Automatic translations update

Upgrade ansible-role-livekit-server (v1.13.3-0 -> v1.13.3-1)
The new version adds livekit_server_config_rtc_ips_includes and livekit_server_config_rtc_ips_excludes variables, controlling LiveKit's rtc.ips.includes/excludes CIDR filters for RTC IP addresses. Related to #4958 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-15 11:12:18 +03:00 · 2026-07-15 04:33:38 +00:00 · 2026-07-15 07:31:52 +03:00 · 2026-07-15 07:29:35 +03:00 · 2026-07-15 06:01:27 +03:00 · 2026-07-14 15:16:31 +03:00
53 changed files with 3311 additions and 2961 deletions
@@ -0,0 +1,13 @@
+# SPDX-FileCopyrightText: 2025 Jonah Aragon
+#
+# SPDX-License-Identifier: AGPL-3.0-or-later
+
+FROM ghcr.io/devture/ansible:11.6.0-r0-0
+
+# Install additional packages
+RUN apk add --no-cache \
+	pwgen
+
+# Preserve command history across container restarts
+RUN SNIPPET="export HISTFILE=/commandhistory/.ash_history" \
+	&& echo "$SNIPPET" >> "/root/.profile"
@@ -0,0 +1,27 @@
+{
+	"name": "matrix-docker-ansible-deploy",
+	"build": {
+		"dockerfile": "Dockerfile",
+		"context": ".."
+	},
+	"postCreateCommand": {
+		"Fix Volume Permissions": "chown -R $(whoami): /commandhistory"
+	},
+	"mounts": [
+		{
+			"source": "matrix-docker-ansible-deploy-bashhistory",
+			"target": "/commandhistory",
+			"type": "volume"
+		}
+	],
+	"customizations": {
+		"vscode": {
+			"extensions": [
+				"EditorConfig.EditorConfig",
+				"redhat.ansible",
+				"redhat.vscode-yaml",
+				"ms-python.python"
+			]
+		}
+	}
+}
@@ -0,0 +1,3 @@
+SPDX-FileCopyrightText: 2025 Jonah Aragon
+
+SPDX-License-Identifier: AGPL-3.0-or-later
@@ -32,6 +32,18 @@
 				"dock.mau.dev/mautrix/**"
 			],
 			"allowedVersions": "/^v0\\./"
+		},
+		{
+			"matchFileNames": [
+				".github/workflows/close-stale-issues.yml",
+				".github/workflows/lock-threads.yml",
+				".github/workflows/matrix.yml",
+				".github/workflows/update-translations.yml",
+				"flake.lock",
+				"i18n/requirements.txt",
+				"mise.toml"
+			],
+			"automerge": true
 		}
 	],
 	"pre-commit": {
@@ -1,3 +1,41 @@
+# 2026-07-15
+
+## Dedicated CAPTCHA variables for Matrix Authentication Service
+
+[Matrix Authentication Service](./docs/configuring-playbook-matrix-authentication-service.md) can now be protected with CAPTCHA (ReCaptcha v2, Cloudflare Turnstile, or hCaptcha) via dedicated variables, instead of going through `matrix_authentication_service_configuration_extension_yaml`. See the [captcha documentation](./docs/configuring-captcha.md#matrix-authentication-service) for details.
+
+# 2026-07-14
+
+## The playbook no longer ships a custom welcome page for Element Web
+
+Element Web [redesigned its welcome page](https://github.com/element-hq/element-web/pull/33211) (the screen shown at `/#/welcome` before logging in) into a built-in component and no longer loads a custom `welcome.html` file by default. Since the playbook upgraded to an Element Web version containing that change (spring 2026), the custom welcome page the playbook installed (and the variables customizing it) had silently stopped having any effect.
+
+The playbook now embraces the new upstream behavior and no longer ships its own `welcome.html`. The following variables have been removed and the playbook will let you know if you're still using them: `matrix_client_element_welcome_headline`, `matrix_client_element_welcome_text`, `matrix_client_element_welcome_logo_link` and `matrix_client_element_page_template_welcome_path`.
+
+Most welcome page customizations keep working, because they go through Element Web's branding configuration, which the new welcome page still honors:
+
+- a custom logo, via `matrix_client_element_welcome_logo` (or `matrix_client_element_branding_auth_header_logo_url`)
+- a custom background, via `matrix_client_element_branding_welcome_background_url`
+
+If you need a fully custom welcome page, you can self-host an HTML page and point Element Web at it, like this:
+
+```yaml
+matrix_client_element_configuration_extension_json: |
+  {
+    "embedded_pages": {
+      "welcome_url": "https://example.com/my-welcome.html"
+    }
+  }
+```
+
+## BorgBackup now includes Synapse's local thumbnails
+
+For Synapse servers, the built-in [BorgBackup](./docs/configuring-playbook-backup-borg.md) integration no longer excludes the media store's `local_thumbnails` directory from backups.
+
+Synapse only generates thumbnails of local media at upload time (unless `dynamic_thumbnails` is enabled, which the playbook does not do), and there is no tooling to regenerate them. Restoring a backup made with the previous exclusion list therefore left all previously uploaded local images without thumbnails. The [official Synapse backup guide](https://element-hq.github.io/synapse/latest/usage/administration/backups.html) recommends backing this directory up, and the playbook now follows that recommendation.
+
+Expect your backups to grow somewhat, depending on how much image media your local users have uploaded. If you prefer the old behavior, you can redefine `backup_borg_location_exclude_patterns` in your `vars.yml`.
+
 # 2026-07-12

 ## matrix-registration-bot has been removed from the playbook
@@ -50,6 +50,8 @@ This ensures that:

 You can either [run Ansible in a container on the Matrix server itself](#running-ansible-in-a-container-on-the-matrix-server-itself) or [run Ansible in a container on another computer (not the Matrix server)](#running-ansible-in-a-container-on-another-computer-not-the-matrix-server).

+💡 If you use [Visual Studio Code](https://code.visualstudio.com/) or [GitHub Codespaces](https://github.com/features/codespaces), the playbook also ships a [dev container](https://containers.dev/) configuration (see the `.devcontainer/` directory) based on this same Ansible Docker image, which can prepare such a containerized Ansible environment for you automatically.
+
 ### Running Ansible in a container on the Matrix server itself

 To run Ansible in a (Docker) container on the Matrix server itself, you need to have a working Docker installation. Docker is normally installed by the playbook, so this may be a bit of a chicken and egg problem. To solve it:
@@ -15,6 +15,8 @@ Captcha can be enabled for this home server. This file explains how to do that.

 The captcha mechanism used is Google's [ReCaptcha](https://www.google.com/recaptcha/). This requires API keys from Google. If your homeserver is Dendrite then [hCapcha](https://www.hcaptcha.com) can be used instead.

+If you are using [Matrix Authentication Service](configuring-playbook-matrix-authentication-service.md), captcha is configured there instead (it handles registration), and [Cloudflare Turnstile](https://www.cloudflare.com/application-services/products/turnstile/) is supported as well. See [Matrix Authentication Service](#matrix-authentication-service) below.
+
 ## ReCaptcha

 ### Getting keys
@@ -61,3 +63,16 @@ matrix_dendrite_client_api_recaptcha_api_js_url: 'https://js.hcaptcha.com/1/api.
 matrix_dendrite_client_api_recaptcha_form_field: 'h-captcha-response'
 matrix_dendrite_client_api_recaptcha_sitekey_class: 'h-captcha'
 ```
+
+## Matrix Authentication Service
+
+When [Matrix Authentication Service](configuring-playbook-matrix-authentication-service.md) is enabled, registration and other account operations are handled by it, so captcha protection is configured there (the Synapse and Dendrite settings above do not apply).
+
+Matrix Authentication Service supports [ReCaptcha v2](http://www.google.com/recaptcha/admin), [Cloudflare Turnstile](https://www.cloudflare.com/application-services/products/turnstile/) and [hCaptcha](https://dashboard.hcaptcha.com/sites/new). Obtain a site/secret key pair from your chosen service, then add the following configuration to your `inventory/host_vars/matrix.example.com/vars.yml` file:
+
+```yaml
+# Valid values: recaptcha_v2, cloudflare_turnstile, hcaptcha
+matrix_authentication_service_config_captcha_service: recaptcha_v2
+matrix_authentication_service_config_captcha_site_key: 'YOUR_SITE_KEY'
+matrix_authentication_service_config_captcha_secret_key: 'YOUR_SECRET_KEY'
+```
@@ -40,6 +40,16 @@ matrix_hookshot_enabled: true
 # matrix_hookshot_github_private_key: "GITHUB_PRIVATE_KEY_HERE"
 ```

+> [!NOTE]
+> End-to-bridge encryption also requires the homeserver to support (and have enabled) [MSC2409](https://github.com/matrix-org/matrix-spec-proposals/pull/2409) and [MSC3202](https://github.com/matrix-org/matrix-spec-proposals/pull/3202). If you are using Synapse, enable them by also adding this to your `vars.yml` file:
+>
+> ```yaml
+> matrix_synapse_experimental_features_msc2409_to_device_messages_enabled: true
+> matrix_synapse_experimental_features_msc3202_transaction_extensions_enabled: true
+> ```
+>
+> These are experimental homeserver-wide features (as is Hookshot's encryption support itself), so enable them deliberately.
+
 For each of the services (GitHub, GitLab, Jira, Figma, and generic webhooks) fill in the respective variables `matrix_hookshot_service_*` listed in [main.yml](../roles/custom/matrix-bridge-hookshot/defaults/main.yml) as required.

 Take special note of the `matrix_hookshot_*_enabled` variables. Services that need no further configuration are enabled by default (GitLab and generic webhooks), while you must first add the required configuration and enable the others (GitHub, Jira, and Figma).
@@ -112,7 +112,9 @@ This option is less fragile and generally better.

 On the base domain's server (e.g. `example.com`), you can set up reverse-proxying (or simply a 302 redirect), so that any access for the `/.well-known/matrix` location prefix is forwarded to the Matrix domain's server (e.g. `matrix.example.com`).

-With this method, you **don't need** to add special HTTP headers for [CORS](https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS) reasons (like `Access-Control-Allow-Origin`), because your Matrix server (where requests ultimately go) will be configured by this playbook correctly.
+With reverse-proxying, you **don't need** to add special HTTP headers for [CORS](https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS) reasons (like `Access-Control-Allow-Origin`), because your Matrix server (where requests ultimately go) will be configured by this playbook correctly.
+
+If you use a 302 redirect instead, be aware that browsers apply CORS checks to every response in the redirect chain, so the redirect response itself must also carry an `Access-Control-Allow-Origin: *` header. Otherwise, web-based Matrix clients (like Element Web) may fail to work even though the final destination sets the header correctly.

 **For nginx**, it would be something like this:

@@ -155,6 +157,23 @@ example.com {
 }
 ```

+**Note**: Caddy does not process directives in the order they appear in the Caddyfile, but according to its own [directive order](https://caddyserver.com/docs/caddyfile/directives#directive-order). Notably, `redir` is evaluated before `reverse_proxy`, so a `redir` elsewhere in the same site block (a common way to send the base domain to `www.example.com` or to another site) takes precedence and breaks the well-known reverse-proxying. In such cases, wrap the directives in [`handle`](https://caddyserver.com/docs/caddyfile/directives/handle) blocks to enforce the intended priority:
+
+```caddy
+example.com {
+	handle /.well-known/matrix/* {
+		reverse_proxy https://matrix.example.com {
+			header_up Host {upstream_hostport}
+		}
+	}
+
+	handle {
+		# Everything else, e.g. a redirect to some other site
+		redir https://www.example.com{uri}
+	}
+}
+```
+
 **For HAProxy**, it would be something like this:

 ```haproxy
@@ -49,8 +49,8 @@ This is because the Matrix specification expects the federation endpoint to be s
 ```yaml
 # To let Traefik know which domains' certificates to serve
 matrix_synapse_container_labels_additional_labels: |
-  traefik.http.routers.matrix-synapse-federation-api.tls.domains.main="example.com"
-  traefik.http.routers.matrix-synapse-federation-api.tls.domains.sans="*.example.com"
+  traefik.http.routers.matrix-synapse-public-federation-api.tls.domains.main="example.com"
+  traefik.http.routers.matrix-synapse-public-federation-api.tls.domains.sans="*.example.com"
 ```

 ### Configure the DNS-01 challenge for let's encrypt
@@ -137,8 +137,8 @@ matrix_synapse_container_labels_public_federation_api_traefik_rule: PathPrefix(`

 # To let Traefik know which domains' certificates to serve
 matrix_synapse_container_labels_additional_labels: |
-  traefik.http.routers.matrix-synapse-federation-api.tls.domains.main="example.com"
-  traefik.http.routers.matrix-synapse-federation-api.tls.domains.sans="*.example.com"
+  traefik.http.routers.matrix-synapse-public-federation-api.tls.domains.main="example.com"
+  traefik.http.routers.matrix-synapse-public-federation-api.tls.domains.sans="*.example.com"

 # Add a new ACME configuration without having to disable the default one, since it would have a wide range of side effects
 traefik_configuration_extension_yaml: |
@@ -25,6 +25,11 @@ The migration might be a good moment, to "reset" a not properly working bridge.

 Before doing the actual import, **you need to upload your Postgres dump file to the server** (any path is okay).

+> [!WARNING]
+> Do not import into a database that already contains tables (e.g. one that a service has already initialized and used). As the [official Synapse backup guide](https://element-hq.github.io/synapse/latest/usage/administration/backups.html) puts it: at best this will error, at worst it will lead to subtle database inconsistencies. Import into an empty (freshly created) database instead.
+
+**Note for Synapse users restoring an older backup**: if the server kept running (and users kept chatting) after the backup you are restoring was made, truncate the `e2e_one_time_keys_json` table after importing and before starting Synapse. Restoring an older backup can otherwise cause already-used one-time keys to be re-issued, leading to message decryption errors for your users. You can do this by [getting a database terminal](maintenance-postgres.md#getting-a-database-terminal), connecting to the Synapse database (`\c synapse`) and running `TRUNCATE e2e_one_time_keys_json;`. Clients will generate and upload fresh one-time keys automatically.
+
 ## Importing

 To import, run this command (make sure to replace `SERVER_PATH_TO_POSTGRES_DUMP_FILE` with a file path on your server):
@@ -13,6 +13,8 @@ You can manually import your `media_store` files from a previous installation of

 Before doing the actual data restore, **you need to upload your media store directory to the server** (any path is okay).

+You also need the [rsync](https://rsync.samba.org/) utility installed **on the server**, as the import performs a server-side `rsync` synchronization. The playbook does not install it for you. On most distributions, it is available as a package called `rsync`.
+
 If you are [storing Matrix media files on Amazon S3](configuring-playbook-s3.md) (optional), restoring with this tool is not possible right now.

 As an alternative, you can perform a manual restore using the [AWS CLI tool](https://aws.amazon.com/cli/) (e.g. `aws s3 sync /path/to/server/media_store/. s3://name-of-bucket/`)
@@ -76,6 +76,8 @@ If you are using an [external Postgres server](configuring-playbook-external-pos

 Restoring a backup made this way can be done by [importing it](importing-postgres.md).

+**Note for Synapse users**: the [official Synapse backup guide](https://element-hq.github.io/synapse/latest/usage/administration/backups.html) recommends that the `e2e_one_time_keys_json` table either not be backed up, or be truncated after restoring (before Synapse is started). The full-server dump command above does include it, so if you ever restore a backup that is older than the server's current state, remember to truncate that table as described in [the importing guide](importing-postgres.md).
+
 ## Upgrading PostgreSQL

 Unless you are using an [external Postgres server](configuring-playbook-external-postgres.md), this playbook initially installs Postgres for you.
@@ -105,6 +105,9 @@ Cache autotuning is **enabled by default** and controlled via the following vari

 You can **learn more about cache-autotuning and the global cache factor settings** in the [Synapse's documentation on caches and associated values](https://matrix-org.github.io/synapse/latest/usage/configuration/config_documentation.html#caches-and-associated-values).

+> [!NOTE]
+> These limits apply **per Synapse process**. If you have [workers](configuring-playbook-synapse.md#load-balancing-with-workers) enabled, the main process and every worker each apply the configured limits independently, so the theoretical aggregate cache memory usage gets multiplied by the number of processes. When running many workers on a memory-constrained server, consider setting these variables to lower, explicitly chosen values.
+
 To **disable cache auto-tuning**, unset all values:

 ```yaml
@@ -3,11 +3,11 @@
    "agru-src": {
      "flake": false,
      "locked": {
-        "lastModified": 1772059918,
-        "narHash": "sha256-o3ZNyJjDEY2RCwIiBWSjWTo6/DqAVMK+ElTuwAVdZrg=",
+        "lastModified": 1783761807,
+        "narHash": "sha256-EVOf5r2oN2WpgodgTQmGJDPJVhgidIMz97hF6TgCyX8=",
        "owner": "etkecc",
        "repo": "agru",
-        "rev": "31a799242c4546ad1f9dbac79abcfafc79daba64",
+        "rev": "9e2ca9d8fa904db04e8d34bf0e7b54287e850298",
        "type": "github"
      },
      "original": {
@@ -36,11 +36,11 @@
    },
    "nixpkgs": {
      "locked": {
-        "lastModified": 1771923393,
-        "narHash": "sha256-Fy0+UXELv9hOE8WjYhJt8fMDLYTU2Dqn3cX4BwoGBos=",
+        "lastModified": 1783816212,
+        "narHash": "sha256-2aZisVTVGSFEk3MYcOiWQp3zvwyzbqpktB69Rcfp150=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "ea7f1f06811ce7fcc81d6c6fd4213150c23edcf2",
+        "rev": "3b32825de172d0bc85664f495edb096b10862524",
        "type": "github"
      },
      "original": {
@@ -22,7 +22,7 @@
        };
        agru = pkgs.buildGo125Module {
          pname = "agru";
-          version = "0.1.19";
+          version = "0.2.1";
          src = agru-src;
          vendorHash = null;
        };
@@ -3378,9 +3378,11 @@ backup_borg_postgresql_databases_auto: "{{ postgres_managed_databases | map(attr
 backup_borg_location_source_directories:
  - "{{ matrix_base_data_path }}"

+# local_thumbnails is deliberately NOT excluded: with dynamic_thumbnails disabled (Synapse's default),
+# nothing regenerates lost thumbnails, so the official Synapse backup guide recommends backing them up.
 backup_borg_location_exclude_patterns: |
  {{
-    ([matrix_synapse_media_store_path + '/remote_content', matrix_synapse_media_store_path + '/local_thumbnails', matrix_synapse_media_store_path + '/remote_thumbnail', matrix_synapse_media_store_path + '/url_cache', matrix_synapse_media_store_path + '/url_cache_thumbnails'] if matrix_homeserver_implementation == 'synapse' else [])
+    ([matrix_synapse_media_store_path + '/remote_content', matrix_synapse_media_store_path + '/remote_thumbnail', matrix_synapse_media_store_path + '/url_cache', matrix_synapse_media_store_path + '/url_cache_thumbnails'] if matrix_homeserver_implementation == 'synapse' else [])
    +
    ([postgres_data_path] if postgres_enabled else [])
  }}
@@ -3835,7 +3837,9 @@ jitsi_turns_port: "{{ coturn_container_stun_tls_host_bind_port_tcp.split(':')[-1
 # Falls back to the scalar.vector.im etherpad in case someone sets `jitsi_etherpad_enabled` to true,
 # while also setting `etherpad_enabled` to false.
 jitsi_etherpad_enabled: "{{ etherpad_enabled }}"
-jitsi_etherpad_base: "{{ etherpad_base_url if etherpad_enabled else 'https://scalar.vector.im/etherpad' }}"
+# The trailing slash is stripped, because the Jitsi role appends path segments (e.g. `/p/`) itself
+# and `etherpad_base_url` ends with a slash, which would otherwise produce double-slash URLs.
+jitsi_etherpad_base: "{{ (etherpad_base_url | regex_replace('/+$', '')) if etherpad_enabled else 'https://scalar.vector.im/etherpad' }}"

 # Allow verification using JWT and matrix-UVS
 jitsi_prosody_auth_matrix_uvs_sync_power_levels: "{{ matrix_user_verification_service_enabled }}"
@@ -4248,6 +4252,7 @@ postgres_managed_databases_auto: |
      'name': prometheus_postgres_exporter_database_name,
      'username': prometheus_postgres_exporter_database_username,
      'password': prometheus_postgres_exporter_database_password,
+      'additional_sql_queries': ['GRANT pg_monitor TO "' + prometheus_postgres_exporter_database_username + '";'],
    }] if (prometheus_postgres_exporter_enabled and prometheus_postgres_exporter_database_hostname == postgres_connection_hostname) else [])
    +
    ([{
@@ -5499,7 +5504,7 @@ grafana_provisioning_datasources_datasources: |
    }] if prometheus_enabled else [])
  }}

-grafana_dashboard_download_urls: |
+grafana_dashboard_download_urls_auto: |
  {{
    (matrix_synapse_grafana_dashboard_urls if matrix_homeserver_implementation == 'synapse' and matrix_synapse_metrics_enabled else [])
    +
@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: matrix-docker-ansible-deploy \n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2026-07-12 11:50+0000\n"
+"POT-Creation-Date: 2026-07-12 15:37+0000\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"
@@ -288,11 +288,23 @@ msgstr ""
 msgid "[Link](docs/configuring-playbook-client-fluffychat-web.md)"
 msgstr ""

-#: ../../../README.md:72
+#: ../../../README.md:0
+msgid "[Commet](https://github.com/commetchat/commet)"
+msgstr ""
+
+#: ../../../README.md:0
+msgid "Matrix web client"
+msgstr ""
+
+#: ../../../README.md:0
+msgid "[Link](docs/configuring-playbook-client-commet.md)"
+msgstr ""
+
+#: ../../../README.md:73
 msgid "Server Components"
 msgstr ""

-#: ../../../README.md:74
+#: ../../../README.md:75
 msgid "Services that run on the server to make the various parts of your installation work."
 msgstr ""

@@ -380,11 +392,11 @@ msgstr ""
 msgid "[Link](docs/configuring-playbook-matrix-rtc.md)"
 msgstr ""

-#: ../../../README.md:86
+#: ../../../README.md:87
 msgid "Authentication"
 msgstr ""

-#: ../../../README.md:88
+#: ../../../README.md:89
 msgid "Extend and modify how users are authenticated on your homeserver."
 msgstr ""

@@ -448,11 +460,11 @@ msgstr ""
 msgid "[Link](docs/configuring-playbook-synapse-simple-antispam.md)"
 msgstr ""

-#: ../../../README.md:98
+#: ../../../README.md:99
 msgid "File Storage"
 msgstr ""

-#: ../../../README.md:100
+#: ../../../README.md:101
 msgid "Use alternative file storage to the default `media_store` folder."
 msgstr ""

@@ -488,11 +500,11 @@ msgstr ""
 msgid "[Link](docs/configuring-playbook-matrix-media-repo.md)"
 msgstr ""

-#: ../../../README.md:108
+#: ../../../README.md:109
 msgid "Bridges"
 msgstr ""

-#: ../../../README.md:110
+#: ../../../README.md:111
 msgid "Bridges can be used to connect your Matrix installation with third-party communication networks."
 msgstr ""

@@ -796,11 +808,11 @@ msgstr ""
 msgid "[Link](docs/configuring-playbook-bridge-postmoogle.md)"
 msgstr ""

-#: ../../../README.md:140
+#: ../../../README.md:141
 msgid "Bots"
 msgstr ""

-#: ../../../README.md:142
+#: ../../../README.md:143
 msgid "Bots provide various additional functionality to your installation."
 msgstr ""

@@ -888,11 +900,11 @@ msgstr ""
 msgid "[Link](docs/configuring-playbook-bot-buscarron.md)"
 msgstr ""

-#: ../../../README.md:154
+#: ../../../README.md:155
 msgid "Administration"
 msgstr ""

-#: ../../../README.md:156
+#: ../../../README.md:157
 msgid "Services that help you in administrating and monitoring your Matrix installation."
 msgstr ""

@@ -980,11 +992,11 @@ msgstr ""
 msgid "[Link](docs/configuring-playbook-synapse-usage-exporter.md)"
 msgstr ""

-#: ../../../README.md:168
+#: ../../../README.md:169
 msgid "Misc"
 msgstr ""

-#: ../../../README.md:170
+#: ../../../README.md:171
 msgid "Various services that don't fit any other categories."
 msgstr ""

@@ -1108,54 +1120,54 @@ msgstr ""
 msgid "[Link](docs/configuring-playbook-element-call.md)"
 msgstr ""

-#: ../../../README.md:185
+#: ../../../README.md:186
 msgid "🆕 Changes"
 msgstr ""

-#: ../../../README.md:187
+#: ../../../README.md:188
 msgid "This playbook evolves over time, sometimes with backward-incompatible changes."
 msgstr ""

-#: ../../../README.md:189
+#: ../../../README.md:190
 msgid "When updating the playbook, refer to [the changelog](CHANGELOG.md) to catch up with what's new."
 msgstr ""

-#: ../../../README.md:191
+#: ../../../README.md:192
 msgid "🆘 Support"
 msgstr ""

-#: ../../../README.md:193
+#: ../../../README.md:194
 msgid "Matrix room: [#matrix-docker-ansible-deploy:devture.com](https://matrix.to/#/#matrix-docker-ansible-deploy:devture.com)"
 msgstr ""

-#: ../../../README.md:195
+#: ../../../README.md:196
 msgid "IRC channel: `#matrix-docker-ansible-deploy` on the [Libera Chat](https://libera.chat/) IRC network (irc.libera.chat:6697)"
 msgstr ""

-#: ../../../README.md:197
+#: ../../../README.md:198
 msgid "GitHub issues: [spantaleev/matrix-docker-ansible-deploy/issues](https://github.com/spantaleev/matrix-docker-ansible-deploy/issues)"
 msgstr ""

-#: ../../../README.md:199
+#: ../../../README.md:200
 msgid "🌐 Translation"
 msgstr ""

-#: ../../../README.md:201
+#: ../../../README.md:202
 msgid "See the [i18n/README.md](i18n/README.md) file for more information about translation."
 msgstr ""

-#: ../../../README.md:203
+#: ../../../README.md:204
 msgid "Translations are still work in progress."
 msgstr ""

-#: ../../../README.md:205
+#: ../../../README.md:206
 msgid "🤝 Related"
 msgstr ""

-#: ../../../README.md:207
+#: ../../../README.md:208
 msgid "You may also be interested in [mash-playbook](https://github.com/mother-of-all-self-hosting/mash-playbook) - another Ansible playbook for self-hosting non-Matrix services (see its [List of supported services](https://github.com/mother-of-all-self-hosting/mash-playbook/blob/main/docs/supported-services.md))."
 msgstr ""

-#: ../../../README.md:209
+#: ../../../README.md:210
 msgid "mash-playbook also makes use of [Traefik](./docs/configuring-playbook-traefik.md) as its reverse-proxy, so with minor [interoperability adjustments](https://github.com/mother-of-all-self-hosting/mash-playbook/blob/main/docs/interoperability.md), you can make matrix-docker-ansible-deploy and mash-playbook co-exist and host Matrix and non-Matrix services on the same server."
 msgstr ""
@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: matrix-docker-ansible-deploy \n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2026-05-19 07:40+0000\n"
+"POT-Creation-Date: 2026-07-12 15:37+0000\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"
@@ -101,92 +101,96 @@ msgid "You can either [run Ansible in a container on the Matrix server itself](#
 msgstr ""

 #: ../../../docs/ansible.md:53
-msgid "Running Ansible in a container on the Matrix server itself"
+msgid "💡 If you use [Visual Studio Code](https://code.visualstudio.com/) or [GitHub Codespaces](https://github.com/features/codespaces), the playbook also ships a [dev container](https://containers.dev/) configuration (see the `.devcontainer/` directory) based on this same Ansible Docker image, which can prepare such a containerized Ansible environment for you automatically."
 msgstr ""

 #: ../../../docs/ansible.md:55
-msgid "To run Ansible in a (Docker) container on the Matrix server itself, you need to have a working Docker installation. Docker is normally installed by the playbook, so this may be a bit of a chicken and egg problem. To solve it:"
+msgid "Running Ansible in a container on the Matrix server itself"
 msgstr ""

 #: ../../../docs/ansible.md:57
+msgid "To run Ansible in a (Docker) container on the Matrix server itself, you need to have a working Docker installation. Docker is normally installed by the playbook, so this may be a bit of a chicken and egg problem. To solve it:"
+msgstr ""
+
+#: ../../../docs/ansible.md:59
 msgid "you **either** need to install Docker manually first. Follow [the upstream instructions](https://docs.docker.com/engine/install/) for your distribution and consider setting `matrix_playbook_docker_installation_enabled: false` in your `vars.yml` file, to prevent the playbook from installing Docker"
 msgstr ""

-#: ../../../docs/ansible.md:58
+#: ../../../docs/ansible.md:60
 msgid "**or** you need to run the playbook in another way (e.g. [Running Ansible in a container on another computer (not the Matrix server)](#running-ansible-in-a-container-on-another-computer-not-the-matrix-server)) at least the first time around"
 msgstr ""

-#: ../../../docs/ansible.md:60
+#: ../../../docs/ansible.md:62
 msgid "Once you have a working Docker installation on the server, **clone the playbook** somewhere on the server and configure it as per usual (`inventory/hosts`, `inventory/host_vars/…`, etc.), as described in [configuring the playbook](configuring-playbook.md)."
 msgstr ""

-#: ../../../docs/ansible.md:62
+#: ../../../docs/ansible.md:64
 msgid "You would then need to add `ansible_connection=community.docker.nsenter` to the host line in `inventory/hosts`. This tells Ansible to connect to the \"remote\" machine by switching Linux namespaces with [nsenter](https://man7.org/linux/man-pages/man1/nsenter.1.html), instead of using SSH."
 msgstr ""

-#: ../../../docs/ansible.md:64
+#: ../../../docs/ansible.md:66
 msgid "Alternatively, you can leave your `inventory/hosts` as is and specify the connection type in **each** `ansible-playbook` call you do later, like this: `just install-all --connection=community.docker.nsenter` (or `ansible-playbook --connection=community.docker.nsenter …`)."
 msgstr ""

-#: ../../../docs/ansible.md:66
-#: ../../../docs/ansible.md:88
+#: ../../../docs/ansible.md:68
+#: ../../../docs/ansible.md:90
 msgid "Run this from the playbook's directory:"
 msgstr ""

-#: ../../../docs/ansible.md:80
-#: ../../../docs/ansible.md:103
-msgid "Once you execute the above command, you'll be dropped into a `/work` directory inside a Docker container. The `/work` directory contains the playbook's code."
-msgstr ""
-
 #: ../../../docs/ansible.md:82
 #: ../../../docs/ansible.md:105
-msgid "First, consider running `git config --global --add safe.directory /work` to [resolve directory ownership issues](#resolve-directory-ownership-issues)."
+msgid "Once you execute the above command, you'll be dropped into a `/work` directory inside a Docker container. The `/work` directory contains the playbook's code."
 msgstr ""

 #: ../../../docs/ansible.md:84
-msgid "Finally, you can execute `just` or `ansible-playbook …` (e.g. `ansible-playbook --connection=community.docker.nsenter …`) commands as per normal now."
+#: ../../../docs/ansible.md:107
+msgid "First, consider running `git config --global --add safe.directory /work` to [resolve directory ownership issues](#resolve-directory-ownership-issues)."
 msgstr ""

 #: ../../../docs/ansible.md:86
+msgid "Finally, you can execute `just` or `ansible-playbook …` (e.g. `ansible-playbook --connection=community.docker.nsenter …`) commands as per normal now."
+msgstr ""
+
+#: ../../../docs/ansible.md:88
 msgid "Running Ansible in a container on another computer (not the Matrix server)"
 msgstr ""

-#: ../../../docs/ansible.md:101
+#: ../../../docs/ansible.md:103
 msgid "The above command tries to mount an SSH key (`$HOME/.ssh/id_ed25519`) into the container (at `/root/.ssh/id_ed25519`). If your SSH key is at a different path (not in `$HOME/.ssh/id_ed25519`), adjust that part."
 msgstr ""

-#: ../../../docs/ansible.md:107
+#: ../../../docs/ansible.md:109
 msgid "Finally, you execute `just` or `ansible-playbook …` commands as per normal now."
 msgstr ""

-#: ../../../docs/ansible.md:109
+#: ../../../docs/ansible.md:111
 msgid "If you don't use SSH keys for authentication"
 msgstr ""

-#: ../../../docs/ansible.md:111
+#: ../../../docs/ansible.md:113
 msgid "If you don't use SSH keys for authentication, simply remove that whole line (`--mount type=bind,src$HOME/.ssh/id_ed25519,dst=/root/.ssh/id_ed25519,ro`)."
 msgstr ""

-#: ../../../docs/ansible.md:113
+#: ../../../docs/ansible.md:115
 msgid "To authenticate at your server using a password, you need to add a package. So, when you are in the shell of the ansible docker container (the previously used `docker run -it …` command), run:"
 msgstr ""

-#: ../../../docs/ansible.md:119
+#: ../../../docs/ansible.md:121
 msgid "Then, to be asked for the password whenever running an `ansible-playbook` command add `--ask-pass` to the arguments of the command."
 msgstr ""

-#: ../../../docs/ansible.md:121
+#: ../../../docs/ansible.md:123
 msgid "Resolve directory ownership issues"
 msgstr ""

-#: ../../../docs/ansible.md:123
+#: ../../../docs/ansible.md:125
 msgid "Because you're `root` in the container running Ansible and this likely differs from the owner (your regular user account) of the playbook directory outside of the container, certain playbook features which use `git` locally may report warnings such as:"
 msgstr ""

-#: ../../../docs/ansible.md:125
+#: ../../../docs/ansible.md:127
 msgid "fatal: unsafe repository ('/work' is owned by someone else) To add an exception for this directory, call:  git config --global --add safe.directory /work"
 msgstr ""

-#: ../../../docs/ansible.md:129
+#: ../../../docs/ansible.md:131
 msgid "These errors can be resolved by making `git` trust the playbook directory by running `git config --global --add safe.directory /work`"
 msgstr ""
@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: matrix-docker-ansible-deploy \n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2026-02-13 10:32+0000\n"
+"POT-Creation-Date: 2026-07-15 04:33+0000\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"
@@ -33,43 +33,59 @@ msgid "The captcha mechanism used is Google's [ReCaptcha](https://www.google.com
 msgstr ""

 #: ../../../docs/configuring-captcha.md:18
-msgid "ReCaptcha"
+msgid "If you are using [Matrix Authentication Service](configuring-playbook-matrix-authentication-service.md), captcha is configured there instead (it handles registration), and [Cloudflare Turnstile](https://www.cloudflare.com/application-services/products/turnstile/) is supported as well. See [Matrix Authentication Service](#matrix-authentication-service) below."
 msgstr ""

 #: ../../../docs/configuring-captcha.md:20
-#: ../../../docs/configuring-captcha.md:46
-msgid "Getting keys"
+msgid "ReCaptcha"
 msgstr ""

 #: ../../../docs/configuring-captcha.md:22
 #: ../../../docs/configuring-captcha.md:48
-msgid "Requires a site/secret key pair from:"
+msgid "Getting keys"
 msgstr ""

 #: ../../../docs/configuring-captcha.md:24
-msgid "<http://www.google.com/recaptcha/admin>"
+#: ../../../docs/configuring-captcha.md:50
+msgid "Requires a site/secret key pair from:"
 msgstr ""

 #: ../../../docs/configuring-captcha.md:26
-msgid "Must be a reCAPTCHA **v2** key using the \"I'm not a robot\" Checkbox option"
+msgid "<http://www.google.com/recaptcha/admin>"
 msgstr ""

 #: ../../../docs/configuring-captcha.md:28
-msgid "Setting ReCaptcha keys"
+msgid "Must be a reCAPTCHA **v2** key using the \"I'm not a robot\" Checkbox option"
 msgstr ""

 #: ../../../docs/configuring-captcha.md:30
+msgid "Setting ReCaptcha keys"
+msgstr ""
+
+#: ../../../docs/configuring-captcha.md:32
 msgid "Once registered as above, add the following configuration to your `inventory/host_vars/matrix.example.com/vars.yml` file:"
 msgstr ""

-#: ../../../docs/configuring-captcha.md:44
+#: ../../../docs/configuring-captcha.md:46
 msgid "hCaptcha"
 msgstr ""

-#: ../../../docs/configuring-captcha.md:50
+#: ../../../docs/configuring-captcha.md:52
 msgid "<https://dashboard.hcaptcha.com/sites/new>"
 msgstr ""

-#: ../../../docs/configuring-captcha.md:52
+#: ../../../docs/configuring-captcha.md:54
 msgid "Setting hCaptcha keys"
 msgstr ""
+
+#: ../../../docs/configuring-captcha.md:67
+msgid "Matrix Authentication Service"
+msgstr ""
+
+#: ../../../docs/configuring-captcha.md:69
+msgid "When [Matrix Authentication Service](configuring-playbook-matrix-authentication-service.md) is enabled, registration and other account operations are handled by it, so captcha protection is configured there (the Synapse and Dendrite settings above do not apply)."
+msgstr ""
+
+#: ../../../docs/configuring-captcha.md:71
+msgid "Matrix Authentication Service supports [ReCaptcha v2](http://www.google.com/recaptcha/admin), [Cloudflare Turnstile](https://www.cloudflare.com/application-services/products/turnstile/) and [hCaptcha](https://dashboard.hcaptcha.com/sites/new). Obtain a site/secret key pair from your chosen service, then add the following configuration to your `inventory/host_vars/matrix.example.com/vars.yml` file:"
+msgstr ""
@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: matrix-docker-ansible-deploy \n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2026-02-13 10:32+0000\n"
+"POT-Creation-Date: 2026-07-15 04:33+0000\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"
@@ -56,95 +56,103 @@ msgstr ""
 msgid "Add the following configuration to your `inventory/host_vars/matrix.example.com/vars.yml` file. Make sure to replace `GITHUB_PRIVATE_KEY_HERE` with the one created [above](#download-github-app-private-key)."
 msgstr ""

-#: ../../../docs/configuring-playbook-bridge-hookshot.md:43
-msgid "For each of the services (GitHub, GitLab, Jira, Figma, and generic webhooks) fill in the respective variables `matrix_hookshot_service_*` listed in [main.yml](../roles/custom/matrix-bridge-hookshot/defaults/main.yml) as required."
-msgstr ""
-
-#: ../../../docs/configuring-playbook-bridge-hookshot.md:45
-msgid "Take special note of the `matrix_hookshot_*_enabled` variables. Services that need no further configuration are enabled by default (GitLab and generic webhooks), while you must first add the required configuration and enable the others (GitHub, Jira, and Figma)."
-msgstr ""
-
-#: ../../../docs/configuring-playbook-bridge-hookshot.md:47
-msgid "Extending the configuration"
-msgstr ""
-
-#: ../../../docs/configuring-playbook-bridge-hookshot.md:49
-msgid "There are some additional things you may wish to configure about the bridge."
+#: ../../../docs/configuring-playbook-bridge-hookshot.md:44
+msgid "End-to-bridge encryption also requires the homeserver to support (and have enabled) [MSC2409](https://github.com/matrix-org/matrix-spec-proposals/pull/2409) and [MSC3202](https://github.com/matrix-org/matrix-spec-proposals/pull/3202). If you are using Synapse, enable them by also adding this to your `vars.yml` file:"
 msgstr ""

 #: ../../../docs/configuring-playbook-bridge-hookshot.md:51
-msgid "Take a look at:"
+msgid "These are experimental homeserver-wide features (as is Hookshot's encryption support itself), so enable them deliberately."
 msgstr ""

 #: ../../../docs/configuring-playbook-bridge-hookshot.md:53
+msgid "For each of the services (GitHub, GitLab, Jira, Figma, and generic webhooks) fill in the respective variables `matrix_hookshot_service_*` listed in [main.yml](../roles/custom/matrix-bridge-hookshot/defaults/main.yml) as required."
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bridge-hookshot.md:55
+msgid "Take special note of the `matrix_hookshot_*_enabled` variables. Services that need no further configuration are enabled by default (GitLab and generic webhooks), while you must first add the required configuration and enable the others (GitHub, Jira, and Figma)."
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bridge-hookshot.md:57
+msgid "Extending the configuration"
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bridge-hookshot.md:59
+msgid "There are some additional things you may wish to configure about the bridge."
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bridge-hookshot.md:61
+msgid "Take a look at:"
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bridge-hookshot.md:63
 msgid "`roles/custom/matrix-bridge-hookshot/defaults/main.yml` for some variables that you can customize via your `vars.yml` file"
 msgstr ""

-#: ../../../docs/configuring-playbook-bridge-hookshot.md:54
+#: ../../../docs/configuring-playbook-bridge-hookshot.md:64
 msgid "`roles/custom/matrix-bridge-hookshot/templates/config.yaml.j2` for the bridge's default configuration. You can override settings (even those that don't have dedicated playbook variables) using the `matrix_hookshot_configuration_extension_yaml` and `matrix_hookshot_registration_extension_yaml` variables"
 msgstr ""

-#: ../../../docs/configuring-playbook-bridge-hookshot.md:56
+#: ../../../docs/configuring-playbook-bridge-hookshot.md:66
 msgid "Refer the [official instructions](https://matrix-org.github.io/matrix-hookshot/latest/setup.html) and the comments in [main.yml](../roles/custom/matrix-bridge-hookshot/defaults/main.yml) to learn what the individual options do."
 msgstr ""

-#: ../../../docs/configuring-playbook-bridge-hookshot.md:58
+#: ../../../docs/configuring-playbook-bridge-hookshot.md:68
 msgid "Installing"
 msgstr ""

-#: ../../../docs/configuring-playbook-bridge-hookshot.md:60
+#: ../../../docs/configuring-playbook-bridge-hookshot.md:70
 msgid "After configuring the playbook, run it with [playbook tags](playbook-tags.md) as below:"
 msgstr ""

-#: ../../../docs/configuring-playbook-bridge-hookshot.md:67
+#: ../../../docs/configuring-playbook-bridge-hookshot.md:77
 msgid "The shortcut commands with the [`just` program](just.md) are also available: `just install-service hookshot` or `just setup-all`"
 msgstr ""

-#: ../../../docs/configuring-playbook-bridge-hookshot.md:69
+#: ../../../docs/configuring-playbook-bridge-hookshot.md:79
 msgid "`just install-service hookshot` is useful for maintaining your setup quickly when its components remain unchanged. If you adjust your `vars.yml` to remove other components, you'd need to run `just setup-all`, or these components will still remain installed. Note `just setup-all` runs the `ensure-matrix-users-created` tag too."
 msgstr ""

-#: ../../../docs/configuring-playbook-bridge-hookshot.md:71
+#: ../../../docs/configuring-playbook-bridge-hookshot.md:81
 msgid "Usage"
 msgstr ""

-#: ../../../docs/configuring-playbook-bridge-hookshot.md:73
+#: ../../../docs/configuring-playbook-bridge-hookshot.md:83
 msgid "To use the bridge, you need to create a room and invite the Hookshot bot (`@hookshot:example.com`) to it."
 msgstr ""

-#: ../../../docs/configuring-playbook-bridge-hookshot.md:75
+#: ../../../docs/configuring-playbook-bridge-hookshot.md:85
 msgid "Make sure the bot is able to send state events (usually the Moderator power level in clients)."
 msgstr ""

-#: ../../../docs/configuring-playbook-bridge-hookshot.md:77
+#: ../../../docs/configuring-playbook-bridge-hookshot.md:87
 msgid "Send `!hookshot help` to the bot to see the available commands."
 msgstr ""

-#: ../../../docs/configuring-playbook-bridge-hookshot.md:79
+#: ../../../docs/configuring-playbook-bridge-hookshot.md:89
 msgid "Refer to [Hookshot's documentation](https://matrix-org.github.io/matrix-hookshot/latest/usage.html) for more details about using the bridge's various features."
 msgstr ""

-#: ../../../docs/configuring-playbook-bridge-hookshot.md:81
+#: ../../../docs/configuring-playbook-bridge-hookshot.md:91
 msgid "💡 **Note**: the different listeners are bound to certain paths which might differ from those assumed by the hookshot documentation. See [URLs for bridges setup](#urls-for-bridges-setup) below."
 msgstr ""

-#: ../../../docs/configuring-playbook-bridge-hookshot.md:83
+#: ../../../docs/configuring-playbook-bridge-hookshot.md:93
 msgid "Reset crypto store"
 msgstr ""

-#: ../../../docs/configuring-playbook-bridge-hookshot.md:85
+#: ../../../docs/configuring-playbook-bridge-hookshot.md:95
 msgid "Should the crypto store be corrupted, you can reset it by executing this Ansible playbook with the tag `reset-hookshot-encryption` added:"
 msgstr ""

-#: ../../../docs/configuring-playbook-bridge-hookshot.md:91
+#: ../../../docs/configuring-playbook-bridge-hookshot.md:101
 msgid "More setup documentation"
 msgstr ""

-#: ../../../docs/configuring-playbook-bridge-hookshot.md:93
+#: ../../../docs/configuring-playbook-bridge-hookshot.md:103
 msgid "URLs for bridges setup"
 msgstr ""

-#: ../../../docs/configuring-playbook-bridge-hookshot.md:95
+#: ../../../docs/configuring-playbook-bridge-hookshot.md:105
 msgid "Unless indicated otherwise, the following endpoints are reachable on your `matrix.` subdomain (if the feature is enabled)."
 msgstr ""

@@ -276,98 +284,98 @@ msgstr ""
 msgid "Widgets"
 msgstr ""

-#: ../../../docs/configuring-playbook-bridge-hookshot.md:107
+#: ../../../docs/configuring-playbook-bridge-hookshot.md:117
 msgid "Also see the various `matrix_hookshot_container_labels_*` variables in [main.yml](../roles/custom/matrix-bridge-hookshot/defaults/main.yml), which expose URLs publicly."
 msgstr ""

-#: ../../../docs/configuring-playbook-bridge-hookshot.md:109
+#: ../../../docs/configuring-playbook-bridge-hookshot.md:119
 msgid "The different listeners are also reachable *internally* in the docker-network via the container's name (configured by `matrix_hookshot_container_url`) and on different ports (e.g. `matrix_hookshot_appservice_port`). Read [main.yml](../roles/custom/matrix-bridge-hookshot/defaults/main.yml) in detail for more info."
 msgstr ""

-#: ../../../docs/configuring-playbook-bridge-hookshot.md:111
+#: ../../../docs/configuring-playbook-bridge-hookshot.md:121
 msgid "Manage GitHub Private Key with aux role"
 msgstr ""

-#: ../../../docs/configuring-playbook-bridge-hookshot.md:113
+#: ../../../docs/configuring-playbook-bridge-hookshot.md:123
 msgid "The GitHub bridge requires you to install a private key file. This can be done in multiple ways:"
 msgstr ""

-#: ../../../docs/configuring-playbook-bridge-hookshot.md:115
+#: ../../../docs/configuring-playbook-bridge-hookshot.md:125
 msgid "copy the *contents* of the downloaded file and set the variable `matrix_hookshot_github_private_key` to the contents (see example in [main.yml](../roles/custom/matrix-bridge-hookshot/defaults/main.yml))."
 msgstr ""

-#: ../../../docs/configuring-playbook-bridge-hookshot.md:116
+#: ../../../docs/configuring-playbook-bridge-hookshot.md:126
 msgid "somehow copy the file to the path `{{ matrix_hookshot_base_path }}/{{ matrix_hookshot_github_private_key_file }}` (default: `/matrix/hookshot/private-key.pem`) on the server manually."
 msgstr ""

-#: ../../../docs/configuring-playbook-bridge-hookshot.md:117
+#: ../../../docs/configuring-playbook-bridge-hookshot.md:127
 msgid "use the [`aux` role](https://github.com/mother-of-all-self-hosting/ansible-role-aux) to copy the file from an arbitrary path on your ansible client to the correct path on the server."
 msgstr ""

-#: ../../../docs/configuring-playbook-bridge-hookshot.md:119
+#: ../../../docs/configuring-playbook-bridge-hookshot.md:129
 msgid "To use the `aux` role, make sure the `matrix_hookshot_github_private_key` variable is empty. Then add the following configuration to your `vars.yml` file:"
 msgstr ""

-#: ../../../docs/configuring-playbook-bridge-hookshot.md:130
+#: ../../../docs/configuring-playbook-bridge-hookshot.md:140
 msgid "For more information, see the documentation in the [default configuration of the aux role](https://github.com/mother-of-all-self-hosting/ansible-role-aux/blob/main/defaults/main.yml)."
 msgstr ""

-#: ../../../docs/configuring-playbook-bridge-hookshot.md:132
+#: ../../../docs/configuring-playbook-bridge-hookshot.md:142
 msgid "Enable metrics"
 msgstr ""

-#: ../../../docs/configuring-playbook-bridge-hookshot.md:134
+#: ../../../docs/configuring-playbook-bridge-hookshot.md:144
 msgid "The playbook can enable and configure the metrics of the service for you."
 msgstr ""

-#: ../../../docs/configuring-playbook-bridge-hookshot.md:136
+#: ../../../docs/configuring-playbook-bridge-hookshot.md:146
 msgid "Metrics are **only enabled by default** if the builtin [Prometheus](configuring-playbook-prometheus-grafana.md) is enabled (by default, Prometheus isn't enabled). If so, metrics will automatically be collected by Prometheus and made available in Grafana. You will, however, need to set up your own Dashboard for displaying them."
 msgstr ""

-#: ../../../docs/configuring-playbook-bridge-hookshot.md:138
+#: ../../../docs/configuring-playbook-bridge-hookshot.md:148
 msgid "To enable the metrics, add the following configuration to your `vars.yml` file:"
 msgstr ""

-#: ../../../docs/configuring-playbook-bridge-hookshot.md:145
+#: ../../../docs/configuring-playbook-bridge-hookshot.md:155
 msgid "**To collect metrics from an external Prometheus server**, besides enabling metrics as described above, you will also need to enable metrics exposure on `https://matrix.example.com/metrics/hookshot` by adding the following configuration to your `vars.yml` file:"
 msgstr ""

-#: ../../../docs/configuring-playbook-bridge-hookshot.md:151
+#: ../../../docs/configuring-playbook-bridge-hookshot.md:161
 msgid "By default metrics are exposed publicly **without** password-protection. To password-protect the metrics with dedicated credentials, add the following configuration to your `vars.yml` file:"
 msgstr ""

-#: ../../../docs/configuring-playbook-bridge-hookshot.md:158
+#: ../../../docs/configuring-playbook-bridge-hookshot.md:168
 msgid "To `matrix_hookshot_container_labels_metrics_middleware_basic_auth_users`, set the Basic Authentication credentials (raw `htpasswd` file content) used to protect the endpoint. See https://doc.traefik.io/traefik/middlewares/http/basicauth/#users for details about it."
 msgstr ""

-#: ../../../docs/configuring-playbook-bridge-hookshot.md:160
+#: ../../../docs/configuring-playbook-bridge-hookshot.md:170
 msgid "**Note**: alternatively, you can use `matrix_metrics_exposure_enabled` to expose all services on this `/metrics/*` feature, and you can use `matrix_metrics_exposure_http_basic_auth_enabled` and `matrix_metrics_exposure_http_basic_auth_users` to password-protect the metrics of them. See [this section](configuring-playbook-prometheus-grafana.md#collecting-metrics-to-an-external-prometheus-server) for more information."
 msgstr ""

-#: ../../../docs/configuring-playbook-bridge-hookshot.md:162
+#: ../../../docs/configuring-playbook-bridge-hookshot.md:172
 msgid "Enable Grafana (optional)"
 msgstr ""

-#: ../../../docs/configuring-playbook-bridge-hookshot.md:164
+#: ../../../docs/configuring-playbook-bridge-hookshot.md:174
 msgid "Probably you wish to enable Grafana along with Prometheus for generating graphs of the metrics."
 msgstr ""

-#: ../../../docs/configuring-playbook-bridge-hookshot.md:166
+#: ../../../docs/configuring-playbook-bridge-hookshot.md:176
 msgid "To enable Grafana, see [this section](configuring-playbook-prometheus-grafana.md#adjusting-the-playbook-configuration-grafana) for instructions."
 msgstr ""

-#: ../../../docs/configuring-playbook-bridge-hookshot.md:168
+#: ../../../docs/configuring-playbook-bridge-hookshot.md:178
 msgid "Troubleshooting"
 msgstr ""

-#: ../../../docs/configuring-playbook-bridge-hookshot.md:170
+#: ../../../docs/configuring-playbook-bridge-hookshot.md:180
 msgid "As with all other services, you can find the logs in [systemd-journald](https://www.freedesktop.org/software/systemd/man/systemd-journald.service.html) by logging in to the server with SSH and running `journalctl -fu matrix-hookshot`."
 msgstr ""

-#: ../../../docs/configuring-playbook-bridge-hookshot.md:172
+#: ../../../docs/configuring-playbook-bridge-hookshot.md:182
 msgid "Increase logging verbosity"
 msgstr ""

-#: ../../../docs/configuring-playbook-bridge-hookshot.md:174
+#: ../../../docs/configuring-playbook-bridge-hookshot.md:184
 msgid "The default logging level for this component is `warn`. If you want to increase the verbosity, add the following configuration to your `vars.yml` file and re-run the playbook:"
 msgstr ""
@@ -0,0 +1,141 @@
+# SOME DESCRIPTIVE TITLE.
+# Copyright (C) 2018-2026, Slavi Pantaleev, Aine Etke, MDAD community members
+# This file is distributed under the same license as the matrix-docker-ansible-deploy package.
+# FIRST AUTHOR <EMAIL@ADDRESS>, YEAR.
+#
+#, fuzzy
+msgid ""
+msgstr ""
+"Project-Id-Version: matrix-docker-ansible-deploy \n"
+"Report-Msgid-Bugs-To: \n"
+"POT-Creation-Date: 2026-07-12 15:37+0000\n"
+"PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
+"Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
+"Language-Team: LANGUAGE <LL@li.org>\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+
+#: ../../../docs/configuring-playbook-client-commet.md:7
+msgid "Setting up Commet (optional)"
+msgstr ""
+
+#: ../../../docs/configuring-playbook-client-commet.md:9
+msgid "The playbook can install and configure the [Commet](https://github.com/commetchat/commet) Matrix web client for you."
+msgstr ""
+
+#: ../../../docs/configuring-playbook-client-commet.md:11
+msgid "Adjusting DNS records"
+msgstr ""
+
+#: ../../../docs/configuring-playbook-client-commet.md:13
+msgid "By default, this playbook installs Commet on the `commet.` subdomain (`commet.example.com`) and requires you to create a CNAME record for `commet`, which targets `matrix.example.com`."
+msgstr ""
+
+#: ../../../docs/configuring-playbook-client-commet.md:15
+msgid "When setting, replace `example.com` with your own."
+msgstr ""
+
+#: ../../../docs/configuring-playbook-client-commet.md:17
+msgid "Adjusting the playbook configuration"
+msgstr ""
+
+#: ../../../docs/configuring-playbook-client-commet.md:19
+msgid "To enable Commet, add the following configuration to your `inventory/host_vars/matrix.example.com/vars.yml` file:"
+msgstr ""
+
+#: ../../../docs/configuring-playbook-client-commet.md:25
+msgid "Adjusting the Commet URL (optional)"
+msgstr ""
+
+#: ../../../docs/configuring-playbook-client-commet.md:27
+msgid "By tweaking the `matrix_client_commet_hostname` and `matrix_client_commet_path_prefix` variables, you can easily make the service available at a **different hostname and/or path** than the default one."
+msgstr ""
+
+#: ../../../docs/configuring-playbook-client-commet.md:29
+msgid "Example additional configuration for your `vars.yml` file:"
+msgstr ""
+
+#: ../../../docs/configuring-playbook-client-commet.md:40
+msgid "After changing the domain, **you may need to adjust your DNS** records to point the Commet domain to the Matrix server."
+msgstr ""
+
+#: ../../../docs/configuring-playbook-client-commet.md:42
+msgid "If you've decided to reuse the `matrix.` domain, you won't need to do any extra DNS configuration."
+msgstr ""
+
+#: ../../../docs/configuring-playbook-client-commet.md:44
+msgid "**Note**: `matrix_client_commet_path_prefix` must either be `/` or not end with a slash (e.g. `/commet`)."
+msgstr ""
+
+#: ../../../docs/configuring-playbook-client-commet.md:46
+msgid "Adjusting the default homeserver (optional)"
+msgstr ""
+
+#: ../../../docs/configuring-playbook-client-commet.md:48
+msgid "Commet is configured with a `default_homeserver` value. By default, the playbook uses `matrix.org`."
+msgstr ""
+
+#: ../../../docs/configuring-playbook-client-commet.md:50
+msgid "To change it, add the following configuration to your `vars.yml` file:"
+msgstr ""
+
+#: ../../../docs/configuring-playbook-client-commet.md:56
+msgid "Adjusting the Commet version/branch to build (optional)"
+msgstr ""
+
+#: ../../../docs/configuring-playbook-client-commet.md:58
+msgid "When self-building the container image (`matrix_client_commet_container_image_self_build: true`), the playbook checks out the Commet source repository and builds an image from it."
+msgstr ""
+
+#: ../../../docs/configuring-playbook-client-commet.md:60
+msgid "To build from a different git branch/tag/SHA, set `matrix_client_commet_version` in your `vars.yml` file:"
+msgstr ""
+
+#: ../../../docs/configuring-playbook-client-commet.md:67
+msgid "**Note**: by default, the image tag is derived from `matrix_client_commet_version` (`localhost/matrix-client-commet:{{ matrix_client_commet_version }}`). If your branch name contains `/` (e.g. `feature/foo`), override `matrix_client_commet_container_image` (and optionally `matrix_client_commet_container_image_self_build_version_tag`) to a Docker-tag-safe value."
+msgstr ""
+
+#: ../../../docs/configuring-playbook-client-commet.md:69
+msgid "Extending the configuration"
+msgstr ""
+
+#: ../../../docs/configuring-playbook-client-commet.md:71
+msgid "There are some additional things you may wish to configure about the component."
+msgstr ""
+
+#: ../../../docs/configuring-playbook-client-commet.md:73
+msgid "Take a look at:"
+msgstr ""
+
+#: ../../../docs/configuring-playbook-client-commet.md:75
+msgid "`roles/custom/matrix-client-commet/defaults/main.yml` for some variables that you can customize via your `vars.yml` file"
+msgstr ""
+
+#: ../../../docs/configuring-playbook-client-commet.md:76
+msgid "`roles/custom/matrix-client-commet/templates/global_config.json.j2` for the component's default runtime configuration"
+msgstr ""
+
+#: ../../../docs/configuring-playbook-client-commet.md:78
+msgid "Installing"
+msgstr ""
+
+#: ../../../docs/configuring-playbook-client-commet.md:80
+msgid "After configuring the playbook and potentially [adjusting your DNS records](#adjusting-dns-records), run the playbook with [playbook tags](playbook-tags.md) as below:"
+msgstr ""
+
+#: ../../../docs/configuring-playbook-client-commet.md:87
+msgid "The shortcut commands with the [`just` program](just.md) are also available: `just install-all` or `just setup-all`"
+msgstr ""
+
+#: ../../../docs/configuring-playbook-client-commet.md:89
+msgid "`just install-all` is useful for maintaining your setup quickly ([2x-5x faster](../CHANGELOG.md#2x-5x-performance-improvements-in-playbook-runtime) than `just setup-all`) when its components remain unchanged. If you adjust your `vars.yml` to remove other components, you'd need to run `just setup-all`, or these components will still remain installed. Note these shortcuts run the `ensure-matrix-users-created` tag too."
+msgstr ""
+
+#: ../../../docs/configuring-playbook-client-commet.md:91
+msgid "Troubleshooting"
+msgstr ""
+
+#: ../../../docs/configuring-playbook-client-commet.md:93
+msgid "As with all other services, you can find the logs in [systemd-journald](https://www.freedesktop.org/software/systemd/man/systemd-journald.service.html) by logging in to the server with SSH and running `journalctl -fu matrix-client-commet`."
+msgstr ""
@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: matrix-docker-ansible-deploy \n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2026-07-12 11:50+0000\n"
+"POT-Creation-Date: 2026-07-12 15:37+0000\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"
@@ -184,410 +184,414 @@ msgstr ""
 msgid "[Setting up FluffyChat Web](configuring-playbook-client-fluffychat-web.md), if you've enabled [FluffyChat Web](https://github.com/krille-chan/fluffychat), a cute cross-platform messenger (web, iOS, Android) for Matrix written in [Flutter](https://flutter.dev/)"
 msgstr ""

-#: ../../../docs/configuring-playbook.md:99
-msgid "Authentication and user-related"
+#: ../../../docs/configuring-playbook.md:98
+msgid "[Setting up Commet](configuring-playbook-client-commet.md), if you've enabled [Commet](https://github.com/commetchat/commet), a Matrix web client"
 msgstr ""

 #: ../../../docs/configuring-playbook.md:101
-msgid "Extend and modify how users are authenticated on your homeserver."
+msgid "Authentication and user-related"
 msgstr ""

 #: ../../../docs/configuring-playbook.md:103
-msgid "[Setting up Matrix Authentication Service](configuring-playbook-matrix-authentication-service.md) (Next-generation auth for Matrix, based on OAuth 2.0/OIDC)"
+msgid "Extend and modify how users are authenticated on your homeserver."
 msgstr ""

 #: ../../../docs/configuring-playbook.md:105
-msgid "[Setting up Appservice Double Puppet](configuring-playbook-appservice-double-puppet.md)"
+msgid "[Setting up Matrix Authentication Service](configuring-playbook-matrix-authentication-service.md) (Next-generation auth for Matrix, based on OAuth 2.0/OIDC)"
 msgstr ""

 #: ../../../docs/configuring-playbook.md:107
-msgid "[Setting up Ketesa](configuring-playbook-ketesa.md)"
+msgid "[Setting up Appservice Double Puppet](configuring-playbook-appservice-double-puppet.md)"
 msgstr ""

 #: ../../../docs/configuring-playbook.md:109
-msgid "[Setting up the REST authentication password provider module](configuring-playbook-rest-auth.md) (advanced)"
+msgid "[Setting up Ketesa](configuring-playbook-ketesa.md)"
 msgstr ""

 #: ../../../docs/configuring-playbook.md:111
-msgid "[Setting up the Shared Secret Auth password provider module](configuring-playbook-shared-secret-auth.md) (advanced)"
+msgid "[Setting up the REST authentication password provider module](configuring-playbook-rest-auth.md) (advanced)"
 msgstr ""

 #: ../../../docs/configuring-playbook.md:113
-msgid "[Setting up the LDAP authentication password provider module](configuring-playbook-ldap-auth.md) (advanced)"
+msgid "[Setting up the Shared Secret Auth password provider module](configuring-playbook-shared-secret-auth.md) (advanced)"
 msgstr ""

 #: ../../../docs/configuring-playbook.md:115
-msgid "[Setting up Synapse Simple Antispam](configuring-playbook-synapse-simple-antispam.md) (advanced)"
+msgid "[Setting up the LDAP authentication password provider module](configuring-playbook-ldap-auth.md) (advanced)"
 msgstr ""

 #: ../../../docs/configuring-playbook.md:117
-msgid "[Setting up Matrix User Verification Service](configuring-playbook-user-verification-service.md) (advanced)"
+msgid "[Setting up Synapse Simple Antispam](configuring-playbook-synapse-simple-antispam.md) (advanced)"
 msgstr ""

 #: ../../../docs/configuring-playbook.md:119
-msgid "File Storage"
+msgid "[Setting up Matrix User Verification Service](configuring-playbook-user-verification-service.md) (advanced)"
 msgstr ""

 #: ../../../docs/configuring-playbook.md:121
-msgid "Use alternative file storage to the default `media_store` folder."
+msgid "File Storage"
 msgstr ""

 #: ../../../docs/configuring-playbook.md:123
-msgid "[Storing Matrix media files using matrix-media-repo](configuring-playbook-matrix-media-repo.md)"
+msgid "Use alternative file storage to the default `media_store` folder."
 msgstr ""

 #: ../../../docs/configuring-playbook.md:125
-msgid "[Storing Synapse media files on Amazon S3 or another compatible Object Storage](configuring-playbook-s3.md)"
+msgid "[Storing Matrix media files using matrix-media-repo](configuring-playbook-matrix-media-repo.md)"
 msgstr ""

 #: ../../../docs/configuring-playbook.md:127
-msgid "[Storing Synapse media files on Amazon S3 with Goofys](configuring-playbook-s3-goofys.md)"
+msgid "[Storing Synapse media files on Amazon S3 or another compatible Object Storage](configuring-playbook-s3.md)"
 msgstr ""

 #: ../../../docs/configuring-playbook.md:129
-msgid "[Storing Synapse media files on Amazon S3 with synapse-s3-storage-provider](configuring-playbook-synapse-s3-storage-provider.md)"
+msgid "[Storing Synapse media files on Amazon S3 with Goofys](configuring-playbook-s3-goofys.md)"
 msgstr ""

 #: ../../../docs/configuring-playbook.md:131
-msgid "Bridging other networks"
+msgid "[Storing Synapse media files on Amazon S3 with synapse-s3-storage-provider](configuring-playbook-synapse-s3-storage-provider.md)"
 msgstr ""

 #: ../../../docs/configuring-playbook.md:133
-msgid "Bridges can be used to connect your Matrix installation with third-party communication networks."
+msgid "Bridging other networks"
 msgstr ""

 #: ../../../docs/configuring-playbook.md:135
-msgid "[Setting up a Generic Mautrix Bridge](configuring-playbook-bridge-mautrix-bridges.md) — a common guide for configuring mautrix bridges"
+msgid "Bridges can be used to connect your Matrix installation with third-party communication networks."
 msgstr ""

 #: ../../../docs/configuring-playbook.md:137
-msgid "[Setting up Mautrix Bluesky bridging](configuring-playbook-bridge-mautrix-bluesky.md)"
+msgid "[Setting up a Generic Mautrix Bridge](configuring-playbook-bridge-mautrix-bridges.md) — a common guide for configuring mautrix bridges"
 msgstr ""

 #: ../../../docs/configuring-playbook.md:139
-msgid "[Setting up Mautrix Discord bridging](configuring-playbook-bridge-mautrix-discord.md)"
+msgid "[Setting up Mautrix Bluesky bridging](configuring-playbook-bridge-mautrix-bluesky.md)"
 msgstr ""

 #: ../../../docs/configuring-playbook.md:141
-msgid "[Setting up Mautrix Telegram bridging](configuring-playbook-bridge-mautrix-telegram.md)"
+msgid "[Setting up Mautrix Discord bridging](configuring-playbook-bridge-mautrix-discord.md)"
 msgstr ""

 #: ../../../docs/configuring-playbook.md:143
-msgid "[Setting up Mautrix Slack bridging](configuring-playbook-bridge-mautrix-slack.md)"
+msgid "[Setting up Mautrix Telegram bridging](configuring-playbook-bridge-mautrix-telegram.md)"
 msgstr ""

 #: ../../../docs/configuring-playbook.md:145
-msgid "[Setting up Mautrix Google Messages bridging](configuring-playbook-bridge-mautrix-gmessages.md)"
+msgid "[Setting up Mautrix Slack bridging](configuring-playbook-bridge-mautrix-slack.md)"
 msgstr ""

 #: ../../../docs/configuring-playbook.md:147
-msgid "[Setting up Mautrix Whatsapp bridging](configuring-playbook-bridge-mautrix-whatsapp.md)"
+msgid "[Setting up Mautrix Google Messages bridging](configuring-playbook-bridge-mautrix-gmessages.md)"
 msgstr ""

 #: ../../../docs/configuring-playbook.md:149
-msgid "[Setting up Instagram bridging via Mautrix Meta](configuring-playbook-bridge-mautrix-meta-instagram.md)"
+msgid "[Setting up Mautrix Whatsapp bridging](configuring-playbook-bridge-mautrix-whatsapp.md)"
 msgstr ""

 #: ../../../docs/configuring-playbook.md:151
-msgid "[Setting up Messenger bridging via Mautrix Meta](configuring-playbook-bridge-mautrix-meta-messenger.md)"
+msgid "[Setting up Instagram bridging via Mautrix Meta](configuring-playbook-bridge-mautrix-meta-instagram.md)"
 msgstr ""

 #: ../../../docs/configuring-playbook.md:153
-msgid "[Setting up Mautrix Google Chat bridging](configuring-playbook-bridge-mautrix-googlechat.md)"
+msgid "[Setting up Messenger bridging via Mautrix Meta](configuring-playbook-bridge-mautrix-meta-messenger.md)"
 msgstr ""

 #: ../../../docs/configuring-playbook.md:155
-msgid "[Setting up Mautrix Twitter bridging](configuring-playbook-bridge-mautrix-twitter.md)"
+msgid "[Setting up Mautrix Google Chat bridging](configuring-playbook-bridge-mautrix-googlechat.md)"
 msgstr ""

 #: ../../../docs/configuring-playbook.md:157
-msgid "[Setting up Mautrix Signal bridging](configuring-playbook-bridge-mautrix-signal.md)"
+msgid "[Setting up Mautrix Twitter bridging](configuring-playbook-bridge-mautrix-twitter.md)"
 msgstr ""

 #: ../../../docs/configuring-playbook.md:159
-msgid "[Setting up Mautrix wsproxy for bridging Android SMS or Apple iMessage](configuring-playbook-bridge-mautrix-wsproxy.md)"
+msgid "[Setting up Mautrix Signal bridging](configuring-playbook-bridge-mautrix-signal.md)"
 msgstr ""

 #: ../../../docs/configuring-playbook.md:161
-msgid "[Setting up RustPush (iMessage) bridging](configuring-playbook-bridge-rustpush.md)"
+msgid "[Setting up Mautrix wsproxy for bridging Android SMS or Apple iMessage](configuring-playbook-bridge-mautrix-wsproxy.md)"
 msgstr ""

 #: ../../../docs/configuring-playbook.md:163
-msgid "[Setting up Appservice IRC bridging](configuring-playbook-bridge-appservice-irc.md)"
+msgid "[Setting up RustPush (iMessage) bridging](configuring-playbook-bridge-rustpush.md)"
 msgstr ""

 #: ../../../docs/configuring-playbook.md:165
-msgid "[Setting up Appservice Discord bridging](configuring-playbook-bridge-appservice-discord.md)"
+msgid "[Setting up Appservice IRC bridging](configuring-playbook-bridge-appservice-irc.md)"
 msgstr ""

 #: ../../../docs/configuring-playbook.md:167
-msgid "[Setting up Appservice Kakaotalk bridging](configuring-playbook-bridge-appservice-kakaotalk.md)"
+msgid "[Setting up Appservice Discord bridging](configuring-playbook-bridge-appservice-discord.md)"
 msgstr ""

 #: ../../../docs/configuring-playbook.md:169
-msgid "[Setting up Beeper LinkedIn bridging](configuring-playbook-bridge-beeper-linkedin.md)"
+msgid "[Setting up Appservice Kakaotalk bridging](configuring-playbook-bridge-appservice-kakaotalk.md)"
 msgstr ""

 #: ../../../docs/configuring-playbook.md:171
-msgid "[Setting up matrix-hookshot](configuring-playbook-bridge-hookshot.md) — a bridge between Matrix and multiple project management services, such as [GitHub](https://github.com), [GitLab](https://about.gitlab.com) and [JIRA](https://www.atlassian.com/software/jira)."
+msgid "[Setting up Beeper LinkedIn bridging](configuring-playbook-bridge-beeper-linkedin.md)"
 msgstr ""

 #: ../../../docs/configuring-playbook.md:173
-msgid "[Setting up MX Puppet GroupMe bridging](configuring-playbook-bridge-mx-puppet-groupme.md)"
+msgid "[Setting up matrix-hookshot](configuring-playbook-bridge-hookshot.md) — a bridge between Matrix and multiple project management services, such as [GitHub](https://github.com), [GitLab](https://about.gitlab.com) and [JIRA](https://www.atlassian.com/software/jira)."
 msgstr ""

 #: ../../../docs/configuring-playbook.md:175
-msgid "[Setting up Steam bridging](configuring-playbook-bridge-steam.md)"
+msgid "[Setting up MX Puppet GroupMe bridging](configuring-playbook-bridge-mx-puppet-groupme.md)"
 msgstr ""

 #: ../../../docs/configuring-playbook.md:177
-msgid "[Setting up MX Puppet Steam bridging](configuring-playbook-bridge-mx-puppet-steam.md)"
+msgid "[Setting up Steam bridging](configuring-playbook-bridge-steam.md)"
 msgstr ""

 #: ../../../docs/configuring-playbook.md:179
-msgid "[Setting up Postmoogle email bridging](configuring-playbook-bridge-postmoogle.md)"
+msgid "[Setting up MX Puppet Steam bridging](configuring-playbook-bridge-mx-puppet-steam.md)"
 msgstr ""

 #: ../../../docs/configuring-playbook.md:181
-msgid "[Setting up Matrix SMS bridging](configuring-playbook-bridge-matrix-bridge-sms.md)"
+msgid "[Setting up Postmoogle email bridging](configuring-playbook-bridge-postmoogle.md)"
 msgstr ""

 #: ../../../docs/configuring-playbook.md:183
-msgid "[Setting up Heisenbridge bouncer-style IRC bridging](configuring-playbook-bridge-heisenbridge.md)"
+msgid "[Setting up Matrix SMS bridging](configuring-playbook-bridge-matrix-bridge-sms.md)"
 msgstr ""

 #: ../../../docs/configuring-playbook.md:185
-msgid "[Setting up a Matrix <-> Meshtastic bridge](configuring-playbook-bridge-meshtastic-relay.md)"
+msgid "[Setting up Heisenbridge bouncer-style IRC bridging](configuring-playbook-bridge-heisenbridge.md)"
 msgstr ""

 #: ../../../docs/configuring-playbook.md:187
-msgid "[Setting up WeChat bridging](configuring-playbook-bridge-wechat.md)"
+msgid "[Setting up a Matrix <-> Meshtastic bridge](configuring-playbook-bridge-meshtastic-relay.md)"
 msgstr ""

 #: ../../../docs/configuring-playbook.md:189
-msgid "Bots"
+msgid "[Setting up WeChat bridging](configuring-playbook-bridge-wechat.md)"
 msgstr ""

 #: ../../../docs/configuring-playbook.md:191
-msgid "Bots provide various additional functionality to your installation."
+msgid "Bots"
 msgstr ""

 #: ../../../docs/configuring-playbook.md:193
-msgid "[Setting up baibot](configuring-playbook-bot-baibot.md) — a bot through which you can talk to various [AI](https://en.wikipedia.org/wiki/Artificial_intelligence) / [Large Language Models](https://en.wikipedia.org/wiki/Large_language_model) services (the privacy-first [Venice](configuring-playbook-bot-baibot.md#venice) we recommend, [OpenAI](https://openai.com/)'s [ChatGPT](https://openai.com/blog/chatgpt/), and [others](https://github.com/etkecc/baibot/blob/main/docs/providers.md))"
+msgid "Bots provide various additional functionality to your installation."
 msgstr ""

 #: ../../../docs/configuring-playbook.md:195
-msgid "[Setting up matrix-reminder-bot](configuring-playbook-bot-matrix-reminder-bot.md) — a bot to remind you about stuff"
+msgid "[Setting up baibot](configuring-playbook-bot-baibot.md) — a bot through which you can talk to various [AI](https://en.wikipedia.org/wiki/Artificial_intelligence) / [Large Language Models](https://en.wikipedia.org/wiki/Large_language_model) services (the privacy-first [Venice](configuring-playbook-bot-baibot.md#venice) we recommend, [OpenAI](https://openai.com/)'s [ChatGPT](https://openai.com/blog/chatgpt/), and [others](https://github.com/etkecc/baibot/blob/main/docs/providers.md))"
 msgstr ""

 #: ../../../docs/configuring-playbook.md:197
-msgid "[Setting up maubot](configuring-playbook-bot-maubot.md) — a plugin-based Matrix bot system"
+msgid "[Setting up matrix-reminder-bot](configuring-playbook-bot-matrix-reminder-bot.md) — a bot to remind you about stuff"
 msgstr ""

 #: ../../../docs/configuring-playbook.md:199
-msgid "[Setting up Honoroit](configuring-playbook-bot-honoroit.md) — a helpdesk bot"
+msgid "[Setting up maubot](configuring-playbook-bot-maubot.md) — a plugin-based Matrix bot system"
 msgstr ""

 #: ../../../docs/configuring-playbook.md:201
-msgid "[Setting up Mjolnir](configuring-playbook-bot-mjolnir.md) — a moderation tool/bot"
+msgid "[Setting up Honoroit](configuring-playbook-bot-honoroit.md) — a helpdesk bot"
 msgstr ""

 #: ../../../docs/configuring-playbook.md:203
-msgid "[Setting up Draupnir](configuring-playbook-bot-draupnir.md) — a moderation tool/bot, forked from Mjolnir and maintained by its former leader developer"
+msgid "[Setting up Mjolnir](configuring-playbook-bot-mjolnir.md) — a moderation tool/bot"
 msgstr ""

 #: ../../../docs/configuring-playbook.md:205
-msgid "[Setting up Draupnir for all/D4A](configuring-playbook-appservice-draupnir-for-all.md) — like the [Draupnir bot](configuring-playbook-bot-draupnir.md) mentioned above, but running in appservice mode and supporting multiple instances"
+msgid "[Setting up Draupnir](configuring-playbook-bot-draupnir.md) — a moderation tool/bot, forked from Mjolnir and maintained by its former leader developer"
 msgstr ""

 #: ../../../docs/configuring-playbook.md:207
-msgid "[Setting up Buscarron](configuring-playbook-bot-buscarron.md) — a bot you can use to send any form (HTTP POST, HTML) to a (encrypted) Matrix room"
+msgid "[Setting up Draupnir for all/D4A](configuring-playbook-appservice-draupnir-for-all.md) — like the [Draupnir bot](configuring-playbook-bot-draupnir.md) mentioned above, but running in appservice mode and supporting multiple instances"
 msgstr ""

 #: ../../../docs/configuring-playbook.md:209
-msgid "Administration"
+msgid "[Setting up Buscarron](configuring-playbook-bot-buscarron.md) — a bot you can use to send any form (HTTP POST, HTML) to a (encrypted) Matrix room"
 msgstr ""

 #: ../../../docs/configuring-playbook.md:211
-msgid "Services that help you in administrating and monitoring your Matrix installation."
+msgid "Administration"
 msgstr ""

 #: ../../../docs/configuring-playbook.md:213
-msgid "[Setting up Prometheus Alertmanager integration via matrix-alertmanager-receiver](configuring-playbook-alertmanager-receiver.md)"
+msgid "Services that help you in administrating and monitoring your Matrix installation."
 msgstr ""

 #: ../../../docs/configuring-playbook.md:215
-msgid "[Enabling metrics and graphs (Prometheus, Grafana) for your Matrix server](configuring-playbook-prometheus-grafana.md)"
+msgid "[Setting up Prometheus Alertmanager integration via matrix-alertmanager-receiver](configuring-playbook-alertmanager-receiver.md)"
 msgstr ""

 #: ../../../docs/configuring-playbook.md:217
-msgid "[Setting up the rageshake bug report server](configuring-playbook-rageshake.md)"
+msgid "[Enabling metrics and graphs (Prometheus, Grafana) for your Matrix server](configuring-playbook-prometheus-grafana.md)"
 msgstr ""

 #: ../../../docs/configuring-playbook.md:219
-msgid "[Enabling synapse-usage-exporter for Synapse usage statistics](configuring-playbook-synapse-usage-exporter.md)"
+msgid "[Setting up the rageshake bug report server](configuring-playbook-rageshake.md)"
 msgstr ""

 #: ../../../docs/configuring-playbook.md:221
+msgid "[Enabling synapse-usage-exporter for Synapse usage statistics](configuring-playbook-synapse-usage-exporter.md)"
+msgstr ""
+
+#: ../../../docs/configuring-playbook.md:223
 msgid "Backups:"
 msgstr ""

-#: ../../../docs/configuring-playbook.md:222
+#: ../../../docs/configuring-playbook.md:224
 msgid "[Setting up BorgBackup](configuring-playbook-backup-borg.md) — a full Matrix server backup solution, including the Postgres database"
 msgstr ""

-#: ../../../docs/configuring-playbook.md:224
+#: ../../../docs/configuring-playbook.md:226
 msgid "[Setting up Postgres backup](configuring-playbook-postgres-backup.md) — a Postgres-database backup solution (note: does not include other files)"
 msgstr ""

-#: ../../../docs/configuring-playbook.md:226
+#: ../../../docs/configuring-playbook.md:228
 msgid "Other specialized services"
 msgstr ""

-#: ../../../docs/configuring-playbook.md:228
+#: ../../../docs/configuring-playbook.md:230
 msgid "Various services that don't fit any other categories."
 msgstr ""

-#: ../../../docs/configuring-playbook.md:230
+#: ../../../docs/configuring-playbook.md:232
 msgid "[Setting up Element Call](configuring-playbook-element-call.md) — a native Matrix video conferencing application, built on top of the [Matrix RTC stack](configuring-playbook-matrix-rtc.md) (optional)"
 msgstr ""

-#: ../../../docs/configuring-playbook.md:232
+#: ../../../docs/configuring-playbook.md:234
 msgid "[Setting up LiveKit JWT Service](configuring-playbook-livekit-jwt-service.md) - a component of the [Matrix RTC stack](configuring-playbook-matrix-rtc.md) (optional)"
 msgstr ""

-#: ../../../docs/configuring-playbook.md:234
+#: ../../../docs/configuring-playbook.md:236
 msgid "[Setting up LiveKit Server](configuring-playbook-livekit-server.md) - a component of the [Matrix RTC stack](configuring-playbook-matrix-rtc.md) (optional)"
 msgstr ""

-#: ../../../docs/configuring-playbook.md:236
+#: ../../../docs/configuring-playbook.md:238
 msgid "[Setting up Matrix RTC](configuring-playbook-matrix-rtc.md) (optional)"
 msgstr ""

-#: ../../../docs/configuring-playbook.md:238
+#: ../../../docs/configuring-playbook.md:240
 msgid "[Setting up synapse-auto-compressor](configuring-playbook-synapse-auto-compressor.md) for compressing the database on Synapse homeservers"
 msgstr ""

-#: ../../../docs/configuring-playbook.md:240
+#: ../../../docs/configuring-playbook.md:242
 msgid "[Setting up Matrix Corporal](configuring-playbook-matrix-corporal.md) (advanced)"
 msgstr ""

-#: ../../../docs/configuring-playbook.md:242
+#: ../../../docs/configuring-playbook.md:244
 msgid "[Setting up Matrix.to](configuring-playbook-matrixto.md)"
 msgstr ""

-#: ../../../docs/configuring-playbook.md:244
+#: ../../../docs/configuring-playbook.md:246
 msgid "[Setting up Etherpad](configuring-playbook-etherpad.md)"
 msgstr ""

-#: ../../../docs/configuring-playbook.md:246
+#: ../../../docs/configuring-playbook.md:248
 msgid "[Setting up the Jitsi video-conferencing platform](configuring-playbook-jitsi.md)"
 msgstr ""

-#: ../../../docs/configuring-playbook.md:248
+#: ../../../docs/configuring-playbook.md:250
 msgid "[Setting up Cactus Comments](configuring-playbook-cactus-comments.md) — a federated comment system built on Matrix"
 msgstr ""

-#: ../../../docs/configuring-playbook.md:250
+#: ../../../docs/configuring-playbook.md:252
 msgid "[Setting up Pantalaimon (E2EE aware proxy daemon)](configuring-playbook-pantalaimon.md) (advanced)"
 msgstr ""

-#: ../../../docs/configuring-playbook.md:252
+#: ../../../docs/configuring-playbook.md:254
 msgid "[Setting up the Sygnal push gateway](configuring-playbook-sygnal.md)"
 msgstr ""

-#: ../../../docs/configuring-playbook.md:254
+#: ../../../docs/configuring-playbook.md:256
 msgid "[Setting up the ntfy push notifications server](configuring-playbook-ntfy.md)"
 msgstr ""

-#: ../../../docs/configuring-playbook.md:256
+#: ../../../docs/configuring-playbook.md:258
 msgid "Deprecated / unmaintained / removed services"
 msgstr ""

-#: ../../../docs/configuring-playbook.md:258
+#: ../../../docs/configuring-playbook.md:260
 msgid "**Note**: since a deprecated or unmaintained service will not be updated, its bug or vulnerability will be unlikely to get patched. It is recommended to migrate from the service to an alternative if any, and make sure to do your own research before you decide to keep it running nonetheless."
 msgstr ""

-#: ../../../docs/configuring-playbook.md:260
+#: ../../../docs/configuring-playbook.md:262
 msgid "[Configuring conduwuit](configuring-playbook-conduwuit.md) (removed; this component has been abandoned and unmaintained)"
 msgstr ""

-#: ../../../docs/configuring-playbook.md:262
+#: ../../../docs/configuring-playbook.md:264
 msgid "[Setting up the Sliding Sync proxy](configuring-playbook-sliding-sync-proxy.md) for clients which require Sliding Sync support (like old Element X versions, before it got switched to Simplified Sliding Sync)"
 msgstr ""

-#: ../../../docs/configuring-playbook.md:264
+#: ../../../docs/configuring-playbook.md:266
 msgid "[Setting up Appservice Slack bridging](configuring-playbook-bridge-appservice-slack.md) (removed; this component has been discontinued)"
 msgstr ""

-#: ../../../docs/configuring-playbook.md:266
+#: ../../../docs/configuring-playbook.md:268
 msgid "[Setting up Appservice Webhooks bridging](configuring-playbook-bridge-appservice-webhooks.md) (deprecated; the bridge's author suggests taking a look at [matrix-hookshot](https://github.com/matrix-org/matrix-hookshot) as a replacement, which can also be [installed using this playbook](configuring-playbook-bridge-hookshot.md))"
 msgstr ""

-#: ../../../docs/configuring-playbook.md:268
+#: ../../../docs/configuring-playbook.md:270
 msgid "[Setting up the Dimension integration manager](configuring-playbook-dimension.md) ([unmaintained](https://github.com/spantaleev/matrix-docker-ansible-deploy/issues/2806#issuecomment-1673559299); after [installing](installing.md))"
 msgstr ""

-#: ../../../docs/configuring-playbook.md:270
+#: ../../../docs/configuring-playbook.md:272
 msgid "[Setting up Email2Matrix](configuring-playbook-email2matrix.md) (removed; the author suggests taking a look at [Postmoogle](https://github.com/etkecc/postmoogle) as a replacement, which can also be [installed using this playbook](configuring-playbook-bridge-postmoogle.md))"
 msgstr ""

-#: ../../../docs/configuring-playbook.md:272
+#: ../../../docs/configuring-playbook.md:274
 msgid "[Setting up Go-NEB](configuring-playbook-bot-go-neb.md) (unmaintained; the bridge's author suggests taking a look at [matrix-hookshot](https://github.com/matrix-org/matrix-hookshot) as a replacement, which can also be [installed using this playbook](configuring-playbook-bridge-hookshot.md))"
 msgstr ""

-#: ../../../docs/configuring-playbook.md:274
+#: ../../../docs/configuring-playbook.md:276
 msgid "[Setting up Go Skype Bridge bridging](configuring-playbook-bridge-go-skype-bridge.md) (removed; Skype has been discontinued since May 2025)"
 msgstr ""

-#: ../../../docs/configuring-playbook.md:276
+#: ../../../docs/configuring-playbook.md:278
 msgid "[Setting up ma1sd Identity Server](configuring-playbook-ma1sd.md) (removed; this component has been unmaintained for a long time, so it has been removed from the playbook.)"
 msgstr ""

-#: ../../../docs/configuring-playbook.md:278
+#: ../../../docs/configuring-playbook.md:280
 msgid "[Setting up matrix-bot-chatgpt](configuring-playbook-bot-chatgpt.md) (unmaintained; the bridge's author suggests taking a look at [baibot](https://github.com/etkecc/baibot) as a replacement, which can also be [installed using this playbook](configuring-playbook-bot-baibot.md))"
 msgstr ""

-#: ../../../docs/configuring-playbook.md:280
+#: ../../../docs/configuring-playbook.md:282
 msgid "[Setting up matrix-ldap-registration-proxy](configuring-playbook-matrix-ldap-registration-proxy.md) (removed; the repository of the source code has been removed)"
 msgstr ""

-#: ../../../docs/configuring-playbook.md:282
+#: ../../../docs/configuring-playbook.md:284
 msgid "[Setting up matrix-registration](configuring-playbook-matrix-registration.md) (removed; this component has been unmaintained)"
 msgstr ""

-#: ../../../docs/configuring-playbook.md:284
+#: ../../../docs/configuring-playbook.md:286
 msgid "[Setting up matrix-registration-bot](configuring-playbook-bot-matrix-registration-bot.md) (removed; this component has been unmaintained)"
 msgstr ""

-#: ../../../docs/configuring-playbook.md:286
+#: ../../../docs/configuring-playbook.md:288
 msgid "[Setting up Mautrix Facebook bridging](configuring-playbook-bridge-mautrix-facebook.md) (deprecated in favor of the Messenger/Instagram bridge with [mautrix-meta-messenger](configuring-playbook-bridge-mautrix-meta-messenger.md))"
 msgstr ""

-#: ../../../docs/configuring-playbook.md:288
+#: ../../../docs/configuring-playbook.md:290
 msgid "[Setting up Mautrix Instagram bridging](configuring-playbook-bridge-mautrix-instagram.md) (deprecated in favor of the Messenger/Instagram bridge with [mautrix-meta-instagram](configuring-playbook-bridge-mautrix-meta-instagram.md))"
 msgstr ""

-#: ../../../docs/configuring-playbook.md:290
+#: ../../../docs/configuring-playbook.md:292
 msgid "[Setting up MX Puppet Discord bridging](configuring-playbook-bridge-mx-puppet-discord.md) (removed; this component has been unmaintained for a long time, so it has been removed from the playbook. Consider [setting up Mautrix Discord bridging](configuring-playbook-bridge-mautrix-discord.md))"
 msgstr ""

-#: ../../../docs/configuring-playbook.md:292
+#: ../../../docs/configuring-playbook.md:294
 msgid "[Setting up MX Puppet Instagram bridging](configuring-playbook-bridge-mx-puppet-instagram.md) (removed; this component has been unmaintained for a long time, so it has been removed from the playbook. Consider [setting up Instagram bridging via Mautrix Meta](configuring-playbook-bridge-mautrix-meta-instagram.md))"
 msgstr ""

-#: ../../../docs/configuring-playbook.md:294
+#: ../../../docs/configuring-playbook.md:296
 msgid "[Setting up MX Puppet Skype bridging](configuring-playbook-bridge-mx-puppet-skype.md) (removed; this component has been broken for a long time, so it has been removed from the playbook. Consider [setting up Go Skype Bridge bridging](configuring-playbook-bridge-go-skype-bridge.md))"
 msgstr ""

-#: ../../../docs/configuring-playbook.md:296
+#: ../../../docs/configuring-playbook.md:298
 msgid "[Setting up MX Puppet Slack bridging](configuring-playbook-bridge-mx-puppet-slack.md) (removed; this component has been unmaintained for a long time, so it has been removed from the playbook. Consider [setting up Mautrix Slack bridging](configuring-playbook-bridge-mautrix-slack.md))"
 msgstr ""

-#: ../../../docs/configuring-playbook.md:298
+#: ../../../docs/configuring-playbook.md:300
 msgid "[Setting up MX Puppet Twitter bridging](configuring-playbook-bridge-mx-puppet-twitter.md) (removed; this component has been unmaintained for a long time, so it has been removed from the playbook. Consider [setting up Mautrix Twitter bridging](configuring-playbook-bridge-mautrix-twitter.md))"
 msgstr ""

-#: ../../../docs/configuring-playbook.md:300
+#: ../../../docs/configuring-playbook.md:302
 msgid "[Setting up Synapse Auto Invite Accept](configuring-playbook-synapse-auto-accept-invite.md) (removed; since Synapse [v1.109.0](https://github.com/element-hq/synapse/releases/tag/v1.109.0) the same feature is available natively.)"
 msgstr ""
@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: matrix-docker-ansible-deploy \n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2026-02-13 10:32+0000\n"
+"POT-Creation-Date: 2026-07-15 04:33+0000\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"
@@ -181,73 +181,81 @@ msgid "On the base domain's server (e.g. `example.com`), you can set up reverse-
 msgstr ""

 #: ../../../docs/configuring-well-known.md:115
-msgid "With this method, you **don't need** to add special HTTP headers for [CORS](https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS) reasons (like `Access-Control-Allow-Origin`), because your Matrix server (where requests ultimately go) will be configured by this playbook correctly."
+msgid "With reverse-proxying, you **don't need** to add special HTTP headers for [CORS](https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS) reasons (like `Access-Control-Allow-Origin`), because your Matrix server (where requests ultimately go) will be configured by this playbook correctly."
 msgstr ""

 #: ../../../docs/configuring-well-known.md:117
+msgid "If you use a 302 redirect instead, be aware that browsers apply CORS checks to every response in the redirect chain, so the redirect response itself must also carry an `Access-Control-Allow-Origin: *` header. Otherwise, web-based Matrix clients (like Element Web) may fail to work even though the final destination sets the header correctly."
+msgstr ""
+
+#: ../../../docs/configuring-well-known.md:119
 msgid "**For nginx**, it would be something like this:"
 msgstr ""

-#: ../../../docs/configuring-well-known.md:134
+#: ../../../docs/configuring-well-known.md:136
 msgid "**For Apache2**, it would be something like this:"
 msgstr ""

-#: ../../../docs/configuring-well-known.md:148
+#: ../../../docs/configuring-well-known.md:150
 msgid "**For Caddy 2**, it would be something like this:"
 msgstr ""

-#: ../../../docs/configuring-well-known.md:158
-msgid "**For HAProxy**, it would be something like this:"
+#: ../../../docs/configuring-well-known.md:160
+msgid "**Note**: Caddy does not process directives in the order they appear in the Caddyfile, but according to its own [directive order](https://caddyserver.com/docs/caddyfile/directives#directive-order). Notably, `redir` is evaluated before `reverse_proxy`, so a `redir` elsewhere in the same site block (a common way to send the base domain to `www.example.com` or to another site) takes precedence and breaks the well-known reverse-proxying. In such cases, wrap the directives in [`handle`](https://caddyserver.com/docs/caddyfile/directives/handle) blocks to enforce the intended priority:"
 msgstr ""

 #: ../../../docs/configuring-well-known.md:177
+msgid "**For HAProxy**, it would be something like this:"
+msgstr ""
+
+#: ../../../docs/configuring-well-known.md:196
 msgid "**For Netlify**, configure a [redirect](https://docs.netlify.com/routing/redirects/) using a `_redirects` file in the [publish directory](https://docs.netlify.com/configure-builds/overview/#definitions) with contents like this:"
 msgstr ""

-#: ../../../docs/configuring-well-known.md:183
+#: ../../../docs/configuring-well-known.md:202
 msgid "**For AWS CloudFront**"
 msgstr ""

-#: ../../../docs/configuring-well-known.md:185
+#: ../../../docs/configuring-well-known.md:204
 msgid "Add a custom origin with matrix.example.com to your distribution"
 msgstr ""

-#: ../../../docs/configuring-well-known.md:186
+#: ../../../docs/configuring-well-known.md:205
 msgid "Add two behaviors, one for `.well-known/matrix/client` and one for `.well-known/matrix/server` and point them to your new origin."
 msgstr ""

-#: ../../../docs/configuring-well-known.md:188
+#: ../../../docs/configuring-well-known.md:207
 msgid "Make sure to:"
 msgstr ""

-#: ../../../docs/configuring-well-known.md:190
+#: ../../../docs/configuring-well-known.md:209
 msgid "**replace `example.com`** in the server configuration with your actual domain name"
 msgstr ""

-#: ../../../docs/configuring-well-known.md:191
+#: ../../../docs/configuring-well-known.md:210
 msgid "and: to **do this for the HTTPS-enabled server block**, as that's where Matrix expects the file to be"
 msgstr ""

-#: ../../../docs/configuring-well-known.md:193
+#: ../../../docs/configuring-well-known.md:212
 msgid "Confirming it works"
 msgstr ""

-#: ../../../docs/configuring-well-known.md:195
+#: ../../../docs/configuring-well-known.md:214
 msgid "No matter which method you've used to set up the well-known files, if you've done it correctly you should be able to see a JSON file at these URLs:"
 msgstr ""

-#: ../../../docs/configuring-well-known.md:197
+#: ../../../docs/configuring-well-known.md:216
 msgid "`https://example.com/.well-known/matrix/server`"
 msgstr ""

-#: ../../../docs/configuring-well-known.md:198
+#: ../../../docs/configuring-well-known.md:217
 msgid "`https://example.com/.well-known/matrix/client`"
 msgstr ""

-#: ../../../docs/configuring-well-known.md:199
+#: ../../../docs/configuring-well-known.md:218
 msgid "`https://example.com/.well-known/matrix/support`"
 msgstr ""

-#: ../../../docs/configuring-well-known.md:201
+#: ../../../docs/configuring-well-known.md:220
 msgid "You can also check if everything is configured correctly, by [checking if services work](maintenance-and-troubleshooting.md#how-to-check-if-services-work)."
 msgstr ""
@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: matrix-docker-ansible-deploy \n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2026-02-13 10:32+0000\n"
+"POT-Creation-Date: 2026-07-15 04:33+0000\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"
@@ -25,7 +25,7 @@ msgid "You can manually import your database from a previous default installatio
 msgstr ""

 #: ../../../docs/importing-postgres.md:14
-#: ../../../docs/importing-postgres.md:38
+#: ../../../docs/importing-postgres.md:43
 msgid "**Notes**:"
 msgstr ""

@@ -57,98 +57,106 @@ msgstr ""
 msgid "Before doing the actual import, **you need to upload your Postgres dump file to the server** (any path is okay)."
 msgstr ""

-#: ../../../docs/importing-postgres.md:28
+#: ../../../docs/importing-postgres.md:29
+msgid "Do not import into a database that already contains tables (e.g. one that a service has already initialized and used). As the [official Synapse backup guide](https://element-hq.github.io/synapse/latest/usage/administration/backups.html) puts it: at best this will error, at worst it will lead to subtle database inconsistencies. Import into an empty (freshly created) database instead."
+msgstr ""
+
+#: ../../../docs/importing-postgres.md:31
+msgid "**Note for Synapse users restoring an older backup**: if the server kept running (and users kept chatting) after the backup you are restoring was made, truncate the `e2e_one_time_keys_json` table after importing and before starting Synapse. Restoring an older backup can otherwise cause already-used one-time keys to be re-issued, leading to message decryption errors for your users. You can do this by [getting a database terminal](maintenance-postgres.md#getting-a-database-terminal), connecting to the Synapse database (`\\c synapse`) and running `TRUNCATE e2e_one_time_keys_json;`. Clients will generate and upload fresh one-time keys automatically."
+msgstr ""
+
+#: ../../../docs/importing-postgres.md:33
 msgid "Importing"
 msgstr ""

-#: ../../../docs/importing-postgres.md:30
+#: ../../../docs/importing-postgres.md:35
 msgid "To import, run this command (make sure to replace `SERVER_PATH_TO_POSTGRES_DUMP_FILE` with a file path on your server):"
 msgstr ""

-#: ../../../docs/importing-postgres.md:40
+#: ../../../docs/importing-postgres.md:45
 msgid "`SERVER_PATH_TO_POSTGRES_DUMP_FILE` must be a file path to a Postgres dump file on the server (not on your local machine!)"
 msgstr ""

-#: ../../../docs/importing-postgres.md:41
+#: ../../../docs/importing-postgres.md:46
 msgid "`postgres_default_import_database` defaults to `matrix`, which is useful for importing multiple databases (for dumps made with `pg_dumpall`). If you're importing a single database (e.g. `synapse`), consider changing `postgres_default_import_database` accordingly"
 msgstr ""

-#: ../../../docs/importing-postgres.md:42
+#: ../../../docs/importing-postgres.md:47
 msgid "after importing a large database, it's a good idea to run [an `ANALYZE` operation](https://www.postgresql.org/docs/current/sql-analyze.html) to make Postgres rebuild its database statistics and optimize its query planner. You can easily do this via the playbook by running `just run-tags run-postgres-vacuum -e postgres_vacuum_preset=analyze` (see [Vacuuming PostgreSQL](maintenance-postgres.md#vacuuming-postgresql) for more details)."
 msgstr ""

-#: ../../../docs/importing-postgres.md:44
+#: ../../../docs/importing-postgres.md:49
 msgid "Troubleshooting"
 msgstr ""

-#: ../../../docs/importing-postgres.md:46
+#: ../../../docs/importing-postgres.md:51
 msgid "Table Ownership"
 msgstr ""

-#: ../../../docs/importing-postgres.md:48
+#: ../../../docs/importing-postgres.md:53
 msgid "A table ownership issue can occur if you are importing from a Synapse installation which was both:"
 msgstr ""

-#: ../../../docs/importing-postgres.md:50
+#: ../../../docs/importing-postgres.md:55
 msgid "migrated from SQLite to Postgres, and"
 msgstr ""

-#: ../../../docs/importing-postgres.md:51
+#: ../../../docs/importing-postgres.md:56
 msgid "used a username other than 'synapse'"
 msgstr ""

-#: ../../../docs/importing-postgres.md:53
+#: ../../../docs/importing-postgres.md:58
 msgid "In this case you may run into the following error during the import task:"
 msgstr ""

-#: ../../../docs/importing-postgres.md:59
+#: ../../../docs/importing-postgres.md:64
 msgid "where `synapse_user` is the database username from the previous Synapse installation."
 msgstr ""

-#: ../../../docs/importing-postgres.md:61
+#: ../../../docs/importing-postgres.md:66
 msgid "This can be verified by examining the dump for ALTER TABLE statements which set OWNER TO that username:"
 msgstr ""

-#: ../../../docs/importing-postgres.md:73
+#: ../../../docs/importing-postgres.md:78
 msgid "It can be worked around by changing the username to `synapse`, for example by using `sed`:"
 msgstr ""

-#: ../../../docs/importing-postgres.md:79
+#: ../../../docs/importing-postgres.md:84
 msgid "This uses sed to perform an 'in-place' (`-i`) replacement globally (`/g`), searching for `synapse_user` and replacing with `synapse` (`s/synapse_user/synapse`). If your database username was different, change `synapse_user` to that username instead. Expand search/replace statement as shown in example above, in case of old user name like `matrix` — replacing `matrix` only would… well — you can imagine."
 msgstr ""

-#: ../../../docs/importing-postgres.md:81
+#: ../../../docs/importing-postgres.md:86
 msgid "Note that if the previous import failed with an error it may have made changes which are incompatible with re-running the import task right away; if you do so it may fail with an error such as:"
 msgstr ""

-#: ../../../docs/importing-postgres.md:87
+#: ../../../docs/importing-postgres.md:92
 msgid "Repeat import"
 msgstr ""

-#: ../../../docs/importing-postgres.md:89
+#: ../../../docs/importing-postgres.md:94
 msgid "In this case you can use the command suggested in the import task to clear the database before retrying the import:"
 msgstr ""

-#: ../../../docs/importing-postgres.md:97
+#: ../../../docs/importing-postgres.md:102
 msgid "Now on your local machine run `just run-tags setup-postgres` to prepare the database roles etc."
 msgstr ""

-#: ../../../docs/importing-postgres.md:99
+#: ../../../docs/importing-postgres.md:104
 msgid "If not, you probably get this error. `synapse` is the correct table owner, but the role is missing in database."
 msgstr ""

-#: ../../../docs/importing-postgres.md:105
+#: ../../../docs/importing-postgres.md:110
 msgid "Once the database is clear and the ownership of the tables has been fixed in the SQL file, the import task should succeed."
 msgstr ""

-#: ../../../docs/importing-postgres.md:107
+#: ../../../docs/importing-postgres.md:112
 msgid "Check, if `--dbname` is set to `synapse` (not `matrix`) and replace paths (or even better, copy this line from your terminal)"
 msgstr ""

-#: ../../../docs/importing-postgres.md:113
+#: ../../../docs/importing-postgres.md:118
 msgid "Hints"
 msgstr ""

-#: ../../../docs/importing-postgres.md:115
+#: ../../../docs/importing-postgres.md:120
 msgid "To open psql terminal run `/matrix/postgres/bin/cli`"
 msgstr ""
@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: matrix-docker-ansible-deploy \n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2026-02-13 10:32+0000\n"
+"POT-Creation-Date: 2026-07-15 04:33+0000\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"
@@ -33,25 +33,29 @@ msgid "Before doing the actual data restore, **you need to upload your media sto
 msgstr ""

 #: ../../../docs/importing-synapse-media-store.md:16
-msgid "If you are [storing Matrix media files on Amazon S3](configuring-playbook-s3.md) (optional), restoring with this tool is not possible right now."
+msgid "You also need the [rsync](https://rsync.samba.org/) utility installed **on the server**, as the import performs a server-side `rsync` synchronization. The playbook does not install it for you. On most distributions, it is available as a package called `rsync`."
 msgstr ""

 #: ../../../docs/importing-synapse-media-store.md:18
-msgid "As an alternative, you can perform a manual restore using the [AWS CLI tool](https://aws.amazon.com/cli/) (e.g. `aws s3 sync /path/to/server/media_store/. s3://name-of-bucket/`)"
+msgid "If you are [storing Matrix media files on Amazon S3](configuring-playbook-s3.md) (optional), restoring with this tool is not possible right now."
 msgstr ""

 #: ../../../docs/importing-synapse-media-store.md:20
-msgid "**Note for Mac users**: Due to case-sensitivity issues on certain Mac filesystems (HFS or HFS+), filename corruption may occur if you copy a `media_store` directory to your Mac. If you're transferring a `media_store` directory between 2 servers, make sure you do it directly (from server to server with a tool such as [rsync](https://rsync.samba.org/)), and not by downloading the files to your Mac."
+msgid "As an alternative, you can perform a manual restore using the [AWS CLI tool](https://aws.amazon.com/cli/) (e.g. `aws s3 sync /path/to/server/media_store/. s3://name-of-bucket/`)"
 msgstr ""

 #: ../../../docs/importing-synapse-media-store.md:22
-msgid "Importing"
+msgid "**Note for Mac users**: Due to case-sensitivity issues on certain Mac filesystems (HFS or HFS+), filename corruption may occur if you copy a `media_store` directory to your Mac. If you're transferring a `media_store` directory between 2 servers, make sure you do it directly (from server to server with a tool such as [rsync](https://rsync.samba.org/)), and not by downloading the files to your Mac."
 msgstr ""

 #: ../../../docs/importing-synapse-media-store.md:24
+msgid "Importing"
+msgstr ""
+
+#: ../../../docs/importing-synapse-media-store.md:26
 msgid "Run this command (make sure to replace `<server-path-to-media_store>` with a path on your server):"
 msgstr ""

-#: ../../../docs/importing-synapse-media-store.md:30
+#: ../../../docs/importing-synapse-media-store.md:32
 msgid "**Note**: `<server-path-to-media_store>` must be a file path to a `media_store` directory on the server (not on your local machine!)."
 msgstr ""
@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: matrix-docker-ansible-deploy \n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2026-06-29 17:50+0000\n"
+"POT-Creation-Date: 2026-07-12 15:37+0000\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"
@@ -77,245 +77,249 @@ msgid "If you **do** use SSH keys for authentication, **and** use a non-root use
 msgstr ""

 #: ../../../docs/installing.md:44
-msgid "There 2 ways to start the installation process — depending on whether you're [Installing a brand new server (without importing data)](#installing-a-brand-new-server-without-importing-data) or [Installing a server into which you'll import old data](#installing-a-server-into-which-youll-import-old-data)."
+msgid "Instead of typing the sudo password on each run (`-K`) or storing it in plain text in the inventory hosts file, you can also pull it from the [pass](https://www.passwordstore.org/) password manager by adding `ansible_become_password='{{ lookup(\"community.general.passwordstore\", \"path/to/password\") }}'` to your host line. See the [passwordstore lookup documentation](https://docs.ansible.com/ansible/latest/collections/community/general/passwordstore_lookup.html) for more details."
 msgstr ""

 #: ../../../docs/installing.md:46
-msgid "**Note**: if you are migrating from an old server to a new one, take a look at [this guide](maintenance-migrating.md) instead. This is an easier and more straightforward way than installing a server and importing old data into it."
+msgid "There 2 ways to start the installation process — depending on whether you're [Installing a brand new server (without importing data)](#installing-a-brand-new-server-without-importing-data) or [Installing a server into which you'll import old data](#installing-a-server-into-which-youll-import-old-data)."
 msgstr ""

 #: ../../../docs/installing.md:48
-msgid "Installing a brand new server (without importing data)"
+msgid "**Note**: if you are migrating from an old server to a new one, take a look at [this guide](maintenance-migrating.md) instead. This is an easier and more straightforward way than installing a server and importing old data into it."
 msgstr ""

 #: ../../../docs/installing.md:50
+msgid "Installing a brand new server (without importing data)"
+msgstr ""
+
+#: ../../../docs/installing.md:52
 msgid "If this is **a brand new** Matrix server and you **won't be importing old data into it**, run all these tags:"
 msgstr ""

-#: ../../../docs/installing.md:56
+#: ../../../docs/installing.md:58
 msgid "This will do a full installation and start all Matrix services."
 msgstr ""

-#: ../../../docs/installing.md:58
+#: ../../../docs/installing.md:60
 msgid "**Note**: if the command does not work as expected, make sure that you have properly installed and configured software required to run the playbook, as described on [Prerequisites](prerequisites.md)."
 msgstr ""

-#: ../../../docs/installing.md:60
+#: ../../../docs/installing.md:62
 msgid "Installing a server into which you'll import old data"
 msgstr ""

-#: ../../../docs/installing.md:62
+#: ../../../docs/installing.md:64
 msgid "If you will be importing data into your newly created Matrix server, install it, but **do not** start its services just yet. Starting its services or messing with its database now will affect your data import later on."
 msgstr ""

-#: ../../../docs/installing.md:64
+#: ../../../docs/installing.md:66
 msgid "To do the installation **without** starting services, run `ansible-playbook` with the `install-all` tag only:"
 msgstr ""

-#: ../../../docs/installing.md:71
+#: ../../../docs/installing.md:73
 msgid "Do not run the just \"recipe\" `just install-all` instead, because it automatically starts services at the end of execution. See: [Difference between playbook tags and shortcuts](just.md#difference-between-playbook-tags-and-shortcuts)"
 msgstr ""

-#: ../../../docs/installing.md:73
+#: ../../../docs/installing.md:75
 msgid "When this command completes, services won't be running yet."
 msgstr ""

-#: ../../../docs/installing.md:75
+#: ../../../docs/installing.md:77
 msgid "You can now:"
 msgstr ""

-#: ../../../docs/installing.md:77
+#: ../../../docs/installing.md:79
 msgid "[Importing an existing SQLite database (from another Synapse installation)](importing-synapse-sqlite.md) (optional)"
 msgstr ""

-#: ../../../docs/installing.md:79
+#: ../../../docs/installing.md:81
 msgid "[Importing an existing Postgres database (from another installation)](importing-postgres.md) (optional)"
 msgstr ""

-#: ../../../docs/installing.md:81
+#: ../../../docs/installing.md:83
 msgid "[Importing `media_store` data files from an existing Synapse installation](importing-synapse-media-store.md) (optional)"
 msgstr ""

-#: ../../../docs/installing.md:83
+#: ../../../docs/installing.md:85
 msgid "… and then proceed to starting all services:"
 msgstr ""

-#: ../../../docs/installing.md:89
+#: ../../../docs/installing.md:91
 msgid "Create your user account"
 msgstr ""

-#: ../../../docs/installing.md:91
+#: ../../../docs/installing.md:93
 msgid "ℹ️ *You can skip this step if you have installed a server and imported old data to it.*"
 msgstr ""

-#: ../../../docs/installing.md:93
+#: ../../../docs/installing.md:95
 msgid "As you have configured your brand new server and the client, you need to **create your user account** on your Matrix server."
 msgstr ""

-#: ../../../docs/installing.md:95
+#: ../../../docs/installing.md:97
 msgid "After creating the user account, you can log in to it with [Element Web](configuring-playbook-client-element-web.md) that this playbook has installed for you at this URL: `https://element.example.com/`."
 msgstr ""

-#: ../../../docs/installing.md:97
+#: ../../../docs/installing.md:99
 msgid "To create your user account (as an administrator of the server) via this Ansible playbook, run the command below on your local computer."
 msgstr ""

-#: ../../../docs/installing.md:99
+#: ../../../docs/installing.md:101
 msgid "**Notes**:"
 msgstr ""

-#: ../../../docs/installing.md:100
+#: ../../../docs/installing.md:102
 msgid "Make sure to adjust `YOUR_USERNAME_HERE` and `YOUR_PASSWORD_HERE`"
 msgstr ""

-#: ../../../docs/installing.md:101
+#: ../../../docs/installing.md:103
 msgid "For `YOUR_USERNAME_HERE`, use a plain username like `alice`, not your full ID (`@alice:example.com`)"
 msgstr ""

-#: ../../../docs/installing.md:102
+#: ../../../docs/installing.md:104
 msgid "Use `admin=yes` to make your user account an administrator of the Matrix server"
 msgstr ""

-#: ../../../docs/installing.md:110
+#: ../../../docs/installing.md:112
 msgid "Feel free to create as many accounts (for friends, family, etc.) as you want. Still, perhaps you should grant full administrative access to your account only (with `admin=yes`), and others should be created with `admin=no`."
 msgstr ""

-#: ../../../docs/installing.md:112
+#: ../../../docs/installing.md:114
 msgid "For more information, see the documentation for [registering users](registering-users.md)."
 msgstr ""

-#: ../../../docs/installing.md:114
+#: ../../../docs/installing.md:116
 msgid "Finalize the installation"
 msgstr ""

-#: ../../../docs/installing.md:116
+#: ../../../docs/installing.md:118
 msgid "Now you've configured Matrix services and your user account, you need to **finalize the installation process** by [setting up Matrix delegation (redirection)](howto-server-delegation.md), so that your Matrix server (`matrix.example.com`) can present itself as the base domain (`example.com`) in the Matrix network."
 msgstr ""

-#: ../../../docs/installing.md:118
+#: ../../../docs/installing.md:120
 msgid "This is required for federation to work! Without a proper configuration, your server will effectively not be part of the Matrix network."
 msgstr ""

-#: ../../../docs/installing.md:120
+#: ../../../docs/installing.md:122
 msgid "To configure the delegation, you have these two options. Choose one of them according to your situation."
 msgstr ""

-#: ../../../docs/installing.md:122
+#: ../../../docs/installing.md:124
 msgid "If you can afford to point the base domain at the Matrix server, follow the instructions below which guide you into [serving the base domain](configuring-playbook-base-domain-serving.md) from the integrated web server. It will enable you to use a Matrix user ID like `@alice:example.com` while hosting services on a subdomain like `matrix.example.com`."
 msgstr ""

-#: ../../../docs/installing.md:123
+#: ../../../docs/installing.md:125
 msgid "Alternatively, if you're using the base domain for other purposes and cannot point it to the Matrix server (and thus cannot \"serve the base domain\" from it), you most likely need to [manually install well-known files on the base domain's server](configuring-well-known.md#manually-installing-well-known-files-on-the-base-domains-server), but feel free to familiarize yourself with all [server delegation (redirection) options](howto-server-delegation.md)."
 msgstr ""

-#: ../../../docs/installing.md:125
+#: ../../../docs/installing.md:127
 msgid "To have the base domain served from the integrated web server, add the following configuration to your `inventory/host_vars/matrix.example.com/vars.yml` file:"
 msgstr ""

-#: ../../../docs/installing.md:131
+#: ../../../docs/installing.md:133
 msgid "After configuring the playbook, run the command below:"
 msgstr ""

-#: ../../../docs/installing.md:137
+#: ../../../docs/installing.md:139
 msgid "**If an error is not returned, the installation has completed and the services have been started successfully**🎉"
 msgstr ""

-#: ../../../docs/installing.md:139
+#: ../../../docs/installing.md:141
 msgid "Things to do next"
 msgstr ""

-#: ../../../docs/installing.md:141
+#: ../../../docs/installing.md:143
 msgid "After completing the installation, you can:"
 msgstr ""

-#: ../../../docs/installing.md:143
+#: ../../../docs/installing.md:145
 msgid "[check if services work](maintenance-and-troubleshooting.md#how-to-check-if-services-work)"
 msgstr ""

-#: ../../../docs/installing.md:144
+#: ../../../docs/installing.md:146
 msgid "or [set up additional services](configuring-playbook.md#other-configuration-options) (bridges to other chat networks, bots, etc.)"
 msgstr ""

-#: ../../../docs/installing.md:145
+#: ../../../docs/installing.md:147
 msgid "or learn how to [upgrade services when new versions are released](maintenance-upgrading-services.md)"
 msgstr ""

-#: ../../../docs/installing.md:146
+#: ../../../docs/installing.md:148
 msgid "or learn how to [maintain your server](faq.md#maintenance)"
 msgstr ""

-#: ../../../docs/installing.md:147
+#: ../../../docs/installing.md:149
 msgid "or join some Matrix rooms:"
 msgstr ""

-#: ../../../docs/installing.md:148
+#: ../../../docs/installing.md:150
 msgid "via the *Explore rooms* feature in Element Web or some other clients, or by discovering them using this [matrix-static list](https://view.matrix.org). **Note**: joining large rooms may overload small servers. For tuning guidance on constrained hosts, see [Limit joining heavy rooms on constrained hosts](configuring-playbook-synapse.md#limit-joining-heavy-rooms-on-constrained-hosts)."
 msgstr ""

-#: ../../../docs/installing.md:150
+#: ../../../docs/installing.md:152
 msgid "or come say Hi in our support room — [#matrix-docker-ansible-deploy:devture.com](https://matrix.to/#/#matrix-docker-ansible-deploy:devture.com). You might learn something or get to help someone else new to Matrix hosting."
 msgstr ""

-#: ../../../docs/installing.md:151
+#: ../../../docs/installing.md:153
 msgid "or help make this playbook better by contributing (code, documentation, or [coffee/beer](https://liberapay.com/s.pantaleev/donate))"
 msgstr ""

-#: ../../../docs/installing.md:153
+#: ../../../docs/installing.md:155
 msgid "Installing native Matrix clients on your computer"
 msgstr ""

-#: ../../../docs/installing.md:155
+#: ../../../docs/installing.md:157
 msgid "As the playbook's aim is to help you to install and manage Matrix services on your server, if you are looking for dedicated native Matrix clients which run on your computer, you need to install ones by yourself. There is a convenient list which introduces known Matrix clients on this page: <https://matrix.org/ecosystem/clients/>"
 msgstr ""

-#: ../../../docs/installing.md:157
+#: ../../../docs/installing.md:159
 msgid "If you feel overwhelmed by the variety and the number of the available clients, you might want to install [**Komai**](https://github.com/etkecc/komai), a desktop-first Matrix chat application maintained by the team behind the playbook. It is stable, and just works without quirks!"
 msgstr ""

-#: ../../../docs/installing.md:159
+#: ../../../docs/installing.md:161
 msgid "⚠️ Keep the playbook and services up-to-date"
 msgstr ""

-#: ../../../docs/installing.md:161
+#: ../../../docs/installing.md:163
 msgid "While this playbook helps you to set up Matrix services and maintain them, it will **not** automatically run the maintenance task for you. You will need to update the playbook and re-run it **manually**."
 msgstr ""

-#: ../../../docs/installing.md:163
+#: ../../../docs/installing.md:165
 msgid "The upstream projects, which this playbook makes use of, occasionally if not often suffer from security vulnerabilities."
 msgstr ""

-#: ../../../docs/installing.md:165
+#: ../../../docs/installing.md:167
 msgid "Since it is unsafe to keep outdated services running on the server connected to the internet, please consider to update the playbook and re-run it periodically, in order to keep the services up-to-date."
 msgstr ""

-#: ../../../docs/installing.md:167
+#: ../../../docs/installing.md:169
 msgid "Also, do not forget to update your system regularly. While this playbook may install basic services, such as Docker, it will not interfere further with system maintenance. Keeping the system itself up-to-date is out of scope for this playbook."
 msgstr ""

-#: ../../../docs/installing.md:169
+#: ../../../docs/installing.md:171
 msgid "For more information about upgrading or maintaining services with the playbook, take a look at this page: [Upgrading the Matrix services](maintenance-upgrading-services.md)"
 msgstr ""

-#: ../../../docs/installing.md:171
+#: ../../../docs/installing.md:173
 msgid "Feel free to **re-run the setup command any time** you think something is wrong with the server configuration. Ansible will take your configuration and update your server to match."
 msgstr ""

-#: ../../../docs/installing.md:177
+#: ../../../docs/installing.md:179
 msgid "**Note**: see [this page on the playbook tags](playbook-tags.md) for more information about those tags."
 msgstr ""

-#: ../../../docs/installing.md:179
+#: ../../../docs/installing.md:181
 msgid "Make full use of `just` shortcut commands"
 msgstr ""

-#: ../../../docs/installing.md:181
+#: ../../../docs/installing.md:183
 msgid "After you get familiar with reconfiguring and re-running the playbook to maintain the server, upgrade its services, etc., you probably would like to make use of `just` shortcut commands for faster input."
 msgstr ""

-#: ../../../docs/installing.md:183
+#: ../../../docs/installing.md:185
 msgid "For example, `just install-all` is useful for maintaining your setup quickly ([2x-5x faster](../CHANGELOG.md#2x-5x-performance-improvements-in-playbook-runtime) than `just setup-all`) when its components remain unchanged. If you adjust your `vars.yml` to remove other components, you'd need to run `just setup-all`, or these components will still remain installed."
 msgstr ""

-#: ../../../docs/installing.md:185
+#: ../../../docs/installing.md:187
 msgid "You can learn about the shortcut commands on this page: [Running `just` commands](just.md)"
 msgstr ""
@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: matrix-docker-ansible-deploy \n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2026-05-19 07:40+0000\n"
+"POT-Creation-Date: 2026-07-15 04:33+0000\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"
@@ -149,69 +149,73 @@ msgid "Restoring a backup made this way can be done by [importing it](importing-
 msgstr ""

 #: ../../../docs/maintenance-postgres.md:79
-msgid "Upgrading PostgreSQL"
+msgid "**Note for Synapse users**: the [official Synapse backup guide](https://element-hq.github.io/synapse/latest/usage/administration/backups.html) recommends that the `e2e_one_time_keys_json` table either not be backed up, or be truncated after restoring (before Synapse is started). The full-server dump command above does include it, so if you ever restore a backup that is older than the server's current state, remember to truncate that table as described in [the importing guide](importing-postgres.md)."
 msgstr ""

 #: ../../../docs/maintenance-postgres.md:81
-msgid "Unless you are using an [external Postgres server](configuring-playbook-external-postgres.md), this playbook initially installs Postgres for you."
+msgid "Upgrading PostgreSQL"
 msgstr ""

 #: ../../../docs/maintenance-postgres.md:83
-msgid "Once installed, the playbook attempts to preserve the Postgres version it starts with. This is because newer Postgres versions cannot start with data generated by older Postgres versions."
+msgid "Unless you are using an [external Postgres server](configuring-playbook-external-postgres.md), this playbook initially installs Postgres for you."
 msgstr ""

 #: ../../../docs/maintenance-postgres.md:85
-msgid "Upgrades must be performed manually."
+msgid "Once installed, the playbook attempts to preserve the Postgres version it starts with. This is because newer Postgres versions cannot start with data generated by older Postgres versions."
 msgstr ""

 #: ../../../docs/maintenance-postgres.md:87
+msgid "Upgrades must be performed manually."
+msgstr ""
+
+#: ../../../docs/maintenance-postgres.md:89
 msgid "The playbook can upgrade your existing Postgres setup with the following command:"
 msgstr ""

-#: ../../../docs/maintenance-postgres.md:93
+#: ../../../docs/maintenance-postgres.md:95
 msgid "**The old Postgres data directory is backed up** automatically, by renaming it to `/matrix/postgres/data-auto-upgrade-backup`. To rename to a different path, pass some extra flags to the command above, like this: `--extra-vars=\"postgres_auto_upgrade_backup_data_path=/another/disk/matrix-postgres-before-upgrade\"`"
 msgstr ""

-#: ../../../docs/maintenance-postgres.md:95
+#: ../../../docs/maintenance-postgres.md:97
 msgid "The auto-upgrade-backup directory stays around forever, until you **manually decide to delete it**."
 msgstr ""

-#: ../../../docs/maintenance-postgres.md:97
+#: ../../../docs/maintenance-postgres.md:99
 msgid "As part of the upgrade, the database is dumped to `/tmp`, an upgraded and empty Postgres server is started, and then the dump is restored into the new server. To use a different directory for the dump, pass some extra flags to the command above, like this: `--extra-vars=\"postgres_dump_dir=/directory/to/dump/here\"`"
 msgstr ""

-#: ../../../docs/maintenance-postgres.md:99
+#: ../../../docs/maintenance-postgres.md:101
 msgid "To save disk space in `/tmp`, the dump file is gzipped on the fly at the expense of CPU usage. If you have plenty of space in `/tmp` and would rather avoid gzipping, you can explicitly pass a dump filename which doesn't end in `.gz`. Example: `--extra-vars=\"postgres_dump_name=matrix-postgres-dump.sql\"`"
 msgstr ""

-#: ../../../docs/maintenance-postgres.md:101
+#: ../../../docs/maintenance-postgres.md:103
 msgid "**All databases, roles, etc. on the Postgres server are migrated**. However, other components that depend on specific Postgres versions (like the [Postgres Backup](configuring-playbook-postgres-backup.md) service) may need to be updated after the upgrade by using `just install-all`"
 msgstr ""

-#: ../../../docs/maintenance-postgres.md:103
+#: ../../../docs/maintenance-postgres.md:105
 msgid "Tuning PostgreSQL"
 msgstr ""

-#: ../../../docs/maintenance-postgres.md:105
+#: ../../../docs/maintenance-postgres.md:107
 msgid "PostgreSQL can be [tuned](https://wiki.postgresql.org/wiki/Tuning_Your_PostgreSQL_Server) to make it run faster. This is done by passing extra arguments to the Postgres process."
 msgstr ""

-#: ../../../docs/maintenance-postgres.md:107
+#: ../../../docs/maintenance-postgres.md:109
 msgid "The [Postgres Ansible role](https://github.com/mother-of-all-self-hosting/ansible-role-postgres) **already does some tuning by default**, which matches the [tuning logic](https://github.com/le0pard/pgtune/blob/master/src/features/configuration/configurationSlice.js) done by websites like https://pgtune.leopard.in.ua/. You can manually influence some of the tuning variables. These parameters (variables) are injected via the `postgres_postgres_process_extra_arguments_default` variable."
 msgstr ""

-#: ../../../docs/maintenance-postgres.md:109
+#: ../../../docs/maintenance-postgres.md:111
 msgid "Most users should be fine with the automatically-done tuning. However, you may wish to:"
 msgstr ""

-#: ../../../docs/maintenance-postgres.md:111
+#: ../../../docs/maintenance-postgres.md:113
 msgid "**adjust the automatically-determined tuning parameters manually**: change the values for the tuning variables defined in the Postgres role's [default configuration file](https://github.com/mother-of-all-self-hosting/ansible-role-postgres/blob/main/defaults/main.yml) (see `postgres_max_connections`, `postgres_data_storage` etc). These variables are ultimately passed to Postgres via a `postgres_postgres_process_extra_arguments_default` variable"
 msgstr ""

-#: ../../../docs/maintenance-postgres.md:113
+#: ../../../docs/maintenance-postgres.md:115
 msgid "**turn automatically-performed tuning off**: override it like this: `postgres_postgres_process_extra_arguments_default: []`"
 msgstr ""

-#: ../../../docs/maintenance-postgres.md:115
+#: ../../../docs/maintenance-postgres.md:117
 msgid "**add additional tuning parameters**: define your additional Postgres configuration parameters in `postgres_postgres_process_extra_arguments_custom`. See `postgres_postgres_process_extra_arguments_default` defined in the Postgres role's [default configuration file](https://github.com/mother-of-all-self-hosting/ansible-role-postgres/blob/main/defaults/main.yml) for inspiration"
 msgstr ""
@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: matrix-docker-ansible-deploy \n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2026-05-19 07:40+0000\n"
+"POT-Creation-Date: 2026-07-15 04:33+0000\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"
@@ -192,14 +192,18 @@ msgstr ""
 msgid "You can **learn more about cache-autotuning and the global cache factor settings** in the [Synapse's documentation on caches and associated values](https://matrix-org.github.io/synapse/latest/usage/configuration/config_documentation.html#caches-and-associated-values)."
 msgstr ""

-#: ../../../docs/maintenance-synapse.md:108
+#: ../../../docs/maintenance-synapse.md:109
+msgid "These limits apply **per Synapse process**. If you have [workers](configuring-playbook-synapse.md#load-balancing-with-workers) enabled, the main process and every worker each apply the configured limits independently, so the theoretical aggregate cache memory usage gets multiplied by the number of processes. When running many workers on a memory-constrained server, consider setting these variables to lower, explicitly chosen values."
+msgstr ""
+
+#: ../../../docs/maintenance-synapse.md:111
 msgid "To **disable cache auto-tuning**, unset all values:"
 msgstr ""

-#: ../../../docs/maintenance-synapse.md:116
+#: ../../../docs/maintenance-synapse.md:119
 msgid "Users who wish to lower Synapse's RAM footprint should look into lowering the global cache factor and tweaking the autotune variables (or disabling auto-tuning). If your cache factor is too low for a given auto tune setting your caches will not reach autotune thresholds and autotune won't be able to do its job. Therefore, when auto-tuning is enabled (which it is by default), it's recommended to have your cache factor be large."
 msgstr ""

-#: ../../../docs/maintenance-synapse.md:118
+#: ../../../docs/maintenance-synapse.md:121
 msgid "See also [How do I optimize this setup for a low-power server?](faq.md#how-do-i-optimize-this-setup-for-a-low-power-server)."
 msgstr ""
@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: matrix-docker-ansible-deploy \n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2026-05-07 11:16+0000\n"
+"POT-Creation-Date: 2026-07-12 15:37+0000\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"
@@ -213,229 +213,265 @@ msgid "For your convenience, we have prepared example files of them ([`vars.yml`
 msgstr ""

 #: ../../../docs/quick-start.md:92
-msgid "To start quickly based on these example files, go into the `matrix-docker-ansible-deploy` directory and follow the instructions below:"
+msgid "To start quickly based on these example files, go into the `matrix-docker-ansible-deploy` directory and initialize your configuration, either automatically or manually."
 msgstr ""

 #: ../../../docs/quick-start.md:94
-msgid "Create a directory to hold your configuration: `mkdir -p inventory/host_vars/matrix.example.com` where `example.com` is your \"base domain\""
-msgstr ""
-
-#: ../../../docs/quick-start.md:95
-msgid "Copy the sample configuration file: `cp examples/vars.yml inventory/host_vars/matrix.example.com/vars.yml`"
+msgid "To initialize it automatically (with the base domain and server address pre-filled and secrets generated for you), run:"
 msgstr ""

 #: ../../../docs/quick-start.md:96
-msgid "Copy the sample inventory hosts file: `cp examples/hosts inventory/hosts`"
+msgid "either: `just add-inventory-host example.com 1.2.3.4` (if you have the [`just`](just.md) tool)"
 msgstr ""

 #: ../../../docs/quick-start.md:97
-msgid "Edit the configuration file (`inventory/host_vars/matrix.example.com/vars.yml`)"
+msgid "or: `make add-inventory-host domain=example.com ip=1.2.3.4` (if you have the `make` program)"
 msgstr ""

-#: ../../../docs/quick-start.md:98
-msgid "Edit the inventory hosts file (`inventory/hosts`)"
+#: ../../../docs/quick-start.md:99
+msgid "… where `example.com` is your \"base domain\" (not `matrix.example.com`) and `1.2.3.4` is your server's external IP address (or domain name)."
 msgstr ""

-#: ../../../docs/quick-start.md:100
-msgid "Before editing these 2 files, make sure to read explanations on them to understand what needs to be configured."
-msgstr ""
-
-#: ../../../docs/quick-start.md:102
-msgid "**💡 Notes:**"
+#: ../../../docs/quick-start.md:101
+msgid "Given a base domain of `example.com`, this creates:"
 msgstr ""

 #: ../../../docs/quick-start.md:103
-msgid "If you are not in control of anything on the base domain, you would need to set additional configuration on `vars.yml`. For more information, see [How do I install on matrix.example.com without involving the base domain?](faq.md#how-do-i-install-on-matrix-example-com-without-involving-the-base-domain) on our FAQ."
+msgid "an entry for `matrix.example.com` (the Matrix server's default hostname: `matrix.` + your base domain) in the inventory hosts file (`inventory/hosts`)"
 msgstr ""

 #: ../../../docs/quick-start.md:104
-msgid "Certain configuration decisions (like the base domain configured in `matrix_domain` and homeserver implementation configured in `matrix_homeserver_implementation`) are final. If you make the wrong choice and wish to change it, you'll have to run the Uninstalling step and start over."
+msgid "a configuration file (`inventory/host_vars/matrix.example.com/vars.yml`) containing `matrix_domain: example.com` and automatically generated secrets"
 msgstr ""

-#: ../../../docs/quick-start.md:105
-msgid "Instead of configuring a lot of things all at once, we recommend starting with the basic (default) settings in order to get yourself familiar with how the playbook works. After making sure that everything works as expected, you can add (and remove) advanced settings / features and run the playbook as many times as you wish."
+#: ../../../docs/quick-start.md:106
+msgid "Afterward, edit these 2 files to adjust them further, as necessary. Existing configuration is never overwritten (the command refuses to run if the host is already in your inventory), so it can also be used for adding more hosts later."
 msgstr ""

-#: ../../../docs/quick-start.md:107
-msgid "Install"
+#: ../../../docs/quick-start.md:108
+msgid "To initialize it manually, follow the instructions below:"
 msgstr ""

-#: ../../../docs/quick-start.md:109
-msgid "<sup>This section is optimized for this quick-start guide and is derived from the following full-documentation page: [Installing](installing.md)</sup>"
+#: ../../../docs/quick-start.md:110
+msgid "Create a directory to hold your configuration: `mkdir -p inventory/host_vars/matrix.example.com` where `example.com` is your \"base domain\""
 msgstr ""

 #: ../../../docs/quick-start.md:111
-msgid "After editing `vars.yml` and `hosts` files, let's start the **installation** procedure."
+msgid "Copy the sample configuration file: `cp examples/vars.yml inventory/host_vars/matrix.example.com/vars.yml`"
+msgstr ""
+
+#: ../../../docs/quick-start.md:112
+msgid "Copy the sample inventory hosts file: `cp examples/hosts inventory/hosts`"
 msgstr ""

 #: ../../../docs/quick-start.md:113
-msgid "Update Ansible roles"
+msgid "Edit the configuration file (`inventory/host_vars/matrix.example.com/vars.yml`)"
 msgstr ""

-#: ../../../docs/quick-start.md:115
-msgid "Before installing, you need to update the Ansible roles that this playbook uses and fetches from outside."
+#: ../../../docs/quick-start.md:114
+msgid "Edit the inventory hosts file (`inventory/hosts`)"
 msgstr ""

-#: ../../../docs/quick-start.md:117
-msgid "To update your playbook directory and all upstream Ansible roles, run:"
+#: ../../../docs/quick-start.md:116
+msgid "Before editing these 2 files, make sure to read explanations on them to understand what needs to be configured."
+msgstr ""
+
+#: ../../../docs/quick-start.md:118
+msgid "**💡 Notes:**"
 msgstr ""

 #: ../../../docs/quick-start.md:119
-msgid "either: `just update`"
+msgid "If you are not in control of anything on the base domain, you would need to set additional configuration on `vars.yml`. For more information, see [How do I install on matrix.example.com without involving the base domain?](faq.md#how-do-i-install-on-matrix-example-com-without-involving-the-base-domain) on our FAQ."
 msgstr ""

 #: ../../../docs/quick-start.md:120
-msgid "or: a combination of `git pull` and `just roles` (or `make roles` if you have `make` program on your computer instead of `just`)"
+msgid "Certain configuration decisions (like the base domain configured in `matrix_domain` and homeserver implementation configured in `matrix_homeserver_implementation`) are final. If you make the wrong choice and wish to change it, you'll have to run the Uninstalling step and start over."
 msgstr ""

-#: ../../../docs/quick-start.md:122
-msgid "If you don't have either `just` tool or `make` program, you can run the `ansible-galaxy` tool directly after updating the playbook: `git pull; rm -rf roles/galaxy; ansible-galaxy install -r requirements.yml -p roles/galaxy/ --force`"
+#: ../../../docs/quick-start.md:121
+msgid "Instead of configuring a lot of things all at once, we recommend starting with the basic (default) settings in order to get yourself familiar with how the playbook works. After making sure that everything works as expected, you can add (and remove) advanced settings / features and run the playbook as many times as you wish."
 msgstr ""

-#: ../../../docs/quick-start.md:124
-msgid "Run installation command"
+#: ../../../docs/quick-start.md:123
+msgid "Install"
 msgstr ""

-#: ../../../docs/quick-start.md:126
-msgid "Then, run the command below to start installation:"
+#: ../../../docs/quick-start.md:125
+msgid "<sup>This section is optimized for this quick-start guide and is derived from the following full-documentation page: [Installing](installing.md)</sup>"
 msgstr ""

-#: ../../../docs/quick-start.md:132
-msgid "If you **don't** use SSH keys for authentication, but rather a regular password, you may need to add `--ask-pass` to the command."
+#: ../../../docs/quick-start.md:127
+msgid "After editing `vars.yml` and `hosts` files, let's start the **installation** procedure."
 msgstr ""

-#: ../../../docs/quick-start.md:134
-msgid "If you **do** use SSH keys for authentication, **and** use a non-root user to *become* root (sudo), you may need to add `-K` (`--ask-become-pass`) to the command."
+#: ../../../docs/quick-start.md:129
+msgid "Update Ansible roles"
+msgstr ""
+
+#: ../../../docs/quick-start.md:131
+msgid "Before installing, you need to update the Ansible roles that this playbook uses and fetches from outside."
+msgstr ""
+
+#: ../../../docs/quick-start.md:133
+msgid "To update your playbook directory and all upstream Ansible roles, run:"
+msgstr ""
+
+#: ../../../docs/quick-start.md:135
+msgid "either: `just update`"
 msgstr ""

 #: ../../../docs/quick-start.md:136
-msgid "Wait until the command completes. If it's all green, everything should be running properly."
+msgid "or: a combination of `git pull` and `just roles` (or `make roles` if you have `make` program on your computer instead of `just`)"
 msgstr ""

 #: ../../../docs/quick-start.md:138
-msgid "Create your user account"
+msgid "If you don't have either `just` tool or `make` program, you can run the `ansible-galaxy` tool directly after updating the playbook: `git pull; rm -rf roles/galaxy; ansible-galaxy install -r requirements.yml -p roles/galaxy/ --force`"
 msgstr ""

 #: ../../../docs/quick-start.md:140
-msgid "<sup>This section is optimized for this quick-start guide and is derived from the following full-documentation page: [Registering users](registering-users.md)</sup>"
+msgid "Run installation command"
 msgstr ""

 #: ../../../docs/quick-start.md:142
-msgid "As you have configured your brand new server and the client, you need to **create your user account** on your Matrix server."
-msgstr ""
-
-#: ../../../docs/quick-start.md:144
-msgid "To create your user account (as an administrator of the server) via this Ansible playbook, run the command below on your local computer."
-msgstr ""
-
-#: ../../../docs/quick-start.md:146
-msgid "**💡 Notes**:"
-msgstr ""
-
-#: ../../../docs/quick-start.md:147
-msgid "Make sure to adjust `YOUR_USERNAME_HERE` and `YOUR_PASSWORD_HERE`"
+msgid "Then, run the command below to start installation:"
 msgstr ""

 #: ../../../docs/quick-start.md:148
-msgid "For `YOUR_USERNAME_HERE`, use a plain username like `alice`, not your full ID (`@alice:example.com`)"
+msgid "If you **don't** use SSH keys for authentication, but rather a regular password, you may need to add `--ask-pass` to the command."
+msgstr ""
+
+#: ../../../docs/quick-start.md:150
+msgid "If you **do** use SSH keys for authentication, **and** use a non-root user to *become* root (sudo), you may need to add `-K` (`--ask-become-pass`) to the command."
+msgstr ""
+
+#: ../../../docs/quick-start.md:152
+msgid "Wait until the command completes. If it's all green, everything should be running properly."
+msgstr ""
+
+#: ../../../docs/quick-start.md:154
+msgid "Create your user account"
+msgstr ""
+
+#: ../../../docs/quick-start.md:156
+msgid "<sup>This section is optimized for this quick-start guide and is derived from the following full-documentation page: [Registering users](registering-users.md)</sup>"
+msgstr ""
+
+#: ../../../docs/quick-start.md:158
+msgid "As you have configured your brand new server and the client, you need to **create your user account** on your Matrix server."
 msgstr ""

 #: ../../../docs/quick-start.md:160
-msgid "Finalize server installation"
+msgid "To create your user account (as an administrator of the server) via this Ansible playbook, run the command below on your local computer."
 msgstr ""

 #: ../../../docs/quick-start.md:162
-msgid "<sup>This section is optimized for this quick-start guide and is derived from the following full-documentation page: [Server Delegation](howto-server-delegation.md)</sup>"
+msgid "**💡 Notes**:"
+msgstr ""
+
+#: ../../../docs/quick-start.md:163
+msgid "Make sure to adjust `YOUR_USERNAME_HERE` and `YOUR_PASSWORD_HERE`"
 msgstr ""

 #: ../../../docs/quick-start.md:164
+msgid "For `YOUR_USERNAME_HERE`, use a plain username like `alice`, not your full ID (`@alice:example.com`)"
+msgstr ""
+
+#: ../../../docs/quick-start.md:176
+msgid "Finalize server installation"
+msgstr ""
+
+#: ../../../docs/quick-start.md:178
+msgid "<sup>This section is optimized for this quick-start guide and is derived from the following full-documentation page: [Server Delegation](howto-server-delegation.md)</sup>"
+msgstr ""
+
+#: ../../../docs/quick-start.md:180
 msgid "Now that you've configured Matrix services and your user account, you need to **finalize the installation process** by [setting up Matrix delegation (redirection)](howto-server-delegation.md), so that your Matrix server (`matrix.example.com`) can present itself as the base domain (`example.com`) in the Matrix network."
 msgstr ""

-#: ../../../docs/quick-start.md:166
+#: ../../../docs/quick-start.md:182
 msgid "**This is required for federation to work!** Without a proper configuration, your server will effectively not be part of the Matrix network."
 msgstr ""

-#: ../../../docs/quick-start.md:168
+#: ../../../docs/quick-start.md:184
 msgid "To configure the delegation, you have these two options. Choose one of them according to your situation."
 msgstr ""

-#: ../../../docs/quick-start.md:170
+#: ../../../docs/quick-start.md:186
 msgid "If you can afford to point the base domain at the Matrix server, follow the instruction below which guides you into [serving the base domain](configuring-playbook-base-domain-serving.md) from the integrated web server."
 msgstr ""

-#: ../../../docs/quick-start.md:171
+#: ../../../docs/quick-start.md:187
 msgid "Alternatively, if you're using the base domain for other purposes and cannot point it to the Matrix server (and thus cannot \"serve the base domain\" from it), you most likely need to [manually install well-known files on the base domain's server](configuring-well-known.md#manually-installing-well-known-files-on-the-base-domains-server)."
 msgstr ""

-#: ../../../docs/quick-start.md:173
+#: ../../../docs/quick-start.md:189
 msgid "To have the base domain served from the integrated web server, add the following configuration to your `inventory/host_vars/matrix.example.com/vars.yml` file:"
 msgstr ""

-#: ../../../docs/quick-start.md:179
+#: ../../../docs/quick-start.md:195
 msgid "After configuring the playbook, run the command below and wait until it finishes:"
 msgstr ""

-#: ../../../docs/quick-start.md:185
+#: ../../../docs/quick-start.md:201
 msgid "💡 Running the `install-matrix-static-files` playbook tag (as done here) is an optimized version of running [the full setup command](#run-installation-command)."
 msgstr ""

-#: ../../../docs/quick-start.md:187
+#: ../../../docs/quick-start.md:203
 msgid "After the command finishes, you can also check whether your server federates with the Matrix network by using the [Federation Tester](https://federationtester.matrix.org/) against your base domain (`example.com`), not the `matrix.example.com` subdomain."
 msgstr ""

-#: ../../../docs/quick-start.md:189
+#: ../../../docs/quick-start.md:205
 msgid "Re-run the full setup command any time"
 msgstr ""

-#: ../../../docs/quick-start.md:191
+#: ../../../docs/quick-start.md:207
 msgid "If you think something is wrong with the server configuration, feel free to re-run the setup command any time:"
 msgstr ""

-#: ../../../docs/quick-start.md:197
+#: ../../../docs/quick-start.md:213
 msgid "Log in to your user account"
 msgstr ""

-#: ../../../docs/quick-start.md:199
+#: ../../../docs/quick-start.md:215
 msgid "Finally, let's make sure that you can log in to the created account with the specified password."
 msgstr ""

-#: ../../../docs/quick-start.md:201
+#: ../../../docs/quick-start.md:217
 msgid "You should be able to log in to it with your own [Element Web](configuring-playbook-client-element-web.md) client which you have set up at `element.example.com` by running the playbook. Open the URL (`https://element.example.com`) in a web browser and enter your credentials to log in."
 msgstr ""

-#: ../../../docs/quick-start.md:203
+#: ../../../docs/quick-start.md:219
 msgid "**If you successfully logged in to your account, the installation and configuration have completed successfully**🎉"
 msgstr ""

-#: ../../../docs/quick-start.md:205
+#: ../../../docs/quick-start.md:221
 msgid "Come say Hi👋 in our support room — [#matrix-docker-ansible-deploy:devture.com](https://matrix.to/#/#matrix-docker-ansible-deploy:devture.com). You might learn something or get to help someone else new to Matrix hosting."
 msgstr ""

-#: ../../../docs/quick-start.md:207
+#: ../../../docs/quick-start.md:223
 msgid "Things to do next"
 msgstr ""

-#: ../../../docs/quick-start.md:209
+#: ../../../docs/quick-start.md:225
 msgid "Once you get familiar with the playbook, you might probably want to set up additional services such as a bridge on your server."
 msgstr ""

-#: ../../../docs/quick-start.md:211
+#: ../../../docs/quick-start.md:227
 msgid "As this page intends to be a quick start guide which explains how to start the core Matrix services, it does not cover a topic like how to set them up. Take a look at the list of [things to do next](installing.md#things-to-do-next) to learn more."
 msgstr ""

-#: ../../../docs/quick-start.md:213
+#: ../../../docs/quick-start.md:229
 msgid "⚠️Keep the playbook and services up-to-date"
 msgstr ""

-#: ../../../docs/quick-start.md:215
+#: ../../../docs/quick-start.md:231
 msgid "While this playbook helps you to set up Matrix services and maintain them, it will **not** automatically run the maintenance task for you. You will need to update the playbook and re-run it **manually**."
 msgstr ""

-#: ../../../docs/quick-start.md:217
+#: ../../../docs/quick-start.md:233
 msgid "Since it is unsafe to keep outdated services running on the server connected to the internet, please consider to update the playbook and re-run it periodically, in order to keep the services up-to-date."
 msgstr ""

-#: ../../../docs/quick-start.md:219
+#: ../../../docs/quick-start.md:235
 msgid "For more information about upgrading or maintaining services with the playbook, take a look at this page: [Upgrading the Matrix services](maintenance-upgrading-services.md)"
 msgstr ""
@@ -4,7 +4,7 @@
  version: v1.0.0-7
  name: auxiliary
 - src: git+https://github.com/mother-of-all-self-hosting/ansible-role-backup_borg.git
-  version: v1.4.4-2.1.4-1
+  version: v1.4.4-2.1.6-1
  name: backup_borg
 - src: git+https://github.com/mother-of-all-self-hosting/ansible-role-cinny.git
  version: v4.12.3-0
@@ -33,7 +33,7 @@
  version: v4.99.1-r0-2-1
  name: exim_relay
 - src: git+https://github.com/mother-of-all-self-hosting/ansible-role-grafana.git
-  version: v13.0.2-0
+  version: v13.0.2-1
  name: grafana
 - src: git+https://github.com/mother-of-all-self-hosting/ansible-role-hydrogen.git
  version: v0.5.1-5
@@ -42,7 +42,7 @@
  version: v11031-0
  name: jitsi
 - src: git+https://github.com/mother-of-all-self-hosting/ansible-role-livekit-server.git
-  version: v1.13.3-0
+  version: v1.13.3-1
  name: livekit_server
 - src: git+https://github.com/mother-of-all-self-hosting/ansible-role-ntfy.git
  version: v2.26.0-0
@@ -57,7 +57,7 @@
  version: dd6e15246b7a9a2d921e0b3f9cd8a4a917a1bb2f
  name: playbook_state_preserver
 - src: git+https://github.com/mother-of-all-self-hosting/ansible-role-postgres.git
-  version: v18.4-0
+  version: v18.4-2
  name: postgres
 - src: git+https://github.com/mother-of-all-self-hosting/ansible-role-postgres-backup.git
  version: v18-3
@@ -75,7 +75,7 @@
  version: v0.20.1-0
  name: prometheus_postgres_exporter
 - src: git+https://github.com/mother-of-all-self-hosting/ansible-role-sable.git
-  version: v1.19.3-0
+  version: v1.19.4-0
  name: sable
 - src: git+https://github.com/devture/com.devture.ansible.role.systemd_docker_base.git
  version: v1.5.0-0
@@ -260,6 +260,33 @@ matrix_authentication_service_config_account_registration_token_required: false
 ########################################################################################


+########################################################################################
+#                                                                                      #
+# Captcha configuration                                                                #
+#                                                                                      #
+########################################################################################
+
+# Controls the `captcha.service` configuration setting.
+#
+# Which service to use for CAPTCHA protection of certain operations (like self-service password registration).
+# Valid values: recaptcha_v2, cloudflare_turnstile, hcaptcha
+# When defined, `matrix_authentication_service_config_captcha_site_key` and `matrix_authentication_service_config_captcha_secret_key` must be defined as well.
+# Leave empty to disable CAPTCHA protection.
+matrix_authentication_service_config_captcha_service: ""
+
+# Controls the `captcha.site_key` configuration setting.
+matrix_authentication_service_config_captcha_site_key: ""
+
+# Controls the `captcha.secret_key` configuration setting.
+matrix_authentication_service_config_captcha_secret_key: ""
+
+########################################################################################
+#                                                                                      #
+# /Captcha configuration                                                               #
+#                                                                                      #
+########################################################################################
+
+
 ########################################################################################
 #                                                                                      #
 # Database configuration                                                               #
@@ -25,6 +25,8 @@
    - {'name': 'matrix_authentication_service_container_labels_public_compatibility_layer_hostname', when: "{{ matrix_authentication_service_container_labels_public_compatibility_layer_enabled }}"}
    - {'name': 'matrix_authentication_service_container_labels_internal_compatibility_layer_entrypoints', when: "{{ matrix_authentication_service_container_labels_internal_compatibility_layer_enabled }}"}
    - {'name': 'matrix_authentication_service_config_email_hostname', when: "{{ matrix_authentication_service_config_email_transport == 'smtp' }}"}
+    - {'name': 'matrix_authentication_service_config_captcha_site_key', when: "{{ matrix_authentication_service_config_captcha_service != '' }}"}
+    - {'name': 'matrix_authentication_service_config_captcha_secret_key', when: "{{ matrix_authentication_service_config_captcha_service != '' }}"}

 - name: Fail if matrix_authentication_service_config_secrets_encryption is not 64 characters long
  ansible.builtin.fail:
@@ -36,6 +38,11 @@
    msg: "matrix_authentication_service_config_email_transport must be one of: blackhole, smtp, or aws_ses"
  when: "matrix_authentication_service_config_email_transport not in ['blackhole', 'smtp', 'aws_ses']"

+- name: Fail if matrix_authentication_service_config_captcha_service is invalid
+  ansible.builtin.fail:
+    msg: "matrix_authentication_service_config_captcha_service must be one of: recaptcha_v2, cloudflare_turnstile, or hcaptcha (or empty, to disable CAPTCHA protection)"
+  when: "matrix_authentication_service_config_captcha_service not in ['', 'recaptcha_v2', 'cloudflare_turnstile', 'hcaptcha']"
+
 - name: (Deprecation) Catch and report renamed matrix-authentication-service settings
  ansible.builtin.fail:
    msg: >-
@@ -72,6 +72,13 @@ account:
  login_with_email_allowed: {{ matrix_authentication_service_config_account_login_with_email_allowed | to_json }}
  registration_token_required: {{ matrix_authentication_service_config_account_registration_token_required | to_json }}

+{% if matrix_authentication_service_config_captcha_service %}
+captcha:
+  service: {{ matrix_authentication_service_config_captcha_service | to_json }}
+  site_key: {{ matrix_authentication_service_config_captcha_site_key | to_json }}
+  secret_key: {{ matrix_authentication_service_config_captcha_secret_key | to_json }}
+{% endif %}
+
 clients: {{ matrix_authentication_service_config_clients | to_json }}

 {% if matrix_authentication_service_config_upstream_oauth2_providers | length > 0 %}
@@ -16,12 +16,11 @@
 # Project source code URL: https://github.com/matrix-org/matrix-appservice-discord

 matrix_appservice_discord_enabled: false
-matrix_appservice_discord_container_image_self_build: false

 # renovate: datasource=docker depName=ghcr.io/matrix-org/matrix-appservice-discord
 matrix_appservice_discord_version: v4.0.0
 matrix_appservice_discord_container_image: "{{ matrix_appservice_discord_container_image_registry_prefix }}matrix-org/matrix-appservice-discord:{{ matrix_appservice_discord_version }}"
-matrix_appservice_discord_container_image_registry_prefix: "{{ 'localhost/' if matrix_appservice_discord_container_image_self_build else matrix_appservice_discord_container_image_registry_prefix_upstream }}"
+matrix_appservice_discord_container_image_registry_prefix: "{{ matrix_appservice_discord_container_image_registry_prefix_upstream }}"
 matrix_appservice_discord_container_image_registry_prefix_upstream: "{{ matrix_appservice_discord_container_image_registry_prefix_upstream_default }}"
 matrix_appservice_discord_container_image_registry_prefix_upstream_default: "ghcr.io/"

@@ -20,6 +20,7 @@
    - {'old': 'matrix_appservice_discord_docker_image_registry_prefix_upstream', 'new': 'matrix_appservice_discord_container_image_registry_prefix_upstream'}
    - {'old': 'matrix_appservice_discord_docker_image_registry_prefix_upstream_default', 'new': 'matrix_appservice_discord_container_image_registry_prefix_upstream_default'}
    - {'old': 'matrix_appservice_discord_container_image_force_pull', 'new': '<removed> (the new community.docker.docker_image_pull module handles this natively)'}
+    - {'old': 'matrix_appservice_discord_container_image_self_build', 'new': '<removed> (self-building was never actually implemented for this role, so enabling it only led to image pull failures; the prebuilt image is amd64-only, so on other architectures consider the mautrix-discord bridge instead)'}

 - name: Fail if required appservice-discord settings not defined
  ansible.builtin.fail:
@@ -70,7 +70,8 @@ matrix_hookshot_cache_redisUri: "{{ ('redis://' + matrix_hookshot_cache_redis_ho

 # Controls whether the end-to-bridge encryption support is enabled.
 # This requires that:
-# - support to also be enabled in the homeserver, see the documentation of Hookshot.
+# - the homeserver to support MSC2409 (to-device messages for appservices) and MSC3202 (encryption-related appservice transaction extensions), and to have them enabled.
+#   These are typically experimental homeserver features which are disabled by default, so they usually need to be enabled explicitly via homeserver-specific configuration.
 # - Hookshot to be pointed at a Redis instance via the `matrix_hookshot_cache_redis*` variables. Note that this is configured automatically by the playbook when encryption is enabled.
 # See: https://matrix-org.github.io/matrix-hookshot/latest/advanced/encryption.html
 # NOTE: Encryption is not currently (2025-12-30) supported when using MAS (https://github.com/matrix-org/matrix-hookshot/issues/1084)
@@ -316,7 +316,7 @@ matrix_mautrix_meta_instagram_registration_yaml: |
  namespaces:
    users:
    - exclusive: true
-      regex: '^@{{ matrix_mautrix_meta_instagram_bridge_username_prefix }}.+:{{ matrix_mautrix_meta_instagram_homeserver_domain | regex_escape }}$'
+      regex: '^@{{ matrix_mautrix_meta_instagram_bridge_username_prefix | regex_escape }}.+:{{ matrix_mautrix_meta_instagram_homeserver_domain | regex_escape }}$'
    - exclusive: true
      regex: '^@{{ matrix_mautrix_meta_instagram_appservice_username | regex_escape }}:{{ matrix_mautrix_meta_instagram_homeserver_domain | regex_escape }}$'
  url: {{ matrix_mautrix_meta_instagram_appservice_address }}
@@ -316,7 +316,7 @@ matrix_mautrix_meta_messenger_registration_yaml: |
  namespaces:
    users:
    - exclusive: true
-      regex: '^@{{ matrix_mautrix_meta_messenger_bridge_username_prefix }}.+:{{ matrix_mautrix_meta_messenger_homeserver_domain | regex_escape }}$'
+      regex: '^@{{ matrix_mautrix_meta_messenger_bridge_username_prefix | regex_escape }}.+:{{ matrix_mautrix_meta_messenger_homeserver_domain | regex_escape }}$'
    - exclusive: true
      regex: '^@{{ matrix_mautrix_meta_messenger_appservice_username | regex_escape }}:{{ matrix_mautrix_meta_messenger_homeserver_domain | regex_escape }}$'
  url: {{ matrix_mautrix_meta_messenger_appservice_address }}
@@ -189,15 +189,10 @@ matrix_client_element_room_directory_servers: ['matrix.org']
 # Branding of Element
 matrix_client_element_brand: "Element"

-# URL to Logo on welcome page
+# URL to the logo shown on the welcome and login pages.
+# This is the default for `matrix_client_element_branding_auth_header_logo_url` below.
 matrix_client_element_welcome_logo: "themes/element/img/logos/element-logo.svg"

-# URL of link on welcome image
-matrix_client_element_welcome_logo_link: "https://element.io"
-
-matrix_client_element_welcome_headline: "_t(\"welcome_to_element\")"
-matrix_client_element_welcome_text: "_t(\"powered_by_matrix_with_logo\")"
-
 # Links, shown in footer of welcome page:
 # [{"text": "Link text", "url": "https://link.target"}, {"text": "Other link"}]
 matrix_client_element_branding_auth_footer_links: ~  # noqa var-naming
@@ -269,8 +264,6 @@ matrix_client_element_element_call_brand: "Element Call"
 # Controls the `element_call.use_exclusively` setting in the Element Web configuration.
 matrix_client_element_element_call_use_exclusively: true

-matrix_client_element_page_template_welcome_path: "{{ role_path }}/templates/welcome.html.j2"
-
 # By default, there's no Element Web homepage (when logged in). If you wish to have one,
 # point this to a `home.html` template file on your local filesystem.
 matrix_client_element_embedded_pages_home_path: ~
@@ -346,6 +339,10 @@ matrix_client_element_configuration: "{{ matrix_client_element_configuration_def
 # How to host your own map tile server: https://matrix.org/docs/guides/map-tile-server
 matrix_client_element_location_sharing_enabled: false

+# Controls the value of the `Access-Control-Allow-Origin` header attached to responses for `map_style.json`.
+# Element Desktop loads the map style from a `vector://vector` origin, so cross-origin access needs to be allowed.
+matrix_client_element_location_sharing_map_style_access_control_allow_origin: "*"
+
 # Default Element location sharing map style configuration template which covers the generic use case.
 # You can customize it by controlling the various variables inside it.
 #
@@ -97,7 +97,6 @@
  with_items:
    - {src: "{{ role_path }}/templates/labels.j2", name: "labels"}
    - {src: "{{ role_path }}/templates/env.j2", name: "env"}
-    - {src: "{{ matrix_client_element_page_template_welcome_path }}", name: "welcome.html"}
    - {src: "{{ matrix_client_element_embedded_pages_home_path }}", name: "home.html"}
  when: "item.src is not none"
  register: matrix_client_element_support_files_result
@@ -113,6 +112,8 @@
    state: absent
  with_items:
    - {src: "{{ matrix_client_element_embedded_pages_home_path }}", name: "home.html"}
+    # The playbook no longer ships a custom welcome.html (Element Web renders its own built-in welcome page).
+    - {src: ~, name: "welcome.html"}
  when: "item.src is none"

 - name: Ensure Element Web container network is created
@@ -30,6 +30,10 @@
    - {'old': 'matrix_client_element_docker_image_registry_prefix_upstream_default', 'new': 'matrix_client_element_container_image_registry_prefix_upstream_default'}
    - {'old': 'matrix_client_element_docker_src_files_path', 'new': 'matrix_client_element_container_src_files_path'}
    - {'old': 'matrix_client_element_container_image_force_pull', 'new': '<removed> (the new community.docker.docker_image_pull module handles this natively)'}
+    - {'old': 'matrix_client_element_welcome_headline', 'new': '<removed> (Element Web now renders its own built-in welcome page and no longer loads the custom welcome.html this variable applied to; a logo and background can still be customized via matrix_client_element_branding_auth_header_logo_url and matrix_client_element_branding_welcome_background_url, and a fully custom page can be self-hosted and wired via embedded_pages.welcome_url in matrix_client_element_configuration_extension_json)'}
+    - {'old': 'matrix_client_element_welcome_text', 'new': '<removed> (Element Web now renders its own built-in welcome page and no longer loads the custom welcome.html this variable applied to; see matrix_client_element_welcome_headline for alternatives)'}
+    - {'old': 'matrix_client_element_welcome_logo_link', 'new': '<removed> (Element Web now renders its own built-in welcome page and no longer loads the custom welcome.html this variable applied to; see matrix_client_element_welcome_headline for alternatives)'}
+    - {'old': 'matrix_client_element_page_template_welcome_path', 'new': '<removed> (Element Web now renders its own built-in welcome page; a fully custom page can be self-hosted and wired via embedded_pages.welcome_url in matrix_client_element_configuration_extension_json)'}

 - name: Fail if required Element Web settings not defined
  ansible.builtin.fail:
@@ -51,6 +51,23 @@ traefik.http.routers.matrix-client-element.tls={{ matrix_client_element_containe
 traefik.http.routers.matrix-client-element.tls.certResolver={{ matrix_client_element_container_labels_traefik_tls_certResolver }}
 {% endif %}

+{% if matrix_client_element_location_sharing_enabled %}
+{#
+	A dedicated router for the map style file, which attaches an Access-Control-Allow-Origin header.
+	Element Desktop loads the map style from a `vector://vector` origin, so it needs to be allowed cross-origin access.
+#}
+traefik.http.middlewares.matrix-client-element-map-style-add-headers.headers.customresponseheaders.Access-Control-Allow-Origin={{ matrix_client_element_location_sharing_map_style_access_control_allow_origin }}
+
+traefik.http.routers.matrix-client-element-map-style.rule={{ matrix_client_element_container_labels_traefik_rule }} && Path(`{{ (matrix_client_element_container_labels_traefik_path_prefix ~ '/map_style.json') | regex_replace('^//', '/') }}`)
+traefik.http.routers.matrix-client-element-map-style.service=matrix-client-element
+traefik.http.routers.matrix-client-element-map-style.middlewares={{ (middlewares + ['matrix-client-element-map-style-add-headers']) | join(',') }}
+traefik.http.routers.matrix-client-element-map-style.entrypoints={{ matrix_client_element_container_labels_traefik_entrypoints }}
+traefik.http.routers.matrix-client-element-map-style.tls={{ matrix_client_element_container_labels_traefik_tls | to_json }}
+{% if matrix_client_element_container_labels_traefik_tls %}
+traefik.http.routers.matrix-client-element-map-style.tls.certResolver={{ matrix_client_element_container_labels_traefik_tls_certResolver }}
+{% endif %}
+{% endif %}
+
 {% endif %}

 {{ matrix_client_element_container_labels_additional_labels }}
@@ -43,7 +43,6 @@ ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} create \
 			{% if matrix_client_element_embedded_pages_home_path is not none %}
 			--mount type=bind,src={{ matrix_client_element_data_path }}/home.html,dst=/app/home.html,ro \
 			{% endif %}
-			--mount type=bind,src={{ matrix_client_element_data_path }}/welcome.html,dst=/app/welcome.html,ro \
 			{% if matrix_client_element_container_healthcheck_cmd %}
 			--health-cmd="{{ matrix_client_element_container_healthcheck_cmd }}" \
 			{% endif %}
@@ -1,205 +0,0 @@
-#jinja2: lstrip_blocks: True
-<style type="text/css">
-
-/* we deliberately inline style here to avoid flash-of-CSS problems, and to avoid
- * voodoo where we have to set display: none by default
- */
-
-h1::after {
-    content: "!";
-}
-
-.mx_Parent {
-    display: -webkit-box;
-    display: -webkit-flex;
-    display: -ms-flexbox;
-    display: flex;
-    -webkit-box-orient: vertical;
-    -webkit-box-direction: normal;
-    -webkit-flex-direction: column;
-    -ms-flex-direction: column;
-    flex-direction: column;
-    -webkit-box-pack: center;
-    -webkit-justify-content: center;
-    -ms-flex-pack: center;
-    justify-content: center;
-    -webkit-box-align: center;
-    -webkit-align-items: center;
-    -ms-flex-align: center;
-    align-items: center;
-    text-align: center;
-    padding: 25px 35px;
-    color: #2e2f32;
-}
-
-.mx_Logo {
-    height: 54px;
-    margin-top: 2px;
-}
-
-.mx_ButtonGroup {
-    margin-top: 10px;
-}
-
-.mx_ButtonRow {
-    display: -webkit-box;
-    display: -webkit-flex;
-    display: -ms-flexbox;
-    display: flex;
-    -webkit-justify-content: space-around;
-    -ms-flex-pack: distribute;
-    justify-content: space-around;
-    -webkit-box-align: center;
-    -webkit-align-items: center;
-    -ms-flex-align: center;
-    align-items: center;
-    justify-content: space-between;
-    box-sizing: border-box;
-    margin: 12px 0 0;
-}
-
-.mx_ButtonRow > * {
-    margin: 0 10px;
-}
-
-.mx_ButtonRow > *:first-child {
-    margin-left: 0;
-}
-
-.mx_ButtonRow > *:last-child {
-    margin-right: 0;
-}
-
-.mx_ButtonParent {
-    display: -webkit-box;
-    display: -webkit-flex;
-    display: -ms-flexbox;
-    display: flex;
-    padding: 10px 20px;
-    -webkit-box-orient: horizontal;
-    -webkit-box-direction: normal;
-    -webkit-flex-direction: row;
-    -ms-flex-direction: row;
-    flex-direction: row;
-    -webkit-box-pack: center;
-    -webkit-justify-content: center;
-    -ms-flex-pack: center;
-    justify-content: center;
-    -webkit-box-align: center;
-    -webkit-align-items: center;
-    -ms-flex-align: center;
-    align-items: center;
-    border-radius: 4px;
-    width: 150px;
-    background-repeat: no-repeat;
-    background-position: 10px center;
-    text-decoration: none;
-    color: #2e2f32 !important;
-}
-
-.mx_ButtonLabel {
-    margin-left: 20px;
-}
-
-.mx_Header_title {
-    font-size: 24px;
-    font-weight: 600;
-    margin: 20px 0 0;
-}
-
-.mx_Header_subtitle {
-    font-size: 12px;
-    font-weight: normal;
-    margin: 8px 0 0;
-}
-
-.mx_ButtonSignIn {
-    background-color: #368BD6;
-    color: white !important;
-}
-
-.mx_ButtonCreateAccount {
-    background-color: #0DBD8B;
-    color: white !important;
-}
-
-.mx_SecondaryButton {
-    background-color: #FFFFFF;
-    color: #2E2F32;
-}
-
-.mx_Button_iconSignIn {
-    background-image: url('welcome/images/icon-sign-in.svg');
-}
-.mx_Button_iconCreateAccount {
-    background-image: url('welcome/images/icon-create-account.svg');
-}
-.mx_Button_iconHelp {
-    background-image: url('welcome/images/icon-help.svg');
-}
-.mx_Button_iconRoomDirectory {
-    background-image: url('welcome/images/icon-room-directory.svg');
-}
-
-/*
-.mx_WelcomePage_loggedIn is applied by EmbeddedPage from the Welcome component
-If it is set on the page, we should show the buttons. Otherwise, we have to assume
-we don't have an account and should hide them. No account == no guest account either.
- */
-.mx_WelcomePage:not(.mx_WelcomePage_loggedIn) .mx_WelcomePage_guestFunctions {
-    display: none;
-}
-
-.mx_ButtonRow.mx_WelcomePage_guestFunctions {
-    margin-top: 20px;
-}
-.mx_ButtonRow.mx_WelcomePage_guestFunctions > div {
-    margin: 0 auto;
-}
-
-@media only screen and (max-width: 480px) {
-    .mx_ButtonRow {
-        flex-direction: column;
-    }
-
-    .mx_ButtonRow > * {
-        margin: 0 0 10px 0;
-    }
-}
-
-</style>
-
-<div class="mx_Parent">
-    <a href="{{ matrix_client_element_welcome_logo_link }}" target="_blank" rel="noopener">
-        <img src="{{ matrix_client_element_welcome_logo }}" alt="" class="mx_Logo"/>
-    </a>
-    <h1 class="mx_Header_title">{{ matrix_client_element_welcome_headline }}</h1>
-    <h4 class="mx_Header_subtitle">{{ matrix_client_element_welcome_text }}</h4>
-    <div class="mx_ButtonGroup">
-        <div class="mx_ButtonRow">
-            <a href="#/login" class="mx_ButtonParent mx_ButtonSignIn mx_Button_iconSignIn">
-                <div class="mx_ButtonLabel">_t("action|sign_in")</div>
-            </a>
-{% if matrix_client_element_registration_enabled %}
-            <a href="#/register" class="mx_ButtonParent mx_ButtonCreateAccount mx_Button_iconCreateAccount">
-                <div class="mx_ButtonLabel">_t("action|create_account")</div>
-            </a>
-{% endif %}
-        </div>
-{% if matrix_client_element_disable_guests != true %}
-        <!-- The comments below are meant to be used by Ansible as a quick way
-             to strip out the marked content when desired.
-             See https://github.com/element-hq/riot-web/issues/8622.
-             TODO: Convert to config option if possible. -->
-        <!-- BEGIN Ansible: Remove these lines when guest access is disabled -->
-        <div class="mx_ButtonRow mx_WelcomePage_guestFunctions">
-            <div>
-                <a href="#/directory" class="mx_ButtonParent mx_SecondaryButton mx_Button_iconRoomDirectory">
-                    <div class="mx_ButtonLabel">_t("action|explore_rooms")</div>
-                </a>
-            </div>
-        </div>
-        <!-- END Ansible: Remove these lines when guest access is disabled -->
-{% endif %}
-    </div>
-</div>
@@ -1,9 +0,0 @@
-SPDX-FileCopyrightText: 2019 Daniel Hoffend
-SPDX-FileCopyrightText: 2019 Hugues De Keyzer
-SPDX-FileCopyrightText: 2020 - 2022 Slavi Pantaleev
-SPDX-FileCopyrightText: 2020 Clement Renaud
-SPDX-FileCopyrightText: 2020 Stefan Warnat
-SPDX-FileCopyrightText: 2023 Pierre 'McFly' Marty
-SPDX-FileCopyrightText: 2024 MDAD project contributors
-
-SPDX-License-Identifier: AGPL-3.0-or-later
@@ -14,7 +14,7 @@ matrix_continuwuity_enabled: true
 matrix_continuwuity_hostname: ''

 # renovate: datasource=docker depName=forgejo.ellis.link/continuwuation/continuwuity
-matrix_continuwuity_version: v26.6.1
+matrix_continuwuity_version: v26.6.2

 matrix_continuwuity_container_image: "{{ matrix_continuwuity_container_image_registry_prefix }}/continuwuation/continuwuity:{{ matrix_continuwuity_container_image_tag }}"
 matrix_continuwuity_container_image_tag: "{{ matrix_continuwuity_version }}"
@@ -413,6 +413,14 @@ matrix_media_repo_shared_secret_auth_token: "PutSomeRandomSecureValueHere"
 # thumbnails and other misc data is also stored in these places. The media repo, when looking
 # for a datastore to use, will always use the smallest datastore first.

+# Controls whether the file datastore is defined in the configuration at all.
+# A datastore can be defined but disabled for uploads (making it readonly) by keeping this enabled
+# while setting `matrix_media_repo_datastore_file_for_kinds: []`. This is useful when migrating
+# media to another datastore, as previously stored media remains readable.
+# By default, the datastore is defined whenever some kinds are assigned to it, matching the
+# previous behavior of this role.
+matrix_media_repo_datastore_file_enabled: "{{ (matrix_media_repo_datastore_file_for_kinds | length) > 0 }}"
+
 # ID for the file datastore. Any unique alphanumeric string (e.g. generated via `pwgen -s 64 1`).
 # This value CANNOT be changed after media has been stored — matrix-media-repo ties media to this ID.
 matrix_media_repo_datastore_file_id: ""
@@ -434,6 +442,14 @@ matrix_media_repo_datastore_file_for_kinds: ["thumbnails", "remote_media", "loca
 # Path to datastore, relative to matrix-media-repo directory root
 matrix_media_repo_datastore_opts_path: "/data/media"

+# Controls whether the S3 datastore is defined in the configuration at all.
+# A datastore can be defined but disabled for uploads (making it readonly) by keeping this enabled
+# while setting `matrix_media_repo_datastore_s3_for_kinds: []`. This is useful when migrating
+# media to another datastore, as previously stored media remains readable.
+# By default, the datastore is defined whenever some kinds are assigned to it, matching the
+# previous behavior of this role.
+matrix_media_repo_datastore_s3_enabled: "{{ (matrix_media_repo_datastore_s3_for_kinds | length) > 0 }}"
+
 # ID for the S3 datastore. Any unique alphanumeric string (e.g. generated via `pwgen -s 64 1`).
 # This value CANNOT be changed after media has been stored — matrix-media-repo ties media to this ID.
 matrix_media_repo_datastore_s3_id: ""
@@ -50,5 +50,5 @@
    - {'name': 'matrix_media_repo_database_hostname', when: true}
    - {'name': 'matrix_media_repo_container_labels_traefik_internal_media_entrypoints', when: "{{ matrix_media_repo_container_labels_traefik_internal_media_enabled }}"}
    - {'name': 'matrix_media_repo_container_labels_traefik_internal_matrix_client_media_entrypoints', when: "{{ matrix_media_repo_container_labels_traefik_internal_matrix_client_media_enabled }}"}
-    - {'name': 'matrix_media_repo_datastore_file_id', when: "{{ (matrix_media_repo_datastore_file_for_kinds | length) > 0 }}"}
-    - {'name': 'matrix_media_repo_datastore_s3_id', when: "{{ (matrix_media_repo_datastore_s3_for_kinds | length) > 0 }}"}
+    - {'name': 'matrix_media_repo_datastore_file_id', when: "{{ matrix_media_repo_datastore_file_enabled }}"}
+    - {'name': 'matrix_media_repo_datastore_s3_id', when: "{{ matrix_media_repo_datastore_s3_enabled }}"}
@@ -198,7 +198,7 @@ sharedSecretAuth:
 # thumbnails and other misc data is also stored in these places. The media repo, when looking
 # for a datastore to use, will always use the smallest datastore first.
 datastores:
-{% if (matrix_media_repo_datastore_file_for_kinds | length) > 0 %}
+{% if matrix_media_repo_datastore_file_enabled %}
  - type: file
    # ID for this datastore (cannot change). Alphanumeric recommended.
    id: {{ matrix_media_repo_datastore_file_id | to_json }}
@@ -218,7 +218,7 @@ datastores:
    opts:
      path: {{ matrix_media_repo_datastore_opts_path | to_json }}
 {% endif %}
-{% if (matrix_media_repo_datastore_s3_for_kinds | length) > 0 %}
+{% if matrix_media_repo_datastore_s3_enabled %}
  - type: s3
    # ID for this datastore (cannot change). Alphanumeric recommended.
    id: {{ matrix_media_repo_datastore_s3_id | to_json }}
@@ -72,6 +72,7 @@ matrix_prometheus_services_connect_scraper_synapse_workers_enabled: "{{ matrix_p

 matrix_prometheus_services_connect_scraper_synapse_workers_enabled_list: []

+# No {# #} comments inside the block below: indented, they leak whitespace and corrupt the YAML.
 matrix_prometheus_services_connect_scraper_synapse_workers_static_configs_as_yaml: |
  {% for worker in matrix_prometheus_services_connect_scraper_synapse_workers_enabled_list %}
  {% if worker.metrics_port != 0 %}
@@ -79,6 +80,7 @@ matrix_prometheus_services_connect_scraper_synapse_workers_static_configs_as_yam
      labels:
        instance: {{ matrix_prometheus_services_connect_scraper_synapse_workers_static_configs_instance | to_json }}
        worker_id: {{ worker.id | to_json }}
+        index: {{ worker.id | regex_search('[0-9]+') | to_json }}
        job: {{ worker.type | to_json }}
        app: {{ worker.app | to_json }}
  {% endif %}
@@ -86,7 +88,7 @@ matrix_prometheus_services_connect_scraper_synapse_workers_static_configs_as_yam

 matrix_prometheus_services_connect_scraper_synapse_workers_static_configs_instance: "{{ matrix_domain }}"

-matrix_prometheus_services_connect_scraper_synapse_workers_static_configs: "{{ [] if matrix_prometheus_services_connect_scraper_synapse_workers_enabled_list | length == 0 else matrix_prometheus_services_connect_scraper_synapse_workers_static_configs_as_yaml | from_yaml }}"
+matrix_prometheus_services_connect_scraper_synapse_workers_static_configs: "{{ [] if matrix_prometheus_services_connect_scraper_synapse_workers_enabled_list | length == 0 else matrix_prometheus_services_connect_scraper_synapse_workers_static_configs_as_yaml | from_yaml or [] }}"

 # Controls whether Postgres (postgres-exporter) shall be scraped
 matrix_prometheus_services_connect_scraper_postgres_enabled: false
@@ -43,6 +43,19 @@

 - when: "matrix_synapse_usage_exporter_container_image_self_build | bool"
  block:
+    # A repository left behind with different file ownership (e.g. cloned by another user in the past)
+    # would make the git update below fail, either with a permission error or with git's
+    # dubious-ownership protection kicking in (which manifests as a confusing
+    # "'origin' does not appear to be a git repository" error, because git ignores
+    # the repository's own configuration in that case).
+    - name: Ensure synapse-usage-exporter repository ownership is correct on self-build
+      ansible.builtin.file:
+        path: "{{ matrix_synapse_usage_exporter_docker_src_files_path }}"
+        state: directory
+        owner: "{{ matrix_user_name }}"
+        group: "{{ matrix_group_name }}"
+        recurse: true
+
    - name: Ensure synapse-usage-exporter repository is present on self-build
      ansible.builtin.git:
        repo: "{{ matrix_synapse_usage_exporter_container_image_self_build_repo }}"
@@ -51,6 +64,10 @@
        force: "yes"
      become: true
      become_user: "{{ matrix_user_name }}"
+      environment:
+        GIT_CONFIG_COUNT: "1"
+        GIT_CONFIG_KEY_0: safe.directory
+        GIT_CONFIG_VALUE_0: "{{ matrix_synapse_usage_exporter_docker_src_files_path }}"
      register: matrix_synapse_usage_exporter_git_pull_results

    - name: Check if synapse-usage-exporter Docker image exists
Author	SHA1	Message	Date
github-actions[bot]	9063739eae	Automatic translations update	2026-07-15 04:33:38 +00:00
Slavi Pantaleev	376786b997	Upgrade ansible-role-livekit-server (v1.13.3-0 -> v1.13.3-1) The new version adds livekit_server_config_rtc_ips_includes and livekit_server_config_rtc_ips_excludes variables, controlling LiveKit's rtc.ips.includes/excludes CIDR filters for RTC IP addresses. Related to #4958 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-15 07:31:52 +03:00
Slavi Pantaleev	de1ba73f40	Add dedicated CAPTCHA variables to matrix-authentication-service Matrix Authentication Service supports CAPTCHA protection (ReCaptcha v2, Cloudflare Turnstile, hCaptcha) for certain operations like self-service password registration, but configuring it required going through matrix_authentication_service_configuration_extension_yaml. Expose it via dedicated variables (matrix_authentication_service_config_captcha_service, _site_key and _secret_key), validate the service value and key presence, and document the setup in the captcha documentation page, which so far only covered Synapse and Dendrite. Related to #5344 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-15 07:29:35 +03:00
Slavi Pantaleev	d2f1fa74cc	Document homeserver requirements for hookshot's end-to-bridge encryption Enabling matrix_hookshot_encryption_enabled configures the bridge side correctly (registration flags, Valkey cache), but hookshot's encryption also needs the homeserver to support and enable MSC2409 and MSC3202, which are typically experimental features disabled by default. Nothing documented that, so the resulting setup silently did not work. Reference the MSCs in the variable's comment, and show the exact Synapse settings in the hookshot documentation page. The playbook deliberately does not auto-enable them: they are experimental homeserver-wide features, and flipping them from a bridge toggle would be surprising. Fixes #3861 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-15 06:01:27 +03:00
Slavi Pantaleev	62792b3670	Fix double-slash in Jitsi's Etherpad integration URLs etherpad_base_url always ends with a trailing slash, and the playbook passed it verbatim to jitsi_etherpad_base, which the Jitsi role appends path segments to (e.g. /p/). The generated Jitsi configuration therefore contained URLs like https://etherpad.example.com//p/, which can 404 depending on the web server. Strip trailing slashes when wiring. Fixes #3471 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-14 15:16:31 +03:00
Slavi Pantaleev	a039cc5982	Upgrade ansible-role-grafana (v13.0.2-0 -> v13.0.2-1) and use grafana_dashboard_download_urls_auto The new role release splits grafana_dashboard_download_urls into default/auto/custom components. Wire the playbook's automatic dashboard list via the auto component, so users can add their own dashboards through grafana_dashboard_download_urls_custom without clobbering it. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-14 14:59:18 +03:00
Slavi Pantaleev	5a9e34c563	Document that Synapse cache autotuning limits apply per process The autotuning defaults are derived from total system RAM, but every Synapse process (the main one and each worker) applies the configured limits independently, so worker setups multiply the theoretical aggregate cache memory usage. Fixes #3336 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-14 14:56:48 +03:00
Slavi Pantaleev	534631c1e7	Document Synapse database restore pitfalls per the official backup guide Add the two remaining hints from the official Synapse backup guide: - never import a dump into a database that already has tables present (at best it errors, at worst it causes subtle inconsistencies) - when restoring a backup older than the server's current state, truncate e2e_one_time_keys_json before starting Synapse, so used one-time keys are not re-issued (which causes decryption errors); our pg_dumpall-based backup commands include that table Fixes #4004 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-14 14:34:45 +03:00
renovate[bot]	635bb61424	Update dependency postgres to v18.4-2	2026-07-14 14:32:12 +03:00
Slavi Pantaleev	c7819f576a	Remove the custom Element Web welcome page Element Web redesigned its welcome page into a built-in component (element-hq/element-web#33211, first released in spring 2026) and no longer falls back to loading welcome.html. The custom page the playbook installed had therefore silently stopped having any effect, and it was a fork of an upstream file that upstream has deleted (its button icon assets are already missing from current Element Web builds). Remove the welcome.html shipping and the variables that only applied to it (matrix_client_element_welcome_headline, _welcome_text, _welcome_logo_link, _page_template_welcome_path), rejecting them in validate_config.yml with pointers to the alternatives. Logo and background customization keep working through Element Web's branding options, which the new welcome page still honors. A fully custom page can be self-hosted and wired via embedded_pages.welcome_url. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-14 07:49:39 +03:00
Aine	435aecc1a8	fix prometheus wiring	2026-07-13 22:46:37 +01:00
Slavi Pantaleev	a03faef70f	Stop excluding Synapse's local_thumbnails from BorgBackup Synapse only generates thumbnails of local media at upload time (unless dynamic_thumbnails is enabled, which the playbook does not do) and no tooling exists to regenerate them, so restoring a backup left all previously uploaded local images without thumbnails permanently. The official Synapse backup guide recommends backing this directory up. Related to #4004. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-13 21:18:43 +03:00
Slavi Pantaleev	94d8e28306	Support readonly datastores for matrix-media-repo The configuration template only rendered a datastore when its for_kinds list was non-empty, even though the inline documentation (matching upstream's) describes forKinds: [] as the way to make a datastore readonly. That made the documented migration scenario impossible: moving media between the file and s3 datastores while keeping the old one readable. Introduce matrix_media_repo_datastore_file_enabled and matrix_media_repo_datastore_s3_enabled, which default to the previous kinds-based behavior. A readonly datastore is now expressed by enabling the datastore explicitly while assigning it no kinds. Fixes #4303 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-13 21:17:09 +03:00
Slavi Pantaleev	6b4b7647e4	Fix synapse-usage-exporter self-build failing on git ownership checks synapse-usage-exporter is self-built by default (no upstream image is published), so every user enabling it runs the git clone/update task. A docker-src checkout whose files are owned by a different user (e.g. left behind by an earlier clone) made that task fail: either with a permission error, or with git's dubious-ownership protection, which ignores the repository's own configuration and surfaces as a confusing "'origin' does not appear to be a git repository" error. Ensure the checkout's ownership recursively before updating it, and mark the path as a safe.directory for the git invocation itself (via GIT_CONFIG_* environment variables), so the ownership check cannot misfire regardless of which user git effectively runs as. Fixes #5065 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-13 19:25:34 +03:00
Slavi Pantaleev	90d486c4f6	Correct CORS guidance for 302-redirect based well-known setup The docs claimed that reverse-proxying "or simply a 302 redirect" needs no CORS headers. That is only true for reverse-proxying: browsers apply CORS checks to every response in a redirect chain, so a redirect response itself must also carry Access-Control-Allow-Origin, otherwise web clients fail even though the final destination sets the header. Fixes #4650 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-13 16:35:07 +03:00
Slavi Pantaleev	2d436491c6	Escape mautrix-meta username prefix in registration regexes The user-namespace regexes in the mautrix-meta-messenger and mautrix-meta-instagram registration templates interpolated the bridge username prefix without regex-escaping it, unlike the neighboring homeserver domain and appservice username values. The default prefixes are regex-safe, but a customized prefix containing regex metacharacters would produce a wrong (too broad or invalid) appservice user namespace. Related to the registration regex discussion in #5096. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-13 16:34:31 +03:00
Slavi Pantaleev	8b9fe4ce37	Make Element welcome page text readable on the dark theme The playbook-shipped welcome.html hardcoded #2e2f32 for the headline and welcome text, which is nearly invisible on the dark background Element renders when the dark theme is active. Element Web's default use_system_theme behavior keys the theme off the system color scheme, so switch the text to Element's dark-theme text color (#ebeef2) under a prefers-color-scheme: dark media query. Fixes #4838 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-13 16:33:55 +03:00
Slavi Pantaleev	639996d3a0	Upgrade ansible-role-backup_borg (v1.4.4-2.1.4-1 -> v1.4.4-2.1.6-1) Pulls in borgmatic 2.1.6, fixing the 2.1.4 JSON parsing regression (borgmatic-collective/borgmatic#1294) where warnings on stderr, such as OpenSSH post-quantum key exchange notices, broke parsing of borg's JSON output and failed the backup run. Fixes #5188 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-13 16:33:03 +03:00
Slavi Pantaleev	f8539f4cbf	Fix Traefik router name in SRV server delegation docs The wildcard certificate examples attached tls.domains labels to a router named matrix-synapse-federation-api, but the Synapse role actually names it matrix-synapse-public-federation-api (see templates/synapse/labels.j2), so the documented labels matched nothing and the certificate configuration silently did not apply. Fixes #3129 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-13 15:30:58 +03:00
Slavi Pantaleev	a4915c0b9e	Remove never-implemented appservice-discord self-build variable matrix_appservice_discord_container_image_self_build only switched the image registry prefix to localhost/, but the role never had any build tasks, so enabling it always ended in an image pull failure. Remove the variable and reject it in validate_config.yml with a hint that the prebuilt image is amd64-only and that mautrix-discord is the better option on other architectures. Fixes #2379 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-13 15:03:51 +03:00
Slavi Pantaleev	deb19c46a8	Document rsync as a server-side prerequisite for media store import The import-synapse-media-store task synchronizes the media store with ansible.posix.synchronize delegated to the server itself, which requires the rsync binary on the server. Nothing in the playbook installs it, so the import failed on minimal systems with "Failed to find required executable rsync". Document the prerequisite. Fixes #2551 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-13 15:03:05 +03:00
Slavi Pantaleev	2fe710bdb4	Document Caddy directive-order pitfall for well-known reverse-proxying Caddy evaluates directives according to its own fixed directive order, not their order in the Caddyfile. redir runs before reverse_proxy, so a redirect elsewhere in the same site block silently shadows the /.well-known/matrix reverse-proxying. Add a note and a handle-block example that enforces the intended priority. Fixes #1080 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-13 15:02:20 +03:00
Slavi Pantaleev	ee38b3aac2	Grant pg_monitor to the prometheus-postgres-exporter database user The exporter's wal collector (enabled by default) calls pg_ls_waldir(), which Postgres restricts to superusers and members of the pg_monitor role. The exporter user is created as a plain managed-database user, so scraping logged "permission denied for function pg_ls_waldir" on every run. Grant pg_monitor via the managed database's additional_sql_queries, which the Postgres role applies both on initial creation and on subsequent runs, covering existing installations too. Fixes #3039 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-13 13:21:19 +03:00
Slavi Pantaleev	506d4ab4c9	Upgrade ansible-role-postgres (v18.4-0 -> v18.4-1) Pulls in the pgloader connection string handling fix, which keeps the Postgres password out of the command line and Ansible error output. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-13 09:01:00 +03:00
Slavi Pantaleev	44cfd16036	Add index label to Synapse worker Prometheus targets The upstream Synapse Grafana dashboard uses `{{job}}-{{index}}` in its legends to tell workers apart, but the worker scrape configs only set instance, worker_id, job and app labels. Without an index label, the dashboard legends collapsed and workers could not be distinguished. Derive the index label from the worker id (its per-type index is the first number in the id, e.g. federation-sender-1, stream-writer-2-events), matching the index label already set on the main process target. Fixes #2158 Fixes #2159 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-13 09:01:00 +03:00
Slavi Pantaleev	b32272ef40	Add CORS header to Element's map_style.json for Element Desktop Element Desktop (Electron) loads the location-sharing map style from a `vector://vector` origin, so fetching map_style.json from the Element domain is a cross-origin request. Without an Access-Control-Allow-Origin header, the request is blocked and maps fail to load with "This homeserver is not configured correctly to display maps". Add a dedicated Traefik router for map_style.json that attaches an Access-Control-Allow-Origin header (configurable via matrix_client_element_location_sharing_map_style_access_control_allow_origin, defaulting to `*`). It is only defined when location sharing is enabled. Fixes #2291 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-13 09:01:00 +03:00
renovate[bot]	d0f877fb86	Update dependency sable to v1.19.4-0	2026-07-13 08:47:12 +03:00
Suguru Hirahara	bb1cbdb111	Add other unimportant dependencies to matchFileNames on renovate.json Signed-off-by: Suguru Hirahara <did:key:z6MkvVZk1A3KBApWJXv2Ju4H14ErDfRGxh8zxdXSZ4vACDg5>	2026-07-13 01:39:13 -04:00
renovate[bot]	f8ea906c19	Update forgejo.ellis.link/continuwuation/continuwuity Docker tag to v26.6.2	2026-07-13 07:16:44 +03:00
Suguru Hirahara	7f4691aabb	Add flake.lock to be the list of items for automerge Signed-off-by: Suguru Hirahara <did:key:z6MkvVZk1A3KBApWJXv2Ju4H14ErDfRGxh8zxdXSZ4vACDg5>	2026-07-13 07:16:00 +03:00
github-actions[bot]	85484aed85	Automatic translations update	2026-07-12 18:51:50 +03:00
Slavi Pantaleev	fa8c764708	Fix up devcontainer config (REUSE, strict JSON, image bump) and mention it in docs - add SPDX licensing information for REUSE compliance - drop the JSONC comment from devcontainer.json, keeping it strict JSON (as required by the check-json pre-commit hook) - bump the base image to the current ghcr.io/devture/ansible release - mention the dev container in docs/ansible.md Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-12 18:36:27 +03:00
Slavi Pantaleev	fba605de34	Merge pull request #4365 from jonaharagon/devcontainer Add devcontainer config	2026-07-12 18:34:16 +03:00
Slavi Pantaleev	0b966a4500	Update agru version label to match the locked v0.2.1 revision flake.lock already pins agru at the v0.2.1 commit (via #5415); this label only names the built derivation. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-12 18:24:05 +03:00
renovate[bot]	93caf43948	Lock file maintenance (#5415 ) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>	2026-07-12 18:23:44 +03:00
Jonah Aragon	4a4ca67465	Use `ghcr.io/devture/ansible` image	2025-08-14 19:18:39 -05:00
Jonah Aragon	0f40fe6270	Add devcontainer config	2025-08-14 19:18:39 -05:00