Automatic translations update

i18n/translation-templates/docs/configuring-captcha.pot

@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: matrix-docker-ansible-deploy \n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2026-02-13 10:32+0000\n"
+"POT-Creation-Date: 2026-07-15 04:33+0000\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"
@@ -33,43 +33,59 @@ msgid "The captcha mechanism used is Google's [ReCaptcha](https://www.google.com
 msgstr ""
 
 #: ../../../docs/configuring-captcha.md:18
-msgid "ReCaptcha"
+msgid "If you are using [Matrix Authentication Service](configuring-playbook-matrix-authentication-service.md), captcha is configured there instead (it handles registration), and [Cloudflare Turnstile](https://www.cloudflare.com/application-services/products/turnstile/) is supported as well. See [Matrix Authentication Service](#matrix-authentication-service) below."
 msgstr ""
 
 #: ../../../docs/configuring-captcha.md:20
-#: ../../../docs/configuring-captcha.md:46
+msgid "ReCaptcha"
-msgid "Getting keys"
 msgstr ""
 
 #: ../../../docs/configuring-captcha.md:22
 #: ../../../docs/configuring-captcha.md:48
-msgid "Requires a site/secret key pair from:"
+msgid "Getting keys"
 msgstr ""
 
 #: ../../../docs/configuring-captcha.md:24
-msgid "<http://www.google.com/recaptcha/admin>"
+#: ../../../docs/configuring-captcha.md:50
+msgid "Requires a site/secret key pair from:"
 msgstr ""
 
 #: ../../../docs/configuring-captcha.md:26
-msgid "Must be a reCAPTCHA **v2** key using the \"I'm not a robot\" Checkbox option"
+msgid "<http://www.google.com/recaptcha/admin>"
 msgstr ""
 
 #: ../../../docs/configuring-captcha.md:28
-msgid "Setting ReCaptcha keys"
+msgid "Must be a reCAPTCHA **v2** key using the \"I'm not a robot\" Checkbox option"
 msgstr ""
 
 #: ../../../docs/configuring-captcha.md:30
+msgid "Setting ReCaptcha keys"
+msgstr ""
+
+#: ../../../docs/configuring-captcha.md:32
 msgid "Once registered as above, add the following configuration to your `inventory/host_vars/matrix.example.com/vars.yml` file:"
 msgstr ""
 
-#: ../../../docs/configuring-captcha.md:44
+#: ../../../docs/configuring-captcha.md:46
 msgid "hCaptcha"
 msgstr ""
 
-#: ../../../docs/configuring-captcha.md:50
+#: ../../../docs/configuring-captcha.md:52
 msgid "<https://dashboard.hcaptcha.com/sites/new>"
 msgstr ""
 
-#: ../../../docs/configuring-captcha.md:52
+#: ../../../docs/configuring-captcha.md:54
 msgid "Setting hCaptcha keys"
 msgstr ""
+
+#: ../../../docs/configuring-captcha.md:67
+msgid "Matrix Authentication Service"
+msgstr ""
+
+#: ../../../docs/configuring-captcha.md:69
+msgid "When [Matrix Authentication Service](configuring-playbook-matrix-authentication-service.md) is enabled, registration and other account operations are handled by it, so captcha protection is configured there (the Synapse and Dendrite settings above do not apply)."
+msgstr ""
+
+#: ../../../docs/configuring-captcha.md:71
+msgid "Matrix Authentication Service supports [ReCaptcha v2](http://www.google.com/recaptcha/admin), [Cloudflare Turnstile](https://www.cloudflare.com/application-services/products/turnstile/) and [hCaptcha](https://dashboard.hcaptcha.com/sites/new). Obtain a site/secret key pair from your chosen service, then add the following configuration to your `inventory/host_vars/matrix.example.com/vars.yml` file:"
+msgstr ""

i18n/translation-templates/docs/configuring-playbook-bridge-hookshot.pot

@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: matrix-docker-ansible-deploy \n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2026-02-13 10:32+0000\n"
+"POT-Creation-Date: 2026-07-15 04:33+0000\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"
@@ -56,95 +56,103 @@ msgstr ""
 msgid "Add the following configuration to your `inventory/host_vars/matrix.example.com/vars.yml` file. Make sure to replace `GITHUB_PRIVATE_KEY_HERE` with the one created [above](#download-github-app-private-key)."
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bridge-hookshot.md:43
+#: ../../../docs/configuring-playbook-bridge-hookshot.md:44
-msgid "For each of the services (GitHub, GitLab, Jira, Figma, and generic webhooks) fill in the respective variables `matrix_hookshot_service_*` listed in [main.yml](../roles/custom/matrix-bridge-hookshot/defaults/main.yml) as required."
+msgid "End-to-bridge encryption also requires the homeserver to support (and have enabled) [MSC2409](https://github.com/matrix-org/matrix-spec-proposals/pull/2409) and [MSC3202](https://github.com/matrix-org/matrix-spec-proposals/pull/3202). If you are using Synapse, enable them by also adding this to your `vars.yml` file:"
-msgstr ""
-
-#: ../../../docs/configuring-playbook-bridge-hookshot.md:45
-msgid "Take special note of the `matrix_hookshot_*_enabled` variables. Services that need no further configuration are enabled by default (GitLab and generic webhooks), while you must first add the required configuration and enable the others (GitHub, Jira, and Figma)."
-msgstr ""
-
-#: ../../../docs/configuring-playbook-bridge-hookshot.md:47
-msgid "Extending the configuration"
-msgstr ""
-
-#: ../../../docs/configuring-playbook-bridge-hookshot.md:49
-msgid "There are some additional things you may wish to configure about the bridge."
 msgstr ""
 
 #: ../../../docs/configuring-playbook-bridge-hookshot.md:51
-msgid "Take a look at:"
+msgid "These are experimental homeserver-wide features (as is Hookshot's encryption support itself), so enable them deliberately."
 msgstr ""
 
 #: ../../../docs/configuring-playbook-bridge-hookshot.md:53
+msgid "For each of the services (GitHub, GitLab, Jira, Figma, and generic webhooks) fill in the respective variables `matrix_hookshot_service_*` listed in [main.yml](../roles/custom/matrix-bridge-hookshot/defaults/main.yml) as required."
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bridge-hookshot.md:55
+msgid "Take special note of the `matrix_hookshot_*_enabled` variables. Services that need no further configuration are enabled by default (GitLab and generic webhooks), while you must first add the required configuration and enable the others (GitHub, Jira, and Figma)."
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bridge-hookshot.md:57
+msgid "Extending the configuration"
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bridge-hookshot.md:59
+msgid "There are some additional things you may wish to configure about the bridge."
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bridge-hookshot.md:61
+msgid "Take a look at:"
+msgstr ""
+
+#: ../../../docs/configuring-playbook-bridge-hookshot.md:63
 msgid "`roles/custom/matrix-bridge-hookshot/defaults/main.yml` for some variables that you can customize via your `vars.yml` file"
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bridge-hookshot.md:54
+#: ../../../docs/configuring-playbook-bridge-hookshot.md:64
 msgid "`roles/custom/matrix-bridge-hookshot/templates/config.yaml.j2` for the bridge's default configuration. You can override settings (even those that don't have dedicated playbook variables) using the `matrix_hookshot_configuration_extension_yaml` and `matrix_hookshot_registration_extension_yaml` variables"
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bridge-hookshot.md:56
+#: ../../../docs/configuring-playbook-bridge-hookshot.md:66
 msgid "Refer the [official instructions](https://matrix-org.github.io/matrix-hookshot/latest/setup.html) and the comments in [main.yml](../roles/custom/matrix-bridge-hookshot/defaults/main.yml) to learn what the individual options do."
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bridge-hookshot.md:58
+#: ../../../docs/configuring-playbook-bridge-hookshot.md:68
 msgid "Installing"
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bridge-hookshot.md:60
+#: ../../../docs/configuring-playbook-bridge-hookshot.md:70
 msgid "After configuring the playbook, run it with [playbook tags](playbook-tags.md) as below:"
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bridge-hookshot.md:67
+#: ../../../docs/configuring-playbook-bridge-hookshot.md:77
 msgid "The shortcut commands with the [`just` program](just.md) are also available: `just install-service hookshot` or `just setup-all`"
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bridge-hookshot.md:69
+#: ../../../docs/configuring-playbook-bridge-hookshot.md:79
 msgid "`just install-service hookshot` is useful for maintaining your setup quickly when its components remain unchanged. If you adjust your `vars.yml` to remove other components, you'd need to run `just setup-all`, or these components will still remain installed. Note `just setup-all` runs the `ensure-matrix-users-created` tag too."
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bridge-hookshot.md:71
+#: ../../../docs/configuring-playbook-bridge-hookshot.md:81
 msgid "Usage"
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bridge-hookshot.md:73
+#: ../../../docs/configuring-playbook-bridge-hookshot.md:83
 msgid "To use the bridge, you need to create a room and invite the Hookshot bot (`@hookshot:example.com`) to it."
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bridge-hookshot.md:75
+#: ../../../docs/configuring-playbook-bridge-hookshot.md:85
 msgid "Make sure the bot is able to send state events (usually the Moderator power level in clients)."
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bridge-hookshot.md:77
+#: ../../../docs/configuring-playbook-bridge-hookshot.md:87
 msgid "Send `!hookshot help` to the bot to see the available commands."
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bridge-hookshot.md:79
+#: ../../../docs/configuring-playbook-bridge-hookshot.md:89
 msgid "Refer to [Hookshot's documentation](https://matrix-org.github.io/matrix-hookshot/latest/usage.html) for more details about using the bridge's various features."
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bridge-hookshot.md:81
+#: ../../../docs/configuring-playbook-bridge-hookshot.md:91
 msgid "💡 **Note**: the different listeners are bound to certain paths which might differ from those assumed by the hookshot documentation. See [URLs for bridges setup](#urls-for-bridges-setup) below."
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bridge-hookshot.md:83
+#: ../../../docs/configuring-playbook-bridge-hookshot.md:93
 msgid "Reset crypto store"
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bridge-hookshot.md:85
+#: ../../../docs/configuring-playbook-bridge-hookshot.md:95
 msgid "Should the crypto store be corrupted, you can reset it by executing this Ansible playbook with the tag `reset-hookshot-encryption` added:"
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bridge-hookshot.md:91
+#: ../../../docs/configuring-playbook-bridge-hookshot.md:101
 msgid "More setup documentation"
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bridge-hookshot.md:93
+#: ../../../docs/configuring-playbook-bridge-hookshot.md:103
 msgid "URLs for bridges setup"
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bridge-hookshot.md:95
+#: ../../../docs/configuring-playbook-bridge-hookshot.md:105
 msgid "Unless indicated otherwise, the following endpoints are reachable on your `matrix.` subdomain (if the feature is enabled)."
 msgstr ""
 
@@ -276,98 +284,98 @@ msgstr ""
 msgid "Widgets"
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bridge-hookshot.md:107
+#: ../../../docs/configuring-playbook-bridge-hookshot.md:117
 msgid "Also see the various `matrix_hookshot_container_labels_*` variables in [main.yml](../roles/custom/matrix-bridge-hookshot/defaults/main.yml), which expose URLs publicly."
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bridge-hookshot.md:109
+#: ../../../docs/configuring-playbook-bridge-hookshot.md:119
 msgid "The different listeners are also reachable *internally* in the docker-network via the container's name (configured by `matrix_hookshot_container_url`) and on different ports (e.g. `matrix_hookshot_appservice_port`). Read [main.yml](../roles/custom/matrix-bridge-hookshot/defaults/main.yml) in detail for more info."
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bridge-hookshot.md:111
+#: ../../../docs/configuring-playbook-bridge-hookshot.md:121
 msgid "Manage GitHub Private Key with aux role"
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bridge-hookshot.md:113
+#: ../../../docs/configuring-playbook-bridge-hookshot.md:123
 msgid "The GitHub bridge requires you to install a private key file. This can be done in multiple ways:"
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bridge-hookshot.md:115
+#: ../../../docs/configuring-playbook-bridge-hookshot.md:125
 msgid "copy the *contents* of the downloaded file and set the variable `matrix_hookshot_github_private_key` to the contents (see example in [main.yml](../roles/custom/matrix-bridge-hookshot/defaults/main.yml))."
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bridge-hookshot.md:116
+#: ../../../docs/configuring-playbook-bridge-hookshot.md:126
 msgid "somehow copy the file to the path `{{ matrix_hookshot_base_path }}/{{ matrix_hookshot_github_private_key_file }}` (default: `/matrix/hookshot/private-key.pem`) on the server manually."
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bridge-hookshot.md:117
+#: ../../../docs/configuring-playbook-bridge-hookshot.md:127
 msgid "use the [`aux` role](https://github.com/mother-of-all-self-hosting/ansible-role-aux) to copy the file from an arbitrary path on your ansible client to the correct path on the server."
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bridge-hookshot.md:119
+#: ../../../docs/configuring-playbook-bridge-hookshot.md:129
 msgid "To use the `aux` role, make sure the `matrix_hookshot_github_private_key` variable is empty. Then add the following configuration to your `vars.yml` file:"
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bridge-hookshot.md:130
+#: ../../../docs/configuring-playbook-bridge-hookshot.md:140
 msgid "For more information, see the documentation in the [default configuration of the aux role](https://github.com/mother-of-all-self-hosting/ansible-role-aux/blob/main/defaults/main.yml)."
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bridge-hookshot.md:132
+#: ../../../docs/configuring-playbook-bridge-hookshot.md:142
 msgid "Enable metrics"
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bridge-hookshot.md:134
+#: ../../../docs/configuring-playbook-bridge-hookshot.md:144
 msgid "The playbook can enable and configure the metrics of the service for you."
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bridge-hookshot.md:136
+#: ../../../docs/configuring-playbook-bridge-hookshot.md:146
 msgid "Metrics are **only enabled by default** if the builtin [Prometheus](configuring-playbook-prometheus-grafana.md) is enabled (by default, Prometheus isn't enabled). If so, metrics will automatically be collected by Prometheus and made available in Grafana. You will, however, need to set up your own Dashboard for displaying them."
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bridge-hookshot.md:138
+#: ../../../docs/configuring-playbook-bridge-hookshot.md:148
 msgid "To enable the metrics, add the following configuration to your `vars.yml` file:"
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bridge-hookshot.md:145
+#: ../../../docs/configuring-playbook-bridge-hookshot.md:155
 msgid "**To collect metrics from an external Prometheus server**, besides enabling metrics as described above, you will also need to enable metrics exposure on `https://matrix.example.com/metrics/hookshot` by adding the following configuration to your `vars.yml` file:"
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bridge-hookshot.md:151
+#: ../../../docs/configuring-playbook-bridge-hookshot.md:161
 msgid "By default metrics are exposed publicly **without** password-protection. To password-protect the metrics with dedicated credentials, add the following configuration to your `vars.yml` file:"
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bridge-hookshot.md:158
+#: ../../../docs/configuring-playbook-bridge-hookshot.md:168
 msgid "To `matrix_hookshot_container_labels_metrics_middleware_basic_auth_users`, set the Basic Authentication credentials (raw `htpasswd` file content) used to protect the endpoint. See https://doc.traefik.io/traefik/middlewares/http/basicauth/#users for details about it."
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bridge-hookshot.md:160
+#: ../../../docs/configuring-playbook-bridge-hookshot.md:170
 msgid "**Note**: alternatively, you can use `matrix_metrics_exposure_enabled` to expose all services on this `/metrics/*` feature, and you can use `matrix_metrics_exposure_http_basic_auth_enabled` and `matrix_metrics_exposure_http_basic_auth_users` to password-protect the metrics of them. See [this section](configuring-playbook-prometheus-grafana.md#collecting-metrics-to-an-external-prometheus-server) for more information."
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bridge-hookshot.md:162
+#: ../../../docs/configuring-playbook-bridge-hookshot.md:172
 msgid "Enable Grafana (optional)"
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bridge-hookshot.md:164
+#: ../../../docs/configuring-playbook-bridge-hookshot.md:174
 msgid "Probably you wish to enable Grafana along with Prometheus for generating graphs of the metrics."
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bridge-hookshot.md:166
+#: ../../../docs/configuring-playbook-bridge-hookshot.md:176
 msgid "To enable Grafana, see [this section](configuring-playbook-prometheus-grafana.md#adjusting-the-playbook-configuration-grafana) for instructions."
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bridge-hookshot.md:168
+#: ../../../docs/configuring-playbook-bridge-hookshot.md:178
 msgid "Troubleshooting"
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bridge-hookshot.md:170
+#: ../../../docs/configuring-playbook-bridge-hookshot.md:180
 msgid "As with all other services, you can find the logs in [systemd-journald](https://www.freedesktop.org/software/systemd/man/systemd-journald.service.html) by logging in to the server with SSH and running `journalctl -fu matrix-hookshot`."
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bridge-hookshot.md:172
+#: ../../../docs/configuring-playbook-bridge-hookshot.md:182
 msgid "Increase logging verbosity"
 msgstr ""
 
-#: ../../../docs/configuring-playbook-bridge-hookshot.md:174
+#: ../../../docs/configuring-playbook-bridge-hookshot.md:184
 msgid "The default logging level for this component is `warn`. If you want to increase the verbosity, add the following configuration to your `vars.yml` file and re-run the playbook:"
 msgstr ""

i18n/translation-templates/docs/configuring-well-known.pot

@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: matrix-docker-ansible-deploy \n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2026-02-13 10:32+0000\n"
+"POT-Creation-Date: 2026-07-15 04:33+0000\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"
@@ -181,73 +181,81 @@ msgid "On the base domain's server (e.g. `example.com`), you can set up reverse-
 msgstr ""
 
 #: ../../../docs/configuring-well-known.md:115
-msgid "With this method, you **don't need** to add special HTTP headers for [CORS](https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS) reasons (like `Access-Control-Allow-Origin`), because your Matrix server (where requests ultimately go) will be configured by this playbook correctly."
+msgid "With reverse-proxying, you **don't need** to add special HTTP headers for [CORS](https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS) reasons (like `Access-Control-Allow-Origin`), because your Matrix server (where requests ultimately go) will be configured by this playbook correctly."
 msgstr ""
 
 #: ../../../docs/configuring-well-known.md:117
+msgid "If you use a 302 redirect instead, be aware that browsers apply CORS checks to every response in the redirect chain, so the redirect response itself must also carry an `Access-Control-Allow-Origin: *` header. Otherwise, web-based Matrix clients (like Element Web) may fail to work even though the final destination sets the header correctly."
+msgstr ""
+
+#: ../../../docs/configuring-well-known.md:119
 msgid "**For nginx**, it would be something like this:"
 msgstr ""
 
-#: ../../../docs/configuring-well-known.md:134
+#: ../../../docs/configuring-well-known.md:136
 msgid "**For Apache2**, it would be something like this:"
 msgstr ""
 
-#: ../../../docs/configuring-well-known.md:148
+#: ../../../docs/configuring-well-known.md:150
 msgid "**For Caddy 2**, it would be something like this:"
 msgstr ""
 
-#: ../../../docs/configuring-well-known.md:158
+#: ../../../docs/configuring-well-known.md:160
-msgid "**For HAProxy**, it would be something like this:"
+msgid "**Note**: Caddy does not process directives in the order they appear in the Caddyfile, but according to its own [directive order](https://caddyserver.com/docs/caddyfile/directives#directive-order). Notably, `redir` is evaluated before `reverse_proxy`, so a `redir` elsewhere in the same site block (a common way to send the base domain to `www.example.com` or to another site) takes precedence and breaks the well-known reverse-proxying. In such cases, wrap the directives in [`handle`](https://caddyserver.com/docs/caddyfile/directives/handle) blocks to enforce the intended priority:"
 msgstr ""
 
 #: ../../../docs/configuring-well-known.md:177
+msgid "**For HAProxy**, it would be something like this:"
+msgstr ""
+
+#: ../../../docs/configuring-well-known.md:196
 msgid "**For Netlify**, configure a [redirect](https://docs.netlify.com/routing/redirects/) using a `_redirects` file in the [publish directory](https://docs.netlify.com/configure-builds/overview/#definitions) with contents like this:"
 msgstr ""
 
-#: ../../../docs/configuring-well-known.md:183
+#: ../../../docs/configuring-well-known.md:202
 msgid "**For AWS CloudFront**"
 msgstr ""
 
-#: ../../../docs/configuring-well-known.md:185
+#: ../../../docs/configuring-well-known.md:204
 msgid "Add a custom origin with matrix.example.com to your distribution"
 msgstr ""
 
-#: ../../../docs/configuring-well-known.md:186
+#: ../../../docs/configuring-well-known.md:205
 msgid "Add two behaviors, one for `.well-known/matrix/client` and one for `.well-known/matrix/server` and point them to your new origin."
 msgstr ""
 
-#: ../../../docs/configuring-well-known.md:188
+#: ../../../docs/configuring-well-known.md:207
 msgid "Make sure to:"
 msgstr ""
 
-#: ../../../docs/configuring-well-known.md:190
+#: ../../../docs/configuring-well-known.md:209
 msgid "**replace `example.com`** in the server configuration with your actual domain name"
 msgstr ""
 
-#: ../../../docs/configuring-well-known.md:191
+#: ../../../docs/configuring-well-known.md:210
 msgid "and: to **do this for the HTTPS-enabled server block**, as that's where Matrix expects the file to be"
 msgstr ""
 
-#: ../../../docs/configuring-well-known.md:193
+#: ../../../docs/configuring-well-known.md:212
 msgid "Confirming it works"
 msgstr ""
 
-#: ../../../docs/configuring-well-known.md:195
+#: ../../../docs/configuring-well-known.md:214
 msgid "No matter which method you've used to set up the well-known files, if you've done it correctly you should be able to see a JSON file at these URLs:"
 msgstr ""
 
-#: ../../../docs/configuring-well-known.md:197
+#: ../../../docs/configuring-well-known.md:216
 msgid "`https://example.com/.well-known/matrix/server`"
 msgstr ""
 
-#: ../../../docs/configuring-well-known.md:198
+#: ../../../docs/configuring-well-known.md:217
 msgid "`https://example.com/.well-known/matrix/client`"
 msgstr ""
 
-#: ../../../docs/configuring-well-known.md:199
+#: ../../../docs/configuring-well-known.md:218
 msgid "`https://example.com/.well-known/matrix/support`"
 msgstr ""
 
-#: ../../../docs/configuring-well-known.md:201
+#: ../../../docs/configuring-well-known.md:220
 msgid "You can also check if everything is configured correctly, by [checking if services work](maintenance-and-troubleshooting.md#how-to-check-if-services-work)."
 msgstr ""

i18n/translation-templates/docs/importing-postgres.pot

@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: matrix-docker-ansible-deploy \n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2026-02-13 10:32+0000\n"
+"POT-Creation-Date: 2026-07-15 04:33+0000\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"
@@ -25,7 +25,7 @@ msgid "You can manually import your database from a previous default installatio
 msgstr ""
 
 #: ../../../docs/importing-postgres.md:14
-#: ../../../docs/importing-postgres.md:38
+#: ../../../docs/importing-postgres.md:43
 msgid "**Notes**:"
 msgstr ""
 
@@ -57,98 +57,106 @@ msgstr ""
 msgid "Before doing the actual import, **you need to upload your Postgres dump file to the server** (any path is okay)."
 msgstr ""
 
-#: ../../../docs/importing-postgres.md:28
+#: ../../../docs/importing-postgres.md:29
+msgid "Do not import into a database that already contains tables (e.g. one that a service has already initialized and used). As the [official Synapse backup guide](https://element-hq.github.io/synapse/latest/usage/administration/backups.html) puts it: at best this will error, at worst it will lead to subtle database inconsistencies. Import into an empty (freshly created) database instead."
+msgstr ""
+
+#: ../../../docs/importing-postgres.md:31
+msgid "**Note for Synapse users restoring an older backup**: if the server kept running (and users kept chatting) after the backup you are restoring was made, truncate the `e2e_one_time_keys_json` table after importing and before starting Synapse. Restoring an older backup can otherwise cause already-used one-time keys to be re-issued, leading to message decryption errors for your users. You can do this by [getting a database terminal](maintenance-postgres.md#getting-a-database-terminal), connecting to the Synapse database (`\\c synapse`) and running `TRUNCATE e2e_one_time_keys_json;`. Clients will generate and upload fresh one-time keys automatically."
+msgstr ""
+
+#: ../../../docs/importing-postgres.md:33
 msgid "Importing"
 msgstr ""
 
-#: ../../../docs/importing-postgres.md:30
+#: ../../../docs/importing-postgres.md:35
 msgid "To import, run this command (make sure to replace `SERVER_PATH_TO_POSTGRES_DUMP_FILE` with a file path on your server):"
 msgstr ""
 
-#: ../../../docs/importing-postgres.md:40
+#: ../../../docs/importing-postgres.md:45
 msgid "`SERVER_PATH_TO_POSTGRES_DUMP_FILE` must be a file path to a Postgres dump file on the server (not on your local machine!)"
 msgstr ""
 
-#: ../../../docs/importing-postgres.md:41
+#: ../../../docs/importing-postgres.md:46
 msgid "`postgres_default_import_database` defaults to `matrix`, which is useful for importing multiple databases (for dumps made with `pg_dumpall`). If you're importing a single database (e.g. `synapse`), consider changing `postgres_default_import_database` accordingly"
 msgstr ""
 
-#: ../../../docs/importing-postgres.md:42
+#: ../../../docs/importing-postgres.md:47
 msgid "after importing a large database, it's a good idea to run [an `ANALYZE` operation](https://www.postgresql.org/docs/current/sql-analyze.html) to make Postgres rebuild its database statistics and optimize its query planner. You can easily do this via the playbook by running `just run-tags run-postgres-vacuum -e postgres_vacuum_preset=analyze` (see [Vacuuming PostgreSQL](maintenance-postgres.md#vacuuming-postgresql) for more details)."
 msgstr ""
 
-#: ../../../docs/importing-postgres.md:44
+#: ../../../docs/importing-postgres.md:49
 msgid "Troubleshooting"
 msgstr ""
 
-#: ../../../docs/importing-postgres.md:46
+#: ../../../docs/importing-postgres.md:51
 msgid "Table Ownership"
 msgstr ""
 
-#: ../../../docs/importing-postgres.md:48
+#: ../../../docs/importing-postgres.md:53
 msgid "A table ownership issue can occur if you are importing from a Synapse installation which was both:"
 msgstr ""
 
-#: ../../../docs/importing-postgres.md:50
+#: ../../../docs/importing-postgres.md:55
 msgid "migrated from SQLite to Postgres, and"
 msgstr ""
 
-#: ../../../docs/importing-postgres.md:51
+#: ../../../docs/importing-postgres.md:56
 msgid "used a username other than 'synapse'"
 msgstr ""
 
-#: ../../../docs/importing-postgres.md:53
+#: ../../../docs/importing-postgres.md:58
 msgid "In this case you may run into the following error during the import task:"
 msgstr ""
 
-#: ../../../docs/importing-postgres.md:59
+#: ../../../docs/importing-postgres.md:64
 msgid "where `synapse_user` is the database username from the previous Synapse installation."
 msgstr ""
 
-#: ../../../docs/importing-postgres.md:61
+#: ../../../docs/importing-postgres.md:66
 msgid "This can be verified by examining the dump for ALTER TABLE statements which set OWNER TO that username:"
 msgstr ""
 
-#: ../../../docs/importing-postgres.md:73
+#: ../../../docs/importing-postgres.md:78
 msgid "It can be worked around by changing the username to `synapse`, for example by using `sed`:"
 msgstr ""
 
-#: ../../../docs/importing-postgres.md:79
+#: ../../../docs/importing-postgres.md:84
 msgid "This uses sed to perform an 'in-place' (`-i`) replacement globally (`/g`), searching for `synapse_user` and replacing with `synapse` (`s/synapse_user/synapse`). If your database username was different, change `synapse_user` to that username instead. Expand search/replace statement as shown in example above, in case of old user name like `matrix` — replacing `matrix` only would… well — you can imagine."
 msgstr ""
 
-#: ../../../docs/importing-postgres.md:81
+#: ../../../docs/importing-postgres.md:86
 msgid "Note that if the previous import failed with an error it may have made changes which are incompatible with re-running the import task right away; if you do so it may fail with an error such as:"
 msgstr ""
 
-#: ../../../docs/importing-postgres.md:87
+#: ../../../docs/importing-postgres.md:92
 msgid "Repeat import"
 msgstr ""
 
-#: ../../../docs/importing-postgres.md:89
+#: ../../../docs/importing-postgres.md:94
 msgid "In this case you can use the command suggested in the import task to clear the database before retrying the import:"
 msgstr ""
 
-#: ../../../docs/importing-postgres.md:97
+#: ../../../docs/importing-postgres.md:102
 msgid "Now on your local machine run `just run-tags setup-postgres` to prepare the database roles etc."
 msgstr ""
 
-#: ../../../docs/importing-postgres.md:99
+#: ../../../docs/importing-postgres.md:104
 msgid "If not, you probably get this error. `synapse` is the correct table owner, but the role is missing in database."
 msgstr ""
 
-#: ../../../docs/importing-postgres.md:105
+#: ../../../docs/importing-postgres.md:110
 msgid "Once the database is clear and the ownership of the tables has been fixed in the SQL file, the import task should succeed."
 msgstr ""
 
-#: ../../../docs/importing-postgres.md:107
+#: ../../../docs/importing-postgres.md:112
 msgid "Check, if `--dbname` is set to `synapse` (not `matrix`) and replace paths (or even better, copy this line from your terminal)"
 msgstr ""
 
-#: ../../../docs/importing-postgres.md:113
+#: ../../../docs/importing-postgres.md:118
 msgid "Hints"
 msgstr ""
 
-#: ../../../docs/importing-postgres.md:115
+#: ../../../docs/importing-postgres.md:120
 msgid "To open psql terminal run `/matrix/postgres/bin/cli`"
 msgstr ""

i18n/translation-templates/docs/importing-synapse-media-store.pot

@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: matrix-docker-ansible-deploy \n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2026-02-13 10:32+0000\n"
+"POT-Creation-Date: 2026-07-15 04:33+0000\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"
@@ -33,25 +33,29 @@ msgid "Before doing the actual data restore, **you need to upload your media sto
 msgstr ""
 
 #: ../../../docs/importing-synapse-media-store.md:16
-msgid "If you are [storing Matrix media files on Amazon S3](configuring-playbook-s3.md) (optional), restoring with this tool is not possible right now."
+msgid "You also need the [rsync](https://rsync.samba.org/) utility installed **on the server**, as the import performs a server-side `rsync` synchronization. The playbook does not install it for you. On most distributions, it is available as a package called `rsync`."
 msgstr ""
 
 #: ../../../docs/importing-synapse-media-store.md:18
-msgid "As an alternative, you can perform a manual restore using the [AWS CLI tool](https://aws.amazon.com/cli/) (e.g. `aws s3 sync /path/to/server/media_store/. s3://name-of-bucket/`)"
+msgid "If you are [storing Matrix media files on Amazon S3](configuring-playbook-s3.md) (optional), restoring with this tool is not possible right now."
 msgstr ""
 
 #: ../../../docs/importing-synapse-media-store.md:20
-msgid "**Note for Mac users**: Due to case-sensitivity issues on certain Mac filesystems (HFS or HFS+), filename corruption may occur if you copy a `media_store` directory to your Mac. If you're transferring a `media_store` directory between 2 servers, make sure you do it directly (from server to server with a tool such as [rsync](https://rsync.samba.org/)), and not by downloading the files to your Mac."
+msgid "As an alternative, you can perform a manual restore using the [AWS CLI tool](https://aws.amazon.com/cli/) (e.g. `aws s3 sync /path/to/server/media_store/. s3://name-of-bucket/`)"
 msgstr ""
 
 #: ../../../docs/importing-synapse-media-store.md:22
-msgid "Importing"
+msgid "**Note for Mac users**: Due to case-sensitivity issues on certain Mac filesystems (HFS or HFS+), filename corruption may occur if you copy a `media_store` directory to your Mac. If you're transferring a `media_store` directory between 2 servers, make sure you do it directly (from server to server with a tool such as [rsync](https://rsync.samba.org/)), and not by downloading the files to your Mac."
 msgstr ""
 
 #: ../../../docs/importing-synapse-media-store.md:24
+msgid "Importing"
+msgstr ""
+
+#: ../../../docs/importing-synapse-media-store.md:26
 msgid "Run this command (make sure to replace `<server-path-to-media_store>` with a path on your server):"
 msgstr ""
 
-#: ../../../docs/importing-synapse-media-store.md:30
+#: ../../../docs/importing-synapse-media-store.md:32
 msgid "**Note**: `<server-path-to-media_store>` must be a file path to a `media_store` directory on the server (not on your local machine!)."
 msgstr ""

i18n/translation-templates/docs/maintenance-postgres.pot

@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: matrix-docker-ansible-deploy \n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2026-05-19 07:40+0000\n"
+"POT-Creation-Date: 2026-07-15 04:33+0000\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"
@@ -149,69 +149,73 @@ msgid "Restoring a backup made this way can be done by [importing it](importing-
 msgstr ""
 
 #: ../../../docs/maintenance-postgres.md:79
-msgid "Upgrading PostgreSQL"
+msgid "**Note for Synapse users**: the [official Synapse backup guide](https://element-hq.github.io/synapse/latest/usage/administration/backups.html) recommends that the `e2e_one_time_keys_json` table either not be backed up, or be truncated after restoring (before Synapse is started). The full-server dump command above does include it, so if you ever restore a backup that is older than the server's current state, remember to truncate that table as described in [the importing guide](importing-postgres.md)."
 msgstr ""
 
 #: ../../../docs/maintenance-postgres.md:81
-msgid "Unless you are using an [external Postgres server](configuring-playbook-external-postgres.md), this playbook initially installs Postgres for you."
+msgid "Upgrading PostgreSQL"
 msgstr ""
 
 #: ../../../docs/maintenance-postgres.md:83
-msgid "Once installed, the playbook attempts to preserve the Postgres version it starts with. This is because newer Postgres versions cannot start with data generated by older Postgres versions."
+msgid "Unless you are using an [external Postgres server](configuring-playbook-external-postgres.md), this playbook initially installs Postgres for you."
 msgstr ""
 
 #: ../../../docs/maintenance-postgres.md:85
-msgid "Upgrades must be performed manually."
+msgid "Once installed, the playbook attempts to preserve the Postgres version it starts with. This is because newer Postgres versions cannot start with data generated by older Postgres versions."
 msgstr ""
 
 #: ../../../docs/maintenance-postgres.md:87
+msgid "Upgrades must be performed manually."
+msgstr ""
+
+#: ../../../docs/maintenance-postgres.md:89
 msgid "The playbook can upgrade your existing Postgres setup with the following command:"
 msgstr ""
 
-#: ../../../docs/maintenance-postgres.md:93
+#: ../../../docs/maintenance-postgres.md:95
 msgid "**The old Postgres data directory is backed up** automatically, by renaming it to `/matrix/postgres/data-auto-upgrade-backup`. To rename to a different path, pass some extra flags to the command above, like this: `--extra-vars=\"postgres_auto_upgrade_backup_data_path=/another/disk/matrix-postgres-before-upgrade\"`"
 msgstr ""
 
-#: ../../../docs/maintenance-postgres.md:95
+#: ../../../docs/maintenance-postgres.md:97
 msgid "The auto-upgrade-backup directory stays around forever, until you **manually decide to delete it**."
 msgstr ""
 
-#: ../../../docs/maintenance-postgres.md:97
+#: ../../../docs/maintenance-postgres.md:99
 msgid "As part of the upgrade, the database is dumped to `/tmp`, an upgraded and empty Postgres server is started, and then the dump is restored into the new server. To use a different directory for the dump, pass some extra flags to the command above, like this: `--extra-vars=\"postgres_dump_dir=/directory/to/dump/here\"`"
 msgstr ""
 
-#: ../../../docs/maintenance-postgres.md:99
+#: ../../../docs/maintenance-postgres.md:101
 msgid "To save disk space in `/tmp`, the dump file is gzipped on the fly at the expense of CPU usage. If you have plenty of space in `/tmp` and would rather avoid gzipping, you can explicitly pass a dump filename which doesn't end in `.gz`. Example: `--extra-vars=\"postgres_dump_name=matrix-postgres-dump.sql\"`"
 msgstr ""
 
-#: ../../../docs/maintenance-postgres.md:101
+#: ../../../docs/maintenance-postgres.md:103
 msgid "**All databases, roles, etc. on the Postgres server are migrated**. However, other components that depend on specific Postgres versions (like the [Postgres Backup](configuring-playbook-postgres-backup.md) service) may need to be updated after the upgrade by using `just install-all`"
 msgstr ""
 
-#: ../../../docs/maintenance-postgres.md:103
+#: ../../../docs/maintenance-postgres.md:105
 msgid "Tuning PostgreSQL"
 msgstr ""
 
-#: ../../../docs/maintenance-postgres.md:105
+#: ../../../docs/maintenance-postgres.md:107
 msgid "PostgreSQL can be [tuned](https://wiki.postgresql.org/wiki/Tuning_Your_PostgreSQL_Server) to make it run faster. This is done by passing extra arguments to the Postgres process."
 msgstr ""
 
-#: ../../../docs/maintenance-postgres.md:107
+#: ../../../docs/maintenance-postgres.md:109
 msgid "The [Postgres Ansible role](https://github.com/mother-of-all-self-hosting/ansible-role-postgres) **already does some tuning by default**, which matches the [tuning logic](https://github.com/le0pard/pgtune/blob/master/src/features/configuration/configurationSlice.js) done by websites like https://pgtune.leopard.in.ua/. You can manually influence some of the tuning variables. These parameters (variables) are injected via the `postgres_postgres_process_extra_arguments_default` variable."
 msgstr ""
 
-#: ../../../docs/maintenance-postgres.md:109
+#: ../../../docs/maintenance-postgres.md:111
 msgid "Most users should be fine with the automatically-done tuning. However, you may wish to:"
 msgstr ""
 
-#: ../../../docs/maintenance-postgres.md:111
+#: ../../../docs/maintenance-postgres.md:113
 msgid "**adjust the automatically-determined tuning parameters manually**: change the values for the tuning variables defined in the Postgres role's [default configuration file](https://github.com/mother-of-all-self-hosting/ansible-role-postgres/blob/main/defaults/main.yml) (see `postgres_max_connections`, `postgres_data_storage` etc). These variables are ultimately passed to Postgres via a `postgres_postgres_process_extra_arguments_default` variable"
 msgstr ""
 
-#: ../../../docs/maintenance-postgres.md:113
+#: ../../../docs/maintenance-postgres.md:115
 msgid "**turn automatically-performed tuning off**: override it like this: `postgres_postgres_process_extra_arguments_default: []`"
 msgstr ""
 
-#: ../../../docs/maintenance-postgres.md:115
+#: ../../../docs/maintenance-postgres.md:117
 msgid "**add additional tuning parameters**: define your additional Postgres configuration parameters in `postgres_postgres_process_extra_arguments_custom`. See `postgres_postgres_process_extra_arguments_default` defined in the Postgres role's [default configuration file](https://github.com/mother-of-all-self-hosting/ansible-role-postgres/blob/main/defaults/main.yml) for inspiration"
 msgstr ""

i18n/translation-templates/docs/maintenance-synapse.pot

@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: matrix-docker-ansible-deploy \n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2026-05-19 07:40+0000\n"
+"POT-Creation-Date: 2026-07-15 04:33+0000\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"
@@ -192,14 +192,18 @@ msgstr ""
 msgid "You can **learn more about cache-autotuning and the global cache factor settings** in the [Synapse's documentation on caches and associated values](https://matrix-org.github.io/synapse/latest/usage/configuration/config_documentation.html#caches-and-associated-values)."
 msgstr ""
 
-#: ../../../docs/maintenance-synapse.md:108
+#: ../../../docs/maintenance-synapse.md:109
+msgid "These limits apply **per Synapse process**. If you have [workers](configuring-playbook-synapse.md#load-balancing-with-workers) enabled, the main process and every worker each apply the configured limits independently, so the theoretical aggregate cache memory usage gets multiplied by the number of processes. When running many workers on a memory-constrained server, consider setting these variables to lower, explicitly chosen values."
+msgstr ""
+
+#: ../../../docs/maintenance-synapse.md:111
 msgid "To **disable cache auto-tuning**, unset all values:"
 msgstr ""
 
-#: ../../../docs/maintenance-synapse.md:116
+#: ../../../docs/maintenance-synapse.md:119
 msgid "Users who wish to lower Synapse's RAM footprint should look into lowering the global cache factor and tweaking the autotune variables (or disabling auto-tuning). If your cache factor is too low for a given auto tune setting your caches will not reach autotune thresholds and autotune won't be able to do its job. Therefore, when auto-tuning is enabled (which it is by default), it's recommended to have your cache factor be large."
 msgstr ""
 
-#: ../../../docs/maintenance-synapse.md:118
+#: ../../../docs/maintenance-synapse.md:121
 msgid "See also [How do I optimize this setup for a low-power server?](faq.md#how-do-i-optimize-this-setup-for-a-low-power-server)."
 msgstr ""