: "matrix-"

roles/matrix-backup-borg/tasks/init.yml

@@ -0,0 +1,4 @@
+---
+- set_fact:
+    matrix_systemd_services_list: "{{ matrix_systemd_services_list + ['matrix-backup-borg.service', 'matrix-backup-borg.timer'] }}"
+  when: matrix_backup_borg_enabled|bool

roles/matrix-backup-borg/tasks/main.yml

@@ -0,0 +1,23 @@
+---
+
+- import_tasks: "{{ role_path }}/tasks/init.yml"
+  tags:
+    - always
+
+- import_tasks: "{{ role_path }}/tasks/validate_config.yml"
+  when: "run_setup|bool and matrix_backup_borg_enabled|bool"
+  tags:
+    - setup-all
+    - setup-backup-borg
+
+- import_tasks: "{{ role_path }}/tasks/setup_install.yml"
+  when: "run_setup|bool and matrix_backup_borg_enabled|bool"
+  tags:
+    - setup-all
+    - setup-backup-borg
+
+- import_tasks: "{{ role_path }}/tasks/setup_uninstall.yml"
+  when: "run_setup|bool and not matrix_backup_borg_enabled|bool"
+  tags:
+    - setup-all
+    - setup-backup-borg

roles/matrix-backup-borg/tasks/setup_install.yml

@@ -0,0 +1,99 @@
+---
+- name: Ensure borg paths exist
+  file:
+    path: "{{ item.path }}"
+    state: directory
+    mode: 0750
+    owner: "{{ matrix_user_username }}"
+    group: "{{ matrix_user_groupname }}"
+  with_items:
+    - {path: "{{ matrix_backup_borg_config_path }}", when: true}
+    - {path: "{{ matrix_backup_borg_docker_src_files_path }}", when: true}
+  when: "item.when|bool"
+
+- name: Ensure borg config is created
+  template:
+    src: "{{ role_path }}/templates/config.yaml.j2"
+    dest: "{{ matrix_backup_borg_config_path }}/config.yaml"
+    owner: "{{ matrix_user_username }}"
+    group: "{{ matrix_user_groupname }}"
+    mode: 0640
+
+- name: Ensure borg passwd is created
+  template:
+    src: "{{ role_path }}/templates/passwd.j2"
+    dest: "{{ matrix_backup_borg_config_path }}/passwd"
+    owner: "{{ matrix_user_username }}"
+    group: "{{ matrix_user_groupname }}"
+    mode: 0640
+
+- name: Ensure borg ssh key is created
+  template:
+    src: "{{ role_path }}/templates/sshkey.j2"
+    dest: "{{ matrix_backup_borg_config_path }}/sshkey"
+    owner: "{{ matrix_user_username }}"
+    group: "{{ matrix_user_groupname }}"
+    mode: 0600
+
+- name: Ensure borg image is pulled
+  docker_image:
+    name: "{{ matrix_backup_borg_docker_image }}"
+    source: "{{ 'pull' if ansible_version.major > 2 or ansible_version.minor > 7 else omit }}"
+    force_source: "{{ matrix_backup_borg_docker_image_force_pull if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}"
+    force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else matrix_backup_borg_docker_image_force_pull }}"
+  when: "not matrix_backup_borg_container_image_self_build|bool"
+  register: result
+  retries: "{{ matrix_container_retries_count }}"
+  delay: "{{ matrix_container_retries_delay }}"
+  until: result is not failed
+
+- name: Ensure borg repository is present on self-build
+  git:
+    repo: "{{ matrix_backup_borg_docker_repo }}"
+    dest: "{{ matrix_backup_borg_docker_src_files_path }}"
+    force: "yes"
+  become: true
+  become_user: "{{ matrix_user_username }}"
+  register: matrix_backup_borg_git_pull_results
+  when: "matrix_backup_borg_container_image_self_build|bool"
+
+- name: Ensure borg image is built
+  docker_image:
+    name: "{{ matrix_backup_borg_docker_image }}"
+    source: build
+    force_source: "{{ matrix_backup_borg_git_pull_results.changed if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}"
+    force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else matrix_mailer_git_pull_results.changed }}"
+    build:
+      dockerfile: Dockerfile
+      path: "{{ matrix_backup_borg_docker_src_files_path }}"
+      pull: true
+  when: "matrix_backup_borg_container_image_self_build|bool"
+
+- name: Ensure matrix-backup-borg.service installed
+  template:
+    src: "{{ role_path }}/templates/systemd/matrix-backup-borg.service.j2"
+    dest: "{{ matrix_systemd_path }}/matrix-backup-borg.service"
+    mode: 0644
+  register: matrix_backup_borg_systemd_service_result
+
+- name: Ensure matrix-backup-borg.timer installed
+  template:
+    src: "{{ role_path }}/templates/systemd/matrix-backup-borg.timer.j2"
+    dest: "{{ matrix_systemd_path }}/matrix-backup-borg.timer"
+    mode: 0644
+  register: matrix_backup_borg_systemd_timer_result
+
+- name: Ensure systemd reloaded after matrix-backup-borg.service installation
+  service:
+    daemon_reload: true
+  when: "matrix_backup_borg_systemd_service_result.changed|bool"
+
+- name: Ensure matrix-backup-borg.service enabled
+  service:
+    enabled: true
+    name: matrix-backup-borg.service
+
+- name: Ensure matrix-backup-borg.timer enabled
+  service:
+    enabled: true
+    name: matrix-backup-borg.timer

roles/matrix-backup-borg/tasks/setup_uninstall.yml

@@ -0,0 +1,41 @@
+---
+- name: Check existence of matrix-backup-borg service
+  stat:
+    path: "{{ matrix_systemd_path }}/matrix-backup-borg.service"
+  register: matrix_backup_borg_service_stat
+
+- name: Ensure matrix-backup-borg is stopped
+  service:
+    name: matrix-backup-borg
+    state: stopped
+    enabled: false
+    daemon_reload: true
+  register: stopping_result
+  when: "matrix_backup_borg_service_stat.stat.exists|bool"
+
+- name: Ensure matrix-backup-borg.service doesn't exist
+  file:
+    path: "{{ matrix_systemd_path }}/matrix-backup-borg.service"
+    state: absent
+  when: "matrix_backup_borg_service_stat.stat.exists|bool"
+
+- name: Ensure matrix-backup-borg.timer doesn't exist
+  file:
+    path: "{{ matrix_systemd_path }}/matrix-backup-borg.timer"
+    state: absent
+  when: "matrix_backup_borg_service_stat.stat.exists|bool"
+
+- name: Ensure systemd reloaded after matrix-backup-borg.service removal
+  service:
+    daemon_reload: true
+  when: "matrix_backup_borg_service_stat.stat.exists|bool"
+
+- name: Ensure Matrix borg paths don't exist
+  file:
+    path: "{{ matrix_backup_borg_base_path }}"
+    state: absent
+
+- name: Ensure borg Docker image doesn't exist
+  docker_image:
+    name: "{{ matrix_backup_borg_docker_image }}"
+    state: absent

roles/matrix-backup-borg/tasks/validate_config.yml

@@ -0,0 +1,10 @@
+---
+- name: Fail if required settings not defined
+  fail:
+    msg: >-
+      You need to define a required configuration setting (`{{ item }}`).
+  when: "vars[item] == ''"
+  with_items:
+    - "matrix_backup_borg_ssh_key_private"
+    - "matrix_backup_borg_location_repositories"
+    - "matrix_backup_borg_storage_encryption_passphrase"

roles/matrix-backup-borg/templates/config.yaml.j2

@@ -0,0 +1,32 @@
+#jinja2: lstrip_blocks: "True", trim_blocks: "True"
+
+location:
+  source_directories: {{ matrix_backup_borg_location_source_directories|to_json }}
+  repositories: {{ matrix_backup_borg_location_repositories|to_json }}
+  one_file_system: true
+  exclude_patterns: {{ matrix_backup_borg_location_exclude_patterns|to_json }}
+
+storage:
+  compression: {{ matrix_backup_borg_storage_compression }}
+  ssh_command: {{ matrix_backup_borg_storage_ssh_command }}
+  archive_name_format: '{{ matrix_backup_borg_storage_archive_name_format }}'
+  encryption_passphrase: {{ matrix_backup_borg_storage_encryption_passphrase }}
+
+retention:
+  keep_hourly: {{ matrix_backup_borg_retention_keep_hourly }}
+  keep_daily: {{ matrix_backup_borg_retention_keep_daily }}
+  keep_weekly: {{ matrix_backup_borg_retention_keep_weekly }}
+  keep_monthly: {{ matrix_backup_borg_retention_keep_monthly }}
+  keep_yearly: {{ matrix_backup_borg_retention_keep_yearly }}
+  prefix: '{{ matrix_backup_borg_retention_prefix }}'
+
+consistency:
+  checks:
+    - repository
+    - archives
+
+hooks:
+  after_backup:
+    - echo "Backup created."
+  on_error:
+    - echo "Error while creating a backup."

roles/matrix-backup-borg/templates/passwd.j2

@@ -0,0 +1,29 @@
+{# the passwd file with correct username, UID and GID is mandatory to work with borg over ssh, otherwise ssh connections will fail #}
+root:x:0:0:root:/root:/bin/ash
+bin:x:1:1:bin:/bin:/sbin/nologin
+daemon:x:2:2:daemon:/sbin:/sbin/nologin
+adm:x:3:4:adm:/var/adm:/sbin/nologin
+lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
+sync:x:5:0:sync:/sbin:/bin/sync
+shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
+halt:x:7:0:halt:/sbin:/sbin/halt
+mail:x:8:12:mail:/var/mail:/sbin/nologin
+news:x:9:13:news:/usr/lib/news:/sbin/nologin
+uucp:x:10:14:uucp:/var/spool/uucppublic:/sbin/nologin
+operator:x:11:0:operator:/root:/sbin/nologin
+man:x:13:15:man:/usr/man:/sbin/nologin
+postmaster:x:14:12:postmaster:/var/mail:/sbin/nologin
+cron:x:16:16:cron:/var/spool/cron:/sbin/nologin
+ftp:x:21:21::/var/lib/ftp:/sbin/nologin
+sshd:x:22:22:sshd:/dev/null:/sbin/nologin
+at:x:25:25:at:/var/spool/cron/atjobs:/sbin/nologin
+squid:x:31:31:Squid:/var/cache/squid:/sbin/nologin
+xfs:x:33:33:X Font Server:/etc/X11/fs:/sbin/nologin
+games:x:35:35:games:/usr/games:/sbin/nologin
+cyrus:x:85:12::/usr/cyrus:/sbin/nologin
+vpopmail:x:89:89::/var/vpopmail:/sbin/nologin
+ntp:x:123:123:NTP:/var/empty:/sbin/nologin
+smmsp:x:209:209:smmsp:/var/spool/mqueue:/sbin/nologin
+guest:x:405:100:guest:/dev/null:/sbin/nologin
+{{ matrix_user_username }}:x:{{ matrix_user_uid }}:{{ matrix_user_gid }}:Matrix:/tmp:/bin/ash
+nobody:x:65534:65534:nobody:/:/sbin/nologin

roles/matrix-backup-borg/templates/sshkey.j2

@@ -0,0 +1 @@
+{{ matrix_backup_borg_ssh_key_private }}

roles/matrix-backup-borg/templates/systemd/matrix-backup-borg.service.j2

@@ -0,0 +1,58 @@
+#jinja2: lstrip_blocks: "True"
+[Unit]
+Description=Matrix Borg Backup
+{% for service in matrix_backup_borg_systemd_required_services_list %}
+Requires={{ service }}
+After={{ service }}
+{% endfor %}
+{% for service in matrix_backup_borg_systemd_wanted_services_list %}
+Wants={{ service }}
+{% endfor %}
+DefaultDependencies=no
+
+[Service]
+Type=oneshot
+Environment="HOME={{ matrix_systemd_unit_home_path }}"
+ExecStartPre=-{{ matrix_host_command_sh }} -c '{{ matrix_host_command_docker }} kill matrix-backup-borg 2>/dev/null || true'
+ExecStartPre=-{{ matrix_host_command_sh }} -c '{{ matrix_host_command_docker }} rm matrix-backup-borg 2>/dev/null || true'
+ExecStartPre=-{{ matrix_host_command_docker }} run --rm --name matrix-backup-borg \
+			--log-driver=none \
+			--cap-drop=ALL \
+			--read-only \
+			--user={{ matrix_user_uid }}:{{ matrix_user_gid }} \
+			--network={{ matrix_docker_network }} \
+			--tmpfs=/tmp:rw,noexec,nosuid,size=100m \
+			--mount type=bind,src={{ matrix_backup_borg_config_path }}/passwd,dst=/etc/passwd,ro \
+			--mount type=bind,src={{ matrix_backup_borg_config_path }},dst=/etc/borgmatic.d,ro \
+			{% for source in matrix_backup_borg_location_source_directories %}
+			--mount type=bind,src={{ source }},dst={{ source }},ro \
+			{% endfor %}
+			{% for arg in matrix_backup_borg_container_extra_arguments %}
+			{{ arg }} \
+			{% endfor %}
+			{{ matrix_backup_borg_docker_image }} \
+			sh -c "borgmatic --init --encryption {{ matrix_backup_borg_encryption }}"
+
+ExecStart={{ matrix_host_command_docker }} run --rm --name matrix-backup-borg \
+			--log-driver=none \
+			--cap-drop=ALL \
+			--read-only \
+			--user={{ matrix_user_uid }}:{{ matrix_user_gid }} \
+			--network={{ matrix_docker_network }} \
+			--tmpfs=/tmp:rw,noexec,nosuid,size=100m \
+			--mount type=bind,src={{ matrix_backup_borg_config_path }}/passwd,dst=/etc/passwd,ro \
+			--mount type=bind,src={{ matrix_backup_borg_config_path }},dst=/etc/borgmatic.d,ro \
+			{% for source in matrix_backup_borg_location_source_directories %}
+			--mount type=bind,src={{ source }},dst={{ source }},ro \
+			{% endfor %}
+			{% for arg in matrix_backup_borg_container_extra_arguments %}
+			{{ arg }} \
+			{% endfor %}
+			{{ matrix_backup_borg_docker_image }}
+
+ExecStop=-{{ matrix_host_command_sh }} -c '{{ matrix_host_command_docker }} kill matrix-backup-borg 2>/dev/null || true'
+ExecStop=-{{ matrix_host_command_sh }} -c '{{ matrix_host_command_docker }} rm matrix-backup-borg 2>/dev/null || true'
+SyslogIdentifier=matrix-backup-borg
+
+[Install]
+WantedBy=multi-user.target

roles/matrix-backup-borg/templates/systemd/matrix-backup-borg.timer.j2

@@ -0,0 +1,10 @@
+[Unit]
+Description=Matrix Borg Backup timer
+
+[Timer]
+Unit=matrix-backup-borg.service
+OnCalendar={{ matrix_backup_borg_schedule }}
+RandomizedDelaySec=2h
+
+[Install]
+WantedBy=timers.target

roles/matrix-base/defaults/main.yml

@@ -65,6 +65,12 @@ matrix_architecture: amd64
 # We just remap from our `matrix_architecture` values to what Debian and possibly other distros call things.
 matrix_debian_arch: "{{ 'armhf' if matrix_architecture == 'arm32' else matrix_architecture }}"
 
+matrix_container_global_registry_prefix: "docker.io/"
+
+# Each docker pull will retry on failed attempt 10 times with delay of 10 seconds between each attempt.
+matrix_container_retries_count: 10
+matrix_container_retries_delay: 10
+
 matrix_user_username: "matrix"
 matrix_user_groupname: "matrix"
 

roles/matrix-bot-go-neb/tasks/setup_install.yml

@@ -22,10 +22,14 @@
     source: "{{ 'pull' if ansible_version.major > 2 or ansible_version.minor > 7 else omit }}"
     force_source: "{{ matrix_bot_go_neb_docker_image_force_pull if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}"
     force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else matrix_bot_go_neb_docker_image_force_pull }}"
+  register: result
+  retries: "{{ matrix_container_retries_count }}"
+  delay: "{{ matrix_container_retries_delay }}"
+  until: result is not failed
 
 - name: Ensure go-neb config installed
   copy:
-    content: "{{ matrix_bot_go_neb_configuration|to_nice_yaml }}"
+    content: "{{ matrix_bot_go_neb_configuration|to_nice_yaml(indent=2, width=999999) }}"
     dest: "{{ matrix_bot_go_neb_config_path }}/config.yaml"
     mode: 0644
     owner: "{{ matrix_user_username }}"

roles/matrix-bot-go-neb/templates/systemd/matrix-bot-go-neb.service.j2

@@ -13,8 +13,8 @@ DefaultDependencies=no
 [Service]
 Type=simple
 Environment="HOME={{ matrix_systemd_unit_home_path }}"
-ExecStartPre=-{{ matrix_host_command_sh }} -c '{{ matrix_host_command_docker }} kill matrix-bot-go-neb 2>/dev/null'
+ExecStartPre=-{{ matrix_host_command_sh }} -c '{{ matrix_host_command_docker }} kill matrix-bot-go-neb 2>/dev/null || true'
-ExecStartPre=-{{ matrix_host_command_sh }} -c '{{ matrix_host_command_docker }} rm matrix-bot-go-neb 2>/dev/null'
+ExecStartPre=-{{ matrix_host_command_sh }} -c '{{ matrix_host_command_docker }} rm matrix-bot-go-neb 2>/dev/null || true'
 
 ExecStart={{ matrix_host_command_docker }} run --rm --name matrix-bot-go-neb \
 			--log-driver=none \
@@ -39,8 +39,8 @@ ExecStart={{ matrix_host_command_docker }} run --rm --name matrix-bot-go-neb \
 			{{ matrix_bot_go_neb_docker_image }} \
 			-c "go-neb /config/config.yaml"
 
-ExecStop=-{{ matrix_host_command_sh }} -c '{{ matrix_host_command_docker }} kill matrix-bot-go-neb 2>/dev/null'
+ExecStop=-{{ matrix_host_command_sh }} -c '{{ matrix_host_command_docker }} kill matrix-bot-go-neb 2>/dev/null || true'
-ExecStop=-{{ matrix_host_command_sh }} -c '{{ matrix_host_command_docker }} rm matrix-bot-go-neb 2>/dev/null'
+ExecStop=-{{ matrix_host_command_sh }} -c '{{ matrix_host_command_docker }} rm matrix-bot-go-neb 2>/dev/null || true'
 Restart=always
 RestartSec=30
 SyslogIdentifier=matrix-bot-go-neb

roles/matrix-bot-honoroit/defaults/main.yml

@@ -8,7 +8,7 @@ matrix_bot_honoroit_container_image_self_build: false
 matrix_bot_honoroit_docker_repo: "https://gitlab.com/etke.cc/honoroit.git"
 matrix_bot_honoroit_docker_src_files_path: "{{ matrix_base_data_path }}/honoroit/docker-src"
 
-matrix_bot_honoroit_version: v0.9.4
+matrix_bot_honoroit_version: v0.9.6
 matrix_bot_honoroit_docker_image: "{{ matrix_bot_honoroit_docker_image_name_prefix }}honoroit:{{ matrix_bot_honoroit_version }}"
 matrix_bot_honoroit_docker_image_name_prefix: "{{ 'localhost/' if matrix_bot_honoroit_container_image_self_build else 'registry.gitlab.com/etke.cc/' }}"
 matrix_bot_honoroit_docker_image_force_pull: "{{ matrix_bot_honoroit_docker_image.endswith(':latest') }}"
@@ -84,6 +84,9 @@ matrix_bot_honoroit_sentry: ''
 # Log level
 matrix_bot_honoroit_loglevel: ''
 
+# Max items in cache
+matrix_bot_honoroit_cachesize: ''
+
 # Text prefix: open
 matrix_bot_honoroit_text_prefix_open: ''
 

roles/matrix-bot-honoroit/tasks/setup_install.yml

@@ -43,6 +43,8 @@
   template:
     src: "{{ role_path }}/templates/env.j2"
     dest: "{{ matrix_bot_honoroit_config_path }}/env"
+    owner: "{{ matrix_user_username }}"
+    group: "{{ matrix_user_groupname }}"
     mode: 0640
 
 - name: Ensure honoroit image is pulled
@@ -52,12 +54,18 @@
     force_source: "{{ matrix_bot_honoroit_docker_image_force_pull if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}"
     force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else matrix_bot_honoroit_docker_image_force_pull }}"
   when: "not matrix_bot_honoroit_container_image_self_build|bool"
+  register: result
+  retries: "{{ matrix_container_retries_count }}"
+  delay: "{{ matrix_container_retries_delay }}"
+  until: result is not failed
 
 - name: Ensure honoroit repository is present on self-build
   git:
     repo: "{{ matrix_bot_honoroit_docker_repo }}"
     dest: "{{ matrix_bot_honoroit_docker_src_files_path }}"
     force: "yes"
+  become: true
+  become_user: "{{ matrix_user_username }}"
   register: matrix_bot_honoroit_git_pull_results
   when: "matrix_bot_honoroit_container_image_self_build|bool"
 

roles/matrix-bot-honoroit/templates/env.j2

@@ -7,6 +7,7 @@ HONOROIT_DB_DIALECT={{ matrix_bot_honoroit_database_dialect }}
 HONOROIT_PREFIX={{ matrix_bot_honoroit_prefix }}
 HONOROIT_SENTRY={{ matrix_bot_honoroit_sentry }}
 HONOROIT_LOGLEVEL={{ matrix_bot_honoroit_loglevel }}
+HONOROIT_CACHESIZE={{ matrix_bot_honoroit_cachesize }}
 HONOROIT_TEXT_PREFIX_OPEN={{ matrix_bot_honoroit_text_prefix_open }}
 HONOROIT_TEXT_PREFIX_DONE={{ matrix_bot_honoroit_text_prefix_done }}
 HONOROIT_TEXT_GREETINGS={{ matrix_bot_honoroit_text_greetings }}

roles/matrix-bot-honoroit/templates/systemd/matrix-bot-honoroit.service.j2

@@ -13,8 +13,8 @@ DefaultDependencies=no
 [Service]
 Type=simple
 Environment="HOME={{ matrix_systemd_unit_home_path }}"
-ExecStartPre=-{{ matrix_host_command_sh }} -c '{{ matrix_host_command_docker }} kill matrix-bot-honoroit 2>/dev/null'
+ExecStartPre=-{{ matrix_host_command_sh }} -c '{{ matrix_host_command_docker }} kill matrix-bot-honoroit 2>/dev/null || true'
-ExecStartPre=-{{ matrix_host_command_sh }} -c '{{ matrix_host_command_docker }} rm matrix-bot-honoroit 2>/dev/null'
+ExecStartPre=-{{ matrix_host_command_sh }} -c '{{ matrix_host_command_docker }} rm matrix-bot-honoroit 2>/dev/null || true'
 
 ExecStart={{ matrix_host_command_docker }} run --rm --name matrix-bot-honoroit \
 			--log-driver=none \
@@ -29,8 +29,8 @@ ExecStart={{ matrix_host_command_docker }} run --rm --name matrix-bot-honoroit \
 			{% endfor %}
 			{{ matrix_bot_honoroit_docker_image }}
 
-ExecStop=-{{ matrix_host_command_sh }} -c '{{ matrix_host_command_docker }} kill matrix-bot-honoroit 2>/dev/null'
+ExecStop=-{{ matrix_host_command_sh }} -c '{{ matrix_host_command_docker }} kill matrix-bot-honoroit 2>/dev/null || true'
-ExecStop=-{{ matrix_host_command_sh }} -c '{{ matrix_host_command_docker }} rm matrix-bot-honoroit 2>/dev/null'
+ExecStop=-{{ matrix_host_command_sh }} -c '{{ matrix_host_command_docker }} rm matrix-bot-honoroit 2>/dev/null || true'
 Restart=always
 RestartSec=30
 SyslogIdentifier=matrix-bot-honoroit

roles/matrix-bot-matrix-reminder-bot/tasks/setup_install.yml

@@ -47,12 +47,18 @@
     force_source: "{{ matrix_bot_matrix_reminder_bot_docker_image_force_pull if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}"
     force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else matrix_bot_matrix_reminder_bot_docker_image_force_pull }}"
   when: "not matrix_bot_matrix_reminder_bot_container_image_self_build|bool"
+  register: result
+  retries: "{{ matrix_container_retries_count }}"
+  delay: "{{ matrix_container_retries_delay }}"
+  until: result is not failed
 
 - name: Ensure matrix-reminder-bot repository is present on self-build
   git:
     repo: "{{ matrix_bot_matrix_reminder_bot_docker_repo }}"
     dest: "{{ matrix_bot_matrix_reminder_bot_docker_src_files_path }}"
     force: "yes"
+  become: true
+  become_user: "{{ matrix_user_username }}"
   register: matrix_bot_matrix_reminder_bot_git_pull_results
   when: "matrix_bot_matrix_reminder_bot_container_image_self_build|bool"
 
@@ -70,7 +76,7 @@
 
 - name: Ensure matrix-reminder-bot config installed
   copy:
-    content: "{{ matrix_bot_matrix_reminder_bot_configuration|to_nice_yaml }}"
+    content: "{{ matrix_bot_matrix_reminder_bot_configuration|to_nice_yaml(indent=2, width=999999) }}"
     dest: "{{ matrix_bot_matrix_reminder_bot_config_path }}/config.yaml"
     mode: 0644
     owner: "{{ matrix_user_username }}"

roles/matrix-bot-matrix-reminder-bot/templates/systemd/matrix-bot-matrix-reminder-bot.service.j2

@@ -13,8 +13,8 @@ DefaultDependencies=no
 [Service]
 Type=simple
 Environment="HOME={{ matrix_systemd_unit_home_path }}"
-ExecStartPre=-{{ matrix_host_command_sh }} -c '{{ matrix_host_command_docker }} kill matrix-bot-matrix-reminder-bot 2>/dev/null'
+ExecStartPre=-{{ matrix_host_command_sh }} -c '{{ matrix_host_command_docker }} kill matrix-bot-matrix-reminder-bot 2>/dev/null || true'
-ExecStartPre=-{{ matrix_host_command_sh }} -c '{{ matrix_host_command_docker }} rm matrix-bot-matrix-reminder-bot 2>/dev/null'
+ExecStartPre=-{{ matrix_host_command_sh }} -c '{{ matrix_host_command_docker }} rm matrix-bot-matrix-reminder-bot 2>/dev/null || true'
 
 ExecStart={{ matrix_host_command_docker }} run --rm --name matrix-bot-matrix-reminder-bot \
 			--log-driver=none \
@@ -32,8 +32,8 @@ ExecStart={{ matrix_host_command_docker }} run --rm --name matrix-bot-matrix-rem
 			{{ matrix_bot_matrix_reminder_bot_docker_image }} \
 			-c "matrix-reminder-bot /config/config.yaml"
 
-ExecStop=-{{ matrix_host_command_sh }} -c '{{ matrix_host_command_docker }} kill matrix-bot-matrix-reminder-bot 2>/dev/null'
+ExecStop=-{{ matrix_host_command_sh }} -c '{{ matrix_host_command_docker }} kill matrix-bot-matrix-reminder-bot 2>/dev/null || true'
-ExecStop=-{{ matrix_host_command_sh }} -c '{{ matrix_host_command_docker }} rm matrix-bot-matrix-reminder-bot 2>/dev/null'
+ExecStop=-{{ matrix_host_command_sh }} -c '{{ matrix_host_command_docker }} rm matrix-bot-matrix-reminder-bot 2>/dev/null || true'
 Restart=always
 RestartSec=30
 SyslogIdentifier=matrix-bot-matrix-reminder-bot

roles/matrix-bot-mjolnir/defaults/main.yml

@@ -4,7 +4,7 @@
 
 matrix_bot_mjolnir_enabled: true
 
-matrix_bot_mjolnir_version: "v1.3.1"
+matrix_bot_mjolnir_version: "v1.4.1"
 
 matrix_bot_mjolnir_container_image_self_build: false
 matrix_bot_mjolnir_container_image_self_build_repo: "https://github.com/matrix-org/mjolnir.git"

roles/matrix-bot-mjolnir/tasks/setup_install.yml

@@ -24,6 +24,10 @@
     force_source: "{{ matrix_bot_mjolnir_docker_image_force_pull if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}"
     force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else matrix_bot_mjolnir_docker_image_force_pull }}"
   when: "not matrix_bot_mjolnir_container_image_self_build|bool"
+  register: result
+  retries: "{{ matrix_container_retries_count }}"
+  delay: "{{ matrix_container_retries_delay }}"
+  until: result is not failed
 
 - name: Ensure mjolnir repository is present on self-build
   git:
@@ -31,6 +35,8 @@
     dest: "{{ matrix_bot_mjolnir_docker_src_files_path }}"
     version: "{{ matrix_bot_mjolnir_docker_image.split(':')[1] }}"
     force: "yes"
+  become: true
+  become_user: "{{ matrix_user_username }}"
   register: matrix_bot_mjolnir_git_pull_results
   when: "matrix_bot_mjolnir_container_image_self_build|bool"
 
@@ -47,7 +53,7 @@
 
 - name: Ensure matrix-bot-mjolnir config installed
   copy:
-    content: "{{ matrix_bot_mjolnir_configuration|to_nice_yaml }}"
+    content: "{{ matrix_bot_mjolnir_configuration|to_nice_yaml(indent=2, width=999999) }}"
     dest: "{{ matrix_bot_mjolnir_config_path }}/production.yaml"
     mode: 0644
     owner: "{{ matrix_user_username }}"